7 files changed, 2684 insertions, 1132 deletions

diff --git a/security/openssh-portable/files/openssh-lpk-5.0p1-64bit.patch b/security/openssh-portable/files/contrib-openssh-5.1_p1-lpk-64bit.patch
index 2e95d951885b..2e95d951885b 100644
--- a/security/openssh-portable/files/openssh-lpk-5.0p1-64bit.patch
+++ b/security/openssh-portable/files/contrib-openssh-5.1_p1-lpk-64bit.patch
diff --git a/security/openssh-portable/files/openssh-lpk-5.0p1-0.3.9-servconv.patch b/security/openssh-portable/files/contrib-openssh-lpk-5.1p1-0.3.10-servconf.c.patch
index 4a354634e4d3..5101aa5528c6 100644
--- a/security/openssh-portable/files/openssh-lpk-5.0p1-0.3.9-servconv.patch
+++ b/security/openssh-portable/files/contrib-openssh-lpk-5.1p1-0.3.10-servconf.c.patch
@@ -1,5 +1,5 @@
---- servconf.c.orig	2009-05-02 19:24:09.000000000 +0400
-+++ servconf.c	2009-05-02 19:29:37.000000000 +0400
+--- servconf.c.orig	2009-05-26 15:13:32.000000000 +0400
++++ servconf.c	2009-05-26 15:24:39.000000000 +0400
 @@ -42,6 +42,10 @@
  #include "channels.h"
  #include "groupaccess.h"
@@ -11,36 +11,27 @@
  static void add_listen_addr(ServerOptions *, char *, int);
  static void add_one_listen_addr(ServerOptions *, char *, int);
  
-@@ -74,7 +78,7 @@
- 	options->ignore_user_known_hosts = -1;
- 	options->print_motd = -1;
- 	options->print_lastlog = -1;
--	options->x11_forwarding = -1;
-+	options->x11_forwarding = 1;
- 	options->x11_display_offset = -1;
- 	options->x11_use_localhost = -1;
- 	options->xauth_location = NULL;
 @@ -128,6 +132,24 @@
  	options->adm_forced_command = NULL;
  	options->chroot_directory = NULL;
  	options->zero_knowledge_password_authentication = -1;
 +#ifdef WITH_LDAP_PUBKEY
-+	/* XXX dirty */
-+	options->lpk.ld = NULL;
-+	options->lpk.on = -1;
-+	options->lpk.servers = NULL;
-+	options->lpk.u_basedn = NULL;
-+	options->lpk.g_basedn = NULL;
-+	options->lpk.binddn = NULL;
-+	options->lpk.bindpw = NULL;
-+	options->lpk.sgroup = NULL;
-+	options->lpk.filter = NULL;
-+	options->lpk.fgroup = NULL;
-+	options->lpk.l_conf = NULL;
-+	options->lpk.tls = -1;
-+	options->lpk.b_timeout.tv_sec = -1;
-+	options->lpk.s_timeout.tv_sec = -1;
-+	options->lpk.flags = FLAG_EMPTY;
++ 	/* XXX dirty */
++ 	options->lpk.ld = NULL;
++ 	options->lpk.on = -1;
++ 	options->lpk.servers = NULL;
++ 	options->lpk.u_basedn = NULL;
++ 	options->lpk.g_basedn = NULL;
++ 	options->lpk.binddn = NULL;
++ 	options->lpk.bindpw = NULL;
++ 	options->lpk.sgroup = NULL;
++ 	options->lpk.filter = NULL;
++ 	options->lpk.fgroup = NULL;
++ 	options->lpk.l_conf = NULL;
++ 	options->lpk.tls = -1;
++ 	options->lpk.b_timeout.tv_sec = -1;
++ 	options->lpk.s_timeout.tv_sec = -1;
++ 	options->lpk.flags = FLAG_EMPTY;
 +#endif
  }
  
diff --git a/security/openssh-portable/files/openssh-lpk-5.0p1-0.3.9.patch b/security/openssh-portable/files/contrib-openssh-lpk-5.1p1-0.3.10.patch
index 24357dfcede2..47402f246da7 100644
--- a/security/openssh-portable/files/openssh-lpk-5.0p1-0.3.9.patch
+++ b/security/openssh-portable/files/contrib-openssh-lpk-5.1p1-0.3.10.patch
@@ -1,292 +1,118 @@
-#
-# Based on: http://dev.inversepath.com/openssh-lpk/openssh-lpk-4.6p1-0.3.9.patch
-#
---- Makefile.in.orig	2008-03-12 22:41:31.000000000 -0300
-+++ Makefile.in	2008-04-17 21:25:41.000000000 -0300
-@@ -86,7 +86,7 @@
- 	auth-krb5.o \
- 	auth2-gss.o gss-serv.o gss-serv-krb5.o \
- 	loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o \
--	audit.o audit-bsm.o platform.o sftp-server.o sftp-common.o
-+	audit.o audit-bsm.o platform.o sftp-server.o sftp-common.o ldapauth.o
+This is a forward-port of the OpenSSH LPK support patch.
+
+It adds support for storing OpenSSH public keys in LDAP. It also supports
+grouping of machines in the LDAP data to limit users to specific machines.
+
+The latest homepage for the LPK project is:
+http://code.google.com/p/openssh-lpk/
+
+The 0.3.10 version of the patch includes a fix for 64-bit platforms, as
+discovered by Gentoo, where the bind timeout and search timeout values were not
+being parsed correctly: http://bugs.gentoo.org/210110
+
+Forward-ported-from: openssh-lpk-5.1p1-0.3.9.patch
+Signed-off-by: Robin H. Johnson <robbat2@gentoo.org>
+
+diff -Nuar --exclude '*.orig' --exclude '*.rej' auth2-pubkey.c auth2-pubkey.c
+--- auth2-pubkey.c	2008-07-03 19:54:25.000000000 -0700
++++ auth2-pubkey.c	2008-08-23 15:02:47.000000000 -0700
+@@ -55,6 +55,10 @@
+ #include "monitor_wrap.h"
+ #include "misc.h"
  
- MANPAGES	= scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-rand-helper.8.out ssh-keysign.8.out sshd_config.5.out ssh_config.5.out
- MANPAGES_IN	= scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-rand-helper.8 ssh-keysign.8 sshd_config.5 ssh_config.5
---- README.lpk.orig	2008-04-17 21:24:57.000000000 -0300
-+++ README.lpk	2008-04-17 21:24:57.000000000 -0300
-@@ -0,0 +1,267 @@
-+OpenSSH LDAP PUBLIC KEY PATCH 
-+Copyright (c) 2003 Eric AUGE (eau@phear.org)
-+All rights reserved.
-+
-+Redistribution and use in source and binary forms, with or without
-+modification, are permitted provided that the following conditions
-+are met:
-+1. Redistributions of source code must retain the above copyright
-+   notice, this list of conditions and the following disclaimer.
-+2. Redistributions in binary form must reproduce the above copyright
-+   notice, this list of conditions and the following disclaimer in the
-+   documentation and/or other materials provided with the distribution.
-+3. The name of the author may not be used to endorse or promote products
-+   derived from this software without specific prior written permission.
-+
-+THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-+IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-+OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-+IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-+INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-+NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-+THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-+
-+purposes of this patch:
-+
-+This patch would help to have authentication centralization policy
-+using ssh public key authentication.
-+This patch could be an alternative to other "secure" authentication system
-+working in a similar way (Kerberos, SecurID, etc...), except the fact 
-+that it's based on OpenSSH and its public key abilities.
-+
-+>> FYI: <<
-+'uid': means unix accounts existing on the current server
-+'lpkServerGroup:' mean server group configured on the current server ('lpkServerGroup' in sshd_config)
-+
-+example schema:
-+
-+
-+                                  server1 (uid: eau,rival,toto) (lpkServerGroup: unix)
-+                ___________      /
-+               /           \ --- - server3 (uid: eau, titi) (lpkServerGroup: unix)
-+              | LDAP Server |    \
-+	      | eau  ,rival |     server2 (uid: rival, eau) (lpkServerGroup: unix)
-+	      | titi ,toto  |
-+	      | userx,....  |         server5 (uid: eau)  (lpkServerGroup: mail)
-+               \___________/ \       /
-+	                       ----- - server4 (uid: eau, rival)  (no group configured)
-+			             \
-+				        etc...
-+
-+- WHAT WE NEED :
-+
-+  * configured LDAP server somewhere on the network (i.e. OpenLDAP)
-+  * patched sshd (with this patch ;)
-+  * LDAP user(/group) entry (look at users.ldif (& groups.ldif)):
-+        User entry:
-+	- attached to the 'ldapPublicKey' objectclass
-+	- attached to the 'posixAccount' objectclass
-+	- with a filled 'sshPublicKey' attribute 
-+	Example:
-+		dn: uid=eau,ou=users,dc=cuckoos,dc=net
-+		objectclass: top
-+		objectclass: person
-+		objectclass: organizationalPerson
-+		objectclass: posixAccount
-+		objectclass: ldapPublicKey
-+		description: Eric AUGE Account
-+		userPassword: blah
-+		cn: Eric AUGE
-+		sn: Eric AUGE
-+		uid: eau
-+		uidNumber: 1034
-+		gidNumber: 1
-+		homeDirectory: /export/home/eau
-+		sshPublicKey: ssh-dss AAAAB3...
-+		sshPublicKey: ssh-dss AAAAM5...
-+
-+	Group entry:
-+	- attached to the 'posixGroup' objectclass
-+	- with a 'cn' groupname attribute
-+	- with multiple 'memberUid' attributes filled with usernames allowed in this group
-+	Example:
-+		# few members
-+		dn: cn=unix,ou=groups,dc=cuckoos,dc=net
-+		objectclass: top
-+		objectclass: posixGroup
-+		description: Unix based servers group
-+		cn: unix
-+		gidNumber: 1002
-+		memberUid: eau
-+		memberUid: user1
-+		memberUid: user2
-+
-+
-+- HOW IT WORKS :
-+
-+  * without patch
-+  If a user wants to authenticate to log in a server the sshd, will first look for authentication method allowed (RSAauth,kerberos,etc..)
-+  and if RSAauth and tickets based auth fails, it will fallback to standard password authentication (if enabled).
-+
-+  * with the patch
-+  If a user want to authenticate to log in a server, the sshd will first look for auth method including LDAP pubkey, if the ldappubkey options is enabled.
-+  It will do an ldapsearch to get the public key directly from the LDAP instead of reading it from the server filesystem. 
-+  (usually in $HOME/.ssh/authorized_keys)
-+
-+  If groups are enabled, it will also check if the user that wants to login is in the group of the server he is trying to log into.
-+  If it fails, it falls back on RSA auth files ($HOME/.ssh/authorized_keys), etc.. and finally to standard password authentication (if enabled).
-+
-+  7 tokens are added to sshd_config :
-+  # here is the new patched ldap related tokens
-+  # entries in your LDAP must be posixAccount & strongAuthenticationUser & posixGroup
-+  UseLPK yes								# look the pub key into LDAP
-+  LpkServers ldap://10.31.32.5/ ldap://10.31.32.4 ldap://10.31.32.3	# which LDAP server for users ? (URL format)
-+  LpkUserDN  ou=users,dc=foobar,dc=net					# which base DN for users ?
-+  LpkGroupDN ou=groups,dc=foobar,dc=net					# which base DN for groups ? 
-+  LpkBindDN cn=manager,dc=foobar,dc=net					# which bind DN ?
-+  LpkBindPw asecret							# bind DN credidentials
-+  LpkServerGroup agroupname						# the group the server is part of
-+
-+  Right now i'm using anonymous binding to get public keys, because getting public keys of someone doesn't impersonate him¸ but there is some
-+  flaws you have to take care of.
-+
-+- HOW TO INSERT A USER/KEY INTO AN LDAP ENTRY
-+
-+  * my way (there is plenty :)
-+  - create ldif file (i.e. users.ldif)
-+  - cat ~/.ssh/id_dsa.pub OR cat ~/.ssh/id_rsa.pub OR cat ~/.ssh/identity.pub
-+  - my way in 4 steps :
-+  Example:
-+
-+  # you add this to the user entry in the LDIF file :
-+  [...]
-+  objectclass: posixAccount
-+  objectclass: ldapPublicKey
-+  [...]
-+  sshPubliKey: ssh-dss AAAABDh12DDUR2...
-+  [...]
-+
-+  # insert your entry and you're done :)
-+  ldapadd -D balblabla -w bleh < file.ldif 
-+  
-+  all standard options can be present in the 'sshPublicKey' attribute.
-+
-+- WHY :
-+
-+  Simply because, i was looking for a way to centralize all sysadmins authentication, easily,  without completely using LDAP 
-+  as authentication method (like pam_ldap etc..).  
-+  
-+  After looking into Kerberos, SecurID, and other centralized secure authentications systems, the use of RSA and LDAP to get 
-+  public key for authentication allows us to control who has access to which server (the user needs an account and to be in 'strongAuthenticationUser'
-+  objectclass within LDAP and part of the group the SSH server is in). 
-+
-+  Passwords update are no longer a nightmare for a server farm (key pair passphrase is stored on each user's box and private key is locally encrypted using his passphrase 
-+  so each user can change it as much as he wants). 
-+
-+  Blocking a user account can be done directly from the LDAP (if sshd is using RSAAuth + ldap only).
-+
-+- RULES :  
-+  Entry in the LDAP server must respect 'posixAccount' and 'ldapPublicKey' which are defined in core.schema. 
-+  and the additionnal lpk.schema.
-+
-+  This patch could allow a smooth transition between standard auth (/etc/passwd) and complete LDAP based authentication 
-+  (pamldap, nss_ldap, etc..).
-+
-+  This can be an alternative to other (old?/expensive?) authentication methods (Kerberos/SecurID/..).
-+  
-+  Referring to schema at the beginning of this file if user 'eau' is only in group 'unix'
-+  'eau' would ONLY access 'server1', 'server2', 'server3' AND 'server4' BUT NOT 'server5'.
-+  If you then modify the LDAP 'mail' group entry to add 'memberUid: eau' THEN user 'eau' would be able
-+  to log in 'server5' (i hope you got the idea, my english is bad :).
-+
-+  Each server's sshd is patched and configured to ask the public key and the group infos in the LDAP
-+  server.
-+  When you want to allow a new user to have access to the server parc, you just add him an account on 
-+  your servers, you add his public key into his entry on the LDAP server, it's done. 
-+
-+  Because sshds are looking public keys into the LDAP directly instead of a file ($HOME/.ssh/authorized_keys).
++#ifdef WITH_LDAP_PUBKEY
++#include "ldapauth.h"
++#endif
 +
-+  When the user needs to change his passphrase he can do it directly from his workstation by changing 
-+  his own key set lock passphrase, and all servers are automatically aware.
+ /* import */
+ extern ServerOptions options;
+ extern u_char *session_id2;
+@@ -187,10 +191,79 @@
+ 	u_long linenum = 0;
+ 	Key *found;
+ 	char *fp;
++#ifdef WITH_LDAP_PUBKEY
++	ldap_key_t * k;
++	unsigned int i = 0;
++#endif
+ 
+ 	/* Temporarily use the user's uid. */
+ 	temporarily_use_uid(pw);
+ 
++#ifdef WITH_LDAP_PUBKEY
++ 	found_key = 0;
++ 	/* allocate a new key type */
++ 	found = key_new(key->type);
 + 
-+  With a CAREFUL LDAP server configuration you could allow a user to add/delete/modify his own entry himself
-+  so he can add/modify/delete himself his public key when needed.
-+
-+­ FLAWS :
-+  LDAP must be well configured, getting the public key of some user is not a problem, but if anonymous LDAP 
-+  allow write to users dn, somebody could replace someuser's public key by its own and impersonate some 
-+  of your users in all your server farm be VERY CAREFUL.
-+  
-+  MITM attack when sshd is requesting the public key, could lead to a compromise of your servers allowing login 
-+  as the impersonnated user.
-+
-+  If LDAP server is down then, fallback on passwd auth.
-+  
-+  the ldap code part has not been well audited yet.
-+
-+- LDAP USER ENTRY EXAMPLES (LDIF Format, look in users.ldif)
-+    --- CUT HERE ---
-+    dn: uid=jdoe,ou=users,dc=foobar,dc=net
-+    objectclass: top
-+    objectclass: person
-+    objectclass: organizationalPerson
-+    objectclass: posixAccount
-+    objectclass: ldapPublicKey
-+    description: My account
-+    cn: John Doe
-+    sn: John Doe
-+    uid: jdoe
-+    uidNumber: 100
-+    gidNumber: 100
-+    homeDirectory: /home/jdoe
-+    sshPublicKey: ssh-dss AAAAB3NzaC1kc3MAAAEBAOvL8pREUg9wSy/8+hQJ54YF3AXkB0OZrXB....
-+    [...]
-+    --- CUT HERE ---
-+
-+- LDAP GROUP ENTRY EXAMPLES (LDIF Format, look in groups.ldif)
-+    --- CUT HERE ---
-+    dn: cn=unix,ou=groups,dc=cuckoos,dc=net
-+    objectclass: top
-+    objectclass: posixGroup
-+    description: Unix based servers group
-+    cn: unix
-+    gidNumber: 1002
-+    memberUid: jdoe
-+    memberUid: user1
-+    memberUid: user2
-+    [...]
-+    --- CUT HERE ---
-+
-+>> FYI: << 
-+Multiple 'sshPublicKey' in a user entry are allowed, as well as multiple 'memberUid' attributes in a group entry
-+
-+- COMPILING:
-+  1. Apply the patch
-+  2. ./configure --with-your-options --with-ldap=/prefix/to/ldap_libs_and_includes
-+  3. make
-+  4. it's done.
++ 	/* first check if the options is enabled, then try.. */
++	if (options.lpk.on) {
++	    debug("[LDAP] trying LDAP first uid=%s",pw->pw_name);
++	    if (ldap_ismember(&options.lpk, pw->pw_name) > 0) {
++		if ((k = ldap_getuserkey(&options.lpk, pw->pw_name)) != NULL) {
++		    /* Skip leading whitespace, empty and comment lines. */
++		    for (i = 0 ; i < k->num ; i++) {
++			/* dont forget if multiple keys to reset options */
++			char *cp, *options = NULL;
 +
-+- BLA :
-+  I hope this could help, and i hope to be clear enough,, or give ideas.  questions/comments/improvements are welcome.
-+  
-+- TODO :
-+  Redesign differently.
++			for (cp = (char *)k->keys[i]->bv_val; *cp == ' ' || *cp == '\t'; cp++)
++			    ;
++			if (!*cp || *cp == '\n' || *cp == '#')
++			    continue;
 +
-+- DOCS/LINK :
-+  http://pacsec.jp/core05/psj05-barisani-en.pdf
-+  http://fritz.potsdam.edu/projects/openssh-lpk/
-+  http://fritz.potsdam.edu/projects/sshgate/
-+  http://dev.inversepath.com/trac/openssh-lpk
-+  http://lam.sf.net/ ( http://lam.sourceforge.net/documentation/supportedSchemas.htm )
++			if (key_read(found, &cp) != 1) {
++			    /* no key?  check if there are options for this key */
++			    int quoted = 0;
++			    debug2("[LDAP] user_key_allowed: check options: '%s'", cp);
++			    options = cp;
++			    for (; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) {
++				if (*cp == '\\' && cp[1] == '"')
++				    cp++;	/* Skip both */
++				else if (*cp == '"')
++				    quoted = !quoted;
++			    }
++			    /* Skip remaining whitespace. */
++			    for (; *cp == ' ' || *cp == '\t'; cp++)
++				;
++			    if (key_read(found, &cp) != 1) {
++				debug2("[LDAP] user_key_allowed: advance: '%s'", cp);
++				/* still no key?  advance to next line*/
++				continue;
++			    }
++			}
 +
-+- CONTRIBUTORS/IDEAS/GREETS :
-+  - Falk Siemonsmeier.
-+  - Jacob Rief.
-+  - Michael Durchgraf.
-+  - frederic peters.
-+  - Finlay dobbie.
-+  - Stefan Fisher.
-+  - Robin H. Johnson.
-+  - Adrian Bridgett.
++			if (key_equal(found, key) &&
++				auth_parse_options(pw, options, file, linenum) == 1) {
++			    found_key = 1;
++			    debug("[LDAP] matching key found");
++			    fp = key_fingerprint(found, SSH_FP_MD5, SSH_FP_HEX);
++			    verbose("[LDAP] Found matching %s key: %s", key_type(found), fp);
 +
-+- CONTACT :
-+  - Eric AUGE <eau@phear.org>
-+  - Andrea Barisani <andrea@inversepath.com>
---- auth-rsa.c.orig	2006-11-07 10:14:42.000000000 -0200
-+++ auth-rsa.c	2008-04-17 21:24:57.000000000 -0300
-@@ -175,10 +175,96 @@
++			    /* restoring memory */
++			    ldap_keys_free(k);
++			    xfree(fp);
++			    restore_uid();
++			    key_free(found);
++			    return found_key;
++			    break;
++			}
++		    }/* end of LDAP for() */
++		} else {
++		    logit("[LDAP] no keys found for '%s'!", pw->pw_name);
++		}
++	    } else {
++		logit("[LDAP] '%s' is not in '%s'", pw->pw_name, options.lpk.sgroup);
++	    }
++	}
++#endif
+ 	debug("trying public key file %s", file);
+ 	f = auth_openkeyfile(file, pw, options.strict_modes);
+ 
+diff -Nuar --exclude '*.orig' --exclude '*.rej' auth-rsa.c auth-rsa.c
+--- auth-rsa.c	2008-07-02 05:37:30.000000000 -0700
++++ auth-rsa.c	2008-08-23 15:02:47.000000000 -0700
+@@ -174,10 +174,96 @@
+ 	FILE *f;
  	u_long linenum = 0;
- 	struct stat st;
  	Key *key;
 +#ifdef WITH_LDAP_PUBKEY
 +	ldap_key_t * k;
@@ -381,102 +207,10 @@
  	/* The authorized keys. */
  	file = authorized_keys_file(pw);
  	debug("trying public RSA key file %s", file);
---- auth2-pubkey.c.orig	2006-08-04 23:39:39.000000000 -0300
-+++ auth2-pubkey.c	2008-04-17 21:24:57.000000000 -0300
-@@ -53,6 +53,10 @@
- #include "monitor_wrap.h"
- #include "misc.h"
- 
-+#ifdef WITH_LDAP_PUBKEY
-+#include "ldapauth.h"
-+#endif
-+
- /* import */
- extern ServerOptions options;
- extern u_char *session_id2;
-@@ -186,10 +190,79 @@
- 	struct stat st;
- 	Key *found;
- 	char *fp;
-+#ifdef WITH_LDAP_PUBKEY
-+	ldap_key_t * k;
-+	unsigned int i = 0;
-+#endif
- 
- 	/* Temporarily use the user's uid. */
- 	temporarily_use_uid(pw);
- 
-+#ifdef WITH_LDAP_PUBKEY
-+ 	found_key = 0;
-+ 	/* allocate a new key type */
-+ 	found = key_new(key->type);
-+ 
-+ 	/* first check if the options is enabled, then try.. */
-+	if (options.lpk.on) {
-+	    debug("[LDAP] trying LDAP first uid=%s",pw->pw_name);
-+	    if (ldap_ismember(&options.lpk, pw->pw_name) > 0) {
-+		if ((k = ldap_getuserkey(&options.lpk, pw->pw_name)) != NULL) {
-+		    /* Skip leading whitespace, empty and comment lines. */
-+		    for (i = 0 ; i < k->num ; i++) {
-+			/* dont forget if multiple keys to reset options */
-+			char *cp, *options = NULL;
-+
-+			for (cp = (char *)k->keys[i]->bv_val; *cp == ' ' || *cp == '\t'; cp++)
-+			    ;
-+			if (!*cp || *cp == '\n' || *cp == '#')
-+			    continue;
-+
-+			if (key_read(found, &cp) != 1) {
-+			    /* no key?  check if there are options for this key */
-+			    int quoted = 0;
-+			    debug2("[LDAP] user_key_allowed: check options: '%s'", cp);
-+			    options = cp;
-+			    for (; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) {
-+				if (*cp == '\\' && cp[1] == '"')
-+				    cp++;	/* Skip both */
-+				else if (*cp == '"')
-+				    quoted = !quoted;
-+			    }
-+			    /* Skip remaining whitespace. */
-+			    for (; *cp == ' ' || *cp == '\t'; cp++)
-+				;
-+			    if (key_read(found, &cp) != 1) {
-+				debug2("[LDAP] user_key_allowed: advance: '%s'", cp);
-+				/* still no key?  advance to next line*/
-+				continue;
-+			    }
-+			}
-+
-+			if (key_equal(found, key) &&
-+				auth_parse_options(pw, options, file, linenum) == 1) {
-+			    found_key = 1;
-+			    debug("[LDAP] matching key found");
-+			    fp = key_fingerprint(found, SSH_FP_MD5, SSH_FP_HEX);
-+			    verbose("[LDAP] Found matching %s key: %s", key_type(found), fp);
-+
-+			    /* restoring memory */
-+			    ldap_keys_free(k);
-+			    xfree(fp);
-+			    restore_uid();
-+			    key_free(found);
-+			    return found_key;
-+			    break;
-+			}
-+		    }/* end of LDAP for() */
-+		} else {
-+		    logit("[LDAP] no keys found for '%s'!", pw->pw_name);
-+		}
-+	    } else {
-+		logit("[LDAP] '%s' is not in '%s'", pw->pw_name, options.lpk.sgroup);
-+	    }
-+	}
-+#endif
- 	debug("trying public key file %s", file);
- 
- 	/* Fail quietly if file does not exist */
---- config.h.in.orig	2008-04-03 07:01:49.000000000 -0300
-+++ config.h.in	2008-04-17 21:24:57.000000000 -0300
-@@ -539,6 +539,9 @@
+diff -Nuar --exclude '*.orig' --exclude '*.rej' config.h.in config.h.in
+--- config.h.in	2008-07-21 01:30:49.000000000 -0700
++++ config.h.in	2008-08-23 15:02:47.000000000 -0700
+@@ -560,6 +560,9 @@
  /* Define to 1 if you have the <linux/if_tun.h> header file. */
  #undef HAVE_LINUX_IF_TUN_H
  
