19 files changed, 638 insertions, 82 deletions

diff --git a/regress/Makefile b/regress/Makefile
index 3b8ea245b..d25a64555 100644
--- a/regress/Makefile
+++ b/regress/Makefile
@@ -1,4 +1,4 @@
-#       $OpenBSD: Makefile,v 1.48 2008/06/28 13:57:25 djm Exp $
+#       $OpenBSD: Makefile,v 1.52 2010/02/26 20:33:21 djm Exp $
 
 REGRESS_TARGETS=        t1 t2 t3 t4 t5 t6 t7 t-exec
 tests:          $(REGRESS_TARGETS)
@@ -34,6 +34,7 @@ LTESTS= 	connect \
                 agent-ptrace \
                 keyscan \
                 keygen-change \
+                keygen-convert \
                 key-options \
                 scp \
                 sftp \
@@ -50,7 +51,10 @@ LTESTS= 	connect \
                 cfgmatch \
                 addrmatch \
                 localcommand \
-                forcecommand
+                forcecommand \
+                portnum \
+                cert-hostkey \
+                cert-userkey
 
 INTEROP_TESTS=  putty-transfer putty-ciphers putty-kex conch-ciphers
 #INTEROP_TESTS+=ssh-com ssh-com-client ssh-com-keygen ssh-com-sftp
@@ -64,7 +68,11 @@ CLEANFILES=	t2.out t6.out1 t6.out2 t7.out t7.out.pub copy.1 copy.2 \
                 ls.copy banner.in banner.out empty.in \
                 scp-ssh-wrapper.scp ssh_proxy_envpass remote_pid \
                 sshd_proxy_bak rsa_ssh2_cr.prv rsa_ssh2_crnl.prv \
-                putty.rsa2
+                known_hosts-cert host_ca_key* cert_host_key* \
+                putty.rsa2 sshd_proxy_orig
+
+# Enable all malloc(3) randomisations and checks
+TEST_ENV=      "MALLOC_OPTIONS=AFGJPRX"
 
 t1:
         ssh-keygen -if ${.CURDIR}/rsa_ssh2.prv | diff - ${.CURDIR}/rsa_openssh.prv
@@ -104,13 +112,13 @@ t-exec:	${LTESTS:=.sh}
         @if [ "x$?" = "x" ]; then exit 0; fi; \
         for TEST in ""$?; do \
                 echo "run test $${TEST}" ... 1>&2; \
-                (env SUDO=${SUDO} sh ${.CURDIR}/test-exec.sh ${.OBJDIR} ${.CURDIR}/$${TEST}) || exit $$?; \
+                (env SUDO=${SUDO} TEST_ENV=${TEST_ENV} sh ${.CURDIR}/test-exec.sh ${.OBJDIR} ${.CURDIR}/$${TEST}) || exit $$?; \
         done
 
 t-exec-interop: ${INTEROP_TESTS:=.sh}
         @if [ "x$?" = "x" ]; then exit 0; fi; \
         for TEST in ""$?; do \
                 echo "run test $${TEST}" ... 1>&2; \
-                (env SUDO=${SUDO} sh ${.CURDIR}/test-exec.sh ${.OBJDIR} ${.CURDIR}/$${TEST}) || exit $$?; \
+                (env SUDO=${SUDO} TEST_ENV=${TEST_ENV} sh ${.CURDIR}/test-exec.sh ${.OBJDIR} ${.CURDIR}/$${TEST}) || exit $$?; \
         done
 
diff --git a/regress/addrmatch.sh b/regress/addrmatch.sh
index a258f7bb4..23ddd65ce 100644
--- a/regress/addrmatch.sh
+++ b/regress/addrmatch.sh
@@ -1,9 +1,9 @@
-#       $OpenBSD: addrmatch.sh,v 1.1 2008/06/10 05:23:32 dtucker Exp $
+#       $OpenBSD: addrmatch.sh,v 1.3 2010/02/09 04:57:36 djm Exp $
 #       Placed in the Public Domain.
 
 tid="address match"
 
-mv $OBJ/sshd_proxy $OBJ/sshd_proxy_orig
+mv $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
 
 run_trial()
 {
@@ -12,13 +12,13 @@ run_trial()
         verbose "test $descr for $user $addr $host"
         result=`${SSHD} -f $OBJ/sshd_proxy -T \
             -C user=${user},addr=${addr},host=${host} | \
-            awk '/passwordauthentication/ {print $2}'`
+            awk '/^passwordauthentication/ {print $2}'`
         if [ "$result" != "$expected" ]; then
                 fail "failed for $user $addr $host: expected $expected, got $result"
         fi
 }
 
