16 files changed, 303 insertions, 42 deletions

diff --git a/regress/Makefile b/regress/Makefile
index 99a7d60f5..cba83f4d6 100644
--- a/regress/Makefile
+++ b/regress/Makefile
@@ -1,4 +1,4 @@
-#       $OpenBSD: Makefile,v 1.78 2015/01/26 06:12:18 djm Exp $
+#       $OpenBSD: Makefile,v 1.81 2015/05/21 06:44:25 djm Exp $
 
 REGRESS_TARGETS=        unit t1 t2 t3 t4 t5 t6 t7 t8 t9 t10 t11 t12 t-exec
 tests:          prep $(REGRESS_TARGETS)
@@ -54,6 +54,7 @@ LTESTS= 	connect \
                 multiplex \
                 reexec \
                 brokenkeys \
+                cfgparse \
                 cfgmatch \
                 addrmatch \
                 localcommand \
@@ -72,7 +73,8 @@ LTESTS= 	connect \
                 limit-keytype \
                 hostkey-agent \
                 keygen-knownhosts \
-                hostkey-rotate
+                hostkey-rotate \
+                principals-command
 
 
 #               dhgex \
@@ -180,10 +182,10 @@ t11:
         ${TEST_SSH_SSHKEYGEN} -E sha256 -lf ${.CURDIR}/rsa_openssh.pub |\
                 awk '{print $$2}' | diff - ${.CURDIR}/t11.ok
 
-t12.out:
-        ${TEST_SSH_SSHKEYGEN} -q -t ed25519 -N '' -C 'test-comment-1234' -f $(OBJ)/$@
+$(OBJ)/t12.out:
+        ${TEST_SSH_SSHKEYGEN} -q -t ed25519 -N '' -C 'test-comment-1234' -f $@
 
-t12: t12.out
+t12: $(OBJ)/t12.out
         ${TEST_SSH_SSHKEYGEN} -lf $(OBJ)/t12.out.pub | grep test-comment-1234 >/dev/null
 
 t-exec: ${LTESTS:=.sh}
diff --git a/regress/README.regress b/regress/README.regress
index 82e4cc751..9b99bdacb 100644
--- a/regress/README.regress
+++ b/regress/README.regress
@@ -31,7 +31,7 @@ TEST_SHELL: shell used for running the test scripts.
 TEST_SSH_PORT: TCP port to be used for the listening tests.
 TEST_SSH_SSH_CONFOPTS: Configuration directives to be added to ssh_config
         before running each test.
-TEST_SSH_SSHD_CONFOTPS: Configuration directives to be added to sshd_config
+TEST_SSH_SSHD_CONFOPTS: Configuration directives to be added to sshd_config
         before running each test.
 
