Import openssh_8.1p1.orig.tar.gz

18 files changed, 432 insertions, 52 deletions

diff --git a/regress/unittests/Makefile b/regress/unittests/Makefile
index e464b085a..4e56e1104 100644
--- a/regress/unittests/Makefile
+++ b/regress/unittests/Makefile
@@ -1,7 +1,7 @@
-#       $OpenBSD: Makefile,v 1.10 2018/03/03 03:16:17 djm Exp $
+#       $OpenBSD: Makefile,v 1.11 2019/04/28 22:53:26 dtucker Exp $
 
 REGRESS_FAIL_EARLY?=    yes
 SUBDIR= test_helper sshbuf sshkey bitmap kex hostkeys utf8 match conversion
-SUBDIR+=authopt
+SUBDIR+=authopt misc
 
 .include <bsd.subdir.mk>
diff --git a/regress/unittests/bitmap/tests.c b/regress/unittests/bitmap/tests.c
index 23025f90a..f66a4ce46 100644
--- a/regress/unittests/bitmap/tests.c
+++ b/regress/unittests/bitmap/tests.c
@@ -16,7 +16,9 @@
 #include <stdlib.h>
 #include <string.h>
 
+#ifdef WITH_OPENSSL
 #include <openssl/bn.h>
+#endif
 
 #include "../test_helper/test_helper.h"
 
@@ -27,6 +29,7 @@
 void
 tests(void)
 {
+#ifdef WITH_OPENSSL
         struct bitmap *b;
         BIGNUM *bn;
         size_t len;
@@ -131,5 +134,6 @@ tests(void)
         bitmap_free(b);
         BN_free(bn);
         TEST_DONE();
+#endif
 }
 
diff --git a/regress/unittests/conversion/tests.c b/regress/unittests/conversion/tests.c
index 6dd77ef42..ae1154d42 100644
--- a/regress/unittests/conversion/tests.c
+++ b/regress/unittests/conversion/tests.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: tests.c,v 1.1 2017/03/14 01:20:29 dtucker Exp $ */
+/*      $OpenBSD: tests.c,v 1.2 2019/06/14 04:03:48 djm Exp $ */
 /*
  * Regress test for conversions
  *
@@ -40,6 +40,8 @@ tests(void)
         ASSERT_LONG_EQ(convtime("-9d"), -1);
         
         /* overflow */
+        snprintf(buf, sizeof buf, "%llu", (unsigned long long)LONG_MAX);
+        ASSERT_LONG_EQ(convtime(buf), -1);
         snprintf(buf, sizeof buf, "%llu", (unsigned long long)LONG_MAX + 1);
         ASSERT_LONG_EQ(convtime(buf), -1);
 
diff --git a/regress/unittests/hostkeys/test_iterate.c b/regress/unittests/hostkeys/test_iterate.c
index d6963bd2a..5904121ef 100644
--- a/regress/unittests/hostkeys/test_iterate.c
+++ b/regress/unittests/hostkeys/test_iterate.c
@@ -57,7 +57,7 @@ check(struct hostkey_foreach_line *l, void *_ctx)
         int parse_key = (ctx->flags & HKF_WANT_PARSE_KEY) != 0;
         const int matching = (ctx->flags & HKF_WANT_MATCH) != 0;
         u_int expected_status, expected_match;
-        int expected_keytype;
+        int expected_keytype, skip = 0;
 
         test_subtest_info("entry %zu/%zu, file line %ld",
             ctx->i + 1, ctx->nexpected, l->linenum);
@@ -92,13 +92,23 @@ check(struct hostkey_foreach_line *l, void *_ctx)
 
 #ifndef OPENSSL_HAS_ECC
         if (expected->l.keytype == KEY_ECDSA ||
-            expected->no_parse_keytype == KEY_ECDSA) {
+            expected->no_parse_keytype == KEY_ECDSA)
+                skip = 1;
+#endif /* OPENSSL_HAS_ECC */
+#ifndef WITH_OPENSSL
+        if (expected->l.keytype == KEY_DSA ||
+            expected->no_parse_keytype == KEY_DSA ||
+            expected->l.keytype == KEY_RSA ||
+            expected->no_parse_keytype == KEY_RSA ||
+            expected->l.keytype == KEY_ECDSA ||
+            expected->no_parse_keytype == KEY_ECDSA)
+                skip = 1;
+#endif /* WITH_OPENSSL */
+        if (skip) {
                 expected_status = HKF_STATUS_INVALID;
                 expected_keytype = KEY_UNSPEC;
                 parse_key = 0;
         }
-#endif
-
         UPDATE_MATCH_STATUS(match_host_p);
         UPDATE_MATCH_STATUS(match_host_s);
         UPDATE_MATCH_STATUS(match_ipv4);
@@ -145,7 +155,15 @@ prepare_expected(struct expected *expected, size_t n)
 #ifndef OPENSSL_HAS_ECC
                 if (expected[i].l.keytype == KEY_ECDSA)
                         continue;
-#endif
+#endif /* OPENSSL_HAS_ECC */
+#ifndef WITH_OPENSSL
+                switch (expected[i].l.keytype) {
+                case KEY_RSA:
+                case KEY_DSA:
+                case KEY_ECDSA:
+                        continue;
+                }
+#endif /* WITH_OPENSSL */
                 ASSERT_INT_EQ(sshkey_load_public(
                     test_data_file(expected[i].key_file), &expected[i].l.key,
                     NULL), 0);
diff --git a/regress/unittests/kex/test_kex.c b/regress/unittests/kex/test_kex.c
index a860efc02..0e7cd9e07 100644
--- a/regress/unittests/kex/test_kex.c
+++ b/regress/unittests/kex/test_kex.c
@@ -142,13 +142,15 @@ do_kex_with_key(char *kex, int keytype, int bits)
         sshbuf_free(state);
         ASSERT_PTR_NE(server2->kex, NULL);
         /* XXX we need to set the callbacks */
+#ifdef WITH_OPENSSL
         server2->kex->kex[KEX_DH_GRP1_SHA1] = kex_gen_server;
         server2->kex->kex[KEX_DH_GRP14_SHA1] = kex_gen_server;
         server2->kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
         server2->kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
 #ifdef OPENSSL_HAS_ECC
         server2->kex->kex[KEX_ECDH_SHA2] = kex_gen_server;
-#endif
+#endif /* OPENSSL_HAS_ECC */
+#endif /* WITH_OPENSSL */
         server2->kex->kex[KEX_C25519_SHA256] = kex_gen_server;
         server2->kex->load_host_public_key = server->kex->load_host_public_key;
         server2->kex->load_host_private_key = server->kex->load_host_private_key;
@@ -175,11 +177,13 @@ do_kex_with_key(char *kex, int keytype, int bits)
 static void
 do_kex(char *kex)
 {
+#ifdef WITH_OPENSSL
         do_kex_with_key(kex, KEY_RSA, 2048);
         do_kex_with_key(kex, KEY_DSA, 1024);
 #ifdef OPENSSL_HAS_ECC
         do_kex_with_key(kex, KEY_ECDSA, 256);
-#endif
+#endif /* OPENSSL_HAS_ECC */
+#endif /* WITH_OPENSSL */
         do_kex_with_key(kex, KEY_ED25519, 256);
 }
 