-cp $OBJ/sshd_proxy_orig $OBJ/sshd_proxy
+cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
 cat >>$OBJ/sshd_proxy <<EOD
 PasswordAuthentication no
 Match Address 192.168.0.0/16,!192.168.30.0/24,10.0.0.0/8,host.example.com
@@ -40,3 +40,6 @@ run_trial user ::3 somehost no			"deny IP6 negated"
 run_trial user ::4 somehost no                  "deny, IP6 no match"
 run_trial user 2000::1 somehost yes             "permit, IP6 network"
 run_trial user 2001::1 somehost no              "deny, IP6 network"
+
+cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy
+rm $OBJ/sshd_proxy_bak
diff --git a/regress/agent-pkcs11.sh b/regress/agent-pkcs11.sh
new file mode 100644
index 000000000..db33ab37e
--- /dev/null
+++ b/regress/agent-pkcs11.sh
@@ -0,0 +1,69 @@
+#       $OpenBSD: agent-pkcs11.sh,v 1.1 2010/02/08 10:52:47 markus Exp $
+#       Placed in the Public Domain.
+
+tid="pkcs11 agent test"
+
+TEST_SSH_PIN=""
+TEST_SSH_PKCS11=/usr/local/lib/soft-pkcs11.so.0.0
+
+# setup environment for soft-pkcs11 token
+SOFTPKCS11RC=$OBJ/pkcs11.info
+export SOFTPKCS11RC
+# prevent ssh-agent from calling ssh-askpass
+SSH_ASKPASS=/usr/bin/true
+export SSH_ASKPASS
+unset DISPLAY
+
+# start command w/o tty, so ssh-add accepts pin from stdin
+notty() {
+        perl -e 'use POSIX; POSIX::setsid(); 
+            if (fork) { wait; exit($? >> 8); } else { exec(@ARGV) }' "$@"
+}
+
+trace "start agent"
+eval `${SSHAGENT} -s` > /dev/null
+r=$?
+if [ $r -ne 0 ]; then
+        fail "could not start ssh-agent: exit code $r"
+else
+        trace "generating key/cert"
+        rm -f $OBJ/pkcs11.key $OBJ/pkcs11.crt
+        openssl genrsa -out $OBJ/pkcs11.key 2048 > /dev/null 2>&1
+        chmod 600 $OBJ/pkcs11.key 
+        openssl req -key $OBJ/pkcs11.key -new -x509 \
+            -out $OBJ/pkcs11.crt -text -subj '/CN=pkcs11 test' > /dev/null
+        printf "a\ta\t$OBJ/pkcs11.crt\t$OBJ/pkcs11.key" > $SOFTPKCS11RC
+        # add to authorized keys
+        ${SSHKEYGEN} -y -f $OBJ/pkcs11.key > $OBJ/authorized_keys_$USER
+
+        trace "add pkcs11 key to agent"
+        echo ${TEST_SSH_PIN} | notty ${SSHADD} -s ${TEST_SSH_PKCS11} > /dev/null 2>&1
+        r=$?
+        if [ $r -ne 0 ]; then
+                fail "ssh-add -s failed: exit code $r"
+        fi
+
+        trace "pkcs11 list via agent"
+        ${SSHADD} -l > /dev/null 2>&1
+        r=$?
+        if [ $r -ne 0 ]; then
+                fail "ssh-add -l failed: exit code $r"
+        fi
+
+        trace "pkcs11 connect via agent"
+        ${SSH} -2 -F $OBJ/ssh_proxy somehost exit 5
+        r=$?
+        if [ $r -ne 5 ]; then
+                fail "ssh connect failed (exit code $r)"
+        fi
+
+        trace "remove pkcs11 keys"
+        echo ${TEST_SSH_PIN} | notty ${SSHADD} -e ${TEST_SSH_PKCS11} > /dev/null 2>&1
+        r=$?
+        if [ $r -ne 0 ]; then
+                fail "ssh-add -e failed: exit code $r"
+        fi
+
+        trace "kill agent"
+        ${SSHAGENT} -k > /dev/null
+fi
diff --git a/regress/cert-hostkey.sh b/regress/cert-hostkey.sh
new file mode 100644
index 000000000..3fda667cb
--- /dev/null
+++ b/regress/cert-hostkey.sh
@@ -0,0 +1,211 @@
+#       $OpenBSD: cert-hostkey.sh,v 1.3 2010/03/04 10:38:23 djm Exp $
+#       Placed in the Public Domain.
+
+tid="certified host keys"
+
+rm -f $OBJ/known_hosts-cert $OBJ/host_ca_key* $OBJ/cert_host_key*
+cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
+
+HOSTS='localhost-with-alias,127.0.0.1,::1'
+
+# Create a CA key and add it to known hosts
+${SSHKEYGEN} -q -N '' -t rsa  -f $OBJ/host_ca_key ||\
+        fail "ssh-keygen of host_ca_key failed"
+(
+        echon '@cert-authority '
+        echon "$HOSTS "
+        cat $OBJ/host_ca_key.pub
+) > $OBJ/known_hosts-cert
+
+# Generate and sign host keys
+for ktype in rsa dsa ; do 
+        verbose "$tid: sign host ${ktype} cert"
+        # Generate and sign a host key
+        ${SSHKEYGEN} -q -N '' -t ${ktype} \
+            -f $OBJ/cert_host_key_${ktype} || \
+                fail "ssh-keygen of cert_host_key_${ktype} failed"
+        ${SSHKEYGEN} -h -q -s $OBJ/host_ca_key \
+            -I "regress host key for $USER" \
+            -n $HOSTS $OBJ/cert_host_key_${ktype} ||
+                fail "couldn't sign cert_host_key_${ktype}"
+done
+
+# Basic connect tests
+for privsep in yes no ; do
+        for ktype in rsa dsa ; do 
+                verbose "$tid: host ${ktype} cert connect privsep $privsep"
+                (
+                        cat $OBJ/sshd_proxy_bak
+                        echo HostKey $OBJ/cert_host_key_${ktype}
+                        echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
+                        echo UsePrivilegeSeparation $privsep
+                ) > $OBJ/sshd_proxy
+
+                ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
+                    -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
+                        -F $OBJ/ssh_proxy somehost true
+                if [ $? -ne 0 ]; then
+                        fail "ssh cert connect failed"
+                fi
+        done
+done
+
+# Revoked certificates with key present
+(
+        echon '@cert-authority '
+        echon "$HOSTS "
+        cat $OBJ/host_ca_key.pub
+        echon '@revoked '
+        echon "* "
+        cat $OBJ/cert_host_key_rsa.pub
+        echon '@revoked '
+        echon "* "
+        cat $OBJ/cert_host_key_dsa.pub
+) > $OBJ/known_hosts-cert
+for privsep in yes no ; do
+        for ktype in rsa dsa ; do 
+                verbose "$tid: host ${ktype} revoked cert privsep $privsep"
+                (
+                        cat $OBJ/sshd_proxy_bak
+                        echo HostKey $OBJ/cert_host_key_${ktype}
+                        echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
+                        echo UsePrivilegeSeparation $privsep
+                ) > $OBJ/sshd_proxy
+
+                ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
+                    -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
+                        -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
+                if [ $? -eq 0 ]; then
+                        fail "ssh cert connect succeeded unexpectedly"
+                fi
+        done
+done
+
+# Revoked CA
+(
+        echon '@cert-authority '
+        echon "$HOSTS "
+        cat $OBJ/host_ca_key.pub
+        echon '@revoked '
+        echon "* "
+        cat $OBJ/host_ca_key.pub
+) > $OBJ/known_hosts-cert
+for ktype in rsa dsa ; do 
+        verbose "$tid: host ${ktype} revoked cert"
+        (
+                cat $OBJ/sshd_proxy_bak
+                echo HostKey $OBJ/cert_host_key_${ktype}
+                echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
+        ) > $OBJ/sshd_proxy
+        ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
+            -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
+                -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
+        if [ $? -eq 0 ]; then
+                fail "ssh cert connect succeeded unexpectedly"
+        fi
+done
+
+# Create a CA key and add it to known hosts
+(
+        echon '@cert-authority '
+        echon "$HOSTS "
+        cat $OBJ/host_ca_key.pub
+) > $OBJ/known_hosts-cert
+
+test_one() {
+        ident=$1
+        result=$2
+        sign_opts=$3
+        
+        verbose "$tid: test host cert connect $ident expect $result"
+
+        ${SSHKEYGEN} -q -s $OBJ/host_ca_key -I "regress host key for $USER" \
+            $sign_opts \
+            $OBJ/cert_host_key_rsa ||
+                fail "couldn't sign cert_host_key_rsa"
+        (
+                cat $OBJ/sshd_proxy_bak
+                echo HostKey $OBJ/cert_host_key_rsa
+                echo HostCertificate $OBJ/cert_host_key_rsa-cert.pub
+        ) > $OBJ/sshd_proxy
+
+        ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
+            -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
+            -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
+        rc=$?
+        if [ "x$result" = "xsuccess" ] ; then
+                if [ $rc -ne 0 ]; then
+                        fail "ssh cert connect $ident failed unexpectedly"
+                fi
+        else
+                if [ $rc -eq 0 ]; then
+                        fail "ssh cert connect $ident succeeded unexpectedly"
+                fi
+        fi
+}
+
+test_one "user-certificate"     failure "-n $HOSTS"
+test_one "empty principals"     success "-h"
+test_one "wrong principals"     failure "-h -n foo"
+test_one "cert not yet valid"   failure "-h -V20200101:20300101"
+test_one "cert expired"         failure "-h -V19800101:19900101"
+test_one "cert valid interval"  success "-h -V-1w:+2w"
+test_one "cert has constraints" failure "-h -Oforce-command=false"
+
+# Check downgrade of cert to raw key when no CA found
+rm -f $OBJ/known_hosts-cert $OBJ/cert_host_key*
+for ktype in rsa dsa ; do 
+        verbose "$tid: host ${ktype} cert downgrade to raw key"
+        # Generate and sign a host key
+        ${SSHKEYGEN} -q -N '' -t ${ktype} \
+            -f $OBJ/cert_host_key_${ktype} || \
+                fail "ssh-keygen of cert_host_key_${ktype} failed"
+        ${SSHKEYGEN} -h -q -s $OBJ/host_ca_key -I "regress host key for $USER" \
+            -n $HOSTS $OBJ/cert_host_key_${ktype} ||
+                fail "couldn't sign cert_host_key_${ktype}"
+        (
+                echon "$HOSTS "
+                cat $OBJ/cert_host_key_${ktype}.pub
+        ) > $OBJ/known_hosts-cert
+        (
+                cat $OBJ/sshd_proxy_bak
+                echo HostKey $OBJ/cert_host_key_${ktype}
+                echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
+        ) > $OBJ/sshd_proxy
+        
+        ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
+            -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
+                -F $OBJ/ssh_proxy somehost true
+        if [ $? -ne 0 ]; then
+                fail "ssh cert connect failed"
+        fi
+done
+
+# Wrong certificate
+(
+        echon '@cert-authority '
+        echon "$HOSTS "
+        cat $OBJ/host_ca_key.pub
+) > $OBJ/known_hosts-cert
+for ktype in rsa dsa ; do 
+        # Self-sign key
+        ${SSHKEYGEN} -h -q -s $OBJ/cert_host_key_${ktype} \
+            -I "regress host key for $USER" \
+            -n $HOSTS $OBJ/cert_host_key_${ktype} ||
+                fail "couldn't sign cert_host_key_${ktype}"
+        verbose "$tid: host ${ktype} connect wrong cert"
+        (
+                cat $OBJ/sshd_proxy_bak
+                echo HostKey $OBJ/cert_host_key_${ktype}
+                echo HostCertificate $OBJ/cert_host_key_${ktype}-cert.pub
+        ) > $OBJ/sshd_proxy
+
+        ${SSH} -2 -oUserKnownHostsFile=$OBJ/known_hosts-cert \
+            -oGlobalKnownHostsFile=$OBJ/known_hosts-cert \
+                -F $OBJ/ssh_proxy -q somehost true >/dev/null 2>&1
+        if [ $? -eq 0 ]; then
+                fail "ssh cert connect $ident succeeded unexpectedly"
+        fi
+done
+
+rm -f $OBJ/known_hosts-cert $OBJ/host_ca_key* $OBJ/cert_host_key*
diff --git a/regress/cert-userkey.sh b/regress/cert-userkey.sh
new file mode 100644
index 000000000..7a58e7b75
--- /dev/null
+++ b/regress/cert-userkey.sh
@@ -0,0 +1,176 @@
+#       $OpenBSD: cert-userkey.sh,v 1.3 2010/03/04 10:38:23 djm Exp $
+#       Placed in the Public Domain.
+
+tid="certified user keys"
+
+rm -f $OBJ/authorized_keys_$USER $OBJ/user_ca_key* $OBJ/cert_user_key*
+cp $OBJ/sshd_proxy $OBJ/sshd_proxy_bak
+
+# Create a CA key
+${SSHKEYGEN} -q -N '' -t rsa  -f $OBJ/user_ca_key ||\
+        fail "ssh-keygen of user_ca_key failed"
+
+# Generate and sign user keys
+for ktype in rsa dsa ; do 
+        verbose "$tid: sign user ${ktype} cert"
+        ${SSHKEYGEN} -q -N '' -t ${ktype} \
+            -f $OBJ/cert_user_key_${ktype} || \
+                fail "ssh-keygen of cert_user_key_${ktype} failed"
+        ${SSHKEYGEN} -q -s $OBJ/user_ca_key -I \
+            "regress user key for $USER" \
+            -n $USER $OBJ/cert_user_key_${ktype} ||
+                fail "couldn't sign cert_user_key_${ktype}"
+done
+
+basic_tests() {
+        auth=$1
+        if test "x$auth" = "xauthorized_keys" ; then
+                # Add CA to authorized_keys
+                (
+                        echon 'cert-authority '
+                        cat $OBJ/user_ca_key.pub
+                ) > $OBJ/authorized_keys_$USER
+        else
+                echo > $OBJ/authorized_keys_$USER
+                extra_sshd="TrustedUserCAKeys $OBJ/user_ca_key.pub"
+        fi
+        
+        for ktype in rsa dsa ; do 
+                for privsep in yes no ; do
+                        _prefix="${ktype} privsep $privsep $auth"
+                        # Simple connect
+                        verbose "$tid: ${_prefix} connect"
+                        (
+                                cat $OBJ/sshd_proxy_bak
+                                echo "UsePrivilegeSeparation $privsep"
+                                echo "$extra_sshd"
+                        ) > $OBJ/sshd_proxy
+        
+                        ${SSH} -2i $OBJ/cert_user_key_${ktype} \
+                            -F $OBJ/ssh_proxy somehost true
+                        if [ $? -ne 0 ]; then
+                                fail "ssh cert connect failed"
+                        fi
+
+                        # Revoked keys
+                        verbose "$tid: ${_prefix} revoked key"
+                        (
+                                cat $OBJ/sshd_proxy_bak
+                                echo "UsePrivilegeSeparation $privsep"
+                                echo "RevokedKeys $OBJ/cert_user_key_${ktype}.pub"
+                                echo "$extra_sshd"
+                        ) > $OBJ/sshd_proxy
+                        ${SSH} -2i $OBJ/cert_user_key_${ktype} \
+                            -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
+                        if [ $? -eq 0 ]; then
+                                fail "ssh cert connect succeeded unexpecedly"
+                        fi
+                done
+        
+                # Revoked CA
+                verbose "$tid: ${ktype} $auth revoked CA key"
+                (
+                        cat $OBJ/sshd_proxy_bak
+                        echo "RevokedKeys $OBJ/user_ca_key.pub"
+                        echo "$extra_sshd"
+                ) > $OBJ/sshd_proxy
+                ${SSH} -2i $OBJ/cert_user_key_${ktype} -F $OBJ/ssh_proxy \
+                    somehost true >/dev/null 2>&1
+                if [ $? -eq 0 ]; then
+                        fail "ssh cert connect succeeded unexpecedly"
+                fi
+        done
+        
+        verbose "$tid: $auth CA does not authenticate"
+        (
+                cat $OBJ/sshd_proxy_bak
+                echo "$extra_sshd"
+        ) > $OBJ/sshd_proxy
+        verbose "$tid: ensure CA key does not authenticate user"
+        ${SSH} -2i $OBJ/user_ca_key \
+            -F $OBJ/ssh_proxy somehost true >/dev/null 2>&1
+        if [ $? -eq 0 ]; then
+                fail "ssh cert connect with CA key succeeded unexpectedly"
+        fi
+}
+
+basic_tests authorized_keys
+basic_tests TrustedUserCAKeys
+
+test_one() {
+        ident=$1
+        result=$2
+        sign_opts=$3
+        auth_choice=$4
+
+        if test "x$auth_choice" = "x" ; then
+                auth_choice="authorized_keys TrustedUserCAKeys"
+        fi
+
+        for auth in $auth_choice ; do
+                cat $OBJ/sshd_proxy_bak > $OBJ/sshd_proxy
+                if test "x$auth" = "xauthorized_keys" ; then
+                        # Add CA to authorized_keys
+                        (
+                                echon 'cert-authority '
+                                cat $OBJ/user_ca_key.pub
+                        ) > $OBJ/authorized_keys_$USER
+                else
+                        echo > $OBJ/authorized_keys_$USER
+                        echo "TrustedUserCAKeys $OBJ/user_ca_key.pub" >> \
+                            $OBJ/sshd_proxy
+
+                fi
+                
+                verbose "$tid: $ident auth $auth expect $result"
+                ${SSHKEYGEN} -q -s $OBJ/user_ca_key \
+                    -I "regress user key for $USER" \
+                    $sign_opts \
+                    $OBJ/cert_user_key_rsa ||
+                        fail "couldn't sign cert_user_key_rsa"
+        
+                ${SSH} -2i $OBJ/cert_user_key_rsa -F $OBJ/ssh_proxy \
+                    somehost true >/dev/null 2>&1
+                rc=$?
+                if [ "x$result" = "xsuccess" ] ; then
+                        if [ $rc -ne 0 ]; then
+                                fail "$ident failed unexpectedly"
+                        fi
+                else
+                        if [ $rc -eq 0 ]; then
+                                fail "$ident succeeded unexpectedly"
+                        fi
+                fi
+        done
+}
+
+test_one "correct principal"    success "-n ${USER}"
+test_one "host-certificate"     failure "-n ${USER} -h"
+test_one "wrong principals"     failure "-n foo"
+test_one "cert not yet valid"   failure "-n ${USER} -V20200101:20300101"
+test_one "cert expired"         failure "-n ${USER} -V19800101:19900101"
+test_one "cert valid interval"  success "-n ${USER} -V-1w:+2w"
+test_one "wrong source-address" failure "-n ${USER} -Osource-address=10.0.0.0/8"
+test_one "force-command"        failure "-n ${USER} -Oforce-command=false"
+
+# Behaviour is different here: TrustedUserCAKeys doesn't allow empty principals
+test_one "empty principals"     success "" authorized_keys
+test_one "empty principals"     failure "" TrustedUserCAKeys
+
+# Wrong certificate
+for ktype in rsa dsa ; do 
+        # Self-sign
+        ${SSHKEYGEN} -q -s $OBJ/cert_user_key_${ktype} -I \
+            "regress user key for $USER" \
+            -n $USER $OBJ/cert_user_key_${ktype} ||
+                fail "couldn't sign cert_user_key_${ktype}"
+        verbose "$tid: user ${ktype} connect wrong cert"
+        ${SSH} -2i $OBJ/cert_user_key_${ktype} -F $OBJ/ssh_proxy \
+            somehost true >/dev/null 2>&1
+        if [ $? -eq 0 ]; then
+                fail "ssh cert connect $ident succeeded unexpectedly"
+        fi
+done
+
+rm -f $OBJ/authorized_keys_$USER $OBJ/user_ca_key* $OBJ/cert_user_key*
+
diff --git a/regress/cfgmatch.sh b/regress/cfgmatch.sh
index 35c5e52a1..96badd51b 100644
--- a/regress/cfgmatch.sh
+++ b/regress/cfgmatch.sh
@@ -57,9 +57,9 @@ for p in 1 2; do
 done
 
