This commit was manufactured by cvs2svn to create tagvendor/openssh/200309-buffer-patch

'openssh-vendor-crypto-OpenSSH_200309_buffer_patch'.

377 files changed, 0 insertions, 87173 deletions

diff --git a/crypto/openssh/COPYING.Ylonen b/crypto/openssh/COPYING.Ylonen
deleted file mode 100644
index 5e681edd2930..000000000000
--- a/crypto/openssh/COPYING.Ylonen
+++ /dev/null
@@ -1,70 +0,0 @@
-This file is part of the ssh software, Copyright (c) 1995 Tatu Ylonen, Finland
-
-
-COPYING POLICY AND OTHER LEGAL ISSUES
-
-As far as I am concerned, the code I have written for this software
-can be used freely for any purpose.  Any derived versions of this
-software must be clearly marked as such, and if the derived work is
-incompatible with the protocol description in the RFC file, it must be
-called by a name other than "ssh" or "Secure Shell".
-
-However, I am not implying to give any licenses to any patents or
-copyrights held by third parties, and the software includes parts that
-are not under my direct control.  As far as I know, all included
-source code is used in accordance with the relevant license agreements
-and can be used freely for any purpose (the GNU license being the most
-restrictive); see below for details.
-
-[ RSA is no longer included. ]
-[ IDEA is no longer included. ]
-[ DES is now external. ]
-[ GMP is now external. No more GNU licence. ]
-[ Zlib is now external. ]
-[ The make-ssh-known-hosts script is no longer included. ]
-[ TSS has been removed. ]
-[ MD5 is now external. ]
-[ RC4 support has been removed. ]
-[ Blowfish is now external. ]
-
-The 32-bit CRC implementation in crc32.c is due to Gary S. Brown.
-Comments in the file indicate it may be used for any purpose without
-restrictions.
-
-The 32-bit CRC compensation attack detector in deattack.c was
-contributed by CORE SDI S.A. under a BSD-style license. See
-http://www.core-sdi.com/english/ssh/ for details.
-
-Note that any information and cryptographic algorithms used in this
-software are publicly available on the Internet and at any major
-bookstore, scientific library, and patent office worldwide.  More
-information can be found e.g. at "http://www.cs.hut.fi/crypto".
-
-The legal status of this program is some combination of all these
-permissions and restrictions.  Use only at your own responsibility.
-You will be responsible for any legal consequences yourself; I am not
-making any claims whether possessing or using this is legal or not in
-your country, and I am not taking any responsibility on your behalf.
-
-
-			    NO WARRANTY
-
-BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
-FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
-OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
-PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
-OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
-TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
-PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
-REPAIR OR CORRECTION.
-
-IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
-REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
-INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
-OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
-TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
-YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
-PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
-POSSIBILITY OF SUCH DAMAGES.
diff --git a/crypto/openssh/CREDITS b/crypto/openssh/CREDITS
deleted file mode 100644
index 0c86684735e2..000000000000
--- a/crypto/openssh/CREDITS
+++ /dev/null
@@ -1,95 +0,0 @@
-Tatu Ylonen <ylo@cs.hut.fi> - Creator of SSH
-
-Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, 
-Theo de Raadt, and Dug Song - Creators of OpenSSH
-
-Alain St-Denis <Alain.St-Denis@ec.gc.ca> - Irix fix
-Alexandre Oliva <oliva@lsd.ic.unicamp.br> - AIX fixes
-Andre Lucas <andre.lucas@dial.pipex.com> - new login code, many fixes
-Andreas Steinmetz <ast@domdv.de> - Shadow password expiry support
-Andrew McGill <andrewm@datrix.co.za> - SCO fixes
-Andrew Morgan <morgan@transmeta.com> - PAM bugfixes
-Andrew Stribblehill <a.d.stribblehill@durham.ac.uk> - Bugfixes
-Andy Sloane <andy@guildsoftware.com> - bugfixes
-Aran Cox <acox@cv.telegroup.com> - SCO bugfixes
-Arkadiusz Miskiewicz <misiek@pld.org.pl> - IPv6 compat fixes
-Ben Lindstrom <mouring@eviladmin.org> - NeXT support
-Ben Taylor <bent@clark.net> - Solaris debugging and fixes
-Bratislav ILICH <bilic@zepter.ru> - Configure fix
-Charles Levert <charles@comm.polymtl.ca> - SunOS 4 & bug fixes
-Chip Salzenberg <chip@valinux.com> - Assorted patches
-Chris Adams <cmadams@hiwaay.net> - OSF SIA support
-Chris Saia <csaia@wtower.com> - SuSE packaging
-Chris, the Young One <cky@pobox.com> - Password auth fixes
-Christos Zoulas <christos@zoulas.com> - Autoconf fixes
-Chun-Chung Chen <cjj@u.washington.edu> - RPM fixes
-Corinna Vinschen <vinschen@cygnus.com> - Cygwin support
-Dan Brosemer <odin@linuxfreak.com> - Autoconf support, build fixes
-Darren Hall <dhall@virage.org> - AIX patches
-Darren Tucker <dtucker@zip.com.au> - AIX BFF package scripts
-David Agraz <dagraz@jahoopa.com> - Build fixes
-David Del Piero <David.DelPiero@qed.qld.gov.au> - bug fixes
-David Hesprich <darkgrue@gue-tech.org> - Configure fixes
-David Rankin <drankin@bohemians.lexington.ky.us> - libwrap, AIX, NetBSD fixes
-Ed Eden <ede370@stl.rural.usda.gov> - configure fixes
-Garrick James <garrick@james.net> - configure fixes
-Gary E. Miller <gem@rellim.com> - SCO support
-Ged Lodder <lodder@yacc.com.au> - HPUX fixes and enhancements
-Gert Doering <gd@hilb1.medat.de> - bug and portability fixes
-HARUYAMA Seigo <haruyama@unixuser.org> - Translations & doc fixes
-Hideaki YOSHIFUJI <yoshfuji@ecei.tohoku.ac.jp> - IPv6 and bug fixes
-Hiroshi Takekawa <takekawa@sr3.t.u-tokyo.ac.jp> - Configure fixes
-Holger Trapp <Holger.Trapp@Informatik.TU-Chemnitz.DE> - KRB4/AFS config patch
-IWAMURO Motonori <iwa@mmp.fujitsu.co.jp> - bugfixes
-Jani Hakala <jahakala@cc.jyu.fi> - Patches
-Jarno Huuskonen <jhuuskon@hytti.uku.fi> - Bugfixes
-Jim Knoble <jmknoble@jmknoble.cx> - Many patches
-Jonchen (email unknown) - the original author of PAM support of SSH
-Juergen Keil <jk@tools.de> - scp bugfixing
-KAMAHARA Junzo <kamahara@cc.kshosen.ac.jp> - Configure fixes
-Kees Cook <cook@cpoint.net> - scp fixes
-Kenji Miyake <kenji@miyake.org> - Configure fixes
-Kevin O'Connor <kevin_oconnor@standardandpoors.com> - RSAless operation
-Kevin Steves <stevesk@pobox.com> - HP support, bugfixes, improvements
-Kiyokazu SUTO <suto@ks-and-ks.ne.jp> - Bugfixes
-Larry Jones <larry.jones@sdrc.com> - Bugfixes
-Lutz Jaenicke <Lutz.Jaenicke@aet.TU-Cottbus.DE> - Bugfixes
-Marc G. Fournier <marc.fournier@acadiau.ca> - Solaris patches
-Mark D. Baushke <mdb@juniper.net> - bug fixes
-Martin Johansson <fatbob@acc.umu.se> - Linux fixes
-Mark D. Roth <roth+openssh@feep.net> - Features, bug fixes
-Mark Miller <markm@swoon.net> - Bugfixes
-Matt Richards <v2matt@btv.ibm.com> - AIX patches
-Michael Stone <mstone@cs.loyola.edu> - Irix enhancements
-Nakaji Hiroyuki <nakaji@tutrp.tut.ac.jp> - Sony News-OS patch
-Nalin Dahyabhai <nalin.dahyabhai@pobox.com> - PAM environment patch
-Nate Itkin <nitkin@europa.com> - SunOS 4.1.x fixes
-Niels Kristian Bech Jensen <nkbj@image.dk> - Assorted patches
-Pavel Kankovsky <peak@argo.troja.mff.cuni.cz> - Security fixes
-Pavel Troller <patrol@omni.sinus.cz> - Bugfixes
-Pekka Savola <pekkas@netcore.fi> - Bugfixes
-Peter Kocks <peter.kocks@baygate.com> - Makefile fixes
-Phil Hands <phil@hands.com> - Debian scripts, assorted patches
-Phil Karn <karn@ka9q.ampr.org> - Autoconf fixes
-Philippe WILLEM <Philippe.WILLEM@urssaf.fr> - Bugfixes
-Phill Camp <P.S.S.Camp@ukc.ac.uk> - login code fix
-Rip Loomis <loomisg@cist.saic.com> - Solaris package support, fixes
-SAKAI Kiyotaka <ksakai@kso.netwk.ntt-at.co.jp> - Multiple bugfixes
-Simon Wilkinson <sxw@dcs.ed.ac.uk> - PAM fixes, Compat with MIT KrbV
-Solar Designer <solar@openwall.com> - many patches and technical assistance
-Svante Signell <svante.signell@telia.com> - Bugfixes
-Thomas Neumann <tom@smart.ruhr.de> - Shadow passwords
-Tim Rice <tim@multitalents.net> - Portability & SCO fixes
-Tobias Oetiker <oetiker@ee.ethz.ch> - Bugfixes
-Tom Bertelson's <tbert@abac.com> - AIX auth fixes
-Tor-Ake Fransson <torake@hotmail.com> - AIX support
-Tudor Bosman <tudorb@jm.nu> - MD5 password support
-Udo Schweigert <ust@cert.siemens.de> - ReliantUNIX support
-Zack Weinberg <zack@wolery.cumb.org> - GNOME askpass enhancement
-
-Apologies to anyone I have missed.
-
-Damien Miller <djm@mindrot.org>
-
-$Id: CREDITS,v 1.67 2002/07/28 20:31:19 stevesk Exp $
-
diff --git a/crypto/openssh/ChangeLog b/crypto/openssh/ChangeLog
deleted file mode 100644
index ebde747954e7..000000000000
--- a/crypto/openssh/ChangeLog
+++ /dev/null
@@ -1,1298 +0,0 @@
-20030401
- - (djm) OpenBSD CVS Sync
-   - jmc@cvs.openbsd.org 2003/03/28 10:11:43
-     [scp.1 sftp.1 ssh.1 ssh-add.1 ssh-agent.1 ssh_config.5 sshd_config.5]
-     [ssh-keygen.1 ssh-keyscan.1 ssh-keysign.8]
-     - killed whitespace
-     - new sentence new line
-     - .Bk for arguments
-     ok markus@
-   - markus@cvs.openbsd.org 2003/04/01 10:10:23
-     [clientloop.c monitor.c monitor_wrap.c packet.c packet.h readconf.c]
-     [readconf.h serverloop.c sshconnect2.c]
-     rekeying bugfixes and automatic rekeying:
-     * both client and server rekey _automatically_
-           (a) after 2^31 packets, because after 2^32 packets
-               the sequence number for packets wraps
-           (b) after 2^(blocksize_in_bits/4) blocks
-       (see: draft-ietf-secsh-newmodes-00.txt)
-       (a) and (b) are _enabled_ by default, and only disabled for known
-       openssh versions, that don't support rekeying properly.
-     * client option 'RekeyLimit'
-     * do not reply to requests during rekeying
-   - markus@cvs.openbsd.org 2003/04/01 10:22:21
-     [clientloop.c monitor.c monitor_wrap.c packet.c packet.h readconf.c]
-     [readconf.h serverloop.c sshconnect2.c]
-     backout rekeying changes (for 3.6.1)
-   - markus@cvs.openbsd.org 2003/04/01 10:31:26
-     [compat.c compat.h kex.c]
-     bugfix causes stalled connections for ssh.com < 3.0; noticed by ho@; 
-     tested by ho@ and myself
-   - markus@cvs.openbsd.org 2003/04/01 10:56:46
-     [version.h]
-     3.6.1
- - (djm) Crank spec file versions
- - (djm) Release 3.6.1p1
-
-20030326
- - (djm) OpenBSD CVS Sync
-   - deraadt@cvs.openbsd.org 2003/03/26 04:02:51
-     [sftp-server.c]
-     one last fix to the tree: race fix broke stuff; pr 3169; 
-     srp@srparish.net, help from djm
-
-20030325
- - (djm) Fix getpeerid support for 64 bit BE systems. From 
-    Arnd Bergmann <arndb@de.ibm.com>
-
-20030324
- - (djm) OpenBSD CVS Sync
-   - markus@cvs.openbsd.org 2003/03/23 19:02:00
-     [monitor.c]
-     unbreak rekeying for privsep; ok millert@
- - Release 3.6p1
- - Fix sshd BindAddress and -b options for systems using fake-getaddrinfo.
-   Report from murple@murple.net, diagnosis from dtucker@zip.com.au
-
-20030320
- - (djm) OpenBSD CVS Sync
-   - markus@cvs.openbsd.org 2003/03/17 10:38:38
-     [progressmeter.c]
-     don't print \n if backgrounded; from ho@
-   - markus@cvs.openbsd.org 2003/03/17 11:43:47
-     [version.h]
-     enter 3.6
- - (bal) The days of lack of int64_t support are over.  Sorry kids.
- - (bal) scp.c 'limit' conflicts with Cray.  Rename to 'limitbw'
- - (bal) Collection of Cray patches (bsd-cray.h fix for CRAYT3E and improved
-   guessing rules)
- - (bal) Disable Privsep for Tru64 after pre-authentication due to issues
-   with SIA.  Also, clean up of tru64 support patch by Chris Adams
-   <cmadams@hiwaay.net>
- - (tim) [contrib/caldera/openssh.spec] workaround RPM quirk. Fix %files
-
-20030318
- - (tim) [configure.ac openbsd-compat/bsd-misc.c openbsd-compat/bsd-misc.h]
-   add nanosleep(). testing/corrections by Darren Tucker <dtucker@zip.com.au>
-
-20030317
- - (djm) Fix return value checks for RAND_bytes. Report from 
-   Steve G <linux_4ever@yahoo.com>
-
-20030315
- - (djm) OpenBSD CVS Sync
-   - markus@cvs.openbsd.org 2003/03/13 11:42:19
-     [authfile.c ssh-keysign.c]
-     move RSA_blinding_on to generic key load method
-   - markus@cvs.openbsd.org 2003/03/13 11:44:50
-     [ssh-agent.c]
-     ssh-agent is similar to ssh-keysign (allows other processes to use
-     private rsa keys). however, it gets key over socket and not from
-     a file, so we have to do blinding here as well.
-
-20030310
-- (djm) OpenBSD CVS Sync
-   - markus@cvs.openbsd.org 2003/03/05 22:33:43
-     [channels.c monitor.c scp.c session.c sftp-client.c sftp-int.c]
-     [sftp-server.c ssh-add.c sshconnect2.c]
-     fix memory leaks; from dlheine@suif.Stanford.EDU/CLOUSEAU; ok djm@
- - (djm) One more portable-specific one from dlheine@suif.Stanford.EDU/
-   CLOUSEAU
- - (djm) Bug #245: TTY problems on Solaris. Fix by stevesk@ and 
-   dtucker@zip.com.au
- - (djm) AIX package builder update from dtucker@zip.com.au
-
-20030225
- - (djm) Fix some compile errors spotted by dtucker and his fabulous 
-   tinderbox
-
-20030224
- - (djm) Tweak gnome-ssh-askpass2:
-   - Retry kb and mouse grab a couple of times, so passphrase dialog doesn't 
-     immediately fail if you are doing something else when it appears (e.g. 
-     dragging a window)
-   - Perform server grab after we have the keyboard and/or pointer to avoid 
-     races.
- - (djm) OpenBSD CVS Sync
-   - markus@cvs.openbsd.org 2003/01/27 17:06:31
-     [sshd.c]
-     more specific error message when /var/empty has wrong permissions;
-     bug #46, map@appgate.com; ok henning@, provos@, stevesk@
-   - markus@cvs.openbsd.org 2003/01/28 16:11:52
-     [scp.1]
-     document -l; pekkas@netcore.fi
-   - stevesk@cvs.openbsd.org 2003/01/28 17:24:51
-     [scp.1]
-     remove example not pertinent with -1 addition; ok markus@
-   - jmc@cvs.openbsd.org 2003/01/31 21:54:40
-     [sshd.8]
-     typos; sshd(8): help and ok markus@
-     help and ok millert@
-   - markus@cvs.openbsd.org 2003/02/02 10:51:13
-     [scp.c]
-     call okname() only when using system(3) for remote-remote copy;
-     fixes bugs #483, #472; ok deraadt@, mouring@
-   - markus@cvs.openbsd.org 2003/02/02 10:56:08
-     [kex.c]
-     add support for key exchange guesses; based on work by
-     avraham.fraenkel@commatch.com; fixes bug #148; ok deraadt@
-   - markus@cvs.openbsd.org 2003/02/03 08:56:16
-     [sshpty.c]
-     don't call error() for readonly /dev; from soekris list; ok mcbride,
-     henning, deraadt.
-   - markus@cvs.openbsd.org 2003/02/04 09:32:08
-     [key.c]
-     better debug3 message
-   - markus@cvs.openbsd.org 2003/02/04 09:33:22
-     [monitor.c monitor_wrap.c]
-     skey/bsdauth: use 0 to indicate failure instead of -1, because
-     the buffer API only supports unsigned ints.
-   - markus@cvs.openbsd.org 2003/02/05 09:02:28
-     [readconf.c]
-     simplify ProxyCommand parsing, remove strcat/xrealloc; ok henning@, djm@
-   - markus@cvs.openbsd.org 2003/02/06 09:26:23
-     [session.c]
-     missing call to setproctitle() after authentication; ok provos@
-   - markus@cvs.openbsd.org 2003/02/06 09:27:29
-     [ssh.c ssh_config.5]
-     support 'ProxyCommand none'; bugzilla #433; binder@arago.de; ok djm@
-   - markus@cvs.openbsd.org 2003/02/06 09:29:18
-     [sftp-server.c]
-     fix races in rename/symlink; from Tony Finch; ok djm@
-   - markus@cvs.openbsd.org 2003/02/06 21:22:43
-     [auth1.c auth2.c]
-     undo broken fix for #387, fixes #486
-   - markus@cvs.openbsd.org 2003/02/10 11:51:47
-     [ssh-add.1]
-     xref sshd_config.5 (not sshd.8); mark@summersault.com; bug #490
-   - markus@cvs.openbsd.org 2003/02/12 09:33:04
-     [key.c key.h ssh-dss.c ssh-rsa.c]
-     merge ssh-dss.h ssh-rsa.h into key.h; ok deraadt@
-   - markus@cvs.openbsd.org 2003/02/12 21:39:50
-     [crc32.c crc32.h]
-     replace crc32.c with a BSD licensed version; noted by David Turner
-   - markus@cvs.openbsd.org 2003/02/16 17:09:57
-     [kex.c kexdh.c kexgex.c kex.h sshconnect2.c sshd.c ssh-keyscan.c]
-     split kex into client and server code, no need to link
-     server code into the client; ok provos@
-   - markus@cvs.openbsd.org 2003/02/16 17:30:33
-     [monitor.c monitor_wrap.c]
-     fix permitrootlogin forced-commands-only for privsep; bux #387; 
-     ok provos@
-   - markus@cvs.openbsd.org 2003/02/21 09:05:53
-     [servconf.c]
-     print sshd_config filename in debug2 mode.
-   - mpech@cvs.openbsd.org 2003/02/21 10:34:48
-     [auth-krb4.c]
-     ...sizeof(&adat.session) is not good here.
-     henning@, deraadt@, millert@
- - (djm) Add new object files to Makefile and reorder
- - (djm) Bug #501: gai_strerror should return char*; 
-   fix from dtucker@zip.com.au
- - (djm) Most of Bug #499: Cygwin compile fixes for new progressmeter;
-   From vinschen@redhat.com
- - (djm) Rest of Bug #499: Import a basename() function from OpenBSD libc
- - (djm) Bug #494: Allow multiple accounts on Windows 9x/Me; 
-   From vinschen@redhat.com
- - (djm) Bug #456: Support for NEC SX6 with Unicos; from wendyp@cray.com
-
-20030211
- - (djm) Cygwin needs libcrypt too. Patch from vinschen@redhat.com
-
-20030206
- - (djm) Teach fake-getaddrinfo to use getservbyname() when provided a 
-   string service name. Suggested by markus@, review by itojun@
-
-20030131
- - (bal) AIX 4.2.1 lacks nanosleep().  Patch to use nsleep() provided by
-   dtucker@zip.com.au
-
-20030130
- - (djm) Unbreak root password auth. Spotted by dtucker@zip.com.au
-
-200301028
- - (djm) Search libposix4 and librt for nanosleep. From dtucker@zip.com.au 
-   and openssh-unix-dev@thewrittenword.com 
-
-200301027
- - (bal) Bugzilla 477 patch by wendyp@cray.com.  Define TIOCGPGRP for
-   cray.  Also removed test for tcgetpgrp in configure.ac since it
-   is no longer used.
-
-20030124
- - (djm) OpenBSD CVS Sync
-   - jmc@cvs.openbsd.org 2003/01/23 08:58:47
-     [sshd_config.5]
-     typos; ok millert@
-   - markus@cvs.openbsd.org 2003/01/23 13:50:27
-     [authfd.c authfd.h readpass.c ssh-add.1 ssh-add.c ssh-agent.c]
-     ssh-add -c, prompt user for confirmation (using ssh-askpass) when
-     private agent key is used; with djm@; test by dugsong@, djm@; 
-     ok deraadt@
-   - markus@cvs.openbsd.org 2003/01/23 14:01:53
-     [scp.c]
-     bandwidth limitation patch (scp -l) from niels@; ok todd@, deraadt@
-   - markus@cvs.openbsd.org 2003/01/23 14:06:15
-     [scp.1 scp.c]
-     scp -12; Sam Smith and others; ok provos@, deraadt@
- - (djm) Add TIMEVAL_TO_TIMESPEC macros
-
-20030123
- - (djm) OpenBSD CVS Sync
-   - djm@cvs.openbsd.org 2003/01/23 00:03:00
-     [auth1.c]
-     Don't log TIS auth response; "get rid of it" - markus@
-
-20030122
- - (djm) OpenBSD CVS Sync
-   - marc@cvs.openbsd.org 2003/01/21 18:14:36
-     [ssh-agent.1 ssh-agent.c]
-     Add a -t life option to ssh-agent that set the default lifetime.
-     The default can still be overriden by using -t in ssh-add.
-     OK markus@
- - (djm) Reorganise PAM & SIA password handling to eliminate some common code
- - (djm) Sync regress with OpenBSD -current
-
-20030120
- - (djm) Fix compilation for NetBSD from dtucker@zip.com.au
- - (tim) [progressmeter.c] make compilers without long long happy.
- - (tim) [configure.ac] Add -belf to build ELF binaries on OpenServer 5 when
-   using cc. (gcc already did)
-
-20030118
- - (djm) Revert fix for Bug #442 for now.
-
-20030117
- - (djm) Bug #470: Detect strnvis, not strvis in configure.
-    From d_wllms@lanl.gov
-
-20030116
- - (djm) OpenBSD CVS Sync
-   - djm@cvs.openbsd.org 2003/01/16 03:41:55
-     [sftp-int.c]
-     explicitly use first glob result
-
-20030114
- - (djm) OpenBSD CVS Sync
-   - fgsch@cvs.openbsd.org 2003/01/10 23:23:24
-     [sftp-int.c]
-     typo; from Nils Nordman <nino at nforced dot com>.
-   - markus@cvs.openbsd.org 2003/01/11 18:29:43
-     [log.c]
-     set fatal_cleanups to NULL in fatal_remove_all_cleanups(); 
-     dtucker@zip.com.au
-   - markus@cvs.openbsd.org 2003/01/12 16:57:02
-     [progressmeter.c]
-     allow WARNINGS=yes; ok djm@
-   - djm@cvs.openbsd.org 2003/01/13 11:04:04
-     [sftp-int.c]
-     make cmds[] array static to avoid conflict with BSDI libc.
-     mindrot bug #466. Fix from mdev@idg.nl; ok markus@
-   - djm@cvs.openbsd.org 2003/01/14 10:58:00
-     [sftp-client.c sftp-int.c]
-     Don't try to upload or download non-regular files. Report from
-     apoloval@pantuflo.escet.urjc.es; ok markus@
-
-20030113
- - (djm) Rework openbsd-compat/setproctitle.c a bit: move emulation type
-   detection to configure.ac. Prompted by stevesk@
- - (djm) Bug #467: Add a --disable-strip option to turn off stripping of 
-   installed binaries. From mdev@idg.nl
-
-20030110
- - (djm) Enable new setproctitle emulation for Linux, AIX and HP/UX. More 
-   systems may be added later.
- - (djm) OpenBSD CVS Sync
-   - djm@cvs.openbsd.org 2003/01/08 23:53:26
-     [sftp.1 sftp.c sftp-int.c sftp-int.h]
-     Cleanup error handling for batchmode
-     Allow blank lines and comments in input
-     Ability to suppress abort on error in batchmode ("-put blah")
-     Fixes mindrot bug #452; markus@ ok
-   - fgsch@cvs.openbsd.org 2003/01/10 08:19:07
-     [scp.c sftp.1 sftp.c sftp-client.c sftp-int.c  progressmeter.c]
-     [progressmeter.h]
-     sftp progress meter support.
-     original diffs by Nils Nordman <nino at nforced dot com> via 
-     markus@, merged to -current by me, djm@ ok.
-   - djm@cvs.openbsd.org 2003/01/10 08:48:15
-     [sftp-client.c]
-     Simplify and avoid redundancy in packet send and receive 
-     functions; ok fgs@
-   - djm@cvs.openbsd.org 2003/01/10 10:29:35
-     [scp.c]
-     Don't ftruncate after write error, creating sparse files of 
-     incorrect length
-     mindrot bug #403, reported by rusr@cup.hp.com; ok markus@
-   - djm@cvs.openbsd.org 2003/01/10 10:32:54
-     [channels.c]
-     hush socket() errors, except last. Fixes mindrot bug #408; ok markus@
-
-20030108
- - (djm) Sync openbsd-compat/ with OpenBSD -current
- - (djm) Avoid redundant xstrdup/xfree in auth2-pam.c. From Solar via markus@
- - (djm) OpenBSD CVS Sync
-   - markus@cvs.openbsd.org 2003/01/01 18:08:52
-     [channels.c]
-     move big output buffer messages to debug2
-   - djm@cvs.openbsd.org 2003/01/06 23:51:22
-     [sftp-client.c]
-     Fix "get -p" download to not add user-write perm. mindrot bug #426
-     reported by gfernandez@livevault.com; ok markus@
-   - fgsch@cvs.openbsd.org 2003/01/07 23:42:54
-     [sftp.1]
-     add version; from Nils Nordman <nino at nforced dot com> via markus@.
-     markus@ ok
- - (djm) Update README to reflect AIX's status as a well supported platform.
-   From dtucker@zip.com.au
- - (tim) [Makefile.in configure.ac] replace fixpath with sed script. Patch
-   by Mo DeJong.
- - (tim) [auth.c] declare today at top of allowed_user() to keep
-   older compilers happy.
- - (tim) [scp.c] make compilers without long long happy.
-
-20030107
- - (djm) Bug #401: Work around Linux breakage with IPv6 mapped addresses. 
-   Based on fix from yoshfuji@linux-ipv6.org
- - (djm) Bug #442: Check for and deny access to accounts with locked 
-   passwords. Patch from dtucker@zip.com.au
- - (djm) Bug #44: Use local mkstemp() rather than glibc's silly one. Fixes
-   Can't pass KRB4 TGT passing. Fix from: jan.iven@cern.ch
- - (djm) Fix Bug #442 for PAM case
- - (djm) Bug #110: bogus error messages in lastlog_get_entry(). Fix based
-   on one by peak@argo.troja.mff.cuni.cz
- - (djm) Bug #111: Run syslog and stderr logging through strnvis to eliminate
-   nasties. Report from peak@argo.troja.mff.cuni.cz
- - (djm) Bug #178: On AIX /etc/nologin wasnt't shown to users. Fix from 
-   Ralf.Wenk@fh-karlsruhe.de and dtucker@zip.com.au
- - (djm) Fix my fix of the fix for the Bug #442 for PAM case. Spotted by 
-   dtucker@zip.com.au. Reorder for clarity too.
-
-20030103
- - (djm) Bug #461: ssh-copy-id fails with no arguments. Patch from 
-   cjwatson@debian.org
- - (djm) Bug #460: Filling utmp[x]->ut_addr_v6 if present. Patch from 
-   cjwatson@debian.org
- - (djm) Bug #446: Set LOGIN env var to pw_name on AIX. Patch from 
-   mii@ornl.gov 
-
-20030101
-  - (stevesk) [session.c sshlogin.c sshlogin.h] complete portable
-    parts of pass addrlen with sockaddr * fix.
-    from Hajimu UMEMOTO <ume@FreeBSD.org>
-
-20021222
- - (bal) OpenBSD CVS Sync
-   - fgsch@cvs.openbsd.org 2002/11/15 10:03:09
-     [authfile.c]
-     lseek(2) may return -1 when getting the public/private key lenght.
-     Simplify the code and check for errors using fstat(2).
-
-     Problem reported by Mauricio Sanchez, markus@ ok.
-   - markus@cvs.openbsd.org 2002/11/18 16:43:44
-     [clientloop.c]
-     don't overwrite SIG{INT,QUIT,TERM} handler if set to SIG_IGN;
-     e.g. if ssh is used for backup; report Joerg Schilling; ok millert@
-   - markus@cvs.openbsd.org 2002/11/21 22:22:50
-     [dh.c]
-     debug->debug2
-   - markus@cvs.openbsd.org 2002/11/21 22:45:31
-     [cipher.c kex.c packet.c sshconnect.c sshconnect2.c]
-     debug->debug2, unify debug messages
-   - deraadt@cvs.openbsd.org 2002/11/21 23:03:51
-     [auth-krb5.c auth1.c hostfile.h monitor_wrap.c sftp-client.c sftp-int.c ssh-add.c ssh-rsa.c 
-      sshconnect.c]
-     KNF
-   - markus@cvs.openbsd.org 2002/11/21 23:04:33
-     [ssh.c]
-     debug->debug2
-   - stevesk@cvs.openbsd.org 2002/11/24 21:46:24
-     [ssh-keysign.8]
-     typo: "the the"
-   - wcobb@cvs.openbsd.org 2002/11/26 00:45:03
-     [scp.c ssh-keygen.c]
-     Remove unnecessary fflush(stderr) calls, stderr is unbuffered by default.
-     ok markus@
-   - stevesk@cvs.openbsd.org 2002/11/26 02:35:30
-     [ssh-keygen.1]
-     remove outdated statement; ok markus@ deraadt@
-   - stevesk@cvs.openbsd.org 2002/11/26 02:38:54
-     [canohost.c]
-     KNF, comment and error message repair; ok markus@
-   - markus@cvs.openbsd.org 2002/11/27 17:53:35
-     [scp.c sftp.c ssh.c]
-     allow usernames with embedded '@', e.g. scp user@vhost@realhost:file /tmp;
-     http://bugzilla.mindrot.org/show_bug.cgi?id=447; ok mouring@, millert@
-   - stevesk@cvs.openbsd.org 2002/12/04 04:36:47
-     [session.c]
-     remove xauth entries before add; PR 2994 from janjaap@stack.nl.
-     ok markus@
-   - markus@cvs.openbsd.org 2002/12/05 11:08:35
-     [scp.c]
-     use roundup() similar to rcp/util.c and avoid problems with strange
-     filesystem block sizes, noted by tjr@freebsd.org; ok djm@
-   - djm@cvs.openbsd.org 2002/12/06 05:20:02
-     [sftp.1]
-     Fix cut'n'paste error, spotted by matthias.riese@b-novative.de; ok deraadt@
-   - millert@cvs.openbsd.org 2002/12/09 16:50:30
-     [ssh.c]
-     Avoid setting optind to 0 as GNU getopt treats that like we do optreset.
-     markus@ OK
-   - markus@cvs.openbsd.org 2002/12/10 08:56:00
-     [session.c]
-     Make sure $SHELL points to the shell from the password file, even if shell
-     is overridden from login.conf; bug#453; semen at online.sinor.ru; ok millert@
-   - markus@cvs.openbsd.org 2002/12/10 19:26:50
-     [packet.c]
-     move tos handling to packet_set_tos; ok provos/henning/deraadt
-   - markus@cvs.openbsd.org 2002/12/10 19:47:14
-     [packet.c]
-     static
-   - markus@cvs.openbsd.org 2002/12/13 10:03:15
-     [channels.c misc.c sshconnect2.c]
-     cleanup debug messages, more useful information for the client user.
-   - markus@cvs.openbsd.org 2002/12/13 15:20:52
-     [scp.c]
-     1) include stalling time in total time
-     2) truncate filenames to 45 instead of 20 characters
-     3) print rate instead of progress bar, no more stars
-     4) scale output to tty width
-     based on a patch from Niels; ok fries@ lebel@ fgs@ millert@
- - (bal) [msg.c msg.h scp.c ssh-keysign.c sshconnect2.c]  Resync CVS IDs since 
-   we already did s/msg_send/ssh_msg_send/
-
-20021205
- - (djm) PERL-free fixpaths from stuge-openssh-unix-dev@cdy.org
-
-20021122
- - (tim) [configure.ac] fix STDPATH test for IRIX. First reported by
-   advax@triumf.ca. This type of solution tested by <herb@sgi.com>
-
-20021113
- - (tim) [configure.ac] remove unused variables no_libsocket and no_libnsl
-
-20021111
- - (tim) [contrib/solaris/opensshd.in] add umask 022 so sshd.pid is
-   not world writable.
-
-20021109
- - (bal) OpenBSD CVS Sync
-   - itojun@cvs.openbsd.org 2002/10/16 14:31:48
-     [sftp-common.c]
-     64bit pedant.  %llu is "unsigned long long".  markus ok
-   - markus@cvs.openbsd.org 2002/10/23 10:32:13
-     [packet.c]
-     use %u for u_int
-   - markus@cvs.openbsd.org 2002/10/23 10:40:16
-     [bufaux.c]
-     %u for u_int
-   - markus@cvs.openbsd.org 2002/11/04 10:07:53
-     [auth.c]
-     don't compare against pw_home if realpath fails for pw_home (seen 
-     on AFS); ok djm@
-   - markus@cvs.openbsd.org 2002/11/04 10:09:51
-     [packet.c]
-     log before send disconnect; ok djm@
-   - markus@cvs.openbsd.org 2002/11/05 19:45:20
-     [monitor.c]
-     handle overflows for size_t larger than u_int; siw@goneko.de, bug #425
-   - markus@cvs.openbsd.org 2002/11/05 20:10:37
-     [sftp-client.c]
-     typo; GaryF@livevault.com
-   - markus@cvs.openbsd.org 2002/11/07 16:28:47
-     [sshd.c]
-     log to stderr if -ie is given, bug #414, prj@po.cwru.edu
-   - markus@cvs.openbsd.org 2002/11/07 22:08:07
-     [readconf.c readconf.h ssh-keysign.8 ssh-keysign.c]
-     we cannot use HostbasedAuthentication for enabling ssh-keysign(8),
-     because HostbasedAuthentication might be enabled based on the
-     target host and ssh-keysign(8) does not know the remote hostname
-     and not trust ssh(1) about the hostname, so we add a new option
-     EnableSSHKeysign; ok djm@, report from zierke@informatik.uni-hamburg.de
-   - markus@cvs.openbsd.org 2002/11/07 22:35:38
-     [scp.c]
-     check exit status from ssh, and exit(1) if ssh fails; bug#369; 
-     binder@arago.de
- - (bal) Update ssh-host-config and minor rewrite of bsd-cygwin_util.c
-   ntsec now default if cygwin version beginning w/ version 56.  Patch
-   by Corinna Vinschen <vinschen@redhat.com> 
- - (bal) AIX does not log login attempts for unknown users (bug #432).
-   patch by dtucker@zip.com.au
-
-20021021
- - (djm) Bug #400: Kill ssh-rand-helper children on timeout, patch from 
-   dtucker@zip.com.au
- - (djm) Bug #317: FreeBSD needs libutil.h for openpty() Report from 
-   dirk.meyer@dinoex.sub.org
-
-20021015
- - (bal) Fix bug id 383 and only call loginrestrict for AIX if not root.
- - (bal) More advanced strsep test by Darren Tucker <dtucker@zip.com.au>
-
-20021015
- - (tim) [contrib/caldera/openssh.spec] make ssh-agent setgid nobody
-
-20021004
- - (bal) Disable post-authentication Privsep for OSF/1.  It conflicts with
-   SIA.
-
-20021003
- - (djm) OpenBSD CVS Sync
-   - markus@cvs.openbsd.org 2002/10/01 20:34:12
-     [ssh-agent.c]
-     allow root to access the agent, since there is no protection from root.
-   - markus@cvs.openbsd.org 2002/10/01 13:24:50
-     [version.h]
-     OpenSSH 3.5
- - (djm) Bump RPM spec version numbers
- - (djm) Bug #406: s/msg_send/ssh_msg_send/ for Mac OS X 1.2
-
-20020930
- - (djm) Tidy contrib/, add Makefile for GNOME passphrase dialogs, 
-   tweak README
- - (djm) OpenBSD CVS Sync
-   - mickey@cvs.openbsd.org 2002/09/27 10:42:09
-     [compat.c compat.h sshd.c]
-     add a generic match for a prober, such as sie big brother; 
-     idea from stevesk@; markus@ ok
-   - stevesk@cvs.openbsd.org 2002/09/27 15:46:21
-     [ssh.1]
-     clarify compression level protocol 1 only; ok markus@ deraadt@
-
-20020927
- - (djm) OpenBSD CVS Sync
-   - markus@cvs.openbsd.org 2002/09/25 11:17:16
-     [sshd_config]
-     sync LoginGraceTime with default
-   - markus@cvs.openbsd.org 2002/09/25 15:19:02
-     [sshd.c]
-     typo; pilot@monkey.org
-   - markus@cvs.openbsd.org 2002/09/26 11:38:43
-     [auth1.c auth.h auth-krb4.c monitor.c monitor.h monitor_wrap.c]
-     [monitor_wrap.h]
-     krb4 + privsep; ok dugsong@, deraadt@
-
-20020925
- - (bal) Fix issue where successfull login does not clear failure counts
-   in AIX.  Patch by dtucker@zip.com.au ok by djm
- - (tim) Cray fixes (bug 367) based on patch from Wendy Palm @ cray.
-    This does not include the deattack.c fixes.
-
-20020923
- - (djm) OpenBSD CVS Sync
-   - stevesk@cvs.openbsd.org 2002/09/23 20:46:27
-     [canohost.c]
-     change get_peer_ipaddr() and get_local_ipaddr() to not return NULL for
-     non-sockets; fixes a problem passing NULL to snprintf(). ok markus@
-   - markus@cvs.openbsd.org 2002/09/23 22:11:05
-     [monitor.c]
-     only call auth_krb5 if kerberos is enabled; ok deraadt@
-   - markus@cvs.openbsd.org 2002/09/24 08:46:04
-     [monitor.c]
-     only call kerberos code for authctxt->valid
-   - todd@cvs.openbsd.org 2002/09/24 20:59:44
-     [sshd.8]
-     tweak the example $HOME/.ssh/rc script to not show on any cmdline the
-     sensitive data it handles. This fixes bug # 402 as reported by
-     kolya@mit.edu (Nickolai Zeldovich).
-     ok markus@ and stevesk@
-
-20020923
- - (tim) [configure.ac] s/return/exit/ patch by dtucker@zip.com.au
-
-20020922
- - (djm) OpenBSD CVS Sync
-   - stevesk@cvs.openbsd.org 2002/09/19 14:53:14
-     [compat.c]
-   - markus@cvs.openbsd.org 2002/09/19 15:51:23
-     [ssh-add.c]
-     typo; cd@kalkatraz.de
-   - stevesk@cvs.openbsd.org 2002/09/19 16:03:15
-     [serverloop.c]
-     log IP address also; ok markus@
-   - stevesk@cvs.openbsd.org 2002/09/20 18:41:29
-     [auth.c]
-     log illegal user here for missing privsep case (ssh2).
-     this is executed in the monitor. ok markus@
-
-20020919
- - (djm) OpenBSD CVS Sync
-   - stevesk@cvs.openbsd.org 2002/09/12 19:11:52
-     [ssh-agent.c]
-     %u for uid print; ok markus@
-   - stevesk@cvs.openbsd.org 2002/09/12 19:50:36
-     [session.c ssh.1]
-     add SSH_CONNECTION and deprecate SSH_CLIENT; bug #384.  ok markus@
-   - stevesk@cvs.openbsd.org 2002/09/13 19:23:09
-     [channels.c sshconnect.c sshd.c]
-     remove use of SO_LINGER, it should not be needed. error check
-     SO_REUSEADDR. fixup comments. ok markus@
-   - stevesk@cvs.openbsd.org 2002/09/16 19:55:33
-     [session.c]
-     log when _PATH_NOLOGIN exists; ok markus@
-   - stevesk@cvs.openbsd.org 2002/09/16 20:12:11
-     [sshd_config.5]
-     more details on X11Forwarding security issues and threats; ok markus@
-   - stevesk@cvs.openbsd.org 2002/09/16 22:03:13
-     [sshd.8]
-     reference moduli(5) in FILES /etc/moduli.
-   - itojun@cvs.openbsd.org 2002/09/17 07:47:02
-     [channels.c]
-     don't quit while creating X11 listening socket.
-     http://mail-index.netbsd.org/current-users/2002/09/16/0005.html
-     got from portable.  markus ok
-   - djm@cvs.openbsd.org 2002/09/19 01:58:18
-     [ssh.c sshconnect.c]
-     bugzilla.mindrot.org #223 - ProxyCommands don't exit.
-     Patch from dtucker@zip.com.au; ok markus@
-
-20020912
- - (djm) Made GNOME askpass programs return non-zero if cancel button is 
-   pressed.
- - (djm) Added getpeereid() replacement. Properly implemented for systems
-   with SO_PEERCRED support. Faked for systems which lack it.
- - (djm) Sync sys/tree.h with OpenBSD -current. Rename tree.h and 
-   fake-queue.h to sys-tree.h and sys-queue.h
- - (djm) OpenBSD CVS Sync
-   - markus@cvs.openbsd.org 2002/09/08 20:24:08
-     [hostfile.h]
-     no comma at end of enumerator list
-   - itojun@cvs.openbsd.org 2002/09/09 06:48:06
-     [auth1.c auth.h auth-krb5.c monitor.c monitor.h]
-     [monitor_wrap.c monitor_wrap.h]
-     kerberos support for privsep.  confirmed to work by lha@stacken.kth.se
-     patch from markus
-   - markus@cvs.openbsd.org 2002/09/09 14:54:15
-     [channels.c kex.h key.c monitor.c monitor_wrap.c radix.c uuencode.c]
-     signed vs unsigned from -pedantic; ok henning@
-   - markus@cvs.openbsd.org 2002/09/10 20:24:47
-     [ssh-agent.c]
-     check the euid of the connecting process with getpeereid(2); 
-     ok provos deraadt stevesk
-   - stevesk@cvs.openbsd.org 2002/09/11 17:55:03
-     [ssh.1]
-     add agent and X11 forwarding warning text from ssh_config.5; ok markus@
-   - stevesk@cvs.openbsd.org 2002/09/11 18:27:26
-     [authfd.c authfd.h ssh.c]
-     don't connect to agent to test for presence if we've previously
-     connected; ok markus@
-   - djm@cvs.openbsd.org 2002/09/11 22:41:50
-     [sftp.1 sftp-client.c sftp-client.h sftp-common.c sftp-common.h]
-     [sftp-glob.c sftp-glob.h sftp-int.c sftp-server.c]
-     support for short/long listings and globbing in "ls"; ok markus@
-   - djm@cvs.openbsd.org 2002/09/12 00:13:06
-     [sftp-int.c]
-     zap unused var introduced in last commit
-
-20020911
- - (djm) Sync openbsd-compat with OpenBSD -current
-
-20020910
- - (djm) Bug #365: Read /.ssh/environment properly under CygWin. 
-   Patch from Mark Bradshaw <bradshaw@staff.crosswalk.com>
- - (djm) Bug #138: Make protocol 1 blowfish work with old OpenSSL. 
-   Patch from Robert Halubek <rob@adso.com.pl>
-
-20020905 
- - (djm) OpenBSD CVS Sync
-   - stevesk@cvs.openbsd.org 2002/09/04 18:52:42
-     [servconf.c sshd.8 sshd_config.5]
-     default LoginGraceTime to 2m; 1m may be too short for slow systems.
-     ok markus@
- - (djm) Merge openssh-TODO.patch from Redhat (null) beta
- - (djm) Add gnome-ssh-askpass2.c (gtk2) by merge with patch from 
-    Nalin Dahyabhai <nalin@redhat.com>
- - (djm) Add support for building gtk2 password requestor from Redhat beta
-
-20020903
- - (djm) Patch from itojun@ for Darwin OS: test getaddrinfo, reorder libcrypt
- - (djm) Fix Redhat RPM build dependancy test
- - (djm) OpenBSD CVS Sync
-   - markus@cvs.openbsd.org 2002/08/12 10:46:35
-     [ssh-agent.c]
-     make ssh-agent setgid, disallow ptrace.
-   - espie@cvs.openbsd.org 2002/08/21 11:20:59
-     [sshd.8]
-     `RSA' updated to refer to `public key', where it matters.
-     okay markus@
-   - stevesk@cvs.openbsd.org 2002/08/21 19:38:06
-     [servconf.c sshd.8 sshd_config sshd_config.5]
-     change LoginGraceTime default to 1 minute; ok mouring@ markus@
-   - stevesk@cvs.openbsd.org 2002/08/21 20:10:28
-     [ssh-agent.c]
-     raise listen backlog; ok markus@
-   - stevesk@cvs.openbsd.org 2002/08/22 19:27:53
-     [ssh-agent.c]
-     use common close function; ok markus@
-   - stevesk@cvs.openbsd.org 2002/08/22 19:38:42
-     [clientloop.c]
-     format with current EscapeChar; bugzilla #388 from wknox@mitre.org.
-     ok markus@
-   - stevesk@cvs.openbsd.org 2002/08/22 20:57:19
-     [ssh-agent.c]
-     shutdown(SHUT_RDWR) not needed before close here; ok markus@
-   - markus@cvs.openbsd.org 2002/08/22 21:33:58
-     [auth1.c auth2.c]
-     auth_root_allowed() is handled by the monitor in the privsep case,
-     so skip this for use_privsep, ok stevesk@, fixes bugzilla #387/325
-   - markus@cvs.openbsd.org 2002/08/22 21:45:41
-     [session.c]
-     send signal name (not signal number) in "exit-signal" message; noticed
-     by galb@vandyke.com
-   - stevesk@cvs.openbsd.org 2002/08/27 17:13:56
-     [ssh-rsa.c]
-     RSA_public_decrypt() returns -1 on error so len must be signed; 
-     ok markus@
-   - stevesk@cvs.openbsd.org 2002/08/27 17:18:40
-     [ssh_config.5]
-     some warning text for ForwardAgent and ForwardX11; ok markus@
-   - stevesk@cvs.openbsd.org 2002/08/29 15:57:25
-     [monitor.c session.c sshlogin.c sshlogin.h]
-     pass addrlen with sockaddr *; from Hajimu UMEMOTO <ume@FreeBSD.org>
-     NOTE: there are also p-specific parts to this patch. ok markus@
-   - stevesk@cvs.openbsd.org 2002/08/29 16:02:54
-     [ssh.1 ssh.c]
-     deprecate -P as UsePrivilegedPort defaults to no now; ok markus@
-   - stevesk@cvs.openbsd.org 2002/08/29 16:09:02
-     [ssh_config.5]
-     more on UsePrivilegedPort and setuid root; ok markus@
-   - stevesk@cvs.openbsd.org 2002/08/29 19:49:42
-     [ssh.c]
-     shrink initial privilege bracket for setuid case; ok markus@
-   - stevesk@cvs.openbsd.org 2002/08/29 22:54:10
-     [ssh_config.5 sshd_config.5]
-     state XAuthLocation is a full pathname
-
-20020820
- - OpenBSD CVS Sync
-   - millert@cvs.openbsd.org 2002/08/02 14:43:15
-     [monitor.c monitor_mm.c]
-     Change mm_zalloc() sanity checks to be more in line with what
-     we do in calloc() and add a check to monitor_mm.c.
-     OK provos@ and markus@
-   - marc@cvs.openbsd.org 2002/08/02 16:00:07
-     [ssh.1 sshd.8]
-     note that .ssh/environment is only read when
-     allowed (PermitUserEnvironment in sshd_config).
-     OK markus@
-   - markus@cvs.openbsd.org 2002/08/02 21:23:41
-     [ssh-rsa.c]
-     diff is u_int (2x); ok deraadt/provos
-   - markus@cvs.openbsd.org 2002/08/02 22:20:30
-     [ssh-rsa.c]
-     replace RSA_verify with our own version and avoid the OpenSSL ASN.1 parser
-     for authentication; ok deraadt/djm
-   - aaron@cvs.openbsd.org 2002/08/08 13:50:23
-     [sshconnect1.c]
-     Use & to test if bits are set, not &&; markus@ ok.
-   - stevesk@cvs.openbsd.org 2002/08/08 23:54:52
-     [auth.c]
-     typo in comment
-   - stevesk@cvs.openbsd.org 2002/08/09 17:21:42
-     [sshd_config.5]
-     use Op for mdoc conformance; from esr@golux.thyrsus.com
-     ok aaron@
-   - stevesk@cvs.openbsd.org 2002/08/09 17:41:12
-     [sshd_config.5]
-     proxy vs. fake display
-   - stevesk@cvs.openbsd.org 2002/08/12 17:30:35
-     [ssh.1 sshd.8 sshd_config.5]
-     more PermitUserEnvironment; ok markus@
-   - stevesk@cvs.openbsd.org 2002/08/17 23:07:14
-     [ssh.1]
-     ForwardAgent has defaulted to no for over 2 years; be more clear here.
-   - stevesk@cvs.openbsd.org 2002/08/17 23:55:01
-     [ssh_config.5]
-     ordered list here
- - (bal) [defines.h] Some platforms don't have SIZE_T_MAX.  So assign 
-   it to ULONG_MAX.
-
-20020813
- - (tim) [configure.ac] Display OpenSSL header/library version.
-   Patch by dtucker@zip.com.au
-
-20020731
- - (bal) OpenBSD CVS Sync
-   - markus@cvs.openbsd.org 2002/07/24 16:11:18
-     [hostfile.c hostfile.h sshconnect.c]
-     print out all known keys for a host if we get a unknown host key,
-     see discussion at http://marc.theaimsgroup.com/?t=101069210100016&r=1&w=4
-
-     the ssharp mitm tool attacks users in a similar way, so i'd like to
-     pointed out again:
-        A MITM attack is always possible if the ssh client prints:
-        The authenticity of host 'bla' can't be established.
-     (protocol version 2 with pubkey authentication allows you to detect
-     MITM attacks)
-   - mouring@cvs.openbsd.org 2002/07/25 01:16:59
-     [sftp.c]
-     FallBackToRsh does not exist anywhere else.  Remove it from here.
-     OK deraadt.
-   - markus@cvs.openbsd.org 2002/07/29 18:57:30
-     [sshconnect.c]
-     print file:line
-   - markus@cvs.openbsd.org 2002/07/30 17:03:55
-     [auth-options.c servconf.c servconf.h session.c sshd_config sshd_config.5]
-     add PermitUserEnvironment (off by default!); from dot@dotat.at;
-     ok provos, deraadt
-
-20020730
- - (bal) [uidswap.c] SCO compile correction by gert@greenie.muc.de
-
-20020728
- - (stevesk) [auth-pam.c] should use PAM_MSG_MEMBER(); from solar
- - (stevesk) [CREDITS] solar
- - (stevesk) [ssh-rand-helper.c] RAND_bytes() and SHA1_Final() unsigned
-   char arg.
-
-20020725
- - (djm) Remove some cruft from INSTALL
- - (djm) Latest config.guess and config.sub from ftp://ftp.gnu.org/gnu/config/
-
-20020723
- - (bal) [bsd-cray.c bsd-cray.h] Part 2 of Cray merger. 
- - (bal) sync ID w/ ssh-agent.c
- - (bal) OpenBSD Sync
-   - markus@cvs.openbsd.org 2002/07/19 15:43:33
-     [log.c log.h session.c sshd.c]
-     remove fatal cleanups after fork; based on discussions with and code
-     from solar.
-   - stevesk@cvs.openbsd.org 2002/07/19 17:42:40
-     [ssh.c]
-     display a warning from ssh when XAuthLocation does not exist or xauth
-     returned no authentication data. ok markus@
-   - stevesk@cvs.openbsd.org 2002/07/21 18:32:20
-     [auth-options.c]
-     unneeded includes
-   - stevesk@cvs.openbsd.org 2002/07/21 18:34:43
-     [auth-options.h]
-     remove invalid comment
-   - markus@cvs.openbsd.org 2002/07/22 11:03:06
-     [session.c]
-     fallback to _PATH_STDPATH on setusercontext+LOGIN_SETPATH errors;
-   - stevesk@cvs.openbsd.org 2002/07/22 17:32:56
-     [monitor.c]
-     u_int here; ok provos@
-   - stevesk@cvs.openbsd.org 2002/07/23 16:03:10
-     [sshd.c]
-     utmp_len is unsigned; display error consistent with other options.
-     ok markus@
-   - stevesk@cvs.openbsd.org 2002/07/15 17:15:31
-     [uidswap.c]
-     little more debugging; ok markus@
-
-20020722
- - (bal) AIX tty data limiting patch fix by leigh@solinno.co.uk
- - (stevesk) [xmmap.c] missing prototype for fatal()
- - (bal) [configure.ac defines.h loginrec.c sshd.c sshpty.c] Partial sync
-   with Cray (mostly #ifdef renaming).  Patch by wendyp@cray.com.
- - (bal) [configure.ac]  Missing ;; from cray patch.
- - (bal) [monitor_mm.c openbsd-compat/xmmap.h] Move xmmap() defines
-   into it's own header.
- - (stevesk) [auth-pam.[ch] session.c] pam_getenvlist() must be
-   freed by the caller; add free_pam_environment() and use it.
- - (stevesk) [auth-pam.c] typo in comment
-
-20020721
- - (stevesk) [auth-pam.c] merge cosmetic changes from solar's
-   openssh-3.4p1-owl-password-changing.diff
- - (stevesk) [auth-pam.c] merge rest of solar's PAM patch;
-   PAM_NEW_AUTHTOK_REQD remains in #if 0 for now.
- - (stevesk) [auth-pam.c] cast to avoid initialization type mismatch
-   warning on pam_conv struct conversation function.
- - (stevesk) [auth-pam.h] license
- - (stevesk) [auth-pam.h] unneeded include
- - (stevesk) [auth-pam.[ch] ssh.h] move SSHD_PAM_SERVICE to auth-pam.h
-
-20020720
- - (stevesk) [ssh-keygen.c] bug #231: always init/seed_rng().
-
-20020719
- - (tim) [contrib/solaris/buildpkg.sh] create privsep user/group if needed.
-   Patch by dtucker@zip.com.au
- - (tim) [configure.ac]  test for libxnet on HP. Patch by dtucker@zip.com.au
-
-20020718
- - (tim) [defines.h] Bug 313 patch by dirk.meyer@dinoex.sub.org
- - (tim) [monitor_mm.c] add missing declaration for xmmap(). Reported
-   by ayamura@ayamura.org
- - (tim) [configure.ac] Bug 267 rework int64_t test.
- - (tim) [includes.h] Bug 267 add stdint.h
-
-20020717
- - (bal) aixbff package updated by dtucker@zip.com.au
- - (tim) [configure.ac] change how we do paths in AC_PATH_PROGS tests
-   for autoconf 2.53. Based on a patch by jrj@purdue.edu
-
-20020716
- - (tim) [contrib/solaris/opensshd.in] Only kill sshd if .pid file found
-
-20020715
- - (bal) OpenBSD CVS Sync
-   - itojun@cvs.openbsd.org 2002/07/12 13:29:09
-     [sshconnect.c]
-     print connect failure during debugging mode.
-   - markus@cvs.openbsd.org 2002/07/12 15:50:17
-     [cipher.c]
-     EVP_CIPH_CUSTOM_IV for our own rijndael
- - (bal) Remove unused tty defined in do_setusercontext() pointed out by
-   dtucker@zip.com.au plus a a more KNF since I am near it.
- - (bal) Privsep user creation support in Solaris buildpkg.sh by 
-   dtucker@zip.com.au
-
-20020714
- - (tim) [Makefile.in] replace "id sshd" with "sshd -t"
- - (bal/tim) [acconfig.h configure.ac monitor_mm.c servconf.c
-   openbsd-compat/Makefile.in] support compression on platforms that
-   have no/broken MAP_ANON. Moved code to openbsd-compat/xmmap.c
-   Based on patch from nalin@redhat.com of code extracted from Owl's package
- - (tim) [ssh_prng_cmds.in] Bug 323 arp -n flag doesn't exist under Solaris.
-   report by chris@by-design.net
- - (tim) [loginrec.c] Bug 347: Fix typo (WTMPX_FILE) report by rodney@bond.net
- - (tim) [loginrec.c] Bug 348: add missing found = 1; to wtmpx_islogin()
-   report by rodney@bond.net
-
-20020712
- - (tim) [Makefile.in] quiet down install-files: and check-user:
- - (tim) [configure.ac] remove unused filepriv line
-
-20020710
- - (tim) [contrib/cygwin/ssh-host-config] explicitely sets the permissions
-   on /var/empty to 755 Patch by vinschen@redhat.com
- - (bal) OpenBSD CVS Sync
-   - itojun@cvs.openbsd.org 2002/07/09 11:56:50
-     [sshconnect.c]
-     silently try next address on connect(2).  markus ok
-   - itojun@cvs.openbsd.org 2002/07/09 11:56:27
-     [canohost.c]
-     suppress log on reverse lookup failiure, as there's no real value in
-     doing so.
-     markus ok
-   - itojun@cvs.openbsd.org 2002/07/09 12:04:02
-     [sshconnect.c]
-     ed static function (less warnings)
-   - stevesk@cvs.openbsd.org 2002/07/09 17:46:25
-     [sshd_config.5]
-     clarify no preference ordering in protocol list; ok markus@
-   - itojun@cvs.openbsd.org 2002/07/10 10:28:15
-     [sshconnect.c]
-     bark if all connection attempt fails.
-   - deraadt@cvs.openbsd.org 2002/07/10 17:53:54
-     [rijndael.c]
-     use right sizeof in memcpy; markus ok
-
-20020709
- - (bal) NO_IPPORT_RESERVED_CONCEPT used instead of CYGWIN so other platforms
-   lacking that concept can share it. Patch by vinschen@redhat.com
-
-20020708
- - (tim) [openssh/contrib/solaris/buildpkg.sh] add PKG_INSTALL_ROOT to
-   work in a jumpstart environment. patch by kbrint@rufus.net
- - (tim) [Makefile.in] workaround for broken pakadd on some systems.
- - (tim) [configure.ac] fix libc89 utimes test. Mention default path for
-   --with-privsep-path=
-
-20020707
- - (tim) [Makefile.in] use umask instead of chmod on $(PRIVSEP_PATH)
- - (tim) [acconfig.h configure.ac sshd.c]
-   s/BROKEN_FD_PASSING/DISABLE_FD_PASSING/
- - (tim) [contrib/cygwin/ssh-host-config] sshd account creation fixes
-   patch from vinschen@redhat.com
- - (bal) [realpath.c] Updated with OpenBSD tree.
- - (bal) OpenBSD CVS Sync
-   - deraadt@cvs.openbsd.org 2002/07/04 04:15:33
-     [key.c monitor_wrap.c sftp-glob.c ssh-dss.c ssh-rsa.c]
-     patch memory leaks; grendel@zeitbombe.org
-   - deraadt@cvs.openbsd.org 2002/07/04 08:12:15
-     [channels.c packet.c]
-     blah blah minor nothing as i read and re-read and re-read...
-   - markus@cvs.openbsd.org 2002/07/04 10:41:47
-     [key.c monitor_wrap.c ssh-dss.c ssh-rsa.c]
-     don't allocate, copy, and discard if there is not interested in the data; 
-     ok deraadt@
-   - deraadt@cvs.openbsd.org 2002/07/06 01:00:49
-     [log.c]
-     KNF
-   - deraadt@cvs.openbsd.org 2002/07/06 01:01:26
-     [ssh-keyscan.c]
-     KNF, realloc fix, and clean usage
-   - stevesk@cvs.openbsd.org 2002/07/06 17:47:58
-     [ssh-keyscan.c]
-     unused variable
- - (bal) Minor KNF on ssh-keyscan.c
-
-20020705
- - (tim) [configure.ac] AIX 4.2.1 has authenticate() in libs.
-   Reported by Darren Tucker <dtucker@zip.com.au>
- - (tim) [contrib/cygwin/ssh-host-config] double slash corrction
-   from vinschen@redhat.com
-
-20020704
- - (bal) Limit data to TTY for AIX only (Newer versions can't handle the
-   faster data rate)  Bug #124
- - (bal) glob.c defines TILDE and AIX also defines it.  #undef it first.
-   bug #265
- - (bal) One too many nulls in ports-aix.c
- 
-20020703
- - (bal) Updated contrib/cygwin/  patch by vinschen@redhat.com 
- - (bal) minor correction to utimes() replacement.  Patch by
-   onoe@sm.sony.co.jp
- - OpenBSD CVS Sync
-   - markus@cvs.openbsd.org 2002/06/27 08:49:44
-     [dh.c ssh-keyscan.c sshconnect.c]
-     more checks for NULL pointers; from grendel@zeitbombe.org; ok deraadt@
-   - deraadt@cvs.openbsd.org 2002/06/27 09:08:00
-     [monitor.c]
-     improve mm_zalloc check; markus ok
-   - deraadt@cvs.openbsd.org 2002/06/27 10:35:47
-     [auth2-none.c monitor.c sftp-client.c]
-     use xfree()
-   - stevesk@cvs.openbsd.org 2002/06/27 19:49:08
-     [ssh-keyscan.c]
-     use convtime(); ok markus@
-   - millert@cvs.openbsd.org 2002/06/28 01:49:31
-     [monitor_mm.c]
-     tree(3) wants an int return value for its compare functions and
-     the difference between two pointers is not an int.  Just do the
-     safest thing and store the result in a long and then return 0,
-     -1, or 1 based on that result.
-   - deraadt@cvs.openbsd.org 2002/06/28 01:50:37
-     [monitor_wrap.c]
-     use ssize_t
-   - deraadt@cvs.openbsd.org 2002/06/28 10:08:25
-     [sshd.c]
-     range check -u option at invocation
-   - deraadt@cvs.openbsd.org 2002/06/28 23:05:06
-     [sshd.c]
-     gidset[2] -> gidset[1]; markus ok
-   - deraadt@cvs.openbsd.org 2002/06/30 21:54:16
-     [auth2.c session.c sshd.c]
-     lint asks that we use names that do not overlap
-   - deraadt@cvs.openbsd.org 2002/06/30 21:59:45
-     [auth-bsdauth.c auth-skey.c auth2-chall.c clientloop.c key.c
-      monitor_wrap.c monitor_wrap.h scard.h session.h sftp-glob.c ssh.c
-      sshconnect2.c sshd.c]
-     minor KNF
-   - deraadt@cvs.openbsd.org 2002/07/01 16:15:25
-     [msg.c]
-     %u
-   - markus@cvs.openbsd.org 2002/07/01 19:48:46
-     [sshconnect2.c]
-     for compression=yes, we fallback to no-compression if the server does
-     not support compression, vice versa for compression=no. ok mouring@
-   - markus@cvs.openbsd.org 2002/07/03 09:55:38
-     [ssh-keysign.c]
-     use RSA_blinding_on() for rsa hostkeys (suggested by Bill Sommerfeld)
-     in order to avoid a possible Kocher timing attack pointed out by Charles
-     Hannum; ok provos@
-   - markus@cvs.openbsd.org 2002/07/03 14:21:05
-     [ssh-keysign.8 ssh-keysign.c ssh.c ssh_config]
-     re-enable ssh-keysign's sbit, but make ssh-keysign read 
-     /etc/ssh/ssh_config and exit if HostbasedAuthentication is disabled 
-     globally. based on discussions with deraadt, itojun and sommerfeld; 
-     ok itojun@
- - (bal) Failed password attempts don't increment counter on AIX. Bug #145
- - (bal) Missed Makefile.in change.  keysign needs readconf.o
- - (bal) Clean up aix_usrinfo().  Ignore TTY= period I guess.
-  
-20020702
- - (djm) Use PAM_MSG_MEMBER for PAM_TEXT_INFO messages, use xmalloc & 
-   friends consistently. Spotted by Solar Designer <solar@openwall.com>
-
-20020629
- - (bal) fix to auth2-pam.c to swap fatal() arguments,  A bit of style
-   clean up while I'm near it.
-
-20020628
- - (stevesk) [sshd_config] PAMAuthenticationViaKbdInt no; commented
-   options should contain default value.  from solar.
- - (bal) Cygwin uid0 fix by vinschen@redhat.com
- - (bal) s/config.h/includes.h/ in openbsd-compat/ for *.c.  Otherwise wise
-   have issues of our fixes not propogating right (ie bcopy instead of
-   memmove).  OK tim
- - (bal) FreeBSD needs <sys/types.h> to detect if mmap() is supported.
-   Bug #303
-
-20020627
- - OpenBSD CVS Sync
-   - deraadt@cvs.openbsd.org 2002/06/26 14:49:36
-     [monitor.c]
-     correct %u
-   - deraadt@cvs.openbsd.org 2002/06/26 14:50:04
-     [monitor_fdpass.c]
-     use ssize_t for recvmsg() and sendmsg() return
-   - markus@cvs.openbsd.org 2002/06/26 14:51:33
-     [ssh-add.c]
-     fix exit code for -X/-x
-   - deraadt@cvs.openbsd.org 2002/06/26 15:00:32
-     [monitor_wrap.c]
-     more %u
-   - markus@cvs.openbsd.org 2002/06/26 22:27:32
-     [ssh-keysign.c]
-     bug #304, xfree(data) called to early; openssh@sigint.cs.purdue.edu
-
-20020626
- - (stevesk) [monitor.c] remove duplicate proto15 dispatch entry for PAM
- - (bal) OpenBSD CVS Sync
-   - markus@cvs.openbsd.org 2002/06/23 21:34:07
-     [channels.c]
-     tcode is u_int
-   - markus@cvs.openbsd.org 2002/06/24 13:12:23
-     [ssh-agent.1]
-     the socket name contains ssh-agent's ppid; via mpech@ from form@
-   - markus@cvs.openbsd.org 2002/06/24 14:33:27
-     [channels.c channels.h clientloop.c serverloop.c]
-     move channel counter to u_int
-   - markus@cvs.openbsd.org 2002/06/24 14:55:38
-     [authfile.c kex.c ssh-agent.c]
-     cat to (void) when output from buffer_get_X is ignored
-   - itojun@cvs.openbsd.org 2002/06/24 15:49:22
-     [msg.c]
-     printf type pedant
-   - deraadt@cvs.openbsd.org 2002/06/24 17:57:20
-     [sftp-server.c sshpty.c]
-     explicit (u_int) for uid and gid
-   - markus@cvs.openbsd.org 2002/06/25 16:22:42
-     [authfd.c]
-     unnecessary cast
-   - markus@cvs.openbsd.org 2002/06/25 18:51:04
-     [sshd.c]
-     lightweight do_setusercontext after chroot()
- - (bal) Updated AIX package build.  Patch by dtucker@zip.com.au
- - (tim) [Makefile.in] fix test on installing ssh-rand-helper.8
- - (bal) added back in error check for mmap().  I screwed up, Pointed
-   out by stevesk@
- - (tim) [README.privsep] UnixWare tip no longer needed.
- - (bal) fixed NeXTStep missing munmap() issue. It defines HAVE_MMAP,
-   but it all damned lies.
- - (stevesk) [README.privsep] more for sshd pseudo-account.
- - (tim) [contrib/caldera/openssh.spec] add support for privsep
- - (djm) setlogin needs pgid==pid on BSD/OS; from itojun@
- - (djm) OpenBSD CVS Sync
-   - markus@cvs.openbsd.org 2002/06/26 08:53:12
-     [bufaux.c]
-     limit size of BNs to 8KB; ok provos/deraadt
-   - markus@cvs.openbsd.org 2002/06/26 08:54:18
-     [buffer.c]
-     limit append to 1MB and buffers to 10MB
-   - markus@cvs.openbsd.org 2002/06/26 08:55:02
-     [channels.c]
-     limit # of channels to 10000
-   - markus@cvs.openbsd.org 2002/06/26 08:58:26
-     [session.c]
-     limit # of env vars to 1000; ok deraadt/djm
-   - deraadt@cvs.openbsd.org 2002/06/26 13:20:57
-     [monitor.c]
-     be careful in mm_zalloc
-   - deraadt@cvs.openbsd.org 2002/06/26 13:49:26
-     [session.c]
-     disclose less information from environment files; based on input 
-     from djm, and dschultz@uclink.Berkeley.EDU
-   - markus@cvs.openbsd.org 2002/06/26 13:55:37
-     [auth2-chall.c]
-     make sure # of response matches # of queries, fixes int overflow; 
-     from ISS
-   - markus@cvs.openbsd.org 2002/06/26 13:56:27
-     [version.h]
-     3.4
- - (djm) Require krb5 devel for RPM build w/ KrbV 
- - (djm) Improve PAMAuthenticationViaKbdInt text from Nalin Dahyabhai 
-   <nalin@redhat.com>
- - (djm) Update spec files for release 
- - (djm) Fix int overflow in auth2-pam.c, similar to one discovered by ISS
- - (djm) Release 3.4p1
- - (tim) [contrib/caldera/openssh.spec] remove 2 configure options I put in
-   by mistake
-
-20020625
- - (stevesk) [INSTALL acconfig.h configure.ac defines.h] remove --with-rsh
- - (stevesk) [README.privsep] minor updates
- - (djm) Create privsep directory and warn if privsep user is missing 
-   during make install
- - (bal) Started list of PrivSep issues in TODO
- - (bal) if mmap() is substandard, don't allow compression on server side.
-   Post 'event' we will add more options.
- - (tim) [contrib/caldera/openssh.spec] Sync with Caldera
- - (bal) moved aix_usrinfo() and noted not setting real TTY.  Patch by
-   dtucker@zip.com.au
- - (tim) [acconfig.h configure.ac sshd.c] BROKEN_FD_PASSING fix from Markus
-   for Cygwin, Cray, & SCO
-
-20020624
- - OpenBSD CVS Sync
-   - deraadt@cvs.openbsd.org 2002/06/23 03:25:50
-     [tildexpand.c]
-     KNF
-   - deraadt@cvs.openbsd.org 2002/06/23 03:26:19
-     [cipher.c key.c]
-     KNF
-   - deraadt@cvs.openbsd.org 2002/06/23 03:30:58
-     [scard.c ssh-dss.c ssh-rsa.c sshconnect.c sshconnect2.c sshd.c sshlogin.c
-      sshpty.c]
-     various KNF and %d for unsigned
-   - deraadt@cvs.openbsd.org 2002/06/23 09:30:14
-     [sftp-client.c sftp-client.h sftp-common.c sftp-int.c sftp-server.c
-      sftp.c]
-     bunch of u_int vs int stuff
-   - deraadt@cvs.openbsd.org 2002/06/23 09:39:55
-     [ssh-keygen.c]
-     u_int stuff
-   - deraadt@cvs.openbsd.org 2002/06/23 09:46:51
-     [bufaux.c servconf.c]
-     minor KNF.  things the fingers do while you read
-   - deraadt@cvs.openbsd.org 2002/06/23 10:29:52
-     [ssh-agent.c sshd.c]
-     some minor KNF and %u
-   - deraadt@cvs.openbsd.org 2002/06/23 20:39:45
-     [session.c]
-     compression_level is u_int
-   - deraadt@cvs.openbsd.org 2002/06/23 21:06:13
-     [sshpty.c]
-     KNF
-   - deraadt@cvs.openbsd.org 2002/06/23 21:06:41
-     [channels.c channels.h session.c session.h]
-     display, screen, row, col, xpixel, ypixel are u_int; markus ok
-   - deraadt@cvs.openbsd.org 2002/06/23 21:10:02
-     [packet.c]
-     packet_get_int() returns unsigned for reason & seqnr
-  - (bal) Also fixed IPADDR_IN_DISPLAY case where display, screen, row, col,
-    xpixel are u_int.
-
-
-20020623
- - (stevesk) [configure.ac] bug #255 LOGIN_NEEDS_UTMPX for AIX.
- - (bal) removed GNUism for getops in ssh-agent since glibc lacks optreset.
- - (bal) add extern char *getopt.  Based on report by dtucker@zip.com.au 
- - OpenBSD CVS Sync
-   - stevesk@cvs.openbsd.org 2002/06/22 02:00:29
-     [ssh.h]
-     correct comment
-   - stevesk@cvs.openbsd.org 2002/06/22 02:40:23
-     [ssh.1]
-     section 5 not 4 for ssh_config
-   - naddy@cvs.openbsd.org 2002/06/22 11:51:39
-     [ssh.1]
-     typo
-   - stevesk@cvs.openbsd.org 2002/06/22 16:32:54
-     [sshd.8]
-     add /var/empty in FILES section
-   - stevesk@cvs.openbsd.org 2002/06/22 16:40:19
-     [sshd.c]
-     check /var/empty owner mode; ok provos@
-   - stevesk@cvs.openbsd.org 2002/06/22 16:41:57
-     [scp.1]
-     typo
-   - stevesk@cvs.openbsd.org 2002/06/22 16:45:29
-     [ssh-agent.1 sshd.8 sshd_config.5]
-     use process ID vs. pid/PID/process identifier
-   - stevesk@cvs.openbsd.org 2002/06/22 20:05:27
-     [sshd.c]
-     don't call setsid() if debugging or run from inetd; no "Operation not
-     permitted" errors now; ok millert@ markus@
-   - stevesk@cvs.openbsd.org 2002/06/22 23:09:51
-     [monitor.c]
-     save auth method before monitor_reset_key_state(); bugzilla bug #284;
-     ok provos@
-
-$Id: ChangeLog,v 1.2648 2003/04/01 11:47:16 djm Exp $
diff --git a/crypto/openssh/INSTALL b/crypto/openssh/INSTALL
deleted file mode 100644
index f5ab0dbd3352..000000000000
--- a/crypto/openssh/INSTALL
+++ /dev/null
@@ -1,220 +0,0 @@
-1. Prerequisites
-----------------
-
-You will need working installations of Zlib and OpenSSL.
-
-Zlib:
-http://www.gzip.org/zlib/ 
-
-OpenSSL 0.9.6 or greater:
-http://www.openssl.org/
-
-(OpenSSL 0.9.5a is partially supported, but some ciphers (SSH protocol 1 
-Blowfish) do not work correctly.)
-
-OpenSSH can utilise Pluggable Authentication Modules (PAM) if your system
-supports it. PAM is standard on Redhat and Debian Linux, Solaris and
-HP-UX 11.
-
-NB. If you operating system supports /dev/random, you should configure 
-OpenSSL to use it. OpenSSH relies on OpenSSL's direct support of 
-/dev/random. If you don't you will have to rely on ssh-rand-helper, which 
-is inferior to a good kernel-based solution.
-
-PAM:
-http://www.kernel.org/pub/linux/libs/pam/
-
-If you wish to build the GNOME passphrase requester, you will need the GNOME
-libraries and headers.
-
-GNOME:
-http://www.gnome.org/
-
-Alternatively, Jim Knoble <jmknoble@jmknoble.cx> has written an excellent X11
-passphrase requester. This is maintained separately at:
-
-http://www.ntrnet.net/~jmknoble/software/x11-ssh-askpass/index.html
-
-PRNGD:
-
-If your system lacks Kernel based random collection, the use of Lutz 
-Jaenicke's PRNGd is recommended.
-
-http://www.aet.tu-cottbus.de/personen/jaenicke/postfix_tls/prngd.html
-
-EGD:
-
-The Entropy Gathering Daemon (EGD) is supported if you have a system which
-lacks /dev/random and don't want to use OpenSSH's internal entropy collection.
-
-http://www.lothar.com/tech/crypto/
-
-S/Key Libraries:
-http://www.sparc.spb.su/solaris/skey/
-
-If you wish to use --with-skey then you will need the above library
-installed.  No other current S/Key library is currently known to be
-supported. 
-
-2. Building / Installation
---------------------------
-
-To install OpenSSH with default options:
-
-./configure
-make
-make install
-
-This will install the OpenSSH binaries in /usr/local/bin, configuration files
-in /usr/local/etc, the server in /usr/local/sbin, etc. To specify a different
-installation prefix, use the --prefix option to configure:
-
-./configure --prefix=/opt
-make
-make install
-
-Will install OpenSSH in /opt/{bin,etc,lib,sbin}. You can also override 
-specific paths, for example:
-
-./configure --prefix=/opt --sysconfdir=/etc/ssh
-make
-make install
-
-This will install the binaries in /opt/{bin,lib,sbin}, but will place the
-configuration files in /etc/ssh.
-
-If you are using PAM, you may need to manually install a PAM control
-file as "/etc/pam.d/sshd" (or wherever your system prefers to keep
-them).  Note that the service name used to start PAM is __progname,
-which is the basename of the path of your sshd (e.g., the service name
-for /usr/sbin/osshd will be osshd).  If you have renamed your sshd
-executable, your PAM configuration may need to be modified.
-
-A generic PAM configuration is included as "contrib/sshd.pam.generic",
-you may need to edit it before using it on your system. If you are
-using a recent version of Red Hat Linux, the config file in
-contrib/redhat/sshd.pam should be more useful.  Failure to install a
-valid PAM file may result in an inability to use password
-authentication.  On HP-UX 11 and Solaris, the standard /etc/pam.conf
-configuration will work with sshd (sshd will match the other service
-name).
-
-There are a few other options to the configure script:
-
---with-pam enables PAM support.
-
---enable-gnome-askpass will build the GNOME passphrase dialog. You
-need a working installation of GNOME, including the development
-headers, for this to work.
-
---with-prngd-socket=/some/file allows you to enable EGD or PRNGD 
-support and to specify a PRNGd socket. Use this if your Unix lacks 
-/dev/random and you don't want to use OpenSSH's builtin entropy 
-collection support.
-
---with-prngd-port=portnum allows you to enable EGD or PRNGD support 
-and to specify a EGD localhost TCP port. Use this if your Unix lacks 
-/dev/random and you don't want to use OpenSSH's builtin entropy 
-collection support.
-
---with-lastlog=FILE will specify the location of the lastlog file. 
-./configure searches a few locations for lastlog, but may not find
-it if lastlog is installed in a different place.
-
---without-lastlog will disable lastlog support entirely.
-
---with-sia, --without-sia will enable or disable OSF1's Security 
-Integration Architecture.  The default for OSF1 machines is enable.
-
---with-kerberos4=PATH will enable Kerberos IV support. You will need
-to have the Kerberos libraries and header files installed for this
-to work. Use the optional PATH argument to specify the root of your
-Kerberos installation.
-
---with-afs=PATH will enable AFS support. You will need to have the
-Kerberos IV and the AFS libraries and header files installed for this
-to work.  Use the optional PATH argument to specify the root of your
-AFS installation. AFS requires Kerberos support to be enabled.
-
---with-skey=PATH will enable S/Key one time password support. You will 
-need the S/Key libraries and header files installed for this to work.
-
---with-tcp-wrappers will enable TCP Wrappers (/etc/hosts.allow|deny)
-support. You will need libwrap.a and tcpd.h installed.
-
---with-md5-passwords will enable the use of MD5 passwords. Enable this
-if your operating system uses MD5 passwords without using PAM.
-
---with-utmpx enables utmpx support. utmpx support is automatic for 
-some platforms.
-
---without-shadow disables shadow password support.
-
---with-ipaddr-display forces the use of a numeric IP address in the 
-$DISPLAY environment variable. Some broken systems need this.
-
---with-default-path=PATH allows you to specify a default $PATH for sessions
-started by sshd. This replaces the standard path entirely.
-
---with-pid-dir=PATH specifies the directory in which the ssh.pid file is
-created.
-
---with-xauth=PATH specifies the location of the xauth binary
-
---with-ipv4-default instructs OpenSSH to use IPv4 by default for new
-connections. Normally OpenSSH will try attempt to lookup both IPv6 and
-IPv4 addresses. On Linux/glibc-2.1.2 this causes long delays in name
-resolution. If this option is specified, you can still attempt to 
-connect to IPv6 addresses using the command line option '-6'.
-
---with-ssl-dir=DIR allows you to specify where your OpenSSL libraries
-are installed.
-
---with-4in6 Check for IPv4 in IPv6 mapped addresses and convert them to
-real (AF_INET) IPv4 addresses. Works around some quirks on Linux.
-
---with-opensc=DIR
---with-sectok=DIR allows for OpenSC or sectok smartcard libraries to
-be used with OpenSSH.  See 'README.smartcard' for more details.
-
-If you need to pass special options to the compiler or linker, you
-can specify these as environment variables before running ./configure.
-For example:
-
-CFLAGS="-O -m486" LDFLAGS="-s" LIBS="-lrubbish" LD="/usr/foo/ld" ./configure
-
-3. Configuration
-----------------
-
-The runtime configuration files are installed by in ${prefix}/etc or 
-whatever you specified as your --sysconfdir (/usr/local/etc by default).
-
-The default configuration should be instantly usable, though you should 
-review it to ensure that it matches your security requirements.
-
-To generate a host key, run "make host-key". Alternately you can do so
-manually using the following commands: 
-
-    ssh-keygen -t rsa1 -f /etc/ssh/ssh_host_key -N ""
-    ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key -N ""
-    ssh-keygen -t dsa -f /etc/ssh/ssh_host_dsa_key -N ""
-
-Replacing /etc/ssh with the correct path to the configuration directory.
-(${prefix}/etc or whatever you specified with --sysconfdir during 
-configuration)
-
-If you have configured OpenSSH with EGD support, ensure that EGD is
-running and has collected some Entropy.
-
-For more information on configuration, please refer to the manual pages 
-for sshd, ssh and ssh-agent.
-
-4. Problems?
-------------
-
-If you experience problems compiling, installing or running OpenSSH. 
-Please refer to the "reporting bugs" section of the webpage at
-http://www.openssh.com/
-
-
-$Id: INSTALL,v 1.55 2002/07/25 04:36:25 djm Exp $
diff --git a/crypto/openssh/LICENCE b/crypto/openssh/LICENCE
deleted file mode 100644
index 19d4c74e660b..000000000000
--- a/crypto/openssh/LICENCE
+++ /dev/null
@@ -1,214 +0,0 @@
-This file is part of the OpenSSH software.
-
-The licences which components of this software fall under are as
-follows.  First, we will summarize and say that all components
-are under a BSD licence, or a licence more free than that.
-
-OpenSSH contains no GPL code.
-
-1)
-     * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
-     *                    All rights reserved
-     *
-     * As far as I am concerned, the code I have written for this software
-     * can be used freely for any purpose.  Any derived versions of this
-     * software must be clearly marked as such, and if the derived work is
-     * incompatible with the protocol description in the RFC file, it must be
-     * called by a name other than "ssh" or "Secure Shell".
-
-    [Tatu continues]
-     *  However, I am not implying to give any licenses to any patents or
-     * copyrights held by third parties, and the software includes parts that
-     * are not under my direct control.  As far as I know, all included
-     * source code is used in accordance with the relevant license agreements
-     * and can be used freely for any purpose (the GNU license being the most
-     * restrictive); see below for details.
-
-    [However, none of that term is relevant at this point in time.  All of
-    these restrictively licenced software components which he talks about
-    have been removed from OpenSSH, i.e.,
-
-     - RSA is no longer included, found in the OpenSSL library
-     - IDEA is no longer included, its use is deprecated
-     - DES is now external, in the OpenSSL library
-     - GMP is no longer used, and instead we call BN code from OpenSSL
-     - Zlib is now external, in a library
-     - The make-ssh-known-hosts script is no longer included
-     - TSS has been removed
-     - MD5 is now external, in the OpenSSL library
-     - RC4 support has been replaced with ARC4 support from OpenSSL
-     - Blowfish is now external, in the OpenSSL library
-
-    [The licence continues]
-
-    Note that any information and cryptographic algorithms used in this
-    software are publicly available on the Internet and at any major
-    bookstore, scientific library, and patent office worldwide.  More
-    information can be found e.g. at "http://www.cs.hut.fi/crypto".
-    
-    The legal status of this program is some combination of all these
-    permissions and restrictions.  Use only at your own responsibility.
-    You will be responsible for any legal consequences yourself; I am not
-    making any claims whether possessing or using this is legal or not in
-    your country, and I am not taking any responsibility on your behalf.
-    
-    
-    			    NO WARRANTY
-    
-    BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
-    FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
-    OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
-    PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
-    OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
-    MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
-    TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
-    PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
-    REPAIR OR CORRECTION.
-    
-    IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-    WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
-    REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
-    INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
-    OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
-    TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
-    YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
-    PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
-    POSSIBILITY OF SUCH DAMAGES.
-
-2)
-    The 32-bit CRC implementation in crc32.c is due to Gary S. Brown.
-    Comments in the file indicate it may be used for any purpose without
-    restrictions:
-
-     * COPYRIGHT (C) 1986 Gary S. Brown.  You may use this program, or
-     * code or tables extracted from it, as desired without restriction.
-
-3)
-    The 32-bit CRC compensation attack detector in deattack.c was
-    contributed by CORE SDI S.A. under a BSD-style license.
-
-     * Cryptographic attack detector for ssh - source code
-     *
-     * Copyright (c) 1998 CORE SDI S.A., Buenos Aires, Argentina.
-     *
-     * All rights reserved. Redistribution and use in source and binary
-     * forms, with or without modification, are permitted provided that
-     * this copyright notice is retained.
-     *
-     * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
-     * WARRANTIES ARE DISCLAIMED. IN NO EVENT SHALL CORE SDI S.A. BE
-     * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY OR
-     * CONSEQUENTIAL DAMAGES RESULTING FROM THE USE OR MISUSE OF THIS
-     * SOFTWARE.
-     *
-     * Ariel Futoransky <futo@core-sdi.com>
-     * <http://www.core-sdi.com>
-
-4)
-    ssh-keygen was contributed by David Mazieres under a BSD-style
-    license.
-
-     * Copyright 1995, 1996 by David Mazieres <dm@lcs.mit.edu>.
-     *
-     * Modification and redistribution in source and binary forms is
-     * permitted provided that due credit is given to the author and the
-     * OpenBSD project by leaving this copyright notice intact.
-
-5)
-    The Rijndael implementation by Vincent Rijmen, Antoon Bosselaers
-    and Paulo Barreto is in the public domain and distributed
-    with the following license:
-
-     * @version 3.0 (December 2000)
-     * 
-     * Optimised ANSI C code for the Rijndael cipher (now AES)
-     * 
-     * @author Vincent Rijmen <vincent.rijmen@esat.kuleuven.ac.be>
-     * @author Antoon Bosselaers <antoon.bosselaers@esat.kuleuven.ac.be>
-     * @author Paulo Barreto <paulo.barreto@terra.com.br>
-     * 
-     * This code is hereby placed in the public domain.
-     * 
-     * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ''AS IS'' AND ANY EXPRESS
-     * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-     * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-     * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE
-     * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
-     * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-     * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
-     * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
-     * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
-     * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
-     * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-6)
-    One component of the ssh source code is under a 4-clause BSD license,
-    held by the University of California, since we pulled these parts from
-    original Berkeley code.  The Regents of the University of California
-    have declared that term 3 is no longer enforceable on their source code,
-    but we retain that license as is.
-
-     * Copyright (c) 1983, 1990, 1992, 1993, 1995
-     *      The Regents of the University of California.  All rights reserved.
-     *
-     * Redistribution and use in source and binary forms, with or without
-     * modification, are permitted provided that the following conditions
-     * are met:
-     * 1. Redistributions of source code must retain the above copyright
-     *    notice, this list of conditions and the following disclaimer.
-     * 2. Redistributions in binary form must reproduce the above copyright
-     *    notice, this list of conditions and the following disclaimer in the
-     *    documentation and/or other materials provided with the distribution.
-     * 3. All advertising materials mentioning features or use of this software
-     *    must display the following acknowledgement:
-     *      This product includes software developed by the University of
-     *      California, Berkeley and its contributors.
-     * 4. Neither the name of the University nor the names of its contributors
-     *    may be used to endorse or promote products derived from this software
-     *    without specific prior written permission.
-     *
-     * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
-     * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-     * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-     * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
-     * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-     * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-     * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-     * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-     * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-     * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-     * SUCH DAMAGE.
-
-7)
-    Remaining components of the software are provided under a standard
-    2-term BSD licence with the following names as copyright holders:
-
-	Markus Friedl
-	Theo de Raadt
-	Niels Provos
-	Dug Song
-	Aaron Campbell
-	Damien Miller
-	Kevin Steves
-	Daniel Kouril
-	Per Allansson
-
-     * Redistribution and use in source and binary forms, with or without
-     * modification, are permitted provided that the following conditions
-     * are met:
-     * 1. Redistributions of source code must retain the above copyright
-     *    notice, this list of conditions and the following disclaimer.
-     * 2. Redistributions in binary form must reproduce the above copyright
-     *    notice, this list of conditions and the following disclaimer in the
-     *    documentation and/or other materials provided with the distribution.
-     *
-     * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-     * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-     * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-     * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-     * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-     * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-     * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-     * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-     * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-     * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/crypto/openssh/Makefile b/crypto/openssh/Makefile
deleted file mode 100644
index 0b9c668b6511..000000000000
--- a/crypto/openssh/Makefile
+++ /dev/null
@@ -1,14 +0,0 @@
-#	$OpenBSD: Makefile,v 1.11 2002/05/23 19:24:30 markus Exp $
-
-.include <bsd.own.mk>
-
-SUBDIR=	lib ssh sshd ssh-add ssh-keygen ssh-agent scp sftp-server \
-	ssh-keysign ssh-keyscan sftp scard
-
-distribution:
-	install -C -o root -g wheel -m 0644 ${.CURDIR}/ssh_config \
-	    ${DESTDIR}/etc/ssh/ssh_config
-	install -C -o root -g wheel -m 0644 ${.CURDIR}/sshd_config \
-	    ${DESTDIR}/etc/ssh/sshd_config
-
-.include <bsd.subdir.mk>
diff --git a/crypto/openssh/Makefile.in b/crypto/openssh/Makefile.in
deleted file mode 100644
index 6702eb96e757..000000000000
--- a/crypto/openssh/Makefile.in
+++ /dev/null
@@ -1,361 +0,0 @@
-# $Id: Makefile.in,v 1.228 2003/03/21 00:34:34 mouring Exp $
-
-# uncomment if you run a non bourne compatable shell. Ie. csh
-#SHELL = @SH@
-
-AUTORECONF=autoreconf
-
-prefix=@prefix@
-exec_prefix=@exec_prefix@
-bindir=@bindir@
-sbindir=@sbindir@
-libexecdir=@libexecdir@
-datadir=@datadir@
-mandir=@mandir@
-mansubdir=@mansubdir@
-sysconfdir=@sysconfdir@
-piddir=@piddir@
-srcdir=@srcdir@
-top_srcdir=@top_srcdir@
-
-DESTDIR=
-VPATH=@srcdir@
-SSH_PROGRAM=@bindir@/ssh
-ASKPASS_PROGRAM=$(libexecdir)/ssh-askpass
-SFTP_SERVER=$(libexecdir)/sftp-server
-SSH_KEYSIGN=$(libexecdir)/ssh-keysign
-RAND_HELPER=$(libexecdir)/ssh-rand-helper
-PRIVSEP_PATH=@PRIVSEP_PATH@
-SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
-STRIP_OPT=@STRIP_OPT@
-
-PATHS= -DSSHDIR=\"$(sysconfdir)\" \
-	-D_PATH_SSH_PROGRAM=\"$(SSH_PROGRAM)\" \
-	-D_PATH_SSH_ASKPASS_DEFAULT=\"$(ASKPASS_PROGRAM)\" \
-	-D_PATH_SFTP_SERVER=\"$(SFTP_SERVER)\" \
-	-D_PATH_SSH_KEY_SIGN=\"$(SSH_KEYSIGN)\" \
-	-D_PATH_SSH_PIDDIR=\"$(piddir)\" \
-	-D_PATH_PRIVSEP_CHROOT_DIR=\"$(PRIVSEP_PATH)\" \
-	-DSSH_RAND_HELPER=\"$(RAND_HELPER)\"
-
-CC=@CC@
-LD=@LD@
-CFLAGS=@CFLAGS@
-CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ $(PATHS) @DEFS@
-LIBS=@LIBS@
-LIBPAM=@LIBPAM@
-LIBWRAP=@LIBWRAP@
-AR=@AR@
-RANLIB=@RANLIB@
-INSTALL=@INSTALL@
-PERL=@PERL@
-SED=@SED@
-ENT=@ENT@
-XAUTH_PATH=@XAUTH_PATH@
-LDFLAGS=-L. -Lopenbsd-compat/ @LDFLAGS@
-EXEEXT=@EXEEXT@
-
-INSTALL_SSH_PRNG_CMDS=@INSTALL_SSH_PRNG_CMDS@
-INSTALL_SSH_RAND_HELPER=@INSTALL_SSH_RAND_HELPER@
-
-TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-agent$(EXEEXT) scp$(EXEEXT) ssh-rand-helper${EXEEXT} sftp-server$(EXEEXT) sftp$(EXEEXT)
-
-LIBSSH_OBJS=authfd.o authfile.o bufaux.o buffer.o canohost.o channels.o \
-	cipher.o compat.o compress.o crc32.o deattack.o fatal.o \
-	hostfile.o log.o match.o mpaux.o nchan.o packet.o readpass.o \
-	rsa.o tildexpand.o ttymodes.o xmalloc.o atomicio.o \
-	key.o dispatch.o kex.o mac.o uuencode.o misc.o \
-	rijndael.o ssh-dss.o ssh-rsa.o dh.o kexdh.o kexgex.o \
-	kexdhc.o kexgexc.o scard.o msg.o progressmeter.o \
-	entropy.o
-
-SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
-	sshconnect.o sshconnect1.o sshconnect2.o
-
-SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o \
-	sshpty.o sshlogin.o servconf.o serverloop.o uidswap.o \
-	auth.o auth1.o auth2.o auth-options.o session.o \
-	auth-chall.o auth2-chall.o groupaccess.o \
-	auth-skey.o auth-bsdauth.o auth2-hostbased.o auth2-kbdint.o \
-	auth2-none.o auth2-passwd.o auth2-pubkey.o \
-	monitor_mm.o monitor.o monitor_wrap.o monitor_fdpass.o \
-	kexdhs.o kexgexs.o \
-	auth-krb5.o auth-krb4.o \
-	loginrec.o auth-pam.o auth2-pam.o auth-sia.o md5crypt.o
-
-MANPAGES	= scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-rand-helper.8.out ssh-keysign.8.out sshd_config.5.out ssh_config.5.out
-MANPAGES_IN	= scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-rand-helper.8 ssh-keysign.8 sshd_config.5 ssh_config.5
-MANTYPE		= @MANTYPE@
-
-CONFIGFILES=sshd_config.out ssh_config.out moduli.out
-CONFIGFILES_IN=sshd_config ssh_config moduli
-
-PATHSUBS	= \
-	-e 's|/etc/ssh/ssh_prng_cmds|$(sysconfdir)/ssh_prng_cmds|g' \
-	-e 's|/etc/ssh/ssh_config|$(sysconfdir)/ssh_config|g' \
-	-e 's|/etc/ssh/ssh_known_hosts|$(sysconfdir)/ssh_known_hosts|g' \
-	-e 's|/etc/ssh/sshd_config|$(sysconfdir)/sshd_config|g' \
-	-e 's|/usr/libexec|$(libexecdir)|g' \
-	-e 's|/etc/shosts.equiv|$(sysconfdir)/shosts.equiv|g' \
-	-e 's|/etc/ssh/ssh_host_key|$(sysconfdir)/ssh_host_key|g' \
-	-e 's|/etc/ssh/ssh_host_dsa_key|$(sysconfdir)/ssh_host_dsa_key|g' \
-	-e 's|/etc/ssh/ssh_host_rsa_key|$(sysconfdir)/ssh_host_rsa_key|g' \
-	-e 's|/var/run/sshd.pid|$(piddir)/sshd.pid|g' \
-	-e 's|/etc/ssh/moduli|$(sysconfdir)/moduli|g' \
-	-e 's|/etc/sshrc|$(sysconfdir)/sshrc|g' \
-	-e 's|/usr/X11R6/bin/xauth|$(XAUTH_PATH)|g' \
-	-e 's|/var/empty|$(PRIVSEP_PATH)|g' \
-	-e 's|/usr/bin:/bin:/usr/sbin:/sbin|@user_path@|g'
-
-FIXPATHSCMD	= $(SED) $(PATHSUBS)
-
-all: $(CONFIGFILES) $(MANPAGES) $(TARGETS)
-
-$(LIBSSH_OBJS): config.h
-$(SSHOBJS): config.h
-$(SSHDOBJS): config.h
-
-.c.o:
-	$(CC) $(CFLAGS) $(CPPFLAGS) -c $<
-
-LIBCOMPAT=openbsd-compat/libopenbsd-compat.a
-$(LIBCOMPAT): always
-	(cd openbsd-compat && $(MAKE))
-always:
-
-libssh.a: $(LIBSSH_OBJS)
-	$(AR) rv $@ $(LIBSSH_OBJS)
-	$(RANLIB) $@
-
-ssh$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHOBJS)
-	$(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
-
-sshd$(EXEEXT): libssh.a	$(LIBCOMPAT) $(SSHDOBJS)
-	$(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBWRAP) $(LIBPAM) $(LIBS)
-
-scp$(EXEEXT): $(LIBCOMPAT) libssh.a scp.o progressmeter.o
-	$(LD) -o $@ scp.o progressmeter.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
-
-ssh-add$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-add.o
-	$(LD) -o $@ ssh-add.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) 
-
-ssh-agent$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-agent.o
-	$(LD) -o $@ ssh-agent.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) 
-
-ssh-keygen$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keygen.o
-	$(LD) -o $@ ssh-keygen.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) 
-
-ssh-keysign$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keysign.o
-	$(LD) -o $@ ssh-keysign.o readconf.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) 
-
-ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o
-	$(LD) -o $@ ssh-keyscan.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS) 
-
-sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a sftp.o sftp-common.o sftp-server.o
-	$(LD) -o $@ sftp-server.o sftp-common.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) 
-
-sftp$(EXEEXT): $(LIBCOMPAT) libssh.a sftp.o sftp-client.o sftp-int.o sftp-common.o sftp-glob.o progressmeter.o
-	$(LD) -o $@ progressmeter.o sftp.o sftp-client.o sftp-common.o sftp-int.o sftp-glob.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
-
-ssh-rand-helper${EXEEXT}: $(LIBCOMPAT) libssh.a ssh-rand-helper.o
-	$(LD) -o $@ ssh-rand-helper.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
-
-# test driver for the loginrec code - not built by default
-logintest: logintest.o $(LIBCOMPAT) libssh.a loginrec.o
-	$(LD) -o $@ logintest.o $(LDFLAGS) loginrec.o -lopenbsd-compat -lssh $(LIBS)
-
-$(MANPAGES): $(MANPAGES_IN)
-	if test "$(MANTYPE)" = "cat"; then \
-		manpage=$(srcdir)/`echo $@ | sed 's/\.[1-9]\.out$$/\.0/'`; \
-	else \
-		manpage=$(srcdir)/`echo $@ | sed 's/\.out$$//'`; \
-	fi; \
-	if test "$(MANTYPE)" = "man"; then \
-		$(FIXPATHSCMD) $${manpage} | $(PERL) $(srcdir)/mdoc2man.pl > $@; \
-	else \
-		$(FIXPATHSCMD) $${manpage} > $@; \
-	fi
-
-$(CONFIGFILES): $(CONFIGFILES_IN)
-	conffile=`echo $@ | sed 's/.out$$//'`; \
-	$(FIXPATHSCMD) $(srcdir)/$${conffile} > $@
-
-clean:
-	rm -f *.o *.a $(TARGETS) logintest config.cache config.log 
-	rm -f *.out core 
-	(cd openbsd-compat && $(MAKE) clean)
-
-distclean:
-	rm -f *.o *.a $(TARGETS) logintest config.cache config.log 
-	rm -f *.out core
-	rm -f Makefile config.h config.status ssh_prng_cmds *~
-	rm -rf autom4te.cache
-	(cd openbsd-compat && $(MAKE) distclean)
-	(cd scard && $(MAKE) distclean)
-
-veryclean:
-	rm -f configure config.h.in *.0
-	rm -f *.o *.a $(TARGETS) logintest config.cache config.log 
-	rm -f *.out core
-	rm -f Makefile config.h config.status ssh_prng_cmds *~
-	(cd openbsd-compat && $(MAKE) distclean)
-	(cd scard && $(MAKE) distclean)
-
-mrproper: distclean
-
-catman-do:
-	@for f in $(MANPAGES_IN) ; do \
-		base=`echo $$f | sed 's/\..*$$//'` ; \
-		echo "$$f -> $$base.0" ; \
-		nroff -mandoc $$f | cat -v | sed -e 's/.\^H//g' \
-			>$$base.0 ; \
-	done
-
-distprep: catman-do
-	$(AUTORECONF)
-	(cd scard && $(MAKE) -f Makefile.in distprep)
-
-install: $(CONFIGFILES) $(MANPAGES) $(TARGETS) install-files host-key check-config
-install-nokeys: $(CONFIGFILES) $(MANPAGES) $(TARGETS) install-files
-
-check-config:
-	-$(DESTDIR)$(sbindir)/sshd -t -f $(DESTDIR)$(sysconfdir)/sshd_config
-
-scard-install:
-	(cd scard && $(MAKE) DESTDIR=$(DESTDIR) install)
-
-install-files: scard-install
-	$(srcdir)/mkinstalldirs $(DESTDIR)$(bindir)
-	$(srcdir)/mkinstalldirs $(DESTDIR)$(sbindir)
-	$(srcdir)/mkinstalldirs $(DESTDIR)$(mandir)
-	$(srcdir)/mkinstalldirs $(DESTDIR)$(datadir)
-	$(srcdir)/mkinstalldirs $(DESTDIR)$(mandir)/$(mansubdir)1
-	$(srcdir)/mkinstalldirs $(DESTDIR)$(mandir)/$(mansubdir)5
-	$(srcdir)/mkinstalldirs $(DESTDIR)$(mandir)/$(mansubdir)8
-	$(srcdir)/mkinstalldirs $(DESTDIR)$(libexecdir)
-	(umask 022 ; $(srcdir)/mkinstalldirs $(DESTDIR)$(PRIVSEP_PATH))
-	$(INSTALL) -m 0755 $(STRIP_OPT) ssh $(DESTDIR)$(bindir)/ssh
-	$(INSTALL) -m 0755 $(STRIP_OPT) scp $(DESTDIR)$(bindir)/scp
-	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-add $(DESTDIR)$(bindir)/ssh-add
-	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-agent $(DESTDIR)$(bindir)/ssh-agent
-	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-keygen $(DESTDIR)$(bindir)/ssh-keygen
-	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-keyscan $(DESTDIR)$(bindir)/ssh-keyscan
-	$(INSTALL) -m 0755 $(STRIP_OPT) sshd $(DESTDIR)$(sbindir)/sshd
-	if test ! -z "$(INSTALL_SSH_RAND_HELPER)" ; then \
-		$(INSTALL) -m 0755 $(STRIP_OPT) ssh-rand-helper $(DESTDIR)$(libexecdir)/ssh-rand-helper ; \
-	fi
-	$(INSTALL) -m 4711 $(STRIP_OPT) ssh-keysign $(DESTDIR)$(SSH_KEYSIGN)
-	$(INSTALL) -m 0755 $(STRIP_OPT) sftp $(DESTDIR)$(bindir)/sftp
-	$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server $(DESTDIR)$(SFTP_SERVER)
-	$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
-	$(INSTALL) -m 644 scp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
-	$(INSTALL) -m 644 ssh-add.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
-	$(INSTALL) -m 644 ssh-agent.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-agent.1
-	$(INSTALL) -m 644 ssh-keygen.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-keygen.1
-	$(INSTALL) -m 644 ssh-keyscan.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-keyscan.1
-	$(INSTALL) -m 644 sshd_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/sshd_config.5
-	$(INSTALL) -m 644 ssh_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/ssh_config.5
-	$(INSTALL) -m 644 sshd.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sshd.8
-	if [ ! -z "$(INSTALL_SSH_RAND_HELPER)" ]; then \
-		$(INSTALL) -m 644 ssh-rand-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-rand-helper.8 ; \
-	fi
-	$(INSTALL) -m 644 sftp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/sftp.1
-	$(INSTALL) -m 644 sftp-server.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
-	$(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
-	-rm -f $(DESTDIR)$(bindir)/slogin
-	ln -s ./ssh$(EXEEXT) $(DESTDIR)$(bindir)/slogin
-	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1
-	ln -s ./ssh.1 $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1
-	if [ ! -d $(DESTDIR)$(sysconfdir) ]; then \
-		$(srcdir)/mkinstalldirs $(DESTDIR)$(sysconfdir); \
-	fi
-	@if [ ! -f $(DESTDIR)$(sysconfdir)/ssh_config ]; then \
-		$(INSTALL) -m 644 ssh_config.out $(DESTDIR)$(sysconfdir)/ssh_config; \
-	else \
-		echo "$(DESTDIR)$(sysconfdir)/ssh_config already exists, install will not overwrite"; \
-	fi
-	@if [ ! -f $(DESTDIR)$(sysconfdir)/sshd_config ]; then \
-		$(INSTALL) -m 644 sshd_config.out $(DESTDIR)$(sysconfdir)/sshd_config; \
-	else \
-		echo "$(DESTDIR)$(sysconfdir)/sshd_config already exists, install will not overwrite"; \
-	fi
-	@if [ -f ssh_prng_cmds -a ! -z "$(INSTALL_SSH_PRNG_CMDS)" ]; then \
-		$(PERL) $(srcdir)/fixprogs ssh_prng_cmds $(ENT); \
-		if [ ! -f $(DESTDIR)$(sysconfdir)/ssh_prng_cmds ] ; then \
-			$(INSTALL) -m 644 ssh_prng_cmds.out $(DESTDIR)$(sysconfdir)/ssh_prng_cmds; \
-		else \
-			echo "$(DESTDIR)$(sysconfdir)/ssh_prng_cmds already exists, install will not overwrite"; \
-		fi ; \
-	fi
-	@if [ ! -f $(DESTDIR)$(sysconfdir)/moduli ]; then \
-		if [ -f $(DESTDIR)$(sysconfdir)/primes ]; then \
-			echo "moving $(DESTDIR)$(sysconfdir)/primes to $(DESTDIR)$(sysconfdir)/moduli"; \
-			mv "$(DESTDIR)$(sysconfdir)/primes" "$(DESTDIR)$(sysconfdir)/moduli"; \
-		else \
-			$(INSTALL) -m 644 moduli.out $(DESTDIR)$(sysconfdir)/moduli; \
-		fi ; \
-	else \
-		echo "$(DESTDIR)$(sysconfdir)/moduli already exists, install will not overwrite"; \
-	fi
-
-host-key: ssh-keygen$(EXEEXT)
-	@if [ -z "$(DESTDIR)" ] ; then \
-		if [ -f "$(DESTDIR)$(sysconfdir)/ssh_host_key" ] ; then \
-			echo "$(DESTDIR)$(sysconfdir)/ssh_host_key already exists, skipping." ; \
-		else \
-			./ssh-keygen -t rsa1 -f $(DESTDIR)$(sysconfdir)/ssh_host_key -N "" ; \
-		fi ; \
-		if [ -f $(DESTDIR)$(sysconfdir)/ssh_host_dsa_key ] ; then \
-			echo "$(DESTDIR)$(sysconfdir)/ssh_host_dsa_key already exists, skipping." ; \
-		else \
-			./ssh-keygen -t dsa -f $(DESTDIR)$(sysconfdir)/ssh_host_dsa_key -N "" ; \
-		fi ; \
-		if [ -f $(DESTDIR)$(sysconfdir)/ssh_host_rsa_key ] ; then \
-			echo "$(DESTDIR)$(sysconfdir)/ssh_host_rsa_key already exists, skipping." ; \
-		else \
-			./ssh-keygen -t rsa -f $(DESTDIR)$(sysconfdir)/ssh_host_rsa_key -N "" ; \
-		fi ; \
-	fi ;
-
-host-key-force: ssh-keygen$(EXEEXT)
-	./ssh-keygen -t rsa1 -f $(DESTDIR)$(sysconfdir)/ssh_host_key -N ""
-	./ssh-keygen -t dsa -f $(DESTDIR)$(sysconfdir)/ssh_host_dsa_key -N ""
-	./ssh-keygen -t rsa -f $(DESTDIR)$(sysconfdir)/ssh_host_rsa_key -N ""
-
-uninstallall:	uninstall
-	-rm -f $(DESTDIR)$(sysconfdir)/ssh_config
-	-rm -f $(DESTDIR)$(sysconfdir)/sshd_config
-	-rm -f $(DESTDIR)$(sysconfdir)/ssh_prng_cmds
-	-rmdir $(DESTDIR)$(sysconfdir)
-	-rmdir $(DESTDIR)$(bindir)
-	-rmdir $(DESTDIR)$(sbindir)
-	-rmdir $(DESTDIR)$(mandir)/$(mansubdir)1
-	-rmdir $(DESTDIR)$(mandir)/$(mansubdir)8
-	-rmdir $(DESTDIR)$(mandir)
-	-rmdir $(DESTDIR)$(libexecdir)
-
-uninstall: 
-	-rm -f $(DESTDIR)$(bindir)/slogin
-	-rm -f $(DESTDIR)$(bindir)/ssh$(EXEEXT)
-	-rm -f $(DESTDIR)$(bindir)/scp$(EXEEXT)
-	-rm -f $(DESTDIR)$(bindir)/ssh-add$(EXEEXT)
-	-rm -f $(DESTDIR)$(bindir)/ssh-agent$(EXEEXT)
-	-rm -f $(DESTDIR)$(bindir)/ssh-keygen$(EXEEXT)
-	-rm -f $(DESTDIR)$(bindir)/ssh-keyscan$(EXEEXT)
-	-rm -f $(DESTDIR)$(bindir)/sftp$(EXEEXT)
-	-rm -f $(DESTDIR)$(sbindir)/sshd$(EXEEXT)
-	-rm -r $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
-	-rm -f $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
-	-rm -f $(DESTDIR)$(RAND_HELPER)$(EXEEXT)
-	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
-	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
-	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
-	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-agent.1
-	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-keygen.1
-	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/sftp.1
-	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-keyscan.1
-	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/sshd.8
-	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-rand-helper.8
-	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
-	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
-	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1
diff --git a/crypto/openssh/Makefile.inc b/crypto/openssh/Makefile.inc
deleted file mode 100644
index c68f59a74e94..000000000000
--- a/crypto/openssh/Makefile.inc
+++ /dev/null
@@ -1,26 +0,0 @@
-#	$OpenBSD: Makefile.inc,v 1.23 2002/03/06 00:23:27 markus Exp $
-
-CFLAGS+=	-I${.CURDIR}/..
-
-CDIAGFLAGS=	-Wall
-#CDIAGFLAGS+=	-Werror
-CDIAGFLAGS+=	-Wpointer-arith
-CDIAGFLAGS+=	-Wno-uninitialized
-#CDIAGFLAGS+=	-Wstrict-prototypes
-CDIAGFLAGS+=	-Wmissing-prototypes
-CDIAGFLAGS+=	-Wunused
-
-#DEBUG=-g
-
-#CFLAGS+=	-DSMARTCARD
-#LDADD+=	-lsectok
-
-.include <bsd.obj.mk>
-
-.if exists(${.CURDIR}/../lib/${__objdir})
-LDADD+=         -L${.CURDIR}/../lib/${__objdir} -lssh
-DPADD+=         ${.CURDIR}/../lib/${__objdir}/libssh.a
-.else
-LDADD+=         -L${.CURDIR}/../lib -lssh
-DPADD+=         ${.CURDIR}/../lib/libssh.a
-.endif
diff --git a/crypto/openssh/OVERVIEW b/crypto/openssh/OVERVIEW
deleted file mode 100644
index ff03ecab21b5..000000000000
--- a/crypto/openssh/OVERVIEW
+++ /dev/null
@@ -1,170 +0,0 @@
-[Note: This file has not been updated for OpenSSH versions after
-OpenSSH-1.2 and should be considered OBSOLETE.  It has been left in
-the distribution because some of its information may still be useful
-to developers.]
-
-This document is intended for those who wish to read the ssh source
-code.  This tries to give an overview of the structure of the code.
-      
-Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>
-Updated 17 Nov 1995.
-Updated 19 Oct 1999 for OpenSSH-1.2
-Updated 20 May 2001 note obsolete for > OpenSSH-1.2
-
-The software consists of ssh (client), sshd (server), scp, sdist, and
-the auxiliary programs ssh-keygen, ssh-agent, ssh-add, and
-make-ssh-known-hosts.  The main program for each of these is in a .c
-file with the same name.
-
-There are some subsystems/abstractions that are used by a number of
-these programs.
-
-  Buffer manipulation routines
-      
-    - These provide an arbitrary size buffer, where data can be appended.
-      Data can be consumed from either end.  The code is used heavily
-      throughout ssh.  The basic buffer manipulation functions are in
-      buffer.c (header buffer.h), and additional code to manipulate specific
-      data types is in bufaux.c.
-
-  Compression Library
-  
-    - Ssh uses the GNU GZIP compression library (ZLIB).
-
-  Encryption/Decryption
-
-    - Ssh contains several encryption algorithms.  These are all
-      accessed through the cipher.h interface.  The interface code is
-      in cipher.c, and the implementations are in libc.
-
-  Multiple Precision Integer Library
-
-    - Uses the SSLeay BIGNUM sublibrary.
-    - Some auxiliary functions for mp-int manipulation are in mpaux.c.
-
-  Random Numbers
-
-    - Uses arc4random() and such.
-
-  RSA key generation, encryption, decryption
-
-    - Ssh uses the RSA routines in libssl.
-
-  RSA key files
-
-    - RSA keys are stored in files with a special format.  The code to
-      read/write these files is in authfile.c.  The files are normally
-      encrypted with a passphrase.  The functions to read passphrases
-      are in readpass.c (the same code is used to read passwords).
-
-  Binary packet protocol
-
-    - The ssh binary packet protocol is implemented in packet.c.  The
-      code in packet.c does not concern itself with packet types or their
-      execution; it contains code to build packets, to receive them and
-      extract data from them, and the code to compress and/or encrypt
-      packets.  CRC code comes from crc32.c.
-
-    - The code in packet.c calls the buffer manipulation routines
-      (buffer.c, bufaux.c), compression routines (compress.c, zlib),
-      and the encryption routines.
-
-  X11, TCP/IP, and Agent forwarding
-
-    - Code for various types of channel forwarding is in channels.c.
-      The file defines a generic framework for arbitrary communication
-      channels inside the secure channel, and uses this framework to
-      implement X11 forwarding, TCP/IP forwarding, and authentication
-      agent forwarding.
-      The new, Protocol 1.5, channel close implementation is in nchan.c
-
-  Authentication agent
-
-    - Code to communicate with the authentication agent is in authfd.c.
-
-  Authentication methods
-
-    - Code for various authentication methods resides in auth-*.c
-      (auth-passwd.c, auth-rh-rsa.c, auth-rhosts.c, auth-rsa.c).  This
-      code is linked into the server.  The routines also manipulate
-      known hosts files using code in hostfile.c.  Code in canohost.c
-      is used to retrieve the canonical host name of the remote host.
-      Code in match.c is used to match host names.  
-
-    - In the client end, authentication code is in sshconnect.c.  It
-      reads Passwords/passphrases using code in readpass.c.  It reads
-      RSA key files with authfile.c.  It communicates the
-      authentication agent using authfd.c.
-
-  The ssh client
-
-    - The client main program is in ssh.c.  It first parses arguments
-      and reads configuration (readconf.c), then calls ssh_connect (in
-      sshconnect.c) to open a connection to the server (possibly via a
-      proxy), and performs authentication (ssh_login in sshconnect.c).
-      It then makes any pty, forwarding, etc. requests.  It may call
-      code in ttymodes.c to encode current tty modes.  Finally it
-      calls client_loop in clientloop.c.  This does the real work for
-      the session.
-
-    - The client is suid root.  It tries to temporarily give up this
-      rights while reading the configuration data.  The root
-      privileges are only used to make the connection (from a
-      privileged socket).  Any extra privileges are dropped before
-      calling ssh_login.
-
-  Pseudo-tty manipulation and tty modes
-
-    - Code to allocate and use a pseudo tty is in pty.c.  Code to
-      encode and set terminal modes is in ttymodes.c.
-
-  Logging in (updating utmp, lastlog, etc.)
-
-    - The code to do things that are done when a user logs in are in
-      login.c.  This includes things such as updating the utmp, wtmp,
-      and lastlog files.  Some of the code is in sshd.c.
-
-  Writing to the system log and terminal
-
-    - The programs use the functions fatal(), log(), debug(), error()
-      in many places to write messages to system log or user's
-      terminal.  The implementation that logs to system log is in
-      log-server.c; it is used in the server program.  The other
-      programs use an implementation that sends output to stderr; it
-      is in log-client.c.  The definitions are in ssh.h.
-
-  The sshd server (daemon)
-
-    - The sshd daemon starts by processing arguments and reading the
-      configuration file (servconf.c).  It then reads the host key,
-      starts listening for connections, and generates the server key.
-      The server key will be regenerated every hour by an alarm.
-
-    - When the server receives a connection, it forks, disables the
-      regeneration alarm, and starts communicating with the client.
-      They first perform identification string exchange, then
-      negotiate encryption, then perform authentication, preparatory
-      operations, and finally the server enters the normal session
-      mode by calling server_loop in serverloop.c.  This does the real
-      work, calling functions in other modules.
-      
-    - The code for the server is in sshd.c.  It contains a lot of
-      stuff, including:
-        - server main program
-	- waiting for connections
-	- processing new connection
-	- authentication
-	- preparatory operations
-	- building up the execution environment for the user program
-	- starting the user program.
-
-  Auxiliary files
-
-    - There are several other files in the distribution that contain
-      various auxiliary routines:
-        ssh.h	     the main header file for ssh (various definitions)
-        getput.h     byte-order independent storage of integers
-        includes.h   includes most system headers.  Lots of #ifdefs.
-	tildexpand.c expand tilde in file names
-	uidswap.c    uid-swapping
-	xmalloc.c    "safe" malloc routines
diff --git a/crypto/openssh/README b/crypto/openssh/README
deleted file mode 100644
index 5709fbeaf96a..000000000000
--- a/crypto/openssh/README
+++ /dev/null
@@ -1,66 +0,0 @@
-- A Japanese translation of this document and of the OpenSSH FAQ is 
-- available at http://www.unixuser.org/~haruyama/security/openssh/index.html
-- Thanks to HARUYAMA Seigo <haruyama@unixuser.org>
-
-This is the port of OpenBSD's excellent OpenSSH[0] to Linux and other
-Unices.
-
-OpenSSH is based on the last free version of Tatu Ylonen's sample
-implementation with all patent-encumbered algorithms removed (to
-external libraries), all known security bugs fixed, new features
-reintroduced and many other clean-ups.  OpenSSH has been created by
-Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, Theo de Raadt,
-and Dug Song. It has a homepage at http://www.openssh.com/
-
-This port consists of the re-introduction of autoconf support, PAM
-support (for Linux and Solaris), EGD[1]/PRNGD[2] support and replacements 
-for OpenBSD library functions that are (regrettably) absent from other 
-unices. This port has been best tested on Linux, Solaris, HP-UX, NetBSD, 
-Irix and AIX. Support for SCO, NeXT and other Unices is underway. 
-This version actively tracks changes in the OpenBSD CVS repository.
-
-The PAM support is now more functional than the popular packages of
-commercial ssh-1.2.x. It checks "account" and "session" modules for
-all logins, not just when using password authentication.
-
-OpenSSH depends on Zlib[3], OpenSSL[4] and optionally PAM[5].
-
-There is now several mailing lists for this port of OpenSSH. Please
-refer to http://www.openssh.com/list.html for details on how to join.
-
-Please send bug reports and patches to the mailing list
-openssh-unix-dev@mindrot.org. The list is open to posting by
-unsubscribed users.
-
-If you are a citizen of an USA-embargoed country to which export of 
-cryptographic products is restricted, then please refrain from sending 
-crypto-related code or patches to the list. We cannot accept them.
-Other code contribution are accepted, but please follow the OpenBSD
-style guidelines[6].
-
-Please refer to the INSTALL document for information on how to install
-OpenSSH on your system. There are a number of differences between this 
-port of OpenSSH and F-Secure SSH 1.x, please refer to the OpenSSH FAQ[7]
-for details and general tips.
-
-Damien Miller <djm@mindrot.org>
-
-Miscellania - 
-
-This version of OpenSSH is based upon code retrieved from the OpenBSD
-CVS repository which in turn was based on the last free sample
-implementation released by Tatu Ylonen.
-
-References -
-
-[0] http://www.openssh.com/faq.html
-[1] http://www.lothar.com/tech/crypto/
-[2] http://www.aet.tu-cottbus.de/personen/jaenicke/postfix_tls/prngd.html
-[3] http://www.gzip.org/zlib/
-[4] http://www.openssl.org/
-[5] http://www.kernel.org/pub/linux/libs/pam/ (PAM is standard on Solaris
-    and HP-UX 11)
-[6] http://www.openbsd.org/cgi-bin/man.cgi?query=style&sektion=9
-[7] http://www.openssh.com/faq.html
-
-$Id: README,v 1.51 2003/01/08 12:28:40 djm Exp $
diff --git a/crypto/openssh/README.openssh2 b/crypto/openssh/README.openssh2
deleted file mode 100644
index 12c90aa31690..000000000000
--- a/crypto/openssh/README.openssh2
+++ /dev/null
@@ -1,44 +0,0 @@
-$Id: README.openssh2,v 1.8 2000/05/07 18:30:03 markus Exp $
-
-howto:
-	1) generate server key:
-		$ ssh-keygen -d -f /etc/ssh_host_dsa_key -N ''
-	2) enable ssh2:
-		server: add 'Protocol 2,1' to /etc/sshd_config
-		client: ssh -o 'Protocol 2,1', or add to .ssh/config
-	3) DSA authentication similar to RSA (add keys to ~/.ssh/authorized_keys2)
-	   interop w/ ssh.com dsa-keys:
-		ssh-keygen -f /key/from/ssh.com -X >> ~/.ssh/authorized_keys2
-	   and vice versa
-		ssh-keygen -f /privatekey/from/openssh -x > ~/.ssh2/mykey.pub
-		echo Key mykey.pub >> ~/.ssh2/authorization
-
-works:
-	secsh-transport: works w/o rekey
-		proposal exchange, i.e. different enc/mac/comp per direction
-		encryption: blowfish-cbc, 3des-cbc, arcfour, cast128-cbc
-		mac: hmac-md5, hmac-sha1, (hmac-ripemd160)
-		compression: zlib, none
-	secsh-userauth: passwd and pubkey with DSA
-	secsh-connection: pty+shell or command, flow control works (window adjust)
-		tcp-forwarding: -L works, -R incomplete
-		x11-fwd
-	dss/dsa: host key database in ~/.ssh/known_hosts2
-	client interops w/ sshd2, lshd
-	server interops w/ ssh2, lsh, ssh.com's Windows client, SecureCRT, F-Secure SSH Client 4.0, SecureFX (secure ftp)
-	server supports multiple concurrent sessions (e.g. with SSH.com Windows client)
-todo:
-	re-keying
-	secsh-connection features:
-		 tcp-forwarding, agent-fwd
-	auth other than passwd, and DSA-pubkey:
-		 keyboard-interactive, (PGP-pubkey?)
-	config
-	server-auth w/ old host-keys
-	cleanup
-	advanced key storage?
-	keynote
-	sftp
-
--markus
-$Date: 2000/05/07 18:30:03 $
diff --git a/crypto/openssh/README.privsep b/crypto/openssh/README.privsep
deleted file mode 100644
index e8bf1db34c8a..000000000000
--- a/crypto/openssh/README.privsep
+++ /dev/null
@@ -1,65 +0,0 @@
-Privilege separation, or privsep, is method in OpenSSH by which
-operations that require root privilege are performed by a separate
-privileged monitor process.  Its purpose is to prevent privilege
-escalation by containing corruption to an unprivileged process.  
-More information is available at:
-	http://www.citi.umich.edu/u/provos/ssh/privsep.html
-
-Privilege separation is now enabled by default; see the
-UsePrivilegeSeparation option in sshd_config(5).
-
-On systems which lack mmap or anonymous (MAP_ANON) memory mapping, 
-compression must be disabled in order for privilege separation to 
-function.
-
-When privsep is enabled, during the pre-authentication phase sshd will
-chroot(2) to "/var/empty" and change its privileges to the "sshd" user
-and its primary group.  sshd is a pseudo-account that should not be
-used by other daemons, and must be locked and should contain a
-"nologin" or invalid shell.
