* New upstream release (http://www.openssh.com/txt/release-6.2).

  - Add support for multiple required authentication in SSH protocol 2 via
    an AuthenticationMethods option (closes: #195716).
  - Fix Sophie Germain formula in moduli(5) (closes: #698612).
  - Update ssh-copy-id to Phil Hands' greatly revised version (closes:
    #99785, #322228, #620428; LP: #518883, #835901, #1074798).

149 files changed, 7337 insertions, 1927 deletions

diff --git a/ChangeLog b/ChangeLog
index f8e600847..dbd8b0aa9 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,673 @@
+20120322
+ - (djm) [contrib/ssh-copy-id contrib/ssh-copy-id.1] Updated to Phil
+   Hands' greatly revised version.
+ - (djm) Release 6.2p1
+
+20120318
+ - (djm) [configure.ac log.c scp.c sshconnect2.c openbsd-compat/vis.c]
+   [openbsd-compat/vis.h] FreeBSD's strnvis isn't compatible with OpenBSD's
+   so mark it as broken. Patch from des AT des.no
+
+20120317
+ - (tim) [configure.ac] OpenServer 5 wants lastlog even though it has none
+   of the bits the configure test looks for.
+
+20120316
+ - (djm) [configure.ac] Disable utmp, wtmp and/or lastlog if the platform
+   is unable to successfully compile them. Based on patch from des AT
+   des.no
+ - (djm) [configure.ac openbsd-compat/bsd-misc.c openbsd-compat/bsd-misc.h]
+   Add a usleep replacement for platforms that lack it; ok dtucker
+ - (djm) [session.c] FreeBSD needs setusercontext(..., LOGIN_SETUMASK) to
+   occur after UID switch; patch from John Marshall via des AT des.no;
+   ok dtucker@
+
+20120312
+ - (dtucker) [regress/Makefile regress/cipher-speed.sh regress/test-exec.sh]
+   Improve portability of cipher-speed test, based mostly on a patch from
+   Iain Morgan.
+ - (dtucker) [auth.c configure.ac platform.c platform.h] Accept uid 2 ("bin")
+   in addition to root as an owner of system directories on AIX and HP-UX.
+   ok djm@
+
+20130307
+ - (dtucker) [INSTALL] Bump documented autoconf version to what we're
+   currently using.
+ - (dtucker) [defines.h] Remove SIZEOF_CHAR bits since the test for it
+   was removed in configure.ac rev 1.481 as it was redundant.
+ - (tim) [Makefile.in] Add another missing $(EXEEXT) I should have seen 3 days
+   ago.
+ - (djm) [configure.ac] Add a timeout to the select/rlimit test to give it a
+   chance to complete on broken systems; ok dtucker@
+
+20130306
+ - (dtucker) [regress/forward-control.sh] Wait longer for the forwarding
+  connection to start so that the test works on slower machines.
+ - (dtucker) [configure.ac] test that we can set number of file descriptors
+   to zero with setrlimit before enabling the rlimit sandbox.  This affects
+   (at least) HPUX 11.11.
+
+20130305
+ - (djm) [regress/modpipe.c] Compilation fix for AIX and parsing fix for
+   HP/UX. Spotted by Kevin Brott
+ - (dtucker) [configure.ac] use "=" for shell test and not "==".  Spotted by
+   Amit Kulkarni and Kevin Brott.
+ - (dtucker) [Makefile.in] Remove trailing "\" on PATHS, which caused obscure
+   build breakage on (at least) HP-UX 11.11.  Found by Amit Kulkarni and Kevin
+   Brott.
+ - (tim) [Makefile.in] Add missing $(EXEEXT). Found by Roumen Petrov.
+
+20130227
+ - (djm) [README contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
+   [contrib/suse/openssh.spec] Crank version numbers
+ - (tim) [regress/forward-control.sh] use sh in case login shell is csh.
+ - (tim) [regress/integrity.sh] shell portability fix.
+ - (tim) [regress/integrity.sh] keep old solaris awk from hanging.
+ - (tim) [regress/krl.sh] keep old solaris awk from hanging.
+
+20130226
+ - OpenBSD CVS Sync
+   - djm@cvs.openbsd.org 2013/02/20 08:27:50
+     [integrity.sh]
+     Add an option to modpipe that warns if the modification offset it not
+     reached in it's stream and turn it on for t-integrity. This should catch
+     cases where the session is not fuzzed for being too short (cf. my last
+     "oops" commit)
+ - (djm) [regress/integrity.sh] Run sshd via $SUDO; fixes tinderbox breakage
+   for UsePAM=yes configuration
+
+20130225
+ - (dtucker) [configure.ac ssh-gss.h] bz#2073: additional #includes needed
+   to use Solaris native GSS libs.  Patch from Pierre Ossman.
+
+20130223
+ - (djm) [configure.ac includes.h loginrec.c mux.c sftp.c] Prefer
+   bsd/libutil.h to libutil.h to avoid deprecation warnings on Ubuntu.
+   ok tim
+
+20130222
+ - (dtucker) [Makefile.in configure.ac] bz#2072: don't link krb5 libs to
+   ssh(1) since they're not needed.  Patch from Pierre Ossman, ok djm.
+ - (dtucker) [configure.ac] bz#2073: look for Solaris' differently-named
+   libgss too.  Patch from Pierre Ossman, ok djm.
+ - (djm) [configure.ac sandbox-seccomp-filter.c] Support for Linux
+   seccomp-bpf sandbox on ARM. Patch from shawnlandden AT gmail.com;
+   ok dtucker
+
+20130221
+ - (tim) [regress/forward-control.sh] shell portability fix.
+
+20130220
+ - (tim) [regress/cipher-speed.sh regress/try-ciphers.sh] shell portability fix.
+ - (tim) [krl.c Makefile.in regress/Makefile regress/modpipe.c] remove unneeded
+   err.h include from krl.c. Additional portability fixes for modpipe. OK djm
+ - OpenBSD CVS Sync
+   - djm@cvs.openbsd.org 2013/02/20 08:27:50
+     [regress/integrity.sh regress/modpipe.c]
+     Add an option to modpipe that warns if the modification offset it not
+     reached in it's stream and turn it on for t-integrity. This should catch
+     cases where the session is not fuzzed for being too short (cf. my last
+     "oops" commit)
+   - djm@cvs.openbsd.org 2013/02/20 08:29:27
+     [regress/modpipe.c]
+     s/Id/OpenBSD/ in RCS tag
+
+20130219
+ - OpenBSD CVS Sync
+   - djm@cvs.openbsd.org 2013/02/18 22:26:47
+     [integrity.sh]
+     crank the offset yet again; it was still fuzzing KEX one of Darren's
+     portable test hosts at 2800
+   - djm@cvs.openbsd.org 2013/02/19 02:14:09
+     [integrity.sh]
+     oops, forgot to increase the output of the ssh command to ensure that
+     we actually reach $offset
+ - (djm) [regress/integrity.sh] Skip SHA2-based MACs on configurations that
+   lack support for SHA2.
+ - (djm) [regress/modpipe.c] Add local err, and errx functions for platforms
+   that do not have them.
+
+20130217
+ - OpenBSD CVS Sync
+   - djm@cvs.openbsd.org 2013/02/17 23:16:55
+     [integrity.sh]
+     make the ssh command generates some output to ensure that there are at
+     least offset+tries bytes in the stream.
+
+20130216
+ - OpenBSD CVS Sync
+   - djm@cvs.openbsd.org 2013/02/16 06:08:45
+     [integrity.sh]
+     make sure the fuzz offset is actually past the end of KEX for all KEX
+     types. diffie-hellman-group-exchange-sha256 requires an offset around
+     2700. Noticed via test failures in portable OpenSSH on platforms that
+     lack ECC and this the more byte-frugal ECDH KEX algorithms.
+
+20130215
+ - (djm) [contrib/suse/rc.sshd] Use SSHD_BIN consistently; bz#2056 from
+   Iain Morgan
+ - (dtucker) [configure.ac openbsd-compat/bsd-misc.c openbsd-compat/bsd-misc.h]
+   Use getpgrp() if we don't have getpgid() (old BSDs, maybe others).
+ - (dtucker) [configure.ac openbsd-compat/Makefile.in openbsd-compat/strtoull.c
+   openbsd-compat/openbsd-compat.h] Add strtoull to compat library for
+   platforms that don't have it.
+ - (dtucker) [openbsd-compat/openbsd-compat.h] Add prototype for strtoul,
+   group strto* function prototypes together.
+ - (dtucker) [openbsd-compat/bsd-misc.c] Handle the case where setpgrp() takes
+   an argument.  Pointed out by djm.
+ - (djm) OpenBSD CVS Sync
+   - djm@cvs.openbsd.org 2013/02/14 21:35:59
+     [auth2-pubkey.c]
+     Correct error message that had a typo and was logging the wrong thing;
+     patch from Petr Lautrbach
+   - dtucker@cvs.openbsd.org 2013/02/15 00:21:01
+     [sshconnect2.c]
+     Warn more loudly if an IdentityFile provided by the user cannot be read.
+     bz #1981, ok djm@
+
+20130214
+ - (djm) [regress/krl.sh] Don't use ecdsa keys in environment that lack ECC.
+ - (djm) [regress/krl.sh] typo; found by Iain Morgan
+ - (djm) [regress/integrity.sh] Start fuzzing from offset 2500 (instead
+   of 2300) to avoid clobbering the end of (non-MAC'd) KEX. Verified by
+   Iain Morgan
+
+20130212
+ - (djm) OpenBSD CVS Sync
+   - djm@cvs.openbsd.org 2013/01/24 21:45:37
+     [krl.c]
+     fix handling of (unused) KRL signatures; skip string in correct buffer
+   - djm@cvs.openbsd.org 2013/01/24 22:08:56
+     [krl.c]
+     skip serial lookup when cert's serial number is zero
+   - krw@cvs.openbsd.org 2013/01/25 05:00:27
+     [krl.c]
+     Revert last. Breaks due to likely typo. Let djm@ fix later.
+     ok djm@ via dlg@
+   - djm@cvs.openbsd.org 2013/01/25 10:22:19
+     [krl.c]
+     redo last commit without the vi-vomit that snuck in:
+     skip serial lookup when cert's serial number is zero
+     (now with 100% better comment)
+   - djm@cvs.openbsd.org 2013/01/26 06:11:05
+     [Makefile.in acss.c acss.h cipher-acss.c cipher.c]
+     [openbsd-compat/openssl-compat.h]
+     remove ACSS, now that it is gone from libcrypto too
+   - djm@cvs.openbsd.org 2013/01/27 10:06:12
+     [krl.c]
+     actually use the xrealloc() return value; spotted by xi.wang AT gmail.com
+   - dtucker@cvs.openbsd.org 2013/02/06 00:20:42
+     [servconf.c sshd_config sshd_config.5]
+     Change default of MaxStartups to 10:30:100 to start doing random early
+     drop at 10 connections up to 100 connections.  This will make it harder
+     to DoS as CPUs have come a long way since the original value was set
+     back in 2000.  Prompted by nion at debian org, ok markus@
+   - dtucker@cvs.openbsd.org 2013/02/06 00:22:21
+     [auth.c]
+     Fix comment, from jfree.e1 at gmail
+   - djm@cvs.openbsd.org 2013/02/08 00:41:12
+     [sftp.c]
+     fix NULL deref when built without libedit and control characters
+     entered as command; debugging and patch from Iain Morgan an
+     Loganaden Velvindron in bz#1956
+   - markus@cvs.openbsd.org 2013/02/10 21:19:34
+     [version.h]
+     openssh 6.2
+   - djm@cvs.openbsd.org 2013/02/10 23:32:10
+     [ssh-keygen.c]
+     append to moduli file when screening candidates rather than overwriting.
+     allows resumption of interrupted screen; patch from Christophe Garault
+     in bz#1957; ok dtucker@
+   - djm@cvs.openbsd.org 2013/02/10 23:35:24
+     [packet.c]
+     record "Received disconnect" messages at ERROR rather than INFO priority,
+     since they are abnormal and result in a non-zero ssh exit status; patch
+     from Iain Morgan in bz#2057; ok dtucker@
+   - dtucker@cvs.openbsd.org 2013/02/11 21:21:58
+     [sshd.c]
+     Add openssl version to debug output similar to the client.  ok markus@
+   - djm@cvs.openbsd.org 2013/02/11 23:58:51
+     [regress/try-ciphers.sh]
+     remove acss here too
+ - (djm) [regress/try-ciphers.sh] clean up CVS merge botch
+
+20130211
+ - (djm) [configure.ac openbsd-compat/openssl-compat.h] Repair build on old
+   libcrypto that lacks EVP_CIPHER_CTX_ctrl
+
+20130208
+ - (djm) [contrib/redhat/sshd.init] treat RETVAL as an integer;
+   patch from Iain Morgan in bz#2059
+ - (dtucker) [configure.ac openbsd-compat/sys-tree.h] Test if compiler allows
+   __attribute__ on return values and work around if necessary.  ok djm@
+
+20130207
+ - (djm) [configure.ac] Don't probe seccomp capability of running kernel
+   at configure time; the seccomp sandbox will fall back to rlimit at
+   runtime anyway. Patch from plautrba AT redhat.com in bz#2011
+
+20130120
+ - (djm) [cipher-aes.c cipher-ctr.c openbsd-compat/openssl-compat.h]
+   Move prototypes for replacement ciphers to openssl-compat.h; fix EVP
+   prototypes for openssl-1.0.0-fips.
+ - (djm) OpenBSD CVS Sync
+   - jmc@cvs.openbsd.org 2013/01/18 07:57:47
+     [ssh-keygen.1]
+     tweak previous;
+   - jmc@cvs.openbsd.org 2013/01/18 07:59:46
+     [ssh-keygen.c]
+     -u before -V in usage();
+   - jmc@cvs.openbsd.org 2013/01/18 08:00:49
+     [sshd_config.5]
+     tweak previous;
+   - jmc@cvs.openbsd.org 2013/01/18 08:39:04
+     [ssh-keygen.1]
+     add -Q to the options list; ok djm
+   - jmc@cvs.openbsd.org 2013/01/18 21:48:43
+     [ssh-keygen.1]
+     command-line (adj.) -> command line (n.);
+   - jmc@cvs.openbsd.org 2013/01/19 07:13:25
+     [ssh-keygen.1]
+     fix some formatting; ok djm
+   - markus@cvs.openbsd.org 2013/01/19 12:34:55
+     [krl.c]
+     RB_INSERT does not remove existing elments; ok djm@
+ - (djm) [openbsd-compat/sys-tree.h] Sync with OpenBSD. krl.c needs newer
+   version.
+ - (djm) [regress/krl.sh] replacement for jot; most platforms lack it
+
+20130118
+ - (djm) OpenBSD CVS Sync
+   - djm@cvs.openbsd.org 2013/01/17 23:00:01
+     [auth.c key.c key.h ssh-keygen.1 ssh-keygen.c sshd_config.5]
+     [krl.c krl.h PROTOCOL.krl]
+     add support for Key Revocation Lists (KRLs). These are a compact way to
+     represent lists of revoked keys and certificates, taking as little as
+     a single bit of incremental cost to revoke a certificate by serial number.
+     KRLs are loaded via the existing RevokedKeys sshd_config option.
+     feedback and ok markus@
+   - djm@cvs.openbsd.org 2013/01/18 00:45:29
+     [regress/Makefile regress/cert-userkey.sh regress/krl.sh]
+     Tests for Key Revocation Lists (KRLs)
+   - djm@cvs.openbsd.org 2013/01/18 03:00:32
+     [krl.c]
+     fix KRL generation bug for list sections
+
+20130117
+ - (djm) [regress/cipher-speed.sh regress/integrity.sh regress/try-ciphers.sh]
+   check for GCM support before testing GCM ciphers.
+
+20130112
+ - (djm) OpenBSD CVS Sync
+   - djm@cvs.openbsd.org 2013/01/12 11:22:04
+     [cipher.c]
+     improve error message for integrity failure in AES-GCM modes; ok markus@
+   - djm@cvs.openbsd.org 2013/01/12 11:23:53
+     [regress/cipher-speed.sh regress/integrity.sh regress/try-ciphers.sh]
+     test AES-GCM modes; feedback markus@
+ - (djm) [regress/integrity.sh] repair botched merge
+
+20130109
+ - (djm) OpenBSD CVS Sync
+   - dtucker@cvs.openbsd.org 2012/12/14 05:26:43
+     [auth.c]
+     use correct string in error message; from rustybsd at gmx.fr
+   - djm@cvs.openbsd.org 2013/01/02 00:32:07
+     [clientloop.c mux.c]
+     channel_setup_local_fwd_listener() returns 0 on failure, not -ve
+     bz#2055 reported by mathieu.lacage AT gmail.com
+   - djm@cvs.openbsd.org 2013/01/02 00:33:49
+     [PROTOCOL.agent]
+     correct format description for SSH_AGENTC_ADD_RSA_ID_CONSTRAINED
+     bz#2051 from david AT lechnology.com
+   - djm@cvs.openbsd.org 2013/01/03 05:49:36
+     [servconf.h]
+     add a couple of ServerOptions members that should be copied to the privsep
+     child (for consistency, in this case they happen only to be accessed in
+     the monitor); ok dtucker@
+   - djm@cvs.openbsd.org 2013/01/03 12:49:01
+     [PROTOCOL]
+     fix description of MAC calculation for EtM modes; ok markus@
+   - djm@cvs.openbsd.org 2013/01/03 12:54:49
+     [sftp-server.8 sftp-server.c]
+     allow specification of an alternate start directory for sftp-server(8)
+     "I like this" markus@
+   - djm@cvs.openbsd.org 2013/01/03 23:22:58
+     [ssh-keygen.c]
+     allow fingerprinting of keys hosted in PKCS#11 tokens: ssh-keygen -lD ...
+     ok markus@
+   - jmc@cvs.openbsd.org 2013/01/04 19:26:38
+     [sftp-server.8 sftp-server.c]
+     sftp-server.8: add argument name to -d
+     sftp-server.c: add -d to usage()
+     ok djm
+   - markus@cvs.openbsd.org 2013/01/08 18:49:04
+     [PROTOCOL authfile.c cipher.c cipher.h kex.c kex.h monitor_wrap.c]
+     [myproposal.h packet.c ssh_config.5 sshd_config.5]
+     support AES-GCM as defined in RFC 5647 (but with simpler KEX handling)
+     ok and feedback djm@
+   - djm@cvs.openbsd.org 2013/01/09 05:40:17
+     [ssh-keygen.c]
+     correctly initialise fingerprint type for fingerprinting PKCS#11 keys
+ - (djm) [cipher.c configure.ac openbsd-compat/openssl-compat.h]
+   Fix merge botch, automatically detect AES-GCM in OpenSSL, move a little
+   cipher compat code to openssl-compat.h
+
+20121217
+ - (dtucker) [Makefile.in] Add some scaffolding so that the new regress
+   tests will work with VPATH directories.
+
+20121213
+ - (djm) OpenBSD CVS Sync
+   - markus@cvs.openbsd.org 2012/12/12 16:45:52
+     [packet.c]
+     reset incoming_packet buffer for each new packet in EtM-case, too;
+     this happens if packets are parsed only parially (e.g. ignore
+     messages sent when su/sudo turn off echo); noted by sthen/millert
+   - naddy@cvs.openbsd.org 2012/12/12 16:46:10
+     [cipher.c]
+     use OpenSSL's EVP_aes_{128,192,256}_ctr() API and remove our hand-rolled
+     counter mode code; ok djm@
+ - (djm) [configure.ac cipher-ctr.c] Adapt EVP AES CTR change to retain our
+   compat code for older OpenSSL
+ - (djm) [cipher.c] Fix missing prototype for compat code
+
+20121212
+ - (djm) OpenBSD CVS Sync
+   - markus@cvs.openbsd.org 2012/12/11 22:16:21
+     [monitor.c]
+     drain the log messages after receiving the keystate from the unpriv
+     child. otherwise it might block while sending. ok djm@
+   - markus@cvs.openbsd.org 2012/12/11 22:31:18
+     [PROTOCOL authfile.c cipher.c cipher.h kex.h mac.c myproposal.h]
+     [packet.c ssh_config.5 sshd_config.5]
+     add encrypt-then-mac (EtM) modes to openssh by defining new mac algorithms
+     that change the packet format and compute the MAC over the encrypted
+     message (including the packet size) instead of the plaintext data;
+     these EtM modes are considered more secure and used by default.
+     feedback and ok djm@
+   - sthen@cvs.openbsd.org 2012/12/11 22:51:45
+     [mac.c]
+     fix typo, s/tem/etm in hmac-ripemd160-tem. ok markus@
+   - markus@cvs.openbsd.org 2012/12/11 22:32:56
+     [regress/try-ciphers.sh]
+     add etm modes
+   - markus@cvs.openbsd.org 2012/12/11 22:42:11
+     [regress/Makefile regress/modpipe.c regress/integrity.sh]
+     test the integrity of the packets; with djm@
+   - markus@cvs.openbsd.org 2012/12/11 23:12:13
+     [try-ciphers.sh]
+     add hmac-ripemd160-etm@openssh.com
+ - (djm) [mac.c] fix merge botch
+ - (djm) [regress/Makefile regress/integrity.sh] Make the integrity.sh test
+   work on platforms without 'jot'
+ - (djm) [regress/integrity.sh] Fix awk quoting, packet length skip
+ - (djm) [regress/Makefile] fix t-exec rule
+
+20121207
+ - (dtucker) OpenBSD CVS Sync
+   - dtucker@cvs.openbsd.org 2012/12/06 06:06:54
+     [regress/keys-command.sh]
+     Fix some problems with the keys-command test:
+      - use string comparison rather than numeric comparison
+      - check for existing KEY_COMMAND file and don't clobber if it exists
+      - clean up KEY_COMMAND file if we do create it.
+      - check that KEY_COMMAND is executable (which it won't be if eg /var/run
+        is mounted noexec).
+     ok djm.
+   - jmc@cvs.openbsd.org 2012/12/03 08:33:03
+     [ssh-add.1 sshd_config.5]
+     tweak previous;
+   - markus@cvs.openbsd.org 2012/12/05 15:42:52
+     [ssh-add.c]
+     prevent double-free of comment; ok djm@
+   - dtucker@cvs.openbsd.org 2012/12/07 01:51:35
+     [serverloop.c]
+     Cast signal to int for logging.  A no-op on openbsd (they're always ints)
+     but will prevent warnings in portable.  ok djm@
+
+20121205
+ - (tim) [defines.h] Some platforms are missing ULLONG_MAX. Feedback djm@.
+
+20121203
+ - (djm) [openbsd-compat/sys-queue.h] Sync with OpenBSD to get
+   TAILQ_FOREACH_SAFE needed for upcoming changes.
+ - (djm) OpenBSD CVS Sync
+   - djm@cvs.openbsd.org 2012/12/02 20:26:11
+     [ssh_config.5 sshconnect2.c]
+     Make IdentitiesOnly apply to keys obtained from a PKCS11Provider.
+     This allows control of which keys are offered from tokens using
+     IdentityFile. ok markus@
+   - djm@cvs.openbsd.org 2012/12/02 20:42:15
+     [ssh-add.1 ssh-add.c]
+     make deleting explicit keys "ssh-add -d" symmetric with adding keys -
+     try to delete the corresponding certificate too and respect the -k option
+     to allow deleting of the key only; feedback and ok markus@
+   - djm@cvs.openbsd.org 2012/12/02 20:46:11
+     [auth-options.c channels.c servconf.c servconf.h serverloop.c session.c]
+     [sshd_config.5]
+     make AllowTcpForwarding accept "local" and "remote" in addition to its
+     current "yes"/"no" to allow the server to specify whether just local or
+     remote TCP forwarding is enabled. ok markus@
+   - dtucker@cvs.openbsd.org 2012/10/05 02:20:48
+     [regress/cipher-speed.sh regress/try-ciphers.sh]
+     Add umac-128@openssh.com to the list of MACs to be tested
+   - djm@cvs.openbsd.org 2012/10/19 05:10:42
+     [regress/cert-userkey.sh]
+     include a serial number when generating certs
+   - djm@cvs.openbsd.org 2012/11/22 22:49:30
+     [regress/Makefile regress/keys-command.sh]
+     regress for AuthorizedKeysCommand; hints from markus@
+   - djm@cvs.openbsd.org 2012/12/02 20:47:48
+     [Makefile regress/forward-control.sh]
+     regress for AllowTcpForwarding local/remote; ok markus@
+   - djm@cvs.openbsd.org 2012/12/03 00:14:06
+     [auth2-chall.c ssh-keygen.c]
+     Fix compilation with -Wall -Werror (trivial type fixes)
+ - (djm) [configure.ac] Turn on -g for gcc compilers. Helps pre-installation
+   debugging. ok dtucker@
+ - (djm) [configure.ac] Revert previous. configure.ac already does this
+   for us.
+
+20121114
+ - (djm) OpenBSD CVS Sync
+   - djm@cvs.openbsd.org 2012/11/14 02:24:27
+     [auth2-pubkey.c]
+     fix username passed to helper program
+     prepare stdio fds before closefrom()
+     spotted by landry@
+   - djm@cvs.openbsd.org 2012/11/14 02:32:15
+     [ssh-keygen.c]
+     allow the full range of unsigned serial numbers; 'fine' deraadt@
+   - djm@cvs.openbsd.org 2012/12/02 20:34:10
+     [auth.c auth.h auth1.c auth2-chall.c auth2-gss.c auth2-jpake.c auth2.c]
+     [monitor.c monitor.h]
+     Fixes logging of partial authentication when privsep is enabled
+     Previously, we recorded "Failed xxx" since we reset authenticated before
+     calling auth_log() in auth2.c. This adds an explcit "Partial" state.
+     
+     Add a "submethod" to auth_log() to report which submethod is used
+     for keyboard-interactive.
+     
+     Fix multiple authentication when one of the methods is
+     keyboard-interactive.
+     
+     ok markus@
+   - dtucker@cvs.openbsd.org 2012/10/05 02:05:30
+     [regress/multiplex.sh]
+     Use 'kill -0' to test for the presence of a pid since it's more portable
+
+20121107
+ - (djm) OpenBSD CVS Sync
+   - eric@cvs.openbsd.org 2011/11/28 08:46:27
+     [moduli.5]
+     fix formula
+     ok djm@
+   - jmc@cvs.openbsd.org 2012/09/26 17:34:38
+     [moduli.5]
+     last stage of rfc changes, using consistent Rs/Re blocks, and moving the
+     references into a STANDARDS section;
+
+20121105
+ - (dtucker) [uidswap.c openbsd-compat/Makefile.in
+   openbsd-compat/bsd-setres_id.c openbsd-compat/bsd-setres_id.h
+   openbsd-compat/openbsd-compat.h]  Move the fallback code for setting uids
+   and gids from uidswap.c to the compat library, which allows it to work with
+   the new setresuid calls in auth2-pubkey.  with tim@, ok djm@
+ - (dtucker) [auth2-pubkey.c] wrap paths.h in an ifdef for platforms that
+   don't have it.  Spotted by tim@.
+
+20121104
+ - (djm) OpenBSD CVS Sync
+   - jmc@cvs.openbsd.org 2012/10/31 08:04:50
+     [sshd_config.5]
+     tweak previous;
+   - djm@cvs.openbsd.org 2012/11/04 10:38:43
+     [auth2-pubkey.c sshd.c sshd_config.5]
+     Remove default of AuthorizedCommandUser. Administrators are now expected
+     to explicitly specify a user. feedback and ok markus@
+   - djm@cvs.openbsd.org 2012/11/04 11:09:15
+     [auth.h auth1.c auth2.c monitor.c servconf.c servconf.h sshd.c]
+     [sshd_config.5]
+     Support multiple required authentication via an AuthenticationMethods
+     option. This option lists one or more comma-separated lists of
+     authentication method names. Successful completion of all the methods in
+     any list is required for authentication to complete;
+     feedback and ok markus@
+
+20121030
+ - (djm) OpenBSD CVS Sync
+   - markus@cvs.openbsd.org 2012/10/05 12:34:39
+     [sftp.c]
+     fix signed vs unsigned warning; feedback & ok: djm@
+   - djm@cvs.openbsd.org 2012/10/30 21:29:55
+     [auth-rsa.c auth.c auth.h auth2-pubkey.c servconf.c servconf.h]
+     [sshd.c sshd_config sshd_config.5]
+     new sshd_config option AuthorizedKeysCommand to support fetching
+     authorized_keys from a command in addition to (or instead of) from
+     the filesystem. The command is run as the target server user unless
+     another specified via a new AuthorizedKeysCommandUser option.
+     
+     patch originally by jchadima AT redhat.com, reworked by me; feedback
+     and ok markus@
+
+20121019
+ - (tim) [buildpkg.sh.in] Double up on some backslashes so they end up in
+   the generated file as intended.
+
+20121005
+ - (dtucker) OpenBSD CVS Sync
+   - djm@cvs.openbsd.org 2012/09/17 09:54:44
+     [sftp.c]
+     an XXX for later
+   - markus@cvs.openbsd.org 2012/09/17 13:04:11
+     [packet.c]
+     clear old keys on rekeing; ok djm
+   - dtucker@cvs.openbsd.org 2012/09/18 10:36:12
+     [sftp.c]
+     Add bounds check on sftp tab-completion.  Part of a patch from from
+     Jean-Marc Robert via tech@, ok djm
+   - dtucker@cvs.openbsd.org 2012/09/21 10:53:07
+     [sftp.c]
+     Fix improper handling of absolute paths when PWD is part of the completed
+     path.  Patch from Jean-Marc Robert via tech@, ok djm.
+  - dtucker@cvs.openbsd.org 2012/09/21 10:55:04
+     [sftp.c]
+     Fix handling of filenames containing escaped globbing characters and
+     escape "#" and "*".  Patch from Jean-Marc Robert via tech@, ok djm.
+   - jmc@cvs.openbsd.org 2012/09/26 16:12:13
+     [ssh.1]
+     last stage of rfc changes, using consistent Rs/Re blocks, and moving the
+     references into a STANDARDS section;
+   - naddy@cvs.openbsd.org 2012/10/01 13:59:51
+     [monitor_wrap.c]
+     pasto; ok djm@
+   - djm@cvs.openbsd.org 2012/10/02 07:07:45
+     [ssh-keygen.c]
+     fix -z option, broken in revision 1.215
+   - markus@cvs.openbsd.org 2012/10/04 13:21:50
+     [myproposal.h ssh_config.5 umac.h sshd_config.5 ssh.1 sshd.8 mac.c]
+     add umac128 variant; ok djm@ at n2k12
+  - dtucker@cvs.openbsd.org 2012/09/06 04:11:07
+     [regress/try-ciphers.sh]
+     Restore missing space.  (Id sync only).
+   - dtucker@cvs.openbsd.org 2012/09/09 11:51:25
+     [regress/multiplex.sh]
+     Add test for ssh -Ostop
+   - dtucker@cvs.openbsd.org 2012/09/10 00:49:21
+     [regress/multiplex.sh]
+     Log -O cmd output to the log file and make logging consistent with the
+     other tests.  Test clean shutdown of an existing channel when testing
+     "stop".
+   - dtucker@cvs.openbsd.org 2012/09/10 01:51:19
+     [regress/multiplex.sh]
+     use -Ocheck and waiting for completions by PID to make multiplexing test
+     less racy and (hopefully) more reliable on slow hardware.
+ - [Makefile umac.c] Add special-case target to build umac128.o.
+ - [umac.c] Enforce allowed umac output sizes.  From djm@.
+ - [Makefile.in] "Using $< in a non-suffix rule context is a GNUmake idiom".
+
+20120917
+ - (dtucker) OpenBSD CVS Sync
+   - dtucker@cvs.openbsd.org 2012/09/13 23:37:36
+     [servconf.c]
+     Fix comment line length
+   - markus@cvs.openbsd.org 2012/09/14 16:51:34
+     [sshconnect.c]
+     remove unused variable
+
+20120907
+ - (dtucker) OpenBSD CVS Sync
+   - dtucker@cvs.openbsd.org 2012/09/06 09:50:13
+     [clientloop.c]
+     Make the escape command help (~?) context sensitive so that only commands
+     that will work in the current session are shown.  ok markus@
+   - jmc@cvs.openbsd.org 2012/09/06 13:57:42
+     [ssh.1]
+     missing letter in previous;
+   - dtucker@cvs.openbsd.org 2012/09/07 00:30:19
+     [clientloop.c]
+     Print '^Z' instead of a raw ^Z when the sequence is not supported.  ok djm@
+   - dtucker@cvs.openbsd.org 2012/09/07 01:10:21
+     [clientloop.c]
+     Merge escape help text for ~v and ~V; ok djm@
+   - dtucker@cvs.openbsd.org 2012/09/07 06:34:21
+     [clientloop.c]
+     when muxmaster is run with -N, make it shut down gracefully when a client
+     sends it "-O stop" rather than hanging around (bz#1985).  ok djm@
+
+20120906
+ - (dtucker) OpenBSD CVS Sync
+   - jmc@cvs.openbsd.org 2012/08/15 18:25:50
+     [ssh-keygen.1]
+     a little more info on certificate validity;
+     requested by Ross L Richardson, and provided by djm
+   - dtucker@cvs.openbsd.org 2012/08/17 00:45:45
+     [clientloop.c clientloop.h mux.c]
+     Force a clean shutdown of ControlMaster client sessions when the ~. escape
+     sequence is used.  This means that ~. should now work in mux clients even
+     if the server is no longer responding.  Found by tedu, ok djm.
+   - djm@cvs.openbsd.org 2012/08/17 01:22:56
+     [kex.c]
+     add some comments about better handling first-KEX-follows notifications
+     from the server. Nothing uses these right now. No binary change
+   - djm@cvs.openbsd.org 2012/08/17 01:25:58
+     [ssh-keygen.c]
+     print details of which host lines were deleted when using
+     "ssh-keygen -R host"; ok markus@
+   - djm@cvs.openbsd.org 2012/08/17 01:30:00
+     [compat.c sshconnect.c]
+     Send client banner immediately, rather than waiting for the server to
+     move first for SSH protocol 2 connections (the default). Patch based on
+     one in bz#1999 by tls AT panix.com, feedback dtucker@ ok markus@
+   - dtucker@cvs.openbsd.org 2012/09/06 04:37:39
+     [clientloop.c log.c ssh.1 log.h]
+     Add ~v and ~V escape sequences to raise and lower the logging level
+     respectively. Man page help from jmc, ok deraadt jmc
+
+20120830
+ - (dtucker) [moduli] Import new moduli file.
+
 20120828
  - (djm) Release openssh-6.1
 
@@ -172,6 +842,7 @@
      [dns.c dns.h key.c key.h ssh-keygen.c]
      add support for RFC6594 SSHFP DNS records for ECDSA key types.
      patch from bugzilla-m67 AT nulld.me in bz#1978; ok + tweak markus@
+     (Original authors Ondřej Surý,  Ondřej Caletka and Daniel Black)
    - djm@cvs.openbsd.org 2012/06/01 00:49:35
      [PROTOCOL.mux]
      correct types of port numbers (integers, not strings); bz#2004 from
diff --git a/INSTALL b/INSTALL
index 7c6046932..576723048 100644
--- a/INSTALL
+++ b/INSTALL
@@ -89,7 +89,7 @@ http://nlnetlabs.nl/projects/ldns/
 Autoconf:
 
 If you modify configure.ac or configure doesn't exist (eg if you checked
-the code out of CVS yourself) then you will need autoconf-2.61 to rebuild
+the code out of CVS yourself) then you will need autoconf-2.68 to rebuild
 the automatically generated files by running "autoreconf".  Earlier
 versions may also work but this is not guaranteed.
 
@@ -266,4 +266,4 @@ Please refer to the "reporting bugs" section of the webpage at
 http://www.openssh.com/
 
 
-$Id: INSTALL,v 1.87 2011/11/04 00:25:25 dtucker Exp $
+$Id: INSTALL,v 1.88 2013/03/07 01:33:35 dtucker Exp $
diff --git a/Makefile.in b/Makefile.in
index 9a286a390..5b2431d4a 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -1,4 +1,4 @@
-# $Id: Makefile.in,v 1.326 2012/04/04 01:27:57 djm Exp $
+# $Id: Makefile.in,v 1.336 2013/03/07 15:37:13 tim Exp $
 
 # uncomment if you run a non bourne compatable shell. Ie. csh
 #SHELL = @SH@
@@ -39,13 +39,15 @@ PATHS= -DSSHDIR=\"$(sysconfdir)\" \
         -D_PATH_SSH_PKCS11_HELPER=\"$(SSH_PKCS11_HELPER)\" \
         -D_PATH_SSH_PIDDIR=\"$(piddir)\" \
         -D_PATH_PRIVSEP_CHROOT_DIR=\"$(PRIVSEP_PATH)\" \
-        -D_PATH_SSH_DATADIR=\"$(SSH_DATADIR)\" \
+        -D_PATH_SSH_DATADIR=\"$(SSH_DATADIR)\"
 
 CC=@CC@
 LD=@LD@
 CFLAGS=@CFLAGS@
 CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ $(PATHS) @DEFS@
 LIBS=@LIBS@
+K5LIBS=@K5LIBS@
+GSSLIBS=@GSSLIBS@
 SSHLIBS=@SSHLIBS@
 SSHDLIBS=@SSHDLIBS@
 LIBEDIT=@LIBEDIT@
@@ -63,8 +65,8 @@ MANFMT=@MANFMT@
 
 TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-vulnkey$(EXEEXT)
 
-LIBSSH_OBJS=acss.o authfd.o authfile.o bufaux.o bufbn.o buffer.o \
-        canohost.o channels.o cipher.o cipher-acss.o cipher-aes.o \
+LIBSSH_OBJS=authfd.o authfile.o bufaux.o bufbn.o buffer.o \
+        canohost.o channels.o cipher.o cipher-aes.o \
         cipher-bf1.o cipher-ctr.o cipher-3des1.o cleanup.o \
         compat.o compress.o crc32.o deattack.o fatal.o hostfile.o \
         log.o match.o md-sha256.o moduli.o nchan.o packet.o \
@@ -73,8 +75,8 @@ LIBSSH_OBJS=acss.o authfd.o authfile.o bufaux.o bufbn.o buffer.o \
         monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-rsa.o dh.o \
         kexdh.o kexgex.o kexdhc.o kexgexc.o bufec.o kexecdh.o kexecdhc.o \
         kexgssc.o \
-        msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o jpake.o \
-        schnorr.o ssh-pkcs11.o
+        msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \
+        jpake.o schnorr.o ssh-pkcs11.o krl.o
 
 SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
         sshconnect.o sshconnect1.o sshconnect2.o mux.o \
@@ -143,10 +145,10 @@ libssh.a: $(LIBSSH_OBJS)
         $(RANLIB) $@
 
 ssh$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHOBJS)
-        $(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHLIBS) $(LIBS)
+        $(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHLIBS) $(LIBS) $(GSSLIBS)
 
 sshd$(EXEEXT): libssh.a $(LIBCOMPAT) $(SSHDOBJS)
-        $(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHDLIBS) $(LIBS)
+        $(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHDLIBS) $(LIBS) $(GSSLIBS) $(K5LIBS)
 
 scp$(EXEEXT): $(LIBCOMPAT) libssh.a scp.o progressmeter.o
         $(LD) -o $@ scp.o progressmeter.o bufaux.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
@@ -202,6 +204,13 @@ $(CONFIGFILES): $(CONFIGFILES_IN)
 moduli:
         echo
 
+# special case target for umac128
+umac128.o:      umac.c
+        $(CC) $(CFLAGS) $(CPPFLAGS) -o umac128.o -c $(srcdir)/umac.c \
+            -DUMAC_OUTPUT_LEN=16 -Dumac_new=umac128_new \
+            -Dumac_update=umac128_update -Dumac_final=umac128_final \
+            -Dumac_delete=umac128_delete
+
 clean:  regressclean
         rm -f *.o *.a $(TARGETS) logintest config.cache config.log
         rm -f *.out core survey
@@ -384,7 +393,12 @@ uninstall:
         -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
         -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1
 
-tests interop-tests:    $(TARGETS)
+regress/modpipe$(EXEEXT): $(srcdir)/regress/modpipe.c
+        [ -d `pwd`/regress ]  ||  mkdir -p `pwd`/regress; \
+        $(CC) $(CPPFLAGS) -o $@ $? \
+        $(LDFLAGS) -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
+
+tests interop-tests:    $(TARGETS) regress/modpipe$(EXEEXT)
         BUILDDIR=`pwd`; \
         [ -d `pwd`/regress ]  ||  mkdir -p `pwd`/regress; \
         [ -f `pwd`/regress/Makefile ]  || \
diff --git a/PROTOCOL b/PROTOCOL
index c28196011..48b3a4400 100644
--- a/PROTOCOL
+++ b/PROTOCOL
@@ -51,6 +51,46 @@ and ecdsa-sha2-nistp521 curves over GF(p) are supported. Elliptic
 curve points encoded using point compression are NOT accepted or
 generated.
 
+1.5 transport: Protocol 2 Encrypt-then-MAC MAC algorithms
+
+OpenSSH supports MAC algorithms, whose names contain "-etm", that
+perform the calculations in a different order to that defined in RFC
+4253. These variants use the so-called "encrypt then MAC" ordering,
+calculating the MAC over the packet ciphertext rather than the
+plaintext. This ordering closes a security flaw in the SSH transport
+protocol, where decryption of unauthenticated ciphertext provided a
+"decryption oracle" that could, in conjunction with cipher flaws, reveal
+session plaintext.
+
+Specifically, the "-etm" MAC algorithms modify the transport protocol
+to calculate the MAC over the packet ciphertext and to send the packet
+length unencrypted. This is necessary for the transport to obtain the
+length of the packet and location of the MAC tag so that it may be
+verified without decrypting unauthenticated data.
+
+As such, the MAC covers:
+
+      mac = MAC(key, sequence_number || packet_length || encrypted_packet)
+
+where "packet_length" is encoded as a uint32 and "encrypted_packet"
+contains:
+
+      byte      padding_length
+      byte[n1]  payload; n1 = packet_length - padding_length - 1
+      byte[n2]  random padding; n2 = padding_length
+
+1.6 transport: AES-GCM
+
+OpenSSH supports the AES-GCM algorithm as specified in RFC 5647.
+Because of problems with the specification of the key exchange
+the behaviour of OpenSSH differs from the RFC as follows:
+
+AES-GCM is only negotiated as the cipher algorithms
+"aes128-gcm@openssh.com" or "aes256-gcm@openssh.com" and never as
+an MAC algorithm. Additionally, if AES-GCM is selected as the cipher
+the exchanged MAC algorithms are ignored and there doesn't have to be
+a matching MAC.
+
 2. Connection protocol changes
 
 2.1. connection: Channel write close extension "eow@openssh.com"
@@ -291,4 +331,4 @@ link(oldpath, newpath) and will respond with a SSH_FXP_STATUS message.
 This extension is advertised in the SSH_FXP_VERSION hello with version
 "1".
 
-$OpenBSD: PROTOCOL,v 1.17 2010/12/04 00:18:01 djm Exp $
+$OpenBSD: PROTOCOL,v 1.20 2013/01/08 18:49:04 markus Exp $
diff --git a/PROTOCOL.agent b/PROTOCOL.agent
index de94d037d..3fcaa14d4 100644
--- a/PROTOCOL.agent
+++ b/PROTOCOL.agent
@@ -152,7 +152,7 @@ fully specified using just rsa_q, rsa_p and rsa_e at the cost of extra
 computation.
 
 "key_constraints" may only be present if the request type is
-SSH_AGENTC_ADD_RSA_IDENTITY.
+SSH_AGENTC_ADD_RSA_ID_CONSTRAINED.
 
 The agent will reply with a SSH_AGENT_SUCCESS if the key has been
 successfully added or a SSH_AGENT_FAILURE if an error occurred.
@@ -557,4 +557,4 @@ Locking and unlocking affects both protocol 1 and protocol 2 keys.
         SSH_AGENT_CONSTRAIN_LIFETIME                    1
         SSH_AGENT_CONSTRAIN_CONFIRM                     2
 
-$OpenBSD: PROTOCOL.agent,v 1.6 2010/08/31 11:54:45 djm Exp $
+$OpenBSD: PROTOCOL.agent,v 1.7 2013/01/02 00:33:49 djm Exp $
diff --git a/PROTOCOL.krl b/PROTOCOL.krl
new file mode 100644
index 000000000..e8caa4527
--- /dev/null
+++ b/PROTOCOL.krl
@@ -0,0 +1,164 @@
+This describes the key/certificate revocation list format for OpenSSH.
+
+1. Overall format
+
+The KRL consists of a header and zero or more sections. The header is:
+
+#define KRL_MAGIC               0x5353484b524c0a00ULL  /* "SSHKRL\n\0" */
+#define KRL_FORMAT_VERSION      1
+
+        uint64  KRL_MAGIC
+        uint32  KRL_FORMAT_VERSION
+        uint64  krl_version
+        uint64  generated_date
+        uint64  flags
+        string  reserved
+        string  comment
+
+Where "krl_version" is a version number that increases each time the KRL
+is modified, "generated_date" is the time in seconds since 1970-01-01
+00:00:00 UTC that the KRL was generated, "comment" is an optional comment
+and "reserved" an extension field whose contents are currently ignored.
+No "flags" are currently defined.
+
+Following the header are zero or more sections, each consisting of:
+
+        byte    section_type
+        string  section_data
+
+Where "section_type" indicates the type of the "section_data". An exception
+to this is the KRL_SECTION_SIGNATURE section, that has a slightly different
+format (see below).
+
+The available section types are:
+
+#define KRL_SECTION_CERTIFICATES                1
+#define KRL_SECTION_EXPLICIT_KEY                2
+#define KRL_SECTION_FINGERPRINT_SHA1            3
+#define KRL_SECTION_SIGNATURE                   4
+
+3. Certificate serial section
+
+These sections use type KRL_SECTION_CERTIFICATES to revoke certificates by
+serial number or key ID. The consist of the CA key that issued the
+certificates to be revoked and a reserved field whose contents is currently
+ignored.
+
+        string ca_key
+        string reserved
+
+Followed by one or more sections:
+
+        byte    cert_section_type
+        string  cert_section_data
+
+The certificate section types are:
+
+#define KRL_SECTION_CERT_SERIAL_LIST    0x20
+#define KRL_SECTION_CERT_SERIAL_RANGE   0x21
+#define KRL_SECTION_CERT_SERIAL_BITMAP  0x22
+#define KRL_SECTION_CERT_KEY_ID         0x23
+
+2.1 Certificate serial list section
+
+This section is identified as KRL_SECTION_CERT_SERIAL_LIST. It revokes
+certificates by listing their serial numbers. The cert_section_data in this
+case contains:
+
+        uint64  revoked_cert_serial
+        uint64  ...
+
+This section may appear multiple times.
+
+2.2. Certificate serial range section
+
+These sections use type KRL_SECTION_CERT_SERIAL_RANGE and hold
+a range of serial numbers of certificates:
+
+        uint64  serial_min
+        uint64  serial_max
+
+All certificates in the range serial_min <= serial <= serial_max are
+revoked.
+
+This section may appear multiple times.
+
+2.3. Certificate serial bitmap section
+
+Bitmap sections use type KRL_SECTION_CERT_SERIAL_BITMAP and revoke keys
+by listing their serial number in a bitmap.
+
+        uint64  serial_offset
+        mpint   revoked_keys_bitmap
+
+A bit set at index N in the bitmap corresponds to revocation of a keys with
+serial number (serial_offset + N).
+
+This section may appear multiple times.
+
+2.4. Revoked key ID sections
+
+KRL_SECTION_CERT_KEY_ID sections revoke particular certificate "key
+ID" strings. This may be useful in revoking all certificates
+associated with a particular identity, e.g. a host or a user.
+
+        string  key_id[0]
+        ...
+
+This section must contain at least one "key_id". This section may appear
+multiple times.
+
+3. Explicit key sections
+
+These sections, identified as KRL_SECTION_EXPLICIT_KEY, revoke keys
+(not certificates). They are less space efficient than serial numbers,
+but are able to revoke plain keys.
+
+        string  public_key_blob[0]
+        ....
+
+This section must contain at least one "public_key_blob". The blob
+must be a raw key (i.e. not a certificate).
+
+This section may appear multiple times.
+
+4. SHA1 fingerprint sections
+
+These sections, identified as KRL_SECTION_FINGERPRINT_SHA1, revoke
+plain keys (i.e. not certificates) by listing their SHA1 hashes:
+
+        string  public_key_hash[0]
+        ....
+
+This section must contain at least one "public_key_hash". The hash blob
+is obtained by taking the SHA1 hash of the public key blob. Hashes in
+this section must appear in numeric order, treating each hash as a big-
+endian integer.
+
+This section may appear multiple times.
+
+5. KRL signature sections
+
+The KRL_SECTION_SIGNATURE section serves a different purpose to the
+preceeding ones: to provide cryptographic authentication of a KRL that
+is retrieved over a channel that does not provide integrity protection.
+Its format is slightly different to the previously-described sections:
+in order to simplify the signature generation, it includes as a "body"
+two string components instead of one.
+
+        byte    KRL_SECTION_SIGNATURE
+        string  signature_key
+        string  signature
+
+The signature is calculated over the entire KRL from the KRL_MAGIC
+to this subsection's "signature_key", including both and using the
+signature generation rules appropriate for the type of "signature_key".
+
+This section must appear last in the KRL. If multiple signature sections
+appear, they must appear consecutively at the end of the KRL file.
+
+Implementations that retrieve KRLs over untrusted channels must verify
+signatures. Signature sections are optional for KRLs distributed by
+trusted means.
+
+$OpenBSD: PROTOCOL.krl,v 1.2 2013/01/18 00:24:58 djm Exp $
diff --git a/README b/README
index 81cb922be..21dc6e1f7 100644
--- a/README
+++ b/README
@@ -1,4 +1,4 @@
-See http://www.openssh.com/txt/release-6.1 for the release notes.
+See http://www.openssh.com/txt/release-6.2 for the release notes.
 
 - A Japanese translation of this document and of the OpenSSH FAQ is
 - available at http://www.unixuser.org/~haruyama/security/openssh/index.html
@@ -62,4 +62,4 @@ References -
 [6] http://www.openbsd.org/cgi-bin/man.cgi?query=style&sektion=9
 [7] http://www.openssh.com/faq.html
 
-$Id: README,v 1.81 2012/08/22 11:57:13 djm Exp $
+$Id: README,v 1.82 2013/02/26 23:48:19 djm Exp $
diff --git a/acss.c b/acss.c
deleted file mode 100644
index 86e2c01a8..000000000
--- a/acss.c
+++ /dev/null
@@ -1,267 +0,0 @@
-/*      $Id: acss.c,v 1.4 2006/07/24 04:51:01 djm Exp $ */
-/*
- * Copyright (c) 2004 The OpenBSD project
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#include "includes.h"
-
-#include <string.h>
-
-#include <openssl/evp.h>
-
-#if !defined(EVP_CTRL_SET_ACSS_MODE) && (OPENSSL_VERSION_NUMBER >= 0x00906000L)
-
-#include "acss.h"
-
-/* decryption sbox */
-static unsigned char sboxdec[] = {
-        0x33, 0x73, 0x3b, 0x26, 0x63, 0x23, 0x6b, 0x76,
-        0x3e, 0x7e, 0x36, 0x2b, 0x6e, 0x2e, 0x66, 0x7b,
-        0xd3, 0x93, 0xdb, 0x06, 0x43, 0x03, 0x4b, 0x96,
-        0xde, 0x9e, 0xd6, 0x0b, 0x4e, 0x0e, 0x46, 0x9b,
-        0x57, 0x17, 0x5f, 0x82, 0xc7, 0x87, 0xcf, 0x12,
-        0x5a, 0x1a, 0x52, 0x8f, 0xca, 0x8a, 0xc2, 0x1f,
-        0xd9, 0x99, 0xd1, 0x00, 0x49, 0x09, 0x41, 0x90,
-        0xd8, 0x98, 0xd0, 0x01, 0x48, 0x08, 0x40, 0x91,
-        0x3d, 0x7d, 0x35, 0x24, 0x6d, 0x2d, 0x65, 0x74,
-        0x3c, 0x7c, 0x34, 0x25, 0x6c, 0x2c, 0x64, 0x75,
-        0xdd, 0x9d, 0xd5, 0x04, 0x4d, 0x0d, 0x45, 0x94,
-        0xdc, 0x9c, 0xd4, 0x05, 0x4c, 0x0c, 0x44, 0x95,
-        0x59, 0x19, 0x51, 0x80, 0xc9, 0x89, 0xc1, 0x10,
-        0x58, 0x18, 0x50, 0x81, 0xc8, 0x88, 0xc0, 0x11,
-        0xd7, 0x97, 0xdf, 0x02, 0x47, 0x07, 0x4f, 0x92,
-        0xda, 0x9a, 0xd2, 0x0f, 0x4a, 0x0a, 0x42, 0x9f,
-        0x53, 0x13, 0x5b, 0x86, 0xc3, 0x83, 0xcb, 0x16,
-        0x5e, 0x1e, 0x56, 0x8b, 0xce, 0x8e, 0xc6, 0x1b,
-        0xb3, 0xf3, 0xbb, 0xa6, 0xe3, 0xa3, 0xeb, 0xf6,
-        0xbe, 0xfe, 0xb6, 0xab, 0xee, 0xae, 0xe6, 0xfb,
-        0x37, 0x77, 0x3f, 0x22, 0x67, 0x27, 0x6f, 0x72,
-        0x3a, 0x7a, 0x32, 0x2f, 0x6a, 0x2a, 0x62, 0x7f,
-        0xb9, 0xf9, 0xb1, 0xa0, 0xe9, 0xa9, 0xe1, 0xf0,
-        0xb8, 0xf8, 0xb0, 0xa1, 0xe8, 0xa8, 0xe0, 0xf1,
-        0x5d, 0x1d, 0x55, 0x84, 0xcd, 0x8d, 0xc5, 0x14,
-        0x5c, 0x1c, 0x54, 0x85, 0xcc, 0x8c, 0xc4, 0x15,
-        0xbd, 0xfd, 0xb5, 0xa4, 0xed, 0xad, 0xe5, 0xf4,
-        0xbc, 0xfc, 0xb4, 0xa5, 0xec, 0xac, 0xe4, 0xf5,
-        0x39, 0x79, 0x31, 0x20, 0x69, 0x29, 0x61, 0x70,
-        0x38, 0x78, 0x30, 0x21, 0x68, 0x28, 0x60, 0x71,
-        0xb7, 0xf7, 0xbf, 0xa2, 0xe7, 0xa7, 0xef, 0xf2,
-        0xba, 0xfa, 0xb2, 0xaf, 0xea, 0xaa, 0xe2, 0xff
-};
-
-/* encryption sbox */
-static unsigned char sboxenc[] = {
-        0x33, 0x3b, 0x73, 0x15, 0x53, 0x5b, 0x13, 0x75,
-        0x3d, 0x35, 0x7d, 0x1b, 0x5d, 0x55, 0x1d, 0x7b,
-        0x67, 0x6f, 0x27, 0x81, 0xc7, 0xcf, 0x87, 0x21,
-        0x69, 0x61, 0x29, 0x8f, 0xc9, 0xc1, 0x89, 0x2f,
-        0xe3, 0xeb, 0xa3, 0x05, 0x43, 0x4b, 0x03, 0xa5,
-        0xed, 0xe5, 0xad, 0x0b, 0x4d, 0x45, 0x0d, 0xab,
-        0xea, 0xe2, 0xaa, 0x00, 0x4a, 0x42, 0x0a, 0xa0,
-        0xe8, 0xe0, 0xa8, 0x02, 0x48, 0x40, 0x08, 0xa2,
-        0x3e, 0x36, 0x7e, 0x14, 0x5e, 0x56, 0x1e, 0x74,
-        0x3c, 0x34, 0x7c, 0x16, 0x5c, 0x54, 0x1c, 0x76,
-        0x6a, 0x62, 0x2a, 0x80, 0xca, 0xc2, 0x8a, 0x20,
-        0x68, 0x60, 0x28, 0x82, 0xc8, 0xc0, 0x88, 0x22,
-        0xee, 0xe6, 0xae, 0x04, 0x4e, 0x46, 0x0e, 0xa4,
-        0xec, 0xe4, 0xac, 0x06, 0x4c, 0x44, 0x0c, 0xa6,
-        0xe7, 0xef, 0xa7, 0x01, 0x47, 0x4f, 0x07, 0xa1,
-        0xe9, 0xe1, 0xa9, 0x0f, 0x49, 0x41, 0x09, 0xaf,
-        0x63, 0x6b, 0x23, 0x85, 0xc3, 0xcb, 0x83, 0x25,
-        0x6d, 0x65, 0x2d, 0x8b, 0xcd, 0xc5, 0x8d, 0x2b,
-        0x37, 0x3f, 0x77, 0x11, 0x57, 0x5f, 0x17, 0x71,
-        0x39, 0x31, 0x79, 0x1f, 0x59, 0x51, 0x19, 0x7f,
-        0xb3, 0xbb, 0xf3, 0x95, 0xd3, 0xdb, 0x93, 0xf5,
-        0xbd, 0xb5, 0xfd, 0x9b, 0xdd, 0xd5, 0x9d, 0xfb,
-        0xba, 0xb2, 0xfa, 0x90, 0xda, 0xd2, 0x9a, 0xf0,
-        0xb8, 0xb0, 0xf8, 0x92, 0xd8, 0xd0, 0x98, 0xf2,
-        0x6e, 0x66, 0x2e, 0x84, 0xce, 0xc6, 0x8e, 0x24,
-        0x6c, 0x64, 0x2c, 0x86, 0xcc, 0xc4, 0x8c, 0x26,
-        0x3a, 0x32, 0x7a, 0x10, 0x5a, 0x52, 0x1a, 0x70,
-        0x38, 0x30, 0x78, 0x12, 0x58, 0x50, 0x18, 0x72,
-        0xbe, 0xb6, 0xfe, 0x94, 0xde, 0xd6, 0x9e, 0xf4,
-        0xbc, 0xb4, 0xfc, 0x96, 0xdc, 0xd4, 0x9c, 0xf6,
-        0xb7, 0xbf, 0xf7, 0x91, 0xd7, 0xdf, 0x97, 0xf1,
-        0xb9, 0xb1, 0xf9, 0x9f, 0xd9, 0xd1, 0x99, 0xff
-};
-
-static unsigned char reverse[] = {
-        0x00, 0x80, 0x40, 0xc0, 0x20, 0xa0, 0x60, 0xe0,
-        0x10, 0x90, 0x50, 0xd0, 0x30, 0xb0, 0x70, 0xf0,
-        0x08, 0x88, 0x48, 0xc8, 0x28, 0xa8, 0x68, 0xe8,
-        0x18, 0x98, 0x58, 0xd8, 0x38, 0xb8, 0x78, 0xf8,
-        0x04, 0x84, 0x44, 0xc4, 0x24, 0xa4, 0x64, 0xe4,
-        0x14, 0x94, 0x54, 0xd4, 0x34, 0xb4, 0x74, 0xf4,
-        0x0c, 0x8c, 0x4c, 0xcc, 0x2c, 0xac, 0x6c, 0xec,
-        0x1c, 0x9c, 0x5c, 0xdc, 0x3c, 0xbc, 0x7c, 0xfc,
-        0x02, 0x82, 0x42, 0xc2, 0x22, 0xa2, 0x62, 0xe2,
-        0x12, 0x92, 0x52, 0xd2, 0x32, 0xb2, 0x72, 0xf2,
-        0x0a, 0x8a, 0x4a, 0xca, 0x2a, 0xaa, 0x6a, 0xea,
-        0x1a, 0x9a, 0x5a, 0xda, 0x3a, 0xba, 0x7a, 0xfa,
-        0x06, 0x86, 0x46, 0xc6, 0x26, 0xa6, 0x66, 0xe6,
-        0x16, 0x96, 0x56, 0xd6, 0x36, 0xb6, 0x76, 0xf6,
-        0x0e, 0x8e, 0x4e, 0xce, 0x2e, 0xae, 0x6e, 0xee,
-        0x1e, 0x9e, 0x5e, 0xde, 0x3e, 0xbe, 0x7e, 0xfe,
-        0x01, 0x81, 0x41, 0xc1, 0x21, 0xa1, 0x61, 0xe1,
-        0x11, 0x91, 0x51, 0xd1, 0x31, 0xb1, 0x71, 0xf1,
-        0x09, 0x89, 0x49, 0xc9, 0x29, 0xa9, 0x69, 0xe9,
-        0x19, 0x99, 0x59, 0xd9, 0x39, 0xb9, 0x79, 0xf9,
-        0x05, 0x85, 0x45, 0xc5, 0x25, 0xa5, 0x65, 0xe5,
-        0x15, 0x95, 0x55, 0xd5, 0x35, 0xb5, 0x75, 0xf5,
-        0x0d, 0x8d, 0x4d, 0xcd, 0x2d, 0xad, 0x6d, 0xed,
-        0x1d, 0x9d, 0x5d, 0xdd, 0x3d, 0xbd, 0x7d, 0xfd,
-        0x03, 0x83, 0x43, 0xc3, 0x23, 0xa3, 0x63, 0xe3,
-        0x13, 0x93, 0x53, 0xd3, 0x33, 0xb3, 0x73, 0xf3,
-        0x0b, 0x8b, 0x4b, 0xcb, 0x2b, 0xab, 0x6b, 0xeb,
-        0x1b, 0x9b, 0x5b, 0xdb, 0x3b, 0xbb, 0x7b, 0xfb,
-        0x07, 0x87, 0x47, 0xc7, 0x27, 0xa7, 0x67, 0xe7,
-        0x17, 0x97, 0x57, 0xd7, 0x37, 0xb7, 0x77, 0xf7,
-        0x0f, 0x8f, 0x4f, 0xcf, 0x2f, 0xaf, 0x6f, 0xef,
-        0x1f, 0x9f, 0x5f, 0xdf, 0x3f, 0xbf, 0x7f, 0xff
-};
-
-/*
- * Two linear feedback shift registers are used:
- *
- * lfsr17:  polynomial of degree 17, primitive modulo 2 (listed in Schneier)
- *          x^15 + x + 1
- * lfsr25:  polynomial of degree 25, not know if primitive modulo 2
- *          x^13 + x^5 + x^4 + x^1 + 1
- *
- * Output bits are discarded, instead the feedback bits are added to produce
- * the cipher stream.  Depending on the mode, feedback bytes may be inverted
- * bit-wise before addition.
- *
- * The lfsrs are seeded with bytes from the raw key:
- *
- * lfsr17:  byte 0[0:7] at bit 9
- *          byte 1[0:7] at bit 0
- *
- * lfsr25:  byte 2[0:4] at bit 16
- *          byte 2[5:7] at bit 22
- *          byte 3[0:7] at bit 8
- *          byte 4[0:7] at bit 0
- *
- * To prevent 0 cycles, 1's are inject at bit 8 in lfrs17 and bit 21 in
- * lfsr25.
- *
- */
-
-int
-acss(ACSS_KEY *key, unsigned long len, const unsigned char *in,
-    unsigned char *out)
-{
-        unsigned long i;
-        unsigned long lfsr17tmp, lfsr25tmp, lfsrsumtmp;
-
-        lfsrsumtmp = lfsr17tmp = lfsr25tmp = 0;
-
-        /* keystream is sum of lfsrs */
-        for (i = 0; i < len; i++) {
-                lfsr17tmp = key->lfsr17 ^ (key->lfsr17 >> 14);
-                key->lfsr17 = (key->lfsr17 >> 8)
-                        ^ (lfsr17tmp << 9)
-                        ^ (lfsr17tmp << 12)
-                        ^ (lfsr17tmp << 15);
-                key->lfsr17 &= 0x1ffff; /* 17 bit LFSR */
-
-                lfsr25tmp = key->lfsr25
-                        ^ (key->lfsr25 >> 3)
-                        ^ (key->lfsr25 >> 4)
-                        ^ (key->lfsr25 >> 12);
-                key->lfsr25 = (key->lfsr25 >> 8) ^ (lfsr25tmp << 17);
-                key->lfsr25 &= 0x1ffffff;       /* 25 bit LFSR */
-
-                lfsrsumtmp = key->lfsrsum;
-
-                /* addition */
-                switch (key->mode) {
-                case ACSS_AUTHENTICATE:
-                case ACSS_DATA:
-                        key->lfsrsum = 0xff & ~(key->lfsr17 >> 9);
-                        key->lfsrsum += key->lfsr25 >> 17;
-                        break;
-                case ACSS_SESSIONKEY:
-                        key->lfsrsum = key->lfsr17 >> 9;
-                        key->lfsrsum += key->lfsr25 >> 17;
-                        break;
-                case ACSS_TITLEKEY:
-                        key->lfsrsum = key->lfsr17 >> 9;
-                        key->lfsrsum += 0xff & ~(key->lfsr25 >> 17);
-                        break;
-                default:
-                        return 1;
-                }
-                key->lfsrsum += (lfsrsumtmp >> 8);
-
-                if (key->encrypt) {
-                        out[i] = sboxenc[(in[i] ^ key->lfsrsum) & 0xff];
-                } else {
-                        out[i] = (sboxdec[in[i]] ^ key->lfsrsum) & 0xff;
-                }
-        }
-
-        return 0;
-}
-
-static void
-acss_seed(ACSS_KEY *key)
-{
-        int i;
-
-        /* if available, mangle with subkey */
-        if (key->subkey_avilable) {
-                for (i = 0; i < ACSS_KEYSIZE; i++)
-                        key->seed[i] = reverse[key->data[i] ^ key->subkey[i]];
-        } else {
-                for (i = 0; i < ACSS_KEYSIZE; i++)
-                        key->seed[i] = reverse[key->data[i]];
-        }
-
-        /* seed lfsrs */
-        key->lfsr17 = key->seed[1]
-                | (key->seed[0] << 9)
-                | (1 << 8);     /* inject 1 at bit 9 */
-        key->lfsr25 = key->seed[4]
-                | (key->seed[3] << 8)
-                | ((key->seed[2] & 0x1f) << 16)
-                | ((key->seed[2] & 0xe0) << 17)
-                        | (1 << 21);    /* inject 1 at bit 22 */
-
-        key->lfsrsum = 0;
-}
-
-void
-acss_setkey(ACSS_KEY *key, const unsigned char *data, int enc, int mode)
-{
-        memcpy(key->data, data, sizeof(key->data));
-        memset(key->subkey, 0, sizeof(key->subkey));
-
-        if (enc != -1)
-                key->encrypt = enc;
-        key->mode = mode;
-        key->subkey_avilable = 0;
-
-        acss_seed(key);
-}
-
-void
-acss_setsubkey(ACSS_KEY *key, const unsigned char *subkey)
-{
-        memcpy(key->subkey, subkey, sizeof(key->subkey));
-        key->subkey_avilable = 1;
-        acss_seed(key);
-}
-#endif
diff --git a/acss.h b/acss.h
deleted file mode 100644
index 91b489542..000000000
--- a/acss.h
+++ /dev/null
@@ -1,47 +0,0 @@
-/*      $Id: acss.h,v 1.2 2004/02/06 04:22:43 dtucker Exp $ */
-/*
- * Copyright (c) 2004 The OpenBSD project
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#ifndef _ACSS_H_
-#define _ACSS_H_
-
-/* 40bit key */
-#define ACSS_KEYSIZE            5
-
-/* modes of acss */
-#define ACSS_AUTHENTICATE       0
-#define ACSS_SESSIONKEY         1
-#define ACSS_TITLEKEY           2
-#define ACSS_DATA               3
-
-typedef struct acss_key_st {
-        unsigned int    lfsr17;         /* current state of lfsrs */
-        unsigned int    lfsr25;
-        unsigned int    lfsrsum;
-        unsigned char   seed[ACSS_KEYSIZE];
-        unsigned char   data[ACSS_KEYSIZE];
-        unsigned char   subkey[ACSS_KEYSIZE];
-        int             encrypt;        /* XXX make these bit flags? */
-        int             mode;
-        int             seeded;
-        int             subkey_avilable;
-} ACSS_KEY;
-
-void acss_setkey(ACSS_KEY *, const unsigned char *, int, int);
-void acss_setsubkey(ACSS_KEY *, const unsigned char *);
-int acss(ACSS_KEY *, unsigned long, const unsigned char *, unsigned char *);
-
-#endif /* ifndef _ACSS_H_ */
diff --git a/auth-options.c b/auth-options.c
index 146b3d174..78e8f3955 100644
--- a/auth-options.c
+++ b/auth-options.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth-options.c,v 1.56 2011/10/18 04:58:26 djm Exp $ */
+/* $OpenBSD: auth-options.c,v 1.57 2012/12/02 20:46:11 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -363,7 +363,7 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
                                 xfree(patterns);
                                 goto bad_option;
                         }
-                        if (options.allow_tcp_forwarding)
+                        if ((options.allow_tcp_forwarding & FORWARD_LOCAL) != 0)
                                 channel_add_permitted_opens(host, port);
                         xfree(patterns);
                         goto next_option;
diff --git a/auth-rsa.c b/auth-rsa.c
index 99c4e882d..33cdb5dae 100644
--- a/auth-rsa.c
+++ b/auth-rsa.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth-rsa.c,v 1.80 2011/05/23 03:30:07 djm Exp $ */
+/* $OpenBSD: auth-rsa.c,v 1.81 2012/10/30 21:29:54 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -278,6 +278,8 @@ auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey)
         temporarily_use_uid(pw);
 
         for (i = 0; !allowed && i < options.num_authkeys_files; i++) {
+                if (strcasecmp(options.authorized_keys_files[i], "none") == 0)
+                        continue;
                 file = expand_authorized_keys(
                     options.authorized_keys_files[i], pw);
                 allowed = rsa_key_allowed_in_file(pw, file, client_n, rkey);
diff --git a/auth.c b/auth.c
index 2216dcddd..514602a0c 100644
--- a/auth.c
+++ b/auth.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth.c,v 1.96 2012/05/13 01:42:32 dtucker Exp $ */
+/* $OpenBSD: auth.c,v 1.101 2013/02/06 00:22:21 dtucker Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -72,6 +72,7 @@
 #endif
 #include "authfile.h"
 #include "monitor_wrap.h"
+#include "krl.h"
 
 /* import */
 extern ServerOptions options;
@@ -252,7 +253,8 @@ allowed_user(struct passwd * pw)
 }
 
 void
-auth_log(Authctxt *authctxt, int authenticated, char *method, char *info)
+auth_log(Authctxt *authctxt, int authenticated, int partial,
+    const char *method, const char *submethod, const char *info)
 {
         void (*authlog) (const char *fmt,...) = verbose;
         char *authmsg;
@@ -269,12 +271,15 @@ auth_log(Authctxt *authctxt, int authenticated, char *method, char *info)
 
         if (authctxt->postponed)
                 authmsg = "Postponed";
+        else if (partial)
+                authmsg = "Partial";
         else
                 authmsg = authenticated ? "Accepted" : "Failed";
 
-        authlog("%s %s for %s%.100s from %.200s port %d%s",
+        authlog("%s %s%s%s for %s%.100s from %.200s port %d%s",
             authmsg,
             method,
+            submethod != NULL ? "/" : "", submethod == NULL ? "" : submethod,
             authctxt->valid ? "" : "invalid user ",
             authctxt->user,
             get_remote_ipaddr(),
@@ -304,7 +309,7 @@ auth_log(Authctxt *authctxt, int authenticated, char *method, char *info)
  * Check whether root logins are disallowed.
  */
 int
-auth_root_allowed(char *method)
+auth_root_allowed(const char *method)
 {
         switch (options.permit_root_login) {
         case PERMIT_YES:
@@ -409,40 +414,41 @@ check_key_in_hostfiles(struct passwd *pw, Key *key, const char *host,
         return host_status;
 }
 
-
 /*
- * Check a given file for security. This is defined as all components
+ * Check a given path for security. This is defined as all components
  * of the path to the file must be owned by either the owner of
  * of the file or root and no directories must be group or world writable.
  *
  * XXX Should any specific check be done for sym links ?
  *
- * Takes an open file descriptor, the file name, a uid and and
+ * Takes a file name, its stat information (preferably from fstat() to
+ * avoid races), the uid of the expected owner, their home directory and an
  * error buffer plus max size as arguments.
  *
  * Returns 0 on success and -1 on failure
  */
-static int
-secure_filename(FILE *f, const char *file, struct passwd *pw,
-    char *err, size_t errlen)
+int
+auth_secure_path(const char *name, struct stat *stp, const char *pw_dir,
+    uid_t uid, char *err, size_t errlen)
 {
-        uid_t uid = pw->pw_uid;
         char buf[MAXPATHLEN], homedir[MAXPATHLEN];
         char *cp;
         int comparehome = 0;
         struct stat st;
 
-        if (realpath(file, buf) == NULL) {
-                snprintf(err, errlen, "realpath %s failed: %s", file,
+        if (realpath(name, buf) == NULL) {
+                snprintf(err, errlen, "realpath %s failed: %s", name,
                     strerror(errno));
                 return -1;
         }
-        if (realpath(pw->pw_dir, homedir) != NULL)
+        if (pw_dir != NULL && realpath(pw_dir, homedir) != NULL)
                 comparehome = 1;
 
-        /* check the open file to avoid races */
-        if (fstat(fileno(f), &st) < 0 ||
-            !secure_permissions(&st, uid)) {
+        if (!S_ISREG(stp->st_mode)) {
+                snprintf(err, errlen, "%s is not a regular file", buf);
+                return -1;
+        }
+        if (!secure_permissions(stp, uid)) {
                 snprintf(err, errlen, "bad ownership or modes for file %s",
                     buf);
                 return -1;
@@ -477,6 +483,27 @@ secure_filename(FILE *f, const char *file, struct passwd *pw,
         return 0;
 }
 
+/*
+ * Version of secure_path() that accepts an open file descriptor to
+ * avoid races.
+ *
+ * Returns 0 on success and -1 on failure
+ */
+static int
+secure_filename(FILE *f, const char *file, struct passwd *pw,
+    char *err, size_t errlen)
+{
+        struct stat st;
+
+        /* check the open file to avoid races */
+        if (fstat(fileno(f), &st) < 0) {
+                snprintf(err, errlen, "cannot stat file %s: %s",
+                    file, strerror(errno));
+                return -1;
+        }
+        return auth_secure_path(file, &st, pw->pw_dir, pw->pw_uid, err, errlen);
+}
+
 static FILE *
 auth_openfile(const char *file, struct passwd *pw, int strict_modes,
     int log_missing, char *file_type)
@@ -636,7 +663,16 @@ auth_key_is_revoked(Key *key, int hostkey)
 
         if (options.revoked_keys_file == NULL)
                 return 0;
-
+        switch (ssh_krl_file_contains_key(options.revoked_keys_file, key)) {
+        case 0:
+                return 0;       /* Not revoked */
+        case -2:
+                break;          /* Not a KRL */
+        default:
+                goto revoked;
+        }
+        debug3("%s: treating %s as a key list", __func__,
+            options.revoked_keys_file);
         switch (key_in_file(key, options.revoked_keys_file, 0)) {
         case 0:
                 /* key not revoked */
@@ -647,6 +683,7 @@ auth_key_is_revoked(Key *key, int hostkey)
                     "authentication");
                 return 1;
         case 1:
+ revoked:
                 /* Key revoked */
                 key_fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
                 error("WARNING: authentication attempt with a revoked "
diff --git a/auth.h b/auth.h
index 568212f9d..c2328f05b 100644
--- a/auth.h
+++ b/auth.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth.h,v 1.69 2011/05/23 03:30:07 djm Exp $ */
+/* $OpenBSD: auth.h,v 1.72 2012/12/02 20:34:09 djm Exp $ */
 
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
@@ -65,6 +65,8 @@ struct Authctxt {
 #ifdef BSD_AUTH
         auth_session_t  *as;
 #endif
+        char            **auth_methods; /* modified from server config */
+        u_int            num_auth_methods;
 #ifdef KRB5
         krb5_context     krb5_ctx;
         krb5_ccache      krb5_fwd_ccache;
@@ -121,6 +123,10 @@ int	 auth_rhosts_rsa_key_allowed(struct passwd *, char *, char *, Key *);
 int      hostbased_key_allowed(struct passwd *, const char *, char *, Key *);
 int      user_key_allowed(struct passwd *, Key *);
 
+struct stat;
+int      auth_secure_path(const char *, struct stat *, const char *, uid_t,
+    char *, size_t);
+
 #ifdef KRB5
 int     auth_krb5(Authctxt *authctxt, krb5_data *auth, char **client, krb5_data *);
 int     auth_krb5_tgt(Authctxt *authctxt, krb5_data *tgt);
@@ -143,12 +149,17 @@ void disable_forwarding(void);
 void    do_authentication(Authctxt *);
 void    do_authentication2(Authctxt *);
 
-void    auth_log(Authctxt *, int, char *, char *);
-void    userauth_finish(Authctxt *, int, char *);
+void    auth_log(Authctxt *, int, int, const char *, const char *,
+    const char *);
+void    userauth_finish(Authctxt *, int, const char *, const char *);
+int     auth_root_allowed(const char *);
+
 void    userauth_send_banner(const char *);
-int     auth_root_allowed(char *);
 
 char    *auth2_read_banner(void);
+int      auth2_methods_valid(const char *, int);
+int      auth2_update_methods_lists(Authctxt *, const char *);
+int      auth2_setup_methods_lists(Authctxt *);
 
 void    privsep_challenge_enable(void);
 
diff --git a/auth1.c b/auth1.c
index 9079b737c..de49b172d 100644
--- a/auth1.c
+++ b/auth1.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth1.c,v 1.75 2010/08/31 09:58:37 djm Exp $ */
+/* $OpenBSD: auth1.c,v 1.77 2012/12/02 20:34:09 djm Exp $ */
 /*
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
@@ -253,7 +253,8 @@ do_authloop(Authctxt *authctxt)
                 if (options.use_pam && (PRIVSEP(do_pam_account())))
 #endif
                 {
-                        auth_log(authctxt, 1, "without authentication", "");
+                        auth_log(authctxt, 1, 0, "without authentication",
+                            NULL, "");
                         return;
                 }
         }
@@ -352,7 +353,8 @@ do_authloop(Authctxt *authctxt)
 
  skip:
                 /* Log before sending the reply */
-                auth_log(authctxt, authenticated, get_authname(type), info);
+                auth_log(authctxt, authenticated, 0, get_authname(type),
+                    NULL, info);
 
                 if (client_user != NULL) {
                         xfree(client_user);
@@ -412,6 +414,11 @@ do_authentication(Authctxt *authctxt)
                 authctxt->pw = fakepw();
         }
 
+        /* Configuration may have changed as a result of Match */
+        if (options.num_auth_methods != 0)
+                fatal("AuthenticationMethods is not supported with SSH "
+                    "protocol 1");
+
         setproctitle("%s%s", authctxt->valid ? user : "unknown",
             use_privsep ? " [net]" : "");
 
diff --git a/auth2-chall.c b/auth2-chall.c
index e6dbffe22..6505d4009 100644
--- a/auth2-chall.c
+++ b/auth2-chall.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-chall.c,v 1.34 2008/12/09 04:32:22 djm Exp $ */
+/* $OpenBSD: auth2-chall.c,v 1.36 2012/12/03 00:14:06 djm Exp $ */
 /*
  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
  * Copyright (c) 2001 Per Allansson.  All rights reserved.
@@ -283,7 +283,8 @@ input_userauth_info_response(int type, u_int32_t seq, void *ctxt)
         KbdintAuthctxt *kbdintctxt;
         int authenticated = 0, res;
         u_int i, nresp;
-        char **response = NULL, *method;
+        const char *devicename = NULL;
+        char **response = NULL;
 
         if (authctxt == NULL)
                 fatal("input_userauth_info_response: no authctxt");
@@ -329,9 +330,7 @@ input_userauth_info_response(int type, u_int32_t seq, void *ctxt)
                 /* Failure! */
                 break;
         }
-
-        xasprintf(&method, "keyboard-interactive/%s", kbdintctxt->device->name);
-
+        devicename = kbdintctxt->device->name;
         if (!authctxt->postponed) {
                 if (authenticated) {
                         auth2_challenge_stop(authctxt);
@@ -341,8 +340,8 @@ input_userauth_info_response(int type, u_int32_t seq, void *ctxt)
                         auth2_challenge_start(authctxt);
                 }
         }
-        userauth_finish(authctxt, authenticated, method);
-        xfree(method);
+        userauth_finish(authctxt, authenticated, "keyboard-interactive",
+            devicename);
 }
 
 void
diff --git a/auth2-gss.c b/auth2-gss.c
index 7dc87dba4..17d4a3a84 100644
--- a/auth2-gss.c
+++ b/auth2-gss.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-gss.c,v 1.17 2011/03/10 02:52:57 djm Exp $ */
+/* $OpenBSD: auth2-gss.c,v 1.18 2012/12/02 20:34:09 djm Exp $ */
 
 /*
  * Copyright (c) 2001-2007 Simon Wilkinson. All rights reserved.
@@ -197,7 +197,7 @@ input_gssapi_token(int type, u_int32_t plen, void *ctxt)
                 }
                 authctxt->postponed = 0;
                 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
-                userauth_finish(authctxt, 0, "gssapi-with-mic");
+                userauth_finish(authctxt, 0, "gssapi-with-mic", NULL);
         } else {
                 if (send_tok.length != 0) {
                         packet_start(SSH2_MSG_USERAUTH_GSSAPI_TOKEN);
@@ -286,7 +286,7 @@ input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt)
         dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
         dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL);
         dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
-        userauth_finish(authctxt, authenticated, "gssapi-with-mic");
+        userauth_finish(authctxt, authenticated, "gssapi-with-mic", NULL);
 }
 
 static void
@@ -327,7 +327,7 @@ input_gssapi_mic(int type, u_int32_t plen, void *ctxt)
         dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
         dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL);
         dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
-        userauth_finish(authctxt, authenticated, "gssapi-with-mic");
+        userauth_finish(authctxt, authenticated, "gssapi-with-mic", NULL);
 }
 