 
diff --git a/regress/cfgparse.sh b/regress/cfgparse.sh
new file mode 100644
index 000000000..736f38976
--- /dev/null
+++ b/regress/cfgparse.sh
@@ -0,0 +1,75 @@
+#       $OpenBSD: cfgparse.sh,v 1.5 2015/05/29 03:05:13 djm Exp $
+#       Placed in the Public Domain.
+
+tid="config parse"
+
+# This is a reasonable proxy for IPv6 support.
+if ! config_defined HAVE_STRUCT_IN6_ADDR ; then
+        SKIP_IPV6=yes
+fi
+
+# We need to use the keys generated for the regression test because sshd -T
+# will fail if we're not running with SUDO (no permissions for real keys) or
+# if we are # running tests on a system that has never had sshd installed
+# (keys won't exist).
+
+grep "HostKey " $OBJ/sshd_config > $OBJ/sshd_config_minimal
+SSHD_KEYS="`cat $OBJ/sshd_config_minimal`"
+
+verbose "reparse minimal config"
+($SUDO ${SSHD} -T -f $OBJ/sshd_config_minimal >$OBJ/sshd_config.1 &&
+ $SUDO ${SSHD} -T -f $OBJ/sshd_config.1 >$OBJ/sshd_config.2 &&
+ diff $OBJ/sshd_config.1 $OBJ/sshd_config.2) || fail "reparse minimal config"
+
+verbose "reparse regress config"
+($SUDO ${SSHD} -T -f $OBJ/sshd_config >$OBJ/sshd_config.1 &&
+ $SUDO ${SSHD} -T -f $OBJ/sshd_config.1 >$OBJ/sshd_config.2 &&
+ diff $OBJ/sshd_config.1 $OBJ/sshd_config.2) || fail "reparse regress config"
+
+verbose "listenaddress order"
+# expected output
+cat > $OBJ/sshd_config.0 <<EOD
+listenaddress 1.2.3.4:1234
+listenaddress 1.2.3.4:5678
+EOD
+[ X${SKIP_IPV6} = Xyes ] || cat >> $OBJ/sshd_config.0 <<EOD
+listenaddress [::1]:1234
+listenaddress [::1]:5678
+EOD
+
+# test input sets.  should all result in the output above.
+# test 1: addressfamily and port first
+cat > $OBJ/sshd_config.1 <<EOD
+${SSHD_KEYS}
+addressfamily any
+port 1234
+port 5678
+listenaddress 1.2.3.4
+EOD
+[ X${SKIP_IPV6} = Xyes ] || cat >> $OBJ/sshd_config.1 <<EOD
+listenaddress ::1
+EOD
+
+($SUDO ${SSHD} -T -f $OBJ/sshd_config.1 | \
+ grep 'listenaddress ' >$OBJ/sshd_config.2 &&
+ diff $OBJ/sshd_config.0 $OBJ/sshd_config.2) || \
+ fail "listenaddress order 1"
+# test 2: listenaddress first
+cat > $OBJ/sshd_config.1 <<EOD
+${SSHD_KEYS}
+listenaddress 1.2.3.4
+port 1234
+port 5678
+addressfamily any
+EOD
+[ X${SKIP_IPV6} = Xyes ] || cat >> $OBJ/sshd_config.1 <<EOD
+listenaddress ::1
+EOD
+
+($SUDO ${SSHD} -T -f $OBJ/sshd_config.1 | \
+ grep 'listenaddress ' >$OBJ/sshd_config.2 &&
+ diff $OBJ/sshd_config.0 $OBJ/sshd_config.2) || \
+ fail "listenaddress order 2"
+
+# cleanup
+rm -f $OBJ/sshd_config.[012]
diff --git a/regress/cipher-speed.sh b/regress/cipher-speed.sh
index ad2f9b90b..575dc2341 100644
--- a/regress/cipher-speed.sh
+++ b/regress/cipher-speed.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: cipher-speed.sh,v 1.12 2015/03/03 22:35:19 markus Exp $
+#       $OpenBSD: cipher-speed.sh,v 1.13 2015/03/24 20:22:17 markus Exp $
 #       Placed in the Public Domain.
 
 tid="cipher speed"
@@ -25,7 +25,7 @@ for c in `${SSH} -Q cipher`; do n=0; for m in `${SSH} -Q mac`; do
                 fi
         done
         # No point trying all MACs for AEAD ciphers since they are ignored.
-        if ssh -Q cipher-auth | grep "^${c}\$" >/dev/null 2>&1 ; then
+        if ${SSH} -Q cipher-auth | grep "^${c}\$" >/dev/null 2>&1 ; then
                 break
         fi
         n=`expr $n + 1`
diff --git a/regress/hostkey-rotate.sh b/regress/hostkey-rotate.sh
index b5d542d12..cde6008f4 100644
--- a/regress/hostkey-rotate.sh
+++ b/regress/hostkey-rotate.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: hostkey-rotate.sh,v 1.2 2015/03/03 17:53:40 djm Exp $
+#       $OpenBSD: hostkey-rotate.sh,v 1.3 2015/03/24 20:22:17 markus Exp $
 #       Placed in the Public Domain.
 
 tid="hostkey rotate"
@@ -15,7 +15,7 @@ rm $OBJ/known_hosts
 trace "prepare hostkeys"
 nkeys=0
 all_algs=""
-for k in `ssh -Q key-plain` ; do
+for k in `${SSH} -Q key-plain` ; do
         ${SSHKEYGEN} -qt $k -f $OBJ/hkr.$k -N '' || fatal "ssh-keygen $k"
         echo "Hostkey $OBJ/hkr.${k}" >> $OBJ/sshd_proxy.orig
         nkeys=`expr $nkeys + 1`
@@ -62,7 +62,7 @@ expect_nkeys $nkeys "learn hostkeys"
 check_key_present ssh-rsa || fail "didn't learn keys"
 