 # Retry previous with key option, should also be denied.
-echo -n 'permitopen="127.0.0.1:'$PORT'" ' >$OBJ/authorized_keys_$USER
+echon 'permitopen="127.0.0.1:'$PORT'" ' >$OBJ/authorized_keys_$USER
 cat $OBJ/rsa.pub >> $OBJ/authorized_keys_$USER
-echo -n 'permitopen="127.0.0.1:'$PORT'" ' >>$OBJ/authorized_keys_$USER
+echon 'permitopen="127.0.0.1:'$PORT'" ' >>$OBJ/authorized_keys_$USER
 cat $OBJ/rsa1.pub >> $OBJ/authorized_keys_$USER
 for p in 1 2; do
         rm -f $pidfile
diff --git a/regress/cipher-speed.sh b/regress/cipher-speed.sh
index d39a829d4..85de6d585 100644
--- a/regress/cipher-speed.sh
+++ b/regress/cipher-speed.sh
@@ -19,7 +19,7 @@ ciphers="aes128-cbc 3des-cbc blowfish-cbc cast128-cbc
 for c in $ciphers; do for m in $macs; do
         trace "proto 2 cipher $c mac $m"
         for x in $tries; do
-                echo -n "$c/$m:\t"
+                echon "$c/$m:\t"
                 ( ${SSH} -o 'compression no' \
                         -F $OBJ/ssh_proxy -2 -m $m -c $c somehost \
                         exec sh -c \'"dd of=/dev/null obs=32k"\' \
@@ -35,7 +35,7 @@ ciphers="3des blowfish"
 for c in $ciphers; do
         trace "proto 1 cipher $c"
         for x in $tries; do
-                echo -n "$c:\t"
+                echon "$c:\t"
                 ( ${SSH} -o 'compression no' \
                         -F $OBJ/ssh_proxy -1 -c $c somehost \
                         exec sh -c \'"dd of=/dev/null obs=32k"\' \
diff --git a/regress/forwarding.sh b/regress/forwarding.sh
index 9ffbb3dd4..6dec991a6 100644
--- a/regress/forwarding.sh
+++ b/regress/forwarding.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: forwarding.sh,v 1.6 2006/07/11 18:51:21 markus Exp $
+#       $OpenBSD: forwarding.sh,v 1.7 2010/01/11 02:53:44 dtucker Exp $
 #       Placed in the Public Domain.
 