 Authmethod method_gsskeyex = {
diff --git a/auth2-jpake.c b/auth2-jpake.c
index a460e8216..ed0eba47b 100644
--- a/auth2-jpake.c
+++ b/auth2-jpake.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-jpake.c,v 1.4 2010/08/31 11:54:45 djm Exp $ */
+/* $OpenBSD: auth2-jpake.c,v 1.5 2012/12/02 20:34:09 djm Exp $ */
 /*
  * Copyright (c) 2008 Damien Miller.  All rights reserved.
  *
@@ -556,7 +556,7 @@ input_userauth_jpake_client_confirm(int type, u_int32_t seq, void *ctxt)
         authctxt->postponed = 0;
         jpake_free(authctxt->jpake_ctx);
         authctxt->jpake_ctx = NULL;
-        userauth_finish(authctxt, authenticated, method_jpake.name);
+        userauth_finish(authctxt, authenticated, method_jpake.name, NULL);
 }
 
 #endif /* JPAKE */
diff --git a/auth2-pubkey.c b/auth2-pubkey.c
index d42ba14b8..f980b0dad 100644
--- a/auth2-pubkey.c
+++ b/auth2-pubkey.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-pubkey.c,v 1.30 2011/09/25 05:44:47 djm Exp $ */
+/* $OpenBSD: auth2-pubkey.c,v 1.34 2013/02/14 21:35:59 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -27,9 +27,15 @@
 
 #include <sys/types.h>
 #include <sys/stat.h>
+#include <sys/wait.h>
 
+#include <errno.h>
 #include <fcntl.h>
+#ifdef HAVE_PATHS_H
+# include <paths.h>
+#endif
 #include <pwd.h>
+#include <signal.h>
 #include <stdio.h>
 #include <stdarg.h>
 #include <string.h>
@@ -241,7 +247,7 @@ match_principals_file(char *file, struct passwd *pw, struct KeyCert *cert)
                         if (strcmp(cp, cert->principals[i]) == 0) {
                                 debug3("matched principal \"%.100s\" "
                                     "from file \"%s\" on line %lu",
-                                    cert->principals[i], file, linenum);
+                                    cert->principals[i], file, linenum);
                                 if (auth_parse_options(pw, line_opts,
                                     file, linenum) != 1)
                                         continue;
@@ -254,31 +260,22 @@ match_principals_file(char *file, struct passwd *pw, struct KeyCert *cert)
         fclose(f);
         restore_uid();
         return 0;
-}       
+}
 
-/* return 1 if user allows given key */
+/*
+ * Checks whether key is allowed in authorized_keys-format file,
+ * returns 1 if the key is allowed or 0 otherwise.
+ */
 static int
-user_key_allowed2(struct passwd *pw, Key *key, char *file)
+check_authkeys_file(FILE *f, char *file, Key* key, struct passwd *pw)
 {
         char line[SSH_MAX_PUBKEY_BYTES];
         const char *reason;
         int found_key = 0;
-        FILE *f;
         u_long linenum = 0;
         Key *found;
         char *fp;
 
-        /* Temporarily use the user's uid. */
-        temporarily_use_uid(pw);
-
-        debug("trying public key file %s", file);
-        f = auth_openkeyfile(file, pw, options.strict_modes);
-
-        if (!f) {
-                restore_uid();
-                return 0;
-        }
-
         found_key = 0;
         found = key_new(key_is_cert(key) ? KEY_UNSPEC : key->type);
 
@@ -373,8 +370,6 @@ user_key_allowed2(struct passwd *pw, Key *key, char *file)
                         break;
                 }
         }
-        restore_uid();
-        fclose(f);
         key_free(found);
         if (!found_key)
                 debug2("key not found");
@@ -437,7 +432,180 @@ user_cert_trusted_ca(struct passwd *pw, Key *key)
         return ret;
 }
 
-/* check whether given key is in .ssh/authorized_keys* */
+/*
+ * Checks whether key is allowed in file.
+ * returns 1 if the key is allowed or 0 otherwise.
+ */
+static int
+user_key_allowed2(struct passwd *pw, Key *key, char *file)
+{
+        FILE *f;
+        int found_key = 0;
+
+        /* Temporarily use the user's uid. */
+        temporarily_use_uid(pw);
+
+        debug("trying public key file %s", file);
+        if ((f = auth_openkeyfile(file, pw, options.strict_modes)) != NULL) {
+                found_key = check_authkeys_file(f, file, key, pw);
+                fclose(f);
+        }
+
+        restore_uid();
+        return found_key;
+}
+
+/*
+ * Checks whether key is allowed in output of command.
+ * returns 1 if the key is allowed or 0 otherwise.
+ */
+static int
+user_key_command_allowed2(struct passwd *user_pw, Key *key)
+{
+        FILE *f;
+        int ok, found_key = 0;
+        struct passwd *pw;
+        struct stat st;
+        int status, devnull, p[2], i;
+        pid_t pid;
+        char *username, errmsg[512];
+
+        if (options.authorized_keys_command == NULL ||
+            options.authorized_keys_command[0] != '/')
+                return 0;
+
+        if (options.authorized_keys_command_user == NULL) {
+                error("No user for AuthorizedKeysCommand specified, skipping");
+                return 0;
+        }
+
+        username = percent_expand(options.authorized_keys_command_user,
+            "u", user_pw->pw_name, (char *)NULL);
+        pw = getpwnam(username);
+        if (pw == NULL) {
+                error("AuthorizedKeysCommandUser \"%s\" not found: %s",
+                    username, strerror(errno));
+                free(username);
+                return 0;
+        }
+        free(username);
+
+        temporarily_use_uid(pw);
+
+        if (stat(options.authorized_keys_command, &st) < 0) {
+                error("Could not stat AuthorizedKeysCommand \"%s\": %s",
+                    options.authorized_keys_command, strerror(errno));
+                goto out;
+        }
+        if (auth_secure_path(options.authorized_keys_command, &st, NULL, 0,
+            errmsg, sizeof(errmsg)) != 0) {
+                error("Unsafe AuthorizedKeysCommand: %s", errmsg);
+                goto out;
+        }
+
+        if (pipe(p) != 0) {
+                error("%s: pipe: %s", __func__, strerror(errno));
+                goto out;
+        }
+
+        debug3("Running AuthorizedKeysCommand: \"%s %s\" as \"%s\"",
+            options.authorized_keys_command, user_pw->pw_name, pw->pw_name);
+
+        /*
+         * Don't want to call this in the child, where it can fatal() and
+         * run cleanup_exit() code.
+         */
+        restore_uid();
+
+        switch ((pid = fork())) {
+        case -1: /* error */
+                error("%s: fork: %s", __func__, strerror(errno));
+                close(p[0]);
+                close(p[1]);
+                return 0;
+        case 0: /* child */
+                for (i = 0; i < NSIG; i++)
+                        signal(i, SIG_DFL);
+
+                if ((devnull = open(_PATH_DEVNULL, O_RDWR)) == -1) {
+                        error("%s: open %s: %s", __func__, _PATH_DEVNULL,
+                            strerror(errno));
+                        _exit(1);
+                }
+                /* Keep stderr around a while longer to catch errors */
+                if (dup2(devnull, STDIN_FILENO) == -1 ||
+                    dup2(p[1], STDOUT_FILENO) == -1) {
+                        error("%s: dup2: %s", __func__, strerror(errno));
+                        _exit(1);
+                }
+                closefrom(STDERR_FILENO + 1);
+
+                /* Don't use permanently_set_uid() here to avoid fatal() */
+                if (setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) != 0) {
+                        error("setresgid %u: %s", (u_int)pw->pw_gid,
+                            strerror(errno));
+                        _exit(1);
+                }
+                if (setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid) != 0) {
+                        error("setresuid %u: %s", (u_int)pw->pw_uid,
+                            strerror(errno));
+                        _exit(1);
+                }
+                /* stdin is pointed to /dev/null at this point */
+                if (dup2(STDIN_FILENO, STDERR_FILENO) == -1) {
+                        error("%s: dup2: %s", __func__, strerror(errno));
+                        _exit(1);
+                }
+
+                execl(options.authorized_keys_command,
+                    options.authorized_keys_command, user_pw->pw_name, NULL);
+
+                error("AuthorizedKeysCommand %s exec failed: %s",
+                    options.authorized_keys_command, strerror(errno));
+                _exit(127);
+        default: /* parent */
+                break;
+        }
+
+        temporarily_use_uid(pw);
+
+        close(p[1]);
+        if ((f = fdopen(p[0], "r")) == NULL) {
+                error("%s: fdopen: %s", __func__, strerror(errno));
+                close(p[0]);
+                /* Don't leave zombie child */
+                kill(pid, SIGTERM);
+                while (waitpid(pid, NULL, 0) == -1 && errno == EINTR)
+                        ;
+                goto out;
+        }
+        ok = check_authkeys_file(f, options.authorized_keys_command, key, pw);
+        fclose(f);
+
+        while (waitpid(pid, &status, 0) == -1) {
+                if (errno != EINTR) {
+                        error("%s: waitpid: %s", __func__, strerror(errno));
+                        goto out;
+                }
+        }
+        if (WIFSIGNALED(status)) {
+                error("AuthorizedKeysCommand %s exited on signal %d",
+                    options.authorized_keys_command, WTERMSIG(status));
+                goto out;
+        } else if (WEXITSTATUS(status) != 0) {
+                error("AuthorizedKeysCommand %s returned status %d",
+                    options.authorized_keys_command, WEXITSTATUS(status));
+                goto out;
+        }
+        found_key = ok;
+ out:
+        restore_uid();
+        return found_key;
+}
+
+/*
+ * Check whether key authenticates and authorises the user.
+ */
 int
 user_key_allowed(struct passwd *pw, Key *key)
 {
@@ -454,9 +622,17 @@ user_key_allowed(struct passwd *pw, Key *key)
         if (success)
                 return success;
 
+        success = user_key_command_allowed2(pw, key);
+        if (success > 0)
+                return success;
+
         for (i = 0; !success && i < options.num_authkeys_files; i++) {
+
+                if (strcasecmp(options.authorized_keys_files[i], "none") == 0)
+                        continue;
                 file = expand_authorized_keys(
                     options.authorized_keys_files[i], pw);
+
                 success = user_key_allowed2(pw, key, file);
                 xfree(file);
         }
diff --git a/auth2.c b/auth2.c
index 1b7403904..f00f14764 100644
--- a/auth2.c
+++ b/auth2.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2.c,v 1.124 2011/12/07 05:44:38 djm Exp $ */
+/* $OpenBSD: auth2.c,v 1.126 2012/12/02 20:34:09 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -98,8 +98,10 @@ static void input_service_request(int, u_int32_t, void *);
 static void input_userauth_request(int, u_int32_t, void *);
 
 /* helper */
-static Authmethod *authmethod_lookup(const char *);
-static char *authmethods_get(void);
+static Authmethod *authmethod_lookup(Authctxt *, const char *);
+static char *authmethods_get(Authctxt *authctxt);
+static int method_allowed(Authctxt *, const char *);
+static int list_starts_with(const char *, const char *);
 
 char *
 auth2_read_banner(void)
@@ -263,6 +265,8 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
                 if (use_privsep)
                         mm_inform_authserv(service, style, role);
                 userauth_banner();
+                if (auth2_setup_methods_lists(authctxt) != 0)
+                        packet_disconnect("no authentication methods enabled");
         } else if (strcmp(user, authctxt->user) != 0 ||
             strcmp(service, authctxt->service) != 0) {
                 packet_disconnect("Change of username or service not allowed: "
@@ -285,12 +289,12 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
         authctxt->server_caused_failure = 0;
 
         /* try to authenticate user */
-        m = authmethod_lookup(method);
+        m = authmethod_lookup(authctxt, method);
         if (m != NULL && authctxt->failures < options.max_authtries) {
                 debug2("input_userauth_request: try method %s", method);
                 authenticated = m->userauth(authctxt);
         }
-        userauth_finish(authctxt, authenticated, method);
+        userauth_finish(authctxt, authenticated, method, NULL);
 
         xfree(service);
         xfree(user);
@@ -298,13 +302,17 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
 }
 
 void
-userauth_finish(Authctxt *authctxt, int authenticated, char *method)
+userauth_finish(Authctxt *authctxt, int authenticated, const char *method,
+    const char *submethod)
 {
         char *methods;
+        int partial = 0;
 
         if (!authctxt->valid && authenticated)
                 fatal("INTERNAL ERROR: authenticated invalid user %s",
                     authctxt->user);
+        if (authenticated && authctxt->postponed)
+                fatal("INTERNAL ERROR: authenticated and postponed");
 
         /* Special handling for root */
         if (authenticated && authctxt->pw->pw_uid == 0 &&
@@ -315,6 +323,19 @@ userauth_finish(Authctxt *authctxt, int authenticated, char *method)
 #endif
         }
 
+        if (authenticated && options.num_auth_methods != 0) {
+                if (!auth2_update_methods_lists(authctxt, method)) {
+                        authenticated = 0;
+                        partial = 1;
+                }
+        }
+
+        /* Log before sending the reply */
+        auth_log(authctxt, authenticated, partial, method, submethod, " ssh2");
+
+        if (authctxt->postponed)
+                return;
+
 #ifdef USE_PAM
         if (options.use_pam && authenticated) {
                 if (!PRIVSEP(do_pam_account())) {
@@ -333,17 +354,10 @@ userauth_finish(Authctxt *authctxt, int authenticated, char *method)
 #ifdef _UNICOS
         if (authenticated && cray_access_denied(authctxt->user)) {
                 authenticated = 0;
-                fatal("Access denied for user %s.",authctxt->user);
+                fatal("Access denied for user %s.", authctxt->user);
         }
 #endif /* _UNICOS */
 
-        /* Log before sending the reply */
-        auth_log(authctxt, authenticated, method, " ssh2");
-
-        if (authctxt->postponed)
-                return;
-
-        /* XXX todo: check if multiple auth methods are needed */
         if (authenticated == 1) {
                 /* turn off userauth */
                 dispatch_set(SSH2_MSG_USERAUTH_REQUEST, &dispatch_protocol_ignore);
@@ -364,34 +378,61 @@ userauth_finish(Authctxt *authctxt, int authenticated, char *method)
 #endif
                         packet_disconnect(AUTH_FAIL_MSG, authctxt->user);
                 }
-                methods = authmethods_get();
+                methods = authmethods_get(authctxt);
+                debug3("%s: failure partial=%d next methods=\"%s\"", __func__,
+                    partial, methods);
                 packet_start(SSH2_MSG_USERAUTH_FAILURE);
                 packet_put_cstring(methods);
-                packet_put_char(0);     /* XXX partial success, unused */
+                packet_put_char(partial);
                 packet_send();
                 packet_write_wait();
                 xfree(methods);
         }
 }
 
+/*
+ * Checks whether method is allowed by at least one AuthenticationMethods
+ * methods list. Returns 1 if allowed, or no methods lists configured.
+ * 0 otherwise.
+ */
+static int
+method_allowed(Authctxt *authctxt, const char *method)
+{
+        u_int i;
+
+        /*
+         * NB. authctxt->num_auth_methods might be zero as a result of
+         * auth2_setup_methods_lists(), so check the configuration.
+         */
+        if (options.num_auth_methods == 0)
+                return 1;
+        for (i = 0; i < authctxt->num_auth_methods; i++) {
+                if (list_starts_with(authctxt->auth_methods[i], method))
+                        return 1;
+        }
+        return 0;
+}
+
 static char *
-authmethods_get(void)
+authmethods_get(Authctxt *authctxt)
 {
         Buffer b;
         char *list;
-        int i;
+        u_int i;
 
         buffer_init(&b);
         for (i = 0; authmethods[i] != NULL; i++) {
                 if (strcmp(authmethods[i]->name, "none") == 0)
                         continue;
-                if (authmethods[i]->enabled != NULL &&
-                    *(authmethods[i]->enabled) != 0) {
-                        if (buffer_len(&b) > 0)
-                                buffer_append(&b, ",", 1);
-                        buffer_append(&b, authmethods[i]->name,
-                            strlen(authmethods[i]->name));
-                }
+                if (authmethods[i]->enabled == NULL ||
+                    *(authmethods[i]->enabled) == 0)
+                        continue;
+                if (!method_allowed(authctxt, authmethods[i]->name))
+                        continue;
+                if (buffer_len(&b) > 0)
+                        buffer_append(&b, ",", 1);
+                buffer_append(&b, authmethods[i]->name,
+                    strlen(authmethods[i]->name));
         }
         buffer_append(&b, "\0", 1);
         list = xstrdup(buffer_ptr(&b));
@@ -400,7 +441,7 @@ authmethods_get(void)
 }
 
 static Authmethod *
-authmethod_lookup(const char *name)
+authmethod_lookup(Authctxt *authctxt, const char *name)
 {
         int i;
 
@@ -408,10 +449,154 @@ authmethod_lookup(const char *name)
                 for (i = 0; authmethods[i] != NULL; i++)
                         if (authmethods[i]->enabled != NULL &&
                             *(authmethods[i]->enabled) != 0 &&
-                            strcmp(name, authmethods[i]->name) == 0)
+                            strcmp(name, authmethods[i]->name) == 0 &&
+                            method_allowed(authctxt, authmethods[i]->name))
                                 return authmethods[i];
         debug2("Unrecognized authentication method name: %s",
             name ? name : "NULL");
         return NULL;
 }
 
+/*
+ * Check a comma-separated list of methods for validity. Is need_enable is
+ * non-zero, then also require that the methods are enabled.
+ * Returns 0 on success or -1 if the methods list is invalid.
+ */
+int
+auth2_methods_valid(const char *_methods, int need_enable)
+{
+        char *methods, *omethods, *method;
+        u_int i, found;
+        int ret = -1;
+
+        if (*_methods == '\0') {
+                error("empty authentication method list");
+                return -1;
+        }
+        omethods = methods = xstrdup(_methods);
+        while ((method = strsep(&methods, ",")) != NULL) {
+                for (found = i = 0; !found && authmethods[i] != NULL; i++) {
+                        if (strcmp(method, authmethods[i]->name) != 0)
+                                continue;
+                        if (need_enable) {
+                                if (authmethods[i]->enabled == NULL ||
+                                    *(authmethods[i]->enabled) == 0) {
+                                        error("Disabled method \"%s\" in "
+                                            "AuthenticationMethods list \"%s\"",
+                                            method, _methods);
+                                        goto out;
+                                }
+                        }
+                        found = 1;
+                        break;
+                }
+                if (!found) {
+                        error("Unknown authentication method \"%s\" in list",
+                            method);
+                        goto out;
+                }
+        }
+        ret = 0;
+ out:
+        free(omethods);
+        return ret;
+}
+
+/*
+ * Prune the AuthenticationMethods supplied in the configuration, removing
+ * any methods lists that include disabled methods. Note that this might
+ * leave authctxt->num_auth_methods == 0, even when multiple required auth
+ * has been requested. For this reason, all tests for whether multiple is
+ * enabled should consult options.num_auth_methods directly.
+ */
+int
+auth2_setup_methods_lists(Authctxt *authctxt)
+{
+        u_int i;
+
+        if (options.num_auth_methods == 0)
+                return 0;
+        debug3("%s: checking methods", __func__);
+        authctxt->auth_methods = xcalloc(options.num_auth_methods,
+            sizeof(*authctxt->auth_methods));
+        authctxt->num_auth_methods = 0;
+        for (i = 0; i < options.num_auth_methods; i++) {
+                if (auth2_methods_valid(options.auth_methods[i], 1) != 0) {
+                        logit("Authentication methods list \"%s\" contains "
+                            "disabled method, skipping",
+                            options.auth_methods[i]);
+                        continue;
+                }
+                debug("authentication methods list %d: %s",
+                    authctxt->num_auth_methods, options.auth_methods[i]);
+                authctxt->auth_methods[authctxt->num_auth_methods++] =
+                    xstrdup(options.auth_methods[i]);
+        }
+        if (authctxt->num_auth_methods == 0) {
+                error("No AuthenticationMethods left after eliminating "
+                    "disabled methods");
+                return -1;
+        }
+        return 0;
+}
+
+static int
+list_starts_with(const char *methods, const char *method)
+{
+        size_t l = strlen(method);
+
+        if (strncmp(methods, method, l) != 0)
+                return 0;
+        if (methods[l] != ',' && methods[l] != '\0')
+                return 0;
+        return 1;
+}
+
+/*
+ * Remove method from the start of a comma-separated list of methods.
+ * Returns 0 if the list of methods did not start with that method or 1
+ * if it did.
+ */
+static int
+remove_method(char **methods, const char *method)
+{
+        char *omethods = *methods;
+        size_t l = strlen(method);
+
+        if (!list_starts_with(omethods, method))
+                return 0;
+        *methods = xstrdup(omethods + l + (omethods[l] == ',' ? 1 : 0));
+        free(omethods);
+        return 1;
+}
+
+/*
+ * Called after successful authentication. Will remove the successful method
+ * from the start of each list in which it occurs. If it was the last method
+ * in any list, then authentication is deemed successful.
+ * Returns 1 if the method completed any authentication list or 0 otherwise.
+ */
+int
+auth2_update_methods_lists(Authctxt *authctxt, const char *method)
+{
+        u_int i, found = 0;
+
+        debug3("%s: updating methods list after \"%s\"", __func__, method);
+        for (i = 0; i < authctxt->num_auth_methods; i++) {
+                if (!remove_method(&(authctxt->auth_methods[i]), method))
+                        continue;
+                found = 1;
+                if (*authctxt->auth_methods[i] == '\0') {
+                        debug2("authentication methods list %d complete", i);
+                        return 1;
+                }
+                debug3("authentication methods list %d remaining: \"%s\"",
+                    i, authctxt->auth_methods[i]);
+        }
+        /* This should not happen, but would be bad if it did */
+        if (!found)
+                fatal("%s: method not in AuthenticationMethods", __func__);
+        return 0;
+}
+
+
diff --git a/authfile.c b/authfile.c
index b0b4e1272..1ecbda8b1 100644
--- a/authfile.c
+++ b/authfile.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: authfile.c,v 1.93 2012/01/25 19:36:31 markus Exp $ */
+/* $OpenBSD: authfile.c,v 1.95 2013/01/08 18:49:04 markus Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -151,7 +151,7 @@ key_private_rsa1_to_blob(Key *key, Buffer *blob, const char *passphrase,
         cipher_set_key_string(&ciphercontext, cipher, passphrase,
             CIPHER_ENCRYPT);
         cipher_crypt(&ciphercontext, cp,
-            buffer_ptr(&buffer), buffer_len(&buffer));
+            buffer_ptr(&buffer), buffer_len(&buffer), 0, 0);
         cipher_cleanup(&ciphercontext);
         memset(&ciphercontext, 0, sizeof(ciphercontext));
 
@@ -475,7 +475,7 @@ key_parse_private_rsa1(Buffer *blob, const char *passphrase, char **commentp)
         cipher_set_key_string(&ciphercontext, cipher, passphrase,
             CIPHER_DECRYPT);
         cipher_crypt(&ciphercontext, cp,
-            buffer_ptr(&copy), buffer_len(&copy));
+            buffer_ptr(&copy), buffer_len(&copy), 0, 0);
         cipher_cleanup(&ciphercontext);
         memset(&ciphercontext, 0, sizeof(ciphercontext));
         buffer_free(&copy);
diff --git a/buildpkg.sh.in b/buildpkg.sh.in
index 4de9d42e4..4b842b3f7 100644
--- a/buildpkg.sh.in
+++ b/buildpkg.sh.in
@@ -337,17 +337,17 @@ then
 else
         if [ "\${USE_SYM_LINKS}" = yes ]
         then
-                [ "$RCS_D" = yes ]  &&  \
+                [ "$RCS_D" = yes ]  &&  \\
         installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rcS.d/${SYSVINITSTOPT}${SYSVINIT_NAME}=../init.d/${SYSVINIT_NAME} s
                 installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rc0.d/${SYSVINITSTOPT}${SYSVINIT_NAME}=../init.d/${SYSVINIT_NAME} s
-                [ "$RC1_D" = no ]  ||  \
+                [ "$RC1_D" = no ]  ||  \\
                 installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rc1.d/${SYSVINITSTOPT}${SYSVINIT_NAME}=../init.d/${SYSVINIT_NAME} s
                 installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rc2.d/${SYSVINITSTART}${SYSVINIT_NAME}=../init.d/${SYSVINIT_NAME} s
         else
-                [ "$RCS_D" = yes ]  &&  \
+                [ "$RCS_D" = yes ]  &&  \\
         installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rcS.d/${SYSVINITSTOPT}${SYSVINIT_NAME}=\${PKG_INSTALL_ROOT}$TEST_DIR/etc/init.d/${SYSVINIT_NAME} l
                 installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rc0.d/${SYSVINITSTOPT}${SYSVINIT_NAME}=\${PKG_INSTALL_ROOT}$TEST_DIR/etc/init.d/${SYSVINIT_NAME} l
-                [ "$RC1_D" = no ]  ||  \
+                [ "$RC1_D" = no ]  ||  \\
                 installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rc1.d/${SYSVINITSTOPT}${SYSVINIT_NAME}=\${PKG_INSTALL_ROOT}$TEST_DIR/etc/init.d/${SYSVINIT_NAME} l
                 installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rc2.d/${SYSVINITSTART}${SYSVINIT_NAME}=\${PKG_INSTALL_ROOT}$TEST_DIR/etc/init.d/${SYSVINIT_NAME} l
         fi
@@ -538,10 +538,10 @@ then
 PRE_INS_STOP=no
 POST_INS_START=no
 # determine if should restart the daemon
-if [ -s ${piddir}/sshd.pid  ] && \
+if [ -s ${piddir}/sshd.pid  ] && \\
     /usr/bin/svcs -H $OPENSSH_FMRI 2>&1 | egrep "^online" > /dev/null 2>&1
 then
-        ans=\`ckyorn -d n \
+        ans=\`ckyorn -d n \\
 -p "Should the running sshd daemon be restarted? ${DEF_MSG}"\` || exit \$?
         case \$ans in
                 [y,Y]*) PRE_INS_STOP=yes
@@ -552,7 +552,7 @@ then
 else
 
 # determine if we should start sshd
-        ans=\`ckyorn -d n \
+        ans=\`ckyorn -d n \\
 -p "Start the sshd daemon after installing this package? ${DEF_MSG}"\` || exit \$?
         case \$ans in
                 [y,Y]*) POST_INS_START=yes ;;
@@ -573,7 +573,7 @@ USE_SYM_LINKS=no
 PRE_INS_STOP=no
 POST_INS_START=no
 # Use symbolic links?
-ans=\`ckyorn -d n \
+ans=\`ckyorn -d n \\
 -p "Do you want symbolic links for the start/stop scripts? ${DEF_MSG}"\` || exit \$?
 case \$ans in
         [y,Y]*) USE_SYM_LINKS=yes ;;
@@ -582,7 +582,7 @@ esac
 # determine if should restart the daemon
 if [ -s ${piddir}/sshd.pid  -a  -f ${TEST_DIR}/etc/init.d/${SYSVINIT_NAME} ]
 then
-        ans=\`ckyorn -d n \
+        ans=\`ckyorn -d n \\
 -p "Should the running sshd daemon be restarted? ${DEF_MSG}"\` || exit \$?
         case \$ans in
                 [y,Y]*) PRE_INS_STOP=yes
@@ -593,7 +593,7 @@ then
 else
 
 # determine if we should start sshd
-        ans=\`ckyorn -d n \
+        ans=\`ckyorn -d n \\
 -p "Start the sshd daemon after installing this package? ${DEF_MSG}"\` || exit \$?
         case \$ans in
                 [y,Y]*) POST_INS_START=yes ;;
diff --git a/channels.c b/channels.c
index 7791febd7..9cf85a38d 100644
--- a/channels.c
+++ b/channels.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: channels.c,v 1.318 2012/04/23 08:18:17 djm Exp $ */
+/* $OpenBSD: channels.c,v 1.319 2012/12/02 20:46:11 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -3165,12 +3165,10 @@ channel_add_adm_permitted_opens(char *host, int port)
 void
 channel_disable_adm_local_opens(void)
 {
-        if (num_adm_permitted_opens == 0) {
-                permitted_adm_opens = xmalloc(sizeof(*permitted_adm_opens));
-                permitted_adm_opens[num_adm_permitted_opens].host_to_connect
-                   = NULL;
-                num_adm_permitted_opens = 1;
-        }
+        channel_clear_adm_permitted_opens();
+        permitted_adm_opens = xmalloc(sizeof(*permitted_adm_opens));
+        permitted_adm_opens[num_adm_permitted_opens].host_to_connect = NULL;
+        num_adm_permitted_opens = 1;
 }
 
 void
diff --git a/cipher-acss.c b/cipher-acss.c
deleted file mode 100644
index e755f92b9..000000000
--- a/cipher-acss.c
+++ /dev/null
@@ -1,86 +0,0 @@
-/*
- * Copyright (c) 2004 The OpenBSD project
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#include "includes.h"
-
-#include <openssl/evp.h>
-
-#include <string.h>
-
-#if !defined(EVP_CTRL_SET_ACSS_MODE) && (OPENSSL_VERSION_NUMBER >= 0x00907000L)
-
-#include "acss.h"
-#include "openbsd-compat/openssl-compat.h"
-
-#define data(ctx) ((EVP_ACSS_KEY *)(ctx)->cipher_data)
-
-typedef struct {
-        ACSS_KEY ks;
-} EVP_ACSS_KEY;
-
-#define EVP_CTRL_SET_ACSS_MODE          0xff06
-#define EVP_CTRL_SET_ACSS_SUBKEY        0xff07
-
-static int
-acss_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
-    const unsigned char *iv, int enc)
-{
-        acss_setkey(&data(ctx)->ks,key,enc,ACSS_DATA);
-        return 1;
-}
-
-static int
-acss_ciph(EVP_CIPHER_CTX *ctx, unsigned char *out, const unsigned char *in,
-    LIBCRYPTO_EVP_INL_TYPE inl)
-{
-        acss(&data(ctx)->ks,inl,in,out);
-        return 1;
-}
-
-static int
-acss_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, void *ptr)
-{
-        switch(type) {
-        case EVP_CTRL_SET_ACSS_MODE:
-                data(ctx)->ks.mode = arg;
-                return 1;
-        case EVP_CTRL_SET_ACSS_SUBKEY:
-                acss_setsubkey(&data(ctx)->ks,(unsigned char *)ptr);
-                return 1;
-        default:
-                return -1;
-        }
-}
-
-const EVP_CIPHER *
-evp_acss(void)
-{
-        static EVP_CIPHER acss_cipher;
-
-        memset(&acss_cipher, 0, sizeof(EVP_CIPHER));
-
-        acss_cipher.nid = NID_undef;
-        acss_cipher.block_size = 1;
-        acss_cipher.key_len = 5;
-        acss_cipher.init = acss_init_key;
-        acss_cipher.do_cipher = acss_ciph;
-        acss_cipher.ctx_size = sizeof(EVP_ACSS_KEY);
-        acss_cipher.ctrl = acss_ctrl;
-
-        return (&acss_cipher);
-}
-#endif
-
diff --git a/cipher-aes.c b/cipher-aes.c
index bfda6d2f2..07ec7aa5d 100644
--- a/cipher-aes.c
+++ b/cipher-aes.c
@@ -46,9 +46,6 @@ struct ssh_rijndael_ctx
         u_char          r_iv[RIJNDAEL_BLOCKSIZE];
 };
 
-const EVP_CIPHER * evp_rijndael(void);
-void ssh_rijndael_iv(EVP_CIPHER_CTX *, int, u_char *, u_int);
-
 static int
 ssh_rijndael_init(EVP_CIPHER_CTX *ctx, const u_char *key, const u_char *iv,
     int enc)
diff --git a/cipher-ctr.c b/cipher-ctr.c
index 04975b4b6..d1fe69f57 100644
--- a/cipher-ctr.c
+++ b/cipher-ctr.c
@@ -16,6 +16,7 @@
  */
 #include "includes.h"
 
+#ifndef OPENSSL_HAVE_EVPCTR
 #include <sys/types.h>
 
 #include <stdarg.h>
@@ -33,9 +34,6 @@
 #include <openssl/aes.h>
 #endif
 
-const EVP_CIPHER *evp_aes_128_ctr(void);
-void ssh_aes_ctr_iv(EVP_CIPHER_CTX *, int, u_char *, size_t);
-
 struct ssh_aes_ctr_ctx
 {
         AES_KEY         aes_ctx;
@@ -144,3 +142,5 @@ evp_aes_128_ctr(void)
 #endif
         return (&aes_ctr);
 }
+
+#endif /* OPENSSL_HAVE_EVPCTR */
diff --git a/cipher.c b/cipher.c
index bb5c0ac3a..9ca1d0065 100644
--- a/cipher.c
+++ b/cipher.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: cipher.c,v 1.82 2009/01/26 09:58:15 markus Exp $ */
+/* $OpenBSD: cipher.c,v 1.87 2013/01/26 06:11:05 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -54,41 +54,46 @@
 extern const EVP_CIPHER *evp_ssh1_bf(void);
 extern const EVP_CIPHER *evp_ssh1_3des(void);
 extern void ssh1_3des_iv(EVP_CIPHER_CTX *, int, u_char *, int);
-extern const EVP_CIPHER *evp_aes_128_ctr(void);
-extern void ssh_aes_ctr_iv(EVP_CIPHER_CTX *, int, u_char *, u_int);
 
 struct Cipher {
         char    *name;
         int     number;         /* for ssh1 only */
         u_int   block_size;
         u_int   key_len;
+        u_int   iv_len;         /* defaults to block_size */
+        u_int   auth_len;
         u_int   discard_len;
         u_int   cbc_mode;
         const EVP_CIPHER        *(*evptype)(void);
 } ciphers[] = {
-        { "none",               SSH_CIPHER_NONE, 8, 0, 0, 0, EVP_enc_null },
-        { "des",                SSH_CIPHER_DES, 8, 8, 0, 1, EVP_des_cbc },
-        { "3des",               SSH_CIPHER_3DES, 8, 16, 0, 1, evp_ssh1_3des },
-        { "blowfish",           SSH_CIPHER_BLOWFISH, 8, 32, 0, 1, evp_ssh1_bf },
-
-        { "3des-cbc",           SSH_CIPHER_SSH2, 8, 24, 0, 1, EVP_des_ede3_cbc },
-        { "blowfish-cbc",       SSH_CIPHER_SSH2, 8, 16, 0, 1, EVP_bf_cbc },
-        { "cast128-cbc",        SSH_CIPHER_SSH2, 8, 16, 0, 1, EVP_cast5_cbc },
-        { "arcfour",            SSH_CIPHER_SSH2, 8, 16, 0, 0, EVP_rc4 },
-        { "arcfour128",         SSH_CIPHER_SSH2, 8, 16, 1536, 0, EVP_rc4 },
-        { "arcfour256",         SSH_CIPHER_SSH2, 8, 32, 1536, 0, EVP_rc4 },
-        { "aes128-cbc",         SSH_CIPHER_SSH2, 16, 16, 0, 1, EVP_aes_128_cbc },
-        { "aes192-cbc",         SSH_CIPHER_SSH2, 16, 24, 0, 1, EVP_aes_192_cbc },
-        { "aes256-cbc",         SSH_CIPHER_SSH2, 16, 32, 0, 1, EVP_aes_256_cbc },
+        { "none",       SSH_CIPHER_NONE, 8, 0, 0, 0, 0, 0, EVP_enc_null },
+        { "des",        SSH_CIPHER_DES, 8, 8, 0, 0, 0, 1, EVP_des_cbc },
+        { "3des",       SSH_CIPHER_3DES, 8, 16, 0, 0, 0, 1, evp_ssh1_3des },
+        { "blowfish",   SSH_CIPHER_BLOWFISH, 8, 32, 0, 0, 0, 1, evp_ssh1_bf },
+
+        { "3des-cbc",   SSH_CIPHER_SSH2, 8, 24, 0, 0, 0, 1, EVP_des_ede3_cbc },
+        { "blowfish-cbc",
+                        SSH_CIPHER_SSH2, 8, 16, 0, 0, 0, 1, EVP_bf_cbc },
+        { "cast128-cbc",
+                        SSH_CIPHER_SSH2, 8, 16, 0, 0, 0, 1, EVP_cast5_cbc },
+        { "arcfour",    SSH_CIPHER_SSH2, 8, 16, 0, 0, 0, 0, EVP_rc4 },
+        { "arcfour128", SSH_CIPHER_SSH2, 8, 16, 0, 0, 1536, 0, EVP_rc4 },
+        { "arcfour256", SSH_CIPHER_SSH2, 8, 32, 0, 0, 1536, 0, EVP_rc4 },
+        { "aes128-cbc", SSH_CIPHER_SSH2, 16, 16, 0, 0, 0, 1, EVP_aes_128_cbc },
+        { "aes192-cbc", SSH_CIPHER_SSH2, 16, 24, 0, 0, 0, 1, EVP_aes_192_cbc },
+        { "aes256-cbc", SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 1, EVP_aes_256_cbc },
         { "rijndael-cbc@lysator.liu.se",
-                                SSH_CIPHER_SSH2, 16, 32, 0, 1, EVP_aes_256_cbc },
-        { "aes128-ctr",         SSH_CIPHER_SSH2, 16, 16, 0, 0, evp_aes_128_ctr },
-        { "aes192-ctr",         SSH_CIPHER_SSH2, 16, 24, 0, 0, evp_aes_128_ctr },
-        { "aes256-ctr",         SSH_CIPHER_SSH2, 16, 32, 0, 0, evp_aes_128_ctr },
-#ifdef USE_CIPHER_ACSS
-        { "acss@openssh.org",   SSH_CIPHER_SSH2, 16, 5, 0, 0, EVP_acss },
+                        SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 1, EVP_aes_256_cbc },
+        { "aes128-ctr", SSH_CIPHER_SSH2, 16, 16, 0, 0, 0, 0, EVP_aes_128_ctr },
+        { "aes192-ctr", SSH_CIPHER_SSH2, 16, 24, 0, 0, 0, 0, EVP_aes_192_ctr },
+        { "aes256-ctr", SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 0, EVP_aes_256_ctr },
+#ifdef OPENSSL_HAVE_EVPGCM
+        { "aes128-gcm@openssh.com",
+                        SSH_CIPHER_SSH2, 16, 16, 12, 16, 0, 0, EVP_aes_128_gcm },
+        { "aes256-gcm@openssh.com",
+                        SSH_CIPHER_SSH2, 16, 32, 12, 16, 0, 0, EVP_aes_256_gcm },
 #endif
-        { NULL,                 SSH_CIPHER_INVALID, 0, 0, 0, 0, NULL }
+        { NULL,         SSH_CIPHER_INVALID, 0, 0, 0, 0, 0, 0, NULL }
 };
 
 /*--*/
@@ -106,6 +111,18 @@ cipher_keylen(const Cipher *c)
 }
 
 u_int
+cipher_authlen(const Cipher *c)
+{
+        return (c->auth_len);
+}
+
+u_int
+cipher_ivlen(const Cipher *c)
+{
+        return (c->iv_len ? c->iv_len : c->block_size);
+}
+
+u_int
 cipher_get_number(const Cipher *c)
 {
         return (c->number);
@@ -224,11 +241,12 @@ cipher_init(CipherContext *cc, Cipher *cipher,
                         keylen = 8;
         }
         cc->plaintext = (cipher->number == SSH_CIPHER_NONE);
+        cc->encrypt = do_encrypt;
 
         if (keylen < cipher->key_len)
                 fatal("cipher_init: key length %d is insufficient for %s.",
                     keylen, cipher->name);
-        if (iv != NULL && ivlen < cipher->block_size)
+        if (iv != NULL && ivlen < cipher_ivlen(cipher))
                 fatal("cipher_init: iv length %d is insufficient for %s.",
                     ivlen, cipher->name);
         cc->cipher = cipher;
@@ -249,6 +267,11 @@ cipher_init(CipherContext *cc, Cipher *cipher,
             (do_encrypt == CIPHER_ENCRYPT)) == 0)
                 fatal("cipher_init: EVP_CipherInit failed for %s",
                     cipher->name);
+        if (cipher_authlen(cipher) &&
+            !EVP_CIPHER_CTX_ctrl(&cc->evp, EVP_CTRL_GCM_SET_IV_FIXED,
+            -1, (u_char *)iv))
+                fatal("cipher_init: EVP_CTRL_GCM_SET_IV_FIXED failed for %s",
+                    cipher->name);
         klen = EVP_CIPHER_CTX_key_length(&cc->evp);
         if (klen > 0 && keylen != (u_int)klen) {
                 debug2("cipher_init: set keylen (%d -> %d)", klen, keylen);
@@ -273,13 +296,59 @@ cipher_init(CipherContext *cc, Cipher *cipher,
         }
 }
 
+/*
+ * cipher_crypt() operates as following:
+ * Copy 'aadlen' bytes (without en/decryption) from 'src' to 'dest'.
+ * Theses bytes are treated as additional authenticated data for
+ * authenticated encryption modes.
+ * En/Decrypt 'len' bytes at offset 'aadlen' from 'src' to 'dest'.
+ * Use 'authlen' bytes at offset 'len'+'aadlen' as the authentication tag.
+ * This tag is written on encryption and verified on decryption.
+ * Both 'aadlen' and 'authlen' can be set to 0.
+ */
 void
-cipher_crypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
+cipher_crypt(CipherContext *cc, u_char *dest, const u_char *src,
+    u_int len, u_int aadlen, u_int authlen)
 {
+        if (authlen) {
+                u_char lastiv[1];
+
+                if (authlen != cipher_authlen(cc->cipher))
+                        fatal("%s: authlen mismatch %d", __func__, authlen);
+                /* increment IV */
+                if (!EVP_CIPHER_CTX_ctrl(&cc->evp, EVP_CTRL_GCM_IV_GEN,
+                    1, lastiv))
+                        fatal("%s: EVP_CTRL_GCM_IV_GEN", __func__);
+                /* set tag on decyption */
+                if (!cc->encrypt &&
+                    !EVP_CIPHER_CTX_ctrl(&cc->evp, EVP_CTRL_GCM_SET_TAG,
+                    authlen, (u_char *)src + aadlen + len))
+                        fatal("%s: EVP_CTRL_GCM_SET_TAG", __func__);
+        }
+        if (aadlen) {
+                if (authlen &&
+                    EVP_Cipher(&cc->evp, NULL, (u_char *)src, aadlen) < 0)
+                        fatal("%s: EVP_Cipher(aad) failed", __func__);
+                memcpy(dest, src, aadlen);
+        }
         if (len % cc->cipher->block_size)
-                fatal("cipher_encrypt: bad plaintext length %d", len);
-        if (EVP_Cipher(&cc->evp, dest, (u_char *)src, len) == 0)
-                fatal("evp_crypt: EVP_Cipher failed");
+                fatal("%s: bad plaintext length %d", __func__, len);
+        if (EVP_Cipher(&cc->evp, dest + aadlen, (u_char *)src + aadlen,
+            len) < 0)
+                fatal("%s: EVP_Cipher failed", __func__);
+        if (authlen) {
+                /* compute tag (on encrypt) or verify tag (on decrypt) */
+                if (EVP_Cipher(&cc->evp, NULL, NULL, 0) < 0) {
+                        if (cc->encrypt)
+                                fatal("%s: EVP_Cipher(final) failed", __func__);
+                        else
+                                fatal("Decryption integrity check failed");
+                }
+                if (cc->encrypt &&
+                    !EVP_CIPHER_CTX_ctrl(&cc->evp, EVP_CTRL_GCM_GET_TAG,
+                    authlen, dest + aadlen + len))
+                        fatal("%s: EVP_CTRL_GCM_GET_TAG", __func__);
+        }
 }
 
 void
@@ -351,10 +420,12 @@ cipher_get_keyiv(CipherContext *cc, u_char *iv, u_int len)
                         ssh_rijndael_iv(&cc->evp, 0, iv, len);
                 else
 #endif
+#ifndef OPENSSL_HAVE_EVPCTR
                 if (c->evptype == evp_aes_128_ctr)
                         ssh_aes_ctr_iv(&cc->evp, 0, iv, len);
                 else
-                        memcpy(iv, cc->evp.iv, len);
+#endif
+                memcpy(iv, cc->evp.iv, len);
                 break;
         case SSH_CIPHER_3DES:
                 ssh1_3des_iv(&cc->evp, 0, iv, 24);
@@ -382,10 +453,12 @@ cipher_set_keyiv(CipherContext *cc, u_char *iv)
                         ssh_rijndael_iv(&cc->evp, 1, iv, evplen);
                 else
 #endif
+#ifndef OPENSSL_HAVE_EVPCTR
                 if (c->evptype == evp_aes_128_ctr)
                         ssh_aes_ctr_iv(&cc->evp, 1, iv, evplen);
                 else
-                        memcpy(cc->evp.iv, iv, evplen);
+#endif
+                memcpy(cc->evp.iv, iv, evplen);
                 break;
         case SSH_CIPHER_3DES:
                 ssh1_3des_iv(&cc->evp, 1, iv, 24);
@@ -395,21 +468,13 @@ cipher_set_keyiv(CipherContext *cc, u_char *iv)
         }
 }
 
-#if OPENSSL_VERSION_NUMBER < 0x00907000L
-#define EVP_X_STATE(evp)        &(evp).c
-#define EVP_X_STATE_LEN(evp)    sizeof((evp).c)
-#else
-#define EVP_X_STATE(evp)        (evp).cipher_data
-#define EVP_X_STATE_LEN(evp)    (evp).cipher->ctx_size
-#endif
-
 int
 cipher_get_keycontext(const CipherContext *cc, u_char *dat)
 {
         Cipher *c = cc->cipher;
         int plen = 0;
 
-        if (c->evptype == EVP_rc4 || c->evptype == EVP_acss) {
+        if (c->evptype == EVP_rc4) {
                 plen = EVP_X_STATE_LEN(cc->evp);
                 if (dat == NULL)
                         return (plen);
@@ -424,7 +489,7 @@ cipher_set_keycontext(CipherContext *cc, u_char *dat)
         Cipher *c = cc->cipher;
         int plen;
 
-        if (c->evptype == EVP_rc4 || c->evptype == EVP_acss) {
+        if (c->evptype == EVP_rc4) {
                 plen = EVP_X_STATE_LEN(cc->evp);
                 memcpy(EVP_X_STATE(cc->evp), dat, plen);
         }
diff --git a/cipher.h b/cipher.h
index 3dd2270bb..8cb57c3e5 100644
--- a/cipher.h
+++ b/cipher.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: cipher.h,v 1.37 2009/01/26 09:58:15 markus Exp $ */
+/* $OpenBSD: cipher.h,v 1.39 2013/01/08 18:49:04 markus Exp $ */
 
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -64,6 +64,7 @@ typedef struct CipherContext CipherContext;
 struct Cipher;
 struct CipherContext {
         int     plaintext;
+        int     encrypt;
         EVP_CIPHER_CTX evp;
         Cipher *cipher;
 };
@@ -76,11 +77,14 @@ char	*cipher_name(int);
 int      ciphers_valid(const char *);
 void     cipher_init(CipherContext *, Cipher *, const u_char *, u_int,
     const u_char *, u_int, int);
-void     cipher_crypt(CipherContext *, u_char *, const u_char *, u_int);
+void     cipher_crypt(CipherContext *, u_char *, const u_char *,
+    u_int, u_int, u_int);
 void     cipher_cleanup(CipherContext *);
 void     cipher_set_key_string(CipherContext *, Cipher *, const char *, int);
 u_int    cipher_blocksize(const Cipher *);
 u_int    cipher_keylen(const Cipher *);
+u_int    cipher_authlen(const Cipher *);
+u_int    cipher_ivlen(const Cipher *);
 u_int    cipher_is_cbc(const Cipher *);
 
 u_int    cipher_get_number(const Cipher *);
diff --git a/clientloop.c b/clientloop.c
index 5b76b9893..1a16b2525 100644
--- a/clientloop.c
+++ b/clientloop.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: clientloop.c,v 1.240 2012/06/20 04:42:58 djm Exp $ */
+/* $OpenBSD: clientloop.c,v 1.248 2013/01/02 00:32:07 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -977,9 +977,9 @@ process_cmdline(void)
                         goto out;
                 }
                 if (local || dynamic) {
-                        if (channel_setup_local_fwd_listener(fwd.listen_host,
+                        if (!channel_setup_local_fwd_listener(fwd.listen_host,
                             fwd.listen_port, fwd.connect_host,
-                            fwd.connect_port, options.gateway_ports) < 0) {
+                            fwd.connect_port, options.gateway_ports)) {
                                 logit("Port forwarding failed.");
                                 goto out;
                         }
@@ -1005,6 +1005,63 @@ out:
                 xfree(fwd.connect_host);
 }
 
+/* reasons to suppress output of an escape command in help output */
+#define SUPPRESS_NEVER          0       /* never suppress, always show */
+#define SUPPRESS_PROTO1         1       /* don't show in protocol 1 sessions */
+#define SUPPRESS_MUXCLIENT      2       /* don't show in mux client sessions */
+#define SUPPRESS_MUXMASTER      4       /* don't show in mux master sessions */
+#define SUPPRESS_SYSLOG         8       /* don't show when logging to syslog */
+struct escape_help_text {
+        const char *cmd;
+        const char *text;
+        unsigned int flags;
+};
+static struct escape_help_text esc_txt[] = {
+    {".",  "terminate session", SUPPRESS_MUXMASTER},
+    {".",  "terminate connection (and any multiplexed sessions)",
+        SUPPRESS_MUXCLIENT},
+    {"B",  "send a BREAK to the remote system", SUPPRESS_PROTO1},
+    {"C",  "open a command line", SUPPRESS_MUXCLIENT},
+    {"R",  "request rekey", SUPPRESS_PROTO1},
+    {"V/v",  "decrease/increase verbosity (LogLevel)", SUPPRESS_MUXCLIENT},
+    {"^Z", "suspend ssh", SUPPRESS_MUXCLIENT},
+    {"#",  "list forwarded connections", SUPPRESS_NEVER},
+    {"&",  "background ssh (when waiting for connections to terminate)",
+        SUPPRESS_MUXCLIENT},
+    {"?", "this message", SUPPRESS_NEVER},
+};
+
+static void
+print_escape_help(Buffer *b, int escape_char, int protocol2, int mux_client,
+    int using_stderr)
+{
+        unsigned int i, suppress_flags;
+        char string[1024];
+
+        snprintf(string, sizeof string, "%c?\r\n"
+            "Supported escape sequences:\r\n", escape_char);
+        buffer_append(b, string, strlen(string));
+
+        suppress_flags = (protocol2 ? 0 : SUPPRESS_PROTO1) |
+            (mux_client ? SUPPRESS_MUXCLIENT : 0) |
+            (mux_client ? 0 : SUPPRESS_MUXMASTER) |
+            (using_stderr ? 0 : SUPPRESS_SYSLOG);
+
+        for (i = 0; i < sizeof(esc_txt)/sizeof(esc_txt[0]); i++) {
+                if (esc_txt[i].flags & suppress_flags)
+                        continue;
+                snprintf(string, sizeof string, " %c%-3s - %s\r\n",
+                    escape_char, esc_txt[i].cmd, esc_txt[i].text);
+                buffer_append(b, string, strlen(string));
+        }
+
+        snprintf(string, sizeof string,
+            " %c%c   - send the escape character by typing it twice\r\n"
+            "(Note that escapes are only recognized immediately after "
+            "newline.)\r\n", escape_char, escape_char);
+        buffer_append(b, string, strlen(string));
+}
+
 /* 
  * Process the characters one by one, call with c==NULL for proto1 case.
  */
@@ -1055,6 +1112,8 @@ process_escapes(Channel *c, Buffer *bin, Buffer *bout, Buffer *berr,
                                 if (c && c->ctl_chan != -1) {
                                         chan_read_failed(c);
                                         chan_write_failed(c);
+                                        mux_master_session_cleanup_cb(c->self,
+                                            NULL);
                                         return 0;
                                 } else
                                         quit_pending = 1;
@@ -1063,11 +1122,16 @@ process_escapes(Channel *c, Buffer *bin, Buffer *bout, Buffer *berr,
                         case 'Z' - 64:
                                 /* XXX support this for mux clients */
                                 if (c && c->ctl_chan != -1) {
+                                        char b[16];
  noescape:
+                                        if (ch == 'Z' - 64)
+                                                snprintf(b, sizeof b, "^Z");
+                                        else
+                                                snprintf(b, sizeof b, "%c", ch);
                                         snprintf(string, sizeof string,
-                                            "%c%c escape not available to "
+                                            "%c%s escape not available to "
                                             "multiplexed sessions\r\n",
-                                            escape_char, ch);
+                                            escape_char, b);
                                         buffer_append(berr, string,
                                             strlen(string));
                                         continue;
@@ -1106,6 +1170,31 @@ process_escapes(Channel *c, Buffer *bin, Buffer *bout, Buffer *berr,
                                 }
                                 continue;
 
+                        case 'V':
+                                /* FALLTHROUGH */
+                        case 'v':
+                                if (c && c->ctl_chan != -1)
+                                        goto noescape;
+                                if (!log_is_on_stderr()) {
+                                        snprintf(string, sizeof string,
+                                            "%c%c [Logging to syslog]\r\n",
+                                             escape_char, ch);
+                                        buffer_append(berr, string,
+                                            strlen(string));
+                                        continue;
+                                }
+                                if (ch == 'V' && options.log_level >
+                                    SYSLOG_LEVEL_QUIET)
+                                        log_change_level(--options.log_level);
+                                if (ch == 'v' && options.log_level <
+                                    SYSLOG_LEVEL_DEBUG3)
+                                        log_change_level(++options.log_level);
+                                snprintf(string, sizeof string,
+                                    "%c%c [LogLevel %s]\r\n", escape_char, ch,
+                                    log_level_name(options.log_level));
+                                buffer_append(berr, string, strlen(string));
+                                continue;
+
                         case '&':
                                 if (c && c->ctl_chan != -1)
                                         goto noescape;
@@ -1159,43 +1248,9 @@ process_escapes(Channel *c, Buffer *bin, Buffer *bout, Buffer *berr,
                                 continue;
 
                         case '?':
-                                if (c && c->ctl_chan != -1) {
-                                        snprintf(string, sizeof string,
-"%c?\r\n\
-Supported escape sequences:\r\n\
-  %c.  - terminate session\r\n\
-  %cB  - send a BREAK to the remote system\r\n\
-  %cR  - Request rekey (SSH protocol 2 only)\r\n\
-  %c#  - list forwarded connections\r\n\
-  %c?  - this message\r\n\
-  %c%c  - send the escape character by typing it twice\r\n\
-(Note that escapes are only recognized immediately after newline.)\r\n",
-                                            escape_char, escape_char,
-                                            escape_char, escape_char,
-                                            escape_char, escape_char,
-                                            escape_char, escape_char);
-                                } else {
-                                        snprintf(string, sizeof string,
-"%c?\r\n\
-Supported escape sequences:\r\n\
-  %c.  - terminate connection (and any multiplexed sessions)\r\n\
-  %cB  - send a BREAK to the remote system\r\n\
-  %cC  - open a command line\r\n\
-  %cR  - Request rekey (SSH protocol 2 only)\r\n\
-  %c^Z - suspend ssh\r\n\
-  %c#  - list forwarded connections\r\n\
-  %c&  - background ssh (when waiting for connections to terminate)\r\n\
-  %c?  - this message\r\n\
-  %c%c  - send the escape character by typing it twice\r\n\
-(Note that escapes are only recognized immediately after newline.)\r\n",
-                                            escape_char, escape_char,
-                                            escape_char, escape_char,
-                                            escape_char, escape_char,
-                                            escape_char, escape_char,
-                                            escape_char, escape_char,
-                                            escape_char);
-                                }
-                                buffer_append(berr, string, strlen(string));
+                                print_escape_help(berr, escape_char, compat20,
+                                    (c && c->ctl_chan != -1),
+                                    log_is_on_stderr());
                                 continue;
 
                         case '#':
@@ -2209,10 +2264,10 @@ client_stop_mux(void)
         if (options.control_path != NULL && muxserver_sock != -1)
                 unlink(options.control_path);
         /*
-         * If we are in persist mode, signal that we should close when all
-         * active channels are closed.
+         * If we are in persist mode, or don't have a shell, signal that we
+         * should close when all active channels are closed.
          */
-        if (options.control_persist) {
+        if (options.control_persist || no_shell_flag) {
                 session_closed = 1;
                 setproctitle("[stopped mux]");
         }
diff --git a/clientloop.h b/clientloop.h
index 3bb794879..d2baa0324 100644
--- a/clientloop.h
+++ b/clientloop.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: clientloop.h,v 1.29 2011/09/09 22:46:44 djm Exp $ */
+/* $OpenBSD: clientloop.h,v 1.30 2012/08/17 00:45:45 dtucker Exp $ */
 
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -76,4 +76,5 @@ void	muxserver_listen(void);
 void    muxclient(const char *);
 void    mux_exit_message(Channel *, int);
 void    mux_tty_alloc_failed(Channel *);
+void    mux_master_session_cleanup_cb(int, void *);
 
diff --git a/compat.c b/compat.c
index 0dc089fd6..f680f4fe3 100644
--- a/compat.c
+++ b/compat.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: compat.c,v 1.79 2011/09/23 07:45:05 markus Exp $ */
+/* $OpenBSD: compat.c,v 1.80 2012/08/17 01:30:00 djm Exp $ */
 /*
  * Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl.  All rights reserved.
  *
@@ -45,6 +45,8 @@ int datafellows = 0;
 void
 enable_compat20(void)
 {
+        if (compat20)
+                return;
         debug("Enabling compatibility mode for protocol 2.0");
         compat20 = 1;
 }
diff --git a/config.h.in b/config.h.in
index 6c4f2272a..67858ef6d 100644
--- a/config.h.in
+++ b/config.h.in
@@ -74,6 +74,9 @@
 /* Define if your snprintf is busted */
 #undef BROKEN_SNPRINTF
 
+/* FreeBSD strnvis does not do what we need */
+#undef BROKEN_STRNVIS
+
 /* tcgetattr with ICANON may hang */
 #undef BROKEN_TCGETATTR_ICANON
 
@@ -215,6 +218,9 @@
 /* Define to 1 if you have the `BN_is_prime_ex' function. */
 #undef HAVE_BN_IS_PRIME_EX
 
+/* Define to 1 if you have the <bsd/libutil.h> header file. */
+#undef HAVE_BSD_LIBUTIL_H
+
 /* Define to 1 if you have the <bsm/audit.h> header file. */
 #undef HAVE_BSM_AUDIT_H
 
@@ -256,6 +262,10 @@
    don't. */
 #undef HAVE_DECL_GLOB_NOMATCH
 
+/* Define to 1 if you have the declaration of `GSS_C_NT_HOSTBASED_SERVICE',
+   and to 0 if you don't. */
+#undef HAVE_DECL_GSS_C_NT_HOSTBASED_SERVICE
+
 /* Define to 1 if you have the declaration of `h_errno', and to 0 if you
    don't. */
 #undef HAVE_DECL_H_ERRNO
@@ -326,6 +336,9 @@
 /* Define to 1 if you have the `DSA_generate_parameters_ex' function. */
 #undef HAVE_DSA_GENERATE_PARAMETERS_EX
 
+/* Define to 1 if you have the <elf.h> header file. */
+#undef HAVE_ELF_H
+
 /* Define to 1 if you have the <endian.h> header file. */
 #undef HAVE_ENDIAN_H
 
@@ -338,6 +351,9 @@
 /* Define if your system has /etc/default/login */
 #undef HAVE_ETC_DEFAULT_LOGIN
 
+/* Define if libcrypto has EVP_CIPHER_CTX_ctrl */
+#undef HAVE_EVP_CIPHER_CTX_CTRL
+
 /* Define to 1 if you have the `EVP_sha256' function. */
 #undef HAVE_EVP_SHA256
 
@@ -428,6 +444,12 @@
 /* Define to 1 if you have the `getpeerucred' function. */
 #undef HAVE_GETPEERUCRED
 
+/* Define to 1 if you have the `getpgid' function. */
+#undef HAVE_GETPGID
+
+/* Define to 1 if you have the `getpgrp' function. */
+#undef HAVE_GETPGRP
+
 /* Define to 1 if you have the `getpwanam' function. */
 #undef HAVE_GETPWANAM
 
@@ -972,6 +994,9 @@
 /* Define to 1 if you have the `strtoul' function. */
 #undef HAVE_STRTOUL
 
+/* Define to 1 if you have the `strtoull' function. */
+#undef HAVE_STRTOULL
+
 /* define if you have struct addrinfo data type */
 #undef HAVE_STRUCT_ADDRINFO
 
@@ -1152,6 +1177,9 @@
 /* Define to 1 if you have the `user_from_uid' function. */
 #undef HAVE_USER_FROM_UID
 
+/* Define to 1 if you have the `usleep' function. */
+#undef HAVE_USLEEP
+
 /* Define to 1 if you have the <util.h> header file. */
 #undef HAVE_UTIL_H
 
@@ -1307,6 +1335,9 @@
 /* Need setpgrp to acquire controlling tty */
 #undef NEED_SETPGRP
 
+/* compiler does not accept __attribute__ on return types */
+#undef NO_ATTRIBUTE_ON_RETURN_TYPE
+
 /* Define if the concept of ports only accessible to superusers isn't known */
 #undef NO_IPPORT_RESERVED_CONCEPT
 
@@ -1322,6 +1353,12 @@
 /* libcrypto includes complete ECC support */
 #undef OPENSSL_HAS_ECC
 
+/* libcrypto has EVP AES CTR */
+#undef OPENSSL_HAVE_EVPCTR
+
+/* libcrypto has EVP AES GCM */
+#undef OPENSSL_HAVE_EVPGCM
+
 /* libcrypto is missing AES 192 and 256 bit functions */
 #undef OPENSSL_LOBOTOMISED_AES
 
@@ -1356,6 +1393,9 @@
 /* must supply username to passwd */
 #undef PASSWD_NEEDS_USERNAME
 
+/* System dirs owned by bin (uid 2) */
+#undef PLATFORM_SYS_DIR_UID
+
 /* Port number of PRNGD/EGD random number socket */
 #undef PRNGD_PORT
 
diff --git a/configure b/configure
index 2f249c936..4eeed9d09 100755
--- a/configure
+++ b/configure
@@ -1,5 +1,5 @@
 #! /bin/sh
-# From configure.ac Revision: 1.496 .
+# From configure.ac Revision: 1.518 .
 # Guess values for system-dependent variables and create Makefiles.
 # Generated by GNU Autoconf 2.68 for OpenSSH Portable.
 #
@@ -614,6 +614,8 @@ XAUTH_PATH
 STRIP_OPT
 xauth_path
 PRIVSEP_PATH
+K5LIBS
+GSSLIBS
 KRB5CONF
 SSHDLIBS
 SSHLIBS
@@ -5589,60 +5591,6 @@ if test "x$ac_cv_have_decl_PR_SET_NO_NEW_PRIVS" = xyes; then :
   have_linux_no_new_privs=1
 fi
 
-if test "x$have_linux_no_new_privs" = "x1" ; then
-ac_fn_c_check_decl "$LINENO" "SECCOMP_MODE_FILTER" "ac_cv_have_decl_SECCOMP_MODE_FILTER" "
-        #include <sys/types.h>
-        #include <linux/seccomp.h>
-
-"
-if test "x$ac_cv_have_decl_SECCOMP_MODE_FILTER" = xyes; then :
-  have_seccomp_filter=1
-fi
-
-fi
-if test "x$have_seccomp_filter" = "x1" ; then
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking kernel for seccomp_filter support" >&5
-$as_echo_n "checking kernel for seccomp_filter support... " >&6; }
-if test "$cross_compiling" = yes; then :
-   { $as_echo "$as_me:${as_lineno-$LINENO}: result: cross-compiling, assuming yes" >&5
-$as_echo "cross-compiling, assuming yes" >&6; }
-
-else
-  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-
-                #include <errno.h>
-                #include <linux/seccomp.h>
-                #include <stdlib.h>
-                #include <sys/prctl.h>
-
-int
-main ()
-{
- errno = 0;
-           prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, NULL, 0, 0);
-           exit(errno == EFAULT ? 0 : 1);
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_run "$LINENO"; then :
-   { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
-else
-
-                { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-                # Disable seccomp filter as a target
-                have_seccomp_filter=0
-
-fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
-  conftest.$ac_objext conftest.beam conftest.$ac_ext
-fi
-
-fi
-
 use_stack_protector=1
 
 # Check whether --with-stackprotect was given.
@@ -5998,6 +5946,34 @@ fi
         fi
 fi
 
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if compiler allows __attribute__ on return types" >&5
+$as_echo_n "checking if compiler allows __attribute__ on return types... " >&6; }
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+#include <stdlib.h>
+__attribute__((__unused__)) static void foo(void){return;}
+int
+main ()
+{
+ exit(0);
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_compile "$LINENO"; then :
+   { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+else
+   { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+
+$as_echo "#define NO_ATTRIBUTE_ON_RETURN_TYPE 1" >>confdefs.h
+
+
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+
 if test "x$no_attrib_nonnull" != "x1" ; then
 
 $as_echo "#define HAVE_ATTRIBUTE__NONNULL__ 1" >>confdefs.h
@@ -6089,6 +6065,7 @@ for ac_header in  \
         crypto/sha2.h \
         dirent.h \
         endian.h \
+        elf.h \
         features.h \
         fcntl.h \
         floatingpoint.h \
@@ -6515,6 +6492,9 @@ $as_echo "#define SSHPAM_CHAUTHTOK_NEEDS_RUID 1" >>confdefs.h
 
 $as_echo "#define PTY_ZEROREAD 1" >>confdefs.h
 
+
+$as_echo "#define PLATFORM_SYS_DIR_UID 2" >>confdefs.h
+
         ;;
 *-*-cygwin*)
         check_for_libcrypt_later=1
@@ -6779,6 +6759,9 @@ $as_echo "#define LOCKED_PASSWD_STRING \"*\"" >>confdefs.h
 
         $as_echo "#define SPT_TYPE SPT_PSTAT" >>confdefs.h
 
+
+$as_echo "#define PLATFORM_SYS_DIR_UID 2" >>confdefs.h
+
         maildir="/var/mail"
         LIBS="$LIBS -lsec"
         { $as_echo "$as_me:${as_lineno-$LINENO}: checking for t_error in -lxnet" >&5
@@ -7008,22 +6991,32 @@ _ACEOF
 fi
 done
 
-        have_seccomp_audit_arch=1
+        { $as_echo "$as_me:${as_lineno-$LINENO}: checking for seccomp architecture" >&5
+$as_echo_n "checking for seccomp architecture... " >&6; }
+        seccomp_audit_arch=
         case "$host" in
         x86_64-*)
-
-$as_echo "#define SECCOMP_AUDIT_ARCH AUDIT_ARCH_X86_64" >>confdefs.h
-
+                seccomp_audit_arch=AUDIT_ARCH_X86_64
                 ;;
         i*86-*)
-
-$as_echo "#define SECCOMP_AUDIT_ARCH AUDIT_ARCH_I386" >>confdefs.h
-
-                ;;
-        *)
-                have_seccomp_audit_arch=0
+                seccomp_audit_arch=AUDIT_ARCH_I386
                 ;;
+        arm*-*)
+                seccomp_audit_arch=AUDIT_ARCH_ARM
+                ;;
         esac
+        if test "x$seccomp_audit_arch" != "x" ; then
+                { $as_echo "$as_me:${as_lineno-$LINENO}: result: \"$seccomp_audit_arch\"" >&5
+$as_echo "\"$seccomp_audit_arch\"" >&6; }
+
+cat >>confdefs.h <<_ACEOF
+#define SECCOMP_AUDIT_ARCH $seccomp_audit_arch
+_ACEOF
+
+        else
+                { $as_echo "$as_me:${as_lineno-$LINENO}: result: architecture not supported" >&5
+$as_echo "architecture not supported" >&6; }
+        fi
         ;;
 mips-sony-bsd|mips-sony-newsos4)
 
@@ -7074,6 +7067,9 @@ fi
 
 $as_echo "#define BROKEN_GLOB 1" >>confdefs.h
 
+
+$as_echo "#define BROKEN_STRNVIS 1" >>confdefs.h
+
         ;;
 *-*-bsdi*)
         $as_echo "#define SETEUID_BREAKS_SETUID 1" >>confdefs.h
@@ -7558,6 +7554,7 @@ done
 
         MANTYPE=man
         TEST_SHELL=ksh
+        SKIP_DISABLE_LASTLOG_DEFINE=yes
         ;;
 *-*-unicosmk*)
 
@@ -8389,12 +8386,13 @@ fi
 done
 
 
-for ac_header in libutil.h
+for ac_header in bsd/libutil.h libutil.h
 do :
-  ac_fn_c_check_header_mongrel "$LINENO" "libutil.h" "ac_cv_header_libutil_h" "$ac_includes_default"
-if test "x$ac_cv_header_libutil_h" = xyes; then :
+  as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
+ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default"
+if eval test \"x\$"$as_ac_Header"\" = x"yes"; then :
   cat >>confdefs.h <<_ACEOF
-#define HAVE_LIBUTIL_H 1
+#define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1
 _ACEOF
 
 fi
@@ -9584,6 +9582,8 @@ for ac_func in  \
         getopt \
         getpeereid \
         getpeerucred \
+        getpgid \
+        getpgrp \
         _getpty \
         getrlimit \
         getttyent \
@@ -9643,6 +9643,7 @@ for ac_func in  \
         strtonum \
         strtoll \
         strtoul \
+        strtoull \
         swap32 \
         sysconf \
         tcgetpgrp \
@@ -9651,6 +9652,7 @@ for ac_func in  \
         unsetenv \
         updwtmpx \
         user_from_uid \
+        usleep \
         vasprintf \
         vhangup \
         vsnprintf \
@@ -11258,6 +11260,147 @@ fi
 rm -f core conftest.err conftest.$ac_objext \
     conftest$ac_exeext conftest.$ac_ext
 
+# Check for OpenSSL with EVP_aes_*ctr
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether OpenSSL has AES CTR via EVP" >&5
+$as_echo_n "checking whether OpenSSL has AES CTR via EVP... " >&6; }
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+#include <string.h>
+#include <openssl/evp.h>
+
+int
+main ()
+{
+
+        exit(EVP_aes_128_ctr() == NULL ||
+            EVP_aes_192_cbc() == NULL ||
+            EVP_aes_256_cbc() == NULL);
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"; then :
+
+                { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+
+$as_echo "#define OPENSSL_HAVE_EVPCTR 1" >>confdefs.h
+
+
+else
+
+                { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+
+
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext conftest.$ac_ext
+
+# Check for OpenSSL with EVP_aes_*gcm
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether OpenSSL has AES GCM via EVP" >&5
+$as_echo_n "checking whether OpenSSL has AES GCM via EVP... " >&6; }
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+#include <string.h>
+#include <openssl/evp.h>
+
+int
+main ()
+{
+
+        exit(EVP_aes_128_gcm() == NULL ||
+            EVP_aes_256_gcm() == NULL ||
+            EVP_CTRL_GCM_SET_IV_FIXED == 0 ||
+            EVP_CTRL_GCM_IV_GEN == 0 ||
+            EVP_CTRL_GCM_SET_TAG == 0 ||
+            EVP_CTRL_GCM_GET_TAG == 0 ||
+            EVP_CIPHER_CTX_ctrl(NULL, 0, 0, NULL) == 0);
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"; then :
+
+                { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+
+$as_echo "#define OPENSSL_HAVE_EVPGCM 1" >>confdefs.h
+
+
+else
+
+                { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+
+
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext conftest.$ac_ext
+
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing EVP_CIPHER_CTX_ctrl" >&5
+$as_echo_n "checking for library containing EVP_CIPHER_CTX_ctrl... " >&6; }
+if ${ac_cv_search_EVP_CIPHER_CTX_ctrl+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  ac_func_search_save_LIBS=$LIBS
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char EVP_CIPHER_CTX_ctrl ();
+int
+main ()
+{
+return EVP_CIPHER_CTX_ctrl ();
+  ;
+  return 0;
+}
+_ACEOF
+for ac_lib in '' crypto; do
+  if test -z "$ac_lib"; then
+    ac_res="none required"
+  else
+    ac_res=-l$ac_lib
+    LIBS="-l$ac_lib  $ac_func_search_save_LIBS"
+  fi
+  if ac_fn_c_try_link "$LINENO"; then :
+  ac_cv_search_EVP_CIPHER_CTX_ctrl=$ac_res
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext
+  if ${ac_cv_search_EVP_CIPHER_CTX_ctrl+:} false; then :
+  break
+fi
+done
+if ${ac_cv_search_EVP_CIPHER_CTX_ctrl+:} false; then :
+
+else
+  ac_cv_search_EVP_CIPHER_CTX_ctrl=no
+fi
+rm conftest.$ac_ext
+LIBS=$ac_func_search_save_LIBS
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_EVP_CIPHER_CTX_ctrl" >&5
+$as_echo "$ac_cv_search_EVP_CIPHER_CTX_ctrl" >&6; }
+ac_res=$ac_cv_search_EVP_CIPHER_CTX_ctrl
+if test "$ac_res" != no; then :
+  test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
+
+$as_echo "#define HAVE_EVP_CIPHER_CTX_CTRL 1" >>confdefs.h
+
+fi
+
+
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking if EVP_DigestUpdate returns an int" >&5
 $as_echo_n "checking if EVP_DigestUpdate returns an int... " >&6; }
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
@@ -11887,6 +12030,57 @@ _ACEOF
 
 
 
+if test "x$have_linux_no_new_privs" = "x1" ; then
+ac_fn_c_check_decl "$LINENO" "SECCOMP_MODE_FILTER" "ac_cv_have_decl_SECCOMP_MODE_FILTER" "
+        #include <sys/types.h>
+        #include <linux/seccomp.h>
+
+"
+if test "x$ac_cv_have_decl_SECCOMP_MODE_FILTER" = xyes; then :
+  have_seccomp_filter=1
+fi
+
+fi
+if test "x$have_seccomp_filter" = "x1" ; then
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking kernel for seccomp_filter support" >&5
+$as_echo_n "checking kernel for seccomp_filter support... " >&6; }
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+                #include <errno.h>
+                #include <elf.h>
+                #include <linux/audit.h>
+                #include <linux/seccomp.h>
+                #include <stdlib.h>
+                #include <sys/prctl.h>
+
+int
+main ()
+{
+ int i = $seccomp_audit_arch;
+           errno = 0;
+           prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, NULL, 0, 0);
+           exit(errno == EFAULT ? 0 : 1);
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"; then :
+   { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+else
+
+                { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+                # Disable seccomp filter as a target
+                have_seccomp_filter=0
+
+
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext conftest.$ac_ext
+fi
+
 # Decide which sandbox style to use
 sandbox_arg=""
 
@@ -11935,6 +12129,7 @@ main ()
         struct rlimit rl_zero;
         int fd, r;
         fd_set fds;
+        struct timeval tv;
 
         fd = open("/dev/null", O_RDONLY);
         FD_ZERO(&fds);
@@ -11942,7 +12137,9 @@ main ()
         rl_zero.rlim_cur = rl_zero.rlim_max = 0;
         setrlimit(RLIMIT_FSIZE, &rl_zero);
         setrlimit(RLIMIT_NOFILE, &rl_zero);
-        r = select(fd+1, &fds, NULL, NULL, NULL);
+        tv.tv_sec = 1;
+        tv.tv_usec = 0;
+        r = select(fd+1, &fds, NULL, NULL, &tv);
         exit (r == -1 ? 1 : 0);
 
   ;
@@ -11963,6 +12160,54 @@ rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
 fi
 
 
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if setrlimit(RLIMIT_NOFILE,{0,0}) works" >&5
+$as_echo_n "checking if setrlimit(RLIMIT_NOFILE,{0,0}) works... " >&6; }
+if test "$cross_compiling" = yes; then :
+  { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cross compiling: assuming yes" >&5
+$as_echo "$as_me: WARNING: cross compiling: assuming yes" >&2;}
+
+else
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+#include <sys/types.h>
+#ifdef HAVE_SYS_TIME_H
+# include <sys/time.h>
+#endif
+#include <sys/resource.h>
+#include <errno.h>
+#include <stdlib.h>
+
+int
+main ()
+{
+
+        struct rlimit rl_zero;
+        int fd, r;
+        fd_set fds;
+
+        rl_zero.rlim_cur = rl_zero.rlim_max = 0;
+        r = setrlimit(RLIMIT_NOFILE, &rl_zero);
+        exit (r == -1 ? 1 : 0);
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_run "$LINENO"; then :
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+         rlimit_nofile_zero_works=yes
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+         rlimit_nofile_zero_works=no
+fi
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
+  conftest.$ac_objext conftest.beam conftest.$ac_ext
+fi
+
+
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking if setrlimit RLIMIT_FSIZE works" >&5
 $as_echo_n "checking if setrlimit RLIMIT_FSIZE works... " >&6; }
 if test "$cross_compiling" = yes; then :
@@ -12026,11 +12271,13 @@ $as_echo "#define SANDBOX_DARWIN 1" >>confdefs.h
 elif test "x$sandbox_arg" = "xseccomp_filter" || \
      ( test -z "$sandbox_arg" && \
        test "x$have_seccomp_filter" = "x1" && \
+       test "x$ac_cv_header_elf_h" = "xyes" && \
        test "x$ac_cv_header_linux_audit_h" = "xyes" && \
-       test "x$have_seccomp_audit_arch" = "x1" && \
+       test "x$ac_cv_header_linux_filter_h" = "xyes" && \
+       test "x$seccomp_audit_arch" != "x" && \
        test "x$have_linux_no_new_privs" = "x1" && \
        test "x$ac_cv_func_prctl" = "xyes" ) ; then
-        test "x$have_seccomp_audit_arch" != "x1" && \
+        test "x$seccomp_audit_arch" = "x" && \
                 as_fn_error $? "seccomp_filter sandbox not supported on $host" "$LINENO" 5
         test "x$have_linux_no_new_privs" != "x1" && \
                 as_fn_error $? "seccomp_filter sandbox requires PR_SET_NO_NEW_PRIVS" "$LINENO" 5
@@ -12044,7 +12291,8 @@ $as_echo "#define SANDBOX_SECCOMP_FILTER 1" >>confdefs.h
 
 elif test "x$sandbox_arg" = "xrlimit" || \
      ( test -z "$sandbox_arg" && test "x$ac_cv_func_setrlimit" = "xyes" && \
-       test "x$select_works_with_rlimit" == "xyes" ) ; then
+       test "x$select_works_with_rlimit" = "xyes" && \
+       test "x$rlimit_nofile_zero_works" = "xyes" ) ; then
         test "x$ac_cv_func_setrlimit" != "xyes" && \
                 as_fn_error $? "rlimit sandbox requires setrlimit function" "$LINENO" 5
         test "x$select_works_with_rlimit" != "xyes" && \
@@ -15229,6 +15477,9 @@ fi
 
 
                 if test -x $KRB5CONF ; then
+                        K5CFLAGS="`$KRB5CONF --cflags`"
+                        K5LIBS="`$KRB5CONF --libs`"
+                        CPPFLAGS="$CPPFLAGS $K5CFLAGS"
 
                         { $as_echo "$as_me:${as_lineno-$LINENO}: checking for gssapi support" >&5
 $as_echo_n "checking for gssapi support... " >&6; }
@@ -15238,15 +15489,13 @@ $as_echo "yes" >&6; }
 
 $as_echo "#define GSSAPI 1" >>confdefs.h
 
-                                k5confopts=gssapi
+                                GSSCFLAGS="`$KRB5CONF --cflags gssapi`"
+                                GSSLIBS="`$KRB5CONF --libs gssapi`"
+                                CPPFLAGS="$CPPFLAGS $GSSCFLAGS"
                         else
                                 { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
-                                k5confopts=""
                         fi
-                        K5CFLAGS="`$KRB5CONF --cflags $k5confopts`"
-                        K5LIBS="`$KRB5CONF --libs $k5confopts`"
-                        CPPFLAGS="$CPPFLAGS $K5CFLAGS"
                         { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we are using Heimdal" >&5
 $as_echo_n "checking whether we are using Heimdal... " >&6; }
                         cat confdefs.h - <<_ACEOF >conftest.$ac_ext
@@ -15449,7 +15698,7 @@ if ${ac_cv_lib_gssapi_krb5_gss_init_sec_context+:} false; then :
   $as_echo_n "(cached) " >&6
 else
   ac_check_lib_save_LIBS=$LIBS
-LIBS="-lgssapi_krb5 $K5LIBS $LIBS"
+LIBS="-lgssapi_krb5  $LIBS"
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
@@ -15482,7 +15731,7 @@ $as_echo "$ac_cv_lib_gssapi_krb5_gss_init_sec_context" >&6; }
 if test "x$ac_cv_lib_gssapi_krb5_gss_init_sec_context" = xyes; then :
    $as_echo "#define GSSAPI 1" >>confdefs.h
 
-                                  K5LIBS="-lgssapi_krb5 $K5LIBS"
+                                  GSSLIBS="-lgssapi_krb5"
 else
    { $as_echo "$as_me:${as_lineno-$LINENO}: checking for gss_init_sec_context in -lgssapi" >&5
 $as_echo_n "checking for gss_init_sec_context in -lgssapi... " >&6; }
@@ -15490,7 +15739,7 @@ if ${ac_cv_lib_gssapi_gss_init_sec_context+:} false; then :
   $as_echo_n "(cached) " >&6
 else
   ac_check_lib_save_LIBS=$LIBS
-LIBS="-lgssapi $K5LIBS $LIBS"
+LIBS="-lgssapi  $LIBS"
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
@@ -15523,7 +15772,48 @@ $as_echo "$ac_cv_lib_gssapi_gss_init_sec_context" >&6; }
 if test "x$ac_cv_lib_gssapi_gss_init_sec_context" = xyes; then :
    $as_echo "#define GSSAPI 1" >>confdefs.h
 