-
-You should do something like the following to prepare the privsep
-preauth environment:
-
-	# mkdir /var/empty
-	# chown root:sys /var/empty
-	# chmod 755 /var/empty
-	# groupadd sshd
-	# useradd -g sshd -c 'sshd privsep' -d /var/empty -s /bin/false sshd
-
-/var/empty should not contain any files.
-
-configure supports the following options to change the default
-privsep user and chroot directory:
-
-  --with-privsep-path=xxx Path for privilege separation chroot
-  --with-privsep-user=user Specify non-privileged user for privilege separation
-
-Privsep requires operating system support for file descriptor passing.
-Compression will be disabled on systems without a working mmap MAP_ANON.
-
-PAM-enabled OpenSSH is known to function with privsep on Linux.  
-It does not function on HP-UX with a trusted system
-configuration.  PAMAuthenticationViaKbdInt does not function with
-privsep.
-
-On Compaq Tru64 Unix, only the pre-authentication part of privsep is
-supported.  Post-authentication privsep is disabled automatically (so
-you won't see the additional process mentioned below).
-
-Note that for a normal interactive login with a shell, enabling privsep
-will require 1 additional process per login session.
-
-Given the following process listing (from HP-UX):
-
-     UID   PID  PPID  C    STIME TTY       TIME COMMAND
-    root  1005     1  0 10:45:17 ?         0:08 /opt/openssh/sbin/sshd -u0
-    root  6917  1005  0 15:19:16 ?         0:00 sshd: stevesk [priv]
- stevesk  6919  6917  0 15:19:17 ?         0:03 sshd: stevesk@2
- stevesk  6921  6919  0 15:19:17 pts/2     0:00 -bash
-
-process 1005 is the sshd process listening for new connections.
-process 6917 is the privileged monitor process, 6919 is the user owned
-sshd process and 6921 is the shell process.
-
-$Id: README.privsep,v 1.11 2003/03/21 01:18:09 mouring Exp $
diff --git a/crypto/openssh/README.smartcard b/crypto/openssh/README.smartcard
deleted file mode 100644
index 29bec8dc64e9..000000000000
--- a/crypto/openssh/README.smartcard
+++ /dev/null
@@ -1,85 +0,0 @@
-How to use smartcards with OpenSSH?
-
-OpenSSH contains experimental support for authentication using Cyberflex
-smartcards and TODOS card readers, in addition to the cards with PKCS#15
-structure supported by OpenSC.
-
-WARNING: Smartcard support is still in development.
-Keyfile formats, etc are still subject to change.
-
-To enable sectok support:
-
-(1) install sectok:
-
-	Sources and instructions are available from
-	http://www.citi.umich.edu/projects/smartcard/sectok.html
-
-(2) enable sectok support in OpenSSH:
-
-	$ ./configure --with-sectok[=/path/to/libsectok] [options]
-
-(3) load the Java Cardlet to the Cyberflex card:
-
-	$ sectok
-	sectok> login -d
-	sectok> jload /usr/libdata/ssh/Ssh.bin
-	sectok> quit
-
-(4) load a RSA key to the card:
-
-	Please don't use your production RSA keys, since
-	with the current version of sectok/ssh-keygen
-	the private key file is still readable.
-
-	$ ssh-keygen -f /path/to/rsakey -U <readernum, eg. 0>
-
-	In spite of the name, this does not generate a key.
-	It just loads an already existing key on to the card.
-
-(5) optional:
-
-	Change the card password so that only you can
-	read the private key:
-
-	$ sectok
-	sectok> login -d
-	sectok> setpass
-	sectok> quit
-
-	This prevents reading the key but not use of the
-	key by the card applet.
-
-	Do not forget the passphrase.  There is no way to
-	recover if you do.
-
-	IMPORTANT WARNING: If you attempt to login with the
-	wrong passphrase three times in a row, you will
-	destroy your card.
-
-To enable OpenSC support:
-
-(1) install OpenSC:
-
-	Sources and instructions are available from
-	http://www.opensc.org/
-
-(2) enable OpenSC support in OpenSSH:
-
-	$ ./configure --with-opensc[=/path/to/opensc] [options]
-
-(3) load a RSA key to the card:
-
-	Not supported yet.
-
-Common smartcard options:
-
-(1) tell the ssh client to use the card reader:
-
-	$ ssh -I <readernum, eg. 0> otherhost
-
-(2) or tell the agent (don't forget to restart) to use the smartcard:
-
-	$ ssh-add -s <readernum, eg. 0>
-
--markus,
-Sat Apr 13 13:48:10 EEST 2002
diff --git a/crypto/openssh/RFC.nroff b/crypto/openssh/RFC.nroff
deleted file mode 100644
index bf7146a70f29..000000000000
--- a/crypto/openssh/RFC.nroff
+++ /dev/null
@@ -1,1780 +0,0 @@
-.\" -*- nroff -*-
-.\"
-.\" $OpenBSD: RFC.nroff,v 1.2 2000/10/16 09:38:44 djm Exp $
-.\"
-.pl 10.0i
-.po 0
-.ll 7.2i
-.lt 7.2i
-.nr LL 7.2i
-.nr LT 7.2i
-.ds LF Ylonen
-.ds RF FORMFEED[Page %]
-.ds CF
-.ds LH Internet-Draft
-.ds RH 15 November 1995
-.ds CH SSH (Secure Shell) Remote Login Protocol
-.na
-.hy 0
-.in 0
-Network Working Group					       T. Ylonen
-Internet-Draft			       Helsinki University of Technology
-draft-ylonen-ssh-protocol-00.txt			15 November 1995
-Expires: 15 May 1996
-
-.in 3
-
-.ce
-The SSH (Secure Shell) Remote Login Protocol
-
-.ti 0
-Status of This Memo
-
-This document is an Internet-Draft.   Internet-Drafts  are  working
-documents of the Internet Engineering Task Force (IETF), its areas,
-and its working groups.  Note that other groups may also distribute
-working documents as Internet-Drafts.
-
-Internet-Drafts are draft documents valid  for  a  maximum  of  six
-months  and  may  be updated, replaced, or obsoleted by other docu-
-ments at any time.  It is inappropriate to use  Internet-Drafts  as
-reference  material  or  to  cite them other than as ``work in pro-
-gress.''
-
-To learn the current status of any Internet-Draft, please check the
-``1id-abstracts.txt'' listing contained in the Internet- Drafts Shadow
-Directories on ftp.is.co.za (Africa), nic.nordu.net (Europe),
-munnari.oz.au (Pacific Rim), ds.internic.net (US East Coast), or
-ftp.isi.edu (US West Coast).
-
-The distribution of  this  memo  is  unlimited.
-
-.ti 0
-Introduction
-
-SSH (Secure Shell) is a program to log into another computer over a
-network, to execute commands in a remote machine, and to move files
-from one machine to another.  It provides strong authentication and
-secure communications over insecure networks.  Its features include
-the following:
-.IP o
-Closes several security holes (e.g., IP, routing, and DNS spoofing).
-New authentication methods: .rhosts together with RSA [RSA] based host
-authentication, and pure RSA authentication.
-.IP o
-All communications are automatically and transparently encrypted.
-Encryption is also used to protect integrity.
-.IP o
-X11 connection forwarding provides secure X11 sessions.
-.IP o
-Arbitrary TCP/IP ports can be redirected over the encrypted channel
-in both directions.
-.IP o
-Client RSA-authenticates the server machine in the beginning of every
-connection to prevent trojan horses (by routing or DNS spoofing) and
-man-in-the-middle attacks, and the server RSA-authenticates the client
-machine before accepting .rhosts or /etc/hosts.equiv authentication
-(to prevent DNS, routing, or IP spoofing).
-.IP o
-An authentication agent, running in the user's local workstation or
-laptop, can be used to hold the user's RSA authentication keys.
-.RT
-
-The goal has been to make the software as easy to use as possible for
-ordinary users.  The protocol has been designed to be as secure as
-possible while making it possible to create implementations that
-are easy to use and install.  The sample implementation has a number
-of convenient features that are not described in this document as they
-are not relevant for the protocol.
-
-
-.ti 0
-Overview of the Protocol
-
-The software consists of a server program running on a server machine,
-and a client program running on a client machine (plus a few auxiliary
-programs).  The machines are connected by an insecure IP [RFC0791]
-network (that can be monitored, tampered with, and spoofed by hostile
-parties).
-
-A connection is always initiated by the client side.  The server
-listens on a specific port waiting for connections.  Many clients may
-connect to the same server machine.
-
-The client and the server are connected via a TCP/IP [RFC0793] socket
-that is used for bidirectional communication.  Other types of
-transport can be used but are currently not defined.
-
-When the client connects the server, the server accepts the connection
-and responds by sending back its version identification string.  The
-client parses the server's identification, and sends its own
-identification.  The purpose of the identification strings is to
-validate that the connection was to the correct port, declare the
-protocol version number used, and to declare the software version used
-on each side (for debugging purposes).  The identification strings are
-human-readable.  If either side fails to understand or support the
-other side's version, it closes the connection.
-
-After the protocol identification phase, both sides switch to a packet
-based binary protocol.  The server starts by sending its host key
-(every host has an RSA key used to authenticate the host), server key
-(an RSA key regenerated every hour), and other information to the
-client.  The client then generates a 256 bit session key, encrypts it
-using both RSA keys (see below for details), and sends the encrypted
-session key and selected cipher type to the server.  Both sides then
-turn on encryption using the selected algorithm and key.  The server
-sends an encrypted confirmation message to the client.
-
-The client then authenticates itself using any of a number of
-authentication methods.  The currently supported authentication
-methods are .rhosts or /etc/hosts.equiv authentication (disabled by
-default), the same with RSA-based host authentication, RSA
-authentication, and password authentication.
-
-After successful authentication, the client makes a number of requests
-to prepare for the session.  Typical requests include allocating a
-pseudo tty, starting X11 [X11] or TCP/IP port forwarding, starting
-authentication agent forwarding, and executing the shell or a command.
-
-When a shell or command is executed, the connection enters interactive
-session mode.  In this mode, data is passed in both directions, 
-new forwarded connections may be opened, etc.  The interactive session
-normally terminates when the server sends the exit status of the
-program to the client.
-
-
-The protocol makes several reservations for future extensibility.
-First of all, the initial protocol identification messages include the
-protocol version number.  Second, the first packet by both sides
-includes a protocol flags field, which can be used to agree on
-extensions in a compatible manner.  Third, the authentication and
-session preparation phases work so that the client sends requests to
-the server, and the server responds with success or failure.  If the
-client sends a request that the server does not support, the server
-simply returns failure for it.  This permits compatible addition of
-new authentication methods and preparation operations.  The
-interactive session phase, on the other hand, works asynchronously and
-does not permit the use of any extensions (because there is no easy
-and reliable way to signal rejection to the other side and problems
-would be hard to debug).  Any compatible extensions to this phase must
-be agreed upon during any of the earlier phases.
-
-.ti 0
-The Binary Packet Protocol
-
-After the protocol identification strings, both sides only send
-specially formatted packets.  The packet layout is as follows:
-.IP o
-Packet length: 32 bit unsigned integer, coded as four 8-bit bytes, msb
-first.  Gives the length of the packet, not including the length field
-and padding.  The maximum length of a packet (not including the length
-field and padding) is 262144 bytes.
-.IP o
-Padding: 1-8 bytes of random data (or zeroes if not encrypting).  The
-amount of padding is (8 - (length % 8)) bytes (where % stands for the
-modulo operator).  The rationale for always having some random padding
-at the beginning of each packet is to make known plaintext attacks
-more difficult.
-.IP o
-Packet type: 8-bit unsigned byte.  The value 255 is reserved for
-future extension.
-.IP o
-Data: binary data bytes, depending on the packet type.  The number of
-data bytes is the "length" field minus 5.
-.IP o
-Check bytes: 32-bit crc, four 8-bit bytes, msb first.  The crc is the
-Cyclic Redundancy Check, with the polynomial 0xedb88320, of the
-Padding, Packet type, and Data fields.  The crc is computed before
-any encryption.
-.RT
-
-The packet, except for the length field, may be encrypted using any of
-a number of algorithms.  The length of the encrypted part (Padding +
-Type + Data + Check) is always a multiple of 8 bytes.  Typically the
-cipher is used in a chained mode, with all packets chained together as
-if it was a single data stream (the length field is never included in
-the encryption process).  Details of encryption are described below.
-
-When the session starts, encryption is turned off.  Encryption is
-enabled after the client has sent the session key.  The encryption
-algorithm to use is selected by the client.
-
-
-.ti 0
-Packet Compression
-
-If compression is supported (it is an optional feature, see
-SSH_CMSG_REQUEST_COMPRESSION below), the packet type and data fields
-of the packet are compressed using the gzip deflate algorithm [GZIP].
-If compression is in effect, the packet length field indicates the
-length of the compressed data, plus 4 for the crc.  The amount of
-padding is computed from the compressed data, so that the amount of
-data to be encrypted becomes a multiple of 8 bytes.
-
-When compressing, the packets (type + data portions) in each direction
-are compressed as if they formed a continuous data stream, with only the
-current compression block flushed between packets.  This corresponds
-to the GNU ZLIB library Z_PARTIAL_FLUSH option.  The compression
-dictionary is not flushed between packets.  The two directions are
-compressed independently of each other.
-
-
-.ti 0
-Packet Encryption
-
-The protocol supports several encryption methods.  During session
-initialization, the server sends a bitmask of all encryption methods
-that it supports, and the client selects one of these methods.  The
-client also generates a 256-bit random session key (32 8-bit bytes) and
-sends it to the server.
-
-The encryption methods supported by the current implementation, and
-their codes are:
-.TS
-center;
-l r l.
-SSH_CIPHER_NONE	0	   No encryption
-SSH_CIPHER_IDEA	1	   IDEA in CFB mode
-SSH_CIPHER_DES	2	   DES in CBC mode
-SSH_CIPHER_3DES	3	   Triple-DES in CBC mode
-SSH_CIPHER_TSS	4	   An experimental stream cipher
-SSH_CIPHER_RC4	5	   RC4
-.TE
-
-All implementations are required to support SSH_CIPHER_DES and
-SSH_CIPHER_3DES.  Supporting SSH_CIPHER_IDEA, SSH_CIPHER_RC4, and
-SSH_CIPHER_NONE is recommended.  Support for SSH_CIPHER_TSS is
-optional (and it is not described in this document).  Other ciphers
-may be added at a later time; support for them is optional.
-
-For encryption, the encrypted portion of the packet is considered a
-linear byte stream.  The length of the stream is always a multiple of
-8.  The encrypted portions of consecutive packets (in the same
-direction) are encrypted as if they were a continuous buffer (that is,
-any initialization vectors are passed from the previous packet to the
-next packet).  Data in each direction is encrypted independently.
-.IP SSH_CIPHER_DES
-The key is taken from the first 8 bytes of the session key.  The least
-significant bit of each byte is ignored.  This results in 56 bits of
-key data.  DES [DES] is used in CBC mode.  The iv (initialization vector) is
-initialized to all zeroes.
-.IP SSH_CIPHER_3DES
-The variant of triple-DES used here works as follows: there are three
-independent DES-CBC ciphers, with independent initialization vectors.
-The data (the whole encrypted data stream) is first encrypted with the
-first cipher, then decrypted with the second cipher, and finally
-encrypted with the third cipher.  All these operations are performed
-in CBC mode.
-
-The key for the first cipher is taken from the first 8 bytes of the
-session key; the key for the next cipher from the next 8 bytes, and
-the key for the third cipher from the following 8 bytes.  All three
-initialization vectors are initialized to zero.
-
-(Note: the variant of 3DES used here differs from some other
-descriptions.)
-.IP SSH_CIPHER_IDEA
-The key is taken from the first 16 bytes of the session key.  IDEA
-[IDEA] is used in CFB mode.  The initialization vector is initialized
-to all zeroes.
-.IP SSH_CIPHER_TSS
-All 32 bytes of the session key are used as the key.
-
-There is no reference available for the TSS algorithm; it is currently
-only documented in the sample implementation source code.  The
-security of this cipher is unknown (but it is quite fast).  The cipher
-is basically a stream cipher that uses MD5 as a random number
-generator and takes feedback from the data.
-.IP SSH_CIPHER_RC4
-The first 16 bytes of the session key are used as the key for the
-server to client direction.  The remaining 16 bytes are used as the
-key for the client to server direction.  This gives independent
-128-bit keys for each direction.
-
-This algorithm is the alleged RC4 cipher posted to the Usenet in 1995.
-It is widely believed to be equivalent with the original RSADSI RC4
-cipher.  This is a very fast algorithm.
-.RT
-
-
-.ti 0
-Data Type Encodings
-
-The Data field of each packet contains data encoded as described in
-this section.  There may be several data items; each item is coded as
-described here, and their representations are concatenated together
-(without any alignment or padding).
-
-Each data type is stored as follows:
-.IP "8-bit byte"
-The byte is stored directly as a single byte.
-.IP "32-bit unsigned integer"
-Stored in 4 bytes, msb first.
-.IP "Arbitrary length binary string"
-First 4 bytes are the length of the string, msb first (not including
-the length itself).  The following "length" bytes are the string
-value.  There are no terminating null characters.
-.IP "Multiple-precision integer"
-First 2 bytes are the number of bits in the integer, msb first (for
-example, the value 0x00012345 would have 17 bits).  The value zero has
-zero bits.  It is permissible that the number of bits be larger than the
-real number of bits.
-
-The number of bits is followed by (bits + 7) / 8 bytes of binary data,
-msb first, giving the value of the integer.
-.RT
-
-
-.ti 0
-TCP/IP Port Number and Other Options
-
-The server listens for connections on TCP/IP port 22.
-
-The client may connect the server from any port.  However, if the
-client wishes to use any form of .rhosts or /etc/hosts.equiv
-authentication, it must connect from a privileged port (less than
-1024).
-
-For the IP Type of Service field [RFC0791], it is recommended that
-interactive sessions (those having a user terminal or forwarding X11
-connections) use the IPTOS_LOWDELAY, and non-interactive connections
-use IPTOS_THROUGHPUT.
-
-It is recommended that keepalives are used, because otherwise programs
-on the server may never notice if the other end of the connection is
-rebooted.
-
-
-.ti 0
-Protocol Version Identification
-
-After the socket is opened, the server sends an identification string,
-which is of the form
-"SSH-<protocolmajor>.<protocolminor>-<version>\\n", where
-<protocolmajor> and <protocolminor> are integers and specify the
-protocol version number (not software distribution version).
-<version> is server side software version string (max 40 characters);
-it is not interpreted by the remote side but may be useful for
-debugging.
-
-The client parses the server's string, and sends a corresponding
-string with its own information in response.  If the server has lower
-version number, and the client contains special code to emulate it,
-the client responds with the lower number; otherwise it responds with
-its own number.  The server then compares the version number the
-client sent with its own, and determines whether they can work
-together.  The server either disconnects, or sends the first packet
-using the binary packet protocol and both sides start working
-according to the lower of the protocol versions.
-
-By convention, changes which keep the protocol compatible with
-previous versions keep the same major protocol version; changes that
-are not compatible increment the major version (which will hopefully
-never happen).  The version described in this document is 1.3.
-
-The client will 
-
-.ti 0
-Key Exchange and Server Host Authentication
-
-The first message sent by the server using the packet protocol is
-SSH_SMSG_PUBLIC_KEY.  It declares the server's host key, server public
-key, supported ciphers, supported authentication methods, and flags
-for protocol extensions.  It also contains a 64-bit random number
-(cookie) that must be returned in the client's reply (to make IP
-spoofing more difficult).  No encryption is used for this message.
-
-Both sides compute a session id as follows.  The modulus of the server
-key is interpreted as a byte string (without explicit length field,
-with minimum length able to hold the whole value), most significant
-byte first.  This string is concatenated with the server host key
-interpreted the same way.  Additionally, the cookie is concatenated
-with this.  Both sides compute MD5 of the resulting string.  The
-resulting 16 bytes (128 bits) are stored by both parties and are
-called the session id.
-
-The client responds with a SSH_CMSG_SESSION_KEY message, which
-contains the selected cipher type, a copy of the 64-bit cookie sent by
-the server, client's protocol flags, and a session key encrypted
-with both the server's host key and server key.  No encryption is used
-for this message.
-
-The session key is 32 8-bit bytes (a total of 256 random bits
-generated by the client).  The client first xors the 16 bytes of the
-session id with the first 16 bytes of the session key.  The resulting
-string is then encrypted using the smaller key (one with smaller
-modulus), and the result is then encrypted using the other key.  The
-number of bits in the public modulus of the two keys must differ by at
-least 128 bits.
-
-At each encryption step, a multiple-precision integer is constructed
-from the data to be encrypted as follows (the integer is here
-interpreted as a sequence of bytes, msb first; the number of bytes is
-the number of bytes needed to represent the modulus).
-
-The most significant byte (which is only partial as the value must be
-less than the public modulus, which is never a power of two) is zero.
-
-The next byte contains the value 2 (which stands for public-key
-encrypted data in the PKCS standard [PKCS#1]).  Then, there are
-non-zero random bytes to fill any unused space, a zero byte, and the
-data to be encrypted in the least significant bytes, the last byte of
-the data in the least significant byte.
-
-This algorithm is used twice.  First, it is used to encrypt the 32
-random bytes generated by the client to be used as the session key
-(xored by the session id).  This value is converted to an integer as
-described above, and encrypted with RSA using the key with the smaller
-modulus.  The resulting integer is converted to a byte stream, msb
-first.  This byte stream is padded and encrypted identically using the
-key with the larger modulus.
-
-After the client has sent the session key, it starts to use the
-selected algorithm and key for decrypting any received packets, and
-for encrypting any sent packets.  Separate ciphers are used for
-different directions (that is, both directions have separate
-initialization vectors or other state for the ciphers).
-
-When the server has received the session key message, and has turned
-on encryption, it sends a SSH_SMSG_SUCCESS message to the client.
-
-The recommended size of the host key is 1024 bits, and 768 bits for
-the server key.  The minimum size is 512 bits for the smaller key.
-
-
-.ti 0
-Declaring the User Name
-
-The client then sends a SSH_CMSG_USER message to the server.  This
-message specifies the user name to log in as.
-
-The server validates that such a user exists, checks whether
-authentication is needed, and responds with either SSH_SMSG_SUCCESS or
-SSH_SMSG_FAILURE.  SSH_SMSG_SUCCESS indicates that no authentication
-is needed for this user (no password), and authentication phase has
-now been completed.  SSH_SMSG_FAILURE indicates that authentication is
-needed (or the user does not exist).
-
-If the user does not exist, it is recommended that this returns
-failure, but the server keeps reading messages from the client, and
-responds to any messages (except SSH_MSG_DISCONNECT, SSH_MSG_IGNORE,
-and SSH_MSG_DEBUG) with SSH_SMSG_FAILURE.  This way the client cannot
-be certain whether the user exists.
-
-
-.ti 0
-Authentication Phase
-
-Provided the server didn't immediately accept the login, an
-authentication exchange begins.  The client sends messages to the
-server requesting different types of authentication in arbitrary order as
-many times as desired (however, the server may close the connection
-after a timeout).  The server always responds with SSH_SMSG_SUCCESS if
-it has accepted the authentication, and with SSH_SMSG_FAILURE if it has
-denied authentication with the requested method or it does not
-recognize the message.  Some authentication methods cause an exchange
-of further messages before the final result is sent.  The
-authentication phase ends when the server responds with success.
-
-The recommended value for the authentication timeout (timeout before
-disconnecting if no successful authentication has been made) is 5
-minutes.
-
-The following authentication methods are currently supported:
-.TS
-center;
-l r l.
-SSH_AUTH_RHOSTS	1	.rhosts or /etc/hosts.equiv
-SSH_AUTH_RSA	2	pure RSA authentication
-SSH_AUTH_PASSWORD	3	password authentication
-SSH_AUTH_RHOSTS_RSA	4	.rhosts with RSA host authentication
-.TE
-.IP SSH_AUTH_RHOSTS
-
-This is the authentication method used by rlogin and rsh [RFC1282].
-
-The client sends SSH_CMSG_AUTH_RHOSTS with the client-side user name
-as an argument.
-
-The server checks whether to permit authentication.  On UNIX systems,
-this is usually done by checking /etc/hosts.equiv, and .rhosts in the
-user's home directory.  The connection must come from a privileged
-port.
-
-It is recommended that the server checks that there are no IP options
-(such as source routing) specified for the socket before accepting
-this type of authentication.  The client host name should be
-reverse-mapped and then forward mapped to ensure that it has the
-proper IP-address.
-
-This authentication method trusts the remote host (root on the remote
-host can pretend to be any other user on that host), the name
-services, and partially the network: anyone who can see packets coming
-out from the server machine can do IP-spoofing and pretend to be any
-machine; however, the protocol prevents blind IP-spoofing (which used
-to be possible with rlogin).
-
-Many sites probably want to disable this authentication method because
-of the fundamental insecurity of conventional .rhosts or
-/etc/hosts.equiv authentication when faced with spoofing.  It is
-recommended that this method not be supported by the server by
-default.
-.IP SSH_AUTH_RHOSTS_RSA
-
-In addition to conventional .rhosts and hosts.equiv authentication,
-this method additionally requires that the client host be
-authenticated using RSA.
-
-The client sends SSH_CMSG_AUTH_RHOSTS_RSA specifying the client-side
-user name, and the public host key of the client host.
-
-The server first checks if normal .rhosts or /etc/hosts.equiv
-authentication would be accepted, and if not, responds with
-SSH_SMSG_FAILURE.  Otherwise, it checks whether it knows the host key
-for the client machine (using the same name for the host that was used
-for checking the .rhosts and /etc/hosts.equiv files).  If it does not
-know the RSA key for the client, access is denied and SSH_SMSG_FAILURE
-is sent.
-
-If the server knows the host key of the client machine, it verifies
-that the given host key matches that known for the client.  If not,
-access is denied and SSH_SMSG_FAILURE is sent.
-
-The server then sends a SSH_SMSG_AUTH_RSA_CHALLENGE message containing
-an encrypted challenge for the client.  The challenge is 32 8-bit
-random bytes (256 bits).  When encrypted, the highest (partial) byte
-is left as zero, the next byte contains the value 2, the following are
-non-zero random bytes, followed by a zero byte, and the challenge put
-in the remaining bytes.  This is then encrypted using RSA with the
-client host's public key.  (The padding and encryption algorithm is
-the same as that used for the session key.)
-
-The client decrypts the challenge using its private host key,
-concatenates this with the session id, and computes an MD5 checksum
-of the resulting 48 bytes.  The MD5 output is returned as 16 bytes in
-a SSH_CMSG_AUTH_RSA_RESPONSE message.  (MD5 is used to deter chosen
-plaintext attacks against RSA; the session id binds it to a specific
-session).
-
-The server verifies that the MD5 of the decrypted challenge returned by
-the client matches that of the original value, and sends SSH_SMSG_SUCCESS if
-so.  Otherwise it sends SSH_SMSG_FAILURE and refuses the
-authentication attempt.
-
-This authentication method trusts the client side machine in that root
-on that machine can pretend to be any user on that machine.
-Additionally, it trusts the client host key.  The name and/or IP
-address of the client host is only used to select the public host key.
-The same host name is used when scanning .rhosts or /etc/hosts.equiv
-and when selecting the host key.  It would in principle be possible to
-eliminate the host name entirely and substitute it directly by the
-host key.  IP and/or DNS [RFC1034] spoofing can only be used
-to pretend to be a host for which the attacker has the private host
-key.
-.IP SSH_AUTH_RSA
-
-The idea behind RSA authentication is that the server recognizes the
-public key offered by the client, generates a random challenge, and
-encrypts the challenge with the public key.  The client must then
-prove that it has the corresponding private key by decrypting the
-challenge.
-
-The client sends SSH_CMSG_AUTH_RSA with public key modulus (n) as an
-argument.
-
-The server may respond immediately with SSH_SMSG_FAILURE if it does
-not permit authentication with this key.  Otherwise it generates a
-challenge, encrypts it using the user's public key (stored on the
-server and identified using the modulus), and sends
-SSH_SMSG_AUTH_RSA_CHALLENGE with the challenge (mp-int) as an
-argument.
-
-The challenge is 32 8-bit random bytes (256 bits).  When encrypted,
-the highest (partial) byte is left as zero, the next byte contains the
-value 2, the following are non-zero random bytes, followed by a zero
-byte, and the challenge put in the remaining bytes.  This is then
-encrypted with the public key.  (The padding and encryption algorithm
-is the same as that used for the session key.)
-
-The client decrypts the challenge using its private key, concatenates
-it with the session id, and computes an MD5 checksum of the resulting
-48 bytes.  The MD5 output is returned as 16 bytes in a
-SSH_CMSG_AUTH_RSA_RESPONSE message.  (Note that the MD5 is necessary
-to avoid chosen plaintext attacks against RSA; the session id binds it
-to a specific session.)
-
-The server verifies that the MD5 of the decrypted challenge returned
-by the client matches that of the original value, and sends
-SSH_SMSG_SUCCESS if so.  Otherwise it sends SSH_SMSG_FAILURE and
-refuses the authentication attempt.
-
-This authentication method does not trust the remote host, the
-network, name services, or anything else.  Authentication is based
-solely on the possession of the private identification keys.  Anyone
-in possession of the private keys can log in, but nobody else.
-
-The server may have additional requirements for a successful
-authentiation.  For example, to limit damage due to a compromised RSA
-key, a server might restrict access to a limited set of hosts.
-.IP SSH_AUTH_PASSWORD
-
-The client sends a SSH_CMSG_AUTH_PASSWORD message with the plain text
-password.  (Note that even though the password is plain text inside
-the message, it is normally encrypted by the packet mechanism.)
-
-The server verifies the password, and sends SSH_SMSG_SUCCESS if
-authentication was accepted and SSH_SMSG_FAILURE otherwise.
-
-Note that the password is read from the user by the client; the user
-never interacts with a login program.
-
-This authentication method does not trust the remote host, the
-network, name services or anything else.  Authentication is based
-solely on the possession of the password.  Anyone in possession of the
-password can log in, but nobody else.
-.RT
-
-.ti 0
-Preparatory Operations
-
-After successful authentication, the server waits for a request from
-the client, processes the request, and responds with SSH_SMSG_SUCCESS
-whenever a request has been successfully processed.  If it receives a
-message that it does not recognize or it fails to honor a request, it
-returns SSH_SMSG_FAILURE.  It is expected that new message types might
-be added to this phase in future.
-
-The following messages are currently defined for this phase.
-.IP SSH_CMSG_REQUEST_COMPRESSION
-Requests that compression be enabled for this session.  A
-gzip-compatible compression level (1-9) is passed as an argument.
-.IP SSH_CMSG_REQUEST_PTY
-Requests that a pseudo terminal device be allocated for this session.
-The user terminal type and terminal modes are supplied as arguments.
-.IP SSH_CMSG_X11_REQUEST_FORWARDING
-Requests forwarding of X11 connections from the remote machine to the
-local machine over the secure channel.  Causes an internet-domain
-socket to be allocated and the DISPLAY variable to be set on the server.
-X11 authentication data is automatically passed to the server, and the
-client may implement spoofing of authentication data for added
-security.  The authentication data is passed as arguments.
-.IP SSH_CMSG_PORT_FORWARD_REQUEST
-Requests forwarding of a TCP/IP port on the server host over the
-secure channel.  What happens is that whenever a connection is made to
-the port on the server, a connection will be made from the client end
-to the specified host/port.  Any user can forward unprivileged ports;
-only the root can forward privileged ports (as determined by
-authentication done earlier).
-.IP SSH_CMSG_AGENT_REQUEST_FORWARDING
-Requests forwarding of the connection to the authentication agent.
-.IP SSH_CMSG_EXEC_SHELL
-Starts a shell (command interpreter) for the user, and moves into
-interactive session mode.
-.IP SSH_CMSG_EXEC_CMD
-Executes the given command (actually "<shell> -c <command>" or
-equivalent) for the user, and moves into interactive session mode.
-.RT
-
-
-.ti 0
-Interactive Session and Exchange of Data
-
-During the interactive session, any data written by the shell or
-command running on the server machine is forwarded to stdin or
-stderr on the client machine, and any input available from stdin on
-the client machine is forwarded to the program on the server machine.
-
-All exchange is asynchronous; either side can send at any time, and
-there are no acknowledgements (TCP/IP already provides reliable
-transport, and the packet protocol protects against tampering or IP
-spoofing).
-
-When the client receives EOF from its standard input, it will send
-SSH_CMSG_EOF; however, this in no way terminates the exchange.  The
-exchange terminates and interactive mode is left when the server sends
-SSH_SMSG_EXITSTATUS to indicate that the client program has
-terminated.  Alternatively, either side may disconnect at any time by
-sending SSH_MSG_DISCONNECT or closing the connection.
-
-The server may send any of the following messages:
-.IP SSH_SMSG_STDOUT_DATA
-Data written to stdout by the program running on the server.  The data
-is passed as a string argument.  The client writes this data to
-stdout.
-.IP SSH_SMSG_STDERR_DATA
-Data written to stderr by the program running on the server.  The data
-is passed as a string argument.  The client writes this data to
-stderr.  (Note that if the program is running on a tty, it is not
-possible to separate stdout and stderr data, and all data will be sent
-as stdout data.)
-.IP SSH_SMSG_EXITSTATUS
-Indicates that the shell or command has exited.  Exit status is passed
-as an integer argument.  This message causes termination of the
-interactive session.
-.IP SSH_SMSG_AGENT_OPEN
-Indicates that someone on the server side is requesting a connection
-to the authentication agent.  The server-side channel number is passed
-as an argument.  The client must respond with either
-SSH_CHANNEL_OPEN_CONFIRMATION or SSH_CHANNEL_OPEN_FAILURE.
-.IP SSH_SMSG_X11_OPEN
-Indicates that a connection has been made to the X11 socket on the
-server side and should be forwarded to the real X server.  An integer
-argument indicates the channel number allocated for this connection on
-the server side.  The client should send back either
-SSH_MSG_CHANNEL_OPEN_CONFIRMATION or SSH_MSG_CHANNEL_OPEN_FAILURE with
-the same server side channel number.
-.IP SSH_MSG_PORT_OPEN
-Indicates that a connection has been made to a port on the server side
-for which forwarding has been requested.  Arguments are server side
-channel number, host name to connect to, and port to connect to.  The
-client should send back either
-SSH_MSG_CHANNEL_OPEN_CONFIRMATION or SSH_MSG_CHANNEL_OPEN_FAILURE with
-the same server side channel number.
-.IP SSH_MSG_CHANNEL_OPEN_CONFIRMATION
-This is sent by the server to indicate that it has opened a connection
-as requested in a previous message.  The first argument indicates the
-client side channel number, and the second argument is the channel number
-that the server has allocated for this connection.
-.IP SSH_MSG_CHANNEL_OPEN_FAILURE
-This is sent by the server to indicate that it failed to open a
-connection as requested in a previous message.  The client-side
-channel number is passed as an argument.  The client will close the
-descriptor associated with the channel and free the channel.
-.IP SSH_MSG_CHANNEL_DATA
-This packet contains data for a channel from the server.  The first
-argument is the client-side channel number, and the second argument (a
-string) is the data.
-.IP SSH_MSG_CHANNEL_CLOSE
-This is sent by the server to indicate that whoever was in the other
-end of the channel has closed it.  The argument is the client side channel
-number.  The client will let all buffered data in the channel to
-drain, and when ready, will close the socket, free the channel, and
-send the server a SSH_MSG_CHANNEL_CLOSE_CONFIRMATION message for the
-channel.
-.IP SSH_MSG_CHANNEL_CLOSE_CONFIRMATION
-This is send by the server to indicate that a channel previously
-closed by the client has now been closed on the server side as well.
-The argument indicates the client channel number.  The client frees
-the channel.
-.RT
-
-The client may send any of the following messages:
-.IP SSH_CMSG_STDIN_DATA
-This is data to be sent as input to the program running on the server.
-The data is passed as a string.
-.IP SSH_CMSG_EOF
-Indicates that the client has encountered EOF while reading standard
-input.  The server will allow any buffered input data to drain, and
-will then close the input to the program.
-.IP SSH_CMSG_WINDOW_SIZE
-Indicates that window size on the client has been changed.  The server
-updates the window size of the tty and causes SIGWINCH to be sent to
-the program.  The new window size is passed as four integer arguments:
-row, col, xpixel, ypixel.
-.IP SSH_MSG_PORT_OPEN
-Indicates that a connection has been made to a port on the client side
-for which forwarding has been requested.  Arguments are client side
-channel number, host name to connect to, and port to connect to.  The
-server should send back either SSH_MSG_CHANNEL_OPEN_CONFIRMATION or
-SSH_MSG_CHANNEL_OPEN_FAILURE with the same client side channel number.
-.IP SSH_MSG_CHANNEL_OPEN_CONFIRMATION
-This is sent by the client to indicate that it has opened a connection
-as requested in a previous message.  The first argument indicates the
-server side channel number, and the second argument is the channel
-number that the client has allocated for this connection.
-.IP SSH_MSG_CHANNEL_OPEN_FAILURE
-This is sent by the client to indicate that it failed to open a
-connection as requested in a previous message.  The server side
-channel number is passed as an argument.  The server will close the
-descriptor associated with the channel and free the channel.
-.IP SSH_MSG_CHANNEL_DATA
-This packet contains data for a channel from the client.  The first
-argument is the server side channel number, and the second argument (a
-string) is the data.
-.IP SSH_MSG_CHANNEL_CLOSE
-This is sent by the client to indicate that whoever was in the other
-end of the channel has closed it.  The argument is the server channel
-number.  The server will allow buffered data to drain, and when ready,
-will close the socket, free the channel, and send the client a
-SSH_MSG_CHANNEL_CLOSE_CONFIRMATION message for the channel.
-.IP SSH_MSG_CHANNEL_CLOSE_CONFIRMATION
-This is send by the client to indicate that a channel previously
-closed by the server has now been closed on the client side as well.
-The argument indicates the server channel number.  The server frees
-the channel.
-.RT
-
-Any unsupported messages during interactive mode cause the connection
-to be terminated with SSH_MSG_DISCONNECT and an error message.
-Compatible protocol upgrades should agree about any extensions during
-the preparation phase or earlier.
-
-
-.ti 0
-Termination of the Connection
-
-Normal termination of the connection is always initiated by the server
-by sending SSH_SMSG_EXITSTATUS after the program has exited.  The
-client responds to this message by sending SSH_CMSG_EXIT_CONFIRMATION
-and closes the socket; the server then closes the socket.  There are
-two purposes for the confirmation: some systems may lose previously
-sent data when the socket is closed, and closing the client side first
-causes any TCP/IP TIME_WAIT [RFC0793] waits to occur on the client side, not
-consuming server resources.
-
-If the program terminates due to a signal, the server will send
-SSH_MSG_DISCONNECT with an appropriate message.  If the connection is
-closed, all file descriptors to the program will be closed and the
-server will exit.  If the program runs on a tty, the kernel sends it
-the SIGHUP signal when the pty master side is closed.
-
-.ti 0
-Protocol Flags
-
-Both the server and the client pass 32 bits of protocol flags to the
-other side.  The flags are intended for compatible protocol extension;
-the server first announces which added capabilities it supports, and
-the client then sends the capabilities that it supports.
-
-The following flags are currently defined (the values are bit masks):
-.IP "1 SSH_PROTOFLAG_SCREEN_NUMBER"
-This flag can only be sent by the client.  It indicates that the X11
-forwarding requests it sends will include the screen number.
-.IP "2 SSH_PROTOFLAG_HOST_IN_FWD_OPEN"
-If both sides specify this flag, SSH_SMSG_X11_OPEN and
-SSH_MSG_PORT_OPEN messages will contain an additional field containing
-a description of the host at the other end of the connection.
-.RT
-
-.ti 0
-Detailed Description of Packet Types and Formats
-
-The supported packet types and the corresponding message numbers are
-given in the following table.  Messages with _MSG_ in their name may
-be sent by either side.  Messages with _CMSG_ are only sent by the
-client, and messages with _SMSG_ only by the server.
-
-A packet may contain additional data after the arguments specified
-below.  Any such data should be ignored by the receiver.  However, it
-is recommended that no such data be stored without good reason.  (This
-helps build compatible extensions.)
-.IP "0 SSH_MSG_NONE"
-This code is reserved.  This message type is never sent.
-.IP "1 SSH_MSG_DISCONNECT"
-.TS
-;
-l l.
-string	Cause of disconnection
-.TE
-This message may be sent by either party at any time.  It causes the
-immediate disconnection of the connection.  The message is intended to
-be displayed to a human, and describes the reason for disconnection.
-.IP "2 SSH_SMSG_PUBLIC_KEY"
-.TS
-;
-l l.
-8 bytes	anti_spoofing_cookie
-32-bit int	server_key_bits
-mp-int	server_key_public_exponent
-mp-int	server_key_public_modulus
-32-bit int	host_key_bits
-mp-int	host_key_public_exponent
-mp-int	host_key_public_modulus
-32-bit int	protocol_flags
-32-bit int	supported_ciphers_mask
-32-bit int	supported_authentications_mask
-.TE
-Sent as the first message by the server.  This message gives the
-server's host key, server key, protocol flags (intended for compatible
-protocol extension), supported_ciphers_mask (which is the
-bitwise or of (1 << cipher_number), where << is the left shift
-operator, for all supported ciphers), and
-supported_authentications_mask (which is the bitwise or of (1 <<
-authentication_type) for all supported authentication types).  The
-anti_spoofing_cookie is 64 random bytes, and must be sent back
-verbatim by the client in its reply.  It is used to make IP-spoofing
-more difficult (encryption and host keys are the real defense against
-spoofing).
-.IP "3 SSH_CMSG_SESSION_KEY"
-.TS
-;
-l l.
-1 byte	cipher_type (must be one of the supported values)
-8 bytes	anti_spoofing_cookie (must match data sent by the server)
-mp-int	double-encrypted session key
-32-bit int	protocol_flags
-.TE
-Sent by the client as the first message in the session.  Selects the
-cipher to use, and sends the encrypted session key to the server.  The
-anti_spoofing_cookie must be the same bytes that were sent by the
-server.  Protocol_flags is intended for negotiating compatible
-protocol extensions.
-.IP "4 SSH_CMSG_USER"
-.TS
-;
-l l.
-string	user login name on server
-.TE
-Sent by the client to begin authentication.  Specifies the user name
-on the server to log in as.  The server responds with SSH_SMSG_SUCCESS
-if no authentication is needed for this user, or SSH_SMSG_FAILURE if
-authentication is needed (or the user does not exist).  [Note to the
-implementator: the user name is of arbitrary size.  The implementation
-must be careful not to overflow internal buffers.]
-.IP "5 SSH_CMSG_AUTH_RHOSTS"
-.TS
-;
-l l.
-string	client-side user name
-.TE
-Requests authentication using /etc/hosts.equiv and .rhosts (or
-equivalent mechanisms).  This authentication method is normally
-disabled in the server because it is not secure (but this is the
-method used by rsh and rlogin).  The server responds with
-SSH_SMSG_SUCCESS if authentication was successful, and
-SSH_SMSG_FAILURE if access was not granted.  The server should check
-that the client side port number is less than 1024 (a privileged
-port), and immediately reject authentication if it is not.  Supporting
-this authentication method is optional.  This method should normally
-not be enabled in the server because it is not safe.  (However, not
-enabling this only helps if rlogind and rshd are disabled.)
-.IP "6 SSH_CMSG_AUTH_RSA"
-.TS
-;
-l l.
-mp-int	identity_public_modulus
-.TE
-Requests authentication using pure RSA authentication.  The server
-checks if the given key is permitted to log in, and if so, responds
-with SSH_SMSG_AUTH_RSA_CHALLENGE.  Otherwise, it responds with
-SSH_SMSG_FAILURE.  The client often tries several different keys in
-sequence until one supported by the server is found.  Authentication
-is accepted if the client gives the correct response to the challenge.
-The server is free to add other criteria for authentication, such as a
-requirement that the connection must come from a certain host.  Such
-additions are not visible at the protocol level.  Supporting this
-authentication method is optional but recommended.
-.IP "7 SSH_SMSG_AUTH_RSA_CHALLENGE"
-.TS
-;
-l l.
-mp-int	encrypted challenge
-.TE
-Presents an RSA authentication challenge to the client.  The challenge
-is a 256-bit random value encrypted as described elsewhere in this
-document.  The client must decrypt the challenge using the RSA private
-key, compute MD5 of the challenge plus session id, and send back the
-resulting 16 bytes using SSH_CMSG_AUTH_RSA_RESPONSE.
-.IP "8 SSH_CMSG_AUTH_RSA_RESPONSE"
-.TS
-;
-l l.
-16 bytes	MD5 of decrypted challenge
-.TE
-This message is sent by the client in response to an RSA challenge.
-The MD5 checksum is returned instead of the decrypted challenge to
-deter known-plaintext attacks against the RSA key.  The server
-responds to this message with either SSH_SMSG_SUCCESS or
-SSH_SMSG_FAILURE.
-.IP "9 SSH_CMSG_AUTH_PASSWORD"
-.TS
-;
-l l.
-string	plain text password
-.TE
-Requests password authentication using the given password.  Note that
-even though the password is plain text inside the packet, the whole
-packet is normally encrypted by the packet layer.  It would not be
-possible for the client to perform password encryption/hashing,
-because it cannot know which kind of encryption/hashing, if any, the
-server uses.  The server responds to this message with
-SSH_SMSG_SUCCESS or SSH_SMSG_FAILURE.
-.IP "10 SSH_CMSG_REQUEST_PTY"
-.TS
-;
-l l.
-string	TERM environment variable value (e.g. vt100)
-32-bit int	terminal height, rows (e.g., 24)
-32-bit int	terminal width, columns (e.g., 80)
-32-bit int	terminal width, pixels (0 if no graphics) (e.g., 480)
-32-bit int	terminal height, pixels (0 if no graphics) (e.g., 640)
-n bytes	tty modes encoded in binary
-.TE
-Requests a pseudo-terminal to be allocated for this command.  This
-message can be used regardless of whether the session will later
-execute the shell or a command.  If a pty has been requested with this
-message, the shell or command will run on a pty.  Otherwise it will
-communicate with the server using pipes, sockets or some other similar
-mechanism.
-
-The terminal type gives the type of the user's terminal.  In the UNIX
-environment it is passed to the shell or command in the TERM
-environment variable.
-
-The width and height values give the initial size of the user's
-terminal or window.  All values can be zero if not supported by the
-operating system.  The server will pass these values to the kernel if
-supported.
-
-Terminal modes are encoded into a byte stream in a portable format.
-The exact format is described later in this document.
-
-The server responds to the request with either SSH_SMSG_SUCCESS or
-SSH_SMSG_FAILURE.  If the server does not have the concept of pseudo
-terminals, it should return success if it is possible to execute a
-shell or a command so that it looks to the client as if it was running
-on a pseudo terminal.
-.IP "11 SSH_CMSG_WINDOW_SIZE"
-.TS
-;
-l l.
-32-bit int	terminal height, rows
-32-bit int	terminal width, columns
-32-bit int	terminal width, pixels
-32-bit int	terminal height, pixels
-.TE
-This message can only be sent by the client during the interactive
-session.  This indicates that the size of the user's window has
-changed, and provides the new size.  The server will update the
-kernel's notion of the window size, and a SIGWINCH signal or
-equivalent will be sent to the shell or command (if supported by the
-operating system).
-.IP "12 SSH_CMSG_EXEC_SHELL"
-
-(no arguments)
-
-Starts a shell (command interpreter), and enters interactive session
-mode.
-.IP "13 SSH_CMSG_EXEC_CMD"
-.TS
-;
-l l.
-string	command to execute
-.TE
-Starts executing the given command, and enters interactive session
-mode.  On UNIX, the command is run as "<shell> -c <command>", where
-<shell> is the user's login shell.
-.IP "14 SSH_SMSG_SUCCESS"
-
-(no arguments)
-
-This message is sent by the server in response to the session key, a
-successful authentication request, and a successfully completed
-preparatory operation.
-.IP "15 SSH_SMSG_FAILURE"
-
-(no arguments)
-
-This message is sent by the server in response to a failed
-authentication operation to indicate that the user has not yet been
-successfully authenticated, and in response to a failed preparatory
-operation.  This is also sent in response to an authentication or
-preparatory operation request that is not recognized or supported.
-.IP "16 SSH_CMSG_STDIN_DATA"
-.TS
-;
-l l.
-string	data
-.TE
-Delivers data from the client to be supplied as input to the shell or
-program running on the server side.  This message can only be used in
-the interactive session mode.  No acknowledgement is sent for this
-message.
-.IP "17 SSH_SMSG_STDOUT_DATA"
-.TS
-;
-l l.
-string	data
-.TE
-Delivers data from the server that was read from the standard output of
-the shell or program running on the server side.  This message can
-only be used in the interactive session mode.  No acknowledgement is
-sent for this message.
-.IP "18 SSH_SMSG_STDERR_DATA"
-.TS
-;
-l l.
-string	data
-.TE
-Delivers data from the server that was read from the standard error of
-the shell or program running on the server side.  This message can
-only be used in the interactive session mode.  No acknowledgement is
-sent for this message.
-.IP "19 SSH_CMSG_EOF"
-
-(no arguments)
-
-This message is sent by the client to indicate that EOF has been
-reached on the input.  Upon receiving this message, and after all
-buffered input data has been sent to the shell or program, the server
-will close the input file descriptor to the program.  This message can
-only be used in the interactive session mode.  No acknowledgement is
-sent for this message.
-.IP "20 SSH_SMSG_EXITSTATUS"
-.TS
-;
-l l.
-32-bit int	exit status of the command
-.TE
-Returns the exit status of the shell or program after it has exited.
-The client should respond with SSH_CMSG_EXIT_CONFIRMATION when it has
-received this message.  This will be the last message sent by the
-server.  If the program being executed dies with a signal instead of
-exiting normally, the server should terminate the session with
-SSH_MSG_DISCONNECT (which can be used to pass a human-readable string
-indicating that the program died due to a signal) instead of using
-this message.
-.IP "21 SSH_MSG_CHANNEL_OPEN_CONFIRMATION"
-.TS
-;
-l l.
-32-bit int	remote_channel
-32-bit int	local_channel
-.TE
-This is sent in response to any channel open request if the channel
-has been successfully opened.  Remote_channel is the channel number
-received in the initial open request; local_channel is the channel
-number the side sending this message has allocated for the channel.
-Data can be transmitted on the channel after this message.
-.IP "22 SSH_MSG_CHANNEL_OPEN_FAILURE"
-.TS
-;
-l l.
-32-bit int	remote_channel
-.TE
-This message indicates that an earlier channel open request by the
-other side has failed or has been denied.  Remote_channel is the
-channel number given in the original request.
-.IP "23 SSH_MSG_CHANNEL_DATA"
-.TS
-;
-l l.
-32-bit int	remote_channel
-string	data
-.TE
-Data is transmitted in a channel in these messages.  A channel is
-bidirectional, and both sides can send these messages.  There is no
-acknowledgement for these messages.  It is possible that either side
-receives these messages after it has sent SSH_MSG_CHANNEL_CLOSE for
-the channel.  These messages cannot be received after the party has
-sent or received SSH_MSG_CHANNEL_CLOSE_CONFIRMATION.
-.IP "24 SSH_MSG_CHANNEL_CLOSE"
-.TS
-;
-l l.
-32-bit int	remote_channel
-.TE
-When a channel is closed at one end of the connection, that side sends
-this message.  Upon receiving this message, the channel should be
-closed.  When this message is received, if the channel is already
-closed (the receiving side has sent this message for the same channel
-earlier), the channel is freed and no further action is taken;
-otherwise the channel is freed and SSH_MSG_CHANNEL_CLOSE_CONFIRMATION
-is sent in response.  (It is possible that the channel is closed
-simultaneously at both ends.)
-.IP "25 SSH_MSG_CHANNEL_CLOSE_CONFIRMATION"
-.TS
-;
-l l.
-32-bit int	remote_channel
-.TE
-This message is sent in response to SSH_MSG_CHANNEL_CLOSE unless the
-channel was already closed.  When this message is sent or received,
-the channel is freed.
-.IP "26 (OBSOLETED; was unix-domain X11 forwarding)
-.IP "27 SSH_SMSG_X11_OPEN"
-.TS
-;
-l l.
-32-bit int	local_channel
-string	originator_string (see below)
-.TE
-This message can be sent by the server during the interactive session
-mode to indicate that a client has connected the fake X server.
-Local_channel is the channel number that the server has allocated for
-the connection.  The client should try to open a connection to the
-real X server, and respond with SSH_MSG_CHANNEL_OPEN_CONFIRMATION or
-SSH_MSG_CHANNEL_OPEN_FAILURE.
-
-The field originator_string is present if both sides
-specified SSH_PROTOFLAG_HOST_IN_FWD_OPEN in the protocol flags.  It
-contains a description of the host originating the connection.
-.IP "28 SSH_CMSG_PORT_FORWARD_REQUEST"
-.TS
-;
-l l.
-32-bit int	server_port
-string	host_to_connect
-32-bit int	port_to_connect
-.TE
-Sent by the client in the preparatory phase, this message requests
-that server_port on the server machine be forwarded over the secure
-channel to the client machine, and from there to the specified host
-and port.  The server should start listening on the port, and send
-SSH_MSG_PORT_OPEN whenever a connection is made to it.  Supporting
-this message is optional, and the server is free to reject any forward
-request.  For example, it is highly recommended that unless the user
-has been authenticated as root, forwarding any privileged port numbers
-(below 1024) is denied.
-.IP "29 SSH_MSG_PORT_OPEN"
-.TS
-;
-l l.
-32-bit int	local_channel
-string	host_name
-32-bit int	port
-string	originator_string (see below)
-.TE
-Sent by either party in interactive session mode, this message
-indicates that a connection has been opened to a forwarded TCP/IP
-port.  Local_channel is the channel number that the sending party has
-allocated for the connection.  Host_name is the host the connection
-should be be forwarded to, and the port is the port on that host to
-connect.  The receiving party should open the connection, and respond
-with SSH_MSG_CHANNEL_OPEN_CONFIRMATION or
-SSH_MSG_CHANNEL_OPEN_FAILURE.  It is recommended that the receiving
-side check the host_name and port for validity to avoid compromising
-local security by compromised remote side software.  Particularly, it
-is recommended that the client permit connections only to those ports
-for which it has requested forwarding with SSH_CMSG_PORT_FORWARD_REQUEST.
-
-The field originator_string is present if both sides
-specified SSH_PROTOFLAG_HOST_IN_FWD_OPEN in the protocol flags.  It
-contains a description of the host originating the connection.
-.IP "30 SSH_CMSG_AGENT_REQUEST_FORWARDING"
-
-(no arguments)
-
-Requests that the connection to the authentication agent be forwarded
-over the secure channel.  The method used by clients to contact the
-authentication agent within each machine is implementation and machine
-dependent.  If the server accepts this request, it should arrange that
-any clients run from this session will actually contact the server
-program when they try to contact the authentication agent.  The server
-should then send a SSH_SMSG_AGENT_OPEN to open a channel to the agent,
-and the client should forward the connection to the real
-authentication agent.  Supporting this message is optional.
-.IP "31 SSH_SMSG_AGENT_OPEN"
-.TS
-;
-l l.
-32-bit int	local_channel
-.TE
-Sent by the server in interactive session mode, this message requests
-opening a channel to the authentication agent.  The client should open
-a channel, and respond with either SSH_MSG_CHANNEL_OPEN_CONFIRMATION
-or SSH_MSG_CHANNEL_OPEN_FAILURE.
-.IP "32 SSH_MSG_IGNORE"
-.TS
-;
-l l.
-string	data
-.TE
-Either party may send this message at any time.  This message, and the
-argument string, is silently ignored.  This message might be used in
-some implementations to make traffic analysis more difficult.  This
-message is not currently sent by the implementation, but all
-implementations are required to recognize and ignore it.
-.IP "33 SSH_CMSG_EXIT_CONFIRMATION"
-
-(no arguments)
-
-Sent by the client in response to SSH_SMSG_EXITSTATUS.  This is the
-last message sent by the client.
-.IP "34 SSH_CMSG_X11_REQUEST_FORWARDING"
-.TS
-;
-l l.
-string	x11_authentication_protocol
-string	x11_authentication_data
-32-bit int	screen number (if SSH_PROTOFLAG_SCREEN_NUMBER)
-.TE
-Sent by the client during the preparatory phase, this message requests
-that the server create a fake X11 display and set the DISPLAY
-environment variable accordingly.  An internet-domain display is
-preferable.  The given authentication protocol and the associated data
-should be recorded by the server so that it is used as authentication
-on connections (e.g., in .Xauthority).  The authentication protocol
-must be one of the supported X11 authentication protocols, e.g.,
-"MIT-MAGIC-COOKIE-1".  Authentication data must be a lowercase hex
-string of even length.  Its interpretation is protocol dependent.
-The data is in a format that can be used with e.g. the xauth program.
-Supporting this message is optional.
-
-The client is permitted (and recommended) to generate fake
-authentication information and send fake information to the server.
-This way, a corrupt server will not have access to the user's terminal
-after the connection has terminated.  The correct authorization codes
-will also not be left hanging around in files on the server (many
-users keep the same X session for months, thus protecting the
-authorization data becomes important).
-
-X11 authentication spoofing works by initially sending fake (random)
-authentication data to the server, and interpreting the first packet
-sent by the X11 client after the connection has been opened.  The
-first packet contains the client's authentication.  If the packet
-contains the correct fake data, it is replaced by the client by the
-correct authentication data, and then sent to the X server.
-.IP "35 SSH_CMSG_AUTH_RHOSTS_RSA"
-.TS
-;
-l l.
-string	clint-side user name
-32-bit int	client_host_key_bits
-mp-int	client_host_key_public_exponent
-mp-int	client_host_key_public_modulus
-.TE
-Requests authentication using /etc/hosts.equiv and .rhosts (or
-equivalent) together with RSA host authentication.  The server should
-check that the client side port number is less than 1024 (a privileged
-port), and immediately reject authentication if it is not.  The server
-responds with SSH_SMSG_FAILURE or SSH_SMSG_AUTH_RSA_CHALLENGE.  The
-client must respond to the challenge with the proper
-SSH_CMSG_AUTH_RSA_RESPONSE.  The server then responds with success if
-access was granted, or failure if the client gave a wrong response.
-Supporting this authentication method is optional but recommended in
-most environments.
-.IP "36 SSH_MSG_DEBUG"
-.TS
-;
-l l.
-string	debugging message sent to the other side
-.TE
-This message may be sent by either party at any time.  It is used to
-send debugging messages that may be informative to the user in
-solving various problems.  For example, if authentication fails
-because of some configuration error (e.g., incorrect permissions for
-some file), it can be very helpful for the user to make the cause of
-failure available.  On the other hand, one should not make too much
-information available for security reasons.  It is recommended that
-the client provides an option to display the debugging information
-sent by the sender (the user probably does not want to see it by default).
-The server can log debugging data sent by the client (if any).  Either
-party is free to ignore any received debugging data.  Every
-implementation must be able to receive this message, but no
-implementation is required to send these.
-.IP "37 SSH_CMSG_REQUEST_COMPRESSION"
-.TS
-;
-l l.
-32-bit int	gzip compression level (1-9)
-.TE
-This message can be sent by the client in the preparatory operations
-phase.  The server responds with SSH_SMSG_FAILURE if it does not
-support compression or does not want to compress; it responds with
-SSH_SMSG_SUCCESS if it accepted the compression request.  In the
-latter case the response to this packet will still be uncompressed,
-but all further packets in either direction will be compressed by gzip.
-.RT
-
-
-.ti 0
-Encoding of Terminal Modes
-
-Terminal modes (as passed in SSH_CMSG_REQUEST_PTY) are encoded into a
-byte stream.  It is intended that the coding be portable across
-different environments.
-
-The tty mode description is a stream of bytes.  The stream consists of
-opcode-argument pairs.  It is terminated by opcode TTY_OP_END (0).
-Opcodes 1-127 have one-byte arguments.  Opcodes 128-159 have 32-bit
-integer arguments (stored msb first).  Opcodes 160-255 are not yet
-defined, and cause parsing to stop (they should only be used after any
-other data).
-
-The client puts in the stream any modes it knows about, and the server
-ignores any modes it does not know about.  This allows some degree of
-machine-independence, at least between systems that use a POSIX-like
-[POSIX] tty interface.  The protocol can support other systems as
-well, but the client may need to fill reasonable values for a number
-of parameters so the server pty gets set to a reasonable mode (the
-server leaves all unspecified mode bits in their default values, and
-only some combinations make sense).
-
-The following opcodes have been defined.  The naming of opcodes mostly
-follows the POSIX terminal mode flags.
-.IP "0 TTY_OP_END"
-Indicates end of options.
-.IP "1 VINTR"
-Interrupt character; 255 if none.  Similarly for the other characters.
-Not all of these characters are supported on all systems.
-.IP "2 VQUIT"
-The quit character (sends SIGQUIT signal on UNIX systems).
-.IP "3 VERASE"
-Erase the character to left of the cursor.
-.IP "4 VKILL"
-Kill the current input line.
-.IP "5 VEOF "
-End-of-file character (sends EOF from the terminal).
-.IP "6 VEOL "
-End-of-line character in addition to carriage return and/or linefeed.
-.IP "7 VEOL2"
-Additional end-of-line character.
-.IP "8 VSTART"
-Continues paused output (normally ^Q).
-.IP "9 VSTOP"
-Pauses output (^S).
-.IP "10 VSUSP"
-Suspends the current program.
-.IP "11 VDSUSP"
-Another suspend character.
-.IP "12 VREPRINT"
-Reprints the current input line.
-.IP "13 VWERASE"
-Erases a word left of cursor.
-.IP "14 VLNEXT"
-More special input characters; these are probably not supported on
-most systems.
-.IP "15 VFLUSH"
-.IP "16 VSWTCH"
-.IP "17 VSTATUS"
-.IP "18 VDISCARD"
-
-.IP "30 IGNPAR"
-The ignore parity flag.  The next byte should be 0 if this flag is not
-set, and 1 if it is set.
-.IP "31 PARMRK"
-More flags.  The exact definitions can be found in the POSIX standard.
-.IP "32 INPCK"
-.IP "33 ISTRIP"
-.IP "34 INLCR"
-.IP "35 IGNCR"
-.IP "36 ICRNL"
-.IP "37 IUCLC"
-.IP "38 IXON"
-.IP "39 IXANY"
-.IP "40 IXOFF"
-.IP "41 IMAXBEL"
-
-.IP "50 ISIG"
-.IP "51 ICANON"
-.IP "52 XCASE"
-.IP "53 ECHO"
-.IP "54 ECHOE"
-.IP "55 ECHOK"
-.IP "56 ECHONL"
-.IP "57 NOFLSH"
-.IP "58 TOSTOP"
-.IP "59 IEXTEN"
-.IP "60 ECHOCTL"
-.IP "61 ECHOKE"
-.IP "62 PENDIN"
-
-.IP "70 OPOST"
-.IP "71 OLCUC"
-.IP "72 ONLCR"
-.IP "73 OCRNL"
-.IP "74 ONOCR"
-.IP "75 ONLRET"
-
-.IP "90 CS7"
-.IP "91 CS8"
-.IP "92 PARENB"
-.IP "93 PARODD"
-
-.IP "192 TTY_OP_ISPEED"
-Specifies the input baud rate in bits per second.
-.IP "193 TTY_OP_OSPEED"
-Specifies the output baud rate in bits per second.
-.RT
-
-
-.ti 0
-The Authentication Agent Protocol
-
-The authentication agent is a program that can be used to hold RSA
-authentication keys for the user (in future, it might hold data for
-other authentication types as well).  An authorized program can send
-requests to the agent to generate a proper response to an RSA
-challenge.  How the connection is made to the agent (or its
-representative) inside a host and how access control is done inside a
-host is implementation-dependent; however, how it is forwarded and how
-one interacts with it is specified in this protocol.  The connection
-to the agent is normally automatically forwarded over the secure
-channel.
-
-A program that wishes to use the agent first opens a connection to its
-local representative (typically, the agent itself or an SSH server).
-It then writes a request to the connection, and waits for response.
-It is recommended that at least five minutes of timeout are provided
-waiting for the agent to respond to an authentication challenge (this
-gives sufficient time for the user to cut-and-paste the challenge to a
-separate machine, perform the computation there, and cut-and-paste the
-result back if so desired).
-
-Messages sent to and by the agent are in the following format:
-.TS
-;
-l l.
-4 bytes	Length, msb first.  Does not include length itself.
-1 byte	Packet type.  The value 255 is reserved for future extensions.
-data	Any data, depending on packet type.  Encoding as in the ssh packet
-protocol.
-.TE
-
-The following message types are currently defined:
-.IP "1 SSH_AGENTC_REQUEST_RSA_IDENTITIES"
-
-(no arguments)
-
-Requests the agent to send a list of all RSA keys for which it can
-answer a challenge.
-.IP "2 SSH_AGENT_RSA_IDENTITIES_ANSWER"
-.TS
-;
-l l.
-32-bit int	howmany
-howmany times:
-32-bit int	bits
-mp-int	public exponent
-mp-int	public modulus
-string	comment
-.TE
-The agent sends this message in response to the to
-SSH_AGENTC_REQUEST_RSA_IDENTITIES.  The answer lists all RSA keys for
-which the agent can answer a challenge.  The comment field is intended
-to help identify each key; it may be printed by an application to
-indicate which key is being used.  If the agent is not holding any
-keys, howmany will be zero.
-.IP "3 SSH_AGENTC_RSA_CHALLENGE
-.TS
-;
-l l.
-32-bit int	bits
-mp-int	public exponent
-mp-int	public modulus
-mp-int	challenge
-16 bytes	session_id
-32-bit int	response_type
-.TE
-Requests RSA decryption of random challenge to authenticate the other
-side.  The challenge will be decrypted with the RSA private key
-corresponding to the given public key.
-
-The decrypted challenge must contain a zero in the highest (partial)
-byte, 2 in the next byte, followed by non-zero random bytes, a zero
-byte, and then the real challenge value in the lowermost bytes.  The
-real challenge must be 32 8-bit bytes (256 bits).
-
-Response_type indicates the format of the response to be returned.
-Currently the only supported value is 1, which means to compute MD5 of
-the real challenge plus session id, and return the resulting 16 bytes
-in a SSH_AGENT_RSA_RESPONSE message.
-.IP "4 SSH_AGENT_RSA_RESPONSE"
-.TS
-;
-l l.
-16 bytes	MD5 of decrypted challenge
-.TE
-Answers an RSA authentication challenge.  The response is 16 bytes:
-the MD5 checksum of the 32-byte challenge.
-.IP "5 SSH_AGENT_FAILURE"
-
-(no arguments)
-
-This message is sent whenever the agent fails to answer a request
-properly.  For example, if the agent cannot answer a challenge (e.g.,
-no longer has the proper key), it can respond with this.  The agent
-also responds with this message if it receives a message it does not
-recognize.
-.IP "6 SSH_AGENT_SUCCESS"
-
-(no arguments)
-
-This message is sent by the agent as a response to certain requests
-that do not otherwise cause a message be sent.  Currently, this is
-only sent in response to SSH_AGENTC_ADD_RSA_IDENTITY and
-SSH_AGENTC_REMOVE_RSA_IDENTITY.
-.IP "7 SSH_AGENTC_ADD_RSA_IDENTITY"
-.TS
-;
-l l.
-32-bit int	bits
-mp-int	public modulus
-mp-int	public exponent
-mp-int	private exponent
-mp-int	multiplicative inverse of p mod q
-mp-int	p
-mp-int	q
-string	comment
-.TE
-Registers an RSA key with the agent.  After this request, the agent can
-use this RSA key to answer requests.  The agent responds with
-SSH_AGENT_SUCCESS or SSH_AGENT_FAILURE.
-.IP "8 SSH_AGENT_REMOVE_RSA_IDENTITY"
-.TS
-;
-l l.
-32-bit int	bits
-mp-int	public exponent
-mp-int	public modulus
-.TE
-Removes an RSA key from the agent.  The agent will no longer accept
-challenges for this key and will not list it as a supported identity.
-The agent responds with SSH_AGENT_SUCCESS or SSH_AGENT_FAILURE.
-.RT
-
-If the agent receives a message that it does not understand, it
-responds with SSH_AGENT_FAILURE.  This permits compatible future
-extensions.
-
-It is possible that several clients have a connection open to the
-authentication agent simultaneously.  Each client will use a separate
-connection (thus, any SSH connection can have multiple agent
-connections active simultaneously).
-
-
-.ti 0
-References
-
-.IP "[DES] "
-FIPS PUB 46-1: Data Encryption Standard.  National Bureau of
-Standards, January 1988.  FIPS PUB 81: DES Modes of Operation.
-National Bureau of Standards, December 1980.  Bruce Schneier: Applied
-Cryptography.  John Wiley & Sons, 1994.  J. Seberry and J. Pieprzyk:
-Cryptography: An Introduction to Computer Security.  Prentice-Hall,
-1989.
-.IP "[GZIP] "
-The GNU GZIP program; available for anonymous ftp at prep.ai.mit.edu.
-Please let me know if you know a paper describing the algorithm.
-.IP "[IDEA] "
-Xuejia Lai: On the Design and Security of Block Ciphers, ETH Series in
-Information Processing, vol. 1, Hartung-Gorre Verlag, Konstanz,
-Switzerland, 1992.  Bruce Schneier: Applied Cryptography, John Wiley &
-Sons, 1994.  See also the following patents: PCT/CH91/00117, EP 0 482
-154 B1, US Pat. 5,214,703.
-.IP [PKCS#1]
-PKCS #1: RSA Encryption Standard.  Version 1.5, RSA Laboratories,
-November 1993.  Available for anonymous ftp at ftp.rsa.com.
-.IP [POSIX]
-Portable Operating System Interface (POSIX) - Part 1: Application
-Program Interface (API) [C language], ISO/IEC 9945-1, IEEE Std 1003.1,
-1990.
-.IP [RFC0791]
-J. Postel: Internet Protocol, RFC 791, USC/ISI, September 1981.
-.IP [RFC0793]
-J. Postel: Transmission Control Protocol, RFC 793, USC/ISI, September
-1981.
-.IP [RFC1034]
-P. Mockapetris: Domain Names - Concepts and Facilities, RFC 1034,
-USC/ISI, November 1987.
-.IP [RFC1282]
-B. Kantor: BSD Rlogin, RFC 1258, UCSD, December 1991.
-.IP "[RSA] "
-Bruce Schneier: Applied Cryptography.  John Wiley & Sons, 1994.  See
-also R. Rivest, A. Shamir, and L. M. Adleman: Cryptographic
-Communications System and Method.  US Patent 4,405,829, 1983.
-.IP "[X11] "
-R. Scheifler: X Window System Protocol, X Consortium Standard, Version
-11, Release 6.  Massachusetts Institute of Technology, Laboratory of
-Computer Science, 1994.
-.RT
-
-
-.ti 0
-Security Considerations
-
-This protocol deals with the very issue of user authentication and
-security.
-
-First of all, as an implementation issue, the server program will have
-to run as root (or equivalent) on the server machine.  This is because
-the server program will need be able to change to an arbitrary user
-id.  The server must also be able to create a privileged TCP/IP port.
-
-The client program will need to run as root if any variant of .rhosts
-authentication is to be used.  This is because the client program will
-need to create a privileged port.  The client host key is also usually
-stored in a file which is readable by root only.  The client needs the
-host key in .rhosts authentication only.  Root privileges can be
-dropped as soon as the privileged port has been created and the host
-key has been read.
-
-The SSH protocol offers major security advantages over existing telnet
-and rlogin protocols.
-.IP o
-IP spoofing is restricted to closing a connection (by encryption, host
-keys, and the special random cookie).  If encryption is not used, IP
-spoofing is possible for those who can hear packets going out from the
-server.
-.IP o
-DNS spoofing is made ineffective (by host keys).
-.IP o
-Routing spoofing is made ineffective (by host keys).
-.IP o
-All data is encrypted with strong algorithms to make eavesdropping as
-difficult as possible.  This includes encrypting any authentication
-information such as passwords.  The information for decrypting session
-keys is destroyed every hour.
-.IP o
-Strong authentication methods: .rhosts combined with RSA host
-authentication, and pure RSA authentication.
-.IP o
-X11 connections and arbitrary TCP/IP ports can be forwarded securely.
-.IP o
-Man-in-the-middle attacks are deterred by using the server host key to
-encrypt the session key.
-.IP o
-Trojan horses to catch a password by routing manipulation are deterred
-by checking that the host key of the server machine matches that
-stored on the client host.
-.RT
-
-The security of SSH against man-in-the-middle attacks and the security
-of the new form of .rhosts authentication, as well as server host
-validation, depends on the integrity of the host key and the files
-containing known host keys.
-
-The host key is normally stored in a root-readable file.  If the host
-key is compromised, it permits attackers to use IP, DNS and routing
-spoofing as with current rlogin and rsh.  It should never be any worse
-than the current situation.
-
-The files containing known host keys are not sensitive.  However, if an
-attacker gets to modify the known host key files, it has the same
-consequences as a compromised host key, because the attacker can then
-change the recorded host key.
-
-The security improvements obtained by this protocol for X11 are of
-particular significance.  Previously, there has been no way to protect
-data communicated between an X server and a client running on a remote
-machine.  By creating a fake display on the server, and forwarding all
-X11 requests over the secure channel, SSH can be used to run any X11
-applications securely without any cooperation with the vendors of the
-X server or the application.
-
-Finally, the security of this program relies on the strength of the
-underlying cryptographic algorithms.  The RSA algorithm is used for
-authentication key exchange.  It is widely believed to be secure.  Of
-the algorithms used to encrypt the session, DES has a rather small key
-these days, probably permitting governments and organized criminals to
-break it in very short time with specialized hardware.  3DES is
-probably safe (but slower).  IDEA is widely believed to be secure.
-People have varying degrees of confidence in the other algorithms.
-This program is not secure if used with no encryption at all.
-
-
-.ti 0
-Additional Information
-
-Additional information (especially on the implementation and mailing
-lists) is available via WWW at http://www.cs.hut.fi/ssh.
-
-Comments should be sent to Tatu Ylonen <ylo@cs.hut.fi> or the SSH
-Mailing List <ssh@clinet.fi>.
-
-.ti 0
-Author's Address
-
-.TS
-;
-l.
-Tatu Ylonen
-Helsinki University of Technology
-Otakaari 1
-FIN-02150 Espoo, Finland
-
-Phone: +358-0-451-3374
-Fax: +358-0-451-3293
-EMail: ylo@cs.hut.fi
-.TE
diff --git a/crypto/openssh/TODO b/crypto/openssh/TODO
deleted file mode 100644
index de83000f5759..000000000000
--- a/crypto/openssh/TODO
+++ /dev/null
@@ -1,137 +0,0 @@
-Programming:
-- Grep for 'XXX' comments and fix
-
-- Link order is incorrect for some systems using Kerberos 4 and AFS. Result
-  is multiple inclusion of DES symbols. Holger Trapp 
-  <holger.trapp@hrz.tu-chemnitz.de> reports that changing the configure
-  generated link order from:
-	-lresolv -lkrb -lz -lnsl  -lutil -lkafs -lkrb -ldes -lcrypto
-  to:
-	-lresolv -lkrb -lz -lnsl  -lutil -lcrypto -lkafs -lkrb -ldes
-  fixing the problem.
-
-- Write a test program that calls stat() to search for EGD/PRNGd socket
-  rather than use the (non-portable) "test -S". 
-
-- More platforms for for setproctitle() emulation (testing needed)
-
-- Handle changing passwords for the non-PAM expired password case
-
-- Improve PAM support (a pam_lastlog module will cause sshd to exit)
-  and maybe support alternate forms of authentications like OPIE via
-  pam?
-
-- Rework PAM ChallengeResponseAuthentication
- - Use kbdint request packet with 0 prompts for informational messages
- - Use different PAM service name for kbdint vs regular auth (suggest from
-   Solar Designer)
- - Ability to select which ChallengeResponseAuthentications may be used
-   and order to try them in e.g. "ChallengeResponseAuthentication skey, pam"
-
-- Complete Tru64 SIA support
- - It looks like we could merge it into the password auth code to cut down
-   on diff size. Maybe PAM password auth too?
-
-- Finish integrating kernel-level auditing code for IRIX and SOLARIS
-  (Gilbert.r.loomis@saic.com)
-
-- sftp-server:  Rework to step down to 32bit ints if the platform
-  lacks 'long long' == 64bit (Notable SCO w/ SCO compiler)
-
-- Linux hangs for 20 seconds when you do "sleep 20&exit".  All current
-  solutions break scp or leaves processes hanging around after the ssh
-  connection has ended.  It seems to be linked to two things.  One
-  select() under Linux is not as nice as others, and two the children
-  of the shell are not killed on exiting the shell.
-  A short run-down of what happens:
-  - The shell starts up, and starts its own session.  As a side-effect, it
-    gets its own process group.
-  - The child forks off sleep, and because it's in the background, puts it
-    into its own process group.  The sleep command inherits a copy of the
-    shell's descriptor for the tty as its stdout.
-  - The shell exits, but doesn't SIGHUP all of its child PIDs like it probably
-    should(?)
-  - The sshd server attempts to read from the master side of the pty, and
-    while there are still process with the pty open, no EOF is produced.
-  - The sleep command exits, closes its descriptor, sshd detects the EOF, and
-    the connection gets closed.
-  Ways we've tried fixing this in sshd, and why they didn't work out:
-  - SIGHUP the sshd's process group.
-    - The shell is in its own process group.
-  - Track process group IDs of all children before we reap them (via an extra
-    field in Session structures which holds the pgid for each child pid), and
-    SIGHUP the pgid when we reap.
-    - Background commands are in yet another process group.
-  - Close the connection when the child dies.
-    - Background commands may need to write data to the connection.  Also
-      prematurely truncates output from some commands (scp server, the
-      famous "dd if=/dev/zero bs=1000 count=100" case).
-  Known workarounds:
-  - bash: shopt huponexit on
-  - tcsh: none
-  - zsh: setopt HUP (usually the default setting)
-    (taken from email from Jason Stone to openssh-unix-dev, 5 May 2001)
-  - pdksh: ?
-  This appears to affect NetKit rsh under Linux as well: it behaves the same
-  with 'sleep 20 & exit'.
-
-- Build an automated test suite
-
-- 64-bit builds on HP-UX 11.X (stevesk@pobox.com):
-  - utmp/wtmp get corrupted (something in loginrec?)
-  - can't build with PAM (no 64-bit libpam yet)
-
-Documentation:
-- More and better
-
-- Install FAQ?
-
-- General FAQ on S/Key, TIS, RSA, RSA2, DSA, etc and suggestions on when it
-  would be best to use them.  
-
-- Create a Documentation/ directory?
-
-Clean up configure/makefiles:
-- Clean up configure.ac - There are a few double #defined variables
-  left to do.  HAVE_LOGIN is one of them.  Consider NOT looking for
-  information in wtmpx or utmpx or any of that stuff if it's not detected
-  from the start
-
-- Fails to compile when cross compile.
-  (vinschen@redhat.com)
-
-- Replace the whole u_intXX_t evilness in acconfig.h with something better???
- - Do it in configure.ac
-
-- Consider splitting the u_intXX_t test for sys/bitype.h  into seperate test
-  to allow people to (right/wrongfully) link against Bind directly.
-
-- Consider splitting configure.ac into seperate files which do logically
-  similar tests. E.g move all the type detection stuff into one file, 
-  entropy related stuff into another.
-
-Packaging:
-- Solaris: Update packaging scripts and build new sysv startup scripts
-  Ideally the package metadata should be generated by autoconf.
-  (gilbert.r.loomis@saic.com)
-
-- HP-UX: Provide DEPOT package scripts.
-  (gilbert.r.loomis@saic.com)
-
-
-PrivSep Issues:
-- mmap() issues.
-  + /dev/zero solution (Solaris)
-  + No/broken MAP_ANON (Irix)
-  + broken /dev/zero parse (Linux)
-- PAM 
-  + See above PAM notes
-- AIX
-  + usrinfo() does not set TTY, but only required for legicy systems.  Works
-    with PrivSep.
-- OSF
-  + SIA is broken
-- Cygwin
-  + Privsep for Pre-auth only (no fd passing)
-
-$Id: TODO,v 1.53 2003/01/12 23:00:34 djm Exp $
diff --git a/crypto/openssh/WARNING.RNG b/crypto/openssh/WARNING.RNG
deleted file mode 100644
index ae43930a77f6..000000000000
--- a/crypto/openssh/WARNING.RNG
+++ /dev/null
@@ -1,96 +0,0 @@
-This document contains a description of portable OpenSSH's random
-number collection code. An alternate reading of this text could
-well be titled "Why I should pressure my system vendor to supply
-/dev/random in their OS".
-
-Why is this important? OpenSSH depends on good, unpredictable numbers
-for generating keys, performing digital signatures and forming
-cryptographic challenges. If the random numbers that it uses are
-predictable, then the strength of the whole system is compromised.
-
-A particularly pernicious problem arises with DSA keys (used by the
-ssh2 protocol). Performing a DSA signature (which is required for
-authentication), entails the use of a 160 bit random number.  If an
-attacker can predict this number, then they can deduce your *private*
-key and impersonate you or your hosts.
-
-If you are using the builtin random number support (configure will
-tell you if this is the case), then read this document in its entirety.
-Alternately, you can use Lutz Jaenicke's PRNGd - a small daemon which
-collects random numbers and makes them available by a socket.
-
-Please also request that your OS vendor provides a kernel-based random
-number collector (/dev/random) in future versions of your operating
-systems by default.
-
-On to the description...
-
-The portable OpenSSH contains random number collection support for
-systems which lack a kernel entropy pool (/dev/random).
-
-This collector (as of 3.1 and beyond) comes as an external application
-that allows the local admin to decide on how to implement entropy
-collection.
-
-The default entropy collector operates by executing the programs listed
-in ($etcdir)/ssh_prng_cmds, reading their output and adding it to the
-PRNG supplied by OpenSSL (which is hash-based). It also stirs in the
-output of several system calls and timings from the execution of the
-programs that it runs.
-
-The ssh_prng_cmds file also specifies a 'rate' for each program. This
-represents the number of bits of randomness per byte of output from
-the specified program.
-
-The random number code will also read and save a seed file to
-~/.ssh/prng_seed. This contents of this file are added to the random
-number generator at startup. The goal here is to maintain as much 
-randomness between sessions as possible.
-
-The default entropy collection code has two main problems:
-
-1. It is slow.
-
-Executing each program in the list can take a large amount of time,   
-especially on slower machines. Additionally some program can take a   
-disproportionate time to execute.                                     
-
-Tuning the default entropy collection code is difficult at this point.
-It requires doing 'times ./ssh-rand-helper'  and modifying the
-($etcdir)/ssh_prng_cmds until you have found the issue.  In the next
-release we will be looking at support '-v' for verbose output to allow
-easier debugging.
-
-The default entropy collector will timeout programs which take too long
-to execute, the actual timeout used can be adjusted with the
---with-entropy-timeout configure option. OpenSSH will not try to
-re-execute programs which have not been found, have had a non-zero
-exit status or have timed out more than a couple of times.
-
-2. Estimating the real 'rate' of program outputs is non-trivial
-
-The shear volume of the task is problematic: there are currently
-around 50 commands in the ssh_prng_cmds list, portable OpenSSH
-supports at least 12 different OSs. That is already 600 sets of data
-to be analysed, without taking into account the numerous differences
-between versions of each OS.
-
-On top of this, the different commands can produce varying amounts of
-usable data depending on how busy the machine is, how long it has been
-up and various other factors.
-
-To make matters even more complex, some of the commands are reporting
-largely the same data as other commands (eg. the various "ps" calls).
-
-
-How to avoid the default entropy code?
-
-The best way is to read the OpenSSL documentation and recompile OpenSSL
-to use prngd or egd.  Some platforms (like earily solaris) have 3rd
-party /dev/random devices that can be also used for this task.
-
-If you are forced to use ssh-rand-helper consider still downloading
-prngd/egd and configure OpenSSH using --with-prngd-port=xx or
---with-prngd-socket=xx (refer to INSTALL for more information).
-
-$Id: WARNING.RNG,v 1.5 2002/04/14 13:16:05 djm Exp $
diff --git a/crypto/openssh/acconfig.h b/crypto/openssh/acconfig.h
deleted file mode 100644
index b6e4b37cc2bd..000000000000
--- a/crypto/openssh/acconfig.h
+++ /dev/null
@@ -1,384 +0,0 @@
-/* $Id: acconfig.h,v 1.149 2003/03/10 00:38:10 djm Exp $ */
-
-#ifndef _CONFIG_H
-#define _CONFIG_H
-
-/* Generated automatically from acconfig.h by autoheader. */
-/* Please make your changes there */
-
-@TOP@
-
-/* Define to a Set Process Title type if your system is */
-/* supported by bsd-setproctitle.c */
-#undef SPT_TYPE
-
-/* setgroups() NOOP allowed */
-#undef SETGROUPS_NOOP
-
-/* SCO workaround */
-#undef BROKEN_SYS_TERMIO_H
-
-/* Define if you have SecureWare-based protected password database */
-#undef HAVE_SECUREWARE
-
-/* If your header files don't define LOGIN_PROGRAM, then use this (detected) */
-/* from environment and PATH */
-#undef LOGIN_PROGRAM_FALLBACK
-
-/* Define if your password has a pw_class field */
-#undef HAVE_PW_CLASS_IN_PASSWD
-
-/* Define if your password has a pw_expire field */
-#undef HAVE_PW_EXPIRE_IN_PASSWD
-
-/* Define if your password has a pw_change field */
-#undef HAVE_PW_CHANGE_IN_PASSWD
-
-/* Define if your system uses access rights style file descriptor passing */
-#undef HAVE_ACCRIGHTS_IN_MSGHDR
-
-/* Define if your system uses ancillary data style file descriptor passing */
-#undef HAVE_CONTROL_IN_MSGHDR
-
-/* Define if you system's inet_ntoa is busted (e.g. Irix gcc issue) */
-#undef BROKEN_INET_NTOA
-
-/* Define if your system defines sys_errlist[] */
-#undef HAVE_SYS_ERRLIST
-
-/* Define if your system defines sys_nerr */
-#undef HAVE_SYS_NERR
-
-/* Define if your system choked on IP TOS setting */
-#undef IP_TOS_IS_BROKEN
-
-/* Define if you have the getuserattr function.  */
-#undef HAVE_GETUSERATTR
-
-/* Work around problematic Linux PAM modules handling of PAM_TTY */
-#undef PAM_TTY_KLUDGE
-
-/* Use PIPES instead of a socketpair() */
-#undef USE_PIPES
-
-/* Define if your snprintf is busted */
-#undef BROKEN_SNPRINTF
-
-/* Define if you are on Cygwin */
-#undef HAVE_CYGWIN
-
-/* Define if you have a broken realpath. */
-#undef BROKEN_REALPATH
-
-/* Define if you are on NeXT */
-#undef HAVE_NEXT
-
-/* Define if you are on NEWS-OS */
-#undef HAVE_NEWS4
-
-/* Define if you want to enable PAM support */
-#undef USE_PAM
-
-/* Define if you want to enable AIX4's authenticate function */
-#undef WITH_AIXAUTHENTICATE
-
-/* Define if you have/want arrays (cluster-wide session managment, not C arrays) */
-#undef WITH_IRIX_ARRAY
-
-/* Define if you want IRIX project management */
-#undef WITH_IRIX_PROJECT
-
-/* Define if you want IRIX audit trails */
-#undef WITH_IRIX_AUDIT
-
-/* Define if you want IRIX kernel jobs */
-#undef WITH_IRIX_JOBS
-
-/* Location of PRNGD/EGD random number socket */
-#undef PRNGD_SOCKET
-
-/* Port number of PRNGD/EGD random number socket */
-#undef PRNGD_PORT
-
-/* Builtin PRNG command timeout */
-#undef ENTROPY_TIMEOUT_MSEC
-
-/* non-privileged user for privilege separation */
-#undef SSH_PRIVSEP_USER
-
-/* Define if you want to install preformatted manpages.*/
-#undef MANTYPE
-
-/* Define if your ssl headers are included with #include <openssl/header.h>  */
-#undef HAVE_OPENSSL
-
-/* Define if you are linking against RSAref.  Used only to print the right
- * message at run-time. */
-#undef RSAREF
-
-/* struct timeval */
-#undef HAVE_STRUCT_TIMEVAL
-
-/* struct utmp and struct utmpx fields */
-#undef HAVE_HOST_IN_UTMP
-#undef HAVE_HOST_IN_UTMPX
-#undef HAVE_ADDR_IN_UTMP
-#undef HAVE_ADDR_IN_UTMPX
-#undef HAVE_ADDR_V6_IN_UTMP
-#undef HAVE_ADDR_V6_IN_UTMPX
-#undef HAVE_SYSLEN_IN_UTMPX
-#undef HAVE_PID_IN_UTMP
-#undef HAVE_TYPE_IN_UTMP
-#undef HAVE_TYPE_IN_UTMPX
-#undef HAVE_TV_IN_UTMP
-#undef HAVE_TV_IN_UTMPX
-#undef HAVE_ID_IN_UTMP
-#undef HAVE_ID_IN_UTMPX
-#undef HAVE_EXIT_IN_UTMP
-#undef HAVE_TIME_IN_UTMP
-#undef HAVE_TIME_IN_UTMPX
-
-/* Define if you don't want to use your system's login() call */
-#undef DISABLE_LOGIN
-
-/* Define if you don't want to use pututline() etc. to write [uw]tmp */
-#undef DISABLE_PUTUTLINE
-
-/* Define if you don't want to use pututxline() etc. to write [uw]tmpx */
-#undef DISABLE_PUTUTXLINE
-
-/* Define if you don't want to use lastlog */
-#undef DISABLE_LASTLOG
-
-/* Define if you don't want to use lastlog in session.c */
-#undef NO_SSH_LASTLOG
-
-/* Define if you don't want to use utmp */
-#undef DISABLE_UTMP
-
-/* Define if you don't want to use utmpx */
-#undef DISABLE_UTMPX
-
-/* Define if you don't want to use wtmp */
-#undef DISABLE_WTMP
-
-/* Define if you don't want to use wtmpx */
-#undef DISABLE_WTMPX
-
-/* Some systems need a utmpx entry for /bin/login to work */
-#undef LOGIN_NEEDS_UTMPX
-
-/* Some versions of /bin/login need the TERM supplied on the commandline */
-#undef LOGIN_NEEDS_TERM
-
-/* Define if your login program cannot handle end of options ("--") */
-#undef LOGIN_NO_ENDOPT
-
-/* Define if you want to specify the path to your lastlog file */
-#undef CONF_LASTLOG_FILE
-
-/* Define if you want to specify the path to your utmp file */
-#undef CONF_UTMP_FILE
-
-/* Define if you want to specify the path to your wtmp file */
-#undef CONF_WTMP_FILE
-
-/* Define if you want to specify the path to your utmpx file */
-#undef CONF_UTMPX_FILE
-
-/* Define if you want to specify the path to your wtmpx file */
-#undef CONF_WTMPX_FILE
-
-/* Define if you want external askpass support */
-#undef USE_EXTERNAL_ASKPASS
-
-/* Define if libc defines __progname */
-#undef HAVE___PROGNAME
-
-/* Define if compiler implements __FUNCTION__ */
-#undef HAVE___FUNCTION__
-
-/* Define if compiler implements __func__ */
-#undef HAVE___func__
-
-/* Define if you want Kerberos 5 support */
-#undef KRB5
-
-/* Define this if you are using the Heimdal version of Kerberos V5 */
-#undef HEIMDAL
-
-/* Define if you want Kerberos 4 support */
-#undef KRB4
-
-/* Define if you want AFS support */
-#undef AFS
-
-/* Define if you want S/Key support */
-#undef SKEY
-
-/* Define if you want TCP Wrappers support */
-#undef LIBWRAP
-
-/* Define if your libraries define login() */
-#undef HAVE_LOGIN
-
-/* Define if your libraries define daemon() */
-#undef HAVE_DAEMON
-
-/* Define if your libraries define getpagesize() */
-#undef HAVE_GETPAGESIZE
-
-/* Define if xauth is found in your path */
-#undef XAUTH_PATH
-
-/* Define if you want to allow MD5 passwords */
-#undef HAVE_MD5_PASSWORDS
-
-/* Define if you want to disable shadow passwords */
-#undef DISABLE_SHADOW
-
-/* Define if you want to use shadow password expire field */
-#undef HAS_SHADOW_EXPIRE
-
-/* Define if you have Digital Unix Security Integration Architecture */
-#undef HAVE_OSF_SIA
-
-/* Define if you have getpwanam(3) [SunOS 4.x] */
-#undef HAVE_GETPWANAM
-
-/* Define if you have an old version of PAM which takes only one argument */
-/* to pam_strerror */
-#undef HAVE_OLD_PAM
-
-/* Define if you are using Solaris-derived PAM which passes pam_messages  */
-/* to the conversation function with an extra level of indirection */
-#undef PAM_SUN_CODEBASE
-
-/* Set this to your mail directory if you don't have maillock.h */
-#undef MAIL_DIRECTORY
-
-/* Data types */
-#undef HAVE_U_INT
-#undef HAVE_INTXX_T
-#undef HAVE_U_INTXX_T
-#undef HAVE_UINTXX_T
-#undef HAVE_INT64_T
-#undef HAVE_U_INT64_T
-#undef HAVE_U_CHAR
-#undef HAVE_SIZE_T
-#undef HAVE_SSIZE_T
-#undef HAVE_CLOCK_T
-#undef HAVE_MODE_T
-#undef HAVE_PID_T
-#undef HAVE_SA_FAMILY_T
-#undef HAVE_STRUCT_SOCKADDR_STORAGE
-#undef HAVE_STRUCT_ADDRINFO
-#undef HAVE_STRUCT_IN6_ADDR
-#undef HAVE_STRUCT_SOCKADDR_IN6
-
-/* Fields in struct sockaddr_storage */
-#undef HAVE_SS_FAMILY_IN_SS
-#undef HAVE___SS_FAMILY_IN_SS
-
-/* Define if you have /dev/ptmx */
-#undef HAVE_DEV_PTMX
-
-/* Define if you have /dev/ptc */
-#undef HAVE_DEV_PTS_AND_PTC
-
-/* Define if you need to use IP address instead of hostname in $DISPLAY */
-#undef IPADDR_IN_DISPLAY
-
-/* Specify default $PATH */
-#undef USER_PATH
-
-/* Specify location of ssh.pid */
-#undef _PATH_SSH_PIDDIR
-
-/* Use IPv4 for connection by default, IPv6 can still if explicity asked */
-#undef IPV4_DEFAULT
-
-/* getaddrinfo is broken (if present) */
-#undef BROKEN_GETADDRINFO
-
-/* Workaround more Linux IPv6 quirks */
-#undef DONT_TRY_OTHER_AF
-
-/* Detect IPv4 in IPv6 mapped addresses and treat as IPv4 */
-#undef IPV4_IN_IPV6
-
-/* Define if you have BSD auth support */
-#undef BSD_AUTH
-
-/* Define if X11 doesn't support AF_UNIX sockets on that system */
-#undef NO_X11_UNIX_SOCKETS
-
-/* Define if the concept of ports only accessible to superusers isn't known */
-#undef NO_IPPORT_RESERVED_CONCEPT
-
-/* Needed for SCO and NeXT */
-#undef BROKEN_SAVED_UIDS
-
-/* Define if your system glob() function has the GLOB_ALTDIRFUNC extension */
-#undef GLOB_HAS_ALTDIRFUNC
-
-/* Define if your system glob() function has gl_matchc options in glob_t */
-#undef GLOB_HAS_GL_MATCHC
-
-/* Define in your struct dirent expects you to allocate extra space for d_name */
-#undef BROKEN_ONE_BYTE_DIRENT_D_NAME
-
-/* Define if your getopt(3) defines and uses optreset */
-#undef HAVE_GETOPT_OPTRESET
-
-/* Define on *nto-qnx systems */
-#undef MISSING_NFDBITS
-
-/* Define on *nto-qnx systems */
-#undef MISSING_HOWMANY
-
-/* Define on *nto-qnx systems */
-#undef MISSING_FD_MASK
-
-/* Define if you want smartcard support */
-#undef SMARTCARD
-
-/* Define if you want smartcard support using sectok */
-#undef USE_SECTOK
-
-/* Define if you want smartcard support using OpenSC */
-#undef USE_OPENSC
-
-/* Define if you want to use OpenSSL's internally seeded PRNG only */
-#undef OPENSSL_PRNG_ONLY
-
-/* Define if you shouldn't strip 'tty' from your ttyname in [uw]tmp */
-#undef WITH_ABBREV_NO_TTY
-
-/* Define if you want a different $PATH for the superuser */
-#undef SUPERUSER_PATH
-
-/* Path that unprivileged child will chroot() to in privep mode */
-#undef PRIVSEP_PATH
-
-/* Define if your platform needs to skip post auth file descriptor passing */
-#undef DISABLE_FD_PASSING
-
-/* Silly mkstemp() */
-#undef HAVE_STRICT_MKSTEMP
-
-/* Setproctitle emulation */
-#undef SETPROCTITLE_STRATEGY
-#undef SETPROCTITLE_PS_PADDING
-
-/* Some systems put this outside of libc */
-#undef HAVE_NANOSLEEP
-
-/* Pushing STREAMS modules incorrectly acquires a controlling TTY */
-#undef STREAMS_PUSH_ACQUIRES_CTTY
-
-@BOTTOM@
-
-/* ******************* Shouldn't need to edit below this line ************** */
-
-#endif /* _CONFIG_H */
diff --git a/crypto/openssh/aclocal.m4 b/crypto/openssh/aclocal.m4
deleted file mode 100644
index 2705a9b23f7e..000000000000
--- a/crypto/openssh/aclocal.m4
+++ /dev/null
@@ -1,86 +0,0 @@
-dnl $Id: aclocal.m4,v 1.5 2001/10/22 00:53:59 tim Exp $
-dnl
-dnl OpenSSH-specific autoconf macros
-dnl
-
-
-dnl OSSH_CHECK_HEADER_FOR_FIELD(field, header, symbol)
-dnl Does AC_EGREP_HEADER on 'header' for the string 'field'
-dnl If found, set 'symbol' to be defined. Cache the result.
-dnl TODO: This is not foolproof, better to compile and read from there
-AC_DEFUN(OSSH_CHECK_HEADER_FOR_FIELD, [
-# look for field '$1' in header '$2'
-	dnl This strips characters illegal to m4 from the header filename
-	ossh_safe=`echo "$2" | sed 'y%./+-%__p_%'`
-	dnl
-	ossh_varname="ossh_cv_$ossh_safe""_has_"$1
-	AC_MSG_CHECKING(for $1 field in $2)
-	AC_CACHE_VAL($ossh_varname, [
-		AC_EGREP_HEADER($1, $2, [ dnl
-			eval "$ossh_varname=yes" dnl
-		], [ dnl
-			eval "$ossh_varname=no" dnl
-		]) dnl
-	])
-	ossh_result=`eval 'echo $'"$ossh_varname"`
-	if test -n "`echo $ossh_varname`"; then
-		AC_MSG_RESULT($ossh_result)
-		if test "x$ossh_result" = "xyes"; then
-			AC_DEFINE($3)
-		fi
-	else
-		AC_MSG_RESULT(no)
-	fi
-])
-
-dnl OSSH_PATH_ENTROPY_PROG(variablename, command):
-dnl Tidiness function, sets 'undef' if not found, and does the AC_SUBST
-AC_DEFUN(OSSH_PATH_ENTROPY_PROG, [
-	AC_PATH_PROG($1, $2)
-	if test -z "[$]$1" ; then
-		$1="undef"
-	fi
-	AC_SUBST($1)
-])
-
-dnl Check for socklen_t: historically on BSD it is an int, and in
-dnl POSIX 1g it is a type of its own, but some platforms use different
-dnl types for the argument to getsockopt, getpeername, etc.  So we
-dnl have to test to find something that will work.
-AC_DEFUN([TYPE_SOCKLEN_T],
-[
-   AC_CHECK_TYPE([socklen_t], ,[
-      AC_MSG_CHECKING([for socklen_t equivalent])
-      AC_CACHE_VAL([curl_cv_socklen_t_equiv],
-      [
-	 # Systems have either "struct sockaddr *" or
-	 # "void *" as the second argument to getpeername
-	 curl_cv_socklen_t_equiv=
-	 for arg2 in "struct sockaddr" void; do
-	    for t in int size_t unsigned long "unsigned long"; do
-	       AC_TRY_COMPILE([
-		  #include <sys/types.h>
-		  #include <sys/socket.h>
-
-		  int getpeername (int, $arg2 *, $t *);
-	       ],[
-		  $t len;
-		  getpeername(0,0,&len);
-	       ],[
-		  curl_cv_socklen_t_equiv="$t"
-		  break
-	       ])
-	    done
-	 done
-
-	 if test "x$curl_cv_socklen_t_equiv" = x; then
-	    AC_MSG_ERROR([Cannot find a type to use in place of socklen_t])
-	 fi
-      ])
-      AC_MSG_RESULT($curl_cv_socklen_t_equiv)
-      AC_DEFINE_UNQUOTED(socklen_t, $curl_cv_socklen_t_equiv,
-			[type to use in place of socklen_t if not defined])],
-      [#include <sys/types.h>
-#include <sys/socket.h>])
-])
-
diff --git a/crypto/openssh/atomicio.c b/crypto/openssh/atomicio.c
deleted file mode 100644
index 47161eb3a1e3..000000000000
--- a/crypto/openssh/atomicio.c
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
- * Copyright (c) 1995,1999 Theo de Raadt.  All rights reserved.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: atomicio.c,v 1.10 2001/05/08 22:48:07 markus Exp $");
-
-#include "atomicio.h"
-
-/*
- * ensure all of data on socket comes through. f==read || f==write
- */
-ssize_t
-atomicio(f, fd, _s, n)
-	ssize_t (*f) ();
-	int fd;
-	void *_s;
-	size_t n;
-{
-	char *s = _s;
-	ssize_t res, pos = 0;
-
-	while (n > pos) {
-		res = (f) (fd, s + pos, n - pos);
-		switch (res) {
-		case -1:
-#ifdef EWOULDBLOCK
-			if (errno == EINTR || errno == EAGAIN || errno == EWOULDBLOCK)
-#else
-			if (errno == EINTR || errno == EAGAIN)
-#endif
-				continue;
-		case 0:
-			return (res);
-		default:
-			pos += res;
-		}
-	}
-	return (pos);
-}
diff --git a/crypto/openssh/atomicio.h b/crypto/openssh/atomicio.h
deleted file mode 100644
index e569d38c603f..000000000000
--- a/crypto/openssh/atomicio.h
+++ /dev/null
@@ -1,31 +0,0 @@
-/*	$OpenBSD: atomicio.h,v 1.4 2001/06/26 06:32:46 itojun Exp $	*/
-
-/*
- * Copyright (c) 1995,1999 Theo de Raadt.  All rights reserved.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/*
- * Ensure all of data on socket comes through. f==read || f==write
- */
-ssize_t	atomicio(ssize_t (*)(), int, void *, size_t);
diff --git a/crypto/openssh/auth-bsdauth.c b/crypto/openssh/auth-bsdauth.c
deleted file mode 100644
index 2ac27a7a20e7..000000000000
--- a/crypto/openssh/auth-bsdauth.c
+++ /dev/null
@@ -1,125 +0,0 @@
-/*
- * Copyright (c) 2001 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#include "includes.h"
-RCSID("$OpenBSD: auth-bsdauth.c,v 1.5 2002/06/30 21:59:45 deraadt Exp $");
-
-#ifdef BSD_AUTH
-#include "xmalloc.h"
-#include "auth.h"
-#include "log.h"
-#include "monitor_wrap.h"
-
-static void *
-bsdauth_init_ctx(Authctxt *authctxt)
-{
-	return authctxt;
-}
-
-int
-bsdauth_query(void *ctx, char **name, char **infotxt,
-   u_int *numprompts, char ***prompts, u_int **echo_on)
-{
-	Authctxt *authctxt = ctx;
-	char *challenge = NULL;
-
-	if (authctxt->as != NULL) {
-		debug2("bsdauth_query: try reuse session");
-		challenge = auth_getitem(authctxt->as, AUTHV_CHALLENGE);
-		if (challenge == NULL) {
-			auth_close(authctxt->as);
-			authctxt->as = NULL;
-		}
-	}
-
-	if (challenge == NULL) {
-		debug2("bsdauth_query: new bsd auth session");
-		debug3("bsdauth_query: style %s",
-		    authctxt->style ? authctxt->style : "<default>");
-		authctxt->as = auth_userchallenge(authctxt->user,
-		    authctxt->style, "auth-ssh", &challenge);
-		if (authctxt->as == NULL)
-			challenge = NULL;
-		debug2("bsdauth_query: <%s>", challenge ? challenge : "empty");
-	}
-
-	if (challenge == NULL)
-		return -1;
-
-	*name = xstrdup("");
-	*infotxt = xstrdup("");
-	*numprompts = 1;
-	*prompts = xmalloc(*numprompts * sizeof(char *));
-	*echo_on = xmalloc(*numprompts * sizeof(u_int));
-	(*echo_on)[0] = 0;
-	(*prompts)[0] = xstrdup(challenge);
-
-	return 0;
-}
-
-int
-bsdauth_respond(void *ctx, u_int numresponses, char **responses)
-{
-	Authctxt *authctxt = ctx;
-	int authok;
-
-	if (authctxt->as == 0)
-		error("bsdauth_respond: no bsd auth session");
-
-	if (numresponses != 1)
-		return -1;
-
-	authok = auth_userresponse(authctxt->as, responses[0], 0);
-	authctxt->as = NULL;
-	debug3("bsdauth_respond: <%s> = <%d>", responses[0], authok);
-
-	return (authok == 0) ? -1 : 0;
-}
-
-static void
-bsdauth_free_ctx(void *ctx)
-{
-	Authctxt *authctxt = ctx;
-
-	if (authctxt && authctxt->as) {
-		auth_close(authctxt->as);
-		authctxt->as = NULL;
-	}
-}
-
-KbdintDevice bsdauth_device = {
-	"bsdauth",
-	bsdauth_init_ctx,
-	bsdauth_query,
-	bsdauth_respond,
-	bsdauth_free_ctx
-};
-
-KbdintDevice mm_bsdauth_device = {
-	"bsdauth",
-	bsdauth_init_ctx,
-	mm_bsdauth_query,
-	mm_bsdauth_respond,
-	bsdauth_free_ctx
-};
-#endif
diff --git a/crypto/openssh/auth-chall.c b/crypto/openssh/auth-chall.c
deleted file mode 100644
index 45e0c34522b1..000000000000
--- a/crypto/openssh/auth-chall.c
+++ /dev/null
@@ -1,82 +0,0 @@
-/*
- * Copyright (c) 2001 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: auth-chall.c,v 1.8 2001/05/18 14:13:28 markus Exp $");
-
-#include "auth.h"
-#include "log.h"
-#include "xmalloc.h"
-
-/* limited protocol v1 interface to kbd-interactive authentication */
-
-extern KbdintDevice *devices[];
-static KbdintDevice *device;
-
-char *
-get_challenge(Authctxt *authctxt)
-{
-	char *challenge, *name, *info, **prompts;
-	u_int i, numprompts;
-	u_int *echo_on;
-
-	device = devices[0]; /* we always use the 1st device for protocol 1 */
-	if (device == NULL)
-		return NULL;
-	if ((authctxt->kbdintctxt = device->init_ctx(authctxt)) == NULL)
-		return NULL;
-	if (device->query(authctxt->kbdintctxt, &name, &info,
-	    &numprompts, &prompts, &echo_on)) {
-		device->free_ctx(authctxt->kbdintctxt);
-		authctxt->kbdintctxt = NULL;
-		return NULL;
-	}
-	if (numprompts < 1)
-		fatal("get_challenge: numprompts < 1");
-	challenge = xstrdup(prompts[0]);
-	for (i = 0; i < numprompts; i++)
-		xfree(prompts[i]);
-	xfree(prompts);
-	xfree(name);
-	xfree(echo_on);
-	xfree(info);
-
-	return (challenge);
-}
-int
-verify_response(Authctxt *authctxt, const char *response)
-{
-	char *resp[1];
-	int res;
-
-	if (device == NULL)
-		return 0;
-	if (authctxt->kbdintctxt == NULL)
-		return 0;
-	resp[0] = (char *)response;
-	res = device->respond(authctxt->kbdintctxt, 1, resp);
-	device->free_ctx(authctxt->kbdintctxt);
-	authctxt->kbdintctxt = NULL;
-	return res ? 0 : 1;
-}
diff --git a/crypto/openssh/auth-krb4.c b/crypto/openssh/auth-krb4.c
deleted file mode 100644
index b28df469f74e..000000000000
--- a/crypto/openssh/auth-krb4.c
+++ /dev/null
@@ -1,368 +0,0 @@
-/*
- * Copyright (c) 1999 Dug Song.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: auth-krb4.c,v 1.29 2003/02/21 10:34:48 mpech Exp $");
-
-#include "ssh.h"
-#include "ssh1.h"
-#include "packet.h"
-#include "xmalloc.h"
-#include "log.h"
-#include "servconf.h"
-#include "uidswap.h"
-#include "auth.h"
-
-#ifdef AFS
-#include "radix.h"
-#endif
-
-#ifdef KRB4
-extern ServerOptions options;
-
-static int
-krb4_init(void *context)
-{
-	static int cleanup_registered = 0;
-	Authctxt *authctxt = (Authctxt *)context;
-	const char *tkt_root = TKT_ROOT;
-	struct stat st;
-	int fd;
-
-	if (!authctxt->krb4_ticket_file) {
-		/* Set unique ticket string manually since we're still root. */
-		authctxt->krb4_ticket_file = xmalloc(MAXPATHLEN);
-#ifdef AFS
-		if (lstat("/ticket", &st) != -1)
-			tkt_root = "/ticket/";
-#endif /* AFS */
-		snprintf(authctxt->krb4_ticket_file, MAXPATHLEN, "%s%u_%ld",
-		    tkt_root, authctxt->pw->pw_uid, (long)getpid());
-		krb_set_tkt_string(authctxt->krb4_ticket_file);
-	}
-	/* Register ticket cleanup in case of fatal error. */
-	if (!cleanup_registered) {
-		fatal_add_cleanup(krb4_cleanup_proc, authctxt);
-		cleanup_registered = 1;
-	}
-	/* Try to create our ticket file. */
-	if ((fd = mkstemp(authctxt->krb4_ticket_file)) != -1) {
-		close(fd);
-		return (1);
-	}
-	/* Ticket file exists - make sure user owns it (just passed ticket). */
-	if (lstat(authctxt->krb4_ticket_file, &st) != -1) {
-		if (st.st_mode == (S_IFREG | S_IRUSR | S_IWUSR) &&
-		    st.st_uid == authctxt->pw->pw_uid)
-			return (1);
-	}
-	/* Failure - cancel cleanup function, leaving ticket for inspection. */
-	log("WARNING: bad ticket file %s", authctxt->krb4_ticket_file);
-
-	fatal_remove_cleanup(krb4_cleanup_proc, authctxt);
-	cleanup_registered = 0;
-
-	xfree(authctxt->krb4_ticket_file);
-	authctxt->krb4_ticket_file = NULL;
-
-	return (0);
-}
-
-/*
- * try krb4 authentication,
- * return 1 on success, 0 on failure, -1 if krb4 is not available
- */
-int
-auth_krb4_password(Authctxt *authctxt, const char *password)
-{
-	AUTH_DAT adata;
-	KTEXT_ST tkt;
-	struct hostent *hp;
-	struct passwd *pw;
-	char localhost[MAXHOSTNAMELEN], phost[INST_SZ], realm[REALM_SZ];
-	u_int32_t faddr;
-	int r;
-
-	if ((pw = authctxt->pw) == NULL)
-		return (0);
-
-	/*
-	 * Try Kerberos password authentication only for non-root
-	 * users and only if Kerberos is installed.
-	 */
-	if (pw->pw_uid != 0 && krb_get_lrealm(realm, 1) == KSUCCESS) {
-		/* Set up our ticket file. */
-		if (!krb4_init(authctxt)) {
-			log("Couldn't initialize Kerberos ticket file for %s!",
-			    pw->pw_name);
-			goto failure;
-		}
-		/* Try to get TGT using our password. */
-		r = krb_get_pw_in_tkt((char *) pw->pw_name, "", realm,
-		    "krbtgt", realm, DEFAULT_TKT_LIFE, (char *)password);
-		if (r != INTK_OK) {
-			debug("Kerberos v4 password authentication for %s "
-			    "failed: %s", pw->pw_name, krb_err_txt[r]);
-			goto failure;
-		}
-		/* Successful authentication. */
-		chown(tkt_string(), pw->pw_uid, pw->pw_gid);
-
-		/*
-		 * Now that we have a TGT, try to get a local
-		 * "rcmd" ticket to ensure that we are not talking
-		 * to a bogus Kerberos server.
-		 */
-		gethostname(localhost, sizeof(localhost));
-		strlcpy(phost, (char *)krb_get_phost(localhost),
-		    sizeof(phost));
-		r = krb_mk_req(&tkt, KRB4_SERVICE_NAME, phost, realm, 33);
-
-		if (r == KSUCCESS) {
-			if ((hp = gethostbyname(localhost)) == NULL) {
-				log("Couldn't get local host address!");
-				goto failure;
-			}
-			memmove((void *)&faddr, (void *)hp->h_addr,
-			    sizeof(faddr));
-
-			/* Verify our "rcmd" ticket. */
-			r = krb_rd_req(&tkt, KRB4_SERVICE_NAME, phost,
-			    faddr, &adata, "");
-			if (r == RD_AP_UNDEC) {
-				/*
-				 * Probably didn't have a srvtab on
-				 * localhost. Disallow login.
-				 */
-				log("Kerberos v4 TGT for %s unverifiable, "
-				    "no srvtab installed? krb_rd_req: %s",
-				    pw->pw_name, krb_err_txt[r]);
-				goto failure;
-			} else if (r != KSUCCESS) {
-				log("Kerberos v4 %s ticket unverifiable: %s",
-				    KRB4_SERVICE_NAME, krb_err_txt[r]);
-				goto failure;
-			}
-		} else if (r == KDC_PR_UNKNOWN) {
-			/*
-			 * Disallow login if no rcmd service exists, and
-			 * log the error.
-			 */
-			log("Kerberos v4 TGT for %s unverifiable: %s; %s.%s "
-			    "not registered, or srvtab is wrong?", pw->pw_name,
-			    krb_err_txt[r], KRB4_SERVICE_NAME, phost);
-			goto failure;
-		} else {
-			/*
-			 * TGT is bad, forget it. Possibly spoofed!
-			 */
-			debug("WARNING: Kerberos v4 TGT possibly spoofed "
-			    "for %s: %s", pw->pw_name, krb_err_txt[r]);
-			goto failure;
-		}
-		/* Authentication succeeded. */
-		return (1);
-	} else
-		/* Logging in as root or no local Kerberos realm. */
-		debug("Unable to authenticate to Kerberos.");
-
- failure:
-	krb4_cleanup_proc(authctxt);
-
-	if (!options.kerberos_or_local_passwd)
-		return (0);
-
-	/* Fall back to ordinary passwd authentication. */
-	return (-1);
-}
-
-void
-krb4_cleanup_proc(void *context)
-{
-	Authctxt *authctxt = (Authctxt *)context;
-	debug("krb4_cleanup_proc called");
-	if (authctxt->krb4_ticket_file) {
-		(void) dest_tkt();
-		xfree(authctxt->krb4_ticket_file);
-		authctxt->krb4_ticket_file = NULL;
-	}
-}
-
-int
-auth_krb4(Authctxt *authctxt, KTEXT auth, char **client, KTEXT reply)
-{
-	AUTH_DAT adat = {0};
-	Key_schedule schedule;
-	struct sockaddr_in local, foreign;
-	char instance[INST_SZ];
-	socklen_t slen;
-	u_int cksum;
-	int r, s;
-
-	s = packet_get_connection_in();
-
-	slen = sizeof(local);
-	memset(&local, 0, sizeof(local));
-	if (getsockname(s, (struct sockaddr *) & local, &slen) < 0)
-		debug("getsockname failed: %.100s", strerror(errno));
-	slen = sizeof(foreign);
-	memset(&foreign, 0, sizeof(foreign));
-	if (getpeername(s, (struct sockaddr *) & foreign, &slen) < 0) {
-		debug("getpeername failed: %.100s", strerror(errno));
-		fatal_cleanup();
-	}
-	instance[0] = '*';
-	instance[1] = 0;
-
-	/* Get the encrypted request, challenge, and session key. */
-	if ((r = krb_rd_req(auth, KRB4_SERVICE_NAME, instance,
-	    0, &adat, ""))) {
-		debug("Kerberos v4 krb_rd_req: %.100s", krb_err_txt[r]);
-		return (0);
-	}
-	des_key_sched((des_cblock *) adat.session, schedule);
-
-	*client = xmalloc(MAX_K_NAME_SZ);
-	(void) snprintf(*client, MAX_K_NAME_SZ, "%s%s%s@%s", adat.pname,
-	    *adat.pinst ? "." : "", adat.pinst, adat.prealm);
-
-	/* Check ~/.klogin authorization now. */
-	if (kuserok(&adat, authctxt->user) != KSUCCESS) {
-		log("Kerberos v4 .klogin authorization failed for %s to "
-		    "account %s", *client, authctxt->user);
-		xfree(*client);
-		*client = NULL;
-		return (0);
-	}
-	/* Increment the checksum, and return it encrypted with the
-	   session key. */
-	cksum = adat.checksum + 1;
-	cksum = htonl(cksum);
-
-	/* If we can't successfully encrypt the checksum, we send back an
-	   empty message, admitting our failure. */
-	if ((r = krb_mk_priv((u_char *) & cksum, reply->dat, sizeof(cksum) + 1,
-	    schedule, &adat.session, &local, &foreign)) < 0) {
-		debug("Kerberos v4 mk_priv: (%d) %s", r, krb_err_txt[r]);
-		reply->dat[0] = 0;
-		reply->length = 0;
-	} else
-		reply->length = r;
-
-	/* Clear session key. */
-	memset(&adat.session, 0, sizeof(adat.session));
-	return (1);
-}
-#endif /* KRB4 */
-
-#ifdef AFS
-int
-auth_krb4_tgt(Authctxt *authctxt, const char *string)
-{
-	CREDENTIALS creds;
-	struct passwd *pw;
-
-	if ((pw = authctxt->pw) == NULL)
-		goto failure;
-
-	temporarily_use_uid(pw);
-
-	if (!radix_to_creds(string, &creds)) {
-		log("Protocol error decoding Kerberos v4 TGT");
-		goto failure;
-	}
-	if (strncmp(creds.service, "", 1) == 0)	/* backward compatibility */
-		strlcpy(creds.service, "krbtgt", sizeof creds.service);
-
-	if (strcmp(creds.service, "krbtgt")) {
-		log("Kerberos v4 TGT (%s%s%s@%s) rejected for %s",
-		    creds.pname, creds.pinst[0] ? "." : "", creds.pinst,
-		    creds.realm, pw->pw_name);
-		goto failure;
-	}
-	if (!krb4_init(authctxt))
-		goto failure;
-
-	if (in_tkt(creds.pname, creds.pinst) != KSUCCESS)
-		goto failure;
-
-	if (save_credentials(creds.service, creds.instance, creds.realm,
-	    creds.session, creds.lifetime, creds.kvno, &creds.ticket_st,
-	    creds.issue_date) != KSUCCESS) {
-		debug("Kerberos v4 TGT refused: couldn't save credentials");
-		goto failure;
-	}
-	/* Successful authentication, passed all checks. */
-	chown(tkt_string(), pw->pw_uid, pw->pw_gid);
-
-	debug("Kerberos v4 TGT accepted (%s%s%s@%s)",
-	    creds.pname, creds.pinst[0] ? "." : "", creds.pinst, creds.realm);
-	memset(&creds, 0, sizeof(creds));
-
-	restore_uid();
-
-	return (1);
-
- failure:
-	krb4_cleanup_proc(authctxt);
-	memset(&creds, 0, sizeof(creds));
-	restore_uid();
-
-	return (0);
-}
-
-int
-auth_afs_token(Authctxt *authctxt, const char *token_string)
-{
-	CREDENTIALS creds;
-	struct passwd *pw;
-	uid_t uid;
-
-	if ((pw = authctxt->pw) == NULL)
-		return (0);
-
-	if (!radix_to_creds(token_string, &creds)) {
-		log("Protocol error decoding AFS token");
-		return (0);
-	}
-	if (strncmp(creds.service, "", 1) == 0)	/* backward compatibility */
-		strlcpy(creds.service, "afs", sizeof creds.service);
-
-	if (strncmp(creds.pname, "AFS ID ", 7) == 0)
-		uid = atoi(creds.pname + 7);
-	else
-		uid = pw->pw_uid;
-
-	if (kafs_settoken(creds.realm, uid, &creds)) {
-		log("AFS token (%s@%s) rejected for %s",
-		    creds.pname, creds.realm, pw->pw_name);
-		memset(&creds, 0, sizeof(creds));
-		return (0);
-	}
-	debug("AFS token accepted (%s@%s)", creds.pname, creds.realm);
-	memset(&creds, 0, sizeof(creds));
-
-	return (1);
-}
-#endif /* AFS */
diff --git a/crypto/openssh/auth-krb5.c b/crypto/openssh/auth-krb5.c
deleted file mode 100644
index c1a0069f1efd..000000000000
--- a/crypto/openssh/auth-krb5.c
+++ /dev/null
@@ -1,405 +0,0 @@
-/*
- *    Kerberos v5 authentication and ticket-passing routines.
