160 files changed, 8489 insertions, 4442 deletions
diff --git a/ChangeLog b/ChangeLog
index 5d7e7f182..ad4bf8838 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,865 @@
+20060211
+ - (dtucker) [README] Bump release notes URL.
+ - (djm) Release 4.3p2
+20060208
+ - (tim) [session.c] Logout records were not updated on systems with
+   post auth privsep disabled due to bug 1086 changes. Analysis and patch
+   by vinschen at redhat.com. OK tim@, dtucker@.
+ - (dtucker) [configure.ac] Typo in Ultrix and NewsOS sections (NEED_SETPRGP
+   -> NEED_SETPGRP), reported by Berhard Simon.  ok tim@
+20060206
+ - (tim) [configure.ac] Remove unnecessary tests for net/if.h and 
+   netinet/in_systm.h. OK dtucker@.
+20060205
+ - (tim) [configure.ac] Add AC_REVISION. Add sys/time.h to lastlog.h test
+   for Solaris. OK dtucker@.
+ - (tim) [configure.ac] Bug #1149. Changes in QNX section only. Patch by
+   kraai at ftbfs.org.
+20060203
+ - (tim) [configure.ac] test for egrep (AC_PROG_EGREP) before first
+   AC_CHECK_HEADERS test. Without it, if AC_CHECK_HEADERS is first run
+   by a platform specific check, builtin standard includes tests will be
+   skipped on the other platforms.
+   Analysis and suggestion by vinschen at redhat.com, patch by dtucker@.
+   OK tim@, djm@.
+20060202
+ - (dtucker) [configure.ac] Bug #1148: Fix "crippled AES" test so that it
+   works with picky compilers.  Patch from alex.kiernan at thus.net.
+20060201
+ - (djm) [regress/test-exec.sh] Try 'logname' as well as 'whoami' to 
+   determine the user's login name - needed for regress tests on Solaris 
+   10 and OpenSolaris
+ - (djm) OpenBSD CVS Sync
+   - jmc@cvs.openbsd.org 2006/02/01 09:06:50
+     [sshd.8]
+     - merge sections on protocols 1 and 2 into a single section
+     - remove configuration file section
+     ok markus
+   - jmc@cvs.openbsd.org 2006/02/01 09:11:41
+     [sshd.8]
+     small tweak;
+ - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
+   [contrib/suse/openssh.spec] Update versions ahead of release
+   - markus@cvs.openbsd.org 2006/02/01 11:27:22
+     [version.h]
+     openssh 4.3
+ - (djm) Release OpenSSH 4.3p1
+20060131
+ - (djm) OpenBSD CVS Sync
+   - jmc@cvs.openbsd.org 2006/01/20 11:21:45
+     [ssh_config.5]
+     - word change, agreed w/ markus
+     - consistency fixes
+   - jmc@cvs.openbsd.org 2006/01/25 09:04:34
+     [sshd.8]
+     move the options description up the page, and a few additional tweaks
+     whilst in here;
+     ok markus
+   - jmc@cvs.openbsd.org 2006/01/25 09:07:22
+     [sshd.8]
+     move subsections to full sections;
+   - jmc@cvs.openbsd.org 2006/01/26 08:47:56
+     [ssh.1]
+     add a section on verifying host keys in dns;
+     written with a lot of help from jakob;
+     feedback dtucker/markus;
+     ok markus
+   - reyk@cvs.openbsd.org 2006/01/30 12:22:22
+     [channels.c]
+     mark channel as write failed or dead instead of read failed on error
+     of the channel output filter.
+     ok markus@
+   - jmc@cvs.openbsd.org 2006/01/30 13:37:49
+     [ssh.1]
+     remove an incorrect sentence;
+     reported by roumen petrov;
+     ok djm markus
+   - djm@cvs.openbsd.org 2006/01/31 10:19:02
+     [misc.c misc.h scp.c sftp.c]
+     fix local arbitrary command execution vulnerability on local/local and
+     remote/remote copies (CVE-2006-0225, bz #1094), patch by
+     t8m AT centrum.cz, polished by dtucker@ and myself; ok markus@
+   - djm@cvs.openbsd.org 2006/01/31 10:35:43
+     [scp.c]
+     "scp a b c" shouldn't clobber "c" when it is not a directory, report and
+     fix from biorn@; ok markus@
+ - (djm) Sync regress tests to OpenBSD:
+   - dtucker@cvs.openbsd.org 2005/03/10 10:20:39
+     [regress/forwarding.sh]
+     Regress test for ClearAllForwardings (bz #994); ok markus@
+   - dtucker@cvs.openbsd.org 2005/04/25 09:54:09
+     [regress/multiplex.sh]
+     Don't call cleanup in multiplex as test-exec will cleanup anyway
+     found by tim@, ok djm@
+     NB. ID sync only, we already had this
+   - djm@cvs.openbsd.org 2005/05/20 23:14:15
+     [regress/test-exec.sh]
+     force addressfamily=inet for tests, unbreaking dynamic-forward regress for
+     recently committed nc SOCKS5 changes
+   - djm@cvs.openbsd.org 2005/05/24 04:10:54
+     [regress/try-ciphers.sh]
+     oops, new arcfour modes here too
+   - markus@cvs.openbsd.org 2005/06/30 11:02:37
+     [regress/scp.sh]
+     allow SUDO=sudo; from Alexander Bluhm
+   - grunk@cvs.openbsd.org 2005/11/14 21:25:56
+     [regress/agent-getpeereid.sh]
+     all other scripts in this dir use $SUDO, not 'sudo', so pull this even
+     ok markus@
+   - dtucker@cvs.openbsd.org 2005/12/14 04:36:39
+     [regress/scp-ssh-wrapper.sh]
+     Fix assumption about how many args scp will pass; ok djm@
+     NB. ID sync only, we already had this
+   - djm@cvs.openbsd.org 2006/01/27 06:49:21
+     [scp.sh]
+     regress test for local to local scp copies; ok dtucker@
+   - djm@cvs.openbsd.org 2006/01/31 10:23:23
+     [scp.sh]
+     regression test for CVE-2006-0225 written by dtucker@
+   - djm@cvs.openbsd.org 2006/01/31 10:36:33
+     [scp.sh]
+     regress test for "scp a b c" where "c" is not a directory
+20060129
+ - (dtucker) [configure.ac opensshd.init.in] Bug #1144: Use /bin/sh for the
+   opensshd.init script interpretter if /sbin/sh does not exist.  ok tim@
+20060120
+ - (dtucker) OpenBSD CVS Sync
+   - jmc@cvs.openbsd.org 2006/01/15 17:37:05
+     [ssh.1]
+     correction from deraadt
+   - jmc@cvs.openbsd.org 2006/01/18 10:53:29
+     [ssh.1]
+     add a section on ssh-based vpn, based on reyk's README.tun;
+   - dtucker@cvs.openbsd.org 2006/01/20 00:14:55
+     [scp.1 ssh.1 ssh_config.5 sftp.1]
+     Document RekeyLimit.  Based on patch from jan.iven at cern.ch from mindrot
+     #1056 with feedback from jmc, djm and markus; ok jmc@ djm@
+20060114
+ - (djm) OpenBSD CVS Sync
+   - jmc@cvs.openbsd.org 2006/01/06 13:27:32
+     [ssh.1]
+     weed out some duplicate info in the known_hosts FILES entries;
+     ok djm
+   - jmc@cvs.openbsd.org 2006/01/06 13:29:10
+     [ssh.1]
+     final round of whacking FILES for duplicate info, and some consistency
+     fixes;
+     ok djm
+   - jmc@cvs.openbsd.org 2006/01/12 14:44:12
+     [ssh.1]
+     split sections on tcp and x11 forwarding into two sections.
+     add an example in the tcp section, based on sth i wrote for ssh faq;
+     help + ok: djm markus dtucker
+   - jmc@cvs.openbsd.org 2006/01/12 18:48:48
+     [ssh.1]
+     refer to `TCP' rather than `TCP/IP' in the context of connection
+     forwarding;
+     ok markus
+   - jmc@cvs.openbsd.org 2006/01/12 22:20:00
+     [sshd.8]
+     refer to TCP forwarding, rather than TCP/IP forwarding;
+   - jmc@cvs.openbsd.org 2006/01/12 22:26:02
+     [ssh_config.5]
+     refer to TCP forwarding, rather than TCP/IP forwarding;
+   - jmc@cvs.openbsd.org 2006/01/12 22:34:12
+     [ssh.1]
+     back out a sentence - AUTHENTICATION already documents this;
+20060109
+ - (dtucker) [contrib/cygwin/ssh-host-config] Make sshd service depend on
+   tcpip service so it's always started after IP is up.  Patch from
+   vinschen at redhat.com.
+20060106
+ - (djm) OpenBSD CVS Sync
+   - jmc@cvs.openbsd.org 2006/01/03 16:31:10
+     [ssh.1]
+     move FILES to a -compact list, and make each files an item in that list.
+     this avoids nastly line wrap when we have long pathnames, and treats
+     each file as a separate item;
+     remove the .Pa too, since it is useless.
+   - jmc@cvs.openbsd.org 2006/01/03 16:35:30
+     [ssh.1]
+     use a larger width for the ENVIRONMENT list;
+   - jmc@cvs.openbsd.org 2006/01/03 16:52:36
+     [ssh.1]
+     put FILES in some sort of order: sort by pathname
+   - jmc@cvs.openbsd.org 2006/01/03 16:55:18
+     [ssh.1]
+     tweak the description of ~/.ssh/environment
+   - jmc@cvs.openbsd.org 2006/01/04 18:42:46
+     [ssh.1]
+     chop out some duplication in the .{r,s}hosts/{h,sh}osts.equiv FILES
+     entries;
+     ok markus
+   - jmc@cvs.openbsd.org 2006/01/04 18:45:01
+     [ssh.1]
+     remove .Xr's to rsh(1) and telnet(1): they are hardly needed;
+   - jmc@cvs.openbsd.org 2006/01/04 19:40:24
+     [ssh.1]
+     +.Xr ssh-keyscan 1 ,
+   - jmc@cvs.openbsd.org 2006/01/04 19:50:09
+     [ssh.1]
+     -.Xr gzip 1 ,
+   - djm@cvs.openbsd.org 2006/01/05 23:43:53
+     [misc.c]
+     check that stdio file descriptors are actually closed before clobbering
+     them in sanitise_stdfd(). problems occurred when a lower numbered fd was
+     closed, but higher ones weren't. spotted by, and patch tested by
+     Fr�d�ric Olivi�
+20060103
+ - (djm) [channels.c] clean up harmless merge error, from reyk@
+20060103
+ - (djm) OpenBSD CVS Sync
+   - jmc@cvs.openbsd.org 2006/01/02 17:09:49
+     [ssh_config.5 sshd_config.5]
+     some corrections from michael knudsen;
+20060102
+ - (djm) [README.tun] Add README.tun, missed during sync of tun(4) support
+ - (djm) OpenBSD CVS Sync
+   - jmc@cvs.openbsd.org 2005/12/31 10:46:17
+     [ssh.1]
+     merge the "LOGIN SESSION AND REMOTE EXECUTION" and "SERVER
+     AUTHENTICATION" sections into "AUTHENTICATION";
+     some rewording done to make the text read better, plus some
+     improvements from djm;
+     ok djm
+   - jmc@cvs.openbsd.org 2005/12/31 13:44:04
+     [ssh.1]
+     clean up ENVIRONMENT a little;
+   - jmc@cvs.openbsd.org 2005/12/31 13:45:19
+     [ssh.1]
+     .Nm does not require an argument;
+   - stevesk@cvs.openbsd.org 2006/01/01 08:59:27
+     [includes.h misc.c]
+     move <net/if.h>; ok djm@
+   - stevesk@cvs.openbsd.org 2006/01/01 10:08:48
+     [misc.c]
+     no trailing "\n" for debug()
+   - djm@cvs.openbsd.org 2006/01/02 01:20:31
+     [sftp-client.c sftp-common.h sftp-server.c]
+     use a common max. packet length, no binary change
+   - reyk@cvs.openbsd.org 2006/01/02 07:53:44
+     [misc.c]
+     clarify tun(4) opening - set the mode and bring the interface up. also
+     (re)sets the tun(4) layer 2 LINK0 flag for existing tunnel interfaces.
+     suggested and ok by djm@
+   - jmc@cvs.openbsd.org 2006/01/02 12:31:06
+     [ssh.1]
+     start to cut some duplicate info from FILES;
+     help/ok djm
+20060101
+ - (djm) [Makefile.in configure.ac includes.h misc.c]
+         [openbsd-compat/port-tun.c openbsd-compat/port-tun.h] Add support
+         for tunnel forwarding for FreeBSD and NetBSD. NetBSD's support is
+         limited to IPv4 tunnels only, and most versions don't support the
+         tap(4) device at all.
+ - (djm) [configure.ac] Fix linux/if_tun.h test
+ - (djm) [openbsd-compat/port-tun.c] Linux needs linux/if.h too
+20051229
+ - (djm) OpenBSD CVS Sync
+   - stevesk@cvs.openbsd.org 2005/12/28 22:46:06
+     [canohost.c channels.c clientloop.c]
+     use 'break-in' for consistency; ok deraadt@ ok and input jmc@
+   - reyk@cvs.openbsd.org 2005/12/30 15:56:37
+     [channels.c channels.h clientloop.c]
+     add channel output filter interface.
+     ok djm@, suggested by markus@
+   - jmc@cvs.openbsd.org 2005/12/30 16:59:00
+     [sftp.1]
+     do not suggest that interactive authentication will work
+     with the -b flag;
+     based on a diff from john l. scarfone;
+     ok djm
+   - stevesk@cvs.openbsd.org 2005/12/31 01:38:45
+     [ssh.1]
+     document -MM; ok djm@
+ - (djm) [openbsd-compat/port-tun.c openbsd-compat/port-tun.h configure.ac]
+   [serverloop.c ssh.c openbsd-compat/Makefile.in]
+   [openbsd-compat/openbsd-compat.h] Implement tun(4) forwarding 
+   compatability support for Linux, diff from reyk@
+ - (djm) [configure.ac] Disable Linux tun(4) compat code if linux/tun.h does
+   not exist
+ - (djm) [configure.ac] oops, make that linux/if_tun.h
+20051229
+ - (tim) [buildpkg.sh.in] grep for $SSHDUID instead of $SSHDGID on /etc/passwd
+20051224
+ - (djm) OpenBSD CVS Sync
+   - jmc@cvs.openbsd.org 2005/12/20 21:59:43
+     [ssh.1]
+     merge the sections on protocols 1 and 2 into one section on
+     authentication;
+     feedback djm dtucker
+     ok deraadt markus dtucker
+   - jmc@cvs.openbsd.org 2005/12/20 22:02:50
+     [ssh.1]
+     .Ss -> .Sh: subsections have not made this page more readable
+   - jmc@cvs.openbsd.org 2005/12/20 22:09:41
+     [ssh.1]
+     move info on ssh return values and config files up into the main
+     description;
+   - jmc@cvs.openbsd.org 2005/12/21 11:48:16
+     [ssh.1]
+     -L and -R descriptions are now above, not below, ~C description;
+   - jmc@cvs.openbsd.org 2005/12/21 11:57:25
+     [ssh.1]
+     options now described `above', rather than `later';
+   - jmc@cvs.openbsd.org 2005/12/21 12:53:31
+     [ssh.1]
+     -Y does X11 forwarding too;
+     ok markus
+   - stevesk@cvs.openbsd.org 2005/12/21 22:44:26
+     [sshd.8]
+     clarify precedence of -p, Port, ListenAddress; ok and help jmc@
+   - jmc@cvs.openbsd.org 2005/12/22 10:31:40
+     [ssh_config.5]
+     put the description of "UsePrivilegedPort" in the correct place;
+   - jmc@cvs.openbsd.org 2005/12/22 11:23:42
+     [ssh.1]
+     expand the description of -w somewhat;
+     help/ok reyk
+   - jmc@cvs.openbsd.org 2005/12/23 14:55:53
+     [ssh.1]
+     - sync the description of -e w/ synopsis
+     - simplify the description of -I
+     - note that -I is only available if support compiled in, and that it
+     isn't by default
+     feedback/ok djm@
+   - jmc@cvs.openbsd.org 2005/12/23 23:46:23
+     [ssh.1]
+     less mark up for -c;
+   - djm@cvs.openbsd.org 2005/12/24 02:27:41
+     [session.c sshd.c]
+     eliminate some code duplicated in privsep and non-privsep paths, and
+     explicitly clear SIGALRM handler; "groovy" deraadt@
+20051220
+ - (dtucker) OpenBSD CVS Sync
+   - reyk@cvs.openbsd.org 2005/12/13 15:03:02
+     [serverloop.c]
+     if forced_tun_device is not set, it is -1 and not SSH_TUNID_ANY
+   - jmc@cvs.openbsd.org 2005/12/16 18:07:08
+     [ssh.1]
+     move the option descriptions up the page: start of a restructure;
+     ok markus deraadt
+   - jmc@cvs.openbsd.org 2005/12/16 18:08:53
+     [ssh.1]
+     simplify a sentence;
+   - jmc@cvs.openbsd.org 2005/12/16 18:12:22
+     [ssh.1]
+     make the description of -c a little nicer;
+   - jmc@cvs.openbsd.org 2005/12/16 18:14:40
+     [ssh.1]
+     signpost the protocol sections;
+   - stevesk@cvs.openbsd.org 2005/12/17 21:13:05
+     [ssh_config.5 session.c]
+     spelling: fowarding, fowarded
+   - stevesk@cvs.openbsd.org 2005/12/17 21:36:42
+     [ssh_config.5]
+     spelling: intented -> intended
+   - dtucker@cvs.openbsd.org 2005/12/20 04:41:07
+     [ssh.c]
+     exit(255) on error to match description in ssh(1); bz #1137; ok deraadt@
+20051219
+ - (dtucker) [cipher-aes.c cipher-ctr.c cipher.c configure.ac
+   openbsd-compat/openssl-compat.h] Check for and work around broken AES
+   ciphers >128bit on (some) Solaris 10 systems.  ok djm@
+20051217
+ - (dtucker) [defines.h] HP-UX system headers define "YES" and "NO" which
+   scp.c also uses, so undef them here.
+ - (dtucker) [configure.ac openbsd-compat/bsd-snprintf.c] Bug #1133: Our
+   snprintf replacement can have a conflicting declaration in HP-UX's system
+   headers (const vs. no const) so we now check for and work around it.  Patch
+   from the dynamic duo of David Leonard and Ted Percival.
+20051214
+ - (dtucker) OpenBSD CVS Sync (regress/)
+   - dtucker@cvs.openbsd.org 2005/12/30 04:36:39
+     [regress/scp-ssh-wrapper.sh]
+     Fix assumption about how many args scp will pass; ok djm@
+20051213
+ - (djm) OpenBSD CVS Sync
+   - jmc@cvs.openbsd.org 2005/11/30 11:18:27
+     [ssh.1]
+     timezone -> time zone
+   - jmc@cvs.openbsd.org 2005/11/30 11:45:20
+     [ssh.1]
+     avoid ambiguities in describing TZ;
+     ok djm@
+   - reyk@cvs.openbsd.org 2005/12/06 22:38:28
+     [auth-options.c auth-options.h channels.c channels.h clientloop.c]
+     [misc.c misc.h readconf.c readconf.h scp.c servconf.c servconf.h]
+     [serverloop.c sftp.c ssh.1 ssh.c ssh_config ssh_config.5 sshconnect.c]
+     [sshconnect.h sshd.8 sshd_config sshd_config.5]
+     Add support for tun(4) forwarding over OpenSSH, based on an idea and
+     initial channel code bits by markus@. This is a simple and easy way to
+     use OpenSSH for ad hoc virtual private network connections, e.g.
+     administrative tunnels or secure wireless access. It's based on a new
+     ssh channel and works similar to the existing TCP forwarding support,
+     except that it depends on the tun(4) network interface on both ends of
+     the connection for layer 2 or layer 3 tunneling. This diff also adds
+     support for LocalCommand in the ssh(1) client.
+     ok djm@, markus@, jmc@ (manpages), tested and discussed with others
+   - djm@cvs.openbsd.org 2005/12/07 03:52:22
+     [clientloop.c]
+     reyk forgot to compile with -Werror (missing header)
+   - jmc@cvs.openbsd.org 2005/12/07 10:52:13
+     [ssh.1]
+     - avoid line split in SYNOPSIS
+     - add args to -w
+     - kill trailing whitespace
+   - jmc@cvs.openbsd.org 2005/12/08 14:59:44
+     [ssh.1 ssh_config.5]
+     make `!command' a little clearer;
+     ok reyk
+   - jmc@cvs.openbsd.org 2005/12/08 15:06:29
+     [ssh_config.5]
+     keep options in order;
+   - reyk@cvs.openbsd.org 2005/12/08 18:34:11
+     [auth-options.c includes.h misc.c misc.h readconf.c servconf.c]
+     [serverloop.c ssh.c ssh_config.5 sshd_config.5 configure.ac]
+     two changes to the new ssh tunnel support. this breaks compatibility
+     with the initial commit but is required for a portable approach.
+     - make the tunnel id u_int and platform friendly, use predefined types.
+     - support configuration of layer 2 (ethernet) or layer 3
+     (point-to-point, default) modes. configuration is done using the
+     Tunnel (yes|point-to-point|ethernet|no) option is ssh_config(5) and
+     restricted by the PermitTunnel (yes|point-to-point|ethernet|no) option
+     in sshd_config(5).
+     ok djm@, man page bits by jmc@
+   - jmc@cvs.openbsd.org 2005/12/08 21:37:50
+     [ssh_config.5]
+     new sentence, new line;
+   - markus@cvs.openbsd.org 2005/12/12 13:46:18
+     [channels.c channels.h session.c]
+     make sure protocol messages for internal channels are ignored.
+     allow adjust messages for non-open channels; with and ok djm@
+ - (djm) [misc.c] Disable tunnel code for non-OpenBSD (for now), enable
+   again by providing a sys_tun_open() function for your platform and 
+   setting the CUSTOM_SYS_TUN_OPEN define. More work is required to match 
+   OpenBSD's tunnel protocol, which prepends the address family to the 
+   packet
+20051201
+ - (djm) [envpass.sh] Remove regress script that was accidentally committed 
+   in top level directory and not noticed for over a year :)
+20051129
+ - (tim) [ssh-keygen.c] Move DSA length test after setting default when
+   bits == 0.
+ - (dtucker) OpenBSD CVS Sync
+   - dtucker@cvs.openbsd.org 2005/11/29 02:04:55
+     [ssh-keygen.c]
+     Populate default key sizes before checking them; from & ok tim@
+ - (tim) [configure.ac sshd.8] Enable locked account check (a "*LK*" string)
+   for UnixWare.
+20051128
+ - (dtucker) [regress/yes-head.sh] Work around breakage caused by some
+   versions of GNU head.  Based on patch from zappaman at buraphalinux.org
+ - (dtucker) [includes.h] Bug #1122: __USE_GNU is a glibc internal macro, use
+   _GNU_SOURCE instead.  Patch from t8m at centrum.cz.
+ - (dtucker) OpenBSD CVS Sync
+   - dtucker@cvs.openbsd.org 2005/11/28 05:16:53
+     [ssh-keygen.1 ssh-keygen.c]
+     Enforce DSA key length of exactly 1024 bits to comply with FIPS-186-2,
+     increase minumum RSA key size to 768 bits and update man page to reflect
+     these.  Patch originally bz#1119 (senthilkumar_sen at hotpop.com),
+     ok djm@, grudging ok deraadt@.
+   - dtucker@cvs.openbsd.org 2005/11/28 06:02:56
+     [ssh-agent.1]
+     Update agent socket path templates to reflect reality, correct xref for
+     time formats.  bz#1121, patch from openssh at roumenpetrov.info, ok djm@
+20051126
+ - (dtucker) [configure.ac] Bug #1126: AIX 5.2 and 5.3 (and presumably newer,
+   when they're available) need the real UID set otherwise pam_chauthtok will
+   set ADMCHG after changing the password, forcing the user to change it
+   again immediately.
+20051125
+ - (dtucker) [configure.ac] Apply tim's fix for older systems where the
+   resolver state in resolv.h is "state" not "__res_state".  With slight
+   modification by me to also work on old AIXes.  ok djm@
+ - (dtucker) [progressmeter.c scp.c sftp-server.c] Use correct casts for
+   snprintf formats, fixes warnings on some 64 bit platforms.  Patch from
+   shaw at vranix.com, ok djm@
+20051124
+ - (djm) [configure.ac openbsd-compat/Makefile.in openbsd-compat/bsd-asprintf.c 
+   openbsd-compat/bsd-snprintf.c openbsd-compat/openbsd-compat.h] Add an 
+   asprintf() implementation, after syncing our {v,}snprintf() implementation
+   with some extra fixes from Samba's version. With help and debugging from 
+   dtucker and tim; ok dtucker@
+ - (dtucker) [configure.ac] Fix typos in comments and AC_SEARCH_LIB argument
+   order in Reliant Unix block.  Patch from johane at lysator.liu.se.
+ - (dtucker) [regress/test-exec.sh] Use 1024 bit keys since we generate so
+   many and use them only once.  Speeds up testing on older/slower hardware.
+20051122
+ - (dtucker) OpenBSD CVS Sync
+   - deraadt@cvs.openbsd.org 2005/11/12 18:37:59
+     [ssh-add.c]
+     space
+   - deraadt@cvs.openbsd.org 2005/11/12 18:38:15
+     [scp.c]
+     avoid close(-1), as in rcp; ok cloder
+   - millert@cvs.openbsd.org 2005/11/15 11:59:54
+     [includes.h]
+     Include sys/queue.h explicitly instead of assuming some other header
+     will pull it in.  At the moment it gets pulled in by sys/select.h
+     (which ssh has no business including) via event.h.  OK markus@
+     (ID sync only in -portable)
+   - dtucker@cvs.openbsd.org 2005/11/21 09:42:10
+     [auth-krb5.c]
+     Perform Kerberos calls even for invalid users to prevent leaking
+     information about account validity.  bz #975, patch originally from
+     Senthil Kumar, sanity checked by Simon Wilkinson, tested by djm@, biorn@,
+     ok markus@
+   - dtucker@cvs.openbsd.org 2005/11/22 03:36:03
+     [hostfile.c]
+     Correct format/arguments to debug call; spotted by shaw at vranix.com
+     ok djm@
+ - (dtucker) [loginrec.c] Add casts to prevent compiler warnings, patch
+   from shaw at vranix.com.
+20051120
+ - (dtucker) [openbsd-compat/openssl-compat.h] Add comment explaining what
+   is going on.
+20051112
+ - (dtucker) [openbsd-compat/getrrsetbyname.c] Restore Portable-specific
+   ifdef lost during sync.  Spotted by tim@.
+ - (dtucker) [openbsd-compat/{realpath.c,stroll.c,rresvport.c}] $OpenBSD tag.
+ - (dtucker) [configure.ac] Use "$AWK" instead of "awk" in gcc version test.
+ - (dtucker) [configure.ac] Remove duplicate utimes() check.  ok djm@
+ - (dtucker) [regress/reconfigure.sh] Fix potential race in the reconfigure
+   test: if sshd takes too long to reconfigure the subsequent connection will
+   fail.  Zap pidfile before HUPing sshd which will rewrite it when it's ready.
+20051110
+ - (dtucker) [openbsd-compat/setenv.c] Merge changes for __findenv from
+   OpenBSD getenv.c revs 1.4 - 1.8 (ANSIfication of arguments, removal of
+   "register").
+ - (dtucker) [openbsd-compat/setenv.c] Make __findenv static, remove
+   unnecessary prototype.
+ - (dtucker) [openbsd-compat/setenv.c] Sync changes from OpenBSD setenv.c
+   revs 1.7 - 1.9.
+ - (dtucker) [auth-krb5.c] Fix -Wsign-compare warning in non-Heimdal path.
+   Patch from djm@.
+ - (dtucker) [configure.ac] Disable pointer-sign warnings on gcc 4.0+
+   since they're not useful right now.  Patch from djm@.
+ - (dtucker) [openbsd-compat/getgrouplist.c] Sync OpenBSD revs 1.10 - 1.2 (ANSI
+   prototypes, removal of "register").
+ - (dtucker) [openbsd-compat/strlcat.c] Sync OpenBSD revs 1.11 - 1.12 (removal
+   of "register").
+ - (dtucker) [openbsd-compat/{LOTS}] Move the "OPENBSD ORIGINAL" markers to
+   after the copyright notices.  Having them at the top next to the CVSIDs
+   guarantees a conflict for each and every sync.
+ - (dtucker) [openbsd-compat/strlcpy.c] Update from OpenBSD 1.8 -> 1.10.
+ - (dtucker) [openbsd-compat/sigact.h] Add "OPENBSD ORIGINAL" marker.
+ - (dtucker) [openbsd-compat/strmode.c] Update from OpenBSD 1.5 -> 1.7.
+   Removal of rcsid, "whiteout" inode type.
+ - (dtucker) [openbsd-compat/basename.c] Update from OpenBSD 1.11 -> 1.14.
+   Removal of rcsid, will no longer strlcpy parts of the string.
+ - (dtucker) [openbsd-compat/strtoll.c] Update from OpenBSD 1.4 -> 1.5.
+ - (dtucker) [openbsd-compat/strtoul.c] Update from OpenBSD 1.5 -> 1.7.
+ - (dtucker) [openbsd-compat/readpassphrase.c] Update from OpenBSD 1.16 -> 1.18.
+ - (dtucker) [openbsd-compat/readpassphrase.h] Update from OpenBSD 1.3 -> 1.5.
+ - (dtucker) [openbsd-compat/glob.c] Update from OpenBSD 1.22 -> 1.25.
+ - (dtucker) [openbsd-compat/glob.h] Update from OpenBSD 1.8 -> 1.9.
+ - (dtucker) [openbsd-compat/getcwd.c] Update from OpenBSD 1.9 -> 1.14.
+ - (dtucker) [openbsd-compat/getcwd.c] Replace lstat with fstat to match up
+   with OpenBSD code since we don't support platforms without fstat any more.
+ - (dtucker) [openbsd-compat/inet_aton.c] Update from OpenBSD 1.7 -> 1.9.
+ - (dtucker) [openbsd-compat/inet_ntoa.c] Update from OpenBSD 1.4 -> 1.6.
+ - (dtucker) [openbsd-compat/inet_ntop.c] Update from OpenBSD 1.5 -> 1.7.
+ - (dtucker) [openbsd-compat/daemon.c] Update from OpenBSD 1.5 -> 1.6.
+ - (dtucker) [openbsd-compat/strsep.c] Update from OpenBSD 1.5 -> 1.6.
+ - (dtucker) [openbsd-compat/daemon.c] Update from OpenBSD 1.10 -> 1.13.
+ - (dtucker) [openbsd-compat/mktemp.c] Update from OpenBSD 1.17 -> 1.19.
+ - (dtucker) [openbsd-compat/rresvport.c] Update from OpenBSD 1.6 -> 1.8.
+ - (dtucker) [openbsd-compat/bindresvport.c] Add "OPENBSD ORIGINAL" marker.
+ - (dtucker) [openbsd-compat/bindresvport.c] Update from OpenBSD 1.16 -> 1.17.
+ - (dtucker) [openbsd-compat/sigact.c] Update from OpenBSD 1.3 -> 1.4.
+   Id and copyright sync only, there were no substantial changes we need.
+ - (dtucker) [openbsd-compat/bsd-closefrom.c openbsd-compat/base64.c]
+   -Wsign-compare fixes from djm.
+ - (dtucker) [openbsd-compat/sigact.h] Update from OpenBSD 1.2 -> 1.3.
+   Id and copyright sync only, there were no substantial changes we need.
+ - (dtucker) [configure.ac] Try to get the gcc version number in a way that
+   doesn't change between versions, and use a safer default.
+20051105
+ - (djm) OpenBSD CVS Sync
+   - markus@cvs.openbsd.org 2005/10/07 11:13:57
+     [ssh-keygen.c]
+     change DSA default back to 1024, as it's defined for 1024 bits only
+     and this causes interop problems with other clients.  moreover,
+     in order to improve the security of DSA you need to change more
+     components of DSA key generation (e.g. the internal SHA1 hash);
+     ok deraadt
+   - djm@cvs.openbsd.org 2005/10/10 10:23:08
+     [channels.c channels.h clientloop.c serverloop.c session.c]
+     fix regression I introduced in 4.2: X11 forwardings initiated after
+     a session has exited (e.g. "(sleep 5; xterm) &") would not start.
+     bz #1086 reported by t8m AT centrum.cz; ok markus@ dtucker@
+   - djm@cvs.openbsd.org 2005/10/11 23:37:37
+     [channels.c]
+     bz #1076 set SO_REUSEADDR on X11 forwarding listner sockets, preventing
+     bind() failure when a previous connection's listeners are in TIME_WAIT,
+     reported by plattner AT inf.ethz.ch; ok dtucker@
+   - stevesk@cvs.openbsd.org 2005/10/13 14:03:01
+     [auth2-gss.c gss-genr.c gss-serv.c]
+     remove unneeded #includes; ok markus@
+   - stevesk@cvs.openbsd.org 2005/10/13 14:20:37
+     [gss-serv.c]
+     spelling in comments
+   - stevesk@cvs.openbsd.org 2005/10/13 19:08:08
+     [gss-serv-krb5.c gss-serv.c]
+     unused declarations; ok deraadt@
+     (id sync only for gss-serv-krb5.c)
+   - stevesk@cvs.openbsd.org 2005/10/13 19:13:41
+     [dns.c]
+     unneeded #include, unused declaration, little knf; ok deraadt@
+   - stevesk@cvs.openbsd.org 2005/10/13 22:24:31
+     [auth2-gss.c gss-genr.c gss-serv.c monitor.c]
+     KNF; ok djm@
+   - stevesk@cvs.openbsd.org 2005/10/14 02:17:59
+     [ssh-keygen.c ssh.c sshconnect2.c]
+     no trailing "\n" for log functions; ok djm@
+   - stevesk@cvs.openbsd.org 2005/10/14 02:29:37
+     [channels.c clientloop.c]
+     free()->xfree(); ok djm@
+   - stevesk@cvs.openbsd.org 2005/10/15 15:28:12
+     [sshconnect.c]
+     make external definition static; ok deraadt@
+   - stevesk@cvs.openbsd.org 2005/10/17 13:45:05
+     [dns.c]
+     fix memory leaks from 2 sources:
+         1) key_fingerprint_raw()
+         2) malloc in dns_read_rdata()
+     ok jakob@
+   - stevesk@cvs.openbsd.org 2005/10/17 14:01:28
+     [dns.c]
+     remove #ifdef LWRES; ok jakob@
+   - stevesk@cvs.openbsd.org 2005/10/17 14:13:35
+     [dns.c dns.h]
+     more cleanups; ok jakob@
+   - djm@cvs.openbsd.org 2005/10/30 01:23:19
+     [ssh_config.5]
+     mention control socket fallback behaviour, reported by 
+     tryponraj AT gmail.com
+   - djm@cvs.openbsd.org 2005/10/30 04:01:03
+     [ssh-keyscan.c]
+     make ssh-keygen discard junk from server before SSH- ident, spotted by
+     dave AT cirt.net; ok dtucker@
+   - djm@cvs.openbsd.org 2005/10/30 04:03:24
+     [ssh.c]
+     fix misleading debug message; ok dtucker@
+   - dtucker@cvs.openbsd.org 2005/10/30 08:29:29
+     [canohost.c sshd.c]
+     Check for connections with IP options earlier and drop silently.  ok djm@
+   - jmc@cvs.openbsd.org 2005/10/30 08:43:47
+     [ssh_config.5]
+     remove trailing whitespace;
+   - djm@cvs.openbsd.org 2005/10/30 08:52:18
+     [clientloop.c packet.c serverloop.c session.c ssh-agent.c ssh-keygen.c]
+     [ssh.c sshconnect.c sshconnect1.c sshd.c]
+     no need to escape single quotes in comments, no binary change
+   - dtucker@cvs.openbsd.org 2005/10/31 06:15:04
+     [sftp.c]
+     Fix sorting with "ls -1" command. From Robert Tsai, "looks right" deraadt@
+   - djm@cvs.openbsd.org 2005/10/31 11:12:49
+     [ssh-keygen.1 ssh-keygen.c]
+     generate a protocol 2 RSA key by default
+   - djm@cvs.openbsd.org 2005/10/31 11:48:29
+     [serverloop.c]
+     make sure we clean up wtmp, etc. file when we receive a SIGTERM,
+     SIGINT or SIGQUIT when running without privilege separation (the
+     normal privsep case is already OK). Patch mainly by dtucker@ and
+     senthilkumar_sen AT hotpop.com; ok dtucker@
+   - jmc@cvs.openbsd.org 2005/10/31 19:55:25
+     [ssh-keygen.1]
+     grammar;
+   - dtucker@cvs.openbsd.org 2005/11/03 13:38:29
+     [canohost.c]
+     Cache reverse lookups with and without DNS separately; ok markus@
+   - djm@cvs.openbsd.org 2005/11/04 05:15:59
+     [kex.c kex.h kexdh.c kexdhc.c kexdhs.c kexgex.c kexgexc.c kexgexs.c]
+     remove hardcoded hash lengths in key exchange code, allowing
+     implementation of KEX methods with different hashes (e.g. SHA-256);
+     ok markus@ dtucker@ stevesk@
+   - djm@cvs.openbsd.org 2005/11/05 05:01:15
+     [bufaux.c]
+     Fix leaks in error paths, bz #1109 and #1110 reported by kremenek AT
+     cs.stanford.edu; ok dtucker@
+ - (dtucker) [README.platform] Add PAM section.
+ - (djm) [openbsd-compat/getrrsetbyname.c] Sync to latest OpenBSD version,
+   resolving memory leak bz#1111 reported by kremenek AT cs.stanford.edu;
+   ok dtucker@
+20051102
+ - (dtucker) [openbsd-compat/bsd-misc.c] Bug #1108: fix broken strdup().
+   Reported by olavi at ipunplugged.com and antoine.brodin at laposte.net
+   via FreeBSD.
+20051030
+ - (djm) [contrib/suse/openssh.spec contrib/suse/rc.
+   sshd contrib/suse/sysconfig.ssh] Bug #1106: Updated SuSE spec and init 
+   files from imorgan AT nas.nasa.gov
+ - (dtucker) [session.c] Bug #1045do not check /etc/nologin when PAM is
+   enabled, instead allow PAM to handle it.  Note that on platforms using PAM,
+   the pam_nologin module should be added to sshd's session stack in order to
+   maintain exising behaviour.  Based on patch and discussion from t8m at
+   centrum.cz, ok djm@
+20051025
+ - (dtucker) [configure.ac] Relocate LLONG_MAX calculation to after the
+   sizeof(long long) checks, to make fixing bug #1104 easier (no changes
+   yet).
+ - (dtucker) [configure.ac] Bug #1104: Tru64's printf family doesn't
+   understand "%lld", even though the compiler has "long long", so handle
+   it as a special case.  Patch tested by mcaskill.scott at epa.gov.
+ - (dtucker) [contrib/cygwin/ssh-user-config] Remove duplicate yes/no
+   prompt.  Patch from vinschen at redhat.com.
+20051017
+ - (dtucker) [configure.ac] Bug #1097: Fix configure for cross-compiling.
+   /etc/default/login report and testing from aabaker at iee.org, corrections
+   from tim@.
+20051009
+ - (dtucker) [configure.ac defines.h openbsd-compat/vis.{c,h}] Sync current
+   versions from OpenBSD.  ok djm@
+20051008
+ - (dtucker) [configure.ac] Bug #1098: define $MAIL for HP-UX; report from
+   brian.smith at agilent com.
+ - (djm) [configure.ac] missing 'test' call for -with-Werror test
+20051005
+ - (dtucker) [configure.ac sshd.8] Enable locked account check (a prepended
+   "*LOCKED*" string) for FreeBSD.  Patch jeremie at le-hen.org and
+   senthilkumar_sen at hotpop.com.
+20051003
+ - (dtucker) OpenBSD CVS Sync
+   - markus@cvs.openbsd.org 2005/09/07 08:53:53
+     [channels.c]
+     enforce chanid != NULL; ok djm
+   - markus@cvs.openbsd.org 2005/09/09 19:18:05
+     [clientloop.c]
+     typo; from mark at mcs.vuw.ac.nz, bug #1082
+   - djm@cvs.openbsd.org 2005/09/13 23:40:07
+     [sshd.c ssh.c misc.h sftp.c ssh-keygen.c ssh-keysign.c sftp-server.c
+     scp.c misc.c ssh-keyscan.c ssh-add.c ssh-agent.c]
+     ensure that stdio fds are attached; ok deraadt@
+   - djm@cvs.openbsd.org 2005/09/19 11:37:34
+     [ssh_config.5 ssh.1]
+     mention ability to specify bind_address for DynamicForward and -D options;
+     bz#1077 spotted by Haruyama Seigo
+   - djm@cvs.openbsd.org 2005/09/19 11:47:09
+     [sshd.c]
+     stop connection abort on rekey with delayed compression enabled when
+     post-auth privsep is disabled (e.g. when root is logged in); ok dtucker@
+   - djm@cvs.openbsd.org 2005/09/19 11:48:10
+     [gss-serv.c]
+     typo
+   - jmc@cvs.openbsd.org 2005/09/19 15:38:27
+     [ssh.1]
+     some more .Bk/.Ek to avoid ugly line split;
+   - jmc@cvs.openbsd.org 2005/09/19 15:42:44
+     [ssh.c]
+     update -D usage here too;
+   - djm@cvs.openbsd.org 2005/09/19 23:31:31
+     [ssh.1]
+     spelling nit from stevesk@
+   - djm@cvs.openbsd.org 2005/09/21 23:36:54
+     [sshd_config.5]
+     aquire -> acquire, from stevesk@
+   - djm@cvs.openbsd.org 2005/09/21 23:37:11
+     [sshd.c]
+     change label at markus@'s request
+   - jaredy@cvs.openbsd.org 2005/09/30 20:34:26
+     [ssh-keyscan.1]
+     deploy .An -nosplit; ok jmc
+   - dtucker@cvs.openbsd.org 2005/10/03 07:44:42
+     [canohost.c]
+     Relocate check_ip_options call to prevent logging of garbage for
+     connections with IP options set.  bz#1092 from David Leonard,
+     "looks good" deraadt@
+ - (dtucker) [regress/README.regress] Bug #989: Document limitation that scp
+   is required in the system path for the multiplex test to work.
+20050930
+ - (dtucker) [openbsd-compat/openbsd-compat.h] Bug #1096: Add prototype
+   for strtoll.  Patch from o.flebbe at science-computing.de.
+ - (dtucker) [monitor.c] Bug #1087: Send loginmsg to preauth privsep
+   child during PAM account check without clearing it.  This restores the
+   post-login warnings such as LDAP password expiry.  Patch from Tomas Mraz
+   with help from several others.
+20050929
+ - (dtucker) [monitor_wrap.c] Remove duplicate definition of loginmsg
+   introduced during sync.
+20050928
+ - (dtucker) [entropy.c] Use u_char for receiving RNG seed for consistency.
+ - (dtucker) [auth-pam.c] Bug #1028: send final non-query messages from
+   PAM via keyboard-interactive.  Patch tested by the folks at Vintela.
+20050927
+ - (dtucker) [entropy.c] Remove unnecessary tests for getuid and geteuid
+   calls, since they can't possibly fail.  ok djm@
+ - (dtucker) [entropy.c entropy.h sshd.c] Pass RNG seed to the reexec'ed
+   process when sshd relies on ssh-random-helper.  Should result in faster
+   logins on systems without a real random device or prngd.  ok djm@
+20050924
+ - (dtucker) [auth2.c] Move start_pam() calls out of if-else block to remove
+   duplicate call.  ok djm@
+20050922
+ - (dtucker) [configure.ac] Use -R linker flag for libedit too; patch from
+   skeleten at shillest.net.
+ - (dtucker) [configure.ac] Fix help for --with-opensc; patch from skeleten at
+   shillest.net.
+20050919
+ - (tim) [aclocal.m4 configure.ac] Delete acconfig.h and add templates to
+   AC_DEFINE and AC_DEFINE_UNQUOTED to quiet autoconf 2.59 warning messages.
+   ok dtucker@
+20050912
+ - (tim) [configure.ac] Bug 1078. Fix --without-kerberos5. Reported by
+   Mike Frysinger.
+20050908
+ - (tim) [defines.h openbsd-compat/port-uw.c] Add long password support to
+   OpenServer 6 and add osr5bigcrypt support so when someone migrates
+   passwords between UnixWare and OpenServer they will still work. OK dtucker@
 20050901
 - (djm) Update RPM spec file versions
@@ -3013,4 +3875,4 @@
   - (djm) Trim deprecated options from INSTALL. Mention UsePAM
   - (djm) Fix quote handling in sftp; Patch from admorten AT umich.edu
-$Id: ChangeLog,v 1.3887 2005/09/01 09:10:48 djm Exp $
+$Id: ChangeLog,v 1.4117.2.10 2006/02/11 00:00:44 djm Exp $
diff --git a/Makefile.in b/Makefile.in
index 947cef8c6..0bdd23fd7 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -1,4 +1,4 @@
-# $Id: Makefile.in,v 1.273 2005/05/29 07:22:29 dtucker Exp $
+# $Id: Makefile.in,v 1.274 2006/01/01 08:47:05 djm Exp $
 # uncomment if you run a non bourne compatable shell. Ie. csh
 #SHELL = @SH@
@@ -139,7 +139,7 @@ sshd$(EXEEXT): libssh.a	$(LIBCOMPAT) $(SSHDOBJS)
        $(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBWRAP) $(LIBPAM) $(LIBS)
 scp$(EXEEXT): $(LIBCOMPAT) libssh.a scp.o progressmeter.o
-        $(LD) -o $@ scp.o progressmeter.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
+        $(LD) -o $@ scp.o progressmeter.o bufaux.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
 ssh-add$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-add.o
        $(LD) -o $@ ssh-add.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
diff --git a/README b/README
index 51f0ca4fb..c8c413195 100644
--- a/README
+++ b/README
@@ -1,4 +1,4 @@
-See http://www.openssh.com/txt/release-4.2 for the release notes.
+See http://www.openssh.com/txt/release-4.3p2 for the release notes.
 - A Japanese translation of this document and of the OpenSSH FAQ is
 - available at http://www.unixuser.org/~haruyama/security/openssh/index.html
@@ -62,4 +62,4 @@ References -
 [6] http://www.openbsd.org/cgi-bin/man.cgi?query=style&sektion=9
 [7] http://www.openssh.com/faq.html
-$Id: README,v 1.60 2005/08/31 14:05:57 dtucker Exp $
+$Id: README,v 1.61.2.1 2006/02/10 23:43:34 dtucker Exp $
diff --git a/README.platform b/README.platform
index af551de48..4c18a3278 100644
--- a/README.platform
+++ b/README.platform
@@ -45,4 +45,14 @@ number is already in use on your system, you may change it at build time
 by configure'ing --with-cflags=-DAUE_openssh=32801 then rebuilding.
-$Id: README.platform,v 1.5 2005/02/20 10:01:49 dtucker Exp $
+Platforms using PAM
+-------------------
+As of OpenSSH 4.3p1, sshd will no longer check /etc/nologin itself when
+PAM is enabled.  To maintain existing behaviour, pam_nologin should be
+added to sshd's session stack which will prevent users from starting shell
+sessions.  Alternatively, pam_nologin can be added to either the auth or
+account stacks which will prevent authentication entirely, but will still
+return the output from pam_nologin to the client.
+$Id: README.platform,v 1.6 2005/11/05 05:28:35 dtucker Exp $
diff --git a/README.tun b/README.tun
new file mode 100644
index 000000000..d814f396d
--- /dev/null
+++ b/README.tun
@@ -0,0 +1,132 @@
+How to use OpenSSH-based virtual private networks
+-------------------------------------------------
+OpenSSH contains support for VPN tunneling using the tun(4) network
+tunnel pseudo-device which is available on most platforms, either for
+layer 2 or 3 traffic.
+The following brief instructions on how to use this feature use
+a network configuration specific to the OpenBSD operating system.
+(1) Server: Enable support for SSH tunneling
+To enable the ssh server to accept tunnel requests from the client, you
+have to add the following option to the ssh server configuration file
+(/etc/ssh/sshd_config):
+        PermitTunnel yes
+Restart the server or send the hangup signal (SIGHUP) to let the server
+reread it's configuration.
+(2) Server: Restrict client access and assign the tunnel
+The OpenSSH server simply uses the file /root/.ssh/authorized_keys to
+restrict the client to connect to a specified tunnel and to
+automatically start the related interface configuration command. These
+settings are optional but recommended:
+        tunnel="1",command="sh /etc/netstart tun1" ssh-rsa ... reyk@openbsd.org
+(3) Client: Configure the local network tunnel interface
+Use the hostname.if(5) interface-specific configuration file to set up
+the network tunnel configuration with OpenBSD. For example, use the
+following configuration in /etc/hostname.tun0 to set up the layer 3
+tunnel on the client:
+        inet 192.168.5.1 255.255.255.252 192.168.5.2
+OpenBSD also supports layer 2 tunneling over the tun device by adding
+the link0 flag:
+        inet 192.168.1.78 255.255.255.0 192.168.1.255 link0
+Layer 2 tunnels can be used in combination with an Ethernet bridge(4)
+interface, like the following example for /etc/bridgename.bridge0:
+        add tun0
+        add sis0
+        up
+(4) Client: Configure the OpenSSH client
+To establish tunnel forwarding for connections to a specified
+remote host by default, use the following ssh client configuration for
+the privileged user (in /root/.ssh/config):
+        Host sshgateway
+                Tunnel yes
+                TunnelDevice 0:any
+                PermitLocalCommand yes
+                LocalCommand sh /etc/netstart tun0
+A more complicated configuration is possible to establish a tunnel to
+a remote host which is not directly accessible by the client.
+The following example describes a client configuration to connect to
+the remote host over two ssh hops in between. It uses the OpenSSH
+ProxyCommand in combination with the nc(1) program to forward the final
+ssh tunnel destination over multiple ssh sessions.
+        Host access.somewhere.net
+                User puffy
+        Host dmzgw
+                User puffy
+                ProxyCommand ssh access.somewhere.net nc dmzgw 22
+        Host sshgateway
+                Tunnel Ethernet
+                TunnelDevice 0:any
+                PermitLocalCommand yes
+                LocalCommand sh /etc/netstart tun0
+                ProxyCommand ssh dmzgw nc sshgateway 22
+The following network plan illustrates the previous configuration in
+combination with layer 2 tunneling and Ethernet bridging.
+--------+       (          )      +----------------------+
+| Client |------(  Internet  )-----| access.somewhere.net |
+--------+       (          )      +----------------------+
+    : 192.168.1.78                             |
+    :.............................         +-------+       
+     Forwarded ssh connection    :         | dmzgw |
+     Layer 2 tunnel              :         +-------+
+                                 :             |
+                                 :             |
+                                 :      +------------+  
+                                 :......| sshgateway |
+                                      | +------------+
+--- real connection                 Bridge ->  |          +----------+
+... "virtual connection"                     [ X ]--------| somehost |
+[X] switch                                                +----------+
+                                                          192.168.1.25
+(5) Client: Connect to the server and establish the tunnel
+Finally connect to the OpenSSH server to establish the tunnel by using
+the following command:
+        
+        ssh sshgateway
+It is also possible to tell the client to fork into the background after
+the connection has been successfully established:
+        ssh -f sshgateway true
+Without the ssh configuration done in step (4), it is also possible
+to use the following command lines:
+        ssh -fw 0:1 sshgateway true
+        ifconfig tun0 192.168.5.1 192.168.5.2 netmask 255.255.255.252
+Using OpenSSH tunnel forwarding is a simple way to establish secure
+and ad hoc virtual private networks. Possible fields of application
+could be wireless networks or administrative VPN tunnels.
+Nevertheless, ssh tunneling requires some packet header overhead and
+runs on top of TCP. It is still suggested to use the IP Security
+Protocol (IPSec) for robust and permanent VPN connections and to
+interconnect corporate networks.
+        Reyk Floeter
+$OpenBSD: README.tun,v 1.3 2005/12/08 18:34:10 reyk Exp $
diff --git a/acconfig.h b/acconfig.h
deleted file mode 100644
index 79b5e8191..000000000
--- a/acconfig.h
+++ /dev/null
@@ -1,458 +0,0 @@
-/* $Id: acconfig.h,v 1.183 2005/07/07 10:33:36 dtucker Exp $ */
-/*
- * Copyright (c) 1999-2003 Damien Miller.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#ifndef _CONFIG_H
-#define _CONFIG_H
-/* Generated automatically from acconfig.h by autoheader. */
-/* Please make your changes there */
-@TOP@
-/* Define if your platform breaks doing a seteuid before a setuid */
-#undef SETEUID_BREAKS_SETUID
-/* Define if your setreuid() is broken */
-#undef BROKEN_SETREUID
-/* Define if your setregid() is broken */
-#undef BROKEN_SETREGID
-/* Define if your setresuid() is broken */
-#undef BROKEN_SETRESUID
-/* Define if your setresgid() is broken */
-#undef BROKEN_SETRESGID
-/* Define to a Set Process Title type if your system is */
-/* supported by bsd-setproctitle.c */
-#undef SPT_TYPE
-#undef SPT_PADCHAR
-/* SCO workaround */
-#undef BROKEN_SYS_TERMIO_H
-/* Define if you have SecureWare-based protected password database */
-#undef HAVE_SECUREWARE
-/* If your header files don't define LOGIN_PROGRAM, then use this (detected) */
-/* from environment and PATH */
-#undef LOGIN_PROGRAM_FALLBACK
-/* Full path of your "passwd" program */
-#undef _PATH_PASSWD_PROG
-/* Define if your password has a pw_class field */
-#undef HAVE_PW_CLASS_IN_PASSWD
-/* Define if your password has a pw_expire field */
-#undef HAVE_PW_EXPIRE_IN_PASSWD
-/* Define if your password has a pw_change field */
-#undef HAVE_PW_CHANGE_IN_PASSWD
-/* Define if your system uses access rights style file descriptor passing */
-#undef HAVE_ACCRIGHTS_IN_MSGHDR
-/* Define if your system uses ancillary data style file descriptor passing */
-#undef HAVE_CONTROL_IN_MSGHDR
-/* Define if you system's inet_ntoa is busted (e.g. Irix gcc issue) */
-#undef BROKEN_INET_NTOA
-/* Define if your system defines sys_errlist[] */
-#undef HAVE_SYS_ERRLIST
-/* Define if your system defines sys_nerr */
-#undef HAVE_SYS_NERR
-/* Define if your system choked on IP TOS setting */
-#undef IP_TOS_IS_BROKEN
-/* Define if you have the getuserattr function.  */
-#undef HAVE_GETUSERATTR
-/* Define if you have the basename function. */
-#undef HAVE_BASENAME
-/* Work around problematic Linux PAM modules handling of PAM_TTY */
-#undef PAM_TTY_KLUDGE
-/* Define if pam_chauthtok wants real uid set to the unpriv'ed user */
-#undef SSHPAM_CHAUTHTOK_NEEDS_RUID
-/* Use PIPES instead of a socketpair() */
-#undef USE_PIPES
-/* Define if your snprintf is busted */
-#undef BROKEN_SNPRINTF
-/* Define if you are on Cygwin */
-#undef HAVE_CYGWIN
-/* Define if you have a broken realpath. */
-#undef BROKEN_REALPATH
-/* Define if you are on NeXT */
-#undef HAVE_NEXT
-/* Define if you want to enable PAM support */
-#undef USE_PAM
-/* Define if you want to enable AIX4's authenticate function */
-#undef WITH_AIXAUTHENTICATE
-/* Define if your AIX loginfailed() function takes 4 arguments (AIX >= 5.2) */
-#undef AIX_LOGINFAILED_4ARG
-/* Define if your skeychallenge() function takes 4 arguments (eg NetBSD) */
-#undef SKEYCHALLENGE_4ARG
-/* Define if you have/want arrays (cluster-wide session managment, not C arrays) */
-#undef WITH_IRIX_ARRAY
-/* Define if you want IRIX project management */
-#undef WITH_IRIX_PROJECT
-/* Define if you want IRIX audit trails */
-#undef WITH_IRIX_AUDIT
-/* Define if you want IRIX kernel jobs */
-#undef WITH_IRIX_JOBS
-/* Location of PRNGD/EGD random number socket */
-#undef PRNGD_SOCKET
-/* Port number of PRNGD/EGD random number socket */
-#undef PRNGD_PORT
-/* Builtin PRNG command timeout */
-#undef ENTROPY_TIMEOUT_MSEC
-/* non-privileged user for privilege separation */
-#undef SSH_PRIVSEP_USER
-/* Define if you want to install preformatted manpages.*/
-#undef MANTYPE
-/* Define if your ssl headers are included with #include <openssl/header.h>  */
-#undef HAVE_OPENSSL
-/* Define if you are linking against RSAref.  Used only to print the right
- * message at run-time. */
-#undef RSAREF
-/* struct timeval */
-#undef HAVE_STRUCT_TIMEVAL
-/* struct utmp and struct utmpx fields */
-#undef HAVE_HOST_IN_UTMP
-#undef HAVE_HOST_IN_UTMPX
-#undef HAVE_ADDR_IN_UTMP
-#undef HAVE_ADDR_IN_UTMPX
-#undef HAVE_ADDR_V6_IN_UTMP
-#undef HAVE_ADDR_V6_IN_UTMPX
-#undef HAVE_SYSLEN_IN_UTMPX
-#undef HAVE_PID_IN_UTMP
-#undef HAVE_TYPE_IN_UTMP
-#undef HAVE_TYPE_IN_UTMPX
-#undef HAVE_TV_IN_UTMP
-#undef HAVE_TV_IN_UTMPX
-#undef HAVE_ID_IN_UTMP
-#undef HAVE_ID_IN_UTMPX
-#undef HAVE_EXIT_IN_UTMP
-#undef HAVE_TIME_IN_UTMP
-#undef HAVE_TIME_IN_UTMPX
-/* Define if you don't want to use your system's login() call */
-#undef DISABLE_LOGIN
-/* Define if you don't want to use pututline() etc. to write [uw]tmp */
-#undef DISABLE_PUTUTLINE
-/* Define if you don't want to use pututxline() etc. to write [uw]tmpx */
-#undef DISABLE_PUTUTXLINE
-/* Define if you don't want to use lastlog */
-#undef DISABLE_LASTLOG
-/* Define if you don't want to use lastlog in session.c */
-#undef NO_SSH_LASTLOG
-/* Define if you don't want to use utmp */
-#undef DISABLE_UTMP
-/* Define if you don't want to use utmpx */
-#undef DISABLE_UTMPX
-/* Define if you don't want to use wtmp */
-#undef DISABLE_WTMP
-/* Define if you don't want to use wtmpx */
-#undef DISABLE_WTMPX
-/* Some systems need a utmpx entry for /bin/login to work */
-#undef LOGIN_NEEDS_UTMPX
-/* Some versions of /bin/login need the TERM supplied on the commandline */
-#undef LOGIN_NEEDS_TERM
-/* Define if your login program cannot handle end of options ("--") */
-#undef LOGIN_NO_ENDOPT
-/* Define if you want to specify the path to your lastlog file */
-#undef CONF_LASTLOG_FILE
-/* Define if you want to specify the path to your utmp file */
-#undef CONF_UTMP_FILE
-/* Define if you want to specify the path to your wtmp file */
-#undef CONF_WTMP_FILE
-/* Define if you want to specify the path to your utmpx file */
-#undef CONF_UTMPX_FILE
-/* Define if you want to specify the path to your wtmpx file */
-#undef CONF_WTMPX_FILE
-/* Define if you want external askpass support */
-#undef USE_EXTERNAL_ASKPASS
-/* Define if libc defines __progname */
-#undef HAVE___PROGNAME
-/* Define if compiler implements __FUNCTION__ */
-#undef HAVE___FUNCTION__
-/* Define if compiler implements __func__ */
-#undef HAVE___func__
-/* Define this is you want GSSAPI support in the version 2 protocol */
-#undef GSSAPI
-/* Define if you want Kerberos 5 support */
-#undef KRB5
-/* Define this if you are using the Heimdal version of Kerberos V5 */
-#undef HEIMDAL
-/* Define this if you want to use libkafs' AFS support */
-#undef USE_AFS
-/* Define if you want S/Key support */
-#undef SKEY
-/* Define if you want TCP Wrappers support */
-#undef LIBWRAP
-/* Define if your libraries define login() */
-#undef HAVE_LOGIN
-/* Define if your libraries define daemon() */
-#undef HAVE_DAEMON
-/* Define if your libraries define getpagesize() */
-#undef HAVE_GETPAGESIZE
-/* Define if xauth is found in your path */
-#undef XAUTH_PATH
-/* Define if you want to allow MD5 passwords */
-#undef HAVE_MD5_PASSWORDS
-/* Define if you want to disable shadow passwords */
-#undef DISABLE_SHADOW
-/* Define if you want to use shadow password expire field */
-#undef HAS_SHADOW_EXPIRE
-/* Define if you have Digital Unix Security Integration Architecture */
-#undef HAVE_OSF_SIA
-/* Define if you have getpwanam(3) [SunOS 4.x] */
-#undef HAVE_GETPWANAM
-/* Define if you have an old version of PAM which takes only one argument */
-/* to pam_strerror */
-#undef HAVE_OLD_PAM
-/* Define if you are using Solaris-derived PAM which passes pam_messages  */
-/* to the conversation function with an extra level of indirection */
-#undef PAM_SUN_CODEBASE
-/* Set this to your mail directory if you don't have maillock.h */
-#undef MAIL_DIRECTORY
-/* Data types */
-#undef HAVE_U_INT
-#undef HAVE_INTXX_T
-#undef HAVE_U_INTXX_T
-#undef HAVE_UINTXX_T
-#undef HAVE_INT64_T
-#undef HAVE_U_INT64_T
-#undef HAVE_U_CHAR
-#undef HAVE_SIZE_T
-#undef HAVE_SSIZE_T
-#undef HAVE_CLOCK_T
-#undef HAVE_MODE_T
-#undef HAVE_PID_T
-#undef HAVE_SA_FAMILY_T
-#undef HAVE_STRUCT_SOCKADDR_STORAGE
-#undef HAVE_STRUCT_ADDRINFO
-#undef HAVE_STRUCT_IN6_ADDR
-#undef HAVE_STRUCT_SOCKADDR_IN6
-/* Fields in struct sockaddr_storage */
-#undef HAVE_SS_FAMILY_IN_SS
-#undef HAVE___SS_FAMILY_IN_SS
-/* Define if you have /dev/ptmx */
-#undef HAVE_DEV_PTMX
-/* Define if you have /dev/ptc */
-#undef HAVE_DEV_PTS_AND_PTC
-/* Define if you need to use IP address instead of hostname in $DISPLAY */
-#undef IPADDR_IN_DISPLAY
-/* Specify default $PATH */
-#undef USER_PATH
-/* Specify location of ssh.pid */
-#undef _PATH_SSH_PIDDIR
-/* getaddrinfo is broken (if present) */
-#undef BROKEN_GETADDRINFO
-/* updwtmpx is broken (if present) */
-#undef BROKEN_UPDWTMPX
-/* Workaround more Linux IPv6 quirks */
-#undef DONT_TRY_OTHER_AF
-/* Detect IPv4 in IPv6 mapped addresses and treat as IPv4 */
-#undef IPV4_IN_IPV6
-/* Define if you have BSD auth support */
-#undef BSD_AUTH
-/* Define if X11 doesn't support AF_UNIX sockets on that system */
-#undef NO_X11_UNIX_SOCKETS
-/* Define if the concept of ports only accessible to superusers isn't known */
-#undef NO_IPPORT_RESERVED_CONCEPT
-/* Needed for SCO and NeXT */
-#undef BROKEN_SAVED_UIDS
-/* Define if your system glob() function has the GLOB_ALTDIRFUNC extension */
-#undef GLOB_HAS_ALTDIRFUNC
-/* Define if your system glob() function has gl_matchc options in glob_t */
-#undef GLOB_HAS_GL_MATCHC
-/* Define in your struct dirent expects you to allocate extra space for d_name */
-#undef BROKEN_ONE_BYTE_DIRENT_D_NAME
-/* Define if your system has /etc/default/login */
-#undef HAVE_ETC_DEFAULT_LOGIN
-/* Define if your getopt(3) defines and uses optreset */
-#undef HAVE_GETOPT_OPTRESET
-/* Define on *nto-qnx systems */
-#undef MISSING_NFDBITS
-/* Define on *nto-qnx systems */
-#undef MISSING_HOWMANY
-/* Define on *nto-qnx systems */
-#undef MISSING_FD_MASK
-/* Define if you want smartcard support */
-#undef SMARTCARD
-/* Define if you want smartcard support using sectok */
-#undef USE_SECTOK
-/* Define if you want smartcard support using OpenSC */
-#undef USE_OPENSC
-/* Define if you want to use OpenSSL's internally seeded PRNG only */
-#undef OPENSSL_PRNG_ONLY
-/* Define if you shouldn't strip 'tty' from your ttyname in [uw]tmp */
-#undef WITH_ABBREV_NO_TTY
-/* Define if you want a different $PATH for the superuser */
-#undef SUPERUSER_PATH
-/* Path that unprivileged child will chroot() to in privep mode */
-#undef PRIVSEP_PATH
-/* Define if your platform needs to skip post auth file descriptor passing */
-#undef DISABLE_FD_PASSING
-/* Silly mkstemp() */
-#undef HAVE_STRICT_MKSTEMP
-/* Some systems put this outside of libc */
-#undef HAVE_NANOSLEEP
-/* Define if sshd somehow reacquires a controlling TTY after setsid() */
-#undef SSHD_ACQUIRES_CTTY
-/* Define if cmsg_type is not passed correctly */
-#undef BROKEN_CMSG_TYPE
-/*
- * Define to whatever link() returns for "not supported" if it doesn't
- * return EOPNOTSUPP.
- */
-#undef LINK_OPNOTSUPP_ERRNO
-/* Strings used in /etc/passwd to denote locked account */
-#undef LOCKED_PASSWD_STRING
-#undef LOCKED_PASSWD_PREFIX
-#undef LOCKED_PASSWD_SUBSTR
-/* Define if getrrsetbyname() exists */
-#undef HAVE_GETRRSETBYNAME
-/* Define if HEADER.ad exists in arpa/nameser.h */
-#undef HAVE_HEADER_AD
-/* Define if your resolver libs need this for getrrsetbyname */
-#undef BIND_8_COMPAT
-/* Define if you have /proc/$pid/fd */
-#undef HAVE_PROC_PID
-@BOTTOM@
-/* ******************* Shouldn't need to edit below this line ************** */
-#endif /* _CONFIG_H */
diff --git a/aclocal.m4 b/aclocal.m4
index 2705a9b23..b68a47080 100644
--- a/aclocal.m4
+++ b/aclocal.m4
@@ -1,4 +1,4 @@
-dnl $Id: aclocal.m4,v 1.5 2001/10/22 00:53:59 tim Exp $
+dnl $Id: aclocal.m4,v 1.6 2005/09/19 16:33:39 tim Exp $
 dnl
 dnl OpenSSH-specific autoconf macros
 dnl
@@ -26,7 +26,7 @@ AC_DEFUN(OSSH_CHECK_HEADER_FOR_FIELD, [
        if test -n "`echo $ossh_varname`"; then
                AC_MSG_RESULT($ossh_result)
                if test "x$ossh_result" = "xyes"; then
-                        AC_DEFINE($3)
+                        AC_DEFINE($3, 1, [Define if you have $1 in $2])
                fi
        else
                AC_MSG_RESULT(no)
diff --git a/auth-krb5.c b/auth-krb5.c
index c7367b49a..64d613543 100644
--- a/auth-krb5.c
+++ b/auth-krb5.c
@@ -28,7 +28,7 @@
 */
 #include "includes.h"
-RCSID("$OpenBSD: auth-krb5.c,v 1.15 2003/11/21 11:57:02 djm Exp $");
+RCSID("$OpenBSD: auth-krb5.c,v 1.16 2005/11/21 09:42:10 dtucker Exp $");
 #include "ssh.h"
 #include "ssh1.h"
@@ -69,9 +69,6 @@ auth_krb5_password(Authctxt *authctxt, const char *password)
        krb5_ccache ccache = NULL;
        int len;
-        if (!authctxt->valid)
-                return (0);
        temporarily_use_uid(authctxt->pw);
        problem = krb5_init(authctxt);
@@ -188,7 +185,7 @@ auth_krb5_password(Authctxt *authctxt, const char *password)
                else
                        return (0);
        }
-        return (1);
+        return (authctxt->valid ? 1 : 0);
 }
 void
@@ -218,7 +215,7 @@ ssh_krb5_cc_gen(krb5_context ctx, krb5_ccache *ccache) {
        ret = snprintf(ccname, sizeof(ccname),
            "FILE:/tmp/krb5cc_%d_XXXXXXXXXX", geteuid());
-        if (ret == -1 || ret >= sizeof(ccname))
+        if (ret < 0 || (size_t)ret >= sizeof(ccname))
                return ENOMEM;
        old_umask = umask(0177);
diff --git a/auth-options.c b/auth-options.c
index a85e40835..ad97e6129 100644
--- a/auth-options.c
+++ b/auth-options.c
@@ -10,7 +10,7 @@
 */
 #include "includes.h"
-RCSID("$OpenBSD: auth-options.c,v 1.31 2005/03/10 22:40:38 deraadt Exp $");
+RCSID("$OpenBSD: auth-options.c,v 1.33 2005/12/08 18:34:11 reyk Exp $");
 #include "xmalloc.h"
 #include "match.h"
@@ -35,6 +35,9 @@ char *forced_command = NULL;
 /* "environment=" options. */
 struct envstring *custom_environment = NULL;
+/* "tunnel=" option. */
+int forced_tun_device = -1;
 extern ServerOptions options;
 void
@@ -54,6 +57,7 @@ auth_clear_options(void)
                xfree(forced_command);
                forced_command = NULL;
        }
+        forced_tun_device = -1;
        channel_clear_permitted_opens();
        auth_debug_reset();
 }
@@ -269,6 +273,41 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
                        xfree(patterns);
                        goto next_option;
                }
+                cp = "tunnel=\"";
+                if (strncasecmp(opts, cp, strlen(cp)) == 0) {
+                        char *tun = NULL;
+                        opts += strlen(cp);
+                        tun = xmalloc(strlen(opts) + 1);
+                        i = 0;
+                        while (*opts) {
+                                if (*opts == '"')
+                                        break;
+                                tun[i++] = *opts++;
+                        }
+                        if (!*opts) {
+                                debug("%.100s, line %lu: missing end quote",
+                                    file, linenum);
+                                auth_debug_add("%.100s, line %lu: missing end quote",
+                                    file, linenum);
+                                xfree(tun);
+                                forced_tun_device = -1;
+                                goto bad_option;
+                        }
+                        tun[i] = 0;
+                        forced_tun_device = a2tun(tun, NULL);
+                        xfree(tun);
+                        if (forced_tun_device == SSH_TUNID_ERR) {
+                                debug("%.100s, line %lu: invalid tun device",
+                                    file, linenum);
+                                auth_debug_add("%.100s, line %lu: invalid tun device",
+                                    file, linenum);
+                                forced_tun_device = -1;
+                                goto bad_option;
+                        }
+                        auth_debug_add("Forced tun device: %d", forced_tun_device);
+                        opts++;
+                        goto next_option;
+                }
 next_option:
                /*
                 * Skip the comma, and move to the next option
diff --git a/auth-options.h b/auth-options.h
index 15fb21255..3cd02a71f 100644
--- a/auth-options.h
+++ b/auth-options.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: auth-options.h,v 1.12 2002/07/21 18:34:43 stevesk Exp $       */
+/*      $OpenBSD: auth-options.h,v 1.13 2005/12/06 22:38:27 reyk Exp $  */
 /*
 * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -28,6 +28,7 @@ extern int no_x11_forwarding_flag;
 extern int no_pty_flag;
 extern char *forced_command;
 extern struct envstring *custom_environment;
+extern int forced_tun_device;
 int     auth_parse_options(struct passwd *, char *, char *, u_long);
 void    auth_clear_options(void);
diff --git a/auth-pam.c b/auth-pam.c
index 0446cd559..fb9ae954a 100644
--- a/auth-pam.c
+++ b/auth-pam.c
@@ -47,7 +47,7 @@
 /* Based on $FreeBSD: src/crypto/openssh/auth2-pam-freebsd.c,v 1.11 2003/03/31 13:48:18 des Exp $ */
 #include "includes.h"
-RCSID("$Id: auth-pam.c,v 1.126 2005/07/17 07:18:50 djm Exp $");
+RCSID("$Id: auth-pam.c,v 1.128 2006/01/29 05:46:13 dtucker Exp $");
 #ifdef USE_PAM
 #if defined(HAVE_SECURITY_PAM_APPL_H)
@@ -716,8 +716,18 @@ sshpam_query(void *ctx, char **name, char **info,
                        plen++;
                        xfree(msg);
                        break;
-                case PAM_SUCCESS:
                case PAM_AUTH_ERR:
+                        debug3("PAM: PAM_AUTH_ERR");
+                        if (**prompts != NULL && strlen(**prompts) != 0) {
+                                *info = **prompts;
+                                **prompts = NULL;
+                                *num = 0;
+                                **echo_on = 0;
+                                ctxt->pam_done = -1;
+                                return 0;
+                        }
+                        /* FALLTHROUGH */
+                case PAM_SUCCESS:
                        if (**prompts != NULL) {
                                /* drain any accumulated messages */
                                debug("PAM: %s", **prompts);
@@ -763,7 +773,7 @@ sshpam_respond(void *ctx, u_int num, char **resp)
        Buffer buffer;
        struct pam_ctxt *ctxt = ctx;
-        debug2("PAM: %s entering, %d responses", __func__, num);
+        debug2("PAM: %s entering, %u responses", __func__, num);
        switch (ctxt->pam_done) {
        case 1:
                sshpam_authenticated = 1;
diff --git a/auth2-gss.c b/auth2-gss.c
index 9295d531b..a6a9c05cd 100644
--- a/auth2-gss.c
+++ b/auth2-gss.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: auth2-gss.c,v 1.10 2005/07/17 07:17:54 djm Exp $      */
+/*      $OpenBSD: auth2-gss.c,v 1.12 2005/10/13 22:24:31 stevesk Exp $  */
 /*
 * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
@@ -34,7 +34,6 @@
 #include "log.h"
 #include "dispatch.h"
 #include "servconf.h"
-#include "compat.h"
 #include "packet.h"
 #include "monitor_wrap.h"
@@ -82,7 +81,7 @@ userauth_gsskeyex(Authctxt *authctxt)
 /*
 * We only support those mechanisms that we know about (ie ones that we know
- * how to check local user kuserok and the like
+ * how to check local user kuserok and the like)
 */
 static int
 userauth_gssapi(Authctxt *authctxt)
@@ -138,7 +137,7 @@ userauth_gssapi(Authctxt *authctxt)
                return (0);
        }
-        authctxt->methoddata=(void *)ctxt;
+        authctxt->methoddata = (void *)ctxt;
        packet_start(SSH2_MSG_USERAUTH_GSSAPI_RESPONSE);
diff --git a/auth2.c b/auth2.c
index bb25597e7..f12440815 100644
--- a/auth2.c
+++ b/auth2.c
@@ -163,21 +163,17 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
                if (authctxt->pw && strcmp(service, "ssh-connection")==0) {
                        authctxt->valid = 1;
                        debug2("input_userauth_request: setting up authctxt for %s", user);
-#ifdef USE_PAM
-                        if (options.use_pam)
-                                PRIVSEP(start_pam(authctxt));
-#endif
                } else {
                        logit("input_userauth_request: invalid user %s", user);
                        authctxt->pw = fakepw();
-#ifdef USE_PAM
-                        if (options.use_pam)
-                                PRIVSEP(start_pam(authctxt));
-#endif
 #ifdef SSH_AUDIT_EVENTS
                        PRIVSEP(audit_event(SSH_INVALID_USER));
 #endif
                }
+#ifdef USE_PAM
+                if (options.use_pam)
+                        PRIVSEP(start_pam(authctxt));
+#endif
                setproctitle("%s%s", authctxt->valid ? user : "unknown",
                    use_privsep ? " [net]" : "");
                authctxt->service = xstrdup(service);
diff --git a/bufaux.c b/bufaux.c
index 8d096a056..106a3a0c7 100644
--- a/bufaux.c
+++ b/bufaux.c
@@ -37,7 +37,7 @@
 */
 #include "includes.h"
-RCSID("$OpenBSD: bufaux.c,v 1.36 2005/06/17 02:44:32 djm Exp $");
+RCSID("$OpenBSD: bufaux.c,v 1.37 2005/11/05 05:01:15 djm Exp $");
 #include <openssl/bn.h>
 #include "bufaux.h"
@@ -63,6 +63,7 @@ buffer_put_bignum_ret(Buffer *buffer, const BIGNUM *value)
        if (oi != bin_size) {
                error("buffer_put_bignum_ret: BN_bn2bin() failed: oi %d != bin_size %d",
                    oi, bin_size);
+                xfree(buf);
                return (-1);
        }
@@ -187,10 +188,12 @@ buffer_get_bignum2_ret(Buffer *buffer, BIGNUM *value)
        if (len > 0 && (bin[0] & 0x80)) {
                error("buffer_get_bignum2_ret: negative numbers not supported");
+                xfree(bin);
                return (-1);
        }
        if (len > 8 * 1024) {
                error("buffer_get_bignum2_ret: cannot handle BN of size %d", len);
+                xfree(bin);
                return (-1);
        }
        BN_bin2bn(bin, len, value);
diff --git a/buildpkg.sh.in b/buildpkg.sh.in
index f90ae6e81..cb9eb3048 100644
--- a/buildpkg.sh.in
+++ b/buildpkg.sh.in
@@ -353,7 +353,7 @@ else
        # Create user if required
        [ "\$DO_PASSWD" = yes ]  &&  {
                # Use uid of 67 if possible
-                if cut -f3 -d: \${PKG_INSTALL_ROOT}/etc/passwd | egrep '^'$SSHDGID'\$' >/dev/null
+                if cut -f3 -d: \${PKG_INSTALL_ROOT}/etc/passwd | egrep '^'$SSHDUID'\$' >/dev/null
                then
                        :
                else
diff --git a/canohost.c b/canohost.c
index c27086bfd..6ca60e6b4 100644
--- a/canohost.c
+++ b/canohost.c
@@ -12,7 +12,7 @@
 */
 #include "includes.h"
-RCSID("$OpenBSD: canohost.c,v 1.44 2005/06/17 02:44:32 djm Exp $");
+RCSID("$OpenBSD: canohost.c,v 1.48 2005/12/28 22:46:06 stevesk Exp $");
 #include "packet.h"
 #include "xmalloc.h"
@@ -43,9 +43,6 @@ get_remote_hostname(int sock, int use_dns)
                cleanup_exit(255);
        }
-        if (from.ss_family == AF_INET)
-                check_ip_options(sock, ntop);
        ipv64_normalise_mapped(&from, &fromlen);
        if (from.ss_family == AF_INET6)
@@ -55,6 +52,9 @@ get_remote_hostname(int sock, int use_dns)
            NULL, 0, NI_NUMERICHOST) != 0)
                fatal("get_remote_hostname: getnameinfo NI_NUMERICHOST failed");
+        if (from.ss_family == AF_INET)
+                check_ip_options(sock, ntop);
        if (!use_dns)
                return xstrdup(ntop);
@@ -102,7 +102,7 @@ get_remote_hostname(int sock, int use_dns)
        hints.ai_socktype = SOCK_STREAM;
        if (getaddrinfo(name, NULL, &hints, &aitop) != 0) {
                logit("reverse mapping checking getaddrinfo for %.700s "
-                    "failed - POSSIBLE BREAKIN ATTEMPT!", name);
+                    "failed - POSSIBLE BREAK-IN ATTEMPT!", name);
                return xstrdup(ntop);
        }
        /* Look for the address from the list of addresses. */
@@ -117,7 +117,7 @@ get_remote_hostname(int sock, int use_dns)
        if (!ai) {
                /* Address not found for the host name. */
                logit("Address %.100s maps to %.600s, but this does not "
-                    "map back to the address - POSSIBLE BREAKIN ATTEMPT!",
+                    "map back to the address - POSSIBLE BREAK-IN ATTEMPT!",
                    ntop, name);
                return xstrdup(ntop);
        }
@@ -158,9 +158,7 @@ check_ip_options(int sock, char *ipaddr)
                for (i = 0; i < option_size; i++)
                        snprintf(text + i*3, sizeof(text) - i*3,
                            " %2.2x", options[i]);
-                logit("Connection from %.100s with IP options:%.800s",
+                fatal("Connection from %.100s with IP options:%.800s",
-                    ipaddr, text);
-                packet_disconnect("Connection from %.100s with IP options:%.800s",
                    ipaddr, text);
        }
 #endif /* IP_OPTIONS */
@@ -200,26 +198,27 @@ ipv64_normalise_mapped(struct sockaddr_storage *addr, socklen_t *len)
 const char *
 get_canonical_hostname(int use_dns)
 {
+        char *host;
        static char *canonical_host_name = NULL;
-        static int use_dns_done = 0;
+        static char *remote_ip = NULL;
        /* Check if we have previously retrieved name with same option. */
-        if (canonical_host_name != NULL) {
+        if (use_dns && canonical_host_name != NULL)
-                if (use_dns_done != use_dns)
+                return canonical_host_name;
-                        xfree(canonical_host_name);
+        if (!use_dns && remote_ip != NULL)
-                else
+                return remote_ip;
-                        return canonical_host_name;
-        }
        /* Get the real hostname if socket; otherwise return UNKNOWN. */
        if (packet_connection_is_on_socket())
-                canonical_host_name = get_remote_hostname(
+                host = get_remote_hostname(packet_get_connection_in(), use_dns);
-                    packet_get_connection_in(), use_dns);
        else
-                canonical_host_name = xstrdup("UNKNOWN");
+                host = "UNKNOWN";
-        use_dns_done = use_dns;
+        if (use_dns)
-        return canonical_host_name;
+                canonical_host_name = host;
+        else
+                remote_ip = host;
+        return host;
 }
 /*
diff --git a/channels.c b/channels.c
index 707b57d86..92448da77 100644
--- a/channels.c
+++ b/channels.c
@@ -39,7 +39,7 @@
 */
 #include "includes.h"
-RCSID("$OpenBSD: channels.c,v 1.223 2005/07/17 07:17:54 djm Exp $");
+RCSID("$OpenBSD: channels.c,v 1.232 2006/01/30 12:22:22 reyk Exp $");
 #include "ssh.h"
 #include "ssh1.h"
@@ -58,8 +58,6 @@ RCSID("$OpenBSD: channels.c,v 1.223 2005/07/17 07:17:54 djm Exp $");
 /* -- channel core */
-#define CHAN_RBUF       16*1024
 /*
 * Pointer to an array containing all allocated channels.  The array is
 * dynamically extended as needed.
@@ -142,23 +140,51 @@ static void port_open_helper(Channel *c, char *rtype);
 /* -- channel core */
 Channel *
-channel_lookup(int id)
+channel_by_id(int id)
 {
        Channel *c;
        if (id < 0 || (u_int)id >= channels_alloc) {
-                logit("channel_lookup: %d: bad id", id);
+                logit("channel_by_id: %d: bad id", id);
                return NULL;
        }
        c = channels[id];
        if (c == NULL) {
-                logit("channel_lookup: %d: bad id: channel free", id);
+                logit("channel_by_id: %d: bad id: channel free", id);
                return NULL;
        }
        return c;
 }
 /*
+ * Returns the channel if it is allowed to receive protocol messages.
+ * Private channels, like listening sockets, may not receive messages.
+ */
+Channel *
+channel_lookup(int id)
+{
+        Channel *c;
+        if ((c = channel_by_id(id)) == NULL)
+                return (NULL);
+        switch(c->type) {
+        case SSH_CHANNEL_X11_OPEN:
+        case SSH_CHANNEL_LARVAL:
+        case SSH_CHANNEL_CONNECTING:
+        case SSH_CHANNEL_DYNAMIC:
+        case SSH_CHANNEL_OPENING:
+        case SSH_CHANNEL_OPEN:
+        case SSH_CHANNEL_INPUT_DRAINING:
+        case SSH_CHANNEL_OUTPUT_DRAINING:
+                return (c);
+                break;
+        }
+        logit("Non-public channel %d, type %d.", id, c->type);
+        return (NULL);
+}
+/*
 * Register filedescriptors for a channel, used when allocating a channel or
 * when the channel consumer/producer is ready, e.g. shell exec'd
 */
@@ -269,9 +295,11 @@ channel_new(char *ctype, int type, int rfd, int wfd, int efd,
        c->force_drain = 0;
        c->single_connection = 0;
        c->detach_user = NULL;
+        c->detach_close = 0;
        c->confirm = NULL;
        c->confirm_ctx = NULL;
        c->input_filter = NULL;
+        c->output_filter = NULL;
        debug("channel %d: new [%s]", found, remote_name);
        return c;
 }
@@ -628,29 +656,32 @@ channel_register_confirm(int id, channel_callback_fn *fn, void *ctx)
        c->confirm_ctx = ctx;
 }
 void
-channel_register_cleanup(int id, channel_callback_fn *fn)
+channel_register_cleanup(int id, channel_callback_fn *fn, int do_close)
 {
-        Channel *c = channel_lookup(id);
+        Channel *c = channel_by_id(id);
        if (c == NULL) {
                logit("channel_register_cleanup: %d: bad id", id);
                return;
        }
        c->detach_user = fn;
+        c->detach_close = do_close;
 }
 void
 channel_cancel_cleanup(int id)
 {
-        Channel *c = channel_lookup(id);
+        Channel *c = channel_by_id(id);
        if (c == NULL) {
                logit("channel_cancel_cleanup: %d: bad id", id);
                return;
        }
        c->detach_user = NULL;
+        c->detach_close = 0;
 }
 void
-channel_register_filter(int id, channel_filter_fn *fn)
+channel_register_filter(int id, channel_infilter_fn *ifn,
+    channel_outfilter_fn *ofn)
 {
        Channel *c = channel_lookup(id);
@@ -658,7 +689,8 @@ channel_register_filter(int id, channel_filter_fn *fn)
                logit("channel_register_filter: %d: bad id", id);
                return;
        }
-        c->input_filter = fn;
+        c->input_filter = ifn;
+        c->output_filter = ofn;
 }
 void
@@ -1227,6 +1259,19 @@ port_open_helper(Channel *c, char *rtype)
        xfree(remote_ipaddr);
 }
+static void
+channel_set_reuseaddr(int fd)
+{
+        int on = 1;
+        /*
+         * Set socket options.
+         * Allow local port reuse in TIME_WAIT.
+         */
+        if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on)) == -1)
+                error("setsockopt SO_REUSEADDR fd %d: %s", fd, strerror(errno));
+}
 /*
 * This socket is listening for connections to a forwarded TCP/IP port.
 */
@@ -1398,6 +1443,8 @@ channel_handle_rfd(Channel *c, fd_set * readset, fd_set * writeset)
                                debug2("channel %d: filter stops", c->self);
                                chan_read_failed(c);
                        }
+                } else if (c->datagram) {
+                        buffer_put_string(&c->input, buf, len);
                } else {
                        buffer_append(&c->input, buf, len);
                }
@@ -1408,7 +1455,7 @@ static int
 channel_handle_wfd(Channel *c, fd_set * readset, fd_set * writeset)
 {
        struct termios tio;
-        u_char *data;
+        u_char *data = NULL, *buf;
        u_int dlen;
        int len;
@@ -1416,14 +1463,45 @@ channel_handle_wfd(Channel *c, fd_set * readset, fd_set * writeset)
        if (c->wfd != -1 &&
            FD_ISSET(c->wfd, writeset) &&
            buffer_len(&c->output) > 0) {
-                data = buffer_ptr(&c->output);
+                if (c->output_filter != NULL) {
-                dlen = buffer_len(&c->output);
+                        if ((buf = c->output_filter(c, &data, &dlen)) == NULL) {
+                                debug2("channel %d: filter stops", c->self);
+                                if (c->type != SSH_CHANNEL_OPEN)
+                                        chan_mark_dead(c);
+                                else
+                                        chan_write_failed(c);
+                                return -1;
+                        }
+                } else if (c->datagram) {
+                        buf = data = buffer_get_string(&c->output, &dlen);
+                } else {
+                        buf = data = buffer_ptr(&c->output);
+                        dlen = buffer_len(&c->output);
+                }
+                if (c->datagram) {
+                        /* ignore truncated writes, datagrams might get lost */
+                        c->local_consumed += dlen + 4;
+                        len = write(c->wfd, buf, dlen);
+                        xfree(data);
+                        if (len < 0 && (errno == EINTR || errno == EAGAIN))
+                                return 1;
+                        if (len <= 0) {
+                                if (c->type != SSH_CHANNEL_OPEN)
+                                        chan_mark_dead(c);
+                                else
+                                        chan_write_failed(c);
+                                return -1;
+                        }
+                        return 1;
+                }
 #ifdef _AIX
                /* XXX: Later AIX versions can't push as much data to tty */
                if (compat20 && c->wfd_isatty)
                        dlen = MIN(dlen, 8*1024);
 #endif
-                len = write(c->wfd, data, dlen);
+                len = write(c->wfd, buf, dlen);
                if (len < 0 && (errno == EINTR || errno == EAGAIN))
                        return 1;
                if (len <= 0) {
@@ -1440,14 +1518,14 @@ channel_handle_wfd(Channel *c, fd_set * readset, fd_set * writeset)
                        }
                        return -1;
                }
-                if (compat20 && c->isatty && dlen >= 1 && data[0] != '\r') {
+                if (compat20 && c->isatty && dlen >= 1 && buf[0] != '\r') {
                        if (tcgetattr(c->wfd, &tio) == 0 &&
                            !(tio.c_lflag & ECHO) && (tio.c_lflag & ICANON)) {
                                /*
                                 * Simulate echo to reduce the impact of
                                 * traffic analysis. We need to match the
                                 * size of a SSH2_MSG_CHANNEL_DATA message
-                                 * (4 byte channel id + data)
+                                 * (4 byte channel id + buf)
                                 */
                                packet_send_ignore(4 + len);
                                packet_send();
@@ -1666,7 +1744,7 @@ channel_garbage_collect(Channel *c)
        if (c == NULL)
                return;
        if (c->detach_user != NULL) {
-                if (!chan_is_dead(c, 0))
+                if (!chan_is_dead(c, c->detach_close))
                        return;
                debug2("channel %d: gc: notify user", c->self);
                c->detach_user(c->self, NULL);
@@ -1776,6 +1854,22 @@ channel_output_poll(void)
                if ((c->istate == CHAN_INPUT_OPEN ||
                    c->istate == CHAN_INPUT_WAIT_DRAIN) &&
                    (len = buffer_len(&c->input)) > 0) {
+                        if (c->datagram) {
+                                if (len > 0) {
+                                        u_char *data;
+                                        u_int dlen;
+                                        data = buffer_get_string(&c->input,
+                                            &dlen);
+                                        packet_start(SSH2_MSG_CHANNEL_DATA);
+                                        packet_put_int(c->remote_id);
+                                        packet_put_string(data, dlen);
+                                        packet_send();
+                                        c->remote_window -= dlen + 4;
+                                        xfree(data);
+                                }
+                                continue;
+                        }
                        /*
                         * Send some data for the other side over the secure
                         * connection.
@@ -1898,7 +1992,10 @@ channel_input_data(int type, u_int32_t seq, void *ctxt)
                c->local_window -= data_len;
        }
        packet_check_eom();
-        buffer_append(&c->output, data, data_len);
+        if (c->datagram)
+                buffer_put_string(&c->output, data, data_len);
+        else
+                buffer_append(&c->output, data, data_len);
        xfree(data);
 }
@@ -2129,9 +2226,8 @@ channel_input_window_adjust(int type, u_int32_t seq, void *ctxt)
        id = packet_get_int();
        c = channel_lookup(id);
-        if (c == NULL || c->type != SSH_CHANNEL_OPEN) {
+        if (c == NULL) {
-                logit("Received window adjust for "
+                logit("Received window adjust for non-open channel %d.", id);
-                    "non-open channel %d.", id);
                return;
        }
        adjust = packet_get_int();
@@ -2188,7 +2284,7 @@ channel_setup_fwd_listener(int type, const char *listen_addr, u_short listen_por
    const char *host_to_connect, u_short port_to_connect, int gateway_ports)
 {
        Channel *c;
-        int sock, r, success = 0, on = 1, wildcard = 0, is_client;
+        int sock, r, success = 0, wildcard = 0, is_client;
        struct addrinfo hints, *ai, *aitop;
        const char *host, *addr;
        char ntop[NI_MAXHOST], strport[NI_MAXSERV];
@@ -2275,13 +2371,8 @@ channel_setup_fwd_listener(int type, const char *listen_addr, u_short listen_por
                        verbose("socket: %.100s", strerror(errno));
                        continue;
                }
-                /*
-                 * Set socket options.
+                channel_set_reuseaddr(sock);
-                 * Allow local port reuse in TIME_WAIT.
