import openssh-5.1p1-gsskex-cjwatson-20080722.patch

18 files changed, 516 insertions, 64 deletions

diff --git a/regress/Makefile b/regress/Makefile
index 539956398..3b8ea245b 100644
--- a/regress/Makefile
+++ b/regress/Makefile
@@ -1,10 +1,15 @@
-#       $OpenBSD: Makefile,v 1.42 2006/07/19 13:34:52 dtucker Exp $
+#       $OpenBSD: Makefile,v 1.48 2008/06/28 13:57:25 djm Exp $
 
 REGRESS_TARGETS=        t1 t2 t3 t4 t5 t6 t7 t-exec
 tests:          $(REGRESS_TARGETS)
 
+# Interop tests are not run by default
+interop interop-tests: t-exec-interop
+
 clean:
         for F in $(CLEANFILES); do rm -f $(OBJ)$$F; done
+        rm -rf $(OBJ).putty
+
 distclean:      clean
 
 LTESTS=         connect \
@@ -29,6 +34,7 @@ LTESTS= 	connect \
                 agent-ptrace \
                 keyscan \
                 keygen-change \
+                key-options \
                 scp \
                 sftp \
                 sftp-cmds \
@@ -42,8 +48,13 @@ LTESTS= 	connect \
                 reexec \
                 brokenkeys \
                 cfgmatch \
+                addrmatch \
+                localcommand \
                 forcecommand
 
+INTEROP_TESTS=  putty-transfer putty-ciphers putty-kex conch-ciphers
+#INTEROP_TESTS+=ssh-com ssh-com-client ssh-com-keygen ssh-com-sftp
+
 USER!=          id -un
 CLEANFILES=     t2.out t6.out1 t6.out2 t7.out t7.out.pub copy.1 copy.2 \
                 authorized_keys_${USER} known_hosts pidfile \
@@ -52,9 +63,8 @@ CLEANFILES=	t2.out t6.out1 t6.out2 t7.out t7.out.pub copy.1 copy.2 \
                 rsa-agent rsa-agent.pub rsa1-agent rsa1-agent.pub \
                 ls.copy banner.in banner.out empty.in \
                 scp-ssh-wrapper.scp ssh_proxy_envpass remote_pid \
-                sshd_proxy_bak rsa_ssh2_cr.prv rsa_ssh2_crnl.prv
-
-#LTESTS +=      ssh-com ssh-com-client ssh-com-keygen ssh-com-sftp
+                sshd_proxy_bak rsa_ssh2_cr.prv rsa_ssh2_crnl.prv \
+                putty.rsa2
 
 t1:
         ssh-keygen -if ${.CURDIR}/rsa_ssh2.prv | diff - ${.CURDIR}/rsa_openssh.prv
@@ -96,3 +106,11 @@ t-exec:	${LTESTS:=.sh}
                 echo "run test $${TEST}" ... 1>&2; \
                 (env SUDO=${SUDO} sh ${.CURDIR}/test-exec.sh ${.OBJDIR} ${.CURDIR}/$${TEST}) || exit $$?; \
         done
+
+t-exec-interop: ${INTEROP_TESTS:=.sh}
+        @if [ "x$?" = "x" ]; then exit 0; fi; \
+        for TEST in ""$?; do \
+                echo "run test $${TEST}" ... 1>&2; \
+                (env SUDO=${SUDO} sh ${.CURDIR}/test-exec.sh ${.OBJDIR} ${.CURDIR}/$${TEST}) || exit $$?; \
+        done
+
diff --git a/regress/addrmatch.sh b/regress/addrmatch.sh
new file mode 100644
index 000000000..a258f7bb4
--- /dev/null
+++ b/regress/addrmatch.sh
@@ -0,0 +1,42 @@
+#       $OpenBSD: addrmatch.sh,v 1.1 2008/06/10 05:23:32 dtucker Exp $
+#       Placed in the Public Domain.
+
+tid="address match"
+
+mv $OBJ/sshd_proxy $OBJ/sshd_proxy_orig
+
+run_trial()
+{
+        user="$1"; addr="$2"; host="$3"; expected="$4"; descr="$5"
+
+        verbose "test $descr for $user $addr $host"
+        result=`${SSHD} -f $OBJ/sshd_proxy -T \
+            -C user=${user},addr=${addr},host=${host} | \
+            awk '/passwordauthentication/ {print $2}'`
+        if [ "$result" != "$expected" ]; then
+                fail "failed for $user $addr $host: expected $expected, got $result"
+        fi
+}
+
+cp $OBJ/sshd_proxy_orig $OBJ/sshd_proxy
+cat >>$OBJ/sshd_proxy <<EOD
+PasswordAuthentication no
+Match Address 192.168.0.0/16,!192.168.30.0/24,10.0.0.0/8,host.example.com
+        PasswordAuthentication yes
+Match Address 1.1.1.1,::1,!::3,2000::/16
+        PasswordAuthentication yes
+EOD
+
+run_trial user 192.168.0.1 somehost yes         "permit, first entry"
+run_trial user 192.168.30.1 somehost no         "deny, negative match"
+run_trial user 19.0.0.1 somehost no             "deny, no match"
+run_trial user 10.255.255.254 somehost yes      "permit, list middle"
+run_trial user 192.168.30.1 192.168.0.1 no      "deny, faked IP in hostname"
+run_trial user 1.1.1.1 somehost.example.com yes "permit, bare IP4 address"
+test "$TEST_SSH_IPV6" = "no" && exit
+run_trial user ::1 somehost.example.com  yes    "permit, bare IP6 address"
+run_trial user ::2 somehost.exaple.com no       "deny IPv6"
+run_trial user ::3 somehost no                  "deny IP6 negated"
+run_trial user ::4 somehost no                  "deny, IP6 no match"
+run_trial user 2000::1 somehost yes             "permit, IP6 network"
+run_trial user 2001::1 somehost no              "deny, IP6 network"
diff --git a/regress/agent-getpeereid.sh b/regress/agent-getpeereid.sh
index d71324241..5d7f73291 100644
--- a/regress/agent-getpeereid.sh
+++ b/regress/agent-getpeereid.sh
@@ -1,11 +1,11 @@
-#       $OpenBSD: agent-getpeereid.sh,v 1.3 2006/07/06 12:01:53 grunk Exp $
+#       $OpenBSD: agent-getpeereid.sh,v 1.4 2007/11/25 15:35:09 jmc Exp $
 #       Placed in the Public Domain.
 