@@ -486,57 +220,10 @@
  /* Define if your libraries define login() */
  #undef HAVE_LOGIN
  
---- configure.ac.orig	2008-03-26 22:33:07.000000000 -0300
-+++ configure.ac	2008-04-17 21:24:57.000000000 -0300
-@@ -1285,6 +1285,37 @@
- 	esac ]
- )
- 
-+# Check whether user wants LDAP support
-+LDAP_MSG="no"
-+AC_ARG_WITH(ldap,
-+	[  --with-ldap[[=PATH]]      Enable LDAP pubkey support (optionally in PATH)],
-+	[
-+		if test "x$withval" != "xno" ; then
-+
-+			if test "x$withval" != "xyes" ; then
-+				CPPFLAGS="$CPPFLAGS -I${withval}/include"
-+				LDFLAGS="$LDFLAGS -L${withval}/lib"
-+			fi
-+
-+			AC_DEFINE([WITH_LDAP_PUBKEY], 1, [Enable LDAP pubkey support])
-+			LIBS="-lldap $LIBS"
-+			LDAP_MSG="yes"
-+	
-+			AC_MSG_CHECKING([for LDAP support])
-+			AC_TRY_COMPILE(
-+				[#include <sys/types.h>
-+				 #include <ldap.h>],
-+				[(void)ldap_init(0, 0);],
-+				[AC_MSG_RESULT(yes)],
-+				[
-+				    AC_MSG_RESULT(no) 
-+					AC_MSG_ERROR([** Incomplete or missing ldap libraries **])
-+				]
-+        	)
-+		fi
-+	]
-+)
-+
- dnl    Checks for library functions. Please keep in alphabetical order
- AC_CHECK_FUNCS( \
- 	arc4random \
-@@ -4089,6 +4120,7 @@
- echo "                 Smartcard support: $SCARD_MSG"
- echo "                     S/KEY support: $SKEY_MSG"
- echo "              TCP Wrappers support: $TCPW_MSG"
-+echo "                      LDAP support: $LDAP_MSG"
- echo "              MD5 password support: $MD5_MSG"
- echo "                   libedit support: $LIBEDIT_MSG"
- echo "  Solaris process contract support: $SPC_MSG"
---- configure.orig	2008-04-03 07:01:50.000000000 -0300
-+++ configure	2008-04-17 21:24:57.000000000 -0300
-@@ -1339,6 +1339,7 @@
+diff -Nuar --exclude '*.orig' --exclude '*.rej' configure configure
+--- configure	2008-07-21 01:30:50.000000000 -0700
++++ configure	2008-08-23 15:02:47.000000000 -0700
+@@ -1340,6 +1340,7 @@
    --with-tcp-wrappers[=PATH] Enable tcpwrappers support (optionally in PATH)
    --with-libedit[=PATH]   Enable libedit support for sftp
    --with-audit=module     Enable EXPERIMENTAL audit support (modules=debug,bsm)
@@ -544,7 +231,7 @@
    --with-ssl-dir=PATH     Specify path to OpenSSL installation
    --without-openssl-header-check Disable OpenSSL version consistency check
    --with-ssl-engine       Enable OpenSSL (hardware) ENGINE support
-@@ -12514,6 +12515,85 @@
+@@ -12568,6 +12569,85 @@
  fi
  
  
@@ -630,7 +317,56 @@
  
  
  
-@@ -29860,6 +29940,7 @@
+@@ -30135,6 +30215,7 @@
+ echo "                 Smartcard support: $SCARD_MSG"
+ echo "                     S/KEY support: $SKEY_MSG"
+ echo "              TCP Wrappers support: $TCPW_MSG"
++echo "                      LDAP support: $LDAP_MSG"
+ echo "              MD5 password support: $MD5_MSG"
+ echo "                   libedit support: $LIBEDIT_MSG"
+ echo "  Solaris process contract support: $SPC_MSG"
+diff -Nuar --exclude '*.orig' --exclude '*.rej' configure.ac configure.ac
+--- configure.ac	2008-07-09 04:07:19.000000000 -0700
++++ configure.ac	2008-08-23 15:02:47.000000000 -0700
+@@ -1299,6 +1299,37 @@
+ 	esac ]
+ )
+ 
++# Check whether user wants LDAP support
++LDAP_MSG="no"
++AC_ARG_WITH(ldap,
++	[  --with-ldap[[=PATH]]      Enable LDAP pubkey support (optionally in PATH)],
++	[
++		if test "x$withval" != "xno" ; then
++
++			if test "x$withval" != "xyes" ; then
++				CPPFLAGS="$CPPFLAGS -I${withval}/include"
++				LDFLAGS="$LDFLAGS -L${withval}/lib"
++			fi
++
++			AC_DEFINE([WITH_LDAP_PUBKEY], 1, [Enable LDAP pubkey support])
++			LIBS="-lldap $LIBS"
++			LDAP_MSG="yes"
++	
++			AC_MSG_CHECKING([for LDAP support])
++			AC_TRY_COMPILE(
++				[#include <sys/types.h>
++				 #include <ldap.h>],
++				[(void)ldap_init(0, 0);],
++				[AC_MSG_RESULT(yes)],
++				[
++				    AC_MSG_RESULT(no) 
++					AC_MSG_ERROR([** Incomplete or missing ldap libraries **])
++				]
++        	)
++		fi
++	]
++)
++
+ dnl    Checks for library functions. Please keep in alphabetical order
+ AC_CHECK_FUNCS( \
+ 	arc4random \
+@@ -4137,6 +4168,7 @@
  echo "                 Smartcard support: $SCARD_MSG"
  echo "                     S/KEY support: $SKEY_MSG"
  echo "              TCP Wrappers support: $TCPW_MSG"
@@ -638,8 +374,9 @@
  echo "              MD5 password support: $MD5_MSG"
  echo "                   libedit support: $LIBEDIT_MSG"
  echo "  Solaris process contract support: $SPC_MSG"
---- ldapauth.c.orig	2008-04-17 21:24:57.000000000 -0300
-+++ ldapauth.c	2008-04-17 21:24:57.000000000 -0300
+diff -Nuar --exclude '*.orig' --exclude '*.rej' ldapauth.c ldapauth.c
+--- ldapauth.c	1969-12-31 16:00:00.000000000 -0800
++++ ldapauth.c	2008-08-23 15:02:47.000000000 -0700
 @@ -0,0 +1,575 @@
 +/* 
 + * $Id: openssh-lpk-4.3p1-0.3.7.patch,v 1.3 2006/04/18 15:29:09 eau Exp $
@@ -1216,8 +953,9 @@
 +}
 +
 +#endif /* WITH_LDAP_PUBKEY */
---- ldapauth.h.orig	2008-04-17 21:24:57.000000000 -0300
-+++ ldapauth.h	2008-04-17 21:24:57.000000000 -0300
+diff -Nuar --exclude '*.orig' --exclude '*.rej' ldapauth.h ldapauth.h
+--- ldapauth.h	1969-12-31 16:00:00.000000000 -0800
++++ ldapauth.h	2008-08-23 15:02:47.000000000 -0700
 @@ -0,0 +1,124 @@
 +/*
 + * $Id: openssh-lpk-4.3p1-0.3.7.patch,v 1.3 2006/04/18 15:29:09 eau Exp $ 
@@ -1343,8 +1081,9 @@
 +int ldap_ismember(ldap_opt_t *, const char *);
 +
 +#endif
---- lpk-user-example.txt.orig	2008-04-17 21:24:57.000000000 -0300
-+++ lpk-user-example.txt	2008-04-17 21:24:57.000000000 -0300
+diff -Nuar --exclude '*.orig' --exclude '*.rej' lpk-user-example.txt lpk-user-example.txt
+--- lpk-user-example.txt	1969-12-31 16:00:00.000000000 -0800
++++ lpk-user-example.txt	2008-08-23 15:02:47.000000000 -0700
 @@ -0,0 +1,117 @@
 +
 +Post to ML -> User Made Quick Install Doc.
@@ -1463,8 +1202,21 @@
 +puTTY). Login should succeed.
 +
 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
---- openssh-lpk_openldap.schema.orig	2008-04-17 21:24:57.000000000 -0300
-+++ openssh-lpk_openldap.schema	2008-04-17 21:24:57.000000000 -0300
+diff -Nuar --exclude '*.orig' --exclude '*.rej' Makefile.in Makefile.in
+--- Makefile.in	2008-07-08 07:21:12.000000000 -0700
++++ Makefile.in	2008-08-23 15:02:47.000000000 -0700
+@@ -86,7 +86,7 @@
+ 	auth-krb5.o \
+ 	auth2-gss.o gss-serv.o gss-serv-krb5.o \
+ 	loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o \
+-	audit.o audit-bsm.o platform.o sftp-server.o sftp-common.o
++	audit.o audit-bsm.o platform.o ldapauth.o sftp-server.o sftp-common.o
+ 
+ MANPAGES	= moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-rand-helper.8.out ssh-keysign.8.out sshd_config.5.out ssh_config.5.out
+ MANPAGES_IN	= moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-rand-helper.8 ssh-keysign.8 sshd_config.5 ssh_config.5
+diff -Nuar --exclude '*.orig' --exclude '*.rej' openssh-lpk_openldap.schema openssh-lpk_openldap.schema
+--- openssh-lpk_openldap.schema	1969-12-31 16:00:00.000000000 -0800
++++ openssh-lpk_openldap.schema	2008-08-23 15:02:47.000000000 -0700
 @@ -0,0 +1,19 @@
 +#
 +# LDAP Public Key Patch schema for use with openssh-ldappubkey
@@ -1485,8 +1237,9 @@
 +	DESC 'MANDATORY: OpenSSH LPK objectclass'
 +	MUST ( sshPublicKey $ uid ) 
 +	)
---- openssh-lpk_sun.schema.orig	2008-04-17 21:24:57.000000000 -0300
-+++ openssh-lpk_sun.schema	2008-04-17 21:24:57.000000000 -0300
+diff -Nuar --exclude '*.orig' --exclude '*.rej' openssh-lpk_sun.schema openssh-lpk_sun.schema
+--- openssh-lpk_sun.schema	1969-12-31 16:00:00.000000000 -0800
++++ openssh-lpk_sun.schema	2008-08-23 15:02:47.000000000 -0700
 @@ -0,0 +1,21 @@
 +#
 +# LDAP Public Key Patch schema for use with openssh-ldappubkey
@@ -1509,9 +1262,306 @@
 +	DESC 'MANDATORY: OpenSSH LPK objectclass'
 +	MUST ( sshPublicKey $ uid ) 
 +	)
---- sshd.c.orig	2008-03-11 08:58:25.000000000 -0300
-+++ sshd.c	2008-04-17 21:24:57.000000000 -0300
-@@ -126,6 +126,10 @@
+diff -Nuar --exclude '*.orig' --exclude '*.rej' README.lpk README.lpk
+--- README.lpk	1969-12-31 16:00:00.000000000 -0800
++++ README.lpk	2008-08-23 15:02:47.000000000 -0700
+@@ -0,0 +1,267 @@
++OpenSSH LDAP PUBLIC KEY PATCH 
++Copyright (c) 2003 Eric AUGE (eau@phear.org)
++All rights reserved.
++
++Redistribution and use in source and binary forms, with or without
++modification, are permitted provided that the following conditions
++are met:
++1. Redistributions of source code must retain the above copyright
++   notice, this list of conditions and the following disclaimer.
++2. Redistributions in binary form must reproduce the above copyright
++   notice, this list of conditions and the following disclaimer in the
++   documentation and/or other materials provided with the distribution.
++3. The name of the author may not be used to endorse or promote products
++   derived from this software without specific prior written permission.
++
++THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
++IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
++OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
++IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
++INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
++DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
++THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
++(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
++THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
++
++purposes of this patch:
++
++This patch would help to have authentication centralization policy
++using ssh public key authentication.
++This patch could be an alternative to other "secure" authentication system
++working in a similar way (Kerberos, SecurID, etc...), except the fact 
++that it's based on OpenSSH and its public key abilities.
++
++>> FYI: <<
++'uid': means unix accounts existing on the current server
++'lpkServerGroup:' mean server group configured on the current server ('lpkServerGroup' in sshd_config)
++
++example schema:
++
++
++                                  server1 (uid: eau,rival,toto) (lpkServerGroup: unix)
++                ___________      /
++               /           \ --- - server3 (uid: eau, titi) (lpkServerGroup: unix)
++              | LDAP Server |    \
++	      | eau  ,rival |     server2 (uid: rival, eau) (lpkServerGroup: unix)
++	      | titi ,toto  |
++	      | userx,....  |         server5 (uid: eau)  (lpkServerGroup: mail)
++               \___________/ \       /
++	                       ----- - server4 (uid: eau, rival)  (no group configured)
++			             \
++				        etc...
++
++- WHAT WE NEED :
++
++  * configured LDAP server somewhere on the network (i.e. OpenLDAP)
++  * patched sshd (with this patch ;)
++  * LDAP user(/group) entry (look at users.ldif (& groups.ldif)):
++        User entry:
++	- attached to the 'ldapPublicKey' objectclass
++	- attached to the 'posixAccount' objectclass
++	- with a filled 'sshPublicKey' attribute 
++	Example:
++		dn: uid=eau,ou=users,dc=cuckoos,dc=net
++		objectclass: top
++		objectclass: person
++		objectclass: organizationalPerson
++		objectclass: posixAccount
++		objectclass: ldapPublicKey
++		description: Eric AUGE Account
++		userPassword: blah
++		cn: Eric AUGE
++		sn: Eric AUGE
++		uid: eau
++		uidNumber: 1034
++		gidNumber: 1
++		homeDirectory: /export/home/eau
++		sshPublicKey: ssh-dss AAAAB3...
++		sshPublicKey: ssh-dss AAAAM5...
++
++	Group entry:
++	- attached to the 'posixGroup' objectclass
++	- with a 'cn' groupname attribute
++	- with multiple 'memberUid' attributes filled with usernames allowed in this group
++	Example:
++		# few members
++		dn: cn=unix,ou=groups,dc=cuckoos,dc=net
++		objectclass: top
++		objectclass: posixGroup
++		description: Unix based servers group
++		cn: unix
++		gidNumber: 1002
++		memberUid: eau
++		memberUid: user1
++		memberUid: user2
++
++
++- HOW IT WORKS :
++
++  * without patch
++  If a user wants to authenticate to log in a server the sshd, will first look for authentication method allowed (RSAauth,kerberos,etc..)
++  and if RSAauth and tickets based auth fails, it will fallback to standard password authentication (if enabled).
++
++  * with the patch
++  If a user want to authenticate to log in a server, the sshd will first look for auth method including LDAP pubkey, if the ldappubkey options is enabled.
++  It will do an ldapsearch to get the public key directly from the LDAP instead of reading it from the server filesystem. 
++  (usually in $HOME/.ssh/authorized_keys)
++
++  If groups are enabled, it will also check if the user that wants to login is in the group of the server he is trying to log into.
++  If it fails, it falls back on RSA auth files ($HOME/.ssh/authorized_keys), etc.. and finally to standard password authentication (if enabled).
++
++  7 tokens are added to sshd_config :
++  # here is the new patched ldap related tokens
++  # entries in your LDAP must be posixAccount & strongAuthenticationUser & posixGroup
++  UseLPK yes								# look the pub key into LDAP
++  LpkServers ldap://10.31.32.5/ ldap://10.31.32.4 ldap://10.31.32.3	# which LDAP server for users ? (URL format)
++  LpkUserDN  ou=users,dc=foobar,dc=net					# which base DN for users ?
++  LpkGroupDN ou=groups,dc=foobar,dc=net					# which base DN for groups ? 
++  LpkBindDN cn=manager,dc=foobar,dc=net					# which bind DN ?
++  LpkBindPw asecret							# bind DN credidentials
++  LpkServerGroup agroupname						# the group the server is part of
++
++  Right now i'm using anonymous binding to get public keys, because getting public keys of someone doesn't impersonate him¸ but there is some
++  flaws you have to take care of.
++
++- HOW TO INSERT A USER/KEY INTO AN LDAP ENTRY
++
++  * my way (there is plenty :)
++  - create ldif file (i.e. users.ldif)
++  - cat ~/.ssh/id_dsa.pub OR cat ~/.ssh/id_rsa.pub OR cat ~/.ssh/identity.pub
++  - my way in 4 steps :
++  Example:
++
++  # you add this to the user entry in the LDIF file :
++  [...]
++  objectclass: posixAccount
++  objectclass: ldapPublicKey
++  [...]
++  sshPubliKey: ssh-dss AAAABDh12DDUR2...
++  [...]
++
++  # insert your entry and you're done :)
++  ldapadd -D balblabla -w bleh < file.ldif 
++  
++  all standard options can be present in the 'sshPublicKey' attribute.
++
++- WHY :
++
++  Simply because, i was looking for a way to centralize all sysadmins authentication, easily,  without completely using LDAP 
++  as authentication method (like pam_ldap etc..).  
++  
++  After looking into Kerberos, SecurID, and other centralized secure authentications systems, the use of RSA and LDAP to get 
++  public key for authentication allows us to control who has access to which server (the user needs an account and to be in 'strongAuthenticationUser'
++  objectclass within LDAP and part of the group the SSH server is in). 
++
++  Passwords update are no longer a nightmare for a server farm (key pair passphrase is stored on each user's box and private key is locally encrypted using his passphrase 
++  so each user can change it as much as he wants). 
++
++  Blocking a user account can be done directly from the LDAP (if sshd is using RSAAuth + ldap only).
++
++- RULES :  
++  Entry in the LDAP server must respect 'posixAccount' and 'ldapPublicKey' which are defined in core.schema. 
++  and the additionnal lpk.schema.
++
++  This patch could allow a smooth transition between standard auth (/etc/passwd) and complete LDAP based authentication 
++  (pamldap, nss_ldap, etc..).
++
++  This can be an alternative to other (old?/expensive?) authentication methods (Kerberos/SecurID/..).
++  
++  Referring to schema at the beginning of this file if user 'eau' is only in group 'unix'
++  'eau' would ONLY access 'server1', 'server2', 'server3' AND 'server4' BUT NOT 'server5'.
++  If you then modify the LDAP 'mail' group entry to add 'memberUid: eau' THEN user 'eau' would be able
++  to log in 'server5' (i hope you got the idea, my english is bad :).
++
++  Each server's sshd is patched and configured to ask the public key and the group infos in the LDAP
++  server.
++  When you want to allow a new user to have access to the server parc, you just add him an account on 
++  your servers, you add his public key into his entry on the LDAP server, it's done. 
++
++  Because sshds are looking public keys into the LDAP directly instead of a file ($HOME/.ssh/authorized_keys).
++
++  When the user needs to change his passphrase he can do it directly from his workstation by changing 
++  his own key set lock passphrase, and all servers are automatically aware.
++ 
++  With a CAREFUL LDAP server configuration you could allow a user to add/delete/modify his own entry himself
++  so he can add/modify/delete himself his public key when needed.
++
++­ FLAWS :
++  LDAP must be well configured, getting the public key of some user is not a problem, but if anonymous LDAP 
++  allow write to users dn, somebody could replace someuser's public key by its own and impersonate some 
++  of your users in all your server farm be VERY CAREFUL.
++  
++  MITM attack when sshd is requesting the public key, could lead to a compromise of your servers allowing login 
++  as the impersonnated user.
++
++  If LDAP server is down then, fallback on passwd auth.
++  
++  the ldap code part has not been well audited yet.
++
++- LDAP USER ENTRY EXAMPLES (LDIF Format, look in users.ldif)
++    --- CUT HERE ---
++    dn: uid=jdoe,ou=users,dc=foobar,dc=net
++    objectclass: top
++    objectclass: person
++    objectclass: organizationalPerson
++    objectclass: posixAccount
++    objectclass: ldapPublicKey
++    description: My account
++    cn: John Doe
++    sn: John Doe
++    uid: jdoe
++    uidNumber: 100
++    gidNumber: 100
++    homeDirectory: /home/jdoe
++    sshPublicKey: ssh-dss AAAAB3NzaC1kc3MAAAEBAOvL8pREUg9wSy/8+hQJ54YF3AXkB0OZrXB....
++    [...]
++    --- CUT HERE ---
++
++- LDAP GROUP ENTRY EXAMPLES (LDIF Format, look in groups.ldif)
++    --- CUT HERE ---
++    dn: cn=unix,ou=groups,dc=cuckoos,dc=net
++    objectclass: top
++    objectclass: posixGroup
++    description: Unix based servers group
++    cn: unix
++    gidNumber: 1002
++    memberUid: jdoe
++    memberUid: user1
++    memberUid: user2
++    [...]
++    --- CUT HERE ---
++
++>> FYI: << 
++Multiple 'sshPublicKey' in a user entry are allowed, as well as multiple 'memberUid' attributes in a group entry
++
++- COMPILING:
++  1. Apply the patch
++  2. ./configure --with-your-options --with-ldap=/prefix/to/ldap_libs_and_includes
++  3. make
++  4. it's done.
++
++- BLA :
++  I hope this could help, and i hope to be clear enough,, or give ideas.  questions/comments/improvements are welcome.
++  
++- TODO :
++  Redesign differently.
++
++- DOCS/LINK :
++  http://pacsec.jp/core05/psj05-barisani-en.pdf
++  http://fritz.potsdam.edu/projects/openssh-lpk/
++  http://fritz.potsdam.edu/projects/sshgate/
++  http://dev.inversepath.com/trac/openssh-lpk
++  http://lam.sf.net/ ( http://lam.sourceforge.net/documentation/supportedSchemas.htm )
++
++- CONTRIBUTORS/IDEAS/GREETS :
++  - Falk Siemonsmeier.
++  - Jacob Rief.
++  - Michael Durchgraf.
++  - frederic peters.
++  - Finlay dobbie.
++  - Stefan Fisher.
++  - Robin H. Johnson.
++  - Adrian Bridgett.
++
++- CONTACT :
++  - Eric AUGE <eau@phear.org>
++  - Andrea Barisani <andrea@inversepath.com>
+
+diff -Nuar --exclude '*.orig' --exclude '*.rej' servconf.h servconf.h
+--- servconf.h	2008-06-10 06:01:51.000000000 -0700
++++ servconf.h	2008-08-23 15:02:47.000000000 -0700
+@@ -16,6 +16,10 @@
+ #ifndef SERVCONF_H
+ #define SERVCONF_H
+ 
++#ifdef WITH_LDAP_PUBKEY
++#include "ldapauth.h"
++#endif
++
+ #define MAX_PORTS		256	/* Max # ports. */
+ 
+ #define MAX_ALLOW_USERS		256	/* Max # users on allow list. */
+@@ -145,6 +149,9 @@
+ 	int	use_pam;		/* Enable auth via PAM */
+ 
+ 	int	permit_tun;
++#ifdef WITH_LDAP_PUBKEY
++        ldap_opt_t lpk;
++#endif
+ 
+ 	int	num_permitted_opens;
+ 
+diff -Nuar --exclude '*.orig' --exclude '*.rej' sshd.c sshd.c
+--- sshd.c	2008-07-11 00:36:49.000000000 -0700
++++ sshd.c	2008-08-23 15:02:47.000000000 -0700
+@@ -127,6 +127,10 @@
  int deny_severity;
  #endif /* LIBWRAP */
  
@@ -1522,7 +1572,7 @@
  #ifndef O_NOCTTY
  #define O_NOCTTY	0
  #endif
-@@ -1454,6 +1458,16 @@
+@@ -1484,6 +1488,16 @@
  		exit(1);
  	}
  
@@ -1539,9 +1589,35 @@
  	debug("sshd version %.100s", SSH_RELEASE);
  