-                                          K5LIBS="-lgssapi $K5LIBS"
+                                          GSSLIBS="-lgssapi"
+else
+   { $as_echo "$as_me:${as_lineno-$LINENO}: checking for gss_init_sec_context in -lgss" >&5
+$as_echo_n "checking for gss_init_sec_context in -lgss... " >&6; }
+if ${ac_cv_lib_gss_gss_init_sec_context+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  ac_check_lib_save_LIBS=$LIBS
+LIBS="-lgss  $LIBS"
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char gss_init_sec_context ();
+int
+main ()
+{
+return gss_init_sec_context ();
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"; then :
+  ac_cv_lib_gss_gss_init_sec_context=yes
+else
+  ac_cv_lib_gss_gss_init_sec_context=no
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext conftest.$ac_ext
+LIBS=$ac_check_lib_save_LIBS
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_gss_gss_init_sec_context" >&5
+$as_echo "$ac_cv_lib_gss_gss_init_sec_context" >&6; }
+if test "x$ac_cv_lib_gss_gss_init_sec_context" = xyes; then :
+   $as_echo "#define GSSAPI 1" >>confdefs.h
+
+                                                  GSSLIBS="-lgss"
 else
   { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: Cannot find any suitable gss-api library - build may fail" >&5
 $as_echo "$as_me: WARNING: Cannot find any suitable gss-api library - build may fail" >&2;}
@@ -15533,6 +15823,9 @@ fi
 fi
 
 
+fi
+
+
                         ac_fn_c_check_header_mongrel "$LINENO" "gssapi.h" "ac_cv_header_gssapi_h" "$ac_includes_default"
 if test "x$ac_cv_header_gssapi_h" = xyes; then :
 
@@ -15620,7 +15913,6 @@ fi
 done
 
 
-                LIBS="$LIBS $K5LIBS"
                 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing k_hasafs" >&5
 $as_echo_n "checking for library containing k_hasafs... " >&6; }
 if ${ac_cv_search_k_hasafs+:} false; then :
@@ -15679,12 +15971,39 @@ $as_echo "#define USE_AFS 1" >>confdefs.h
 
 fi
 
+
+                ac_fn_c_check_decl "$LINENO" "GSS_C_NT_HOSTBASED_SERVICE" "ac_cv_have_decl_GSS_C_NT_HOSTBASED_SERVICE" "
+#ifdef HAVE_GSSAPI_H
+# include <gssapi.h>
+#elif defined(HAVE_GSSAPI_GSSAPI_H)
+# include <gssapi/gssapi.h>
+#endif
+
+#ifdef HAVE_GSSAPI_GENERIC_H
+# include <gssapi_generic.h>
+#elif defined(HAVE_GSSAPI_GSSAPI_GENERIC_H)
+# include <gssapi/gssapi_generic.h>
+#endif
+
+"
+if test "x$ac_cv_have_decl_GSS_C_NT_HOSTBASED_SERVICE" = xyes; then :
+  ac_have_decl=1
+else
+  ac_have_decl=0
+fi
+
+cat >>confdefs.h <<_ACEOF
+#define HAVE_DECL_GSS_C_NT_HOSTBASED_SERVICE $ac_have_decl
+_ACEOF
+
         fi
 
 
 fi
 
 
+
+
 # Check whether user wants ConsoleKit support
 CONSOLEKIT_MSG="no"
 LIBCK_CONNECTOR=""
@@ -16868,7 +17187,6 @@ _ACEOF
 
 fi
 
-
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking if your system defines WTMPX_FILE" >&5
 $as_echo_n "checking if your system defines WTMPX_FILE... " >&6; }
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
@@ -16921,6 +17239,60 @@ if test ! -z "$blibpath" ; then
 $as_echo "$as_me: WARNING: Please check and edit blibpath in LDFLAGS in Makefile" >&2;}
 fi
 
+ac_fn_c_check_member "$LINENO" "struct lastlog" "ll_line" "ac_cv_member_struct_lastlog_ll_line" "
+#ifdef HAVE_SYS_TYPES_H
+#include <sys/types.h>
+#endif
+#ifdef HAVE_UTMP_H
+#include <utmp.h>
+#endif
+#ifdef HAVE_UTMPX_H
+#include <utmpx.h>
+#endif
+#ifdef HAVE_LASTLOG_H
+#include <lastlog.h>
+#endif
+
+"
+if test "x$ac_cv_member_struct_lastlog_ll_line" = xyes; then :
+
+else
+
+    if test x$SKIP_DISABLE_LASTLOG_DEFINE != "xyes" ; then
+        $as_echo "#define DISABLE_LASTLOG 1" >>confdefs.h
+
+    fi
+
+fi
+
+
+ac_fn_c_check_member "$LINENO" "struct utmp" "ut_line" "ac_cv_member_struct_utmp_ut_line" "
+#ifdef HAVE_SYS_TYPES_H
+#include <sys/types.h>
+#endif
+#ifdef HAVE_UTMP_H
+#include <utmp.h>
+#endif
+#ifdef HAVE_UTMPX_H
+#include <utmpx.h>
+#endif
+#ifdef HAVE_LASTLOG_H
+#include <lastlog.h>
+#endif
+
+"
+if test "x$ac_cv_member_struct_utmp_ut_line" = xyes; then :
+
+else
+
+        $as_echo "#define DISABLE_UTMP 1" >>confdefs.h
+
+        $as_echo "#define DISABLE_WTMP 1" >>confdefs.h
+
+
+fi
+
+
 CFLAGS="$CFLAGS $werror_flags"
 
 if test "x$ac_cv_func_getaddrinfo" != "xyes" ; then
diff --git a/configure.ac b/configure.ac
index fabd3e0f1..198a2056e 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,4 +1,4 @@
-# $Id: configure.ac,v 1.496 2012/07/06 01:49:29 djm Exp $
+# $Id: configure.ac,v 1.518 2013/03/20 01:55:15 djm Exp $
 #
 # Copyright (c) 1999-2004 Damien Miller
 #
@@ -15,7 +15,7 @@
 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
 AC_INIT([OpenSSH], [Portable], [openssh-unix-dev@mindrot.org])
-AC_REVISION($Revision: 1.496 $)
+AC_REVISION($Revision: 1.518 $)
 AC_CONFIG_SRCDIR([ssh.c])
 AC_LANG([C])
 
@@ -120,32 +120,6 @@ AC_CHECK_DECL([PR_SET_NO_NEW_PRIVS], [have_linux_no_new_privs=1], , [
         #include <sys/types.h>
         #include <linux/prctl.h>
 ])
-if test "x$have_linux_no_new_privs" = "x1" ; then
-AC_CHECK_DECL([SECCOMP_MODE_FILTER], [have_seccomp_filter=1], , [
-        #include <sys/types.h>
-        #include <linux/seccomp.h>
-])
-fi
-if test "x$have_seccomp_filter" = "x1" ; then
-AC_MSG_CHECKING([kernel for seccomp_filter support])
-AC_RUN_IFELSE([AC_LANG_PROGRAM([[
-                #include <errno.h>
-                #include <linux/seccomp.h>
-                #include <stdlib.h>
-                #include <sys/prctl.h>
-        ]],
-        [[ errno = 0;
-           prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, NULL, 0, 0);
-           exit(errno == EFAULT ? 0 : 1); ]])],
-        [ AC_MSG_RESULT([yes]) ], [
-                AC_MSG_RESULT([no])
-                # Disable seccomp filter as a target
-                have_seccomp_filter=0
-        ],
-        [ AC_MSG_RESULT([cross-compiling, assuming yes]) ]
-)
-fi
-
 use_stack_protector=1
 AC_ARG_WITH([stackprotect],
     [  --without-stackprotect  Don't use compiler's stack protection], [
@@ -239,6 +213,18 @@ if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
         fi
 fi
 
+AC_MSG_CHECKING([if compiler allows __attribute__ on return types])
+AC_COMPILE_IFELSE(
+    [AC_LANG_PROGRAM([[
+#include <stdlib.h>
+__attribute__((__unused__)) static void foo(void){return;}]],
+    [[ exit(0); ]])],
+    [ AC_MSG_RESULT([yes]) ],
+    [ AC_MSG_RESULT([no])
+      AC_DEFINE(NO_ATTRIBUTE_ON_RETURN_TYPE, 1,
+         [compiler does not accept __attribute__ on return types]) ]
+)
+
 if test "x$no_attrib_nonnull" != "x1" ; then
         AC_DEFINE([HAVE_ATTRIBUTE__NONNULL__], [1], [Have attribute nonnull])
 fi
@@ -310,6 +296,7 @@ AC_CHECK_HEADERS([ \
         crypto/sha2.h \
         dirent.h \
         endian.h \
+        elf.h \
         features.h \
         fcntl.h \
         floatingpoint.h \
@@ -493,6 +480,7 @@ case "$host" in
         AC_DEFINE([SSHPAM_CHAUTHTOK_NEEDS_RUID], [1],
             [AIX 5.2 and 5.3 (and presumably newer) require this])
         AC_DEFINE([PTY_ZEROREAD], [1], [read(1) can return 0 for a non-closed fd])
+        AC_DEFINE([PLATFORM_SYS_DIR_UID], 2, [System dirs owned by bin (uid 2)])
         ;;
 *-*-cygwin*)
         check_for_libcrypt_later=1
@@ -602,6 +590,7 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
         AC_DEFINE([LOCKED_PASSWD_STRING], ["*"],
                 [String used in /etc/passwd to denote locked account])
         AC_DEFINE([SPT_TYPE], [SPT_PSTAT])
+        AC_DEFINE([PLATFORM_SYS_DIR_UID], 2, [System dirs owned by bin (uid 2)])
         maildir="/var/mail"
         LIBS="$LIBS -lsec"
         AC_CHECK_LIB([xnet], [t_error], ,
@@ -713,20 +702,26 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
         AC_CHECK_HEADERS([linux/seccomp.h linux/filter.h linux/audit.h], [],
             [], [#include <linux/types.h>])
         AC_CHECK_FUNCS([prctl])
-        have_seccomp_audit_arch=1
+        AC_MSG_CHECKING([for seccomp architecture])
+        seccomp_audit_arch=
         case "$host" in
         x86_64-*)
-                AC_DEFINE([SECCOMP_AUDIT_ARCH], [AUDIT_ARCH_X86_64],
-                    [Specify the system call convention in use])
+                seccomp_audit_arch=AUDIT_ARCH_X86_64
                 ;;
         i*86-*)
-                AC_DEFINE([SECCOMP_AUDIT_ARCH], [AUDIT_ARCH_I386],
-                    [Specify the system call convention in use])
-                ;;
-        *)
-                have_seccomp_audit_arch=0
+                seccomp_audit_arch=AUDIT_ARCH_I386
                 ;;
+        arm*-*)
+                seccomp_audit_arch=AUDIT_ARCH_ARM
+                ;;
         esac
+        if test "x$seccomp_audit_arch" != "x" ; then
+                AC_MSG_RESULT(["$seccomp_audit_arch"])
+                AC_DEFINE_UNQUOTED([SECCOMP_AUDIT_ARCH], [$seccomp_audit_arch],
+                    [Specify the system call convention in use])
+        else
+                AC_MSG_RESULT([architecture not supported])
+        fi
         ;;
 mips-sony-bsd|mips-sony-newsos4)
         AC_DEFINE([NEED_SETPGRP], [1], [Need setpgrp to acquire controlling tty])
@@ -750,6 +745,7 @@ mips-sony-bsd|mips-sony-newsos4)
         AC_CHECK_HEADER([net/if_tap.h], ,
             AC_DEFINE([SSH_TUN_NO_L2], [1], [No layer 2 tunnel support]))
         AC_DEFINE([BROKEN_GLOB], [1], [FreeBSD glob does not do what we need])
+        AC_DEFINE([BROKEN_STRNVIS], [1], [FreeBSD strnvis does not do what we need])
         ;;
 *-*-bsdi*)
         AC_DEFINE([SETEUID_BREAKS_SETUID])
@@ -926,6 +922,7 @@ mips-sony-bsd|mips-sony-newsos4)
         AC_CHECK_FUNCS([getluid setluid])
         MANTYPE=man
         TEST_SHELL=ksh
+        SKIP_DISABLE_LASTLOG_DEFINE=yes
         ;;
 *-*-unicosmk*)
         AC_DEFINE([NO_SSH_LASTLOG], [1],
@@ -1194,7 +1191,7 @@ AC_CHECK_FUNCS([utimes],
 )
 
 dnl    Checks for libutil functions
-AC_CHECK_HEADERS([libutil.h])
+AC_CHECK_HEADERS([bsd/libutil.h libutil.h])
 AC_SEARCH_LIBS([fmt_scaled], [util bsd])
 AC_SEARCH_LIBS([login], [util bsd])
 AC_SEARCH_LIBS([logout], [util bsd])
@@ -1563,6 +1560,8 @@ AC_CHECK_FUNCS([ \
         getopt \
         getpeereid \
         getpeerucred \
+        getpgid \
+        getpgrp \
         _getpty \
         getrlimit \
         getttyent \
@@ -1622,6 +1621,7 @@ AC_CHECK_FUNCS([ \
         strtonum \
         strtoll \
         strtoul \
+        strtoull \
         swap32 \
         sysconf \
         tcgetpgrp \
@@ -1630,6 +1630,7 @@ AC_CHECK_FUNCS([ \
         unsetenv \
         updwtmpx \
         user_from_uid \
+        usleep \
         vasprintf \
         vhangup \
         vsnprintf \
@@ -2323,6 +2324,56 @@ AC_LINK_IFELSE(
         ]
 )
 
+# Check for OpenSSL with EVP_aes_*ctr
+AC_MSG_CHECKING([whether OpenSSL has AES CTR via EVP])
+AC_LINK_IFELSE(
+        [AC_LANG_PROGRAM([[
+#include <string.h>
+#include <openssl/evp.h>
+        ]], [[
+        exit(EVP_aes_128_ctr() == NULL ||
+            EVP_aes_192_cbc() == NULL ||
+            EVP_aes_256_cbc() == NULL);
+        ]])],
+        [
+                AC_MSG_RESULT([yes])
+                AC_DEFINE([OPENSSL_HAVE_EVPCTR], [1],
+                    [libcrypto has EVP AES CTR])
+        ],
+        [
+                AC_MSG_RESULT([no])
+        ]
+)
+
+# Check for OpenSSL with EVP_aes_*gcm
+AC_MSG_CHECKING([whether OpenSSL has AES GCM via EVP])
+AC_LINK_IFELSE(
+        [AC_LANG_PROGRAM([[
+#include <string.h>
+#include <openssl/evp.h>
+        ]], [[
+        exit(EVP_aes_128_gcm() == NULL ||
+            EVP_aes_256_gcm() == NULL ||
+            EVP_CTRL_GCM_SET_IV_FIXED == 0 ||
+            EVP_CTRL_GCM_IV_GEN == 0 ||
+            EVP_CTRL_GCM_SET_TAG == 0 ||
+            EVP_CTRL_GCM_GET_TAG == 0 ||
+            EVP_CIPHER_CTX_ctrl(NULL, 0, 0, NULL) == 0);
+        ]])],
+        [
+                AC_MSG_RESULT([yes])
+                AC_DEFINE([OPENSSL_HAVE_EVPGCM], [1],
+                    [libcrypto has EVP AES GCM])
+        ],
+        [
+                AC_MSG_RESULT([no])
+        ]
+)
+
+AC_SEARCH_LIBS([EVP_CIPHER_CTX_ctrl], [crypto],
+        [AC_DEFINE([HAVE_EVP_CIPHER_CTX_CTRL], [1],
+            [Define if libcrypto has EVP_CIPHER_CTX_ctrl])])
+
 AC_MSG_CHECKING([if EVP_DigestUpdate returns an int])
 AC_LINK_IFELSE(
         [AC_LANG_PROGRAM([[
@@ -2589,6 +2640,34 @@ AC_DEFINE_UNQUOTED([SSH_PRIVSEP_USER], ["$SSH_PRIVSEP_USER"],
         [non-privileged user for privilege separation])
 AC_SUBST([SSH_PRIVSEP_USER])
 
+if test "x$have_linux_no_new_privs" = "x1" ; then
+AC_CHECK_DECL([SECCOMP_MODE_FILTER], [have_seccomp_filter=1], , [
+        #include <sys/types.h>
+        #include <linux/seccomp.h>
+])
+fi
+if test "x$have_seccomp_filter" = "x1" ; then
+AC_MSG_CHECKING([kernel for seccomp_filter support])
+AC_LINK_IFELSE([AC_LANG_PROGRAM([[
+                #include <errno.h>
+                #include <elf.h>
+                #include <linux/audit.h>
+                #include <linux/seccomp.h>
+                #include <stdlib.h>
+                #include <sys/prctl.h>
+        ]],
+        [[ int i = $seccomp_audit_arch;
+           errno = 0;
+           prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, NULL, 0, 0);
+           exit(errno == EFAULT ? 0 : 1); ]])],
+        [ AC_MSG_RESULT([yes]) ], [
+                AC_MSG_RESULT([no])
+                # Disable seccomp filter as a target
+                have_seccomp_filter=0
+        ]
+)
+fi
+
 # Decide which sandbox style to use
 sandbox_arg=""
 AC_ARG_WITH([sandbox],
@@ -2623,6 +2702,7 @@ AC_RUN_IFELSE(
         struct rlimit rl_zero;
         int fd, r;
         fd_set fds;
+        struct timeval tv;
 
         fd = open("/dev/null", O_RDONLY);
         FD_ZERO(&fds);
@@ -2630,7 +2710,9 @@ AC_RUN_IFELSE(
         rl_zero.rlim_cur = rl_zero.rlim_max = 0;
         setrlimit(RLIMIT_FSIZE, &rl_zero);
         setrlimit(RLIMIT_NOFILE, &rl_zero);
-        r = select(fd+1, &fds, NULL, NULL, NULL);
+        tv.tv_sec = 1;
+        tv.tv_usec = 0;
+        r = select(fd+1, &fds, NULL, NULL, &tv);
         exit (r == -1 ? 1 : 0);
         ]])],
         [AC_MSG_RESULT([yes])
@@ -2640,6 +2722,32 @@ AC_RUN_IFELSE(
         [AC_MSG_WARN([cross compiling: assuming yes])]
 )
 
+AC_MSG_CHECKING([if setrlimit(RLIMIT_NOFILE,{0,0}) works])
+AC_RUN_IFELSE(
+        [AC_LANG_PROGRAM([[
+#include <sys/types.h>
+#ifdef HAVE_SYS_TIME_H
+# include <sys/time.h>
+#endif
+#include <sys/resource.h>
+#include <errno.h>
+#include <stdlib.h>
+        ]],[[
+        struct rlimit rl_zero;
+        int fd, r;
+        fd_set fds;
+
+        rl_zero.rlim_cur = rl_zero.rlim_max = 0;
+        r = setrlimit(RLIMIT_NOFILE, &rl_zero);
+        exit (r == -1 ? 1 : 0);
+        ]])],
+        [AC_MSG_RESULT([yes])
+         rlimit_nofile_zero_works=yes],
+        [AC_MSG_RESULT([no])
+         rlimit_nofile_zero_works=no],
+        [AC_MSG_WARN([cross compiling: assuming yes])]
+)
+
 AC_MSG_CHECKING([if setrlimit RLIMIT_FSIZE works])
 AC_RUN_IFELSE(
         [AC_LANG_PROGRAM([[
@@ -2676,11 +2784,13 @@ elif test "x$sandbox_arg" = "xdarwin" || \
 elif test "x$sandbox_arg" = "xseccomp_filter" || \
      ( test -z "$sandbox_arg" && \
        test "x$have_seccomp_filter" = "x1" && \
+       test "x$ac_cv_header_elf_h" = "xyes" && \
        test "x$ac_cv_header_linux_audit_h" = "xyes" && \
-       test "x$have_seccomp_audit_arch" = "x1" && \
+       test "x$ac_cv_header_linux_filter_h" = "xyes" && \
+       test "x$seccomp_audit_arch" != "x" && \
        test "x$have_linux_no_new_privs" = "x1" && \
        test "x$ac_cv_func_prctl" = "xyes" ) ; then
-        test "x$have_seccomp_audit_arch" != "x1" && \
+        test "x$seccomp_audit_arch" = "x" && \
                 AC_MSG_ERROR([seccomp_filter sandbox not supported on $host])
         test "x$have_linux_no_new_privs" != "x1" && \
                 AC_MSG_ERROR([seccomp_filter sandbox requires PR_SET_NO_NEW_PRIVS])
@@ -2692,7 +2802,8 @@ elif test "x$sandbox_arg" = "xseccomp_filter" || \
         AC_DEFINE([SANDBOX_SECCOMP_FILTER], [1], [Sandbox using seccomp filter])
 elif test "x$sandbox_arg" = "xrlimit" || \
      ( test -z "$sandbox_arg" && test "x$ac_cv_func_setrlimit" = "xyes" && \
-       test "x$select_works_with_rlimit" == "xyes" ) ; then
+       test "x$select_works_with_rlimit" = "xyes" && \
+       test "x$rlimit_nofile_zero_works" = "xyes" ) ; then
         test "x$ac_cv_func_setrlimit" != "xyes" && \
                 AC_MSG_ERROR([rlimit sandbox requires setrlimit function])
         test "x$select_works_with_rlimit" != "xyes" && \
@@ -3584,6 +3695,9 @@ AC_ARG_WITH([kerberos5],
                              [$KRB5ROOT/bin/krb5-config],
                              [$KRB5ROOT/bin:$PATH])
                 if test -x $KRB5CONF ; then
+                        K5CFLAGS="`$KRB5CONF --cflags`"
+                        K5LIBS="`$KRB5CONF --libs`"
+                        CPPFLAGS="$CPPFLAGS $K5CFLAGS"
 
                         AC_MSG_CHECKING([for gssapi support])
                         if $KRB5CONF | grep gssapi >/dev/null ; then
@@ -3591,14 +3705,12 @@ AC_ARG_WITH([kerberos5],
                                 AC_DEFINE([GSSAPI], [1],
                                         [Define this if you want GSSAPI
                                         support in the version 2 protocol])
-                                k5confopts=gssapi
+                                GSSCFLAGS="`$KRB5CONF --cflags gssapi`"
+                                GSSLIBS="`$KRB5CONF --libs gssapi`"
+                                CPPFLAGS="$CPPFLAGS $GSSCFLAGS"
                         else
                                 AC_MSG_RESULT([no])
-                                k5confopts=""
                         fi
-                        K5CFLAGS="`$KRB5CONF --cflags $k5confopts`"
-                        K5LIBS="`$KRB5CONF --libs $k5confopts`"
-                        CPPFLAGS="$CPPFLAGS $K5CFLAGS"
                         AC_MSG_CHECKING([whether we are using Heimdal])
                         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <krb5.h>
                                 ]], [[ char *tmp = heimdal_version; ]])],
@@ -3630,14 +3742,16 @@ AC_ARG_WITH([kerberos5],
 
                         AC_CHECK_LIB([gssapi_krb5], [gss_init_sec_context],
                                 [ AC_DEFINE([GSSAPI])
-                                  K5LIBS="-lgssapi_krb5 $K5LIBS" ],
+                                  GSSLIBS="-lgssapi_krb5" ],
                                 [ AC_CHECK_LIB([gssapi], [gss_init_sec_context],
                                         [ AC_DEFINE([GSSAPI])
-                                          K5LIBS="-lgssapi $K5LIBS" ],
-                                        AC_MSG_WARN([Cannot find any suitable gss-api library - build may fail]),
-                                        $K5LIBS)
-                                ],
-                                $K5LIBS)
+                                          GSSLIBS="-lgssapi" ],
+                                        [ AC_CHECK_LIB([gss], [gss_init_sec_context],
+                                                [ AC_DEFINE([GSSAPI])
+                                                  GSSLIBS="-lgss" ],
+                                                AC_MSG_WARN([Cannot find any suitable gss-api library - build may fail]))
+                                        ])
+                                ])
 
                         AC_CHECK_HEADER([gssapi.h], ,
                                 [ unset ac_cv_header_gssapi_h
@@ -3665,12 +3779,27 @@ AC_ARG_WITH([kerberos5],
                 AC_CHECK_HEADERS([gssapi_krb5.h gssapi/gssapi_krb5.h])
                 AC_CHECK_HEADERS([gssapi_generic.h gssapi/gssapi_generic.h])
 
-                LIBS="$LIBS $K5LIBS"
                 AC_SEARCH_LIBS([k_hasafs], [kafs], [AC_DEFINE([USE_AFS], [1],
                         [Define this if you want to use libkafs' AFS support])])
+
+                AC_CHECK_DECLS([GSS_C_NT_HOSTBASED_SERVICE], [], [], [[
+#ifdef HAVE_GSSAPI_H
+# include <gssapi.h>
+#elif defined(HAVE_GSSAPI_GSSAPI_H)
+# include <gssapi/gssapi.h>
+#endif
+
+#ifdef HAVE_GSSAPI_GENERIC_H
+# include <gssapi_generic.h>
+#elif defined(HAVE_GSSAPI_GSSAPI_GENERIC_H)
+# include <gssapi/gssapi_generic.h>
+#endif
+                ]])
         fi
         ]
 )
+AC_SUBST([GSSLIBS])
+AC_SUBST([K5LIBS])
 
 # Check whether user wants ConsoleKit support
 CONSOLEKIT_MSG="no"
@@ -4361,7 +4490,6 @@ if test -n "$conf_wtmp_location"; then
                 [Define if you want to specify the path to your wtmp file])
 fi
 
-
 dnl wtmpx detection
 AC_MSG_CHECKING([if your system defines WTMPX_FILE])
 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
@@ -4393,6 +4521,43 @@ if test ! -z "$blibpath" ; then
         AC_MSG_WARN([Please check and edit blibpath in LDFLAGS in Makefile])
 fi
 
+AC_CHECK_MEMBER([struct lastlog.ll_line], [], [
+    if test x$SKIP_DISABLE_LASTLOG_DEFINE != "xyes" ; then
+        AC_DEFINE([DISABLE_LASTLOG])
+    fi
+        ], [
+#ifdef HAVE_SYS_TYPES_H
+#include <sys/types.h>
+#endif
+#ifdef HAVE_UTMP_H
+#include <utmp.h>
+#endif
+#ifdef HAVE_UTMPX_H
+#include <utmpx.h>
+#endif
+#ifdef HAVE_LASTLOG_H
+#include <lastlog.h>
+#endif
+        ])
+
+AC_CHECK_MEMBER([struct utmp.ut_line], [], [
+        AC_DEFINE([DISABLE_UTMP])
+        AC_DEFINE([DISABLE_WTMP])
+        ], [
+#ifdef HAVE_SYS_TYPES_H
+#include <sys/types.h>
+#endif
+#ifdef HAVE_UTMP_H
+#include <utmp.h>
+#endif
+#ifdef HAVE_UTMPX_H
+#include <utmpx.h>
+#endif
+#ifdef HAVE_LASTLOG_H
+#include <lastlog.h>
+#endif
+        ])
+
 dnl Adding -Werror to CFLAGS early prevents configure tests from running.
 dnl Add now.
 CFLAGS="$CFLAGS $werror_flags"
diff --git a/contrib/caldera/openssh.spec b/contrib/caldera/openssh.spec
index 9fd07953a..196bd7904 100644
--- a/contrib/caldera/openssh.spec
+++ b/contrib/caldera/openssh.spec
@@ -16,7 +16,7 @@
 
 #old cvs stuff.  please update before use.  may be deprecated.
 %define use_stable      1
-%define version         6.1p1
+%define version         6.2p1
 %if %{use_stable}
   %define cvs           %{nil}
   %define release       1
@@ -363,4 +363,4 @@ fi
 * Mon Jan 01 1998 ...
 Template Version: 1.31
 
-$Id: openssh.spec,v 1.78 2012/08/22 11:57:15 djm Exp $
+$Id: openssh.spec,v 1.79 2013/02/26 23:48:20 djm Exp $
diff --git a/contrib/redhat/openssh.spec b/contrib/redhat/openssh.spec
index f74ad4486..3898c6c99 100644
--- a/contrib/redhat/openssh.spec
+++ b/contrib/redhat/openssh.spec
@@ -1,4 +1,4 @@
-%define ver 6.1p1
+%define ver 6.2p1
 %define rel 1
 
 # OpenSSH privilege separation requires a user & group ID
diff --git a/contrib/redhat/sshd.init b/contrib/redhat/sshd.init
index e9a751796..40c8dfd9f 100755
--- a/contrib/redhat/sshd.init
+++ b/contrib/redhat/sshd.init
@@ -29,7 +29,7 @@ do_restart_sanity_check()
 {
         $SSHD -t
         RETVAL=$?
-        if [ ! "$RETVAL" = 0 ]; then
+        if [ $RETVAL -ne 0 ]; then
                 failure $"Configuration file or keys are invalid"
                 echo
         fi
@@ -49,7 +49,7 @@ start()
         echo -n $"Starting $prog:"
         $SSHD $OPTIONS && success || failure
         RETVAL=$?
-        [ "$RETVAL" = 0 ] && touch /var/lock/subsys/sshd
+        [ $RETVAL -eq 0 ] && touch /var/lock/subsys/sshd
         echo
 }
 
@@ -58,7 +58,7 @@ stop()
         echo -n $"Stopping $prog:"
         killproc $SSHD -TERM
         RETVAL=$?
-        [ "$RETVAL" = 0 ] && rm -f /var/lock/subsys/sshd
+        [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/sshd
         echo
 }
 
@@ -87,7 +87,7 @@ case "$1" in
         condrestart)
                 if [ -f /var/lock/subsys/sshd ] ; then
                         do_restart_sanity_check
-                        if [ "$RETVAL" = 0 ] ; then
+                        if [ $RETVAL -eq 0 ] ; then
                                 stop
                                 # avoid race
                                 sleep 3
diff --git a/contrib/ssh-copy-id b/contrib/ssh-copy-id
index 86d037abd..af18a1929 100644
--- a/contrib/ssh-copy-id
+++ b/contrib/ssh-copy-id
@@ -1,54 +1,293 @@
 #!/bin/sh
 
-# Shell script to install your public key on a remote machine
-# Takes the remote machine name as an argument.
-# Obviously, the remote machine must accept password authentication,
-# or one of the other keys in your ssh-agent, for this to work.
-
-ID_FILE="${HOME}/.ssh/id_rsa.pub"
-
-if [ "-i" = "$1" ]; then
-  shift
-  # check if we have 2 parameters left, if so the first is the new ID file
-  if [ -n "$2" ]; then
-    if expr "$1" : ".*\.pub" > /dev/null ; then
-      ID_FILE="$1"
-    else
-      ID_FILE="$1.pub"
-    fi
-    shift         # and this should leave $1 as the target name
+# Copyright (c) 1999-2013 Philip Hands <phil@hands.com>
+#               2013 Martin Kletzander <mkletzan@redhat.com>
+#               2010 Adeodato =?iso-8859-1?Q?Sim=F3?= <asp16@alu.ua.es>
+#               2010 Eric Moret <eric.moret@gmail.com>
+#               2009 Xr <xr@i-jeuxvideo.com>
+#               2007 Justin Pryzby <justinpryzby@users.sourceforge.net>
+#               2004 Reini Urban <rurban@x-ray.at>
+#               2003 Colin Watson <cjwatson@debian.org>
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+# NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+# Shell script to install your public key(s) on a remote machine
+# See the ssh-copy-id(1) man page for details
+
+# check that we have something mildly sane as our shell, or try to find something better
+if false ^ printf "%s: WARNING: ancient shell, hunting for a more modern one... " "$0"
+then
+  SANE_SH=${SANE_SH:-/usr/bin/ksh}
+  if printf 'true ^ false\n' | "$SANE_SH"
+  then
+    printf "'%s' seems viable.\n" "$SANE_SH"
+    exec "$SANE_SH" "$0" "$@"
+  else
+    cat <<-EOF
+        oh dear.
+
+          If you have a more recent shell available, that supports \$(...) etc.
+          please try setting the environment variable SANE_SH to the path of that
+          shell, and then retry running this script. If that works, please report
+          a bug describing your setup, and the shell you used to make it work.
+
+        EOF
+    printf "%s: ERROR: Less dimwitted shell required.\n" "$0"
+    exit 1
   fi
-else
-  if [ x$SSH_AUTH_SOCK != x ] && ssh-add -L >/dev/null 2>&1; then
-    GET_ID="$GET_ID ssh-add -L"
+fi
+
+DEFAULT_PUB_ID_FILE=$(ls -t ${HOME}/.ssh/id*.pub 2>/dev/null | grep -v -- '-cert.pub$' | head -n 1)
+
+usage () {
+  printf 'Usage: %s [-h|-?|-n] [-i [identity_file]] [-p port] [[-o <ssh -o options>] ...] [user@]hostname\n' "$0" >&2
+  exit 1
+}
+
+# escape any single quotes in an argument
+quote() {
+  printf "%s\n" "$1" | sed -e "s/'/'\\\\''/g"
+}
+
+use_id_file() {
+  local L_ID_FILE="$1"
+
+  if expr "$L_ID_FILE" : ".*\.pub$" >/dev/null ; then
+    PUB_ID_FILE="$L_ID_FILE"
+  else
+    PUB_ID_FILE="$L_ID_FILE.pub"
   fi
+
+  PRIV_ID_FILE=$(dirname "$PUB_ID_FILE")/$(basename "$PUB_ID_FILE" .pub)
+
+  # check that the files are readable
+  for f in $PUB_ID_FILE $PRIV_ID_FILE ; do
+    ErrMSG=$( { : < $f ; } 2>&1 ) || {
+      printf "\n%s: ERROR: failed to open ID file '%s': %s\n\n" "$0" "$f" "$(printf "%s\n" "$ErrMSG" | sed -e 's/.*: *//')"
+      exit 1
+    }
+  done
+  GET_ID="cat \"$PUB_ID_FILE\""
+}
+
+if [ -n "$SSH_AUTH_SOCK" ] && ssh-add -L >/dev/null 2>&1 ; then
+  GET_ID="ssh-add -L"
 fi
 
-if [ -z "`eval $GET_ID`" ] && [ -r "${ID_FILE}" ] ; then
-  GET_ID="cat \"${ID_FILE}\""
+while test "$#" -gt 0
+do
+  [ "${SEEN_OPT_I}" ] && expr "$1" : "[-]i" >/dev/null && {
+        printf "\n%s: ERROR: -i option must not be specified more than once\n\n" "$0"
+        usage
+  }
+
+  OPT= OPTARG=
+  # implement something like getopt to avoid Solaris pain
+  case "$1" in
+    -i?*|-o?*|-p?*)
+      OPT="$(printf -- "$1"|cut -c1-2)"
+      OPTARG="$(printf -- "$1"|cut -c3-)"
+      shift
+      ;;
+    -o|-p)
+      OPT="$1"
+      OPTARG="$2"
+      shift 2
+      ;;
+    -i)
+      OPT="$1"
+      test "$#" -le 2 || expr "$2" : "[-]" >/dev/null || {
+        OPTARG="$2"
+        shift
+      }
+      shift
+      ;;
+    -n|-h|-\?)
+      OPT="$1"
+      OPTARG=
+      shift
+      ;;
+    --)
+      shift
+      while test "$#" -gt 0
+      do
+        SAVEARGS="${SAVEARGS:+$SAVEARGS }'$(quote "$1")'"
+        shift
+      done
+      break
+      ;;
+    -*)
+      printf "\n%s: ERROR: invalid option (%s)\n\n" "$0" "$1"
+      usage
+      ;;
+    *)
+      SAVEARGS="${SAVEARGS:+$SAVEARGS }'$(quote "$1")'"
+      shift
+      continue
+      ;;
+  esac
+
+  case "$OPT" in
+    -i)
+      SEEN_OPT_I="yes"
+      use_id_file "${OPTARG:-$DEFAULT_PUB_ID_FILE}"
+      ;;
+    -o|-p)
+      SSH_OPTS="${SSH_OPTS:+$SSH_OPTS }$OPT '$(quote "$OPTARG")'"
+      ;;
+    -n)
+      DRY_RUN=1
+      ;;
+    -h|-\?)
+      usage
+      ;;
+  esac
+done 
+
+eval set -- "$SAVEARGS"
+
+if [ $# != 1 ] ; then
+  printf '%s: ERROR: Too many arguments.  Expecting a target hostname, got: %s\n\n' "$0" "$SAVEARGS" >&2
+  usage
 fi
 
-if [ -z "`eval $GET_ID`" ]; then
-  echo "$0: ERROR: No identities found" >&2
-  exit 1
+# drop trailing colon
+USER_HOST=$(printf "%s\n" "$1" | sed 's/:$//')
+# tack the hostname onto SSH_OPTS
+SSH_OPTS="${SSH_OPTS:+$SSH_OPTS }'$(quote "$USER_HOST")'"
+# and populate "$@" for later use (only way to get proper quoting of options)
+eval set -- "$SSH_OPTS"
+
+if [ -z "$(eval $GET_ID)" ] && [ -r "${PUB_ID_FILE:=$DEFAULT_PUB_ID_FILE}" ] ; then
+  use_id_file "$PUB_ID_FILE"
 fi
 
-if [ "$#" -lt 1 ] || [ "$1" = "-h" ] || [ "$1" = "--help" ]; then
-  echo "Usage: $0 [-i [identity_file]] [user@]machine" >&2
+if [ -z "$(eval $GET_ID)" ] ; then
+  printf '%s: ERROR: No identities found\n' "$0" >&2
   exit 1
 fi
 
-# strip any trailing colon
-host=`echo $1 | sed 's/:$//'`
+# populate_new_ids() uses several global variables ($USER_HOST, $SSH_OPTS ...)
+# and has the side effect of setting $NEW_IDS
+populate_new_ids() {
+  local L_SUCCESS="$1"
 
-{ eval "$GET_ID" ; } | ssh $host "umask 077; test -d ~/.ssh || mkdir ~/.ssh ; cat >> ~/.ssh/authorized_keys && (test -x /sbin/restorecon && /sbin/restorecon ~/.ssh ~/.ssh/authorized_keys >/dev/null 2>&1 || true)" || exit 1
+  # repopulate "$@" inside this function 
+  eval set -- "$SSH_OPTS"
 
-cat <<EOF
-Now try logging into the machine, with "ssh '$host'", and check in:
+  umask 0177
+  local L_TMP_ID_FILE=$(mktemp ~/.ssh/ssh-copy-id_id.XXXXXXXXXX)
+  trap "rm -f $L_TMP_ID_FILE*" EXIT TERM INT QUIT
+  printf '%s: INFO: attempting to log in with the new key(s), to filter out any that are already installed\n' "$0" >&2
+  NEW_IDS=$(
+    eval $GET_ID | {
+      while read ID ; do
+        printf '%s\n' "$ID" > $L_TMP_ID_FILE
 
-  ~/.ssh/authorized_keys
+        # the next line assumes $PRIV_ID_FILE only set if using a single id file - this
+        # assumption will break if we implement the possibility of multiple -i options.
+        # The point being that if file based, ssh needs the private key, which it cannot
+        # find if only given the contents of the .pub file in an unrelated tmpfile
+        ssh -i "${PRIV_ID_FILE:-$L_TMP_ID_FILE}" \
+            -o PreferredAuthentications=publickey \
+            -o IdentitiesOnly=yes "$@" exit 2>$L_TMP_ID_FILE.stderr </dev/null
+        if [ "$?" = "$L_SUCCESS" ] ; then
+          : > $L_TMP_ID_FILE
+        else
+          grep 'Permission denied' $L_TMP_ID_FILE.stderr >/dev/null || {
+            sed -e 's/^/ERROR: /' <$L_TMP_ID_FILE.stderr >$L_TMP_ID_FILE
+            cat >/dev/null #consume the other keys, causing loop to end
+          }
+        fi
+
+        cat $L_TMP_ID_FILE
+      done
+    }
+  )
+  rm -f $L_TMP_ID_FILE* && trap - EXIT TERM INT QUIT
+
+  if expr "$NEW_IDS" : "^ERROR: " >/dev/null ; then
+    printf '\n%s: %s\n\n' "$0" "$NEW_IDS" >&2
+    exit 1
+  fi
+  if [ -z "$NEW_IDS" ] ; then
+    printf '\n%s: WARNING: All keys were skipped because they already exist on the remote system.\n\n' "$0" >&2
+    exit 0
+  fi
+  printf '%s: INFO: %d key(s) remain to be installed -- if you are prompted now it is to install the new keys\n' "$0" "$(printf '%s\n' "$NEW_IDS" | wc -l)" >&2
+}
 
-to make sure we haven't added extra keys that you weren't expecting.
+REMOTE_VERSION=$(ssh -v -o PreferredAuthentications=',' "$@" 2>&1 |
+                 sed -ne 's/.*remote software version //p')
 
-EOF
+case "$REMOTE_VERSION" in
+  NetScreen*)
+    populate_new_ids 1
+    for KEY in $(printf "%s" "$NEW_IDS" | cut -d' ' -f2) ; do
+      KEY_NO=$(($KEY_NO + 1))
+      printf "%s\n" "$KEY" | grep ssh-dss >/dev/null || {
+         printf '%s: WARNING: Non-dsa key (#%d) skipped (NetScreen only supports DSA keys)\n' "$0" "$KEY_NO" >&2
+         continue
+      }
+      [ "$DRY_RUN" ] || printf 'set ssh pka-dsa key %s\nsave\nexit\n' "$KEY" | ssh -T "$@" >/dev/null 2>&1
+      if [ $? = 255 ] ; then
+        printf '%s: ERROR: installation of key #%d failed (please report a bug describing what caused this, so that we can make this message useful)\n' "$0" "$KEY_NO" >&2
+      else
+        ADDED=$(($ADDED + 1))
+      fi
+    done
+    if [ -z "$ADDED" ] ; then
+      exit 1
+    fi
+    ;;
+  *)
+    # Assuming that the remote host treats ~/.ssh/authorized_keys as one might expect
+    populate_new_ids 0
+    [ "$DRY_RUN" ] || printf '%s\n' "$NEW_IDS" | ssh "$@" "
+                umask 077 ;
+                mkdir -p .ssh && cat >> .ssh/authorized_keys || exit 1 ;
+                if type restorecon >/dev/null 2>&1 ; then restorecon -F .ssh .ssh/authorized_keys ; fi" \
+      || exit 1
+    ADDED=$(printf '%s\n' "$NEW_IDS" | wc -l)
+    ;;
+esac
+
+if [ "$DRY_RUN" ] ; then
+  cat <<-EOF
+        =-=-=-=-=-=-=-=
+        Would have added the following key(s):
+
+        $NEW_IDS
+        =-=-=-=-=-=-=-=
+        EOF
+else
+  cat <<-EOF
+
+        Number of key(s) added: $ADDED
+
+        Now try logging into the machine, with:   "ssh $SSH_OPTS"
+        and check to make sure that only the key(s) you wanted were added.
+
+        EOF
+fi
 
+# =-=-=-=
diff --git a/contrib/ssh-copy-id.1 b/contrib/ssh-copy-id.1
index cb15ab24d..67a59e492 100644
--- a/contrib/ssh-copy-id.1
+++ b/contrib/ssh-copy-id.1
@@ -1,75 +1,186 @@
 .ig \"  -*- nroff -*-
-Copyright (c) 1999 Philip Hands Computing <http://www.hands.com/>
+Copyright (c) 1999-2013 hands.com Ltd. <http://hands.com/>
 
-Permission is granted to make and distribute verbatim copies of
-this manual provided the copyright notice and this permission notice
-are preserved on all copies.
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
 
-Permission is granted to copy and distribute modified versions of this
-manual under the conditions for verbatim copying, provided that the
-entire resulting derived work is distributed under the terms of a
-permission notice identical to this one.
-
-Permission is granted to copy and distribute translations of this
-manual into another language, under the above conditions for modified
-versions, except that this permission notice may be included in
-translations approved by the Free Software Foundation instead of in
-the original English.
+THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 ..
-.TH SSH-COPY-ID 1 "14 November 1999" "OpenSSH"
-.SH NAME
-ssh-copy-id \- install your public key in a remote machine's authorized_keys
-.SH SYNOPSIS
-.B ssh-copy-id [-i [identity_file]]
-.I "[user@]machine"
+.Dd $Mdocdate: June 17 2010 $
+.Dt SSH-COPY-ID 1
+.Os
+.Sh NAME
+.Nm ssh-copy-id
+.Nd use locally available keys to authorise logins on a remote machine
+.Sh SYNOPSIS
+.Nm
+.Op Fl n
+.Op Fl i Op Ar identity_file
+.Op Fl p Ar port
+.Op Fl o Ar ssh_option
+.Op Ar user Ns @ Ns
+.Ar hostname
+.Nm
+.Fl h | Fl ?
 .br
-.SH DESCRIPTION
-.BR ssh-copy-id
-is a script that uses ssh to log into a remote machine and
-append the indicated identity file to that machine's
-.B ~/.ssh/authorized_keys
-file.
-.PP
-If the
-.B -i
-option is given then the identity file (defaults to
-.BR ~/.ssh/id_rsa.pub )
-is used, regardless of whether there are any keys in your
-.BR ssh-agent .
-Otherwise, if this:
-.PP
-.B "      ssh-add -L"
-.PP
-provides any output, it uses that in preference to the identity file.
-.PP
-If the
-.B -i
-option is used, or the
-.B ssh-add
-produced no output, then it uses the contents of the identity
-file.  Once it has one or more fingerprints (by whatever means) it
-uses ssh to append them to
-.B ~/.ssh/authorized_keys
-on the remote machine (creating the file, and directory, if necessary.)
-
-.SH NOTES
-This program does not modify the permissions of any
-pre-existing files or directories. Therefore, if the remote
-.B sshd
-has
-.B StrictModes
-set in its
-configuration, then the user's home,
-.B ~/.ssh
-folder, and
-.B ~/.ssh/authorized_keys
-file may need to have group writability disabled manually, e.g. via
-
-.B "      chmod go-w ~ ~/.ssh ~/.ssh/authorized_keys"
-
-on the remote machine.
-
-.SH "SEE ALSO"
-.BR ssh (1),
-.BR ssh-agent (1),
-.BR sshd (8)
+.Sh DESCRIPTION
+.Nm
+is a script that uses
+.Xr ssh 1
+to log into a remote machine (presumably using a login password,
+so password authentication should be enabled, unless you've done some
+clever use of multiple identities).  It assembles a list of one or more
+fingerprints (as described below) and tries to log in with each key, to
+see if any of them are already installed (of course, if you are not using
+.Xr ssh-agent 1
+this may result in you being repeatedly prompted for pass-phrases).
+It then assembles a list of those that failed to log in, and using ssh,
+enables logins with those keys on the remote server.  By default it adds
+the keys by appending them to the remote user's
+.Pa ~/.ssh/authorized_keys
+(creating the file, and directory, if necessary).  It is also capable
+of detecting if the remote system is a NetScreen, and using its
+.Ql set ssh pka-dsa key ...
+command instead.
+.Pp
+The options are as follows:
+.Bl -tag -width Ds
+.It Fl i Ar identity_file
+Use only the key(s) contained in
+.Ar identity_file
+(rather than looking for identities via
+.Xr ssh-add 1
+or in the
+.Ic default_ID_file ) .
+If the filename does not end in
+.Pa .pub
+this is added.  If the filename is omitted, the 
+.Ic default_ID_file
+is used.
+.Pp
+Note that this can be used to ensure that the keys copied have the
+comment one prefers and/or extra options applied, by ensuring that the
+key file has these set as preferred before the copy is attempted.
+.It Fl n
+do a dry-run.  Instead of installing keys on the remote system simply
+prints the key(s) that would have been installed.
+.It Fl h , Fl ?
+Print Usage summary
+.It Fl p Ar port , Fl o Ar ssh_option
+These two options are simply passed through untouched, along with their
+argument, to allow one to set the port or other
+.Xr ssh 1
+options, respectively.
+.Pp
+Rather than specifying these as command line options, it is often better to use (per-host) settings in
+.Xr ssh 1 Ns 's
+configuration file:
+.Xr ssh_config 5 .
+.El
+.Pp
+Default behaviour without
+.Fl i ,
+is to check if
+.Ql ssh-add -L
+provides any output, and if so those keys are used.  Note that this results in
+the comment on the key being the filename that was given to
+.Xr ssh-add 1
+when the key was loaded into your
+.Xr ssh-agent 1
+rather than the comment contained in that file, which is a bit of a shame.
+Otherwise, if
+.Xr ssh-add 1
+provides no keys contents of the 
+.Ic default_ID_file
+will be used.
+.Pp
+The
+.Ic default_ID_file
+is the most recent file that matches:
+.Pa ~/.ssh/id*.pub ,
+(excluding those that match
+.Pa ~/.ssh/*-cert.pub )
+so if you create a key that is not the one you want
+.Nm
+to use, just use
+.Xr touch 1
+on your preferred key's 
+.Pa .pub
+file to reinstate it as the most recent.
+.Pp
+.Sh EXAMPLES
+If you have already installed keys from one system on a lot of remote
+hosts, and you then create a new key, on a new client machine, say,
+it can be difficult to keep track of which systems on which you've
+installed the new key.  One way of dealing with this is to load both
+the new key and old key(s) into your
+.Xr ssh-agent 1 .
+Load the new key first, without the
+.Fl c
+option, then load one or more old keys into the agent, possibly by
+ssh-ing to the client machine that has that old key, using the
+.Fl A
+option to allow agent forwarding:
+.Pp
+.D1 user@newclient$ ssh-add
+.D1 user@newclient$ ssh -A old.client
+.D1 user@oldl$ ssh-add -c
+.D1 No   ... prompt for pass-phrase ...
+.D1 user@old$ logoff
+.D1 user@newclient$ ssh someserver
+.Pp
+now, if the new key is installed on the server, you'll be allowed in
+unprompted, whereas if you only have the old key(s) enabled, you'll be
+asked for confirmation, which is your cue to log back out and run
+.Pp
+.D1 user@newclient$ ssh-copy-id -i someserver
+.Pp
+The reason you might want to specify the -i option in this case is to
+ensure that the comment on the installed key is the one from the
+.Pa .pub
+file, rather than just the filename that was loaded into you agent.
+It also ensures that only the id you intended is installed, rather than
+all the keys that you have in your
+.Xr ssh-agent 1 .
+Of course, you can specify another id, or use the contents of the
+.Xr ssh-agent 1
+as you prefer.
+.Pp
+Having mentioned
+.Xr ssh-add 1 Ns 's
+.Fl c
+option, you might consider using this whenever using agent forwarding
+to avoid your key being hijacked, but it is much better to instead use
+.Xr ssh 1 Ns 's
+.Ar ProxyCommand
+and 
+.Fl W
+option,
+to bounce through remote servers while always doing direct end-to-end
+authentication. This way the middle hop(s) don't get access to your
+.Xr ssh-agent 1 .
+A web search for
+.Ql ssh proxycommand nc
+should prove enlightening (N.B. the modern approach is to use the
+.Fl W
+option, rather than
+.Xr nc 1 ) .
+.Sh "SEE ALSO"
+.Xr ssh 1 ,
+.Xr ssh-agent 1 ,
+.Xr sshd 8
diff --git a/contrib/suse/openssh.spec b/contrib/suse/openssh.spec
index 3b8abecc8..960feae07 100644
--- a/contrib/suse/openssh.spec
+++ b/contrib/suse/openssh.spec
@@ -13,7 +13,7 @@
 
 Summary:        OpenSSH, a free Secure Shell (SSH) protocol implementation
 Name:           openssh
-Version:        6.1p1
+Version:        6.2p1
 URL:            http://www.openssh.com/
 Release:        1
 Source0:        openssh-%{version}.tar.gz
diff --git a/contrib/suse/rc.sshd b/contrib/suse/rc.sshd
index 4a3bc41db..28f28e41d 100644
--- a/contrib/suse/rc.sshd
+++ b/contrib/suse/rc.sshd
@@ -49,7 +49,7 @@ case "$1" in
         ## Start daemon with startproc(8). If this fails
         ## the echo return value is set appropriate.
 
-        startproc -f -p $SSHD_PIDFILE /usr/sbin/sshd $SSHD_OPTS -o "PidFile=$SSHD_PIDFILE" 
+        startproc -f -p $SSHD_PIDFILE $SSHD_BIN $SSHD_OPTS -o "PidFile=$SSHD_PIDFILE" 
 
         # Remember status and be verbose
         rc_status -v
@@ -59,7 +59,7 @@ case "$1" in
         ## Stop daemon with killproc(8) and if this fails
         ## set echo the echo return value.
 
-        killproc -p $SSHD_PIDFILE -TERM /usr/sbin/sshd
+        killproc -p $SSHD_PIDFILE -TERM $SSHD_BIN
 
         # Remember status and be verbose
         rc_status -v
@@ -87,7 +87,7 @@ case "$1" in
 
         echo -n "Reload service sshd"
 
-        killproc -p $SSHD_PIDFILE -HUP /usr/sbin/sshd
+        killproc -p $SSHD_PIDFILE -HUP $SSHD_BIN
 
         rc_status -v
 
@@ -103,7 +103,7 @@ case "$1" in
         # 2 - service dead, but /var/lock/ lock file exists
         # 3 - service not running
 
-        checkproc -p $SSHD_PIDFILE /usr/sbin/sshd
+        checkproc -p $SSHD_PIDFILE $SSHD_BIN
 
         rc_status -v
         ;;
diff --git a/debian/changelog b/debian/changelog
index 092837792..174c0c585 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,5 +1,11 @@
-openssh (1:6.1p1-5) UNRELEASED; urgency=low
-
+openssh (1:6.2p1-1) UNRELEASED; urgency=low
+
+  * New upstream release (http://www.openssh.com/txt/release-6.2).
+    - Add support for multiple required authentication in SSH protocol 2 via
+      an AuthenticationMethods option (closes: #195716).
+    - Fix Sophie Germain formula in moduli(5) (closes: #698612).
+    - Update ssh-copy-id to Phil Hands' greatly revised version (closes:
+      #99785, #322228, #620428; LP: #518883, #835901, #1074798).
   * Use dh-autoreconf.
 
  -- Colin Watson <cjwatson@debian.org>  Mon, 06 May 2013 10:47:33 +0100
diff --git a/debian/patches/auth-log-verbosity.patch b/debian/patches/auth-log-verbosity.patch
index bc2602306..206967bc9 100644
--- a/debian/patches/auth-log-verbosity.patch
+++ b/debian/patches/auth-log-verbosity.patch
@@ -2,7 +2,7 @@ Description: Quieten logs when multiple from= restrictions are used
 Author: Colin Watson <cjwatson@debian.org>
 Bug-Debian: http://bugs.debian.org/630606
 Forwarded: no
-Last-Update: 2011-07-28
+Last-Update: 2013-05-07
 
 Index: b/auth-options.c
 ===================================================================
@@ -96,7 +96,7 @@ Index: b/auth2-pubkey.c
 ===================================================================
 --- a/auth2-pubkey.c
 +++ b/auth2-pubkey.c
-@@ -211,6 +211,7 @@
+@@ -217,6 +217,7 @@
                 restore_uid();
                 return 0;
         }
@@ -104,7 +104,7 @@ Index: b/auth2-pubkey.c
         while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) {
                 /* Skip leading whitespace. */
                 for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
-@@ -281,6 +282,8 @@
+@@ -278,6 +279,8 @@
         found_key = 0;
         found = key_new(key_is_cert(key) ? KEY_UNSPEC : key->type);
  
@@ -113,7 +113,7 @@ Index: b/auth2-pubkey.c
         while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) {
                 char *cp, *key_options = NULL;
  
-@@ -417,6 +420,7 @@
+@@ -412,6 +415,7 @@
         if (key_cert_check_authority(key, 0, 1,
             principals_file == NULL ? pw->pw_name : NULL, &reason) != 0)
                 goto fail_reason;
diff --git a/debian/patches/authorized-keys-man-symlink.patch b/debian/patches/authorized-keys-man-symlink.patch
index 6ffc716ee..c6a4b64c6 100644
--- a/debian/patches/authorized-keys-man-symlink.patch
+++ b/debian/patches/authorized-keys-man-symlink.patch
@@ -2,13 +2,13 @@ Description: Install authorized_keys(5) as a symlink to sshd(8)
 Author: Tomas Pospisek <tpo_deb@sourcepole.ch>
 Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1720
 Bug-Debian: http://bugs.debian.org/441817
-Last-Update: 2010-03-01
+Last-Update: 2013-05-07
 
 Index: b/Makefile.in
 ===================================================================
 --- a/Makefile.in
 +++ b/Makefile.in
-@@ -277,6 +277,7 @@
+@@ -286,6 +286,7 @@
         $(INSTALL) -m 644 sshd_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/sshd_config.5
         $(INSTALL) -m 644 ssh_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/ssh_config.5
         $(INSTALL) -m 644 sshd.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sshd.8
diff --git a/debian/patches/consolekit.patch b/debian/patches/consolekit.patch
index a952e4405..d67123a1e 100644
--- a/debian/patches/consolekit.patch
+++ b/debian/patches/consolekit.patch
@@ -1,13 +1,13 @@
 Description: Add support for registering ConsoleKit sessions on login
 Author: Colin Watson <cjwatson@ubuntu.com>
 Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1450
-Last-Updated: 2012-10-31
+Last-Updated: 2013-05-07
 
 Index: b/Makefile.in
 ===================================================================
 --- a/Makefile.in
 +++ b/Makefile.in
-@@ -94,7 +94,8 @@
+@@ -96,7 +96,8 @@
         sftp-server.o sftp-common.o \
         roaming_common.o roaming_serv.o \
         sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o \
@@ -21,9 +21,9 @@ Index: b/configure.ac
 ===================================================================
 --- a/configure.ac
 +++ b/configure.ac
-@@ -3672,6 +3672,30 @@
-        ]
- )
+@@ -3801,6 +3801,30 @@
+ AC_SUBST([GSSLIBS])
+ AC_SUBST([K5LIBS])
  
 +# Check whether user wants ConsoleKit support
 +CONSOLEKIT_MSG="no"
@@ -52,7 +52,7 @@ Index: b/configure.ac
  # Looking for programs, paths and files
  
  PRIVSEP_PATH=/var/empty
-@@ -4435,6 +4459,7 @@
+@@ -4600,6 +4624,7 @@
  echo "                   libedit support: $LIBEDIT_MSG"
  echo "  Solaris process contract support: $SPC_MSG"
  echo "           Solaris project support: $SP_MSG"
@@ -64,7 +64,7 @@ Index: b/configure
 ===================================================================
 --- a/configure
 +++ b/configure
-@@ -735,6 +735,7 @@
+@@ -737,6 +737,7 @@
  with_sandbox
  with_selinux
  with_kerberos5
@@ -72,7 +72,7 @@ Index: b/configure
  with_privsep_path
  with_xauth
  enable_strip
-@@ -1425,6 +1426,7 @@
+@@ -1427,6 +1428,7 @@
    --with-sandbox=style    Specify privilege separation sandbox (no, darwin, rlimit, systrace, seccomp_filter)
    --with-selinux          Enable SELinux support
    --with-kerberos5=PATH   Enable Kerberos 5 support
@@ -80,8 +80,8 @@ Index: b/configure
    --with-privsep-path=xxx Path for privilege separation chroot (default=/var/empty)
    --with-xauth=PATH       Specify path to xauth program
    --with-maildir=/path/to/mail    Specify your system mail directory
-@@ -15683,6 +15685,135 @@
- fi
+@@ -16002,6 +16004,135 @@
+ 
  
  
 +# Check whether user wants ConsoleKit support
@@ -216,7 +216,7 @@ Index: b/configure
  # Looking for programs, paths and files
  
  PRIVSEP_PATH=/var/empty
-@@ -18155,6 +18286,7 @@
+@@ -18527,6 +18658,7 @@
  echo "                   libedit support: $LIBEDIT_MSG"
  echo "  Solaris process contract support: $SPC_MSG"
  echo "           Solaris project support: $SP_MSG"
@@ -522,7 +522,7 @@ Index: b/monitor.c
  static Authctxt *authctxt;
  static BIGNUM *ssh1_challenge = NULL;  /* used for ssh1 rsa auth */
  
-@@ -283,6 +290,9 @@
+@@ -284,6 +291,9 @@
      {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
      {MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT, mm_answer_audit_command},
  #endif
@@ -532,7 +532,7 @@ Index: b/monitor.c
      {0, 0, NULL}
  };
  
-@@ -325,6 +335,9 @@
+@@ -326,6 +336,9 @@
      {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
      {MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT|MON_ONCE, mm_answer_audit_command},
  #endif
@@ -542,7 +542,7 @@ Index: b/monitor.c
      {0, 0, NULL}
  };
  
-@@ -495,6 +508,9 @@
+@@ -514,6 +527,9 @@
                 monitor_permit(mon_dispatch, MONITOR_REQ_PTY, 1);
                 monitor_permit(mon_dispatch, MONITOR_REQ_PTYCLEANUP, 1);
         }
@@ -552,7 +552,7 @@ Index: b/monitor.c
  
         for (;;)
                 monitor_read(pmonitor, mon_dispatch, NULL);
-@@ -2196,6 +2212,34 @@
+@@ -2232,6 +2248,34 @@
         buffer_put_int(m, major);
         buffer_put_string(m, hash.value, hash.length);
  
@@ -591,19 +591,20 @@ Index: b/monitor.h
 ===================================================================
 --- a/monitor.h
 +++ b/monitor.h
-@@ -62,6 +62,7 @@
-        MONITOR_REQ_PAM_RESPOND, MONITOR_ANS_PAM_RESPOND,
-        MONITOR_REQ_PAM_FREE_CTX, MONITOR_ANS_PAM_FREE_CTX,
-        MONITOR_REQ_AUDIT_EVENT, MONITOR_REQ_AUDIT_COMMAND,
-+       MONITOR_REQ_CONSOLEKIT_REGISTER, MONITOR_ANS_CONSOLEKIT_REGISTER,
-        MONITOR_REQ_TERM,
-        MONITOR_REQ_JPAKE_STEP1, MONITOR_ANS_JPAKE_STEP1,
-        MONITOR_REQ_JPAKE_GET_PWDATA, MONITOR_ANS_JPAKE_GET_PWDATA,
+@@ -75,6 +75,8 @@
+ 
+        MONITOR_REQ_AUTHROLE = 300,
+ 
++       MONITOR_REQ_CONSOLEKIT_REGISTER = 400, MONITOR_ANS_CONSOLEKIT_REGISTER = 401,
++
+ };
+ 
+ struct mm_master;
 Index: b/monitor_wrap.c
 ===================================================================
 --- a/monitor_wrap.c
 +++ b/monitor_wrap.c
-@@ -1310,6 +1310,37 @@
+@@ -1311,6 +1311,37 @@
  mm_ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_desc *data, gss_buffer_desc *hash)
  {
         Buffer m;
@@ -666,7 +667,7 @@ Index: b/session.c
  
  #if defined(KRB5) && defined(USE_AFS)
  #include <kafs.h>
-@@ -1129,6 +1130,9 @@
+@@ -1132,6 +1133,9 @@
  #if !defined (HAVE_LOGIN_CAP) && !defined (HAVE_CYGWIN)
         char *path = NULL;
  #endif
@@ -676,7 +677,7 @@ Index: b/session.c
  
         /* Initialize the environment. */
         envsize = 100;
-@@ -1273,6 +1277,11 @@
+@@ -1276,6 +1280,11 @@
                 child_set_env(&env, &envsize, "KRB5CCNAME",
                     s->authctxt->krb5_ccname);
  #endif
@@ -688,7 +689,7 @@ Index: b/session.c
  #ifdef USE_PAM
         /*
          * Pull in any environment variables that may have
-@@ -2300,6 +2309,10 @@
+@@ -2308,6 +2317,10 @@
  
         debug("session_pty_cleanup: session %d release %s", s->self, s->tty);
  
diff --git a/debian/patches/copy-id-restorecon.patch b/debian/patches/copy-id-restorecon.patch
deleted file mode 100644
index d26680c4a..000000000
--- a/debian/patches/copy-id-restorecon.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-Description: Call restorecon on copied ~/.ssh/authorized_keys if possible
-Author: Tomas Mraz <tmraz@fedoraproject.org>
-Bug-Debian: http://bugs.debian.org/658675
-Bug-Fedora: https://bugzilla.redhat.com/show_bug.cgi?id=739989
-Last-Update: 2012-08-24
-
-Index: b/contrib/ssh-copy-id
-===================================================================
---- a/contrib/ssh-copy-id
-+++ b/contrib/ssh-copy-id
-@@ -41,7 +41,7 @@
- # strip any trailing colon
- host=`echo $1 | sed 's/:$//'`
- 
--{ eval "$GET_ID" ; } | ssh $host "umask 077; test -d ~/.ssh || mkdir ~/.ssh ; cat >> ~/.ssh/authorized_keys" || exit 1
-+{ eval "$GET_ID" ; } | ssh $host "umask 077; test -d ~/.ssh || mkdir ~/.ssh ; cat >> ~/.ssh/authorized_keys && (test -x /sbin/restorecon && /sbin/restorecon ~/.ssh ~/.ssh/authorized_keys >/dev/null 2>&1 || true)" || exit 1
- 
- cat <<EOF
- Now try logging into the machine, with "ssh '$host'", and check in:
diff --git a/debian/patches/debian-banner.patch b/debian/patches/debian-banner.patch
index 22b1e4c14..d96f2cc59 100644
--- a/debian/patches/debian-banner.patch
+++ b/debian/patches/debian-banner.patch
@@ -4,13 +4,13 @@ Description: Add DebianBanner server configuration option
 Author: Kees Cook <kees@debian.org>
 Bug-Debian: http://bugs.debian.org/562048
 Forwarded: not-needed
-Last-Update: 2012-09-07
+Last-Update: 2013-05-07
 
 Index: b/servconf.c
 ===================================================================
 --- a/servconf.c
 +++ b/servconf.c
-@@ -146,6 +146,7 @@
+@@ -150,6 +150,7 @@
         options->ip_qos_interactive = -1;
         options->ip_qos_bulk = -1;
         options->version_addendum = NULL;
@@ -18,7 +18,7 @@ Index: b/servconf.c
  }
  
  void
-@@ -295,6 +296,8 @@
+@@ -299,6 +300,8 @@
                 options->ip_qos_bulk = IPTOS_THROUGHPUT;
         if (options->version_addendum == NULL)
                 options->version_addendum = xstrdup("");
@@ -27,23 +27,23 @@ Index: b/servconf.c
         /* Turn privilege separation on by default */
         if (use_privsep == -1)
                 use_privsep = PRIVSEP_NOSANDBOX;
-@@ -343,6 +346,7 @@
-        sZeroKnowledgePasswordAuthentication, sHostCertificate,
-        sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile,
+@@ -349,6 +352,7 @@
         sKexAlgorithms, sIPQoS, sVersionAddendum,
+        sAuthorizedKeysCommand, sAuthorizedKeysCommandUser,
+        sAuthenticationMethods,
 +       sDebianBanner,
         sDeprecated, sUnsupported
  } ServerOpCodes;
  
-@@ -479,6 +483,7 @@
-        { "kexalgorithms", sKexAlgorithms, SSHCFG_GLOBAL },
-        { "ipqos", sIPQoS, SSHCFG_ALL },
+@@ -488,6 +492,7 @@
+        { "authorizedkeyscommanduser", sAuthorizedKeysCommandUser, SSHCFG_ALL },
         { "versionaddendum", sVersionAddendum, SSHCFG_GLOBAL },
+        { "authenticationmethods", sAuthenticationMethods, SSHCFG_ALL },
 +       { "debianbanner", sDebianBanner, SSHCFG_GLOBAL },
         { NULL, sBadOption, 0 }
  };
  
-@@ -1538,6 +1543,10 @@
+@@ -1593,6 +1598,10 @@
                 }
                 return 0;
  
@@ -58,10 +58,11 @@ Index: b/servconf.h
 ===================================================================
 --- a/servconf.h
 +++ b/servconf.h
-@@ -172,6 +172,7 @@
-        char   *authorized_principals_file;
+@@ -184,6 +184,8 @@
  
-        char   *version_addendum;       /* Appended to SSH banner */
+        u_int   num_auth_methods;
+        char   *auth_methods[MAX_AUTH_METHODS];
++
 +       int     debian_banner;
  }       ServerOptions;
  
@@ -70,7 +71,7 @@ Index: b/sshd.c
 ===================================================================
 --- a/sshd.c
 +++ b/sshd.c
-@@ -425,7 +425,8 @@
+@@ -434,7 +434,8 @@
         }
  
         xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s%s",
@@ -84,7 +85,7 @@ Index: b/sshd_config.5
 ===================================================================
 --- a/sshd_config.5
 +++ b/sshd_config.5
-@@ -342,6 +342,11 @@
+@@ -397,6 +397,11 @@
  .Dq no .
  The default is
  .Dq delayed .
diff --git a/debian/patches/debian-config.patch b/debian/patches/debian-config.patch
index 57ebbf540..77e807502 100644
--- a/debian/patches/debian-config.patch
+++ b/debian/patches/debian-config.patch
@@ -18,7 +18,7 @@ Description: Various Debian-specific configuration changes
 Author: Colin Watson <cjwatson@debian.org>
 Author: Russ Allbery <rra@debian.org>
 Forwarded: not-needed
-Last-Update: 2010-02-28
+Last-Update: 2013-05-07
 
 Index: b/readconf.c
 ===================================================================
@@ -84,7 +84,7 @@ Index: b/ssh_config.5
  The configuration file has the following format:
  .Pp
  Empty lines and lines starting with
-@@ -499,7 +515,8 @@
+@@ -502,7 +518,8 @@
  Remote clients will be refused access after this time.
  .Pp
  The default is
diff --git a/debian/patches/doc-hash-tab-completion.patch b/debian/patches/doc-hash-tab-completion.patch
index cec6f6639..25201a7d4 100644
--- a/debian/patches/doc-hash-tab-completion.patch
+++ b/debian/patches/doc-hash-tab-completion.patch
@@ -2,13 +2,13 @@ Description: Document that HashKnownHosts may break tab-completion
 Author: Colin Watson <cjwatson@debian.org>
 Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1727
 Bug-Debian: http://bugs.debian.org/430154
-Last-Update: 2010-03-01
+Last-Update: 2013-05-07
 
 Index: b/ssh_config.5
 ===================================================================
 --- a/ssh_config.5
 +++ b/ssh_config.5
-@@ -585,6 +585,9 @@
+@@ -588,6 +588,9 @@
  will not be converted automatically,
  but may be manually hashed using
  .Xr ssh-keygen 1 .
diff --git a/debian/patches/gssapi.patch b/debian/patches/gssapi.patch
index 786500feb..7690e5824 100644
--- a/debian/patches/gssapi.patch
+++ b/debian/patches/gssapi.patch
@@ -13,7 +13,7 @@ Description: GSSAPI key exchange support
  security history.
 Author: Simon Wilkinson <simon@sxw.org.uk>
 Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1242
-Last-Updated: 2012-09-07
+Last-Updated: 2013-05-07
 
 Index: b/ChangeLog.gssapi
 ===================================================================
@@ -137,15 +137,15 @@ Index: b/Makefile.in
 ===================================================================
 --- a/Makefile.in
 +++ b/Makefile.in
-@@ -70,6 +70,7 @@
+@@ -72,6 +72,7 @@
         atomicio.o key.o dispatch.o kex.o mac.o uidswap.o uuencode.o misc.o \
         monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-rsa.o dh.o \
         kexdh.o kexgex.o kexdhc.o kexgexc.o bufec.o kexecdh.o kexecdhc.o \
 +       kexgssc.o \
-        msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o jpake.o \
-        schnorr.o ssh-pkcs11.o
+        msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \
+        jpake.o schnorr.o ssh-pkcs11.o krl.o
  
-@@ -86,7 +87,7 @@
+@@ -88,7 +89,7 @@
         auth2-none.o auth2-passwd.o auth2-pubkey.o auth2-jpake.o \
         monitor_mm.o monitor.o monitor_wrap.o kexdhs.o kexgexs.o kexecdhs.o \
         auth-krb5.o \
@@ -210,7 +210,7 @@ Index: b/auth2-gss.c
 --- a/auth2-gss.c
 +++ b/auth2-gss.c
 @@ -1,7 +1,7 @@
- /* $OpenBSD: auth2-gss.c,v 1.17 2011/03/10 02:52:57 djm Exp $ */
+ /* $OpenBSD: auth2-gss.c,v 1.18 2012/12/02 20:34:09 djm Exp $ */
  
  /*
 - * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
@@ -280,7 +280,7 @@ Index: b/auth2-gss.c
                 logit("GSSAPI MIC check failed");
  
 @@ -294,6 +330,12 @@
-        userauth_finish(authctxt, authenticated, "gssapi-with-mic");
+        userauth_finish(authctxt, authenticated, "gssapi-with-mic", NULL);
  }
  
 +Authmethod method_gsskeyex = {
@@ -327,7 +327,7 @@ Index: b/clientloop.c
  /* import options */
  extern Options options;
  
-@@ -1544,6 +1548,15 @@
+@@ -1599,6 +1603,15 @@
                 /* Do channel operations unless rekeying in progress. */
                 if (!rekeying) {
                         channel_after_select(readset, writeset);
@@ -347,7 +347,7 @@ Index: b/config.h.in
 ===================================================================
 --- a/config.h.in
 +++ b/config.h.in
-@@ -1471,6 +1471,9 @@
+@@ -1511,6 +1511,9 @@
  /* Use btmp to log bad logins */
  #undef USE_BTMP
  
@@ -357,7 +357,7 @@ Index: b/config.h.in
  /* Use libedit for sftp */
  #undef USE_LIBEDIT
  
-@@ -1486,6 +1489,9 @@
+@@ -1526,6 +1529,9 @@
  /* Use PIPES instead of a socketpair() */
  #undef USE_PIPES
  
@@ -371,7 +371,7 @@ Index: b/configure
 ===================================================================
 --- a/configure
 +++ b/configure
-@@ -6608,6 +6608,63 @@
+@@ -6588,6 +6588,63 @@
  
  $as_echo "#define SSH_TUN_PREPEND_AF 1" >>confdefs.h
  
@@ -439,7 +439,7 @@ Index: b/configure.ac
 ===================================================================
 --- a/configure.ac
 +++ b/configure.ac
-@@ -545,6 +545,30 @@
+@@ -533,6 +533,30 @@
             [Use tunnel device compatibility to OpenBSD])
         AC_DEFINE([SSH_TUN_PREPEND_AF], [1],
             [Prepend the address family to IP tunnel traffic])
@@ -1277,7 +1277,7 @@ Index: b/kex.c
  #if OPENSSL_VERSION_NUMBER >= 0x00907000L
  # if defined(HAVE_EVP_SHA256)
  # define evp_ssh_sha256 EVP_sha256
-@@ -358,6 +362,20 @@
+@@ -369,6 +373,20 @@
                 k->kex_type = KEX_ECDH_SHA2;
                 k->evp_md = kex_ecdh_name_to_evpmd(k->name);
  #endif
@@ -1312,7 +1312,7 @@ Index: b/kex.h
         KEX_MAX
  };
  
-@@ -129,6 +132,12 @@
+@@ -131,6 +134,12 @@
         sig_atomic_t done;
         int     flags;
         const EVP_MD *evp_md;
@@ -1325,7 +1325,7 @@ Index: b/kex.h
         char    *client_version_string;
         char    *server_version_string;
         int     (*verify_host_key)(Key *);
-@@ -156,6 +165,11 @@
+@@ -158,6 +167,11 @@
  void    kexecdh_client(Kex *);
  void    kexecdh_server(Kex *);
  
@@ -2016,7 +2016,7 @@ Index: b/monitor.c
  #endif
  
  #ifdef SSH_AUDIT_EVENTS
-@@ -251,6 +253,7 @@
+@@ -252,6 +254,7 @@
      {MONITOR_REQ_GSSSTEP, MON_ISAUTH, mm_answer_gss_accept_ctx},
      {MONITOR_REQ_GSSUSEROK, MON_AUTH, mm_answer_gss_userok},
      {MONITOR_REQ_GSSCHECKMIC, MON_ISAUTH, mm_answer_gss_checkmic},
@@ -2024,7 +2024,7 @@ Index: b/monitor.c
  #endif
  #ifdef JPAKE
      {MONITOR_REQ_JPAKE_GET_PWDATA, MON_ONCE, mm_answer_jpake_get_pwdata},
-@@ -263,6 +266,12 @@
+@@ -264,6 +267,12 @@
  };
  
  struct mon_table mon_dispatch_postauth20[] = {
@@ -2037,7 +2037,7 @@ Index: b/monitor.c
      {MONITOR_REQ_MODULI, 0, mm_answer_moduli},
      {MONITOR_REQ_SIGN, 0, mm_answer_sign},
      {MONITOR_REQ_PTY, 0, mm_answer_pty},
-@@ -371,6 +380,10 @@
+@@ -372,6 +381,10 @@
                 /* Permit requests for moduli and signatures */
                 monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
                 monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
@@ -2048,7 +2048,7 @@ Index: b/monitor.c
         } else {
                 mon_dispatch = mon_dispatch_proto15;
  
-@@ -468,6 +481,10 @@
+@@ -487,6 +500,10 @@
                 monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
                 monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
                 monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1);
@@ -2059,7 +2059,7 @@ Index: b/monitor.c
         } else {
                 mon_dispatch = mon_dispatch_postauth15;
                 monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1);
-@@ -1800,6 +1817,13 @@
+@@ -1836,6 +1853,13 @@
         kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
         kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
         kex->kex[KEX_ECDH_SHA2] = kexecdh_server;
@@ -2073,7 +2073,7 @@ Index: b/monitor.c
         kex->server = 1;
         kex->hostkey_type = buffer_get_int(m);
         kex->kex_type = buffer_get_int(m);
-@@ -2006,6 +2030,9 @@
+@@ -2042,6 +2066,9 @@
         OM_uint32 major;
         u_int len;
  
@@ -2083,7 +2083,7 @@ Index: b/monitor.c
         goid.elements = buffer_get_string(m, &len);
         goid.length = len;
  
-@@ -2033,6 +2060,9 @@
+@@ -2069,6 +2096,9 @@
         OM_uint32 flags = 0; /* GSI needs this */
         u_int len;
  
@@ -2093,7 +2093,7 @@ Index: b/monitor.c
         in.value = buffer_get_string(m, &len);
         in.length = len;
         major = ssh_gssapi_accept_ctx(gsscontext, &in, &out, &flags);
-@@ -2050,6 +2080,7 @@
+@@ -2086,6 +2116,7 @@
                 monitor_permit(mon_dispatch, MONITOR_REQ_GSSSTEP, 0);
                 monitor_permit(mon_dispatch, MONITOR_REQ_GSSUSEROK, 1);
                 monitor_permit(mon_dispatch, MONITOR_REQ_GSSCHECKMIC, 1);
@@ -2101,7 +2101,7 @@ Index: b/monitor.c
         }
         return (0);
  }
-@@ -2061,6 +2092,9 @@
+@@ -2097,6 +2128,9 @@
         OM_uint32 ret;
         u_int len;
  
@@ -2111,7 +2111,7 @@ Index: b/monitor.c
         gssbuf.value = buffer_get_string(m, &len);
         gssbuf.length = len;
         mic.value = buffer_get_string(m, &len);
-@@ -2087,7 +2121,11 @@
+@@ -2123,7 +2157,11 @@
  {
         int authenticated;
  
@@ -2124,7 +2124,7 @@ Index: b/monitor.c
  
         buffer_clear(m);
         buffer_put_int(m, authenticated);
-@@ -2100,6 +2138,74 @@
+@@ -2136,6 +2174,74 @@
         /* Monitor loop will terminate if authenticated */
         return (authenticated);
  }
@@ -2203,20 +2203,21 @@ Index: b/monitor.h
 ===================================================================
 --- a/monitor.h
 +++ b/monitor.h
-@@ -53,6 +53,8 @@
-        MONITOR_REQ_GSSSTEP, MONITOR_ANS_GSSSTEP,
-        MONITOR_REQ_GSSUSEROK, MONITOR_ANS_GSSUSEROK,
-        MONITOR_REQ_GSSCHECKMIC, MONITOR_ANS_GSSCHECKMIC,
-+       MONITOR_REQ_GSSSIGN, MONITOR_ANS_GSSSIGN,
-+       MONITOR_REQ_GSSUPCREDS, MONITOR_ANS_GSSUPCREDS,
-        MONITOR_REQ_PAM_START,
-        MONITOR_REQ_PAM_ACCOUNT, MONITOR_ANS_PAM_ACCOUNT,
-        MONITOR_REQ_PAM_INIT_CTX, MONITOR_ANS_PAM_INIT_CTX,
+@@ -70,6 +70,9 @@
+        MONITOR_REQ_PAM_FREE_CTX = 110, MONITOR_ANS_PAM_FREE_CTX = 111,
+        MONITOR_REQ_AUDIT_EVENT = 112, MONITOR_REQ_AUDIT_COMMAND = 113,
+ 
++       MONITOR_REQ_GSSSIGN = 200, MONITOR_ANS_GSSSIGN = 201,
++       MONITOR_REQ_GSSUPCREDS = 202, MONITOR_ANS_GSSUPCREDS = 203,
++
+ };
+ 
+ struct mm_master;
 Index: b/monitor_wrap.c
 ===================================================================
 --- a/monitor_wrap.c
 +++ b/monitor_wrap.c
-@@ -1270,7 +1270,7 @@
+@@ -1271,7 +1271,7 @@
  }
  
  int
@@ -2225,7 +2226,7 @@ Index: b/monitor_wrap.c
  {
         Buffer m;
         int authenticated = 0;
-@@ -1287,6 +1287,51 @@
+@@ -1288,6 +1288,51 @@
         debug3("%s: user %sauthenticated",__func__, authenticated ? "" : "not ");
         return (authenticated);
  }
@@ -2406,7 +2407,7 @@ Index: b/servconf.c
 ===================================================================
 --- a/servconf.c
 +++ b/servconf.c
-@@ -100,7 +100,10 @@
+@@ -102,7 +102,10 @@
         options->kerberos_ticket_cleanup = -1;
         options->kerberos_get_afs_token = -1;
         options->gss_authentication=-1;
@@ -2417,7 +2418,7 @@ Index: b/servconf.c
         options->password_authentication = -1;
         options->kbd_interactive_authentication = -1;
         options->challenge_response_authentication = -1;
-@@ -229,8 +232,14 @@
+@@ -233,8 +236,14 @@
                 options->kerberos_get_afs_token = 0;
         if (options->gss_authentication == -1)
                 options->gss_authentication = 0;
@@ -2432,7 +2433,7 @@ Index: b/servconf.c
         if (options->password_authentication == -1)
                 options->password_authentication = 1;
         if (options->kbd_interactive_authentication == -1)
-@@ -323,7 +332,9 @@
+@@ -327,7 +336,9 @@
         sBanner, sUseDNS, sHostbasedAuthentication,
         sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
         sClientAliveCountMax, sAuthorizedKeysFile,
@@ -2443,7 +2444,7 @@ Index: b/servconf.c
         sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
         sUsePrivilegeSeparation, sAllowAgentForwarding,
         sZeroKnowledgePasswordAuthentication, sHostCertificate,
-@@ -387,10 +398,20 @@
+@@ -393,10 +404,20 @@
  #ifdef GSSAPI
         { "gssapiauthentication", sGssAuthentication, SSHCFG_ALL },
         { "gssapicleanupcredentials", sGssCleanupCreds, SSHCFG_GLOBAL },
@@ -2464,7 +2465,7 @@ Index: b/servconf.c
         { "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
         { "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
         { "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL },
-@@ -1031,10 +1052,22 @@
+@@ -1049,10 +1070,22 @@
                 intptr = &options->gss_authentication;
                 goto parse_flag;
  