@@ -187,13 +191,15 @@ void
 kex_tests(void)
 {
         do_kex("curve25519-sha256@libssh.org");
+#ifdef WITH_OPENSSL
 #ifdef OPENSSL_HAS_ECC
         do_kex("ecdh-sha2-nistp256");
         do_kex("ecdh-sha2-nistp384");
         do_kex("ecdh-sha2-nistp521");
-#endif
+#endif /* OPENSSL_HAS_ECC */
         do_kex("diffie-hellman-group-exchange-sha256");
         do_kex("diffie-hellman-group-exchange-sha1");
         do_kex("diffie-hellman-group14-sha1");
         do_kex("diffie-hellman-group1-sha1");
+#endif /* WITH_OPENSSL */
 }
diff --git a/regress/unittests/sshbuf/test_sshbuf_getput_basic.c b/regress/unittests/sshbuf/test_sshbuf_getput_basic.c
index 966e8432b..bea89881a 100644
--- a/regress/unittests/sshbuf/test_sshbuf_getput_basic.c
+++ b/regress/unittests/sshbuf/test_sshbuf_getput_basic.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: test_sshbuf_getput_basic.c,v 1.1 2014/04/30 05:32:00 djm Exp $ */
+/*      $OpenBSD: test_sshbuf_getput_basic.c,v 1.2 2019/07/14 23:33:19 djm Exp $ */
 /*
  * Regress test for sshbuf.h buffer API
  *
@@ -481,4 +481,233 @@ sshbuf_getput_basic_tests(void)
         ASSERT_MEM_EQ(sshbuf_ptr(p1), bn_exp3, sizeof(bn_exp3));
         sshbuf_free(p1);
         TEST_DONE();
+
+        TEST_START("sshbuf_peek_u64");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put(p1, x, sizeof(x)), 0);
+        ASSERT_INT_EQ(sshbuf_peek_u64(p1, 0, &v64), 0);
+        ASSERT_U64_EQ(v64, 0x1122334455667788ULL);
+        ASSERT_INT_EQ(sshbuf_peek_u64(p1, 2, &v64), 0);
+        ASSERT_U64_EQ(v64, 0x3344556677880099ULL);
+        ASSERT_INT_EQ(sshbuf_peek_u64(p1, 3, &v64), SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_INT_EQ(sshbuf_peek_u64(p1, sizeof(x), &v64),
+            SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_INT_EQ(sshbuf_peek_u64(p1, 1000, &v64),
+            SSH_ERR_MESSAGE_INCOMPLETE);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_peek_u32");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put(p1, x, sizeof(x)), 0);
+        ASSERT_INT_EQ(sshbuf_peek_u32(p1, 0, &v32), 0);
+        ASSERT_U32_EQ(v32, 0x11223344);
+        ASSERT_INT_EQ(sshbuf_peek_u32(p1, 6, &v32), 0);
+        ASSERT_U32_EQ(v32, 0x77880099);
+        ASSERT_INT_EQ(sshbuf_peek_u32(p1, 7, &v32), SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_INT_EQ(sshbuf_peek_u32(p1, sizeof(x), &v32),
+            SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_INT_EQ(sshbuf_peek_u32(p1, 1000, &v32),
+            SSH_ERR_MESSAGE_INCOMPLETE);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_peek_u16");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put(p1, x, sizeof(x)), 0);
+        ASSERT_INT_EQ(sshbuf_peek_u16(p1, 0, &v16), 0);
+        ASSERT_U16_EQ(v16, 0x1122);
+        ASSERT_INT_EQ(sshbuf_peek_u16(p1, 8, &v16), 0);
+        ASSERT_U16_EQ(v16, 0x99);
+        ASSERT_INT_EQ(sshbuf_peek_u16(p1, 9, &v16), SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_INT_EQ(sshbuf_peek_u16(p1, sizeof(x), &v16),
+            SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_INT_EQ(sshbuf_peek_u16(p1, 1000, &v16),
+            SSH_ERR_MESSAGE_INCOMPLETE);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_peek_u8");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_put(p1, x, sizeof(x)), 0);
+        ASSERT_INT_EQ(sshbuf_peek_u8(p1, 0, &v8), 0);
+        ASSERT_U8_EQ(v8, 0x11);
+        ASSERT_INT_EQ(sshbuf_peek_u8(p1, 9, &v8), 0);
+        ASSERT_U8_EQ(v8, 0x99);
+        ASSERT_INT_EQ(sshbuf_peek_u8(p1, sizeof(x), &v8),
+            SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_INT_EQ(sshbuf_peek_u8(p1, 1000, &v8),
+            SSH_ERR_MESSAGE_INCOMPLETE);
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_poke_u64");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_reserve(p1, 10, NULL), 0);
+        /* poke at start of buffer */
+        ASSERT_INT_EQ(sshbuf_poke_u64(p1, 0, 0xa1b2c3d4e5f60718ULL), 0);
+        s2 = sshbuf_dtob16(p1);
+        ASSERT_PTR_NE(s2, NULL);
+        ASSERT_STRING_EQ(s2, "a1b2c3d4e5f607180000");
+        free(s2);
+        sshbuf_reset(p1);
+        ASSERT_INT_EQ(sshbuf_reserve(p1, 10, NULL), 0);
+        /* poke aligned with end of buffer */
+        ASSERT_INT_EQ(sshbuf_poke_u64(p1, 2, 0xa1b2c3d4e5f60718ULL), 0);
+        s2 = sshbuf_dtob16(p1);
+        ASSERT_PTR_NE(s2, NULL);
+        ASSERT_STRING_EQ(s2, "0000a1b2c3d4e5f60718");
+        free(s2);
+        sshbuf_reset(p1);
+        ASSERT_INT_EQ(sshbuf_reserve(p1, 10, NULL), 0);
+        /* poke past end of buffer */
+        ASSERT_INT_EQ(sshbuf_poke_u64(p1, 3, 0xa1b2c3d4e5f60718ULL),
+            SSH_ERR_NO_BUFFER_SPACE);
+        ASSERT_INT_EQ(sshbuf_poke_u64(p1, 10, 0xa1b2c3d4e5f60718ULL),
+            SSH_ERR_NO_BUFFER_SPACE);
+        ASSERT_INT_EQ(sshbuf_poke_u64(p1, 1000, 0xa1b2c3d4e5f60718ULL),
+            SSH_ERR_NO_BUFFER_SPACE);
+        /* ensure failed pokes do not modify buffer */
+        s2 = sshbuf_dtob16(p1);
+        ASSERT_PTR_NE(s2, NULL);
+        ASSERT_STRING_EQ(s2, "00000000000000000000");
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_poke_u32");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_reserve(p1, 10, NULL), 0);
+        /* poke at start of buffer */
+        ASSERT_INT_EQ(sshbuf_poke_u32(p1, 0, 0xa1b2c3d4), 0);