 tid="local and remote forwarding"
@@ -93,3 +93,13 @@ for p in 1 2; do
         fi
         sleep 10
 done
+
+for p in 2; do
+        trace "stdio forwarding proto $p"
+        cmd="${SSH} -$p -F $OBJ/ssh_config"
+        $cmd -o "ProxyCommand $cmd -q -W localhost:$PORT somehost" \
+                somehost true
+        if [ $? != 0 ]; then
+                fail "stdio forwarding proto $p"
+        fi
+done
diff --git a/regress/keygen-convert.sh b/regress/keygen-convert.sh
new file mode 100644
index 000000000..ad0e9c637
--- /dev/null
+++ b/regress/keygen-convert.sh
@@ -0,0 +1,33 @@
+#       $OpenBSD: keygen-convert.sh,v 1.1 2009/11/09 04:20:04 dtucker Exp $
+#       Placed in the Public Domain.
+
+tid="convert keys"
+
+for t in rsa dsa; do
+        # generate user key for agent
+        trace "generating $t key"
+        rm -f $OBJ/$t-key
+        ${SSHKEYGEN} -q -N "" -t $t -f $OBJ/$t-key
+
+        trace "export $t private to rfc4716 public"
+        ${SSHKEYGEN} -q -e -f $OBJ/$t-key >$OBJ/$t-key-rfc || \
+            fail "export $t private to rfc4716 public"
+
+        trace "export $t public to rfc4716 public"
+        ${SSHKEYGEN} -q -e -f $OBJ/$t-key.pub >$OBJ/$t-key-rfc.pub || \
+            fail "$t public to rfc4716 public"
+
+        cmp $OBJ/$t-key-rfc $OBJ/$t-key-rfc.pub || \
+            fail "$t rfc4716 exports differ between public and private"
+
+        trace "import $t rfc4716 public"
+        ${SSHKEYGEN} -q -i -f $OBJ/$t-key-rfc >$OBJ/$t-rfc-imported || \
+            fail "$t import rfc4716 public"
+
+        cut -f1,2 -d " " $OBJ/$t-key.pub >$OBJ/$t-key-nocomment.pub
+        cmp $OBJ/$t-key-nocomment.pub $OBJ/$t-rfc-imported || \
+            fail "$t imported differs from original"
+
+        rm -f $OBJ/$t-key $OBJ/$t-key.pub $OBJ/$t-key-rfc $OBJ/$t-key-rfc.pub \
+            $OBJ/$t-rfc-imported $OBJ/$t-key-nocomment.pub
+done
diff --git a/regress/multiplex.sh b/regress/multiplex.sh
index 4fba7b5ac..8a98a6e54 100644
--- a/regress/multiplex.sh
+++ b/regress/multiplex.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: multiplex.sh,v 1.11 2005/04/25 09:54:09 dtucker Exp $
+#       $OpenBSD: multiplex.sh,v 1.12 2009/05/05 07:51:36 dtucker Exp $
 #       Placed in the Public Domain.
 