-                 */
-                if (setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &on,
-                    sizeof(on)) == -1)
-                        error("setsockopt SO_REUSEADDR: %s", strerror(errno));
                debug("Local forwarding listening on %s port %s.", ntop, strport);
@@ -2453,7 +2544,7 @@ channel_request_rforward_cancel(const char *host, u_short port)
        permitted_opens[i].listen_port = 0;
        permitted_opens[i].port_to_connect = 0;
-        free(permitted_opens[i].host_to_connect);
+        xfree(permitted_opens[i].host_to_connect);
        permitted_opens[i].host_to_connect = NULL;
 }
@@ -2668,6 +2759,9 @@ x11_create_display_inet(int x11_display_offset, int x11_use_localhost,
        char strport[NI_MAXSERV];
        int gaierr, n, num_socks = 0, socks[NUM_SOCKS];
+        if (chanids == NULL)
+                return -1;
        for (display_number = x11_display_offset;
            display_number < MAX_DISPLAYS;
            display_number++) {
@@ -2708,6 +2802,7 @@ x11_create_display_inet(int x11_display_offset, int x11_use_localhost,
                                        error("setsockopt IPV6_V6ONLY: %.100s", strerror(errno));
                        }
 #endif
+                        channel_set_reuseaddr(sock);
                        if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
                                debug2("bind port %d: %.100s", port, strerror(errno));
                                close(sock);
@@ -2753,8 +2848,7 @@ x11_create_display_inet(int x11_display_offset, int x11_use_localhost,
        }
        /* Allocate a channel for each socket. */
-        if (chanids != NULL)
+        *chanids = xmalloc(sizeof(**chanids) * (num_socks + 1));
-                *chanids = xmalloc(sizeof(**chanids) * (num_socks + 1));
        for (n = 0; n < num_socks; n++) {
                sock = socks[n];
                nc = channel_new("x11 listener",
@@ -2762,11 +2856,9 @@ x11_create_display_inet(int x11_display_offset, int x11_use_localhost,
                    CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
                    0, "X11 inet listener", 1);
                nc->single_connection = single_connection;
-                if (*chanids != NULL)
+                (*chanids)[n] = nc->self;
-                        (*chanids)[n] = nc->self;
        }
-        if (*chanids != NULL)
+        (*chanids)[n] = -1;
-                (*chanids)[n] = -1;
        /* Return the display number for the DISPLAY environment variable. */
        *display_numberp = display_number;
@@ -2952,7 +3044,7 @@ deny_input_open(int type, u_int32_t seq, void *ctxt)
                error("deny_input_open: type %d", type);
                break;
        }
-        error("Warning: this is probably a break in attempt by a malicious server.");
+        error("Warning: this is probably a break-in attempt by a malicious server.");
        packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
        packet_put_int(rchan);
        packet_send();
diff --git a/channels.h b/channels.h
index 1cb2c3a34..a97dd9007 100644
--- a/channels.h
+++ b/channels.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: channels.h,v 1.79 2005/07/17 06:49:04 djm Exp $       */
+/*      $OpenBSD: channels.h,v 1.83 2005/12/30 15:56:37 reyk Exp $      */
 /*
 * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -63,7 +63,8 @@ struct Channel;
 typedef struct Channel Channel;
 typedef void channel_callback_fn(int, void *);
-typedef int channel_filter_fn(struct Channel *, char *, int);
+typedef int channel_infilter_fn(struct Channel *, char *, int);
+typedef u_char *channel_outfilter_fn(struct Channel *, u_char **, u_int *);
 struct Channel {
        int     type;           /* channel type/state */
@@ -106,11 +107,15 @@ struct Channel {
        /* callback */
        channel_callback_fn     *confirm;
-        channel_callback_fn     *detach_user;
        void                    *confirm_ctx;
+        channel_callback_fn     *detach_user;
+        int                     detach_close;
        /* filter */
-        channel_filter_fn       *input_filter;
+        channel_infilter_fn     *input_filter;
+        channel_outfilter_fn    *output_filter;
+        int     datagram;       /* keep boundaries */
 };
 #define CHAN_EXTENDED_IGNORE            0
@@ -142,6 +147,8 @@ struct Channel {
 #define CHAN_EOF_SENT                   0x04
 #define CHAN_EOF_RCVD                   0x08
+#define CHAN_RBUF       16*1024
 /* check whether 'efd' is still in use */
 #define CHANNEL_EFD_INPUT_ACTIVE(c) \
        (compat20 && c->extended_usage == CHAN_EXTENDED_READ && \
@@ -154,6 +161,7 @@ struct Channel {
 /* channel management */
+Channel *channel_by_id(int);
 Channel *channel_lookup(int);
 Channel *channel_new(char *, int, int, int, int, u_int, u_int, int, char *, int);
 void     channel_set_fds(int, int, int, int, int, int, u_int);
@@ -163,9 +171,9 @@ void	 channel_stop_listening(void);
 void     channel_send_open(int);
 void     channel_request_start(int, char *, int);
-void     channel_register_cleanup(int, channel_callback_fn *);
+void     channel_register_cleanup(int, channel_callback_fn *, int);
 void     channel_register_confirm(int, channel_callback_fn *, void *);
-void     channel_register_filter(int, channel_filter_fn *);
+void     channel_register_filter(int, channel_infilter_fn *, channel_outfilter_fn *);
 void     channel_cancel_cleanup(int);
 int      channel_close_fd(int *);
 void     channel_send_window_changes(void);
diff --git a/cipher-aes.c b/cipher-aes.c
index 22d500d42..228ddb104 100644
--- a/cipher-aes.c
+++ b/cipher-aes.c
@@ -23,7 +23,11 @@
 */
 #include "includes.h"
-#if OPENSSL_VERSION_NUMBER < 0x00907000L
+/* compatibility with old or broken OpenSSL versions */
+#include "openbsd-compat/openssl-compat.h"
+#ifdef USE_BUILTIN_RIJNDAEL
 RCSID("$OpenBSD: cipher-aes.c,v 1.2 2003/11/26 21:44:29 djm Exp $");
 #include <openssl/evp.h>
@@ -31,10 +35,6 @@ RCSID("$OpenBSD: cipher-aes.c,v 1.2 2003/11/26 21:44:29 djm Exp $");
 #include "xmalloc.h"
 #include "log.h"
-#if OPENSSL_VERSION_NUMBER < 0x00906000L
-#define SSH_OLD_EVP
-#endif
 #define RIJNDAEL_BLOCKSIZE 16
 struct ssh_rijndael_ctx
 {
@@ -157,4 +157,4 @@ evp_rijndael(void)
 #endif
        return (&rijndal_cbc);
 }
-#endif /* OPENSSL_VERSION_NUMBER */
+#endif /* USE_BUILTIN_RIJNDAEL */
diff --git a/cipher-ctr.c b/cipher-ctr.c
index 856177349..8a98f3c42 100644
--- a/cipher-ctr.c
+++ b/cipher-ctr.c
@@ -21,11 +21,10 @@ RCSID("$OpenBSD: cipher-ctr.c,v 1.6 2005/07/17 07:17:55 djm Exp $");
 #include "log.h"
 #include "xmalloc.h"
-#if OPENSSL_VERSION_NUMBER < 0x00906000L
+/* compatibility with old or broken OpenSSL versions */
-#define SSH_OLD_EVP
+#include "openbsd-compat/openssl-compat.h"
-#endif
-#if OPENSSL_VERSION_NUMBER < 0x00907000L
+#ifdef USE_BUILTIN_RIJNDAEL
 #include "rijndael.h"
 #define AES_KEY rijndael_ctx
 #define AES_BLOCK_SIZE 16
diff --git a/cipher.c b/cipher.c
index 0dddf270a..1434d5524 100644
--- a/cipher.c
+++ b/cipher.c
@@ -334,7 +334,7 @@ cipher_get_keyiv(CipherContext *cc, u_char *iv, u_int len)
                if ((u_int)evplen != len)
                        fatal("%s: wrong iv length %d != %d", __func__,
                            evplen, len);
-#if OPENSSL_VERSION_NUMBER < 0x00907000L
+#ifdef USE_BUILTIN_RIJNDAEL
                if (c->evptype == evp_rijndael)
                        ssh_rijndael_iv(&cc->evp, 0, iv, len);
                else
@@ -365,7 +365,7 @@ cipher_set_keyiv(CipherContext *cc, u_char *iv)
                evplen = EVP_CIPHER_CTX_iv_length(&cc->evp);
                if (evplen == 0)
                        return;
-#if OPENSSL_VERSION_NUMBER < 0x00907000L
+#ifdef USE_BUILTIN_RIJNDAEL
                if (c->evptype == evp_rijndael)
                        ssh_rijndael_iv(&cc->evp, 1, iv, evplen);
                else
diff --git a/clientloop.c b/clientloop.c
index 6a35c8e3e..5621768b5 100644
--- a/clientloop.c
+++ b/clientloop.c
@@ -59,7 +59,7 @@
 */
 #include "includes.h"
-RCSID("$OpenBSD: clientloop.c,v 1.141 2005/07/16 01:35:24 djm Exp $");
+RCSID("$OpenBSD: clientloop.c,v 1.149 2005/12/30 15:56:37 reyk Exp $");
 #include "ssh.h"
 #include "ssh1.h"
@@ -77,6 +77,7 @@ RCSID("$OpenBSD: clientloop.c,v 1.141 2005/07/16 01:35:24 djm Exp $");
 #include "log.h"
 #include "readconf.h"
 #include "clientloop.h"
+#include "sshconnect.h"
 #include "authfd.h"
 #include "atomicio.h"
 #include "sshpty.h"
@@ -113,7 +114,7 @@ extern char *host;
 static volatile sig_atomic_t received_window_change_signal = 0;
 static volatile sig_atomic_t received_signal = 0;
-/* Flag indicating whether the user\'s terminal is in non-blocking mode. */
+/* Flag indicating whether the user's terminal is in non-blocking mode. */
 static int in_non_blocking_mode = 0;
 /* Common data for the client loop code. */
@@ -266,7 +267,7 @@ client_x11_get_proto(const char *display, const char *xauth_path,
                        }
                }
                snprintf(cmd, sizeof(cmd),
-                    "%s %s%s list %s . 2>" _PATH_DEVNULL,
+                    "%s %s%s list %s 2>" _PATH_DEVNULL,
                    xauth_path,
                    generated ? "-f " : "" ,
                    generated ? xauthfile : "",
@@ -919,6 +920,15 @@ process_cmdline(void)
                logit("      -Lport:host:hostport    Request local forward");
                logit("      -Rport:host:hostport    Request remote forward");
                logit("      -KRhostport             Cancel remote forward");
+                if (!options.permit_local_command)
+                        goto out;
+                logit("      !args                   Execute local command");
+                goto out;
+        }
+        if (*s == '!' && options.permit_local_command) {
+                s++;
+                ssh_local_cmd(s);
                goto out;
        }
@@ -1381,10 +1391,10 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
                session_ident = ssh2_chan_id;
                if (escape_char != SSH_ESCAPECHAR_NONE)
                        channel_register_filter(session_ident,
-                            simple_escape_filter);
+                            simple_escape_filter, NULL);
                if (session_ident != -1)
                        channel_register_cleanup(session_ident,
-                            client_channel_closed);
+                            client_channel_closed, 0);
        } else {
                /* Check if we should immediately send eof on stdin. */
                client_check_initial_eof_on_stdin();
@@ -1685,7 +1695,7 @@ client_request_x11(const char *request_type, int rchan)
        if (!options.forward_x11) {
                error("Warning: ssh server tried X11 forwarding.");
-                error("Warning: this is probably a break in attempt by a malicious server.");
+                error("Warning: this is probably a break-in attempt by a malicious server.");
                return NULL;
        }
        originator = packet_get_string(NULL);
@@ -1718,7 +1728,7 @@ client_request_agent(const char *request_type, int rchan)
        if (!options.forward_agent) {
                error("Warning: ssh server tried agent forwarding.");
-                error("Warning: this is probably a break in attempt by a malicious server.");
+                error("Warning: this is probably a break-in attempt by a malicious server.");
                return NULL;
        }
        sock =  ssh_get_authentication_socket();
@@ -1887,7 +1897,7 @@ client_session2_setup(int id, int want_tty, int want_subsystem,
                        /* Split */
                        name = xstrdup(env[i]);
                        if ((val = strchr(name, '=')) == NULL) {
-                                free(name);
+                                xfree(name);
                                continue;
                        }
                        *val++ = '\0';
@@ -1901,7 +1911,7 @@ client_session2_setup(int id, int want_tty, int want_subsystem,
                        }
                        if (!matched) {
                                debug3("Ignored env %s", name);
-                                free(name);
+                                xfree(name);
                                continue;
                        }
@@ -1910,7 +1920,7 @@ client_session2_setup(int id, int want_tty, int want_subsystem,
                        packet_put_cstring(name);
                        packet_put_cstring(val);
                        packet_send();
-                        free(name);
+                        xfree(name);
                }
        }
diff --git a/config.h.in b/config.h.in
index 551d7e5d9..05e17adc8 100644
--- a/config.h.in
+++ b/config.h.in
@@ -1,191 +1,87 @@
 /* config.h.in.  Generated from configure.ac by autoheader.  */
-/* $Id: acconfig.h,v 1.183 2005/07/07 10:33:36 dtucker Exp $ */
-/*
- * Copyright (c) 1999-2003 Damien Miller.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#ifndef _CONFIG_H
-#define _CONFIG_H
-/* Generated automatically from acconfig.h by autoheader. */
-/* Please make your changes there */
+/* Define if you have a getaddrinfo that fails for the all-zeros IPv6 address
+   */
+#undef AIX_GETNAMEINFO_HACK
-/* Define if your platform breaks doing a seteuid before a setuid */
+/* Define if your AIX loginfailed() function takes 4 arguments (AIX >= 5.2) */
-#undef SETEUID_BREAKS_SETUID
+#undef AIX_LOGINFAILED_4ARG
-/* Define if your setreuid() is broken */
-#undef BROKEN_SETREUID
-/* Define if your setregid() is broken */
-#undef BROKEN_SETREGID
-/* Define if your setresuid() is broken */
-#undef BROKEN_SETRESUID
-/* Define if your setresgid() is broken */
-#undef BROKEN_SETRESGID
-/* Define to a Set Process Title type if your system is */
-/* supported by bsd-setproctitle.c */
-#undef SPT_TYPE
-#undef SPT_PADCHAR
-/* SCO workaround */
-#undef BROKEN_SYS_TERMIO_H
-/* Define if you have SecureWare-based protected password database */
-#undef HAVE_SECUREWARE
-/* If your header files don't define LOGIN_PROGRAM, then use this (detected) */
-/* from environment and PATH */
-#undef LOGIN_PROGRAM_FALLBACK
-/* Full path of your "passwd" program */
-#undef _PATH_PASSWD_PROG
-/* Define if your password has a pw_class field */
-#undef HAVE_PW_CLASS_IN_PASSWD
-/* Define if your password has a pw_expire field */
+/* Define if your resolver libs need this for getrrsetbyname */
-#undef HAVE_PW_EXPIRE_IN_PASSWD
+#undef BIND_8_COMPAT
-/* Define if your password has a pw_change field */
+/* Define if cmsg_type is not passed correctly */
-#undef HAVE_PW_CHANGE_IN_PASSWD
+#undef BROKEN_CMSG_TYPE
-/* Define if your system uses access rights style file descriptor passing */
+/* getaddrinfo is broken (if present) */
-#undef HAVE_ACCRIGHTS_IN_MSGHDR
+#undef BROKEN_GETADDRINFO
-/* Define if your system uses ancillary data style file descriptor passing */
+/* getgroups(0,NULL) will return -1 */
-#undef HAVE_CONTROL_IN_MSGHDR
+#undef BROKEN_GETGROUPS
 /* Define if you system's inet_ntoa is busted (e.g. Irix gcc issue) */
 #undef BROKEN_INET_NTOA
-/* Define if your system defines sys_errlist[] */
+/* ia_uinfo routines not supported by OS yet */
-#undef HAVE_SYS_ERRLIST
+#undef BROKEN_LIBIAF
-/* Define if your system defines sys_nerr */
-#undef HAVE_SYS_NERR
-/* Define if your system choked on IP TOS setting */
-#undef IP_TOS_IS_BROKEN
-/* Define if you have the getuserattr function.  */
-#undef HAVE_GETUSERATTR
-/* Define if you have the basename function. */
-#undef HAVE_BASENAME
-/* Work around problematic Linux PAM modules handling of PAM_TTY */
-#undef PAM_TTY_KLUDGE
-/* Define if pam_chauthtok wants real uid set to the unpriv'ed user */
-#undef SSHPAM_CHAUTHTOK_NEEDS_RUID
-/* Use PIPES instead of a socketpair() */
-#undef USE_PIPES
-/* Define if your snprintf is busted */
+/* Ultrix mmap can't map files */
-#undef BROKEN_SNPRINTF
+#undef BROKEN_MMAP
-/* Define if you are on Cygwin */
+/* Define if your struct dirent expects you to allocate extra space for d_name
-#undef HAVE_CYGWIN
+   */
+#undef BROKEN_ONE_BYTE_DIRENT_D_NAME
 /* Define if you have a broken realpath. */
 #undef BROKEN_REALPATH
-/* Define if you are on NeXT */
+/* Needed for NeXT */
-#undef HAVE_NEXT
+#undef BROKEN_SAVED_UIDS
-/* Define if you want to enable PAM support */
-#undef USE_PAM
-/* Define if you want to enable AIX4's authenticate function */
-#undef WITH_AIXAUTHENTICATE
-/* Define if your AIX loginfailed() function takes 4 arguments (AIX >= 5.2) */
+/* Define if your setregid() is broken */
-#undef AIX_LOGINFAILED_4ARG
+#undef BROKEN_SETREGID
-/* Define if your skeychallenge() function takes 4 arguments (eg NetBSD) */
+/* Define if your setresgid() is broken */
-#undef SKEYCHALLENGE_4ARG
+#undef BROKEN_SETRESGID
-/* Define if you have/want arrays (cluster-wide session managment, not C arrays) */
+/* Define if your setresuid() is broken */
-#undef WITH_IRIX_ARRAY
+#undef BROKEN_SETRESUID
-/* Define if you want IRIX project management */
+/* Define if your setreuid() is broken */
-#undef WITH_IRIX_PROJECT
+#undef BROKEN_SETREUID
-/* Define if you want IRIX audit trails */
+/* LynxOS has broken setvbuf() implementation */
-#undef WITH_IRIX_AUDIT
+#undef BROKEN_SETVBUF
-/* Define if you want IRIX kernel jobs */
+/* Define if your snprintf is busted */
-#undef WITH_IRIX_JOBS
+#undef BROKEN_SNPRINTF
-/* Location of PRNGD/EGD random number socket */
+/* updwtmpx is broken (if present) */
-#undef PRNGD_SOCKET
+#undef BROKEN_UPDWTMPX
-/* Port number of PRNGD/EGD random number socket */
+/* Define if you have BSD auth support */
-#undef PRNGD_PORT
+#undef BSD_AUTH
-/* Builtin PRNG command timeout */
+/* Define if you want to specify the path to your lastlog file */
-#undef ENTROPY_TIMEOUT_MSEC
+#undef CONF_LASTLOG_FILE
-/* non-privileged user for privilege separation */
+/* Define if you want to specify the path to your utmpx file */
-#undef SSH_PRIVSEP_USER
+#undef CONF_UTMPX_FILE
-/* Define if you want to install preformatted manpages.*/
+/* Define if you want to specify the path to your utmp file */
-#undef MANTYPE
+#undef CONF_UTMP_FILE
-/* Define if your ssl headers are included with #include <openssl/header.h>  */
+/* Define if you want to specify the path to your wtmpx file */
-#undef HAVE_OPENSSL
+#undef CONF_WTMPX_FILE
-/* Define if you are linking against RSAref.  Used only to print the right
+/* Define if you want to specify the path to your wtmp file */
- * message at run-time. */
+#undef CONF_WTMP_FILE
-#undef RSAREF
-/* struct timeval */
+/* Define if your platform needs to skip post auth file descriptor passing */
-#undef HAVE_STRUCT_TIMEVAL
+#undef DISABLE_FD_PASSING
-/* struct utmp and struct utmpx fields */
+/* Define if you don't want to use lastlog */
-#undef HAVE_HOST_IN_UTMP
+#undef DISABLE_LASTLOG
-#undef HAVE_HOST_IN_UTMPX
-#undef HAVE_ADDR_IN_UTMP
-#undef HAVE_ADDR_IN_UTMPX
-#undef HAVE_ADDR_V6_IN_UTMP
-#undef HAVE_ADDR_V6_IN_UTMPX
-#undef HAVE_SYSLEN_IN_UTMPX
-#undef HAVE_PID_IN_UTMP
-#undef HAVE_TYPE_IN_UTMP
-#undef HAVE_TYPE_IN_UTMPX
-#undef HAVE_TV_IN_UTMP
-#undef HAVE_TV_IN_UTMPX
-#undef HAVE_ID_IN_UTMP
-#undef HAVE_ID_IN_UTMPX
-#undef HAVE_EXIT_IN_UTMP
-#undef HAVE_TIME_IN_UTMP
-#undef HAVE_TIME_IN_UTMPX
 /* Define if you don't want to use your system's login() call */
 #undef DISABLE_LOGIN
@@ -196,11 +92,8 @@
 /* Define if you don't want to use pututxline() etc. to write [uw]tmpx */
 #undef DISABLE_PUTUTXLINE
-/* Define if you don't want to use lastlog */
+/* Define if you want to disable shadow passwords */
-#undef DISABLE_LASTLOG
+#undef DISABLE_SHADOW
-/* Define if you don't want to use lastlog in session.c */
-#undef NO_SSH_LASTLOG
 /* Define if you don't want to use utmp */
 #undef DISABLE_UTMP
@@ -214,159 +107,17 @@
 /* Define if you don't want to use wtmpx */
 #undef DISABLE_WTMPX
-/* Some systems need a utmpx entry for /bin/login to work */
-#undef LOGIN_NEEDS_UTMPX
-/* Some versions of /bin/login need the TERM supplied on the commandline */
-#undef LOGIN_NEEDS_TERM
-/* Define if your login program cannot handle end of options ("--") */
-#undef LOGIN_NO_ENDOPT
-/* Define if you want to specify the path to your lastlog file */
-#undef CONF_LASTLOG_FILE
-/* Define if you want to specify the path to your utmp file */
-#undef CONF_UTMP_FILE
-/* Define if you want to specify the path to your wtmp file */
-#undef CONF_WTMP_FILE
-/* Define if you want to specify the path to your utmpx file */
-#undef CONF_UTMPX_FILE
-/* Define if you want to specify the path to your wtmpx file */
-#undef CONF_WTMPX_FILE
-/* Define if you want external askpass support */
-#undef USE_EXTERNAL_ASKPASS
-/* Define if libc defines __progname */
-#undef HAVE___PROGNAME
-/* Define if compiler implements __FUNCTION__ */
-#undef HAVE___FUNCTION__
-/* Define if compiler implements __func__ */
-#undef HAVE___func__
-/* Define this is you want GSSAPI support in the version 2 protocol */
-#undef GSSAPI
-/* Define if you want Kerberos 5 support */
-#undef KRB5
-/* Define this if you are using the Heimdal version of Kerberos V5 */
-#undef HEIMDAL
-/* Define this if you want to use libkafs' AFS support */
-#undef USE_AFS
-/* Define if you want S/Key support */
-#undef SKEY
-/* Define if you want TCP Wrappers support */
-#undef LIBWRAP
-/* Define if your libraries define login() */
-#undef HAVE_LOGIN
-/* Define if your libraries define daemon() */
-#undef HAVE_DAEMON
-/* Define if your libraries define getpagesize() */
-#undef HAVE_GETPAGESIZE
-/* Define if xauth is found in your path */
-#undef XAUTH_PATH
-/* Define if you want to allow MD5 passwords */
-#undef HAVE_MD5_PASSWORDS
-/* Define if you want to disable shadow passwords */
-#undef DISABLE_SHADOW
-/* Define if you want to use shadow password expire field */
-#undef HAS_SHADOW_EXPIRE
-/* Define if you have Digital Unix Security Integration Architecture */
-#undef HAVE_OSF_SIA
-/* Define if you have getpwanam(3) [SunOS 4.x] */
-#undef HAVE_GETPWANAM
-/* Define if you have an old version of PAM which takes only one argument */
-/* to pam_strerror */
-#undef HAVE_OLD_PAM
-/* Define if you are using Solaris-derived PAM which passes pam_messages  */
-/* to the conversation function with an extra level of indirection */
-#undef PAM_SUN_CODEBASE
-/* Set this to your mail directory if you don't have maillock.h */
-#undef MAIL_DIRECTORY
-/* Data types */
-#undef HAVE_U_INT
-#undef HAVE_INTXX_T
-#undef HAVE_U_INTXX_T
-#undef HAVE_UINTXX_T
-#undef HAVE_INT64_T
-#undef HAVE_U_INT64_T
-#undef HAVE_U_CHAR
-#undef HAVE_SIZE_T
-#undef HAVE_SSIZE_T
-#undef HAVE_CLOCK_T
-#undef HAVE_MODE_T
-#undef HAVE_PID_T
-#undef HAVE_SA_FAMILY_T
-#undef HAVE_STRUCT_SOCKADDR_STORAGE
-#undef HAVE_STRUCT_ADDRINFO
-#undef HAVE_STRUCT_IN6_ADDR
-#undef HAVE_STRUCT_SOCKADDR_IN6
-/* Fields in struct sockaddr_storage */
-#undef HAVE_SS_FAMILY_IN_SS
-#undef HAVE___SS_FAMILY_IN_SS
-/* Define if you have /dev/ptmx */
-#undef HAVE_DEV_PTMX
-/* Define if you have /dev/ptc */
-#undef HAVE_DEV_PTS_AND_PTC
-/* Define if you need to use IP address instead of hostname in $DISPLAY */
-#undef IPADDR_IN_DISPLAY
-/* Specify default $PATH */
-#undef USER_PATH
-/* Specify location of ssh.pid */
-#undef _PATH_SSH_PIDDIR
-/* getaddrinfo is broken (if present) */
-#undef BROKEN_GETADDRINFO
-/* updwtmpx is broken (if present) */
-#undef BROKEN_UPDWTMPX
 /* Workaround more Linux IPv6 quirks */
 #undef DONT_TRY_OTHER_AF
-/* Detect IPv4 in IPv6 mapped addresses and treat as IPv4 */
+/* Builtin PRNG command timeout */
-#undef IPV4_IN_IPV6
+#undef ENTROPY_TIMEOUT_MSEC
-/* Define if you have BSD auth support */
-#undef BSD_AUTH
-/* Define if X11 doesn't support AF_UNIX sockets on that system */
-#undef NO_X11_UNIX_SOCKETS
-/* Define if the concept of ports only accessible to superusers isn't known */
+/* Define to 1 if the `getpgrp' function requires zero arguments. */
-#undef NO_IPPORT_RESERVED_CONCEPT
+#undef GETPGRP_VOID
-/* Needed for SCO and NeXT */
+/* Conflicting defs for getspnam */
-#undef BROKEN_SAVED_UIDS
+#undef GETSPNAM_CONFLICTING_DEFS
 /* Define if your system glob() function has the GLOB_ALTDIRFUNC extension */
 #undef GLOB_HAS_ALTDIRFUNC
@@ -374,109 +125,36 @@
 /* Define if your system glob() function has gl_matchc options in glob_t */
 #undef GLOB_HAS_GL_MATCHC
-/* Define in your struct dirent expects you to allocate extra space for d_name */
+/* Define this if you want GSSAPI support in the version 2 protocol */
-#undef BROKEN_ONE_BYTE_DIRENT_D_NAME
+#undef GSSAPI
-/* Define if your system has /etc/default/login */
-#undef HAVE_ETC_DEFAULT_LOGIN
-/* Define if your getopt(3) defines and uses optreset */
-#undef HAVE_GETOPT_OPTRESET
-/* Define on *nto-qnx systems */
-#undef MISSING_NFDBITS
-/* Define on *nto-qnx systems */
-#undef MISSING_HOWMANY
-/* Define on *nto-qnx systems */
-#undef MISSING_FD_MASK
-/* Define if you want smartcard support */
-#undef SMARTCARD
-/* Define if you want smartcard support using sectok */
-#undef USE_SECTOK
-/* Define if you want smartcard support using OpenSC */
-#undef USE_OPENSC
-/* Define if you want to use OpenSSL's internally seeded PRNG only */
-#undef OPENSSL_PRNG_ONLY
-/* Define if you shouldn't strip 'tty' from your ttyname in [uw]tmp */
-#undef WITH_ABBREV_NO_TTY
-/* Define if you want a different $PATH for the superuser */
-#undef SUPERUSER_PATH
-/* Path that unprivileged child will chroot() to in privep mode */
-#undef PRIVSEP_PATH
-/* Define if your platform needs to skip post auth file descriptor passing */
-#undef DISABLE_FD_PASSING
-/* Silly mkstemp() */
-#undef HAVE_STRICT_MKSTEMP
-/* Some systems put this outside of libc */
-#undef HAVE_NANOSLEEP
-/* Define if sshd somehow reacquires a controlling TTY after setsid() */
-#undef SSHD_ACQUIRES_CTTY
-/* Define if cmsg_type is not passed correctly */
-#undef BROKEN_CMSG_TYPE
-/*
- * Define to whatever link() returns for "not supported" if it doesn't
- * return EOPNOTSUPP.
- */
-#undef LINK_OPNOTSUPP_ERRNO
-/* Strings used in /etc/passwd to denote locked account */
-#undef LOCKED_PASSWD_STRING
-#undef LOCKED_PASSWD_PREFIX
-#undef LOCKED_PASSWD_SUBSTR
-/* Define if getrrsetbyname() exists */
-#undef HAVE_GETRRSETBYNAME
-/* Define if HEADER.ad exists in arpa/nameser.h */
-#undef HAVE_HEADER_AD
-/* Define if your resolver libs need this for getrrsetbyname */
-#undef BIND_8_COMPAT
-/* Define if you have /proc/$pid/fd */
-#undef HAVE_PROC_PID
-/* Define if you have a getaddrinfo that fails for the all-zeros IPv6 address
-   */
-#undef AIX_GETNAMEINFO_HACK
-/* getgroups(0,NULL) will return -1 */
+/* Define if you want to use shadow password expire field */
-#undef BROKEN_GETGROUPS
+#undef HAS_SHADOW_EXPIRE
-/* ia_uinfo routines not supported by OS yet */
+/* Define if your system uses access rights style file descriptor passing */
-#undef BROKEN_LIBIAF
+#undef HAVE_ACCRIGHTS_IN_MSGHDR
-/* Ultrix mmap can't map files */
+/* Define if you have ut_addr in utmp.h */
-#undef BROKEN_MMAP
+#undef HAVE_ADDR_IN_UTMP
-/* LynxOS has broken setvbuf() implementation */
+/* Define if you have ut_addr in utmpx.h */
-#undef BROKEN_SETVBUF
+#undef HAVE_ADDR_IN_UTMPX
-/* Define to 1 if the `getpgrp' function requires zero arguments. */
+/* Define if you have ut_addr_v6 in utmp.h */
-#undef GETPGRP_VOID
+#undef HAVE_ADDR_V6_IN_UTMP
-/* Conflicting defs for getspnam */
+/* Define if you have ut_addr_v6 in utmpx.h */
-#undef GETSPNAM_CONFLICTING_DEFS
+#undef HAVE_ADDR_V6_IN_UTMPX
 /* Define to 1 if you have the `arc4random' function. */
 #undef HAVE_ARC4RANDOM
+/* Define to 1 if you have the `asprintf' function. */
+#undef HAVE_ASPRINTF
+/* OpenBSD's gcc has bounded */
+#undef HAVE_ATTRIBUTE__BOUNDED__
 /* OpenBSD's gcc has sentinel */
 #undef HAVE_ATTRIBUTE__SENTINEL__
@@ -486,6 +164,9 @@
 /* Define to 1 if you have the `b64_pton' function. */
 #undef HAVE_B64_PTON
+/* Define if you have the basename function. */
+#undef HAVE_BASENAME
 /* Define to 1 if you have the `bcopy' function. */
 #undef HAVE_BCOPY
@@ -501,15 +182,27 @@
 /* Define to 1 if you have the `clock' function. */
 #undef HAVE_CLOCK
+/* define if you have clock_t data type */
+#undef HAVE_CLOCK_T
 /* Define to 1 if you have the `closefrom' function. */
 #undef HAVE_CLOSEFROM
 /* Define if gai_strerror() returns const char * */
 #undef HAVE_CONST_GAI_STRERROR_PROTO
+/* Define if your system uses ancillary data style file descriptor passing */
+#undef HAVE_CONTROL_IN_MSGHDR
 /* Define to 1 if you have the <crypt.h> header file. */
 #undef HAVE_CRYPT_H
+/* Define if you are on Cygwin */
+#undef HAVE_CYGWIN
+/* Define if your libraries define daemon() */
+#undef HAVE_DAEMON
 /* Define to 1 if you have the declaration of `authenticate', and to 0 if you
   don't. */
 #undef HAVE_DECL_AUTHENTICATE
@@ -546,6 +239,12 @@
   don't. */
 #undef HAVE_DECL__GETSHORT
+/* Define if you have /dev/ptmx */
+#undef HAVE_DEV_PTMX
+/* Define if you have /dev/ptc */
+#undef HAVE_DEV_PTS_AND_PTC
 /* Define to 1 if you have the <dirent.h> header file. */
 #undef HAVE_DIRENT_H
@@ -564,6 +263,12 @@
 /* Define to 1 if you have the `endutxent' function. */
 #undef HAVE_ENDUTXENT
+/* Define if your system has /etc/default/login */
+#undef HAVE_ETC_DEFAULT_LOGIN
+/* Define if you have ut_exit in utmp.h */
+#undef HAVE_EXIT_IN_UTMP
 /* Define to 1 if you have the `fchmod' function. */
 #undef HAVE_FCHMOD
@@ -612,6 +317,12 @@
 /* Define to 1 if you have the <getopt.h> header file. */
 #undef HAVE_GETOPT_H
+/* Define if your getopt(3) defines and uses optreset */
+#undef HAVE_GETOPT_OPTRESET
+/* Define if your libraries define getpagesize() */
+#undef HAVE_GETPAGESIZE
 /* Define to 1 if you have the `getpeereid' function. */
 #undef HAVE_GETPEEREID
@@ -621,6 +332,9 @@
 /* Define to 1 if you have the `getrlimit' function. */
 #undef HAVE_GETRLIMIT
+/* Define if getrrsetbyname() exists */
+#undef HAVE_GETRRSETBYNAME
 /* Define to 1 if you have the `getrusage' function. */
 #undef HAVE_GETRUSAGE
@@ -672,12 +386,27 @@
 /* Define to 1 if you have the <gssapi_krb5.h> header file. */
 #undef HAVE_GSSAPI_KRB5_H
+/* Define if HEADER.ad exists in arpa/nameser.h */
+#undef HAVE_HEADER_AD
+/* Define if you have ut_host in utmp.h */
+#undef HAVE_HOST_IN_UTMP
+/* Define if you have ut_host in utmpx.h */
+#undef HAVE_HOST_IN_UTMPX
 /* Define to 1 if you have the <iaf.h> header file. */
 #undef HAVE_IAF_H
 /* Define to 1 if you have the <ia.h> header file. */
 #undef HAVE_IA_H
+/* Define if you have ut_id in utmp.h */
+#undef HAVE_ID_IN_UTMP
+/* Define if you have ut_id in utmpx.h */
+#undef HAVE_ID_IN_UTMPX
 /* Define to 1 if you have the `inet_aton' function. */
 #undef HAVE_INET_ATON
@@ -690,9 +419,15 @@
 /* Define to 1 if you have the `innetgr' function. */
 #undef HAVE_INNETGR
+/* define if you have int64_t data type */
+#undef HAVE_INT64_T
 /* Define to 1 if you have the <inttypes.h> header file. */
 #undef HAVE_INTTYPES_H
+/* define if you have intxx_t data type */
+#undef HAVE_INTXX_T
 /* Define to 1 if the system has the type `in_addr_t'. */
 #undef HAVE_IN_ADDR_T
@@ -738,6 +473,12 @@
 /* Define to 1 if you have the <limits.h> header file. */
 #undef HAVE_LIMITS_H
+/* Define to 1 if you have the <linux/if_tun.h> header file. */
+#undef HAVE_LINUX_IF_TUN_H
+/* Define if your libraries define login() */
+#undef HAVE_LOGIN
 /* Define to 1 if you have the <login_cap.h> header file. */
 #undef HAVE_LOGIN_CAP_H
@@ -753,12 +494,21 @@
 /* Define to 1 if you have the `logwtmp' function. */
 #undef HAVE_LOGWTMP
+/* Define to 1 if the system has the type `long double'. */
+#undef HAVE_LONG_DOUBLE
+/* Define to 1 if the system has the type `long long'. */
+#undef HAVE_LONG_LONG
 /* Define to 1 if you have the <maillock.h> header file. */
 #undef HAVE_MAILLOCK_H
 /* Define to 1 if you have the `md5_crypt' function. */
 #undef HAVE_MD5_CRYPT
+/* Define if you want to allow MD5 passwords */
+#undef HAVE_MD5_PASSWORDS
 /* Define to 1 if you have the `memmove' function. */
 #undef HAVE_MEMMOVE
@@ -771,6 +521,12 @@
 /* Define to 1 if you have the `mmap' function. */
 #undef HAVE_MMAP
+/* define if you have mode_t data type */
+#undef HAVE_MODE_T
+/* Some systems put nanosleep outside of libc */
+#undef HAVE_NANOSLEEP
 /* Define to 1 if you have the <ndir.h> header file. */
 #undef HAVE_NDIR_H
@@ -780,8 +536,8 @@
 /* Define to 1 if you have the <netgroup.h> header file. */
 #undef HAVE_NETGROUP_H
-/* Define to 1 if you have the <netinet/in_systm.h> header file. */
+/* Define if you are on NeXT */
-#undef HAVE_NETINET_IN_SYSTM_H
+#undef HAVE_NEXT
 /* Define to 1 if you have the `ngetaddrinfo' function. */
 #undef HAVE_NGETADDRINFO
@@ -792,12 +548,22 @@
 /* Define to 1 if you have the `ogetaddrinfo' function. */
 #undef HAVE_OGETADDRINFO
+/* Define if you have an old version of PAM which takes only one argument to
+   pam_strerror */
+#undef HAVE_OLD_PAM
 /* Define to 1 if you have the `openlog_r' function. */
 #undef HAVE_OPENLOG_R
 /* Define to 1 if you have the `openpty' function. */
 #undef HAVE_OPENPTY
+/* Define if your ssl headers are included with #include <openssl/header.h> */
+#undef HAVE_OPENSSL
+/* Define if you have Digital Unix Security Integration Architecture */
+#undef HAVE_OSF_SIA
 /* Define to 1 if you have the `pam_getenvlist' function. */
 #undef HAVE_PAM_GETENVLIST
@@ -810,9 +576,18 @@
 /* Define to 1 if you have the <paths.h> header file. */
 #undef HAVE_PATHS_H
+/* Define if you have ut_pid in utmp.h */
+#undef HAVE_PID_IN_UTMP
+/* define if you have pid_t data type */
+#undef HAVE_PID_T
 /* Define to 1 if you have the `prctl' function. */
 #undef HAVE_PRCTL
+/* Define if you have /proc/$pid/fd */
+#undef HAVE_PROC_PID
 /* Define to 1 if you have the `pstat' function. */
 #undef HAVE_PSTAT
@@ -825,6 +600,15 @@
 /* Define to 1 if you have the `pututxline' function. */
 #undef HAVE_PUTUTXLINE
+/* Define if your password has a pw_change field */
+#undef HAVE_PW_CHANGE_IN_PASSWD
+/* Define if your password has a pw_class field */
+#undef HAVE_PW_CLASS_IN_PASSWD
+/* Define if your password has a pw_expire field */
+#undef HAVE_PW_EXPIRE_IN_PASSWD
 /* Define to 1 if you have the `readpassphrase' function. */
 #undef HAVE_READPASSPHRASE
@@ -843,9 +627,15 @@
 /* Define to 1 if you have the `rresvport_af' function. */
 #undef HAVE_RRESVPORT_AF
+/* define if you have sa_family_t data type */
+#undef HAVE_SA_FAMILY_T
 /* Define to 1 if you have the <sectok.h> header file. */
 #undef HAVE_SECTOK_H
+/* Define if you have SecureWare-based protected password database */
+#undef HAVE_SECUREWARE
 /* Define to 1 if you have the <security/pam_appl.h> header file. */
 #undef HAVE_SECURITY_PAM_APPL_H
@@ -924,6 +714,9 @@
 /* Define to 1 if the system has the type `sig_atomic_t'. */
 #undef HAVE_SIG_ATOMIC_T
+/* define if you have size_t data type */
+#undef HAVE_SIZE_T
 /* Define to 1 if you have the `snprintf' function. */
 #undef HAVE_SNPRINTF
@@ -933,6 +726,12 @@
 /* Have PEERCRED socket option */
 #undef HAVE_SO_PEERCRED
+/* define if you have ssize_t data type */
+#undef HAVE_SSIZE_T
+/* Fields in struct sockaddr_storage */
+#undef HAVE_SS_FAMILY_IN_SS
 /* Define to 1 if you have the <stddef.h> header file. */
 #undef HAVE_STDDEF_H
@@ -951,6 +750,9 @@
 /* Define to 1 if you have the `strftime' function. */
 #undef HAVE_STRFTIME
+/* Silly mkstemp() */
+#undef HAVE_STRICT_MKSTEMP
 /* Define to 1 if you have the <strings.h> header file. */
 #undef HAVE_STRINGS_H
@@ -981,15 +783,33 @@
 /* Define to 1 if you have the `strtoul' function. */
 #undef HAVE_STRTOUL
+/* define if you have struct addrinfo data type */
+#undef HAVE_STRUCT_ADDRINFO
+/* define if you have struct in6_addr data type */
+#undef HAVE_STRUCT_IN6_ADDR
+/* define if you have struct sockaddr_in6 data type */
+#undef HAVE_STRUCT_SOCKADDR_IN6
+/* define if you have struct sockaddr_storage data type */
+#undef HAVE_STRUCT_SOCKADDR_STORAGE
 /* Define to 1 if `st_blksize' is member of `struct stat'. */
 #undef HAVE_STRUCT_STAT_ST_BLKSIZE
 /* Define to 1 if the system has the type `struct timespec'. */
 #undef HAVE_STRUCT_TIMESPEC
+/* define if you have struct timeval */
+#undef HAVE_STRUCT_TIMEVAL
 /* Define to 1 if you have the `sysconf' function. */
 #undef HAVE_SYSCONF
+/* Define if you have syslen in utmpx.h */
+#undef HAVE_SYSLEN_IN_UTMPX
 /* Define to 1 if you have the <sys/audit.h> header file. */
 #undef HAVE_SYS_AUDIT_H
@@ -1005,12 +825,18 @@
 /* Define to 1 if you have the <sys/dir.h> header file. */
 #undef HAVE_SYS_DIR_H
+/* Define if your system defines sys_errlist[] */
+#undef HAVE_SYS_ERRLIST
 /* Define to 1 if you have the <sys/mman.h> header file. */
 #undef HAVE_SYS_MMAN_H
 /* Define to 1 if you have the <sys/ndir.h> header file. */
 #undef HAVE_SYS_NDIR_H
+/* Define if your system defines sys_nerr */
+#undef HAVE_SYS_NERR
 /* Define to 1 if you have the <sys/prctl.h> header file. */
 #undef HAVE_SYS_PRCTL_H
@@ -1065,6 +891,12 @@
 /* Define to 1 if you have the <time.h> header file. */
 #undef HAVE_TIME_H
+/* Define if you have ut_time in utmp.h */
+#undef HAVE_TIME_IN_UTMP
+/* Define if you have ut_time in utmpx.h */
+#undef HAVE_TIME_IN_UTMPX
 /* Define to 1 if you have the <tmpdir.h> header file. */
 #undef HAVE_TMPDIR_H
@@ -1074,12 +906,30 @@
 /* Define to 1 if you have the <ttyent.h> header file. */
 #undef HAVE_TTYENT_H
+/* Define if you have ut_tv in utmp.h */
+#undef HAVE_TV_IN_UTMP
+/* Define if you have ut_tv in utmpx.h */
+#undef HAVE_TV_IN_UTMPX
+/* Define if you have ut_type in utmp.h */
+#undef HAVE_TYPE_IN_UTMP
+/* Define if you have ut_type in utmpx.h */
+#undef HAVE_TYPE_IN_UTMPX
+/* define if you have uintxx_t data type */
+#undef HAVE_UINTXX_T
 /* Define to 1 if you have the <unistd.h> header file. */
 #undef HAVE_UNISTD_H
 /* Define to 1 if you have the `unsetenv' function. */
 #undef HAVE_UNSETENV
+/* Define to 1 if the system has the type `unsigned long long'. */
+#undef HAVE_UNSIGNED_LONG_LONG
 /* Define to 1 if you have the `updwtmp' function. */
 #undef HAVE_UPDWTMP
@@ -1110,6 +960,24 @@
 /* Define to 1 if you have the <utmp.h> header file. */
 #undef HAVE_UTMP_H
+/* define if you have u_char data type */
+#undef HAVE_U_CHAR
+/* define if you have u_int data type */
+#undef HAVE_U_INT
+/* define if you have u_int64_t data type */
+#undef HAVE_U_INT64_T
+/* define if you have u_intxx_t data type */
+#undef HAVE_U_INTXX_T
+/* Define to 1 if you have the `vasprintf' function. */
+#undef HAVE_VASPRINTF
+/* Define if va_copy exists */
+#undef HAVE_VA_COPY
 /* Define to 1 if you have the `vhangup' function. */
 #undef HAVE_VHANGUP
@@ -1137,14 +1005,100 @@
 /* Define to 1 if you have the `__b64_pton' function. */
 #undef HAVE___B64_PTON
+/* Define if compiler implements __FUNCTION__ */
+#undef HAVE___FUNCTION__
+/* Define if libc defines __progname */
+#undef HAVE___PROGNAME
+/* Fields in struct sockaddr_storage */
+#undef HAVE___SS_FAMILY_IN_SS
+/* Define if __va_copy exists */
+#undef HAVE___VA_COPY
+/* Define if compiler implements __func__ */
+#undef HAVE___func__
+/* Define this if you are using the Heimdal version of Kerberos V5 */
+#undef HEIMDAL
+/* Define if you need to use IP address instead of hostname in $DISPLAY */
+#undef IPADDR_IN_DISPLAY
+/* Detect IPv4 in IPv6 mapped addresses and treat as IPv4 */
+#undef IPV4_IN_IPV6
+/* Define if your system choked on IP TOS setting */
+#undef IP_TOS_IS_BROKEN
+/* Define if you want Kerberos 5 support */
+#undef KRB5
+/* Define if you want TCP Wrappers support */
+#undef LIBWRAP
+/* Define to whatever link() returns for "not supported" if it doesn't return
+   EOPNOTSUPP. */
+#undef LINK_OPNOTSUPP_ERRNO
 /* max value of long long calculated by configure */
 #undef LLONG_MAX
 /* min value of long long calculated by configure */
 #undef LLONG_MIN
+/* Account locked with pw(1) */
+#undef LOCKED_PASSWD_PREFIX
+/* String used in /etc/passwd to denote locked account */
+#undef LOCKED_PASSWD_STRING
+/* String used in /etc/passwd to denote locked account */
+#undef LOCKED_PASSWD_SUBSTR
+/* Some versions of /bin/login need the TERM supplied on the commandline */
+#undef LOGIN_NEEDS_TERM
+/* Some systems need a utmpx entry for /bin/login to work */
+#undef LOGIN_NEEDS_UTMPX
+/* Define if your login program cannot handle end of options ("--") */
+#undef LOGIN_NO_ENDOPT
+/* If your header files don't define LOGIN_PROGRAM, then use this (detected)
+   from environment and PATH */
+#undef LOGIN_PROGRAM_FALLBACK
+/* Set this to your mail directory if you don't have maillock.h */
+#undef MAIL_DIRECTORY
+/* Define on *nto-qnx systems */
+#undef MISSING_FD_MASK
+/* Define on *nto-qnx systems */
+#undef MISSING_HOWMANY
+/* Define on *nto-qnx systems */
+#undef MISSING_NFDBITS
 /* Need setpgrp to acquire controlling tty */
-#undef NEED_SETPRGP
+#undef NEED_SETPGRP
+/* Define if the concept of ports only accessible to superusers isn't known */
+#undef NO_IPPORT_RESERVED_CONCEPT
+/* Define if you don't want to use lastlog in session.c */
+#undef NO_SSH_LASTLOG
+/* Define if X11 doesn't support AF_UNIX sockets on that system */
+#undef NO_X11_UNIX_SOCKETS
+/* libcrypto is missing AES 192 and 256 bit functions */
+#undef OPENSSL_LOBOTOMISED_AES
+/* Define if you want OpenSSL's internally seeded PRNG only */
+#undef OPENSSL_PRNG_ONLY
 /* Define to the address where bug reports for this package should be sent. */
 #undef PACKAGE_BUGREPORT
@@ -1161,9 +1115,25 @@
 /* Define to the version of this package. */
 #undef PACKAGE_VERSION
+/* Define if you are using Solaris-derived PAM which passes pam_messages to
+   the conversation function with an extra level of indirection */
+#undef PAM_SUN_CODEBASE
+/* Work around problematic Linux PAM modules handling of PAM_TTY */
+#undef PAM_TTY_KLUDGE
 /* must supply username to passwd */
 #undef PASSWD_NEEDS_USERNAME
+/* Port number of PRNGD/EGD random number socket */
+#undef PRNGD_PORT
+/* Location of PRNGD/EGD random number socket */
+#undef PRNGD_SOCKET
+/* Define if your platform breaks doing a seteuid before a setuid */
+#undef SETEUID_BREAKS_SETUID
 /* The size of a `char', as computed by sizeof. */
 #undef SIZEOF_CHAR
@@ -1179,15 +1149,67 @@
 /* The size of a `short int', as computed by sizeof. */
 #undef SIZEOF_SHORT_INT
+/* Define if you want S/Key support */
+#undef SKEY
+/* Define if your skeychallenge() function takes 4 arguments (NetBSD) */
+#undef SKEYCHALLENGE_4ARG
+/* Define if you want smartcard support */
+#undef SMARTCARD
+/* Define as const if snprintf() can declare const char *fmt */
+#undef SNPRINTF_CONST
+/* Define to a Set Process Title type if your system is supported by
+   bsd-setproctitle.c */
+#undef SPT_TYPE
+/* Define if sshd somehow reacquires a controlling TTY after setsid() */
+#undef SSHD_ACQUIRES_CTTY
+/* Define if pam_chauthtok wants real uid set to the unpriv'ed user */
+#undef SSHPAM_CHAUTHTOK_NEEDS_RUID
 /* Use audit debugging module */
 #undef SSH_AUDIT_EVENTS
+/* non-privileged user for privilege separation */
+#undef SSH_PRIVSEP_USER
+/* Use tunnel device compatibility to OpenBSD */
+#undef SSH_TUN_COMPAT_AF
+/* Open tunnel devices the FreeBSD way */
+#undef SSH_TUN_FREEBSD
+/* Open tunnel devices the Linux tun/tap way */
+#undef SSH_TUN_LINUX
+/* No layer 2 tunnel support */
+#undef SSH_TUN_NO_L2
+/* Open tunnel devices the OpenBSD way */
+#undef SSH_TUN_OPENBSD
+/* Prepend the address family to IP tunnel traffic */
+#undef SSH_TUN_PREPEND_AF
 /* Define to 1 if you have the ANSI C header files. */
 #undef STDC_HEADERS
+/* Define if you want a different $PATH for the superuser */
+#undef SUPERUSER_PATH
 /* Support passwords > 8 chars */
 #undef UNIXWARE_LONG_PASSWORDS
+/* Specify default $PATH */
+#undef USER_PATH
+/* Define this if you want to use libkafs' AFS support */
+#undef USE_AFS
 /* Use BSM audit module */
 #undef USE_BSM_AUDIT
@@ -1197,13 +1219,44 @@
 /* Use libedit for sftp */
 #undef USE_LIBEDIT
-/* Define if you want SELinux support. */
+/* Define if you want smartcard support using OpenSC */
-#undef WITH_SELINUX
+#undef USE_OPENSC
+/* Define if you want to enable PAM support */
+#undef USE_PAM
+/* Use PIPES instead of a socketpair() */
+#undef USE_PIPES
+/* Define if you want smartcard support using sectok */
+#undef USE_SECTOK
+/* Define if you shouldn't strip 'tty' from your ttyname in [uw]tmp */
+#undef WITH_ABBREV_NO_TTY
+/* Define if you want to enable AIX4's authenticate function */
+#undef WITH_AIXAUTHENTICATE
+/* Define if you have/want arrays (cluster-wide session managment, not C
+   arrays) */
+#undef WITH_IRIX_ARRAY
+/* Define if you want IRIX audit trails */
+#undef WITH_IRIX_AUDIT
+/* Define if you want IRIX kernel jobs */
+#undef WITH_IRIX_JOBS
+/* Define if you want IRIX project management */
+#undef WITH_IRIX_PROJECT
 /* Define to 1 if your processor stores words with the most significant byte
   first (like Motorola and SPARC, unlike Intel and VAX). */
 #undef WORDS_BIGENDIAN
+/* Define if xauth is found in your path */
+#undef XAUTH_PATH
 /* Number of bits in a file offset, on hosts where this is settable. */
 #undef _FILE_OFFSET_BITS
@@ -1213,6 +1266,15 @@
 /* log for bad login attempts */
 #undef _PATH_BTMP
+/* Full path of your "passwd" program */
+#undef _PATH_PASSWD_PROG
+/* Specify location of ssh.pid */
+#undef _PATH_SSH_PIDDIR
+/* Define if we don't have struct __res_state in resolv.h */
+#undef __res_state
 /* Define to `__inline__' or `__inline' if that's what the C compiler
   calls it, or to nothing if 'inline' is not supported under any name.  */
 #ifndef __cplusplus
@@ -1221,7 +1283,3 @@
 /* type to use in place of socklen_t if not defined */
 #undef socklen_t
-/* ******************* Shouldn't need to edit below this line ************** */
-#endif /* _CONFIG_H */
diff --git a/configure b/configure
index bc27b88c2..552acba68 100755
--- a/configure
+++ b/configure
@@ -1,4 +1,5 @@
 #! /bin/sh
+# From configure.ac Revision: 1.322.2.6 .
 # Guess values for system-dependent variables and create Makefiles.
 # Generated by GNU Autoconf 2.59 for OpenSSH Portable.
 #
@@ -311,7 +312,7 @@ ac_includes_default="\
 # include <unistd.h>
 #endif"
-ac_subst_vars='SHELL PATH_SEPARATOR PACKAGE_NAME PACKAGE_TARNAME PACKAGE_VERSION PACKAGE_STRING PACKAGE_BUGREPORT exec_prefix prefix program_transform_name bindir sbindir libexecdir datadir sysconfdir sharedstatedir localstatedir libdir includedir oldincludedir infodir mandir build_alias host_alias target_alias DEFS ECHO_C ECHO_N ECHO_T LIBS CC CFLAGS LDFLAGS CPPFLAGS ac_ct_CC EXEEXT OBJEXT build build_cpu build_vendor build_os host host_cpu host_vendor host_os AWK CPP RANLIB ac_ct_RANLIB INSTALL_PROGRAM INSTALL_SCRIPT INSTALL_DATA AR CAT KILL PERL SED ENT TEST_MINUS_S_SH SH TEST_SHELL PATH_GROUPADD_PROG PATH_USERADD_PROG MAKE_PACKAGE_SUPPORTED LOGIN_PROGRAM_FALLBACK PATH_PASSWD_PROG LD EGREP LIBWRAP LIBEDIT LIBPAM INSTALL_SSH_RAND_HELPER SSH_PRIVSEP_USER PROG_LS PROG_NETSTAT PROG_ARP PROG_IFCONFIG PROG_JSTAT PROG_PS PROG_SAR PROG_W PROG_WHO PROG_LAST PROG_LASTLOG PROG_DF PROG_VMSTAT PROG_UPTIME PROG_IPCS PROG_TAIL INSTALL_SSH_PRNG_CMDS OPENSC_CONFIG PRIVSEP_PATH xauth_path STRIP_OPT XAUTH_PATH NROFF MANTYPE mansubdir user_path piddir LIBOBJS LTLIBOBJS'
+ac_subst_vars='SHELL PATH_SEPARATOR PACKAGE_NAME PACKAGE_TARNAME PACKAGE_VERSION PACKAGE_STRING PACKAGE_BUGREPORT exec_prefix prefix program_transform_name bindir sbindir libexecdir datadir sysconfdir sharedstatedir localstatedir libdir includedir oldincludedir infodir mandir build_alias host_alias target_alias DEFS ECHO_C ECHO_N ECHO_T LIBS CC CFLAGS LDFLAGS CPPFLAGS ac_ct_CC EXEEXT OBJEXT build build_cpu build_vendor build_os host host_cpu host_vendor host_os AWK CPP RANLIB ac_ct_RANLIB INSTALL_PROGRAM INSTALL_SCRIPT INSTALL_DATA EGREP AR CAT KILL PERL SED ENT TEST_MINUS_S_SH SH TEST_SHELL PATH_GROUPADD_PROG PATH_USERADD_PROG MAKE_PACKAGE_SUPPORTED STARTUP_SCRIPT_SHELL LOGIN_PROGRAM_FALLBACK PATH_PASSWD_PROG LD LIBWRAP LIBEDIT LIBPAM INSTALL_SSH_RAND_HELPER SSH_PRIVSEP_USER PROG_LS PROG_NETSTAT PROG_ARP PROG_IFCONFIG PROG_JSTAT PROG_PS PROG_SAR PROG_W PROG_WHO PROG_LAST PROG_LASTLOG PROG_DF PROG_VMSTAT PROG_UPTIME PROG_IPCS PROG_TAIL INSTALL_SSH_PRNG_CMDS OPENSC_CONFIG PRIVSEP_PATH xauth_path STRIP_OPT XAUTH_PATH NROFF MANTYPE mansubdir user_path piddir LIBOBJS LTLIBOBJS'
 ac_subst_files=''
 # Initialize some variables set by options.
@@ -884,7 +885,7 @@ Optional Packages:
  --with-entropy-timeout  Specify entropy gathering command timeout (msec)
  --with-privsep-user=user Specify non-privileged user for privilege separation
  --with-sectok           Enable smartcard support using libsectok
--with-opensc[=PFX]       Enable smartcard support using OpenSC (optionally in PATH)
+  --with-opensc[=PFX]     Enable smartcard support using OpenSC (optionally in PATH)
  --with-selinux          Enable SELinux support
  --with-kerberos5=PATH   Enable Kerberos 5 support
  --with-privsep-path=xxx Path for privilege separation chroot (default=/var/empty)
@@ -1360,6 +1361,7 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu
          ac_config_headers="$ac_config_headers config.h"
 ac_ext=c
@@ -3028,6 +3030,21 @@ test -z "$INSTALL_SCRIPT" && INSTALL_SCRIPT='${INSTALL}'
 test -z "$INSTALL_DATA" && INSTALL_DATA='${INSTALL} -m 644'
+echo "$as_me:$LINENO: checking for egrep" >&5
+echo $ECHO_N "checking for egrep... $ECHO_C" >&6
+if test "${ac_cv_prog_egrep+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  if echo a | (grep -E '(a|b)') >/dev/null 2>&1
+    then ac_cv_prog_egrep='grep -E'
+    else ac_cv_prog_egrep='egrep'
+    fi
+fi
+echo "$as_me:$LINENO: result: $ac_cv_prog_egrep" >&5
+echo "${ECHO_T}$ac_cv_prog_egrep" >&6
+ EGREP=$ac_cv_prog_egrep
 # Extract the first word of "ar", so it can be a program name with args.
 set dummy ar; ac_word=$2
 echo "$as_me:$LINENO: checking for $ac_word" >&5
@@ -3544,6 +3561,13 @@ else
 echo "${ECHO_T}no" >&6
 fi
+if test -x /sbin/sh; then
+        STARTUP_SCRIPT_SHELL=/sbin/sh
+else
+        STARTUP_SCRIPT_SHELL=/bin/sh
+fi
 # System features
 # Check whether --enable-largefile or --disable-largefile was given.
@@ -3913,7 +3937,8 @@ fi
 # Use LOGIN_PROGRAM from environment if possible
 if test ! -z "$LOGIN_PROGRAM" ; then
-        cat >>confdefs.h <<_ACEOF
+cat >>confdefs.h <<_ACEOF
 #define LOGIN_PROGRAM_FALLBACK "$LOGIN_PROGRAM"
 _ACEOF
@@ -4006,7 +4031,8 @@ echo "${ECHO_T}no" >&6
 fi
 if test ! -z "$PATH_PASSWD_PROG" ; then
-        cat >>confdefs.h <<_ACEOF
+cat >>confdefs.h <<_ACEOF
 #define _PATH_PASSWD_PROG "$PATH_PASSWD_PROG"
 _ACEOF
@@ -4151,12 +4177,14 @@ fi
 if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
        CFLAGS="$CFLAGS -Wall -Wpointer-arith -Wuninitialized"
-        GCC_VER=`$CC --version`
+        GCC_VER=`$CC -v 2>&1 | $AWK '/gcc version /{print $3}'`
        case $GCC_VER in
                1.*) ;;
                2.8* | 2.9*) CFLAGS="$CFLAGS -Wsign-compare" ;;
                2.*) ;;
-                *) CFLAGS="$CFLAGS -Wsign-compare" ;;
+                3.*) CFLAGS="$CFLAGS -Wsign-compare" ;;
+                4.*) CFLAGS="$CFLAGS -Wsign-compare -Wno-pointer-sign" ;;
+                *) ;;
        esac
        if test -z "$have_llong_max"; then
@@ -4230,110 +4258,6 @@ fi
        fi
 fi
-if test -z "$have_llong_max"; then
-        echo "$as_me:$LINENO: checking for max value of long long" >&5
-echo $ECHO_N "checking for max value of long long... $ECHO_C" >&6
-        if test "$cross_compiling" = yes; then
-                        { echo "$as_me:$LINENO: WARNING: cross compiling: not checking" >&5
-echo "$as_me: WARNING: cross compiling: not checking" >&2;}
-else
-  cat >conftest.$ac_ext <<_ACEOF
-/* confdefs.h.  */
-_ACEOF
-cat confdefs.h >>conftest.$ac_ext
-cat >>conftest.$ac_ext <<_ACEOF
-/* end confdefs.h.  */
-#include <stdio.h>
-/* Why is this so damn hard? */
-#ifdef __GNUC__
-# undef __GNUC__
-#endif
-#define __USE_ISOC99
-#include <limits.h>
-#define DATA "conftest.llminmax"
-int main(void) {
-        FILE *f;
-        long long i, llmin, llmax = 0;
-        if((f = fopen(DATA,"w")) == NULL)
-                exit(1);
-#if defined(LLONG_MIN) && defined(LLONG_MAX)
-        fprintf(stderr, "Using system header for LLONG_MIN and LLONG_MAX\n");
-        llmin = LLONG_MIN;
-        llmax = LLONG_MAX;
-#else
-        fprintf(stderr, "Calculating  LLONG_MIN and LLONG_MAX\n");
-        /* This will work on one's complement and two's complement */
-        for (i = 1; i > llmax; i <<= 1, i++)
-                llmax = i;
-        llmin = llmax + 1LL;    /* wrap */
-#endif
-        /* Sanity check */
-        if (llmin + 1 < llmin || llmin - 1 < llmin || llmax + 1 > llmax
-            || llmax - 1 > llmax) {
-                fprintf(f, "unknown unknown\n");
-                exit(2);
-        }
-        if (fprintf(f ,"%lld %lld", llmin, llmax) < 0)
-                exit(3);
-        exit(0);
-}
-_ACEOF
-rm -f conftest$ac_exeext
-if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5
-  (eval $ac_link) 2>&5
-  ac_status=$?
-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
-  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
-  (eval $ac_try) 2>&5
-  ac_status=$?
-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); }; }; then
-                        llong_min=`$AWK '{print $1}' conftest.llminmax`
-                        llong_max=`$AWK '{print $2}' conftest.llminmax`
-                        echo "$as_me:$LINENO: result: $llong_max" >&5
-echo "${ECHO_T}$llong_max" >&6
-cat >>confdefs.h <<_ACEOF
-#define LLONG_MAX ${llong_max}LL
-_ACEOF
-                        echo "$as_me:$LINENO: checking for min value of long long" >&5
-echo $ECHO_N "checking for min value of long long... $ECHO_C" >&6
-                        echo "$as_me:$LINENO: result: $llong_min" >&5
-echo "${ECHO_T}$llong_min" >&6
-cat >>confdefs.h <<_ACEOF
-#define LLONG_MIN ${llong_min}LL
-_ACEOF
-else
-  echo "$as_me: program exited with status $ac_status" >&5
-echo "$as_me: failed program was:" >&5
-sed 's/^/| /' conftest.$ac_ext >&5
-( exit $ac_status )
-                        echo "$as_me:$LINENO: result: not found" >&5
-echo "${ECHO_T}not found" >&6
-fi
-rm -f core *.core gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
-fi
-fi
 # Check whether --with-rpath or --without-rpath was given.
 if test "${with_rpath+set}" = set; then
@@ -4508,7 +4432,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_func_authenticate" >&5
 echo "${ECHO_T}$ac_cv_func_authenticate" >&6
 if test $ac_cv_func_authenticate = yes; then
-  cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define WITH_AIXAUTHENTICATE 1
 _ACEOF
@@ -5043,7 +4968,8 @@ if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
  (exit $ac_status); }; }; then
  echo "$as_me:$LINENO: result: yes" >&5
 echo "${ECHO_T}yes" >&6
-                         cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define AIX_LOGINFAILED_4ARG 1
 _ACEOF
@@ -5167,63 +5093,82 @@ fi
 done
        check_for_aix_broken_getaddrinfo=1
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define BROKEN_REALPATH 1
 _ACEOF
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define SETEUID_BREAKS_SETUID 1
 _ACEOF
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define BROKEN_SETREUID 1
 _ACEOF
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define BROKEN_SETREGID 1
 _ACEOF
-                cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define DISABLE_LASTLOG 1
 _ACEOF
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define LOGIN_NEEDS_UTMPX 1
 _ACEOF
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define SPT_TYPE SPT_REUSEARGV
 _ACEOF
+cat >>confdefs.h <<\_ACEOF
+#define SSHPAM_CHAUTHTOK_NEEDS_RUID 1
+_ACEOF
        ;;
 *-*-cygwin*)
        check_for_libcrypt_later=1
        LIBS="$LIBS /usr/lib/textmode.o"
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_CYGWIN 1
 _ACEOF
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define USE_PIPES 1
 _ACEOF
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define DISABLE_SHADOW 1
 _ACEOF
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define IP_TOS_IS_BROKEN 1
 _ACEOF
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define NO_X11_UNIX_SOCKETS 1
 _ACEOF
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define NO_IPPORT_RESERVED_CONCEPT 1
 _ACEOF
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define DISABLE_FD_PASSING 1
 _ACEOF
@@ -5287,7 +5232,8 @@ sed 's/^/| /' conftest.$ac_ext >&5
 ( exit $ac_status )
 echo "$as_me:$LINENO: result: buggy" >&5
 echo "${ECHO_T}buggy" >&6
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define BROKEN_GETADDRINFO 1
 _ACEOF
@@ -5306,7 +5252,8 @@ _ACEOF
 #define BROKEN_SETREGID 1
 _ACEOF
-        cat >>confdefs.h <<_ACEOF
+cat >>confdefs.h <<_ACEOF
 #define BIND_8_COMPAT 1
 _ACEOF
@@ -5319,7 +5266,8 @@ _ACEOF
 #define USE_PIPES 1
 _ACEOF
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define LOGIN_NO_ENDOPT 1
 _ACEOF
@@ -5327,7 +5275,8 @@ _ACEOF
 #define LOGIN_NEEDS_UTMPX 1
 _ACEOF
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define LOCKED_PASSWD_STRING "*"
 _ACEOF
@@ -5335,6 +5284,7 @@ _ACEOF
 #define SPT_TYPE SPT_PSTAT
 _ACEOF
+        MAIL="/var/mail/username"
        LIBS="$LIBS -lsec"
 echo "$as_me:$LINENO: checking for t_error in -lxnet" >&5
@@ -5422,11 +5372,13 @@ fi
                fi
                ;;
        *-*-hpux11*)
-                cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define PAM_SUN_CODEBASE 1
 _ACEOF
-                cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define DISABLE_UTMP 1
 _ACEOF
@@ -5443,7 +5395,8 @@ _ACEOF
        # lastly, we define options specific to minor releases
        case "$host" in
        *-*-hpux10.26)
-                cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_SECUREWARE 1
 _ACEOF
@@ -5454,7 +5407,8 @@ _ACEOF
        ;;
 *-*-irix5*)
        PATH="$PATH:/usr/etc"
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define BROKEN_INET_NTOA 1
 _ACEOF
@@ -5470,7 +5424,8 @@ _ACEOF
 #define BROKEN_SETREGID 1
 _ACEOF
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define WITH_ABBREV_NO_TTY 1
 _ACEOF
@@ -5481,15 +5436,18 @@ _ACEOF
        ;;
 *-*-irix6*)
        PATH="$PATH:/usr/etc"
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define WITH_IRIX_ARRAY 1
 _ACEOF
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define WITH_IRIX_PROJECT 1
 _ACEOF
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define WITH_IRIX_AUDIT 1
 _ACEOF
@@ -5583,7 +5541,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_func_jlimit_startjob" >&5
 echo "${ECHO_T}$ac_cv_func_jlimit_startjob" >&6
 if test $ac_cv_func_jlimit_startjob = yes; then
-  cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define WITH_IRIX_JOBS 1
 _ACEOF
@@ -5605,7 +5564,8 @@ _ACEOF
 #define BROKEN_SETREGID 1
 _ACEOF
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define BROKEN_UPDWTMPX 1
 _ACEOF
@@ -5647,15 +5607,18 @@ _ACEOF
        no_dev_ptmx=1
        check_for_libcrypt_later=1
        check_for_openpty_ctty_bug=1
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define DONT_TRY_OTHER_AF 1
 _ACEOF
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define PAM_TTY_KLUDGE 1
 _ACEOF
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define LOCKED_PASSWD_PREFIX "!"
 _ACEOF
@@ -5663,7 +5626,8 @@ _ACEOF
 #define SPT_TYPE SPT_REUSEARGV
 _ACEOF
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define LINK_OPNOTSUPP_ERRNO EPERM
 _ACEOF
@@ -5672,25 +5636,429 @@ cat >>confdefs.h <<\_ACEOF
 #define _PATH_BTMP "/var/log/btmp"
 _ACEOF
+        cat >>confdefs.h <<\_ACEOF
-cat >>confdefs.h <<\_ACEOF
 #define USE_BTMP 1
 _ACEOF
        inet6_default_4in6=yes
        case `uname -r` in
        1.*|2.0.*)
-                cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define BROKEN_CMSG_TYPE 1
 _ACEOF
                ;;
        esac
+        # tun(4) forwarding compat code
+echo "$as_me:$LINENO: checking for ANSI C header files" >&5
+echo $ECHO_N "checking for ANSI C header files... $ECHO_C" >&6
+if test "${ac_cv_header_stdc+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#include <stdlib.h>
+#include <stdarg.h>
+#include <string.h>
+#include <float.h>
+int
+main ()
+{
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
+  (eval $ac_compile) 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } &&
+         { ac_try='test -z "$ac_c_werror_flag"                   || test ! -s conftest.err'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; } &&
+         { ac_try='test -s conftest.$ac_objext'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; }; then
+  ac_cv_header_stdc=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ac_cv_header_stdc=no
+fi
+rm -f conftest.err conftest.$ac_objext conftest.$ac_ext
+if test $ac_cv_header_stdc = yes; then
+  # SunOS 4.x string.h does not declare mem*, contrary to ANSI.
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#include <string.h>
+_ACEOF
+if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
+  $EGREP "memchr" >/dev/null 2>&1; then
+  :
+else
+  ac_cv_header_stdc=no
+fi
+rm -f conftest*
+fi
+if test $ac_cv_header_stdc = yes; then
+  # ISC 2.0.2 stdlib.h does not declare free, contrary to ANSI.
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#include <stdlib.h>
+_ACEOF
+if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
+  $EGREP "free" >/dev/null 2>&1; then
+  :
+else
+  ac_cv_header_stdc=no
+fi
+rm -f conftest*
+fi
+if test $ac_cv_header_stdc = yes; then
+  # /bin/cc in Irix-4.0.5 gets non-ANSI ctype macros unless using -ansi.
+  if test "$cross_compiling" = yes; then
+  :
+else
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#include <ctype.h>
+#if ((' ' & 0x0FF) == 0x020)
+# define ISLOWER(c) ('a' <= (c) && (c) <= 'z')
+# define TOUPPER(c) (ISLOWER(c) ? 'A' + ((c) - 'a') : (c))
+#else
+# define ISLOWER(c) \
+                   (('a' <= (c) && (c) <= 'i') \
+                     || ('j' <= (c) && (c) <= 'r') \
+                     || ('s' <= (c) && (c) <= 'z'))
+# define TOUPPER(c) (ISLOWER(c) ? ((c) | 0x40) : (c))
+#endif
+#define XOR(e, f) (((e) && !(f)) || (!(e) && (f)))
+int
+main ()
+{
+  int i;
+  for (i = 0; i < 256; i++)
+    if (XOR (islower (i), ISLOWER (i))
+        || toupper (i) != TOUPPER (i))
+      exit(2);
+  exit (0);
+}
+_ACEOF
+rm -f conftest$ac_exeext
+if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5
+  (eval $ac_link) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; }; then
+  :
+else
+  echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+( exit $ac_status )
+ac_cv_header_stdc=no
+fi
+rm -f core *.core gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
+fi
+fi
+fi
+echo "$as_me:$LINENO: result: $ac_cv_header_stdc" >&5
+echo "${ECHO_T}$ac_cv_header_stdc" >&6
+if test $ac_cv_header_stdc = yes; then
+cat >>confdefs.h <<\_ACEOF
+#define STDC_HEADERS 1
+_ACEOF
+fi
+# On IRIX 5.3, sys/types and inttypes.h are conflicting.
+for ac_header in sys/types.h sys/stat.h stdlib.h string.h memory.h strings.h \
+                  inttypes.h stdint.h unistd.h
+do
+as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
+echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6
+if eval "test \"\${$as_ac_Header+set}\" = set"; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+$ac_includes_default
+#include <$ac_header>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
+  (eval $ac_compile) 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } &&
+         { ac_try='test -z "$ac_c_werror_flag"                   || test ! -s conftest.err'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; } &&
+         { ac_try='test -s conftest.$ac_objext'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; }; then
+  eval "$as_ac_Header=yes"
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+eval "$as_ac_Header=no"
+fi
+rm -f conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+echo "$as_me:$LINENO: result: `eval echo '${'$as_ac_Header'}'`" >&5
+echo "${ECHO_T}`eval echo '${'$as_ac_Header'}'`" >&6
+if test `eval echo '${'$as_ac_Header'}'` = yes; then
+  cat >>confdefs.h <<_ACEOF
+#define `echo "HAVE_$ac_header" | $as_tr_cpp` 1
+_ACEOF
+fi
+done
+for ac_header in linux/if_tun.h
+do
+as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
+if eval "test \"\${$as_ac_Header+set}\" = set"; then
+  echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6
+if eval "test \"\${$as_ac_Header+set}\" = set"; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+fi
+echo "$as_me:$LINENO: result: `eval echo '${'$as_ac_Header'}'`" >&5
+echo "${ECHO_T}`eval echo '${'$as_ac_Header'}'`" >&6
+else
+  # Is the header compilable?
+echo "$as_me:$LINENO: checking $ac_header usability" >&5
+echo $ECHO_N "checking $ac_header usability... $ECHO_C" >&6
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+$ac_includes_default
+#include <$ac_header>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
+  (eval $ac_compile) 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } &&
+         { ac_try='test -z "$ac_c_werror_flag"                   || test ! -s conftest.err'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; } &&
+         { ac_try='test -s conftest.$ac_objext'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; }; then
+  ac_header_compiler=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ac_header_compiler=no
+fi
+rm -f conftest.err conftest.$ac_objext conftest.$ac_ext
+echo "$as_me:$LINENO: result: $ac_header_compiler" >&5
+echo "${ECHO_T}$ac_header_compiler" >&6
+# Is the header present?
+echo "$as_me:$LINENO: checking $ac_header presence" >&5
+echo $ECHO_N "checking $ac_header presence... $ECHO_C" >&6
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#include <$ac_header>
+_ACEOF
+if { (eval echo "$as_me:$LINENO: \"$ac_cpp conftest.$ac_ext\"") >&5
+  (eval $ac_cpp conftest.$ac_ext) 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } >/dev/null; then
+  if test -s conftest.err; then
+    ac_cpp_err=$ac_c_preproc_warn_flag
+    ac_cpp_err=$ac_cpp_err$ac_c_werror_flag
+  else
+    ac_cpp_err=
+  fi
+else
+  ac_cpp_err=yes
+fi
+if test -z "$ac_cpp_err"; then
+  ac_header_preproc=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+  ac_header_preproc=no
+fi
+rm -f conftest.err conftest.$ac_ext
+echo "$as_me:$LINENO: result: $ac_header_preproc" >&5
+echo "${ECHO_T}$ac_header_preproc" >&6
+# So?  What about this header?
+case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in
+  yes:no: )
+    { echo "$as_me:$LINENO: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&5
+echo "$as_me: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&2;}
+    { echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the compiler's result" >&5
+echo "$as_me: WARNING: $ac_header: proceeding with the compiler's result" >&2;}
+    ac_header_preproc=yes
+    ;;
+  no:yes:* )
+    { echo "$as_me:$LINENO: WARNING: $ac_header: present but cannot be compiled" >&5
+echo "$as_me: WARNING: $ac_header: present but cannot be compiled" >&2;}
+    { echo "$as_me:$LINENO: WARNING: $ac_header:     check for missing prerequisite headers?" >&5
+echo "$as_me: WARNING: $ac_header:     check for missing prerequisite headers?" >&2;}
+    { echo "$as_me:$LINENO: WARNING: $ac_header: see the Autoconf documentation" >&5
+echo "$as_me: WARNING: $ac_header: see the Autoconf documentation" >&2;}
+    { echo "$as_me:$LINENO: WARNING: $ac_header:     section \"Present But Cannot Be Compiled\"" >&5
+echo "$as_me: WARNING: $ac_header:     section \"Present But Cannot Be Compiled\"" >&2;}
+    { echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the preprocessor's result" >&5
+echo "$as_me: WARNING: $ac_header: proceeding with the preprocessor's result" >&2;}
+    { echo "$as_me:$LINENO: WARNING: $ac_header: in the future, the compiler will take precedence" >&5
+echo "$as_me: WARNING: $ac_header: in the future, the compiler will take precedence" >&2;}
+    (
+      cat <<\_ASBOX
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev@mindrot.org ##
+## ------------------------------------------- ##
+_ASBOX
+    ) |
+      sed "s/^/$as_me: WARNING:     /" >&2
+    ;;
+esac
+echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6
+if eval "test \"\${$as_ac_Header+set}\" = set"; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  eval "$as_ac_Header=\$ac_header_preproc"
+fi
+echo "$as_me:$LINENO: result: `eval echo '${'$as_ac_Header'}'`" >&5
+echo "${ECHO_T}`eval echo '${'$as_ac_Header'}'`" >&6
+fi
+if test `eval echo '${'$as_ac_Header'}'` = yes; then
+  cat >>confdefs.h <<_ACEOF
+#define `echo "HAVE_$ac_header" | $as_tr_cpp` 1
+_ACEOF
+fi
+done
+        if test "x$ac_cv_header_linux_if_tun_h" = "xyes" ; then
+cat >>confdefs.h <<\_ACEOF
+#define SSH_TUN_LINUX 1
+_ACEOF
+cat >>confdefs.h <<\_ACEOF
+#define SSH_TUN_COMPAT_AF 1
+_ACEOF
+cat >>confdefs.h <<\_ACEOF
+#define SSH_TUN_PREPEND_AF 1
+_ACEOF
+        fi
        ;;
 mips-sony-bsd|mips-sony-newsos4)
 cat >>confdefs.h <<\_ACEOF
-#define NEED_SETPRGP
+#define NEED_SETPGRP 1
 _ACEOF
        SONY=1
@@ -5700,9 +6068,323 @@ _ACEOF
        if test "x$withval" != "xno" ; then
                need_dash_r=1
        fi
+cat >>confdefs.h <<\_ACEOF
+#define SSH_TUN_FREEBSD 1
+_ACEOF
+        if test "${ac_cv_header_net_if_tap_h+set}" = set; then
+  echo "$as_me:$LINENO: checking for net/if_tap.h" >&5
+echo $ECHO_N "checking for net/if_tap.h... $ECHO_C" >&6
+if test "${ac_cv_header_net_if_tap_h+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+fi
+echo "$as_me:$LINENO: result: $ac_cv_header_net_if_tap_h" >&5
+echo "${ECHO_T}$ac_cv_header_net_if_tap_h" >&6
+else
+  # Is the header compilable?
+echo "$as_me:$LINENO: checking net/if_tap.h usability" >&5
+echo $ECHO_N "checking net/if_tap.h usability... $ECHO_C" >&6
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+$ac_includes_default
+#include <net/if_tap.h>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
+  (eval $ac_compile) 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } &&
+         { ac_try='test -z "$ac_c_werror_flag"                   || test ! -s conftest.err'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; } &&
+         { ac_try='test -s conftest.$ac_objext'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; }; then
+  ac_header_compiler=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ac_header_compiler=no
+fi
+rm -f conftest.err conftest.$ac_objext conftest.$ac_ext
+echo "$as_me:$LINENO: result: $ac_header_compiler" >&5
+echo "${ECHO_T}$ac_header_compiler" >&6
+# Is the header present?
+echo "$as_me:$LINENO: checking net/if_tap.h presence" >&5
+echo $ECHO_N "checking net/if_tap.h presence... $ECHO_C" >&6
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#include <net/if_tap.h>
+_ACEOF
+if { (eval echo "$as_me:$LINENO: \"$ac_cpp conftest.$ac_ext\"") >&5
+  (eval $ac_cpp conftest.$ac_ext) 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } >/dev/null; then
+  if test -s conftest.err; then
+    ac_cpp_err=$ac_c_preproc_warn_flag
+    ac_cpp_err=$ac_cpp_err$ac_c_werror_flag
+  else
+    ac_cpp_err=
+  fi
+else
+  ac_cpp_err=yes
+fi
+if test -z "$ac_cpp_err"; then
+  ac_header_preproc=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+  ac_header_preproc=no
+fi
+rm -f conftest.err conftest.$ac_ext
+echo "$as_me:$LINENO: result: $ac_header_preproc" >&5
+echo "${ECHO_T}$ac_header_preproc" >&6
+# So?  What about this header?
+case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in
+  yes:no: )
+    { echo "$as_me:$LINENO: WARNING: net/if_tap.h: accepted by the compiler, rejected by the preprocessor!" >&5
+echo "$as_me: WARNING: net/if_tap.h: accepted by the compiler, rejected by the preprocessor!" >&2;}
+    { echo "$as_me:$LINENO: WARNING: net/if_tap.h: proceeding with the compiler's result" >&5
+echo "$as_me: WARNING: net/if_tap.h: proceeding with the compiler's result" >&2;}
+    ac_header_preproc=yes
+    ;;
+  no:yes:* )
+    { echo "$as_me:$LINENO: WARNING: net/if_tap.h: present but cannot be compiled" >&5
+echo "$as_me: WARNING: net/if_tap.h: present but cannot be compiled" >&2;}
+    { echo "$as_me:$LINENO: WARNING: net/if_tap.h:     check for missing prerequisite headers?" >&5
+echo "$as_me: WARNING: net/if_tap.h:     check for missing prerequisite headers?" >&2;}
+    { echo "$as_me:$LINENO: WARNING: net/if_tap.h: see the Autoconf documentation" >&5
+echo "$as_me: WARNING: net/if_tap.h: see the Autoconf documentation" >&2;}
+    { echo "$as_me:$LINENO: WARNING: net/if_tap.h:     section \"Present But Cannot Be Compiled\"" >&5
+echo "$as_me: WARNING: net/if_tap.h:     section \"Present But Cannot Be Compiled\"" >&2;}
+    { echo "$as_me:$LINENO: WARNING: net/if_tap.h: proceeding with the preprocessor's result" >&5
+echo "$as_me: WARNING: net/if_tap.h: proceeding with the preprocessor's result" >&2;}
+    { echo "$as_me:$LINENO: WARNING: net/if_tap.h: in the future, the compiler will take precedence" >&5
+echo "$as_me: WARNING: net/if_tap.h: in the future, the compiler will take precedence" >&2;}
+    (
+      cat <<\_ASBOX
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev@mindrot.org ##
+## ------------------------------------------- ##
+_ASBOX
+    ) |
+      sed "s/^/$as_me: WARNING:     /" >&2
+    ;;
+esac
+echo "$as_me:$LINENO: checking for net/if_tap.h" >&5
+echo $ECHO_N "checking for net/if_tap.h... $ECHO_C" >&6
+if test "${ac_cv_header_net_if_tap_h+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  ac_cv_header_net_if_tap_h=$ac_header_preproc
+fi
+echo "$as_me:$LINENO: result: $ac_cv_header_net_if_tap_h" >&5
+echo "${ECHO_T}$ac_cv_header_net_if_tap_h" >&6
+fi
+if test $ac_cv_header_net_if_tap_h = yes; then
+  :
+else
+cat >>confdefs.h <<\_ACEOF
+#define SSH_TUN_NO_L2 1
+_ACEOF
+fi
+cat >>confdefs.h <<\_ACEOF
+#define SSH_TUN_PREPEND_AF 1
+_ACEOF
        ;;
 *-*-freebsd*)
        check_for_libcrypt_later=1
+cat >>confdefs.h <<\_ACEOF
+#define LOCKED_PASSWD_PREFIX "*LOCKED*"
+_ACEOF
+cat >>confdefs.h <<\_ACEOF
+#define SSH_TUN_FREEBSD 1
+_ACEOF
+        if test "${ac_cv_header_net_if_tap_h+set}" = set; then
+  echo "$as_me:$LINENO: checking for net/if_tap.h" >&5
+echo $ECHO_N "checking for net/if_tap.h... $ECHO_C" >&6
+if test "${ac_cv_header_net_if_tap_h+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+fi
+echo "$as_me:$LINENO: result: $ac_cv_header_net_if_tap_h" >&5
+echo "${ECHO_T}$ac_cv_header_net_if_tap_h" >&6
+else
+  # Is the header compilable?
+echo "$as_me:$LINENO: checking net/if_tap.h usability" >&5
+echo $ECHO_N "checking net/if_tap.h usability... $ECHO_C" >&6
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+$ac_includes_default
+#include <net/if_tap.h>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
+  (eval $ac_compile) 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } &&
+         { ac_try='test -z "$ac_c_werror_flag"                   || test ! -s conftest.err'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; } &&
+         { ac_try='test -s conftest.$ac_objext'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; }; then
+  ac_header_compiler=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ac_header_compiler=no
+fi
+rm -f conftest.err conftest.$ac_objext conftest.$ac_ext
+echo "$as_me:$LINENO: result: $ac_header_compiler" >&5
+echo "${ECHO_T}$ac_header_compiler" >&6
+# Is the header present?
+echo "$as_me:$LINENO: checking net/if_tap.h presence" >&5
+echo $ECHO_N "checking net/if_tap.h presence... $ECHO_C" >&6
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#include <net/if_tap.h>
+_ACEOF
+if { (eval echo "$as_me:$LINENO: \"$ac_cpp conftest.$ac_ext\"") >&5
+  (eval $ac_cpp conftest.$ac_ext) 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } >/dev/null; then
+  if test -s conftest.err; then
+    ac_cpp_err=$ac_c_preproc_warn_flag
+    ac_cpp_err=$ac_cpp_err$ac_c_werror_flag
+  else
+    ac_cpp_err=
+  fi
+else
+  ac_cpp_err=yes
+fi
+if test -z "$ac_cpp_err"; then
+  ac_header_preproc=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+  ac_header_preproc=no
+fi
+rm -f conftest.err conftest.$ac_ext
+echo "$as_me:$LINENO: result: $ac_header_preproc" >&5
+echo "${ECHO_T}$ac_header_preproc" >&6
+# So?  What about this header?
+case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in
+  yes:no: )
+    { echo "$as_me:$LINENO: WARNING: net/if_tap.h: accepted by the compiler, rejected by the preprocessor!" >&5
+echo "$as_me: WARNING: net/if_tap.h: accepted by the compiler, rejected by the preprocessor!" >&2;}
+    { echo "$as_me:$LINENO: WARNING: net/if_tap.h: proceeding with the compiler's result" >&5
+echo "$as_me: WARNING: net/if_tap.h: proceeding with the compiler's result" >&2;}
+    ac_header_preproc=yes
+    ;;
+  no:yes:* )
+    { echo "$as_me:$LINENO: WARNING: net/if_tap.h: present but cannot be compiled" >&5
+echo "$as_me: WARNING: net/if_tap.h: present but cannot be compiled" >&2;}
+    { echo "$as_me:$LINENO: WARNING: net/if_tap.h:     check for missing prerequisite headers?" >&5
+echo "$as_me: WARNING: net/if_tap.h:     check for missing prerequisite headers?" >&2;}
+    { echo "$as_me:$LINENO: WARNING: net/if_tap.h: see the Autoconf documentation" >&5
+echo "$as_me: WARNING: net/if_tap.h: see the Autoconf documentation" >&2;}
+    { echo "$as_me:$LINENO: WARNING: net/if_tap.h:     section \"Present But Cannot Be Compiled\"" >&5
+echo "$as_me: WARNING: net/if_tap.h:     section \"Present But Cannot Be Compiled\"" >&2;}
+    { echo "$as_me:$LINENO: WARNING: net/if_tap.h: proceeding with the preprocessor's result" >&5
+echo "$as_me: WARNING: net/if_tap.h: proceeding with the preprocessor's result" >&2;}
+    { echo "$as_me:$LINENO: WARNING: net/if_tap.h: in the future, the compiler will take precedence" >&5
+echo "$as_me: WARNING: net/if_tap.h: in the future, the compiler will take precedence" >&2;}
+    (
+      cat <<\_ASBOX
+## ------------------------------------------- ##
+## Report this to openssh-unix-dev@mindrot.org ##
+## ------------------------------------------- ##
+_ASBOX
+    ) |
+      sed "s/^/$as_me: WARNING:     /" >&2
+    ;;
+esac
+echo "$as_me:$LINENO: checking for net/if_tap.h" >&5
+echo $ECHO_N "checking for net/if_tap.h... $ECHO_C" >&6
+if test "${ac_cv_header_net_if_tap_h+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  ac_cv_header_net_if_tap_h=$ac_header_preproc
+fi
+echo "$as_me:$LINENO: result: $ac_cv_header_net_if_tap_h" >&5
+echo "${ECHO_T}$ac_cv_header_net_if_tap_h" >&6
+fi
+if test $ac_cv_header_net_if_tap_h = yes; then
+  :
+else
+cat >>confdefs.h <<\_ACEOF
+#define SSH_TUN_NO_L2 1
+_ACEOF
+fi
        ;;
 *-*-bsdi*)
        cat >>confdefs.h <<\_ACEOF
@@ -5723,7 +6405,8 @@ _ACEOF
        conf_utmp_location=/etc/utmp
        conf_wtmp_location=/usr/adm/wtmp
        MAIL=/usr/spool/mail
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_NEXT 1
 _ACEOF
@@ -5735,7 +6418,8 @@ _ACEOF
 #define USE_PIPES 1
 _ACEOF
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define BROKEN_SAVED_UIDS 1
 _ACEOF
@@ -5746,6 +6430,16 @@ cat >>confdefs.h <<\_ACEOF
 #define HAVE_ATTRIBUTE__SENTINEL__ 1
 _ACEOF
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_ATTRIBUTE__BOUNDED__ 1
+_ACEOF
+cat >>confdefs.h <<\_ACEOF
+#define SSH_TUN_OPENBSD 1
+_ACEOF
        ;;
 *-*-solaris*)
        if test "x$withval" != "xno" ; then
@@ -5759,7 +6453,8 @@ _ACEOF
 #define LOGIN_NEEDS_UTMPX 1
 _ACEOF
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define LOGIN_NEEDS_TERM 1
 _ACEOF
@@ -5767,7 +6462,8 @@ _ACEOF
 #define PAM_TTY_KLUDGE 1
 _ACEOF
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define SSHPAM_CHAUTHTOK_NEEDS_RUID 1
 _ACEOF
@@ -5776,7 +6472,8 @@ _ACEOF
 _ACEOF
        # Pushing STREAMS modules will cause sshd to acquire a controlling tty.
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define SSHD_ACQUIRES_CTTY 1
 _ACEOF
@@ -5793,7 +6490,8 @@ echo "${ECHO_T}yes" >&6
 #define DISABLE_UTMP 1
 _ACEOF
-                cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define DISABLE_WTMP 1
 _ACEOF
@@ -6015,14 +6713,14 @@ _ACEOF
 fi
-        # -lresolv needs to be at then end of LIBS or DNS lookups break
+        # -lresolv needs to be at the end of LIBS or DNS lookups break
-        echo "$as_me:$LINENO: checking for resolv in -lres_query" >&5
+        echo "$as_me:$LINENO: checking for res_query in -lresolv" >&5
-echo $ECHO_N "checking for resolv in -lres_query... $ECHO_C" >&6
+echo $ECHO_N "checking for res_query in -lresolv... $ECHO_C" >&6
-if test "${ac_cv_lib_res_query_resolv+set}" = set; then
+if test "${ac_cv_lib_resolv_res_query+set}" = set; then
  echo $ECHO_N "(cached) $ECHO_C" >&6
 else
  ac_check_lib_save_LIBS=$LIBS
-LIBS="-lres_query  $LIBS"
+LIBS="-lresolv  $LIBS"
 cat >conftest.$ac_ext <<_ACEOF
 /* confdefs.h.  */
 _ACEOF
@@ -6036,11 +6734,11 @@ extern "C"
 #endif
 /* We use char because int might match the return type of a gcc2
   builtin and then its argument prototype would still apply.  */
-char resolv ();
+char res_query ();
 int
 main ()
 {
-resolv ();
+res_query ();
  ;
  return 0;
 }
@@ -6066,20 +6764,20 @@ if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5
  ac_status=$?
  echo "$as_me:$LINENO: \$? = $ac_status" >&5
  (exit $ac_status); }; }; then
-  ac_cv_lib_res_query_resolv=yes
+  ac_cv_lib_resolv_res_query=yes
 else
  echo "$as_me: failed program was:" >&5
 sed 's/^/| /' conftest.$ac_ext >&5
-ac_cv_lib_res_query_resolv=no
+ac_cv_lib_resolv_res_query=no
 fi
 rm -f conftest.err conftest.$ac_objext \
      conftest$ac_exeext conftest.$ac_ext
 LIBS=$ac_check_lib_save_LIBS
 fi
-echo "$as_me:$LINENO: result: $ac_cv_lib_res_query_resolv" >&5
+echo "$as_me:$LINENO: result: $ac_cv_lib_resolv_res_query" >&5
-echo "${ECHO_T}$ac_cv_lib_res_query_resolv" >&6
+echo "${ECHO_T}$ac_cv_lib_resolv_res_query" >&6
-if test $ac_cv_lib_res_query_resolv = yes; then
+if test $ac_cv_lib_resolv_res_query = yes; then
   LIBS="$LIBS -lresolv"
 fi
@@ -6115,6 +6813,7 @@ _ACEOF
        ;;
 # UnixWare 1.x, UnixWare 2.x, and others based on code from Univel.
 *-*-sysv4.2*)
+        CFLAGS="$CFLAGS -Dva_list=_VA_LIST"
        cat >>confdefs.h <<\_ACEOF
 #define USE_PIPES 1
 _ACEOF
@@ -6136,6 +6835,10 @@ cat >>confdefs.h <<\_ACEOF
 #define PASSWD_NEEDS_USERNAME 1
 _ACEOF
+        cat >>confdefs.h <<\_ACEOF
+#define LOCKED_PASSWD_STRING "*LK*"
+_ACEOF
        ;;
 # UnixWare 7.x, OpenUNIX 8
 *-*-sysv5*)
@@ -6161,8 +6864,7 @@ _ACEOF
 #define BROKEN_SETREGID 1
 _ACEOF
+        cat >>confdefs.h <<\_ACEOF
-cat >>confdefs.h <<\_ACEOF
 #define PASSWD_NEEDS_USERNAME 1
 _ACEOF
@@ -6175,6 +6877,11 @@ cat >>confdefs.h <<\_ACEOF
 _ACEOF
                ;;
+        *)      cat >>confdefs.h <<\_ACEOF
+#define LOCKED_PASSWD_STRING "*LK*"
+_ACEOF
+                ;;
        esac
        ;;
 *-*-sysv*)
@@ -6228,8 +6935,7 @@ _ACEOF
 #define BROKEN_UPDWTMPX 1
 _ACEOF
+        cat >>confdefs.h <<\_ACEOF
-cat >>confdefs.h <<\_ACEOF
 #define PASSWD_NEEDS_USERNAME 1
 _ACEOF
@@ -6339,7 +7045,8 @@ done
        TEST_SHELL=ksh
        ;;
 *-*-unicosmk*)
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define NO_SSH_LASTLOG 1
 _ACEOF
@@ -6445,11 +7152,13 @@ fi;
                if test -f /etc/sia/matrix.conf; then
                        echo "$as_me:$LINENO: result: yes" >&5
 echo "${ECHO_T}yes" >&6
-                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_OSF_SIA 1
 _ACEOF
-                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define DISABLE_LOGIN 1
 _ACEOF
@@ -6461,7 +7170,8 @@ _ACEOF
                else
                        echo "$as_me:$LINENO: result: no" >&5
 echo "${ECHO_T}no" >&6
-                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define LOCKED_PASSWD_SUBSTR "Nologin"
 _ACEOF
@@ -6485,7 +7195,7 @@ _ACEOF
        ;;
-*-*-nto-qnx)
+*-*-nto-qnx*)
        cat >>confdefs.h <<\_ACEOF
 #define USE_PIPES 1
 _ACEOF
@@ -6494,34 +7204,40 @@ _ACEOF
 #define NO_X11_UNIX_SOCKETS 1
 _ACEOF
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define MISSING_NFDBITS 1
 _ACEOF
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define MISSING_HOWMANY 1
 _ACEOF
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define MISSING_FD_MASK 1
 _ACEOF
+        cat >>confdefs.h <<\_ACEOF
+#define DISABLE_LASTLOG 1
+_ACEOF
        ;;
 *-*-ultrix*)
 cat >>confdefs.h <<\_ACEOF
-#define BROKEN_GETGROUPS
+#define BROKEN_GETGROUPS 1
 _ACEOF
 cat >>confdefs.h <<\_ACEOF
-#define BROKEN_MMAP
+#define BROKEN_MMAP 1
 _ACEOF
+        cat >>confdefs.h <<\_ACEOF
-cat >>confdefs.h <<\_ACEOF
+#define NEED_SETPGRP 1
-#define NEED_SETPRGP
 _ACEOF
@@ -6533,7 +7249,7 @@ _ACEOF
 *-*-lynxos)
        CFLAGS="$CFLAGS -D__NO_INCLUDE_WARN__"
-        cat >>confdefs.h <<\_ACEOF
+        cat >>confdefs.h <<\_ACEOF
 #define MISSING_HOWMANY 1
 _ACEOF
@@ -6601,7 +7317,7 @@ if test "${with_Werror+set}" = set; then
                if test -n "$withval"  &&  test "x$withval" != "xno"; then
                        werror_flags="-Werror"
-                        if "x${withval}" != "xyes"; then
+                        if test "x${withval}" != "xyes"; then
                                werror_flags="$withval"
                        fi
                fi
@@ -6658,260 +7374,6 @@ rm -f core *.core gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftes
 fi
-echo "$as_me:$LINENO: checking for egrep" >&5
-echo $ECHO_N "checking for egrep... $ECHO_C" >&6
-if test "${ac_cv_prog_egrep+set}" = set; then
-  echo $ECHO_N "(cached) $ECHO_C" >&6
-else
-  if echo a | (grep -E '(a|b)') >/dev/null 2>&1
-    then ac_cv_prog_egrep='grep -E'
-    else ac_cv_prog_egrep='egrep'
-    fi
-fi
-echo "$as_me:$LINENO: result: $ac_cv_prog_egrep" >&5
-echo "${ECHO_T}$ac_cv_prog_egrep" >&6
- EGREP=$ac_cv_prog_egrep
-echo "$as_me:$LINENO: checking for ANSI C header files" >&5
-echo $ECHO_N "checking for ANSI C header files... $ECHO_C" >&6
-if test "${ac_cv_header_stdc+set}" = set; then
-  echo $ECHO_N "(cached) $ECHO_C" >&6
-else
-  cat >conftest.$ac_ext <<_ACEOF
-/* confdefs.h.  */
-_ACEOF
-cat confdefs.h >>conftest.$ac_ext
-cat >>conftest.$ac_ext <<_ACEOF
-/* end confdefs.h.  */
-#include <stdlib.h>
-#include <stdarg.h>
-#include <string.h>
-#include <float.h>
-int
-main ()
-{
-  ;
-  return 0;
-}
-_ACEOF
-rm -f conftest.$ac_objext
-if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
-  (eval $ac_compile) 2>conftest.er1
-  ac_status=$?
-  grep -v '^ *+' conftest.er1 >conftest.err
-  rm -f conftest.er1
-  cat conftest.err >&5
-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); } &&
-         { ac_try='test -z "$ac_c_werror_flag"                   || test ! -s conftest.err'
-  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
-  (eval $ac_try) 2>&5
-  ac_status=$?
-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); }; } &&
-         { ac_try='test -s conftest.$ac_objext'
-  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
-  (eval $ac_try) 2>&5
-  ac_status=$?
-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); }; }; then
-  ac_cv_header_stdc=yes
-else
-  echo "$as_me: failed program was:" >&5
-sed 's/^/| /' conftest.$ac_ext >&5
-ac_cv_header_stdc=no
-fi
-rm -f conftest.err conftest.$ac_objext conftest.$ac_ext
-if test $ac_cv_header_stdc = yes; then
-  # SunOS 4.x string.h does not declare mem*, contrary to ANSI.
-  cat >conftest.$ac_ext <<_ACEOF
-/* confdefs.h.  */
-_ACEOF
-cat confdefs.h >>conftest.$ac_ext
-cat >>conftest.$ac_ext <<_ACEOF
-/* end confdefs.h.  */
-#include <string.h>
-_ACEOF
-if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
-  $EGREP "memchr" >/dev/null 2>&1; then
-  :
-else
-  ac_cv_header_stdc=no
-fi
-rm -f conftest*
-fi
-if test $ac_cv_header_stdc = yes; then
-  # ISC 2.0.2 stdlib.h does not declare free, contrary to ANSI.
-  cat >conftest.$ac_ext <<_ACEOF
-/* confdefs.h.  */
-_ACEOF
-cat confdefs.h >>conftest.$ac_ext
-cat >>conftest.$ac_ext <<_ACEOF
-/* end confdefs.h.  */
-#include <stdlib.h>
-_ACEOF
-if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
-  $EGREP "free" >/dev/null 2>&1; then
-  :
-else
-  ac_cv_header_stdc=no
-fi
-rm -f conftest*
-fi
-if test $ac_cv_header_stdc = yes; then
-  # /bin/cc in Irix-4.0.5 gets non-ANSI ctype macros unless using -ansi.
-  if test "$cross_compiling" = yes; then
-  :
-else
-  cat >conftest.$ac_ext <<_ACEOF
-/* confdefs.h.  */
-_ACEOF
-cat confdefs.h >>conftest.$ac_ext
-cat >>conftest.$ac_ext <<_ACEOF
-/* end confdefs.h.  */
-#include <ctype.h>
-#if ((' ' & 0x0FF) == 0x020)
-# define ISLOWER(c) ('a' <= (c) && (c) <= 'z')
-# define TOUPPER(c) (ISLOWER(c) ? 'A' + ((c) - 'a') : (c))
-#else
-# define ISLOWER(c) \
-                   (('a' <= (c) && (c) <= 'i') \
-                     || ('j' <= (c) && (c) <= 'r') \
-                     || ('s' <= (c) && (c) <= 'z'))
-# define TOUPPER(c) (ISLOWER(c) ? ((c) | 0x40) : (c))
-#endif
-#define XOR(e, f) (((e) && !(f)) || (!(e) && (f)))
-int
-main ()
-{
-  int i;
-  for (i = 0; i < 256; i++)
-    if (XOR (islower (i), ISLOWER (i))
-        || toupper (i) != TOUPPER (i))
-      exit(2);
-  exit (0);
-}
-_ACEOF
-rm -f conftest$ac_exeext
-if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5
-  (eval $ac_link) 2>&5
-  ac_status=$?
-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
-  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
-  (eval $ac_try) 2>&5
-  ac_status=$?
-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); }; }; then
-  :
-else
-  echo "$as_me: program exited with status $ac_status" >&5
-echo "$as_me: failed program was:" >&5
-sed 's/^/| /' conftest.$ac_ext >&5
-( exit $ac_status )
-ac_cv_header_stdc=no
-fi
-rm -f core *.core gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
-fi
-fi
-fi
-echo "$as_me:$LINENO: result: $ac_cv_header_stdc" >&5
-echo "${ECHO_T}$ac_cv_header_stdc" >&6
-if test $ac_cv_header_stdc = yes; then
-cat >>confdefs.h <<\_ACEOF
-#define STDC_HEADERS 1
-_ACEOF
-fi
-# On IRIX 5.3, sys/types and inttypes.h are conflicting.