 # Check each key type
-for k in `ssh -Q key-plain` ; do
+for k in `${SSH} -Q key-plain` ; do
         verbose "learn additional hostkeys, type=$k"
         dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=$k,$all_algs
         expect_nkeys $nkeys "learn hostkeys $k"
@@ -109,7 +109,7 @@ dossh -oStrictHostKeyChecking=yes -oHostKeyAlgorithms=ssh-rsa
 expect_nkeys 1 "learn hostkeys"
 check_key_present ssh-rsa || fail "didn't learn changed key"
 
-#       $OpenBSD: hostkey-rotate.sh,v 1.2 2015/03/03 17:53:40 djm Exp $
+#       $OpenBSD: hostkey-rotate.sh,v 1.3 2015/03/24 20:22:17 markus Exp $
 #       Placed in the Public Domain.
 
 tid="hostkey rotate"
diff --git a/regress/integrity.sh b/regress/integrity.sh
index 2ff8b3f17..1d4976771 100644
--- a/regress/integrity.sh
+++ b/regress/integrity.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: integrity.sh,v 1.15 2015/01/19 20:42:31 markus Exp $
+#       $OpenBSD: integrity.sh,v 1.16 2015/03/24 20:22:17 markus Exp $
 #       Placed in the Public Domain.
 
 tid="integrity"
@@ -38,7 +38,7 @@ for m in $macs; do
                 cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
                 # modify output from sshd at offset $off
                 pxy="proxycommand=$cmd | $OBJ/modpipe -wm xor:$off:1"
-                if ssh -Q cipher-auth | grep "^${m}\$" >/dev/null 2>&1 ; then
+                if ${SSH} -Q cipher-auth | grep "^${m}\$" >/dev/null 2>&1 ; then
                         echo "Ciphers=$m" >> $OBJ/sshd_proxy
                         macopt="-c $m"
                 else
diff --git a/regress/kextype.sh b/regress/kextype.sh
index 6f952f4e4..e27189904 100644
--- a/regress/kextype.sh
+++ b/regress/kextype.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: kextype.sh,v 1.5 2014/04/21 22:15:37 djm Exp $
+#       $OpenBSD: kextype.sh,v 1.6 2015/03/24 20:19:15 markus Exp $
 #       Placed in the Public Domain.
 
 tid="login with different key exchange algorithms"
@@ -8,7 +8,7 @@ cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
 cp $OBJ/ssh_proxy $OBJ/ssh_proxy_bak
 
 # Make server accept all key exchanges.
-ALLKEX=`ssh -Q kex`
+ALLKEX=`${SSH} -Q kex`
 KEXOPT=`echo $ALLKEX | tr ' ' ,`
 echo "KexAlgorithms=$KEXOPT" >> $OBJ/sshd_proxy
 
diff --git a/regress/keys-command.sh b/regress/keys-command.sh
index b595a434f..700273b66 100644
--- a/regress/keys-command.sh
+++ b/regress/keys-command.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: keys-command.sh,v 1.2 2012/12/06 06:06:54 dtucker Exp $
+#       $OpenBSD: keys-command.sh,v 1.3 2015/05/21 06:40:02 djm Exp $
 #       Placed in the Public Domain.
 
 tid="authorized keys from command"
@@ -9,26 +9,63 @@ if test -z "$SUDO" ; then
         exit 0
 fi
 