 tid="disallow agent attach from other uid"
 
 UNPRIV=nobody
 ASOCK=${OBJ}/agent
-SSH_AUTH_SOCK=/nonexistant
+SSH_AUTH_SOCK=/nonexistent
 
 if grep "#undef.*HAVE_GETPEEREID" ${BUILDDIR}/config.h >/dev/null 2>&1 && \
         grep "#undef.*HAVE_GETPEERUCRED" ${BUILDDIR}/config.h >/dev/null && \
diff --git a/regress/agent.sh b/regress/agent.sh
index b34487767..094cf694b 100644
--- a/regress/agent.sh
+++ b/regress/agent.sh
@@ -1,9 +1,9 @@
-#       $OpenBSD: agent.sh,v 1.6 2002/03/15 13:08:56 markus Exp $
+#       $OpenBSD: agent.sh,v 1.7 2007/11/25 15:35:09 jmc Exp $
 #       Placed in the Public Domain.
 
 tid="simple agent test"
 
-SSH_AUTH_SOCK=/nonexistant ${SSHADD} -l > /dev/null 2>&1
+SSH_AUTH_SOCK=/nonexistent ${SSHADD} -l > /dev/null 2>&1
 if [ $? -ne 2 ]; then
         fail "ssh-add -l did not fail with exit code 2"
 fi
diff --git a/regress/cfgmatch.sh b/regress/cfgmatch.sh
index d987dcb97..35c5e52a1 100644
--- a/regress/cfgmatch.sh
+++ b/regress/cfgmatch.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: cfgmatch.sh,v 1.2 2006/07/22 01:50:00 dtucker Exp $
+#       $OpenBSD: cfgmatch.sh,v 1.4 2006/12/13 08:36:36 dtucker Exp $
 #       Placed in the Public Domain.
 
 tid="sshd_config match"
@@ -35,7 +35,7 @@ for p in 1 2; do
         rm -f $pidfile
         trace "match permitopen localhost proto $p"
         ${SSH} -$p $fwd -F $OBJ/ssh_config -f somehost \
-            "echo \$\$ > $pidfile; exec sleep 100" >>$TEST_SSH_LOGFILE 2>&1 ||\
+            exec sh -c \'"echo \$\$ > $pidfile; exec sleep 100"\' >>$TEST_SSH_LOGFILE 2>&1 ||\
             fail "match permitopen proto $p sshd failed"
         sleep 1;
         ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true || \
@@ -48,7 +48,7 @@ for p in 1 2; do
         rm -f $pidfile
         trace "match permitopen proxy proto $p"
         ${SSH} -q -$p $fwd -F $OBJ/ssh_proxy -f somehost \
-            "echo \$\$ > $pidfile; exec sleep 100" >>$TEST_SSH_LOGFILE 2>&1 ||\
+            exec sh -c \'"echo \$\$ > $pidfile; exec sleep 100"\' >>$TEST_SSH_LOGFILE 2>&1 ||\
             fail "match permitopen proxy proto $p sshd failed"
         sleep 1;
         ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true && \
@@ -65,7 +65,7 @@ for p in 1 2; do
         rm -f $pidfile
         trace "match permitopen proxy w/key opts proto $p"
         ${SSH} -q -$p $fwd -F $OBJ/ssh_proxy -f somehost \
-            "echo \$\$ > $pidfile; exec sleep 100" >>$TEST_SSH_LOGFILE 2>&1 ||\
+            exec sh -c \'"echo \$\$ > $pidfile; exec sleep 100"\' >>$TEST_SSH_LOGFILE 2>&1 ||\
             fail "match permitopen w/key opt proto $p sshd failed"
         sleep 1;
         ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true && \
@@ -79,7 +79,7 @@ for p in 1 2; do
         rm -f $pidfile
         trace "match permitopen localhost proto $p"
         ${SSH} -$p $fwd -F $OBJ/ssh_config -f somehost \
-            "echo \$\$ > $pidfile; exec sleep 100" >>$TEST_SSH_LOGFILE 2>&1 ||\
+            exec sh -c \'"echo \$\$ > $pidfile; exec sleep 100"\' >>$TEST_SSH_LOGFILE 2>&1 ||\
             fail "match permitopen proto $p sshd failed"
         sleep 1;
         ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true || \
@@ -97,10 +97,29 @@ for p in 1 2; do
         rm -f $pidfile
         trace "match permitopen proxy w/key opts proto $p"
         ${SSH} -q -$p $fwd -F $OBJ/ssh_proxy -f somehost \
-            "echo \$\$ > $pidfile; exec sleep 100" >>$TEST_SSH_LOGFILE 2>&1 ||\
+            exec sh -c \'"echo \$\$ > $pidfile; exec sleep 100"\' >>$TEST_SSH_LOGFILE 2>&1 ||\
             fail "match override permitopen proto $p sshd failed"
         sleep 1;
         ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true && \
             fail "match override permitopen proto $p"
         stop_client
 done
+
+cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
+echo "PermitOpen 127.0.0.1:1 127.0.0.1:$PORT 127.0.0.2:2" >>$OBJ/sshd_proxy
+echo "Match User NoSuchUser" >>$OBJ/sshd_proxy
+echo "PermitOpen 127.0.0.1:1 127.0.0.1:2" >>$OBJ/sshd_proxy
+
+# Test that a rule that doesn't match doesn't override, plus test a
+# PermitOpen entry that's not at the start of the list
+for p in 1 2; do
+        rm -f $pidfile
+        trace "nomatch permitopen proxy w/key opts proto $p"
+        ${SSH} -q -$p $fwd -F $OBJ/ssh_proxy -f somehost \
+            exec sh -c \'"echo \$\$ > $pidfile; exec sleep 100"\' >>$TEST_SSH_LOGFILE 2>&1 ||\
+            fail "nomatch override permitopen proto $p sshd failed"
+        sleep 1;
+        ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true || \
+            fail "nomatch override permitopen proto $p"
+        stop_client
+done
diff --git a/regress/cipher-speed.sh b/regress/cipher-speed.sh
index 592511143..d39a829d4 100644
--- a/regress/cipher-speed.sh
+++ b/regress/cipher-speed.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: cipher-speed.sh,v 1.2 2005/05/24 04:09:54 djm Exp $
+#       $OpenBSD: cipher-speed.sh,v 1.3 2007/06/07 19:41:46 pvalchev Exp $
 #       Placed in the Public Domain.
 