@@ -2487,7 +2488,7 @@ Index: b/servconf.c
         case sPasswordAuthentication:
                 intptr = &options->password_authentication;
                 goto parse_flag;
-@@ -1868,7 +1901,10 @@
+@@ -1927,7 +1960,10 @@
  #endif
  #ifdef GSSAPI
         dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
@@ -2502,7 +2503,7 @@ Index: b/servconf.h
 ===================================================================
 --- a/servconf.h
 +++ b/servconf.h
-@@ -103,7 +103,10 @@
+@@ -110,7 +110,10 @@
         int     kerberos_get_afs_token;         /* If true, try to get AFS token if
                                                  * authenticated with Kerberos. */
         int     gss_authentication;     /* If true, permit GSSAPI authentication */
@@ -2525,7 +2526,7 @@ Index: b/ssh-gss.h
   *
   * Redistribution and use in source and binary forms, with or without
   * modification, are permitted provided that the following conditions
-@@ -60,10 +60,22 @@
+@@ -61,10 +61,22 @@
  
  #define SSH_GSS_OIDTYPE 0x06
  
@@ -2548,7 +2549,7 @@ Index: b/ssh-gss.h
         void *data;
  } ssh_gssapi_ccache;
  
-@@ -71,8 +83,11 @@
+@@ -72,8 +84,11 @@
         gss_buffer_desc displayname;
         gss_buffer_desc exportedname;
         gss_cred_id_t creds;
@@ -2560,7 +2561,7 @@ Index: b/ssh-gss.h
  } ssh_gssapi_client;
  
  typedef struct ssh_gssapi_mech_struct {
-@@ -83,6 +98,7 @@
+@@ -84,6 +99,7 @@
         int (*userok) (ssh_gssapi_client *, char *);
         int (*localname) (ssh_gssapi_client *, char **);
         void (*storecreds) (ssh_gssapi_client *);
@@ -2568,7 +2569,7 @@ Index: b/ssh-gss.h
  } ssh_gssapi_mech;
  
  typedef struct {
-@@ -93,10 +109,11 @@
+@@ -94,10 +110,11 @@
         gss_OID         oid; /* client */
         gss_cred_id_t   creds; /* server */
         gss_name_t      client; /* server */
@@ -2581,7 +2582,7 @@ Index: b/ssh-gss.h
  
  int  ssh_gssapi_check_oid(Gssctxt *, void *, size_t);
  void ssh_gssapi_set_oid_data(Gssctxt *, void *, size_t);
-@@ -116,16 +133,30 @@
+@@ -117,16 +134,30 @@
  void ssh_gssapi_delete_ctx(Gssctxt **);
  OM_uint32 ssh_gssapi_sign(Gssctxt *, gss_buffer_t, gss_buffer_t);
  void ssh_gssapi_buildmic(Buffer *, const char *, const char *, const char *);
@@ -2631,7 +2632,7 @@ Index: b/ssh_config.5
 ===================================================================
 --- a/ssh_config.5
 +++ b/ssh_config.5
-@@ -527,11 +527,43 @@
+@@ -530,11 +530,43 @@
  The default is
  .Dq no .
  Note that this option applies to protocol version 2 only.
@@ -2764,7 +2765,7 @@ Index: b/sshconnect2.c
         xxx_kex = kex;
  
         dispatch_run(DISPATCH_BLOCK, &kex->done, kex);
-@@ -305,6 +361,7 @@
+@@ -306,6 +362,7 @@
  void   input_gssapi_hash(int type, u_int32_t, void *);
  void   input_gssapi_error(int, u_int32_t, void *);
  void   input_gssapi_errtok(int, u_int32_t, void *);
@@ -2772,7 +2773,7 @@ Index: b/sshconnect2.c
  #endif
  
  void   userauth(Authctxt *, char *);
-@@ -320,6 +377,11 @@
+@@ -321,6 +378,11 @@
  
  Authmethod authmethods[] = {
  #ifdef GSSAPI
@@ -2784,7 +2785,7 @@ Index: b/sshconnect2.c
         {"gssapi-with-mic",
                 userauth_gssapi,
                 NULL,
-@@ -626,19 +688,31 @@
+@@ -627,19 +689,31 @@
         static u_int mech = 0;
         OM_uint32 min;
         int ok = 0;
@@ -2818,7 +2819,7 @@ Index: b/sshconnect2.c
                         ok = 1; /* Mechanism works */
                 } else {
                         mech++;
-@@ -735,8 +809,8 @@
+@@ -736,8 +810,8 @@
  {
         Authctxt *authctxt = ctxt;
         Gssctxt *gssctxt;
@@ -2829,7 +2830,7 @@ Index: b/sshconnect2.c
  
         if (authctxt == NULL)
                 fatal("input_gssapi_response: no authentication context");
-@@ -846,6 +920,48 @@
+@@ -847,6 +921,48 @@
         xfree(msg);
         xfree(lang);
  }
@@ -2893,7 +2894,7 @@ Index: b/sshd.c
  #ifdef LIBWRAP
  #include <tcpd.h>
  #include <syslog.h>
-@@ -1607,10 +1611,13 @@
+@@ -1645,10 +1649,13 @@
                 logit("Disabling protocol version 1. Could not load host key");
                 options.protocol &= ~SSH_PROTO_1;
         }
@@ -2907,7 +2908,7 @@ Index: b/sshd.c
         if (!(options.protocol & (SSH_PROTO_1|SSH_PROTO_2))) {
                 logit("sshd: no hostkeys available -- exiting.");
                 exit(1);
-@@ -1938,6 +1945,60 @@
+@@ -1976,6 +1983,60 @@
         /* Log the connection. */
         verbose("Connection from %.500s port %d", remote_ip, remote_port);
  
@@ -2968,7 +2969,7 @@ Index: b/sshd.c
         /*
          * We don't want to listen forever unless the other side
          * successfully authenticates itself.  So we set up an alarm which is
-@@ -2319,6 +2380,48 @@
+@@ -2357,6 +2418,48 @@
  
         myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = list_hostkey_types();
  
@@ -3017,7 +3018,7 @@ Index: b/sshd.c
         /* start key exchange */
         kex = kex_setup(myproposal);
         kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server;
-@@ -2326,6 +2429,13 @@
+@@ -2364,6 +2467,13 @@
         kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
         kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
         kex->kex[KEX_ECDH_SHA2] = kexecdh_server;
@@ -3035,7 +3036,7 @@ Index: b/sshd_config
 ===================================================================
 --- a/sshd_config
 +++ b/sshd_config
-@@ -77,6 +77,8 @@
+@@ -80,6 +80,8 @@
  # GSSAPI options
  #GSSAPIAuthentication no
  #GSSAPICleanupCredentials yes
@@ -3048,7 +3049,7 @@ Index: b/sshd_config.5
 ===================================================================
 --- a/sshd_config.5
 +++ b/sshd_config.5
-@@ -426,12 +426,40 @@
+@@ -481,12 +481,40 @@
  The default is
  .Dq no .
  Note that this option applies to protocol version 2 only.
diff --git a/debian/patches/keepalive-extensions.patch b/debian/patches/keepalive-extensions.patch
index 0937a49e6..028bd62e5 100644
--- a/debian/patches/keepalive-extensions.patch
+++ b/debian/patches/keepalive-extensions.patch
@@ -12,7 +12,7 @@ Author: Richard Kettlewell <rjk@greenend.org.uk>
 Author: Ian Jackson <ian@chiark.greenend.org.uk>
 Author: Matthew Vernon <matthew@debian.org>
 Author: Colin Watson <cjwatson@debian.org>
-Last-Update: 2010-02-27
+Last-Update: 2013-05-07
 
 Index: b/readconf.c
 ===================================================================
@@ -78,7 +78,7 @@ Index: b/ssh_config.5
  The argument must be
  .Dq yes
  or
-@@ -1099,8 +1103,15 @@
+@@ -1113,8 +1117,15 @@
  will send a message through the encrypted
  channel to request a response from the server.
  The default
@@ -95,7 +95,7 @@ Index: b/ssh_config.5
  .It Cm StrictHostKeyChecking
  If this flag is set to
  .Dq yes ,
-@@ -1139,6 +1150,12 @@
+@@ -1153,6 +1164,12 @@
  other side.
  If they are sent, death of the connection or crash of one
  of the machines will be properly noticed.
@@ -112,7 +112,7 @@ Index: b/sshd_config.5
 ===================================================================
 --- a/sshd_config.5
 +++ b/sshd_config.5
-@@ -1048,6 +1048,9 @@
+@@ -1122,6 +1122,9 @@
  .Pp
  To disable TCP keepalive messages, the value should be set to
  .Dq no .
diff --git a/debian/patches/lintian-symlink-pickiness.patch b/debian/patches/lintian-symlink-pickiness.patch
index ae32969ea..8afabfaba 100644
--- a/debian/patches/lintian-symlink-pickiness.patch
+++ b/debian/patches/lintian-symlink-pickiness.patch
@@ -3,13 +3,13 @@ Description: Fix picky lintian errors about slogin symlinks
  either way and opted to keep the status quo.  We need this patch anyway.
 Author: Colin Watson <cjwatson@debian.org>
 Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1728
-Last-Update: 2010-04-10
+Last-Update: 2013-05-07
 
 Index: b/Makefile.in
 ===================================================================
 --- a/Makefile.in
 +++ b/Makefile.in
-@@ -284,9 +284,9 @@
+@@ -293,9 +293,9 @@
         $(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
         $(INSTALL) -m 644 ssh-vulnkey.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-vulnkey.1
         -rm -f $(DESTDIR)$(bindir)/slogin
diff --git a/debian/patches/max-startups-default.patch b/debian/patches/max-startups-default.patch
deleted file mode 100644
index 87e690bd1..000000000
--- a/debian/patches/max-startups-default.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-Description: Change default of MaxStartups to 10:30:100
- This causes sshd to start doing random early drop at 10 connections up to
- 100 connections.  This will make it harder to DoS as CPUs have come a long
- way since the original value was set back in 2000.
-Author: Darren Tucker
-Origin: http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/servconf.c?r1=1.234#rev1.234
-Origin: http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshd_config.5?r1=1.156#rev1.156
-Origin: http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshd_config?r1=1.89#rev1.89
-Bug-Debian: http://bugs.debian.org/700102
-Forwarded: not-needed
-Last-Update: 2013-02-08
-
-Index: b/servconf.c
-===================================================================
---- a/servconf.c
-+++ b/servconf.c
-@@ -264,11 +264,11 @@
-        if (options->gateway_ports == -1)
-                options->gateway_ports = 0;
-        if (options->max_startups == -1)
--               options->max_startups = 10;
-+               options->max_startups = 100;
-        if (options->max_startups_rate == -1)
--               options->max_startups_rate = 100;               /* 100% */
-+               options->max_startups_rate = 30;                /* 30% */
-        if (options->max_startups_begin == -1)
--               options->max_startups_begin = options->max_startups;
-+               options->max_startups_begin = 10;
-        if (options->max_authtries == -1)
-                options->max_authtries = DEFAULT_AUTH_FAIL_MAX;
-        if (options->max_sessions == -1)
-Index: b/sshd_config
-===================================================================
---- a/sshd_config
-+++ b/sshd_config
-@@ -108,7 +108,7 @@
- #ClientAliveCountMax 3
- #UseDNS yes
- #PidFile /var/run/sshd.pid
--#MaxStartups 10
-+#MaxStartups 10:30:100
- #PermitTunnel no
- #ChrootDirectory none
- #VersionAddendum none
-Index: b/sshd_config.5
-===================================================================
---- a/sshd_config.5
-+++ b/sshd_config.5
-@@ -781,7 +781,7 @@
- Additional connections will be dropped until authentication succeeds or the
- .Cm LoginGraceTime
- expires for a connection.
--The default is 10.
-+The default is 10:30:100.
- .Pp
- Alternatively, random early drop can be enabled by specifying
- the three colon separated values
diff --git a/debian/patches/mention-ssh-keygen-on-keychange.patch b/debian/patches/mention-ssh-keygen-on-keychange.patch
index 42b32638c..fa7c725b4 100644
--- a/debian/patches/mention-ssh-keygen-on-keychange.patch
+++ b/debian/patches/mention-ssh-keygen-on-keychange.patch
@@ -2,13 +2,13 @@ Description: Mention ssh-keygen in ssh fingerprint changed warning
 Author: Scott Moser <smoser@ubuntu.com>
 Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1843
 Bug-Ubuntu: https://bugs.launchpad.net/bugs/686607
-Last-Update: 2010-12-14
+Last-Update: 2013-05-07
 
 Index: b/sshconnect.c
 ===================================================================
 --- a/sshconnect.c
 +++ b/sshconnect.c
-@@ -956,9 +956,12 @@
+@@ -975,9 +975,12 @@
                         error("%s. This could either mean that", key_msg);
                         error("DNS SPOOFING is happening or the IP address for the host");
                         error("and its host key have changed at the same time.");
@@ -22,7 +22,7 @@ Index: b/sshconnect.c
                 }
                 /* The host key has changed. */
                 warn_changed_key(host_key);
-@@ -966,6 +969,8 @@
+@@ -985,6 +988,8 @@
                     user_hostfiles[0]);
                 error("Offending %s key in %s:%lu", key_type(host_found->key),
                     host_found->file, host_found->line);
diff --git a/debian/patches/openbsd-docs.patch b/debian/patches/openbsd-docs.patch
index fe8ebe757..48c3ff598 100644
--- a/debian/patches/openbsd-docs.patch
+++ b/debian/patches/openbsd-docs.patch
@@ -6,7 +6,7 @@ Description: Adjust various OpenBSD-specific references in manual pages
   https://bugs.launchpad.net/bugs/456660 (ssl(8))
 Author: Colin Watson <cjwatson@debian.org>
 Forwarded: not-needed
-Last-Update: 2010-02-28
+Last-Update: 2013-05-07
 
 Index: b/moduli.5
 ===================================================================
@@ -34,7 +34,7 @@ Index: b/ssh-keygen.1
 ===================================================================
 --- a/ssh-keygen.1
 +++ b/ssh-keygen.1
-@@ -152,9 +152,7 @@
+@@ -171,9 +171,7 @@
  .Pa ~/.ssh/id_dsa
  or
  .Pa ~/.ssh/id_rsa .
@@ -45,7 +45,7 @@ Index: b/ssh-keygen.1
  .Pp
  Normally this program generates the key and asks for a file in which
  to store the private key.
-@@ -200,9 +198,7 @@
+@@ -219,9 +217,7 @@
  For each of the key types (rsa1, rsa, dsa and ecdsa) for which host keys
  do not exist, generate the host keys with the default key file path,
  an empty passphrase, default bits for the key type, and default comment.
@@ -56,7 +56,7 @@ Index: b/ssh-keygen.1
  .It Fl a Ar trials
  Specifies the number of primality tests to perform when screening DH-GEX
  candidates using the
-@@ -556,7 +552,7 @@
+@@ -606,7 +602,7 @@
  Valid generator values are 2, 3, and 5.
  .Pp
  Screened DH groups may be installed in
@@ -65,7 +65,7 @@ Index: b/ssh-keygen.1
  It is important that this file contains moduli of a range of bit lengths and
  that both ends of a connection share common moduli.
  .Sh CERTIFICATES
-@@ -682,7 +678,7 @@
+@@ -801,7 +797,7 @@
  where the user wishes to log in using public key authentication.
  There is no need to keep the contents of this file secret.
  .Pp
@@ -123,7 +123,7 @@ Index: b/sshd_config.5
 ===================================================================
 --- a/sshd_config.5
 +++ b/sshd_config.5
-@@ -224,8 +224,7 @@
+@@ -276,8 +276,7 @@
  By default, no banner is displayed.
  .It Cm ChallengeResponseAuthentication
  Specifies whether challenge-response authentication is allowed (e.g. via
diff --git a/debian/patches/package-versioning.patch b/debian/patches/package-versioning.patch
index b396cb116..c337ad671 100644
--- a/debian/patches/package-versioning.patch
+++ b/debian/patches/package-versioning.patch
@@ -5,26 +5,30 @@ Description: Include the Debian version in our identification
  vulnerable-looking version strings.  (However, see debian-banner.patch.)
 Author: Matthew Vernon <matthew@debian.org>
 Forwarded: not-needed
-Last-Update: 2012-09-07
+Last-Update: 2013-05-07
 
 Index: b/sshconnect.c
 ===================================================================
 --- a/sshconnect.c
 +++ b/sshconnect.c
-@@ -556,7 +556,7 @@
-        snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s%s",
-            compat20 ? PROTOCOL_MAJOR_2 : PROTOCOL_MAJOR_1,
-            compat20 ? PROTOCOL_MINOR_2 : minor1,
--           SSH_VERSION, compat20 ? "\r\n" : "\n");
-+           SSH_RELEASE, compat20 ? "\r\n" : "\n");
-        if (roaming_atomicio(vwrite, connection_out, buf, strlen(buf))
-            != strlen(buf))
-                fatal("write: %.100s", strerror(errno));
+@@ -435,10 +435,10 @@
+        /* Send our own protocol version identification. */
+        if (compat20) {
+                xasprintf(&client_version_string, "SSH-%d.%d-%.100s\r\n",
+-                   PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION);
++                   PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE);
+        } else {
+                xasprintf(&client_version_string, "SSH-%d.%d-%.100s\n",
+-                   PROTOCOL_MAJOR_1, minor1, SSH_VERSION);
++                   PROTOCOL_MAJOR_1, minor1, SSH_RELEASE);
+        }
+        if (roaming_atomicio(vwrite, connection_out, client_version_string,
+            strlen(client_version_string)) != strlen(client_version_string))
 Index: b/sshd.c
 ===================================================================
 --- a/sshd.c
 +++ b/sshd.c
-@@ -425,7 +425,7 @@
+@@ -434,7 +434,7 @@
         }
  
         xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s%s",
@@ -38,7 +42,7 @@ Index: b/version.h
 --- a/version.h
 +++ b/version.h
 @@ -3,4 +3,9 @@
- #define SSH_VERSION    "OpenSSH_6.1"
+ #define SSH_VERSION    "OpenSSH_6.2"
  
  #define SSH_PORTABLE   "p1"
 -#define SSH_RELEASE    SSH_VERSION SSH_PORTABLE
diff --git a/debian/patches/quieter-signals.patch b/debian/patches/quieter-signals.patch
index e436fe59e..f25ff89d0 100644
--- a/debian/patches/quieter-signals.patch
+++ b/debian/patches/quieter-signals.patch
@@ -10,13 +10,13 @@ Author: Peter Samuelson <peter@p12n.org>
 Author: Colin Watson <cjwatson@debian.org>
 Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1118
 Bug-Debian: http://bugs.debian.org/313371
-Last-Update: 2010-02-27
+Last-Update: 2013-05-07
 
 Index: b/clientloop.c
 ===================================================================
 --- a/clientloop.c
 +++ b/clientloop.c
-@@ -1655,8 +1655,10 @@
+@@ -1710,8 +1710,10 @@
                 exit_status = 0;
         }
  
diff --git a/debian/patches/selinux-role.patch b/debian/patches/selinux-role.patch
index 80fe3247b..f2f8fcd21 100644
--- a/debian/patches/selinux-role.patch
+++ b/debian/patches/selinux-role.patch
@@ -5,7 +5,7 @@ Description: Handle SELinux authorisation roles
 Author: Manoj Srivastava <srivasta@debian.org>
 Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1641
 Bug-Debian: http://bugs.debian.org/394795
-Last-Update: 2010-02-27
+Last-Update: 2013-05-07
 
 Index: b/auth.h
 ===================================================================
@@ -23,7 +23,7 @@ Index: b/auth1.c
 ===================================================================
 --- a/auth1.c
 +++ b/auth1.c
-@@ -383,7 +383,7 @@
+@@ -385,7 +385,7 @@
  do_authentication(Authctxt *authctxt)
  {
         u_int ulen;
@@ -32,7 +32,7 @@ Index: b/auth1.c
  
         /* Get the name of the user that we wish to log in as. */
         packet_read_expect(SSH_CMSG_USER);
-@@ -392,11 +392,17 @@
+@@ -394,11 +394,17 @@
         user = packet_get_cstring(&ulen);
         packet_check_eom();
  
@@ -54,7 +54,7 @@ Index: b/auth2.c
 ===================================================================
 --- a/auth2.c
 +++ b/auth2.c
-@@ -217,7 +217,7 @@
+@@ -219,7 +219,7 @@
  {
         Authctxt *authctxt = ctxt;
         Authmethod *m = NULL;
@@ -63,7 +63,7 @@ Index: b/auth2.c
         int authenticated = 0;
  
         if (authctxt == NULL)
-@@ -229,8 +229,13 @@
+@@ -231,8 +231,13 @@
         debug("userauth-request for user %s service %s method %s", user, service, method);
         debug("attempt %d failures %d", authctxt->attempt, authctxt->failures);
  
@@ -77,7 +77,7 @@ Index: b/auth2.c
  
         if (authctxt->attempt++ == 0) {
                 /* setup auth context */
-@@ -254,8 +259,9 @@
+@@ -256,8 +261,9 @@
                     use_privsep ? " [net]" : "");
                 authctxt->service = xstrdup(service);
                 authctxt->style = style ? xstrdup(style) : NULL;
@@ -86,8 +86,8 @@ Index: b/auth2.c
 -                       mm_inform_authserv(service, style);
 +                       mm_inform_authserv(service, style, role);
                 userauth_banner();
-        } else if (strcmp(user, authctxt->user) != 0 ||
-            strcmp(service, authctxt->service) != 0) {
+                if (auth2_setup_methods_lists(authctxt) != 0)
+                        packet_disconnect("no authentication methods enabled");
 Index: b/monitor.c
 ===================================================================
 --- a/monitor.c
@@ -100,7 +100,7 @@ Index: b/monitor.c
  int mm_answer_authpassword(int, Buffer *);
  int mm_answer_bsdauthquery(int, Buffer *);
  int mm_answer_bsdauthrespond(int, Buffer *);
-@@ -225,6 +226,7 @@
+@@ -226,6 +227,7 @@
      {MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign},
      {MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow},
      {MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv},
@@ -108,7 +108,7 @@ Index: b/monitor.c
      {MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner},
      {MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword},
  #ifdef USE_PAM
-@@ -808,6 +810,7 @@
+@@ -837,6 +839,7 @@
         else {
                 /* Allow service/style information on the auth context */
                 monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1);
@@ -116,7 +116,7 @@ Index: b/monitor.c
                 monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1);
         }
  #ifdef USE_PAM
-@@ -840,14 +843,37 @@
+@@ -869,14 +872,37 @@
  
         authctxt->service = buffer_get_string(m, NULL);
         authctxt->style = buffer_get_string(m, NULL);
@@ -156,7 +156,7 @@ Index: b/monitor.c
         return (0);
  }
  
-@@ -1435,7 +1461,7 @@
+@@ -1471,7 +1497,7 @@
         res = pty_allocate(&s->ptyfd, &s->ttyfd, s->tty, sizeof(s->tty));
         if (res == 0)
                 goto error;
@@ -169,15 +169,15 @@ Index: b/monitor.h
 ===================================================================
 --- a/monitor.h
 +++ b/monitor.h
-@@ -30,7 +30,7 @@
- 
- enum monitor_reqtype {
-        MONITOR_REQ_MODULI, MONITOR_ANS_MODULI,
--       MONITOR_REQ_FREE, MONITOR_REQ_AUTHSERV,
-+       MONITOR_REQ_FREE, MONITOR_REQ_AUTHSERV, MONITOR_REQ_AUTHROLE,
-        MONITOR_REQ_SIGN, MONITOR_ANS_SIGN,
-        MONITOR_REQ_PWNAM, MONITOR_ANS_PWNAM,
-        MONITOR_REQ_AUTH2_READ_BANNER, MONITOR_ANS_AUTH2_READ_BANNER,
+@@ -73,6 +73,8 @@
+        MONITOR_REQ_GSSSIGN = 200, MONITOR_ANS_GSSSIGN = 201,
+        MONITOR_REQ_GSSUPCREDS = 202, MONITOR_ANS_GSSUPCREDS = 203,
+ 
++       MONITOR_REQ_AUTHROLE = 300,
++
+ };
+ 
+ struct mm_master;
 Index: b/monitor_wrap.c
 ===================================================================
 --- a/monitor_wrap.c
@@ -369,12 +369,12 @@ Index: b/platform.h
 +void platform_setusercontext_post_groups(struct passwd *, const char *);
  char *platform_get_krb5_client(const char *);
  char *platform_krb5_get_principal_name(const char *);
- 
+ int platform_sys_dir_uid(uid_t);
 Index: b/session.c
 ===================================================================
 --- a/session.c
 +++ b/session.c
-@@ -1471,7 +1471,7 @@
+@@ -1474,7 +1474,7 @@
  
  /* Set login name, uid, gid, and groups. */
  void
@@ -383,7 +383,7 @@ Index: b/session.c
  {
         char *chroot_path, *tmp;
  
-@@ -1499,7 +1499,7 @@
+@@ -1502,7 +1502,7 @@
                 endgrent();
  #endif
  
@@ -392,7 +392,7 @@ Index: b/session.c
  
                 if (options.chroot_directory != NULL &&
                     strcasecmp(options.chroot_directory, "none") != 0) {
-@@ -1625,7 +1625,7 @@
+@@ -1633,7 +1633,7 @@
  
         /* Force a password change */
         if (s->authctxt->force_pwchange) {
@@ -401,7 +401,7 @@ Index: b/session.c
                 child_close_fds();
                 do_pwchange(s);
                 exit(1);
-@@ -1652,7 +1652,7 @@
+@@ -1660,7 +1660,7 @@
                 /* When PAM is enabled we rely on it to do the nologin check */
                 if (!options.use_pam)
                         do_nologin(pw);
@@ -410,7 +410,7 @@ Index: b/session.c
                 /*
                  * PAM session modules in do_setusercontext may have
                  * generated messages, so if this in an interactive
-@@ -2064,7 +2064,7 @@
+@@ -2072,7 +2072,7 @@
         tty_parse_modes(s->ttyfd, &n_bytes);
  
         if (!use_privsep)
@@ -436,7 +436,7 @@ Index: b/sshd.c
 ===================================================================
 --- a/sshd.c
 +++ b/sshd.c
-@@ -736,7 +736,7 @@
+@@ -745,7 +745,7 @@
         RAND_seed(rnd, sizeof(rnd));
  
         /* Drop privileges */
diff --git a/debian/patches/series b/debian/patches/series
index efb2c5432..6f2da2944 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -3,7 +3,6 @@ gssapi.patch
 
 # SELinux
 selinux-role.patch
-copy-id-restorecon.patch
 
 # Key blacklisting
 ssh-vulnkey.patch
@@ -27,7 +26,6 @@ shell-path.patch
 dnssec-sshfp.patch
 auth-log-verbosity.patch
 mention-ssh-keygen-on-keychange.patch
-max-startups-default.patch
 
 # Versioning
 package-versioning.patch
diff --git a/debian/patches/shell-path.patch b/debian/patches/shell-path.patch
index 8c549128b..4c4532e99 100644
--- a/debian/patches/shell-path.patch
+++ b/debian/patches/shell-path.patch
@@ -4,7 +4,7 @@ Description: Look for $SHELL on the path for ProxyCommand/LocalCommand
 Author: Colin Watson <cjwatson@debian.org>
 Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1494
 Bug-Debian: http://bugs.debian.org/492728
-Last-Update: 2010-02-27
+Last-Update: 2013-05-07
 
 Index: b/sshconnect.c
 ===================================================================
@@ -19,7 +19,7 @@ Index: b/sshconnect.c
                 perror(argv[0]);
                 exit(1);
         }
-@@ -1273,7 +1273,7 @@
+@@ -1292,7 +1292,7 @@
         if (pid == 0) {
                 signal(SIGPIPE, SIG_DFL);
                 debug3("Executing %s -c \"%s\"", shell, args);
diff --git a/debian/patches/ssh-argv0.patch b/debian/patches/ssh-argv0.patch
index 3cc1272ec..6f4a3cd9a 100644
--- a/debian/patches/ssh-argv0.patch
+++ b/debian/patches/ssh-argv0.patch
@@ -5,13 +5,13 @@ Description: ssh(1): Refer to ssh-argv0(1)
  manual page from ssh(1).
 Bug-Debian: http://bugs.debian.org/111341
 Forwarded: not-needed
-Last-Update: 2010-02-28
+Last-Update: 2013-05-07
 
 Index: b/ssh.1
 ===================================================================
 --- a/ssh.1
 +++ b/ssh.1
-@@ -1425,6 +1425,7 @@
+@@ -1433,6 +1433,7 @@
  .Xr sftp 1 ,
  .Xr ssh-add 1 ,
  .Xr ssh-agent 1 ,
diff --git a/debian/patches/ssh-vulnkey.patch b/debian/patches/ssh-vulnkey.patch
index c13cb3412..b7531cce0 100644
--- a/debian/patches/ssh-vulnkey.patch
+++ b/debian/patches/ssh-vulnkey.patch
@@ -8,7 +8,7 @@ Description: Reject vulnerable keys to mitigate Debian OpenSSL flaw
  See CVE-2008-0166.
 Author: Colin Watson <cjwatson@ubuntu.com>
 Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1469
-Last-Update: 2010-02-27
+Last-Update: 2013-05-07
 
 Index: b/Makefile.in
 ===================================================================
@@ -22,24 +22,26 @@ Index: b/Makefile.in
  PRIVSEP_PATH=@PRIVSEP_PATH@
  SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
  STRIP_OPT=@STRIP_OPT@
-@@ -38,6 +39,7 @@
+@@ -37,7 +38,8 @@
+        -D_PATH_SSH_KEY_SIGN=\"$(SSH_KEYSIGN)\" \
         -D_PATH_SSH_PKCS11_HELPER=\"$(SSH_PKCS11_HELPER)\" \
         -D_PATH_SSH_PIDDIR=\"$(piddir)\" \
-        -D_PATH_PRIVSEP_CHROOT_DIR=\"$(PRIVSEP_PATH)\" \
-+       -D_PATH_SSH_DATADIR=\"$(SSH_DATADIR)\" \
+-       -D_PATH_PRIVSEP_CHROOT_DIR=\"$(PRIVSEP_PATH)\"
++       -D_PATH_PRIVSEP_CHROOT_DIR=\"$(PRIVSEP_PATH)\" \
++       -D_PATH_SSH_DATADIR=\"$(SSH_DATADIR)\"
  
  CC=@CC@
  LD=@LD@
-@@ -59,7 +61,7 @@
+@@ -61,7 +63,7 @@
  EXEEXT=@EXEEXT@
  MANFMT=@MANFMT@
  
 -TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT)
 +TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-vulnkey$(EXEEXT)
  
- LIBSSH_OBJS=acss.o authfd.o authfile.o bufaux.o bufbn.o buffer.o \
-        canohost.o channels.o cipher.o cipher-acss.o cipher-aes.o \
-@@ -94,8 +96,8 @@
+ LIBSSH_OBJS=authfd.o authfile.o bufaux.o bufbn.o buffer.o \
+        canohost.o channels.o cipher.o cipher-aes.o \
+@@ -96,8 +98,8 @@
         sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o \
         sandbox-seccomp-filter.o
  
@@ -50,7 +52,7 @@ Index: b/Makefile.in
  MANTYPE                = @MANTYPE@
  
  CONFIGFILES=sshd_config.out ssh_config.out moduli.out
-@@ -172,6 +174,9 @@
+@@ -174,6 +176,9 @@
  sftp$(EXEEXT): $(LIBCOMPAT) libssh.a sftp.o sftp-client.o sftp-common.o sftp-glob.o progressmeter.o
         $(LD) -o $@ progressmeter.o sftp.o sftp-client.o sftp-common.o sftp-glob.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(LIBEDIT)
  
@@ -60,7 +62,7 @@ Index: b/Makefile.in
  # test driver for the loginrec code - not built by default
  logintest: logintest.o $(LIBCOMPAT) libssh.a loginrec.o
         $(LD) -o $@ logintest.o $(LDFLAGS) loginrec.o -lopenbsd-compat -lssh $(LIBS)
-@@ -260,6 +265,7 @@
+@@ -269,6 +274,7 @@
         $(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
         $(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
         $(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
@@ -68,7 +70,7 @@ Index: b/Makefile.in
         $(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
         $(INSTALL) -m 644 scp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
         $(INSTALL) -m 644 ssh-add.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
-@@ -274,6 +280,7 @@
+@@ -283,6 +289,7 @@
         $(INSTALL) -m 644 sftp-server.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
         $(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
         $(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
@@ -76,7 +78,7 @@ Index: b/Makefile.in
         -rm -f $(DESTDIR)$(bindir)/slogin
         ln -s ./ssh$(EXEEXT) $(DESTDIR)$(bindir)/slogin
         -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1
-@@ -355,6 +362,7 @@
+@@ -364,6 +371,7 @@
         -rm -f $(DESTDIR)$(bindir)/ssh-agent$(EXEEXT)
         -rm -f $(DESTDIR)$(bindir)/ssh-keygen$(EXEEXT)
         -rm -f $(DESTDIR)$(bindir)/ssh-keyscan$(EXEEXT)
@@ -84,7 +86,7 @@ Index: b/Makefile.in
         -rm -f $(DESTDIR)$(bindir)/sftp$(EXEEXT)
         -rm -f $(DESTDIR)$(sbindir)/sshd$(EXEEXT)
         -rm -r $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
-@@ -367,6 +375,7 @@
+@@ -376,6 +384,7 @@
         -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-keygen.1
         -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/sftp.1
         -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-keyscan.1
@@ -130,7 +132,7 @@ Index: b/auth.c
  #include "auth.h"
  #include "auth-options.h"
  #include "canohost.h"
-@@ -608,10 +609,34 @@
+@@ -635,10 +636,34 @@
  
  /* Returns 1 if key is revoked by revoked_keys_file, 0 otherwise */
  int
@@ -165,12 +167,12 @@ Index: b/auth.c
 +
         if (options.revoked_keys_file == NULL)
                 return 0;
- 
+        switch (ssh_krl_file_contains_key(options.revoked_keys_file, key)) {
 Index: b/auth.h
 ===================================================================
 --- a/auth.h
 +++ b/auth.h
-@@ -174,7 +174,7 @@
+@@ -185,7 +185,7 @@
  
  FILE   *auth_openkeyfile(const char *, struct passwd *, int);
  FILE   *auth_openprincipals(const char *, struct passwd *, int);
@@ -196,7 +198,7 @@ Index: b/auth2-pubkey.c
 ===================================================================
 --- a/auth2-pubkey.c
 +++ b/auth2-pubkey.c
-@@ -440,9 +440,10 @@
+@@ -608,9 +608,10 @@
         u_int success, i;
         char *file;
  
@@ -462,7 +464,7 @@ Index: b/servconf.c
 ===================================================================
 --- a/servconf.c
 +++ b/servconf.c
-@@ -107,6 +107,7 @@
+@@ -109,6 +109,7 @@
         options->password_authentication = -1;
         options->kbd_interactive_authentication = -1;
         options->challenge_response_authentication = -1;
@@ -470,7 +472,7 @@ Index: b/servconf.c
         options->permit_empty_passwd = -1;
         options->permit_user_env = -1;
         options->use_login = -1;
-@@ -246,6 +247,8 @@
+@@ -250,6 +251,8 @@
                 options->kbd_interactive_authentication = 0;
         if (options->challenge_response_authentication == -1)
                 options->challenge_response_authentication = 1;
@@ -479,7 +481,7 @@ Index: b/servconf.c
         if (options->permit_empty_passwd == -1)
                 options->permit_empty_passwd = 0;
         if (options->permit_user_env == -1)
-@@ -323,7 +326,7 @@
+@@ -327,7 +330,7 @@
         sListenAddress, sAddressFamily,
         sPrintMotd, sPrintLastLog, sIgnoreRhosts,
         sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
@@ -488,7 +490,7 @@ Index: b/servconf.c
         sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression,
         sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
         sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
-@@ -433,6 +436,7 @@
+@@ -439,6 +442,7 @@
         { "x11uselocalhost", sX11UseLocalhost, SSHCFG_ALL },
         { "xauthlocation", sXAuthLocation, SSHCFG_GLOBAL },
         { "strictmodes", sStrictModes, SSHCFG_GLOBAL },
@@ -496,7 +498,7 @@ Index: b/servconf.c
         { "permitemptypasswords", sEmptyPasswd, SSHCFG_ALL },
         { "permituserenvironment", sPermitUserEnvironment, SSHCFG_GLOBAL },
         { "uselogin", sUseLogin, SSHCFG_GLOBAL },
-@@ -1116,6 +1120,10 @@
+@@ -1134,6 +1138,10 @@
                 intptr = &options->tcp_keep_alive;
                 goto parse_flag;
  
@@ -507,7 +509,7 @@ Index: b/servconf.c
         case sEmptyPasswd:
                 intptr = &options->permit_empty_passwd;
                 goto parse_flag;
-@@ -1921,6 +1929,7 @@
+@@ -1980,6 +1988,7 @@
         dump_cfg_fmtint(sX11UseLocalhost, o->x11_use_localhost);
         dump_cfg_fmtint(sStrictModes, o->strict_modes);
         dump_cfg_fmtint(sTCPKeepAlive, o->tcp_keep_alive);
@@ -519,7 +521,7 @@ Index: b/servconf.h
 ===================================================================
 --- a/servconf.h
 +++ b/servconf.h
-@@ -113,6 +113,7 @@
+@@ -120,6 +120,7 @@
         int     challenge_response_authentication;
         int     zero_knowledge_password_authentication;
                                         /* If true, permit jpake auth */
@@ -554,7 +556,7 @@ Index: b/ssh-add.c
 ===================================================================
 --- a/ssh-add.c
 +++ b/ssh-add.c
-@@ -142,7 +142,7 @@
+@@ -167,7 +167,7 @@
  add_file(AuthenticationConnection *ac, const char *filename, int key_only)
  {
         Key *private, *cert;
@@ -563,7 +565,7 @@ Index: b/ssh-add.c
         char msg[1024], *certpath = NULL;
         int fd, perms_ok, ret = -1;
         Buffer keyblob;
-@@ -218,6 +218,14 @@
+@@ -243,6 +243,14 @@
         } else {
                 fprintf(stderr, "Could not add identity: %s\n", filename);
         }
@@ -582,7 +584,7 @@ Index: b/ssh-keygen.1
 ===================================================================
 --- a/ssh-keygen.1
 +++ b/ssh-keygen.1
-@@ -691,6 +691,7 @@
+@@ -810,6 +810,7 @@
  .Xr ssh 1 ,
  .Xr ssh-add 1 ,
  .Xr ssh-agent 1 ,
@@ -1233,7 +1235,7 @@ Index: b/ssh.1
 ===================================================================
 --- a/ssh.1
 +++ b/ssh.1
-@@ -1421,6 +1421,7 @@
+@@ -1429,6 +1429,7 @@
  .Xr ssh-agent 1 ,
  .Xr ssh-keygen 1 ,
  .Xr ssh-keyscan 1 ,
@@ -1281,7 +1283,7 @@ Index: b/ssh_config.5
 ===================================================================
 --- a/ssh_config.5
 +++ b/ssh_config.5
-@@ -1187,6 +1187,23 @@
+@@ -1201,6 +1201,23 @@
  .Dq any .
  The default is
  .Dq any:any .
@@ -1309,24 +1311,24 @@ Index: b/sshconnect2.c
 ===================================================================
 --- a/sshconnect2.c
 +++ b/sshconnect2.c
-@@ -1489,6 +1489,8 @@
+@@ -1491,6 +1491,8 @@
  
-        /* list of keys stored in the filesystem */
+        /* list of keys stored in the filesystem and PKCS#11 */
         for (i = 0; i < options.num_identity_files; i++) {
 +               if (options.identity_files[i] == NULL)
 +                       continue;
                 key = options.identity_keys[i];
                 if (key && key->type == KEY_RSA1)
                         continue;
-@@ -1582,7 +1584,7 @@
+@@ -1609,7 +1611,7 @@
                         debug("Offering %s public key: %s", key_type(id->key),
                             id->filename);
                         sent = send_pubkey_test(authctxt, id);
 -               } else if (id->key == NULL) {
 +               } else if (id->key == NULL && id->filename) {
                         debug("Trying private key: %s", id->filename);
-                        id->key = load_identity_file(id->filename);
-                        if (id->key != NULL) {
+                        id->key = load_identity_file(id->filename,
+                            id->userprovided);
 Index: b/sshd.8
 ===================================================================
 --- a/sshd.8
@@ -1343,7 +1345,7 @@ Index: b/sshd.c
 ===================================================================
 --- a/sshd.c
 +++ b/sshd.c
-@@ -1593,6 +1593,11 @@
+@@ -1631,6 +1631,11 @@
                         sensitive_data.host_keys[i] = NULL;
                         continue;
                 }
@@ -1359,7 +1361,7 @@ Index: b/sshd_config.5
 ===================================================================
 --- a/sshd_config.5
 +++ b/sshd_config.5
-@@ -803,6 +803,20 @@
+@@ -870,6 +870,20 @@
  Specifies whether password authentication is allowed.
  The default is
  .Dq yes .
diff --git a/debian/patches/ssh1-keepalive.patch b/debian/patches/ssh1-keepalive.patch
index b71ff9df9..87211e8a3 100644
--- a/debian/patches/ssh1-keepalive.patch
+++ b/debian/patches/ssh1-keepalive.patch
@@ -1,7 +1,7 @@
 Description: Partial server keep-alive implementation for SSH1
 Author: Colin Watson <cjwatson@debian.org>
 Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1712
-Last-Update: 2010-02-27
+Last-Update: 2013-05-07
 
 Index: b/clientloop.c
 ===================================================================
@@ -51,7 +51,7 @@ Index: b/ssh_config.5
 ===================================================================
 --- a/ssh_config.5
 +++ b/ssh_config.5
-@@ -1088,7 +1088,10 @@
+@@ -1102,7 +1102,10 @@
  .Cm ServerAliveCountMax
  is left at the default, if the server becomes unresponsive,
  ssh will disconnect after approximately 45 seconds.
diff --git a/debian/patches/user-group-modes.patch b/debian/patches/user-group-modes.patch
index 1368ccb3c..ddedbf79a 100644
--- a/debian/patches/user-group-modes.patch
+++ b/debian/patches/user-group-modes.patch
@@ -9,7 +9,7 @@ Description: Allow harmless group-writability
 Author: Colin Watson <cjwatson@debian.org>
 Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1060
 Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=314347
-Last-Update: 2010-02-27
+Last-Update: 2013-05-07
 
 Index: b/readconf.c
 ===================================================================
@@ -38,7 +38,7 @@ Index: b/ssh.1
 ===================================================================
 --- a/ssh.1
 +++ b/ssh.1
-@@ -1312,6 +1312,8 @@
+@@ -1320,6 +1320,8 @@
  .Xr ssh_config 5 .
  Because of the potential for abuse, this file must have strict permissions:
  read/write for the user, and not accessible by others.
@@ -51,7 +51,7 @@ Index: b/ssh_config.5
 ===================================================================
 --- a/ssh_config.5
 +++ b/ssh_config.5
-@@ -1342,6 +1342,8 @@
+@@ -1356,6 +1356,8 @@
  This file is used by the SSH client.
  Because of the potential for abuse, this file must have strict permissions:
  read/write for the user, and not accessible by others.
@@ -64,7 +64,7 @@ Index: b/auth.c
 ===================================================================
 --- a/auth.c
 +++ b/auth.c
-@@ -381,8 +381,7 @@
+@@ -386,8 +386,7 @@
                 user_hostfile = tilde_expand_filename(userfile, pw->pw_uid);
                 if (options.strict_modes &&
                     (stat(user_hostfile, &st) == 0) &&
@@ -74,21 +74,21 @@ Index: b/auth.c
                         logit("Authentication refused for %.100s: "
                             "bad owner or modes for %.200s",
                             pw->pw_name, user_hostfile);
-@@ -443,8 +442,7 @@
- 
-        /* check the open file to avoid races */
-        if (fstat(fileno(f), &st) < 0 ||
--           (st.st_uid != 0 && st.st_uid != uid) ||
--           (st.st_mode & 022) != 0) {
-+           !secure_permissions(&st, uid)) {
+@@ -449,8 +448,7 @@
+                snprintf(err, errlen, "%s is not a regular file", buf);
+                return -1;
+        }
+-       if ((!platform_sys_dir_uid(stp->st_uid) && stp->st_uid != uid) ||
+-           (stp->st_mode & 022) != 0) {
++       if (!secure_permissions(stp, uid)) {
                 snprintf(err, errlen, "bad ownership or modes for file %s",
                     buf);
                 return -1;
-@@ -459,8 +457,7 @@
+@@ -465,8 +463,7 @@
                 strlcpy(buf, cp, sizeof(buf));
  
                 if (stat(buf, &st) < 0 ||
--                   (st.st_uid != 0 && st.st_uid != uid) ||
+-                   (!platform_sys_dir_uid(st.st_uid) && st.st_uid != uid) ||
 -                   (st.st_mode & 022) != 0) {
 +                   !secure_permissions(&st, uid)) {
                         snprintf(err, errlen,
@@ -115,7 +115,7 @@ Index: b/misc.c
  int
 +secure_permissions(struct stat *st, uid_t uid)
 +{
-+       if (st->st_uid != 0 && st->st_uid != uid)
++       if (!platform_sys_dir_uid(st->st_uid) && st->st_uid != uid)
 +               return 0;
 +       if ((st->st_mode & 002) != 0)
 +               return 0;
diff --git a/defines.h b/defines.h
index 53f83a142..64515c2ff 100644
--- a/defines.h
+++ b/defines.h
@@ -25,7 +25,7 @@
 #ifndef _DEFINES_H
 #define _DEFINES_H
 
-/* $Id: defines.h,v 1.169 2012/02/15 04:13:06 tim Exp $ */
+/* $Id: defines.h,v 1.171 2013/03/07 09:06:13 dtucker Exp $ */
 
 
 /* Constants */
@@ -227,11 +227,7 @@ typedef uint16_t u_int16_t;
 typedef uint32_t u_int32_t;
 # define HAVE_U_INTXX_T 1
 # else
-#  if (SIZEOF_CHAR == 1)
 typedef unsigned char u_int8_t;
-#  else
-#   error "8 bit int type not found."
-#  endif
 #  if (SIZEOF_SHORT_INT == 2)
 typedef unsigned short int u_int16_t;
 #  else
@@ -283,6 +279,10 @@ typedef unsigned char u_char;
 # define HAVE_U_CHAR
 #endif /* HAVE_U_CHAR */
 
+#ifndef ULLONG_MAX
+# define ULLONG_MAX ((unsigned long long)-1)
+#endif
+
 #ifndef SIZE_T_MAX
 #define SIZE_T_MAX ULONG_MAX
 #endif /* SIZE_T_MAX */
diff --git a/includes.h b/includes.h
index b4c53d9b4..3e206c899 100644
--- a/includes.h
+++ b/includes.h
@@ -137,8 +137,10 @@
 # include <tmpdir.h>
 #endif
 
-#ifdef HAVE_LIBUTIL_H
-# include <libutil.h> /* Openpty on FreeBSD at least */
+#if defined(HAVE_BSD_LIBUTIL_H)
+# include <bsd/libutil.h>
+#elif defined(HAVE_LIBUTIL_H)
+# include <libutil.h>
 #endif
 
 #if defined(KRB5) && defined(USE_AFS)
diff --git a/kex.c b/kex.c
index 58349fc19..f9e7a9c09 100644
--- a/kex.c
+++ b/kex.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: kex.c,v 1.86 2010/09/22 05:01:29 djm Exp $ */
+/* $OpenBSD: kex.c,v 1.88 2013/01/08 18:49:04 markus Exp $ */
 /*
  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
  *
@@ -246,8 +246,18 @@ kex_input_kexinit(int type, u_int32_t seq, void *ctxt)
                 packet_get_char();
         for (i = 0; i < PROPOSAL_MAX; i++)
                 xfree(packet_get_string(NULL));
-        (void) packet_get_char();
-        (void) packet_get_int();
+        /*
+         * XXX RFC4253 sec 7: "each side MAY guess" - currently no supported
+         * KEX method has the server move first, but a server might be using
+         * a custom method or one that we otherwise don't support. We should
+         * be prepared to remember first_kex_follows here so we can eat a
+         * packet later.
+         * XXX2 - RFC4253 is kind of ambiguous on what first_kex_follows means
+         * for cases where the server *doesn't* go first. I guess we should
+         * ignore it when it is set for these cases, which is what we do now.
+         */
+        (void) packet_get_char();       /* first_kex_follows */
+        (void) packet_get_int();        /* reserved */
         packet_check_eom();
 
         kex_kexinit_finish(kex);
@@ -298,6 +308,7 @@ choose_enc(Enc *enc, char *client, char *server)
         enc->name = name;
         enc->enabled = 0;
         enc->iv = NULL;
+        enc->iv_len = cipher_ivlen(enc->cipher);
         enc->key = NULL;
         enc->key_len = cipher_keylen(enc->cipher);
         enc->block_size = cipher_blocksize(enc->cipher);
@@ -423,7 +434,7 @@ kex_choose_conf(Kex *kex)
         char **my, **peer;
         char **cprop, **sprop;
         int nenc, nmac, ncomp;
-        u_int mode, ctos, need;
+        u_int mode, ctos, need, authlen;
         int first_kex_follows, type;
 
         my   = kex_buf2prop(&kex->my, NULL);
@@ -456,13 +467,16 @@ kex_choose_conf(Kex *kex)
                 nenc  = ctos ? PROPOSAL_ENC_ALGS_CTOS  : PROPOSAL_ENC_ALGS_STOC;
                 nmac  = ctos ? PROPOSAL_MAC_ALGS_CTOS  : PROPOSAL_MAC_ALGS_STOC;
                 ncomp = ctos ? PROPOSAL_COMP_ALGS_CTOS : PROPOSAL_COMP_ALGS_STOC;
-                choose_enc (&newkeys->enc,  cprop[nenc],  sprop[nenc]);
-                choose_mac (&newkeys->mac,  cprop[nmac],  sprop[nmac]);
+                choose_enc(&newkeys->enc, cprop[nenc], sprop[nenc]);
+                /* ignore mac for authenticated encryption */
+                authlen = cipher_authlen(newkeys->enc.cipher);
+                if (authlen == 0)
+                        choose_mac(&newkeys->mac, cprop[nmac], sprop[nmac]);
                 choose_comp(&newkeys->comp, cprop[ncomp], sprop[ncomp]);
                 debug("kex: %s %s %s %s",
                     ctos ? "client->server" : "server->client",
                     newkeys->enc.name,
-                    newkeys->mac.name,
+                    authlen == 0 ? newkeys->mac.name : "<implicit>",
                     newkeys->comp.name);
         }
         choose_kex(kex, cprop[PROPOSAL_KEX_ALGS], sprop[PROPOSAL_KEX_ALGS]);
@@ -475,6 +489,8 @@ kex_choose_conf(Kex *kex)
                         need = newkeys->enc.key_len;
                 if (need < newkeys->enc.block_size)
                         need = newkeys->enc.block_size;
+                if (need < newkeys->enc.iv_len)
+                        need = newkeys->enc.iv_len;
                 if (need < newkeys->mac.key_len)
                         need = newkeys->mac.key_len;
         }
diff --git a/kex.h b/kex.h
index fa50b2ccb..8013ab8a4 100644
--- a/kex.h
+++ b/kex.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: kex.h,v 1.52 2010/09/22 05:01:29 djm Exp $ */
+/* $OpenBSD: kex.h,v 1.54 2013/01/08 18:49:04 markus Exp $ */
 
 /*
  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
@@ -92,6 +92,7 @@ struct Enc {
         Cipher  *cipher;
         int     enabled;
         u_int   key_len;
+        u_int   iv_len;
         u_int   block_size;
         u_char  *key;
         u_char  *iv;
@@ -103,6 +104,7 @@ struct Mac {
         u_char  *key;
         u_int   key_len;
         int     type;
+        int     etm;            /* Encrypt-then-MAC */
         const EVP_MD    *evp_md;
         HMAC_CTX        evp_ctx;
         struct umac_ctx *umac_ctx;
diff --git a/key.c b/key.c
index 2a16b25b9..fdfed5c56 100644
--- a/key.c
+++ b/key.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: key.c,v 1.99 2012/05/23 03:28:28 djm Exp $ */
+/* $OpenBSD: key.c,v 1.100 2013/01/17 23:00:01 djm Exp $ */
 /*
  * read_bignum():
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -55,6 +55,8 @@
 #include "misc.h"
 #include "ssh2.h"
 
+static int to_blob(const Key *, u_char **, u_int *, int);
+
 static struct KeyCert *
 cert_new(void)
 {
@@ -324,14 +326,15 @@ key_equal(const Key *a, const Key *b)
 }
 
 u_char*
-key_fingerprint_raw(Key *k, enum fp_type dgst_type, u_int *dgst_raw_length)
+key_fingerprint_raw(const Key *k, enum fp_type dgst_type,
+    u_int *dgst_raw_length)
 {
         const EVP_MD *md = NULL;
         EVP_MD_CTX ctx;
         u_char *blob = NULL;
         u_char *retval = NULL;
         u_int len = 0;
-        int nlen, elen, otype;
+        int nlen, elen;
 
         *dgst_raw_length = 0;
 
@@ -371,10 +374,7 @@ key_fingerprint_raw(Key *k, enum fp_type dgst_type, u_int *dgst_raw_length)
         case KEY_ECDSA_CERT:
         case KEY_RSA_CERT:
                 /* We want a fingerprint of the _key_ not of the cert */
-                otype = k->type;
-                k->type = key_type_plain(k->type);
-                key_to_blob(k, &blob, &len);
-                k->type = otype;
+                to_blob(k, &blob, &len, 1);
                 break;
         case KEY_UNSPEC:
                 return retval;
@@ -1591,18 +1591,19 @@ key_from_blob(const u_char *blob, u_int blen)
         return key;
 }
 
-int
-key_to_blob(const Key *key, u_char **blobp, u_int *lenp)
+static int
+to_blob(const Key *key, u_char **blobp, u_int *lenp, int force_plain)
 {
         Buffer b;
-        int len;
+        int len, type;
 
         if (key == NULL) {
                 error("key_to_blob: key == NULL");
                 return 0;
         }
         buffer_init(&b);
-        switch (key->type) {
+        type = force_plain ? key_type_plain(key->type) : key->type;
+        switch (type) {
         case KEY_DSA_CERT_V00:
         case KEY_RSA_CERT_V00:
         case KEY_DSA_CERT:
@@ -1613,7 +1614,8 @@ key_to_blob(const Key *key, u_char **blobp, u_int *lenp)
                     buffer_len(&key->cert->certblob));
                 break;
         case KEY_DSA:
-                buffer_put_cstring(&b, key_ssh_name(key));
+                buffer_put_cstring(&b,
+                    key_ssh_name_from_type_nid(type, key->ecdsa_nid));
                 buffer_put_bignum2(&b, key->dsa->p);
                 buffer_put_bignum2(&b, key->dsa->q);
                 buffer_put_bignum2(&b, key->dsa->g);
@@ -1621,14 +1623,16 @@ key_to_blob(const Key *key, u_char **blobp, u_int *lenp)
                 break;
 #ifdef OPENSSL_HAS_ECC
         case KEY_ECDSA:
-                buffer_put_cstring(&b, key_ssh_name(key));
+                buffer_put_cstring(&b,
+                    key_ssh_name_from_type_nid(type, key->ecdsa_nid));
                 buffer_put_cstring(&b, key_curve_nid_to_name(key->ecdsa_nid));
                 buffer_put_ecpoint(&b, EC_KEY_get0_group(key->ecdsa),
                     EC_KEY_get0_public_key(key->ecdsa));
                 break;
 #endif
         case KEY_RSA:
-                buffer_put_cstring(&b, key_ssh_name(key));
+                buffer_put_cstring(&b,
+                    key_ssh_name_from_type_nid(type, key->ecdsa_nid));
                 buffer_put_bignum2(&b, key->rsa->e);
                 buffer_put_bignum2(&b, key->rsa->n);
                 break;
@@ -1650,6 +1654,12 @@ key_to_blob(const Key *key, u_char **blobp, u_int *lenp)
 }
 
 int
+key_to_blob(const Key *key, u_char **blobp, u_int *lenp)
+{
+        return to_blob(key, blobp, lenp, 0);
+}
+
+int
 key_sign(
     const Key *key,
     u_char **sigp, u_int *lenp,
@@ -2028,7 +2038,7 @@ key_cert_check_authority(const Key *k, int want_host, int require_principal,
 }
 
 int
-key_cert_is_legacy(Key *k)
+key_cert_is_legacy(const Key *k)
 {
         switch (k->type) {
         case KEY_DSA_CERT_V00:
diff --git a/key.h b/key.h
index ca56b4271..4beaf202e 100644
--- a/key.h
+++ b/key.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: key.h,v 1.34 2012/05/23 03:28:28 djm Exp $ */
+/* $OpenBSD: key.h,v 1.35 2013/01/17 23:00:01 djm Exp $ */
 
 /*
  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
@@ -97,7 +97,7 @@ Key		*key_demote(const Key *);
 int              key_equal_public(const Key *, const Key *);
 int              key_equal(const Key *, const Key *);
 char            *key_fingerprint(Key *, enum fp_type, enum fp_rep);
-u_char          *key_fingerprint_raw(Key *, enum fp_type, u_int *);
+u_char          *key_fingerprint_raw(const Key *, enum fp_type, u_int *);
 const char      *key_type(const Key *);
 const char      *key_cert_type(const Key *);
 int              key_write(const Key *, FILE *);
@@ -115,7 +115,7 @@ int	 key_certify(Key *, Key *);
 void     key_cert_copy(const Key *, struct Key *);
 int      key_cert_check_authority(const Key *, int, int, const char *,
             const char **);
-int      key_cert_is_legacy(Key *);
+int      key_cert_is_legacy(const Key *);
 