+        s2 = sshbuf_dtob16(p1);
+        ASSERT_PTR_NE(s2, NULL);
+        ASSERT_STRING_EQ(s2, "a1b2c3d4000000000000");
+        free(s2);
+        sshbuf_reset(p1);
+        ASSERT_INT_EQ(sshbuf_reserve(p1, 10, NULL), 0);
+        /* poke aligned with end of buffer */
+        ASSERT_INT_EQ(sshbuf_poke_u32(p1, 6, 0xa1b2c3d4), 0);
+        s2 = sshbuf_dtob16(p1);
+        ASSERT_PTR_NE(s2, NULL);
+        ASSERT_STRING_EQ(s2, "000000000000a1b2c3d4");
+        free(s2);
+        sshbuf_reset(p1);
+        ASSERT_INT_EQ(sshbuf_reserve(p1, 10, NULL), 0);
+        /* poke past end of buffer */
+        ASSERT_INT_EQ(sshbuf_poke_u32(p1, 7, 0xa1b2c3d4),
+            SSH_ERR_NO_BUFFER_SPACE);
+        ASSERT_INT_EQ(sshbuf_poke_u32(p1, 10, 0xa1b2c3d4),
+            SSH_ERR_NO_BUFFER_SPACE);
+        ASSERT_INT_EQ(sshbuf_poke_u32(p1, 1000, 0xa1b2c3d4),
+            SSH_ERR_NO_BUFFER_SPACE);
+        /* ensure failed pokes do not modify buffer */
+        s2 = sshbuf_dtob16(p1);
+        ASSERT_PTR_NE(s2, NULL);
+        ASSERT_STRING_EQ(s2, "00000000000000000000");
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_poke_u16");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_reserve(p1, 10, NULL), 0);
+        /* poke at start of buffer */
+        ASSERT_INT_EQ(sshbuf_poke_u16(p1, 0, 0xa1b2), 0);
+        s2 = sshbuf_dtob16(p1);
+        ASSERT_PTR_NE(s2, NULL);
+        ASSERT_STRING_EQ(s2, "a1b20000000000000000");
+        free(s2);
+        sshbuf_reset(p1);
+        ASSERT_INT_EQ(sshbuf_reserve(p1, 10, NULL), 0);
+        /* poke aligned with end of buffer */
+        ASSERT_INT_EQ(sshbuf_poke_u16(p1, 8, 0xa1b2), 0);
+        s2 = sshbuf_dtob16(p1);
+        ASSERT_PTR_NE(s2, NULL);
+        ASSERT_STRING_EQ(s2, "0000000000000000a1b2");
+        free(s2);
+        sshbuf_reset(p1);
+        ASSERT_INT_EQ(sshbuf_reserve(p1, 10, NULL), 0);
+        /* poke past end of buffer */
+        ASSERT_INT_EQ(sshbuf_poke_u16(p1, 9, 0xa1b2),
+            SSH_ERR_NO_BUFFER_SPACE);
+        ASSERT_INT_EQ(sshbuf_poke_u16(p1, 10, 0xa1b2),
+            SSH_ERR_NO_BUFFER_SPACE);
+        ASSERT_INT_EQ(sshbuf_poke_u16(p1, 1000, 0xa1b2),
+            SSH_ERR_NO_BUFFER_SPACE);
+        /* ensure failed pokes do not modify buffer */
+        s2 = sshbuf_dtob16(p1);
+        ASSERT_PTR_NE(s2, NULL);
+        ASSERT_STRING_EQ(s2, "00000000000000000000");
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_poke_u8");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_reserve(p1, 10, NULL), 0);
+        /* poke at start of buffer */
+        ASSERT_INT_EQ(sshbuf_poke_u8(p1, 0, 0xa1), 0);
+        s2 = sshbuf_dtob16(p1);
+        ASSERT_PTR_NE(s2, NULL);
+        ASSERT_STRING_EQ(s2, "a1000000000000000000");
+        free(s2);
+        sshbuf_reset(p1);
+        ASSERT_INT_EQ(sshbuf_reserve(p1, 10, NULL), 0);
+        /* poke aligned with end of buffer */
+        ASSERT_INT_EQ(sshbuf_poke_u8(p1, 9, 0xa1), 0);
+        s2 = sshbuf_dtob16(p1);
+        ASSERT_PTR_NE(s2, NULL);
+        ASSERT_STRING_EQ(s2, "000000000000000000a1");
+        free(s2);
+        sshbuf_reset(p1);
+        ASSERT_INT_EQ(sshbuf_reserve(p1, 10, NULL), 0);
+        /* poke past end of buffer */
+        ASSERT_INT_EQ(sshbuf_poke_u8(p1, 10, 0xa1), SSH_ERR_NO_BUFFER_SPACE);
+        ASSERT_INT_EQ(sshbuf_poke_u8(p1, 1000, 0xa1), SSH_ERR_NO_BUFFER_SPACE);
+        /* ensure failed pokes do not modify buffer */
+        s2 = sshbuf_dtob16(p1);
+        ASSERT_PTR_NE(s2, NULL);
+        ASSERT_STRING_EQ(s2, "00000000000000000000");
+        sshbuf_free(p1);
+        TEST_DONE();
+
+        TEST_START("sshbuf_poke");
+        p1 = sshbuf_new();
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_reserve(p1, 10, NULL), 0);
+        /* poke at start of buffer */
+        ASSERT_INT_EQ(sshbuf_poke(p1, 0, "hello!", 6), 0);
+        s2 = sshbuf_dtob16(p1);
+        ASSERT_PTR_NE(s2, NULL);
+        ASSERT_STRING_EQ(s2, "68656c6c6f2100000000");
+        free(s2);
+        sshbuf_reset(p1);
+        ASSERT_INT_EQ(sshbuf_reserve(p1, 10, NULL), 0);
+        /* poke aligned with end of buffer */
+        ASSERT_INT_EQ(sshbuf_poke(p1, 4, "hello!", 6), 0);
+        s2 = sshbuf_dtob16(p1);
+        ASSERT_PTR_NE(s2, NULL);
+        ASSERT_STRING_EQ(s2, "0000000068656c6c6f21");
+        free(s2);
+        sshbuf_reset(p1);
+        ASSERT_INT_EQ(sshbuf_reserve(p1, 10, NULL), 0);
+        /* poke past end of buffer */
+        ASSERT_INT_EQ(sshbuf_poke(p1, 7, "hello!", 6),
+            SSH_ERR_NO_BUFFER_SPACE);
+        ASSERT_INT_EQ(sshbuf_poke(p1, 10, "hello!", 6),
+            SSH_ERR_NO_BUFFER_SPACE);
+        ASSERT_INT_EQ(sshbuf_poke(p1, 1000, "hello!", 6),
+            SSH_ERR_NO_BUFFER_SPACE);
+        /* ensure failed pokes do not modify buffer */
+        s2 = sshbuf_dtob16(p1);
+        ASSERT_PTR_NE(s2, NULL);
+        ASSERT_STRING_EQ(s2, "00000000000000000000");
+        sshbuf_free(p1);
+        TEST_DONE();
 }
diff --git a/regress/unittests/sshbuf/test_sshbuf_getput_crypto.c b/regress/unittests/sshbuf/test_sshbuf_getput_crypto.c
index 5d39e63e1..492b3bdf0 100644
--- a/regress/unittests/sshbuf/test_sshbuf_getput_crypto.c
+++ b/regress/unittests/sshbuf/test_sshbuf_getput_crypto.c
@@ -7,6 +7,8 @@
 