 CTL=/tmp/openssh.regress.ctl-sock.$$
@@ -26,7 +26,7 @@ sleep 5
 
 verbose "test $tid: envpass"
 trace "env passing over multiplexed connection"
-_XXX_TEST=blah ${SSH} -oSendEnv="_XXX_TEST" -S$CTL otherhost sh << 'EOF'
+_XXX_TEST=blah ${SSH} -F $OBJ/ssh_config -oSendEnv="_XXX_TEST" -S$CTL otherhost sh << 'EOF'
         test X"$_XXX_TEST" = X"blah"
 EOF
 if [ $? -ne 0 ]; then
@@ -36,26 +36,26 @@ fi
 verbose "test $tid: transfer"
 rm -f ${COPY}
 trace "ssh transfer over multiplexed connection and check result"
-${SSH} -S$CTL otherhost cat ${DATA} > ${COPY}
+${SSH} -F $OBJ/ssh_config -S$CTL otherhost cat ${DATA} > ${COPY}
 test -f ${COPY}                 || fail "ssh -Sctl: failed copy ${DATA}" 
 cmp ${DATA} ${COPY}             || fail "ssh -Sctl: corrupted copy of ${DATA}"
 
 rm -f ${COPY}
 trace "ssh transfer over multiplexed connection and check result"
-${SSH} -S $CTL otherhost cat ${DATA} > ${COPY}
+${SSH} -F $OBJ/ssh_config -S $CTL otherhost cat ${DATA} > ${COPY}
 test -f ${COPY}                 || fail "ssh -S ctl: failed copy ${DATA}" 
 cmp ${DATA} ${COPY}             || fail "ssh -S ctl: corrupted copy of ${DATA}"
 
 rm -f ${COPY}
 trace "sftp transfer over multiplexed connection and check result"
 echo "get ${DATA} ${COPY}" | \
-        ${SFTP} -S ${SSH} -oControlPath=$CTL otherhost >$LOG 2>&1
+        ${SFTP} -S ${SSH} -F $OBJ/ssh_config -oControlPath=$CTL otherhost >$LOG 2>&1
 test -f ${COPY}                 || fail "sftp: failed copy ${DATA}" 
 cmp ${DATA} ${COPY}             || fail "sftp: corrupted copy of ${DATA}"
 
 rm -f ${COPY}
 trace "scp transfer over multiplexed connection and check result"
-${SCP} -S ${SSH} -oControlPath=$CTL otherhost:${DATA} ${COPY} >$LOG 2>&1
+${SCP} -S ${SSH} -F $OBJ/ssh_config -oControlPath=$CTL otherhost:${DATA} ${COPY} >$LOG 2>&1
 test -f ${COPY}                 || fail "scp: failed copy ${DATA}" 
 cmp ${DATA} ${COPY}             || fail "scp: corrupted copy of ${DATA}"
 
@@ -64,7 +64,7 @@ rm -f ${COPY}
 for s in 0 1 4 5 44; do
         trace "exit status $s over multiplexed connection"
         verbose "test $tid: status $s"
-        ${SSH} -S $CTL otherhost exit $s
+        ${SSH} -F $OBJ/ssh_config -S $CTL otherhost exit $s
         r=$?
         if [ $r -ne $s ]; then
                 fail "exit code mismatch for protocol $p: $r != $s"
@@ -72,7 +72,7 @@ for s in 0 1 4 5 44; do
 
         # same with early close of stdout/err
         trace "exit status $s with early close over multiplexed connection"
-        ${SSH} -S $CTL -n otherhost \
+        ${SSH} -F $OBJ/ssh_config -S $CTL -n otherhost \
                 exec sh -c \'"sleep 2; exec > /dev/null 2>&1; sleep 3; exit $s"\'
         r=$?
         if [ $r -ne $s ]; then
@@ -81,10 +81,10 @@ for s in 0 1 4 5 44; do
 done
 
 trace "test check command"
-${SSH} -S $CTL -Ocheck otherhost || fail "check command failed" 
+${SSH} -F $OBJ/ssh_config -S $CTL -Ocheck otherhost || fail "check command failed" 
 
 trace "test exit command"
-${SSH} -S $CTL -Oexit otherhost || fail "send exit command failed" 
+${SSH} -F $OBJ/ssh_config -S $CTL -Oexit otherhost || fail "send exit command failed" 
 
 # Wait for master to exit
 sleep 2
diff --git a/regress/portnum.sh b/regress/portnum.sh
new file mode 100644
index 000000000..1de0680fe
--- /dev/null
+++ b/regress/portnum.sh
@@ -0,0 +1,34 @@
+#       $OpenBSD: portnum.sh,v 1.1 2009/08/13 00:57:17 djm Exp $
+#       Placed in the Public Domain.
+
+tid="port number parsing"
+
+badport() {
+        port=$1
+        verbose "$tid: invalid port $port"
+        if ${SSH} -F $OBJ/ssh_proxy -p $port somehost true 2>/dev/null ; then
+                fail "$tid accepted invalid port $port"
+        fi
+}
+goodport() {
+        port=$1
+        verbose "$tid: valid port $port"
+        if ${SSH} -F $OBJ/ssh_proxy -p $port somehost true 2>/dev/null ; then
+                :
+        else
+                fail "$tid rejected valid port $port"
+        fi
+}
+
+badport 0
+badport 65536
+badport 131073
+badport 2000blah
+badport blah2000
+
+goodport 1
+goodport 22
+goodport 2222
+goodport 22222
+goodport 65535
+
diff --git a/regress/sftp-badcmds.sh b/regress/sftp-badcmds.sh
index b48b1cb01..08009f26b 100644
--- a/regress/sftp-badcmds.sh
+++ b/regress/sftp-badcmds.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: sftp-badcmds.sh,v 1.3 2008/03/24 21:46:54 djm Exp $
+#       $OpenBSD: sftp-badcmds.sh,v 1.4 2009/08/13 01:11:55 djm Exp $
 #       Placed in the Public Domain.
 