 int              key_ecdsa_nid_from_name(const char *);
 int              key_curve_name_to_nid(const char *);
diff --git a/krl.c b/krl.c
new file mode 100644
index 000000000..5a6bd14aa
--- /dev/null
+++ b/krl.c
@@ -0,0 +1,1229 @@
+/*
+ * Copyright (c) 2012 Damien Miller <djm@mindrot.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $OpenBSD: krl.c,v 1.9 2013/01/27 10:06:12 djm Exp $ */
+
+#include "includes.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <openbsd-compat/sys-tree.h>
+#include <openbsd-compat/sys-queue.h>
+
+#include <errno.h>
+#include <fcntl.h>
+#include <limits.h>
+#include <string.h>
+#include <time.h>
+#include <unistd.h>
+
+#include "buffer.h"
+#include "key.h"
+#include "authfile.h"
+#include "misc.h"
+#include "log.h"
+#include "xmalloc.h"
+
+#include "krl.h"
+
+/* #define DEBUG_KRL */
+#ifdef DEBUG_KRL
+# define KRL_DBG(x) debug3 x
+#else
+# define KRL_DBG(x)
+#endif
+
+/*
+ * Trees of revoked serial numbers, key IDs and keys. This allows
+ * quick searching, querying and producing lists in canonical order.
+ */
+
+/* Tree of serial numbers. XXX make smarter: really need a real sparse bitmap */
+struct revoked_serial {
+        u_int64_t lo, hi;
+        RB_ENTRY(revoked_serial) tree_entry;
+};
+static int serial_cmp(struct revoked_serial *a, struct revoked_serial *b);
+RB_HEAD(revoked_serial_tree, revoked_serial);
+RB_GENERATE_STATIC(revoked_serial_tree, revoked_serial, tree_entry, serial_cmp);
+
+/* Tree of key IDs */
+struct revoked_key_id {
+        char *key_id;
+        RB_ENTRY(revoked_key_id) tree_entry;
+};
+static int key_id_cmp(struct revoked_key_id *a, struct revoked_key_id *b);
+RB_HEAD(revoked_key_id_tree, revoked_key_id);
+RB_GENERATE_STATIC(revoked_key_id_tree, revoked_key_id, tree_entry, key_id_cmp);
+
+/* Tree of blobs (used for keys and fingerprints) */
+struct revoked_blob {
+        u_char *blob;
+        u_int len;
+        RB_ENTRY(revoked_blob) tree_entry;
+};
+static int blob_cmp(struct revoked_blob *a, struct revoked_blob *b);
+RB_HEAD(revoked_blob_tree, revoked_blob);
+RB_GENERATE_STATIC(revoked_blob_tree, revoked_blob, tree_entry, blob_cmp);
+
+/* Tracks revoked certs for a single CA */
+struct revoked_certs {
+        Key *ca_key;
+        struct revoked_serial_tree revoked_serials;
+        struct revoked_key_id_tree revoked_key_ids;
+        TAILQ_ENTRY(revoked_certs) entry;
+};
+TAILQ_HEAD(revoked_certs_list, revoked_certs);
+
+struct ssh_krl {
+        u_int64_t krl_version;
+        u_int64_t generated_date;
+        u_int64_t flags;
+        char *comment;
+        struct revoked_blob_tree revoked_keys;
+        struct revoked_blob_tree revoked_sha1s;
+        struct revoked_certs_list revoked_certs;
+};
+
+/* Return equal if a and b overlap */
+static int
+serial_cmp(struct revoked_serial *a, struct revoked_serial *b)
+{
+        if (a->hi >= b->lo && a->lo <= b->hi)
+                return 0;
+        return a->lo < b->lo ? -1 : 1;
+}
+
+static int
+key_id_cmp(struct revoked_key_id *a, struct revoked_key_id *b)
+{
+        return strcmp(a->key_id, b->key_id);
+}
+
+static int
+blob_cmp(struct revoked_blob *a, struct revoked_blob *b)
+{
+        int r;
+
+        if (a->len != b->len) {
+                if ((r = memcmp(a->blob, b->blob, MIN(a->len, b->len))) != 0)
+                        return r;
+                return a->len > b->len ? 1 : -1;
+        } else
+                return memcmp(a->blob, b->blob, a->len);
+}
+
+struct ssh_krl *
+ssh_krl_init(void)
+{
+        struct ssh_krl *krl;
+
+        if ((krl = calloc(1, sizeof(*krl))) == NULL)
+                return NULL;
+        RB_INIT(&krl->revoked_keys);
+        RB_INIT(&krl->revoked_sha1s);
+        TAILQ_INIT(&krl->revoked_certs);
+        return krl;
+}
+
+static void
+revoked_certs_free(struct revoked_certs *rc)
+{
+        struct revoked_serial *rs, *trs;
+        struct revoked_key_id *rki, *trki;
+
+        RB_FOREACH_SAFE(rs, revoked_serial_tree, &rc->revoked_serials, trs) {
+                RB_REMOVE(revoked_serial_tree, &rc->revoked_serials, rs);
+                free(rs);
+        }
+        RB_FOREACH_SAFE(rki, revoked_key_id_tree, &rc->revoked_key_ids, trki) {
+                RB_REMOVE(revoked_key_id_tree, &rc->revoked_key_ids, rki);
+                free(rki->key_id);
+                free(rki);
+        }
+        if (rc->ca_key != NULL)
+                key_free(rc->ca_key);
+}
+
+void
+ssh_krl_free(struct ssh_krl *krl)
+{
+        struct revoked_blob *rb, *trb;
+        struct revoked_certs *rc, *trc;
+
+        if (krl == NULL)
+                return;
+
+        free(krl->comment);
+        RB_FOREACH_SAFE(rb, revoked_blob_tree, &krl->revoked_keys, trb) {
+                RB_REMOVE(revoked_blob_tree, &krl->revoked_keys, rb);
+                free(rb->blob);
+                free(rb);
+        }
+        RB_FOREACH_SAFE(rb, revoked_blob_tree, &krl->revoked_sha1s, trb) {
+                RB_REMOVE(revoked_blob_tree, &krl->revoked_sha1s, rb);
+                free(rb->blob);
+                free(rb);
+        }
+        TAILQ_FOREACH_SAFE(rc, &krl->revoked_certs, entry, trc) {
+                TAILQ_REMOVE(&krl->revoked_certs, rc, entry);
+                revoked_certs_free(rc);
+        }
+}
+
+void
+ssh_krl_set_version(struct ssh_krl *krl, u_int64_t version)
+{
+        krl->krl_version = version;
+}
+
+void
+ssh_krl_set_comment(struct ssh_krl *krl, const char *comment)
+{
+        free(krl->comment);
+        if ((krl->comment = strdup(comment)) == NULL)
+                fatal("%s: strdup", __func__);
+}
+
+/*
+ * Find the revoked_certs struct for a CA key. If allow_create is set then
+ * create a new one in the tree if one did not exist already.
+ */
+static int
+revoked_certs_for_ca_key(struct ssh_krl *krl, const Key *ca_key,
+    struct revoked_certs **rcp, int allow_create)
+{
+        struct revoked_certs *rc;
+
+        *rcp = NULL;
+        TAILQ_FOREACH(rc, &krl->revoked_certs, entry) {
+                if (key_equal(rc->ca_key, ca_key)) {
+                        *rcp = rc;
+                        return 0;
+                }
+        }
+        if (!allow_create)
+                return 0;
+        /* If this CA doesn't exist in the list then add it now */
+        if ((rc = calloc(1, sizeof(*rc))) == NULL)
+                return -1;
+        if ((rc->ca_key = key_from_private(ca_key)) == NULL) {
+                free(rc);
+                return -1;
+        }
+        RB_INIT(&rc->revoked_serials);
+        RB_INIT(&rc->revoked_key_ids);
+        TAILQ_INSERT_TAIL(&krl->revoked_certs, rc, entry);
+        debug3("%s: new CA %s", __func__, key_type(ca_key));
+        *rcp = rc;
+        return 0;
+}
+
+static int
+insert_serial_range(struct revoked_serial_tree *rt, u_int64_t lo, u_int64_t hi)
+{
+        struct revoked_serial rs, *ers, *crs, *irs;
+
+        KRL_DBG(("%s: insert %llu:%llu", __func__, lo, hi));
+        bzero(&rs, sizeof(rs));
+        rs.lo = lo;
+        rs.hi = hi;
+        ers = RB_NFIND(revoked_serial_tree, rt, &rs);
+        if (ers == NULL || serial_cmp(ers, &rs) != 0) {
+                /* No entry matches. Just insert */
+                if ((irs = malloc(sizeof(rs))) == NULL)
+                        return -1;
+                memcpy(irs, &rs, sizeof(*irs));
+                ers = RB_INSERT(revoked_serial_tree, rt, irs);
+                if (ers != NULL) {
+                        KRL_DBG(("%s: bad: ers != NULL", __func__));
+                        /* Shouldn't happen */
+                        free(irs);
+                        return -1;
+                }
+                ers = irs;
+        } else {
+                KRL_DBG(("%s: overlap found %llu:%llu", __func__,
+                    ers->lo, ers->hi));
+                /*
+                 * The inserted entry overlaps an existing one. Grow the
+                 * existing entry.
+                 */
+                if (ers->lo > lo)
+                        ers->lo = lo;
+                if (ers->hi < hi)
+                        ers->hi = hi;
+        }
+        /*
+         * The inserted or revised range might overlap or abut adjacent ones;
+         * coalesce as necessary.
+         */
+
+        /* Check predecessors */
+        while ((crs = RB_PREV(revoked_serial_tree, rt, ers)) != NULL) {
+                KRL_DBG(("%s: pred %llu:%llu", __func__, crs->lo, crs->hi));
+                if (ers->lo != 0 && crs->hi < ers->lo - 1)
+                        break;
+                /* This entry overlaps. */
+                if (crs->lo < ers->lo) {
+                        ers->lo = crs->lo;
+                        KRL_DBG(("%s: pred extend %llu:%llu", __func__,
+                            ers->lo, ers->hi));
+                }
+                RB_REMOVE(revoked_serial_tree, rt, crs);
+                free(crs);
+        }
+        /* Check successors */
+        while ((crs = RB_NEXT(revoked_serial_tree, rt, ers)) != NULL) {
+                KRL_DBG(("%s: succ %llu:%llu", __func__, crs->lo, crs->hi));
+                if (ers->hi != (u_int64_t)-1 && crs->lo > ers->hi + 1)
+                        break;
+                /* This entry overlaps. */
+                if (crs->hi > ers->hi) {
+                        ers->hi = crs->hi;
+                        KRL_DBG(("%s: succ extend %llu:%llu", __func__,
+                            ers->lo, ers->hi));
+                }
+                RB_REMOVE(revoked_serial_tree, rt, crs);
+                free(crs);
+        }
+        KRL_DBG(("%s: done, final %llu:%llu", __func__, ers->lo, ers->hi));
+        return 0;
+}
+
+int
+ssh_krl_revoke_cert_by_serial(struct ssh_krl *krl, const Key *ca_key,
+    u_int64_t serial)
+{
+        return ssh_krl_revoke_cert_by_serial_range(krl, ca_key, serial, serial);
+}
+
+int
+ssh_krl_revoke_cert_by_serial_range(struct ssh_krl *krl, const Key *ca_key,
+    u_int64_t lo, u_int64_t hi)
+{
+        struct revoked_certs *rc;
+
+        if (lo > hi || lo == 0)
+                return -1;
+        if (revoked_certs_for_ca_key(krl, ca_key, &rc, 1) != 0)
+                return -1;
+        return insert_serial_range(&rc->revoked_serials, lo, hi);
+}
+
+int
+ssh_krl_revoke_cert_by_key_id(struct ssh_krl *krl, const Key *ca_key,
+    const char *key_id)
+{
+        struct revoked_key_id *rki, *erki;
+        struct revoked_certs *rc;
+
+        if (revoked_certs_for_ca_key(krl, ca_key, &rc, 1) != 0)
+                return -1;
+
+        debug3("%s: revoke %s", __func__, key_id);
+        if ((rki = calloc(1, sizeof(*rki))) == NULL ||
+            (rki->key_id = strdup(key_id)) == NULL) {
+                free(rki);
+                fatal("%s: strdup", __func__);
+        }
+        erki = RB_INSERT(revoked_key_id_tree, &rc->revoked_key_ids, rki);
+        if (erki != NULL) {
+                free(rki->key_id);
+                free(rki);
+        }
+        return 0;
+}
+
+/* Convert "key" to a public key blob without any certificate information */
+static int
+plain_key_blob(const Key *key, u_char **blob, u_int *blen)
+{
+        Key *kcopy;
+        int r;
+
+        if ((kcopy = key_from_private(key)) == NULL)
+                return -1;
+        if (key_is_cert(kcopy)) {
+                if (key_drop_cert(kcopy) != 0) {
+                        error("%s: key_drop_cert", __func__);
+                        key_free(kcopy);
+                        return -1;
+                }
+        }
+        r = key_to_blob(kcopy, blob, blen);
+        free(kcopy);
+        return r == 0 ? -1 : 0;
+}
+
+/* Revoke a key blob. Ownership of blob is transferred to the tree */
+static int
+revoke_blob(struct revoked_blob_tree *rbt, u_char *blob, u_int len)
+{
+        struct revoked_blob *rb, *erb;
+
+        if ((rb = calloc(1, sizeof(*rb))) == NULL)
+                return -1;
+        rb->blob = blob;
+        rb->len = len;
+        erb = RB_INSERT(revoked_blob_tree, rbt, rb);
+        if (erb != NULL) {
+                free(rb->blob);
+                free(rb);
+        }
+        return 0;
+}
+
+int
+ssh_krl_revoke_key_explicit(struct ssh_krl *krl, const Key *key)
+{
+        u_char *blob;
+        u_int len;
+
+        debug3("%s: revoke type %s", __func__, key_type(key));
+        if (plain_key_blob(key, &blob, &len) != 0)
+                return -1;
+        return revoke_blob(&krl->revoked_keys, blob, len);
+}
+
+int
+ssh_krl_revoke_key_sha1(struct ssh_krl *krl, const Key *key)
+{
+        u_char *blob;
+        u_int len;
+
+        debug3("%s: revoke type %s by sha1", __func__, key_type(key));
+        if ((blob = key_fingerprint_raw(key, SSH_FP_SHA1, &len)) == NULL)
+                return -1;
+        return revoke_blob(&krl->revoked_sha1s, blob, len);
+}
+
+int
+ssh_krl_revoke_key(struct ssh_krl *krl, const Key *key)
+{
+        if (!key_is_cert(key))
+                return ssh_krl_revoke_key_sha1(krl, key);
+
+        if (key_cert_is_legacy(key) || key->cert->serial == 0) {
+                return ssh_krl_revoke_cert_by_key_id(krl,
+                    key->cert->signature_key,
+                    key->cert->key_id);
+        } else {
+                return ssh_krl_revoke_cert_by_serial(krl,
+                    key->cert->signature_key,
+                    key->cert->serial);
+        }
+}
+
+/*
+ * Select a copact next section type to emit in a KRL based on the
+ * current section type, the run length of contiguous revoked serial
+ * numbers and the gaps from the last and to the next revoked serial.
+ * Applies a mostly-accurate bit cost model to select the section type
+ * that will minimise the size of the resultant KRL.
+ */
+static int
+choose_next_state(int current_state, u_int64_t contig, int final,
+    u_int64_t last_gap, u_int64_t next_gap, int *force_new_section)
+{
+        int new_state;
+        u_int64_t cost, cost_list, cost_range, cost_bitmap, cost_bitmap_restart;
+
+        /*
+         * Avoid unsigned overflows.
+         * The limits are high enough to avoid confusing the calculations.
+         */
+        contig = MIN(contig, 1ULL<<31);
+        last_gap = MIN(last_gap, 1ULL<<31);
+        next_gap = MIN(next_gap, 1ULL<<31);
+
+        /*
+         * Calculate the cost to switch from the current state to candidates.
+         * NB. range sections only ever contain a single range, so their
+         * switching cost is independent of the current_state.
+         */
+        cost_list = cost_bitmap = cost_bitmap_restart = 0;
+        cost_range = 8;
+        switch (current_state) {
+        case KRL_SECTION_CERT_SERIAL_LIST:
+                cost_bitmap_restart = cost_bitmap = 8 + 64;
+                break;
+        case KRL_SECTION_CERT_SERIAL_BITMAP:
+                cost_list = 8;
+                cost_bitmap_restart = 8 + 64;
+                break;
+        case KRL_SECTION_CERT_SERIAL_RANGE:
+        case 0:
+                cost_bitmap_restart = cost_bitmap = 8 + 64;
+                cost_list = 8;
+        }
+
+        /* Estimate base cost in bits of each section type */
+        cost_list += 64 * contig + (final ? 0 : 8+64);
+        cost_range += (2 * 64) + (final ? 0 : 8+64);
+        cost_bitmap += last_gap + contig + (final ? 0 : MIN(next_gap, 8+64));
+        cost_bitmap_restart += contig + (final ? 0 : MIN(next_gap, 8+64));
+
+        /* Convert to byte costs for actual comparison */
+        cost_list = (cost_list + 7) / 8;
+        cost_bitmap = (cost_bitmap + 7) / 8;
+        cost_bitmap_restart = (cost_bitmap_restart + 7) / 8;
+        cost_range = (cost_range + 7) / 8;
+
+        /* Now pick the best choice */
+        *force_new_section = 0;
+        new_state = KRL_SECTION_CERT_SERIAL_BITMAP;
+        cost = cost_bitmap;
+        if (cost_range < cost) {
+                new_state = KRL_SECTION_CERT_SERIAL_RANGE;
+                cost = cost_range;
+        }
+        if (cost_list < cost) {
+                new_state = KRL_SECTION_CERT_SERIAL_LIST;
+                cost = cost_list;
+        }
+        if (cost_bitmap_restart < cost) {
+                new_state = KRL_SECTION_CERT_SERIAL_BITMAP;
+                *force_new_section = 1;
+                cost = cost_bitmap_restart;
+        }
+        debug3("%s: contig %llu last_gap %llu next_gap %llu final %d, costs:"
+            "list %llu range %llu bitmap %llu new bitmap %llu, "
+            "selected 0x%02x%s", __func__, contig, last_gap, next_gap, final,
+            cost_list, cost_range, cost_bitmap, cost_bitmap_restart, new_state,
+            *force_new_section ? " restart" : "");
+        return new_state;
+}
+
+/* Generate a KRL_SECTION_CERTIFICATES KRL section */
+static int
+revoked_certs_generate(struct revoked_certs *rc, Buffer *buf)
+{
+        int final, force_new_sect, r = -1;
+        u_int64_t i, contig, gap, last = 0, bitmap_start = 0;
+        struct revoked_serial *rs, *nrs;
+        struct revoked_key_id *rki;
+        int next_state, state = 0;
+        Buffer sect;
+        u_char *kblob = NULL;
+        u_int klen;
+        BIGNUM *bitmap = NULL;
+
+        /* Prepare CA scope key blob if we have one supplied */
+        if (key_to_blob(rc->ca_key, &kblob, &klen) == 0)
+                return -1;
+
+        buffer_init(&sect);
+
+        /* Store the header */
+        buffer_put_string(buf, kblob, klen);
+        buffer_put_string(buf, NULL, 0); /* Reserved */
+
+        free(kblob);
+
+        /* Store the revoked serials.  */
+        for (rs = RB_MIN(revoked_serial_tree, &rc->revoked_serials);
+             rs != NULL;
+             rs = RB_NEXT(revoked_serial_tree, &rc->revoked_serials, rs)) {
+                debug3("%s: serial %llu:%llu state 0x%02x", __func__,
+                    rs->lo, rs->hi, state);
+
+                /* Check contiguous length and gap to next section (if any) */
+                nrs = RB_NEXT(revoked_serial_tree, &rc->revoked_serials, rs);
+                final = nrs == NULL;
+                gap = nrs == NULL ? 0 : nrs->lo - rs->hi;
+                contig = 1 + (rs->hi - rs->lo);
+
+                /* Choose next state based on these */
+                next_state = choose_next_state(state, contig, final,
+                    state == 0 ? 0 : rs->lo - last, gap, &force_new_sect);
+
+                /*
+                 * If the current section is a range section or has a different
+                 * type to the next section, then finish it off now.
+                 */
+                if (state != 0 && (force_new_sect || next_state != state ||
+                    state == KRL_SECTION_CERT_SERIAL_RANGE)) {
+                        debug3("%s: finish state 0x%02x", __func__, state);
+                        switch (state) {
+                        case KRL_SECTION_CERT_SERIAL_LIST:
+                        case KRL_SECTION_CERT_SERIAL_RANGE:
+                                break;
+                        case KRL_SECTION_CERT_SERIAL_BITMAP:
+                                buffer_put_bignum2(&sect, bitmap);
+                                BN_free(bitmap);
+                                bitmap = NULL;
+                                break;
+                        }
+                        buffer_put_char(buf, state);
+                        buffer_put_string(buf,
+                            buffer_ptr(&sect), buffer_len(&sect));
+                }
+
+                /* If we are starting a new section then prepare it now */
+                if (next_state != state || force_new_sect) {
+                        debug3("%s: start state 0x%02x", __func__, next_state);
+                        state = next_state;
+                        buffer_clear(&sect);
+                        switch (state) {
+                        case KRL_SECTION_CERT_SERIAL_LIST:
+                        case KRL_SECTION_CERT_SERIAL_RANGE:
+                                break;
+                        case KRL_SECTION_CERT_SERIAL_BITMAP:
+                                if ((bitmap = BN_new()) == NULL)
+                                        goto out;
+                                bitmap_start = rs->lo;
+                                buffer_put_int64(&sect, bitmap_start);
+                                break;
+                        }
+                }
+
+                /* Perform section-specific processing */
+                switch (state) {
+                case KRL_SECTION_CERT_SERIAL_LIST:
+                        for (i = 0; i < contig; i++)
+                                buffer_put_int64(&sect, rs->lo + i);
+                        break;
+                case KRL_SECTION_CERT_SERIAL_RANGE:
+                        buffer_put_int64(&sect, rs->lo);
+                        buffer_put_int64(&sect, rs->hi);
+                        break;
+                case KRL_SECTION_CERT_SERIAL_BITMAP:
+                        if (rs->lo - bitmap_start > INT_MAX) {
+                                error("%s: insane bitmap gap", __func__);
+                                goto out;
+                        }
+                        for (i = 0; i < contig; i++) {
+                                if (BN_set_bit(bitmap,
+                                    rs->lo + i - bitmap_start) != 1)
+                                        goto out;
+                        }
+                        break;
+                }
+                last = rs->hi;
+        }
+        /* Flush the remaining section, if any */
+        if (state != 0) {
+                debug3("%s: serial final flush for state 0x%02x",
+                    __func__, state);
+                switch (state) {
+                case KRL_SECTION_CERT_SERIAL_LIST:
+                case KRL_SECTION_CERT_SERIAL_RANGE:
+                        break;
+                case KRL_SECTION_CERT_SERIAL_BITMAP:
+                        buffer_put_bignum2(&sect, bitmap);
+                        BN_free(bitmap);
+                        bitmap = NULL;
+                        break;
+                }
+                buffer_put_char(buf, state);
+                buffer_put_string(buf,
+                    buffer_ptr(&sect), buffer_len(&sect));
+        }
+        debug3("%s: serial done ", __func__);
+
+        /* Now output a section for any revocations by key ID */
+        buffer_clear(&sect);
+        RB_FOREACH(rki, revoked_key_id_tree, &rc->revoked_key_ids) {
+                debug3("%s: key ID %s", __func__, rki->key_id);
+                buffer_put_cstring(&sect, rki->key_id);
+        }
+        if (buffer_len(&sect) != 0) {
+                buffer_put_char(buf, KRL_SECTION_CERT_KEY_ID);
+                buffer_put_string(buf, buffer_ptr(&sect),
+                    buffer_len(&sect));
+        }
+        r = 0;
+ out:
+        if (bitmap != NULL)
+                BN_free(bitmap);
+        buffer_free(&sect);
+        return r;
+}
+
+int
+ssh_krl_to_blob(struct ssh_krl *krl, Buffer *buf, const Key **sign_keys,
+    u_int nsign_keys)
+{
+        int r = -1;
+        struct revoked_certs *rc;
+        struct revoked_blob *rb;
+        Buffer sect;
+        u_char *kblob = NULL, *sblob = NULL;
+        u_int klen, slen, i;
+
+        if (krl->generated_date == 0)
+                krl->generated_date = time(NULL);
+
+        buffer_init(&sect);
+
+        /* Store the header */
+        buffer_append(buf, KRL_MAGIC, sizeof(KRL_MAGIC) - 1);
+        buffer_put_int(buf, KRL_FORMAT_VERSION);
+        buffer_put_int64(buf, krl->krl_version);
+        buffer_put_int64(buf, krl->generated_date);
+        buffer_put_int64(buf, krl->flags);
+        buffer_put_string(buf, NULL, 0);
+        buffer_put_cstring(buf, krl->comment ? krl->comment : "");
+
+        /* Store sections for revoked certificates */
+        TAILQ_FOREACH(rc, &krl->revoked_certs, entry) {
+                if (revoked_certs_generate(rc, &sect) != 0)
+                        goto out;
+                buffer_put_char(buf, KRL_SECTION_CERTIFICATES);
+                buffer_put_string(buf, buffer_ptr(&sect),
+                    buffer_len(&sect));
+        }
+
+        /* Finally, output sections for revocations by public key/hash */
+        buffer_clear(&sect);
+        RB_FOREACH(rb, revoked_blob_tree, &krl->revoked_keys) {
+                debug3("%s: key len %u ", __func__, rb->len);
+                buffer_put_string(&sect, rb->blob, rb->len);
+        }
+        if (buffer_len(&sect) != 0) {
+                buffer_put_char(buf, KRL_SECTION_EXPLICIT_KEY);
+                buffer_put_string(buf, buffer_ptr(&sect),
+                    buffer_len(&sect));
+        }
+        buffer_clear(&sect);
+        RB_FOREACH(rb, revoked_blob_tree, &krl->revoked_sha1s) {
+                debug3("%s: hash len %u ", __func__, rb->len);
+                buffer_put_string(&sect, rb->blob, rb->len);
+        }
+        if (buffer_len(&sect) != 0) {
+                buffer_put_char(buf, KRL_SECTION_FINGERPRINT_SHA1);
+                buffer_put_string(buf, buffer_ptr(&sect),
+                    buffer_len(&sect));
+        }
+
+        for (i = 0; i < nsign_keys; i++) {
+                if (key_to_blob(sign_keys[i], &kblob, &klen) == 0)
+                        goto out;
+
+                debug3("%s: signature key len %u", __func__, klen);
+                buffer_put_char(buf, KRL_SECTION_SIGNATURE);
+                buffer_put_string(buf, kblob, klen);
+
+                if (key_sign(sign_keys[i], &sblob, &slen,
+                    buffer_ptr(buf), buffer_len(buf)) == -1)
+                        goto out;
+                debug3("%s: signature sig len %u", __func__, slen);
+                buffer_put_string(buf, sblob, slen);
+        }
+
+        r = 0;
+ out:
+        free(kblob);
+        free(sblob);
+        buffer_free(&sect);
+        return r;
+}
+
+static void
+format_timestamp(u_int64_t timestamp, char *ts, size_t nts)
+{
+        time_t t;
+        struct tm *tm;
+
+        t = timestamp;
+        tm = localtime(&t);
+        *ts = '\0';
+        strftime(ts, nts, "%Y%m%dT%H%M%S", tm);
+}
+
+static int
+parse_revoked_certs(Buffer *buf, struct ssh_krl *krl)
+{
+        int ret = -1, nbits;
+        u_char type, *blob;
+        u_int blen;
+        Buffer subsect;
+        u_int64_t serial, serial_lo, serial_hi;
+        BIGNUM *bitmap = NULL;
+        char *key_id = NULL;
+        Key *ca_key = NULL;
+
+        buffer_init(&subsect);
+
+        if ((blob = buffer_get_string_ptr_ret(buf, &blen)) == NULL ||
+            buffer_get_string_ptr_ret(buf, NULL) == NULL) { /* reserved */
+                error("%s: buffer error", __func__);
+                goto out;
+        }
+        if ((ca_key = key_from_blob(blob, blen)) == NULL)
+                goto out;
+
+        while (buffer_len(buf) > 0) {
+                if (buffer_get_char_ret(&type, buf) != 0 ||
+                    (blob = buffer_get_string_ptr_ret(buf, &blen)) == NULL) {
+                        error("%s: buffer error", __func__);
+                        goto out;
+                }
+                buffer_clear(&subsect);
+                buffer_append(&subsect, blob, blen);
+                debug3("%s: subsection type 0x%02x", __func__, type);
+                /* buffer_dump(&subsect); */
+
+                switch (type) {
+                case KRL_SECTION_CERT_SERIAL_LIST:
+                        while (buffer_len(&subsect) > 0) {
+                                if (buffer_get_int64_ret(&serial,
+                                    &subsect) != 0) {
+                                        error("%s: buffer error", __func__);
+                                        goto out;
+                                }
+                                if (ssh_krl_revoke_cert_by_serial(krl, ca_key,
+                                    serial) != 0) {
+                                        error("%s: update failed", __func__);
+                                        goto out;
+                                }
+                        }
+                        break;
+                case KRL_SECTION_CERT_SERIAL_RANGE:
+                        if (buffer_get_int64_ret(&serial_lo, &subsect) != 0 ||
+                            buffer_get_int64_ret(&serial_hi, &subsect) != 0) {
+                                error("%s: buffer error", __func__);
+                                goto out;
+                        }
+                        if (ssh_krl_revoke_cert_by_serial_range(krl, ca_key,
+                            serial_lo, serial_hi) != 0) {
+                                error("%s: update failed", __func__);
+                                goto out;
+                        }
+                        break;
+                case KRL_SECTION_CERT_SERIAL_BITMAP:
+                        if ((bitmap = BN_new()) == NULL) {
+                                error("%s: BN_new", __func__);
+                                goto out;
+                        }
+                        if (buffer_get_int64_ret(&serial_lo, &subsect) != 0 ||
+                            buffer_get_bignum2_ret(&subsect, bitmap) != 0) {
+                                error("%s: buffer error", __func__);
+                                goto out;
+                        }
+                        if ((nbits = BN_num_bits(bitmap)) < 0) {
+                                error("%s: bitmap bits < 0", __func__);
+                                goto out;
+                        }
+                        for (serial = 0; serial < (u_int)nbits; serial++) {
+                                if (serial > 0 && serial_lo + serial == 0) {
+                                        error("%s: bitmap wraps u64", __func__);
+                                        goto out;
+                                }
+                                if (!BN_is_bit_set(bitmap, serial))
+                                        continue;
+                                if (ssh_krl_revoke_cert_by_serial(krl, ca_key,
+                                    serial_lo + serial) != 0) {
+                                        error("%s: update failed", __func__);
+                                        goto out;
+                                }
+                        }
+                        BN_free(bitmap);
+                        bitmap = NULL;
+                        break;
+                case KRL_SECTION_CERT_KEY_ID:
+                        while (buffer_len(&subsect) > 0) {
+                                if ((key_id = buffer_get_cstring_ret(&subsect,
+                                    NULL)) == NULL) {
+                                        error("%s: buffer error", __func__);
+                                        goto out;
+                                }
+                                if (ssh_krl_revoke_cert_by_key_id(krl, ca_key,
+                                    key_id) != 0) {
+                                        error("%s: update failed", __func__);
+                                        goto out;
+                                }
+                                free(key_id);
+                                key_id = NULL;
+                        }
+                        break;
+                default:
+                        error("Unsupported KRL certificate section %u", type);
+                        goto out;
+                }
+                if (buffer_len(&subsect) > 0) {
+                        error("KRL certificate section contains unparsed data");
+                        goto out;
+                }
+        }
+
+        ret = 0;
+ out:
+        if (ca_key != NULL)
+                key_free(ca_key);
+        if (bitmap != NULL)
+                BN_free(bitmap);
+        free(key_id);
+        buffer_free(&subsect);
+        return ret;
+}
+
+
+/* Attempt to parse a KRL, checking its signature (if any) with sign_ca_keys. */
+int
+ssh_krl_from_blob(Buffer *buf, struct ssh_krl **krlp,
+    const Key **sign_ca_keys, u_int nsign_ca_keys)
+{
+        Buffer copy, sect;
+        struct ssh_krl *krl;
+        char timestamp[64];
+        int ret = -1, r, sig_seen;
+        Key *key = NULL, **ca_used = NULL;
+        u_char type, *blob;
+        u_int i, j, sig_off, sects_off, blen, format_version, nca_used = 0;
+
+        *krlp = NULL;
+        if (buffer_len(buf) < sizeof(KRL_MAGIC) - 1 ||
+            memcmp(buffer_ptr(buf), KRL_MAGIC, sizeof(KRL_MAGIC) - 1) != 0) {
+                debug3("%s: not a KRL", __func__);
+                /*
+                 * Return success but a NULL *krlp here to signal that the
+                 * file might be a simple list of keys.
+                 */
+                return 0;
+        }
+
+        /* Take a copy of the KRL buffer so we can verify its signature later */
+        buffer_init(&copy);
+        buffer_append(&copy, buffer_ptr(buf), buffer_len(buf));
+
+        buffer_init(&sect);
+        buffer_consume(&copy, sizeof(KRL_MAGIC) - 1);
+
+        if ((krl = ssh_krl_init()) == NULL) {
+                error("%s: alloc failed", __func__);
+                goto out;
+        }
+
+        if (buffer_get_int_ret(&format_version, &copy) != 0) {
+                error("%s: KRL truncated", __func__);
+                goto out;
+        }
+        if (format_version != KRL_FORMAT_VERSION) {
+                error("%s: KRL unsupported format version %u",
+                    __func__, format_version);
+                goto out;
+        }
+        if (buffer_get_int64_ret(&krl->krl_version, &copy) != 0 ||
+            buffer_get_int64_ret(&krl->generated_date, &copy) != 0 ||
+            buffer_get_int64_ret(&krl->flags, &copy) != 0 ||
+            buffer_get_string_ptr_ret(&copy, NULL) == NULL || /* reserved */
+            (krl->comment = buffer_get_cstring_ret(&copy, NULL)) == NULL) {
+                error("%s: buffer error", __func__);
+                goto out;
+        }
+
+        format_timestamp(krl->generated_date, timestamp, sizeof(timestamp));
+        debug("KRL version %llu generated at %s%s%s", krl->krl_version,
+            timestamp, *krl->comment ? ": " : "", krl->comment);
+
+        /*
+         * 1st pass: verify signatures, if any. This is done to avoid
+         * detailed parsing of data whose provenance is unverified.
+         */
+        sig_seen = 0;
+        sects_off = buffer_len(buf) - buffer_len(&copy);
+        while (buffer_len(&copy) > 0) {
+                if (buffer_get_char_ret(&type, &copy) != 0 ||
+                    (blob = buffer_get_string_ptr_ret(&copy, &blen)) == NULL) {
+                        error("%s: buffer error", __func__);
+                        goto out;
+                }
+                debug3("%s: first pass, section 0x%02x", __func__, type);
+                if (type != KRL_SECTION_SIGNATURE) {
+                        if (sig_seen) {
+                                error("KRL contains non-signature section "
+                                    "after signature");
+                                goto out;
+                        }
+                        /* Not interested for now. */
+                        continue;
+                }
+                sig_seen = 1;
+                /* First string component is the signing key */
+                if ((key = key_from_blob(blob, blen)) == NULL) {
+                        error("%s: invalid signature key", __func__);
+                        goto out;
+                }
+                sig_off = buffer_len(buf) - buffer_len(&copy);
+                /* Second string component is the signature itself */
+                if ((blob = buffer_get_string_ptr_ret(&copy, &blen)) == NULL) {
+                        error("%s: buffer error", __func__);
+                        goto out;
+                }
+                /* Check signature over entire KRL up to this point */
+                if (key_verify(key, blob, blen,
+                    buffer_ptr(buf), buffer_len(buf) - sig_off) == -1) {
+                        error("bad signaure on KRL");
+                        goto out;
+                }
+                /* Check if this key has already signed this KRL */
+                for (i = 0; i < nca_used; i++) {
+                        if (key_equal(ca_used[i], key)) {
+                                error("KRL signed more than once with "
+                                    "the same key");
+                                goto out;
+                        }
+                }
+                /* Record keys used to sign the KRL */
+                ca_used = xrealloc(ca_used, nca_used + 1, sizeof(*ca_used));
+                ca_used[nca_used++] = key;
+                key = NULL;
+                break;
+        }
+
+        /*
+         * 2nd pass: parse and load the KRL, skipping the header to the point
+         * where the section start.
+         */
+        buffer_append(&copy, (u_char*)buffer_ptr(buf) + sects_off,
+            buffer_len(buf) - sects_off);
+        while (buffer_len(&copy) > 0) {
+                if (buffer_get_char_ret(&type, &copy) != 0 ||
+                    (blob = buffer_get_string_ptr_ret(&copy, &blen)) == NULL) {
+                        error("%s: buffer error", __func__);
+                        goto out;
+                }
+                debug3("%s: second pass, section 0x%02x", __func__, type);
+                buffer_clear(&sect);
+                buffer_append(&sect, blob, blen);
+
+                switch (type) {
+                case KRL_SECTION_CERTIFICATES:
+                        if ((r = parse_revoked_certs(&sect, krl)) != 0)
+                                goto out;
+                        break;
+                case KRL_SECTION_EXPLICIT_KEY:
+                case KRL_SECTION_FINGERPRINT_SHA1:
+                        while (buffer_len(&sect) > 0) {
+                                if ((blob = buffer_get_string_ret(&sect,
+                                    &blen)) == NULL) {
+                                        error("%s: buffer error", __func__);
+                                        goto out;
+                                }
+                                if (type == KRL_SECTION_FINGERPRINT_SHA1 &&
+                                    blen != 20) {
+                                        error("%s: bad SHA1 length", __func__);
+                                        goto out;
+                                }
+                                if (revoke_blob(
+                                    type == KRL_SECTION_EXPLICIT_KEY ?
+                                    &krl->revoked_keys : &krl->revoked_sha1s,
+                                    blob, blen) != 0)
+                                        goto out; /* revoke_blob frees blob */
+                        }
+                        break;
+                case KRL_SECTION_SIGNATURE:
+                        /* Handled above, but still need to stay in synch */
+                        buffer_clear(&sect);
+                        if ((blob = buffer_get_string_ptr_ret(&copy,
+                            &blen)) == NULL) {
+                                error("%s: buffer error", __func__);
+                                goto out;
+                        }
+                        break;
+                default:
+                        error("Unsupported KRL section %u", type);
+                        goto out;
+                }
+                if (buffer_len(&sect) > 0) {
+                        error("KRL section contains unparsed data");
+                        goto out;
+                }
+        }
+
+        /* Check that the key(s) used to sign the KRL weren't revoked */
+        sig_seen = 0;
+        for (i = 0; i < nca_used; i++) {
+                if (ssh_krl_check_key(krl, ca_used[i]) == 0)
+                        sig_seen = 1;
+                else {
+                        key_free(ca_used[i]);
+                        ca_used[i] = NULL;
+                }
+        }
+        if (nca_used && !sig_seen) {
+                error("All keys used to sign KRL were revoked");
+                goto out;
+        }
+
+        /* If we have CA keys, then verify that one was used to sign the KRL */
+        if (sig_seen && nsign_ca_keys != 0) {
+                sig_seen = 0;
+                for (i = 0; !sig_seen && i < nsign_ca_keys; i++) {
+                        for (j = 0; j < nca_used; j++) {
+                                if (ca_used[j] == NULL)
+                                        continue;
+                                if (key_equal(ca_used[j], sign_ca_keys[i])) {
+                                        sig_seen = 1;
+                                        break;
+                                }
+                        }
+                }
+                if (!sig_seen) {
+                        error("KRL not signed with any trusted key");
+                        goto out;
+                }
+        }
+
+        *krlp = krl;
+        ret = 0;
+ out:
+        if (ret != 0)
+                ssh_krl_free(krl);
+        for (i = 0; i < nca_used; i++) {
+                if (ca_used[i] != NULL)
+                        key_free(ca_used[i]);
+        }
+        free(ca_used);
+        if (key != NULL)
+                key_free(key);
+        buffer_free(&copy);
+        buffer_free(&sect);
+        return ret;
+}
+
+/* Checks whether a given key/cert is revoked. Does not check its CA */
+static int
+is_key_revoked(struct ssh_krl *krl, const Key *key)
+{
+        struct revoked_blob rb, *erb;
+        struct revoked_serial rs, *ers;
+        struct revoked_key_id rki, *erki;
+        struct revoked_certs *rc;
+
+        /* Check explicitly revoked hashes first */
+        bzero(&rb, sizeof(rb));
+        if ((rb.blob = key_fingerprint_raw(key, SSH_FP_SHA1, &rb.len)) == NULL)
+                return -1;
+        erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha1s, &rb);
+        free(rb.blob);
+        if (erb != NULL) {
+                debug("%s: revoked by key SHA1", __func__);
+                return -1;
+        }
+
+        /* Next, explicit keys */
+        bzero(&rb, sizeof(rb));
+        if (plain_key_blob(key, &rb.blob, &rb.len) != 0)
+                return -1;
+        erb = RB_FIND(revoked_blob_tree, &krl->revoked_keys, &rb);
+        free(rb.blob);
+        if (erb != NULL) {
+                debug("%s: revoked by explicit key", __func__);
+                return -1;
+        }
+
+        if (!key_is_cert(key))
+                return 0;
+
+        /* Check cert revocation */
+        if (revoked_certs_for_ca_key(krl, key->cert->signature_key,
+            &rc, 0) != 0)
+                return -1;
+        if (rc == NULL)
+                return 0; /* No entry for this CA */
+
+        /* Check revocation by cert key ID */
+        bzero(&rki, sizeof(rki));
+        rki.key_id = key->cert->key_id;
+        erki = RB_FIND(revoked_key_id_tree, &rc->revoked_key_ids, &rki);
+        if (erki != NULL) {
+                debug("%s: revoked by key ID", __func__);
+                return -1;
+        }
+
+        /*
+         * Legacy cert formats lack serial numbers. Zero serials numbers
+         * are ignored (it's the default when the CA doesn't specify one).
+         */
+        if (key_cert_is_legacy(key) || key->cert->serial == 0)
+                return 0;
+
+        bzero(&rs, sizeof(rs));
+        rs.lo = rs.hi = key->cert->serial;
+        ers = RB_FIND(revoked_serial_tree, &rc->revoked_serials, &rs);
+        if (ers != NULL) {
+                KRL_DBG(("%s: %llu matched %llu:%llu", __func__,
+                    key->cert->serial, ers->lo, ers->hi));
+                debug("%s: revoked by serial", __func__);
+                return -1;
+        }
+        KRL_DBG(("%s: %llu no match", __func__, key->cert->serial));
+
+        return 0;
+}
+
+int
+ssh_krl_check_key(struct ssh_krl *krl, const Key *key)
+{
+        int r;
+
+        debug2("%s: checking key", __func__);
+        if ((r = is_key_revoked(krl, key)) != 0)
+                return r;
+        if (key_is_cert(key)) {
+                debug2("%s: checking CA key", __func__);
+                if ((r = is_key_revoked(krl, key->cert->signature_key)) != 0)
+                        return r;
+        }
+        debug3("%s: key okay", __func__);
+        return 0;
+}
+
+/* Returns 0 on success, -1 on error or key revoked, -2 if path is not a KRL */
+int
+ssh_krl_file_contains_key(const char *path, const Key *key)
+{
+        Buffer krlbuf;
+        struct ssh_krl *krl;
+        int revoked, fd;
+
+        if (path == NULL)
+                return 0;
+
+        if ((fd = open(path, O_RDONLY)) == -1) {
+                error("open %s: %s", path, strerror(errno));
+                error("Revoked keys file not accessible - refusing public key "
+                    "authentication");
+                return -1;
+        }
+        buffer_init(&krlbuf);
+        if (!key_load_file(fd, path, &krlbuf)) {
+                close(fd);
+                buffer_free(&krlbuf);
+                error("Revoked keys file not readable - refusing public key "
+                    "authentication");
+                return -1;
+        }
+        close(fd);
+        if (ssh_krl_from_blob(&krlbuf, &krl, NULL, 0) != 0) {
+                buffer_free(&krlbuf);
+                error("Invalid KRL, refusing public key "
+                    "authentication");
+                return -1;
+        }
+        buffer_free(&krlbuf);
+        if (krl == NULL) {
+                debug3("%s: %s is not a KRL file", __func__, path);
+                return -2;
+        }
+        debug2("%s: checking KRL %s", __func__, path);
+        revoked = ssh_krl_check_key(krl, key) != 0;
+        ssh_krl_free(krl);
+        return revoked ? -1 : 0;
+}
diff --git a/krl.h b/krl.h
new file mode 100644
index 000000000..2c43f5bb2
--- /dev/null
+++ b/krl.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (c) 2012 Damien Miller <djm@mindrot.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $OpenBSD: krl.h,v 1.2 2013/01/18 00:24:58 djm Exp $ */
+
+#ifndef _KRL_H
+#define _KRL_H
+
+/* Functions to manage key revocation lists */
+
+#define KRL_MAGIC               "SSHKRL\n\0"
+#define KRL_FORMAT_VERSION      1
+
+/* KRL section types */
+#define KRL_SECTION_CERTIFICATES        1
+#define KRL_SECTION_EXPLICIT_KEY        2
+#define KRL_SECTION_FINGERPRINT_SHA1    3
+#define KRL_SECTION_SIGNATURE           4
+
+/* KRL_SECTION_CERTIFICATES subsection types */
+#define KRL_SECTION_CERT_SERIAL_LIST    0x20
+#define KRL_SECTION_CERT_SERIAL_RANGE   0x21
+#define KRL_SECTION_CERT_SERIAL_BITMAP  0x22
+#define KRL_SECTION_CERT_KEY_ID         0x23
+
+struct ssh_krl;
+
+struct ssh_krl *ssh_krl_init(void);
+void ssh_krl_free(struct ssh_krl *krl);
+void ssh_krl_set_version(struct ssh_krl *krl, u_int64_t version);
+void ssh_krl_set_sign_key(struct ssh_krl *krl, const Key *sign_key);
+void ssh_krl_set_comment(struct ssh_krl *krl, const char *comment);
+int ssh_krl_revoke_cert_by_serial(struct ssh_krl *krl, const Key *ca_key,
+    u_int64_t serial);
+int ssh_krl_revoke_cert_by_serial_range(struct ssh_krl *krl, const Key *ca_key,
+    u_int64_t lo, u_int64_t hi);
+int ssh_krl_revoke_cert_by_key_id(struct ssh_krl *krl, const Key *ca_key,
+    const char *key_id);
+int ssh_krl_revoke_key_explicit(struct ssh_krl *krl, const Key *key);
+int ssh_krl_revoke_key_sha1(struct ssh_krl *krl, const Key *key);
+int ssh_krl_revoke_key(struct ssh_krl *krl, const Key *key);
+int ssh_krl_to_blob(struct ssh_krl *krl, Buffer *buf, const Key **sign_keys,
+    u_int nsign_keys);
+int ssh_krl_from_blob(Buffer *buf, struct ssh_krl **krlp,
+    const Key **sign_ca_keys, u_int nsign_ca_keys);
+int ssh_krl_check_key(struct ssh_krl *krl, const Key *key);
+int ssh_krl_file_contains_key(const char *path, const Key *key);
+
+#endif /* _KRL_H */
+
diff --git a/log.c b/log.c
index 201740893..dabee1407 100644
--- a/log.c
+++ b/log.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: log.c,v 1.42 2011/06/17 21:44:30 djm Exp $ */
+/* $OpenBSD: log.c,v 1.43 2012/09/06 04:37:39 dtucker Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -45,7 +45,7 @@
 #include <syslog.h>
 #include <unistd.h>
 #include <errno.h>
-#if defined(HAVE_STRNVIS) && defined(HAVE_VIS_H)
+#if defined(HAVE_STRNVIS) && defined(HAVE_VIS_H) && !defined(BROKEN_STRNVIS)
 # include <vis.h>
 #endif
 
@@ -330,6 +330,21 @@ log_init(char *av0, LogLevel level, SyslogFacility facility, int on_stderr)
 #endif
 }
 
+void
+log_change_level(LogLevel new_log_level)
+{
+        /* no-op if log_init has not been called */
+        if (argv0 == NULL)
+                return;
+        log_init(argv0, new_log_level, log_facility, log_on_stderr);
+}
+
+int
+log_is_on_stderr(void)
+{
+        return log_on_stderr;
+}
+
 #define MSGBUFSIZ 1024
 
 void
diff --git a/log.h b/log.h
index 1b8d2142b..e3e328b06 100644
--- a/log.h
+++ b/log.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: log.h,v 1.18 2011/06/17 21:44:30 djm Exp $ */
+/* $OpenBSD: log.h,v 1.19 2012/09/06 04:37:39 dtucker Exp $ */
 
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -49,6 +49,8 @@ typedef enum {
 typedef void (log_handler_fn)(LogLevel, const char *, void *);
 
 void     log_init(char *, LogLevel, SyslogFacility, int);
+void     log_change_level(LogLevel);
+int      log_is_on_stderr(void);
 
 SyslogFacility  log_facility_number(char *);
 const char *    log_facility_name(SyslogFacility);
diff --git a/loginrec.c b/loginrec.c
index 32941c985..f9662fa5c 100644
--- a/loginrec.c
+++ b/loginrec.c
@@ -180,10 +180,6 @@
 # include <util.h>
 #endif
 
-#ifdef HAVE_LIBUTIL_H
-# include <libutil.h>
-#endif
-
 /**
  ** prototypes for helper functions in this file
  **/
diff --git a/mac.c b/mac.c
index 9b450e4e2..3f2dc6f2a 100644
--- a/mac.c
+++ b/mac.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: mac.c,v 1.18 2012/06/28 05:07:45 dtucker Exp $ */
+/* $OpenBSD: mac.c,v 1.21 2012/12/11 22:51:45 sthen Exp $ */
 /*
  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
  *
@@ -48,6 +48,7 @@
 
 #define SSH_EVP         1       /* OpenSSL EVP-based MAC */
 #define SSH_UMAC        2       /* UMAC (not integrated with OpenSSL) */
+#define SSH_UMAC128     3
 
 struct {
         char            *name;
@@ -56,19 +57,36 @@ struct {
         int             truncatebits;   /* truncate digest if != 0 */
         int             key_len;        /* just for UMAC */
         int             len;            /* just for UMAC */
+        int             etm;            /* Encrypt-then-MAC */
 } macs[] = {
-        { "hmac-sha1",                  SSH_EVP, EVP_sha1, 0, -1, -1 },
-        { "hmac-sha1-96",               SSH_EVP, EVP_sha1, 96, -1, -1 },
+        /* Encrypt-and-MAC (encrypt-and-authenticate) variants */
+        { "hmac-sha1",                          SSH_EVP, EVP_sha1, 0, 0, 0, 0 },
+        { "hmac-sha1-96",                       SSH_EVP, EVP_sha1, 96, 0, 0, 0 },
 #ifdef HAVE_EVP_SHA256
-        { "hmac-sha2-256",              SSH_EVP, EVP_sha256, 0, -1, -1 },
-        { "hmac-sha2-512",              SSH_EVP, EVP_sha512, 0, -1, -1 },
+        { "hmac-sha2-256",                      SSH_EVP, EVP_sha256, 0, 0, 0, 0 },
+        { "hmac-sha2-512",                      SSH_EVP, EVP_sha512, 0, 0, 0, 0 },
 #endif
-        { "hmac-md5",                   SSH_EVP, EVP_md5, 0, -1, -1 },
-        { "hmac-md5-96",                SSH_EVP, EVP_md5, 96, -1, -1 },
-        { "hmac-ripemd160",             SSH_EVP, EVP_ripemd160, 0, -1, -1 },
-        { "hmac-ripemd160@openssh.com", SSH_EVP, EVP_ripemd160, 0, -1, -1 },
-        { "umac-64@openssh.com",        SSH_UMAC, NULL, 0, 128, 64 },
-        { NULL,                         0, NULL, 0, -1, -1 }
+        { "hmac-md5",                           SSH_EVP, EVP_md5, 0, 0, 0, 0 },
+        { "hmac-md5-96",                        SSH_EVP, EVP_md5, 96, 0, 0, 0 },
+        { "hmac-ripemd160",                     SSH_EVP, EVP_ripemd160, 0, 0, 0, 0 },
+        { "hmac-ripemd160@openssh.com",         SSH_EVP, EVP_ripemd160, 0, 0, 0, 0 },
+        { "umac-64@openssh.com",                SSH_UMAC, NULL, 0, 128, 64, 0 },
+        { "umac-128@openssh.com",               SSH_UMAC128, NULL, 0, 128, 128, 0 },
+
+        /* Encrypt-then-MAC variants */
+        { "hmac-sha1-etm@openssh.com",          SSH_EVP, EVP_sha1, 0, 0, 0, 1 },
+        { "hmac-sha1-96-etm@openssh.com",       SSH_EVP, EVP_sha1, 96, 0, 0, 1 },
+#ifdef HAVE_EVP_SHA256
+        { "hmac-sha2-256-etm@openssh.com",      SSH_EVP, EVP_sha256, 0, 0, 0, 1 },
+        { "hmac-sha2-512-etm@openssh.com",      SSH_EVP, EVP_sha512, 0, 0, 0, 1 },
+#endif
+        { "hmac-md5-etm@openssh.com",           SSH_EVP, EVP_md5, 0, 0, 0, 1 },
+        { "hmac-md5-96-etm@openssh.com",        SSH_EVP, EVP_md5, 96, 0, 0, 1 },
+        { "hmac-ripemd160-etm@openssh.com",     SSH_EVP, EVP_ripemd160, 0, 0, 0, 1 },
+        { "umac-64-etm@openssh.com",            SSH_UMAC, NULL, 0, 128, 64, 1 },
+        { "umac-128-etm@openssh.com",           SSH_UMAC128, NULL, 0, 128, 128, 1 },
+
+        { NULL,                                 0, NULL, 0, 0, 0, 0 }
 };
 
 static void
@@ -88,6 +106,7 @@ mac_setup_by_id(Mac *mac, int which)
         }
         if (macs[which].truncatebits != 0)
                 mac->mac_len = macs[which].truncatebits / 8;
+        mac->etm = macs[which].etm;
 }
 
 int
@@ -122,6 +141,9 @@ mac_init(Mac *mac)
         case SSH_UMAC:
                 mac->umac_ctx = umac_new(mac->key);
                 return 0;
+        case SSH_UMAC128:
+                mac->umac_ctx = umac128_new(mac->key);
+                return 0;
         default:
                 return -1;
         }
@@ -151,6 +173,11 @@ mac_compute(Mac *mac, u_int32_t seqno, u_char *data, int datalen)
                 umac_update(mac->umac_ctx, data, datalen);
                 umac_final(mac->umac_ctx, m, nonce);
                 break;
+        case SSH_UMAC128:
+                put_u64(nonce, seqno);
+                umac128_update(mac->umac_ctx, data, datalen);
+                umac128_final(mac->umac_ctx, m, nonce);
+                break;
         default:
                 fatal("mac_compute: unknown MAC type");
         }
@@ -163,6 +190,9 @@ mac_clear(Mac *mac)
         if (mac->type == SSH_UMAC) {
                 if (mac->umac_ctx != NULL)
                         umac_delete(mac->umac_ctx);
+        } else if (mac->type == SSH_UMAC128) {
+                if (mac->umac_ctx != NULL)
+                        umac128_delete(mac->umac_ctx);
         } else if (mac->evp_md != NULL)
                 HMAC_cleanup(&mac->evp_ctx);
         mac->evp_md = NULL;
diff --git a/misc.c b/misc.c
index ddff00e52..3938d4053 100644
--- a/misc.c
+++ b/misc.c
@@ -645,7 +645,7 @@ read_keyfile_line(FILE *f, const char *filename, char *buf, size_t bufsz,
 int
 secure_permissions(struct stat *st, uid_t uid)
 {
-        if (st->st_uid != 0 && st->st_uid != uid)
+        if (!platform_sys_dir_uid(st->st_uid) && st->st_uid != uid)
                 return 0;
         if ((st->st_mode & 002) != 0)
                 return 0;
diff --git a/moduli b/moduli
index 3bb155de9..49f76ee98 100644
--- a/moduli
+++ b/moduli
@@ -1,206 +1,199 @@
-#    $OpenBSD: moduli,v 1.7 2012/07/20 00:39:57 dtucker Exp $
+#    $OpenBSD: moduli,v 1.8 2012/08/29 05:06:54 dtucker Exp $
 # Time Type Tests Tries Size Generator Modulus
-20120705004026 2 6 100 1023 5 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA6242844A94DCF
-20120705004028 2 6 100 1023 2 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA6242844B1694B
-20120705004036 2 6 100 1023 2 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA6242844E34093
-20120705004039 2 6 100 1023 5 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA6242844F41247
-20120705004040 2 6 100 1023 2 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA6242844F8B39B
-20120705004042 2 6 100 1023 5 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA624284500D22F
-20120705004044 2 6 100 1023 2 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA624284504854B
-20120705004047 2 6 100 1023 2 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA62428451642A3
-20120705004049 2 6 100 1023 2 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA62428451B31D3
-20120705004052 2 6 100 1023 2 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA62428452B05CB
-20120705004053 2 6 100 1023 2 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA62428452BB06B
-20120705004057 2 6 100 1023 5 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA624284544D6EF
-20120705004101 2 6 100 1023 5 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA62428454FBFBF
-20120705004103 2 6 100 1023 5 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA624284556870F
-20120705004104 2 6 100 1023 5 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA62428455A1DCF
-20120705004106 2 6 100 1023 2 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA62428455A71F3
-20120705004107 2 6 100 1023 2 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA62428455C229B
-20120705004109 2 6 100 1023 5 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA6242845624C8F
-20120705004111 2 6 100 1023 5 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA6242845650AD7
-20120705004113 2 6 100 1023 5 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA624284572AE77
-20120705004116 2 6 100 1023 5 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA62428457F0DE7
-20120705004119 2 6 100 1023 5 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA62428458D623F
-20120705004121 2 6 100 1023 5 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA624284598C1BF
-20120705004122 2 6 100 1023 5 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA624284598FF9F
-20120705004127 2 6 100 1023 5 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA6242845B559BF
-20120705004129 2 6 100 1023 5 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA6242845BA77E7
-20120705004131 2 6 100 1023 5 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA6242845C3989F
-20120705004132 2 6 100 1023 5 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA6242845C5A23F
-20120705004134 2 6 100 1023 2 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA6242845CAF1DB
-20120705004136 2 6 100 1023 2 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA6242845D1CB5B
-20120705004137 2 6 100 1023 5 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA6242845D4528F
-20120705004139 2 6 100 1023 2 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA6242845DCBCB3
-20120705004143 2 6 100 1023 5 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA6242845EE91B7
-20120705004144 2 6 100 1023 5 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA6242845EFF1A7
-20120705004145 2 6 100 1023 2 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA6242845F363FB
-20120705004146 2 6 100 1023 2 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA6242845F3738B
-20120705004148 2 6 100 1023 5 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA6242845F437CF
-20120705004150 2 6 100 1023 5 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA624284601A3BF
-20120705004152 2 6 100 1023 5 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA624284603421F
-20120705004153 2 6 100 1023 5 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA624284605C5B7
-20120705004155 2 6 100 1023 2 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA62428460AF7CB
-20120705004159 2 6 100 1023 2 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA6242846266533
-20120705004201 2 6 100 1023 2 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA6242846287DD3
-20120705004204 2 6 100 1023 2 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA6242846397273
-20120705004206 2 6 100 1023 2 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA624284646FA83
-20120705004207 2 6 100 1023 2 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA6242846475ED3
-20120705004210 2 6 100 1023 5 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA624284651649F
-20120705004212 2 6 100 1023 2 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA624284659876B
-20120705004213 2 6 100 1023 2 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA624284659F8F3
-20120705004214 2 6 100 1023 2 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA62428465BD413
-20120705004216 2 6 100 1023 2 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA62428465F222B
-20120705004217 2 6 100 1023 2 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA624284660995B
-20120705004221 2 6 100 1023 5 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA62428467B9247
-20120705004227 2 6 100 1023 5 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA62428468DAF87
-20120705004230 2 6 100 1023 2 C9398FAC691CA974CDDD9E4254BD438A42F3294EB2EEAD1952EE1528921C54074519CCDAE5247550B94BCEF27A4C068DFF9135619D258C7AB9924231177BC6906A04CA6C2EA550D6F9EFCA41F5A0BB29E2DB461FE3E7B10B40737D6B5BA00078628B09353C87C1B23502F7B88265C56C935681E48FD982A68EA62428468E1A13
-20120705004838 2 6 100 1535 5 E78D0311A0270EFB6AFA3D49C4F29AFBD1F6E17F09EF7C478453B0AC3569217D11C976B33A34B1455AF42C925882D5F7B37DE14F96EAFA62819815B9C023647FAA7C00A26B88EF6F1D4791BA4AFB3C41E7F09C79742FEB04897DDCCDA6CB75BCA573228359359397BDD1B054FC6B900829A4914E939F813E09DDFE94783F2739EB19D59E921881C601B2401E553972C47E93FBC5410B3712E936C9EA2255445A1E5312D6E6DBE4B7DBF69C1C6F366E91DDDDD04E67C9A5F7FD6E18C8F7205887
-20120705004853 2 6 100 1535 5 E78D0311A0270EFB6AFA3D49C4F29AFBD1F6E17F09EF7C478453B0AC3569217D11C976B33A34B1455AF42C925882D5F7B37DE14F96EAFA62819815B9C023647FAA7C00A26B88EF6F1D4791BA4AFB3C41E7F09C79742FEB04897DDCCDA6CB75BCA573228359359397BDD1B054FC6B900829A4914E939F813E09DDFE94783F2739EB19D59E921881C601B2401E553972C47E93FBC5410B3712E936C9EA2255445A1E5312D6E6DBE4B7DBF69C1C6F366E91DDDDD04E67C9A5F7FD6E18C8F73B39C7
-20120705004937 2 6 100 1535 2 E78D0311A0270EFB6AFA3D49C4F29AFBD1F6E17F09EF7C478453B0AC3569217D11C976B33A34B1455AF42C925882D5F7B37DE14F96EAFA62819815B9C023647FAA7C00A26B88EF6F1D4791BA4AFB3C41E7F09C79742FEB04897DDCCDA6CB75BCA573228359359397BDD1B054FC6B900829A4914E939F813E09DDFE94783F2739EB19D59E921881C601B2401E553972C47E93FBC5410B3712E936C9EA2255445A1E5312D6E6DBE4B7DBF69C1C6F366E91DDDDD04E67C9A5F7FD6E18C8F7A3E153
-20120705005002 2 6 100 1535 2 E78D0311A0270EFB6AFA3D49C4F29AFBD1F6E17F09EF7C478453B0AC3569217D11C976B33A34B1455AF42C925882D5F7B37DE14F96EAFA62819815B9C023647FAA7C00A26B88EF6F1D4791BA4AFB3C41E7F09C79742FEB04897DDCCDA6CB75BCA573228359359397BDD1B054FC6B900829A4914E939F813E09DDFE94783F2739EB19D59E921881C601B2401E553972C47E93FBC5410B3712E936C9EA2255445A1E5312D6E6DBE4B7DBF69C1C6F366E91DDDDD04E67C9A5F7FD6E18C8F7DB4473
-20120705005017 2 6 100 1535 5 E78D0311A0270EFB6AFA3D49C4F29AFBD1F6E17F09EF7C478453B0AC3569217D11C976B33A34B1455AF42C925882D5F7B37DE14F96EAFA62819815B9C023647FAA7C00A26B88EF6F1D4791BA4AFB3C41E7F09C79742FEB04897DDCCDA6CB75BCA573228359359397BDD1B054FC6B900829A4914E939F813E09DDFE94783F2739EB19D59E921881C601B2401E553972C47E93FBC5410B3712E936C9EA2255445A1E5312D6E6DBE4B7DBF69C1C6F366E91DDDDD04E67C9A5F7FD6E18C8F7F7293F
-20120705005025 2 6 100 1535 2 E78D0311A0270EFB6AFA3D49C4F29AFBD1F6E17F09EF7C478453B0AC3569217D11C976B33A34B1455AF42C925882D5F7B37DE14F96EAFA62819815B9C023647FAA7C00A26B88EF6F1D4791BA4AFB3C41E7F09C79742FEB04897DDCCDA6CB75BCA573228359359397BDD1B054FC6B900829A4914E939F813E09DDFE94783F2739EB19D59E921881C601B2401E553972C47E93FBC5410B3712E936C9EA2255445A1E5312D6E6DBE4B7DBF69C1C6F366E91DDDDD04E67C9A5F7FD6E18C8F802FE8B
-20120705005048 2 6 100 1535 2 E78D0311A0270EFB6AFA3D49C4F29AFBD1F6E17F09EF7C478453B0AC3569217D11C976B33A34B1455AF42C925882D5F7B37DE14F96EAFA62819815B9C023647FAA7C00A26B88EF6F1D4791BA4AFB3C41E7F09C79742FEB04897DDCCDA6CB75BCA573228359359397BDD1B054FC6B900829A4914E939F813E09DDFE94783F2739EB19D59E921881C601B2401E553972C47E93FBC5410B3712E936C9EA2255445A1E5312D6E6DBE4B7DBF69C1C6F366E91DDDDD04E67C9A5F7FD6E18C8F836B5D3
-20120705005117 2 6 100 1535 2 E78D0311A0270EFB6AFA3D49C4F29AFBD1F6E17F09EF7C478453B0AC3569217D11C976B33A34B1455AF42C925882D5F7B37DE14F96EAFA62819815B9C023647FAA7C00A26B88EF6F1D4791BA4AFB3C41E7F09C79742FEB04897DDCCDA6CB75BCA573228359359397BDD1B054FC6B900829A4914E939F813E09DDFE94783F2739EB19D59E921881C601B2401E553972C47E93FBC5410B3712E936C9EA2255445A1E5312D6E6DBE4B7DBF69C1C6F366E91DDDDD04E67C9A5F7FD6E18C8F878CDEB
-20120705005122 2 6 100 1535 2 E78D0311A0270EFB6AFA3D49C4F29AFBD1F6E17F09EF7C478453B0AC3569217D11C976B33A34B1455AF42C925882D5F7B37DE14F96EAFA62819815B9C023647FAA7C00A26B88EF6F1D4791BA4AFB3C41E7F09C79742FEB04897DDCCDA6CB75BCA573228359359397BDD1B054FC6B900829A4914E939F813E09DDFE94783F2739EB19D59E921881C601B2401E553972C47E93FBC5410B3712E936C9EA2255445A1E5312D6E6DBE4B7DBF69C1C6F366E91DDDDD04E67C9A5F7FD6E18C8F87AB3EB
-20120705005140 2 6 100 1535 2 E78D0311A0270EFB6AFA3D49C4F29AFBD1F6E17F09EF7C478453B0AC3569217D11C976B33A34B1455AF42C925882D5F7B37DE14F96EAFA62819815B9C023647FAA7C00A26B88EF6F1D4791BA4AFB3C41E7F09C79742FEB04897DDCCDA6CB75BCA573228359359397BDD1B054FC6B900829A4914E939F813E09DDFE94783F2739EB19D59E921881C601B2401E553972C47E93FBC5410B3712E936C9EA2255445A1E5312D6E6DBE4B7DBF69C1C6F366E91DDDDD04E67C9A5F7FD6E18C8F89EAA43
-20120705005148 2 6 100 1535 2 E78D0311A0270EFB6AFA3D49C4F29AFBD1F6E17F09EF7C478453B0AC3569217D11C976B33A34B1455AF42C925882D5F7B37DE14F96EAFA62819815B9C023647FAA7C00A26B88EF6F1D4791BA4AFB3C41E7F09C79742FEB04897DDCCDA6CB75BCA573228359359397BDD1B054FC6B900829A4914E939F813E09DDFE94783F2739EB19D59E921881C601B2401E553972C47E93FBC5410B3712E936C9EA2255445A1E5312D6E6DBE4B7DBF69C1C6F366E91DDDDD04E67C9A5F7FD6E18C8F8AA75F3
-20120705005201 2 6 100 1535 2 E78D0311A0270EFB6AFA3D49C4F29AFBD1F6E17F09EF7C478453B0AC3569217D11C976B33A34B1455AF42C925882D5F7B37DE14F96EAFA62819815B9C023647FAA7C00A26B88EF6F1D4791BA4AFB3C41E7F09C79742FEB04897DDCCDA6CB75BCA573228359359397BDD1B054FC6B900829A4914E939F813E09DDFE94783F2739EB19D59E921881C601B2401E553972C47E93FBC5410B3712E936C9EA2255445A1E5312D6E6DBE4B7DBF69C1C6F366E91DDDDD04E67C9A5F7FD6E18C8F8C2EAAB
-20120705005215 2 6 100 1535 2 E78D0311A0270EFB6AFA3D49C4F29AFBD1F6E17F09EF7C478453B0AC3569217D11C976B33A34B1455AF42C925882D5F7B37DE14F96EAFA62819815B9C023647FAA7C00A26B88EF6F1D4791BA4AFB3C41E7F09C79742FEB04897DDCCDA6CB75BCA573228359359397BDD1B054FC6B900829A4914E939F813E09DDFE94783F2739EB19D59E921881C601B2401E553972C47E93FBC5410B3712E936C9EA2255445A1E5312D6E6DBE4B7DBF69C1C6F366E91DDDDD04E67C9A5F7FD6E18C8F8DEAC73
-20120705005221 2 6 100 1535 2 E78D0311A0270EFB6AFA3D49C4F29AFBD1F6E17F09EF7C478453B0AC3569217D11C976B33A34B1455AF42C925882D5F7B37DE14F96EAFA62819815B9C023647FAA7C00A26B88EF6F1D4791BA4AFB3C41E7F09C79742FEB04897DDCCDA6CB75BCA573228359359397BDD1B054FC6B900829A4914E939F813E09DDFE94783F2739EB19D59E921881C601B2401E553972C47E93FBC5410B3712E936C9EA2255445A1E5312D6E6DBE4B7DBF69C1C6F366E91DDDDD04E67C9A5F7FD6E18C8F8E3C303
-20120705005231 2 6 100 1535 5 E78D0311A0270EFB6AFA3D49C4F29AFBD1F6E17F09EF7C478453B0AC3569217D11C976B33A34B1455AF42C925882D5F7B37DE14F96EAFA62819815B9C023647FAA7C00A26B88EF6F1D4791BA4AFB3C41E7F09C79742FEB04897DDCCDA6CB75BCA573228359359397BDD1B054FC6B900829A4914E939F813E09DDFE94783F2739EB19D59E921881C601B2401E553972C47E93FBC5410B3712E936C9EA2255445A1E5312D6E6DBE4B7DBF69C1C6F366E91DDDDD04E67C9A5F7FD6E18C8F8F51EFF
-20120705005246 2 6 100 1535 5 E78D0311A0270EFB6AFA3D49C4F29AFBD1F6E17F09EF7C478453B0AC3569217D11C976B33A34B1455AF42C925882D5F7B37DE14F96EAFA62819815B9C023647FAA7C00A26B88EF6F1D4791BA4AFB3C41E7F09C79742FEB04897DDCCDA6CB75BCA573228359359397BDD1B054FC6B900829A4914E939F813E09DDFE94783F2739EB19D59E921881C601B2401E553972C47E93FBC5410B3712E936C9EA2255445A1E5312D6E6DBE4B7DBF69C1C6F366E91DDDDD04E67C9A5F7FD6E18C8F9115B97
-20120705005317 2 6 100 1535 5 E78D0311A0270EFB6AFA3D49C4F29AFBD1F6E17F09EF7C478453B0AC3569217D11C976B33A34B1455AF42C925882D5F7B37DE14F96EAFA62819815B9C023647FAA7C00A26B88EF6F1D4791BA4AFB3C41E7F09C79742FEB04897DDCCDA6CB75BCA573228359359397BDD1B054FC6B900829A4914E939F813E09DDFE94783F2739EB19D59E921881C601B2401E553972C47E93FBC5410B3712E936C9EA2255445A1E5312D6E6DBE4B7DBF69C1C6F366E91DDDDD04E67C9A5F7FD6E18C8F95737CF
-20120705005324 2 6 100 1535 5 E78D0311A0270EFB6AFA3D49C4F29AFBD1F6E17F09EF7C478453B0AC3569217D11C976B33A34B1455AF42C925882D5F7B37DE14F96EAFA62819815B9C023647FAA7C00A26B88EF6F1D4791BA4AFB3C41E7F09C79742FEB04897DDCCDA6CB75BCA573228359359397BDD1B054FC6B900829A4914E939F813E09DDFE94783F2739EB19D59E921881C601B2401E553972C47E93FBC5410B3712E936C9EA2255445A1E5312D6E6DBE4B7DBF69C1C6F366E91DDDDD04E67C9A5F7FD6E18C8F960A5F7
-20120705005339 2 6 100 1535 2 E78D0311A0270EFB6AFA3D49C4F29AFBD1F6E17F09EF7C478453B0AC3569217D11C976B33A34B1455AF42C925882D5F7B37DE14F96EAFA62819815B9C023647FAA7C00A26B88EF6F1D4791BA4AFB3C41E7F09C79742FEB04897DDCCDA6CB75BCA573228359359397BDD1B054FC6B900829A4914E939F813E09DDFE94783F2739EB19D59E921881C601B2401E553972C47E93FBC5410B3712E936C9EA2255445A1E5312D6E6DBE4B7DBF69C1C6F366E91DDDDD04E67C9A5F7FD6E18C8F97DBAB3
-20120705005353 2 6 100 1535 5 E78D0311A0270EFB6AFA3D49C4F29AFBD1F6E17F09EF7C478453B0AC3569217D11C976B33A34B1455AF42C925882D5F7B37DE14F96EAFA62819815B9C023647FAA7C00A26B88EF6F1D4791BA4AFB3C41E7F09C79742FEB04897DDCCDA6CB75BCA573228359359397BDD1B054FC6B900829A4914E939F813E09DDFE94783F2739EB19D59E921881C601B2401E553972C47E93FBC5410B3712E936C9EA2255445A1E5312D6E6DBE4B7DBF69C1C6F366E91DDDDD04E67C9A5F7FD6E18C8F999A9CF
-20120705005453 2 6 100 1535 5 E78D0311A0270EFB6AFA3D49C4F29AFBD1F6E17F09EF7C478453B0AC3569217D11C976B33A34B1455AF42C925882D5F7B37DE14F96EAFA62819815B9C023647FAA7C00A26B88EF6F1D4791BA4AFB3C41E7F09C79742FEB04897DDCCDA6CB75BCA573228359359397BDD1B054FC6B900829A4914E939F813E09DDFE94783F2739EB19D59E921881C601B2401E553972C47E93FBC5410B3712E936C9EA2255445A1E5312D6E6DBE4B7DBF69C1C6F366E91DDDDD04E67C9A5F7FD6E18C8FA253557
-20120705005516 2 6 100 1535 2 E78D0311A0270EFB6AFA3D49C4F29AFBD1F6E17F09EF7C478453B0AC3569217D11C976B33A34B1455AF42C925882D5F7B37DE14F96EAFA62819815B9C023647FAA7C00A26B88EF6F1D4791BA4AFB3C41E7F09C79742FEB04897DDCCDA6CB75BCA573228359359397BDD1B054FC6B900829A4914E939F813E09DDFE94783F2739EB19D59E921881C601B2401E553972C47E93FBC5410B3712E936C9EA2255445A1E5312D6E6DBE4B7DBF69C1C6F366E91DDDDD04E67C9A5F7FD6E18C8FA597D23
-20120705005521 2 6 100 1535 2 E78D0311A0270EFB6AFA3D49C4F29AFBD1F6E17F09EF7C478453B0AC3569217D11C976B33A34B1455AF42C925882D5F7B37DE14F96EAFA62819815B9C023647FAA7C00A26B88EF6F1D4791BA4AFB3C41E7F09C79742FEB04897DDCCDA6CB75BCA573228359359397BDD1B054FC6B900829A4914E939F813E09DDFE94783F2739EB19D59E921881C601B2401E553972C47E93FBC5410B3712E936C9EA2255445A1E5312D6E6DBE4B7DBF69C1C6F366E91DDDDD04E67C9A5F7FD6E18C8FA5B9B1B
-20120705005600 2 6 100 1535 2 E78D0311A0270EFB6AFA3D49C4F29AFBD1F6E17F09EF7C478453B0AC3569217D11C976B33A34B1455AF42C925882D5F7B37DE14F96EAFA62819815B9C023647FAA7C00A26B88EF6F1D4791BA4AFB3C41E7F09C79742FEB04897DDCCDA6CB75BCA573228359359397BDD1B054FC6B900829A4914E939F813E09DDFE94783F2739EB19D59E921881C601B2401E553972C47E93FBC5410B3712E936C9EA2255445A1E5312D6E6DBE4B7DBF69C1C6F366E91DDDDD04E67C9A5F7FD6E18C8FAB57F73
-20120705005606 2 6 100 1535 2 E78D0311A0270EFB6AFA3D49C4F29AFBD1F6E17F09EF7C478453B0AC3569217D11C976B33A34B1455AF42C925882D5F7B37DE14F96EAFA62819815B9C023647FAA7C00A26B88EF6F1D4791BA4AFB3C41E7F09C79742FEB04897DDCCDA6CB75BCA573228359359397BDD1B054FC6B900829A4914E939F813E09DDFE94783F2739EB19D59E921881C601B2401E553972C47E93FBC5410B3712E936C9EA2255445A1E5312D6E6DBE4B7DBF69C1C6F366E91DDDDD04E67C9A5F7FD6E18C8FABBBAFB
-20120705005632 2 6 100 1535 2 E78D0311A0270EFB6AFA3D49C4F29AFBD1F6E17F09EF7C478453B0AC3569217D11C976B33A34B1455AF42C925882D5F7B37DE14F96EAFA62819815B9C023647FAA7C00A26B88EF6F1D4791BA4AFB3C41E7F09C79742FEB04897DDCCDA6CB75BCA573228359359397BDD1B054FC6B900829A4914E939F813E09DDFE94783F2739EB19D59E921881C601B2401E553972C47E93FBC5410B3712E936C9EA2255445A1E5312D6E6DBE4B7DBF69C1C6F366E91DDDDD04E67C9A5F7FD6E18C8FAF58CB3
-20120705005640 2 6 100 1535 2 E78D0311A0270EFB6AFA3D49C4F29AFBD1F6E17F09EF7C478453B0AC3569217D11C976B33A34B1455AF42C925882D5F7B37DE14F96EAFA62819815B9C023647FAA7C00A26B88EF6F1D4791BA4AFB3C41E7F09C79742FEB04897DDCCDA6CB75BCA573228359359397BDD1B054FC6B900829A4914E939F813E09DDFE94783F2739EB19D59E921881C601B2401E553972C47E93FBC5410B3712E936C9EA2255445A1E5312D6E6DBE4B7DBF69C1C6F366E91DDDDD04E67C9A5F7FD6E18C8FB01659B
-20120705005645 2 6 100 1535 5 E78D0311A0270EFB6AFA3D49C4F29AFBD1F6E17F09EF7C478453B0AC3569217D11C976B33A34B1455AF42C925882D5F7B37DE14F96EAFA62819815B9C023647FAA7C00A26B88EF6F1D4791BA4AFB3C41E7F09C79742FEB04897DDCCDA6CB75BCA573228359359397BDD1B054FC6B900829A4914E939F813E09DDFE94783F2739EB19D59E921881C601B2401E553972C47E93FBC5410B3712E936C9EA2255445A1E5312D6E6DBE4B7DBF69C1C6F366E91DDDDD04E67C9A5F7FD6E18C8FB04D9E7
-20120705005659 2 6 100 1535 5 E78D0311A0270EFB6AFA3D49C4F29AFBD1F6E17F09EF7C478453B0AC3569217D11C976B33A34B1455AF42C925882D5F7B37DE14F96EAFA62819815B9C023647FAA7C00A26B88EF6F1D4791BA4AFB3C41E7F09C79742FEB04897DDCCDA6CB75BCA573228359359397BDD1B054FC6B900829A4914E939F813E09DDFE94783F2739EB19D59E921881C601B2401E553972C47E93FBC5410B3712E936C9EA2255445A1E5312D6E6DBE4B7DBF69C1C6F366E91DDDDD04E67C9A5F7FD6E18C8FB205C67
-20120705011229 2 6 100 2047 2 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D205DA381EB
-20120705011307 2 6 100 2047 2 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D205DAEFA5B
-20120705011647 2 6 100 2047 5 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D205E09B2B7
-20120705011825 2 6 100 2047 2 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D205E30C613
-20120705011957 2 6 100 2047 5 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D205E5B7E3F
-20120705012217 2 6 100 2047 5 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D205E9ED607
-20120705012259 2 6 100 2047 2 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D205EB4E9E3
-20120705012319 2 6 100 2047 2 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D205EBDF313
-20120705012338 2 6 100 2047 5 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D205EC9AD5F
-20120705012817 2 6 100 2047 5 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D205F79773F
-20120705012947 2 6 100 2047 2 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D205FB2897B
-20120705013020 2 6 100 2047 2 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D205FC0CFAB
-20120705013559 2 6 100 2047 2 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D20606541A3
-20120705013637 2 6 100 2047 5 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D206078A9DF
-20120705013859 2 6 100 2047 2 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D2060C181BB
-20120705014010 2 6 100 2047 2 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D2060DFB1BB
-20120705014101 2 6 100 2047 2 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D2060F217A3
-20120705014248 2 6 100 2047 2 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D2061182263
-20120705014325 2 6 100 2047 2 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D2061214FC3
-20120705014539 2 6 100 2047 5 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D206162E447
-20120705014658 2 6 100 2047 2 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D206186D1F3
-20120705014856 2 6 100 2047 2 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D2061D0EF73
-20120705015000 2 6 100 2047 2 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D2062023BFB
-20120705015045 2 6 100 2047 2 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D20621EDDEB
-20120705015234 2 6 100 2047 2 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D2062752373
-20120705015345 2 6 100 2047 5 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D2062B97207
-20120705015734 2 6 100 2047 5 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D20636C6B0F
-20120705015750 2 6 100 2047 2 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D2063752183
-20120705015806 2 6 100 2047 2 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D20637DAF9B
-20120705015900 2 6 100 2047 2 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D2063B134BB
-20120705015921 2 6 100 2047 2 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D2063C148EB
-20120705020044 2 6 100 2047 5 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D20640F2047
-20120705020232 2 6 100 2047 2 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D20647E3FEB
-20120705020339 2 6 100 2047 2 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D2064C2CC83
-20120705020502 2 6 100 2047 2 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D2065162F7B
-20120705020512 2 6 100 2047 2 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D2065194343
-20120705020523 2 6 100 2047 2 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D20651C2E2B
-20120705020541 2 6 100 2047 5 F40926C361E350C4310F5B3D226E71AEC07A03D75D888F970ABA8668618ED65C320792C35505B25AB099C9DB0EAFE3CD8A831A9B54F68F68C48EF3282593342D5B7529949B37B29D99EBF2DC8B454F02354772A10041B7F150A6181C103244FC53E52DC4DE433853E8363FCDA31A8F9B0C245C5B5F2B341877A37854FAC42141C6F1FB8B8514E21672C4462FFEEDFA979469B68FC868E646F29CF8775D2087E01603C5BA5C628DFF0B30C8F3E66EFB13176CC4564AB386578DF555549A80E04F537BA0E235919AB75D2B48F69C29E0F3784A25A97BB8189059FAEBA055797808FA6E3566F8A7D3E7C5E0754B23EAA38441B0F1A563EEC2FF7D374D206528BA2F
-20120705021818 2 6 100 3071 5 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA54165EF071CF
-20120705022441 2 6 100 3071 5 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA54165F6DCFB7
-20120705024326 2 6 100 3071 2 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA541660E5F72B
-20120705025034 2 6 100 3071 2 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA5416617271AB
-20120705025525 2 6 100 3071 5 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA541661CDD5AF
-20120705025705 2 6 100 3071 5 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA541661E6A71F
-20120705025752 2 6 100 3071 2 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA541661EE2413
-20120705030403 2 6 100 3071 5 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA541662662DC7
-20120705030432 2 6 100 3071 5 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA5416626728EF
-20120705030953 2 6 100 3071 2 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA541662CA2463
-20120705031728 2 6 100 3071 2 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA5416635CAC93
-20120705032458 2 6 100 3071 5 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA541663EC109F
-20120705032902 2 6 100 3071 5 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA54166431CB8F
-20120705033016 2 6 100 3071 2 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA54166441BDC3
-20120705033652 2 6 100 3071 2 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA541664BF1503
-20120705033740 2 6 100 3071 2 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA541664C48A73
-20120705034025 2 6 100 3071 5 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA541664F440CF
-20120705034138 2 6 100 3071 2 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA541665048ECB
-20120705034458 2 6 100 3071 5 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA5416653F1BC7
-20120705040416 2 6 100 3071 2 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA541666BE5B43
-20120705041326 2 6 100 3071 2 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA5416676F9AD3
-20120705041429 2 6 100 3071 5 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA5416677BBDD7
-20120705041928 2 6 100 3071 5 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA541667DA5427
-20120705042013 2 6 100 3071 5 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA541667E0CDA7
-20120705044833 2 6 100 3071 2 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA54166A1D45AB
-20120705045307 2 6 100 3071 5 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA54166A71DD37
-20120705050710 2 6 100 3071 2 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA54166B8634A3
-20120705051048 2 6 100 3071 2 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA54166BC572CB
-20120705051219 2 6 100 3071 5 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA54166BDA113F
-20120705051634 2 6 100 3071 2 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA54166C28FFCB
-20120705052331 2 6 100 3071 2 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA54166CAA425B
-20120705052812 2 6 100 3071 2 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA54166D041A0B
-20120705053701 2 6 100 3071 5 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA54166DA81DB7
-20120705055127 2 6 100 3071 5 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA54166EC251D7
-20120705055500 2 6 100 3071 2 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA54166F01CF6B
-20120705055603 2 6 100 3071 2 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA54166F0EF763
-20120705055831 2 6 100 3071 2 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA54166F39358B
-20120705060133 2 6 100 3071 2 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA54166F5FDC7B
-20120705060444 2 6 100 3071 2 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA54166F8017B3
-20120705060616 2 6 100 3071 2 D890FD65E29157CFC7DDEE6D3593A43B0FABAD7638B24BFB0E58470A19C3CABAE86077D2C8B6BC113A7D01DC52820B4325F8EDF001A95AD2153A9CA5C2CFE131FE8472608D36D5252AF9B8C7438974D569147CFEC5D1CE0C492E7629CCE2277A85FF32B7D8051F901241B34277318752D75D3BDEC041C37E22FFA4859F52A875B2A01727978E6BABF8E4570383ECE6C8F4A8D0EFDE7894D92891E4B62B9CD31061E50177162AE78C2CFE8EF850721EFB79EC61560806F40A6EA84E40A430EE82D5737C4456B03126E4AA7C6E291612D433BB255B2F96A9C2C75B437EC79FD386A0984D6BECA43C7D5B5A91A1642E787911BD9D42A0E8E264E8317EB7E86E679787DD4D1FA0D7B39E94070123B186247B6710C0BB11FAC8589D196831D2AC1DCF25CAE16874740D310CC40A9F3C91B09A86112ACA4E62FAE3986896A4B8132AE3F2CE11B0B21DE147168E3E27FF0067C8787D5C930D6F05AF47A7BC8C59F34F17CC28C39207DFC14B9DA5C61C1B0D18E87662427DCBCF254B3BDA54166F8A763B
-20120705074615 2 6 100 4095 5 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E404D4A9FF
-20120705075624 2 6 100 4095 2 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E405259C43
-20120705075814 2 6 100 4095 2 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E4052CF1E3
-20120705082750 2 6 100 4095 5 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E405CAF157
-20120705091841 2 6 100 4095 5 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E40777DB37
-20120705094647 2 6 100 4095 2 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E40863BD9B
-20120705113042 2 6 100 4095 5 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E40BE821C7
-20120705113614 2 6 100 4095 2 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E40C0EADAB
-20120705113856 2 6 100 4095 2 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E40C1D4D93
-20120705115824 2 6 100 4095 2 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E40CBE3D6B
-20120705122406 2 6 100 4095 2 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E40D792E73
-20120705123711 2 6 100 4095 5 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E40DDA1F9F
-20120705124452 2 6 100 4095 2 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E40E149903
-20120705133408 2 6 100 4095 2 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E40F205063
-20120705133854 2 6 100 4095 2 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E40F36CB23
-20120705140912 2 6 100 4095 2 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E40FF3C14B
-20120705151048 2 6 100 4095 2 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E41130009B
-20120705154517 2 6 100 4095 2 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E411EA83DB
-20120705155613 2 6 100 4095 5 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E4123EC08F
-20120705162202 2 6 100 4095 5 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E4130DF347
-20120705162423 2 6 100 4095 5 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E41319263F
-20120705163533 2 6 100 4095 5 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E4136A686F
-20120705170312 2 6 100 4095 2 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E4144BD02B
-20120705175100 2 6 100 4095 2 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E415E0D6BB
-20120705190344 2 6 100 4095 2 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E418110983
-20120705191532 2 6 100 4095 2 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E4186E4BE3
-20120705193904 2 6 100 4095 2 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E41933A90B
-20120705201440 2 6 100 4095 5 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E41A1607FF
-20120705202233 2 6 100 4095 5 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E41A3C4B5F
-20120705204542 2 6 100 4095 5 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E41AFA0127
-20120705205809 2 6 100 4095 2 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E41B59BD9B
-20120705213138 2 6 100 4095 2 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E41C73B903
-20120705214528 2 6 100 4095 2 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E41CE1ACFB
-20120705215449 2 6 100 4095 2 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E41D2A1E9B
-20120705225456 2 6 100 4095 5 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E41F236C7F
-20120705231339 2 6 100 4095 2 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E41FB99943
-20120705232933 2 6 100 4095 2 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E4203D8FB3
-20120705233827 2 6 100 4095 2 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E420804A5B
-20120705234448 2 6 100 4095 5 DFFB779B102B10577B70CDEE209CFAB26C1253293E8D5276DBAC95D03FCBD38E8A848E936A1CB8030EBC8E2C34EAC58F80CC9CCF8791D989809E2B4AB5CC21CCA57AAA4A5BB1790A0285F2E221F5F2E3432D7FE997B5E128AC60AE4D96D64D578F0E00AD9A784A66669CC98A6313A453D8071AA32C0CCFFE0F563A39478DE745FBE68390AE208F9A1927E205527C34E903C9392DFBB15172842B60C0F7DD073B9AFDA8DED1110031323DE355D245DCA105739D476C83F9FC1CB2DADAEB3858E1A5958B2A878EC1D7AF9DE6191A324B0370C84E092157E46BBF7743DE32A6F935F64A6855CFF6D48B6312C4CB90C057BE850A14377042080D370219B0677961112B926D69780F82EE3292619A074E22EFF9D919D01D872079A94BF8CBD98E700D63B5C33409B070133AB2D09AA175215F80D5D64290D74059955EE9CFE7E7CF7E83C51DFE9822BDC92F5447AF88BB944A812607D9A1508885EAAF1FE5C42779085F0D831E21A689C141D769E423F42B5CE2BFE8DB4AE13808AD146903A8322D895306C34285BAB6EF9B4DC9498051F5246CD9716D6E00BCB255CDCFCE603EB54C0D9ABFB187FBFE9FC2D456624D7A9415D1D9022B4AE86045AD1FA073400A8F85F6469B609666B0E78A5BCE8B02825A7F9CE33776BD068F2B4626472EADFED316CF2F2CEDFFF966A9D5C30B41C1ABD5DBFBE29F0953292A6C96ADF8E420AC9D9F
+20120821044040 2 6 100 1023 5 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A770E2EC9F
+20120821044046 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A7711F2C6B
+20120821044047 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A771225323
+20120821044048 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A7712507AB
+20120821044050 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A7712A2DB3
+20120821044051 2 6 100 1023 5 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A7712CACEF
+20120821044053 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A7713959C3
+20120821044057 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A7715BBA13
+20120821044103 2 6 100 1023 5 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A77191592F
+20120821044104 2 6 100 1023 5 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A771938E1F
+20120821044106 2 6 100 1023 5 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A771A1E127
+20120821044108 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A771B3CDFB
+20120821044109 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A771B71913
+20120821044111 2 6 100 1023 5 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A771C2759F
+20120821044113 2 6 100 1023 5 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A771CF8ABF
+20120821044114 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A771D2B49B
+20120821044116 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A771DF6193
+20120821044117 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A771E67E33
+20120821044120 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A771FA581B
+20120821044121 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A772027DDB
+20120821044123 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A772093F8B
+20120821044124 2 6 100 1023 5 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A7720EEF6F
+20120821044125 2 6 100 1023 5 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A77216CAD7
+20120821044126 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A77219A90B
+20120821044129 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A7722A0103
+20120821044130 2 6 100 1023 5 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A772343DBF
+20120821044133 2 6 100 1023 5 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A772460C3F
+20120821044137 2 6 100 1023 5 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A7726A4E0F
+20120821044138 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A772716D8B
+20120821044141 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A7728D719B
+20120821044143 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A77297AA8B
+20120821044145 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A772A8794B
+20120821044147 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A772B4D6AB
+20120821044149 2 6 100 1023 5 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A772BD325F
+20120821044150 2 6 100 1023 5 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A772BDAE07
+20120821044151 2 6 100 1023 2 D9277DAA27DB131C03B108D41A76B4DA8ACEECCCAE73D2E48CEDAAA70B09EF9F04FB020DCF36C51B8E485B26FABE0337E24232BE4F4E693548310244937433FB1A5758195DC73B84ADEF8237472C46747D79DC0A2CF8A57CE8DBD8F466A20F8551E7B1B824B2E4987A8816D9BC0741C2798F3EBAD3ADEBCC78FCE6A772C95CE3
+20120821044502 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F96361507
+20120821044515 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F965885BF
+20120821044519 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F966006C7
+20120821044528 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F9674A0EB
+20120821044539 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F969457F3
+20120821044544 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F969BE79B
+20120821044606 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F96E1E827
+20120821044623 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F9714284B
+20120821044630 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F97231CB7
+20120821044636 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F972E01DF
+20120821044647 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F974BCED3
+20120821044650 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F974C3A43
+20120821044653 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F974E8F73
+20120821044701 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F9763403B
+20120821044705 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F9767666B
+20120821044708 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F9768D81F
+20120821044726 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F979FD437
+20120821044729 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F97A29BC7
+20120821044732 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F97A56447
+20120821044737 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F97AEDBDB
+20120821044740 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F97B187F3
+20120821044746 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F97BC6EE3
+20120821044757 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F97DCCDEB
+20120821044817 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F981975F7
+20120821044831 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F983EC267
+20120821044841 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F985A032F
+20120821044846 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F9863B0AB
+20120821044852 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F986E5C7F
+20120821044911 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F98A8FF6B
+20120821044917 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F98B40E4B
+20120821044924 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F98C5840F
+20120821044940 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F98F22CEB
+20120821044947 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F99040FFF
+20120821044954 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F99139AE3
+20120821045010 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F9940BEFB
+20120821045017 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F9954379F
+20120821045020 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F99548C23
+20120821045023 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F99562FC3
+20120821045028 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F9960CDCF
+20120821045038 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F997AC0B3
+20120821045045 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F998D9B6B
+20120821045050 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F9994BB77
+20120821045059 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F99AC001B
+20120821045101 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F99AC5547
+20120821045107 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F99B86567
+20120821045110 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F99BA2677
+20120821045128 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F99EF4523
+20120821045154 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F9A419DAB
+20120821045214 2 6 100 1535 5 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F9A7D1E67
+20120821045218 2 6 100 1535 2 D1391174233D315398FE2830AC6B2B66BCCD01B0A634899F339B7879F1DB85712E9DC4E4B1C6C8355570C1D2DCB53493DF18175A9C53D1128B592B4C72D97136F5542FEB981CBFE8012FDD30361F288A42BD5EBB08BAB0A5640E1AC48763B2ABD1945FEE36B2D55E1D50A1C86CED9DD141C4E7BE2D32D9B562A0F8E2E927020E91F58B57EB9ACDDA106A59302D7E92AD5F6E851A45FA1CFE86029A0F727F65A8F475F33572E2FDAB6073F0C21B8B54C3823DB2EF068927E5D747498F9A826443
+20120821045639 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293680B09D63
+20120821045830 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C6042936814C2FFB
+20120821050046 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C60429368214FC53
+20120821050054 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C60429368218E83F
+20120821050118 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293682361D5F
+20120821050218 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C6042936828ADA17
+20120821050243 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293682A8A7CB
+20120821050427 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C60429368341AC87
+20120821050515 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C6042936837F8657
+20120821050545 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293683A3DFD3
+20120821050554 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293683A9635F
+20120821050636 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293683DF582B
+20120821050648 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293683E86803
+20120821050758 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293684495A13
+20120821050807 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C6042936844FAB5B
+20120821050849 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C60429368486D99B
+20120821050916 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293684A776A7
+20120821050942 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293684C4FF73
+20120821051003 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293684DB980F
+20120821051010 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293684DD4FBF
+20120821051158 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293685721537
+20120821051206 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293685768253
+20120821051231 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293685930F13
+20120821051240 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293685987B0B
+20120821051324 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293685D5E36B
+20120821051349 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293685F3AB7F
+20120821051424 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293686206187
+20120821051516 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C60429368668EB4B
+20120821051540 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C60429368686EB87
+20120821051622 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293686BCCF13
+20120821051703 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293686F13B9F
+20120821051715 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293686FB2D4F
+20120821051837 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C6042936876ED7DF
+20120821051843 2 6 100 2047 2 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C6042936876F05DB
+20120821051930 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293687AEDE8F
+20120821052131 2 6 100 2047 5 DD2047CBDBB6F8E919BC63DE885B34D0FD6E3DB2887D8B46FE249886ACED6B46DFCD5553168185FD376122171CD8927E60120FA8D01F01D03E58281FEA9A1ABE97631C828E41815F34FDCDF787419FE13A3137649AA93D2584230DF5F24B5C00C88B7D7DE4367693428C730376F218A53E853B0851BAB7C53C15DA7839CBE1285DB63F6FA45C1BB59FE1C5BB918F0F8459D7EF60ACFF5C0FA0F3FCAD1C5F4CE4416D4F4B36B05CDCEBE4FB879E95847EFBC6449CD190248843BC7EDB145FBFC4EDBB1A3C959298F08F3BA2CFBE231BBE204BE6F906209D28BD4820AB3E7BE96C26AE8A809ADD8D1A5A0B008E9570FA4C4697E116B8119892C604293688637CFF
+20120821053137 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF942284EA9F
+20120821053209 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF94228B7F67
+20120821053317 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF9422A2B3C7
+20120821053841 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF94232DEF87
+20120821054039 2 6 100 3071 2 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF942359AB7B
+20120821054334 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF9423A371A7
+20120821054455 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF9423C1CEEF
+20120821054844 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF9424273F1F
+20120821055307 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF9424987667
+20120821055436 2 6 100 3071 2 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF9424B90BAB
+20120821055700 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF9424F6C7CF
+20120821060224 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF94258ADCEF
+20120821060334 2 6 100 3071 2 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF9425A1FCEB
+20120821060420 2 6 100 3071 2 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF9425AEBF43
+20120821060927 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF942634C34F
+20120821061829 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF94272F0D4F
+20120821062020 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF94275B00B7
+20120821062241 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF9427941F5F
+20120821063416 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF9428D5E367
+20120821063648 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF942917E127
+20120821064052 2 6 100 3071 2 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF9429825A2B
+20120821064951 2 6 100 3071 2 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF942A74C4EB
+20120821065736 2 6 100 3071 2 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF942B4640D3
+20120821071146 2 6 100 3071 2 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF942CCD6D1B
+20120821071337 2 6 100 3071 2 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF942CF9321B
+20120821072545 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF942E48654F
+20120821075022 2 6 100 3071 2 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF9430F1B6A3
+20120821080229 2 6 100 3071 2 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF9432356F63
+20120821081230 2 6 100 3071 2 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF94333D9363
+20120821081746 2 6 100 3071 5 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF9433C6A7A7
+20120821081811 2 6 100 3071 2 DFAA35D35531E0F524F0099877A482D2AC8D589F374394A262A8E81A8A4FB2F65FADBAB395E05D147B29D486DFAA41F41597A256DA82A8B6F76401AED53D0253F956CEC610D417E42E3B287F7938FC24D8821B40BFA218A956EB7401BED6C96C68C7FD64F8170A8A76B953DD2F05420118F6B144D8FE48060A2BCB85056B478EDEF96DBC70427053ECD2958C074169E9550DD877779A3CF17C5AC850598C7586BEEA9DCFE9DD2A5FB62DF5F33EA7BC00CDA31B9D2DD721F979EA85B6E63F0C4E30BDDCD3A335522F9004C4ED50B15DC537F55324DD4FA119FB3F101467C6D7E1699DE4B3E3C478A8679B8EB3FA5C9B826B44530FD3BE9AD3063B240B0C853EBDDBD68DD940332D98F148D5D9E1DC977D60A0D23D0CA1198637FEAE4E7FAAC173AF2B84313A666CFB4EE6972811921D0AD867CE57F3BBC8D6CB057E3B66757BB46C9F72662624D44E14528327E3A7100E81A12C43C4E236118318CD90C8AA185BBB0C764826DAEAEE8DD245C5B451B4944E6122CC522D1C335C2EEF9433C94C93
+20120821084945 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA45B27D047
+20120821091240 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA45C370A33
+20120821092428 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA45CBB9FBB
+20120821093047 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA45D001E73
+20120821095420 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA45E104D6F
+20120821095624 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA45E21E2BF
+20120821102749 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA45F9B1B7B
+20120821105854 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA4610E205F
+20120821110658 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA461631FBF
+20120821110744 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA461635E3B
+20120821115206 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA4636E0DF7
+20120821121256 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA4645F38B3
+20120821121421 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA46467609B
+20120821122649 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA464F87D6B
+20120821122854 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA46508F94B
+20120821125200 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA4661CBC5B
+20120821130613 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA466BC6B33
+20120821131115 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA466ED9CC7
+20120821132817 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA467B278B3
+20120821135349 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA468D8351B
+20120821141206 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA469A817A7
+20120821144909 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA46B488EF7
+20120821150021 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA46BC5D5E7
+20120821153843 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA46D774723
+20120821162006 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA46F5488DB
+20120821170404 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA47157A067
+20120821173305 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA472A1E94B
+20120821173936 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA472E0E57F
+20120821174533 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA4731F7433
+20120821180053 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA473C7CE3F
+20120821180952 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA4742A8237
+20120821181124 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA474343C5B
+20120821183540 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA4754D89DB
+20120821183852 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA47569B47F
+20120821184512 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA475AC57DB
+20120821184603 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA475AD78CB
+20120821184701 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA475B0038F
+20120821185939 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA4763BD72F
+20120821190630 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA476853BB7
+20120821190945 2 6 100 4095 2 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA476A47843
+20120821195501 2 6 100 4095 5 EF07B0F39662DC8600224E46AB8BE8CB72E552D52E88013D20EC039A0697ED9AAD018B16F0B910D4AD54437B8585AAA4EAE0CE216E31F50EDF0CD05DAF5E02A73D399C91B38220EC3B62C42D1CF6BF06378533A70C1F8F4F4416DD542213D3432412125FDBFF7B9473CE6F8812D860E66282C9F34C1774D1EA57D54DADDF7E37A12C4A6AD5B4A30128C29D27D03B6535C0F7A8AF857E18ECAB992984E6D546918AAACB971A2AC2C2E7AF79A9547979E6342DB7443985E5F7EDF6F9F22B600EEB42CB84A5F1ACD76E213C52E3052DAE1A9119801CFA28E6EFD4F6BC35FA06C8724D78A96AF054826C0BF865D0EC5F6F4D31C1D3F7CF2FE6F16AF267A7BA04753AEF420D4D8C36BCE8D9694814B9E9C3DF468064EB5636405C71CA9D8D50D36570B42639C9C2C02FB3A3D0C6B28DD200B0AF164C621D60B12E35E4D00129C8900F6EFDBB49FF34DD64CB13CD4087A7F84FEFD77D4E8099C2B804BA643EAFCA66D1F02BD09AE44AC83A5149F60711B7B108C01D53FF15FA59B36BE62A870F163F5063CEE103B377808343AFBD32271199E26D93734011BED2305EDE2E841EAD512E23B8C9B8CD4D398C7B4C8B76B355CC150B66B8EB7779E2CA519E10E45D0FB138676850C56F23DB135F546D364B92BC1C9423E089D30D4D57D27D7885EE14AE135A488C0542C3719FBEF46F4BB5FB53A28DA26DDF84C8BC55348A8AA478A96AEF
 20120705232031 2 6 100 6143 2 EEBCAD36F686DDEB790C1EBDF6C6355A4EEB95435785FAC26C1DDBBD0D3C284AB5B4A1D5BA22131604AAE087D8B9431038CDA76DAA9E1C8D10793F53374FDF26489D38FF13188B6961B86E44A065D2FADEFC6C9496350AFA4129C9FD1B6B321E6053A6C645978C151D623C1106FE6669C220690B637F6259522F88250CC2B1B7F170706E9CE741F6E26BB4E86FB6822B13D8A7CE99FEF5CD66EF08310ECE5CC86648BD90E1DC59332505579116D3F3C8314065DC1319BEA133ED809903CA4949905C3D21619217816465E964768FFE76BC962AACBC8FF13477990A81C8759BBE95DFFA22E299F7C0F79A0EA7C44B28E8AB96149CC213E7C886E3D0A2230D7A4176749D6EDD6FCA2F5F3E2BD10392BC818CFB25C696C1EC14CE6F23CDB6C3DA2ED77E098A874799EB65F82A4EAF85CA0C9E68278381AF964AA5816B2CDA8E1ABB2954C02F641E1F374563B0F9DBF2F1B6D8168558BB971C8F48668A8034F82908D45D4D9A9072375D00AE0D5D442C6E6B6B2E7280C104C7675FDB0795DD0D3273E74BDC7B243B7604447502EB1572A273ABA0032CDB754345B1ACDF17B5AEDA45B661DBEFDA084B1427F94C8EA62BAB6A1E05DED8F2F706445879F15FB096996765238B6B546FDE5F219B5B85B31E804A989C4959600998A03572FB59DC150714BDB0C71A236497AE79871FBEFCAFFF34D2DF0142F2AF3C9C5D92F5FC7A61A27FF9AA1EADDF3552A2BED2CC4D19FB0F67DCC02744947A42FE10B338A3A8E634B413AE46C4E644DD5934D5820C9714656171A02BBCA25AED1CCD9EB9BEF9C63E7E966B0E2E47146191ECA452588FA2AFF50AF25FABAF83E143D47A651BD9B9C37CF5D6319FDCBC2F5D4B76D07B52D857FDE48FD983F06B531F7D316E2961E17D358FE6556C82C2E78C1D9CCF68760EFD8CC692E8912914781651D834C0C766B3D71C07C91AB93619E0C06385CFAC6FA18E1DEC7F3C5EE92C906CC49A4786D24CDB4F5656DE60F1F4412367B16BDA68DA368218C16E30C48366A8C0FDFA6E708E3353B8471402A42E594903774A65EA7AB5A83D08AD10D34DB38201B44B241215BB
 20120705233800 2 6 100 6143 2 EEBCAD36F686DDEB790C1EBDF6C6355A4EEB95435785FAC26C1DDBBD0D3C284AB5B4A1D5BA22131604AAE087D8B9431038CDA76DAA9E1C8D10793F53374FDF26489D38FF13188B6961B86E44A065D2FADEFC6C9496350AFA4129C9FD1B6B321E6053A6C645978C151D623C1106FE6669C220690B637F6259522F88250CC2B1B7F170706E9CE741F6E26BB4E86FB6822B13D8A7CE99FEF5CD66EF08310ECE5CC86648BD90E1DC59332505579116D3F3C8314065DC1319BEA133ED809903CA4949905C3D21619217816465E964768FFE76BC962AACBC8FF13477990A81C8759BBE95DFFA22E299F7C0F79A0EA7C44B28E8AB96149CC213E7C886E3D0A2230D7A4176749D6EDD6FCA2F5F3E2BD10392BC818CFB25C696C1EC14CE6F23CDB6C3DA2ED77E098A874799EB65F82A4EAF85CA0C9E68278381AF964AA5816B2CDA8E1ABB2954C02F641E1F374563B0F9DBF2F1B6D8168558BB971C8F48668A8034F82908D45D4D9A9072375D00AE0D5D442C6E6B6B2E7280C104C7675FDB0795DD0D3273E74BDC7B243B7604447502EB1572A273ABA0032CDB754345B1ACDF17B5AEDA45B661DBEFDA084B1427F94C8EA62BAB6A1E05DED8F2F706445879F15FB096996765238B6B546FDE5F219B5B85B31E804A989C4959600998A03572FB59DC150714BDB0C71A236497AE79871FBEFCAFFF34D2DF0142F2AF3C9C5D92F5FC7A61A27FF9AA1EADDF3552A2BED2CC4D19FB0F67DCC02744947A42FE10B338A3A8E634B413AE46C4E644DD5934D5820C9714656171A02BBCA25AED1CCD9EB9BEF9C63E7E966B0E2E47146191ECA452588FA2AFF50AF25FABAF83E143D47A651BD9B9C37CF5D6319FDCBC2F5D4B76D07B52D857FDE48FD983F06B531F7D316E2961E17D358FE6556C82C2E78C1D9CCF68760EFD8CC692E8912914781651D834C0C766B3D71C07C91AB93619E0C06385CFAC6FA18E1DEC7F3C5EE92C906CC49A4786D24CDB4F5656DE60F1F4412367B16BDA68DA368218C16E30C48366A8C0FDFA6E708E3353B8471402A42E594903774A65EA7AB5A83D08AD10D34DB38201B44B246EC93B
 20120706002709 2 6 100 6143 5 EEBCAD36F686DDEB790C1EBDF6C6355A4EEB95435785FAC26C1DDBBD0D3C284AB5B4A1D5BA22131604AAE087D8B9431038CDA76DAA9E1C8D10793F53374FDF26489D38FF13188B6961B86E44A065D2FADEFC6C9496350AFA4129C9FD1B6B321E6053A6C645978C151D623C1106FE6669C220690B637F6259522F88250CC2B1B7F170706E9CE741F6E26BB4E86FB6822B13D8A7CE99FEF5CD66EF08310ECE5CC86648BD90E1DC59332505579116D3F3C8314065DC1319BEA133ED809903CA4949905C3D21619217816465E964768FFE76BC962AACBC8FF13477990A81C8759BBE95DFFA22E299F7C0F79A0EA7C44B28E8AB96149CC213E7C886E3D0A2230D7A4176749D6EDD6FCA2F5F3E2BD10392BC818CFB25C696C1EC14CE6F23CDB6C3DA2ED77E098A874799EB65F82A4EAF85CA0C9E68278381AF964AA5816B2CDA8E1ABB2954C02F641E1F374563B0F9DBF2F1B6D8168558BB971C8F48668A8034F82908D45D4D9A9072375D00AE0D5D442C6E6B6B2E7280C104C7675FDB0795DD0D3273E74BDC7B243B7604447502EB1572A273ABA0032CDB754345B1ACDF17B5AEDA45B661DBEFDA084B1427F94C8EA62BAB6A1E05DED8F2F706445879F15FB096996765238B6B546FDE5F219B5B85B31E804A989C4959600998A03572FB59DC150714BDB0C71A236497AE79871FBEFCAFFF34D2DF0142F2AF3C9C5D92F5FC7A61A27FF9AA1EADDF3552A2BED2CC4D19FB0F67DCC02744947A42FE10B338A3A8E634B413AE46C4E644DD5934D5820C9714656171A02BBCA25AED1CCD9EB9BEF9C63E7E966B0E2E47146191ECA452588FA2AFF50AF25FABAF83E143D47A651BD9B9C37CF5D6319FDCBC2F5D4B76D07B52D857FDE48FD983F06B531F7D316E2961E17D358FE6556C82C2E78C1D9CCF68760EFD8CC692E8912914781651D834C0C766B3D71C07C91AB93619E0C06385CFAC6FA18E1DEC7F3C5EE92C906CC49A4786D24CDB4F5656DE60F1F4412367B16BDA68DA368218C16E30C48366A8C0FDFA6E708E3353B8471402A42E594903774A65EA7AB5A83D08AD10D34DB38201B44B2582B477
diff --git a/moduli.0 b/moduli.0
index bf510de32..77dfa4295 100644
--- a/moduli.0
+++ b/moduli.0
@@ -25,7 +25,7 @@ DESCRIPTION
 
                         0     Unknown, not tested.
                         2     "Safe" prime; (p-1)/2 is also prime.
-                        4     Sophie Germain; (p+1)*2 is also prime.
+                        4     Sophie Germain; 2p+1 is also prime.
 