  	/* Store privilege separation user for later use if required. */
---- sshd_config.5.orig	2008-03-26 21:02:02.000000000 -0300
-+++ sshd_config.5	2008-04-17 21:24:57.000000000 -0300
-@@ -964,6 +964,62 @@
+diff -Nuar --exclude '*.orig' --exclude '*.rej' sshd_config sshd_config
+--- sshd_config	2008-07-02 05:35:43.000000000 -0700
++++ sshd_config	2008-08-23 15:02:47.000000000 -0700
+@@ -109,6 +109,21 @@
+ # no default banner path
+ #Banner none
+ 
++# here are the new patched ldap related tokens
++# entries in your LDAP must have posixAccount & ldapPublicKey objectclass
++#UseLPK yes
++#LpkLdapConf /etc/ldap.conf
++#LpkServers  ldap://10.1.7.1/ ldap://10.1.7.2/
++#LpkUserDN   ou=users,dc=phear,dc=org
++#LpkGroupDN  ou=groups,dc=phear,dc=org
++#LpkBindDN cn=Manager,dc=phear,dc=org
++#LpkBindPw secret
++#LpkServerGroup mail
++#LpkFilter (hostAccess=master.phear.org)
++#LpkForceTLS no
++#LpkSearchTimelimit 3
++#LpkBindTimelimit 3
++
+ # override default of no subsystems
+ Subsystem	sftp	/usr/libexec/sftp-server
+ 
+diff -Nuar --exclude '*.orig' --exclude '*.rej' sshd_config.5 sshd_config.5
+--- sshd_config.5	2008-07-02 05:35:43.000000000 -0700
++++ sshd_config.5	2008-08-23 15:02:47.000000000 -0700
+@@ -1003,6 +1003,62 @@
  program.
  The default is
  .Pa /usr/X11R6/bin/xauth .
@@ -1604,50 +1680,3 @@
  .El
  .Sh TIME FORMATS
  .Xr sshd 8
---- sshd_config.orig	2008-02-10 09:40:12.000000000 -0200
-+++ sshd_config	2008-04-17 21:28:29.000000000 -0300
-@@ -107,6 +107,21 @@
- # no default banner path
- #Banner none
- 
-+# here are the new patched ldap related tokens
-+# entries in your LDAP must have posixAccount & ldapPublicKey objectclass
-+#UseLPK yes
-+#LpkLdapConf /etc/ldap.conf
-+#LpkServers  ldap://10.1.7.1/ ldap://10.1.7.2/
-+#LpkUserDN   ou=users,dc=phear,dc=org
-+#LpkGroupDN  ou=groups,dc=phear,dc=org
-+#LpkBindDN cn=Manager,dc=phear,dc=org
-+#LpkBindPw secret
-+#LpkServerGroup mail
-+#LpkFilter (hostAccess=master.phear.org)
-+#LpkForceTLS no
-+#LpkSearchTimelimit 3
-+#LpkBindTimelimit 3
-+
- # override default of no subsystems
- Subsystem	sftp	/usr/libexec/sftp-server
- 
---- servconf.h.orig	2008-03-07 04:31:24.000000000 -0300
-+++ servconf.h	2008-04-17 21:24:57.000000000 -0300
-@@ -16,6 +16,10 @@
- #ifndef SERVCONF_H
- #define SERVCONF_H
- 
-+#ifdef WITH_LDAP_PUBKEY
-+#include "ldapauth.h"
-+#endif
-+
- #define MAX_PORTS		256	/* Max # ports. */
- 
- #define MAX_ALLOW_USERS		256	/* Max # users on allow list. */
-@@ -142,6 +146,9 @@
- 	int	use_pam;		/* Enable auth via PAM */
- 
- 	int	permit_tun;
-+#ifdef WITH_LDAP_PUBKEY
-+        ldap_opt_t lpk;
-+#endif
- 
- 	int	num_permitted_opens;
- 
diff --git a/security/openssh-portable/files/openssh-lpk+hpn-servconf.patch b/security/openssh-portable/files/lpk+hpn-servconf.c.patch
index a6976baacaea..850acbc6bfde 100644
--- a/security/openssh-portable/files/openssh-lpk+hpn-servconf.patch
+++ b/security/openssh-portable/files/lpk+hpn-servconf.c.patch
@@ -1,5 +1,5 @@
---- servconf.c.orig	2009-05-02 19:35:42.000000000 +0400
-+++ servconf.c	2009-05-02 19:37:13.000000000 +0400
+--- servconf.c.orig	2009-05-26 15:13:32.000000000 +0400
++++ servconf.c	2009-05-26 18:09:30.000000000 +0400
 @@ -42,6 +42,10 @@
  #include "channels.h"
  #include "groupaccess.h"
@@ -11,59 +11,85 @@
  static void add_listen_addr(ServerOptions *, char *, int);
  static void add_one_listen_addr(ServerOptions *, char *, int);
  
-@@ -74,7 +78,7 @@
- 	options->ignore_user_known_hosts = -1;
- 	options->print_motd = -1;
- 	options->print_lastlog = -1;
--	options->x11_forwarding = -1;
-+	options->x11_forwarding = 1;
- 	options->x11_display_offset = -1;
- 	options->x11_use_localhost = -1;
- 	options->xauth_location = NULL;
-@@ -127,12 +131,39 @@
- 	options->num_permitted_opens = -1;
+@@ -128,11 +132,38 @@
  	options->adm_forced_command = NULL;
  	options->chroot_directory = NULL;
-+ 	options->none_enabled = -1;
-+ 	options->tcp_rcv_buf_poll = -1;
-+ 	options->hpn_disabled = -1;
-+ 	options->hpn_buffer_size = -1;
  	options->zero_knowledge_password_authentication = -1;
++	options->none_enabled = -1;
++	options->tcp_rcv_buf_poll = -1;
++	options->hpn_disabled = -1;
++	options->hpn_buffer_size = -1;
 +#ifdef WITH_LDAP_PUBKEY
-+	/* XXX dirty */
-+	options->lpk.ld = NULL;
-+	options->lpk.on = -1;
-+	options->lpk.servers = NULL;
-+	options->lpk.u_basedn = NULL;
-+	options->lpk.g_basedn = NULL;
-+	options->lpk.binddn = NULL;
-+	options->lpk.bindpw = NULL;
-+	options->lpk.sgroup = NULL;
-+	options->lpk.filter = NULL;
-+	options->lpk.fgroup = NULL;
-+	options->lpk.l_conf = NULL;
-+	options->lpk.tls = -1;
-+	options->lpk.b_timeout.tv_sec = -1;
-+	options->lpk.s_timeout.tv_sec = -1;
-+	options->lpk.flags = FLAG_EMPTY;
++ 	/* XXX dirty */
++ 	options->lpk.ld = NULL;
++ 	options->lpk.on = -1;
++ 	options->lpk.servers = NULL;
++ 	options->lpk.u_basedn = NULL;
++ 	options->lpk.g_basedn = NULL;
++ 	options->lpk.binddn = NULL;
++ 	options->lpk.bindpw = NULL;
++ 	options->lpk.sgroup = NULL;
++ 	options->lpk.filter = NULL;
++ 	options->lpk.fgroup = NULL;
++ 	options->lpk.l_conf = NULL;
++ 	options->lpk.tls = -1;
++ 	options->lpk.b_timeout.tv_sec = -1;
++ 	options->lpk.s_timeout.tv_sec = -1;
++ 	options->lpk.flags = FLAG_EMPTY;
 +#endif
  }
  
  void
  fill_default_server_options(ServerOptions *options)
  {
-+ 	/* needed for hpn socket tests */
-+ 	int sock;
-+ 	int socksize;
-+ 	int socksizelen = sizeof(int);
-+ 
++	/* needed for hpn socket tests */
++	int sock;
++	int socksize;
++	int socksizelen = sizeof(int);
++
  	/* Portable-specific options */
  	if (options->use_pam == -1)
  		options->use_pam = 1;
-@@ -265,6 +296,32 @@
+@@ -265,6 +296,68 @@
  		options->permit_tun = SSH_TUNMODE_NO;
  	if (options->zero_knowledge_password_authentication == -1)
  		options->zero_knowledge_password_authentication = 0;
++	if (options->hpn_disabled == -1) 
++		options->hpn_disabled = 0;
++
++	if (options->hpn_buffer_size == -1) {
++		/* option not explicitly set. Now we have to figure out */
++		/* what value to use */
++		if (options->hpn_disabled == 1) {
++			options->hpn_buffer_size = CHAN_SES_WINDOW_DEFAULT;
++		} else {
++			/* get the current RCV size and set it to that */
++			/*create a socket but don't connect it */
++			/* we use that the get the rcv socket size */
++			sock = socket(AF_INET, SOCK_STREAM, 0);
++			getsockopt(sock, SOL_SOCKET, SO_RCVBUF, 
++				   &socksize, &socksizelen);
++			close(sock);
++			options->hpn_buffer_size = socksize;
++			debug ("HPN Buffer Size: %d", options->hpn_buffer_size);
++			
++		} 
++	} else {
++		/* we have to do this incase the user sets both values in a contradictory */
++		/* manner. hpn_disabled overrrides hpn_buffer_size*/
++		if (options->hpn_disabled <= 0) {
++			if (options->hpn_buffer_size == 0)
++				options->hpn_buffer_size = 1;
++			/* limit the maximum buffer to 64MB */
++			if (options->hpn_buffer_size > 64*1024) {
++				options->hpn_buffer_size = 64*1024*1024;
++			} else {
++				options->hpn_buffer_size *= 1024;
++			}
++		} else
++			options->hpn_buffer_size = CHAN_TCP_WINDOW_DEFAULT;
++	}
++
 +#ifdef WITH_LDAP_PUBKEY
 +	if (options->lpk.on == -1)
 +	    options->lpk.on = _DEFAULT_LPK_ON;
@@ -91,14 +117,13 @@
 +	    options->lpk.l_conf = _DEFAULT_LPK_LDP;
 +#endif
  
- 	if (options->hpn_disabled == -1) 
- 		options->hpn_disabled = 0;
-@@ -345,8 +402,15 @@
- 	sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel,
+ 	/* Turn privilege separation on by default */
+ 	if (use_privsep == -1)
+@@ -310,7 +403,14 @@
  	sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
  	sUsePrivilegeSeparation, sAllowAgentForwarding,
-+ 	sNoneEnabled, sTcpRcvBufPoll, sHPNDisabled, sHPNBufferSize,
  	sZeroKnowledgePasswordAuthentication,
++	sNoneEnabled, sTcpRcvBufPoll, sHPNDisabled, sHPNBufferSize,
  	sDeprecated, sUnsupported
 +#ifdef WITH_LDAP_PUBKEY
 +	,sLdapPublickey, sLdapServers, sLdapUserDN
@@ -109,7 +134,7 @@
  } ServerOpCodes;
  
  #define SSHCFG_GLOBAL	0x01	/* allowed in main section of sshd_config */
-@@ -457,6 +521,20 @@
+@@ -421,6 +521,20 @@
  	{ "clientalivecountmax", sClientAliveCountMax, SSHCFG_GLOBAL },
  	{ "authorizedkeysfile", sAuthorizedKeysFile, SSHCFG_GLOBAL },
  	{ "authorizedkeysfile2", sAuthorizedKeysFile2, SSHCFG_GLOBAL },
@@ -130,7 +155,49 @@
  	{ "useprivilegeseparation", sUsePrivilegeSeparation, SSHCFG_GLOBAL },
  	{ "acceptenv", sAcceptEnv, SSHCFG_GLOBAL },
  	{ "permittunnel", sPermitTunnel, SSHCFG_GLOBAL },
-@@ -1368,6 +1446,107 @@
+@@ -428,6 +542,10 @@
+ 	{ "permitopen", sPermitOpen, SSHCFG_ALL },
+ 	{ "forcecommand", sForceCommand, SSHCFG_ALL },
+ 	{ "chrootdirectory", sChrootDirectory, SSHCFG_ALL },
++	{ "noneenabled", sNoneEnabled },
++	{ "hpndisabled", sHPNDisabled },
++	{ "hpnbuffersize", sHPNBufferSize },
++	{ "tcprcvbufpoll", sTcpRcvBufPoll },
+ 	{ NULL, sBadOption, 0 }
+ };
+ 
+@@ -454,6 +572,7 @@
+ 
+ 	for (i = 0; keywords[i].name; i++)
+ 		if (strcasecmp(cp, keywords[i].name) == 0) {
++		        debug ("Config token is %s", keywords[i].name);
+ 			*flags = keywords[i].flags;
+ 			return keywords[i].opcode;
+ 		}
+@@ -851,6 +970,22 @@
+ 			*intptr = value;
+ 		break;
+ 
++	case sNoneEnabled:
++		intptr = &options->none_enabled;
++		goto parse_flag;
++
++	case sTcpRcvBufPoll:
++		intptr = &options->tcp_rcv_buf_poll;
++		goto parse_flag;
++
++	case sHPNDisabled:
++		intptr = &options->hpn_disabled;
++		goto parse_flag;
++
++	case sHPNBufferSize:
++		intptr = &options->hpn_buffer_size;
++		goto parse_int;
++
+ 	case sIgnoreUserKnownHosts:
+ 		intptr = &options->ignore_user_known_hosts;
+ 		goto parse_flag;
+@@ -1311,6 +1446,107 @@
  		while (arg)
  		    arg = strdelim(&cp);
  		break;
diff --git a/security/openssh-portable/files/openssh-5.2p1-hpn-servconf.patch b/security/openssh-portable/files/openssh-5.2p1-hpn-servconf.patch
deleted file mode 100644
index fd7fd8ba53d5..000000000000
--- a/security/openssh-portable/files/openssh-5.2p1-hpn-servconf.patch
+++ /dev/null
@@ -1,32 +0,0 @@
---- servconf.c.orig	2009-05-02 18:22:38.000000000 +0400
-+++ servconf.c	2009-05-02 18:24:15.000000000 +0400
-@@ -127,12 +127,21 @@
- 	options->num_permitted_opens = -1;
- 	options->adm_forced_command = NULL;
- 	options->chroot_directory = NULL;
-+ 	options->none_enabled = -1;
-+ 	options->tcp_rcv_buf_poll = -1;
-+ 	options->hpn_disabled = -1;
-+ 	options->hpn_buffer_size = -1;
- 	options->zero_knowledge_password_authentication = -1;
- }
- 
- void
- fill_default_server_options(ServerOptions *options)
- {
-+ 	/* needed for hpn socket tests */
-+ 	int sock;
-+ 	int socksize;
-+ 	int socksizelen = sizeof(int);
-+ 
- 	/* Portable-specific options */
- 	if (options->use_pam == -1)
- 		options->use_pam = 1;
-@@ -345,6 +354,7 @@
- 	sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel,
- 	sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
- 	sUsePrivilegeSeparation, sAllowAgentForwarding,
-+ 	sNoneEnabled, sTcpRcvBufPoll, sHPNDisabled, sHPNBufferSize,
- 	sZeroKnowledgePasswordAuthentication,
- 	sDeprecated, sUnsupported
- } ServerOpCodes;
diff --git a/security/openssh-portable/files/openssh-5.2p1-hpn13v6-servconf.c.diff b/security/openssh-portable/files/openssh-5.2p1-hpn13v6-servconf.c.diff
new file mode 100644
index 000000000000..bafd3e6d75aa
--- /dev/null
+++ b/security/openssh-portable/files/openssh-5.2p1-hpn13v6-servconf.c.diff
@@ -0,0 +1,117 @@
+diff -NupwB servconf.c servconf.c
+--- servconf.c	2009-01-28 00:31:23.000000000 -0500
++++ servconf.c	2009-05-14 12:36:10.000000000 -0400
+@@ -128,11 +128,20 @@ initialize_server_options(ServerOptions 
+ 	options->adm_forced_command = NULL;
+ 	options->chroot_directory = NULL;
+ 	options->zero_knowledge_password_authentication = -1;
++	options->none_enabled = -1;
++	options->tcp_rcv_buf_poll = -1;
++	options->hpn_disabled = -1;
++	options->hpn_buffer_size = -1;
+ }
+ 
+ void
+ fill_default_server_options(ServerOptions *options)
+ {
++	/* needed for hpn socket tests */
++	int sock;
++	int socksize;
++	int socksizelen = sizeof(int);
++
+ 	/* Portable-specific options */
+ 	if (options->use_pam == -1)
+ 		options->use_pam = 0;
+@@ -262,6 +271,42 @@ fill_default_server_options(ServerOption
+ 	if (options->zero_knowledge_password_authentication == -1)
+ 		options->zero_knowledge_password_authentication = 0;
+ 
++	if (options->hpn_disabled == -1) 
++		options->hpn_disabled = 0;
++
++	if (options->hpn_buffer_size == -1) {
++		/* option not explicitly set. Now we have to figure out */
++		/* what value to use */
++		if (options->hpn_disabled == 1) {
++			options->hpn_buffer_size = CHAN_SES_WINDOW_DEFAULT;
++		} else {
++			/* get the current RCV size and set it to that */
++			/*create a socket but don't connect it */
++			/* we use that the get the rcv socket size */
++			sock = socket(AF_INET, SOCK_STREAM, 0);
++			getsockopt(sock, SOL_SOCKET, SO_RCVBUF, 
++				   &socksize, &socksizelen);
++			close(sock);
++			options->hpn_buffer_size = socksize;
++			debug ("HPN Buffer Size: %d", options->hpn_buffer_size);
++			
++		} 
++	} else {
++		/* we have to do this incase the user sets both values in a contradictory */
++		/* manner. hpn_disabled overrrides hpn_buffer_size*/
++		if (options->hpn_disabled <= 0) {
++			if (options->hpn_buffer_size == 0)
++				options->hpn_buffer_size = 1;
++			/* limit the maximum buffer to 64MB */
++			if (options->hpn_buffer_size > 64*1024) {
++				options->hpn_buffer_size = 64*1024*1024;
++			} else {
++				options->hpn_buffer_size *= 1024;
++			}
++		} else
++			options->hpn_buffer_size = CHAN_TCP_WINDOW_DEFAULT;
++	}
++
+ 	/* Turn privilege separation on by default */
+ 	if (use_privsep == -1)
+ 		use_privsep = 1;
+@@ -306,6 +351,7 @@ typedef enum {
+ 	sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
+ 	sUsePrivilegeSeparation, sAllowAgentForwarding,
+ 	sZeroKnowledgePasswordAuthentication,
++	sNoneEnabled, sTcpRcvBufPoll, sHPNDisabled, sHPNBufferSize,
+ 	sDeprecated, sUnsupported
+ } ServerOpCodes;
+ 
+@@ -424,6 +470,10 @@ static struct {
+ 	{ "permitopen", sPermitOpen, SSHCFG_ALL },
+ 	{ "forcecommand", sForceCommand, SSHCFG_ALL },
+ 	{ "chrootdirectory", sChrootDirectory, SSHCFG_ALL },
++	{ "noneenabled", sNoneEnabled },
++	{ "hpndisabled", sHPNDisabled },
++	{ "hpnbuffersize", sHPNBufferSize },
++	{ "tcprcvbufpoll", sTcpRcvBufPoll },
+ 	{ NULL, sBadOption, 0 }
+ };
+ 
+@@ -450,6 +500,7 @@ parse_token(const char *cp, const char *
+ 
+ 	for (i = 0; keywords[i].name; i++)
+ 		if (strcasecmp(cp, keywords[i].name) == 0) {
++		        debug ("Config token is %s", keywords[i].name);
+ 			*flags = keywords[i].flags;
+ 			return keywords[i].opcode;
+ 		}
+@@ -847,6 +898,22 @@ process_server_config_line(ServerOptions
+ 			*intptr = value;
+ 		break;
+ 
++	case sNoneEnabled:
++		intptr = &options->none_enabled;
++		goto parse_flag;
++
++	case sTcpRcvBufPoll:
++		intptr = &options->tcp_rcv_buf_poll;
++		goto parse_flag;
++
++	case sHPNDisabled:
++		intptr = &options->hpn_disabled;
++		goto parse_flag;
++
++	case sHPNBufferSize:
++		intptr = &options->hpn_buffer_size;
++		goto parse_int;
++
+ 	case sIgnoreUserKnownHosts:
+ 		intptr = &options->ignore_user_known_hosts;
+ 		goto parse_flag;
diff --git a/security/openssh-portable/files/openssh-5.2p1-hpn.patch b/security/openssh-portable/files/openssh-5.2p1-hpn13v6.diff
index 8faf1f9ef28c..7bb5a7f21e92 100644
--- a/security/openssh-portable/files/openssh-5.2p1-hpn.patch
+++ b/security/openssh-portable/files/openssh-5.2p1-hpn13v6.diff
@@ -1,160 +1,7 @@
-diff -urN HPN-README HPN-README
---- HPN-README	1970-01-01 03:00:00.000000000 +0300
-+++ HPN-README	2009-05-02 17:38:18.000000000 +0400
-@@ -0,0 +1,128 @@
-+Notes:
-+
-+MULTI-THREADED CIPHER:
-+The AES cipher in CTR mode has been multithreaded (MTR-AES-CTR). This will allow ssh installations
-+on hosts with multiple cores to use more than one processing core during encryption. 
-+Tests have show significant throughput performance increases when using MTR-AES-CTR up 
-+to and including a full gigabit per second on quad core systems. It should be possible to 
-+achieve full line rate on dual core systems but OS and data management overhead makes this
-+more difficult to achieve. The cipher stream from MTR-AES-CTR is entirely compatible with single 
-+thread AES-CTR (ST-AES-CTR) implementations and should be 100% backward compatible. Optimal 
-+performance requires the MTR-AES-CTR mode be enabled on both ends of the connection. 
-+The MTR-AES-CTR replaces ST-AES-CTR and is used in exactly the same way with the same
-+nomenclature. 
-+Use examples: 	ssh -caes128-ctr you@host.com
-+		scp -oCipher=aes256-ctr file you@host.com:~/file
-+
-+NONE CIPHER:
-+To use the NONE option you must have the NoneEnabled switch set on the server and
-+you *must* have *both* NoneEnabled and NoneSwitch set to yes on the client. The NONE
-+feature works with ALL ssh subsystems (as far as we can tell) *AS LONG AS* a tty is not 
-+spawned. If a user uses the -T switch to prevent a tty being created the NONE cipher will
-+be disabled. 
-+
-+The performance increase will only be as good as the network and TCP stack tuning
-+on the reciever side of the connection allows. As a rule of thumb a user will need 
-+at least 10Mb/s connection with a 100ms RTT to see a doubling of performance. The
-+HPN-SSH home page describes this in greater detail. 
-+
-+http://www.psc.edu/networking/projects/hpn-ssh
-+
-+BUFFER SIZES:
-+
-+If HPN is disabled the receive buffer size will be set to the 
-+OpenSSH default of 64K.
-+
-+If an HPN system connects to a nonHPN system the receive buffer will
-+be set to the HPNBufferSize value. The default is 2MB but user adjustable.
-+
-+If an HPN to HPN connection is established a number of different things might
-+happen based on the user options and conditions. 
-+
-+Conditions: HPNBufferSize NOT Set, TCPRcvBufPoll enabled, TCPRcvBuf NOT Set 
-+HPN Buffer Size = up to 64MB 
-+This is the default state. The HPN buffer size will grow to a maximum of 64MB 
-+as the TCP receive buffer grows. The maximum HPN Buffer size of 64MB is 
-+geared towards 10GigE transcontinental connections. 
-+
-+Conditions: HPNBufferSize NOT Set, TCPRcvBufPoll disabled, TCPRcvBuf NOT Set
-+HPN Buffer Size = TCP receive buffer value. 
-+Users on non-autotuning systesm should disable TCPRcvBufPoll in the 
-+ssh_cofig and sshd_config
-+
-+Conditions: HPNBufferSize SET, TCPRcvBufPoll disabled, TCPRcvBuf NOT Set
-+HPN Buffer Size = minmum of TCP receive buffer and HPNBufferSize. 
-+This would be the system defined TCP receive buffer (RWIN).
-+
-+Conditions: HPNBufferSize SET, TCPRcvBufPoll disabled, TCPRcvBuf SET
-+HPN Buffer Size = minmum of TCPRcvBuf and HPNBufferSize. 
-+Generally there is no need to set both.
-+
-+Conditions: HPNBufferSize SET, TCPRcvBufPoll enabled, TCPRcvBuf NOT Set
-+HPN Buffer Size = grows to HPNBufferSize
-+The buffer will grow up to the maximum size specified here. 
-+
-+Conditions: HPNBufferSize SET, TCPRcvBufPoll enabled, TCPRcvBuf SET
-+HPN Buffer Size = minmum of TCPRcvBuf and HPNBufferSize. 
-+Generally there is no need to set both of these, especially on autotuning 
-+systems. However, if the users wishes to override the autotuning this would be 
-+one way to do it.
-+
-+Conditions: HPNBufferSize NOT Set, TCPRcvBufPoll enabled, TCPRcvBuf SET
-+HPN Buffer Size = TCPRcvBuf. 
-+This will override autotuning and set the TCP recieve buffer to the user defined 
-+value.
-+
-+
-+HPN Specific Configuration options
-+
-+TcpRcvBuf=[int]KB client
-+      set the TCP socket receive buffer to n Kilobytes. It can be set up to the 
-+maximum socket size allowed by the system. This is useful in situations where 
-+the tcp receive window is set low but the maximum buffer size is set 
-+higher (as is typical). This works on a per TCP connection basis. You can also 
-+use this to artifically limit the transfer rate of the connection. In these 
-+cases the throughput will be no more than n/RTT. The minimum buffer size is 1KB. 
-+Default is the current system wide tcp receive buffer size.
-+
-+TcpRcvBufPoll=[yes/no] client/server
-+      enable of disable the polling of the tcp receive buffer through the life 
-+of the connection. You would want to make sure that this option is enabled 
-+for systems making use of autotuning kernels (linux 2.4.24+, 2.6, MS Vista) 
-+default is yes.
-+
-+NoneEnabled=[yes/no] client/server
-+      enable or disable the use of the None cipher. Care must always be used 
-+when enabling this as it will allow users to send data in the clear. However, 
-+it is important to note that authentication information remains encrypted 
-+even if this option is enabled. Set to no by default.
-+
-+NoneSwitch=[yes/no] client
-+     Switch the encryption cipher being used to the None cipher after
-+authentication takes place. NoneEnabled must be enabled on both the client
-+and server side of the connection. When the connection switches to the NONE
-+cipher a warning is sent to STDERR. The connection attempt will fail with an
-+error if a client requests a NoneSwitch from the server that does not explicitly
-+have NoneEnabled set to yes. Note: The NONE cipher cannot be used in
-+interactive (shell) sessions and it will fail silently. Set to no by default.
-+
-+HPNDisabled=[yes/no] client/server
-+     In some situations, such as transfers on a local area network, the impact 
-+of the HPN code produces a net decrease in performance. In these cases it is 
-+helpful to disable the HPN functionality. By default HPNDisabled is set to no. 
-+
-+HPNBufferSize=[int]KB client/server
-+     This is the default buffer size the HPN functionality uses when interacting
-+with nonHPN SSH installations. Conceptually this is similar to the TcpRcvBuf
-+option as applied to the internal SSH flow control. This value can range from 
-+1KB to 64MB (1-65536). Use of oversized or undersized buffers can cause performance
-+problems depending on the length of the network path. The default size of this buffer
-+is 2MB.
-+
-+
-+Credits: This patch was conceived, designed, and led by Chris Rapier (rapier@psc.edu)
-+         The majority of the actual coding for versions up to HPN12v1 was performed
-+         by Michael Stevens (mstevens@andrew.cmu.edu). The MT-AES-CTR cipher was 
-+	 implemented by Ben Bennet (ben@psc.edu). This work was financed, in part,
-+         by Cisco System, Inc., the National Library of Medicine, 
-+	 and the National Science Foundation. 
-diff -urN Makefile.in Makefile.in
---- Makefile.in	2009-05-02 17:37:11.000000000 +0400
-+++ Makefile.in	2009-05-02 17:38:18.000000000 +0400
-@@ -43,7 +43,7 @@
- LD=@LD@
- CFLAGS=@CFLAGS@
- CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ $(PATHS) @DEFS@
--LIBS=@LIBS@
-+LIBS=@LIBS@ -lpthread
- SSHDLIBS=@SSHDLIBS@
- LIBEDIT=@LIBEDIT@
- AR=@AR@
-@@ -64,7 +64,7 @@
- 
- LIBSSH_OBJS=acss.o authfd.o authfile.o bufaux.o bufbn.o buffer.o \
- 	canohost.o channels.o cipher.o cipher-acss.o cipher-aes.o \
--	cipher-bf1.o cipher-ctr.o cipher-3des1.o cleanup.o \
-+	cipher-bf1.o cipher-ctr.o cipher-ctr-mt.o cipher-3des1.o cleanup.o \
- 	compat.o compress.o crc32.o deattack.o fatal.o hostfile.o \
- 	log.o match.o md-sha256.o moduli.o nchan.o packet.o \
- 	readpass.o rsa.o ttymodes.o xmalloc.o addrmatch.o \
-diff -urN auth2.c auth2.c
---- auth2.c	2009-05-02 17:37:11.000000000 +0400
-+++ auth2.c	2009-05-02 17:38:18.000000000 +0400
-@@ -50,6 +50,7 @@
+diff -NupwB auth2.c auth2.c
+--- auth2.c	2008-11-05 00:20:46.000000000 -0500
++++ auth2.c	2009-05-14 12:36:10.000000000 -0400
+@@ -49,6 +49,7 @@
  #include "dispatch.h"
  #include "pathnames.h"
  #include "buffer.h"
@@ -162,7 +9,7 @@ diff -urN auth2.c auth2.c
  