+rm -f $OBJ/keys-command-args
+
+touch $OBJ/keys-command-args
+chmod a+rw $OBJ/keys-command-args
+
+expected_key_text=`awk '{ print $2 }' < $OBJ/rsa.pub`
+expected_key_fp=`$SSHKEYGEN -lf $OBJ/rsa.pub | awk '{ print $2 }'`
+
 # Establish a AuthorizedKeysCommand in /var/run where it will have
 # acceptable directory permissions.
 KEY_COMMAND="/var/run/keycommand_${LOGNAME}"
-cat << _EOF | $SUDO sh -c "cat > '$KEY_COMMAND'"
+cat << _EOF | $SUDO sh -c "rm -f '$KEY_COMMAND' ; cat > '$KEY_COMMAND'"
 #!/bin/sh
+echo args: "\$@" >> $OBJ/keys-command-args
+echo "$PATH" | grep -q mekmitasdigoat && exit 7
 test "x\$1" != "x${LOGNAME}" && exit 1
+if test $# -eq 6 ; then
+        test "x\$2" != "xblah" && exit 2
+        test "x\$3" != "x${expected_key_text}" && exit 3
+        test "x\$4" != "xssh-rsa" && exit 4
+        test "x\$5" != "x${expected_key_fp}" && exit 5
+        test "x\$6" != "xblah" && exit 6
+fi
 exec cat "$OBJ/authorized_keys_${LOGNAME}"
 _EOF
 $SUDO chmod 0755 "$KEY_COMMAND"
 
-cp $OBJ/sshd_proxy $OBJ/sshd_proxy.bak
-(
-        grep -vi AuthorizedKeysFile $OBJ/sshd_proxy.bak
-        echo AuthorizedKeysFile none
-        echo AuthorizedKeysCommand $KEY_COMMAND
-        echo AuthorizedKeysCommandUser ${LOGNAME}
-) > $OBJ/sshd_proxy
-
 if [ -x $KEY_COMMAND ]; then
-        ${SSH} -F $OBJ/ssh_proxy somehost true
+        cp $OBJ/sshd_proxy $OBJ/sshd_proxy.bak
+
+        verbose "AuthorizedKeysCommand with arguments"
+        (
+                grep -vi AuthorizedKeysFile $OBJ/sshd_proxy.bak
+                echo AuthorizedKeysFile none
+                echo AuthorizedKeysCommand $KEY_COMMAND %u blah %k %t %f blah
+                echo AuthorizedKeysCommandUser ${LOGNAME}
+        ) > $OBJ/sshd_proxy
+
+        # Ensure that $PATH is sanitised in sshd
+        env PATH=$PATH:/sbin/mekmitasdigoat \
+            ${SSH} -F $OBJ/ssh_proxy somehost true
+        if [ $? -ne 0 ]; then
+                fail "connect failed"
+        fi
+
+        verbose "AuthorizedKeysCommand without arguments"
+        # Check legacy behavior of no-args resulting in username being passed.
+        (
+                grep -vi AuthorizedKeysFile $OBJ/sshd_proxy.bak
+                echo AuthorizedKeysFile none
+                echo AuthorizedKeysCommand $KEY_COMMAND
+                echo AuthorizedKeysCommandUser ${LOGNAME}
+        ) > $OBJ/sshd_proxy
+
+        # Ensure that $PATH is sanitised in sshd
+        env PATH=$PATH:/sbin/mekmitasdigoat \
+            ${SSH} -F $OBJ/ssh_proxy somehost true
         if [ $? -ne 0 ]; then
                 fail "connect failed"
         fi
diff --git a/regress/netcat.c b/regress/netcat.c
index 1a9fc8730..6234ba019 100644
--- a/regress/netcat.c
+++ b/regress/netcat.c
@@ -42,7 +42,6 @@
 #include <netinet/in.h>
 #include <netinet/tcp.h>
 #include <netinet/ip.h>
-#include <arpa/telnet.h>
 