                         Moduli candidates initially produced by ssh-keygen(1)
                         are Sophie Germain primes (type 4).  Further primality
@@ -66,7 +66,9 @@ DESCRIPTION
 SEE ALSO
      ssh-keygen(1), sshd(8)
 
-     Diffie-Hellman Group Exchange for the Secure Shell (SSH) Transport Layer
-     Protocol, RFC 4419, 2006.
+STANDARDS
+     M. Friedl, N. Provos, and W. Simpson, Diffie-Hellman Group Exchange for
+     the Secure Shell (SSH) Transport Layer Protocol, RFC 4419, March 2006,
+     2006.
 
-OpenBSD 5.2                    October 14, 2010                    OpenBSD 5.2
+OpenBSD 5.3                   September 26, 2012                   OpenBSD 5.3
diff --git a/moduli.5 b/moduli.5
index 097abc109..149846c8c 100644
--- a/moduli.5
+++ b/moduli.5
@@ -1,4 +1,4 @@
-.\"     $OpenBSD: moduli.5,v 1.15 2010/10/14 20:41:28 jmc Exp $
+.\"     $OpenBSD: moduli.5,v 1.17 2012/09/26 17:34:38 jmc Exp $
 .\"
 .\" Copyright (c) 2008 Damien Miller <djm@mindrot.org>
 .\"
@@ -13,7 +13,7 @@
 .\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-.Dd $Mdocdate: October 14 2010 $
+.Dd $Mdocdate: September 26 2012 $
 .Dt MODULI 5
 .Os
 .Sh NAME
@@ -61,7 +61,7 @@ Unknown, not tested.
 .It 2
 "Safe" prime; (p-1)/2 is also prime.
 .It 4
-Sophie Germain; (p+1)*2 is also prime.
+Sophie Germain; 2p+1 is also prime.
 .El
 .Pp
 Moduli candidates initially produced by
@@ -115,8 +115,13 @@ that best meets the size requirement.
 .Sh SEE ALSO
 .Xr ssh-keygen 1 ,
 .Xr sshd 8
+.Sh STANDARDS
 .Rs
+.%A M. Friedl
+.%A N. Provos
+.%A W. Simpson
+.%D March 2006
 .%R RFC 4419
-.%T "Diffie-Hellman Group Exchange for the Secure Shell (SSH) Transport Layer Protocol"
+.%T Diffie-Hellman Group Exchange for the Secure Shell (SSH) Transport Layer Protocol
 .%D 2006
 .Re
diff --git a/monitor.c b/monitor.c
index a5d1c5ba1..9b08020ca 100644
--- a/monitor.c
+++ b/monitor.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor.c,v 1.117 2012/06/22 12:30:26 dtucker Exp $ */
+/* $OpenBSD: monitor.c,v 1.120 2012/12/11 22:16:21 markus Exp $ */
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
  * Copyright 2002 Markus Friedl <markus@openbsd.org>
@@ -209,6 +209,7 @@ static int key_blobtype = MM_NOKEY;
 static char *hostbased_cuser = NULL;
 static char *hostbased_chost = NULL;
 static char *auth_method = "unknown";
+static char *auth_submethod = NULL;
 static u_int session_id2_len = 0;
 static u_char *session_id2 = NULL;
 static pid_t monitor_child_pid;
@@ -376,7 +377,7 @@ void
 monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
 {
         struct mon_table *ent;
-        int authenticated = 0;
+        int authenticated = 0, partial = 0;
 
         debug3("preauth child monitor started");
 
@@ -407,8 +408,26 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
 
         /* The first few requests do not require asynchronous access */
         while (!authenticated) {
+                partial = 0;
                 auth_method = "unknown";
+                auth_submethod = NULL;
                 authenticated = (monitor_read(pmonitor, mon_dispatch, &ent) == 1);
+
+                /* Special handling for multiple required authentications */
+                if (options.num_auth_methods != 0) {
+                        if (!compat20)
+                                fatal("AuthenticationMethods is not supported"
+                                    "with SSH protocol 1");
+                        if (authenticated &&
+                            !auth2_update_methods_lists(authctxt,
+                            auth_method)) {
+                                debug3("%s: method %s: partial", __func__,
+                                    auth_method);
+                                authenticated = 0;
+                                partial = 1;
+                        }
+                }
+
                 if (authenticated) {
                         if (!(ent->flags & MON_AUTHDECIDE))
                                 fatal("%s: unexpected authentication from %d",
@@ -429,9 +448,9 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
                         }
 #endif
                 }
-
                 if (ent->flags & (MON_AUTHDECIDE|MON_ALOG)) {
-                        auth_log(authctxt, authenticated, auth_method,
+                        auth_log(authctxt, authenticated, partial,
+                            auth_method, auth_submethod,
                             compat20 ? " ssh2" : "");
                         if (!authenticated)
                                 authctxt->failures++;
@@ -447,10 +466,6 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
 #endif
         }
 
-        /* Drain any buffered messages from the child */
-        while (pmonitor->m_log_recvfd != -1 && monitor_read_log(pmonitor) == 0)
-                ;
-
         if (!authctxt->valid)
                 fatal("%s: authenticated invalid user", __func__);
         if (strcmp(auth_method, "unknown") == 0)
@@ -461,6 +476,10 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
 
         mm_get_keystate(pmonitor);
 
+        /* Drain any buffered messages from the child */
+        while (pmonitor->m_log_recvfd != -1 && monitor_read_log(pmonitor) == 0)
+                ;
+
         close(pmonitor->m_sendfd);
         close(pmonitor->m_log_recvfd);
         pmonitor->m_sendfd = pmonitor->m_log_recvfd = -1;
@@ -816,7 +835,17 @@ mm_answer_pwnamallow(int sock, Buffer *m)
         COPY_MATCH_STRING_OPTS();
 #undef M_CP_STROPT
 #undef M_CP_STRARRAYOPT
-        
+
+        /* Create valid auth method lists */
+        if (compat20 && auth2_setup_methods_lists(authctxt) != 0) {
+                /*
+                 * The monitor will continue long enough to let the child
+                 * run to it's packet_disconnect(), but it must not allow any
+                 * authentication to succeed.
+                 */
+                debug("%s: no valid authentication method lists", __func__);
+        }
+
         debug3("%s: sending MONITOR_ANS_PWNAM: %d", __func__, allowed);
         mm_request_send(sock, MONITOR_ANS_PWNAM, m);
 
@@ -977,7 +1006,10 @@ mm_answer_bsdauthrespond(int sock, Buffer *m)
         debug3("%s: sending authenticated: %d", __func__, authok);
         mm_request_send(sock, MONITOR_ANS_BSDAUTHRESPOND, m);
 
-        auth_method = "bsdauth";
+        if (compat20)
+                auth_method = "keyboard-interactive"; /* XXX auth_submethod */
+        else
+                auth_method = "bsdauth";
 
         return (authok != 0);
 }
@@ -1116,7 +1148,8 @@ mm_answer_pam_query(int sock, Buffer *m)
                 xfree(prompts);
         if (echo_on != NULL)
                 xfree(echo_on);
-        auth_method = "keyboard-interactive/pam";
+        auth_method = "keyboard-interactive";
+        auth_submethod = "pam";
         mm_request_send(sock, MONITOR_ANS_PAM_QUERY, m);
         return (0);
 }
@@ -1145,7 +1178,8 @@ mm_answer_pam_respond(int sock, Buffer *m)
         buffer_clear(m);
         buffer_put_int(m, ret);
         mm_request_send(sock, MONITOR_ANS_PAM_RESPOND, m);
-        auth_method = "keyboard-interactive/pam";
+        auth_method = "keyboard-interactive";
+        auth_submethod = "pam";
         if (ret == 0)
                 sshpam_authok = sshpam_ctxt;
         return (0);
@@ -1159,7 +1193,8 @@ mm_answer_pam_free_ctx(int sock, Buffer *m)
         (sshpam_device.free_ctx)(sshpam_ctxt);
         buffer_clear(m);
         mm_request_send(sock, MONITOR_ANS_PAM_FREE_CTX, m);
-        auth_method = "keyboard-interactive/pam";
+        auth_method = "keyboard-interactive";
+        auth_submethod = "pam";
         return (sshpam_authok == sshpam_ctxt);
 }
 #endif
@@ -1233,7 +1268,8 @@ mm_answer_keyallowed(int sock, Buffer *m)
                 hostbased_chost = chost;
         } else {
                 /* Log failed attempt */
-                auth_log(authctxt, 0, auth_method, compat20 ? " ssh2" : "");
+                auth_log(authctxt, 0, 0, auth_method, NULL,
+                    compat20 ? " ssh2" : "");
                 xfree(blob);
                 xfree(cuser);
                 xfree(chost);
diff --git a/monitor.h b/monitor.h
index 15a38c347..504daa79a 100644
--- a/monitor.h
+++ b/monitor.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor.h,v 1.16 2011/06/17 21:44:31 djm Exp $ */
+/* $OpenBSD: monitor.h,v 1.17 2012/12/02 20:34:10 djm Exp $ */
 
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
@@ -28,47 +28,55 @@
 #ifndef _MONITOR_H_
 #define _MONITOR_H_
 
+/* Please keep *_REQ_* values on even numbers and *_ANS_* on odd numbers */
 enum monitor_reqtype {
-        MONITOR_REQ_MODULI, MONITOR_ANS_MODULI,
-        MONITOR_REQ_FREE, MONITOR_REQ_AUTHSERV, MONITOR_REQ_AUTHROLE,
-        MONITOR_REQ_SIGN, MONITOR_ANS_SIGN,
-        MONITOR_REQ_PWNAM, MONITOR_ANS_PWNAM,
-        MONITOR_REQ_AUTH2_READ_BANNER, MONITOR_ANS_AUTH2_READ_BANNER,
-        MONITOR_REQ_AUTHPASSWORD, MONITOR_ANS_AUTHPASSWORD,
-        MONITOR_REQ_BSDAUTHQUERY, MONITOR_ANS_BSDAUTHQUERY,
-        MONITOR_REQ_BSDAUTHRESPOND, MONITOR_ANS_BSDAUTHRESPOND,
-        MONITOR_REQ_SKEYQUERY, MONITOR_ANS_SKEYQUERY,
-        MONITOR_REQ_SKEYRESPOND, MONITOR_ANS_SKEYRESPOND,
-        MONITOR_REQ_KEYALLOWED, MONITOR_ANS_KEYALLOWED,
-        MONITOR_REQ_KEYVERIFY, MONITOR_ANS_KEYVERIFY,
-        MONITOR_REQ_KEYEXPORT,
-        MONITOR_REQ_PTY, MONITOR_ANS_PTY,
-        MONITOR_REQ_PTYCLEANUP,
-        MONITOR_REQ_SESSKEY, MONITOR_ANS_SESSKEY,
-        MONITOR_REQ_SESSID,
-        MONITOR_REQ_RSAKEYALLOWED, MONITOR_ANS_RSAKEYALLOWED,
-        MONITOR_REQ_RSACHALLENGE, MONITOR_ANS_RSACHALLENGE,
-        MONITOR_REQ_RSARESPONSE, MONITOR_ANS_RSARESPONSE,
-        MONITOR_REQ_GSSSETUP, MONITOR_ANS_GSSSETUP,
-        MONITOR_REQ_GSSSTEP, MONITOR_ANS_GSSSTEP,
-        MONITOR_REQ_GSSUSEROK, MONITOR_ANS_GSSUSEROK,
-        MONITOR_REQ_GSSCHECKMIC, MONITOR_ANS_GSSCHECKMIC,
-        MONITOR_REQ_GSSSIGN, MONITOR_ANS_GSSSIGN,
-        MONITOR_REQ_GSSUPCREDS, MONITOR_ANS_GSSUPCREDS,
-        MONITOR_REQ_PAM_START,
-        MONITOR_REQ_PAM_ACCOUNT, MONITOR_ANS_PAM_ACCOUNT,
-        MONITOR_REQ_PAM_INIT_CTX, MONITOR_ANS_PAM_INIT_CTX,
-        MONITOR_REQ_PAM_QUERY, MONITOR_ANS_PAM_QUERY,
-        MONITOR_REQ_PAM_RESPOND, MONITOR_ANS_PAM_RESPOND,
-        MONITOR_REQ_PAM_FREE_CTX, MONITOR_ANS_PAM_FREE_CTX,
-        MONITOR_REQ_AUDIT_EVENT, MONITOR_REQ_AUDIT_COMMAND,
-        MONITOR_REQ_CONSOLEKIT_REGISTER, MONITOR_ANS_CONSOLEKIT_REGISTER,
-        MONITOR_REQ_TERM,
-        MONITOR_REQ_JPAKE_STEP1, MONITOR_ANS_JPAKE_STEP1,
-        MONITOR_REQ_JPAKE_GET_PWDATA, MONITOR_ANS_JPAKE_GET_PWDATA,
-        MONITOR_REQ_JPAKE_STEP2, MONITOR_ANS_JPAKE_STEP2,
-        MONITOR_REQ_JPAKE_KEY_CONFIRM, MONITOR_ANS_JPAKE_KEY_CONFIRM,
-        MONITOR_REQ_JPAKE_CHECK_CONFIRM, MONITOR_ANS_JPAKE_CHECK_CONFIRM,
+        MONITOR_REQ_MODULI = 0, MONITOR_ANS_MODULI = 1,
+        MONITOR_REQ_FREE = 2,
+        MONITOR_REQ_AUTHSERV = 4,
+        MONITOR_REQ_SIGN = 6, MONITOR_ANS_SIGN = 7,
+        MONITOR_REQ_PWNAM = 8, MONITOR_ANS_PWNAM = 9,
+        MONITOR_REQ_AUTH2_READ_BANNER = 10, MONITOR_ANS_AUTH2_READ_BANNER = 11,
+        MONITOR_REQ_AUTHPASSWORD = 12, MONITOR_ANS_AUTHPASSWORD = 13,
+        MONITOR_REQ_BSDAUTHQUERY = 14, MONITOR_ANS_BSDAUTHQUERY = 15,
+        MONITOR_REQ_BSDAUTHRESPOND = 16, MONITOR_ANS_BSDAUTHRESPOND = 17,
+        MONITOR_REQ_SKEYQUERY = 18, MONITOR_ANS_SKEYQUERY = 19,
+        MONITOR_REQ_SKEYRESPOND = 20, MONITOR_ANS_SKEYRESPOND = 21,
+        MONITOR_REQ_KEYALLOWED = 22, MONITOR_ANS_KEYALLOWED = 23,
+        MONITOR_REQ_KEYVERIFY = 24, MONITOR_ANS_KEYVERIFY = 25,
+        MONITOR_REQ_KEYEXPORT = 26,
+        MONITOR_REQ_PTY = 28, MONITOR_ANS_PTY = 29,
+        MONITOR_REQ_PTYCLEANUP = 30,
+        MONITOR_REQ_SESSKEY = 32, MONITOR_ANS_SESSKEY = 33,
+        MONITOR_REQ_SESSID = 34,
+        MONITOR_REQ_RSAKEYALLOWED = 36, MONITOR_ANS_RSAKEYALLOWED = 37,
+        MONITOR_REQ_RSACHALLENGE = 38, MONITOR_ANS_RSACHALLENGE = 39,
+        MONITOR_REQ_RSARESPONSE = 40, MONITOR_ANS_RSARESPONSE = 41,
+        MONITOR_REQ_GSSSETUP = 42, MONITOR_ANS_GSSSETUP = 43,
+        MONITOR_REQ_GSSSTEP = 44, MONITOR_ANS_GSSSTEP = 45,
+        MONITOR_REQ_GSSUSEROK = 46, MONITOR_ANS_GSSUSEROK = 47,
+        MONITOR_REQ_GSSCHECKMIC = 48, MONITOR_ANS_GSSCHECKMIC = 49,
+        MONITOR_REQ_TERM = 50,
+        MONITOR_REQ_JPAKE_STEP1 = 52, MONITOR_ANS_JPAKE_STEP1 = 53,
+        MONITOR_REQ_JPAKE_GET_PWDATA = 54, MONITOR_ANS_JPAKE_GET_PWDATA = 55,
+        MONITOR_REQ_JPAKE_STEP2 = 56, MONITOR_ANS_JPAKE_STEP2 = 57,
+        MONITOR_REQ_JPAKE_KEY_CONFIRM = 58, MONITOR_ANS_JPAKE_KEY_CONFIRM = 59,
+        MONITOR_REQ_JPAKE_CHECK_CONFIRM = 60, MONITOR_ANS_JPAKE_CHECK_CONFIRM = 61,
+
+        MONITOR_REQ_PAM_START = 100,
+        MONITOR_REQ_PAM_ACCOUNT = 102, MONITOR_ANS_PAM_ACCOUNT = 103,
+        MONITOR_REQ_PAM_INIT_CTX = 104, MONITOR_ANS_PAM_INIT_CTX = 105,
+        MONITOR_REQ_PAM_QUERY = 106, MONITOR_ANS_PAM_QUERY = 107,
+        MONITOR_REQ_PAM_RESPOND = 108, MONITOR_ANS_PAM_RESPOND = 109,
+        MONITOR_REQ_PAM_FREE_CTX = 110, MONITOR_ANS_PAM_FREE_CTX = 111,
+        MONITOR_REQ_AUDIT_EVENT = 112, MONITOR_REQ_AUDIT_COMMAND = 113,
+
+        MONITOR_REQ_GSSSIGN = 200, MONITOR_ANS_GSSSIGN = 201,
+        MONITOR_REQ_GSSUPCREDS = 202, MONITOR_ANS_GSSUPCREDS = 203,
+
+        MONITOR_REQ_AUTHROLE = 300,
+
+        MONITOR_REQ_CONSOLEKIT_REGISTER = 400, MONITOR_ANS_CONSOLEKIT_REGISTER = 401,
+
 };
 
 struct mm_master;
diff --git a/monitor_wrap.c b/monitor_wrap.c
index b758c9f72..8cc76b380 100644
--- a/monitor_wrap.c
+++ b/monitor_wrap.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor_wrap.c,v 1.73 2011/06/17 21:44:31 djm Exp $ */
+/* $OpenBSD: monitor_wrap.c,v 1.75 2013/01/08 18:49:04 markus Exp $ */
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
  * Copyright 2002 Markus Friedl <markus@openbsd.org>
@@ -509,25 +509,24 @@ mm_newkeys_from_blob(u_char *blob, int blen)
         enc->enabled = buffer_get_int(&b);
         enc->block_size = buffer_get_int(&b);
         enc->key = buffer_get_string(&b, &enc->key_len);
-        enc->iv = buffer_get_string(&b, &len);
-        if (len != enc->block_size)
-                fatal("%s: bad ivlen: expected %u != %u", __func__,
-                    enc->block_size, len);
+        enc->iv = buffer_get_string(&b, &enc->iv_len);
 
         if (enc->name == NULL || cipher_by_name(enc->name) != enc->cipher)
                 fatal("%s: bad cipher name %s or pointer %p", __func__,
                     enc->name, enc->cipher);
 
         /* Mac structure */
-        mac->name = buffer_get_string(&b, NULL);
-        if (mac->name == NULL || mac_setup(mac, mac->name) == -1)
-                fatal("%s: can not setup mac %s", __func__, mac->name);
-        mac->enabled = buffer_get_int(&b);
-        mac->key = buffer_get_string(&b, &len);
-        if (len > mac->key_len)
-                fatal("%s: bad mac key length: %u > %d", __func__, len,
-                    mac->key_len);
-        mac->key_len = len;
+        if (cipher_authlen(enc->cipher) == 0) {
+                mac->name = buffer_get_string(&b, NULL);
+                if (mac->name == NULL || mac_setup(mac, mac->name) == -1)
+                        fatal("%s: can not setup mac %s", __func__, mac->name);
+                mac->enabled = buffer_get_int(&b);
+                mac->key = buffer_get_string(&b, &len);
+                if (len > mac->key_len)
+                        fatal("%s: bad mac key length: %u > %d", __func__, len,
+                            mac->key_len);
+                mac->key_len = len;
+        }
 
         /* Comp structure */
         comp->type = buffer_get_int(&b);
@@ -569,13 +568,15 @@ mm_newkeys_to_blob(int mode, u_char **blobp, u_int *lenp)
         buffer_put_int(&b, enc->enabled);
         buffer_put_int(&b, enc->block_size);
         buffer_put_string(&b, enc->key, enc->key_len);
-        packet_get_keyiv(mode, enc->iv, enc->block_size);
-        buffer_put_string(&b, enc->iv, enc->block_size);
+        packet_get_keyiv(mode, enc->iv, enc->iv_len);
+        buffer_put_string(&b, enc->iv, enc->iv_len);
 
         /* Mac structure */
-        buffer_put_cstring(&b, mac->name);
-        buffer_put_int(&b, mac->enabled);
-        buffer_put_string(&b, mac->key, mac->key_len);
+        if (cipher_authlen(enc->cipher) == 0) {
+                buffer_put_cstring(&b, mac->name);
+                buffer_put_int(&b, mac->enabled);
+                buffer_put_string(&b, mac->key, mac->key_len);
+        }
 
         /* Comp structure */
         buffer_put_int(&b, comp->type);
@@ -639,7 +640,7 @@ mm_send_keystate(struct monitor *monitor)
                 ivlen = packet_get_keyiv_len(MODE_OUT);
                 packet_get_keyiv(MODE_OUT, iv, ivlen);
                 buffer_put_string(&m, iv, ivlen);
-                ivlen = packet_get_keyiv_len(MODE_OUT);
+                ivlen = packet_get_keyiv_len(MODE_IN);
                 packet_get_keyiv(MODE_IN, iv, ivlen);
                 buffer_put_string(&m, iv, ivlen);
                 goto skip;
diff --git a/mux.c b/mux.c
index 5e0e65ff3..1ae0e0915 100644
--- a/mux.c
+++ b/mux.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: mux.c,v 1.36 2012/07/06 01:37:21 djm Exp $ */
+/* $OpenBSD: mux.c,v 1.38 2013/01/02 00:32:07 djm Exp $ */
 /*
  * Copyright (c) 2002-2008 Damien Miller <djm@openbsd.org>
  *
@@ -63,10 +63,6 @@
 # include <util.h>
 #endif
 
-#ifdef HAVE_LIBUTIL_H
-# include <libutil.h>
-#endif
-
 #include "openbsd-compat/sys-queue.h"
 #include "xmalloc.h"
 #include "log.h"
@@ -188,7 +184,7 @@ static const struct {
 
 /* Cleanup callback fired on closure of mux slave _session_ channel */
 /* ARGSUSED */
-static void
+void
 mux_master_session_cleanup_cb(int cid, void *unused)
 {
         Channel *cc, *c = channel_by_id(cid);
@@ -738,9 +734,9 @@ process_mux_open_fwd(u_int rid, Channel *c, Buffer *m, Buffer *r)
         }
 
         if (ftype == MUX_FWD_LOCAL || ftype == MUX_FWD_DYNAMIC) {
-                if (channel_setup_local_fwd_listener(fwd.listen_host,
+                if (!channel_setup_local_fwd_listener(fwd.listen_host,
                     fwd.listen_port, fwd.connect_host, fwd.connect_port,
-                    options.gateway_ports) < 0) {
+                    options.gateway_ports)) {
  fail:
                         logit("slave-requested %s failed", fwd_desc);
                         buffer_put_int(r, MUX_S_FAILURE);
diff --git a/myproposal.h b/myproposal.h
index b9b819c0a..99d093461 100644
--- a/myproposal.h
+++ b/myproposal.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: myproposal.h,v 1.29 2012/06/28 05:07:45 dtucker Exp $ */
+/* $OpenBSD: myproposal.h,v 1.32 2013/01/08 18:49:04 markus Exp $ */
 
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
@@ -73,6 +73,7 @@
 #define KEX_DEFAULT_ENCRYPT \
         "aes128-ctr,aes192-ctr,aes256-ctr," \
         "arcfour256,arcfour128," \
+        "aes128-gcm@openssh.com,aes256-gcm@openssh.com," \
         "aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc," \
         "aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se"
 #ifdef HAVE_EVP_SHA256
@@ -83,9 +84,19 @@
 # define SHA2_HMAC_MODES
 #endif
 #define KEX_DEFAULT_MAC \
+        "hmac-md5-etm@openssh.com," \
+        "hmac-sha1-etm@openssh.com," \
+        "umac-64-etm@openssh.com," \
+        "umac-128-etm@openssh.com," \
+        "hmac-sha2-256-etm@openssh.com," \
+        "hmac-sha2-512-etm@openssh.com," \
+        "hmac-ripemd160-etm@openssh.com," \
+        "hmac-sha1-96-etm@openssh.com," \
+        "hmac-md5-96-etm@openssh.com," \
         "hmac-md5," \
         "hmac-sha1," \
         "umac-64@openssh.com," \
+        "umac-128@openssh.com," \
         SHA2_HMAC_MODES \
         "hmac-ripemd160," \
         "hmac-ripemd160@openssh.com," \
diff --git a/openbsd-compat/Makefile.in b/openbsd-compat/Makefile.in
index 196a81d13..e1c3651e8 100644
--- a/openbsd-compat/Makefile.in
+++ b/openbsd-compat/Makefile.in
@@ -1,4 +1,4 @@
-# $Id: Makefile.in,v 1.48 2011/11/04 00:25:25 dtucker Exp $
+# $Id: Makefile.in,v 1.50 2013/02/15 01:13:02 dtucker Exp $
 
 sysconfdir=@sysconfdir@
 piddir=@piddir@
@@ -16,9 +16,9 @@ RANLIB=@RANLIB@
 INSTALL=@INSTALL@
 LDFLAGS=-L. @LDFLAGS@
 
-OPENBSD=base64.o basename.o bindresvport.o daemon.o dirname.o fmt_scaled.o getcwd.o getgrouplist.o getopt.o getrrsetbyname.o glob.o inet_aton.o inet_ntoa.o inet_ntop.o mktemp.o pwcache.o readpassphrase.o realpath.o rresvport.o setenv.o setproctitle.o sha2.o sigact.o strlcat.o strlcpy.o strmode.o strnlen.o strptime.o strsep.o strtonum.o strtoll.o strtoul.o timingsafe_bcmp.o vis.o
+OPENBSD=base64.o basename.o bindresvport.o daemon.o dirname.o fmt_scaled.o getcwd.o getgrouplist.o getopt.o getrrsetbyname.o glob.o inet_aton.o inet_ntoa.o inet_ntop.o mktemp.o pwcache.o readpassphrase.o realpath.o rresvport.o setenv.o setproctitle.o sha2.o sigact.o strlcat.o strlcpy.o strmode.o strnlen.o strptime.o strsep.o strtonum.o strtoll.o strtoul.o strtoull.o timingsafe_bcmp.o vis.o
 
-COMPAT=bsd-arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o getrrsetbyname-ldns.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-snprintf.o bsd-statvfs.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o
+COMPAT=bsd-arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o getrrsetbyname-ldns.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-setres_id.o bsd-snprintf.o bsd-statvfs.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o
 
 PORTS=port-aix.o port-irix.o port-linux.o port-solaris.o port-tun.o port-uw.o
 
diff --git a/openbsd-compat/bsd-misc.c b/openbsd-compat/bsd-misc.c
index 3ef373f56..d75854e83 100644
--- a/openbsd-compat/bsd-misc.c
+++ b/openbsd-compat/bsd-misc.c
@@ -165,6 +165,17 @@ int nanosleep(const struct timespec *req, struct timespec *rem)
 }
 #endif
 
+#if !defined(HAVE_USLEEP)
+int usleep(unsigned int useconds)
+{
+        struct timespec ts;
+
+        ts.tv_sec = useconds / 1000000;
+        ts.tv_nsec = (useconds % 1000000) * 1000;
+        return nanosleep(&ts, NULL);
+}
+#endif
+
 #ifndef HAVE_TCGETPGRP
 pid_t
 tcgetpgrp(int fd)
@@ -242,8 +253,25 @@ strdup(const char *str)
 #endif
 
 #ifndef HAVE_ISBLANK
-int isblank(int c)
+int
+isblank(int c)
 {
         return (c == ' ' || c == '\t');
 }
 #endif
+
+#ifndef HAVE_GETPGID
+pid_t
+getpgid(pid_t pid)
+{
+#if defined(HAVE_GETPGRP) && !defined(GETPGRP_VOID)
+        return getpgrp(pid);
+#elif defined(HAVE_GETPGRP)
+        if (pid == 0)
+                return getpgrp();
+#endif
+
+        errno = ESRCH;
+        return -1;
+}
+#endif
diff --git a/openbsd-compat/bsd-misc.h b/openbsd-compat/bsd-misc.h
index eac5217ca..430066376 100644
--- a/openbsd-compat/bsd-misc.h
+++ b/openbsd-compat/bsd-misc.h
@@ -1,4 +1,4 @@
-/* $Id: bsd-misc.h,v 1.21 2012/07/03 22:50:10 dtucker Exp $ */
+/* $Id: bsd-misc.h,v 1.23 2013/03/14 23:34:27 djm Exp $ */
 
 /*
  * Copyright (c) 1999-2004 Damien Miller <djm@mindrot.org>
@@ -80,6 +80,10 @@ struct timespec {
 int nanosleep(const struct timespec *, struct timespec *);
 #endif
 
+#ifndef HAVE_USLEEP
+int usleep(unsigned int useconds);
+#endif
+
 #ifndef HAVE_TCGETPGRP
 pid_t tcgetpgrp(int);
 #endif
@@ -102,4 +106,8 @@ mysig_t mysignal(int sig, mysig_t act);
 int     isblank(int);
 #endif
 
+#ifndef HAVE_GETPGID
+pid_t getpgid(pid_t);
+#endif
+
 #endif /* _BSD_MISC_H */
diff --git a/openbsd-compat/bsd-setres_id.c b/openbsd-compat/bsd-setres_id.c
new file mode 100644
index 000000000..020b214b8
--- /dev/null
+++ b/openbsd-compat/bsd-setres_id.c
@@ -0,0 +1,99 @@
+/* $Id: bsd-setres_id.c,v 1.1 2012/11/05 06:04:37 dtucker Exp $ */
+
+/*
+ * Copyright (c) 2012 Darren Tucker (dtucker at zip com au).
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "includes.h"
+
+#include <sys/types.h>
+
+#include <stdarg.h>
+#include <unistd.h>
+
+#include "log.h"
+
+#if !defined(HAVE_SETRESGID) || defined(BROKEN_SETRESGID)
+int
+setresgid(gid_t rgid, gid_t egid, gid_t sgid)
+{
+        int ret = 0, saved_errno;
+
+        if (rgid != sgid) {
+                errno = ENOSYS;
+                return -1;
+        }
+#if defined(HAVE_SETREGID) && !defined(BROKEN_SETREGID)
+        if (setregid(rgid, egid) < 0) {
+                saved_errno = errno;
+                error("setregid %u: %.100s", rgid, strerror(errno));
+                errno = saved_errno;
+                ret = -1;
+        }
+#else
+        if (setegid(egid) < 0) {
+                saved_errno = errno;
+                error("setegid %u: %.100s", (u_int)egid, strerror(errno));
+                errno = saved_errno;
+                ret = -1;
+        }
+        if (setgid(rgid) < 0) {
+                saved_errno = errno;
+                error("setgid %u: %.100s", rgid, strerror(errno));
+                errno = saved_errno;
+                ret = -1;
+        }
+#endif
+        return ret;
+}
+#endif
+
+#if !defined(HAVE_SETRESUID) || defined(BROKEN_SETRESUID)
+int
+setresuid(uid_t ruid, uid_t euid, uid_t suid)
+{
+        int ret = 0, saved_errno;
+
+        if (ruid != suid) {
+                errno = ENOSYS;
+                return -1;
+        }
+#if defined(HAVE_SETREUID) && !defined(BROKEN_SETREUID)
+        if (setreuid(ruid, euid) < 0) {
+                saved_errno = errno;
+                error("setreuid %u: %.100s", ruid, strerror(errno));
+                errno = saved_errno;
+                ret = -1;
+        }
+#else
+
+# ifndef SETEUID_BREAKS_SETUID
+        if (seteuid(euid) < 0) {
+                saved_errno = errno;
+                error("seteuid %u: %.100s", euid, strerror(errno));
+                errno = saved_errno;
+                ret = -1;
+        }
+# endif
+        if (setuid(ruid) < 0) {
+                saved_errno = errno;
+                error("setuid %u: %.100s", ruid, strerror(errno));
+                errno = saved_errno;
+                ret = -1;
+        }
+#endif
+        return ret;
+}
+#endif
diff --git a/openbsd-compat/bsd-setres_id.h b/openbsd-compat/bsd-setres_id.h
new file mode 100644
index 000000000..6c269e0b9
--- /dev/null
+++ b/openbsd-compat/bsd-setres_id.h
@@ -0,0 +1,24 @@
+/* $Id: bsd-setres_id.h,v 1.1 2012/11/05 06:04:37 dtucker Exp $ */
+
+/*
+ * Copyright (c) 2012 Darren Tucker (dtucker at zip com au).
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef HAVE_SETRESGID
+int     setresgid(gid_t, gid_t, gid_t);
+#endif
+#ifndef HAVE_SETRESUID
+int     setresuid(uid_t, uid_t, uid_t);
+#endif
diff --git a/openbsd-compat/openbsd-compat.h b/openbsd-compat/openbsd-compat.h
index 807acf626..a8c579f49 100644
--- a/openbsd-compat/openbsd-compat.h
+++ b/openbsd-compat/openbsd-compat.h
@@ -1,4 +1,4 @@
-/* $Id: openbsd-compat.h,v 1.52 2011/09/23 01:16:11 djm Exp $ */
+/* $Id: openbsd-compat.h,v 1.55 2013/02/15 01:20:42 dtucker Exp $ */
 
 /*
  * Copyright (c) 1999-2003 Damien Miller.  All rights reserved.
@@ -149,6 +149,7 @@ int writev(int, struct iovec *, int);
 
 /* Home grown routines */
 #include "bsd-misc.h"
+#include "bsd-setres_id.h"
 #include "bsd-statvfs.h"
 #include "bsd-waitpid.h"
 #include "bsd-poll.h"
@@ -189,6 +190,14 @@ int snprintf(char *, size_t, SNPRINTF_CONST char *, ...);
 long long strtoll(const char *, char **, int);
 #endif
 
+#ifndef HAVE_STRTOUL
+unsigned long strtoul(const char *, char **, int);
+#endif
+
+#ifndef HAVE_STRTOULL
+unsigned long long strtoull(const char *, char **, int);
+#endif
+
 #ifndef HAVE_STRTONUM
 long long strtonum(const char *, long long, long long, const char **);
 #endif
diff --git a/openbsd-compat/openssl-compat.h b/openbsd-compat/openssl-compat.h
index a151eff38..e7439b4e7 100644
--- a/openbsd-compat/openssl-compat.h
+++ b/openbsd-compat/openssl-compat.h
@@ -1,4 +1,4 @@
-/* $Id: openssl-compat.h,v 1.20 2012/01/17 03:03:39 dtucker Exp $ */
+/* $Id: openssl-compat.h,v 1.24 2013/02/12 00:00:40 djm Exp $ */
 
 /*
  * Copyright (c) 2005 Darren Tucker <dtucker@zip.com.au>
@@ -40,7 +40,7 @@
 # define EVP_CIPHER_CTX_get_app_data(e)         ((e)->app_data)
 #endif
 
-#if OPENSSL_VERSION_NUMBER < 0x1000000fL
+#if OPENSSL_VERSION_NUMBER < 0x10000001L
 # define LIBCRYPTO_EVP_INL_TYPE unsigned int
 #else
 # define LIBCRYPTO_EVP_INL_TYPE size_t
@@ -59,20 +59,43 @@
 # define EVP_aes_128_cbc evp_rijndael
 # define EVP_aes_192_cbc evp_rijndael
 # define EVP_aes_256_cbc evp_rijndael
-extern const EVP_CIPHER *evp_rijndael(void);
-extern void ssh_rijndael_iv(EVP_CIPHER_CTX *, int, u_char *, u_int);
+const EVP_CIPHER *evp_rijndael(void);
+void ssh_rijndael_iv(EVP_CIPHER_CTX *, int, u_char *, u_int);
 #endif
 
-#if !defined(EVP_CTRL_SET_ACSS_MODE)
-# if (OPENSSL_VERSION_NUMBER >= 0x00907000L)
-#  define USE_CIPHER_ACSS 1
-extern const EVP_CIPHER *evp_acss(void);
-#  define EVP_acss evp_acss
+#ifndef OPENSSL_HAVE_EVPCTR
+#define EVP_aes_128_ctr evp_aes_128_ctr
+#define EVP_aes_192_ctr evp_aes_128_ctr
+#define EVP_aes_256_ctr evp_aes_128_ctr
+const EVP_CIPHER *evp_aes_128_ctr(void);
+void ssh_aes_ctr_iv(EVP_CIPHER_CTX *, int, u_char *, size_t);
+#endif
+
+/* Avoid some #ifdef. Code that uses these is unreachable without GCM */
+#if !defined(OPENSSL_HAVE_EVPGCM) && !defined(EVP_CTRL_GCM_SET_IV_FIXED)
+# define EVP_CTRL_GCM_SET_IV_FIXED -1
+# define EVP_CTRL_GCM_IV_GEN -1
+# define EVP_CTRL_GCM_SET_TAG -1
+# define EVP_CTRL_GCM_GET_TAG -1
+#endif
+
+/* Replace missing EVP_CIPHER_CTX_ctrl() with something that returns failure */
+#ifndef HAVE_EVP_CIPHER_CTX_CTRL
+# ifdef OPENSSL_HAVE_EVPGCM
+#  error AES-GCM enabled without EVP_CIPHER_CTX_ctrl /* shouldn't happen */
 # else
-#  define EVP_acss NULL
+# define EVP_CIPHER_CTX_ctrl(a,b,c,d) (0)
 # endif
 #endif
 
+#if OPENSSL_VERSION_NUMBER < 0x00907000L
+#define EVP_X_STATE(evp)        &(evp).c
+#define EVP_X_STATE_LEN(evp)    sizeof((evp).c)
+#else
+#define EVP_X_STATE(evp)        (evp).cipher_data
+#define EVP_X_STATE_LEN(evp)    (evp).cipher->ctx_size
+#endif
+
 /* OpenSSL 0.9.8e returns cipher key len not context key len */
 #if (OPENSSL_VERSION_NUMBER == 0x0090805fL)
 # define EVP_CIPHER_CTX_key_length(c) ((c)->key_len)
diff --git a/openbsd-compat/strtoull.c b/openbsd-compat/strtoull.c
new file mode 100644
index 000000000..f7c818c52
--- /dev/null
+++ b/openbsd-compat/strtoull.c
@@ -0,0 +1,110 @@
+/*      $OpenBSD: strtoull.c,v 1.5 2005/08/08 08:05:37 espie Exp $ */
+/*-
+ * Copyright (c) 1992 The Regents of the University of California.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/* OPENBSD ORIGINAL: lib/libc/stdlib/strtoull.c */
+
+#include "includes.h"
+#ifndef HAVE_STRTOULL
+
+#include <sys/types.h>
+
+#include <ctype.h>
+#include <errno.h>
+#include <limits.h>
+#include <stdlib.h>
+
+/*
+ * Convert a string to an unsigned long long.
+ *
+ * Ignores `locale' stuff.  Assumes that the upper and lower case
+ * alphabets and digits are each contiguous.
+ */
+unsigned long long
+strtoull(const char *nptr, char **endptr, int base)
+{
+        const char *s;
+        unsigned long long acc, cutoff;
+        int c;
+        int neg, any, cutlim;
+
+        /*
+         * See strtoq for comments as to the logic used.
+         */
+        s = nptr;
+        do {
+                c = (unsigned char) *s++;
+        } while (isspace(c));
+        if (c == '-') {
+                neg = 1;
+                c = *s++;
+        } else { 
+                neg = 0;
+                if (c == '+')
+                        c = *s++;
+        }
+        if ((base == 0 || base == 16) &&
+            c == '0' && (*s == 'x' || *s == 'X')) {
+                c = s[1];
+                s += 2;
+                base = 16;
+        }
+        if (base == 0)
+                base = c == '0' ? 8 : 10;
+
+        cutoff = ULLONG_MAX / (unsigned long long)base;
+        cutlim = ULLONG_MAX % (unsigned long long)base;
+        for (acc = 0, any = 0;; c = (unsigned char) *s++) {
+                if (isdigit(c))
+                        c -= '0';
+                else if (isalpha(c))
+                        c -= isupper(c) ? 'A' - 10 : 'a' - 10;
+                else
+                        break;
+                if (c >= base)
+                        break;
+                if (any < 0)
+                        continue;
+                if (acc > cutoff || (acc == cutoff && c > cutlim)) {
+                        any = -1;
+                        acc = ULLONG_MAX;
+                        errno = ERANGE;
+                } else {
+                        any = 1;
+                        acc *= (unsigned long long)base;
+                        acc += c;
+                }
+        }
+        if (neg && any > 0)
+                acc = -acc;
+        if (endptr != 0)
+                *endptr = (char *) (any ? s - 1 : nptr);
+        return (acc);
+}
+#endif /* !HAVE_STRTOULL */
diff --git a/openbsd-compat/sys-queue.h b/openbsd-compat/sys-queue.h
index 5cf0587bd..28aaaa37a 100644
--- a/openbsd-compat/sys-queue.h
+++ b/openbsd-compat/sys-queue.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: queue.h,v 1.32 2007/04/30 18:42:34 pedro Exp $        */
+/*      $OpenBSD: queue.h,v 1.36 2012/04/11 13:29:14 naddy Exp $        */
 /*      $NetBSD: queue.h,v 1.11 1996/05/16 05:17:14 mycroft Exp $       */
 
 /*
@@ -202,10 +202,10 @@ struct {								\
             (var) != SLIST_END(head);                                   \
             (var) = SLIST_NEXT(var, field))
 
-#define SLIST_FOREACH_PREVPTR(var, varp, head, field)                   \
-        for ((varp) = &SLIST_FIRST((head));                             \
-            ((var) = *(varp)) != SLIST_END(head);                       \
-            (varp) = &SLIST_NEXT((var), field))
+#define SLIST_FOREACH_SAFE(var, head, field, tvar)                      \
+        for ((var) = SLIST_FIRST(head);                         \
+            (var) && ((tvar) = SLIST_NEXT(var, field), 1);              \
+            (var) = (tvar))
 
 /*
  * Singly-linked List functions.
@@ -224,7 +224,7 @@ struct {								\
         (head)->slh_first = (elm);                                      \
 } while (0)
 
-#define SLIST_REMOVE_NEXT(head, elm, field) do {                        \
+#define SLIST_REMOVE_AFTER(elm, field) do {                             \
         (elm)->field.sle_next = (elm)->field.sle_next->field.sle_next;  \
 } while (0)
 
@@ -276,6 +276,11 @@ struct {								\
             (var)!= LIST_END(head);                                     \
             (var) = LIST_NEXT(var, field))
 
+#define LIST_FOREACH_SAFE(var, head, field, tvar)                       \
+        for ((var) = LIST_FIRST(head);                          \
+            (var) && ((tvar) = LIST_NEXT(var, field), 1);               \
+            (var) = (tvar))
+
 /*
  * List functions.
  */
@@ -354,6 +359,11 @@ struct {								\
             (var) != SIMPLEQ_END(head);                                 \
             (var) = SIMPLEQ_NEXT(var, field))
 
+#define SIMPLEQ_FOREACH_SAFE(var, head, field, tvar)                    \
+        for ((var) = SIMPLEQ_FIRST(head);                               \
+            (var) && ((tvar) = SIMPLEQ_NEXT(var, field), 1);            \
+            (var) = (tvar))
+
 /*
  * Simple queue functions.
  */
@@ -385,6 +395,12 @@ struct {								\
                 (head)->sqh_last = &(head)->sqh_first;                  \
 } while (0)
 
+#define SIMPLEQ_REMOVE_AFTER(head, elm, field) do {                     \
+        if (((elm)->field.sqe_next = (elm)->field.sqe_next->field.sqe_next) \
+            == NULL)                                                    \
+                (head)->sqh_last = &(elm)->field.sqe_next;              \
+} while (0)
+
 /*
  * Tail queue definitions.
  */
@@ -422,11 +438,24 @@ struct {								\
             (var) != TAILQ_END(head);                                   \
             (var) = TAILQ_NEXT(var, field))
 
+#define TAILQ_FOREACH_SAFE(var, head, field, tvar)                      \
+        for ((var) = TAILQ_FIRST(head);                                 \
+            (var) != TAILQ_END(head) &&                                 \
+            ((tvar) = TAILQ_NEXT(var, field), 1);                       \
+            (var) = (tvar))
+
+
 #define TAILQ_FOREACH_REVERSE(var, head, headname, field)               \
         for((var) = TAILQ_LAST(head, headname);                         \
             (var) != TAILQ_END(head);                                   \
             (var) = TAILQ_PREV(var, headname, field))
 
+#define TAILQ_FOREACH_REVERSE_SAFE(var, head, headname, field, tvar)    \
+        for ((var) = TAILQ_LAST(head, headname);                        \
+            (var) != TAILQ_END(head) &&                                 \
+            ((tvar) = TAILQ_PREV(var, headname, field), 1);             \
+            (var) = (tvar))
+
 /*
  * Tail queue functions.
  */
@@ -526,11 +555,23 @@ struct {								\
             (var) != CIRCLEQ_END(head);                                 \
             (var) = CIRCLEQ_NEXT(var, field))
 
+#define CIRCLEQ_FOREACH_SAFE(var, head, field, tvar)                    \
+        for ((var) = CIRCLEQ_FIRST(head);                               \
+            (var) != CIRCLEQ_END(head) &&                               \
+            ((tvar) = CIRCLEQ_NEXT(var, field), 1);                     \
+            (var) = (tvar))
+
 #define CIRCLEQ_FOREACH_REVERSE(var, head, field)                       \
         for((var) = CIRCLEQ_LAST(head);                                 \
             (var) != CIRCLEQ_END(head);                                 \
             (var) = CIRCLEQ_PREV(var, field))
 
+#define CIRCLEQ_FOREACH_REVERSE_SAFE(var, head, headname, field, tvar)  \
+        for ((var) = CIRCLEQ_LAST(head, headname);                      \
+            (var) != CIRCLEQ_END(head) &&                               \
+            ((tvar) = CIRCLEQ_PREV(var, headname, field), 1);           \
+            (var) = (tvar))
+
 /*
  * Circular queue functions.
  */
diff --git a/openbsd-compat/sys-tree.h b/openbsd-compat/sys-tree.h
index d4949b5e7..7f7546ecd 100644
--- a/openbsd-compat/sys-tree.h
+++ b/openbsd-compat/sys-tree.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: tree.h,v 1.10 2007/10/29 23:49:41 djm Exp $   */
+/*      $OpenBSD: tree.h,v 1.13 2011/07/09 00:19:45 pirofti Exp $       */
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
  * All rights reserved.
@@ -26,6 +26,11 @@
 
 /* OPENBSD ORIGINAL: sys/sys/tree.h */
 
+#include "config.h"
+#ifdef NO_ATTRIBUTE_ON_RETURN_TYPE
+# define __attribute__(x)
+#endif
+
 #ifndef _SYS_TREE_H_
 #define _SYS_TREE_H_
 
@@ -331,7 +336,7 @@ struct {								\
 } while (0)
 
 #ifndef RB_AUGMENT
-#define RB_AUGMENT(x)
+#define RB_AUGMENT(x)   do {} while (0)
 #endif
 
 #define RB_ROTATE_LEFT(head, elm, tmp, field) do {                      \
@@ -375,21 +380,31 @@ struct {								\
 } while (0)
 
 /* Generates prototypes and inline functions */
-#define RB_PROTOTYPE(name, type, field, cmp)                            \
-void name##_RB_INSERT_COLOR(struct name *, struct type *);      \
-void name##_RB_REMOVE_COLOR(struct name *, struct type *, struct type *);\
-struct type *name##_RB_REMOVE(struct name *, struct type *);            \
-struct type *name##_RB_INSERT(struct name *, struct type *);            \
-struct type *name##_RB_FIND(struct name *, struct type *);              \
-struct type *name##_RB_NEXT(struct type *);                             \
-struct type *name##_RB_MINMAX(struct name *, int);                      
-
+#define RB_PROTOTYPE(name, type, field, cmp)                            \
+        RB_PROTOTYPE_INTERNAL(name, type, field, cmp,)
+#define RB_PROTOTYPE_STATIC(name, type, field, cmp)                     \
+        RB_PROTOTYPE_INTERNAL(name, type, field, cmp, __attribute__((__unused__)) static)
+#define RB_PROTOTYPE_INTERNAL(name, type, field, cmp, attr)             \
+attr void name##_RB_INSERT_COLOR(struct name *, struct type *);         \
+attr void name##_RB_REMOVE_COLOR(struct name *, struct type *, struct type *);\
+attr struct type *name##_RB_REMOVE(struct name *, struct type *);       \
+attr struct type *name##_RB_INSERT(struct name *, struct type *);       \
+attr struct type *name##_RB_FIND(struct name *, struct type *);         \
+attr struct type *name##_RB_NFIND(struct name *, struct type *);        \
+attr struct type *name##_RB_NEXT(struct type *);                        \
+attr struct type *name##_RB_PREV(struct type *);                        \
+attr struct type *name##_RB_MINMAX(struct name *, int);                 \
+                                                                        \
 
 /* Main rb operation.
  * Moves node close to the key of elm to top
  */
-#define RB_GENERATE(name, type, field, cmp)                             \
-void                                                                    \
+#define RB_GENERATE(name, type, field, cmp)                             \
+        RB_GENERATE_INTERNAL(name, type, field, cmp,)
+#define RB_GENERATE_STATIC(name, type, field, cmp)                      \
+        RB_GENERATE_INTERNAL(name, type, field, cmp, __attribute__((__unused__)) static)
+#define RB_GENERATE_INTERNAL(name, type, field, cmp, attr)              \
+attr void                                                               \
 name##_RB_INSERT_COLOR(struct name *head, struct type *elm)             \
 {                                                                       \
         struct type *parent, *gparent, *tmp;                            \
@@ -433,7 +448,7 @@ name##_RB_INSERT_COLOR(struct name *head, struct type *elm)		\
         RB_COLOR(head->rbh_root, field) = RB_BLACK;                     \
 }                                                                       \
                                                                         \
-void                                                                    \
+attr void                                                               \
 name##_RB_REMOVE_COLOR(struct name *head, struct type *parent, struct type *elm) \
 {                                                                       \
         struct type *tmp;                                               \
@@ -509,7 +524,7 @@ name##_RB_REMOVE_COLOR(struct name *head, struct type *parent, struct type *elm)
                 RB_COLOR(elm, field) = RB_BLACK;                        \
 }                                                                       \
                                                                         \
-struct type *                                                           \
+attr struct type *                                                      \
 name##_RB_REMOVE(struct name *head, struct type *elm)                   \
 {                                                                       \
         struct type *child, *parent, *old = elm;                        \
@@ -577,7 +592,7 @@ color:									\
 }                                                                       \
                                                                         \
 /* Inserts a node into the RB tree */                                   \
-struct type *                                                           \
+attr struct type *                                                      \
 name##_RB_INSERT(struct name *head, struct type *elm)                   \
 {                                                                       \
         struct type *tmp;                                               \
@@ -608,7 +623,7 @@ name##_RB_INSERT(struct name *head, struct type *elm)			\
 }                                                                       \
                                                                         \
 /* Finds the node with the same key as elm */                           \
-struct type *                                                           \
+attr struct type *                                                      \
 name##_RB_FIND(struct name *head, struct type *elm)                     \
 {                                                                       \
         struct type *tmp = RB_ROOT(head);                               \
@@ -625,7 +640,29 @@ name##_RB_FIND(struct name *head, struct type *elm)			\
         return (NULL);                                                  \
 }                                                                       \
                                                                         \
-struct type *                                                           \
+/* Finds the first node greater than or equal to the search key */      \
+attr struct type *                                                      \
+name##_RB_NFIND(struct name *head, struct type *elm)                    \
+{                                                                       \
+        struct type *tmp = RB_ROOT(head);                               \
+        struct type *res = NULL;                                        \
+        int comp;                                                       \
+        while (tmp) {                                                   \
+                comp = cmp(elm, tmp);                                   \
+                if (comp < 0) {                                         \
+                        res = tmp;                                      \
+                        tmp = RB_LEFT(tmp, field);                      \
+                }                                                       \
+                else if (comp > 0)                                      \
+                        tmp = RB_RIGHT(tmp, field);                     \
+                else                                                    \
+                        return (tmp);                                   \
+        }                                                               \
+        return (res);                                                   \
+}                                                                       \
+                                                                        \
+/* ARGSUSED */                                                          \
+attr struct type *                                                      \
 name##_RB_NEXT(struct type *elm)                                        \
 {                                                                       \
         if (RB_RIGHT(elm, field)) {                                     \
@@ -646,7 +683,29 @@ name##_RB_NEXT(struct type *elm)					\
         return (elm);                                                   \
 }                                                                       \
                                                                         \
-struct type *                                                           \
+/* ARGSUSED */                                                          \
+attr struct type *                                                      \
+name##_RB_PREV(struct type *elm)                                        \
+{                                                                       \
+        if (RB_LEFT(elm, field)) {                                      \
+                elm = RB_LEFT(elm, field);                              \
+                while (RB_RIGHT(elm, field))                            \
+                        elm = RB_RIGHT(elm, field);                     \
+        } else {                                                        \
+                if (RB_PARENT(elm, field) &&                            \
+                    (elm == RB_RIGHT(RB_PARENT(elm, field), field)))    \
+                        elm = RB_PARENT(elm, field);                    \
+                else {                                                  \
+                        while (RB_PARENT(elm, field) &&                 \
+                            (elm == RB_LEFT(RB_PARENT(elm, field), field)))\
+                                elm = RB_PARENT(elm, field);            \
+                        elm = RB_PARENT(elm, field);                    \
+                }                                                       \
+        }                                                               \
+        return (elm);                                                   \
+}                                                                       \
+                                                                        \
+attr struct type *                                                      \
 name##_RB_MINMAX(struct name *head, int val)                            \
 {                                                                       \
         struct type *tmp = RB_ROOT(head);                               \
@@ -667,7 +726,9 @@ name##_RB_MINMAX(struct name *head, int val)				\
 #define RB_INSERT(name, x, y)   name##_RB_INSERT(x, y)
 #define RB_REMOVE(name, x, y)   name##_RB_REMOVE(x, y)
 #define RB_FIND(name, x, y)     name##_RB_FIND(x, y)
+#define RB_NFIND(name, x, y)    name##_RB_NFIND(x, y)
 #define RB_NEXT(name, x, y)     name##_RB_NEXT(y)
+#define RB_PREV(name, x, y)     name##_RB_PREV(y)
 #define RB_MIN(name, x)         name##_RB_MINMAX(x, RB_NEGINF)
 #define RB_MAX(name, x)         name##_RB_MINMAX(x, RB_INF)
 
@@ -676,4 +737,19 @@ name##_RB_MINMAX(struct name *head, int val)				\
              (x) != NULL;                                               \
              (x) = name##_RB_NEXT(x))
 
+#define RB_FOREACH_SAFE(x, name, head, y)                               \
+        for ((x) = RB_MIN(name, head);                                  \
+            ((x) != NULL) && ((y) = name##_RB_NEXT(x), 1);              \
+             (x) = (y))
+
+#define RB_FOREACH_REVERSE(x, name, head)                               \
+        for ((x) = RB_MAX(name, head);                                  \
+             (x) != NULL;                                               \
+             (x) = name##_RB_PREV(x))
+
+#define RB_FOREACH_REVERSE_SAFE(x, name, head, y)                       \
+        for ((x) = RB_MAX(name, head);                                  \
+            ((x) != NULL) && ((y) = name##_RB_PREV(x), 1);              \
+             (x) = (y))
+
 #endif  /* _SYS_TREE_H_ */
diff --git a/openbsd-compat/vis.c b/openbsd-compat/vis.c
index 3a087b341..f6f5665c1 100644
--- a/openbsd-compat/vis.c
+++ b/openbsd-compat/vis.c
@@ -31,7 +31,7 @@
 /* OPENBSD ORIGINAL: lib/libc/gen/vis.c */
 
 #include "includes.h"
-#if !defined(HAVE_STRNVIS)
+#if !defined(HAVE_STRNVIS) || defined(BROKEN_STRNVIS)
 
 #include <ctype.h>
 #include <string.h>
diff --git a/openbsd-compat/vis.h b/openbsd-compat/vis.h
index 3898a9e70..d1286c99d 100644
--- a/openbsd-compat/vis.h
+++ b/openbsd-compat/vis.h
@@ -35,7 +35,7 @@
 /* OPENBSD ORIGINAL: include/vis.h */
 
 #include "includes.h"
-#if !defined(HAVE_STRNVIS)
+#if !defined(HAVE_STRNVIS) || defined(BROKEN_STRNVIS)
 
 #ifndef _VIS_H_
 #define _VIS_H_
@@ -92,4 +92,4 @@ ssize_t strnunvis(char *, const char *, size_t)
 
 #endif /* !_VIS_H_ */
 
-#endif /* !HAVE_STRNVIS */
+#endif /* !HAVE_STRNVIS || BROKEN_STRNVIS */
diff --git a/packet.c b/packet.c
index d0c66fe57..9326ddea6 100644
--- a/packet.c
+++ b/packet.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: packet.c,v 1.176 2012/01/25 19:40:09 markus Exp $ */
+/* $OpenBSD: packet.c,v 1.181 2013/02/10 23:35:24 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -275,7 +275,7 @@ packet_stop_discard(void)
 static void
 packet_start_discard(Enc *enc, Mac *mac, u_int packet_length, u_int discard)
 {
-        if (enc == NULL || !cipher_is_cbc(enc->cipher))
+        if (enc == NULL || !cipher_is_cbc(enc->cipher) || (mac && mac->etm))
                 packet_disconnect("Packet corrupt");
         if (packet_length != PACKET_MAX_SIZE && mac && mac->enabled)
                 active_state->packet_discard_mac = mac;
@@ -709,7 +709,7 @@ packet_send1(void)
             buffer_len(&active_state->outgoing_packet));
         cipher_crypt(&active_state->send_context, cp,
             buffer_ptr(&active_state->outgoing_packet),
-            buffer_len(&active_state->outgoing_packet));
+            buffer_len(&active_state->outgoing_packet), 0, 0);
 
 #ifdef PACKET_DEBUG
         fprintf(stderr, "encrypted: ");
@@ -757,6 +757,9 @@ set_newkeys(int mode)
                 mac  = &active_state->newkeys[mode]->mac;
                 comp = &active_state->newkeys[mode]->comp;
                 mac_clear(mac);
+                memset(enc->iv,  0, enc->iv_len);
+                memset(enc->key, 0, enc->key_len);
+                memset(mac->key, 0, mac->key_len);
                 xfree(enc->name);
                 xfree(enc->iv);
                 xfree(enc->key);
@@ -771,11 +774,11 @@ set_newkeys(int mode)
         enc  = &active_state->newkeys[mode]->enc;
         mac  = &active_state->newkeys[mode]->mac;
         comp = &active_state->newkeys[mode]->comp;
-        if (mac_init(mac) == 0)
+        if (cipher_authlen(enc->cipher) == 0 && mac_init(mac) == 0)
                 mac->enabled = 1;
         DBG(debug("cipher_init_context: %d", mode));
         cipher_init(cc, enc->cipher, enc->key, enc->key_len,
-            enc->iv, enc->block_size, crypt_type);
+            enc->iv, enc->iv_len, crypt_type);
         /* Deleting the keys does not gain extra security */
         /* memset(enc->iv,  0, enc->block_size);
            memset(enc->key, 0, enc->key_len);
@@ -842,9 +845,8 @@ static void
 packet_send2_wrapped(void)
 {
         u_char type, *cp, *macbuf = NULL;
-        u_char padlen, pad;
-        u_int packet_length = 0;
-        u_int i, len;
+        u_char padlen, pad = 0;
+        u_int i, len, authlen = 0, aadlen = 0;
         u_int32_t rnd = 0;
         Enc *enc   = NULL;
         Mac *mac   = NULL;
@@ -855,8 +857,12 @@ packet_send2_wrapped(void)
                 enc  = &active_state->newkeys[MODE_OUT]->enc;
                 mac  = &active_state->newkeys[MODE_OUT]->mac;
                 comp = &active_state->newkeys[MODE_OUT]->comp;
+                /* disable mac for authenticated encryption */
+                if ((authlen = cipher_authlen(enc->cipher)) != 0)
+                        mac = NULL;
         }
         block_size = enc ? enc->block_size : 8;
+        aadlen = (mac && mac->enabled && mac->etm) || authlen ? 4 : 0;
 
         cp = buffer_ptr(&active_state->outgoing_packet);
         type = cp[5];
@@ -889,6 +895,7 @@ packet_send2_wrapped(void)
          * calc size of padding, alloc space, get random data,
          * minimum padding is 4 bytes
          */
+        len -= aadlen; /* packet length is not encrypted for EtM modes */
         padlen = block_size - (len % block_size);
         if (padlen < 4)
                 padlen += block_size;
@@ -916,29 +923,37 @@ packet_send2_wrapped(void)
                 /* clear padding */
                 memset(cp, 0, padlen);
         }
-        /* packet_length includes payload, padding and padding length field */
-        packet_length = buffer_len(&active_state->outgoing_packet) - 4;
+        /* sizeof (packet_len + pad_len + payload + padding) */
+        len = buffer_len(&active_state->outgoing_packet);
         cp = buffer_ptr(&active_state->outgoing_packet);
-        put_u32(cp, packet_length);
+        /* packet_length includes payload, padding and padding length field */
+        put_u32(cp, len - 4);
         cp[4] = padlen;
-        DBG(debug("send: len %d (includes padlen %d)", packet_length+4, padlen));
+        DBG(debug("send: len %d (includes padlen %d, aadlen %d)",
+            len, padlen, aadlen));
 
         /* compute MAC over seqnr and packet(length fields, payload, padding) */
-        if (mac && mac->enabled) {
+        if (mac && mac->enabled && !mac->etm) {
                 macbuf = mac_compute(mac, active_state->p_send.seqnr,
-                    buffer_ptr(&active_state->outgoing_packet),
-                    buffer_len(&active_state->outgoing_packet));
+                    buffer_ptr(&active_state->outgoing_packet), len);
                 DBG(debug("done calc MAC out #%d", active_state->p_send.seqnr));
         }
         /* encrypt packet and append to output buffer. */
-        cp = buffer_append_space(&active_state->output,
-            buffer_len(&active_state->outgoing_packet));
+        cp = buffer_append_space(&active_state->output, len + authlen);
         cipher_crypt(&active_state->send_context, cp,
             buffer_ptr(&active_state->outgoing_packet),
-            buffer_len(&active_state->outgoing_packet));
+            len - aadlen, aadlen, authlen);
         /* append unencrypted MAC */
-        if (mac && mac->enabled)
+        if (mac && mac->enabled) {
+                if (mac->etm) {
+                        /* EtM: compute mac over aadlen + cipher text */
+                        macbuf = mac_compute(mac,
+                            active_state->p_send.seqnr, cp, len);
+                        DBG(debug("done calc MAC(EtM) out #%d",
+                            active_state->p_send.seqnr));
+                }
                 buffer_append(&active_state->output, macbuf, mac->mac_len);
+        }
 #ifdef PACKET_DEBUG
         fprintf(stderr, "encrypted: ");
         buffer_dump(&active_state->output);
@@ -949,8 +964,8 @@ packet_send2_wrapped(void)
         if (++active_state->p_send.packets == 0)
                 if (!(datafellows & SSH_BUG_NOREKEY))
                         fatal("XXX too many packets with same key");
-        active_state->p_send.blocks += (packet_length + 4) / block_size;
-        active_state->p_send.bytes += packet_length + 4;
+        active_state->p_send.blocks += len / block_size;
+        active_state->p_send.bytes += len;
         buffer_clear(&active_state->outgoing_packet);
 
         if (type == SSH2_MSG_NEWKEYS)
@@ -1187,7 +1202,7 @@ packet_read_poll1(void)
         buffer_clear(&active_state->incoming_packet);
         cp = buffer_append_space(&active_state->incoming_packet, padded_len);
         cipher_crypt(&active_state->receive_context, cp,
-            buffer_ptr(&active_state->input), padded_len);
+            buffer_ptr(&active_state->input), padded_len, 0, 0);
 
         buffer_consume(&active_state->input, padded_len);
 
@@ -1235,8 +1250,8 @@ static int
 packet_read_poll2(u_int32_t *seqnr_p)
 {
         u_int padlen, need;
-        u_char *macbuf, *cp, type;
-        u_int maclen, block_size;
+        u_char *macbuf = NULL, *cp, type;
+        u_int maclen, authlen = 0, aadlen = 0, block_size;
         Enc *enc   = NULL;
         Mac *mac   = NULL;
         Comp *comp = NULL;
@@ -1248,11 +1263,29 @@ packet_read_poll2(u_int32_t *seqnr_p)
                 enc  = &active_state->newkeys[MODE_IN]->enc;
                 mac  = &active_state->newkeys[MODE_IN]->mac;
                 comp = &active_state->newkeys[MODE_IN]->comp;
+                /* disable mac for authenticated encryption */
+                if ((authlen = cipher_authlen(enc->cipher)) != 0)
+                        mac = NULL;
         }
         maclen = mac && mac->enabled ? mac->mac_len : 0;
         block_size = enc ? enc->block_size : 8;
+        aadlen = (mac && mac->enabled && mac->etm) || authlen ? 4 : 0;
 
-        if (active_state->packlen == 0) {
+        if (aadlen && active_state->packlen == 0) {
+                if (buffer_len(&active_state->input) < 4)
+                        return SSH_MSG_NONE;
+                cp = buffer_ptr(&active_state->input);
+                active_state->packlen = get_u32(cp);
+                if (active_state->packlen < 1 + 4 ||
+                    active_state->packlen > PACKET_MAX_SIZE) {
+#ifdef PACKET_DEBUG
+                        buffer_dump(&active_state->input);
+#endif
+                        logit("Bad packet length %u.", active_state->packlen);
+                        packet_disconnect("Packet corrupt");
+                }
+                buffer_clear(&active_state->incoming_packet);
+        } else if (active_state->packlen == 0) {
                 /*
                  * check if input size is less than the cipher block size,
                  * decrypt first block and extract length of incoming packet
@@ -1263,7 +1296,7 @@ packet_read_poll2(u_int32_t *seqnr_p)
                 cp = buffer_append_space(&active_state->incoming_packet,
                     block_size);
                 cipher_crypt(&active_state->receive_context, cp,
-                    buffer_ptr(&active_state->input), block_size);
+                    buffer_ptr(&active_state->input), block_size, 0, 0);
                 cp = buffer_ptr(&active_state->incoming_packet);
                 active_state->packlen = get_u32(cp);
                 if (active_state->packlen < 1 + 4 ||
@@ -1276,13 +1309,21 @@ packet_read_poll2(u_int32_t *seqnr_p)
                             PACKET_MAX_SIZE);
                         return SSH_MSG_NONE;
                 }
-                DBG(debug("input: packet len %u", active_state->packlen+4));
                 buffer_consume(&active_state->input, block_size);
         }
-        /* we have a partial packet of block_size bytes */
-        need = 4 + active_state->packlen - block_size;
-        DBG(debug("partial packet %d, need %d, maclen %d", block_size,
-            need, maclen));
+        DBG(debug("input: packet len %u", active_state->packlen+4));
+        if (aadlen) {
+                /* only the payload is encrypted */
+                need = active_state->packlen;
+        } else {
+                /*
+                 * the payload size and the payload are encrypted, but we
+                 * have a partial packet of block_size bytes
+                 */
+                need = 4 + active_state->packlen - block_size;
+        }
+        DBG(debug("partial packet: block %d, need %d, maclen %d, authlen %d,"
+            " aadlen %d", block_size, need, maclen, authlen, aadlen));
         if (need % block_size != 0) {
                 logit("padding error: need %d block %d mod %d",
                     need, block_size, need % block_size);
@@ -1292,26 +1333,35 @@ packet_read_poll2(u_int32_t *seqnr_p)
         }
         /*
          * check if the entire packet has been received and
-         * decrypt into incoming_packet
+         * decrypt into incoming_packet:
+         * 'aadlen' bytes are unencrypted, but authenticated.
+         * 'need' bytes are encrypted, followed by either
+         * 'authlen' bytes of authentication tag or
+         * 'maclen' bytes of message authentication code.
          */
-        if (buffer_len(&active_state->input) < need + maclen)
+        if (buffer_len(&active_state->input) < aadlen + need + authlen + maclen)
                 return SSH_MSG_NONE;
 #ifdef PACKET_DEBUG
         fprintf(stderr, "read_poll enc/full: ");
         buffer_dump(&active_state->input);
 #endif
-        cp = buffer_append_space(&active_state->incoming_packet, need);
+        /* EtM: compute mac over encrypted input */
+        if (mac && mac->enabled && mac->etm)
+                macbuf = mac_compute(mac, active_state->p_read.seqnr,
+                    buffer_ptr(&active_state->input), aadlen + need);
+        cp = buffer_append_space(&active_state->incoming_packet, aadlen + need);
         cipher_crypt(&active_state->receive_context, cp,
-            buffer_ptr(&active_state->input), need);
-        buffer_consume(&active_state->input, need);
+            buffer_ptr(&active_state->input), need, aadlen, authlen);
+        buffer_consume(&active_state->input, aadlen + need + authlen);
         /*
          * compute MAC over seqnr and packet,
          * increment sequence number for incoming packet
          */
         if (mac && mac->enabled) {
-                macbuf = mac_compute(mac, active_state->p_read.seqnr,
-                    buffer_ptr(&active_state->incoming_packet),
-                    buffer_len(&active_state->incoming_packet));
+                if (!mac->etm)
+                        macbuf = mac_compute(mac, active_state->p_read.seqnr,
+                            buffer_ptr(&active_state->incoming_packet),
+                            buffer_len(&active_state->incoming_packet));
                 if (timingsafe_bcmp(macbuf, buffer_ptr(&active_state->input),
                     mac->mac_len) != 0) {
                         logit("Corrupted MAC on input.");
@@ -1410,7 +1460,7 @@ packet_read_poll_seqnr(u_int32_t *seqnr_p)
                         case SSH2_MSG_DISCONNECT:
                                 reason = packet_get_int();
                                 msg = packet_get_string(NULL);
-                                logit("Received disconnect from %s: %u: %.400s",
+                                error("Received disconnect from %s: %u: %.400s",
                                     get_remote_ipaddr(), reason, msg);
                                 xfree(msg);
                                 cleanup_exit(255);
@@ -1435,7 +1485,7 @@ packet_read_poll_seqnr(u_int32_t *seqnr_p)
                                 break;
                         case SSH_MSG_DISCONNECT:
                                 msg = packet_get_string(NULL);
-                                logit("Received disconnect from %s: %.400s",
+                                error("Received disconnect from %s: %.400s",
                                     get_remote_ipaddr(), msg);
                                 cleanup_exit(255);
                                 break;
diff --git a/platform.c b/platform.c
index e707aa4c7..a962f15b5 100644
--- a/platform.c
+++ b/platform.c
@@ -1,4 +1,4 @@
-/* $Id: platform.c,v 1.18 2011/01/11 06:02:25 djm Exp $ */
+/* $Id: platform.c,v 1.19 2013/03/12 00:31:05 dtucker Exp $ */
 
 /*
  * Copyright (c) 2006 Darren Tucker.  All rights reserved.
@@ -194,3 +194,19 @@ platform_krb5_get_principal_name(const char *pw_name)
         return NULL;
 #endif
 }
+
+/*
+ * return 1 if the specified uid is a uid that may own a system directory
+ * otherwise 0.
+ */
+int
+platform_sys_dir_uid(uid_t uid)
+{
+        if (uid == 0)
+                return 1;
+#ifdef PLATFORM_SYS_DIR_UID
+        if (uid == PLATFORM_SYS_DIR_UID)
+                return 1;
+#endif
+        return 0;
+}
diff --git a/platform.h b/platform.h
index 7b2d481af..3188a3d7c 100644
--- a/platform.h
+++ b/platform.h
@@ -1,4 +1,4 @@
-/* $Id: platform.h,v 1.7 2010/11/05 03:47:01 dtucker Exp $ */
+/* $Id: platform.h,v 1.8 2013/03/12 00:31:05 dtucker Exp $ */
 