 tid="cipher speed"
@@ -12,7 +12,7 @@ tries="1 2"
 DATA=/bin/ls
 DATA=/bsd
 
-macs="hmac-sha1 hmac-md5 hmac-sha1-96 hmac-md5-96"
+macs="hmac-sha1 hmac-md5 umac-64@openssh.com hmac-sha1-96 hmac-md5-96"
 ciphers="aes128-cbc 3des-cbc blowfish-cbc cast128-cbc 
         arcfour128 arcfour256 arcfour aes192-cbc aes256-cbc aes128-ctr"
 
diff --git a/regress/conch-ciphers.sh b/regress/conch-ciphers.sh
new file mode 100644
index 000000000..84b190618
--- /dev/null
+++ b/regress/conch-ciphers.sh
@@ -0,0 +1,30 @@
+#       $OpenBSD: conch-ciphers.sh,v 1.2 2008/06/30 10:43:03 djm Exp $
+#       Placed in the Public Domain.
+
+tid="conch ciphers"
+
+DATA=/bin/ls
+COPY=${OBJ}/copy
+
+if test "x$REGRESS_INTEROP_CONCH" != "xyes" ; then
+        fatal "conch interop tests not enabled"
+fi
+
+start_sshd
+
+for c in aes256-ctr aes256-cbc aes192-ctr aes192-cbc aes128-ctr aes128-cbc \
+         cast128-cbc blowfish 3des-cbc ; do
+        verbose "$tid: cipher $c"
+        rm -f ${COPY}
+        # XXX the 2nd "cat" seems to be needed because of buggy FD handling
+        # in conch
+        ${CONCH} --identity $OBJ/rsa --port $PORT --user $USER  -e none \
+            --known-hosts $OBJ/known_hosts --notty --noagent --nox11 -n \
+            127.0.0.1 "cat ${DATA}" 2>/dev/null | cat > ${COPY}
+        if [ $? -ne 0 ]; then
+                fail "ssh cat $DATA failed"
+        fi
+        cmp ${DATA} ${COPY}             || fail "corrupted copy"
+done
+rm -f ${COPY}
+
diff --git a/regress/key-options.sh b/regress/key-options.sh
new file mode 100644
index 000000000..f98d78b30
--- /dev/null
+++ b/regress/key-options.sh
@@ -0,0 +1,71 @@
+#       $OpenBSD: key-options.sh,v 1.2 2008/06/30 08:07:34 djm Exp $
+#       Placed in the Public Domain.
+
+tid="key options"
+
+origkeys="$OBJ/authkeys_orig"
+authkeys="$OBJ/authorized_keys_${USER}"
+cp $authkeys $origkeys
+
+# Test command= forced command
+for p in 1 2; do
+    for c in 'command="echo bar"' 'no-pty,command="echo bar"'; do
+        sed "s/.*/$c &/" $origkeys >$authkeys
+        verbose "key option proto $p $c"
+        r=`${SSH} -$p -q -F $OBJ/ssh_proxy somehost echo foo`
+        if [ "$r" = "foo" ]; then
+                fail "key option forced command not restricted"
+        fi
+        if [ "$r" != "bar" ]; then
+                fail "key option forced command not executed"
+        fi
+    done
+done
+
+# Test no-pty
+sed 's/.*/no-pty &/' $origkeys >$authkeys
+for p in 1 2; do
+        verbose "key option proto $p no-pty"
+        r=`${SSH} -$p -q -F $OBJ/ssh_proxy somehost tty`
+        if [ -f "$r" ]; then
+                fail "key option failed proto $p no-pty (pty $r)"
+        fi
+done
+
+# Test environment=
+echo 'PermitUserEnvironment yes' >> $OBJ/sshd_proxy
+sed 's/.*/environment="FOO=bar" &/' $origkeys >$authkeys
+for p in 1 2; do
+        verbose "key option proto $p environment"
+        r=`${SSH} -$p -q -F $OBJ/ssh_proxy somehost 'echo $FOO'`
+        if [ "$r" != "bar" ]; then
+                fail "key option environment not set"
+        fi
+done
+
+# Test from= restriction
+start_sshd
+for p in 1 2; do
+    for f in 127.0.0.1 '127.0.0.0\/8'; do
+        cat  $origkeys >$authkeys
+        ${SSH} -$p -q -F $OBJ/ssh_proxy somehost true
+        if [ $? -ne 0 ]; then
+                fail "key option proto $p failed without restriction"
+        fi
+
+        sed 's/.*/from="'"$f"'" &/' $origkeys >$authkeys
+        from=`head -1 $authkeys | cut -f1 -d ' '`
+        verbose "key option proto $p $from"
+        r=`${SSH} -$p -q -F $OBJ/ssh_proxy somehost 'echo true'`
+        if [ "$r" = "true" ]; then
+                fail "key option proto $p $from not restricted"
+        fi
+
+        r=`${SSH} -$p -q -F $OBJ/ssh_config somehost 'echo true'`
+        if [ "$r" != "true" ]; then
+                fail "key option proto $p $from not allowed but should be"
+        fi
+    done
+done
+
+rm -f "$origkeys"
diff --git a/regress/localcommand.sh b/regress/localcommand.sh
new file mode 100644
index 000000000..feade7a9d
--- /dev/null
+++ b/regress/localcommand.sh
@@ -0,0 +1,15 @@
+#       $OpenBSD: localcommand.sh,v 1.1 2007/10/29 06:57:13 dtucker Exp $
+#       Placed in the Public Domain.
+
+tid="localcommand"
+
+echo 'PermitLocalCommand yes' >> $OBJ/ssh_proxy
+echo 'LocalCommand echo foo' >> $OBJ/ssh_proxy