 #include <errno.h>
 #include <netdb.h>
@@ -63,6 +62,13 @@
 # endif
 #endif
 
+/* Telnet options from arpa/telnet.h */
+#define IAC     255
+#define DONT    254
+#define DO      253
+#define WONT    252
+#define WILL    251
+
 #ifndef SUN_LEN
 #define SUN_LEN(su) \
         (sizeof(*(su)) - sizeof((su)->sun_path) + strlen((su)->sun_path))
diff --git a/regress/principals-command.sh b/regress/principals-command.sh
new file mode 100644
index 000000000..90064373d
--- /dev/null
+++ b/regress/principals-command.sh
@@ -0,0 +1,141 @@
+#       $OpenBSD: principals-command.sh,v 1.1 2015/05/21 06:44:25 djm Exp $
+#       Placed in the Public Domain.
+
+tid="authorized principals command"
+
+rm -f $OBJ/user_ca_key* $OBJ/cert_user_key*
+cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
+
+if test -z "$SUDO" ; then
+        echo "skipped (SUDO not set)"
+        echo "need SUDO to create file in /var/run, test won't work without"
+        exit 0
+fi
+
+# Establish a AuthorizedPrincipalsCommand in /var/run where it will have
+# acceptable directory permissions.
+PRINCIPALS_COMMAND="/var/run/principals_command_${LOGNAME}"
+cat << _EOF | $SUDO sh -c "cat > '$PRINCIPALS_COMMAND'"
+#!/bin/sh
+test "x\$1" != "x${LOGNAME}" && exit 1
+test -f "$OBJ/authorized_principals_${LOGNAME}" &&
+        exec cat "$OBJ/authorized_principals_${LOGNAME}"
+_EOF
+test $? -eq 0 || fatal "couldn't prepare principals command"
+$SUDO chmod 0755 "$PRINCIPALS_COMMAND"
+
+# Create a CA key and a user certificate.
+${SSHKEYGEN} -q -N '' -t ed25519  -f $OBJ/user_ca_key || \
+        fatal "ssh-keygen of user_ca_key failed"
+${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/cert_user_key || \
+        fatal "ssh-keygen of cert_user_key failed"
+${SSHKEYGEN} -q -s $OBJ/user_ca_key -I "regress user key for $USER" \
+    -z $$ -n ${USER},mekmitasdigoat $OBJ/cert_user_key || \
+        fatal "couldn't sign cert_user_key"
+
+# Test explicitly-specified principals
+for privsep in yes no ; do
+        _prefix="privsep $privsep"
+
+        # Setup for AuthorizedPrincipalsCommand
+        rm -f $OBJ/authorized_keys_$USER
+        (
+                cat $OBJ/sshd_proxy_bak
+                echo "UsePrivilegeSeparation $privsep"
+                echo "AuthorizedKeysFile none"
+                echo "AuthorizedPrincipalsCommand $PRINCIPALS_COMMAND %u"
+                echo "AuthorizedPrincipalsCommandUser ${LOGNAME}"
+                echo "TrustedUserCAKeys $OBJ/user_ca_key.pub"
+        ) > $OBJ/sshd_proxy
+
+        # XXX test missing command
+        # XXX test failing command
+
+        # Empty authorized_principals
+        verbose "$tid: ${_prefix} empty authorized_principals"
+        echo > $OBJ/authorized_principals_$USER
+        ${SSH} -2i $OBJ/cert_user_key \
+            -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
+        if [ $? -eq 0 ]; then
+                fail "ssh cert connect succeeded unexpectedly"
+        fi
+
+        # Wrong authorized_principals
+        verbose "$tid: ${_prefix} wrong authorized_principals"
+        echo gregorsamsa > $OBJ/authorized_principals_$USER
+        ${SSH} -2i $OBJ/cert_user_key \
+            -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
+        if [ $? -eq 0 ]; then
+                fail "ssh cert connect succeeded unexpectedly"
+        fi
+
+        # Correct authorized_principals
+        verbose "$tid: ${_prefix} correct authorized_principals"
+        echo mekmitasdigoat > $OBJ/authorized_principals_$USER
+        ${SSH} -2i $OBJ/cert_user_key \
+            -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
+        if [ $? -ne 0 ]; then
+                fail "ssh cert connect failed"
+        fi
+
+        # authorized_principals with bad key option
+        verbose "$tid: ${_prefix} authorized_principals bad key opt"
+        echo 'blah mekmitasdigoat' > $OBJ/authorized_principals_$USER
+        ${SSH} -2i $OBJ/cert_user_key \
+            -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
+        if [ $? -eq 0 ]; then
+                fail "ssh cert connect succeeded unexpectedly"
+        fi
+
+        # authorized_principals with command=false
+        verbose "$tid: ${_prefix} authorized_principals command=false"
+        echo 'command="false" mekmitasdigoat' > \
+            $OBJ/authorized_principals_$USER
+        ${SSH} -2i $OBJ/cert_user_key \
+            -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
+        if [ $? -eq 0 ]; then
+                fail "ssh cert connect succeeded unexpectedly"
+        fi
+
+
+        # authorized_principals with command=true
+        verbose "$tid: ${_prefix} authorized_principals command=true"
+        echo 'command="true" mekmitasdigoat' > \
+            $OBJ/authorized_principals_$USER
+        ${SSH} -2i $OBJ/cert_user_key \
+            -F $OBJ/ssh_proxy somehost false >/dev/null 2>&1
+        if [ $? -ne 0 ]; then
+                fail "ssh cert connect failed"
+        fi
+
+        # Setup for principals= key option
+        rm -f $OBJ/authorized_principals_$USER
+        (
+                cat $OBJ/sshd_proxy_bak
+                echo "UsePrivilegeSeparation $privsep"
+        ) > $OBJ/sshd_proxy
+
+        # Wrong principals list
+        verbose "$tid: ${_prefix} wrong principals key option"
+        (
+                printf 'cert-authority,principals="gregorsamsa" '
+                cat $OBJ/user_ca_key.pub
+        ) > $OBJ/authorized_keys_$USER
+        ${SSH} -2i $OBJ/cert_user_key \
+            -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
+        if [ $? -eq 0 ]; then
+                fail "ssh cert connect succeeded unexpectedly"
+        fi
+
+        # Correct principals list
+        verbose "$tid: ${_prefix} correct principals key option"
+        (
+                printf 'cert-authority,principals="mekmitasdigoat" '
+                cat $OBJ/user_ca_key.pub
+        ) > $OBJ/authorized_keys_$USER
+        ${SSH} -2i $OBJ/cert_user_key \
+            -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
+        if [ $? -ne 0 ]; then
+                fail "ssh cert connect failed"
+        fi
+done
diff --git a/regress/ssh-com.sh b/regress/ssh-com.sh
index 6c5cfe888..4371d5279 100644
--- a/regress/ssh-com.sh
+++ b/regress/ssh-com.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: ssh-com.sh,v 1.8 2013/05/17 00:37:40 dtucker Exp $
+#       $OpenBSD: ssh-com.sh,v 1.9 2015/05/08 07:29:00 djm Exp $
 #       Placed in the Public Domain.
 