-for ac_header in sys/types.h sys/stat.h stdlib.h string.h memory.h strings.h \
-                  inttypes.h stdint.h unistd.h
-do
-as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
-echo "$as_me:$LINENO: checking for $ac_header" >&5
-echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6
-if eval "test \"\${$as_ac_Header+set}\" = set"; then
-  echo $ECHO_N "(cached) $ECHO_C" >&6
-else
-  cat >conftest.$ac_ext <<_ACEOF
-/* confdefs.h.  */
-_ACEOF
-cat confdefs.h >>conftest.$ac_ext
-cat >>conftest.$ac_ext <<_ACEOF
-/* end confdefs.h.  */
-$ac_includes_default
-#include <$ac_header>
-_ACEOF
-rm -f conftest.$ac_objext
-if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
-  (eval $ac_compile) 2>conftest.er1
-  ac_status=$?
-  grep -v '^ *+' conftest.er1 >conftest.err
-  rm -f conftest.er1
-  cat conftest.err >&5
-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); } &&
-         { ac_try='test -z "$ac_c_werror_flag"                   || test ! -s conftest.err'
-  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
-  (eval $ac_try) 2>&5
-  ac_status=$?
-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); }; } &&
-         { ac_try='test -s conftest.$ac_objext'
-  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
-  (eval $ac_try) 2>&5
-  ac_status=$?
-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); }; }; then
-  eval "$as_ac_Header=yes"
-else
-  echo "$as_me: failed program was:" >&5
-sed 's/^/| /' conftest.$ac_ext >&5
-eval "$as_ac_Header=no"
-fi
-rm -f conftest.err conftest.$ac_objext conftest.$ac_ext
-fi
-echo "$as_me:$LINENO: result: `eval echo '${'$as_ac_Header'}'`" >&5
-echo "${ECHO_T}`eval echo '${'$as_ac_Header'}'`" >&6
-if test `eval echo '${'$as_ac_Header'}'` = yes; then
-  cat >>confdefs.h <<_ACEOF
-#define `echo "HAVE_$ac_header" | $as_tr_cpp` 1
-_ACEOF
-fi
-done
@@ -6978,7 +7440,6 @@ for ac_header in \
        glob.h \
        ia.h \
        iaf.h \
-        lastlog.h \
        limits.h \
        login.h \
        login_cap.h \
@@ -6986,7 +7447,6 @@ for ac_header in \
        ndir.h \
        netdb.h \
        netgroup.h \
-        netinet/in_systm.h \
        pam/pam_appl.h \
        paths.h \
        pty.h \
@@ -7175,6 +7635,72 @@ fi
 done
+# lastlog.h requires sys/time.h to be included first on Solaris
+for ac_header in lastlog.h
+do
+as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
+echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6
+if eval "test \"\${$as_ac_Header+set}\" = set"; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#ifdef HAVE_SYS_TIME_H
+# include <sys/time.h>
+#endif
+#include <$ac_header>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
+  (eval $ac_compile) 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } &&
+         { ac_try='test -z "$ac_c_werror_flag"                   || test ! -s conftest.err'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; } &&
+         { ac_try='test -s conftest.$ac_objext'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; }; then
+  eval "$as_ac_Header=yes"
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+eval "$as_ac_Header=no"
+fi
+rm -f conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+echo "$as_me:$LINENO: result: `eval echo '${'$as_ac_Header'}'`" >&5
+echo "${ECHO_T}`eval echo '${'$as_ac_Header'}'`" >&6
+if test `eval echo '${'$as_ac_Header'}'` = yes; then
+  cat >>confdefs.h <<_ACEOF
+#define `echo "HAVE_$ac_header" | $as_tr_cpp` 1
+_ACEOF
+fi
+done
 # sys/ptms.h requires sys/stream.h to be included first on Solaris
 for ac_header in sys/ptms.h
@@ -7899,11 +8425,7 @@ else
                        save_LIBS="$LIBS"
                        LIBS="$LIBS -lgen"
                        if test "$cross_compiling" = yes; then
-  { { echo "$as_me:$LINENO: error: cannot run test program while cross compiling
+   ac_cv_have_broken_dirname="no"
-See \`config.log' for more details." >&5
-echo "$as_me: error: cannot run test program while cross compiling
-See \`config.log' for more details." >&2;}
-   { (exit 1); exit 1; }; }
 else
  cat >conftest.$ac_ext <<_ACEOF
 /* confdefs.h.  */
@@ -7947,7 +8469,6 @@ sed 's/^/| /' conftest.$ac_ext >&5
 ( exit $ac_status )
 ac_cv_have_broken_dirname="yes"
 fi
 rm -f core *.core gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
 fi
@@ -8402,7 +8923,8 @@ echo "$as_me:$LINENO: result: $ac_cv_search_basename" >&5
 echo "${ECHO_T}$ac_cv_search_basename" >&6
 if test "$ac_cv_search_basename" != no; then
  test "$ac_cv_search_basename" = "none required" || LIBS="$ac_cv_search_basename $LIBS"
-  cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_BASENAME 1
 _ACEOF
@@ -8989,9 +9511,13 @@ fi
 fi
-echo "$as_me:$LINENO: checking for utimes" >&5
-echo $ECHO_N "checking for utimes... $ECHO_C" >&6
+for ac_func in utimes
-if test "${ac_cv_func_utimes+set}" = set; then
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6
+if eval "test \"\${$as_ac_var+set}\" = set"; then
  echo $ECHO_N "(cached) $ECHO_C" >&6
 else
  cat >conftest.$ac_ext <<_ACEOF
@@ -9000,12 +9526,12 @@ _ACEOF
 cat confdefs.h >>conftest.$ac_ext
 cat >>conftest.$ac_ext <<_ACEOF
 /* end confdefs.h.  */
-/* Define utimes to an innocuous variant, in case <limits.h> declares utimes.
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
   For example, HP-UX 11i <limits.h> declares gettimeofday.  */
-#define utimes innocuous_utimes
+#define $ac_func innocuous_$ac_func
 /* System header to define __stub macros and hopefully few prototypes,
-    which can conflict with char utimes (); below.
+    which can conflict with char $ac_func (); below.
    Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
    <limits.h> exists even on freestanding compilers.  */
@@ -9015,7 +9541,7 @@ cat >>conftest.$ac_ext <<_ACEOF
 # include <assert.h>
 #endif
-#undef utimes
+#undef $ac_func
 /* Override any gcc2 internal prototype to avoid an error.  */
 #ifdef __cplusplus
@@ -9024,14 +9550,14 @@ extern "C"
 #endif
 /* We use char because int might match the return type of a gcc2
   builtin and then its argument prototype would still apply.  */
-char utimes ();
+char $ac_func ();
 /* The GNU C library defines this for functions which it implements
    to always fail with ENOSYS.  Some functions are actually named
    something starting with __ and the normal name is an alias.  */
-#if defined (__stub_utimes) || defined (__stub___utimes)
+#if defined (__stub_$ac_func) || defined (__stub___$ac_func)
 choke me
 #else
-char (*f) () = utimes;
+char (*f) () = $ac_func;
 #endif
 #ifdef __cplusplus
 }
@@ -9040,7 +9566,7 @@ char (*f) () = utimes;
 int
 main ()
 {
-return f != utimes;
+return f != $ac_func;
  ;
  return 0;
 }
@@ -9066,20 +9592,23 @@ if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5
  ac_status=$?
  echo "$as_me:$LINENO: \$? = $ac_status" >&5
  (exit $ac_status); }; }; then
-  ac_cv_func_utimes=yes
+  eval "$as_ac_var=yes"
 else
  echo "$as_me: failed program was:" >&5
 sed 's/^/| /' conftest.$ac_ext >&5
-ac_cv_func_utimes=no
+eval "$as_ac_var=no"
 fi
 rm -f conftest.err conftest.$ac_objext \
      conftest$ac_exeext conftest.$ac_ext
 fi
-echo "$as_me:$LINENO: result: $ac_cv_func_utimes" >&5
+echo "$as_me:$LINENO: result: `eval echo '${'$as_ac_var'}'`" >&5
-echo "${ECHO_T}$ac_cv_func_utimes" >&6
+echo "${ECHO_T}`eval echo '${'$as_ac_var'}'`" >&6
-if test $ac_cv_func_utimes = yes; then
+if test `eval echo '${'$as_ac_var'}'` = yes; then
-  :
+  cat >>confdefs.h <<_ACEOF
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
+_ACEOF
 else
   echo "$as_me:$LINENO: checking for utimes in -lc89" >&5
 echo $ECHO_N "checking for utimes in -lc89... $ECHO_C" >&6
@@ -9154,6 +9683,7 @@ fi
 fi
+done
@@ -9426,7 +9956,8 @@ echo "$as_me:$LINENO: result: $ac_cv_search_login" >&5
 echo "${ECHO_T}$ac_cv_search_login" >&6
 if test "$ac_cv_search_login" != no; then
  test "$ac_cv_search_login" = "none required" || LIBS="$ac_cv_search_login $LIBS"
-  cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_LOGIN 1
 _ACEOF
@@ -9730,7 +10261,8 @@ _ACEOF
 if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
  $EGREP "FOUNDIT" >/dev/null 2>&1; then
-                cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define GLOB_HAS_ALTDIRFUNC 1
 _ACEOF
@@ -9764,7 +10296,8 @@ _ACEOF
 if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
  $EGREP "FOUNDIT" >/dev/null 2>&1; then
-                cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define GLOB_HAS_GL_MATCHC 1
 _ACEOF
@@ -9828,7 +10361,8 @@ sed 's/^/| /' conftest.$ac_ext >&5
                echo "$as_me:$LINENO: result: no" >&5
 echo "${ECHO_T}no" >&6
-                cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define BROKEN_ONE_BYTE_DIRENT_D_NAME 1
 _ACEOF
@@ -9840,7 +10374,8 @@ fi
 echo "$as_me:$LINENO: checking for /proc/pid/fd directory" >&5
 echo $ECHO_N "checking for /proc/pid/fd directory... $ECHO_C" >&6
 if test -d "/proc/$$/fd" ; then
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_PROC_PID 1
 _ACEOF
@@ -9865,7 +10400,8 @@ if test "${with_skey+set}" = set; then
                                LDFLAGS="$LDFLAGS -L${withval}/lib"
                        fi
-                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define SKEY 1
 _ACEOF
@@ -9874,14 +10410,7 @@ _ACEOF
                        echo "$as_me:$LINENO: checking for s/key support" >&5
 echo $ECHO_N "checking for s/key support... $ECHO_C" >&6
-                        if test "$cross_compiling" = yes; then
+                        cat >conftest.$ac_ext <<_ACEOF
-  { { echo "$as_me:$LINENO: error: cannot run test program while cross compiling
-See \`config.log' for more details." >&5
-echo "$as_me: error: cannot run test program while cross compiling
-See \`config.log' for more details." >&2;}
-   { (exit 1); exit 1; }; }
-else
-  cat >conftest.$ac_ext <<_ACEOF
 /* confdefs.h.  */
 _ACEOF
 cat confdefs.h >>conftest.$ac_ext
@@ -9893,12 +10422,22 @@ cat >>conftest.$ac_ext <<_ACEOF
 int main() { char *ff = skey_keyinfo(""); ff=""; exit(0); }
 _ACEOF
-rm -f conftest$ac_exeext
+rm -f conftest.$ac_objext conftest$ac_exeext
 if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5
-  (eval $ac_link) 2>&5
+  (eval $ac_link) 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } &&
+         { ac_try='test -z "$ac_c_werror_flag"                   || test ! -s conftest.err'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
  ac_status=$?
  echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+  (exit $ac_status); }; } &&
+         { ac_try='test -s conftest$ac_exeext'
  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
  (eval $ac_try) 2>&5
  ac_status=$?
@@ -9907,11 +10446,9 @@ if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5
  echo "$as_me:$LINENO: result: yes" >&5
 echo "${ECHO_T}yes" >&6
 else
-  echo "$as_me: program exited with status $ac_status" >&5
+  echo "$as_me: failed program was:" >&5
-echo "$as_me: failed program was:" >&5
 sed 's/^/| /' conftest.$ac_ext >&5
-( exit $ac_status )
                                        echo "$as_me:$LINENO: result: no" >&5
 echo "${ECHO_T}no" >&6
@@ -9920,8 +10457,8 @@ echo "$as_me: error: ** Incomplete or missing s/key libraries." >&2;}
   { (exit 1); exit 1; }; }
 fi
-rm -f core *.core gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
+rm -f conftest.err conftest.$ac_objext \
-fi
+      conftest$ac_exeext conftest.$ac_ext
                        echo "$as_me:$LINENO: checking if skeychallenge takes 4 arguments" >&5
 echo $ECHO_N "checking if skeychallenge takes 4 arguments... $ECHO_C" >&6
                        cat >conftest.$ac_ext <<_ACEOF
@@ -9963,7 +10500,8 @@ if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
  (exit $ac_status); }; }; then
  echo "$as_me:$LINENO: result: yes" >&5
 echo "${ECHO_T}yes" >&6
-                                 cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define SKEYCHALLENGE_4ARG 1
 _ACEOF
@@ -10062,7 +10600,8 @@ if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5
                                        echo "$as_me:$LINENO: result: yes" >&5
 echo "${ECHO_T}yes" >&6
-                                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define LIBWRAP 1
 _ACEOF
@@ -10096,8 +10635,12 @@ if test "${with_libedit+set}" = set; then
  withval="$with_libedit"
   if test "x$withval" != "xno" ; then
                if test "x$withval" != "xyes"; then
-                        CPPFLAGS="$CPPFLAGS -I$withval/include"
+                        CPPFLAGS="$CPPFLAGS -I${withval}/include"
-                        LDFLAGS="$LDFLAGS -L$withval/lib"
+                        if test -n "${need_dash_r}"; then
+                                LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
+                        else
+                                LDFLAGS="-L${withval}/lib ${LDFLAGS}"
+                        fi
                fi
                echo "$as_me:$LINENO: checking for el_init in -ledit" >&5
 echo $ECHO_N "checking for el_init in -ledit... $ECHO_C" >&6
@@ -10166,7 +10709,7 @@ echo "${ECHO_T}$ac_cv_lib_edit_el_init" >&6
 if test $ac_cv_lib_edit_el_init = yes; then
 cat >>confdefs.h <<\_ACEOF
-#define USE_LIBEDIT
+#define USE_LIBEDIT 1
 _ACEOF
                          LIBEDIT="-ledit -lcurses"
@@ -10688,7 +11231,7 @@ done
 cat >>confdefs.h <<\_ACEOF
-#define USE_BSM_AUDIT
+#define USE_BSM_AUDIT 1
 _ACEOF
                ;;
@@ -10698,7 +11241,7 @@ _ACEOF
 echo "${ECHO_T}debug" >&6
 cat >>confdefs.h <<\_ACEOF
-#define SSH_AUDIT_EVENTS
+#define SSH_AUDIT_EVENTS 1
 _ACEOF
                ;;
@@ -10795,8 +11338,10 @@ fi;
 for ac_func in \
        arc4random \
+        asprintf \
        b64_ntop \
        __b64_ntop \
        b64_pton \
@@ -10872,7 +11417,7 @@ for ac_func in \
        truncate \
        unsetenv \
        updwtmpx \
-        utimes \
+        vasprintf \
        vhangup \
        vsnprintf \
        waitpid \
@@ -11261,7 +11806,8 @@ echo "$as_me:$LINENO: result: $ac_cv_search_nanosleep" >&5
 echo "${ECHO_T}$ac_cv_search_nanosleep" >&6
 if test "$ac_cv_search_nanosleep" != no; then
  test "$ac_cv_search_nanosleep" = "none required" || LIBS="$ac_cv_search_nanosleep $LIBS"
-  cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_NANOSLEEP 1
 _ACEOF
@@ -11968,6 +12514,7 @@ echo "$as_me: failed program was:" >&5
 sed 's/^/| /' conftest.$ac_ext >&5
 ( exit $ac_status )
 cat >>confdefs.h <<\_ACEOF
 #define BROKEN_SETRESUID 1
 _ACEOF
@@ -12118,6 +12665,7 @@ echo "$as_me: failed program was:" >&5
 sed 's/^/| /' conftest.$ac_ext >&5
 ( exit $ac_status )
 cat >>confdefs.h <<\_ACEOF
 #define BROKEN_SETRESGID 1
 _ACEOF
@@ -12739,7 +13287,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_func_daemon" >&5
 echo "${ECHO_T}$ac_cv_func_daemon" >&6
 if test $ac_cv_func_daemon = yes; then
-  cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_DAEMON 1
 _ACEOF
@@ -12908,7 +13457,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_func_getpagesize" >&5
 echo "${ECHO_T}$ac_cv_func_getpagesize" >&6
 if test $ac_cv_func_getpagesize = yes; then
-  cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_GETPAGESIZE 1
 _ACEOF
@@ -13029,7 +13579,8 @@ sed 's/^/| /' conftest.$ac_ext >&5
                        echo "$as_me:$LINENO: result: no" >&5
 echo "${ECHO_T}no" >&6
-                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define BROKEN_SNPRINTF 1
 _ACEOF
@@ -13041,6 +13592,133 @@ rm -f core *.core gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftes
 fi
 fi
+# If we don't have a working asprintf, then we strongly depend on vsnprintf
+# returning the right thing on overflow: the number of characters it tried to
+# create (as per SUSv3)
+if test "x$ac_cv_func_asprintf" != "xyes" && \
+   test "x$ac_cv_func_vsnprintf" = "xyes" ; then
+        echo "$as_me:$LINENO: checking whether vsnprintf returns correct values on overflow" >&5
+echo $ECHO_N "checking whether vsnprintf returns correct values on overflow... $ECHO_C" >&6
+        if test "$cross_compiling" = yes; then
+   { echo "$as_me:$LINENO: WARNING: cross compiling: Assuming working vsnprintf()" >&5
+echo "$as_me: WARNING: cross compiling: Assuming working vsnprintf()" >&2;}
+else
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#include <sys/types.h>
+#include <stdio.h>
+#include <stdarg.h>
+int x_snprintf(char *str,size_t count,const char *fmt,...)
+{
+        size_t ret; va_list ap;
+        va_start(ap, fmt); ret = vsnprintf(str, count, fmt, ap); va_end(ap);
+        return ret;
+}
+int main(void)
+{
+        char x[1];
+        exit(x_snprintf(x, 1, "%s %d", "hello", 12345) == 11 ? 0 : 1);
+}
+_ACEOF
+rm -f conftest$ac_exeext
+if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5
+  (eval $ac_link) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; }; then
+  echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6
+else
+  echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+( exit $ac_status )
+                        echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6
+cat >>confdefs.h <<\_ACEOF
+#define BROKEN_SNPRINTF 1
+_ACEOF
+                        { echo "$as_me:$LINENO: WARNING: ****** Your vsnprintf() function is broken, complain to your vendor" >&5
+echo "$as_me: WARNING: ****** Your vsnprintf() function is broken, complain to your vendor" >&2;}
+fi
+rm -f core *.core gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
+fi
+fi
+# On systems where [v]snprintf is broken, but is declared in stdio,
+# check that the fmt argument is const char * or just char *.
+# This is only useful for when BROKEN_SNPRINTF
+echo "$as_me:$LINENO: checking whether snprintf can declare const char *fmt" >&5
+echo $ECHO_N "checking whether snprintf can declare const char *fmt... $ECHO_C" >&6
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#include <stdio.h>
+           int snprintf(char *a, size_t b, const char *c, ...) { return 0; }
+           int main(void) { snprintf(0, 0, 0); }
+_ACEOF
+rm -f conftest.$ac_objext
+if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
+  (eval $ac_compile) 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } &&
+         { ac_try='test -z "$ac_c_werror_flag"                   || test ! -s conftest.err'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; } &&
+         { ac_try='test -s conftest.$ac_objext'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; }; then
+  echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6
+cat >>confdefs.h <<\_ACEOF
+#define SNPRINTF_CONST const
+_ACEOF
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6
+    cat >>confdefs.h <<\_ACEOF
+#define SNPRINTF_CONST /* not const */
+_ACEOF
+fi
+rm -f conftest.err conftest.$ac_objext conftest.$ac_ext
 # Check for missing getpeereid (or equiv) support
 NO_PEERCHECK=""
 if test "x$ac_cv_func_getpeereid" != "xyes" ; then
@@ -13087,7 +13765,7 @@ if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
 echo "${ECHO_T}yes" >&6
 cat >>confdefs.h <<\_ACEOF
-#define HAVE_SO_PEERCRED
+#define HAVE_SO_PEERCRED 1
 _ACEOF
@@ -13156,7 +13834,8 @@ sed 's/^/| /' conftest.$ac_ext >&5
                echo "$as_me:$LINENO: result: yes" >&5
 echo "${ECHO_T}yes" >&6
-                cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_STRICT_MKSTEMP 1
 _ACEOF
@@ -13170,11 +13849,11 @@ if test ! -z "$check_for_openpty_ctty_bug"; then
        echo "$as_me:$LINENO: checking if openpty correctly handles controlling tty" >&5
 echo $ECHO_N "checking if openpty correctly handles controlling tty... $ECHO_C" >&6
        if test "$cross_compiling" = yes; then
-  { { echo "$as_me:$LINENO: error: cannot run test program while cross compiling
-See \`config.log' for more details." >&5
+                        echo "$as_me:$LINENO: result: cross-compiling" >&5
-echo "$as_me: error: cannot run test program while cross compiling
+echo "${ECHO_T}cross-compiling" >&6
-See \`config.log' for more details." >&2;}
-   { (exit 1); exit 1; }; }
 else
  cat >conftest.$ac_ext <<_ACEOF
 /* confdefs.h.  */
@@ -13245,7 +13924,6 @@ echo "${ECHO_T}no" >&6
 _ACEOF
 fi
 rm -f core *.core gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
 fi
@@ -13256,11 +13934,11 @@ if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
        echo "$as_me:$LINENO: checking if getaddrinfo seems to work" >&5
 echo $ECHO_N "checking if getaddrinfo seems to work... $ECHO_C" >&6
        if test "$cross_compiling" = yes; then
-  { { echo "$as_me:$LINENO: error: cannot run test program while cross compiling
-See \`config.log' for more details." >&5
+                        echo "$as_me:$LINENO: result: cross-compiling" >&5
-echo "$as_me: error: cannot run test program while cross compiling
+echo "${ECHO_T}cross-compiling" >&6
-See \`config.log' for more details." >&2;}
-   { (exit 1); exit 1; }; }
 else
  cat >conftest.$ac_ext <<_ACEOF
 /* confdefs.h.  */
@@ -13353,7 +14031,6 @@ echo "${ECHO_T}no" >&6
 _ACEOF
 fi
 rm -f core *.core gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
 fi
@@ -13364,11 +14041,10 @@ if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
        echo "$as_me:$LINENO: checking if getaddrinfo seems to work" >&5
 echo $ECHO_N "checking if getaddrinfo seems to work... $ECHO_C" >&6
        if test "$cross_compiling" = yes; then
-  { { echo "$as_me:$LINENO: error: cannot run test program while cross compiling
+  echo "$as_me:$LINENO: result: cross-compiling" >&5
-See \`config.log' for more details." >&5
+echo "${ECHO_T}cross-compiling" >&6
-echo "$as_me: error: cannot run test program while cross compiling
-See \`config.log' for more details." >&2;}
+        ]
-   { (exit 1); exit 1; }; }
 else
  cat >conftest.$ac_ext <<_ACEOF
 /* confdefs.h.  */
@@ -13436,7 +14112,7 @@ if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5
 echo "${ECHO_T}yes" >&6
 cat >>confdefs.h <<\_ACEOF
-#define AIX_GETNAMEINFO_HACK
+#define AIX_GETNAMEINFO_HACK 1
 _ACEOF
@@ -13454,7 +14130,6 @@ echo "${ECHO_T}no" >&6
 _ACEOF
 fi
 rm -f core *.core gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
 fi
@@ -13945,7 +14620,8 @@ done
                        PAM_MSG="yes"
-                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define USE_PAM 1
 _ACEOF
@@ -14015,7 +14691,8 @@ else
 sed 's/^/| /' conftest.$ac_ext >&5
-                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_OLD_PAM 1
 _ACEOF
@@ -14107,7 +14784,8 @@ if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5
  ac_status=$?
  echo "$as_me:$LINENO: \$? = $ac_status" >&5
  (exit $ac_status); }; }; then
-  cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_OPENSSL 1
 _ACEOF
@@ -14385,6 +15063,63 @@ fi
 rm -f core *.core gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
 fi
+# Check for OpenSSL without EVP_aes_{192,256}_cbc
+echo "$as_me:$LINENO: checking whether OpenSSL has crippled AES support" >&5
+echo $ECHO_N "checking whether OpenSSL has crippled AES support... $ECHO_C" >&6
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#include <string.h>
+#include <openssl/evp.h>
+int main(void) { exit(EVP_aes_192_cbc() == NULL || EVP_aes_256_cbc() == NULL);}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
+  (eval $ac_compile) 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } &&
+         { ac_try='test -z "$ac_c_werror_flag"                   || test ! -s conftest.err'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; } &&
+         { ac_try='test -s conftest.$ac_objext'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; }; then
+                echo "$as_me:$LINENO: result: no" >&5
+echo "${ECHO_T}no" >&6
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+                echo "$as_me:$LINENO: result: yes" >&5
+echo "${ECHO_T}yes" >&6
+cat >>confdefs.h <<\_ACEOF
+#define OPENSSL_LOBOTOMISED_AES 1
+_ACEOF
+fi
+rm -f conftest.err conftest.$ac_objext conftest.$ac_ext
 # Some systems want crypt() from libcrypt, *not* the version in OpenSSL,
 # because the system crypt() is more featureful.
 if test "x$check_for_libcrypt_before" = "x1"; then
@@ -14694,7 +15429,8 @@ fi;
 # Which randomness source do we use?
 if test ! -z "$OPENSSL_SEEDS_ITSELF" && test -z "$USE_RAND_HELPER" ; then
        # OpenSSL only
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define OPENSSL_PRNG_ONLY 1
 _ACEOF
@@ -14729,7 +15465,8 @@ echo "$as_me: error: You must specify a numeric port number for --with-prngd-por
                esac
                if test ! -z "$withval" ; then
                        PRNGD_PORT="$withval"
-                        cat >>confdefs.h <<_ACEOF
+cat >>confdefs.h <<_ACEOF
 #define PRNGD_PORT $PRNGD_PORT
 _ACEOF
@@ -14771,7 +15508,8 @@ echo "$as_me: error: You may not specify both a PRNGD/EGD port and socket" >&2;}
 echo "$as_me: WARNING: Entropy socket is not readable" >&2;}
                        fi
                        PRNGD_SOCKET="$withval"
-                        cat >>confdefs.h <<_ACEOF
+cat >>confdefs.h <<_ACEOF
 #define PRNGD_SOCKET "$PRNGD_SOCKET"
 _ACEOF
@@ -14820,6 +15558,7 @@ if test "${with_entropy_timeout+set}" = set; then
 fi;
 cat >>confdefs.h <<_ACEOF
 #define ENTROPY_TIMEOUT_MSEC $entropy_timeout
 _ACEOF
@@ -14838,6 +15577,7 @@ if test "${with_privsep_user+set}" = set; then
 fi;
 cat >>confdefs.h <<_ACEOF
 #define SSH_PRIVSEP_USER "$SSH_PRIVSEP_USER"
 _ACEOF
@@ -15603,7 +16343,199 @@ if test ! -z "$SONY" ; then
  LIBS="$LIBS -liberty";
 fi
-# Checks for data types
+# Check for  long long datatypes
+echo "$as_me:$LINENO: checking for long long" >&5
+echo $ECHO_N "checking for long long... $ECHO_C" >&6
+if test "${ac_cv_type_long_long+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+$ac_includes_default
+int
+main ()
+{
+if ((long long *) 0)
+  return 0;
+if (sizeof (long long))
+  return 0;
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
+  (eval $ac_compile) 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } &&
+         { ac_try='test -z "$ac_c_werror_flag"                   || test ! -s conftest.err'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; } &&
+         { ac_try='test -s conftest.$ac_objext'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; }; then
+  ac_cv_type_long_long=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ac_cv_type_long_long=no
+fi
+rm -f conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+echo "$as_me:$LINENO: result: $ac_cv_type_long_long" >&5
+echo "${ECHO_T}$ac_cv_type_long_long" >&6
+if test $ac_cv_type_long_long = yes; then
+cat >>confdefs.h <<_ACEOF
+#define HAVE_LONG_LONG 1
+_ACEOF
+fi
+echo "$as_me:$LINENO: checking for unsigned long long" >&5
+echo $ECHO_N "checking for unsigned long long... $ECHO_C" >&6
+if test "${ac_cv_type_unsigned_long_long+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+$ac_includes_default
+int
+main ()
+{
+if ((unsigned long long *) 0)
+  return 0;
+if (sizeof (unsigned long long))
+  return 0;
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
+  (eval $ac_compile) 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } &&
+         { ac_try='test -z "$ac_c_werror_flag"                   || test ! -s conftest.err'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; } &&
+         { ac_try='test -s conftest.$ac_objext'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; }; then
+  ac_cv_type_unsigned_long_long=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ac_cv_type_unsigned_long_long=no
+fi
+rm -f conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+echo "$as_me:$LINENO: result: $ac_cv_type_unsigned_long_long" >&5
+echo "${ECHO_T}$ac_cv_type_unsigned_long_long" >&6
+if test $ac_cv_type_unsigned_long_long = yes; then
+cat >>confdefs.h <<_ACEOF
+#define HAVE_UNSIGNED_LONG_LONG 1
+_ACEOF
+fi
+echo "$as_me:$LINENO: checking for long double" >&5
+echo $ECHO_N "checking for long double... $ECHO_C" >&6
+if test "${ac_cv_type_long_double+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+$ac_includes_default
+int
+main ()
+{
+if ((long double *) 0)
+  return 0;
+if (sizeof (long double))
+  return 0;
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
+  (eval $ac_compile) 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } &&
+         { ac_try='test -z "$ac_c_werror_flag"                   || test ! -s conftest.err'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; } &&
+         { ac_try='test -s conftest.$ac_objext'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; }; then
+  ac_cv_type_long_double=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ac_cv_type_long_double=no
+fi
+rm -f conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+echo "$as_me:$LINENO: result: $ac_cv_type_long_double" >&5
+echo "${ECHO_T}$ac_cv_type_long_double" >&6
+if test $ac_cv_type_long_double = yes; then
+cat >>confdefs.h <<_ACEOF
+#define HAVE_LONG_DOUBLE 1
+_ACEOF
+fi
+# Check datatype sizes
 echo "$as_me:$LINENO: checking for char" >&5
 echo $ECHO_N "checking for char... $ECHO_C" >&6
 if test "${ac_cv_type_char+set}" = set; then
@@ -17640,6 +18572,124 @@ if test "x$ac_cv_sizeof_long_long_int" = "x4" ; then
        ac_cv_sizeof_long_long_int=0
 fi
+# compute LLONG_MIN and LLONG_MAX if we don't know them.
+if test -z "$have_llong_max"; then
+        echo "$as_me:$LINENO: checking for max value of long long" >&5
+echo $ECHO_N "checking for max value of long long... $ECHO_C" >&6
+        if test "$cross_compiling" = yes; then
+                        { echo "$as_me:$LINENO: WARNING: cross compiling: not checking" >&5
+echo "$as_me: WARNING: cross compiling: not checking" >&2;}
+else
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#include <stdio.h>
+/* Why is this so damn hard? */
+#ifdef __GNUC__
+# undef __GNUC__
+#endif
+#define __USE_ISOC99
+#include <limits.h>
+#define DATA "conftest.llminmax"
+int main(void) {
+        FILE *f;
+        long long i, llmin, llmax = 0;
+        if((f = fopen(DATA,"w")) == NULL)
+                exit(1);
+#if defined(LLONG_MIN) && defined(LLONG_MAX)
+        fprintf(stderr, "Using system header for LLONG_MIN and LLONG_MAX\n");
+        llmin = LLONG_MIN;
+        llmax = LLONG_MAX;
+#else
+        fprintf(stderr, "Calculating  LLONG_MIN and LLONG_MAX\n");
+        /* This will work on one's complement and two's complement */
+        for (i = 1; i > llmax; i <<= 1, i++)
+                llmax = i;
+        llmin = llmax + 1LL;    /* wrap */
+#endif
+        /* Sanity check */
+        if (llmin + 1 < llmin || llmin - 1 < llmin || llmax + 1 > llmax
+            || llmax - 1 > llmax) {
+                fprintf(f, "unknown unknown\n");
+                exit(2);
+        }
+        if (fprintf(f ,"%lld %lld", llmin, llmax) < 0)
+                exit(3);
+        exit(0);
+}
+_ACEOF
+rm -f conftest$ac_exeext
+if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5
+  (eval $ac_link) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; }; then
+                        llong_min=`$AWK '{print $1}' conftest.llminmax`
+                        llong_max=`$AWK '{print $2}' conftest.llminmax`
+                        # snprintf on some Tru64s doesn't understand "%lld"
+                        case "$host" in
+                        alpha-dec-osf*)
+                                if test "x$ac_cv_sizeof_long_long_int" = "x8" &&
+                                  test "x$llong_max" = "xld"; then
+                                        llong_min="-9223372036854775808"
+                                        llong_max="9223372036854775807"
+                                fi
+                                ;;
+                        esac
+                        echo "$as_me:$LINENO: result: $llong_max" >&5
+echo "${ECHO_T}$llong_max" >&6
+cat >>confdefs.h <<_ACEOF
+#define LLONG_MAX ${llong_max}LL
+_ACEOF
+                        echo "$as_me:$LINENO: checking for min value of long long" >&5
+echo $ECHO_N "checking for min value of long long... $ECHO_C" >&6
+                        echo "$as_me:$LINENO: result: $llong_min" >&5
+echo "${ECHO_T}$llong_min" >&6
+cat >>confdefs.h <<_ACEOF
+#define LLONG_MIN ${llong_min}LL
+_ACEOF
+else
+  echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+( exit $ac_status )
+                        echo "$as_me:$LINENO: result: not found" >&5
+echo "${ECHO_T}not found" >&6
+fi
+rm -f core *.core gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
+fi
+fi
 # More checks for data types
 echo "$as_me:$LINENO: checking for u_int type" >&5
 echo $ECHO_N "checking for u_int type... $ECHO_C" >&6
@@ -17697,7 +18747,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_have_u_int" >&5
 echo "${ECHO_T}$ac_cv_have_u_int" >&6
 if test "x$ac_cv_have_u_int" = "xyes" ; then
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_U_INT 1
 _ACEOF
@@ -17760,7 +18811,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_have_intxx_t" >&5
 echo "${ECHO_T}$ac_cv_have_intxx_t" >&6
 if test "x$ac_cv_have_intxx_t" = "xyes" ; then
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_INTXX_T 1
 _ACEOF
@@ -17892,7 +18944,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_have_int64_t" >&5
 echo "${ECHO_T}$ac_cv_have_int64_t" >&6
 if test "x$ac_cv_have_int64_t" = "xyes" ; then
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_INT64_T 1
 _ACEOF
@@ -17954,7 +19007,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_have_u_intxx_t" >&5
 echo "${ECHO_T}$ac_cv_have_u_intxx_t" >&6
 if test "x$ac_cv_have_u_intxx_t" = "xyes" ; then
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_U_INTXX_T 1
 _ACEOF
@@ -18075,7 +19129,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_have_u_int64_t" >&5
 echo "${ECHO_T}$ac_cv_have_u_int64_t" >&6
 if test "x$ac_cv_have_u_int64_t" = "xyes" ; then
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_U_INT64_T 1
 _ACEOF
@@ -18199,7 +19254,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_have_uintxx_t" >&5
 echo "${ECHO_T}$ac_cv_have_uintxx_t" >&6
        if test "x$ac_cv_have_uintxx_t" = "xyes" ; then
-                cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_UINTXX_T 1
 _ACEOF
@@ -18393,7 +19449,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_have_u_char" >&5
 echo "${ECHO_T}$ac_cv_have_u_char" >&6
 if test "x$ac_cv_have_u_char" = "xyes" ; then
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_U_CHAR 1
 _ACEOF
@@ -18739,7 +19796,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_have_size_t" >&5
 echo "${ECHO_T}$ac_cv_have_size_t" >&6
 if test "x$ac_cv_have_size_t" = "xyes" ; then
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_SIZE_T 1
 _ACEOF
@@ -18803,7 +19861,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_have_ssize_t" >&5
 echo "${ECHO_T}$ac_cv_have_ssize_t" >&6
 if test "x$ac_cv_have_ssize_t" = "xyes" ; then
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_SSIZE_T 1
 _ACEOF
@@ -18867,7 +19926,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_have_clock_t" >&5
 echo "${ECHO_T}$ac_cv_have_clock_t" >&6
 if test "x$ac_cv_have_clock_t" = "xyes" ; then
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_CLOCK_T 1
 _ACEOF
@@ -18980,7 +20040,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_have_sa_family_t" >&5
 echo "${ECHO_T}$ac_cv_have_sa_family_t" >&6
 if test "x$ac_cv_have_sa_family_t" = "xyes" ; then
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_SA_FAMILY_T 1
 _ACEOF
@@ -19044,7 +20105,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_have_pid_t" >&5
 echo "${ECHO_T}$ac_cv_have_pid_t" >&6
 if test "x$ac_cv_have_pid_t" = "xyes" ; then
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_PID_T 1
 _ACEOF
@@ -19108,7 +20170,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_have_mode_t" >&5
 echo "${ECHO_T}$ac_cv_have_mode_t" >&6
 if test "x$ac_cv_have_mode_t" = "xyes" ; then
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_MODE_T 1
 _ACEOF
@@ -19174,7 +20237,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_have_struct_sockaddr_storage" >&5
 echo "${ECHO_T}$ac_cv_have_struct_sockaddr_storage" >&6
 if test "x$ac_cv_have_struct_sockaddr_storage" = "xyes" ; then
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_STRUCT_SOCKADDR_STORAGE 1
 _ACEOF
@@ -19239,7 +20303,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_have_struct_sockaddr_in6" >&5
 echo "${ECHO_T}$ac_cv_have_struct_sockaddr_in6" >&6
 if test "x$ac_cv_have_struct_sockaddr_in6" = "xyes" ; then
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_STRUCT_SOCKADDR_IN6 1
 _ACEOF
@@ -19304,7 +20369,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_have_struct_in6_addr" >&5
 echo "${ECHO_T}$ac_cv_have_struct_in6_addr" >&6
 if test "x$ac_cv_have_struct_in6_addr" = "xyes" ; then
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_STRUCT_IN6_ADDR 1
 _ACEOF
@@ -19370,7 +20436,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_have_struct_addrinfo" >&5
 echo "${ECHO_T}$ac_cv_have_struct_addrinfo" >&6
 if test "x$ac_cv_have_struct_addrinfo" = "xyes" ; then
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_STRUCT_ADDRINFO 1
 _ACEOF
@@ -19432,7 +20499,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_have_struct_timeval" >&5
 echo "${ECHO_T}$ac_cv_have_struct_timeval" >&6
 if test "x$ac_cv_have_struct_timeval" = "xyes" ; then
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_STRUCT_TIMEVAL 1
 _ACEOF
@@ -19610,7 +20678,8 @@ fi
                echo "$as_me:$LINENO: result: $ossh_result" >&5
 echo "${ECHO_T}$ossh_result" >&6
                if test "x$ossh_result" = "xyes"; then
-                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_HOST_IN_UTMP 1
 _ACEOF
@@ -19654,7 +20723,8 @@ fi
                echo "$as_me:$LINENO: result: $ossh_result" >&5
 echo "${ECHO_T}$ossh_result" >&6
                if test "x$ossh_result" = "xyes"; then
-                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_HOST_IN_UTMPX 1
 _ACEOF
@@ -19698,7 +20768,8 @@ fi
                echo "$as_me:$LINENO: result: $ossh_result" >&5
 echo "${ECHO_T}$ossh_result" >&6
                if test "x$ossh_result" = "xyes"; then
-                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_SYSLEN_IN_UTMPX 1
 _ACEOF
@@ -19742,7 +20813,8 @@ fi
                echo "$as_me:$LINENO: result: $ossh_result" >&5
 echo "${ECHO_T}$ossh_result" >&6
                if test "x$ossh_result" = "xyes"; then
-                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_PID_IN_UTMP 1
 _ACEOF
@@ -19786,7 +20858,8 @@ fi
                echo "$as_me:$LINENO: result: $ossh_result" >&5
 echo "${ECHO_T}$ossh_result" >&6
                if test "x$ossh_result" = "xyes"; then
-                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_TYPE_IN_UTMP 1
 _ACEOF
@@ -19830,7 +20903,8 @@ fi
                echo "$as_me:$LINENO: result: $ossh_result" >&5
 echo "${ECHO_T}$ossh_result" >&6
                if test "x$ossh_result" = "xyes"; then
-                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_TYPE_IN_UTMPX 1
 _ACEOF
@@ -19874,7 +20948,8 @@ fi
                echo "$as_me:$LINENO: result: $ossh_result" >&5
 echo "${ECHO_T}$ossh_result" >&6
                if test "x$ossh_result" = "xyes"; then
-                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_TV_IN_UTMP 1
 _ACEOF
@@ -19918,7 +20993,8 @@ fi
                echo "$as_me:$LINENO: result: $ossh_result" >&5
 echo "${ECHO_T}$ossh_result" >&6
                if test "x$ossh_result" = "xyes"; then
-                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_ID_IN_UTMP 1
 _ACEOF
@@ -19962,7 +21038,8 @@ fi
                echo "$as_me:$LINENO: result: $ossh_result" >&5
 echo "${ECHO_T}$ossh_result" >&6
                if test "x$ossh_result" = "xyes"; then
-                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_ID_IN_UTMPX 1
 _ACEOF
@@ -20006,7 +21083,8 @@ fi
                echo "$as_me:$LINENO: result: $ossh_result" >&5
 echo "${ECHO_T}$ossh_result" >&6
                if test "x$ossh_result" = "xyes"; then
-                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_ADDR_IN_UTMP 1
 _ACEOF
@@ -20050,7 +21128,8 @@ fi
                echo "$as_me:$LINENO: result: $ossh_result" >&5
 echo "${ECHO_T}$ossh_result" >&6
                if test "x$ossh_result" = "xyes"; then
-                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_ADDR_IN_UTMPX 1
 _ACEOF
@@ -20094,7 +21173,8 @@ fi
                echo "$as_me:$LINENO: result: $ossh_result" >&5
 echo "${ECHO_T}$ossh_result" >&6
                if test "x$ossh_result" = "xyes"; then
-                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_ADDR_V6_IN_UTMP 1
 _ACEOF
@@ -20138,7 +21218,8 @@ fi
                echo "$as_me:$LINENO: result: $ossh_result" >&5
 echo "${ECHO_T}$ossh_result" >&6
                if test "x$ossh_result" = "xyes"; then
-                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_ADDR_V6_IN_UTMPX 1
 _ACEOF
@@ -20182,7 +21263,8 @@ fi
                echo "$as_me:$LINENO: result: $ossh_result" >&5
 echo "${ECHO_T}$ossh_result" >&6
                if test "x$ossh_result" = "xyes"; then
-                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_EXIT_IN_UTMP 1
 _ACEOF
@@ -20226,7 +21308,8 @@ fi
                echo "$as_me:$LINENO: result: $ossh_result" >&5
 echo "${ECHO_T}$ossh_result" >&6
                if test "x$ossh_result" = "xyes"; then
-                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_TIME_IN_UTMP 1
 _ACEOF
@@ -20270,7 +21353,8 @@ fi
                echo "$as_me:$LINENO: result: $ossh_result" >&5
 echo "${ECHO_T}$ossh_result" >&6
                if test "x$ossh_result" = "xyes"; then
-                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_TIME_IN_UTMPX 1
 _ACEOF
@@ -20314,7 +21398,8 @@ fi
                echo "$as_me:$LINENO: result: $ossh_result" >&5
 echo "${ECHO_T}$ossh_result" >&6
                if test "x$ossh_result" = "xyes"; then
-                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_TV_IN_UTMPX 1
 _ACEOF
@@ -20433,6 +21518,133 @@ _ACEOF
 fi
+echo "$as_me:$LINENO: checking for struct __res_state.retrans" >&5
+echo $ECHO_N "checking for struct __res_state.retrans... $ECHO_C" >&6
+if test "${ac_cv_member_struct___res_state_retrans+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#include <stdio.h>
+#if HAVE_SYS_TYPES_H
+# include <sys/types.h>
+#endif
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <resolv.h>
+int
+main ()
+{
+static struct __res_state ac_aggr;
+if (ac_aggr.retrans)
+return 0;
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
+  (eval $ac_compile) 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } &&
+         { ac_try='test -z "$ac_c_werror_flag"                   || test ! -s conftest.err'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; } &&
+         { ac_try='test -s conftest.$ac_objext'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; }; then
+  ac_cv_member_struct___res_state_retrans=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#include <stdio.h>
+#if HAVE_SYS_TYPES_H
+# include <sys/types.h>
+#endif
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <resolv.h>
+int
+main ()
+{
+static struct __res_state ac_aggr;
+if (sizeof ac_aggr.retrans)
+return 0;
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
+  (eval $ac_compile) 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } &&
+         { ac_try='test -z "$ac_c_werror_flag"                   || test ! -s conftest.err'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; } &&
+         { ac_try='test -s conftest.$ac_objext'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; }; then
+  ac_cv_member_struct___res_state_retrans=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ac_cv_member_struct___res_state_retrans=no
+fi
+rm -f conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+rm -f conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+echo "$as_me:$LINENO: result: $ac_cv_member_struct___res_state_retrans" >&5
+echo "${ECHO_T}$ac_cv_member_struct___res_state_retrans" >&6
+if test $ac_cv_member_struct___res_state_retrans = yes; then
+  :
+else
+cat >>confdefs.h <<\_ACEOF
+#define __res_state state
+_ACEOF
+fi
 echo "$as_me:$LINENO: checking for ss_family field in struct sockaddr_storage" >&5
 echo $ECHO_N "checking for ss_family field in struct sockaddr_storage... $ECHO_C" >&6
@@ -20492,7 +21704,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_have_ss_family_in_struct_ss" >&5
 echo "${ECHO_T}$ac_cv_have_ss_family_in_struct_ss" >&6
 if test "x$ac_cv_have_ss_family_in_struct_ss" = "xyes" ; then
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_SS_FAMILY_IN_SS 1
 _ACEOF
@@ -20557,7 +21770,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_have___ss_family_in_struct_ss" >&5
 echo "${ECHO_T}$ac_cv_have___ss_family_in_struct_ss" >&6
 if test "x$ac_cv_have___ss_family_in_struct_ss" = "xyes" ; then
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE___SS_FAMILY_IN_SS 1
 _ACEOF
@@ -20621,7 +21835,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_have_pw_class_in_struct_passwd" >&5
 echo "${ECHO_T}$ac_cv_have_pw_class_in_struct_passwd" >&6
 if test "x$ac_cv_have_pw_class_in_struct_passwd" = "xyes" ; then
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_PW_CLASS_IN_PASSWD 1
 _ACEOF
@@ -20685,7 +21900,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_have_pw_expire_in_struct_passwd" >&5
 echo "${ECHO_T}$ac_cv_have_pw_expire_in_struct_passwd" >&6
 if test "x$ac_cv_have_pw_expire_in_struct_passwd" = "xyes" ; then
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_PW_EXPIRE_IN_PASSWD 1
 _ACEOF
@@ -20749,7 +21965,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_have_pw_change_in_struct_passwd" >&5
 echo "${ECHO_T}$ac_cv_have_pw_change_in_struct_passwd" >&6
 if test "x$ac_cv_have_pw_change_in_struct_passwd" = "xyes" ; then
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_PW_CHANGE_IN_PASSWD 1
 _ACEOF
@@ -20812,7 +22029,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_have_accrights_in_msghdr" >&5
 echo "${ECHO_T}$ac_cv_have_accrights_in_msghdr" >&6
 if test "x$ac_cv_have_accrights_in_msghdr" = "xyes" ; then
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_ACCRIGHTS_IN_MSGHDR 1
 _ACEOF
@@ -20875,7 +22093,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_have_control_in_msghdr" >&5
 echo "${ECHO_T}$ac_cv_have_control_in_msghdr" >&6
 if test "x$ac_cv_have_control_in_msghdr" = "xyes" ; then
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_CONTROL_IN_MSGHDR 1
 _ACEOF
@@ -20938,7 +22157,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_libc_defines___progname" >&5
 echo "${ECHO_T}$ac_cv_libc_defines___progname" >&6
 if test "x$ac_cv_libc_defines___progname" = "xyes" ; then
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE___PROGNAME 1
 _ACEOF
@@ -21003,7 +22223,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_cc_implements___FUNCTION__" >&5
 echo "${ECHO_T}$ac_cv_cc_implements___FUNCTION__" >&6
 if test "x$ac_cv_cc_implements___FUNCTION__" = "xyes" ; then
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE___FUNCTION__ 1
 _ACEOF
@@ -21068,12 +22289,143 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_cc_implements___func__" >&5
 echo "${ECHO_T}$ac_cv_cc_implements___func__" >&6
 if test "x$ac_cv_cc_implements___func__" = "xyes" ; then
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE___func__ 1
 _ACEOF
 fi
+echo "$as_me:$LINENO: checking whether va_copy exists" >&5
+echo $ECHO_N "checking whether va_copy exists... $ECHO_C" >&6
+if test "${ac_cv_have_va_copy+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+        cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#include <stdarg.h>
+                 va_list x,y;
+int
+main ()
+{
+va_copy(x,y);
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5
+  (eval $ac_link) 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } &&
+         { ac_try='test -z "$ac_c_werror_flag"                   || test ! -s conftest.err'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; } &&
+         { ac_try='test -s conftest$ac_exeext'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; }; then
+   ac_cv_have_va_copy="yes"
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_have_va_copy="no"
+fi
+rm -f conftest.err conftest.$ac_objext \
+      conftest$ac_exeext conftest.$ac_ext
+fi
+echo "$as_me:$LINENO: result: $ac_cv_have_va_copy" >&5
+echo "${ECHO_T}$ac_cv_have_va_copy" >&6
+if test "x$ac_cv_have_va_copy" = "xyes" ; then
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_VA_COPY 1
+_ACEOF
+fi
+echo "$as_me:$LINENO: checking whether __va_copy exists" >&5
+echo $ECHO_N "checking whether __va_copy exists... $ECHO_C" >&6
+if test "${ac_cv_have___va_copy+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+        cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#include <stdarg.h>
+                 va_list x,y;
+int
+main ()
+{
+__va_copy(x,y);
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5
+  (eval $ac_link) 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } &&
+         { ac_try='test -z "$ac_c_werror_flag"                   || test ! -s conftest.err'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; } &&
+         { ac_try='test -s conftest$ac_exeext'
+  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; }; then
+   ac_cv_have___va_copy="yes"
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+ ac_cv_have___va_copy="no"
+fi
+rm -f conftest.err conftest.$ac_objext \
+      conftest$ac_exeext conftest.$ac_ext
+fi
+echo "$as_me:$LINENO: result: $ac_cv_have___va_copy" >&5
+echo "${ECHO_T}$ac_cv_have___va_copy" >&6
+if test "x$ac_cv_have___va_copy" = "xyes" ; then
+cat >>confdefs.h <<\_ACEOF
+#define HAVE___VA_COPY 1
+_ACEOF
+fi
 echo "$as_me:$LINENO: checking whether getopt has optreset support" >&5
 echo $ECHO_N "checking whether getopt has optreset support... $ECHO_C" >&6
 if test "${ac_cv_have_getopt_optreset+set}" = set; then
@@ -21133,7 +22485,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_have_getopt_optreset" >&5
 echo "${ECHO_T}$ac_cv_have_getopt_optreset" >&6
 if test "x$ac_cv_have_getopt_optreset" = "xyes" ; then
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_GETOPT_OPTRESET 1
 _ACEOF
@@ -21196,7 +22549,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_libc_defines_sys_errlist" >&5
 echo "${ECHO_T}$ac_cv_libc_defines_sys_errlist" >&6
 if test "x$ac_cv_libc_defines_sys_errlist" = "xyes" ; then
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_SYS_ERRLIST 1
 _ACEOF
@@ -21260,7 +22614,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_libc_defines_sys_nerr" >&5
 echo "${ECHO_T}$ac_cv_libc_defines_sys_nerr" >&6
 if test "x$ac_cv_libc_defines_sys_nerr" = "xyes" ; then
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_SYS_NERR 1
 _ACEOF
@@ -21516,11 +22871,13 @@ fi
 echo "$as_me: error: Can't find libsectok" >&2;}
   { (exit 1); exit 1; }; }
                        fi
-                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define SMARTCARD 1
 _ACEOF
-                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define USE_SECTOK 1
 _ACEOF
@@ -21591,7 +22948,8 @@ fi
 #define SMARTCARD 1
 _ACEOF
-                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define USE_OPENSC 1
 _ACEOF
@@ -21724,7 +23082,8 @@ echo "$as_me:$LINENO: result: $ac_cv_search_getrrsetbyname" >&5
 echo "${ECHO_T}$ac_cv_search_getrrsetbyname" >&6
 if test "$ac_cv_search_getrrsetbyname" != no; then
  test "$ac_cv_search_getrrsetbyname" = "none required" || LIBS="$ac_cv_search_getrrsetbyname $LIBS"
-  cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_GETRRSETBYNAME 1
 _ACEOF
@@ -22432,7 +23791,8 @@ fi
 echo "$as_me:$LINENO: result: $ac_cv_member_HEADER_ad" >&5
 echo "${ECHO_T}$ac_cv_member_HEADER_ad" >&6
 if test $ac_cv_member_HEADER_ad = yes; then
-  cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_HEADER_AD 1
 _ACEOF
@@ -22622,7 +23982,8 @@ if test "${with_kerberos5+set}" = set; then
                        KRB5ROOT=${withval}
                fi
-                cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define KRB5 1
 _ACEOF
@@ -22640,7 +24001,8 @@ echo $ECHO_N "checking for gssapi support... $ECHO_C" >&6
                        if $KRB5CONF | grep gssapi >/dev/null ; then
                                echo "$as_me:$LINENO: result: yes" >&5
 echo "${ECHO_T}yes" >&6
-                                cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define GSSAPI 1
 _ACEOF
@@ -22693,7 +24055,8 @@ if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
  (exit $ac_status); }; }; then
   echo "$as_me:$LINENO: result: yes" >&5
 echo "${ECHO_T}yes" >&6
-                                         cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HEIMDAL 1
 _ACEOF
@@ -23562,7 +24925,6 @@ fi
                if test ! -z "$blibpath" ; then
                        blibpath="$blibpath:${KRB5ROOT}/lib"
                fi
-        fi
@@ -24015,8 +25377,8 @@ fi
 done
-        LIBS="$LIBS $K5LIBS"
+                LIBS="$LIBS $K5LIBS"
-        echo "$as_me:$LINENO: checking for library containing k_hasafs" >&5
+                echo "$as_me:$LINENO: checking for library containing k_hasafs" >&5
 echo $ECHO_N "checking for library containing k_hasafs... $ECHO_C" >&6
 if test "${ac_cv_search_k_hasafs+set}" = set; then
  echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -24137,12 +25499,14 @@ echo "$as_me:$LINENO: result: $ac_cv_search_k_hasafs" >&5
 echo "${ECHO_T}$ac_cv_search_k_hasafs" >&6
 if test "$ac_cv_search_k_hasafs" != no; then
  test "$ac_cv_search_k_hasafs" = "none required" || LIBS="$ac_cv_search_k_hasafs $LIBS"
-  cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define USE_AFS 1
 _ACEOF
 fi
+        fi
 fi;
@@ -24244,7 +25608,8 @@ if test -z "$xauth_path" ; then
        XAUTH_PATH="undefined"
 else
-        cat >>confdefs.h <<_ACEOF
+cat >>confdefs.h <<_ACEOF
 #define XAUTH_PATH "$xauth_path"
 _ACEOF
@@ -24255,7 +25620,8 @@ fi
 # Check for mail directory (last resort if we cannot get it from headers)
 if test ! -z "$MAIL" ; then
        maildir=`dirname $MAIL`
-        cat >>confdefs.h <<_ACEOF
+cat >>confdefs.h <<_ACEOF
 #define MAIL_DIRECTORY "$maildir"
 _ACEOF
@@ -24287,7 +25653,8 @@ echo "$as_me:$LINENO: result: $ac_cv_file___dev_ptmx_" >&5
 echo "${ECHO_T}$ac_cv_file___dev_ptmx_" >&6
 if test $ac_cv_file___dev_ptmx_ = yes; then
-                                cat >>confdefs.h <<_ACEOF
+cat >>confdefs.h <<_ACEOF
 #define HAVE_DEV_PTMX 1
 _ACEOF
@@ -24319,7 +25686,8 @@ echo "$as_me:$LINENO: result: $ac_cv_file___dev_ptc_" >&5
 echo "${ECHO_T}$ac_cv_file___dev_ptc_" >&6
 if test $ac_cv_file___dev_ptc_ = yes; then
-                        cat >>confdefs.h <<_ACEOF
+cat >>confdefs.h <<_ACEOF
 #define HAVE_DEV_PTS_AND_PTC 1
 _ACEOF
@@ -24423,7 +25791,8 @@ if test "${with_md5_passwords+set}" = set; then
  withval="$with_md5_passwords"
                if test "x$withval" != "xno" ; then
-                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAVE_MD5_PASSWORDS 1
 _ACEOF
@@ -24506,7 +25875,8 @@ rm -f conftest.err conftest.$ac_objext conftest.$ac_ext
        if test "x$sp_expire_available" = "xyes" ; then
                echo "$as_me:$LINENO: result: yes" >&5
 echo "${ECHO_T}yes" >&6
-                cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define HAS_SHADOW_EXPIRE 1
 _ACEOF
@@ -24519,7 +25889,8 @@ fi
 # Use ip address instead of hostname in $DISPLAY
 if test ! -z "$IPADDR_IN_DISPLAY" ; then
        DISPLAY_HACK_MSG="yes"
-        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define IPADDR_IN_DISPLAY 1
 _ACEOF
@@ -24554,7 +25925,14 @@ echo "$as_me: /etc/default/login handling disabled" >&6;}
                etc_default_login=yes
          fi
 else
-   etc_default_login=yes
+   if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes";
+          then
+                { echo "$as_me:$LINENO: WARNING: cross compiling: not checking /etc/default/login" >&5
+echo "$as_me: WARNING: cross compiling: not checking /etc/default/login" >&2;}
+                etc_default_login=no
+          else
+                etc_default_login=yes
+          fi
 fi;
@@ -24580,12 +25958,9 @@ if test $ac_cv_file___etc_default_login_ = yes; then
   external_path_file=/etc/default/login
 fi
-        if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes";
+        if test "x$external_path_file" = "x/etc/default/login"; then
-        then
-                { echo "$as_me:$LINENO: WARNING: cross compiling: Disabling /etc/default/login test" >&5
+cat >>confdefs.h <<\_ACEOF
-echo "$as_me: WARNING: cross compiling: Disabling /etc/default/login test" >&2;}
-        elif test "x$external_path_file" = "x/etc/default/login"; then
-                cat >>confdefs.h <<\_ACEOF
 #define HAVE_ETC_DEFAULT_LOGIN 1
 _ACEOF
@@ -24724,7 +26099,8 @@ echo "${ECHO_T}Adding $t_bindir to USER_PATH so scp will work" >&6
 fi;
 if test "x$external_path_file" != "x/etc/login.conf" ; then
-        cat >>confdefs.h <<_ACEOF
+cat >>confdefs.h <<_ACEOF
 #define USER_PATH "$user_path"
 _ACEOF
@@ -24739,7 +26115,8 @@ if test "${with_superuser_path+set}" = set; then
                if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
                    test "x${withval}" != "xyes"; then
-                        cat >>confdefs.h <<_ACEOF
+cat >>confdefs.h <<_ACEOF
 #define SUPERUSER_PATH "$withval"
 _ACEOF
@@ -24761,7 +26138,8 @@ if test "${with_4in6+set}" = set; then
                if test "x$withval" != "xno" ; then
                        echo "$as_me:$LINENO: result: yes" >&5
 echo "${ECHO_T}yes" >&6
-                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define IPV4_IN_IPV6 1
 _ACEOF
@@ -24797,7 +26175,8 @@ if test "${with_bsd_auth+set}" = set; then
  withval="$with_bsd_auth"
                if test "x$withval" != "xno" ; then
-                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define BSD_AUTH 1
 _ACEOF
@@ -24834,6 +26213,7 @@ echo "$as_me: WARNING: ** no $piddir directory on this system **" >&2;}
 fi;
 cat >>confdefs.h <<_ACEOF
 #define _PATH_SSH_PIDDIR "$piddir"
 _ACEOF
@@ -24871,7 +26251,8 @@ if test "${enable_utmpx+set}" = set; then
  enableval="$enable_utmpx"
                if test "x$enableval" = "xno" ; then
-                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define DISABLE_UTMPX 1
 _ACEOF
@@ -24897,7 +26278,8 @@ if test "${enable_wtmpx+set}" = set; then
  enableval="$enable_wtmpx"
                if test "x$enableval" = "xno" ; then
-                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define DISABLE_WTMPX 1
 _ACEOF
@@ -24923,7 +26305,8 @@ if test "${enable_pututline+set}" = set; then
  enableval="$enable_pututline"
                if test "x$enableval" = "xno" ; then
-                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define DISABLE_PUTUTLINE 1
 _ACEOF
@@ -24936,7 +26319,8 @@ if test "${enable_pututxline+set}" = set; then
  enableval="$enable_pututxline"
                if test "x$enableval" = "xno" ; then
-                        cat >>confdefs.h <<\_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define DISABLE_PUTUTXLINE 1
 _ACEOF
@@ -25101,7 +26485,8 @@ echo "$as_me: WARNING: ** Cannot find lastlog **" >&2;}
 fi
 if test -n "$conf_lastlog_location"; then
-        cat >>confdefs.h <<_ACEOF
+cat >>confdefs.h <<_ACEOF
 #define CONF_LASTLOG_FILE "$conf_lastlog_location"
 _ACEOF
@@ -25179,7 +26564,8 @@ _ACEOF
        fi
 fi
 if test -n "$conf_utmp_location"; then
-        cat >>confdefs.h <<_ACEOF
+cat >>confdefs.h <<_ACEOF
 #define CONF_UTMP_FILE "$conf_utmp_location"
 _ACEOF
@@ -25257,7 +26643,8 @@ _ACEOF
        fi
 fi
 if test -n "$conf_wtmp_location"; then
-        cat >>confdefs.h <<_ACEOF
+cat >>confdefs.h <<_ACEOF
 #define CONF_WTMP_FILE "$conf_wtmp_location"
 _ACEOF
@@ -25331,7 +26718,8 @@ _ACEOF
        fi
 else
-        cat >>confdefs.h <<_ACEOF
+cat >>confdefs.h <<_ACEOF
 #define CONF_UTMPX_FILE "$conf_utmpx_location"
 _ACEOF
@@ -25404,7 +26792,8 @@ _ACEOF
        fi
 else
-        cat >>confdefs.h <<_ACEOF
+cat >>confdefs.h <<_ACEOF
 #define CONF_WTMPX_FILE "$conf_wtmpx_location"
 _ACEOF
@@ -26068,6 +27457,7 @@ s,@ac_ct_RANLIB@,$ac_ct_RANLIB,;t t
 s,@INSTALL_PROGRAM@,$INSTALL_PROGRAM,;t t
 s,@INSTALL_SCRIPT@,$INSTALL_SCRIPT,;t t
 s,@INSTALL_DATA@,$INSTALL_DATA,;t t
+s,@EGREP@,$EGREP,;t t
 s,@AR@,$AR,;t t
 s,@CAT@,$CAT,;t t
 s,@KILL@,$KILL,;t t
@@ -26080,10 +27470,10 @@ s,@TEST_SHELL@,$TEST_SHELL,;t t
 s,@PATH_GROUPADD_PROG@,$PATH_GROUPADD_PROG,;t t
 s,@PATH_USERADD_PROG@,$PATH_USERADD_PROG,;t t
 s,@MAKE_PACKAGE_SUPPORTED@,$MAKE_PACKAGE_SUPPORTED,;t t
+s,@STARTUP_SCRIPT_SHELL@,$STARTUP_SCRIPT_SHELL,;t t
 s,@LOGIN_PROGRAM_FALLBACK@,$LOGIN_PROGRAM_FALLBACK,;t t
 s,@PATH_PASSWD_PROG@,$PATH_PASSWD_PROG,;t t
 s,@LD@,$LD,;t t
-s,@EGREP@,$EGREP,;t t
 s,@LIBWRAP@,$LIBWRAP,;t t
 s,@LIBEDIT@,$LIBEDIT,;t t
 s,@LIBPAM@,$LIBPAM,;t t
diff --git a/configure.ac b/configure.ac
index 849e2f771..9ff199451 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,4 +1,4 @@
-# $Id: configure.ac,v 1.292 2005/08/31 16:59:49 tim Exp $
+# $Id: configure.ac,v 1.322.2.6 2006/02/08 11:11:06 dtucker Exp $
 #
 # Copyright (c) 1999-2004 Damien Miller
 #
@@ -15,6 +15,7 @@
 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 AC_INIT(OpenSSH, Portable, openssh-unix-dev@mindrot.org)
+AC_REVISION($Revision: 1.322.2.6 $)
 AC_CONFIG_SRCDIR([ssh.c])
 AC_CONFIG_HEADER(config.h)
@@ -27,6 +28,7 @@ AC_PROG_AWK
 AC_PROG_CPP
 AC_PROG_RANLIB
 AC_PROG_INSTALL
+AC_PROG_EGREP
 AC_PATH_PROG(AR, ar)
 AC_PATH_PROG(CAT, cat)
 AC_PATH_PROG(KILL, kill)
@@ -47,6 +49,11 @@ AC_PATH_PROG(PATH_GROUPADD_PROG, groupadd, groupadd,
 AC_PATH_PROG(PATH_USERADD_PROG, useradd, useradd,
        [/usr/sbin${PATH_SEPARATOR}/etc])
 AC_CHECK_PROG(MAKE_PACKAGE_SUPPORTED, pkgmk, yes, no)
+if test -x /sbin/sh; then
+        AC_SUBST(STARTUP_SCRIPT_SHELL,/sbin/sh)
+else
+        AC_SUBST(STARTUP_SCRIPT_SHELL,/bin/sh)
+fi
 # System features
 AC_SYS_LARGEFILE
@@ -57,7 +64,9 @@ fi
 # Use LOGIN_PROGRAM from environment if possible
 if test ! -z "$LOGIN_PROGRAM" ; then
-        AC_DEFINE_UNQUOTED(LOGIN_PROGRAM_FALLBACK, "$LOGIN_PROGRAM")
+        AC_DEFINE_UNQUOTED(LOGIN_PROGRAM_FALLBACK, "$LOGIN_PROGRAM",
+                [If your header files don't define LOGIN_PROGRAM,
+                then use this (detected) from environment and PATH])
 else
        # Search for login
        AC_PATH_PROG(LOGIN_PROGRAM_FALLBACK, login)
@@ -68,7 +77,8 @@ fi
 AC_PATH_PROG(PATH_PASSWD_PROG, passwd)
 if test ! -z "$PATH_PASSWD_PROG" ; then
-        AC_DEFINE_UNQUOTED(_PATH_PASSWD_PROG, "$PATH_PASSWD_PROG")
+        AC_DEFINE_UNQUOTED(_PATH_PASSWD_PROG, "$PATH_PASSWD_PROG",
+                [Full path of your "passwd" program])
 fi
 if test -z "$LD" ; then
@@ -82,12 +92,14 @@ AC_CHECK_DECL(LLONG_MAX, have_llong_max=1, , [#include <limits.h>])
 if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
        CFLAGS="$CFLAGS -Wall -Wpointer-arith -Wuninitialized"
-        GCC_VER=`$CC --version`
+        GCC_VER=`$CC -v 2>&1 | $AWK '/gcc version /{print $3}'`
        case $GCC_VER in
                1.*) ;;
                2.8* | 2.9*) CFLAGS="$CFLAGS -Wsign-compare" ;;
                2.*) ;;
-                *) CFLAGS="$CFLAGS -Wsign-compare" ;;
+                3.*) CFLAGS="$CFLAGS -Wsign-compare" ;;
+                4.*) CFLAGS="$CFLAGS -Wsign-compare -Wno-pointer-sign" ;;
+                *) ;;
        esac
        if test -z "$have_llong_max"; then
@@ -103,70 +115,6 @@ if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
        fi
 fi
-if test -z "$have_llong_max"; then
-        AC_MSG_CHECKING([for max value of long long])
-        AC_RUN_IFELSE(
-                [AC_LANG_SOURCE([[
-#include <stdio.h>
-/* Why is this so damn hard? */
-#ifdef __GNUC__
-# undef __GNUC__
-#endif
-#define __USE_ISOC99
-#include <limits.h>
-#define DATA "conftest.llminmax"
-int main(void) {
-        FILE *f;
-        long long i, llmin, llmax = 0;
-        if((f = fopen(DATA,"w")) == NULL)
-                exit(1);
-#if defined(LLONG_MIN) && defined(LLONG_MAX)
-        fprintf(stderr, "Using system header for LLONG_MIN and LLONG_MAX\n");
-        llmin = LLONG_MIN;
-        llmax = LLONG_MAX;
-#else
-        fprintf(stderr, "Calculating  LLONG_MIN and LLONG_MAX\n");
-        /* This will work on one's complement and two's complement */
-        for (i = 1; i > llmax; i <<= 1, i++)
-                llmax = i;
-        llmin = llmax + 1LL;    /* wrap */
-#endif
-        /* Sanity check */
-        if (llmin + 1 < llmin || llmin - 1 < llmin || llmax + 1 > llmax
-            || llmax - 1 > llmax) {
-                fprintf(f, "unknown unknown\n");
-                exit(2);
-        }
-        if (fprintf(f ,"%lld %lld", llmin, llmax) < 0)
-                exit(3);
-        exit(0);
-}
-                ]])],
-                [
-                        llong_min=`$AWK '{print $1}' conftest.llminmax`
-                        llong_max=`$AWK '{print $2}' conftest.llminmax`
-                        AC_MSG_RESULT($llong_max)
-                        AC_DEFINE_UNQUOTED(LLONG_MAX, [${llong_max}LL],
-                            [max value of long long calculated by configure])
-                        AC_MSG_CHECKING([for min value of long long])
-                        AC_MSG_RESULT($llong_min)
-                        AC_DEFINE_UNQUOTED(LLONG_MIN, [${llong_min}LL],
-                            [min value of long long calculated by configure])
-                ],
-                [
-                        AC_MSG_RESULT(not found)
-                ],
-                [
-                        AC_MSG_WARN([cross compiling: not checking])
-                ]
-        )
-fi
 AC_ARG_WITH(rpath,
        [  --without-rpath         Disable auto-added -R linker paths],
        [
@@ -201,7 +149,8 @@ case "$host" in
        fi
        LDFLAGS="$saved_LDFLAGS"
        dnl Check for authenticate.  Might be in libs.a on older AIXes
-        AC_CHECK_FUNC(authenticate, [AC_DEFINE(WITH_AIXAUTHENTICATE)],
+        AC_CHECK_FUNC(authenticate, [AC_DEFINE(WITH_AIXAUTHENTICATE, 1,
+                [Define if you want to enable AIX4's authenticate function])],
                [AC_CHECK_LIB(s,authenticate,
                        [ AC_DEFINE(WITH_AIXAUTHENTICATE)
                                LIBS="$LIBS -ls"
@@ -217,7 +166,9 @@ case "$host" in
                        [#include <usersec.h>],
                        [(void)loginfailed("user","host","tty",0);],
                        [AC_MSG_RESULT(yes)
-                         AC_DEFINE(AIX_LOGINFAILED_4ARG)],
+                         AC_DEFINE(AIX_LOGINFAILED_4ARG, 1,
+                                [Define if your AIX loginfailed() function
+                                takes 4 arguments (AIX >= 5.2)])],
                        [AC_MSG_RESULT(no)]
                )],
                [],
@@ -225,25 +176,38 @@ case "$host" in
        )
        AC_CHECK_FUNCS(setauthdb)
        check_for_aix_broken_getaddrinfo=1
-        AC_DEFINE(BROKEN_REALPATH)
+        AC_DEFINE(BROKEN_REALPATH, 1, [Define if you have a broken realpath.])
-        AC_DEFINE(SETEUID_BREAKS_SETUID)
+        AC_DEFINE(SETEUID_BREAKS_SETUID, 1,
-        AC_DEFINE(BROKEN_SETREUID)
+            [Define if your platform breaks doing a seteuid before a setuid])
-        AC_DEFINE(BROKEN_SETREGID)
+        AC_DEFINE(BROKEN_SETREUID, 1, [Define if your setreuid() is broken])
+        AC_DEFINE(BROKEN_SETREGID, 1, [Define if your setregid() is broken])
        dnl AIX handles lastlog as part of its login message
-        AC_DEFINE(DISABLE_LASTLOG)
+        AC_DEFINE(DISABLE_LASTLOG, 1, [Define if you don't want to use lastlog])
-        AC_DEFINE(LOGIN_NEEDS_UTMPX)
+        AC_DEFINE(LOGIN_NEEDS_UTMPX, 1,
-        AC_DEFINE(SPT_TYPE,SPT_REUSEARGV)
+                [Some systems need a utmpx entry for /bin/login to work])
+        AC_DEFINE(SPT_TYPE,SPT_REUSEARGV,
+                [Define to a Set Process Title type if your system is
+                supported by bsd-setproctitle.c])
+        AC_DEFINE(SSHPAM_CHAUTHTOK_NEEDS_RUID, 1,
+            [AIX 5.2 and 5.3 (and presumably newer) require this])
        ;;
 *-*-cygwin*)
        check_for_libcrypt_later=1
        LIBS="$LIBS /usr/lib/textmode.o"
-        AC_DEFINE(HAVE_CYGWIN)
+        AC_DEFINE(HAVE_CYGWIN, 1, [Define if you are on Cygwin])
-        AC_DEFINE(USE_PIPES)
+        AC_DEFINE(USE_PIPES, 1, [Use PIPES instead of a socketpair()])
-        AC_DEFINE(DISABLE_SHADOW)
+        AC_DEFINE(DISABLE_SHADOW, 1,
-        AC_DEFINE(IP_TOS_IS_BROKEN)
+                [Define if you want to disable shadow passwords])
-        AC_DEFINE(NO_X11_UNIX_SOCKETS)
+        AC_DEFINE(IP_TOS_IS_BROKEN, 1,
-        AC_DEFINE(NO_IPPORT_RESERVED_CONCEPT)
+                [Define if your system choked on IP TOS setting])
-        AC_DEFINE(DISABLE_FD_PASSING)
+        AC_DEFINE(NO_X11_UNIX_SOCKETS, 1,
+                [Define if X11 doesn't support AF_UNIX sockets on that system])
+        AC_DEFINE(NO_IPPORT_RESERVED_CONCEPT, 1,
+                [Define if the concept of ports only accessible to
+                superusers isn't known])
+        AC_DEFINE(DISABLE_FD_PASSING, 1,
+                [Define if your platform needs to skip post auth
+                file descriptor passing])
        ;;
 *-*-dgux*)
        AC_DEFINE(IP_TOS_IS_BROKEN)
@@ -260,22 +224,26 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
                exit(1);
 }], [AC_MSG_RESULT(working)],
        [AC_MSG_RESULT(buggy)
-        AC_DEFINE(BROKEN_GETADDRINFO)],
+        AC_DEFINE(BROKEN_GETADDRINFO, 1, [getaddrinfo is broken (if present)])],
        [AC_MSG_RESULT(assume it is working)])
        AC_DEFINE(SETEUID_BREAKS_SETUID)
        AC_DEFINE(BROKEN_SETREUID)
        AC_DEFINE(BROKEN_SETREGID)
-        AC_DEFINE_UNQUOTED(BIND_8_COMPAT, 1)
+        AC_DEFINE_UNQUOTED(BIND_8_COMPAT, 1,
+                [Define if your resolver libs need this for getrrsetbyname])
        ;;
 *-*-hpux*)
        # first we define all of the options common to all HP-UX releases
        CPPFLAGS="$CPPFLAGS -D_HPUX_SOURCE -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1"
        IPADDR_IN_DISPLAY=yes
        AC_DEFINE(USE_PIPES)
-        AC_DEFINE(LOGIN_NO_ENDOPT)
+        AC_DEFINE(LOGIN_NO_ENDOPT, 1,
+            [Define if your login program cannot handle end of options ("--")])
        AC_DEFINE(LOGIN_NEEDS_UTMPX)
-        AC_DEFINE(LOCKED_PASSWD_STRING, "*")
+        AC_DEFINE(LOCKED_PASSWD_STRING, "*",
+                [String used in /etc/passwd to denote locked account])
        AC_DEFINE(SPT_TYPE,SPT_PSTAT)
+        MAIL="/var/mail/username"
        LIBS="$LIBS -lsec"
        AC_CHECK_LIB(xnet, t_error, ,
            AC_MSG_ERROR([*** -lxnet needed on HP-UX - check config.log ***]))
@@ -288,8 +256,12 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
                fi
                ;;
        *-*-hpux11*)
-                AC_DEFINE(PAM_SUN_CODEBASE)
+                AC_DEFINE(PAM_SUN_CODEBASE, 1,
-                AC_DEFINE(DISABLE_UTMP)
+                        [Define if you are using Solaris-derived PAM which
+                        passes pam_messages to the conversation function
+                        with an extra level of indirection])
+                AC_DEFINE(DISABLE_UTMP, 1,
+                        [Define if you don't want to use utmp])
                AC_DEFINE(USE_BTMP, 1, [Use btmp to log bad logins])
                check_for_hpux_broken_getaddrinfo=1
                check_for_conflicting_getspnam=1
@@ -299,7 +271,9 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
        # lastly, we define options specific to minor releases
        case "$host" in
        *-*-hpux10.26)
-                AC_DEFINE(HAVE_SECUREWARE)
+                AC_DEFINE(HAVE_SECUREWARE, 1,
+                        [Define if you have SecureWare-based
+                        protected password database])
                disable_ptmx_check=yes
                LIBS="$LIBS -lsecpw"
                ;;
@@ -307,24 +281,33 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
        ;;
 *-*-irix5*)
        PATH="$PATH:/usr/etc"
-        AC_DEFINE(BROKEN_INET_NTOA)
+        AC_DEFINE(BROKEN_INET_NTOA, 1,
+                [Define if you system's inet_ntoa is busted
+                (e.g. Irix gcc issue)])
        AC_DEFINE(SETEUID_BREAKS_SETUID)
        AC_DEFINE(BROKEN_SETREUID)
        AC_DEFINE(BROKEN_SETREGID)
-        AC_DEFINE(WITH_ABBREV_NO_TTY)
+        AC_DEFINE(WITH_ABBREV_NO_TTY, 1,
+                [Define if you shouldn't strip 'tty' from your
+                ttyname in [uw]tmp])
        AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
        ;;
 *-*-irix6*)
        PATH="$PATH:/usr/etc"
-        AC_DEFINE(WITH_IRIX_ARRAY)
+        AC_DEFINE(WITH_IRIX_ARRAY, 1,
-        AC_DEFINE(WITH_IRIX_PROJECT)
+                [Define if you have/want arrays
-        AC_DEFINE(WITH_IRIX_AUDIT)
+                (cluster-wide session managment, not C arrays)])
-        AC_CHECK_FUNC(jlimit_startjob, [AC_DEFINE(WITH_IRIX_JOBS)])
+        AC_DEFINE(WITH_IRIX_PROJECT, 1,
+                [Define if you want IRIX project management])
+        AC_DEFINE(WITH_IRIX_AUDIT, 1,
+                [Define if you want IRIX audit trails])
+        AC_CHECK_FUNC(jlimit_startjob, [AC_DEFINE(WITH_IRIX_JOBS, 1,
+                [Define if you want IRIX kernel jobs])])
        AC_DEFINE(BROKEN_INET_NTOA)
        AC_DEFINE(SETEUID_BREAKS_SETUID)
        AC_DEFINE(BROKEN_SETREUID)
        AC_DEFINE(BROKEN_SETREGID)
-        AC_DEFINE(BROKEN_UPDWTMPX)
+        AC_DEFINE(BROKEN_UPDWTMPX, 1, [updwtmpx is broken (if present)])
        AC_DEFINE(WITH_ABBREV_NO_TTY)
        AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
        ;;
@@ -340,22 +323,37 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
        no_dev_ptmx=1
        check_for_libcrypt_later=1
        check_for_openpty_ctty_bug=1
-        AC_DEFINE(DONT_TRY_OTHER_AF)
+        AC_DEFINE(DONT_TRY_OTHER_AF, 1, [Workaround more Linux IPv6 quirks])
-        AC_DEFINE(PAM_TTY_KLUDGE)
+        AC_DEFINE(PAM_TTY_KLUDGE, 1,
-        AC_DEFINE(LOCKED_PASSWD_PREFIX, "!")
+                [Work around problematic Linux PAM modules handling of PAM_TTY])
+        AC_DEFINE(LOCKED_PASSWD_PREFIX, "!",
+                [String used in /etc/passwd to denote locked account])
        AC_DEFINE(SPT_TYPE,SPT_REUSEARGV)
-        AC_DEFINE(LINK_OPNOTSUPP_ERRNO, EPERM)
+        AC_DEFINE(LINK_OPNOTSUPP_ERRNO, EPERM,
+                [Define to whatever link() returns for "not supported"
+                if it doesn't return EOPNOTSUPP.])
        AC_DEFINE(_PATH_BTMP, "/var/log/btmp", [log for bad login attempts])
-        AC_DEFINE(USE_BTMP, 1, [Use btmp to log bad logins])
+        AC_DEFINE(USE_BTMP)
        inet6_default_4in6=yes
        case `uname -r` in
        1.*|2.0.*)
-                AC_DEFINE(BROKEN_CMSG_TYPE)
+                AC_DEFINE(BROKEN_CMSG_TYPE, 1,
+                        [Define if cmsg_type is not passed correctly])
                ;;
        esac
+        # tun(4) forwarding compat code
+        AC_CHECK_HEADERS(linux/if_tun.h)
+        if test "x$ac_cv_header_linux_if_tun_h" = "xyes" ; then
+                AC_DEFINE(SSH_TUN_LINUX, 1,
+                    [Open tunnel devices the Linux tun/tap way])
+                AC_DEFINE(SSH_TUN_COMPAT_AF, 1,
+                    [Use tunnel device compatibility to OpenBSD])
+                AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
+                    [Prepend the address family to IP tunnel traffic])
+        fi
        ;;
 mips-sony-bsd|mips-sony-newsos4)
-        AC_DEFINE(NEED_SETPRGP, [], [Need setpgrp to acquire controlling tty])
+        AC_DEFINE(NEED_SETPGRP, 1, [Need setpgrp to acquire controlling tty])
        SONY=1
        ;;
 *-*-netbsd*)
@@ -363,9 +361,18 @@ mips-sony-bsd|mips-sony-newsos4)
        if test "x$withval" != "xno" ; then
                need_dash_r=1
        fi
+        AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way])
+        AC_CHECK_HEADER([net/if_tap.h], ,
+            AC_DEFINE(SSH_TUN_NO_L2, 1, [No layer 2 tunnel support]))
+        AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
+            [Prepend the address family to IP tunnel traffic])
        ;;
 *-*-freebsd*)
        check_for_libcrypt_later=1
+        AC_DEFINE(LOCKED_PASSWD_PREFIX, "*LOCKED*", [Account locked with pw(1)])
+        AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way])
+        AC_CHECK_HEADER([net/if_tap.h], ,
+            AC_DEFINE(SSH_TUN_NO_L2, 1, [No layer 2 tunnel support]))
        ;;
 *-*-bsdi*)
        AC_DEFINE(SETEUID_BREAKS_SETUID)
@@ -377,13 +384,15 @@ mips-sony-bsd|mips-sony-newsos4)
        conf_utmp_location=/etc/utmp
        conf_wtmp_location=/usr/adm/wtmp
        MAIL=/usr/spool/mail
-        AC_DEFINE(HAVE_NEXT)
+        AC_DEFINE(HAVE_NEXT, 1, [Define if you are on NeXT])
        AC_DEFINE(BROKEN_REALPATH)
        AC_DEFINE(USE_PIPES)
-        AC_DEFINE(BROKEN_SAVED_UIDS)
+        AC_DEFINE(BROKEN_SAVED_UIDS, 1, [Needed for NeXT])
        ;;
 *-*-openbsd*)
        AC_DEFINE(HAVE_ATTRIBUTE__SENTINEL__, 1, [OpenBSD's gcc has sentinel])
+        AC_DEFINE(HAVE_ATTRIBUTE__BOUNDED__, 1, [OpenBSD's gcc has bounded])
+        AC_DEFINE(SSH_TUN_OPENBSD, 1, [Open tunnel devices the OpenBSD way])
        ;;
 *-*-solaris*)
        if test "x$withval" != "xno" ; then
@@ -391,12 +400,18 @@ mips-sony-bsd|mips-sony-newsos4)
        fi
        AC_DEFINE(PAM_SUN_CODEBASE)
        AC_DEFINE(LOGIN_NEEDS_UTMPX)
-        AC_DEFINE(LOGIN_NEEDS_TERM)
+        AC_DEFINE(LOGIN_NEEDS_TERM, 1,
+                [Some versions of /bin/login need the TERM supplied
+                on the commandline])
        AC_DEFINE(PAM_TTY_KLUDGE)
-        AC_DEFINE(SSHPAM_CHAUTHTOK_NEEDS_RUID)
+        AC_DEFINE(SSHPAM_CHAUTHTOK_NEEDS_RUID, 1,
+                [Define if pam_chauthtok wants real uid set
+                to the unpriv'ed user])
        AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
        # Pushing STREAMS modules will cause sshd to acquire a controlling tty.
-        AC_DEFINE(SSHD_ACQUIRES_CTTY)
+        AC_DEFINE(SSHD_ACQUIRES_CTTY, 1,
+                [Define if sshd somehow reacquires a controlling TTY
+                after setsid()])
        external_path_file=/etc/default/login
        # hardwire lastlog location (can't detect it on some versions)
        conf_lastlog_location="/var/adm/lastlog"
@@ -405,7 +420,8 @@ mips-sony-bsd|mips-sony-newsos4)
        if test "$sol2ver" -ge 8; then
                AC_MSG_RESULT(yes)
                AC_DEFINE(DISABLE_UTMP)
-                AC_DEFINE(DISABLE_WTMP)
+                AC_DEFINE(DISABLE_WTMP, 1,
+                        [Define if you don't want to use wtmp])
        else
                AC_MSG_RESULT(no)
        fi
@@ -430,8 +446,8 @@ mips-sony-bsd|mips-sony-newsos4)
 *-sni-sysv*)
        # /usr/ucblib MUST NOT be searched on ReliantUNIX
        AC_CHECK_LIB(dl, dlsym, ,)
-        # -lresolv needs to be at then end of LIBS or DNS lookups break
+        # -lresolv needs to be at the end of LIBS or DNS lookups break
-        AC_CHECK_LIB(res_query, resolv, [ LIBS="$LIBS -lresolv" ])
+        AC_CHECK_LIB(resolv, res_query, [ LIBS="$LIBS -lresolv" ])
        IPADDR_IN_DISPLAY=yes
        AC_DEFINE(USE_PIPES)
        AC_DEFINE(IP_TOS_IS_BROKEN)
@@ -446,11 +462,13 @@ mips-sony-bsd|mips-sony-newsos4)
        ;;
 # UnixWare 1.x, UnixWare 2.x, and others based on code from Univel.
 *-*-sysv4.2*)
+        CFLAGS="$CFLAGS -Dva_list=_VA_LIST"
        AC_DEFINE(USE_PIPES)
        AC_DEFINE(SETEUID_BREAKS_SETUID)
        AC_DEFINE(BROKEN_SETREUID)
        AC_DEFINE(BROKEN_SETREGID)
        AC_DEFINE(PASSWD_NEEDS_USERNAME, 1, [must supply username to passwd])
+        AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
        ;;
 # UnixWare 7.x, OpenUNIX 8
 *-*-sysv5*)
@@ -460,11 +478,14 @@ mips-sony-bsd|mips-sony-newsos4)
        AC_DEFINE(SETEUID_BREAKS_SETUID)
        AC_DEFINE(BROKEN_SETREUID)
        AC_DEFINE(BROKEN_SETREGID)
-        AC_DEFINE(PASSWD_NEEDS_USERNAME, 1, [must supply username to passwd])
+        AC_DEFINE(PASSWD_NEEDS_USERNAME)
        case "$host" in
        *-*-sysv5SCO_SV*)       # SCO OpenServer 6.x
                TEST_SHELL=/u95/bin/sh
-                AC_DEFINE(BROKEN_LIBIAF, 1, [ia_uinfo routines not supported by OS yet])
+                AC_DEFINE(BROKEN_LIBIAF, 1,
+                        [ia_uinfo routines not supported by OS yet])
+                ;;
+        *)      AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
                ;;
        esac
        ;;
@@ -490,13 +511,14 @@ mips-sony-bsd|mips-sony-newsos4)
        AC_DEFINE(BROKEN_SETREGID)
        AC_DEFINE(WITH_ABBREV_NO_TTY)
        AC_DEFINE(BROKEN_UPDWTMPX)
-        AC_DEFINE(PASSWD_NEEDS_USERNAME, 1, [must supply username to passwd])
+        AC_DEFINE(PASSWD_NEEDS_USERNAME)
        AC_CHECK_FUNCS(getluid setluid)
        MANTYPE=man
        TEST_SHELL=ksh
        ;;
 *-*-unicosmk*)
-        AC_DEFINE(NO_SSH_LASTLOG)
+        AC_DEFINE(NO_SSH_LASTLOG, 1,
+                [Define if you don't want to use lastlog in session.c])
        AC_DEFINE(SETEUID_BREAKS_SETUID)
        AC_DEFINE(BROKEN_SETREUID)
        AC_DEFINE(BROKEN_SETREGID)
@@ -543,13 +565,18 @@ mips-sony-bsd|mips-sony-newsos4)
        if test -z "$no_osfsia" ; then
                if test -f /etc/sia/matrix.conf; then
                        AC_MSG_RESULT(yes)
-                        AC_DEFINE(HAVE_OSF_SIA)
+                        AC_DEFINE(HAVE_OSF_SIA, 1,
-                        AC_DEFINE(DISABLE_LOGIN)
+                                [Define if you have Digital Unix Security
+                                Integration Architecture])
+                        AC_DEFINE(DISABLE_LOGIN, 1,
+                                [Define if you don't want to use your
+                                system's login() call])
                        AC_DEFINE(DISABLE_FD_PASSING)
                        LIBS="$LIBS -lsecurity -ldb -lm -laud"
                else
                        AC_MSG_RESULT(no)
-                        AC_DEFINE(LOCKED_PASSWD_SUBSTR, "Nologin")
+                        AC_DEFINE(LOCKED_PASSWD_SUBSTR, "Nologin",
+                          [String used in /etc/passwd to denote locked account])
                fi
        fi
        AC_DEFINE(BROKEN_GETADDRINFO)
@@ -558,24 +585,25 @@ mips-sony-bsd|mips-sony-newsos4)
        AC_DEFINE(BROKEN_SETREGID)
        ;;
-*-*-nto-qnx)
+*-*-nto-qnx*)
        AC_DEFINE(USE_PIPES)
        AC_DEFINE(NO_X11_UNIX_SOCKETS)
-        AC_DEFINE(MISSING_NFDBITS)
+        AC_DEFINE(MISSING_NFDBITS, 1, [Define on *nto-qnx systems])
-        AC_DEFINE(MISSING_HOWMANY)
+        AC_DEFINE(MISSING_HOWMANY, 1, [Define on *nto-qnx systems])
-        AC_DEFINE(MISSING_FD_MASK)
+        AC_DEFINE(MISSING_FD_MASK, 1, [Define on *nto-qnx systems])
+        AC_DEFINE(DISABLE_LASTLOG)
        ;;
 *-*-ultrix*)
-        AC_DEFINE(BROKEN_GETGROUPS, [], [getgroups(0,NULL) will return -1])
+        AC_DEFINE(BROKEN_GETGROUPS, 1, [getgroups(0,NULL) will return -1])
-        AC_DEFINE(BROKEN_MMAP, [], [Ultrix mmap can't map files])
+        AC_DEFINE(BROKEN_MMAP, 1, [Ultrix mmap can't map files])
-        AC_DEFINE(NEED_SETPRGP, [], [Need setpgrp to acquire controlling tty])
+        AC_DEFINE(NEED_SETPGRP)
        AC_DEFINE(HAVE_SYS_SYSLOG_H, 1, [Force use of sys/syslog.h on Ultrix])
        ;;
 *-*-lynxos)
        CFLAGS="$CFLAGS -D__NO_INCLUDE_WARN__"
-        AC_DEFINE(MISSING_HOWMANY)
+        AC_DEFINE(MISSING_HOWMANY)
        AC_DEFINE(BROKEN_SETVBUF, 1, [LynxOS has broken setvbuf() implementation])
        ;;
 esac
@@ -622,7 +650,7 @@ AC_ARG_WITH(Werror,
        [
                if test -n "$withval"  &&  test "x$withval" != "xno"; then
                        werror_flags="-Werror"
-                        if "x${withval}" != "xyes"; then
+                        if test "x${withval}" != "xyes"; then
                                werror_flags="$withval"
                        fi
                fi
@@ -655,7 +683,6 @@ AC_CHECK_HEADERS( \
        glob.h \
        ia.h \
        iaf.h \
-        lastlog.h \
        limits.h \
        login.h \
        login_cap.h \
@@ -663,7 +690,6 @@ AC_CHECK_HEADERS( \
        ndir.h \
        netdb.h \
        netgroup.h \
-        netinet/in_systm.h \
        pam/pam_appl.h \
        paths.h \
        pty.h \
@@ -705,6 +731,13 @@ AC_CHECK_HEADERS( \
        vis.h \
 )
+# lastlog.h requires sys/time.h to be included first on Solaris
+AC_CHECK_HEADERS(lastlog.h, [], [], [
+#ifdef HAVE_SYS_TIME_H
+# include <sys/time.h>
+#endif
+])
 # sys/ptms.h requires sys/stream.h to be included first on Solaris
 AC_CHECK_HEADERS(sys/ptms.h, [], [], [
 #ifdef HAVE_SYS_STREAM_H
@@ -723,8 +756,8 @@ AC_CHECK_FUNCS(dirname, [AC_CHECK_HEADERS(libgen.h)] ,[
                        ac_cv_have_broken_dirname, [
                        save_LIBS="$LIBS"
                        LIBS="$LIBS -lgen"
-                        AC_TRY_RUN(
+                        AC_RUN_IFELSE(
-                                [
+                                [AC_LANG_SOURCE([[
 #include <libgen.h>
 #include <string.h>
@@ -739,9 +772,10 @@ int main(int argc, char **argv) {
        exit(0);
    }
 }
-                                ],
+                                ]])],
+                                [ ac_cv_have_broken_dirname="no" ],
+                                [ ac_cv_have_broken_dirname="yes" ],
                                [ ac_cv_have_broken_dirname="no" ],
-                                [ ac_cv_have_broken_dirname="yes" ]
                        )
                        LIBS="$save_LIBS"
                ])
@@ -755,7 +789,8 @@ int main(int argc, char **argv) {
 AC_CHECK_FUNC(getspnam, ,
        AC_CHECK_LIB(gen, getspnam, LIBS="$LIBS -lgen"))
-AC_SEARCH_LIBS(basename, gen, AC_DEFINE(HAVE_BASENAME))
+AC_SEARCH_LIBS(basename, gen, AC_DEFINE(HAVE_BASENAME, 1,
+        [Define if you have the basename function.]))
 dnl zlib is required
 AC_ARG_WITH(zlib,
@@ -859,14 +894,15 @@ dnl UnixWare 2.x
 AC_CHECK_FUNC(strcasecmp,
        [], [ AC_CHECK_LIB(resolv, strcasecmp, LIBS="$LIBS -lresolv") ]
 )
-AC_CHECK_FUNC(utimes,
+AC_CHECK_FUNCS(utimes,
        [], [ AC_CHECK_LIB(c89, utimes, [AC_DEFINE(HAVE_UTIMES)
                                        LIBS="$LIBS -lc89"]) ]
 )
 dnl    Checks for libutil functions
 AC_CHECK_HEADERS(libutil.h)
-AC_SEARCH_LIBS(login, util bsd, [AC_DEFINE(HAVE_LOGIN)])
+AC_SEARCH_LIBS(login, util bsd, [AC_DEFINE(HAVE_LOGIN, 1,
+        [Define if your libraries define login()])])
 AC_CHECK_FUNCS(logout updwtmp logwtmp)
 AC_FUNC_STRFTIME
@@ -881,7 +917,9 @@ AC_EGREP_CPP(FOUNDIT,
                #endif
        ],
        [
-                AC_DEFINE(GLOB_HAS_ALTDIRFUNC)
+                AC_DEFINE(GLOB_HAS_ALTDIRFUNC, 1,
+                        [Define if your system glob() function has
+                        the GLOB_ALTDIRFUNC extension])
                AC_MSG_RESULT(yes)
        ],
        [
@@ -897,7 +935,9 @@ AC_EGREP_CPP(FOUNDIT,
                int main(void){glob_t g; g.gl_matchc = 1;}
        ],
        [
-                AC_DEFINE(GLOB_HAS_GL_MATCHC)
+                AC_DEFINE(GLOB_HAS_GL_MATCHC, 1,
+                        [Define if your system glob() function has
+                        gl_matchc options in glob_t])
                AC_MSG_RESULT(yes)
        ],
        [
@@ -915,7 +955,9 @@ int main(void){struct dirent d;exit(sizeof(d.d_name)<=sizeof(char));}
        [AC_MSG_RESULT(yes)],
        [
                AC_MSG_RESULT(no)
-                AC_DEFINE(BROKEN_ONE_BYTE_DIRENT_D_NAME)
+                AC_DEFINE(BROKEN_ONE_BYTE_DIRENT_D_NAME, 1,
+                        [Define if your struct dirent expects you to
+                        allocate extra space for d_name])
        ],
        [
                AC_MSG_WARN([cross compiling: assuming BROKEN_ONE_BYTE_DIRENT_D_NAME])
@@ -925,7 +967,7 @@ int main(void){struct dirent d;exit(sizeof(d.d_name)<=sizeof(char));}
 AC_MSG_CHECKING([for /proc/pid/fd directory])
 if test -d "/proc/$$/fd" ; then
-        AC_DEFINE(HAVE_PROC_PID)
+        AC_DEFINE(HAVE_PROC_PID, 1, [Define if you have /proc/$pid/fd])
        AC_MSG_RESULT(yes)
 else
        AC_MSG_RESULT(no)
@@ -943,17 +985,17 @@ AC_ARG_WITH(skey,
                                LDFLAGS="$LDFLAGS -L${withval}/lib"
                        fi
-                        AC_DEFINE(SKEY)
+                        AC_DEFINE(SKEY, 1, [Define if you want S/Key support])
                        LIBS="-lskey $LIBS"
                        SKEY_MSG="yes"
                        AC_MSG_CHECKING([for s/key support])
-                        AC_TRY_RUN(
+                        AC_LINK_IFELSE(
-                                [
+                                [AC_LANG_SOURCE([[
 #include <stdio.h>
 #include <skey.h>
 int main() { char *ff = skey_keyinfo(""); ff=""; exit(0); }
-                                ],
+                                ]])],
                                [AC_MSG_RESULT(yes)],
                                [
                                        AC_MSG_RESULT(no)
@@ -965,7 +1007,9 @@ int main() { char *ff = skey_keyinfo(""); ff=""; exit(0); }
                                 #include <skey.h>],
                                [(void)skeychallenge(NULL,"name","",0);],
                                [AC_MSG_RESULT(yes)
-                                 AC_DEFINE(SKEYCHALLENGE_4ARG)],
+                                 AC_DEFINE(SKEYCHALLENGE_4ARG, 1,
+                                        [Define if your skeychallenge()
+                                        function takes 4 arguments (NetBSD)])],
                                [AC_MSG_RESULT(no)]
                        )
                fi
@@ -1016,7 +1060,9 @@ AC_ARG_WITH(tcp-wrappers,
                                [hosts_access(0);],
                                [
                                        AC_MSG_RESULT(yes)
-                                        AC_DEFINE(LIBWRAP)
+                                        AC_DEFINE(LIBWRAP, 1,
+                                                [Define if you want
+                                                TCP Wrappers support])
                                        AC_SUBST(LIBWRAP)
                                        TCPW_MSG="yes"
                                ],
@@ -1035,11 +1081,15 @@ AC_ARG_WITH(libedit,
        [  --with-libedit[[=PATH]]   Enable libedit support for sftp],
        [ if test "x$withval" != "xno" ; then
                if test "x$withval" != "xyes"; then
-                        CPPFLAGS="$CPPFLAGS -I$withval/include"
+                        CPPFLAGS="$CPPFLAGS -I${withval}/include"
-                        LDFLAGS="$LDFLAGS -L$withval/lib"
+                        if test -n "${need_dash_r}"; then
+                                LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
+                        else
+                                LDFLAGS="-L${withval}/lib ${LDFLAGS}"
+                        fi
                fi
                AC_CHECK_LIB(edit, el_init,
-                        [ AC_DEFINE(USE_LIBEDIT, [], [Use libedit for sftp])
+                        [ AC_DEFINE(USE_LIBEDIT, 1, [Use libedit for sftp])
                          LIBEDIT="-ledit -lcurses"
                          LIBEDIT_MSG="yes"
                          AC_SUBST(LIBEDIT)
@@ -1083,12 +1133,12 @@ AC_ARG_WITH(audit,
                    [AC_MSG_ERROR(BSM enabled and required function not found)])
                # These are optional
                AC_CHECK_FUNCS(getaudit_addr)
-                AC_DEFINE(USE_BSM_AUDIT, [], [Use BSM audit module])
+                AC_DEFINE(USE_BSM_AUDIT, 1, [Use BSM audit module])
                ;;
          debug)
                AUDIT_MODULE=debug
                AC_MSG_RESULT(debug)
-                AC_DEFINE(SSH_AUDIT_EVENTS, [], Use audit debugging module)
+                AC_DEFINE(SSH_AUDIT_EVENTS, 1, Use audit debugging module)
                ;;
          no)
                AC_MSG_RESULT(no)
@@ -1102,6 +1152,7 @@ AC_ARG_WITH(audit,
 dnl    Checks for library functions. Please keep in alphabetical order
 AC_CHECK_FUNCS( \
        arc4random \
+        asprintf \
        b64_ntop \
        __b64_ntop \
        b64_pton \
@@ -1177,7 +1228,7 @@ AC_CHECK_FUNCS( \
        truncate \
        unsetenv \
        updwtmpx \
-        utimes \
+        vasprintf \
        vhangup \
        vsnprintf \
        waitpid \
@@ -1198,7 +1249,8 @@ str = gai_strerror(0);],[
                AC_DEFINE(HAVE_CONST_GAI_STRERROR_PROTO, 1,
                [Define if gai_strerror() returns const char *])])])
-AC_SEARCH_LIBS(nanosleep, rt posix4, AC_DEFINE(HAVE_NANOSLEEP))
+AC_SEARCH_LIBS(nanosleep, rt posix4, AC_DEFINE(HAVE_NANOSLEEP, 1,
+        [Some systems put nanosleep outside of libc]))
 dnl Make sure prototypes are defined for these before using them.