  #ifdef GSSAPI
  #include "ssh-gss.h"
-@@ -76,6 +77,9 @@
+@@ -75,6 +76,9 @@ extern Authmethod method_gssapi;
  extern Authmethod method_jpake;
  #endif
  
@@ -172,7 +19,7 @@ diff -urN auth2.c auth2.c
  Authmethod *authmethods[] = {
  	&method_none,
  	&method_pubkey,
-@@ -233,6 +237,11 @@
+@@ -225,6 +229,11 @@ input_userauth_request(int type, u_int32
  	service = packet_get_string(NULL);
  	method = packet_get_string(NULL);
  	debug("userauth-request for user %s service %s method %s", user, service, method);
@@ -184,10 +31,10 @@ diff -urN auth2.c auth2.c
  	debug("attempt %d failures %d", authctxt->attempt, authctxt->failures);
  
  	if ((style = strchr(user, ':')) != NULL)
-diff -urN buffer.c buffer.c
---- buffer.c	2006-08-05 06:39:39.000000000 +0400
-+++ buffer.c	2009-05-02 17:38:18.000000000 +0400
-@@ -127,7 +127,7 @@
+diff -NupwB buffer.c buffer.c
+--- buffer.c	2006-08-04 22:39:39.000000000 -0400
++++ buffer.c	2009-05-14 12:36:10.000000000 -0400
+@@ -127,7 +127,7 @@ restart:
  
  	/* Increase the size of the buffer and retry. */
  	newlen = roundup(buffer->alloc + len, BUFFER_ALLOCSZ);
@@ -196,9 +43,9 @@ diff -urN buffer.c buffer.c
  		fatal("buffer_append_space: alloc %u not supported",
  		    newlen);
  	buffer->buf = xrealloc(buffer->buf, 1, newlen);
-diff -urN buffer.h buffer.h
---- buffer.h	2008-05-19 08:59:37.000000000 +0400
-+++ buffer.h	2009-05-02 17:38:18.000000000 +0400
+diff -NupwB buffer.h buffer.h
+--- buffer.h	2008-05-19 00:59:37.000000000 -0400
++++ buffer.h	2009-05-14 12:36:10.000000000 -0400
 @@ -16,6 +16,9 @@
  #ifndef BUFFER_H
  #define BUFFER_H
@@ -209,10 +56,10 @@ diff -urN buffer.h buffer.h
  typedef struct {
  	u_char	*buf;		/* Buffer for data. */
  	u_int	 alloc;		/* Number of bytes allocated for data. */
-diff -urN channels.c channels.c
---- channels.c	2009-02-14 08:28:21.000000000 +0300
-+++ channels.c	2009-05-02 17:41:46.000000000 +0400
-@@ -169,8 +169,14 @@
+diff -NupwB channels.c channels.c
+--- channels.c	2009-02-14 00:28:21.000000000 -0500
++++ channels.c	2009-05-14 12:36:10.000000000 -0400
+@@ -169,8 +169,14 @@ static void port_open_helper(Channel *c,
  static int connect_next(struct channel_connect *);
  static void channel_connect_ctx_free(struct channel_connect *);
  
@@ -227,7 +74,7 @@ diff -urN channels.c channels.c
  Channel *
  channel_by_id(int id)
  {
-@@ -308,6 +314,7 @@
+@@ -308,6 +314,7 @@ channel_new(char *ctype, int type, int r
  	c->local_window_max = window;
  	c->local_consumed = 0;
  	c->local_maxpacket = maxpack;
@@ -235,7 +82,7 @@ diff -urN channels.c channels.c
  	c->remote_id = -1;
  	c->remote_name = xstrdup(remote_name);
  	c->remote_window = 0;
-@@ -798,11 +805,35 @@
+@@ -798,11 +805,35 @@ channel_pre_open_13(Channel *c, fd_set *
  		FD_SET(c->sock, writeset);
  }
  
@@ -271,7 +118,7 @@ diff -urN channels.c channels.c
  	if (c->istate == CHAN_INPUT_OPEN &&
  	    limit > 0 &&
  	    buffer_len(&c->input) < limit &&
-@@ -1759,14 +1790,21 @@
+@@ -1759,14 +1790,21 @@ channel_check_window(Channel *c)
  	    c->local_maxpacket*3) ||
  	    c->local_window < c->local_window_max/2) &&
  	    c->local_consumed > 0) {
@@ -295,7 +142,7 @@ diff -urN channels.c channels.c
  		c->local_consumed = 0;
  	}
  	return 1;
-@@ -1969,11 +2007,12 @@
+@@ -1969,11 +2007,12 @@ channel_after_select(fd_set *readset, fd
  
  
  /* If there is data to send to the connection, enqueue some of it now. */
@@ -309,7 +156,7 @@ diff -urN channels.c channels.c
  
  	for (i = 0; i < channels_alloc; i++) {
  		c = channels[i];
-@@ -2013,7 +2052,7 @@
+@@ -2013,7 +2052,7 @@ channel_output_poll(void)
  					packet_start(SSH2_MSG_CHANNEL_DATA);
  					packet_put_int(c->remote_id);
  					packet_put_string(data, dlen);
@@ -318,7 +165,7 @@ diff -urN channels.c channels.c
  					c->remote_window -= dlen + 4;
  					xfree(data);
  				}
-@@ -2043,7 +2082,7 @@
+@@ -2043,7 +2082,7 @@ channel_output_poll(void)
  				    SSH2_MSG_CHANNEL_DATA : SSH_MSG_CHANNEL_DATA);
  				packet_put_int(c->remote_id);
  				packet_put_string(buffer_ptr(&c->input), len);
@@ -327,7 +174,7 @@ diff -urN channels.c channels.c
  				buffer_consume(&c->input, len);
  				c->remote_window -= len;
  			}
-@@ -2078,12 +2117,13 @@
+@@ -2078,12 +2117,13 @@ channel_output_poll(void)
  			packet_put_int(c->remote_id);
  			packet_put_int(SSH2_EXTENDED_DATA_STDERR);
  			packet_put_string(buffer_ptr(&c->extended), len);
@@ -342,7 +189,7 @@ diff -urN channels.c channels.c
  }
  
  
-@@ -2459,6 +2499,15 @@
+@@ -2459,6 +2499,15 @@ channel_set_af(int af)
  	IPv4or6 = af;
  }
  
@@ -358,12 +205,12 @@ diff -urN channels.c channels.c
  static int
  channel_setup_fwd_listener(int type, const char *listen_addr,
      u_short listen_port, int *allocated_listen_port,
-@@ -2610,9 +2659,15 @@
+@@ -2610,9 +2659,15 @@ channel_setup_fwd_listener(int type, con
  		}
  
  		/* Allocate a channel number for the socket. */
-+ 		/* explicitly test for hpn disabled option. if true use smaller window size */
-+ 		if (hpn_disabled)
++		/* explicitly test for hpn disabled option. if true use smaller window size */
++		if (hpn_disabled)
  		c = channel_new("port listener", type, sock, sock, -1,
  		    CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
  		    0, "port listener", 1);
@@ -374,7 +221,7 @@ diff -urN channels.c channels.c
  		c->path = xstrdup(host);
  		c->host_port = port_to_connect;
  		c->listening_port = listen_port;
-@@ -3151,10 +3206,17 @@
+@@ -3151,10 +3206,17 @@ x11_create_display_inet(int x11_display_
  	*chanids = xcalloc(num_socks + 1, sizeof(**chanids));
  	for (n = 0; n < num_socks; n++) {
  		sock = socks[n];
@@ -392,10 +239,10 @@ diff -urN channels.c channels.c
  		nc->single_connection = single_connection;
  		(*chanids)[n] = nc->self;
  	}
-diff -urN channels.h channels.h
---- channels.h	2009-02-14 08:28:21.000000000 +0300
-+++ channels.h	2009-05-02 17:38:18.000000000 +0400
-@@ -115,8 +115,10 @@
+diff -NupwB channels.h channels.h
+--- channels.h	2009-02-14 00:28:21.000000000 -0500
++++ channels.h	2009-05-14 12:36:10.000000000 -0400
+@@ -115,8 +115,10 @@ struct Channel {
  	u_int	local_window_max;
  	u_int	local_consumed;
  	u_int	local_maxpacket;
@@ -406,7 +253,7 @@ diff -urN channels.h channels.h
  
  	char   *ctype;		/* type */
  
-@@ -146,9 +148,11 @@
+@@ -146,9 +148,11 @@ struct Channel {
  
  /* default window/packet sizes for tcp/x11-fwd-channel */
  #define CHAN_SES_PACKET_DEFAULT	(32*1024)
@@ -420,7 +267,7 @@ diff -urN channels.h channels.h
  #define CHAN_X11_PACKET_DEFAULT	(16*1024)
  #define CHAN_X11_WINDOW_DEFAULT	(4*CHAN_X11_PACKET_DEFAULT)
  
-@@ -221,7 +225,7 @@
+@@ -221,7 +225,7 @@ void	 channel_input_status_confirm(int, 
  
  void	 channel_prepare_select(fd_set **, fd_set **, int *, u_int*, int);
  void     channel_after_select(fd_set *, fd_set *);
@@ -429,7 +276,7 @@ diff -urN channels.h channels.h
  
  int      channel_not_very_much_buffered_data(void);
  void     channel_close_all(void);
-@@ -277,4 +281,7 @@
+@@ -277,4 +281,7 @@ void	 chan_rcvd_ieof(Channel *);
  void	 chan_write_failed(Channel *);
  void	 chan_obuf_empty(Channel *);
  
@@ -437,9 +284,59 @@ diff -urN channels.h channels.h
 +void     channel_set_hpn(int, int);
 +
  #endif
-diff -urN cipher-ctr-mt.c cipher-ctr-mt.c
---- cipher-ctr-mt.c	1970-01-01 03:00:00.000000000 +0300
-+++ cipher-ctr-mt.c	2009-05-02 17:38:18.000000000 +0400
+diff -NupwB cipher.c cipher.c
+--- cipher.c	2009-01-28 00:38:41.000000000 -0500
++++ cipher.c	2009-05-14 12:36:10.000000000 -0400
+@@ -55,6 +55,7 @@ extern const EVP_CIPHER *evp_ssh1_bf(voi
+ extern const EVP_CIPHER *evp_ssh1_3des(void);
+ extern void ssh1_3des_iv(EVP_CIPHER_CTX *, int, u_char *, int);
+ extern const EVP_CIPHER *evp_aes_128_ctr(void);
++extern const EVP_CIPHER *evp_aes_ctr_mt(void);
+ extern void ssh_aes_ctr_iv(EVP_CIPHER_CTX *, int, u_char *, u_int);
+ 
+ struct Cipher {
+@@ -82,9 +83,9 @@ struct Cipher {
+ 	{ "aes256-cbc",		SSH_CIPHER_SSH2, 16, 32, 0, 1, EVP_aes_256_cbc },
+ 	{ "rijndael-cbc@lysator.liu.se",
+ 				SSH_CIPHER_SSH2, 16, 32, 0, 1, EVP_aes_256_cbc },
+-	{ "aes128-ctr",		SSH_CIPHER_SSH2, 16, 16, 0, 0, evp_aes_128_ctr },
+-	{ "aes192-ctr",		SSH_CIPHER_SSH2, 16, 24, 0, 0, evp_aes_128_ctr },
+-	{ "aes256-ctr",		SSH_CIPHER_SSH2, 16, 32, 0, 0, evp_aes_128_ctr },
++	{ "aes128-ctr",		SSH_CIPHER_SSH2, 16, 16, 0, 0, evp_aes_ctr_mt },
++	{ "aes192-ctr",		SSH_CIPHER_SSH2, 16, 24, 0, 0, evp_aes_ctr_mt },
++	{ "aes256-ctr",		SSH_CIPHER_SSH2, 16, 32, 0, 0, evp_aes_ctr_mt },
+ #ifdef USE_CIPHER_ACSS
+ 	{ "acss@openssh.org",	SSH_CIPHER_SSH2, 16, 5, 0, 0, EVP_acss },
+ #endif
+@@ -163,7 +164,8 @@ ciphers_valid(const char *names)
+ 	for ((p = strsep(&cp, CIPHER_SEP)); p && *p != '\0';
+ 	    (p = strsep(&cp, CIPHER_SEP))) {
+ 		c = cipher_by_name(p);
+-		if (c == NULL || c->number != SSH_CIPHER_SSH2) {
++		if (c == NULL || (c->number != SSH_CIPHER_SSH2 && 
++c->number != SSH_CIPHER_NONE)) {
+ 			debug("bad cipher %s [%s]", p, names);
+ 			xfree(cipher_list);
+ 			return 0;
+@@ -337,6 +339,7 @@ cipher_get_keyiv(CipherContext *cc, u_ch
+ 	int evplen;
+ 
+ 	switch (c->number) {
++	case SSH_CIPHER_NONE:
+ 	case SSH_CIPHER_SSH2:
+ 	case SSH_CIPHER_DES:
+ 	case SSH_CIPHER_BLOWFISH:
+@@ -371,6 +374,7 @@ cipher_set_keyiv(CipherContext *cc, u_ch
+ 	int evplen = 0;
+ 
+ 	switch (c->number) {
++	case SSH_CIPHER_NONE:
+ 	case SSH_CIPHER_SSH2:
+ 	case SSH_CIPHER_DES:
+ 	case SSH_CIPHER_BLOWFISH:
+diff -NupwB cipher-ctr-mt.c cipher-ctr-mt.c
+--- cipher-ctr-mt.c	1969-12-31 19:00:00.000000000 -0500
++++ cipher-ctr-mt.c	2009-05-14 12:36:10.000000000 -0400
 @@ -0,0 +1,473 @@
 +/*
 + * OpenSSH Multi-threaded AES-CTR Cipher
@@ -914,60 +811,10 @@ diff -urN cipher-ctr-mt.c cipher-ctr-mt.c
 +#endif
 +	return (&aes_ctr);
 +}
-diff -urN cipher.c cipher.c
---- cipher.c	2009-01-28 08:38:41.000000000 +0300
-+++ cipher.c	2009-05-02 17:43:11.000000000 +0400
-@@ -55,6 +55,7 @@
- extern const EVP_CIPHER *evp_ssh1_3des(void);
- extern void ssh1_3des_iv(EVP_CIPHER_CTX *, int, u_char *, int);
- extern const EVP_CIPHER *evp_aes_128_ctr(void);
-+extern const EVP_CIPHER *evp_aes_ctr_mt(void);
- extern void ssh_aes_ctr_iv(EVP_CIPHER_CTX *, int, u_char *, u_int);
- 
- struct Cipher {
-@@ -82,9 +83,9 @@
- 	{ "aes256-cbc",		SSH_CIPHER_SSH2, 16, 32, 0, 1, EVP_aes_256_cbc },
- 	{ "rijndael-cbc@lysator.liu.se",
- 				SSH_CIPHER_SSH2, 16, 32, 0, 1, EVP_aes_256_cbc },
--	{ "aes128-ctr",		SSH_CIPHER_SSH2, 16, 16, 0, 0, evp_aes_128_ctr },
--	{ "aes192-ctr",		SSH_CIPHER_SSH2, 16, 24, 0, 0, evp_aes_128_ctr },
--	{ "aes256-ctr",		SSH_CIPHER_SSH2, 16, 32, 0, 0, evp_aes_128_ctr },
-+ 	{ "aes128-ctr",		SSH_CIPHER_SSH2, 16, 16, 0, 0, evp_aes_ctr_mt },
-+ 	{ "aes192-ctr",		SSH_CIPHER_SSH2, 16, 24, 0, 0, evp_aes_ctr_mt },
-+ 	{ "aes256-ctr",		SSH_CIPHER_SSH2, 16, 32, 0, 0, evp_aes_ctr_mt },
- #ifdef USE_CIPHER_ACSS
- 	{ "acss@openssh.org",	SSH_CIPHER_SSH2, 16, 5, 0, 0, EVP_acss },
- #endif
-@@ -163,7 +164,8 @@
- 	for ((p = strsep(&cp, CIPHER_SEP)); p && *p != '\0';
- 	    (p = strsep(&cp, CIPHER_SEP))) {
- 		c = cipher_by_name(p);
--		if (c == NULL || c->number != SSH_CIPHER_SSH2) {
-+		if (c == NULL || (c->number != SSH_CIPHER_SSH2 && 
-+c->number != SSH_CIPHER_NONE)) {
- 			debug("bad cipher %s [%s]", p, names);
- 			xfree(cipher_list);
- 			return 0;
-@@ -337,6 +339,7 @@
- 	int evplen;
- 
- 	switch (c->number) {
-+	case SSH_CIPHER_NONE:
- 	case SSH_CIPHER_SSH2:
- 	case SSH_CIPHER_DES:
- 	case SSH_CIPHER_BLOWFISH:
-@@ -371,6 +374,7 @@
- 	int evplen = 0;
- 
- 	switch (c->number) {
-+	case SSH_CIPHER_NONE:
- 	case SSH_CIPHER_SSH2:
- 	case SSH_CIPHER_DES:
- 	case SSH_CIPHER_BLOWFISH:
-diff -urN clientloop.c clientloop.c
---- clientloop.c	2009-02-14 08:28:21.000000000 +0300
-+++ clientloop.c	2009-05-02 17:38:18.000000000 +0400
-@@ -1688,9 +1688,15 @@
+diff -NupwB clientloop.c clientloop.c
+--- clientloop.c	2009-02-14 00:28:21.000000000 -0500
++++ clientloop.c	2009-05-14 12:36:10.000000000 -0400
+@@ -1688,9 +1688,15 @@ client_request_x11(const char *request_t
  	sock = x11_connect_display();
  	if (sock < 0)
  		return NULL;
@@ -983,7 +830,7 @@ diff -urN clientloop.c clientloop.c
  	c->force_drain = 1;
  	return c;
  }
-@@ -1710,9 +1716,15 @@
+@@ -1710,9 +1716,15 @@ client_request_agent(const char *request
  	sock = ssh_get_authentication_socket();
  	if (sock < 0)
  		return NULL;
@@ -1000,7 +847,7 @@ diff -urN clientloop.c clientloop.c
  	    "authentication agent connection", 1);
  	c->force_drain = 1;
  	return c;
-@@ -1740,10 +1752,18 @@
+@@ -1740,10 +1752,18 @@ client_request_tun_fwd(int tun_mode, int
  		return -1;
  	}
  
@@ -1020,10 +867,10 @@ diff -urN clientloop.c clientloop.c
  #if defined(SSH_TUN_FILTER)
  	if (options.tun_open == SSH_TUNMODE_POINTOPOINT)
  		channel_register_filter(c->self, sys_tun_infilter,
-diff -urN compat.c compat.c
---- compat.c	2008-11-03 11:20:14.000000000 +0300
-+++ compat.c	2009-05-02 17:38:18.000000000 +0400
-@@ -170,6 +170,15 @@
+diff -NupwB compat.c compat.c
+--- compat.c	2008-11-03 03:20:14.000000000 -0500
++++ compat.c	2009-05-14 12:36:10.000000000 -0400
+@@ -170,6 +170,15 @@ compat_datafellows(const char *version)
  		    strlen(check[i].pat), 0) == 1) {
  			debug("match: %s pat %s", version, check[i].pat);
  			datafellows = check[i].bugs;
@@ -1039,9 +886,9 @@ diff -urN compat.c compat.c
  			return;
  		}
  	}
-diff -urN compat.h compat.h
---- compat.h	2008-11-03 11:20:14.000000000 +0300
-+++ compat.h	2009-05-02 17:40:04.000000000 +0400
+diff -NupwB compat.h compat.h
+--- compat.h	2008-11-03 03:20:14.000000000 -0500
++++ compat.h	2009-05-14 12:36:10.000000000 -0400
 @@ -58,6 +58,7 @@
  #define SSH_OLD_FORWARD_ADDR	0x01000000
  #define SSH_BUG_RFWD_ADDR	0x02000000
@@ -1050,9 +897,142 @@ diff -urN compat.h compat.h
  