 tid="connect to ssh.com server"
@@ -44,14 +44,14 @@ cat << EOF > $OBJ/sshd2_config
         HostKeyFile                     ${SRC}/dsa_ssh2.prv
         PublicHostKeyFile               ${SRC}/dsa_ssh2.pub
         RandomSeedFile                  ${OBJ}/random_seed
-        MaxConnections                  0 
+        MaxConnections                  0
         PermitRootLogin                 yes
         VerboseMode                     no
         CheckMail                       no
         Ssh1Compatibility               no
 EOF
 
-# create client config 
+# create client config
 sed "s/HostKeyAlias.*/HostKeyAlias ssh2-localhost-with-alias/" \
         < $OBJ/ssh_config > $OBJ/ssh_config_com
 
diff --git a/regress/ssh2putty.sh b/regress/ssh2putty.sh
index 691db1690..bcf83afe9 100755
--- a/regress/ssh2putty.sh
+++ b/regress/ssh2putty.sh
@@ -1,5 +1,5 @@
 #!/bin/sh
-#       $OpenBSD: ssh2putty.sh,v 1.2 2009/10/06 23:51:49 dtucker Exp $
+#       $OpenBSD: ssh2putty.sh,v 1.3 2015/05/08 07:26:13 djm Exp $
 
 if test "x$1" = "x" -o "x$2" = "x" -o "x$3" = "x" ; then
         echo "Usage: ssh2putty hostname port ssh-private-key"
@@ -19,13 +19,13 @@ else
 fi
 
 public_exponent=`
-        openssl rsa -noout -text -in $KEYFILE | grep ^publicExponent | 
+        openssl rsa -noout -text -in $KEYFILE | grep ^publicExponent |
         sed 's/.*(//;s/).*//'
 `
 test $? -ne 0 && exit 1
 