 #include "includes.h"
 
+#ifdef WITH_OPENSSL
+
 #include <sys/types.h>
 #include <sys/param.h>
 #include <stdio.h>
@@ -276,3 +278,4 @@ sshbuf_getput_crypto_tests(void)
 #endif
 }
 
+#endif /* WITH_OPENSSL */
diff --git a/regress/unittests/sshbuf/test_sshbuf_getput_fuzz.c b/regress/unittests/sshbuf/test_sshbuf_getput_fuzz.c
index ca06bfb00..1ca30be97 100644
--- a/regress/unittests/sshbuf/test_sshbuf_getput_fuzz.c
+++ b/regress/unittests/sshbuf/test_sshbuf_getput_fuzz.c
@@ -32,10 +32,12 @@ static void
 attempt_parse_blob(u_char *blob, size_t len)
 {
         struct sshbuf *p1;
+#ifdef WITH_OPENSSL
         BIGNUM *bn;
 #if defined(OPENSSL_HAS_ECC) && defined(OPENSSL_HAS_NISTP256)
         EC_KEY *eck;
-#endif
+#endif /* defined(OPENSSL_HAS_ECC) && defined(OPENSSL_HAS_NISTP256) */
+#endif /* WITH_OPENSSL */
         u_char *s;
         size_t l;
         u_int8_t u8;
@@ -54,6 +56,7 @@ attempt_parse_blob(u_char *blob, size_t len)
                 bzero(s, l);
                 free(s);
         }
+#ifdef WITH_OPENSSL
         bn = NULL;
         sshbuf_get_bignum2(p1, &bn);
         BN_clear_free(bn);
@@ -62,7 +65,8 @@ attempt_parse_blob(u_char *blob, size_t len)
         ASSERT_PTR_NE(eck, NULL);
         sshbuf_get_eckey(p1, eck);
         EC_KEY_free(eck);
-#endif
+#endif /* defined(OPENSSL_HAS_ECC) && defined(OPENSSL_HAS_NISTP256) */
+#endif /* WITH_OPENSSL */
         sshbuf_free(p1);
 }
 
diff --git a/regress/unittests/sshbuf/test_sshbuf_misc.c b/regress/unittests/sshbuf/test_sshbuf_misc.c
index 762a6c31c..c53db937f 100644
--- a/regress/unittests/sshbuf/test_sshbuf_misc.c
+++ b/regress/unittests/sshbuf/test_sshbuf_misc.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: test_sshbuf_misc.c,v 1.2 2016/05/03 13:48:33 djm Exp $ */
+/*      $OpenBSD: test_sshbuf_misc.c,v 1.4 2019/07/16 22:16:49 djm Exp $ */
 /*
  * Regress test for sshbuf.h buffer API
  *
@@ -19,6 +19,7 @@
 #include "../test_helper/test_helper.h"
 
 #include "sshbuf.h"
+#include "ssherr.h"
 
 void sshbuf_misc_tests(void);
 
@@ -26,7 +27,7 @@ void
 sshbuf_misc_tests(void)
 {
         struct sshbuf *p1;
-        char tmp[512], *p;
+        char tmp[512], msg[] = "imploring ping silence ping over", *p;
         FILE *out;
         size_t sz;
 
@@ -60,48 +61,48 @@ sshbuf_misc_tests(void)
         sshbuf_free(p1);
         TEST_DONE();
 
-        TEST_START("sshbuf_dtob64 len 1");
+        TEST_START("sshbuf_dtob64_string len 1");
         p1 = sshbuf_new();
         ASSERT_PTR_NE(p1, NULL);
         ASSERT_INT_EQ(sshbuf_put_u8(p1, 0x11), 0);
-        p = sshbuf_dtob64(p1);
+        p = sshbuf_dtob64_string(p1, 0);
         ASSERT_PTR_NE(p, NULL);
         ASSERT_STRING_EQ(p, "EQ==");
         free(p);
         sshbuf_free(p1);
         TEST_DONE();
 
-        TEST_START("sshbuf_dtob64 len 2");
+        TEST_START("sshbuf_dtob64_string len 2");
         p1 = sshbuf_new();
         ASSERT_PTR_NE(p1, NULL);
         ASSERT_INT_EQ(sshbuf_put_u8(p1, 0x11), 0);
         ASSERT_INT_EQ(sshbuf_put_u8(p1, 0x22), 0);
-        p = sshbuf_dtob64(p1);
+        p = sshbuf_dtob64_string(p1, 0);
         ASSERT_PTR_NE(p, NULL);
         ASSERT_STRING_EQ(p, "ESI=");
         free(p);
         sshbuf_free(p1);
         TEST_DONE();
 
-        TEST_START("sshbuf_dtob64 len 3");
+        TEST_START("sshbuf_dtob64_string len 3");
         p1 = sshbuf_new();
         ASSERT_PTR_NE(p1, NULL);
         ASSERT_INT_EQ(sshbuf_put_u8(p1, 0x11), 0);
         ASSERT_INT_EQ(sshbuf_put_u8(p1, 0x22), 0);
         ASSERT_INT_EQ(sshbuf_put_u8(p1, 0x33), 0);
-        p = sshbuf_dtob64(p1);
+        p = sshbuf_dtob64_string(p1, 0);
         ASSERT_PTR_NE(p, NULL);
         ASSERT_STRING_EQ(p, "ESIz");
         free(p);
         sshbuf_free(p1);
         TEST_DONE();
 