 AC_CHECK_DECL(getrusage, [AC_CHECK_FUNCS(getrusage)])
@@ -1230,7 +1282,8 @@ AC_CHECK_FUNCS(setresuid, [
 int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
                ]])],
                [AC_MSG_RESULT(yes)],
-                [AC_DEFINE(BROKEN_SETRESUID)
+                [AC_DEFINE(BROKEN_SETRESUID, 1,
+                        [Define if your setresuid() is broken])
                 AC_MSG_RESULT(not implemented)],
                [AC_MSG_WARN([cross compiling: not checking setresuid])]
        )
@@ -1246,7 +1299,8 @@ AC_CHECK_FUNCS(setresgid, [
 int main(){errno=0; setresgid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
                ]])],
                [AC_MSG_RESULT(yes)],
-                [AC_DEFINE(BROKEN_SETRESGID)
+                [AC_DEFINE(BROKEN_SETRESGID, 1,
+                        [Define if your setresgid() is broken])
                 AC_MSG_RESULT(not implemented)],
                [AC_MSG_WARN([cross compiling: not checking setresuid])]
        )
@@ -1262,13 +1316,16 @@ AC_CHECK_FUNCS(endutxent getutxent getutxid getutxline pututxline )
 AC_CHECK_FUNCS(setutxent utmpxname)
 AC_CHECK_FUNC(daemon,
-        [AC_DEFINE(HAVE_DAEMON)],
+        [AC_DEFINE(HAVE_DAEMON, 1, [Define if your libraries define daemon()])],
-        [AC_CHECK_LIB(bsd, daemon, [LIBS="$LIBS -lbsd"; AC_DEFINE(HAVE_DAEMON)])]
+        [AC_CHECK_LIB(bsd, daemon,
+                [LIBS="$LIBS -lbsd"; AC_DEFINE(HAVE_DAEMON)])]
 )
 AC_CHECK_FUNC(getpagesize,
-        [AC_DEFINE(HAVE_GETPAGESIZE)],
+        [AC_DEFINE(HAVE_GETPAGESIZE, 1,
-        [AC_CHECK_LIB(ucb, getpagesize, [LIBS="$LIBS -lucb"; AC_DEFINE(HAVE_GETPAGESIZE)])]
+                [Define if your libraries define getpagesize()])],
+        [AC_CHECK_LIB(ucb, getpagesize,
+                [LIBS="$LIBS -lucb"; AC_DEFINE(HAVE_GETPAGESIZE)])]
 )
 # Check for broken snprintf
@@ -1282,13 +1339,62 @@ int main(void){char b[5];snprintf(b,5,"123456789");exit(b[4]!='\0');}
                [AC_MSG_RESULT(yes)],
                [
                        AC_MSG_RESULT(no)
-                        AC_DEFINE(BROKEN_SNPRINTF)
+                        AC_DEFINE(BROKEN_SNPRINTF, 1,
+                                [Define if your snprintf is busted])
                        AC_MSG_WARN([****** Your snprintf() function is broken, complain to your vendor])
                ],
                [ AC_MSG_WARN([cross compiling: Assuming working snprintf()]) ]
        )
 fi
+# If we don't have a working asprintf, then we strongly depend on vsnprintf
+# returning the right thing on overflow: the number of characters it tried to
+# create (as per SUSv3)
+if test "x$ac_cv_func_asprintf" != "xyes" && \
+   test "x$ac_cv_func_vsnprintf" = "xyes" ; then
+        AC_MSG_CHECKING([whether vsnprintf returns correct values on overflow])
+        AC_RUN_IFELSE(
+                [AC_LANG_SOURCE([[
+#include <sys/types.h>
+#include <stdio.h>
+#include <stdarg.h>
+int x_snprintf(char *str,size_t count,const char *fmt,...)
+{
+        size_t ret; va_list ap;
+        va_start(ap, fmt); ret = vsnprintf(str, count, fmt, ap); va_end(ap);
+        return ret;
+}
+int main(void)
+{
+        char x[1];
+        exit(x_snprintf(x, 1, "%s %d", "hello", 12345) == 11 ? 0 : 1);
+} ]])],
+                [AC_MSG_RESULT(yes)],
+                [
+                        AC_MSG_RESULT(no)
+                        AC_DEFINE(BROKEN_SNPRINTF, 1,
+                                [Define if your snprintf is busted])
+                        AC_MSG_WARN([****** Your vsnprintf() function is broken, complain to your vendor])
+                ],
+                [ AC_MSG_WARN([cross compiling: Assuming working vsnprintf()]) ]
+        )
+fi
+# On systems where [v]snprintf is broken, but is declared in stdio,
+# check that the fmt argument is const char * or just char *.
+# This is only useful for when BROKEN_SNPRINTF
+AC_MSG_CHECKING([whether snprintf can declare const char *fmt])
+AC_COMPILE_IFELSE([AC_LANG_SOURCE([[#include <stdio.h>
+           int snprintf(char *a, size_t b, const char *c, ...) { return 0; }
+           int main(void) { snprintf(0, 0, 0); } 
+    ]])],
+   [AC_MSG_RESULT(yes)
+    AC_DEFINE(SNPRINTF_CONST, [const],
+              [Define as const if snprintf() can declare const char *fmt])],
+   [AC_MSG_RESULT(no)
+    AC_DEFINE(SNPRINTF_CONST, [/* not const */])])
 # Check for missing getpeereid (or equiv) support
 NO_PEERCHECK=""
 if test "x$ac_cv_func_getpeereid" != "xyes" ; then
@@ -1298,7 +1404,7 @@ if test "x$ac_cv_func_getpeereid" != "xyes" ; then
                 #include <sys/socket.h>],
                [int i = SO_PEERCRED;],
                [ AC_MSG_RESULT(yes)
-                  AC_DEFINE(HAVE_SO_PEERCRED, [], [Have PEERCRED socket option])
+                  AC_DEFINE(HAVE_SO_PEERCRED, 1, [Have PEERCRED socket option])
                ],
                [AC_MSG_RESULT(no)
                NO_PEERCHECK=1]
@@ -1308,21 +1414,21 @@ fi
 dnl see whether mkstemp() requires XXXXXX
 if test "x$ac_cv_func_mkdtemp" = "xyes" ; then
 AC_MSG_CHECKING([for (overly) strict mkstemp])
-AC_TRY_RUN(
+AC_RUN_IFELSE(
-        [
+        [AC_LANG_SOURCE([[
 #include <stdlib.h>
 main() { char template[]="conftest.mkstemp-test";
 if (mkstemp(template) == -1)
        exit(1);
 unlink(template); exit(0);
 }
-        ],
+        ]])],
        [
                AC_MSG_RESULT(no)
        ],
        [
                AC_MSG_RESULT(yes)
-                AC_DEFINE(HAVE_STRICT_MKSTEMP)
+                AC_DEFINE(HAVE_STRICT_MKSTEMP, 1, [Silly mkstemp()])
        ],
        [
                AC_MSG_RESULT(yes)
@@ -1334,8 +1440,8 @@ fi
 dnl make sure that openpty does not reacquire controlling terminal
 if test ! -z "$check_for_openpty_ctty_bug"; then
        AC_MSG_CHECKING(if openpty correctly handles controlling tty)
-        AC_TRY_RUN(
+        AC_RUN_IFELSE(
-                [
+                [AC_LANG_SOURCE([[
 #include <stdio.h>
 #include <sys/fcntl.h>
 #include <sys/types.h>
@@ -1367,13 +1473,16 @@ main()
                        exit(0);        /* Did not acquire ctty: OK */
        }
 }
-                ],
+                ]])],
                [
                        AC_MSG_RESULT(yes)
                ],
                [
                        AC_MSG_RESULT(no)
                        AC_DEFINE(SSHD_ACQUIRES_CTTY)
+                ],
+                [
+                        AC_MSG_RESULT(cross-compiling, assuming yes)
                ]
        )
 fi
@@ -1381,8 +1490,8 @@ fi
 if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
    test "x$check_for_hpux_broken_getaddrinfo" = "x1"; then
        AC_MSG_CHECKING(if getaddrinfo seems to work)
-        AC_TRY_RUN(
+        AC_RUN_IFELSE(
-                [
+                [AC_LANG_SOURCE([[
 #include <stdio.h>
 #include <sys/socket.h>
 #include <netdb.h>
@@ -1436,13 +1545,16 @@ main(void)
        }
        exit(0);
 }
-                ],
+                ]])],
                [
                        AC_MSG_RESULT(yes)
                ],
                [
                        AC_MSG_RESULT(no)
                        AC_DEFINE(BROKEN_GETADDRINFO)
+                ],
+                [
+                        AC_MSG_RESULT(cross-compiling, assuming yes)
                ]
        )
 fi
@@ -1450,8 +1562,8 @@ fi
 if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
    test "x$check_for_aix_broken_getaddrinfo" = "x1"; then
        AC_MSG_CHECKING(if getaddrinfo seems to work)
-        AC_TRY_RUN(
+        AC_RUN_IFELSE(
-                [
+                [AC_LANG_SOURCE([[
 #include <stdio.h>
 #include <sys/socket.h>
 #include <netdb.h>
@@ -1493,15 +1605,18 @@ main(void)
        }
        exit(0);
 }
-                ],
+                ]])],
                [
                        AC_MSG_RESULT(yes)
-                        AC_DEFINE(AIX_GETNAMEINFO_HACK, [],
+                        AC_DEFINE(AIX_GETNAMEINFO_HACK, 1,
-[Define if you have a getaddrinfo that fails for the all-zeros IPv6 address])
+                                [Define if you have a getaddrinfo that fails
+                                for the all-zeros IPv6 address])
                ],
                [
                        AC_MSG_RESULT(no)
                        AC_DEFINE(BROKEN_GETADDRINFO)
+                ],
+                        AC_MSG_RESULT(cross-compiling, assuming no)
                ]
        )
 fi
@@ -1544,7 +1659,8 @@ AC_ARG_WITH(pam,
                        PAM_MSG="yes"
-                        AC_DEFINE(USE_PAM)
+                        AC_DEFINE(USE_PAM, 1,
+                                [Define if you want to enable PAM support])
                        if test $ac_cv_lib_dl_dlopen = yes; then
                                LIBPAM="-lpam -ldl"
                        else
@@ -1571,7 +1687,9 @@ if test "x$PAM_MSG" = "xyes" ; then
                [(void)pam_strerror((pam_handle_t *)NULL, -1);],
                [AC_MSG_RESULT(no)],
                [
-                        AC_DEFINE(HAVE_OLD_PAM)
+                        AC_DEFINE(HAVE_OLD_PAM, 1,
+                                [Define if you have an old version of PAM
+                                which takes only one argument to pam_strerror])
                        AC_MSG_RESULT(yes)
                        PAM_MSG="yes (old library)"
                ]
@@ -1611,7 +1729,9 @@ AC_ARG_WITH(ssl-dir,
        ]
 )
 LIBS="-lcrypto $LIBS"
-AC_TRY_LINK_FUNC(RAND_add, AC_DEFINE(HAVE_OPENSSL),
+AC_TRY_LINK_FUNC(RAND_add, AC_DEFINE(HAVE_OPENSSL, 1,
+        [Define if your ssl headers are included
+        with #include <openssl/header.h>]),
        [
                dnl Check default openssl install dir
                if test -n "${need_dash_r}"; then
@@ -1721,6 +1841,24 @@ Also see contrib/findssl.sh for help identifying header/library mismatches.])
        ]
 )
+# Check for OpenSSL without EVP_aes_{192,256}_cbc
+AC_MSG_CHECKING([whether OpenSSL has crippled AES support])
+AC_COMPILE_IFELSE(
+        [AC_LANG_SOURCE([[
+#include <string.h>
+#include <openssl/evp.h>
+int main(void) { exit(EVP_aes_192_cbc() == NULL || EVP_aes_256_cbc() == NULL);}
+        ]])],
+        [
+                AC_MSG_RESULT(no)
+        ],
+        [
+                AC_MSG_RESULT(yes)
+                AC_DEFINE(OPENSSL_LOBOTOMISED_AES, 1,
+                    [libcrypto is missing AES 192 and 256 bit functions])
+        ]
+)
 # Some systems want crypt() from libcrypt, *not* the version in OpenSSL,
 # because the system crypt() is more featureful.
 if test "x$check_for_libcrypt_before" = "x1"; then
@@ -1785,7 +1923,8 @@ AC_ARG_WITH(rand-helper,
 # Which randomness source do we use?
 if test ! -z "$OPENSSL_SEEDS_ITSELF" && test -z "$USE_RAND_HELPER" ; then
        # OpenSSL only
-        AC_DEFINE(OPENSSL_PRNG_ONLY)
+        AC_DEFINE(OPENSSL_PRNG_ONLY, 1,
+                [Define if you want OpenSSL's internally seeded PRNG only])
        RAND_MSG="OpenSSL internal ONLY"
        INSTALL_SSH_RAND_HELPER=""
 elif test ! -z "$USE_RAND_HELPER" ; then
@@ -1813,7 +1952,8 @@ AC_ARG_WITH(prngd-port,
                esac
                if test ! -z "$withval" ; then
                        PRNGD_PORT="$withval"
-                        AC_DEFINE_UNQUOTED(PRNGD_PORT, $PRNGD_PORT)
+                        AC_DEFINE_UNQUOTED(PRNGD_PORT, $PRNGD_PORT,
+                                [Port number of PRNGD/EGD random number socket])
                fi
        ]
 )
@@ -1844,7 +1984,8 @@ AC_ARG_WITH(prngd-socket,
                                AC_MSG_WARN(Entropy socket is not readable)
                        fi
                        PRNGD_SOCKET="$withval"
-                        AC_DEFINE_UNQUOTED(PRNGD_SOCKET, "$PRNGD_SOCKET")
+                        AC_DEFINE_UNQUOTED(PRNGD_SOCKET, "$PRNGD_SOCKET",
+                                [Location of PRNGD/EGD random number socket])
                fi
        ],
        [
@@ -1879,7 +2020,8 @@ AC_ARG_WITH(entropy-timeout,
                fi
        ]
 )
-AC_DEFINE_UNQUOTED(ENTROPY_TIMEOUT_MSEC, $entropy_timeout)
+AC_DEFINE_UNQUOTED(ENTROPY_TIMEOUT_MSEC, $entropy_timeout,
+        [Builtin PRNG command timeout])
 SSH_PRIVSEP_USER=sshd
 AC_ARG_WITH(privsep-user,
@@ -1891,7 +2033,8 @@ AC_ARG_WITH(privsep-user,
                fi
        ]
 )
-AC_DEFINE_UNQUOTED(SSH_PRIVSEP_USER, "$SSH_PRIVSEP_USER")
+AC_DEFINE_UNQUOTED(SSH_PRIVSEP_USER, "$SSH_PRIVSEP_USER",
+        [non-privileged user for privilege separation])
 AC_SUBST(SSH_PRIVSEP_USER)
 # We do this little dance with the search path to insure
@@ -1949,7 +2092,10 @@ if test ! -z "$SONY" ; then
  LIBS="$LIBS -liberty";
 fi
-# Checks for data types
+# Check for  long long datatypes
+AC_CHECK_TYPES([long long, unsigned long long, long double])
+# Check datatype sizes
 AC_CHECK_SIZEOF(char, 1)
 AC_CHECK_SIZEOF(short int, 2)
 AC_CHECK_SIZEOF(int, 4)
@@ -1961,6 +2107,84 @@ if test "x$ac_cv_sizeof_long_long_int" = "x4" ; then
        ac_cv_sizeof_long_long_int=0
 fi
+# compute LLONG_MIN and LLONG_MAX if we don't know them.
+if test -z "$have_llong_max"; then
+        AC_MSG_CHECKING([for max value of long long])
+        AC_RUN_IFELSE(
+                [AC_LANG_SOURCE([[
+#include <stdio.h>
+/* Why is this so damn hard? */
+#ifdef __GNUC__
+# undef __GNUC__
+#endif
+#define __USE_ISOC99
+#include <limits.h>
+#define DATA "conftest.llminmax"
+int main(void) {
+        FILE *f;
+        long long i, llmin, llmax = 0;
+        if((f = fopen(DATA,"w")) == NULL)
+                exit(1);
+#if defined(LLONG_MIN) && defined(LLONG_MAX)
+        fprintf(stderr, "Using system header for LLONG_MIN and LLONG_MAX\n");
+        llmin = LLONG_MIN;
+        llmax = LLONG_MAX;
+#else
+        fprintf(stderr, "Calculating  LLONG_MIN and LLONG_MAX\n");
+        /* This will work on one's complement and two's complement */
+        for (i = 1; i > llmax; i <<= 1, i++)
+                llmax = i;
+        llmin = llmax + 1LL;    /* wrap */
+#endif
+        /* Sanity check */
+        if (llmin + 1 < llmin || llmin - 1 < llmin || llmax + 1 > llmax
+            || llmax - 1 > llmax) {
+                fprintf(f, "unknown unknown\n");
+                exit(2);
+        }
+        if (fprintf(f ,"%lld %lld", llmin, llmax) < 0)
+                exit(3);
+        exit(0);
+}
+                ]])],
+                [
+                        llong_min=`$AWK '{print $1}' conftest.llminmax`
+                        llong_max=`$AWK '{print $2}' conftest.llminmax`
+                        # snprintf on some Tru64s doesn't understand "%lld"
+                        case "$host" in
+                        alpha-dec-osf*)
+                                if test "x$ac_cv_sizeof_long_long_int" = "x8" &&
+                                  test "x$llong_max" = "xld"; then
+                                        llong_min="-9223372036854775808"
+                                        llong_max="9223372036854775807"
+                                fi
+                                ;;
+                        esac
+                        AC_MSG_RESULT($llong_max)
+                        AC_DEFINE_UNQUOTED(LLONG_MAX, [${llong_max}LL],
+                            [max value of long long calculated by configure])
+                        AC_MSG_CHECKING([for min value of long long])
+                        AC_MSG_RESULT($llong_min)
+                        AC_DEFINE_UNQUOTED(LLONG_MIN, [${llong_min}LL],
+                            [min value of long long calculated by configure])
+                ],
+                [
+                        AC_MSG_RESULT(not found)
+                ],
+                [
+                        AC_MSG_WARN([cross compiling: not checking])
+                ]
+        )
+fi
 # More checks for data types
 AC_CACHE_CHECK([for u_int type], ac_cv_have_u_int, [
        AC_TRY_COMPILE(
@@ -1971,7 +2195,7 @@ AC_CACHE_CHECK([for u_int type], ac_cv_have_u_int, [
        )
 ])
 if test "x$ac_cv_have_u_int" = "xyes" ; then
-        AC_DEFINE(HAVE_U_INT)
+        AC_DEFINE(HAVE_U_INT, 1, [define if you have u_int data type])
        have_u_int=1
 fi
@@ -1984,7 +2208,7 @@ AC_CACHE_CHECK([for intXX_t types], ac_cv_have_intxx_t, [
        )
 ])
 if test "x$ac_cv_have_intxx_t" = "xyes" ; then
-        AC_DEFINE(HAVE_INTXX_T)
+        AC_DEFINE(HAVE_INTXX_T, 1, [define if you have intxx_t data type])
        have_intxx_t=1
 fi
@@ -2021,7 +2245,7 @@ AC_CACHE_CHECK([for int64_t type], ac_cv_have_int64_t, [
        )
 ])
 if test "x$ac_cv_have_int64_t" = "xyes" ; then
-        AC_DEFINE(HAVE_INT64_T)
+        AC_DEFINE(HAVE_INT64_T, 1, [define if you have int64_t data type])
 fi
 AC_CACHE_CHECK([for u_intXX_t types], ac_cv_have_u_intxx_t, [
@@ -2033,7 +2257,7 @@ AC_CACHE_CHECK([for u_intXX_t types], ac_cv_have_u_intxx_t, [
        )
 ])
 if test "x$ac_cv_have_u_intxx_t" = "xyes" ; then
-        AC_DEFINE(HAVE_U_INTXX_T)
+        AC_DEFINE(HAVE_U_INTXX_T, 1, [define if you have u_intxx_t data type])
        have_u_intxx_t=1
 fi
@@ -2059,7 +2283,7 @@ AC_CACHE_CHECK([for u_int64_t types], ac_cv_have_u_int64_t, [
        )
 ])
 if test "x$ac_cv_have_u_int64_t" = "xyes" ; then
-        AC_DEFINE(HAVE_U_INT64_T)
+        AC_DEFINE(HAVE_U_INT64_T, 1, [define if you have u_int64_t data type])
        have_u_int64_t=1
 fi
@@ -2088,7 +2312,8 @@ if test -z "$have_u_intxx_t" ; then
                )
        ])
        if test "x$ac_cv_have_uintxx_t" = "xyes" ; then
-                AC_DEFINE(HAVE_UINTXX_T)
+                AC_DEFINE(HAVE_UINTXX_T, 1,
+                        [define if you have uintxx_t data type])
        fi
 fi
@@ -2139,7 +2364,7 @@ AC_CACHE_CHECK([for u_char], ac_cv_have_u_char, [
        )
 ])
 if test "x$ac_cv_have_u_char" = "xyes" ; then
-        AC_DEFINE(HAVE_U_CHAR)
+        AC_DEFINE(HAVE_U_CHAR, 1, [define if you have u_char data type])
 fi
 TYPE_SOCKLEN_T
@@ -2161,7 +2386,7 @@ AC_CACHE_CHECK([for size_t], ac_cv_have_size_t, [
        )
 ])
 if test "x$ac_cv_have_size_t" = "xyes" ; then
-        AC_DEFINE(HAVE_SIZE_T)
+        AC_DEFINE(HAVE_SIZE_T, 1, [define if you have size_t data type])
 fi
 AC_CACHE_CHECK([for ssize_t], ac_cv_have_ssize_t, [
@@ -2175,7 +2400,7 @@ AC_CACHE_CHECK([for ssize_t], ac_cv_have_ssize_t, [
        )
 ])
 if test "x$ac_cv_have_ssize_t" = "xyes" ; then
-        AC_DEFINE(HAVE_SSIZE_T)
+        AC_DEFINE(HAVE_SSIZE_T, 1, [define if you have ssize_t data type])
 fi
 AC_CACHE_CHECK([for clock_t], ac_cv_have_clock_t, [
@@ -2189,7 +2414,7 @@ AC_CACHE_CHECK([for clock_t], ac_cv_have_clock_t, [
        )
 ])
 if test "x$ac_cv_have_clock_t" = "xyes" ; then
-        AC_DEFINE(HAVE_CLOCK_T)
+        AC_DEFINE(HAVE_CLOCK_T, 1, [define if you have clock_t data type])
 fi
 AC_CACHE_CHECK([for sa_family_t], ac_cv_have_sa_family_t, [
@@ -2214,7 +2439,8 @@ AC_CACHE_CHECK([for sa_family_t], ac_cv_have_sa_family_t, [
        )
 ])
 if test "x$ac_cv_have_sa_family_t" = "xyes" ; then
-        AC_DEFINE(HAVE_SA_FAMILY_T)
+        AC_DEFINE(HAVE_SA_FAMILY_T, 1,
+                [define if you have sa_family_t data type])
 fi
 AC_CACHE_CHECK([for pid_t], ac_cv_have_pid_t, [
@@ -2228,7 +2454,7 @@ AC_CACHE_CHECK([for pid_t], ac_cv_have_pid_t, [
        )
 ])
 if test "x$ac_cv_have_pid_t" = "xyes" ; then
-        AC_DEFINE(HAVE_PID_T)
+        AC_DEFINE(HAVE_PID_T, 1, [define if you have pid_t data type])
 fi
 AC_CACHE_CHECK([for mode_t], ac_cv_have_mode_t, [
@@ -2242,7 +2468,7 @@ AC_CACHE_CHECK([for mode_t], ac_cv_have_mode_t, [
        )
 ])
 if test "x$ac_cv_have_mode_t" = "xyes" ; then
-        AC_DEFINE(HAVE_MODE_T)
+        AC_DEFINE(HAVE_MODE_T, 1, [define if you have mode_t data type])
 fi
@@ -2258,7 +2484,8 @@ AC_CACHE_CHECK([for struct sockaddr_storage], ac_cv_have_struct_sockaddr_storage
        )
 ])
 if test "x$ac_cv_have_struct_sockaddr_storage" = "xyes" ; then
-        AC_DEFINE(HAVE_STRUCT_SOCKADDR_STORAGE)
+        AC_DEFINE(HAVE_STRUCT_SOCKADDR_STORAGE, 1,
+                [define if you have struct sockaddr_storage data type])
 fi
 AC_CACHE_CHECK([for struct sockaddr_in6], ac_cv_have_struct_sockaddr_in6, [
@@ -2273,7 +2500,8 @@ AC_CACHE_CHECK([for struct sockaddr_in6], ac_cv_have_struct_sockaddr_in6, [
        )
 ])
 if test "x$ac_cv_have_struct_sockaddr_in6" = "xyes" ; then
-        AC_DEFINE(HAVE_STRUCT_SOCKADDR_IN6)
+        AC_DEFINE(HAVE_STRUCT_SOCKADDR_IN6, 1,
+                [define if you have struct sockaddr_in6 data type])
 fi
 AC_CACHE_CHECK([for struct in6_addr], ac_cv_have_struct_in6_addr, [
@@ -2288,7 +2516,8 @@ AC_CACHE_CHECK([for struct in6_addr], ac_cv_have_struct_in6_addr, [
        )
 ])
 if test "x$ac_cv_have_struct_in6_addr" = "xyes" ; then
-        AC_DEFINE(HAVE_STRUCT_IN6_ADDR)
+        AC_DEFINE(HAVE_STRUCT_IN6_ADDR, 1,
+                [define if you have struct in6_addr data type])
 fi
 AC_CACHE_CHECK([for struct addrinfo], ac_cv_have_struct_addrinfo, [
@@ -2304,7 +2533,8 @@ AC_CACHE_CHECK([for struct addrinfo], ac_cv_have_struct_addrinfo, [
        )
 ])
 if test "x$ac_cv_have_struct_addrinfo" = "xyes" ; then
-        AC_DEFINE(HAVE_STRUCT_ADDRINFO)
+        AC_DEFINE(HAVE_STRUCT_ADDRINFO, 1,
+                [define if you have struct addrinfo data type])
 fi
 AC_CACHE_CHECK([for struct timeval], ac_cv_have_struct_timeval, [
@@ -2316,7 +2546,7 @@ AC_CACHE_CHECK([for struct timeval], ac_cv_have_struct_timeval, [
        )
 ])
 if test "x$ac_cv_have_struct_timeval" = "xyes" ; then
-        AC_DEFINE(HAVE_STRUCT_TIMEVAL)
+        AC_DEFINE(HAVE_STRUCT_TIMEVAL, 1, [define if you have struct timeval])
        have_struct_timeval=1
 fi
@@ -2381,6 +2611,17 @@ OSSH_CHECK_HEADER_FOR_FIELD(ut_time, utmpx.h, HAVE_TIME_IN_UTMPX)
 OSSH_CHECK_HEADER_FOR_FIELD(ut_tv, utmpx.h, HAVE_TV_IN_UTMPX)
 AC_CHECK_MEMBERS([struct stat.st_blksize])
+AC_CHECK_MEMBER([struct __res_state.retrans], [], [AC_DEFINE(__res_state, state,
+        [Define if we don't have struct __res_state in resolv.h])],
+[
+#include <stdio.h>
+#if HAVE_SYS_TYPES_H
+# include <sys/types.h>
+#endif
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <resolv.h>
+])
 AC_CACHE_CHECK([for ss_family field in struct sockaddr_storage],
                ac_cv_have_ss_family_in_struct_ss, [
@@ -2395,7 +2636,7 @@ AC_CACHE_CHECK([for ss_family field in struct sockaddr_storage],
        )
 ])
 if test "x$ac_cv_have_ss_family_in_struct_ss" = "xyes" ; then
-        AC_DEFINE(HAVE_SS_FAMILY_IN_SS)
+        AC_DEFINE(HAVE_SS_FAMILY_IN_SS, 1, [Fields in struct sockaddr_storage])
 fi
 AC_CACHE_CHECK([for __ss_family field in struct sockaddr_storage],
@@ -2411,7 +2652,8 @@ AC_CACHE_CHECK([for __ss_family field in struct sockaddr_storage],
        )
 ])
 if test "x$ac_cv_have___ss_family_in_struct_ss" = "xyes" ; then
-        AC_DEFINE(HAVE___SS_FAMILY_IN_SS)
+        AC_DEFINE(HAVE___SS_FAMILY_IN_SS, 1,
+                [Fields in struct sockaddr_storage])
 fi
 AC_CACHE_CHECK([for pw_class field in struct passwd],
@@ -2426,7 +2668,8 @@ AC_CACHE_CHECK([for pw_class field in struct passwd],
        )
 ])
 if test "x$ac_cv_have_pw_class_in_struct_passwd" = "xyes" ; then
-        AC_DEFINE(HAVE_PW_CLASS_IN_PASSWD)
+        AC_DEFINE(HAVE_PW_CLASS_IN_PASSWD, 1,
+                [Define if your password has a pw_class field])
 fi
 AC_CACHE_CHECK([for pw_expire field in struct passwd],
@@ -2441,7 +2684,8 @@ AC_CACHE_CHECK([for pw_expire field in struct passwd],
        )
 ])
 if test "x$ac_cv_have_pw_expire_in_struct_passwd" = "xyes" ; then
-        AC_DEFINE(HAVE_PW_EXPIRE_IN_PASSWD)
+        AC_DEFINE(HAVE_PW_EXPIRE_IN_PASSWD, 1,
+                [Define if your password has a pw_expire field])
 fi
 AC_CACHE_CHECK([for pw_change field in struct passwd],
@@ -2456,7 +2700,8 @@ AC_CACHE_CHECK([for pw_change field in struct passwd],
        )
 ])
 if test "x$ac_cv_have_pw_change_in_struct_passwd" = "xyes" ; then
-        AC_DEFINE(HAVE_PW_CHANGE_IN_PASSWD)
+        AC_DEFINE(HAVE_PW_CHANGE_IN_PASSWD, 1,
+                [Define if your password has a pw_change field])
 fi
 dnl make sure we're using the real structure members and not defines
@@ -2482,7 +2727,9 @@ exit(0);
        )
 ])
 if test "x$ac_cv_have_accrights_in_msghdr" = "xyes" ; then
-        AC_DEFINE(HAVE_ACCRIGHTS_IN_MSGHDR)
+        AC_DEFINE(HAVE_ACCRIGHTS_IN_MSGHDR, 1,
+                [Define if your system uses access rights style
+                file descriptor passing])
 fi
 AC_CACHE_CHECK([for msg_control field in struct msghdr],
@@ -2507,7 +2754,9 @@ exit(0);
        )
 ])
 if test "x$ac_cv_have_control_in_msghdr" = "xyes" ; then
-        AC_DEFINE(HAVE_CONTROL_IN_MSGHDR)
+        AC_DEFINE(HAVE_CONTROL_IN_MSGHDR, 1,
+                [Define if your system uses ancillary data style
+                file descriptor passing])
 fi
 AC_CACHE_CHECK([if libc defines __progname], ac_cv_libc_defines___progname, [
@@ -2518,7 +2767,7 @@ AC_CACHE_CHECK([if libc defines __progname], ac_cv_libc_defines___progname, [
        )
 ])
 if test "x$ac_cv_libc_defines___progname" = "xyes" ; then
-        AC_DEFINE(HAVE___PROGNAME)
+        AC_DEFINE(HAVE___PROGNAME, 1, [Define if libc defines __progname])
 fi
 AC_CACHE_CHECK([whether $CC implements __FUNCTION__], ac_cv_cc_implements___FUNCTION__, [
@@ -2531,7 +2780,8 @@ AC_CACHE_CHECK([whether $CC implements __FUNCTION__], ac_cv_cc_implements___FUNC
        )
 ])
 if test "x$ac_cv_cc_implements___FUNCTION__" = "xyes" ; then
-        AC_DEFINE(HAVE___FUNCTION__)
+        AC_DEFINE(HAVE___FUNCTION__, 1,
+                [Define if compiler implements __FUNCTION__])
 fi
 AC_CACHE_CHECK([whether $CC implements __func__], ac_cv_cc_implements___func__, [
@@ -2544,7 +2794,33 @@ AC_CACHE_CHECK([whether $CC implements __func__], ac_cv_cc_implements___func__,
        )
 ])
 if test "x$ac_cv_cc_implements___func__" = "xyes" ; then
-        AC_DEFINE(HAVE___func__)
+        AC_DEFINE(HAVE___func__, 1, [Define if compiler implements __func__])
+fi
+AC_CACHE_CHECK([whether va_copy exists], ac_cv_have_va_copy, [
+        AC_TRY_LINK(
+                [#include <stdarg.h>
+                 va_list x,y;],
+                [va_copy(x,y);],
+                [ ac_cv_have_va_copy="yes" ],
+                [ ac_cv_have_va_copy="no" ]
+        )
+])
+if test "x$ac_cv_have_va_copy" = "xyes" ; then
+        AC_DEFINE(HAVE_VA_COPY, 1, [Define if va_copy exists])
+fi
+AC_CACHE_CHECK([whether __va_copy exists], ac_cv_have___va_copy, [
+        AC_TRY_LINK(
+                [#include <stdarg.h>
+                 va_list x,y;],
+                [__va_copy(x,y);],
+                [ ac_cv_have___va_copy="yes" ],
+                [ ac_cv_have___va_copy="no" ]
+        )
+])
+if test "x$ac_cv_have___va_copy" = "xyes" ; then
+        AC_DEFINE(HAVE___VA_COPY, 1, [Define if __va_copy exists])
 fi
 AC_CACHE_CHECK([whether getopt has optreset support],
@@ -2559,7 +2835,8 @@ AC_CACHE_CHECK([whether getopt has optreset support],
        )
 ])
 if test "x$ac_cv_have_getopt_optreset" = "xyes" ; then
-        AC_DEFINE(HAVE_GETOPT_OPTRESET)
+        AC_DEFINE(HAVE_GETOPT_OPTRESET, 1,
+                [Define if your getopt(3) defines and uses optreset])
 fi
 AC_CACHE_CHECK([if libc defines sys_errlist], ac_cv_libc_defines_sys_errlist, [
@@ -2570,7 +2847,8 @@ AC_CACHE_CHECK([if libc defines sys_errlist], ac_cv_libc_defines_sys_errlist, [
        )
 ])
 if test "x$ac_cv_libc_defines_sys_errlist" = "xyes" ; then
-        AC_DEFINE(HAVE_SYS_ERRLIST)
+        AC_DEFINE(HAVE_SYS_ERRLIST, 1,
+                [Define if your system defines sys_errlist[]])
 fi
@@ -2582,7 +2860,7 @@ AC_CACHE_CHECK([if libc defines sys_nerr], ac_cv_libc_defines_sys_nerr, [
        )
 ])
 if test "x$ac_cv_libc_defines_sys_nerr" = "xyes" ; then
-        AC_DEFINE(HAVE_SYS_NERR)
+        AC_DEFINE(HAVE_SYS_NERR, 1, [Define if your system defines sys_nerr])
 fi
 SCARD_MSG="no"
@@ -2609,8 +2887,11 @@ AC_ARG_WITH(sectok,
                        if test "$ac_cv_lib_sectok_sectok_open" != yes; then
                                AC_MSG_ERROR(Can't find libsectok)
                        fi
-                        AC_DEFINE(SMARTCARD)
+                        AC_DEFINE(SMARTCARD, 1,
-                        AC_DEFINE(USE_SECTOK)
+                                [Define if you want smartcard support])
+                        AC_DEFINE(USE_SECTOK, 1,
+                                [Define if you want smartcard support
+                                using sectok])
                        SCARD_MSG="yes, using sectok"
                fi
        ]
@@ -2619,7 +2900,7 @@ AC_ARG_WITH(sectok,
 # Check whether user wants OpenSC support
 OPENSC_CONFIG="no"
 AC_ARG_WITH(opensc,
-        [--with-opensc[[=PFX]]       Enable smartcard support using OpenSC (optionally in PATH)],
+        [  --with-opensc[[=PFX]]     Enable smartcard support using OpenSC (optionally in PATH)],
        [
            if test "x$withval" != "xno" ; then
                if test "x$withval" != "xyes" ; then
@@ -2633,7 +2914,9 @@ AC_ARG_WITH(opensc,
                        CPPFLAGS="$CPPFLAGS $LIBOPENSC_CFLAGS"
                        LDFLAGS="$LDFLAGS $LIBOPENSC_LIBS"
                        AC_DEFINE(SMARTCARD)
-                        AC_DEFINE(USE_OPENSC)
+                        AC_DEFINE(USE_OPENSC, 1,
+                                [Define if you want smartcard support
+                                using OpenSC])
                        SCARD_MSG="yes, using OpenSC"
                fi
            fi
@@ -2642,7 +2925,8 @@ AC_ARG_WITH(opensc,
 # Check libraries needed by DNS fingerprint support
 AC_SEARCH_LIBS(getrrsetbyname, resolv,
-        [AC_DEFINE(HAVE_GETRRSETBYNAME)],
+        [AC_DEFINE(HAVE_GETRRSETBYNAME, 1,
+                [Define if getrrsetbyname() exists])],
        [
                # Needed by our getrrsetbyname()
                AC_SEARCH_LIBS(res_query, resolv)
@@ -2671,7 +2955,8 @@ int main()
                    [#include <sys/types.h>
                    #include <arpa/nameser.h>])
                AC_CHECK_MEMBER(HEADER.ad,
-                        [AC_DEFINE(HAVE_HEADER_AD)],,
+                        [AC_DEFINE(HAVE_HEADER_AD, 1,
+                            [Define if HEADER.ad exists in arpa/nameser.h])],,
                        [#include <arpa/nameser.h>])
        ])
@@ -2698,7 +2983,7 @@ AC_ARG_WITH(kerberos5,
                        KRB5ROOT=${withval}
                fi
-                AC_DEFINE(KRB5)
+                AC_DEFINE(KRB5, 1, [Define if you want Kerberos 5 support])
                KRB5_MSG="yes"
                AC_MSG_CHECKING(for krb5-config)
@@ -2709,7 +2994,9 @@ AC_ARG_WITH(kerberos5,
                        AC_MSG_CHECKING(for gssapi support)
                        if $KRB5CONF | grep gssapi >/dev/null ; then
                                AC_MSG_RESULT(yes)
-                                AC_DEFINE(GSSAPI)
+                                AC_DEFINE(GSSAPI, 1,
+                                        [Define this if you want GSSAPI
+                                        support in the version 2 protocol])
                                k5confopts=gssapi
                        else
                                AC_MSG_RESULT(no)
@@ -2722,7 +3009,9 @@ AC_ARG_WITH(kerberos5,
                        AC_TRY_COMPILE([ #include <krb5.h> ],
                                       [ char *tmp = heimdal_version; ],
                                       [ AC_MSG_RESULT(yes)
-                                         AC_DEFINE(HEIMDAL) ],
+                                         AC_DEFINE(HEIMDAL, 1,
+                                        [Define this if you are using the
+                                        Heimdal version of Kerberos V5]) ],
                                         AC_MSG_RESULT(no)
                        )
                else
@@ -2777,14 +3066,15 @@ AC_ARG_WITH(kerberos5,
                if test ! -z "$blibpath" ; then
                        blibpath="$blibpath:${KRB5ROOT}/lib"
                fi
-        fi
-        AC_CHECK_HEADERS(gssapi.h gssapi/gssapi.h)
+                AC_CHECK_HEADERS(gssapi.h gssapi/gssapi.h)
-        AC_CHECK_HEADERS(gssapi_krb5.h gssapi/gssapi_krb5.h)
+                AC_CHECK_HEADERS(gssapi_krb5.h gssapi/gssapi_krb5.h)
-        AC_CHECK_HEADERS(gssapi_generic.h gssapi/gssapi_generic.h)
+                AC_CHECK_HEADERS(gssapi_generic.h gssapi/gssapi_generic.h)
-        LIBS="$LIBS $K5LIBS"
+                LIBS="$LIBS $K5LIBS"
-        AC_SEARCH_LIBS(k_hasafs, kafs, AC_DEFINE(USE_AFS))
+                AC_SEARCH_LIBS(k_hasafs, kafs, AC_DEFINE(USE_AFS, 1,
+                        [Define this if you want to use libkafs' AFS support]))
+        fi
        ]
 )
@@ -2838,7 +3128,8 @@ if test -z "$xauth_path" ; then
        XAUTH_PATH="undefined"
        AC_SUBST(XAUTH_PATH)
 else
-        AC_DEFINE_UNQUOTED(XAUTH_PATH, "$xauth_path")
+        AC_DEFINE_UNQUOTED(XAUTH_PATH, "$xauth_path",
+                [Define if xauth is found in your path])
        XAUTH_PATH=$xauth_path
        AC_SUBST(XAUTH_PATH)
 fi
@@ -2846,7 +3137,8 @@ fi
 # Check for mail directory (last resort if we cannot get it from headers)
 if test ! -z "$MAIL" ; then
        maildir=`dirname $MAIL`
-        AC_DEFINE_UNQUOTED(MAIL_DIRECTORY, "$maildir")
+        AC_DEFINE_UNQUOTED(MAIL_DIRECTORY, "$maildir",
+                [Set this to your mail directory if you don't have maillock.h])
 fi
 if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes"; then
@@ -2857,7 +3149,8 @@ if test -z "$no_dev_ptmx" ; then
        if test "x$disable_ptmx_check" != "xyes" ; then
                AC_CHECK_FILE("/dev/ptmx",
                        [
-                                AC_DEFINE_UNQUOTED(HAVE_DEV_PTMX)
+                                AC_DEFINE_UNQUOTED(HAVE_DEV_PTMX, 1,
+                                        [Define if you have /dev/ptmx])
                                have_dev_ptmx=1
                        ]
                )
@@ -2867,7 +3160,8 @@ fi
 if test ! -z "$cross_compiling" && test "x$cross_compiling" != "xyes"; then
        AC_CHECK_FILE("/dev/ptc",
                [
-                        AC_DEFINE_UNQUOTED(HAVE_DEV_PTS_AND_PTC)
+                        AC_DEFINE_UNQUOTED(HAVE_DEV_PTS_AND_PTC, 1,
+                                [Define if you have /dev/ptc])
                        have_dev_ptc=1
                ]
        )
@@ -2914,7 +3208,8 @@ AC_ARG_WITH(md5-passwords,
        [  --with-md5-passwords    Enable use of MD5 passwords],
        [
                if test "x$withval" != "xno" ; then
-                        AC_DEFINE(HAVE_MD5_PASSWORDS)
+                        AC_DEFINE(HAVE_MD5_PASSWORDS, 1,
+                                [Define if you want to allow MD5 passwords])
                        MD5_MSG="yes"
                fi
        ]
@@ -2944,7 +3239,8 @@ if test -z "$disable_shadow" ; then
        if test "x$sp_expire_available" = "xyes" ; then
                AC_MSG_RESULT(yes)
-                AC_DEFINE(HAS_SHADOW_EXPIRE)
+                AC_DEFINE(HAS_SHADOW_EXPIRE, 1,
+                    [Define if you want to use shadow password expire field])
        else
                AC_MSG_RESULT(no)
        fi
@@ -2953,7 +3249,9 @@ fi
 # Use ip address instead of hostname in $DISPLAY
 if test ! -z "$IPADDR_IN_DISPLAY" ; then
        DISPLAY_HACK_MSG="yes"
-        AC_DEFINE(IPADDR_IN_DISPLAY)
+        AC_DEFINE(IPADDR_IN_DISPLAY, 1,
+                [Define if you need to use IP address
+                instead of hostname in $DISPLAY])
 else
        DISPLAY_HACK_MSG="no"
        AC_ARG_WITH(ipaddr-display,
@@ -2976,17 +3274,21 @@ AC_ARG_ENABLE(etc-default-login,
          else
                etc_default_login=yes
          fi ],
-        [ etc_default_login=yes ]
+        [ if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes";
+          then
+                AC_MSG_WARN([cross compiling: not checking /etc/default/login])
+                etc_default_login=no
+          else
+                etc_default_login=yes
+          fi ]
 )
 if test "x$etc_default_login" != "xno"; then
        AC_CHECK_FILE("/etc/default/login",
            [ external_path_file=/etc/default/login ])
-        if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes";
+        if test "x$external_path_file" = "x/etc/default/login"; then
-        then
+                AC_DEFINE(HAVE_ETC_DEFAULT_LOGIN, 1,
-                AC_MSG_WARN([cross compiling: Disabling /etc/default/login test])
+                        [Define if your system has /etc/default/login])
-        elif test "x$external_path_file" = "x/etc/default/login"; then
-                AC_DEFINE(HAVE_ETC_DEFAULT_LOGIN)
        fi
 fi
@@ -3023,8 +3325,8 @@ $external_path_file .])
 If PATH is defined in $external_path_file, ensure the path to scp is included,
 otherwise scp will not work.])
                fi
-                AC_TRY_RUN(
+                AC_RUN_IFELSE(
-                        [
+                        [AC_LANG_SOURCE([[
 /* find out what STDPATH is */
 #include <stdio.h>
 #ifdef HAVE_PATHS_H
@@ -3056,7 +3358,8 @@ main()
        exit(0);
 }
-                ], [ user_path=`cat conftest.stdpath` ],
+                ]])],
+                [ user_path=`cat conftest.stdpath` ],
                [ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ],
                [ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ]
        )
@@ -3079,7 +3382,7 @@ main()
        fi ]
 )
 if test "x$external_path_file" != "x/etc/login.conf" ; then
-        AC_DEFINE_UNQUOTED(USER_PATH, "$user_path")
+        AC_DEFINE_UNQUOTED(USER_PATH, "$user_path", [Specify default $PATH])
        AC_SUBST(user_path)
 fi
@@ -3089,7 +3392,9 @@ AC_ARG_WITH(superuser-path,
        [
                if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
                    test "x${withval}" != "xyes"; then
-                        AC_DEFINE_UNQUOTED(SUPERUSER_PATH, "$withval")
+                        AC_DEFINE_UNQUOTED(SUPERUSER_PATH, "$withval",
+                                [Define if you want a different $PATH
+                                for the superuser])
                        superuser_path=$withval
                fi
        ]
@@ -3103,7 +3408,9 @@ AC_ARG_WITH(4in6,
        [
                if test "x$withval" != "xno" ; then
                        AC_MSG_RESULT(yes)
-                        AC_DEFINE(IPV4_IN_IPV6)
+                        AC_DEFINE(IPV4_IN_IPV6, 1,
+                                [Detect IPv4 in IPv6 mapped addresses
+                                and treat as IPv4])
                        IPV4_IN6_HACK_MSG="yes"
                else
                        AC_MSG_RESULT(no)
@@ -3125,7 +3432,8 @@ AC_ARG_WITH(bsd-auth,
        [  --with-bsd-auth         Enable BSD auth support],
        [
                if test "x$withval" != "xno" ; then
-                        AC_DEFINE(BSD_AUTH)
+                        AC_DEFINE(BSD_AUTH, 1,
+                                [Define if you have BSD auth support])
                        BSD_AUTH_MSG=yes
                fi
        ]
@@ -3154,7 +3462,7 @@ AC_ARG_WITH(pid-dir,
        ]
 )
-AC_DEFINE_UNQUOTED(_PATH_SSH_PIDDIR, "$piddir")
+AC_DEFINE_UNQUOTED(_PATH_SSH_PIDDIR, "$piddir", [Specify location of ssh.pid])
 AC_SUBST(piddir)
 dnl allow user to disable some login recording features
@@ -3178,7 +3486,8 @@ AC_ARG_ENABLE(utmpx,
        [  --disable-utmpx         disable use of utmpx even if detected [no]],
        [
                if test "x$enableval" = "xno" ; then
-                        AC_DEFINE(DISABLE_UTMPX)
+                        AC_DEFINE(DISABLE_UTMPX, 1,
+                                [Define if you don't want to use utmpx])
                fi
        ]
 )
@@ -3194,7 +3503,8 @@ AC_ARG_ENABLE(wtmpx,
        [  --disable-wtmpx         disable use of wtmpx even if detected [no]],
        [
                if test "x$enableval" = "xno" ; then
-                        AC_DEFINE(DISABLE_WTMPX)
+                        AC_DEFINE(DISABLE_WTMPX, 1,
+                                [Define if you don't want to use wtmpx])
                fi
        ]
 )
@@ -3210,7 +3520,9 @@ AC_ARG_ENABLE(pututline,
        [  --disable-pututline     disable use of pututline() etc. ([uw]tmp) [no]],
        [
                if test "x$enableval" = "xno" ; then
-                        AC_DEFINE(DISABLE_PUTUTLINE)
+                        AC_DEFINE(DISABLE_PUTUTLINE, 1,
+                                [Define if you don't want to use pututline()
+                                etc. to write [uw]tmp])
                fi
        ]
 )
@@ -3218,7 +3530,9 @@ AC_ARG_ENABLE(pututxline,
        [  --disable-pututxline    disable use of pututxline() etc. ([uw]tmpx) [no]],
        [
                if test "x$enableval" = "xno" ; then
-                        AC_DEFINE(DISABLE_PUTUTXLINE)
+                        AC_DEFINE(DISABLE_PUTUTXLINE, 1,
+                                [Define if you don't want to use pututxline()
+                                etc. to write [uw]tmpx])
                fi
        ]
 )
@@ -3293,7 +3607,8 @@ if test -z "$conf_lastlog_location"; then
 fi
 if test -n "$conf_lastlog_location"; then
-        AC_DEFINE_UNQUOTED(CONF_LASTLOG_FILE, "$conf_lastlog_location")
+        AC_DEFINE_UNQUOTED(CONF_LASTLOG_FILE, "$conf_lastlog_location",
+                [Define if you want to specify the path to your lastlog file])
 fi
 dnl utmp detection
@@ -3323,7 +3638,8 @@ if test -z "$conf_utmp_location"; then
        fi
 fi
 if test -n "$conf_utmp_location"; then
-        AC_DEFINE_UNQUOTED(CONF_UTMP_FILE, "$conf_utmp_location")
+        AC_DEFINE_UNQUOTED(CONF_UTMP_FILE, "$conf_utmp_location",
+                [Define if you want to specify the path to your utmp file])
 fi
 dnl wtmp detection
@@ -3353,7 +3669,8 @@ if test -z "$conf_wtmp_location"; then
        fi
 fi
 if test -n "$conf_wtmp_location"; then
-        AC_DEFINE_UNQUOTED(CONF_WTMP_FILE, "$conf_wtmp_location")
+        AC_DEFINE_UNQUOTED(CONF_WTMP_FILE, "$conf_wtmp_location",
+                [Define if you want to specify the path to your wtmp file])
 fi
@@ -3381,7 +3698,8 @@ if test -z "$conf_utmpx_location"; then
                AC_DEFINE(DISABLE_UTMPX)
        fi
 else
-        AC_DEFINE_UNQUOTED(CONF_UTMPX_FILE, "$conf_utmpx_location")
+        AC_DEFINE_UNQUOTED(CONF_UTMPX_FILE, "$conf_utmpx_location",
+                [Define if you want to specify the path to your utmpx file])
 fi
 dnl wtmpx detection
@@ -3406,7 +3724,8 @@ if test -z "$conf_wtmpx_location"; then
                AC_DEFINE(DISABLE_WTMPX)
        fi
 else
-        AC_DEFINE_UNQUOTED(CONF_WTMPX_FILE, "$conf_wtmpx_location")
+        AC_DEFINE_UNQUOTED(CONF_WTMPX_FILE, "$conf_wtmpx_location",
+                [Define if you want to specify the path to your wtmpx file])
 fi
diff --git a/contrib/caldera/openssh.spec b/contrib/caldera/openssh.spec
index bfde0fefc..09c08f194 100644
--- a/contrib/caldera/openssh.spec
+++ b/contrib/caldera/openssh.spec
@@ -17,7 +17,7 @@
 #old cvs stuff.  please update before use.  may be deprecated.
 %define use_stable      1
 %if %{use_stable}
-  %define version       4.2p1
+  %define version       4.3p2
  %define cvs           %{nil}
  %define release       1
 %else
@@ -357,4 +357,4 @@ fi
 * Mon Jan 01 1998 ...
 Template Version: 1.31
-$Id: openssh.spec,v 1.55 2005/09/01 09:10:49 djm Exp $
+$Id: openssh.spec,v 1.56.2.1 2006/02/11 00:00:45 djm Exp $
diff --git a/contrib/cygwin/ssh-host-config b/contrib/cygwin/ssh-host-config
index fbfb5c195..0540890e6 100644
--- a/contrib/cygwin/ssh-host-config
+++ b/contrib/cygwin/ssh-host-config
@@ -551,14 +551,14 @@ then
      [ -z "${_cygwin}" ] && _cygwin="ntsec"
      if [ $_nt2003 -gt 0 -a "${sshd_server_in_sam}" = "yes" ]
      then
-        if cygrunsrv -I sshd -d "CYGWIN sshd" -p /usr/sbin/sshd -a -D -u sshd_server -w "${_password}" -e "CYGWIN=${_cygwin}"
+        if cygrunsrv -I sshd -d "CYGWIN sshd" -p /usr/sbin/sshd -a -D -u sshd_server -w "${_password}" -e "CYGWIN=${_cygwin}" -y tcpip
        then
          echo
          echo "The service has been installed under sshd_server account."
          echo "To start the service, call \`net start sshd' or \`cygrunsrv -S sshd'."
        fi
      else
-        if cygrunsrv -I sshd -d "CYGWIN sshd" -p /usr/sbin/sshd -a -D -e "CYGWIN=${_cygwin}"
+        if cygrunsrv -I sshd -d "CYGWIN sshd" -p /usr/sbin/sshd -a -D -e "CYGWIN=${_cygwin}" -y tcpip
        then
          echo
          echo "The service has been installed under LocalSystem account."
diff --git a/contrib/cygwin/ssh-user-config b/contrib/cygwin/ssh-user-config
index fe07ce360..9482efe9e 100644
--- a/contrib/cygwin/ssh-user-config
+++ b/contrib/cygwin/ssh-user-config
@@ -198,7 +198,7 @@ fi
 if [ ! -f "${pwdhome}/.ssh/id_rsa" ]
 then
-  if request "Shall I create an SSH2 RSA identity file for you? (yes/no) "
+  if request "Shall I create an SSH2 RSA identity file for you?"
  then
    echo "Generating ${pwdhome}/.ssh/id_rsa"
    if [ "${with_passphrase}" = "yes" ]
@@ -217,7 +217,7 @@ fi
 if [ ! -f "${pwdhome}/.ssh/id_dsa" ]
 then
-  if request "Shall I create an SSH2 DSA identity file for you? (yes/no) "
+  if request "Shall I create an SSH2 DSA identity file for you?"
  then
    echo "Generating ${pwdhome}/.ssh/id_dsa"
    if [ "${with_passphrase}" = "yes" ]
diff --git a/contrib/redhat/openssh.spec b/contrib/redhat/openssh.spec
index 049b07fe4..cbdf7bbc7 100644
--- a/contrib/redhat/openssh.spec
+++ b/contrib/redhat/openssh.spec
@@ -1,4 +1,4 @@
-%define ver 4.2p1
+%define ver 4.3p2
 %define rel 1
 # OpenSSH privilege separation requires a user & group ID
diff --git a/contrib/suse/openssh.spec b/contrib/suse/openssh.spec
index 6ad862fad..b49e78c65 100644
--- a/contrib/suse/openssh.spec
+++ b/contrib/suse/openssh.spec
@@ -1,14 +1,29 @@
-Summary: OpenSSH, a free Secure Shell (SSH) protocol implementation
+# Default values for additional components
-Name: openssh
+%define build_x11_askpass       1
-Version: 4.2p1
-URL: http://www.openssh.com/
+# Define the UID/GID to use for privilege separation
-Release: 1
+%define sshd_gid        65
-Source0: openssh-%{version}.tar.gz
+%define sshd_uid        71
-Copyright: BSD
-Group: Applications/Internet
+# The version of x11-ssh-askpass to use
-BuildRoot: /tmp/openssh-%{version}-buildroot
+%define xversion        1.2.4.1
-PreReq: openssl
-Obsoletes: ssh
+# Allow the ability to override defaults with -D skip_xxx=1
+%{?skip_x11_askpass:%define build_x11_askpass 0}
+Summary:        OpenSSH, a free Secure Shell (SSH) protocol implementation
+Name:           openssh
+Version:        4.3p2
+URL:            http://www.openssh.com/
+Release:        1
+Source0:        openssh-%{version}.tar.gz
+Source1:        x11-ssh-askpass-%{xversion}.tar.gz
+License:        BSD
+Group:          Productivity/Networking/SSH
+BuildRoot:      %{_tmppath}/openssh-%{version}-buildroot
+PreReq:         openssl
+Obsoletes:      ssh
+Provides:       ssh
 #
 # (Build[ing] Prereq[uisites] only work for RPM 2.95 and newer.)
 # building prerequisites -- stuff for
@@ -16,14 +31,25 @@ Obsoletes: ssh
 #   TCP Wrappers (nkitb),
 #   and Gnome (glibdev, gtkdev, and gnlibsd)
 #
-BuildPrereq: openssl
+BuildPrereq:    openssl
-BuildPrereq: nkitb
+BuildPrereq:    nkitb
-BuildPrereq: glibdev
+#BuildPrereq:   glibdev
-BuildPrereq: gtkdev
+#BuildPrereq:   gtkdev
-BuildPrereq: gnlibsd
+#BuildPrereq:   gnlibsd
+%package        askpass
+Summary:        A passphrase dialog for OpenSSH and the X window System.
+Group:          Productivity/Networking/SSH
+Requires:       openssh = %{version}
+Obsoletes:      ssh-extras
+Provides:       openssh:${_libdir}/ssh/ssh-askpass
+%if %{build_x11_askpass}
+BuildPrereq:    XFree86-devel
+%endif
 %description
-Ssh (Secure Shell) a program for logging into a remote machine and for
+Ssh (Secure Shell) is a program for logging into a remote machine and for
 executing commands in a remote machine.  It is intended to replace
 rlogin and rsh, and provide secure encrypted communications between
 two untrusted hosts over an insecure network.  X11 connections and
@@ -34,10 +60,26 @@ up to date in terms of security and features, as well as removing all
 patented algorithms to seperate libraries (OpenSSL).
 This package includes all files necessary for both the OpenSSH
-client and server. Additionally, this package contains the GNOME
+client and server.
-passphrase dialog.
+%description askpass
+Ssh (Secure Shell) is a program for logging into a remote machine and for
+executing commands in a remote machine.  It is intended to replace
+rlogin and rsh, and provide secure encrypted communications between
+two untrusted hosts over an insecure network.  X11 connections and
+arbitrary TCP/IP ports can also be forwarded over the secure channel.
+OpenSSH is OpenBSD's rework of the last free version of SSH, bringing it
+up to date in terms of security and features, as well as removing all
+patented algorithms to seperate libraries (OpenSSL).
+This package contains an X Window System passphrase dialog for OpenSSH.
 %changelog
+* Wed Oct 26 2005 Iain Morgan <imorgan@nas.nasa.gov>
+- Removed accidental inclusion of --without-zlib-version-check
+* Tue Oct 25 2005 Iain Morgan <imorgan@nas.nasa.gov>
+- Overhaul to deal with newer versions of SuSE and OpenSSH
 * Mon Jun 12 2000 Damien Miller <djm@mindrot.org>
 - Glob manpages to catch compressed files
 * Wed Mar 15 2000 Damien Miller <djm@ibs.com.au>
@@ -84,116 +126,124 @@ passphrase dialog.
 %prep
+%if %{build_x11_askpass}
+%setup -q -a 1
+%else
 %setup -q
+%endif
 %build
 CFLAGS="$RPM_OPT_FLAGS" \
-./configure     --prefix=/usr \
+%configure      --prefix=/usr \
-                --sysconfdir=/etc/ssh \
+                --sysconfdir=%{_sysconfdir}/ssh \
-                --datadir=/usr/share/openssh \
+                --mandir=%{_mandir} \
+                --with-privsep-path=/var/lib/empty \
                --with-pam \
-                --with-gnome-askpass \
                --with-tcp-wrappers \
-                --with-ipv4-default \
+                --libexecdir=%{_libdir}/ssh
-                --libexecdir=/usr/lib/ssh
 make
-cd contrib
+%if %{build_x11_askpass}
-gcc -O -g `gnome-config --cflags gnome gnomeui` \
+cd x11-ssh-askpass-%{xversion}
-        gnome-ssh-askpass.c -o gnome-ssh-askpass \
+%configure      --mandir=/usr/X11R6/man \
-        `gnome-config --libs gnome gnomeui`
+                --libexecdir=%{_libdir}/ssh
+xmkmf -a
+make
 cd ..
+%endif
 %install
 rm -rf $RPM_BUILD_ROOT
 make install DESTDIR=$RPM_BUILD_ROOT/
-install -d $RPM_BUILD_ROOT/etc/ssh/
 install -d $RPM_BUILD_ROOT/etc/pam.d/
-install -d $RPM_BUILD_ROOT/sbin/init.d/
+install -d $RPM_BUILD_ROOT/etc/init.d/
 install -d $RPM_BUILD_ROOT/var/adm/fillup-templates
-install -d $RPM_BUILD_ROOT/usr/lib/ssh
 install -m644 contrib/sshd.pam.generic $RPM_BUILD_ROOT/etc/pam.d/sshd
-install -m744 contrib/suse/rc.sshd $RPM_BUILD_ROOT/sbin/init.d/sshd
+install -m744 contrib/suse/rc.sshd $RPM_BUILD_ROOT/etc/init.d/sshd
-ln -s ../../sbin/init.d/sshd $RPM_BUILD_ROOT/usr/sbin/rcsshd
+install -m744 contrib/suse/sysconfig.ssh \
-install -s contrib/gnome-ssh-askpass $RPM_BUILD_ROOT/usr/lib/ssh/gnome-ssh-askpass
-ln -s gnome-ssh-askpass $RPM_BUILD_ROOT/usr/lib/ssh/ssh-askpass
-install -m744 contrib/suse/rc.config.sshd \
   $RPM_BUILD_ROOT/var/adm/fillup-templates
+%if %{build_x11_askpass}
+cd x11-ssh-askpass-%{xversion}
+make install install.man BINDIR=%{_libdir}/ssh DESTDIR=$RPM_BUILD_ROOT/
+rm -f $RPM_BUILD_ROOT/usr/share/Ssh.bin
+%endif
 %clean
 rm -rf $RPM_BUILD_ROOT
+%pre
+/usr/sbin/groupadd -g %{sshd_gid} -o -r sshd 2> /dev/null || :
+/usr/sbin/useradd -r -o -g sshd -u %{sshd_uid} -s /bin/false -c "SSH Privilege Separation User" -d /var/lib/sshd sshd 2> /dev/null || :
 %post
-if [ "$1" = 1 ]; then
-  echo "Creating SSH stop/start scripts in the rc directories..."
-  ln -s ../sshd /sbin/init.d/rc2.d/K20sshd
-  ln -s ../sshd /sbin/init.d/rc2.d/S20sshd
-  ln -s ../sshd /sbin/init.d/rc3.d/K20sshd
-  ln -s ../sshd /sbin/init.d/rc3.d/S20sshd
-fi
-echo "Updating /etc/rc.config..."
-if [ -x /bin/fillup ] ; then
-  /bin/fillup -q -d = etc/rc.config var/adm/fillup-templates/rc.config.sshd
-else
-  echo "ERROR: fillup not found.  This should NOT happen in SuSE Linux."
-  echo "Update /etc/rc.config by hand from the following template file:"
-  echo "  /var/adm/fillup-templates/rc.config.sshd"
-fi
 if [ ! -f /etc/ssh/ssh_host_key -o ! -s /etc/ssh/ssh_host_key ]; then
-        echo "Generating SSH host key..."
+        echo "Generating SSH RSA host key..."
-        /usr/bin/ssh-keygen -b 1024 -f /etc/ssh/ssh_host_key -N '' >&2
+        /usr/bin/ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key -N '' >&2
 fi
 if [ ! -f /etc/ssh/ssh_host_dsa_key -o ! -s /etc/ssh/ssh_host_dsa_key ]; then
        echo "Generating SSH DSA host key..."
-        /usr/bin/ssh-keygen -d -f /etc/ssh/ssh_host_dsa_key -N '' >&2
+        /usr/bin/ssh-keygen -t dsa -f /etc/ssh/ssh_host_dsa_key -N '' >&2
-fi
-if test -r /var/run/sshd.pid
-then
-        echo "Restarting the running SSH daemon..."
-        /usr/sbin/rcsshd restart >&2
 fi
+%{fillup_and_insserv -n -s -y ssh sshd START_SSHD}
+%run_permissions
+%verifyscript
+%verify_permissions -e /etc/ssh/sshd_config -e /etc/ssh/ssh_config -e /usr/bin/ssh
 %preun
-if [ "$1" = 0 ]
+%stop_on_removal sshd
-then
-        echo "Stopping the SSH daemon..."
+%postun
-        /usr/sbin/rcsshd stop >&2
+%restart_on_update sshd
-        echo "Removing SSH stop/start scripts from the rc directories..."
+%{insserv_cleanup}
-        rm /sbin/init.d/rc2.d/K20sshd
-        rm /sbin/init.d/rc2.d/S20sshd
-        rm /sbin/init.d/rc3.d/K20sshd
-        rm /sbin/init.d/rc3.d/S20sshd
-fi
 %files
 %defattr(-,root,root)
 %doc ChangeLog OVERVIEW README*
 %doc RFC.nroff TODO CREDITS LICENCE
-%attr(0755,root,root) %dir /etc/ssh
+%attr(0755,root,root) %dir %{_sysconfdir}/ssh
-%attr(0644,root,root) %config /etc/ssh/ssh_config
+%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ssh/ssh_config
-%attr(0600,root,root) %config /etc/ssh/sshd_config
+%attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/sshd_config
-%attr(0600,root,root) %config /etc/ssh/moduli
+%attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/moduli
-%attr(0644,root,root) %config /etc/pam.d/sshd
+%attr(0644,root,root) %config(noreplace) /etc/pam.d/sshd
-%attr(0755,root,root) %config /sbin/init.d/sshd
+%attr(0755,root,root) %config /etc/init.d/sshd
-%attr(0755,root,root) /usr/bin/ssh-keygen
+%attr(0755,root,root) %{_bindir}/ssh-keygen
-%attr(0755,root,root) /usr/bin/scp
+%attr(0755,root,root) %{_bindir}/scp
-%attr(4755,root,root) /usr/bin/ssh
+%attr(0755,root,root) %{_bindir}/ssh
-%attr(-,root,root) /usr/bin/slogin
+%attr(-,root,root) %{_bindir}/slogin
-%attr(0755,root,root) /usr/bin/ssh-agent
+%attr(0755,root,root) %{_bindir}/ssh-agent
-%attr(0755,root,root) /usr/bin/ssh-add
+%attr(0755,root,root) %{_bindir}/ssh-add
-%attr(0755,root,root) /usr/bin/ssh-keyscan
+%attr(0755,root,root) %{_bindir}/ssh-keyscan
-%attr(0755,root,root) /usr/bin/sftp
+%attr(0755,root,root) %{_bindir}/sftp
-%attr(0755,root,root) /usr/sbin/sshd
+%attr(0755,root,root) %{_sbindir}/sshd
-%attr(-,root,root) /usr/sbin/rcsshd
+%attr(0755,root,root) %dir %{_libdir}/ssh
-%attr(0755,root,root) %dir /usr/lib/ssh
+%attr(0755,root,root) %{_libdir}/ssh/sftp-server
-%attr(0755,root,root) /usr/lib/ssh/ssh-askpass
+%attr(4711,root,root) %{_libdir}/ssh/ssh-keysign
-%attr(0755,root,root) /usr/lib/ssh/gnome-ssh-askpass
+%attr(0644,root,root) %doc %{_mandir}/man1/scp.1*
-%attr(0644,root,root) %doc /usr/man/man1/scp.1*
+%attr(0644,root,root) %doc %{_mandir}/man1/sftp.1*
-%attr(0644,root,root) %doc /usr/man/man1/ssh.1*
+%attr(-,root,root) %doc %{_mandir}/man1/slogin.1*
-%attr(-,root,root) %doc /usr/man/man1/slogin.1*
+%attr(0644,root,root) %doc %{_mandir}/man1/ssh.1*
-%attr(0644,root,root) %doc /usr/man/man1/ssh-agent.1*
+%attr(0644,root,root) %doc %{_mandir}/man1/ssh-add.1*
-%attr(0644,root,root) %doc /usr/man/man1/ssh-add.1*
+%attr(0644,root,root) %doc %{_mandir}/man1/ssh-agent.1*
-%attr(0644,root,root) %doc /usr/man/man1/ssh-keygen.1*
+%attr(0644,root,root) %doc %{_mandir}/man1/ssh-keygen.1*
-%attr(0644,root,root) %doc /usr/man/man8/sshd.8*
+%attr(0644,root,root) %doc %{_mandir}/man1/ssh-keyscan.1*
-%attr(0644,root,root) /var/adm/fillup-templates/rc.config.sshd
+%attr(0644,root,root) %doc %{_mandir}/man5/ssh_config.5*
+%attr(0644,root,root) %doc %{_mandir}/man5/sshd_config.5*
+%attr(0644,root,root) %doc %{_mandir}/man8/sftp-server.8*
+%attr(0644,root,root) %doc %{_mandir}/man8/ssh-keysign.8*
+%attr(0644,root,root) %doc %{_mandir}/man8/sshd.8*
+%attr(0644,root,root) /var/adm/fillup-templates/sysconfig.ssh
+%if %{build_x11_askpass}
+%files askpass
+%defattr(-,root,root)
+%doc x11-ssh-askpass-%{xversion}/README
+%doc x11-ssh-askpass-%{xversion}/ChangeLog
+%doc x11-ssh-askpass-%{xversion}/SshAskpass*.ad
+%attr(0755,root,root) %{_libdir}/ssh/ssh-askpass
+%attr(0755,root,root) %{_libdir}/ssh/x11-ssh-askpass
+%attr(0644,root,root) %doc /usr/X11R6/man/man1/ssh-askpass.1x*
+%attr(0644,root,root) %doc /usr/X11R6/man/man1/x11-ssh-askpass.1x*
+%attr(0644,root,root) %config /usr/X11R6/lib/X11/app-defaults/SshAskpass
+%endif
diff --git a/contrib/suse/rc.sshd b/contrib/suse/rc.sshd
index f7d431ebb..573960bfa 100644
--- a/contrib/suse/rc.sshd
+++ b/contrib/suse/rc.sshd
@@ -1,80 +1,133 @@
 #! /bin/sh
-# Copyright (c) 1995-1998 SuSE GmbH Nuernberg, Germany.
+# Copyright (c) 1995-2000 SuSE GmbH Nuernberg, Germany.
 #
-# Author: Chris Saia <csaia@wtower.com>
+# Author: Jiri Smid <feedback@suse.de>
 #
-# /sbin/init.d/sshd
+# /etc/init.d/sshd
 #
 #   and symbolic its link
 #
-# /sbin/rcsshd
+# /usr/sbin/rcsshd
 #
+### BEGIN INIT INFO
+# Provides: sshd
+# Required-Start: $network $remote_fs
+# Required-Stop: $network $remote_fs
+# Default-Start: 3 5
+# Default-Stop: 0 1 2 6
+# Description: Start the sshd daemon
+### END INIT INFO
-. /etc/rc.config
+SSHD_BIN=/usr/sbin/sshd
+test -x $SSHD_BIN || exit 5
-# Determine the base and follow a runlevel link name.
+SSHD_SYSCONFIG=/etc/sysconfig/ssh
-base=${0##*/}
+test -r $SSHD_SYSCONFIG || exit 6
-link=${base#*[SK][0-9][0-9]}
+. $SSHD_SYSCONFIG
-# Force execution if not called by a runlevel directory.
+SSHD_PIDFILE=/var/run/sshd.init.pid
-test $link = $base && START_SSHD=yes
-test "$START_SSHD" = yes || exit 0
+. /etc/rc.status
+# Shell functions sourced from /etc/rc.status:
+#      rc_check         check and set local and overall rc status
+#      rc_status        check and set local and overall rc status
+#      rc_status -v     ditto but be verbose in local rc status
+#      rc_status -v -r  ditto and clear the local rc status
+#      rc_failed        set local and overall rc status to failed
+#      rc_reset         clear local rc status (overall remains)
+#      rc_exit          exit appropriate to overall rc status
+# First reset status of this service
+rc_reset
-# The echo return value for success (defined in /etc/rc.config).
-return=$rc_done
 case "$1" in
    start)
-        echo -n "Starting service sshd"
+        if ! test -f /etc/ssh/ssh_host_key ; then
+            echo Generating /etc/ssh/ssh_host_key.
+            ssh-keygen -t rsa1 -b 1024 -f /etc/ssh/ssh_host_key -N ''
+        fi
+        if ! test -f /etc/ssh/ssh_host_dsa_key ; then
+            echo Generating /etc/ssh/ssh_host_dsa_key.
+            
+            ssh-keygen -t dsa -b 1024 -f /etc/ssh/ssh_host_dsa_key -N ''
+        fi
+        if ! test -f /etc/ssh/ssh_host_rsa_key ; then
+            echo Generating /etc/ssh/ssh_host_rsa_key.
+            
+            ssh-keygen -t rsa -b 1024 -f /etc/ssh/ssh_host_rsa_key -N ''
+        fi
+        echo -n "Starting SSH daemon"
        ## Start daemon with startproc(8). If this fails
        ## the echo return value is set appropriate.
-        startproc /usr/sbin/sshd || return=$rc_failed
+        startproc -f -p $SSHD_PIDFILE /usr/sbin/sshd $SSHD_OPTS -o "PidFile=$SSHD_PIDFILE" 
-        echo -e "$return"
+        # Remember status and be verbose
+        rc_status -v
        ;;
    stop)
-        echo -n "Stopping service sshd"
+        echo -n "Shutting down SSH daemon"
        ## Stop daemon with killproc(8) and if this fails
        ## set echo the echo return value.
-        killproc -TERM /usr/sbin/sshd || return=$rc_failed
+        killproc -p $SSHD_PIDFILE -TERM /usr/sbin/sshd
-        echo -e "$return"
+        # Remember status and be verbose
+        rc_status -v
        ;;
+    try-restart)
+        ## Stop the service and if this succeeds (i.e. the 
+        ## service was running before), start it again.
+        $0 status >/dev/null &&  $0 restart
+        # Remember status and be quiet
+        rc_status
+        ;;
    restart)
-        ## If first returns OK call the second, if first or
+        ## Stop the service and regardless of whether it was
-        ## second command fails, set echo return value.
+        ## running or not, start it again.
-        $0 stop  &&  $0 start  ||  return=$rc_failed
+        $0 stop
-        ;;
+        $0 start
-    reload)
-        ## Choose ONE of the following two cases:
-        ## First possibility: A few services accepts a signal
+        # Remember status and be quiet
-        ## to reread the (changed) configuration.
+        rc_status
+        ;;
+    force-reload|reload)
+        ## Signal the daemon to reload its config. Most daemons
+        ## do this on signal 1 (SIGHUP).
        echo -n "Reload service sshd"
-        killproc -HUP /usr/sbin/sshd || return=$rc_failed
-        echo -e "$return"
+        killproc -p $SSHD_PIDFILE -HUP /usr/sbin/sshd
-        ;;
+        rc_status -v
+        ;;
    status)
-        echo -n "Checking for service sshd"
+        echo -n "Checking for service sshd "
-        ## Check status with checkproc(8), if process is running
+        ## Check status with checkproc(8), if process is running
-        ## checkproc will return with exit status 0.
+        ## checkproc will return with exit status 0.
-        checkproc /usr/sbin/sshd && echo OK || echo No process
+        # Status has a slightly different for the status command:
+        # 0 - service running
+        # 1 - service dead, but /var/run/  pid  file exists
+        # 2 - service dead, but /var/lock/ lock file exists
+        # 3 - service not running
+        checkproc -p $SSHD_PIDFILE /usr/sbin/sshd
+        rc_status -v
        ;;
    probe)
        ## Optional: Probe for the necessity of a reload,
        ## give out the argument which is required for a reload.
-        test /etc/ssh/sshd_config -nt /var/run/sshd.pid && echo reload
+        test /etc/ssh/sshd_config -nt $SSHD_PIDFILE && echo reload
        ;;
    *)
-        echo "Usage: $0 {start|stop|status|restart|reload[|probe]}"
+        echo "Usage: $0 {start|stop|status|try-restart|restart|force-reload|reload|probe}"
        exit 1
        ;;
 esac
+rc_exit
-# Inform the caller not only verbosely and set an exit status.
-test "$return" = "$rc_done" || exit 1
-exit 0
diff --git a/contrib/suse/sysconfig.ssh b/contrib/suse/sysconfig.ssh
new file mode 100644
index 000000000..c6a37e5cb
--- /dev/null
+++ b/contrib/suse/sysconfig.ssh
@@ -0,0 +1,9 @@
+## Path:        Network/Remote access/SSH
+## Description: SSH server settings
+## Type:        string
+## Default:     ""
+## ServiceRestart: sshd
+#
+# Options for sshd
+#
+SSHD_OPTS=""
diff --git a/debian/changelog b/debian/changelog
index 0d0363119..98e6ed73a 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,5 +1,45 @@
-openssh (1:4.2p1-9) UNRELEASED; urgency=low
+openssh (1:4.3p2-1) UNRELEASED; urgency=low
+  * New upstream release (closes: #361032).
+    - CVE-2006-0225: scp (as does rcp, on which it is based) invoked a
+      subshell to perform local to local, and remote to remote copy
+      operations. This subshell exposed filenames to shell expansion twice;
+      allowing a local attacker to create filenames containing shell
+      metacharacters that, if matched by a wildcard, could lead to execution
+      of attacker-specified commands with the privilege of the user running
+      scp (closes: #349645).
+    - Add support for tunneling arbitrary network packets over a connection
+      between an OpenSSH client and server via tun(4) virtual network
+      interfaces. This allows the use of OpenSSH (4.3+) to create a true VPN
+      between the client and server providing real network connectivity at
+      layer 2 or 3. This feature is experimental.
+    - Reduce default key length for new DSA keys generated by ssh-keygen
+      back to 1024 bits. DSA is not specified for longer lengths and does
+      not fully benefit from simply making keys longer. As per FIPS 186-2
+      Change Notice 1, ssh-keygen will refuse to generate a new DSA key
+      smaller or larger than 1024 bits.
+    - Fixed X forwarding failing to start when the X11 client is executed in
+      background at the time of session exit.
+    - Change ssh-keygen to generate a protocol 2 RSA key when invoked
+      without arguments (closes: #114894).
+    - Fix timing variance for valid vs. invalid accounts when attempting
+      Kerberos authentication.
+    - Ensure that ssh always returns code 255 on internal error
+      (closes: #259865).
+    - Cleanup wtmp files on SIGTERM when not using privsep.
+    - Set SO_REUSEADDR on X11 listeners to avoid problems caused by
+      lingering sockets from previous session (X11 applications can
+      sometimes not connect to 127.0.0.1:60xx) (closes:
+      https://launchpad.net/bugs/25528).
+    - Ensure that fds 0, 1 and 2 are always attached in all programs, by
+      duping /dev/null to them if necessary.
+    - Xauth list invocation had bogus "." argument.
+    - Remove internal assumptions on key exchange hash algorithm and output
+      length, preparing OpenSSH for KEX methods with alternate hashes.
+    - Ignore junk sent by a server before it sends the "SSH-" banner.
+    - Many manual page improvements.
+    - Lots of cleanups, including fixes to memory leaks on error paths and
+      possible crashes.
  * Rename KeepAlive to TCPKeepAlive in default sshd_config
    (closes: #349896).
  * debconf template translations:
diff --git a/defines.h b/defines.h
index 408b988b5..f25934176 100644
--- a/defines.h
+++ b/defines.h
@@ -25,7 +25,7 @@
 #ifndef _DEFINES_H
 #define _DEFINES_H
-/* $Id: defines.h,v 1.127 2005/08/31 16:59:49 tim Exp $ */
+/* $Id: defines.h,v 1.130 2005/12/17 11:04:09 dtucker Exp $ */
 /* Constants */
@@ -450,6 +450,10 @@ struct winsize {
 # define __sentinel__
 #endif
+#if !defined(HAVE_ATTRIBUTE__BOUNDED__) && !defined(__bounded__)
+# define __bounded__(x, y, z)
+#endif
 /* *-*-nto-qnx doesn't define this macro in the system headers */
 #ifdef MISSING_HOWMANY
 # define howmany(x,y)   (((x)+((y)-1))/(y))
@@ -688,7 +692,7 @@ struct winsize {
 # define CUSTOM_SYS_AUTH_PASSWD 1
 #endif
-#if defined(HAVE_LIBIAF)  &&  !defined(BROKEN_LIBIAF)
+#ifdef HAVE_LIBIAF
 # define CUSTOM_SYS_AUTH_PASSWD 1
 #endif
@@ -711,4 +715,12 @@ struct winsize {
 # undef HAVE_MMAP
 #endif
+/* some system headers on HP-UX define YES/NO */
+#ifdef YES
+# undef YES
+#endif
+#ifdef NO
+# undef NO
+#endif
 #endif /* _DEFINES_H */
diff --git a/dns.c b/dns.c
index 4487c1aba..a71dd9bff 100644
--- a/dns.c
+++ b/dns.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: dns.c,v 1.12 2005/06/17 02:44:32 djm Exp $    */
+/*      $OpenBSD: dns.c,v 1.16 2005/10/17 14:13:35 stevesk Exp $        */
 /*
 * Copyright (c) 2003 Wesley Griffin. All rights reserved.
@@ -25,27 +25,16 @@
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */
 #include "includes.h"
+RCSID("$OpenBSD: dns.c,v 1.16 2005/10/17 14:13:35 stevesk Exp $");
-#include <openssl/bn.h>
-#ifdef LWRES
-#include <lwres/netdb.h>
-#include <dns/result.h>
-#else /* LWRES */
 #include <netdb.h>
-#endif /* LWRES */
 #include "xmalloc.h"
 #include "key.h"
 #include "dns.h"
 #include "log.h"
-#include "uuencode.h"
-extern char *__progname;
-RCSID("$OpenBSD: dns.c,v 1.12 2005/06/17 02:44:32 djm Exp $");
-#ifndef LWRES
 static const char *errset_text[] = {
        "success",              /* 0 ERRSET_SUCCESS */
        "out of memory",        /* 1 ERRSET_NOMEMORY */
@@ -75,8 +64,6 @@ dns_result_totext(unsigned int res)
                return "unknown error";
        }
 }
-#endif /* LWRES */
 /*
 * Read SSHFP parameters from key buffer.
@@ -95,12 +82,14 @@ dns_read_key(u_int8_t *algorithm, u_int8_t *digest_type,
                *algorithm = SSHFP_KEY_DSA;
                break;
        default:
-                *algorithm = SSHFP_KEY_RESERVED;
+                *algorithm = SSHFP_KEY_RESERVED; /* 0 */
        }
        if (*algorithm) {
                *digest_type = SSHFP_HASH_SHA1;
                *digest = key_fingerprint_raw(key, SSH_FP_SHA1, digest_len);
+                if (*digest == NULL)
+                        fatal("dns_read_key: null from key_fingerprint_raw()");
                success = 1;
        } else {
                *digest_type = SSHFP_HASH_RESERVED;
@@ -133,7 +122,7 @@ dns_read_rdata(u_int8_t *algorithm, u_int8_t *digest_type,
                        *digest = (u_char *) xmalloc(*digest_len);
                        memcpy(*digest, rdata + 2, *digest_len);
                } else {
-                        *digest = NULL;
+                        *digest = xstrdup("");
                }
                success = 1;
@@ -187,7 +176,7 @@ verify_host_key_dns(const char *hostname, struct sockaddr *address,
        *flags = 0;
-        debug3("verify_hostkey_dns");
+        debug3("verify_host_key_dns");
        if (hostkey == NULL)
                fatal("No key to look up!");
@@ -223,7 +212,7 @@ verify_host_key_dns(const char *hostname, struct sockaddr *address,
        if (fingerprints->rri_nrdatas)
                *flags |= DNS_VERIFY_FOUND;
-        for (counter = 0 ; counter < fingerprints->rri_nrdatas ; counter++)  {
+        for (counter = 0; counter < fingerprints->rri_nrdatas; counter++)  {
                /*
                 * Extract the key from the answer. Ignore any badly
                 * formatted fingerprints.
@@ -247,8 +236,10 @@ verify_host_key_dns(const char *hostname, struct sockaddr *address,
                                *flags |= DNS_VERIFY_MATCH;
                        }
                }
+                xfree(dnskey_digest);
        }
+        xfree(hostkey_digest); /* from key_fingerprint_raw() */
        freerrset(fingerprints);
        if (*flags & DNS_VERIFY_FOUND)
@@ -262,7 +253,6 @@ verify_host_key_dns(const char *hostname, struct sockaddr *address,
        return 0;
 }
 /*
 * Export the fingerprint of a key as a DNS resource record
 */
@@ -278,7 +268,7 @@ export_dns_rr(const char *hostname, const Key *key, FILE *f, int generic)
        int success = 0;
        if (dns_read_key(&rdata_pubkey_algorithm, &rdata_digest_type,
-                         &rdata_digest, &rdata_digest_len, key)) {
+            &rdata_digest, &rdata_digest_len, key)) {
                if (generic)
                        fprintf(f, "%s IN TYPE%d \\# %d %02x %02x ", hostname,
@@ -291,9 +281,10 @@ export_dns_rr(const char *hostname, const Key *key, FILE *f, int generic)
                for (i = 0; i < rdata_digest_len; i++)
                        fprintf(f, "%02x", rdata_digest[i]);
                fprintf(f, "\n");
+                xfree(rdata_digest); /* from key_fingerprint_raw() */
                success = 1;
        } else {
-                error("dns_export_rr: unsupported algorithm");
+                error("export_dns_rr: unsupported algorithm");
        }
        return success;
diff --git a/dns.h b/dns.h
index c5da22ef6..0aa1c28f2 100644
--- a/dns.h
+++ b/dns.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: dns.h,v 1.5 2003/11/12 16:39:58 jakob Exp $   */
+/*      $OpenBSD: dns.h,v 1.6 2005/10/17 14:13:35 stevesk Exp $ */
 /*
 * Copyright (c) 2003 Wesley Griffin. All rights reserved.
@@ -25,7 +25,6 @@
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */
 #include "includes.h"
 #ifndef DNS_H
@@ -49,7 +48,6 @@ enum sshfp_hashes {
 #define DNS_VERIFY_MATCH        0x00000002
 #define DNS_VERIFY_SECURE       0x00000004
 int     verify_host_key_dns(const char *, struct sockaddr *, const Key *, int *);
 int     export_dns_rr(const char *, const Key *, FILE *, int);
diff --git a/entropy.c b/entropy.c
index e48d6d3f9..b9d238200 100644
--- a/entropy.c
+++ b/entropy.c
@@ -26,6 +26,7 @@
 #include <openssl/rand.h>
 #include <openssl/crypto.h>
+#include <openssl/err.h>
 #include "ssh.h"
 #include "misc.h"
@@ -33,6 +34,8 @@
 #include "atomicio.h"
 #include "pathnames.h"
 #include "log.h"
+#include "buffer.h"
+#include "bufaux.h"
 /*
 * Portable OpenSSH PRNG seeding:
@@ -45,7 +48,7 @@
 * XXX: we should tell the child how many bytes we need.
 */
-RCSID("$Id: entropy.c,v 1.49 2005/07/17 07:26:44 djm Exp $");
+RCSID("$Id: entropy.c,v 1.52 2005/09/27 22:26:30 dtucker Exp $");
 #ifndef OPENSSL_PRNG_ONLY
 #define RANDOM_SEED_SIZE 48
@@ -148,10 +151,35 @@ init_rng(void)
 #endif
 #ifndef OPENSSL_PRNG_ONLY
-        if ((original_uid = getuid()) == -1)
+        original_uid = getuid();
-                fatal("getuid: %s", strerror(errno));
+        original_euid = geteuid();
-        if ((original_euid = geteuid()) == -1)
-                fatal("geteuid: %s", strerror(errno));
 #endif
 }
+#ifndef OPENSSL_PRNG_ONLY
+void
+rexec_send_rng_seed(Buffer *m)
+{
+        u_char buf[RANDOM_SEED_SIZE];
+        if (RAND_bytes(buf, sizeof(buf)) <= 0) {
+                error("Couldn't obtain random bytes (error %ld)",
+                    ERR_get_error());
+                buffer_put_string(m, "", 0);
+        } else 
+                buffer_put_string(m, buf, sizeof(buf));
+}
+void
+rexec_recv_rng_seed(Buffer *m)
+{
+        u_char *buf;
+        u_int len;
+        buf = buffer_get_string_ret(m, &len);
+        if (buf != NULL) {
+                debug3("rexec_recv_rng_seed: seeding rng with %u bytes", len);
+                RAND_add(buf, len, len);
+        }
+}
+#endif
diff --git a/entropy.h b/entropy.h
index 5f63c1f1f..ec1ebcc57 100644
--- a/entropy.h
+++ b/entropy.h
@@ -22,12 +22,17 @@
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */
-/* $Id: entropy.h,v 1.4 2001/02/09 01:55:36 djm Exp $ */
+/* $Id: entropy.h,v 1.5 2005/09/27 12:46:32 dtucker Exp $ */
 #ifndef _RANDOMS_H
 #define _RANDOMS_H
+#include "buffer.h"
 void seed_rng(void);
 void init_rng(void);
+void rexec_send_rng_seed(Buffer *);
+void rexec_recv_rng_seed(Buffer *);
 #endif /* _RANDOMS_H */
diff --git a/envpass.sh b/envpass.sh
deleted file mode 100644
index 67044d421..000000000
--- a/envpass.sh
+++ /dev/null
@@ -1,44 +0,0 @@
-#       $OpenBSD: envpass.sh,v 1.1 2004/04/27 09:47:30 djm Exp $
-#       Placed in the Public Domain.
-tid="environment passing"
-# NB accepted env vars are in test-exec.sh (_XXX_TEST_* and _XXX_TEST)
-trace "pass env, don't accept"
-verbose "test $tid: pass env, don't accept"
-_TEST_ENV=blah ${SSH} -oSendEnv="*" -F $OBJ/ssh_proxy otherhost \
-        '[ -z "$_TEST_ENV" ]'
-r=$?
-if [ $r -ne 0 ]; then
-        fail "environment found"
-fi
-trace "don't pass env, accept"
-verbose "test $tid: don't pass env, accept"
-${SSH} -F $OBJ/ssh_proxy otherhost \
-        '[ -z "$_XXX_TEST_A" -a -z "$_XXX_TEST_B" ]'
-r=$?
-if [ $r -ne 0 ]; then
-        fail "environment found"
-fi
-trace "pass single env, accept single env"
-verbose "test $tid: pass single env, accept single env"
-_XXX_TEST=blah ${SSH} -oSendEnv="_XXX_TEST" -F $OBJ/ssh_proxy otherhost \
-        '[ "x$_XXX_TEST" = "xblah" ]'
-r=$?
-if [ $r -ne 0 ]; then
-        fail "environment not found"
-fi
-trace "pass multiple env, accept multiple env"
-verbose "test $tid: pass multiple env, accept multiple env"
-_XXX_TEST_A=1 _XXX_TEST_B=2 ${SSH} -oSendEnv="_XXX_TEST_*" \
-    -F $OBJ/ssh_proxy otherhost \
-        '[ "x$_XXX_TEST_A" = "x1" -a "x$_XXX_TEST_B" = "x2" ]'
-r=$?