- *
- * $FreeBSD$
- */
-/*
- * Copyright (c) 2002 Daniel Kouril.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: auth-krb5.c,v 1.10 2002/11/21 23:03:51 deraadt Exp $");
-
-#include "ssh.h"
-#include "ssh1.h"
-#include "packet.h"
-#include "xmalloc.h"
-#include "log.h"
-#include "servconf.h"
-#include "uidswap.h"
-#include "auth.h"
-
-#ifdef KRB5
-#include <krb5.h>
-#ifndef HEIMDAL
-#define krb5_get_err_text(context,code) error_message(code)
-#endif /* !HEIMDAL */
-
-extern ServerOptions	 options;
-
-static int
-krb5_init(void *context)
-{
-	Authctxt *authctxt = (Authctxt *)context;
-	krb5_error_code problem;
-	static int cleanup_registered = 0;
-
-	if (authctxt->krb5_ctx == NULL) {
-		problem = krb5_init_context(&authctxt->krb5_ctx);
-		if (problem)
-			return (problem);
-		krb5_init_ets(authctxt->krb5_ctx);
-	}
-	if (!cleanup_registered) {
-		fatal_add_cleanup(krb5_cleanup_proc, authctxt);
-		cleanup_registered = 1;
-	}
-	return (0);
-}
-
-/*
- * Try krb5 authentication. server_user is passed for logging purposes
- * only, in auth is received ticket, in client is returned principal
- * from the ticket
- */
-int
-auth_krb5(Authctxt *authctxt, krb5_data *auth, char **client, krb5_data *reply)
-{
-	krb5_error_code problem;
-	krb5_principal server;
-	krb5_ticket *ticket;
-	int fd, ret;
-
-	ret = 0;
-	server = NULL;
-	ticket = NULL;
-	reply->length = 0;
-
-	problem = krb5_init(authctxt);
-	if (problem)
-		goto err;
-
-	problem = krb5_auth_con_init(authctxt->krb5_ctx,
-	    &authctxt->krb5_auth_ctx);
-	if (problem)
-		goto err;
-
-	fd = packet_get_connection_in();
-#ifdef HEIMDAL
-	problem = krb5_auth_con_setaddrs_from_fd(authctxt->krb5_ctx,
-	    authctxt->krb5_auth_ctx, &fd);
-#else
-	problem = krb5_auth_con_genaddrs(authctxt->krb5_ctx, 
-	    authctxt->krb5_auth_ctx,fd,
-	    KRB5_AUTH_CONTEXT_GENERATE_REMOTE_FULL_ADDR |
-	    KRB5_AUTH_CONTEXT_GENERATE_LOCAL_FULL_ADDR);
-#endif
-	if (problem)
-		goto err;
-
-	problem = krb5_sname_to_principal(authctxt->krb5_ctx, NULL, NULL,
-	    KRB5_NT_SRV_HST, &server);
-	if (problem)
-		goto err;
-
-	problem = krb5_rd_req(authctxt->krb5_ctx, &authctxt->krb5_auth_ctx,
-	    auth, server, NULL, NULL, &ticket);
-	if (problem)
-		goto err;
-
-#ifdef HEIMDAL
-	problem = krb5_copy_principal(authctxt->krb5_ctx, ticket->client,
-	    &authctxt->krb5_user);
-#else
-	problem = krb5_copy_principal(authctxt->krb5_ctx, 
-				      ticket->enc_part2->client,
-				      &authctxt->krb5_user);
-#endif
-	if (problem)
-		goto err;
-
-	/* if client wants mutual auth */
-	problem = krb5_mk_rep(authctxt->krb5_ctx, authctxt->krb5_auth_ctx,
-	    reply);
-	if (problem)
-		goto err;
-
-	/* Check .k5login authorization now. */
-	if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user,
-	    authctxt->pw->pw_name))
-		goto err;
-
-	if (client)
-		krb5_unparse_name(authctxt->krb5_ctx, authctxt->krb5_user,
-		    client);
-
-	ret = 1;
- err:
-	if (server)
-		krb5_free_principal(authctxt->krb5_ctx, server);
-	if (ticket)
-		krb5_free_ticket(authctxt->krb5_ctx, ticket);
-	if (!ret && reply->length) {
-		xfree(reply->data);
-		memset(reply, 0, sizeof(*reply));
-	}
-
-	if (problem) {
-		if (authctxt->krb5_ctx != NULL)
-			debug("Kerberos v5 authentication failed: %s",
-			    krb5_get_err_text(authctxt->krb5_ctx, problem));
-		else
-			debug("Kerberos v5 authentication failed: %d",
-			    problem);
-	}
-
-	return (ret);
-}
-
-int
-auth_krb5_tgt(Authctxt *authctxt, krb5_data *tgt)
-{
-	krb5_error_code problem;
-	krb5_ccache ccache = NULL;
-	char *pname;
-	krb5_creds **creds;
-
-	if (authctxt->pw == NULL || authctxt->krb5_user == NULL)
-		return (0);
-
-	temporarily_use_uid(authctxt->pw);
-
-#ifdef HEIMDAL
-	problem = krb5_cc_gen_new(authctxt->krb5_ctx, &krb5_fcc_ops, &ccache);
-#else
-{
-	char ccname[40];
-	int tmpfd;
-	
-	snprintf(ccname,sizeof(ccname),"FILE:/tmp/krb5cc_%d_XXXXXX",geteuid());
-	
-	if ((tmpfd = mkstemp(ccname+strlen("FILE:")))==-1) {
-		log("mkstemp(): %.100s", strerror(errno));
-		problem = errno;
-		goto fail;
-	}
-	if (fchmod(tmpfd,S_IRUSR | S_IWUSR) == -1) {
-		log("fchmod(): %.100s", strerror(errno));
-		close(tmpfd);
-		problem = errno;
-		goto fail;
-	}
-	close(tmpfd);
-	problem = krb5_cc_resolve(authctxt->krb5_ctx, ccname, &ccache);
-}
-#endif
-	if (problem)
-		goto fail;
-
-	problem = krb5_cc_initialize(authctxt->krb5_ctx, ccache,
-	    authctxt->krb5_user);
-	if (problem)
-		goto fail;
-
-#ifdef HEIMDAL
-	problem = krb5_rd_cred2(authctxt->krb5_ctx, authctxt->krb5_auth_ctx,
-	    ccache, tgt);
-	if (problem)
-		goto fail;
-#else
-	problem = krb5_rd_cred(authctxt->krb5_ctx, authctxt->krb5_auth_ctx,
-	    tgt, &creds, NULL);
-	if (problem)
-		goto fail;
-	problem = krb5_cc_store_cred(authctxt->krb5_ctx, ccache, *creds);
-	if (problem)
-		goto fail;
-#endif
-
-	authctxt->krb5_fwd_ccache = ccache;
-	ccache = NULL;
-
-	authctxt->krb5_ticket_file = (char *)krb5_cc_get_name(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
-
-	problem = krb5_unparse_name(authctxt->krb5_ctx, authctxt->krb5_user,
-	    &pname);
-	if (problem)
-		goto fail;
-
-	debug("Kerberos v5 TGT accepted (%s)", pname);
-
-	restore_uid();
-
-	return (1);
-
- fail:
-	if (problem)
-		debug("Kerberos v5 TGT passing failed: %s",
-		    krb5_get_err_text(authctxt->krb5_ctx, problem));
-	if (ccache)
-		krb5_cc_destroy(authctxt->krb5_ctx, ccache);
-
-	restore_uid();
-
-	return (0);
-}
-
-int
-auth_krb5_password(Authctxt *authctxt, const char *password)
-{
-#ifndef HEIMDAL
-	krb5_creds creds;
-	krb5_principal server;
-	char ccname[40];
-	int tmpfd;
-#endif	
-	krb5_error_code problem;
-
-	if (authctxt->pw == NULL)
-		return (0);
-
-	temporarily_use_uid(authctxt->pw);
-
-	problem = krb5_init(authctxt);
-	if (problem)
-		goto out;
-
-	problem = krb5_parse_name(authctxt->krb5_ctx, authctxt->pw->pw_name,
-		    &authctxt->krb5_user);
-	if (problem)
-		goto out;
-
-#ifdef HEIMDAL
-	problem = krb5_cc_gen_new(authctxt->krb5_ctx, &krb5_mcc_ops,
-	    &authctxt->krb5_fwd_ccache);
-	if (problem)
-		goto out;
-
-	problem = krb5_cc_initialize(authctxt->krb5_ctx,
-	    authctxt->krb5_fwd_ccache, authctxt->krb5_user);
-	if (problem)
-		goto out;
-
-	restore_uid();
-	problem = krb5_verify_user(authctxt->krb5_ctx, authctxt->krb5_user,
-	    authctxt->krb5_fwd_ccache, password, 1, NULL);
-	temporarily_use_uid(authctxt->pw);
-
-	if (problem)
-		goto out;
-
-#else
-	problem = krb5_get_init_creds_password(authctxt->krb5_ctx, &creds,
-	    authctxt->krb5_user, (char *)password, NULL, NULL, 0, NULL, NULL);
-	if (problem)
-		goto out;
-
-	problem = krb5_sname_to_principal(authctxt->krb5_ctx, NULL, NULL,
-	    KRB5_NT_SRV_HST, &server);
-	if (problem)
-		goto out;
-
-	restore_uid();
-	problem = krb5_verify_init_creds(authctxt->krb5_ctx, &creds, server,
-	    NULL, NULL, NULL);
-	krb5_free_principal(authctxt->krb5_ctx, server);
-	temporarily_use_uid(authctxt->pw);
-	if (problem)
-		goto out;
-	
-	if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user, 
-			  authctxt->pw->pw_name)) {
-		problem = -1;
-		goto out;
-	} 
-
-	snprintf(ccname,sizeof(ccname),"FILE:/tmp/krb5cc_%d_XXXXXX",geteuid());
-	
-	if ((tmpfd = mkstemp(ccname+strlen("FILE:")))==-1) {
-		log("mkstemp(): %.100s", strerror(errno));
-		problem = errno;
-		goto out;
-	}
-	
-	if (fchmod(tmpfd,S_IRUSR | S_IWUSR) == -1) {
-		log("fchmod(): %.100s", strerror(errno));
-		close(tmpfd);
-		problem = errno;
-		goto out;
-	}
-	close(tmpfd);
-
-	problem = krb5_cc_resolve(authctxt->krb5_ctx, ccname, &authctxt->krb5_fwd_ccache);
-	if (problem)
-		goto out;
-
-	problem = krb5_cc_initialize(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache,
-				     authctxt->krb5_user);
-	if (problem)
-		goto out;
-				
-	problem= krb5_cc_store_cred(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache,
-				 &creds);
-	if (problem)
-		goto out;
-#endif		
-
-	authctxt->krb5_ticket_file = (char *)krb5_cc_get_name(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
-
- out:
-	restore_uid();
-
-	if (problem) {
-		if (authctxt->krb5_ctx != NULL && problem!=-1)
-			debug("Kerberos password authentication failed: %s",
-			    krb5_get_err_text(authctxt->krb5_ctx, problem));
-		else
-			debug("Kerberos password authentication failed: %d",
-			    problem);
-
-		krb5_cleanup_proc(authctxt);
-
-		if (options.kerberos_or_local_passwd)
-			return (-1);
-		else
-			return (0);
-	}
-	return (1);
-}
-
-void
-krb5_cleanup_proc(void *context)
-{
-	Authctxt *authctxt = (Authctxt *)context;
-
-	debug("krb5_cleanup_proc called");
-	if (authctxt->krb5_fwd_ccache) {
-		krb5_cc_destroy(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
-		authctxt->krb5_fwd_ccache = NULL;
-	}
-	if (authctxt->krb5_user) {
-		krb5_free_principal(authctxt->krb5_ctx, authctxt->krb5_user);
-		authctxt->krb5_user = NULL;
-	}
-	if (authctxt->krb5_auth_ctx) {
-		krb5_auth_con_free(authctxt->krb5_ctx,
-		    authctxt->krb5_auth_ctx);
-		authctxt->krb5_auth_ctx = NULL;
-	}
-	if (authctxt->krb5_ctx) {
-		krb5_free_context(authctxt->krb5_ctx);
-		authctxt->krb5_ctx = NULL;
-	}
-}
-
-#endif /* KRB5 */
diff --git a/crypto/openssh/auth-options.c b/crypto/openssh/auth-options.c
deleted file mode 100644
index 8595fdc147d8..000000000000
--- a/crypto/openssh/auth-options.c
+++ /dev/null
@@ -1,300 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: auth-options.c,v 1.26 2002/07/30 17:03:55 markus Exp $");
-
-#include "xmalloc.h"
-#include "match.h"
-#include "log.h"
-#include "canohost.h"
-#include "channels.h"
-#include "auth-options.h"
-#include "servconf.h"
-#include "misc.h"
-#include "monitor_wrap.h"
-#include "auth.h"
-
-/* Flags set authorized_keys flags */
-int no_port_forwarding_flag = 0;
-int no_agent_forwarding_flag = 0;
-int no_x11_forwarding_flag = 0;
-int no_pty_flag = 0;
-
-/* "command=" option. */
-char *forced_command = NULL;
-
-/* "environment=" options. */
-struct envstring *custom_environment = NULL;
-
-extern ServerOptions options;
-
-void
-auth_clear_options(void)
-{
-	no_agent_forwarding_flag = 0;
-	no_port_forwarding_flag = 0;
-	no_pty_flag = 0;
-	no_x11_forwarding_flag = 0;
-	while (custom_environment) {
-		struct envstring *ce = custom_environment;
-		custom_environment = ce->next;
-		xfree(ce->s);
-		xfree(ce);
-	}
-	if (forced_command) {
-		xfree(forced_command);
-		forced_command = NULL;
-	}
-	channel_clear_permitted_opens();
-	auth_debug_reset();
-}
-
-/*
- * return 1 if access is granted, 0 if not.
- * side effect: sets key option flags
- */
-int
-auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
-{
-	const char *cp;
-	int i;
-
-	/* reset options */
-	auth_clear_options();
-
-	if (!opts)
-		return 1;
-
-	while (*opts && *opts != ' ' && *opts != '\t') {
-		cp = "no-port-forwarding";
-		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
-			auth_debug_add("Port forwarding disabled.");
-			no_port_forwarding_flag = 1;
-			opts += strlen(cp);
-			goto next_option;
-		}
-		cp = "no-agent-forwarding";
-		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
-			auth_debug_add("Agent forwarding disabled.");
-			no_agent_forwarding_flag = 1;
-			opts += strlen(cp);
-			goto next_option;
-		}
-		cp = "no-X11-forwarding";
-		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
-			auth_debug_add("X11 forwarding disabled.");
-			no_x11_forwarding_flag = 1;
-			opts += strlen(cp);
-			goto next_option;
-		}
-		cp = "no-pty";
-		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
-			auth_debug_add("Pty allocation disabled.");
-			no_pty_flag = 1;
-			opts += strlen(cp);
-			goto next_option;
-		}
-		cp = "command=\"";
-		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
-			opts += strlen(cp);
-			forced_command = xmalloc(strlen(opts) + 1);
-			i = 0;
-			while (*opts) {
-				if (*opts == '"')
-					break;
-				if (*opts == '\\' && opts[1] == '"') {
-					opts += 2;
-					forced_command[i++] = '"';
-					continue;
-				}
-				forced_command[i++] = *opts++;
-			}
-			if (!*opts) {
-				debug("%.100s, line %lu: missing end quote",
-				    file, linenum);
-				auth_debug_add("%.100s, line %lu: missing end quote",
-				    file, linenum);
-				xfree(forced_command);
-				forced_command = NULL;
-				goto bad_option;
-			}
-			forced_command[i] = 0;
-			auth_debug_add("Forced command: %.900s", forced_command);
-			opts++;
-			goto next_option;
-		}
-		cp = "environment=\"";
-		if (options.permit_user_env &&
-		    strncasecmp(opts, cp, strlen(cp)) == 0) {
-			char *s;
-			struct envstring *new_envstring;
-
-			opts += strlen(cp);
-			s = xmalloc(strlen(opts) + 1);
-			i = 0;
-			while (*opts) {
-				if (*opts == '"')
-					break;
-				if (*opts == '\\' && opts[1] == '"') {
-					opts += 2;
-					s[i++] = '"';
-					continue;
-				}
-				s[i++] = *opts++;
-			}
-			if (!*opts) {
-				debug("%.100s, line %lu: missing end quote",
-				    file, linenum);
-				auth_debug_add("%.100s, line %lu: missing end quote",
-				    file, linenum);
-				xfree(s);
-				goto bad_option;
-			}
-			s[i] = 0;
-			auth_debug_add("Adding to environment: %.900s", s);
-			debug("Adding to environment: %.900s", s);
-			opts++;
-			new_envstring = xmalloc(sizeof(struct envstring));
-			new_envstring->s = s;
-			new_envstring->next = custom_environment;
-			custom_environment = new_envstring;
-			goto next_option;
-		}
-		cp = "from=\"";
-		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
-			const char *remote_ip = get_remote_ipaddr();
-			const char *remote_host = get_canonical_hostname(
-			    options.verify_reverse_mapping);
-			char *patterns = xmalloc(strlen(opts) + 1);
-
-			opts += strlen(cp);
-			i = 0;
-			while (*opts) {
-				if (*opts == '"')
-					break;
-				if (*opts == '\\' && opts[1] == '"') {
-					opts += 2;
-					patterns[i++] = '"';
-					continue;
-				}
-				patterns[i++] = *opts++;
-			}
-			if (!*opts) {
-				debug("%.100s, line %lu: missing end quote",
-				    file, linenum);
-				auth_debug_add("%.100s, line %lu: missing end quote",
-				    file, linenum);
-				xfree(patterns);
-				goto bad_option;
-			}
-			patterns[i] = 0;
-			opts++;
-			if (match_host_and_ip(remote_host, remote_ip,
-			    patterns) != 1) {
-				xfree(patterns);
-				log("Authentication tried for %.100s with "
-				    "correct key but not from a permitted "
-				    "host (host=%.200s, ip=%.200s).",
-				    pw->pw_name, remote_host, remote_ip);
-				auth_debug_add("Your host '%.200s' is not "
-				    "permitted to use this key for login.",
-				    remote_host);
-				/* deny access */
-				return 0;
-			}
-			xfree(patterns);
-			/* Host name matches. */
-			goto next_option;
-		}
-		cp = "permitopen=\"";
-		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
-			char host[256], sport[6];
-			u_short port;
-			char *patterns = xmalloc(strlen(opts) + 1);
-
-			opts += strlen(cp);
-			i = 0;
-			while (*opts) {
-				if (*opts == '"')
-					break;
-				if (*opts == '\\' && opts[1] == '"') {
-					opts += 2;
-					patterns[i++] = '"';
-					continue;
-				}
-				patterns[i++] = *opts++;
-			}
-			if (!*opts) {
-				debug("%.100s, line %lu: missing end quote",
-				    file, linenum);
-				auth_debug_add("%.100s, line %lu: missing end quote",
-				    file, linenum);
-				xfree(patterns);
-				goto bad_option;
-			}
-			patterns[i] = 0;
-			opts++;
-			if (sscanf(patterns, "%255[^:]:%5[0-9]", host, sport) != 2 &&
-			    sscanf(patterns, "%255[^/]/%5[0-9]", host, sport) != 2) {
-				debug("%.100s, line %lu: Bad permitopen specification "
-				    "<%.100s>", file, linenum, patterns);
-				auth_debug_add("%.100s, line %lu: "
-				    "Bad permitopen specification", file, linenum);
-				xfree(patterns);
-				goto bad_option;
-			}
-			if ((port = a2port(sport)) == 0) {
-				debug("%.100s, line %lu: Bad permitopen port <%.100s>",
-				    file, linenum, sport);
-				auth_debug_add("%.100s, line %lu: "
-				    "Bad permitopen port", file, linenum);
-				xfree(patterns);
-				goto bad_option;
-			}
-			if (options.allow_tcp_forwarding)
-				channel_add_permitted_opens(host, port);
-			xfree(patterns);
-			goto next_option;
-		}
-next_option:
-		/*
-		 * Skip the comma, and move to the next option
-		 * (or break out if there are no more).
-		 */
-		if (!*opts)
-			fatal("Bugs in auth-options.c option processing.");
-		if (*opts == ' ' || *opts == '\t')
-			break;		/* End of options. */
-		if (*opts != ',')
-			goto bad_option;
-		opts++;
-		/* Process the next option. */
-	}
-
-	if (!use_privsep)
-		auth_debug_send();
-
-	/* grant access */
-	return 1;
-
-bad_option:
-	log("Bad options in %.100s file, line %lu: %.50s",
-	    file, linenum, opts);
-	auth_debug_add("Bad options in %.100s file, line %lu: %.50s",
-	    file, linenum, opts);
-
-	if (!use_privsep)
-		auth_debug_send();
-
-	/* deny access */
-	return 0;
-}
diff --git a/crypto/openssh/auth-options.h b/crypto/openssh/auth-options.h
deleted file mode 100644
index 15fb21255e53..000000000000
--- a/crypto/openssh/auth-options.h
+++ /dev/null
@@ -1,35 +0,0 @@
-/*	$OpenBSD: auth-options.h,v 1.12 2002/07/21 18:34:43 stevesk Exp $	*/
-
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#ifndef AUTH_OPTIONS_H
-#define AUTH_OPTIONS_H
-
-/* Linked list of custom environment strings */
-struct envstring {
-	struct envstring *next;
-	char   *s;
-};
-
-/* Flags that may be set in authorized_keys options. */
-extern int no_port_forwarding_flag;
-extern int no_agent_forwarding_flag;
-extern int no_x11_forwarding_flag;
-extern int no_pty_flag;
-extern char *forced_command;
-extern struct envstring *custom_environment;
-
-int	auth_parse_options(struct passwd *, char *, char *, u_long);
-void	auth_clear_options(void);
-
-#endif
diff --git a/crypto/openssh/auth-pam.c b/crypto/openssh/auth-pam.c
deleted file mode 100644
index fe9570f92a10..000000000000
--- a/crypto/openssh/auth-pam.c
+++ /dev/null
@@ -1,455 +0,0 @@
-/*
- * Copyright (c) 2000 Damien Miller.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-
-#ifdef USE_PAM
-#include "xmalloc.h"
-#include "log.h"
-#include "auth.h"
-#include "auth-options.h"
-#include "auth-pam.h"
-#include "servconf.h"
-#include "canohost.h"
-#include "readpass.h"
-
-extern char *__progname;
-
-extern int use_privsep;
-
-RCSID("$Id: auth-pam.c,v 1.55 2003/01/22 04:42:26 djm Exp $");
-
-#define NEW_AUTHTOK_MSG \
-	"Warning: Your password has expired, please change it now."
-#define NEW_AUTHTOK_MSG_PRIVSEP \
-	"Your password has expired, the session cannot proceed."
-
-static int do_pam_conversation(int num_msg, const struct pam_message **msg,
-	struct pam_response **resp, void *appdata_ptr);
-
-/* module-local variables */
-static struct pam_conv conv = {
-	(int (*)())do_pam_conversation,
-	NULL
-};
-static char *__pam_msg = NULL;
-static pam_handle_t *__pamh = NULL;
-static const char *__pampasswd = NULL;
-
-/* states for do_pam_conversation() */
-enum { INITIAL_LOGIN, OTHER } pamstate = INITIAL_LOGIN;
-/* remember whether pam_acct_mgmt() returned PAM_NEW_AUTHTOK_REQD */
-static int password_change_required = 0;
-/* remember whether the last pam_authenticate() succeeded or not */
-static int was_authenticated = 0;
-
-/* Remember what has been initialised */
-static int session_opened = 0;
-static int creds_set = 0;
-
-/* accessor which allows us to switch conversation structs according to
- * the authentication method being used */
-void do_pam_set_conv(struct pam_conv *conv)
-{
-	pam_set_item(__pamh, PAM_CONV, conv);
-}
-
-/* start an authentication run */
-int do_pam_authenticate(int flags)
-{
-	int retval = pam_authenticate(__pamh, flags);
-	was_authenticated = (retval == PAM_SUCCESS);
-	return retval;
-}
-
-/*
- * PAM conversation function.
- * There are two states this can run in.
- *
- * INITIAL_LOGIN mode simply feeds the password from the client into
- * PAM in response to PAM_PROMPT_ECHO_OFF, and collects output
- * messages with into __pam_msg.  This is used during initial
- * authentication to bypass the normal PAM password prompt.
- *
- * OTHER mode handles PAM_PROMPT_ECHO_OFF with read_passphrase()
- * and outputs messages to stderr. This mode is used if pam_chauthtok()
- * is called to update expired passwords.
- */
-static int do_pam_conversation(int num_msg, const struct pam_message **msg,
-	struct pam_response **resp, void *appdata_ptr)
-{
-	struct pam_response *reply;
-	int count;
-	char buf[1024];
-
-	/* PAM will free this later */
-	reply = xmalloc(num_msg * sizeof(*reply));
-
-	for (count = 0; count < num_msg; count++) {
-		if (pamstate == INITIAL_LOGIN) {
-			/*
-			 * We can't use stdio yet, queue messages for 
-			 * printing later
-			 */
-			switch(PAM_MSG_MEMBER(msg, count, msg_style)) {
-			case PAM_PROMPT_ECHO_ON:
-				xfree(reply);
-				return PAM_CONV_ERR;
-			case PAM_PROMPT_ECHO_OFF:
-				if (__pampasswd == NULL) {
-					xfree(reply);
-					return PAM_CONV_ERR;
-				}
-				reply[count].resp = xstrdup(__pampasswd);
-				reply[count].resp_retcode = PAM_SUCCESS;
-				break;
-			case PAM_ERROR_MSG:
-			case PAM_TEXT_INFO:
-				if (PAM_MSG_MEMBER(msg, count, msg) != NULL) {
-					message_cat(&__pam_msg, 
-					    PAM_MSG_MEMBER(msg, count, msg));
-				}
-				reply[count].resp = xstrdup("");
-				reply[count].resp_retcode = PAM_SUCCESS;
-				break;
-			default:
-				xfree(reply);
-				return PAM_CONV_ERR;
-			}
-		} else {
-			/*
-			 * stdio is connected, so interact directly
-			 */
-			switch(PAM_MSG_MEMBER(msg, count, msg_style)) {
-			case PAM_PROMPT_ECHO_ON:
-				fputs(PAM_MSG_MEMBER(msg, count, msg), stderr);
-				fgets(buf, sizeof(buf), stdin);
-				reply[count].resp = xstrdup(buf);
-				reply[count].resp_retcode = PAM_SUCCESS;
-				break;
-			case PAM_PROMPT_ECHO_OFF:
-				reply[count].resp = 
-				    read_passphrase(PAM_MSG_MEMBER(msg, count,
-					msg), RP_ALLOW_STDIN);
-				reply[count].resp_retcode = PAM_SUCCESS;
-				break;
-			case PAM_ERROR_MSG:
-			case PAM_TEXT_INFO:
-				if (PAM_MSG_MEMBER(msg, count, msg) != NULL)
-					fprintf(stderr, "%s\n", 
-					    PAM_MSG_MEMBER(msg, count, msg));
-				reply[count].resp = xstrdup("");
-				reply[count].resp_retcode = PAM_SUCCESS;
-				break;
-			default:
-				xfree(reply);
-				return PAM_CONV_ERR;
-			}
-		}
-	}
-
-	*resp = reply;
-
-	return PAM_SUCCESS;
-}
-
-/* Called at exit to cleanly shutdown PAM */
-void do_pam_cleanup_proc(void *context)
-{
-	int pam_retval = PAM_SUCCESS;
-
-	if (__pamh && session_opened) {
-		pam_retval = pam_close_session(__pamh, 0);
-		if (pam_retval != PAM_SUCCESS)
-			log("Cannot close PAM session[%d]: %.200s",
-			    pam_retval, PAM_STRERROR(__pamh, pam_retval));
-	}
-
-	if (__pamh && creds_set) {
-		pam_retval = pam_setcred(__pamh, PAM_DELETE_CRED);
-		if (pam_retval != PAM_SUCCESS)
-			debug("Cannot delete credentials[%d]: %.200s", 
-			    pam_retval, PAM_STRERROR(__pamh, pam_retval));
-	}
-
-	if (__pamh) {
-		pam_retval = pam_end(__pamh, pam_retval);
-		if (pam_retval != PAM_SUCCESS)
-			log("Cannot release PAM authentication[%d]: %.200s",
-			    pam_retval, PAM_STRERROR(__pamh, pam_retval));
-	}
-}
-
-/* Attempt password authentation using PAM */
-int auth_pam_password(Authctxt *authctxt, const char *password)
-{
-	extern ServerOptions options;
-	int pam_retval;
-	struct passwd *pw = authctxt->pw;
-
-	do_pam_set_conv(&conv);
-
-	__pampasswd = password;
-
-	pamstate = INITIAL_LOGIN;
-	pam_retval = do_pam_authenticate(
-	    options.permit_empty_passwd == 0 ? PAM_DISALLOW_NULL_AUTHTOK : 0);
-	if (pam_retval == PAM_SUCCESS) {
-		debug("PAM Password authentication accepted for "
-		    "user \"%.100s\"", pw->pw_name);
-		return 1;
-	} else {
-		debug("PAM Password authentication for \"%.100s\" "
-		    "failed[%d]: %s", pw->pw_name, pam_retval, 
-		    PAM_STRERROR(__pamh, pam_retval));
-		return 0;
-	}
-}
-
-/* Do account management using PAM */
-int do_pam_account(char *username, char *remote_user)
-{
-	int pam_retval;
-
-	do_pam_set_conv(&conv);
-
-	if (remote_user) {
-		debug("PAM setting ruser to \"%.200s\"", remote_user);
-		pam_retval = pam_set_item(__pamh, PAM_RUSER, remote_user);
-		if (pam_retval != PAM_SUCCESS)
-			fatal("PAM set ruser failed[%d]: %.200s", pam_retval, 
-			    PAM_STRERROR(__pamh, pam_retval));
-	}
-
-	pam_retval = pam_acct_mgmt(__pamh, 0);
-	debug2("pam_acct_mgmt() = %d", pam_retval);
-	switch (pam_retval) {
-		case PAM_SUCCESS:
-			/* This is what we want */
-			break;
-#if 0
-		case PAM_NEW_AUTHTOK_REQD:
-			message_cat(&__pam_msg, use_privsep ?
-			    NEW_AUTHTOK_MSG_PRIVSEP : NEW_AUTHTOK_MSG);
-			/* flag that password change is necessary */
-			password_change_required = 1;
-			/* disallow other functionality for now */
-			no_port_forwarding_flag |= 2;
-			no_agent_forwarding_flag |= 2;
-			no_x11_forwarding_flag |= 2;
-			break;
-#endif
-		default:
-			log("PAM rejected by account configuration[%d]: "
-			    "%.200s", pam_retval, PAM_STRERROR(__pamh, 
-			    pam_retval));
-			return(0);
-	}
-
-	return(1);
-}
-
-/* Do PAM-specific session initialisation */
-void do_pam_session(char *username, const char *ttyname)
-{
-	int pam_retval;
-
-	do_pam_set_conv(&conv);
-
-	if (ttyname != NULL) {
-		debug("PAM setting tty to \"%.200s\"", ttyname);
-		pam_retval = pam_set_item(__pamh, PAM_TTY, ttyname);
-		if (pam_retval != PAM_SUCCESS)
-			fatal("PAM set tty failed[%d]: %.200s",
-			    pam_retval, PAM_STRERROR(__pamh, pam_retval));
-	}
-
-	pam_retval = pam_open_session(__pamh, 0);
-	if (pam_retval != PAM_SUCCESS)
-		fatal("PAM session setup failed[%d]: %.200s",
-		    pam_retval, PAM_STRERROR(__pamh, pam_retval));
-
-	session_opened = 1;
-}
-
-/* Set PAM credentials */
-void do_pam_setcred(int init)
-{
-	int pam_retval;
-
-	if (__pamh == NULL)
-		return;
-
-	do_pam_set_conv(&conv);
-
-	debug("PAM establishing creds");
-	pam_retval = pam_setcred(__pamh, 
-	    init ? PAM_ESTABLISH_CRED : PAM_REINITIALIZE_CRED);
-	if (pam_retval != PAM_SUCCESS) {
-		if (was_authenticated)
-			fatal("PAM setcred failed[%d]: %.200s",
-			    pam_retval, PAM_STRERROR(__pamh, pam_retval));
-		else
-			debug("PAM setcred failed[%d]: %.200s",
-			    pam_retval, PAM_STRERROR(__pamh, pam_retval));
-	} else
-		creds_set = 1;
-}
-
-/* accessor function for file scope static variable */
-int is_pam_password_change_required(void)
-{
-	return password_change_required;
-}
-
-/*
- * Have user change authentication token if pam_acct_mgmt() indicated
- * it was expired.  This needs to be called after an interactive
- * session is established and the user's pty is connected to
- * stdin/stdout/stderr.
- */
-void do_pam_chauthtok(void)
-{
-	int pam_retval;
-
-	do_pam_set_conv(&conv);
-
-	if (password_change_required) {
-		if (use_privsep)
-			fatal("Password changing is currently unsupported"
-			    " with privilege separation");
-		pamstate = OTHER;
-		pam_retval = pam_chauthtok(__pamh, PAM_CHANGE_EXPIRED_AUTHTOK);
-		if (pam_retval != PAM_SUCCESS)
-			fatal("PAM pam_chauthtok failed[%d]: %.200s",
-			    pam_retval, PAM_STRERROR(__pamh, pam_retval));
-#if 0
-		/* XXX: This would need to be done in the parent process,
-		 * but there's currently no way to pass such request. */
-		no_port_forwarding_flag &= ~2;
-		no_agent_forwarding_flag &= ~2;
-		no_x11_forwarding_flag &= ~2;
-		if (!no_port_forwarding_flag && options.allow_tcp_forwarding)
-			channel_permit_all_opens();
-#endif
-	}
-}
-
-/* Cleanly shutdown PAM */
-void finish_pam(void)
-{
-	do_pam_cleanup_proc(NULL);
-	fatal_remove_cleanup(&do_pam_cleanup_proc, NULL);
-}
-
-/* Start PAM authentication for specified account */
-void start_pam(const char *user)
-{
-	int pam_retval;
-	extern ServerOptions options;
-	extern u_int utmp_len;
-	const char *rhost;
-
-	debug("Starting up PAM with username \"%.200s\"", user);
-
-	pam_retval = pam_start(SSHD_PAM_SERVICE, user, &conv, &__pamh);
-
-	if (pam_retval != PAM_SUCCESS)
-		fatal("PAM initialisation failed[%d]: %.200s",
-		    pam_retval, PAM_STRERROR(__pamh, pam_retval));
-
-	rhost = get_remote_name_or_ip(utmp_len, options.verify_reverse_mapping);
-	debug("PAM setting rhost to \"%.200s\"", rhost);
-
-	pam_retval = pam_set_item(__pamh, PAM_RHOST, rhost);
-	if (pam_retval != PAM_SUCCESS)
-		fatal("PAM set rhost failed[%d]: %.200s", pam_retval,
-		    PAM_STRERROR(__pamh, pam_retval));
-#ifdef PAM_TTY_KLUDGE
-	/*
-	 * Some PAM modules (e.g. pam_time) require a TTY to operate,
-	 * and will fail in various stupid ways if they don't get one.
-	 * sshd doesn't set the tty until too late in the auth process and may
-	 * not even need one (for tty-less connections)
-	 * Kludge: Set a fake PAM_TTY
-	 */
-	pam_retval = pam_set_item(__pamh, PAM_TTY, "NODEVssh");
-	if (pam_retval != PAM_SUCCESS)
-		fatal("PAM set tty failed[%d]: %.200s",
-		    pam_retval, PAM_STRERROR(__pamh, pam_retval));
-#endif /* PAM_TTY_KLUDGE */
-
-	fatal_add_cleanup(&do_pam_cleanup_proc, NULL);
-}
-
-/* Return list of PAM environment strings */
-char **fetch_pam_environment(void)
-{
-#ifdef HAVE_PAM_GETENVLIST
-	return(pam_getenvlist(__pamh));
-#else /* HAVE_PAM_GETENVLIST */
-	return(NULL);
-#endif /* HAVE_PAM_GETENVLIST */
-}
-
-void free_pam_environment(char **env)
-{
-	int i;
-
-	if (env != NULL) {
-		for (i = 0; env[i] != NULL; i++)
-			xfree(env[i]);
-	}
-}
-
-/* Print any messages that have been generated during authentication */
-/* or account checking to stderr */
-void print_pam_messages(void)
-{
-	if (__pam_msg != NULL)
-		fputs(__pam_msg, stderr);
-}
-
-/* Append a message to buffer */
-void message_cat(char **p, const char *a)
-{
-	char *cp;
-	size_t new_len;
-
-	new_len = strlen(a);
-
-	if (*p) {
-		size_t len = strlen(*p);
-
-		*p = xrealloc(*p, new_len + len + 2);
-		cp = *p + len;
-	} else
-		*p = cp = xmalloc(new_len + 2);
-
-	memcpy(cp, a, new_len);
-	cp[new_len] = '\n';
-	cp[new_len + 1] = '\0';
-}
-
-#endif /* USE_PAM */
diff --git a/crypto/openssh/auth-pam.h b/crypto/openssh/auth-pam.h
deleted file mode 100644
index 7881b6b80786..000000000000
--- a/crypto/openssh/auth-pam.h
+++ /dev/null
@@ -1,49 +0,0 @@
-/* $Id: auth-pam.h,v 1.16 2002/07/23 00:44:07 stevesk Exp $ */
-
-/*
- * Copyright (c) 2000 Damien Miller.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-#ifdef USE_PAM
-
-#if !defined(SSHD_PAM_SERVICE)
-# define SSHD_PAM_SERVICE		__progname
-#endif
-
-void start_pam(const char *user);
-void finish_pam(void);
-int auth_pam_password(Authctxt *authctxt, const char *password);
-char **fetch_pam_environment(void);
-void free_pam_environment(char **env);
-int do_pam_authenticate(int flags);
-int do_pam_account(char *username, char *remote_user);
-void do_pam_session(char *username, const char *ttyname);
-void do_pam_setcred(int init);
-void print_pam_messages(void);
-int is_pam_password_change_required(void);
-void do_pam_chauthtok(void);
-void do_pam_set_conv(struct pam_conv *);
-void message_cat(char **p, const char *a);
-
-#endif /* USE_PAM */
diff --git a/crypto/openssh/auth-passwd.c b/crypto/openssh/auth-passwd.c
deleted file mode 100644
index 9901d48425ff..000000000000
--- a/crypto/openssh/auth-passwd.c
+++ /dev/null
@@ -1,234 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * Password authentication.  This file contains the functions to check whether
- * the password is valid for the user.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- *
- * Copyright (c) 1999 Dug Song.  All rights reserved.
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: auth-passwd.c,v 1.27 2002/05/24 16:45:16 stevesk Exp $");
-
-#include "packet.h"
-#include "log.h"
-#include "servconf.h"
-#include "auth.h"
-
-#if !defined(USE_PAM) && !defined(HAVE_OSF_SIA)
-/* Don't need any of these headers for the PAM or SIA cases */
-# ifdef HAVE_CRYPT_H
-#  include <crypt.h>
-# endif
-# ifdef WITH_AIXAUTHENTICATE
-#  include <login.h>
-# endif
-# ifdef __hpux
-#  include <hpsecurity.h>
-#  include <prot.h>
-# endif
-# ifdef HAVE_SECUREWARE
-#  include <sys/security.h>
-#  include <sys/audit.h>
-#  include <prot.h>
-# endif /* HAVE_SECUREWARE */
-# if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
-#  include <shadow.h>
-# endif
-# if defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW)
-#  include <sys/label.h>
-#  include <sys/audit.h>
-#  include <pwdadj.h>
-# endif
-# if defined(HAVE_MD5_PASSWORDS) && !defined(HAVE_MD5_CRYPT)
-#  include "md5crypt.h"
-# endif /* defined(HAVE_MD5_PASSWORDS) && !defined(HAVE_MD5_CRYPT) */
-
-# ifdef HAVE_CYGWIN
-#  undef ERROR
-#  include <windows.h>
-#  include <sys/cygwin.h>
-#  define is_winnt       (GetVersion() < 0x80000000)
-# endif
-#endif /* !USE_PAM && !HAVE_OSF_SIA */
-
-extern ServerOptions options;
-#ifdef WITH_AIXAUTHENTICATE
-extern char *aixloginmsg;
-#endif
-
-/*
- * Tries to authenticate the user using password.  Returns true if
- * authentication succeeds.
- */
-int
-auth_password(Authctxt *authctxt, const char *password)
-{
-	struct passwd * pw = authctxt->pw;
-#if !defined(USE_PAM) && !defined(HAVE_OSF_SIA)
-	char *encrypted_password;
-	char *pw_password;
-	char *salt;
-# if defined(__hpux) || defined(HAVE_SECUREWARE)
-	struct pr_passwd *spw;
-# endif /* __hpux || HAVE_SECUREWARE */
-# if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
-	struct spwd *spw;
-# endif
-# if defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW)
-	struct passwd_adjunct *spw;
-# endif
-# ifdef WITH_AIXAUTHENTICATE
-	char *authmsg;
-	int authsuccess;
-	int reenter = 1;
-# endif
-#endif /* !defined(USE_PAM) && !defined(HAVE_OSF_SIA) */
-
-	/* deny if no user. */
-	if (pw == NULL)
-		return 0;
-#ifndef HAVE_CYGWIN
-       if (pw->pw_uid == 0 && options.permit_root_login != PERMIT_YES)
-		return 0;
-#endif
-	if (*password == '\0' && options.permit_empty_passwd == 0)
-		return 0;
-
-#if defined(USE_PAM)
-	return auth_pam_password(authctxt, password);
-#elif defined(HAVE_OSF_SIA)
-	return auth_sia_password(authctxt, password);
-#else
-# ifdef KRB5
-	if (options.kerberos_authentication == 1) {
-		int ret = auth_krb5_password(authctxt, password);
-		if (ret == 1 || ret == 0)
-			return ret;
-		/* Fall back to ordinary passwd authentication. */
-	}
-# endif
-# ifdef HAVE_CYGWIN
-	if (is_winnt) {
-		HANDLE hToken = cygwin_logon_user(pw, password);
-
-		if (hToken == INVALID_HANDLE_VALUE)
-			return 0;
-		cygwin_set_impersonation_token(hToken);
-		return 1;
-	}
-# endif
-# ifdef WITH_AIXAUTHENTICATE
-	authsuccess = (authenticate(pw->pw_name,password,&reenter,&authmsg) == 0);
-
-	if (authsuccess)
-	        /* We don't have a pty yet, so just label the line as "ssh" */
-	        if (loginsuccess(authctxt->user,
-			get_canonical_hostname(options.verify_reverse_mapping),
-			"ssh", &aixloginmsg) < 0)
-				aixloginmsg = NULL;
-
-	return(authsuccess);
-# endif
-# ifdef KRB4
-	if (options.kerberos_authentication == 1) {
-		int ret = auth_krb4_password(authctxt, password);
-		if (ret == 1 || ret == 0)
-			return ret;
-		/* Fall back to ordinary passwd authentication. */
-	}
-# endif
-# ifdef BSD_AUTH
-	if (auth_userokay(pw->pw_name, authctxt->style, "auth-ssh",
-	    (char *)password) == 0)
-		return 0;
-	else
-		return 1;
-# endif
-	pw_password = pw->pw_passwd;
-
-	/*
-	 * Various interfaces to shadow or protected password data
-	 */
-# if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
-	spw = getspnam(pw->pw_name);
-	if (spw != NULL)
-		pw_password = spw->sp_pwdp;
-# endif /* defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) */
-
-# if defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW)
-	if (issecure() && (spw = getpwanam(pw->pw_name)) != NULL)
-		pw_password = spw->pwa_passwd;
-# endif /* defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW) */
-
-# ifdef HAVE_SECUREWARE
-	if ((spw = getprpwnam(pw->pw_name)) != NULL)
-		pw_password = spw->ufld.fd_encrypt;
-# endif /* HAVE_SECUREWARE */
-
-# if defined(__hpux) && !defined(HAVE_SECUREWARE)
-	if (iscomsec() && (spw = getprpwnam(pw->pw_name)) != NULL)
-		pw_password = spw->ufld.fd_encrypt;
-# endif /* defined(__hpux) && !defined(HAVE_SECUREWARE) */
-
-	/* Check for users with no password. */
-	if ((password[0] == '\0') && (pw_password[0] == '\0'))
-		return 1;
-
-	if (pw_password[0] != '\0')
-		salt = pw_password;
-	else
-		salt = "xx";
-
-# ifdef HAVE_MD5_PASSWORDS
-	if (is_md5_salt(salt))
-		encrypted_password = md5_crypt(password, salt);
-	else
-		encrypted_password = crypt(password, salt);
-# else /* HAVE_MD5_PASSWORDS */
-#  if defined(__hpux) && !defined(HAVE_SECUREWARE)
-	if (iscomsec())
-		encrypted_password = bigcrypt(password, salt);
-	else
-		encrypted_password = crypt(password, salt);
-#  else
-#   ifdef HAVE_SECUREWARE
-	encrypted_password = bigcrypt(password, salt);
-#   else
-	encrypted_password = crypt(password, salt);
-#   endif /* HAVE_SECUREWARE */
-#  endif /* __hpux && !defined(HAVE_SECUREWARE) */
-# endif /* HAVE_MD5_PASSWORDS */
-
-	/* Authentication is accepted if the encrypted passwords are identical. */
-	return (strcmp(encrypted_password, pw_password) == 0);
-#endif /* !USE_PAM && !HAVE_OSF_SIA */
-}
diff --git a/crypto/openssh/auth-rh-rsa.c b/crypto/openssh/auth-rh-rsa.c
deleted file mode 100644
index d7848d04c4dd..000000000000
--- a/crypto/openssh/auth-rh-rsa.c
+++ /dev/null
@@ -1,91 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * Rhosts or /etc/hosts.equiv authentication combined with RSA host
- * authentication.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: auth-rh-rsa.c,v 1.34 2002/03/25 09:25:06 markus Exp $");
-
-#include "packet.h"
-#include "uidswap.h"
-#include "log.h"
-#include "servconf.h"
-#include "key.h"
-#include "hostfile.h"
-#include "pathnames.h"
-#include "auth.h"
-#include "canohost.h"
-
-#include "monitor_wrap.h"
-
-/* import */
-extern ServerOptions options;
-
-int
-auth_rhosts_rsa_key_allowed(struct passwd *pw, char *cuser, char *chost,
-    Key *client_host_key)
-{
-	HostStatus host_status;
-
-	/* Check if we would accept it using rhosts authentication. */
-	if (!auth_rhosts(pw, cuser))
-		return 0;
-
-	host_status = check_key_in_hostfiles(pw, client_host_key,
-	    chost, _PATH_SSH_SYSTEM_HOSTFILE,
-	    options.ignore_user_known_hosts ? NULL : _PATH_SSH_USER_HOSTFILE);
-
-	return (host_status == HOST_OK);
-}
-
-/*
- * Tries to authenticate the user using the .rhosts file and the host using
- * its host key.  Returns true if authentication succeeds.
- */
-int
-auth_rhosts_rsa(struct passwd *pw, char *cuser, Key *client_host_key)
-{
-	char *chost;
-
-	debug("Trying rhosts with RSA host authentication for client user %.100s",
-	    cuser);
-
-	if (pw == NULL || client_host_key == NULL ||
-	    client_host_key->rsa == NULL)
-		return 0;
-
-	chost = (char *)get_canonical_hostname(options.verify_reverse_mapping);
-	debug("Rhosts RSA authentication: canonical host %.900s", chost);
-
-	if (!PRIVSEP(auth_rhosts_rsa_key_allowed(pw, cuser, chost, client_host_key))) {
-		debug("Rhosts with RSA host authentication denied: unknown or invalid host key");
-		packet_send_debug("Your host key cannot be verified: unknown or invalid host key.");
-		return 0;
-	}
-	/* A matching host key was found and is known. */
-
-	/* Perform the challenge-response dialog with the client for the host key. */
-	if (!auth_rsa_challenge_dialog(client_host_key)) {
-		log("Client on %.800s failed to respond correctly to host authentication.",
-		    chost);
-		return 0;
-	}
-	/*
-	 * We have authenticated the user using .rhosts or /etc/hosts.equiv,
-	 * and the host using RSA. We accept the authentication.
-	 */
-
-	verbose("Rhosts with RSA host authentication accepted for %.100s, %.100s on %.700s.",
-	   pw->pw_name, cuser, chost);
-	packet_send_debug("Rhosts with RSA host authentication accepted.");
-	return 1;
-}
diff --git a/crypto/openssh/auth-rhosts.c b/crypto/openssh/auth-rhosts.c
deleted file mode 100644
index afca1f7c63c3..000000000000
--- a/crypto/openssh/auth-rhosts.c
+++ /dev/null
@@ -1,298 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * Rhosts authentication.  This file contains code to check whether to admit
- * the login based on rhosts authentication.  This file also processes
- * /etc/hosts.equiv.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: auth-rhosts.c,v 1.28 2002/05/13 21:26:49 markus Exp $");
-
-#include "packet.h"
-#include "uidswap.h"
-#include "pathnames.h"
-#include "log.h"
-#include "servconf.h"
-#include "canohost.h"
-#include "auth.h"
-
-/* import */
-extern ServerOptions options;
-extern int use_privsep;
-
-/*
- * This function processes an rhosts-style file (.rhosts, .shosts, or
- * /etc/hosts.equiv).  This returns true if authentication can be granted
- * based on the file, and returns zero otherwise.
- */
-
-static int
-check_rhosts_file(const char *filename, const char *hostname,
-		  const char *ipaddr, const char *client_user,
-		  const char *server_user)
-{
-	FILE *f;
-	char buf[1024];	/* Must not be larger than host, user, dummy below. */
-
-	/* Open the .rhosts file, deny if unreadable */
-	f = fopen(filename, "r");
-	if (!f)
-		return 0;
-
-	while (fgets(buf, sizeof(buf), f)) {
-		/* All three must be at least as big as buf to avoid overflows. */
-		char hostbuf[1024], userbuf[1024], dummy[1024], *host, *user, *cp;
-		int negated;
-
-		for (cp = buf; *cp == ' ' || *cp == '\t'; cp++)
-			;
-		if (*cp == '#' || *cp == '\n' || !*cp)
-			continue;
-
-		/*
-		 * NO_PLUS is supported at least on OSF/1.  We skip it (we
-		 * don't ever support the plus syntax).
-		 */
-		if (strncmp(cp, "NO_PLUS", 7) == 0)
-			continue;
-
-		/*
-		 * This should be safe because each buffer is as big as the
-		 * whole string, and thus cannot be overwritten.
-		 */
-		switch (sscanf(buf, "%s %s %s", hostbuf, userbuf, dummy)) {
-		case 0:
-			auth_debug_add("Found empty line in %.100s.", filename);
-			continue;
-		case 1:
-			/* Host name only. */
-			strlcpy(userbuf, server_user, sizeof(userbuf));
-			break;
-		case 2:
-			/* Got both host and user name. */
-			break;
-		case 3:
-			auth_debug_add("Found garbage in %.100s.", filename);
-			continue;
-		default:
-			/* Weird... */
-			continue;
-		}
-
-		host = hostbuf;
-		user = userbuf;
-		negated = 0;
-
-		/* Process negated host names, or positive netgroups. */
-		if (host[0] == '-') {
-			negated = 1;
-			host++;
-		} else if (host[0] == '+')
-			host++;
-
-		if (user[0] == '-') {
-			negated = 1;
-			user++;
-		} else if (user[0] == '+')
-			user++;
-
-		/* Check for empty host/user names (particularly '+'). */
-		if (!host[0] || !user[0]) {
-			/* We come here if either was '+' or '-'. */
-			auth_debug_add("Ignoring wild host/user names in %.100s.",
-			    filename);
-			continue;
-		}
-		/* Verify that host name matches. */
-		if (host[0] == '@') {
-			if (!innetgr(host + 1, hostname, NULL, NULL) &&
-			    !innetgr(host + 1, ipaddr, NULL, NULL))
-				continue;
-		} else if (strcasecmp(host, hostname) && strcmp(host, ipaddr) != 0)
-			continue;	/* Different hostname. */
-
-		/* Verify that user name matches. */
-		if (user[0] == '@') {
-			if (!innetgr(user + 1, NULL, client_user, NULL))
-				continue;
-		} else if (strcmp(user, client_user) != 0)
-			continue;	/* Different username. */
-
-		/* Found the user and host. */
-		fclose(f);
-
-		/* If the entry was negated, deny access. */
-		if (negated) {
-			auth_debug_add("Matched negative entry in %.100s.",
-			     filename);
-			return 0;
-		}
-		/* Accept authentication. */
-		return 1;
-	}
-
-	/* Authentication using this file denied. */
-	fclose(f);
-	return 0;
-}
-
-/*
- * Tries to authenticate the user using the .shosts or .rhosts file. Returns
- * true if authentication succeeds.  If ignore_rhosts is true, only
- * /etc/hosts.equiv will be considered (.rhosts and .shosts are ignored).
- */
-
-int
-auth_rhosts(struct passwd *pw, const char *client_user)
-{
-	const char *hostname, *ipaddr;
-
-	hostname = get_canonical_hostname(options.verify_reverse_mapping);
-	ipaddr = get_remote_ipaddr();
-	return auth_rhosts2(pw, client_user, hostname, ipaddr);
-}
-
-static int
-auth_rhosts2_raw(struct passwd *pw, const char *client_user, const char *hostname,
-    const char *ipaddr)
-{
-	char buf[1024];
-	struct stat st;
-	static const char *rhosts_files[] = {".shosts", ".rhosts", NULL};
-	u_int rhosts_file_index;
-
-	debug2("auth_rhosts2: clientuser %s hostname %s ipaddr %s",
-	    client_user, hostname, ipaddr);
-
-	/* no user given */
-	if (pw == NULL)
-		return 0;
-
-	/* Switch to the user's uid. */
-	temporarily_use_uid(pw);
-	/*
-	 * Quick check: if the user has no .shosts or .rhosts files, return
-	 * failure immediately without doing costly lookups from name
-	 * servers.
-	 */
-	for (rhosts_file_index = 0; rhosts_files[rhosts_file_index];
-	    rhosts_file_index++) {
-		/* Check users .rhosts or .shosts. */
-		snprintf(buf, sizeof buf, "%.500s/%.100s",
-			 pw->pw_dir, rhosts_files[rhosts_file_index]);
-		if (stat(buf, &st) >= 0)
-			break;
-	}
-	/* Switch back to privileged uid. */
-	restore_uid();
-
-	/* Deny if The user has no .shosts or .rhosts file and there are no system-wide files. */
-	if (!rhosts_files[rhosts_file_index] &&
-	    stat(_PATH_RHOSTS_EQUIV, &st) < 0 &&
-	    stat(_PATH_SSH_HOSTS_EQUIV, &st) < 0)
-		return 0;
-
-	/* If not logging in as superuser, try /etc/hosts.equiv and shosts.equiv. */
-	if (pw->pw_uid != 0) {
-		if (check_rhosts_file(_PATH_RHOSTS_EQUIV, hostname, ipaddr,
-		    client_user, pw->pw_name)) {
-			auth_debug_add("Accepted for %.100s [%.100s] by /etc/hosts.equiv.",
-			    hostname, ipaddr);
-			return 1;
-		}
-		if (check_rhosts_file(_PATH_SSH_HOSTS_EQUIV, hostname, ipaddr,
-		    client_user, pw->pw_name)) {
-			auth_debug_add("Accepted for %.100s [%.100s] by %.100s.",
-			    hostname, ipaddr, _PATH_SSH_HOSTS_EQUIV);
-			return 1;
-		}
-	}
-	/*
-	 * Check that the home directory is owned by root or the user, and is
-	 * not group or world writable.
-	 */
-	if (stat(pw->pw_dir, &st) < 0) {
-		log("Rhosts authentication refused for %.100s: "
-		    "no home directory %.200s", pw->pw_name, pw->pw_dir);
-		auth_debug_add("Rhosts authentication refused for %.100s: "
-		    "no home directory %.200s", pw->pw_name, pw->pw_dir);
-		return 0;
-	}
-	if (options.strict_modes &&
-	    ((st.st_uid != 0 && st.st_uid != pw->pw_uid) ||
-	    (st.st_mode & 022) != 0)) {
-		log("Rhosts authentication refused for %.100s: "
-		    "bad ownership or modes for home directory.", pw->pw_name);
-		auth_debug_add("Rhosts authentication refused for %.100s: "
-		    "bad ownership or modes for home directory.", pw->pw_name);
-		return 0;
-	}
-	/* Temporarily use the user's uid. */
-	temporarily_use_uid(pw);
-
-	/* Check all .rhosts files (currently .shosts and .rhosts). */
-	for (rhosts_file_index = 0; rhosts_files[rhosts_file_index];
-	    rhosts_file_index++) {
-		/* Check users .rhosts or .shosts. */
-		snprintf(buf, sizeof buf, "%.500s/%.100s",
-			 pw->pw_dir, rhosts_files[rhosts_file_index]);
-		if (stat(buf, &st) < 0)
-			continue;
-
-		/*
-		 * Make sure that the file is either owned by the user or by
-		 * root, and make sure it is not writable by anyone but the
-		 * owner.  This is to help avoid novices accidentally
-		 * allowing access to their account by anyone.
-		 */
-		if (options.strict_modes &&
-		    ((st.st_uid != 0 && st.st_uid != pw->pw_uid) ||
-		    (st.st_mode & 022) != 0)) {
-			log("Rhosts authentication refused for %.100s: bad modes for %.200s",
-			    pw->pw_name, buf);
-			auth_debug_add("Bad file modes for %.200s", buf);
-			continue;
-		}
-		/* Check if we have been configured to ignore .rhosts and .shosts files. */
-		if (options.ignore_rhosts) {
-			auth_debug_add("Server has been configured to ignore %.100s.",
-			    rhosts_files[rhosts_file_index]);
-			continue;
-		}
-		/* Check if authentication is permitted by the file. */
-		if (check_rhosts_file(buf, hostname, ipaddr, client_user, pw->pw_name)) {
-			auth_debug_add("Accepted by %.100s.",
-			    rhosts_files[rhosts_file_index]);
-			/* Restore the privileged uid. */
-			restore_uid();
-			auth_debug_add("Accepted host %s ip %s client_user %s server_user %s",
-				hostname, ipaddr, client_user, pw->pw_name);
-			return 1;
-		}
-	}
-
-	/* Restore the privileged uid. */
-	restore_uid();
-	return 0;
-}
-
-int
-auth_rhosts2(struct passwd *pw, const char *client_user, const char *hostname,
-    const char *ipaddr)
-{
-	int ret;
-
-	auth_debug_reset();
-	ret = auth_rhosts2_raw(pw, client_user, hostname, ipaddr);
-	if (!use_privsep)
-		auth_debug_send();
-	return ret;
-}
diff --git a/crypto/openssh/auth-rsa.c b/crypto/openssh/auth-rsa.c
deleted file mode 100644
index 92f6277f9a06..000000000000
--- a/crypto/openssh/auth-rsa.c
+++ /dev/null
@@ -1,327 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * RSA-based authentication.  This code determines whether to admit a login
- * based on RSA authentication.  This file also contains functions to check
- * validity of the host key.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: auth-rsa.c,v 1.56 2002/06/10 16:53:06 stevesk Exp $");
-
-#include <openssl/rsa.h>
-#include <openssl/md5.h>
-
-#include "rsa.h"
-#include "packet.h"
-#include "xmalloc.h"
-#include "ssh1.h"
-#include "mpaux.h"
-#include "uidswap.h"
-#include "match.h"
-#include "auth-options.h"
-#include "pathnames.h"
-#include "log.h"
-#include "servconf.h"
-#include "auth.h"
-#include "hostfile.h"
-#include "monitor_wrap.h"
-#include "ssh.h"
-
-/* import */
-extern ServerOptions options;
-
-/*
- * Session identifier that is used to bind key exchange and authentication
- * responses to a particular session.
- */
-extern u_char session_id[16];
-
-/*
- * The .ssh/authorized_keys file contains public keys, one per line, in the
- * following format:
- *   options bits e n comment
- * where bits, e and n are decimal numbers,
- * and comment is any string of characters up to newline.  The maximum
- * length of a line is 8000 characters.  See the documentation for a
- * description of the options.
- */
-
-BIGNUM *
-auth_rsa_generate_challenge(Key *key)
-{
-	BIGNUM *challenge;
-	BN_CTX *ctx;
-
-	if ((challenge = BN_new()) == NULL)
-		fatal("auth_rsa_generate_challenge: BN_new() failed");
-	/* Generate a random challenge. */
-	BN_rand(challenge, 256, 0, 0);
-	if ((ctx = BN_CTX_new()) == NULL)
-		fatal("auth_rsa_generate_challenge: BN_CTX_new() failed");
-	BN_mod(challenge, challenge, key->rsa->n, ctx);
-	BN_CTX_free(ctx);
-
-	return challenge;
-}
-
-int
-auth_rsa_verify_response(Key *key, BIGNUM *challenge, u_char response[16])
-{
-	u_char buf[32], mdbuf[16];
-	MD5_CTX md;
-	int len;
-
-	/* don't allow short keys */
-	if (BN_num_bits(key->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE) {
-		error("auth_rsa_verify_response: RSA modulus too small: %d < minimum %d bits",
-		    BN_num_bits(key->rsa->n), SSH_RSA_MINIMUM_MODULUS_SIZE);
-		return (0);
-	}
-
-	/* The response is MD5 of decrypted challenge plus session id. */
-	len = BN_num_bytes(challenge);
-	if (len <= 0 || len > 32)
-		fatal("auth_rsa_verify_response: bad challenge length %d", len);
-	memset(buf, 0, 32);
-	BN_bn2bin(challenge, buf + 32 - len);
-	MD5_Init(&md);
-	MD5_Update(&md, buf, 32);
-	MD5_Update(&md, session_id, 16);
-	MD5_Final(mdbuf, &md);
-
-	/* Verify that the response is the original challenge. */
-	if (memcmp(response, mdbuf, 16) != 0) {
-		/* Wrong answer. */
-		return (0);
-	}
-	/* Correct answer. */
-	return (1);
-}
-
-/*
- * Performs the RSA authentication challenge-response dialog with the client,
- * and returns true (non-zero) if the client gave the correct answer to
- * our challenge; returns zero if the client gives a wrong answer.
- */
-
-int
-auth_rsa_challenge_dialog(Key *key)
-{
-	BIGNUM *challenge, *encrypted_challenge;
-	u_char response[16];
-	int i, success;
-
-	if ((encrypted_challenge = BN_new()) == NULL)
-		fatal("auth_rsa_challenge_dialog: BN_new() failed");
-
-	challenge = PRIVSEP(auth_rsa_generate_challenge(key));
-
-	/* Encrypt the challenge with the public key. */
-	rsa_public_encrypt(encrypted_challenge, challenge, key->rsa);
-
-	/* Send the encrypted challenge to the client. */
-	packet_start(SSH_SMSG_AUTH_RSA_CHALLENGE);
-	packet_put_bignum(encrypted_challenge);
-	packet_send();
-	BN_clear_free(encrypted_challenge);
-	packet_write_wait();
-
-	/* Wait for a response. */
-	packet_read_expect(SSH_CMSG_AUTH_RSA_RESPONSE);
-	for (i = 0; i < 16; i++)
-		response[i] = packet_get_char();
-	packet_check_eom();
-
-	success = PRIVSEP(auth_rsa_verify_response(key, challenge, response));
-	BN_clear_free(challenge);
-	return (success);
-}
-
-/*
- * check if there's user key matching client_n,
- * return key if login is allowed, NULL otherwise
- */
-
-int
-auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey)
-{
-	char line[8192], *file;
-	int allowed = 0;
-	u_int bits;
-	FILE *f;
-	u_long linenum = 0;
-	struct stat st;
-	Key *key;
-
-	/* Temporarily use the user's uid. */
-	temporarily_use_uid(pw);
-
-	/* The authorized keys. */
-	file = authorized_keys_file(pw);
-	debug("trying public RSA key file %s", file);
-
-	/* Fail quietly if file does not exist */
-	if (stat(file, &st) < 0) {
-		/* Restore the privileged uid. */
-		restore_uid();
-		xfree(file);
-		return (0);
-	}
-	/* Open the file containing the authorized keys. */
-	f = fopen(file, "r");
-	if (!f) {
-		/* Restore the privileged uid. */
-		restore_uid();
-		xfree(file);
-		return (0);
-	}
-	if (options.strict_modes &&
-	    secure_filename(f, file, pw, line, sizeof(line)) != 0) {
-		xfree(file);
-		fclose(f);
-		log("Authentication refused: %s", line);
-		restore_uid();
-		return (0);
-	}
-
-	/* Flag indicating whether the key is allowed. */
-	allowed = 0;
-
-	key = key_new(KEY_RSA1);
-
-	/*
-	 * Go though the accepted keys, looking for the current key.  If
-	 * found, perform a challenge-response dialog to verify that the
-	 * user really has the corresponding private key.
-	 */
-	while (fgets(line, sizeof(line), f)) {
-		char *cp;
-		char *options;
-
-		linenum++;
-
-		/* Skip leading whitespace, empty and comment lines. */
-		for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
-			;
-		if (!*cp || *cp == '\n' || *cp == '#')
-			continue;
-
-		/*
-		 * Check if there are options for this key, and if so,
-		 * save their starting address and skip the option part
-		 * for now.  If there are no options, set the starting
-		 * address to NULL.
-		 */
-		if (*cp < '0' || *cp > '9') {
-			int quoted = 0;
-			options = cp;
-			for (; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) {
-				if (*cp == '\\' && cp[1] == '"')
-					cp++;	/* Skip both */
-				else if (*cp == '"')
-					quoted = !quoted;
-			}
-		} else
-			options = NULL;
-
-		/* Parse the key from the line. */
-		if (hostfile_read_key(&cp, &bits, key) == 0) {
-			debug("%.100s, line %lu: non ssh1 key syntax",
-			    file, linenum);
-			continue;
-		}
-		/* cp now points to the comment part. */
-
-		/* Check if the we have found the desired key (identified by its modulus). */
-		if (BN_cmp(key->rsa->n, client_n) != 0)
-			continue;
-
-		/* check the real bits  */
-		if (bits != BN_num_bits(key->rsa->n))
-			log("Warning: %s, line %lu: keysize mismatch: "
-			    "actual %d vs. announced %d.",
-			    file, linenum, BN_num_bits(key->rsa->n), bits);
-
-		/* We have found the desired key. */
-		/*
-		 * If our options do not allow this key to be used,
-		 * do not send challenge.
-		 */
-		if (!auth_parse_options(pw, options, file, linenum))
-			continue;
-
-		/* break out, this key is allowed */
-		allowed = 1;
-		break;
-	}
-
-	/* Restore the privileged uid. */
-	restore_uid();
-
-	/* Close the file. */
-	xfree(file);
-	fclose(f);
-
-	/* return key if allowed */
-	if (allowed && rkey != NULL)
-		*rkey = key;
-	else
-		key_free(key);
-	return (allowed);
-}
-
-/*
- * Performs the RSA authentication dialog with the client.  This returns
- * 0 if the client could not be authenticated, and 1 if authentication was
- * successful.  This may exit if there is a serious protocol violation.
- */
-int
-auth_rsa(struct passwd *pw, BIGNUM *client_n)
-{
-	Key *key;
-	char *fp;
-
-	/* no user given */
-	if (pw == NULL)
-		return 0;
-
-	if (!PRIVSEP(auth_rsa_key_allowed(pw, client_n, &key))) {
-		auth_clear_options();
-		return (0);
-	}
-
-	/* Perform the challenge-response dialog for this key. */
-	if (!auth_rsa_challenge_dialog(key)) {
-		/* Wrong response. */
-		verbose("Wrong response to RSA authentication challenge.");
-		packet_send_debug("Wrong response to RSA authentication challenge.");
-		/*
-		 * Break out of the loop. Otherwise we might send
-		 * another challenge and break the protocol.
-		 */
-		key_free(key);
-		return (0);
-	}
-	/*
-	 * Correct response.  The client has been successfully
-	 * authenticated. Note that we have not yet processed the
-	 * options; this will be reset if the options cause the
-	 * authentication to be rejected.
-	 */
-	fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
-	verbose("Found matching %s key: %s",
-	    key_type(key), fp);
-	xfree(fp);
-	key_free(key);
-
-	packet_send_debug("RSA authentication accepted.");
-	return (1);
-}
diff --git a/crypto/openssh/auth-sia.c b/crypto/openssh/auth-sia.c
deleted file mode 100644
index 5c9b3f5de24b..000000000000
--- a/crypto/openssh/auth-sia.c
+++ /dev/null
@@ -1,109 +0,0 @@
-/*
- * Copyright (c) 2002 Chris Adams.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-
-#ifdef HAVE_OSF_SIA
-#include "ssh.h"
-#include "auth.h"
-#include "auth-sia.h"
-#include "log.h"
-#include "servconf.h"
-#include "canohost.h"
-
-#include <sia.h>
-#include <siad.h>
-#include <pwd.h>
-#include <signal.h>
-#include <setjmp.h>
-#include <sys/resource.h>
-#include <unistd.h>
-#include <string.h>
-
-extern ServerOptions options;
-extern int saved_argc;
-extern char **saved_argv;
-
-int
-auth_sia_password(Authctxt *authctxt, char *pass)
-{
-	int ret;
-	SIAENTITY *ent = NULL;
-	const char *host;
-
-	host = get_canonical_hostname(options.verify_reverse_mapping);
-
-	if (!authctxt->user || !pass || pass[0] == '\0')
-		return(0);
-
-	if (sia_ses_init(&ent, saved_argc, saved_argv, host, authctxt->user,
-	    NULL, 0, NULL) != SIASUCCESS)
-		return(0);
-
-	if ((ret = sia_ses_authent(NULL, pass, ent)) != SIASUCCESS) {
-		error("Couldn't authenticate %s from %s", authctxt->user,
-		    host);
-		if (ret & SIASTOP)
-			sia_ses_release(&ent);
-		return(0);
-	}
-
-	sia_ses_release(&ent);
-
-	return(1);
-}
-
-void
-session_setup_sia(struct passwd *pw, char *tty)
-{
-	SIAENTITY *ent = NULL;
-	const char *host;
-
-	host = get_canonical_hostname(options.verify_reverse_mapping);
-
-	if (sia_ses_init(&ent, saved_argc, saved_argv, host, pw->pw_name, tty,
-	    0, NULL) != SIASUCCESS)
-		fatal("sia_ses_init failed");
-
-	if (sia_make_entity_pwd(pw, ent) != SIASUCCESS) {
-		sia_ses_release(&ent);
-		fatal("sia_make_entity_pwd failed");
-	}
-
-	ent->authtype = SIA_A_NONE;
-	if (sia_ses_estab(sia_collect_trm, ent) != SIASUCCESS)
-		fatal("Couldn't establish session for %s from %s",
-		    pw->pw_name, host);
-
-	if (sia_ses_launch(sia_collect_trm, ent) != SIASUCCESS)
-		fatal("Couldn't launch session for %s from %s", pw->pw_name,
-		    host);
-	
-	sia_ses_release(&ent);
-
-	if (setreuid(geteuid(), geteuid()) < 0)
-		fatal("setreuid: %s", strerror(errno));
-}
-
-#endif /* HAVE_OSF_SIA */
diff --git a/crypto/openssh/auth-sia.h b/crypto/openssh/auth-sia.h
deleted file mode 100644
index 7aecce940af1..000000000000
--- a/crypto/openssh/auth-sia.h
+++ /dev/null
@@ -1,32 +0,0 @@
-/*
- * Copyright (c) 2002 Chris Adams.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-
-#ifdef HAVE_OSF_SIA
-
-int	auth_sia_password(Authctxt *authctxt, char *pass);
-void	session_setup_sia(struct passwd *pw, char *tty);
-
-#endif /* HAVE_OSF_SIA */
diff --git a/crypto/openssh/auth-skey.c b/crypto/openssh/auth-skey.c
deleted file mode 100644
index f9ea03fd1a9b..000000000000
--- a/crypto/openssh/auth-skey.c
+++ /dev/null
@@ -1,103 +0,0 @@
-/*
- * Copyright (c) 2001 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#include "includes.h"
-RCSID("$OpenBSD: auth-skey.c,v 1.20 2002/06/30 21:59:45 deraadt Exp $");
-
-#ifdef SKEY
-
-#include <skey.h>
-
-#include "xmalloc.h"
-#include "auth.h"
-#include "monitor_wrap.h"
-
-static void *
-skey_init_ctx(Authctxt *authctxt)
-{
-	return authctxt;
-}
-
-int
-skey_query(void *ctx, char **name, char **infotxt,
-    u_int* numprompts, char ***prompts, u_int **echo_on)
-{
-	Authctxt *authctxt = ctx;
-	char challenge[1024], *p;
-	int len;
-	struct skey skey;
-
-	if (skeychallenge(&skey, authctxt->user, challenge) == -1)
-		return -1;
-
-	*name  = xstrdup("");
-	*infotxt  = xstrdup("");
-	*numprompts = 1;
-	*prompts = xmalloc(*numprompts * sizeof(char *));
-	*echo_on = xmalloc(*numprompts * sizeof(u_int));
-	(*echo_on)[0] = 0;
-
-	len = strlen(challenge) + strlen(SKEY_PROMPT) + 1;
-	p = xmalloc(len);
-	strlcpy(p, challenge, len);
-	strlcat(p, SKEY_PROMPT, len);
-	(*prompts)[0] = p;
-
-	return 0;
-}
-
-int
-skey_respond(void *ctx, u_int numresponses, char **responses)
-{
-	Authctxt *authctxt = ctx;
-
-	if (authctxt->valid &&
-	    numresponses == 1 &&
-	    skey_haskey(authctxt->pw->pw_name) == 0 &&
-	    skey_passcheck(authctxt->pw->pw_name, responses[0]) != -1)
-	    return 0;
-	return -1;
-}
-
-static void
-skey_free_ctx(void *ctx)
-{
-	/* we don't have a special context */
-}
-
-KbdintDevice skey_device = {
-	"skey",
-	skey_init_ctx,
-	skey_query,
-	skey_respond,
-	skey_free_ctx
-};
-
-KbdintDevice mm_skey_device = {
-	"skey",
-	skey_init_ctx,
-	mm_skey_query,
-	mm_skey_respond,
-	skey_free_ctx
-};
-#endif /* SKEY */
diff --git a/crypto/openssh/auth.c b/crypto/openssh/auth.c
deleted file mode 100644
index 1268accb1ba1..000000000000
--- a/crypto/openssh/auth.c
+++ /dev/null
@@ -1,566 +0,0 @@
-/*
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: auth.c,v 1.46 2002/11/04 10:07:53 markus Exp $");
-
-#ifdef HAVE_LOGIN_H
-#include <login.h>
-#endif
-#if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
-#include <shadow.h>
-#endif /* defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) */
-
-#ifdef HAVE_LIBGEN_H
-#include <libgen.h>
-#endif
-
-#include "xmalloc.h"
-#include "match.h"
-#include "groupaccess.h"
-#include "log.h"
-#include "servconf.h"
-#include "auth.h"
-#include "auth-options.h"
-#include "canohost.h"
-#include "buffer.h"
-#include "bufaux.h"
-#include "uidswap.h"
-#include "tildexpand.h"
-#include "misc.h"
-#include "bufaux.h"
-#include "packet.h"
-
-/* import */
-extern ServerOptions options;
-
-/* Debugging messages */
-Buffer auth_debug;
-int auth_debug_init;
-
-/*
- * Check if the user is allowed to log in via ssh. If user is listed
- * in DenyUsers or one of user's groups is listed in DenyGroups, false
- * will be returned. If AllowUsers isn't empty and user isn't listed
- * there, or if AllowGroups isn't empty and one of user's groups isn't
- * listed there, false will be returned.
- * If the user's shell is not executable, false will be returned.
- * Otherwise true is returned.
- */
-int
-allowed_user(struct passwd * pw)
-{
-	struct stat st;
-	const char *hostname = NULL, *ipaddr = NULL;
-	char *shell;
-	int i;
-#ifdef WITH_AIXAUTHENTICATE
-	char *loginmsg;
-#endif /* WITH_AIXAUTHENTICATE */
-#if !defined(USE_PAM) && defined(HAVE_SHADOW_H) && \
-    !defined(DISABLE_SHADOW) && defined(HAS_SHADOW_EXPIRE)
-	struct spwd *spw;
-	time_t today;
-#endif
-
-	/* Shouldn't be called if pw is NULL, but better safe than sorry... */
-	if (!pw || !pw->pw_name)
-		return 0;
-
-#if !defined(USE_PAM) && defined(HAVE_SHADOW_H) && \
-    !defined(DISABLE_SHADOW) && defined(HAS_SHADOW_EXPIRE)
-#define	DAY		(24L * 60 * 60) /* 1 day in seconds */
-	if ((spw = getspnam(pw->pw_name)) != NULL) {
-		today = time(NULL) / DAY;
-		debug3("allowed_user: today %d sp_expire %d sp_lstchg %d"
-		    " sp_max %d", (int)today, (int)spw->sp_expire,
-		    (int)spw->sp_lstchg, (int)spw->sp_max);
-
-		/*
-		 * We assume account and password expiration occurs the
-		 * day after the day specified.
-		 */
-		if (spw->sp_expire != -1 && today > spw->sp_expire) {
-			log("Account %.100s has expired", pw->pw_name);
-			return 0;
-		}
-
-		if (spw->sp_lstchg == 0) {
-			log("User %.100s password has expired (root forced)",
-			    pw->pw_name);
-			return 0;
-		}
-
-		if (spw->sp_max != -1 &&
-		    today > spw->sp_lstchg + spw->sp_max) {
-			log("User %.100s password has expired (password aged)",
-			    pw->pw_name);
-			return 0;
-		}
-	}
-#endif
-
-	/*
-	 * Get the shell from the password data.  An empty shell field is
-	 * legal, and means /bin/sh.
-	 */
-	shell = (pw->pw_shell[0] == '\0') ? _PATH_BSHELL : pw->pw_shell;
-
-	/* deny if shell does not exists or is not executable */
-	if (stat(shell, &st) != 0) {
-		log("User %.100s not allowed because shell %.100s does not exist",
-		    pw->pw_name, shell);
-		return 0;
-	}
-	if (S_ISREG(st.st_mode) == 0 ||
-	    (st.st_mode & (S_IXOTH|S_IXUSR|S_IXGRP)) == 0) {
-		log("User %.100s not allowed because shell %.100s is not executable",
-		    pw->pw_name, shell);
-		return 0;
-	}
-
-	if (options.num_deny_users > 0 || options.num_allow_users > 0) {
-		hostname = get_canonical_hostname(options.verify_reverse_mapping);
-		ipaddr = get_remote_ipaddr();
-	}
-
-	/* Return false if user is listed in DenyUsers */
-	if (options.num_deny_users > 0) {
-		for (i = 0; i < options.num_deny_users; i++)
-			if (match_user(pw->pw_name, hostname, ipaddr,
-			    options.deny_users[i])) {
-				log("User %.100s not allowed because listed in DenyUsers",
-				    pw->pw_name);
-				return 0;
-			}
-	}
-	/* Return false if AllowUsers isn't empty and user isn't listed there */
-	if (options.num_allow_users > 0) {
-		for (i = 0; i < options.num_allow_users; i++)
-			if (match_user(pw->pw_name, hostname, ipaddr,
-			    options.allow_users[i]))
-				break;
-		/* i < options.num_allow_users iff we break for loop */
-		if (i >= options.num_allow_users) {
-			log("User %.100s not allowed because not listed in AllowUsers",
-			    pw->pw_name);
-			return 0;
-		}
-	}
-	if (options.num_deny_groups > 0 || options.num_allow_groups > 0) {
-		/* Get the user's group access list (primary and supplementary) */
-		if (ga_init(pw->pw_name, pw->pw_gid) == 0) {
-			log("User %.100s not allowed because not in any group",
-			    pw->pw_name);
-			return 0;
-		}
-
-		/* Return false if one of user's groups is listed in DenyGroups */
-		if (options.num_deny_groups > 0)
-			if (ga_match(options.deny_groups,
-			    options.num_deny_groups)) {
-				ga_free();
-				log("User %.100s not allowed because a group is listed in DenyGroups",
-				    pw->pw_name);
-				return 0;
-			}
-		/*
-		 * Return false if AllowGroups isn't empty and one of user's groups
-		 * isn't listed there
-		 */
-		if (options.num_allow_groups > 0)
-			if (!ga_match(options.allow_groups,
-			    options.num_allow_groups)) {
-				ga_free();
-				log("User %.100s not allowed because none of user's groups are listed in AllowGroups",
-				    pw->pw_name);
-				return 0;
-			}
-		ga_free();
-	}
-
-#ifdef WITH_AIXAUTHENTICATE
-	/*
-	 * Don't check loginrestrictions() for root account (use
-	 * PermitRootLogin to control logins via ssh), or if running as
-	 * non-root user (since loginrestrictions will always fail).
-	 */
-	if ((pw->pw_uid != 0) && (geteuid() == 0) &&
-	    loginrestrictions(pw->pw_name, S_RLOGIN, NULL, &loginmsg) != 0) {
-		int loginrestrict_errno = errno;
-
-		if (loginmsg && *loginmsg) {
-			/* Remove embedded newlines (if any) */
-			char *p;
-			for (p = loginmsg; *p; p++) {
-				if (*p == '\n')
-					*p = ' ';
-			}
-			/* Remove trailing newline */
-			*--p = '\0';
-			log("Login restricted for %s: %.100s", pw->pw_name, 
-			    loginmsg);
-		}
-		/* Don't fail if /etc/nologin  set */
-	    	if (!(loginrestrict_errno == EPERM && 
-		    stat(_PATH_NOLOGIN, &st) == 0))
-			return 0;
-	}
-#endif /* WITH_AIXAUTHENTICATE */
-
-	/* We found no reason not to let this user try to log on... */
-	return 1;
-}
-
-Authctxt *
-authctxt_new(void)
-{
-	Authctxt *authctxt = xmalloc(sizeof(*authctxt));
-	memset(authctxt, 0, sizeof(*authctxt));
-	return authctxt;
-}
-
-void
-auth_log(Authctxt *authctxt, int authenticated, char *method, char *info)
-{
-	void (*authlog) (const char *fmt,...) = verbose;
-	char *authmsg;
-
-	/* Raise logging level */
-	if (authenticated == 1 ||
-	    !authctxt->valid ||
-	    authctxt->failures >= AUTH_FAIL_LOG ||
-	    strcmp(method, "password") == 0)
-		authlog = log;
-
-	if (authctxt->postponed)
-		authmsg = "Postponed";
-	else
-		authmsg = authenticated ? "Accepted" : "Failed";
-
-	authlog("%s %s for %s%.100s from %.200s port %d%s",
-	    authmsg,
-	    method,
-	    authctxt->valid ? "" : "illegal user ",
-	    authctxt->user,
-	    get_remote_ipaddr(),
-	    get_remote_port(),
-	    info);
-
-#ifdef WITH_AIXAUTHENTICATE
-	if (authenticated == 0 && strcmp(method, "password") == 0)
-	    loginfailed(authctxt->user,
-		get_canonical_hostname(options.verify_reverse_mapping),
-		"ssh");
-#endif /* WITH_AIXAUTHENTICATE */
-
-}
-
-/*
- * Check whether root logins are disallowed.
- */
-int
-auth_root_allowed(char *method)
-{
-	switch (options.permit_root_login) {
-	case PERMIT_YES:
-		return 1;
-		break;
-	case PERMIT_NO_PASSWD:
-		if (strcmp(method, "password") != 0)
-			return 1;
-		break;
-	case PERMIT_FORCED_ONLY:
-		if (forced_command) {
-			log("Root login accepted for forced command.");
-			return 1;
-		}
-		break;
-	}
-	log("ROOT LOGIN REFUSED FROM %.200s", get_remote_ipaddr());
-	return 0;
-}
-
-
-/*
- * Given a template and a passwd structure, build a filename
- * by substituting % tokenised options. Currently, %% becomes '%',
- * %h becomes the home directory and %u the username.
- *
- * This returns a buffer allocated by xmalloc.
- */
-char *
-expand_filename(const char *filename, struct passwd *pw)
-{
-	Buffer buffer;
-	char *file;
-	const char *cp;
-
-	/*
-	 * Build the filename string in the buffer by making the appropriate
-	 * substitutions to the given file name.
-	 */
-	buffer_init(&buffer);
-	for (cp = filename; *cp; cp++) {
-		if (cp[0] == '%' && cp[1] == '%') {
-			buffer_append(&buffer, "%", 1);
-			cp++;
-			continue;
-		}
-		if (cp[0] == '%' && cp[1] == 'h') {
-			buffer_append(&buffer, pw->pw_dir, strlen(pw->pw_dir));
-			cp++;
-			continue;
-		}
-		if (cp[0] == '%' && cp[1] == 'u') {
-			buffer_append(&buffer, pw->pw_name,
-			    strlen(pw->pw_name));
-			cp++;
-			continue;
-		}
-		buffer_append(&buffer, cp, 1);
-	}
-	buffer_append(&buffer, "\0", 1);
-
-	/*
-	 * Ensure that filename starts anchored. If not, be backward
-	 * compatible and prepend the '%h/'
-	 */
-	file = xmalloc(MAXPATHLEN);
-	cp = buffer_ptr(&buffer);
-	if (*cp != '/')
-		snprintf(file, MAXPATHLEN, "%s/%s", pw->pw_dir, cp);
-	else
-		strlcpy(file, cp, MAXPATHLEN);
-
-	buffer_free(&buffer);
-	return file;
-}
-
-char *
-authorized_keys_file(struct passwd *pw)
-{
-	return expand_filename(options.authorized_keys_file, pw);
-}
-
-char *
-authorized_keys_file2(struct passwd *pw)
-{
-	return expand_filename(options.authorized_keys_file2, pw);
-}
-
-/* return ok if key exists in sysfile or userfile */
-HostStatus
-check_key_in_hostfiles(struct passwd *pw, Key *key, const char *host,
-    const char *sysfile, const char *userfile)
-{
-	Key *found;
-	char *user_hostfile;
-	struct stat st;
-	HostStatus host_status;
-
-	/* Check if we know the host and its host key. */
-	found = key_new(key->type);
-	host_status = check_host_in_hostfile(sysfile, host, key, found, NULL);
-
-	if (host_status != HOST_OK && userfile != NULL) {
-		user_hostfile = tilde_expand_filename(userfile, pw->pw_uid);
-		if (options.strict_modes &&
-		    (stat(user_hostfile, &st) == 0) &&
-		    ((st.st_uid != 0 && st.st_uid != pw->pw_uid) ||
-		    (st.st_mode & 022) != 0)) {
-			log("Authentication refused for %.100s: "
-			    "bad owner or modes for %.200s",
-			    pw->pw_name, user_hostfile);
-		} else {
-			temporarily_use_uid(pw);
-			host_status = check_host_in_hostfile(user_hostfile,
-			    host, key, found, NULL);
-			restore_uid();
-		}
-		xfree(user_hostfile);
-	}
-	key_free(found);
-
-	debug2("check_key_in_hostfiles: key %s for %s", host_status == HOST_OK ?
-	    "ok" : "not found", host);
-	return host_status;
-}
-
-
-/*
- * Check a given file for security. This is defined as all components
- * of the path to the file must be owned by either the owner of
- * of the file or root and no directories must be group or world writable.
- *
- * XXX Should any specific check be done for sym links ?
- *
- * Takes an open file descriptor, the file name, a uid and and
- * error buffer plus max size as arguments.
- *
- * Returns 0 on success and -1 on failure
- */
-int
-secure_filename(FILE *f, const char *file, struct passwd *pw,
-    char *err, size_t errlen)
-{
-	uid_t uid = pw->pw_uid;
-	char buf[MAXPATHLEN], homedir[MAXPATHLEN];
-	char *cp;
-	int comparehome = 0;
-	struct stat st;
-
-	if (realpath(file, buf) == NULL) {
-		snprintf(err, errlen, "realpath %s failed: %s", file,
-		    strerror(errno));
-		return -1;
-	}
-	if (realpath(pw->pw_dir, homedir) != NULL)
-		comparehome = 1;
-
-	/* check the open file to avoid races */
-	if (fstat(fileno(f), &st) < 0 ||
-	    (st.st_uid != 0 && st.st_uid != uid) ||
-	    (st.st_mode & 022) != 0) {
-		snprintf(err, errlen, "bad ownership or modes for file %s",
-		    buf);
-		return -1;
-	}
-
-	/* for each component of the canonical path, walking upwards */
-	for (;;) {
-		if ((cp = dirname(buf)) == NULL) {
-			snprintf(err, errlen, "dirname() failed");
-			return -1;
-		}
-		strlcpy(buf, cp, sizeof(buf));
-
-		debug3("secure_filename: checking '%s'", buf);
-		if (stat(buf, &st) < 0 ||
-		    (st.st_uid != 0 && st.st_uid != uid) ||
-		    (st.st_mode & 022) != 0) {
-			snprintf(err, errlen,
-			    "bad ownership or modes for directory %s", buf);
-			return -1;
-		}
-
-		/* If are passed the homedir then we can stop */
-		if (comparehome && strcmp(homedir, buf) == 0) {
-			debug3("secure_filename: terminating check at '%s'",
-			    buf);
-			break;
-		}
-		/*
-		 * dirname should always complete with a "/" path,
-		 * but we can be paranoid and check for "." too
-		 */
-		if ((strcmp("/", buf) == 0) || (strcmp(".", buf) == 0))
-			break;
-	}
-	return 0;
-}
-
-struct passwd *
-getpwnamallow(const char *user)
-{
-#ifdef HAVE_LOGIN_CAP
-	extern login_cap_t *lc;
-#ifdef BSD_AUTH
-	auth_session_t *as;
-#endif
-#endif
-	struct passwd *pw;
-
-	pw = getpwnam(user);
-	if (pw == NULL) {
-		log("Illegal user %.100s from %.100s",
-		    user, get_remote_ipaddr());
-#ifdef WITH_AIXAUTHENTICATE
-		loginfailed(user,
-		    get_canonical_hostname(options.verify_reverse_mapping),
-		    "ssh");
-#endif
-		return (NULL);
-	}
-	if (!allowed_user(pw))
-		return (NULL);
-#ifdef HAVE_LOGIN_CAP
-	if ((lc = login_getclass(pw->pw_class)) == NULL) {
-		debug("unable to get login class: %s", user);
-		return (NULL);
-	}
-#ifdef BSD_AUTH
-	if ((as = auth_open()) == NULL || auth_setpwd(as, pw) != 0 ||
-	    auth_approval(as, lc, pw->pw_name, "ssh") <= 0) {
-		debug("Approval failure for %s", user);
-		pw = NULL;
-	}
-	if (as != NULL)
-		auth_close(as);
-#endif
-#endif
-	if (pw != NULL)
-		return (pwcopy(pw));
-	return (NULL);
-}
-
-void
-auth_debug_add(const char *fmt,...)
-{
-	char buf[1024];
-	va_list args;
-
-	if (!auth_debug_init)
-		return;
-
-	va_start(args, fmt);
-	vsnprintf(buf, sizeof(buf), fmt, args);
-	va_end(args);
-	buffer_put_cstring(&auth_debug, buf);
-}
-
-void
-auth_debug_send(void)
-{
-	char *msg;
-
-	if (!auth_debug_init)
-		return;
-	while (buffer_len(&auth_debug)) {
-		msg = buffer_get_string(&auth_debug, NULL);
-		packet_send_debug("%s", msg);
-		xfree(msg);
-	}
-}
-
-void
-auth_debug_reset(void)
-{
-	if (auth_debug_init)
-		buffer_clear(&auth_debug);
-	else {
-		buffer_init(&auth_debug);
-		auth_debug_init = 1;
-	}
-}
diff --git a/crypto/openssh/auth.h b/crypto/openssh/auth.h
deleted file mode 100644
index c75d75366bca..000000000000
--- a/crypto/openssh/auth.h
+++ /dev/null
@@ -1,192 +0,0 @@
-/*	$OpenBSD: auth.h,v 1.41 2002/09/26 11:38:43 markus Exp $	*/
-
-/*
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- */
-
-#ifndef AUTH_H
-#define AUTH_H
-
-#include "key.h"
-#include "hostfile.h"
-#include <openssl/rsa.h>
-
-#ifdef HAVE_LOGIN_CAP
-#include <login_cap.h>
-#endif
-#ifdef BSD_AUTH
-#include <bsd_auth.h>
-#endif
-#ifdef KRB5
-#include <krb5.h>
-#endif
-
-typedef struct Authctxt Authctxt;
-typedef struct Authmethod Authmethod;
-typedef struct KbdintDevice KbdintDevice;
-
-struct Authctxt {
-	int		 success;
-	int		 postponed;
-	int		 valid;
-	int		 attempt;
-	int		 failures;
-	char		*user;
-	char		*service;
-	struct passwd	*pw;
-	char		*style;
-	void		*kbdintctxt;
-#ifdef BSD_AUTH
-	auth_session_t	*as;
-#endif
-#ifdef KRB4
-	char		*krb4_ticket_file;
-#endif
-#ifdef KRB5
-	krb5_context	 krb5_ctx;
-	krb5_auth_context krb5_auth_ctx;
-	krb5_ccache	 krb5_fwd_ccache;
-	krb5_principal	 krb5_user;
-	char		*krb5_ticket_file;
-#endif
-};
-
-struct Authmethod {
-	char	*name;
-	int	(*userauth)(Authctxt *authctxt);
-	int	*enabled;
-};
-
-/*
- * Keyboard interactive device:
- * init_ctx	returns: non NULL upon success
- * query	returns: 0 - success, otherwise failure
- * respond	returns: 0 - success, 1 - need further interaction,
- *		otherwise - failure
- */
-struct KbdintDevice
-{
-	const char *name;
-	void*	(*init_ctx)(Authctxt*);
-	int	(*query)(void *ctx, char **name, char **infotxt,
-		    u_int *numprompts, char ***prompts, u_int **echo_on);
-	int	(*respond)(void *ctx, u_int numresp, char **responses);
-	void	(*free_ctx)(void *ctx);
-};
-
-int      auth_rhosts(struct passwd *, const char *);
-int
-auth_rhosts2(struct passwd *, const char *, const char *, const char *);
-
-int	 auth_rhosts_rsa(struct passwd *, char *, Key *);
-int      auth_password(Authctxt *, const char *);
-int      auth_rsa(struct passwd *, BIGNUM *);
-int      auth_rsa_challenge_dialog(Key *);
-BIGNUM	*auth_rsa_generate_challenge(Key *);
-int	 auth_rsa_verify_response(Key *, BIGNUM *, u_char[]);
-int	 auth_rsa_key_allowed(struct passwd *, BIGNUM *, Key **);
-
-int	 auth_rhosts_rsa_key_allowed(struct passwd *, char *, char *, Key *);
-int	 hostbased_key_allowed(struct passwd *, const char *, char *, Key *);
-int	 user_key_allowed(struct passwd *, Key *);
-
-#ifdef KRB4
-#include <krb.h>
-int     auth_krb4(Authctxt *, KTEXT, char **, KTEXT);
-int	auth_krb4_password(Authctxt *, const char *);
-void    krb4_cleanup_proc(void *);
-
-#ifdef AFS
-#include <kafs.h>
-int     auth_krb4_tgt(Authctxt *, const char *);
-int     auth_afs_token(Authctxt *, const char *);
-#endif /* AFS */
-
-#endif /* KRB4 */
-
-#ifdef KRB5
-int	auth_krb5(Authctxt *authctxt, krb5_data *auth, char **client, krb5_data *);
-int	auth_krb5_tgt(Authctxt *authctxt, krb5_data *tgt);
-int	auth_krb5_password(Authctxt *authctxt, const char *password);
-void	krb5_cleanup_proc(void *authctxt);
-#endif /* KRB5 */
-
-#include "auth-pam.h"
-#include "auth2-pam.h"
-
-Authctxt *do_authentication(void);
-Authctxt *do_authentication2(void);
-
-Authctxt *authctxt_new(void);
-void	auth_log(Authctxt *, int, char *, char *);
-void	userauth_finish(Authctxt *, int, char *);
-int	auth_root_allowed(char *);
-
-char	*auth2_read_banner(void);
-
-void	privsep_challenge_enable(void);
-
-int	auth2_challenge(Authctxt *, char *);
-void	auth2_challenge_stop(Authctxt *);
-int	bsdauth_query(void *, char **, char **, u_int *, char ***, u_int **);
-int	bsdauth_respond(void *, u_int, char **);
-int	skey_query(void *, char **, char **, u_int *, char ***, u_int **);
-int	skey_respond(void *, u_int, char **);
-
-int	allowed_user(struct passwd *);
-struct passwd * getpwnamallow(const char *user);
-
-char	*get_challenge(Authctxt *);
-int	verify_response(Authctxt *, const char *);
-
-struct passwd * auth_get_user(void);
-
-char	*expand_filename(const char *, struct passwd *);
-char	*authorized_keys_file(struct passwd *);
-char	*authorized_keys_file2(struct passwd *);
-
-int
-secure_filename(FILE *, const char *, struct passwd *, char *, size_t);
-
-HostStatus
-check_key_in_hostfiles(struct passwd *, Key *, const char *,
-    const char *, const char *);
-
-/* hostkey handling */
-Key	*get_hostkey_by_index(int);
-Key	*get_hostkey_by_type(int);
-int	 get_hostkey_index(Key *);
-int	 ssh1_session_key(BIGNUM *);
-
-/* debug messages during authentication */
-void	 auth_debug_add(const char *fmt,...) __attribute__((format(printf, 1, 2)));
-void	 auth_debug_send(void);
-void	 auth_debug_reset(void);
-
-#define AUTH_FAIL_MAX 6
-#define AUTH_FAIL_LOG (AUTH_FAIL_MAX/2)
-#define AUTH_FAIL_MSG "Too many authentication failures for %.100s"
-
-#define SKEY_PROMPT "\nS/Key Password: "
-#endif
diff --git a/crypto/openssh/auth1.c b/crypto/openssh/auth1.c
deleted file mode 100644
index c273f2fb6b5f..000000000000
--- a/crypto/openssh/auth1.c
+++ /dev/null
@@ -1,432 +0,0 @@
-/*
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: auth1.c,v 1.47 2003/02/06 21:22:42 markus Exp $");
-
-#include "xmalloc.h"
-#include "rsa.h"
-#include "ssh1.h"
-#include "packet.h"
-#include "buffer.h"
-#include "mpaux.h"
-#include "log.h"
-#include "servconf.h"
-#include "compat.h"
-#include "auth.h"
-#include "channels.h"
-#include "session.h"
-#include "uidswap.h"
-#include "monitor_wrap.h"
-
-/* import */
-extern ServerOptions options;
-
-/*
- * convert ssh auth msg type into description
- */
-static char *
-get_authname(int type)
-{
-	static char buf[1024];
-	switch (type) {
-	case SSH_CMSG_AUTH_PASSWORD:
-		return "password";
-	case SSH_CMSG_AUTH_RSA:
-		return "rsa";
-	case SSH_CMSG_AUTH_RHOSTS_RSA:
-		return "rhosts-rsa";
-	case SSH_CMSG_AUTH_RHOSTS:
-		return "rhosts";
-	case SSH_CMSG_AUTH_TIS:
-	case SSH_CMSG_AUTH_TIS_RESPONSE:
-		return "challenge-response";
-#if defined(KRB4) || defined(KRB5)
-	case SSH_CMSG_AUTH_KERBEROS:
-		return "kerberos";
-#endif
-	}
-	snprintf(buf, sizeof buf, "bad-auth-msg-%d", type);
-	return buf;
-}
-
-/*
- * read packets, try to authenticate the user and
- * return only if authentication is successful
- */
-static void
-do_authloop(Authctxt *authctxt)
-{
-	int authenticated = 0;
-	u_int bits;
-	Key *client_host_key;
-	BIGNUM *n;
-	char *client_user, *password;
-	char info[1024];
-	u_int dlen;
-	u_int ulen;
-	int type = 0;
-	struct passwd *pw = authctxt->pw;
-
-	debug("Attempting authentication for %s%.100s.",
-	    authctxt->valid ? "" : "illegal user ", authctxt->user);
-
-	/* If the user has no password, accept authentication immediately. */
-	if (options.password_authentication &&
-#if defined(KRB4) || defined(KRB5)
-	    (!options.kerberos_authentication || options.kerberos_or_local_passwd) &&
-#endif
-	    PRIVSEP(auth_password(authctxt, ""))) {
-		auth_log(authctxt, 1, "without authentication", "");
-		return;
-	}
-
-	/* Indicate that authentication is needed. */
-	packet_start(SSH_SMSG_FAILURE);
-	packet_send();
-	packet_write_wait();
-
-	client_user = NULL;
-
-	for (;;) {
-		/* default to fail */
-		authenticated = 0;
-
-		info[0] = '\0';
-
-		/* Get a packet from the client. */
-		type = packet_read();
-
-		/* Process the packet. */
-		switch (type) {
-
-#if defined(KRB4) || defined(KRB5)
-		case SSH_CMSG_AUTH_KERBEROS:
-			if (!options.kerberos_authentication) {
-				verbose("Kerberos authentication disabled.");
-			} else {
-				char *kdata = packet_get_string(&dlen);
-				packet_check_eom();
-
-				if (kdata[0] == 4) { /* KRB_PROT_VERSION */
-#ifdef KRB4
-					KTEXT_ST tkt, reply;
-					tkt.length = dlen;
-					if (tkt.length < MAX_KTXT_LEN)
-						memcpy(tkt.dat, kdata, tkt.length);
-
-					if (PRIVSEP(auth_krb4(authctxt, &tkt,
-					    &client_user, &reply))) {
-						authenticated = 1;
-						snprintf(info, sizeof(info),
-						    " tktuser %.100s",
-						    client_user);
-
-						packet_start(
-						    SSH_SMSG_AUTH_KERBEROS_RESPONSE);
-						packet_put_string((char *)
-						    reply.dat, reply.length);
-						packet_send();
-						packet_write_wait();
-					}
-#endif /* KRB4 */
-				} else {
-#ifdef KRB5
-					krb5_data tkt, reply;
-					tkt.length = dlen;
-					tkt.data = kdata;
-
-					if (PRIVSEP(auth_krb5(authctxt, &tkt,
-					    &client_user, &reply))) {
-						authenticated = 1;
-						snprintf(info, sizeof(info),
-						    " tktuser %.100s",
-						    client_user);
-
- 						/* Send response to client */
- 						packet_start(
-						    SSH_SMSG_AUTH_KERBEROS_RESPONSE);
- 						packet_put_string((char *)
-						    reply.data, reply.length);
- 						packet_send();
- 						packet_write_wait();
-
- 						if (reply.length)
- 							xfree(reply.data);
-					}
-#endif /* KRB5 */
-				}
-				xfree(kdata);
-			}
-			break;
-#endif /* KRB4 || KRB5 */
-
-#if defined(AFS) || defined(KRB5)
-			/* XXX - punt on backward compatibility here. */
-		case SSH_CMSG_HAVE_KERBEROS_TGT:
-			packet_send_debug("Kerberos TGT passing disabled before authentication.");
-			break;
-#ifdef AFS
-		case SSH_CMSG_HAVE_AFS_TOKEN:
-			packet_send_debug("AFS token passing disabled before authentication.");
-			break;
-#endif /* AFS */
-#endif /* AFS || KRB5 */
-
-		case SSH_CMSG_AUTH_RHOSTS:
-			if (!options.rhosts_authentication) {
-				verbose("Rhosts authentication disabled.");
-				break;
-			}
-			/*
-			 * Get client user name.  Note that we just have to
-			 * trust the client; this is one reason why rhosts
-			 * authentication is insecure. (Another is
-			 * IP-spoofing on a local network.)
-			 */
-			client_user = packet_get_string(&ulen);
-			packet_check_eom();
-
-			/* Try to authenticate using /etc/hosts.equiv and .rhosts. */
-			authenticated = auth_rhosts(pw, client_user);
-
-			snprintf(info, sizeof info, " ruser %.100s", client_user);
-			break;
-
-		case SSH_CMSG_AUTH_RHOSTS_RSA:
-			if (!options.rhosts_rsa_authentication) {
-				verbose("Rhosts with RSA authentication disabled.");
-				break;
-			}
-			/*
-			 * Get client user name.  Note that we just have to
-			 * trust the client; root on the client machine can
-			 * claim to be any user.
-			 */
-			client_user = packet_get_string(&ulen);
-
-			/* Get the client host key. */
-			client_host_key = key_new(KEY_RSA1);
-			bits = packet_get_int();
-			packet_get_bignum(client_host_key->rsa->e);
-			packet_get_bignum(client_host_key->rsa->n);
-
-			if (bits != BN_num_bits(client_host_key->rsa->n))
-				verbose("Warning: keysize mismatch for client_host_key: "
-				    "actual %d, announced %d",
-				    BN_num_bits(client_host_key->rsa->n), bits);
-			packet_check_eom();
-
-			authenticated = auth_rhosts_rsa(pw, client_user,
-			    client_host_key);
-			key_free(client_host_key);
-
-			snprintf(info, sizeof info, " ruser %.100s", client_user);
-			break;
-
-		case SSH_CMSG_AUTH_RSA:
-			if (!options.rsa_authentication) {
-				verbose("RSA authentication disabled.");
-				break;
-			}
-			/* RSA authentication requested. */
-			if ((n = BN_new()) == NULL)
-				fatal("do_authloop: BN_new failed");
-			packet_get_bignum(n);
-			packet_check_eom();
-			authenticated = auth_rsa(pw, n);
-			BN_clear_free(n);
-			break;
-
-		case SSH_CMSG_AUTH_PASSWORD:
-			if (!options.password_authentication) {
-				verbose("Password authentication disabled.");
-				break;
-			}
-			/*
-			 * Read user password.  It is in plain text, but was
-			 * transmitted over the encrypted channel so it is
-			 * not visible to an outside observer.
-			 */
-			password = packet_get_string(&dlen);
-			packet_check_eom();
-
-			/* Try authentication with the password. */
-			authenticated = PRIVSEP(auth_password(authctxt, password));
-
-			memset(password, 0, strlen(password));
-			xfree(password);
-			break;
-
-		case SSH_CMSG_AUTH_TIS:
-			debug("rcvd SSH_CMSG_AUTH_TIS");
-			if (options.challenge_response_authentication == 1) {
-				char *challenge = get_challenge(authctxt);
-				if (challenge != NULL) {
-					debug("sending challenge '%s'", challenge);
-					packet_start(SSH_SMSG_AUTH_TIS_CHALLENGE);
-					packet_put_cstring(challenge);
-					xfree(challenge);
-					packet_send();
-					packet_write_wait();
-					continue;
-				}
-			}
-			break;
-		case SSH_CMSG_AUTH_TIS_RESPONSE:
-			debug("rcvd SSH_CMSG_AUTH_TIS_RESPONSE");
-			if (options.challenge_response_authentication == 1) {
-				char *response = packet_get_string(&dlen);
-				packet_check_eom();
-				authenticated = verify_response(authctxt, response);
-				memset(response, 'r', dlen);
-				xfree(response);
-			}
-			break;
-
-		default:
-			/*
-			 * Any unknown messages will be ignored (and failure
-			 * returned) during authentication.
-			 */
-			log("Unknown message during authentication: type %d", type);
-			break;
-		}
-#ifdef BSD_AUTH
-		if (authctxt->as) {
-			auth_close(authctxt->as);
-			authctxt->as = NULL;
-		}
-#endif
-		if (!authctxt->valid && authenticated)
-			fatal("INTERNAL ERROR: authenticated invalid user %s",
-			    authctxt->user);
-
-#ifdef _UNICOS
-		if (type == SSH_CMSG_AUTH_PASSWORD && !authenticated)
-			cray_login_failure(authctxt->user, IA_UDBERR);
-		if (authenticated && cray_access_denied(authctxt->user)) {
-			authenticated = 0;
-			fatal("Access denied for user %s.",authctxt->user);
-		}
-#endif /* _UNICOS */
-
-#ifdef HAVE_CYGWIN
-		if (authenticated &&
-		    !check_nt_auth(type == SSH_CMSG_AUTH_PASSWORD, pw)) {
-			packet_disconnect("Authentication rejected for uid %d.",
-			pw == NULL ? -1 : pw->pw_uid);
-			authenticated = 0;
-		}
-#else
-		/* Special handling for root */
-		if (authenticated && authctxt->pw->pw_uid == 0 &&
-		    !auth_root_allowed(get_authname(type)))
-			authenticated = 0;
-#endif
-#ifdef USE_PAM
-		if (!use_privsep && authenticated && 
-		    !do_pam_account(pw->pw_name, client_user))
-			authenticated = 0;
-#endif
-
-		/* Log before sending the reply */
-		auth_log(authctxt, authenticated, get_authname(type), info);
-
-		if (client_user != NULL) {
-			xfree(client_user);
-			client_user = NULL;
-		}
-
-		if (authenticated)
-			return;
-
-		if (authctxt->failures++ > AUTH_FAIL_MAX) {
-			packet_disconnect(AUTH_FAIL_MSG, authctxt->user);
-		}
-
-		packet_start(SSH_SMSG_FAILURE);
-		packet_send();
-		packet_write_wait();
-	}
-}
-
-/*
- * Performs authentication of an incoming connection.  Session key has already
- * been exchanged and encryption is enabled.
- */
-Authctxt *
-do_authentication(void)
-{
-	Authctxt *authctxt;
-	u_int ulen;
-	char *user, *style = NULL;
-
-	/* Get the name of the user that we wish to log in as. */
-	packet_read_expect(SSH_CMSG_USER);
-
-	/* Get the user name. */
-	user = packet_get_string(&ulen);
-	packet_check_eom();
-
-	if ((style = strchr(user, ':')) != NULL)
-		*style++ = '\0';
-
-#ifdef KRB5
-	/* XXX - SSH.com Kerberos v5 braindeath. */
-	if ((datafellows & SSH_BUG_K5USER) &&
-	    options.kerberos_authentication) {
-		char *p;
-		if ((p = strchr(user, '@')) != NULL)
-			*p = '\0';
-	}
-#endif
-
-	authctxt = authctxt_new();
-	authctxt->user = user;
-	authctxt->style = style;
-
-	/* Verify that the user is a valid user. */
-	if ((authctxt->pw = PRIVSEP(getpwnamallow(user))) != NULL)
-		authctxt->valid = 1;
-	else
-		debug("do_authentication: illegal user %s", user);
-
-	setproctitle("%s%s", authctxt->pw ? user : "unknown",
-	    use_privsep ? " [net]" : "");
-
-#ifdef USE_PAM
-	PRIVSEP(start_pam(authctxt->pw == NULL ? "NOUSER" : user));
-#endif
-
-	/*
-	 * If we are not running as root, the user must have the same uid as
-	 * the server. (Unless you are running Windows)
-	 */
-#ifndef HAVE_CYGWIN
-	if (!use_privsep && getuid() != 0 && authctxt->pw &&
-	    authctxt->pw->pw_uid != getuid())
-		packet_disconnect("Cannot change user when server not running as root.");
-#endif
-
-	/*
-	 * Loop until the user has been authenticated or the connection is
-	 * closed, do_authloop() returns only if authentication is successful
-	 */
-	do_authloop(authctxt);
-
-	/* The user has been authenticated and accepted. */
-	packet_start(SSH_SMSG_SUCCESS);
-	packet_send();
-	packet_write_wait();
-
-	return (authctxt);
-}
diff --git a/crypto/openssh/auth2-chall.c b/crypto/openssh/auth2-chall.c
deleted file mode 100644
index 0d170930795e..000000000000
--- a/crypto/openssh/auth2-chall.c
+++ /dev/null
@@ -1,337 +0,0 @@
-/*
- * Copyright (c) 2001 Markus Friedl.  All rights reserved.
- * Copyright (c) 2001 Per Allansson.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#include "includes.h"
-RCSID("$OpenBSD: auth2-chall.c,v 1.20 2002/06/30 21:59:45 deraadt Exp $");
-
-#include "ssh2.h"
-#include "auth.h"
-#include "buffer.h"
-#include "packet.h"
-#include "xmalloc.h"
-#include "dispatch.h"
-#include "auth.h"
-#include "log.h"
-
-static int auth2_challenge_start(Authctxt *);
-static int send_userauth_info_request(Authctxt *);
-static void input_userauth_info_response(int, u_int32_t, void *);
-
-#ifdef BSD_AUTH
-extern KbdintDevice bsdauth_device;
-#else
-#ifdef SKEY
-extern KbdintDevice skey_device;
-#endif
-#endif
-
-KbdintDevice *devices[] = {
-#ifdef BSD_AUTH
-	&bsdauth_device,
-#else
-#ifdef SKEY
-	&skey_device,
-#endif
-#endif
-	NULL
-};
-
-typedef struct KbdintAuthctxt KbdintAuthctxt;
-struct KbdintAuthctxt
-{
-	char *devices;
-	void *ctxt;
-	KbdintDevice *device;
-	u_int nreq;
-};
-
-static KbdintAuthctxt *
-kbdint_alloc(const char *devs)
-{
-	KbdintAuthctxt *kbdintctxt;
-	Buffer b;
-	int i;
-
-	kbdintctxt = xmalloc(sizeof(KbdintAuthctxt));
-	if (strcmp(devs, "") == 0) {
-		buffer_init(&b);
-		for (i = 0; devices[i]; i++) {
-			if (buffer_len(&b) > 0)
-				buffer_append(&b, ",", 1);
-			buffer_append(&b, devices[i]->name,
-			    strlen(devices[i]->name));
-		}
-		buffer_append(&b, "\0", 1);
-		kbdintctxt->devices = xstrdup(buffer_ptr(&b));
-		buffer_free(&b);
-	} else {
-		kbdintctxt->devices = xstrdup(devs);
-	}
-	debug("kbdint_alloc: devices '%s'", kbdintctxt->devices);
-	kbdintctxt->ctxt = NULL;
-	kbdintctxt->device = NULL;
-	kbdintctxt->nreq = 0;
-
-	return kbdintctxt;
-}
-static void
-kbdint_reset_device(KbdintAuthctxt *kbdintctxt)
-{
-	if (kbdintctxt->ctxt) {
-		kbdintctxt->device->free_ctx(kbdintctxt->ctxt);
-		kbdintctxt->ctxt = NULL;
-	}
-	kbdintctxt->device = NULL;
-}
-static void
-kbdint_free(KbdintAuthctxt *kbdintctxt)
-{
-	if (kbdintctxt->device)
-		kbdint_reset_device(kbdintctxt);
-	if (kbdintctxt->devices) {
-		xfree(kbdintctxt->devices);
-		kbdintctxt->devices = NULL;
-	}
-	xfree(kbdintctxt);
-}
-/* get next device */
-static int
-kbdint_next_device(KbdintAuthctxt *kbdintctxt)
-{
-	size_t len;
-	char *t;
-	int i;
-
-	if (kbdintctxt->device)
-		kbdint_reset_device(kbdintctxt);
-	do {
-		len = kbdintctxt->devices ?
-		    strcspn(kbdintctxt->devices, ",") : 0;
-
-		if (len == 0)
-			break;
-		for (i = 0; devices[i]; i++)
-			if (strncmp(kbdintctxt->devices, devices[i]->name, len) == 0)
-				kbdintctxt->device = devices[i];
-		t = kbdintctxt->devices;
-		kbdintctxt->devices = t[len] ? xstrdup(t+len+1) : NULL;
-		xfree(t);
-		debug2("kbdint_next_device: devices %s", kbdintctxt->devices ?
-		   kbdintctxt->devices : "<empty>");
-	} while (kbdintctxt->devices && !kbdintctxt->device);
-
-	return kbdintctxt->device ? 1 : 0;
-}
-
-/*
- * try challenge-response, set authctxt->postponed if we have to
- * wait for the response.
- */
-int
-auth2_challenge(Authctxt *authctxt, char *devs)
-{
-	debug("auth2_challenge: user=%s devs=%s",
-	    authctxt->user ? authctxt->user : "<nouser>",
-	    devs ? devs : "<no devs>");
-
-	if (authctxt->user == NULL || !devs)
-		return 0;
-	if (authctxt->kbdintctxt == NULL)
-		authctxt->kbdintctxt = kbdint_alloc(devs);
-	return auth2_challenge_start(authctxt);
-}
-
-/* unregister kbd-int callbacks and context */
-void
-auth2_challenge_stop(Authctxt *authctxt)
-{
-	/* unregister callback */
-	dispatch_set(SSH2_MSG_USERAUTH_INFO_RESPONSE, NULL);
-	if (authctxt->kbdintctxt != NULL)  {
-		kbdint_free(authctxt->kbdintctxt);
-		authctxt->kbdintctxt = NULL;
-	}
-}
-
-/* side effect: sets authctxt->postponed if a reply was sent*/
-static int
-auth2_challenge_start(Authctxt *authctxt)
-{
-	KbdintAuthctxt *kbdintctxt = authctxt->kbdintctxt;
-
-	debug2("auth2_challenge_start: devices %s",
-	    kbdintctxt->devices ?  kbdintctxt->devices : "<empty>");
-
-	if (kbdint_next_device(kbdintctxt) == 0) {
-		auth2_challenge_stop(authctxt);
-		return 0;
-	}
-	debug("auth2_challenge_start: trying authentication method '%s'",
-	    kbdintctxt->device->name);
-
-	if ((kbdintctxt->ctxt = kbdintctxt->device->init_ctx(authctxt)) == NULL) {
-		auth2_challenge_stop(authctxt);
-		return 0;
-	}
-	if (send_userauth_info_request(authctxt) == 0) {
-		auth2_challenge_stop(authctxt);
-		return 0;
-	}
-	dispatch_set(SSH2_MSG_USERAUTH_INFO_RESPONSE,
-	    &input_userauth_info_response);
-
-	authctxt->postponed = 1;
-	return 0;
-}
-
-static int
-send_userauth_info_request(Authctxt *authctxt)
-{
-	KbdintAuthctxt *kbdintctxt;
-	char *name, *instr, **prompts;
-	int i;
-	u_int *echo_on;
-
-	kbdintctxt = authctxt->kbdintctxt;
-	if (kbdintctxt->device->query(kbdintctxt->ctxt,
-	    &name, &instr, &kbdintctxt->nreq, &prompts, &echo_on))
-		return 0;
-
-	packet_start(SSH2_MSG_USERAUTH_INFO_REQUEST);
-	packet_put_cstring(name);
-	packet_put_cstring(instr);
-	packet_put_cstring("");		/* language not used */
-	packet_put_int(kbdintctxt->nreq);
-	for (i = 0; i < kbdintctxt->nreq; i++) {
-		packet_put_cstring(prompts[i]);
-		packet_put_char(echo_on[i]);
-	}
-	packet_send();
-	packet_write_wait();
-
-	for (i = 0; i < kbdintctxt->nreq; i++)
-		xfree(prompts[i]);
-	xfree(prompts);
-	xfree(echo_on);
-	xfree(name);
-	xfree(instr);
-	return 1;
-}
-
-static void
-input_userauth_info_response(int type, u_int32_t seq, void *ctxt)
-{
-	Authctxt *authctxt = ctxt;
-	KbdintAuthctxt *kbdintctxt;
-	int i, authenticated = 0, res, len;
-	u_int nresp;
-	char **response = NULL, *method;
-
-	if (authctxt == NULL)
-		fatal("input_userauth_info_response: no authctxt");
-	kbdintctxt = authctxt->kbdintctxt;
-	if (kbdintctxt == NULL || kbdintctxt->ctxt == NULL)
-		fatal("input_userauth_info_response: no kbdintctxt");
-	if (kbdintctxt->device == NULL)
-		fatal("input_userauth_info_response: no device");
-
-	authctxt->postponed = 0;	/* reset */
-	nresp = packet_get_int();
-	if (nresp != kbdintctxt->nreq)
-		fatal("input_userauth_info_response: wrong number of replies");
-	if (nresp > 100)
-		fatal("input_userauth_info_response: too many replies");
-	if (nresp > 0) {
-		response = xmalloc(nresp * sizeof(char *));
-		for (i = 0; i < nresp; i++)
-			response[i] = packet_get_string(NULL);
-	}
-	packet_check_eom();
-
-	if (authctxt->valid) {
-		res = kbdintctxt->device->respond(kbdintctxt->ctxt,
-		    nresp, response);
-	} else {
-		res = -1;
-	}
-
-	for (i = 0; i < nresp; i++) {
-		memset(response[i], 'r', strlen(response[i]));
-		xfree(response[i]);
-	}
-	if (response)
-		xfree(response);
-
-	switch (res) {
-	case 0:
-		/* Success! */
-		authenticated = 1;
-		break;
-	case 1:
-		/* Authentication needs further interaction */
-		if (send_userauth_info_request(authctxt) == 1)
-			authctxt->postponed = 1;
-		break;
-	default:
-		/* Failure! */
-		break;
-	}
-
-	len = strlen("keyboard-interactive") + 2 +
-		strlen(kbdintctxt->device->name);
-	method = xmalloc(len);
-	snprintf(method, len, "keyboard-interactive/%s",
-	    kbdintctxt->device->name);
-
-	if (!authctxt->postponed) {
-		if (authenticated) {
-			auth2_challenge_stop(authctxt);
-		} else {
-			/* start next device */
-			/* may set authctxt->postponed */
-			auth2_challenge_start(authctxt);
-		}
-	}
-	userauth_finish(authctxt, authenticated, method);
-	xfree(method);
-}
-
-void
-privsep_challenge_enable(void)
-{
-#ifdef BSD_AUTH
-	extern KbdintDevice mm_bsdauth_device;
-#endif
-#ifdef SKEY
-	extern KbdintDevice mm_skey_device;
-#endif
-	/* As long as SSHv1 has devices[0] hard coded this is fine */
-#ifdef BSD_AUTH
-	devices[0] = &mm_bsdauth_device;
-#else
-#ifdef SKEY
-	devices[0] = &mm_skey_device;
-#endif
-#endif
-}
diff --git a/crypto/openssh/auth2-hostbased.c b/crypto/openssh/auth2-hostbased.c
deleted file mode 100644
index 2bde7bb79ec4..000000000000
--- a/crypto/openssh/auth2-hostbased.c
+++ /dev/null
@@ -1,182 +0,0 @@
-/*
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: auth2-hostbased.c,v 1.2 2002/05/31 11:35:15 markus Exp $");
-
-#include "ssh2.h"
-#include "xmalloc.h"
-#include "packet.h"
-#include "buffer.h"
-#include "log.h"
-#include "servconf.h"
-#include "compat.h"
-#include "bufaux.h"
-#include "auth.h"
-#include "key.h"
-#include "canohost.h"
-#include "monitor_wrap.h"
-#include "pathnames.h"
-
-/* import */
-extern ServerOptions options;
-extern u_char *session_id2;
-extern int session_id2_len;
-
-static int
-userauth_hostbased(Authctxt *authctxt)
-{
-	Buffer b;
-	Key *key = NULL;
-	char *pkalg, *cuser, *chost, *service;
-	u_char *pkblob, *sig;
-	u_int alen, blen, slen;
-	int pktype;
-	int authenticated = 0;
-
-	if (!authctxt->valid) {
-		debug2("userauth_hostbased: disabled because of invalid user");
-		return 0;
-	}
-	pkalg = packet_get_string(&alen);
-	pkblob = packet_get_string(&blen);
-	chost = packet_get_string(NULL);
-	cuser = packet_get_string(NULL);
-	sig = packet_get_string(&slen);
-
-	debug("userauth_hostbased: cuser %s chost %s pkalg %s slen %d",
-	    cuser, chost, pkalg, slen);
-#ifdef DEBUG_PK
-	debug("signature:");
-	buffer_init(&b);
-	buffer_append(&b, sig, slen);
-	buffer_dump(&b);
-	buffer_free(&b);
-#endif
-	pktype = key_type_from_name(pkalg);
-	if (pktype == KEY_UNSPEC) {
-		/* this is perfectly legal */
-		log("userauth_hostbased: unsupported "
-		    "public key algorithm: %s", pkalg);
-		goto done;
-	}
-	key = key_from_blob(pkblob, blen);
-	if (key == NULL) {
-		error("userauth_hostbased: cannot decode key: %s", pkalg);
-		goto done;
-	}
-	if (key->type != pktype) {
-		error("userauth_hostbased: type mismatch for decoded key "
-		    "(received %d, expected %d)", key->type, pktype);
-		goto done;
-	}
-	service = datafellows & SSH_BUG_HBSERVICE ? "ssh-userauth" :
-	    authctxt->service;
-	buffer_init(&b);
-	buffer_put_string(&b, session_id2, session_id2_len);
-	/* reconstruct packet */
-	buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
-	buffer_put_cstring(&b, authctxt->user);
-	buffer_put_cstring(&b, service);
-	buffer_put_cstring(&b, "hostbased");
-	buffer_put_string(&b, pkalg, alen);
-	buffer_put_string(&b, pkblob, blen);
-	buffer_put_cstring(&b, chost);
-	buffer_put_cstring(&b, cuser);
-#ifdef DEBUG_PK
-	buffer_dump(&b);
-#endif
-	/* test for allowed key and correct signature */
-	authenticated = 0;
-	if (PRIVSEP(hostbased_key_allowed(authctxt->pw, cuser, chost, key)) &&
-	    PRIVSEP(key_verify(key, sig, slen, buffer_ptr(&b),
-			buffer_len(&b))) == 1)
-		authenticated = 1;
-
-	buffer_clear(&b);
-done:
-	debug2("userauth_hostbased: authenticated %d", authenticated);
-	if (key != NULL)
-		key_free(key);
-	xfree(pkalg);
-	xfree(pkblob);
-	xfree(cuser);
-	xfree(chost);
-	xfree(sig);
-	return authenticated;
-}
-
-/* return 1 if given hostkey is allowed */
-int
-hostbased_key_allowed(struct passwd *pw, const char *cuser, char *chost,
-    Key *key)
-{
-	const char *resolvedname, *ipaddr, *lookup;
-	HostStatus host_status;
-	int len;
-
-	resolvedname = get_canonical_hostname(options.verify_reverse_mapping);
-	ipaddr = get_remote_ipaddr();
-
-	debug2("userauth_hostbased: chost %s resolvedname %s ipaddr %s",
-	    chost, resolvedname, ipaddr);
-
-	if (options.hostbased_uses_name_from_packet_only) {
-		if (auth_rhosts2(pw, cuser, chost, chost) == 0)
-			return 0;
-		lookup = chost;
-	} else {
-		if (((len = strlen(chost)) > 0) && chost[len - 1] == '.') {
-			debug2("stripping trailing dot from chost %s", chost);
-			chost[len - 1] = '\0';
-		}
-		if (strcasecmp(resolvedname, chost) != 0)
-			log("userauth_hostbased mismatch: "
-			    "client sends %s, but we resolve %s to %s",
-			    chost, ipaddr, resolvedname);
-		if (auth_rhosts2(pw, cuser, resolvedname, ipaddr) == 0)
-			return 0;
-		lookup = resolvedname;
-	}
-	debug2("userauth_hostbased: access allowed by auth_rhosts2");
-
-	host_status = check_key_in_hostfiles(pw, key, lookup,
-	    _PATH_SSH_SYSTEM_HOSTFILE,
-	    options.ignore_user_known_hosts ? NULL : _PATH_SSH_USER_HOSTFILE);
-
-	/* backward compat if no key has been found. */
-	if (host_status == HOST_NEW)
-		host_status = check_key_in_hostfiles(pw, key, lookup,
-		    _PATH_SSH_SYSTEM_HOSTFILE2,
-		    options.ignore_user_known_hosts ? NULL :
-		    _PATH_SSH_USER_HOSTFILE2);
-
-	return (host_status == HOST_OK);
-}
-
-Authmethod method_hostbased = {
-	"hostbased",
-	userauth_hostbased,
-	&options.hostbased_authentication
-};
diff --git a/crypto/openssh/auth2-kbdint.c b/crypto/openssh/auth2-kbdint.c
deleted file mode 100644
index e60992881553..000000000000
--- a/crypto/openssh/auth2-kbdint.c
+++ /dev/null
@@ -1,69 +0,0 @@
-/*
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: auth2-kbdint.c,v 1.2 2002/05/31 11:35:15 markus Exp $");
-
-#include "packet.h"
-#include "auth.h"
-#include "log.h"
-#include "servconf.h"
-#include "xmalloc.h"
-
-/* import */
-extern ServerOptions options;
-
-static int
-userauth_kbdint(Authctxt *authctxt)
-{
-	int authenticated = 0;
-	char *lang, *devs;
-
-	lang = packet_get_string(NULL);
-	devs = packet_get_string(NULL);
-	packet_check_eom();
-
-	debug("keyboard-interactive devs %s", devs);
-
-	if (options.challenge_response_authentication)
-		authenticated = auth2_challenge(authctxt, devs);
-
-#ifdef USE_PAM
-	if (authenticated == 0 && options.pam_authentication_via_kbd_int)
-		authenticated = auth2_pam(authctxt);
-#endif
-	xfree(devs);
-	xfree(lang);
-#ifdef HAVE_CYGWIN
-	if (check_nt_auth(0, authctxt->pw) == 0)
-		return(0);
-#endif
-	return authenticated;
-}
-
-Authmethod method_kbdint = {
-	"keyboard-interactive",
-	userauth_kbdint,
-	&options.kbd_interactive_authentication
-};
diff --git a/crypto/openssh/auth2-none.c b/crypto/openssh/auth2-none.c
deleted file mode 100644
index c07b2dd81488..000000000000
--- a/crypto/openssh/auth2-none.c
+++ /dev/null
@@ -1,110 +0,0 @@
-/*
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: auth2-none.c,v 1.4 2002/06/27 10:35:47 deraadt Exp $");
-
-#include "auth.h"
-#include "xmalloc.h"
-#include "packet.h"
-#include "log.h"
-#include "servconf.h"
-#include "atomicio.h"
-#include "compat.h"
-#include "ssh2.h"
-#include "monitor_wrap.h"
-
-/* import */
-extern ServerOptions options;
-
-/* "none" is allowed only one time */
-static int none_enabled = 1;
-
-char *
-auth2_read_banner(void)
-{
-	struct stat st;
-	char *banner = NULL;
-	off_t len, n;
-	int fd;
-
-	if ((fd = open(options.banner, O_RDONLY)) == -1)
-		return (NULL);
-	if (fstat(fd, &st) == -1) {
-		close(fd);
-		return (NULL);
-	}
-	len = st.st_size;
-	banner = xmalloc(len + 1);
-	n = atomicio(read, fd, banner, len);
-	close(fd);
-
-	if (n != len) {
-		xfree(banner);
-		return (NULL);
-	}
-	banner[n] = '\0';
-
-	return (banner);
-}
-
-static void
-userauth_banner(void)
-{
-	char *banner = NULL;
-
-	if (options.banner == NULL || (datafellows & SSH_BUG_BANNER))
-		return;
-
-	if ((banner = PRIVSEP(auth2_read_banner())) == NULL)
-		goto done;
-
-	packet_start(SSH2_MSG_USERAUTH_BANNER);
-	packet_put_cstring(banner);
-	packet_put_cstring("");		/* language, unused */
-	packet_send();
-	debug("userauth_banner: sent");
-done:
-	if (banner)
-		xfree(banner);
-}
-
-static int
-userauth_none(Authctxt *authctxt)
-{
-	none_enabled = 0;
-	packet_check_eom();
-	userauth_banner();
-#ifdef HAVE_CYGWIN
-	if (check_nt_auth(1, authctxt->pw) == 0)
-		return(0);
-#endif
-	return (authctxt->valid ? PRIVSEP(auth_password(authctxt, "")) : 0);
-}
-
-Authmethod method_none = {
-	"none",
-	userauth_none,
-	&none_enabled
-};
diff --git a/crypto/openssh/auth2-pam.c b/crypto/openssh/auth2-pam.c
deleted file mode 100644
index ac28fb2451c9..000000000000
--- a/crypto/openssh/auth2-pam.c
+++ /dev/null
@@ -1,165 +0,0 @@
-#include "includes.h"
-RCSID("$Id: auth2-pam.c,v 1.15 2003/01/08 01:37:03 djm Exp $");
-
-#ifdef USE_PAM
-#include <security/pam_appl.h>
-
-#include "ssh.h"
-#include "ssh2.h"
-#include "auth.h"
-#include "auth-pam.h"
-#include "packet.h"
-#include "xmalloc.h"
-#include "dispatch.h"
-#include "log.h"
-
-static int do_pam_conversation_kbd_int(int num_msg, 
-    const struct pam_message **msg, struct pam_response **resp, 
-    void *appdata_ptr);
-void input_userauth_info_response_pam(int type, u_int32_t seqnr, void *ctxt);
-
-struct {
-	int finished, num_received, num_expected;
-	int *prompts;
-	struct pam_response *responses;
-} context_pam2 = {0, 0, 0, NULL};
-
-static struct pam_conv conv2 = {
-	do_pam_conversation_kbd_int,
-	NULL,
-};
-
-int
-auth2_pam(Authctxt *authctxt)
-{
-	int retval = -1;
-
-	if (authctxt->user == NULL)
-		fatal("auth2_pam: internal error: no user");
-
-	conv2.appdata_ptr = authctxt;
-	do_pam_set_conv(&conv2);
-
-	dispatch_set(SSH2_MSG_USERAUTH_INFO_RESPONSE,
-	    &input_userauth_info_response_pam);
-	retval = (do_pam_authenticate(0) == PAM_SUCCESS);
-	dispatch_set(SSH2_MSG_USERAUTH_INFO_RESPONSE, NULL);
-
-	return retval;
-}
-
-static int
-do_pam_conversation_kbd_int(int num_msg, const struct pam_message **msg,
-    struct pam_response **resp, void *appdata_ptr)
-{
-	int i, j, done;
-	char *text;
-
-	context_pam2.finished = 0;
-	context_pam2.num_received = 0;
-	context_pam2.num_expected = 0;
-	context_pam2.prompts = xmalloc(sizeof(int) * num_msg);
-	context_pam2.responses = xmalloc(sizeof(struct pam_response) * num_msg);
-	memset(context_pam2.responses, 0, sizeof(struct pam_response) * num_msg);
-
-	text = NULL;
-	for (i = 0, context_pam2.num_expected = 0; i < num_msg; i++) {
-		int style = PAM_MSG_MEMBER(msg, i, msg_style);
-		switch (style) {
-		case PAM_PROMPT_ECHO_ON:
-		case PAM_PROMPT_ECHO_OFF:
-			context_pam2.num_expected++;
-			break;
-		case PAM_TEXT_INFO:
-		case PAM_ERROR_MSG:
-		default:
-			/* Capture all these messages to be sent at once */
-			message_cat(&text, PAM_MSG_MEMBER(msg, i, msg));
-			break;
-		}
-	}
-
-	if (context_pam2.num_expected == 0)
-		return PAM_SUCCESS;
-
-	packet_start(SSH2_MSG_USERAUTH_INFO_REQUEST);
-	packet_put_cstring("");	/* Name */
-	packet_put_cstring("");	/* Instructions */
-	packet_put_cstring("");	/* Language */
-	packet_put_int(context_pam2.num_expected);
-	
-	for (i = 0, j = 0; i < num_msg; i++) {
-		int style = PAM_MSG_MEMBER(msg, i, msg_style);
-		
-		/* Skip messages which don't need a reply */
-		if (style != PAM_PROMPT_ECHO_ON && style != PAM_PROMPT_ECHO_OFF)
-			continue;
-		
-		context_pam2.prompts[j++] = i;
-		if (text) {
-			message_cat(&text, PAM_MSG_MEMBER(msg, i, msg));
-			packet_put_cstring(text);
-			text = NULL;
-		} else
-			packet_put_cstring(PAM_MSG_MEMBER(msg, i, msg));
-		packet_put_char(style == PAM_PROMPT_ECHO_ON);
-	}
-	packet_send();
-	packet_write_wait();
-
-	/*
-	 * Grabbing control of execution and spinning until we get what
-	 * we want is probably rude, but it seems to work properly, and
-	 * the client *should* be in lock-step with us, so the loop should
-	 * only be traversed once.