-        TEST_START("sshbuf_dtob64 len 8191");
+        TEST_START("sshbuf_dtob64_string len 8191");
         p1 = sshbuf_new();
         ASSERT_PTR_NE(p1, NULL);
         ASSERT_INT_EQ(sshbuf_reserve(p1, 8192, NULL), 0);
         bzero(sshbuf_mutable_ptr(p1), 8192);
-        p = sshbuf_dtob64(p1);
+        p = sshbuf_dtob64_string(p1, 0);
         ASSERT_PTR_NE(p, NULL);
         ASSERT_SIZE_T_EQ(strlen(p), ((8191 + 2) / 3) * 4);
         free(p);
@@ -163,5 +164,55 @@ sshbuf_misc_tests(void)
         ASSERT_PTR_EQ(p, NULL);
         sshbuf_free(p1);
         TEST_DONE();
+
+        TEST_START("sshbuf_cmp");
+        p1 = sshbuf_from(msg, sizeof(msg) - 1);
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_cmp(p1, 0, "i", 1), 0);
+        ASSERT_INT_EQ(sshbuf_cmp(p1, 0, "j", 1), SSH_ERR_INVALID_FORMAT);
+        ASSERT_INT_EQ(sshbuf_cmp(p1, 0, "imploring", 9), 0);
+        ASSERT_INT_EQ(sshbuf_cmp(p1, 0, "implored", 9), SSH_ERR_INVALID_FORMAT);
+        ASSERT_INT_EQ(sshbuf_cmp(p1, 10, "ping", 4), 0);
+        ASSERT_INT_EQ(sshbuf_cmp(p1, 10, "ring", 4), SSH_ERR_INVALID_FORMAT);
+        ASSERT_INT_EQ(sshbuf_cmp(p1, 28, "over", 4), 0);
+        ASSERT_INT_EQ(sshbuf_cmp(p1, 28, "rove", 4), SSH_ERR_INVALID_FORMAT);
+        ASSERT_INT_EQ(sshbuf_cmp(p1, 28, "overt", 5),
+            SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_INT_EQ(sshbuf_cmp(p1, 32, "ping", 4),
+            SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_INT_EQ(sshbuf_cmp(p1, 1000, "silence", 7),
+            SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_INT_EQ(sshbuf_cmp(p1, 0, msg, sizeof(msg) - 1), 0);
+        TEST_DONE();
+
+        TEST_START("sshbuf_find");
+        p1 = sshbuf_from(msg, sizeof(msg) - 1);
+        ASSERT_PTR_NE(p1, NULL);
+        ASSERT_INT_EQ(sshbuf_find(p1, 0, "i", 1, &sz), 0);
+        ASSERT_SIZE_T_EQ(sz, 0);
+        ASSERT_INT_EQ(sshbuf_find(p1, 0, "j", 1, &sz), SSH_ERR_INVALID_FORMAT);
+        ASSERT_INT_EQ(sshbuf_find(p1, 0, "imploring", 9, &sz), 0);
+        ASSERT_SIZE_T_EQ(sz, 0);
+        ASSERT_INT_EQ(sshbuf_find(p1, 0, "implored", 9, &sz),
+            SSH_ERR_INVALID_FORMAT);
+        ASSERT_INT_EQ(sshbuf_find(p1, 3, "ping", 4, &sz), 0);
+        ASSERT_SIZE_T_EQ(sz, 10);
+        ASSERT_INT_EQ(sshbuf_find(p1, 11, "ping", 4, &sz), 0);
+        ASSERT_SIZE_T_EQ(sz, 23);
+        ASSERT_INT_EQ(sshbuf_find(p1, 20, "over", 4, &sz), 0);
+        ASSERT_SIZE_T_EQ(sz, 28);
+        ASSERT_INT_EQ(sshbuf_find(p1, 28, "over", 4, &sz), 0);
+        ASSERT_SIZE_T_EQ(sz, 28);
+        ASSERT_INT_EQ(sshbuf_find(p1, 28, "rove", 4, &sz),
+            SSH_ERR_INVALID_FORMAT);
+        ASSERT_INT_EQ(sshbuf_find(p1, 28, "overt", 5, &sz),
+            SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_INT_EQ(sshbuf_find(p1, 32, "ping", 4, &sz),
+            SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_INT_EQ(sshbuf_find(p1, 1000, "silence", 7, &sz),
+            SSH_ERR_MESSAGE_INCOMPLETE);
+        ASSERT_INT_EQ(sshbuf_find(p1, 0, msg + 1, sizeof(msg) - 2, &sz), 0);
+        ASSERT_SIZE_T_EQ(sz, 1);
+        TEST_DONE();
 }
 
diff --git a/regress/unittests/sshbuf/tests.c b/regress/unittests/sshbuf/tests.c
index 1557e4342..29916a10b 100644
--- a/regress/unittests/sshbuf/tests.c
+++ b/regress/unittests/sshbuf/tests.c
@@ -20,7 +20,9 @@ tests(void)
 {
         sshbuf_tests();
         sshbuf_getput_basic_tests();
+#ifdef WITH_OPENSSL
         sshbuf_getput_crypto_tests();
+#endif
         sshbuf_misc_tests();
         sshbuf_fuzz_tests();
         sshbuf_getput_fuzz_tests();
diff --git a/regress/unittests/sshkey/common.c b/regress/unittests/sshkey/common.c
index e63465c47..e21638093 100644
--- a/regress/unittests/sshkey/common.c
+++ b/regress/unittests/sshkey/common.c
@@ -19,13 +19,15 @@
 #include <string.h>
 #include <unistd.h>
 
+#ifdef WITH_OPENSSL
 #include <openssl/bn.h>
 #include <openssl/rsa.h>
 #include <openssl/dsa.h>
 #include <openssl/objects.h>
 #ifdef OPENSSL_HAS_NISTP256
 # include <openssl/ec.h>
-#endif
+#endif /* OPENSSL_HAS_NISTP256 */
+#endif /* WITH_OPENSSL */
 
 #include "openbsd-compat/openssl-compat.h"
 
@@ -72,6 +74,7 @@ load_text_file(const char *name)
         return ret;
 }
 
+#ifdef WITH_OPENSSL
 BIGNUM *
 load_bignum(const char *name)
 {
@@ -160,4 +163,5 @@ dsa_priv_key(struct sshkey *k)
         DSA_get0_key(k->dsa, NULL, &priv_key);
         return priv_key;
 }
+#endif /* WITH_OPENSSL */
 
diff --git a/regress/unittests/sshkey/test_file.c b/regress/unittests/sshkey/test_file.c
index 65610dacc..55627bc12 100644
--- a/regress/unittests/sshkey/test_file.c
+++ b/regress/unittests/sshkey/test_file.c
@@ -19,13 +19,15 @@
 #include <string.h>
 #include <unistd.h>
 