 /*
  * Copyright (c) 2006 Darren Tucker.  All rights reserved.
@@ -29,5 +29,4 @@ void platform_setusercontext(struct passwd *);
 void platform_setusercontext_post_groups(struct passwd *, const char *);
 char *platform_get_krb5_client(const char *);
 char *platform_krb5_get_principal_name(const char *);
-
-
+int platform_sys_dir_uid(uid_t);
diff --git a/regress/Makefile b/regress/Makefile
index f114c27e9..6ef5d9cce 100644
--- a/regress/Makefile
+++ b/regress/Makefile
@@ -1,4 +1,4 @@
-#       $OpenBSD: Makefile,v 1.58 2011/01/06 22:46:21 djm Exp $
+#       $OpenBSD: Makefile,v 1.62 2013/01/18 00:45:29 djm Exp $
 
 REGRESS_TARGETS=        t1 t2 t3 t4 t5 t6 t7 t8 t9 t-exec
 tests:          $(REGRESS_TARGETS)
@@ -57,7 +57,11 @@ LTESTS= 	connect \
                 kextype \
                 cert-hostkey \
                 cert-userkey \
-                host-expand
+                host-expand \
+                keys-command \
+                forward-control \
+                integrity \
+                krl
 
 INTEROP_TESTS=  putty-transfer putty-ciphers putty-kex conch-ciphers
 #INTEROP_TESTS+=ssh-com ssh-com-client ssh-com-keygen ssh-com-sftp
@@ -67,23 +71,27 @@ INTEROP_TESTS=	putty-transfer putty-ciphers putty-kex conch-ciphers
 USER!=          id -un
 CLEANFILES=     t2.out t3.out t6.out1 t6.out2 t7.out t7.out.pub copy.1 copy.2 \
                 t8.out t8.out.pub t9.out t9.out.pub \
-                authorized_keys_${USER} known_hosts pidfile \
+                authorized_keys_${USER} known_hosts pidfile testdata \
                 ssh_config sshd_config.orig ssh_proxy sshd_config sshd_proxy \
                 rsa.pub rsa rsa1.pub rsa1 host.rsa host.rsa1 \
                 rsa-agent rsa-agent.pub rsa1-agent rsa1-agent.pub \
                 ls.copy banner.in banner.out empty.in \
                 scp-ssh-wrapper.scp ssh_proxy_envpass remote_pid \
                 sshd_proxy_bak rsa_ssh2_cr.prv rsa_ssh2_crnl.prv \
-                known_hosts-cert host_ca_key* cert_host_key* \
+                known_hosts-cert host_ca_key* cert_host_key* cert_user_key* \
                 putty.rsa2 sshd_proxy_orig ssh_proxy_bak \
                 key.rsa-* key.dsa-* key.ecdsa-* \
-                authorized_principals_${USER} expect actual
+                authorized_principals_${USER} expect actual ready \
+                sshd_proxy.* authorized_keys_${USER}.* modpipe revoked-* krl-*
+
 
 # Enable all malloc(3) randomisations and checks
 TEST_ENV=      "MALLOC_OPTIONS=AFGJPRX"
 
 TEST_SSH_SSHKEYGEN?=ssh-keygen
 
+CPPFLAGS=-I..
+
 t1:
         ${TEST_SSH_SSHKEYGEN} -if ${.CURDIR}/rsa_ssh2.prv | diff - ${.CURDIR}/rsa_openssh.prv
         tr '\n' '\r' <${.CURDIR}/rsa_ssh2.prv > ${.OBJDIR}/rsa_ssh2_cr.prv
diff --git a/regress/cert-userkey.sh b/regress/cert-userkey.sh
index 6700db274..3bba9f8f2 100644
--- a/regress/cert-userkey.sh
+++ b/regress/cert-userkey.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: cert-userkey.sh,v 1.8 2011/05/17 07:13:31 djm Exp $
+#       $OpenBSD: cert-userkey.sh,v 1.10 2013/01/18 00:45:29 djm Exp $
 #       Placed in the Public Domain.
 
 tid="certified user keys"
@@ -22,9 +22,8 @@ for ktype in rsa dsa $ecdsa ; do
         ${SSHKEYGEN} -q -N '' -t ${ktype} \
             -f $OBJ/cert_user_key_${ktype} || \
                 fail "ssh-keygen of cert_user_key_${ktype} failed"
-        ${SSHKEYGEN} -q -s $OBJ/user_ca_key -I \
-            "regress user key for $USER" \
-            -n ${USER},mekmitasdigoat $OBJ/cert_user_key_${ktype} ||
+        ${SSHKEYGEN} -q -s $OBJ/user_ca_key -I "regress user key for $USER" \
+            -z $$ -n ${USER},mekmitasdigoat $OBJ/cert_user_key_${ktype} ||
                 fail "couldn't sign cert_user_key_${ktype}"
         # v00 ecdsa certs do not exist
         test "${ktype}" = "ecdsa" && continue
@@ -185,14 +184,32 @@ basic_tests() {
                         (
                                 cat $OBJ/sshd_proxy_bak
                                 echo "UsePrivilegeSeparation $privsep"
-                                echo "RevokedKeys $OBJ/cert_user_key_${ktype}.pub"
+                                echo "RevokedKeys $OBJ/cert_user_key_revoked"
                                 echo "$extra_sshd"
                         ) > $OBJ/sshd_proxy
+                        cp $OBJ/cert_user_key_${ktype}.pub \
+                            $OBJ/cert_user_key_revoked
+                        ${SSH} -2i $OBJ/cert_user_key_${ktype} \
+                            -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
+                        if [ $? -eq 0 ]; then
+                                fail "ssh cert connect succeeded unexpecedly"
+                        fi
+                        verbose "$tid: ${_prefix} revoked via KRL"
+                        rm $OBJ/cert_user_key_revoked
+                        ${SSHKEYGEN} -kqf $OBJ/cert_user_key_revoked \
+                            $OBJ/cert_user_key_${ktype}.pub
                         ${SSH} -2i $OBJ/cert_user_key_${ktype} \
                             -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
                         if [ $? -eq 0 ]; then
                                 fail "ssh cert connect succeeded unexpecedly"
                         fi
+                        verbose "$tid: ${_prefix} empty KRL"
+                        ${SSHKEYGEN} -kqf $OBJ/cert_user_key_revoked
+                        ${SSH} -2i $OBJ/cert_user_key_${ktype} \
+                            -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
+                        if [ $? -ne 0 ]; then
+                                fail "ssh cert connect failed"
+                        fi
                 done
         
                 # Revoked CA
diff --git a/regress/cipher-speed.sh b/regress/cipher-speed.sh
index 5800f4b09..65e5f35ec 100644
--- a/regress/cipher-speed.sh
+++ b/regress/cipher-speed.sh
@@ -1,29 +1,31 @@
-#       $OpenBSD: cipher-speed.sh,v 1.5 2012/06/28 05:07:45 dtucker Exp $
+#       $OpenBSD: cipher-speed.sh,v 1.7 2013/01/12 11:23:53 djm Exp $
 #       Placed in the Public Domain.
 
 tid="cipher speed"
 
 getbytes ()
 {
-        sed -n '/transferred/s/.*secs (\(.* bytes.sec\).*/\1/p'
+        sed -n -e '/transferred/s/.*secs (\(.* bytes.sec\).*/\1/p' \
+            -e '/copied/s/.*s, \(.* MB.s\).*/\1/p'
 }
 
 tries="1 2"
-DATA=/bin/ls
-DATA=/bsd
 
 ciphers="aes128-cbc 3des-cbc blowfish-cbc cast128-cbc 
         arcfour128 arcfour256 arcfour 
         aes192-cbc aes256-cbc rijndael-cbc@lysator.liu.se
         aes128-ctr aes192-ctr aes256-ctr"
-macs="hmac-sha1 hmac-md5 umac-64@openssh.com hmac-sha1-96 hmac-md5-96"
-config_defined HAVE_EVP_SHA256 &&
+config_defined OPENSSL_HAVE_EVPGCM && \
+        ciphers="$ciphers aes128-gcm@openssh.com aes256-gcm@openssh.com"
+macs="hmac-sha1 hmac-md5 umac-64@openssh.com umac-128@openssh.com
+        hmac-sha1-96 hmac-md5-96"
+config_defined HAVE_EVP_SHA256 && \
     macs="$macs hmac-sha2-256 hmac-sha2-512"
 
-for c in $ciphers; do for m in $macs; do
+for c in $ciphers; do n=0; for m in $macs; do
         trace "proto 2 cipher $c mac $m"
         for x in $tries; do
-                echon "$c/$m:\t"
+                printf "%-60s" "$c/$m:"
                 ( ${SSH} -o 'compression no' \
                         -F $OBJ/ssh_proxy -2 -m $m -c $c somehost \
                         exec sh -c \'"dd of=/dev/null obs=32k"\' \
@@ -33,13 +35,18 @@ for c in $ciphers; do for m in $macs; do
                         fail "ssh -2 failed with mac $m cipher $c"
                 fi
         done
+        # No point trying all MACs for GCM since they are ignored.
+        case $c in
+        aes*-gcm@openssh.com)   test $n -gt 0 && break;;
+        esac
+        n=`expr $n + 1`
 done; done
 
 ciphers="3des blowfish"
 for c in $ciphers; do
         trace "proto 1 cipher $c"
         for x in $tries; do
-                echon "$c:\t"
+                printf "%-60s" "$c:"
                 ( ${SSH} -o 'compression no' \
                         -F $OBJ/ssh_proxy -1 -c $c somehost \
                         exec sh -c \'"dd of=/dev/null obs=32k"\' \
diff --git a/regress/forward-control.sh b/regress/forward-control.sh
new file mode 100644
index 000000000..80ddb4167
--- /dev/null
+++ b/regress/forward-control.sh
@@ -0,0 +1,168 @@
+#       $OpenBSD: forward-control.sh,v 1.1 2012/12/02 20:47:48 djm Exp $
+#       Placed in the Public Domain.
+
+tid="sshd control of local and remote forwarding"
+
+LFWD_PORT=3320
+RFWD_PORT=3321
+CTL=$OBJ/ctl-sock
+READY=$OBJ/ready
+
+wait_for_file_to_appear() {
+        _path=$1
+        _n=0
+        while test ! -f $_path ; do
+                test $_n -eq 1 && trace "waiting for $_path to appear"
+                _n=`expr $_n + 1`
+                test $_n -ge 20 && return 1
+                sleep 1
+        done
+        return 0
+}
+
+wait_for_process_to_exit() {
+        _pid=$1
+        _n=0
+        while kill -0 $_pid 2>/dev/null ; do
+                test $_n -eq 1 && trace "waiting for $_pid to exit"
+                _n=`expr $_n + 1`
+                test $_n -ge 20 && return 1
+                sleep 1
+        done
+        return 0
+}
+
+# usage: check_lfwd protocol Y|N message
+check_lfwd() {
+        _proto=$1
+        _expected=$2
+        _message=$3
+        rm -f $READY
+        ${SSH} -oProtocol=$_proto -F $OBJ/ssh_proxy \
+            -L$LFWD_PORT:127.0.0.1:$PORT \
+            -o ExitOnForwardFailure=yes \
+            -n host exec sh -c \'"sleep 60 & echo \$! > $READY ; wait "\' \
+            >/dev/null 2>&1 &
+        _sshpid=$!
+        wait_for_file_to_appear $READY || \
+                fatal "check_lfwd ssh fail: $_message"
+        ${SSH} -F $OBJ/ssh_config -p $LFWD_PORT \
+            -oConnectionAttempts=4 host true >/dev/null 2>&1
+        _result=$?
+        kill $_sshpid `cat $READY` 2>/dev/null
+        wait_for_process_to_exit $_sshpid
+        if test "x$_expected" = "xY" -a $_result -ne 0 ; then
+                fail "check_lfwd failed (expecting success): $_message"
+        elif test "x$_expected" = "xN" -a $_result -eq 0 ; then
+                fail "check_lfwd succeeded (expecting failure): $_message"
+        elif test "x$_expected" != "xY" -a "x$_expected" != "xN" ; then
+                fatal "check_lfwd invalid argument \"$_expected\""
+        else
+                verbose "check_lfwd done (expecting $_expected): $_message"
+        fi
+}
+
+# usage: check_rfwd protocol Y|N message
+check_rfwd() {
+        _proto=$1
+        _expected=$2
+        _message=$3
+        rm -f $READY
+        ${SSH} -oProtocol=$_proto -F $OBJ/ssh_proxy \
+            -R$RFWD_PORT:127.0.0.1:$PORT \
+            -o ExitOnForwardFailure=yes \
+            -n host exec sh -c \'"sleep 60 & echo \$! > $READY ; wait "\' \
+            >/dev/null 2>&1 &
+        _sshpid=$!
+        wait_for_file_to_appear $READY
+        _result=$?
+        if test $_result -eq 0 ; then
+                ${SSH} -F $OBJ/ssh_config -p $RFWD_PORT \
+                    -oConnectionAttempts=4 host true >/dev/null 2>&1
+                _result=$?
+                kill $_sshpid `cat $READY` 2>/dev/null
+                wait_for_process_to_exit $_sshpid
+        fi
+        if test "x$_expected" = "xY" -a $_result -ne 0 ; then
+                fail "check_rfwd failed (expecting success): $_message"
+        elif test "x$_expected" = "xN" -a $_result -eq 0 ; then
+                fail "check_rfwd succeeded (expecting failure): $_message"
+        elif test "x$_expected" != "xY" -a "x$_expected" != "xN" ; then
+                fatal "check_rfwd invalid argument \"$_expected\""
+        else
+                verbose "check_rfwd done (expecting $_expected): $_message"
+        fi
+}
+
+start_sshd
+cp ${OBJ}/sshd_proxy ${OBJ}/sshd_proxy.bak
+cp ${OBJ}/authorized_keys_${USER} ${OBJ}/authorized_keys_${USER}.bak
+
+# Sanity check: ensure the default config allows forwarding
+for p in 1 2 ; do
+        check_lfwd $p Y "proto $p, default configuration"
+        check_rfwd $p Y "proto $p, default configuration"
+done
+
+# Usage: all_tests yes|local|remote|no Y|N Y|N Y|N Y|N Y|N Y|N
+all_tests() {
+        _tcpfwd=$1
+        _plain_lfwd=$2
+        _plain_rfwd=$3
+        _nopermit_lfwd=$4
+        _nopermit_rfwd=$5
+        _permit_lfwd=$6
+        _permit_rfwd=$7
+        _badfwd=127.0.0.1:22
+        _goodfwd=127.0.0.1:${PORT}
+        for _proto in 1 2 ; do
+                cp ${OBJ}/authorized_keys_${USER}.bak \
+                    ${OBJ}/authorized_keys_${USER}
+                _prefix="proto $_proto, AllowTcpForwarding=$_tcpfwd"
+                # No PermitOpen
+                ( cat ${OBJ}/sshd_proxy.bak ;
+                  echo "AllowTcpForwarding $_tcpfwd" ) \
+                    > ${OBJ}/sshd_proxy
+                check_lfwd $_proto $_plain_lfwd "$_prefix"
+                check_rfwd $_proto $_plain_rfwd "$_prefix"
+                # PermitOpen via sshd_config that doesn't match
+                ( cat ${OBJ}/sshd_proxy.bak ;
+                  echo "AllowTcpForwarding $_tcpfwd" ;
+                  echo "PermitOpen $_badfwd" ) \
+                    > ${OBJ}/sshd_proxy
+                check_lfwd $_proto $_nopermit_lfwd "$_prefix, !PermitOpen"
+                check_rfwd $_proto $_nopermit_rfwd "$_prefix, !PermitOpen"
+                # PermitOpen via sshd_config that does match
+                ( cat ${OBJ}/sshd_proxy.bak ;
+                  echo "AllowTcpForwarding $_tcpfwd" ;
+                  echo "PermitOpen $_badfwd $_goodfwd" ) \
+                    > ${OBJ}/sshd_proxy
+                # NB. permitopen via authorized_keys should have same
+                # success/fail as via sshd_config
+                # permitopen via authorized_keys that doesn't match
+                sed "s/^/permitopen=\"$_badfwd\" /" \
+                    < ${OBJ}/authorized_keys_${USER}.bak \
+                    > ${OBJ}/authorized_keys_${USER} || fatal "sed 1 fail"
+                ( cat ${OBJ}/sshd_proxy.bak ;
+                  echo "AllowTcpForwarding $_tcpfwd" ) \
+                    > ${OBJ}/sshd_proxy
+                check_lfwd $_proto $_nopermit_lfwd "$_prefix, !permitopen"
+                check_rfwd $_proto $_nopermit_rfwd "$_prefix, !permitopen"
+                # permitopen via authorized_keys that does match
+                sed "s/^/permitopen=\"$_badfwd\",permitopen=\"$_goodfwd\" /" \
+                    < ${OBJ}/authorized_keys_${USER}.bak \
+                    > ${OBJ}/authorized_keys_${USER} || fatal "sed 2 fail"
+                ( cat ${OBJ}/sshd_proxy.bak ;
+                  echo "AllowTcpForwarding $_tcpfwd" ) \
+                    > ${OBJ}/sshd_proxy
+                check_lfwd $_proto $_permit_lfwd "$_prefix, permitopen"
+                check_rfwd $_proto $_permit_rfwd "$_prefix, permitopen"
+        done
+}
+
+#                      no-permitopen mismatch-permitopen match-permitopen
+#   AllowTcpForwarding  local remote        local remote     local remote
+all_tests          yes      Y      Y            N      Y         Y      Y
+all_tests        local      Y      N            N      N         Y      N
+all_tests       remote      N      Y            N      Y         N      Y
+all_tests           no      N      N            N      N         N      N
diff --git a/regress/integrity.sh b/regress/integrity.sh
new file mode 100644
index 000000000..4d46926d5
--- /dev/null
+++ b/regress/integrity.sh
@@ -0,0 +1,74 @@
+#       $OpenBSD: integrity.sh,v 1.7 2013/02/20 08:27:50 djm Exp $
+#       Placed in the Public Domain.
+
+tid="integrity"
+
+# start at byte 2900 (i.e. after kex) and corrupt at different offsets
+# XXX the test hangs if we modify the low bytes of the packet length
+# XXX and ssh tries to read...
+tries=10
+startoffset=2900
+macs="hmac-sha1 hmac-md5 umac-64@openssh.com umac-128@openssh.com
+        hmac-sha1-96 hmac-md5-96 
+        hmac-sha1-etm@openssh.com hmac-md5-etm@openssh.com
+        umac-64-etm@openssh.com umac-128-etm@openssh.com
+        hmac-sha1-96-etm@openssh.com hmac-md5-96-etm@openssh.com"
+config_defined HAVE_EVP_SHA256 &&
+        macs="$macs hmac-sha2-256 hmac-sha2-512
+                hmac-sha2-256-etm@openssh.com hmac-sha2-512-etm@openssh.com"
+# The following are not MACs, but ciphers with integrated integrity. They are
+# handled specially below.
+config_defined OPENSSL_HAVE_EVPGCM && \
+        macs="$macs aes128-gcm@openssh.com aes256-gcm@openssh.com"
+
+# sshd-command for proxy (see test-exec.sh)
+cmd="$SUDO sh ${SRC}/sshd-log-wrapper.sh ${SSHD} ${TEST_SSH_LOGFILE} -i -f $OBJ/sshd_proxy"
+
+jot() {
+        awk "BEGIN { for (i = $2; i < $2 + $1; i++) { printf \"%d\n\", i } exit }"
+}
+
+for m in $macs; do
+        trace "test $tid: mac $m"
+        elen=0
+        epad=0
+        emac=0
+        ecnt=0
+        skip=0
+        for off in `jot $tries $startoffset`; do
+                skip=`expr $skip - 1`
+                if [ $skip -gt 0 ]; then
+                        # avoid modifying the high bytes of the length
+                        continue
+                fi
+                # modify output from sshd at offset $off
+                pxy="proxycommand=$cmd | $OBJ/modpipe -wm xor:$off:1"
+                case $m in
+                        aes*gcm*)       macopt="-c $m";;
+                        *)              macopt="-m $m";;
+                esac
+                output=`${SSH} $macopt -2F $OBJ/ssh_proxy -o "$pxy" \
+                    999.999.999.999 'printf "%4096s" " "' 2>&1`
+                if [ $? -eq 0 ]; then
+                        fail "ssh -m $m succeeds with bit-flip at $off"
+                fi
+                ecnt=`expr $ecnt + 1`
+                output=`echo $output | tr -s '\r\n' '.'`
+                verbose "test $tid: $m @$off $output"
+                case "$output" in
+                Bad?packet*)    elen=`expr $elen + 1`; skip=3;;
+                Corrupted?MAC* | Decryption?integrity?check?failed*)
+                                emac=`expr $emac + 1`; skip=0;;
+                padding*)       epad=`expr $epad + 1`; skip=0;;
+                *)              fail "unexpected error mac $m at $off";;
+                esac
+        done
+        verbose "test $tid: $ecnt errors: mac $emac padding $epad length $elen"
+        if [ $emac -eq 0 ]; then
+                fail "$m: no mac errors"
+        fi
+        expect=`expr $ecnt - $epad - $elen`
+        if [ $emac -ne $expect ]; then
+                fail "$m: expected $expect mac errors, got $emac"
+        fi
+done
diff --git a/regress/keys-command.sh b/regress/keys-command.sh
new file mode 100644
index 000000000..b595a434f
--- /dev/null
+++ b/regress/keys-command.sh
@@ -0,0 +1,39 @@
+#       $OpenBSD: keys-command.sh,v 1.2 2012/12/06 06:06:54 dtucker Exp $
+#       Placed in the Public Domain.
+
+tid="authorized keys from command"
+
+if test -z "$SUDO" ; then
+        echo "skipped (SUDO not set)"
+        echo "need SUDO to create file in /var/run, test won't work without"
+        exit 0
+fi
+
+# Establish a AuthorizedKeysCommand in /var/run where it will have
+# acceptable directory permissions.
+KEY_COMMAND="/var/run/keycommand_${LOGNAME}"
+cat << _EOF | $SUDO sh -c "cat > '$KEY_COMMAND'"
+#!/bin/sh
+test "x\$1" != "x${LOGNAME}" && exit 1
+exec cat "$OBJ/authorized_keys_${LOGNAME}"
+_EOF
+$SUDO chmod 0755 "$KEY_COMMAND"
+
+cp $OBJ/sshd_proxy $OBJ/sshd_proxy.bak
+(
+        grep -vi AuthorizedKeysFile $OBJ/sshd_proxy.bak
+        echo AuthorizedKeysFile none
+        echo AuthorizedKeysCommand $KEY_COMMAND
+        echo AuthorizedKeysCommandUser ${LOGNAME}
+) > $OBJ/sshd_proxy
+
+if [ -x $KEY_COMMAND ]; then
+        ${SSH} -F $OBJ/ssh_proxy somehost true
+        if [ $? -ne 0 ]; then
+                fail "connect failed"
+        fi
+else
+        echo "SKIPPED: $KEY_COMMAND not executable (/var/run mounted noexec?)"
+fi
+
+$SUDO rm -f $KEY_COMMAND
diff --git a/regress/krl.sh b/regress/krl.sh
new file mode 100644
index 000000000..62a239c38
--- /dev/null
+++ b/regress/krl.sh
@@ -0,0 +1,161 @@
+#       $OpenBSD: krl.sh,v 1.1 2013/01/18 00:45:29 djm Exp $
+#       Placed in the Public Domain.
+
+tid="key revocation lists"
+
+# If we don't support ecdsa keys then this tell will be much slower.
+ECDSA=ecdsa
+if test "x$TEST_SSH_ECC" != "xyes"; then
+        ECDSA=rsa
+fi
+
+# Do most testing with ssh-keygen; it uses the same verification code as sshd.
+
+# Old keys will interfere with ssh-keygen.
+rm -f $OBJ/revoked-* $OBJ/krl-*
+
+# Generate a CA key
+$SSHKEYGEN -t $ECDSA -f $OBJ/revoked-ca  -C "" -N "" > /dev/null ||
+        fatal "$SSHKEYGEN CA failed"
+
+# A specification that revokes some certificates by serial numbers
+# The serial pattern is chosen to ensure the KRL includes list, range and
+# bitmap sections.
+cat << EOF >> $OBJ/revoked-serials
+serial: 1-4
+serial: 10
+serial: 15
+serial: 30
+serial: 50
+serial: 999
+# The following sum to 500-799
+serial: 500
+serial: 501
+serial: 502
+serial: 503-600
+serial: 700-797
+serial: 798
+serial: 799
+serial: 599-701
+EOF
+
+jot() {
+        awk "BEGIN { for (i = $2; i < $2 + $1; i++) { printf \"%d\n\", i } exit }"
+}
+
+# A specification that revokes some certificated by key ID.
+touch $OBJ/revoked-keyid
+for n in 1 2 3 4 10 15 30 50 `jot 500 300` 999 1000 1001 1002; do
+        # Fill in by-ID revocation spec.
+        echo "id: revoked $n" >> $OBJ/revoked-keyid
+done
+
+keygen() {
+        N=$1
+        f=$OBJ/revoked-`printf "%04d" $N`
+        # Vary the keytype. We use mostly ECDSA since this is fastest by far.
+        keytype=$ECDSA
+        case $N in
+        2 | 10 | 510 | 1001)    keytype=rsa;;
+        4 | 30 | 520 | 1002)    keytype=dsa;;
+        esac
+        $SSHKEYGEN -t $keytype -f $f -C "" -N "" > /dev/null \
+                || fatal "$SSHKEYGEN failed"
+        # Sign cert
+        $SSHKEYGEN -s $OBJ/revoked-ca -z $n -I "revoked $N" $f >/dev/null 2>&1 \
+                || fatal "$SSHKEYGEN sign failed"
+        echo $f
+}
+
+# Generate some keys.
+verbose "$tid: generating test keys"
+REVOKED_SERIALS="1 4 10 50 500 510 520 799 999"
+for n in $REVOKED_SERIALS ; do
+        f=`keygen $n`
+        REVOKED_KEYS="$REVOKED_KEYS ${f}.pub"
+        REVOKED_CERTS="$REVOKED_CERTS ${f}-cert.pub"
+done
+NOTREVOKED_SERIALS="5 9 14 16 29 30 49 51 499 800 1000 1001"
+NOTREVOKED=""
+for n in $NOTREVOKED_SERIALS ; do
+        NOTREVOKED_KEYS="$NOTREVOKED_KEYS ${f}.pub"
+        NOTREVOKED_CERTS="$NOTREVOKED_CERTS ${f}-cert.pub"
+done
+
+genkrls() {
+        OPTS=$1
+$SSHKEYGEN $OPTS -kf $OBJ/krl-empty - </dev/null \
+        >/dev/null || fatal "$SSHKEYGEN KRL failed"
+$SSHKEYGEN $OPTS -kf $OBJ/krl-keys $REVOKED_KEYS \
+        >/dev/null || fatal "$SSHKEYGEN KRL failed"
+$SSHKEYGEN $OPTS -kf $OBJ/krl-cert $REVOKED_CERTS \
+        >/dev/null || fatal "$SSHKEYGEN KRL failed"
+$SSHKEYGEN $OPTS -kf $OBJ/krl-all $REVOKED_KEYS $REVOKED_CERTS \
+        >/dev/null || fatal "$SSHKEYGEN KRL failed"
+$SSHKEYGEN $OPTS -kf $OBJ/krl-ca $OBJ/revoked-ca.pub \
+        >/dev/null || fatal "$SSHKEYGEN KRL failed"
+# KRLs from serial/key-id spec need the CA specified.
+$SSHKEYGEN $OPTS -kf $OBJ/krl-serial $OBJ/revoked-serials \
+        >/dev/null 2>&1 && fatal "$SSHKEYGEN KRL succeeded unexpectedly"
+$SSHKEYGEN $OPTS -kf $OBJ/krl-keyid $OBJ/revoked-keyid \
+        >/dev/null 2>&1 && fatal "$SSHKEYGEN KRL succeeded unexpectedly"
+$SSHKEYGEN $OPTS -kf $OBJ/krl-serial -s $OBJ/revoked-ca $OBJ/revoked-serials \
+        >/dev/null || fatal "$SSHKEYGEN KRL failed"
+$SSHKEYGEN $OPTS -kf $OBJ/krl-keyid -s $OBJ/revoked-ca.pub $OBJ/revoked-keyid \
+        >/dev/null || fatal "$SSHKEYGEN KRL failed"
+}
+
+verbose "$tid: generating KRLs"
+genkrls
+
+check_krl() {
+        KEY=$1
+        KRL=$2
+        EXPECT_REVOKED=$3
+        TAG=$4
+        $SSHKEYGEN -Qf $KRL $KEY >/dev/null
+        result=$?
+        if test "x$EXPECT_REVOKED" = "xyes" -a $result -eq 0 ; then
+                fatal "key $KEY not revoked by KRL $KRL: $TAG"
+        elif test "x$EXPECT_REVOKED" = "xno" -a $result -ne 0 ; then
+                fatal "key $KEY unexpectedly revoked by KRL $KRL: $TAG"
+        fi
+}
+test_all() {
+        FILES=$1
+        TAG=$2
+        KEYS_RESULT=$3
+        ALL_RESULT=$4
+        SERIAL_RESULT=$5
+        KEYID_RESULT=$6
+        CERTS_RESULT=$7
+        CA_RESULT=$8
+        verbose "$tid: checking revocations for $TAG"
+        for f in $FILES ; do
+                check_krl $f $OBJ/krl-empty  no             "$TAG"
+                check_krl $f $OBJ/krl-keys   $KEYS_RESULT   "$TAG"
+                check_krl $f $OBJ/krl-all    $ALL_RESULT    "$TAG"
+                check_krl $f $OBJ/krl-serial $SERIAL_RESULT "$TAG"
+                check_krl $f $OBJ/krl-keyid  $KEYID_RESULT  "$TAG"
+                check_krl $f $OBJ/krl-cert  $CERTS_RESULT   "$TAG"
+                check_krl $f $OBJ/krl-ca     $CA_RESULT     "$TAG"
+        done
+}
+#                                            keys  all serial  keyid  certs   CA
+test_all    "$REVOKED_KEYS"    "revoked keys" yes  yes     no     no     no   no
+test_all  "$UNREVOKED_KEYS"  "unrevoked keys"  no   no     no     no     no   no
+test_all   "$REVOKED_CERTS"   "revoked certs" yes  yes    yes    yes    yes  yes
+test_all "$UNREVOKED_CERTS" "unrevoked certs"  no   no     no     no     no  yes
+
+# Check update. Results should be identical.
+verbose "$tid: testing KRL update"
+for f in $OBJ/krl-keys $OBJ/krl-cert $OBJ/krl-all \
+    $OBJ/krl-ca $OBJ/krl-serial $OBJ/krl-keyid ; do
+        cp -f $OBJ/krl-empty $f
+        genkrls -u
+done
+#                                            keys  all serial  keyid  certs   CA
+test_all    "$REVOKED_KEYS"    "revoked keys" yes  yes     no     no     no   no
+test_all  "$UNREVOKED_KEYS"  "unrevoked keys"  no   no     no     no     no   no
+test_all   "$REVOKED_CERTS"   "revoked certs" yes  yes    yes    yes    yes  yes
+test_all "$UNREVOKED_CERTS" "unrevoked certs"  no   no     no     no     no  yes
diff --git a/regress/modpipe.c b/regress/modpipe.c
new file mode 100755
index 000000000..9629aa80b
--- /dev/null
+++ b/regress/modpipe.c
@@ -0,0 +1,175 @@
+/*
+ * Copyright (c) 2012 Damien Miller <djm@mindrot.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $OpenBSD: modpipe.c,v 1.4 2013/02/20 08:29:27 djm Exp $ */
+
+#include "includes.h"
+
+#include <sys/types.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdarg.h>
+#include <stdlib.h>
+#include <errno.h>
+#include "openbsd-compat/getopt.c"
+
+static void err(int, const char *, ...) __attribute__((format(printf, 2, 3)));
+static void errx(int, const char *, ...) __attribute__((format(printf, 2, 3)));
+
+static void
+err(int r, const char *fmt, ...)
+{
+        va_list args;
+
+        va_start(args, fmt);
+        fprintf(stderr, "%s: ", strerror(errno));
+        vfprintf(stderr, fmt, args);
+        fputc('\n', stderr);
+        va_end(args);
+        exit(r);
+}
+
+static void
+errx(int r, const char *fmt, ...)
+{
+        va_list args;
+
+        va_start(args, fmt);
+        vfprintf(stderr, fmt, args);
+        fputc('\n', stderr);
+        va_end(args);
+        exit(r);
+}
+
+static void
+usage(void)
+{
+        fprintf(stderr, "Usage: modpipe -w [-m modspec ...] < in > out\n");
+        fprintf(stderr, "modspec is one of:\n");
+        fprintf(stderr, "    xor:offset:value       - XOR \"value\" at \"offset\"\n");
+        fprintf(stderr, "    andor:offset:val1:val2 - AND \"val1\" then OR \"val2\" at \"offset\"\n");
+        exit(1);
+}
+
+#define MAX_MODIFICATIONS 256
+struct modification {
+        enum { MOD_XOR, MOD_AND_OR } what;
+        u_int64_t offset;
+        u_int8_t m1, m2;
+};
+
+static void
+parse_modification(const char *s, struct modification *m)
+{
+        char what[16+1];
+        int n, m1, m2;
+
+        bzero(m, sizeof(*m));
+        if ((n = sscanf(s, "%16[^:]%*[:]%lli%*[:]%i%*[:]%i",
+            what, &m->offset, &m1, &m2)) < 3)
+                errx(1, "Invalid modification spec \"%s\"", s);
+        if (strcasecmp(what, "xor") == 0) {
+                if (n > 3)
+                        errx(1, "Invalid modification spec \"%s\"", s);
+                if (m1 < 0 || m1 > 0xff)
+                        errx(1, "Invalid XOR modification value");
+                m->what = MOD_XOR;
+                m->m1 = m1;
+        } else if (strcasecmp(what, "andor") == 0) {
+                if (n != 4)
+                        errx(1, "Invalid modification spec \"%s\"", s);
+                if (m1 < 0 || m1 > 0xff)
+                        errx(1, "Invalid AND modification value");
+                if (m2 < 0 || m2 > 0xff)
+                        errx(1, "Invalid OR modification value");
+                m->what = MOD_AND_OR;
+                m->m1 = m1;
+                m->m2 = m2;
+        } else
+                errx(1, "Invalid modification type \"%s\"", what);
+}
+
+int
+main(int argc, char **argv)
+{
+        int ch;
+        u_char buf[8192];
+        size_t total;
+        ssize_t r, s, o;
+        struct modification mods[MAX_MODIFICATIONS];
+        u_int i, wflag = 0, num_mods = 0;
+
+        while ((ch = getopt(argc, argv, "wm:")) != -1) {
+                switch (ch) {
+                case 'm':
+                        if (num_mods >= MAX_MODIFICATIONS)
+                                errx(1, "Too many modifications");
+                        parse_modification(optarg, &(mods[num_mods++]));
+                        break;
+                case 'w':
+                        wflag = 1;
+                        break;
+                default:
+                        usage();
+                        /* NOTREACHED */
+                }
+        }
+        for (total = 0;;) {
+                r = s = read(STDIN_FILENO, buf, sizeof(buf));
+                if (r == 0)
+                        break;
+                if (r < 0) {
+                        if (errno == EAGAIN || errno == EINTR)
+                                continue;
+                        err(1, "read");
+                }
+                for (i = 0; i < num_mods; i++) {
+                        if (mods[i].offset < total ||
+                            mods[i].offset >= total + s)
+                                continue;
+                        switch (mods[i].what) {
+                        case MOD_XOR:
+                                buf[mods[i].offset - total] ^= mods[i].m1;
+                                break;
+                        case MOD_AND_OR:
+                                buf[mods[i].offset - total] &= mods[i].m1;
+                                buf[mods[i].offset - total] |= mods[i].m2;
+                                break;
+                        }
+                }
+                for (o = 0; o < s; o += r) {
+                        r = write(STDOUT_FILENO, buf, s - o);
+                        if (r == 0)
+                                break;
+                        if (r < 0) {
+                                if (errno == EAGAIN || errno == EINTR)
+                                        continue;
+                                err(1, "write");
+                        }
+                }
+                total += s;
+        }
+        /* Warn if modifications not reached in input stream */
+        r = 0;
+        for (i = 0; wflag && i < num_mods; i++) {
+                if (mods[i].offset < total)
+                        continue;
+                r = 1;
+                fprintf(stderr, "modpipe: warning - mod %u not reached\n", i);
+        }
+        return r;
+}
diff --git a/regress/multiplex.sh b/regress/multiplex.sh
index 93e15088f..1e6cc7606 100644
--- a/regress/multiplex.sh
+++ b/regress/multiplex.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: multiplex.sh,v 1.13 2012/06/01 00:47:36 djm Exp $
+#       $OpenBSD: multiplex.sh,v 1.17 2012/10/05 02:05:30 dtucker Exp $
 #       Placed in the Public Domain.
 
 CTL=/tmp/openssh.regress.ctl-sock.$$
@@ -13,14 +13,22 @@ fi
 DATA=/bin/ls${EXEEXT}
 COPY=$OBJ/ls.copy
 
+wait_for_mux_master_ready()
+{
+        for i in 1 2 3 4 5; do
+                ${SSH} -F $OBJ/ssh_config -S $CTL -Ocheck otherhost \
+                    >/dev/null 2>&1 && return 0
+                sleep $i
+        done
+        fatal "mux master never becomes ready"
+}
+
 start_sshd
 
 trace "start master, fork to background"
 ${SSH} -Nn2 -MS$CTL -F $OBJ/ssh_config -oSendEnv="_XXX_TEST" somehost &
 MASTER_PID=$!
-
-# Wait for master to start and authenticate
-sleep 5
+wait_for_mux_master_ready
 
 verbose "test $tid: envpass"
 trace "env passing over multiplexed connection"
@@ -78,13 +86,35 @@ for s in 0 1 4 5 44; do
         fi
 done
 
-trace "test check command"
-${SSH} -F $OBJ/ssh_config -S $CTL -Ocheck otherhost || fail "check command failed" 
+verbose "test $tid: cmd check"
+${SSH} -F $OBJ/ssh_config -S $CTL -Ocheck otherhost >>$TEST_SSH_LOGFILE 2>&1 \
+    || fail "check command failed" 
 
-trace "test exit command"
-${SSH} -F $OBJ/ssh_config -S $CTL -Oexit otherhost || fail "send exit command failed" 
+verbose "test $tid: cmd exit"
+${SSH} -F $OBJ/ssh_config -S $CTL -Oexit otherhost >>$TEST_SSH_LOGFILE 2>&1 \
+    || fail "send exit command failed" 
 
 # Wait for master to exit
-sleep 2
+wait $MASTER_PID
+kill -0 $MASTER_PID >/dev/null 2>&1 && fail "exit command failed"
 
-kill -0 $MASTER_PID >/dev/null 2>&1 && fail "exit command failed" 
+# Restart master and test -O stop command with master using -N
+verbose "test $tid: cmd stop"
+trace "restart master, fork to background"
+${SSH} -Nn2 -MS$CTL -F $OBJ/ssh_config -oSendEnv="_XXX_TEST" somehost &
+MASTER_PID=$!
+wait_for_mux_master_ready
+
+# start a long-running command then immediately request a stop
+${SSH} -F $OBJ/ssh_config -S $CTL otherhost "sleep 10; exit 0" \
+     >>$TEST_SSH_LOGFILE 2>&1 &
+SLEEP_PID=$!
+${SSH} -F $OBJ/ssh_config -S $CTL -Ostop otherhost >>$TEST_SSH_LOGFILE 2>&1 \
+    || fail "send stop command failed"
+
+# wait until both long-running command and master have exited.
+wait $SLEEP_PID
+[ $! != 0 ] || fail "waiting for concurrent command"
+wait $MASTER_PID
+[ $! != 0 ] || fail "waiting for master stop"
+kill -0 $MASTER_PID >/dev/null 2>&1 && fail "stop command failed"
diff --git a/regress/test-exec.sh b/regress/test-exec.sh
index bdc2c1a49..aa4e6e5c0 100644
--- a/regress/test-exec.sh
+++ b/regress/test-exec.sh
@@ -140,6 +140,10 @@ if [ "x$TEST_SSH_LOGFILE" = "x" ]; then
         TEST_SSH_LOGFILE=/dev/null
 fi
 
+# Some data for test copies
+DATA=$OBJ/testdata
+cat $SSHD${EXEEXT} $SSHD${EXEEXT} $SSHD${EXEEXT} $SSHD${EXEEXT} >$DATA
+
 # these should be used in tests
 export SSH SSHD SSHAGENT SSHADD SSHKEYGEN SSHKEYSCAN SFTP SFTPSERVER SCP
 #echo $SSH $SSHD $SSHAGENT $SSHADD $SSHKEYGEN $SSHKEYSCAN $SFTP $SFTPSERVER $SCP
diff --git a/regress/try-ciphers.sh b/regress/try-ciphers.sh
index 925863504..084a1457a 100644
--- a/regress/try-ciphers.sh
+++ b/regress/try-ciphers.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: try-ciphers.sh,v 1.13 2012/06/28 05:07:45 dtucker Exp $
+#       $OpenBSD: try-ciphers.sh,v 1.19 2013/02/11 23:58:51 djm Exp $
 #       Placed in the Public Domain.
 
 tid="try ciphers"
@@ -7,11 +7,20 @@ ciphers="aes128-cbc 3des-cbc blowfish-cbc cast128-cbc
         arcfour128 arcfour256 arcfour 
         aes192-cbc aes256-cbc rijndael-cbc@lysator.liu.se
         aes128-ctr aes192-ctr aes256-ctr"
-macs="hmac-sha1 hmac-md5 umac-64@openssh.com hmac-sha1-96 hmac-md5-96"
+config_defined OPENSSL_HAVE_EVPGCM && \
+        ciphers="$ciphers aes128-gcm@openssh.com aes256-gcm@openssh.com"
+macs="hmac-sha1 hmac-md5 umac-64@openssh.com umac-128@openssh.com
+        hmac-sha1-96 hmac-md5-96
+        hmac-sha1-etm@openssh.com hmac-md5-etm@openssh.com
+        umac-64-etm@openssh.com umac-128-etm@openssh.com
+        hmac-sha1-96-etm@openssh.com hmac-md5-96-etm@openssh.com
+        hmac-ripemd160-etm@openssh.com"
 config_defined HAVE_EVP_SHA256 &&
-    macs="$macs hmac-sha2-256 hmac-sha2-512"
+    macs="$macs hmac-sha2-256 hmac-sha2-512
+        hmac-sha2-256-etm@openssh.com hmac-sha2-512-etm@openssh.com"
 
 for c in $ciphers; do
+        n=0
         for m in $macs; do
                 trace "proto 2 cipher $c mac $m"
                 verbose "test $tid: proto 2 cipher $c mac $m"
@@ -19,6 +28,11 @@ for c in $ciphers; do
                 if [ $? -ne 0 ]; then
                         fail "ssh -2 failed with mac $m cipher $c"
                 fi
+                # No point trying all MACs for GCM since they are ignored.
+                case $c in
+                aes*-gcm@openssh.com)   test $n -gt 0 && break;;
+                esac
+                n=`expr $n + 1`
         done
 done
 
@@ -32,20 +46,3 @@ for c in $ciphers; do
         fi
 done
 
-if ${SSH} -oCiphers=acss@openssh.org 2>&1 | grep "Bad SSH2 cipher" >/dev/null
-then
-        :
-else
-
-echo "Ciphers acss@openssh.org" >> $OBJ/sshd_proxy
-c=acss@openssh.org
-for m in $macs; do
-        trace "proto 2 $c mac $m"
-        verbose "test $tid: proto 2 cipher $c mac $m"
-        ${SSH} -F $OBJ/ssh_proxy -2 -m $m -c $c somehost true
-        if [ $? -ne 0 ]; then
-                fail "ssh -2 failed with mac $m cipher $c"
-        fi
-done
-
-fi
diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
index ef2b13c4f..e12418399 100644
--- a/sandbox-seccomp-filter.c
+++ b/sandbox-seccomp-filter.c
@@ -44,6 +44,7 @@
 #include <linux/audit.h>
 #include <linux/filter.h>
 #include <linux/seccomp.h>
+#include <elf.h>
 
 #include <asm/unistd.h>
 
@@ -90,7 +91,9 @@ static const struct sock_filter preauth_insns[] = {
         SC_DENY(open, EACCES),
         SC_ALLOW(getpid),
         SC_ALLOW(gettimeofday),
+#ifdef __NR_time /* not defined on EABI ARM */
         SC_ALLOW(time),
+#endif
         SC_ALLOW(read),
         SC_ALLOW(write),
         SC_ALLOW(close),
@@ -102,7 +105,12 @@ static const struct sock_filter preauth_insns[] = {
         SC_ALLOW(select),
 #endif
         SC_ALLOW(madvise),
+#ifdef __NR_mmap2 /* EABI ARM only has mmap2() */
+        SC_ALLOW(mmap2),
+#endif
+#ifdef __NR_mmap
         SC_ALLOW(mmap),
+#endif
         SC_ALLOW(munmap),
         SC_ALLOW(exit_group),
 #ifdef __NR_rt_sigprocmask
diff --git a/scp.0 b/scp.0
index e612d30ef..119d9293b 100644
--- a/scp.0
+++ b/scp.0
@@ -155,4 +155,4 @@ AUTHORS
      Timo Rinne <tri@iki.fi>
      Tatu Ylonen <ylo@cs.hut.fi>
 
-OpenBSD 5.2                    September 5, 2011                   OpenBSD 5.2
+OpenBSD 5.3                    September 5, 2011                   OpenBSD 5.3
diff --git a/scp.c b/scp.c
index c08d122ea..e1fdd3985 100644
--- a/scp.c
+++ b/scp.c
@@ -103,7 +103,7 @@
 #include <string.h>
 #include <time.h>
 #include <unistd.h>
-#if defined(HAVE_STRNVIS) && defined(HAVE_VIS_H)
+#if defined(HAVE_STRNVIS) && defined(HAVE_VIS_H) && !defined(BROKEN_STRNVIS)
 #include <vis.h>
 #endif
 
diff --git a/servconf.c b/servconf.c
index 9a8822938..1700d5aa6 100644
--- a/servconf.c
+++ b/servconf.c
@@ -1,5 +1,5 @@
 
-/* $OpenBSD: servconf.c,v 1.229 2012/07/13 01:35:21 dtucker Exp $ */
+/* $OpenBSD: servconf.c,v 1.234 2013/02/06 00:20:42 dtucker Exp $ */
 /*
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
@@ -48,6 +48,8 @@
 #include "groupaccess.h"
 #include "canohost.h"
 #include "packet.h"
+#include "hostfile.h"
+#include "auth.h"
 
 static void add_listen_addr(ServerOptions *, char *, int);
 static void add_one_listen_addr(ServerOptions *, char *, int);
@@ -139,6 +141,8 @@ initialize_server_options(ServerOptions *options)
         options->num_permitted_opens = -1;
         options->adm_forced_command = NULL;
         options->chroot_directory = NULL;
+        options->authorized_keys_command = NULL;
+        options->authorized_keys_command_user = NULL;
         options->zero_knowledge_password_authentication = -1;
         options->revoked_keys_file = NULL;
         options->trusted_user_ca_keys = NULL;
@@ -259,7 +263,7 @@ fill_default_server_options(ServerOptions *options)
         if (options->compression == -1)
                 options->compression = COMP_DELAYED;
         if (options->allow_tcp_forwarding == -1)
-                options->allow_tcp_forwarding = 1;
+                options->allow_tcp_forwarding = FORWARD_ALLOW;
         if (options->allow_agent_forwarding == -1)
                 options->allow_agent_forwarding = 1;
         if (options->gateway_ports == -1)
@@ -346,6 +350,8 @@ typedef enum {
         sZeroKnowledgePasswordAuthentication, sHostCertificate,
         sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile,
         sKexAlgorithms, sIPQoS, sVersionAddendum,
+        sAuthorizedKeysCommand, sAuthorizedKeysCommandUser,
+        sAuthenticationMethods,
         sDebianBanner,
         sDeprecated, sUnsupported
 } ServerOpCodes;
@@ -482,7 +488,10 @@ static struct {
         { "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL },
         { "kexalgorithms", sKexAlgorithms, SSHCFG_GLOBAL },
         { "ipqos", sIPQoS, SSHCFG_ALL },
+        { "authorizedkeyscommand", sAuthorizedKeysCommand, SSHCFG_ALL },
+        { "authorizedkeyscommanduser", sAuthorizedKeysCommandUser, SSHCFG_ALL },
         { "versionaddendum", sVersionAddendum, SSHCFG_GLOBAL },
+        { "authenticationmethods", sAuthenticationMethods, SSHCFG_ALL },
         { "debianbanner", sDebianBanner, SSHCFG_GLOBAL },
         { NULL, sBadOption, 0 }
 };
@@ -648,8 +657,9 @@ out:
 }
 
 /*
- * All of the attributes on a single Match line are ANDed together, so we need to check every
- * attribute and set the result to zero if any attribute does not match.
+ * All of the attributes on a single Match line are ANDed together, so we need
+ * to check every * attribute and set the result to zero if any attribute does
+ * not match.
  */
 static int
 match_cfg_line(char **condition, int line, struct connection_info *ci)
@@ -806,6 +816,14 @@ static const struct multistate multistate_privsep[] = {
         { "no",                         PRIVSEP_OFF },
         { NULL, -1 }
 };
+static const struct multistate multistate_tcpfwd[] = {
+        { "yes",                        FORWARD_ALLOW },
+        { "all",                        FORWARD_ALLOW },
+        { "no",                         FORWARD_DENY },
+        { "remote",                     FORWARD_REMOTE },
+        { "local",                      FORWARD_LOCAL },
+        { NULL, -1 }
+};
 
 int
 process_server_config_line(ServerOptions *options, char *line,
@@ -1179,7 +1197,8 @@ process_server_config_line(ServerOptions *options, char *line,
 
         case sAllowTcpForwarding:
                 intptr = &options->allow_tcp_forwarding;
-                goto parse_flag;
+                multistate_ptr = multistate_tcpfwd;
+                goto parse_multistate;
 
         case sAllowAgentForwarding:
                 intptr = &options->allow_agent_forwarding;
@@ -1459,7 +1478,6 @@ process_server_config_line(ServerOptions *options, char *line,
                 }
                 if (strcmp(arg, "none") == 0) {
                         if (*activep && n == -1) {
-                                channel_clear_adm_permitted_opens();
                                 options->num_permitted_opens = 1;
                                 channel_disable_adm_local_opens();
                         }
@@ -1543,6 +1561,43 @@ process_server_config_line(ServerOptions *options, char *line,
                 }
                 return 0;
 
+        case sAuthorizedKeysCommand:
+                len = strspn(cp, WHITESPACE);
+                if (*activep && options->authorized_keys_command == NULL) {
+                        if (cp[len] != '/' && strcasecmp(cp + len, "none") != 0)
+                                fatal("%.200s line %d: AuthorizedKeysCommand "
+                                    "must be an absolute path",
+                                    filename, linenum);
+                        options->authorized_keys_command = xstrdup(cp + len);
+                }
+                return 0;
+
+        case sAuthorizedKeysCommandUser:
+                charptr = &options->authorized_keys_command_user;
+
+                arg = strdelim(&cp);
+                if (*activep && *charptr == NULL)
+                        *charptr = xstrdup(arg);
+                break;
+
+        case sAuthenticationMethods:
+                if (*activep && options->num_auth_methods == 0) {
+                        while ((arg = strdelim(&cp)) && *arg != '\0') {
+                                if (options->num_auth_methods >=
+                                    MAX_AUTH_METHODS)
+                                        fatal("%s line %d: "
+                                            "too many authentication methods.",
+                                            filename, linenum);
+                                if (auth2_methods_valid(arg, 0) != 0)
+                                        fatal("%s line %d: invalid "
+                                            "authentication method list.",
+                                            filename, linenum);
+                                options->auth_methods[
+                                    options->num_auth_methods++] = xstrdup(arg);
+                        }
+                }
+                return 0;
+
         case sDebianBanner:
                 intptr = &options->debian_banner;
                 goto parse_int;
@@ -1697,6 +1752,8 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
         M_CP_INTOPT(hostbased_uses_name_from_packet_only);
         M_CP_INTOPT(kbd_interactive_authentication);
         M_CP_INTOPT(zero_knowledge_password_authentication);
+        M_CP_STROPT(authorized_keys_command);
+        M_CP_STROPT(authorized_keys_command_user);
         M_CP_INTOPT(permit_root_login);
         M_CP_INTOPT(permit_empty_passwd);
 
@@ -1781,6 +1838,8 @@ fmt_intarg(ServerOpCodes code, int val)
                 return fmt_multistate_int(val, multistate_compression);
         case sUsePrivilegeSeparation:
                 return fmt_multistate_int(val, multistate_privsep);
+        case sAllowTcpForwarding:
+                return fmt_multistate_int(val, multistate_tcpfwd);
         case sProtocol:
                 switch (val) {
                 case SSH_PROTO_1:
@@ -1961,6 +2020,8 @@ dump_config(ServerOptions *o)
         dump_cfg_string(sAuthorizedPrincipalsFile,
             o->authorized_principals_file);
         dump_cfg_string(sVersionAddendum, o->version_addendum);
+        dump_cfg_string(sAuthorizedKeysCommand, o->authorized_keys_command);
+        dump_cfg_string(sAuthorizedKeysCommandUser, o->authorized_keys_command_user);
 
         /* string arguments requiring a lookup */
         dump_cfg_string(sLogLevel, log_level_name(o->log_level));
@@ -1978,6 +2039,8 @@ dump_config(ServerOptions *o)
         dump_cfg_strarray(sAllowGroups, o->num_allow_groups, o->allow_groups);
         dump_cfg_strarray(sDenyGroups, o->num_deny_groups, o->deny_groups);
         dump_cfg_strarray(sAcceptEnv, o->num_accept_env, o->accept_env);
+        dump_cfg_strarray_oneline(sAuthenticationMethods,
+            o->num_auth_methods, o->auth_methods);
 
         /* other arguments */
         for (i = 0; i < o->num_subsystems; i++)
diff --git a/servconf.h b/servconf.h
index a15f2a7fa..bc0536927 100644
--- a/servconf.h
+++ b/servconf.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: servconf.h,v 1.103 2012/07/10 02:19:15 djm Exp $ */
+/* $OpenBSD: servconf.h,v 1.107 2013/01/03 05:49:36 djm Exp $ */
 
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -28,6 +28,7 @@
 #define MAX_ACCEPT_ENV          256     /* Max # of env vars. */
 #define MAX_MATCH_GROUPS        256     /* Max # of groups for Match. */
 #define MAX_AUTHKEYS_FILES      256     /* Max # of authorized_keys files. */
+#define MAX_AUTH_METHODS        256     /* Max # of AuthenticationMethods. */
 
 /* permit_root_login */
 #define PERMIT_NOT_SET          -1
@@ -41,6 +42,12 @@
 #define PRIVSEP_ON              1
 #define PRIVSEP_NOSANDBOX       2
 
+/* AllowTCPForwarding */
+#define FORWARD_DENY            0
+#define FORWARD_REMOTE          (1)
+#define FORWARD_LOCAL           (1<<1)
+#define FORWARD_ALLOW           (FORWARD_REMOTE|FORWARD_LOCAL)
+
 #define DEFAULT_AUTH_FAIL_MAX   6       /* Default for MaxAuthTries */
 #define DEFAULT_SESSIONS_MAX    10      /* Default for MaxSessions */
 
@@ -119,7 +126,7 @@ typedef struct {
         int     permit_user_env;        /* If true, read ~/.ssh/environment */
         int     use_login;      /* If true, login(1) is used */
         int     compression;    /* If true, compression is allowed */
-        int     allow_tcp_forwarding;
+        int     allow_tcp_forwarding; /* One of FORWARD_* */
         int     allow_agent_forwarding;
         u_int num_allow_users;
         char   *allow_users[MAX_ALLOW_USERS];
@@ -170,8 +177,14 @@ typedef struct {
         char   *revoked_keys_file;
         char   *trusted_user_ca_keys;
         char   *authorized_principals_file;
+        char   *authorized_keys_command;
+        char   *authorized_keys_command_user;
 
         char   *version_addendum;       /* Appended to SSH banner */
+
+        u_int   num_auth_methods;
+        char   *auth_methods[MAX_AUTH_METHODS];
+
         int     debian_banner;
 }       ServerOptions;
 
@@ -196,12 +209,15 @@ struct connection_info {
                 M_CP_STROPT(trusted_user_ca_keys); \
                 M_CP_STROPT(revoked_keys_file); \
                 M_CP_STROPT(authorized_principals_file); \
+                M_CP_STROPT(authorized_keys_command); \
+                M_CP_STROPT(authorized_keys_command_user); \
                 M_CP_STRARRAYOPT(authorized_keys_files, num_authkeys_files); \
                 M_CP_STRARRAYOPT(allow_users, num_allow_users); \
                 M_CP_STRARRAYOPT(deny_users, num_deny_users); \
                 M_CP_STRARRAYOPT(allow_groups, num_allow_groups); \
                 M_CP_STRARRAYOPT(deny_groups, num_deny_groups); \
                 M_CP_STRARRAYOPT(accept_env, num_accept_env); \
+                M_CP_STRARRAYOPT(auth_methods, num_auth_methods); \
         } while (0)
 
 struct connection_info *get_connection_info(int, int);
diff --git a/serverloop.c b/serverloop.c
index 0b0f386d9..9e5fa555e 100644
--- a/serverloop.c
+++ b/serverloop.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: serverloop.c,v 1.162 2012/06/20 04:42:58 djm Exp $ */
+/* $OpenBSD: serverloop.c,v 1.164 2012/12/07 01:51:35 dtucker Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -708,7 +708,7 @@ server_loop(pid_t pid, int fdin_arg, int fdout_arg, int fderr_arg)
                     &nalloc, max_time_milliseconds);
 
                 if (received_sigterm) {
-                        logit("Exiting on signal %d", received_sigterm);
+                        logit("Exiting on signal %d", (int)received_sigterm);
                         /* Clean up sessions, utmp, etc. */
                         cleanup_exit(255);
                 }
@@ -858,7 +858,7 @@ server_loop2(Authctxt *authctxt)
                     &nalloc, 0);
 
                 if (received_sigterm) {
-                        logit("Exiting on signal %d", received_sigterm);
+                        logit("Exiting on signal %d", (int)received_sigterm);
                         /* Clean up sessions, utmp, etc. */
                         cleanup_exit(255);
                 }
@@ -950,7 +950,7 @@ server_input_window_size(int type, u_int32_t seq, void *ctxt)
 static Channel *
 server_request_direct_tcpip(void)
 {
-        Channel *c;
+        Channel *c = NULL;
         char *target, *originator;
         u_short target_port, originator_port;
 
@@ -963,9 +963,16 @@ server_request_direct_tcpip(void)
         debug("server_request_direct_tcpip: originator %s port %d, target %s "
             "port %d", originator, originator_port, target, target_port);
 
-        /* XXX check permission */
-        c = channel_connect_to(target, target_port,
-            "direct-tcpip", "direct-tcpip");
+        /* XXX fine grained permissions */
+        if ((options.allow_tcp_forwarding & FORWARD_LOCAL) != 0 &&
+            !no_port_forwarding_flag) {
+                c = channel_connect_to(target, target_port,
+                    "direct-tcpip", "direct-tcpip");
+        } else {
+                logit("refused local port forward: "
+                    "originator %s port %d, target %s port %d",
+                    originator, originator_port, target, target_port);
+        }
 
         xfree(originator);
         xfree(target);
@@ -1126,7 +1133,7 @@ server_input_global_request(int type, u_int32_t seq, void *ctxt)
                     listen_address, listen_port);
 
                 /* check permissions */
-                if (!options.allow_tcp_forwarding ||
+                if ((options.allow_tcp_forwarding & FORWARD_REMOTE) == 0 ||
                     no_port_forwarding_flag ||
                     (!want_reply && listen_port == 0)
 #ifndef NO_IPPORT_RESERVED_CONCEPT
diff --git a/session.c b/session.c
index 1bffa6b06..cff14cd5a 100644
--- a/session.c
+++ b/session.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: session.c,v 1.260 2012/03/15 03:10:27 guenther Exp $ */
+/* $OpenBSD: session.c,v 1.261 2012/12/02 20:46:11 djm Exp $ */
 /*
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
@@ -274,7 +274,10 @@ do_authenticated(Authctxt *authctxt)
         setproctitle("%s", authctxt->pw->pw_name);
 
         /* setup the channel layer */
-        if (!no_port_forwarding_flag && options.allow_tcp_forwarding)
+        if (no_port_forwarding_flag ||
+            (options.allow_tcp_forwarding & FORWARD_LOCAL) == 0)
+                channel_disable_adm_local_opens();
+        else
                 channel_permit_all_opens();
 
         auth_debug_send();
@@ -384,7 +387,7 @@ do_authenticated1(Authctxt *authctxt)
                                 debug("Port forwarding not permitted for this authentication.");
                                 break;
                         }
-                        if (!options.allow_tcp_forwarding) {
+                        if (!(options.allow_tcp_forwarding & FORWARD_REMOTE)) {
                                 debug("Port forwarding not permitted.");
                                 break;
                         }
@@ -1526,6 +1529,11 @@ do_setusercontext(struct passwd *pw, const char *role)
                         perror("unable to set user context (setuser)");
                         exit(1);
                 }
+                /* 
+                 * FreeBSD's setusercontext() will not apply the user's
+                 * own umask setting unless running with the user's UID.
+                 */
+                (void) setusercontext(lc, pw, pw->pw_uid, LOGIN_SETUMASK);
 #else
                 /* Permanently switch to the desired uid. */
                 permanently_set_uid(pw);
diff --git a/sftp-server.0 b/sftp-server.0
index 340929d75..6beddcc13 100644
--- a/sftp-server.0
+++ b/sftp-server.0
@@ -4,7 +4,8 @@ NAME
      sftp-server - SFTP server subsystem
 
 SYNOPSIS
-     sftp-server [-ehR] [-f log_facility] [-l log_level] [-u umask]
+     sftp-server [-ehR] [-d start_directory] [-f log_facility] [-l log_level]
+                 [-u umask]
 
 DESCRIPTION
      sftp-server is a program that speaks the server side of SFTP protocol to
@@ -17,6 +18,15 @@ DESCRIPTION
 
      Valid options are:
 
+     -d start_directory
+             specifies an alternate starting directory for users.  The
+             pathname may contain the following tokens that are expanded at
+             runtime: %% is replaced by a literal '%', %h is replaced by the
+             home directory of the user being authenticated, and %u is
+             replaced by the username of that user.  The default is to use the
+             user's home directory.  This option is useful in conjunction with
+             the sshd_config(5) ChrootDirectory option.
+
      -e      Causes sftp-server to print logging information to stderr instead
              of syslog for debugging.
 
@@ -61,4 +71,4 @@ HISTORY
 AUTHORS
      Markus Friedl <markus@openbsd.org>
 
-OpenBSD 5.2                     January 9, 2010                    OpenBSD 5.2
+OpenBSD 5.3                     January 4, 2013                    OpenBSD 5.3
diff --git a/sftp-server.8 b/sftp-server.8
index bb19c15e1..2fd3df20c 100644
--- a/sftp-server.8
+++ b/sftp-server.8
@@ -1,4 +1,4 @@
-.\" $OpenBSD: sftp-server.8,v 1.19 2010/01/09 03:36:00 jmc Exp $
+.\" $OpenBSD: sftp-server.8,v 1.21 2013/01/04 19:26:38 jmc Exp $
 .\"
 .\" Copyright (c) 2000 Markus Friedl.  All rights reserved.
 .\"
@@ -22,7 +22,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: January 9 2010 $
+.Dd $Mdocdate: January 4 2013 $
 .Dt SFTP-SERVER 8
 .Os
 .Sh NAME
@@ -31,6 +31,7 @@
 .Sh SYNOPSIS
 .Nm sftp-server
 .Op Fl ehR
+.Op Fl d Ar start_directory
 .Op Fl f Ar log_facility
 .Op Fl l Ar log_level
 .Op Fl u Ar umask
@@ -56,6 +57,17 @@ for more information.
 .Pp
 Valid options are:
 .Bl -tag -width Ds
+.It Fl d Ar start_directory
+specifies an alternate starting directory for users.
+The pathname may contain the following tokens that are expanded at runtime:
+%% is replaced by a literal '%',
+%h is replaced by the home directory of the user being authenticated,
+and %u is replaced by the username of that user.
+The default is to use the user's home directory.
+This option is useful in conjunction with the
+.Xr sshd_config 5
+.Cm ChrootDirectory
+option.
 .It Fl e
 Causes
 .Nm
diff --git a/sftp-server.c b/sftp-server.c
index 9d01c7d79..cce074a56 100644
--- a/sftp-server.c
+++ b/sftp-server.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sftp-server.c,v 1.94 2011/06/17 21:46:16 djm Exp $ */
+/* $OpenBSD: sftp-server.c,v 1.96 2013/01/04 19:26:38 jmc Exp $ */
 /*
  * Copyright (c) 2000-2004 Markus Friedl.  All rights reserved.
  *
@@ -1390,7 +1390,8 @@ sftp_server_usage(void)
         extern char *__progname;
 
         fprintf(stderr,
-            "usage: %s [-ehR] [-f log_facility] [-l log_level] [-u umask]\n",
+            "usage: %s [-ehR] [-d start_directory] [-f log_facility] "
+            "[-l log_level]\n\t[-u umask]\n",
             __progname);
         exit(1);
 }
@@ -1402,7 +1403,7 @@ sftp_server_main(int argc, char **argv, struct passwd *user_pw)
         int in, out, max, ch, skipargs = 0, log_stderr = 0;
         ssize_t len, olen, set_size;
         SyslogFacility log_facility = SYSLOG_FACILITY_AUTH;
-        char *cp, buf[4*4096];
+        char *cp, *homedir = NULL, buf[4*4096];
         long mask;
 
         extern char *optarg;
@@ -1411,7 +1412,9 @@ sftp_server_main(int argc, char **argv, struct passwd *user_pw)
         __progname = ssh_get_progname(argv[0]);
         log_init(__progname, log_level, log_facility, log_stderr);
 
-        while (!skipargs && (ch = getopt(argc, argv, "f:l:u:cehR")) != -1) {
+        pw = pwcopy(user_pw);
+
+        while (!skipargs && (ch = getopt(argc, argv, "d:f:l:u:cehR")) != -1) {
                 switch (ch) {
                 case 'R':
                         readonly = 1;
@@ -1436,6 +1439,12 @@ sftp_server_main(int argc, char **argv, struct passwd *user_pw)
                         if (log_facility == SYSLOG_FACILITY_NOT_SET)
                                 error("Invalid log facility \"%s\"", optarg);
                         break;
+                case 'd':
+                        cp = tilde_expand_filename(optarg, user_pw->pw_uid);
+                        homedir = percent_expand(cp, "d", user_pw->pw_dir,
+                            "u", user_pw->pw_name, (char *)NULL);
+                        free(cp);
+                        break;
                 case 'u':
                         errno = 0;
                         mask = strtol(optarg, &cp, 8);
@@ -1463,8 +1472,6 @@ sftp_server_main(int argc, char **argv, struct passwd *user_pw)
         } else
                 client_addr = xstrdup("UNKNOWN");
 
-        pw = pwcopy(user_pw);
-
         logit("session opened for local user %s from [%s]",
             pw->pw_name, client_addr);
 
@@ -1489,6 +1496,13 @@ sftp_server_main(int argc, char **argv, struct passwd *user_pw)
         rset = (fd_set *)xmalloc(set_size);
         wset = (fd_set *)xmalloc(set_size);
 
+        if (homedir != NULL) {
+                if (chdir(homedir) != 0) {
+                        error("chdir to \"%s\" failed: %s", homedir,
+                            strerror(errno));
+                }
+        }
+
         for (;;) {
                 memset(rset, 0, set_size);
                 memset(wset, 0, set_size);
diff --git a/sftp.0 b/sftp.0
index e67b64c48..dd1da5241 100644
--- a/sftp.0
+++ b/sftp.0
@@ -336,4 +336,4 @@ SEE ALSO
      draft-ietf-secsh-filexfer-00.txt, January 2001, work in progress
      material.
 
-OpenBSD 5.2                    September 5, 2011                   OpenBSD 5.2
+OpenBSD 5.3                    September 5, 2011                   OpenBSD 5.3
diff --git a/sftp.c b/sftp.c
index 235c6ad04..342ae7efc 100644
--- a/sftp.c
+++ b/sftp.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sftp.c,v 1.136 2012/06/22 14:36:33 dtucker Exp $ */
+/* $OpenBSD: sftp.c,v 1.142 2013/02/08 00:41:12 djm Exp $ */
 /*
  * Copyright (c) 2001-2004 Damien Miller <djm@openbsd.org>
  *
@@ -54,10 +54,6 @@ typedef void EditLine;
 # include <util.h>
 #endif
 
-#ifdef HAVE_LIBUTIL_H
-# include <libutil.h>
-#endif
-
 #include "xmalloc.h"
 #include "log.h"
 #include "pathnames.h"
@@ -991,6 +987,10 @@ makeargv(const char *arg, int *argcp, int sloppy, char *lastquote,
         state = MA_START;
         i = j = 0;
         for (;;) {
+                if ((size_t)argc >= sizeof(argv) / sizeof(*argv)){
+                        error("Too many arguments.");
+                        return NULL;
+                }
                 if (isspace(arg[i])) {
                         if (state == MA_UNQUOTED) {
                                 /* Terminate current argument */
@@ -1141,7 +1141,7 @@ parse_args(const char **cpp, int *pflag, int *rflag, int *lflag, int *iflag,
 
         /* Figure out which command we have */
         for (i = 0; cmds[i].c != NULL; i++) {
-                if (strcasecmp(cmds[i].c, argv[0]) == 0)
+                if (argv[0] != NULL && strcasecmp(cmds[i].c, argv[0]) == 0)
                         break;
         }
         cmdnum = cmds[i].n;
@@ -1695,7 +1695,7 @@ complete_match(EditLine *el, struct sftp_conn *conn, char *remote_path,
 {
         glob_t g;
         char *tmp, *tmp2, ins[3];
-        u_int i, hadglob, pwdlen, len, tmplen, filelen;
+        u_int i, hadglob, pwdlen, len, tmplen, filelen, cesc, isesc, isabs;
         const LineInfo *lf;
         
         /* Glob from "file" location */
@@ -1704,6 +1704,9 @@ complete_match(EditLine *el, struct sftp_conn *conn, char *remote_path,
         else
                 xasprintf(&tmp, "%s*", file);
 
+        /* Check if the path is absolute. */
+        isabs = tmp[0] == '/';
+
         memset(&g, 0, sizeof(g));
         if (remote != LOCAL) {
                 tmp = make_absolute(tmp, remote_path);
@@ -1738,7 +1741,7 @@ complete_match(EditLine *el, struct sftp_conn *conn, char *remote_path,
                 goto out;
 
         tmp2 = complete_ambiguous(file, g.gl_pathv, g.gl_matchc);
-        tmp = path_strip(tmp2, remote_path);
+        tmp = path_strip(tmp2, isabs ? NULL : remote_path);
         xfree(tmp2);
 
         if (tmp == NULL)
@@ -1747,8 +1750,18 @@ complete_match(EditLine *el, struct sftp_conn *conn, char *remote_path,
         tmplen = strlen(tmp);
         filelen = strlen(file);
 
-        if (tmplen > filelen)  {
-                tmp2 = tmp + filelen;
+        /* Count the number of escaped characters in the input string. */
+        cesc = isesc = 0;
+        for (i = 0; i < filelen; i++) {
+                if (!isesc && file[i] == '\\' && i + 1 < filelen){
+                        isesc = 1;
+                        cesc++;
+                } else
+                        isesc = 0;
+        }
+
+        if (tmplen > (filelen - cesc)) {
+                tmp2 = tmp + filelen - cesc;
                 len = strlen(tmp2); 
                 /* quote argument on way out */
                 for (i = 0; i < len; i++) {
@@ -1762,6 +1775,8 @@ complete_match(EditLine *el, struct sftp_conn *conn, char *remote_path,
                         case '\t':
                         case '[':
                         case ' ':
+                        case '#':
+                        case '*':
                                 if (quote == '\0' || tmp2[i] == quote) {
                                         if (el_insertstr(el, ins) == -1)
                                                 fatal("el_insertstr "
@@ -1917,6 +1932,7 @@ interactive_loop(struct sftp_conn *conn, char *file1, char *file2)
                                 return (-1);
                         }
                 } else {
+                        /* XXX this is wrong wrt quoting */
                         if (file2 == NULL)
                                 snprintf(cmd, sizeof cmd, "get %s", dir);
                         else
diff --git a/ssh-add.0 b/ssh-add.0
index 2ed59c10e..ed43dc8cc 100644
--- a/ssh-add.0
+++ b/ssh-add.0
@@ -37,16 +37,17 @@ DESCRIPTION
 
      -d      Instead of adding identities, removes identities from the agent.
              If ssh-add has been run without arguments, the keys for the
-             default identities will be removed.  Otherwise, the argument list
-             will be interpreted as a list of paths to public key files and
-             matching keys will be removed from the agent.  If no public key
-             is found at a given path, ssh-add will append .pub and retry.
+             default identities and their corresponding certificates will be
+             removed.  Otherwise, the argument list will be interpreted as a
+             list of paths to public key files to specify keys and
+             certificates to be removed from the agent.  If no public key is
+             found at a given path, ssh-add will append .pub and retry.
 
      -e pkcs11
              Remove keys provided by the PKCS#11 shared library pkcs11.
 
-     -k      When loading keys into the agent, load plain private keys only
-             and skip certificates.
+     -k      When loading keys into or deleting keys from the agent, process
+             plain private keys only and skip certificates.
 
      -L      Lists public key parameters of all identities currently
              represented by the agent.
@@ -115,4 +116,4 @@ AUTHORS
      created OpenSSH.  Markus Friedl contributed the support for SSH protocol
      versions 1.5 and 2.0.
 
-OpenBSD 5.2                    October 18, 2011                    OpenBSD 5.2
+OpenBSD 5.3                    December 3, 2012                    OpenBSD 5.3
diff --git a/ssh-add.1 b/ssh-add.1
index 64e21bb51..d394b2696 100644
--- a/ssh-add.1
+++ b/ssh-add.1
@@ -1,4 +1,4 @@
-.\"     $OpenBSD: ssh-add.1,v 1.56 2011/10/18 05:00:48 djm Exp $
+.\"     $OpenBSD: ssh-add.1,v 1.58 2012/12/03 08:33:02 jmc Exp $
 .\"
 .\" Author: Tatu Ylonen <ylo@cs.hut.fi>
 .\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -35,7 +35,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: October 18 2011 $
+.Dd $Mdocdate: December 3 2012 $
 .Dt SSH-ADD 1
 .Os
 .Sh NAME
@@ -102,10 +102,10 @@ Deletes all identities from the agent.
 Instead of adding identities, removes identities from the agent.
 If
 .Nm
-has been run without arguments, the keys for the default identities will
-be removed.
+has been run without arguments, the keys for the default identities and
+their corresponding certificates will be removed.
 Otherwise, the argument list will be interpreted as a list of paths to
-public key files and matching keys will be removed from the agent.
+public key files to specify keys and certificates to be removed from the agent.
 If no public key is found at a given path,
 .Nm
 will append
@@ -115,8 +115,8 @@ and retry.
 Remove keys provided by the PKCS#11 shared library
 .Ar pkcs11 .
 .It Fl k
-When loading keys into the agent, load plain private keys only and skip
-certificates.
+When loading keys into or deleting keys from the agent, process plain private
+keys only and skip certificates.
 .It Fl L
 Lists public key parameters of all identities currently represented
 by the agent.
diff --git a/ssh-add.c b/ssh-add.c
index 0111b7793..b9c7a0211 100644
--- a/ssh-add.c
+++ b/ssh-add.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-add.c,v 1.103 2011/10/18 23:37:42 djm Exp $ */
+/* $OpenBSD: ssh-add.c,v 1.105 2012/12/05 15:42:52 markus Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -96,10 +96,10 @@ clear_pass(void)
 }
 
 static int
-delete_file(AuthenticationConnection *ac, const char *filename)
+delete_file(AuthenticationConnection *ac, const char *filename, int key_only)
 {
-        Key *public;
-        char *comment = NULL;
+        Key *public = NULL, *cert = NULL;
+        char *certpath = NULL, *comment = NULL;
         int ret = -1;
 
         public = key_load_public(filename, &comment);
@@ -113,8 +113,33 @@ delete_file(AuthenticationConnection *ac, const char *filename)
         } else
                 fprintf(stderr, "Could not remove identity: %s\n", filename);
 
-        key_free(public);
-        xfree(comment);
+        if (key_only)
+                goto out;
+
+        /* Now try to delete the corresponding certificate too */
+        free(comment);
+        comment = NULL;
+        xasprintf(&certpath, "%s-cert.pub", filename);
+        if ((cert = key_load_public(certpath, &comment)) == NULL)
+                goto out;
+        if (!key_equal_public(cert, public))
+                fatal("Certificate %s does not match private key %s",
+                    certpath, filename);
+
+        if (ssh_remove_identity(ac, cert)) {
+                fprintf(stderr, "Identity removed: %s (%s)\n", certpath,
+                    comment);
+                ret = 0;
+        } else
+                fprintf(stderr, "Could not remove identity: %s\n", certpath);
+
+ out:
+        if (cert != NULL)
+                key_free(cert);
+        if (public != NULL)
+                key_free(public);
+        free(certpath);
+        free(comment);
 
         return ret;
 }
@@ -362,7 +387,7 @@ static int
 do_file(AuthenticationConnection *ac, int deleting, int key_only, char *file)
 {
         if (deleting) {
-                if (delete_file(ac, file) == -1)
+                if (delete_file(ac, file, key_only) == -1)
                         return -1;
         } else {
                 if (add_file(ac, file, key_only) == -1)
diff --git a/ssh-agent.0 b/ssh-agent.0
index 77930ce42..578984815 100644
--- a/ssh-agent.0
+++ b/ssh-agent.0
@@ -120,4 +120,4 @@ AUTHORS
      created OpenSSH.  Markus Friedl contributed the support for SSH protocol
      versions 1.5 and 2.0.
 
-OpenBSD 5.2                    November 21, 2010                   OpenBSD 5.2
+OpenBSD 5.3                    November 21, 2010                   OpenBSD 5.3
diff --git a/ssh-gss.h b/ssh-gss.h
index 31d5a0835..bc6e8f946 100644
--- a/ssh-gss.h
+++ b/ssh-gss.h
@@ -42,12 +42,13 @@
 #   include <gssapi/gssapi_generic.h>
 #  endif
 
-/* MIT Kerberos doesn't seem to define GSS_NT_HOSTBASED_SERVICE */
+/* Old MIT Kerberos doesn't seem to define GSS_NT_HOSTBASED_SERVICE */
 
-#ifndef GSS_C_NT_HOSTBASED_SERVICE
-#define GSS_C_NT_HOSTBASED_SERVICE gss_nt_service_name
-#endif /* GSS_C_NT_... */
-#endif /* !HEIMDAL */
+#  if !HAVE_DECL_GSS_C_NT_HOSTBASED_SERVICE
+#   define GSS_C_NT_HOSTBASED_SERVICE gss_nt_service_name
+#  endif /* !HAVE_DECL_GSS_C_NT_... */
+
+# endif /* !HEIMDAL */
 #endif /* KRB5 */
 
 /* draft-ietf-secsh-gsskeyex-06 */
diff --git a/ssh-keygen.0 b/ssh-keygen.0
index 8f9fbd179..3c7a64753 100644
--- a/ssh-keygen.0
+++ b/ssh-keygen.0
@@ -25,6 +25,9 @@ SYNOPSIS
                 [-O option] [-V validity_interval] [-z serial_number] file ...
      ssh-keygen -L [-f input_keyfile]
      ssh-keygen -A
+     ssh-keygen -k -f krl_file [-u] [-s ca_public] [-z version_number]
+                file ...
+     ssh-keygen -Q -f krl_file file ...
 
 DESCRIPTION
      ssh-keygen generates, manages and converts authentication keys for
@@ -37,6 +40,10 @@ DESCRIPTION
      ssh-keygen is also used to generate groups for use in Diffie-Hellman
      group exchange (DH-GEX).  See the MODULI GENERATION section for details.
 
+     Finally, ssh-keygen can be used to generate and update Key Revocation
+     Lists, and to test whether given keys have been revoked by one.  See the
+     KEY REVOCATION LISTS section for details.
+
      Normally each user wishing to use SSH with public key authentication runs
      this once to create the authentication key in ~/.ssh/identity,
      ~/.ssh/id_ecdsa, ~/.ssh/id_dsa or ~/.ssh/id_rsa.  Additionally, the
@@ -167,6 +174,13 @@ DESCRIPTION
              keys from other software, including several commercial SSH
              implementations.  The default import format is ``RFC4716''.
 
+     -k      Generate a KRL file.  In this mode, ssh-keygen will generate a
+             KRL file at the location specified via the -f flag that revokes
+             every key or certificate presented on the command line.
+             Keys/certificates to be revoked may be specified by public key
+             file or using the format described in the KEY REVOCATION LISTS
+             section.
+
      -L      Prints the contents of a certificate.
 
      -l      Show fingerprint of specified public key file.  Private RSA1 keys
@@ -256,6 +270,8 @@ DESCRIPTION
              containing the private key, for the old passphrase, and twice for
              the new passphrase.
 
+     -Q      Test whether keys have been revoked in a KRL.
+
      -q      Silence ssh-keygen.
 
      -R hostname
@@ -275,6 +291,10 @@ DESCRIPTION
              Certify (sign) a public key using the specified CA key.  Please
              see the CERTIFICATES section for details.
 
+             When generating a KRL, -s specifies a path to a CA public key
+             file used to revoke certificates directly by key ID or serial
+             number.  See the KEY REVOCATION LISTS section for details.
+
      -T output_file
              Test DH group exchange candidate primes (generated using the -G
              option) for safety.
@@ -284,6 +304,10 @@ DESCRIPTION
              ``rsa1'' for protocol version 1 and ``dsa'', ``ecdsa'' or ``rsa''
              for protocol version 2.
 