 modulus=`
-        openssl rsa -noout -modulus -in $KEYFILE | grep ^Modulus= | 
+        openssl rsa -noout -modulus -in $KEYFILE | grep ^Modulus= |
         sed 's/^Modulus=/0x/' | tr A-Z a-z
 `
 test $? -ne 0 && exit 1
diff --git a/regress/test-exec.sh b/regress/test-exec.sh
index 0f766620d..114e129f2 100644
--- a/regress/test-exec.sh
+++ b/regress/test-exec.sh
@@ -444,7 +444,7 @@ Host *
 EOF
 
 if [ ! -z "$TEST_SSH_SSH_CONFOPTS" ]; then
-        trace "adding ssh_config option $TEST_SSH_SSHD_CONFOPTS"
+        trace "adding ssh_config option $TEST_SSH_SSH_CONFOPTS"
         echo "$TEST_SSH_SSH_CONFOPTS" >> $OBJ/ssh_config
 fi
 
diff --git a/regress/try-ciphers.sh b/regress/try-ciphers.sh
index 4165c7b88..889a735d2 100644
--- a/regress/try-ciphers.sh
+++ b/regress/try-ciphers.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: try-ciphers.sh,v 1.24 2015/03/03 22:35:19 markus Exp $
+#       $OpenBSD: try-ciphers.sh,v 1.25 2015/03/24 20:22:17 markus Exp $
 #       Placed in the Public Domain.
 
 tid="try ciphers"
@@ -19,7 +19,7 @@ for c in `${SSH} -Q cipher`; do
                 fi
                 # No point trying all MACs for AEAD ciphers since they
                 # are ignored.
-                if ssh -Q cipher-auth | grep "^${c}\$" >/dev/null 2>&1 ; then
+                if ${SSH} -Q cipher-auth | grep "^${c}\$" >/dev/null 2>&1 ; then
                         break
                 fi
                 n=`expr $n + 1`
diff --git a/regress/unittests/hostkeys/test_iterate.c b/regress/unittests/hostkeys/test_iterate.c
index d81291b68..2eaaf063a 100644
--- a/regress/unittests/hostkeys/test_iterate.c
+++ b/regress/unittests/hostkeys/test_iterate.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: test_iterate.c,v 1.3 2015/03/07 04:41:48 djm Exp $ */
+/*      $OpenBSD: test_iterate.c,v 1.4 2015/03/31 22:59:01 djm Exp $ */
 /*
  * Regress test for hostfile.h hostkeys_foreach()
  *
@@ -91,8 +91,8 @@ check(struct hostkey_foreach_line *l, void *_ctx)
             expected->l.keytype : expected->no_parse_keytype;
 
 #ifndef WITH_SSH1
-        if (expected->l.keytype == KEY_RSA1 ||
-            expected->no_parse_keytype == KEY_RSA1) {
+        if (parse_key && (expected->l.keytype == KEY_RSA1 ||
+            expected->no_parse_keytype == KEY_RSA1)) {
                 expected_status = HKF_STATUS_INVALID;
                 expected_keytype = KEY_UNSPEC;
                 parse_key = 0;
diff --git a/regress/unittests/sshkey/test_sshkey.c b/regress/unittests/sshkey/test_sshkey.c
index ad10c9be2..4453a8599 100644
--- a/regress/unittests/sshkey/test_sshkey.c
+++ b/regress/unittests/sshkey/test_sshkey.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: test_sshkey.c,v 1.3 2015/01/26 06:11:28 djm Exp $ */
+/*      $OpenBSD: test_sshkey.c,v 1.4 2015/04/22 01:38:36 djm Exp $ */
 /*
  * Regress test for sshkey.h key management API
  *
@@ -505,7 +505,7 @@ sshkey_tests(void)
         ASSERT_INT_EQ(sshkey_load_cert(test_data_file("rsa_1"), &k1), 0);
         ASSERT_INT_EQ(sshkey_load_public(test_data_file("rsa_1.pub"), &k2,
             NULL), 0);
-        k3 = get_private("ed25519_2");
+        k3 = get_private("rsa_1");
         build_cert(b, k2, "ssh-rsa-cert-v01@openssh.com", k3, k1);
         ASSERT_INT_EQ(sshkey_from_blob(sshbuf_ptr(b), sshbuf_len(b), &k4),
             SSH_ERR_KEY_CERT_INVALID_SIGN_KEY);