-if [ $r -ne 0 ]; then
-        fail "environment not found"
-fi
diff --git a/gss-genr.c b/gss-genr.c
index aad30dd0b..2a905f5e9 100644
--- a/gss-genr.c
+++ b/gss-genr.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: gss-genr.c,v 1.4 2005/07/17 07:17:55 djm Exp $        */
+/*      $OpenBSD: gss-genr.c,v 1.6 2005/10/13 22:24:31 stevesk Exp $    */
 /*
 * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
@@ -30,9 +30,7 @@
 #include "xmalloc.h"
 #include "bufaux.h"
-#include "compat.h"
 #include "log.h"
-#include "monitor_wrap.h"
 #include "ssh2.h"
 #include <openssl/evp.h>
@@ -411,7 +409,8 @@ ssh_gssapi_buildmic(Buffer *b, const char *user, const char *service,
 }
 OM_uint32
-ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID oid) {
+ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID oid)
+{
        if (*ctx)
                ssh_gssapi_delete_ctx(ctx);
        ssh_gssapi_build_ctx(ctx);
diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
index 5033ffb25..5a9b2cdd3 100644
--- a/gss-serv-krb5.c
+++ b/gss-serv-krb5.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: gss-serv-krb5.c,v 1.3 2004/07/21 10:36:23 djm Exp $   */
+/*      $OpenBSD: gss-serv-krb5.c,v 1.4 2005/10/13 19:08:08 stevesk Exp $       */
 /*
 * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
diff --git a/gss-serv.c b/gss-serv.c
index 05ae54e97..9682fc3c3 100644
--- a/gss-serv.c
+++ b/gss-serv.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: gss-serv.c,v 1.8 2005/08/30 22:08:05 djm Exp $        */
+/*      $OpenBSD: gss-serv.c,v 1.13 2005/10/13 22:24:31 stevesk Exp $   */
 /*
 * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
@@ -29,20 +29,16 @@
 #ifdef GSSAPI
 #include "bufaux.h"
-#include "compat.h"
 #include "auth.h"
 #include "log.h"
 #include "channels.h"
 #include "session.h"
 #include "servconf.h"
-#include "monitor_wrap.h"
 #include "xmalloc.h"
 #include "getput.h"
 #include "ssh-gss.h"
-extern ServerOptions options;
 static ssh_gssapi_client gssapi_client =
    { GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER,
    GSS_C_NO_CREDENTIAL, NULL, {NULL, NULL, NULL}};
@@ -61,7 +57,7 @@ ssh_gssapi_mech* supported_mechs[]= {
        &gssapi_null_mech,
 };
-/* Unpriviledged */
+/* Unprivileged */
 char *
 ssh_gssapi_server_mechanisms() {
        gss_OID_set     supported;
@@ -71,7 +67,7 @@ ssh_gssapi_server_mechanisms() {
            NULL));
 }
-/* Unpriviledged */
+/* Unprivileged */
 int
 ssh_gssapi_server_check_mech(gss_OID oid, void *data) {
        Gssctxt * ctx = NULL;
@@ -83,7 +79,7 @@ ssh_gssapi_server_check_mech(gss_OID oid, void *data) {
        return (res);
 }
-/* Unpriviledged */
+/* Unprivileged */
 void
 ssh_gssapi_supported_oids(gss_OID_set *oidset)
 {
@@ -112,7 +108,7 @@ ssh_gssapi_supported_oids(gss_OID_set *oidset)
 *    oid
 *    credentials       (from ssh_gssapi_acquire_cred)
 */
-/* Priviledged */
+/* Privileged */
 OM_uint32
 ssh_gssapi_accept_ctx(Gssctxt *ctx, gss_buffer_desc *recv_tok,
    gss_buffer_desc *send_tok, OM_uint32 *flags)
@@ -160,14 +156,14 @@ ssh_gssapi_parse_ename(Gssctxt *ctx, gss_buffer_t ename, gss_buffer_t name)
        OM_uint32 offset;
        OM_uint32 oidl;
-        tok=ename->value;
+        tok = ename->value;
        /*
         * Check that ename is long enough for all of the fixed length
         * header, and that the initial ID bytes are correct
         */
-        if (ename->length<6 || memcmp(tok,"\x04\x01", 2)!=0)
+        if (ename->length < 6 || memcmp(tok, "\x04\x01", 2) != 0)
                return GSS_S_FAILURE;
        /*
@@ -186,7 +182,7 @@ ssh_gssapi_parse_ename(Gssctxt *ctx, gss_buffer_t ename, gss_buffer_t name)
         */
        if (tok[4] != 0x06 || tok[5] != oidl ||
            ename->length < oidl+6 ||
-            !ssh_gssapi_check_oid(ctx,tok+6,oidl))
+            !ssh_gssapi_check_oid(ctx, tok+6, oidl))
                return GSS_S_FAILURE;
        offset = oidl+6;
@@ -201,7 +197,7 @@ ssh_gssapi_parse_ename(Gssctxt *ctx, gss_buffer_t ename, gss_buffer_t name)
                return GSS_S_FAILURE;
        name->value = xmalloc(name->length+1);
-        memcpy(name->value,tok+offset,name->length);
+        memcpy(name->value, tok+offset,name->length);
        ((char *)name->value)[name->length] = 0;
        return GSS_S_COMPLETE;
@@ -210,7 +206,7 @@ ssh_gssapi_parse_ename(Gssctxt *ctx, gss_buffer_t ename, gss_buffer_t name)
 /* Extract the client details from a given context. This can only reliably
 * be called once for a context */
-/* Priviledged (called from accept_secure_ctx) */
+/* Privileged (called from accept_secure_ctx) */
 OM_uint32
 ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
 {
@@ -285,15 +281,14 @@ ssh_gssapi_do_child(char ***envp, u_int *envsizep)
        if (gssapi_client.store.envvar != NULL &&
            gssapi_client.store.envval != NULL) {
                debug("Setting %s to %s", gssapi_client.store.envvar,
-                gssapi_client.store.envval);
+                    gssapi_client.store.envval);
                child_set_env(envp, envsizep, gssapi_client.store.envvar,
                    gssapi_client.store.envval);
        }
 }
-/* Priviledged */
+/* Privileged */
 int
 ssh_gssapi_userok(char *user)
 {
@@ -320,4 +315,14 @@ ssh_gssapi_userok(char *user)
        return (0);
 }
+/* Privileged */
+OM_uint32
+ssh_gssapi_checkmic(Gssctxt *ctx, gss_buffer_t gssbuf, gss_buffer_t gssmic)
+{
+        ctx->major = gss_verify_mic(&ctx->minor, ctx->context,
+            gssbuf, gssmic, NULL);
+        return (ctx->major);
+}
 #endif
diff --git a/hostfile.c b/hostfile.c
index 63550a29d..3ed646247 100644
--- a/hostfile.c
+++ b/hostfile.c
@@ -36,7 +36,7 @@
 */
 #include "includes.h"
-RCSID("$OpenBSD: hostfile.c,v 1.35 2005/07/27 10:39:03 dtucker Exp $");
+RCSID("$OpenBSD: hostfile.c,v 1.36 2005/11/22 03:36:03 dtucker Exp $");
 #include <resolv.h>
 #include <openssl/hmac.h>
@@ -88,8 +88,8 @@ extract_salt(const char *s, u_int l, char *salt, size_t salt_len)
                return (-1);
        }
        if (ret != SHA_DIGEST_LENGTH) {
-                debug2("extract_salt: expected salt len %u, got %u",
+                debug2("extract_salt: expected salt len %d, got %d",
-                    salt_len, ret);
+                    SHA_DIGEST_LENGTH, ret);
                return (-1);
        }
diff --git a/includes.h b/includes.h
index fa65aa38d..520817400 100644
--- a/includes.h
+++ b/includes.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: includes.h,v 1.19 2005/05/19 02:42:26 djm Exp $       */
+/*      $OpenBSD: includes.h,v 1.22 2006/01/01 08:59:27 stevesk Exp $   */
 /*
 * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -21,6 +21,8 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "\100(#)" msg }
 #include "config.h"
+#define _GNU_SOURCE /* activate extra prototypes for glibc */
 #include <stdarg.h>
 #include <stdio.h>
 #include <ctype.h>
@@ -67,7 +69,6 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "\100(#)" msg }
 #ifdef HAVE_NEXT
 #  include <libc.h>
 #endif
-#define __USE_GNU /* before unistd.h, activate extra prototypes for glibc */
 #include <unistd.h> /* For STDIN_FILENO, etc */
 #include <termios.h> /* Struct winsize */
diff --git a/kex.c b/kex.c
index e7147ae74..e0b9d5872 100644
--- a/kex.c
+++ b/kex.c
@@ -23,7 +23,7 @@
 */
 #include "includes.h"
-RCSID("$OpenBSD: kex.c,v 1.64 2005/07/25 11:59:39 markus Exp $");
+RCSID("$OpenBSD: kex.c,v 1.65 2005/11/04 05:15:59 djm Exp $");
 #include <openssl/crypto.h>
@@ -298,18 +298,23 @@ choose_kex(Kex *k, char *client, char *server)
                fatal("no kex alg");
        if (strcmp(k->name, KEX_DH1) == 0) {
                k->kex_type = KEX_DH_GRP1_SHA1;
+                k->evp_md = EVP_sha1();
        } else if (strcmp(k->name, KEX_DH14) == 0) {
                k->kex_type = KEX_DH_GRP14_SHA1;
-        } else if (strcmp(k->name, KEX_DHGEX) == 0) {
+                k->evp_md = EVP_sha1();
+        } else if (strcmp(k->name, KEX_DHGEX_SHA1) == 0) {
                k->kex_type = KEX_DH_GEX_SHA1;
+                k->evp_md = EVP_sha1();
 #ifdef GSSAPI
        } else if (strncmp(k->name, KEX_GSS_SHA1, 
            sizeof(KEX_GSS_SHA1)-1) == 0) {
                k->kex_type = KEX_GSS_GRP1_SHA1;
+                k->evp_md = EVP_sha1();
 #endif
        } else
                fatal("bad kex alg %s", k->name);
 }
 static void
 choose_hostkeyalg(Kex *k, char *client, char *server)
 {
@@ -413,28 +418,28 @@ kex_choose_conf(Kex *kex)
 }
 static u_char *
-derive_key(Kex *kex, int id, u_int need, u_char *hash, BIGNUM *shared_secret)
+derive_key(Kex *kex, int id, u_int need, u_char *hash, u_int hashlen,
+    BIGNUM *shared_secret)
 {
        Buffer b;
-        const EVP_MD *evp_md = EVP_sha1();
        EVP_MD_CTX md;
        char c = id;
        u_int have;
-        int mdsz = EVP_MD_size(evp_md);
+        int mdsz;
        u_char *digest;
-        if (mdsz < 0)
+        if ((mdsz = EVP_MD_size(kex->evp_md)) <= 0)
-                fatal("derive_key: mdsz < 0");
+                fatal("bad kex md size %d", mdsz);
-        digest = xmalloc(roundup(need, mdsz));
+        digest = xmalloc(roundup(need, mdsz));
        buffer_init(&b);
        buffer_put_bignum2(&b, shared_secret);
        /* K1 = HASH(K || H || "A" || session_id) */
-        EVP_DigestInit(&md, evp_md);
+        EVP_DigestInit(&md, kex->evp_md);
        if (!(datafellows & SSH_BUG_DERIVEKEY))
                EVP_DigestUpdate(&md, buffer_ptr(&b), buffer_len(&b));
-        EVP_DigestUpdate(&md, hash, mdsz);
+        EVP_DigestUpdate(&md, hash, hashlen);
        EVP_DigestUpdate(&md, &c, 1);
        EVP_DigestUpdate(&md, kex->session_id, kex->session_id_len);
        EVP_DigestFinal(&md, digest, NULL);
@@ -445,10 +450,10 @@ derive_key(Kex *kex, int id, u_int need, u_char *hash, BIGNUM *shared_secret)
         * Key = K1 || K2 || ... || Kn
         */
        for (have = mdsz; need > have; have += mdsz) {
-                EVP_DigestInit(&md, evp_md);
+                EVP_DigestInit(&md, kex->evp_md);
                if (!(datafellows & SSH_BUG_DERIVEKEY))
                        EVP_DigestUpdate(&md, buffer_ptr(&b), buffer_len(&b));
-                EVP_DigestUpdate(&md, hash, mdsz);
+                EVP_DigestUpdate(&md, hash, hashlen);
                EVP_DigestUpdate(&md, digest, have);
                EVP_DigestFinal(&md, digest + have, NULL);
        }
@@ -464,13 +469,15 @@ Newkeys *current_keys[MODE_MAX];
 #define NKEYS   6
 void
-kex_derive_keys(Kex *kex, u_char *hash, BIGNUM *shared_secret)
+kex_derive_keys(Kex *kex, u_char *hash, u_int hashlen, BIGNUM *shared_secret)
 {
        u_char *keys[NKEYS];
        u_int i, mode, ctos;
-        for (i = 0; i < NKEYS; i++)
+        for (i = 0; i < NKEYS; i++) {
-                keys[i] = derive_key(kex, 'A'+i, kex->we_need, hash, shared_secret);
+                keys[i] = derive_key(kex, 'A'+i, kex->we_need, hash, hashlen,
+                    shared_secret);
+        }
        debug2("kex_derive_keys");
        for (mode = 0; mode < MODE_MAX; mode++) {
diff --git a/kex.h b/kex.h
index 25720dff8..370e3e873 100644
--- a/kex.h
+++ b/kex.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: kex.h,v 1.37 2005/07/25 11:59:39 markus Exp $ */
+/*      $OpenBSD: kex.h,v 1.38 2005/11/04 05:15:59 djm Exp $    */
 /*
 * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
@@ -31,9 +31,9 @@
 #include "cipher.h"
 #include "key.h"
-#define KEX_DH1         "diffie-hellman-group1-sha1"
+#define KEX_DH1                 "diffie-hellman-group1-sha1"
-#define KEX_DH14        "diffie-hellman-group14-sha1"
+#define KEX_DH14                "diffie-hellman-group14-sha1"
-#define KEX_DHGEX       "diffie-hellman-group-exchange-sha1"
+#define KEX_DHGEX_SHA1          "diffie-hellman-group-exchange-sha1"
 #define COMP_NONE       0
 #define COMP_ZLIB       1
@@ -115,6 +115,7 @@ struct Kex {
        Buffer  peer;
        int     done;
        int     flags;
+        const EVP_MD *evp_md;
 #ifdef GSSAPI
        int     gss_deleg_creds;
 #endif
@@ -131,7 +132,7 @@ void	 kex_finish(Kex *);
 void     kex_send_kexinit(Kex *);
 void     kex_input_kexinit(int, u_int32_t, void *);
-void     kex_derive_keys(Kex *, u_char *, BIGNUM *);
+void     kex_derive_keys(Kex *, u_char *, u_int, BIGNUM *);
 Newkeys *kex_get_newkeys(int);
@@ -145,12 +146,13 @@ void	kexgss_client(Kex *);
 void    kexgss_server(Kex *);
 #endif
-u_char *
+void
 kex_dh_hash(char *, char *, char *, int, char *, int, u_char *, int,
-    BIGNUM *, BIGNUM *, BIGNUM *);
+    BIGNUM *, BIGNUM *, BIGNUM *, u_char **, u_int *);
-u_char *
+void
-kexgex_hash(char *, char *, char *, int, char *, int, u_char *, int,
+kexgex_hash(const EVP_MD *, char *, char *, char *, int, char *,
-    int, int, int, BIGNUM *, BIGNUM *, BIGNUM *, BIGNUM *, BIGNUM *);
+    int, u_char *, int, int, int, int, BIGNUM *, BIGNUM *, BIGNUM *, 
+    BIGNUM *, BIGNUM *, u_char **, u_int *);
 void
 derive_ssh1_session_id(BIGNUM *, BIGNUM *, u_int8_t[8], u_int8_t[16]);
diff --git a/kexdh.c b/kexdh.c
index 4bbb7d1db..f79d8781d 100644
--- a/kexdh.c
+++ b/kexdh.c
@@ -23,7 +23,7 @@
 */
 #include "includes.h"
-RCSID("$OpenBSD: kexdh.c,v 1.19 2003/02/16 17:09:57 markus Exp $");
+RCSID("$OpenBSD: kexdh.c,v 1.20 2005/11/04 05:15:59 djm Exp $");
 #include <openssl/evp.h>
@@ -32,7 +32,7 @@ RCSID("$OpenBSD: kexdh.c,v 1.19 2003/02/16 17:09:57 markus Exp $");
 #include "ssh2.h"
 #include "kex.h"
-u_char *
+void
 kex_dh_hash(
    char *client_version_string,
    char *server_version_string,
@@ -41,7 +41,8 @@ kex_dh_hash(
    u_char *serverhostkeyblob, int sbloblen,
    BIGNUM *client_dh_pub,
    BIGNUM *server_dh_pub,
-    BIGNUM *shared_secret)
+    BIGNUM *shared_secret,
+    u_char **hash, u_int *hashlen)
 {
        Buffer b;
        static u_char digest[EVP_MAX_MD_SIZE];
@@ -77,5 +78,6 @@ kex_dh_hash(
 #ifdef DEBUG_KEX
        dump_digest("hash", digest, EVP_MD_size(evp_md));
 #endif
-        return digest;
+        *hash = digest;
+        *hashlen = EVP_MD_size(evp_md);
 }
diff --git a/kexdhc.c b/kexdhc.c
index f48bd4678..d8a2fa3b7 100644
--- a/kexdhc.c
+++ b/kexdhc.c
@@ -23,7 +23,7 @@
 */
 #include "includes.h"
-RCSID("$OpenBSD: kexdhc.c,v 1.2 2004/06/13 12:53:24 djm Exp $");
+RCSID("$OpenBSD: kexdhc.c,v 1.3 2005/11/04 05:15:59 djm Exp $");
 #include "xmalloc.h"
 #include "key.h"
@@ -41,7 +41,7 @@ kexdh_client(Kex *kex)
        Key *server_host_key;
        u_char *server_host_key_blob = NULL, *signature = NULL;
        u_char *kbuf, *hash;
-        u_int klen, kout, slen, sbloblen;
+        u_int klen, kout, slen, sbloblen, hashlen;
        /* generate and send 'e', client DH public key */
        switch (kex->kex_type) {
@@ -114,7 +114,7 @@ kexdh_client(Kex *kex)
        xfree(kbuf);
        /* calc and verify H */
-        hash = kex_dh_hash(
+        kex_dh_hash(
            kex->client_version_string,
            kex->server_version_string,
            buffer_ptr(&kex->my), buffer_len(&kex->my),
@@ -122,25 +122,26 @@ kexdh_client(Kex *kex)
            server_host_key_blob, sbloblen,
            dh->pub_key,
            dh_server_pub,
-            shared_secret
+            shared_secret,
+            &hash, &hashlen
        );
        xfree(server_host_key_blob);
        BN_clear_free(dh_server_pub);
        DH_free(dh);
-        if (key_verify(server_host_key, signature, slen, hash, 20) != 1)
+        if (key_verify(server_host_key, signature, slen, hash, hashlen) != 1)
                fatal("key_verify failed for server_host_key");
        key_free(server_host_key);
        xfree(signature);
        /* save session id */
        if (kex->session_id == NULL) {
-                kex->session_id_len = 20;
+                kex->session_id_len = hashlen;
                kex->session_id = xmalloc(kex->session_id_len);
                memcpy(kex->session_id, hash, kex->session_id_len);
        }
-        kex_derive_keys(kex, hash, shared_secret);
+        kex_derive_keys(kex, hash, hashlen, shared_secret);
        BN_clear_free(shared_secret);
        kex_finish(kex);
 }
diff --git a/kexdhs.c b/kexdhs.c
index 225e65592..26c8cdfd6 100644
--- a/kexdhs.c
+++ b/kexdhs.c
@@ -23,7 +23,7 @@
 */
 #include "includes.h"
-RCSID("$OpenBSD: kexdhs.c,v 1.2 2004/06/13 12:53:24 djm Exp $");
+RCSID("$OpenBSD: kexdhs.c,v 1.3 2005/11/04 05:15:59 djm Exp $");
 #include "xmalloc.h"
 #include "key.h"
@@ -41,7 +41,7 @@ kexdh_server(Kex *kex)
        DH *dh;
        Key *server_host_key;
        u_char *kbuf, *hash, *signature = NULL, *server_host_key_blob = NULL;
-        u_int sbloblen, klen, kout;
+        u_int sbloblen, klen, kout, hashlen;
        u_int slen;
        /* generate server DH public key */
@@ -103,7 +103,7 @@ kexdh_server(Kex *kex)
        key_to_blob(server_host_key, &server_host_key_blob, &sbloblen);
        /* calc H */
-        hash = kex_dh_hash(
+        kex_dh_hash(
            kex->client_version_string,
            kex->server_version_string,
            buffer_ptr(&kex->peer), buffer_len(&kex->peer),
@@ -111,21 +111,20 @@ kexdh_server(Kex *kex)
            server_host_key_blob, sbloblen,
            dh_client_pub,
            dh->pub_key,
-            shared_secret
+            shared_secret,
+            &hash, &hashlen
        );
        BN_clear_free(dh_client_pub);
        /* save session id := H */
-        /* XXX hashlen depends on KEX */
        if (kex->session_id == NULL) {
-                kex->session_id_len = 20;
+                kex->session_id_len = hashlen;
                kex->session_id = xmalloc(kex->session_id_len);
                memcpy(kex->session_id, hash, kex->session_id_len);
        }
        /* sign H */
-        /* XXX hashlen depends on KEX */
+        PRIVSEP(key_sign(server_host_key, &signature, &slen, hash, hashlen));
-        PRIVSEP(key_sign(server_host_key, &signature, &slen, hash, 20));
        /* destroy_sensitive_data(); */
@@ -141,7 +140,7 @@ kexdh_server(Kex *kex)
        /* have keys, free DH */
        DH_free(dh);
-        kex_derive_keys(kex, hash, shared_secret);
+        kex_derive_keys(kex, hash, hashlen, shared_secret);
        BN_clear_free(shared_secret);
        kex_finish(kex);
 }
diff --git a/kexgex.c b/kexgex.c
index b0c39c8cb..705484a47 100644
--- a/kexgex.c
+++ b/kexgex.c
@@ -24,7 +24,7 @@
 */
 #include "includes.h"
-RCSID("$OpenBSD: kexgex.c,v 1.23 2003/02/16 17:09:57 markus Exp $");
+RCSID("$OpenBSD: kexgex.c,v 1.24 2005/11/04 05:15:59 djm Exp $");
 #include <openssl/evp.h>
@@ -33,8 +33,9 @@ RCSID("$OpenBSD: kexgex.c,v 1.23 2003/02/16 17:09:57 markus Exp $");
 #include "kex.h"
 #include "ssh2.h"
-u_char *
+void
 kexgex_hash(
+    const EVP_MD *evp_md,
    char *client_version_string,
    char *server_version_string,
    char *ckexinit, int ckexinitlen,
@@ -43,11 +44,11 @@ kexgex_hash(
    int min, int wantbits, int max, BIGNUM *prime, BIGNUM *gen,
    BIGNUM *client_dh_pub,
    BIGNUM *server_dh_pub,
-    BIGNUM *shared_secret)
+    BIGNUM *shared_secret,
+    u_char **hash, u_int *hashlen)
 {
        Buffer b;
        static u_char digest[EVP_MAX_MD_SIZE];
-        const EVP_MD *evp_md = EVP_sha1();
        EVP_MD_CTX md;
        buffer_init(&b);
@@ -79,14 +80,15 @@ kexgex_hash(
 #ifdef DEBUG_KEXDH
        buffer_dump(&b);
 #endif
        EVP_DigestInit(&md, evp_md);
        EVP_DigestUpdate(&md, buffer_ptr(&b), buffer_len(&b));
        EVP_DigestFinal(&md, digest, NULL);
        buffer_free(&b);
+        *hash = digest;
+        *hashlen = EVP_MD_size(evp_md);
 #ifdef DEBUG_KEXDH
-        dump_digest("hash", digest, EVP_MD_size(evp_md));
+        dump_digest("hash", digest, *hashlen);
 #endif
-        return digest;
 }
diff --git a/kexgexc.c b/kexgexc.c
index 0193183b9..a6ff8757d 100644
--- a/kexgexc.c
+++ b/kexgexc.c
@@ -24,7 +24,7 @@
 */
 #include "includes.h"
-RCSID("$OpenBSD: kexgexc.c,v 1.2 2003/12/08 11:00:47 markus Exp $");
+RCSID("$OpenBSD: kexgexc.c,v 1.3 2005/11/04 05:15:59 djm Exp $");
 #include "xmalloc.h"
 #include "key.h"
@@ -42,7 +42,7 @@ kexgex_client(Kex *kex)
        BIGNUM *p = NULL, *g = NULL;
        Key *server_host_key;
        u_char *kbuf, *hash, *signature = NULL, *server_host_key_blob = NULL;
-        u_int klen, kout, slen, sbloblen;
+        u_int klen, kout, slen, sbloblen, hashlen;
        int min, max, nbits;
        DH *dh;
@@ -155,7 +155,8 @@ kexgex_client(Kex *kex)
                min = max = -1;
        /* calc and verify H */
-        hash = kexgex_hash(
+        kexgex_hash(
+            kex->evp_md,
            kex->client_version_string,
            kex->server_version_string,
            buffer_ptr(&kex->my), buffer_len(&kex->my),
@@ -165,25 +166,27 @@ kexgex_client(Kex *kex)
            dh->p, dh->g,
            dh->pub_key,
            dh_server_pub,
-            shared_secret
+            shared_secret,
+            &hash, &hashlen
        );
        /* have keys, free DH */
        DH_free(dh);
        xfree(server_host_key_blob);
        BN_clear_free(dh_server_pub);
-        if (key_verify(server_host_key, signature, slen, hash, 20) != 1)
+        if (key_verify(server_host_key, signature, slen, hash, hashlen) != 1)
                fatal("key_verify failed for server_host_key");
        key_free(server_host_key);
        xfree(signature);
        /* save session id */
        if (kex->session_id == NULL) {
-                kex->session_id_len = 20;
+                kex->session_id_len = hashlen;
                kex->session_id = xmalloc(kex->session_id_len);
                memcpy(kex->session_id, hash, kex->session_id_len);
        }
-        kex_derive_keys(kex, hash, shared_secret);
+        kex_derive_keys(kex, hash, hashlen, shared_secret);
        BN_clear_free(shared_secret);
        kex_finish(kex);
diff --git a/kexgexs.c b/kexgexs.c
index baebfcfb0..c48b27af9 100644
--- a/kexgexs.c
+++ b/kexgexs.c
@@ -24,7 +24,7 @@
 */
 #include "includes.h"
-RCSID("$OpenBSD: kexgexs.c,v 1.1 2003/02/16 17:09:57 markus Exp $");
+RCSID("$OpenBSD: kexgexs.c,v 1.2 2005/11/04 05:15:59 djm Exp $");
 #include "xmalloc.h"
 #include "key.h"
@@ -43,7 +43,7 @@ kexgex_server(Kex *kex)
        Key *server_host_key;
        DH *dh;
        u_char *kbuf, *hash, *signature = NULL, *server_host_key_blob = NULL;
-        u_int sbloblen, klen, kout, slen;
+        u_int sbloblen, klen, kout, slen, hashlen;
        int min = -1, max = -1, nbits = -1, type;
        if (kex->load_host_key == NULL)
@@ -137,8 +137,9 @@ kexgex_server(Kex *kex)
        if (type == SSH2_MSG_KEX_DH_GEX_REQUEST_OLD)
                min = max = -1;
-        /* calc H */                    /* XXX depends on 'kex' */
+        /* calc H */
-        hash = kexgex_hash(
+        kexgex_hash(
+            kex->evp_md,
            kex->client_version_string,
            kex->server_version_string,
            buffer_ptr(&kex->peer), buffer_len(&kex->peer),
@@ -148,21 +149,20 @@ kexgex_server(Kex *kex)
            dh->p, dh->g,
            dh_client_pub,
            dh->pub_key,
-            shared_secret
+            shared_secret,
+            &hash, &hashlen
        );
        BN_clear_free(dh_client_pub);
        /* save session id := H */
-        /* XXX hashlen depends on KEX */
        if (kex->session_id == NULL) {
-                kex->session_id_len = 20;
+                kex->session_id_len = hashlen;
                kex->session_id = xmalloc(kex->session_id_len);
                memcpy(kex->session_id, hash, kex->session_id_len);
        }
        /* sign H */
-        /* XXX hashlen depends on KEX */
+        PRIVSEP(key_sign(server_host_key, &signature, &slen, hash, hashlen));
-        PRIVSEP(key_sign(server_host_key, &signature, &slen, hash, 20));
        /* destroy_sensitive_data(); */
@@ -179,7 +179,7 @@ kexgex_server(Kex *kex)
        /* have keys, free DH */
        DH_free(dh);
-        kex_derive_keys(kex, hash, shared_secret);
+        kex_derive_keys(kex, hash, hashlen, shared_secret);
        BN_clear_free(shared_secret);
        kex_finish(kex);
diff --git a/loginrec.c b/loginrec.c
index c3783c991..d096346ec 100644
--- a/loginrec.c
+++ b/loginrec.c
@@ -165,7 +165,7 @@
 # include <libutil.h>
 #endif
-RCSID("$Id: loginrec.c,v 1.70 2005/07/17 07:26:44 djm Exp $");
+RCSID("$Id: loginrec.c,v 1.71 2005/11/22 08:55:13 dtucker Exp $");
 /**
 ** prototypes for helper functions in this file
@@ -1589,7 +1589,7 @@ lastlog_get_entry(struct logininfo *li)
                return (0);
        default:
                error("%s: Error reading from %s: Expecting %d, got %d",
-                    __func__, LASTLOG_FILE, sizeof(last), ret);
+                    __func__, LASTLOG_FILE, (int)sizeof(last), ret);
                return (0);
        }
@@ -1613,7 +1613,7 @@ record_failed_login(const char *username, const char *hostname,
        int fd;
        struct utmp ut;
        struct sockaddr_storage from;
-        size_t fromlen = sizeof(from);
+        socklen_t fromlen = sizeof(from);
        struct sockaddr_in *a4;
        struct sockaddr_in6 *a6;
        time_t t;
diff --git a/misc.c b/misc.c
index 2dd8ae6e3..29e928886 100644
--- a/misc.c
+++ b/misc.c
@@ -24,7 +24,11 @@
 */
 #include "includes.h"
-RCSID("$OpenBSD: misc.c,v 1.34 2005/07/08 09:26:18 dtucker Exp $");
+RCSID("$OpenBSD: misc.c,v 1.42 2006/01/31 10:19:02 djm Exp $");
+#ifdef SSH_TUN_OPENBSD
+#include <net/if.h>
+#endif
 #include "misc.h"
 #include "log.h"
@@ -194,6 +198,37 @@ a2port(const char *s)
        return port;
 }
+int
+a2tun(const char *s, int *remote)
+{
+        const char *errstr = NULL;
+        char *sp, *ep;
+        int tun;
+        if (remote != NULL) {
+                *remote = SSH_TUNID_ANY;
+                sp = xstrdup(s);
+                if ((ep = strchr(sp, ':')) == NULL) {
+                        xfree(sp);
+                        return (a2tun(s, NULL));
+                }
+                ep[0] = '\0'; ep++;
+                *remote = a2tun(ep, NULL);
+                tun = a2tun(sp, NULL);
+                xfree(sp);
+                return (*remote == SSH_TUNID_ERR ? *remote : tun);
+        }
+        if (strcasecmp(s, "any") == 0)
+                return (SSH_TUNID_ANY);
+        tun = strtonum(s, 0, SSH_TUNID_MAX, &errstr);
+        if (errstr != NULL)
+                return (SSH_TUNID_ERR);
+        return (tun);
+}
 #define SECONDS         1
 #define MINUTES         (SECONDS * 60)
 #define HOURS           (MINUTES * 60)
@@ -356,12 +391,15 @@ void
 addargs(arglist *args, char *fmt, ...)
 {
        va_list ap;
-        char buf[1024];
+        char *cp;
        u_int nalloc;
+        int r;
        va_start(ap, fmt);
-        vsnprintf(buf, sizeof(buf), fmt, ap);
+        r = vasprintf(&cp, fmt, ap);
        va_end(ap);
+        if (r == -1)
+                fatal("addargs: argument too long");
        nalloc = args->nalloc;
        if (args->list == NULL) {
@@ -372,10 +410,44 @@ addargs(arglist *args, char *fmt, ...)
        args->list = xrealloc(args->list, nalloc * sizeof(char *));
        args->nalloc = nalloc;
-        args->list[args->num++] = xstrdup(buf);
+        args->list[args->num++] = cp;
        args->list[args->num] = NULL;
 }
+void
+replacearg(arglist *args, u_int which, char *fmt, ...)
+{
+        va_list ap;
+        char *cp;
+        int r;
+        va_start(ap, fmt);
+        r = vasprintf(&cp, fmt, ap);
+        va_end(ap);
+        if (r == -1)
+                fatal("replacearg: argument too long");
+        if (which >= args->num)
+                fatal("replacearg: tried to replace invalid arg %d >= %d",
+                    which, args->num);
+        xfree(args->list[which]);
+        args->list[which] = cp;
+}
+void
+freeargs(arglist *args)
+{
+        u_int i;
+        if (args->list != NULL) {
+                for (i = 0; i < args->num; i++)
+                        xfree(args->list[i]);
+                xfree(args->list);
+                args->nalloc = args->num = 0;
+                args->list = NULL;
+        }
+}
 /*
 * Expands tildes in the file name.  Returns data allocated by xmalloc.
 * Warning: this calls getpw*.
@@ -507,6 +579,99 @@ read_keyfile_line(FILE *f, const char *filename, char *buf, size_t bufsz,
        return -1;
 }
+int
+tun_open(int tun, int mode)
+{
+#if defined(CUSTOM_SYS_TUN_OPEN)
+        return (sys_tun_open(tun, mode));
+#elif defined(SSH_TUN_OPENBSD)
+        struct ifreq ifr;
+        char name[100];
+        int fd = -1, sock;
+        /* Open the tunnel device */
+        if (tun <= SSH_TUNID_MAX) {
+                snprintf(name, sizeof(name), "/dev/tun%d", tun);
+                fd = open(name, O_RDWR);
+        } else if (tun == SSH_TUNID_ANY) {
+                for (tun = 100; tun >= 0; tun--) {
+                        snprintf(name, sizeof(name), "/dev/tun%d", tun);
+                        if ((fd = open(name, O_RDWR)) >= 0)
+                                break;
+                }
+        } else {
+                debug("%s: invalid tunnel %u", __func__, tun);
+                return (-1);
+        }
+        if (fd < 0) {
+                debug("%s: %s open failed: %s", __func__, name, strerror(errno));
+                return (-1);
+        }
+        debug("%s: %s mode %d fd %d", __func__, name, mode, fd);
+        /* Set the tunnel device operation mode */
+        snprintf(ifr.ifr_name, sizeof(ifr.ifr_name), "tun%d", tun);
+        if ((sock = socket(PF_UNIX, SOCK_STREAM, 0)) == -1)
+                goto failed;
+        if (ioctl(sock, SIOCGIFFLAGS, &ifr) == -1)
+                goto failed;
+        /* Set interface mode */
+        ifr.ifr_flags &= ~IFF_UP;
+        if (mode == SSH_TUNMODE_ETHERNET)
+                ifr.ifr_flags |= IFF_LINK0;
+        else
+                ifr.ifr_flags &= ~IFF_LINK0;
+        if (ioctl(sock, SIOCSIFFLAGS, &ifr) == -1)
+                goto failed;
+        /* Bring interface up */
+        ifr.ifr_flags |= IFF_UP;
+        if (ioctl(sock, SIOCSIFFLAGS, &ifr) == -1)
+                goto failed;
+        close(sock);
+        return (fd);
+ failed:
+        if (fd >= 0)
+                close(fd);
+        if (sock >= 0)
+                close(sock);
+        debug("%s: failed to set %s mode %d: %s", __func__, name,
+            mode, strerror(errno));
+        return (-1);
+#else
+        error("Tunnel interfaces are not supported on this platform");
+        return (-1);
+#endif
+}
+void
+sanitise_stdfd(void)
+{
+        int nullfd, dupfd;
+        if ((nullfd = dupfd = open(_PATH_DEVNULL, O_RDWR)) == -1) {
+                fprintf(stderr, "Couldn't open /dev/null: %s", strerror(errno));
+                exit(1);
+        }
+        while (++dupfd <= 2) {
+                /* Only clobber closed fds */
+                if (fcntl(dupfd, F_GETFL, 0) >= 0)
+                        continue;
+                if (dup2(nullfd, dupfd) == -1) {
+                        fprintf(stderr, "dup2: %s", strerror(errno));
+                        exit(1);
+                }
+        }
+        if (nullfd > 2)
+                close(nullfd);
+}
 char *
 tohex(const u_char *d, u_int l)
 {
diff --git a/misc.h b/misc.h
index 2d630feb5..0a1a09a68 100644
--- a/misc.h
+++ b/misc.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: misc.h,v 1.25 2005/07/14 04:00:43 dtucker Exp $       */
+/*      $OpenBSD: misc.h,v 1.29 2006/01/31 10:19:02 djm Exp $   */
 /*
 * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -20,6 +20,7 @@ int	 set_nonblock(int);
 int      unset_nonblock(int);
 void     set_nodelay(int);
 int      a2port(const char *);
+int      a2tun(const char *, int *);
 char    *hpdelim(char **);
 char    *cleanhostname(char *);
 char    *colon(char *);
@@ -27,6 +28,7 @@ long	 convtime(const char *);
 char    *tilde_expand_filename(const char *, uid_t);
 char    *percent_expand(const char *, ...) __attribute__((__sentinel__));
 char    *tohex(const u_char *, u_int);
+void     sanitise_stdfd(void);
 struct passwd *pwcopy(struct passwd *);
@@ -36,7 +38,11 @@ struct arglist {
        u_int   num;
        u_int   nalloc;
 };
-void     addargs(arglist *, char *, ...) __attribute__((format(printf, 2, 3)));
+void     addargs(arglist *, char *, ...)
+             __attribute__((format(printf, 2, 3)));
+void     replacearg(arglist *, u_int, char *, ...)
+             __attribute__((format(printf, 3, 4)));
+void     freeargs(arglist *);
 /* readpass.c */
@@ -48,3 +54,16 @@ void	 addargs(arglist *, char *, ...) __attribute__((format(printf, 2, 3)));
 char    *read_passphrase(const char *, int);
 int      ask_permission(const char *, ...) __attribute__((format(printf, 1, 2)));
 int      read_keyfile_line(FILE *, const char *, char *, size_t, u_long *);
+int      tun_open(int, int);
+/* Common definitions for ssh tunnel device forwarding */
+#define SSH_TUNMODE_NO          0x00
+#define SSH_TUNMODE_POINTOPOINT 0x01
+#define SSH_TUNMODE_ETHERNET    0x02
+#define SSH_TUNMODE_DEFAULT     SSH_TUNMODE_POINTOPOINT
+#define SSH_TUNMODE_YES         (SSH_TUNMODE_POINTOPOINT|SSH_TUNMODE_ETHERNET)
+#define SSH_TUNID_ANY           0x7fffffff
+#define SSH_TUNID_ERR           (SSH_TUNID_ANY - 1)
+#define SSH_TUNID_MAX           (SSH_TUNID_ANY - 2)
diff --git a/monitor.c b/monitor.c
index 0d100ab56..e9693ef63 100644
--- a/monitor.c
+++ b/monitor.c
@@ -25,7 +25,7 @@
 */
 #include "includes.h"
-RCSID("$OpenBSD: monitor.c,v 1.63 2005/03/10 22:01:05 deraadt Exp $");
+RCSID("$OpenBSD: monitor.c,v 1.64 2005/10/13 22:24:31 stevesk Exp $");
 #include <openssl/dh.h>
@@ -855,9 +855,7 @@ mm_answer_pam_account(int sock, Buffer *m)
        ret = do_pam_account();
        buffer_put_int(m, ret);
-        buffer_append(&loginmsg, "\0", 1);
+        buffer_put_string(m, buffer_ptr(&loginmsg), buffer_len(&loginmsg));
-        buffer_put_cstring(m, buffer_ptr(&loginmsg));
-        buffer_clear(&loginmsg);
        mm_request_send(sock, MONITOR_ANS_PAM_ACCOUNT, m);
@@ -1855,7 +1853,7 @@ mm_answer_gss_setup_ctx(int sock, Buffer *m)
        buffer_clear(m);
        buffer_put_int(m, major);
-        mm_request_send(sock,MONITOR_ANS_GSSSETUP, m);
+        mm_request_send(sock, MONITOR_ANS_GSSSETUP, m);
        /* Now we have a context, enable the step */
        monitor_permit(mon_dispatch, MONITOR_REQ_GSSSTEP, 1);
@@ -1868,7 +1866,7 @@ mm_answer_gss_accept_ctx(int sock, Buffer *m)
 {
        gss_buffer_desc in;
        gss_buffer_desc out = GSS_C_EMPTY_BUFFER;
-        OM_uint32 major,minor;
+        OM_uint32 major, minor;
        OM_uint32 flags = 0; /* GSI needs this */
        u_int len;
@@ -1885,7 +1883,7 @@ mm_answer_gss_accept_ctx(int sock, Buffer *m)
        gss_release_buffer(&minor, &out);
-        if (major==GSS_S_COMPLETE) {
+        if (major == GSS_S_COMPLETE) {
                monitor_permit(mon_dispatch, MONITOR_REQ_GSSSTEP, 0);
                monitor_permit(mon_dispatch, MONITOR_REQ_GSSUSEROK, 1);
                monitor_permit(mon_dispatch, MONITOR_REQ_GSSCHECKMIC, 1);
@@ -1935,7 +1933,7 @@ mm_answer_gss_userok(int sock, Buffer *m)
        debug3("%s: sending result %d", __func__, authenticated);
        mm_request_send(sock, MONITOR_ANS_GSSUSEROK, m);
-        auth_method="gssapi-with-mic";
+        auth_method = "gssapi-with-mic";
        /* Monitor loop will terminate if authenticated */
        return (authenticated);
diff --git a/monitor_wrap.c b/monitor_wrap.c
index 63d158b67..23b0cbd59 100644
--- a/monitor_wrap.c
+++ b/monitor_wrap.c
@@ -72,7 +72,6 @@ extern struct monitor *pmonitor;
 extern Buffer input, output;
 extern Buffer loginmsg;
 extern ServerOptions options;
-extern Buffer loginmsg;
 int
 mm_is_monitor(void)
diff --git a/openbsd-compat/Makefile.in b/openbsd-compat/Makefile.in
index 6f5ee2845..3a8703bc1 100644
--- a/openbsd-compat/Makefile.in
+++ b/openbsd-compat/Makefile.in
@@ -1,4 +1,4 @@
-# $Id: Makefile.in,v 1.35 2005/08/26 20:15:20 tim Exp $
+# $Id: Makefile.in,v 1.37 2005/12/31 05:33:37 djm Exp $
 sysconfdir=@sysconfdir@
 piddir=@piddir@
@@ -18,9 +18,9 @@ LDFLAGS=-L. @LDFLAGS@
 OPENBSD=base64.o basename.o bindresvport.o daemon.o dirname.o getcwd.o getgrouplist.o getopt.o getrrsetbyname.o glob.o inet_aton.o inet_ntoa.o inet_ntop.o mktemp.o readpassphrase.o realpath.o rresvport.o setenv.o setproctitle.o sigact.o strlcat.o strlcpy.o strmode.o strsep.o strtonum.o strtoll.o strtoul.o vis.o
-COMPAT=bsd-arc4random.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-snprintf.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o
+COMPAT=bsd-arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-snprintf.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o
-PORTS=port-irix.o port-aix.o port-uw.o
+PORTS=port-irix.o port-aix.o port-uw.o port-tun.o
 .c.o:
        $(CC) $(CFLAGS) $(CPPFLAGS) -c $<
diff --git a/openbsd-compat/base64.c b/openbsd-compat/base64.c
index dcaa03e5d..9a60f583b 100644
--- a/openbsd-compat/base64.c
+++ b/openbsd-compat/base64.c
@@ -1,5 +1,3 @@
-/* OPENBSD ORIGINAL: lib/libc/net/base64.c */
 /*      $OpenBSD: base64.c,v 1.4 2002/01/02 23:00:10 deraadt Exp $      */
 /*
@@ -44,6 +42,8 @@
 * IF IBM IS APPRISED OF THE POSSIBILITY OF SUCH DAMAGES.
 */
+/* OPENBSD ORIGINAL: lib/libc/net/base64.c */
 #include "includes.h"
 #if (!defined(HAVE_B64_NTOP) && !defined(HAVE___B64_NTOP)) || (!defined(HAVE_B64_PTON) && !defined(HAVE___B64_PTON))
@@ -139,7 +139,7 @@ b64_ntop(u_char const *src, size_t srclength, char *target, size_t targsize)
        size_t datalength = 0;
        u_char input[3];
        u_char output[4];
-        int i;
+        u_int i;
        while (2 < srclength) {
                input[0] = *src++;
@@ -206,7 +206,8 @@ b64_ntop(u_char const *src, size_t srclength, char *target, size_t targsize)
 int
 b64_pton(char const *src, u_char *target, size_t targsize)
 {
-        int tarindex, state, ch;
+        u_int tarindex, state;
+        int ch;
        char *pos;
        state = 0;
diff --git a/openbsd-compat/basename.c b/openbsd-compat/basename.c
index 552dc1e1c..ad040e139 100644
--- a/openbsd-compat/basename.c
+++ b/openbsd-compat/basename.c
@@ -1,9 +1,7 @@
-/* OPENBSD ORIGINAL: lib/libc/gen/basename.c */
+/*      $OpenBSD: basename.c,v 1.14 2005/08/08 08:05:33 espie Exp $     */
-/*      $OpenBSD: basename.c,v 1.11 2003/06/17 21:56:23 millert Exp $   */
 /*
- * Copyright (c) 1997 Todd C. Miller <Todd.Miller@courtesan.com>
+ * Copyright (c) 1997, 2004 Todd C. Miller <Todd.Miller@courtesan.com>
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
@@ -18,34 +16,35 @@
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */
+/* OPENBSD ORIGINAL: lib/libc/gen/basename.c */
 #include "includes.h"
 #ifndef HAVE_BASENAME
-#ifndef lint
-static char rcsid[] = "$OpenBSD: basename.c,v 1.11 2003/06/17 21:56:23 millert Exp $";
-#endif /* not lint */
 char *
 basename(const char *path)
 {
        static char bname[MAXPATHLEN];
-        register const char *endp, *startp;
+        size_t len;
+        const char *endp, *startp;
        /* Empty or NULL string gets treated as "." */
        if (path == NULL || *path == '\0') {
-                (void)strlcpy(bname, ".", sizeof bname);
+                bname[0] = '.';
-                return(bname);
+                bname[1] = '\0';
+                return (bname);
        }
-        /* Strip trailing slashes */
+        /* Strip any trailing slashes */
        endp = path + strlen(path) - 1;
        while (endp > path && *endp == '/')
                endp--;
-        /* All slashes become "/" */
+        /* All slashes becomes "/" */
        if (endp == path && *endp == '/') {
-                (void)strlcpy(bname, "/", sizeof bname);
+                bname[0] = '/';
-                return(bname);
+                bname[1] = '\0';
+                return (bname);
        }
        /* Find the start of the base */
@@ -53,12 +52,14 @@ basename(const char *path)
        while (startp > path && *(startp - 1) != '/')
                startp--;
-        if (endp - startp + 2 > sizeof(bname)) {
+        len = endp - startp + 1;
+        if (len >= sizeof(bname)) {
                errno = ENAMETOOLONG;
-                return(NULL);
+                return (NULL);
        }
-        strlcpy(bname, startp, endp - startp + 2);
+        memcpy(bname, startp, len);
-        return(bname);
+        bname[len] = '\0';
+        return (bname);
 }
 #endif /* !defined(HAVE_BASENAME) */
diff --git a/openbsd-compat/bindresvport.c b/openbsd-compat/bindresvport.c
index 8a273f9b5..7f48fd03a 100644
--- a/openbsd-compat/bindresvport.c
+++ b/openbsd-compat/bindresvport.c
@@ -1,6 +1,6 @@
 /* This file has be substantially modified from the original OpenBSD source */
-/*      $OpenBSD: bindresvport.c,v 1.15 2003/05/20 22:42:35 deraadt Exp $       */
+/*      $OpenBSD: bindresvport.c,v 1.16 2005/04/01 07:44:03 otto Exp $  */
 /*
 * Copyright 1996, Jason Downs.  All rights reserved.
@@ -28,6 +28,8 @@
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */
+/* OPENBSD ORIGINAL: lib/libc/rpc/bindresvport.c */
 #include "includes.h"
 #ifndef HAVE_BINDRESVPORT_SA
@@ -42,9 +44,7 @@
 * Bind a socket to a privileged IP port
 */
 int
-bindresvport_sa(sd, sa)
+bindresvport_sa(int sd, struct sockaddr *sa)
-        int sd;
-        struct sockaddr *sa;
 {
        int error, af;
        struct sockaddr_storage myaddr;
diff --git a/openbsd-compat/bsd-asprintf.c b/openbsd-compat/bsd-asprintf.c
new file mode 100644
index 000000000..5ca01f80f
--- /dev/null
+++ b/openbsd-compat/bsd-asprintf.c
@@ -0,0 +1,95 @@
+/*
+ * Copyright (c) 2004 Darren Tucker.
+ *
+ * Based originally on asprintf.c from OpenBSD:
+ * Copyright (c) 1997 Todd C. Miller <Todd.Miller@courtesan.com>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#include "includes.h"
+#ifndef HAVE_VASPRINTF
+#ifndef VA_COPY
+# ifdef HAVE_VA_COPY
+#  define VA_COPY(dest, src) va_copy(dest, src)
+# else
+#  ifdef HAVE___VA_COPY
+#   define VA_COPY(dest, src) __va_copy(dest, src)
+#  else
+#   define VA_COPY(dest, src) (dest) = (src)
+#  endif
+# endif
+#endif
+#define INIT_SZ 128
+int vasprintf(char **str, const char *fmt, va_list ap)
+{
+        int ret = -1;
+        va_list ap2;
+        char *string, *newstr;
+        size_t len;
+        VA_COPY(ap2, ap);
+        if ((string = malloc(INIT_SZ)) == NULL)
+                goto fail;
+        ret = vsnprintf(string, INIT_SZ, fmt, ap2);
+        if (ret >= 0 && ret < INIT_SZ) { /* succeeded with initial alloc */
+                *str = string;
+        } else if (ret == INT_MAX) { /* shouldn't happen */
+                goto fail;
+        } else {        /* bigger than initial, realloc allowing for nul */
+                len = (size_t)ret + 1;
+                if ((newstr = realloc(string, len)) == NULL) {
+                        free(string);
+                        goto fail;
+                } else {
+                        va_end(ap2);
+                        VA_COPY(ap2, ap);
+                        ret = vsnprintf(newstr, len, fmt, ap2);
+                        if (ret >= 0 && (size_t)ret < len) {
+                                *str = newstr;
+                        } else { /* failed with realloc'ed string, give up */
+                                free(newstr);
+                                goto fail;
+                        }
+                }
+        }
+        va_end(ap2);
+        return (ret);
+fail:
+        *str = NULL;
+        errno = ENOMEM;
+        va_end(ap2);
+        return (-1);
+}
+#endif
+#ifndef HAVE_ASPRINTF
+int asprintf(char **str, const char *fmt, ...)
+{
+        va_list ap;
+        int ret;
+        
+        *str = NULL;
+        va_start(ap, fmt);
+        ret = vasprintf(str, fmt, ap);
+        va_end(ap);
+        return ret;
+}
+#endif
diff --git a/openbsd-compat/bsd-closefrom.c b/openbsd-compat/bsd-closefrom.c
index 61a9fa391..5b7b94ae4 100644
--- a/openbsd-compat/bsd-closefrom.c
+++ b/openbsd-compat/bsd-closefrom.c
@@ -46,7 +46,7 @@
 # define OPEN_MAX       256
 #endif
-RCSID("$Id: bsd-closefrom.c,v 1.1 2004/08/15 08:41:00 djm Exp $");
+RCSID("$Id: bsd-closefrom.c,v 1.2 2005/11/10 08:29:13 dtucker Exp $");
 #ifndef lint
 static const char sudorcsid[] = "$Sudo: closefrom.c,v 1.6 2004/06/01 20:51:56 millert Exp $";
@@ -67,7 +67,7 @@ closefrom(int lowfd)
    /* Check for a /proc/$$/fd directory. */
    len = snprintf(fdpath, sizeof(fdpath), "/proc/%ld/fd", (long)getpid());
-    if (len != -1 && len <= sizeof(fdpath) && (dirp = opendir(fdpath))) {
+    if (len >= 0 && (u_int)len <= sizeof(fdpath) && (dirp = opendir(fdpath))) {
        while ((dent = readdir(dirp)) != NULL) {
            fd = strtol(dent->d_name, &endp, 10);
            if (dent->d_name != endp && *endp == '\0' &&
diff --git a/openbsd-compat/bsd-misc.c b/openbsd-compat/bsd-misc.c
index 6ba9bd986..d32b054d7 100644
--- a/openbsd-compat/bsd-misc.c
+++ b/openbsd-compat/bsd-misc.c
@@ -18,7 +18,7 @@
 #include "includes.h"
 #include "xmalloc.h"
-RCSID("$Id: bsd-misc.c,v 1.27 2005/05/27 11:13:41 dtucker Exp $");
+RCSID("$Id: bsd-misc.c,v 1.28 2005/11/01 22:07:31 dtucker Exp $");
 #ifndef HAVE___PROGNAME
 char *__progname;
@@ -223,10 +223,7 @@ strdup(const char *str)
        len = strlen(str) + 1;
        cp = malloc(len);
        if (cp != NULL)
-                if (strlcpy(cp, str, len) != len) {
+                return(memcpy(cp, str, len));
-                        free(cp);
+        return NULL;
-                        return NULL;
-                }
-        return cp;
 }
 #endif
diff --git a/openbsd-compat/bsd-snprintf.c b/openbsd-compat/bsd-snprintf.c
index b5a7ef7a0..e4ba154fd 100644
--- a/openbsd-compat/bsd-snprintf.c
+++ b/openbsd-compat/bsd-snprintf.c
@@ -45,45 +45,82 @@
 *    missing.  Some systems only have snprintf() but not vsnprintf(), so
 *    the code is now broken down under HAVE_SNPRINTF and HAVE_VSNPRINTF.
 *
- *  Ben Lindstrom <mouring@eviladmin.org> 09/27/00 for OpenSSH
+ *  Andrew Tridgell (tridge@samba.org) Oct 1998
- *    Welcome to the world of %lld and %qd support.  With other
+ *    fixed handling of %.0f
- *    long long support.  This is needed for sftp-server to work
+ *    added test for HAVE_LONG_DOUBLE
- *    right.
 *
- *  Ben Lindstrom <mouring@eviladmin.org> 02/12/01 for OpenSSH
+ * tridge@samba.org, idra@samba.org, April 2001
- *    Removed all hint of VARARGS stuff and banished it to the void,
+ *    got rid of fcvt code (twas buggy and made testing harder)
- *    and did a bit of KNF style work to make things a bit more
+ *    added C99 semantics
- *    acceptable.  Consider stealing from mutt or enlightenment.
+ *
+ * date: 2002/12/19 19:56:31;  author: herb;  state: Exp;  lines: +2 -0
+ * actually print args for %g and %e
+ * 
+ * date: 2002/06/03 13:37:52;  author: jmcd;  state: Exp;  lines: +8 -0
+ * Since includes.h isn't included here, VA_COPY has to be defined here.  I don't
+ * see any include file that is guaranteed to be here, so I'm defining it
+ * locally.  Fixes AIX and Solaris builds.
+ * 
+ * date: 2002/06/03 03:07:24;  author: tridge;  state: Exp;  lines: +5 -13
+ * put the ifdef for HAVE_VA_COPY in one place rather than in lots of
+ * functions
+ * 
+ * date: 2002/05/17 14:51:22;  author: jmcd;  state: Exp;  lines: +21 -4
+ * Fix usage of va_list passed as an arg.  Use __va_copy before using it
+ * when it exists.
+ * 
+ * date: 2002/04/16 22:38:04;  author: idra;  state: Exp;  lines: +20 -14
+ * Fix incorrect zpadlen handling in fmtfp.
+ * Thanks to Ollie Oldham <ollie.oldham@metro-optix.com> for spotting it.
+ * few mods to make it easier to compile the tests.
+ * addedd the "Ollie" test to the floating point ones.
+ *
+ * Martin Pool (mbp@samba.org) April 2003
+ *    Remove NO_CONFIG_H so that the test case can be built within a source
+ *    tree with less trouble.
+ *    Remove unnecessary SAFE_FREE() definition.
+ *
+ * Martin Pool (mbp@samba.org) May 2003
+ *    Put in a prototype for dummy_snprintf() to quiet compiler warnings.
+ *
+ *    Move #endif to make sure VA_COPY, LDOUBLE, etc are defined even
+ *    if the C library has some snprintf functions already.
 **************************************************************/
 #include "includes.h"
-RCSID("$Id: bsd-snprintf.c,v 1.9 2004/09/23 11:35:09 dtucker Exp $");
+RCSID("$Id: bsd-snprintf.c,v 1.11 2005/12/17 11:32:04 dtucker Exp $");
 #if defined(BROKEN_SNPRINTF)            /* For those with broken snprintf() */
 # undef HAVE_SNPRINTF
 # undef HAVE_VSNPRINTF
 #endif
-#if !defined(HAVE_SNPRINTF) || !defined(HAVE_VSNPRINTF)
+#ifndef VA_COPY
+# ifdef HAVE_VA_COPY
-static void 
+#  define VA_COPY(dest, src) va_copy(dest, src)
-dopr(char *buffer, size_t maxlen, const char *format, va_list args);
+# else
+#  ifdef HAVE___VA_COPY
-static void 
+#   define VA_COPY(dest, src) __va_copy(dest, src)
-fmtstr(char *buffer, size_t *currlen, size_t maxlen, char *value, int flags, 
+#  else
-    int min, int max);
+#   define VA_COPY(dest, src) (dest) = (src)
+#  endif
+# endif
+#endif
-static void 
+#if !defined(HAVE_SNPRINTF) || !defined(HAVE_VSNPRINTF)
-fmtint(char *buffer, size_t *currlen, size_t maxlen, long value, int base, 
-    int min, int max, int flags);
-static void 
+#ifdef HAVE_LONG_DOUBLE
-fmtfp(char *buffer, size_t *currlen, size_t maxlen, long double fvalue, 
+# define LDOUBLE long double
-    int min, int max, int flags);
+#else
+# define LDOUBLE double
+#endif
-static void
+#ifdef HAVE_LONG_LONG
-dopr_outch(char *buffer, size_t *currlen, size_t maxlen, char c);
+# define LLONG long long
+#else
+# define LLONG long
+#endif
 /*
 * dopr(): poor man's version of doprintf
@@ -109,28 +146,49 @@ dopr_outch(char *buffer, size_t *currlen, size_t maxlen, char c);
 #define DP_F_UNSIGNED   (1 << 6)
 /* Conversion Flags */
-#define DP_C_SHORT     1
+#define DP_C_SHORT   1
-#define DP_C_LONG      2
+#define DP_C_LONG    2
-#define DP_C_LDOUBLE   3
+#define DP_C_LDOUBLE 3
-#define DP_C_LONG_LONG 4
+#define DP_C_LLONG   4
-#define char_to_int(p) (p - '0')
+#define char_to_int(p) ((p)- '0')
-#define abs_val(p) (p < 0 ? -p : p)
+#ifndef MAX
+# define MAX(p,q) (((p) >= (q)) ? (p) : (q))
+#endif
-static void 
+static size_t dopr(char *buffer, size_t maxlen, const char *format, 
-dopr(char *buffer, size_t maxlen, const char *format, va_list args)
+                   va_list args_in);
+static void fmtstr(char *buffer, size_t *currlen, size_t maxlen,
+                    char *value, int flags, int min, int max);
+static void fmtint(char *buffer, size_t *currlen, size_t maxlen,
+                    long value, int base, int min, int max, int flags);
+static void fmtfp(char *buffer, size_t *currlen, size_t maxlen,
+                   LDOUBLE fvalue, int min, int max, int flags);
+static void dopr_outch(char *buffer, size_t *currlen, size_t maxlen, char c);
+static size_t dopr(char *buffer, size_t maxlen, const char *format, va_list args_in)
 {
-        char *strvalue, ch;
+        char ch;
-        long value;
+        LLONG value;
-        long double fvalue;
+        LDOUBLE fvalue;
-        int min = 0, max = -1, state = DP_S_DEFAULT, flags = 0, cflags = 0;
+        char *strvalue;
-        size_t currlen = 0;
+        int min;
-  
+        int max;
+        int state;
+        int flags;
+        int cflags;
+        size_t currlen;
+        va_list args;
+        VA_COPY(args, args_in);
+        
+        state = DP_S_DEFAULT;
+        currlen = flags = cflags = min = 0;
+        max = -1;
        ch = *format++;
+        
        while (state != DP_S_DONE) {
-                if ((ch == '\0') || (currlen >= maxlen)) 
+                if (ch == '\0') 
                        state = DP_S_DONE;
                switch(state) {
@@ -138,7 +196,7 @@ dopr(char *buffer, size_t maxlen, const char *format, va_list args)
                        if (ch == '%') 
                                state = DP_S_FLAGS;
                        else 
-                                dopr_outch(buffer, &currlen, maxlen, ch);
+                                dopr_outch (buffer, &currlen, maxlen, ch);
                        ch = *format++;
                        break;
                case DP_S_FLAGS:
@@ -170,34 +228,37 @@ dopr(char *buffer, size_t maxlen, const char *format, va_list args)
                        break;
                case DP_S_MIN:
                        if (isdigit((unsigned char)ch)) {
-                                min = 10 * min + char_to_int (ch);
+                                min = 10*min + char_to_int (ch);
                                ch = *format++;
                        } else if (ch == '*') {
                                min = va_arg (args, int);
                                ch = *format++;
                                state = DP_S_DOT;
-                        } else 
+                        } else {
                                state = DP_S_DOT;
+                        }
                        break;
                case DP_S_DOT:
                        if (ch == '.') {
                                state = DP_S_MAX;
                                ch = *format++;
-                        } else 
+                        } else { 
                                state = DP_S_MOD;
+                        }
                        break;
                case DP_S_MAX:
                        if (isdigit((unsigned char)ch)) {
                                if (max < 0)
                                        max = 0;
-                                max = 10 * max + char_to_int(ch);
+                                max = 10*max + char_to_int (ch);
                                ch = *format++;
                        } else if (ch == '*') {
                                max = va_arg (args, int);
                                ch = *format++;
                                state = DP_S_MOD;
-                        } else 
+                        } else {
                                state = DP_S_MOD;
+                        }
                        break;
                case DP_S_MOD:
                        switch (ch) {
@@ -208,15 +269,11 @@ dopr(char *buffer, size_t maxlen, const char *format, va_list args)
                        case 'l':
                                cflags = DP_C_LONG;
                                ch = *format++;
-                                if (ch == 'l') {
+                                if (ch == 'l') {        /* It's a long long */
-                                        cflags = DP_C_LONG_LONG;
+                                        cflags = DP_C_LLONG;
                                        ch = *format++;
                                }
                                break;
-                        case 'q':
-                                cflags = DP_C_LONG_LONG;
-                                ch = *format++;
-                                break;
                        case 'L':
                                cflags = DP_C_LDOUBLE;
                                ch = *format++;
@@ -231,37 +288,37 @@ dopr(char *buffer, size_t maxlen, const char *format, va_list args)
                        case 'd':
                        case 'i':
                                if (cflags == DP_C_SHORT) 
-                                        value = va_arg(args, int);
+                                        value = va_arg (args, int);
                                else if (cflags == DP_C_LONG)
-                                        value = va_arg(args, long int);
+                                        value = va_arg (args, long int);
-                                else if (cflags == DP_C_LONG_LONG)
+                                else if (cflags == DP_C_LLONG)
-                                        value = va_arg (args, long long);
+                                        value = va_arg (args, LLONG);
                                else
                                        value = va_arg (args, int);
-                                fmtint(buffer, &currlen, maxlen, value, 10, min, max, flags);
+                                fmtint (buffer, &currlen, maxlen, value, 10, min, max, flags);
                                break;
                        case 'o':
                                flags |= DP_F_UNSIGNED;
                                if (cflags == DP_C_SHORT)
-                                        value = va_arg(args, unsigned int);
+                                        value = va_arg (args, unsigned int);
                                else if (cflags == DP_C_LONG)
-                                        value = va_arg(args, unsigned long int);
+                                        value = (long)va_arg (args, unsigned long int);
-                                else if (cflags == DP_C_LONG_LONG)
+                                else if (cflags == DP_C_LLONG)
-                                        value = va_arg(args, unsigned long long);
+                                        value = (long)va_arg (args, unsigned LLONG);
                                else
-                                        value = va_arg(args, unsigned int);
+                                        value = (long)va_arg (args, unsigned int);
-                                fmtint(buffer, &currlen, maxlen, value, 8, min, max, flags);
+                                fmtint (buffer, &currlen, maxlen, value, 8, min, max, flags);
                                break;
                        case 'u':
                                flags |= DP_F_UNSIGNED;
                                if (cflags == DP_C_SHORT)
-                                        value = va_arg(args, unsigned int);
+                                        value = va_arg (args, unsigned int);
                                else if (cflags == DP_C_LONG)
-                                        value = va_arg(args, unsigned long int);
+                                        value = (long)va_arg (args, unsigned long int);
-                                else if (cflags == DP_C_LONG_LONG)
+                                else if (cflags == DP_C_LLONG)
-                                        value = va_arg(args, unsigned long long);
+                                        value = (LLONG)va_arg (args, unsigned LLONG);
                                else
-                                        value = va_arg(args, unsigned int);
+                                        value = (long)va_arg (args, unsigned int);
                                fmtint (buffer, &currlen, maxlen, value, 10, min, max, flags);
                                break;
                        case 'X':
@@ -269,79 +326,86 @@ dopr(char *buffer, size_t maxlen, const char *format, va_list args)
                        case 'x':
                                flags |= DP_F_UNSIGNED;
                                if (cflags == DP_C_SHORT)
-                                        value = va_arg(args, unsigned int);
+                                        value = va_arg (args, unsigned int);
                                else if (cflags == DP_C_LONG)
-                                        value = va_arg(args, unsigned long int);
+                                        value = (long)va_arg (args, unsigned long int);
-                                else if (cflags == DP_C_LONG_LONG)
+                                else if (cflags == DP_C_LLONG)
-                                        value = va_arg(args, unsigned long long);
+                                        value = (LLONG)va_arg (args, unsigned LLONG);
                                else
-                                        value = va_arg(args, unsigned int);
+                                        value = (long)va_arg (args, unsigned int);
-                                fmtint(buffer, &currlen, maxlen, value, 16, min, max, flags);
+                                fmtint (buffer, &currlen, maxlen, value, 16, min, max, flags);
                                break;
                        case 'f':
                                if (cflags == DP_C_LDOUBLE)
-                                        fvalue = va_arg(args, long double);
+                                        fvalue = va_arg (args, LDOUBLE);
                                else
-                                        fvalue = va_arg(args, double);
+                                        fvalue = va_arg (args, double);
                                /* um, floating point? */
-                                fmtfp(buffer, &currlen, maxlen, fvalue, min, max, flags);
+                                fmtfp (buffer, &currlen, maxlen, fvalue, min, max, flags);
                                break;
                        case 'E':
                                flags |= DP_F_UP;
                        case 'e':
                                if (cflags == DP_C_LDOUBLE)
-                                        fvalue = va_arg(args, long double);
+                                        fvalue = va_arg (args, LDOUBLE);
                                else
-                                        fvalue = va_arg(args, double);
+                                        fvalue = va_arg (args, double);
+                                fmtfp (buffer, &currlen, maxlen, fvalue, min, max, flags);
                                break;
                        case 'G':
                                flags |= DP_F_UP;
                        case 'g':
                                if (cflags == DP_C_LDOUBLE)
-                                        fvalue = va_arg(args, long double);
+                                        fvalue = va_arg (args, LDOUBLE);
                                else
-                                        fvalue = va_arg(args, double);
+                                        fvalue = va_arg (args, double);
+                                fmtfp (buffer, &currlen, maxlen, fvalue, min, max, flags);
                                break;
                        case 'c':
-                                dopr_outch(buffer, &currlen, maxlen, va_arg(args, int));
+                                dopr_outch (buffer, &currlen, maxlen, va_arg (args, int));
                                break;
                        case 's':
-                                strvalue = va_arg(args, char *);
+                                strvalue = va_arg (args, char *);
-                                if (max < 0) 
+                                if (!strvalue) strvalue = "(NULL)";
-                                        max = maxlen; /* ie, no max */
+                                if (max == -1) {
-                                fmtstr(buffer, &currlen, maxlen, strvalue, flags, min, max);
+                                        max = strlen(strvalue);
+                                }
+                                if (min > 0 && max >= 0 && min > max) max = min;
+                                fmtstr (buffer, &currlen, maxlen, strvalue, flags, min, max);
                                break;
                        case 'p':
-                                strvalue = va_arg(args, void *);
+                                strvalue = va_arg (args, void *);
-                                fmtint(buffer, &currlen, maxlen, (long) strvalue, 16, min, max, flags);
+                                fmtint (buffer, &currlen, maxlen, (long) strvalue, 16, min, max, flags);
                                break;
                        case 'n':
                                if (cflags == DP_C_SHORT) {
                                        short int *num;
-                                        num = va_arg(args, short int *);
+                                        num = va_arg (args, short int *);
                                        *num = currlen;
                                } else if (cflags == DP_C_LONG) {
                                        long int *num;
-                                        num = va_arg(args, long int *);
+                                        num = va_arg (args, long int *);
-                                        *num = currlen;
+                                        *num = (long int)currlen;
-                                } else if (cflags == DP_C_LONG_LONG) {
+                                } else if (cflags == DP_C_LLONG) {
-                                        long long *num;
+                                        LLONG *num;
-                                        num = va_arg(args, long long *);
+                                        num = va_arg (args, LLONG *);
-                                        *num = currlen;
+                                        *num = (LLONG)currlen;
                                } else {
                                        int *num;
-                                        num = va_arg(args, int *);
+                                        num = va_arg (args, int *);
                                        *num = currlen;
                                }
                                break;
                        case '%':
-                                dopr_outch(buffer, &currlen, maxlen, ch);
+                                dopr_outch (buffer, &currlen, maxlen, ch);
                                break;
-                        case 'w': /* not supported yet, treat as next char */
+                        case 'w':
+                                /* not supported yet, treat as next char */
                                ch = *format++;
                                break;
-                        default: /* Unknown, skip */
+                        default:
-                        break;
+                                /* Unknown, skip */
+                                break;
                        }
                        ch = *format++;
                        state = DP_S_DEFAULT;
@@ -350,24 +414,33 @@ dopr(char *buffer, size_t maxlen, const char *format, va_list args)
                        break;
                case DP_S_DONE:
                        break;
-                default: /* hmm? */
+                default:
+                        /* hmm? */
                        break; /* some picky compilers need this */
                }
        }
-        if (currlen < maxlen - 1) 
+        if (maxlen != 0) {
-                buffer[currlen] = '\0';
+                if (currlen < maxlen - 1) 
-        else 
+                        buffer[currlen] = '\0';
-                buffer[maxlen - 1] = '\0';
+                else if (maxlen > 0) 
+                        buffer[maxlen - 1] = '\0';
+        }
+        
+        return currlen;
 }
-static void
+static void fmtstr(char *buffer, size_t *currlen, size_t maxlen,
-fmtstr(char *buffer, size_t *currlen, size_t maxlen,
+                    char *value, int flags, int min, int max)
-    char *value, int flags, int min, int max)
 {
-        int cnt = 0, padlen, strln;     /* amount to pad */
+        int padlen, strln;     /* amount to pad */
-  
+        int cnt = 0;
-        if (value == 0) 
+#ifdef DEBUG_SNPRINTF
+        printf("fmtstr min=%d max=%d s=[%s]\n", min, max, value);
+#endif
+        if (value == 0) {
                value = "<NULL>";
+        }
        for (strln = 0; strln < max && value[strln]; ++strln); /* strlen */
        padlen = min - strln;
@@ -375,18 +448,18 @@ fmtstr(char *buffer, size_t *currlen, size_t maxlen,
                padlen = 0;
        if (flags & DP_F_MINUS) 
                padlen = -padlen; /* Left Justify */
+        
        while ((padlen > 0) && (cnt < max)) {
-                dopr_outch(buffer, currlen, maxlen, ' ');
+                dopr_outch (buffer, currlen, maxlen, ' ');
                --padlen;
                ++cnt;
        }
        while (*value && (cnt < max)) {
-                dopr_outch(buffer, currlen, maxlen, *value++);
+                dopr_outch (buffer, currlen, maxlen, *value++);
                ++cnt;
        }
        while ((padlen < 0) && (cnt < max)) {
-                dopr_outch(buffer, currlen, maxlen, ' ');
+                dopr_outch (buffer, currlen, maxlen, ' ');
                ++padlen;
                ++cnt;
        }
@@ -394,49 +467,49 @@ fmtstr(char *buffer, size_t *currlen, size_t maxlen,
 /* Have to handle DP_F_NUM (ie 0x and 0 alternates) */
-static void 
+static void fmtint(char *buffer, size_t *currlen, size_t maxlen,
-fmtint(char *buffer, size_t *currlen, size_t maxlen,
+                    long value, int base, int min, int max, int flags)
-    long value, int base, int min, int max, int flags)
 {
+        int signvalue = 0;
        unsigned long uvalue;
        char convert[20];
-        int signvalue = 0, place = 0, caps = 0;
+        int place = 0;
        int spadlen = 0; /* amount to space pad */
        int zpadlen = 0; /* amount to zero pad */
-  
+        int caps = 0;
+        
        if (max < 0)
                max = 0;
+        
        uvalue = value;
+        
-        if (!(flags & DP_F_UNSIGNED)) {
+        if(!(flags & DP_F_UNSIGNED)) {
-                if (value < 0) {
+                if( value < 0 ) {
                        signvalue = '-';
                        uvalue = -value;
-                } else if (flags & DP_F_PLUS)  /* Do a sign (+/i) */
+                } else {
-                        signvalue = '+';
+                        if (flags & DP_F_PLUS)  /* Do a sign (+/i) */
-                else if (flags & DP_F_SPACE)
+                                signvalue = '+';
-                        signvalue = ' ';
+                        else if (flags & DP_F_SPACE)
+                                signvalue = ' ';
+                }
        }
  
-        if (flags & DP_F_UP) 
+        if (flags & DP_F_UP) caps = 1; /* Should characters be upper case? */
-                caps = 1; /* Should characters be upper case? */
        do {
                convert[place++] =
-                    (caps ? "0123456789ABCDEF" : "0123456789abcdef")
+                        (caps? "0123456789ABCDEF":"0123456789abcdef")
-                    [uvalue % (unsigned)base];
+                        [uvalue % (unsigned)base  ];
                uvalue = (uvalue / (unsigned)base );
-        } while (uvalue && (place < 20));
+        } while(uvalue && (place < 20));
-        if (place == 20) 
+        if (place == 20) place--;
-                place--;
        convert[place] = 0;
        zpadlen = max - place;
        spadlen = min - MAX (max, place) - (signvalue ? 1 : 0);
-        if (zpadlen < 0)
+        if (zpadlen < 0) zpadlen = 0;
-                zpadlen = 0;
+        if (spadlen < 0) spadlen = 0;
-        if (spadlen < 0)
-                spadlen = 0;
        if (flags & DP_F_ZERO) {
                zpadlen = MAX(zpadlen, spadlen);
                spadlen = 0;
@@ -444,27 +517,32 @@ fmtint(char *buffer, size_t *currlen, size_t maxlen,
        if (flags & DP_F_MINUS) 
                spadlen = -spadlen; /* Left Justifty */
+#ifdef DEBUG_SNPRINTF
+        printf("zpad: %d, spad: %d, min: %d, max: %d, place: %d\n",
+               zpadlen, spadlen, min, max, place);
+#endif
        /* Spaces */
        while (spadlen > 0) {
-                dopr_outch(buffer, currlen, maxlen, ' ');
+                dopr_outch (buffer, currlen, maxlen, ' ');
                --spadlen;
        }
        /* Sign */
        if (signvalue) 
-                dopr_outch(buffer, currlen, maxlen, signvalue);
+                dopr_outch (buffer, currlen, maxlen, signvalue);
        /* Zeros */
        if (zpadlen > 0) {
                while (zpadlen > 0) {
-                        dopr_outch(buffer, currlen, maxlen, '0');
+                        dopr_outch (buffer, currlen, maxlen, '0');
                        --zpadlen;
                }
        }
        /* Digits */
        while (place > 0) 
-                dopr_outch(buffer, currlen, maxlen, convert[--place]);
+                dopr_outch (buffer, currlen, maxlen, convert[--place]);
  
        /* Left Justified spaces */
        while (spadlen < 0) {
@@ -473,11 +551,20 @@ fmtint(char *buffer, size_t *currlen, size_t maxlen,
        }
 }
-static long double 
+static LDOUBLE abs_val(LDOUBLE value)
-pow10(int exp)
 {
-        long double result = 1;
+        LDOUBLE result = value;
+        if (value < 0)
+                result = -value;
+        
+        return result;
+}
+static LDOUBLE POW10(int exp)
+{
+        LDOUBLE result = 1;
+        
        while (exp) {
                result *= 10;
                exp--;
@@ -486,28 +573,69 @@ pow10(int exp)
        return result;
 }
-static long 
+static LLONG ROUND(LDOUBLE value)
-round(long double value)
 {
-        long intpart = value;
+        LLONG intpart;
-        value -= intpart;
-        if (value >= 0.5)
-                intpart++;
+        intpart = (LLONG)value;
+        value = value - intpart;
+        if (value >= 0.5) intpart++;
+        
        return intpart;
 }
-static void 
+/* a replacement for modf that doesn't need the math library. Should
-fmtfp(char *buffer, size_t *currlen, size_t maxlen, long double fvalue, 
+   be portable, but slow */
-      int min, int max, int flags)
+static double my_modf(double x0, double *iptr)
 {
-        char iconvert[20], fconvert[20];
+        int i;
-        int signvalue = 0, iplace = 0, fplace = 0;
+        long l;
+        double x = x0;
+        double f = 1.0;
+        for (i=0;i<100;i++) {
+                l = (long)x;
+                if (l <= (x+1) && l >= (x-1)) break;
+                x *= 0.1;
+                f *= 10.0;
+        }
+        if (i == 100) {
+                /* yikes! the number is beyond what we can handle. What do we do? */
+                (*iptr) = 0;
+                return 0;
+        }
+        if (i != 0) {
+                double i2;
+                double ret;
+                ret = my_modf(x0-l*f, &i2);
+                (*iptr) = l*f + i2;
+                return ret;
+        } 
+        (*iptr) = l;
+        return x - (*iptr);
+}
+static void fmtfp (char *buffer, size_t *currlen, size_t maxlen,
+                   LDOUBLE fvalue, int min, int max, int flags)
+{
+        int signvalue = 0;
+        double ufvalue;
+        char iconvert[311];
+        char fconvert[311];
+        int iplace = 0;
+        int fplace = 0;
        int padlen = 0; /* amount to pad */
-        int zpadlen = 0, caps = 0;
+        int zpadlen = 0; 
-        long intpart, fracpart;
+        int caps = 0;
-        long double ufvalue;
+        int idx;
+        double intpart;
+        double fracpart;
+        double temp;
  
        /* 
         * AIX manpage says the default is 0, but Solaris says the default
@@ -516,137 +644,159 @@ fmtfp(char *buffer, size_t *currlen, size_t maxlen, long double fvalue,
        if (max < 0)
                max = 6;
-        ufvalue = abs_val(fvalue);
+        ufvalue = abs_val (fvalue);
-        if (fvalue < 0)
+        if (fvalue < 0) {
                signvalue = '-';
-        else if (flags & DP_F_PLUS)  /* Do a sign (+/i) */
+        } else {
-                signvalue = '+';
+                if (flags & DP_F_PLUS) { /* Do a sign (+/i) */
-        else if (flags & DP_F_SPACE)
+                        signvalue = '+';
-                signvalue = ' ';
+                } else {
+                        if (flags & DP_F_SPACE)
+                                signvalue = ' ';
+                }
+        }
-        intpart = ufvalue;
+#if 0
+        if (flags & DP_F_UP) caps = 1; /* Should characters be upper case? */
+#endif
+#if 0
+         if (max == 0) ufvalue += 0.5; /* if max = 0 we must round */
+#endif
        /* 
-         * Sorry, we only support 9 digits past the decimal because of our 
+         * Sorry, we only support 16 digits past the decimal because of our 
         * conversion method
         */
-        if (max > 9)
+        if (max > 16)
-                max = 9;
+                max = 16;
        /* We "cheat" by converting the fractional part to integer by
         * multiplying by a factor of 10
         */
-        fracpart = round((pow10 (max)) * (ufvalue - intpart));
-        if (fracpart >= pow10 (max)) {
+        temp = ufvalue;
+        my_modf(temp, &intpart);
+        fracpart = ROUND((POW10(max)) * (ufvalue - intpart));
+        
+        if (fracpart >= POW10(max)) {
                intpart++;
-                fracpart -= pow10 (max);
+                fracpart -= POW10(max);
        }
        /* Convert integer part */
        do {
+                temp = intpart*0.1;
+                my_modf(temp, &intpart);
+                idx = (int) ((temp -intpart +0.05)* 10.0);
+                /* idx = (int) (((double)(temp*0.1) -intpart +0.05) *10.0); */
+                /* printf ("%llf, %f, %x\n", temp, intpart, idx); */
                iconvert[iplace++] =
-                    (caps ? "0123456789ABCDEF" : "0123456789abcdef")
+                        (caps? "0123456789ABCDEF":"0123456789abcdef")[idx];
-                    [intpart % 10];
+        } while (intpart && (iplace < 311));
-                intpart = (intpart / 10);
+        if (iplace == 311) iplace--;
-        } while(intpart && (iplace < 20));
-        if (iplace == 20) 
-                iplace--;
        iconvert[iplace] = 0;
        /* Convert fractional part */
-        do {
+        if (fracpart)
-                fconvert[fplace++] =
+        {
-                    (caps ? "0123456789ABCDEF" : "0123456789abcdef")
+                do {
-                    [fracpart % 10];
+                        temp = fracpart*0.1;
-                fracpart = (fracpart / 10);
+                        my_modf(temp, &fracpart);
-        } while(fracpart && (fplace < 20));
+                        idx = (int) ((temp -fracpart +0.05)* 10.0);
-        if (fplace == 20) 
+                        /* idx = (int) ((((temp/10) -fracpart) +0.05) *10); */
-                fplace--;
+                        /* printf ("%lf, %lf, %ld\n", temp, fracpart, idx ); */
+                        fconvert[fplace++] =
+                        (caps? "0123456789ABCDEF":"0123456789abcdef")[idx];
+                } while(fracpart && (fplace < 311));
+                if (fplace == 311) fplace--;
+        }
        fconvert[fplace] = 0;
+  
        /* -1 for decimal point, another -1 if we are printing a sign */
        padlen = min - iplace - max - 1 - ((signvalue) ? 1 : 0); 
        zpadlen = max - fplace;
-        if (zpadlen < 0)
+        if (zpadlen < 0) zpadlen = 0;
-                zpadlen = 0;
        if (padlen < 0) 
                padlen = 0;
        if (flags & DP_F_MINUS) 
                padlen = -padlen; /* Left Justifty */
+        
        if ((flags & DP_F_ZERO) && (padlen > 0)) {
                if (signvalue) {
-                        dopr_outch(buffer, currlen, maxlen, signvalue);
+                        dopr_outch (buffer, currlen, maxlen, signvalue);
                        --padlen;
                        signvalue = 0;
                }
                while (padlen > 0) {
-                        dopr_outch(buffer, currlen, maxlen, '0');
+                        dopr_outch (buffer, currlen, maxlen, '0');
                        --padlen;
                }
        }
        while (padlen > 0) {
-                dopr_outch(buffer, currlen, maxlen, ' ');
+                dopr_outch (buffer, currlen, maxlen, ' ');
                --padlen;
        }
        if (signvalue) 
-                dopr_outch(buffer, currlen, maxlen, signvalue);
+                dopr_outch (buffer, currlen, maxlen, signvalue);
+        
        while (iplace > 0) 
-                dopr_outch(buffer, currlen, maxlen, iconvert[--iplace]);
+                dopr_outch (buffer, currlen, maxlen, iconvert[--iplace]);
+#ifdef DEBUG_SNPRINTF
+        printf("fmtfp: fplace=%d zpadlen=%d\n", fplace, zpadlen);
+#endif
        /*
-         * Decimal point.  This should probably use locale to find the 
+         * Decimal point.  This should probably use locale to find the correct
-         * correct char to print out.
+         * char to print out.
         */
-        dopr_outch(buffer, currlen, maxlen, '.');
+        if (max > 0) {
+                dopr_outch (buffer, currlen, maxlen, '.');
-        while (fplace > 0) 
+                
-                dopr_outch(buffer, currlen, maxlen, fconvert[--fplace]);
+                while (zpadlen > 0) {
+                        dopr_outch (buffer, currlen, maxlen, '0');
+                        --zpadlen;
+                }
-        while (zpadlen > 0) {
+                while (fplace > 0) 
-                dopr_outch(buffer, currlen, maxlen, '0');
+                        dopr_outch (buffer, currlen, maxlen, fconvert[--fplace]);
-                --zpadlen;
        }
        while (padlen < 0) {
-                dopr_outch(buffer, currlen, maxlen, ' ');
+                dopr_outch (buffer, currlen, maxlen, ' ');
                ++padlen;
        }
 }
-static void 
+static void dopr_outch(char *buffer, size_t *currlen, size_t maxlen, char c)
-dopr_outch(char *buffer, size_t *currlen, size_t maxlen, char c)
 {
-        if (*currlen < maxlen)
+        if (*currlen < maxlen) {
-                buffer[(*currlen)++] = c;
+                buffer[(*currlen)] = c;
+        }
+        (*currlen)++;
 }
 #endif /* !defined(HAVE_SNPRINTF) || !defined(HAVE_VSNPRINTF) */
-#ifndef HAVE_VSNPRINTF
+#if !defined(HAVE_VSNPRINTF)
-int 
+int vsnprintf (char *str, size_t count, const char *fmt, va_list args)
-vsnprintf(char *str, size_t count, const char *fmt, va_list args)
 {
-        str[0] = 0;
+        return dopr(str, count, fmt, args);
-        dopr(str, count, fmt, args);
-        return(strlen(str));
 }
-#endif /* !HAVE_VSNPRINTF */
+#endif
-#ifndef HAVE_SNPRINTF
+#if !defined(HAVE_SNPRINTF)
-int 
+int snprintf(char *str, size_t count, SNPRINTF_CONST char *fmt, ...)
-snprintf(char *str,size_t count,const char *fmt,...)
 {
+        size_t ret;
        va_list ap;
        va_start(ap, fmt);
-        (void) vsnprintf(str, count, fmt, ap);
+        ret = vsnprintf(str, count, fmt, ap);
        va_end(ap);
+        return ret;
-        return(strlen(str));
 }
+#endif
-#endif /* !HAVE_SNPRINTF */
diff --git a/openbsd-compat/daemon.c b/openbsd-compat/daemon.c
index c0be5fff9..f8a0680bf 100644
--- a/openbsd-compat/daemon.c
+++ b/openbsd-compat/daemon.c
@@ -1,5 +1,4 @@
-/* OPENBSD ORIGINAL: lib/libc/gen/daemon.c */
+/*      $OpenBSD: daemon.c,v 1.6 2005/08/08 08:05:33 espie Exp $ */
 /*-
 * Copyright (c) 1990, 1993
 *      The Regents of the University of California.  All rights reserved.
@@ -29,14 +28,12 @@
 * SUCH DAMAGE.
 */
+/* OPENBSD ORIGINAL: lib/libc/gen/daemon.c */
 #include "includes.h"
 #ifndef HAVE_DAEMON
-#if defined(LIBC_SCCS) && !defined(lint)
-static char rcsid[] = "$OpenBSD: daemon.c,v 1.5 2003/07/15 17:32:41 deraadt Exp $";
-#endif /* LIBC_SCCS and not lint */
 int
 daemon(int nochdir, int noclose)
 {
diff --git a/openbsd-compat/dirname.c b/openbsd-compat/dirname.c
index 25ab34dd6..30fcb4968 100644
--- a/openbsd-compat/dirname.c
+++ b/openbsd-compat/dirname.c
@@ -1,9 +1,7 @@
-/* OPENBSD ORIGINAL: lib/libc/gen/dirname.c */
+/*      $OpenBSD: dirname.c,v 1.13 2005/08/08 08:05:33 espie Exp $      */
-/*      $OpenBSD: dirname.c,v 1.10 2003/06/17 21:56:23 millert Exp $    */
 /*
- * Copyright (c) 1997 Todd C. Miller <Todd.Miller@courtesan.com>
+ * Copyright (c) 1997, 2004 Todd C. Miller <Todd.Miller@courtesan.com>
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
@@ -18,13 +16,11 @@
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */
+/* OPENBSD ORIGINAL: lib/libc/gen/dirname.c */
 #include "includes.h"
 #ifndef HAVE_DIRNAME
-#ifndef lint
-static char rcsid[] = "$OpenBSD: dirname.c,v 1.10 2003/06/17 21:56:23 millert Exp $";
-#endif /* not lint */
 #include <errno.h>
 #include <string.h>
 #include <sys/param.h>
@@ -32,16 +28,18 @@ static char rcsid[] = "$OpenBSD: dirname.c,v 1.10 2003/06/17 21:56:23 millert Ex
 char *
 dirname(const char *path)
 {
-        static char bname[MAXPATHLEN];
+        static char dname[MAXPATHLEN];
-        register const char *endp;
+        size_t len;
+        const char *endp;
        /* Empty or NULL string gets treated as "." */
        if (path == NULL || *path == '\0') {
-                (void)strlcpy(bname, ".", sizeof bname);
+                dname[0] = '.';
-                return(bname);
+                dname[1] = '\0';
+                return (dname);
        }
-        /* Strip trailing slashes */
+        /* Strip any trailing slashes */
        endp = path + strlen(path) - 1;
        while (endp > path && *endp == '/')
                endp--;
@@ -52,19 +50,23 @@ dirname(const char *path)
        /* Either the dir is "/" or there are no slashes */
        if (endp == path) {
-                (void)strlcpy(bname, *endp == '/' ? "/" : ".", sizeof bname);
+                dname[0] = *endp == '/' ? '/' : '.';
-                return(bname);
+                dname[1] = '\0';
+                return (dname);
        } else {
+                /* Move forward past the separating slashes */
                do {
                        endp--;
                } while (endp > path && *endp == '/');
        }
-        if (endp - path + 2 > sizeof(bname)) {
+        len = endp - path + 1;
+        if (len >= sizeof(dname)) {
                errno = ENAMETOOLONG;
-                return(NULL);
+                return (NULL);
        }
-        strlcpy(bname, path, endp - path + 2);
+        memcpy(dname, path, len);
-        return(bname);
+        dname[len] = '\0';
+        return (dname);
 }
 #endif
diff --git a/openbsd-compat/getcwd.c b/openbsd-compat/getcwd.c
index 19be59172..711cb9cd5 100644
--- a/openbsd-compat/getcwd.c
+++ b/openbsd-compat/getcwd.c
@@ -1,5 +1,4 @@
-/* OPENBSD ORIGINAL: lib/libc/gen/getcwd.c */
+/*      $OpenBSD: getcwd.c,v 1.14 2005/08/08 08:05:34 espie Exp $ */
 /*
 * Copyright (c) 1989, 1991, 1993
 *      The Regents of the University of California.  All rights reserved.
@@ -29,14 +28,12 @@
 * SUCH DAMAGE.
 */
+/* OPENBSD ORIGINAL: lib/libc/gen/getcwd.c */
 #include "includes.h"
 #if !defined(HAVE_GETCWD)
-#if defined(LIBC_SCCS) && !defined(lint)
-static char rcsid[] = "$OpenBSD: getcwd.c,v 1.9 2003/06/11 21:03:10 deraadt Exp $";
-#endif /* LIBC_SCCS and not lint */
 #include <sys/param.h>
 #include <sys/stat.h>
 #include <errno.h>
@@ -54,12 +51,12 @@ static char rcsid[] = "$OpenBSD: getcwd.c,v 1.9 2003/06/11 21:03:10 deraadt Exp
 char *
 getcwd(char *pt, size_t size)
 {
-        register struct dirent *dp;
+        struct dirent *dp;
-        register DIR *dir = NULL;
+        DIR *dir = NULL;
-        register dev_t dev;
+        dev_t dev;
-        register ino_t ino;
+        ino_t ino;
-        register int first;
+        int first;
-        register char *bpt, *bup;
+        char *bpt, *bup;
        struct stat s;
        dev_t root_dev;
        ino_t root_ino;
@@ -80,7 +77,7 @@ getcwd(char *pt, size_t size)
                }
                ept = pt + size;
        } else {
-                if ((pt = malloc(ptsize = 1024 - 4)) == NULL)
+                if ((pt = malloc(ptsize = MAXPATHLEN)) == NULL)
                        return (NULL);
                ept = pt + ptsize;
        }
@@ -88,13 +85,13 @@ getcwd(char *pt, size_t size)
        *bpt = '\0';
        /*
-         * Allocate bytes (1024 - malloc space) for the string of "../"'s.
+         * Allocate bytes for the string of "../"'s.
         * Should always be enough (it's 340 levels).  If it's not, allocate
         * as necessary.  Special * case the first stat, it's ".", not "..".
         */
-        if ((up = malloc(upsize = 1024 - 4)) == NULL)
+        if ((up = malloc(upsize = MAXPATHLEN)) == NULL)
                goto err;
-        eup = up + MAXPATHLEN;
+        eup = up + upsize;
        bup = up;
        up[0] = '.';
        up[1] = '\0';
@@ -139,18 +136,16 @@ getcwd(char *pt, size_t size)
                        if ((nup = realloc(up, upsize *= 2)) == NULL)
                                goto err;
+                        bup = nup + (bup - up);
                        up = nup;
-                        bup = up;
                        eup = up + upsize;
                }
                *bup++ = '.';
                *bup++ = '.';
                *bup = '\0';
-                /* Open and stat parent directory. 
+                /* Open and stat parent directory. */
-                 * RACE?? - replaced fstat(dirfd(dir), &s) w/ lstat(up,&s) 
+                if (!(dir = opendir(up)) || fstat(dirfd(dir), &s))
-                 */
-                if (!(dir = opendir(up)) || lstat(up,&s))
                        goto err;
                /* Add trailing slash for next directory. */
@@ -175,7 +170,7 @@ getcwd(char *pt, size_t size)
                                        goto notfound;
                                if (ISDOT(dp))
                                        continue;
-                                memmove(bup, dp->d_name, dp->d_namlen + 1);
+                                memcpy(bup, dp->d_name, dp->d_namlen + 1);
                                /* Save the first error for later. */
                                if (lstat(up, &s)) {
@@ -193,19 +188,18 @@ getcwd(char *pt, size_t size)
                 * leading slash.
                 */
                if (bpt - pt < dp->d_namlen + (first ? 1 : 2)) {
-                        size_t len, off;
+                        size_t len;
                        char *npt;
                        if (!ptsize) {
                                errno = ERANGE;
                                goto err;
                        }
-                        off = bpt - pt;
                        len = ept - bpt;
                        if ((npt = realloc(pt, ptsize *= 2)) == NULL)
                                goto err;
+                        bpt = npt + (bpt - pt);
                        pt = npt;
-                        bpt = pt + off;
                        ept = pt + ptsize;
                        memmove(ept - len, bpt, len);
                        bpt = ept - len;
@@ -213,7 +207,7 @@ getcwd(char *pt, size_t size)
                if (!first)
                        *--bpt = '/';
                bpt -= dp->d_namlen;
-                memmove(bpt, dp->d_name, dp->d_namlen);
+                memcpy(bpt, dp->d_name, dp->d_namlen);
                (void)closedir(dir);
                /* Truncate any file name. */
@@ -230,12 +224,16 @@ notfound:
                errno = save_errno ? save_errno : ENOENT;
        /* FALLTHROUGH */
 err:
+        save_errno = errno;
        if (ptsize)
                free(pt);
-        if (up)
+        free(up);
-                free(up);
        if (dir)
                (void)closedir(dir);
+        errno = save_errno;
        return (NULL);
 }
diff --git a/openbsd-compat/getgrouplist.c b/openbsd-compat/getgrouplist.c
index 59c164f44..a57d7d388 100644
--- a/openbsd-compat/getgrouplist.c
+++ b/openbsd-compat/getgrouplist.c
@@ -1,5 +1,4 @@
-/* OPENBSD ORIGINAL: lib/libc/gen/getgrouplist.c */
+/*      $OpenBSD: getgrouplist.c,v 1.12 2005/08/08 08:05:34 espie Exp $ */
 /*
 * Copyright (c) 1991, 1993
 *      The Regents of the University of California.  All rights reserved.
@@ -29,14 +28,12 @@
 * SUCH DAMAGE.
 */
+/* OPENBSD ORIGINAL: lib/libc/gen/getgrouplist.c */
 #include "includes.h"
 #ifndef HAVE_GETGROUPLIST
-#if defined(LIBC_SCCS) && !defined(lint)
-static char rcsid[] = "$OpenBSD: getgrouplist.c,v 1.9 2003/06/25 21:16:47 deraadt Exp $";
-#endif /* LIBC_SCCS and not lint */
 /*
 * get credential
 */
@@ -46,14 +43,10 @@ static char rcsid[] = "$OpenBSD: getgrouplist.c,v 1.9 2003/06/25 21:16:47 deraad
 #include <grp.h>
 int
-getgrouplist(uname, agroup, groups, grpcnt)
+getgrouplist(const char *uname, gid_t agroup, gid_t *groups, int *grpcnt)
-        const char *uname;
-        gid_t agroup;
-        register gid_t *groups;
-        int *grpcnt;
 {
-        register struct group *grp;
+        struct group *grp;
-        register int i, ngroups;
+        int i, ngroups;
        int ret, maxgroups;
        int bail;
diff --git a/openbsd-compat/getopt.c b/openbsd-compat/getopt.c
index f5ee6778d..5450e43d9 100644
--- a/openbsd-compat/getopt.c
+++ b/openbsd-compat/getopt.c
@@ -1,5 +1,3 @@
-/* OPENBSD ORIGINAL: lib/libc/stdlib/getopt.c */
 /*
 * Copyright (c) 1987, 1993, 1994
 *      The Regents of the University of California.  All rights reserved.
@@ -29,6 +27,8 @@
 * SUCH DAMAGE.
 */
+/* OPENBSD ORIGINAL: lib/libc/stdlib/getopt.c */
 #include "includes.h"
 #if !defined(HAVE_GETOPT) || !defined(HAVE_GETOPT_OPTRESET)
diff --git a/openbsd-compat/getrrsetbyname.c b/openbsd-compat/getrrsetbyname.c
index 2016ffe31..bea6aea3b 100644
--- a/openbsd-compat/getrrsetbyname.c
+++ b/openbsd-compat/getrrsetbyname.c
@@ -1,6 +1,4 @@
-/* OPENBSD ORIGINAL: lib/libc/net/getrrsetbyname.c */
+/* $OpenBSD: getrrsetbyname.c,v 1.10 2005/03/30 02:58:28 tedu Exp $ */
-/* $OpenBSD: getrrsetbyname.c,v 1.7 2003/03/07 07:34:14 itojun Exp $ */
 /*
 * Copyright (c) 2001 Jakob Schlyter. All rights reserved.
@@ -45,54 +43,26 @@
 * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */
+/* OPENBSD ORIGINAL: lib/libc/net/getrrsetbyname.c */
 #include "includes.h"
 #ifndef HAVE_GETRRSETBYNAME
 #include "getrrsetbyname.h"
-#define ANSWER_BUFFER_SIZE 1024*64
 #if defined(HAVE_DECL_H_ERRNO) && !HAVE_DECL_H_ERRNO
 extern int h_errno;
 #endif
-struct dns_query {
+/* We don't need multithread support here */
-        char                    *name;
+#ifdef _THREAD_PRIVATE
-        u_int16_t               type;
+# undef _THREAD_PRIVATE
-        u_int16_t               class;
+#endif
-        struct dns_query        *next;
+#define _THREAD_PRIVATE(a,b,c) (c)
-};
+struct __res_state _res;
-struct dns_rr {
-        char                    *name;
-        u_int16_t               type;
-        u_int16_t               class;
-        u_int16_t               ttl;
-        u_int16_t               size;
-        void                    *rdata;
-        struct dns_rr           *next;
-};
-struct dns_response {
-        HEADER                  header;
-        struct dns_query        *query;
-        struct dns_rr           *answer;
-        struct dns_rr           *authority;
-        struct dns_rr           *additional;
-};
-static struct dns_response *parse_dns_response(const u_char *, int);
-static struct dns_query *parse_dns_qsection(const u_char *, int,
-    const u_char **, int);
-static struct dns_rr *parse_dns_rrsection(const u_char *, int, const u_char **,
-    int);
-static void free_dns_query(struct dns_query *);
-static void free_dns_rr(struct dns_rr *);
-static void free_dns_response(struct dns_response *);
-static int count_dns_rr(struct dns_rr *, u_int16_t, u_int16_t);
+/* Necessary functions and macros */
 /*
 * Inline versions of get/put short/long.  Pointer is advanced.