+     -u      Update a KRL.  When specified with -k, keys listed via the
+             command line are added to the existing KRL rather than a new KRL
+             being created.
+
      -V validity_interval
              Specify a validity interval when signing a certificate.  A
              validity interval may consist of a single time, indicating that
@@ -321,6 +345,9 @@ DESCRIPTION
              distinguish this certificate from others from the same CA.  The
              default serial number is zero.
 
+             When generating a KRL, the -z flag is used to specify a KRL
+             version number.
+
 MODULI GENERATION
      ssh-keygen may be used to generate groups for the Diffie-Hellman Group
      Exchange (DH-GEX) protocol.  Generating these groups is a two-step
@@ -404,13 +431,64 @@ CERTIFICATES
      Finally, certificates may be defined with a validity lifetime.  The -V
      option allows specification of certificate start and end times.  A
      certificate that is presented at a time outside this range will not be
-     considered valid.  By default, certificates have a maximum validity
-     interval.
+     considered valid.  By default, certificates are valid from UNIX Epoch to
+     the distant future.
 
      For certificates to be used for user or host authentication, the CA
      public key must be trusted by sshd(8) or ssh(1).  Please refer to those
      manual pages for details.
 
+KEY REVOCATION LISTS
+     ssh-keygen is able to manage OpenSSH format Key Revocation Lists (KRLs).
+     These binary files specify keys or certificates to be revoked using a
+     compact format, taking as little a one bit per certificate if they are
+     being revoked by serial number.
+
+     KRLs may be generated using the -k flag.  This option reads one or more
+     files from the command line and generates a new KRL.  The files may
+     either contain a KRL specification (see below) or public keys, listed one
+     per line.  Plain public keys are revoked by listing their hash or
+     contents in the KRL and certificates revoked by serial number or key ID
+     (if the serial is zero or not available).
+
+     Revoking keys using a KRL specification offers explicit control over the
+     types of record used to revoke keys and may be used to directly revoke
+     certificates by serial number or key ID without having the complete
+     original certificate on hand.  A KRL specification consists of lines
+     containing one of the following directives followed by a colon and some
+     directive-specific information.
+
+     serial: serial_number[-serial_number]
+             Revokes a certificate with the specified serial number.  Serial
+             numbers are 64-bit values, not including zero and may be
+             expressed in decimal, hex or octal.  If two serial numbers are
+             specified separated by a hyphen, then the range of serial numbers
+             including and between each is revoked.  The CA key must have been
+             specified on the ssh-keygen command line using the -s option.
+
+     id: key_id
+             Revokes a certificate with the specified key ID string.  The CA
+             key must have been specified on the ssh-keygen command line using
+             the -s option.
+
+     key: public_key
+             Revokes the specified key.  If a certificate is listed, then it
+             is revoked as a plain public key.
+
+     sha1: public_key
+             Revokes the specified key by its SHA1 hash.
+
+     KRLs may be updated using the -u flag in addition to -k.  When this
+     option is specified, keys listed via the command line are merged into the
+     KRL, adding to those already there.
+
+     It is also possible, given a KRL, to test whether it revokes a particular
+     key (or keys).  The -Q flag will query an existing KRL, testing each key
+     specified on the commandline.  If any key listed on the command line has
+     been revoked (or an error encountered) then ssh-keygen will exit with a
+     non-zero exit status.  A zero exit status will only be returned if no key
+     was revoked.
+
 FILES
      ~/.ssh/identity
              Contains the protocol version 1 RSA authentication identity of
@@ -465,4 +543,4 @@ AUTHORS
      created OpenSSH.  Markus Friedl contributed the support for SSH protocol
      versions 1.5 and 2.0.
 
-OpenBSD 5.2                      July 6, 2012                      OpenBSD 5.2
+OpenBSD 5.3                    January 19, 2013                    OpenBSD 5.3
diff --git a/ssh-keygen.1 b/ssh-keygen.1
index fe26750a4..0d84ebd1e 100644
--- a/ssh-keygen.1
+++ b/ssh-keygen.1
@@ -1,4 +1,4 @@
-.\"     $OpenBSD: ssh-keygen.1,v 1.109 2012/07/06 00:41:59 dtucker Exp $
+.\"     $OpenBSD: ssh-keygen.1,v 1.115 2013/01/19 07:13:25 jmc Exp $
 .\"
 .\" Author: Tatu Ylonen <ylo@cs.hut.fi>
 .\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -35,7 +35,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: July 6 2012 $
+.Dd $Mdocdate: January 19 2013 $
 .Dt SSH-KEYGEN 1
 .Os
 .Sh NAME
@@ -122,6 +122,17 @@
 .Op Fl f Ar input_keyfile
 .Nm ssh-keygen
 .Fl A
+.Nm ssh-keygen
+.Fl k
+.Fl f Ar krl_file
+.Op Fl u
+.Op Fl s Ar ca_public
+.Op Fl z Ar version_number
+.Ar
+.Nm ssh-keygen
+.Fl Q
+.Fl f Ar krl_file
+.Ar
 .Ek
 .Sh DESCRIPTION
 .Nm
@@ -144,6 +155,14 @@ See the
 .Sx MODULI GENERATION
 section for details.
 .Pp
+Finally,
+.Nm
+can be used to generate and update Key Revocation Lists, and to test whether
+given keys have been revoked by one.
+See the
+.Sx KEY REVOCATION LISTS
+section for details.
+.Pp
 Normally each user wishing to use SSH
 with public key authentication runs this once to create the authentication
 key in
@@ -317,6 +336,17 @@ This option allows importing keys from other software, including several
 commercial SSH implementations.
 The default import format is
 .Dq RFC4716 .
+.It Fl k
+Generate a KRL file.
+In this mode,
+.Nm
+will generate a KRL file at the location specified via the
+.Fl f
+flag that revokes every key or certificate presented on the command line.
+Keys/certificates to be revoked may be specified by public key file or
+using the format described in the
+.Sx KEY REVOCATION LISTS
+section.
 .It Fl L
 Prints the contents of a certificate.
 .It Fl l
@@ -421,6 +451,8 @@ creating a new private key.
 The program will prompt for the file
 containing the private key, for the old passphrase, and twice for the
 new passphrase.
+.It Fl Q
+Test whether keys have been revoked in a KRL.
 .It Fl q
 Silence
 .Nm ssh-keygen .
@@ -444,6 +476,14 @@ Certify (sign) a public key using the specified CA key.
 Please see the
 .Sx CERTIFICATES
 section for details.
+.Pp
+When generating a KRL,
+.Fl s
+specifies a path to a CA public key file used to revoke certificates directly
+by key ID or serial number.
+See the
+.Sx KEY REVOCATION LISTS
+section for details.
 .It Fl T Ar output_file
 Test DH group exchange candidate primes (generated using the
 .Fl G
@@ -458,6 +498,12 @@ for protocol version 1 and
 or
 .Dq rsa
 for protocol version 2.
+.It Fl u
+Update a KRL.
+When specified with
+.Fl k ,
+keys listed via the command line are added to the existing KRL rather than
+a new KRL being created.
 .It Fl V Ar validity_interval
 Specify a validity interval when signing a certificate.
 A validity interval may consist of a single time, indicating that the
@@ -500,6 +546,10 @@ OpenSSH format file and print an OpenSSH public key to stdout.
 Specifies a serial number to be embedded in the certificate to distinguish
 this certificate from others from the same CA.
 The default serial number is zero.
+.Pp
+When generating a KRL, the
+.Fl z
+flag is used to specify a KRL version number.
 .El
 .Sh MODULI GENERATION
 .Nm
@@ -624,7 +674,9 @@ The
 option allows specification of certificate start and end times.
 A certificate that is presented at a time outside this range will not be
 considered valid.
-By default, certificates have a maximum validity interval.
+By default, certificates are valid from
+.Ux
+Epoch to the distant future.
 .Pp
 For certificates to be used for user or host authentication, the CA
 public key must be trusted by
@@ -632,6 +684,73 @@ public key must be trusted by
 or
 .Xr ssh 1 .
 Please refer to those manual pages for details.
+.Sh KEY REVOCATION LISTS
+.Nm
+is able to manage OpenSSH format Key Revocation Lists (KRLs).
+These binary files specify keys or certificates to be revoked using a
+compact format, taking as little a one bit per certificate if they are being
+revoked by serial number.
+.Pp
+KRLs may be generated using the
+.Fl k
+flag.
+This option reads one or more files from the command line and generates a new
+KRL.
+The files may either contain a KRL specification (see below) or public keys,
+listed one per line.
+Plain public keys are revoked by listing their hash or contents in the KRL and
+certificates revoked by serial number or key ID (if the serial is zero or
+not available).
+.Pp
+Revoking keys using a KRL specification offers explicit control over the
+types of record used to revoke keys and may be used to directly revoke
+certificates by serial number or key ID without having the complete original
+certificate on hand.
+A KRL specification consists of lines containing one of the following directives
+followed by a colon and some directive-specific information.
+.Bl -tag -width Ds
+.It Cm serial : Ar serial_number Ns Op - Ns Ar serial_number
+Revokes a certificate with the specified serial number.
+Serial numbers are 64-bit values, not including zero and may be expressed
+in decimal, hex or octal.
+If two serial numbers are specified separated by a hyphen, then the range
+of serial numbers including and between each is revoked.
+The CA key must have been specified on the
+.Nm
+command line using the
+.Fl s
+option.
+.It Cm id : Ar key_id
+Revokes a certificate with the specified key ID string.
+The CA key must have been specified on the
+.Nm
+command line using the
+.Fl s
+option.
+.It Cm key : Ar public_key
+Revokes the specified key.
+If a certificate is listed, then it is revoked as a plain public key.
+.It Cm sha1 : Ar public_key
+Revokes the specified key by its SHA1 hash.
+.El
+.Pp
+KRLs may be updated using the
+.Fl u
+flag in addition to
+.Fl k .
+When this option is specified, keys listed via the command line are merged into
+the KRL, adding to those already there.
+.Pp
+It is also possible, given a KRL, to test whether it revokes a particular key
+(or keys).
+The
+.Fl Q
+flag will query an existing KRL, testing each key specified on the commandline.
+If any key listed on the command line has been revoked (or an error encountered)
+then
+.Nm
+will exit with a non-zero exit status.
+A zero exit status will only be returned if no key was revoked.
 .Sh FILES
 .Bl -tag -width Ds -compact
 .It Pa ~/.ssh/identity
diff --git a/ssh-keygen.c b/ssh-keygen.c
index a223ddc81..d1a205e18 100644
--- a/ssh-keygen.c
+++ b/ssh-keygen.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-keygen.c,v 1.216 2012/07/06 06:38:03 jmc Exp $ */
+/* $OpenBSD: ssh-keygen.c,v 1.225 2013/02/10 23:32:10 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -48,8 +48,11 @@
 #include "match.h"
 #include "hostfile.h"
 #include "dns.h"
+#include "ssh.h"
 #include "ssh2.h"
 #include "ssh-pkcs11.h"
+#include "atomicio.h"
+#include "krl.h"
 
 /* Number of bits in the RSA/DSA key.  This value can be set on the command line. */
 #define DEFAULT_BITS            2048
@@ -104,7 +107,7 @@ char *identity_comment = NULL;
 char *ca_key_path = NULL;
 
 /* Certificate serial number */
-long long cert_serial = 0;
+unsigned long long cert_serial = 0;
 
 /* Key type when certifying */
 u_int cert_key_type = SSH2_CERT_TYPE_USER;
@@ -723,15 +726,33 @@ do_download(struct passwd *pw)
 #ifdef ENABLE_PKCS11
         Key **keys = NULL;
         int i, nkeys;
+        enum fp_rep rep;
+        enum fp_type fptype;
+        char *fp, *ra;
+
+        fptype = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5;
+        rep =    print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX;
 
         pkcs11_init(0);
         nkeys = pkcs11_add_provider(pkcs11provider, NULL, &keys);
         if (nkeys <= 0)
                 fatal("cannot read public key from pkcs11");
         for (i = 0; i < nkeys; i++) {
-                key_write(keys[i], stdout);
+                if (print_fingerprint) {
+                        fp = key_fingerprint(keys[i], fptype, rep);
+                        ra = key_fingerprint(keys[i], SSH_FP_MD5,
+                            SSH_FP_RANDOMART);
+                        printf("%u %s %s (PKCS11 key)\n", key_size(keys[i]),
+                            fp, key_type(keys[i]));
+                        if (log_level >= SYSLOG_LEVEL_VERBOSE)
+                                printf("%s\n", ra);
+                        xfree(ra);
+                        xfree(fp);
+                } else {
+                        key_write(keys[i], stdout);
+                        fprintf(stdout, "\n");
+                }
                 key_free(keys[i]);
-                fprintf(stdout, "\n");
         }
         xfree(keys);
         pkcs11_terminate();
@@ -1088,8 +1109,14 @@ do_known_hosts(struct passwd *pw, const char *name)
                                             ca ? " (CA key)" : "");
                                         printhost(out, cp, pub, ca, 0);
                                 }
-                                if (delete_host && !c && !ca)
-                                        printhost(out, cp, pub, ca, 0);
+                                if (delete_host) {
+                                        if (!c && !ca)
+                                                printhost(out, cp, pub, ca, 0);
+                                        else
+                                                printf("# Host %s found: "
+                                                    "line %d type %s\n", name,
+                                                    num, key_type(pub));
+                                }
                         } else if (hash_hosts)
                                 printhost(out, cp, pub, ca, 0);
                 } else {
@@ -1104,8 +1131,14 @@ do_known_hosts(struct passwd *pw, const char *name)
                                         printhost(out, name, pub,
                                             ca, hash_hosts && !ca);
                                 }
-                                if (delete_host && !c && !ca)
-                                        printhost(out, cp, pub, ca, 0);
+                                if (delete_host) {
+                                        if (!c && !ca)
+                                                printhost(out, cp, pub, ca, 0);
+                                        else
+                                                printf("# Host %s found: "
+                                                    "line %d type %s\n", name,
+                                                    num, key_type(pub));
+                                }
                         } else if (hash_hosts) {
                                 for (cp2 = strsep(&cp, ",");
                                     cp2 != NULL && *cp2 != '\0';
@@ -1867,6 +1900,226 @@ do_show_cert(struct passwd *pw)
 }
 
 static void
+load_krl(const char *path, struct ssh_krl **krlp)
+{
+        Buffer krlbuf;
+        int fd;
+
+        buffer_init(&krlbuf);
+        if ((fd = open(path, O_RDONLY)) == -1)
+                fatal("open %s: %s", path, strerror(errno));
+        if (!key_load_file(fd, path, &krlbuf))
+                fatal("Unable to load KRL");
+        close(fd);
+        /* XXX check sigs */
+        if (ssh_krl_from_blob(&krlbuf, krlp, NULL, 0) != 0 ||
+            *krlp == NULL)
+                fatal("Invalid KRL file");
+        buffer_free(&krlbuf);
+}
+
+static void
+update_krl_from_file(struct passwd *pw, const char *file, const Key *ca,
+    struct ssh_krl *krl)
+{
+        Key *key = NULL;
+        u_long lnum = 0;
+        char *path, *cp, *ep, line[SSH_MAX_PUBKEY_BYTES];
+        unsigned long long serial, serial2;
+        int i, was_explicit_key, was_sha1, r;
+        FILE *krl_spec;
+
+        path = tilde_expand_filename(file, pw->pw_uid);
+        if (strcmp(path, "-") == 0) {
+                krl_spec = stdin;
+                free(path);
+                path = xstrdup("(standard input)");
+        } else if ((krl_spec = fopen(path, "r")) == NULL)
+                fatal("fopen %s: %s", path, strerror(errno));
+
+        if (!quiet)
+                printf("Revoking from %s\n", path);
+        while (read_keyfile_line(krl_spec, path, line, sizeof(line),
+            &lnum) == 0) {
+                was_explicit_key = was_sha1 = 0;
+                cp = line + strspn(line, " \t");
+                /* Trim trailing space, comments and strip \n */
+                for (i = 0, r = -1; cp[i] != '\0'; i++) {
+                        if (cp[i] == '#' || cp[i] == '\n') {
+                                cp[i] = '\0';
+                                break;
+                        }
+                        if (cp[i] == ' ' || cp[i] == '\t') {
+                                /* Remember the start of a span of whitespace */
+                                if (r == -1)
+                                        r = i;
+                        } else
+                                r = -1;
+                }
+                if (r != -1)
+                        cp[r] = '\0';
+                if (*cp == '\0')
+                        continue;
+                if (strncasecmp(cp, "serial:", 7) == 0) {
+                        if (ca == NULL) {
+                                fatal("revoking certificated by serial number "
+                                    "requires specification of a CA key");
+                        }
+                        cp += 7;
+                        cp = cp + strspn(cp, " \t");
+                        errno = 0;
+                        serial = strtoull(cp, &ep, 0);
+                        if (*cp == '\0' || (*ep != '\0' && *ep != '-'))
+                                fatal("%s:%lu: invalid serial \"%s\"",
+                                    path, lnum, cp);
+                        if (errno == ERANGE && serial == ULLONG_MAX)
+                                fatal("%s:%lu: serial out of range",
+                                    path, lnum);
+                        serial2 = serial;
+                        if (*ep == '-') {
+                                cp = ep + 1;
+                                errno = 0;
+                                serial2 = strtoull(cp, &ep, 0);
+                                if (*cp == '\0' || *ep != '\0')
+                                        fatal("%s:%lu: invalid serial \"%s\"",
+                                            path, lnum, cp);
+                                if (errno == ERANGE && serial2 == ULLONG_MAX)
+                                        fatal("%s:%lu: serial out of range",
+                                            path, lnum);
+                                if (serial2 <= serial)
+                                        fatal("%s:%lu: invalid serial range "
+                                            "%llu:%llu", path, lnum,
+                                            (unsigned long long)serial,
+                                            (unsigned long long)serial2);
+                        }
+                        if (ssh_krl_revoke_cert_by_serial_range(krl,
+                            ca, serial, serial2) != 0) {
+                                fatal("%s: revoke serial failed",
+                                    __func__);
+                        }
+                } else if (strncasecmp(cp, "id:", 3) == 0) {
+                        if (ca == NULL) {
+                                fatal("revoking certificated by key ID "
+                                    "requires specification of a CA key");
+                        }
+                        cp += 3;
+                        cp = cp + strspn(cp, " \t");
+                        if (ssh_krl_revoke_cert_by_key_id(krl, ca, cp) != 0)
+                                fatal("%s: revoke key ID failed", __func__);
+                } else {
+                        if (strncasecmp(cp, "key:", 4) == 0) {
+                                cp += 4;
+                                cp = cp + strspn(cp, " \t");
+                                was_explicit_key = 1;
+                        } else if (strncasecmp(cp, "sha1:", 5) == 0) {
+                                cp += 5;
+                                cp = cp + strspn(cp, " \t");
+                                was_sha1 = 1;
+                        } else {
+                                /*
+                                 * Just try to process the line as a key.
+                                 * Parsing will fail if it isn't.
+                                 */
+                        }
+                        if ((key = key_new(KEY_UNSPEC)) == NULL)
+                                fatal("key_new");
+                        if (key_read(key, &cp) != 1)
+                                fatal("%s:%lu: invalid key", path, lnum);
+                        if (was_explicit_key)
+                                r = ssh_krl_revoke_key_explicit(krl, key);
+                        else if (was_sha1)
+                                r = ssh_krl_revoke_key_sha1(krl, key);
+                        else
+                                r = ssh_krl_revoke_key(krl, key);
+                        if (r != 0)
+                                fatal("%s: revoke key failed", __func__);
+                        key_free(key);
+                }
+        }
+        if (strcmp(path, "-") != 0)
+                fclose(krl_spec);
+}
+
+static void
+do_gen_krl(struct passwd *pw, int updating, int argc, char **argv)
+{
+        struct ssh_krl *krl;
+        struct stat sb;
+        Key *ca = NULL;
+        int fd, i;
+        char *tmp;
+        Buffer kbuf;
+
+        if (*identity_file == '\0')
+                fatal("KRL generation requires an output file");
+        if (stat(identity_file, &sb) == -1) {
+                if (errno != ENOENT)
+                        fatal("Cannot access KRL \"%s\": %s",
+                            identity_file, strerror(errno));
+                if (updating)
+                        fatal("KRL \"%s\" does not exist", identity_file);
+        }
+        if (ca_key_path != NULL) {
+                tmp = tilde_expand_filename(ca_key_path, pw->pw_uid);
+                if ((ca = key_load_public(tmp, NULL)) == NULL)
+                        fatal("Cannot load CA public key %s", tmp);
+                xfree(tmp);
+        }
+
+        if (updating)
+                load_krl(identity_file, &krl);
+        else if ((krl = ssh_krl_init()) == NULL)
+                fatal("couldn't create KRL");
+
+        if (cert_serial != 0)
+                ssh_krl_set_version(krl, cert_serial);
+        if (identity_comment != NULL)
+                ssh_krl_set_comment(krl, identity_comment);
+
+        for (i = 0; i < argc; i++)
+                update_krl_from_file(pw, argv[i], ca, krl);
+
+        buffer_init(&kbuf);
+        if (ssh_krl_to_blob(krl, &kbuf, NULL, 0) != 0)
+                fatal("Couldn't generate KRL");
+        if ((fd = open(identity_file, O_WRONLY|O_CREAT|O_TRUNC, 0644)) == -1)
+                fatal("open %s: %s", identity_file, strerror(errno));
+        if (atomicio(vwrite, fd, buffer_ptr(&kbuf), buffer_len(&kbuf)) !=
+            buffer_len(&kbuf))
+                fatal("write %s: %s", identity_file, strerror(errno));
+        close(fd);
+        buffer_free(&kbuf);
+        ssh_krl_free(krl);
+}
+
+static void
+do_check_krl(struct passwd *pw, int argc, char **argv)
+{
+        int i, r, ret = 0;
+        char *comment;
+        struct ssh_krl *krl;
+        Key *k;
+
+        if (*identity_file == '\0')
+                fatal("KRL checking requires an input file");
+        load_krl(identity_file, &krl);
+        for (i = 0; i < argc; i++) {
+                if ((k = key_load_public(argv[i], &comment)) == NULL)
+                        fatal("Cannot load public key %s", argv[i]);
+                r = ssh_krl_check_key(krl, k);
+                printf("%s%s%s%s: %s\n", argv[i],
+                    *comment ? " (" : "", comment, *comment ? ")" : "",
+                    r == 0 ? "ok" : "REVOKED");
+                if (r != 0)
+                        ret = 1;
+                key_free(k);
+                free(comment);
+        }
+        ssh_krl_free(krl);
+        exit(ret);
+}
+
+static void
 usage(void)
 {
         fprintf(stderr, "usage: %s [options]\n", __progname);
@@ -1892,6 +2145,7 @@ usage(void)
         fprintf(stderr, "  -J number   Screen this number of moduli lines.\n");
         fprintf(stderr, "  -j number   Start screening moduli at specified line.\n");
         fprintf(stderr, "  -K checkpt  Write checkpoints to this file.\n");
+        fprintf(stderr, "  -k          Generate a KRL file.\n");
         fprintf(stderr, "  -L          Print the contents of a certificate.\n");
         fprintf(stderr, "  -l          Show fingerprint of key file.\n");
         fprintf(stderr, "  -M memory   Amount of memory (MB) to use for generating DH-GEX moduli.\n");
@@ -1901,6 +2155,7 @@ usage(void)
         fprintf(stderr, "  -O option   Specify a certificate option.\n");
         fprintf(stderr, "  -P phrase   Provide old passphrase.\n");
         fprintf(stderr, "  -p          Change passphrase of private key file.\n");
+        fprintf(stderr, "  -Q          Test whether key(s) are revoked in KRL.\n");
         fprintf(stderr, "  -q          Quiet.\n");
         fprintf(stderr, "  -R hostname Remove host from known_hosts file.\n");
         fprintf(stderr, "  -r hostname Print DNS resource record.\n");
@@ -1908,6 +2163,7 @@ usage(void)
         fprintf(stderr, "  -s ca_key   Certify keys with CA key.\n");
         fprintf(stderr, "  -T file     Screen candidates for DH-GEX moduli.\n");
         fprintf(stderr, "  -t type     Specify type of key to create.\n");
+        fprintf(stderr, "  -u          Update KRL rather than creating a new one.\n");
         fprintf(stderr, "  -V from:to  Specify certificate validity interval.\n");
         fprintf(stderr, "  -v          Verbose.\n");
         fprintf(stderr, "  -W gen      Generator to use for generating DH-GEX moduli.\n");
@@ -1925,14 +2181,14 @@ main(int argc, char **argv)
 {
         char dotsshdir[MAXPATHLEN], comment[1024], *passphrase1, *passphrase2;
         char *checkpoint = NULL;
-        char out_file[MAXPATHLEN], *rr_hostname = NULL;
+        char out_file[MAXPATHLEN], *ep, *rr_hostname = NULL;
         Key *private, *public;
         struct passwd *pw;
         struct stat st;
         int opt, type, fd;
         u_int32_t memory = 0, generator_wanted = 0, trials = 100;
         int do_gen_candidates = 0, do_screen_candidates = 0;
-        int gen_all_hostkeys = 0;
+        int gen_all_hostkeys = 0, gen_krl = 0, update_krl = 0, check_krl = 0;
         unsigned long start_lineno = 0, lines_to_process = 0;
         BIGNUM *start = NULL;
         FILE *f;
@@ -1962,8 +2218,8 @@ main(int argc, char **argv)
                 exit(1);
         }
 
-        while ((opt = getopt(argc, argv, "AegiqpclBHLhvxXyF:b:f:t:D:I:J:j:K:P:"
-            "m:N:n:O:C:r:g:R:T:G:M:S:s:a:V:W:z")) != -1) {
+        while ((opt = getopt(argc, argv, "ABHLQXceghiklpquvxy"
+            "C:D:F:G:I:J:K:M:N:O:P:R:S:T:V:W:a:b:f:g:j:m:n:r:s:t:z:")) != -1) {
                 switch (opt) {
                 case 'A':
                         gen_all_hostkeys = 1;
@@ -2042,6 +2298,9 @@ main(int argc, char **argv)
                 case 'N':
                         identity_new_passphrase = optarg;
                         break;
+                case 'Q':
+                        check_krl = 1;
+                        break;
                 case 'O':
                         add_cert_option(optarg);
                         break;
@@ -2060,6 +2319,9 @@ main(int argc, char **argv)
                         cert_key_type = SSH2_CERT_TYPE_HOST;
                         certflags_flags = 0;
                         break;
+                case 'k':
+                        gen_krl = 1;
+                        break;
                 case 'i':
                 case 'X':
                         /* import key */
@@ -2077,6 +2339,9 @@ main(int argc, char **argv)
                 case 'D':
                         pkcs11provider = optarg;
                         break;
+                case 'u':
+                        update_krl = 1;
+                        break;
                 case 'v':
                         if (log_level == SYSLOG_LEVEL_INFO)
                                 log_level = SYSLOG_LEVEL_DEBUG1;
@@ -2133,9 +2398,11 @@ main(int argc, char **argv)
                         parse_cert_times(optarg);
                         break;
                 case 'z':
-                        cert_serial = strtonum(optarg, 0, LLONG_MAX, &errstr);
-                        if (errstr)
-                                fatal("Invalid serial number: %s", errstr);
+                        errno = 0;
+                        cert_serial = strtoull(optarg, &ep, 10);
+                        if (*optarg < '0' || *optarg > '9' || *ep != '\0' ||
+                            (errno == ERANGE && cert_serial == ULLONG_MAX))
+                                fatal("Invalid serial number \"%s\"", optarg);
                         break;
                 case '?':
                 default:
@@ -2150,11 +2417,11 @@ main(int argc, char **argv)
         argc -= optind;
 
         if (ca_key_path != NULL) {
-                if (argc < 1) {
+                if (argc < 1 && !gen_krl) {
                         printf("Too few arguments.\n");
                         usage();
                 }
-        } else if (argc > 0) {
+        } else if (argc > 0 && !gen_krl && !check_krl) {
                 printf("Too many arguments.\n");
                 usage();
         }
@@ -2163,9 +2430,17 @@ main(int argc, char **argv)
                 usage();
         }
         if (print_fingerprint && (delete_host || hash_hosts)) {
-                printf("Cannot use -l with -D or -R.\n");
+                printf("Cannot use -l with -H or -R.\n");
                 usage();
         }
+        if (gen_krl) {
+                do_gen_krl(pw, update_krl, argc, argv);
+                return (0);
+        }
+        if (check_krl) {
+                do_check_krl(pw, argc, argv);
+                return (0);
+        }
         if (ca_key_path != NULL) {
                 if (cert_key_id == NULL)
                         fatal("Must specify key id (-I) when certifying");
@@ -2175,6 +2450,8 @@ main(int argc, char **argv)
                 do_show_cert(pw);
         if (delete_host || hash_hosts || find_host)
                 do_known_hosts(pw, rr_hostname);
+        if (pkcs11provider != NULL)
+                do_download(pw);
         if (print_fingerprint || print_bubblebabble)
                 do_fingerprint(pw);
         if (change_passphrase)
@@ -2212,8 +2489,6 @@ main(int argc, char **argv)
                         exit(0);
                 }
         }
-        if (pkcs11provider != NULL)
-                do_download(pw);
 
         if (do_gen_candidates) {
                 FILE *out = fopen(out_file, "w");
@@ -2233,7 +2508,7 @@ main(int argc, char **argv)
 
         if (do_screen_candidates) {
                 FILE *in;
-                FILE *out = fopen(out_file, "w");
+                FILE *out = fopen(out_file, "a");
 
                 if (have_identity && strcmp(identity_file, "-") != 0) {
                         if ((in = fopen(identity_file, "r")) == NULL) {
diff --git a/ssh-keyscan.0 b/ssh-keyscan.0
index 0d8cf3cf4..559c5a1f4 100644
--- a/ssh-keyscan.0
+++ b/ssh-keyscan.0
@@ -106,4 +106,4 @@ BUGS
      This is because it opens a connection to the ssh port, reads the public
      key, and drops the connection as soon as it gets the key.
 
-OpenBSD 5.2                     April 11, 2012                     OpenBSD 5.2
+OpenBSD 5.3                     April 11, 2012                     OpenBSD 5.3
diff --git a/ssh-keysign.0 b/ssh-keysign.0
index 50b7162dc..a2e9eec2b 100644
--- a/ssh-keysign.0
+++ b/ssh-keysign.0
@@ -48,4 +48,4 @@ HISTORY
 AUTHORS
      Markus Friedl <markus@openbsd.org>
 
-OpenBSD 5.2                     August 31, 2010                    OpenBSD 5.2
+OpenBSD 5.3                     August 31, 2010                    OpenBSD 5.3
diff --git a/ssh-pkcs11-helper.0 b/ssh-pkcs11-helper.0
index 2f8a674aa..dcfaa222a 100644
--- a/ssh-pkcs11-helper.0
+++ b/ssh-pkcs11-helper.0
@@ -22,4 +22,4 @@ HISTORY
 AUTHORS
      Markus Friedl <markus@openbsd.org>
 
-OpenBSD 5.2                    February 10, 2010                   OpenBSD 5.2
+OpenBSD 5.3                    February 10, 2010                   OpenBSD 5.3
diff --git a/ssh.0 b/ssh.0
index 7d43f8879..f6b642bc8 100644
--- a/ssh.0
+++ b/ssh.0
@@ -396,8 +396,8 @@ AUTHENTICATION
      since it provides additional mechanisms for confidentiality (the traffic
      is encrypted using AES, 3DES, Blowfish, CAST128, or Arcfour) and
      integrity (hmac-md5, hmac-sha1, hmac-sha2-256, hmac-sha2-512, umac-64,
-     hmac-ripemd160).  Protocol 1 lacks a strong mechanism for ensuring the
-     integrity of the connection.
+     umac-128, hmac-ripemd160).  Protocol 1 lacks a strong mechanism for
+     ensuring the integrity of the connection.
 
      The methods available for authentication are: GSSAPI-based
      authentication, host-based authentication, public key authentication,
@@ -537,6 +537,12 @@ ESCAPE CHARACTERS
      ~R      Request rekeying of the connection (only useful for SSH protocol
              version 2 and if the peer supports it).
 
+     ~V      Decrease the verbosity (LogLevel) when errors are being written
+             to stderr.
+
+     ~v      Increase the verbosity (LogLevel) when errors are being written
+             to stderr.
+
 TCP FORWARDING
      Forwarding of arbitrary TCP connections over the secure channel can be
      specified either on the command line or in a configuration file.  One
@@ -862,36 +868,45 @@ SEE ALSO
      scp(1), sftp(1), ssh-add(1), ssh-agent(1), ssh-keygen(1), ssh-keyscan(1),
      tun(4), hosts.equiv(5), ssh_config(5), ssh-keysign(8), sshd(8)
 
-     The Secure Shell (SSH) Protocol Assigned Numbers, RFC 4250, 2006.
+STANDARDS
+     S. Lehtinen and C. Lonvick, The Secure Shell (SSH) Protocol Assigned
+     Numbers, RFC 4250, January 2006.
 
-     The Secure Shell (SSH) Protocol Architecture, RFC 4251, 2006.
+     T. Ylonen and C. Lonvick, The Secure Shell (SSH) Protocol Architecture,
+     RFC 4251, January 2006.
 
-     The Secure Shell (SSH) Authentication Protocol, RFC 4252, 2006.
+     T. Ylonen and C. Lonvick, The Secure Shell (SSH) Authentication Protocol,
+     RFC 4252, January 2006.
 
-     The Secure Shell (SSH) Transport Layer Protocol, RFC 4253, 2006.
+     T. Ylonen and C. Lonvick, The Secure Shell (SSH) Transport Layer
+     Protocol, RFC 4253, January 2006.
 
-     The Secure Shell (SSH) Connection Protocol, RFC 4254, 2006.
+     T. Ylonen and C. Lonvick, The Secure Shell (SSH) Connection Protocol, RFC
+     4254, January 2006.
 
-     Using DNS to Securely Publish Secure Shell (SSH) Key Fingerprints, RFC
-     4255, 2006.
+     J. Schlyter and W. Griffin, Using DNS to Securely Publish Secure Shell
+     (SSH) Key Fingerprints, RFC 4255, January 2006.
 
-     Generic Message Exchange Authentication for the Secure Shell Protocol
-     (SSH), RFC 4256, 2006.
+     F. Cusack and M. Forssen, Generic Message Exchange Authentication for the
+     Secure Shell Protocol (SSH), RFC 4256, January 2006.
 
-     The Secure Shell (SSH) Session Channel Break Extension, RFC 4335, 2006.
+     J. Galbraith and P. Remaker, The Secure Shell (SSH) Session Channel Break
+     Extension, RFC 4335, January 2006.
 
-     The Secure Shell (SSH) Transport Layer Encryption Modes, RFC 4344, 2006.
+     M. Bellare, T. Kohno, and C. Namprempre, The Secure Shell (SSH) Transport
+     Layer Encryption Modes, RFC 4344, January 2006.
 
-     Improved Arcfour Modes for the Secure Shell (SSH) Transport Layer
-     Protocol, RFC 4345, 2006.
+     B. Harris, Improved Arcfour Modes for the Secure Shell (SSH) Transport
+     Layer Protocol, RFC 4345, January 2006.
 
-     Diffie-Hellman Group Exchange for the Secure Shell (SSH) Transport Layer
-     Protocol, RFC 4419, 2006.
+     M. Friedl, N. Provos, and W. Simpson, Diffie-Hellman Group Exchange for
+     the Secure Shell (SSH) Transport Layer Protocol, RFC 4419, March 2006.
 
-     The Secure Shell (SSH) Public Key File Format, RFC 4716, 2006.
+     J. Galbraith and R. Thayer, The Secure Shell (SSH) Public Key File
+     Format, RFC 4716, November 2006.
 
-     Elliptic Curve Algorithm Integration in the Secure Shell Transport Layer,
-     RFC 5656, 2009.
+     D. Stebila and J. Green, Elliptic Curve Algorithm Integration in the
+     Secure Shell Transport Layer, RFC 5656, December 2009.
 
      A. Perrig and D. Song, Hash Visualization: a New Technique to improve
      Real-World Security, 1999, International Workshop on Cryptographic
@@ -904,4 +919,4 @@ AUTHORS
      created OpenSSH.  Markus Friedl contributed the support for SSH protocol
      versions 1.5 and 2.0.
 
-OpenBSD 5.2                      June 18, 2012                     OpenBSD 5.2
+OpenBSD 5.3                     October 4, 2012                    OpenBSD 5.3
diff --git a/ssh.1 b/ssh.1
index 4c789fcf4..5ac75e992 100644
--- a/ssh.1
+++ b/ssh.1
@@ -33,8 +33,8 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: ssh.1,v 1.326 2012/06/18 12:17:18 dtucker Exp $
-.Dd $Mdocdate: June 18 2012 $
+.\" $OpenBSD: ssh.1,v 1.330 2012/10/04 13:21:50 markus Exp $
+.Dd $Mdocdate: October 4 2012 $
 .Dt SSH 1
 .Os
 .Sh NAME
@@ -674,7 +674,7 @@ it provides additional mechanisms for confidentiality
 (the traffic is encrypted using AES, 3DES, Blowfish, CAST128, or Arcfour)
 and integrity (hmac-md5, hmac-sha1,
 hmac-sha2-256, hmac-sha2-512,
-umac-64, hmac-ripemd160).
+umac-64, umac-128, hmac-ripemd160).
 Protocol 1 lacks a strong mechanism for ensuring the
 integrity of the connection.
 .Pp
@@ -930,6 +930,14 @@ option.
 .It Cm ~R
 Request rekeying of the connection
 (only useful for SSH protocol version 2 and if the peer supports it).
+.It Cm ~V
+Decrease the verbosity
+.Pq Ic LogLevel
+when errors are being written to stderr.
+.It Cm ~v
+Increase the verbosity
+.Pq Ic LogLevel
+when errors are being written to stderr.
 .El
 .Sh TCP FORWARDING
 Forwarding of arbitrary TCP connections over the secure channel can
@@ -1434,77 +1442,118 @@ if an error occurred.
 .Xr ssh_config 5 ,
 .Xr ssh-keysign 8 ,
 .Xr sshd 8
+.Sh STANDARDS
 .Rs
+.%A S. Lehtinen
+.%A C. Lonvick
+.%D January 2006
 .%R RFC 4250
-.%T "The Secure Shell (SSH) Protocol Assigned Numbers"
-.%D 2006
+.%T The Secure Shell (SSH) Protocol Assigned Numbers
 .Re
+.Pp
 .Rs
+.%A T. Ylonen
+.%A C. Lonvick
+.%D January 2006
 .%R RFC 4251
-.%T "The Secure Shell (SSH) Protocol Architecture"
-.%D 2006
+.%T The Secure Shell (SSH) Protocol Architecture
 .Re
+.Pp
 .Rs
+.%A T. Ylonen
+.%A C. Lonvick
+.%D January 2006
 .%R RFC 4252
-.%T "The Secure Shell (SSH) Authentication Protocol"
-.%D 2006
+.%T The Secure Shell (SSH) Authentication Protocol
 .Re
+.Pp
 .Rs
+.%A T. Ylonen
+.%A C. Lonvick
+.%D January 2006
 .%R RFC 4253
-.%T "The Secure Shell (SSH) Transport Layer Protocol"
-.%D 2006
+.%T The Secure Shell (SSH) Transport Layer Protocol
 .Re
+.Pp
 .Rs
+.%A T. Ylonen
+.%A C. Lonvick
+.%D January 2006
 .%R RFC 4254
-.%T "The Secure Shell (SSH) Connection Protocol"
-.%D 2006
+.%T The Secure Shell (SSH) Connection Protocol
 .Re
+.Pp
 .Rs
+.%A J. Schlyter
+.%A W. Griffin
+.%D January 2006
 .%R RFC 4255
-.%T "Using DNS to Securely Publish Secure Shell (SSH) Key Fingerprints"
-.%D 2006
+.%T Using DNS to Securely Publish Secure Shell (SSH) Key Fingerprints
 .Re
+.Pp
 .Rs
+.%A F. Cusack
+.%A M. Forssen
+.%D January 2006
 .%R RFC 4256
-.%T "Generic Message Exchange Authentication for the Secure Shell Protocol (SSH)"
-.%D 2006
+.%T Generic Message Exchange Authentication for the Secure Shell Protocol (SSH)
 .Re
+.Pp
 .Rs
+.%A J. Galbraith
+.%A P. Remaker
+.%D January 2006
 .%R RFC 4335
-.%T "The Secure Shell (SSH) Session Channel Break Extension"
-.%D 2006
+.%T The Secure Shell (SSH) Session Channel Break Extension
 .Re
+.Pp
 .Rs
+.%A M. Bellare
+.%A T. Kohno
+.%A C. Namprempre
+.%D January 2006
 .%R RFC 4344
-.%T "The Secure Shell (SSH) Transport Layer Encryption Modes"
-.%D 2006
+.%T The Secure Shell (SSH) Transport Layer Encryption Modes
 .Re
+.Pp
 .Rs
+.%A B. Harris
+.%D January 2006
 .%R RFC 4345
-.%T "Improved Arcfour Modes for the Secure Shell (SSH) Transport Layer Protocol"
-.%D 2006
+.%T Improved Arcfour Modes for the Secure Shell (SSH) Transport Layer Protocol
 .Re
+.Pp
 .Rs
+.%A M. Friedl
+.%A N. Provos
+.%A W. Simpson
+.%D March 2006
 .%R RFC 4419
-.%T "Diffie-Hellman Group Exchange for the Secure Shell (SSH) Transport Layer Protocol"
-.%D 2006
+.%T Diffie-Hellman Group Exchange for the Secure Shell (SSH) Transport Layer Protocol
 .Re
+.Pp
 .Rs
+.%A J. Galbraith
+.%A R. Thayer
+.%D November 2006
 .%R RFC 4716
-.%T "The Secure Shell (SSH) Public Key File Format"
-.%D 2006
+.%T The Secure Shell (SSH) Public Key File Format
 .Re
+.Pp
 .Rs
+.%A D. Stebila
+.%A J. Green
+.%D December 2009
 .%R RFC 5656
-.%T "Elliptic Curve Algorithm Integration in the Secure Shell Transport Layer"
-.%D 2009
+.%T Elliptic Curve Algorithm Integration in the Secure Shell Transport Layer
 .Re
+.Pp
 .Rs
-.%T "Hash Visualization: a New Technique to improve Real-World Security"
 .%A A. Perrig
 .%A D. Song
 .%D 1999
-.%O "International Workshop on Cryptographic Techniques and E-Commerce (CrypTEC '99)"
+.%O International Workshop on Cryptographic Techniques and E-Commerce (CrypTEC '99)
+.%T Hash Visualization: a New Technique to improve Real-World Security
 .Re
 .Sh AUTHORS
 OpenSSH is a derivative of the original and free
diff --git a/ssh_config.0 b/ssh_config.0
index d8256d137..164d11817 100644
--- a/ssh_config.0
+++ b/ssh_config.0
@@ -97,10 +97,13 @@ DESCRIPTION
              preference.  Multiple ciphers must be comma-separated.  The
              supported ciphers are ``3des-cbc'', ``aes128-cbc'',
              ``aes192-cbc'', ``aes256-cbc'', ``aes128-ctr'', ``aes192-ctr'',
-             ``aes256-ctr'', ``arcfour128'', ``arcfour256'', ``arcfour'',
-             ``blowfish-cbc'', and ``cast128-cbc''.  The default is:
+             ``aes256-ctr'', ``aes128-gcm@openssh.com'',
+             ``aes256-gcm@openssh.com'', ``arcfour128'', ``arcfour256'',
+             ``arcfour'', ``blowfish-cbc'', and ``cast128-cbc''.  The default
+             is:
 
                 aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,
+                aes128-gcm@openssh.com,aes256-gcm@openssh.com,
                 aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,
                 aes256-cbc,arcfour
 
@@ -354,11 +357,11 @@ DESCRIPTION
 
      IdentitiesOnly
              Specifies that ssh(1) should only use the authentication identity
-             files configured in the ssh_config files, even if ssh-agent(1)
-             offers more identities.  The argument to this keyword must be
-             ``yes'' or ``no''.  This option is intended for situations where
-             ssh-agent offers many different identities.  The default is
-             ``no''.
+             files configured in the ssh_config files, even if ssh-agent(1) or
+             a PKCS11Provider offers more identities.  The argument to this
+             keyword must be ``yes'' or ``no''.  This option is intended for
+             situations where ssh-agent offers many different identities.  The
+             default is ``no''.
 
      IdentityFile
              Specifies a file from which the user's DSA, ECDSA or RSA
@@ -460,9 +463,16 @@ DESCRIPTION
      MACs    Specifies the MAC (message authentication code) algorithms in
              order of preference.  The MAC algorithm is used in protocol
              version 2 for data integrity protection.  Multiple algorithms
-             must be comma-separated.  The default is:
-
-                   hmac-md5,hmac-sha1,umac-64@openssh.com,
+             must be comma-separated.  The algorithms that contain ``-etm''
+             calculate the MAC after encryption (encrypt-then-mac).  These are
+             considered safer and their use recommended.  The default is:
+
+                   hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,
+                   umac-64-etm@openssh.com,umac-128-etm@openssh.com,
+                   hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,
+                   hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,
+                   hmac-md5-96-etm@openssh.com,
+                   hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,
                    hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,
                    hmac-sha1-96,hmac-md5-96
 
@@ -763,4 +773,4 @@ AUTHORS
      created OpenSSH.  Markus Friedl contributed the support for SSH protocol
      versions 1.5 and 2.0.
 
-OpenBSD 5.2                      June 29, 2012                     OpenBSD 5.2
+OpenBSD 5.3                     January 8, 2013                    OpenBSD 5.3
diff --git a/ssh_config.5 b/ssh_config.5
index 9d4b38aa8..fa852acb1 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -33,8 +33,8 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: ssh_config.5,v 1.157 2012/06/29 13:57:25 naddy Exp $
-.Dd $Mdocdate: June 29 2012 $
+.\" $OpenBSD: ssh_config.5,v 1.161 2013/01/08 18:49:04 markus Exp $
+.Dd $Mdocdate: January 8 2013 $
 .Dt SSH_CONFIG 5
 .Os
 .Sh NAME
@@ -224,6 +224,8 @@ The supported ciphers are
 .Dq aes128-ctr ,
 .Dq aes192-ctr ,
 .Dq aes256-ctr ,
+.Dq aes128-gcm@openssh.com ,
+.Dq aes256-gcm@openssh.com ,
 .Dq arcfour128 ,
 .Dq arcfour256 ,
 .Dq arcfour ,
@@ -233,6 +235,7 @@ and
 The default is:
 .Bd -literal -offset 3n
 aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,
+aes128-gcm@openssh.com,aes256-gcm@openssh.com,
 aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,
 aes256-cbc,arcfour
 .Ed
@@ -658,6 +661,8 @@ should only use the authentication identity files configured in the
 files,
 even if
 .Xr ssh-agent 1
+or a
+.Cm PKCS11Provider
 offers more identities.
 The argument to this keyword must be
 .Dq yes
@@ -846,9 +851,18 @@ in order of preference.
 The MAC algorithm is used in protocol version 2
 for data integrity protection.
 Multiple algorithms must be comma-separated.
+The algorithms that contain
+.Dq -etm
+calculate the MAC after encryption (encrypt-then-mac).
+These are considered safer and their use recommended.
 The default is:
 .Bd -literal -offset indent
-hmac-md5,hmac-sha1,umac-64@openssh.com,
+hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,
+umac-64-etm@openssh.com,umac-128-etm@openssh.com,
+hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,
+hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,
+hmac-md5-96-etm@openssh.com,
+hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,
 hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,
 hmac-sha1-96,hmac-md5-96
 .Ed
diff --git a/sshconnect.c b/sshconnect.c
index 2cde2f0a3..ed0e78bfd 100644
--- a/sshconnect.c
+++ b/sshconnect.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect.c,v 1.234 2011/05/24 07:15:47 djm Exp $ */
+/* $OpenBSD: sshconnect.c,v 1.236 2012/09/14 16:51:34 markus Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -429,6 +429,24 @@ ssh_connect(const char *host, struct sockaddr_storage * hostaddr,
         return 0;
 }
 
+static void
+send_client_banner(int connection_out, int minor1)
+{
+        /* Send our own protocol version identification. */
+        if (compat20) {
+                xasprintf(&client_version_string, "SSH-%d.%d-%.100s\r\n",
+                    PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE);
+        } else {
+                xasprintf(&client_version_string, "SSH-%d.%d-%.100s\n",
+                    PROTOCOL_MAJOR_1, minor1, SSH_RELEASE);
+        }
+        if (roaming_atomicio(vwrite, connection_out, client_version_string,
+            strlen(client_version_string)) != strlen(client_version_string))
+                fatal("write: %.100s", strerror(errno));
+        chop(client_version_string);
+        debug("Local version string %.100s", client_version_string);
+}
+
 /*
  * Waits for the server identification string, and sends our own
  * identification string.
@@ -440,7 +458,7 @@ ssh_exchange_identification(int timeout_ms)
         int remote_major, remote_minor, mismatch;
         int connection_in = packet_get_connection_in();
         int connection_out = packet_get_connection_out();
-        int minor1 = PROTOCOL_MINOR_1;
+        int minor1 = PROTOCOL_MINOR_1, client_banner_sent = 0;
         u_int i, n;
         size_t len;
         int fdsetsz, remaining, rc;
@@ -450,6 +468,16 @@ ssh_exchange_identification(int timeout_ms)
         fdsetsz = howmany(connection_in + 1, NFDBITS) * sizeof(fd_mask);
         fdset = xcalloc(1, fdsetsz);
 
+        /*
+         * If we are SSH2-only then we can send the banner immediately and
+         * save a round-trip.
+         */
+        if (options.protocol == SSH_PROTO_2) {
+                enable_compat20();
+                send_client_banner(connection_out, 0);
+                client_banner_sent = 1;
+        }
+
         /* Read other side's version identification. */
         remaining = timeout_ms;
         for (n = 0;;) {
@@ -552,18 +580,9 @@ ssh_exchange_identification(int timeout_ms)
                 fatal("Protocol major versions differ: %d vs. %d",
                     (options.protocol & SSH_PROTO_2) ? PROTOCOL_MAJOR_2 : PROTOCOL_MAJOR_1,
                     remote_major);
-        /* Send our own protocol version identification. */
-        snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s%s",
-            compat20 ? PROTOCOL_MAJOR_2 : PROTOCOL_MAJOR_1,
-            compat20 ? PROTOCOL_MINOR_2 : minor1,
-            SSH_RELEASE, compat20 ? "\r\n" : "\n");
-        if (roaming_atomicio(vwrite, connection_out, buf, strlen(buf))
-            != strlen(buf))
-                fatal("write: %.100s", strerror(errno));
-        client_version_string = xstrdup(buf);
-        chop(client_version_string);
+        if (!client_banner_sent)
+                send_client_banner(connection_out, minor1);
         chop(server_version_string);
-        debug("Local version string %.100s", client_version_string);
 }
 
 /* defaults to 'no' */
diff --git a/sshconnect2.c b/sshconnect2.c
index fe68d5c41..378b3200c 100644
--- a/sshconnect2.c
+++ b/sshconnect2.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect2.c,v 1.189 2012/06/22 12:30:26 dtucker Exp $ */
+/* $OpenBSD: sshconnect2.c,v 1.191 2013/02/15 00:21:01 dtucker Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  * Copyright (c) 2008 Damien Miller.  All rights reserved.
@@ -40,7 +40,7 @@
 #include <stdio.h>
 #include <string.h>
 #include <unistd.h>
-#if defined(HAVE_STRNVIS) && defined(HAVE_VIS_H)
+#if defined(HAVE_STRNVIS) && defined(HAVE_VIS_H) && !defined(BROKEN_STRNVIS)
 #include <vis.h>
 #endif
 
@@ -304,6 +304,7 @@ struct identity {
         char    *filename;              /* comment for agent-only keys */
         int     tried;
         int     isprivate;              /* key points to the private key */
+        int     userprovided;
 };
 TAILQ_HEAD(idlist, identity);
 
@@ -369,7 +370,7 @@ void	userauth(Authctxt *, char *);
 static int sign_and_send_pubkey(Authctxt *, Identity *);
 static void pubkey_prepare(Authctxt *);
 static void pubkey_cleanup(Authctxt *);
-static Key *load_identity_file(char *);
+static Key *load_identity_file(char *, int);
 
 static Authmethod *authmethod_get(char *authlist);
 static Authmethod *authmethod_lookup(const char *name);
@@ -1302,7 +1303,7 @@ identity_sign(Identity *id, u_char **sigp, u_int *lenp,
         if (id->isprivate || (id->key->flags & KEY_FLAG_EXT))
                 return (key_sign(id->key, sigp, lenp, data, datalen));
         /* load the private key from the file */
-        if ((prv = load_identity_file(id->filename)) == NULL)
+        if ((prv = load_identity_file(id->filename, id->userprovided)) == NULL)
                 return (-1);
         ret = key_sign(prv, sigp, lenp, data, datalen);
         key_free(prv);
@@ -1427,7 +1428,7 @@ send_pubkey_test(Authctxt *authctxt, Identity *id)
 }
 
 static Key *
-load_identity_file(char *filename)
+load_identity_file(char *filename, int userprovided)
 {
         Key *private;
         char prompt[300], *passphrase;
@@ -1435,7 +1436,8 @@ load_identity_file(char *filename)
         struct stat st;
 
         if (stat(filename, &st) < 0) {
-                debug3("no such identity: %s", filename);
+                (userprovided ? logit : debug3)("no such identity: %s: %s",
+                    filename, strerror(errno));
                 return NULL;
         }
         private = key_load_private_type(KEY_UNSPEC, filename, "", NULL, &perm_ok);
@@ -1475,7 +1477,7 @@ load_identity_file(char *filename)
 static void
 pubkey_prepare(Authctxt *authctxt)
 {
-        Identity *id;
+        Identity *id, *id2, *tmp;
         Idlist agent, files, *preferred;
         Key *key;
         AuthenticationConnection *ac;
@@ -1487,7 +1489,7 @@ pubkey_prepare(Authctxt *authctxt)
         preferred = &authctxt->keys;
         TAILQ_INIT(preferred);  /* preferred order of keys */
 
-        /* list of keys stored in the filesystem */
+        /* list of keys stored in the filesystem and PKCS#11 */
         for (i = 0; i < options.num_identity_files; i++) {
                 if (options.identity_files[i] == NULL)
                         continue;
@@ -1500,8 +1502,32 @@ pubkey_prepare(Authctxt *authctxt)
                 id = xcalloc(1, sizeof(*id));
                 id->key = key;
                 id->filename = xstrdup(options.identity_files[i]);
+                id->userprovided = 1;
                 TAILQ_INSERT_TAIL(&files, id, next);
         }
+        /* Prefer PKCS11 keys that are explicitly listed */
+        TAILQ_FOREACH_SAFE(id, &files, next, tmp) {
+                if (id->key == NULL || (id->key->flags & KEY_FLAG_EXT) == 0)
+                        continue;
+                found = 0;
+                TAILQ_FOREACH(id2, &files, next) {
+                        if (id2->key == NULL ||
+                            (id2->key->flags & KEY_FLAG_EXT) != 0)
+                                continue;
+                        if (key_equal(id->key, id2->key)) {
+                                TAILQ_REMOVE(&files, id, next);
+                                TAILQ_INSERT_TAIL(preferred, id, next);
+                                found = 1;
+                                break;
+                        }
+                }
+                /* If IdentitiesOnly set and key not found then don't use it */
+                if (!found && options.identities_only) {
+                        TAILQ_REMOVE(&files, id, next);
+                        bzero(id, sizeof(id));
+                        free(id);
+                }
+        }
         /* list of keys supported by the agent */
         if ((ac = ssh_get_authentication_connection())) {
                 for (key = ssh_get_first_identity(ac, &comment, 2);
@@ -1541,7 +1567,8 @@ pubkey_prepare(Authctxt *authctxt)
                 TAILQ_INSERT_TAIL(preferred, id, next);
         }
         TAILQ_FOREACH(id, preferred, next) {
-                debug2("key: %s (%p)", id->filename, id->key);
+                debug2("key: %s (%p),%s", id->filename, id->key,
+                    id->userprovided ? " explicit" : "");
         }
 }
 
@@ -1586,7 +1613,8 @@ userauth_pubkey(Authctxt *authctxt)
                         sent = send_pubkey_test(authctxt, id);
                 } else if (id->key == NULL && id->filename) {
                         debug("Trying private key: %s", id->filename);
-                        id->key = load_identity_file(id->filename);
+                        id->key = load_identity_file(id->filename,
+                            id->userprovided);
                         if (id->key != NULL) {
                                 id->isprivate = 1;
                                 sent = sign_and_send_pubkey(authctxt, id);
diff --git a/sshd.0 b/sshd.0
index 35093337d..83f9a881b 100644
--- a/sshd.0
+++ b/sshd.0
@@ -169,7 +169,7 @@ AUTHENTICATION
      client selects the encryption algorithm to use from those offered by the
      server.  Additionally, session integrity is provided through a
      cryptographic message authentication code (hmac-md5, hmac-sha1, umac-64,
-     hmac-ripemd160, hmac-sha2-256 or hmac-sha2-512).
+     umac-128, hmac-ripemd160, hmac-sha2-256 or hmac-sha2-512).
 
      Finally, the server and the client enter an authentication dialog.  The
      client tries to authenticate itself using host-based authentication,
@@ -634,4 +634,4 @@ CAVEATS
      System security is not improved unless rshd, rlogind, and rexecd are
      disabled (thus completely disabling rlogin and rsh into the machine).
 
-OpenBSD 5.2                      June 18, 2012                     OpenBSD 5.2
+OpenBSD 5.3                     October 4, 2012                    OpenBSD 5.3
diff --git a/sshd.8 b/sshd.8
index b74ab47c0..e7ec82e64 100644
--- a/sshd.8
+++ b/sshd.8
@@ -33,8 +33,8 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: sshd.8,v 1.266 2012/06/18 12:07:07 dtucker Exp $
-.Dd $Mdocdate: June 18 2012 $
+.\" $OpenBSD: sshd.8,v 1.267 2012/10/04 13:21:50 markus Exp $
+.Dd $Mdocdate: October 4 2012 $
 .Dt SSHD 8
 .Os
 .Sh NAME
@@ -319,7 +319,7 @@ The client selects the encryption algorithm
 to use from those offered by the server.
 Additionally, session integrity is provided
 through a cryptographic message authentication code
-(hmac-md5, hmac-sha1, umac-64, hmac-ripemd160,
+(hmac-md5, hmac-sha1, umac-64, umac-128, hmac-ripemd160,
 hmac-sha2-256 or hmac-sha2-512).
 .Pp
 Finally, the server and the client enter an authentication dialog.
diff --git a/sshd.c b/sshd.c
index 101c31671..64c564236 100644
--- a/sshd.c
+++ b/sshd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshd.c,v 1.393 2012/07/10 02:19:15 djm Exp $ */
+/* $OpenBSD: sshd.c,v 1.397 2013/02/11 21:21:58 dtucker Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -363,6 +363,15 @@ grace_alarm_handler(int sig)
         if (use_privsep && pmonitor != NULL && pmonitor->m_pid > 0)
                 kill(pmonitor->m_pid, SIGALRM);
 
+        /*
+         * Try to kill any processes that we have spawned, E.g. authorized
+         * keys command helpers.
+         */
+        if (getpgid(0) == getpid()) {
+                signal(SIGTERM, SIG_IGN);
+                killpg(0, SIGTERM);
+        }
+
         /* Log error and exit. */
         sigdie("Timeout before authentication for %s", get_remote_ipaddr());
 }
@@ -1333,6 +1342,7 @@ main(int ac, char **av)
         int remote_port;
         char *line;
         int config_s[2] = { -1 , -1 };
+        u_int n;
         u_int64_t ibytes, obytes;
         mode_t new_umask;
         Key *key;
@@ -1555,6 +1565,33 @@ main(int ac, char **av)
         if (options.challenge_response_authentication)
                 options.kbd_interactive_authentication = 1;
 
+        /* Check that options are sensible */
+        if (options.authorized_keys_command_user == NULL &&
+            (options.authorized_keys_command != NULL &&
+            strcasecmp(options.authorized_keys_command, "none") != 0))
+                fatal("AuthorizedKeysCommand set without "
+                    "AuthorizedKeysCommandUser");
+
+        /*
+         * Check whether there is any path through configured auth methods.
+         * Unfortunately it is not possible to verify this generally before
+         * daemonisation in the presence of Match block, but this catches
+         * and warns for trivial misconfigurations that could break login.
+         */
+        if (options.num_auth_methods != 0) {
+                if ((options.protocol & SSH_PROTO_1))
+                        fatal("AuthenticationMethods is not supported with "
+                            "SSH protocol 1");
+                for (n = 0; n < options.num_auth_methods; n++) {
+                        if (auth2_methods_valid(options.auth_methods[n],
+                            1) == 0)
+                                break;
+                }
+                if (n >= options.num_auth_methods)
+                        fatal("AuthenticationMethods cannot be satisfied by "
+                            "enabled authentication methods");
+        }
+
         /* set default channel AF */
         channel_set_af(options.address_family);
 
@@ -1564,7 +1601,8 @@ main(int ac, char **av)
                 exit(1);
         }
 
-        debug("sshd version %.100s", SSH_RELEASE);
+        debug("sshd version %s, %s", SSH_VERSION,
+            SSLeay_version(SSLEAY_VERSION));
 
         /* Store privilege separation user for later use if required. */
         if ((privsep_pw = getpwnam(SSH_PRIVSEP_USER)) == NULL) {
diff --git a/sshd_config b/sshd_config
index 3ea8e2efc..5de6846ef 100644
--- a/sshd_config
+++ b/sshd_config
@@ -1,4 +1,4 @@
-#       $OpenBSD: sshd_config,v 1.87 2012/07/10 02:19:15 djm Exp $
+#       $OpenBSD: sshd_config,v 1.89 2013/02/06 00:20:42 dtucker Exp $
 
 # This is the sshd server system-wide configuration file.  See
 # sshd_config(5) for more information.
@@ -52,6 +52,9 @@ AuthorizedKeysFile	.ssh/authorized_keys
 
 #AuthorizedPrincipalsFile none
 
+#AuthorizedKeysCommand none
+#AuthorizedKeysCommandUser nobody
+
 # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
 #RhostsRSAAuthentication no
 # similar for protocol version 2
diff --git a/sshd_config.0 b/sshd_config.0
index d9c87b7a0..2648db3d4 100644
--- a/sshd_config.0
+++ b/sshd_config.0
@@ -53,10 +53,14 @@ DESCRIPTION
              See PATTERNS in ssh_config(5) for more information on patterns.
 
      AllowTcpForwarding
-             Specifies whether TCP forwarding is permitted.  The default is
-             ``yes''.  Note that disabling TCP forwarding does not improve
-             security unless users are also denied shell access, as they can
-             always install their own forwarders.
+             Specifies whether TCP forwarding is permitted.  The available
+             options are ``yes'' or ``all'' to allow TCP forwarding, ``no'' to
+             prevent all TCP forwarding, ``local'' to allow local (from the
+             perspective of ssh(1)) forwarding only or ``remote'' to allow
+             remote forwarding only.  The default is ``yes''.  Note that
+             disabling TCP forwarding does not improve security unless users
+             are also denied shell access, as they can always install their
+             own forwarders.
 
      AllowUsers
              This keyword can be followed by a list of user name patterns,
@@ -71,6 +75,44 @@ DESCRIPTION
 
              See PATTERNS in ssh_config(5) for more information on patterns.
 
+     AuthenticationMethods
+             Specifies the authentication methods that must be successfully
+             completed for a user to be granted access.  This option must be
+             followed by one or more comma-separated lists of authentication
+             method names.  Successful authentication requires completion of
+             every method in at least one of these lists.
+
+             For example, an argument of ``publickey,password
+             publickey,keyboard-interactive'' would require the user to
+             complete public key authentication, followed by either password
+             or keyboard interactive authentication.  Only methods that are
+             next in one or more lists are offered at each stage, so for this
+             example, it would not be possible to attempt password or
+             keyboard-interactive authentication before public key.
+
+             This option is only available for SSH protocol 2 and will yield a
+             fatal error if enabled if protocol 1 is also enabled.  Note that
+             each authentication method listed should also be explicitly
+             enabled in the configuration.  The default is not to require
+             multiple authentication; successful completion of a single
+             authentication method is sufficient.
+
+     AuthorizedKeysCommand
+             Specifies a program to be used to look up the user's public keys.
+             The program will be invoked with a single argument of the
+             username being authenticated, and should produce on standard
+             output zero or more lines of authorized_keys output (see
+             AUTHORIZED_KEYS in sshd(8)).  If a key supplied by
+             AuthorizedKeysCommand does not successfully authenticate and
+             authorize the user then public key authentication continues using
+             the usual AuthorizedKeysFile files.  By default, no
+             AuthorizedKeysCommand is run.
+
+     AuthorizedKeysCommandUser
+             Specifies the user under whose account the AuthorizedKeysCommand
+             is run.  It is recommended to use a dedicated user that has no
+             other role on the host than running authorized keys commands.
+
      AuthorizedKeysFile
              Specifies the file that contains the public keys that can be used
              for user authentication.  The format is described in the
@@ -150,11 +192,13 @@ DESCRIPTION
              Specifies the ciphers allowed for protocol version 2.  Multiple
              ciphers must be comma-separated.  The supported ciphers are
              ``3des-cbc'', ``aes128-cbc'', ``aes192-cbc'', ``aes256-cbc'',
-             ``aes128-ctr'', ``aes192-ctr'', ``aes256-ctr'', ``arcfour128'',
-             ``arcfour256'', ``arcfour'', ``blowfish-cbc'', and
-             ``cast128-cbc''.  The default is:
+             ``aes128-ctr'', ``aes192-ctr'', ``aes256-ctr'',
+             ``aes128-gcm@openssh.com'', ``aes256-gcm@openssh.com'',
+             ``arcfour128'', ``arcfour256'', ``arcfour'', ``blowfish-cbc'',
+             and ``cast128-cbc''.  The default is:
 
                 aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,
+                aes128-gcm@openssh.com,aes256-gcm@openssh.com,
                 aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,
                 aes256-cbc,arcfour
 
@@ -373,9 +417,16 @@ DESCRIPTION
      MACs    Specifies the available MAC (message authentication code)
              algorithms.  The MAC algorithm is used in protocol version 2 for
              data integrity protection.  Multiple algorithms must be comma-
-             separated.  The default is:
-
-                   hmac-md5,hmac-sha1,umac-64@openssh.com,
+             separated.  The algorithms that contain ``-etm'' calculate the
+             MAC after encryption (encrypt-then-mac).  These are considered
+             safer and their use recommended.  The default is:
+
+                   hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,
+                   umac-64-etm@openssh.com,umac-128-etm@openssh.com,
+                   hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,
+                   hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,
+                   hmac-md5-96-etm@openssh.com,
+                   hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,
                    hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,
                    hmac-sha1-96,hmac-md5-96
 
@@ -402,15 +453,16 @@ DESCRIPTION
              Only a subset of keywords may be used on the lines following a
              Match keyword.  Available keywords are AcceptEnv,
              AllowAgentForwarding, AllowGroups, AllowTcpForwarding,
-             AllowUsers, AuthorizedKeysFile, AuthorizedPrincipalsFile, Banner,
-             ChrootDirectory, DenyGroups, DenyUsers, ForceCommand,
-             GatewayPorts, GSSAPIAuthentication, HostbasedAuthentication,
-             HostbasedUsesNameFromPacketOnly, KbdInteractiveAuthentication,
-             KerberosAuthentication, MaxAuthTries, MaxSessions,
-             PasswordAuthentication, PermitEmptyPasswords, PermitOpen,
-             PermitRootLogin, PermitTunnel, PubkeyAuthentication,
-             RhostsRSAAuthentication, RSAAuthentication, X11DisplayOffset,
-             X11Forwarding and X11UseLocalHost.
+             AllowUsers, AuthenticationMethods, AuthorizedKeysCommand,
+             AuthorizedKeysCommandUser, AuthorizedKeysFile,
+             AuthorizedPrincipalsFile, Banner, ChrootDirectory, DenyGroups,
+             DenyUsers, ForceCommand, GatewayPorts, GSSAPIAuthentication,
+             HostbasedAuthentication, HostbasedUsesNameFromPacketOnly,
+             KbdInteractiveAuthentication, KerberosAuthentication,
+             MaxAuthTries, MaxSessions, PasswordAuthentication,
+             PermitEmptyPasswords, PermitOpen, PermitRootLogin, PermitTunnel,
+             PubkeyAuthentication, RhostsRSAAuthentication, RSAAuthentication,
+             X11DisplayOffset, X11Forwarding and X11UseLocalHost.
 
      MaxAuthTries
              Specifies the maximum number of authentication attempts permitted
@@ -425,7 +477,7 @@ DESCRIPTION
              Specifies the maximum number of concurrent unauthenticated
              connections to the SSH daemon.  Additional connections will be
              dropped until authentication succeeds or the LoginGraceTime
-             expires for a connection.  The default is 10.
+             expires for a connection.  The default is 10:30:100.
 
              Alternatively, random early drop can be enabled by specifying the
              three colon separated values ``start:rate:full'' (e.g.
@@ -520,10 +572,13 @@ DESCRIPTION
              version 2 only.
 
      RevokedKeys
-             Specifies a list of revoked public keys.  Keys listed in this
-             file will be refused for public key authentication.  Note that if
-             this file is not readable, then public key authentication will be
-             refused for all users.
+             Specifies revoked public keys.  Keys listed in this file will be
+             refused for public key authentication.  Note that if this file is
+             not readable, then public key authentication will be refused for
+             all users.  Keys may be specified as a text file, listing one
+             public key per line, or as an OpenSSH Key Revocation List (KRL)
+             as generated by ssh-keygen(1).  For more information on KRLs, see
+             the KEY REVOCATION LISTS section in ssh-keygen(1).
 
      RhostsRSAAuthentication
              Specifies whether rhosts or /etc/hosts.equiv authentication
@@ -722,4 +777,4 @@ AUTHORS
      versions 1.5 and 2.0.  Niels Provos and Markus Friedl contributed support
      for privilege separation.
 
-OpenBSD 5.2                      June 29, 2012                     OpenBSD 5.2
+OpenBSD 5.3                    February 6, 2013                    OpenBSD 5.3
diff --git a/sshd_config.5 b/sshd_config.5
index de2b776fd..251d847fd 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -33,8 +33,8 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: sshd_config.5,v 1.144 2012/06/29 13:57:25 naddy Exp $
-.Dd $Mdocdate: June 29 2012 $
+.\" $OpenBSD: sshd_config.5,v 1.156 2013/02/06 00:20:42 dtucker Exp $
+.Dd $Mdocdate: February 6 2013 $
 .Dt SSHD_CONFIG 5
 .Os
 .Sh NAME
@@ -151,6 +151,19 @@ in
 for more information on patterns.
 .It Cm AllowTcpForwarding
 Specifies whether TCP forwarding is permitted.
+The available options are
+.Dq yes
+or
+.Dq all
+to allow TCP forwarding,
+.Dq no
+to prevent all TCP forwarding,
+.Dq local
+to allow local (from the perspective of
+.Xr ssh 1 )
+forwarding only or
+.Dq remote
+to allow remote forwarding only.
 The default is
 .Dq yes .
 Note that disabling TCP forwarding does not improve security unless
@@ -178,6 +191,45 @@ See
 in
 .Xr ssh_config 5
 for more information on patterns.
+.It Cm AuthenticationMethods
+Specifies the authentication methods that must be successfully completed
+for a user to be granted access.
+This option must be followed by one or more comma-separated lists of
+authentication method names.
+Successful authentication requires completion of every method in at least
+one of these lists.
+.Pp
+For example, an argument of
+.Dq publickey,password publickey,keyboard-interactive
+would require the user to complete public key authentication, followed by
+either password or keyboard interactive authentication.
+Only methods that are next in one or more lists are offered at each stage,
+so for this example, it would not be possible to attempt password or
+keyboard-interactive authentication before public key.
+.Pp
+This option is only available for SSH protocol 2 and will yield a fatal
+error if enabled if protocol 1 is also enabled.
+Note that each authentication method listed should also be explicitly enabled
+in the configuration.
+The default is not to require multiple authentication; successful completion
+of a single authentication method is sufficient.
+.It Cm AuthorizedKeysCommand
+Specifies a program to be used to look up the user's public keys.
+The program will be invoked with a single argument of the username
+being authenticated, and should produce on standard output zero or
+more lines of authorized_keys output (see
+.Sx AUTHORIZED_KEYS
+in
+.Xr sshd 8 ) .
+If a key supplied by AuthorizedKeysCommand does not successfully authenticate
+and authorize the user then public key authentication continues using the usual
+.Cm AuthorizedKeysFile
+files.
+By default, no AuthorizedKeysCommand is run.
+.It Cm AuthorizedKeysCommandUser
+Specifies the user under whose account the AuthorizedKeysCommand is run.
+It is recommended to use a dedicated user that has no other role on the host
+than running authorized keys commands.
 .It Cm AuthorizedKeysFile
 Specifies the file that contains the public keys that can be used
 for user authentication.
@@ -310,6 +362,8 @@ The supported ciphers are
 .Dq aes128-ctr ,
 .Dq aes192-ctr ,
 .Dq aes256-ctr ,
+.Dq aes128-gcm@openssh.com ,
+.Dq aes256-gcm@openssh.com ,
 .Dq arcfour128 ,
 .Dq arcfour256 ,
 .Dq arcfour ,
@@ -319,6 +373,7 @@ and
 The default is:
 .Bd -literal -offset 3n
 aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,
+aes128-gcm@openssh.com,aes256-gcm@openssh.com,
 aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,
 aes256-cbc,arcfour
 .Ed
@@ -713,9 +768,18 @@ Specifies the available MAC (message authentication code) algorithms.
 The MAC algorithm is used in protocol version 2
 for data integrity protection.
 Multiple algorithms must be comma-separated.
+The algorithms that contain
+.Dq -etm
+calculate the MAC after encryption (encrypt-then-mac).
+These are considered safer and their use recommended.
 The default is:
 .Bd -literal -offset indent
-hmac-md5,hmac-sha1,umac-64@openssh.com,
+hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,
+umac-64-etm@openssh.com,umac-128-etm@openssh.com,
+hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,
+hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,
+hmac-md5-96-etm@openssh.com,
+hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,
 hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,
 hmac-sha1-96,hmac-md5-96
 .Ed
@@ -770,6 +834,9 @@ Available keywords are
 .Cm AllowGroups ,
 .Cm AllowTcpForwarding ,
 .Cm AllowUsers ,
+.Cm AuthenticationMethods ,
+.Cm AuthorizedKeysCommand ,
+.Cm AuthorizedKeysCommandUser ,
 .Cm AuthorizedKeysFile ,
 .Cm AuthorizedPrincipalsFile ,
 .Cm Banner ,
@@ -1000,10 +1067,17 @@ The default is
 .Dq yes .
 Note that this option applies to protocol version 2 only.
 .It Cm RevokedKeys
-Specifies a list of revoked public keys.
+Specifies revoked public keys.
 Keys listed in this file will be refused for public key authentication.
 Note that if this file is not readable, then public key authentication will
 be refused for all users.
+Keys may be specified as a text file, listing one public key per line, or as
+an OpenSSH Key Revocation List (KRL) as generated by
+.Xr ssh-keygen 1 .
+For more information on KRLs, see the
+.Sx KEY REVOCATION LISTS
+section in
+.Xr ssh-keygen 1 .
 .It Cm RhostsRSAAuthentication
 Specifies whether rhosts or /etc/hosts.equiv authentication together
 with successful RSA host authentication is allowed.
diff --git a/uidswap.c b/uidswap.c
index 837648396..cdd7309e3 100644
--- a/uidswap.c
+++ b/uidswap.c
@@ -138,20 +138,8 @@ permanently_drop_suid(uid_t uid)
         uid_t old_uid = getuid();
 
         debug("permanently_drop_suid: %u", (u_int)uid);
-#if defined(HAVE_SETRESUID) && !defined(BROKEN_SETRESUID)
         if (setresuid(uid, uid, uid) < 0)
                 fatal("setresuid %u: %.100s", (u_int)uid, strerror(errno));
-#elif defined(HAVE_SETREUID) && !defined(BROKEN_SETREUID)
-        if (setreuid(uid, uid) < 0)
-                fatal("setreuid %u: %.100s", (u_int)uid, strerror(errno));
-#else
-# ifndef SETEUID_BREAKS_SETUID
-        if (seteuid(uid) < 0)
-                fatal("seteuid %u: %.100s", (u_int)uid, strerror(errno));
-# endif
-        if (setuid(uid) < 0)
-                fatal("setuid %u: %.100s", (u_int)uid, strerror(errno));
-#endif
 
 #ifndef HAVE_CYGWIN
         /* Try restoration of UID if changed (test clearing of saved uid) */
@@ -220,18 +208,8 @@ permanently_set_uid(struct passwd *pw)
         debug("permanently_set_uid: %u/%u", (u_int)pw->pw_uid,
             (u_int)pw->pw_gid);
 
-#if defined(HAVE_SETRESGID) && !defined(BROKEN_SETRESGID)
         if (setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) < 0)
                 fatal("setresgid %u: %.100s", (u_int)pw->pw_gid, strerror(errno));
-#elif defined(HAVE_SETREGID) && !defined(BROKEN_SETREGID)
-        if (setregid(pw->pw_gid, pw->pw_gid) < 0)
-                fatal("setregid %u: %.100s", (u_int)pw->pw_gid, strerror(errno));
-#else
-        if (setegid(pw->pw_gid) < 0)
-                fatal("setegid %u: %.100s", (u_int)pw->pw_gid, strerror(errno));
-        if (setgid(pw->pw_gid) < 0)
-                fatal("setgid %u: %.100s", (u_int)pw->pw_gid, strerror(errno));
-#endif
 
 #ifdef __APPLE__
         /*
@@ -243,20 +221,8 @@ permanently_set_uid(struct passwd *pw)
                     pw->pw_name, (u_int)pw->pw_gid, strerror(errno));
 #endif
 
-#if defined(HAVE_SETRESUID) && !defined(BROKEN_SETRESUID)
         if (setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid) < 0)
                 fatal("setresuid %u: %.100s", (u_int)pw->pw_uid, strerror(errno));
-#elif defined(HAVE_SETREUID) && !defined(BROKEN_SETREUID)
-        if (setreuid(pw->pw_uid, pw->pw_uid) < 0)
-                fatal("setreuid %u: %.100s", (u_int)pw->pw_uid, strerror(errno));
-#else
-# ifndef SETEUID_BREAKS_SETUID
-        if (seteuid(pw->pw_uid) < 0)
-                fatal("seteuid %u: %.100s", (u_int)pw->pw_uid, strerror(errno));
-# endif
-        if (setuid(pw->pw_uid) < 0)
-                fatal("setuid %u: %.100s", (u_int)pw->pw_uid, strerror(errno));
-#endif
 
 #ifndef HAVE_CYGWIN
         /* Try restoration of GID if changed (test clearing of saved gid) */
diff --git a/umac.c b/umac.c
index e78d2cc5f..0567c37f9 100644
--- a/umac.c
+++ b/umac.c
@@ -52,7 +52,15 @@
 /* --- User Switches ---------------------------------------------------- */
 /* ---------------------------------------------------------------------- */
 
+#ifndef UMAC_OUTPUT_LEN
 #define UMAC_OUTPUT_LEN     8  /* Alowable: 4, 8, 12, 16                  */
+#endif
+
+#if UMAC_OUTPUT_LEN != 4 && UMAC_OUTPUT_LEN != 8 && \
+    UMAC_OUTPUT_LEN != 12 && UMAC_OUTPUT_LEN != 16
+# error UMAC_OUTPUT_LEN must be defined to 4, 8, 12 or 16
+#endif
+
 /* #define FORCE_C_ONLY        1  ANSI C and 64-bit integers req'd        */
 /* #define AES_IMPLEMENTAION   1  1 = OpenSSL, 2 = Barreto, 3 = Gladman   */
 /* #define SSE2                0  Is SSE2 is available?                   */
diff --git a/umac.h b/umac.h
index 055c705f8..6795112a3 100644
--- a/umac.h
+++ b/umac.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: umac.h,v 1.1 2007/06/07 19:37:34 pvalchev Exp $ */
+/* $OpenBSD: umac.h,v 1.2 2012/10/04 13:21:50 markus Exp $ */
 /* -----------------------------------------------------------------------
  * 
  * umac.h -- C Implementation UMAC Message Authentication
@@ -116,6 +116,12 @@ int uhash(uhash_ctx_t ctx,
 
 #endif
 
+/* matching umac-128 API, we reuse umac_ctx, since it's opaque */
+struct umac_ctx *umac128_new(u_char key[]);
+int umac128_update(struct umac_ctx *ctx, u_char *input, long len);
+int umac128_final(struct umac_ctx *ctx, u_char tag[], u_char nonce[8]);
+int umac128_delete(struct umac_ctx *ctx);
+
 #ifdef __cplusplus
     }
 #endif
diff --git a/version.h b/version.h
index 09e8f6099..82061d88a 100644
--- a/version.h
+++ b/version.h
@@ -1,6 +1,6 @@
-/* $OpenBSD: version.h,v 1.65 2012/07/22 18:19:21 markus Exp $ */
+/* $OpenBSD: version.h,v 1.66 2013/02/10 21:19:34 markus Exp $ */
 
-#define SSH_VERSION     "OpenSSH_6.1"
+#define SSH_VERSION     "OpenSSH_6.2"
 
 #define SSH_PORTABLE    "p1"
 #define SSH_RELEASE_MINIMUM     SSH_VERSION SSH_PORTABLE