-	 */
-	while(context_pam2.finished == 0) {
-		done = 1;
-		dispatch_run(DISPATCH_BLOCK, &done, appdata_ptr);
-		if (context_pam2.finished == 0)
-			debug("extra packet during conversation");
-	}
-
-	if (context_pam2.num_received == context_pam2.num_expected) {
-		*resp = context_pam2.responses;
-		return PAM_SUCCESS;
-	} else
-		return PAM_CONV_ERR;
-}
-
-void
-input_userauth_info_response_pam(int type, u_int32_t seqnr, void *ctxt)
-{
-	Authctxt *authctxt = ctxt;
-	unsigned int nresp = 0, rlen = 0, i = 0;
-	char *resp;
-
-	if (authctxt == NULL)
-		fatal("input_userauth_info_response_pam: no authentication context");
-
-	nresp = packet_get_int();	/* Number of responses. */
-	debug("got %d responses", nresp);
-
-
-	if (nresp != context_pam2.num_expected)
-		fatal("%s: Received incorrect number of responses "
-		    "(expected %d, received %u)", __func__, 
-		    context_pam2.num_expected, nresp);
-
-	if (nresp > 100)
-		fatal("%s: too many replies", __func__);
-
-	for (i = 0; i < nresp; i++) {
-		int j = context_pam2.prompts[i];
-
-		resp = packet_get_string(&rlen);
-		context_pam2.responses[j].resp_retcode = PAM_SUCCESS;
-		context_pam2.responses[j].resp = resp;
-		context_pam2.num_received++;
-	}
-
-	context_pam2.finished = 1;
-
-	packet_check_eom();
-}
-#endif
diff --git a/crypto/openssh/auth2-pam.h b/crypto/openssh/auth2-pam.h
deleted file mode 100644
index c54f811cfa0d..000000000000
--- a/crypto/openssh/auth2-pam.h
+++ /dev/null
@@ -1,8 +0,0 @@
-/* $Id: auth2-pam.h,v 1.2 2001/02/09 01:55:36 djm Exp $ */
-
-#include "includes.h"
-#ifdef USE_PAM
-
-int	auth2_pam(Authctxt *authctxt);
-
-#endif /* USE_PAM */
diff --git a/crypto/openssh/auth2-passwd.c b/crypto/openssh/auth2-passwd.c
deleted file mode 100644
index ffa27959426a..000000000000
--- a/crypto/openssh/auth2-passwd.c
+++ /dev/null
@@ -1,65 +0,0 @@
-/*
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: auth2-passwd.c,v 1.2 2002/05/31 11:35:15 markus Exp $");
-
-#include "xmalloc.h"
-#include "packet.h"
-#include "log.h"
-#include "auth.h"
-#include "monitor_wrap.h"
-#include "servconf.h"
-
-/* import */
-extern ServerOptions options;
-
-static int
-userauth_passwd(Authctxt *authctxt)
-{
-	char *password;
-	int authenticated = 0;
-	int change;
-	u_int len;
-	change = packet_get_char();
-	if (change)
-		log("password change not supported");
-	password = packet_get_string(&len);
-	packet_check_eom();
-	if (authctxt->valid &&
-#ifdef HAVE_CYGWIN
-	    check_nt_auth(1, authctxt->pw) &&
-#endif
-	    PRIVSEP(auth_password(authctxt, password)) == 1)
-		authenticated = 1;
-	memset(password, 0, len);
-	xfree(password);
-	return authenticated;
-}
-
-Authmethod method_passwd = {
-	"password",
-	userauth_passwd,
-	&options.password_authentication
-};
diff --git a/crypto/openssh/auth2-pubkey.c b/crypto/openssh/auth2-pubkey.c
deleted file mode 100644
index 947bfed0bb47..000000000000
--- a/crypto/openssh/auth2-pubkey.c
+++ /dev/null
@@ -1,283 +0,0 @@
-/*
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: auth2-pubkey.c,v 1.2 2002/05/31 11:35:15 markus Exp $");
-
-#include "ssh2.h"
-#include "xmalloc.h"
-#include "packet.h"
-#include "buffer.h"
-#include "log.h"
-#include "servconf.h"
-#include "compat.h"
-#include "bufaux.h"
-#include "auth.h"
-#include "key.h"
-#include "pathnames.h"
-#include "uidswap.h"
-#include "auth-options.h"
-#include "canohost.h"
-#include "monitor_wrap.h"
-
-/* import */
-extern ServerOptions options;
-extern u_char *session_id2;
-extern int session_id2_len;
-
-static int
-userauth_pubkey(Authctxt *authctxt)
-{
-	Buffer b;
-	Key *key = NULL;
-	char *pkalg;
-	u_char *pkblob, *sig;
-	u_int alen, blen, slen;
-	int have_sig, pktype;
-	int authenticated = 0;
-
-	if (!authctxt->valid) {
-		debug2("userauth_pubkey: disabled because of invalid user");
-		return 0;
-	}
-	have_sig = packet_get_char();
-	if (datafellows & SSH_BUG_PKAUTH) {
-		debug2("userauth_pubkey: SSH_BUG_PKAUTH");
-		/* no explicit pkalg given */
-		pkblob = packet_get_string(&blen);
-		buffer_init(&b);
-		buffer_append(&b, pkblob, blen);
-		/* so we have to extract the pkalg from the pkblob */
-		pkalg = buffer_get_string(&b, &alen);
-		buffer_free(&b);
-	} else {
-		pkalg = packet_get_string(&alen);
-		pkblob = packet_get_string(&blen);
-	}
-	pktype = key_type_from_name(pkalg);
-	if (pktype == KEY_UNSPEC) {
-		/* this is perfectly legal */
-		log("userauth_pubkey: unsupported public key algorithm: %s",
-		    pkalg);
-		goto done;
-	}
-	key = key_from_blob(pkblob, blen);
-	if (key == NULL) {
-		error("userauth_pubkey: cannot decode key: %s", pkalg);
-		goto done;
-	}
-	if (key->type != pktype) {
-		error("userauth_pubkey: type mismatch for decoded key "
-		    "(received %d, expected %d)", key->type, pktype);
-		goto done;
-	}
-	if (have_sig) {
-		sig = packet_get_string(&slen);
-		packet_check_eom();
-		buffer_init(&b);
-		if (datafellows & SSH_OLD_SESSIONID) {
-			buffer_append(&b, session_id2, session_id2_len);
-		} else {
-			buffer_put_string(&b, session_id2, session_id2_len);
-		}
-		/* reconstruct packet */
-		buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
-		buffer_put_cstring(&b, authctxt->user);
-		buffer_put_cstring(&b,
-		    datafellows & SSH_BUG_PKSERVICE ?
-		    "ssh-userauth" :
-		    authctxt->service);
-		if (datafellows & SSH_BUG_PKAUTH) {
-			buffer_put_char(&b, have_sig);
-		} else {
-			buffer_put_cstring(&b, "publickey");
-			buffer_put_char(&b, have_sig);
-			buffer_put_cstring(&b, pkalg);
-		}
-		buffer_put_string(&b, pkblob, blen);
-#ifdef DEBUG_PK
-		buffer_dump(&b);
-#endif
-		/* test for correct signature */
-		authenticated = 0;
-		if (PRIVSEP(user_key_allowed(authctxt->pw, key)) &&
-		    PRIVSEP(key_verify(key, sig, slen, buffer_ptr(&b),
-				buffer_len(&b))) == 1)
-			authenticated = 1;
-		buffer_clear(&b);
-		xfree(sig);
-	} else {
-		debug("test whether pkalg/pkblob are acceptable");
-		packet_check_eom();
-
-		/* XXX fake reply and always send PK_OK ? */
-		/*
-		 * XXX this allows testing whether a user is allowed
-		 * to login: if you happen to have a valid pubkey this
-		 * message is sent. the message is NEVER sent at all
-		 * if a user is not allowed to login. is this an
-		 * issue? -markus
-		 */
-		if (PRIVSEP(user_key_allowed(authctxt->pw, key))) {
-			packet_start(SSH2_MSG_USERAUTH_PK_OK);
-			packet_put_string(pkalg, alen);
-			packet_put_string(pkblob, blen);
-			packet_send();
-			packet_write_wait();
-			authctxt->postponed = 1;
-		}
-	}
-	if (authenticated != 1)
-		auth_clear_options();
-done:
-	debug2("userauth_pubkey: authenticated %d pkalg %s", authenticated, pkalg);
-	if (key != NULL)
-		key_free(key);
-	xfree(pkalg);
-	xfree(pkblob);
-#ifdef HAVE_CYGWIN
-	if (check_nt_auth(0, authctxt->pw) == 0)
-		return(0);
-#endif
-	return authenticated;
-}
-
-/* return 1 if user allows given key */
-static int
-user_key_allowed2(struct passwd *pw, Key *key, char *file)
-{
-	char line[8192];
-	int found_key = 0;
-	FILE *f;
-	u_long linenum = 0;
-	struct stat st;
-	Key *found;
-	char *fp;
-
-	if (pw == NULL)
-		return 0;
-
-	/* Temporarily use the user's uid. */
-	temporarily_use_uid(pw);
-
-	debug("trying public key file %s", file);
-
-	/* Fail quietly if file does not exist */
-	if (stat(file, &st) < 0) {
-		/* Restore the privileged uid. */
-		restore_uid();
-		return 0;
-	}
-	/* Open the file containing the authorized keys. */
-	f = fopen(file, "r");
-	if (!f) {
-		/* Restore the privileged uid. */
-		restore_uid();
-		return 0;
-	}
-	if (options.strict_modes &&
-	    secure_filename(f, file, pw, line, sizeof(line)) != 0) {
-		fclose(f);
-		log("Authentication refused: %s", line);
-		restore_uid();
-		return 0;
-	}
-
-	found_key = 0;
-	found = key_new(key->type);
-
-	while (fgets(line, sizeof(line), f)) {
-		char *cp, *options = NULL;
-		linenum++;
-		/* Skip leading whitespace, empty and comment lines. */
-		for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
-			;
-		if (!*cp || *cp == '\n' || *cp == '#')
-			continue;
-
-		if (key_read(found, &cp) != 1) {
-			/* no key?  check if there are options for this key */
-			int quoted = 0;
-			debug2("user_key_allowed: check options: '%s'", cp);
-			options = cp;
-			for (; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) {
-				if (*cp == '\\' && cp[1] == '"')
-					cp++;	/* Skip both */
-				else if (*cp == '"')
-					quoted = !quoted;
-			}
-			/* Skip remaining whitespace. */
-			for (; *cp == ' ' || *cp == '\t'; cp++)
-				;
-			if (key_read(found, &cp) != 1) {
-				debug2("user_key_allowed: advance: '%s'", cp);
-				/* still no key?  advance to next line*/
-				continue;
-			}
-		}
-		if (key_equal(found, key) &&
-		    auth_parse_options(pw, options, file, linenum) == 1) {
-			found_key = 1;
-			debug("matching key found: file %s, line %lu",
-			    file, linenum);
-			fp = key_fingerprint(found, SSH_FP_MD5, SSH_FP_HEX);
-			verbose("Found matching %s key: %s",
-			    key_type(found), fp);
-			xfree(fp);
-			break;
-		}
-	}
-	restore_uid();
-	fclose(f);
-	key_free(found);
-	if (!found_key)
-		debug2("key not found");
-	return found_key;
-}
-
-/* check whether given key is in .ssh/authorized_keys* */
-int
-user_key_allowed(struct passwd *pw, Key *key)
-{
-	int success;
-	char *file;
-
-	file = authorized_keys_file(pw);
-	success = user_key_allowed2(pw, key, file);
-	xfree(file);
-	if (success)
-		return success;
-
-	/* try suffix "2" for backward compat, too */
-	file = authorized_keys_file2(pw);
-	success = user_key_allowed2(pw, key, file);
-	xfree(file);
-	return success;
-}
-
-Authmethod method_pubkey = {
-	"publickey",
-	userauth_pubkey,
-	&options.pubkey_authentication
-};
diff --git a/crypto/openssh/auth2-skey.c b/crypto/openssh/auth2-skey.c
deleted file mode 100644
index 9de08fc09cfd..000000000000
--- a/crypto/openssh/auth2-skey.c
+++ /dev/null
@@ -1,104 +0,0 @@
-#include "includes.h"
-RCSID("$OpenBSD: auth2-skey.c,v 1.1 2000/10/11 20:14:38 markus Exp $");
-
-#include "ssh.h"
-#include "ssh2.h"
-#include "auth.h"
-#include "packet.h"
-#include "xmalloc.h"
-#include "dispatch.h"
-
-void	send_userauth_into_request(Authctxt *authctxt, int echo);
-void	input_userauth_info_response(int type, int plen, void *ctxt);
-
-/*
- * try skey authentication, always return -1 (= postponed) since we have to
- * wait for the s/key response.
- */
-int
-auth2_skey(Authctxt *authctxt)
-{
-	send_userauth_into_request(authctxt, 0);
-	dispatch_set(SSH2_MSG_USERAUTH_INFO_RESPONSE, &input_userauth_info_response);
-	return -1;
-}
-
-void
-send_userauth_into_request(Authctxt *authctxt, int echo)
-{
-	int retval = -1;
-	struct skey skey;
-	char challenge[SKEY_MAX_CHALLENGE];
-	char *fake;
-
-	if (authctxt->user == NULL)
-		fatal("send_userauth_into_request: internal error: no user");
-
-	/* get skey challenge */
-	if (authctxt->valid)
-		retval = skeychallenge(&skey, authctxt->user, challenge);
-
-	if (retval == -1) {
-		fake = skey_fake_keyinfo(authctxt->user);
-		strlcpy(challenge, fake, sizeof challenge);
-	}
-	/* send our info request */
-	packet_start(SSH2_MSG_USERAUTH_INFO_REQUEST);
-	packet_put_cstring("S/Key Authentication");	/* Name */
-	packet_put_cstring(challenge);			/* Instruction */
-	packet_put_cstring("");				/* Language */
-	packet_put_int(1);			 	/* Number of prompts */
-	packet_put_cstring(echo ?
-		 "Response [Echo]: ": "Response: ");	/* Prompt */
-	packet_put_char(echo);				/* Echo */
-	packet_send();
-	packet_write_wait();
-	memset(challenge, 'c', sizeof challenge);
-}
-
-void
-input_userauth_info_response(int type, int plen, void *ctxt)
-{
-	Authctxt *authctxt = ctxt;
-	int authenticated = 0;
-	unsigned int nresp, rlen;
-	char *resp, *method;
-
-	if (authctxt == NULL)
-		fatal("input_userauth_info_response: no authentication context");
-
-	if (authctxt->attempt++ >= AUTH_FAIL_MAX)
-		packet_disconnect("too many failed userauth_requests");
-
-	nresp = packet_get_int();
-	if (nresp == 1) {
-		/* we only support s/key and assume s/key for nresp == 1 */
-		method = "s/key";
-		resp = packet_get_string(&rlen);
-		packet_done();
-		if (strlen(resp) == 0) {
-			/*
-			 * if we received a null response, resend prompt with
-			 * echo enabled
-			 */
-			authenticated = -1;
-			userauth_log(authctxt, authenticated, method);
-			send_userauth_into_request(authctxt, 1);
-		} else {
-			/* verify skey response */
-			if (authctxt->valid &&
-			    skey_haskey(authctxt->pw->pw_name) == 0 &&
-			    skey_passcheck(authctxt->pw->pw_name, resp) != -1) {
-				authenticated = 1;
-			} else {
-				authenticated = 0;
-			}
-			memset(resp, 'r', rlen);
-			/* unregister callback */
-			dispatch_set(SSH2_MSG_USERAUTH_INFO_RESPONSE, NULL);
-			userauth_log(authctxt, authenticated, method);
-			userauth_reply(authctxt, authenticated);
-		}
-		xfree(resp);
-	}
-}
diff --git a/crypto/openssh/auth2.c b/crypto/openssh/auth2.c
deleted file mode 100644
index 1b21eb2dab7b..000000000000
--- a/crypto/openssh/auth2.c
+++ /dev/null
@@ -1,307 +0,0 @@
-/*
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: auth2.c,v 1.96 2003/02/06 21:22:43 markus Exp $");
-
-#include "ssh2.h"
-#include "xmalloc.h"
-#include "packet.h"
-#include "log.h"
-#include "servconf.h"
-#include "compat.h"
-#include "auth.h"
-#include "dispatch.h"
-#include "pathnames.h"
-#include "monitor_wrap.h"
-
-/* import */
-extern ServerOptions options;
-extern u_char *session_id2;
-extern int session_id2_len;
-
-Authctxt *x_authctxt = NULL;
-
-/* methods */
-
-extern Authmethod method_none;
-extern Authmethod method_pubkey;
-extern Authmethod method_passwd;
-extern Authmethod method_kbdint;
-extern Authmethod method_hostbased;
-
-Authmethod *authmethods[] = {
-	&method_none,
-	&method_pubkey,
-	&method_passwd,
-	&method_kbdint,
-	&method_hostbased,
-	NULL
-};
-
-/* protocol */
-
-static void input_service_request(int, u_int32_t, void *);
-static void input_userauth_request(int, u_int32_t, void *);
-
-/* helper */
-static Authmethod *authmethod_lookup(const char *);
-static char *authmethods_get(void);
-int user_key_allowed(struct passwd *, Key *);
-int hostbased_key_allowed(struct passwd *, const char *, char *, Key *);
-
-/*
- * loop until authctxt->success == TRUE
- */
-
-Authctxt *
-do_authentication2(void)
-{
-	Authctxt *authctxt = authctxt_new();
-
-	x_authctxt = authctxt;		/*XXX*/
-
-	/* challenge-response is implemented via keyboard interactive */
-	if (options.challenge_response_authentication)
-		options.kbd_interactive_authentication = 1;
-	if (options.pam_authentication_via_kbd_int)
-		options.kbd_interactive_authentication = 1;
-	if (use_privsep)
-		options.pam_authentication_via_kbd_int = 0;
-
-	dispatch_init(&dispatch_protocol_error);
-	dispatch_set(SSH2_MSG_SERVICE_REQUEST, &input_service_request);
-	dispatch_run(DISPATCH_BLOCK, &authctxt->success, authctxt);
-
-	return (authctxt);
-}
-
-static void
-input_service_request(int type, u_int32_t seq, void *ctxt)
-{
-	Authctxt *authctxt = ctxt;
-	u_int len;
-	int acceptit = 0;
-	char *service = packet_get_string(&len);
-	packet_check_eom();
-
-	if (authctxt == NULL)
-		fatal("input_service_request: no authctxt");
-
-	if (strcmp(service, "ssh-userauth") == 0) {
-		if (!authctxt->success) {
-			acceptit = 1;
-			/* now we can handle user-auth requests */
-			dispatch_set(SSH2_MSG_USERAUTH_REQUEST, &input_userauth_request);
-		}
-	}
-	/* XXX all other service requests are denied */
-
-	if (acceptit) {
-		packet_start(SSH2_MSG_SERVICE_ACCEPT);
-		packet_put_cstring(service);
-		packet_send();
-		packet_write_wait();
-	} else {
-		debug("bad service request %s", service);
-		packet_disconnect("bad service request %s", service);
-	}
-	xfree(service);
-}
-
-static void
-input_userauth_request(int type, u_int32_t seq, void *ctxt)
-{
-	Authctxt *authctxt = ctxt;
-	Authmethod *m = NULL;
-	char *user, *service, *method, *style = NULL;
-	int authenticated = 0;
-
-	if (authctxt == NULL)
-		fatal("input_userauth_request: no authctxt");
-
-	user = packet_get_string(NULL);
-	service = packet_get_string(NULL);
-	method = packet_get_string(NULL);
-	debug("userauth-request for user %s service %s method %s", user, service, method);
-	debug("attempt %d failures %d", authctxt->attempt, authctxt->failures);
-
-	if ((style = strchr(user, ':')) != NULL)
-		*style++ = 0;
-
-	if (authctxt->attempt++ == 0) {
-		/* setup auth context */
-		authctxt->pw = PRIVSEP(getpwnamallow(user));
-		if (authctxt->pw && strcmp(service, "ssh-connection")==0) {
-			authctxt->valid = 1;
-			debug2("input_userauth_request: setting up authctxt for %s", user);
-#ifdef USE_PAM
-			PRIVSEP(start_pam(authctxt->pw->pw_name));
-#endif
-		} else {
-			log("input_userauth_request: illegal user %s", user);
-#ifdef USE_PAM
-			PRIVSEP(start_pam("NOUSER"));
-#endif
-		}
-		setproctitle("%s%s", authctxt->pw ? user : "unknown",
-		    use_privsep ? " [net]" : "");
-		authctxt->user = xstrdup(user);
-		authctxt->service = xstrdup(service);
-		authctxt->style = style ? xstrdup(style) : NULL;
-		if (use_privsep)
-			mm_inform_authserv(service, style);
-	} else if (strcmp(user, authctxt->user) != 0 ||
-	    strcmp(service, authctxt->service) != 0) {
-		packet_disconnect("Change of username or service not allowed: "
-		    "(%s,%s) -> (%s,%s)",
-		    authctxt->user, authctxt->service, user, service);
-	}
-	/* reset state */
-	auth2_challenge_stop(authctxt);
-	authctxt->postponed = 0;
-
-	/* try to authenticate user */
-	m = authmethod_lookup(method);
-	if (m != NULL) {
-		debug2("input_userauth_request: try method %s", method);
-		authenticated =	m->userauth(authctxt);
-	}
-	userauth_finish(authctxt, authenticated, method);
-
-	xfree(service);
-	xfree(user);
-	xfree(method);
-}
-
-void
-userauth_finish(Authctxt *authctxt, int authenticated, char *method)
-{
-	char *methods;
-
-	if (!authctxt->valid && authenticated)
-		fatal("INTERNAL ERROR: authenticated invalid user %s",
-		    authctxt->user);
-
-	/* Special handling for root */
-	if (authenticated && authctxt->pw->pw_uid == 0 &&
-	    !auth_root_allowed(method))
-		authenticated = 0;
-
-#ifdef USE_PAM
-	if (!use_privsep && authenticated && authctxt->user && 
-	    !do_pam_account(authctxt->user, NULL))
-		authenticated = 0;
-#endif /* USE_PAM */
-
-#ifdef _UNICOS
-	if (authenticated && cray_access_denied(authctxt->user)) {
-		authenticated = 0;
-		fatal("Access denied for user %s.",authctxt->user);
-	}
-#endif /* _UNICOS */
-
-	/* Log before sending the reply */
-	auth_log(authctxt, authenticated, method, " ssh2");
-
-	if (authctxt->postponed)
-		return;
-
-	/* XXX todo: check if multiple auth methods are needed */
-	if (authenticated == 1) {
-		/* turn off userauth */
-		dispatch_set(SSH2_MSG_USERAUTH_REQUEST, &dispatch_protocol_ignore);
-		packet_start(SSH2_MSG_USERAUTH_SUCCESS);
-		packet_send();
-		packet_write_wait();
-		/* now we can break out */
-		authctxt->success = 1;
-	} else {
-		if (authctxt->failures++ > AUTH_FAIL_MAX) {
-			packet_disconnect(AUTH_FAIL_MSG, authctxt->user);
-		}
-#ifdef _UNICOS
-		if (strcmp(method, "password") == 0)
-			cray_login_failure(authctxt->user, IA_UDBERR);
-#endif /* _UNICOS */
-		methods = authmethods_get();
-		packet_start(SSH2_MSG_USERAUTH_FAILURE);
-		packet_put_cstring(methods);
-		packet_put_char(0);	/* XXX partial success, unused */
-		packet_send();
-		packet_write_wait();
-		xfree(methods);
-	}
-}
-
-/* get current user */
-
-struct passwd*
-auth_get_user(void)
-{
-	return (x_authctxt != NULL && x_authctxt->valid) ? x_authctxt->pw : NULL;
-}
-
-#define	DELIM	","
-
-static char *
-authmethods_get(void)
-{
-	Buffer b;
-	char *list;
-	int i;
-
-	buffer_init(&b);
-	for (i = 0; authmethods[i] != NULL; i++) {
-		if (strcmp(authmethods[i]->name, "none") == 0)
-			continue;
-		if (authmethods[i]->enabled != NULL &&
-		    *(authmethods[i]->enabled) != 0) {
-			if (buffer_len(&b) > 0)
-				buffer_append(&b, ",", 1);
-			buffer_append(&b, authmethods[i]->name,
-			    strlen(authmethods[i]->name));
-		}
-	}
-	buffer_append(&b, "\0", 1);
-	list = xstrdup(buffer_ptr(&b));
-	buffer_free(&b);
-	return list;
-}
-
-static Authmethod *
-authmethod_lookup(const char *name)
-{
-	int i;
-
-	if (name != NULL)
-		for (i = 0; authmethods[i] != NULL; i++)
-			if (authmethods[i]->enabled != NULL &&
-			    *(authmethods[i]->enabled) != 0 &&
-			    strcmp(name, authmethods[i]->name) == 0)
-				return authmethods[i];
-	debug2("Unrecognized authentication method name: %s",
-	    name ? name : "NULL");
-	return NULL;
-}
diff --git a/crypto/openssh/authfd.c b/crypto/openssh/authfd.c
deleted file mode 100644
index a186e01175b0..000000000000
--- a/crypto/openssh/authfd.c
+++ /dev/null
@@ -1,653 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * Functions for connecting the local authentication agent.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- *
- * SSH2 implementation,
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: authfd.c,v 1.58 2003/01/23 13:50:27 markus Exp $");
-
-#include <openssl/evp.h>
-
-#include "ssh.h"
-#include "rsa.h"
-#include "buffer.h"
-#include "bufaux.h"
-#include "xmalloc.h"
-#include "getput.h"
-#include "key.h"
-#include "authfd.h"
-#include "cipher.h"
-#include "kex.h"
-#include "compat.h"
-#include "log.h"
-#include "atomicio.h"
-
-static int agent_present = 0;
-
-/* helper */
-int	decode_reply(int type);
-
-/* macro to check for "agent failure" message */
-#define agent_failed(x) \
-    ((x == SSH_AGENT_FAILURE) || (x == SSH_COM_AGENT2_FAILURE) || \
-    (x == SSH2_AGENT_FAILURE))
-
-int
-ssh_agent_present(void)
-{
-	int authfd;
-
-	if (agent_present)
-		return 1;
-	if ((authfd = ssh_get_authentication_socket()) == -1)
-		return 0;
-	else {
-		ssh_close_authentication_socket(authfd);
-		return 1;
-	}
-}
-
-/* Returns the number of the authentication fd, or -1 if there is none. */
-
-int
-ssh_get_authentication_socket(void)
-{
-	const char *authsocket;
-	int sock;
-	struct sockaddr_un sunaddr;
-
-	authsocket = getenv(SSH_AUTHSOCKET_ENV_NAME);
-	if (!authsocket)
-		return -1;
-
-	sunaddr.sun_family = AF_UNIX;
-	strlcpy(sunaddr.sun_path, authsocket, sizeof(sunaddr.sun_path));
-
-	sock = socket(AF_UNIX, SOCK_STREAM, 0);
-	if (sock < 0)
-		return -1;
-
-	/* close on exec */
-	if (fcntl(sock, F_SETFD, 1) == -1) {
-		close(sock);
-		return -1;
-	}
-	if (connect(sock, (struct sockaddr *) &sunaddr, sizeof sunaddr) < 0) {
-		close(sock);
-		return -1;
-	}
-	agent_present = 1;
-	return sock;
-}
-
-static int
-ssh_request_reply(AuthenticationConnection *auth, Buffer *request, Buffer *reply)
-{
-	int l, len;
-	char buf[1024];
-
-	/* Get the length of the message, and format it in the buffer. */
-	len = buffer_len(request);
-	PUT_32BIT(buf, len);
-
-	/* Send the length and then the packet to the agent. */
-	if (atomicio(write, auth->fd, buf, 4) != 4 ||
-	    atomicio(write, auth->fd, buffer_ptr(request),
-	    buffer_len(request)) != buffer_len(request)) {
-		error("Error writing to authentication socket.");
-		return 0;
-	}
-	/*
-	 * Wait for response from the agent.  First read the length of the
-	 * response packet.
-	 */
-	len = 4;
-	while (len > 0) {
-		l = read(auth->fd, buf + 4 - len, len);
-		if (l == -1 && (errno == EAGAIN || errno == EINTR))
-			continue;
-		if (l <= 0) {
-			error("Error reading response length from authentication socket.");
-			return 0;
-		}
-		len -= l;
-	}
-
-	/* Extract the length, and check it for sanity. */
-	len = GET_32BIT(buf);
-	if (len > 256 * 1024)
-		fatal("Authentication response too long: %d", len);
-
-	/* Read the rest of the response in to the buffer. */
-	buffer_clear(reply);
-	while (len > 0) {
-		l = len;
-		if (l > sizeof(buf))
-			l = sizeof(buf);
-		l = read(auth->fd, buf, l);
-		if (l == -1 && (errno == EAGAIN || errno == EINTR))
-			continue;
-		if (l <= 0) {
-			error("Error reading response from authentication socket.");
-			return 0;
-		}
-		buffer_append(reply, buf, l);
-		len -= l;
-	}
-	return 1;
-}
-
-/*
- * Closes the agent socket if it should be closed (depends on how it was
- * obtained).  The argument must have been returned by
- * ssh_get_authentication_socket().
- */
-
-void
-ssh_close_authentication_socket(int sock)
-{
-	if (getenv(SSH_AUTHSOCKET_ENV_NAME))
-		close(sock);
-}
-
-/*
- * Opens and connects a private socket for communication with the
- * authentication agent.  Returns the file descriptor (which must be
- * shut down and closed by the caller when no longer needed).
- * Returns NULL if an error occurred and the connection could not be
- * opened.
- */
-
-AuthenticationConnection *
-ssh_get_authentication_connection(void)
-{
-	AuthenticationConnection *auth;
-	int sock;
-
-	sock = ssh_get_authentication_socket();
-
-	/*
-	 * Fail if we couldn't obtain a connection.  This happens if we
-	 * exited due to a timeout.
-	 */
-	if (sock < 0)
-		return NULL;
-
-	auth = xmalloc(sizeof(*auth));
-	auth->fd = sock;
-	buffer_init(&auth->identities);
-	auth->howmany = 0;
-
-	return auth;
-}
-
-/*
- * Closes the connection to the authentication agent and frees any associated
- * memory.
- */
-
-void
-ssh_close_authentication_connection(AuthenticationConnection *auth)
-{
-	buffer_free(&auth->identities);
-	close(auth->fd);
-	xfree(auth);
-}
-
-/* Lock/unlock agent */
-int
-ssh_lock_agent(AuthenticationConnection *auth, int lock, const char *password)
-{
-	int type;
-	Buffer msg;
-
-	buffer_init(&msg);
-	buffer_put_char(&msg, lock ? SSH_AGENTC_LOCK : SSH_AGENTC_UNLOCK);
-	buffer_put_cstring(&msg, password);
-
-	if (ssh_request_reply(auth, &msg, &msg) == 0) {
-		buffer_free(&msg);
-		return 0;
-	}
-	type = buffer_get_char(&msg);
-	buffer_free(&msg);
-	return decode_reply(type);
-}
-
-/*
- * Returns the first authentication identity held by the agent.
- */
-
-int
-ssh_get_num_identities(AuthenticationConnection *auth, int version)
-{
-	int type, code1 = 0, code2 = 0;
-	Buffer request;
-
-	switch (version) {
-	case 1:
-		code1 = SSH_AGENTC_REQUEST_RSA_IDENTITIES;
-		code2 = SSH_AGENT_RSA_IDENTITIES_ANSWER;
-		break;
-	case 2:
-		code1 = SSH2_AGENTC_REQUEST_IDENTITIES;
-		code2 = SSH2_AGENT_IDENTITIES_ANSWER;
-		break;
-	default:
-		return 0;
-	}
-
-	/*
-	 * Send a message to the agent requesting for a list of the
-	 * identities it can represent.
-	 */
-	buffer_init(&request);
-	buffer_put_char(&request, code1);
-
-	buffer_clear(&auth->identities);
-	if (ssh_request_reply(auth, &request, &auth->identities) == 0) {
-		buffer_free(&request);
-		return 0;
-	}
-	buffer_free(&request);
-
-	/* Get message type, and verify that we got a proper answer. */
-	type = buffer_get_char(&auth->identities);
-	if (agent_failed(type)) {
-		return 0;
-	} else if (type != code2) {
-		fatal("Bad authentication reply message type: %d", type);
-	}
-
-	/* Get the number of entries in the response and check it for sanity. */
-	auth->howmany = buffer_get_int(&auth->identities);
-	if (auth->howmany > 1024)
-		fatal("Too many identities in authentication reply: %d",
-		    auth->howmany);
-
-	return auth->howmany;
-}
-
-Key *
-ssh_get_first_identity(AuthenticationConnection *auth, char **comment, int version)
-{
-	/* get number of identities and return the first entry (if any). */
-	if (ssh_get_num_identities(auth, version) > 0)
-		return ssh_get_next_identity(auth, comment, version);
-	return NULL;
-}
-
-Key *
-ssh_get_next_identity(AuthenticationConnection *auth, char **comment, int version)
-{
-	u_int bits;
-	u_char *blob;
-	u_int blen;
-	Key *key = NULL;
-
-	/* Return failure if no more entries. */
-	if (auth->howmany <= 0)
-		return NULL;
-
-	/*
-	 * Get the next entry from the packet.  These will abort with a fatal
-	 * error if the packet is too short or contains corrupt data.
-	 */
-	switch (version) {
-	case 1:
-		key = key_new(KEY_RSA1);
-		bits = buffer_get_int(&auth->identities);
-		buffer_get_bignum(&auth->identities, key->rsa->e);
-		buffer_get_bignum(&auth->identities, key->rsa->n);
-		*comment = buffer_get_string(&auth->identities, NULL);
-		if (bits != BN_num_bits(key->rsa->n))
-			log("Warning: identity keysize mismatch: actual %d, announced %u",
-			    BN_num_bits(key->rsa->n), bits);
-		break;
-	case 2:
-		blob = buffer_get_string(&auth->identities, &blen);
-		*comment = buffer_get_string(&auth->identities, NULL);
-		key = key_from_blob(blob, blen);
-		xfree(blob);
-		break;
-	default:
-		return NULL;
-		break;
-	}
-	/* Decrement the number of remaining entries. */
-	auth->howmany--;
-	return key;
-}
-
-/*
- * Generates a random challenge, sends it to the agent, and waits for
- * response from the agent.  Returns true (non-zero) if the agent gave the
- * correct answer, zero otherwise.  Response type selects the style of
- * response desired, with 0 corresponding to protocol version 1.0 (no longer
- * supported) and 1 corresponding to protocol version 1.1.
- */
-
-int
-ssh_decrypt_challenge(AuthenticationConnection *auth,
-    Key* key, BIGNUM *challenge,
-    u_char session_id[16],
-    u_int response_type,
-    u_char response[16])
-{
-	Buffer buffer;
-	int success = 0;
-	int i;
-	int type;
-
-	if (key->type != KEY_RSA1)
-		return 0;
-	if (response_type == 0) {
-		log("Compatibility with ssh protocol version 1.0 no longer supported.");
-		return 0;
-	}
-	buffer_init(&buffer);
-	buffer_put_char(&buffer, SSH_AGENTC_RSA_CHALLENGE);
-	buffer_put_int(&buffer, BN_num_bits(key->rsa->n));
-	buffer_put_bignum(&buffer, key->rsa->e);
-	buffer_put_bignum(&buffer, key->rsa->n);
-	buffer_put_bignum(&buffer, challenge);
-	buffer_append(&buffer, session_id, 16);
-	buffer_put_int(&buffer, response_type);
-
-	if (ssh_request_reply(auth, &buffer, &buffer) == 0) {
-		buffer_free(&buffer);
-		return 0;
-	}
-	type = buffer_get_char(&buffer);
-
-	if (agent_failed(type)) {
-		log("Agent admitted failure to authenticate using the key.");
-	} else if (type != SSH_AGENT_RSA_RESPONSE) {
-		fatal("Bad authentication response: %d", type);
-	} else {
-		success = 1;
-		/*
-		 * Get the response from the packet.  This will abort with a
-		 * fatal error if the packet is corrupt.
-		 */
-		for (i = 0; i < 16; i++)
-			response[i] = buffer_get_char(&buffer);
-	}
-	buffer_free(&buffer);
-	return success;
-}
-
-/* ask agent to sign data, returns -1 on error, 0 on success */
-int
-ssh_agent_sign(AuthenticationConnection *auth,
-    Key *key,
-    u_char **sigp, u_int *lenp,
-    u_char *data, u_int datalen)
-{
-	extern int datafellows;
-	Buffer msg;
-	u_char *blob;
-	u_int blen;
-	int type, flags = 0;
-	int ret = -1;
-
-	if (key_to_blob(key, &blob, &blen) == 0)
-		return -1;
-
-	if (datafellows & SSH_BUG_SIGBLOB)
-		flags = SSH_AGENT_OLD_SIGNATURE;
-
-	buffer_init(&msg);
-	buffer_put_char(&msg, SSH2_AGENTC_SIGN_REQUEST);
-	buffer_put_string(&msg, blob, blen);
-	buffer_put_string(&msg, data, datalen);
-	buffer_put_int(&msg, flags);
-	xfree(blob);
-
-	if (ssh_request_reply(auth, &msg, &msg) == 0) {
-		buffer_free(&msg);
-		return -1;
-	}
-	type = buffer_get_char(&msg);
-	if (agent_failed(type)) {
-		log("Agent admitted failure to sign using the key.");
-	} else if (type != SSH2_AGENT_SIGN_RESPONSE) {
-		fatal("Bad authentication response: %d", type);
-	} else {
-		ret = 0;
-		*sigp = buffer_get_string(&msg, lenp);
-	}
-	buffer_free(&msg);
-	return ret;
-}
-
-/* Encode key for a message to the agent. */
-
-static void
-ssh_encode_identity_rsa1(Buffer *b, RSA *key, const char *comment)
-{
-	buffer_put_int(b, BN_num_bits(key->n));
-	buffer_put_bignum(b, key->n);
-	buffer_put_bignum(b, key->e);
-	buffer_put_bignum(b, key->d);
-	/* To keep within the protocol: p < q for ssh. in SSL p > q */
-	buffer_put_bignum(b, key->iqmp);	/* ssh key->u */
-	buffer_put_bignum(b, key->q);	/* ssh key->p, SSL key->q */
-	buffer_put_bignum(b, key->p);	/* ssh key->q, SSL key->p */
-	buffer_put_cstring(b, comment);
-}
-
-static void
-ssh_encode_identity_ssh2(Buffer *b, Key *key, const char *comment)
-{
-	buffer_put_cstring(b, key_ssh_name(key));
-	switch (key->type) {
-	case KEY_RSA:
-		buffer_put_bignum2(b, key->rsa->n);
-		buffer_put_bignum2(b, key->rsa->e);
-		buffer_put_bignum2(b, key->rsa->d);
-		buffer_put_bignum2(b, key->rsa->iqmp);
-		buffer_put_bignum2(b, key->rsa->p);
-		buffer_put_bignum2(b, key->rsa->q);
-		break;
-	case KEY_DSA:
-		buffer_put_bignum2(b, key->dsa->p);
-		buffer_put_bignum2(b, key->dsa->q);
-		buffer_put_bignum2(b, key->dsa->g);
-		buffer_put_bignum2(b, key->dsa->pub_key);
-		buffer_put_bignum2(b, key->dsa->priv_key);
-		break;
-	}
-	buffer_put_cstring(b, comment);
-}
-
-/*
- * Adds an identity to the authentication server.  This call is not meant to
- * be used by normal applications.
- */
-
-int
-ssh_add_identity_constrained(AuthenticationConnection *auth, Key *key,
-    const char *comment, u_int life, u_int confirm)
-{
-	Buffer msg;
-	int type, constrained = (life || confirm);
-
-	buffer_init(&msg);
-
-	switch (key->type) {
-	case KEY_RSA1:
-		type = constrained ?
-		    SSH_AGENTC_ADD_RSA_ID_CONSTRAINED :
-		    SSH_AGENTC_ADD_RSA_IDENTITY;
-		buffer_put_char(&msg, type);
-		ssh_encode_identity_rsa1(&msg, key->rsa, comment);
-		break;
-	case KEY_RSA:
-	case KEY_DSA:
-		type = constrained ?
-		    SSH2_AGENTC_ADD_ID_CONSTRAINED :
-		    SSH2_AGENTC_ADD_IDENTITY;
-		buffer_put_char(&msg, type);
-		ssh_encode_identity_ssh2(&msg, key, comment);
-		break;
-	default:
-		buffer_free(&msg);
-		return 0;
-		break;
-	}
-	if (constrained) {
-		if (life != 0) {
-			buffer_put_char(&msg, SSH_AGENT_CONSTRAIN_LIFETIME);
-			buffer_put_int(&msg, life);
-		}
-		if (confirm != 0)
-			buffer_put_char(&msg, SSH_AGENT_CONSTRAIN_CONFIRM);
-	}
-	if (ssh_request_reply(auth, &msg, &msg) == 0) {
-		buffer_free(&msg);
-		return 0;
-	}
-	type = buffer_get_char(&msg);
-	buffer_free(&msg);
-	return decode_reply(type);
-}
-
-int
-ssh_add_identity(AuthenticationConnection *auth, Key *key, const char *comment)
-{
-	return ssh_add_identity_constrained(auth, key, comment, 0, 0);
-}
-
-/*
- * Removes an identity from the authentication server.  This call is not
- * meant to be used by normal applications.
- */
-
-int
-ssh_remove_identity(AuthenticationConnection *auth, Key *key)
-{
-	Buffer msg;
-	int type;
-	u_char *blob;
-	u_int blen;
-
-	buffer_init(&msg);
-
-	if (key->type == KEY_RSA1) {
-		buffer_put_char(&msg, SSH_AGENTC_REMOVE_RSA_IDENTITY);
-		buffer_put_int(&msg, BN_num_bits(key->rsa->n));
-		buffer_put_bignum(&msg, key->rsa->e);
-		buffer_put_bignum(&msg, key->rsa->n);
-	} else if (key->type == KEY_DSA || key->type == KEY_RSA) {
-		key_to_blob(key, &blob, &blen);
-		buffer_put_char(&msg, SSH2_AGENTC_REMOVE_IDENTITY);
-		buffer_put_string(&msg, blob, blen);
-		xfree(blob);
-	} else {
-		buffer_free(&msg);
-		return 0;
-	}
-	if (ssh_request_reply(auth, &msg, &msg) == 0) {
-		buffer_free(&msg);
-		return 0;
-	}
-	type = buffer_get_char(&msg);
-	buffer_free(&msg);
-	return decode_reply(type);
-}
-
-int
-ssh_update_card(AuthenticationConnection *auth, int add, const char *reader_id, const char *pin)
-{
-	Buffer msg;
-	int type;
-
-	buffer_init(&msg);
-	buffer_put_char(&msg, add ? SSH_AGENTC_ADD_SMARTCARD_KEY :
-	    SSH_AGENTC_REMOVE_SMARTCARD_KEY);
-	buffer_put_cstring(&msg, reader_id);
-	buffer_put_cstring(&msg, pin);
-	if (ssh_request_reply(auth, &msg, &msg) == 0) {
-		buffer_free(&msg);
-		return 0;
-	}
-	type = buffer_get_char(&msg);
-	buffer_free(&msg);
-	return decode_reply(type);
-}
-
-/*
- * Removes all identities from the agent.  This call is not meant to be used
- * by normal applications.
- */
-
-int
-ssh_remove_all_identities(AuthenticationConnection *auth, int version)
-{
-	Buffer msg;
-	int type;
-	int code = (version==1) ?
-		SSH_AGENTC_REMOVE_ALL_RSA_IDENTITIES :
-		SSH2_AGENTC_REMOVE_ALL_IDENTITIES;
-
-	buffer_init(&msg);
-	buffer_put_char(&msg, code);
-
-	if (ssh_request_reply(auth, &msg, &msg) == 0) {
-		buffer_free(&msg);
-		return 0;
-	}
-	type = buffer_get_char(&msg);
-	buffer_free(&msg);
-	return decode_reply(type);
-}
-
-int
-decode_reply(int type)
-{
-	switch (type) {
-	case SSH_AGENT_FAILURE:
-	case SSH_COM_AGENT2_FAILURE:
-	case SSH2_AGENT_FAILURE:
-		log("SSH_AGENT_FAILURE");
-		return 0;
-	case SSH_AGENT_SUCCESS:
-		return 1;
-	default:
-		fatal("Bad response from authentication agent: %d", type);
-	}
-	/* NOTREACHED */
-	return 0;
-}
diff --git a/crypto/openssh/authfd.h b/crypto/openssh/authfd.h
deleted file mode 100644
index 2a8751ec18bf..000000000000
--- a/crypto/openssh/authfd.h
+++ /dev/null
@@ -1,95 +0,0 @@
-/*	$OpenBSD: authfd.h,v 1.32 2003/01/23 13:50:27 markus Exp $	*/
-
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * Functions to interface with the SSH_AUTHENTICATION_FD socket.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#ifndef AUTHFD_H
-#define AUTHFD_H
-
-#include "buffer.h"
-
-/* Messages for the authentication agent connection. */
-#define SSH_AGENTC_REQUEST_RSA_IDENTITIES	1
-#define SSH_AGENT_RSA_IDENTITIES_ANSWER		2
-#define SSH_AGENTC_RSA_CHALLENGE		3
-#define SSH_AGENT_RSA_RESPONSE			4
-#define SSH_AGENT_FAILURE			5
-#define SSH_AGENT_SUCCESS			6
-#define SSH_AGENTC_ADD_RSA_IDENTITY		7
-#define SSH_AGENTC_REMOVE_RSA_IDENTITY		8
-#define SSH_AGENTC_REMOVE_ALL_RSA_IDENTITIES	9
-
-/* private OpenSSH extensions for SSH2 */
-#define SSH2_AGENTC_REQUEST_IDENTITIES		11
-#define SSH2_AGENT_IDENTITIES_ANSWER		12
-#define SSH2_AGENTC_SIGN_REQUEST		13
-#define SSH2_AGENT_SIGN_RESPONSE		14
-#define SSH2_AGENTC_ADD_IDENTITY		17
-#define SSH2_AGENTC_REMOVE_IDENTITY		18
-#define SSH2_AGENTC_REMOVE_ALL_IDENTITIES	19
-
-/* smartcard */
-#define SSH_AGENTC_ADD_SMARTCARD_KEY		20
-#define SSH_AGENTC_REMOVE_SMARTCARD_KEY		21
-
-/* lock/unlock the agent */
-#define SSH_AGENTC_LOCK				22
-#define SSH_AGENTC_UNLOCK			23
-
-/* add key with constraints */
-#define SSH_AGENTC_ADD_RSA_ID_CONSTRAINED	24
-#define SSH2_AGENTC_ADD_ID_CONSTRAINED		25
-
-#define	SSH_AGENT_CONSTRAIN_LIFETIME		1
-#define	SSH_AGENT_CONSTRAIN_CONFIRM		2
-
-/* extended failure messages */
-#define SSH2_AGENT_FAILURE			30
-
-/* additional error code for ssh.com's ssh-agent2 */
-#define SSH_COM_AGENT2_FAILURE			102
-
-#define	SSH_AGENT_OLD_SIGNATURE			0x01
-
-typedef struct {
-	int	fd;
-	Buffer	identities;
-	int	howmany;
-}	AuthenticationConnection;
-
-int	ssh_agent_present(void);
-int	ssh_get_authentication_socket(void);
-void	ssh_close_authentication_socket(int);
-
-AuthenticationConnection *ssh_get_authentication_connection(void);
-void	ssh_close_authentication_connection(AuthenticationConnection *);
-int	 ssh_get_num_identities(AuthenticationConnection *, int);
-Key	*ssh_get_first_identity(AuthenticationConnection *, char **, int);
-Key	*ssh_get_next_identity(AuthenticationConnection *, char **, int);
-int	 ssh_add_identity(AuthenticationConnection *, Key *, const char *);
-int	 ssh_add_identity_constrained(AuthenticationConnection *, Key *,
-    const char *, u_int, u_int);
-int	 ssh_remove_identity(AuthenticationConnection *, Key *);
-int	 ssh_remove_all_identities(AuthenticationConnection *, int);
-int	 ssh_lock_agent(AuthenticationConnection *, int, const char *);
-int	 ssh_update_card(AuthenticationConnection *, int, const char *, const char *);
-
-int
-ssh_decrypt_challenge(AuthenticationConnection *, Key *, BIGNUM *, u_char[16],
-    u_int, u_char[16]);
-
-int
-ssh_agent_sign(AuthenticationConnection *, Key *, u_char **, u_int *, u_char *,
-    u_int);
-
-#endif				/* AUTHFD_H */
diff --git a/crypto/openssh/authfile.c b/crypto/openssh/authfile.c
deleted file mode 100644
index 90618efdef88..000000000000
--- a/crypto/openssh/authfile.c
+++ /dev/null
@@ -1,644 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * This file contains functions for reading and writing identity files, and
- * for reading the passphrase from the user.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- *
- *
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: authfile.c,v 1.52 2003/03/13 11:42:18 markus Exp $");
-
-#include <openssl/err.h>
-#include <openssl/evp.h>
-#include <openssl/pem.h>
-
-#include "cipher.h"
-#include "xmalloc.h"
-#include "buffer.h"
-#include "bufaux.h"
-#include "key.h"
-#include "ssh.h"
-#include "log.h"
-#include "authfile.h"
-#include "rsa.h"
-
-/* Version identification string for SSH v1 identity files. */
-static const char authfile_id_string[] =
-    "SSH PRIVATE KEY FILE FORMAT 1.1\n";
-
-/*
- * Saves the authentication (private) key in a file, encrypting it with
- * passphrase.  The identification of the file (lowest 64 bits of n) will
- * precede the key to provide identification of the key without needing a
- * passphrase.
- */
-
-static int
-key_save_private_rsa1(Key *key, const char *filename, const char *passphrase,
-    const char *comment)
-{
-	Buffer buffer, encrypted;
-	u_char buf[100], *cp;
-	int fd, i, cipher_num;
-	CipherContext ciphercontext;
-	Cipher *cipher;
-	u_int32_t rand;
-
-	/*
-	 * If the passphrase is empty, use SSH_CIPHER_NONE to ease converting
-	 * to another cipher; otherwise use SSH_AUTHFILE_CIPHER.
-	 */
-	cipher_num = (strcmp(passphrase, "") == 0) ?
-	    SSH_CIPHER_NONE : SSH_AUTHFILE_CIPHER;
-	if ((cipher = cipher_by_number(cipher_num)) == NULL)
-		fatal("save_private_key_rsa: bad cipher");
-
-	/* This buffer is used to built the secret part of the private key. */
-	buffer_init(&buffer);
-
-	/* Put checkbytes for checking passphrase validity. */
-	rand = arc4random();
-	buf[0] = rand & 0xff;
-	buf[1] = (rand >> 8) & 0xff;
-	buf[2] = buf[0];
-	buf[3] = buf[1];
-	buffer_append(&buffer, buf, 4);
-
-	/*
-	 * Store the private key (n and e will not be stored because they
-	 * will be stored in plain text, and storing them also in encrypted
-	 * format would just give known plaintext).
-	 */
-	buffer_put_bignum(&buffer, key->rsa->d);
-	buffer_put_bignum(&buffer, key->rsa->iqmp);
-	buffer_put_bignum(&buffer, key->rsa->q);	/* reverse from SSL p */
-	buffer_put_bignum(&buffer, key->rsa->p);	/* reverse from SSL q */
-
-	/* Pad the part to be encrypted until its size is a multiple of 8. */
-	while (buffer_len(&buffer) % 8 != 0)
-		buffer_put_char(&buffer, 0);
-
-	/* This buffer will be used to contain the data in the file. */
-	buffer_init(&encrypted);
-
-	/* First store keyfile id string. */
-	for (i = 0; authfile_id_string[i]; i++)
-		buffer_put_char(&encrypted, authfile_id_string[i]);
-	buffer_put_char(&encrypted, 0);
-
-	/* Store cipher type. */
-	buffer_put_char(&encrypted, cipher_num);
-	buffer_put_int(&encrypted, 0);	/* For future extension */
-
-	/* Store public key.  This will be in plain text. */
-	buffer_put_int(&encrypted, BN_num_bits(key->rsa->n));
-	buffer_put_bignum(&encrypted, key->rsa->n);
-	buffer_put_bignum(&encrypted, key->rsa->e);
-	buffer_put_cstring(&encrypted, comment);
-
-	/* Allocate space for the private part of the key in the buffer. */
-	cp = buffer_append_space(&encrypted, buffer_len(&buffer));
-
-	cipher_set_key_string(&ciphercontext, cipher, passphrase,
-	    CIPHER_ENCRYPT);
-	cipher_crypt(&ciphercontext, cp,
-	    buffer_ptr(&buffer), buffer_len(&buffer));
-	cipher_cleanup(&ciphercontext);
-	memset(&ciphercontext, 0, sizeof(ciphercontext));
-
-	/* Destroy temporary data. */
-	memset(buf, 0, sizeof(buf));
-	buffer_free(&buffer);
-
-	fd = open(filename, O_WRONLY | O_CREAT | O_TRUNC, 0600);
-	if (fd < 0) {
-		error("open %s failed: %s.", filename, strerror(errno));
-		return 0;
-	}
-	if (write(fd, buffer_ptr(&encrypted), buffer_len(&encrypted)) !=
-	    buffer_len(&encrypted)) {
-		error("write to key file %s failed: %s", filename,
-		    strerror(errno));
-		buffer_free(&encrypted);
-		close(fd);
-		unlink(filename);
-		return 0;
-	}
-	close(fd);
-	buffer_free(&encrypted);
-	return 1;
-}
-
-/* save SSH v2 key in OpenSSL PEM format */
-static int
-key_save_private_pem(Key *key, const char *filename, const char *_passphrase,
-    const char *comment)
-{
-	FILE *fp;
-	int fd;
-	int success = 0;
-	int len = strlen(_passphrase);
-	u_char *passphrase = (len > 0) ? (u_char *)_passphrase : NULL;
-	const EVP_CIPHER *cipher = (len > 0) ? EVP_des_ede3_cbc() : NULL;
-
-	if (len > 0 && len <= 4) {
-		error("passphrase too short: have %d bytes, need > 4", len);
-		return 0;
-	}
-	fd = open(filename, O_WRONLY | O_CREAT | O_TRUNC, 0600);
-	if (fd < 0) {
-		error("open %s failed: %s.", filename, strerror(errno));
-		return 0;
-	}
-	fp = fdopen(fd, "w");
-	if (fp == NULL ) {
-		error("fdopen %s failed: %s.", filename, strerror(errno));
-		close(fd);
-		return 0;
-	}
-	switch (key->type) {
-	case KEY_DSA:
-		success = PEM_write_DSAPrivateKey(fp, key->dsa,
-		    cipher, passphrase, len, NULL, NULL);
-		break;
-	case KEY_RSA:
-		success = PEM_write_RSAPrivateKey(fp, key->rsa,
-		    cipher, passphrase, len, NULL, NULL);
-		break;
-	}
-	fclose(fp);
-	return success;
-}
-
-int
-key_save_private(Key *key, const char *filename, const char *passphrase,
-    const char *comment)
-{
-	switch (key->type) {
-	case KEY_RSA1:
-		return key_save_private_rsa1(key, filename, passphrase,
-		    comment);
-		break;
-	case KEY_DSA:
-	case KEY_RSA:
-		return key_save_private_pem(key, filename, passphrase,
-		    comment);
-		break;
-	default:
-		break;
-	}
-	error("key_save_private: cannot save key type %d", key->type);
-	return 0;
-}
-
-/*
- * Loads the public part of the ssh v1 key file.  Returns NULL if an error was
- * encountered (the file does not exist or is not readable), and the key
- * otherwise.
- */
-
-static Key *
-key_load_public_rsa1(int fd, const char *filename, char **commentp)
-{
-	Buffer buffer;
-	Key *pub;
-	struct stat st;
-	char *cp;
-	int i;
-	off_t len;
-
-	if (fstat(fd, &st) < 0) {
-		error("fstat for key file %.200s failed: %.100s",
-		    filename, strerror(errno));
-		return NULL;
-	}
-	len = st.st_size;
-
-	buffer_init(&buffer);
-	cp = buffer_append_space(&buffer, len);
-
-	if (read(fd, cp, (size_t) len) != (size_t) len) {
-		debug("Read from key file %.200s failed: %.100s", filename,
-		    strerror(errno));
-		buffer_free(&buffer);
-		return NULL;
-	}
-
-	/* Check that it is at least big enough to contain the ID string. */
-	if (len < sizeof(authfile_id_string)) {
-		debug3("Not a RSA1 key file %.200s.", filename);
-		buffer_free(&buffer);
-		return NULL;
-	}
-	/*
-	 * Make sure it begins with the id string.  Consume the id string
-	 * from the buffer.
-	 */
-	for (i = 0; i < sizeof(authfile_id_string); i++)
-		if (buffer_get_char(&buffer) != authfile_id_string[i]) {
-			debug3("Not a RSA1 key file %.200s.", filename);
-			buffer_free(&buffer);
-			return NULL;
-		}
-	/* Skip cipher type and reserved data. */
-	(void) buffer_get_char(&buffer);	/* cipher type */
-	(void) buffer_get_int(&buffer);		/* reserved */
-
-	/* Read the public key from the buffer. */
-	(void) buffer_get_int(&buffer);
-	pub = key_new(KEY_RSA1);
-	buffer_get_bignum(&buffer, pub->rsa->n);
-	buffer_get_bignum(&buffer, pub->rsa->e);
-	if (commentp)
-		*commentp = buffer_get_string(&buffer, NULL);
-	/* The encrypted private part is not parsed by this function. */
-
-	buffer_free(&buffer);
-	return pub;
-}
-
-/* load public key from private-key file, works only for SSH v1 */
-Key *
-key_load_public_type(int type, const char *filename, char **commentp)
-{
-	Key *pub;
-	int fd;
-
-	if (type == KEY_RSA1) {
-		fd = open(filename, O_RDONLY);
-		if (fd < 0)
-			return NULL;
-		pub = key_load_public_rsa1(fd, filename, commentp);
-		close(fd);
-		return pub;
-	}
-	return NULL;
-}
-
-/*
- * Loads the private key from the file.  Returns 0 if an error is encountered
- * (file does not exist or is not readable, or passphrase is bad). This
- * initializes the private key.
- * Assumes we are called under uid of the owner of the file.
- */
-
-static Key *
-key_load_private_rsa1(int fd, const char *filename, const char *passphrase,
-    char **commentp)
-{
-	int i, check1, check2, cipher_type;
-	off_t len;
-	Buffer buffer, decrypted;
-	u_char *cp;
-	CipherContext ciphercontext;
-	Cipher *cipher;
-	Key *prv = NULL;
-	struct stat st;
-
-	if (fstat(fd, &st) < 0) {
-		error("fstat for key file %.200s failed: %.100s",
-		    filename, strerror(errno));
-		close(fd);
-		return NULL;
-	}
-	len = st.st_size;
-
-	buffer_init(&buffer);
-	cp = buffer_append_space(&buffer, len);
-
-	if (read(fd, cp, (size_t) len) != (size_t) len) {
-		debug("Read from key file %.200s failed: %.100s", filename,
-		    strerror(errno));
-		buffer_free(&buffer);
-		close(fd);
-		return NULL;
-	}
-
-	/* Check that it is at least big enough to contain the ID string. */
-	if (len < sizeof(authfile_id_string)) {
-		debug3("Not a RSA1 key file %.200s.", filename);
-		buffer_free(&buffer);
-		close(fd);
-		return NULL;
-	}
-	/*
-	 * Make sure it begins with the id string.  Consume the id string
-	 * from the buffer.
-	 */
-	for (i = 0; i < sizeof(authfile_id_string); i++)
-		if (buffer_get_char(&buffer) != authfile_id_string[i]) {
-			debug3("Not a RSA1 key file %.200s.", filename);
-			buffer_free(&buffer);
-			close(fd);
-			return NULL;
-		}
-
-	/* Read cipher type. */
-	cipher_type = buffer_get_char(&buffer);
-	(void) buffer_get_int(&buffer);	/* Reserved data. */
-
-	/* Read the public key from the buffer. */
-	(void) buffer_get_int(&buffer);
-	prv = key_new_private(KEY_RSA1);
-
-	buffer_get_bignum(&buffer, prv->rsa->n);
-	buffer_get_bignum(&buffer, prv->rsa->e);
-	if (commentp)
-		*commentp = buffer_get_string(&buffer, NULL);
-	else
-		xfree(buffer_get_string(&buffer, NULL));
-
-	/* Check that it is a supported cipher. */
-	cipher = cipher_by_number(cipher_type);
-	if (cipher == NULL) {
-		debug("Unsupported cipher %d used in key file %.200s.",
-		    cipher_type, filename);
-		buffer_free(&buffer);
-		goto fail;
-	}
-	/* Initialize space for decrypted data. */
-	buffer_init(&decrypted);
-	cp = buffer_append_space(&decrypted, buffer_len(&buffer));
-
-	/* Rest of the buffer is encrypted.  Decrypt it using the passphrase. */
-	cipher_set_key_string(&ciphercontext, cipher, passphrase,
-	    CIPHER_DECRYPT);
-	cipher_crypt(&ciphercontext, cp,
-	    buffer_ptr(&buffer), buffer_len(&buffer));
-	cipher_cleanup(&ciphercontext);
-	memset(&ciphercontext, 0, sizeof(ciphercontext));
-	buffer_free(&buffer);
-
-	check1 = buffer_get_char(&decrypted);
-	check2 = buffer_get_char(&decrypted);
-	if (check1 != buffer_get_char(&decrypted) ||
-	    check2 != buffer_get_char(&decrypted)) {
-		if (strcmp(passphrase, "") != 0)
-			debug("Bad passphrase supplied for key file %.200s.",
-			    filename);
-		/* Bad passphrase. */
-		buffer_free(&decrypted);
-		goto fail;
-	}
-	/* Read the rest of the private key. */
-	buffer_get_bignum(&decrypted, prv->rsa->d);
-	buffer_get_bignum(&decrypted, prv->rsa->iqmp);		/* u */
-	/* in SSL and SSH v1 p and q are exchanged */
-	buffer_get_bignum(&decrypted, prv->rsa->q);		/* p */
-	buffer_get_bignum(&decrypted, prv->rsa->p);		/* q */
-
-	/* calculate p-1 and q-1 */
-	rsa_generate_additional_parameters(prv->rsa);
-
-	buffer_free(&decrypted);
-
-	/* enable blinding */
-	if (RSA_blinding_on(prv->rsa, NULL) != 1) {
-		error("key_load_private_rsa1: RSA_blinding_on failed");
-		goto fail;
-	}
-	close(fd);
-	return prv;
-
-fail:
-	if (commentp)
-		xfree(*commentp);
-	close(fd);
-	key_free(prv);
-	return NULL;
-}
-
-Key *
-key_load_private_pem(int fd, int type, const char *passphrase,
-    char **commentp)
-{
-	FILE *fp;
-	EVP_PKEY *pk = NULL;
-	Key *prv = NULL;
-	char *name = "<no key>";
-
-	fp = fdopen(fd, "r");
-	if (fp == NULL) {
-		error("fdopen failed: %s", strerror(errno));
-		close(fd);
-		return NULL;
-	}
-	pk = PEM_read_PrivateKey(fp, NULL, NULL, (char *)passphrase);
-	if (pk == NULL) {
-		debug("PEM_read_PrivateKey failed");
-		(void)ERR_get_error();
-	} else if (pk->type == EVP_PKEY_RSA &&
-	    (type == KEY_UNSPEC||type==KEY_RSA)) {
-		prv = key_new(KEY_UNSPEC);
-		prv->rsa = EVP_PKEY_get1_RSA(pk);
-		prv->type = KEY_RSA;
-		name = "rsa w/o comment";
-#ifdef DEBUG_PK
-		RSA_print_fp(stderr, prv->rsa, 8);
-#endif
-		if (RSA_blinding_on(prv->rsa, NULL) != 1) {
-			error("key_load_private_pem: RSA_blinding_on failed");
-			key_free(prv);
-			prv = NULL;
-		}
-	} else if (pk->type == EVP_PKEY_DSA &&
-	    (type == KEY_UNSPEC||type==KEY_DSA)) {
-		prv = key_new(KEY_UNSPEC);
-		prv->dsa = EVP_PKEY_get1_DSA(pk);
-		prv->type = KEY_DSA;
-		name = "dsa w/o comment";
-#ifdef DEBUG_PK
-		DSA_print_fp(stderr, prv->dsa, 8);
-#endif
-	} else {
-		error("PEM_read_PrivateKey: mismatch or "
-		    "unknown EVP_PKEY save_type %d", pk->save_type);
-	}
-	fclose(fp);
-	if (pk != NULL)
-		EVP_PKEY_free(pk);
-	if (prv != NULL && commentp)
-		*commentp = xstrdup(name);
-	debug("read PEM private key done: type %s",
-	    prv ? key_type(prv) : "<unknown>");
-	return prv;
-}
-
-static int
-key_perm_ok(int fd, const char *filename)
-{
-	struct stat st;
-
-	if (fstat(fd, &st) < 0)
-		return 0;
-	/*
-	 * if a key owned by the user is accessed, then we check the
-	 * permissions of the file. if the key owned by a different user,
-	 * then we don't care.
-	 */
-#ifdef HAVE_CYGWIN
-	if (check_ntsec(filename))
-#endif
-	if ((st.st_uid == getuid()) && (st.st_mode & 077) != 0) {
-		error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
-		error("@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @");
-		error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
-		error("Permissions 0%3.3o for '%s' are too open.",
-		    st.st_mode & 0777, filename);
-		error("It is recommended that your private key files are NOT accessible by others.");
-		error("This private key will be ignored.");
-		return 0;
-	}
-	return 1;
-}
-
-Key *
-key_load_private_type(int type, const char *filename, const char *passphrase,
-    char **commentp)
-{
-	int fd;
-
-	fd = open(filename, O_RDONLY);
-	if (fd < 0)
-		return NULL;
-	if (!key_perm_ok(fd, filename)) {
-		error("bad permissions: ignore key: %s", filename);
-		close(fd);
-		return NULL;
-	}
-	switch (type) {
-	case KEY_RSA1:
-		return key_load_private_rsa1(fd, filename, passphrase,
-		    commentp);
-		/* closes fd */
-		break;
-	case KEY_DSA:
-	case KEY_RSA:
-	case KEY_UNSPEC:
-		return key_load_private_pem(fd, type, passphrase, commentp);
-		/* closes fd */
-		break;
-	default:
-		close(fd);
-		break;
-	}
-	return NULL;
-}
-
-Key *
-key_load_private(const char *filename, const char *passphrase,
-    char **commentp)
-{
-	Key *pub, *prv;
-	int fd;
-
-	fd = open(filename, O_RDONLY);
-	if (fd < 0)
-		return NULL;
-	if (!key_perm_ok(fd, filename)) {
-		error("bad permissions: ignore key: %s", filename);
-		close(fd);
-		return NULL;
-	}
-	pub = key_load_public_rsa1(fd, filename, commentp);
-	lseek(fd, (off_t) 0, SEEK_SET);		/* rewind */
-	if (pub == NULL) {
-		/* closes fd */
-		prv = key_load_private_pem(fd, KEY_UNSPEC, passphrase, NULL);
-		/* use the filename as a comment for PEM */
-		if (commentp && prv)
-			*commentp = xstrdup(filename);
-	} else {
-		/* it's a SSH v1 key if the public key part is readable */
-		key_free(pub);
-		/* closes fd */
-		prv = key_load_private_rsa1(fd, filename, passphrase, NULL);
-	}
-	return prv;
-}
-
-static int
-key_try_load_public(Key *k, const char *filename, char **commentp)
-{
-	FILE *f;
-	char line[4096];
-	char *cp;
-
-	f = fopen(filename, "r");
-	if (f != NULL) {
-		while (fgets(line, sizeof(line), f)) {
-			line[sizeof(line)-1] = '\0';
-			cp = line;
-			switch (*cp) {
-			case '#':
-			case '\n':
-			case '\0':
-				continue;
-			}
-			/* Skip leading whitespace. */
-			for (; *cp && (*cp == ' ' || *cp == '\t'); cp++)
-				;
-			if (*cp) {
-				if (key_read(k, &cp) == 1) {
-					if (commentp)
-						*commentp=xstrdup(filename);
-					fclose(f);
-					return 1;
-				}
-			}
-		}
-		fclose(f);
-	}
-	return 0;
-}
-
-/* load public key from ssh v1 private or any pubkey file */
-Key *
-key_load_public(const char *filename, char **commentp)
-{
-	Key *pub;
-	char file[MAXPATHLEN];
-
-	pub = key_load_public_type(KEY_RSA1, filename, commentp);
-	if (pub != NULL)
-		return pub;
-	pub = key_new(KEY_UNSPEC);
-	if (key_try_load_public(pub, filename, commentp) == 1)
-		return pub;
-	if ((strlcpy(file, filename, sizeof file) < sizeof(file)) &&
-	    (strlcat(file, ".pub", sizeof file) < sizeof(file)) &&
-	    (key_try_load_public(pub, file, commentp) == 1))
-		return pub;
-	key_free(pub);
-	return NULL;
-}
diff --git a/crypto/openssh/authfile.h b/crypto/openssh/authfile.h
deleted file mode 100644
index 7f92701ec055..000000000000
--- a/crypto/openssh/authfile.h
+++ /dev/null
@@ -1,25 +0,0 @@
-/*	$OpenBSD: authfile.h,v 1.10 2002/05/23 19:24:30 markus Exp $	*/
-
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#ifndef AUTHFILE_H
-#define AUTHFILE_H
-
-int	 key_save_private(Key *, const char *, const char *, const char *);
-Key	*key_load_public(const char *, char **);
-Key	*key_load_public_type(int, const char *, char **);
-Key	*key_load_private(const char *, const char *, char **);
-Key	*key_load_private_type(int, const char *, const char *, char **);
-Key	*key_load_private_pem(int, int, const char *, char **);
-
-#endif
diff --git a/crypto/openssh/aux.c b/crypto/openssh/aux.c
deleted file mode 100644
index 899142da7167..000000000000
--- a/crypto/openssh/aux.c
+++ /dev/null
@@ -1,36 +0,0 @@
-#include "includes.h"
-RCSID("$OpenBSD: aux.c,v 1.2 2000/05/17 09:47:59 markus Exp $");
-
-#include "ssh.h"
-
-char *
-chop(char *s)
-{
-	char *t = s;
-	while (*t) {
-		if(*t == '\n' || *t == '\r') {
-			*t = '\0';
-			return s;
-		}
-		t++;
-	}
-	return s;
-
-}
-
-void
-set_nonblock(int fd)
-{
-	int val;
-	val = fcntl(fd, F_GETFL, 0);
-	if (val < 0) {
-		error("fcntl(%d, F_GETFL, 0): %s", fd, strerror(errno));
-		return;
-	}
-	if (val & O_NONBLOCK)
-		return;
-	debug("fd %d setting O_NONBLOCK", fd);
-	val |= O_NONBLOCK;
-	if (fcntl(fd, F_SETFL, val) == -1)
-		error("fcntl(%d, F_SETFL, O_NONBLOCK): %s", fd, strerror(errno));
-}
diff --git a/crypto/openssh/bufaux.c b/crypto/openssh/bufaux.c
deleted file mode 100644
index 3c276b8105d3..000000000000
--- a/crypto/openssh/bufaux.c
+++ /dev/null
@@ -1,279 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * Auxiliary functions for storing and retrieving various data types to/from
- * Buffers.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- *
- *
- * SSH2 packet format added by Markus Friedl
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: bufaux.c,v 1.28 2002/10/23 10:40:16 markus Exp $");
-
-#include <openssl/bn.h>
-#include "bufaux.h"
-#include "xmalloc.h"
-#include "getput.h"
-#include "log.h"
-
-/*
- * Stores an BIGNUM in the buffer with a 2-byte msb first bit count, followed
- * by (bits+7)/8 bytes of binary data, msb first.
- */
-void
-buffer_put_bignum(Buffer *buffer, BIGNUM *value)
-{
-	int bits = BN_num_bits(value);
-	int bin_size = (bits + 7) / 8;
-	u_char *buf = xmalloc(bin_size);
-	int oi;
-	char msg[2];
-
-	/* Get the value of in binary */
-	oi = BN_bn2bin(value, buf);
-	if (oi != bin_size)
-		fatal("buffer_put_bignum: BN_bn2bin() failed: oi %d != bin_size %d",
-		    oi, bin_size);
-
-	/* Store the number of bits in the buffer in two bytes, msb first. */
-	PUT_16BIT(msg, bits);
-	buffer_append(buffer, msg, 2);
-	/* Store the binary data. */
-	buffer_append(buffer, (char *)buf, oi);
-
-	memset(buf, 0, bin_size);
-	xfree(buf);
-}
-
-/*
- * Retrieves an BIGNUM from the buffer.
- */
-void
-buffer_get_bignum(Buffer *buffer, BIGNUM *value)
-{
-	int bits, bytes;
-	u_char buf[2], *bin;
-
-	/* Get the number for bits. */
-	buffer_get(buffer, (char *) buf, 2);
-	bits = GET_16BIT(buf);
-	/* Compute the number of binary bytes that follow. */
-	bytes = (bits + 7) / 8;
-	if (bytes > 8 * 1024)
-		fatal("buffer_get_bignum: cannot handle BN of size %d", bytes);
-	if (buffer_len(buffer) < bytes)
-		fatal("buffer_get_bignum: input buffer too small");
-	bin = buffer_ptr(buffer);
-	BN_bin2bn(bin, bytes, value);
-	buffer_consume(buffer, bytes);
-}
-
-/*
- * Stores an BIGNUM in the buffer in SSH2 format.
- */
-void
-buffer_put_bignum2(Buffer *buffer, BIGNUM *value)
-{
-	int bytes = BN_num_bytes(value) + 1;
-	u_char *buf = xmalloc(bytes);
-	int oi;
-	int hasnohigh = 0;
-
-	buf[0] = '\0';
-	/* Get the value of in binary */
-	oi = BN_bn2bin(value, buf+1);
-	if (oi != bytes-1)
-		fatal("buffer_put_bignum: BN_bn2bin() failed: oi %d != bin_size %d",
-		    oi, bytes);
-	hasnohigh = (buf[1] & 0x80) ? 0 : 1;
-	if (value->neg) {
-		/**XXX should be two's-complement */
-		int i, carry;
-		u_char *uc = buf;
-		log("negativ!");
-		for (i = bytes-1, carry = 1; i>=0; i--) {
-			uc[i] ^= 0xff;
-			if (carry)
-				carry = !++uc[i];
-		}
-	}
-	buffer_put_string(buffer, buf+hasnohigh, bytes-hasnohigh);
-	memset(buf, 0, bytes);
-	xfree(buf);
-}
-
-/* XXX does not handle negative BNs */
-void
-buffer_get_bignum2(Buffer *buffer, BIGNUM *value)
-{
-	u_int len;
-	u_char *bin = buffer_get_string(buffer, &len);
-
-	if (len > 8 * 1024)
-		fatal("buffer_get_bignum2: cannot handle BN of size %d", len);
-	BN_bin2bn(bin, len, value);
-	xfree(bin);
-}
-/*
- * Returns integers from the buffer (msb first).
- */
-
-u_short
-buffer_get_short(Buffer *buffer)
-{
-	u_char buf[2];
-
-	buffer_get(buffer, (char *) buf, 2);
-	return GET_16BIT(buf);
-}
-
-u_int
-buffer_get_int(Buffer *buffer)
-{
-	u_char buf[4];
-
-	buffer_get(buffer, (char *) buf, 4);
-	return GET_32BIT(buf);
-}
-
-#ifdef HAVE_U_INT64_T
-u_int64_t
-buffer_get_int64(Buffer *buffer)
-{
-	u_char buf[8];
-
-	buffer_get(buffer, (char *) buf, 8);
-	return GET_64BIT(buf);
-}
-#endif
-
-/*
- * Stores integers in the buffer, msb first.
- */
-void
-buffer_put_short(Buffer *buffer, u_short value)
-{
-	char buf[2];
-
-	PUT_16BIT(buf, value);
-	buffer_append(buffer, buf, 2);
-}
-
-void
-buffer_put_int(Buffer *buffer, u_int value)
-{
-	char buf[4];
-
-	PUT_32BIT(buf, value);
-	buffer_append(buffer, buf, 4);
-}
-
-#ifdef HAVE_U_INT64_T
-void
-buffer_put_int64(Buffer *buffer, u_int64_t value)
-{
-	char buf[8];
-
-	PUT_64BIT(buf, value);
-	buffer_append(buffer, buf, 8);
-}
-#endif
-
-/*
- * Returns an arbitrary binary string from the buffer.  The string cannot
- * be longer than 256k.  The returned value points to memory allocated
- * with xmalloc; it is the responsibility of the calling function to free
- * the data.  If length_ptr is non-NULL, the length of the returned data
- * will be stored there.  A null character will be automatically appended
- * to the returned string, and is not counted in length.
- */
-void *
-buffer_get_string(Buffer *buffer, u_int *length_ptr)
-{
-	u_char *value;
-	u_int len;
-
-	/* Get the length. */
-	len = buffer_get_int(buffer);
-	if (len > 256 * 1024)
-		fatal("buffer_get_string: bad string length %u", len);
-	/* Allocate space for the string.  Add one byte for a null character. */
-	value = xmalloc(len + 1);
-	/* Get the string. */
-	buffer_get(buffer, value, len);
-	/* Append a null character to make processing easier. */
-	value[len] = 0;
-	/* Optionally return the length of the string. */
-	if (length_ptr)
-		*length_ptr = len;
-	return value;
-}
-
-/*
- * Stores and arbitrary binary string in the buffer.
- */
-void
-buffer_put_string(Buffer *buffer, const void *buf, u_int len)
-{
-	buffer_put_int(buffer, len);
-	buffer_append(buffer, buf, len);
-}
-void
-buffer_put_cstring(Buffer *buffer, const char *s)
-{
-	if (s == NULL)
-		fatal("buffer_put_cstring: s == NULL");
-	buffer_put_string(buffer, s, strlen(s));
-}
-
-/*
- * Returns a character from the buffer (0 - 255).
- */
-int
-buffer_get_char(Buffer *buffer)
-{
-	char ch;
-
-	buffer_get(buffer, &ch, 1);
-	return (u_char) ch;
-}
-
-/*
- * Stores a character in the buffer.
- */
-void
-buffer_put_char(Buffer *buffer, int value)
-{
-	char ch = value;
-
-	buffer_append(buffer, &ch, 1);
-}
diff --git a/crypto/openssh/bufaux.h b/crypto/openssh/bufaux.h
deleted file mode 100644
index 80f35c1ecfa4..000000000000
--- a/crypto/openssh/bufaux.h
+++ /dev/null
@@ -1,47 +0,0 @@
-/*	$OpenBSD: bufaux.h,v 1.18 2002/04/20 09:14:58 markus Exp $	*/
-
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#ifndef BUFAUX_H
-#define BUFAUX_H
-
-#include "buffer.h"
-#include <openssl/bn.h>
-
-void    buffer_put_bignum(Buffer *, BIGNUM *);
-void    buffer_put_bignum2(Buffer *, BIGNUM *);
-void	buffer_get_bignum(Buffer *, BIGNUM *);
-void	buffer_get_bignum2(Buffer *, BIGNUM *);
-
-u_short	buffer_get_short(Buffer *);
-void	buffer_put_short(Buffer *, u_short);
-
-u_int	buffer_get_int(Buffer *);
-void    buffer_put_int(Buffer *, u_int);
-
-#ifdef HAVE_U_INT64_T
-u_int64_t buffer_get_int64(Buffer *);
-void	buffer_put_int64(Buffer *, u_int64_t);
-#endif
-
-int     buffer_get_char(Buffer *);
-void    buffer_put_char(Buffer *, int);
-
-void   *buffer_get_string(Buffer *, u_int *);
-void    buffer_put_string(Buffer *, const void *, u_int);
-void	buffer_put_cstring(Buffer *, const char *);
-
-#define buffer_skip_string(b) \
-    do { u_int l = buffer_get_int(b); buffer_consume(b, l); } while(0)
-
-#endif				/* BUFAUX_H */
diff --git a/crypto/openssh/buffer.h b/crypto/openssh/buffer.h
deleted file mode 100644
index 5e4c41244230..000000000000
--- a/crypto/openssh/buffer.h
+++ /dev/null
@@ -1,43 +0,0 @@
-/*	$OpenBSD: buffer.h,v 1.11 2002/03/04 17:27:39 stevesk Exp $	*/
-
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * Code for manipulating FIFO buffers.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#ifndef BUFFER_H
-#define BUFFER_H
-
-typedef struct {
-	u_char	*buf;		/* Buffer for data. */
-	u_int	 alloc;		/* Number of bytes allocated for data. */
-	u_int	 offset;	/* Offset of first byte containing data. */
-	u_int	 end;		/* Offset of last byte containing data. */
-}       Buffer;
-
-void	 buffer_init(Buffer *);
-void	 buffer_clear(Buffer *);
-void	 buffer_free(Buffer *);
-
-u_int	 buffer_len(Buffer *);
-void	*buffer_ptr(Buffer *);
-
-void	 buffer_append(Buffer *, const void *, u_int);
-void	*buffer_append_space(Buffer *, u_int);
-
-void	 buffer_get(Buffer *, void *, u_int);
-
-void	 buffer_consume(Buffer *, u_int);
-void	 buffer_consume_end(Buffer *, u_int);
-
-void     buffer_dump(Buffer *);
-
-#endif				/* BUFFER_H */
diff --git a/crypto/openssh/canohost.c b/crypto/openssh/canohost.c
deleted file mode 100644
index 941db23b64bf..000000000000
--- a/crypto/openssh/canohost.c
+++ /dev/null
@@ -1,374 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * Functions for returning the canonical host name of the remote site.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: canohost.c,v 1.35 2002/11/26 02:38:54 stevesk Exp $");
-
-#include "packet.h"
-#include "xmalloc.h"
-#include "log.h"
-#include "canohost.h"
-
-static void check_ip_options(int, char *);
-
-/*
- * Return the canonical name of the host at the other end of the socket. The
- * caller should free the returned string with xfree.
- */
-
-static char *
-get_remote_hostname(int socket, int verify_reverse_mapping)
-{
-	struct sockaddr_storage from;
-	int i;
-	socklen_t fromlen;
-	struct addrinfo hints, *ai, *aitop;
-	char name[NI_MAXHOST], ntop[NI_MAXHOST], ntop2[NI_MAXHOST];
-
-	/* Get IP address of client. */
-	fromlen = sizeof(from);
-	memset(&from, 0, sizeof(from));
-	if (getpeername(socket, (struct sockaddr *)&from, &fromlen) < 0) {
-		debug("getpeername failed: %.100s", strerror(errno));
-		fatal_cleanup();
-	}
-#ifdef IPV4_IN_IPV6
-	if (from.ss_family == AF_INET6) {
-		struct sockaddr_in6 *from6 = (struct sockaddr_in6 *)&from;
-
-		/* Detect IPv4 in IPv6 mapped address and convert it to */
-		/* plain (AF_INET) IPv4 address */
-		if (IN6_IS_ADDR_V4MAPPED(&from6->sin6_addr)) {
-			struct sockaddr_in *from4 = (struct sockaddr_in *)&from;
-			struct in_addr addr;
-			u_int16_t port;
-
-			memcpy(&addr, ((char *)&from6->sin6_addr) + 12, sizeof(addr));
-			port = from6->sin6_port;
-
-			memset(&from, 0, sizeof(from));
-
-			from4->sin_family = AF_INET;
-			fromlen = sizeof(*from4);
-			memcpy(&from4->sin_addr, &addr, sizeof(addr));
-			from4->sin_port = port;
-		}
-	}
-#endif
-	if (from.ss_family == AF_INET6)
-		fromlen = sizeof(struct sockaddr_in6);
-
-	if (getnameinfo((struct sockaddr *)&from, fromlen, ntop, sizeof(ntop),
-	    NULL, 0, NI_NUMERICHOST) != 0)
-		fatal("get_remote_hostname: getnameinfo NI_NUMERICHOST failed");
-
-	if (from.ss_family == AF_INET)
-		check_ip_options(socket, ntop);
-
-	debug3("Trying to reverse map address %.100s.", ntop);
-	/* Map the IP address to a host name. */
-	if (getnameinfo((struct sockaddr *)&from, fromlen, name, sizeof(name),
-	    NULL, 0, NI_NAMEREQD) != 0) {
-		/* Host name not found.  Use ip address. */
-#if 0
-		log("Could not reverse map address %.100s.", ntop);
-#endif
-		return xstrdup(ntop);
-	}
-
-	/* Got host name. */
-	name[sizeof(name) - 1] = '\0';
-	/*
-	 * Convert it to all lowercase (which is expected by the rest
-	 * of this software).
-	 */
-	for (i = 0; name[i]; i++)
-		if (isupper(name[i]))
-			name[i] = tolower(name[i]);
-
-	if (!verify_reverse_mapping)
-		return xstrdup(name);
-	/*
-	 * Map it back to an IP address and check that the given
-	 * address actually is an address of this host.  This is
-	 * necessary because anyone with access to a name server can
-	 * define arbitrary names for an IP address. Mapping from
-	 * name to IP address can be trusted better (but can still be
-	 * fooled if the intruder has access to the name server of
-	 * the domain).
-	 */
-	memset(&hints, 0, sizeof(hints));
-	hints.ai_family = from.ss_family;
-	hints.ai_socktype = SOCK_STREAM;
-	if (getaddrinfo(name, NULL, &hints, &aitop) != 0) {
-		log("reverse mapping checking getaddrinfo for %.700s "
-		    "failed - POSSIBLE BREAKIN ATTEMPT!", name);
-		return xstrdup(ntop);
-	}
-	/* Look for the address from the list of addresses. */
-	for (ai = aitop; ai; ai = ai->ai_next) {
-		if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop2,
-		    sizeof(ntop2), NULL, 0, NI_NUMERICHOST) == 0 &&
-		    (strcmp(ntop, ntop2) == 0))
-				break;
-	}
-	freeaddrinfo(aitop);
-	/* If we reached the end of the list, the address was not there. */
-	if (!ai) {
-		/* Address not found for the host name. */
-		log("Address %.100s maps to %.600s, but this does not "
-		    "map back to the address - POSSIBLE BREAKIN ATTEMPT!",
-		    ntop, name);
-		return xstrdup(ntop);
-	}
-	return xstrdup(name);
-}
-
-/*
- * If IP options are supported, make sure there are none (log and
- * disconnect them if any are found).  Basically we are worried about
- * source routing; it can be used to pretend you are somebody
- * (ip-address) you are not. That itself may be "almost acceptable"
- * under certain circumstances, but rhosts autentication is useless
- * if source routing is accepted. Notice also that if we just dropped
- * source routing here, the other side could use IP spoofing to do
- * rest of the interaction and could still bypass security.  So we
- * exit here if we detect any IP options.
- */
-/* IPv4 only */
-static void
-check_ip_options(int socket, char *ipaddr)
-{
-	u_char options[200];
-	char text[sizeof(options) * 3 + 1];
-	socklen_t option_size;
-	int i, ipproto;
-	struct protoent *ip;
-
-	if ((ip = getprotobyname("ip")) != NULL)
-		ipproto = ip->p_proto;
-	else
-		ipproto = IPPROTO_IP;
-	option_size = sizeof(options);
-	if (getsockopt(socket, ipproto, IP_OPTIONS, options,
-	    &option_size) >= 0 && option_size != 0) {
-		text[0] = '\0';
-		for (i = 0; i < option_size; i++)
-			snprintf(text + i*3, sizeof(text) - i*3,
-			    " %2.2x", options[i]);
-		log("Connection from %.100s with IP options:%.800s",
-		    ipaddr, text);
-		packet_disconnect("Connection from %.100s with IP options:%.800s",
-		    ipaddr, text);
-	}
-}
-
-/*
- * Return the canonical name of the host in the other side of the current
- * connection.  The host name is cached, so it is efficient to call this
- * several times.
- */
-
-const char *
-get_canonical_hostname(int verify_reverse_mapping)
-{
-	static char *canonical_host_name = NULL;
-	static int verify_reverse_mapping_done = 0;
-
-	/* Check if we have previously retrieved name with same option. */
-	if (canonical_host_name != NULL) {
-		if (verify_reverse_mapping_done != verify_reverse_mapping)
-			xfree(canonical_host_name);
-		else
-			return canonical_host_name;
-	}
-
-	/* Get the real hostname if socket; otherwise return UNKNOWN. */
-	if (packet_connection_is_on_socket())
-		canonical_host_name = get_remote_hostname(
-		    packet_get_connection_in(), verify_reverse_mapping);
-	else
-		canonical_host_name = xstrdup("UNKNOWN");
-
-	verify_reverse_mapping_done = verify_reverse_mapping;
-	return canonical_host_name;
-}
-
-/*
- * Returns the local/remote IP-address/hostname of socket as a string.
- * The returned string must be freed.
- */
-static char *
-get_socket_address(int socket, int remote, int flags)
-{
-	struct sockaddr_storage addr;
-	socklen_t addrlen;
-	char ntop[NI_MAXHOST];
-
-	/* Get IP address of client. */
-	addrlen = sizeof(addr);
-	memset(&addr, 0, sizeof(addr));
-
-	if (remote) {
-		if (getpeername(socket, (struct sockaddr *)&addr, &addrlen)
-		    < 0)
-			return NULL;
-	} else {
-		if (getsockname(socket, (struct sockaddr *)&addr, &addrlen)
-		    < 0)
-			return NULL;
-	}
-
-	/* Work around Linux IPv6 weirdness */
-	if (addr.ss_family == AF_INET6)
-		addrlen = sizeof(struct sockaddr_in6);
-
-	/* Get the address in ascii. */
-	if (getnameinfo((struct sockaddr *)&addr, addrlen, ntop, sizeof(ntop),
-	    NULL, 0, flags) != 0) {
-		error("get_socket_address: getnameinfo %d failed", flags);
-		return NULL;
-	}
-	return xstrdup(ntop);
-}
-
-char *
-get_peer_ipaddr(int socket)
-{
-	char *p;
-
-	if ((p = get_socket_address(socket, 1, NI_NUMERICHOST)) != NULL)
-		return p;
-	return xstrdup("UNKNOWN");
-}
-
-char *
-get_local_ipaddr(int socket)
-{
-	char *p;
-
-	if ((p = get_socket_address(socket, 0, NI_NUMERICHOST)) != NULL)
-		return p;
-	return xstrdup("UNKNOWN");
-}
-
-char *
-get_local_name(int socket)
-{
-	return get_socket_address(socket, 0, NI_NAMEREQD);
-}
-
-/*
- * Returns the IP-address of the remote host as a string.  The returned
- * string must not be freed.
- */
-
-const char *
-get_remote_ipaddr(void)
-{
-	static char *canonical_host_ip = NULL;
-
-	/* Check whether we have cached the ipaddr. */
-	if (canonical_host_ip == NULL) {
-		if (packet_connection_is_on_socket()) {
-			canonical_host_ip =
-			    get_peer_ipaddr(packet_get_connection_in());
-			if (canonical_host_ip == NULL)
-				fatal_cleanup();
-		} else {
-			/* If not on socket, return UNKNOWN. */
-			canonical_host_ip = xstrdup("UNKNOWN");
-		}
-	}
-	return canonical_host_ip;
-}
-
-const char *
-get_remote_name_or_ip(u_int utmp_len, int verify_reverse_mapping)
-{
-	static const char *remote = "";
-	if (utmp_len > 0)
-		remote = get_canonical_hostname(verify_reverse_mapping);
-	if (utmp_len == 0 || strlen(remote) > utmp_len)
-		remote = get_remote_ipaddr();
-	return remote;
-}
-
-/* Returns the local/remote port for the socket. */
-
-static int
-get_sock_port(int sock, int local)
-{
-	struct sockaddr_storage from;
-	socklen_t fromlen;
-	char strport[NI_MAXSERV];
-
-	/* Get IP address of client. */
-	fromlen = sizeof(from);
-	memset(&from, 0, sizeof(from));
-	if (local) {
-		if (getsockname(sock, (struct sockaddr *)&from, &fromlen) < 0) {
-			error("getsockname failed: %.100s", strerror(errno));
-			return 0;
-		}
-	} else {
-		if (getpeername(sock, (struct sockaddr *)&from, &fromlen) < 0) {
-			debug("getpeername failed: %.100s", strerror(errno));
-			fatal_cleanup();
-		}
-	}
-
-	/* Work around Linux IPv6 weirdness */
-	if (from.ss_family == AF_INET6)
-		fromlen = sizeof(struct sockaddr_in6);
-
-	/* Return port number. */
-	if (getnameinfo((struct sockaddr *)&from, fromlen, NULL, 0,
-	    strport, sizeof(strport), NI_NUMERICSERV) != 0)
-		fatal("get_sock_port: getnameinfo NI_NUMERICSERV failed");
-	return atoi(strport);
-}
-
-/* Returns remote/local port number for the current connection. */
-
-static int
-get_port(int local)
-{
-	/*
-	 * If the connection is not a socket, return 65535.  This is
-	 * intentionally chosen to be an unprivileged port number.
-	 */
-	if (!packet_connection_is_on_socket())
-		return 65535;
-
-	/* Get socket and return the port number. */
-	return get_sock_port(packet_get_connection_in(), local);
-}
-
-int
-get_peer_port(int sock)
-{
-	return get_sock_port(sock, 0);
-}
-
-int
-get_remote_port(void)
-{
-	return get_port(0);
-}
-
-int
-get_local_port(void)
-{
-	return get_port(1);
-}
diff --git a/crypto/openssh/canohost.h b/crypto/openssh/canohost.h
deleted file mode 100644
index 4347b488a145..000000000000
--- a/crypto/openssh/canohost.h
+++ /dev/null
@@ -1,25 +0,0 @@
-/*	$OpenBSD: canohost.h,v 1.8 2001/06/26 17:27:23 markus Exp $	*/
-
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-const char	*get_canonical_hostname(int);
-const char	*get_remote_ipaddr(void);
-const char	*get_remote_name_or_ip(u_int, int);
-
-char		*get_peer_ipaddr(int);
-int		 get_peer_port(int);
-char		*get_local_ipaddr(int);
-char		*get_local_name(int);
-
-int		 get_remote_port(void);
-int		 get_local_port(void);
diff --git a/crypto/openssh/channels.c b/crypto/openssh/channels.c
deleted file mode 100644
index 1937b02446b5..000000000000
--- a/crypto/openssh/channels.c
+++ /dev/null
@@ -1,2771 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * This file contains functions for generic socket connection forwarding.
- * There is also code for initiating connection forwarding for X11 connections,
- * arbitrary tcp/ip connections, and the authentication agent connection.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- *
- * SSH2 support added by Markus Friedl.
- * Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl.  All rights reserved.
- * Copyright (c) 1999 Dug Song.  All rights reserved.
- * Copyright (c) 1999 Theo de Raadt.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: channels.c,v 1.187 2003/03/05 22:33:43 markus Exp $");
-
-#include "ssh.h"
-#include "ssh1.h"
-#include "ssh2.h"
-#include "packet.h"
-#include "xmalloc.h"
-#include "log.h"
-#include "misc.h"
-#include "channels.h"
-#include "compat.h"
-#include "canohost.h"
-#include "key.h"
-#include "authfd.h"
-#include "pathnames.h"
-
-
-/* -- channel core */
-
-/*
- * Pointer to an array containing all allocated channels.  The array is
- * dynamically extended as needed.
- */
-static Channel **channels = NULL;
-
-/*
- * Size of the channel array.  All slots of the array must always be
- * initialized (at least the type field); unused slots set to NULL
- */
-static int channels_alloc = 0;
-
-/*
- * Maximum file descriptor value used in any of the channels.  This is
- * updated in channel_new.
- */
-static int channel_max_fd = 0;
-
-
-/* -- tcp forwarding */
-
-/*
- * Data structure for storing which hosts are permitted for forward requests.
- * The local sides of any remote forwards are stored in this array to prevent
- * a corrupt remote server from accessing arbitrary TCP/IP ports on our local
- * network (which might be behind a firewall).
- */
-typedef struct {
-	char *host_to_connect;		/* Connect to 'host'. */
-	u_short port_to_connect;	/* Connect to 'port'. */
-	u_short listen_port;		/* Remote side should listen port number. */
-} ForwardPermission;
-
-/* List of all permitted host/port pairs to connect. */
-static ForwardPermission permitted_opens[SSH_MAX_FORWARDS_PER_DIRECTION];
-
-/* Number of permitted host/port pairs in the array. */
-static int num_permitted_opens = 0;
-/*
- * If this is true, all opens are permitted.  This is the case on the server
- * on which we have to trust the client anyway, and the user could do
- * anything after logging in anyway.
- */
-static int all_opens_permitted = 0;
-
-
-/* -- X11 forwarding */
-
-/* Maximum number of fake X11 displays to try. */
-#define MAX_DISPLAYS  1000
-
-/* Saved X11 authentication protocol name. */
-static char *x11_saved_proto = NULL;
-
-/* Saved X11 authentication data.  This is the real data. */
-static char *x11_saved_data = NULL;
-static u_int x11_saved_data_len = 0;
-
-/*
- * Fake X11 authentication data.  This is what the server will be sending us;
- * we should replace any occurrences of this by the real data.
- */
-static char *x11_fake_data = NULL;
-static u_int x11_fake_data_len;
-
-
-/* -- agent forwarding */
-
-#define	NUM_SOCKS	10
-
-/* AF_UNSPEC or AF_INET or AF_INET6 */
-static int IPv4or6 = AF_UNSPEC;
-
-/* helper */
-static void port_open_helper(Channel *c, char *rtype);
-
-/* -- channel core */
-
-Channel *
-channel_lookup(int id)
-{
-	Channel *c;
-
-	if (id < 0 || id >= channels_alloc) {
-		log("channel_lookup: %d: bad id", id);
-		return NULL;
-	}
-	c = channels[id];
-	if (c == NULL) {
-		log("channel_lookup: %d: bad id: channel free", id);
-		return NULL;
-	}
-	return c;
-}
-
-/*
- * Register filedescriptors for a channel, used when allocating a channel or
- * when the channel consumer/producer is ready, e.g. shell exec'd
- */
-
-static void
-channel_register_fds(Channel *c, int rfd, int wfd, int efd,
-    int extusage, int nonblock)
-{
-	/* Update the maximum file descriptor value. */
-	channel_max_fd = MAX(channel_max_fd, rfd);
-	channel_max_fd = MAX(channel_max_fd, wfd);
-	channel_max_fd = MAX(channel_max_fd, efd);
-
-	/* XXX set close-on-exec -markus */
-
-	c->rfd = rfd;
-	c->wfd = wfd;
-	c->sock = (rfd == wfd) ? rfd : -1;
-	c->efd = efd;
-	c->extended_usage = extusage;
-
-	/* XXX ugly hack: nonblock is only set by the server */
-	if (nonblock && isatty(c->rfd)) {
-		debug("channel %d: rfd %d isatty", c->self, c->rfd);
-		c->isatty = 1;
-		if (!isatty(c->wfd)) {
-			error("channel %d: wfd %d is not a tty?",
-			    c->self, c->wfd);
-		}
-	} else {
-		c->isatty = 0;
-	}
-	c->wfd_isatty = isatty(c->wfd);
-
-	/* enable nonblocking mode */
-	if (nonblock) {
-		if (rfd != -1)
-			set_nonblock(rfd);
-		if (wfd != -1)
-			set_nonblock(wfd);
-		if (efd != -1)
-			set_nonblock(efd);
-	}
-}
-
-/*
- * Allocate a new channel object and set its type and socket. This will cause
- * remote_name to be freed.
- */
-
-Channel *
-channel_new(char *ctype, int type, int rfd, int wfd, int efd,
-    u_int window, u_int maxpack, int extusage, char *remote_name, int nonblock)
-{
-	int i, found;
-	Channel *c;
-
-	/* Do initial allocation if this is the first call. */
-	if (channels_alloc == 0) {
-		channels_alloc = 10;
-		channels = xmalloc(channels_alloc * sizeof(Channel *));
-		for (i = 0; i < channels_alloc; i++)
-			channels[i] = NULL;
-		fatal_add_cleanup((void (*) (void *)) channel_free_all, NULL);
-	}
-	/* Try to find a free slot where to put the new channel. */
-	for (found = -1, i = 0; i < channels_alloc; i++)
-		if (channels[i] == NULL) {
-			/* Found a free slot. */
-			found = i;
-			break;
-		}
-	if (found == -1) {
-		/* There are no free slots.  Take last+1 slot and expand the array.  */
-		found = channels_alloc;
-		channels_alloc += 10;
-		if (channels_alloc > 10000)
-			fatal("channel_new: internal error: channels_alloc %d "
-			    "too big.", channels_alloc);
-		debug2("channel: expanding %d", channels_alloc);
-		channels = xrealloc(channels, channels_alloc * sizeof(Channel *));
-		for (i = found; i < channels_alloc; i++)
-			channels[i] = NULL;
-	}
-	/* Initialize and return new channel. */
-	c = channels[found] = xmalloc(sizeof(Channel));
-	memset(c, 0, sizeof(Channel));
-	buffer_init(&c->input);
-	buffer_init(&c->output);
-	buffer_init(&c->extended);
-	c->ostate = CHAN_OUTPUT_OPEN;
-	c->istate = CHAN_INPUT_OPEN;
-	c->flags = 0;
-	channel_register_fds(c, rfd, wfd, efd, extusage, nonblock);
-	c->self = found;
-	c->type = type;
-	c->ctype = ctype;
-	c->local_window = window;
-	c->local_window_max = window;
-	c->local_consumed = 0;
-	c->local_maxpacket = maxpack;
-	c->remote_id = -1;
-	c->remote_name = remote_name;
-	c->remote_window = 0;
-	c->remote_maxpacket = 0;
-	c->force_drain = 0;
-	c->single_connection = 0;
-	c->detach_user = NULL;
-	c->confirm = NULL;
-	c->input_filter = NULL;
-	debug("channel %d: new [%s]", found, remote_name);
-	return c;
-}
-
-static int
-channel_find_maxfd(void)
-{
-	int i, max = 0;
-	Channel *c;
-
-	for (i = 0; i < channels_alloc; i++) {
-		c = channels[i];
-		if (c != NULL) {
-			max = MAX(max, c->rfd);
-			max = MAX(max, c->wfd);
-			max = MAX(max, c->efd);
-		}
-	}
-	return max;
-}
-
-int
-channel_close_fd(int *fdp)
-{
-	int ret = 0, fd = *fdp;
-
-	if (fd != -1) {
-		ret = close(fd);
-		*fdp = -1;
-		if (fd == channel_max_fd)
-			channel_max_fd = channel_find_maxfd();
-	}
-	return ret;
-}
-
-/* Close all channel fd/socket. */
-
-static void
-channel_close_fds(Channel *c)
-{
-	debug3("channel_close_fds: channel %d: r %d w %d e %d",
-	    c->self, c->rfd, c->wfd, c->efd);
-
-	channel_close_fd(&c->sock);
-	channel_close_fd(&c->rfd);
-	channel_close_fd(&c->wfd);
-	channel_close_fd(&c->efd);
-}
-
-/* Free the channel and close its fd/socket. */
-
-void
-channel_free(Channel *c)
-{
-	char *s;
-	int i, n;
-
-	for (n = 0, i = 0; i < channels_alloc; i++)
-		if (channels[i])
-			n++;
-	debug("channel_free: channel %d: %s, nchannels %d", c->self,
-	    c->remote_name ? c->remote_name : "???", n);
-
-	s = channel_open_message();
-	debug3("channel_free: status: %s", s);
-	xfree(s);
-
-	if (c->sock != -1)
-		shutdown(c->sock, SHUT_RDWR);
-	channel_close_fds(c);
-	buffer_free(&c->input);
-	buffer_free(&c->output);
-	buffer_free(&c->extended);
-	if (c->remote_name) {
-		xfree(c->remote_name);
-		c->remote_name = NULL;
-	}
-	channels[c->self] = NULL;
-	xfree(c);
-}
-
-void
-channel_free_all(void)
-{
-	int i;
-
-	for (i = 0; i < channels_alloc; i++)
-		if (channels[i] != NULL)
-			channel_free(channels[i]);
-}
-
-/*
- * Closes the sockets/fds of all channels.  This is used to close extra file
- * descriptors after a fork.
- */
-
-void
-channel_close_all(void)
-{
-	int i;
-
-	for (i = 0; i < channels_alloc; i++)
-		if (channels[i] != NULL)
-			channel_close_fds(channels[i]);
-}
-
-/*
- * Stop listening to channels.
- */
-
-void
-channel_stop_listening(void)
-{
-	int i;
-	Channel *c;
-
-	for (i = 0; i < channels_alloc; i++) {
-		c = channels[i];
-		if (c != NULL) {
-			switch (c->type) {
-			case SSH_CHANNEL_AUTH_SOCKET:
-			case SSH_CHANNEL_PORT_LISTENER:
-			case SSH_CHANNEL_RPORT_LISTENER:
-			case SSH_CHANNEL_X11_LISTENER:
-				channel_close_fd(&c->sock);
-				channel_free(c);
-				break;
-			}
-		}
-	}
-}
-
-/*
- * Returns true if no channel has too much buffered data, and false if one or
- * more channel is overfull.
- */
-
-int
-channel_not_very_much_buffered_data(void)
-{
-	u_int i;
-	Channel *c;
-
-	for (i = 0; i < channels_alloc; i++) {
-		c = channels[i];
-		if (c != NULL && c->type == SSH_CHANNEL_OPEN) {
-#if 0
-			if (!compat20 &&
-			    buffer_len(&c->input) > packet_get_maxsize()) {
-				debug2("channel %d: big input buffer %d",
-				    c->self, buffer_len(&c->input));
-				return 0;
-			}
-#endif
-			if (buffer_len(&c->output) > packet_get_maxsize()) {
-				debug2("channel %d: big output buffer %d > %d",
-				    c->self, buffer_len(&c->output),
-				    packet_get_maxsize());
-				return 0;
-			}
-		}
-	}
-	return 1;
-}
-
-/* Returns true if any channel is still open. */
-
-int
-channel_still_open(void)
-{
-	int i;
-	Channel *c;
-
-	for (i = 0; i < channels_alloc; i++) {
-		c = channels[i];
-		if (c == NULL)
-			continue;
-		switch (c->type) {
-		case SSH_CHANNEL_X11_LISTENER:
-		case SSH_CHANNEL_PORT_LISTENER:
-		case SSH_CHANNEL_RPORT_LISTENER:
-		case SSH_CHANNEL_CLOSED:
-		case SSH_CHANNEL_AUTH_SOCKET:
-		case SSH_CHANNEL_DYNAMIC:
-		case SSH_CHANNEL_CONNECTING:
-		case SSH_CHANNEL_ZOMBIE:
-			continue;
-		case SSH_CHANNEL_LARVAL:
-			if (!compat20)
-				fatal("cannot happen: SSH_CHANNEL_LARVAL");
-			continue;
-		case SSH_CHANNEL_OPENING:
-		case SSH_CHANNEL_OPEN:
-		case SSH_CHANNEL_X11_OPEN:
-			return 1;
-		case SSH_CHANNEL_INPUT_DRAINING:
-		case SSH_CHANNEL_OUTPUT_DRAINING:
-			if (!compat13)
-				fatal("cannot happen: OUT_DRAIN");
-			return 1;
-		default:
-			fatal("channel_still_open: bad channel type %d", c->type);
-			/* NOTREACHED */
-		}
-	}
-	return 0;
-}
-
-/* Returns the id of an open channel suitable for keepaliving */
-
-int
-channel_find_open(void)
-{
-	int i;
-	Channel *c;
-
-	for (i = 0; i < channels_alloc; i++) {
-		c = channels[i];
-		if (c == NULL)
-			continue;
-		switch (c->type) {
-		case SSH_CHANNEL_CLOSED:
-		case SSH_CHANNEL_DYNAMIC:
-		case SSH_CHANNEL_X11_LISTENER:
-		case SSH_CHANNEL_PORT_LISTENER:
-		case SSH_CHANNEL_RPORT_LISTENER:
-		case SSH_CHANNEL_OPENING:
-		case SSH_CHANNEL_CONNECTING:
-		case SSH_CHANNEL_ZOMBIE:
-			continue;
-		case SSH_CHANNEL_LARVAL:
-		case SSH_CHANNEL_AUTH_SOCKET:
-		case SSH_CHANNEL_OPEN:
-		case SSH_CHANNEL_X11_OPEN:
-			return i;
-		case SSH_CHANNEL_INPUT_DRAINING:
-		case SSH_CHANNEL_OUTPUT_DRAINING:
-			if (!compat13)
-				fatal("cannot happen: OUT_DRAIN");
-			return i;
-		default:
-			fatal("channel_find_open: bad channel type %d", c->type);
-			/* NOTREACHED */
-		}
-	}
-	return -1;
-}
-
-
-/*
- * Returns a message describing the currently open forwarded connections,
- * suitable for sending to the client.  The message contains crlf pairs for
- * newlines.
- */
-
-char *
-channel_open_message(void)
-{
-	Buffer buffer;
-	Channel *c;
-	char buf[1024], *cp;
-	int i;
-
-	buffer_init(&buffer);
-	snprintf(buf, sizeof buf, "The following connections are open:\r\n");
-	buffer_append(&buffer, buf, strlen(buf));
-	for (i = 0; i < channels_alloc; i++) {
-		c = channels[i];
-		if (c == NULL)
-			continue;
-		switch (c->type) {
-		case SSH_CHANNEL_X11_LISTENER:
-		case SSH_CHANNEL_PORT_LISTENER:
-		case SSH_CHANNEL_RPORT_LISTENER:
-		case SSH_CHANNEL_CLOSED:
-		case SSH_CHANNEL_AUTH_SOCKET:
-		case SSH_CHANNEL_ZOMBIE:
-			continue;
-		case SSH_CHANNEL_LARVAL:
-		case SSH_CHANNEL_OPENING:
-		case SSH_CHANNEL_CONNECTING:
-		case SSH_CHANNEL_DYNAMIC:
-		case SSH_CHANNEL_OPEN:
-		case SSH_CHANNEL_X11_OPEN:
-		case SSH_CHANNEL_INPUT_DRAINING:
-		case SSH_CHANNEL_OUTPUT_DRAINING:
-			snprintf(buf, sizeof buf, "  #%d %.300s (t%d r%d i%d/%d o%d/%d fd %d/%d)\r\n",
-			    c->self, c->remote_name,
-			    c->type, c->remote_id,
-			    c->istate, buffer_len(&c->input),
-			    c->ostate, buffer_len(&c->output),
-			    c->rfd, c->wfd);
-			buffer_append(&buffer, buf, strlen(buf));
-			continue;
-		default:
-			fatal("channel_open_message: bad channel type %d", c->type);
-			/* NOTREACHED */
-		}
-	}
-	buffer_append(&buffer, "\0", 1);
-	cp = xstrdup(buffer_ptr(&buffer));
-	buffer_free(&buffer);
-	return cp;
-}
-
-void
-channel_send_open(int id)
-{
-	Channel *c = channel_lookup(id);
-
-	if (c == NULL) {
-		log("channel_send_open: %d: bad id", id);
-		return;
-	}
-	debug2("channel %d: send open", id);
-	packet_start(SSH2_MSG_CHANNEL_OPEN);
-	packet_put_cstring(c->ctype);
-	packet_put_int(c->self);
-	packet_put_int(c->local_window);
-	packet_put_int(c->local_maxpacket);
-	packet_send();
-}
-
-void
-channel_request_start(int id, char *service, int wantconfirm)
-{
-	Channel *c = channel_lookup(id);
-
-	if (c == NULL) {
-		log("channel_request_start: %d: unknown channel id", id);
-		return;
-	}
-	debug("channel %d: request %s", id, service) ;
-	packet_start(SSH2_MSG_CHANNEL_REQUEST);
-	packet_put_int(c->remote_id);
-	packet_put_cstring(service);
-	packet_put_char(wantconfirm);
-}
-void
-channel_register_confirm(int id, channel_callback_fn *fn)
-{
-	Channel *c = channel_lookup(id);
-
-	if (c == NULL) {
-		log("channel_register_comfirm: %d: bad id", id);
-		return;
-	}
-	c->confirm = fn;
-}
-void
-channel_register_cleanup(int id, channel_callback_fn *fn)
-{
-	Channel *c = channel_lookup(id);
-
-	if (c == NULL) {
-		log("channel_register_cleanup: %d: bad id", id);
-		return;
-	}
-	c->detach_user = fn;
-}
-void
-channel_cancel_cleanup(int id)
-{
-	Channel *c = channel_lookup(id);
-
-	if (c == NULL) {
-		log("channel_cancel_cleanup: %d: bad id", id);
-		return;
-	}
-	c->detach_user = NULL;
-}
-void
-channel_register_filter(int id, channel_filter_fn *fn)
-{
-	Channel *c = channel_lookup(id);
-
-	if (c == NULL) {
-		log("channel_register_filter: %d: bad id", id);
-		return;
-	}
-	c->input_filter = fn;
-}
-
-void
-channel_set_fds(int id, int rfd, int wfd, int efd,
-    int extusage, int nonblock, u_int window_max)
-{
-	Channel *c = channel_lookup(id);
-
-	if (c == NULL || c->type != SSH_CHANNEL_LARVAL)
-		fatal("channel_activate for non-larval channel %d.", id);
-	channel_register_fds(c, rfd, wfd, efd, extusage, nonblock);
-	c->type = SSH_CHANNEL_OPEN;
-	c->local_window = c->local_window_max = window_max;
-	packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
-	packet_put_int(c->remote_id);
-	packet_put_int(c->local_window);
-	packet_send();
-}
-
-/*
- * 'channel_pre*' are called just before select() to add any bits relevant to
- * channels in the select bitmasks.
- */
-/*
- * 'channel_post*': perform any appropriate operations for channels which
- * have events pending.
- */
-typedef void chan_fn(Channel *c, fd_set * readset, fd_set * writeset);
-chan_fn *channel_pre[SSH_CHANNEL_MAX_TYPE];
-chan_fn *channel_post[SSH_CHANNEL_MAX_TYPE];
-
-static void
-channel_pre_listener(Channel *c, fd_set * readset, fd_set * writeset)
-{
-	FD_SET(c->sock, readset);
-}
-
-static void
-channel_pre_connecting(Channel *c, fd_set * readset, fd_set * writeset)
-{
-	debug3("channel %d: waiting for connection", c->self);
-	FD_SET(c->sock, writeset);
-}
-
-static void
-channel_pre_open_13(Channel *c, fd_set * readset, fd_set * writeset)
-{
-	if (buffer_len(&c->input) < packet_get_maxsize())
-		FD_SET(c->sock, readset);
-	if (buffer_len(&c->output) > 0)
-		FD_SET(c->sock, writeset);
-}
-
-static void
-channel_pre_open(Channel *c, fd_set * readset, fd_set * writeset)
-{
-	u_int limit = compat20 ? c->remote_window : packet_get_maxsize();
-
-	if (c->istate == CHAN_INPUT_OPEN &&
-	    limit > 0 &&
-	    buffer_len(&c->input) < limit)
-		FD_SET(c->rfd, readset);
-	if (c->ostate == CHAN_OUTPUT_OPEN ||
-	    c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
-		if (buffer_len(&c->output) > 0) {
-			FD_SET(c->wfd, writeset);
-		} else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
-			if (CHANNEL_EFD_OUTPUT_ACTIVE(c))
-			       debug2("channel %d: obuf_empty delayed efd %d/(%d)",
-				   c->self, c->efd, buffer_len(&c->extended));
-			else
-				chan_obuf_empty(c);
-		}
-	}
-	/** XXX check close conditions, too */
-	if (compat20 && c->efd != -1) {
-		if (c->extended_usage == CHAN_EXTENDED_WRITE &&
-		    buffer_len(&c->extended) > 0)
-			FD_SET(c->efd, writeset);
-		else if (!(c->flags & CHAN_EOF_SENT) &&
-		    c->extended_usage == CHAN_EXTENDED_READ &&
-		    buffer_len(&c->extended) < c->remote_window)
-			FD_SET(c->efd, readset);
-	}
-}
-
-static void
-channel_pre_input_draining(Channel *c, fd_set * readset, fd_set * writeset)
-{
-	if (buffer_len(&c->input) == 0) {
-		packet_start(SSH_MSG_CHANNEL_CLOSE);
-		packet_put_int(c->remote_id);
-		packet_send();
-		c->type = SSH_CHANNEL_CLOSED;
-		debug("channel %d: closing after input drain.", c->self);
-	}
-}
-
-static void
-channel_pre_output_draining(Channel *c, fd_set * readset, fd_set * writeset)
-{
-	if (buffer_len(&c->output) == 0)
-		chan_mark_dead(c);
-	else
-		FD_SET(c->sock, writeset);
-}
-
-/*
- * This is a special state for X11 authentication spoofing.  An opened X11
- * connection (when authentication spoofing is being done) remains in this
- * state until the first packet has been completely read.  The authentication
- * data in that packet is then substituted by the real data if it matches the
- * fake data, and the channel is put into normal mode.
- * XXX All this happens at the client side.
- * Returns: 0 = need more data, -1 = wrong cookie, 1 = ok
- */
-static int
-x11_open_helper(Buffer *b)
-{
-	u_char *ucp;
-	u_int proto_len, data_len;
-
-	/* Check if the fixed size part of the packet is in buffer. */
-	if (buffer_len(b) < 12)
-		return 0;
-
-	/* Parse the lengths of variable-length fields. */
-	ucp = buffer_ptr(b);
-	if (ucp[0] == 0x42) {	/* Byte order MSB first. */
-		proto_len = 256 * ucp[6] + ucp[7];
-		data_len = 256 * ucp[8] + ucp[9];
-	} else if (ucp[0] == 0x6c) {	/* Byte order LSB first. */
-		proto_len = ucp[6] + 256 * ucp[7];
-		data_len = ucp[8] + 256 * ucp[9];
-	} else {
-		debug("Initial X11 packet contains bad byte order byte: 0x%x",
-		    ucp[0]);
-		return -1;
-	}
-
-	/* Check if the whole packet is in buffer. */
-	if (buffer_len(b) <
-	    12 + ((proto_len + 3) & ~3) + ((data_len + 3) & ~3))
-		return 0;
-
-	/* Check if authentication protocol matches. */
-	if (proto_len != strlen(x11_saved_proto) ||
-	    memcmp(ucp + 12, x11_saved_proto, proto_len) != 0) {
-		debug("X11 connection uses different authentication protocol.");
-		return -1;
-	}
-	/* Check if authentication data matches our fake data. */
-	if (data_len != x11_fake_data_len ||
-	    memcmp(ucp + 12 + ((proto_len + 3) & ~3),
-		x11_fake_data, x11_fake_data_len) != 0) {
-		debug("X11 auth data does not match fake data.");
-		return -1;
-	}
-	/* Check fake data length */
-	if (x11_fake_data_len != x11_saved_data_len) {
-		error("X11 fake_data_len %d != saved_data_len %d",
-		    x11_fake_data_len, x11_saved_data_len);
-		return -1;
-	}
-	/*
-	 * Received authentication protocol and data match
-	 * our fake data. Substitute the fake data with real
-	 * data.