@@ -162,14 +132,56 @@ _getlong(msgp)
 u_int32_t _getlong(register const u_char *);
 #endif
+/* ************** */
+#define ANSWER_BUFFER_SIZE 1024*64
+struct dns_query {
+        char                    *name;
+        u_int16_t               type;
+        u_int16_t               class;
+        struct dns_query        *next;
+};
+struct dns_rr {
+        char                    *name;
+        u_int16_t               type;
+        u_int16_t               class;
+        u_int16_t               ttl;
+        u_int16_t               size;
+        void                    *rdata;
+        struct dns_rr           *next;
+};
+struct dns_response {
+        HEADER                  header;
+        struct dns_query        *query;
+        struct dns_rr           *answer;
+        struct dns_rr           *authority;
+        struct dns_rr           *additional;
+};
+static struct dns_response *parse_dns_response(const u_char *, int);
+static struct dns_query *parse_dns_qsection(const u_char *, int,
+    const u_char **, int);
+static struct dns_rr *parse_dns_rrsection(const u_char *, int, const u_char **,
+    int);
+static void free_dns_query(struct dns_query *);
+static void free_dns_rr(struct dns_rr *);
+static void free_dns_response(struct dns_response *);
+static int count_dns_rr(struct dns_rr *, u_int16_t, u_int16_t);
 int
 getrrsetbyname(const char *hostname, unsigned int rdclass,
    unsigned int rdtype, unsigned int flags,
    struct rrsetinfo **res)
 {
+        struct __res_state *_resp = _THREAD_PRIVATE(_res, _res, &_res);
        int result;
        struct rrsetinfo *rrset = NULL;
-        struct dns_response *response;
+        struct dns_response *response = NULL;
        struct dns_rr *rr;
        struct rdatainfo *rdata;
        int length;
@@ -195,19 +207,19 @@ getrrsetbyname(const char *hostname, unsigned int rdclass,
        }
        /* initialize resolver */
-        if ((_res.options & RES_INIT) == 0 && res_init() == -1) {
+        if ((_resp->options & RES_INIT) == 0 && res_init() == -1) {
                result = ERRSET_FAIL;
                goto fail;
        }
 #ifdef DEBUG
-        _res.options |= RES_DEBUG;
+        _resp->options |= RES_DEBUG;
 #endif /* DEBUG */
 #ifdef RES_USE_DNSSEC
        /* turn on DNSSEC if EDNS0 is configured */
-        if (_res.options & RES_USE_EDNS0)
+        if (_resp->options & RES_USE_EDNS0)
-                _res.options |= RES_USE_DNSSEC;
+                _resp->options |= RES_USE_DNSSEC;
 #endif /* RES_USE_DNSEC */
        /* make query */
@@ -257,13 +269,11 @@ getrrsetbyname(const char *hostname, unsigned int rdclass,
 #endif
        /* copy name from answer section */
-        length = strlen(response->answer->name);
+        rrset->rri_name = strdup(response->answer->name);
-        rrset->rri_name = malloc(length + 1);
        if (rrset->rri_name == NULL) {
                result = ERRSET_NOMEMORY;
                goto fail;
        }
-        strlcpy(rrset->rri_name, response->answer->name, length + 1);
        /* count answers */
        rrset->rri_nrdatas = count_dns_rr(response->answer, rrset->rri_rdclass,
@@ -281,7 +291,7 @@ getrrsetbyname(const char *hostname, unsigned int rdclass,
        /* allocate memory for signatures */
        rrset->rri_sigs = calloc(rrset->rri_nsigs, sizeof(struct rdatainfo));
-        if (rrset->rri_nsigs > 0 && rrset->rri_sigs == NULL) {
+        if (rrset->rri_sigs == NULL) {
                result = ERRSET_NOMEMORY;
                goto fail;
        }
@@ -311,6 +321,7 @@ getrrsetbyname(const char *hostname, unsigned int rdclass,
                        memcpy(rdata->rdi_data, rr->rdata, rr->size);
                }
        }
+        free_dns_response(response);
        *res = rrset;
        return (ERRSET_SUCCESS);
@@ -318,6 +329,8 @@ getrrsetbyname(const char *hostname, unsigned int rdclass,
 fail:
        if (rrset != NULL)
                freerrset(rrset);
+        if (response != NULL)
+                free_dns_response(response);
        return (result);
 }
@@ -467,7 +480,8 @@ parse_dns_qsection(const u_char *answer, int size, const u_char **cp, int count)
 }
 static struct dns_rr *
-parse_dns_rrsection(const u_char *answer, int size, const u_char **cp, int count)
+parse_dns_rrsection(const u_char *answer, int size, const u_char **cp,
+    int count)
 {
        struct dns_rr *head, *curr, *prev;
        int i, length;
diff --git a/openbsd-compat/glob.c b/openbsd-compat/glob.c
index 7fafc8c40..f6a04ea3f 100644
--- a/openbsd-compat/glob.c
+++ b/openbsd-compat/glob.c
@@ -1,5 +1,4 @@
-/* OPENBSD ORIGINAL: lib/libc/gen/glob.c */
+/*      $OpenBSD: glob.c,v 1.25 2005/08/08 08:05:34 espie Exp $ */
 /*
 * Copyright (c) 1989, 1993
 *      The Regents of the University of California.  All rights reserved.
@@ -32,6 +31,8 @@
 * SUCH DAMAGE.
 */
+/* OPENBSD ORIGINAL: lib/libc/gen/glob.c */
 #include "includes.h"
 #include <ctype.h>
@@ -50,14 +51,6 @@ get_arg_max(void)
 #if !defined(HAVE_GLOB) || !defined(GLOB_HAS_ALTDIRFUNC) || \
    !defined(GLOB_HAS_GL_MATCHC)
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)glob.c      8.3 (Berkeley) 10/13/93";
-#else
-static char rcsid[] = "$OpenBSD: glob.c,v 1.22 2003/06/25 21:16:47 deraadt Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
 /*
 * glob(3) -- a superset of the one defined in POSIX 1003.2.
 *
@@ -158,10 +151,8 @@ static void	 qprintf(const char *, Char *);
 #endif
 int
-glob(pattern, flags, errfunc, pglob)
+glob(const char *pattern, int flags, int (*errfunc)(const char *, int),
-        const char *pattern;
+    glob_t *pglob)
-        int flags, (*errfunc)(const char *, int);
-        glob_t *pglob;
 {
        const u_char *patnext;
        int c;
@@ -209,9 +200,7 @@ glob(pattern, flags, errfunc, pglob)
 * characters
 */
 static int
-globexp1(pattern, pglob)
+globexp1(const Char *pattern, glob_t *pglob)
-        const Char *pattern;
-        glob_t *pglob;
 {
        const Char* ptr = pattern;
        int rv;
@@ -234,10 +223,7 @@ globexp1(pattern, pglob)
 * If it fails then it tries to glob the rest of the pattern and returns.
 */
 static int
-globexp2(ptr, pattern, pglob, rv)
+globexp2(const Char *ptr, const Char *pattern, glob_t *pglob, int *rv)
-        const Char *ptr, *pattern;
-        glob_t *pglob;
-        int *rv;
 {
        int     i;
        Char   *lm, *ls;
@@ -342,11 +328,7 @@ globexp2(ptr, pattern, pglob, rv)
 * expand tilde from the passwd file.
 */
 static const Char *
-globtilde(pattern, patbuf, patbuf_len, pglob)
+globtilde(const Char *pattern, Char *patbuf, size_t patbuf_len, glob_t *pglob)
-        const Char *pattern;
-        Char *patbuf;
-        size_t patbuf_len;
-        glob_t *pglob;
 {
        struct passwd *pwd;
        char *h;
@@ -414,9 +396,7 @@ globtilde(pattern, patbuf, patbuf_len, pglob)
 * to find no matches.
 */
 static int
-glob0(pattern, pglob)
+glob0(const Char *pattern, glob_t *pglob)
-        const Char *pattern;
-        glob_t *pglob;
 {
        const Char *qpatnext;
        int c, err, oldpathc;
@@ -503,17 +483,13 @@ glob0(pattern, pglob)
 }
 static int
-compare(p, q)
+compare(const void *p, const void *q)
-        const void *p, *q;
 {
        return(strcmp(*(char **)p, *(char **)q));
 }
 static int
-glob1(pattern, pattern_last, pglob, limitp)
+glob1(Char *pattern, Char *pattern_last, glob_t *pglob, size_t *limitp)
-        Char *pattern, *pattern_last;
-        glob_t *pglob;
-        size_t *limitp;
 {
        Char pathbuf[MAXPATHLEN];
@@ -531,12 +507,8 @@ glob1(pattern, pattern_last, pglob, limitp)
 * meta characters.
 */
 static int
-glob2(pathbuf, pathbuf_last, pathend, pathend_last, pattern,
+glob2(Char *pathbuf, Char *pathbuf_last, Char *pathend, Char *pathend_last,
-    pattern_last, pglob, limitp)
+    Char *pattern, Char *pattern_last, glob_t *pglob, size_t *limitp)
-        Char *pathbuf, *pathbuf_last, *pathend, *pathend_last;
-        Char *pattern, *pattern_last;
-        glob_t *pglob;
-        size_t *limitp;
 {
        struct stat sb;
        Char *p, *q;
@@ -595,14 +567,11 @@ glob2(pathbuf, pathbuf_last, pathend, pathend_last, pattern,
 }
 static int
-glob3(pathbuf, pathbuf_last, pathend, pathend_last, pattern, pattern_last,
+glob3(Char *pathbuf, Char *pathbuf_last, Char *pathend, Char *pathend_last,
-    restpattern, restpattern_last, pglob, limitp)
+    Char *pattern, Char *pattern_last, Char *restpattern,
-        Char *pathbuf, *pathbuf_last, *pathend, *pathend_last;
+    Char *restpattern_last, glob_t *pglob, size_t *limitp)
-        Char *pattern, *pattern_last, *restpattern, *restpattern_last;
-        glob_t *pglob;
-        size_t *limitp;
 {
-        register struct dirent *dp;
+        struct dirent *dp;
        DIR *dirp;
        int err;
        char buf[MAXPATHLEN];
@@ -640,8 +609,8 @@ glob3(pathbuf, pathbuf_last, pathend, pathend_last, pattern, pattern_last,
        else
                readdirfunc = (struct dirent *(*)(void *))readdir;
        while ((dp = (*readdirfunc)(dirp))) {
-                register u_char *sc;
+                u_char *sc;
-                register Char *dc;
+                Char *dc;
                /* Initial DOT must be matched literally. */
                if (dp->d_name[0] == DOT && *pattern != DOT)
@@ -689,13 +658,10 @@ glob3(pathbuf, pathbuf_last, pathend, pathend_last, pattern, pattern_last,
 *      gl_pathv points to (gl_offs + gl_pathc + 1) items.
 */
 static int
-globextend(path, pglob, limitp)
+globextend(const Char *path, glob_t *pglob, size_t *limitp)
-        const Char *path;
-        glob_t *pglob;
-        size_t *limitp;
 {
-        register char **pathv;
+        char **pathv;
-        register int i;
+        int i;
        u_int newsize, len;
        char *copy;
        const Char *p;
@@ -747,8 +713,7 @@ globextend(path, pglob, limitp)
 * pattern causes a recursion level.
 */
 static int
-match(name, pat, patend)
+match(Char *name, Char *pat, Char *patend)
-        register Char *name, *pat, *patend;
 {
        int ok, negate_range;
        Char c, k;
@@ -759,11 +724,10 @@ match(name, pat, patend)
                case M_ALL:
                        if (pat == patend)
                                return(1);
-                        do
+                        do {
                            if (match(name, pat, patend))
                                    return(1);
-                        while (*name++ != EOS)
+                        } while (*name++ != EOS);
-                                ;
                        return(0);
                case M_ONE:
                        if (*name++ == EOS)
@@ -796,11 +760,10 @@ match(name, pat, patend)
 /* Free allocated data belonging to a glob_t structure. */
 void
-globfree(pglob)
+globfree(glob_t *pglob)
-        glob_t *pglob;
 {
-        register int i;
+        int i;
-        register char **pp;
+        char **pp;
        if (pglob->gl_pathv != NULL) {
                pp = pglob->gl_pathv + pglob->gl_offs;
@@ -813,9 +776,7 @@ globfree(pglob)
 }
 static DIR *
-g_opendir(str, pglob)
+g_opendir(Char *str, glob_t *pglob)
-        register Char *str;
-        glob_t *pglob;
 {
        char buf[MAXPATHLEN];
@@ -833,10 +794,7 @@ g_opendir(str, pglob)
 }
 static int
-g_lstat(fn, sb, pglob)
+g_lstat(Char *fn, struct stat *sb, glob_t *pglob)
-        register Char *fn;
-        struct stat *sb;
-        glob_t *pglob;
 {
        char buf[MAXPATHLEN];
@@ -848,10 +806,7 @@ g_lstat(fn, sb, pglob)
 }
 static int
-g_stat(fn, sb, pglob)
+g_stat(Char *fn, struct stat *sb, glob_t *pglob)
-        register Char *fn;
-        struct stat *sb;
-        glob_t *pglob;
 {
        char buf[MAXPATHLEN];
@@ -863,9 +818,7 @@ g_stat(fn, sb, pglob)
 }
 static Char *
-g_strchr(str, ch)
+g_strchr(Char *str, int ch)
-        Char *str;
-        int ch;
 {
        do {
                if (*str == ch)
@@ -875,10 +828,7 @@ g_strchr(str, ch)
 }
 static int
-g_Ctoc(str, buf, len)
+g_Ctoc(const Char *str, char *buf, u_int len)
-        register const Char *str;
-        char *buf;
-        u_int len;
 {
        while (len--) {
@@ -890,11 +840,9 @@ g_Ctoc(str, buf, len)
 #ifdef DEBUG
 static void
-qprintf(str, s)
+qprintf(const char *str, Char *s)
-        const char *str;
-        register Char *s;
 {
-        register Char *p;
+        Char *p;
        (void)printf("%s:\n", str);
        for (p = s; *p; p++)
diff --git a/openbsd-compat/glob.h b/openbsd-compat/glob.h
index 3428b2013..4fdbfc1ea 100644
--- a/openbsd-compat/glob.h
+++ b/openbsd-compat/glob.h
@@ -1,6 +1,4 @@
-/* OPENBSD ORIGINAL: include/glob.h */
+/*      $OpenBSD: glob.h,v 1.9 2004/10/07 16:56:11 millert Exp $        */
-/*      $OpenBSD: glob.h,v 1.8 2003/06/02 19:34:12 millert Exp $        */
 /*      $NetBSD: glob.h,v 1.5 1994/10/26 00:55:56 cgd Exp $     */
 /*
@@ -37,6 +35,8 @@
 *      @(#)glob.h      8.1 (Berkeley) 6/2/93
 */
+/* OPENBSD ORIGINAL: include/glob.h */
 #if !defined(HAVE_GLOB_H) || !defined(GLOB_HAS_ALTDIRFUNC) || \
    !defined(GLOB_HAS_GL_MATCHC)
@@ -72,6 +72,7 @@ typedef struct {
 #define GLOB_MARK       0x0008  /* Append / to matching directories. */
 #define GLOB_NOCHECK    0x0010  /* Return pattern itself if nothing matches. */
 #define GLOB_NOSORT     0x0020  /* Don't sort. */
+#define GLOB_NOESCAPE   0x1000  /* Disable backslash escaping. */
 #define GLOB_ALTDIRFUNC 0x0040  /* Use alternately specified directory funcs. */
 #define GLOB_BRACE      0x0080  /* Expand braces ala csh. */
@@ -79,7 +80,6 @@ typedef struct {
 #define GLOB_NOMAGIC    0x0200  /* GLOB_NOCHECK without magic chars (csh). */
 #define GLOB_QUOTE      0x0400  /* Quote special chars with \. */
 #define GLOB_TILDE      0x0800  /* Expand tilde names from the passwd file. */
-#define GLOB_NOESCAPE   0x1000  /* Disable backslash escaping. */
 #define GLOB_LIMIT      0x2000  /* Limit pattern match output to ARG_MAX */
 /* Error values returned by glob(3) */
diff --git a/openbsd-compat/inet_aton.c b/openbsd-compat/inet_aton.c
index c141bcc68..130597e14 100644
--- a/openbsd-compat/inet_aton.c
+++ b/openbsd-compat/inet_aton.c
@@ -1,6 +1,4 @@
-/* OPENBSD ORIGINAL: lib/libc/net/inet_addr.c */
+/*      $OpenBSD: inet_addr.c,v 1.9 2005/08/06 20:30:03 espie Exp $     */
-/*      $OpenBSD: inet_addr.c,v 1.7 2003/06/02 20:18:35 millert Exp $   */
 /*
 * Copyright (c) 1983, 1990, 1993
@@ -51,19 +49,12 @@
 * --Copyright--
 */
+/* OPENBSD ORIGINAL: lib/libc/net/inet_addr.c */
 #include "includes.h"
 #if !defined(HAVE_INET_ATON)
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)inet_addr.c 8.1 (Berkeley) 6/17/93";
-static char rcsid[] = "$From: inet_addr.c,v 8.5 1996/08/05 08:31:35 vixie Exp $";
-#else
-static char rcsid[] = "$OpenBSD: inet_addr.c,v 1.7 2003/06/02 20:18:35 millert Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
 #include <sys/types.h>
 #include <sys/param.h>
 #include <netinet/in.h>
@@ -76,8 +67,7 @@ static char rcsid[] = "$OpenBSD: inet_addr.c,v 1.7 2003/06/02 20:18:35 millert E
 * The value returned is in network order.
 */
 in_addr_t
-inet_addr(cp)
+inet_addr(const char *cp)
-        register const char *cp;
 {
        struct in_addr val;
@@ -97,11 +87,11 @@ inet_addr(cp)
 int
 inet_aton(const char *cp, struct in_addr *addr)
 {
-        register u_int32_t val;
+        u_int32_t val;
-        register int base, n;
+        int base, n;
-        register char c;
+        char c;
-        unsigned int parts[4];
+        u_int parts[4];
-        register unsigned int *pp = parts;
+        u_int *pp = parts;
        c = *cp;
        for (;;) {
diff --git a/openbsd-compat/inet_ntoa.c b/openbsd-compat/inet_ntoa.c
index dc010dc53..0eb7b3bd7 100644
--- a/openbsd-compat/inet_ntoa.c
+++ b/openbsd-compat/inet_ntoa.c
@@ -1,5 +1,4 @@
-/* OPENBSD ORIGINAL: lib/libc/net/inet_ntoa.c */
+/*      $OpenBSD: inet_ntoa.c,v 1.6 2005/08/06 20:30:03 espie Exp $ */
 /*
 * Copyright (c) 1983, 1993
 *      The Regents of the University of California.  All rights reserved.
@@ -29,14 +28,12 @@
 * SUCH DAMAGE.
 */
+/* OPENBSD ORIGINAL: lib/libc/net/inet_ntoa.c */
 #include "includes.h"
 #if defined(BROKEN_INET_NTOA) || !defined(HAVE_INET_NTOA)
-#if defined(LIBC_SCCS) && !defined(lint)
-static char rcsid[] = "$OpenBSD: inet_ntoa.c,v 1.4 2003/06/02 20:18:35 millert Exp $";
-#endif /* LIBC_SCCS and not lint */
 /*
 * Convert network-format internet address
 * to base 256 d.d.d.d representation.
@@ -46,10 +43,11 @@ static char rcsid[] = "$OpenBSD: inet_ntoa.c,v 1.4 2003/06/02 20:18:35 millert E
 #include <arpa/inet.h>
 #include <stdio.h>
-char *inet_ntoa(struct in_addr in)
+char *
+inet_ntoa(struct in_addr in)
 {
        static char b[18];
-        register char *p;
+        char *p;
        p = (char *)&in;
 #define UC(b)   (((int)b)&0xff)
diff --git a/openbsd-compat/inet_ntop.c b/openbsd-compat/inet_ntop.c
index 47796c370..e7ca4b7f8 100644
--- a/openbsd-compat/inet_ntop.c
+++ b/openbsd-compat/inet_ntop.c
@@ -1,6 +1,4 @@
-/* OPENBSD ORIGINAL: lib/libc/net/inet_ntop.c */
+/*      $OpenBSD: inet_ntop.c,v 1.7 2005/08/06 20:30:03 espie Exp $     */
-/*      $OpenBSD: inet_ntop.c,v 1.5 2002/08/23 16:27:31 itojun Exp $    */
 /* Copyright (c) 1996 by Internet Software Consortium.
 *
@@ -18,18 +16,12 @@
 * SOFTWARE.
 */
+/* OPENBSD ORIGINAL: lib/libc/net/inet_ntop.c */
 #include "includes.h"
 #ifndef HAVE_INET_NTOP
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char rcsid[] = "$From: inet_ntop.c,v 8.7 1996/08/05 08:41:18 vixie Exp $";
-#else
-static char rcsid[] = "$OpenBSD: inet_ntop.c,v 1.5 2002/08/23 16:27:31 itojun Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
 #include <sys/param.h>
 #include <sys/types.h>
 #include <sys/socket.h>
@@ -65,11 +57,7 @@ static const char *inet_ntop6(const u_char *src, char *dst, size_t size);
 *      Paul Vixie, 1996.
 */
 const char *
-inet_ntop(af, src, dst, size)
+inet_ntop(int af, const void *src, char *dst, size_t size)
-        int af;
-        const void *src;
-        char *dst;
-        size_t size;
 {
        switch (af) {
        case AF_INET:
@@ -95,10 +83,7 @@ inet_ntop(af, src, dst, size)
 *      Paul Vixie, 1996.
 */
 static const char *
-inet_ntop4(src, dst, size)
+inet_ntop4(const u_char *src, char *dst, size_t size)
-        const u_char *src;
-        char *dst;
-        size_t size;
 {
        static const char fmt[] = "%u.%u.%u.%u";
        char tmp[sizeof "255.255.255.255"];
@@ -120,10 +105,7 @@ inet_ntop4(src, dst, size)
 *      Paul Vixie, 1996.
 */
 static const char *
-inet_ntop6(src, dst, size)
+inet_ntop6(const u_char *src, char *dst, size_t size)
-        const u_char *src;
-        char *dst;
-        size_t size;
 {
        /*
         * Note that int32_t and int16_t need only be "at least" large enough
diff --git a/openbsd-compat/mktemp.c b/openbsd-compat/mktemp.c
index 969f69580..88e04c520 100644
--- a/openbsd-compat/mktemp.c
+++ b/openbsd-compat/mktemp.c
@@ -1,8 +1,7 @@
-/* OPENBSD ORIGINAL: lib/libc/stdio/mktemp.c */
 /* THIS FILE HAS BEEN MODIFIED FROM THE ORIGINAL OPENBSD SOURCE */
 /* Changes: Removed mktemp */
+/*      $OpenBSD: mktemp.c,v 1.19 2005/08/08 08:05:36 espie Exp $ */
 /*
 * Copyright (c) 1987, 1993
 *      The Regents of the University of California.  All rights reserved.
@@ -32,20 +31,16 @@
 * SUCH DAMAGE.
 */
+/* OPENBSD ORIGINAL: lib/libc/stdio/mktemp.c */
 #include "includes.h"
 #if !defined(HAVE_MKDTEMP) || defined(HAVE_STRICT_MKSTEMP)
-#if defined(LIBC_SCCS) && !defined(lint)
-static char rcsid[] = "$OpenBSD: mktemp.c,v 1.17 2003/06/02 20:18:37 millert Exp $";
-#endif /* LIBC_SCCS and not lint */
 static int _gettemp(char *, int *, int, int);
 int
-mkstemps(path, slen)
+mkstemps(char *path, int slen)
-        char *path;
-        int slen;
 {
        int fd;
@@ -53,8 +48,7 @@ mkstemps(path, slen)
 }
 int
-mkstemp(path)
+mkstemp(char *path)
-        char *path;
 {
        int fd;
@@ -62,8 +56,7 @@ mkstemp(path)
 }
 char *
-mkdtemp(path)
+mkdtemp(char *path)
-        char *path;
 {
        return(_gettemp(path, (int *)NULL, 1, 0) ? path : (char *)NULL);
 }
diff --git a/openbsd-compat/openbsd-compat.h b/openbsd-compat/openbsd-compat.h
index ba68bc27e..1a3027353 100644
--- a/openbsd-compat/openbsd-compat.h
+++ b/openbsd-compat/openbsd-compat.h
@@ -1,4 +1,4 @@
-/* $Id: openbsd-compat.h,v 1.30 2005/08/26 20:15:20 tim Exp $ */
+/* $Id: openbsd-compat.h,v 1.33 2005/12/31 05:33:37 djm Exp $ */
 /*
 * Copyright (c) 1999-2003 Damien Miller.  All rights reserved.
@@ -142,6 +142,10 @@ unsigned int arc4random(void);
 void arc4random_stir(void);
 #endif /* !HAVE_ARC4RANDOM */
+#ifndef HAVE_ASPRINTF
+int asprintf(char **, const char *, ...);
+#endif 
 #ifndef HAVE_OPENPTY
 int openpty(int *, int *, char *, struct termios *, struct winsize *);
 #endif /* HAVE_OPENPTY */
@@ -152,10 +156,18 @@ int openpty(int *, int *, char *, struct termios *, struct winsize *);
 int snprintf(char *, size_t, const char *, ...);
 #endif 
+#ifndef HAVE_STRTOLL
+long long strtoll(const char *, char **, int);
+#endif
 #ifndef HAVE_STRTONUM
 long long strtonum(const char *, long long, long long, const char **);
 #endif
+#ifndef HAVE_VASPRINTF
+int vasprintf(char **, const char *, va_list);
+#endif
 #ifndef HAVE_VSNPRINTF
 int vsnprintf(char *, size_t, const char *, va_list);
 #endif
@@ -174,5 +186,6 @@ char *shadow_pw(struct passwd *pw);
 #include "port-irix.h"
 #include "port-aix.h"
 #include "port-uw.h"
+#include "port-tun.h"
 #endif /* _OPENBSD_COMPAT_H */
diff --git a/openbsd-compat/openssl-compat.h b/openbsd-compat/openssl-compat.h
index d9b2fa55f..8a015ec43 100644
--- a/openbsd-compat/openssl-compat.h
+++ b/openbsd-compat/openssl-compat.h
@@ -1,4 +1,4 @@
-/* $Id: openssl-compat.h,v 1.1 2005/06/09 11:45:11 dtucker Exp $ */
+/* $Id: openssl-compat.h,v 1.3 2005/12/19 06:40:40 dtucker Exp $ */
 /*
 * Copyright (c) 2005 Darren Tucker <dtucker@zip.com.au>
@@ -24,7 +24,11 @@
 # define EVP_CIPHER_CTX_get_app_data(e)         ((e)->app_data)
 #endif
-#if OPENSSL_VERSION_NUMBER < 0x00907000L
+#if (OPENSSL_VERSION_NUMBER < 0x00907000L) || defined(OPENSSL_LOBOTOMISED_AES)
+# define USE_BUILTIN_RIJNDAEL
+#endif
+#ifdef USE_BUILTIN_RIJNDAEL
 # define EVP_aes_128_cbc evp_rijndael
 # define EVP_aes_192_cbc evp_rijndael
 # define EVP_aes_256_cbc evp_rijndael
@@ -43,7 +47,12 @@ extern const EVP_CIPHER *evp_acss(void);
 #endif
 /*
- * insert comment here
+ * We overload some of the OpenSSL crypto functions with ssh_* equivalents
+ * which cater for older and/or less featureful OpenSSL version.
+ *
+ * In order for the compat library to call the real functions, it must
+ * define SSH_DONT_OVERLOAD_OPENSSL_FUNCS before including this file and
+ * implement the ssh_* equivalents.
 */
 #ifdef SSH_OLD_EVP
diff --git a/openbsd-compat/port-tun.c b/openbsd-compat/port-tun.c
new file mode 100644
index 000000000..31921615f
--- /dev/null
+++ b/openbsd-compat/port-tun.c
@@ -0,0 +1,252 @@
+/*
+ * Copyright (c) 2005 Reyk Floeter <reyk@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#include "includes.h"
+#include "log.h"
+#include "misc.h"
+#include "bufaux.h"
+/*
+ * This is the portable version of the SSH tunnel forwarding, it
+ * uses some preprocessor definitions for various platform-specific
+ * settings.
+ *
+ * SSH_TUN_LINUX        Use the (newer) Linux tun/tap device
+ * SSH_TUN_COMPAT_AF    Translate the OpenBSD address family
+ * SSH_TUN_PREPEND_AF   Prepend/remove the address family
+ */
+/*
+ * System-specific tunnel open function
+ */
+#if defined(SSH_TUN_LINUX)
+#include <linux/if.h>
+#include <linux/if_tun.h>
+int
+sys_tun_open(int tun, int mode)
+{
+        struct ifreq ifr;
+        int fd = -1;
+        const char *name = NULL;
+        if ((fd = open("/dev/net/tun", O_RDWR)) == -1) {
+                debug("%s: failed to open tunnel control interface: %s",
+                    __func__, strerror(errno));
+                return (-1);
+        }
+        bzero(&ifr, sizeof(ifr));       
+        if (mode == SSH_TUNMODE_ETHERNET) {
+                ifr.ifr_flags = IFF_TAP;
+                name = "tap%d";
+        } else {
+                ifr.ifr_flags = IFF_TUN;
+                name = "tun%d";
+        }
+        ifr.ifr_flags |= IFF_NO_PI;
+        if (tun != SSH_TUNID_ANY) {
+                if (tun > SSH_TUNID_MAX) {
+                        debug("%s: invalid tunnel id %x: %s", __func__,
+                            tun, strerror(errno));
+                        goto failed;
+                }
+                snprintf(ifr.ifr_name, sizeof(ifr.ifr_name), name, tun);
+        }
+        if (ioctl(fd, TUNSETIFF, &ifr) == -1) {
+                debug("%s: failed to configure tunnel (mode %d): %s", __func__,
+                    mode, strerror(errno));
+                goto failed;
+        }
+        if (tun == SSH_TUNID_ANY)
+                debug("%s: tunnel mode %d fd %d", __func__, mode, fd);
+        else
+                debug("%s: %s mode %d fd %d", __func__, ifr.ifr_name, mode, fd);
+        return (fd);
+ failed:
+        close(fd);
+        return (-1);
+}
+#endif /* SSH_TUN_LINUX */
+#ifdef SSH_TUN_FREEBSD
+#include <sys/socket.h>
+#include <net/if.h>
+#include <net/if_tun.h>
+int
+sys_tun_open(int tun, int mode)
+{
+        struct ifreq ifr;
+        char name[100];
+        int fd = -1, sock, flag;
+        const char *tunbase = "tun";
+        if (mode == SSH_TUNMODE_ETHERNET) {
+#ifdef SSH_TUN_NO_L2
+                debug("%s: no layer 2 tunnelling support", __func__);
+                return (-1);
+#else
+                tunbase = "tap";
+#endif
+        }
+        /* Open the tunnel device */
+        if (tun <= SSH_TUNID_MAX) {
+                snprintf(name, sizeof(name), "/dev/%s%d", tunbase, tun);
+                fd = open(name, O_RDWR);
+        } else if (tun == SSH_TUNID_ANY) {
+                for (tun = 100; tun >= 0; tun--) {
+                        snprintf(name, sizeof(name), "/dev/%s%d",
+                            tunbase, tun);
+                        if ((fd = open(name, O_RDWR)) >= 0)
+                                break;
+                }
+        } else {
+                debug("%s: invalid tunnel %u\n", __func__, tun);
+                return (-1);
+        }
+        if (fd < 0) {
+                debug("%s: %s open failed: %s", __func__, name,
+                    strerror(errno));
+                return (-1);
+        }
+        /* Turn on tunnel headers */
+        flag = 1;
+#if defined(TUNSIFHEAD) && !defined(SSH_TUN_PREPEND_AF)
+        if (mode != SSH_TUNMODE_ETHERNET &&
+            ioctl(fd, TUNSIFHEAD, &flag) == -1) {
+                debug("%s: ioctl(%d, TUNSIFHEAD, 1): %s", __func__, fd,
+                    strerror(errno));
+                close(fd);
+        }
+#endif
+        debug("%s: %s mode %d fd %d", __func__, name, mode, fd);
+        /* Set the tunnel device operation mode */
+        snprintf(ifr.ifr_name, sizeof(ifr.ifr_name), "%s%d", tunbase, tun);
+        if ((sock = socket(PF_UNIX, SOCK_STREAM, 0)) == -1)
+                goto failed;
+        if (ioctl(sock, SIOCGIFFLAGS, &ifr) == -1)
+                goto failed;
+        ifr.ifr_flags |= IFF_UP;
+        if (ioctl(sock, SIOCSIFFLAGS, &ifr) == -1)
+                goto failed;
+        close(sock);
+        return (fd);
+ failed:
+        if (fd >= 0)
+                close(fd);
+        if (sock >= 0)
+                close(sock);
+        debug("%s: failed to set %s mode %d: %s", __func__, name,
+            mode, strerror(errno));
+        return (-1);
+}
+#endif /* SSH_TUN_FREEBSD */
+/*
+ * System-specific channel filters
+ */
+#if defined(SSH_TUN_FILTER)
+#define OPENBSD_AF_INET         2
+#define OPENBSD_AF_INET6        24
+int
+sys_tun_infilter(struct Channel *c, char *buf, int len)
+{
+#if defined(SSH_TUN_PREPEND_AF)
+        char rbuf[CHAN_RBUF];
+        struct ip *iph;
+#endif
+        u_int32_t *af;
+        char *ptr = buf;
+#if defined(SSH_TUN_PREPEND_AF)
+        if (len <= 0 || len > (int)(sizeof(rbuf) - sizeof(*af)))
+                return (-1);
+        ptr = (char *)&rbuf[0];
+        bcopy(buf, ptr + sizeof(u_int32_t), len);
+        len += sizeof(u_int32_t);
+        af = (u_int32_t *)ptr;
+        iph = (struct ip *)(ptr + sizeof(u_int32_t));
+        switch (iph->ip_v) {
+        case 6:
+                *af = AF_INET6;
+                break;
+        case 4:
+        default:
+                *af = AF_INET;
+                break;
+        }
+#endif
+#if defined(SSH_TUN_COMPAT_AF)
+        if (len < (int)sizeof(u_int32_t))
+                return (-1);
+        af = (u_int32_t *)ptr;
+        if (*af == htonl(AF_INET6))
+                *af = htonl(OPENBSD_AF_INET6);
+        else
+                *af = htonl(OPENBSD_AF_INET);
+#endif
+        buffer_put_string(&c->input, ptr, len);
+        return (0);
+}
+u_char *
+sys_tun_outfilter(struct Channel *c, u_char **data, u_int *dlen)
+{
+        u_char *buf;
+        u_int32_t *af;
+        *data = buffer_get_string(&c->output, dlen);
+        if (*dlen < sizeof(*af))
+                return (NULL);
+        buf = *data;
+#if defined(SSH_TUN_PREPEND_AF)
+        *dlen -= sizeof(u_int32_t);
+        buf = *data + sizeof(u_int32_t);
+#elif defined(SSH_TUN_COMPAT_AF)
+        af = ntohl(*(u_int32_t *)buf);
+        if (*af == OPENBSD_AF_INET6)
+                *af = htonl(AF_INET6);
+        else
+                *af = htonl(AF_INET);
+#endif
+        return (buf);
+}
+#endif /* SSH_TUN_FILTER */
diff --git a/openbsd-compat/port-tun.h b/openbsd-compat/port-tun.h
new file mode 100644
index 000000000..86d9272b4
--- /dev/null
+++ b/openbsd-compat/port-tun.h
@@ -0,0 +1,33 @@
+/*
+ * Copyright (c) 2005 Reyk Floeter <reyk@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifndef _PORT_TUN_H
+#define _PORT_TUN_H
+#include "channels.h"
+#if defined(SSH_TUN_LINUX) || defined(SSH_TUN_FREEBSD)
+# define CUSTOM_SYS_TUN_OPEN
+int       sys_tun_open(int, int);
+#endif
+#if defined(SSH_TUN_COMPAT_AF) || defined(SSH_TUN_PREPEND_AF)
+# define SSH_TUN_FILTER
+int      sys_tun_infilter(struct Channel *, char *, int);
+u_char  *sys_tun_outfilter(struct Channel *, u_char **, u_int *);
+#endif
+#endif
diff --git a/openbsd-compat/port-uw.c b/openbsd-compat/port-uw.c
index d881ff028..c64427121 100644
--- a/openbsd-compat/port-uw.c
+++ b/openbsd-compat/port-uw.c
@@ -25,7 +25,7 @@
 #include "includes.h"
-#if defined(HAVE_LIBIAF)  &&  !defined(BROKEN_LIBIAF)
+#ifdef HAVE_LIBIAF
 #ifdef HAVE_CRYPT_H
 #include <crypt.h>
 #endif
@@ -42,7 +42,6 @@ int
 sys_auth_passwd(Authctxt *authctxt, const char *password)
 {
        struct passwd *pw = authctxt->pw;
-        char *encrypted_password;
        char *salt;
        int result;
@@ -55,21 +54,24 @@ sys_auth_passwd(Authctxt *authctxt, const char *password)
        /* Encrypt the candidate password using the proper salt. */
        salt = (pw_password[0] && pw_password[1]) ? pw_password : "xx";
-#ifdef UNIXWARE_LONG_PASSWORDS
-        if (!nischeck(pw->pw_name))
-                encrypted_password = bigcrypt(password, salt);
-        else
-#endif /* UNIXWARE_LONG_PASSWORDS */
-                encrypted_password = xcrypt(password, salt);
        /*
         * Authentication is accepted if the encrypted passwords
         * are identical.
         */
-        result = (strcmp(encrypted_password, pw_password) == 0);
+#ifdef UNIXWARE_LONG_PASSWORDS
+        if (!nischeck(pw->pw_name)) {
+                result = ((strcmp(bigcrypt(password, salt), pw_password) == 0)
+                ||  (strcmp(osr5bigcrypt(password, salt), pw_password) == 0));
+        }
+        else
+#endif /* UNIXWARE_LONG_PASSWORDS */
+                result = (strcmp(xcrypt(password, salt), pw_password) == 0);
+#if !defined(BROKEN_LIBIAF)
        if (authctxt->valid)
                free(pw_password);
+#endif
        return(result);
 }
@@ -114,6 +116,7 @@ nischeck(char *namep)
        functions that call shadow_pw() will need to free
 */
+#if !defined(BROKEN_LIBIAF)
 char *
 get_iaf_password(struct passwd *pw)
 {
@@ -130,5 +133,6 @@ get_iaf_password(struct passwd *pw)
        else
                fatal("ia_openinfo: Unable to open the shadow passwd file");
 }
-#endif /* HAVE_LIBIAF  && !BROKEN_LIBIAF */
+#endif /* !BROKEN_LIBIAF */
+#endif /* HAVE_LIBIAF */
diff --git a/openbsd-compat/readpassphrase.c b/openbsd-compat/readpassphrase.c
index eb060bdbf..919c0174a 100644
--- a/openbsd-compat/readpassphrase.c
+++ b/openbsd-compat/readpassphrase.c
@@ -1,6 +1,4 @@
-/* OPENBSD ORIGINAL: lib/libc/gen/readpassphrase.c */
+/*      $OpenBSD: readpassphrase.c,v 1.18 2005/08/08 08:05:34 espie Exp $       */
-/*      $OpenBSD: readpassphrase.c,v 1.16 2003/06/17 21:56:23 millert Exp $     */
 /*
 * Copyright (c) 2000-2002 Todd C. Miller <Todd.Miller@courtesan.com>
@@ -22,9 +20,7 @@
 * Materiel Command, USAF, under agreement number F39502-99-1-0512.
 */
-#if defined(LIBC_SCCS) && !defined(lint)
+/* OPENBSD ORIGINAL: lib/libc/gen/readpassphrase.c */
-static const char rcsid[] = "$OpenBSD: readpassphrase.c,v 1.16 2003/06/17 21:56:23 millert Exp $";
-#endif /* LIBC_SCCS and not lint */
 #include "includes.h"
diff --git a/openbsd-compat/readpassphrase.h b/openbsd-compat/readpassphrase.h
index 178edf346..5fd7c5d77 100644
--- a/openbsd-compat/readpassphrase.h
+++ b/openbsd-compat/readpassphrase.h
@@ -1,34 +1,27 @@
-/* OPENBSD ORIGINAL: include/readpassphrase.h */
+/*      $OpenBSD: readpassphrase.h,v 1.5 2003/06/17 21:56:23 millert Exp $      */
-/*      $OpenBSD: readpassphrase.h,v 1.3 2002/06/28 12:32:22 millert Exp $      */
 /*
- * Copyright (c) 2000 Todd C. Miller <Todd.Miller@courtesan.com>
+ * Copyright (c) 2000, 2002 Todd C. Miller <Todd.Miller@courtesan.com>
- * All rights reserved.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
 *
- * Redistribution and use in source and binary forms, with or without
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * modification, are permitted provided that the following conditions
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * are met:
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * 1. Redistributions of source code must retain the above copyright
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- *    notice, this list of conditions and the following disclaimer.
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * 2. Redistributions in binary form must reproduce the above copyright
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- *    notice, this list of conditions and the following disclaimer in the
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- *    documentation and/or other materials provided with the distribution.
- * 3. The name of the author may not be used to endorse or promote products
- *    derived from this software without specific prior written permission.
 *
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * Sponsored in part by the Defense Advanced Research Projects
- * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * Agency (DARPA) and Air Force Research Laboratory, Air Force
- * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL
+ * Materiel Command, USAF, under agreement number F39502-99-1-0512.
- * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
- * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
- * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
- * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
- * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */
+/* OPENBSD ORIGINAL: include/readpassphrase.h */
 #ifndef _READPASSPHRASE_H_
 #define _READPASSPHRASE_H_
diff --git a/openbsd-compat/realpath.c b/openbsd-compat/realpath.c
index 8430bec24..b6120d034 100644
--- a/openbsd-compat/realpath.c
+++ b/openbsd-compat/realpath.c
@@ -1,5 +1,4 @@
-/* OPENBSD ORIGINAL: lib/libc/stdlib/realpath.c */
+/*      $OpenBSD: realpath.c,v 1.13 2005/08/08 08:05:37 espie Exp $ */
 /*
 * Copyright (c) 2003 Constantin S. Svintsoff <kostik@iclub.nsu.ru>
 *
@@ -28,6 +27,8 @@
 * SUCH DAMAGE.
 */
+/* OPENBSD ORIGINAL: lib/libc/stdlib/realpath.c */
 #include "includes.h"
 #if !defined(HAVE_REALPATH) || defined(BROKEN_REALPATH)
diff --git a/openbsd-compat/rresvport.c b/openbsd-compat/rresvport.c
index 75167065c..71cf6e6eb 100644
--- a/openbsd-compat/rresvport.c
+++ b/openbsd-compat/rresvport.c
@@ -1,5 +1,4 @@
-/* OPENBSD ORIGINAL: lib/libc/net/rresvport.c */
+/* $OpenBSD: rresvport.c,v 1.9 2005/11/10 10:00:17 espie Exp $ */
 /*
 * Copyright (c) 1995, 1996, 1998 Theo de Raadt.  All rights reserved.
 * Copyright (c) 1983, 1993, 1994
@@ -30,26 +29,21 @@
 * SUCH DAMAGE.
 */
+/* OPENBSD ORIGINAL: lib/libc/net/rresvport.c */
 #include "includes.h"
 #ifndef HAVE_RRESVPORT_AF
-#if defined(LIBC_SCCS) && !defined(lint)
-static char *rcsid = "$OpenBSD: rresvport.c,v 1.6 2003/06/03 02:11:35 deraadt Exp $";
-#endif /* LIBC_SCCS and not lint */
-#include "includes.h"
 #if 0
 int
-rresvport(alport)
+rresvport(int *alport)
-        int *alport;
 {
        return rresvport_af(alport, AF_INET);
 }
 #endif
-int 
+int
 rresvport_af(int *alport, sa_family_t af)
 {
        struct sockaddr_storage ss;
diff --git a/openbsd-compat/setenv.c b/openbsd-compat/setenv.c
index c3a86c651..b52a99c2c 100644
--- a/openbsd-compat/setenv.c
+++ b/openbsd-compat/setenv.c
@@ -1,5 +1,4 @@
-/* OPENBSD ORIGINAL: lib/libc/stdlib/setenv.c */
+/*      $OpenBSD: setenv.c,v 1.9 2005/08/08 08:05:37 espie Exp $ */
 /*
 * Copyright (c) 1987 Regents of the University of California.
 * All rights reserved.
@@ -29,36 +28,31 @@
 * SUCH DAMAGE.
 */
+/* OPENBSD ORIGINAL: lib/libc/stdlib/setenv.c */
 #include "includes.h"
 #if !defined(HAVE_SETENV) || !defined(HAVE_UNSETENV)
-#if defined(LIBC_SCCS) && !defined(lint)
-static char *rcsid = "$OpenBSD: setenv.c,v 1.6 2003/06/02 20:18:38 millert Exp $";
-#endif /* LIBC_SCCS and not lint */
 #include <stdlib.h>
 #include <string.h>
-char *__findenv(const char *name, int *offset);
+extern char **environ;
+/* OpenSSH Portable: __findenv is from getenv.c rev 1.8, made static */
 /*
 * __findenv --
 *      Returns pointer to value associated with name, if any, else NULL.
 *      Sets offset to be the offset of the name/value combination in the
 *      environmental array, for use by setenv(3) and unsetenv(3).
 *      Explicitly removes '=' in argument name.
- *
- *      This routine *should* be a static; don't use it.
 */
-char *
+static char *
-__findenv(name, offset)
+__findenv(const char *name, int *offset)
-        register const char *name;
-        int *offset;
 {
        extern char **environ;
-        register int len, i;
+        int len, i;
-        register const char *np;
+        const char *np;
-        register char **p, *cp;
+        char **p, *cp;
        if (name == NULL || environ == NULL)
                return (NULL);
@@ -84,14 +78,10 @@ __findenv(name, offset)
 *      "value".  If rewrite is set, replace any current value.
 */
 int
-setenv(name, value, rewrite)
+setenv(const char *name, const char *value, int rewrite)
-        register const char *name;
-        register const char *value;
-        int rewrite;
 {
-        extern char **environ;
+        static char **lastenv;                  /* last value of environ */
-        static int alloced;                     /* if allocated space before */
+        char *C;
-        register char *C;
        int l_value, offset;
        if (*value == '=')                      /* no `=' in value */
@@ -106,30 +96,23 @@ setenv(name, value, rewrite)
                        return (0);
                }
        } else {                                        /* create new slot */
-                register int    cnt;
+                size_t cnt;
-                register char   **P;
+                char **P;
-                for (P = environ, cnt = 0; *P; ++P, ++cnt);
+                for (P = environ; *P != NULL; P++)
-                if (alloced) {                  /* just increase size */
+                        ;
-                        P = (char **)realloc((void *)environ,
+                cnt = P - environ;
-                            (size_t)(sizeof(char *) * (cnt + 2)));
+                P = (char **)realloc(lastenv, sizeof(char *) * (cnt + 2));
-                        if (!P)
+                if (!P)
-                                return (-1);
+                        return (-1);
-                        environ = P;
+                if (lastenv != environ)
-                }
+                        memcpy(P, environ, cnt * sizeof(char *));
-                else {                          /* get new space */
+                lastenv = environ = P;
-                        alloced = 1;            /* copy old entries into it */
-                        P = (char **)malloc((size_t)(sizeof(char *) *
-                            (cnt + 2)));
-                        if (!P)
-                                return (-1);
-                        memmove(P, environ, cnt * sizeof(char *));
-                        environ = P;
-                }
-                environ[cnt + 1] = NULL;
                offset = cnt;
+                environ[cnt + 1] = NULL;
        }
-        for (C = (char *)name; *C && *C != '='; ++C);   /* no `=' in name */
+        for (C = (char *)name; *C && *C != '='; ++C)
+                ;                               /* no `=' in name */
        if (!(environ[offset] =                 /* name + `=' + value */
            malloc((size_t)((int)(C - name) + l_value + 2))))
                return (-1);
@@ -147,15 +130,12 @@ setenv(name, value, rewrite)
 *      Delete environmental variable "name".
 */
 void
-unsetenv(name)
+unsetenv(const char *name)
-        const char      *name;
 {
-        extern char **environ;
+        char **P;
-        register char **P;
        int offset;
-        char *__findenv();
-        while (__findenv(name, &offset))                /* if set multiple times */
+        while (__findenv(name, &offset))        /* if set multiple times */
                for (P = &environ[offset];; ++P)
                        if (!(*P = *(P + 1)))
                                break;
diff --git a/openbsd-compat/sigact.c b/openbsd-compat/sigact.c
index 2772ac574..8b8e4dd2c 100644
--- a/openbsd-compat/sigact.c
+++ b/openbsd-compat/sigact.c
@@ -1,9 +1,7 @@
-/* OPENBSD ORIGINAL: lib/libcurses/base/sigaction.c */
+/*      $OpenBSD: sigaction.c,v 1.4 2001/01/22 18:01:48 millert Exp $   */
-/*      $OpenBSD: sigaction.c,v 1.3 1999/06/27 08:14:21 millert Exp $   */
 /****************************************************************************
- * Copyright (c) 1998 Free Software Foundation, Inc.                        *
+ * Copyright (c) 1998,2000 Free Software Foundation, Inc.                   *
 *                                                                          *
 * Permission is hereby granted, free of charge, to any person obtaining a  *
 * copy of this software and associated documentation files (the            *
@@ -35,6 +33,8 @@
 *     and: Eric S. Raymond <esr@snark.thyrsus.com>                         *
 ****************************************************************************/
+/* OPENBSD ORIGINAL: lib/libcurses/base/sigaction.c */
 #include "includes.h"
 #include <signal.h>
 #include "sigact.h"
diff --git a/openbsd-compat/sigact.h b/openbsd-compat/sigact.h
index b37c1f84a..db96d0a5c 100644
--- a/openbsd-compat/sigact.h
+++ b/openbsd-compat/sigact.h
@@ -1,7 +1,7 @@
-/*      $OpenBSD: SigAction.h,v 1.2 1999/06/27 08:15:19 millert Exp $   */
+/*      $OpenBSD: SigAction.h,v 1.3 2001/01/22 18:01:32 millert Exp $   */
 /****************************************************************************
- * Copyright (c) 1998 Free Software Foundation, Inc.                        *
+ * Copyright (c) 1998,2000 Free Software Foundation, Inc.                   *
 *                                                                          *
 * Permission is hereby granted, free of charge, to any person obtaining a  *
 * copy of this software and associated documentation files (the            *
@@ -34,12 +34,14 @@
 ****************************************************************************/
 /*
- * $From: SigAction.h,v 1.5 1999/06/19 23:00:54 tom Exp $
+ * $From: SigAction.h,v 1.6 2000/12/10 02:36:10 tom Exp $
 *
 * This file exists to handle non-POSIX systems which don't have <unistd.h>,
 * and usually no sigaction() nor <termios.h>
 */
+/* OPENBSD ORIGINAL: lib/libcurses/SigAction.h */
 #ifndef _SIGACTION_H
 #define _SIGACTION_H
diff --git a/openbsd-compat/strlcat.c b/openbsd-compat/strlcat.c
index 70f01cb2a..bcc1b61ad 100644
--- a/openbsd-compat/strlcat.c
+++ b/openbsd-compat/strlcat.c
@@ -1,6 +1,4 @@
-/* OPENBSD ORIGINAL: lib/libc/string/strlcat.c */
+/*      $OpenBSD: strlcat.c,v 1.13 2005/08/08 08:05:37 espie Exp $      */
-/*      $OpenBSD: strlcat.c,v 1.11 2003/06/17 21:56:24 millert Exp $    */
 /*
 * Copyright (c) 1998 Todd C. Miller <Todd.Miller@courtesan.com>
@@ -18,13 +16,11 @@
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */
+/* OPENBSD ORIGINAL: lib/libc/string/strlcat.c */
 #include "includes.h"
 #ifndef HAVE_STRLCAT
-#if defined(LIBC_SCCS) && !defined(lint)
-static char *rcsid = "$OpenBSD: strlcat.c,v 1.11 2003/06/17 21:56:24 millert Exp $";
-#endif /* LIBC_SCCS and not lint */
 #include <sys/types.h>
 #include <string.h>
@@ -38,9 +34,9 @@ static char *rcsid = "$OpenBSD: strlcat.c,v 1.11 2003/06/17 21:56:24 millert Exp
 size_t
 strlcat(char *dst, const char *src, size_t siz)
 {
-        register char *d = dst;
+        char *d = dst;
-        register const char *s = src;
+        const char *s = src;
-        register size_t n = siz;
+        size_t n = siz;
        size_t dlen;
        /* Find the end of dst and adjust bytes left but don't go past end */
diff --git a/openbsd-compat/strlcpy.c b/openbsd-compat/strlcpy.c
index ccfa12a0a..679a5b291 100644
--- a/openbsd-compat/strlcpy.c
+++ b/openbsd-compat/strlcpy.c
@@ -1,6 +1,4 @@
-/* OPENBSD ORIGINAL: lib/libc/string/strlcpy.c */
+/*      $OpenBSD: strlcpy.c,v 1.10 2005/08/08 08:05:37 espie Exp $      */
-/*      $OpenBSD: strlcpy.c,v 1.8 2003/06/17 21:56:24 millert Exp $     */
 /*
 * Copyright (c) 1998 Todd C. Miller <Todd.Miller@courtesan.com>
@@ -18,13 +16,11 @@
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */
+/* OPENBSD ORIGINAL: lib/libc/string/strlcpy.c */
 #include "includes.h"
 #ifndef HAVE_STRLCPY
-#if defined(LIBC_SCCS) && !defined(lint)
-static char *rcsid = "$OpenBSD: strlcpy.c,v 1.8 2003/06/17 21:56:24 millert Exp $";
-#endif /* LIBC_SCCS and not lint */
 #include <sys/types.h>
 #include <string.h>
@@ -36,9 +32,9 @@ static char *rcsid = "$OpenBSD: strlcpy.c,v 1.8 2003/06/17 21:56:24 millert Exp
 size_t
 strlcpy(char *dst, const char *src, size_t siz)
 {
-        register char *d = dst;
+        char *d = dst;
-        register const char *s = src;
+        const char *s = src;
-        register size_t n = siz;
+        size_t n = siz;
        /* Copy as many bytes as will fit */
        if (n != 0 && --n != 0) {
diff --git a/openbsd-compat/strmode.c b/openbsd-compat/strmode.c
index ea8d515e3..4a8161422 100644
--- a/openbsd-compat/strmode.c
+++ b/openbsd-compat/strmode.c
@@ -1,5 +1,4 @@
-/* OPENBSD ORIGINAL: lib/libc/string/strmode.c */
+/*      $OpenBSD: strmode.c,v 1.7 2005/08/08 08:05:37 espie Exp $ */
 /*-
 * Copyright (c) 1990 The Regents of the University of California.
 * All rights reserved.
@@ -29,13 +28,11 @@
 * SUCH DAMAGE.
 */
+/* OPENBSD ORIGINAL: lib/libc/string/strmode.c */
 #include "includes.h"
 #ifndef HAVE_STRMODE
-#if defined(LIBC_SCCS) && !defined(lint)
-static char *rcsid = "$OpenBSD: strmode.c,v 1.5 2003/06/11 21:08:16 deraadt Exp $";
-#endif /* LIBC_SCCS and not lint */
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <string.h>
@@ -72,11 +69,6 @@ strmode(int mode, char *p)
                *p++ = 'p';
                break;
 #endif
-#ifdef S_IFWHT
-        case S_IFWHT:                   /* whiteout */
-                *p++ = 'w';
-                break;
-#endif
        default:                        /* unknown */
                *p++ = '?';
                break;
diff --git a/openbsd-compat/strsep.c b/openbsd-compat/strsep.c
index 330d84ce1..b36eb8fda 100644
--- a/openbsd-compat/strsep.c
+++ b/openbsd-compat/strsep.c
@@ -1,6 +1,4 @@
-/* OPENBSD ORIGINAL: lib/libc/string/strsep.c */
+/*      $OpenBSD: strsep.c,v 1.6 2005/08/08 08:05:37 espie Exp $        */
-/*      $OpenBSD: strsep.c,v 1.5 2003/06/11 21:08:16 deraadt Exp $      */
 /*-
 * Copyright (c) 1990, 1993
@@ -31,6 +29,8 @@
 * SUCH DAMAGE.
 */
+/* OPENBSD ORIGINAL: lib/libc/string/strsep.c */
 #include "includes.h"
 #if !defined(HAVE_STRSEP)
@@ -38,14 +38,6 @@
 #include <string.h>
 #include <stdio.h>
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)strsep.c    8.1 (Berkeley) 6/4/93";
-#else
-static char *rcsid = "$OpenBSD: strsep.c,v 1.5 2003/06/11 21:08:16 deraadt Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
 /*
 * Get next token from string *stringp, where tokens are possibly-empty
 * strings separated by characters from delim.  
diff --git a/openbsd-compat/strtoll.c b/openbsd-compat/strtoll.c
index 60c276f8a..f62930388 100644
--- a/openbsd-compat/strtoll.c
+++ b/openbsd-compat/strtoll.c
@@ -1,5 +1,4 @@
-/* OPENBSD ORIGINAL: lib/libc/stdlib/strtoll.c */
+/* $OpenBSD: strtoll.c,v 1.6 2005/11/10 10:00:17 espie Exp $ */
 /*-
 * Copyright (c) 1992 The Regents of the University of California.
 * All rights reserved.
@@ -29,13 +28,11 @@
 * SUCH DAMAGE.
 */
+/* OPENBSD ORIGINAL: lib/libc/stdlib/strtoll.c */
 #include "includes.h"
 #ifndef HAVE_STRTOLL
-#if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$OpenBSD: strtoll.c,v 1.4 2005/03/30 18:51:49 pat Exp $";
-#endif /* LIBC_SCCS and not lint */
 #include <sys/types.h>
 #include <ctype.h>
diff --git a/openbsd-compat/strtonum.c b/openbsd-compat/strtonum.c
index b681ed83b..8ad0d0058 100644
--- a/openbsd-compat/strtonum.c
+++ b/openbsd-compat/strtonum.c
@@ -1,5 +1,3 @@
-/* OPENBSD ORIGINAL: lib/libc/stdlib/strtonum.c */
 /*      $OpenBSD: strtonum.c,v 1.6 2004/08/03 19:38:01 millert Exp $    */
 /*
@@ -19,6 +17,8 @@
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */
+/* OPENBSD ORIGINAL: lib/libc/stdlib/strtonum.c */
 #include "includes.h"
 #ifndef HAVE_STRTONUM
 #include <limits.h>
diff --git a/openbsd-compat/strtoul.c b/openbsd-compat/strtoul.c
index 24d0e253d..8219c8391 100644
--- a/openbsd-compat/strtoul.c
+++ b/openbsd-compat/strtoul.c
@@ -1,5 +1,4 @@
-/* OPENBSD ORIGINAL: lib/libc/stdlib/strtoul.c */
+/*      $OpenBSD: strtoul.c,v 1.7 2005/08/08 08:05:37 espie Exp $ */
 /*
 * Copyright (c) 1990 Regents of the University of California.
 * All rights reserved.
@@ -29,13 +28,11 @@
 * SUCH DAMAGE.
 */
+/* OPENBSD ORIGINAL: lib/libc/stdlib/strtoul.c */
 #include "includes.h"
 #ifndef HAVE_STRTOUL
-#if defined(LIBC_SCCS) && !defined(lint)
-static char *rcsid = "$OpenBSD: strtoul.c,v 1.5 2003/06/02 20:18:38 millert Exp $";
-#endif /* LIBC_SCCS and not lint */
 #include <ctype.h>
 #include <errno.h>
 #include <limits.h>
@@ -48,15 +45,12 @@ static char *rcsid = "$OpenBSD: strtoul.c,v 1.5 2003/06/02 20:18:38 millert Exp
 * alphabets and digits are each contiguous.
 */
 unsigned long
-strtoul(nptr, endptr, base)
+strtoul(const char *nptr, char **endptr, int base)
-        const char *nptr;
-        char **endptr;
-        register int base;
 {
-        register const char *s;
+        const char *s;
-        register unsigned long acc, cutoff;
+        unsigned long acc, cutoff;
-        register int c;
+        int c;
-        register int neg, any, cutlim;
+        int neg, any, cutlim;
        /*
         * See strtol for comments as to the logic used.
diff --git a/openbsd-compat/sys-queue.h b/openbsd-compat/sys-queue.h
index c49a94650..402343324 100644
--- a/openbsd-compat/sys-queue.h
+++ b/openbsd-compat/sys-queue.h
@@ -1,5 +1,3 @@
-/* OPENBSD ORIGINAL: sys/sys/queue.h */
 /*      $OpenBSD: queue.h,v 1.25 2004/04/08 16:08:21 henning Exp $      */
 /*      $NetBSD: queue.h,v 1.11 1996/05/16 05:17:14 mycroft Exp $       */
@@ -34,6 +32,8 @@
 *      @(#)queue.h     8.5 (Berkeley) 8/20/94
 */
+/* OPENBSD ORIGINAL: sys/sys/queue.h */
 #ifndef _FAKE_QUEUE_H_
 #define _FAKE_QUEUE_H_
diff --git a/openbsd-compat/sys-tree.h b/openbsd-compat/sys-tree.h
index 73cfbe72a..c80b90b21 100644
--- a/openbsd-compat/sys-tree.h
+++ b/openbsd-compat/sys-tree.h
@@ -1,5 +1,3 @@
-/* OPENBSD ORIGINAL: sys/sys/tree.h */
 /*      $OpenBSD: tree.h,v 1.7 2002/10/17 21:51:54 art Exp $    */
 /*
 * Copyright 2002 Niels Provos <provos@citi.umich.edu>
@@ -26,6 +24,8 @@
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */
+/* OPENBSD ORIGINAL: sys/sys/tree.h */
 #ifndef _SYS_TREE_H_
 #define _SYS_TREE_H_
diff --git a/openbsd-compat/vis.c b/openbsd-compat/vis.c
index 1fb7a01e3..3a087b341 100644
--- a/openbsd-compat/vis.c
+++ b/openbsd-compat/vis.c
@@ -1,5 +1,4 @@
-/* OPENBSD ORIGINAL: lib/libc/gen/vis.c */
+/*      $OpenBSD: vis.c,v 1.19 2005/09/01 17:15:49 millert Exp $ */
 /*-
 * Copyright (c) 1989, 1993
 *      The Regents of the University of California.  All rights reserved.
@@ -28,36 +27,34 @@
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */
+/* OPENBSD ORIGINAL: lib/libc/gen/vis.c */
 #include "includes.h"
 #if !defined(HAVE_STRNVIS)
-#if defined(LIBC_SCCS) && !defined(lint)
-static char rcsid[] = "$OpenBSD: vis.c,v 1.12 2003/06/02 20:18:35 millert Exp $";
-#endif /* LIBC_SCCS and not lint */
 #include <ctype.h>
 #include <string.h>
 #include "vis.h"
 #define isoctal(c)      (((u_char)(c)) >= '0' && ((u_char)(c)) <= '7')
-#define isvisible(c)    (((u_int)(c) <= UCHAR_MAX && isascii((u_char)(c)) && \
+#define isvisible(c)                                                    \
-                                isgraph((u_char)(c))) ||                     \
+        (((u_int)(c) <= UCHAR_MAX && isascii((u_char)(c)) &&            \
-                                ((flag & VIS_SP) == 0 && (c) == ' ') ||      \
+        (((c) != '*' && (c) != '?' && (c) != '[' && (c) != '#') ||      \
-                                ((flag & VIS_TAB) == 0 && (c) == '\t') ||    \
+                (flag & VIS_GLOB) == 0) && isgraph((u_char)(c))) ||     \
-                                ((flag & VIS_NL) == 0 && (c) == '\n') ||     \
+        ((flag & VIS_SP) == 0 && (c) == ' ') ||                         \
-                                ((flag & VIS_SAFE) && ((c) == '\b' ||        \
+        ((flag & VIS_TAB) == 0 && (c) == '\t') ||                       \
-                                (c) == '\007' || (c) == '\r' ||              \
+        ((flag & VIS_NL) == 0 && (c) == '\n') ||                        \
-                                isgraph((u_char)(c)))))
+        ((flag & VIS_SAFE) && ((c) == '\b' ||                           \
+                (c) == '\007' || (c) == '\r' ||                         \
+                isgraph((u_char)(c)))))
 /*
 * vis - visually encode characters
 */
 char *
-vis(dst, c, flag, nextc)
+vis(char *dst, int c, int flag, int nextc)
-        register char *dst;
-        int c, nextc;
-        register int flag;
 {
        if (isvisible(c)) {
                *dst++ = c;
@@ -111,7 +108,8 @@ vis(dst, c, flag, nextc)
                        goto done;
                }
        }
-        if (((c & 0177) == ' ') || (flag & VIS_OCTAL)) {        
+        if (((c & 0177) == ' ') || (flag & VIS_OCTAL) ||
+            ((flag & VIS_GLOB) && (c == '*' || c == '?' || c == '[' || c == '#'))) {
                *dst++ = '\\';
                *dst++ = ((u_char)c >> 6 & 07) + '0';
                *dst++ = ((u_char)c >> 3 & 07) + '0';
@@ -124,7 +122,7 @@ vis(dst, c, flag, nextc)
                c &= 0177;
                *dst++ = 'M';
        }
-        if (iscntrl(c)) {
+        if (iscntrl((u_char)c)) {
                *dst++ = '^';
                if (c == 0177)
                        *dst++ = '?';
@@ -153,12 +151,9 @@ done:
 *      This is useful for encoding a block of data.
 */
 int
-strvis(dst, src, flag)
+strvis(char *dst, const char *src, int flag)
-        register char *dst;
-        register const char *src;
-        int flag;
 {
-        register char c;
+        char c;
        char *start;
        for (start = dst; (c = *src);)
@@ -168,16 +163,11 @@ strvis(dst, src, flag)
 }
 int
-strnvis(dst, src, siz, flag)
+strnvis(char *dst, const char *src, size_t siz, int flag)
-        char *dst;
-        const char *src;
-        size_t siz;
-        int flag;
 {
-        char c;
        char *start, *end;
        char tbuf[5];
-        int  i;
+        int c, i;
        i = 0;
        for (start = dst, end = start + siz - 1; (c = *src) && dst < end; ) {
@@ -217,13 +207,9 @@ strnvis(dst, src, siz, flag)
 }
 int
-strvisx(dst, src, len, flag)
+strvisx(char *dst, const char *src, size_t len, int flag)
-        register char *dst;
-        register const char *src;
-        register size_t len;
-        int flag;
 {
-        register char c;
+        char c;
        char *start;
        for (start = dst; len > 1; len--) {
diff --git a/openbsd-compat/vis.h b/openbsd-compat/vis.h
index 663355a24..3898a9e70 100644
--- a/openbsd-compat/vis.h
+++ b/openbsd-compat/vis.h
@@ -1,6 +1,4 @@
-/* OPENBSD ORIGINAL: include/vis.h */
+/*      $OpenBSD: vis.h,v 1.11 2005/08/09 19:38:31 millert Exp $        */
-/*      $OpenBSD: vis.h,v 1.6 2003/06/02 19:34:12 millert Exp $ */
 /*      $NetBSD: vis.h,v 1.4 1994/10/26 00:56:41 cgd Exp $      */
 /*-
@@ -34,6 +32,8 @@
 *      @(#)vis.h       5.9 (Berkeley) 4/3/91
 */
+/* OPENBSD ORIGINAL: include/vis.h */
 #include "includes.h"
 #if !defined(HAVE_STRNVIS)
@@ -63,6 +63,7 @@
 * other
 */
 #define VIS_NOSLASH     0x40    /* inhibit printing '\' */
+#define VIS_GLOB        0x100   /* encode glob(3) magics and '#' */
 /*
 * unvis return codes
@@ -80,10 +81,14 @@
 char    *vis(char *, int, int, int);
 int     strvis(char *, const char *, int);
-int     strnvis(char *, const char *, size_t, int);
+int     strnvis(char *, const char *, size_t, int)
-int     strvisx(char *, const char *, size_t, int);
+                __attribute__ ((__bounded__(__string__,1,3)));
+int     strvisx(char *, const char *, size_t, int)
+                __attribute__ ((__bounded__(__string__,1,3)));
 int     strunvis(char *, const char *);
 int     unvis(char *, char, int *, int);
+ssize_t strnunvis(char *, const char *, size_t)
+                __attribute__ ((__bounded__(__string__,1,3)));
 #endif /* !_VIS_H_ */
diff --git a/opensshd.init.in b/opensshd.init.in
index ffa7cdac2..c36c5c88a 100755
--- a/opensshd.init.in
+++ b/opensshd.init.in
@@ -1,4 +1,4 @@
-#!/sbin/sh
+#!@STARTUP_SCRIPT_SHELL@
 # Donated code that was put under PD license.
 #
 # Stripped PRNGd out of it for the time being.
diff --git a/packet.c b/packet.c
index 4becde0a4..3208383e8 100644
--- a/packet.c
+++ b/packet.c
@@ -37,7 +37,7 @@
 */
 #include "includes.h"
-RCSID("$OpenBSD: packet.c,v 1.119 2005/07/28 17:36:22 markus Exp $");
+RCSID("$OpenBSD: packet.c,v 1.120 2005/10/30 08:52:17 djm Exp $");
 #include "openbsd-compat/sys-queue.h"
@@ -575,7 +575,7 @@ packet_send1(void)
        buffer_clear(&outgoing_packet);
        /*
-         * Note that the packet is now only buffered in output.  It won\'t be
+         * Note that the packet is now only buffered in output.  It won't be
         * actually sent until packet_write_wait or packet_write_poll is
         * called.
         */
diff --git a/progressmeter.c b/progressmeter.c
index 3cda09061..13c51d87e 100644
--- a/progressmeter.c
+++ b/progressmeter.c
@@ -85,8 +85,8 @@ format_rate(char *buf, int size, off_t bytes)
                bytes = (bytes + 512) / 1024;
        }
        snprintf(buf, size, "%3lld.%1lld%c%s",
-            (int64_t) (bytes + 5) / 100,
+            (long long) (bytes + 5) / 100,
-            (int64_t) (bytes + 5) / 10 % 10,
+            (long long) (bytes + 5) / 10 % 10,
            unit[i],
            i ? "B" : " ");
 }
@@ -99,7 +99,7 @@ format_size(char *buf, int size, off_t bytes)
        for (i = 0; bytes >= 10000 && unit[i] != 'T'; i++)
                bytes = (bytes + 512) / 1024;
        snprintf(buf, size, "%4lld%c%s",
-            (int64_t) bytes,
+            (long long) bytes,
            unit[i],
            i ? "B" : " ");
 }
diff --git a/readconf.c b/readconf.c
index d2c5a77f7..7933c5289 100644
--- a/readconf.c
+++ b/readconf.c
@@ -12,7 +12,7 @@
 */
 #include "includes.h"
-RCSID("$OpenBSD: readconf.c,v 1.143 2005/07/30 02:03:47 djm Exp $");
+RCSID("$OpenBSD: readconf.c,v 1.145 2005/12/08 18:34:11 reyk Exp $");
 #include "ssh.h"
 #include "xmalloc.h"
@@ -70,6 +70,10 @@ RCSID("$OpenBSD: readconf.c,v 1.143 2005/07/30 02:03:47 djm Exp $");
     Cipher none
     PasswordAuthentication no
+   Host vpn.fake.com
+     Tunnel yes
+     TunnelDevice 3
   # Defaults for various options
   Host *
     ForwardAgent no
@@ -107,6 +111,7 @@ typedef enum {
        oAddressFamily, oGssAuthentication, oGssDelegateCreds,
        oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
        oSendEnv, oControlPath, oControlMaster, oHashKnownHosts,
+        oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand,
        oProtocolKeepAlives, oSetupTimeOut,
        oDeprecated, oUnsupported
 } OpCodes;
@@ -199,6 +204,10 @@ static struct {
        { "controlpath", oControlPath },
        { "controlmaster", oControlMaster },
        { "hashknownhosts", oHashKnownHosts },
+        { "tunnel", oTunnel },
+        { "tunneldevice", oTunnelDevice },
+        { "localcommand", oLocalCommand },
+        { "permitlocalcommand", oPermitLocalCommand },
        { "protocolkeepalives", oProtocolKeepAlives },
        { "setuptimeout", oSetupTimeOut },
        { NULL, oBadOption }
@@ -267,6 +276,7 @@ clear_forwardings(Options *options)
                xfree(options->remote_forwards[i].connect_host);
        }
        options->num_remote_forwards = 0;
+        options->tun_open = SSH_TUNMODE_NO;
 }
 /*
@@ -299,7 +309,7 @@ process_config_line(Options *options, const char *host,
                    int *activep)
 {
        char *s, **charptr, *endofnumber, *keyword, *arg, *arg2, fwdarg[256];
-        int opcode, *intptr, value;
+        int opcode, *intptr, value, value2;
        size_t len;
        Forward fwd;
@@ -556,9 +566,10 @@ parse_string:
                goto parse_string;
        case oProxyCommand:
+                charptr = &options->proxy_command;
+parse_command:
                if (s == NULL)
                        fatal("%.200s line %d: Missing argument.", filename, linenum);
-                charptr = &options->proxy_command;
                len = strspn(s, WHITESPACE "=");
                if (*activep && *charptr == NULL)
                        *charptr = xstrdup(s + len);
@@ -826,6 +837,49 @@ parse_int:
                intptr = &options->hash_known_hosts;
                goto parse_flag;
+        case oTunnel:
+                intptr = &options->tun_open;
+                arg = strdelim(&s);
+                if (!arg || *arg == '\0')
+                        fatal("%s line %d: Missing yes/point-to-point/"
+                            "ethernet/no argument.", filename, linenum);
+                value = 0;      /* silence compiler */
+                if (strcasecmp(arg, "ethernet") == 0)
+                        value = SSH_TUNMODE_ETHERNET;
+                else if (strcasecmp(arg, "point-to-point") == 0)
+                        value = SSH_TUNMODE_POINTOPOINT;
+                else if (strcasecmp(arg, "yes") == 0)
+                        value = SSH_TUNMODE_DEFAULT;
+                else if (strcasecmp(arg, "no") == 0)
+                        value = SSH_TUNMODE_NO;
+                else
+                        fatal("%s line %d: Bad yes/point-to-point/ethernet/"
+                            "no argument: %s", filename, linenum, arg);
+                if (*activep)
+                        *intptr = value;
+                break;
+        case oTunnelDevice:
+                arg = strdelim(&s);
+                if (!arg || *arg == '\0')
+                        fatal("%.200s line %d: Missing argument.", filename, linenum);
+                value = a2tun(arg, &value2);
+                if (value == SSH_TUNID_ERR)
+                        fatal("%.200s line %d: Bad tun device.", filename, linenum);
+                if (*activep) {
+                        options->tun_local = value;
+                        options->tun_remote = value2;
+                }
+                break;
+        case oLocalCommand:
+                charptr = &options->local_command;
+                goto parse_command;
+        case oPermitLocalCommand:
+                intptr = &options->permit_local_command;
+                goto parse_flag;
        case oSetupTimeOut:
                intptr = &options->setuptimeout;
                goto parse_int;
@@ -994,6 +1048,11 @@ initialize_options(Options * options)
        options->control_path = NULL;
        options->control_master = -1;
        options->hash_known_hosts = -1;
+        options->tun_open = -1;
+        options->tun_local = -1;
+        options->tun_remote = -1;
+        options->local_command = NULL;
+        options->permit_local_command = -1;
 }
 /*
@@ -1123,6 +1182,14 @@ fill_default_options(Options * options)
                options->control_master = 0;
        if (options->hash_known_hosts == -1)
                options->hash_known_hosts = 0;
+        if (options->tun_open == -1)
+                options->tun_open = SSH_TUNMODE_NO;
+        if (options->tun_local == -1)
+                options->tun_local = SSH_TUNID_ANY;
+        if (options->tun_remote == -1)
+                options->tun_remote = SSH_TUNID_ANY;
+        if (options->permit_local_command == -1)
+                options->permit_local_command = 0;
        if (options->setuptimeout == -1) {
                /* in batch mode, default is 5mins */
                if (options->batch_mode == 1)
@@ -1130,6 +1197,7 @@ fill_default_options(Options * options)
                else
                        options->setuptimeout = 0;
        }
+        /* options->local_command should not be set by default */
        /* options->proxy_command should not be set by default */
        /* options->user will be set in the main program if appropriate */
        /* options->hostname will be set in the main program if appropriate */
diff --git a/readconf.h b/readconf.h
index a68734437..630895ee4 100644
--- a/readconf.h
+++ b/readconf.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: readconf.h,v 1.67 2005/06/08 11:25:09 djm Exp $       */
+/*      $OpenBSD: readconf.h,v 1.68 2005/12/06 22:38:27 reyk Exp $      */
 /*
 * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -115,6 +115,14 @@ typedef struct {
        int     control_master;
        int     hash_known_hosts;
+        int     tun_open;       /* tun(4) */
+        int     tun_local;      /* force tun device (optional) */
+        int     tun_remote;     /* force tun device (optional) */
+        char    *local_command;
+        int     permit_local_command;
 }       Options;
 #define SSHCTL_MASTER_NO        0
diff --git a/regress/README.regress b/regress/README.regress
index 0c07c9cf1..5aaf734bd 100644
--- a/regress/README.regress
+++ b/regress/README.regress
@@ -97,8 +97,12 @@ Known Issues.
  unless ssh-rand-helper is in pre-installed (the path to
  ssh-rand-helper is hard coded).
+- Similarly, if you do not have "scp" in your system's $PATH then the
+  multiplex scp tests will fail (since the system's shell startup scripts
+  will determine where the shell started by sshd will look for scp).
 - Recent GNU coreutils deprecate "head -[n]": this will cause the yes-head
  test to fail.  The old behaviour can be restored by setting (and
  exporting) _POSIX2_VERSION=199209 before running the tests.
-$Id: README.regress,v 1.9 2004/08/17 12:31:33 dtucker Exp $
+$Id: README.regress,v 1.10 2005/10/03 10:14:18 dtucker Exp $
diff --git a/regress/agent-getpeereid.sh b/regress/agent-getpeereid.sh
index 46d20dc2b..6186a8d48 100644
--- a/regress/agent-getpeereid.sh
+++ b/regress/agent-getpeereid.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: agent-getpeereid.sh,v 1.1 2002/12/09 16:05:02 markus Exp $
+#       $OpenBSD: agent-getpeereid.sh,v 1.2 2005/11/14 21:25:56 grunk Exp $
 #       Placed in the Public Domain.
 tid="disallow agent attach from other uid"
@@ -27,7 +27,7 @@ else
                fail "ssh-add failed with $r != 1"
        fi
-        < /dev/null sudo -S -u ${UNPRIV} ssh-add -l > /dev/null 2>&1
+        < /dev/null ${SUDO} -S -u ${UNPRIV} ssh-add -l > /dev/null 2>&1
        r=$?
        if [ $r -lt 2 ]; then
                fail "ssh-add did not fail for ${UNPRIV}: $r < 2"
diff --git a/regress/forwarding.sh b/regress/forwarding.sh
index dfe065dd6..3b171144f 100644
--- a/regress/forwarding.sh
+++ b/regress/forwarding.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: forwarding.sh,v 1.4 2002/03/15 13:08:56 markus Exp $
+#       $OpenBSD: forwarding.sh,v 1.5 2005/03/10 10:20:39 dtucker Exp $
 #       Placed in the Public Domain.
 tid="local and remote forwarding"
@@ -32,3 +32,34 @@ for p in 1 2; do
        sleep 10
 done
+for p in 1 2; do
+        trace "simple clear forwarding proto $p"
+        ${SSH} -$p -F $OBJ/ssh_config -oClearAllForwardings=yes somehost true
+        trace "clear local forward proto $p"
+        ${SSH} -$p -f -F $OBJ/ssh_config -L ${base}01:127.0.0.1:$PORT \
+            -oClearAllForwardings=yes somehost sleep 10
+        if [ $? != 0 ]; then
+                fail "connection failed with cleared local forwarding"
+        else
+                # this one should fail
+                ${SSH} -$p -F $OBJ/ssh_config -p ${base}01 true \
+                     2>${TEST_SSH_LOGFILE} && \
+                        fail "local forwarding not cleared"
+        fi
+        sleep 10
+        
+        trace "clear remote forward proto $p"
+        ${SSH} -$p -f -F $OBJ/ssh_config -R ${base}01:127.0.0.1:$PORT \
+            -oClearAllForwardings=yes somehost sleep 10
+        if [ $? != 0 ]; then
+                fail "connection failed with cleared remote forwarding"
+        else
+                # this one should fail
+                ${SSH} -$p -F $OBJ/ssh_config -p ${base}01 true \
+                     2>${TEST_SSH_LOGFILE} && \
+                        fail "remote forwarding not cleared"
+        fi
+        sleep 10
+done
diff --git a/regress/multiplex.sh b/regress/multiplex.sh
index a172e5790..4fba7b5ac 100644
--- a/regress/multiplex.sh
+++ b/regress/multiplex.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: multiplex.sh,v 1.10 2005/02/27 11:33:30 dtucker Exp $
+#       $OpenBSD: multiplex.sh,v 1.11 2005/04/25 09:54:09 dtucker Exp $
 #       Placed in the Public Domain.
 CTL=/tmp/openssh.regress.ctl-sock.$$
diff --git a/regress/reconfigure.sh b/regress/reconfigure.sh
index ba6dbc6f5..1daf29f9a 100644
--- a/regress/reconfigure.sh
+++ b/regress/reconfigure.sh
@@ -15,8 +15,9 @@ esac
 start_sshd
-$SUDO kill -HUP `cat $PIDFILE`
+PID=`cat $PIDFILE`
-sleep 1
+rm -f $PIDFILE
+$SUDO kill -HUP $PID
 trace "wait for sshd to restart"
 i=0;
diff --git a/regress/scp-ssh-wrapper.sh b/regress/scp-ssh-wrapper.sh
index 8e4314773..d1005a995 100644
--- a/regress/scp-ssh-wrapper.sh
+++ b/regress/scp-ssh-wrapper.sh
@@ -1,5 +1,5 @@
 #!/bin/sh
-#       $OpenBSD: scp-ssh-wrapper.sh,v 1.1 2004/06/13 13:51:02 dtucker Exp $
+#       $OpenBSD: scp-ssh-wrapper.sh,v 1.2 2005/12/14 04:36:39 dtucker Exp $
 #       Placed in the Public Domain.
 printname () {
@@ -16,8 +16,11 @@ printname () {
        done
 }
-# discard first 5 args
+# Discard all but last argument.  We use arg later.
-shift; shift; shift; shift; shift
+while test "$1" != ""; do
+        arg="$1"
+        shift
+done
 BAD="../../../../../../../../../../../../../${DIR}/dotpathdir"
@@ -49,6 +52,6 @@ badserver_4)
        echo "X"
        ;;
 *)
-        exec $1
+        exec $arg
        ;;
 esac
diff --git a/regress/scp.sh b/regress/scp.sh
index c3034b6e7..c5d412dd9 100644
--- a/regress/scp.sh
+++ b/regress/scp.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: scp.sh,v 1.3 2004/07/08 12:59:35 dtucker Exp $
+#       $OpenBSD: scp.sh,v 1.7 2006/01/31 10:36:33 djm Exp $
 #       Placed in the Public Domain.
 tid="scp"
@@ -28,6 +28,11 @@ scpclean() {
        mkdir ${DIR} ${DIR2}
 }
+verbose "$tid: simple copy local file to local file"
+scpclean
+$SCP $scpopts ${DATA} ${COPY} || fail "copy failed"
+cmp ${DATA} ${COPY} || fail "corrupted copy"
 verbose "$tid: simple copy local file to remote file"
 scpclean
 $SCP $scpopts ${DATA} somehost:${COPY} || fail "copy failed"
@@ -44,6 +49,12 @@ cp ${DATA} ${COPY}
 $SCP $scpopts ${COPY} somehost:${DIR} || fail "copy failed"
 cmp ${COPY} ${DIR}/copy || fail "corrupted copy"
+verbose "$tid: simple copy local file to local dir"
+scpclean
+cp ${DATA} ${COPY}
+$SCP $scpopts ${COPY} ${DIR} || fail "copy failed"
+cmp ${COPY} ${DIR}/copy || fail "corrupted copy"
 verbose "$tid: simple copy remote file to local dir"
 scpclean
 cp ${DATA} ${COPY}
@@ -57,6 +68,13 @@ cp ${DATA} ${DIR}/copy
 $SCP $scpopts -r ${DIR} somehost:${DIR2} || fail "copy failed"
 diff ${DIFFOPT} ${DIR} ${DIR2} || fail "corrupted copy"
+verbose "$tid: recursive local dir to local dir"
+scpclean
+rm -rf ${DIR2}
+cp ${DATA} ${DIR}/copy
+$SCP $scpopts -r ${DIR} ${DIR2} || fail "copy failed"
+diff ${DIFFOPT} ${DIR} ${DIR2} || fail "corrupted copy"
 verbose "$tid: recursive remote dir to local dir"
 scpclean
 rm -rf ${DIR2}
@@ -64,6 +82,13 @@ cp ${DATA} ${DIR}/copy
 $SCP $scpopts -r somehost:${DIR} ${DIR2} || fail "copy failed"
 diff ${DIFFOPT} ${DIR} ${DIR2} || fail "corrupted copy"
+verbose "$tid: shell metacharacters"
+scpclean
+(cd ${DIR} && \
+touch '`touch metachartest`' && \
+$SCP $scpopts *metachar* ${DIR2} 2>/dev/null; \
+[ ! -f metachartest ] ) || fail "shell metacharacters"
 if [ ! -z "$SUDO" ]; then
        verbose "$tid: skipped file after scp -p with failed chown+utimes"
        scpclean
@@ -73,7 +98,7 @@ if [ ! -z "$SUDO" ]; then
        chmod 660 ${DIR2}/copy
        $SUDO chown root ${DIR2}/copy
        $SCP -p $scpopts somehost:${DIR}/\* ${DIR2} >/dev/null 2>&1
-        diff ${DIFFOPT} ${DIR} ${DIR2} || fail "corrupted copy"
+        $SUDO diff ${DIFFOPT} ${DIR} ${DIR2} || fail "corrupted copy"
        $SUDO rm ${DIR2}/copy
 fi
@@ -91,5 +116,12 @@ for i in 0 1 2 3 4; do
        [ -d ${DIR}/dotpathdir ] && fail "allows dir creation outside of subdir"
 done
+verbose "$tid: detect non-directory target"
+scpclean
+echo a > ${COPY}
+echo b > ${COPY2}
+$SCP $scpopts ${DATA} ${COPY} ${COPY2}
+cmp ${COPY} ${COPY2} >/dev/null && fail "corrupt target"
 scpclean
 rm -f ${OBJ}/scp-ssh-wrapper.scp
diff --git a/regress/test-exec.sh b/regress/test-exec.sh
index 4b3a70eb3..59ae33c08 100644
--- a/regress/test-exec.sh
+++ b/regress/test-exec.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: test-exec.sh,v 1.27 2005/02/27 11:33:30 dtucker Exp $
+#       $OpenBSD: test-exec.sh,v 1.28 2005/05/20 23:14:15 djm Exp $
 #       Placed in the Public Domain.
 #SUDO=sudo
@@ -24,6 +24,8 @@ if [ -x /usr/ucb/whoami ]; then
        USER=`/usr/ucb/whoami`
 elif whoami >/dev/null 2>&1; then
        USER=`whoami`
+elif logname >/dev/null 2>&1; then
+        USER=`logname`
 else
        USER=`id -un`
 fi
@@ -194,6 +196,7 @@ trap fatal 3 2
 cat << EOF > $OBJ/sshd_config
        StrictModes             no
        Port                    $PORT
+        AddressFamily           inet
        ListenAddress           127.0.0.1
        #ListenAddress          ::1
        PidFile                 $PIDFILE
@@ -244,7 +247,7 @@ trace "generate keys"
 for t in rsa rsa1; do
        # generate user key
        rm -f $OBJ/$t
-        ${SSHKEYGEN} -q -N '' -t $t  -f $OBJ/$t ||\
+        ${SSHKEYGEN} -b 1024 -q -N '' -t $t  -f $OBJ/$t ||\
                fail "ssh-keygen for $t failed"
        # known hosts file for client
diff --git a/regress/try-ciphers.sh b/regress/try-ciphers.sh
index c6e1b9152..379fe353a 100644
--- a/regress/try-ciphers.sh
+++ b/regress/try-ciphers.sh
@@ -1,9 +1,10 @@
-#       $OpenBSD: try-ciphers.sh,v 1.9 2004/02/28 13:44:45 dtucker Exp $
+#       $OpenBSD: try-ciphers.sh,v 1.10 2005/05/24 04:10:54 djm Exp $
 #       Placed in the Public Domain.
 tid="try ciphers"
-ciphers="aes128-cbc 3des-cbc blowfish-cbc cast128-cbc arcfour 
+ciphers="aes128-cbc 3des-cbc blowfish-cbc cast128-cbc 
+        arcfour128 arcfour256 arcfour 
        aes192-cbc aes256-cbc rijndael-cbc@lysator.liu.se
        aes128-ctr aes192-ctr aes256-ctr"
 macs="hmac-sha1 hmac-md5 hmac-sha1-96 hmac-md5-96"
diff --git a/regress/yes-head.sh b/regress/yes-head.sh
index 17a4d0dd4..a8e6bc800 100644
--- a/regress/yes-head.sh
+++ b/regress/yes-head.sh
@@ -4,7 +4,7 @@
 tid="yes pipe head"
 for p in 1 2; do
-        lines=`${SSH} -$p -F $OBJ/ssh_proxy thishost 'sh -c "while true;do echo yes;done | head -2000"' | (sleep 3 ; wc -l)`
+        lines=`${SSH} -$p -F $OBJ/ssh_proxy thishost 'sh -c "while true;do echo yes;done | _POSIX2_VERSION=199209 head -2000"' | (sleep 3 ; wc -l)`
        if [ $? -ne 0 ]; then
                fail "yes|head test failed"
                lines = 0;
diff --git a/scp.0 b/scp.0
index aa54dda3f..2c7f15567 100644
--- a/scp.0
+++ b/scp.0
@@ -92,6 +92,7 @@ DESCRIPTION
                   Protocol
                   ProxyCommand
                   PubkeyAuthentication
+                   RekeyLimit
                   RhostsRSAAuthentication
                   RSAAuthentication
                   SendEnv
@@ -141,4 +142,4 @@ AUTHORS
     Timo Rinne <tri@iki.fi>
     Tatu Ylonen <ylo@cs.hut.fi>
-OpenBSD 3.8                   September 25, 1999                             3
+OpenBSD 3.9                   September 25, 1999                             3
diff --git a/scp.1 b/scp.1
index b5191e318..d9b1f8e8f 100644
--- a/scp.1
+++ b/scp.1
@@ -9,7 +9,7 @@
 .\"
 .\" Created: Sun May  7 00:14:37 1995 ylo
 .\"
-.\" $OpenBSD: scp.1,v 1.38 2005/03/01 17:19:35 jmc Exp $
+.\" $OpenBSD: scp.1,v 1.39 2006/01/20 00:14:55 dtucker Exp $
 .\"
 .Dd September 25, 1999
 .Dt SCP 1
@@ -152,6 +152,7 @@ For full details of the options listed below, and their possible values, see
 .It Protocol
 .It ProxyCommand
 .It PubkeyAuthentication
+.It RekeyLimit
 .It RhostsRSAAuthentication
 .It RSAAuthentication
 .It SendEnv
diff --git a/scp.c b/scp.c
index 1407aa71d..620024ea7 100644
--- a/scp.c
+++ b/scp.c
@@ -71,7 +71,7 @@
 */
 #include "includes.h"
-RCSID("$OpenBSD: scp.c,v 1.125 2005/07/27 10:39:03 dtucker Exp $");
+RCSID("$OpenBSD: scp.c,v 1.130 2006/01/31 10:35:43 djm Exp $");
 #include "xmalloc.h"
 #include "atomicio.h"
@@ -118,6 +118,48 @@ killchild(int signo)
        exit(1);
 }
+static int
+do_local_cmd(arglist *a)
+{
+        u_int i;
+        int status;
+        pid_t pid;
+        if (a->num == 0)
+                fatal("do_local_cmd: no arguments");
+        if (verbose_mode) {
+                fprintf(stderr, "Executing:");
+                for (i = 0; i < a->num; i++)
+                        fprintf(stderr, " %s", a->list[i]);
+                fprintf(stderr, "\n");
+        }
+        if ((pid = fork()) == -1)
+                fatal("do_local_cmd: fork: %s", strerror(errno));
+        if (pid == 0) {
+                execvp(a->list[0], a->list);
+                perror(a->list[0]);
+                exit(1);
+        }
+        do_cmd_pid = pid;
+        signal(SIGTERM, killchild);
+        signal(SIGINT, killchild);
+        signal(SIGHUP, killchild);
+        while (waitpid(pid, &status, 0) == -1)
+                if (errno != EINTR)
+                        fatal("do_local_cmd: waitpid: %s", strerror(errno));
+        do_cmd_pid = -1;
+        if (!WIFEXITED(status) || WEXITSTATUS(status) != 0)
+                return (-1);
+        return (0);
+}
 /*
 * This function executes the given command as the specified user on the
 * given host.  This returns < 0 if execution fails, and >= 0 otherwise. This
@@ -162,7 +204,7 @@ do_cmd(char *host, char *remuser, char *cmd, int *fdin, int *fdout, int argc)
                close(pin[0]);
                close(pout[1]);
-                args.list[0] = ssh_program;
+                replacearg(&args, 0, "%s", ssh_program);
                if (remuser != NULL)
                        addargs(&args, "-l%s", remuser);
                addargs(&args, "%s", host);
@@ -222,12 +264,17 @@ main(int argc, char **argv)
        extern char *optarg;
        extern int optind;
+        /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
+        sanitise_stdfd();
        __progname = ssh_get_progname(argv[0]);
+        memset(&args, '\0', sizeof(args));
        args.list = NULL;
-        addargs(&args, "ssh");          /* overwritten with ssh_program */
+        addargs(&args, "%s", ssh_program);
        addargs(&args, "-x");
        addargs(&args, "-oForwardAgent no");
+        addargs(&args, "-oPermitLocalCommand no");
        addargs(&args, "-oClearAllForwardings yes");
        fflag = tflag = 0;
@@ -336,9 +383,9 @@ main(int argc, char **argv)
        if ((targ = colon(argv[argc - 1])))     /* Dest is remote host. */
                toremote(targ, argc, argv);
        else {
-                tolocal(argc, argv);    /* Dest is local host. */
                if (targetshouldbedirectory)
                        verifydir(argv[argc - 1]);
+                tolocal(argc, argv);    /* Dest is local host. */
        }
        /*
         * Finally check the exit status of the ssh process, if one was forked
@@ -364,6 +411,10 @@ toremote(char *targ, int argc, char **argv)
 {
        int i, len;
        char *bp, *host, *src, *suser, *thost, *tuser, *arg;
+        arglist alist;
+        memset(&alist, '\0', sizeof(alist));
+        alist.list = NULL;
        *targ++ = 0;
        if (*targ == 0)
@@ -381,56 +432,48 @@ toremote(char *targ, int argc, char **argv)
                tuser = NULL;
        }
+        if (tuser != NULL && !okname(tuser)) {
+                xfree(arg);
+                return;
+        }
        for (i = 0; i < argc - 1; i++) {
                src = colon(argv[i]);
                if (src) {      /* remote to remote */
-                        static char *ssh_options =
+                        freeargs(&alist);
-                            "-x -o'ClearAllForwardings yes'";
+                        addargs(&alist, "%s", ssh_program);
+                        if (verbose_mode)
+                                addargs(&alist, "-v");
+                        addargs(&alist, "-x");
+                        addargs(&alist, "-oClearAllForwardings yes");
+                        addargs(&alist, "-n");
                        *src++ = 0;
                        if (*src == 0)
                                src = ".";
                        host = strrchr(argv[i], '@');
-                        len = strlen(ssh_program) + strlen(argv[i]) +
-                            strlen(src) + (tuser ? strlen(tuser) : 0) +
-                            strlen(thost) + strlen(targ) +
-                            strlen(ssh_options) + CMDNEEDS + 20;
-                        bp = xmalloc(len);
                        if (host) {
                                *host++ = 0;
                                host = cleanhostname(host);
                                suser = argv[i];
                                if (*suser == '\0')
                                        suser = pwd->pw_name;
-                                else if (!okname(suser)) {
+                                else if (!okname(suser))
-                                        xfree(bp);
                                        continue;
-                                }
+                                addargs(&alist, "-l");
-                                if (tuser && !okname(tuser)) {
+                                addargs(&alist, "%s", suser);
-                                        xfree(bp);
-                                        continue;
-                                }
-                                snprintf(bp, len,
-                                    "%s%s %s -n "
-                                    "-l %s %s %s %s '%s%s%s:%s'",
-                                    ssh_program, verbose_mode ? " -v" : "",
-                                    ssh_options, suser, host, cmd, src,
-                                    tuser ? tuser : "", tuser ? "@" : "",
-                                    thost, targ);
                        } else {
                                host = cleanhostname(argv[i]);
-                                snprintf(bp, len,
-                                    "exec %s%s %s -n %s "
-                                    "%s %s '%s%s%s:%s'",
-                                    ssh_program, verbose_mode ? " -v" : "",
-                                    ssh_options, host, cmd, src,
-                                    tuser ? tuser : "", tuser ? "@" : "",
-                                    thost, targ);
                        }
-                        if (verbose_mode)
+                        addargs(&alist, "%s", host);
-                                fprintf(stderr, "Executing: %s\n", bp);
+                        addargs(&alist, "%s", cmd);
-                        if (system(bp) != 0)
+                        addargs(&alist, "%s", src);
+                        addargs(&alist, "%s%s%s:%s",
+                            tuser ? tuser : "", tuser ? "@" : "",
+                            thost, targ);
+                        if (do_local_cmd(&alist) != 0)
                                errs = 1;
-                        (void) xfree(bp);
                } else {        /* local to remote */
                        if (remin == -1) {
                                len = strlen(targ) + CMDNEEDS + 20;
@@ -454,20 +497,23 @@ tolocal(int argc, char **argv)
 {
        int i, len;
        char *bp, *host, *src, *suser;
+        arglist alist;
+        memset(&alist, '\0', sizeof(alist));
+        alist.list = NULL;
        for (i = 0; i < argc - 1; i++) {
                if (!(src = colon(argv[i]))) {  /* Local to local. */
-                        len = strlen(_PATH_CP) + strlen(argv[i]) +
+                        freeargs(&alist);
-                            strlen(argv[argc - 1]) + 20;
+                        addargs(&alist, "%s", _PATH_CP);
-                        bp = xmalloc(len);
+                        if (iamrecursive)
-                        (void) snprintf(bp, len, "exec %s%s%s %s %s", _PATH_CP,
+                                addargs(&alist, "-r");
-                            iamrecursive ? " -r" : "", pflag ? " -p" : "",
+                        if (pflag)
-                            argv[i], argv[argc - 1]);
+                                addargs(&alist, "-p");
-                        if (verbose_mode)
+                        addargs(&alist, "%s", argv[i]);
-                                fprintf(stderr, "Executing: %s\n", bp);
+                        addargs(&alist, "%s", argv[argc-1]);
-                        if (system(bp))
+                        if (do_local_cmd(&alist))
                                ++errs;
-                        (void) xfree(bp);
                        continue;
                }
                *src++ = 0;
@@ -560,7 +606,7 @@ syserr:			run_err("%s: %s", name, strerror(errno));
 #define FILEMODEMASK    (S_ISUID|S_ISGID|S_IRWXU|S_IRWXG|S_IRWXO)
                snprintf(buf, sizeof buf, "C%04o %lld %s\n",
                    (u_int) (stb.st_mode & FILEMODEMASK),
-                    (int64_t)stb.st_size, last);
+                    (long long)stb.st_size, last);
                if (verbose_mode) {
                        fprintf(stderr, "Sending file modes: %s", buf);
                }
@@ -568,7 +614,10 @@ syserr:			run_err("%s: %s", name, strerror(errno));
                if (response() < 0)
                        goto next;
                if ((bp = allocbuf(&buffer, fd, 2048)) == NULL) {
-next:                   (void) close(fd);
+next:                   if (fd != -1) {
+                                (void) close(fd);
+                                fd = -1;
+                        }
                        continue;
                }
                if (showprogress)
@@ -597,8 +646,11 @@ next:			(void) close(fd);
                if (showprogress)
                        stop_progress_meter();
-                if (close(fd) < 0 && !haderr)
+                if (fd != -1) {
-                        haderr = errno;
+                        if (close(fd) < 0 && !haderr)
+                                haderr = errno;
+                        fd = -1;
+                }
                if (!haderr)
                        (void) atomicio(vwrite, remout, "", 1);
                else
diff --git a/servconf.c b/servconf.c
index 9e420a527..81953bb80 100644
--- a/servconf.c
+++ b/servconf.c
@@ -10,7 +10,7 @@
 */
 #include "includes.h"
-RCSID("$OpenBSD: servconf.c,v 1.144 2005/08/06 10:03:12 dtucker Exp $");
+RCSID("$OpenBSD: servconf.c,v 1.146 2005/12/08 18:34:11 reyk Exp $");
 #include "ssh.h"
 #include "log.h"
@@ -101,6 +101,7 @@ initialize_server_options(ServerOptions *options)
        options->authorized_keys_file = NULL;
        options->authorized_keys_file2 = NULL;
        options->num_accept_env = 0;
+        options->permit_tun = -1;
        /* Needs to be accessable in many places */
        use_privsep = -1;
@@ -229,6 +230,8 @@ fill_default_server_options(ServerOptions *options)
        }
        if (options->authorized_keys_file == NULL)
                options->authorized_keys_file = _PATH_SSH_USER_PERMITTED_KEYS;
+        if (options->permit_tun == -1)
+                options->permit_tun = SSH_TUNMODE_NO;
        /* Turn privilege separation on by default */
        if (use_privsep == -1)
@@ -270,7 +273,7 @@ typedef enum {
        sBanner, sUseDNS, sHostbasedAuthentication,
        sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
        sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2,
-        sGssAuthentication, sGssCleanupCreds, sAcceptEnv,
+        sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel,
        sUsePrivilegeSeparation,
        sDeprecated, sUnsupported
 } ServerOpCodes;
@@ -373,6 +376,7 @@ static struct {
        { "authorizedkeysfile2", sAuthorizedKeysFile2 },
        { "useprivilegeseparation", sUsePrivilegeSeparation},
        { "acceptenv", sAcceptEnv },
+        { "permittunnel", sPermitTunnel },
        { NULL, sBadOption }
 };
@@ -962,6 +966,28 @@ parse_flag:
                }
                break;
+        case sPermitTunnel:
+                intptr = &options->permit_tun;
+                arg = strdelim(&cp);
+                if (!arg || *arg == '\0')
+                        fatal("%s line %d: Missing yes/point-to-point/"
+                            "ethernet/no argument.", filename, linenum);
+                value = 0;      /* silence compiler */
+                if (strcasecmp(arg, "ethernet") == 0)
+                        value = SSH_TUNMODE_ETHERNET;
+                else if (strcasecmp(arg, "point-to-point") == 0)
+                        value = SSH_TUNMODE_POINTOPOINT;
+                else if (strcasecmp(arg, "yes") == 0)
+                        value = SSH_TUNMODE_YES;
+                else if (strcasecmp(arg, "no") == 0)
+                        value = SSH_TUNMODE_NO;
+                else
+                        fatal("%s line %d: Bad yes/point-to-point/ethernet/"
+                            "no argument: %s", filename, linenum, arg);
+                if (*intptr == -1)
+                        *intptr = value;
+                break;
        case sDeprecated:
                logit("%s line %d: Deprecated option %s",
                    filename, linenum, arg);
diff --git a/servconf.h b/servconf.h
index f7e56d521..ab82c8f57 100644
--- a/servconf.h
+++ b/servconf.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: servconf.h,v 1.71 2004/12/23 23:11:00 djm Exp $       */
+/*      $OpenBSD: servconf.h,v 1.72 2005/12/06 22:38:27 reyk Exp $      */
 /*
 * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -133,7 +133,10 @@ typedef struct {
        char   *authorized_keys_file;   /* File containing public keys */
        char   *authorized_keys_file2;
        int     use_pam;                /* Enable auth via PAM */
+        int     permit_tun;
 }       ServerOptions;
 void     initialize_server_options(ServerOptions *);
diff --git a/serverloop.c b/serverloop.c
index 031847873..f72b73bf8 100644
--- a/serverloop.c
+++ b/serverloop.c
@@ -35,7 +35,7 @@
 */
 #include "includes.h"
-RCSID("$OpenBSD: serverloop.c,v 1.118 2005/07/17 07:17:55 djm Exp $");
+RCSID("$OpenBSD: serverloop.c,v 1.124 2005/12/13 15:03:02 reyk Exp $");
 #include "xmalloc.h"
 #include "packet.h"
@@ -61,6 +61,7 @@ extern ServerOptions options;
 /* XXX */
 extern Kex *xxx_kex;
 extern Authctxt *the_authctxt;
+extern int use_privsep;
 static Buffer stdin_buffer;     /* Buffer for stdin data. */
 static Buffer stdout_buffer;    /* Buffer for stdout data. */
@@ -90,6 +91,9 @@ static int client_alive_timeouts = 0;
 static volatile sig_atomic_t child_terminated = 0;      /* The child has terminated. */
+/* Cleanup on signals (!use_privsep case only) */
+static volatile sig_atomic_t received_sigterm = 0;
 /* prototypes */
 static void server_init_dispatch(void);
@@ -151,6 +155,12 @@ sigchld_handler(int sig)
        errno = save_errno;
 }
+static void
+sigterm_handler(int sig)
+{
+        received_sigterm = sig;
+}
 /*
 * Make packets from buffered stderr data, and buffer it for sending
 * to the client.