+
+for p in 1 2; do
+        verbose "test $tid: proto $p localcommand"
+        a=`${SSH} -F $OBJ/ssh_proxy -$p somehost true`
+        if [ "$a" != "foo" ] ; then
+                fail "$tid proto $p"
+        fi
+done
diff --git a/regress/putty-ciphers.sh b/regress/putty-ciphers.sh
new file mode 100644
index 000000000..40435ef41
--- /dev/null
+++ b/regress/putty-ciphers.sh
@@ -0,0 +1,28 @@
+#       $OpenBSD: putty-ciphers.sh,v 1.2 2008/06/30 10:31:11 djm Exp $
+#       Placed in the Public Domain.
+
+tid="putty ciphers"
+
+DATA=/bin/ls
+COPY=${OBJ}/copy
+
+if test "x$REGRESS_INTEROP_PUTTY" != "xyes" ; then
+        fatal "putty interop tests not enabled"
+fi
+
+for c in aes blowfish 3des arcfour ; do
+        verbose "$tid: cipher $c"
+        cp ${OBJ}/.putty/sessions/localhost_proxy \
+            ${OBJ}/.putty/sessions/cipher_$c
+        echo "Cipher=$c" >> ${OBJ}/.putty/sessions/cipher_$c
+
+        rm -f ${COPY}
+        env HOME=$PWD ${PLINK} -load cipher_$c -batch -i putty.rsa2 \
+            127.0.0.1 cat ${DATA} > ${COPY}
+        if [ $? -ne 0 ]; then
+                fail "ssh cat $DATA failed"
+        fi
+        cmp ${DATA} ${COPY}             || fail "corrupted copy"
+done
+rm -f ${COPY}
+
diff --git a/regress/putty-kex.sh b/regress/putty-kex.sh
new file mode 100644
index 000000000..2534b8575
--- /dev/null
+++ b/regress/putty-kex.sh
@@ -0,0 +1,25 @@
+#       $OpenBSD: putty-kex.sh,v 1.2 2008/06/30 10:31:11 djm Exp $
+#       Placed in the Public Domain.
+
+tid="putty KEX"
+
+DATA=/bin/ls
+COPY=${OBJ}/copy
+
+if test "x$REGRESS_INTEROP_PUTTY" != "xyes" ; then
+        fatal "putty interop tests not enabled"
+fi
+
+for k in dh-gex-sha1 dh-group1-sha1 dh-group14-sha1 ; do
+        verbose "$tid: kex $k"
+        cp ${OBJ}/.putty/sessions/localhost_proxy \
+            ${OBJ}/.putty/sessions/kex_$k
+        echo "KEX=$k" >> ${OBJ}/.putty/sessions/kex_$k
+
+        env HOME=$PWD ${PLINK} -load kex_$k -batch -i putty.rsa2 \
+            127.0.0.1 true
+        if [ $? -ne 0 ]; then
+                fail "KEX $k failed"
+        fi
+done
+
diff --git a/regress/putty-transfer.sh b/regress/putty-transfer.sh
new file mode 100644
index 000000000..6b21f3be7
--- /dev/null
+++ b/regress/putty-transfer.sh
@@ -0,0 +1,43 @@
+#       $OpenBSD: putty-transfer.sh,v 1.2 2008/06/30 10:31:11 djm Exp $
+#       Placed in the Public Domain.
+
+tid="putty transfer data"
+
+DATA=/bin/ls
+COPY=${OBJ}/copy
+
+if test "x$REGRESS_INTEROP_PUTTY" != "xyes" ; then
+        fatal "putty interop tests not enabled"
+fi
+
+# XXX support protocol 1 too
+for p in 2; do
+        for c in 0 1 ; do 
+        verbose "$tid: proto $p compression $c"
+                rm -f ${COPY}
+                cp ${OBJ}/.putty/sessions/localhost_proxy \
+                    ${OBJ}/.putty/sessions/compression_$c
+                echo "Compression=$c" >> ${OBJ}/.putty/sessions/kex_$k
+                env HOME=$PWD ${PLINK} -load compression_$c -batch \
+                    -i putty.rsa$p 127.0.0.1 cat ${DATA} > ${COPY}
+                if [ $? -ne 0 ]; then
+                        fail "ssh cat $DATA failed"
+                fi
+                cmp ${DATA} ${COPY}             || fail "corrupted copy"
+        
+                for s in 10 100 1k 32k 64k 128k 256k; do
+                        trace "proto $p compression $c dd-size ${s}"
+                        rm -f ${COPY}
+                        dd if=$DATA obs=${s} 2> /dev/null | \
+                                env HOME=$PWD ${PLINK} -load compression_$c \
+                                    -batch -i putty.rsa$p 127.0.0.1 \
+                                    "cat > ${COPY}"
+                        if [ $? -ne 0 ]; then
+                                fail "ssh cat $DATA failed"
+                        fi
+                        cmp $DATA ${COPY}       || fail "corrupted copy"
+                done
+        done
+done
+rm -f ${COPY}
+
diff --git a/regress/sftp-badcmds.sh b/regress/sftp-badcmds.sh
index eac189aaf..b48b1cb01 100644
--- a/regress/sftp-badcmds.sh
+++ b/regress/sftp-badcmds.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: sftp-badcmds.sh,v 1.2 2003/05/15 04:07:12 mouring Exp $
+#       $OpenBSD: sftp-badcmds.sh,v 1.3 2008/03/24 21:46:54 djm Exp $
 #       Placed in the Public Domain.
 