+#ifdef WITH_OPENSSL
 #include <openssl/bn.h>
 #include <openssl/rsa.h>
 #include <openssl/dsa.h>
 #include <openssl/objects.h>
 #ifdef OPENSSL_HAS_NISTP256
 # include <openssl/ec.h>
-#endif
+#endif /* OPENSSL_HAS_NISTP256 */
+#endif /* WITH_OPENSSL */
 
 #include "../test_helper/test_helper.h"
 
@@ -44,7 +46,9 @@ sshkey_file_tests(void)
 {
         struct sshkey *k1, *k2;
         struct sshbuf *buf, *pw;
+#ifdef WITH_OPENSSL
         BIGNUM *a, *b, *c;
+#endif
         char *cp;
 
         TEST_START("load passphrase");
@@ -52,6 +56,7 @@ sshkey_file_tests(void)
         TEST_DONE();
 
 
+#ifdef WITH_OPENSSL
         TEST_START("parse RSA from private");
         buf = load_file("rsa_1");
         ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
@@ -350,6 +355,7 @@ sshkey_file_tests(void)
 
         sshkey_free(k1);
 #endif /* OPENSSL_HAS_ECC */
+#endif /* WITH_OPENSSL */
 
         TEST_START("parse Ed25519 from private");
         buf = load_file("ed25519_1");
diff --git a/regress/unittests/sshkey/test_fuzz.c b/regress/unittests/sshkey/test_fuzz.c
index 5953de595..1323f8997 100644
--- a/regress/unittests/sshkey/test_fuzz.c
+++ b/regress/unittests/sshkey/test_fuzz.c
@@ -113,7 +113,7 @@ sshkey_fuzz_tests(void)
         struct fuzz *fuzz;
         int r, i;
 
-
+#ifdef WITH_OPENSSL
         TEST_START("fuzz RSA private");
         buf = load_file("rsa_1");
         fuzz = fuzz_begin(FUZZ_BASE64, sshbuf_mutable_ptr(buf),
@@ -246,7 +246,8 @@ sshkey_fuzz_tests(void)
         sshbuf_free(fuzzed);
         fuzz_cleanup(fuzz);
         TEST_DONE();
-#endif
+#endif /* OPENSSL_HAS_ECC */
+#endif /* WITH_OPENSSL */
 
         TEST_START("fuzz Ed25519 private");
         buf = load_file("ed25519_1");
@@ -270,6 +271,7 @@ sshkey_fuzz_tests(void)
         fuzz_cleanup(fuzz);
         TEST_DONE();
 
+#ifdef WITH_OPENSSL
         TEST_START("fuzz RSA public");
         buf = load_file("rsa_1");
         ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
@@ -312,7 +314,8 @@ sshkey_fuzz_tests(void)
         public_fuzz(k1);
         sshkey_free(k1);
         TEST_DONE();
-#endif
+#endif /* OPENSSL_HAS_ECC */
+#endif /* WITH_OPENSSL */
 
         TEST_START("fuzz Ed25519 public");
         buf = load_file("ed25519_1");
@@ -328,6 +331,7 @@ sshkey_fuzz_tests(void)
         sshkey_free(k1);
         TEST_DONE();
 
+#ifdef WITH_OPENSSL
         TEST_START("fuzz RSA sig");
         buf = load_file("rsa_1");
         ASSERT_INT_EQ(sshkey_parse_private_fileblob(buf, "", &k1, NULL), 0);
@@ -368,7 +372,8 @@ sshkey_fuzz_tests(void)
         sig_fuzz(k1, NULL);
         sshkey_free(k1);
         TEST_DONE();
-#endif
+#endif /* OPENSSL_HAS_ECC */
+#endif /* WITH_OPENSSL */
 
         TEST_START("fuzz Ed25519 sig");
         buf = load_file("ed25519_1");
@@ -379,5 +384,6 @@ sshkey_fuzz_tests(void)
         TEST_DONE();
 
 /* XXX fuzz decoded new-format blobs too */
+/* XXX fuzz XMSS too */
 
 }
diff --git a/regress/unittests/sshkey/test_sshkey.c b/regress/unittests/sshkey/test_sshkey.c
index 47a03fad4..42395b8db 100644
--- a/regress/unittests/sshkey/test_sshkey.c
+++ b/regress/unittests/sshkey/test_sshkey.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: test_sshkey.c,v 1.17 2018/09/13 09:03:20 djm Exp $ */
+/*      $OpenBSD: test_sshkey.c,v 1.18 2019/06/21 04:21:45 djm Exp $ */
 /*
  * Regress test for sshkey.h key management API
  *
@@ -50,9 +50,10 @@ put_opt(struct sshbuf *b, const char *name, const char *value)
         sshbuf_free(sect);
 }
 
+#ifdef WITH_OPENSSL
 static void
-build_cert(struct sshbuf *b, const struct sshkey *k, const char *type,
-    const struct sshkey *sign_key, const struct sshkey *ca_key,
+build_cert(struct sshbuf *b, struct sshkey *k, const char *type,
+    struct sshkey *sign_key, struct sshkey *ca_key,
     const char *sig_alg)
 {
         struct sshbuf *ca_buf, *pk, *principals, *critopts, *exts;
@@ -110,6 +111,7 @@ build_cert(struct sshbuf *b, const struct sshkey *k, const char *type,
         sshbuf_free(principals);
         sshbuf_free(pk);
 }
+#endif /* WITH_OPENSSL */
 
 static void
 signature_test(struct sshkey *k, struct sshkey *bad, const char *sig_alg,
@@ -176,10 +178,13 @@ get_private(const char *n)
 void
 sshkey_tests(void)
 {
-        struct sshkey *k1, *k2, *k3, *k4, *kr, *kd, *kf;
+        struct sshkey *k1, *k2, *k3, *kf;
+#ifdef WITH_OPENSSL
+        struct sshkey *k4, *kr, *kd;
 #ifdef OPENSSL_HAS_ECC
         struct sshkey *ke;
-#endif
+#endif /* OPENSSL_HAS_ECC */
+#endif /* WITH_OPENSSL */
         struct sshbuf *b;
 
         TEST_START("new invalid");
@@ -193,6 +198,7 @@ sshkey_tests(void)
         sshkey_free(k1);
         TEST_DONE();
 
+#ifdef WITH_OPENSSL
         TEST_START("new/free KEY_RSA");
         k1 = sshkey_new(KEY_RSA);
         ASSERT_PTR_NE(k1, NULL);
@@ -281,7 +287,8 @@ sshkey_tests(void)
         ASSERT_PTR_NE(EC_KEY_get0_public_key(ke->ecdsa), NULL);
         ASSERT_PTR_NE(EC_KEY_get0_private_key(ke->ecdsa), NULL);
         TEST_DONE();
-#endif
+#endif /* OPENSSL_HAS_ECC */
+#endif /* WITH_OPENSSL */
 