@@ -502,6 +512,12 @@ server_loop(pid_t pid, int fdin_arg, int fdout_arg, int fderr_arg)
        child_terminated = 0;
        mysignal(SIGCHLD, sigchld_handler);
+        if (!use_privsep) {
+                signal(SIGTERM, sigterm_handler);
+                signal(SIGINT, sigterm_handler);
+                signal(SIGQUIT, sigterm_handler);
+        }
        /* Initialize our global variables. */
        fdin = fdin_arg;
        fdout = fdout_arg;
@@ -548,7 +564,7 @@ server_loop(pid_t pid, int fdin_arg, int fdout_arg, int fderr_arg)
         * If we have no separate fderr (which is the case when we have a pty
         * - there we cannot make difference between data sent to stdout and
         * stderr), indicate that we have seen an EOF from stderr.  This way
-         * we don\'t need to check the descriptor everywhere.
+         * we don't need to check the descriptor everywhere.
         */
        if (fderr == -1)
                fderr_eof = 1;
@@ -629,6 +645,12 @@ server_loop(pid_t pid, int fdin_arg, int fdout_arg, int fderr_arg)
                wait_until_can_do_something(&readset, &writeset, &max_fd,
                    &nalloc, max_time_milliseconds);
+                if (received_sigterm) {
+                        logit("Exiting on signal %d", received_sigterm);
+                        /* Clean up sessions, utmp, etc. */
+                        cleanup_exit(255);
+                }
                /* Process any channel events. */
                channel_after_select(readset, writeset);
@@ -749,6 +771,12 @@ server_loop2(Authctxt *authctxt)
        connection_in = packet_get_connection_in();
        connection_out = packet_get_connection_out();
+        if (!use_privsep) {
+                signal(SIGTERM, sigterm_handler);
+                signal(SIGINT, sigterm_handler);
+                signal(SIGQUIT, sigterm_handler);
+        }
        notify_setup();
        max_fd = MAX(connection_in, connection_out);
@@ -766,6 +794,12 @@ server_loop2(Authctxt *authctxt)
                wait_until_can_do_something(&readset, &writeset, &max_fd,
                    &nalloc, 0);
+                if (received_sigterm) {
+                        logit("Exiting on signal %d", received_sigterm);
+                        /* Clean up sessions, utmp, etc. */
+                        cleanup_exit(255);
+                }
                collect_children();
                if (!rekeying) {
                        channel_after_select(readset, writeset);
@@ -880,6 +914,52 @@ server_request_direct_tcpip(void)
 }
 static Channel *
+server_request_tun(void)
+{
+        Channel *c = NULL;
+        int mode, tun;
+        int sock;
+        mode = packet_get_int();
+        switch (mode) {
+        case SSH_TUNMODE_POINTOPOINT:
+        case SSH_TUNMODE_ETHERNET:
+                break;
+        default:
+                packet_send_debug("Unsupported tunnel device mode.");
+                return NULL;
+        }
+        if ((options.permit_tun & mode) == 0) {
+                packet_send_debug("Server has rejected tunnel device "
+                    "forwarding");
+                return NULL;
+        }
+        tun = packet_get_int();
+        if (forced_tun_device != -1) {
+                if (tun != SSH_TUNID_ANY && forced_tun_device != tun)
+                        goto done;
+                tun = forced_tun_device;
+        }
+        sock = tun_open(tun, mode);
+        if (sock < 0)
+                goto done;
+        c = channel_new("tun", SSH_CHANNEL_OPEN, sock, sock, -1,
+            CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0, "tun", 1);
+        c->datagram = 1;
+#if defined(SSH_TUN_FILTER)
+        if (mode == SSH_TUNMODE_POINTOPOINT)
+                channel_register_filter(c->self, sys_tun_infilter,
+                    sys_tun_outfilter);
+#endif
+ done:
+        if (c == NULL)
+                packet_send_debug("Failed to open the tunnel device.");
+        return c;
+}
+static Channel *
 server_request_session(void)
 {
        Channel *c;
@@ -900,7 +980,7 @@ server_request_session(void)
                channel_free(c);
                return NULL;
        }
-        channel_register_cleanup(c->self, session_close_by_channel);
+        channel_register_cleanup(c->self, session_close_by_channel, 0);
        return c;
 }
@@ -924,6 +1004,8 @@ server_input_channel_open(int type, u_int32_t seq, void *ctxt)
                c = server_request_session();
        } else if (strcmp(ctype, "direct-tcpip") == 0) {
                c = server_request_direct_tcpip();
+        } else if (strcmp(ctype, "tun@openssh.com") == 0) {
+                c = server_request_tun();
        }
        if (c != NULL) {
                debug("server_input_channel_open: confirm %s", ctype);
diff --git a/session.c b/session.c
index fb719d42a..daad03929 100644
--- a/session.c
+++ b/session.c
@@ -33,7 +33,7 @@
 */
 #include "includes.h"
-RCSID("$OpenBSD: session.c,v 1.186 2005/07/25 11:59:40 markus Exp $");
+RCSID("$OpenBSD: session.c,v 1.191 2005/12/24 02:27:41 djm Exp $");
 #include "ssh.h"
 #include "ssh1.h"
@@ -211,15 +211,6 @@ do_authenticated(Authctxt *authctxt)
 {
        setproctitle("%s", authctxt->pw->pw_name);
-        /*
-         * Cancel the alarm we set to limit the time taken for
-         * authentication.
-         */
-        alarm(0);
-        if (startup_pipe != -1) {
-                close(startup_pipe);
-                startup_pipe = -1;
-        }
        /* setup the channel layer */
        if (!no_port_forwarding_flag && options.allow_tcp_forwarding)
                channel_permit_all_opens();
@@ -1423,7 +1414,7 @@ child_close_fds(void)
        endpwent();
        /*
-         * Close any extra open file descriptors so that we don\'t have them
+         * Close any extra open file descriptors so that we don't have them
         * hanging around in clients.  Note that we want to do this after
         * initgroups, because at least on Solaris 2.3 it leaves file
         * descriptors open.
@@ -1475,7 +1466,9 @@ do_child(Session *s, const char *command)
                if (!check_quietlogin(s, command))
                        do_motd();
 #else /* HAVE_OSF_SIA */
-                do_nologin(pw);
+                /* When PAM is enabled we rely on it to do the nologin check */
+                if (!options.use_pam)
+                        do_nologin(pw);
                do_setusercontext(pw);
                /*
                 * PAM session modules in do_setusercontext may have
@@ -1556,7 +1549,7 @@ do_child(Session *s, const char *command)
        }
 #endif
-        /* Change current directory to the user\'s home directory. */
+        /* Change current directory to the user's home directory. */
        if (chdir(pw->pw_dir) < 0) {
                fprintf(stderr, "Could not chdir to home directory %s: %s\n",
                    pw->pw_dir, strerror(errno));
@@ -1871,7 +1864,7 @@ session_x11_req(Session *s)
        if (s->auth_proto != NULL || s->auth_data != NULL) {
                error("session_x11_req: session %d: "
-                    "x11 fowarding already active", s->self);
+                    "x11 forwarding already active", s->self);
                return 0;
        }
        s->single_connection = packet_get_char();
@@ -2103,7 +2096,7 @@ session_close_x11(int id)
 {
        Channel *c;
-        if ((c = channel_lookup(id)) == NULL) {
+        if ((c = channel_by_id(id)) == NULL) {
                debug("session_close_x11: x11 channel %d missing", id);
        } else {
                /* Detach X11 listener */
@@ -2158,7 +2151,6 @@ static void
 session_exit_message(Session *s, int status)
 {
        Channel *c;
-        u_int i;
        if ((c = channel_lookup(s->chanid)) == NULL)
                fatal("session_exit_message: session %d: no channel %d",
@@ -2188,7 +2180,14 @@ session_exit_message(Session *s, int status)
        /* disconnect channel */
        debug("session_exit_message: release channel %d", s->chanid);
-        channel_cancel_cleanup(s->chanid);
+        /*
+         * Adjust cleanup callback attachment to send close messages when
+         * the channel gets EOF. The session will be then be closed 
+         * by session_close_by_channel when the childs close their fds.
+         */
+        channel_register_cleanup(c->self, session_close_by_channel, 1);
        /*
         * emulate a write failure with 'chan_write_failed', nobody will be
         * interested in data we write.
@@ -2197,15 +2196,6 @@ session_exit_message(Session *s, int status)
         */
        if (c->ostate != CHAN_OUTPUT_CLOSED)
                chan_write_failed(c);
-        s->chanid = -1;
-        /* Close any X11 listeners associated with this session */
-        if (s->x11_chanids != NULL) {
-                for (i = 0; s->x11_chanids[i] != -1; i++) {
-                        session_close_x11(s->x11_chanids[i]);
-                        s->x11_chanids[i] = -1;
-                }
-        }
 }
 void
@@ -2249,7 +2239,9 @@ session_close_by_pid(pid_t pid, int status)
        }
        if (s->chanid != -1)
                session_exit_message(s, status);
-        session_close(s);
+        if (s->ttyfd != -1)
+                session_pty_cleanup(s);
+        s->pid = 0;
 }
 /*
@@ -2260,6 +2252,7 @@ void
 session_close_by_channel(int id, void *arg)
 {
        Session *s = session_by_channel(id);
+        u_int i;
        if (s == NULL) {
                debug("session_close_by_channel: no session for id %d", id);
@@ -2279,6 +2272,15 @@ session_close_by_channel(int id, void *arg)
        }
        /* detach by removing callback */
        channel_cancel_cleanup(s->chanid);
+        /* Close any X11 listeners associated with this session */
+        if (s->x11_chanids != NULL) {
+                for (i = 0; s->x11_chanids[i] != -1; i++) {
+                        session_close_x11(s->x11_chanids[i]);
+                        s->x11_chanids[i] = -1;
+                }
+        }
        s->chanid = -1;
        session_close(s);
 }
@@ -2373,7 +2375,7 @@ session_setup_x11fwd(Session *s)
        }
        for (i = 0; s->x11_chanids[i] != -1; i++) {
                channel_register_cleanup(s->x11_chanids[i],
-                    session_close_single_x11);
+                    session_close_single_x11, 0);
        }
        /* Set up a suitable value for the DISPLAY variable. */
diff --git a/sftp-client.c b/sftp-client.c
index afbd1e6f3..05bce3368 100644
--- a/sftp-client.c
+++ b/sftp-client.c
@@ -20,7 +20,7 @@
 /* XXX: copy between two remote sites */
 #include "includes.h"
-RCSID("$OpenBSD: sftp-client.c,v 1.57 2005/07/27 10:39:03 dtucker Exp $");
+RCSID("$OpenBSD: sftp-client.c,v 1.58 2006/01/02 01:20:31 djm Exp $");
 #include "openbsd-compat/sys-queue.h"
@@ -42,9 +42,6 @@ extern int showprogress;
 /* Minimum amount of data to read at at time */
 #define MIN_READ_SIZE   512
-/* Maximum packet size */
-#define MAX_MSG_LENGTH  (256 * 1024)
 struct sftp_conn {
        int fd_in;
        int fd_out;
@@ -59,7 +56,7 @@ send_msg(int fd, Buffer *m)
 {
        u_char mlen[4];
-        if (buffer_len(m) > MAX_MSG_LENGTH)
+        if (buffer_len(m) > SFTP_MAX_MSG_LENGTH)
                fatal("Outbound message too long %u", buffer_len(m));
        /* Send length first */
@@ -87,7 +84,7 @@ get_msg(int fd, Buffer *m)
        }
        msg_len = buffer_get_int(m);
-        if (msg_len > MAX_MSG_LENGTH)
+        if (msg_len > SFTP_MAX_MSG_LENGTH)
                fatal("Received message too long %u", msg_len);
        buffer_append_space(m, msg_len);
diff --git a/sftp-common.h b/sftp-common.h
index b42ba9140..2b1995a2d 100644
--- a/sftp-common.h
+++ b/sftp-common.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: sftp-common.h,v 1.5 2003/11/10 16:23:41 jakob Exp $   */
+/*      $OpenBSD: sftp-common.h,v 1.6 2006/01/02 01:20:31 djm Exp $     */
 /*
 * Copyright (c) 2001 Markus Friedl.  All rights reserved.
@@ -25,6 +25,9 @@
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */
+/* Maximum packet that we are willing to send/accept */
+#define SFTP_MAX_MSG_LENGTH     (256 * 1024)
 typedef struct Attrib Attrib;
 /* File attributes */
diff --git a/sftp-server.0 b/sftp-server.0
index 285ff706e..5367b5fdb 100644
--- a/sftp-server.0
+++ b/sftp-server.0
@@ -24,4 +24,4 @@ AUTHORS
 HISTORY
     sftp-server first appeared in OpenBSD 2.8 .
-OpenBSD 3.8                     August 30, 2000                              1
+OpenBSD 3.9                     August 30, 2000                              1
diff --git a/sftp-server.c b/sftp-server.c
index 6870e7732..7060c44ad 100644
--- a/sftp-server.c
+++ b/sftp-server.c
@@ -14,13 +14,14 @@
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */
 #include "includes.h"
-RCSID("$OpenBSD: sftp-server.c,v 1.48 2005/06/17 02:44:33 djm Exp $");
+RCSID("$OpenBSD: sftp-server.c,v 1.50 2006/01/02 01:20:31 djm Exp $");
 #include "buffer.h"
 #include "bufaux.h"
 #include "getput.h"
 #include "log.h"
 #include "xmalloc.h"
+#include "misc.h"
 #include "sftp.h"
 #include "sftp-common.h"
@@ -427,7 +428,7 @@ process_read(void)
        len = get_int();
        TRACE("read id %u handle %d off %llu len %d", id, handle,
-            (u_int64_t)off, len);
+            (unsigned long long)off, len);
        if (len > sizeof buf) {
                len = sizeof buf;
                logit("read change len %d", len);
@@ -468,7 +469,7 @@ process_write(void)
        data = get_string(&len);
        TRACE("write id %u handle %d off %llu len %d", id, handle,
-            (u_int64_t)off, len);
+            (unsigned long long)off, len);
        fd = handle_to_fd(handle);
        if (fd >= 0) {
                if (lseek(fd, off, SEEK_SET) < 0) {
@@ -945,7 +946,7 @@ process(void)
                return;         /* Incomplete message. */
        cp = buffer_ptr(&iqueue);
        msg_len = GET_32BIT(cp);
-        if (msg_len > 256 * 1024) {
+        if (msg_len > SFTP_MAX_MSG_LENGTH) {
                error("bad message ");
                exit(11);
        }
@@ -1036,6 +1037,9 @@ main(int ac, char **av)
        int in, out, max;
        ssize_t len, olen, set_size;
+        /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
+        sanitise_stdfd();
        /* XXX should use getopt */
        __progname = ssh_get_progname(av[0]);
diff --git a/sftp.0 b/sftp.0
index 1205c437b..77ab78d96 100644
--- a/sftp.0
+++ b/sftp.0
@@ -25,8 +25,8 @@ DESCRIPTION
     The third usage format allows sftp to start in a remote directory.
     The final usage format allows for automated sessions using the -b option.
-     In such cases, it is usually necessary to configure public key authenti-
+     In such cases, it is necessary to configure non-interactive authentica-
-     cation to obviate the need to enter a password at connection time (see
+     tion to obviate the need to enter a password at connection time (see
     sshd(8) and ssh-keygen(1) for details).  The options are as follows:
     -1      Specify the use of protocol version 1.
@@ -96,6 +96,7 @@ DESCRIPTION
                   Protocol
                   ProxyCommand
                   PubkeyAuthentication
+                   RekeyLimit
                   RhostsRSAAuthentication
                   RSAAuthentication
                   SendEnv
@@ -262,4 +263,4 @@ SEE ALSO
     T. Ylonen and S. Lehtinen, SSH File Transfer Protocol, draft-ietf-secsh-
     filexfer-00.txt, January 2001, work in progress material.
-OpenBSD 3.8                    February 4, 2001                              4
+OpenBSD 3.9                    February 4, 2001                              4
diff --git a/sftp.1 b/sftp.1
index c89ffc30f..47aafa89e 100644
--- a/sftp.1
+++ b/sftp.1
@@ -1,4 +1,4 @@
-.\" $OpenBSD: sftp.1,v 1.61 2005/03/01 17:19:35 jmc Exp $
+.\" $OpenBSD: sftp.1,v 1.63 2006/01/20 00:14:55 dtucker Exp $
 .\"
 .\" Copyright (c) 2001 Damien Miller.  All rights reserved.
 .\"
@@ -78,7 +78,7 @@ to start in a remote directory.
 The final usage format allows for automated sessions using the
 .Fl b
 option.
-In such cases, it is usually necessary to configure public key authentication
+In such cases, it is necessary to configure non-interactive authentication
 to obviate the need to enter a password at connection time (see
 .Xr sshd 8
 and
@@ -180,6 +180,7 @@ For full details of the options listed below, and their possible values, see
 .It Protocol
 .It ProxyCommand
 .It PubkeyAuthentication
+.It RekeyLimit
 .It RhostsRSAAuthentication
 .It RSAAuthentication
 .It SendEnv
diff --git a/sftp.c b/sftp.c
index f98ed7d27..a2e3f6aad 100644
--- a/sftp.c
+++ b/sftp.c
@@ -16,7 +16,7 @@
 #include "includes.h"
-RCSID("$OpenBSD: sftp.c,v 1.66 2005/08/08 13:22:48 jaredy Exp $");
+RCSID("$OpenBSD: sftp.c,v 1.70 2006/01/31 10:19:02 djm Exp $");
 #ifdef USE_LIBEDIT
 #include <histedit.h>
@@ -697,6 +697,8 @@ do_ls_dir(struct sftp_conn *conn, char *path, char *strip_path, int lflag)
        }
        if (lflag & SORT_FLAGS) {
+                for (n = 0; d[n] != NULL; n++)
+                        ;       /* count entries */
                sort_flag = lflag & (SORT_FLAGS|LS_REVERSE_SORT);
                qsort(d, n, sizeof(*d), sdirent_comp);
        }
@@ -1447,11 +1449,16 @@ main(int argc, char **argv)
        extern int optind;
        extern char *optarg;
+        /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
+        sanitise_stdfd();
        __progname = ssh_get_progname(argv[0]);
+        memset(&args, '\0', sizeof(args));
        args.list = NULL;
-        addargs(&args, "ssh");          /* overwritten with ssh_program */
+        addargs(&args, ssh_program);
        addargs(&args, "-oForwardX11 no");
        addargs(&args, "-oForwardAgent no");
+        addargs(&args, "-oPermitLocalCommand no");
        addargs(&args, "-oClearAllForwardings yes");
        ll = SYSLOG_LEVEL_INFO;
@@ -1483,6 +1490,7 @@ main(int argc, char **argv)
                        break;
                case 'S':
                        ssh_program = optarg;
+                        replacearg(&args, 0, "%s", ssh_program);
                        break;
                case 'b':
                        if (batchmode)
@@ -1559,7 +1567,6 @@ main(int argc, char **argv)
                addargs(&args, "%s", host);
                addargs(&args, "%s", (sftp_server != NULL ?
                    sftp_server : "sftp"));
-                args.list[0] = ssh_program;
                if (!batchmode)
                        fprintf(stderr, "Connecting to %s...\n", host);
@@ -1572,6 +1579,7 @@ main(int argc, char **argv)
                        fprintf(stderr, "Attaching to %s...\n", sftp_direct);
                connect_to_server(sftp_direct, args.list, &in, &out);
        }
+        freeargs(&args);
        err = interactive_loop(in, out, file1, file2);
diff --git a/ssh-add.0 b/ssh-add.0
index 1c2455f9b..ee05d09d6 100644
--- a/ssh-add.0
+++ b/ssh-add.0
@@ -99,4 +99,4 @@ AUTHORS
     ated OpenSSH.  Markus Friedl contributed the support for SSH protocol
     versions 1.5 and 2.0.
-OpenBSD 3.8                   September 25, 1999                             2
+OpenBSD 3.9                   September 25, 1999                             2
diff --git a/ssh-add.c b/ssh-add.c
index a3428769c..2b01e6f13 100644
--- a/ssh-add.c
+++ b/ssh-add.c
@@ -35,7 +35,7 @@
 */
 #include "includes.h"
-RCSID("$OpenBSD: ssh-add.c,v 1.72 2005/07/17 07:17:55 djm Exp $");
+RCSID("$OpenBSD: ssh-add.c,v 1.74 2005/11/12 18:37:59 deraadt Exp $");
 #include <openssl/evp.h>
@@ -312,6 +312,9 @@ main(int argc, char **argv)
        char *sc_reader_id = NULL;
        int i, ch, deleting = 0, ret = 0;
+        /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
+        sanitise_stdfd();
        __progname = ssh_get_progname(argv[0]);
        init_rng();
        seed_rng();
@@ -321,7 +324,8 @@ main(int argc, char **argv)
        /* At first, get a connection to the authentication agent. */
        ac = ssh_get_authentication_connection();
        if (ac == NULL) {
-                fprintf(stderr, "Could not open a connection to your authentication agent.\n");
+                fprintf(stderr,
+                    "Could not open a connection to your authentication agent.\n");
                exit(2);
        }
        while ((ch = getopt(argc, argv, "lLcdDxXe:s:t:")) != -1) {
diff --git a/ssh-agent.0 b/ssh-agent.0
index 8490a9da8..7d64d550f 100644
--- a/ssh-agent.0
+++ b/ssh-agent.0
@@ -19,7 +19,7 @@ DESCRIPTION
     -a bind_address
             Bind the agent to the unix-domain socket bind_address.  The de-
-             fault is /tmp/ssh-XXXXXXXX/agent.<ppid>.
+             fault is /tmp/ssh-XXXXXXXXXX/agent.<ppid>.
     -c      Generate C-shell commands on stdout.  This is the default if
             SHELL looks like it's a csh style of shell.
@@ -33,9 +33,9 @@ DESCRIPTION
     -t life
             Set a default value for the maximum lifetime of identities added
             to the agent.  The lifetime may be specified in seconds or in a
-             time format specified in sshd(8).  A lifetime specified for an
+             time format specified in sshd_config(5).  A lifetime specified
-             identity with ssh-add(1) overrides this value.  Without this op-
+             for an identity with ssh-add(1) overrides this value.  Without
-             tion the default maximum lifetime is forever.
+             this option the default maximum lifetime is forever.
     -d      Debug mode.  When this option is specified ssh-agent will not
             fork.
@@ -98,7 +98,7 @@ FILES
             Contains the protocol version 2 RSA authentication identity of
             the user.
-     /tmp/ssh-XXXXXXXX/agent.<ppid>
+     /tmp/ssh-XXXXXXXXXX/agent.<ppid>
             Unix-domain sockets used to contain the connection to the authen-
             tication agent.  These sockets should only be readable by the
             owner.  The sockets should get automatically removed when the
@@ -114,4 +114,4 @@ AUTHORS
     ated OpenSSH.  Markus Friedl contributed the support for SSH protocol
     versions 1.5 and 2.0.
-OpenBSD 3.8                   September 25, 1999                             2
+OpenBSD 3.9                   September 25, 1999                             2
diff --git a/ssh-agent.1 b/ssh-agent.1
index 741cf4bd1..fd6bd3f6c 100644
--- a/ssh-agent.1
+++ b/ssh-agent.1
@@ -1,4 +1,4 @@
-.\" $OpenBSD: ssh-agent.1,v 1.42 2005/04/21 06:17:50 djm Exp $
+.\" $OpenBSD: ssh-agent.1,v 1.43 2005/11/28 06:02:56 dtucker Exp $
 .\"
 .\" Author: Tatu Ylonen <ylo@cs.hut.fi>
 .\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -70,7 +70,7 @@ The options are as follows:
 Bind the agent to the unix-domain socket
 .Ar bind_address .
 The default is
-.Pa /tmp/ssh-XXXXXXXX/agent.<ppid> .
+.Pa /tmp/ssh-XXXXXXXXXX/agent.<ppid> .
 .It Fl c
 Generate C-shell commands on
 .Dv stdout .
@@ -90,7 +90,7 @@ environment variable).
 .It Fl t Ar life
 Set a default value for the maximum lifetime of identities added to the agent.
 The lifetime may be specified in seconds or in a time format specified in
-.Xr sshd 8 .
+.Xr sshd_config 5 .
 A lifetime specified for an identity with
 .Xr ssh-add 1
 overrides this value.
@@ -185,7 +185,7 @@ Contains the protocol version 1 RSA authentication identity of the user.
 Contains the protocol version 2 DSA authentication identity of the user.
 .It Pa ~/.ssh/id_rsa
 Contains the protocol version 2 RSA authentication identity of the user.
-.It Pa /tmp/ssh-XXXXXXXX/agent.<ppid>
+.It Pa /tmp/ssh-XXXXXXXXXX/agent.<ppid>
 Unix-domain sockets used to contain the connection to the
 authentication agent.
 These sockets should only be readable by the owner.
diff --git a/ssh-agent.c b/ssh-agent.c
index dd7e22ad5..a69c25eec 100644
--- a/ssh-agent.c
+++ b/ssh-agent.c
@@ -35,7 +35,7 @@
 #include "includes.h"
 #include "openbsd-compat/sys-queue.h"
-RCSID("$OpenBSD: ssh-agent.c,v 1.122 2004/10/29 22:53:56 djm Exp $");
+RCSID("$OpenBSD: ssh-agent.c,v 1.124 2005/10/30 08:52:18 djm Exp $");
 #include <openssl/evp.h>
 #include <openssl/md5.h>
@@ -355,7 +355,7 @@ process_remove_identity(SocketEntry *e, int version)
                if (id != NULL) {
                        /*
                         * We have this key.  Free the old key.  Since we
-                         * don\'t want to leave empty slots in the middle of
+                         * don't want to leave empty slots in the middle of
                         * the array, we actually free the key there and move
                         * all the entries between the empty slot and the end
                         * of the array.
@@ -1008,6 +1008,9 @@ main(int ac, char **av)
        pid_t pid;
        char pidstrbuf[1 + 3 * sizeof pid];
+        /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
+        sanitise_stdfd();
        /* drop */
        setegid(getgid());
        setgid(getgid());
diff --git a/ssh-keygen.0 b/ssh-keygen.0
index de651e9c4..a972607b2 100644
--- a/ssh-keygen.0
+++ b/ssh-keygen.0
@@ -27,7 +27,9 @@ DESCRIPTION
     ssh-keygen generates, manages and converts authentication keys for
     ssh(1).  ssh-keygen can create RSA keys for use by SSH protocol version 1
     and RSA or DSA keys for use by SSH protocol version 2.  The type of key
-     to be generated is specified with the -t option.
+     to be generated is specified with the -t option.  If invoked without any
+     arguments, ssh-keygen will generate an RSA key for use in SSH protocol 2
+     connections.
     ssh-keygen is also used to generate groups for use in Diffie-Hellman
     group exchange (DH-GEX).  See the MODULI GENERATION section for details.
@@ -74,9 +76,10 @@ DESCRIPTION
             file.
     -b bits
-             Specifies the number of bits in the key to create.  Minimum is
+             Specifies the number of bits in the key to create.  For RSA keys,
-             512 bits.  Generally, 2048 bits is considered sufficient.  The
+             the minimum size is 768 bits and the default is 2048 bits.  Gen-
-             default is 2048 bits.
+             erally, 2048 bits is considered sufficient.  DSA keys must be ex-
+             actly 1024 bits as specified by FIPS 186-2.
     -C comment
             Provides a new comment.
@@ -282,4 +285,4 @@ AUTHORS
     created OpenSSH.  Markus Friedl contributed the support for SSH protocol
     versions 1.5 and 2.0.
-OpenBSD 3.8                   September 25, 1999                             5
+OpenBSD 3.9                   September 25, 1999                             5
diff --git a/ssh-keygen.1 b/ssh-keygen.1
index 5454d00ce..ab16bcd77 100644
--- a/ssh-keygen.1
+++ b/ssh-keygen.1
@@ -1,4 +1,4 @@
-.\"     $OpenBSD: ssh-keygen.1,v 1.69 2005/06/08 03:50:00 djm Exp $
+.\"     $OpenBSD: ssh-keygen.1,v 1.72 2005/11/28 05:16:53 dtucker Exp $
 .\"
 .\"  -*- nroff -*-
 .\"
@@ -118,6 +118,9 @@ keys for use by SSH protocol version 2.
 The type of key to be generated is specified with the
 .Fl t
 option.
+If invoked without any arguments,
+.Nm
+will generate an RSA key for use in SSH protocol 2 connections.
 .Pp
 .Nm
 is also used to generate groups for use in Diffie-Hellman group
@@ -187,9 +190,9 @@ command.
 Show the bubblebabble digest of specified private or public key file.
 .It Fl b Ar bits
 Specifies the number of bits in the key to create.
-Minimum is 512 bits.
+For RSA keys, the minimum size is 768 bits and the default is 2048 bits.
 Generally, 2048 bits is considered sufficient.
-The default is 2048 bits.
+DSA keys must be exactly 1024 bits as specified by FIPS 186-2.
 .It Fl C Ar comment
 Provides a new comment.
 .It Fl c
diff --git a/ssh-keygen.c b/ssh-keygen.c
index b17851946..64fadc7a1 100644
--- a/ssh-keygen.c
+++ b/ssh-keygen.c
@@ -12,7 +12,7 @@
 */
 #include "includes.h"
-RCSID("$OpenBSD: ssh-keygen.c,v 1.128 2005/07/17 07:17:55 djm Exp $");
+RCSID("$OpenBSD: ssh-keygen.c,v 1.135 2005/11/29 02:04:55 dtucker Exp $");
 #include <openssl/evp.h>
 #include <openssl/pem.h>
@@ -35,8 +35,10 @@ RCSID("$OpenBSD: ssh-keygen.c,v 1.128 2005/07/17 07:17:55 djm Exp $");
 #endif
 #include "dns.h"
-/* Number of bits in the RSA/DSA key.  This value can be changed on the command line. */
+/* Number of bits in the RSA/DSA key.  This value can be set on the command line. */
-u_int32_t bits = 2048;
+#define DEFAULT_BITS            2048
+#define DEFAULT_BITS_DSA        1024
+u_int32_t bits = 0;
 /*
 * Flag indicating that we just want to change the passphrase.  This can be
@@ -1018,6 +1020,9 @@ main(int ac, char **av)
        extern int optind;
        extern char *optarg;
+        /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
+        sanitise_stdfd();
        __progname = ssh_get_progname(av[0]);
        SSLeay_add_all_algorithms();
@@ -1041,7 +1046,7 @@ main(int ac, char **av)
            "degiqpclBHvxXyF:b:f:t:U:D:P:N:C:r:g:R:T:G:M:S:a:W:")) != -1) {
                switch (opt) {
                case 'b':
-                        bits = strtonum(optarg, 512, 32768, &errstr);
+                        bits = strtonum(optarg, 768, 32768, &errstr);
                        if (errstr)
                                fatal("Bits has bad value %s (%s)",
                                        optarg, errstr);
@@ -1214,8 +1219,10 @@ main(int ac, char **av)
                            out_file, strerror(errno));
                        return (1);
                }
+                if (bits == 0)
+                        bits = DEFAULT_BITS;
                if (gen_candidates(out, memory, bits, start) != 0)
-                        fatal("modulus candidate generation failed\n");
+                        fatal("modulus candidate generation failed");
                return (0);
        }
@@ -1238,21 +1245,24 @@ main(int ac, char **av)
                            out_file, strerror(errno));
                }
                if (prime_test(in, out, trials, generator_wanted) != 0)
-                        fatal("modulus screening failed\n");
+                        fatal("modulus screening failed");
                return (0);
        }
        arc4random_stir();
-        if (key_type_name == NULL) {
+        if (key_type_name == NULL)
-                printf("You must specify a key type (-t).\n");
+                key_type_name = "rsa";
-                usage();
-        }
        type = key_type_from_name(key_type_name);
        if (type == KEY_UNSPEC) {
                fprintf(stderr, "unknown key type %s\n", key_type_name);
                exit(1);
        }
+        if (bits == 0)
+                bits = (type == KEY_DSA) ? DEFAULT_BITS_DSA : DEFAULT_BITS;
+        if (type == KEY_DSA && bits != 1024)
+                fatal("DSA keys must be 1024 bits");
        if (!quiet)
                printf("Generating public/private %s key pair.\n", key_type_name);
        private = key_generate(type, bits);
@@ -1265,7 +1275,7 @@ main(int ac, char **av)
        if (!have_identity)
                ask_filename(pw, "Enter file in which to save the key");
-        /* Create ~/.ssh directory if it doesn\'t already exist. */
+        /* Create ~/.ssh directory if it doesn't already exist. */
        snprintf(dotsshdir, sizeof dotsshdir, "%s/%s", pw->pw_dir, _PATH_SSH_USER_DIR);
        if (strstr(identity_file, dotsshdir) != NULL &&
            stat(dotsshdir, &st) < 0) {
diff --git a/ssh-keyscan.0 b/ssh-keyscan.0
index b365148e4..0206c04fb 100644
--- a/ssh-keyscan.0
+++ b/ssh-keyscan.0
@@ -94,9 +94,9 @@ SEE ALSO
     ssh(1), sshd(8)
 AUTHORS
-     David Mazieres <dm@lcs.mit.edu> wrote the initial version, and
+     David Mazieres <dm@lcs.mit.edu> wrote the initial version, and Wayne
-     Wayne Davison <wayned@users.sourceforge.net> added support for protocol
+     Davison <wayned@users.sourceforge.net> added support for protocol version
-     version 2.
+     2.
 BUGS
     It generates "Connection closed by remote host" messages on the consoles
@@ -104,4 +104,4 @@ BUGS
     This is because it opens a connection to the ssh port, reads the public
     key, and drops the connection as soon as it gets the key.
-OpenBSD 3.8                     January 1, 1996                              2
+OpenBSD 3.9                     January 1, 1996                              2
diff --git a/ssh-keyscan.1 b/ssh-keyscan.1
index 7e846f77c..80fc8cd96 100644
--- a/ssh-keyscan.1
+++ b/ssh-keyscan.1
@@ -1,4 +1,4 @@
-.\"     $OpenBSD: ssh-keyscan.1,v 1.20 2005/03/01 15:47:14 jmc Exp $
+.\"     $OpenBSD: ssh-keyscan.1,v 1.21 2005/09/30 20:34:26 jaredy Exp $
 .\"
 .\" Copyright 1995, 1996 by David Mazieres <dm@lcs.mit.edu>.
 .\"
@@ -156,6 +156,7 @@ $ ssh-keyscan -t rsa,dsa -f ssh_hosts | \e
 .Xr ssh 1 ,
 .Xr sshd 8
 .Sh AUTHORS
+.An -nosplit
 .An David Mazieres Aq dm@lcs.mit.edu
 wrote the initial version, and
 .An Wayne Davison Aq wayned@users.sourceforge.net
diff --git a/ssh-keyscan.c b/ssh-keyscan.c
index 64eecfb9a..f429c2c02 100644
--- a/ssh-keyscan.c
+++ b/ssh-keyscan.c
@@ -7,7 +7,7 @@
 */
 #include "includes.h"
-RCSID("$OpenBSD: ssh-keyscan.c,v 1.55 2005/06/17 02:44:33 djm Exp $");
+RCSID("$OpenBSD: ssh-keyscan.c,v 1.57 2005/10/30 04:01:03 djm Exp $");
 #include "openbsd-compat/sys-queue.h"
@@ -499,12 +499,18 @@ congreet(int s)
        size_t bufsiz;
        con *c = &fdcon[s];
-        bufsiz = sizeof(buf);
+        for (;;) {
-        cp = buf;
+                memset(buf, '\0', sizeof(buf));
-        while (bufsiz-- && (n = atomicio(read, s, cp, 1)) == 1 && *cp != '\n') {
+                bufsiz = sizeof(buf);
-                if (*cp == '\r')
+                cp = buf;
-                        *cp = '\n';
+                while (bufsiz-- &&
-                cp++;
+                    (n = atomicio(read, s, cp, 1)) == 1 && *cp != '\n') {
+                        if (*cp == '\r')
+                                *cp = '\n';
+                        cp++;
+                }
+                if (n != 1 || strncmp(buf, "SSH-", 4) == 0)
+                        break;
        }
        if (n == 0) {
                switch (errno) {
@@ -712,6 +718,9 @@ main(int argc, char **argv)
        seed_rng();
        TAILQ_INIT(&tq);
+        /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
+        sanitise_stdfd();
        if (argc <= 1)
                usage();
diff --git a/ssh-keysign.0 b/ssh-keysign.0
index ea944a6fe..c32c42fb2 100644
--- a/ssh-keysign.0
+++ b/ssh-keysign.0
@@ -39,4 +39,4 @@ HISTORY
 AUTHORS
     Markus Friedl <markus@openbsd.org>
-OpenBSD 3.8                      May 24, 2002                                1
+OpenBSD 3.9                      May 24, 2002                                1
diff --git a/ssh-keysign.c b/ssh-keysign.c
index 04597a91d..dae3a2e8c 100644
--- a/ssh-keysign.c
+++ b/ssh-keysign.c
@@ -22,7 +22,7 @@
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */
 #include "includes.h"
-RCSID("$OpenBSD: ssh-keysign.c,v 1.18 2004/08/23 14:29:23 dtucker Exp $");
+RCSID("$OpenBSD: ssh-keysign.c,v 1.19 2005/09/13 23:40:07 djm Exp $");
 #include <openssl/evp.h>
 #include <openssl/rand.h>
@@ -148,6 +148,13 @@ main(int argc, char **argv)
        u_int slen, dlen;
        u_int32_t rnd[256];
+        /* Ensure that stdin and stdout are connected */
+        if ((fd = open(_PATH_DEVNULL, O_RDWR)) < 2)
+                exit(1);
+        /* Leave /dev/null fd iff it is attached to stderr */
+        if (fd > 2)
+                close(fd);
        key_fd[0] = open(_PATH_HOST_RSA_KEY_FILE, O_RDONLY);
        key_fd[1] = open(_PATH_HOST_DSA_KEY_FILE, O_RDONLY);
diff --git a/ssh-rand-helper.0 b/ssh-rand-helper.0
index 35a7a7ce5..75ad52fa4 100644
--- a/ssh-rand-helper.0
+++ b/ssh-rand-helper.0
@@ -46,4 +46,4 @@ AUTHORS
 SEE ALSO
     ssh(1), ssh-add(1), ssh-keygen(1), sshd(8)
-OpenBSD 3.8                     April 14, 2002                               1
+OpenBSD 3.9                     April 14, 2002                               1
diff --git a/ssh.0 b/ssh.0
index 274fab8b5..83c4b94eb 100644
--- a/ssh.0
+++ b/ssh.0
@@ -5,208 +5,26 @@ NAME
 SYNOPSIS
     ssh [-1246AaCfgkMNnqsTtVvXxY] [-b bind_address] [-c cipher_spec]
-         [-D port] [-e escape_char] [-F configfile] [-i identity_file]
+         [-D [bind_address:]port] [-e escape_char] [-F configfile]
-         [-L [bind_address:]port:host:hostport] [-l login_name] [-m mac_spec]
+         [-i identity_file] [-L [bind_address:]port:host:hostport]
-         [-O ctl_cmd] [-o option] [-p port]
+         [-l login_name] [-m mac_spec] [-O ctl_cmd] [-o option] [-p port]
-         [-R [bind_address:]port:host:hostport] [-S ctl_path] [user@]hostname
+         [-R [bind_address:]port:host:hostport] [-S ctl_path]
-         [command]
+         [-w tunnel:tunnel] [user@]hostname [command]
 DESCRIPTION
     ssh (SSH client) is a program for logging into a remote machine and for
     executing commands on a remote machine.  It is intended to replace rlogin
     and rsh, and provide secure encrypted communications between two untrust-
-     ed hosts over an insecure network.  X11 connections and arbitrary TCP/IP
+     ed hosts over an insecure network.  X11 connections and arbitrary TCP
     ports can also be forwarded over the secure channel.
     ssh connects and logs into the specified hostname (with optional user
     name).  The user must prove his/her identity to the remote machine using
-     one of several methods depending on the protocol version used.
+     one of several methods depending on the protocol version used (see be-
+     low).
-     If command is specified, command is executed on the remote host instead
+     If command is specified, it is executed on the remote host instead of a
-     of a login shell.
+     login shell.
-   SSH protocol version 1
-     The first authentication method is the rhosts or hosts.equiv method com-
-     bined with RSA-based host authentication.  If the machine the user logs
-     in from is listed in /etc/hosts.equiv or /etc/shosts.equiv on the remote
-     machine, and the user names are the same on both sides, or if the files
-     ~/.rhosts or ~/.shosts exist in the user's home directory on the remote
-     machine and contain a line containing the name of the client machine and
-     the name of the user on that machine, the user is considered for log in.
-     Additionally, if the server can verify the client's host key (see
-     /etc/ssh/ssh_known_hosts and ~/.ssh/known_hosts in the FILES section),
-     only then is login permitted.  This authentication method closes security
-     holes due to IP spoofing, DNS spoofing and routing spoofing.  [Note to
-     the administrator: /etc/hosts.equiv, ~/.rhosts, and the rlogin/rsh proto-
-     col in general, are inherently insecure and should be disabled if securi-
-     ty is desired.]
-     As a second authentication method, ssh supports RSA based authentication.
-     The scheme is based on public-key cryptography: there are cryptosystems
-     where encryption and decryption are done using separate keys, and it is
-     not possible to derive the decryption key from the encryption key.  RSA
-     is one such system.  The idea is that each user creates a public/private
-     key pair for authentication purposes.  The server knows the public key,
-     and only the user knows the private key.
-     The file ~/.ssh/authorized_keys lists the public keys that are permitted
-     for logging in.  When the user logs in, the ssh program tells the server
-     which key pair it would like to use for authentication.  The server
-     checks if this key is permitted, and if so, sends the user (actually the
-     ssh program running on behalf of the user) a challenge, a random number,
-     encrypted by the user's public key.  The challenge can only be decrypted
-     using the proper private key.  The user's client then decrypts the chal-
-     lenge using the private key, proving that he/she knows the private key
-     but without disclosing it to the server.
-     ssh implements the RSA authentication protocol automatically.  The user
-     creates his/her RSA key pair by running ssh-keygen(1).  This stores the
-     private key in ~/.ssh/identity and stores the public key in
-     ~/.ssh/identity.pub in the user's home directory.  The user should then
-     copy the identity.pub to ~/.ssh/authorized_keys in his/her home directory
-     on the remote machine (the authorized_keys file corresponds to the con-
-     ventional ~/.rhosts file, and has one key per line, though the lines can
-     be very long).  After this, the user can log in without giving the pass-
-     word.
-     The most convenient way to use RSA authentication may be with an authen-
-     tication agent.  See ssh-agent(1) for more information.
-     If other authentication methods fail, ssh prompts the user for a pass-
-     word.  The password is sent to the remote host for checking; however,
-     since all communications are encrypted, the password cannot be seen by
-     someone listening on the network.
-   SSH protocol version 2
-     When a user connects using protocol version 2, similar authentication
-     methods are available.  Using the default values for
-     PreferredAuthentications, the client will try to authenticate first using
-     the hostbased method; if this method fails, public key authentication is
-     attempted, and finally if this method fails, keyboard-interactive and
-     password authentication are tried.
-     The public key method is similar to RSA authentication described in the
-     previous section and allows the RSA or DSA algorithm to be used: The
-     client uses his private key, ~/.ssh/id_dsa or ~/.ssh/id_rsa, to sign the
-     session identifier and sends the result to the server.  The server checks
-     whether the matching public key is listed in ~/.ssh/authorized_keys and
-     grants access if both the key is found and the signature is correct.  The
-     session identifier is derived from a shared Diffie-Hellman value and is
-     only known to the client and the server.
-     If public key authentication fails or is not available, a password can be
-     sent encrypted to the remote host to prove the user's identity.
-     Additionally, ssh supports hostbased or challenge response authentica-
-     tion.
-     Protocol 2 provides additional mechanisms for confidentiality (the traf-
-     fic is encrypted using AES, 3DES, Blowfish, CAST128 or Arcfour) and in-
-     tegrity (hmac-md5, hmac-sha1, hmac-ripemd160).  Note that protocol 1
-     lacks a strong mechanism for ensuring the integrity of the connection.
-   Login session and remote execution
-     When the user's identity has been accepted by the server, the server ei-
-     ther executes the given command, or logs into the machine and gives the
-     user a normal shell on the remote machine.  All communication with the
-     remote command or shell will be automatically encrypted.
-     If a pseudo-terminal has been allocated (normal login session), the user
-     may use the escape characters noted below.
-     If no pseudo-tty has been allocated, the session is transparent and can
-     be used to reliably transfer binary data.  On most systems, setting the
-     escape character to ``none'' will also make the session transparent even
-     if a tty is used.
-     The session terminates when the command or shell on the remote machine
-     exits and all X11 and TCP/IP connections have been closed.  The exit sta-
-     tus of the remote program is returned as the exit status of ssh.
-   Escape Characters
-     When a pseudo-terminal has been requested, ssh supports a number of func-
-     tions through the use of an escape character.
-     A single tilde character can be sent as ~~ or by following the tilde by a
-     character other than those described below.  The escape character must
-     always follow a newline to be interpreted as special.  The escape charac-
-     ter can be changed in configuration files using the EscapeChar configura-
-     tion directive or on the command line by the -e option.
-     The supported escapes (assuming the default `~') are:
-     ~.      Disconnect.
-     ~^Z     Background ssh.
-     ~#      List forwarded connections.
-     ~&      Background ssh at logout when waiting for forwarded connection /
-             X11 sessions to terminate.
-     ~?      Display a list of escape characters.
-     ~B      Send a BREAK to the remote system (only useful for SSH protocol
-             version 2 and if the peer supports it).
-     ~C      Open command line.  Currently this allows the addition of port
-             forwardings using the -L and -R options (see below).  It also al-
-             lows the cancellation of existing remote port-forwardings using
-             -KR hostport.  Basic help is available, using the -h option.
-     ~R      Request rekeying of the connection (only useful for SSH protocol
-             version 2 and if the peer supports it).
-   X11 and TCP forwarding
-     If the ForwardX11 variable is set to ``yes'' (or see the description of
-     the -X and -x options described later) and the user is using X11 (the
-     DISPLAY environment variable is set), the connection to the X11 display
-     is automatically forwarded to the remote side in such a way that any X11
-     programs started from the shell (or command) will go through the encrypt-
-     ed channel, and the connection to the real X server will be made from the
-     local machine.  The user should not manually set DISPLAY.  Forwarding of
-     X11 connections can be configured on the command line or in configuration
-     files.
-     The DISPLAY value set by ssh will point to the server machine, but with a
-     display number greater than zero.  This is normal, and happens because
-     ssh creates a ``proxy'' X server on the server machine for forwarding the
-     connections over the encrypted channel.
-     ssh will also automatically set up Xauthority data on the server machine.
-     For this purpose, it will generate a random authorization cookie, store
-     it in Xauthority on the server, and verify that any forwarded connections
-     carry this cookie and replace it by the real cookie when the connection
-     is opened.  The real authentication cookie is never sent to the server
-     machine (and no cookies are sent in the plain).
-     If the ForwardAgent variable is set to ``yes'' (or see the description of
-     the -A and -a options described later) and the user is using an authenti-
-     cation agent, the connection to the agent is automatically forwarded to
-     the remote side.
-     Forwarding of arbitrary TCP/IP connections over the secure channel can be
-     specified either on the command line or in a configuration file.  One
-     possible application of TCP/IP forwarding is a secure connection to an
-     electronic purse; another is going through firewalls.
-   Server authentication
-     ssh automatically maintains and checks a database containing identifica-
-     tions for all hosts it has ever been used with.  Host keys are stored in
-     ~/.ssh/known_hosts in the user's home directory.  Additionally, the file
-     /etc/ssh/ssh_known_hosts is automatically checked for known hosts.  Any
-     new hosts are automatically added to the user's file.  If a host's iden-
-     tification ever changes, ssh warns about this and disables password au-
-     thentication to prevent a trojan horse from getting the user's password.
-     Another purpose of this mechanism is to prevent man-in-the-middle attacks
-     which could otherwise be used to circumvent the encryption.  The
-     StrictHostKeyChecking option can be used to prevent logins to machines
-     whose host key is not known or has changed.
-     ssh can be configured to verify host identification using fingerprint re-
-     source records (SSHFP) published in DNS.  The VerifyHostKeyDNS option can
-     be used to control how DNS lookups are performed.  SSHFP resource records
-     can be generated using ssh-keygen(1).
     The options are as follows:
@@ -238,7 +56,7 @@ DESCRIPTION
             dress.
     -C      Requests compression of all data (including stdin, stdout,
-             stderr, and data for forwarded X11 and TCP/IP connections).  The
+             stderr, and data for forwarded X11 and TCP connections).  The
             compression algorithm is the same used by gzip(1), and the
             ``level'' can be controlled by the CompressionLevel option for
             protocol version 1.  Compression is desirable on modem lines and
@@ -250,7 +68,7 @@ DESCRIPTION
             Selects the cipher specification for encrypting the session.
             Protocol version 1 allows specification of a single cipher.  The
-             suported values are ``3des'', ``blowfish'' and ``des''.  3des
+             supported values are ``3des'', ``blowfish'', and ``des''.  3des
             (triple-des) is an encrypt-decrypt-encrypt triple with three dif-
             ferent keys.  It is believed to be secure.  blowfish is a fast
             block cipher; it appears very secure and is much faster than
@@ -259,29 +77,39 @@ DESCRIPTION
             the 3des cipher.  Its use is strongly discouraged due to crypto-
             graphic weaknesses.  The default is ``3des''.
-             For protocol version 2 cipher_spec is a comma-separated list of
+             For protocol version 2, cipher_spec is a comma-separated list of
-             ciphers listed in order of preference.  The supported ciphers are
+             ciphers listed in order of preference.  The supported ciphers
-             ``3des-cbc'', ``aes128-cbc'', ``aes192-cbc'', ``aes256-cbc'',
+             are: 3des-cbc, aes128-cbc, aes192-cbc, aes256-cbc, aes128-ctr,
-             ``aes128-ctr'', ``aes192-ctr'', ``aes256-ctr'', ``arcfour128'',
+             aes192-ctr, aes256-ctr, arcfour128, arcfour256, arcfour, blow-
-             ``arcfour256'', ``arcfour'', ``blowfish-cbc'', and
+             fish-cbc, and cast128-cbc.  The default is:
-             ``cast128-cbc''.  The default is
-               ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,
+                   aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,
-                 arcfour256,arcfour,aes192-cbc,aes256-cbc,aes128-ctr,
+                   arcfour256,arcfour,aes192-cbc,aes256-cbc,aes128-ctr,
-                 aes192-ctr,aes256-ctr''
+                   aes192-ctr,aes256-ctr
-     -D port
+     -D [bind_address:]port
             Specifies a local ``dynamic'' application-level port forwarding.
             This works by allocating a socket to listen to port on the local
-             side, and whenever a connection is made to this port, the connec-
+             side, optionally bound to the specified bind_address.  Whenever a
-             tion is forwarded over the secure channel, and the application
+             connection is made to this port, the connection is forwarded over
-             protocol is then used to determine where to connect to from the
+             the secure channel, and the application protocol is then used to
-             remote machine.  Currently the SOCKS4 and SOCKS5 protocols are
+             determine where to connect to from the remote machine.  Currently
-             supported, and ssh will act as a SOCKS server.  Only root can
+             the SOCKS4 and SOCKS5 protocols are supported, and ssh will act
-             forward privileged ports.  Dynamic port forwardings can also be
+             as a SOCKS server.  Only root can forward privileged ports.  Dy-
-             specified in the configuration file.
+             namic port forwardings can also be specified in the configuration
+             file.
-     -e ch | ^ch | none
+             IPv6 addresses can be specified with an alternative syntax:
+             [bind_address/]port or by enclosing the address in square brack-
+             ets.  Only the superuser can forward privileged ports.  By de-
+             fault, the local port is bound in accordance with the
+             GatewayPorts setting.  However, an explicit bind_address may be
+             used to bind the connection to a specific address.  The
+             bind_address of ``localhost'' indicates that the listening port
+             be bound for local use only, while an empty address or `*' indi-
+             cates that the port should be available from all interfaces.
+     -e escape_char
             Sets the escape character for sessions with a pty (default: `~').
             The escape character is only recognized at the beginning of a
             line.  The escape character followed by a dot (`.') closes the
@@ -305,9 +133,10 @@ DESCRIPTION
     -g      Allows remote hosts to connect to local forwarded ports.
     -I smartcard_device
-             Specifies which smartcard device to use.  The argument is the de-
+             Specify the device ssh should use to communicate with a smartcard
-             vice ssh should use to communicate with a smartcard used for
+             used for storing the user's private RSA key.  This option is only
-             storing the user's private RSA key.
+             available if support for smartcard devices is compiled in (de-
+             fault is no support).
     -i identity_file
             Selects a file from which the identity (private key) for RSA or
@@ -345,8 +174,10 @@ DESCRIPTION
             may be specified on a per-host basis in the configuration file.
     -M      Places the ssh client into ``master'' mode for connection shar-
-             ing.  Refer to the description of ControlMaster in ssh_config(5)
+             ing.  Multiple -M options places ssh into ``master'' mode with
-             for details.
+             confirmation required before slave connections are accepted.  Re-
+             fer to the description of ControlMaster in ssh_config(5) for de-
+             tails.
     -m mac_spec
             Additionally, for protocol version 2 a comma-separated list of
@@ -410,17 +241,20 @@ DESCRIPTION
                   IdentityFile
                   IdentitiesOnly
                   KbdInteractiveDevices
+                   LocalCommand
                   LocalForward
                   LogLevel
                   MACs
                   NoHostAuthenticationForLocalhost
                   NumberOfPasswordPrompts
                   PasswordAuthentication
+                   PermitLocalCommand
                   Port
                   PreferredAuthentications
                   Protocol
                   ProxyCommand
                   PubkeyAuthentication
+                   RekeyLimit
                   RemoteForward
                   RhostsRSAAuthentication
                   RSAAuthentication
@@ -430,6 +264,8 @@ DESCRIPTION
                   SmartcardDevice
                   StrictHostKeyChecking
                   TCPKeepAlive
+                   Tunnel
+                   TunnelDevice
                   UsePrivilegedPort
                   User
                   UserKnownHostsFile
@@ -489,6 +325,12 @@ DESCRIPTION
             tion, and configuration problems.  Multiple -v options increase
             the verbosity.  The maximum is 3.
+     -w tunnel:tunnel
+             Requests a tun(4) device on the client (first tunnel arg) and
+             server (second tunnel arg).  The devices may be specified by nu-
+             merical ID or the keyword ``any'', which uses the next available
+             tunnel device.  See also the Tunnel directive in ssh_config(5).
     -X      Enables X11 forwarding.  This can also be specified on a per-host
             basis in a configuration file.
@@ -508,100 +350,358 @@ DESCRIPTION
     -Y      Enables trusted X11 forwarding.  Trusted X11 forwardings are not
             subjected to the X11 SECURITY extension controls.
-CONFIGURATION FILES
     ssh may additionally obtain configuration data from a per-user configura-
     tion file and a system-wide configuration file.  The file format and con-
     figuration options are described in ssh_config(5).
-ENVIRONMENT
+     ssh exits with the exit status of the remote command or with 255 if an
-     ssh will normally set the following environment variables:
+     error occurred.
+AUTHENTICATION
+     The OpenSSH SSH client supports SSH protocols 1 and 2.  Protocol 2 is the
+     default, with ssh falling back to protocol 1 if it detects protocol 2 is
+     unsupported.  These settings may be altered using the Protocol option in
+     ssh_config(5), or enforced using the -1 and -2 options (see above).  Both
+     protocols support similar authentication methods, but protocol 2 is pre-
+     ferred since it provides additional mechanisms for confidentiality (the
+     traffic is encrypted using AES, 3DES, Blowfish, CAST128, or Arcfour) and
+     integrity (hmac-md5, hmac-sha1, hmac-ripemd160).  Protocol 1 lacks a
+     strong mechanism for ensuring the integrity of the connection.
+     The methods available for authentication are: host-based authentication,
+     public key authentication, challenge-response authentication, and pass-
+     word authentication.  Authentication methods are tried in the order spec-
+     ified above, though protocol 2 has a configuration option to change the
+     default order: PreferredAuthentications.
+     Host-based authentication works as follows: If the machine the user logs
+     in from is listed in /etc/hosts.equiv or /etc/shosts.equiv on the remote
+     machine, and the user names are the same on both sides, or if the files
+     ~/.rhosts or ~/.shosts exist in the user's home directory on the remote
+     machine and contain a line containing the name of the client machine and
+     the name of the user on that machine, the user is considered for login.
+     Additionally, the server must be able to verify the client's host key
+     (see the description of /etc/ssh/ssh_known_hosts and ~/.ssh/known_hosts,
+     below) for login to be permitted.  This authentication method closes se-
+     curity holes due to IP spoofing, DNS spoofing, and routing spoofing.
+     [Note to the administrator: /etc/hosts.equiv, ~/.rhosts, and the
+     rlogin/rsh protocol in general, are inherently insecure and should be
+     disabled if security is desired.]
+     Public key authentication works as follows: The scheme is based on pub-
+     lic-key cryptography, using cryptosystems where encryption and decryption
+     are done using separate keys, and it is unfeasible to derive the decryp-
+     tion key from the encryption key.  The idea is that each user creates a
+     public/private key pair for authentication purposes.  The server knows
+     the public key, and only the user knows the private key.  ssh implements
+     public key authentication protocol automatically, using either the RSA or
+     DSA algorithms.  Protocol 1 is restricted to using only RSA keys, but
+     protocol 2 may use either.  The HISTORY section of ssl(8) contains a
+     brief discussion of the two algorithms.
+     The file ~/.ssh/authorized_keys lists the public keys that are permitted
+     for logging in.  When the user logs in, the ssh program tells the server
+     which key pair it would like to use for authentication.  The client
+     proves that it has access to the private key and the server checks that
+     the corresponding public key is authorized to accept the account.
+     The user creates his/her key pair by running ssh-keygen(1).  This stores
+     the private key in ~/.ssh/identity (protocol 1), ~/.ssh/id_dsa (protocol
+     2 DSA), or ~/.ssh/id_rsa (protocol 2 RSA) and stores the public key in
+     ~/.ssh/identity.pub (protocol 1), ~/.ssh/id_dsa.pub (protocol 2 DSA), or
+     ~/.ssh/id_rsa.pub (protocol 2 RSA) in the user's home directory.  The us-
+     er should then copy the public key to ~/.ssh/authorized_keys in his/her
+     home directory on the remote machine.  The authorized_keys file corre-
+     sponds to the conventional ~/.rhosts file, and has one key per line,
+     though the lines can be very long.  After this, the user can log in with-
+     out giving the password.
+     The most convenient way to use public key authentication may be with an
+     authentication agent.  See ssh-agent(1) for more information.
+     Challenge-response authentication works as follows: The server sends an
+     arbitrary "challenge" text, and prompts for a response.  Protocol 2 al-
+     lows multiple challenges and responses; protocol 1 is restricted to just
+     one challenge/response.  Examples of challenge-response authentication
+     include BSD Authentication (see login.conf(5)) and PAM (some non-OpenBSD
+     systems).
+     Finally, if other authentication methods fail, ssh prompts the user for a
+     password.  The password is sent to the remote host for checking; however,
+     since all communications are encrypted, the password cannot be seen by
+     someone listening on the network.
+     ssh automatically maintains and checks a database containing identifica-
+     tion for all hosts it has ever been used with.  Host keys are stored in
+     ~/.ssh/known_hosts in the user's home directory.  Additionally, the file
+     /etc/ssh/ssh_known_hosts is automatically checked for known hosts.  Any
+     new hosts are automatically added to the user's file.  If a host's iden-
+     tification ever changes, ssh warns about this and disables password au-
+     thentication to prevent server spoofing or man-in-the-middle attacks,
+     which could otherwise be used to circumvent the encryption.  The
+     StrictHostKeyChecking option can be used to control logins to machines
+     whose host key is not known or has changed.
+     When the user's identity has been accepted by the server, the server ei-
+     ther executes the given command, or logs into the machine and gives the
+     user a normal shell on the remote machine.  All communication with the
+     remote command or shell will be automatically encrypted.
+     If a pseudo-terminal has been allocated (normal login session), the user
+     may use the escape characters noted below.
+     If no pseudo-tty has been allocated, the session is transparent and can
+     be used to reliably transfer binary data.  On most systems, setting the
+     escape character to ``none'' will also make the session transparent even
+     if a tty is used.
+     The session terminates when the command or shell on the remote machine
+     exits and all X11 and TCP connections have been closed.
+ESCAPE CHARACTERS
+     When a pseudo-terminal has been requested, ssh supports a number of func-
+     tions through the use of an escape character.
+     A single tilde character can be sent as ~~ or by following the tilde by a
+     character other than those described below.  The escape character must
+     always follow a newline to be interpreted as special.  The escape charac-
+     ter can be changed in configuration files using the EscapeChar configura-
+     tion directive or on the command line by the -e option.
+     The supported escapes (assuming the default `~') are:
+     ~.      Disconnect.
+     ~^Z     Background ssh.
+     ~#      List forwarded connections.
+     ~&      Background ssh at logout when waiting for forwarded connection /
+             X11 sessions to terminate.
+     ~?      Display a list of escape characters.
+     ~B      Send a BREAK to the remote system (only useful for SSH protocol
+             version 2 and if the peer supports it).
+     ~C      Open command line.  Currently this allows the addition of port
+             forwardings using the -L and -R options (see above).  It also al-
+             lows the cancellation of existing remote port-forwardings using
+             -KR hostport.  !command allows the user to execute a local com-
+             mand if the PermitLocalCommand option is enabled in
+             ssh_config(5).  Basic help is available, using the -h option.
+     ~R      Request rekeying of the connection (only useful for SSH protocol
+             version 2 and if the peer supports it).
+TCP FORWARDING
+     Forwarding of arbitrary TCP connections over the secure channel can be
+     specified either on the command line or in a configuration file.  One
+     possible application of TCP forwarding is a secure connection to a mail
+     server; another is going through firewalls.
+     In the example below, we look at encrypting communication between an IRC
+     client and server, even though the IRC server does not directly support
+     encrypted communications.  This works as follows: the user connects to
+     the remote host using ssh, specifying a port to be used to forward con-
+     nections to the remote server.  After that it is possible to start the
+     service which is to be encrypted on the client machine, connecting to the
+     same local port, and ssh will encrypt and forward the connection.
+     The following example tunnels an IRC session from client machine
+     ``127.0.0.1'' (localhost) to remote server ``server.example.com'':
+         $ ssh -f -L 1234:localhost:6667 server.example.com sleep 10
+         $ irc -c '#users' -p 1234 pinky 127.0.0.1
+     This tunnels a connection to IRC server ``server.example.com'', joining
+     channel ``#users'', nickname ``pinky'', using port 1234.  It doesn't mat-
+     ter which port is used, as long as it's greater than 1023 (remember, only
+     root can open sockets on privileged ports) and doesn't conflict with any
+     ports already in use.  The connection is forwarded to port 6667 on the
+     remote server, since that's the standard port for IRC services.
+     The -f option backgrounds ssh and the remote command ``sleep 10'' is
+     specified to allow an amount of time (10 seconds, in the example) to
+     start the service which is to be tunnelled.  If no connections are made
+     within the time specified, ssh will exit.
+X11 FORWARDING
+     If the ForwardX11 variable is set to ``yes'' (or see the description of
+     the -X, -x, and -Y options above) and the user is using X11 (the DISPLAY
+     environment variable is set), the connection to the X11 display is auto-
+     matically forwarded to the remote side in such a way that any X11 pro-
+     grams started from the shell (or command) will go through the encrypted
+     channel, and the connection to the real X server will be made from the
+     local machine.  The user should not manually set DISPLAY.  Forwarding of
+     X11 connections can be configured on the command line or in configuration
+     files.
+     The DISPLAY value set by ssh will point to the server machine, but with a
+     display number greater than zero.  This is normal, and happens because
+     ssh creates a ``proxy'' X server on the server machine for forwarding the
+     connections over the encrypted channel.
+     ssh will also automatically set up Xauthority data on the server machine.
+     For this purpose, it will generate a random authorization cookie, store
+     it in Xauthority on the server, and verify that any forwarded connections
+     carry this cookie and replace it by the real cookie when the connection
+     is opened.  The real authentication cookie is never sent to the server
+     machine (and no cookies are sent in the plain).
+     If the ForwardAgent variable is set to ``yes'' (or see the description of
+     the -A and -a options above) and the user is using an authentication
+     agent, the connection to the agent is automatically forwarded to the re-
+     mote side.
+VERIFYING HOST KEYS
+     When connecting to a server for the first time, a fingerprint of the
+     server's public key is presented to the user (unless the option
+     StrictHostKeyChecking has been disabled).  Fingerprints can be determined
+     using ssh-keygen(1):
+           $ ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key
+     If the fingerprint is already known, it can be matched and verified, and
+     the key can be accepted.  If the fingerprint is unknown, an alternative
+     method of verification is available: SSH fingerprints verified by DNS.
+     An additional resource record (RR), SSHFP, is added to a zonefile and the
+     connecting client is able to match the fingerprint with that of the key
+     presented.
+     In this example, we are connecting a client to a server,
+     ``host.example.com''.  The SSHFP resource records should first be added
+     to the zonefile for host.example.com:
-     DISPLAY  The DISPLAY variable indicates the location of the X11 server.
+           $ ssh-keygen -f /etc/ssh/ssh_host_rsa_key.pub -r host.example.com.
-              It is automatically set by ssh to point to a value of the form
+           $ ssh-keygen -f /etc/ssh/ssh_host_dsa_key.pub -r host.example.com.
-              ``hostname:n'' where hostname indicates the host where the shell
-              runs, and n is an integer >= 1.  ssh uses this special value to
-              forward X11 connections over the secure channel.  The user
-              should normally not set DISPLAY explicitly, as that will render
-              the X11 connection insecure (and will require the user to manu-
-              ally copy any required authorization cookies).
-     HOME     Set to the path of the user's home directory.
+     The output lines will have to be added to the zonefile.  To check that
+     the zone is answering fingerprint queries:
-     LOGNAME  Synonym for USER; set for compatibility with systems that use
+           $ dig -t SSHFP host.example.com
-              this variable.
-     MAIL     Set to the path of the user's mailbox.
+     Finally the client connects:
-     PATH     Set to the default PATH, as specified when compiling ssh.
+           $ ssh -o "VerifyHostKeyDNS ask" host.example.com
+           [...]
+           Matching host key fingerprint found in DNS.
+           Are you sure you want to continue connecting (yes/no)?
-     SSH_ASKPASS
+     See the VerifyHostKeyDNS option in ssh_config(5) for more information.
-              If ssh needs a passphrase, it will read the passphrase from the
-              current terminal if it was run from a terminal.  If ssh does not
-              have a terminal associated with it but DISPLAY and SSH_ASKPASS
-              are set, it will execute the program specified by SSH_ASKPASS
-              and open an X11 window to read the passphrase.  This is particu-
-              larly useful when calling ssh from a .xsession or related
-              script.  (Note that on some machines it may be necessary to
-              redirect the input from /dev/null to make this work.)
-     SSH_AUTH_SOCK
+SSH-BASED VIRTUAL PRIVATE NETWORKS
-              Identifies the path of a unix-domain socket used to communicate
+     ssh contains support for Virtual Private Network (VPN) tunnelling using
-              with the agent.
+     the tun(4) network pseudo-device, allowing two networks to be joined se-
+     curely.  The sshd_config(5) configuration option PermitTunnel controls
+     whether the server supports this, and at what level (layer 2 or 3 traf-
+     fic).
-     SSH_CONNECTION
+     The following example would connect client network 10.0.50.0/24 with re-
-              Identifies the client and server ends of the connection.  The
+     mote network 10.0.99.0/24, provided that the SSH server running on the
-              variable contains four space-separated values: client ip-ad-
+     gateway to the remote network, at 192.168.1.15, allows it:
-              dress, client port number, server ip-address and server port
-              number.
-     SSH_ORIGINAL_COMMAND
+           # ssh -f -w 0:1 192.168.1.15 true
-              The variable contains the original command line if a forced com-
+           # ifconfig tun0 10.0.50.1 10.0.99.1 netmask 255.255.255.252
-              mand is executed.  It can be used to extract the original argu-
-              ments.
-     SSH_TTY  This is set to the name of the tty (path to the device) associ-
+     Client access may be more finely tuned via the /root/.ssh/authorized_keys
-              ated with the current shell or command.  If the current session
+     file (see below) and the PermitRootLogin server option.  The following
-              has no tty, this variable is not set.
+     entry would permit connections on the first tun(4) device from user
+     ``jane'' and on the second device from user ``john'', if PermitRootLogin
+     is set to ``forced-commands-only'':
-     TZ       The timezone variable is set to indicate the present timezone if
+       tunnel="1",command="sh /etc/netstart tun1" ssh-rsa ... jane
-              it was set when the daemon was started (i.e., the daemon passes
+       tunnel="2",command="sh /etc/netstart tun1" ssh-rsa ... john
-              the value on to new connections).
-     USER     Set to the name of the user logging in.
+     Since a SSH-based setup entails a fair amount of overhead, it may be more
+     suited to temporary setups, such as for wireless VPNs.  More permanent
+     VPNs are better provided by tools such as ipsecctl(8) and isakmpd(8).
+ENVIRONMENT
+     ssh will normally set the following environment variables:
+     DISPLAY               The DISPLAY variable indicates the location of the
+                           X11 server.  It is automatically set by ssh to
+                           point to a value of the form ``hostname:n'', where
+                           ``hostname'' indicates the host where the shell
+                           runs, and `n' is an integer >= 1.  ssh uses this
+                           special value to forward X11 connections over the
+                           secure channel.  The user should normally not set
+                           DISPLAY explicitly, as that will render the X11
+                           connection insecure (and will require the user to
+                           manually copy any required authorization cookies).
+     HOME                  Set to the path of the user's home directory.
+     LOGNAME               Synonym for USER; set for compatibility with sys-
+                           tems that use this variable.
+     MAIL                  Set to the path of the user's mailbox.
+     PATH                  Set to the default PATH, as specified when compil-
+                           ing ssh.
+     SSH_ASKPASS           If ssh needs a passphrase, it will read the
+                           passphrase from the current terminal if it was run
+                           from a terminal.  If ssh does not have a terminal
+                           associated with it but DISPLAY and SSH_ASKPASS are
+                           set, it will execute the program specified by
+                           SSH_ASKPASS and open an X11 window to read the
+                           passphrase.  This is particularly useful when call-
+                           ing ssh from a .xsession or related script.  (Note
+                           that on some machines it may be necessary to redi-
+                           rect the input from /dev/null to make this work.)
+     SSH_AUTH_SOCK         Identifies the path of a UNIX-domain socket used to
+                           communicate with the agent.
+     SSH_CONNECTION        Identifies the client and server ends of the con-
+                           nection.  The variable contains four space-separat-
+                           ed values: client IP address, client port number,
+                           server IP address, and server port number.
+     SSH_ORIGINAL_COMMAND  This variable contains the original command line if
+                           a forced command is executed.  It can be used to
+                           extract the original arguments.
+     SSH_TTY               This is set to the name of the tty (path to the de-
+                           vice) associated with the current shell or command.
+                           If the current session has no tty, this variable is
+                           not set.
+     TZ                    This variable is set to indicate the present time
+                           zone if it was set when the daemon was started
+                           (i.e., the daemon passes the value on to new con-
+                           nections).
+     USER                  Set to the name of the user logging in.
     Additionally, ssh reads ~/.ssh/environment, and adds lines of the format
-     ``VARNAME=value'' to the environment if the file exists and if users are
+     ``VARNAME=value'' to the environment if the file exists and users are al-
-     allowed to change their environment.  For more information, see the
+     lowed to change their environment.  For more information, see the
     PermitUserEnvironment option in sshd_config(5).
 FILES
-     ~/.ssh/known_hosts
+     ~/.rhosts
-             Records host keys for all hosts the user has logged into that are
+             This file is used for host-based authentication (see above).  On
-             not in /etc/ssh/ssh_known_hosts.  See sshd(8).
+             some machines this file may need to be world-readable if the us-
+             er's home directory is on an NFS partition, because sshd(8) reads
-     ~/.ssh/identity, ~/.ssh/id_dsa, ~/.ssh/id_rsa
+             it as root.  Additionally, this file must be owned by the user,
-             Contains the authentication identity of the user.  They are for
+             and must not have write permissions for anyone else.  The recom-
-             protocol 1 RSA, protocol 2 DSA, and protocol 2 RSA, respectively.
+             mended permission for most machines is read/write for the user,
-             These files contain sensitive data and should be readable by the
+             and not accessible by others.
-             user but not accessible by others (read/write/execute).  Note
-             that ssh ignores a private key file if it is accessible by oth-
+     ~/.shosts
-             ers.  It is possible to specify a passphrase when generating the
+             This file is used in exactly the same way as .rhosts, but allows
-             key; the passphrase will be used to encrypt the sensitive part of
+             host-based authentication without permitting login with
-             this file using 3DES.
+             rlogin/rsh.
-     ~/.ssh/identity.pub, ~/.ssh/id_dsa.pub, ~/.ssh/id_rsa.pub
+     ~/.ssh/authorized_keys
-             Contains the public key for authentication (public part of the
+             Lists the public keys (RSA/DSA) that can be used for logging in
-             identity file in human-readable form).  The contents of the
+             as this user.  The format of this file is described in the
-             ~/.ssh/identity.pub file should be added to the file
+             sshd(8) manual page.  This file is not highly sensitive, but the
-             ~/.ssh/authorized_keys on all machines where the user wishes to
+             recommended permissions are read/write for the user, and not ac-
-             log in using protocol version 1 RSA authentication.  The contents
+             cessible by others.
-             of the ~/.ssh/id_dsa.pub and ~/.ssh/id_rsa.pub file should be
-             added to ~/.ssh/authorized_keys on all machines where the user
-             wishes to log in using protocol version 2 DSA/RSA authentication.
-             These files are not sensitive and can (but need not) be readable
-             by anyone.  These files are never used automatically and are not
-             necessary; they are only provided for the convenience of the us-
-             er.
     ~/.ssh/config
             This is the per-user configuration file.  The file format and
@@ -609,112 +709,75 @@ FILES
             the potential for abuse, this file must have strict permissions:
             read/write for the user, and not accessible by others.
-     ~/.ssh/authorized_keys
+     ~/.ssh/environment
-             Lists the public keys (RSA/DSA) that can be used for logging in
+             Contains additional definitions for environment variables; see
-             as this user.  The format of this file is described in the
+             ENVIRONMENT, above.
-             sshd(8) manual page.  In the simplest form the format is the same
-             as the .pub identity files.  This file is not highly sensitive,
+     ~/.ssh/identity
-             but the recommended permissions are read/write for the user, and
+     ~/.ssh/id_dsa
-             not accessible by others.
+     ~/.ssh/id_rsa
+             Contains the private key for authentication.  These files contain
+             sensitive data and should be readable by the user but not acces-
+             sible by others (read/write/execute).  ssh will simply ignore a
+             private key file if it is accessible by others.  It is possible
+             to specify a passphrase when generating the key which will be
+             used to encrypt the sensitive part of this file using 3DES.
+     ~/.ssh/identity.pub
+     ~/.ssh/id_dsa.pub
+     ~/.ssh/id_rsa.pub
+             Contains the public key for authentication.  These files are not
+             sensitive and can (but need not) be readable by anyone.
-     /etc/ssh/ssh_known_hosts
+     ~/.ssh/known_hosts
-             Systemwide list of known host keys.  This file should be prepared
+             Contains a list of host keys for all hosts the user has logged
-             by the system administrator to contain the public host keys of
+             into that are not already in the systemwide list of known host
-             all machines in the organization.  This file should be world-
+             keys.  See sshd(8) for further details of the format of this
-             readable.  This file contains public keys, one per line, in the
+             file.
-             following format (fields separated by spaces): system name, pub-
-             lic key and optional comment field.  When different names are
+     ~/.ssh/rc
-             used for the same machine, all such names should be listed, sepa-
+             Commands in this file are executed by ssh when the user logs in,
-             rated by commas.  The format is described in the sshd(8) manual
+             just before the user's shell (or command) is started.  See the
-             page.
+             sshd(8) manual page for more information.
-             The canonical system name (as returned by name servers) is used
+     /etc/hosts.equiv
-             by sshd(8) to verify the client host when logging in; other names
+             This file is for host-based authentication (see above).  It
-             are needed because ssh does not convert the user-supplied name to
+             should only be writable by root.
-             a canonical name before checking the key, because someone with
-             access to the name servers would then be able to fool host au-
+     /etc/shosts.equiv
-             thentication.
+             This file is used in exactly the same way as hosts.equiv, but al-
+             lows host-based authentication without permitting login with
+             rlogin/rsh.
     /etc/ssh/ssh_config
             Systemwide configuration file.  The file format and configuration
             options are described in ssh_config(5).
-     /etc/ssh/ssh_host_key, /etc/ssh/ssh_host_dsa_key,
+     /etc/ssh/ssh_host_key
-             /etc/ssh/ssh_host_rsa_key
+     /etc/ssh/ssh_host_dsa_key
+     /etc/ssh/ssh_host_rsa_key
             These three files contain the private parts of the host keys and
-             are used for RhostsRSAAuthentication and HostbasedAuthentication.
+             are used for host-based authentication.  If protocol version 1 is
-             If the protocol version 1 RhostsRSAAuthentication method is used,
+             used, ssh must be setuid root, since the host key is readable on-
-             ssh must be setuid root, since the host key is readable only by
+             ly by root.  For protocol version 2, ssh uses ssh-keysign(8) to
-             root.  For protocol version 2, ssh uses ssh-keysign(8) to access
+             access the host keys, eliminating the requirement that ssh be se-
-             the host keys for HostbasedAuthentication.  This eliminates the
+             tuid root when host-based authentication is used.  By default ssh
-             requirement that ssh be setuid root when that authentication
+             is not setuid root.
-             method is used.  By default ssh is not setuid root.
-     ~/.rhosts
+     /etc/ssh/ssh_known_hosts
-             This file is used in RhostsRSAAuthentication and
+             Systemwide list of known host keys.  This file should be prepared
-             HostbasedAuthentication authentication to list the host/user
+             by the system administrator to contain the public host keys of
-             pairs that are permitted to log in.  (Note that this file is also
+             all machines in the organization.  It should be world-readable.
-             used by rlogin and rsh, which makes using this file insecure.)
+             See sshd(8) for further details of the format of this file.
-             Each line of the file contains a host name (in the canonical form
-             returned by name servers), and then a user name on that host,
-             separated by a space.  On some machines this file may need to be
-             world-readable if the user's home directory is on a NFS parti-
-             tion, because sshd(8) reads it as root.  Additionally, this file
-             must be owned by the user, and must not have write permissions
-             for anyone else.  The recommended permission for most machines is
-             read/write for the user, and not accessible by others.
-             Note that sshd(8) allows authentication only in combination with
-             client host key authentication before permitting log in.  If the
-             server machine does not have the client's host key in
-             /etc/ssh/ssh_known_hosts, it can be stored in ~/.ssh/known_hosts.
-             The easiest way to do this is to connect back to the client from
-             the server machine using ssh; this will automatically add the
-             host key to ~/.ssh/known_hosts.
-     ~/.shosts
-             This file is used exactly the same way as .rhosts.  The purpose
-             for having this file is to be able to use RhostsRSAAuthentication
-             and HostbasedAuthentication authentication without permitting lo-
-             gin with rlogin or rsh(1).
-     /etc/hosts.equiv
-             This file is used during RhostsRSAAuthentication and
-             HostbasedAuthentication authentication.  It contains canonical
-             hosts names, one per line (the full format is described in the
-             sshd(8) manual page).  If the client host is found in this file,
-             login is automatically permitted provided client and server user
-             names are the same.  Additionally, successful client host key au-
-             thentication is required.  This file should only be writable by
-             root.
-     /etc/shosts.equiv
-             This file is processed exactly as /etc/hosts.equiv.  This file
-             may be useful to permit logins using ssh but not using
-             rsh/rlogin.
     /etc/ssh/sshrc
-             Commands in this file are executed by ssh when the user logs in
+             Commands in this file are executed by ssh when the user logs in,
-             just before the user's shell (or command) is started.  See the
-             sshd(8) manual page for more information.
-     ~/.ssh/rc
-             Commands in this file are executed by ssh when the user logs in
             just before the user's shell (or command) is started.  See the
             sshd(8) manual page for more information.
-     ~/.ssh/environment
-             Contains additional definitions for environment variables, see
-             section ENVIRONMENT above.
-DIAGNOSTICS
-     ssh exits with the exit status of the remote command or with 255 if an
-     error occurred.
 SEE ALSO
-     gzip(1), rsh(1), scp(1), sftp(1), ssh-add(1), ssh-agent(1),
+     scp(1), sftp(1), ssh-add(1), ssh-agent(1), ssh-keygen(1), ssh-keyscan(1),
-     ssh-keygen(1), telnet(1), hosts.equiv(5), ssh_config(5), ssh-keysign(8),
+     tun(4), hosts.equiv(5), ssh_config(5), ssh-keysign(8), sshd(8)
-     sshd(8)
     T. Ylonen, T. Kivinen, M. Saarinen, T. Rinne, and S. Lehtinen, SSH
     Protocol Architecture, draft-ietf-secsh-architecture-12.txt, January
@@ -727,4 +790,4 @@ AUTHORS
     created OpenSSH.  Markus Friedl contributed the support for SSH protocol
     versions 1.5 and 2.0.
-OpenBSD 3.8                   September 25, 1999                            12
+OpenBSD 3.9                   September 25, 1999                            12
diff --git a/ssh.1 b/ssh.1
index 9ce28be69..f7c65a372 100644
--- a/ssh.1
+++ b/ssh.1
@@ -34,7 +34,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: ssh.1,v 1.209 2005/07/06 09:33:05 dtucker Exp $
+.\" $OpenBSD: ssh.1,v 1.253 2006/01/30 13:37:49 jmc Exp $
 .Dd September 25, 1999
 .Dt SSH 1
 .Os
@@ -43,21 +43,29 @@
 .Nd OpenSSH SSH client (remote login program)
 .Sh SYNOPSIS
 .Nm ssh
-.Bk -words
 .Op Fl 1246AaCfgkMNnqsTtVvXxY
 .Op Fl b Ar bind_address
 .Op Fl c Ar cipher_spec
-.Op Fl D Ar port
+.Oo Fl D\ \&
+.Sm off
+.Oo Ar bind_address : Oc
+.Ar port
+.Sm on
+.Oc
 .Op Fl e Ar escape_char
 .Op Fl F Ar configfile
+.Bk -words
 .Op Fl i Ar identity_file
+.Ek
 .Oo Fl L\ \&
 .Sm off
 .Oo Ar bind_address : Oc
 .Ar port : host : hostport
 .Sm on
 .Oc
+.Bk -words
 .Op Fl l Ar login_name
+.Ek
 .Op Fl m Ar mac_spec
 .Op Fl O Ar ctl_cmd
 .Op Fl o Ar option
@@ -69,6 +77,8 @@
 .Sm on
 .Oc
 .Op Fl S Ar ctl_path
+.Bk -words
+.Op Fl w Ar tunnel : Ns Ar tunnel
 .Oo Ar user Ns @ Oc Ns Ar hostname
 .Op Ar command
 .Ek
@@ -79,7 +89,7 @@ executing commands on a remote machine.
 It is intended to replace rlogin and rsh,
 and provide secure encrypted communications between
 two untrusted hosts over an insecure network.
-X11 connections and arbitrary TCP/IP ports
+X11 connections and arbitrary TCP ports
 can also be forwarded over the secure channel.
 .Pp
 .Nm
@@ -90,306 +100,12 @@ connects and logs into the specified
 name).
 The user must prove
 his/her identity to the remote machine using one of several methods
-depending on the protocol version used.
+depending on the protocol version used (see below).
 .Pp
 If
 .Ar command
 is specified,
-.Ar command
+it is executed on the remote host instead of a login shell.
-is executed on the remote host instead of a login shell.
-.Ss SSH protocol version 1
-The first authentication method is the
-.Em rhosts
-or
-.Em hosts.equiv
-method combined with RSA-based host authentication.
-If the machine the user logs in from is listed in
-.Pa /etc/hosts.equiv
-or
-.Pa /etc/shosts.equiv
-on the remote machine, and the user names are
-the same on both sides, or if the files
-.Pa ~/.rhosts
-or
-.Pa ~/.shosts
-exist in the user's home directory on the
-remote machine and contain a line containing the name of the client
-machine and the name of the user on that machine, the user is
-considered for log in.
-Additionally, if the server can verify the client's
-host key (see
-.Pa /etc/ssh/ssh_known_hosts
-and
-.Pa ~/.ssh/known_hosts
-in the
-.Sx FILES
-section), only then is login permitted.
-This authentication method closes security holes due to IP
-spoofing, DNS spoofing and routing spoofing.
-[Note to the administrator:
-.Pa /etc/hosts.equiv ,
-.Pa ~/.rhosts ,
-and the rlogin/rsh protocol in general, are inherently insecure and should be
-disabled if security is desired.]
-.Pp
-As a second authentication method,
-.Nm
-supports RSA based authentication.
-The scheme is based on public-key cryptography: there are cryptosystems
-where encryption and decryption are done using separate keys, and it
-is not possible to derive the decryption key from the encryption key.
-RSA is one such system.
-The idea is that each user creates a public/private
-key pair for authentication purposes.
-The server knows the public key, and only the user knows the private key.
-.Pp
-The file
-.Pa ~/.ssh/authorized_keys
-lists the public keys that are permitted for logging in.
-When the user logs in, the
-.Nm
-program tells the server which key pair it would like to use for
-authentication.
-The server checks if this key is permitted, and if so,
-sends the user (actually the
-.Nm
-program running on behalf of the user) a challenge, a random number,
-encrypted by the user's public key.
-The challenge can only be decrypted using the proper private key.
-The user's client then decrypts the challenge using the private key,
-proving that he/she knows the private key
-but without disclosing it to the server.
-.Pp
-.Nm
-implements the RSA authentication protocol automatically.
-The user creates his/her RSA key pair by running
-.Xr ssh-keygen 1 .
-This stores the private key in
-.Pa ~/.ssh/identity
-and stores the public key in
-.Pa ~/.ssh/identity.pub
-in the user's home directory.
-The user should then copy the
-.Pa identity.pub
-to
-.Pa ~/.ssh/authorized_keys
-in his/her home directory on the remote machine (the
-.Pa authorized_keys
-file corresponds to the conventional
-.Pa ~/.rhosts
-file, and has one key
-per line, though the lines can be very long).
-After this, the user can log in without giving the password.
-.Pp
-The most convenient way to use RSA authentication may be with an
-authentication agent.
-See
-.Xr ssh-agent 1
-for more information.
-.Pp
-If other authentication methods fail,
-.Nm
-prompts the user for a password.
-The password is sent to the remote
-host for checking; however, since all communications are encrypted,
-the password cannot be seen by someone listening on the network.
-.Ss SSH protocol version 2
-When a user connects using protocol version 2,
-similar authentication methods are available.
-Using the default values for
-.Cm PreferredAuthentications ,
-the client will try to authenticate first using the hostbased method;
-if this method fails, public key authentication is attempted,
-and finally if this method fails, keyboard-interactive and
-password authentication are tried.
-.Pp
-The public key method is similar to RSA authentication described
-in the previous section and allows the RSA or DSA algorithm to be used:
-The client uses his private key,
-.Pa ~/.ssh/id_dsa
-or
-.Pa ~/.ssh/id_rsa ,
-to sign the session identifier and sends the result to the server.
-The server checks whether the matching public key is listed in
-.Pa ~/.ssh/authorized_keys
-and grants access if both the key is found and the signature is correct.
-The session identifier is derived from a shared Diffie-Hellman value
-and is only known to the client and the server.
-.Pp
-If public key authentication fails or is not available, a password
-can be sent encrypted to the remote host to prove the user's identity.
-.Pp
-Additionally,
-.Nm
-supports hostbased or challenge response authentication.
-.Pp
-Protocol 2 provides additional mechanisms for confidentiality
-(the traffic is encrypted using AES, 3DES, Blowfish, CAST128 or Arcfour)
-and integrity (hmac-md5, hmac-sha1, hmac-ripemd160).
-Note that protocol 1 lacks a strong mechanism for ensuring the
-integrity of the connection.
-.Ss Login session and remote execution
-When the user's identity has been accepted by the server, the server
-either executes the given command, or logs into the machine and gives
-the user a normal shell on the remote machine.
-All communication with
-the remote command or shell will be automatically encrypted.
-.Pp
-If a pseudo-terminal has been allocated (normal login session), the
-user may use the escape characters noted below.
-.Pp
-If no pseudo-tty has been allocated,
-the session is transparent and can be used to reliably transfer binary data.
-On most systems, setting the escape character to
-.Dq none
-will also make the session transparent even if a tty is used.
-.Pp
-The session terminates when the command or shell on the remote
-machine exits and all X11 and TCP/IP connections have been closed.
-The exit status of the remote program is returned as the exit status of
-.Nm ssh .
-.Ss Escape Characters
-When a pseudo-terminal has been requested,
-.Nm
-supports a number of functions through the use of an escape character.
-.Pp
-A single tilde character can be sent as
-.Ic ~~
-or by following the tilde by a character other than those described below.
-The escape character must always follow a newline to be interpreted as
-special.
-The escape character can be changed in configuration files using the
-.Cm EscapeChar
-configuration directive or on the command line by the
-.Fl e
-option.
-.Pp
-The supported escapes (assuming the default
-.Ql ~ )
-are:
-.Bl -tag -width Ds
-.It Cm ~.
-Disconnect.
-.It Cm ~^Z
-Background
-.Nm ssh .
-.It Cm ~#
-List forwarded connections.
-.It Cm ~&
-Background
-.Nm
-at logout when waiting for forwarded connection / X11 sessions to terminate.
-.It Cm ~?
-Display a list of escape characters.
-.It Cm ~B
-Send a BREAK to the remote system
-(only useful for SSH protocol version 2 and if the peer supports it).
-.It Cm ~C
-Open command line.
-Currently this allows the addition of port forwardings using the
-.Fl L
-and
-.Fl R
-options (see below).
-It also allows the cancellation of existing remote port-forwardings
-using
-.Fl KR Ar hostport .
-Basic help is available, using the
-.Fl h
-option.
-.It Cm ~R
-Request rekeying of the connection
-(only useful for SSH protocol version 2 and if the peer supports it).
-.El
-.Ss X11 and TCP forwarding
-If the
-.Cm ForwardX11
-variable is set to
-.Dq yes
-(or see the description of the
-.Fl X
-and
-.Fl x
-options described later)
-and the user is using X11 (the
-.Ev DISPLAY
-environment variable is set), the connection to the X11 display is
-automatically forwarded to the remote side in such a way that any X11
-programs started from the shell (or command) will go through the
-encrypted channel, and the connection to the real X server will be made
-from the local machine.
-The user should not manually set
-.Ev DISPLAY .
-Forwarding of X11 connections can be
-configured on the command line or in configuration files.
-.Pp
-The
-.Ev DISPLAY
-value set by
-.Nm
-will point to the server machine, but with a display number greater than zero.
-This is normal, and happens because
-.Nm
-creates a
-.Dq proxy
-X server on the server machine for forwarding the
-connections over the encrypted channel.
-.Pp
-.Nm
-will also automatically set up Xauthority data on the server machine.
-For this purpose, it will generate a random authorization cookie,
-store it in Xauthority on the server, and verify that any forwarded
-connections carry this cookie and replace it by the real cookie when
-the connection is opened.
-The real authentication cookie is never
-sent to the server machine (and no cookies are sent in the plain).
-.Pp
-If the
-.Cm ForwardAgent
-variable is set to
-.Dq yes
-(or see the description of the
-.Fl A
-and
-.Fl a
-options described later) and
-the user is using an authentication agent, the connection to the agent
-is automatically forwarded to the remote side.
-.Pp
-Forwarding of arbitrary TCP/IP connections over the secure channel can
-be specified either on the command line or in a configuration file.
-One possible application of TCP/IP forwarding is a secure connection to an
-electronic purse; another is going through firewalls.
-.Ss Server authentication
-.Nm
-automatically maintains and checks a database containing
-identifications for all hosts it has ever been used with.
-Host keys are stored in
-.Pa ~/.ssh/known_hosts
-in the user's home directory.
-Additionally, the file
-.Pa /etc/ssh/ssh_known_hosts
-is automatically checked for known hosts.
-Any new hosts are automatically added to the user's file.
-If a host's identification ever changes,
-.Nm
-warns about this and disables password authentication to prevent a
-trojan horse from getting the user's password.
-Another purpose of this mechanism is to prevent man-in-the-middle attacks
-which could otherwise be used to circumvent the encryption.
-The
-.Cm StrictHostKeyChecking
-option can be used to prevent logins to machines whose
-host key is not known or has changed.
-.Pp
-.Nm
-can be configured to verify host identification using fingerprint resource
-records (SSHFP) published in DNS.
-The
-.Cm VerifyHostKeyDNS
-option can be used to control how DNS lookups are performed.
-SSHFP resource records can be generated using
-.Xr ssh-keygen 1 .
 .Pp
 The options are as follows:
 .Bl -tag -width Ds
@@ -430,7 +146,7 @@ of the connection.
 Only useful on systems with more than one address.
 .It Fl C
 Requests compression of all data (including stdin, stdout, stderr, and
-data for forwarded X11 and TCP/IP connections).
+data for forwarded X11 and TCP connections).
 The compression algorithm is the same used by
 .Xr gzip 1 ,
 and the
@@ -448,9 +164,9 @@ option.
 Selects the cipher specification for encrypting the session.
 .Pp
 Protocol version 1 allows specification of a single cipher.
-The suported values are
+The supported values are
 .Dq 3des ,
-.Dq blowfish
+.Dq blowfish ,
 and
 .Dq des .
 .Ar 3des
@@ -470,37 +186,44 @@ Its use is strongly discouraged due to cryptographic weaknesses.
 The default is
 .Dq 3des .
 .Pp
-For protocol version 2
+For protocol version 2,
 .Ar cipher_spec
 is a comma-separated list of ciphers
 listed in order of preference.
-The supported ciphers are
+The supported ciphers are:
-.Dq 3des-cbc ,
+3des-cbc,
-.Dq aes128-cbc ,
+aes128-cbc,
-.Dq aes192-cbc ,
+aes192-cbc,
-.Dq aes256-cbc ,
+aes256-cbc,
-.Dq aes128-ctr ,
+aes128-ctr,
-.Dq aes192-ctr ,
+aes192-ctr,
-.Dq aes256-ctr ,
+aes256-ctr,
-.Dq arcfour128 ,
+arcfour128,
-.Dq arcfour256 ,
+arcfour256,
-.Dq arcfour ,
+arcfour,
-.Dq blowfish-cbc ,
+blowfish-cbc,
 and
-.Dq cast128-cbc .
+cast128-cbc.