  void     enable_compat13(void);
  void     enable_compat20(void);
-diff -urN kex.c kex.c
---- kex.c	2008-11-03 11:19:12.000000000 +0300
-+++ kex.c	2009-05-02 17:38:18.000000000 +0400
+Common subdirectories: contrib and contrib
+diff -NupwB HPN-README HPN-README
+--- HPN-README	1969-12-31 19:00:00.000000000 -0500
++++ HPN-README	2009-05-14 12:36:10.000000000 -0400
+@@ -0,0 +1,128 @@
++Notes:
++
++MULTI-THREADED CIPHER:
++The AES cipher in CTR mode has been multithreaded (MTR-AES-CTR). This will allow ssh installations
++on hosts with multiple cores to use more than one processing core during encryption. 
++Tests have show significant throughput performance increases when using MTR-AES-CTR up 
++to and including a full gigabit per second on quad core systems. It should be possible to 
++achieve full line rate on dual core systems but OS and data management overhead makes this
++more difficult to achieve. The cipher stream from MTR-AES-CTR is entirely compatible with single 
++thread AES-CTR (ST-AES-CTR) implementations and should be 100% backward compatible. Optimal 
++performance requires the MTR-AES-CTR mode be enabled on both ends of the connection. 
++The MTR-AES-CTR replaces ST-AES-CTR and is used in exactly the same way with the same
++nomenclature. 
++Use examples: 	ssh -caes128-ctr you@host.com
++		scp -oCipher=aes256-ctr file you@host.com:~/file
++
++NONE CIPHER:
++To use the NONE option you must have the NoneEnabled switch set on the server and
++you *must* have *both* NoneEnabled and NoneSwitch set to yes on the client. The NONE
++feature works with ALL ssh subsystems (as far as we can tell) *AS LONG AS* a tty is not 
++spawned. If a user uses the -T switch to prevent a tty being created the NONE cipher will
++be disabled. 
++
++The performance increase will only be as good as the network and TCP stack tuning
++on the reciever side of the connection allows. As a rule of thumb a user will need 
++at least 10Mb/s connection with a 100ms RTT to see a doubling of performance. The
++HPN-SSH home page describes this in greater detail. 
++
++http://www.psc.edu/networking/projects/hpn-ssh
++
++BUFFER SIZES:
++
++If HPN is disabled the receive buffer size will be set to the 
++OpenSSH default of 64K.
++
++If an HPN system connects to a nonHPN system the receive buffer will
++be set to the HPNBufferSize value. The default is 2MB but user adjustable.
++
++If an HPN to HPN connection is established a number of different things might
++happen based on the user options and conditions. 
++
++Conditions: HPNBufferSize NOT Set, TCPRcvBufPoll enabled, TCPRcvBuf NOT Set 
++HPN Buffer Size = up to 64MB 
++This is the default state. The HPN buffer size will grow to a maximum of 64MB 
++as the TCP receive buffer grows. The maximum HPN Buffer size of 64MB is 
++geared towards 10GigE transcontinental connections. 
++
++Conditions: HPNBufferSize NOT Set, TCPRcvBufPoll disabled, TCPRcvBuf NOT Set
++HPN Buffer Size = TCP receive buffer value. 
++Users on non-autotuning systesm should disable TCPRcvBufPoll in the 
++ssh_cofig and sshd_config
++
++Conditions: HPNBufferSize SET, TCPRcvBufPoll disabled, TCPRcvBuf NOT Set
++HPN Buffer Size = minmum of TCP receive buffer and HPNBufferSize. 
++This would be the system defined TCP receive buffer (RWIN).
++
++Conditions: HPNBufferSize SET, TCPRcvBufPoll disabled, TCPRcvBuf SET
++HPN Buffer Size = minmum of TCPRcvBuf and HPNBufferSize. 
++Generally there is no need to set both.
++
++Conditions: HPNBufferSize SET, TCPRcvBufPoll enabled, TCPRcvBuf NOT Set
++HPN Buffer Size = grows to HPNBufferSize
++The buffer will grow up to the maximum size specified here. 
++
++Conditions: HPNBufferSize SET, TCPRcvBufPoll enabled, TCPRcvBuf SET
++HPN Buffer Size = minmum of TCPRcvBuf and HPNBufferSize. 
++Generally there is no need to set both of these, especially on autotuning 
++systems. However, if the users wishes to override the autotuning this would be 
++one way to do it.
++
++Conditions: HPNBufferSize NOT Set, TCPRcvBufPoll enabled, TCPRcvBuf SET
++HPN Buffer Size = TCPRcvBuf. 
++This will override autotuning and set the TCP recieve buffer to the user defined 
++value.
++
++
++HPN Specific Configuration options
++
++TcpRcvBuf=[int]KB client
++      set the TCP socket receive buffer to n Kilobytes. It can be set up to the 
++maximum socket size allowed by the system. This is useful in situations where 
++the tcp receive window is set low but the maximum buffer size is set 
++higher (as is typical). This works on a per TCP connection basis. You can also 
++use this to artifically limit the transfer rate of the connection. In these 
++cases the throughput will be no more than n/RTT. The minimum buffer size is 1KB. 
++Default is the current system wide tcp receive buffer size.
++
++TcpRcvBufPoll=[yes/no] client/server
++      enable of disable the polling of the tcp receive buffer through the life 
++of the connection. You would want to make sure that this option is enabled 
++for systems making use of autotuning kernels (linux 2.4.24+, 2.6, MS Vista) 
++default is yes.
++
++NoneEnabled=[yes/no] client/server
++      enable or disable the use of the None cipher. Care must always be used 
++when enabling this as it will allow users to send data in the clear. However, 
++it is important to note that authentication information remains encrypted 
++even if this option is enabled. Set to no by default.
++
++NoneSwitch=[yes/no] client
++     Switch the encryption cipher being used to the None cipher after
++authentication takes place. NoneEnabled must be enabled on both the client
++and server side of the connection. When the connection switches to the NONE
++cipher a warning is sent to STDERR. The connection attempt will fail with an
++error if a client requests a NoneSwitch from the server that does not explicitly
++have NoneEnabled set to yes. Note: The NONE cipher cannot be used in
++interactive (shell) sessions and it will fail silently. Set to no by default.
++
++HPNDisabled=[yes/no] client/server
++     In some situations, such as transfers on a local area network, the impact 
++of the HPN code produces a net decrease in performance. In these cases it is 
++helpful to disable the HPN functionality. By default HPNDisabled is set to no. 
++
++HPNBufferSize=[int]KB client/server
++     This is the default buffer size the HPN functionality uses when interacting
++with nonHPN SSH installations. Conceptually this is similar to the TcpRcvBuf
++option as applied to the internal SSH flow control. This value can range from 
++1KB to 64MB (1-65536). Use of oversized or undersized buffers can cause performance
++problems depending on the length of the network path. The default size of this buffer
++is 2MB.
++
++
++Credits: This patch was conceived, designed, and led by Chris Rapier (rapier@psc.edu)
++         The majority of the actual coding for versions up to HPN12v1 was performed
++         by Michael Stevens (mstevens@andrew.cmu.edu). The MT-AES-CTR cipher was 
++	 implemented by Ben Bennet (ben@psc.edu). This work was financed, in part,
++         by Cisco System, Inc., the National Library of Medicine, 
++	 and the National Science Foundation. 
+diff -NupwB kex.c kex.c
+--- kex.c	2008-11-03 03:19:12.000000000 -0500
++++ kex.c	2009-05-14 12:36:10.000000000 -0400
 @@ -48,6 +48,7 @@
  #include "match.h"
  #include "dispatch.h"
@@ -1061,7 +1041,7 @@ diff -urN kex.c kex.c
  
  #define KEX_COOKIE_LEN	16
  
-@@ -64,7 +65,8 @@
+@@ -64,7 +65,8 @@ static void kex_kexinit_finish(Kex *);
  static void kex_choose_conf(Kex *);
  
  /* put algorithm proposal into buffer */
@@ -1071,7 +1051,7 @@ diff -urN kex.c kex.c
  kex_prop2buf(Buffer *b, char *proposal[PROPOSAL_MAX])
  {
  	u_int i;
-@@ -376,6 +378,13 @@
+@@ -376,6 +378,13 @@ kex_choose_conf(Kex *kex)
  	int nenc, nmac, ncomp;
  	u_int mode, ctos, need;
  	int first_kex_follows, type;
@@ -1085,7 +1065,7 @@ diff -urN kex.c kex.c
  
  	my   = kex_buf2prop(&kex->my, NULL);
  	peer = kex_buf2prop(&kex->peer, &first_kex_follows);
-@@ -400,11 +409,34 @@
+@@ -400,11 +409,34 @@ kex_choose_conf(Kex *kex)
  		choose_enc (&newkeys->enc,  cprop[nenc],  sprop[nenc]);
  		choose_mac (&newkeys->mac,  cprop[nmac],  sprop[nmac]);
  		choose_comp(&newkeys->comp, cprop[ncomp], sprop[ncomp]);
@@ -1120,10 +1100,10 @@ diff -urN kex.c kex.c
  	}
  	choose_kex(kex, cprop[PROPOSAL_KEX_ALGS], sprop[PROPOSAL_KEX_ALGS]);
  	choose_hostkeyalg(kex, cprop[PROPOSAL_SERVER_HOST_KEY_ALGS],
-diff -urN kex.h kex.h
---- kex.h	2007-06-11 08:01:42.000000000 +0400
-+++ kex.h	2009-05-02 17:38:18.000000000 +0400
-@@ -127,6 +127,8 @@
+diff -NupwB kex.h kex.h
+--- kex.h	2007-06-11 00:01:42.000000000 -0400
++++ kex.h	2009-05-14 12:36:10.000000000 -0400
+@@ -127,6 +127,8 @@ struct Kex {
  	void	(*kex[KEX_MAX])(Kex *);
  };
  
@@ -1132,22 +1112,44 @@ diff -urN kex.h kex.h
  Kex	*kex_setup(char *[PROPOSAL_MAX]);
  void	 kex_finish(Kex *);
  
-diff -urN myproposal.h myproposal.h
---- myproposal.h	2009-01-28 08:33:31.000000000 +0300
-+++ myproposal.h	2009-05-02 17:45:01.000000000 +0400
+diff -NupwB Makefile.in Makefile.in
+--- Makefile.in	2008-11-05 00:20:46.000000000 -0500
++++ Makefile.in	2009-05-14 12:36:10.000000000 -0400
+@@ -43,7 +43,7 @@ CC=@CC@
+ LD=@LD@
+ CFLAGS=@CFLAGS@
+ CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ $(PATHS) @DEFS@
+-LIBS=@LIBS@
++LIBS=@LIBS@ -lpthread
+ SSHDLIBS=@SSHDLIBS@
+ LIBEDIT=@LIBEDIT@
+ AR=@AR@
+@@ -64,7 +64,7 @@ TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-a
+ 
+ LIBSSH_OBJS=acss.o authfd.o authfile.o bufaux.o bufbn.o buffer.o \
+ 	canohost.o channels.o cipher.o cipher-acss.o cipher-aes.o \
+-	cipher-bf1.o cipher-ctr.o cipher-3des1.o cleanup.o \
++	cipher-bf1.o cipher-ctr.o cipher-ctr-mt.o cipher-3des1.o cleanup.o \
+ 	compat.o compress.o crc32.o deattack.o fatal.o hostfile.o \
+ 	log.o match.o md-sha256.o moduli.o nchan.o packet.o \
+ 	readpass.o rsa.o ttymodes.o xmalloc.o addrmatch.o \
+diff -NupwB myproposal.h myproposal.h
+--- myproposal.h	2009-01-28 00:33:31.000000000 -0500
++++ myproposal.h	2009-05-14 12:36:10.000000000 -0400
 @@ -47,6 +47,8 @@
  	"arcfour256,arcfour128," \
  	"aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc," \
  	"aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se"
 +#define KEX_ENCRYPT_INCLUDE_NONE KEX_DEFAULT_ENCRYPT \
-+ 	",none"
++	",none"
  #define	KEX_DEFAULT_MAC \
  	"hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160," \
  	"hmac-ripemd160@openssh.com," \
-diff -urN packet.c packet.c
---- packet.c	2009-02-14 08:35:01.000000000 +0300
-+++ packet.c	2009-05-02 17:38:18.000000000 +0400
-@@ -775,7 +775,7 @@
+Common subdirectories: openbsd-compat and openbsd-compat
+diff -NupwB packet.c packet.c
+--- packet.c	2009-02-14 00:35:01.000000000 -0500
++++ packet.c	2009-05-14 12:36:10.000000000 -0400
+@@ -775,7 +775,7 @@ packet_enable_delayed_compress(void)
  /*
   * Finalize packet in SSH2 format (compress, mac, encrypt, enqueue)
   */
@@ -1156,7 +1158,7 @@ diff -urN packet.c packet.c
  packet_send2_wrapped(void)
  {
  	u_char type, *cp, *macbuf = NULL;
-@@ -888,11 +888,13 @@
+@@ -888,11 +888,13 @@ packet_send2_wrapped(void)
  		set_newkeys(MODE_OUT);
  	else if (type == SSH2_MSG_USERAUTH_SUCCESS && server_side)
  		packet_enable_delayed_compress();
@@ -1171,7 +1173,7 @@ diff -urN packet.c packet.c
  	static int rekeying = 0;
  	struct packet *p;
  	u_char type, *cp;
-@@ -910,7 +912,7 @@
+@@ -910,7 +912,7 @@ packet_send2(void)
  			memcpy(&p->payload, &outgoing_packet, sizeof(Buffer));
  			buffer_init(&outgoing_packet);
  			TAILQ_INSERT_TAIL(&outgoing, p, next);
@@ -1180,7 +1182,7 @@ diff -urN packet.c packet.c
  		}
  	}
  
-@@ -918,7 +920,7 @@
+@@ -918,7 +920,7 @@ packet_send2(void)
  	if (type == SSH2_MSG_KEXINIT)
  		rekeying = 1;
  
@@ -1189,7 +1191,7 @@ diff -urN packet.c packet.c
  
  	/* after a NEWKEYS message we can send the complete queue */
  	if (type == SSH2_MSG_NEWKEYS) {
-@@ -931,19 +933,22 @@
+@@ -931,19 +933,22 @@ packet_send2(void)
  			    sizeof(Buffer));
  			TAILQ_REMOVE(&outgoing, p, next);
  			xfree(p);
@@ -1215,7 +1217,7 @@ diff -urN packet.c packet.c
  }
  
  /*
-@@ -1544,23 +1549,25 @@
+@@ -1544,23 +1549,25 @@ packet_disconnect(const char *fmt,...)
  
  /* Checks if there is any buffered output, and tries to write some of the output. */
  
@@ -1244,7 +1246,7 @@ diff -urN packet.c packet.c
  }
  
  
-@@ -1569,16 +1576,17 @@
+@@ -1569,16 +1576,17 @@ packet_write_poll(void)
   * written.
   */
  
@@ -1264,7 +1266,7 @@ diff -urN packet.c packet.c
  	while (packet_have_data_to_write()) {
  		memset(setp, 0, howmany(connection_out + 1, NFDBITS) *
  		    sizeof(fd_mask));
-@@ -1612,7 +1620,7 @@
+@@ -1612,7 +1620,7 @@ packet_write_wait(void)
  			    "waiting to write", get_remote_ipaddr());
  			cleanup_exit(255);
  		}
@@ -1273,7 +1275,7 @@ diff -urN packet.c packet.c
  	}
  	xfree(setp);
  }
-@@ -1736,12 +1744,24 @@
+@@ -1736,12 +1744,24 @@ packet_send_ignore(int nbytes)
  	}
  }
  
@@ -1298,7 +1300,7 @@ diff -urN packet.c packet.c
  	return
  	    (p_send.packets > MAX_PACKETS) ||
  	    (p_read.packets > MAX_PACKETS) ||
-@@ -1766,3 +1786,9 @@
+@@ -1766,3 +1786,9 @@ packet_set_authenticated(void)
  {
  	after_authentication = 1;
  }
@@ -1308,9 +1310,9 @@ diff -urN packet.c packet.c
 +{
 +	return(after_authentication);
 +}
-diff -urN packet.h packet.h
---- packet.h	2008-07-11 11:36:48.000000000 +0400
-+++ packet.h	2009-05-02 17:38:18.000000000 +0400
+diff -NupwB packet.h packet.h
+--- packet.h	2008-07-11 03:36:48.000000000 -0400
++++ packet.h	2009-05-14 12:36:10.000000000 -0400
 @@ -20,6 +20,9 @@
  
  #include <openssl/bn.h>
@@ -1321,7 +1323,7 @@ diff -urN packet.h packet.h
  void     packet_set_connection(int, int);
  void     packet_set_timeout(int, int);
  void     packet_set_nonblocking(void);
-@@ -35,6 +38,7 @@
+@@ -35,6 +38,7 @@ void     packet_set_interactive(int);
  int      packet_is_interactive(void);
  void     packet_set_server(void);
  void     packet_set_authenticated(void);
@@ -1329,7 +1331,7 @@ diff -urN packet.h packet.h
  
  void     packet_start(u_char);
  void     packet_put_char(int ch);
-@@ -44,7 +48,7 @@
+@@ -44,7 +48,7 @@ void     packet_put_bignum2(BIGNUM * val
  void     packet_put_string(const void *buf, u_int len);
  void     packet_put_cstring(const char *str);
  void     packet_put_raw(const void *buf, u_int len);
@@ -1338,7 +1340,7 @@ diff -urN packet.h packet.h
  
  int      packet_read(void);
  void     packet_read_expect(int type);
-@@ -73,8 +77,8 @@
+@@ -73,8 +77,8 @@ void	 packet_set_state(int, u_int32_t, u
  int	 packet_get_ssh1_cipher(void);
  void	 packet_set_iv(int, u_char *);
  
@@ -1349,10 +1351,10 @@ diff -urN packet.h packet.h
  int      packet_have_data_to_write(void);
  int      packet_not_very_much_data_to_write(void);
  
-diff -urN progressmeter.c progressmeter.c
---- progressmeter.c	2006-08-05 06:39:40.000000000 +0400
-+++ progressmeter.c	2009-05-02 17:38:18.000000000 +0400
-@@ -68,6 +68,8 @@
+diff -NupwB progressmeter.c progressmeter.c
+--- progressmeter.c	2006-08-04 22:39:40.000000000 -0400
++++ progressmeter.c	2009-05-14 12:36:10.000000000 -0400
+@@ -68,6 +68,8 @@ static time_t last_update;	/* last progr
  static char *file;		/* name of the file being transferred */
  static off_t end_pos;		/* ending position of transfer */
  static off_t cur_pos;		/* transfer position as of last refresh */
@@ -1361,7 +1363,7 @@ diff -urN progressmeter.c progressmeter.c
  static volatile off_t *counter;	/* progress counter */
  static long stalled;		/* how long we have been stalled */
  static int bytes_per_second;	/* current speed in bytes per second */
-@@ -128,12 +130,17 @@
+@@ -128,12 +130,17 @@ refresh_progress_meter(void)
  	int hours, minutes, seconds;
  	int i, len;
  	int file_len;
@@ -1379,7 +1381,7 @@ diff -urN progressmeter.c progressmeter.c
  	if (bytes_left > 0)
  		elapsed = now - last_update;
  	else {
-@@ -158,7 +165,7 @@
+@@ -158,7 +165,7 @@ refresh_progress_meter(void)
  
  	/* filename */
  	buf[0] = '\0';
@@ -1388,7 +1390,7 @@ diff -urN progressmeter.c progressmeter.c
  	if (file_len > 0) {
  		len = snprintf(buf, file_len + 1, "\r%s", file);
  		if (len < 0)
-@@ -175,7 +182,8 @@
+@@ -175,7 +182,8 @@ refresh_progress_meter(void)
  		percent = ((float)cur_pos / end_pos) * 100;
  	else
  		percent = 100;
@@ -1398,7 +1400,7 @@ diff -urN progressmeter.c progressmeter.c
  	    " %3d%% ", percent);
  
  	/* amount transferred */
-@@ -188,6 +196,15 @@
+@@ -188,6 +196,15 @@ refresh_progress_meter(void)
  	    (off_t)bytes_per_second);
  	strlcat(buf, "/s ", win_size);
  
@@ -1414,7 +1416,7 @@ diff -urN progressmeter.c progressmeter.c
  	/* ETA */
  	if (!transferred)
  		stalled += elapsed;
-@@ -224,6 +241,7 @@
+@@ -224,6 +241,7 @@ refresh_progress_meter(void)
  
  	atomicio(vwrite, STDOUT_FILENO, buf, win_size - 1);
  	last_update = now;
@@ -1422,32 +1424,32 @@ diff -urN progressmeter.c progressmeter.c
  }
  
  /*ARGSUSED*/
-diff -urN readconf.c readconf.c
---- readconf.c	2009-05-02 17:37:11.000000000 +0400
-+++ readconf.c	2009-05-02 17:47:56.000000000 +0400
-@@ -131,6 +131,8 @@
+diff -NupwB readconf.c readconf.c
+--- readconf.c	2009-02-14 00:28:21.000000000 -0500
++++ readconf.c	2009-05-14 12:36:10.000000000 -0400
+@@ -131,6 +131,8 @@ typedef enum {
  	oSendEnv, oControlPath, oControlMaster, oHashKnownHosts,
  	oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand,
  	oVisualHostKey, oZeroKnowledgePasswordAuthentication,
-+ 	oNoneEnabled, oTcpRcvBufPoll, oTcpRcvBuf, oNoneSwitch, oHPNDisabled,
-+ 	oHPNBufferSize,
++	oNoneEnabled, oTcpRcvBufPoll, oTcpRcvBuf, oNoneSwitch, oHPNDisabled,
++	oHPNBufferSize,
  	oDeprecated, oUnsupported
  } OpCodes;
  
-@@ -228,6 +230,12 @@
- 	{ "localcommand", oLocalCommand },
- 	{ "permitlocalcommand", oPermitLocalCommand },
- 	{ "visualhostkey", oVisualHostKey },
-+ 	{ "noneenabled", oNoneEnabled },
-+ 	{ "tcprcvbufpoll", oTcpRcvBufPoll },
-+ 	{ "tcprcvbuf", oTcpRcvBuf },
-+ 	{ "noneswitch", oNoneSwitch },
-+ 	{ "hpndisabled", oHPNDisabled },
-+ 	{ "hpnbuffersize", oHPNBufferSize },
- #ifdef JPAKE
- 	{ "zeroknowledgepasswordauthentication",
- 	    oZeroKnowledgePasswordAuthentication },
-@@ -465,6 +473,37 @@
+@@ -234,6 +236,12 @@ static struct {
+ #else
+ 	{ "zeroknowledgepasswordauthentication", oUnsupported },
+ #endif
++	{ "noneenabled", oNoneEnabled },
++	{ "tcprcvbufpoll", oTcpRcvBufPoll },
++	{ "tcprcvbuf", oTcpRcvBuf },
++	{ "noneswitch", oNoneSwitch },
++	{ "hpndisabled", oHPNDisabled },
++	{ "hpnbuffersize", oHPNBufferSize },
+ 
+ 	{ NULL, oBadOption }
+ };
+@@ -465,6 +473,37 @@ parse_flag:
  		intptr = &options->check_host_ip;
  		goto parse_flag;
  
@@ -1485,7 +1487,7 @@ diff -urN readconf.c readconf.c
  	case oVerifyHostKeyDNS:
  		intptr = &options->verify_host_key_dns;
  		goto parse_yesnoask;
-@@ -643,6 +682,10 @@
+@@ -643,6 +682,10 @@ parse_int:
  		intptr = &options->connection_attempts;
  		goto parse_int;
  
@@ -1496,20 +1498,20 @@ diff -urN readconf.c readconf.c
  	case oCipher:
  		intptr = &options->cipher;
  		arg = strdelim(&s);
-@@ -1065,6 +1108,12 @@
+@@ -1065,6 +1108,12 @@ initialize_options(Options * options)
  	options->permit_local_command = -1;
  	options->visual_host_key = -1;
  	options->zero_knowledge_password_authentication = -1;
-+ 	options->none_switch = -1;
-+ 	options->none_enabled = -1;
-+ 	options->hpn_disabled = -1;
-+ 	options->hpn_buffer_size = -1;
-+ 	options->tcp_rcv_buf_poll = -1;
-+ 	options->tcp_rcv_buf = -1;
++	options->none_switch = -1;
++	options->none_enabled = -1;
++	options->hpn_disabled = -1;
++	options->hpn_buffer_size = -1;
++	options->tcp_rcv_buf_poll = -1;
++	options->tcp_rcv_buf = -1;
  }
  