-	 */
-	memcpy(ucp + 12 + ((proto_len + 3) & ~3),
-	    x11_saved_data, x11_saved_data_len);
-	return 1;
-}
-
-static void
-channel_pre_x11_open_13(Channel *c, fd_set * readset, fd_set * writeset)
-{
-	int ret = x11_open_helper(&c->output);
-
-	if (ret == 1) {
-		/* Start normal processing for the channel. */
-		c->type = SSH_CHANNEL_OPEN;
-		channel_pre_open_13(c, readset, writeset);
-	} else if (ret == -1) {
-		/*
-		 * We have received an X11 connection that has bad
-		 * authentication information.
-		 */
-		log("X11 connection rejected because of wrong authentication.");
-		buffer_clear(&c->input);
-		buffer_clear(&c->output);
-		channel_close_fd(&c->sock);
-		c->sock = -1;
-		c->type = SSH_CHANNEL_CLOSED;
-		packet_start(SSH_MSG_CHANNEL_CLOSE);
-		packet_put_int(c->remote_id);
-		packet_send();
-	}
-}
-
-static void
-channel_pre_x11_open(Channel *c, fd_set * readset, fd_set * writeset)
-{
-	int ret = x11_open_helper(&c->output);
-
-	/* c->force_drain = 1; */
-
-	if (ret == 1) {
-		c->type = SSH_CHANNEL_OPEN;
-		channel_pre_open(c, readset, writeset);
-	} else if (ret == -1) {
-		log("X11 connection rejected because of wrong authentication.");
-		debug("X11 rejected %d i%d/o%d", c->self, c->istate, c->ostate);
-		chan_read_failed(c);
-		buffer_clear(&c->input);
-		chan_ibuf_empty(c);
-		buffer_clear(&c->output);
-		/* for proto v1, the peer will send an IEOF */
-		if (compat20)
-			chan_write_failed(c);
-		else
-			c->type = SSH_CHANNEL_OPEN;
-		debug("X11 closed %d i%d/o%d", c->self, c->istate, c->ostate);
-	}
-}
-
-/* try to decode a socks4 header */
-static int
-channel_decode_socks4(Channel *c, fd_set * readset, fd_set * writeset)
-{
-	char *p, *host;
-	int len, have, i, found;
-	char username[256];
-	struct {
-		u_int8_t version;
-		u_int8_t command;
-		u_int16_t dest_port;
-		struct in_addr dest_addr;
-	} s4_req, s4_rsp;
-
-	debug2("channel %d: decode socks4", c->self);
-
-	have = buffer_len(&c->input);
-	len = sizeof(s4_req);
-	if (have < len)
-		return 0;
-	p = buffer_ptr(&c->input);
-	for (found = 0, i = len; i < have; i++) {
-		if (p[i] == '\0') {
-			found = 1;
-			break;
-		}
-		if (i > 1024) {
-			/* the peer is probably sending garbage */
-			debug("channel %d: decode socks4: too long",
-			    c->self);
-			return -1;
-		}
-	}
-	if (!found)
-		return 0;
-	buffer_get(&c->input, (char *)&s4_req.version, 1);
-	buffer_get(&c->input, (char *)&s4_req.command, 1);
-	buffer_get(&c->input, (char *)&s4_req.dest_port, 2);
-	buffer_get(&c->input, (char *)&s4_req.dest_addr, 4);
-	have = buffer_len(&c->input);
-	p = buffer_ptr(&c->input);
-	len = strlen(p);
-	debug2("channel %d: decode socks4: user %s/%d", c->self, p, len);
-	if (len > have)
-		fatal("channel %d: decode socks4: len %d > have %d",
-		    c->self, len, have);
-	strlcpy(username, p, sizeof(username));
-	buffer_consume(&c->input, len);
-	buffer_consume(&c->input, 1);		/* trailing '\0' */
-
-	host = inet_ntoa(s4_req.dest_addr);
-	strlcpy(c->path, host, sizeof(c->path));
-	c->host_port = ntohs(s4_req.dest_port);
-
-	debug("channel %d: dynamic request: socks4 host %s port %u command %u",
-	    c->self, host, c->host_port, s4_req.command);
-
-	if (s4_req.command != 1) {
-		debug("channel %d: cannot handle: socks4 cn %d",
-		    c->self, s4_req.command);
-		return -1;
-	}
-	s4_rsp.version = 0;			/* vn: 0 for reply */
-	s4_rsp.command = 90;			/* cd: req granted */
-	s4_rsp.dest_port = 0;			/* ignored */
-	s4_rsp.dest_addr.s_addr = INADDR_ANY;	/* ignored */
-	buffer_append(&c->output, (char *)&s4_rsp, sizeof(s4_rsp));
-	return 1;
-}
-
-/* dynamic port forwarding */
-static void
-channel_pre_dynamic(Channel *c, fd_set * readset, fd_set * writeset)
-{
-	u_char *p;
-	int have, ret;
-
-	have = buffer_len(&c->input);
-	c->delayed = 0;
-	debug2("channel %d: pre_dynamic: have %d", c->self, have);
-	/* buffer_dump(&c->input); */
-	/* check if the fixed size part of the packet is in buffer. */
-	if (have < 4) {
-		/* need more */
-		FD_SET(c->sock, readset);
-		return;
-	}
-	/* try to guess the protocol */
-	p = buffer_ptr(&c->input);
-	switch (p[0]) {
-	case 0x04:
-		ret = channel_decode_socks4(c, readset, writeset);
-		break;
-	default:
-		ret = -1;
-		break;
-	}
-	if (ret < 0) {
-		chan_mark_dead(c);
-	} else if (ret == 0) {
-		debug2("channel %d: pre_dynamic: need more", c->self);
-		/* need more */
-		FD_SET(c->sock, readset);
-	} else {
-		/* switch to the next state */
-		c->type = SSH_CHANNEL_OPENING;
-		port_open_helper(c, "direct-tcpip");
-	}
-}
-
-/* This is our fake X11 server socket. */
-static void
-channel_post_x11_listener(Channel *c, fd_set * readset, fd_set * writeset)
-{
-	Channel *nc;
-	struct sockaddr addr;
-	int newsock;
-	socklen_t addrlen;
-	char buf[16384], *remote_ipaddr;
-	int remote_port;
-
-	if (FD_ISSET(c->sock, readset)) {
-		debug("X11 connection requested.");
-		addrlen = sizeof(addr);
-		newsock = accept(c->sock, &addr, &addrlen);
-		if (c->single_connection) {
-			debug("single_connection: closing X11 listener.");
-			channel_close_fd(&c->sock);
-			chan_mark_dead(c);
-		}
-		if (newsock < 0) {
-			error("accept: %.100s", strerror(errno));
-			return;
-		}
-		set_nodelay(newsock);
-		remote_ipaddr = get_peer_ipaddr(newsock);
-		remote_port = get_peer_port(newsock);
-		snprintf(buf, sizeof buf, "X11 connection from %.200s port %d",
-		    remote_ipaddr, remote_port);
-
-		nc = channel_new("accepted x11 socket",
-		    SSH_CHANNEL_OPENING, newsock, newsock, -1,
-		    c->local_window_max, c->local_maxpacket,
-		    0, xstrdup(buf), 1);
-		if (compat20) {
-			packet_start(SSH2_MSG_CHANNEL_OPEN);
-			packet_put_cstring("x11");
-			packet_put_int(nc->self);
-			packet_put_int(nc->local_window_max);
-			packet_put_int(nc->local_maxpacket);
-			/* originator ipaddr and port */
-			packet_put_cstring(remote_ipaddr);
-			if (datafellows & SSH_BUG_X11FWD) {
-				debug("ssh2 x11 bug compat mode");
-			} else {
-				packet_put_int(remote_port);
-			}
-			packet_send();
-		} else {
-			packet_start(SSH_SMSG_X11_OPEN);
-			packet_put_int(nc->self);
-			if (packet_get_protocol_flags() &
-			    SSH_PROTOFLAG_HOST_IN_FWD_OPEN)
-				packet_put_cstring(buf);
-			packet_send();
-		}
-		xfree(remote_ipaddr);
-	}
-}
-
-static void
-port_open_helper(Channel *c, char *rtype)
-{
-	int direct;
-	char buf[1024];
-	char *remote_ipaddr = get_peer_ipaddr(c->sock);
-	u_short remote_port = get_peer_port(c->sock);
-
-	direct = (strcmp(rtype, "direct-tcpip") == 0);
-
-	snprintf(buf, sizeof buf,
-	    "%s: listening port %d for %.100s port %d, "
-	    "connect from %.200s port %d",
-	    rtype, c->listening_port, c->path, c->host_port,
-	    remote_ipaddr, remote_port);
-
-	xfree(c->remote_name);
-	c->remote_name = xstrdup(buf);
-
-	if (compat20) {
-		packet_start(SSH2_MSG_CHANNEL_OPEN);
-		packet_put_cstring(rtype);
-		packet_put_int(c->self);
-		packet_put_int(c->local_window_max);
-		packet_put_int(c->local_maxpacket);
-		if (direct) {
-			/* target host, port */
-			packet_put_cstring(c->path);
-			packet_put_int(c->host_port);
-		} else {
-			/* listen address, port */
-			packet_put_cstring(c->path);
-			packet_put_int(c->listening_port);
-		}
-		/* originator host and port */
-		packet_put_cstring(remote_ipaddr);
-		packet_put_int(remote_port);
-		packet_send();
-	} else {
-		packet_start(SSH_MSG_PORT_OPEN);
-		packet_put_int(c->self);
-		packet_put_cstring(c->path);
-		packet_put_int(c->host_port);
-		if (packet_get_protocol_flags() &
-		    SSH_PROTOFLAG_HOST_IN_FWD_OPEN)
-			packet_put_cstring(c->remote_name);
-		packet_send();
-	}
-	xfree(remote_ipaddr);
-}
-
-/*
- * This socket is listening for connections to a forwarded TCP/IP port.
- */
-static void
-channel_post_port_listener(Channel *c, fd_set * readset, fd_set * writeset)
-{
-	Channel *nc;
-	struct sockaddr addr;
-	int newsock, nextstate;
-	socklen_t addrlen;
-	char *rtype;
-
-	if (FD_ISSET(c->sock, readset)) {
-		debug("Connection to port %d forwarding "
-		    "to %.100s port %d requested.",
-		    c->listening_port, c->path, c->host_port);
-
-		if (c->type == SSH_CHANNEL_RPORT_LISTENER) {
-			nextstate = SSH_CHANNEL_OPENING;
-			rtype = "forwarded-tcpip";
-		} else {
-			if (c->host_port == 0) {
-				nextstate = SSH_CHANNEL_DYNAMIC;
-				rtype = "dynamic-tcpip";
-			} else {
-				nextstate = SSH_CHANNEL_OPENING;
-				rtype = "direct-tcpip";
-			}
-		}
-
-		addrlen = sizeof(addr);
-		newsock = accept(c->sock, &addr, &addrlen);
-		if (newsock < 0) {
-			error("accept: %.100s", strerror(errno));
-			return;
-		}
-		set_nodelay(newsock);
-		nc = channel_new(rtype,
-		    nextstate, newsock, newsock, -1,
-		    c->local_window_max, c->local_maxpacket,
-		    0, xstrdup(rtype), 1);
-		nc->listening_port = c->listening_port;
-		nc->host_port = c->host_port;
-		strlcpy(nc->path, c->path, sizeof(nc->path));
-
-		if (nextstate == SSH_CHANNEL_DYNAMIC) {
-			/*
-			 * do not call the channel_post handler until
-			 * this flag has been reset by a pre-handler.
-			 * otherwise the FD_ISSET calls might overflow
-			 */
-			nc->delayed = 1;
-		} else {
-			port_open_helper(nc, rtype);
-		}
-	}
-}
-
-/*
- * This is the authentication agent socket listening for connections from
- * clients.
- */
-static void
-channel_post_auth_listener(Channel *c, fd_set * readset, fd_set * writeset)
-{
-	Channel *nc;
-	char *name;
-	int newsock;
-	struct sockaddr addr;
-	socklen_t addrlen;
-
-	if (FD_ISSET(c->sock, readset)) {
-		addrlen = sizeof(addr);
-		newsock = accept(c->sock, &addr, &addrlen);
-		if (newsock < 0) {
-			error("accept from auth socket: %.100s", strerror(errno));
-			return;
-		}
-		name = xstrdup("accepted auth socket");
-		nc = channel_new("accepted auth socket",
-		    SSH_CHANNEL_OPENING, newsock, newsock, -1,
-		    c->local_window_max, c->local_maxpacket,
-		    0, name, 1);
-		if (compat20) {
-			packet_start(SSH2_MSG_CHANNEL_OPEN);
-			packet_put_cstring("auth-agent@openssh.com");
-			packet_put_int(nc->self);
-			packet_put_int(c->local_window_max);
-			packet_put_int(c->local_maxpacket);
-		} else {
-			packet_start(SSH_SMSG_AGENT_OPEN);
-			packet_put_int(nc->self);
-		}
-		packet_send();
-	}
-}
-
-static void
-channel_post_connecting(Channel *c, fd_set * readset, fd_set * writeset)
-{
-	int err = 0;
-	socklen_t sz = sizeof(err);
-
-	if (FD_ISSET(c->sock, writeset)) {
-		if (getsockopt(c->sock, SOL_SOCKET, SO_ERROR, &err, &sz) < 0) {
-			err = errno;
-			error("getsockopt SO_ERROR failed");
-		}
-		if (err == 0) {
-			debug("channel %d: connected", c->self);
-			c->type = SSH_CHANNEL_OPEN;
-			if (compat20) {
-				packet_start(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION);
-				packet_put_int(c->remote_id);
-				packet_put_int(c->self);
-				packet_put_int(c->local_window);
-				packet_put_int(c->local_maxpacket);
-			} else {
-				packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
-				packet_put_int(c->remote_id);
-				packet_put_int(c->self);
-			}
-		} else {
-			debug("channel %d: not connected: %s",
-			    c->self, strerror(err));
-			if (compat20) {
-				packet_start(SSH2_MSG_CHANNEL_OPEN_FAILURE);
-				packet_put_int(c->remote_id);
-				packet_put_int(SSH2_OPEN_CONNECT_FAILED);
-				if (!(datafellows & SSH_BUG_OPENFAILURE)) {
-					packet_put_cstring(strerror(err));
-					packet_put_cstring("");
-				}
-			} else {
-				packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
-				packet_put_int(c->remote_id);
-			}
-			chan_mark_dead(c);
-		}
-		packet_send();
-	}
-}
-
-static int
-channel_handle_rfd(Channel *c, fd_set * readset, fd_set * writeset)
-{
-	char buf[16*1024];
-	int len;
-
-	if (c->rfd != -1 &&
-	    FD_ISSET(c->rfd, readset)) {
-		len = read(c->rfd, buf, sizeof(buf));
-		if (len < 0 && (errno == EINTR || errno == EAGAIN))
-			return 1;
-		if (len <= 0) {
-			debug("channel %d: read<=0 rfd %d len %d",
-			    c->self, c->rfd, len);
-			if (c->type != SSH_CHANNEL_OPEN) {
-				debug("channel %d: not open", c->self);
-				chan_mark_dead(c);
-				return -1;
-			} else if (compat13) {
-				buffer_clear(&c->output);
-				c->type = SSH_CHANNEL_INPUT_DRAINING;
-				debug("channel %d: input draining.", c->self);
-			} else {
-				chan_read_failed(c);
-			}
-			return -1;
-		}
-		if (c->input_filter != NULL) {
-			if (c->input_filter(c, buf, len) == -1) {
-				debug("channel %d: filter stops", c->self);
-				chan_read_failed(c);
-			}
-		} else {
-			buffer_append(&c->input, buf, len);
-		}
-	}
-	return 1;
-}
-static int
-channel_handle_wfd(Channel *c, fd_set * readset, fd_set * writeset)
-{
-	struct termios tio;
-	u_char *data;
-	u_int dlen;
-	int len;
-
-	/* Send buffered output data to the socket. */
-	if (c->wfd != -1 &&
-	    FD_ISSET(c->wfd, writeset) &&
-	    buffer_len(&c->output) > 0) {
-		data = buffer_ptr(&c->output);
-		dlen = buffer_len(&c->output);
-#ifdef _AIX
-		/* XXX: Later AIX versions can't push as much data to tty */ 
-		if (compat20 && c->wfd_isatty && dlen > 8*1024)
-			dlen = 8*1024;
-#endif
-		len = write(c->wfd, data, dlen);
-		if (len < 0 && (errno == EINTR || errno == EAGAIN))
-			return 1;
-		if (len <= 0) {
-			if (c->type != SSH_CHANNEL_OPEN) {
-				debug("channel %d: not open", c->self);
-				chan_mark_dead(c);
-				return -1;
-			} else if (compat13) {
-				buffer_clear(&c->output);
-				debug("channel %d: input draining.", c->self);
-				c->type = SSH_CHANNEL_INPUT_DRAINING;
-			} else {
-				chan_write_failed(c);
-			}
-			return -1;
-		}
-		if (compat20 && c->isatty && dlen >= 1 && data[0] != '\r') {
-			if (tcgetattr(c->wfd, &tio) == 0 &&
-			    !(tio.c_lflag & ECHO) && (tio.c_lflag & ICANON)) {
-				/*
-				 * Simulate echo to reduce the impact of
-				 * traffic analysis. We need to match the
-				 * size of a SSH2_MSG_CHANNEL_DATA message
-				 * (4 byte channel id + data)
-				 */
-				packet_send_ignore(4 + len);
-				packet_send();
-			}
-		}
-		buffer_consume(&c->output, len);
-		if (compat20 && len > 0) {
-			c->local_consumed += len;
-		}
-	}
-	return 1;
-}
-static int
-channel_handle_efd(Channel *c, fd_set * readset, fd_set * writeset)
-{
-	char buf[16*1024];
-	int len;
-
-/** XXX handle drain efd, too */
-	if (c->efd != -1) {
-		if (c->extended_usage == CHAN_EXTENDED_WRITE &&
-		    FD_ISSET(c->efd, writeset) &&
-		    buffer_len(&c->extended) > 0) {
-			len = write(c->efd, buffer_ptr(&c->extended),
-			    buffer_len(&c->extended));
-			debug2("channel %d: written %d to efd %d",
-			    c->self, len, c->efd);
-			if (len < 0 && (errno == EINTR || errno == EAGAIN))
-				return 1;
-			if (len <= 0) {
-				debug2("channel %d: closing write-efd %d",
-				    c->self, c->efd);
-				channel_close_fd(&c->efd);
-			} else {
-				buffer_consume(&c->extended, len);
-				c->local_consumed += len;
-			}
-		} else if (c->extended_usage == CHAN_EXTENDED_READ &&
-		    FD_ISSET(c->efd, readset)) {
-			len = read(c->efd, buf, sizeof(buf));
-			debug2("channel %d: read %d from efd %d",
-			    c->self, len, c->efd);
-			if (len < 0 && (errno == EINTR || errno == EAGAIN))
-				return 1;
-			if (len <= 0) {
-				debug2("channel %d: closing read-efd %d",
-				    c->self, c->efd);
-				channel_close_fd(&c->efd);
-			} else {
-				buffer_append(&c->extended, buf, len);
-			}
-		}
-	}
-	return 1;
-}
-static int
-channel_check_window(Channel *c)
-{
-	if (c->type == SSH_CHANNEL_OPEN &&
-	    !(c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD)) &&
-	    c->local_window < c->local_window_max/2 &&
-	    c->local_consumed > 0) {
-		packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
-		packet_put_int(c->remote_id);
-		packet_put_int(c->local_consumed);
-		packet_send();
-		debug2("channel %d: window %d sent adjust %d",
-		    c->self, c->local_window,
-		    c->local_consumed);
-		c->local_window += c->local_consumed;
-		c->local_consumed = 0;
-	}
-	return 1;
-}
-
-static void
-channel_post_open(Channel *c, fd_set * readset, fd_set * writeset)
-{
-	if (c->delayed)
-		return;
-	channel_handle_rfd(c, readset, writeset);
-	channel_handle_wfd(c, readset, writeset);
-	if (!compat20)
-		return;
-	channel_handle_efd(c, readset, writeset);
-	channel_check_window(c);
-}
-
-static void
-channel_post_output_drain_13(Channel *c, fd_set * readset, fd_set * writeset)
-{
-	int len;
-
-	/* Send buffered output data to the socket. */
-	if (FD_ISSET(c->sock, writeset) && buffer_len(&c->output) > 0) {
-		len = write(c->sock, buffer_ptr(&c->output),
-			    buffer_len(&c->output));
-		if (len <= 0)
-			buffer_clear(&c->output);
-		else
-			buffer_consume(&c->output, len);
-	}
-}
-
-static void
-channel_handler_init_20(void)
-{
-	channel_pre[SSH_CHANNEL_OPEN] =			&channel_pre_open;
-	channel_pre[SSH_CHANNEL_X11_OPEN] =		&channel_pre_x11_open;
-	channel_pre[SSH_CHANNEL_PORT_LISTENER] =	&channel_pre_listener;
-	channel_pre[SSH_CHANNEL_RPORT_LISTENER] =	&channel_pre_listener;
-	channel_pre[SSH_CHANNEL_X11_LISTENER] =		&channel_pre_listener;
-	channel_pre[SSH_CHANNEL_AUTH_SOCKET] =		&channel_pre_listener;
-	channel_pre[SSH_CHANNEL_CONNECTING] =		&channel_pre_connecting;
-	channel_pre[SSH_CHANNEL_DYNAMIC] =		&channel_pre_dynamic;
-
-	channel_post[SSH_CHANNEL_OPEN] =		&channel_post_open;
-	channel_post[SSH_CHANNEL_PORT_LISTENER] =	&channel_post_port_listener;
-	channel_post[SSH_CHANNEL_RPORT_LISTENER] =	&channel_post_port_listener;
-	channel_post[SSH_CHANNEL_X11_LISTENER] =	&channel_post_x11_listener;
-	channel_post[SSH_CHANNEL_AUTH_SOCKET] =		&channel_post_auth_listener;
-	channel_post[SSH_CHANNEL_CONNECTING] =		&channel_post_connecting;
-	channel_post[SSH_CHANNEL_DYNAMIC] =		&channel_post_open;
-}
-
-static void
-channel_handler_init_13(void)
-{
-	channel_pre[SSH_CHANNEL_OPEN] =			&channel_pre_open_13;
-	channel_pre[SSH_CHANNEL_X11_OPEN] =		&channel_pre_x11_open_13;
-	channel_pre[SSH_CHANNEL_X11_LISTENER] =		&channel_pre_listener;
-	channel_pre[SSH_CHANNEL_PORT_LISTENER] =	&channel_pre_listener;
-	channel_pre[SSH_CHANNEL_AUTH_SOCKET] =		&channel_pre_listener;
-	channel_pre[SSH_CHANNEL_INPUT_DRAINING] =	&channel_pre_input_draining;
-	channel_pre[SSH_CHANNEL_OUTPUT_DRAINING] =	&channel_pre_output_draining;
-	channel_pre[SSH_CHANNEL_CONNECTING] =		&channel_pre_connecting;
-	channel_pre[SSH_CHANNEL_DYNAMIC] =		&channel_pre_dynamic;
-
-	channel_post[SSH_CHANNEL_OPEN] =		&channel_post_open;
-	channel_post[SSH_CHANNEL_X11_LISTENER] =	&channel_post_x11_listener;
-	channel_post[SSH_CHANNEL_PORT_LISTENER] =	&channel_post_port_listener;
-	channel_post[SSH_CHANNEL_AUTH_SOCKET] =		&channel_post_auth_listener;
-	channel_post[SSH_CHANNEL_OUTPUT_DRAINING] =	&channel_post_output_drain_13;
-	channel_post[SSH_CHANNEL_CONNECTING] =		&channel_post_connecting;
-	channel_post[SSH_CHANNEL_DYNAMIC] =		&channel_post_open;
-}
-
-static void
-channel_handler_init_15(void)
-{
-	channel_pre[SSH_CHANNEL_OPEN] =			&channel_pre_open;
-	channel_pre[SSH_CHANNEL_X11_OPEN] =		&channel_pre_x11_open;
-	channel_pre[SSH_CHANNEL_X11_LISTENER] =		&channel_pre_listener;
-	channel_pre[SSH_CHANNEL_PORT_LISTENER] =	&channel_pre_listener;
-	channel_pre[SSH_CHANNEL_AUTH_SOCKET] =		&channel_pre_listener;
-	channel_pre[SSH_CHANNEL_CONNECTING] =		&channel_pre_connecting;
-	channel_pre[SSH_CHANNEL_DYNAMIC] =		&channel_pre_dynamic;
-
-	channel_post[SSH_CHANNEL_X11_LISTENER] =	&channel_post_x11_listener;
-	channel_post[SSH_CHANNEL_PORT_LISTENER] =	&channel_post_port_listener;
-	channel_post[SSH_CHANNEL_AUTH_SOCKET] =		&channel_post_auth_listener;
-	channel_post[SSH_CHANNEL_OPEN] =		&channel_post_open;
-	channel_post[SSH_CHANNEL_CONNECTING] =		&channel_post_connecting;
-	channel_post[SSH_CHANNEL_DYNAMIC] =		&channel_post_open;
-}
-
-static void
-channel_handler_init(void)
-{
-	int i;
-
-	for (i = 0; i < SSH_CHANNEL_MAX_TYPE; i++) {
-		channel_pre[i] = NULL;
-		channel_post[i] = NULL;
-	}
-	if (compat20)
-		channel_handler_init_20();
-	else if (compat13)
-		channel_handler_init_13();
-	else
-		channel_handler_init_15();
-}
-
-/* gc dead channels */
-static void
-channel_garbage_collect(Channel *c)
-{
-	if (c == NULL)
-		return;
-	if (c->detach_user != NULL) {
-		if (!chan_is_dead(c, 0))
-			return;
-		debug("channel %d: gc: notify user", c->self);
-		c->detach_user(c->self, NULL);
-		/* if we still have a callback */
-		if (c->detach_user != NULL)
-			return;
-		debug("channel %d: gc: user detached", c->self);
-	}
-	if (!chan_is_dead(c, 1))
-		return;
-	debug("channel %d: garbage collecting", c->self);
-	channel_free(c);
-}
-
-static void
-channel_handler(chan_fn *ftab[], fd_set * readset, fd_set * writeset)
-{
-	static int did_init = 0;
-	int i;
-	Channel *c;
-
-	if (!did_init) {
-		channel_handler_init();
-		did_init = 1;
-	}
-	for (i = 0; i < channels_alloc; i++) {
-		c = channels[i];
-		if (c == NULL)
-			continue;
-		if (ftab[c->type] != NULL)
-			(*ftab[c->type])(c, readset, writeset);
-		channel_garbage_collect(c);
-	}
-}
-
-/*
- * Allocate/update select bitmasks and add any bits relevant to channels in
- * select bitmasks.
- */
-void
-channel_prepare_select(fd_set **readsetp, fd_set **writesetp, int *maxfdp,
-    int *nallocp, int rekeying)
-{
-	int n;
-	u_int sz;
-
-	n = MAX(*maxfdp, channel_max_fd);
-
-	sz = howmany(n+1, NFDBITS) * sizeof(fd_mask);
-	/* perhaps check sz < nalloc/2 and shrink? */
-	if (*readsetp == NULL || sz > *nallocp) {
-		*readsetp = xrealloc(*readsetp, sz);
-		*writesetp = xrealloc(*writesetp, sz);
-		*nallocp = sz;
-	}
-	*maxfdp = n;
-	memset(*readsetp, 0, sz);
-	memset(*writesetp, 0, sz);
-
-	if (!rekeying)
-		channel_handler(channel_pre, *readsetp, *writesetp);
-}
-
-/*
- * After select, perform any appropriate operations for channels which have
- * events pending.
- */
-void
-channel_after_select(fd_set * readset, fd_set * writeset)
-{
-	channel_handler(channel_post, readset, writeset);
-}
-
-
-/* If there is data to send to the connection, enqueue some of it now. */
-
-void
-channel_output_poll(void)
-{
-	Channel *c;
-	int i;
-	u_int len;
-
-	for (i = 0; i < channels_alloc; i++) {
-		c = channels[i];
-		if (c == NULL)
-			continue;
-
-		/*
-		 * We are only interested in channels that can have buffered
-		 * incoming data.
-		 */
-		if (compat13) {
-			if (c->type != SSH_CHANNEL_OPEN &&
-			    c->type != SSH_CHANNEL_INPUT_DRAINING)
-				continue;
-		} else {
-			if (c->type != SSH_CHANNEL_OPEN)
-				continue;
-		}
-		if (compat20 &&
-		    (c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD))) {
-			/* XXX is this true? */
-			debug3("channel %d: will not send data after close", c->self);
-			continue;
-		}
-
-		/* Get the amount of buffered data for this channel. */
-		if ((c->istate == CHAN_INPUT_OPEN ||
-		    c->istate == CHAN_INPUT_WAIT_DRAIN) &&
-		    (len = buffer_len(&c->input)) > 0) {
-			/*
-			 * Send some data for the other side over the secure
-			 * connection.
-			 */
-			if (compat20) {
-				if (len > c->remote_window)
-					len = c->remote_window;
-				if (len > c->remote_maxpacket)
-					len = c->remote_maxpacket;
-			} else {
-				if (packet_is_interactive()) {
-					if (len > 1024)
-						len = 512;
-				} else {
-					/* Keep the packets at reasonable size. */
-					if (len > packet_get_maxsize()/2)
-						len = packet_get_maxsize()/2;
-				}
-			}
-			if (len > 0) {
-				packet_start(compat20 ?
-				    SSH2_MSG_CHANNEL_DATA : SSH_MSG_CHANNEL_DATA);
-				packet_put_int(c->remote_id);
-				packet_put_string(buffer_ptr(&c->input), len);
-				packet_send();
-				buffer_consume(&c->input, len);
-				c->remote_window -= len;
-			}
-		} else if (c->istate == CHAN_INPUT_WAIT_DRAIN) {
-			if (compat13)
-				fatal("cannot happen: istate == INPUT_WAIT_DRAIN for proto 1.3");
-			/*
-			 * input-buffer is empty and read-socket shutdown:
-			 * tell peer, that we will not send more data: send IEOF.
-			 * hack for extended data: delay EOF if EFD still in use.
-			 */
-			if (CHANNEL_EFD_INPUT_ACTIVE(c))
-			       debug2("channel %d: ibuf_empty delayed efd %d/(%d)",
-				   c->self, c->efd, buffer_len(&c->extended));
-			else
-				chan_ibuf_empty(c);
-		}
-		/* Send extended data, i.e. stderr */
-		if (compat20 &&
-		    !(c->flags & CHAN_EOF_SENT) &&
-		    c->remote_window > 0 &&
-		    (len = buffer_len(&c->extended)) > 0 &&
-		    c->extended_usage == CHAN_EXTENDED_READ) {
-			debug2("channel %d: rwin %u elen %u euse %d",
-			    c->self, c->remote_window, buffer_len(&c->extended),
-			    c->extended_usage);
-			if (len > c->remote_window)
-				len = c->remote_window;
-			if (len > c->remote_maxpacket)
-				len = c->remote_maxpacket;
-			packet_start(SSH2_MSG_CHANNEL_EXTENDED_DATA);
-			packet_put_int(c->remote_id);
-			packet_put_int(SSH2_EXTENDED_DATA_STDERR);
-			packet_put_string(buffer_ptr(&c->extended), len);
-			packet_send();
-			buffer_consume(&c->extended, len);
-			c->remote_window -= len;
-			debug2("channel %d: sent ext data %d", c->self, len);
-		}
-	}
-}
-
-
-/* -- protocol input */
-
-void
-channel_input_data(int type, u_int32_t seq, void *ctxt)
-{
-	int id;
-	char *data;
-	u_int data_len;
-	Channel *c;
-
-	/* Get the channel number and verify it. */
-	id = packet_get_int();
-	c = channel_lookup(id);
-	if (c == NULL)
-		packet_disconnect("Received data for nonexistent channel %d.", id);
-
-	/* Ignore any data for non-open channels (might happen on close) */
-	if (c->type != SSH_CHANNEL_OPEN &&
-	    c->type != SSH_CHANNEL_X11_OPEN)
-		return;
-
-	/* same for protocol 1.5 if output end is no longer open */
-	if (!compat13 && c->ostate != CHAN_OUTPUT_OPEN)
-		return;
-
-	/* Get the data. */
-	data = packet_get_string(&data_len);
-
-	if (compat20) {
-		if (data_len > c->local_maxpacket) {
-			log("channel %d: rcvd big packet %d, maxpack %d",
-			    c->self, data_len, c->local_maxpacket);
-		}
-		if (data_len > c->local_window) {
-			log("channel %d: rcvd too much data %d, win %d",
-			    c->self, data_len, c->local_window);
-			xfree(data);
-			return;
-		}
-		c->local_window -= data_len;
-	}
-	packet_check_eom();
-	buffer_append(&c->output, data, data_len);
-	xfree(data);
-}
-
-void
-channel_input_extended_data(int type, u_int32_t seq, void *ctxt)
-{
-	int id;
-	char *data;
-	u_int data_len, tcode;
-	Channel *c;
-
-	/* Get the channel number and verify it. */
-	id = packet_get_int();
-	c = channel_lookup(id);
-
-	if (c == NULL)
-		packet_disconnect("Received extended_data for bad channel %d.", id);
-	if (c->type != SSH_CHANNEL_OPEN) {
-		log("channel %d: ext data for non open", id);
-		return;
-	}
-	if (c->flags & CHAN_EOF_RCVD) {
-		if (datafellows & SSH_BUG_EXTEOF)
-			debug("channel %d: accepting ext data after eof", id);
-		else
-			packet_disconnect("Received extended_data after EOF "
-			    "on channel %d.", id);
-	}
-	tcode = packet_get_int();
-	if (c->efd == -1 ||
-	    c->extended_usage != CHAN_EXTENDED_WRITE ||
-	    tcode != SSH2_EXTENDED_DATA_STDERR) {
-		log("channel %d: bad ext data", c->self);
-		return;
-	}
-	data = packet_get_string(&data_len);
-	packet_check_eom();
-	if (data_len > c->local_window) {
-		log("channel %d: rcvd too much extended_data %d, win %d",
-		    c->self, data_len, c->local_window);
-		xfree(data);
-		return;
-	}
-	debug2("channel %d: rcvd ext data %d", c->self, data_len);
-	c->local_window -= data_len;
-	buffer_append(&c->extended, data, data_len);
-	xfree(data);
-}
-
-void
-channel_input_ieof(int type, u_int32_t seq, void *ctxt)
-{
-	int id;
-	Channel *c;
-
-	id = packet_get_int();
-	packet_check_eom();
-	c = channel_lookup(id);
-	if (c == NULL)
-		packet_disconnect("Received ieof for nonexistent channel %d.", id);
-	chan_rcvd_ieof(c);
-
-	/* XXX force input close */
-	if (c->force_drain && c->istate == CHAN_INPUT_OPEN) {
-		debug("channel %d: FORCE input drain", c->self);
-		c->istate = CHAN_INPUT_WAIT_DRAIN;
-		if (buffer_len(&c->input) == 0)
-			chan_ibuf_empty(c);
-	}
-
-}
-
-void
-channel_input_close(int type, u_int32_t seq, void *ctxt)
-{
-	int id;
-	Channel *c;
-
-	id = packet_get_int();
-	packet_check_eom();
-	c = channel_lookup(id);
-	if (c == NULL)
-		packet_disconnect("Received close for nonexistent channel %d.", id);
-
-	/*
-	 * Send a confirmation that we have closed the channel and no more
-	 * data is coming for it.
-	 */
-	packet_start(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION);
-	packet_put_int(c->remote_id);
-	packet_send();
-
-	/*
-	 * If the channel is in closed state, we have sent a close request,
-	 * and the other side will eventually respond with a confirmation.
-	 * Thus, we cannot free the channel here, because then there would be
-	 * no-one to receive the confirmation.  The channel gets freed when
-	 * the confirmation arrives.
-	 */
-	if (c->type != SSH_CHANNEL_CLOSED) {
-		/*
-		 * Not a closed channel - mark it as draining, which will
-		 * cause it to be freed later.
-		 */
-		buffer_clear(&c->input);
-		c->type = SSH_CHANNEL_OUTPUT_DRAINING;
-	}
-}
-
-/* proto version 1.5 overloads CLOSE_CONFIRMATION with OCLOSE */
-void
-channel_input_oclose(int type, u_int32_t seq, void *ctxt)
-{
-	int id = packet_get_int();
-	Channel *c = channel_lookup(id);
-
-	packet_check_eom();
-	if (c == NULL)
-		packet_disconnect("Received oclose for nonexistent channel %d.", id);
-	chan_rcvd_oclose(c);
-}
-
-void
-channel_input_close_confirmation(int type, u_int32_t seq, void *ctxt)
-{
-	int id = packet_get_int();
-	Channel *c = channel_lookup(id);
-
-	packet_check_eom();
-	if (c == NULL)
-		packet_disconnect("Received close confirmation for "
-		    "out-of-range channel %d.", id);
-	if (c->type != SSH_CHANNEL_CLOSED)
-		packet_disconnect("Received close confirmation for "
-		    "non-closed channel %d (type %d).", id, c->type);
-	channel_free(c);
-}
-
-void
-channel_input_open_confirmation(int type, u_int32_t seq, void *ctxt)
-{
-	int id, remote_id;
-	Channel *c;
-
-	id = packet_get_int();
-	c = channel_lookup(id);
-
-	if (c==NULL || c->type != SSH_CHANNEL_OPENING)
-		packet_disconnect("Received open confirmation for "
-		    "non-opening channel %d.", id);
-	remote_id = packet_get_int();
-	/* Record the remote channel number and mark that the channel is now open. */
-	c->remote_id = remote_id;
-	c->type = SSH_CHANNEL_OPEN;
-
-	if (compat20) {
-		c->remote_window = packet_get_int();
-		c->remote_maxpacket = packet_get_int();
-		if (c->confirm) {
-			debug2("callback start");
-			c->confirm(c->self, NULL);
-			debug2("callback done");
-		}
-		debug("channel %d: open confirm rwindow %u rmax %u", c->self,
-		    c->remote_window, c->remote_maxpacket);
-	}
-	packet_check_eom();
-}
-
-static char *
-reason2txt(int reason)
-{
-	switch (reason) {
-	case SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED:
-		return "administratively prohibited";
-	case SSH2_OPEN_CONNECT_FAILED:
-		return "connect failed";
-	case SSH2_OPEN_UNKNOWN_CHANNEL_TYPE:
-		return "unknown channel type";
-	case SSH2_OPEN_RESOURCE_SHORTAGE:
-		return "resource shortage";
-	}
-	return "unknown reason";
-}
-
-void
-channel_input_open_failure(int type, u_int32_t seq, void *ctxt)
-{
-	int id, reason;
-	char *msg = NULL, *lang = NULL;
-	Channel *c;
-
-	id = packet_get_int();
-	c = channel_lookup(id);
-
-	if (c==NULL || c->type != SSH_CHANNEL_OPENING)
-		packet_disconnect("Received open failure for "
-		    "non-opening channel %d.", id);
-	if (compat20) {
-		reason = packet_get_int();
-		if (!(datafellows & SSH_BUG_OPENFAILURE)) {
-			msg  = packet_get_string(NULL);
-			lang = packet_get_string(NULL);
-		}
-		log("channel %d: open failed: %s%s%s", id,
-		    reason2txt(reason), msg ? ": ": "", msg ? msg : "");
-		if (msg != NULL)
-			xfree(msg);
-		if (lang != NULL)
-			xfree(lang);
-	}
-	packet_check_eom();
-	/* Free the channel.  This will also close the socket. */
-	channel_free(c);
-}
-
-void
-channel_input_window_adjust(int type, u_int32_t seq, void *ctxt)
-{
-	Channel *c;
-	int id;
-	u_int adjust;
-
-	if (!compat20)
-		return;
-
-	/* Get the channel number and verify it. */
-	id = packet_get_int();
-	c = channel_lookup(id);
-
-	if (c == NULL || c->type != SSH_CHANNEL_OPEN) {
-		log("Received window adjust for "
-		    "non-open channel %d.", id);
-		return;
-	}
-	adjust = packet_get_int();
-	packet_check_eom();
-	debug2("channel %d: rcvd adjust %u", id, adjust);
-	c->remote_window += adjust;
-}
-
-void
-channel_input_port_open(int type, u_int32_t seq, void *ctxt)
-{
-	Channel *c = NULL;
-	u_short host_port;
-	char *host, *originator_string;
-	int remote_id, sock = -1;
-
-	remote_id = packet_get_int();
-	host = packet_get_string(NULL);
-	host_port = packet_get_int();
-
-	if (packet_get_protocol_flags() & SSH_PROTOFLAG_HOST_IN_FWD_OPEN) {
-		originator_string = packet_get_string(NULL);
-	} else {
-		originator_string = xstrdup("unknown (remote did not supply name)");
-	}
-	packet_check_eom();
-	sock = channel_connect_to(host, host_port);
-	if (sock != -1) {
-		c = channel_new("connected socket",
-		    SSH_CHANNEL_CONNECTING, sock, sock, -1, 0, 0, 0,
-		    originator_string, 1);
-		c->remote_id = remote_id;
-	}
-	if (c == NULL) {
-		xfree(originator_string);
-		packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
-		packet_put_int(remote_id);
-		packet_send();
-	}
-	xfree(host);
-}
-
-
-/* -- tcp forwarding */
-
-void
-channel_set_af(int af)
-{
-	IPv4or6 = af;
-}
-
-static int
-channel_setup_fwd_listener(int type, const char *listen_addr, u_short listen_port,
-    const char *host_to_connect, u_short port_to_connect, int gateway_ports)
-{
-	Channel *c;
-	int success, sock, on = 1;
-	struct addrinfo hints, *ai, *aitop;
-	const char *host;
-	char ntop[NI_MAXHOST], strport[NI_MAXSERV];
-
-	success = 0;
-	host = (type == SSH_CHANNEL_RPORT_LISTENER) ?
-	    listen_addr : host_to_connect;
-
-	if (host == NULL) {
-		error("No forward host name.");
-		return success;
-	}
-	if (strlen(host) > SSH_CHANNEL_PATH_LEN - 1) {
-		error("Forward host name too long.");
-		return success;
-	}
-
-	/*
-	 * getaddrinfo returns a loopback address if the hostname is
-	 * set to NULL and hints.ai_flags is not AI_PASSIVE
-	 */
-	memset(&hints, 0, sizeof(hints));
-	hints.ai_family = IPv4or6;
-	hints.ai_flags = gateway_ports ? AI_PASSIVE : 0;
-	hints.ai_socktype = SOCK_STREAM;
-	snprintf(strport, sizeof strport, "%d", listen_port);
-	if (getaddrinfo(NULL, strport, &hints, &aitop) != 0)
-		packet_disconnect("getaddrinfo: fatal error");
-
-	for (ai = aitop; ai; ai = ai->ai_next) {
-		if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
-			continue;
-		if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop),
-		    strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
-			error("channel_setup_fwd_listener: getnameinfo failed");
-			continue;
-		}
-		/* Create a port to listen for the host. */
-		sock = socket(ai->ai_family, SOCK_STREAM, 0);
-		if (sock < 0) {
-			/* this is no error since kernel may not support ipv6 */
-			verbose("socket: %.100s", strerror(errno));
-			continue;
-		}
-		/*
-		 * Set socket options.
-		 * Allow local port reuse in TIME_WAIT.
-		 */
-		if (setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &on,
-		    sizeof(on)) == -1)
-			error("setsockopt SO_REUSEADDR: %s", strerror(errno));
-
-		debug("Local forwarding listening on %s port %s.", ntop, strport);
-
-		/* Bind the socket to the address. */
-		if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
-			/* address can be in use ipv6 address is already bound */
-			if (!ai->ai_next)
-				error("bind: %.100s", strerror(errno));
-			else
-				verbose("bind: %.100s", strerror(errno));
-
-			close(sock);
-			continue;
-		}
-		/* Start listening for connections on the socket. */
-		if (listen(sock, 5) < 0) {
-			error("listen: %.100s", strerror(errno));
-			close(sock);
-			continue;
-		}
-		/* Allocate a channel number for the socket. */
-		c = channel_new("port listener", type, sock, sock, -1,
-		    CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
-		    0, xstrdup("port listener"), 1);
-		strlcpy(c->path, host, sizeof(c->path));
-		c->host_port = port_to_connect;
-		c->listening_port = listen_port;
-		success = 1;
-	}
-	if (success == 0)
-		error("channel_setup_fwd_listener: cannot listen to port: %d",
-		    listen_port);
-	freeaddrinfo(aitop);
-	return success;
-}
-
-/* protocol local port fwd, used by ssh (and sshd in v1) */
-int
-channel_setup_local_fwd_listener(u_short listen_port,
-    const char *host_to_connect, u_short port_to_connect, int gateway_ports)
-{
-	return channel_setup_fwd_listener(SSH_CHANNEL_PORT_LISTENER,
-	    NULL, listen_port, host_to_connect, port_to_connect, gateway_ports);
-}
-
-/* protocol v2 remote port fwd, used by sshd */
-int
-channel_setup_remote_fwd_listener(const char *listen_address,
-    u_short listen_port, int gateway_ports)
-{
-	return channel_setup_fwd_listener(SSH_CHANNEL_RPORT_LISTENER,
-	    listen_address, listen_port, NULL, 0, gateway_ports);
-}
-
-/*
- * Initiate forwarding of connections to port "port" on remote host through
- * the secure channel to host:port from local side.
- */
-
-void
-channel_request_remote_forwarding(u_short listen_port,
-    const char *host_to_connect, u_short port_to_connect)
-{
-	int type, success = 0;
-
-	/* Record locally that connection to this host/port is permitted. */
-	if (num_permitted_opens >= SSH_MAX_FORWARDS_PER_DIRECTION)
-		fatal("channel_request_remote_forwarding: too many forwards");
-
-	/* Send the forward request to the remote side. */
-	if (compat20) {
-		const char *address_to_bind = "0.0.0.0";
-		packet_start(SSH2_MSG_GLOBAL_REQUEST);
-		packet_put_cstring("tcpip-forward");
-		packet_put_char(1);			/* boolean: want reply */
-		packet_put_cstring(address_to_bind);
-		packet_put_int(listen_port);
-		packet_send();
-		packet_write_wait();
-		/* Assume that server accepts the request */
-		success = 1;
-	} else {
-		packet_start(SSH_CMSG_PORT_FORWARD_REQUEST);
-		packet_put_int(listen_port);
-		packet_put_cstring(host_to_connect);
-		packet_put_int(port_to_connect);
-		packet_send();
-		packet_write_wait();
-
-		/* Wait for response from the remote side. */
-		type = packet_read();
-		switch (type) {
-		case SSH_SMSG_SUCCESS:
-			success = 1;
-			break;
-		case SSH_SMSG_FAILURE:
-			log("Warning: Server denied remote port forwarding.");
-			break;
-		default:
-			/* Unknown packet */
-			packet_disconnect("Protocol error for port forward request:"
-			    "received packet type %d.", type);
-		}
-	}
-	if (success) {
-		permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host_to_connect);
-		permitted_opens[num_permitted_opens].port_to_connect = port_to_connect;
-		permitted_opens[num_permitted_opens].listen_port = listen_port;
-		num_permitted_opens++;
-	}
-}
-
-/*
- * This is called after receiving CHANNEL_FORWARDING_REQUEST.  This initates
- * listening for the port, and sends back a success reply (or disconnect
- * message if there was an error).  This never returns if there was an error.
- */
-
-void
-channel_input_port_forward_request(int is_root, int gateway_ports)
-{
-	u_short port, host_port;
-	char *hostname;
-
-	/* Get arguments from the packet. */
-	port = packet_get_int();
-	hostname = packet_get_string(NULL);
-	host_port = packet_get_int();
-
-#ifndef HAVE_CYGWIN
-	/*
-	 * Check that an unprivileged user is not trying to forward a
-	 * privileged port.
-	 */
-	if (port < IPPORT_RESERVED && !is_root)
-		packet_disconnect("Requested forwarding of port %d but user is not root.",
-				  port);
-#endif
-	/* Initiate forwarding */
-	channel_setup_local_fwd_listener(port, hostname, host_port, gateway_ports);
-
-	/* Free the argument string. */
-	xfree(hostname);
-}
-
-/*
- * Permits opening to any host/port if permitted_opens[] is empty.  This is
- * usually called by the server, because the user could connect to any port
- * anyway, and the server has no way to know but to trust the client anyway.
- */
-void
-channel_permit_all_opens(void)
-{
-	if (num_permitted_opens == 0)
-		all_opens_permitted = 1;
-}
-
-void
-channel_add_permitted_opens(char *host, int port)
-{
-	if (num_permitted_opens >= SSH_MAX_FORWARDS_PER_DIRECTION)
-		fatal("channel_request_remote_forwarding: too many forwards");
-	debug("allow port forwarding to host %s port %d", host, port);
-
-	permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host);
-	permitted_opens[num_permitted_opens].port_to_connect = port;
-	num_permitted_opens++;
-
-	all_opens_permitted = 0;
-}
-
-void
-channel_clear_permitted_opens(void)
-{
-	int i;
-
-	for (i = 0; i < num_permitted_opens; i++)
-		xfree(permitted_opens[i].host_to_connect);
-	num_permitted_opens = 0;
-
-}
-
-
-/* return socket to remote host, port */
-static int
-connect_to(const char *host, u_short port)
-{
-	struct addrinfo hints, *ai, *aitop;
-	char ntop[NI_MAXHOST], strport[NI_MAXSERV];
-	int gaierr;
-	int sock = -1;
-
-	memset(&hints, 0, sizeof(hints));
-	hints.ai_family = IPv4or6;
-	hints.ai_socktype = SOCK_STREAM;
-	snprintf(strport, sizeof strport, "%d", port);
-	if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0) {
-		error("connect_to %.100s: unknown host (%s)", host,
-		    gai_strerror(gaierr));
-		return -1;
-	}
-	for (ai = aitop; ai; ai = ai->ai_next) {
-		if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
-			continue;
-		if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop),
-		    strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
-			error("connect_to: getnameinfo failed");
-			continue;
-		}
-		sock = socket(ai->ai_family, SOCK_STREAM, 0);
-		if (sock < 0) {
-			if (ai->ai_next == NULL)
-				error("socket: %.100s", strerror(errno));
-			else
-				verbose("socket: %.100s", strerror(errno));
-			continue;
-		}
-		if (fcntl(sock, F_SETFL, O_NONBLOCK) < 0)
-			fatal("connect_to: F_SETFL: %s", strerror(errno));
-		if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0 &&
-		    errno != EINPROGRESS) {
-			error("connect_to %.100s port %s: %.100s", ntop, strport,
-			    strerror(errno));
-			close(sock);
-			continue;	/* fail -- try next */
-		}
-		break; /* success */
-
-	}
-	freeaddrinfo(aitop);
-	if (!ai) {
-		error("connect_to %.100s port %d: failed.", host, port);
-		return -1;
-	}
-	/* success */
-	set_nodelay(sock);
-	return sock;
-}
-
-int
-channel_connect_by_listen_address(u_short listen_port)
-{
-	int i;
-
-	for (i = 0; i < num_permitted_opens; i++)
-		if (permitted_opens[i].listen_port == listen_port)
-			return connect_to(
-			    permitted_opens[i].host_to_connect,
-			    permitted_opens[i].port_to_connect);
-	error("WARNING: Server requests forwarding for unknown listen_port %d",
-	    listen_port);
-	return -1;
-}
-
-/* Check if connecting to that port is permitted and connect. */
-int
-channel_connect_to(const char *host, u_short port)
-{
-	int i, permit;
-
-	permit = all_opens_permitted;
-	if (!permit) {
-		for (i = 0; i < num_permitted_opens; i++)
-			if (permitted_opens[i].port_to_connect == port &&
-			    strcmp(permitted_opens[i].host_to_connect, host) == 0)
-				permit = 1;
-
-	}
-	if (!permit) {
-		log("Received request to connect to host %.100s port %d, "
-		    "but the request was denied.", host, port);
-		return -1;
-	}
-	return connect_to(host, port);
-}
-
-/* -- X11 forwarding */
-
-/*
- * Creates an internet domain socket for listening for X11 connections.
- * Returns 0 and a suitable display number for the DISPLAY variable
- * stored in display_numberp , or -1 if an error occurs.
- */
-int
-x11_create_display_inet(int x11_display_offset, int x11_use_localhost,
-    int single_connection, u_int *display_numberp)
-{
-	Channel *nc = NULL;
-	int display_number, sock;
-	u_short port;
-	struct addrinfo hints, *ai, *aitop;
-	char strport[NI_MAXSERV];
-	int gaierr, n, num_socks = 0, socks[NUM_SOCKS];
-
-	for (display_number = x11_display_offset;
-	    display_number < MAX_DISPLAYS;
-	    display_number++) {
-		port = 6000 + display_number;
-		memset(&hints, 0, sizeof(hints));
-		hints.ai_family = IPv4or6;
-		hints.ai_flags = x11_use_localhost ? 0: AI_PASSIVE;
-		hints.ai_socktype = SOCK_STREAM;
-		snprintf(strport, sizeof strport, "%d", port);
-		if ((gaierr = getaddrinfo(NULL, strport, &hints, &aitop)) != 0) {
-			error("getaddrinfo: %.100s", gai_strerror(gaierr));
-			return -1;
-		}
-		for (ai = aitop; ai; ai = ai->ai_next) {
-			if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
-				continue;
-			sock = socket(ai->ai_family, SOCK_STREAM, 0);
-			if (sock < 0) {
-				if ((errno != EINVAL) && (errno != EAFNOSUPPORT)) {
-					error("socket: %.100s", strerror(errno));
-					return -1;
-				} else {
-					debug("x11_create_display_inet: Socket family %d not supported",
-						 ai->ai_family);
-					continue;
-				}
-			}
-#ifdef IPV6_V6ONLY
-			if (ai->ai_family == AF_INET6) {
-				int on = 1;
-				if (setsockopt(sock, IPPROTO_IPV6, IPV6_V6ONLY, &on, sizeof(on)) < 0)
-					error("setsockopt IPV6_V6ONLY: %.100s", strerror(errno));
-			}
-#endif
-			if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
-				debug("bind port %d: %.100s", port, strerror(errno));
-				close(sock);
-
-				if (ai->ai_next)
-					continue;
-
-				for (n = 0; n < num_socks; n++) {
-					close(socks[n]);
-				}
-				num_socks = 0;
-				break;
-			}
-			socks[num_socks++] = sock;
-#ifndef DONT_TRY_OTHER_AF
-			if (num_socks == NUM_SOCKS)
-				break;
-#else
-			if (x11_use_localhost) {
-				if (num_socks == NUM_SOCKS)
-					break;
-			} else {
-				break;
-			}
-#endif
-		}
-		freeaddrinfo(aitop);
-		if (num_socks > 0)
-			break;
-	}
-	if (display_number >= MAX_DISPLAYS) {
-		error("Failed to allocate internet-domain X11 display socket.");
-		return -1;
-	}
-	/* Start listening for connections on the socket. */
-	for (n = 0; n < num_socks; n++) {
-		sock = socks[n];
-		if (listen(sock, 5) < 0) {
-			error("listen: %.100s", strerror(errno));
-			close(sock);
-			return -1;
-		}
-	}
-
-	/* Allocate a channel for each socket. */
-	for (n = 0; n < num_socks; n++) {
-		sock = socks[n];
-		nc = channel_new("x11 listener",
-		    SSH_CHANNEL_X11_LISTENER, sock, sock, -1,
-		    CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
-		    0, xstrdup("X11 inet listener"), 1);
-		nc->single_connection = single_connection;
-	}
-
-	/* Return the display number for the DISPLAY environment variable. */
-	*display_numberp = display_number;
-	return (0);
-}
-
-static int
-connect_local_xsocket(u_int dnr)
-{
-	int sock;
-	struct sockaddr_un addr;
-
-	sock = socket(AF_UNIX, SOCK_STREAM, 0);
-	if (sock < 0)
-		error("socket: %.100s", strerror(errno));
-	memset(&addr, 0, sizeof(addr));
-	addr.sun_family = AF_UNIX;
-	snprintf(addr.sun_path, sizeof addr.sun_path, _PATH_UNIX_X, dnr);
-	if (connect(sock, (struct sockaddr *) & addr, sizeof(addr)) == 0)
-		return sock;
-	close(sock);
-	error("connect %.100s: %.100s", addr.sun_path, strerror(errno));
-	return -1;
-}
-
-int
-x11_connect_display(void)
-{
-	int display_number, sock = 0;
-	const char *display;
-	char buf[1024], *cp;
-	struct addrinfo hints, *ai, *aitop;
-	char strport[NI_MAXSERV];
-	int gaierr;
-
-	/* Try to open a socket for the local X server. */
-	display = getenv("DISPLAY");
-	if (!display) {
-		error("DISPLAY not set.");
-		return -1;
-	}
-	/*
-	 * Now we decode the value of the DISPLAY variable and make a
-	 * connection to the real X server.
-	 */
-
-	/*
-	 * Check if it is a unix domain socket.  Unix domain displays are in
-	 * one of the following formats: unix:d[.s], :d[.s], ::d[.s]
-	 */
-	if (strncmp(display, "unix:", 5) == 0 ||
-	    display[0] == ':') {
-		/* Connect to the unix domain socket. */
-		if (sscanf(strrchr(display, ':') + 1, "%d", &display_number) != 1) {
-			error("Could not parse display number from DISPLAY: %.100s",
-			    display);
-			return -1;
-		}
-		/* Create a socket. */
-		sock = connect_local_xsocket(display_number);
-		if (sock < 0)
-			return -1;
-
-		/* OK, we now have a connection to the display. */
-		return sock;
-	}
-	/*
-	 * Connect to an inet socket.  The DISPLAY value is supposedly
-	 * hostname:d[.s], where hostname may also be numeric IP address.
-	 */
-	strlcpy(buf, display, sizeof(buf));
-	cp = strchr(buf, ':');
-	if (!cp) {
-		error("Could not find ':' in DISPLAY: %.100s", display);
-		return -1;
-	}
-	*cp = 0;
-	/* buf now contains the host name.  But first we parse the display number. */
-	if (sscanf(cp + 1, "%d", &display_number) != 1) {
-		error("Could not parse display number from DISPLAY: %.100s",
-		    display);
-		return -1;
-	}
-
-	/* Look up the host address */
-	memset(&hints, 0, sizeof(hints));
-	hints.ai_family = IPv4or6;
-	hints.ai_socktype = SOCK_STREAM;
-	snprintf(strport, sizeof strport, "%d", 6000 + display_number);
-	if ((gaierr = getaddrinfo(buf, strport, &hints, &aitop)) != 0) {
-		error("%.100s: unknown host. (%s)", buf, gai_strerror(gaierr));
-		return -1;
-	}
-	for (ai = aitop; ai; ai = ai->ai_next) {
-		/* Create a socket. */
-		sock = socket(ai->ai_family, SOCK_STREAM, 0);
-		if (sock < 0) {
-			debug("socket: %.100s", strerror(errno));
-			continue;
-		}
-		/* Connect it to the display. */
-		if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
-			debug("connect %.100s port %d: %.100s", buf,
-			    6000 + display_number, strerror(errno));
-			close(sock);
-			continue;
-		}
-		/* Success */
-		break;
-	}
-	freeaddrinfo(aitop);
-	if (!ai) {
-		error("connect %.100s port %d: %.100s", buf, 6000 + display_number,
-		    strerror(errno));
-		return -1;
-	}
-	set_nodelay(sock);
-	return sock;
-}
-
-/*
- * This is called when SSH_SMSG_X11_OPEN is received.  The packet contains
- * the remote channel number.  We should do whatever we want, and respond
- * with either SSH_MSG_OPEN_CONFIRMATION or SSH_MSG_OPEN_FAILURE.
- */
-
-void
-x11_input_open(int type, u_int32_t seq, void *ctxt)
-{
-	Channel *c = NULL;
-	int remote_id, sock = 0;
-	char *remote_host;
-
-	debug("Received X11 open request.");
-
-	remote_id = packet_get_int();
-
-	if (packet_get_protocol_flags() & SSH_PROTOFLAG_HOST_IN_FWD_OPEN) {
-		remote_host = packet_get_string(NULL);
-	} else {
-		remote_host = xstrdup("unknown (remote did not supply name)");
-	}
-	packet_check_eom();
-
-	/* Obtain a connection to the real X display. */
-	sock = x11_connect_display();
-	if (sock != -1) {
-		/* Allocate a channel for this connection. */
-		c = channel_new("connected x11 socket",
-		    SSH_CHANNEL_X11_OPEN, sock, sock, -1, 0, 0, 0,
-		    remote_host, 1);
-		c->remote_id = remote_id;
-		c->force_drain = 1;
-	}
-	if (c == NULL) {
-		/* Send refusal to the remote host. */
-		packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
-		packet_put_int(remote_id);
-		xfree(remote_host);
-	} else {
-		/* Send a confirmation to the remote host. */
-		packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
-		packet_put_int(remote_id);
-		packet_put_int(c->self);
-	}
-	packet_send();
-}
-
-/* dummy protocol handler that denies SSH-1 requests (agent/x11) */
-void
-deny_input_open(int type, u_int32_t seq, void *ctxt)
-{
-	int rchan = packet_get_int();
-
-	switch (type) {
-	case SSH_SMSG_AGENT_OPEN:
-		error("Warning: ssh server tried agent forwarding.");
-		break;
-	case SSH_SMSG_X11_OPEN:
-		error("Warning: ssh server tried X11 forwarding.");
-		break;
-	default:
-		error("deny_input_open: type %d", type);
-		break;
-	}
-	error("Warning: this is probably a break in attempt by a malicious server.");
-	packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
-	packet_put_int(rchan);
-	packet_send();
-}
-
-/*
- * Requests forwarding of X11 connections, generates fake authentication
- * data, and enables authentication spoofing.
- * This should be called in the client only.
- */
-void
-x11_request_forwarding_with_spoofing(int client_session_id,
-    const char *proto, const char *data)
-{
-	u_int data_len = (u_int) strlen(data) / 2;
-	u_int i, value, len;
-	char *new_data;
-	int screen_number;
-	const char *cp;
-	u_int32_t rand = 0;
-
-	cp = getenv("DISPLAY");
-	if (cp)
-		cp = strchr(cp, ':');
-	if (cp)
-		cp = strchr(cp, '.');
-	if (cp)
-		screen_number = atoi(cp + 1);
-	else
-		screen_number = 0;
-
-	/* Save protocol name. */
-	x11_saved_proto = xstrdup(proto);
-
-	/*
-	 * Extract real authentication data and generate fake data of the
-	 * same length.
-	 */
-	x11_saved_data = xmalloc(data_len);
-	x11_fake_data = xmalloc(data_len);
-	for (i = 0; i < data_len; i++) {
-		if (sscanf(data + 2 * i, "%2x", &value) != 1)
-			fatal("x11_request_forwarding: bad authentication data: %.100s", data);
-		if (i % 4 == 0)
-			rand = arc4random();
-		x11_saved_data[i] = value;
-		x11_fake_data[i] = rand & 0xff;
-		rand >>= 8;
-	}
-	x11_saved_data_len = data_len;
-	x11_fake_data_len = data_len;
-
-	/* Convert the fake data into hex. */
-	len = 2 * data_len + 1;
-	new_data = xmalloc(len);
-	for (i = 0; i < data_len; i++)
-		snprintf(new_data + 2 * i, len - 2 * i,
-		    "%02x", (u_char) x11_fake_data[i]);
-
-	/* Send the request packet. */
-	if (compat20) {
-		channel_request_start(client_session_id, "x11-req", 0);
-		packet_put_char(0);	/* XXX bool single connection */
-	} else {
-		packet_start(SSH_CMSG_X11_REQUEST_FORWARDING);
-	}
-	packet_put_cstring(proto);
-	packet_put_cstring(new_data);
-	packet_put_int(screen_number);
-	packet_send();
-	packet_write_wait();
-	xfree(new_data);
-}
-
-
-/* -- agent forwarding */
-
-/* Sends a message to the server to request authentication fd forwarding. */
-
-void
-auth_request_forwarding(void)
-{
-	packet_start(SSH_CMSG_AGENT_REQUEST_FORWARDING);
-	packet_send();
-	packet_write_wait();
-}
-
-/* This is called to process an SSH_SMSG_AGENT_OPEN message. */
-
-void
-auth_input_open_request(int type, u_int32_t seq, void *ctxt)
-{
-	Channel *c = NULL;
-	int remote_id, sock;
-	char *name;
-
-	/* Read the remote channel number from the message. */
-	remote_id = packet_get_int();
-	packet_check_eom();
-
-	/*
-	 * Get a connection to the local authentication agent (this may again
-	 * get forwarded).
-	 */
-	sock = ssh_get_authentication_socket();
-
-	/*
-	 * If we could not connect the agent, send an error message back to
-	 * the server. This should never happen unless the agent dies,
-	 * because authentication forwarding is only enabled if we have an
-	 * agent.
-	 */
-	if (sock >= 0) {
-		name = xstrdup("authentication agent connection");
-		c = channel_new("", SSH_CHANNEL_OPEN, sock, sock,
-		    -1, 0, 0, 0, name, 1);
-		c->remote_id = remote_id;
-		c->force_drain = 1;
-	}
-	if (c == NULL) {
-		packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
-		packet_put_int(remote_id);
-	} else {
-		/* Send a confirmation to the remote host. */
-		debug("Forwarding authentication connection.");
-		packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
-		packet_put_int(remote_id);
-		packet_put_int(c->self);
-	}
-	packet_send();
-}
diff --git a/crypto/openssh/channels.h b/crypto/openssh/channels.h
deleted file mode 100644
index bd2e92589c59..000000000000
--- a/crypto/openssh/channels.h
+++ /dev/null
@@ -1,234 +0,0 @@
-/*	$OpenBSD: channels.h,v 1.70 2002/06/24 14:33:27 markus Exp $	*/
-
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-/*
- * Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef CHANNEL_H
-#define CHANNEL_H
-
-#include "buffer.h"
-
-/* Definitions for channel types. */
-#define SSH_CHANNEL_X11_LISTENER	1	/* Listening for inet X11 conn. */
-#define SSH_CHANNEL_PORT_LISTENER	2	/* Listening on a port. */
-#define SSH_CHANNEL_OPENING		3	/* waiting for confirmation */
-#define SSH_CHANNEL_OPEN		4	/* normal open two-way channel */
-#define SSH_CHANNEL_CLOSED		5	/* waiting for close confirmation */
-#define SSH_CHANNEL_AUTH_SOCKET		6	/* authentication socket */
-#define SSH_CHANNEL_X11_OPEN		7	/* reading first X11 packet */
-#define SSH_CHANNEL_INPUT_DRAINING	8	/* sending remaining data to conn */
-#define SSH_CHANNEL_OUTPUT_DRAINING	9	/* sending remaining data to app */
-#define SSH_CHANNEL_LARVAL		10	/* larval session */
-#define SSH_CHANNEL_RPORT_LISTENER	11	/* Listening to a R-style port  */
-#define SSH_CHANNEL_CONNECTING		12
-#define SSH_CHANNEL_DYNAMIC		13
-#define SSH_CHANNEL_ZOMBIE		14	/* Almost dead. */
-#define SSH_CHANNEL_MAX_TYPE		15
-
-#define SSH_CHANNEL_PATH_LEN		256
-
-struct Channel;
-typedef struct Channel Channel;
-
-typedef void channel_callback_fn(int, void *);
-typedef int channel_filter_fn(struct Channel *, char *, int);
-
-struct Channel {
-	int     type;		/* channel type/state */
-	int     self;		/* my own channel identifier */
-	int     remote_id;	/* channel identifier for remote peer */
-	u_int   istate;		/* input from channel (state of receive half) */
-	u_int   ostate;		/* output to channel  (state of transmit half) */
-	int     flags;		/* close sent/rcvd */
-	int     rfd;		/* read fd */
-	int     wfd;		/* write fd */
-	int     efd;		/* extended fd */
-	int     sock;		/* sock fd */
-	int     isatty;		/* rfd is a tty */
-	int     wfd_isatty;	/* wfd is a tty */
-	int     force_drain;	/* force close on iEOF */
-	int     delayed;		/* fdset hack */
-	Buffer  input;		/* data read from socket, to be sent over
-				 * encrypted connection */
-	Buffer  output;		/* data received over encrypted connection for
-				 * send on socket */
-	Buffer  extended;
-	char    path[SSH_CHANNEL_PATH_LEN];
-		/* path for unix domain sockets, or host name for forwards */
-	int     listening_port;	/* port being listened for forwards */
-	int     host_port;	/* remote port to connect for forwards */
-	char   *remote_name;	/* remote hostname */
-
-	u_int	remote_window;
-	u_int	remote_maxpacket;
-	u_int	local_window;
-	u_int	local_window_max;
-	u_int	local_consumed;
-	u_int	local_maxpacket;
-	int     extended_usage;
-	int	single_connection;
-
-	char   *ctype;		/* type */
-
-	/* callback */
-	channel_callback_fn	*confirm;
-	channel_callback_fn	*detach_user;
-
-	/* filter */
-	channel_filter_fn	*input_filter;
-};
-
-#define CHAN_EXTENDED_IGNORE		0
-#define CHAN_EXTENDED_READ		1
-#define CHAN_EXTENDED_WRITE		2
-
-/* default window/packet sizes for tcp/x11-fwd-channel */
-#define CHAN_SES_PACKET_DEFAULT	(32*1024)
-#define CHAN_SES_WINDOW_DEFAULT	(4*CHAN_SES_PACKET_DEFAULT)
-#define CHAN_TCP_PACKET_DEFAULT	(32*1024)
-#define CHAN_TCP_WINDOW_DEFAULT	(4*CHAN_TCP_PACKET_DEFAULT)
-#define CHAN_X11_PACKET_DEFAULT	(16*1024)
-#define CHAN_X11_WINDOW_DEFAULT	(4*CHAN_X11_PACKET_DEFAULT)
-
-/* possible input states */
-#define CHAN_INPUT_OPEN			0
-#define CHAN_INPUT_WAIT_DRAIN		1
-#define CHAN_INPUT_WAIT_OCLOSE		2
-#define CHAN_INPUT_CLOSED		3
-
-/* possible output states */
-#define CHAN_OUTPUT_OPEN		0
-#define CHAN_OUTPUT_WAIT_DRAIN		1
-#define CHAN_OUTPUT_WAIT_IEOF		2
-#define CHAN_OUTPUT_CLOSED		3
-
-#define CHAN_CLOSE_SENT			0x01
-#define CHAN_CLOSE_RCVD			0x02
-#define CHAN_EOF_SENT			0x04
-#define CHAN_EOF_RCVD			0x08
-
-/* check whether 'efd' is still in use */
-#define CHANNEL_EFD_INPUT_ACTIVE(c) \
-	(compat20 && c->extended_usage == CHAN_EXTENDED_READ && \
-	(c->efd != -1 || \
-	buffer_len(&c->extended) > 0))
-#define CHANNEL_EFD_OUTPUT_ACTIVE(c) \
-	(compat20 && c->extended_usage == CHAN_EXTENDED_WRITE && \
-	((c->efd != -1 && !(c->flags & (CHAN_EOF_RCVD|CHAN_CLOSE_RCVD))) || \
-	buffer_len(&c->extended) > 0))
-
-/* channel management */
-
-Channel	*channel_lookup(int);
-Channel *channel_new(char *, int, int, int, int, u_int, u_int, int, char *, int);
-void	 channel_set_fds(int, int, int, int, int, int, u_int);
-void	 channel_free(Channel *);
-void	 channel_free_all(void);
-void	 channel_stop_listening(void);
-
-void	 channel_send_open(int);
-void	 channel_request_start(int, char *, int);
-void	 channel_register_cleanup(int, channel_callback_fn *);
-void	 channel_register_confirm(int, channel_callback_fn *);
-void	 channel_register_filter(int, channel_filter_fn *);
-void	 channel_cancel_cleanup(int);
-int	 channel_close_fd(int *);
-
-/* protocol handler */
-
-void	 channel_input_close(int, u_int32_t, void *);
-void	 channel_input_close_confirmation(int, u_int32_t, void *);
-void	 channel_input_data(int, u_int32_t, void *);
-void	 channel_input_extended_data(int, u_int32_t, void *);
-void	 channel_input_ieof(int, u_int32_t, void *);
-void	 channel_input_oclose(int, u_int32_t, void *);
-void	 channel_input_open_confirmation(int, u_int32_t, void *);
-void	 channel_input_open_failure(int, u_int32_t, void *);
-void	 channel_input_port_open(int, u_int32_t, void *);
-void	 channel_input_window_adjust(int, u_int32_t, void *);
-
-/* file descriptor handling (read/write) */
-
-void	 channel_prepare_select(fd_set **, fd_set **, int *, int*, int);
-void     channel_after_select(fd_set *, fd_set *);
-void     channel_output_poll(void);
-
-int      channel_not_very_much_buffered_data(void);
-void     channel_close_all(void);
-int      channel_still_open(void);
-char	*channel_open_message(void);
-int	 channel_find_open(void);
-
-/* tcp forwarding */
-void	 channel_set_af(int af);
-void     channel_permit_all_opens(void);
-void	 channel_add_permitted_opens(char *, int);
-void	 channel_clear_permitted_opens(void);
-void     channel_input_port_forward_request(int, int);
-int	 channel_connect_to(const char *, u_short);
-int	 channel_connect_by_listen_address(u_short);
-void	 channel_request_remote_forwarding(u_short, const char *, u_short);
-int	 channel_setup_local_fwd_listener(u_short, const char *, u_short, int);
-int	 channel_setup_remote_fwd_listener(const char *, u_short, int);
-
-/* x11 forwarding */
-
-int	 x11_connect_display(void);
-int	 x11_create_display_inet(int, int, int, u_int *);
-void     x11_input_open(int, u_int32_t, void *);
-void	 x11_request_forwarding_with_spoofing(int, const char *, const char *);
-void	 deny_input_open(int, u_int32_t, void *);
-
-/* agent forwarding */
-
-void	 auth_request_forwarding(void);
-void	 auth_input_open_request(int, u_int32_t, void *);
-
-/* channel close */
-
-int	 chan_is_dead(Channel *, int);
-void	 chan_mark_dead(Channel *);
-
-/* channel events */
-
-void	 chan_rcvd_oclose(Channel *);
-void	 chan_read_failed(Channel *);
-void	 chan_ibuf_empty(Channel *);
-
-void	 chan_rcvd_ieof(Channel *);
-void	 chan_write_failed(Channel *);
-void	 chan_obuf_empty(Channel *);
-
-#endif
diff --git a/crypto/openssh/cipher.c b/crypto/openssh/cipher.c
deleted file mode 100644
index b5d38747ed80..000000000000
--- a/crypto/openssh/cipher.c
+++ /dev/null
@@ -1,740 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- *
- *
- * Copyright (c) 1999 Niels Provos.  All rights reserved.
- * Copyright (c) 1999, 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: cipher.c,v 1.62 2002/11/21 22:45:31 markus Exp $");
-
-#include "xmalloc.h"
-#include "log.h"
-#include "cipher.h"
-
-#include <openssl/md5.h>
-
-#if OPENSSL_VERSION_NUMBER < 0x00906000L
-#define SSH_OLD_EVP
-#define EVP_CIPHER_CTX_get_app_data(e)          ((e)->app_data)
-#endif
-
-#if OPENSSL_VERSION_NUMBER < 0x00907000L
-#include "rijndael.h"
-static const EVP_CIPHER *evp_rijndael(void);
-#endif
-static const EVP_CIPHER *evp_ssh1_3des(void);
-static const EVP_CIPHER *evp_ssh1_bf(void);
-
-struct Cipher {
-	char	*name;
-	int	number;		/* for ssh1 only */
-	u_int	block_size;
-	u_int	key_len;
-	const EVP_CIPHER	*(*evptype)(void);
-} ciphers[] = {
-	{ "none", 		SSH_CIPHER_NONE, 8, 0, EVP_enc_null },
-	{ "des", 		SSH_CIPHER_DES, 8, 8, EVP_des_cbc },
-	{ "3des", 		SSH_CIPHER_3DES, 8, 16, evp_ssh1_3des },
-	{ "blowfish", 		SSH_CIPHER_BLOWFISH, 8, 32, evp_ssh1_bf },
-
-	{ "3des-cbc", 		SSH_CIPHER_SSH2, 8, 24, EVP_des_ede3_cbc },
-	{ "blowfish-cbc", 	SSH_CIPHER_SSH2, 8, 16, EVP_bf_cbc },
-	{ "cast128-cbc", 	SSH_CIPHER_SSH2, 8, 16, EVP_cast5_cbc },
-	{ "arcfour", 		SSH_CIPHER_SSH2, 8, 16, EVP_rc4 },
-#if OPENSSL_VERSION_NUMBER < 0x00907000L
-	{ "aes128-cbc", 	SSH_CIPHER_SSH2, 16, 16, evp_rijndael },
-	{ "aes192-cbc", 	SSH_CIPHER_SSH2, 16, 24, evp_rijndael },
-	{ "aes256-cbc", 	SSH_CIPHER_SSH2, 16, 32, evp_rijndael },
-	{ "rijndael-cbc@lysator.liu.se",
-				SSH_CIPHER_SSH2, 16, 32, evp_rijndael },
-#else
-	{ "aes128-cbc",		SSH_CIPHER_SSH2, 16, 16, EVP_aes_128_cbc },
-	{ "aes192-cbc",		SSH_CIPHER_SSH2, 16, 24, EVP_aes_192_cbc },
-	{ "aes256-cbc",		SSH_CIPHER_SSH2, 16, 32, EVP_aes_256_cbc },
-	{ "rijndael-cbc@lysator.liu.se",
-				SSH_CIPHER_SSH2, 16, 32, EVP_aes_256_cbc },
-#endif
-
-	{ NULL,			SSH_CIPHER_ILLEGAL, 0, 0, NULL }
-};
-
-/*--*/
-
-u_int
-cipher_blocksize(Cipher *c)
-{
-	return (c->block_size);
-}
-
-u_int
-cipher_keylen(Cipher *c)
-{
-	return (c->key_len);
-}
-
-u_int
-cipher_get_number(Cipher *c)
-{
-	return (c->number);
-}
-
-u_int
-cipher_mask_ssh1(int client)
-{
-	u_int mask = 0;
-	mask |= 1 << SSH_CIPHER_3DES;		/* Mandatory */
-	mask |= 1 << SSH_CIPHER_BLOWFISH;
-	if (client) {
-		mask |= 1 << SSH_CIPHER_DES;
-	}
-	return mask;
-}
-
-Cipher *
-cipher_by_name(const char *name)
-{
-	Cipher *c;
-	for (c = ciphers; c->name != NULL; c++)
-		if (strcasecmp(c->name, name) == 0)
-			return c;
-	return NULL;
-}
-
-Cipher *
-cipher_by_number(int id)
-{
-	Cipher *c;
-	for (c = ciphers; c->name != NULL; c++)
-		if (c->number == id)
-			return c;
-	return NULL;
-}
-
-#define	CIPHER_SEP	","
-int
-ciphers_valid(const char *names)
-{
-	Cipher *c;
-	char *ciphers, *cp;
-	char *p;
-
-	if (names == NULL || strcmp(names, "") == 0)
-		return 0;
-	ciphers = cp = xstrdup(names);
-	for ((p = strsep(&cp, CIPHER_SEP)); p && *p != '\0';
-	    (p = strsep(&cp, CIPHER_SEP))) {
-		c = cipher_by_name(p);
-		if (c == NULL || c->number != SSH_CIPHER_SSH2) {
-			debug("bad cipher %s [%s]", p, names);
-			xfree(ciphers);
-			return 0;
-		} else {
-			debug3("cipher ok: %s [%s]", p, names);
-		}
-	}
-	debug3("ciphers ok: [%s]", names);
-	xfree(ciphers);
-	return 1;
-}
-
-/*
- * Parses the name of the cipher.  Returns the number of the corresponding
- * cipher, or -1 on error.
- */
-
-int
-cipher_number(const char *name)
-{
-	Cipher *c;
-	if (name == NULL)
-		return -1;
-	c = cipher_by_name(name);
-	return (c==NULL) ? -1 : c->number;
-}
-
-char *
-cipher_name(int id)
-{
-	Cipher *c = cipher_by_number(id);
-	return (c==NULL) ? "<unknown>" : c->name;
-}
-
-void
-cipher_init(CipherContext *cc, Cipher *cipher,
-    const u_char *key, u_int keylen, const u_char *iv, u_int ivlen,
-    int encrypt)
-{
-	static int dowarn = 1;
-#ifdef SSH_OLD_EVP
-	EVP_CIPHER *type;
-#else
-	const EVP_CIPHER *type;
-#endif
-	int klen;
-
-	if (cipher->number == SSH_CIPHER_DES) {
-		if (dowarn) {
-			error("Warning: use of DES is strongly discouraged "
-			    "due to cryptographic weaknesses");
-			dowarn = 0;
-		}
-		if (keylen > 8)
-			keylen = 8;
-	}
-	cc->plaintext = (cipher->number == SSH_CIPHER_NONE);
-
-	if (keylen < cipher->key_len)
-		fatal("cipher_init: key length %d is insufficient for %s.",
-		    keylen, cipher->name);
-	if (iv != NULL && ivlen < cipher->block_size)
-		fatal("cipher_init: iv length %d is insufficient for %s.",
-		    ivlen, cipher->name);
-	cc->cipher = cipher;
-
-	type = (*cipher->evptype)();
-
-	EVP_CIPHER_CTX_init(&cc->evp);
-#ifdef SSH_OLD_EVP
-	if (type->key_len > 0 && type->key_len != keylen) {
-		debug("cipher_init: set keylen (%d -> %d)",
-		    type->key_len, keylen);
-		type->key_len = keylen;
-	}
-	EVP_CipherInit(&cc->evp, type, (u_char *)key, (u_char *)iv,
-	    (encrypt == CIPHER_ENCRYPT));
-#else
-	if (EVP_CipherInit(&cc->evp, type, NULL, (u_char *)iv,
-	    (encrypt == CIPHER_ENCRYPT)) == 0)
-		fatal("cipher_init: EVP_CipherInit failed for %s",
-		    cipher->name);
-	klen = EVP_CIPHER_CTX_key_length(&cc->evp);
-	if (klen > 0 && keylen != klen) {
-		debug2("cipher_init: set keylen (%d -> %d)", klen, keylen);
-		if (EVP_CIPHER_CTX_set_key_length(&cc->evp, keylen) == 0)
-			fatal("cipher_init: set keylen failed (%d -> %d)",
-			    klen, keylen);
-	}
-	if (EVP_CipherInit(&cc->evp, NULL, (u_char *)key, NULL, -1) == 0)
-		fatal("cipher_init: EVP_CipherInit: set key failed for %s",
-		    cipher->name);
-#endif
-}
-
-void
-cipher_crypt(CipherContext *cc, u_char *dest, const u_char *src, u_int len)
-{
-	if (len % cc->cipher->block_size)
-		fatal("cipher_encrypt: bad plaintext length %d", len);
-#ifdef SSH_OLD_EVP
-	EVP_Cipher(&cc->evp, dest, (u_char *)src, len);
-#else
-	if (EVP_Cipher(&cc->evp, dest, (u_char *)src, len) == 0)
-		fatal("evp_crypt: EVP_Cipher failed");
-#endif
-}
-
-void
-cipher_cleanup(CipherContext *cc)
-{
-#ifdef SSH_OLD_EVP
-	EVP_CIPHER_CTX_cleanup(&cc->evp);
-#else
-	if (EVP_CIPHER_CTX_cleanup(&cc->evp) == 0)
-		error("cipher_cleanup: EVP_CIPHER_CTX_cleanup failed");
-#endif
-}
-
-/*
- * Selects the cipher, and keys if by computing the MD5 checksum of the
- * passphrase and using the resulting 16 bytes as the key.
- */
-
-void
-cipher_set_key_string(CipherContext *cc, Cipher *cipher,
-    const char *passphrase, int encrypt)
-{
-	MD5_CTX md;
-	u_char digest[16];
-
-	MD5_Init(&md);
-	MD5_Update(&md, (const u_char *)passphrase, strlen(passphrase));
-	MD5_Final(digest, &md);
-
-	cipher_init(cc, cipher, digest, 16, NULL, 0, encrypt);
-
-	memset(digest, 0, sizeof(digest));
-	memset(&md, 0, sizeof(md));
-}
-
-/* Implementations for other non-EVP ciphers */
-
-/*
- * This is used by SSH1:
- *
- * What kind of triple DES are these 2 routines?
- *
- * Why is there a redundant initialization vector?
- *
- * If only iv3 was used, then, this would till effect have been
- * outer-cbc. However, there is also a private iv1 == iv2 which
- * perhaps makes differential analysis easier. On the other hand, the
- * private iv1 probably makes the CRC-32 attack ineffective. This is a
- * result of that there is no longer any known iv1 to use when
- * choosing the X block.
- */
-struct ssh1_3des_ctx
-{
-	EVP_CIPHER_CTX	k1, k2, k3;
-};
-
-static int
-ssh1_3des_init(EVP_CIPHER_CTX *ctx, const u_char *key, const u_char *iv,
-    int enc)
-{
-	struct ssh1_3des_ctx *c;
-	u_char *k1, *k2, *k3;
-
-	if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) {
-		c = xmalloc(sizeof(*c));
-		EVP_CIPHER_CTX_set_app_data(ctx, c);
-	}
-	if (key == NULL)
-		return (1);
-	if (enc == -1)
-		enc = ctx->encrypt;
-	k1 = k2 = k3 = (u_char *) key;
-	k2 += 8;
-	if (EVP_CIPHER_CTX_key_length(ctx) >= 16+8) {
-		if (enc)
-			k3 += 16;
-		else
-			k1 += 16;
-	}
-	EVP_CIPHER_CTX_init(&c->k1);
-	EVP_CIPHER_CTX_init(&c->k2);
-	EVP_CIPHER_CTX_init(&c->k3);
-#ifdef SSH_OLD_EVP
-	EVP_CipherInit(&c->k1, EVP_des_cbc(), k1, NULL, enc);
-	EVP_CipherInit(&c->k2, EVP_des_cbc(), k2, NULL, !enc);
-	EVP_CipherInit(&c->k3, EVP_des_cbc(), k3, NULL, enc);
-#else
-	if (EVP_CipherInit(&c->k1, EVP_des_cbc(), k1, NULL, enc) == 0 ||
-	    EVP_CipherInit(&c->k2, EVP_des_cbc(), k2, NULL, !enc) == 0 ||
-	    EVP_CipherInit(&c->k3, EVP_des_cbc(), k3, NULL, enc) == 0) {
-		memset(c, 0, sizeof(*c));
-		xfree(c);
-		EVP_CIPHER_CTX_set_app_data(ctx, NULL);
-		return (0);
-	}
-#endif
-	return (1);
-}
-
-static int
-ssh1_3des_cbc(EVP_CIPHER_CTX *ctx, u_char *dest, const u_char *src, u_int len)
-{
-	struct ssh1_3des_ctx *c;
-
-	if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) {
-		error("ssh1_3des_cbc: no context");
-		return (0);
-	}
-#ifdef SSH_OLD_EVP
-	EVP_Cipher(&c->k1, dest, (u_char *)src, len);
-	EVP_Cipher(&c->k2, dest, dest, len);
-	EVP_Cipher(&c->k3, dest, dest, len);
-#else
-	if (EVP_Cipher(&c->k1, dest, (u_char *)src, len) == 0 ||
-	    EVP_Cipher(&c->k2, dest, dest, len) == 0 ||
-	    EVP_Cipher(&c->k3, dest, dest, len) == 0)
-		return (0);
-#endif
-	return (1);
-}
-
-static int
-ssh1_3des_cleanup(EVP_CIPHER_CTX *ctx)
-{
-	struct ssh1_3des_ctx *c;
-
-	if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) != NULL) {
-		memset(c, 0, sizeof(*c));
-		xfree(c);
-		EVP_CIPHER_CTX_set_app_data(ctx, NULL);
-	}
-	return (1);
-}
-
-static const EVP_CIPHER *
-evp_ssh1_3des(void)
-{
-	static EVP_CIPHER ssh1_3des;
-
-	memset(&ssh1_3des, 0, sizeof(EVP_CIPHER));
-	ssh1_3des.nid = NID_undef;
-	ssh1_3des.block_size = 8;
-	ssh1_3des.iv_len = 0;
-	ssh1_3des.key_len = 16;
-	ssh1_3des.init = ssh1_3des_init;
-	ssh1_3des.cleanup = ssh1_3des_cleanup;
-	ssh1_3des.do_cipher = ssh1_3des_cbc;
-#ifndef SSH_OLD_EVP
-	ssh1_3des.flags = EVP_CIPH_CBC_MODE | EVP_CIPH_VARIABLE_LENGTH;
-#endif
-	return (&ssh1_3des);
-}
-
-/*
- * SSH1 uses a variation on Blowfish, all bytes must be swapped before
- * and after encryption/decryption. Thus the swap_bytes stuff (yuk).
- */
-static void
-swap_bytes(const u_char *src, u_char *dst, int n)
-{
-	u_char c[4];
-
-	/* Process 4 bytes every lap. */
-	for (n = n / 4; n > 0; n--) {
-		c[3] = *src++;
-		c[2] = *src++;
-		c[1] = *src++;
-		c[0] = *src++;
-
-		*dst++ = c[0];
-		*dst++ = c[1];
-		*dst++ = c[2];
-		*dst++ = c[3];
-	}
-}
-
-#ifdef SSH_OLD_EVP
-static void bf_ssh1_init (EVP_CIPHER_CTX * ctx, const unsigned char *key,
-			  const unsigned char *iv, int enc)
-{
-	if (iv != NULL)
-		memcpy (&(ctx->oiv[0]), iv, 8);
-	memcpy (&(ctx->iv[0]), &(ctx->oiv[0]), 8);
-	if (key != NULL)
-		BF_set_key (&(ctx->c.bf_ks), EVP_CIPHER_CTX_key_length (ctx),
-			    key);
-}
-#endif
-static int (*orig_bf)(EVP_CIPHER_CTX *, u_char *, const u_char *, u_int) = NULL;
-
-static int
-bf_ssh1_cipher(EVP_CIPHER_CTX *ctx, u_char *out, const u_char *in, u_int len)
-{
-	int ret;
-
-	swap_bytes(in, out, len);
-	ret = (*orig_bf)(ctx, out, out, len);
-	swap_bytes(out, out, len);
-	return (ret);
-}
-
-static const EVP_CIPHER *
-evp_ssh1_bf(void)
-{
-	static EVP_CIPHER ssh1_bf;
-
-	memcpy(&ssh1_bf, EVP_bf_cbc(), sizeof(EVP_CIPHER));
-	orig_bf = ssh1_bf.do_cipher;
-	ssh1_bf.nid = NID_undef;
-#ifdef SSH_OLD_EVP
-	ssh1_bf.init = bf_ssh1_init;
-#endif
-	ssh1_bf.do_cipher = bf_ssh1_cipher;
-	ssh1_bf.key_len = 32;
-	return (&ssh1_bf);
-}
-
-#if OPENSSL_VERSION_NUMBER < 0x00907000L
-/* RIJNDAEL */
-#define RIJNDAEL_BLOCKSIZE 16
-struct ssh_rijndael_ctx
-{
-	rijndael_ctx	r_ctx;
-	u_char		r_iv[RIJNDAEL_BLOCKSIZE];
-};
-
-static int
-ssh_rijndael_init(EVP_CIPHER_CTX *ctx, const u_char *key, const u_char *iv,
-    int enc)
-{
-	struct ssh_rijndael_ctx *c;
-
-	if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) {
-		c = xmalloc(sizeof(*c));
-		EVP_CIPHER_CTX_set_app_data(ctx, c);
-	}
-	if (key != NULL) {
-		if (enc == -1)
-			enc = ctx->encrypt;
-		rijndael_set_key(&c->r_ctx, (u_char *)key,
-		    8*EVP_CIPHER_CTX_key_length(ctx), enc);
-	}
-	if (iv != NULL)
-		memcpy(c->r_iv, iv, RIJNDAEL_BLOCKSIZE);
-	return (1);
-}
-
-static int
-ssh_rijndael_cbc(EVP_CIPHER_CTX *ctx, u_char *dest, const u_char *src,
-    u_int len)
-{
-	struct ssh_rijndael_ctx *c;
-	u_char buf[RIJNDAEL_BLOCKSIZE];
-	u_char *cprev, *cnow, *plain, *ivp;
-	int i, j, blocks = len / RIJNDAEL_BLOCKSIZE;
-
-	if (len == 0)
-		return (1);
-	if (len % RIJNDAEL_BLOCKSIZE)
-		fatal("ssh_rijndael_cbc: bad len %d", len);
-	if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) {
-		error("ssh_rijndael_cbc: no context");
-		return (0);
-	}
-	if (ctx->encrypt) {
-		cnow  = dest;
-		plain = (u_char *)src;
-		cprev = c->r_iv;
-		for (i = 0; i < blocks; i++, plain+=RIJNDAEL_BLOCKSIZE,
-		    cnow+=RIJNDAEL_BLOCKSIZE) {
-			for (j = 0; j < RIJNDAEL_BLOCKSIZE; j++)
-				buf[j] = plain[j] ^ cprev[j];
-			rijndael_encrypt(&c->r_ctx, buf, cnow);
-			cprev = cnow;
-		}
-		memcpy(c->r_iv, cprev, RIJNDAEL_BLOCKSIZE);
-	} else {
-		cnow  = (u_char *) (src+len-RIJNDAEL_BLOCKSIZE);
-		plain = dest+len-RIJNDAEL_BLOCKSIZE;
-
-		memcpy(buf, cnow, RIJNDAEL_BLOCKSIZE);
-		for (i = blocks; i > 0; i--, cnow-=RIJNDAEL_BLOCKSIZE,
-		    plain-=RIJNDAEL_BLOCKSIZE) {
-			rijndael_decrypt(&c->r_ctx, cnow, plain);
-			ivp = (i == 1) ? c->r_iv : cnow-RIJNDAEL_BLOCKSIZE;
-			for (j = 0; j < RIJNDAEL_BLOCKSIZE; j++)
-				plain[j] ^= ivp[j];
-		}
-		memcpy(c->r_iv, buf, RIJNDAEL_BLOCKSIZE);
-	}
-	return (1);
-}
-
-static int
-ssh_rijndael_cleanup(EVP_CIPHER_CTX *ctx)
-{
-	struct ssh_rijndael_ctx *c;
-
-	if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) != NULL) {
-		memset(c, 0, sizeof(*c));
-		xfree(c);
-		EVP_CIPHER_CTX_set_app_data(ctx, NULL);
-	}
-	return (1);
-}
-
-static const EVP_CIPHER *
-evp_rijndael(void)
-{
-	static EVP_CIPHER rijndal_cbc;
-
-	memset(&rijndal_cbc, 0, sizeof(EVP_CIPHER));
-	rijndal_cbc.nid = NID_undef;
-	rijndal_cbc.block_size = RIJNDAEL_BLOCKSIZE;
-	rijndal_cbc.iv_len = RIJNDAEL_BLOCKSIZE;
-	rijndal_cbc.key_len = 16;
-	rijndal_cbc.init = ssh_rijndael_init;
-	rijndal_cbc.cleanup = ssh_rijndael_cleanup;
-	rijndal_cbc.do_cipher = ssh_rijndael_cbc;
-#ifndef SSH_OLD_EVP
-	rijndal_cbc.flags = EVP_CIPH_CBC_MODE | EVP_CIPH_VARIABLE_LENGTH |
-	    EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CUSTOM_IV;
-#endif
-	return (&rijndal_cbc);
-}
-#endif
-
-/*
- * Exports an IV from the CipherContext required to export the key
- * state back from the unprivileged child to the privileged parent
- * process.
- */
-
-int
-cipher_get_keyiv_len(CipherContext *cc)
-{
-	Cipher *c = cc->cipher;
-	int ivlen;
-
-	if (c->number == SSH_CIPHER_3DES)
-		ivlen = 24;
-	else
-		ivlen = EVP_CIPHER_CTX_iv_length(&cc->evp);
-	return (ivlen);
-}
-
-void
-cipher_get_keyiv(CipherContext *cc, u_char *iv, u_int len)
-{
-	Cipher *c = cc->cipher;
-	u_char *civ = NULL;
-	int evplen;
-
-	switch (c->number) {
-	case SSH_CIPHER_SSH2:
-	case SSH_CIPHER_DES:
-	case SSH_CIPHER_BLOWFISH:
-		evplen = EVP_CIPHER_CTX_iv_length(&cc->evp);
-		if (evplen == 0)
-			return;
-		if (evplen != len)
-			fatal("%s: wrong iv length %d != %d", __func__,
-			    evplen, len);
-
-#if OPENSSL_VERSION_NUMBER < 0x00907000L
-		if (c->evptype == evp_rijndael) {
-			struct ssh_rijndael_ctx *aesc;
-
-			aesc = EVP_CIPHER_CTX_get_app_data(&cc->evp);
-			if (aesc == NULL)
-				fatal("%s: no rijndael context", __func__);
-			civ = aesc->r_iv;
-		} else
-#endif
-		{
-			civ = cc->evp.iv;
-		}
-		break;
-	case SSH_CIPHER_3DES: {
-		struct ssh1_3des_ctx *desc;
-		if (len != 24)
-			fatal("%s: bad 3des iv length: %d", __func__, len);
-		desc = EVP_CIPHER_CTX_get_app_data(&cc->evp);
-		if (desc == NULL)
-			fatal("%s: no 3des context", __func__);
-		debug3("%s: Copying 3DES IV", __func__);
-		memcpy(iv, desc->k1.iv, 8);
-		memcpy(iv + 8, desc->k2.iv, 8);
-		memcpy(iv + 16, desc->k3.iv, 8);
-		return;
-	}
-	default:
-		fatal("%s: bad cipher %d", __func__, c->number);
-	}
-	memcpy(iv, civ, len);
-}
-
-void
-cipher_set_keyiv(CipherContext *cc, u_char *iv)
-{
-	Cipher *c = cc->cipher;
-	u_char *div = NULL;
-	int evplen = 0;
-
-	switch (c->number) {
-	case SSH_CIPHER_SSH2:
-	case SSH_CIPHER_DES:
-	case SSH_CIPHER_BLOWFISH:
-		evplen = EVP_CIPHER_CTX_iv_length(&cc->evp);
-		if (evplen == 0)
-			return;
-
-#if OPENSSL_VERSION_NUMBER < 0x00907000L
-		if (c->evptype == evp_rijndael) {
-			struct ssh_rijndael_ctx *aesc;
-
-			aesc = EVP_CIPHER_CTX_get_app_data(&cc->evp);
-			if (aesc == NULL)
-				fatal("%s: no rijndael context", __func__);
-			div = aesc->r_iv;
-		} else
-#endif
-		{
-			div = cc->evp.iv;
-		}
-		break;
-	case SSH_CIPHER_3DES: {
-		struct ssh1_3des_ctx *desc;
-		desc = EVP_CIPHER_CTX_get_app_data(&cc->evp);
-		if (desc == NULL)
-			fatal("%s: no 3des context", __func__);
-		debug3("%s: Installed 3DES IV", __func__);
-		memcpy(desc->k1.iv, iv, 8);
-		memcpy(desc->k2.iv, iv + 8, 8);
-		memcpy(desc->k3.iv, iv + 16, 8);
-		return;
-	}
-	default:
-		fatal("%s: bad cipher %d", __func__, c->number);
-	}
-	memcpy(div, iv, evplen);
-}
-
-#if OPENSSL_VERSION_NUMBER < 0x00907000L
-#define EVP_X_STATE(evp)	&(evp).c
-#define EVP_X_STATE_LEN(evp)	sizeof((evp).c)
-#else
-#define EVP_X_STATE(evp)	(evp).cipher_data
-#define EVP_X_STATE_LEN(evp)	(evp).cipher->ctx_size
-#endif
-
-int
-cipher_get_keycontext(CipherContext *cc, u_char *dat)
-{
-	Cipher *c = cc->cipher;
-	int plen = 0;
-
-	if (c->evptype == EVP_rc4) {
-		plen = EVP_X_STATE_LEN(cc->evp);
-		if (dat == NULL)
-			return (plen);
-		memcpy(dat, EVP_X_STATE(cc->evp), plen);
-	}
-	return (plen);
-}
-
-void
-cipher_set_keycontext(CipherContext *cc, u_char *dat)
-{
-	Cipher *c = cc->cipher;
-	int plen;
-
-	if (c->evptype == EVP_rc4) {
-		plen = EVP_X_STATE_LEN(cc->evp);
-		memcpy(EVP_X_STATE(cc->evp), dat, plen);
-	}
-}
diff --git a/crypto/openssh/cipher.h b/crypto/openssh/cipher.h
deleted file mode 100644
index fc7f6dd0fc46..000000000000
--- a/crypto/openssh/cipher.h
+++ /dev/null
@@ -1,91 +0,0 @@
-/*	$OpenBSD: cipher.h,v 1.33 2002/03/18 17:13:15 markus Exp $	*/
-
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- *
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef CIPHER_H
-#define CIPHER_H
-
-#include <openssl/evp.h>
-/*
- * Cipher types for SSH-1.  New types can be added, but old types should not
- * be removed for compatibility.  The maximum allowed value is 31.
- */
-#define SSH_CIPHER_SSH2		-3
-#define SSH_CIPHER_ILLEGAL	-2	/* No valid cipher selected. */
-#define SSH_CIPHER_NOT_SET	-1	/* None selected (invalid number). */
-#define SSH_CIPHER_NONE		0	/* no encryption */
-#define SSH_CIPHER_IDEA		1	/* IDEA CFB */
-#define SSH_CIPHER_DES		2	/* DES CBC */
-#define SSH_CIPHER_3DES		3	/* 3DES CBC */
-#define SSH_CIPHER_BROKEN_TSS	4	/* TRI's Simple Stream encryption CBC */
-#define SSH_CIPHER_BROKEN_RC4	5	/* Alleged RC4 */
-#define SSH_CIPHER_BLOWFISH	6
-#define SSH_CIPHER_RESERVED	7
-#define SSH_CIPHER_MAX		31
-
-#define CIPHER_ENCRYPT		1
-#define CIPHER_DECRYPT		0
-
-typedef struct Cipher Cipher;
-typedef struct CipherContext CipherContext;
-
-struct Cipher;
-struct CipherContext {
-	int	plaintext;
-	EVP_CIPHER_CTX evp;
-	Cipher *cipher;
-};
-
-u_int	 cipher_mask_ssh1(int);
-Cipher	*cipher_by_name(const char *);
-Cipher	*cipher_by_number(int);
-int	 cipher_number(const char *);
-char	*cipher_name(int);
-int	 ciphers_valid(const char *);
-void	 cipher_init(CipherContext *, Cipher *, const u_char *, u_int,
-    const u_char *, u_int, int);
-void	 cipher_crypt(CipherContext *, u_char *, const u_char *, u_int);
-void	 cipher_cleanup(CipherContext *);
-void	 cipher_set_key_string(CipherContext *, Cipher *, const char *, int);
-u_int	 cipher_blocksize(Cipher *);
-u_int	 cipher_keylen(Cipher *);
-
-u_int	 cipher_get_number(Cipher *);
-void	 cipher_get_keyiv(CipherContext *, u_char *, u_int);
-void	 cipher_set_keyiv(CipherContext *, u_char *);
-int	 cipher_get_keyiv_len(CipherContext *);
-int	 cipher_get_keycontext(CipherContext *, u_char *);
-void	 cipher_set_keycontext(CipherContext *, u_char *);
-#endif				/* CIPHER_H */
diff --git a/crypto/openssh/cli.c b/crypto/openssh/cli.c
deleted file mode 100644
index 8f0b2b87e36c..000000000000
--- a/crypto/openssh/cli.c
+++ /dev/null
@@ -1,231 +0,0 @@
-/*	$OpenBSD: cli.c,v 1.11 2001/03/06 00:33:04 deraadt Exp $	*/
-
-/*
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: cli.c,v 1.11 2001/03/06 00:33:04 deraadt Exp $");
-
-#include "xmalloc.h"
-#include "log.h"
-#include "cli.h"
-
-#include <vis.h>
-
-static int cli_input = -1;
-static int cli_output = -1;
-static int cli_from_stdin = 0;
-
-sigset_t oset;
-sigset_t nset;
-struct sigaction nsa;
-struct sigaction osa;
-struct termios ntio;
-struct termios otio;
-int echo_modified;
-
-volatile int intr;
-
-static int
-cli_open(int from_stdin)
-{
-	if (cli_input >= 0 && cli_output >= 0 && cli_from_stdin == from_stdin)
-		return 1;
-
-	if (from_stdin) {
-		if (!cli_from_stdin && cli_input >= 0) {
-			(void)close(cli_input);
-		}
-		cli_input = STDIN_FILENO;
-		cli_output = STDERR_FILENO;
-	} else {
-		cli_input = cli_output = open(_PATH_TTY, O_RDWR);
-		if (cli_input < 0)
-			fatal("You have no controlling tty.  Cannot read passphrase.");
-	}
-
-	cli_from_stdin = from_stdin;
-
-	return cli_input >= 0 && cli_output >= 0 && cli_from_stdin == from_stdin;
-}
-
-static void
-cli_close(void)
-{
-	if (!cli_from_stdin && cli_input >= 0)
-		close(cli_input);
-	cli_input = -1;
-	cli_output = -1;
-	cli_from_stdin = 0;
-	return;
-}
-
-void
-intrcatch(int sig)
-{
-	intr = 1;
-}
-
-static void
-cli_echo_disable(void)
-{
-	sigemptyset(&nset);
-	sigaddset(&nset, SIGTSTP);
-	(void) sigprocmask(SIG_BLOCK, &nset, &oset);
-
-	intr = 0;
-
-	memset(&nsa, 0, sizeof(nsa));
-	nsa.sa_handler = intrcatch;
-	(void) sigaction(SIGINT, &nsa, &osa);
-
-	echo_modified = 0;
-	if (tcgetattr(cli_input, &otio) == 0 && (otio.c_lflag & ECHO)) {
-		echo_modified = 1;
-		ntio = otio;
-		ntio.c_lflag &= ~(ECHO | ECHOE | ECHOK | ECHONL);
-		(void) tcsetattr(cli_input, TCSANOW, &ntio);
-	}
-	return;
-}
-
-static void
-cli_echo_restore(void)
-{
-	if (echo_modified != 0) {
-		tcsetattr(cli_input, TCSANOW, &otio);
-		echo_modified = 0;
-	}
-
-	(void) sigprocmask(SIG_SETMASK, &oset, NULL);
-	(void) sigaction(SIGINT, &osa, NULL);
-
-	if (intr != 0) {
-		kill(getpid(), SIGINT);
-		sigemptyset(&nset);
-		/* XXX tty has not neccessarily drained by now? */
-		sigsuspend(&nset);
-		intr = 0;
-	}
-	return;
-}
-
-static int
-cli_read(char* buf, int size, int echo)
-{
-	char ch = 0;
-	int i = 0;
-	int n;
-
-	if (!echo)
-		cli_echo_disable();
-
-	while (ch != '\n') {
-		n = read(cli_input, &ch, 1);
-		if (n == -1 && (errno == EAGAIN || errno == EINTR))
-			continue;
-		if (n != 1)
-			break;
-		if (ch == '\n' || intr != 0)
-			break;
-		if (i < size)
-			buf[i++] = ch;
-	}
-	buf[i] = '\0';
-
-	if (!echo)
-		cli_echo_restore();
-	if (!intr && !echo)
-		(void) write(cli_output, "\n", 1);
-	return i;
-}
-
-static int
-cli_write(char* buf, int size)
-{
-	int i, len, pos, ret = 0;
-	char *output, *p;
-
-	output = xmalloc(4*size);
-	for (p = output, i = 0; i < size; i++) {
-		if (buf[i] == '\n' || buf[i] == '\r')
-			*p++ = buf[i];
-		else
-			p = vis(p, buf[i], 0, 0);
-	}
-	len = p - output;
-
-	for (pos = 0; pos < len; pos += ret) {
-		ret = write(cli_output, output + pos, len - pos);
-		if (ret == -1) {
-			xfree(output);
-			return -1;
-		}
-	}
-	xfree(output);
-	return 0;
-}
-
-/*
- * Presents a prompt and returns the response allocated with xmalloc().
- * Uses /dev/tty or stdin/out depending on arg.  Optionally disables echo
- * of response depending on arg.  Tries to ensure that no other userland
- * buffer is storing the response.
- */
-char*
-cli_read_passphrase(char* prompt, int from_stdin, int echo_enable)
-{
-	char	buf[BUFSIZ];
-	char*	p;
-
-	if (!cli_open(from_stdin))
-		fatal("Cannot read passphrase.");
-
-	fflush(stdout);
-
-	cli_write(prompt, strlen(prompt));
-	cli_read(buf, sizeof buf, echo_enable);
-
-	cli_close();
-
-	p = xstrdup(buf);
-	memset(buf, 0, sizeof(buf));
-	return (p);
-}
-
-char*
-cli_prompt(char* prompt, int echo_enable)
-{
-	return cli_read_passphrase(prompt, 0, echo_enable);
-}
-
-void
-cli_mesg(char* mesg)
-{
-	cli_open(0);
-	cli_write(mesg, strlen(mesg));
-	cli_write("\n", strlen("\n"));
-	cli_close();
-	return;
-}
diff --git a/crypto/openssh/cli.h b/crypto/openssh/cli.h
deleted file mode 100644
index 6f57c9b8ad0a..000000000000
--- a/crypto/openssh/cli.h
+++ /dev/null
@@ -1,42 +0,0 @@
-/*	$OpenBSD: cli.h,v 1.4 2001/03/01 03:38:33 deraadt Exp $	*/
-
-/*
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/* $OpenBSD: cli.h,v 1.4 2001/03/01 03:38:33 deraadt Exp $ */
-
-#ifndef CLI_H
-#define CLI_H
-
-/*
- * Presents a prompt and returns the response allocated with xmalloc().
- * Uses /dev/tty or stdin/out depending on arg.  Optionally disables echo
- * of response depending on arg.  Tries to ensure that no other userland
- * buffer is storing the response.
- */
-char *	cli_read_passphrase(char * prompt, int from_stdin, int echo_enable);
-char *	cli_prompt(char * prompt, int echo_enable);
-void	cli_mesg(char * mesg);
-
-#endif /* CLI_H */
diff --git a/crypto/openssh/clientloop.c b/crypto/openssh/clientloop.c
deleted file mode 100644
index af207c070b37..000000000000
--- a/crypto/openssh/clientloop.c
+++ /dev/null
@@ -1,1377 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * The main loop for the interactive session (client side).
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- *
- *
- * Copyright (c) 1999 Theo de Raadt.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *
- * SSH2 support added by Markus Friedl.
- * Copyright (c) 1999, 2000, 2001 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: clientloop.c,v 1.107 2003/04/01 10:22:21 markus Exp $");
-
-#include "ssh.h"
-#include "ssh1.h"
-#include "ssh2.h"
-#include "xmalloc.h"
-#include "packet.h"
-#include "buffer.h"
-#include "compat.h"
-#include "channels.h"
-#include "dispatch.h"
-#include "buffer.h"
-#include "bufaux.h"
-#include "key.h"
-#include "kex.h"
-#include "log.h"
-#include "readconf.h"
-#include "clientloop.h"
-#include "authfd.h"
-#include "atomicio.h"
-#include "sshtty.h"
-#include "misc.h"
-#include "readpass.h"
-
-/* import options */
-extern Options options;
-
-/* Flag indicating that stdin should be redirected from /dev/null. */
-extern int stdin_null_flag;
-
-/*
- * Name of the host we are connecting to.  This is the name given on the
- * command line, or the HostName specified for the user-supplied name in a
- * configuration file.
- */
-extern char *host;
-
-/*
- * Flag to indicate that we have received a window change signal which has
- * not yet been processed.  This will cause a message indicating the new
- * window size to be sent to the server a little later.  This is volatile
- * because this is updated in a signal handler.
- */
-static volatile sig_atomic_t received_window_change_signal = 0;
-static volatile sig_atomic_t received_signal = 0;
-
-/* Flag indicating whether the user\'s terminal is in non-blocking mode. */
-static int in_non_blocking_mode = 0;
-
-/* Common data for the client loop code. */
-static int quit_pending;	/* Set to non-zero to quit the client loop. */
-static int escape_char;		/* Escape character. */
-static int escape_pending;	/* Last character was the escape character */
-static int last_was_cr;		/* Last character was a newline. */
-static int exit_status;		/* Used to store the exit status of the command. */
-static int stdin_eof;		/* EOF has been encountered on standard error. */
-static Buffer stdin_buffer;	/* Buffer for stdin data. */
-static Buffer stdout_buffer;	/* Buffer for stdout data. */
-static Buffer stderr_buffer;	/* Buffer for stderr data. */
-static u_long stdin_bytes, stdout_bytes, stderr_bytes;
-static u_int buffer_high;/* Soft max buffer size. */
-static int connection_in;	/* Connection to server (input). */
-static int connection_out;	/* Connection to server (output). */
-static int need_rekeying;	/* Set to non-zero if rekeying is requested. */
-static int session_closed = 0;	/* In SSH2: login session closed. */
-
-static void client_init_dispatch(void);
-int	session_ident = -1;
-
-/*XXX*/
-extern Kex *xxx_kex;
-
-/* Restores stdin to blocking mode. */
-
-static void
-leave_non_blocking(void)
-{
-	if (in_non_blocking_mode) {
-		(void) fcntl(fileno(stdin), F_SETFL, 0);
-		in_non_blocking_mode = 0;
-		fatal_remove_cleanup((void (*) (void *)) leave_non_blocking, NULL);
-	}
-}
-
-/* Puts stdin terminal in non-blocking mode. */
-
-static void
-enter_non_blocking(void)
-{
-	in_non_blocking_mode = 1;
-	(void) fcntl(fileno(stdin), F_SETFL, O_NONBLOCK);
-	fatal_add_cleanup((void (*) (void *)) leave_non_blocking, NULL);
-}
-
-/*
- * Signal handler for the window change signal (SIGWINCH).  This just sets a
- * flag indicating that the window has changed.
- */
-
-static void
-window_change_handler(int sig)
-{
-	received_window_change_signal = 1;
-	signal(SIGWINCH, window_change_handler);
-}
-
-/*
- * Signal handler for signals that cause the program to terminate.  These
- * signals must be trapped to restore terminal modes.
- */
-
-static void
-signal_handler(int sig)
-{
-	received_signal = sig;
-	quit_pending = 1;
-}
-
-/*
- * Returns current time in seconds from Jan 1, 1970 with the maximum
- * available resolution.
- */
-
-static double
-get_current_time(void)
-{
-	struct timeval tv;
-	gettimeofday(&tv, NULL);
-	return (double) tv.tv_sec + (double) tv.tv_usec / 1000000.0;
-}
-
-/*
- * This is called when the interactive is entered.  This checks if there is
- * an EOF coming on stdin.  We must check this explicitly, as select() does
- * not appear to wake up when redirecting from /dev/null.
- */
-
-static void
-client_check_initial_eof_on_stdin(void)
-{
-	int len;
-	char buf[1];
-
-	/*
-	 * If standard input is to be "redirected from /dev/null", we simply
-	 * mark that we have seen an EOF and send an EOF message to the
-	 * server. Otherwise, we try to read a single character; it appears
-	 * that for some files, such /dev/null, select() never wakes up for
-	 * read for this descriptor, which means that we never get EOF.  This
-	 * way we will get the EOF if stdin comes from /dev/null or similar.
-	 */
-	if (stdin_null_flag) {
-		/* Fake EOF on stdin. */
-		debug("Sending eof.");
-		stdin_eof = 1;
-		packet_start(SSH_CMSG_EOF);
-		packet_send();
-	} else {
-		enter_non_blocking();
-
-		/* Check for immediate EOF on stdin. */
-		len = read(fileno(stdin), buf, 1);
-		if (len == 0) {
-			/* EOF.  Record that we have seen it and send EOF to server. */
-			debug("Sending eof.");
-			stdin_eof = 1;
-			packet_start(SSH_CMSG_EOF);
-			packet_send();
-		} else if (len > 0) {
-			/*
-			 * Got data.  We must store the data in the buffer,
-			 * and also process it as an escape character if
-			 * appropriate.
-			 */
-			if ((u_char) buf[0] == escape_char)
-				escape_pending = 1;
-			else
-				buffer_append(&stdin_buffer, buf, 1);
-		}
-		leave_non_blocking();
-	}
-}
-
-
-/*
- * Make packets from buffered stdin data, and buffer them for sending to the
- * connection.
- */
-
-static void
-client_make_packets_from_stdin_data(void)
-{
-	u_int len;
-
-	/* Send buffered stdin data to the server. */
-	while (buffer_len(&stdin_buffer) > 0 &&
-	    packet_not_very_much_data_to_write()) {
-		len = buffer_len(&stdin_buffer);
-		/* Keep the packets at reasonable size. */
-		if (len > packet_get_maxsize())
-			len = packet_get_maxsize();
-		packet_start(SSH_CMSG_STDIN_DATA);
-		packet_put_string(buffer_ptr(&stdin_buffer), len);
-		packet_send();
-		buffer_consume(&stdin_buffer, len);
-		stdin_bytes += len;
-		/* If we have a pending EOF, send it now. */
-		if (stdin_eof && buffer_len(&stdin_buffer) == 0) {
-			packet_start(SSH_CMSG_EOF);
-			packet_send();
-		}
-	}
-}
-
-/*
- * Checks if the client window has changed, and sends a packet about it to
- * the server if so.  The actual change is detected elsewhere (by a software
- * interrupt on Unix); this just checks the flag and sends a message if
- * appropriate.
- */
-
-static void
-client_check_window_change(void)
-{
-	struct winsize ws;
-
-	if (! received_window_change_signal)
-		return;
-	/** XXX race */
-	received_window_change_signal = 0;
-
-	if (ioctl(fileno(stdin), TIOCGWINSZ, &ws) < 0)
-		return;
-
-	debug2("client_check_window_change: changed");
-
-	if (compat20) {
-		channel_request_start(session_ident, "window-change", 0);
-		packet_put_int(ws.ws_col);
-		packet_put_int(ws.ws_row);
-		packet_put_int(ws.ws_xpixel);
-		packet_put_int(ws.ws_ypixel);
-		packet_send();
-	} else {
-		packet_start(SSH_CMSG_WINDOW_SIZE);
-		packet_put_int(ws.ws_row);
-		packet_put_int(ws.ws_col);
-		packet_put_int(ws.ws_xpixel);
-		packet_put_int(ws.ws_ypixel);
-		packet_send();
-	}
-}
-
-/*
- * Waits until the client can do something (some data becomes available on
- * one of the file descriptors).
- */
-
-static void
-client_wait_until_can_do_something(fd_set **readsetp, fd_set **writesetp,
-    int *maxfdp, int *nallocp, int rekeying)
-{
-	/* Add any selections by the channel mechanism. */
-	channel_prepare_select(readsetp, writesetp, maxfdp, nallocp, rekeying);
-
-	if (!compat20) {
-		/* Read from the connection, unless our buffers are full. */
-		if (buffer_len(&stdout_buffer) < buffer_high &&
-		    buffer_len(&stderr_buffer) < buffer_high &&
-		    channel_not_very_much_buffered_data())
-			FD_SET(connection_in, *readsetp);
-		/*
-		 * Read from stdin, unless we have seen EOF or have very much
-		 * buffered data to send to the server.
-		 */
-		if (!stdin_eof && packet_not_very_much_data_to_write())
-			FD_SET(fileno(stdin), *readsetp);
-
-		/* Select stdout/stderr if have data in buffer. */
-		if (buffer_len(&stdout_buffer) > 0)
-			FD_SET(fileno(stdout), *writesetp);
-		if (buffer_len(&stderr_buffer) > 0)
-			FD_SET(fileno(stderr), *writesetp);
-	} else {
-		/* channel_prepare_select could have closed the last channel */
-		if (session_closed && !channel_still_open() &&
-		    !packet_have_data_to_write()) {
-			/* clear mask since we did not call select() */
-			memset(*readsetp, 0, *nallocp);
-			memset(*writesetp, 0, *nallocp);
-			return;
-		} else {
-			FD_SET(connection_in, *readsetp);
-		}
-	}
-
-	/* Select server connection if have data to write to the server. */
-	if (packet_have_data_to_write())
-		FD_SET(connection_out, *writesetp);
-
-	/*
-	 * Wait for something to happen.  This will suspend the process until
-	 * some selected descriptor can be read, written, or has some other
-	 * event pending. Note: if you want to implement SSH_MSG_IGNORE
-	 * messages to fool traffic analysis, this might be the place to do
-	 * it: just have a random timeout for the select, and send a random
-	 * SSH_MSG_IGNORE packet when the timeout expires.
-	 */
-
-	if (select((*maxfdp)+1, *readsetp, *writesetp, NULL, NULL) < 0) {
-		char buf[100];
-
-		/*
-		 * We have to clear the select masks, because we return.
-		 * We have to return, because the mainloop checks for the flags
-		 * set by the signal handlers.
-		 */
-		memset(*readsetp, 0, *nallocp);
-		memset(*writesetp, 0, *nallocp);
-
-		if (errno == EINTR)
-			return;
-		/* Note: we might still have data in the buffers. */
-		snprintf(buf, sizeof buf, "select: %s\r\n", strerror(errno));
-		buffer_append(&stderr_buffer, buf, strlen(buf));
-		quit_pending = 1;
-	}
-}
-
-static void
-client_suspend_self(Buffer *bin, Buffer *bout, Buffer *berr)
-{
-	struct winsize oldws, newws;
-
-	/* Flush stdout and stderr buffers. */
-	if (buffer_len(bout) > 0)
-		atomicio(write, fileno(stdout), buffer_ptr(bout), buffer_len(bout));
-	if (buffer_len(berr) > 0)
-		atomicio(write, fileno(stderr), buffer_ptr(berr), buffer_len(berr));
-
-	leave_raw_mode();
-
-	/*
-	 * Free (and clear) the buffer to reduce the amount of data that gets
-	 * written to swap.
-	 */
-	buffer_free(bin);
-	buffer_free(bout);
-	buffer_free(berr);
-
-	/* Save old window size. */
-	ioctl(fileno(stdin), TIOCGWINSZ, &oldws);
-
-	/* Send the suspend signal to the program itself. */
-	kill(getpid(), SIGTSTP);
-
-	/* Check if the window size has changed. */
-	if (ioctl(fileno(stdin), TIOCGWINSZ, &newws) >= 0 &&
-	    (oldws.ws_row != newws.ws_row ||
-	    oldws.ws_col != newws.ws_col ||
-	    oldws.ws_xpixel != newws.ws_xpixel ||
-	    oldws.ws_ypixel != newws.ws_ypixel))
-		received_window_change_signal = 1;
-
-	/* OK, we have been continued by the user. Reinitialize buffers. */
-	buffer_init(bin);
-	buffer_init(bout);
-	buffer_init(berr);
-
-	enter_raw_mode();
-}
-
-static void
-client_process_net_input(fd_set * readset)
-{
-	int len;
-	char buf[8192];
-
-	/*
-	 * Read input from the server, and add any such data to the buffer of
-	 * the packet subsystem.
-	 */
-	if (FD_ISSET(connection_in, readset)) {
-		/* Read as much as possible. */
-		len = read(connection_in, buf, sizeof(buf));
-		if (len == 0) {
-			/* Received EOF.  The remote host has closed the connection. */
-			snprintf(buf, sizeof buf, "Connection to %.300s closed by remote host.\r\n",
-				 host);
-			buffer_append(&stderr_buffer, buf, strlen(buf));
-			quit_pending = 1;
-			return;
-		}
-		/*
-		 * There is a kernel bug on Solaris that causes select to
-		 * sometimes wake up even though there is no data available.
-		 */
-		if (len < 0 && (errno == EAGAIN || errno == EINTR))
-			len = 0;
-
-		if (len < 0) {
-			/* An error has encountered.  Perhaps there is a network problem. */
-			snprintf(buf, sizeof buf, "Read from remote host %.300s: %.100s\r\n",
-				 host, strerror(errno));
-			buffer_append(&stderr_buffer, buf, strlen(buf));
-			quit_pending = 1;
-			return;
-		}
-		packet_process_incoming(buf, len);
-	}
-}
-
-static void
-process_cmdline(void)
-{
-	void (*handler)(int);
-	char *s, *cmd;
-	u_short fwd_port, fwd_host_port;
-	char buf[1024], sfwd_port[6], sfwd_host_port[6];
-	int local = 0;
-
-	leave_raw_mode();
-	handler = signal(SIGINT, SIG_IGN);
-	cmd = s = read_passphrase("\r\nssh> ", RP_ECHO);
-	if (s == NULL)
-		goto out;
-	while (*s && isspace(*s))
-		s++;
-	if (*s == 0)
-		goto out;
-	if (strlen(s) < 2 || s[0] != '-' || !(s[1] == 'L' || s[1] == 'R')) {
-		log("Invalid command.");
-		goto out;
-	}
-	if (s[1] == 'L')
-		local = 1;
-	if (!local && !compat20) {
-		log("Not supported for SSH protocol version 1.");
-		goto out;
-	}
-	s += 2;
-	while (*s && isspace(*s))
-		s++;
-
-	if (sscanf(s, "%5[0-9]:%255[^:]:%5[0-9]",
-	    sfwd_port, buf, sfwd_host_port) != 3 &&
-	    sscanf(s, "%5[0-9]/%255[^/]/%5[0-9]",
-	    sfwd_port, buf, sfwd_host_port) != 3) {
-		log("Bad forwarding specification.");
-		goto out;
-	}
-	if ((fwd_port = a2port(sfwd_port)) == 0 ||
-	    (fwd_host_port = a2port(sfwd_host_port)) == 0) {
-		log("Bad forwarding port(s).");
-		goto out;
-	}
-	if (local) {
-		if (channel_setup_local_fwd_listener(fwd_port, buf,
-		    fwd_host_port, options.gateway_ports) < 0) {
-			log("Port forwarding failed.");
-			goto out;
-		}
-	} else
-		channel_request_remote_forwarding(fwd_port, buf,
-		    fwd_host_port);
-	log("Forwarding port.");
-out:
-	signal(SIGINT, handler);
-	enter_raw_mode();
-	if (cmd)
-		xfree(cmd);
-}
-
-/* process the characters one by one */
-static int
-process_escapes(Buffer *bin, Buffer *bout, Buffer *berr, char *buf, int len)
-{
-	char string[1024];
-	pid_t pid;
-	int bytes = 0;
-	u_int i;
-	u_char ch;
-	char *s;
-
-	for (i = 0; i < len; i++) {
-		/* Get one character at a time. */
-		ch = buf[i];
-
-		if (escape_pending) {
-			/* We have previously seen an escape character. */
-			/* Clear the flag now. */
-			escape_pending = 0;
-
-			/* Process the escaped character. */
-			switch (ch) {
-			case '.':
-				/* Terminate the connection. */
-				snprintf(string, sizeof string, "%c.\r\n", escape_char);
-				buffer_append(berr, string, strlen(string));
-
-				quit_pending = 1;
-				return -1;
-
-			case 'Z' - 64:
-				/* Suspend the program. */
-				/* Print a message to that effect to the user. */
-				snprintf(string, sizeof string, "%c^Z [suspend ssh]\r\n", escape_char);
-				buffer_append(berr, string, strlen(string));
-
-				/* Restore terminal modes and suspend. */
-				client_suspend_self(bin, bout, berr);
-
-				/* We have been continued. */
-				continue;
-
-			case 'R':
-				if (compat20) {
-					if (datafellows & SSH_BUG_NOREKEY)
-						log("Server does not support re-keying");
-					else
-						need_rekeying = 1;
-				}
-				continue;
-
-			case '&':
-				/*
-				 * Detach the program (continue to serve connections,
-				 * but put in background and no more new connections).