 tid="sftp invalid commands"
@@ -13,13 +13,13 @@ rm -rf ${COPY} ${COPY}.1 ${COPY}.2 ${COPY}.dd
 
 rm -f ${COPY}
 verbose "$tid: get nonexistent"
-echo "get $NONEXIST $COPY" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+echo "get $NONEXIST $COPY" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "get nonexistent failed"
 test -f ${COPY} && fail "existing copy after get nonexistent"
 
 rm -f ${COPY}.dd/*
 verbose "$tid: glob get to nonexistent directory"
-echo "get /bin/l* $NONEXIST" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+echo "get /bin/l* $NONEXIST" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "get nonexistent failed"
 for x in $GLOBFILES; do
         test -f ${COPY}.dd/$x && fail "existing copy after get nonexistent"
@@ -27,13 +27,13 @@ done
 
 rm -f ${COPY}
 verbose "$tid: put nonexistent"
-echo "put $NONEXIST $COPY" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+echo "put $NONEXIST $COPY" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "put nonexistent failed"
 test -f ${COPY} && fail "existing copy after put nonexistent"
 
 rm -f ${COPY}.dd/*
 verbose "$tid: glob put to nonexistent directory"
-echo "put /bin/l* ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+echo "put /bin/l* ${COPY}.dd" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "put nonexistent failed"
 for x in $GLOBFILES; do
         test -f ${COPY}.dd/$x && fail "existing copy after nonexistent"
@@ -41,7 +41,7 @@ done
 
 rm -f ${COPY}
 verbose "$tid: rename nonexistent"
-echo "rename $NONEXIST ${COPY}.1" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+echo "rename $NONEXIST ${COPY}.1" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "rename nonexist failed"
 test -f ${COPY}.1 && fail "file exists after rename nonexistent"
 
@@ -49,7 +49,7 @@ rm -rf ${COPY} ${COPY}.dd
 cp $DATA $COPY
 mkdir ${COPY}.dd
 verbose "$tid: rename target exists (directory)"
-echo "rename $COPY ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+echo "rename $COPY ${COPY}.dd" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "rename target exists (directory) failed"
 test -f ${COPY} || fail "oldname missing after rename target exists (directory)"
 test -d ${COPY}.dd || fail "newname missing after rename target exists (directory)"
@@ -59,7 +59,7 @@ rm -f ${COPY}.dd/*
 rm -rf ${COPY}
 cp ${DATA2} ${COPY}
 verbose "$tid: glob put files to local file"
-echo "put /bin/l* $COPY" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 
+echo "put /bin/l* $COPY" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 
 cmp ${DATA2} ${COPY} || fail "put successed when it should have failed"
 
 rm -rf ${COPY} ${COPY}.1 ${COPY}.2 ${COPY}.dd
diff --git a/regress/sftp-batch.sh b/regress/sftp-batch.sh
index 365c47cfc..a51ef0782 100644
--- a/regress/sftp-batch.sh
+++ b/regress/sftp-batch.sh
@@ -1,4 +1,4 @@
-#     $OpenBSD: sftp-batch.sh,v 1.3 2004/01/13 09:49:06 djm Exp $
+#       $OpenBSD: sftp-batch.sh,v 1.4 2009/08/13 01:11:55 djm Exp $
 #       Placed in the Public Domain.
 
 tid="sftp batchfile"
@@ -37,19 +37,19 @@ cat << EOF > ${BATCH}.fail.2
 EOF
 
 verbose "$tid: good commands"
-${SFTP} -b ${BATCH}.pass.1 -P ${SFTPSERVER} >/dev/null 2>&1 \
+${SFTP} -b ${BATCH}.pass.1 -D ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "good commands failed"
 
 verbose "$tid: bad commands"
-${SFTP} -b ${BATCH}.fail.1 -P ${SFTPSERVER} >/dev/null 2>&1 \
+${SFTP} -b ${BATCH}.fail.1 -D ${SFTPSERVER} >/dev/null 2>&1 \
         && fail "bad commands succeeded"
 
 verbose "$tid: comments and blanks"
-${SFTP} -b ${BATCH}.pass.2 -P ${SFTPSERVER} >/dev/null 2>&1 \
+${SFTP} -b ${BATCH}.pass.2 -D ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "comments & blanks failed"
 
 verbose "$tid: junk command"
-${SFTP} -b ${BATCH}.fail.2 -P ${SFTPSERVER} >/dev/null 2>&1 \
+${SFTP} -b ${BATCH}.fail.2 -D ${SFTPSERVER} >/dev/null 2>&1 \
         && fail "junk command succeeded"
 
 rm -rf ${COPY} ${COPY}.1 ${COPY}.2 ${COPY}.dd ${BATCH}.*
diff --git a/regress/sftp-cmds.sh b/regress/sftp-cmds.sh
index 3b453c5e8..c4d6ae2de 100644
--- a/regress/sftp-cmds.sh
+++ b/regress/sftp-cmds.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: sftp-cmds.sh,v 1.9 2007/12/12 05:04:03 djm Exp $
+#       $OpenBSD: sftp-cmds.sh,v 1.10 2009/08/13 01:11:55 djm Exp $
 #       Placed in the Public Domain.
 
 # XXX - TODO: 
@@ -40,56 +40,56 @@ SPACECOPY_ARG="${COPY}\ this\ has\ spaces.txt"
 # File with glob metacharacters
 GLOBMETACOPY="${COPY} [metachar].txt"
 
-rm -rf ${COPY} ${COPY}.1 ${COPY}.2 ${COPY}.dd ${COPY}.dd2
+rm -rf ${COPY} ${COPY}.1 ${COPY}.2 ${COPY}.dd ${COPY}.dd2 ${BATCH}.*
 mkdir ${COPY}.dd
 
 verbose "$tid: lls"
-(echo "lcd ${OBJ}" ; echo "lls") | ${SFTP} -P ${SFTPSERVER} 2>&1 | \
+(echo "lcd ${OBJ}" ; echo "lls") | ${SFTP} -D ${SFTPSERVER} 2>&1 | \
         grep copy.dd >/dev/null 2>&1 || fail "lls failed"
 
 verbose "$tid: lls w/path"
-echo "lls ${OBJ}" | ${SFTP} -P ${SFTPSERVER} 2>&1 | \
+echo "lls ${OBJ}" | ${SFTP} -D ${SFTPSERVER} 2>&1 | \
         grep copy.dd >/dev/null 2>&1 || fail "lls w/path failed"
 