  /*
-@@ -1187,6 +1236,29 @@
+@@ -1187,6 +1236,29 @@ fill_default_options(Options * options)
  		options->server_alive_interval = 0;
  	if (options->server_alive_count_max == -1)
  		options->server_alive_count_max = 3;
@@ -1539,10 +1541,1324 @@ diff -urN readconf.c readconf.c
  	if (options->control_master == -1)
  		options->control_master = 0;
  	if (options->hash_known_hosts == -1)
-diff -urN readconf.h readconf.h
---- readconf.h	2009-02-14 08:28:21.000000000 +0300
-+++ readconf.h	2009-05-02 17:38:19.000000000 +0400
-@@ -57,6 +57,11 @@
+diff -NupwB readconf.c.orig readconf.c.orig
+--- readconf.c.orig	1969-12-31 19:00:00.000000000 -0500
++++ readconf.c.orig	2009-02-14 00:28:21.000000000 -0500
+@@ -0,0 +1,1310 @@
++/* $OpenBSD: readconf.c,v 1.176 2009/02/12 03:00:56 djm Exp $ */
++/*
++ * Author: Tatu Ylonen <ylo@cs.hut.fi>
++ * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
++ *                    All rights reserved
++ * Functions for reading the configuration files.
++ *
++ * As far as I am concerned, the code I have written for this software
++ * can be used freely for any purpose.  Any derived versions of this
++ * software must be clearly marked as such, and if the derived work is
++ * incompatible with the protocol description in the RFC file, it must be
++ * called by a name other than "ssh" or "Secure Shell".
++ */
++
++#include "includes.h"
++
++#include <sys/types.h>
++#include <sys/stat.h>
++#include <sys/socket.h>
++
++#include <netinet/in.h>
++
++#include <ctype.h>
++#include <errno.h>
++#include <netdb.h>
++#include <signal.h>
++#include <stdarg.h>
++#include <stdio.h>
++#include <string.h>
++#include <unistd.h>
++
++#include "xmalloc.h"
++#include "ssh.h"
++#include "compat.h"
++#include "cipher.h"
++#include "pathnames.h"
++#include "log.h"
++#include "key.h"
++#include "readconf.h"
++#include "match.h"
++#include "misc.h"
++#include "buffer.h"
++#include "kex.h"
++#include "mac.h"
++
++/* Format of the configuration file:
++
++   # Configuration data is parsed as follows:
++   #  1. command line options
++   #  2. user-specific file
++   #  3. system-wide file
++   # Any configuration value is only changed the first time it is set.
++   # Thus, host-specific definitions should be at the beginning of the
++   # configuration file, and defaults at the end.
++
++   # Host-specific declarations.  These may override anything above.  A single
++   # host may match multiple declarations; these are processed in the order
++   # that they are given in.
++
++   Host *.ngs.fi ngs.fi
++     User foo
++
++   Host fake.com
++     HostName another.host.name.real.org
++     User blaah
++     Port 34289
++     ForwardX11 no
++     ForwardAgent no
++
++   Host books.com
++     RemoteForward 9999 shadows.cs.hut.fi:9999
++     Cipher 3des
++
++   Host fascist.blob.com
++     Port 23123
++     User tylonen
++     PasswordAuthentication no
++
++   Host puukko.hut.fi
++     User t35124p
++     ProxyCommand ssh-proxy %h %p
++
++   Host *.fr
++     PublicKeyAuthentication no
++
++   Host *.su
++     Cipher none
++     PasswordAuthentication no
++
++   Host vpn.fake.com
++     Tunnel yes
++     TunnelDevice 3
++
++   # Defaults for various options
++   Host *
++     ForwardAgent no
++     ForwardX11 no
++     PasswordAuthentication yes
++     RSAAuthentication yes
++     RhostsRSAAuthentication yes
++     StrictHostKeyChecking yes
++     TcpKeepAlive no
++     IdentityFile ~/.ssh/identity
++     Port 22
++     EscapeChar ~
++
++*/
++
++/* Keyword tokens. */
++
++typedef enum {
++	oBadOption,
++	oForwardAgent, oForwardX11, oForwardX11Trusted, oGatewayPorts,
++	oExitOnForwardFailure,
++	oPasswordAuthentication, oRSAAuthentication,
++	oChallengeResponseAuthentication, oXAuthLocation,
++	oIdentityFile, oHostName, oPort, oCipher, oRemoteForward, oLocalForward,
++	oUser, oHost, oEscapeChar, oRhostsRSAAuthentication, oProxyCommand,
++	oGlobalKnownHostsFile, oUserKnownHostsFile, oConnectionAttempts,
++	oBatchMode, oCheckHostIP, oStrictHostKeyChecking, oCompression,
++	oCompressionLevel, oTCPKeepAlive, oNumberOfPasswordPrompts,
++	oUsePrivilegedPort, oLogLevel, oCiphers, oProtocol, oMacs,
++	oGlobalKnownHostsFile2, oUserKnownHostsFile2, oPubkeyAuthentication,
++	oKbdInteractiveAuthentication, oKbdInteractiveDevices, oHostKeyAlias,
++	oDynamicForward, oPreferredAuthentications, oHostbasedAuthentication,
++	oHostKeyAlgorithms, oBindAddress, oSmartcardDevice,
++	oClearAllForwardings, oNoHostAuthenticationForLocalhost,
++	oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
++	oAddressFamily, oGssAuthentication, oGssDelegateCreds,
++	oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
++	oSendEnv, oControlPath, oControlMaster, oHashKnownHosts,
++	oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand,
++	oVisualHostKey, oZeroKnowledgePasswordAuthentication,
++	oDeprecated, oUnsupported
++} OpCodes;
++
++/* Textual representations of the tokens. */
++
++static struct {
++	const char *name;
++	OpCodes opcode;
++} keywords[] = {
++	{ "forwardagent", oForwardAgent },
++	{ "forwardx11", oForwardX11 },
++	{ "forwardx11trusted", oForwardX11Trusted },
++	{ "exitonforwardfailure", oExitOnForwardFailure },
++	{ "xauthlocation", oXAuthLocation },
++	{ "gatewayports", oGatewayPorts },
++	{ "useprivilegedport", oUsePrivilegedPort },
++	{ "rhostsauthentication", oDeprecated },
++	{ "passwordauthentication", oPasswordAuthentication },
++	{ "kbdinteractiveauthentication", oKbdInteractiveAuthentication },
++	{ "kbdinteractivedevices", oKbdInteractiveDevices },
++	{ "rsaauthentication", oRSAAuthentication },
++	{ "pubkeyauthentication", oPubkeyAuthentication },
++	{ "dsaauthentication", oPubkeyAuthentication },		    /* alias */
++	{ "rhostsrsaauthentication", oRhostsRSAAuthentication },
++	{ "hostbasedauthentication", oHostbasedAuthentication },
++	{ "challengeresponseauthentication", oChallengeResponseAuthentication },
++	{ "skeyauthentication", oChallengeResponseAuthentication }, /* alias */
++	{ "tisauthentication", oChallengeResponseAuthentication },  /* alias */
++	{ "kerberosauthentication", oUnsupported },
++	{ "kerberostgtpassing", oUnsupported },
++	{ "afstokenpassing", oUnsupported },
++#if defined(GSSAPI)
++	{ "gssapiauthentication", oGssAuthentication },
++	{ "gssapidelegatecredentials", oGssDelegateCreds },
++#else
++	{ "gssapiauthentication", oUnsupported },
++	{ "gssapidelegatecredentials", oUnsupported },
++#endif
++	{ "fallbacktorsh", oDeprecated },
++	{ "usersh", oDeprecated },
++	{ "identityfile", oIdentityFile },
++	{ "identityfile2", oIdentityFile },			/* obsolete */
++	{ "identitiesonly", oIdentitiesOnly },
++	{ "hostname", oHostName },
++	{ "hostkeyalias", oHostKeyAlias },
++	{ "proxycommand", oProxyCommand },
++	{ "port", oPort },
++	{ "cipher", oCipher },
++	{ "ciphers", oCiphers },
++	{ "macs", oMacs },
++	{ "protocol", oProtocol },
++	{ "remoteforward", oRemoteForward },
++	{ "localforward", oLocalForward },
++	{ "user", oUser },
++	{ "host", oHost },
++	{ "escapechar", oEscapeChar },
++	{ "globalknownhostsfile", oGlobalKnownHostsFile },
++	{ "globalknownhostsfile2", oGlobalKnownHostsFile2 },	/* obsolete */
++	{ "userknownhostsfile", oUserKnownHostsFile },
++	{ "userknownhostsfile2", oUserKnownHostsFile2 },	/* obsolete */
++	{ "connectionattempts", oConnectionAttempts },
++	{ "batchmode", oBatchMode },
++	{ "checkhostip", oCheckHostIP },
++	{ "stricthostkeychecking", oStrictHostKeyChecking },
++	{ "compression", oCompression },
++	{ "compressionlevel", oCompressionLevel },
++	{ "tcpkeepalive", oTCPKeepAlive },
++	{ "keepalive", oTCPKeepAlive },				/* obsolete */
++	{ "numberofpasswordprompts", oNumberOfPasswordPrompts },
++	{ "loglevel", oLogLevel },
++	{ "dynamicforward", oDynamicForward },
++	{ "preferredauthentications", oPreferredAuthentications },
++	{ "hostkeyalgorithms", oHostKeyAlgorithms },
++	{ "bindaddress", oBindAddress },
++#ifdef SMARTCARD
++	{ "smartcarddevice", oSmartcardDevice },
++#else
++	{ "smartcarddevice", oUnsupported },
++#endif
++	{ "clearallforwardings", oClearAllForwardings },
++	{ "enablesshkeysign", oEnableSSHKeysign },
++	{ "verifyhostkeydns", oVerifyHostKeyDNS },
++	{ "nohostauthenticationforlocalhost", oNoHostAuthenticationForLocalhost },
++	{ "rekeylimit", oRekeyLimit },
++	{ "connecttimeout", oConnectTimeout },
++	{ "addressfamily", oAddressFamily },
++	{ "serveraliveinterval", oServerAliveInterval },
++	{ "serveralivecountmax", oServerAliveCountMax },
++	{ "sendenv", oSendEnv },
++	{ "controlpath", oControlPath },
++	{ "controlmaster", oControlMaster },
++	{ "hashknownhosts", oHashKnownHosts },
++	{ "tunnel", oTunnel },
++	{ "tunneldevice", oTunnelDevice },
++	{ "localcommand", oLocalCommand },
++	{ "permitlocalcommand", oPermitLocalCommand },
++	{ "visualhostkey", oVisualHostKey },
++#ifdef JPAKE
++	{ "zeroknowledgepasswordauthentication",
++	    oZeroKnowledgePasswordAuthentication },
++#else
++	{ "zeroknowledgepasswordauthentication", oUnsupported },
++#endif
++
++	{ NULL, oBadOption }
++};
++
++/*
++ * Adds a local TCP/IP port forward to options.  Never returns if there is an
++ * error.
++ */
++
++void
++add_local_forward(Options *options, const Forward *newfwd)
++{
++	Forward *fwd;
++#ifndef NO_IPPORT_RESERVED_CONCEPT
++	extern uid_t original_real_uid;
++	if (newfwd->listen_port < IPPORT_RESERVED && original_real_uid != 0)
++		fatal("Privileged ports can only be forwarded by root.");
++#endif
++	if (options->num_local_forwards >= SSH_MAX_FORWARDS_PER_DIRECTION)
++		fatal("Too many local forwards (max %d).", SSH_MAX_FORWARDS_PER_DIRECTION);
++	fwd = &options->local_forwards[options->num_local_forwards++];
++
++	fwd->listen_host = newfwd->listen_host;
++	fwd->listen_port = newfwd->listen_port;
++	fwd->connect_host = newfwd->connect_host;
++	fwd->connect_port = newfwd->connect_port;
++}
++
++/*
++ * Adds a remote TCP/IP port forward to options.  Never returns if there is
++ * an error.
++ */
++
++void
++add_remote_forward(Options *options, const Forward *newfwd)
++{
++	Forward *fwd;
++	if (options->num_remote_forwards >= SSH_MAX_FORWARDS_PER_DIRECTION)
++		fatal("Too many remote forwards (max %d).",
++		    SSH_MAX_FORWARDS_PER_DIRECTION);
++	fwd = &options->remote_forwards[options->num_remote_forwards++];
++
++	fwd->listen_host = newfwd->listen_host;
++	fwd->listen_port = newfwd->listen_port;
++	fwd->connect_host = newfwd->connect_host;
++	fwd->connect_port = newfwd->connect_port;
++}
++
++static void
++clear_forwardings(Options *options)
++{
++	int i;
++
++	for (i = 0; i < options->num_local_forwards; i++) {
++		if (options->local_forwards[i].listen_host != NULL)
++			xfree(options->local_forwards[i].listen_host);
++		xfree(options->local_forwards[i].connect_host);
++	}
++	options->num_local_forwards = 0;
++	for (i = 0; i < options->num_remote_forwards; i++) {
++		if (options->remote_forwards[i].listen_host != NULL)
++			xfree(options->remote_forwards[i].listen_host);
++		xfree(options->remote_forwards[i].connect_host);
++	}
++	options->num_remote_forwards = 0;
++	options->tun_open = SSH_TUNMODE_NO;
++}
++
++/*
++ * Returns the number of the token pointed to by cp or oBadOption.
++ */
++
++static OpCodes
++parse_token(const char *cp, const char *filename, int linenum)
++{
++	u_int i;
++
++	for (i = 0; keywords[i].name; i++)
++		if (strcasecmp(cp, keywords[i].name) == 0)
++			return keywords[i].opcode;
++
++	error("%s: line %d: Bad configuration option: %s",
++	    filename, linenum, cp);
++	return oBadOption;
++}
++
++/*
++ * Processes a single option line as used in the configuration files. This
++ * only sets those values that have not already been set.
++ */
++#define WHITESPACE " \t\r\n"
++
++int
++process_config_line(Options *options, const char *host,
++		    char *line, const char *filename, int linenum,
++		    int *activep)
++{
++	char *s, **charptr, *endofnumber, *keyword, *arg, *arg2, fwdarg[256];
++	int opcode, *intptr, value, value2, scale;
++	LogLevel *log_level_ptr;
++	long long orig, val64;
++	size_t len;
++	Forward fwd;
++
++	/* Strip trailing whitespace */
++	for (len = strlen(line) - 1; len > 0; len--) {
++		if (strchr(WHITESPACE, line[len]) == NULL)
++			break;
++		line[len] = '\0';
++	}
++
++	s = line;
++	/* Get the keyword. (Each line is supposed to begin with a keyword). */
++	if ((keyword = strdelim(&s)) == NULL)
++		return 0;
++	/* Ignore leading whitespace. */
++	if (*keyword == '\0')
++		keyword = strdelim(&s);
++	if (keyword == NULL || !*keyword || *keyword == '\n' || *keyword == '#')
++		return 0;
++
++	opcode = parse_token(keyword, filename, linenum);
++
++	switch (opcode) {
++	case oBadOption:
++		/* don't panic, but count bad options */
++		return -1;
++		/* NOTREACHED */
++	case oConnectTimeout:
++		intptr = &options->connection_timeout;
++parse_time:
++		arg = strdelim(&s);
++		if (!arg || *arg == '\0')
++			fatal("%s line %d: missing time value.",
++			    filename, linenum);
++		if ((value = convtime(arg)) == -1)
++			fatal("%s line %d: invalid time value.",
++			    filename, linenum);
++		if (*activep && *intptr == -1)
++			*intptr = value;
++		break;
++
++	case oForwardAgent:
++		intptr = &options->forward_agent;
++parse_flag:
++		arg = strdelim(&s);
++		if (!arg || *arg == '\0')
++			fatal("%.200s line %d: Missing yes/no argument.", filename, linenum);
++		value = 0;	/* To avoid compiler warning... */
++		if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0)
++			value = 1;
++		else if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0)
++			value = 0;
++		else
++			fatal("%.200s line %d: Bad yes/no argument.", filename, linenum);
++		if (*activep && *intptr == -1)
++			*intptr = value;
++		break;
++
++	case oForwardX11:
++		intptr = &options->forward_x11;
++		goto parse_flag;
++
++	case oForwardX11Trusted:
++		intptr = &options->forward_x11_trusted;
++		goto parse_flag;
++
++	case oGatewayPorts:
++		intptr = &options->gateway_ports;
++		goto parse_flag;
++
++	case oExitOnForwardFailure:
++		intptr = &options->exit_on_forward_failure;
++		goto parse_flag;
++
++	case oUsePrivilegedPort:
++		intptr = &options->use_privileged_port;
++		goto parse_flag;
++
++	case oPasswordAuthentication:
++		intptr = &options->password_authentication;
++		goto parse_flag;
++
++	case oZeroKnowledgePasswordAuthentication:
++		intptr = &options->zero_knowledge_password_authentication;
++		goto parse_flag;
++
++	case oKbdInteractiveAuthentication:
++		intptr = &options->kbd_interactive_authentication;
++		goto parse_flag;
++
++	case oKbdInteractiveDevices:
++		charptr = &options->kbd_interactive_devices;
++		goto parse_string;
++
++	case oPubkeyAuthentication:
++		intptr = &options->pubkey_authentication;
++		goto parse_flag;
++
++	case oRSAAuthentication:
++		intptr = &options->rsa_authentication;
++		goto parse_flag;
++
++	case oRhostsRSAAuthentication:
++		intptr = &options->rhosts_rsa_authentication;
++		goto parse_flag;
++
++	case oHostbasedAuthentication:
++		intptr = &options->hostbased_authentication;
++		goto parse_flag;
++
++	case oChallengeResponseAuthentication:
++		intptr = &options->challenge_response_authentication;
++		goto parse_flag;
++
++	case oGssAuthentication:
++		intptr = &options->gss_authentication;
++		goto parse_flag;
++
++	case oGssDelegateCreds:
++		intptr = &options->gss_deleg_creds;
++		goto parse_flag;
++
++	case oBatchMode:
++		intptr = &options->batch_mode;
++		goto parse_flag;
++
++	case oCheckHostIP:
++		intptr = &options->check_host_ip;
++		goto parse_flag;
++
++	case oVerifyHostKeyDNS:
++		intptr = &options->verify_host_key_dns;
++		goto parse_yesnoask;
++
++	case oStrictHostKeyChecking:
++		intptr = &options->strict_host_key_checking;
++parse_yesnoask:
++		arg = strdelim(&s);
++		if (!arg || *arg == '\0')
++			fatal("%.200s line %d: Missing yes/no/ask argument.",
++			    filename, linenum);
++		value = 0;	/* To avoid compiler warning... */
++		if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0)
++			value = 1;
++		else if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0)
++			value = 0;
++		else if (strcmp(arg, "ask") == 0)
++			value = 2;
++		else
++			fatal("%.200s line %d: Bad yes/no/ask argument.", filename, linenum);
++		if (*activep && *intptr == -1)
++			*intptr = value;
++		break;
++
++	case oCompression:
++		intptr = &options->compression;
++		goto parse_flag;
++
++	case oTCPKeepAlive:
++		intptr = &options->tcp_keep_alive;
++		goto parse_flag;
++
++	case oNoHostAuthenticationForLocalhost:
++		intptr = &options->no_host_authentication_for_localhost;
++		goto parse_flag;
++
++	case oNumberOfPasswordPrompts:
++		intptr = &options->number_of_password_prompts;
++		goto parse_int;
++
++	case oCompressionLevel:
++		intptr = &options->compression_level;
++		goto parse_int;
++
++	case oRekeyLimit:
++		arg = strdelim(&s);
++		if (!arg || *arg == '\0')
++			fatal("%.200s line %d: Missing argument.", filename, linenum);
++		if (arg[0] < '0' || arg[0] > '9')
++			fatal("%.200s line %d: Bad number.", filename, linenum);
++		orig = val64 = strtoll(arg, &endofnumber, 10);
++		if (arg == endofnumber)
++			fatal("%.200s line %d: Bad number.", filename, linenum);
++		switch (toupper(*endofnumber)) {
++		case '\0':
++			scale = 1;
++			break;
++		case 'K':
++			scale = 1<<10;
++			break;
++		case 'M':
++			scale = 1<<20;
++			break;
++		case 'G':
++			scale = 1<<30;
++			break;
++		default:
++			fatal("%.200s line %d: Invalid RekeyLimit suffix",
++			    filename, linenum);
++		}
++		val64 *= scale;
++		/* detect integer wrap and too-large limits */
++		if ((val64 / scale) != orig || val64 > UINT_MAX)
++			fatal("%.200s line %d: RekeyLimit too large",
++			    filename, linenum);
++		if (val64 < 16)
++			fatal("%.200s line %d: RekeyLimit too small",
++			    filename, linenum);
++		if (*activep && options->rekey_limit == -1)
++			options->rekey_limit = (u_int32_t)val64;
++		break;
++
++	case oIdentityFile:
++		arg = strdelim(&s);
++		if (!arg || *arg == '\0')
++			fatal("%.200s line %d: Missing argument.", filename, linenum);
++		if (*activep) {
++			intptr = &options->num_identity_files;
++			if (*intptr >= SSH_MAX_IDENTITY_FILES)
++				fatal("%.200s line %d: Too many identity files specified (max %d).",
++				    filename, linenum, SSH_MAX_IDENTITY_FILES);
++			charptr = &options->identity_files[*intptr];
++			*charptr = xstrdup(arg);
++			*intptr = *intptr + 1;
++		}
++		break;
++
++	case oXAuthLocation:
++		charptr=&options->xauth_location;
++		goto parse_string;
++
++	case oUser:
++		charptr = &options->user;
++parse_string:
++		arg = strdelim(&s);
++		if (!arg || *arg == '\0')
++			fatal("%.200s line %d: Missing argument.", filename, linenum);
++		if (*activep && *charptr == NULL)
++			*charptr = xstrdup(arg);
++		break;
++
++	case oGlobalKnownHostsFile:
++		charptr = &options->system_hostfile;
++		goto parse_string;
++
++	case oUserKnownHostsFile:
++		charptr = &options->user_hostfile;
++		goto parse_string;
++
++	case oGlobalKnownHostsFile2:
++		charptr = &options->system_hostfile2;
++		goto parse_string;
++
++	case oUserKnownHostsFile2:
++		charptr = &options->user_hostfile2;
++		goto parse_string;
++
++	case oHostName:
++		charptr = &options->hostname;
++		goto parse_string;
++
++	case oHostKeyAlias:
++		charptr = &options->host_key_alias;
++		goto parse_string;
++
++	case oPreferredAuthentications:
++		charptr = &options->preferred_authentications;
++		goto parse_string;
++
++	case oBindAddress:
++		charptr = &options->bind_address;
++		goto parse_string;
++
++	case oSmartcardDevice:
++		charptr = &options->smartcard_device;
++		goto parse_string;
++
++	case oProxyCommand:
++		charptr = &options->proxy_command;
++parse_command:
++		if (s == NULL)
++			fatal("%.200s line %d: Missing argument.", filename, linenum);
++		len = strspn(s, WHITESPACE "=");
++		if (*activep && *charptr == NULL)
++			*charptr = xstrdup(s + len);
++		return 0;
++
++	case oPort:
++		intptr = &options->port;
++parse_int:
++		arg = strdelim(&s);
++		if (!arg || *arg == '\0')
++			fatal("%.200s line %d: Missing argument.", filename, linenum);
++		if (arg[0] < '0' || arg[0] > '9')
++			fatal("%.200s line %d: Bad number.", filename, linenum);
++
++		/* Octal, decimal, or hex format? */
++		value = strtol(arg, &endofnumber, 0);
++		if (arg == endofnumber)
++			fatal("%.200s line %d: Bad number.", filename, linenum);
++		if (*activep && *intptr == -1)
++			*intptr = value;
++		break;
++
++	case oConnectionAttempts:
++		intptr = &options->connection_attempts;
++		goto parse_int;
++
++	case oCipher:
++		intptr = &options->cipher;
++		arg = strdelim(&s);
++		if (!arg || *arg == '\0')
++			fatal("%.200s line %d: Missing argument.", filename, linenum);
++		value = cipher_number(arg);
++		if (value == -1)
++			fatal("%.200s line %d: Bad cipher '%s'.",
++			    filename, linenum, arg ? arg : "<NONE>");
++		if (*activep && *intptr == -1)
++			*intptr = value;
++		break;
++
++	case oCiphers:
++		arg = strdelim(&s);
++		if (!arg || *arg == '\0')
++			fatal("%.200s line %d: Missing argument.", filename, linenum);
++		if (!ciphers_valid(arg))
++			fatal("%.200s line %d: Bad SSH2 cipher spec '%s'.",
++			    filename, linenum, arg ? arg : "<NONE>");
++		if (*activep && options->ciphers == NULL)
++			options->ciphers = xstrdup(arg);
++		break;
++
++	case oMacs:
++		arg = strdelim(&s);
++		if (!arg || *arg == '\0')
++			fatal("%.200s line %d: Missing argument.", filename, linenum);
++		if (!mac_valid(arg))
++			fatal("%.200s line %d: Bad SSH2 Mac spec '%s'.",
++			    filename, linenum, arg ? arg : "<NONE>");
++		if (*activep && options->macs == NULL)
++			options->macs = xstrdup(arg);
++		break;
++
++	case oHostKeyAlgorithms:
++		arg = strdelim(&s);
++		if (!arg || *arg == '\0')
++			fatal("%.200s line %d: Missing argument.", filename, linenum);
++		if (!key_names_valid2(arg))
++			fatal("%.200s line %d: Bad protocol 2 host key algorithms '%s'.",
++			    filename, linenum, arg ? arg : "<NONE>");
++		if (*activep && options->hostkeyalgorithms == NULL)
++			options->hostkeyalgorithms = xstrdup(arg);
++		break;
++
++	case oProtocol:
++		intptr = &options->protocol;
++		arg = strdelim(&s);
++		if (!arg || *arg == '\0')
++			fatal("%.200s line %d: Missing argument.", filename, linenum);
++		value = proto_spec(arg);
++		if (value == SSH_PROTO_UNKNOWN)
++			fatal("%.200s line %d: Bad protocol spec '%s'.",
++			    filename, linenum, arg ? arg : "<NONE>");
++		if (*activep && *intptr == SSH_PROTO_UNKNOWN)
++			*intptr = value;
++		break;
++
++	case oLogLevel:
++		log_level_ptr = &options->log_level;
++		arg = strdelim(&s);
++		value = log_level_number(arg);
++		if (value == SYSLOG_LEVEL_NOT_SET)
++			fatal("%.200s line %d: unsupported log level '%s'",
++			    filename, linenum, arg ? arg : "<NONE>");
++		if (*activep && *log_level_ptr == SYSLOG_LEVEL_NOT_SET)
++			*log_level_ptr = (LogLevel) value;
++		break;
++
++	case oLocalForward:
++	case oRemoteForward:
++	case oDynamicForward:
++		arg = strdelim(&s);
++		if (arg == NULL || *arg == '\0')
++			fatal("%.200s line %d: Missing port argument.",
++			    filename, linenum);
++
++		if (opcode == oLocalForward ||
++		    opcode == oRemoteForward) {
++			arg2 = strdelim(&s);
++			if (arg2 == NULL || *arg2 == '\0')
++				fatal("%.200s line %d: Missing target argument.",
++				    filename, linenum);
++
++			/* construct a string for parse_forward */
++			snprintf(fwdarg, sizeof(fwdarg), "%s:%s", arg, arg2);
++		} else if (opcode == oDynamicForward) {
++			strlcpy(fwdarg, arg, sizeof(fwdarg));
++		}
++
++		if (parse_forward(&fwd, fwdarg,
++		    opcode == oDynamicForward ? 1 : 0,
++		    opcode == oRemoteForward ? 1 : 0) == 0)
++			fatal("%.200s line %d: Bad forwarding specification.",
++			    filename, linenum);
++
++		if (*activep) {
++			if (opcode == oLocalForward ||
++			    opcode == oDynamicForward)
++				add_local_forward(options, &fwd);
++			else if (opcode == oRemoteForward)
++				add_remote_forward(options, &fwd);
++		}
++		break;
++
++	case oClearAllForwardings:
++		intptr = &options->clear_forwardings;
++		goto parse_flag;
++
++	case oHost:
++		*activep = 0;
++		while ((arg = strdelim(&s)) != NULL && *arg != '\0')
++			if (match_pattern(host, arg)) {
++				debug("Applying options for %.100s", arg);
++				*activep = 1;
++				break;
++			}
++		/* Avoid garbage check below, as strdelim is done. */
++		return 0;
++
++	case oEscapeChar:
++		intptr = &options->escape_char;
++		arg = strdelim(&s);
++		if (!arg || *arg == '\0')
++			fatal("%.200s line %d: Missing argument.", filename, linenum);
++		if (arg[0] == '^' && arg[2] == 0 &&
++		    (u_char) arg[1] >= 64 && (u_char) arg[1] < 128)
++			value = (u_char) arg[1] & 31;
++		else if (strlen(arg) == 1)
++			value = (u_char) arg[0];
++		else if (strcmp(arg, "none") == 0)
++			value = SSH_ESCAPECHAR_NONE;
++		else {
++			fatal("%.200s line %d: Bad escape character.",
++			    filename, linenum);
++			/* NOTREACHED */
++			value = 0;	/* Avoid compiler warning. */
++		}
++		if (*activep && *intptr == -1)
++			*intptr = value;
++		break;
++
++	case oAddressFamily:
++		arg = strdelim(&s);
++		if (!arg || *arg == '\0')
++			fatal("%s line %d: missing address family.",
++			    filename, linenum);
++		intptr = &options->address_family;
++		if (strcasecmp(arg, "inet") == 0)
++			value = AF_INET;
++		else if (strcasecmp(arg, "inet6") == 0)
++			value = AF_INET6;
++		else if (strcasecmp(arg, "any") == 0)
++			value = AF_UNSPEC;
++		else
++			fatal("Unsupported AddressFamily \"%s\"", arg);
++		if (*activep && *intptr == -1)
++			*intptr = value;
++		break;
++
++	case oEnableSSHKeysign:
++		intptr = &options->enable_ssh_keysign;
++		goto parse_flag;
++
++	case oIdentitiesOnly:
++		intptr = &options->identities_only;
++		goto parse_flag;
++
++	case oServerAliveInterval:
++		intptr = &options->server_alive_interval;
++		goto parse_time;
++
++	case oServerAliveCountMax:
++		intptr = &options->server_alive_count_max;
++		goto parse_int;
++
++	case oSendEnv:
++		while ((arg = strdelim(&s)) != NULL && *arg != '\0') {
++			if (strchr(arg, '=') != NULL)
++				fatal("%s line %d: Invalid environment name.",
++				    filename, linenum);
++			if (!*activep)
++				continue;
++			if (options->num_send_env >= MAX_SEND_ENV)
++				fatal("%s line %d: too many send env.",
++				    filename, linenum);
++			options->send_env[options->num_send_env++] =
++			    xstrdup(arg);
++		}
++		break;
++
++	case oControlPath:
++		charptr = &options->control_path;
++		goto parse_string;
++
++	case oControlMaster:
++		intptr = &options->control_master;
++		arg = strdelim(&s);
++		if (!arg || *arg == '\0')
++			fatal("%.200s line %d: Missing ControlMaster argument.",
++			    filename, linenum);
++		value = 0;	/* To avoid compiler warning... */
++		if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0)
++			value = SSHCTL_MASTER_YES;
++		else if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0)
++			value = SSHCTL_MASTER_NO;
++		else if (strcmp(arg, "auto") == 0)
++			value = SSHCTL_MASTER_AUTO;
++		else if (strcmp(arg, "ask") == 0)
++			value = SSHCTL_MASTER_ASK;
++		else if (strcmp(arg, "autoask") == 0)
++			value = SSHCTL_MASTER_AUTO_ASK;
++		else
++			fatal("%.200s line %d: Bad ControlMaster argument.",
++			    filename, linenum);
++		if (*activep && *intptr == -1)
++			*intptr = value;
++		break;
++
++	case oHashKnownHosts:
++		intptr = &options->hash_known_hosts;
++		goto parse_flag;
++
++	case oTunnel:
++		intptr = &options->tun_open;
++		arg = strdelim(&s);
++		if (!arg || *arg == '\0')
++			fatal("%s line %d: Missing yes/point-to-point/"
++			    "ethernet/no argument.", filename, linenum);
++		value = 0;	/* silence compiler */
++		if (strcasecmp(arg, "ethernet") == 0)
++			value = SSH_TUNMODE_ETHERNET;
++		else if (strcasecmp(arg, "point-to-point") == 0)
++			value = SSH_TUNMODE_POINTOPOINT;
++		else if (strcasecmp(arg, "yes") == 0)
++			value = SSH_TUNMODE_DEFAULT;
++		else if (strcasecmp(arg, "no") == 0)
++			value = SSH_TUNMODE_NO;
++		else
++			fatal("%s line %d: Bad yes/point-to-point/ethernet/"
++			    "no argument: %s", filename, linenum, arg);
++		if (*activep)
++			*intptr = value;
++		break;
++
++	case oTunnelDevice:
++		arg = strdelim(&s);
++		if (!arg || *arg == '\0')
++			fatal("%.200s line %d: Missing argument.", filename, linenum);
++		value = a2tun(arg, &value2);
++		if (value == SSH_TUNID_ERR)
++			fatal("%.200s line %d: Bad tun device.", filename, linenum);
++		if (*activep) {
++			options->tun_local = value;
++			options->tun_remote = value2;
++		}
++		break;
++
++	case oLocalCommand:
++		charptr = &options->local_command;
++		goto parse_command;
++
++	case oPermitLocalCommand:
++		intptr = &options->permit_local_command;
++		goto parse_flag;
++
++	case oVisualHostKey:
++		intptr = &options->visual_host_key;
++		goto parse_flag;
++
++	case oDeprecated:
++		debug("%s line %d: Deprecated option \"%s\"",
++		    filename, linenum, keyword);
++		return 0;
++
++	case oUnsupported:
++		error("%s line %d: Unsupported option \"%s\"",
++		    filename, linenum, keyword);
++		return 0;
++
++	default:
++		fatal("process_config_line: Unimplemented opcode %d", opcode);
++	}
++
++	/* Check that there is no garbage at end of line. */
++	if ((arg = strdelim(&s)) != NULL && *arg != '\0') {
++		fatal("%.200s line %d: garbage at end of line; \"%.200s\".",
++		    filename, linenum, arg);
++	}
++	return 0;
++}
++
++
++/*
++ * Reads the config file and modifies the options accordingly.  Options
++ * should already be initialized before this call.  This never returns if
++ * there is an error.  If the file does not exist, this returns 0.
++ */
++
++int
++read_config_file(const char *filename, const char *host, Options *options,
++    int checkperm)
++{
++	FILE *f;
++	char line[1024];
++	int active, linenum;
++	int bad_options = 0;
++
++	if ((f = fopen(filename, "r")) == NULL)
++		return 0;
++
++	if (checkperm) {
++		struct stat sb;
++
++		if (fstat(fileno(f), &sb) == -1)
++			fatal("fstat %s: %s", filename, strerror(errno));
++		if (((sb.st_uid != 0 && sb.st_uid != getuid()) ||
++		    (sb.st_mode & 022) != 0))
++			fatal("Bad owner or permissions on %s", filename);
++	}
++
++	debug("Reading configuration data %.200s", filename);
++
++	/*
++	 * Mark that we are now processing the options.  This flag is turned
++	 * on/off by Host specifications.
++	 */
++	active = 1;
++	linenum = 0;
++	while (fgets(line, sizeof(line), f)) {
++		/* Update line number counter. */
++		linenum++;
++		if (process_config_line(options, host, line, filename, linenum, &active) != 0)
++			bad_options++;
++	}
++	fclose(f);
++	if (bad_options > 0)
++		fatal("%s: terminating, %d bad configuration options",
++		    filename, bad_options);
++	return 1;
++}
++
++/*
++ * Initializes options to special values that indicate that they have not yet
++ * been set.  Read_config_file will only set options with this value. Options
++ * are processed in the following order: command line, user config file,
++ * system config file.  Last, fill_default_options is called.
++ */
++
++void
++initialize_options(Options * options)
++{
++	memset(options, 'X', sizeof(*options));
++	options->forward_agent = -1;
++	options->forward_x11 = -1;
++	options->forward_x11_trusted = -1;
++	options->exit_on_forward_failure = -1;
++	options->xauth_location = NULL;
++	options->gateway_ports = -1;
++	options->use_privileged_port = -1;
++	options->rsa_authentication = -1;
++	options->pubkey_authentication = -1;
++	options->challenge_response_authentication = -1;
++	options->gss_authentication = -1;
++	options->gss_deleg_creds = -1;
++	options->password_authentication = -1;
++	options->kbd_interactive_authentication = -1;
++	options->kbd_interactive_devices = NULL;
++	options->rhosts_rsa_authentication = -1;
++	options->hostbased_authentication = -1;
++	options->batch_mode = -1;
++	options->check_host_ip = -1;
++	options->strict_host_key_checking = -1;
++	options->compression = -1;
++	options->tcp_keep_alive = -1;
++	options->compression_level = -1;
++	options->port = -1;
++	options->address_family = -1;
++	options->connection_attempts = -1;
++	options->connection_timeout = -1;
++	options->number_of_password_prompts = -1;
++	options->cipher = -1;
++	options->ciphers = NULL;
++	options->macs = NULL;
++	options->hostkeyalgorithms = NULL;
++	options->protocol = SSH_PROTO_UNKNOWN;
++	options->num_identity_files = 0;
++	options->hostname = NULL;
++	options->host_key_alias = NULL;
++	options->proxy_command = NULL;
++	options->user = NULL;
++	options->escape_char = -1;
++	options->system_hostfile = NULL;
++	options->user_hostfile = NULL;
++	options->system_hostfile2 = NULL;
++	options->user_hostfile2 = NULL;
++	options->num_local_forwards = 0;
++	options->num_remote_forwards = 0;
++	options->clear_forwardings = -1;
++	options->log_level = SYSLOG_LEVEL_NOT_SET;
++	options->preferred_authentications = NULL;
++	options->bind_address = NULL;
++	options->smartcard_device = NULL;
++	options->enable_ssh_keysign = - 1;
++	options->no_host_authentication_for_localhost = - 1;
++	options->identities_only = - 1;
++	options->rekey_limit = - 1;
++	options->verify_host_key_dns = -1;
++	options->server_alive_interval = -1;
++	options->server_alive_count_max = -1;
++	options->num_send_env = 0;
++	options->control_path = NULL;
++	options->control_master = -1;
++	options->hash_known_hosts = -1;
++	options->tun_open = -1;
++	options->tun_local = -1;
++	options->tun_remote = -1;
++	options->local_command = NULL;
++	options->permit_local_command = -1;
++	options->visual_host_key = -1;
++	options->zero_knowledge_password_authentication = -1;
++}
++
++/*
++ * Called after processing other sources of option data, this fills those
++ * options for which no value has been specified with their default values.
++ */
++
++void
++fill_default_options(Options * options)
++{
++	int len;
++
++	if (options->forward_agent == -1)
++		options->forward_agent = 0;
++	if (options->forward_x11 == -1)
++		options->forward_x11 = 0;
++	if (options->forward_x11_trusted == -1)
++		options->forward_x11_trusted = 0;
++	if (options->exit_on_forward_failure == -1)
++		options->exit_on_forward_failure = 0;
++	if (options->xauth_location == NULL)
++		options->xauth_location = _PATH_XAUTH;
++	if (options->gateway_ports == -1)
++		options->gateway_ports = 0;
++	if (options->use_privileged_port == -1)
++		options->use_privileged_port = 0;
++	if (options->rsa_authentication == -1)
++		options->rsa_authentication = 1;
++	if (options->pubkey_authentication == -1)
++		options->pubkey_authentication = 1;
++	if (options->challenge_response_authentication == -1)
++		options->challenge_response_authentication = 1;
++	if (options->gss_authentication == -1)
++		options->gss_authentication = 0;
++	if (options->gss_deleg_creds == -1)
++		options->gss_deleg_creds = 0;
++	if (options->password_authentication == -1)
++		options->password_authentication = 1;
++	if (options->kbd_interactive_authentication == -1)
++		options->kbd_interactive_authentication = 1;
++	if (options->rhosts_rsa_authentication == -1)
++		options->rhosts_rsa_authentication = 0;
++	if (options->hostbased_authentication == -1)
++		options->hostbased_authentication = 0;
++	if (options->batch_mode == -1)
++		options->batch_mode = 0;
++	if (options->check_host_ip == -1)
++		options->check_host_ip = 1;
++	if (options->strict_host_key_checking == -1)
++		options->strict_host_key_checking = 2;	/* 2 is default */
++	if (options->compression == -1)
++		options->compression = 0;
++	if (options->tcp_keep_alive == -1)
++		options->tcp_keep_alive = 1;
++	if (options->compression_level == -1)
++		options->compression_level = 6;
++	if (options->port == -1)
++		options->port = 0;	/* Filled in ssh_connect. */
++	if (options->address_family == -1)
++		options->address_family = AF_UNSPEC;
++	if (options->connection_attempts == -1)
++		options->connection_attempts = 1;
++	if (options->number_of_password_prompts == -1)
++		options->number_of_password_prompts = 3;
++	/* Selected in ssh_login(). */
++	if (options->cipher == -1)
++		options->cipher = SSH_CIPHER_NOT_SET;
++	/* options->ciphers, default set in myproposals.h */
++	/* options->macs, default set in myproposals.h */
++	/* options->hostkeyalgorithms, default set in myproposals.h */
++	if (options->protocol == SSH_PROTO_UNKNOWN)
++		options->protocol = SSH_PROTO_1|SSH_PROTO_2;
++	if (options->num_identity_files == 0) {
++		if (options->protocol & SSH_PROTO_1) {
++			len = 2 + strlen(_PATH_SSH_CLIENT_IDENTITY) + 1;
++			options->identity_files[options->num_identity_files] =
++			    xmalloc(len);
++			snprintf(options->identity_files[options->num_identity_files++],
++			    len, "~/%.100s", _PATH_SSH_CLIENT_IDENTITY);
++		}
++		if (options->protocol & SSH_PROTO_2) {
++			len = 2 + strlen(_PATH_SSH_CLIENT_ID_RSA) + 1;
++			options->identity_files[options->num_identity_files] =
++			    xmalloc(len);
++			snprintf(options->identity_files[options->num_identity_files++],
++			    len, "~/%.100s", _PATH_SSH_CLIENT_ID_RSA);
++
++			len = 2 + strlen(_PATH_SSH_CLIENT_ID_DSA) + 1;
++			options->identity_files[options->num_identity_files] =
++			    xmalloc(len);
++			snprintf(options->identity_files[options->num_identity_files++],
++			    len, "~/%.100s", _PATH_SSH_CLIENT_ID_DSA);
++		}
++	}
++	if (options->escape_char == -1)
++		options->escape_char = '~';
++	if (options->system_hostfile == NULL)
++		options->system_hostfile = _PATH_SSH_SYSTEM_HOSTFILE;
++	if (options->user_hostfile == NULL)
++		options->user_hostfile = _PATH_SSH_USER_HOSTFILE;
++	if (options->system_hostfile2 == NULL)
++		options->system_hostfile2 = _PATH_SSH_SYSTEM_HOSTFILE2;
++	if (options->user_hostfile2 == NULL)
++		options->user_hostfile2 = _PATH_SSH_USER_HOSTFILE2;
++	if (options->log_level == SYSLOG_LEVEL_NOT_SET)
++		options->log_level = SYSLOG_LEVEL_INFO;
++	if (options->clear_forwardings == 1)
++		clear_forwardings(options);
++	if (options->no_host_authentication_for_localhost == - 1)
++		options->no_host_authentication_for_localhost = 0;
++	if (options->identities_only == -1)
++		options->identities_only = 0;
++	if (options->enable_ssh_keysign == -1)
++		options->enable_ssh_keysign = 0;
++	if (options->rekey_limit == -1)
++		options->rekey_limit = 0;
++	if (options->verify_host_key_dns == -1)
++		options->verify_host_key_dns = 0;
++	if (options->server_alive_interval == -1)
++		options->server_alive_interval = 0;
++	if (options->server_alive_count_max == -1)
++		options->server_alive_count_max = 3;
++	if (options->control_master == -1)
++		options->control_master = 0;
++	if (options->hash_known_hosts == -1)
++		options->hash_known_hosts = 0;
++	if (options->tun_open == -1)
++		options->tun_open = SSH_TUNMODE_NO;
++	if (options->tun_local == -1)
++		options->tun_local = SSH_TUNID_ANY;
++	if (options->tun_remote == -1)
++		options->tun_remote = SSH_TUNID_ANY;
++	if (options->permit_local_command == -1)
++		options->permit_local_command = 0;
++	if (options->visual_host_key == -1)
++		options->visual_host_key = 0;
++	if (options->zero_knowledge_password_authentication == -1)
++		options->zero_knowledge_password_authentication = 0;
++	/* options->local_command should not be set by default */
++	/* options->proxy_command should not be set by default */
++	/* options->user will be set in the main program if appropriate */
++	/* options->hostname will be set in the main program if appropriate */
++	/* options->host_key_alias should not be set by default */
++	/* options->preferred_authentications will be set in ssh */
++}
++
++/*
++ * parse_forward
++ * parses a string containing a port forwarding specification of the form:
++ *   dynamicfwd == 0
++ *	[listenhost:]listenport:connecthost:connectport
++ *   dynamicfwd == 1
++ *	[listenhost:]listenport
++ * returns number of arguments parsed or zero on error
++ */
++int
++parse_forward(Forward *fwd, const char *fwdspec, int dynamicfwd, int remotefwd)
++{
++	int i;
++	char *p, *cp, *fwdarg[4];
++
++	memset(fwd, '\0', sizeof(*fwd));
++
++	cp = p = xstrdup(fwdspec);
++
++	/* skip leading spaces */
++	while (isspace(*cp))
++		cp++;
++
++	for (i = 0; i < 4; ++i)
++		if ((fwdarg[i] = hpdelim(&cp)) == NULL)
++			break;
++
++	/* Check for trailing garbage */
++	if (cp != NULL)
++		i = 0;	/* failure */
++
++	switch (i) {
++	case 1:
++		fwd->listen_host = NULL;
++		fwd->listen_port = a2port(fwdarg[0]);
++		fwd->connect_host = xstrdup("socks");
++		break;
++
++	case 2:
++		fwd->listen_host = xstrdup(cleanhostname(fwdarg[0]));
++		fwd->listen_port = a2port(fwdarg[1]);
++		fwd->connect_host = xstrdup("socks");
++		break;
++
++	case 3:
++		fwd->listen_host = NULL;
++		fwd->listen_port = a2port(fwdarg[0]);
++		fwd->connect_host = xstrdup(cleanhostname(fwdarg[1]));
++		fwd->connect_port = a2port(fwdarg[2]);
++		break;
++
++	case 4:
++		fwd->listen_host = xstrdup(cleanhostname(fwdarg[0]));
++		fwd->listen_port = a2port(fwdarg[1]);
++		fwd->connect_host = xstrdup(cleanhostname(fwdarg[2]));
++		fwd->connect_port = a2port(fwdarg[3]);
++		break;
++	default:
++		i = 0; /* failure */
++	}
++
++	xfree(p);
++
++	if (dynamicfwd) {
++		if (!(i == 1 || i == 2))
++			goto fail_free;
++	} else {
++		if (!(i == 3 || i == 4))
++			goto fail_free;
++		if (fwd->connect_port <= 0)
++			goto fail_free;
++	}
++
++	if (fwd->listen_port < 0 || (!remotefwd && fwd->listen_port == 0))
++		goto fail_free;
++
++	if (fwd->connect_host != NULL &&
++	    strlen(fwd->connect_host) >= NI_MAXHOST)
++		goto fail_free;
++	if (fwd->listen_host != NULL &&
++	    strlen(fwd->listen_host) >= NI_MAXHOST)
++		goto fail_free;
++
++
++	return (i);
++
++ fail_free:
++	if (fwd->connect_host != NULL) {
++		xfree(fwd->connect_host);
++		fwd->connect_host = NULL;
++	}
++	if (fwd->listen_host != NULL) {
++		xfree(fwd->listen_host);
++		fwd->listen_host = NULL;
++	}
++	return (0);
++}
+diff -NupwB readconf.h readconf.h
+--- readconf.h	2009-02-14 00:28:21.000000000 -0500
++++ readconf.h	2009-05-14 12:36:10.000000000 -0400
+@@ -57,6 +57,11 @@ typedef struct {
  	int     compression_level;	/* Compression level 1 (fast) to 9
  					 * (best). */
  	int     tcp_keep_alive;	/* Set SO_KEEPALIVE. */
@@ -1554,7 +2870,7 @@ diff -urN readconf.h readconf.h
  	LogLevel log_level;	/* Level for logging. */
  