-The default is
+The default is:
-.Bd -literal
+.Bd -literal -offset indent
-  ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,
+aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,
-    arcfour256,arcfour,aes192-cbc,aes256-cbc,aes128-ctr,
+arcfour256,arcfour,aes192-cbc,aes256-cbc,aes128-ctr,
-    aes192-ctr,aes256-ctr''
+aes192-ctr,aes256-ctr
 .Ed
-.It Fl D Ar port
+.It Fl D Xo
+.Sm off
+.Oo Ar bind_address : Oc
+.Ar port
+.Sm on
+.Xc
 Specifies a local
 .Dq dynamic
 application-level port forwarding.
 This works by allocating a socket to listen to
 .Ar port
-on the local side, and whenever a connection is made to this port, the
+on the local side, optionally bound to the specified
+.Ar bind_address .
+Whenever a connection is made to this port, the
 connection is forwarded over the secure channel, and the application
 protocol is then used to determine where to connect to from the
 remote machine.
@@ -509,7 +232,31 @@ Currently the SOCKS4 and SOCKS5 protocols are supported, and
 will act as a SOCKS server.
 Only root can forward privileged ports.
 Dynamic port forwardings can also be specified in the configuration file.
-.It Fl e Ar ch | ^ch | none
+.Pp
+IPv6 addresses can be specified with an alternative syntax:
+.Sm off
+.Xo
+.Op Ar bind_address No /
+.Ar port
+.Xc
+.Sm on
+or by enclosing the address in square brackets.
+Only the superuser can forward privileged ports.
+By default, the local port is bound in accordance with the
+.Cm GatewayPorts
+setting.
+However, an explicit
+.Ar bind_address
+may be used to bind the connection to a specific address.
+The
+.Ar bind_address
+of
+.Dq localhost
+indicates that the listening port be bound for local use only, while an
+empty address or
+.Sq *
+indicates that the port should be available from all interfaces.
+.It Fl e Ar escape_char
 Sets the escape character for sessions with a pty (default:
 .Ql ~ ) .
 The escape character is only recognized at the beginning of a line.
@@ -545,11 +292,12 @@ something like
 .It Fl g
 Allows remote hosts to connect to local forwarded ports.
 .It Fl I Ar smartcard_device
-Specifies which smartcard device to use.
+Specify the device
-The argument is the device
 .Nm
 should use to communicate with a smartcard used for storing the user's
 private RSA key.
+This option is only available if support for smartcard devices
+is compiled in (default is no support).
 .It Fl i Ar identity_file
 Selects a file from which the identity (private key) for
 RSA or DSA authentication is read.
@@ -621,6 +369,13 @@ Places the
 client into
 .Dq master
 mode for connection sharing.
+Multiple
+.Fl M
+options places
+.Nm
+into
+.Dq master
+mode with confirmation required before slave connections are accepted.
 Refer to the description of
 .Cm ControlMaster
 in
@@ -709,17 +464,20 @@ For full details of the options listed below, and their possible values, see
 .It IdentityFile
 .It IdentitiesOnly
 .It KbdInteractiveDevices
+.It LocalCommand
 .It LocalForward
 .It LogLevel
 .It MACs
 .It NoHostAuthenticationForLocalhost
 .It NumberOfPasswordPrompts
 .It PasswordAuthentication
+.It PermitLocalCommand
 .It Port
 .It PreferredAuthentications
 .It Protocol
 .It ProxyCommand
 .It PubkeyAuthentication
+.It RekeyLimit
 .It RemoteForward
 .It RhostsRSAAuthentication
 .It RSAAuthentication
@@ -729,6 +487,8 @@ For full details of the options listed below, and their possible values, see
 .It SmartcardDevice
 .It StrictHostKeyChecking
 .It TCPKeepAlive
+.It Tunnel
+.It TunnelDevice
 .It UsePrivilegedPort
 .It User
 .It UserKnownHostsFile
@@ -832,6 +592,24 @@ Multiple
 .Fl v
 options increase the verbosity.
 The maximum is 3.
+.It Fl w Ar tunnel : Ns Ar tunnel
+Requests a
+.Xr tun 4
+device on the client
+(first
+.Ar tunnel
+arg)
+and server
+(second
+.Ar tunnel
+arg).
+The devices may be specified by numerical ID or the keyword
+.Dq any ,
+which uses the next available tunnel device.
+See also the
+.Cm Tunnel
+directive in
+.Xr ssh_config 5 .
 .It Fl X
 Enables X11 forwarding.
 This can also be specified on a per-host basis in a configuration file.
@@ -859,16 +637,474 @@ Enables trusted X11 forwarding.
 Trusted X11 forwardings are not subjected to the X11 SECURITY extension
 controls.
 .El
-.Sh CONFIGURATION FILES
+.Pp
 .Nm
 may additionally obtain configuration data from
 a per-user configuration file and a system-wide configuration file.
 The file format and configuration options are described in
 .Xr ssh_config 5 .
+.Pp
+.Nm
+exits with the exit status of the remote command or with 255
+if an error occurred.
+.Sh AUTHENTICATION
+The OpenSSH SSH client supports SSH protocols 1 and 2.
+Protocol 2 is the default, with
+.Nm
+falling back to protocol 1 if it detects protocol 2 is unsupported.
+These settings may be altered using the
+.Cm Protocol
+option in
+.Xr ssh_config 5 ,
+or enforced using the
+.Fl 1
+and
+.Fl 2
+options (see above).
+Both protocols support similar authentication methods,
+but protocol 2 is preferred since
+it provides additional mechanisms for confidentiality
+(the traffic is encrypted using AES, 3DES, Blowfish, CAST128, or Arcfour)
+and integrity (hmac-md5, hmac-sha1, hmac-ripemd160).
+Protocol 1 lacks a strong mechanism for ensuring the
+integrity of the connection.
+.Pp
+The methods available for authentication are:
+host-based authentication,
+public key authentication,
+challenge-response authentication,
+and password authentication.
+Authentication methods are tried in the order specified above,
+though protocol 2 has a configuration option to change the default order:
+.Cm PreferredAuthentications .
+.Pp
+Host-based authentication works as follows:
+If the machine the user logs in from is listed in
+.Pa /etc/hosts.equiv
+or
+.Pa /etc/shosts.equiv
+on the remote machine, and the user names are
+the same on both sides, or if the files
+.Pa ~/.rhosts
+or
+.Pa ~/.shosts
+exist in the user's home directory on the
+remote machine and contain a line containing the name of the client
+machine and the name of the user on that machine, the user is
+considered for login.
+Additionally, the server
+.Em must
+be able to verify the client's
+host key (see the description of
+.Pa /etc/ssh/ssh_known_hosts
+and
+.Pa ~/.ssh/known_hosts ,
+below)
+for login to be permitted.
+This authentication method closes security holes due to IP
+spoofing, DNS spoofing, and routing spoofing.
+[Note to the administrator:
+.Pa /etc/hosts.equiv ,
+.Pa ~/.rhosts ,
+and the rlogin/rsh protocol in general, are inherently insecure and should be
+disabled if security is desired.]
+.Pp
+Public key authentication works as follows:
+The scheme is based on public-key cryptography,
+using cryptosystems
+where encryption and decryption are done using separate keys,
+and it is unfeasible to derive the decryption key from the encryption key.
+The idea is that each user creates a public/private
+key pair for authentication purposes.
+The server knows the public key, and only the user knows the private key.
+.Nm
+implements public key authentication protocol automatically,
+using either the RSA or DSA algorithms.
+Protocol 1 is restricted to using only RSA keys,
+but protocol 2 may use either.
+The
+.Sx HISTORY
+section of
+.Xr ssl 8
+contains a brief discussion of the two algorithms.
+.Pp
+The file
+.Pa ~/.ssh/authorized_keys
+lists the public keys that are permitted for logging in.
+When the user logs in, the
+.Nm
+program tells the server which key pair it would like to use for
+authentication.
+The client proves that it has access to the private key
+and the server checks that the corresponding public key
+is authorized to accept the account.
+.Pp
+The user creates his/her key pair by running
+.Xr ssh-keygen 1 .
+This stores the private key in
+.Pa ~/.ssh/identity
+(protocol 1),
+.Pa ~/.ssh/id_dsa
+(protocol 2 DSA),
+or
+.Pa ~/.ssh/id_rsa
+(protocol 2 RSA)
+and stores the public key in
+.Pa ~/.ssh/identity.pub
+(protocol 1),
+.Pa ~/.ssh/id_dsa.pub
+(protocol 2 DSA),
+or
+.Pa ~/.ssh/id_rsa.pub
+(protocol 2 RSA)
+in the user's home directory.
+The user should then copy the public key
+to
+.Pa ~/.ssh/authorized_keys
+in his/her home directory on the remote machine.
+The
+.Pa authorized_keys
+file corresponds to the conventional
+.Pa ~/.rhosts
+file, and has one key
+per line, though the lines can be very long.
+After this, the user can log in without giving the password.
+.Pp
+The most convenient way to use public key authentication may be with an
+authentication agent.
+See
+.Xr ssh-agent 1
+for more information.
+.Pp
+Challenge-response authentication works as follows:
+The server sends an arbitrary
+.Qq challenge
+text, and prompts for a response.
+Protocol 2 allows multiple challenges and responses;
+protocol 1 is restricted to just one challenge/response.
+Examples of challenge-response authentication include
+BSD Authentication (see
+.Xr login.conf 5 )
+and PAM (some non-OpenBSD systems).
+.Pp
+Finally, if other authentication methods fail,
+.Nm
+prompts the user for a password.
+The password is sent to the remote
+host for checking; however, since all communications are encrypted,
+the password cannot be seen by someone listening on the network.
+.Pp
+.Nm
+automatically maintains and checks a database containing
+identification for all hosts it has ever been used with.
+Host keys are stored in
+.Pa ~/.ssh/known_hosts
+in the user's home directory.
+Additionally, the file
+.Pa /etc/ssh/ssh_known_hosts
+is automatically checked for known hosts.
+Any new hosts are automatically added to the user's file.
+If a host's identification ever changes,
+.Nm
+warns about this and disables password authentication to prevent
+server spoofing or man-in-the-middle attacks,
+which could otherwise be used to circumvent the encryption.
+The
+.Cm StrictHostKeyChecking
+option can be used to control logins to machines whose
+host key is not known or has changed.
+.Pp
+When the user's identity has been accepted by the server, the server
+either executes the given command, or logs into the machine and gives
+the user a normal shell on the remote machine.
+All communication with
+the remote command or shell will be automatically encrypted.
+.Pp
+If a pseudo-terminal has been allocated (normal login session), the
+user may use the escape characters noted below.
+.Pp
+If no pseudo-tty has been allocated,
+the session is transparent and can be used to reliably transfer binary data.
+On most systems, setting the escape character to
+.Dq none
+will also make the session transparent even if a tty is used.
+.Pp
+The session terminates when the command or shell on the remote
+machine exits and all X11 and TCP connections have been closed.
+.Sh ESCAPE CHARACTERS
+When a pseudo-terminal has been requested,
+.Nm
+supports a number of functions through the use of an escape character.
+.Pp
+A single tilde character can be sent as
+.Ic ~~
+or by following the tilde by a character other than those described below.
+The escape character must always follow a newline to be interpreted as
+special.
+The escape character can be changed in configuration files using the
+.Cm EscapeChar
+configuration directive or on the command line by the
+.Fl e
+option.
+.Pp
+The supported escapes (assuming the default
+.Ql ~ )
+are:
+.Bl -tag -width Ds
+.It Cm ~.
+Disconnect.
+.It Cm ~^Z
+Background
+.Nm .
+.It Cm ~#
+List forwarded connections.
+.It Cm ~&
+Background
+.Nm
+at logout when waiting for forwarded connection / X11 sessions to terminate.
+.It Cm ~?
+Display a list of escape characters.
+.It Cm ~B
+Send a BREAK to the remote system
+(only useful for SSH protocol version 2 and if the peer supports it).
+.It Cm ~C
+Open command line.
+Currently this allows the addition of port forwardings using the
+.Fl L
+and
+.Fl R
+options (see above).
+It also allows the cancellation of existing remote port-forwardings
+using
+.Fl KR Ar hostport .
+.Ic !\& Ns Ar command
+allows the user to execute a local command if the
+.Ic PermitLocalCommand
+option is enabled in
+.Xr ssh_config 5 .
+Basic help is available, using the
+.Fl h
+option.
+.It Cm ~R
+Request rekeying of the connection
+(only useful for SSH protocol version 2 and if the peer supports it).
+.El
+.Sh TCP FORWARDING
+Forwarding of arbitrary TCP connections over the secure channel can
+be specified either on the command line or in a configuration file.
+One possible application of TCP forwarding is a secure connection to a
+mail server; another is going through firewalls.
+.Pp
+In the example below, we look at encrypting communication between
+an IRC client and server, even though the IRC server does not directly
+support encrypted communications.
+This works as follows:
+the user connects to the remote host using
+.Nm ,
+specifying a port to be used to forward connections
+to the remote server.
+After that it is possible to start the service which is to be encrypted
+on the client machine,
+connecting to the same local port,
+and
+.Nm
+will encrypt and forward the connection.
+.Pp
+The following example tunnels an IRC session from client machine
+.Dq 127.0.0.1
+(localhost)
+to remote server
+.Dq server.example.com :
+.Bd -literal -offset 4n
+$ ssh -f -L 1234:localhost:6667 server.example.com sleep 10
+$ irc -c '#users' -p 1234 pinky 127.0.0.1
+.Ed
+.Pp
+This tunnels a connection to IRC server
+.Dq server.example.com ,
+joining channel
+.Dq #users ,
+nickname
+.Dq pinky ,
+using port 1234.
+It doesn't matter which port is used,
+as long as it's greater than 1023
+(remember, only root can open sockets on privileged ports)
+and doesn't conflict with any ports already in use.
+The connection is forwarded to port 6667 on the remote server,
+since that's the standard port for IRC services.
+.Pp
+The
+.Fl f
+option backgrounds
+.Nm
+and the remote command
+.Dq sleep 10
+is specified to allow an amount of time
+(10 seconds, in the example)
+to start the service which is to be tunnelled.
+If no connections are made within the time specified,
+.Nm
+will exit.
+.Sh X11 FORWARDING
+If the
+.Cm ForwardX11
+variable is set to
+.Dq yes
+(or see the description of the
+.Fl X ,
+.Fl x ,
+and
+.Fl Y
+options above)
+and the user is using X11 (the
+.Ev DISPLAY
+environment variable is set), the connection to the X11 display is
+automatically forwarded to the remote side in such a way that any X11
+programs started from the shell (or command) will go through the
+encrypted channel, and the connection to the real X server will be made
+from the local machine.
+The user should not manually set
+.Ev DISPLAY .
+Forwarding of X11 connections can be
+configured on the command line or in configuration files.
+.Pp
+The
+.Ev DISPLAY
+value set by
+.Nm
+will point to the server machine, but with a display number greater than zero.
+This is normal, and happens because
+.Nm
+creates a
+.Dq proxy
+X server on the server machine for forwarding the
+connections over the encrypted channel.
+.Pp
+.Nm
+will also automatically set up Xauthority data on the server machine.
+For this purpose, it will generate a random authorization cookie,
+store it in Xauthority on the server, and verify that any forwarded
+connections carry this cookie and replace it by the real cookie when
+the connection is opened.
+The real authentication cookie is never
+sent to the server machine (and no cookies are sent in the plain).
+.Pp
+If the
+.Cm ForwardAgent
+variable is set to
+.Dq yes
+(or see the description of the
+.Fl A
+and
+.Fl a
+options above) and
+the user is using an authentication agent, the connection to the agent
+is automatically forwarded to the remote side.
+.Sh VERIFYING HOST KEYS
+When connecting to a server for the first time,
+a fingerprint of the server's public key is presented to the user
+(unless the option
+.Cm StrictHostKeyChecking
+has been disabled).
+Fingerprints can be determined using
+.Xr ssh-keygen 1 :
+.Pp
+.Dl $ ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key
+.Pp
+If the fingerprint is already known,
+it can be matched and verified,
+and the key can be accepted.
+If the fingerprint is unknown,
+an alternative method of verification is available:
+SSH fingerprints verified by DNS.
+An additional resource record (RR),
+SSHFP,
+is added to a zonefile
+and the connecting client is able to match the fingerprint
+with that of the key presented.
+.Pp
+In this example, we are connecting a client to a server,
+.Dq host.example.com .
+The SSHFP resource records should first be added to the zonefile for
+host.example.com:
+.Bd -literal -offset indent
+$ ssh-keygen -f /etc/ssh/ssh_host_rsa_key.pub -r host.example.com.
+$ ssh-keygen -f /etc/ssh/ssh_host_dsa_key.pub -r host.example.com.
+.Ed
+.Pp
+The output lines will have to be added to the zonefile.
+To check that the zone is answering fingerprint queries:
+.Pp
+.Dl $ dig -t SSHFP host.example.com
+.Pp
+Finally the client connects:
+.Bd -literal -offset indent
+$ ssh -o "VerifyHostKeyDNS ask" host.example.com
+[...]
+Matching host key fingerprint found in DNS.
+Are you sure you want to continue connecting (yes/no)?
+.Ed
+.Pp
+See the
+.Cm VerifyHostKeyDNS
+option in
+.Xr ssh_config 5
+for more information.
+.Sh SSH-BASED VIRTUAL PRIVATE NETWORKS
+.Nm
+contains support for Virtual Private Network (VPN) tunnelling
+using the
+.Xr tun 4
+network pseudo-device,
+allowing two networks to be joined securely.
+The
+.Xr sshd_config 5
+configuration option
+.Cm PermitTunnel
+controls whether the server supports this,
+and at what level (layer 2 or 3 traffic).
+.Pp
+The following example would connect client network 10.0.50.0/24
+with remote network 10.0.99.0/24, provided that the SSH server
+running on the gateway to the remote network,
+at 192.168.1.15, allows it:
+.Bd -literal -offset indent
+# ssh -f -w 0:1 192.168.1.15 true
+# ifconfig tun0 10.0.50.1 10.0.99.1 netmask 255.255.255.252
+.Ed
+.Pp
+Client access may be more finely tuned via the
+.Pa /root/.ssh/authorized_keys
+file (see below) and the
+.Cm PermitRootLogin
+server option.
+The following entry would permit connections on the first
+.Xr tun 4
+device from user
+.Dq jane
+and on the second device from user
+.Dq john ,
+if
+.Cm PermitRootLogin
+is set to
+.Dq forced-commands-only :
+.Bd -literal -offset 2n
+tunnel="1",command="sh /etc/netstart tun1" ssh-rsa ... jane
+tunnel="2",command="sh /etc/netstart tun1" ssh-rsa ... john
+.Ed
+.Pp
+Since a SSH-based setup entails a fair amount of overhead,
+it may be more suited to temporary setups,
+such as for wireless VPNs.
+More permanent VPNs are better provided by tools such as
+.Xr ipsecctl 8
+and
+.Xr isakmpd 8 .
 .Sh ENVIRONMENT
 .Nm
 will normally set the following environment variables:
-.Bl -tag -width LOGNAME
+.Bl -tag -width "SSH_ORIGINAL_COMMAND"
 .It Ev DISPLAY
 The
 .Ev DISPLAY
@@ -876,9 +1112,12 @@ variable indicates the location of the X11 server.
 It is automatically set by
 .Nm
 to point to a value of the form
-.Dq hostname:n
+.Dq hostname:n ,
-where hostname indicates
+where
-the host where the shell runs, and n is an integer \*(Ge 1.
+.Dq hostname
+indicates the host where the shell runs, and
+.Sq n
+is an integer \*(Ge 1.
 .Nm
 uses this special value to forward X11 connections over the secure
 channel.
@@ -899,7 +1138,7 @@ Set to the path of the user's mailbox.
 Set to the default
 .Ev PATH ,
 as specified when compiling
-.Nm ssh .
+.Nm .
 .It Ev SSH_ASKPASS
 If
 .Nm
@@ -924,15 +1163,16 @@ may be necessary to redirect the input from
 .Pa /dev/null
 to make this work.)
 .It Ev SSH_AUTH_SOCK
-Identifies the path of a unix-domain socket used to communicate with the
+Identifies the path of a
-agent.
+.Ux Ns -domain
+socket used to communicate with the agent.
 .It Ev SSH_CONNECTION
 Identifies the client and server ends of the connection.
 The variable contains
-four space-separated values: client ip-address, client port number,
+four space-separated values: client IP address, client port number,
-server ip-address and server port number.
+server IP address, and server port number.
 .It Ev SSH_ORIGINAL_COMMAND
-The variable contains the original command line if a forced command
+This variable contains the original command line if a forced command
 is executed.
 It can be used to extract the original arguments.
 .It Ev SSH_TTY
@@ -941,7 +1181,7 @@ with the current shell or command.
 If the current session has no tty,
 this variable is not set.
 .It Ev TZ
-The timezone variable is set to indicate the present timezone if it
+This variable is set to indicate the present time zone if it
 was set when the daemon was started (i.e., the daemon passes the value
 on to new connections).
 .It Ev USER
@@ -954,224 +1194,153 @@ reads
 .Pa ~/.ssh/environment ,
 and adds lines of the format
 .Dq VARNAME=value
-to the environment if the file exists and if users are allowed to
+to the environment if the file exists and users are allowed to
 change their environment.
 For more information, see the
 .Cm PermitUserEnvironment
 option in
 .Xr sshd_config 5 .
 .Sh FILES
-.Bl -tag -width Ds
+.Bl -tag -width Ds -compact
-.It Pa ~/.ssh/known_hosts
+.It ~/.rhosts
-Records host keys for all hosts the user has logged into that are not
+This file is used for host-based authentication (see above).
-in
+On some machines this file may need to be
-.Pa /etc/ssh/ssh_known_hosts .
+world-readable if the user's home directory is on an NFS partition,
-See
+because
-.Xr sshd 8 .
+.Xr sshd 8
-.It Pa ~/.ssh/identity, ~/.ssh/id_dsa, ~/.ssh/id_rsa
+reads it as root.
-Contains the authentication identity of the user.
+Additionally, this file must be owned by the user,
-They are for protocol 1 RSA, protocol 2 DSA, and protocol 2 RSA, respectively.
+and must not have write permissions for anyone else.
+The recommended
+permission for most machines is read/write for the user, and not
+accessible by others.
+.Pp
+.It ~/.shosts
+This file is used in exactly the same way as
+.Pa .rhosts ,
+but allows host-based authentication without permitting login with
+rlogin/rsh.
+.Pp
+.It ~/.ssh/authorized_keys
+Lists the public keys (RSA/DSA) that can be used for logging in as this user.
+The format of this file is described in the
+.Xr sshd 8
+manual page.
+This file is not highly sensitive, but the recommended
+permissions are read/write for the user, and not accessible by others.
+.Pp
+.It ~/.ssh/config
+This is the per-user configuration file.
+The file format and configuration options are described in
+.Xr ssh_config 5 .
+Because of the potential for abuse, this file must have strict permissions:
+read/write for the user, and not accessible by others.
+It may be group-writable provided that the group in question contains only
+the user.
+.Pp
+.It ~/.ssh/environment
+Contains additional definitions for environment variables; see
+.Sx ENVIRONMENT ,
+above.
+.Pp
+.It ~/.ssh/identity
+.It ~/.ssh/id_dsa
+.It ~/.ssh/id_rsa
+Contains the private key for authentication.
 These files
 contain sensitive data and should be readable by the user but not
 accessible by others (read/write/execute).
-Note that
 .Nm
-ignores a private key file if it is accessible by others.
+will simply ignore a private key file if it is accessible by others.
 It is possible to specify a passphrase when
-generating the key; the passphrase will be used to encrypt the
+generating the key which will be used to encrypt the
 sensitive part of this file using 3DES.
-.It Pa ~/.ssh/identity.pub, ~/.ssh/id_dsa.pub, ~/.ssh/id_rsa.pub
+.Pp
-Contains the public key for authentication (public part of the
+.It ~/.ssh/identity.pub
-identity file in human-readable form).
+.It ~/.ssh/id_dsa.pub
-The contents of the
+.It ~/.ssh/id_rsa.pub
-.Pa ~/.ssh/identity.pub
+Contains the public key for authentication.
-file should be added to the file
-.Pa ~/.ssh/authorized_keys
-on all machines
-where the user wishes to log in using protocol version 1 RSA authentication.
-The contents of the
-.Pa ~/.ssh/id_dsa.pub
-and
-.Pa ~/.ssh/id_rsa.pub
-file should be added to
-.Pa ~/.ssh/authorized_keys
-on all machines
-where the user wishes to log in using protocol version 2 DSA/RSA authentication.
 These files are not
 sensitive and can (but need not) be readable by anyone.
-These files are
-never used automatically and are not necessary; they are only provided for
-the convenience of the user.
-.It Pa ~/.ssh/config
-This is the per-user configuration file.
-The file format and configuration options are described in
-.Xr ssh_config 5 .
-Because of the potential for abuse, this file must have strict permissions:
-read/write for the user, and not accessible by others.
-It may be group-writable provided that the group in question contains only
-the user.
-.It Pa ~/.ssh/authorized_keys
-Lists the public keys (RSA/DSA) that can be used for logging in as this user.
-The format of this file is described in the
-.Xr sshd 8
-manual page.
-In the simplest form the format is the same as the
-.Pa .pub
-identity files.
-This file is not highly sensitive, but the recommended
-permissions are read/write for the user, and not accessible by others.
-.It Pa /etc/ssh/ssh_known_hosts
-Systemwide list of known host keys.
-This file should be prepared by the
-system administrator to contain the public host keys of all machines in the
-organization.
-This file should be world-readable.
-This file contains
-public keys, one per line, in the following format (fields separated
-by spaces): system name, public key and optional comment field.
-When different names are used
-for the same machine, all such names should be listed, separated by
-commas.
-The format is described in the
-.Xr sshd 8
-manual page.
 .Pp
-The canonical system name (as returned by name servers) is used by
+.It ~/.ssh/known_hosts
+Contains a list of host keys for all hosts the user has logged into
+that are not already in the systemwide list of known host keys.
+See
 .Xr sshd 8
-to verify the client host when logging in; other names are needed because
+for further details of the format of this file.
+.Pp
+.It ~/.ssh/rc
+Commands in this file are executed by
 .Nm
-does not convert the user-supplied name to a canonical name before
+when the user logs in, just before the user's shell (or command) is
-checking the key, because someone with access to the name servers
+started.
-would then be able to fool host authentication.
+See the
+.Xr sshd 8
+manual page for more information.
+.Pp
+.It /etc/hosts.equiv
+This file is for host-based authentication (see above).
+It should only be writable by root.
+.Pp
+.It /etc/shosts.equiv
+This file is used in exactly the same way as
+.Pa hosts.equiv ,
+but allows host-based authentication without permitting login with
+rlogin/rsh.
+.Pp
 .It Pa /etc/ssh/ssh_config
 Systemwide configuration file.
 The file format and configuration options are described in
 .Xr ssh_config 5 .
-.It Pa /etc/ssh/ssh_host_key, /etc/ssh/ssh_host_dsa_key, /etc/ssh/ssh_host_rsa_key
+.Pp
+.It /etc/ssh/ssh_host_key
+.It /etc/ssh/ssh_host_dsa_key
+.It /etc/ssh/ssh_host_rsa_key
 These three files contain the private parts of the host keys
-and are used for
+and are used for host-based authentication.
-.Cm RhostsRSAAuthentication
+If protocol version 1 is used,
-and
-.Cm HostbasedAuthentication .
-If the protocol version 1
-.Cm RhostsRSAAuthentication
-method is used,
 .Nm
 must be setuid root, since the host key is readable only by root.
 For protocol version 2,
 .Nm
 uses
 .Xr ssh-keysign 8
-to access the host keys for
+to access the host keys,
-.Cm HostbasedAuthentication .
+eliminating the requirement that
-This eliminates the requirement that
 .Nm
-be setuid root when that authentication method is used.
+be setuid root when host-based authentication is used.
 By default
 .Nm
 is not setuid root.
-.It Pa ~/.rhosts
-This file is used in
-.Cm RhostsRSAAuthentication
-and
-.Cm HostbasedAuthentication
-authentication to list the
-host/user pairs that are permitted to log in.
-(Note that this file is
-also used by rlogin and rsh, which makes using this file insecure.)
-Each line of the file contains a host name (in the canonical form
-returned by name servers), and then a user name on that host,
-separated by a space.
-On some machines this file may need to be
-world-readable if the user's home directory is on a NFS partition,
-because
-.Xr sshd 8
-reads it as root.
-Additionally, this file must be owned by the user,
-and must not have write permissions for anyone else.
-The recommended
-permission for most machines is read/write for the user, and not
-accessible by others.
 .Pp
-Note that
+.It /etc/ssh/ssh_known_hosts
-.Xr sshd 8
+Systemwide list of known host keys.
-allows authentication only in combination with client host key
+This file should be prepared by the
-authentication before permitting log in.
+system administrator to contain the public host keys of all machines in the
-If the server machine does not have the client's host key in
+organization.
-.Pa /etc/ssh/ssh_known_hosts ,
+It should be world-readable.
-it can be stored in
+See
-.Pa ~/.ssh/known_hosts .
-The easiest way to do this is to
-connect back to the client from the server machine using ssh; this
-will automatically add the host key to
-.Pa ~/.ssh/known_hosts .
-.It Pa ~/.shosts
-This file is used exactly the same way as
-.Pa .rhosts .
-The purpose for
-having this file is to be able to use
-.Cm RhostsRSAAuthentication
-and
-.Cm HostbasedAuthentication
-authentication without permitting login with
-.Xr rlogin
-or
-.Xr rsh 1 .
-.It Pa /etc/hosts.equiv
-This file is used during
-.Cm RhostsRSAAuthentication
-and
-.Cm HostbasedAuthentication
-authentication.
-It contains
-canonical hosts names, one per line (the full format is described in the
-.Xr sshd 8
-manual page).
-If the client host is found in this file, login is
-automatically permitted provided client and server user names are the
-same.
-Additionally, successful client host key authentication is required.
-This file should only be writable by root.
-.It Pa /etc/shosts.equiv
-This file is processed exactly as
-.Pa /etc/hosts.equiv .
-This file may be useful to permit logins using
-.Nm
-but not using rsh/rlogin.
-.It Pa /etc/ssh/sshrc
-Commands in this file are executed by
-.Nm
-when the user logs in just before the user's shell (or command) is started.
-See the
 .Xr sshd 8
-manual page for more information.
+for further details of the format of this file.
-.It Pa ~/.ssh/rc
+.Pp
+.It /etc/ssh/sshrc
 Commands in this file are executed by
 .Nm
-when the user logs in just before the user's shell (or command) is
+when the user logs in, just before the user's shell (or command) is started.
-started.
 See the
 .Xr sshd 8
 manual page for more information.
-.It Pa ~/.ssh/environment
-Contains additional definitions for environment variables, see section
-.Sx ENVIRONMENT
-above.
 .El
-.Sh DIAGNOSTICS
-.Nm
-exits with the exit status of the remote command or with 255
-if an error occurred.
 .Sh SEE ALSO
-.Xr gzip 1 ,
-.Xr rsh 1 ,
 .Xr scp 1 ,
 .Xr sftp 1 ,
 .Xr ssh-add 1 ,
 .Xr ssh-agent 1 ,
 .Xr ssh-argv0 1 ,
 .Xr ssh-keygen 1 ,
-.Xr telnet 1 ,
+.Xr ssh-keyscan 1 ,
+.Xr tun 4 ,
 .Xr hosts.equiv 5 ,
 .Xr ssh_config 5 ,
 .Xr ssh-keysign 8 ,
diff --git a/ssh.c b/ssh.c
index 75a0d9b23..a64f1e2dc 100644
--- a/ssh.c
+++ b/ssh.c
@@ -40,7 +40,7 @@
 */
 #include "includes.h"
-RCSID("$OpenBSD: ssh.c,v 1.249 2005/07/30 01:26:16 djm Exp $");
+RCSID("$OpenBSD: ssh.c,v 1.257 2005/12/20 04:41:07 dtucker Exp $");
 #include <openssl/evp.h>
 #include <openssl/err.h>
@@ -158,13 +158,13 @@ usage(void)
 {
        fprintf(stderr,
 "usage: ssh [-1246AaCfgkMNnqsTtVvXxY] [-b bind_address] [-c cipher_spec]\n"
-"           [-D port] [-e escape_char] [-F configfile]\n"
+"           [-D [bind_address:]port] [-e escape_char] [-F configfile]\n"
 "           [-i identity_file] [-L [bind_address:]port:host:hostport]\n"
 "           [-l login_name] [-m mac_spec] [-O ctl_cmd] [-o option] [-p port]\n"
 "           [-R [bind_address:]port:host:hostport] [-S ctl_path]\n"
-"           [user@]hostname [command]\n"
+"           [-w tunnel:tunnel] [user@]hostname [command]\n"
        );
-        exit(1);
+        exit(255);
 }
 static int ssh_session(void);
@@ -188,6 +188,9 @@ main(int ac, char **av)
        struct servent *sp;
        Forward fwd;
+        /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
+        sanitise_stdfd();
        __progname = ssh_get_progname(av[0]);
        init_rng();
@@ -220,7 +223,7 @@ main(int ac, char **av)
        pw = getpwuid(original_real_uid);
        if (!pw) {
                logit("You don't exist, go away!");
-                exit(1);
+                exit(255);
        }
        /* Take a copy of the returned structure. */
        pw = pwcopy(pw);
@@ -241,7 +244,7 @@ main(int ac, char **av)
 again:
        while ((opt = getopt(ac, av,
-            "1246ab:c:e:fgi:kl:m:no:p:qstvxACD:F:I:L:MNO:PR:S:TVXY")) != -1) {
+            "1246ab:c:e:fgi:kl:m:no:p:qstvxACD:F:I:L:MNO:PR:S:TVw:XY")) != -1) {
                switch (opt) {
                case '1':
                        options.protocol = SSH_PROTO_1;
@@ -337,6 +340,15 @@ again:
                        if (opt == 'V')
                                exit(0);
                        break;
+                case 'w':
+                        if (options.tun_open == -1)
+                                options.tun_open = SSH_TUNMODE_DEFAULT;
+                        options.tun_local = a2tun(optarg, &options.tun_remote);
+                        if (options.tun_local == SSH_TUNID_ERR) {
+                                fprintf(stderr, "Bad tun device '%s'\n", optarg);
+                                exit(255);
+                        }
+                        break;
                case 'q':
                        if (options.log_level == SYSLOG_LEVEL_QUIET) {
                                options.log_level = SYSLOG_LEVEL_SILENT;
@@ -357,7 +369,7 @@ again:
                        else {
                                fprintf(stderr, "Bad escape character '%s'.\n",
                                    optarg);
-                                exit(1);
+                                exit(255);
                        }
                        break;
                case 'c':
@@ -372,7 +384,7 @@ again:
                                        fprintf(stderr,
                                            "Unknown cipher type '%s'\n",
                                            optarg);
-                                        exit(1);
+                                        exit(255);
                                }
                                if (options.cipher == SSH_CIPHER_3DES)
                                        options.ciphers = "3des-cbc";
@@ -388,7 +400,7 @@ again:
                        else {
                                fprintf(stderr, "Unknown mac type '%s'\n",
                                    optarg);
-                                exit(1);
+                                exit(255);
                        }
                        break;
                case 'M':
@@ -401,7 +413,7 @@ again:
                        options.port = a2port(optarg);
                        if (options.port == 0) {
                                fprintf(stderr, "Bad port '%s'\n", optarg);
-                                exit(1);
+                                exit(255);
                        }
                        break;
                case 'l':
@@ -415,7 +427,7 @@ again:
                                fprintf(stderr,
                                    "Bad local forwarding specification '%s'\n",
                                    optarg);
-                                exit(1);
+                                exit(255);
                        }
                        break;
@@ -426,7 +438,7 @@ again:
                                fprintf(stderr,
                                    "Bad remote forwarding specification "
                                    "'%s'\n", optarg);
-                                exit(1);
+                                exit(255);
                        }
                        break;
@@ -437,7 +449,7 @@ again:
                        if ((fwd.listen_host = hpdelim(&cp)) == NULL) {
                                fprintf(stderr, "Bad dynamic forwarding "
                                    "specification '%.100s'\n", optarg);
-                                exit(1);
+                                exit(255);
                        }
                        if (cp != NULL) {
                                fwd.listen_port = a2port(cp);
@@ -450,7 +462,7 @@ again:
                        if (fwd.listen_port == 0) {
                                fprintf(stderr, "Bad dynamic port '%s'\n",
                                    optarg);
-                                exit(1);
+                                exit(255);
                        }
                        add_local_forward(&options, &fwd);
                        xfree(p);
@@ -471,7 +483,7 @@ again:
                        line = xstrdup(optarg);
                        if (process_config_line(&options, host ? host : "",
                            line, "command-line", 0, &dummy) != 0)
-                                exit(1);
+                                exit(255);
                        xfree(line);
                        break;
                case 's':
@@ -647,7 +659,7 @@ again:
            original_effective_uid == 0 && options.use_privileged_port,
 #endif
            options.proxy_command) != 0)
-                exit(1);
+                exit(255);
        /*
         * If we successfully made the connection, load the host private key
@@ -700,7 +712,7 @@ again:
        /*
         * Now that we are back to our own permissions, create ~/.ssh
-         * directory if it doesn\'t already exist.
+         * directory if it doesn't already exist.
         */
        snprintf(buf, sizeof buf, "%.100s%s%.100s", pw->pw_dir, strcmp(pw->pw_dir, "/") ? "/" : "", _PATH_SSH_USER_DIR);
        if (stat(buf, &st) < 0)
@@ -796,8 +808,7 @@ ssh_init_forwarding(void)
                debug("Remote connections from %.200s:%d forwarded to "
                    "local address %.200s:%d",
                    (options.remote_forwards[i].listen_host == NULL) ?
-                    (options.gateway_ports ? "*" : "LOCALHOST") :
+                    "LOCALHOST" : options.remote_forwards[i].listen_host,
-                    options.remote_forwards[i].listen_host,
                    options.remote_forwards[i].listen_port,
                    options.remote_forwards[i].connect_host,
                    options.remote_forwards[i].connect_port);
@@ -813,7 +824,7 @@ static void
 check_agent_present(void)
 {
        if (options.forward_agent) {
-                /* Clear agent forwarding if we don\'t have an agent. */
+                /* Clear agent forwarding if we don't have an agent. */
                if (!ssh_agent_present())
                        options.forward_agent = 0;
        }
@@ -1015,7 +1026,7 @@ ssh_control_listener(void)
                fatal("ControlPath too long");
        if ((control_fd = socket(PF_UNIX, SOCK_STREAM, 0)) < 0)
-                fatal("%s socket(): %s\n", __func__, strerror(errno));
+                fatal("%s socket(): %s", __func__, strerror(errno));
        old_umask = umask(0177);
        if (bind(control_fd, (struct sockaddr*)&addr, addr_len) == -1) {
@@ -1024,12 +1035,12 @@ ssh_control_listener(void)
                        fatal("ControlSocket %s already exists",
                            options.control_path);
                else
-                        fatal("%s bind(): %s\n", __func__, strerror(errno));
+                        fatal("%s bind(): %s", __func__, strerror(errno));
        }
        umask(old_umask);
        if (listen(control_fd, 64) == -1)
-                fatal("%s listen(): %s\n", __func__, strerror(errno));
+                fatal("%s listen(): %s", __func__, strerror(errno));
        set_nonblock(control_fd);
 }
@@ -1062,6 +1073,33 @@ ssh_session2_setup(int id, void *arg)
                packet_send();
        }
+        if (options.tun_open != SSH_TUNMODE_NO) {
+                Channel *c;
+                int fd;
+                debug("Requesting tun.");
+                if ((fd = tun_open(options.tun_local,
+                    options.tun_open)) >= 0) {
+                        c = channel_new("tun", SSH_CHANNEL_OPENING, fd, fd, -1,
+                            CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
+                            0, "tun", 1);
+                        c->datagram = 1;
+#if defined(SSH_TUN_FILTER)
+                        if (options.tun_open == SSH_TUNMODE_POINTOPOINT)
+                                channel_register_filter(c->self, sys_tun_infilter,
+                                    sys_tun_outfilter);
+#endif
+                        packet_start(SSH2_MSG_CHANNEL_OPEN);
+                        packet_put_cstring("tun@openssh.com");
+                        packet_put_int(c->self);
+                        packet_put_int(c->local_window_max);
+                        packet_put_int(c->local_maxpacket);
+                        packet_put_int(options.tun_open);
+                        packet_put_int(options.tun_remote);
+                        packet_send();
+                }
+        }
        client_session2_setup(id, tty_flag, subsystem_flag, getenv("TERM"),
            NULL, fileno(stdin), &command, environ, &ssh_subsystem_reply);
@@ -1126,6 +1164,11 @@ ssh_session2(void)
        if (!no_shell_flag || (datafellows & SSH_BUG_DUMMYCHAN))
                id = ssh_session2_open();
+        /* Execute a local command */
+        if (options.local_command != NULL &&
+            options.permit_local_command)
+                ssh_local_cmd(options.local_command);
        /* If requested, let ssh continue in the background. */
        if (fork_after_authentication_flag)
                if (daemon(1, 1) < 0)
diff --git a/ssh_config b/ssh_config
index 0510f347c..a3cac0e4e 100644
--- a/ssh_config
+++ b/ssh_config
@@ -1,4 +1,4 @@
-#       $OpenBSD: ssh_config,v 1.20 2005/01/28 09:45:53 dtucker Exp $
+#       $OpenBSD: ssh_config,v 1.21 2005/12/06 22:38:27 reyk Exp $
 # This is the ssh client system-wide configuration file.  See
 # ssh_config(5) for more information.  This file provides defaults for
@@ -38,5 +38,8 @@ Host *
 #   Cipher 3des
 #   Ciphers aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
 #   EscapeChar ~
+#   Tunnel no
+#   TunnelDevice any:any
+#   PermitLocalCommand no
    SendEnv LANG LC_*
    HashKnownHosts yes
diff --git a/ssh_config.0 b/ssh_config.0
index a2706b69c..46a0543c3 100644
--- a/ssh_config.0
+++ b/ssh_config.0
@@ -129,16 +129,19 @@ DESCRIPTION
             on a control socket specified using the ControlPath argument.
             Additional sessions can connect to this socket using the same
             ControlPath with ControlMaster set to ``no'' (the default).
-             These sessions will reuse the master instance's network connec-
+             These sessions will try to reuse the master instance's network
-             tion rather than initiating new ones.  Setting this to ``ask''
+             connection rather than initiating new ones, but will fall back to
-             will cause ssh to listen for control connections, but require
+             connecting normally if the control socket does not exist, or is
-             confirmation using the SSH_ASKPASS program before they are ac-
+             not listening.
-             cepted (see ssh-add(1) for details).  If the ControlPath can not
-             be opened, ssh will continue without connecting to a master in-
+             Setting this to ``ask'' will cause ssh to listen for control con-
-             stance.
+             nections, but require confirmation using the SSH_ASKPASS program
+             before they are accepted (see ssh-add(1) for details).  If the
+             ControlPath can not be opened, ssh will continue without connect-
+             ing to a master instance.
             X11 and ssh-agent(1) forwarding is supported over these multi-
-             plexed connections, however the display and agent fowarded will
+             plexed connections, however the display and agent forwarded will
             be the one belonging to the master connection i.e. it is not pos-
             sible to forward multiple displays or agents.
@@ -159,14 +162,24 @@ DESCRIPTION
             nections are uniquely identified.
     DynamicForward
-             Specifies that a TCP/IP port on the local machine be forwarded
+             Specifies that a TCP port on the local machine be forwarded over
-             over the secure channel, and the application protocol is then
+             the secure channel, and the application protocol is then used to
-             used to determine where to connect to from the remote machine.
+             determine where to connect to from the remote machine.
-             The argument must be a port number.  Currently the SOCKS4 and
-             SOCKS5 protocols are supported, and ssh will act as a SOCKS serv-
+             The argument must be [bind_address:]port.  IPv6 addresses can be
-             er.  Multiple forwardings may be specified, and additional for-
+             specified by enclosing addresses in square brackets or by using
-             wardings can be given on the command line.  Only the superuser
+             an alternative syntax: [bind_address/]port.  By default, the lo-
-             can forward privileged ports.
+             cal port is bound in accordance with the GatewayPorts setting.
+             However, an explicit bind_address may be used to bind the connec-
+             tion to a specific address.  The bind_address of ``localhost''
+             indicates that the listening port be bound for local use only,
+             while an empty address or `*' indicates that the port should be
+             available from all interfaces.
+             Currently the SOCKS4 and SOCKS5 protocols are supported, and ssh
+             will act as a SOCKS server.  Multiple forwardings may be speci-
+             fied, and additional forwardings can be given on the command
+             line.  Only the superuser can forward privileged ports.
     EnableSSHKeysign
             Setting this option to ``yes'' in the global client configuration
@@ -280,6 +293,14 @@ DESCRIPTION
             permitted (both on the command line and in HostName specifica-
             tions).
+     IdentitiesOnly
+             Specifies that ssh should only use the authentication identity
+             files configured in the ssh_config files, even if the ssh-agent
+             offers more identities.  The argument to this keyword must be
+             ``yes'' or ``no''.  This option is intended for situations where
+             ssh-agent offers many different identities.  The default is
+             ``no''.
     IdentityFile
             Specifies a file from which the user's RSA or DSA authentication
             identity is read.  The default is ~/.ssh/identity for protocol
@@ -290,35 +311,33 @@ DESCRIPTION
             is possible to have multiple identity files specified in configu-
             ration files; all these identities will be tried in sequence.
-     IdentitiesOnly
-             Specifies that ssh should only use the authentication identity
-             files configured in the ssh_config files, even if the ssh-agent
-             offers more identities.  The argument to this keyword must be
-             ``yes'' or ``no''.  This option is intented for situations where
-             ssh-agent offers many different identities.  The default is
-             ``no''.
     KbdInteractiveDevices
             Specifies the list of methods to use in keyboard-interactive au-
             thentication.  Multiple method names must be comma-separated.
             The default is to use the server specified list.
+     LocalCommand
+             Specifies a command to execute on the local machine after suc-
+             cessfully connecting to the server.  The command string extends
+             to the end of the line, and is executed with /bin/sh.  This di-
+             rective is ignored unless PermitLocalCommand has been enabled.
     LocalForward
-             Specifies that a TCP/IP port on the local machine be forwarded
+             Specifies that a TCP port on the local machine be forwarded over
-             over the secure channel to the specified host and port from the
+             the secure channel to the specified host and port from the remote
-             remote machine.  The first argument must be [bind_address:]port
+             machine.  The first argument must be [bind_address:]port and the
-             and the second argument must be host:hostport.  IPv6 addresses
+             second argument must be host:hostport.  IPv6 addresses can be
-             can be specified by enclosing addresses in square brackets or by
+             specified by enclosing addresses in square brackets or by using
-             using an alternative syntax: [bind_address/]port and
+             an alternative syntax: [bind_address/]port and host/hostport.
-             host/hostport.  Multiple forwardings may be specified, and addi-
+             Multiple forwardings may be specified, and additional forwardings
-             tional forwardings can be given on the command line.  Only the
+             can be given on the command line.  Only the superuser can forward
-             superuser can forward privileged ports.  By default, the local
+             privileged ports.  By default, the local port is bound in accor-
-             port is bound in accordance with the GatewayPorts setting.  How-
+             dance with the GatewayPorts setting.  However, an explicit
-             ever, an explicit bind_address may be used to bind the connection
+             bind_address may be used to bind the connection to a specific ad-
-             to a specific address.  The bind_address of ``localhost'' indi-
+             dress.  The bind_address of ``localhost'' indicates that the lis-
-             cates that the listening port be bound for local use only, while
+             tening port be bound for local use only, while an empty address
-             an empty address or `*' indicates that the port should be avail-
+             or `*' indicates that the port should be available from all in-
-             able from all interfaces.
+             terfaces.
     LogLevel
             Gives the verbosity level that is used when logging messages from
@@ -351,6 +370,11 @@ DESCRIPTION
             to this keyword must be ``yes'' or ``no''.  The default is
             ``yes''.
+     PermitLocalCommand
+             Allow local command execution via the LocalCommand option or us-
+             ing the !command escape sequence in ssh(1).  The argument must be
+             ``yes'' or ``no''.  The default is ``no''.
     Port    Specifies the port number to connect on the remote host.  Default
             is 22.
@@ -393,16 +417,24 @@ DESCRIPTION
             to this keyword must be ``yes'' or ``no''.  The default is
             ``yes''.  This option applies to protocol version 2 only.
+     RekeyLimit
+             Specifies the maximum amount of data that may be transmitted be-
+             fore the session key is renegotiated.  The argument is the number
+             of bytes, with an optional suffix of `K', `M', or `G' to indicate
+             Kilobytes, Megabytes, or Gigabytes, respectively.  The default is
+             between ``1G'' and ``4G'', depending on the cipher.  This option
+             applies to protocol version 2 only.
     RemoteForward
-             Specifies that a TCP/IP port on the remote machine be forwarded
+             Specifies that a TCP port on the remote machine be forwarded over
-             over the secure channel to the specified host and port from the
+             the secure channel to the specified host and port from the local
-             local machine.  The first argument must be [bind_address:]port
+             machine.  The first argument must be [bind_address:]port and the
-             and the second argument must be host:hostport.  IPv6 addresses
+             second argument must be host:hostport.  IPv6 addresses can be
-             can be specified by enclosing addresses in square brackets or by
+             specified by enclosing addresses in square brackets or by using
-             using an alternative syntax: [bind_address/]port and
+             an alternative syntax: [bind_address/]port and host/hostport.
-             host/hostport.  Multiple forwardings may be specified, and addi-
+             Multiple forwardings may be specified, and additional forwardings
-             tional forwardings can be given on the command line.  Only the
+             can be given on the command line.  Only the superuser can forward
-             superuser can forward privileged ports.
+             privileged ports.
             If the bind_address is not specified, the default is to only bind
             to loopback addresses.  If the bind_address is `*' or an empty
@@ -434,15 +466,8 @@ DESCRIPTION
             separated by whitespace or spread across multiple SendEnv direc-
             tives.  The default is not to send any environment variables.
-     ServerAliveInterval
-             Sets a timeout interval in seconds after which if no data has
-             been received from the server, ssh will send a message through
-             the encrypted channel to request a response from the server.  The
-             default is 0, indicating that these messages will not be sent to
-             the server.  This option applies to protocol version 2 only.
     ServerAliveCountMax
-             Sets the number of server alive messages (see above) which may be
+             Sets the number of server alive messages (see below) which may be
             sent without ssh receiving any messages back from the server.  If
             this threshold is reached while server alive messages are being
             sent, ssh will disconnect from the server, terminating the ses-
@@ -455,9 +480,16 @@ DESCRIPTION
             tion has become inactive.
             The default value is 3.  If, for example, ServerAliveInterval
-             (above) is set to 15, and ServerAliveCountMax is left at the de-
+             (see below) is set to 15, and ServerAliveCountMax is left at the
-             fault, if the server becomes unresponsive ssh will disconnect af-
+             default, if the server becomes unresponsive ssh will disconnect
-             ter approximately 45 seconds.
+             after approximately 45 seconds.
+     ServerAliveInterval
+             Sets a timeout interval in seconds after which if no data has
+             been received from the server, ssh will send a message through
+             the encrypted channel to request a response from the server.  The
+             default is 0, indicating that these messages will not be sent to
+             the server.  This option applies to protocol version 2 only.
     SmartcardDevice
             Specifies which smartcard device to use.  The argument to this
@@ -496,6 +528,16 @@ DESCRIPTION
             To disable TCP keepalive messages, the value should be set to
             ``no''.
+     Tunnel  Request starting tun(4) device forwarding between the client and
+             the server.  This option also allows requesting layer 2 (ether-
+             net) instead of layer 3 (point-to-point) tunneling from the serv-
+             er.  The argument must be ``yes'', ``point-to-point'',
+             ``ethernet'' or ``no''.  The default is ``no''.
+     TunnelDevice
+             Force a specified tun(4) device on the client.  Without this op-
+             tion, the next available device will be used.
     UsePrivilegedPort
             Specifies whether to use a privileged port for outgoing connec-
             tions.  The argument must be ``yes'' or ``no''.  The default is
@@ -551,4 +593,4 @@ AUTHORS
     ated OpenSSH.  Markus Friedl contributed the support for SSH protocol
     versions 1.5 and 2.0.
-OpenBSD 3.8                   September 25, 1999                             9
+OpenBSD 3.9                   September 25, 1999                             9
diff --git a/ssh_config.5 b/ssh_config.5
index b232a0203..889def626 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -34,7 +34,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: ssh_config.5,v 1.61 2005/07/08 12:53:10 jmc Exp $
+.\" $OpenBSD: ssh_config.5,v 1.76 2006/01/20 11:21:45 jmc Exp $
 .Dd September 25, 1999
 .Dt SSH_CONFIG 5
 .Os
@@ -270,8 +270,10 @@ with
 set to
 .Dq no
 (the default).
-These sessions will reuse the master instance's network connection rather
+These sessions will try to reuse the master instance's network connection
-than initiating new ones.
+rather than initiating new ones, but will fall back to connecting normally
+if the control socket does not exist, or is not listening.
+.Pp
 Setting this to
 .Dq ask
 will cause
@@ -290,7 +292,7 @@ will continue without connecting to a master instance.
 X11 and
 .Xr ssh-agent 1
 forwarding is supported over these multiplexed connections, however the
-display and agent fowarded will be the one belonging to the master
+display and agent forwarded will be the one belonging to the master
 connection i.e. it is not possible to forward multiple displays or agents.
 .Pp
 Two additional options allow for opportunistic multiplexing: try to use a
@@ -323,11 +325,33 @@ used for opportunistic connection sharing include
 all three of these escape sequences.
 This ensures that shared connections are uniquely identified.
 .It Cm DynamicForward
-Specifies that a TCP/IP port on the local machine be forwarded
+Specifies that a TCP port on the local machine be forwarded
 over the secure channel, and the application
 protocol is then used to determine where to connect to from the
 remote machine.
-The argument must be a port number.
+.Pp
+The argument must be
+.Sm off
+.Oo Ar bind_address : Oc Ar port .
+.Sm on
+IPv6 addresses can be specified by enclosing addresses in square brackets or
+by using an alternative syntax:
+.Oo Ar bind_address Ns / Oc Ns Ar port .
+By default, the local port is bound in accordance with the
+.Cm GatewayPorts
+setting.
+However, an explicit
+.Ar bind_address
+may be used to bind the connection to a specific address.
+The
+.Ar bind_address
+of
+.Dq localhost
+indicates that the listening port be bound for local use only, while an
+empty address or
+.Sq *
+indicates that the port should be available from all interfaces.
+.Pp
 Currently the SOCKS4 and SOCKS5 protocols are supported, and
 .Nm ssh
 will act as a SOCKS server.
@@ -501,23 +525,6 @@ Default is the name given on the command line.
 Numeric IP addresses are also permitted (both on the command line and in
 .Cm HostName
 specifications).
-.It Cm IdentityFile
-Specifies a file from which the user's RSA or DSA authentication identity
-is read.
-The default is
-.Pa ~/.ssh/identity
-for protocol version 1, and
-.Pa ~/.ssh/id_rsa
-and
-.Pa ~/.ssh/id_dsa
-for protocol version 2.
-Additionally, any identities represented by the authentication agent
-will be used for authentication.
-The file name may use the tilde
-syntax to refer to a user's home directory.
-It is possible to have
-multiple identity files specified in configuration files; all these
-identities will be tried in sequence.
 .It Cm IdentitiesOnly
 Specifies that
 .Nm ssh
@@ -531,17 +538,42 @@ The argument to this keyword must be
 .Dq yes
 or
 .Dq no .
-This option is intented for situations where
+This option is intended for situations where
 .Nm ssh-agent
 offers many different identities.
 The default is
 .Dq no .
+.It Cm IdentityFile
+Specifies a file from which the user's RSA or DSA authentication identity
+is read.
+The default is
+.Pa ~/.ssh/identity
+for protocol version 1, and
+.Pa ~/.ssh/id_rsa
+and
+.Pa ~/.ssh/id_dsa
+for protocol version 2.
+Additionally, any identities represented by the authentication agent
+will be used for authentication.
+The file name may use the tilde
+syntax to refer to a user's home directory.
+It is possible to have
+multiple identity files specified in configuration files; all these
+identities will be tried in sequence.
 .It Cm KbdInteractiveDevices
 Specifies the list of methods to use in keyboard-interactive authentication.
 Multiple method names must be comma-separated.
 The default is to use the server specified list.
+.It Cm LocalCommand
+Specifies a command to execute on the local machine after successfully
+connecting to the server.
+The command string extends to the end of the line, and is executed with
+.Pa /bin/sh .
+This directive is ignored unless
+.Cm PermitLocalCommand
+has been enabled.
 .It Cm LocalForward
-Specifies that a TCP/IP port on the local machine be forwarded over
+Specifies that a TCP port on the local machine be forwarded over
 the secure channel to the specified host and port from the remote machine.
 The first argument must be
 .Sm off
@@ -609,6 +641,19 @@ or
 .Dq no .
 The default is
 .Dq yes .
+.It Cm PermitLocalCommand
+Allow local command execution via the
+.Ic LocalCommand
+option or using the
+.Ic !\& Ns Ar command
+escape sequence in
+.Xr ssh 1 .
+The argument must be
+.Dq yes
+or
+.Dq no .
+The default is
+.Dq no .
 .It Cm Port
 Specifies the port number to connect on the remote host.
 Default is 22.
@@ -681,8 +726,23 @@ or
 The default is
 .Dq yes .
 This option applies to protocol version 2 only.
+.It Cm RekeyLimit
+Specifies the maximum amount of data that may be transmitted before the
+session key is renegotiated.
+The argument is the number of bytes, with an optional suffix of
+.Sq K ,
+.Sq M ,
+or
+.Sq G
+to indicate Kilobytes, Megabytes, or Gigabytes, respectively.
+The default is between
+.Dq 1G
+and
+.Dq 4G ,
+depending on the cipher.
+This option applies to protocol version 2 only.
 .It Cm RemoteForward
-Specifies that a TCP/IP port on the remote machine be forwarded over
+Specifies that a TCP port on the remote machine be forwarded over
 the secure channel to the specified host and port from the local machine.
 The first argument must be
 .Sm off
@@ -759,21 +819,8 @@ across multiple
 .Cm SendEnv
 directives.
 The default is not to send any environment variables.
-.It Cm ServerAliveInterval
-Sets a timeout interval in seconds after which if no data has been received
-from the server,
-.Nm ssh
-will send a message through the encrypted
-channel to request a response from the server.
-The default
-is 0, indicating that these messages will not be sent to the server,
-or 300 if the
-.Cm BatchMode
-option is set.
-.Cm ProtocolKeepAlives
-is a Debian-specific compatibility alias for this option.
 .It Cm ServerAliveCountMax
-Sets the number of server alive messages (see above) which may be
+Sets the number of server alive messages (see below) which may be
 sent without
 .Nm ssh
 receiving any messages back from the server.
@@ -795,7 +842,7 @@ server depend on knowing when a connection has become inactive.
 The default value is 3.
 If, for example,
 .Cm ServerAliveInterval
-(above) is set to 15, and
+(see below) is set to 15, and
 .Cm ServerAliveCountMax
 is left at the default, if the server becomes unresponsive ssh
 will disconnect after approximately 45 seconds.
@@ -803,6 +850,20 @@ This option works when using protocol version 2 only; in protocol version
 1 there is no mechanism to request a response from the server to the
 server alive messages, so disconnection is the responsibility of the TCP
 stack.
+.It Cm ServerAliveInterval
+Sets a timeout interval in seconds after which if no data has been received
+from the server,
+.Nm ssh
+will send a message through the encrypted
+channel to request a response from the server.
+The default
+is 0, indicating that these messages will not be sent to the server,
+or 300 if the
+.Cm BatchMode
+option is set.
+This option applies to protocol version 2 only.
+.Cm ProtocolKeepAlives
+is a Debian-specific compatibility alias for this option.
 .It Cm SetupTimeOut
 Normally,
 .Nm ssh
@@ -885,6 +946,25 @@ This is important in scripts, and many users want it too.
 .Pp
 To disable TCP keepalive messages, the value should be set to
 .Dq no .
+.It Cm Tunnel
+Request starting
+.Xr tun 4
+device forwarding between the client and the server.
+This option also allows requesting layer 2 (ethernet)
+instead of layer 3 (point-to-point) tunneling from the server.
+The argument must be
+.Dq yes ,
+.Dq point-to-point ,
+.Dq ethernet
+or
+.Dq no .
+The default is
+.Dq no .
+.It Cm TunnelDevice
+Force a specified
+.Xr tun 4
+device on the client.
+Without this option, the next available device will be used.
 .It Cm UsePrivilegedPort
 Specifies whether to use a privileged port for outgoing connections.
 The argument must be
diff --git a/sshconnect.c b/sshconnect.c
index 10eaac35d..8a63ef22b 100644
--- a/sshconnect.c
+++ b/sshconnect.c
@@ -13,7 +13,7 @@
 */
 #include "includes.h"
-RCSID("$OpenBSD: sshconnect.c,v 1.168 2005/07/17 07:17:55 djm Exp $");
+RCSID("$OpenBSD: sshconnect.c,v 1.171 2005/12/06 22:38:27 reyk Exp $");
 #include <openssl/bn.h>
@@ -31,13 +31,12 @@ RCSID("$OpenBSD: sshconnect.c,v 1.168 2005/07/17 07:17:55 djm Exp $");
 #include "readconf.h"
 #include "atomicio.h"
 #include "misc.h"
 #include "dns.h"
 char *client_version_string = NULL;
 char *server_version_string = NULL;
-int matching_host_key_dns = 0;
+static int matching_host_key_dns = 0;
 /* import */
 extern Options options;
@@ -647,7 +646,7 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
        file_key = key_new(host_key->type);
        /*
-         * Check if the host key is present in the user\'s list of known
+         * Check if the host key is present in the user's list of known
         * hosts or in the systemwide list.
         */
        host_file = user_hostfile;
@@ -1078,3 +1077,39 @@ warn_changed_key(Key *host_key)
        xfree(fp);
 }
+/*
+ * Execute a local command
+ */
+int
+ssh_local_cmd(const char *args)
+{
+        char *shell;
+        pid_t pid;
+        int status;
+        if (!options.permit_local_command ||
+            args == NULL || !*args)
+                return (1);
+        if ((shell = getenv("SHELL")) == NULL)
+                shell = _PATH_BSHELL;
+        pid = fork();
+        if (pid == 0) {
+                debug3("Executing %s -c \"%s\"", shell, args);
+                execl(shell, shell, "-c", args, (char *)NULL);
+                error("Couldn't execute %s -c \"%s\": %s",
+                    shell, args, strerror(errno));
+                _exit(1);
+        } else if (pid == -1)
+                fatal("fork failed: %.100s", strerror(errno));
+        while (waitpid(pid, &status, 0) == -1)
+                if (errno != EINTR)
+                        fatal("Couldn't wait for child: %s", strerror(errno));
+        if (!WIFEXITED(status))
+                return (1);
+        return (WEXITSTATUS(status));
+}
diff --git a/sshconnect.h b/sshconnect.h
index 0be30fe69..e7c7a2b34 100644
--- a/sshconnect.h
+++ b/sshconnect.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: sshconnect.h,v 1.17 2002/06/19 00:27:55 deraadt Exp $ */
+/*      $OpenBSD: sshconnect.h,v 1.18 2005/12/06 22:38:28 reyk Exp $    */
 /*
 * Copyright (c) 2000 Markus Friedl.  All rights reserved.
@@ -49,7 +49,7 @@ void	 ssh_userauth1(const char *, const char *, char *, Sensitive *);
 void     ssh_userauth2(const char *, const char *, char *, Sensitive *);
 void     ssh_put_password(char *);
+int      ssh_local_cmd(const char *);
 /*
 * Macros to raise/lower permissions.
diff --git a/sshconnect1.c b/sshconnect1.c
index bd05723c7..440d7c5bd 100644
--- a/sshconnect1.c
+++ b/sshconnect1.c
@@ -13,7 +13,7 @@
 */
 #include "includes.h"
-RCSID("$OpenBSD: sshconnect1.c,v 1.61 2005/06/17 02:44:33 djm Exp $");
+RCSID("$OpenBSD: sshconnect1.c,v 1.62 2005/10/30 08:52:18 djm Exp $");
 #include <openssl/bn.h>
 #include <openssl/md5.h>
@@ -84,7 +84,7 @@ try_agent_authentication(void)
                /* Wait for server's response. */
                type = packet_read();
-                /* The server sends failure if it doesn\'t like our key or
+                /* The server sends failure if it doesn't like our key or
                   does not support RSA authentication. */
                if (type == SSH_SMSG_FAILURE) {
                        debug("Server refused our key.");
@@ -215,8 +215,8 @@ try_rsa_authentication(int idx)
        type = packet_read();
        /*
-         * The server responds with failure if it doesn\'t like our key or
+         * The server responds with failure if it doesn't like our key or
-         * doesn\'t support RSA authentication.
+         * doesn't support RSA authentication.
         */
        if (type == SSH_SMSG_FAILURE) {
                debug("Server refused our key.");
diff --git a/sshconnect2.c b/sshconnect2.c
index 579e60c1c..7ee71763a 100644
--- a/sshconnect2.c
+++ b/sshconnect2.c
@@ -23,7 +23,7 @@
 */
 #include "includes.h"
-RCSID("$OpenBSD: sshconnect2.c,v 1.142 2005/08/30 22:08:05 djm Exp $");
+RCSID("$OpenBSD: sshconnect2.c,v 1.143 2005/10/14 02:17:59 stevesk Exp $");
 #include "openbsd-compat/sys-queue.h"
@@ -769,7 +769,7 @@ input_gssapi_error(int type, u_int32_t plen, void *ctxt)
        packet_check_eom();
-        debug("Server GSSAPI Error:\n%s\n", msg);
+        debug("Server GSSAPI Error:\n%s", msg);
        xfree(msg);
        xfree(lang);
 }
diff --git a/sshd.0 b/sshd.0
index 9a9613b54..040be6cad 100644
--- a/sshd.0
+++ b/sshd.0
@@ -8,95 +8,20 @@ SYNOPSIS
          [-h host_key_file] [-k key_gen_time] [-o option] [-p port] [-u len]
 DESCRIPTION
-     sshd (SSH Daemon) is the daemon program for ssh(1).  Together these pro-
+     sshd (OpenSSH Daemon) is the daemon program for ssh(1).  Together these
-     grams replace rlogin and rsh, and provide secure encrypted communications
+     programs replace rlogin and rsh, and provide secure encrypted communica-
-     between two untrusted hosts over an insecure network.  The programs are
+     tions between two untrusted hosts over an insecure network.
-     intended to be as easy to install and use as possible.
-     sshd is the daemon that listens for connections from clients.  It is nor-
-     mally started at boot from /etc/rc.  It forks a new daemon for each in-
-     coming connection.  The forked daemons handle key exchange, encryption,
-     authentication, command execution, and data exchange.  This implementa-
-     tion of sshd supports both SSH protocol version 1 and 2 simultaneously.
-     sshd works as follows:
-   SSH protocol version 1
-     Each host has a host-specific RSA key (normally 2048 bits) used to iden-
-     tify the host.  Additionally, when the daemon starts, it generates a
-     server RSA key (normally 768 bits).  This key is normally regenerated ev-
-     ery hour if it has been used, and is never stored on disk.
-     Whenever a client connects, the daemon responds with its public host and
-     server keys.  The client compares the RSA host key against its own
-     database to verify that it has not changed.  The client then generates a
-     256-bit random number.  It encrypts this random number using both the
-     host key and the server key, and sends the encrypted number to the serv-
-     er.  Both sides then use this random number as a session key which is
-     used to encrypt all further communications in the session.  The rest of
-     the session is encrypted using a conventional cipher, currently Blowfish
-     or 3DES, with 3DES being used by default.  The client selects the encryp-
-     tion algorithm to use from those offered by the server.
-     Next, the server and the client enter an authentication dialog.  The
+     sshd listens for connections from clients.  It is normally started at
-     client tries to authenticate itself using .rhosts authentication combined
+     boot from /etc/rc.  It forks a new daemon for each incoming connection.
-     with RSA host authentication, RSA challenge-response authentication, or
+     The forked daemons handle key exchange, encryption, authentication, com-
-     password based authentication.
+     mand execution, and data exchange.
-     Regardless of the authentication type, the account is checked to ensure
-     that it is accessible.  An account is not accessible if it is locked,
-     listed in DenyUsers or its group is listed in DenyGroups .  The defini-
-     tion of a locked account is system dependant. Some platforms have their
-     own account database (eg AIX) and some modify the passwd field ( `*LK*'
-     on Solaris, `*' on HP-UX, containing `Nologin' on Tru64 and a leading
-     `!!' on Linux).  If there is a requirement to disable password authenti-
-     cation for the account while allowing still public-key, then the passwd
-     field should be set to something other than these values (eg `NP' or
-     `*NP*' ).
-     rshd, rlogind, and rexecd are disabled (thus completely disabling rlogin
-     and rsh into the machine).
-   SSH protocol version 2
-     Version 2 works similarly: Each host has a host-specific key (RSA or DSA)
-     used to identify the host.  However, when the daemon starts, it does not
-     generate a server key.  Forward security is provided through a Diffie-
-     Hellman key agreement.  This key agreement results in a shared session
-     key.
-     The rest of the session is encrypted using a symmetric cipher, currently
-     128-bit AES, Blowfish, 3DES, CAST128, Arcfour, 192-bit AES, or 256-bit
-     AES.  The client selects the encryption algorithm to use from those of-
-     fered by the server.  Additionally, session integrity is provided through
-     a cryptographic message authentication code (hmac-sha1 or hmac-md5).
-     Protocol version 2 provides a public key based user (PubkeyAuthentica-
-     tion) or client host (HostbasedAuthentication) authentication method,
-     conventional password authentication and challenge response based meth-
-     ods.
-   Command execution and data forwarding
-     If the client successfully authenticates itself, a dialog for preparing
-     the session is entered.  At this time the client may request things like
-     allocating a pseudo-tty, forwarding X11 connections, forwarding TCP/IP
-     connections, or forwarding the authentication agent connection over the
-     secure channel.
-     Finally, the client either requests a shell or execution of a command.
-     The sides then enter session mode.  In this mode, either side may send
-     data at any time, and such data is forwarded to/from the shell or command
-     on the server side, and the user terminal in the client side.
-     When the user program terminates and all forwarded X11 and other connec-
-     tions have been closed, the server sends command exit status to the
-     client, and both sides exit.
     sshd can be configured using command-line options or a configuration file
-     (by default sshd_config(5)).  Command-line options override values speci-
+     (by default sshd_config(5)); command-line options override values speci-
-     fied in the configuration file.
+     fied in the configuration file.  sshd rereads its configuration file when
+     it receives a hangup signal, SIGHUP, by executing itself with the name
-     sshd rereads its configuration file when it receives a hangup signal,
+     and options it was started with, e.g., /usr/sbin/sshd.
-     SIGHUP, by executing itself with the name and options it was started
-     with, e.g., /usr/sbin/sshd.
     The options are as follows:
@@ -165,8 +90,9 @@ DESCRIPTION
     -p port
             Specifies the port on which the server listens for connections
             (default 22).  Multiple port options are permitted.  Ports speci-
-             fied in the configuration file are ignored when a command-line
+             fied in the configuration file with the Port option are ignored
-             port is specified.
+             when a command-line port is specified.  Ports specified using the
+             ListenAddress option override command-line ports.
     -q      Quiet mode.  Nothing is sent to the system log.  Normally the be-
             ginning, authentication, and termination of each connection is
@@ -185,15 +111,74 @@ DESCRIPTION
             the utmp file.  -u0 may also be used to prevent sshd from making
             DNS requests unless the authentication mechanism or configuration
             requires it.  Authentication mechanisms that may require DNS in-
-             clude RhostsRSAAuthentication, HostbasedAuthentication and using
+             clude RhostsRSAAuthentication, HostbasedAuthentication, and using
             a from="pattern-list" option in a key file.  Configuration op-
             tions that require DNS include using a USER@HOST pattern in
             AllowUsers or DenyUsers.
-CONFIGURATION FILE
+AUTHENTICATION
-     sshd reads configuration data from /etc/ssh/sshd_config (or the file
+     The OpenSSH SSH daemon supports SSH protocols 1 and 2.  Both protocols
-     specified with -f on the command line).  The file format and configura-
+     are supported by default, though this can be changed via the Protocol op-
-     tion options are described in sshd_config(5).
+     tion in sshd_config(5).  Protocol 2 supports both RSA and DSA keys; pro-
+     tocol 1 only supports RSA keys.  For both protocols, each host has a
+     host-specific key, normally 2048 bits, used to identify the host.
+     Forward security for protocol 1 is provided through an additional server
+     key, normally 768 bits, generated when the server starts.  This key is
+     normally regenerated every hour if it has been used, and is never stored
+     on disk.  Whenever a client connects, the daemon responds with its public
+     host and server keys.  The client compares the RSA host key against its
+     own database to verify that it has not changed.  The client then gener-
+     ates a 256-bit random number.  It encrypts this random number using both
+     the host key and the server key, and sends the encrypted number to the
+     server.  Both sides then use this random number as a session key which is
+     used to encrypt all further communications in the session.  The rest of
+     the session is encrypted using a conventional cipher, currently Blowfish
+     or 3DES, with 3DES being used by default.  The client selects the encryp-
+     tion algorithm to use from those offered by the server.
+     For protocol 2, forward security is provided through a Diffie-Hellman key
+     agreement.  This key agreement results in a shared session key.  The rest
+     of the session is encrypted using a symmetric cipher, currently 128-bit
+     AES, Blowfish, 3DES, CAST128, Arcfour, 192-bit AES, or 256-bit AES.  The
+     client selects the encryption algorithm to use from those offered by the
+     server.  Additionally, session integrity is provided through a crypto-
+     graphic message authentication code (hmac-sha1 or hmac-md5).
+     Finally, the server and the client enter an authentication dialog.  The
+     client tries to authenticate itself using host-based authentication, pub-
+     lic key authentication, challenge-response authentication, or password
+     authentication.
+     Regardless of the authentication type, the account is checked to ensure
+     that it is accessible.  An account is not accessible if it is locked,
+     listed in DenyUsers or its group is listed in DenyGroups .  The defini-
+     tion of a locked account is system dependant. Some platforms have their
+     own account database (eg AIX) and some modify the passwd field ( `*LK*'
+     on Solaris and UnixWare, `*' on HP-UX, containing `Nologin' on Tru64, a
+     leading `*LOCKED*' on FreeBSD and a leading `!!' on Linux).  If there is
+     a requirement to disable password authentication for the account while
+     allowing still public-key, then the passwd field should be set to some-
+     thing other than these values (eg `NP' or `*NP*' ).
+     System security is not improved unless rshd, rlogind, and rexecd are dis-
+     abled (thus completely disabling rlogin and rsh into the machine).
+COMMAND EXECUTION AND DATA FORWARDING
+     If the client successfully authenticates itself, a dialog for preparing
+     the session is entered.  At this time the client may request things like
+     allocating a pseudo-tty, forwarding X11 connections, forwarding TCP con-
+     nections, or forwarding the authentication agent connection over the se-
+     cure channel.
+     Finally, the client either requests a shell or execution of a command.
+     The sides then enter session mode.  In this mode, either side may send
+     data at any time, and such data is forwarded to/from the shell or command
+     on the server side, and the user terminal in the client side.
+     When the user program terminates and all forwarded X11 and other connec-
+     tions have been closed, the server sends command exit status to the
+     client, and both sides exit.
 LOGIN PROCESS
     When a user successfully logs in, sshd does the following:
@@ -280,9 +265,9 @@ AUTHORIZED_KEYS FILE FORMAT
             backslash.  This option might be useful to restrict certain pub-
             lic keys to perform just a specific operation.  An example might
             be a key that permits remote backups but nothing else.  Note that
-             the client may specify TCP/IP and/or X11 forwarding unless they
+             the client may specify TCP and/or X11 forwarding unless they are
-             are explicitly prohibited.  Note that this option applies to
+             explicitly prohibited.  Note that this option applies to shell,
-             shell, command or subsystem execution.
+             command or subsystem execution.
     environment="NAME=value"
             Specifies that the string is to be added to the environment when
@@ -293,10 +278,9 @@ AUTHORIZED_KEYS FILE FORMAT
             This option is automatically disabled if UseLogin is enabled.
     no-port-forwarding
-             Forbids TCP/IP forwarding when this key is used for authentica-
+             Forbids TCP forwarding when this key is used for authentication.
-             tion.  Any port forward requests by the client will return an er-
+             Any port forward requests by the client will return an error.
-             ror.  This might be used, e.g., in connection with the command
+             This might be used, e.g., in connection with the command option.
-             option.
     no-X11-forwarding
             Forbids X11 forwarding when this key is used for authentication.
@@ -316,6 +300,11 @@ AUTHORIZED_KEYS FILE FORMAT
             is performed on the specified hostnames, they must be literal do-
             mains or addresses.
+     tunnel="n"
+             Force a tun(4) device on the server.  Without this option, the
+             next available device will be used if the client requests a tun-
+             nel.
   Examples
     1024 33 12121...312314325 ylo@foo.bar
@@ -326,6 +315,9 @@ AUTHORIZED_KEYS FILE FORMAT
     permitopen="10.2.1.55:80",permitopen="10.2.1.56:25" 1024 33 23...2323
+     tunnel="0",command="sh /etc/netstart tun0" ssh-rsa AAAA...== reyk@openb-
+     sd.org
 SSH_KNOWN_HOSTS FILE FORMAT
     The /etc/ssh/ssh_known_hosts and ~/.ssh/known_hosts files contain host
     public keys for all known hosts.  The global file should be prepared by
@@ -571,4 +563,4 @@ AUTHORS
     versions 1.5 and 2.0.  Niels Provos and Markus Friedl contributed support
     for privilege separation.
-OpenBSD 3.8                   September 25, 1999                             9
+OpenBSD 3.9                   September 25, 1999                             9
diff --git a/sshd.8 b/sshd.8
index 92eb7a9da..fec3c3582 100644
--- a/sshd.8
+++ b/sshd.8
@@ -34,7 +34,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: sshd.8,v 1.208 2005/06/08 03:50:00 djm Exp $
+.\" $OpenBSD: sshd.8,v 1.215 2006/02/01 09:11:41 jmc Exp $
 .Dd September 25, 1999
 .Dt SSHD 8
 .Os
@@ -56,16 +56,14 @@
 .Ek
 .Sh DESCRIPTION
 .Nm
-(SSH Daemon) is the daemon program for
+(OpenSSH Daemon) is the daemon program for
 .Xr ssh 1 .
 Together these programs replace rlogin and rsh, and
 provide secure encrypted communications between two untrusted hosts
 over an insecure network.
-The programs are intended to be as easy to
-install and use as possible.
 .Pp
 .Nm
-is the daemon that listens for connections from clients.
+listens for connections from clients.
 It is normally started at boot from
 .Pa /etc/rc .
 It forks a new
@@ -73,119 +71,13 @@ daemon for each incoming connection.
 The forked daemons handle
 key exchange, encryption, authentication, command execution,
 and data exchange.
-This implementation of
-.Nm
-supports both SSH protocol version 1 and 2 simultaneously.
-.Nm
-works as follows:
-.Ss SSH protocol version 1
-Each host has a host-specific RSA key
-(normally 2048 bits) used to identify the host.
-Additionally, when
-the daemon starts, it generates a server RSA key (normally 768 bits).
-This key is normally regenerated every hour if it has been used, and
-is never stored on disk.
-.Pp
-Whenever a client connects, the daemon responds with its public
-host and server keys.
-The client compares the
-RSA host key against its own database to verify that it has not changed.
-The client then generates a 256-bit random number.
-It encrypts this
-random number using both the host key and the server key, and sends
-the encrypted number to the server.
-Both sides then use this
-random number as a session key which is used to encrypt all further
-communications in the session.
-The rest of the session is encrypted
-using a conventional cipher, currently Blowfish or 3DES, with 3DES
-being used by default.
-The client selects the encryption algorithm
-to use from those offered by the server.
-.Pp
-Next, the server and the client enter an authentication dialog.
-The client tries to authenticate itself using
-.Em .rhosts
-authentication combined with RSA host
-authentication, RSA challenge-response authentication, or password
-based authentication.
-.Pp
-Regardless of the authentication type, the account is checked to
-ensure that it is accessible.  An account is not accessible if it is
-locked, listed in
-.Cm DenyUsers
-or its group is listed in
-.Cm DenyGroups
-\&.  The definition of a locked account is system dependant. Some platforms
-have their own account database (eg AIX) and some modify the passwd field (
-.Ql \&*LK\&*
-on Solaris,
-.Ql \&*
-on HP-UX, containing
-.Ql Nologin
-on Tru64 and a leading
-.Ql \&!!
-on Linux).  If there is a requirement to disable password authentication
-for the account while allowing still public-key, then the passwd field
-should be set to something other than these values (eg
-.Ql NP
-or
-.Ql \&*NP\&*
-).
-.Pp
-.Nm rshd ,
-.Nm rlogind ,
-and
-.Nm rexecd
-are disabled (thus completely disabling
-.Xr rlogin
-and
-.Xr rsh
-into the machine).
-.Ss SSH protocol version 2
-Version 2 works similarly:
-Each host has a host-specific key (RSA or DSA) used to identify the host.
-However, when the daemon starts, it does not generate a server key.
-Forward security is provided through a Diffie-Hellman key agreement.
-This key agreement results in a shared session key.
-.Pp
-The rest of the session is encrypted using a symmetric cipher, currently
-128-bit AES, Blowfish, 3DES, CAST128, Arcfour, 192-bit AES, or 256-bit AES.
-The client selects the encryption algorithm
-to use from those offered by the server.
-Additionally, session integrity is provided
-through a cryptographic message authentication code
-(hmac-sha1 or hmac-md5).
-.Pp
-Protocol version 2 provides a public key based
-user (PubkeyAuthentication) or
-client host (HostbasedAuthentication) authentication method,
-conventional password authentication and challenge response based methods.
-.Ss Command execution and data forwarding
-If the client successfully authenticates itself, a dialog for
-preparing the session is entered.
-At this time the client may request
-things like allocating a pseudo-tty, forwarding X11 connections,
-forwarding TCP/IP connections, or forwarding the authentication agent
-connection over the secure channel.
-.Pp
-Finally, the client either requests a shell or execution of a command.
-The sides then enter session mode.
-In this mode, either side may send
-data at any time, and such data is forwarded to/from the shell or
-command on the server side, and the user terminal in the client side.
-.Pp
-When the user program terminates and all forwarded X11 and other
-connections have been closed, the server sends command exit status to
-the client, and both sides exit.
 .Pp
 .Nm
 can be configured using command-line options or a configuration file
 (by default
-.Xr sshd_config 5 ) .
+.Xr sshd_config 5 ) ;
-Command-line options override values specified in the
+command-line options override values specified in the
 configuration file.
-.Pp
 .Nm
 rereads its configuration file when it receives a hangup signal,
 .Dv SIGHUP ,
@@ -285,8 +177,12 @@ For full details of the options, and their values, see
 Specifies the port on which the server listens for connections
 (default 22).
 Multiple port options are permitted.
-Ports specified in the configuration file are ignored when a
+Ports specified in the configuration file with the
-command-line port is specified.
+.Cm Port
+option are ignored when a command-line port is specified.
+Ports specified using the
+.Cm ListenAddress
+option override command-line ports.
 .It Fl q
 Quiet mode.
 Only fatal errors are sent to the system log.
@@ -324,7 +220,7 @@ from making DNS requests unless the authentication
 mechanism or configuration requires it.
 Authentication mechanisms that may require DNS include
 .Cm RhostsRSAAuthentication ,
-.Cm HostbasedAuthentication
+.Cm HostbasedAuthentication ,
 and using a
 .Cm from="pattern-list"
 option in a key file.
@@ -334,15 +230,114 @@ USER@HOST pattern in
 or
 .Cm DenyUsers .
 .El
-.Sh CONFIGURATION FILE
+.Sh AUTHENTICATION
-.Nm
+The OpenSSH SSH daemon supports SSH protocols 1 and 2.
-reads configuration data from
+Both protocols are supported by default,
-.Pa /etc/ssh/sshd_config
+though this can be changed via the
-(or the file specified with
+.Cm Protocol
-.Fl f
+option in
-on the command line).
-The file format and configuration options are described in
 .Xr sshd_config 5 .
+Protocol 2 supports both RSA and DSA keys;
+protocol 1 only supports RSA keys.
+For both protocols,
+each host has a host-specific key,
+normally 2048 bits,
+used to identify the host.
+.Pp
+Forward security for protocol 1 is provided through
+an additional server key,
+normally 768 bits,
+generated when the server starts.
+This key is normally regenerated every hour if it has been used, and
+is never stored on disk.
+Whenever a client connects, the daemon responds with its public
+host and server keys.
+The client compares the
+RSA host key against its own database to verify that it has not changed.
+The client then generates a 256-bit random number.
+It encrypts this
+random number using both the host key and the server key, and sends
+the encrypted number to the server.
+Both sides then use this
+random number as a session key which is used to encrypt all further
+communications in the session.
+The rest of the session is encrypted
+using a conventional cipher, currently Blowfish or 3DES, with 3DES
+being used by default.
+The client selects the encryption algorithm
+to use from those offered by the server.
+.Pp
+For protocol 2,
+forward security is provided through a Diffie-Hellman key agreement.
+This key agreement results in a shared session key.
+The rest of the session is encrypted using a symmetric cipher, currently
+128-bit AES, Blowfish, 3DES, CAST128, Arcfour, 192-bit AES, or 256-bit AES.
+The client selects the encryption algorithm
+to use from those offered by the server.
+Additionally, session integrity is provided
+through a cryptographic message authentication code
+(hmac-sha1 or hmac-md5).
+.Pp
+Finally, the server and the client enter an authentication dialog.
+The client tries to authenticate itself using
+host-based authentication,
+public key authentication,
+challenge-response authentication,
+or password authentication.
+.Pp
+Regardless of the authentication type, the account is checked to
+ensure that it is accessible.  An account is not accessible if it is
+locked, listed in
+.Cm DenyUsers
+or its group is listed in
+.Cm DenyGroups
+\&.  The definition of a locked account is system dependant. Some platforms
+have their own account database (eg AIX) and some modify the passwd field (
+.Ql \&*LK\&*
+on Solaris and UnixWare,
+.Ql \&*
+on HP-UX, containing
+.Ql Nologin
+on Tru64,
+a leading
+.Ql \&*LOCKED\&*
+on FreeBSD and a leading
+.Ql \&!!
+on Linux).  If there is a requirement to disable password authentication
+for the account while allowing still public-key, then the passwd field
+should be set to something other than these values (eg
+.Ql NP
+or
+.Ql \&*NP\&*
+).
+.Pp
+System security is not improved unless
+.Nm rshd ,
+.Nm rlogind ,
+and
+.Nm rexecd
+are disabled (thus completely disabling
+.Xr rlogin
+and
+.Xr rsh
+into the machine).
+.Sh COMMAND EXECUTION AND DATA FORWARDING
+If the client successfully authenticates itself, a dialog for
+preparing the session is entered.
+At this time the client may request
+things like allocating a pseudo-tty, forwarding X11 connections,
+forwarding TCP connections, or forwarding the authentication agent
+connection over the secure channel.
+.Pp
+Finally, the client either requests a shell or execution of a command.
+The sides then enter session mode.
+In this mode, either side may send
+data at any time, and such data is forwarded to/from the shell or
+command on the server side, and the user terminal in the client side.
+.Pp
+When the user program terminates and all forwarded X11 and other
+connections have been closed, the server sends command exit status to
+the client, and both sides exit.
 .Sh LOGIN PROCESS
 When a user successfully logs in,
 .Nm
@@ -476,7 +471,7 @@ A quote may be included in the command by quoting it with a backslash.
 This option might be useful
 to restrict certain public keys to perform just a specific operation.
 An example might be a key that permits remote backups but nothing else.
-Note that the client may specify TCP/IP and/or X11
+Note that the client may specify TCP and/or X11
 forwarding unless they are explicitly prohibited.
 Note that this option applies to shell, command or subsystem execution.
 .It Cm environment="NAME=value"
@@ -493,7 +488,7 @@ This option is automatically disabled if
 .Cm UseLogin
 is enabled.
 .It Cm no-port-forwarding
-Forbids TCP/IP forwarding when this key is used for authentication.
+Forbids TCP forwarding when this key is used for authentication.
 Any port forward requests by the client will return an error.
 This might be used, e.g., in connection with the
 .Cm command
@@ -518,6 +513,12 @@ Multiple
 options may be applied separated by commas.
 No pattern matching is performed on the specified hostnames,
 they must be literal domains or addresses.
+.It Cm tunnel="n"
+Force a
+.Xr tun 4
+device on the server.
+Without this option, the next available device will be used if
+the client requests a tunnel.
 .El
 .Ss Examples
 1024 33 12121...312314325 ylo@foo.bar
@@ -527,6 +528,8 @@ from="*.niksula.hut.fi,!pc.niksula.hut.fi" 1024 35 23...2334 ylo@niksula
 command="dump /home",no-pty,no-port-forwarding 1024 33 23...2323 backup.hut.fi
 .Pp
 permitopen="10.2.1.55:80",permitopen="10.2.1.56:25" 1024 33 23...2323
+.Pp
+tunnel="0",command="sh /etc/netstart tun0" ssh-rsa AAAA...== reyk@openbsd.org
 .Sh SSH_KNOWN_HOSTS FILE FORMAT
 The
 .Pa /etc/ssh/ssh_known_hosts
diff --git a/sshd.c b/sshd.c
index 967f5e7f0..df6d1e374 100644
--- a/sshd.c
+++ b/sshd.c
@@ -42,7 +42,7 @@
 */
 #include "includes.h"
-RCSID("$OpenBSD: sshd.c,v 1.312 2005/07/25 11:59:40 markus Exp $");
+RCSID("$OpenBSD: sshd.c,v 1.318 2005/12/24 02:27:41 djm Exp $");
 #include <openssl/dh.h>
 #include <openssl/bn.h>
@@ -633,16 +633,8 @@ privsep_postauth(Authctxt *authctxt)
        if (authctxt->pw->pw_uid == 0 || options.use_login) {
 #endif
                /* File descriptor passing is broken or root login */
-                monitor_apply_keystate(pmonitor);
                use_privsep = 0;
-                return;
+                goto skip;
-        }
-        /* Authentication complete */
-        alarm(0);
-        if (startup_pipe != -1) {
-                close(startup_pipe);
-                startup_pipe = -1;
        }
        /* New socket pair */
@@ -669,6 +661,7 @@ privsep_postauth(Authctxt *authctxt)
        /* Drop privileges */
        do_setusercontext(authctxt->pw);
+ skip:
        /* It is safe now to apply the key state */
        monitor_apply_keystate(pmonitor);
@@ -800,6 +793,7 @@ send_rexec_state(int fd, Buffer *conf)
         *      bignum  iqmp                    "
         *      bignum  p                       "
         *      bignum  q                       "
+         *      string rngseed          (only if OpenSSL is not self-seeded)
         */
        buffer_init(&m);
        buffer_put_cstring(&m, buffer_ptr(conf));
@@ -816,6 +810,10 @@ send_rexec_state(int fd, Buffer *conf)
        } else
                buffer_put_int(&m, 0);
+#ifndef OPENSSL_PRNG_ONLY
+        rexec_send_rng_seed(&m);
+#endif
        if (ssh_msg_send(fd, 0, &m) == -1)
                fatal("%s: ssh_msg_send failed", __func__);
@@ -858,6 +856,11 @@ recv_rexec_state(int fd, Buffer *conf)
                rsa_generate_additional_parameters(
                    sensitive_data.server_key->rsa);
        }
+#ifndef OPENSSL_PRNG_ONLY
+        rexec_recv_rng_seed(&m);
+#endif
        buffer_free(&m);
        debug3("%s: done", __func__);
@@ -914,6 +917,9 @@ main(int ac, char **av)
        if (geteuid() == 0 && setgroups(0, NULL) == -1)
                debug("setgroups(): %.200s", strerror(errno));
+        /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
+        sanitise_stdfd();
        /* Initialize configuration options to their default values. */
        initialize_server_options(&options);
@@ -1056,8 +1062,6 @@ main(int ac, char **av)
        drop_cray_privs();
 #endif
-        seed_rng();
        sensitive_data.server_key = NULL;
        sensitive_data.ssh1_host_key = NULL;
        sensitive_data.have_ssh1_key = 0;
@@ -1076,6 +1080,8 @@ main(int ac, char **av)
        if (!rexec_flag)
                buffer_free(&cfg);
+        seed_rng();
        /* Fill in default values for those options not explicitly set. */
        fill_default_server_options(&options);
@@ -1645,7 +1651,12 @@ main(int ac, char **av)
                debug("get_remote_port failed");
                cleanup_exit(255);
        }
-        remote_ip = get_remote_ipaddr();
+        /*
+         * We use get_canonical_hostname with usedns = 0 instead of
+         * get_remote_ipaddr here so IP options will be checked.
+         */
+        remote_ip = get_canonical_hostname(0);
 #ifdef SSH_AUDIT_EVENTS
        audit_connection_from(remote_ip, remote_port);
@@ -1671,10 +1682,10 @@ main(int ac, char **av)
        verbose("Connection from %.500s port %d", remote_ip, remote_port);
        /*
-         * We don\'t want to listen forever unless the other side
+         * We don't want to listen forever unless the other side
         * successfully authenticates itself.  So we set up an alarm which is
         * cleared after successful authentication.  A limit of zero
-         * indicates no limit. Note that we don\'t set the alarm in debugging
+         * indicates no limit. Note that we don't set the alarm in debugging
         * mode; it is just annoying to have the server exit just when you
         * are about to discover the bug.
         */
@@ -1721,6 +1732,17 @@ main(int ac, char **av)
        }
 authenticated:
+        /*
+         * Cancel the alarm we set to limit the time taken for
+         * authentication.
+         */
+        alarm(0);
+        signal(SIGALRM, SIG_DFL);
+        if (startup_pipe != -1) {
+                close(startup_pipe);
+                startup_pipe = -1;
+        }
 #ifdef SSH_AUDIT_EVENTS
        audit_event(SSH_AUTH_SUCCESS);
 #endif
diff --git a/sshd_config b/sshd_config
index 1440c05ff..4957dd1a6 100644
--- a/sshd_config
+++ b/sshd_config
@@ -1,4 +1,4 @@
-#       $OpenBSD: sshd_config,v 1.72 2005/07/25 11:59:40 markus Exp $
+#       $OpenBSD: sshd_config,v 1.73 2005/12/06 22:38:28 reyk Exp $
 # This is the sshd server system-wide configuration file.  See
 # sshd_config(5) for more information.
@@ -96,6 +96,7 @@
 #UseDNS yes
 #PidFile /var/run/sshd.pid
 #MaxStartups 10
+#PermitTunnel no
 # no default banner path
 #Banner /some/path
diff --git a/sshd_config.0 b/sshd_config.0
index d821a84b6..d2c5454e1 100644
--- a/sshd_config.0
+++ b/sshd_config.0
@@ -92,7 +92,7 @@ DESCRIPTION
                 aes192-ctr,aes256-ctr''
     ClientAliveCountMax
-             Sets the number of client alive messages (see above) which may be
+             Sets the number of client alive messages (see below) which may be
             sent without sshd receiving any messages back from the client.
             If this threshold is reached while client alive messages are be-
             ing sent, sshd will disconnect the client, terminating the ses-
@@ -104,9 +104,10 @@ DESCRIPTION
             able when the client or server depend on knowing when a connec-
             tion has become inactive.
-             The default value is 3.  If ClientAliveInterval (above) is set to
+             The default value is 3.  If ClientAliveInterval (see below) is
-             15, and ClientAliveCountMax is left at the default, unresponsive
+             set to 15, and ClientAliveCountMax is left at the default, unre-
-             ssh clients will be disconnected after approximately 45 seconds.
+             sponsive ssh clients will be disconnected after approximately 45
+             seconds.
     ClientAliveInterval
             Sets a timeout interval in seconds after which if no data has
@@ -198,7 +199,7 @@ DESCRIPTION
     KerberosGetAFSToken
             If AFS is active and the user has a Kerberos 5 TGT, attempt to
-             aquire an AFS token before accessing the user's home directory.
+             acquire an AFS token before accessing the user's home directory.
             Default is ``no''.
     KerberosOrLocalPasswd
@@ -295,6 +296,11 @@ DESCRIPTION
             If this option is set to ``no'' root is not allowed to log in.
+     PermitTunnel
+             Specifies whether tun(4) device forwarding is allowed.  The argu-
+             ment must be ``yes'', ``point-to-point'', ``ethernet'' or ``no''.
+             The default is ``no''.
     PermitUserEnvironment
             Specifies whether ~/.ssh/environment and environment= options in
             ~/.ssh/authorized_keys are processed by sshd.  The default is
@@ -501,4 +507,4 @@ AUTHORS
     versions 1.5 and 2.0.  Niels Provos and Markus Friedl contributed support
     for privilege separation.
-OpenBSD 3.8                   September 25, 1999                             8
+OpenBSD 3.9                   September 25, 1999                             8
diff --git a/sshd_config.5 b/sshd_config.5
index 048e8924e..71a293ffb 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -34,7 +34,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: sshd_config.5,v 1.44 2005/07/25 11:59:40 markus Exp $
+.\" $OpenBSD: sshd_config.5,v 1.48 2006/01/02 17:09:49 jmc Exp $
 .Dd September 25, 1999
 .Dt SSHD_CONFIG 5
 .Os
@@ -181,7 +181,7 @@ The default is
    aes192-ctr,aes256-ctr''
 .Ed
 .It Cm ClientAliveCountMax
-Sets the number of client alive messages (see above) which may be
+Sets the number of client alive messages (see below) which may be
 sent without
 .Nm sshd
 receiving any messages back from the client.
@@ -203,7 +203,7 @@ server depend on knowing when a connection has become inactive.
 The default value is 3.
 If
 .Cm ClientAliveInterval
-(above) is set to 15, and
+(see below) is set to 15, and
 .Cm ClientAliveCountMax
 is left at the default, unresponsive ssh clients
 will be disconnected after approximately 45 seconds.
@@ -348,7 +348,7 @@ Kerberos servtab which allows the verification of the KDC's identity.
 Default is
 .Dq no .
 .It Cm KerberosGetAFSToken
-If AFS is active and the user has a Kerberos 5 TGT, attempt to aquire
+If AFS is active and the user has a Kerberos 5 TGT, attempt to acquire
 an AFS token before accessing the user's home directory.
 Default is
 .Dq no .
@@ -502,6 +502,18 @@ All other authentication methods are disabled for root.
 If this option is set to
 .Dq no
 root is not allowed to log in.
+.It Cm PermitTunnel
+Specifies whether
+.Xr tun 4
+device forwarding is allowed.
+The argument must be
+.Dq yes ,
+.Dq point-to-point ,
+.Dq ethernet
+or
+.Dq no .
+The default is
+.Dq no .
 .It Cm PermitUserEnvironment
 Specifies whether
 .Pa ~/.ssh/environment
diff --git a/version.h b/version.h
index c4397326f..35eb49d63 100644
--- a/version.h
+++ b/version.h
@@ -1,8 +1,8 @@
-/* $OpenBSD: version.h,v 1.45 2005/08/31 09:28:42 markus Exp $ */
+/* $OpenBSD: version.h,v 1.46 2006/02/01 11:27:22 markus Exp $ */
-#define SSH_VERSION     "OpenSSH_4.2"
+#define SSH_VERSION     "OpenSSH_4.3"
-#define SSH_PORTABLE    "p1"
+#define SSH_PORTABLE    "p2"
 #ifndef SSH_EXTRAVERSION
 #define SSH_EXTRAVERSION
 #endif