-				 */
-				/* Restore tty modes. */
-				leave_raw_mode();
-
-				/* Stop listening for new connections. */
-				channel_stop_listening();
-
-				snprintf(string, sizeof string,
-				    "%c& [backgrounded]\n", escape_char);
-				buffer_append(berr, string, strlen(string));
-
-				/* Fork into background. */
-				pid = fork();
-				if (pid < 0) {
-					error("fork: %.100s", strerror(errno));
-					continue;
-				}
-				if (pid != 0) {	/* This is the parent. */
-					/* The parent just exits. */
-					exit(0);
-				}
-				/* The child continues serving connections. */
-				if (compat20) {
-					buffer_append(bin, "\004", 1);
-					/* fake EOF on stdin */
-					return -1;
-				} else if (!stdin_eof) {
-					/*
-					 * Sending SSH_CMSG_EOF alone does not always appear
-					 * to be enough.  So we try to send an EOF character
-					 * first.
-					 */
-					packet_start(SSH_CMSG_STDIN_DATA);
-					packet_put_string("\004", 1);
-					packet_send();
-					/* Close stdin. */
-					stdin_eof = 1;
-					if (buffer_len(bin) == 0) {
-						packet_start(SSH_CMSG_EOF);
-						packet_send();
-					}
-				}
-				continue;
-
-			case '?':
-				snprintf(string, sizeof string,
-"%c?\r\n\
-Supported escape sequences:\r\n\
-%c.  - terminate connection\r\n\
-%cC  - open a command line\r\n\
-%cR  - Request rekey (SSH protocol 2 only)\r\n\
-%c^Z - suspend ssh\r\n\
-%c#  - list forwarded connections\r\n\
-%c&  - background ssh (when waiting for connections to terminate)\r\n\
-%c?  - this message\r\n\
-%c%c  - send the escape character by typing it twice\r\n\
-(Note that escapes are only recognized immediately after newline.)\r\n",
-				    escape_char, escape_char, escape_char, escape_char,
-				    escape_char, escape_char, escape_char, escape_char,
-				    escape_char, escape_char);
-				buffer_append(berr, string, strlen(string));
-				continue;
-
-			case '#':
-				snprintf(string, sizeof string, "%c#\r\n", escape_char);
-				buffer_append(berr, string, strlen(string));
-				s = channel_open_message();
-				buffer_append(berr, s, strlen(s));
-				xfree(s);
-				continue;
-
-			case 'C':
-				process_cmdline();
-				continue;
-
-			default:
-				if (ch != escape_char) {
-					buffer_put_char(bin, escape_char);
-					bytes++;
-				}
-				/* Escaped characters fall through here */
-				break;
-			}
-		} else {
-			/*
-			 * The previous character was not an escape char. Check if this
-			 * is an escape.
-			 */
-			if (last_was_cr && ch == escape_char) {
-				/* It is. Set the flag and continue to next character. */
-				escape_pending = 1;
-				continue;
-			}
-		}
-
-		/*
-		 * Normal character.  Record whether it was a newline,
-		 * and append it to the buffer.
-		 */
-		last_was_cr = (ch == '\r' || ch == '\n');
-		buffer_put_char(bin, ch);
-		bytes++;
-	}
-	return bytes;
-}
-
-static void
-client_process_input(fd_set * readset)
-{
-	int len;
-	char buf[8192];
-
-	/* Read input from stdin. */
-	if (FD_ISSET(fileno(stdin), readset)) {
-		/* Read as much as possible. */
-		len = read(fileno(stdin), buf, sizeof(buf));
-		if (len < 0 && (errno == EAGAIN || errno == EINTR))
-			return;		/* we'll try again later */
-		if (len <= 0) {
-			/*
-			 * Received EOF or error.  They are treated
-			 * similarly, except that an error message is printed
-			 * if it was an error condition.
-			 */
-			if (len < 0) {
-				snprintf(buf, sizeof buf, "read: %.100s\r\n", strerror(errno));
-				buffer_append(&stderr_buffer, buf, strlen(buf));
-			}
-			/* Mark that we have seen EOF. */
-			stdin_eof = 1;
-			/*
-			 * Send an EOF message to the server unless there is
-			 * data in the buffer.  If there is data in the
-			 * buffer, no message will be sent now.  Code
-			 * elsewhere will send the EOF when the buffer
-			 * becomes empty if stdin_eof is set.
-			 */
-			if (buffer_len(&stdin_buffer) == 0) {
-				packet_start(SSH_CMSG_EOF);
-				packet_send();
-			}
-		} else if (escape_char == SSH_ESCAPECHAR_NONE) {
-			/*
-			 * Normal successful read, and no escape character.
-			 * Just append the data to buffer.
-			 */
-			buffer_append(&stdin_buffer, buf, len);
-		} else {
-			/*
-			 * Normal, successful read.  But we have an escape character
-			 * and have to process the characters one by one.
-			 */
-			if (process_escapes(&stdin_buffer, &stdout_buffer,
-			    &stderr_buffer, buf, len) == -1)
-				return;
-		}
-	}
-}
-
-static void
-client_process_output(fd_set * writeset)
-{
-	int len;
-	char buf[100];
-
-	/* Write buffered output to stdout. */
-	if (FD_ISSET(fileno(stdout), writeset)) {
-		/* Write as much data as possible. */
-		len = write(fileno(stdout), buffer_ptr(&stdout_buffer),
-		    buffer_len(&stdout_buffer));
-		if (len <= 0) {
-			if (errno == EINTR || errno == EAGAIN)
-				len = 0;
-			else {
-				/*
-				 * An error or EOF was encountered.  Put an
-				 * error message to stderr buffer.
-				 */
-				snprintf(buf, sizeof buf, "write stdout: %.50s\r\n", strerror(errno));
-				buffer_append(&stderr_buffer, buf, strlen(buf));
-				quit_pending = 1;
-				return;
-			}
-		}
-		/* Consume printed data from the buffer. */
-		buffer_consume(&stdout_buffer, len);
-		stdout_bytes += len;
-	}
-	/* Write buffered output to stderr. */
-	if (FD_ISSET(fileno(stderr), writeset)) {
-		/* Write as much data as possible. */
-		len = write(fileno(stderr), buffer_ptr(&stderr_buffer),
-		    buffer_len(&stderr_buffer));
-		if (len <= 0) {
-			if (errno == EINTR || errno == EAGAIN)
-				len = 0;
-			else {
-				/* EOF or error, but can't even print error message. */
-				quit_pending = 1;
-				return;
-			}
-		}
-		/* Consume printed characters from the buffer. */
-		buffer_consume(&stderr_buffer, len);
-		stderr_bytes += len;
-	}
-}
-
-/*
- * Get packets from the connection input buffer, and process them as long as
- * there are packets available.
- *
- * Any unknown packets received during the actual
- * session cause the session to terminate.  This is
- * intended to make debugging easier since no
- * confirmations are sent.  Any compatible protocol
- * extensions must be negotiated during the
- * preparatory phase.
- */
-
-static void
-client_process_buffered_input_packets(void)
-{
-	dispatch_run(DISPATCH_NONBLOCK, &quit_pending, compat20 ? xxx_kex : NULL);
-}
-
-/* scan buf[] for '~' before sending data to the peer */
-
-static int
-simple_escape_filter(Channel *c, char *buf, int len)
-{
-	/* XXX we assume c->extended is writeable */
-	return process_escapes(&c->input, &c->output, &c->extended, buf, len);
-}
-
-static void
-client_channel_closed(int id, void *arg)
-{
-	if (id != session_ident)
-		error("client_channel_closed: id %d != session_ident %d",
-		    id, session_ident);
-	channel_cancel_cleanup(id);
-	session_closed = 1;
-	if (in_raw_mode())
-		leave_raw_mode();
-}
-
-/*
- * Implements the interactive session with the server.  This is called after
- * the user has been authenticated, and a command has been started on the
- * remote host.  If escape_char != SSH_ESCAPECHAR_NONE, it is the character
- * used as an escape character for terminating or suspending the session.
- */
-
-int
-client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
-{
-	fd_set *readset = NULL, *writeset = NULL;
-	double start_time, total_time;
-	int max_fd = 0, max_fd2 = 0, len, rekeying = 0, nalloc = 0;
-	char buf[100];
-
-	debug("Entering interactive session.");
-
-	start_time = get_current_time();
-
-	/* Initialize variables. */
-	escape_pending = 0;
-	last_was_cr = 1;
-	exit_status = -1;
-	stdin_eof = 0;
-	buffer_high = 64 * 1024;
-	connection_in = packet_get_connection_in();
-	connection_out = packet_get_connection_out();
-	max_fd = MAX(connection_in, connection_out);
-
-	if (!compat20) {
-		/* enable nonblocking unless tty */
-		if (!isatty(fileno(stdin)))
-			set_nonblock(fileno(stdin));
-		if (!isatty(fileno(stdout)))
-			set_nonblock(fileno(stdout));
-		if (!isatty(fileno(stderr)))
-			set_nonblock(fileno(stderr));
-		max_fd = MAX(max_fd, fileno(stdin));
-		max_fd = MAX(max_fd, fileno(stdout));
-		max_fd = MAX(max_fd, fileno(stderr));
-	}
-	stdin_bytes = 0;
-	stdout_bytes = 0;
-	stderr_bytes = 0;
-	quit_pending = 0;
-	escape_char = escape_char_arg;
-
-	/* Initialize buffers. */
-	buffer_init(&stdin_buffer);
-	buffer_init(&stdout_buffer);
-	buffer_init(&stderr_buffer);
-
-	client_init_dispatch();
-
-	/*
-	 * Set signal handlers, (e.g. to restore non-blocking mode)
-	 * but don't overwrite SIG_IGN, matches behaviour from rsh(1)
-	 */
-	if (signal(SIGINT, SIG_IGN) != SIG_IGN)
-		signal(SIGINT, signal_handler);
-	if (signal(SIGQUIT, SIG_IGN) != SIG_IGN)
-		signal(SIGQUIT, signal_handler);
-	if (signal(SIGTERM, SIG_IGN) != SIG_IGN)
-		signal(SIGTERM, signal_handler);
-	if (have_pty)
-		signal(SIGWINCH, window_change_handler);
-
-	if (have_pty)
-		enter_raw_mode();
-
-	if (compat20) {
-		session_ident = ssh2_chan_id;
-		if (escape_char != SSH_ESCAPECHAR_NONE)
-			channel_register_filter(session_ident,
-			    simple_escape_filter);
-		if (session_ident != -1)
-			channel_register_cleanup(session_ident,
-			    client_channel_closed);
-	} else {
-		/* Check if we should immediately send eof on stdin. */
-		client_check_initial_eof_on_stdin();
-	}
-
-	/* Main loop of the client for the interactive session mode. */
-	while (!quit_pending) {
-
-		/* Process buffered packets sent by the server. */
-		client_process_buffered_input_packets();
-
-		if (compat20 && session_closed && !channel_still_open())
-			break;
-
-		rekeying = (xxx_kex != NULL && !xxx_kex->done);
-
-		if (rekeying) {
-			debug("rekeying in progress");
-		} else {
-			/*
-			 * Make packets of buffered stdin data, and buffer
-			 * them for sending to the server.
-			 */
-			if (!compat20)
-				client_make_packets_from_stdin_data();
-
-			/*
-			 * Make packets from buffered channel data, and
-			 * enqueue them for sending to the server.
-			 */
-			if (packet_not_very_much_data_to_write())
-				channel_output_poll();
-
-			/*
-			 * Check if the window size has changed, and buffer a
-			 * message about it to the server if so.
-			 */
-			client_check_window_change();
-
-			if (quit_pending)
-				break;
-		}
-		/*
-		 * Wait until we have something to do (something becomes
-		 * available on one of the descriptors).
-		 */
-		max_fd2 = max_fd;
-		client_wait_until_can_do_something(&readset, &writeset,
-		    &max_fd2, &nalloc, rekeying);
-
-		if (quit_pending)
-			break;
-
-		/* Do channel operations unless rekeying in progress. */
-		if (!rekeying) {
-			channel_after_select(readset, writeset);
-
-			if (need_rekeying) {
-				debug("user requests rekeying");
-				xxx_kex->done = 0;
-				kex_send_kexinit(xxx_kex);
-				need_rekeying = 0;
-			}
-		}
-
-		/* Buffer input from the connection.  */
-		client_process_net_input(readset);
-
-		if (quit_pending)
-			break;
-
-		if (!compat20) {
-			/* Buffer data from stdin */
-			client_process_input(readset);
-			/*
-			 * Process output to stdout and stderr.  Output to
-			 * the connection is processed elsewhere (above).
-			 */
-			client_process_output(writeset);
-		}
-
-		/* Send as much buffered packet data as possible to the sender. */
-		if (FD_ISSET(connection_out, writeset))
-			packet_write_poll();
-	}
-	if (readset)
-		xfree(readset);
-	if (writeset)
-		xfree(writeset);
-
-	/* Terminate the session. */
-
-	/* Stop watching for window change. */
-	if (have_pty)
-		signal(SIGWINCH, SIG_DFL);
-
-	channel_free_all();
-
-	if (have_pty)
-		leave_raw_mode();
-
-	/* restore blocking io */
-	if (!isatty(fileno(stdin)))
-		unset_nonblock(fileno(stdin));
-	if (!isatty(fileno(stdout)))
-		unset_nonblock(fileno(stdout));
-	if (!isatty(fileno(stderr)))
-		unset_nonblock(fileno(stderr));
-
-	if (received_signal) {
-		if (in_non_blocking_mode)	/* XXX */
-			leave_non_blocking();
-		fatal("Killed by signal %d.", (int) received_signal);
-	}
-
-	/*
-	 * In interactive mode (with pseudo tty) display a message indicating
-	 * that the connection has been closed.
-	 */
-	if (have_pty && options.log_level != SYSLOG_LEVEL_QUIET) {
-		snprintf(buf, sizeof buf, "Connection to %.64s closed.\r\n", host);
-		buffer_append(&stderr_buffer, buf, strlen(buf));
-	}
-
-	/* Output any buffered data for stdout. */
-	while (buffer_len(&stdout_buffer) > 0) {
-		len = write(fileno(stdout), buffer_ptr(&stdout_buffer),
-		    buffer_len(&stdout_buffer));
-		if (len <= 0) {
-			error("Write failed flushing stdout buffer.");
-			break;
-		}
-		buffer_consume(&stdout_buffer, len);
-		stdout_bytes += len;
-	}
-
-	/* Output any buffered data for stderr. */
-	while (buffer_len(&stderr_buffer) > 0) {
-		len = write(fileno(stderr), buffer_ptr(&stderr_buffer),
-		    buffer_len(&stderr_buffer));
-		if (len <= 0) {
-			error("Write failed flushing stderr buffer.");
-			break;
-		}
-		buffer_consume(&stderr_buffer, len);
-		stderr_bytes += len;
-	}
-
-	/* Clear and free any buffers. */
-	memset(buf, 0, sizeof(buf));
-	buffer_free(&stdin_buffer);
-	buffer_free(&stdout_buffer);
-	buffer_free(&stderr_buffer);
-
-	/* Report bytes transferred, and transfer rates. */
-	total_time = get_current_time() - start_time;
-	debug("Transferred: stdin %lu, stdout %lu, stderr %lu bytes in %.1f seconds",
-	    stdin_bytes, stdout_bytes, stderr_bytes, total_time);
-	if (total_time > 0)
-		debug("Bytes per second: stdin %.1f, stdout %.1f, stderr %.1f",
-		    stdin_bytes / total_time, stdout_bytes / total_time,
-		    stderr_bytes / total_time);
-
-	/* Return the exit status of the program. */
-	debug("Exit status %d", exit_status);
-	return exit_status;
-}
-
-/*********/
-
-static void
-client_input_stdout_data(int type, u_int32_t seq, void *ctxt)
-{
-	u_int data_len;
-	char *data = packet_get_string(&data_len);
-	packet_check_eom();
-	buffer_append(&stdout_buffer, data, data_len);
-	memset(data, 0, data_len);
-	xfree(data);
-}
-static void
-client_input_stderr_data(int type, u_int32_t seq, void *ctxt)
-{
-	u_int data_len;
-	char *data = packet_get_string(&data_len);
-	packet_check_eom();
-	buffer_append(&stderr_buffer, data, data_len);
-	memset(data, 0, data_len);
-	xfree(data);
-}
-static void
-client_input_exit_status(int type, u_int32_t seq, void *ctxt)
-{
-	exit_status = packet_get_int();
-	packet_check_eom();
-	/* Acknowledge the exit. */
-	packet_start(SSH_CMSG_EXIT_CONFIRMATION);
-	packet_send();
-	/*
-	 * Must wait for packet to be sent since we are
-	 * exiting the loop.
-	 */
-	packet_write_wait();
-	/* Flag that we want to exit. */
-	quit_pending = 1;
-}
-
-static Channel *
-client_request_forwarded_tcpip(const char *request_type, int rchan)
-{
-	Channel *c = NULL;
-	char *listen_address, *originator_address;
-	int listen_port, originator_port;
-	int sock;
-
-	/* Get rest of the packet */
-	listen_address = packet_get_string(NULL);
-	listen_port = packet_get_int();
-	originator_address = packet_get_string(NULL);
-	originator_port = packet_get_int();
-	packet_check_eom();
-
-	debug("client_request_forwarded_tcpip: listen %s port %d, originator %s port %d",
-	    listen_address, listen_port, originator_address, originator_port);
-
-	sock = channel_connect_by_listen_address(listen_port);
-	if (sock < 0) {
-		xfree(originator_address);
-		xfree(listen_address);
-		return NULL;
-	}
-	c = channel_new("forwarded-tcpip",
-	    SSH_CHANNEL_CONNECTING, sock, sock, -1,
-	    CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_WINDOW_DEFAULT, 0,
-	    xstrdup(originator_address), 1);
-	xfree(originator_address);
-	xfree(listen_address);
-	return c;
-}
-
-static Channel *
-client_request_x11(const char *request_type, int rchan)
-{
-	Channel *c = NULL;
-	char *originator;
-	int originator_port;
-	int sock;
-
-	if (!options.forward_x11) {
-		error("Warning: ssh server tried X11 forwarding.");
-		error("Warning: this is probably a break in attempt by a malicious server.");
-		return NULL;
-	}
-	originator = packet_get_string(NULL);
-	if (datafellows & SSH_BUG_X11FWD) {
-		debug2("buggy server: x11 request w/o originator_port");
-		originator_port = 0;
-	} else {
-		originator_port = packet_get_int();
-	}
-	packet_check_eom();
-	/* XXX check permission */
-	debug("client_request_x11: request from %s %d", originator,
-	    originator_port);
-	xfree(originator);
-	sock = x11_connect_display();
-	if (sock < 0)
-		return NULL;
-	c = channel_new("x11",
-	    SSH_CHANNEL_X11_OPEN, sock, sock, -1,
-	    CHAN_TCP_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT, 0,
-	    xstrdup("x11"), 1);
-	c->force_drain = 1;
-	return c;
-}
-
-static Channel *
-client_request_agent(const char *request_type, int rchan)
-{
-	Channel *c = NULL;
-	int sock;
-
-	if (!options.forward_agent) {
-		error("Warning: ssh server tried agent forwarding.");
-		error("Warning: this is probably a break in attempt by a malicious server.");
-		return NULL;
-	}
-	sock =  ssh_get_authentication_socket();
-	if (sock < 0)
-		return NULL;
-	c = channel_new("authentication agent connection",
-	    SSH_CHANNEL_OPEN, sock, sock, -1,
-	    CHAN_X11_WINDOW_DEFAULT, CHAN_TCP_WINDOW_DEFAULT, 0,
-	    xstrdup("authentication agent connection"), 1);
-	c->force_drain = 1;
-	return c;
-}
-
-/* XXXX move to generic input handler */
-static void
-client_input_channel_open(int type, u_int32_t seq, void *ctxt)
-{
-	Channel *c = NULL;
-	char *ctype;
-	int rchan;
-	u_int rmaxpack, rwindow, len;
-
-	ctype = packet_get_string(&len);
-	rchan = packet_get_int();
-	rwindow = packet_get_int();
-	rmaxpack = packet_get_int();
-
-	debug("client_input_channel_open: ctype %s rchan %d win %d max %d",
-	    ctype, rchan, rwindow, rmaxpack);
-
-	if (strcmp(ctype, "forwarded-tcpip") == 0) {
-		c = client_request_forwarded_tcpip(ctype, rchan);
-	} else if (strcmp(ctype, "x11") == 0) {
-		c = client_request_x11(ctype, rchan);
-	} else if (strcmp(ctype, "auth-agent@openssh.com") == 0) {
-		c = client_request_agent(ctype, rchan);
-	}
-/* XXX duplicate : */
-	if (c != NULL) {
-		debug("confirm %s", ctype);
-		c->remote_id = rchan;
-		c->remote_window = rwindow;
-		c->remote_maxpacket = rmaxpack;
-		if (c->type != SSH_CHANNEL_CONNECTING) {
-			packet_start(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION);
-			packet_put_int(c->remote_id);
-			packet_put_int(c->self);
-			packet_put_int(c->local_window);
-			packet_put_int(c->local_maxpacket);
-			packet_send();
-		}
-	} else {
-		debug("failure %s", ctype);
-		packet_start(SSH2_MSG_CHANNEL_OPEN_FAILURE);
-		packet_put_int(rchan);
-		packet_put_int(SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED);
-		if (!(datafellows & SSH_BUG_OPENFAILURE)) {
-			packet_put_cstring("open failed");
-			packet_put_cstring("");
-		}
-		packet_send();
-	}
-	xfree(ctype);
-}
-static void
-client_input_channel_req(int type, u_int32_t seq, void *ctxt)
-{
-	Channel *c = NULL;
-	int id, reply, success = 0;
-	char *rtype;
-
-	id = packet_get_int();
-	rtype = packet_get_string(NULL);
-	reply = packet_get_char();
-
-	debug("client_input_channel_req: channel %d rtype %s reply %d",
-	    id, rtype, reply);
-
-	if (session_ident == -1) {
-		error("client_input_channel_req: no channel %d", session_ident);
-	} else if (id != session_ident) {
-		error("client_input_channel_req: channel %d: wrong channel: %d",
-		    session_ident, id);
-	}
-	c = channel_lookup(id);
-	if (c == NULL) {
-		error("client_input_channel_req: channel %d: unknown channel", id);
-	} else if (strcmp(rtype, "exit-status") == 0) {
-		success = 1;
-		exit_status = packet_get_int();
-		packet_check_eom();
-	}
-	if (reply) {
-		packet_start(success ?
-		    SSH2_MSG_CHANNEL_SUCCESS : SSH2_MSG_CHANNEL_FAILURE);
-		packet_put_int(c->remote_id);
-		packet_send();
-	}
-	xfree(rtype);
-}
-static void
-client_input_global_request(int type, u_int32_t seq, void *ctxt)
-{
-	char *rtype;
-	int want_reply;
-	int success = 0;
-
-	rtype = packet_get_string(NULL);
-	want_reply = packet_get_char();
-	debug("client_input_global_request: rtype %s want_reply %d", rtype, want_reply);
-	if (want_reply) {
-		packet_start(success ?
-		    SSH2_MSG_REQUEST_SUCCESS : SSH2_MSG_REQUEST_FAILURE);
-		packet_send();
-		packet_write_wait();
-	}
-	xfree(rtype);
-}
-
-static void
-client_init_dispatch_20(void)
-{
-	dispatch_init(&dispatch_protocol_error);
-
-	dispatch_set(SSH2_MSG_CHANNEL_CLOSE, &channel_input_oclose);
-	dispatch_set(SSH2_MSG_CHANNEL_DATA, &channel_input_data);
-	dispatch_set(SSH2_MSG_CHANNEL_EOF, &channel_input_ieof);
-	dispatch_set(SSH2_MSG_CHANNEL_EXTENDED_DATA, &channel_input_extended_data);
-	dispatch_set(SSH2_MSG_CHANNEL_OPEN, &client_input_channel_open);
-	dispatch_set(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION, &channel_input_open_confirmation);
-	dispatch_set(SSH2_MSG_CHANNEL_OPEN_FAILURE, &channel_input_open_failure);
-	dispatch_set(SSH2_MSG_CHANNEL_REQUEST, &client_input_channel_req);
-	dispatch_set(SSH2_MSG_CHANNEL_WINDOW_ADJUST, &channel_input_window_adjust);
-	dispatch_set(SSH2_MSG_GLOBAL_REQUEST, &client_input_global_request);
-
-	/* rekeying */
-	dispatch_set(SSH2_MSG_KEXINIT, &kex_input_kexinit);
-
-	/* global request reply messages */
-	dispatch_set(SSH2_MSG_REQUEST_FAILURE, &client_global_request_reply);
-	dispatch_set(SSH2_MSG_REQUEST_SUCCESS, &client_global_request_reply);
-}
-static void
-client_init_dispatch_13(void)
-{
-	dispatch_init(NULL);
-	dispatch_set(SSH_MSG_CHANNEL_CLOSE, &channel_input_close);
-	dispatch_set(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION, &channel_input_close_confirmation);
-	dispatch_set(SSH_MSG_CHANNEL_DATA, &channel_input_data);
-	dispatch_set(SSH_MSG_CHANNEL_OPEN_CONFIRMATION, &channel_input_open_confirmation);
-	dispatch_set(SSH_MSG_CHANNEL_OPEN_FAILURE, &channel_input_open_failure);
-	dispatch_set(SSH_MSG_PORT_OPEN, &channel_input_port_open);
-	dispatch_set(SSH_SMSG_EXITSTATUS, &client_input_exit_status);
-	dispatch_set(SSH_SMSG_STDERR_DATA, &client_input_stderr_data);
-	dispatch_set(SSH_SMSG_STDOUT_DATA, &client_input_stdout_data);
-
-	dispatch_set(SSH_SMSG_AGENT_OPEN, options.forward_agent ?
-	    &auth_input_open_request : &deny_input_open);
-	dispatch_set(SSH_SMSG_X11_OPEN, options.forward_x11 ?
-	    &x11_input_open : &deny_input_open);
-}
-static void
-client_init_dispatch_15(void)
-{
-	client_init_dispatch_13();
-	dispatch_set(SSH_MSG_CHANNEL_CLOSE, &channel_input_ieof);
-	dispatch_set(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION, & channel_input_oclose);
-}
-static void
-client_init_dispatch(void)
-{
-	if (compat20)
-		client_init_dispatch_20();
-	else if (compat13)
-		client_init_dispatch_13();
-	else
-		client_init_dispatch_15();
-}
diff --git a/crypto/openssh/clientloop.h b/crypto/openssh/clientloop.h
deleted file mode 100644
index 8056a40c3ab9..000000000000
--- a/crypto/openssh/clientloop.h
+++ /dev/null
@@ -1,40 +0,0 @@
-/*	$OpenBSD: clientloop.h,v 1.7 2002/04/22 21:04:52 markus Exp $	*/
-
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-/*
- * Copyright (c) 2001 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/* Client side main loop for the interactive session. */
-int	 client_loop(int, int, int);
-void	 client_global_request_reply(int type, u_int32_t seq, void *ctxt);
diff --git a/crypto/openssh/compat.c b/crypto/openssh/compat.c
deleted file mode 100644
index 5e1774ab63d5..000000000000
--- a/crypto/openssh/compat.c
+++ /dev/null
@@ -1,228 +0,0 @@
-/*
- * Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: compat.c,v 1.66 2003/04/01 10:31:26 markus Exp $");
-
-#include "buffer.h"
-#include "packet.h"
-#include "xmalloc.h"
-#include "compat.h"
-#include "log.h"
-#include "match.h"
-
-int compat13 = 0;
-int compat20 = 0;
-int datafellows = 0;
-
-void
-enable_compat20(void)
-{
-	debug("Enabling compatibility mode for protocol 2.0");
-	compat20 = 1;
-}
-void
-enable_compat13(void)
-{
-	debug("Enabling compatibility mode for protocol 1.3");
-	compat13 = 1;
-}
-/* datafellows bug compatibility */
-void
-compat_datafellows(const char *version)
-{
-	int i;
-	static struct {
-		char	*pat;
-		int	bugs;
-	} check[] = {
-		{ "OpenSSH-2.0*,"
-		  "OpenSSH-2.1*,"
-		  "OpenSSH_2.1*,"
-		  "OpenSSH_2.2*",	SSH_OLD_SESSIONID|SSH_BUG_BANNER|
-					SSH_OLD_DHGEX|SSH_BUG_NOREKEY|
-					SSH_BUG_EXTEOF},
-		{ "OpenSSH_2.3.0*",	SSH_BUG_BANNER|SSH_BUG_BIGENDIANAES|
-					SSH_OLD_DHGEX|SSH_BUG_NOREKEY|
-					SSH_BUG_EXTEOF},
-		{ "OpenSSH_2.3.*",	SSH_BUG_BIGENDIANAES|SSH_OLD_DHGEX|
-					SSH_BUG_NOREKEY|SSH_BUG_EXTEOF},
-		{ "OpenSSH_2.5.0p1*,"
-		  "OpenSSH_2.5.1p1*",
-					SSH_BUG_BIGENDIANAES|SSH_OLD_DHGEX|
-					SSH_BUG_NOREKEY|SSH_BUG_EXTEOF},
-		{ "OpenSSH_2.5.0*,"
-		  "OpenSSH_2.5.1*,"
-		  "OpenSSH_2.5.2*",	SSH_OLD_DHGEX|SSH_BUG_NOREKEY|
-					SSH_BUG_EXTEOF},
-		{ "OpenSSH_2.5.3*",	SSH_BUG_NOREKEY|SSH_BUG_EXTEOF},
-		{ "OpenSSH_2.*,"
-		  "OpenSSH_3.0*,"
-		  "OpenSSH_3.1*",	SSH_BUG_EXTEOF},
-		{ "Sun_SSH_1.0*",	SSH_BUG_NOREKEY|SSH_BUG_EXTEOF},
-		{ "OpenSSH*",		0 },
-		{ "*MindTerm*",		0 },
-		{ "2.1.0*",		SSH_BUG_SIGBLOB|SSH_BUG_HMAC|
-					SSH_OLD_SESSIONID|SSH_BUG_DEBUG|
-					SSH_BUG_RSASIGMD5|SSH_BUG_HBSERVICE|
-					SSH_BUG_FIRSTKEX },
-		{ "2.1 *",		SSH_BUG_SIGBLOB|SSH_BUG_HMAC|
-					SSH_OLD_SESSIONID|SSH_BUG_DEBUG|
-					SSH_BUG_RSASIGMD5|SSH_BUG_HBSERVICE|
-					SSH_BUG_FIRSTKEX },
-		{ "2.0.13*,"
-		  "2.0.14*,"
-		  "2.0.15*,"
-		  "2.0.16*,"
-		  "2.0.17*,"
-		  "2.0.18*,"
-		  "2.0.19*",		SSH_BUG_SIGBLOB|SSH_BUG_HMAC|
-					SSH_OLD_SESSIONID|SSH_BUG_DEBUG|
-					SSH_BUG_PKSERVICE|SSH_BUG_X11FWD|
-					SSH_BUG_PKOK|SSH_BUG_RSASIGMD5|
-					SSH_BUG_HBSERVICE|SSH_BUG_OPENFAILURE|
-					SSH_BUG_DUMMYCHAN|SSH_BUG_FIRSTKEX },
-		{ "2.0.11*,"
-		  "2.0.12*",		SSH_BUG_SIGBLOB|SSH_BUG_HMAC|
-					SSH_OLD_SESSIONID|SSH_BUG_DEBUG|
-					SSH_BUG_PKSERVICE|SSH_BUG_X11FWD|
-					SSH_BUG_PKAUTH|SSH_BUG_PKOK|
-					SSH_BUG_RSASIGMD5|SSH_BUG_OPENFAILURE|
-					SSH_BUG_DUMMYCHAN|SSH_BUG_FIRSTKEX },
-		{ "2.0.*",		SSH_BUG_SIGBLOB|SSH_BUG_HMAC|
-					SSH_OLD_SESSIONID|SSH_BUG_DEBUG|
-					SSH_BUG_PKSERVICE|SSH_BUG_X11FWD|
-					SSH_BUG_PKAUTH|SSH_BUG_PKOK|
-					SSH_BUG_RSASIGMD5|SSH_BUG_OPENFAILURE|
-					SSH_BUG_DERIVEKEY|SSH_BUG_DUMMYCHAN|
-					SSH_BUG_FIRSTKEX },
-		{ "2.2.0*,"
-		  "2.3.0*",		SSH_BUG_HMAC|SSH_BUG_DEBUG|
-					SSH_BUG_RSASIGMD5|SSH_BUG_FIRSTKEX },
-		{ "2.3.*",		SSH_BUG_DEBUG|SSH_BUG_RSASIGMD5|
-					SSH_BUG_FIRSTKEX },
-		{ "2.4",		SSH_OLD_SESSIONID },	/* Van Dyke */
-		{ "2.*",		SSH_BUG_DEBUG|SSH_BUG_FIRSTKEX },
-		{ "3.0.*",		SSH_BUG_DEBUG },
-		{ "3.0 SecureCRT*",	SSH_OLD_SESSIONID },
-		{ "1.7 SecureFX*",	SSH_OLD_SESSIONID },
-		{ "1.2.18*,"
-		  "1.2.19*,"
-		  "1.2.20*,"
-		  "1.2.21*,"
-		  "1.2.22*",		SSH_BUG_IGNOREMSG|SSH_BUG_K5USER },
-		{ "1.3.2*",		/* F-Secure */
-					SSH_BUG_IGNOREMSG|SSH_BUG_K5USER },
-		{ "1.2.1*,"
-		  "1.2.2*,"
-		  "1.2.3*",		SSH_BUG_K5USER },
-		{ "*SSH Compatible Server*",			/* Netscreen */
-					SSH_BUG_PASSWORDPAD },
-		{ "*OSU_0*,"
-		  "OSU_1.0*,"
-		  "OSU_1.1*,"
-		  "OSU_1.2*,"
-		  "OSU_1.3*,"
-		  "OSU_1.4*,"
-		  "OSU_1.5alpha1*,"
-		  "OSU_1.5alpha2*,"
-		  "OSU_1.5alpha3*",	SSH_BUG_PASSWORDPAD },
-		{ "*SSH_Version_Mapper*",
-					SSH_BUG_SCANNER },
-		{ "Probe-*",
-					SSH_BUG_PROBE },
-		{ NULL,			0 }
-	};
-
-	/* process table, return first match */
-	for (i = 0; check[i].pat; i++) {
-		if (match_pattern_list(version, check[i].pat,
-		    strlen(check[i].pat), 0) == 1) {
-			debug("match: %s pat %s", version, check[i].pat);
-			datafellows = check[i].bugs;
-			return;
-		}
-	}
-	debug("no match: %s", version);
-}
-
-#define	SEP	","
-int
-proto_spec(const char *spec)
-{
-	char *s, *p, *q;
-	int ret = SSH_PROTO_UNKNOWN;
-
-	if (spec == NULL)
-		return ret;
-	q = s = xstrdup(spec);
-	for ((p = strsep(&q, SEP)); p && *p != '\0'; (p = strsep(&q, SEP))) {
-		switch (atoi(p)) {
-		case 1:
-			if (ret == SSH_PROTO_UNKNOWN)
-				ret |= SSH_PROTO_1_PREFERRED;
-			ret |= SSH_PROTO_1;
-			break;
-		case 2:
-			ret |= SSH_PROTO_2;
-			break;
-		default:
-			log("ignoring bad proto spec: '%s'.", p);
-			break;
-		}
-	}
-	xfree(s);
-	return ret;
-}
-
-char *
-compat_cipher_proposal(char *cipher_prop)
-{
-	Buffer b;
-	char *orig_prop, *fix_ciphers;
-	char *cp, *tmp;
-
-	if (!(datafellows & SSH_BUG_BIGENDIANAES))
-		return(cipher_prop);
-
-	buffer_init(&b);
-	tmp = orig_prop = xstrdup(cipher_prop);
-	while ((cp = strsep(&tmp, ",")) != NULL) {
-		if (strncmp(cp, "aes", 3) != 0) {
-			if (buffer_len(&b) > 0)
-				buffer_append(&b, ",", 1);
-			buffer_append(&b, cp, strlen(cp));
-		}
-	}
-	buffer_append(&b, "\0", 1);
-	fix_ciphers = xstrdup(buffer_ptr(&b));
-	buffer_free(&b);
-	xfree(orig_prop);
-	debug2("Original cipher proposal: %s", cipher_prop);
-	debug2("Compat cipher proposal: %s", fix_ciphers);
-	if (!*fix_ciphers)
-		fatal("No available ciphers found.");
-
-	return(fix_ciphers);
-}
diff --git a/crypto/openssh/compat.h b/crypto/openssh/compat.h
deleted file mode 100644
index 881e450d39ea..000000000000
--- a/crypto/openssh/compat.h
+++ /dev/null
@@ -1,69 +0,0 @@
-/*	$OpenBSD: compat.h,v 1.34 2003/04/01 10:31:26 markus Exp $	*/
-
-/*
- * Copyright (c) 1999, 2000, 2001 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef COMPAT_H
-#define COMPAT_H
-
-#define	SSH_PROTO_UNKNOWN 	0x00
-#define	SSH_PROTO_1		0x01
-#define	SSH_PROTO_1_PREFERRED	0x02
-#define	SSH_PROTO_2		0x04
-
-#define SSH_BUG_SIGBLOB		0x00000001
-#define SSH_BUG_PKSERVICE	0x00000002
-#define SSH_BUG_HMAC		0x00000004
-#define SSH_BUG_X11FWD		0x00000008
-#define SSH_OLD_SESSIONID	0x00000010
-#define SSH_BUG_PKAUTH		0x00000020
-#define SSH_BUG_DEBUG		0x00000040
-#define SSH_BUG_BANNER		0x00000080
-#define SSH_BUG_IGNOREMSG	0x00000100
-#define SSH_BUG_PKOK		0x00000200
-#define SSH_BUG_PASSWORDPAD	0x00000400
-#define SSH_BUG_SCANNER		0x00000800
-#define SSH_BUG_BIGENDIANAES	0x00001000
-#define SSH_BUG_RSASIGMD5	0x00002000
-#define SSH_OLD_DHGEX		0x00004000
-#define SSH_BUG_NOREKEY		0x00008000
-#define SSH_BUG_HBSERVICE	0x00010000
-#define SSH_BUG_OPENFAILURE	0x00020000
-#define SSH_BUG_DERIVEKEY	0x00040000
-#define SSH_BUG_DUMMYCHAN	0x00100000
-#define SSH_BUG_EXTEOF		0x00200000
-#define SSH_BUG_K5USER		0x00400000
-#define SSH_BUG_PROBE		0x00800000
-#define SSH_BUG_FIRSTKEX	0x01000000
-
-void     enable_compat13(void);
-void     enable_compat20(void);
-void     compat_datafellows(const char *);
-int	 proto_spec(const char *);
-char	*compat_cipher_proposal(char *);
-
-extern int compat13;
-extern int compat20;
-extern int datafellows;
-#endif
diff --git a/crypto/openssh/compress.c b/crypto/openssh/compress.c
deleted file mode 100644
index 85a361d3a58e..000000000000
--- a/crypto/openssh/compress.c
+++ /dev/null
@@ -1,160 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * Interface to packet compression for ssh.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: compress.c,v 1.19 2002/03/18 17:31:54 provos Exp $");
-
-#include "log.h"
-#include "buffer.h"
-#include "zlib.h"
-#include "compress.h"
-
-z_stream incoming_stream;
-z_stream outgoing_stream;
-static int compress_init_send_called = 0;
-static int compress_init_recv_called = 0;
-static int inflate_failed = 0;
-static int deflate_failed = 0;
-
-/*
- * Initializes compression; level is compression level from 1 to 9
- * (as in gzip).
- */
-
-void
-buffer_compress_init_send(int level)
-{
-	if (compress_init_send_called == 1)
-		deflateEnd(&outgoing_stream);
-	compress_init_send_called = 1;
-	debug("Enabling compression at level %d.", level);
-	if (level < 1 || level > 9)
-		fatal("Bad compression level %d.", level);
-	deflateInit(&outgoing_stream, level);
-}
-void
-buffer_compress_init_recv(void)
-{
-	if (compress_init_recv_called == 1)
-		inflateEnd(&incoming_stream);
-	compress_init_recv_called = 1;
-	inflateInit(&incoming_stream);
-}
-
-/* Frees any data structures allocated for compression. */
-
-void
-buffer_compress_uninit(void)
-{
-	debug("compress outgoing: raw data %lu, compressed %lu, factor %.2f",
-	    outgoing_stream.total_in, outgoing_stream.total_out,
-	    outgoing_stream.total_in == 0 ? 0.0 :
-	    (double) outgoing_stream.total_out / outgoing_stream.total_in);
-	debug("compress incoming: raw data %lu, compressed %lu, factor %.2f",
-	    incoming_stream.total_out, incoming_stream.total_in,
-	    incoming_stream.total_out == 0 ? 0.0 :
-	    (double) incoming_stream.total_in / incoming_stream.total_out);
-	if (compress_init_recv_called == 1 && inflate_failed == 0)
-		inflateEnd(&incoming_stream);
-	if (compress_init_send_called == 1 && deflate_failed == 0)
-		deflateEnd(&outgoing_stream);
-}
-
-/*
- * Compresses the contents of input_buffer into output_buffer.  All packets
- * compressed using this function will form a single compressed data stream;
- * however, data will be flushed at the end of every call so that each
- * output_buffer can be decompressed independently (but in the appropriate
- * order since they together form a single compression stream) by the
- * receiver.  This appends the compressed data to the output buffer.
- */
-
-void
-buffer_compress(Buffer * input_buffer, Buffer * output_buffer)
-{
-	u_char buf[4096];
-	int status;
-
-	/* This case is not handled below. */
-	if (buffer_len(input_buffer) == 0)
-		return;
-
-	/* Input is the contents of the input buffer. */
-	outgoing_stream.next_in = buffer_ptr(input_buffer);
-	outgoing_stream.avail_in = buffer_len(input_buffer);
-
-	/* Loop compressing until deflate() returns with avail_out != 0. */
-	do {
-		/* Set up fixed-size output buffer. */
-		outgoing_stream.next_out = buf;
-		outgoing_stream.avail_out = sizeof(buf);
-
-		/* Compress as much data into the buffer as possible. */
-		status = deflate(&outgoing_stream, Z_PARTIAL_FLUSH);
-		switch (status) {
-		case Z_OK:
-			/* Append compressed data to output_buffer. */
-			buffer_append(output_buffer, buf,
-			    sizeof(buf) - outgoing_stream.avail_out);
-			break;
-		default:
-			deflate_failed = 1;
-			fatal("buffer_compress: deflate returned %d", status);
-			/* NOTREACHED */
-		}
-	} while (outgoing_stream.avail_out == 0);
-}
-
-/*
- * Uncompresses the contents of input_buffer into output_buffer.  All packets
- * uncompressed using this function will form a single compressed data
- * stream; however, data will be flushed at the end of every call so that
- * each output_buffer.  This must be called for the same size units that the
- * buffer_compress was called, and in the same order that buffers compressed
- * with that.  This appends the uncompressed data to the output buffer.
- */
-
-void
-buffer_uncompress(Buffer * input_buffer, Buffer * output_buffer)
-{
-	u_char buf[4096];
-	int status;
-
-	incoming_stream.next_in = buffer_ptr(input_buffer);
-	incoming_stream.avail_in = buffer_len(input_buffer);
-
-	for (;;) {
-		/* Set up fixed-size output buffer. */
-		incoming_stream.next_out = buf;
-		incoming_stream.avail_out = sizeof(buf);
-
-		status = inflate(&incoming_stream, Z_PARTIAL_FLUSH);
-		switch (status) {
-		case Z_OK:
-			buffer_append(output_buffer, buf,
-			    sizeof(buf) - incoming_stream.avail_out);
-			break;
-		case Z_BUF_ERROR:
-			/*
-			 * Comments in zlib.h say that we should keep calling
-			 * inflate() until we get an error.  This appears to
-			 * be the error that we get.
-			 */
-			return;
-		default:
-			inflate_failed = 1;
-			fatal("buffer_uncompress: inflate returned %d", status);
-			/* NOTREACHED */
-		}
-	}
-}
diff --git a/crypto/openssh/compress.h b/crypto/openssh/compress.h
deleted file mode 100644
index e364f4bdc582..000000000000
--- a/crypto/openssh/compress.h
+++ /dev/null
@@ -1,25 +0,0 @@
-/*	$OpenBSD: compress.h,v 1.11 2002/03/04 17:27:39 stevesk Exp $	*/
-
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * Interface to packet compression for ssh.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#ifndef COMPRESS_H
-#define COMPRESS_H
-
-void	 buffer_compress_init_send(int);
-void	 buffer_compress_init_recv(void);
-void     buffer_compress_uninit(void);
-void     buffer_compress(Buffer *, Buffer *);
-void     buffer_uncompress(Buffer *, Buffer *);
-
-#endif				/* COMPRESS_H */
diff --git a/crypto/openssh/config.guess b/crypto/openssh/config.guess
deleted file mode 100755
index e8f2061233dd..000000000000
--- a/crypto/openssh/config.guess
+++ /dev/null
@@ -1,1357 +0,0 @@
-#! /bin/sh
-# Attempt to guess a canonical system name.
-#   Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999,
-#   2000, 2001, 2002 Free Software Foundation, Inc.
-
-timestamp='2002-07-23'
-
-# This file is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-# General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
-#
-# As a special exception to the GNU General Public License, if you
-# distribute this file as part of a program that contains a
-# configuration script generated by Autoconf, you may include it under
-# the same distribution terms that you use for the rest of that program.
-
-# Originally written by Per Bothner <per@bothner.com>.
-# Please send patches to <config-patches@gnu.org>.  Submit a context
-# diff and a properly formatted ChangeLog entry.
-#
-# This script attempts to guess a canonical system name similar to
-# config.sub.  If it succeeds, it prints the system name on stdout, and
-# exits with 0.  Otherwise, it exits with 1.
-#
-# The plan is that this can be called by configure scripts if you
-# don't specify an explicit build system type.
-
-me=`echo "$0" | sed -e 's,.*/,,'`
-
-usage="\
-Usage: $0 [OPTION]
-
-Output the configuration name of the system \`$me' is run on.
-
-Operation modes:
-  -h, --help         print this help, then exit
-  -t, --time-stamp   print date of last modification, then exit
-  -v, --version      print version number, then exit
-
-Report bugs and patches to <config-patches@gnu.org>."
-
-version="\
-GNU config.guess ($timestamp)
-
-Originally written by Per Bothner.
-Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001
-Free Software Foundation, Inc.
-
-This is free software; see the source for copying conditions.  There is NO
-warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
-
-help="
-Try \`$me --help' for more information."
-
-# Parse command line
-while test $# -gt 0 ; do
-  case $1 in
-    --time-stamp | --time* | -t )
-       echo "$timestamp" ; exit 0 ;;
-    --version | -v )
-       echo "$version" ; exit 0 ;;
-    --help | --h* | -h )
-       echo "$usage"; exit 0 ;;
-    -- )     # Stop option processing
-       shift; break ;;
-    - )	# Use stdin as input.
-       break ;;
-    -* )
-       echo "$me: invalid option $1$help" >&2
-       exit 1 ;;
-    * )
-       break ;;
-  esac
-done
-
-if test $# != 0; then
-  echo "$me: too many arguments$help" >&2
-  exit 1
-fi
-
-trap 'exit 1' 1 2 15
-
-# CC_FOR_BUILD -- compiler used by this script. Note that the use of a
-# compiler to aid in system detection is discouraged as it requires
-# temporary files to be created and, as you can see below, it is a
-# headache to deal with in a portable fashion.
-
-# Historically, `CC_FOR_BUILD' used to be named `HOST_CC'. We still
-# use `HOST_CC' if defined, but it is deprecated.
-
-# This shell variable is my proudest work .. or something. --bje
-
-set_cc_for_build='tmpdir=${TMPDIR-/tmp}/config-guess-$$ ;
-(old=`umask` && umask 077 && mkdir $tmpdir && umask $old && unset old)
-   || (echo "$me: cannot create $tmpdir" >&2 && exit 1) ;
-dummy=$tmpdir/dummy ;
-files="$dummy.c $dummy.o $dummy.rel $dummy" ;
-trap '"'"'rm -f $files; rmdir $tmpdir; exit 1'"'"' 1 2 15 ;
-case $CC_FOR_BUILD,$HOST_CC,$CC in
- ,,)    echo "int x;" > $dummy.c ;
-	for c in cc gcc c89 c99 ; do
-	  if ($c $dummy.c -c -o $dummy.o) >/dev/null 2>&1 ; then
-	     CC_FOR_BUILD="$c"; break ;
-	  fi ;
-	done ;
-	rm -f $files ;
-	if test x"$CC_FOR_BUILD" = x ; then
-	  CC_FOR_BUILD=no_compiler_found ;
-	fi
-	;;
- ,,*)   CC_FOR_BUILD=$CC ;;
- ,*,*)  CC_FOR_BUILD=$HOST_CC ;;
-esac ;
-unset files'
-
-# This is needed to find uname on a Pyramid OSx when run in the BSD universe.
-# (ghazi@noc.rutgers.edu 1994-08-24)
-if (test -f /.attbin/uname) >/dev/null 2>&1 ; then
-	PATH=$PATH:/.attbin ; export PATH
-fi
-
-UNAME_MACHINE=`(uname -m) 2>/dev/null` || UNAME_MACHINE=unknown
-UNAME_RELEASE=`(uname -r) 2>/dev/null` || UNAME_RELEASE=unknown
-UNAME_SYSTEM=`(uname -s) 2>/dev/null`  || UNAME_SYSTEM=unknown
-UNAME_VERSION=`(uname -v) 2>/dev/null` || UNAME_VERSION=unknown
-
-# Note: order is significant - the case branches are not exclusive.
-
-case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
-    *:NetBSD:*:*)
-	# NetBSD (nbsd) targets should (where applicable) match one or
-	# more of the tupples: *-*-netbsdelf*, *-*-netbsdaout*,
-	# *-*-netbsdecoff* and *-*-netbsd*.  For targets that recently
-	# switched to ELF, *-*-netbsd* would select the old
-	# object file format.  This provides both forward
-	# compatibility and a consistent mechanism for selecting the
-	# object file format.
-	#
-	# Note: NetBSD doesn't particularly care about the vendor
-	# portion of the name.  We always set it to "unknown".
-	sysctl="sysctl -n hw.machine_arch"
-	UNAME_MACHINE_ARCH=`(/sbin/$sysctl 2>/dev/null || \
-	    /usr/sbin/$sysctl 2>/dev/null || echo unknown)`
-	case "${UNAME_MACHINE_ARCH}" in
-	    armeb) machine=armeb-unknown ;;
-	    arm*) machine=arm-unknown ;;
-	    sh3el) machine=shl-unknown ;;
-	    sh3eb) machine=sh-unknown ;;
-	    *) machine=${UNAME_MACHINE_ARCH}-unknown ;;
-	esac
-	# The Operating System including object format, if it has switched
-	# to ELF recently, or will in the future.
-	case "${UNAME_MACHINE_ARCH}" in
-	    arm*|i386|m68k|ns32k|sh3*|sparc|vax)
-		eval $set_cc_for_build
-		if echo __ELF__ | $CC_FOR_BUILD -E - 2>/dev/null \
-			| grep __ELF__ >/dev/null
-		then
-		    # Once all utilities can be ECOFF (netbsdecoff) or a.out (netbsdaout).
-		    # Return netbsd for either.  FIX?
-		    os=netbsd
-		else
-		    os=netbsdelf
-		fi
-		;;
-	    *)
-	        os=netbsd
-		;;
-	esac
-	# The OS release
-	release=`echo ${UNAME_RELEASE}|sed -e 's/[-_].*/\./'`
-	# Since CPU_TYPE-MANUFACTURER-KERNEL-OPERATING_SYSTEM:
-	# contains redundant information, the shorter form:
-	# CPU_TYPE-MANUFACTURER-OPERATING_SYSTEM is used.
-	echo "${machine}-${os}${release}"
-	exit 0 ;;
-    amiga:OpenBSD:*:*)
-	echo m68k-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    arc:OpenBSD:*:*)
-	echo mipsel-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    hp300:OpenBSD:*:*)
-	echo m68k-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    mac68k:OpenBSD:*:*)
-	echo m68k-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    macppc:OpenBSD:*:*)
-	echo powerpc-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    mvme68k:OpenBSD:*:*)
-	echo m68k-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    mvme88k:OpenBSD:*:*)
-	echo m88k-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    mvmeppc:OpenBSD:*:*)
-	echo powerpc-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    pmax:OpenBSD:*:*)
-	echo mipsel-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    sgi:OpenBSD:*:*)
-	echo mipseb-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    sun3:OpenBSD:*:*)
-	echo m68k-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    wgrisc:OpenBSD:*:*)
-	echo mipsel-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    *:OpenBSD:*:*)
-	echo ${UNAME_MACHINE}-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    alpha:OSF1:*:*)
-	if test $UNAME_RELEASE = "V4.0"; then
-		UNAME_RELEASE=`/usr/sbin/sizer -v | awk '{print $3}'`
-	fi
-	# A Vn.n version is a released version.
-	# A Tn.n version is a released field test version.
-	# A Xn.n version is an unreleased experimental baselevel.
-	# 1.2 uses "1.2" for uname -r.
-	eval $set_cc_for_build
-	cat <<EOF >$dummy.s
-	.data
-\$Lformat:
-	.byte 37,100,45,37,120,10,0	# "%d-%x\n"
-
-	.text
-	.globl main
-	.align 4
-	.ent main
-main:
-	.frame \$30,16,\$26,0
-	ldgp \$29,0(\$27)
-	.prologue 1
-	.long 0x47e03d80 # implver \$0
-	lda \$2,-1
-	.long 0x47e20c21 # amask \$2,\$1
-	lda \$16,\$Lformat
-	mov \$0,\$17
-	not \$1,\$18
-	jsr \$26,printf
-	ldgp \$29,0(\$26)
-	mov 0,\$16
-	jsr \$26,exit
-	.end main
-EOF
-	$CC_FOR_BUILD $dummy.s -o $dummy 2>/dev/null
-	if test "$?" = 0 ; then
-		case `$dummy` in
-			0-0)
-				UNAME_MACHINE="alpha"
-				;;
-			1-0)
-				UNAME_MACHINE="alphaev5"
-				;;
-			1-1)
-				UNAME_MACHINE="alphaev56"
-				;;
-			1-101)
-				UNAME_MACHINE="alphapca56"
-				;;
-			2-303)
-				UNAME_MACHINE="alphaev6"
-				;;
-			2-307)
-				UNAME_MACHINE="alphaev67"
-				;;
-			2-1307)
-				UNAME_MACHINE="alphaev68"
-				;;
-			3-1307)
-				UNAME_MACHINE="alphaev7"
-				;;
-		esac
-	fi
-	rm -f $dummy.s $dummy && rmdir $tmpdir
-	echo ${UNAME_MACHINE}-dec-osf`echo ${UNAME_RELEASE} | sed -e 's/^[VTX]//' | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz'`
-	exit 0 ;;
-    Alpha\ *:Windows_NT*:*)
-	# How do we know it's Interix rather than the generic POSIX subsystem?
-	# Should we change UNAME_MACHINE based on the output of uname instead
-	# of the specific Alpha model?
-	echo alpha-pc-interix
-	exit 0 ;;
-    21064:Windows_NT:50:3)
-	echo alpha-dec-winnt3.5
-	exit 0 ;;
-    Amiga*:UNIX_System_V:4.0:*)
-	echo m68k-unknown-sysv4
-	exit 0;;
-    *:[Aa]miga[Oo][Ss]:*:*)
-	echo ${UNAME_MACHINE}-unknown-amigaos
-	exit 0 ;;
-    *:[Mm]orph[Oo][Ss]:*:*)
-	echo ${UNAME_MACHINE}-unknown-morphos
-	exit 0 ;;
-    *:OS/390:*:*)
-	echo i370-ibm-openedition
-	exit 0 ;;
-    arm:RISC*:1.[012]*:*|arm:riscix:1.[012]*:*)
-	echo arm-acorn-riscix${UNAME_RELEASE}
-	exit 0;;
-    SR2?01:HI-UX/MPP:*:* | SR8000:HI-UX/MPP:*:*)
-	echo hppa1.1-hitachi-hiuxmpp
-	exit 0;;
-    Pyramid*:OSx*:*:* | MIS*:OSx*:*:* | MIS*:SMP_DC-OSx*:*:*)
-	# akee@wpdis03.wpafb.af.mil (Earle F. Ake) contributed MIS and NILE.
-	if test "`(/bin/universe) 2>/dev/null`" = att ; then
-		echo pyramid-pyramid-sysv3
-	else
-		echo pyramid-pyramid-bsd
-	fi
-	exit 0 ;;
-    NILE*:*:*:dcosx)
-	echo pyramid-pyramid-svr4
-	exit 0 ;;
-    DRS?6000:UNIX_SV:4.2*:7*)
-	case `/usr/bin/uname -p` in
-	    sparc) echo sparc-icl-nx7 && exit 0 ;;
-	esac ;;
-    sun4H:SunOS:5.*:*)
-	echo sparc-hal-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
-	exit 0 ;;
-    sun4*:SunOS:5.*:* | tadpole*:SunOS:5.*:*)
-	echo sparc-sun-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
-	exit 0 ;;
-    i86pc:SunOS:5.*:*)
-	echo i386-pc-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
-	exit 0 ;;
-    sun4*:SunOS:6*:*)
-	# According to config.sub, this is the proper way to canonicalize
-	# SunOS6.  Hard to guess exactly what SunOS6 will be like, but
-	# it's likely to be more like Solaris than SunOS4.
-	echo sparc-sun-solaris3`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
-	exit 0 ;;
-    sun4*:SunOS:*:*)
-	case "`/usr/bin/arch -k`" in
-	    Series*|S4*)
-		UNAME_RELEASE=`uname -v`
-		;;
-	esac
-	# Japanese Language versions have a version number like `4.1.3-JL'.
-	echo sparc-sun-sunos`echo ${UNAME_RELEASE}|sed -e 's/-/_/'`
-	exit 0 ;;
-    sun3*:SunOS:*:*)
-	echo m68k-sun-sunos${UNAME_RELEASE}
-	exit 0 ;;
-    sun*:*:4.2BSD:*)
-	UNAME_RELEASE=`(sed 1q /etc/motd | awk '{print substr($5,1,3)}') 2>/dev/null`
-	test "x${UNAME_RELEASE}" = "x" && UNAME_RELEASE=3
-	case "`/bin/arch`" in
-	    sun3)
-		echo m68k-sun-sunos${UNAME_RELEASE}
-		;;
-	    sun4)
-		echo sparc-sun-sunos${UNAME_RELEASE}
-		;;
-	esac
-	exit 0 ;;
-    aushp:SunOS:*:*)
-	echo sparc-auspex-sunos${UNAME_RELEASE}
-	exit 0 ;;
-    # The situation for MiNT is a little confusing.  The machine name
-    # can be virtually everything (everything which is not
-    # "atarist" or "atariste" at least should have a processor
-    # > m68000).  The system name ranges from "MiNT" over "FreeMiNT"
-    # to the lowercase version "mint" (or "freemint").  Finally
-    # the system name "TOS" denotes a system which is actually not
-    # MiNT.  But MiNT is downward compatible to TOS, so this should
-    # be no problem.
-    atarist[e]:*MiNT:*:* | atarist[e]:*mint:*:* | atarist[e]:*TOS:*:*)
-        echo m68k-atari-mint${UNAME_RELEASE}
-	exit 0 ;;
-    atari*:*MiNT:*:* | atari*:*mint:*:* | atarist[e]:*TOS:*:*)
-	echo m68k-atari-mint${UNAME_RELEASE}
-        exit 0 ;;
-    *falcon*:*MiNT:*:* | *falcon*:*mint:*:* | *falcon*:*TOS:*:*)
-        echo m68k-atari-mint${UNAME_RELEASE}
-	exit 0 ;;
-    milan*:*MiNT:*:* | milan*:*mint:*:* | *milan*:*TOS:*:*)
-        echo m68k-milan-mint${UNAME_RELEASE}
-        exit 0 ;;
-    hades*:*MiNT:*:* | hades*:*mint:*:* | *hades*:*TOS:*:*)
-        echo m68k-hades-mint${UNAME_RELEASE}
-        exit 0 ;;
-    *:*MiNT:*:* | *:*mint:*:* | *:*TOS:*:*)
-        echo m68k-unknown-mint${UNAME_RELEASE}
-        exit 0 ;;
-    powerpc:machten:*:*)
-	echo powerpc-apple-machten${UNAME_RELEASE}
-	exit 0 ;;
-    RISC*:Mach:*:*)
-	echo mips-dec-mach_bsd4.3
-	exit 0 ;;
-    RISC*:ULTRIX:*:*)
-	echo mips-dec-ultrix${UNAME_RELEASE}
-	exit 0 ;;
-    VAX*:ULTRIX*:*:*)
-	echo vax-dec-ultrix${UNAME_RELEASE}
-	exit 0 ;;
-    2020:CLIX:*:* | 2430:CLIX:*:*)
-	echo clipper-intergraph-clix${UNAME_RELEASE}
-	exit 0 ;;
-    mips:*:*:UMIPS | mips:*:*:RISCos)
-	eval $set_cc_for_build
-	sed 's/^	//' << EOF >$dummy.c
-#ifdef __cplusplus
-#include <stdio.h>  /* for printf() prototype */
-	int main (int argc, char *argv[]) {
-#else
-	int main (argc, argv) int argc; char *argv[]; {
-#endif
-	#if defined (host_mips) && defined (MIPSEB)
-	#if defined (SYSTYPE_SYSV)
-	  printf ("mips-mips-riscos%ssysv\n", argv[1]); exit (0);
-	#endif
-	#if defined (SYSTYPE_SVR4)
-	  printf ("mips-mips-riscos%ssvr4\n", argv[1]); exit (0);
-	#endif
-	#if defined (SYSTYPE_BSD43) || defined(SYSTYPE_BSD)
-	  printf ("mips-mips-riscos%sbsd\n", argv[1]); exit (0);
-	#endif
-	#endif
-	  exit (-1);
-	}
-EOF
-	$CC_FOR_BUILD $dummy.c -o $dummy \
-	  && $dummy `echo "${UNAME_RELEASE}" | sed -n 's/\([0-9]*\).*/\1/p'` \
-	  && rm -f $dummy.c $dummy && rmdir $tmpdir && exit 0
-	rm -f $dummy.c $dummy && rmdir $tmpdir
-	echo mips-mips-riscos${UNAME_RELEASE}
-	exit 0 ;;
-    Motorola:PowerMAX_OS:*:*)
-	echo powerpc-motorola-powermax
-	exit 0 ;;
-    Night_Hawk:*:*:PowerMAX_OS)
-	echo powerpc-harris-powermax
-	exit 0 ;;
-    Night_Hawk:Power_UNIX:*:*)
-	echo powerpc-harris-powerunix
-	exit 0 ;;
-    m88k:CX/UX:7*:*)
-	echo m88k-harris-cxux7
-	exit 0 ;;
-    m88k:*:4*:R4*)
-	echo m88k-motorola-sysv4
-	exit 0 ;;
-    m88k:*:3*:R3*)
-	echo m88k-motorola-sysv3
-	exit 0 ;;
-    AViiON:dgux:*:*)
-        # DG/UX returns AViiON for all architectures
-        UNAME_PROCESSOR=`/usr/bin/uname -p`
-	if [ $UNAME_PROCESSOR = mc88100 ] || [ $UNAME_PROCESSOR = mc88110 ]
-	then
-	    if [ ${TARGET_BINARY_INTERFACE}x = m88kdguxelfx ] || \
-	       [ ${TARGET_BINARY_INTERFACE}x = x ]
-	    then
-		echo m88k-dg-dgux${UNAME_RELEASE}
-	    else
-		echo m88k-dg-dguxbcs${UNAME_RELEASE}
-	    fi
-	else
-	    echo i586-dg-dgux${UNAME_RELEASE}
-	fi
- 	exit 0 ;;
-    M88*:DolphinOS:*:*)	# DolphinOS (SVR3)
-	echo m88k-dolphin-sysv3
-	exit 0 ;;
-    M88*:*:R3*:*)
-	# Delta 88k system running SVR3
-	echo m88k-motorola-sysv3
-	exit 0 ;;
-    XD88*:*:*:*) # Tektronix XD88 system running UTekV (SVR3)
-	echo m88k-tektronix-sysv3
-	exit 0 ;;
-    Tek43[0-9][0-9]:UTek:*:*) # Tektronix 4300 system running UTek (BSD)
-	echo m68k-tektronix-bsd
-	exit 0 ;;
-    *:IRIX*:*:*)
-	echo mips-sgi-irix`echo ${UNAME_RELEASE}|sed -e 's/-/_/g'`
-	exit 0 ;;
-    ????????:AIX?:[12].1:2)   # AIX 2.2.1 or AIX 2.1.1 is RT/PC AIX.
-	echo romp-ibm-aix      # uname -m gives an 8 hex-code CPU id
-	exit 0 ;;              # Note that: echo "'`uname -s`'" gives 'AIX '
-    i*86:AIX:*:*)
-	echo i386-ibm-aix
-	exit 0 ;;
-    ia64:AIX:*:*)
-	if [ -x /usr/bin/oslevel ] ; then
-		IBM_REV=`/usr/bin/oslevel`
-	else
-		IBM_REV=${UNAME_VERSION}.${UNAME_RELEASE}
-	fi
-	echo ${UNAME_MACHINE}-ibm-aix${IBM_REV}
-	exit 0 ;;
-    *:AIX:2:3)
-	if grep bos325 /usr/include/stdio.h >/dev/null 2>&1; then
-		eval $set_cc_for_build
-		sed 's/^		//' << EOF >$dummy.c
-		#include <sys/systemcfg.h>
-
-		main()
-			{
-			if (!__power_pc())
-				exit(1);
-			puts("powerpc-ibm-aix3.2.5");
-			exit(0);
-			}
-EOF
-		$CC_FOR_BUILD $dummy.c -o $dummy && $dummy && rm -f $dummy.c $dummy && rmdir $tmpdir && exit 0
-		rm -f $dummy.c $dummy && rmdir $tmpdir
-		echo rs6000-ibm-aix3.2.5
-	elif grep bos324 /usr/include/stdio.h >/dev/null 2>&1; then
-		echo rs6000-ibm-aix3.2.4
-	else
-		echo rs6000-ibm-aix3.2
-	fi
-	exit 0 ;;
-    *:AIX:*:[45])
-	IBM_CPU_ID=`/usr/sbin/lsdev -C -c processor -S available | sed 1q | awk '{ print $1 }'`
-	if /usr/sbin/lsattr -El ${IBM_CPU_ID} | grep ' POWER' >/dev/null 2>&1; then
-		IBM_ARCH=rs6000
-	else
-		IBM_ARCH=powerpc
-	fi
-	if [ -x /usr/bin/oslevel ] ; then
-		IBM_REV=`/usr/bin/oslevel`
-	else
-		IBM_REV=${UNAME_VERSION}.${UNAME_RELEASE}
-	fi
-	echo ${IBM_ARCH}-ibm-aix${IBM_REV}
-	exit 0 ;;
-    *:AIX:*:*)
-	echo rs6000-ibm-aix
-	exit 0 ;;
-    ibmrt:4.4BSD:*|romp-ibm:BSD:*)
-	echo romp-ibm-bsd4.4
-	exit 0 ;;
-    ibmrt:*BSD:*|romp-ibm:BSD:*)            # covers RT/PC BSD and
-	echo romp-ibm-bsd${UNAME_RELEASE}   # 4.3 with uname added to
-	exit 0 ;;                           # report: romp-ibm BSD 4.3
-    *:BOSX:*:*)
-	echo rs6000-bull-bosx
-	exit 0 ;;
-    DPX/2?00:B.O.S.:*:*)
-	echo m68k-bull-sysv3
-	exit 0 ;;
-    9000/[34]??:4.3bsd:1.*:*)
-	echo m68k-hp-bsd
-	exit 0 ;;
-    hp300:4.4BSD:*:* | 9000/[34]??:4.3bsd:2.*:*)
-	echo m68k-hp-bsd4.4
-	exit 0 ;;
-    9000/[34678]??:HP-UX:*:*)
-	HPUX_REV=`echo ${UNAME_RELEASE}|sed -e 's/[^.]*.[0B]*//'`
-	case "${UNAME_MACHINE}" in
-	    9000/31? )            HP_ARCH=m68000 ;;
-	    9000/[34]?? )         HP_ARCH=m68k ;;
-	    9000/[678][0-9][0-9])
-		if [ -x /usr/bin/getconf ]; then
-		    sc_cpu_version=`/usr/bin/getconf SC_CPU_VERSION 2>/dev/null`
-                    sc_kernel_bits=`/usr/bin/getconf SC_KERNEL_BITS 2>/dev/null`
-                    case "${sc_cpu_version}" in
-                      523) HP_ARCH="hppa1.0" ;; # CPU_PA_RISC1_0
-                      528) HP_ARCH="hppa1.1" ;; # CPU_PA_RISC1_1
-                      532)                      # CPU_PA_RISC2_0
-                        case "${sc_kernel_bits}" in
-                          32) HP_ARCH="hppa2.0n" ;;
-                          64) HP_ARCH="hppa2.0w" ;;
-			  '') HP_ARCH="hppa2.0" ;;   # HP-UX 10.20
-                        esac ;;
-                    esac
-		fi
-		if [ "${HP_ARCH}" = "" ]; then
-		    eval $set_cc_for_build
-		    sed 's/^              //' << EOF >$dummy.c
-
-              #define _HPUX_SOURCE
-              #include <stdlib.h>
-              #include <unistd.h>
-
-              int main ()
-              {
-              #if defined(_SC_KERNEL_BITS)
-                  long bits = sysconf(_SC_KERNEL_BITS);
-              #endif
-                  long cpu  = sysconf (_SC_CPU_VERSION);
-
-                  switch (cpu)
-              	{
-              	case CPU_PA_RISC1_0: puts ("hppa1.0"); break;
-              	case CPU_PA_RISC1_1: puts ("hppa1.1"); break;
-              	case CPU_PA_RISC2_0:
-              #if defined(_SC_KERNEL_BITS)
-              	    switch (bits)
-              		{
-              		case 64: puts ("hppa2.0w"); break;
-              		case 32: puts ("hppa2.0n"); break;
-              		default: puts ("hppa2.0"); break;
-              		} break;
-              #else  /* !defined(_SC_KERNEL_BITS) */
-              	    puts ("hppa2.0"); break;
-              #endif
-              	default: puts ("hppa1.0"); break;
-              	}
-                  exit (0);
-              }
-EOF
-		    (CCOPTS= $CC_FOR_BUILD $dummy.c -o $dummy 2>/dev/null) && HP_ARCH=`$dummy`
-		    if test -z "$HP_ARCH"; then HP_ARCH=hppa; fi
-		    rm -f $dummy.c $dummy && rmdir $tmpdir
-		fi ;;
-	esac
-	echo ${HP_ARCH}-hp-hpux${HPUX_REV}
-	exit 0 ;;
-    ia64:HP-UX:*:*)
-	HPUX_REV=`echo ${UNAME_RELEASE}|sed -e 's/[^.]*.[0B]*//'`
-	echo ia64-hp-hpux${HPUX_REV}
-	exit 0 ;;
-    3050*:HI-UX:*:*)
-	eval $set_cc_for_build
-	sed 's/^	//' << EOF >$dummy.c
-	#include <unistd.h>
-	int
-	main ()
-	{
-	  long cpu = sysconf (_SC_CPU_VERSION);
-	  /* The order matters, because CPU_IS_HP_MC68K erroneously returns
-	     true for CPU_PA_RISC1_0.  CPU_IS_PA_RISC returns correct
-	     results, however.  */
-	  if (CPU_IS_PA_RISC (cpu))
-	    {
-	      switch (cpu)
-		{
-		  case CPU_PA_RISC1_0: puts ("hppa1.0-hitachi-hiuxwe2"); break;
-		  case CPU_PA_RISC1_1: puts ("hppa1.1-hitachi-hiuxwe2"); break;
-		  case CPU_PA_RISC2_0: puts ("hppa2.0-hitachi-hiuxwe2"); break;
-		  default: puts ("hppa-hitachi-hiuxwe2"); break;
-		}
-	    }
-	  else if (CPU_IS_HP_MC68K (cpu))
-	    puts ("m68k-hitachi-hiuxwe2");
-	  else puts ("unknown-hitachi-hiuxwe2");
-	  exit (0);
-	}
-EOF
-	$CC_FOR_BUILD $dummy.c -o $dummy && $dummy && rm -f $dummy.c $dummy && rmdir $tmpdir && exit 0
-	rm -f $dummy.c $dummy && rmdir $tmpdir
-	echo unknown-hitachi-hiuxwe2
-	exit 0 ;;
-    9000/7??:4.3bsd:*:* | 9000/8?[79]:4.3bsd:*:* )
-	echo hppa1.1-hp-bsd
-	exit 0 ;;
-    9000/8??:4.3bsd:*:*)
-	echo hppa1.0-hp-bsd
-	exit 0 ;;
-    *9??*:MPE/iX:*:* | *3000*:MPE/iX:*:*)
-	echo hppa1.0-hp-mpeix
-	exit 0 ;;
-    hp7??:OSF1:*:* | hp8?[79]:OSF1:*:* )
-	echo hppa1.1-hp-osf
-	exit 0 ;;
-    hp8??:OSF1:*:*)
-	echo hppa1.0-hp-osf
-	exit 0 ;;
-    i*86:OSF1:*:*)
-	if [ -x /usr/sbin/sysversion ] ; then
-	    echo ${UNAME_MACHINE}-unknown-osf1mk
-	else
-	    echo ${UNAME_MACHINE}-unknown-osf1
-	fi
-	exit 0 ;;
-    parisc*:Lites*:*:*)
-	echo hppa1.1-hp-lites
-	exit 0 ;;
-    C1*:ConvexOS:*:* | convex:ConvexOS:C1*:*)
-	echo c1-convex-bsd
-        exit 0 ;;
-    C2*:ConvexOS:*:* | convex:ConvexOS:C2*:*)
-	if getsysinfo -f scalar_acc
-	then echo c32-convex-bsd
-	else echo c2-convex-bsd
-	fi
-        exit 0 ;;
-    C34*:ConvexOS:*:* | convex:ConvexOS:C34*:*)
-	echo c34-convex-bsd
-        exit 0 ;;
-    C38*:ConvexOS:*:* | convex:ConvexOS:C38*:*)
-	echo c38-convex-bsd
-        exit 0 ;;
-    C4*:ConvexOS:*:* | convex:ConvexOS:C4*:*)
-	echo c4-convex-bsd
-        exit 0 ;;
-    CRAY*Y-MP:*:*:*)
-	echo ymp-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
-	exit 0 ;;
-    CRAY*[A-Z]90:*:*:*)
-	echo ${UNAME_MACHINE}-cray-unicos${UNAME_RELEASE} \
-	| sed -e 's/CRAY.*\([A-Z]90\)/\1/' \
-	      -e y/ABCDEFGHIJKLMNOPQRSTUVWXYZ/abcdefghijklmnopqrstuvwxyz/ \
-	      -e 's/\.[^.]*$/.X/'
-	exit 0 ;;
-    CRAY*TS:*:*:*)
-	echo t90-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
-	exit 0 ;;
-    CRAY*T3D:*:*:*)
-	echo alpha-cray-unicosmk${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
-	exit 0 ;;
-    CRAY*T3E:*:*:*)
-	echo alphaev5-cray-unicosmk${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
-	exit 0 ;;
-    CRAY*SV1:*:*:*)
-	echo sv1-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
-	exit 0 ;;
-    *:UNICOS/mp:*:*)
-	echo nv1-cray-unicosmp | sed -e 's/\.[^.]*$/.X/'
-	exit 0 ;;
-    F30[01]:UNIX_System_V:*:* | F700:UNIX_System_V:*:*)
-	FUJITSU_PROC=`uname -m | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz'`
-        FUJITSU_SYS=`uname -p | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/\///'`
-        FUJITSU_REL=`echo ${UNAME_RELEASE} | sed -e 's/ /_/'`
-        echo "${FUJITSU_PROC}-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
-        exit 0 ;;
-    i*86:BSD/386:*:* | i*86:BSD/OS:*:* | *:Ascend\ Embedded/OS:*:*)
-	echo ${UNAME_MACHINE}-pc-bsdi${UNAME_RELEASE}
-	exit 0 ;;
-    sparc*:BSD/OS:*:*)
-	echo sparc-unknown-bsdi${UNAME_RELEASE}
-	exit 0 ;;
-    *:BSD/OS:*:*)
-	echo ${UNAME_MACHINE}-unknown-bsdi${UNAME_RELEASE}
-	exit 0 ;;
-    *:FreeBSD:*:*)
-	# Determine whether the default compiler uses glibc.
-	eval $set_cc_for_build
-	sed 's/^	//' << EOF >$dummy.c
-	#include <features.h>
-	#if __GLIBC__ >= 2
-	LIBC=gnu
-	#else
-	LIBC=
-	#endif
-EOF
-	eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep ^LIBC=`
-	rm -f $dummy.c && rmdir $tmpdir
-	echo ${UNAME_MACHINE}-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`${LIBC:+-$LIBC}
-	exit 0 ;;
-    i*:CYGWIN*:*)
-	echo ${UNAME_MACHINE}-pc-cygwin
-	exit 0 ;;
-    i*:MINGW*:*)
-	echo ${UNAME_MACHINE}-pc-mingw32
-	exit 0 ;;
-    i*:PW*:*)
-	echo ${UNAME_MACHINE}-pc-pw32
-	exit 0 ;;
-    x86:Interix*:3*)
-	echo i386-pc-interix3
-	exit 0 ;;
-    i*:Windows_NT*:* | Pentium*:Windows_NT*:*)
-	# How do we know it's Interix rather than the generic POSIX subsystem?
-	# It also conflicts with pre-2.0 versions of AT&T UWIN. Should we
-	# UNAME_MACHINE based on the output of uname instead of i386?
-	echo i386-pc-interix
-	exit 0 ;;
-    i*:UWIN*:*)
-	echo ${UNAME_MACHINE}-pc-uwin
-	exit 0 ;;
-    p*:CYGWIN*:*)
-	echo powerpcle-unknown-cygwin
-	exit 0 ;;
-    prep*:SunOS:5.*:*)
-	echo powerpcle-unknown-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
-	exit 0 ;;
-    *:GNU:*:*)
-	echo `echo ${UNAME_MACHINE}|sed -e 's,[-/].*$,,'`-unknown-gnu`echo ${UNAME_RELEASE}|sed -e 's,/.*$,,'`
-	exit 0 ;;
-    i*86:Minix:*:*)
-	echo ${UNAME_MACHINE}-pc-minix
-	exit 0 ;;
-    arm*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
-	exit 0 ;;
-    ia64:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
-	exit 0 ;;
-    m68*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
-	exit 0 ;;
-    mips:Linux:*:*)
-	eval $set_cc_for_build
-	sed 's/^	//' << EOF >$dummy.c
-	#undef CPU
-	#undef mips
-	#undef mipsel
-	#if defined(__MIPSEL__) || defined(__MIPSEL) || defined(_MIPSEL) || defined(MIPSEL)
-	CPU=mipsel
-	#else
-	#if defined(__MIPSEB__) || defined(__MIPSEB) || defined(_MIPSEB) || defined(MIPSEB)
-	CPU=mips
-	#else
-	CPU=
-	#endif
-	#endif
-EOF
-	eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep ^CPU=`
-	rm -f $dummy.c && rmdir $tmpdir
-	test x"${CPU}" != x && echo "${CPU}-pc-linux-gnu" && exit 0
-	;;
-    ppc:Linux:*:*)
-	echo powerpc-unknown-linux-gnu
-	exit 0 ;;
-    ppc64:Linux:*:*)
-	echo powerpc64-unknown-linux-gnu
-	exit 0 ;;
-    alpha:Linux:*:*)
-	case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in
-	  EV5)   UNAME_MACHINE=alphaev5 ;;
-	  EV56)  UNAME_MACHINE=alphaev56 ;;
-	  PCA56) UNAME_MACHINE=alphapca56 ;;
-	  PCA57) UNAME_MACHINE=alphapca56 ;;
-	  EV6)   UNAME_MACHINE=alphaev6 ;;
-	  EV67)  UNAME_MACHINE=alphaev67 ;;
-	  EV68*) UNAME_MACHINE=alphaev68 ;;
-        esac
-	objdump --private-headers /bin/sh | grep ld.so.1 >/dev/null
-	if test "$?" = 0 ; then LIBC="libc1" ; else LIBC="" ; fi
-	echo ${UNAME_MACHINE}-unknown-linux-gnu${LIBC}
-	exit 0 ;;
-    parisc:Linux:*:* | hppa:Linux:*:*)
-	# Look for CPU level
-	case `grep '^cpu[^a-z]*:' /proc/cpuinfo 2>/dev/null | cut -d' ' -f2` in
-	  PA7*) echo hppa1.1-unknown-linux-gnu ;;
-	  PA8*) echo hppa2.0-unknown-linux-gnu ;;
-	  *)    echo hppa-unknown-linux-gnu ;;
-	esac
-	exit 0 ;;
-    parisc64:Linux:*:* | hppa64:Linux:*:*)
-	echo hppa64-unknown-linux-gnu
-	exit 0 ;;
-    s390:Linux:*:* | s390x:Linux:*:*)
-	echo ${UNAME_MACHINE}-ibm-linux
-	exit 0 ;;
-    sh*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
-	exit 0 ;;
-    sparc:Linux:*:* | sparc64:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
-	exit 0 ;;
-    x86_64:Linux:*:*)
-	echo x86_64-unknown-linux-gnu
-	exit 0 ;;
-    i*86:Linux:*:*)
-	# The BFD linker knows what the default object file format is, so
-	# first see if it will tell us. cd to the root directory to prevent
-	# problems with other programs or directories called `ld' in the path.
-	# Set LC_ALL=C to ensure ld outputs messages in English.
-	ld_supported_targets=`cd /; LC_ALL=C ld --help 2>&1 \
-			 | sed -ne '/supported targets:/!d
-				    s/[ 	][ 	]*/ /g
-				    s/.*supported targets: *//
-				    s/ .*//
-				    p'`
-        case "$ld_supported_targets" in
-	  elf32-i386)
-		TENTATIVE="${UNAME_MACHINE}-pc-linux-gnu"
-		;;
-	  a.out-i386-linux)
-		echo "${UNAME_MACHINE}-pc-linux-gnuaout"
-		exit 0 ;;
-	  coff-i386)
-		echo "${UNAME_MACHINE}-pc-linux-gnucoff"
-		exit 0 ;;
-	  "")
-		# Either a pre-BFD a.out linker (linux-gnuoldld) or
-		# one that does not give us useful --help.
-		echo "${UNAME_MACHINE}-pc-linux-gnuoldld"
-		exit 0 ;;
-	esac
-	# Determine whether the default compiler is a.out or elf
-	eval $set_cc_for_build
-	sed 's/^	//' << EOF >$dummy.c
-	#include <features.h>
-	#ifdef __ELF__
-	# ifdef __GLIBC__
-	#  if __GLIBC__ >= 2
-	LIBC=gnu
-	#  else
-	LIBC=gnulibc1
-	#  endif
-	# else
-	LIBC=gnulibc1
-	# endif
-	#else
-	#ifdef __INTEL_COMPILER
-	LIBC=gnu
-	#else
-	LIBC=gnuaout
-	#endif
-	#endif
-EOF
-	eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep ^LIBC=`
-	rm -f $dummy.c && rmdir $tmpdir
-	test x"${LIBC}" != x && echo "${UNAME_MACHINE}-pc-linux-${LIBC}" && exit 0
-	test x"${TENTATIVE}" != x && echo "${TENTATIVE}" && exit 0
-	;;
-    i*86:DYNIX/ptx:4*:*)
-	# ptx 4.0 does uname -s correctly, with DYNIX/ptx in there.
-	# earlier versions are messed up and put the nodename in both
-	# sysname and nodename.
-	echo i386-sequent-sysv4
-	exit 0 ;;
-    i*86:UNIX_SV:4.2MP:2.*)
-        # Unixware is an offshoot of SVR4, but it has its own version
-        # number series starting with 2...
-        # I am not positive that other SVR4 systems won't match this,
-	# I just have to hope.  -- rms.
-        # Use sysv4.2uw... so that sysv4* matches it.
-	echo ${UNAME_MACHINE}-pc-sysv4.2uw${UNAME_VERSION}
-	exit 0 ;;
-    i*86:*:4.*:* | i*86:SYSTEM_V:4.*:*)
-	UNAME_REL=`echo ${UNAME_RELEASE} | sed 's/\/MP$//'`
-	if grep Novell /usr/include/link.h >/dev/null 2>/dev/null; then
-		echo ${UNAME_MACHINE}-univel-sysv${UNAME_REL}
-	else
-		echo ${UNAME_MACHINE}-pc-sysv${UNAME_REL}
-	fi
-	exit 0 ;;
-    i*86:*:5:[78]*)
-	case `/bin/uname -X | grep "^Machine"` in
-	    *486*)	     UNAME_MACHINE=i486 ;;
-	    *Pentium)	     UNAME_MACHINE=i586 ;;
-	    *Pent*|*Celeron) UNAME_MACHINE=i686 ;;
-	esac
-	echo ${UNAME_MACHINE}-unknown-sysv${UNAME_RELEASE}${UNAME_SYSTEM}${UNAME_VERSION}
-	exit 0 ;;
-    i*86:*:3.2:*)
-	if test -f /usr/options/cb.name; then
-		UNAME_REL=`sed -n 's/.*Version //p' </usr/options/cb.name`
-		echo ${UNAME_MACHINE}-pc-isc$UNAME_REL
-	elif /bin/uname -X 2>/dev/null >/dev/null ; then
-		UNAME_REL=`(/bin/uname -X|grep Release|sed -e 's/.*= //')`
-		(/bin/uname -X|grep i80486 >/dev/null) && UNAME_MACHINE=i486
-		(/bin/uname -X|grep '^Machine.*Pentium' >/dev/null) \
-			&& UNAME_MACHINE=i586
-		(/bin/uname -X|grep '^Machine.*Pent *II' >/dev/null) \
-			&& UNAME_MACHINE=i686
-		(/bin/uname -X|grep '^Machine.*Pentium Pro' >/dev/null) \
-			&& UNAME_MACHINE=i686
-		echo ${UNAME_MACHINE}-pc-sco$UNAME_REL
-	else
-		echo ${UNAME_MACHINE}-pc-sysv32
-	fi
-	exit 0 ;;
-    i*86:*DOS:*:*)
-	echo ${UNAME_MACHINE}-pc-msdosdjgpp
-	exit 0 ;;
-    pc:*:*:*)
-	# Left here for compatibility:
-        # uname -m prints for DJGPP always 'pc', but it prints nothing about
-        # the processor, so we play safe by assuming i386.
-	echo i386-pc-msdosdjgpp
-        exit 0 ;;
-    Intel:Mach:3*:*)
-	echo i386-pc-mach3
-	exit 0 ;;
-    paragon:*:*:*)
-	echo i860-intel-osf1
-	exit 0 ;;
-    i860:*:4.*:*) # i860-SVR4
-	if grep Stardent /usr/include/sys/uadmin.h >/dev/null 2>&1 ; then
-	  echo i860-stardent-sysv${UNAME_RELEASE} # Stardent Vistra i860-SVR4
-	else # Add other i860-SVR4 vendors below as they are discovered.
-	  echo i860-unknown-sysv${UNAME_RELEASE}  # Unknown i860-SVR4
-	fi
-	exit 0 ;;
-    mini*:CTIX:SYS*5:*)
-	# "miniframe"
-	echo m68010-convergent-sysv
-	exit 0 ;;
-    M68*:*:R3V[567]*:*)
-	test -r /sysV68 && echo 'm68k-motorola-sysv' && exit 0 ;;
-    3[34]??:*:4.0:3.0 | 3[34]??A:*:4.0:3.0 | 3[34]??,*:*:4.0:3.0 | 3[34]??/*:*:4.0:3.0 | 4400:*:4.0:3.0 | 4850:*:4.0:3.0 | SKA40:*:4.0:3.0)
-	OS_REL=''
-	test -r /etc/.relid \
-	&& OS_REL=.`sed -n 's/[^ ]* [^ ]* \([0-9][0-9]\).*/\1/p' < /etc/.relid`
-	/bin/uname -p 2>/dev/null | grep 86 >/dev/null \
-	  && echo i486-ncr-sysv4.3${OS_REL} && exit 0
-	/bin/uname -p 2>/dev/null | /bin/grep entium >/dev/null \
-	  && echo i586-ncr-sysv4.3${OS_REL} && exit 0 ;;
-    3[34]??:*:4.0:* | 3[34]??,*:*:4.0:*)
-        /bin/uname -p 2>/dev/null | grep 86 >/dev/null \
-          && echo i486-ncr-sysv4 && exit 0 ;;
-    m68*:LynxOS:2.*:* | m68*:LynxOS:3.0*:*)
-	echo m68k-unknown-lynxos${UNAME_RELEASE}
-	exit 0 ;;
-    mc68030:UNIX_System_V:4.*:*)
-	echo m68k-atari-sysv4
-	exit 0 ;;
-    i*86:LynxOS:2.*:* | i*86:LynxOS:3.[01]*:* | i*86:LynxOS:4.0*:*)
-	echo i386-unknown-lynxos${UNAME_RELEASE}
-	exit 0 ;;
-    TSUNAMI:LynxOS:2.*:*)
-	echo sparc-unknown-lynxos${UNAME_RELEASE}
-	exit 0 ;;
-    rs6000:LynxOS:2.*:*)
-	echo rs6000-unknown-lynxos${UNAME_RELEASE}
-	exit 0 ;;
-    PowerPC:LynxOS:2.*:* | PowerPC:LynxOS:3.[01]*:* | PowerPC:LynxOS:4.0*:*)
-	echo powerpc-unknown-lynxos${UNAME_RELEASE}
-	exit 0 ;;
-    SM[BE]S:UNIX_SV:*:*)
-	echo mips-dde-sysv${UNAME_RELEASE}
-	exit 0 ;;
-    RM*:ReliantUNIX-*:*:*)
-	echo mips-sni-sysv4
-	exit 0 ;;
-    RM*:SINIX-*:*:*)
-	echo mips-sni-sysv4
-	exit 0 ;;
-    *:SINIX-*:*:*)
-	if uname -p 2>/dev/null >/dev/null ; then
-		UNAME_MACHINE=`(uname -p) 2>/dev/null`
-		echo ${UNAME_MACHINE}-sni-sysv4
-	else
-		echo ns32k-sni-sysv
-	fi
-	exit 0 ;;
-    PENTIUM:*:4.0*:*) # Unisys `ClearPath HMP IX 4000' SVR4/MP effort
-                      # says <Richard.M.Bartel@ccMail.Census.GOV>
-        echo i586-unisys-sysv4
-        exit 0 ;;
-    *:UNIX_System_V:4*:FTX*)
-	# From Gerald Hewes <hewes@openmarket.com>.
-	# How about differentiating between stratus architectures? -djm
-	echo hppa1.1-stratus-sysv4
-	exit 0 ;;
-    *:*:*:FTX*)
-	# From seanf@swdc.stratus.com.
-	echo i860-stratus-sysv4
-	exit 0 ;;
-    *:VOS:*:*)
-	# From Paul.Green@stratus.com.
-	echo hppa1.1-stratus-vos
-	exit 0 ;;
-    mc68*:A/UX:*:*)
-	echo m68k-apple-aux${UNAME_RELEASE}
-	exit 0 ;;
-    news*:NEWS-OS:6*:*)
-	echo mips-sony-newsos6
-	exit 0 ;;
-    R[34]000:*System_V*:*:* | R4000:UNIX_SYSV:*:* | R*000:UNIX_SV:*:*)
-	if [ -d /usr/nec ]; then
-	        echo mips-nec-sysv${UNAME_RELEASE}
-	else
-	        echo mips-unknown-sysv${UNAME_RELEASE}
-	fi
-        exit 0 ;;
-    BeBox:BeOS:*:*)	# BeOS running on hardware made by Be, PPC only.
-	echo powerpc-be-beos
-	exit 0 ;;
-    BeMac:BeOS:*:*)	# BeOS running on Mac or Mac clone, PPC only.
-	echo powerpc-apple-beos
-	exit 0 ;;
-    BePC:BeOS:*:*)	# BeOS running on Intel PC compatible.
-	echo i586-pc-beos
-	exit 0 ;;
-    SX-4:SUPER-UX:*:*)
-	echo sx4-nec-superux${UNAME_RELEASE}
-	exit 0 ;;
-    SX-5:SUPER-UX:*:*)
-	echo sx5-nec-superux${UNAME_RELEASE}
-	exit 0 ;;
-    Power*:Rhapsody:*:*)
-	echo powerpc-apple-rhapsody${UNAME_RELEASE}
-	exit 0 ;;
-    *:Rhapsody:*:*)
-	echo ${UNAME_MACHINE}-apple-rhapsody${UNAME_RELEASE}
-	exit 0 ;;
-    *:Darwin:*:*)
-	echo `uname -p`-apple-darwin${UNAME_RELEASE}
-	exit 0 ;;
-    *:procnto*:*:* | *:QNX:[0123456789]*:*)
-	UNAME_PROCESSOR=`uname -p`
-	if test "$UNAME_PROCESSOR" = "x86"; then
-		UNAME_PROCESSOR=i386
-		UNAME_MACHINE=pc
-	fi
-	echo ${UNAME_PROCESSOR}-${UNAME_MACHINE}-nto-qnx${UNAME_RELEASE}
-	exit 0 ;;
-    *:QNX:*:4*)
-	echo i386-pc-qnx
-	exit 0 ;;
-    NSR-[GKLNPTVW]:NONSTOP_KERNEL:*:*)
-	echo nsr-tandem-nsk${UNAME_RELEASE}
-	exit 0 ;;
-    *:NonStop-UX:*:*)
-	echo mips-compaq-nonstopux
-	exit 0 ;;
-    BS2000:POSIX*:*:*)
-	echo bs2000-siemens-sysv
-	exit 0 ;;
-    DS/*:UNIX_System_V:*:*)
-	echo ${UNAME_MACHINE}-${UNAME_SYSTEM}-${UNAME_RELEASE}
-	exit 0 ;;
-    *:Plan9:*:*)
-	# "uname -m" is not consistent, so use $cputype instead. 386
-	# is converted to i386 for consistency with other x86
-	# operating systems.
-	if test "$cputype" = "386"; then
-	    UNAME_MACHINE=i386
-	else
-	    UNAME_MACHINE="$cputype"
-	fi
-	echo ${UNAME_MACHINE}-unknown-plan9
-	exit 0 ;;
-    i*86:OS/2:*:*)
-	# If we were able to find `uname', then EMX Unix compatibility
-	# is probably installed.
-	echo ${UNAME_MACHINE}-pc-os2-emx
-	exit 0 ;;
-    *:TOPS-10:*:*)
-	echo pdp10-unknown-tops10
-	exit 0 ;;
-    *:TENEX:*:*)
-	echo pdp10-unknown-tenex
-	exit 0 ;;
-    KS10:TOPS-20:*:* | KL10:TOPS-20:*:* | TYPE4:TOPS-20:*:*)
-	echo pdp10-dec-tops20
-	exit 0 ;;
-    XKL-1:TOPS-20:*:* | TYPE5:TOPS-20:*:*)
-	echo pdp10-xkl-tops20
-	exit 0 ;;
-    *:TOPS-20:*:*)
-	echo pdp10-unknown-tops20
-	exit 0 ;;
-    *:ITS:*:*)
-	echo pdp10-unknown-its
-	exit 0 ;;
-    i*86:XTS-300:*:STOP)
-	echo ${UNAME_MACHINE}-unknown-stop
-	exit 0 ;;
-    i*86:atheos:*:*)
-	echo ${UNAME_MACHINE}-unknown-atheos
-	exit 0 ;;
-esac
-
-#echo '(No uname command or uname output not recognized.)' 1>&2
-#echo "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" 1>&2
-
-eval $set_cc_for_build
-cat >$dummy.c <<EOF
-#ifdef _SEQUENT_
-# include <sys/types.h>
-# include <sys/utsname.h>
-#endif
-main ()
-{
-#if defined (sony)
-#if defined (MIPSEB)
-  /* BFD wants "bsd" instead of "newsos".  Perhaps BFD should be changed,
-     I don't know....  */
-  printf ("mips-sony-bsd\n"); exit (0);
-#else
-#include <sys/param.h>
-  printf ("m68k-sony-newsos%s\n",
-#ifdef NEWSOS4
-          "4"
-#else
-	  ""
-#endif
-         ); exit (0);
-#endif
-#endif
-
-#if defined (__arm) && defined (__acorn) && defined (__unix)
-  printf ("arm-acorn-riscix"); exit (0);
-#endif
-
-#if defined (hp300) && !defined (hpux)
-  printf ("m68k-hp-bsd\n"); exit (0);
-#endif
-
-#if defined (NeXT)
-#if !defined (__ARCHITECTURE__)
-#define __ARCHITECTURE__ "m68k"
-#endif
-  int version;
-  version=`(hostinfo | sed -n 's/.*NeXT Mach \([0-9]*\).*/\1/p') 2>/dev/null`;
-  if (version < 4)
-    printf ("%s-next-nextstep%d\n", __ARCHITECTURE__, version);
-  else
-    printf ("%s-next-openstep%d\n", __ARCHITECTURE__, version);
-  exit (0);
-#endif
-
-#if defined (MULTIMAX) || defined (n16)
-#if defined (UMAXV)
-  printf ("ns32k-encore-sysv\n"); exit (0);
-#else
-#if defined (CMU)
-  printf ("ns32k-encore-mach\n"); exit (0);
-#else
-  printf ("ns32k-encore-bsd\n"); exit (0);
-#endif
-#endif
-#endif
-
-#if defined (__386BSD__)
-  printf ("i386-pc-bsd\n"); exit (0);
-#endif
-
-#if defined (sequent)
-#if defined (i386)
-  printf ("i386-sequent-dynix\n"); exit (0);
-#endif
-#if defined (ns32000)
-  printf ("ns32k-sequent-dynix\n"); exit (0);
-#endif
-#endif
-
-#if defined (_SEQUENT_)
-    struct utsname un;
-
-    uname(&un);
-
-    if (strncmp(un.version, "V2", 2) == 0) {
-	printf ("i386-sequent-ptx2\n"); exit (0);
-    }
-    if (strncmp(un.version, "V1", 2) == 0) { /* XXX is V1 correct? */
-	printf ("i386-sequent-ptx1\n"); exit (0);
-    }
-    printf ("i386-sequent-ptx\n"); exit (0);
-
-#endif
-
-#if defined (vax)
-# if !defined (ultrix)
-#  include <sys/param.h>
-#  if defined (BSD)
-#   if BSD == 43
-      printf ("vax-dec-bsd4.3\n"); exit (0);
-#   else
-#    if BSD == 199006
-      printf ("vax-dec-bsd4.3reno\n"); exit (0);
-#    else
-      printf ("vax-dec-bsd\n"); exit (0);
-#    endif
-#   endif
-#  else
-    printf ("vax-dec-bsd\n"); exit (0);
-#  endif
-# else
-    printf ("vax-dec-ultrix\n"); exit (0);
-# endif
-#endif
-
-#if defined (alliant) && defined (i860)
-  printf ("i860-alliant-bsd\n"); exit (0);
-#endif
-
-  exit (1);
-}
-EOF
-
-$CC_FOR_BUILD $dummy.c -o $dummy 2>/dev/null && $dummy && rm -f $dummy.c $dummy && rmdir $tmpdir && exit 0
-rm -f $dummy.c $dummy && rmdir $tmpdir
-
-# Apollos put the system type in the environment.
-
-test -d /usr/apollo && { echo ${ISP}-apollo-${SYSTYPE}; exit 0; }
-
-# Convex versions that predate uname can use getsysinfo(1)
-
-if [ -x /usr/convex/getsysinfo ]
-then
-    case `getsysinfo -f cpu_type` in
-    c1*)
-	echo c1-convex-bsd
-	exit 0 ;;
-    c2*)
-	if getsysinfo -f scalar_acc
-	then echo c32-convex-bsd
-	else echo c2-convex-bsd
-	fi
-	exit 0 ;;
-    c34*)
-	echo c34-convex-bsd
-	exit 0 ;;
-    c38*)
-	echo c38-convex-bsd
-	exit 0 ;;
-    c4*)
-	echo c4-convex-bsd
-	exit 0 ;;
-    esac
-fi
-
-cat >&2 <<EOF
-$0: unable to guess system type
-
-This script, last modified $timestamp, has failed to recognize
-the operating system you are using. It is advised that you
-download the most up to date version of the config scripts from
-
-    ftp://ftp.gnu.org/pub/gnu/config/
-
-If the version you run ($0) is already up to date, please
-send the following data and any information you think might be
-pertinent to <config-patches@gnu.org> in order to provide the needed
-information to handle your system.
-
-config.guess timestamp = $timestamp
-
-uname -m = `(uname -m) 2>/dev/null || echo unknown`
-uname -r = `(uname -r) 2>/dev/null || echo unknown`
-uname -s = `(uname -s) 2>/dev/null || echo unknown`
-uname -v = `(uname -v) 2>/dev/null || echo unknown`
-
-/usr/bin/uname -p = `(/usr/bin/uname -p) 2>/dev/null`
-/bin/uname -X     = `(/bin/uname -X) 2>/dev/null`
-
-hostinfo               = `(hostinfo) 2>/dev/null`
-/bin/universe          = `(/bin/universe) 2>/dev/null`
-/usr/bin/arch -k       = `(/usr/bin/arch -k) 2>/dev/null`
-/bin/arch              = `(/bin/arch) 2>/dev/null`
-/usr/bin/oslevel       = `(/usr/bin/oslevel) 2>/dev/null`
-/usr/convex/getsysinfo = `(/usr/convex/getsysinfo) 2>/dev/null`
-
-UNAME_MACHINE = ${UNAME_MACHINE}
-UNAME_RELEASE = ${UNAME_RELEASE}
-UNAME_SYSTEM  = ${UNAME_SYSTEM}
-UNAME_VERSION = ${UNAME_VERSION}
-EOF
-
-exit 1
-
-# Local variables:
-# eval: (add-hook 'write-file-hooks 'time-stamp)
-# time-stamp-start: "timestamp='"
-# time-stamp-format: "%:y-%02m-%02d"
-# time-stamp-end: "'"
-# End:
diff --git a/crypto/openssh/config.sub b/crypto/openssh/config.sub
deleted file mode 100755
index a0b7bb9e8b34..000000000000
--- a/crypto/openssh/config.sub
+++ /dev/null
@@ -1,1467 +0,0 @@
-#! /bin/sh
-# Configuration validation subroutine script.
-#   Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999,
-#   2000, 2001, 2002 Free Software Foundation, Inc.
-
-timestamp='2002-07-03'
-
-# This file is (in principle) common to ALL GNU software.
-# The presence of a machine in this file suggests that SOME GNU software
-# can handle that machine.  It does not imply ALL GNU software can.
-#
-# This file is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place - Suite 330,
-# Boston, MA 02111-1307, USA.
-
-# As a special exception to the GNU General Public License, if you
-# distribute this file as part of a program that contains a
-# configuration script generated by Autoconf, you may include it under
-# the same distribution terms that you use for the rest of that program.
-
-# Please send patches to <config-patches@gnu.org>.  Submit a context
-# diff and a properly formatted ChangeLog entry.
-#
-# Configuration subroutine to validate and canonicalize a configuration type.
-# Supply the specified configuration type as an argument.
-# If it is invalid, we print an error message on stderr and exit with code 1.
-# Otherwise, we print the canonical config type on stdout and succeed.
-
-# This file is supposed to be the same for all GNU packages
-# and recognize all the CPU types, system types and aliases
-# that are meaningful with *any* GNU software.
-# Each package is responsible for reporting which valid configurations
-# it does not support.  The user should be able to distinguish
-# a failure to support a valid configuration from a meaningless
-# configuration.
-
-# The goal of this file is to map all the various variations of a given
-# machine specification into a single specification in the form:
-#	CPU_TYPE-MANUFACTURER-OPERATING_SYSTEM
-# or in some cases, the newer four-part form:
-#	CPU_TYPE-MANUFACTURER-KERNEL-OPERATING_SYSTEM
-# It is wrong to echo any other type of specification.
-
-me=`echo "$0" | sed -e 's,.*/,,'`
-
-usage="\
-Usage: $0 [OPTION] CPU-MFR-OPSYS
-       $0 [OPTION] ALIAS
-
-Canonicalize a configuration name.
-
-Operation modes:
-  -h, --help         print this help, then exit
-  -t, --time-stamp   print date of last modification, then exit
-  -v, --version      print version number, then exit
-
-Report bugs and patches to <config-patches@gnu.org>."
-
-version="\
-GNU config.sub ($timestamp)
-
-Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001
-Free Software Foundation, Inc.
-
-This is free software; see the source for copying conditions.  There is NO
-warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
-
-help="
-Try \`$me --help' for more information."
-
-# Parse command line
-while test $# -gt 0 ; do
-  case $1 in
-    --time-stamp | --time* | -t )
-       echo "$timestamp" ; exit 0 ;;
-    --version | -v )
-       echo "$version" ; exit 0 ;;
-    --help | --h* | -h )
-       echo "$usage"; exit 0 ;;
-    -- )     # Stop option processing
-       shift; break ;;
-    - )	# Use stdin as input.
-       break ;;
-    -* )
-       echo "$me: invalid option $1$help"
-       exit 1 ;;
-
-    *local*)
-       # First pass through any local machine types.
-       echo $1
-       exit 0;;
-
-    * )
-       break ;;
-  esac
-done
-
-case $# in
- 0) echo "$me: missing argument$help" >&2
-    exit 1;;
- 1) ;;
- *) echo "$me: too many arguments$help" >&2
-    exit 1;;
-esac
-
-# Separate what the user gave into CPU-COMPANY and OS or KERNEL-OS (if any).
-# Here we must recognize all the valid KERNEL-OS combinations.
-maybe_os=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\2/'`
-case $maybe_os in
-  nto-qnx* | linux-gnu* | freebsd*-gnu* | storm-chaos* | os2-emx* | windows32-* | rtmk-nova*)
-    os=-$maybe_os
-    basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`
-    ;;
-  *)
-    basic_machine=`echo $1 | sed 's/-[^-]*$//'`
-    if [ $basic_machine != $1 ]
-    then os=`echo $1 | sed 's/.*-/-/'`
-    else os=; fi
-    ;;
-esac
-
-### Let's recognize common machines as not being operating systems so
-### that things like config.sub decstation-3100 work.  We also
-### recognize some manufacturers as not being operating systems, so we
-### can provide default operating systems below.
-case $os in
-	-sun*os*)
-		# Prevent following clause from handling this invalid input.
-		;;
-	-dec* | -mips* | -sequent* | -encore* | -pc532* | -sgi* | -sony* | \
-	-att* | -7300* | -3300* | -delta* | -motorola* | -sun[234]* | \
-	-unicom* | -ibm* | -next | -hp | -isi* | -apollo | -altos* | \
-	-convergent* | -ncr* | -news | -32* | -3600* | -3100* | -hitachi* |\
-	-c[123]* | -convex* | -sun | -crds | -omron* | -dg | -ultra | -tti* | \
-	-harris | -dolphin | -highlevel | -gould | -cbm | -ns | -masscomp | \
-	-apple | -axis)
-		os=
-		basic_machine=$1
-		;;
-	-sim | -cisco | -oki | -wec | -winbond)
-		os=
-		basic_machine=$1
-		;;
-	-scout)
-		;;
-	-wrs)
-		os=-vxworks
-		basic_machine=$1
-		;;
-	-chorusos*)
-		os=-chorusos
-		basic_machine=$1
-		;;
- 	-chorusrdb)
- 		os=-chorusrdb
-		basic_machine=$1
- 		;;
-	-hiux*)
-		os=-hiuxwe2
-		;;
-	-sco5)
-		os=-sco3.2v5
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
-		;;
-	-sco4)
-		os=-sco3.2v4
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
-		;;
-	-sco3.2.[4-9]*)
-		os=`echo $os | sed -e 's/sco3.2./sco3.2v/'`
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
-		;;
-	-sco3.2v[4-9]*)
-		# Don't forget version if it is 3.2v4 or newer.
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
-		;;
-	-sco*)
-		os=-sco3.2v2
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
-		;;
-	-udk*)
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
-		;;
-	-isc)
-		os=-isc2.2
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
-		;;
-	-clix*)
-		basic_machine=clipper-intergraph
-		;;
-	-isc*)
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
-		;;
-	-lynx*)
-		os=-lynxos
-		;;
-	-ptx*)
-		basic_machine=`echo $1 | sed -e 's/86-.*/86-sequent/'`
-		;;
-	-windowsnt*)
-		os=`echo $os | sed -e 's/windowsnt/winnt/'`
-		;;
-	-psos*)
-		os=-psos
-		;;
-	-mint | -mint[0-9]*)
-		basic_machine=m68k-atari
-		os=-mint
-		;;
-esac
-
-# Decode aliases for certain CPU-COMPANY combinations.
-case $basic_machine in
-	# Recognize the basic CPU types without company name.
-	# Some are omitted here because they have special meanings below.
-	1750a | 580 \
-	| a29k \
-	| alpha | alphaev[4-8] | alphaev56 | alphaev6[78] | alphapca5[67] \
-	| alpha64 | alpha64ev[4-8] | alpha64ev56 | alpha64ev6[78] | alpha64pca5[67] \
-	| arc | arm | arm[bl]e | arme[lb] | armv[2345] | armv[345][lb] | avr \
-	| c4x | clipper \
-	| d10v | d30v | dlx | dsp16xx \
-	| fr30 | frv \
-	| h8300 | h8500 | hppa | hppa1.[01] | hppa2.0 | hppa2.0[nw] | hppa64 \
-	| i370 | i860 | i960 | ia64 \
-	| ip2k \
-	| m32r | m68000 | m68k | m88k | mcore \
-	| mips | mipsbe | mipseb | mipsel | mipsle \
-	| mips16 \
-	| mips64 | mips64el \
-	| mips64orion | mips64orionel \
-	| mips64vr4100 | mips64vr4100el \
-	| mips64vr4300 | mips64vr4300el \
-	| mips64vr5000 | mips64vr5000el \
-	| mipsisa32 | mipsisa32el \
-	| mipsisa64 | mipsisa64el \
-	| mipsisa64sb1 | mipsisa64sb1el \
-	| mipstx39 | mipstx39el \
-	| mn10200 | mn10300 \
-	| ns16k | ns32k \
-	| openrisc | or32 \
-	| pdp10 | pdp11 | pj | pjl \
-	| powerpc | powerpc64 | powerpc64le | powerpcle | ppcbe \
-	| pyramid \
-	| sh | sh[1234] | sh3e | sh[34]eb | shbe | shle | sh[1234]le | sh3ele \
-	| sh64 | sh64le \
-	| sparc | sparc64 | sparc86x | sparclet | sparclite | sparcv9 | sparcv9b \
-	| strongarm \
-	| tahoe | thumb | tic80 | tron \
-	| v850 | v850e \
-	| we32k \
-	| x86 | xscale | xstormy16 | xtensa \
-	| z8k)
-		basic_machine=$basic_machine-unknown
-		;;
-	m6811 | m68hc11 | m6812 | m68hc12)
-		# Motorola 68HC11/12.
-		basic_machine=$basic_machine-unknown
-		os=-none
-		;;
-	m88110 | m680[12346]0 | m683?2 | m68360 | m5200 | v70 | w65 | z8k)
-		;;
-
-	# We use `pc' rather than `unknown'
-	# because (1) that's what they normally are, and
-	# (2) the word "unknown" tends to confuse beginning users.
-	i*86 | x86_64)
-	  basic_machine=$basic_machine-pc
-	  ;;
-	# Object if more than one company name word.
-	*-*-*)
-		echo Invalid configuration \`$1\': machine \`$basic_machine\' not recognized 1>&2
-		exit 1
-		;;
-	# Recognize the basic CPU types with company name.
-	580-* \
-	| a29k-* \
-	| alpha-* | alphaev[4-8]-* | alphaev56-* | alphaev6[78]-* \
-	| alpha64-* | alpha64ev[4-8]-* | alpha64ev56-* | alpha64ev6[78]-* \
-	| alphapca5[67]-* | alpha64pca5[67]-* | arc-* \
-	| arm-*  | armbe-* | armle-* | armeb-* | armv*-* \
-	| avr-* \
-	| bs2000-* \
-	| c[123]* | c30-* | [cjt]90-* | c54x-* \
-	| clipper-* | cydra-* \
-	| d10v-* | d30v-* | dlx-* \
-	| elxsi-* \
-	| f30[01]-* | f700-* | fr30-* | frv-* | fx80-* \
-	| h8300-* | h8500-* \
-	| hppa-* | hppa1.[01]-* | hppa2.0-* | hppa2.0[nw]-* | hppa64-* \
-	| i*86-* | i860-* | i960-* | ia64-* \
-	| ip2k-* \
-	| m32r-* \
-	| m68000-* | m680[012346]0-* | m68360-* | m683?2-* | m68k-* \
-	| m88110-* | m88k-* | mcore-* \
-	| mips-* | mipsbe-* | mipseb-* | mipsel-* | mipsle-* \
-	| mips16-* \
-	| mips64-* | mips64el-* \
-	| mips64orion-* | mips64orionel-* \
-	| mips64vr4100-* | mips64vr4100el-* \
-	| mips64vr4300-* | mips64vr4300el-* \
-	| mips64vr5000-* | mips64vr5000el-* \
-	| mipsisa32-* | mipsisa32el-* \
-	| mipsisa64-* | mipsisa64el-* \
-	| mipsisa64sb1-* | mipsisa64sb1el-* \
-	| mipstx39 | mipstx39el \
-	| none-* | np1-* | ns16k-* | ns32k-* | nv1-* \
-	| orion-* \
-	| pdp10-* | pdp11-* | pj-* | pjl-* | pn-* | power-* \
-	| powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* | ppcbe-* \
-	| pyramid-* \
-	| romp-* | rs6000-* \
-	| sh-* | sh[1234]-* | sh3e-* | sh[34]eb-* | shbe-* \
-	| shle-* | sh[1234]le-* | sh3ele-* | sh64-* | sh64le-* \
-	| sparc-* | sparc64-* | sparc86x-* | sparclet-* | sparclite-* \
-	| sparcv9-* | sparcv9b-* | strongarm-* | sv1-* | sx?-* \
-	| tahoe-* | thumb-* | tic30-* | tic54x-* | tic80-* | tron-* \
-	| v850-* | v850e-* | vax-* \
-	| we32k-* \
-	| x86-* | x86_64-* | xps100-* | xscale-* | xstormy16-* \
-	| xtensa-* \
-	| ymp-* \
-	| z8k-*)
-		;;
-	# Recognize the various machine names and aliases which stand
-	# for a CPU type and a company and sometimes even an OS.
-	386bsd)
-		basic_machine=i386-unknown
-		os=-bsd
-		;;
-	3b1 | 7300 | 7300-att | att-7300 | pc7300 | safari | unixpc)
-		basic_machine=m68000-att
-		;;
-	3b*)
-		basic_machine=we32k-att
-		;;
-	a29khif)
-		basic_machine=a29k-amd
-		os=-udi
-		;;
-	adobe68k)
-		basic_machine=m68010-adobe
-		os=-scout
-		;;
-	alliant | fx80)
-		basic_machine=fx80-alliant
-		;;
-	altos | altos3068)
-		basic_machine=m68k-altos
-		;;
-	am29k)
-		basic_machine=a29k-none
-		os=-bsd
-		;;
-	amdahl)
-		basic_machine=580-amdahl
-		os=-sysv
-		;;
-	amiga | amiga-*)
-		basic_machine=m68k-unknown
-		;;
-	amigaos | amigados)
-		basic_machine=m68k-unknown
-		os=-amigaos
-		;;
-	amigaunix | amix)
-		basic_machine=m68k-unknown
-		os=-sysv4
-		;;
-	apollo68)
-		basic_machine=m68k-apollo
-		os=-sysv
-		;;
-	apollo68bsd)
-		basic_machine=m68k-apollo
-		os=-bsd
-		;;
-	aux)
-		basic_machine=m68k-apple
-		os=-aux
-		;;
-	balance)
-		basic_machine=ns32k-sequent
-		os=-dynix
-		;;
-	c90)
-		basic_machine=c90-cray
-		os=-unicos
-		;;
-	convex-c1)
-		basic_machine=c1-convex
-		os=-bsd
-		;;
-	convex-c2)
-		basic_machine=c2-convex
-		os=-bsd
-		;;
-	convex-c32)
-		basic_machine=c32-convex
-		os=-bsd
-		;;
-	convex-c34)
-		basic_machine=c34-convex
-		os=-bsd
-		;;
-	convex-c38)
-		basic_machine=c38-convex
-		os=-bsd
-		;;
-	cray | j90)
-		basic_machine=j90-cray
-		os=-unicos
-		;;
-	crds | unos)
-		basic_machine=m68k-crds
-		;;
-	cris | cris-* | etrax*)
-		basic_machine=cris-axis
-		;;
-	da30 | da30-*)
-		basic_machine=m68k-da30
-		;;
-	decstation | decstation-3100 | pmax | pmax-* | pmin | dec3100 | decstatn)
-		basic_machine=mips-dec
-		;;
-	decsystem10* | dec10*)
-		basic_machine=pdp10-dec
-		os=-tops10
-		;;
-	decsystem20* | dec20*)
-		basic_machine=pdp10-dec
-		os=-tops20
-		;;
-	delta | 3300 | motorola-3300 | motorola-delta \
-	      | 3300-motorola | delta-motorola)
-		basic_machine=m68k-motorola
-		;;
-	delta88)
-		basic_machine=m88k-motorola
-		os=-sysv3
-		;;
-	dpx20 | dpx20-*)
-		basic_machine=rs6000-bull
-		os=-bosx
-		;;
-	dpx2* | dpx2*-bull)
-		basic_machine=m68k-bull
-		os=-sysv3
-		;;
-	ebmon29k)
-		basic_machine=a29k-amd
-		os=-ebmon
-		;;
-	elxsi)
-		basic_machine=elxsi-elxsi
-		os=-bsd
-		;;
-	encore | umax | mmax)
-		basic_machine=ns32k-encore
-		;;
-	es1800 | OSE68k | ose68k | ose | OSE)
-		basic_machine=m68k-ericsson
-		os=-ose
-		;;
-	fx2800)
-		basic_machine=i860-alliant
-		;;
-	genix)
-		basic_machine=ns32k-ns
-		;;
-	gmicro)
-		basic_machine=tron-gmicro
-		os=-sysv
-		;;
-	go32)
-		basic_machine=i386-pc
-		os=-go32
-		;;
-	h3050r* | hiux*)
-		basic_machine=hppa1.1-hitachi
-		os=-hiuxwe2
-		;;
-	h8300hms)
-		basic_machine=h8300-hitachi
-		os=-hms
-		;;
-	h8300xray)
-		basic_machine=h8300-hitachi
-		os=-xray
-		;;
-	h8500hms)
-		basic_machine=h8500-hitachi
-		os=-hms
-		;;
-	harris)
-		basic_machine=m88k-harris
-		os=-sysv3
-		;;
-	hp300-*)
-		basic_machine=m68k-hp
-		;;
-	hp300bsd)
-		basic_machine=m68k-hp
-		os=-bsd
-		;;
-	hp300hpux)
-		basic_machine=m68k-hp
-		os=-hpux
-		;;
-	hp3k9[0-9][0-9] | hp9[0-9][0-9])
-		basic_machine=hppa1.0-hp
-		;;
-	hp9k2[0-9][0-9] | hp9k31[0-9])
-		basic_machine=m68000-hp
-		;;
-	hp9k3[2-9][0-9])
-		basic_machine=m68k-hp
-		;;
-	hp9k6[0-9][0-9] | hp6[0-9][0-9])
-		basic_machine=hppa1.0-hp
-		;;
-	hp9k7[0-79][0-9] | hp7[0-79][0-9])
-		basic_machine=hppa1.1-hp
-		;;
-	hp9k78[0-9] | hp78[0-9])
-		# FIXME: really hppa2.0-hp
-		basic_machine=hppa1.1-hp
-		;;
-	hp9k8[67]1 | hp8[67]1 | hp9k80[24] | hp80[24] | hp9k8[78]9 | hp8[78]9 | hp9k893 | hp893)
-		# FIXME: really hppa2.0-hp
-		basic_machine=hppa1.1-hp
-		;;
-	hp9k8[0-9][13679] | hp8[0-9][13679])
-		basic_machine=hppa1.1-hp
-		;;
-	hp9k8[0-9][0-9] | hp8[0-9][0-9])
-		basic_machine=hppa1.0-hp
-		;;
-	hppa-next)
-		os=-nextstep3
-		;;
-	hppaosf)
-		basic_machine=hppa1.1-hp
-		os=-osf
-		;;
-	hppro)
-		basic_machine=hppa1.1-hp
-		os=-proelf
-		;;
-	i370-ibm* | ibm*)
-		basic_machine=i370-ibm
-		;;
-# I'm not sure what "Sysv32" means.  Should this be sysv3.2?