         TEST_START("generate KEY_ED25519");
         ASSERT_INT_EQ(sshkey_generate(KEY_ED25519, 256, &kf), 0);
@@ -291,6 +298,7 @@ sshkey_tests(void)
         ASSERT_PTR_NE(kf->ed25519_sk, NULL);
         TEST_DONE();
 
+#ifdef WITH_OPENSSL
         TEST_START("demote KEY_RSA");
         ASSERT_INT_EQ(sshkey_from_private(kr, &k1), 0);
         ASSERT_PTR_NE(k1, NULL);
@@ -338,7 +346,8 @@ sshkey_tests(void)
         ASSERT_INT_EQ(sshkey_equal(ke, k1), 1);
         sshkey_free(k1);
         TEST_DONE();
-#endif
+#endif /* OPENSSL_HAS_ECC */
+#endif /* WITH_OPENSSL */
 
         TEST_START("demote KEY_ED25519");
         ASSERT_INT_EQ(sshkey_from_private(kf, &k1), 0);
@@ -354,17 +363,20 @@ sshkey_tests(void)
         sshkey_free(k1);
         TEST_DONE();
 
+#ifdef WITH_OPENSSL
         TEST_START("equal mismatched key types");
         ASSERT_INT_EQ(sshkey_equal(kd, kr), 0);
 #ifdef OPENSSL_HAS_ECC
         ASSERT_INT_EQ(sshkey_equal(kd, ke), 0);
         ASSERT_INT_EQ(sshkey_equal(kr, ke), 0);
         ASSERT_INT_EQ(sshkey_equal(ke, kf), 0);
-#endif
+#endif /* OPENSSL_HAS_ECC */
         ASSERT_INT_EQ(sshkey_equal(kd, kf), 0);
         TEST_DONE();
+#endif /* WITH_OPENSSL */
 
         TEST_START("equal different keys");
+#ifdef WITH_OPENSSL
         ASSERT_INT_EQ(sshkey_generate(KEY_RSA, 1024, &k1), 0);
         ASSERT_INT_EQ(sshkey_equal(kr, k1), 0);
         sshkey_free(k1);
@@ -375,17 +387,20 @@ sshkey_tests(void)
         ASSERT_INT_EQ(sshkey_generate(KEY_ECDSA, 256, &k1), 0);
         ASSERT_INT_EQ(sshkey_equal(ke, k1), 0);
         sshkey_free(k1);
-#endif
+#endif /* OPENSSL_HAS_ECC */
+#endif /* WITH_OPENSSL */
         ASSERT_INT_EQ(sshkey_generate(KEY_ED25519, 256, &k1), 0);
         ASSERT_INT_EQ(sshkey_equal(kf, k1), 0);
         sshkey_free(k1);
         TEST_DONE();
 
+#ifdef WITH_OPENSSL
         sshkey_free(kr);
         sshkey_free(kd);
 #ifdef OPENSSL_HAS_ECC
         sshkey_free(ke);
-#endif
+#endif /* OPENSSL_HAS_ECC */
+#endif /* WITH_OPENSSL */
         sshkey_free(kf);
 
         TEST_START("certify key");
@@ -434,6 +449,7 @@ sshkey_tests(void)
         sshbuf_reset(b);
         TEST_DONE();
 
+#ifdef WITH_OPENSSL
         TEST_START("sign and verify RSA");
         k1 = get_private("rsa_1");
         ASSERT_INT_EQ(sshkey_load_public(test_data_file("rsa_2.pub"), &k2,
@@ -479,7 +495,8 @@ sshkey_tests(void)
         sshkey_free(k1);
         sshkey_free(k2);
         TEST_DONE();
-#endif
+#endif /* OPENSSL_HAS_ECC */
+#endif /* WITH_OPENSSL */
 
         TEST_START("sign and verify ED25519");
         k1 = get_private("ed25519_1");
@@ -490,6 +507,7 @@ sshkey_tests(void)
         sshkey_free(k2);
         TEST_DONE();
 
+#ifdef WITH_OPENSSL
         TEST_START("nested certificate");
         ASSERT_INT_EQ(sshkey_load_cert(test_data_file("rsa_1"), &k1), 0);
         ASSERT_INT_EQ(sshkey_load_public(test_data_file("rsa_1.pub"), &k2,
@@ -504,5 +522,5 @@ sshkey_tests(void)
         sshkey_free(k3);
         sshbuf_free(b);
         TEST_DONE();
-
+#endif /* WITH_OPENSSL */
 }
diff --git a/regress/unittests/sshkey/testdata/ed25519_1_pw b/regress/unittests/sshkey/testdata/ed25519_1_pw
index c3b7ae7f8..da94d2b8e 100644
--- a/regress/unittests/sshkey/testdata/ed25519_1_pw
+++ b/regress/unittests/sshkey/testdata/ed25519_1_pw
@@ -1,8 +1,8 @@
 -----BEGIN OPENSSH PRIVATE KEY-----
-b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jYmMAAAAGYmNyeXB0AAAAGAAAABCus+kaow
-AUjHphacvRp98dAAAAEAAAAAEAAAAzAAAAC3NzaC1lZDI1NTE5AAAAIFOG6kY7Rf4UtCFv
-PwKgo/BztXck2xC4a2WyA34XtIwZAAAAoJaqqgiYQuElraJAmYOm7Tb4nJ3eI4oj9mQ52M
-/Yd+ION2Ur1v8BDewpDX+LHEYgKHo3Mlmcn2UyF+QJ+7xUCW7QCtk/4szrJzw74DlEl6mH
-T8PT/f/av7PpECBD/YD3NoDlB9OWm/Q4sHcxfBEKfTGD7s2Onn71HgrdEOPqd4Sj/IQigR
-drfjtXEMlD32k9n3dd2eS9x7AHWYaGFEMkOcY=
+b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABDKT56mBA
+tXIMsWqmuuA2gdAAAAEAAAAAEAAAAzAAAAC3NzaC1lZDI1NTE5AAAAIFOG6kY7Rf4UtCFv
+PwKgo/BztXck2xC4a2WyA34XtIwZAAAAoC13U47yfUOSZJePNUAwWXuFOk3aOKwPM5PMvK
+0zwRnMZZjgn+tsMAYPwhsT3Mx3h5QzvVGFyFEqsiK7j4vAotD+LVQeBN5TwWbUBx4lnoGs
+3iAfYVDakO/gNvVBDDGOqv5kdCc4cgn5HacjHQLKOAx6KzHe7JFn7uCywMdVVQjlpI6LHb
+mHkaKiVX/C2oiRnsoe17HZ8Fxyt3vd1qNM8BE=
 -----END OPENSSH PRIVATE KEY-----
diff --git a/regress/unittests/test_helper/test_helper.c b/regress/unittests/test_helper/test_helper.c
index e7a47b265..9014ce8e4 100644
--- a/regress/unittests/test_helper/test_helper.c
+++ b/regress/unittests/test_helper/test_helper.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: test_helper.c,v 1.11 2018/11/23 02:53:57 dtucker Exp $        */
+/*      $OpenBSD: test_helper.c,v 1.12 2019/08/02 01:41:24 djm Exp $    */
 /*
  * Copyright (c) 2011 Damien Miller <djm@mindrot.org>
  *
@@ -23,6 +23,7 @@
 #include <sys/param.h>
 #include <sys/uio.h>
 