 verbose "$tid: ls"
-echo "ls ${OBJ}" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+echo "ls ${OBJ}" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "ls failed"
 # XXX always successful
 
 verbose "$tid: shell"
-echo "!echo hi there" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+echo "!echo hi there" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "shell failed"
 # XXX always successful
 
 verbose "$tid: pwd"
-echo "pwd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+echo "pwd" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "pwd failed"
 # XXX always successful
 
 verbose "$tid: lpwd"
-echo "lpwd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+echo "lpwd" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "lpwd failed"
 # XXX always successful
 
 verbose "$tid: quit"
-echo "quit" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+echo "quit" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "quit failed"
 # XXX always successful
 
 verbose "$tid: help"
-echo "help" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+echo "help" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "help failed"
 # XXX always successful
 
 rm -f ${COPY}
 verbose "$tid: get"
-echo "get $DATA $COPY" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+echo "get $DATA $COPY" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "get failed"
 cmp $DATA ${COPY} || fail "corrupted copy after get"
 
 rm -f ${COPY}
 verbose "$tid: get quoted"
-echo "get \"$DATA\" $COPY" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+echo "get \"$DATA\" $COPY" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "get failed"
 cmp $DATA ${COPY} || fail "corrupted copy after get"
 
@@ -97,8 +97,8 @@ if [ "$os" != "cygwin" ]; then
 rm -f ${QUOTECOPY}
 cp $DATA ${QUOTECOPY}
 verbose "$tid: get filename with quotes"
-echo "get \"$QUOTECOPY_ARG\" ${COPY}" | \
-    ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \ || fail "get failed"
+echo "get \"$QUOTECOPY_ARG\" ${COPY}" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
+        || fail "get failed"
 cmp ${COPY} ${QUOTECOPY} || fail "corrupted copy after get with quotes"
 rm -f ${QUOTECOPY} ${COPY}
 fi
@@ -106,7 +106,7 @@ fi
 rm -f "$SPACECOPY" ${COPY}
 cp $DATA "$SPACECOPY"
 verbose "$tid: get filename with spaces"
-echo "get ${SPACECOPY_ARG} ${COPY}" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+echo "get ${SPACECOPY_ARG} ${COPY}" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "get failed"
 cmp ${COPY} "$SPACECOPY" || fail "corrupted copy after get with spaces"
 
@@ -114,19 +114,19 @@ rm -f "$GLOBMETACOPY" ${COPY}
 cp $DATA "$GLOBMETACOPY"
 verbose "$tid: get filename with glob metacharacters"
 echo "get \"${GLOBMETACOPY}\" ${COPY}" | \
-        ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 || fail "get failed"
+        ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 || fail "get failed"
 cmp ${COPY} "$GLOBMETACOPY" || \
         fail "corrupted copy after get with glob metacharacters"
 
 rm -f ${COPY}.dd/*
 verbose "$tid: get to directory"
-echo "get $DATA ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+echo "get $DATA ${COPY}.dd" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "get failed"
 cmp $DATA ${COPY}.dd/`basename $DATA` || fail "corrupted copy after get"
 
 rm -f ${COPY}.dd/*
 verbose "$tid: glob get to directory"
-echo "get /bin/l* ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+echo "get /bin/l* ${COPY}.dd" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "get failed"
 for x in $GLOBFILES; do
         cmp /bin/$x ${COPY}.dd/$x || fail "corrupted copy after get"
@@ -134,13 +134,13 @@ done
 
 rm -f ${COPY}.dd/*
 verbose "$tid: get to local dir"
-(echo "lcd ${COPY}.dd"; echo "get $DATA" ) | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+(echo "lcd ${COPY}.dd"; echo "get $DATA" ) | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "get failed"
 cmp $DATA ${COPY}.dd/`basename $DATA` || fail "corrupted copy after get"
 
 rm -f ${COPY}.dd/*
 verbose "$tid: glob get to local dir"
-(echo "lcd ${COPY}.dd"; echo "get /bin/l*") | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+(echo "lcd ${COPY}.dd"; echo "get /bin/l*") | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "get failed"
 for x in $GLOBFILES; do
         cmp /bin/$x ${COPY}.dd/$x || fail "corrupted copy after get"
@@ -149,32 +149,32 @@ done
 rm -f ${COPY}
 verbose "$tid: put"
 echo "put $DATA $COPY" | \
-        ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 || fail "put failed"
+        ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 || fail "put failed"
 cmp $DATA ${COPY} || fail "corrupted copy after put"
 
 if [ "$os" != "cygwin" ]; then
 rm -f ${QUOTECOPY}
 verbose "$tid: put filename with quotes"
 echo "put $DATA \"$QUOTECOPY_ARG\"" | \
-        ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 || fail "put failed"
+        ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 || fail "put failed"
 cmp $DATA ${QUOTECOPY} || fail "corrupted copy after put with quotes"
 fi
 
 rm -f "$SPACECOPY"
 verbose "$tid: put filename with spaces"
 echo "put $DATA ${SPACECOPY_ARG}" | \
-        ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 || fail "put failed"
+        ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 || fail "put failed"
 cmp $DATA "$SPACECOPY" || fail "corrupted copy after put with spaces"
 
 rm -f ${COPY}.dd/*
 verbose "$tid: put to directory"
-echo "put $DATA ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+echo "put $DATA ${COPY}.dd" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "put failed"
 cmp $DATA ${COPY}.dd/`basename $DATA` || fail "corrupted copy after put"
 
 rm -f ${COPY}.dd/*
 verbose "$tid: glob put to directory"
-echo "put /bin/l? ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+echo "put /bin/l? ${COPY}.dd" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "put failed"
 for x in $GLOBFILES; do
         cmp /bin/$x ${COPY}.dd/$x || fail "corrupted copy after put"
@@ -182,60 +182,61 @@ done
 
 rm -f ${COPY}.dd/*
 verbose "$tid: put to local dir"
-(echo "cd ${COPY}.dd"; echo "put $DATA") | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+(echo "cd ${COPY}.dd"; echo "put $DATA") | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "put failed"
 cmp $DATA ${COPY}.dd/`basename $DATA` || fail "corrupted copy after put"
 
 rm -f ${COPY}.dd/*
 verbose "$tid: glob put to local dir"
-(echo "cd ${COPY}.dd"; echo "put /bin/l?") | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+(echo "cd ${COPY}.dd"; echo "put /bin/l?") | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "put failed"
 for x in $GLOBFILES; do
         cmp /bin/$x ${COPY}.dd/$x || fail "corrupted copy after put"
 done
 
 verbose "$tid: rename"
-echo "rename $COPY ${COPY}.1" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+echo "rename $COPY ${COPY}.1" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "rename failed"
 test -f ${COPY}.1 || fail "missing file after rename"
 cmp $DATA ${COPY}.1 >/dev/null 2>&1 || fail "corrupted copy after rename"
 
 verbose "$tid: rename directory"
 echo "rename ${COPY}.dd ${COPY}.dd2" | \
-        ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 || \
+        ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 || \
         fail "rename directory failed"
 test -d ${COPY}.dd && fail "oldname exists after rename directory"
 test -d ${COPY}.dd2 || fail "missing newname after rename directory"
 
 verbose "$tid: ln"
-echo "ln ${COPY}.1 ${COPY}.2" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 || fail "ln failed"
+echo "ln ${COPY}.1 ${COPY}.2" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 || fail "ln failed"
 test -h ${COPY}.2 || fail "missing file after ln"
 
 verbose "$tid: mkdir"
-echo "mkdir ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+echo "mkdir ${COPY}.dd" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "mkdir failed"
 test -d ${COPY}.dd || fail "missing directory after mkdir"
 