-	i*86v32)
-		basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'`
-		os=-sysv32
-		;;
-	i*86v4*)
-		basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'`
-		os=-sysv4
-		;;
-	i*86v)
-		basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'`
-		os=-sysv
-		;;
-	i*86sol2)
-		basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'`
-		os=-solaris2
-		;;
-	i386mach)
-		basic_machine=i386-mach
-		os=-mach
-		;;
-	i386-vsta | vsta)
-		basic_machine=i386-unknown
-		os=-vsta
-		;;
-	iris | iris4d)
-		basic_machine=mips-sgi
-		case $os in
-		    -irix*)
-			;;
-		    *)
-			os=-irix4
-			;;
-		esac
-		;;
-	isi68 | isi)
-		basic_machine=m68k-isi
-		os=-sysv
-		;;
-	m88k-omron*)
-		basic_machine=m88k-omron
-		;;
-	magnum | m3230)
-		basic_machine=mips-mips
-		os=-sysv
-		;;
-	merlin)
-		basic_machine=ns32k-utek
-		os=-sysv
-		;;
-	mingw32)
-		basic_machine=i386-pc
-		os=-mingw32
-		;;
-	miniframe)
-		basic_machine=m68000-convergent
-		;;
-	*mint | -mint[0-9]* | *MiNT | *MiNT[0-9]*)
-		basic_machine=m68k-atari
-		os=-mint
-		;;
-	mips3*-*)
-		basic_machine=`echo $basic_machine | sed -e 's/mips3/mips64/'`
-		;;
-	mips3*)
-		basic_machine=`echo $basic_machine | sed -e 's/mips3/mips64/'`-unknown
-		;;
-	mmix*)
-		basic_machine=mmix-knuth
-		os=-mmixware
-		;;
-	monitor)
-		basic_machine=m68k-rom68k
-		os=-coff
-		;;
-	morphos)
-		basic_machine=powerpc-unknown
-		os=-morphos
-		;;
-	msdos)
-		basic_machine=i386-pc
-		os=-msdos
-		;;
-	mvs)
-		basic_machine=i370-ibm
-		os=-mvs
-		;;
-	ncr3000)
-		basic_machine=i486-ncr
-		os=-sysv4
-		;;
-	netbsd386)
-		basic_machine=i386-unknown
-		os=-netbsd
-		;;
-	netwinder)
-		basic_machine=armv4l-rebel
-		os=-linux
-		;;
-	news | news700 | news800 | news900)
-		basic_machine=m68k-sony
-		os=-newsos
-		;;
-	news1000)
-		basic_machine=m68030-sony
-		os=-newsos
-		;;
-	news-3600 | risc-news)
-		basic_machine=mips-sony
-		os=-newsos
-		;;
-	necv70)
-		basic_machine=v70-nec
-		os=-sysv
-		;;
-	next | m*-next )
-		basic_machine=m68k-next
-		case $os in
-		    -nextstep* )
-			;;
-		    -ns2*)
-		      os=-nextstep2
-			;;
-		    *)
-		      os=-nextstep3
-			;;
-		esac
-		;;
-	nh3000)
-		basic_machine=m68k-harris
-		os=-cxux
-		;;
-	nh[45]000)
-		basic_machine=m88k-harris
-		os=-cxux
-		;;
-	nindy960)
-		basic_machine=i960-intel
-		os=-nindy
-		;;
-	mon960)
-		basic_machine=i960-intel
-		os=-mon960
-		;;
-	nonstopux)
-		basic_machine=mips-compaq
-		os=-nonstopux
-		;;
-	np1)
-		basic_machine=np1-gould
-		;;
-	nsr-tandem)
-		basic_machine=nsr-tandem
-		;;
-	nv1)
-		basic_machine=nv1-cray
-		;;
-	op50n-* | op60c-*)
-		basic_machine=hppa1.1-oki
-		os=-proelf
-		;;
-	or32 | or32-*)
-		basic_machine=or32-unknown
-		os=-coff
-		;;
-	OSE68000 | ose68000)
-		basic_machine=m68000-ericsson
-		os=-ose
-		;;
-	os68k)
-		basic_machine=m68k-none
-		os=-os68k
-		;;
-	pa-hitachi)
-		basic_machine=hppa1.1-hitachi
-		os=-hiuxwe2
-		;;
-	paragon)
-		basic_machine=i860-intel
-		os=-osf
-		;;
-	pbd)
-		basic_machine=sparc-tti
-		;;
-	pbb)
-		basic_machine=m68k-tti
-		;;
-        pc532 | pc532-*)
-		basic_machine=ns32k-pc532
-		;;
-	pentium | p5 | k5 | k6 | nexgen | viac3)
-		basic_machine=i586-pc
-		;;
-	pentiumpro | p6 | 6x86 | athlon)
-		basic_machine=i686-pc
-		;;
-	pentiumii | pentium2)
-		basic_machine=i686-pc
-		;;
-	pentium-* | p5-* | k5-* | k6-* | nexgen-* | viac3-*)
-		basic_machine=i586-`echo $basic_machine | sed 's/^[^-]*-//'`
-		;;
-	pentiumpro-* | p6-* | 6x86-* | athlon-*)
-		basic_machine=i686-`echo $basic_machine | sed 's/^[^-]*-//'`
-		;;
-	pentiumii-* | pentium2-*)
-		basic_machine=i686-`echo $basic_machine | sed 's/^[^-]*-//'`
-		;;
-	pn)
-		basic_machine=pn-gould
-		;;
-	power)	basic_machine=power-ibm
-		;;
-	ppc)	basic_machine=powerpc-unknown
-	        ;;
-	ppc-*)	basic_machine=powerpc-`echo $basic_machine | sed 's/^[^-]*-//'`
-		;;
-	ppcle | powerpclittle | ppc-le | powerpc-little)
-		basic_machine=powerpcle-unknown
-	        ;;
-	ppcle-* | powerpclittle-*)
-		basic_machine=powerpcle-`echo $basic_machine | sed 's/^[^-]*-//'`
-		;;
-	ppc64)	basic_machine=powerpc64-unknown
-	        ;;
-	ppc64-*) basic_machine=powerpc64-`echo $basic_machine | sed 's/^[^-]*-//'`
-		;;
-	ppc64le | powerpc64little | ppc64-le | powerpc64-little)
-		basic_machine=powerpc64le-unknown
-	        ;;
-	ppc64le-* | powerpc64little-*)
-		basic_machine=powerpc64le-`echo $basic_machine | sed 's/^[^-]*-//'`
-		;;
-	ps2)
-		basic_machine=i386-ibm
-		;;
-	pw32)
-		basic_machine=i586-unknown
-		os=-pw32
-		;;
-	rom68k)
-		basic_machine=m68k-rom68k
-		os=-coff
-		;;
-	rm[46]00)
-		basic_machine=mips-siemens
-		;;
-	rtpc | rtpc-*)
-		basic_machine=romp-ibm
-		;;
-	s390 | s390-*)
-		basic_machine=s390-ibm
-		;;
-	s390x | s390x-*)
-		basic_machine=s390x-ibm
-		;;
-	sa29200)
-		basic_machine=a29k-amd
-		os=-udi
-		;;
-	sequent)
-		basic_machine=i386-sequent
-		;;
-	sh)
-		basic_machine=sh-hitachi
-		os=-hms
-		;;
-	sparclite-wrs | simso-wrs)
-		basic_machine=sparclite-wrs
-		os=-vxworks
-		;;
-	sps7)
-		basic_machine=m68k-bull
-		os=-sysv2
-		;;
-	spur)
-		basic_machine=spur-unknown
-		;;
-	st2000)
-		basic_machine=m68k-tandem
-		;;
-	stratus)
-		basic_machine=i860-stratus
-		os=-sysv4
-		;;
-	sun2)
-		basic_machine=m68000-sun
-		;;
-	sun2os3)
-		basic_machine=m68000-sun
-		os=-sunos3
-		;;
-	sun2os4)
-		basic_machine=m68000-sun
-		os=-sunos4
-		;;
-	sun3os3)
-		basic_machine=m68k-sun
-		os=-sunos3
-		;;
-	sun3os4)
-		basic_machine=m68k-sun
-		os=-sunos4
-		;;
-	sun4os3)
-		basic_machine=sparc-sun
-		os=-sunos3
-		;;
-	sun4os4)
-		basic_machine=sparc-sun
-		os=-sunos4
-		;;
-	sun4sol2)
-		basic_machine=sparc-sun
-		os=-solaris2
-		;;
-	sun3 | sun3-*)
-		basic_machine=m68k-sun
-		;;
-	sun4)
-		basic_machine=sparc-sun
-		;;
-	sun386 | sun386i | roadrunner)
-		basic_machine=i386-sun
-		;;
-        sv1)
-		basic_machine=sv1-cray
-		os=-unicos
-		;;
-        sx*-nec)
-		basic_machine=sx6-nec
-		os=-sysv
-		;;
-	symmetry)
-		basic_machine=i386-sequent
-		os=-dynix
-		;;
-	t3d)
-		basic_machine=alpha-cray
-		os=-unicos
-		;;
-	t3e)
-		basic_machine=alphaev5-cray
-		os=-unicos
-		;;
-	t90)
-		basic_machine=t90-cray
-		os=-unicos
-		;;
-	tic54x | c54x*)
-		basic_machine=tic54x-unknown
-		os=-coff
-		;;
-	tx39)
-		basic_machine=mipstx39-unknown
-		;;
-	tx39el)
-		basic_machine=mipstx39el-unknown
-		;;
-	toad1)
-		basic_machine=pdp10-xkl
-		os=-tops20
-		;;
-	tower | tower-32)
-		basic_machine=m68k-ncr
-		;;
-	udi29k)
-		basic_machine=a29k-amd
-		os=-udi
-		;;
-	ultra3)
-		basic_machine=a29k-nyu
-		os=-sym1
-		;;
-	v810 | necv810)
-		basic_machine=v810-nec
-		os=-none
-		;;
-	vaxv)
-		basic_machine=vax-dec
-		os=-sysv
-		;;
-	vms)
-		basic_machine=vax-dec
-		os=-vms
-		;;
-	vpp*|vx|vx-*)
-               basic_machine=f301-fujitsu
-               ;;
-	vxworks960)
-		basic_machine=i960-wrs
-		os=-vxworks
-		;;
-	vxworks68)
-		basic_machine=m68k-wrs
-		os=-vxworks
-		;;
-	vxworks29k)
-		basic_machine=a29k-wrs
-		os=-vxworks
-		;;
-	w65*)
-		basic_machine=w65-wdc
-		os=-none
-		;;
-	w89k-*)
-		basic_machine=hppa1.1-winbond
-		os=-proelf
-		;;
-	windows32)
-		basic_machine=i386-pc
-		os=-windows32-msvcrt
-		;;
-        xps | xps100)
-		basic_machine=xps100-honeywell
-		;;
-	ymp)
-		basic_machine=ymp-cray
-		os=-unicos
-		;;
-	z8k-*-coff)
-		basic_machine=z8k-unknown
-		os=-sim
-		;;
-	none)
-		basic_machine=none-none
-		os=-none
-		;;
-
-# Here we handle the default manufacturer of certain CPU types.  It is in
-# some cases the only manufacturer, in others, it is the most popular.
-	w89k)
-		basic_machine=hppa1.1-winbond
-		;;
-	op50n)
-		basic_machine=hppa1.1-oki
-		;;
-	op60c)
-		basic_machine=hppa1.1-oki
-		;;
-	romp)
-		basic_machine=romp-ibm
-		;;
-	rs6000)
-		basic_machine=rs6000-ibm
-		;;
-	vax)
-		basic_machine=vax-dec
-		;;
-	pdp10)
-		# there are many clones, so DEC is not a safe bet
-		basic_machine=pdp10-unknown
-		;;
-	pdp11)
-		basic_machine=pdp11-dec
-		;;
-	we32k)
-		basic_machine=we32k-att
-		;;
-	sh3 | sh4 | sh3eb | sh4eb | sh[1234]le | sh3ele)
-		basic_machine=sh-unknown
-		;;
-	sh64)
-		basic_machine=sh64-unknown
-		;;
-	sparc | sparcv9 | sparcv9b)
-		basic_machine=sparc-sun
-		;;
-        cydra)
-		basic_machine=cydra-cydrome
-		;;
-	orion)
-		basic_machine=orion-highlevel
-		;;
-	orion105)
-		basic_machine=clipper-highlevel
-		;;
-	mac | mpw | mac-mpw)
-		basic_machine=m68k-apple
-		;;
-	pmac | pmac-mpw)
-		basic_machine=powerpc-apple
-		;;
-	c4x*)
-		basic_machine=c4x-none
-		os=-coff
-		;;
-	*-unknown)
-		# Make sure to match an already-canonicalized machine name.
-		;;
-	*)
-		echo Invalid configuration \`$1\': machine \`$basic_machine\' not recognized 1>&2
-		exit 1
-		;;
-esac
-
-# Here we canonicalize certain aliases for manufacturers.
-case $basic_machine in
-	*-digital*)
-		basic_machine=`echo $basic_machine | sed 's/digital.*/dec/'`
-		;;
-	*-commodore*)
-		basic_machine=`echo $basic_machine | sed 's/commodore.*/cbm/'`
-		;;
-	*)
-		;;
-esac
-
-# Decode manufacturer-specific aliases for certain operating systems.
-
-if [ x"$os" != x"" ]
-then
-case $os in
-        # First match some system type aliases
-        # that might get confused with valid system types.
-	# -solaris* is a basic system type, with this one exception.
-	-solaris1 | -solaris1.*)
-		os=`echo $os | sed -e 's|solaris1|sunos4|'`
-		;;
-	-solaris)
-		os=-solaris2
-		;;
-	-svr4*)
-		os=-sysv4
-		;;
-	-unixware*)
-		os=-sysv4.2uw
-		;;
-	-gnu/linux*)
-		os=`echo $os | sed -e 's|gnu/linux|linux-gnu|'`
-		;;
-	# First accept the basic system types.
-	# The portable systems comes first.
-	# Each alternative MUST END IN A *, to match a version number.
-	# -sysv* is not here because it comes later, after sysvr4.
-	-gnu* | -bsd* | -mach* | -minix* | -genix* | -ultrix* | -irix* \
-	      | -*vms* | -sco* | -esix* | -isc* | -aix* | -sunos | -sunos[34]*\
-	      | -hpux* | -unos* | -osf* | -luna* | -dgux* | -solaris* | -sym* \
-	      | -amigaos* | -amigados* | -msdos* | -newsos* | -unicos* | -aof* \
-	      | -aos* \
-	      | -nindy* | -vxsim* | -vxworks* | -ebmon* | -hms* | -mvs* \
-	      | -clix* | -riscos* | -uniplus* | -iris* | -rtu* | -xenix* \
-	      | -hiux* | -386bsd* | -netbsd* | -openbsd* | -freebsd* | -riscix* \
-	      | -lynxos* | -bosx* | -nextstep* | -cxux* | -aout* | -elf* | -oabi* \
-	      | -ptx* | -coff* | -ecoff* | -winnt* | -domain* | -vsta* \
-	      | -udi* | -eabi* | -lites* | -ieee* | -go32* | -aux* \
-	      | -chorusos* | -chorusrdb* \
-	      | -cygwin* | -pe* | -psos* | -moss* | -proelf* | -rtems* \
-	      | -mingw32* | -linux-gnu* | -uxpv* | -beos* | -mpeix* | -udk* \
-	      | -interix* | -uwin* | -rhapsody* | -darwin* | -opened* \
-	      | -openstep* | -oskit* | -conix* | -pw32* | -nonstopux* \
-	      | -storm-chaos* | -tops10* | -tenex* | -tops20* | -its* \
-	      | -os2* | -vos* | -palmos* | -uclinux* | -nucleus* \
-	      | -morphos* | -superux* | -rtmk* | -rtmk-nova* | -windiss* | -powermax*)
-	# Remember, each alternative MUST END IN *, to match a version number.
-		;;
-	-qnx*)
-		case $basic_machine in
-		    x86-* | i*86-*)
-			;;
-		    *)
-			os=-nto$os
-			;;
-		esac
-		;;
-	-nto*)
-		os=-nto-qnx
-		;;
-	-sim | -es1800* | -hms* | -xray | -os68k* | -none* | -v88r* \
-	      | -windows* | -osx | -abug | -netware* | -os9* | -beos* \
-	      | -macos* | -mpw* | -magic* | -mmixware* | -mon960* | -lnews*)
-		;;
-	-mac*)
-		os=`echo $os | sed -e 's|mac|macos|'`
-		;;
-	-linux*)
-		os=`echo $os | sed -e 's|linux|linux-gnu|'`
-		;;
-	-sunos5*)
-		os=`echo $os | sed -e 's|sunos5|solaris2|'`
-		;;
-	-sunos6*)
-		os=`echo $os | sed -e 's|sunos6|solaris3|'`
-		;;
-	-opened*)
-		os=-openedition
-		;;
-	-wince*)
-		os=-wince
-		;;
-	-osfrose*)
-		os=-osfrose
-		;;
-	-osf*)
-		os=-osf
-		;;
-	-utek*)
-		os=-bsd
-		;;
-	-dynix*)
-		os=-bsd
-		;;
-	-acis*)
-		os=-aos
-		;;
-	-atheos*)
-		os=-atheos
-		;;
-	-386bsd)
-		os=-bsd
-		;;
-	-ctix* | -uts*)
-		os=-sysv
-		;;
-	-nova*)
-		os=-rtmk-nova
-		;;
-	-ns2 )
-	        os=-nextstep2
-		;;
-	-nsk*)
-		os=-nsk
-		;;
-	# Preserve the version number of sinix5.
-	-sinix5.*)
-		os=`echo $os | sed -e 's|sinix|sysv|'`
-		;;
-	-sinix*)
-		os=-sysv4
-		;;
-	-triton*)
-		os=-sysv3
-		;;
-	-oss*)
-		os=-sysv3
-		;;
-	-svr4)
-		os=-sysv4
-		;;
-	-svr3)
-		os=-sysv3
-		;;
-	-sysvr4)
-		os=-sysv4
-		;;
-	# This must come after -sysvr4.
-	-sysv*)
-		;;
-	-ose*)
-		os=-ose
-		;;
-	-es1800*)
-		os=-ose
-		;;
-	-xenix)
-		os=-xenix
-		;;
-        -*mint | -mint[0-9]* | -*MiNT | -MiNT[0-9]*)
-	        os=-mint
-		;;
-	-none)
-		;;
-	*)
-		# Get rid of the `-' at the beginning of $os.
-		os=`echo $os | sed 's/[^-]*-//'`
-		echo Invalid configuration \`$1\': system \`$os\' not recognized 1>&2
-		exit 1
-		;;
-esac
-else
-
-# Here we handle the default operating systems that come with various machines.
-# The value should be what the vendor currently ships out the door with their
-# machine or put another way, the most popular os provided with the machine.
-
-# Note that if you're going to try to match "-MANUFACTURER" here (say,
-# "-sun"), then you have to tell the case statement up towards the top
-# that MANUFACTURER isn't an operating system.  Otherwise, code above
-# will signal an error saying that MANUFACTURER isn't an operating
-# system, and we'll never get to this point.
-
-case $basic_machine in
-	*-acorn)
-		os=-riscix1.2
-		;;
-	arm*-rebel)
-		os=-linux
-		;;
-	arm*-semi)
-		os=-aout
-		;;
-	# This must come before the *-dec entry.
-	pdp10-*)
-		os=-tops20
-		;;
-        pdp11-*)
-		os=-none
-		;;
-	*-dec | vax-*)
-		os=-ultrix4.2
-		;;
-	m68*-apollo)
-		os=-domain
-		;;
-	i386-sun)
-		os=-sunos4.0.2
-		;;
-	m68000-sun)
-		os=-sunos3
-		# This also exists in the configure program, but was not the
-		# default.
-		# os=-sunos4
-		;;
-	m68*-cisco)
-		os=-aout
-		;;
-	mips*-cisco)
-		os=-elf
-		;;
-	mips*-*)
-		os=-elf
-		;;
-	or32-*)
-		os=-coff
-		;;
-	*-tti)	# must be before sparc entry or we get the wrong os.
-		os=-sysv3
-		;;
-	sparc-* | *-sun)
-		os=-sunos4.1.1
-		;;
-	*-be)
-		os=-beos
-		;;
-	*-ibm)
-		os=-aix
-		;;
-	*-wec)
-		os=-proelf
-		;;
-	*-winbond)
-		os=-proelf
-		;;
-	*-oki)
-		os=-proelf
-		;;
-	*-hp)
-		os=-hpux
-		;;
-	*-hitachi)
-		os=-hiux
-		;;
-	i860-* | *-att | *-ncr | *-altos | *-motorola | *-convergent)
-		os=-sysv
-		;;
-	*-cbm)
-		os=-amigaos
-		;;
-	*-dg)
-		os=-dgux
-		;;
-	*-dolphin)
-		os=-sysv3
-		;;
-	m68k-ccur)
-		os=-rtu
-		;;
-	m88k-omron*)
-		os=-luna
-		;;
-	*-next )
-		os=-nextstep
-		;;
-	*-sequent)
-		os=-ptx
-		;;
-	*-crds)
-		os=-unos
-		;;
-	*-ns)
-		os=-genix
-		;;
-	i370-*)
-		os=-mvs
-		;;
-	*-next)
-		os=-nextstep3
-		;;
-        *-gould)
-		os=-sysv
-		;;
-        *-highlevel)
-		os=-bsd
-		;;
-	*-encore)
-		os=-bsd
-		;;
-        *-sgi)
-		os=-irix
-		;;
-        *-siemens)
-		os=-sysv4
-		;;
-	*-masscomp)
-		os=-rtu
-		;;
-	f30[01]-fujitsu | f700-fujitsu)
-		os=-uxpv
-		;;
-	*-rom68k)
-		os=-coff
-		;;
-	*-*bug)
-		os=-coff
-		;;
-	*-apple)
-		os=-macos
-		;;
-	*-atari*)
-		os=-mint
-		;;
-	*)
-		os=-none
-		;;
-esac
-fi
-
-# Here we handle the case where we know the os, and the CPU type, but not the
-# manufacturer.  We pick the logical manufacturer.
-vendor=unknown
-case $basic_machine in
-	*-unknown)
-		case $os in
-			-riscix*)
-				vendor=acorn
-				;;
-			-sunos*)
-				vendor=sun
-				;;
-			-aix*)
-				vendor=ibm
-				;;
-			-beos*)
-				vendor=be
-				;;
-			-hpux*)
-				vendor=hp
-				;;
-			-mpeix*)
-				vendor=hp
-				;;
-			-hiux*)
-				vendor=hitachi
-				;;
-			-unos*)
-				vendor=crds
-				;;
-			-dgux*)
-				vendor=dg
-				;;
-			-luna*)
-				vendor=omron
-				;;
-			-genix*)
-				vendor=ns
-				;;
-			-mvs* | -opened*)
-				vendor=ibm
-				;;
-			-ptx*)
-				vendor=sequent
-				;;
-			-vxsim* | -vxworks* | -windiss*)
-				vendor=wrs
-				;;
-			-aux*)
-				vendor=apple
-				;;
-			-hms*)
-				vendor=hitachi
-				;;
-			-mpw* | -macos*)
-				vendor=apple
-				;;
-			-*mint | -mint[0-9]* | -*MiNT | -MiNT[0-9]*)
-				vendor=atari
-				;;
-			-vos*)
-				vendor=stratus
-				;;
-		esac
-		basic_machine=`echo $basic_machine | sed "s/unknown/$vendor/"`
-		;;
-esac
-
-echo $basic_machine$os
-exit 0
-
-# Local variables:
-# eval: (add-hook 'write-file-hooks 'time-stamp)
-# time-stamp-start: "timestamp='"
-# time-stamp-format: "%:y-%02m-%02d"
-# time-stamp-end: "'"
-# End:
diff --git a/crypto/openssh/configure.ac b/crypto/openssh/configure.ac
deleted file mode 100644
index 47fef0cbeccf..000000000000
--- a/crypto/openssh/configure.ac
+++ /dev/null
@@ -1,2567 +0,0 @@
-# $Id: configure.ac,v 1.113 2003/03/21 01:18:09 mouring Exp $
-
-AC_INIT
-AC_CONFIG_SRCDIR([ssh.c])
-
-AC_CONFIG_HEADER(config.h)
-AC_PROG_CC
-AC_CANONICAL_HOST
-AC_C_BIGENDIAN
-
-# Checks for programs.
-AC_PROG_CPP
-AC_PROG_RANLIB
-AC_PROG_INSTALL
-AC_PATH_PROG(AR, ar)
-AC_PATH_PROGS(PERL, perl5 perl)
-AC_PATH_PROG(SED, sed)
-AC_SUBST(PERL)
-AC_PATH_PROG(ENT, ent)
-AC_SUBST(ENT)
-AC_PATH_PROG(TEST_MINUS_S_SH, bash)
-AC_PATH_PROG(TEST_MINUS_S_SH, ksh)
-AC_PATH_PROG(TEST_MINUS_S_SH, sh)
-AC_PATH_PROG(SH, sh)
-
-# System features
-AC_SYS_LARGEFILE
-
-if test -z "$AR" ; then
-	AC_MSG_ERROR([*** 'ar' missing, please install or fix your \$PATH ***])
-fi
-
-# Use LOGIN_PROGRAM from environment if possible
-if test ! -z "$LOGIN_PROGRAM" ; then
-	AC_DEFINE_UNQUOTED(LOGIN_PROGRAM_FALLBACK, "$LOGIN_PROGRAM")
-else
-	# Search for login
-	AC_PATH_PROG(LOGIN_PROGRAM_FALLBACK, login)
-	if test ! -z "$LOGIN_PROGRAM_FALLBACK" ; then
-		AC_DEFINE_UNQUOTED(LOGIN_PROGRAM_FALLBACK, "$LOGIN_PROGRAM_FALLBACK")
-	fi
-fi
-
-if test -z "$LD" ; then
-	LD=$CC
-fi
-AC_SUBST(LD)
-	
-AC_C_INLINE
-if test "$GCC" = "yes" || test "$GCC" = "egcs"; then 
-	CFLAGS="$CFLAGS -Wall -Wpointer-arith -Wno-uninitialized"
-fi
-
-# Check for some target-specific stuff
-case "$host" in
-*-*-aix*)
-	AFS_LIBS="-lld"
-	CPPFLAGS="$CPPFLAGS -I/usr/local/include"
-	LDFLAGS="$LDFLAGS -L/usr/local/lib"
-	if (test "$LD" != "gcc" && test -z "$blibpath"); then
-		AC_MSG_CHECKING([if linkage editor ($LD) accepts -blibpath])
-		saved_LDFLAGS="$LDFLAGS"
-		LDFLAGS="$LDFLAGS -blibpath:/usr/lib:/lib:/usr/local/lib"
-		AC_TRY_LINK([],
-			[],
-			[
-				AC_MSG_RESULT(yes)
-				blibpath="/usr/lib:/lib:/usr/local/lib"
-			],
-			[ AC_MSG_RESULT(no) ]
-		)
-		LDFLAGS="$saved_LDFLAGS"
-	fi
-	AC_CHECK_FUNC(authenticate, [AC_DEFINE(WITH_AIXAUTHENTICATE)],
-		[AC_CHECK_LIB(s,authenticate,
-			[ AC_DEFINE(WITH_AIXAUTHENTICATE)
-				LIBS="$LIBS -ls"
-			])
-		])
-	AC_DEFINE(BROKEN_GETADDRINFO)
-	AC_DEFINE(BROKEN_REALPATH)
-	dnl AIX handles lastlog as part of its login message
-	AC_DEFINE(DISABLE_LASTLOG)
-	AC_DEFINE(LOGIN_NEEDS_UTMPX)
-	AC_DEFINE(SETPROCTITLE_STRATEGY,PS_USE_CLOBBER_ARGV)
-	AC_DEFINE(SETPROCTITLE_PS_PADDING, '\0')
-	;;
-*-*-cygwin*)
-	check_for_libcrypt_later=1
-	LIBS="$LIBS /usr/lib/textmode.o"
-	AC_DEFINE(HAVE_CYGWIN)
-	AC_DEFINE(USE_PIPES)
-	AC_DEFINE(DISABLE_SHADOW)
-	AC_DEFINE(IPV4_DEFAULT)
-	AC_DEFINE(IP_TOS_IS_BROKEN)
-	AC_DEFINE(NO_X11_UNIX_SOCKETS)
-	AC_DEFINE(NO_IPPORT_RESERVED_CONCEPT)
-	AC_DEFINE(DISABLE_FD_PASSING)
-	AC_DEFINE(SETGROUPS_NOOP)
-	;;
-*-*-dgux*)
-	AC_DEFINE(IP_TOS_IS_BROKEN)
-	;;
-*-*-darwin*)
-	AC_MSG_CHECKING(if we have working getaddrinfo)
-	AC_TRY_RUN([#include <mach-o/dyld.h>
-main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
-		exit(0);
-	else
-		exit(1);
-}], [AC_MSG_RESULT(working)],
-	[AC_MSG_RESULT(buggy)
-	AC_DEFINE(BROKEN_GETADDRINFO)],
-	[AC_MSG_RESULT(assume it is working)])
-	;;
-*-*-hpux10.26)
-	if test -z "$GCC"; then
-		CFLAGS="$CFLAGS -Ae"
-	fi
-	CPPFLAGS="$CPPFLAGS -D_HPUX_SOURCE -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1"
-	IPADDR_IN_DISPLAY=yes
-	AC_DEFINE(HAVE_SECUREWARE)
-	AC_DEFINE(USE_PIPES)
-	AC_DEFINE(LOGIN_NO_ENDOPT)
-	AC_DEFINE(LOGIN_NEEDS_UTMPX)
-	AC_DEFINE(DISABLE_SHADOW)
-	AC_DEFINE(DISABLE_UTMP)
-	AC_DEFINE(SETPROCTITLE_STRATEGY,PS_USE_PSTAT)
-	LIBS="$LIBS -lsec -lsecpw"
-	AC_CHECK_LIB(xnet, t_error, ,AC_MSG_ERROR([*** -lxnet needed on HP-UX - check config.log ***]))
-	disable_ptmx_check=yes
-	;;
-*-*-hpux10*)
-	if test -z "$GCC"; then
-		CFLAGS="$CFLAGS -Ae"
-	fi
-	CPPFLAGS="$CPPFLAGS -D_HPUX_SOURCE -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1"
-	IPADDR_IN_DISPLAY=yes
-	AC_DEFINE(USE_PIPES)
-	AC_DEFINE(LOGIN_NO_ENDOPT)
-	AC_DEFINE(LOGIN_NEEDS_UTMPX)
-	AC_DEFINE(DISABLE_SHADOW)
-	AC_DEFINE(DISABLE_UTMP)
-	AC_DEFINE(SETPROCTITLE_STRATEGY,PS_USE_PSTAT)
-	LIBS="$LIBS -lsec"
-	AC_CHECK_LIB(xnet, t_error, ,AC_MSG_ERROR([*** -lxnet needed on HP-UX - check config.log ***]))
-	;;
-*-*-hpux11*)
-	CPPFLAGS="$CPPFLAGS -D_HPUX_SOURCE -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1"
-	IPADDR_IN_DISPLAY=yes
-	AC_DEFINE(PAM_SUN_CODEBASE)
-	AC_DEFINE(USE_PIPES)
-	AC_DEFINE(LOGIN_NO_ENDOPT)
-	AC_DEFINE(LOGIN_NEEDS_UTMPX)
-	AC_DEFINE(DISABLE_SHADOW)
-	AC_DEFINE(DISABLE_UTMP)
-	AC_DEFINE(SETPROCTITLE_STRATEGY,PS_USE_PSTAT)
-	LIBS="$LIBS -lsec"
-	AC_CHECK_LIB(xnet, t_error, ,AC_MSG_ERROR([*** -lxnet needed on HP-UX - check config.log ***]))
-	;;
-*-*-irix5*)
-	CPPFLAGS="$CPPFLAGS -I/usr/local/include"
-	LDFLAGS="$LDFLAGS"
-	PATH="$PATH:/usr/etc"
-	AC_DEFINE(BROKEN_INET_NTOA)
-	AC_DEFINE(WITH_ABBREV_NO_TTY)
-	;;
-*-*-irix6*)
-	CPPFLAGS="$CPPFLAGS -I/usr/local/include"
-	LDFLAGS="$LDFLAGS"
-	PATH="$PATH:/usr/etc"
-	AC_DEFINE(WITH_IRIX_ARRAY)
-	AC_DEFINE(WITH_IRIX_PROJECT)
-	AC_DEFINE(WITH_IRIX_AUDIT)
-	AC_CHECK_FUNC(jlimit_startjob, [AC_DEFINE(WITH_IRIX_JOBS)])
-	AC_DEFINE(BROKEN_INET_NTOA)
-	AC_DEFINE(WITH_ABBREV_NO_TTY)
-	;;
-*-*-linux*)
-	no_dev_ptmx=1
-	check_for_libcrypt_later=1
-	AC_DEFINE(DONT_TRY_OTHER_AF)
-	AC_DEFINE(PAM_TTY_KLUDGE)
-	AC_DEFINE(SETPROCTITLE_STRATEGY,PS_USE_CLOBBER_ARGV)
-	AC_DEFINE(SETPROCTITLE_PS_PADDING, '\0')
-	inet6_default_4in6=yes
-	;;
-mips-sony-bsd|mips-sony-newsos4)
-	AC_DEFINE(HAVE_NEWS4)
-	SONY=1
-	;;
-*-*-netbsd*)
-	check_for_libcrypt_before=1
-	need_dash_r=1
-	;;
-*-*-freebsd*)
-	check_for_libcrypt_later=1
-	;;
-*-next-*)
-	conf_lastlog_location="/usr/adm/lastlog"
-	conf_utmp_location=/etc/utmp
-	conf_wtmp_location=/usr/adm/wtmp
-	MAIL=/usr/spool/mail
-	AC_DEFINE(HAVE_NEXT)
-	AC_DEFINE(BROKEN_REALPATH)
-	AC_DEFINE(USE_PIPES)
-	AC_DEFINE(BROKEN_SAVED_UIDS)
-	CPPFLAGS="$CPPFLAGS -I/usr/local/include"
-	CFLAGS="$CFLAGS"
-	;;
-*-*-solaris*)
-	CPPFLAGS="$CPPFLAGS -I/usr/local/include"
-	LDFLAGS="$LDFLAGS -L/usr/local/lib -R/usr/local/lib" 
-	need_dash_r=1
-	AC_DEFINE(PAM_SUN_CODEBASE)
-	AC_DEFINE(LOGIN_NEEDS_UTMPX)
-	AC_DEFINE(LOGIN_NEEDS_TERM)
-	AC_DEFINE(PAM_TTY_KLUDGE)
-	AC_DEFINE(STREAMS_PUSH_ACQUIRES_CTTY)
-	# hardwire lastlog location (can't detect it on some versions)
-	conf_lastlog_location="/var/adm/lastlog"
-	AC_MSG_CHECKING(for obsolete utmp and wtmp in solaris2.x)
-	sol2ver=`echo "$host"| sed -e 's/.*[[0-9]]\.//'`
-	if test "$sol2ver" -ge 8; then
-		AC_MSG_RESULT(yes)
-		AC_DEFINE(DISABLE_UTMP)
-		AC_DEFINE(DISABLE_WTMP)
-	else
-		AC_MSG_RESULT(no)
-	fi
-	;;
-*-*-sunos4*)
-	CPPFLAGS="$CPPFLAGS -DSUNOS4"
-	AC_CHECK_FUNCS(getpwanam)
-	AC_DEFINE(PAM_SUN_CODEBASE)
-	conf_utmp_location=/etc/utmp
-	conf_wtmp_location=/var/adm/wtmp
-	conf_lastlog_location=/var/adm/lastlog
-	AC_DEFINE(USE_PIPES)
-	;;
-*-ncr-sysv*)
-	CPPFLAGS="$CPPFLAGS -I/usr/local/include"
-	LDFLAGS="$LDFLAGS -L/usr/local/lib"
-	LIBS="$LIBS -lc89"
-	AC_DEFINE(USE_PIPES)
-	;;
-*-sni-sysv*)
-	CPPFLAGS="$CPPFLAGS -I/usr/local/include"
-	# /usr/ucblib MUST NOT be searched on ReliantUNIX
-	LDFLAGS="$LDFLAGS -L/usr/local/lib"
-	IPADDR_IN_DISPLAY=yes
-	AC_DEFINE(USE_PIPES)
-	AC_DEFINE(IP_TOS_IS_BROKEN)
-	# /usr/ucblib/libucb.a no longer needed on ReliantUNIX
-	# Attention: always take care to bind libsocket and libnsl before libc,
-	# otherwise you will find lots of "SIOCGPGRP errno 22" on syslog
-	;;
-*-*-sysv4.2*)
-	CPPFLAGS="$CPPFLAGS -I/usr/local/include"
-	LDFLAGS="$LDFLAGS -L/usr/local/lib"
-	AC_DEFINE(USE_PIPES)
-	;;
-*-*-sysv5*)
-	CPPFLAGS="$CPPFLAGS -I/usr/local/include"
-	LDFLAGS="$LDFLAGS -L/usr/local/lib"
-	AC_DEFINE(USE_PIPES)
-	;;
-*-*-sysv*)
-	CPPFLAGS="$CPPFLAGS -I/usr/local/include"
-	LDFLAGS="$LDFLAGS -L/usr/local/lib"
-	;;
-*-*-sco3.2v4*)
-	CPPFLAGS="$CPPFLAGS -Dftruncate=chsize -I/usr/local/include"
-	LDFLAGS="$LDFLAGS -L/usr/local/lib"
-	LIBS="$LIBS -los -lprot -lx -ltinfo -lm"
-	RANLIB=true
-	no_dev_ptmx=1
-	AC_DEFINE(BROKEN_SYS_TERMIO_H)
-	AC_DEFINE(USE_PIPES)
-	AC_DEFINE(HAVE_SECUREWARE)
-	AC_DEFINE(DISABLE_SHADOW)
-	AC_DEFINE(BROKEN_SAVED_UIDS)
-	AC_CHECK_FUNCS(getluid setluid)
-	MANTYPE=man
-	do_sco3_extra_lib_check=yes
-	;;
-*-*-sco3.2v5*)
-	if test -z "$GCC"; then
-		CFLAGS="$CFLAGS -belf"
-	fi
-	CPPFLAGS="$CPPFLAGS -I/usr/local/include"
-	LDFLAGS="$LDFLAGS -L/usr/local/lib"
-	LIBS="$LIBS -lprot -lx -ltinfo -lm"
-	no_dev_ptmx=1
-	AC_DEFINE(USE_PIPES)
-	AC_DEFINE(HAVE_SECUREWARE)
-	AC_DEFINE(DISABLE_SHADOW)
-	AC_DEFINE(DISABLE_FD_PASSING)
-	AC_CHECK_FUNCS(getluid setluid)
-	MANTYPE=man
-	;;
-*-*-unicosmk*)
-	AC_DEFINE(USE_PIPES)
-	AC_DEFINE(DISABLE_FD_PASSING)
-	LDFLAGS="$LDFLAGS"
-	LIBS="$LIBS -lgen -lrsc -lshare -luex -lacm"
-	MANTYPE=cat
-	;;
-*-*-unicos*)
-	AC_DEFINE(USE_PIPES)
-	AC_DEFINE(DISABLE_FD_PASSING)
-	AC_DEFINE(NO_SSH_LASTLOG)
-	LDFLAGS="$LDFLAGS -Wl,-Dmsglevel=334:fatal"
-	LIBS="$LIBS -lgen -lrsc -lshare -luex -lacm"
-	MANTYPE=cat
-	;;
-*-dec-osf*)
-	AC_MSG_CHECKING(for Digital Unix SIA)
-	no_osfsia=""
-	AC_ARG_WITH(osfsia,
-		[  --with-osfsia           Enable Digital Unix SIA],
-		[
-			if test "x$withval" = "xno" ; then
-				AC_MSG_RESULT(disabled)
-				no_osfsia=1
-			fi
-		],
-	)
-	if test -z "$no_osfsia" ; then
-		if test -f /etc/sia/matrix.conf; then
-			AC_MSG_RESULT(yes)
-			AC_DEFINE(HAVE_OSF_SIA)
-			AC_DEFINE(DISABLE_LOGIN)
-			AC_DEFINE(DISABLE_FD_PASSING)
-			LIBS="$LIBS -lsecurity -ldb -lm -laud"
-		else
-			AC_MSG_RESULT(no)
-		fi
-	fi
-	AC_DEFINE(DISABLE_FD_PASSING)
-	;;
-
-*-*-nto-qnx)
-	AC_DEFINE(USE_PIPES)
-	AC_DEFINE(NO_X11_UNIX_SOCKETS)
-	AC_DEFINE(MISSING_NFDBITS)
-	AC_DEFINE(MISSING_HOWMANY)
-	AC_DEFINE(MISSING_FD_MASK)
-	;;
-esac
-
-# Allow user to specify flags
-AC_ARG_WITH(cflags,
-	[  --with-cflags           Specify additional flags to pass to compiler],
-	[
-		if test "x$withval" != "xno" ; then
-			CFLAGS="$CFLAGS $withval"
-		fi
-	]	
-)
-AC_ARG_WITH(cppflags,
-	[  --with-cppflags         Specify additional flags to pass to preprocessor] ,
-	[
-		if test "x$withval" != "xno"; then
-			CPPFLAGS="$CPPFLAGS $withval"
-		fi
-	]
-)
-AC_ARG_WITH(ldflags,
-	[  --with-ldflags          Specify additional flags to pass to linker],
-	[
-		if test "x$withval" != "xno" ; then
-			LDFLAGS="$LDFLAGS $withval"
-		fi
-	]	
-)
-AC_ARG_WITH(libs,
-	[  --with-libs             Specify additional libraries to link with],
-	[
-		if test "x$withval" != "xno" ; then
-			LIBS="$LIBS $withval"
-		fi
-	]	
-)
-
-# Checks for header files.
-AC_CHECK_HEADERS(bstring.h crypt.h endian.h floatingpoint.h \
-	getopt.h glob.h ia.h lastlog.h libgen.h limits.h login.h \
-	login_cap.h maillock.h netdb.h netgroup.h \
-	netinet/in_systm.h paths.h pty.h readpassphrase.h \
-	rpc/types.h security/pam_appl.h shadow.h stddef.h stdint.h \
-	strings.h sys/bitypes.h sys/bsdtty.h sys/cdefs.h \
-	sys/mman.h sys/pstat.h sys/select.h sys/stat.h \
-	sys/stropts.h sys/sysmacros.h sys/time.h sys/timers.h \
-	sys/un.h time.h tmpdir.h ttyent.h usersec.h \
-	util.h utime.h utmp.h utmpx.h)
-
-# Checks for libraries.
-AC_CHECK_FUNC(yp_match, , AC_CHECK_LIB(nsl, yp_match))
-AC_CHECK_FUNC(setsockopt, , AC_CHECK_LIB(socket, setsockopt))
-
-dnl SCO OS3 needs this for libwrap
-if test "x$with_tcp_wrappers" != "xno" ; then
-    if test "x$do_sco3_extra_lib_check" = "xyes" ; then
-	AC_CHECK_LIB(rpc, innetgr, LIBS="-lrpc -lyp -lrpc $LIBS" , , -lyp -lrpc)
-    fi
-fi
-
-AC_CHECK_FUNC(getspnam, ,
-	AC_CHECK_LIB(gen, getspnam, LIBS="$LIBS -lgen"))
-
-AC_ARG_WITH(rpath,
-	[  --without-rpath         Disable auto-added -R linker paths],
-	[
-		if test "x$withval" = "xno" ; then	
-			need_dash_r=""
-		fi
-		if test "x$withval" = "xyes" ; then
-			need_dash_r=1
-		fi
-	]
-)
-
-dnl zlib is required
-AC_ARG_WITH(zlib,
-	[  --with-zlib=PATH        Use zlib in PATH],
-	[
-		if test "x$withval" = "xno" ; then
-			AC_MSG_ERROR([*** zlib is required ***])
-		fi
-		if test -d "$withval/lib"; then
-			if test -n "${need_dash_r}"; then
-				LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
-			else
-				LDFLAGS="-L${withval}/lib ${LDFLAGS}"
-			fi
-		else
-			if test -n "${need_dash_r}"; then
-				LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
-			else
-				LDFLAGS="-L${withval} ${LDFLAGS}"
-			fi
-		fi
-		if test -d "$withval/include"; then
-			CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
-		else
-			CPPFLAGS="-I${withval} ${CPPFLAGS}"
-		fi
-	]
-)
-
-AC_CHECK_LIB(z, deflate, ,AC_MSG_ERROR([*** zlib missing - please install first or check config.log ***]))
-
-dnl UnixWare 2.x
-AC_CHECK_FUNC(strcasecmp, 
-	[], [ AC_CHECK_LIB(resolv, strcasecmp, LIBS="$LIBS -lresolv") ]
-)
-AC_CHECK_FUNC(utimes, 
-	[], [ AC_CHECK_LIB(c89, utimes, [AC_DEFINE(HAVE_UTIMES)
-					LIBS="$LIBS -lc89"]) ]
-)
-
-dnl    Checks for libutil functions
-AC_CHECK_HEADERS(libutil.h)
-AC_SEARCH_LIBS(login, util bsd, [AC_DEFINE(HAVE_LOGIN)])
-AC_CHECK_FUNCS(logout updwtmp logwtmp)
-
-AC_FUNC_STRFTIME
-
-# Check for ALTDIRFUNC glob() extension
-AC_MSG_CHECKING(for GLOB_ALTDIRFUNC support)
-AC_EGREP_CPP(FOUNDIT,
-	[
-		#include <glob.h>
-		#ifdef GLOB_ALTDIRFUNC
-		FOUNDIT
-		#endif
-	], 
-	[
-		AC_DEFINE(GLOB_HAS_ALTDIRFUNC)
-		AC_MSG_RESULT(yes)
-	],
-	[
-		AC_MSG_RESULT(no)
-	]
-)
-
-# Check for g.gl_matchc glob() extension
-AC_MSG_CHECKING(for gl_matchc field in glob_t)
-AC_EGREP_CPP(FOUNDIT,
-        [
-                #include <glob.h>
-		int main(void){glob_t g; g.gl_matchc = 1;}
-        ],
-        [
-                AC_DEFINE(GLOB_HAS_GL_MATCHC)
-                AC_MSG_RESULT(yes)
-        ],
-        [
-                AC_MSG_RESULT(no)
-        ]
-)
-
-AC_MSG_CHECKING([whether struct dirent allocates space for d_name])
-AC_TRY_RUN(
-	[
-#include <sys/types.h>
-#include <dirent.h>
-int main(void){struct dirent d;exit(sizeof(d.d_name)<=sizeof(char));}
-	],
-	[AC_MSG_RESULT(yes)], 
-	[
-		AC_MSG_RESULT(no)
-		AC_DEFINE(BROKEN_ONE_BYTE_DIRENT_D_NAME)
-	]
-)
-
-# Check whether user wants S/Key support
-SKEY_MSG="no" 
-AC_ARG_WITH(skey,
-	[  --with-skey[[=PATH]]      Enable S/Key support
-                            (optionally in PATH)],
-	[
-		if test "x$withval" != "xno" ; then
-
-			if test "x$withval" != "xyes" ; then
-				CPPFLAGS="$CPPFLAGS -I${withval}/include"
-				LDFLAGS="$LDFLAGS -L${withval}/lib"
-			fi
-
-			AC_DEFINE(SKEY)
-			LIBS="-lskey $LIBS"
-			SKEY_MSG="yes" 
-	
-			AC_MSG_CHECKING([for s/key support])
-			AC_TRY_RUN(
-				[
-#include <stdio.h>
-#include <skey.h>
-int main() { char *ff = skey_keyinfo(""); ff=""; exit(0); }
-				],
-				[AC_MSG_RESULT(yes)],
-				[
-					AC_MSG_RESULT(no)
-					AC_MSG_ERROR([** Incomplete or missing s/key libraries.])
-				])
-		fi
-	]
-)
-
-# Check whether user wants TCP wrappers support
-TCPW_MSG="no"
-AC_ARG_WITH(tcp-wrappers,
-	[  --with-tcp-wrappers[[=PATH]]      Enable tcpwrappers support
-                            (optionally in PATH)],
-	[
-		if test "x$withval" != "xno" ; then
-			saved_LIBS="$LIBS"
-			saved_LDFLAGS="$LDFLAGS"
-			saved_CPPFLAGS="$CPPFLAGS"
-			if test -n "${withval}" -a "${withval}" != "yes"; then
-				if test -d "${withval}/lib"; then
-					if test -n "${need_dash_r}"; then
-						LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
-					else
-						LDFLAGS="-L${withval}/lib ${LDFLAGS}"
-					fi
-				else
-					if test -n "${need_dash_r}"; then
-						LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
-					else
-						LDFLAGS="-L${withval} ${LDFLAGS}"
-					fi
-				fi
-				if test -d "${withval}/include"; then
-					CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
-				else
-					CPPFLAGS="-I${withval} ${CPPFLAGS}"
-				fi
-			fi
-			LIBWRAP="-lwrap"
-			LIBS="$LIBWRAP $LIBS"
-			AC_MSG_CHECKING(for libwrap)
-			AC_TRY_LINK(
-				[
-#include <tcpd.h>
-					int deny_severity = 0, allow_severity = 0;
-				],
-				[hosts_access(0);],
-				[
-					AC_MSG_RESULT(yes)
-					AC_DEFINE(LIBWRAP)
-					AC_SUBST(LIBWRAP)
-					TCPW_MSG="yes"
-				],
-				[
-					AC_MSG_ERROR([*** libwrap missing])
-				]
-			)
-			LIBS="$saved_LIBS"
-		fi
-	]
-)
-
-dnl    Checks for library functions. Please keep in alphabetical order
-AC_CHECK_FUNCS(\
-	arc4random __b64_ntop b64_ntop __b64_pton b64_pton basename bcopy \
-	bindresvport_sa clock fchmod fchown freeaddrinfo futimes \
-	gai_strerror getaddrinfo getcwd getgrouplist getnameinfo getopt \
-	getpeereid _getpty getrlimit getrusage getttyent glob inet_aton \
-	inet_ntoa inet_ntop innetgr login_getcapbool md5_crypt memmove \
-	mkdtemp mmap ngetaddrinfo nsleep ogetaddrinfo openpty pstat \
-	readpassphrase realpath recvmsg rresvport_af sendmsg setdtablesize \
-	setegid setenv seteuid setgroups setlogin setpcred setproctitle \
-	setresgid setreuid setrlimit setsid setvbuf sigaction sigvec \
-	snprintf socketpair strerror strlcat strlcpy strmode strnvis \
-	sysconf tcgetpgrp truncate utimes vhangup vsnprintf waitpid \
-)
-
-AC_SEARCH_LIBS(nanosleep, rt posix4, AC_DEFINE(HAVE_NANOSLEEP))
-
-dnl Make sure strsep prototype is defined before defining HAVE_STRSEP
-AC_CHECK_DECL(strsep, [AC_CHECK_FUNCS(strsep)])
-
-dnl IRIX and Solaris 2.5.1 have dirname() in libgen
-AC_CHECK_FUNCS(dirname, [AC_CHECK_HEADERS(libgen.h)] ,[
-	AC_CHECK_LIB(gen, dirname,[
-		AC_CACHE_CHECK([for broken dirname],
-			ac_cv_have_broken_dirname, [
-			save_LIBS="$LIBS"
-			LIBS="$LIBS -lgen"
-			AC_TRY_RUN(
-				[
-#include <libgen.h>
-#include <string.h>
-
-int main(int argc, char **argv) {
-    char *s, buf[32];
-
-    strncpy(buf,"/etc", 32);
-    s = dirname(buf);
-    if (!s || strncmp(s, "/", 32) != 0) {
-	exit(1);
-    } else {
-	exit(0);
-    }
-}
-				],
-				[ ac_cv_have_broken_dirname="no" ],
-				[ ac_cv_have_broken_dirname="yes" ]
-			)
-			LIBS="$save_LIBS"
-		])
-		if test "x$ac_cv_have_broken_dirname" = "xno" ; then
-			LIBS="$LIBS -lgen"
-			AC_DEFINE(HAVE_DIRNAME)
-			AC_CHECK_HEADERS(libgen.h)
-		fi
-	])
-])
-
-dnl    Checks for time functions
-AC_CHECK_FUNCS(gettimeofday time)
-dnl    Checks for utmp functions
-AC_CHECK_FUNCS(endutent getutent getutid getutline pututline setutent)
-AC_CHECK_FUNCS(utmpname)
-dnl    Checks for utmpx functions
-AC_CHECK_FUNCS(endutxent getutxent getutxid getutxline pututxline )
-AC_CHECK_FUNCS(setutxent utmpxname)
-
-AC_CHECK_FUNC(daemon, 
-	[AC_DEFINE(HAVE_DAEMON)],
-	[AC_CHECK_LIB(bsd, daemon, [LIBS="$LIBS -lbsd"; AC_DEFINE(HAVE_DAEMON)])]
-)
-
-AC_CHECK_FUNC(getpagesize, 
-	[AC_DEFINE(HAVE_GETPAGESIZE)],
-	[AC_CHECK_LIB(ucb, getpagesize, [LIBS="$LIBS -lucb"; AC_DEFINE(HAVE_GETPAGESIZE)])]
-)
-
-# Check for broken snprintf
-if test "x$ac_cv_func_snprintf" = "xyes" ; then
-	AC_MSG_CHECKING([whether snprintf correctly terminates long strings])
-	AC_TRY_RUN(
-		[
-#include <stdio.h>
-int main(void){char b[5];snprintf(b,5,"123456789");exit(b[4]!='\0');}
-		],
-		[AC_MSG_RESULT(yes)], 
-		[
-			AC_MSG_RESULT(no)
-			AC_DEFINE(BROKEN_SNPRINTF)
-			AC_MSG_WARN([****** Your snprintf() function is broken, complain to your vendor])
-		]
-	)
-fi
-
-dnl see whether mkstemp() requires XXXXXX
-if test "x$ac_cv_func_mkdtemp" = "xyes" ; then
-AC_MSG_CHECKING([for (overly) strict mkstemp])
-AC_TRY_RUN(
-	[
-#include <stdlib.h>
-main() { char template[]="conftest.mkstemp-test";
-if (mkstemp(template) == -1)
-	exit(1);
-unlink(template); exit(0);
-}
-	],
-	[
-		AC_MSG_RESULT(no)
-	],
-	[ 
-		AC_MSG_RESULT(yes)
-		AC_DEFINE(HAVE_STRICT_MKSTEMP)
-	],
-	[
-		AC_MSG_RESULT(yes)
-		AC_DEFINE(HAVE_STRICT_MKSTEMP)
-	] 
-)
-fi
-
-AC_FUNC_GETPGRP
-
-# Check for PAM libs
-PAM_MSG="no"
-AC_ARG_WITH(pam,
-	[  --with-pam              Enable PAM support ],
-	[
-		if test "x$withval" != "xno" ; then
-			if test "x$ac_cv_header_security_pam_appl_h" != "xyes" ; then
-				AC_MSG_ERROR([PAM headers not found])
-			fi
-
-			AC_CHECK_LIB(dl, dlopen, , )
-			AC_CHECK_LIB(pam, pam_set_item, , AC_MSG_ERROR([*** libpam missing]))
-			AC_CHECK_FUNCS(pam_getenvlist)
-
-			disable_shadow=yes
-			PAM_MSG="yes"
-
-			AC_DEFINE(USE_PAM)
-			if test $ac_cv_lib_dl_dlopen = yes; then
-				LIBPAM="-lpam -ldl"
-			else
-				LIBPAM="-lpam"
-			fi
-			AC_SUBST(LIBPAM)
-		fi
-	]
-)
-
-# Check for older PAM
-if test "x$PAM_MSG" = "xyes" ; then
-	# Check PAM strerror arguments (old PAM)
-	AC_MSG_CHECKING([whether pam_strerror takes only one argument])
-	AC_TRY_COMPILE(
-		[
-#include <stdlib.h>
-#include <security/pam_appl.h>
-		], 
-		[(void)pam_strerror((pam_handle_t *)NULL, -1);], 
-		[AC_MSG_RESULT(no)],
-		[
-			AC_DEFINE(HAVE_OLD_PAM)
-			AC_MSG_RESULT(yes)
-			PAM_MSG="yes (old library)"
-		]
-	)
-fi
-
-# Some systems want crypt() from libcrypt, *not* the version in OpenSSL,
-# because the system crypt() is more featureful.
-if test "x$check_for_libcrypt_before" = "x1"; then
-	AC_CHECK_LIB(crypt, crypt)
-fi
-
-# Search for OpenSSL
-saved_CPPFLAGS="$CPPFLAGS"
-saved_LDFLAGS="$LDFLAGS"
-AC_ARG_WITH(ssl-dir,
-	[  --with-ssl-dir=PATH     Specify path to OpenSSL installation ],
-	[
-		if test "x$withval" != "xno" ; then
-			if test -d "$withval/lib"; then
-				if test -n "${need_dash_r}"; then
-					LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
-				else
-					LDFLAGS="-L${withval}/lib ${LDFLAGS}"
-				fi
-			else
-				if test -n "${need_dash_r}"; then
-					LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
-				else
-					LDFLAGS="-L${withval} ${LDFLAGS}"
-				fi
-			fi
-			if test -d "$withval/include"; then
-				CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
-			else
-				CPPFLAGS="-I${withval} ${CPPFLAGS}"
-			fi
-		fi
-	]
-)
-LIBS="$LIBS -lcrypto"
-AC_TRY_LINK_FUNC(RAND_add, AC_DEFINE(HAVE_OPENSSL),
-	[
-		dnl Check default openssl install dir
-		if test -n "${need_dash_r}"; then
-			LDFLAGS="-L/usr/local/ssl/lib -R/usr/local/ssl/lib ${saved_LDFLAGS}"
-		else
-			LDFLAGS="-L/usr/local/ssl/lib ${saved_LDFLAGS}"
-		fi
-		CPPFLAGS="-I/usr/local/ssl/include ${saved_CPPFLAGS}"
-		AC_TRY_LINK_FUNC(RAND_add, AC_DEFINE(HAVE_OPENSSL),
-			[
-				AC_MSG_ERROR([*** Can't find recent OpenSSL libcrypto (see config.log for details) ***])
-			]
-		)
-	]
-)
-
-# Determine OpenSSL header version
-AC_MSG_CHECKING([OpenSSL header version])
-AC_TRY_RUN(
-	[
-#include <stdio.h>
-#include <string.h>
-#include <openssl/opensslv.h>
-#define DATA "conftest.sslincver"
-int main(void) {
-        FILE *fd;
-        int rc;
-
-        fd = fopen(DATA,"w");
-        if(fd == NULL)
-                exit(1);
-
-	if ((rc = fprintf(fd ,"%x (%s)\n", OPENSSL_VERSION_NUMBER, OPENSSL_VERSION_TEXT)) <0)
-		exit(1);
-
-	exit(0);
-}
-	],
-	[
-		ssl_header_ver=`cat conftest.sslincver`
-		AC_MSG_RESULT($ssl_header_ver)
-	],
-	[
-		AC_MSG_RESULT(not found)
-		AC_MSG_ERROR(OpenSSL version header not found.)
-	]
-)
-
-# Determine OpenSSL library version
-AC_MSG_CHECKING([OpenSSL library version])
-AC_TRY_RUN(
-	[
-#include <stdio.h>
-#include <string.h>
-#include <openssl/opensslv.h>
-#include <openssl/crypto.h>
-#define DATA "conftest.ssllibver"
-int main(void) {
-        FILE *fd;
-        int rc;
-
-        fd = fopen(DATA,"w");
-        if(fd == NULL)
-                exit(1);
-
-	if ((rc = fprintf(fd ,"%x (%s)\n", SSLeay(), SSLeay_version(SSLEAY_VERSION))) <0)
-		exit(1);
-
-	exit(0);
-}
-	],
-	[
-		ssl_library_ver=`cat conftest.ssllibver`
-		AC_MSG_RESULT($ssl_library_ver)
-	],
-	[
-		AC_MSG_RESULT(not found)
-		AC_MSG_ERROR(OpenSSL library not found.)
-	]
-)
-
-# Sanity check OpenSSL headers
-AC_MSG_CHECKING([whether OpenSSL's headers match the library])
-AC_TRY_RUN(
-	[
-#include <string.h>
-#include <openssl/opensslv.h>
-int main(void) { exit(SSLeay() == OPENSSL_VERSION_NUMBER ? 0 : 1); }
-	],
-	[
-		AC_MSG_RESULT(yes)
-	],
-	[
-		AC_MSG_RESULT(no)
-		AC_MSG_ERROR(Your OpenSSL headers do not match your library)
-	]
-)
-
-# Some Linux systems (Slackware) need crypt() from libcrypt, *not* the 
-# version in OpenSSL. Skip this for PAM
-if test "x$PAM_MSG" = "xno" -a "x$check_for_libcrypt_later" = "x1"; then
-	AC_CHECK_LIB(crypt, crypt, LIBS="$LIBS -lcrypt")
-fi
-
-
-### Configure cryptographic random number support
-
-# Check wheter OpenSSL seeds itself
-AC_MSG_CHECKING([whether OpenSSL's PRNG is internally seeded])
-AC_TRY_RUN(
-	[
-#include <string.h>
-#include <openssl/rand.h>
-int main(void) { exit(RAND_status() == 1 ? 0 : 1); }
-	],
-	[
-		OPENSSL_SEEDS_ITSELF=yes
-		AC_MSG_RESULT(yes)
-	],
-	[
-		AC_MSG_RESULT(no)
-		# Default to use of the rand helper if OpenSSL doesn't
-		# seed itself
-		USE_RAND_HELPER=yes
-	]
-)
-
-
-# Do we want to force the use of the rand helper?
-AC_ARG_WITH(rand-helper,
-	[  --with-rand-helper      Use subprocess to gather strong randomness ],
-	[
-		if test "x$withval" = "xno" ; then
-			# Force use of OpenSSL's internal RNG, even if 
-			# the previous test showed it to be unseeded.
-			if test -z "$OPENSSL_SEEDS_ITSELF" ; then
-				AC_MSG_WARN([*** Forcing use of OpenSSL's non-self-seeding PRNG])
-				OPENSSL_SEEDS_ITSELF=yes
-				USE_RAND_HELPER=""
-			fi
-		else
-			USE_RAND_HELPER=yes
-		fi
-	],
-)	
-
-# Which randomness source do we use?
-if test ! -z "$OPENSSL_SEEDS_ITSELF" -a -z "$USE_RAND_HELPER" ; then
-	# OpenSSL only
-	AC_DEFINE(OPENSSL_PRNG_ONLY)
-	RAND_MSG="OpenSSL internal ONLY"
-	INSTALL_SSH_RAND_HELPER=""
-elif test ! -z "$USE_RAND_HELPER" ; then
-	# install rand helper
-	RAND_MSG="ssh-rand-helper"
-	INSTALL_SSH_RAND_HELPER="yes"
-fi
-AC_SUBST(INSTALL_SSH_RAND_HELPER)
-
-### Configuration of ssh-rand-helper
-
-# PRNGD TCP socket
-AC_ARG_WITH(prngd-port,
-	[  --with-prngd-port=PORT  read entropy from PRNGD/EGD TCP localhost:PORT],
-	[
-		case "$withval" in
-		no)
-			withval=""
-			;;
-		[[0-9]]*)
-			;;
-		*)
-			AC_MSG_ERROR(You must specify a numeric port number for --with-prngd-port)
-			;;
-		esac
-		if test ! -z "$withval" ; then
-			PRNGD_PORT="$withval"
-			AC_DEFINE_UNQUOTED(PRNGD_PORT, $PRNGD_PORT)
-		fi
-	]
-)
-
-# PRNGD Unix domain socket
-AC_ARG_WITH(prngd-socket,
-	[  --with-prngd-socket=FILE read entropy from PRNGD/EGD socket FILE (default=/var/run/egd-pool)],
-	[
-		case "$withval" in
-		yes)
-			withval="/var/run/egd-pool"
-			;;
-		no)
-			withval=""
-			;;
-		/*)
-			;;
-		*)
-			AC_MSG_ERROR(You must specify an absolute path to the entropy socket)
-			;;
-		esac
-
-		if test ! -z "$withval" ; then
-			if test ! -z "$PRNGD_PORT" ; then
-				AC_MSG_ERROR(You may not specify both a PRNGD/EGD port and socket)
-			fi
-			if test ! -r "$withval" ; then
-				AC_MSG_WARN(Entropy socket is not readable)
-			fi
-			PRNGD_SOCKET="$withval"
-			AC_DEFINE_UNQUOTED(PRNGD_SOCKET, "$PRNGD_SOCKET")
-		fi
-	],
-	[
-		# Check for existing socket only if we don't have a random device already
-		if test "$USE_RAND_HELPER" = yes ; then
-			AC_MSG_CHECKING(for PRNGD/EGD socket)
-			# Insert other locations here
-			for sock in /var/run/egd-pool /dev/egd-pool /etc/entropy; do
-				if test -r $sock && $TEST_MINUS_S_SH -c "test -S $sock -o -p $sock" ; then
-					PRNGD_SOCKET="$sock"
-					AC_DEFINE_UNQUOTED(PRNGD_SOCKET, "$PRNGD_SOCKET")
-					break;
-				fi
-			done
-			if test ! -z "$PRNGD_SOCKET" ; then
-				AC_MSG_RESULT($PRNGD_SOCKET)
-			else
-				AC_MSG_RESULT(not found)
-			fi
-		fi
-	]
-)
-
-# Change default command timeout for hashing entropy source
-entropy_timeout=200
-AC_ARG_WITH(entropy-timeout,
-	[  --with-entropy-timeout  Specify entropy gathering command timeout (msec)],
-	[
-		if test "x$withval" != "xno" ; then
-			entropy_timeout=$withval
-		fi
-	]	
-)
-AC_DEFINE_UNQUOTED(ENTROPY_TIMEOUT_MSEC, $entropy_timeout)
-
-SSH_PRIVSEP_USER=sshd
-AC_ARG_WITH(privsep-user,
-	[  --with-privsep-user=user Specify non-privileged user for privilege separation],
-	[
-		if test -n "$withval"; then
-			SSH_PRIVSEP_USER=$withval
-		fi
-	]	
-)
-AC_DEFINE_UNQUOTED(SSH_PRIVSEP_USER, "$SSH_PRIVSEP_USER")
-AC_SUBST(SSH_PRIVSEP_USER)
-
-# We do this little dance with the search path to insure
-# that programs that we select for use by installed programs
-# (which may be run by the super-user) come from trusted
-# locations before they come from the user's private area.
-# This should help avoid accidentally configuring some
-# random version of a program in someone's personal bin.
-
-OPATH=$PATH
-PATH=/bin:/usr/bin
-test -h /bin 2> /dev/null && PATH=/usr/bin
-test -d /sbin && PATH=$PATH:/sbin
-test -d /usr/sbin && PATH=$PATH:/usr/sbin
-PATH=$PATH:/etc:$OPATH
-
-# These programs are used by the command hashing source to gather entropy 
-OSSH_PATH_ENTROPY_PROG(PROG_LS, ls)
-OSSH_PATH_ENTROPY_PROG(PROG_NETSTAT, netstat)
-OSSH_PATH_ENTROPY_PROG(PROG_ARP, arp)
-OSSH_PATH_ENTROPY_PROG(PROG_IFCONFIG, ifconfig)
-OSSH_PATH_ENTROPY_PROG(PROG_JSTAT, jstat)
-OSSH_PATH_ENTROPY_PROG(PROG_PS, ps)
-OSSH_PATH_ENTROPY_PROG(PROG_SAR, sar)
-OSSH_PATH_ENTROPY_PROG(PROG_W, w)
-OSSH_PATH_ENTROPY_PROG(PROG_WHO, who)
-OSSH_PATH_ENTROPY_PROG(PROG_LAST, last)
-OSSH_PATH_ENTROPY_PROG(PROG_LASTLOG, lastlog)
-OSSH_PATH_ENTROPY_PROG(PROG_DF, df)
-OSSH_PATH_ENTROPY_PROG(PROG_VMSTAT, vmstat)
-OSSH_PATH_ENTROPY_PROG(PROG_UPTIME, uptime)
-OSSH_PATH_ENTROPY_PROG(PROG_IPCS, ipcs)
-OSSH_PATH_ENTROPY_PROG(PROG_TAIL, tail)
-# restore PATH
-PATH=$OPATH
-
-# Where does ssh-rand-helper get its randomness from?
-INSTALL_SSH_PRNG_CMDS=""
-if test ! -z "$INSTALL_SSH_RAND_HELPER" ; then
-	if test ! -z "$PRNGD_PORT" ; then
-		RAND_HELPER_MSG="TCP localhost:$PRNGD_PORT"
-	elif test ! -z "$PRNGD_SOCKET" ; then
-		RAND_HELPER_MSG="Unix domain socket \"$PRNGD_SOCKET\""
-	else
-		RAND_HELPER_MSG="Command hashing (timeout $entropy_timeout)"
-		RAND_HELPER_CMDHASH=yes
-		INSTALL_SSH_PRNG_CMDS="yes"
-	fi
-fi
-AC_SUBST(INSTALL_SSH_PRNG_CMDS)
-
-
-# Cheap hack to ensure NEWS-OS libraries are arranged right.
-if test ! -z "$SONY" ; then
-  LIBS="$LIBS -liberty";
-fi
-
-# Checks for data types
-AC_CHECK_SIZEOF(char, 1)
-AC_CHECK_SIZEOF(short int, 2)
-AC_CHECK_SIZEOF(int, 4)
-AC_CHECK_SIZEOF(long int, 4)
-AC_CHECK_SIZEOF(long long int, 8)
-
-# Sanity check long long for some platforms (AIX)
-if test "x$ac_cv_sizeof_long_long_int" = "x4" ; then
-	ac_cv_sizeof_long_long_int=0
-fi
-
-# More checks for data types
-AC_CACHE_CHECK([for u_int type], ac_cv_have_u_int, [
-	AC_TRY_COMPILE(
-		[ #include <sys/types.h> ], 
-		[ u_int a; a = 1;], 
-		[ ac_cv_have_u_int="yes" ],
-		[ ac_cv_have_u_int="no" ]
-	)
-])
-if test "x$ac_cv_have_u_int" = "xyes" ; then
-	AC_DEFINE(HAVE_U_INT)
-	have_u_int=1
-fi
-
-AC_CACHE_CHECK([for intXX_t types], ac_cv_have_intxx_t, [
-	AC_TRY_COMPILE(
-		[ #include <sys/types.h> ], 
-		[ int8_t a; int16_t b; int32_t c; a = b = c = 1;], 
-		[ ac_cv_have_intxx_t="yes" ],
-		[ ac_cv_have_intxx_t="no" ]
-	)
-])
-if test "x$ac_cv_have_intxx_t" = "xyes" ; then
-	AC_DEFINE(HAVE_INTXX_T)
-	have_intxx_t=1
-fi
-
-if (test -z "$have_intxx_t" && \
-           test "x$ac_cv_header_stdint_h" = "xyes")
-then
-    AC_MSG_CHECKING([for intXX_t types in stdint.h])
-	AC_TRY_COMPILE(
-		[ #include <stdint.h> ], 
-		[ int8_t a; int16_t b; int32_t c; a = b = c = 1;], 
-		[
-			AC_DEFINE(HAVE_INTXX_T)
-			AC_MSG_RESULT(yes)
-		],
-		[ AC_MSG_RESULT(no) ]
-	)
-fi
-
-AC_CACHE_CHECK([for int64_t type], ac_cv_have_int64_t, [
-	AC_TRY_COMPILE(
-		[
-#include <sys/types.h>
-#ifdef HAVE_STDINT_H
-# include <stdint.h>
-#endif
-#include <sys/socket.h>
-#ifdef HAVE_SYS_BITYPES_H
-# include <sys/bitypes.h>
-#endif
-		], 
-		[ int64_t a; a = 1;], 
-		[ ac_cv_have_int64_t="yes" ],
-		[ ac_cv_have_int64_t="no" ]
-	)
-])
-if test "x$ac_cv_have_int64_t" = "xyes" ; then
-	AC_DEFINE(HAVE_INT64_T)
-fi
-
-AC_CACHE_CHECK([for u_intXX_t types], ac_cv_have_u_intxx_t, [
-	AC_TRY_COMPILE(
-		[ #include <sys/types.h> ], 
-		[ u_int8_t a; u_int16_t b; u_int32_t c; a = b = c = 1;], 
-		[ ac_cv_have_u_intxx_t="yes" ],
-		[ ac_cv_have_u_intxx_t="no" ]
-	)
-])
-if test "x$ac_cv_have_u_intxx_t" = "xyes" ; then
-	AC_DEFINE(HAVE_U_INTXX_T)
-	have_u_intxx_t=1
-fi
-
-if test -z "$have_u_intxx_t" ; then
-    AC_MSG_CHECKING([for u_intXX_t types in sys/socket.h])
-	AC_TRY_COMPILE(
-		[ #include <sys/socket.h> ], 
-		[ u_int8_t a; u_int16_t b; u_int32_t c; a = b = c = 1;], 
-		[
-			AC_DEFINE(HAVE_U_INTXX_T)
-			AC_MSG_RESULT(yes)
-		],
-		[ AC_MSG_RESULT(no) ]
-	)
-fi
-
-AC_CACHE_CHECK([for u_int64_t types], ac_cv_have_u_int64_t, [
-	AC_TRY_COMPILE(
-		[ #include <sys/types.h> ], 
-		[ u_int64_t a; a = 1;], 
-		[ ac_cv_have_u_int64_t="yes" ],
-		[ ac_cv_have_u_int64_t="no" ]
-	)
-])
-if test "x$ac_cv_have_u_int64_t" = "xyes" ; then
-	AC_DEFINE(HAVE_U_INT64_T)
-	have_u_int64_t=1
-fi
-
-if test -z "$have_u_int64_t" ; then
-    AC_MSG_CHECKING([for u_int64_t type in sys/bitypes.h])
-	AC_TRY_COMPILE(
-		[ #include <sys/bitypes.h> ], 
-		[ u_int64_t a; a = 1],
-		[
-			AC_DEFINE(HAVE_U_INT64_T)
-			AC_MSG_RESULT(yes)
-		],
-		[ AC_MSG_RESULT(no) ]
-	)
-fi
-
-if test -z "$have_u_intxx_t" ; then
-	AC_CACHE_CHECK([for uintXX_t types], ac_cv_have_uintxx_t, [
-		AC_TRY_COMPILE(
-			[
-#include <sys/types.h>
-			], 
-			[ uint8_t a; uint16_t b; uint32_t c; a = b = c = 1; ], 
-			[ ac_cv_have_uintxx_t="yes" ],
-			[ ac_cv_have_uintxx_t="no" ]
-		)
-	])
-	if test "x$ac_cv_have_uintxx_t" = "xyes" ; then
-		AC_DEFINE(HAVE_UINTXX_T)
-	fi
-fi
-
-if test -z "$have_uintxx_t" ; then
-    AC_MSG_CHECKING([for uintXX_t types in stdint.h])
-	AC_TRY_COMPILE(
-		[ #include <stdint.h> ], 
-		[ uint8_t a; uint16_t b; uint32_t c; a = b = c = 1;], 
-		[
-			AC_DEFINE(HAVE_UINTXX_T)
-			AC_MSG_RESULT(yes)
-		],
-		[ AC_MSG_RESULT(no) ]
-	)
-fi
-
-if (test -z "$have_u_intxx_t" || test -z "$have_intxx_t" && \
-           test "x$ac_cv_header_sys_bitypes_h" = "xyes")
-then
-	AC_MSG_CHECKING([for intXX_t and u_intXX_t types in sys/bitypes.h])
-	AC_TRY_COMPILE(
-		[
-#include <sys/bitypes.h>
-		], 
-		[
-			int8_t a; int16_t b; int32_t c;
-			u_int8_t e; u_int16_t f; u_int32_t g;
-			a = b = c = e = f = g = 1;
-		], 
-		[
-			AC_DEFINE(HAVE_U_INTXX_T)
-			AC_DEFINE(HAVE_INTXX_T)
-			AC_MSG_RESULT(yes)
-		],
-		[AC_MSG_RESULT(no)]
-	) 
-fi
-
-
-AC_CACHE_CHECK([for u_char], ac_cv_have_u_char, [
-	AC_TRY_COMPILE(
-		[
-#include <sys/types.h>
-		],
-		[ u_char foo; foo = 125; ],
-		[ ac_cv_have_u_char="yes" ],
-		[ ac_cv_have_u_char="no" ]
-	)
-])
-if test "x$ac_cv_have_u_char" = "xyes" ; then
-	AC_DEFINE(HAVE_U_CHAR)
-fi
-
-TYPE_SOCKLEN_T
-
-AC_CHECK_TYPES(sig_atomic_t,,,[#include <signal.h>])
-
-AC_CACHE_CHECK([for size_t], ac_cv_have_size_t, [
-	AC_TRY_COMPILE(
-		[
-#include <sys/types.h>
-		],
-		[ size_t foo; foo = 1235; ],
-		[ ac_cv_have_size_t="yes" ],
-		[ ac_cv_have_size_t="no" ]
-	)
-])
-if test "x$ac_cv_have_size_t" = "xyes" ; then
-	AC_DEFINE(HAVE_SIZE_T)
-fi
-
-AC_CACHE_CHECK([for ssize_t], ac_cv_have_ssize_t, [
-	AC_TRY_COMPILE(
-		[
-#include <sys/types.h>
-		],
-		[ ssize_t foo; foo = 1235; ],
-		[ ac_cv_have_ssize_t="yes" ],
-		[ ac_cv_have_ssize_t="no" ]
-	)
-])
-if test "x$ac_cv_have_ssize_t" = "xyes" ; then
-	AC_DEFINE(HAVE_SSIZE_T)
-fi
-
-AC_CACHE_CHECK([for clock_t], ac_cv_have_clock_t, [
-	AC_TRY_COMPILE(
-		[
-#include <time.h>
-		],
-		[ clock_t foo; foo = 1235; ],
-		[ ac_cv_have_clock_t="yes" ],
-		[ ac_cv_have_clock_t="no" ]
-	)
-])
-if test "x$ac_cv_have_clock_t" = "xyes" ; then
-	AC_DEFINE(HAVE_CLOCK_T)
-fi
-
-AC_CACHE_CHECK([for sa_family_t], ac_cv_have_sa_family_t, [
-	AC_TRY_COMPILE(
-		[
-#include <sys/types.h>
-#include <sys/socket.h>
-		],
-		[ sa_family_t foo; foo = 1235; ],
-		[ ac_cv_have_sa_family_t="yes" ],
-		[ AC_TRY_COMPILE(
-		  [
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <netinet/in.h>
-		],
-		[ sa_family_t foo; foo = 1235; ],
-		[ ac_cv_have_sa_family_t="yes" ],
-
-		[ ac_cv_have_sa_family_t="no" ]
-	)]
-	)
-])
-if test "x$ac_cv_have_sa_family_t" = "xyes" ; then
-	AC_DEFINE(HAVE_SA_FAMILY_T)
-fi
-
-AC_CACHE_CHECK([for pid_t], ac_cv_have_pid_t, [
-	AC_TRY_COMPILE(
-		[
-#include <sys/types.h>
-		],
-		[ pid_t foo; foo = 1235; ],
-		[ ac_cv_have_pid_t="yes" ],
-		[ ac_cv_have_pid_t="no" ]
-	)
-])
-if test "x$ac_cv_have_pid_t" = "xyes" ; then
-	AC_DEFINE(HAVE_PID_T)
-fi
-
-AC_CACHE_CHECK([for mode_t], ac_cv_have_mode_t, [
-	AC_TRY_COMPILE(
-		[
-#include <sys/types.h>
-		],
-		[ mode_t foo; foo = 1235; ],
-		[ ac_cv_have_mode_t="yes" ],
-		[ ac_cv_have_mode_t="no" ]
-	)
-])
-if test "x$ac_cv_have_mode_t" = "xyes" ; then
-	AC_DEFINE(HAVE_MODE_T)
-fi
-
-
-AC_CACHE_CHECK([for struct sockaddr_storage], ac_cv_have_struct_sockaddr_storage, [
-	AC_TRY_COMPILE(
-		[
-#include <sys/types.h>
-#include <sys/socket.h>
-		],
-		[ struct sockaddr_storage s; ],
-		[ ac_cv_have_struct_sockaddr_storage="yes" ],
-		[ ac_cv_have_struct_sockaddr_storage="no" ]
-	)
-])
-if test "x$ac_cv_have_struct_sockaddr_storage" = "xyes" ; then
-	AC_DEFINE(HAVE_STRUCT_SOCKADDR_STORAGE)
-fi
-
-AC_CACHE_CHECK([for struct sockaddr_in6], ac_cv_have_struct_sockaddr_in6, [
-	AC_TRY_COMPILE(
-		[
-#include <sys/types.h>
-#include <netinet/in.h>
-		],
-		[ struct sockaddr_in6 s; s.sin6_family = 0; ],
-		[ ac_cv_have_struct_sockaddr_in6="yes" ],
-		[ ac_cv_have_struct_sockaddr_in6="no" ]
-	)
-])
-if test "x$ac_cv_have_struct_sockaddr_in6" = "xyes" ; then
-	AC_DEFINE(HAVE_STRUCT_SOCKADDR_IN6)
-fi
-
-AC_CACHE_CHECK([for struct in6_addr], ac_cv_have_struct_in6_addr, [
-	AC_TRY_COMPILE(
-		[
-#include <sys/types.h>
-#include <netinet/in.h>
-		],
-		[ struct in6_addr s; s.s6_addr[0] = 0; ],
-		[ ac_cv_have_struct_in6_addr="yes" ],
-		[ ac_cv_have_struct_in6_addr="no" ]
-	)
-])
-if test "x$ac_cv_have_struct_in6_addr" = "xyes" ; then
-	AC_DEFINE(HAVE_STRUCT_IN6_ADDR)
-fi
-
-AC_CACHE_CHECK([for struct addrinfo], ac_cv_have_struct_addrinfo, [
-	AC_TRY_COMPILE(
-		[
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <netdb.h>
-		],
-		[ struct addrinfo s; s.ai_flags = AI_PASSIVE; ],
-		[ ac_cv_have_struct_addrinfo="yes" ],
-		[ ac_cv_have_struct_addrinfo="no" ]
-	)
-])
-if test "x$ac_cv_have_struct_addrinfo" = "xyes" ; then
-	AC_DEFINE(HAVE_STRUCT_ADDRINFO)
-fi
-
-AC_CACHE_CHECK([for struct timeval], ac_cv_have_struct_timeval, [
-	AC_TRY_COMPILE(
-		[ #include <sys/time.h> ], 
-		[ struct timeval tv; tv.tv_sec = 1;], 
-		[ ac_cv_have_struct_timeval="yes" ],
-		[ ac_cv_have_struct_timeval="no" ]
-	)
-])
-if test "x$ac_cv_have_struct_timeval" = "xyes" ; then
-	AC_DEFINE(HAVE_STRUCT_TIMEVAL)
-	have_struct_timeval=1
-fi
-
-AC_CHECK_TYPES(struct timespec)
-
-# We need int64_t or else certian parts of the compile will fail.
-if test "x$ac_cv_have_int64_t" = "xno" -a \
-	"x$ac_cv_sizeof_long_int" != "x8" -a \
-	"x$ac_cv_sizeof_long_long_int" = "x0" ; then
-	echo "OpenSSH requires int64_t support.  Contact your vendor or install"
-	echo "an alternative compiler (I.E., GCC) before continuing."
-	echo ""
-	exit 1;
-else
-dnl test snprintf (broken on SCO w/gcc)
-	AC_TRY_RUN(
-		[
-#include <stdio.h>
-#include <string.h>
-#ifdef HAVE_SNPRINTF
-main()
-{
-	char buf[50];
-	char expected_out[50];
-	int mazsize = 50 ;
-#if (SIZEOF_LONG_INT == 8)
-	long int num = 0x7fffffffffffffff;
-#else
-	long long num = 0x7fffffffffffffffll;
-#endif
-	strcpy(expected_out, "9223372036854775807");
-	snprintf(buf, mazsize, "%lld", num);
-	if(strcmp(buf, expected_out) != 0)
-        	exit(1);
-	exit(0);
-}
-#else
-main() { exit(0); }
-#endif
-		], [ true ], [ AC_DEFINE(BROKEN_SNPRINTF) ]
-	)
-fi
-
-dnl Checks for structure members
-OSSH_CHECK_HEADER_FOR_FIELD(ut_host, utmp.h, HAVE_HOST_IN_UTMP)
-OSSH_CHECK_HEADER_FOR_FIELD(ut_host, utmpx.h, HAVE_HOST_IN_UTMPX)
-OSSH_CHECK_HEADER_FOR_FIELD(syslen, utmpx.h, HAVE_SYSLEN_IN_UTMPX)
-OSSH_CHECK_HEADER_FOR_FIELD(ut_pid, utmp.h, HAVE_PID_IN_UTMP)
-OSSH_CHECK_HEADER_FOR_FIELD(ut_type, utmp.h, HAVE_TYPE_IN_UTMP)
-OSSH_CHECK_HEADER_FOR_FIELD(ut_type, utmpx.h, HAVE_TYPE_IN_UTMPX)
-OSSH_CHECK_HEADER_FOR_FIELD(ut_tv, utmp.h, HAVE_TV_IN_UTMP)
-OSSH_CHECK_HEADER_FOR_FIELD(ut_id, utmp.h, HAVE_ID_IN_UTMP)
-OSSH_CHECK_HEADER_FOR_FIELD(ut_id, utmpx.h, HAVE_ID_IN_UTMPX)
-OSSH_CHECK_HEADER_FOR_FIELD(ut_addr, utmp.h, HAVE_ADDR_IN_UTMP)
-OSSH_CHECK_HEADER_FOR_FIELD(ut_addr, utmpx.h, HAVE_ADDR_IN_UTMPX)
-OSSH_CHECK_HEADER_FOR_FIELD(ut_addr_v6, utmp.h, HAVE_ADDR_V6_IN_UTMP)
-OSSH_CHECK_HEADER_FOR_FIELD(ut_addr_v6, utmpx.h, HAVE_ADDR_V6_IN_UTMPX)
-OSSH_CHECK_HEADER_FOR_FIELD(ut_exit, utmp.h, HAVE_EXIT_IN_UTMP)
-OSSH_CHECK_HEADER_FOR_FIELD(ut_time, utmp.h, HAVE_TIME_IN_UTMP)
-OSSH_CHECK_HEADER_FOR_FIELD(ut_time, utmpx.h, HAVE_TIME_IN_UTMPX)
-OSSH_CHECK_HEADER_FOR_FIELD(ut_tv, utmpx.h, HAVE_TV_IN_UTMPX)
-
-AC_CHECK_MEMBERS([struct stat.st_blksize])
-
-AC_CACHE_CHECK([for ss_family field in struct sockaddr_storage],
-		ac_cv_have_ss_family_in_struct_ss, [
-	AC_TRY_COMPILE(
-		[
-#include <sys/types.h>
-#include <sys/socket.h>
-		],
-		[ struct sockaddr_storage s; s.ss_family = 1; ],
-		[ ac_cv_have_ss_family_in_struct_ss="yes" ],
-		[ ac_cv_have_ss_family_in_struct_ss="no" ],
-	)
-])
-if test "x$ac_cv_have_ss_family_in_struct_ss" = "xyes" ; then
-	AC_DEFINE(HAVE_SS_FAMILY_IN_SS)
-fi
-
-AC_CACHE_CHECK([for __ss_family field in struct sockaddr_storage],
-		ac_cv_have___ss_family_in_struct_ss, [
-	AC_TRY_COMPILE(
-		[
-#include <sys/types.h>
-#include <sys/socket.h>
-		],
-		[ struct sockaddr_storage s; s.__ss_family = 1; ],
-		[ ac_cv_have___ss_family_in_struct_ss="yes" ],
-		[ ac_cv_have___ss_family_in_struct_ss="no" ]
-	)
-])
-if test "x$ac_cv_have___ss_family_in_struct_ss" = "xyes" ; then
-	AC_DEFINE(HAVE___SS_FAMILY_IN_SS)
-fi
-
-AC_CACHE_CHECK([for pw_class field in struct passwd],
-		ac_cv_have_pw_class_in_struct_passwd, [
-	AC_TRY_COMPILE(
-		[
-#include <pwd.h>
-		],
-		[ struct passwd p; p.pw_class = 0; ],
-		[ ac_cv_have_pw_class_in_struct_passwd="yes" ],
-		[ ac_cv_have_pw_class_in_struct_passwd="no" ]
-	)
-])
-if test "x$ac_cv_have_pw_class_in_struct_passwd" = "xyes" ; then
-	AC_DEFINE(HAVE_PW_CLASS_IN_PASSWD)
-fi
-
-AC_CACHE_CHECK([for pw_expire field in struct passwd],
-		ac_cv_have_pw_expire_in_struct_passwd, [
-	AC_TRY_COMPILE(
-		[
-#include <pwd.h>
-		],
-		[ struct passwd p; p.pw_expire = 0; ],
-		[ ac_cv_have_pw_expire_in_struct_passwd="yes" ],
-		[ ac_cv_have_pw_expire_in_struct_passwd="no" ]
-	)
-])
-if test "x$ac_cv_have_pw_expire_in_struct_passwd" = "xyes" ; then
-	AC_DEFINE(HAVE_PW_EXPIRE_IN_PASSWD)
-fi
-
-AC_CACHE_CHECK([for pw_change field in struct passwd],
-		ac_cv_have_pw_change_in_struct_passwd, [
-	AC_TRY_COMPILE(
-		[
-#include <pwd.h>
-		],
-		[ struct passwd p; p.pw_change = 0; ],
-		[ ac_cv_have_pw_change_in_struct_passwd="yes" ],
-		[ ac_cv_have_pw_change_in_struct_passwd="no" ]
-	)
-])
-if test "x$ac_cv_have_pw_change_in_struct_passwd" = "xyes" ; then
-	AC_DEFINE(HAVE_PW_CHANGE_IN_PASSWD)
-fi
-
-dnl make sure we're using the real structure members and not defines
-AC_CACHE_CHECK([for msg_accrights field in struct msghdr],
-		ac_cv_have_accrights_in_msghdr, [
-	AC_TRY_RUN(
-		[
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <sys/uio.h>
-int main() {
-#ifdef msg_accrights
-exit(1);
-#endif
-struct msghdr m;
-m.msg_accrights = 0;
-exit(0);
-}
-		],
-		[ ac_cv_have_accrights_in_msghdr="yes" ],
-		[ ac_cv_have_accrights_in_msghdr="no" ]
-	)
-])
-if test "x$ac_cv_have_accrights_in_msghdr" = "xyes" ; then
-	AC_DEFINE(HAVE_ACCRIGHTS_IN_MSGHDR)
-fi
-
-AC_CACHE_CHECK([for msg_control field in struct msghdr],
-		ac_cv_have_control_in_msghdr, [
-	AC_TRY_RUN(
-		[
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <sys/uio.h>
-int main() {
-#ifdef msg_control
-exit(1);
-#endif
-struct msghdr m;
-m.msg_control = 0;
-exit(0);
-}
-		],
-		[ ac_cv_have_control_in_msghdr="yes" ],
-		[ ac_cv_have_control_in_msghdr="no" ]
-	)
-])
-if test "x$ac_cv_have_control_in_msghdr" = "xyes" ; then
-	AC_DEFINE(HAVE_CONTROL_IN_MSGHDR)
-fi
-
-AC_CACHE_CHECK([if libc defines __progname], ac_cv_libc_defines___progname, [
-	AC_TRY_LINK([], 
-		[ extern char *__progname; printf("%s", __progname); ], 
-		[ ac_cv_libc_defines___progname="yes" ],
-		[ ac_cv_libc_defines___progname="no" ]
-	)
-])
-if test "x$ac_cv_libc_defines___progname" = "xyes" ; then
-	AC_DEFINE(HAVE___PROGNAME)
-fi
-
-AC_CACHE_CHECK([whether $CC implements __FUNCTION__], ac_cv_cc_implements___FUNCTION__, [
-	AC_TRY_LINK([
-#include <stdio.h>
-], 
-		[ printf("%s", __FUNCTION__); ], 
-		[ ac_cv_cc_implements___FUNCTION__="yes" ],
-		[ ac_cv_cc_implements___FUNCTION__="no" ]
-	)
-])
-if test "x$ac_cv_cc_implements___FUNCTION__" = "xyes" ; then
-	AC_DEFINE(HAVE___FUNCTION__)
-fi
-
-AC_CACHE_CHECK([whether $CC implements __func__], ac_cv_cc_implements___func__, [
-	AC_TRY_LINK([
-#include <stdio.h>
-], 
-		[ printf("%s", __func__); ], 
-		[ ac_cv_cc_implements___func__="yes" ],
-		[ ac_cv_cc_implements___func__="no" ]
-	)
-])
-if test "x$ac_cv_cc_implements___func__" = "xyes" ; then
-	AC_DEFINE(HAVE___func__)
-fi
-
-AC_CACHE_CHECK([whether getopt has optreset support],
-		ac_cv_have_getopt_optreset, [
-	AC_TRY_LINK(
-		[
-#include <getopt.h>
-		],
-		[ extern int optreset; optreset = 0; ],
-		[ ac_cv_have_getopt_optreset="yes" ],
-		[ ac_cv_have_getopt_optreset="no" ]
-	)
-])
-if test "x$ac_cv_have_getopt_optreset" = "xyes" ; then
-	AC_DEFINE(HAVE_GETOPT_OPTRESET)
-fi
-
-AC_CACHE_CHECK([if libc defines sys_errlist], ac_cv_libc_defines_sys_errlist, [
-	AC_TRY_LINK([], 
-		[ extern const char *const sys_errlist[]; printf("%s", sys_errlist[0]);], 
-		[ ac_cv_libc_defines_sys_errlist="yes" ],
-		[ ac_cv_libc_defines_sys_errlist="no" ]
-	)
-])
-if test "x$ac_cv_libc_defines_sys_errlist" = "xyes" ; then
-	AC_DEFINE(HAVE_SYS_ERRLIST)
-fi
-
-
-AC_CACHE_CHECK([if libc defines sys_nerr], ac_cv_libc_defines_sys_nerr, [
-	AC_TRY_LINK([], 
-		[ extern int sys_nerr; printf("%i", sys_nerr);], 
-		[ ac_cv_libc_defines_sys_nerr="yes" ],
-		[ ac_cv_libc_defines_sys_nerr="no" ]
-	)
-])
-if test "x$ac_cv_libc_defines_sys_nerr" = "xyes" ; then
-	AC_DEFINE(HAVE_SYS_NERR)
-fi
-
-SCARD_MSG="no" 
-
-# Check whether user wants sectok support
-AC_ARG_WITH(sectok,
-	[  --with-sectok           Enable smartcard support using libsectok],
-	[
-		if test "x$withval" != "xno" ; then
-			if test "x$withval" != "xyes" ; then
-				CPPFLAGS="$CPPFLAGS -I${withval}"
-				LDFLAGS="$LDFLAGS -L${withval}"
-				if test ! -z "$need_dash_r" ; then
-					LDFLAGS="$LDFLAGS -R${withval}"
-				fi
-				if test ! -z "$blibpath" ; then
-					blibpath="$blibpath:${withval}"
-				fi
-			fi
-			AC_CHECK_HEADERS(sectok.h)
-			if test "$ac_cv_header_sectok_h" != yes; then
-				AC_MSG_ERROR(Can't find sectok.h)
-			fi
-			AC_CHECK_LIB(sectok, sectok_open)
-			if test "$ac_cv_lib_sectok_sectok_open" != yes; then
-				AC_MSG_ERROR(Can't find libsectok)
-			fi
-			AC_DEFINE(SMARTCARD)
-			AC_DEFINE(USE_SECTOK)
-			SCARD_MSG="yes, using sectok" 
-		fi
-	]
-)
-
-# Check whether user wants OpenSC support
-AC_ARG_WITH(opensc,
-	AC_HELP_STRING([--with-opensc=PFX],
-		       [Enable smartcard support using OpenSC]),
-	opensc_config_prefix="$withval", opensc_config_prefix="")
-if test x$opensc_config_prefix != x ; then
-  OPENSC_CONFIG=$opensc_config_prefix/bin/opensc-config
-  AC_PATH_PROG(OPENSC_CONFIG, opensc-config, no)
-  if test "$OPENSC_CONFIG" != "no"; then
-    LIBOPENSC_CFLAGS=`$OPENSC_CONFIG --cflags`
-    LIBOPENSC_LIBS=`$OPENSC_CONFIG --libs`
-    CPPFLAGS="$CPPFLAGS $LIBOPENSC_CFLAGS"
-    LDFLAGS="$LDFLAGS $LIBOPENSC_LIBS"
-    AC_DEFINE(SMARTCARD)
-    AC_DEFINE(USE_OPENSC)
-    SCARD_MSG="yes, using OpenSC" 
-  fi
-fi
-
-# Check whether user wants Kerberos 5 support
-KRB5_MSG="no" 
-AC_ARG_WITH(kerberos5,
-        [  --with-kerberos5=PATH   Enable Kerberos 5 support],
-        [
-                if test "x$withval" != "xno" ; then
-                        if test "x$withval" = "xyes" ; then
-                                KRB5ROOT="/usr/local"
-                        else
-                                KRB5ROOT=${withval}
-                        fi
-			CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include"
-                        LDFLAGS="$LDFLAGS -L${KRB5ROOT}/lib"
-                        AC_DEFINE(KRB5)
-			KRB5_MSG="yes"
-                        AC_MSG_CHECKING(whether we are using Heimdal)
-                        AC_TRY_COMPILE([ #include <krb5.h> ],
-                                       [ char *tmp = heimdal_version; ],
-                                       [ AC_MSG_RESULT(yes)
-                                         AC_DEFINE(HEIMDAL)
-                                         K5LIBS="-lkrb5 -ldes -lcom_err -lasn1 -lroken"
-                                       ],
-                                       [ AC_MSG_RESULT(no)
-                                         K5LIBS="-lkrb5 -lk5crypto -lcom_err"
-                                       ]
-                        )
-                        if test ! -z "$need_dash_r" ; then
-                                LDFLAGS="$LDFLAGS -R${KRB5ROOT}/lib"
-                        fi
-                        if test ! -z "$blibpath" ; then
-                                blibpath="$blibpath:${KRB5ROOT}/lib"
-                        fi
-                        AC_CHECK_LIB(resolv, dn_expand, , )
-
-                        KRB5=yes
-                fi
-        ]
-)
-# Check whether user wants Kerberos 4 support
-KRB4_MSG="no" 
-AC_ARG_WITH(kerberos4,
-	[  --with-kerberos4=PATH   Enable Kerberos 4 support],
-	[
-		if test "x$withval" != "xno" ; then
-			if test "x$withval" != "xyes" ; then
-				CPPFLAGS="$CPPFLAGS -I${withval}/include"
-				LDFLAGS="$LDFLAGS -L${withval}/lib"
-				if test ! -z "$need_dash_r" ; then
-					LDFLAGS="$LDFLAGS -R${withval}/lib"
-				fi
-				if test ! -z "$blibpath" ; then
-					blibpath="$blibpath:${withval}/lib"
-				fi
-			else
-				if test -d /usr/include/kerberosIV ; then
-					CPPFLAGS="$CPPFLAGS -I/usr/include/kerberosIV"
-				fi
-			fi
-
-			AC_CHECK_HEADERS(krb.h)
-			if test "$ac_cv_header_krb_h" != yes; then
-				AC_MSG_WARN([Cannot find krb.h, build may fail])
-			fi
-			AC_CHECK_LIB(krb, main)
-			if test "$ac_cv_lib_krb_main" != yes; then
-				AC_CHECK_LIB(krb4, main)
-				if test "$ac_cv_lib_krb4_main" != yes; then
-					AC_MSG_WARN([Cannot find libkrb nor libkrb4, build may fail])
-				else
-					KLIBS="-lkrb4"
-				fi
-			else
-				KLIBS="-lkrb"
-			fi
-			AC_CHECK_LIB(des, des_cbc_encrypt)
-			if test "$ac_cv_lib_des_des_cbc_encrypt" != yes; then
-				AC_CHECK_LIB(des425, des_cbc_encrypt)
-				if test "$ac_cv_lib_des425_des_cbc_encrypt" != yes; then
-					AC_MSG_WARN([Cannot find libdes nor libdes425, build may fail])
-				else
-					KLIBS="-ldes425"
-				fi
-			else
-				KLIBS="-ldes"
-			fi
-			AC_CHECK_LIB(resolv, dn_expand, , )
-			KRB4=yes
-			KRB4_MSG="yes" 
-			AC_DEFINE(KRB4)
-		fi
-	]
-)
-
-# Check whether user wants AFS support
-AFS_MSG="no" 
-AC_ARG_WITH(afs,
-	[  --with-afs=PATH         Enable AFS support],
-	[
-		if test "x$withval" != "xno" ; then
-
-			if test "x$withval" != "xyes" ; then
-				CPPFLAGS="$CPPFLAGS -I${withval}/include"
-				LDFLAGS="$LDFLAGS -L${withval}/lib"
-			fi
-
-			if test -z "$KRB4" ; then
-				AC_MSG_WARN([AFS requires Kerberos IV support, build may fail])
-			fi
-
-			LIBS="-lkafs $LIBS"
-			if test ! -z "$AFS_LIBS" ; then
-				LIBS="$LIBS $AFS_LIBS"
-			fi
-			AC_DEFINE(AFS)
-			AFS_MSG="yes" 
-		fi
-	]
-)
-LIBS="$LIBS $KLIBS $K5LIBS"
-
-# Looking for programs, paths and files
-
-PRIVSEP_PATH=/var/empty
-AC_ARG_WITH(privsep-path,
-	[  --with-privsep-path=xxx Path for privilege separation chroot (default=/var/empty)],
-	[
-		if test "x$withval" != "$no" ; then
-			PRIVSEP_PATH=$withval
-		fi
-	]
-)
-AC_SUBST(PRIVSEP_PATH)
-
-AC_ARG_WITH(xauth,
-	[  --with-xauth=PATH       Specify path to xauth program ],
-	[
-		if test "x$withval" != "xno" ; then
-			xauth_path=$withval
-		fi
-	],
-	[
-		TestPath="$PATH"
-		TestPath="${TestPath}${PATH_SEPARATOR}/usr/X/bin"
-		TestPath="${TestPath}${PATH_SEPARATOR}/usr/bin/X11"
-		TestPath="${TestPath}${PATH_SEPARATOR}/usr/X11R6/bin"
-		TestPath="${TestPath}${PATH_SEPARATOR}/usr/openwin/bin"
-		AC_PATH_PROG(xauth_path, xauth, , $TestPath)
-		if (test ! -z "$xauth_path" && test -x "/usr/openwin/bin/xauth") ; then
-			xauth_path="/usr/openwin/bin/xauth"
-		fi
-	]
-)
-
-STRIP_OPT=-s
-AC_ARG_ENABLE(strip,
-	[  --disable-strip         Disable calling strip(1) on install],
-	[
-		if test "x$enableval" = "xno" ; then
-			STRIP_OPT=
-		fi
-	]
-)
-AC_SUBST(STRIP_OPT)
-
-if test -z "$xauth_path" ; then
-	XAUTH_PATH="undefined"
-	AC_SUBST(XAUTH_PATH)
-else
-	AC_DEFINE_UNQUOTED(XAUTH_PATH, "$xauth_path")
-	XAUTH_PATH=$xauth_path
-	AC_SUBST(XAUTH_PATH)
-fi
-
-# Check for mail directory (last resort if we cannot get it from headers)
-if test ! -z "$MAIL" ; then
-	maildir=`dirname $MAIL`
-	AC_DEFINE_UNQUOTED(MAIL_DIRECTORY, "$maildir")
-fi
-
-if test -z "$no_dev_ptmx" ; then
-	if test "x$disable_ptmx_check" != "xyes" ; then
-		AC_CHECK_FILE("/dev/ptmx", 
-			[
-				AC_DEFINE_UNQUOTED(HAVE_DEV_PTMX)
-				have_dev_ptmx=1
-			]
-		)
-	fi
-fi
-AC_CHECK_FILE("/dev/ptc", 
-	[
-		AC_DEFINE_UNQUOTED(HAVE_DEV_PTS_AND_PTC)
-		have_dev_ptc=1
-	]
-)
-
-# Options from here on. Some of these are preset by platform above
-AC_ARG_WITH(mantype,
-	[  --with-mantype=man|cat|doc  Set man page type],
-	[
-		case "$withval" in
-		man|cat|doc)
-			MANTYPE=$withval
-			;;
-		*)
-			AC_MSG_ERROR(invalid man type: $withval)
-			;;
-		esac
-	]
-)
-if test -z "$MANTYPE"; then
-	TestPath="/usr/bin${PATH_SEPARATOR}/usr/ucb"
-	AC_PATH_PROGS(NROFF, nroff awf, /bin/false, $TestPath)
-	if ${NROFF} -mdoc ${srcdir}/ssh.1 >/dev/null 2>&1; then
-		MANTYPE=doc
-	elif ${NROFF} -man ${srcdir}/ssh.1 >/dev/null 2>&1; then
-		MANTYPE=man
-	else
-		MANTYPE=cat
-	fi
-fi
-AC_SUBST(MANTYPE)
-if test "$MANTYPE" = "doc"; then
-	mansubdir=man;
-else
-	mansubdir=$MANTYPE;
-fi
-AC_SUBST(mansubdir)
-
-# Check whether to enable MD5 passwords
-MD5_MSG="no" 
-AC_ARG_WITH(md5-passwords,
-	[  --with-md5-passwords    Enable use of MD5 passwords],
-	[
-		if test "x$withval" != "xno" ; then
-			AC_DEFINE(HAVE_MD5_PASSWORDS)
-			MD5_MSG="yes" 
-		fi
-	]
-)
-
-# Whether to disable shadow password support
-AC_ARG_WITH(shadow,
-	[  --without-shadow        Disable shadow password support],
-	[
-		if test "x$withval" = "xno" ; then	
-			AC_DEFINE(DISABLE_SHADOW)
-			disable_shadow=yes
-		fi
-	]
-)
-
-if test -z "$disable_shadow" ; then
-	AC_MSG_CHECKING([if the systems has expire shadow information])
-	AC_TRY_COMPILE(
-	[
-#include <sys/types.h>
-#include <shadow.h>
-	struct spwd sp;
-	],[ sp.sp_expire = sp.sp_lstchg = sp.sp_inact = 0; ],
-	[ sp_expire_available=yes ], []
-	)
-
-	if test "x$sp_expire_available" = "xyes" ; then
-		AC_MSG_RESULT(yes)
-		AC_DEFINE(HAS_SHADOW_EXPIRE)
-	else
-		AC_MSG_RESULT(no)
-	fi
-fi
-
-# Use ip address instead of hostname in $DISPLAY
-if test ! -z "$IPADDR_IN_DISPLAY" ; then
-	DISPLAY_HACK_MSG="yes"
-	AC_DEFINE(IPADDR_IN_DISPLAY)
-else
-	DISPLAY_HACK_MSG="no" 
-	AC_ARG_WITH(ipaddr-display,
-		[  --with-ipaddr-display   Use ip address instead of hostname in \$DISPLAY],
-		[
-			if test "x$withval" != "xno" ; then	
-				AC_DEFINE(IPADDR_IN_DISPLAY)
-				DISPLAY_HACK_MSG="yes" 
-			fi
-		]
-	)
-fi
-
-dnl BSD systems use /etc/login.conf so --with-default-path= has no effect
-if test $ac_cv_func_login_getcapbool = "yes" -a \
-	$ac_cv_header_login_cap_h = "yes" ; then
-	USES_LOGIN_CONF=yes
-fi
-# Whether to mess with the default path
-SERVER_PATH_MSG="(default)" 
-AC_ARG_WITH(default-path,
-	[  --with-default-path=    Specify default \$PATH environment for server],
-	[
-		if test "$USES_LOGIN_CONF" = "yes" ; then
-			AC_MSG_WARN([
---with-default-path=PATH has no effect on this system.
-Edit /etc/login.conf instead.])
-		elif test "x$withval" != "xno" ; then	
-			user_path="$withval"
-			SERVER_PATH_MSG="$withval" 
-		fi
-	],
-	[ if test "$USES_LOGIN_CONF" = "yes" ; then
-	AC_MSG_WARN([Make sure the path to scp is in /etc/login.conf])
-	else
-	AC_TRY_RUN(
-		[
-/* find out what STDPATH is */
-#include <stdio.h>
-#ifdef HAVE_PATHS_H
-# include <paths.h>
-#endif
-#ifndef _PATH_STDPATH
-# ifdef _PATH_USERPATH	/* Irix */
-#  define _PATH_STDPATH _PATH_USERPATH
-# else
-#  define _PATH_STDPATH "/usr/bin:/bin:/usr/sbin:/sbin"
-# endif
-#endif
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <fcntl.h>
-#define DATA "conftest.stdpath"
-
-main()
-{
-	FILE *fd;
-	int rc;
-	
-	fd = fopen(DATA,"w");
-	if(fd == NULL)
-		exit(1);
-	
-	if ((rc = fprintf(fd,"%s", _PATH_STDPATH)) < 0)
-		exit(1);
-
-	exit(0);
-}
-		], [ user_path=`cat conftest.stdpath` ],
-		[ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ],
-		[ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ]
-	)
-# make sure $bindir is in USER_PATH so scp will work
-		t_bindir=`eval echo ${bindir}`
-		case $t_bindir in
-			NONE/*) t_bindir=`echo $t_bindir | sed "s~NONE~$prefix~"` ;;
-		esac
-		case $t_bindir in
-			NONE/*) t_bindir=`echo $t_bindir | sed "s~NONE~$ac_default_prefix~"` ;;
-		esac
-		echo $user_path | grep ":$t_bindir"  > /dev/null 2>&1
-		if test $? -ne 0  ; then
-			echo $user_path | grep "^$t_bindir"  > /dev/null 2>&1
-			if test $? -ne 0  ; then
-				user_path=$user_path:$t_bindir
-				AC_MSG_RESULT(Adding $t_bindir to USER_PATH so scp will work)
-			fi
-		fi
-	fi ]
-)
-if test "$USES_LOGIN_CONF" != "yes" ; then
-	AC_DEFINE_UNQUOTED(USER_PATH, "$user_path")
-	AC_SUBST(user_path)
-fi
-
-# Set superuser path separately to user path
-AC_ARG_WITH(superuser-path,
-	[  --with-superuser-path=  Specify different path for super-user],
-	[
-		if test "x$withval" != "xno" ; then
-			AC_DEFINE_UNQUOTED(SUPERUSER_PATH, "$withval")
-			superuser_path=$withval
-		fi
-	]
-)
-
-
-# Whether to force IPv4 by default (needed on broken glibc Linux)
-IPV4_HACK_MSG="no" 
-AC_ARG_WITH(ipv4-default,
-	[  --with-ipv4-default     Use IPv4 by connections unless '-6' specified],
-	[
-		if test "x$withval" != "xno" ; then	
-			AC_DEFINE(IPV4_DEFAULT)
-			IPV4_HACK_MSG="yes" 
-		fi
-	]
-)
-
-AC_MSG_CHECKING([if we need to convert IPv4 in IPv6-mapped addresses])
-IPV4_IN6_HACK_MSG="no" 
-AC_ARG_WITH(4in6,
-	[  --with-4in6             Check for and convert IPv4 in IPv6 mapped addresses],
-	[
-		if test "x$withval" != "xno" ; then
-			AC_MSG_RESULT(yes)
-			AC_DEFINE(IPV4_IN_IPV6)
-			IPV4_IN6_HACK_MSG="yes" 
-		else
-			AC_MSG_RESULT(no)
-		fi
-	],[
-		if test "x$inet6_default_4in6" = "xyes"; then
-			AC_MSG_RESULT([yes (default)])
-			AC_DEFINE(IPV4_IN_IPV6)
-			IPV4_IN6_HACK_MSG="yes" 
-		else
-			AC_MSG_RESULT([no (default)])
-		fi
-	]
-)
-
-# Whether to enable BSD auth support
-BSD_AUTH_MSG=no
-AC_ARG_WITH(bsd-auth,
-	[  --with-bsd-auth         Enable BSD auth support],
-	[
-		if test "x$withval" != "xno" ; then	
-			AC_DEFINE(BSD_AUTH)
-			BSD_AUTH_MSG=yes
-		fi
-	]
-)
-
-# Where to place sshd.pid
-piddir=/var/run
-# make sure the directory exists
-if test ! -d $piddir ; then	
-	piddir=`eval echo ${sysconfdir}`
-	case $piddir in
- 		NONE/*) piddir=`echo $piddir | sed "s~NONE~$ac_default_prefix~"` ;;
-	esac
-fi
-
-AC_ARG_WITH(pid-dir,
-	[  --with-pid-dir=PATH     Specify location of ssh.pid file],
-	[
-		if test "x$withval" != "xno" ; then	
-			piddir=$withval
-			if test ! -d $piddir ; then	
-			AC_MSG_WARN([** no $piddir directory on this system **])
-			fi
-		fi
-	]
-)
-
-AC_DEFINE_UNQUOTED(_PATH_SSH_PIDDIR, "$piddir")
-AC_SUBST(piddir)
-
-dnl allow user to disable some login recording features
-AC_ARG_ENABLE(lastlog,
-	[  --disable-lastlog       disable use of lastlog even if detected [no]],
-	[ AC_DEFINE(DISABLE_LASTLOG) ]
-)
-AC_ARG_ENABLE(utmp,
-	[  --disable-utmp          disable use of utmp even if detected [no]],
-	[ AC_DEFINE(DISABLE_UTMP) ]
-)
-AC_ARG_ENABLE(utmpx,
-	[  --disable-utmpx         disable use of utmpx even if detected [no]],
-	[ AC_DEFINE(DISABLE_UTMPX) ]
-)
-AC_ARG_ENABLE(wtmp,
-	[  --disable-wtmp          disable use of wtmp even if detected [no]],
-	[ AC_DEFINE(DISABLE_WTMP) ]
-)
-AC_ARG_ENABLE(wtmpx,
-	[  --disable-wtmpx         disable use of wtmpx even if detected [no]],
-	[ AC_DEFINE(DISABLE_WTMPX) ]
-)
-AC_ARG_ENABLE(libutil,
-	[  --disable-libutil       disable use of libutil (login() etc.) [no]],
-	[ AC_DEFINE(DISABLE_LOGIN) ]
-)
-AC_ARG_ENABLE(pututline,
-	[  --disable-pututline     disable use of pututline() etc. ([uw]tmp) [no]],
-	[ AC_DEFINE(DISABLE_PUTUTLINE) ]
-)
-AC_ARG_ENABLE(pututxline,
-	[  --disable-pututxline    disable use of pututxline() etc. ([uw]tmpx) [no]],
-	[ AC_DEFINE(DISABLE_PUTUTXLINE) ]
-)
-AC_ARG_WITH(lastlog,
-  [  --with-lastlog=FILE|DIR specify lastlog location [common locations]],
-	[
-		if test "x$withval" = "xno" ; then	
-			AC_DEFINE(DISABLE_LASTLOG)
-		else
-			conf_lastlog_location=$withval
-		fi
-	]
-)
-
-dnl lastlog, [uw]tmpx? detection
-dnl  NOTE: set the paths in the platform section to avoid the
-dnl   need for command-line parameters
-dnl lastlog and [uw]tmp are subject to a file search if all else fails
-
-dnl lastlog detection
-dnl  NOTE: the code itself will detect if lastlog is a directory
-AC_MSG_CHECKING([if your system defines LASTLOG_FILE])
-AC_TRY_COMPILE([
-#include <sys/types.h>
-#include <utmp.h>
-#ifdef HAVE_LASTLOG_H
-#  include <lastlog.h>
-#endif
-#ifdef HAVE_PATHS_H
-#  include <paths.h>
-#endif
-#ifdef HAVE_LOGIN_H
-# include <login.h>
-#endif
-	],
-	[ char *lastlog = LASTLOG_FILE; ],
-	[ AC_MSG_RESULT(yes) ],
-	[
-		AC_MSG_RESULT(no)
-		AC_MSG_CHECKING([if your system defines _PATH_LASTLOG])
-		AC_TRY_COMPILE([
-#include <sys/types.h>
-#include <utmp.h>
-#ifdef HAVE_LASTLOG_H
-#  include <lastlog.h>
-#endif
-#ifdef HAVE_PATHS_H
-#  include <paths.h>
-#endif
-		],
-		[ char *lastlog = _PATH_LASTLOG; ],
-		[ AC_MSG_RESULT(yes) ],
-		[
-			AC_MSG_RESULT(no)
-			system_lastlog_path=no
-		])
-	]
-)
-
-if test -z "$conf_lastlog_location"; then
-	if test x"$system_lastlog_path" = x"no" ; then
-		for f in /var/log/lastlog /usr/adm/lastlog /var/adm/lastlog /etc/security/lastlog ; do
-				if (test -d "$f" || test -f "$f") ; then
-					conf_lastlog_location=$f
-				fi
-		done
-		if test -z "$conf_lastlog_location"; then
-			AC_MSG_WARN([** Cannot find lastlog **])
-			dnl Don't define DISABLE_LASTLOG - that means we don't try wtmp/wtmpx
-		fi
-	fi
-fi
-
-if test -n "$conf_lastlog_location"; then
-	AC_DEFINE_UNQUOTED(CONF_LASTLOG_FILE, "$conf_lastlog_location")
-fi	
-
-dnl utmp detection
-AC_MSG_CHECKING([if your system defines UTMP_FILE])
-AC_TRY_COMPILE([
-#include <sys/types.h>
-#include <utmp.h>
-#ifdef HAVE_PATHS_H
-#  include <paths.h>
-#endif
-	],
-	[ char *utmp = UTMP_FILE; ],
-	[ AC_MSG_RESULT(yes) ],
-	[ AC_MSG_RESULT(no)
-	  system_utmp_path=no ]
-)
-if test -z "$conf_utmp_location"; then
-	if test x"$system_utmp_path" = x"no" ; then
-		for f in /etc/utmp /usr/adm/utmp /var/run/utmp; do
-			if test -f $f ; then
-				conf_utmp_location=$f
-			fi
-		done
-		if test -z "$conf_utmp_location"; then
-			AC_DEFINE(DISABLE_UTMP)
-		fi
-	fi
-fi
-if test -n "$conf_utmp_location"; then
-	AC_DEFINE_UNQUOTED(CONF_UTMP_FILE, "$conf_utmp_location")
-fi	
-
-dnl wtmp detection
-AC_MSG_CHECKING([if your system defines WTMP_FILE])
-AC_TRY_COMPILE([
-#include <sys/types.h>
-#include <utmp.h>
-#ifdef HAVE_PATHS_H
-#  include <paths.h>
-#endif
-	],
-	[ char *wtmp = WTMP_FILE; ],
-	[ AC_MSG_RESULT(yes) ],
-	[ AC_MSG_RESULT(no)
-	  system_wtmp_path=no ]
-)
-if test -z "$conf_wtmp_location"; then
-	if test x"$system_wtmp_path" = x"no" ; then
-		for f in /usr/adm/wtmp /var/log/wtmp; do
-			if test -f $f ; then
-				conf_wtmp_location=$f
-			fi
-		done
-		if test -z "$conf_wtmp_location"; then
-			AC_DEFINE(DISABLE_WTMP)
-		fi
-	fi
-fi
-if test -n "$conf_wtmp_location"; then
-	AC_DEFINE_UNQUOTED(CONF_WTMP_FILE, "$conf_wtmp_location")
-fi	
-
-
-dnl utmpx detection - I don't know any system so perverse as to require
-dnl  utmpx, but not define UTMPX_FILE (ditto wtmpx.) No doubt it's out
-dnl  there, though.
-AC_MSG_CHECKING([if your system defines UTMPX_FILE])
-AC_TRY_COMPILE([
-#include <sys/types.h>
-#include <utmp.h>
-#ifdef HAVE_UTMPX_H
-#include <utmpx.h>
-#endif
-#ifdef HAVE_PATHS_H
-#  include <paths.h>
-#endif
-	],
-	[ char *utmpx = UTMPX_FILE; ],
-	[ AC_MSG_RESULT(yes) ],
-	[ AC_MSG_RESULT(no)
-	  system_utmpx_path=no ]
-)
-if test -z "$conf_utmpx_location"; then
-	if test x"$system_utmpx_path" = x"no" ; then
-		AC_DEFINE(DISABLE_UTMPX)
-	fi
-else
-	AC_DEFINE_UNQUOTED(CONF_UTMPX_FILE, "$conf_utmpx_location")
-fi	
-
-dnl wtmpx detection
-AC_MSG_CHECKING([if your system defines WTMPX_FILE])
-AC_TRY_COMPILE([
-#include <sys/types.h>
-#include <utmp.h>
-#ifdef HAVE_UTMPX_H
-#include <utmpx.h>
-#endif
-#ifdef HAVE_PATHS_H
-#  include <paths.h>
-#endif
-	],
-	[ char *wtmpx = WTMPX_FILE; ],
-	[ AC_MSG_RESULT(yes) ],
-	[ AC_MSG_RESULT(no)
-	  system_wtmpx_path=no ]
-)
-if test -z "$conf_wtmpx_location"; then
-	if test x"$system_wtmpx_path" = x"no" ; then
-		AC_DEFINE(DISABLE_WTMPX)
-	fi
-else
-	AC_DEFINE_UNQUOTED(CONF_WTMPX_FILE, "$conf_wtmpx_location")
-fi	
-
-
-if test ! -z "$blibpath" ; then
-	LDFLAGS="$LDFLAGS -blibpath:$blibpath"
-	AC_MSG_WARN([Please check and edit -blibpath in LDFLAGS in Makefile])
-fi
-
-dnl remove pam and dl because they are in $LIBPAM
-if test "$PAM_MSG" = yes ; then
-	LIBS=`echo $LIBS | sed 's/-lpam //'`
-fi
-if test "$ac_cv_lib_pam_pam_set_item" = yes ; then
-	LIBS=`echo $LIBS | sed 's/-ldl //'`
-fi
-
-AC_EXEEXT
-AC_CONFIG_FILES([Makefile openbsd-compat/Makefile scard/Makefile ssh_prng_cmds])
-AC_OUTPUT
-
-# Print summary of options
-
-# Someone please show me a better way :)
-A=`eval echo ${prefix}` ; A=`eval echo ${A}`
-B=`eval echo ${bindir}` ; B=`eval echo ${B}`
-C=`eval echo ${sbindir}` ; C=`eval echo ${C}`
-D=`eval echo ${sysconfdir}` ; D=`eval echo ${D}`
-E=`eval echo ${libexecdir}/ssh-askpass` ; E=`eval echo ${E}`
-F=`eval echo ${mandir}/${mansubdir}X` ; F=`eval echo ${F}`
-G=`eval echo ${piddir}` ; G=`eval echo ${G}`
-H=`eval echo ${PRIVSEP_PATH}` ; H=`eval echo ${H}`
-I=`eval echo ${user_path}` ; I=`eval echo ${I}`
-J=`eval echo ${superuser_path}` ; J=`eval echo ${J}`
-
-echo ""
-echo "OpenSSH has been configured with the following options:"
-echo "                     User binaries: $B"
-echo "                   System binaries: $C"
-echo "               Configuration files: $D"
-echo "                   Askpass program: $E"
-echo "                      Manual pages: $F"
-echo "                          PID file: $G"
-echo "  Privilege separation chroot path: $H"
-if test "$USES_LOGIN_CONF" = "yes" ; then
-echo "   At runtime, sshd will use the path defined in /etc/login.conf"
-else
-echo "            sshd default user PATH: $I"
-fi
-if test ! -z "$superuser_path" ; then
-echo "          sshd superuser user PATH: $J"
-fi
-echo "                    Manpage format: $MANTYPE"
-echo "                       PAM support: ${PAM_MSG}"
-echo "                KerberosIV support: $KRB4_MSG"
-echo "                 KerberosV support: $KRB5_MSG"
-echo "                 Smartcard support: $SCARD_MSG"
-echo "                       AFS support: $AFS_MSG"
-echo "                     S/KEY support: $SKEY_MSG"
-echo "              TCP Wrappers support: $TCPW_MSG"
-echo "              MD5 password support: $MD5_MSG"
-echo "       IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
-echo "          Use IPv4 by default hack: $IPV4_HACK_MSG"
-echo "           Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
-echo "                  BSD Auth support: $BSD_AUTH_MSG"
-echo "              Random number source: $RAND_MSG"
-if test ! -z "$USE_RAND_HELPER" ; then
-echo "     ssh-rand-helper collects from: $RAND_HELPER_MSG"
-fi
-
-echo ""
-
-echo "              Host: ${host}"
-echo "          Compiler: ${CC}"
-echo "    Compiler flags: ${CFLAGS}"
-echo "Preprocessor flags: ${CPPFLAGS}"
-echo "      Linker flags: ${LDFLAGS}"
-echo "         Libraries: ${LIBWRAP} ${LIBPAM} ${LIBS}"
-
-echo ""
-
-if test "x$PAM_MSG" = "xyes" ; then
-	echo "PAM is enabled. You may need to install a PAM control file "
-	echo "for sshd, otherwise password authentication may fail. "
-	echo "Example PAM control files can be found in the contrib/ " 
-	echo "subdirectory"
-	echo ""
-fi
-
-if test ! -z "$RAND_HELPER_CMDHASH" ; then
-	echo "WARNING: you are using the builtin random number collection "
-	echo "service. Please read WARNING.RNG and request that your OS "
-	echo "vendor includes kernel-based random number collection in "
-	echo "future versions of your OS."