  	int     port;		/* Port to connect. */
-@@ -102,6 +107,8 @@
+@@ -102,6 +107,8 @@ typedef struct {
  
  	int	enable_ssh_keysign;
  	int64_t rekey_limit;
@@ -1563,10 +2879,161 @@ diff -urN readconf.h readconf.h
  	int	no_host_authentication_for_localhost;
  	int	identities_only;
  	int	server_alive_interval;
-diff -urN scp.c scp.c
---- scp.c	2008-11-03 11:23:45.000000000 +0300
-+++ scp.c	2009-05-02 17:38:19.000000000 +0400
-@@ -632,7 +632,7 @@
+diff -NupwB readconf.h.orig readconf.h.orig
+--- readconf.h.orig	1969-12-31 19:00:00.000000000 -0500
++++ readconf.h.orig	2009-02-14 00:28:21.000000000 -0500
+@@ -0,0 +1,145 @@
++/* $OpenBSD: readconf.h,v 1.78 2009/02/12 03:00:56 djm Exp $ */
++
++/*
++ * Author: Tatu Ylonen <ylo@cs.hut.fi>
++ * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
++ *                    All rights reserved
++ * Functions for reading the configuration file.
++ *
++ * As far as I am concerned, the code I have written for this software
++ * can be used freely for any purpose.  Any derived versions of this
++ * software must be clearly marked as such, and if the derived work is
++ * incompatible with the protocol description in the RFC file, it must be
++ * called by a name other than "ssh" or "Secure Shell".
++ */
++
++#ifndef READCONF_H
++#define READCONF_H
++
++/* Data structure for representing a forwarding request. */
++
++typedef struct {
++	char	 *listen_host;		/* Host (address) to listen on. */
++	int	  listen_port;		/* Port to forward. */
++	char	 *connect_host;		/* Host to connect. */
++	int	  connect_port;		/* Port to connect on connect_host. */
++}       Forward;
++/* Data structure for representing option data. */
++
++#define MAX_SEND_ENV	256
++
++typedef struct {
++	int     forward_agent;	/* Forward authentication agent. */
++	int     forward_x11;	/* Forward X11 display. */
++	int     forward_x11_trusted;	/* Trust Forward X11 display. */
++	int     exit_on_forward_failure;	/* Exit if bind(2) fails for -L/-R */
++	char   *xauth_location;	/* Location for xauth program */
++	int     gateway_ports;	/* Allow remote connects to forwarded ports. */
++	int     use_privileged_port;	/* Don't use privileged port if false. */
++	int     rhosts_rsa_authentication;	/* Try rhosts with RSA
++						 * authentication. */
++	int     rsa_authentication;	/* Try RSA authentication. */
++	int     pubkey_authentication;	/* Try ssh2 pubkey authentication. */
++	int     hostbased_authentication;	/* ssh2's rhosts_rsa */
++	int     challenge_response_authentication;
++					/* Try S/Key or TIS, authentication. */
++	int     gss_authentication;	/* Try GSS authentication */
++	int     gss_deleg_creds;	/* Delegate GSS credentials */
++	int     password_authentication;	/* Try password
++						 * authentication. */
++	int     kbd_interactive_authentication; /* Try keyboard-interactive auth. */
++	char	*kbd_interactive_devices; /* Keyboard-interactive auth devices. */
++	int     zero_knowledge_password_authentication;	/* Try jpake */
++	int     batch_mode;	/* Batch mode: do not ask for passwords. */
++	int     check_host_ip;	/* Also keep track of keys for IP address */
++	int     strict_host_key_checking;	/* Strict host key checking. */
++	int     compression;	/* Compress packets in both directions. */
++	int     compression_level;	/* Compression level 1 (fast) to 9
++					 * (best). */
++	int     tcp_keep_alive;	/* Set SO_KEEPALIVE. */
++	LogLevel log_level;	/* Level for logging. */
++
++	int     port;		/* Port to connect. */
++	int     address_family;
++	int     connection_attempts;	/* Max attempts (seconds) before
++					 * giving up */
++	int     connection_timeout;	/* Max time (seconds) before
++					 * aborting connection attempt */
++	int     number_of_password_prompts;	/* Max number of password
++						 * prompts. */
++	int     cipher;		/* Cipher to use. */
++	char   *ciphers;	/* SSH2 ciphers in order of preference. */
++	char   *macs;		/* SSH2 macs in order of preference. */
++	char   *hostkeyalgorithms;	/* SSH2 server key types in order of preference. */
++	int	protocol;	/* Protocol in order of preference. */
++	char   *hostname;	/* Real host to connect. */
++	char   *host_key_alias;	/* hostname alias for .ssh/known_hosts */
++	char   *proxy_command;	/* Proxy command for connecting the host. */
++	char   *user;		/* User to log in as. */
++	int     escape_char;	/* Escape character; -2 = none */
++
++	char   *system_hostfile;/* Path for /etc/ssh/ssh_known_hosts. */
++	char   *user_hostfile;	/* Path for $HOME/.ssh/known_hosts. */
++	char   *system_hostfile2;
++	char   *user_hostfile2;
++	char   *preferred_authentications;
++	char   *bind_address;	/* local socket address for connection to sshd */
++	char   *smartcard_device; /* Smartcard reader device */
++	int	verify_host_key_dns;	/* Verify host key using DNS */
++
++	int     num_identity_files;	/* Number of files for RSA/DSA identities. */
++	char   *identity_files[SSH_MAX_IDENTITY_FILES];
++	Key    *identity_keys[SSH_MAX_IDENTITY_FILES];
++
++	/* Local TCP/IP forward requests. */
++	int     num_local_forwards;
++	Forward local_forwards[SSH_MAX_FORWARDS_PER_DIRECTION];
++
++	/* Remote TCP/IP forward requests. */
++	int     num_remote_forwards;
++	Forward remote_forwards[SSH_MAX_FORWARDS_PER_DIRECTION];
++	int	clear_forwardings;
++
++	int	enable_ssh_keysign;
++	int64_t rekey_limit;
++	int	no_host_authentication_for_localhost;
++	int	identities_only;
++	int	server_alive_interval;
++	int	server_alive_count_max;
++
++	int     num_send_env;
++	char   *send_env[MAX_SEND_ENV];
++
++	char	*control_path;
++	int	control_master;
++
++	int	hash_known_hosts;
++
++	int	tun_open;	/* tun(4) */
++	int     tun_local;	/* force tun device (optional) */
++	int     tun_remote;	/* force tun device (optional) */
++
++	char	*local_command;
++	int	permit_local_command;
++	int	visual_host_key;
++
++}       Options;
++
++#define SSHCTL_MASTER_NO	0
++#define SSHCTL_MASTER_YES	1
++#define SSHCTL_MASTER_AUTO	2
++#define SSHCTL_MASTER_ASK	3
++#define SSHCTL_MASTER_AUTO_ASK	4
++
++void     initialize_options(Options *);
++void     fill_default_options(Options *);
++int	 read_config_file(const char *, const char *, Options *, int);
++int	 parse_forward(Forward *, const char *, int, int);
++
++int
++process_config_line(Options *, const char *, char *, const char *, int, int *);
++
++void	 add_local_forward(Options *, const Forward *);
++void	 add_remote_forward(Options *, const Forward *);
++
++#endif				/* READCONF_H */
+Common subdirectories: regress and regress
+Common subdirectories: scard and scard
+diff -NupwB scp.c scp.c
+--- scp.c	2008-11-03 03:23:45.000000000 -0500
++++ scp.c	2009-05-14 12:36:10.000000000 -0400
+@@ -632,7 +632,7 @@ source(int argc, char **argv)
  	off_t i, statbytes;
  	size_t amt;
  	int fd = -1, haderr, indx;
@@ -1575,7 +3042,7 @@ diff -urN scp.c scp.c
  	int len;
  
  	for (indx = 0; indx < argc; ++indx) {
-@@ -868,7 +868,7 @@
+@@ -868,7 +868,7 @@ sink(int argc, char **argv)
  	mode_t mode, omode, mask;
  	off_t size, statbytes;
  	int setimes, targisdir, wrerrno = 0;
@@ -1584,98 +3051,10 @@ diff -urN scp.c scp.c
  	struct timeval tv[2];
  