+#include <stdarg.h>
 #include <fcntl.h>
 #include <stdio.h>
 #ifdef HAVE_STDINT_H
@@ -34,8 +35,10 @@
 #include <unistd.h>
 #include <signal.h>
 
+#ifdef WITH_OPENSSL
 #include <openssl/bn.h>
 #include <openssl/err.h>
+#endif
 
 #if defined(HAVE_STRNVIS) && defined(HAVE_VIS_H) && !defined(BROKEN_STRNVIS)
 # include <vis.h>
@@ -126,7 +129,9 @@ main(int argc, char **argv)
         int ch;
 
         seed_rng();
+#ifdef WITH_OPENSSL
         ERR_load_CRYPTO_strings();
+#endif
 
         /* Handle systems without __progname */
         if (__progname == NULL) {
@@ -287,6 +292,7 @@ test_subtest_info(const char *fmt, ...)
 void
 ssl_err_check(const char *file, int line)
 {
+#ifdef WITH_OPENSSL
         long openssl_error = ERR_get_error();
 
         if (openssl_error == 0)
@@ -294,6 +300,10 @@ ssl_err_check(const char *file, int line)
 
         fprintf(stderr, "\n%s:%d: uncaught OpenSSL error: %s",
             file, line, ERR_error_string(openssl_error, NULL));
+#else /* WITH_OPENSSL */
+        fprintf(stderr, "\n%s:%d: uncaught OpenSSL error ",
+            file, line);
+#endif /* WITH_OPENSSL */
         abort();
 }
 
@@ -338,6 +348,7 @@ test_header(const char *file, int line, const char *a1, const char *a2,
             a2 != NULL ? ", " : "", a2 != NULL ? a2 : "");
 }
 
+#ifdef WITH_OPENSSL
 void
 assert_bignum(const char *file, int line, const char *a1, const char *a2,
     const BIGNUM *aa1, const BIGNUM *aa2, enum test_predicate pred)
@@ -350,6 +361,7 @@ assert_bignum(const char *file, int line, const char *a1, const char *a2,
         fprintf(stderr, "%12s = 0x%s\n", a2, BN_bn2hex(aa2));
         test_die();
 }
+#endif
 
 void
 assert_string(const char *file, int line, const char *a1, const char *a2,
@@ -391,6 +403,8 @@ assert_mem(const char *file, int line, const char *a1, const char *a2,
     const void *aa1, const void *aa2, size_t l, enum test_predicate pred)
 {
         int r;
+        char *aa1_tohex = NULL;
+        char *aa2_tohex = NULL;
 
         if (l == 0)
                 return;
@@ -401,8 +415,12 @@ assert_mem(const char *file, int line, const char *a1, const char *a2,
         r = memcmp(aa1, aa2, l);
         TEST_CHECK_INT(r, pred);
         test_header(file, line, a1, a2, "STRING", pred);
-        fprintf(stderr, "%12s = %s (len %zu)\n", a1, tohex(aa1, MIN(l, 256)), l);
-        fprintf(stderr, "%12s = %s (len %zu)\n", a2, tohex(aa2, MIN(l, 256)), l);
+        aa1_tohex = tohex(aa1, MIN(l, 256));
+        aa2_tohex = tohex(aa2, MIN(l, 256));
+        fprintf(stderr, "%12s = %s (len %zu)\n", a1, aa1_tohex, l);
+        fprintf(stderr, "%12s = %s (len %zu)\n", a2, aa2_tohex, l);
+        free(aa1_tohex);
+        free(aa2_tohex);
         test_die();
 }
 
@@ -427,6 +445,7 @@ assert_mem_filled(const char *file, int line, const char *a1,
         size_t where = -1;
         int r;
         char tmp[64];
+        char *aa1_tohex = NULL;
 
         if (l == 0)
                 return;
@@ -436,8 +455,10 @@ assert_mem_filled(const char *file, int line, const char *a1,
         r = memvalcmp(aa1, v, l, &where);
         TEST_CHECK_INT(r, pred);
         test_header(file, line, a1, NULL, "MEM_ZERO", pred);
+        aa1_tohex = tohex(aa1, MIN(l, 20));
         fprintf(stderr, "%20s = %s%s (len %zu)\n", a1,
-            tohex(aa1, MIN(l, 20)), l > 20 ? "..." : "", l);
+            aa1_tohex, l > 20 ? "..." : "", l);
+        free(aa1_tohex);
         snprintf(tmp, sizeof(tmp), "(%s)[%zu]", a1, where);
         fprintf(stderr, "%20s = 0x%02x (expected 0x%02x)\n", tmp,
             ((u_char *)aa1)[where], v);
diff --git a/regress/unittests/test_helper/test_helper.h b/regress/unittests/test_helper/test_helper.h
index 1f893c8dd..66302201c 100644
--- a/regress/unittests/test_helper/test_helper.h
+++ b/regress/unittests/test_helper/test_helper.h
@@ -27,8 +27,10 @@
 # include <stdint.h>
 #endif
 
+#ifdef WITH_OPENSSL
 #include <openssl/bn.h>
 #include <openssl/err.h>
+#endif
 
 enum test_predicate {
         TEST_EQ, TEST_NE, TEST_LT, TEST_LE, TEST_GT, TEST_GE
@@ -50,9 +52,11 @@ int test_is_slow(void);
 void test_subtest_info(const char *fmt, ...)
     __attribute__((format(printf, 1, 2)));
 void ssl_err_check(const char *file, int line);
+#ifdef WITH_OPENSSL
 void assert_bignum(const char *file, int line,
     const char *a1, const char *a2,
     const BIGNUM *aa1, const BIGNUM *aa2, enum test_predicate pred);
+#endif
 void assert_string(const char *file, int line,
     const char *a1, const char *a2,
     const char *aa1, const char *aa2, enum test_predicate pred);
diff --git a/regress/unittests/utf8/tests.c b/regress/unittests/utf8/tests.c
index f0bbca509..8cf524ddb 100644
--- a/regress/unittests/utf8/tests.c
+++ b/regress/unittests/utf8/tests.c
@@ -9,7 +9,9 @@
 #include "includes.h"
 
 #include <locale.h>
+#include <stdarg.h>
 #include <string.h>
+#include <stdio.h>
 
 #include "../test_helper/test_helper.h"