 tid="sftp invalid commands"
@@ -45,17 +45,6 @@ echo "rename $NONEXIST ${COPY}.1" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "rename nonexist failed"
 test -f ${COPY}.1 && fail "file exists after rename nonexistent"
 
-rm -f ${COPY} ${COPY}.1
-cp $DATA $COPY
-cp $DATA2 ${COPY}.1
-verbose "$tid: rename target exists"
-echo "rename $COPY ${COPY}.1" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
-        || fail "rename target exists failed"
-test -f ${COPY} || fail "oldname missing after rename target exists"
-test -f ${COPY}.1 || fail "newname missing after rename target exists"
-cmp $DATA ${COPY} >/dev/null 2>&1 || fail "corrupted oldname after rename target exists"
-cmp $DATA2 ${COPY}.1 >/dev/null 2>&1 || fail "corrupted newname after rename target exists"
-
 rm -rf ${COPY} ${COPY}.dd
 cp $DATA $COPY
 mkdir ${COPY}.dd
diff --git a/regress/sftp-cmds.sh b/regress/sftp-cmds.sh
index 31b21d1f2..3b453c5e8 100644
--- a/regress/sftp-cmds.sh
+++ b/regress/sftp-cmds.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: sftp-cmds.sh,v 1.6 2003/10/07 07:04:52 djm Exp $
+#       $OpenBSD: sftp-cmds.sh,v 1.9 2007/12/12 05:04:03 djm Exp $
 #       Placed in the Public Domain.
 
 # XXX - TODO: 
@@ -34,14 +34,22 @@ fi
 # Path with embedded quote
 QUOTECOPY=${COPY}".\"blah\""
 QUOTECOPY_ARG=${COPY}'.\"blah\"'
+# File with spaces
+SPACECOPY="${COPY} this has spaces.txt"
+SPACECOPY_ARG="${COPY}\ this\ has\ spaces.txt"
+# File with glob metacharacters
+GLOBMETACOPY="${COPY} [metachar].txt"
 
 rm -rf ${COPY} ${COPY}.1 ${COPY}.2 ${COPY}.dd ${COPY}.dd2
 mkdir ${COPY}.dd
 
 verbose "$tid: lls"
-echo "lls ${OBJ}" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
-        || fail "lls failed"
-# XXX always successful
+(echo "lcd ${OBJ}" ; echo "lls") | ${SFTP} -P ${SFTPSERVER} 2>&1 | \
+        grep copy.dd >/dev/null 2>&1 || fail "lls failed"
+
+verbose "$tid: lls w/path"
+echo "lls ${OBJ}" | ${SFTP} -P ${SFTPSERVER} 2>&1 | \
+        grep copy.dd >/dev/null 2>&1 || fail "lls w/path failed"
 
 verbose "$tid: ls"
 echo "ls ${OBJ}" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
@@ -89,12 +97,27 @@ if [ "$os" != "cygwin" ]; then
 rm -f ${QUOTECOPY}
 cp $DATA ${QUOTECOPY}
 verbose "$tid: get filename with quotes"
-echo "get \"$QUOTECOPY_ARG\" ${COPY}" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
-        || fail "put failed"
+echo "get \"$QUOTECOPY_ARG\" ${COPY}" | \
+    ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \ || fail "get failed"
 cmp ${COPY} ${QUOTECOPY} || fail "corrupted copy after get with quotes"
 rm -f ${QUOTECOPY} ${COPY}
 fi
 