  #define	atime	tv[0]
-diff -urN servconf.c servconf.c
---- servconf.c	2009-05-02 17:37:11.000000000 +0400
-+++ servconf.c	2009-05-02 17:38:19.000000000 +0400
-@@ -266,6 +266,42 @@
- 	if (options->zero_knowledge_password_authentication == -1)
- 		options->zero_knowledge_password_authentication = 0;
- 
-+	if (options->hpn_disabled == -1) 
-+		options->hpn_disabled = 0;
-+
-+	if (options->hpn_buffer_size == -1) {
-+		/* option not explicitly set. Now we have to figure out */
-+		/* what value to use */
-+		if (options->hpn_disabled == 1) {
-+			options->hpn_buffer_size = CHAN_SES_WINDOW_DEFAULT;
-+		} else {
-+			/* get the current RCV size and set it to that */
-+			/*create a socket but don't connect it */
-+			/* we use that the get the rcv socket size */
-+			sock = socket(AF_INET, SOCK_STREAM, 0);
-+			getsockopt(sock, SOL_SOCKET, SO_RCVBUF, 
-+				   &socksize, &socksizelen);
-+			close(sock);
-+			options->hpn_buffer_size = socksize;
-+			debug ("HPN Buffer Size: %d", options->hpn_buffer_size);
-+			
-+		} 
-+	} else {
-+		/* we have to do this incase the user sets both values in a contradictory */
-+		/* manner. hpn_disabled overrrides hpn_buffer_size*/
-+		if (options->hpn_disabled <= 0) {
-+			if (options->hpn_buffer_size == 0)
-+				options->hpn_buffer_size = 1;
-+			/* limit the maximum buffer to 64MB */
-+			if (options->hpn_buffer_size > 64*1024) {
-+				options->hpn_buffer_size = 64*1024*1024;
-+			} else {
-+				options->hpn_buffer_size *= 1024;
-+			}
-+		} else
-+			options->hpn_buffer_size = CHAN_TCP_WINDOW_DEFAULT;
-+	}
-+
- 	/* Turn privilege separation on by default */
- 	if (use_privsep == -1)
- 		use_privsep = 1;
-@@ -428,6 +464,10 @@
- 	{ "permitopen", sPermitOpen, SSHCFG_ALL },
- 	{ "forcecommand", sForceCommand, SSHCFG_ALL },
- 	{ "chrootdirectory", sChrootDirectory, SSHCFG_ALL },
-+	{ "noneenabled", sNoneEnabled },
-+	{ "hpndisabled", sHPNDisabled },
-+	{ "hpnbuffersize", sHPNBufferSize },
-+	{ "tcprcvbufpoll", sTcpRcvBufPoll },
- 	{ NULL, sBadOption, 0 }
- };
- 
-@@ -454,6 +494,7 @@
- 
- 	for (i = 0; keywords[i].name; i++)
- 		if (strcasecmp(cp, keywords[i].name) == 0) {
-+		        debug ("Config token is %s", keywords[i].name);
- 			*flags = keywords[i].flags;
- 			return keywords[i].opcode;
- 		}
-@@ -851,6 +892,22 @@
- 			*intptr = value;
- 		break;
- 
-+	case sNoneEnabled:
-+		intptr = &options->none_enabled;
-+		goto parse_flag;
-+
-+	case sTcpRcvBufPoll:
-+		intptr = &options->tcp_rcv_buf_poll;
-+		goto parse_flag;
-+
-+	case sHPNDisabled:
-+		intptr = &options->hpn_disabled;
-+		goto parse_flag;
-+
-+	case sHPNBufferSize:
-+		intptr = &options->hpn_buffer_size;
-+		goto parse_int;
-+
- 	case sIgnoreUserKnownHosts:
- 		intptr = &options->ignore_user_known_hosts;
- 		goto parse_flag;
-diff -urN servconf.h servconf.h
---- servconf.h	2009-01-28 08:31:23.000000000 +0300
-+++ servconf.h	2009-05-02 17:38:19.000000000 +0400
-@@ -145,6 +145,10 @@
+diff -NupwB servconf.h servconf.h
+--- servconf.h	2009-01-28 00:31:23.000000000 -0500
++++ servconf.h	2009-05-14 12:36:10.000000000 -0400
+@@ -145,6 +145,10 @@ typedef struct {
  	char   *adm_forced_command;
  
  	int	use_pam;		/* Enable auth via PAM */
@@ -1686,10 +3065,10 @@ diff -urN servconf.h servconf.h
  
  	int	permit_tun;
  
-diff -urN serverloop.c serverloop.c
---- serverloop.c	2009-02-14 08:33:09.000000000 +0300
-+++ serverloop.c	2009-05-02 17:38:19.000000000 +0400
-@@ -93,10 +93,10 @@
+diff -NupwB serverloop.c serverloop.c
+--- serverloop.c	2009-02-14 00:33:09.000000000 -0500
++++ serverloop.c	2009-05-14 12:36:10.000000000 -0400
+@@ -93,10 +93,10 @@ static int fdin;		/* Descriptor for stdi
  static int fdout;		/* Descriptor for stdout (for reading);
  				   May be same number as fdin. */
  static int fderr;		/* Descriptor for stderr.  May be -1. */
@@ -1704,7 +3083,7 @@ diff -urN serverloop.c serverloop.c
  static int stdin_eof = 0;	/* EOF message received from client. */
  static int fdout_eof = 0;	/* EOF encountered reading from fdout. */
  static int fderr_eof = 0;	/* EOF encountered readung from fderr. */
-@@ -121,6 +121,20 @@
+@@ -121,6 +121,20 @@ static volatile sig_atomic_t received_si
  static void server_init_dispatch(void);
  
  /*
@@ -1725,7 +3104,7 @@ diff -urN serverloop.c serverloop.c
   * we write to this pipe if a SIGCHLD is caught in order to avoid
   * the race between select() and child_terminated
   */
-@@ -410,6 +424,7 @@
+@@ -410,6 +424,7 @@ process_input(fd_set *readset)
  		} else {
  			/* Buffer any received data. */
  			packet_process_incoming(buf, len);
@@ -1733,7 +3112,7 @@ diff -urN serverloop.c serverloop.c
  		}
  	}
  	if (compat20)
-@@ -432,6 +447,7 @@
+@@ -432,6 +447,7 @@ process_input(fd_set *readset)
  		} else {
  			buffer_append(&stdout_buffer, buf, len);
  			fdout_bytes += len;
@@ -1741,7 +3120,7 @@ diff -urN serverloop.c serverloop.c
  		}
  	}
  	/* Read and buffer any available stderr data from the program. */
-@@ -499,7 +515,7 @@
+@@ -499,7 +515,7 @@ process_output(fd_set *writeset)
  	}
  	/* Send any buffered packet data to the client. */
  	if (FD_ISSET(connection_out, writeset))
@@ -1750,7 +3129,7 @@ diff -urN serverloop.c serverloop.c
  }
  
  /*
-@@ -816,8 +832,10 @@
+@@ -816,8 +832,10 @@ server_loop2(Authctxt *authctxt)
  {
  	fd_set *readset = NULL, *writeset = NULL;
  	int rekeying = 0, max_fd, nalloc = 0;
@@ -1761,7 +3140,7 @@ diff -urN serverloop.c serverloop.c
  
  	mysignal(SIGCHLD, sigchld_handler);
  	child_terminated = 0;
-@@ -879,6 +897,11 @@
+@@ -879,6 +897,11 @@ server_loop2(Authctxt *authctxt)
  
  	/* free remaining sessions, e.g. remove wtmp entries */
  	session_destroy_all(NULL);
@@ -1773,7 +3152,7 @@ diff -urN serverloop.c serverloop.c
  }
  
  static void
-@@ -994,8 +1017,12 @@
+@@ -994,8 +1017,12 @@ server_request_tun(void)
  	sock = tun_open(tun, mode);
  	if (sock < 0)
  		goto done;
@@ -1786,7 +3165,7 @@ diff -urN serverloop.c serverloop.c
  	c->datagram = 1;
  #if defined(SSH_TUN_FILTER)
  	if (mode == SSH_TUNMODE_POINTOPOINT)
-@@ -1031,6 +1058,8 @@
+@@ -1031,6 +1058,8 @@ server_request_session(void)
  	c = channel_new("session", SSH_CHANNEL_LARVAL,
  	    -1, -1, -1, /*window size*/0, CHAN_SES_PACKET_DEFAULT,
  	    0, "server-session", 1);
@@ -1795,10 +3174,10 @@ diff -urN serverloop.c serverloop.c
  	if (session_open(the_authctxt, c->self) != 1) {
  		debug("session open failed, free channel %d", c->self);
  		channel_free(c);
-diff -urN session.c session.c
---- session.c	2009-05-02 17:37:11.000000000 +0400
-+++ session.c	2009-05-02 17:38:19.000000000 +0400
-@@ -230,6 +230,7 @@
+diff -NupwB session.c session.c
+--- session.c	2009-01-28 00:29:49.000000000 -0500
++++ session.c	2009-05-14 12:36:10.000000000 -0400
+@@ -230,6 +230,7 @@ auth_input_request_forwarding(struct pas
  	}
  
  	/* Allocate a channel for the authentication agent socket. */
@@ -1806,7 +3185,7 @@ diff -urN session.c session.c
  	nc = channel_new("auth socket",
  	    SSH_CHANNEL_AUTH_SOCKET, sock, sock, -1,
  	    CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
-@@ -2351,10 +2352,16 @@
+@@ -2301,10 +2302,16 @@ session_set_fds(Session *s, int fdin, in
  	 */
  	if (s->chanid == -1)
  		fatal("no channel for session %d", s->self);
@@ -1823,10 +3202,10 @@ diff -urN session.c session.c
  }
  
  /*
-diff -urN sftp.1 sftp.1
---- sftp.1	2009-01-28 08:14:09.000000000 +0300
-+++ sftp.1	2009-05-02 17:38:19.000000000 +0400
-@@ -203,7 +203,8 @@
+diff -NupwB sftp.1 sftp.1
+--- sftp.1	2009-01-28 00:14:09.000000000 -0500
++++ sftp.1	2009-05-14 12:36:10.000000000 -0400
+@@ -203,7 +203,8 @@ This option may be useful in debugging t
  Specify how many requests may be outstanding at any one time.
  Increasing this may slightly improve file transfer speed
  but will increase memory usage.
@@ -1836,10 +3215,10 @@ diff -urN sftp.1 sftp.1
  .It Fl S Ar program
  Name of the
  .Ar program
-diff -urN sftp.c sftp.c
---- sftp.c	2009-02-14 08:26:19.000000000 +0300
-+++ sftp.c	2009-05-02 17:38:19.000000000 +0400
-@@ -75,7 +75,7 @@
+diff -NupwB sftp.c sftp.c
+--- sftp.c	2009-02-14 00:26:19.000000000 -0500
++++ sftp.c	2009-05-14 12:36:10.000000000 -0400
+@@ -75,7 +75,7 @@ int batchmode = 0;
  size_t copy_buffer_len = 32768;
  
  /* Number of concurrent outstanding requests */
@@ -1848,10 +3227,10 @@ diff -urN sftp.c sftp.c
  
  /* PID of ssh transport process */
  static pid_t sshpid = -1;
-diff -urN ssh.c ssh.c
---- ssh.c	2009-05-02 17:37:11.000000000 +0400
-+++ ssh.c	2009-05-02 17:38:19.000000000 +0400
-@@ -492,9 +492,6 @@
+diff -NupwB ssh.c ssh.c
+--- ssh.c	2009-02-14 00:28:21.000000000 -0500
++++ ssh.c	2009-05-14 12:36:10.000000000 -0400
+@@ -492,9 +492,6 @@ main(int ac, char **av)
  			no_shell_flag = 1;
  			no_tty_flag = 1;
  			break;
@@ -1861,7 +3240,7 @@ diff -urN ssh.c ssh.c
  		case 'o':
  			dummy = 1;
  			line = xstrdup(optarg);
-@@ -503,6 +500,13 @@
+@@ -503,6 +500,13 @@ main(int ac, char **av)
  				exit(255);
  			xfree(line);
  			break;
@@ -1875,7 +3254,7 @@ diff -urN ssh.c ssh.c
  		case 's':
  			subsystem_flag = 1;
  			break;
-@@ -1159,6 +1163,9 @@
+@@ -1142,6 +1146,9 @@ ssh_session2_open(void)
  {
  	Channel *c;
  	int window, packetmax, in, out, err;
@@ -1885,7 +3264,7 @@ diff -urN ssh.c ssh.c
  
  	if (stdin_null_flag) {
  		in = open(_PATH_DEVNULL, O_RDONLY);
-@@ -1179,9 +1186,75 @@
+@@ -1162,9 +1169,75 @@ ssh_session2_open(void)
  	if (!isatty(err))
  		set_nonblock(err);
  
@@ -1962,7 +3341,7 @@ diff -urN ssh.c ssh.c
  		window >>= 1;
  		packetmax >>= 1;
  	}
-@@ -1189,7 +1262,10 @@
+@@ -1172,7 +1245,10 @@ ssh_session2_open(void)
  	    "session", SSH_CHANNEL_OPENING, in, out, err,
  	    window, packetmax, CHAN_EXTENDED_WRITE,
  	    "client-session", /*nonblock*/0);
@@ -1974,10 +3353,55 @@ diff -urN ssh.c ssh.c
  	debug3("ssh_session2_open: channel_new: %d", c->self);
  
  	channel_send_open(c->self);
-diff -urN sshconnect.c sshconnect.c
---- sshconnect.c	2009-02-01 14:19:54.000000000 +0300
-+++ sshconnect.c	2009-05-02 17:38:19.000000000 +0400
-@@ -165,6 +165,31 @@
+diff -NupwB sshconnect2.c sshconnect2.c
+--- sshconnect2.c	2008-11-05 00:20:47.000000000 -0500
++++ sshconnect2.c	2009-05-14 12:36:10.000000000 -0400
+@@ -78,6 +78,12 @@
+ extern char *client_version_string;
+ extern char *server_version_string;
+ extern Options options;
++extern Kex *xxx_kex;
++
++/* tty_flag is set in ssh.c. use this in ssh_userauth2 */
++/* if it is set then prevent the switch to the null cipher */
++
++extern int tty_flag;
+ 
+ /*
+  * SSH2 key exchange
+@@ -350,6 +356,28 @@ ssh_userauth2(const char *local_user, co
+ 	pubkey_cleanup(&authctxt);
+ 	dispatch_range(SSH2_MSG_USERAUTH_MIN, SSH2_MSG_USERAUTH_MAX, NULL);
+ 
++	/* if the user wants to use the none cipher do it */
++	/* post authentication and only if the right conditions are met */
++	/* both of the NONE commands must be true and there must be no */
++	/* tty allocated */
++	if ((options.none_switch == 1) && (options.none_enabled == 1)) 
++	{
++		if (!tty_flag) /* no null on tty sessions */
++		{
++			debug("Requesting none rekeying...");
++			myproposal[PROPOSAL_ENC_ALGS_STOC] = "none";
++			myproposal[PROPOSAL_ENC_ALGS_CTOS] = "none";
++			kex_prop2buf(&xxx_kex->my,myproposal);
++			packet_request_rekeying();
++			fprintf(stderr, "WARNING: ENABLED NONE CIPHER\n");
++		}
++		else
++		{
++			/* requested NONE cipher when in a tty */
++			debug("Cannot switch to NONE cipher with tty allocated");
++			fprintf(stderr, "NONE cipher switch disabled when a TTY is allocated\n");
++		}
++	}
+ 	debug("Authentication succeeded (%s).", authctxt.method->name);
+ }
+ 
+diff -NupwB sshconnect.c sshconnect.c
+--- sshconnect.c	2009-02-01 06:19:54.000000000 -0500
++++ sshconnect.c	2009-05-14 12:36:10.000000000 -0400
+@@ -165,6 +165,31 @@ ssh_proxy_connect(const char *host, u_sh
  }
  
  /*
@@ -2009,7 +3433,7 @@ diff -urN sshconnect.c sshconnect.c
   * Creates a (possibly privileged) socket for use as the ssh connection.
   */
  static int
-@@ -187,12 +212,18 @@
+@@ -187,12 +212,18 @@ ssh_create_socket(int privileged, struct
  			    strerror(errno));
  		else
  			debug("Allocated local port %d.", p);
@@ -2028,7 +3452,7 @@ diff -urN sshconnect.c sshconnect.c
  	/* Bind the socket to an alternative local IP address */
  	if (options.bind_address == NULL)
  		return sock;
-@@ -536,7 +567,7 @@
+@@ -536,7 +567,7 @@ ssh_exchange_identification(int timeout_
  	snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s%s",
  	    compat20 ? PROTOCOL_MAJOR_2 : PROTOCOL_MAJOR_1,
  	    compat20 ? PROTOCOL_MINOR_2 : minor1,
@@ -2037,55 +3461,10 @@ diff -urN sshconnect.c sshconnect.c
  	if (atomicio(vwrite, connection_out, buf, strlen(buf)) != strlen(buf))
  		fatal("write: %.100s", strerror(errno));
  	client_version_string = xstrdup(buf);
-diff -urN sshconnect2.c sshconnect2.c
---- sshconnect2.c	2008-11-05 08:20:47.000000000 +0300
-+++ sshconnect2.c	2009-05-02 17:38:19.000000000 +0400
-@@ -78,6 +78,12 @@
- extern char *client_version_string;
- extern char *server_version_string;
- extern Options options;
-+extern Kex *xxx_kex;
-+
-+/* tty_flag is set in ssh.c. use this in ssh_userauth2 */
-+/* if it is set then prevent the switch to the null cipher */
-+
-+extern int tty_flag;
- 
- /*
-  * SSH2 key exchange
-@@ -350,6 +356,28 @@
- 	pubkey_cleanup(&authctxt);
- 	dispatch_range(SSH2_MSG_USERAUTH_MIN, SSH2_MSG_USERAUTH_MAX, NULL);
- 
-+	/* if the user wants to use the none cipher do it */
-+	/* post authentication and only if the right conditions are met */
-+	/* both of the NONE commands must be true and there must be no */
-+	/* tty allocated */
-+	if ((options.none_switch == 1) && (options.none_enabled == 1)) 
-+	{
-+		if (!tty_flag) /* no null on tty sessions */
-+		{
-+			debug("Requesting none rekeying...");
-+			myproposal[PROPOSAL_ENC_ALGS_STOC] = "none";
-+			myproposal[PROPOSAL_ENC_ALGS_CTOS] = "none";
-+			kex_prop2buf(&xxx_kex->my,myproposal);
-+			packet_request_rekeying();
-+			fprintf(stderr, "WARNING: ENABLED NONE CIPHER\n");
-+		}
-+		else
-+		{
-+			/* requested NONE cipher when in a tty */
-+			debug("Cannot switch to NONE cipher with tty allocated");
-+			fprintf(stderr, "NONE cipher switch disabled when a TTY is allocated\n");
-+		}
-+	}
- 	debug("Authentication succeeded (%s).", authctxt.method->name);
- }
- 
-diff -urN sshd.c sshd.c
---- sshd.c	2009-05-02 17:37:11.000000000 +0400
-+++ sshd.c	2009-05-02 17:38:19.000000000 +0400
-@@ -143,6 +143,9 @@
+diff -NupwB sshd.c sshd.c
+--- sshd.c	2009-01-28 00:31:23.000000000 -0500
++++ sshd.c	2009-05-14 12:36:10.000000000 -0400
+@@ -136,6 +136,9 @@ int deny_severity;
  #define REEXEC_CONFIG_PASS_FD		(STDERR_FILENO + 3)
  #define REEXEC_MIN_FREE_FD		(STDERR_FILENO + 4)
  
@@ -2095,7 +3474,7 @@ diff -urN sshd.c sshd.c
  extern char *__progname;
  
  /* Server configuration options. */
-@@ -422,7 +425,7 @@
+@@ -415,7 +418,7 @@ sshd_exchange_identification(int sock_in
  		minor = PROTOCOL_MINOR_1;
  	}
  	snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s%s", major, minor,
@@ -2104,7 +3483,7 @@ diff -urN sshd.c sshd.c
  	server_version_string = xstrdup(buf);
  
  	/* Send our protocol version identification. */
-@@ -473,6 +476,9 @@
+@@ -466,6 +469,9 @@ sshd_exchange_identification(int sock_in
  	}
  	debug("Client protocol version %d.%d; client software version %.100s",
  	    remote_major, remote_minor, remote_version);
@@ -2114,7 +3493,7 @@ diff -urN sshd.c sshd.c
  
  	compat_datafellows(remote_version);
  
-@@ -951,6 +957,8 @@
+@@ -944,6 +950,8 @@ server_listen(void)
  	int ret, listen_sock, on = 1;
  	struct addrinfo *ai;
  	char ntop[NI_MAXHOST], strport[NI_MAXSERV];
@@ -2123,7 +3502,7 @@ diff -urN sshd.c sshd.c
  
  	for (ai = options.listen_addrs; ai; ai = ai->ai_next) {
  		if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
-@@ -997,6 +1005,11 @@
+@@ -990,6 +998,11 @@ server_listen(void)
  
  		debug("Bind to port %s on %s.", strport, ntop);
  
@@ -2135,7 +3514,7 @@ diff -urN sshd.c sshd.c
  		/* Bind the socket to the desired port. */
  		if (bind(listen_sock, ai->ai_addr, ai->ai_addrlen) < 0) {
  			error("Bind to port %s on %s failed: %.200s.",
-@@ -1847,6 +1860,9 @@
+@@ -1817,6 +1830,9 @@ main(int ac, char **av)
  	/* Log the connection. */
  	verbose("Connection from %.500s port %d", remote_ip, remote_port);
  
@@ -2145,7 +3524,7 @@ diff -urN sshd.c sshd.c
  	/*
  	 * We don't want to listen forever unless the other side
  	 * successfully authenticates itself.  So we set up an alarm which is
-@@ -2201,9 +2217,15 @@
+@@ -2171,9 +2187,15 @@ do_ssh2_kex(void)
  {
  	Kex *kex;
  
@@ -2161,10 +3540,10 @@ diff -urN sshd.c sshd.c
  	}
  	myproposal[PROPOSAL_ENC_ALGS_CTOS] =
  	    compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_CTOS]);
-diff -urN sshd_config sshd_config
---- sshd_config	2009-05-02 17:37:11.000000000 +0400
-+++ sshd_config	2009-05-02 17:38:19.000000000 +0400
-@@ -112,6 +112,20 @@
+diff -NupwB sshd_config sshd_config
+--- sshd_config	2008-07-02 08:35:43.000000000 -0400
++++ sshd_config	2009-05-14 12:36:10.000000000 -0400
+@@ -112,6 +112,20 @@ Protocol 2
  # override default of no subsystems
  Subsystem	sftp	/usr/libexec/sftp-server
  
@@ -2185,12 +3564,13 @@ diff -urN sshd_config sshd_config
  # Example of overriding settings on a per-user basis
  #Match User anoncvs
  #	X11Forwarding no
---- version.h.orig      2009-02-23 03:09:26.000000000 +0300
-+++ version.h   2009-05-02 18:53:20.000000000 +0400
+diff -NupwB version.h version.h
+--- version.h	2009-02-22 19:09:26.000000000 -0500
++++ version.h	2009-05-14 12:42:05.000000000 -0400
 @@ -3,4 +3,5 @@
- #define SSH_VERSION    "OpenSSH_5.2"
+ #define SSH_VERSION	"OpenSSH_5.2"
  
- #define SSH_PORTABLE   "p1"
--#define SSH_RELEASE    SSH_VERSION SSH_PORTABLE
-+#define SSH_HPN         "-hpn13v5"
-+#define SSH_RELEASE    SSH_VERSION SSH_PORTABLE SSH_HPN
+ #define SSH_PORTABLE	"p1"
+-#define SSH_RELEASE	SSH_VERSION SSH_PORTABLE
++#define SSH_HPN         "-hpn13v6"
++#define SSH_RELEASE	SSH_VERSION SSH_PORTABLE SSH_HPN