 # XXX do more here
 verbose "$tid: chdir"
-echo "chdir ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+echo "chdir ${COPY}.dd" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "chdir failed"
 
 verbose "$tid: rmdir"
-echo "rmdir ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+echo "rmdir ${COPY}.dd" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "rmdir failed"
 test -d ${COPY}.1 && fail "present directory after rmdir"
 
 verbose "$tid: lmkdir"
-echo "lmkdir ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+echo "lmkdir ${COPY}.dd" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "lmkdir failed"
 test -d ${COPY}.dd || fail "missing directory after lmkdir"
 
 # XXX do more here
 verbose "$tid: lchdir"
-echo "lchdir ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+echo "lchdir ${COPY}.dd" | ${SFTP} -D ${SFTPSERVER} >/dev/null 2>&1 \
         || fail "lchdir failed"
 
-rm -rf ${COPY} ${COPY}.1 ${COPY}.2 ${COPY}.dd ${COPY}.dd2
+rm -rf ${COPY} ${COPY}.1 ${COPY}.2 ${COPY}.dd ${COPY}.dd2 ${BATCH}.*
 rm -rf ${QUOTECOPY} "$SPACECOPY" "$GLOBMETACOPY"
 
+
diff --git a/regress/sftp-glob.sh b/regress/sftp-glob.sh
index 60116a748..72bb17d75 100644
--- a/regress/sftp-glob.sh
+++ b/regress/sftp-glob.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: sftp-glob.sh,v 1.3 2007/10/26 05:30:01 djm Exp $
+#       $OpenBSD: sftp-glob.sh,v 1.4 2009/08/13 01:11:55 djm Exp $
 #       Placed in the Public Domain.
 
 tid="sftp glob"
@@ -10,7 +10,7 @@ sftp_ls() {
         unexpected=$4
         verbose "$tid: $errtag"
         printf "ls -l %s" "${target}" | \
-                ${SFTP} -b - -P ${SFTPSERVER} 2>/dev/null | \
+                ${SFTP} -b - -D ${SFTPSERVER} 2>/dev/null | \
                 grep -v "^sftp>" > ${RESULTS}
         if [ $? -ne 0 ]; then
                 fail "$errtag failed"
diff --git a/regress/sftp.sh b/regress/sftp.sh
index 0e22f8f6b..f84fa6f4e 100644
--- a/regress/sftp.sh
+++ b/regress/sftp.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: sftp.sh,v 1.2 2002/03/27 22:39:52 markus Exp $
+#       $OpenBSD: sftp.sh,v 1.3 2009/08/13 01:11:55 djm Exp $
 #       Placed in the Public Domain.
 
 tid="basic sftp put/get"
@@ -19,8 +19,8 @@ REQUESTS="1 2 10"
 for B in ${BUFFERSIZE}; do
         for R in ${REQUESTS}; do
                 verbose "test $tid: buffer_size $B num_requests $R"
-                rm -f ${COPY}.1 ${COPY}.2                
-                ${SFTP} -P ${SFTPSERVER} -B $B -R $R -b $SFTPCMDFILE \
+                rm -f ${COPY}.1 ${COPY}.2
+                ${SFTP} -D ${SFTPSERVER} -B $B -R $R -b $SFTPCMDFILE \
                 > /dev/null 2>&1
                 r=$?
                 if [ $r -ne 0 ]; then
diff --git a/regress/ssh-com-sftp.sh b/regress/ssh-com-sftp.sh
index 936b4cca7..be6f4e0dc 100644
--- a/regress/ssh-com-sftp.sh
+++ b/regress/ssh-com-sftp.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: ssh-com-sftp.sh,v 1.5 2004/02/24 17:06:52 markus Exp $
+#       $OpenBSD: ssh-com-sftp.sh,v 1.6 2009/08/20 18:43:07 djm Exp $
 #       Placed in the Public Domain.
 
 tid="basic sftp put/get with ssh.com server"
@@ -51,7 +51,7 @@ for v in ${VERSIONS}; do
                 for R in ${REQUESTS}; do
                         verbose "test $tid: buffer_size $B num_requests $R"
                         rm -f ${COPY}.1 ${COPY}.2
-                        ${SFTP} -P ${server} -B $B -R $R -b $SFTPCMDFILE \
+                        ${SFTP} -D ${server} -B $B -R $R -b $SFTPCMDFILE \
                         > /dev/null 2>&1
                         r=$?
                         if [ $r -ne 0 ]; then
diff --git a/regress/ssh2putty.sh b/regress/ssh2putty.sh
index dfdeeff4a..691db1690 100755
--- a/regress/ssh2putty.sh
+++ b/regress/ssh2putty.sh
@@ -1,4 +1,5 @@
 #!/bin/sh
+#       $OpenBSD: ssh2putty.sh,v 1.2 2009/10/06 23:51:49 dtucker Exp $
 
 if test "x$1" = "x" -o "x$2" = "x" -o "x$3" = "x" ; then
         echo "Usage: ssh2putty hostname port ssh-private-key"
diff --git a/regress/test-exec.sh b/regress/test-exec.sh
index b54448912..b3a19389d 100644
--- a/regress/test-exec.sh
+++ b/regress/test-exec.sh
@@ -1,4 +1,4 @@
-#       $OpenBSD: test-exec.sh,v 1.35 2008/06/28 13:57:25 djm Exp $
+#       $OpenBSD: test-exec.sh,v 1.37 2010/02/24 06:21:56 djm Exp $
 #       Placed in the Public Domain.
 
 #SUDO=sudo
@@ -172,9 +172,17 @@ cleanup ()
                         echo no sshd running
                 else
                         if [ $pid -lt 2 ]; then
-                                echo bad pid for ssd: $pid
+                                echo bad pid for ssh: $pid
                         else
                                 $SUDO kill $pid
+                                trace "wait for sshd to exit"
+                                i=0;
+                                while [ -f $PIDFILE -a $i -lt 5 ]; do
+                                        i=`expr $i + 1`
+                                        sleep $i
+                                done
+                                test -f $PIDFILE && \
+                                    fatal "sshd didn't exit port $PORT pid $pid"
                         fi
                 fi
         fi
@@ -222,6 +230,7 @@ trap fatal 3 2
 cat << EOF > $OBJ/sshd_config
         StrictModes             no
         Port                    $PORT
+        Protocol                2,1
         AddressFamily           inet
         ListenAddress           127.0.0.1
         #ListenAddress          ::1
@@ -247,6 +256,7 @@ echo 'StrictModes no' >> $OBJ/sshd_proxy
 # create client config
 cat << EOF > $OBJ/ssh_config
 Host *
+        Protocol                2,1
         Hostname                127.0.0.1
         HostKeyAlias            localhost-with-alias
         Port                    $PORT