+rm -f "$SPACECOPY" ${COPY}
+cp $DATA "$SPACECOPY"
+verbose "$tid: get filename with spaces"
+echo "get ${SPACECOPY_ARG} ${COPY}" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+        || fail "get failed"
+cmp ${COPY} "$SPACECOPY" || fail "corrupted copy after get with spaces"
+
+rm -f "$GLOBMETACOPY" ${COPY}
+cp $DATA "$GLOBMETACOPY"
+verbose "$tid: get filename with glob metacharacters"
+echo "get \"${GLOBMETACOPY}\" ${COPY}" | \
+        ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 || fail "get failed"
+cmp ${COPY} "$GLOBMETACOPY" || \
+        fail "corrupted copy after get with glob metacharacters"
+
 rm -f ${COPY}.dd/*
 verbose "$tid: get to directory"
 echo "get $DATA ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
@@ -125,18 +148,24 @@ done
 
 rm -f ${COPY}
 verbose "$tid: put"
-echo "put $DATA $COPY" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
-        || fail "put failed"
+echo "put $DATA $COPY" | \
+        ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 || fail "put failed"
 cmp $DATA ${COPY} || fail "corrupted copy after put"
 
 if [ "$os" != "cygwin" ]; then
 rm -f ${QUOTECOPY}
 verbose "$tid: put filename with quotes"
-echo "put $DATA \"$QUOTECOPY_ARG\"" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
-        || fail "put failed"
+echo "put $DATA \"$QUOTECOPY_ARG\"" | \
+        ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 || fail "put failed"
 cmp $DATA ${QUOTECOPY} || fail "corrupted copy after put with quotes"
 fi
 
+rm -f "$SPACECOPY"
+verbose "$tid: put filename with spaces"
+echo "put $DATA ${SPACECOPY_ARG}" | \
+        ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 || fail "put failed"
+cmp $DATA "$SPACECOPY" || fail "corrupted copy after put with spaces"
+
 rm -f ${COPY}.dd/*
 verbose "$tid: put to directory"
 echo "put $DATA ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
@@ -145,7 +174,7 @@ cmp $DATA ${COPY}.dd/`basename $DATA` || fail "corrupted copy after put"
 
 rm -f ${COPY}.dd/*
 verbose "$tid: glob put to directory"
-echo "put /bin/l* ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+echo "put /bin/l? ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "put failed"
 for x in $GLOBFILES; do
         cmp /bin/$x ${COPY}.dd/$x || fail "corrupted copy after put"
@@ -159,7 +188,7 @@ cmp $DATA ${COPY}.dd/`basename $DATA` || fail "corrupted copy after put"
 
 rm -f ${COPY}.dd/*
 verbose "$tid: glob put to local dir"
-(echo "cd ${COPY}.dd"; echo "put /bin/l*") | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+(echo "cd ${COPY}.dd"; echo "put /bin/l?") | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "put failed"
 for x in $GLOBFILES; do
         cmp /bin/$x ${COPY}.dd/$x || fail "corrupted copy after put"
@@ -172,8 +201,9 @@ test -f ${COPY}.1 || fail "missing file after rename"
 cmp $DATA ${COPY}.1 >/dev/null 2>&1 || fail "corrupted copy after rename"
 
 verbose "$tid: rename directory"
-echo "rename ${COPY}.dd ${COPY}.dd2" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
-        || fail "rename directory failed"
+echo "rename ${COPY}.dd ${COPY}.dd2" | \
+        ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 || \
+        fail "rename directory failed"
 test -d ${COPY}.dd && fail "oldname exists after rename directory"
 test -d ${COPY}.dd2 || fail "missing newname after rename directory"
 
@@ -207,5 +237,5 @@ echo "lchdir ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "lchdir failed"
 
 rm -rf ${COPY} ${COPY}.1 ${COPY}.2 ${COPY}.dd ${COPY}.dd2
-
+rm -rf ${QUOTECOPY} "$SPACECOPY" "$GLOBMETACOPY"
 
diff --git a/regress/sftp-glob.sh b/regress/sftp-glob.sh
index e238356a2..60116a748 100644
--- a/regress/sftp-glob.sh
+++ b/regress/sftp-glob.sh
@@ -1,28 +1,68 @@
-#       $OpenBSD: sftp-glob.sh,v 1.1 2004/12/10 01:31:30 fgsch Exp $
+#       $OpenBSD: sftp-glob.sh,v 1.3 2007/10/26 05:30:01 djm Exp $
 #       Placed in the Public Domain.
 
 tid="sftp glob"
 
+sftp_ls() {
+        target=$1
+        errtag=$2
+        expected=$3
+        unexpected=$4
+        verbose "$tid: $errtag"
+        printf "ls -l %s" "${target}" | \
+                ${SFTP} -b - -P ${SFTPSERVER} 2>/dev/null | \
+                grep -v "^sftp>" > ${RESULTS}
+        if [ $? -ne 0 ]; then
+                fail "$errtag failed"
+        fi
+        if test "x$expected" != "x" ; then
+            if fgrep "$expected" ${RESULTS} >/dev/null 2>&1 ; then
+                :
+            else
+                fail "$expected missing from $errtag results"
+            fi
+        fi
+        if test "x$unexpected" != "x" && \
+           fgrep "$unexpected" ${RESULTS} >/dev/null 2>&1 ; then
+                fail "$unexpected present in $errtag results"
+        fi
+        rm -f ${RESULTS}
+}
+
 BASE=${OBJ}/glob
+RESULTS=${OBJ}/results
 DIR=${BASE}/dir
 DATA=${DIR}/file
 
+GLOB1="${DIR}/g-wild*"
+GLOB2="${DIR}/g-wildx"
+QUOTE="${DIR}/g-quote\""
+SLASH="${DIR}/g-sl\\ash"
+ESLASH="${DIR}/g-slash\\"
+QSLASH="${DIR}/g-qs\\\""
+SPACE="${DIR}/g-q space"
+
 rm -rf ${BASE}
 mkdir -p ${DIR}
-touch ${DATA}
-
-verbose "$tid: ls file"
-echo "ls -l ${DIR}/fil*" | ${SFTP} -P ${SFTPSERVER} 2>/dev/null | \
-        grep ${DATA} >/dev/null 2>&1
-if [ $? -ne 0 ]; then
-        fail "globbed ls file failed"
-fi
-
-verbose "$tid: ls dir"
-echo "ls -l ${BASE}/d*" | ${SFTP} -P ${SFTPSERVER} 2>/dev/null | \
-        grep file >/dev/null 2>&1
-if [ $? -ne 0 ]; then
-        fail "globbed ls dir failed"
-fi
+touch "${DATA}" "${GLOB1}" "${GLOB2}" "${QUOTE}"
+touch "${QSLASH}" "${ESLASH}" "${SLASH}" "${SPACE}"
+
+#       target                   message                expected     unexpected
+sftp_ls "${DIR}/fil*"            "file glob"            "${DATA}"    ""
+sftp_ls "${BASE}/d*"             "dir glob"             "`basename ${DATA}`" ""
+sftp_ls "${DIR}/g-wild\"*\""     "quoted glob"          "g-wild*"    "g-wildx"
+sftp_ls "${DIR}/g-wild\*"        "escaped glob"         "g-wild*"    "g-wildx"
+sftp_ls "${DIR}/g-quote\\\""     "escaped quote"        "g-quote\""  ""
+sftp_ls "\"${DIR}/g-quote\\\"\"" "quoted quote"         "g-quote\""  ""
+sftp_ls "'${DIR}/g-quote\"'"     "single-quoted quote"  "g-quote\""  ""
+sftp_ls "${DIR}/g-sl\\\\ash"     "escaped slash"        "g-sl\\ash"  ""
+sftp_ls "'${DIR}/g-sl\\\\ash'"   "quoted slash"         "g-sl\\ash"  ""
+sftp_ls "${DIR}/g-slash\\\\"     "escaped slash at EOL" "g-slash\\"  ""
+sftp_ls "'${DIR}/g-slash\\\\'"   "quoted slash at EOL"  "g-slash\\"  ""
+sftp_ls "${DIR}/g-qs\\\\\\\""    "escaped slash+quote"  "g-qs\\\""   ""
+sftp_ls "'${DIR}/g-qs\\\\\"'"    "quoted slash+quote"   "g-qs\\\""   ""
+sftp_ls "${DIR}/g-q\\ space"     "escaped space"        "g-q space"  ""
+sftp_ls "'${DIR}/g-q space'"     "quoted space"         "g-q space"  ""
 
 rm -rf ${BASE}
+
diff --git a/regress/ssh2putty.sh b/regress/ssh2putty.sh
new file mode 100755
index 000000000..dfdeeff4a
--- /dev/null
+++ b/regress/ssh2putty.sh
@@ -0,0 +1,33 @@
+#!/bin/sh
+
+if test "x$1" = "x" -o "x$2" = "x" -o "x$3" = "x" ; then
+        echo "Usage: ssh2putty hostname port ssh-private-key"
+        exit 1
+fi
+
+HOST=$1
+PORT=$2
+KEYFILE=$3
+
+# XXX - support DSA keys too
+if grep "BEGIN RSA PRIVATE KEY" $KEYFILE >/dev/null 2>&1 ; then
+        :
+else
+        echo "Unsupported private key format"
+        exit 1
+fi
+
+public_exponent=`
+        openssl rsa -noout -text -in $KEYFILE | grep ^publicExponent | 
+        sed 's/.*(//;s/).*//'
+`
+test $? -ne 0 && exit 1
+
+modulus=`
+        openssl rsa -noout -modulus -in $KEYFILE | grep ^Modulus= | 
+        sed 's/^Modulus=/0x/' | tr A-Z a-z
+`
+test $? -ne 0 && exit 1
+
+echo "rsa2@$PORT:$HOST $public_exponent,$modulus"
+
diff --git a/regress/test-exec.sh b/regress/test-exec.sh
index 59ae33c08..b54448912 100644
--- a/regress/test-exec.sh
+++ b/regress/test-exec.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: test-exec.sh,v 1.28 2005/05/20 23:14:15 djm Exp $
+#       $OpenBSD: test-exec.sh,v 1.35 2008/06/28 13:57:25 djm Exp $
 #       Placed in the Public Domain.
 
 #SUDO=sudo
@@ -69,6 +69,11 @@ SFTP=sftp
 SFTPSERVER=/usr/libexec/openssh/sftp-server
 SCP=scp
 
+# Interop testing
+PLINK=plink
+PUTTYGEN=puttygen
+CONCH=conch
+
 if [ "x$TEST_SSH_SSH" != "x" ]; then
         SSH="${TEST_SSH_SSH}"
 fi
@@ -96,6 +101,27 @@ fi
 if [ "x$TEST_SSH_SCP" != "x" ]; then
         SCP="${TEST_SSH_SCP}"
 fi
+if [ "x$TEST_SSH_PLINK" != "x" ]; then
+        # Find real binary, if it exists
+        case "${TEST_SSH_PLINK}" in
+        /*) PLINK="${TEST_SSH_PLINK}" ;;
+        *) PLINK=`which ${TEST_SSH_PLINK} 2>/dev/null` ;;
+        esac
+fi
+if [ "x$TEST_SSH_PUTTYGEN" != "x" ]; then
+        # Find real binary, if it exists
+        case "${TEST_SSH_PUTTYGEN}" in
+        /*) PUTTYGEN="${TEST_SSH_PUTTYGEN}" ;;
+        *) PUTTYGEN=`which ${TEST_SSH_PUTTYGEN} 2>/dev/null` ;;
+        esac
+fi
+if [ "x$TEST_SSH_CONCH" != "x" ]; then
+        # Find real binary, if it exists
+        case "${TEST_SSH_CONCH}" in
+        /*) CONCH="${TEST_SSH_CONCH}" ;;
+        *) CONCH=`which ${TEST_SSH_CONCH} 2>/dev/null` ;;
+        esac
+fi
 
 # Path to sshd must be absolute for rexec
 case "$SSHD" in
@@ -269,6 +295,49 @@ for t in rsa rsa1; do
 done
 chmod 644 $OBJ/authorized_keys_$USER
 
+# Activate Twisted Conch tests if the binary is present
+REGRESS_INTEROP_CONCH=no
+if test -x "$CONCH" ; then
+        REGRESS_INTEROP_CONCH=yes
+fi
+
+# If PuTTY is present and we are running a PuTTY test, prepare keys and
+# configuration
+REGRESS_INTEROP_PUTTY=no
+if test -x "$PUTTYGEN" -a -x "$PLINK" ; then
+        REGRESS_INTEROP_PUTTY=yes
+fi
+case "$SCRIPT" in
+*putty*)        ;;
+*)              REGRESS_INTEROP_PUTTY=no ;;
+esac
+
+if test "$REGRESS_INTEROP_PUTTY" = "yes" ; then
+        mkdir -p ${OBJ}/.putty
+
+        # Add a PuTTY key to authorized_keys
+        rm -f ${OBJ}/putty.rsa2
+        puttygen -t rsa -o ${OBJ}/putty.rsa2 < /dev/null > /dev/null
+        puttygen -O public-openssh ${OBJ}/putty.rsa2 \
+            >> $OBJ/authorized_keys_$USER
+
+        # Convert rsa2 host key to PuTTY format
+        ${SRC}/ssh2putty.sh 127.0.0.1 $PORT $OBJ/rsa > \
+            ${OBJ}/.putty/sshhostkeys
+        ${SRC}/ssh2putty.sh 127.0.0.1 22 $OBJ/rsa >> \
+            ${OBJ}/.putty/sshhostkeys
+
+        # Setup proxied session
+        mkdir -p ${OBJ}/.putty/sessions
+        rm -f ${OBJ}/.putty/sessions/localhost_proxy
+        echo "Hostname=127.0.0.1" >> ${OBJ}/.putty/sessions/localhost_proxy
+        echo "PortNumber=$PORT" >> ${OBJ}/.putty/sessions/localhost_proxy
+        echo "ProxyMethod=5" >> ${OBJ}/.putty/sessions/localhost_proxy
+        echo "ProxyTelnetCommand=sh ${SRC}/sshd-log-wrapper.sh ${SSHD} ${TEST_SSH_LOGFILE} -i -f $OBJ/sshd_proxy" >> ${OBJ}/.putty/sessions/localhost_proxy 
+
+        REGRESS_INTEROP_PUTTY=yes
+fi
+
 # create a proxy version of the client config
 (
         cat $OBJ/ssh_config
@@ -281,8 +350,8 @@ ${SSHD} -t -f $OBJ/sshd_proxy	|| fatal "sshd_proxy broken"
 start_sshd ()
 {
         # start sshd
-        $SUDO ${SSHD} -f $OBJ/sshd_config -t    || fatal "sshd_config broken"
-        $SUDO ${SSHD} -f $OBJ/sshd_config -e >>$TEST_SSH_LOGFILE 2>&1
+        $SUDO ${SSHD} -f $OBJ/sshd_config "$@" -t || fatal "sshd_config broken"
+        $SUDO ${SSHD} -f $OBJ/sshd_config -e "$@" >>$TEST_SSH_LOGFILE 2>&1
 
         trace "wait for sshd"
         i=0;
diff --git a/regress/try-ciphers.sh b/regress/try-ciphers.sh
index 379fe353a..ef776d2ee 100644
--- a/regress/try-ciphers.sh
+++ b/regress/try-ciphers.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: try-ciphers.sh,v 1.10 2005/05/24 04:10:54 djm Exp $
+#       $OpenBSD: try-ciphers.sh,v 1.11 2007/06/07 19:41:46 pvalchev Exp $
 #       Placed in the Public Domain.
 
 tid="try ciphers"
@@ -7,7 +7,7 @@ ciphers="aes128-cbc 3des-cbc blowfish-cbc cast128-cbc
         arcfour128 arcfour256 arcfour 
         aes192-cbc aes256-cbc rijndael-cbc@lysator.liu.se
         aes128-ctr aes192-ctr aes256-ctr"
-macs="hmac-sha1 hmac-md5 hmac-sha1-96 hmac-md5-96"
+macs="hmac-sha1 hmac-md5 umac-64@openssh.com hmac-sha1-96 hmac-md5-96"
 
 for c in $ciphers; do
         for m in $macs; do