-	echo ""
-fi
-
diff --git a/crypto/openssh/crc32.c b/crypto/openssh/crc32.c
deleted file mode 100644
index ac627b57a563..000000000000
--- a/crypto/openssh/crc32.c
+++ /dev/null
@@ -1,105 +0,0 @@
-/*	$OpenBSD: crc32.c,v 1.9 2003/02/12 21:39:50 markus Exp $	*/
-
-/*
- * Copyright (c) 2003 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#include "includes.h"
-#include "crc32.h"
-
-static const u_int32_t crc32tab[] = {
-	0x00000000L, 0x77073096L, 0xee0e612cL, 0x990951baL,
-	0x076dc419L, 0x706af48fL, 0xe963a535L, 0x9e6495a3L,
-	0x0edb8832L, 0x79dcb8a4L, 0xe0d5e91eL, 0x97d2d988L,
-	0x09b64c2bL, 0x7eb17cbdL, 0xe7b82d07L, 0x90bf1d91L,
-	0x1db71064L, 0x6ab020f2L, 0xf3b97148L, 0x84be41deL,
-	0x1adad47dL, 0x6ddde4ebL, 0xf4d4b551L, 0x83d385c7L,
-	0x136c9856L, 0x646ba8c0L, 0xfd62f97aL, 0x8a65c9ecL,
-	0x14015c4fL, 0x63066cd9L, 0xfa0f3d63L, 0x8d080df5L,
-	0x3b6e20c8L, 0x4c69105eL, 0xd56041e4L, 0xa2677172L,
-	0x3c03e4d1L, 0x4b04d447L, 0xd20d85fdL, 0xa50ab56bL,
-	0x35b5a8faL, 0x42b2986cL, 0xdbbbc9d6L, 0xacbcf940L,
-	0x32d86ce3L, 0x45df5c75L, 0xdcd60dcfL, 0xabd13d59L,
-	0x26d930acL, 0x51de003aL, 0xc8d75180L, 0xbfd06116L,
-	0x21b4f4b5L, 0x56b3c423L, 0xcfba9599L, 0xb8bda50fL,
-	0x2802b89eL, 0x5f058808L, 0xc60cd9b2L, 0xb10be924L,
-	0x2f6f7c87L, 0x58684c11L, 0xc1611dabL, 0xb6662d3dL,
-	0x76dc4190L, 0x01db7106L, 0x98d220bcL, 0xefd5102aL,
-	0x71b18589L, 0x06b6b51fL, 0x9fbfe4a5L, 0xe8b8d433L,
-	0x7807c9a2L, 0x0f00f934L, 0x9609a88eL, 0xe10e9818L,
-	0x7f6a0dbbL, 0x086d3d2dL, 0x91646c97L, 0xe6635c01L,
-	0x6b6b51f4L, 0x1c6c6162L, 0x856530d8L, 0xf262004eL,
-	0x6c0695edL, 0x1b01a57bL, 0x8208f4c1L, 0xf50fc457L,
-	0x65b0d9c6L, 0x12b7e950L, 0x8bbeb8eaL, 0xfcb9887cL,
-	0x62dd1ddfL, 0x15da2d49L, 0x8cd37cf3L, 0xfbd44c65L,
-	0x4db26158L, 0x3ab551ceL, 0xa3bc0074L, 0xd4bb30e2L,
-	0x4adfa541L, 0x3dd895d7L, 0xa4d1c46dL, 0xd3d6f4fbL,
-	0x4369e96aL, 0x346ed9fcL, 0xad678846L, 0xda60b8d0L,
-	0x44042d73L, 0x33031de5L, 0xaa0a4c5fL, 0xdd0d7cc9L,
-	0x5005713cL, 0x270241aaL, 0xbe0b1010L, 0xc90c2086L,
-	0x5768b525L, 0x206f85b3L, 0xb966d409L, 0xce61e49fL,
-	0x5edef90eL, 0x29d9c998L, 0xb0d09822L, 0xc7d7a8b4L,
-	0x59b33d17L, 0x2eb40d81L, 0xb7bd5c3bL, 0xc0ba6cadL,
-	0xedb88320L, 0x9abfb3b6L, 0x03b6e20cL, 0x74b1d29aL,
-	0xead54739L, 0x9dd277afL, 0x04db2615L, 0x73dc1683L,
-	0xe3630b12L, 0x94643b84L, 0x0d6d6a3eL, 0x7a6a5aa8L,
-	0xe40ecf0bL, 0x9309ff9dL, 0x0a00ae27L, 0x7d079eb1L,
-	0xf00f9344L, 0x8708a3d2L, 0x1e01f268L, 0x6906c2feL,
-	0xf762575dL, 0x806567cbL, 0x196c3671L, 0x6e6b06e7L,
-	0xfed41b76L, 0x89d32be0L, 0x10da7a5aL, 0x67dd4accL,
-	0xf9b9df6fL, 0x8ebeeff9L, 0x17b7be43L, 0x60b08ed5L,
-	0xd6d6a3e8L, 0xa1d1937eL, 0x38d8c2c4L, 0x4fdff252L,
-	0xd1bb67f1L, 0xa6bc5767L, 0x3fb506ddL, 0x48b2364bL,
-	0xd80d2bdaL, 0xaf0a1b4cL, 0x36034af6L, 0x41047a60L,
-	0xdf60efc3L, 0xa867df55L, 0x316e8eefL, 0x4669be79L,
-	0xcb61b38cL, 0xbc66831aL, 0x256fd2a0L, 0x5268e236L,
-	0xcc0c7795L, 0xbb0b4703L, 0x220216b9L, 0x5505262fL,
-	0xc5ba3bbeL, 0xb2bd0b28L, 0x2bb45a92L, 0x5cb36a04L,
-	0xc2d7ffa7L, 0xb5d0cf31L, 0x2cd99e8bL, 0x5bdeae1dL,
-	0x9b64c2b0L, 0xec63f226L, 0x756aa39cL, 0x026d930aL,
-	0x9c0906a9L, 0xeb0e363fL, 0x72076785L, 0x05005713L,
-	0x95bf4a82L, 0xe2b87a14L, 0x7bb12baeL, 0x0cb61b38L,
-	0x92d28e9bL, 0xe5d5be0dL, 0x7cdcefb7L, 0x0bdbdf21L,
-	0x86d3d2d4L, 0xf1d4e242L, 0x68ddb3f8L, 0x1fda836eL,
-	0x81be16cdL, 0xf6b9265bL, 0x6fb077e1L, 0x18b74777L,
-	0x88085ae6L, 0xff0f6a70L, 0x66063bcaL, 0x11010b5cL,
-	0x8f659effL, 0xf862ae69L, 0x616bffd3L, 0x166ccf45L,
-	0xa00ae278L, 0xd70dd2eeL, 0x4e048354L, 0x3903b3c2L,
-	0xa7672661L, 0xd06016f7L, 0x4969474dL, 0x3e6e77dbL,
-	0xaed16a4aL, 0xd9d65adcL, 0x40df0b66L, 0x37d83bf0L,
-	0xa9bcae53L, 0xdebb9ec5L, 0x47b2cf7fL, 0x30b5ffe9L,
-	0xbdbdf21cL, 0xcabac28aL, 0x53b39330L, 0x24b4a3a6L,
-	0xbad03605L, 0xcdd70693L, 0x54de5729L, 0x23d967bfL,
-	0xb3667a2eL, 0xc4614ab8L, 0x5d681b02L, 0x2a6f2b94L,
-	0xb40bbe37L, 0xc30c8ea1L, 0x5a05df1bL, 0x2d02ef8dL
-};
-
-u_int32_t
-ssh_crc32(const u_char *buf, u_int32_t size)
-{
-	u_int32_t i, crc;
-
-	crc = 0;
-	for (i = 0;  i < size;  i++)
-		crc = crc32tab[(crc ^ buf[i]) & 0xff] ^ (crc >> 8);
-	return crc;
-}
diff --git a/crypto/openssh/crc32.h b/crypto/openssh/crc32.h
deleted file mode 100644
index a2fb58493a99..000000000000
--- a/crypto/openssh/crc32.h
+++ /dev/null
@@ -1,30 +0,0 @@
-/*	$OpenBSD: crc32.h,v 1.14 2003/02/12 21:39:50 markus Exp $	*/
-
-/*
- * Copyright (c) 2003 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef SSH_CRC32_H
-#define SSH_CRC32_H
-u_int32_t	 ssh_crc32(const u_char *, u_int32_t);
-#endif
diff --git a/crypto/openssh/deattack.c b/crypto/openssh/deattack.c
deleted file mode 100644
index 0442501e7a17..000000000000
--- a/crypto/openssh/deattack.c
+++ /dev/null
@@ -1,156 +0,0 @@
-/*
- * Cryptographic attack detector for ssh - source code
- *
- * Copyright (c) 1998 CORE SDI S.A., Buenos Aires, Argentina.
- *
- * All rights reserved. Redistribution and use in source and binary
- * forms, with or without modification, are permitted provided that
- * this copyright notice is retained.
- *
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
- * WARRANTIES ARE DISCLAIMED. IN NO EVENT SHALL CORE SDI S.A. BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY OR
- * CONSEQUENTIAL DAMAGES RESULTING FROM THE USE OR MISUSE OF THIS
- * SOFTWARE.
- *
- * Ariel Futoransky <futo@core-sdi.com>
- * <http://www.core-sdi.com>
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: deattack.c,v 1.18 2002/03/04 17:27:39 stevesk Exp $");
-
-#include "deattack.h"
-#include "log.h"
-#include "crc32.h"
-#include "getput.h"
-#include "xmalloc.h"
-#include "deattack.h"
-
-/* SSH Constants */
-#define SSH_MAXBLOCKS	(32 * 1024)
-#define SSH_BLOCKSIZE	(8)
-
-/* Hashing constants */
-#define HASH_MINSIZE	(8 * 1024)
-#define HASH_ENTRYSIZE	(2)
-#define HASH_FACTOR(x)	((x)*3/2)
-#define HASH_UNUSEDCHAR	(0xff)
-#define HASH_UNUSED	(0xffff)
-#define HASH_IV		(0xfffe)
-
-#define HASH_MINBLOCKS	(7*SSH_BLOCKSIZE)
-
-
-/* Hash function (Input keys are cipher results) */
-#define HASH(x)		GET_32BIT(x)
-
-#define CMP(a, b)	(memcmp(a, b, SSH_BLOCKSIZE))
-
-static void
-crc_update(u_int32_t *a, u_int32_t b)
-{
-	b ^= *a;
-	*a = ssh_crc32((u_char *) &b, sizeof(b));
-}
-
-/* detect if a block is used in a particular pattern */
-static int
-check_crc(u_char *S, u_char *buf, u_int32_t len,
-	  u_char *IV)
-{
-	u_int32_t crc;
-	u_char *c;
-
-	crc = 0;
-	if (IV && !CMP(S, IV)) {
-		crc_update(&crc, 1);
-		crc_update(&crc, 0);
-	}
-	for (c = buf; c < buf + len; c += SSH_BLOCKSIZE) {
-		if (!CMP(S, c)) {
-			crc_update(&crc, 1);
-			crc_update(&crc, 0);
-		} else {
-			crc_update(&crc, 0);
-			crc_update(&crc, 0);
-		}
-	}
-	return (crc == 0);
-}
-
-
-/* Detect a crc32 compensation attack on a packet */
-int
-detect_attack(u_char *buf, u_int32_t len, u_char *IV)
-{
-	static u_int16_t *h = (u_int16_t *) NULL;
-	static u_int32_t n = HASH_MINSIZE / HASH_ENTRYSIZE;
-	u_int32_t i, j;
-	u_int32_t l;
-	u_char *c;
-	u_char *d;
-
-	if (len > (SSH_MAXBLOCKS * SSH_BLOCKSIZE) ||
-	    len % SSH_BLOCKSIZE != 0) {
-		fatal("detect_attack: bad length %d", len);
-	}
-	for (l = n; l < HASH_FACTOR(len / SSH_BLOCKSIZE); l = l << 2)
-		;
-
-	if (h == NULL) {
-		debug("Installing crc compensation attack detector.");
-		n = l;
-		h = (u_int16_t *) xmalloc(n * HASH_ENTRYSIZE);
-	} else {
-		if (l > n) {
-			n = l;
-			h = (u_int16_t *) xrealloc(h, n * HASH_ENTRYSIZE);
-		}
-	}
-
-	if (len <= HASH_MINBLOCKS) {
-		for (c = buf; c < buf + len; c += SSH_BLOCKSIZE) {
-			if (IV && (!CMP(c, IV))) {
-				if ((check_crc(c, buf, len, IV)))
-					return (DEATTACK_DETECTED);
-				else
-					break;
-			}
-			for (d = buf; d < c; d += SSH_BLOCKSIZE) {
-				if (!CMP(c, d)) {
-					if ((check_crc(c, buf, len, IV)))
-						return (DEATTACK_DETECTED);
-					else
-						break;
-				}
-			}
-		}
-		return (DEATTACK_OK);
-	}
-	memset(h, HASH_UNUSEDCHAR, n * HASH_ENTRYSIZE);
-
-	if (IV)
-		h[HASH(IV) & (n - 1)] = HASH_IV;
-
-	for (c = buf, j = 0; c < (buf + len); c += SSH_BLOCKSIZE, j++) {
-		for (i = HASH(c) & (n - 1); h[i] != HASH_UNUSED;
-		    i = (i + 1) & (n - 1)) {
-			if (h[i] == HASH_IV) {
-				if (!CMP(c, IV)) {
-					if (check_crc(c, buf, len, IV))
-						return (DEATTACK_DETECTED);
-					else
-						break;
-				}
-			} else if (!CMP(c, buf + h[i] * SSH_BLOCKSIZE)) {
-				if (check_crc(c, buf, len, IV))
-					return (DEATTACK_DETECTED);
-				else
-					break;
-			}
-		}
-		h[i] = j;
-	}
-	return (DEATTACK_OK);
-}
diff --git a/crypto/openssh/deattack.h b/crypto/openssh/deattack.h
deleted file mode 100644
index ddccdea50594..000000000000
--- a/crypto/openssh/deattack.h
+++ /dev/null
@@ -1,30 +0,0 @@
-/*	$OpenBSD: deattack.h,v 1.7 2001/06/26 17:27:23 markus Exp $	*/
-
-/*
- * Cryptographic attack detector for ssh - Header file
- *
- * Copyright (c) 1998 CORE SDI S.A., Buenos Aires, Argentina.
- *
- * All rights reserved. Redistribution and use in source and binary
- * forms, with or without modification, are permitted provided that
- * this copyright notice is retained.
- *
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
- * WARRANTIES ARE DISCLAIMED. IN NO EVENT SHALL CORE SDI S.A. BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY OR
- * CONSEQUENTIAL DAMAGES RESULTING FROM THE USE OR MISUSE OF THIS
- * SOFTWARE.
- *
- * Ariel Futoransky <futo@core-sdi.com>
- * <http://www.core-sdi.com>
- */
-
-#ifndef _DEATTACK_H
-#define _DEATTACK_H
-
-/* Return codes */
-#define DEATTACK_OK		0
-#define DEATTACK_DETECTED	1
-
-int	 detect_attack(u_char *, u_int32_t, u_char[8]);
-#endif
diff --git a/crypto/openssh/defines.h b/crypto/openssh/defines.h
deleted file mode 100644
index 73fbe077b479..000000000000
--- a/crypto/openssh/defines.h
+++ /dev/null
@@ -1,563 +0,0 @@
-#ifndef _DEFINES_H
-#define _DEFINES_H
-
-/* $Id: defines.h,v 1.97 2003/01/24 00:50:32 djm Exp $ */
-
-
-/* Constants */
-
-#ifndef SHUT_RDWR
-enum
-{
-  SHUT_RD = 0,		/* No more receptions.  */
-  SHUT_WR,			/* No more transmissions.  */
-  SHUT_RDWR			/* No more receptions or transmissions.  */
-};
-# define SHUT_RD   SHUT_RD
-# define SHUT_WR   SHUT_WR
-# define SHUT_RDWR SHUT_RDWR
-#endif
-
-#ifndef IPTOS_LOWDELAY
-# define IPTOS_LOWDELAY          0x10
-# define IPTOS_THROUGHPUT        0x08
-# define IPTOS_RELIABILITY       0x04
-# define IPTOS_LOWCOST           0x02
-# define IPTOS_MINCOST           IPTOS_LOWCOST
-#endif /* IPTOS_LOWDELAY */
-
-#ifndef MAXPATHLEN
-# ifdef PATH_MAX
-#  define MAXPATHLEN PATH_MAX
-# else /* PATH_MAX */
-#  define MAXPATHLEN 64 /* Should be safe */
-# endif /* PATH_MAX */
-#endif /* MAXPATHLEN */
-
-#ifndef STDIN_FILENO
-# define STDIN_FILENO    0
-#endif
-#ifndef STDOUT_FILENO
-# define STDOUT_FILENO   1
-#endif
-#ifndef STDERR_FILENO
-# define STDERR_FILENO   2
-#endif
-
-#ifndef NGROUPS_MAX	/* Disable groupaccess if NGROUP_MAX is not set */
-#ifdef NGROUPS
-#define NGROUPS_MAX NGROUPS
-#else
-#define NGROUPS_MAX 0
-#endif
-#endif
-
-#ifndef O_NONBLOCK	/* Non Blocking Open */
-# define O_NONBLOCK      00004
-#endif
-
-#ifndef S_ISDIR
-# define S_ISDIR(mode)	(((mode) & (_S_IFMT)) == (_S_IFDIR))
-#endif /* S_ISDIR */
-
-#ifndef S_ISREG 
-# define S_ISREG(mode)	(((mode) & (_S_IFMT)) == (_S_IFREG))
-#endif /* S_ISREG */
-
-#ifndef S_ISLNK
-# define S_ISLNK(mode)	(((mode) & S_IFMT) == S_IFLNK)
-#endif /* S_ISLNK */
-
-#ifndef S_IXUSR
-# define S_IXUSR			0000100	/* execute/search permission, */
-# define S_IXGRP			0000010	/* execute/search permission, */
-# define S_IXOTH			0000001	/* execute/search permission, */
-# define _S_IWUSR			0000200	/* write permission, */
-# define S_IWUSR			_S_IWUSR	/* write permission, owner */
-# define S_IWGRP			0000020	/* write permission, group */
-# define S_IWOTH			0000002	/* write permission, other */
-# define S_IRUSR			0000400	/* read permission, owner */
-# define S_IRGRP			0000040	/* read permission, group */
-# define S_IROTH			0000004	/* read permission, other */
-# define S_IRWXU			0000700	/* read, write, execute */
-# define S_IRWXG			0000070	/* read, write, execute */
-# define S_IRWXO			0000007	/* read, write, execute */
-#endif /* S_IXUSR */
-
-#if !defined(MAP_ANON) && defined(MAP_ANONYMOUS)
-#define MAP_ANON MAP_ANONYMOUS
-#endif
-
-#ifndef MAP_FAILED
-# define MAP_FAILED ((void *)-1)
-#endif
-
-/* *-*-nto-qnx doesn't define this constant in the system headers */
-#ifdef MISSING_NFDBITS
-# define	NFDBITS (8 * sizeof(unsigned long))
-#endif
-
-/*
-SCO Open Server 3 has INADDR_LOOPBACK defined in rpc/rpc.h but
-including rpc/rpc.h breaks Solaris 6
-*/
-#ifndef INADDR_LOOPBACK
-#define INADDR_LOOPBACK ((u_long)0x7f000001)
-#endif
-
-/* Types */
-
-/* If sys/types.h does not supply intXX_t, supply them ourselves */
-/* (or die trying) */
-
-
-#ifndef HAVE_U_INT
-typedef unsigned int u_int;
-#endif
-
-#ifndef HAVE_INTXX_T
-# if (SIZEOF_CHAR == 1)
-typedef char int8_t;
-# else
-#  error "8 bit int type not found."
-# endif
-# if (SIZEOF_SHORT_INT == 2)
-typedef short int int16_t;
-# else
-#  ifdef _UNICOS
-#   if (SIZEOF_SHORT_INT == 4)
-typedef short int16_t;
-#   else
-typedef long  int16_t;
-#   endif
-#  else
-#   error "16 bit int type not found."
-#  endif /* _UNICOS */
-# endif
-# if (SIZEOF_INT == 4)
-typedef int int32_t;
-# else
-#  ifdef _UNICOS
-typedef long  int32_t;
-#  else
-#   error "32 bit int type not found."
-#  endif /* _UNICOS */
-# endif
-#endif
-
-/* If sys/types.h does not supply u_intXX_t, supply them ourselves */
-#ifndef HAVE_U_INTXX_T
-# ifdef HAVE_UINTXX_T
-typedef uint8_t u_int8_t;
-typedef uint16_t u_int16_t;
-typedef uint32_t u_int32_t;
-# define HAVE_U_INTXX_T 1
-# else
-#  if (SIZEOF_CHAR == 1)
-typedef unsigned char u_int8_t;
-#  else
-#   error "8 bit int type not found."
-#  endif
-#  if (SIZEOF_SHORT_INT == 2)
-typedef unsigned short int u_int16_t;
-#  else
-#   ifdef _UNICOS
-#    if (SIZEOF_SHORT_INT == 4)
-typedef unsigned short u_int16_t;
-#    else
-typedef unsigned long  u_int16_t;
-#    endif
-#   else
-#    error "16 bit int type not found."
-#   endif
-#  endif
-#  if (SIZEOF_INT == 4)
-typedef unsigned int u_int32_t;
-#  else
-#   ifdef _UNICOS
-typedef unsigned long  u_int32_t;
-#   else
-#    error "32 bit int type not found."
-#   endif
-#  endif
-# endif
-#define __BIT_TYPES_DEFINED__
-#endif
-
-/* 64-bit types */
-#ifndef HAVE_INT64_T
-# if (SIZEOF_LONG_INT == 8)
-typedef long int int64_t;
-#   define HAVE_INT64_T 1
-# else
-#  if (SIZEOF_LONG_LONG_INT == 8)
-typedef long long int int64_t;
-#   define HAVE_INT64_T 1
-#  endif
-# endif
-#endif
-#ifndef HAVE_U_INT64_T
-# if (SIZEOF_LONG_INT == 8)
-typedef unsigned long int u_int64_t;
-#   define HAVE_U_INT64_T 1
-# else
-#  if (SIZEOF_LONG_LONG_INT == 8)
-typedef unsigned long long int u_int64_t;
-#   define HAVE_U_INT64_T 1
-#  endif
-# endif
-#endif
-#if !defined(HAVE_LONG_LONG_INT) && (SIZEOF_LONG_LONG_INT == 8)
-# define HAVE_LONG_LONG_INT 1
-#endif
-
-#ifndef HAVE_U_CHAR
-typedef unsigned char u_char;
-# define HAVE_U_CHAR
-#endif /* HAVE_U_CHAR */
-
-#ifndef SIZE_T_MAX
-#define SIZE_T_MAX ULONG_MAX
-#endif /* SIZE_T_MAX */
-
-#ifndef HAVE_SIZE_T
-typedef unsigned int size_t;
-# define HAVE_SIZE_T
-#endif /* HAVE_SIZE_T */
-
-#ifndef HAVE_SSIZE_T
-typedef int ssize_t;
-# define HAVE_SSIZE_T
-#endif /* HAVE_SSIZE_T */
-
-#ifndef HAVE_CLOCK_T
-typedef long clock_t;
-# define HAVE_CLOCK_T
-#endif /* HAVE_CLOCK_T */
-
-#ifndef HAVE_SA_FAMILY_T
-typedef int sa_family_t;
-# define HAVE_SA_FAMILY_T
-#endif /* HAVE_SA_FAMILY_T */
-
-#ifndef HAVE_PID_T
-typedef int pid_t;
-# define HAVE_PID_T
-#endif /* HAVE_PID_T */
-
-#ifndef HAVE_SIG_ATOMIC_T
-typedef int sig_atomic_t;
-# define HAVE_SIG_ATOMIC_T
-#endif /* HAVE_SIG_ATOMIC_T */
-
-#ifndef HAVE_MODE_T
-typedef int mode_t;
-# define HAVE_MODE_T
-#endif /* HAVE_MODE_T */
-
-#if !defined(HAVE_SS_FAMILY_IN_SS) && defined(HAVE___SS_FAMILY_IN_SS)
-# define ss_family __ss_family
-#endif /* !defined(HAVE_SS_FAMILY_IN_SS) && defined(HAVE_SA_FAMILY_IN_SS) */
-
-#ifndef HAVE_SYS_UN_H
-struct	sockaddr_un {
-	short	sun_family;		/* AF_UNIX */
-	char	sun_path[108];		/* path name (gag) */
-};
-#endif /* HAVE_SYS_UN_H */
-
-#if defined(BROKEN_SYS_TERMIO_H) && !defined(_STRUCT_WINSIZE)
-#define _STRUCT_WINSIZE
-struct winsize {
-      unsigned short ws_row;          /* rows, in characters */
-      unsigned short ws_col;          /* columns, in character */
-      unsigned short ws_xpixel;       /* horizontal size, pixels */
-      unsigned short ws_ypixel;       /* vertical size, pixels */
-};
-#endif
-
-/* *-*-nto-qnx does not define this type in the system headers */
-#ifdef MISSING_FD_MASK
- typedef unsigned long int	fd_mask;
-#endif
-
-/* Paths */
-
-#ifndef _PATH_BSHELL
-# define _PATH_BSHELL "/bin/sh"
-#endif
-#ifndef _PATH_CSHELL
-# define _PATH_CSHELL "/bin/csh"
-#endif
-#ifndef _PATH_SHELLS
-# define _PATH_SHELLS "/etc/shells"
-#endif
-
-#ifdef USER_PATH
-# ifdef _PATH_STDPATH
-#  undef _PATH_STDPATH
-# endif
-# define _PATH_STDPATH USER_PATH
-#endif
-
-#ifndef _PATH_STDPATH
-# define _PATH_STDPATH "/usr/bin:/bin:/usr/sbin:/sbin"
-#endif
-
-#ifndef _PATH_DEVNULL
-# define _PATH_DEVNULL "/dev/null"
-#endif
-
-#ifndef MAIL_DIRECTORY
-# define MAIL_DIRECTORY "/var/spool/mail"
-#endif
-
-#ifndef MAILDIR
-# define MAILDIR MAIL_DIRECTORY
-#endif
-
-#if !defined(_PATH_MAILDIR) && defined(MAILDIR)
-# define _PATH_MAILDIR MAILDIR
-#endif /* !defined(_PATH_MAILDIR) && defined(MAILDIR) */
-
-#ifndef _PATH_NOLOGIN
-# define _PATH_NOLOGIN "/etc/nologin"
-#endif
-
-/* Define this to be the path of the xauth program. */
-#ifdef XAUTH_PATH
-#define _PATH_XAUTH XAUTH_PATH
-#endif /* XAUTH_PATH */
-
-/* derived from XF4/xc/lib/dps/Xlibnet.h */
-#ifndef X_UNIX_PATH
-#  ifdef __hpux
-#    define X_UNIX_PATH "/var/spool/sockets/X11/%u"
-#  else
-#    define X_UNIX_PATH "/tmp/.X11-unix/X%u"
-#  endif
-#endif /* X_UNIX_PATH */
-#define _PATH_UNIX_X X_UNIX_PATH
-
-#ifndef _PATH_TTY
-# define _PATH_TTY "/dev/tty"
-#endif
-
-/* Macros */
-
-#if defined(HAVE_LOGIN_GETCAPBOOL) && defined(HAVE_LOGIN_CAP_H)
-# define HAVE_LOGIN_CAP
-#endif
-
-#ifndef MAX
-# define MAX(a,b) (((a)>(b))?(a):(b))
-# define MIN(a,b) (((a)<(b))?(a):(b))
-#endif
-
-#ifndef roundup
-# define roundup(x, y)   ((((x)+((y)-1))/(y))*(y))
-#endif
-
-#ifndef timersub
-#define timersub(a, b, result)					\
-   do {								\
-      (result)->tv_sec = (a)->tv_sec - (b)->tv_sec;		\
-      (result)->tv_usec = (a)->tv_usec - (b)->tv_usec;		\
-      if ((result)->tv_usec < 0) {				\
-	 --(result)->tv_sec;					\
-	 (result)->tv_usec += 1000000;				\
-      }								\
-   } while (0)
-#endif
-
-#ifndef TIMEVAL_TO_TIMESPEC
-#define	TIMEVAL_TO_TIMESPEC(tv, ts) {					\
-	(ts)->tv_sec = (tv)->tv_sec;					\
-	(ts)->tv_nsec = (tv)->tv_usec * 1000;				\
-}
-#endif
-
-#ifndef TIMESPEC_TO_TIMEVAL
-#define	TIMESPEC_TO_TIMEVAL(tv, ts) {					\
-	(tv)->tv_sec = (ts)->tv_sec;					\
-	(tv)->tv_usec = (ts)->tv_nsec / 1000;				\
-}
-#endif
-
-#ifndef __P
-# define __P(x) x
-#endif
-
-#if !defined(IN6_IS_ADDR_V4MAPPED)
-# define IN6_IS_ADDR_V4MAPPED(a) \
-	((((u_int32_t *) (a))[0] == 0) && (((u_int32_t *) (a))[1] == 0) && \
-	 (((u_int32_t *) (a))[2] == htonl (0xffff)))
-#endif /* !defined(IN6_IS_ADDR_V4MAPPED) */
-
-#if !defined(__GNUC__) || (__GNUC__ < 2)
-# define __attribute__(x)
-#endif /* !defined(__GNUC__) || (__GNUC__ < 2) */
-
-/* *-*-nto-qnx doesn't define this macro in the system headers */
-#ifdef MISSING_HOWMANY
-# define howmany(x,y)	(((x)+((y)-1))/(y))
-#endif
-
-#ifndef OSSH_ALIGNBYTES
-#define OSSH_ALIGNBYTES	(sizeof(int) - 1)
-#endif
-#ifndef __CMSG_ALIGN
-#define	__CMSG_ALIGN(p) (((u_int)(p) + OSSH_ALIGNBYTES) &~ OSSH_ALIGNBYTES)
-#endif
-
-/* Length of the contents of a control message of length len */
-#ifndef CMSG_LEN
-#define	CMSG_LEN(len)	(__CMSG_ALIGN(sizeof(struct cmsghdr)) + (len))
-#endif
-
-/* Length of the space taken up by a padded control message of length len */
-#ifndef CMSG_SPACE
-#define	CMSG_SPACE(len)	(__CMSG_ALIGN(sizeof(struct cmsghdr)) + __CMSG_ALIGN(len))
-#endif
-
-/* Function replacement / compatibility hacks */
-
-#if !defined(HAVE_GETADDRINFO) && (defined(HAVE_OGETADDRINFO) || defined(HAVE_NGETADDRINFO))
-# define HAVE_GETADDRINFO
-#endif
-
-#ifndef HAVE_GETOPT_OPTRESET
-# undef getopt
-# undef opterr
-# undef optind
-# undef optopt
-# undef optreset
-# undef optarg
-# define getopt(ac, av, o)  BSDgetopt(ac, av, o)
-# define opterr             BSDopterr
-# define optind             BSDoptind
-# define optopt             BSDoptopt
-# define optreset           BSDoptreset
-# define optarg             BSDoptarg
-#endif
-
-/* In older versions of libpam, pam_strerror takes a single argument */
-#ifdef HAVE_OLD_PAM
-# define PAM_STRERROR(a,b) pam_strerror((b))
-#else
-# define PAM_STRERROR(a,b) pam_strerror((a),(b))
-#endif
-
-#ifdef PAM_SUN_CODEBASE
-# define PAM_MSG_MEMBER(msg, n, member) ((*(msg))[(n)].member)
-#else
-# define PAM_MSG_MEMBER(msg, n, member) ((msg)[(n)]->member)
-#endif
-
-#if defined(BROKEN_GETADDRINFO) && defined(HAVE_GETADDRINFO)
-# undef HAVE_GETADDRINFO
-#endif
-#if defined(BROKEN_GETADDRINFO) && defined(HAVE_FREEADDRINFO)
-# undef HAVE_FREEADDRINFO
-#endif
-#if defined(BROKEN_GETADDRINFO) && defined(HAVE_GAI_STRERROR)
-# undef HAVE_GAI_STRERROR
-#endif
-
-#if !defined(HAVE_MEMMOVE) && defined(HAVE_BCOPY)
-# define memmove(s1, s2, n) bcopy((s2), (s1), (n))
-#endif /* !defined(HAVE_MEMMOVE) && defined(HAVE_BCOPY) */
-
-#if defined(HAVE_VHANGUP) && !defined(HAVE_DEV_PTMX)
-#  define USE_VHANGUP
-#endif /* defined(HAVE_VHANGUP) && !defined(HAVE_DEV_PTMX) */
-
-#ifndef GETPGRP_VOID
-# define getpgrp() getpgrp(0)
-#endif
-
-/* OPENSSL_free() is Free() in versions before OpenSSL 0.9.6 */
-#if !defined(OPENSSL_VERSION_NUMBER) || (OPENSSL_VERSION_NUMBER < 0x0090600f)
-# define OPENSSL_free(x) Free(x)
-#endif
-
-#if !defined(HAVE___func__) && defined(HAVE___FUNCTION__)
-#  define __func__ __FUNCTION__
-#elif !defined(HAVE___func__)
-#  define __func__ ""
-#endif
-
-/*
- * Define this to use pipes instead of socketpairs for communicating with the
- * client program.  Socketpairs do not seem to work on all systems.
- *
- * configure.ac sets this for a few OS's which are known to have problems
- * but you may need to set it yourself
- */
-/* #define USE_PIPES 1 */
-
-/**
- ** login recorder definitions
- **/
-
-/* FIXME: put default paths back in */
-#ifndef UTMP_FILE
-#  ifdef _PATH_UTMP
-#    define UTMP_FILE _PATH_UTMP
-#  else
-#    ifdef CONF_UTMP_FILE
-#      define UTMP_FILE CONF_UTMP_FILE
-#    endif
-#  endif
-#endif
-#ifndef WTMP_FILE
-#  ifdef _PATH_WTMP
-#    define WTMP_FILE _PATH_WTMP
-#  else
-#    ifdef CONF_WTMP_FILE
-#      define WTMP_FILE CONF_WTMP_FILE
-#    endif
-#  endif
-#endif
-/* pick up the user's location for lastlog if given */
-#ifndef LASTLOG_FILE
-#  ifdef _PATH_LASTLOG
-#    define LASTLOG_FILE _PATH_LASTLOG
-#  else
-#    ifdef CONF_LASTLOG_FILE
-#      define LASTLOG_FILE CONF_LASTLOG_FILE
-#    endif
-#  endif
-#endif
-
-
-/* The login() library function in libutil is first choice */
-#if defined(HAVE_LOGIN) && !defined(DISABLE_LOGIN)
-#  define USE_LOGIN
-
-#else
-/* Simply select your favourite login types. */
-/* Can't do if-else because some systems use several... <sigh> */
-#  if defined(UTMPX_FILE) && !defined(DISABLE_UTMPX)
-#    define USE_UTMPX
-#  endif
-#  if defined(UTMP_FILE) && !defined(DISABLE_UTMP)
-#    define USE_UTMP
-#  endif
-#  if defined(WTMPX_FILE) && !defined(DISABLE_WTMPX)
-#    define USE_WTMPX
-#  endif
-#  if defined(WTMP_FILE) && !defined(DISABLE_WTMP)
-#    define USE_WTMP
-#  endif
-
-#endif
-
-/* I hope that the presence of LASTLOG_FILE is enough to detect this */
-#if defined(LASTLOG_FILE) && !defined(DISABLE_LASTLOG)
-#  define USE_LASTLOG
-#endif
-
-/** end of login recorder definitions */
-
-#endif /* _DEFINES_H */
diff --git a/crypto/openssh/dh.c b/crypto/openssh/dh.c
deleted file mode 100644
index 1be51953c6e2..000000000000
--- a/crypto/openssh/dh.c
+++ /dev/null
@@ -1,289 +0,0 @@
-/*
- * Copyright (c) 2000 Niels Provos.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: dh.c,v 1.23 2002/11/21 22:22:50 markus Exp $");
-
-#include "xmalloc.h"
-
-#include <openssl/bn.h>
-#include <openssl/dh.h>
-#include <openssl/evp.h>
-
-#include "buffer.h"
-#include "cipher.h"
-#include "kex.h"
-#include "dh.h"
-#include "pathnames.h"
-#include "log.h"
-#include "misc.h"
-
-static int
-parse_prime(int linenum, char *line, struct dhgroup *dhg)
-{
-	char *cp, *arg;
-	char *strsize, *gen, *prime;
-
-	cp = line;
-	arg = strdelim(&cp);
-	/* Ignore leading whitespace */
-	if (*arg == '\0')
-		arg = strdelim(&cp);
-	if (!arg || !*arg || *arg == '#')
-		return 0;
-
-	/* time */
-	if (cp == NULL || *arg == '\0')
-		goto fail;
-	arg = strsep(&cp, " "); /* type */
-	if (cp == NULL || *arg == '\0')
-		goto fail;
-	arg = strsep(&cp, " "); /* tests */
-	if (cp == NULL || *arg == '\0')
-		goto fail;
-	arg = strsep(&cp, " "); /* tries */
-	if (cp == NULL || *arg == '\0')
-		goto fail;
-	strsize = strsep(&cp, " "); /* size */
-	if (cp == NULL || *strsize == '\0' ||
-	    (dhg->size = atoi(strsize)) == 0)
-		goto fail;
-	/* The whole group is one bit larger */
-	dhg->size++;
-	gen = strsep(&cp, " "); /* gen */
-	if (cp == NULL || *gen == '\0')
-		goto fail;
-	prime = strsep(&cp, " "); /* prime */
-	if (cp != NULL || *prime == '\0')
-		goto fail;
-
-	if ((dhg->g = BN_new()) == NULL)
-		fatal("parse_prime: BN_new failed");
-	if ((dhg->p = BN_new()) == NULL)
-		fatal("parse_prime: BN_new failed");
-	if (BN_hex2bn(&dhg->g, gen) == 0)
-		goto failclean;
-
-	if (BN_hex2bn(&dhg->p, prime) == 0)
-		goto failclean;
-
-	if (BN_num_bits(dhg->p) != dhg->size)
-		goto failclean;
-
-	return (1);
-
- failclean:
-	BN_clear_free(dhg->g);
-	BN_clear_free(dhg->p);
- fail:
-	error("Bad prime description in line %d", linenum);
-	return (0);
-}
-
-DH *
-choose_dh(int min, int wantbits, int max)
-{
-	FILE *f;
-	char line[2048];
-	int best, bestcount, which;
-	int linenum;
-	struct dhgroup dhg;
-
-	if ((f = fopen(_PATH_DH_MODULI, "r")) == NULL &&
-	    (f = fopen(_PATH_DH_PRIMES, "r")) == NULL) {
-		log("WARNING: %s does not exist, using old modulus", _PATH_DH_MODULI);
-		return (dh_new_group1());
-	}
-
-	linenum = 0;
-	best = bestcount = 0;
-	while (fgets(line, sizeof(line), f)) {
-		linenum++;
-		if (!parse_prime(linenum, line, &dhg))
-			continue;
-		BN_clear_free(dhg.g);
-		BN_clear_free(dhg.p);
-
-		if (dhg.size > max || dhg.size < min)
-			continue;
-
-		if ((dhg.size > wantbits && dhg.size < best) ||
-		    (dhg.size > best && best < wantbits)) {
-			best = dhg.size;
-			bestcount = 0;
-		}
-		if (dhg.size == best)
-			bestcount++;
-	}
-	rewind(f);
-
-	if (bestcount == 0) {
-		fclose(f);
-		log("WARNING: no suitable primes in %s", _PATH_DH_PRIMES);
-		return (NULL);
-	}
-
-	linenum = 0;
-	which = arc4random() % bestcount;
-	while (fgets(line, sizeof(line), f)) {
-		if (!parse_prime(linenum, line, &dhg))
-			continue;
-		if ((dhg.size > max || dhg.size < min) ||
-		    dhg.size != best ||
-		    linenum++ != which) {
-			BN_clear_free(dhg.g);
-			BN_clear_free(dhg.p);
-			continue;
-		}
-		break;
-	}
-	fclose(f);
-	if (linenum != which+1)
-		fatal("WARNING: line %d disappeared in %s, giving up",
-		    which, _PATH_DH_PRIMES);
-
-	return (dh_new_group(dhg.g, dhg.p));
-}
-
-/* diffie-hellman-group1-sha1 */
-
-int
-dh_pub_is_valid(DH *dh, BIGNUM *dh_pub)
-{
-	int i;
-	int n = BN_num_bits(dh_pub);
-	int bits_set = 0;
-
-	if (dh_pub->neg) {
-		log("invalid public DH value: negativ");
-		return 0;
-	}
-	for (i = 0; i <= n; i++)
-		if (BN_is_bit_set(dh_pub, i))
-			bits_set++;
-	debug2("bits set: %d/%d", bits_set, BN_num_bits(dh->p));
-
-	/* if g==2 and bits_set==1 then computing log_g(dh_pub) is trivial */
-	if (bits_set > 1 && (BN_cmp(dh_pub, dh->p) == -1))
-		return 1;
-	log("invalid public DH value (%d/%d)", bits_set, BN_num_bits(dh->p));
-	return 0;
-}
-
-void
-dh_gen_key(DH *dh, int need)
-{
-	int i, bits_set = 0, tries = 0;
-
-	if (dh->p == NULL)
-		fatal("dh_gen_key: dh->p == NULL");
-	if (2*need >= BN_num_bits(dh->p))
-		fatal("dh_gen_key: group too small: %d (2*need %d)",
-		    BN_num_bits(dh->p), 2*need);
-	do {
-		if (dh->priv_key != NULL)
-			BN_clear_free(dh->priv_key);
-		if ((dh->priv_key = BN_new()) == NULL)
-			fatal("dh_gen_key: BN_new failed");
-		/* generate a 2*need bits random private exponent */
-		if (!BN_rand(dh->priv_key, 2*need, 0, 0))
-			fatal("dh_gen_key: BN_rand failed");
-		if (DH_generate_key(dh) == 0)
-			fatal("DH_generate_key");
-		for (i = 0; i <= BN_num_bits(dh->priv_key); i++)
-			if (BN_is_bit_set(dh->priv_key, i))
-				bits_set++;
-		debug2("dh_gen_key: priv key bits set: %d/%d",
-		    bits_set, BN_num_bits(dh->priv_key));
-		if (tries++ > 10)
-			fatal("dh_gen_key: too many bad keys: giving up");
-	} while (!dh_pub_is_valid(dh, dh->pub_key));
-}
-
-DH *
-dh_new_group_asc(const char *gen, const char *modulus)
-{
-	DH *dh;
-
-	if ((dh = DH_new()) == NULL)
-		fatal("dh_new_group_asc: DH_new");
-
-	if (BN_hex2bn(&dh->p, modulus) == 0)
-		fatal("BN_hex2bn p");
-	if (BN_hex2bn(&dh->g, gen) == 0)
-		fatal("BN_hex2bn g");
-
-	return (dh);
-}
-
-/*
- * This just returns the group, we still need to generate the exchange
- * value.
- */
-
-DH *
-dh_new_group(BIGNUM *gen, BIGNUM *modulus)
-{
-	DH *dh;
-
-	if ((dh = DH_new()) == NULL)
-		fatal("dh_new_group: DH_new");
-	dh->p = modulus;
-	dh->g = gen;
-
-	return (dh);
-}
-
-DH *
-dh_new_group1(void)
-{
-	static char *gen = "2", *group1 =
-	    "FFFFFFFF" "FFFFFFFF" "C90FDAA2" "2168C234" "C4C6628B" "80DC1CD1"
-	    "29024E08" "8A67CC74" "020BBEA6" "3B139B22" "514A0879" "8E3404DD"
-	    "EF9519B3" "CD3A431B" "302B0A6D" "F25F1437" "4FE1356D" "6D51C245"
-	    "E485B576" "625E7EC6" "F44C42E9" "A637ED6B" "0BFF5CB6" "F406B7ED"
-	    "EE386BFB" "5A899FA5" "AE9F2411" "7C4B1FE6" "49286651" "ECE65381"
-	    "FFFFFFFF" "FFFFFFFF";
-
-	return (dh_new_group_asc(gen, group1));
-}
-
-/*
- * Estimates the group order for a Diffie-Hellman group that has an
- * attack complexity approximately the same as O(2**bits).  Estimate
- * with:  O(exp(1.9223 * (ln q)^(1/3) (ln ln q)^(2/3)))
- */
-
-int
-dh_estimate(int bits)
-{
-
-	if (bits < 64)
-		return (512);	/* O(2**63) */
-	if (bits < 128)
-		return (1024);	/* O(2**86) */
-	if (bits < 192)
-		return (2048);	/* O(2**116) */
-	return (4096);		/* O(2**156) */
-}
diff --git a/crypto/openssh/dh.h b/crypto/openssh/dh.h
deleted file mode 100644
index a0c97b2ff222..000000000000
--- a/crypto/openssh/dh.h
+++ /dev/null
@@ -1,48 +0,0 @@
-/*	$OpenBSD: dh.h,v 1.7 2001/06/26 17:27:23 markus Exp $	*/
-
-/*
- * Copyright (c) 2000 Niels Provos.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#ifndef DH_H
-#define DH_H
-
-struct dhgroup {
-	int size;
-	BIGNUM *g;
-	BIGNUM *p;
-};
-
-DH	*choose_dh(int, int, int);
-DH	*dh_new_group_asc(const char *, const char *);
-DH	*dh_new_group(BIGNUM *, BIGNUM *);
-DH	*dh_new_group1(void);
-
-void	 dh_gen_key(DH *, int);
-int	 dh_pub_is_valid(DH *, BIGNUM *);
-
-int	 dh_estimate(int);
-
-#define DH_GRP_MIN	1024
-#define DH_GRP_MAX	8192
-
-#endif
diff --git a/crypto/openssh/dispatch.c b/crypto/openssh/dispatch.c
deleted file mode 100644
index ce32bc22f21e..000000000000
--- a/crypto/openssh/dispatch.c
+++ /dev/null
@@ -1,99 +0,0 @@
-/*
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#include "includes.h"
-RCSID("$OpenBSD: dispatch.c,v 1.15 2002/01/11 13:39:36 markus Exp $");
-
-#include "ssh1.h"
-#include "ssh2.h"
-#include "log.h"
-#include "dispatch.h"
-#include "packet.h"
-#include "compat.h"
-
-#define DISPATCH_MIN	0
-#define DISPATCH_MAX	255
-
-dispatch_fn *dispatch[DISPATCH_MAX];
-
-void
-dispatch_protocol_error(int type, u_int32_t seq, void *ctxt)
-{
-	log("dispatch_protocol_error: type %d seq %u", type, seq);
-	if (!compat20)
-		fatal("protocol error");
-	packet_start(SSH2_MSG_UNIMPLEMENTED);
-	packet_put_int(seq);
-	packet_send();
-	packet_write_wait();
-}
-void
-dispatch_protocol_ignore(int type, u_int32_t seq, void *ctxt)
-{
-	log("dispatch_protocol_ignore: type %d seq %u", type, seq);
-}
-void
-dispatch_init(dispatch_fn *dflt)
-{
-	u_int i;
-	for (i = 0; i < DISPATCH_MAX; i++)
-		dispatch[i] = dflt;
-}
-void
-dispatch_range(u_int from, u_int to, dispatch_fn *fn)
-{
-	u_int i;
-
-	for (i = from; i <= to; i++) {
-		if (i >= DISPATCH_MAX)
-			break;
-		dispatch[i] = fn;
-	}
-}
-void
-dispatch_set(int type, dispatch_fn *fn)
-{
-	dispatch[type] = fn;
-}
-void
-dispatch_run(int mode, int *done, void *ctxt)
-{
-	for (;;) {
-		int type;
-		u_int32_t seqnr;
-
-		if (mode == DISPATCH_BLOCK) {
-			type = packet_read_seqnr(&seqnr);
-		} else {
-			type = packet_read_poll_seqnr(&seqnr);
-			if (type == SSH_MSG_NONE)
-				return;
-		}
-		if (type > 0 && type < DISPATCH_MAX && dispatch[type] != NULL)
-			(*dispatch[type])(type, seqnr, ctxt);
-		else
-			packet_disconnect("protocol error: rcvd type %d", type);
-		if (done != NULL && *done)
-			return;
-	}
-}
diff --git a/crypto/openssh/dispatch.h b/crypto/openssh/dispatch.h
deleted file mode 100644
index a82e2165b356..000000000000
--- a/crypto/openssh/dispatch.h
+++ /dev/null
@@ -1,38 +0,0 @@
-/*	$OpenBSD: dispatch.h,v 1.9 2002/01/11 13:39:36 markus Exp $	*/
-
-/*
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-enum {
-	DISPATCH_BLOCK,
-	DISPATCH_NONBLOCK
-};
-
-typedef void dispatch_fn(int, u_int32_t, void *);
-
-void	 dispatch_init(dispatch_fn *);
-void	 dispatch_set(int, dispatch_fn *);
-void	 dispatch_range(u_int, u_int, dispatch_fn *);
-void	 dispatch_run(int, int *, void *);
-void	 dispatch_protocol_error(int, u_int32_t, void *);
-void	 dispatch_protocol_ignore(int, u_int32_t, void *);
diff --git a/crypto/openssh/dsa.c b/crypto/openssh/dsa.c
deleted file mode 100644
index 4ff4b58f2b49..000000000000
--- a/crypto/openssh/dsa.c
+++ /dev/null
@@ -1,304 +0,0 @@
-/*
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: dsa.c,v 1.11 2000/09/07 20:27:51 deraadt Exp $");
-
-#include "ssh.h"
-#include "xmalloc.h"
-#include "buffer.h"
-#include "bufaux.h"
-#include "compat.h"
-
-#include <openssl/bn.h>
-#include <openssl/dh.h>
-#include <openssl/rsa.h>
-#include <openssl/dsa.h>
-#include <openssl/evp.h>
-#include <openssl/bio.h>
-#include <openssl/pem.h>
-
-#include <openssl/hmac.h>
-#include "kex.h"
-#include "key.h"
-#include "uuencode.h"
-
-#define INTBLOB_LEN	20
-#define SIGBLOB_LEN	(2*INTBLOB_LEN)
-
-Key *
-dsa_key_from_blob(char *blob, int blen)
-{
-	Buffer b;
-	char *ktype;
-	int rlen;
-	DSA *dsa;
-	Key *key;
-
-#ifdef DEBUG_DSS
-	dump_base64(stderr, blob, blen);
-#endif
-	/* fetch & parse DSA/DSS pubkey */
-	buffer_init(&b);
-	buffer_append(&b, blob, blen);
-	ktype = buffer_get_string(&b, NULL);
-	if (strcmp(KEX_DSS, ktype) != 0) {
-		error("dsa_key_from_blob: cannot handle type %s", ktype);
-		buffer_free(&b);
-		xfree(ktype);
-		return NULL;
-	}
-	key = key_new(KEY_DSA);
-	dsa = key->dsa;
-	buffer_get_bignum2(&b, dsa->p);
-	buffer_get_bignum2(&b, dsa->q);
-	buffer_get_bignum2(&b, dsa->g);
-	buffer_get_bignum2(&b, dsa->pub_key);
-	rlen = buffer_len(&b);
-	if(rlen != 0)
-		error("dsa_key_from_blob: remaining bytes in key blob %d", rlen);
-	buffer_free(&b);
-	xfree(ktype);
-
-#ifdef DEBUG_DSS
-	DSA_print_fp(stderr, dsa, 8);
-#endif
-	return key;
-}
-int
-dsa_make_key_blob(Key *key, unsigned char **blobp, unsigned int *lenp)
-{
-	Buffer b;
-	int len;
-	unsigned char *buf;
-
-	if (key == NULL || key->type != KEY_DSA)
-		return 0;
-	buffer_init(&b);
-	buffer_put_cstring(&b, KEX_DSS);
-	buffer_put_bignum2(&b, key->dsa->p);
-	buffer_put_bignum2(&b, key->dsa->q);
-	buffer_put_bignum2(&b, key->dsa->g);
-	buffer_put_bignum2(&b, key->dsa->pub_key);
-	len = buffer_len(&b);
-	buf = xmalloc(len);
-	memcpy(buf, buffer_ptr(&b), len);
-	memset(buffer_ptr(&b), 0, len);
-	buffer_free(&b);
-	if (lenp != NULL)
-		*lenp = len;
-	if (blobp != NULL)
-		*blobp = buf;
-	return len;
-}
-int
-dsa_sign(
-    Key *key,
-    unsigned char **sigp, int *lenp,
-    unsigned char *data, int datalen)
-{
-	unsigned char *digest;
-	unsigned char *ret;
-	DSA_SIG *sig;
-	EVP_MD *evp_md = EVP_sha1();
-	EVP_MD_CTX md;
-	unsigned int rlen;
-	unsigned int slen;
-	unsigned int len;
-	unsigned char sigblob[SIGBLOB_LEN];
-	Buffer b;
-
-	if (key == NULL || key->type != KEY_DSA || key->dsa == NULL) {
-		error("dsa_sign: no DSA key");
-		return -1;
-	}
-	digest = xmalloc(evp_md->md_size);
-	EVP_DigestInit(&md, evp_md);
-	EVP_DigestUpdate(&md, data, datalen);
-	EVP_DigestFinal(&md, digest, NULL);
-
-	sig = DSA_do_sign(digest, evp_md->md_size, key->dsa);
-	if (sig == NULL) {
-		fatal("dsa_sign: cannot sign");
-	}
-
-	rlen = BN_num_bytes(sig->r);
-	slen = BN_num_bytes(sig->s);
-	if (rlen > INTBLOB_LEN || slen > INTBLOB_LEN) {
-		error("bad sig size %d %d", rlen, slen);
-		DSA_SIG_free(sig);
-		return -1;
-	}
-	debug("sig size %d %d", rlen, slen);
-
-	memset(sigblob, 0, SIGBLOB_LEN);
-	BN_bn2bin(sig->r, sigblob+ SIGBLOB_LEN - INTBLOB_LEN - rlen);
-	BN_bn2bin(sig->s, sigblob+ SIGBLOB_LEN - slen);
-	DSA_SIG_free(sig);
-
-	if (datafellows & SSH_BUG_SIGBLOB) {
-		debug("datafellows");
-		ret = xmalloc(SIGBLOB_LEN);
-		memcpy(ret, sigblob, SIGBLOB_LEN);
-		if (lenp != NULL)
-			*lenp = SIGBLOB_LEN;
-		if (sigp != NULL)
-			*sigp = ret;
-	} else {
-		/* ietf-drafts */
-		buffer_init(&b);
-		buffer_put_cstring(&b, KEX_DSS);
-		buffer_put_string(&b, sigblob, SIGBLOB_LEN);
-		len = buffer_len(&b);
-		ret = xmalloc(len);
-		memcpy(ret, buffer_ptr(&b), len);
-		buffer_free(&b);
-		if (lenp != NULL)
-			*lenp = len;
-		if (sigp != NULL)
-			*sigp = ret;
-	}
-	return 0;
-}
-int
-dsa_verify(
-    Key *key,
-    unsigned char *signature, int signaturelen,
-    unsigned char *data, int datalen)
-{
-	Buffer b;
-	unsigned char *digest;
-	DSA_SIG *sig;
-	EVP_MD *evp_md = EVP_sha1();
-	EVP_MD_CTX md;
-	unsigned char *sigblob;
-	char *txt;
-	unsigned int len;
-	int rlen;
-	int ret;
-
-	if (key == NULL || key->type != KEY_DSA || key->dsa == NULL) {
-		error("dsa_verify: no DSA key");
-		return -1;
-	}
-
-	if (!(datafellows & SSH_BUG_SIGBLOB) &&
-	    signaturelen == SIGBLOB_LEN) {
-		datafellows |= ~SSH_BUG_SIGBLOB;
-		log("autodetect SSH_BUG_SIGBLOB");
-	} else if ((datafellows & SSH_BUG_SIGBLOB) &&
-	    signaturelen != SIGBLOB_LEN) {
-		log("autoremove SSH_BUG_SIGBLOB");
-		datafellows &= ~SSH_BUG_SIGBLOB;
-	}
-
-	debug("len %d datafellows %d", signaturelen, datafellows);
-
-	/* fetch signature */
-	if (datafellows & SSH_BUG_SIGBLOB) {
-		sigblob = signature;
-		len = signaturelen;
-	} else {
-		/* ietf-drafts */
-		char *ktype;
-		buffer_init(&b);
-		buffer_append(&b, (char *) signature, signaturelen);
-		ktype = buffer_get_string(&b, NULL);
-		if (strcmp(KEX_DSS, ktype) != 0) {
-			error("dsa_verify: cannot handle type %s", ktype);
-			buffer_free(&b);
-			return -1;
-		}
-		sigblob = (unsigned char *)buffer_get_string(&b, &len);
-		rlen = buffer_len(&b);
-		if(rlen != 0) {
-			error("remaining bytes in signature %d", rlen);
-			buffer_free(&b);
-			return -1;
-		}
-		buffer_free(&b);
-		xfree(ktype);
-	}
-
-	if (len != SIGBLOB_LEN) {
-		fatal("bad sigbloblen %d != SIGBLOB_LEN", len);
-	}
-
-	/* parse signature */
-	sig = DSA_SIG_new();
-	sig->r = BN_new();
-	sig->s = BN_new();
-	BN_bin2bn(sigblob, INTBLOB_LEN, sig->r);
-	BN_bin2bn(sigblob+ INTBLOB_LEN, INTBLOB_LEN, sig->s);
-
-	if (!(datafellows & SSH_BUG_SIGBLOB)) {
-		memset(sigblob, 0, len);
-		xfree(sigblob);
-	}
-	
-	/* sha1 the data */
-	digest = xmalloc(evp_md->md_size);
-	EVP_DigestInit(&md, evp_md);
-	EVP_DigestUpdate(&md, data, datalen);
-	EVP_DigestFinal(&md, digest, NULL);
-
-	ret = DSA_do_verify(digest, evp_md->md_size, sig, key->dsa);
-
-	memset(digest, 0, evp_md->md_size);
-	xfree(digest);
-	DSA_SIG_free(sig);
-
-	switch (ret) {
-	case 1:
-		txt = "correct";
-		break;
-	case 0:
-		txt = "incorrect";
-		break;
-	case -1:
-	default:
-		txt = "error";
-		break;
-	}
-	debug("dsa_verify: signature %s", txt);
-	return ret;
-}
-
-Key *
-dsa_generate_key(unsigned int bits)
-{
-	DSA *dsa = DSA_generate_parameters(bits, NULL, 0, NULL, NULL, NULL, NULL);
-	Key *k;
-	if (dsa == NULL) {
-		fatal("DSA_generate_parameters failed");
-	}
-	if (!DSA_generate_key(dsa)) {
-		fatal("DSA_generate_keys failed");
-	}
-
-	k = key_new(KEY_EMPTY);
-	k->type = KEY_DSA;
-	k->dsa = dsa;
-	return k;
-}
diff --git a/crypto/openssh/dsa.h b/crypto/openssh/dsa.h
deleted file mode 100644
index 252e7880beb5..000000000000
--- a/crypto/openssh/dsa.h
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#ifndef DSA_H
-#define DSA_H
-
-Key	*dsa_key_from_blob(char *blob, int blen);
-int	dsa_make_key_blob(Key *key, unsigned char **blobp, unsigned int *lenp);
-
-int
-dsa_sign(
-    Key *key,
-    unsigned char **sigp, int *lenp,
-    unsigned char *data, int datalen);
-
-int
-dsa_verify(
-    Key *key,
-    unsigned char *signature, int signaturelen,
-    unsigned char *data, int datalen);
-
-Key *
-dsa_generate_key(unsigned int bits);
-
-#endif
diff --git a/crypto/openssh/entropy.c b/crypto/openssh/entropy.c
deleted file mode 100644
index dcc8689c929f..000000000000
--- a/crypto/openssh/entropy.c
+++ /dev/null
@@ -1,154 +0,0 @@
-/*
- * Copyright (c) 2001 Damien Miller.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-
-#include <openssl/rand.h>
-#include <openssl/crypto.h>
-
-#include "ssh.h"
-#include "misc.h"
-#include "xmalloc.h"
-#include "atomicio.h"
-#include "pathnames.h"
-#include "log.h"
-
-/*
- * Portable OpenSSH PRNG seeding:
- * If OpenSSL has not "internally seeded" itself (e.g. pulled data from 
- * /dev/random), then we execute a "ssh-rand-helper" program which 
- * collects entropy and writes it to stdout. The child program must 
- * write at least RANDOM_SEED_SIZE bytes. The child is run with stderr
- * attached, so error/debugging output should be visible.
- *
- * XXX: we should tell the child how many bytes we need.
- */
-
-RCSID("$Id: entropy.c,v 1.44 2002/06/09 19:41:48 mouring Exp $");
-
-#ifndef OPENSSL_PRNG_ONLY
-#define RANDOM_SEED_SIZE 48
-static uid_t original_uid, original_euid;
-#endif
-
-void
-seed_rng(void)
-{
-#ifndef OPENSSL_PRNG_ONLY
-	int devnull;
-	int p[2];
-	pid_t pid;
-	int ret;
-	unsigned char buf[RANDOM_SEED_SIZE];
-	mysig_t old_sigchld;
-
-	if (RAND_status() == 1) {
-		debug3("RNG is ready, skipping seeding");
-		return;
-	}
-
-	debug3("Seeding PRNG from %s", SSH_RAND_HELPER);
-
-	if ((devnull = open("/dev/null", O_RDWR)) == -1)
-		fatal("Couldn't open /dev/null: %s", strerror(errno));
-	if (pipe(p) == -1)
-		fatal("pipe: %s", strerror(errno));
-
-	old_sigchld = mysignal(SIGCHLD, SIG_DFL);
-	if ((pid = fork()) == -1)
-		fatal("Couldn't fork: %s", strerror(errno));
-	if (pid == 0) {
-		dup2(devnull, STDIN_FILENO);
-		dup2(p[1], STDOUT_FILENO);
-		/* Keep stderr open for errors */
-		close(p[0]);
-		close(p[1]);
-		close(devnull);
-
-		if (original_uid != original_euid && 
-		    ( seteuid(getuid()) == -1 || 
-		      setuid(original_uid) == -1) ) {
-			fprintf(stderr, "(rand child) setuid(%d): %s\n", 
-			    original_uid, strerror(errno));
-			_exit(1);
-		}
-		
-		execl(SSH_RAND_HELPER, "ssh-rand-helper", NULL);
-		fprintf(stderr, "(rand child) Couldn't exec '%s': %s\n", 
-		    SSH_RAND_HELPER, strerror(errno));
-		_exit(1);
-	}
-
-	close(devnull);
-	close(p[1]);
-
-	memset(buf, '\0', sizeof(buf));
-	ret = atomicio(read, p[0], buf, sizeof(buf));
-	if (ret == -1)
-		fatal("Couldn't read from ssh-rand-helper: %s",
-		    strerror(errno));
-	if (ret != sizeof(buf))
-		fatal("ssh-rand-helper child produced insufficient data");
-
-	close(p[0]);
-
-	if (waitpid(pid, &ret, 0) == -1)
-	       fatal("Couldn't wait for ssh-rand-helper completion: %s", 
-		   strerror(errno));
-	mysignal(SIGCHLD, old_sigchld);
-
-	/* We don't mind if the child exits upon a SIGPIPE */
-	if (!WIFEXITED(ret) && 
-	    (!WIFSIGNALED(ret) || WTERMSIG(ret) != SIGPIPE))
-		fatal("ssh-rand-helper terminated abnormally");
-	if (WEXITSTATUS(ret) != 0)
-		fatal("ssh-rand-helper exit with exit status %d", ret);
-
-	RAND_add(buf, sizeof(buf), sizeof(buf));
-	memset(buf, '\0', sizeof(buf));
-
-#endif /* OPENSSL_PRNG_ONLY */
-	if (RAND_status() != 1)
-		fatal("PRNG is not seeded");
-}
-
-void
-init_rng(void) 
-{
-	/*
-	 * OpenSSL version numbers: MNNFFPPS: major minor fix patch status
-	 * We match major, minor, fix and status (not patch)
-	 */
-	if ((SSLeay() ^ OPENSSL_VERSION_NUMBER) & ~0xff0L)
-		fatal("OpenSSL version mismatch. Built against %lx, you "
-		    "have %lx", OPENSSL_VERSION_NUMBER, SSLeay());
-
-#ifndef OPENSSL_PRNG_ONLY
-	if ((original_uid = getuid()) == -1)
-		fatal("getuid: %s", strerror(errno));
-	if ((original_euid = geteuid()) == -1)
-		fatal("geteuid: %s", strerror(errno));
-#endif
-}
-
diff --git a/crypto/openssh/entropy.h b/crypto/openssh/entropy.h
deleted file mode 100644
index 5f63c1f1fc4d..000000000000
--- a/crypto/openssh/entropy.h
+++ /dev/null
@@ -1,33 +0,0 @@
-/*
- * Copyright (c) 1999-2000 Damien Miller.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/* $Id: entropy.h,v 1.4 2001/02/09 01:55:36 djm Exp $ */
-
-#ifndef _RANDOMS_H
-#define _RANDOMS_H
-
-void seed_rng(void);
-void init_rng(void);
-
-#endif /* _RANDOMS_H */
diff --git a/crypto/openssh/fatal.c b/crypto/openssh/fatal.c
deleted file mode 100644
index 9e7d1600073f..000000000000
--- a/crypto/openssh/fatal.c
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
- * Copyright (c) 2002 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: fatal.c,v 1.1 2002/02/22 12:20:34 markus Exp $");
-
-#include "log.h"
-
-/* Fatal messages.  This function never returns. */
-
-void
-fatal(const char *fmt,...)
-{
-	va_list args;
-	va_start(args, fmt);
-	do_log(SYSLOG_LEVEL_FATAL, fmt, args);
-	va_end(args);
-	fatal_cleanup();
-}
diff --git a/crypto/openssh/fingerprint.c b/crypto/openssh/fingerprint.c
deleted file mode 100644
index 4b0966d91557..000000000000
--- a/crypto/openssh/fingerprint.c
+++ /dev/null
@@ -1,69 +0,0 @@
-/*
- * Copyright (c) 1999 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by Markus Friedl.
- * 4. The name of the author may not be used to endorse or promote products
- *    derived from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$Id: fingerprint.c,v 1.6 2000/04/12 09:39:10 markus Exp $");
-
-#include "ssh.h"
-#include "xmalloc.h"
-#include <openssl/md5.h>
-
-#define FPRINT "%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x"
-
-/*
- * Generate key fingerprint in ascii format.
- * Based on ideas and code from Bjoern Groenvall <bg@sics.se>
- */
-char *
-fingerprint(BIGNUM *e, BIGNUM *n)
-{
-	static char retval[80];
-	MD5_CTX md;
-	unsigned char d[16];
-	unsigned char *buf;
-	int nlen, elen;
-
-	nlen = BN_num_bytes(n);
-	elen = BN_num_bytes(e);
-
-	buf = xmalloc(nlen + elen);
-
-	BN_bn2bin(n, buf);
-	BN_bn2bin(e, buf + nlen);
-
-	MD5_Init(&md);
-	MD5_Update(&md, buf, nlen + elen);
-	MD5_Final(d, &md);
-	snprintf(retval, sizeof(retval), FPRINT,
-	    d[0], d[1], d[2], d[3], d[4], d[5], d[6], d[7],
-	    d[8], d[9], d[10], d[11], d[12], d[13], d[14], d[15]);
-	memset(buf, 0, nlen + elen);
-	xfree(buf);
-	return retval;
-}
diff --git a/crypto/openssh/fingerprint.h b/crypto/openssh/fingerprint.h
deleted file mode 100644
index fbb0d4c46206..000000000000
--- a/crypto/openssh/fingerprint.h
+++ /dev/null
@@ -1,34 +0,0 @@
-/*
- * Copyright (c) 1999 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by Markus Friedl.
- * 4. The name of the author may not be used to endorse or promote products
- *    derived from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-/* RCSID("$Id: fingerprint.h,v 1.3 1999/11/24 16:15:25 markus Exp $"); */
-
-#ifndef FINGERPRINT_H
-#define FINGERPRINT_H
-char   *fingerprint(BIGNUM * e, BIGNUM * n);
-#endif
diff --git a/crypto/openssh/fixpaths b/crypto/openssh/fixpaths
deleted file mode 100755
index 60a67990f173..000000000000
--- a/crypto/openssh/fixpaths
+++ /dev/null
@@ -1,22 +0,0 @@
-#!/bin/sh
-#
-# fixpaths  - substitute makefile variables into text files
-# Usage: fixpaths -Dsomething=somethingelse ...
-
-die() {
-	echo $*
-	exit -1
-}
-
-test -n "`echo $1|grep -- -D`" || \
-	die $0: nothing to do - no substitutions listed!
-
-test -n "`echo $1|grep -- '-D[^=]\+=[^ ]\+'`" || \
-	die $0: error in command line arguments.
-
-test -n "`echo $*|grep -- ' [^-]'`" || \
-	die Usage: $0 '[-Dstring=replacement] [[infile] ...]'
-
-sed `echo $*|sed -e 's/-D\([^=]\+\)=\([^ ]*\)/-e s=\1=\2=g/g'`
-
-exit 0
diff --git a/crypto/openssh/fixprogs b/crypto/openssh/fixprogs
deleted file mode 100755
index 61840cf810b7..000000000000
--- a/crypto/openssh/fixprogs
+++ /dev/null
@@ -1,72 +0,0 @@
-#!/usr/bin/perl
-#
-# fixprogs  - run through the list of entropy commands and
-#             score out the losers
-#
-
-$entscale = 50; # divisor for optional entropy measurement
-
-sub usage {
-  return("Usage: $0 <command file>\n");
-}
-
-if (($#ARGV == -1) || ($#ARGV>1)) {
-  die(&usage);
-}
-
-# 'undocumented' option - run ent (in second param) on the output
-if ($#ARGV==1) {
-  $entcmd=$ARGV[1]
-} else {
-  $entcmd = ""
-};
-
-$infilename = $ARGV[0];
-
-if (!open(IN, "<".$infilename)) {
-  die("Couldn't open input file");
-}
-$outfilename=$infilename.".out";
-if (!open(OUT, ">$outfilename")) {
-  die("Couldn't open output file $outfilename");
-}
-@infile=<IN>;
-
-select(OUT); $|=1; select(STDOUT);
-
-foreach (@infile) {
-  if (/^\s*\#/ || /^\s*$/) {
-    print OUT;
-    next;
-  }
-  ($cmd, $path, $est) = /^\"([^\"]+)\"\s+([\w\/_-]+)\s+([\d\.\-]+)/o;
-  @args = split(/ /, $cmd);
-   if (! ($pid = fork())) {
-     # child
-     close STDIN; close STDOUT; close STDERR;
-     open (STDIN,  "</dev/null");
-     open (STDOUT, ">/dev/null");
-     open (STDERR, ">/dev/null");
-     exec $path @args;
-     exit 1; # shouldn't be here
-   }
-   # parent
-   waitpid ($pid, 0); $ret=$? >> 8;
-
-  if ($ret != 0) {
-    $path = "undef";
-  } else {
-    if ($entcmd ne "") {
-      # now try to run ent on the command
-      $mostargs=join(" ", splice(@args,1));
-      print "Evaluating '$path $mostargs'\n";
-      @ent = qx{$path $mostargs | $entcmd -b -t};
-      @ent = grep(/^1,/, @ent);
-      ($null, $null, $rate) = split(/,/, $ent[0]);
-      $est = $rate / $entscale;		# scale the estimate back
-    }
-  }    
-  print OUT "\"$cmd\" $path $est\n";
-}
-
-close(IN);
diff --git a/crypto/openssh/getput.h b/crypto/openssh/getput.h
deleted file mode 100644
index 20cf8f20b30a..000000000000
--- a/crypto/openssh/getput.h
+++ /dev/null
@@ -1,58 +0,0 @@
-/*	$OpenBSD: getput.h,v 1.8 2002/03/04 17:27:39 stevesk Exp $	*/
-
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * Macros for storing and retrieving data in msb first and lsb first order.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#ifndef GETPUT_H
-#define GETPUT_H
-
-/*------------ macros for storing/extracting msb first words -------------*/
-
-#define GET_64BIT(cp) (((u_int64_t)(u_char)(cp)[0] << 56) | \
-		       ((u_int64_t)(u_char)(cp)[1] << 48) | \
-		       ((u_int64_t)(u_char)(cp)[2] << 40) | \
-		       ((u_int64_t)(u_char)(cp)[3] << 32) | \
-		       ((u_int64_t)(u_char)(cp)[4] << 24) | \
-		       ((u_int64_t)(u_char)(cp)[5] << 16) | \
-		       ((u_int64_t)(u_char)(cp)[6] << 8) | \
-		       ((u_int64_t)(u_char)(cp)[7]))
-
-#define GET_32BIT(cp) (((u_long)(u_char)(cp)[0] << 24) | \
-		       ((u_long)(u_char)(cp)[1] << 16) | \
-		       ((u_long)(u_char)(cp)[2] << 8) | \
-		       ((u_long)(u_char)(cp)[3]))
-
-#define GET_16BIT(cp) (((u_long)(u_char)(cp)[0] << 8) | \
-		       ((u_long)(u_char)(cp)[1]))
-
-#define PUT_64BIT(cp, value) do { \
-  (cp)[0] = (value) >> 56; \
-  (cp)[1] = (value) >> 48; \
-  (cp)[2] = (value) >> 40; \
-  (cp)[3] = (value) >> 32; \
-  (cp)[4] = (value) >> 24; \
-  (cp)[5] = (value) >> 16; \
-  (cp)[6] = (value) >> 8; \
-  (cp)[7] = (value); } while (0)
-
-#define PUT_32BIT(cp, value) do { \
-  (cp)[0] = (value) >> 24; \
-  (cp)[1] = (value) >> 16; \
-  (cp)[2] = (value) >> 8; \
-  (cp)[3] = (value); } while (0)
-
-#define PUT_16BIT(cp, value) do { \
-  (cp)[0] = (value) >> 8; \
-  (cp)[1] = (value); } while (0)
-
-#endif				/* GETPUT_H */
diff --git a/crypto/openssh/groupaccess.c b/crypto/openssh/groupaccess.c
deleted file mode 100644
index 66dfa68fe1f8..000000000000
--- a/crypto/openssh/groupaccess.c
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
- * Copyright (c) 2001 Kevin Steves.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: groupaccess.c,v 1.5 2002/03/04 17:27:39 stevesk Exp $");
-
-#include "groupaccess.h"
-#include "xmalloc.h"
-#include "match.h"
-#include "log.h"
-
-static int ngroups;
-static char *groups_byname[NGROUPS_MAX + 1];	/* +1 for base/primary group */
-
-/*
- * Initialize group access list for user with primary (base) and
- * supplementary groups.  Return the number of groups in the list.
- */
-int
-ga_init(const char *user, gid_t base)
-{
-	gid_t groups_bygid[NGROUPS_MAX + 1];
-	int i, j;
-	struct group *gr;
-
-	if (ngroups > 0)
-		ga_free();
-
-	ngroups = sizeof(groups_bygid) / sizeof(gid_t);
-	if (getgrouplist(user, base, groups_bygid, &ngroups) == -1)
-		log("getgrouplist: groups list too small");
-	for (i = 0, j = 0; i < ngroups; i++)
-		if ((gr = getgrgid(groups_bygid[i])) != NULL)
-			groups_byname[j++] = xstrdup(gr->gr_name);
-	return (ngroups = j);
-}
-
-/*
- * Return 1 if one of user's groups is contained in groups.
- * Return 0 otherwise.  Use match_pattern() for string comparison.
- */
-int
-ga_match(char * const *groups, int n)
-{
-	int i, j;
-
-	for (i = 0; i < ngroups; i++)
-		for (j = 0; j < n; j++)
-			if (match_pattern(groups_byname[i], groups[j]))
-				return 1;
-	return 0;
-}
-
-/*
- * Free memory allocated for group access list.
- */
-void
-ga_free(void)
-{
-	int i;
-
-	if (ngroups > 0) {
-		for (i = 0; i < ngroups; i++)
-			xfree(groups_byname[i]);
-		ngroups = 0;
-	}
-}
diff --git a/crypto/openssh/groupaccess.h b/crypto/openssh/groupaccess.h
deleted file mode 100644
index ede4805c2c24..000000000000
--- a/crypto/openssh/groupaccess.h
+++ /dev/null
@@ -1,36 +0,0 @@
-/*	$OpenBSD: groupaccess.h,v 1.4 2001/06/26 17:27:23 markus Exp $	*/
-
-/*
- * Copyright (c) 2001 Kevin Steves.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef GROUPACCESS_H
-#define GROUPACCESS_H
-
-#include <grp.h>
-
-int	 ga_init(const char *, gid_t);
-int	 ga_match(char * const *, int);
-void	 ga_free(void);
-
-#endif
diff --git a/crypto/openssh/hmac.c b/crypto/openssh/hmac.c
deleted file mode 100644
index 48a176304beb..000000000000
--- a/crypto/openssh/hmac.c
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: hmac.c,v 1.4 2000/09/07 20:27:51 deraadt Exp $");
-
-#include "xmalloc.h"
-#include "ssh.h"
-#include "getput.h"
-
-#include <openssl/hmac.h>
-
-unsigned char *
-hmac(
-    EVP_MD *evp_md,
-    unsigned int seqno,
-    unsigned char *data, int datalen,
-    unsigned char *key, int keylen)
-{
-	HMAC_CTX c;
-	static unsigned char m[EVP_MAX_MD_SIZE];
-	unsigned char b[4];
-
-	if (key == NULL)
-		fatal("hmac: no key");
-	HMAC_Init(&c, key, keylen, evp_md);
-	PUT_32BIT(b, seqno);
-	HMAC_Update(&c, b, sizeof b);
-	HMAC_Update(&c, data, datalen);
-	HMAC_Final(&c, m, NULL);
-	HMAC_cleanup(&c);
-	return(m);
-}
diff --git a/crypto/openssh/hmac.h b/crypto/openssh/hmac.h
deleted file mode 100644
index 281300e25c48..000000000000
--- a/crypto/openssh/hmac.h
+++ /dev/null
@@ -1,34 +0,0 @@
-/*
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#ifndef HMAC_H
-#define HMAC_H
-
-unsigned char *
-hmac(
-    EVP_MD *evp_md,
-    unsigned int seqno,
-    unsigned char *data, int datalen,
-    unsigned char *key, int len);
-
-#endif
diff --git a/crypto/openssh/hostfile.c b/crypto/openssh/hostfile.c
deleted file mode 100644
index dcee03448332..000000000000
--- a/crypto/openssh/hostfile.c
+++ /dev/null
@@ -1,232 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * Functions for manipulating the known hosts files.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- *
- *
- * Copyright (c) 1999, 2000 Markus Friedl.  All rights reserved.
- * Copyright (c) 1999 Niels Provos.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: hostfile.c,v 1.30 2002/07/24 16:11:18 markus Exp $");
-
-#include "packet.h"
-#include "match.h"
-#include "key.h"
-#include "hostfile.h"
-#include "log.h"
-
-/*
- * Parses an RSA (number of bits, e, n) or DSA key from a string.  Moves the
- * pointer over the key.  Skips any whitespace at the beginning and at end.
- */
-
-int
-hostfile_read_key(char **cpp, u_int *bitsp, Key *ret)
-{
-	char *cp;
-
-	/* Skip leading whitespace. */
-	for (cp = *cpp; *cp == ' ' || *cp == '\t'; cp++)
-		;
-
-	if (key_read(ret, &cp) != 1)
-		return 0;
-
-	/* Skip trailing whitespace. */
-	for (; *cp == ' ' || *cp == '\t'; cp++)
-		;
-
-	/* Return results. */
-	*cpp = cp;
-	*bitsp = key_size(ret);
-	return 1;
-}
-
-static int
-hostfile_check_key(int bits, Key *key, const char *host, const char *filename, int linenum)
-{
-	if (key == NULL || key->type != KEY_RSA1 || key->rsa == NULL)
-		return 1;
-	if (bits != BN_num_bits(key->rsa->n)) {
-		log("Warning: %s, line %d: keysize mismatch for host %s: "
-		    "actual %d vs. announced %d.",
-		    filename, linenum, host, BN_num_bits(key->rsa->n), bits);
-		log("Warning: replace %d with %d in %s, line %d.",
-		    bits, BN_num_bits(key->rsa->n), filename, linenum);
-	}
-	return 1;
-}
-
-/*
- * Checks whether the given host (which must be in all lowercase) is already
- * in the list of our known hosts. Returns HOST_OK if the host is known and
- * has the specified key, HOST_NEW if the host is not known, and HOST_CHANGED
- * if the host is known but used to have a different host key.
- *
- * If no 'key' has been specified and a key of type 'keytype' is known
- * for the specified host, then HOST_FOUND is returned.
- */
-
-static HostStatus
-check_host_in_hostfile_by_key_or_type(const char *filename,
-    const char *host, Key *key, int keytype, Key *found, int *numret)
-{
-	FILE *f;
-	char line[8192];
-	int linenum = 0;
-	u_int kbits;
-	char *cp, *cp2;
-	HostStatus end_return;
-
-	debug3("check_host_in_hostfile: filename %s", filename);
-
-	/* Open the file containing the list of known hosts. */
-	f = fopen(filename, "r");
-	if (!f)
-		return HOST_NEW;
-
-	/*
-	 * Return value when the loop terminates.  This is set to
-	 * HOST_CHANGED if we have seen a different key for the host and have
-	 * not found the proper one.
-	 */
-	end_return = HOST_NEW;
-
-	/* Go through the file. */
-	while (fgets(line, sizeof(line), f)) {
-		cp = line;
-		linenum++;
-
-		/* Skip any leading whitespace, comments and empty lines. */
-		for (; *cp == ' ' || *cp == '\t'; cp++)
-			;
-		if (!*cp || *cp == '#' || *cp == '\n')
-			continue;
-
-		/* Find the end of the host name portion. */
-		for (cp2 = cp; *cp2 && *cp2 != ' ' && *cp2 != '\t'; cp2++)
-			;
-
-		/* Check if the host name matches. */
-		if (match_hostname(host, cp, (u_int) (cp2 - cp)) != 1)
-			continue;
-
-		/* Got a match.  Skip host name. */
-		cp = cp2;
-
-		/*
-		 * Extract the key from the line.  This will skip any leading
-		 * whitespace.  Ignore badly formatted lines.
-		 */
-		if (!hostfile_read_key(&cp, &kbits, found))
-			continue;
-
-		if (numret != NULL)
-			*numret = linenum;
-
-		if (key == NULL) {
-			/* we found a key of the requested type */
-			if (found->type == keytype)
-				return HOST_FOUND;
-			continue;
-		}
-
-		if (!hostfile_check_key(kbits, found, host, filename, linenum))
-			continue;
-
-		/* Check if the current key is the same as the given key. */
-		if (key_equal(key, found)) {
-			/* Ok, they match. */
-			debug3("check_host_in_hostfile: match line %d", linenum);
-			fclose(f);
-			return HOST_OK;
-		}
-		/*
-		 * They do not match.  We will continue to go through the
-		 * file; however, we note that we will not return that it is
-		 * new.
-		 */
-		end_return = HOST_CHANGED;
-	}
-	/* Clear variables and close the file. */
-	fclose(f);
-
-	/*
-	 * Return either HOST_NEW or HOST_CHANGED, depending on whether we
-	 * saw a different key for the host.
-	 */
-	return end_return;
-}
-
-HostStatus
-check_host_in_hostfile(const char *filename, const char *host, Key *key,
-    Key *found, int *numret)
-{
-	if (key == NULL)
-		fatal("no key to look up");
-	return (check_host_in_hostfile_by_key_or_type(filename, host, key, 0,
-	    found, numret));
-}
-
-int
-lookup_key_in_hostfile_by_type(const char *filename, const char *host,
-    int keytype, Key *found, int *numret)
-{
-	return (check_host_in_hostfile_by_key_or_type(filename, host, NULL,
-	    keytype, found, numret) == HOST_FOUND);
-}
-
-/*
- * Appends an entry to the host file.  Returns false if the entry could not
- * be appended.
- */
-
-int
-add_host_to_hostfile(const char *filename, const char *host, Key *key)
-{
-	FILE *f;
-	int success = 0;
-	if (key == NULL)
-		return 1;	/* XXX ? */
-	f = fopen(filename, "a");
-	if (!f)
-		return 0;
-	fprintf(f, "%s ", host);
-	if (key_write(key, f)) {
-		success = 1;
-	} else {
-		error("add_host_to_hostfile: saving key in %s failed", filename);
-	}
-	fprintf(f, "\n");
-	fclose(f);
-	return success;
-}
diff --git a/crypto/openssh/hostfile.h b/crypto/openssh/hostfile.h
deleted file mode 100644
index e3d1165818cb..000000000000
--- a/crypto/openssh/hostfile.h
+++ /dev/null
@@ -1,28 +0,0 @@
-/*	$OpenBSD: hostfile.h,v 1.13 2002/11/21 23:03:51 deraadt Exp $	*/
-
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-#ifndef HOSTFILE_H
-#define HOSTFILE_H
-
-typedef enum {
-	HOST_OK, HOST_NEW, HOST_CHANGED, HOST_FOUND
-}       HostStatus;
-
-int	 hostfile_read_key(char **, u_int *, Key *);
-HostStatus check_host_in_hostfile(const char *, const char *,
-	    Key *, Key *, int *);
-int	add_host_to_hostfile(const char *, const char *, Key *);
-int	lookup_key_in_hostfile_by_type(const char *, const char *,
-	    int, Key *, int *);
-
-#endif
diff --git a/crypto/openssh/includes.h b/crypto/openssh/includes.h
deleted file mode 100644
index 37d402ef40d4..000000000000
--- a/crypto/openssh/includes.h
+++ /dev/null
@@ -1,175 +0,0 @@
-/*	$OpenBSD: includes.h,v 1.17 2002/01/26 16:44:22 stevesk Exp $	*/
-
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * This file includes most of the needed system headers.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#ifndef INCLUDES_H
-#define INCLUDES_H
-
-#define RCSID(msg) \
-static /**/const char *const rcsid[] = { (char *)rcsid, "\100(#)" msg }
-
-#include "config.h"
-
-#include <stdio.h>
-#include <ctype.h>
-#include <errno.h>
-#include <fcntl.h> /* For O_NONBLOCK */
-#include <signal.h>
-#include <stdlib.h>
-#include <string.h>
-#include <stdarg.h>
-#include <pwd.h>
-#include <grp.h>
-#include <time.h>
-#include <dirent.h>
-
-#ifdef HAVE_LIMITS_H
-# include <limits.h> /* For PATH_MAX */
-#endif
-#ifdef HAVE_GETOPT_H
-# include <getopt.h>
-#endif
-#ifdef HAVE_BSTRING_H
-# include <bstring.h>
-#endif
-#if defined(HAVE_GLOB_H) && defined(GLOB_HAS_ALTDIRFUNC) && \
-    defined(GLOB_HAS_GL_MATCHC)
-# include <glob.h>
-#endif
-#ifdef HAVE_NETGROUP_H
-# include <netgroup.h>
-#endif
-#if defined(HAVE_NETDB_H)
-# include <netdb.h>
-#endif
-#ifdef HAVE_ENDIAN_H
-# include <endian.h>
-#endif
-#ifdef HAVE_TTYENT_H
-# include <ttyent.h>
-#endif
-#ifdef HAVE_UTIME_H
-# include <utime.h>
-#endif
-#ifdef HAVE_MAILLOCK_H
-# include <maillock.h> /* For _PATH_MAILDIR */
-#endif
-#ifdef HAVE_NEXT
-#  include <libc.h>
-#endif
-#include <unistd.h> /* For STDIN_FILENO, etc */
-#include <termios.h> /* Struct winsize */
-
-/*
- *-*-nto-qnx needs these headers for strcasecmp and LASTLOG_FILE respectively
- */
-#ifdef HAVE_STRINGS_H
-# include <strings.h>
-#endif
-#ifdef HAVE_LOGIN_H
-# include <login.h>
-#endif
-
-#ifdef HAVE_UTMP_H
-#  include <utmp.h>
-#endif
-#ifdef HAVE_UTMPX_H
-#  ifdef HAVE_TV_IN_UTMPX
-#    include <sys/time.h>
-#  endif
-#  include <utmpx.h>
-#endif
-#ifdef HAVE_LASTLOG_H
-#  include <lastlog.h>
-#endif
-#ifdef HAVE_PATHS_H
-#  include <paths.h> /* For _PATH_XXX */
-#endif
-
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <sys/ioctl.h>
-#include <sys/wait.h>
-#ifdef HAVE_SYS_TIME_H
-# include <sys/time.h> /* For timersub */
-#endif
-#include <sys/resource.h>
-#ifdef HAVE_SYS_SELECT_H
-# include <sys/select.h>
-#endif
-#ifdef HAVE_SYS_BSDTTY_H
-# include <sys/bsdtty.h>
-#endif
-#include <sys/param.h> /* For MAXPATHLEN and roundup() */
-#ifdef HAVE_SYS_UN_H
-# include <sys/un.h> /* For sockaddr_un */
-#endif
-#ifdef HAVE_STDINT_H
-# include <stdint.h>
-#endif
-#ifdef HAVE_SYS_BITYPES_H
-# include <sys/bitypes.h> /* For u_intXX_t */
-#endif
-#ifdef HAVE_SYS_CDEFS_H
-# include <sys/cdefs.h> /* For __P() */
-#endif
-#ifdef HAVE_SYS_STAT_H
-# include <sys/stat.h> /* For S_* constants and macros */
-#endif
-#ifdef HAVE_SYS_SYSMACROS_H
-# include <sys/sysmacros.h> /* For MIN, MAX, etc */
-#endif
-#ifdef HAVE_SYS_MMAN_H
-#include <sys/mman.h> /* for MAP_ANONYMOUS */
-#endif
-
-#include <netinet/in_systm.h> /* For typedefs */
-#include <netinet/in.h> /* For IPv6 macros */
-#include <netinet/ip.h> /* For IPTOS macros */
-#include <netinet/tcp.h>
-#include <arpa/inet.h>
-#ifdef HAVE_RPC_TYPES_H
-# include <rpc/types.h> /* For INADDR_LOOPBACK */
-#endif
-#ifdef USE_PAM
-# include <security/pam_appl.h>
-#endif
-#ifdef HAVE_READPASSPHRASE_H
-# include <readpassphrase.h>
-#endif
-
-#ifdef HAVE_IA_H
-# include <ia.h>
-#endif
-
-#ifdef HAVE_TMPDIR_H
-# include <tmpdir.h>
-#endif
-
-#ifdef HAVE_LIBUTIL_H
-# include <libutil.h> /* Openpty on FreeBSD at least */
-#endif
-
-#include <openssl/opensslv.h> /* For OPENSSL_VERSION_NUMBER */
-
-#include "defines.h"
-
-#include "version.h"
-#include "openbsd-compat/openbsd-compat.h"
-#include "openbsd-compat/bsd-cygwin_util.h"
-#include "openbsd-compat/bsd-nextstep.h"
-
-#include "entropy.h"
-
-#endif /* INCLUDES_H */
diff --git a/crypto/openssh/install-sh b/crypto/openssh/install-sh
deleted file mode 100755
index e9de23842dcd..000000000000
--- a/crypto/openssh/install-sh
+++ /dev/null
@@ -1,251 +0,0 @@
-#!/bin/sh
-#
-# install - install a program, script, or datafile
-# This comes from X11R5 (mit/util/scripts/install.sh).
-#
-# Copyright 1991 by the Massachusetts Institute of Technology
-#
-# Permission to use, copy, modify, distribute, and sell this software and its
-# documentation for any purpose is hereby granted without fee, provided that
-# the above copyright notice appear in all copies and that both that
-# copyright notice and this permission notice appear in supporting
-# documentation, and that the name of M.I.T. not be used in advertising or
-# publicity pertaining to distribution of the software without specific,
-# written prior permission.  M.I.T. makes no representations about the
-# suitability of this software for any purpose.  It is provided "as is"
-# without express or implied warranty.
-#
-# Calling this script install-sh is preferred over install.sh, to prevent
-# `make' implicit rules from creating a file called install from it
-# when there is no Makefile.
-#
-# This script is compatible with the BSD install script, but was written
-# from scratch.  It can only install one file at a time, a restriction
-# shared with many OS's install programs.
-
-
-# set DOITPROG to echo to test this script
-
-# Don't use :- since 4.3BSD and earlier shells don't like it.
-doit="${DOITPROG-}"
-
-
-# put in absolute paths if you don't have them in your path; or use env. vars.
-
-mvprog="${MVPROG-mv}"
-cpprog="${CPPROG-cp}"
-chmodprog="${CHMODPROG-chmod}"
-chownprog="${CHOWNPROG-chown}"
-chgrpprog="${CHGRPPROG-chgrp}"
-stripprog="${STRIPPROG-strip}"
-rmprog="${RMPROG-rm}"
-mkdirprog="${MKDIRPROG-mkdir}"
-
-transformbasename=""
-transform_arg=""
-instcmd="$mvprog"
-chmodcmd="$chmodprog 0755"
-chowncmd=""
-chgrpcmd=""
-stripcmd=""
-rmcmd="$rmprog -f"
-mvcmd="$mvprog"
-src=""
-dst=""
-dir_arg=""
-
-while [ x"$1" != x ]; do
-    case $1 in
-	-c) instcmd="$cpprog"
-	    shift
-	    continue;;
-
-	-d) dir_arg=true
-	    shift
-	    continue;;
-
-	-m) chmodcmd="$chmodprog $2"
-	    shift
-	    shift
-	    continue;;
-
-	-o) chowncmd="$chownprog $2"
-	    shift
-	    shift
-	    continue;;
-
-	-g) chgrpcmd="$chgrpprog $2"
-	    shift
-	    shift
-	    continue;;
-
-	-s) stripcmd="$stripprog"
-	    shift
-	    continue;;
-
-	-t=*) transformarg=`echo $1 | sed 's/-t=//'`
-	    shift
-	    continue;;
-
-	-b=*) transformbasename=`echo $1 | sed 's/-b=//'`
-	    shift
-	    continue;;
-
-	*)  if [ x"$src" = x ]
-	    then
-		src=$1
-	    else
-		# this colon is to work around a 386BSD /bin/sh bug
-		:
-		dst=$1
-	    fi
-	    shift
-	    continue;;
-    esac
-done
-
-if [ x"$src" = x ]
-then
-	echo "install:	no input file specified"
-	exit 1
-else
-	true
-fi
-
-if [ x"$dir_arg" != x ]; then
-	dst=$src
-	src=""
-	
-	if [ -d $dst ]; then
-		instcmd=:
-		chmodcmd=""
-	else
-		instcmd=mkdir
-	fi
-else
-
-# Waiting for this to be detected by the "$instcmd $src $dsttmp" command
-# might cause directories to be created, which would be especially bad 
-# if $src (and thus $dsttmp) contains '*'.
-
-	if [ -f $src -o -d $src ]
-	then
-		true
-	else
-		echo "install:  $src does not exist"
-		exit 1
-	fi
-	
-	if [ x"$dst" = x ]
-	then
-		echo "install:	no destination specified"
-		exit 1
-	else
-		true
-	fi
-
-# If destination is a directory, append the input filename; if your system
-# does not like double slashes in filenames, you may need to add some logic
-
-	if [ -d $dst ]
-	then
-		dst="$dst"/`basename $src`
-	else
-		true
-	fi
-fi
-
-## this sed command emulates the dirname command
-dstdir=`echo $dst | sed -e 's,[^/]*$,,;s,/$,,;s,^$,.,'`
-
-# Make sure that the destination directory exists.
-#  this part is taken from Noah Friedman's mkinstalldirs script
-
-# Skip lots of stat calls in the usual case.
-if [ ! -d "$dstdir" ]; then
-defaultIFS='	
-'
-IFS="${IFS-${defaultIFS}}"
-
-oIFS="${IFS}"
-# Some sh's can't handle IFS=/ for some reason.
-IFS='%'
-set - `echo ${dstdir} | sed -e 's@/@%@g' -e 's@^%@/@'`
-IFS="${oIFS}"
-
-pathcomp=''
-
-while [ $# -ne 0 ] ; do
-	pathcomp="${pathcomp}${1}"
-	shift
-
-	if [ ! -d "${pathcomp}" ] ;
-        then
-		$mkdirprog "${pathcomp}"
-	else
-		true
-	fi
-
-	pathcomp="${pathcomp}/"
-done
-fi
-
-if [ x"$dir_arg" != x ]
-then
-	$doit $instcmd $dst &&
-
-	if [ x"$chowncmd" != x ]; then $doit $chowncmd $dst; else true ; fi &&
-	if [ x"$chgrpcmd" != x ]; then $doit $chgrpcmd $dst; else true ; fi &&
-	if [ x"$stripcmd" != x ]; then $doit $stripcmd $dst; else true ; fi &&
-	if [ x"$chmodcmd" != x ]; then $doit $chmodcmd $dst; else true ; fi
-else
-
-# If we're going to rename the final executable, determine the name now.
-
-	if [ x"$transformarg" = x ] 
-	then
-		dstfile=`basename $dst`
-	else
-		dstfile=`basename $dst $transformbasename | 
-			sed $transformarg`$transformbasename
-	fi
-
-# don't allow the sed command to completely eliminate the filename
-
-	if [ x"$dstfile" = x ] 
-	then
-		dstfile=`basename $dst`
-	else
-		true
-	fi
-
-# Make a temp file name in the proper directory.
-
-	dsttmp=$dstdir/#inst.$$#
-
-# Move or copy the file name to the temp name
-
-	$doit $instcmd $src $dsttmp &&
-
-	trap "rm -f ${dsttmp}" 0 &&
-
-# and set any options; do chmod last to preserve setuid bits
-
-# If any of these fail, we abort the whole thing.  If we want to
-# ignore errors from any of these, just make sure not to ignore
-# errors from the above "$doit $instcmd $src $dsttmp" command.
-
-	if [ x"$chowncmd" != x ]; then $doit $chowncmd $dsttmp; else true;fi &&
-	if [ x"$chgrpcmd" != x ]; then $doit $chgrpcmd $dsttmp; else true;fi &&
-	if [ x"$stripcmd" != x ]; then $doit $stripcmd $dsttmp; else true;fi &&
-	if [ x"$chmodcmd" != x ]; then $doit $chmodcmd $dsttmp; else true;fi &&
-
-# Now rename the file to the real destination.
-
-	$doit $rmcmd -f $dstdir/$dstfile &&
-	$doit $mvcmd $dsttmp $dstdir/$dstfile 
-
-fi &&
-
-
-exit 0
diff --git a/crypto/openssh/kex.c b/crypto/openssh/kex.c
deleted file mode 100644
index b070ccf42eb2..000000000000
--- a/crypto/openssh/kex.c
+++ /dev/null
@@ -1,498 +0,0 @@
-/*
- * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: kex.c,v 1.55 2003/04/01 10:31:26 markus Exp $");
-
-#include <openssl/crypto.h>
-
-#include "ssh2.h"
-#include "xmalloc.h"
-#include "buffer.h"
-#include "bufaux.h"
-#include "packet.h"
-#include "compat.h"
-#include "cipher.h"
-#include "kex.h"
-#include "key.h"
-#include "log.h"
-#include "mac.h"
-#include "match.h"
-#include "dispatch.h"
-#include "monitor.h"
-
-#define KEX_COOKIE_LEN	16
-
-/* prototype */
-static void kex_kexinit_finish(Kex *);
-static void kex_choose_conf(Kex *);
-
-/* put algorithm proposal into buffer */
-static void
-kex_prop2buf(Buffer *b, char *proposal[PROPOSAL_MAX])
-{
-	int i;
-
-	buffer_clear(b);
-	/*
-	 * add a dummy cookie, the cookie will be overwritten by
-	 * kex_send_kexinit(), each time a kexinit is set
-	 */
-	for (i = 0; i < KEX_COOKIE_LEN; i++)
-		buffer_put_char(b, 0);
-	for (i = 0; i < PROPOSAL_MAX; i++)
-		buffer_put_cstring(b, proposal[i]);
-	buffer_put_char(b, 0);			/* first_kex_packet_follows */
-	buffer_put_int(b, 0);			/* uint32 reserved */
-}
-
-/* parse buffer and return algorithm proposal */
-static char **
-kex_buf2prop(Buffer *raw, int *first_kex_follows)
-{
-	Buffer b;
-	int i;
-	char **proposal;
-
-	proposal = xmalloc(PROPOSAL_MAX * sizeof(char *));
-
-	buffer_init(&b);
-	buffer_append(&b, buffer_ptr(raw), buffer_len(raw));
-	/* skip cookie */
-	for (i = 0; i < KEX_COOKIE_LEN; i++)
-		buffer_get_char(&b);
-	/* extract kex init proposal strings */
-	for (i = 0; i < PROPOSAL_MAX; i++) {
-		proposal[i] = buffer_get_string(&b,NULL);
-		debug2("kex_parse_kexinit: %s", proposal[i]);
-	}
-	/* first kex follows / reserved */
-	i = buffer_get_char(&b);
-	if (first_kex_follows != NULL)
-		*first_kex_follows = i;
-	debug2("kex_parse_kexinit: first_kex_follows %d ", i);
-	i = buffer_get_int(&b);
-	debug2("kex_parse_kexinit: reserved %d ", i);
-	buffer_free(&b);
-	return proposal;
-}
-
-static void
-kex_prop_free(char **proposal)
-{
-	int i;
-
-	for (i = 0; i < PROPOSAL_MAX; i++)
-		xfree(proposal[i]);
-	xfree(proposal);
-}
-
-static void
-kex_protocol_error(int type, u_int32_t seq, void *ctxt)
-{
-	error("Hm, kex protocol error: type %d seq %u", type, seq);
-}
-
-static void
-kex_reset_dispatch(void)
-{
-	dispatch_range(SSH2_MSG_TRANSPORT_MIN,
-	    SSH2_MSG_TRANSPORT_MAX, &kex_protocol_error);
-	dispatch_set(SSH2_MSG_KEXINIT, &kex_input_kexinit);
-}
-
-void
-kex_finish(Kex *kex)
-{
-	kex_reset_dispatch();
-
-	packet_start(SSH2_MSG_NEWKEYS);
-	packet_send();
-	/* packet_write_wait(); */
-	debug("SSH2_MSG_NEWKEYS sent");
-
-	debug("expecting SSH2_MSG_NEWKEYS");
-	packet_read_expect(SSH2_MSG_NEWKEYS);
-	packet_check_eom();
-	debug("SSH2_MSG_NEWKEYS received");
-
-	kex->done = 1;
-	buffer_clear(&kex->peer);
-	/* buffer_clear(&kex->my); */
-	kex->flags &= ~KEX_INIT_SENT;
-	xfree(kex->name);
-	kex->name = NULL;
-}
-
-void
-kex_send_kexinit(Kex *kex)
-{
-	u_int32_t rand = 0;
-	u_char *cookie;
-	int i;
-
-	if (kex == NULL) {
-		error("kex_send_kexinit: no kex, cannot rekey");
-		return;
-	}
-	if (kex->flags & KEX_INIT_SENT) {
-		debug("KEX_INIT_SENT");
-		return;
-	}
-	kex->done = 0;
-
-	/* generate a random cookie */
-	if (buffer_len(&kex->my) < KEX_COOKIE_LEN)
-		fatal("kex_send_kexinit: kex proposal too short");
-	cookie = buffer_ptr(&kex->my);
-	for (i = 0; i < KEX_COOKIE_LEN; i++) {
-		if (i % 4 == 0)
-			rand = arc4random();
-		cookie[i] = rand;
-		rand >>= 8;
-	}
-	packet_start(SSH2_MSG_KEXINIT);
-	packet_put_raw(buffer_ptr(&kex->my), buffer_len(&kex->my));
-	packet_send();
-	debug("SSH2_MSG_KEXINIT sent");
-	kex->flags |= KEX_INIT_SENT;
-}
-
-void
-kex_input_kexinit(int type, u_int32_t seq, void *ctxt)
-{
-	char *ptr;
-	int dlen;
-	int i;
-	Kex *kex = (Kex *)ctxt;
-
-	debug("SSH2_MSG_KEXINIT received");
-	if (kex == NULL)
-		fatal("kex_input_kexinit: no kex, cannot rekey");
-
-	ptr = packet_get_raw(&dlen);
-	buffer_append(&kex->peer, ptr, dlen);
-
-	/* discard packet */
-	for (i = 0; i < KEX_COOKIE_LEN; i++)
-		packet_get_char();
-	for (i = 0; i < PROPOSAL_MAX; i++)
-		xfree(packet_get_string(NULL));
-	(void) packet_get_char();
-	(void) packet_get_int();
-	packet_check_eom();
-
-	kex_kexinit_finish(kex);
-}
-
-Kex *
-kex_setup(char *proposal[PROPOSAL_MAX])
-{
-	Kex *kex;
-
-	kex = xmalloc(sizeof(*kex));
-	memset(kex, 0, sizeof(*kex));
-	buffer_init(&kex->peer);
-	buffer_init(&kex->my);
-	kex_prop2buf(&kex->my, proposal);
-	kex->done = 0;
-
-	kex_send_kexinit(kex);					/* we start */
-	kex_reset_dispatch();
-
-	return kex;
-}
-
-static void
-kex_kexinit_finish(Kex *kex)
-{
-	if (!(kex->flags & KEX_INIT_SENT))
-		kex_send_kexinit(kex);
-
-	kex_choose_conf(kex);
-
-	if (kex->kex_type >= 0 && kex->kex_type < KEX_MAX &&
-	    kex->kex[kex->kex_type] != NULL) {
-		(kex->kex[kex->kex_type])(kex);
-	} else {
-		fatal("Unsupported key exchange %d", kex->kex_type);
-	}
-}
-
-static void
-choose_enc(Enc *enc, char *client, char *server)
-{
-	char *name = match_list(client, server, NULL);
-	if (name == NULL)
-		fatal("no matching cipher found: client %s server %s", client, server);
-	if ((enc->cipher = cipher_by_name(name)) == NULL)
-		fatal("matching cipher is not supported: %s", name);
-	enc->name = name;
-	enc->enabled = 0;
-	enc->iv = NULL;
-	enc->key = NULL;
-	enc->key_len = cipher_keylen(enc->cipher);
-	enc->block_size = cipher_blocksize(enc->cipher);
-}
-static void
-choose_mac(Mac *mac, char *client, char *server)
-{
-	char *name = match_list(client, server, NULL);
-	if (name == NULL)
-		fatal("no matching mac found: client %s server %s", client, server);
-	if (mac_init(mac, name) < 0)
-		fatal("unsupported mac %s", name);
-	/* truncate the key */
-	if (datafellows & SSH_BUG_HMAC)
-		mac->key_len = 16;
-	mac->name = name;
-	mac->key = NULL;
-	mac->enabled = 0;
-}
-static void
-choose_comp(Comp *comp, char *client, char *server)
-{
-	char *name = match_list(client, server, NULL);
-	if (name == NULL)
-		fatal("no matching comp found: client %s server %s", client, server);
-	if (strcmp(name, "zlib") == 0) {
-		comp->type = 1;
-	} else if (strcmp(name, "none") == 0) {
-		comp->type = 0;
-	} else {
-		fatal("unsupported comp %s", name);
-	}
-	comp->name = name;
-}
-static void
-choose_kex(Kex *k, char *client, char *server)
-{
-	k->name = match_list(client, server, NULL);
-	if (k->name == NULL)
-		fatal("no kex alg");
-	if (strcmp(k->name, KEX_DH1) == 0) {
-		k->kex_type = KEX_DH_GRP1_SHA1;
-	} else if (strcmp(k->name, KEX_DHGEX) == 0) {
-		k->kex_type = KEX_DH_GEX_SHA1;
-	} else
-		fatal("bad kex alg %s", k->name);
-}
-static void
-choose_hostkeyalg(Kex *k, char *client, char *server)
-{
-	char *hostkeyalg = match_list(client, server, NULL);
-	if (hostkeyalg == NULL)
-		fatal("no hostkey alg");
-	k->hostkey_type = key_type_from_name(hostkeyalg);
-	if (k->hostkey_type == KEY_UNSPEC)
-		fatal("bad hostkey alg '%s'", hostkeyalg);
-	xfree(hostkeyalg);
-}
-
-static int 
-proposals_match(char *my[PROPOSAL_MAX], char *peer[PROPOSAL_MAX])
-{
-	static int check[] = {
-		PROPOSAL_KEX_ALGS, PROPOSAL_SERVER_HOST_KEY_ALGS, -1
-	};
-	int *idx;
-	char *p;
-
-	for (idx = &check[0]; *idx != -1; idx++) {
-		if ((p = strchr(my[*idx], ',')) != NULL)
-			*p = '\0';
-		if ((p = strchr(peer[*idx], ',')) != NULL)
-			*p = '\0';
-		if (strcmp(my[*idx], peer[*idx]) != 0) {
-			debug2("proposal mismatch: my %s peer %s",
-			    my[*idx], peer[*idx]);
-			return (0);
-		}
-	}
-	debug2("proposals match");
-	return (1);
-}
-
-static void
-kex_choose_conf(Kex *kex)
-{
-	Newkeys *newkeys;
-	char **my, **peer;
-	char **cprop, **sprop;
-	int nenc, nmac, ncomp;
-	int mode;
-	int ctos;				/* direction: if true client-to-server */
-	int need;
-	int first_kex_follows, type;
-
-	my   = kex_buf2prop(&kex->my, NULL);
-	peer = kex_buf2prop(&kex->peer, &first_kex_follows);
-
-	if (kex->server) {
-		cprop=peer;
-		sprop=my;
-	} else {
-		cprop=my;
-		sprop=peer;
-	}
-
-	/* Algorithm Negotiation */
-	for (mode = 0; mode < MODE_MAX; mode++) {
-		newkeys = xmalloc(sizeof(*newkeys));
-		memset(newkeys, 0, sizeof(*newkeys));
-		kex->newkeys[mode] = newkeys;
-		ctos = (!kex->server && mode == MODE_OUT) || (kex->server && mode == MODE_IN);
-		nenc  = ctos ? PROPOSAL_ENC_ALGS_CTOS  : PROPOSAL_ENC_ALGS_STOC;
-		nmac  = ctos ? PROPOSAL_MAC_ALGS_CTOS  : PROPOSAL_MAC_ALGS_STOC;
-		ncomp = ctos ? PROPOSAL_COMP_ALGS_CTOS : PROPOSAL_COMP_ALGS_STOC;
-		choose_enc (&newkeys->enc,  cprop[nenc],  sprop[nenc]);
-		choose_mac (&newkeys->mac,  cprop[nmac],  sprop[nmac]);
-		choose_comp(&newkeys->comp, cprop[ncomp], sprop[ncomp]);
-		debug("kex: %s %s %s %s",
-		    ctos ? "client->server" : "server->client",
-		    newkeys->enc.name,
-		    newkeys->mac.name,
-		    newkeys->comp.name);
-	}
-	choose_kex(kex, cprop[PROPOSAL_KEX_ALGS], sprop[PROPOSAL_KEX_ALGS]);
-	choose_hostkeyalg(kex, cprop[PROPOSAL_SERVER_HOST_KEY_ALGS],
-	    sprop[PROPOSAL_SERVER_HOST_KEY_ALGS]);
-	need = 0;
-	for (mode = 0; mode < MODE_MAX; mode++) {
-		newkeys = kex->newkeys[mode];
-		if (need < newkeys->enc.key_len)
-			need = newkeys->enc.key_len;
-		if (need < newkeys->enc.block_size)
-			need = newkeys->enc.block_size;
-		if (need < newkeys->mac.key_len)
-			need = newkeys->mac.key_len;
-	}
-	/* XXX need runden? */
-	kex->we_need = need;
-
-	/* ignore the next message if the proposals do not match */
-	if (first_kex_follows && !proposals_match(my, peer) && 
-	   !(datafellows & SSH_BUG_FIRSTKEX)) {
-		type = packet_read();
-		debug2("skipping next packet (type %u)", type);
-	}
-
-	kex_prop_free(my);
-	kex_prop_free(peer);
-}
-
-static u_char *
-derive_key(Kex *kex, int id, int need, u_char *hash, BIGNUM *shared_secret)
-{
-	Buffer b;
-	const EVP_MD *evp_md = EVP_sha1();
-	EVP_MD_CTX md;
-	char c = id;
-	int have;
-	int mdsz = EVP_MD_size(evp_md);
-	u_char *digest = xmalloc(roundup(need, mdsz));
-
-	buffer_init(&b);
-	buffer_put_bignum2(&b, shared_secret);
-
-	/* K1 = HASH(K || H || "A" || session_id) */
-	EVP_DigestInit(&md, evp_md);
-	if (!(datafellows & SSH_BUG_DERIVEKEY))
-		EVP_DigestUpdate(&md, buffer_ptr(&b), buffer_len(&b));
-	EVP_DigestUpdate(&md, hash, mdsz);
-	EVP_DigestUpdate(&md, &c, 1);
-	EVP_DigestUpdate(&md, kex->session_id, kex->session_id_len);
-	EVP_DigestFinal(&md, digest, NULL);
-
-	/*
-	 * expand key:
-	 * Kn = HASH(K || H || K1 || K2 || ... || Kn-1)
-	 * Key = K1 || K2 || ... || Kn
-	 */
-	for (have = mdsz; need > have; have += mdsz) {
-		EVP_DigestInit(&md, evp_md);
-		if (!(datafellows & SSH_BUG_DERIVEKEY))
-			EVP_DigestUpdate(&md, buffer_ptr(&b), buffer_len(&b));
-		EVP_DigestUpdate(&md, hash, mdsz);
-		EVP_DigestUpdate(&md, digest, have);
-		EVP_DigestFinal(&md, digest + have, NULL);
-	}
-	buffer_free(&b);
-#ifdef DEBUG_KEX
-	fprintf(stderr, "key '%c'== ", c);
-	dump_digest("key", digest, need);
-#endif
-	return digest;
-}
-
-Newkeys *current_keys[MODE_MAX];
-
-#define NKEYS	6
-void
-kex_derive_keys(Kex *kex, u_char *hash, BIGNUM *shared_secret)
-{
-	u_char *keys[NKEYS];
-	int i, mode, ctos;
-
-	for (i = 0; i < NKEYS; i++)
-		keys[i] = derive_key(kex, 'A'+i, kex->we_need, hash, shared_secret);
-
-	debug2("kex_derive_keys");
-	for (mode = 0; mode < MODE_MAX; mode++) {
-		current_keys[mode] = kex->newkeys[mode];
-		kex->newkeys[mode] = NULL;
-		ctos = (!kex->server && mode == MODE_OUT) || (kex->server && mode == MODE_IN);
-		current_keys[mode]->enc.iv  = keys[ctos ? 0 : 1];
-		current_keys[mode]->enc.key = keys[ctos ? 2 : 3];
-		current_keys[mode]->mac.key = keys[ctos ? 4 : 5];
-	}
-}
-
-Newkeys *
-kex_get_newkeys(int mode)
-{
-	Newkeys *ret;
-
-	ret = current_keys[mode];
-	current_keys[mode] = NULL;
-	return ret;
-}
-
-#if defined(DEBUG_KEX) || defined(DEBUG_KEXDH)
-void
-dump_digest(char *msg, u_char *digest, int len)
-{
-	int i;
-
-	fprintf(stderr, "%s\n", msg);
-	for (i = 0; i< len; i++) {
-		fprintf(stderr, "%02x", digest[i]);
-		if (i%32 == 31)
-			fprintf(stderr, "\n");
-		else if (i%8 == 7)
-			fprintf(stderr, " ");
-	}
-	fprintf(stderr, "\n");
-}
-#endif
diff --git a/crypto/openssh/kex.h b/crypto/openssh/kex.h
deleted file mode 100644
index 52d442e9a7d1..000000000000
--- a/crypto/openssh/kex.h
+++ /dev/null
@@ -1,144 +0,0 @@
-/*	$OpenBSD: kex.h,v 1.33 2003/02/16 17:09:57 markus Exp $	*/
-
-/*
- * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#ifndef KEX_H
-#define KEX_H
-
-#include <openssl/evp.h>
-#include "buffer.h"
-#include "cipher.h"
-#include "key.h"
-
-#define	KEX_DH1		"diffie-hellman-group1-sha1"
-#define	KEX_DHGEX	"diffie-hellman-group-exchange-sha1"
-
-enum kex_init_proposals {
-	PROPOSAL_KEX_ALGS,
-	PROPOSAL_SERVER_HOST_KEY_ALGS,
-	PROPOSAL_ENC_ALGS_CTOS,
-	PROPOSAL_ENC_ALGS_STOC,
-	PROPOSAL_MAC_ALGS_CTOS,
-	PROPOSAL_MAC_ALGS_STOC,
-	PROPOSAL_COMP_ALGS_CTOS,
-	PROPOSAL_COMP_ALGS_STOC,
-	PROPOSAL_LANG_CTOS,
-	PROPOSAL_LANG_STOC,
-	PROPOSAL_MAX
-};
-
-enum kex_modes {
-	MODE_IN,
-	MODE_OUT,
-	MODE_MAX
-};
-
-enum kex_exchange {
-	KEX_DH_GRP1_SHA1,
-	KEX_DH_GEX_SHA1,
-	KEX_MAX
-};
-
-#define KEX_INIT_SENT	0x0001
-
-typedef struct Kex Kex;
-typedef struct Mac Mac;
-typedef struct Comp Comp;
-typedef struct Enc Enc;
-typedef struct Newkeys Newkeys;
-
-struct Enc {
-	char	*name;
-	Cipher	*cipher;
-	int	enabled;
-	u_int	key_len;
-	u_int	block_size;
-	u_char	*key;
-	u_char	*iv;
-};
-struct Mac {
-	char	*name;
-	int	enabled;
-	const EVP_MD	*md;
-	int	mac_len;
-	u_char	*key;
-	int	key_len;
-};
-struct Comp {
-	int	type;
-	int	enabled;
-	char	*name;
-};
-struct Newkeys {
-	Enc	enc;
-	Mac	mac;
-	Comp	comp;
-};
-struct Kex {
-	u_char	*session_id;
-	u_int	session_id_len;
-	Newkeys	*newkeys[MODE_MAX];
-	int	we_need;
-	int	server;
-	char	*name;
-	int	hostkey_type;
-	int	kex_type;
-	Buffer	my;
-	Buffer	peer;
-	int	done;
-	int	flags;
-	char	*client_version_string;
-	char	*server_version_string;
-	int	(*verify_host_key)(Key *);
-	Key	*(*load_host_key)(int);
-	int	(*host_key_index)(Key *);
-	void	(*kex[KEX_MAX])(Kex *);
-};
-
-Kex	*kex_setup(char *[PROPOSAL_MAX]);
-void	 kex_finish(Kex *);
-
-void	 kex_send_kexinit(Kex *);
-void	 kex_input_kexinit(int, u_int32_t, void *);
-void	 kex_derive_keys(Kex *, u_char *, BIGNUM *);
-
-Newkeys *kex_get_newkeys(int);
-
-void	 kexdh_client(Kex *);
-void	 kexdh_server(Kex *);
-void	 kexgex_client(Kex *);
-void	 kexgex_server(Kex *);
-
-u_char *
-kex_dh_hash(char *, char *, char *, int, char *, int, u_char *, int,
-    BIGNUM *, BIGNUM *, BIGNUM *);
-u_char *
-kexgex_hash(char *, char *, char *, int, char *, int, u_char *, int,
-    int, int, int, BIGNUM *, BIGNUM *, BIGNUM *, BIGNUM *, BIGNUM *);
-
-#if defined(DEBUG_KEX) || defined(DEBUG_KEXDH)
-void	dump_digest(char *, u_char *, int);
-#endif
-
-#endif
diff --git a/crypto/openssh/kexdh.c b/crypto/openssh/kexdh.c
deleted file mode 100644
index 4bbb7d1dba98..000000000000
--- a/crypto/openssh/kexdh.c
+++ /dev/null
@@ -1,81 +0,0 @@
-/*
- * Copyright (c) 2001 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: kexdh.c,v 1.19 2003/02/16 17:09:57 markus Exp $");
-
-#include <openssl/evp.h>
-
-#include "buffer.h"
-#include "bufaux.h"
-#include "ssh2.h"
-#include "kex.h"
-
-u_char *
-kex_dh_hash(
-    char *client_version_string,
-    char *server_version_string,
-    char *ckexinit, int ckexinitlen,
-    char *skexinit, int skexinitlen,
-    u_char *serverhostkeyblob, int sbloblen,
-    BIGNUM *client_dh_pub,
-    BIGNUM *server_dh_pub,
-    BIGNUM *shared_secret)
-{
-	Buffer b;
-	static u_char digest[EVP_MAX_MD_SIZE];
-	const EVP_MD *evp_md = EVP_sha1();
-	EVP_MD_CTX md;
-
-	buffer_init(&b);
-	buffer_put_cstring(&b, client_version_string);
-	buffer_put_cstring(&b, server_version_string);
-
-	/* kexinit messages: fake header: len+SSH2_MSG_KEXINIT */
-	buffer_put_int(&b, ckexinitlen+1);
-	buffer_put_char(&b, SSH2_MSG_KEXINIT);
-	buffer_append(&b, ckexinit, ckexinitlen);
-	buffer_put_int(&b, skexinitlen+1);
-	buffer_put_char(&b, SSH2_MSG_KEXINIT);
-	buffer_append(&b, skexinit, skexinitlen);
-
-	buffer_put_string(&b, serverhostkeyblob, sbloblen);
-	buffer_put_bignum2(&b, client_dh_pub);
-	buffer_put_bignum2(&b, server_dh_pub);
-	buffer_put_bignum2(&b, shared_secret);
-
-#ifdef DEBUG_KEX
-	buffer_dump(&b);
-#endif
-	EVP_DigestInit(&md, evp_md);
-	EVP_DigestUpdate(&md, buffer_ptr(&b), buffer_len(&b));
-	EVP_DigestFinal(&md, digest, NULL);
-
-	buffer_free(&b);
-
-#ifdef DEBUG_KEX
-	dump_digest("hash", digest, EVP_MD_size(evp_md));
-#endif
-	return digest;
-}
diff --git a/crypto/openssh/kexdhc.c b/crypto/openssh/kexdhc.c
deleted file mode 100644
index fe6dc53f8591..000000000000
--- a/crypto/openssh/kexdhc.c
+++ /dev/null
@@ -1,137 +0,0 @@
-/*
- * Copyright (c) 2001 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: kexdhc.c,v 1.1 2003/02/16 17:09:57 markus Exp $");
-
-#include "xmalloc.h"
-#include "key.h"
-#include "kex.h"
-#include "log.h"
-#include "packet.h"
-#include "dh.h"
-#include "ssh2.h"
-
-void
-kexdh_client(Kex *kex)
-{
-	BIGNUM *dh_server_pub = NULL, *shared_secret = NULL;
-	DH *dh;
-	Key *server_host_key;
-	u_char *server_host_key_blob = NULL, *signature = NULL;
-	u_char *kbuf, *hash;
-	u_int klen, kout, slen, sbloblen;
-
-	/* generate and send 'e', client DH public key */
-	dh = dh_new_group1();
-	dh_gen_key(dh, kex->we_need * 8);
-	packet_start(SSH2_MSG_KEXDH_INIT);
-	packet_put_bignum2(dh->pub_key);
-	packet_send();
-
-	debug("sending SSH2_MSG_KEXDH_INIT");
-#ifdef DEBUG_KEXDH
-	DHparams_print_fp(stderr, dh);
-	fprintf(stderr, "pub= ");
-	BN_print_fp(stderr, dh->pub_key);
-	fprintf(stderr, "\n");
-#endif
-
-	debug("expecting SSH2_MSG_KEXDH_REPLY");
-	packet_read_expect(SSH2_MSG_KEXDH_REPLY);
-
-	/* key, cert */
-	server_host_key_blob = packet_get_string(&sbloblen);
-	server_host_key = key_from_blob(server_host_key_blob, sbloblen);
-	if (server_host_key == NULL)
-		fatal("cannot decode server_host_key_blob");
-	if (server_host_key->type != kex->hostkey_type)
-		fatal("type mismatch for decoded server_host_key_blob");
-	if (kex->verify_host_key == NULL)
-		fatal("cannot verify server_host_key");
-	if (kex->verify_host_key(server_host_key) == -1)
-		fatal("server_host_key verification failed");
-
-	/* DH paramter f, server public DH key */
-	if ((dh_server_pub = BN_new()) == NULL)
-		fatal("dh_server_pub == NULL");
-	packet_get_bignum2(dh_server_pub);
-
-#ifdef DEBUG_KEXDH
-	fprintf(stderr, "dh_server_pub= ");
-	BN_print_fp(stderr, dh_server_pub);
-	fprintf(stderr, "\n");
-	debug("bits %d", BN_num_bits(dh_server_pub));
-#endif
-
-	/* signed H */
-	signature = packet_get_string(&slen);
-	packet_check_eom();
-
-	if (!dh_pub_is_valid(dh, dh_server_pub))
-		packet_disconnect("bad server public DH value");
-
-	klen = DH_size(dh);
-	kbuf = xmalloc(klen);
-	kout = DH_compute_key(kbuf, dh_server_pub, dh);
-#ifdef DEBUG_KEXDH
-	dump_digest("shared secret", kbuf, kout);
-#endif
-	if ((shared_secret = BN_new()) == NULL)
-		fatal("kexdh_client: BN_new failed");
-	BN_bin2bn(kbuf, kout, shared_secret);
-	memset(kbuf, 0, klen);
-	xfree(kbuf);
-
-	/* calc and verify H */
-	hash = kex_dh_hash(
-	    kex->client_version_string,
-	    kex->server_version_string,
-	    buffer_ptr(&kex->my), buffer_len(&kex->my),
-	    buffer_ptr(&kex->peer), buffer_len(&kex->peer),
-	    server_host_key_blob, sbloblen,
-	    dh->pub_key,
-	    dh_server_pub,
-	    shared_secret
-	);
-	xfree(server_host_key_blob);
-	BN_clear_free(dh_server_pub);
-	DH_free(dh);
-
-	if (key_verify(server_host_key, signature, slen, hash, 20) != 1)
-		fatal("key_verify failed for server_host_key");
-	key_free(server_host_key);
-	xfree(signature);
-
-	/* save session id */
-	if (kex->session_id == NULL) {
-		kex->session_id_len = 20;
-		kex->session_id = xmalloc(kex->session_id_len);
-		memcpy(kex->session_id, hash, kex->session_id_len);
-	}
-
-	kex_derive_keys(kex, hash, shared_secret);
-	BN_clear_free(shared_secret);
-	kex_finish(kex);
-}
diff --git a/crypto/openssh/kexdhs.c b/crypto/openssh/kexdhs.c
deleted file mode 100644
index f04bce8255c9..000000000000
--- a/crypto/openssh/kexdhs.c
+++ /dev/null
@@ -1,138 +0,0 @@
-/*
- * Copyright (c) 2001 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: kexdhs.c,v 1.1 2003/02/16 17:09:57 markus Exp $");
-
-#include "xmalloc.h"
-#include "key.h"
-#include "kex.h"
-#include "log.h"
-#include "packet.h"
-#include "dh.h"
-#include "ssh2.h"
-#include "monitor_wrap.h"
-
-void
-kexdh_server(Kex *kex)
-{
-	BIGNUM *shared_secret = NULL, *dh_client_pub = NULL;
-	DH *dh;
-	Key *server_host_key;
-	u_char *kbuf, *hash, *signature = NULL, *server_host_key_blob = NULL;
-	u_int sbloblen, klen, kout;
-	u_int slen;
-
-	/* generate server DH public key */
-	dh = dh_new_group1();
-	dh_gen_key(dh, kex->we_need * 8);
-
-	debug("expecting SSH2_MSG_KEXDH_INIT");
-	packet_read_expect(SSH2_MSG_KEXDH_INIT);
-
-	if (kex->load_host_key == NULL)
-		fatal("Cannot load hostkey");
-	server_host_key = kex->load_host_key(kex->hostkey_type);
-	if (server_host_key == NULL)
-		fatal("Unsupported hostkey type %d", kex->hostkey_type);
-
-	/* key, cert */
-	if ((dh_client_pub = BN_new()) == NULL)
-		fatal("dh_client_pub == NULL");
-	packet_get_bignum2(dh_client_pub);
-	packet_check_eom();
-
-#ifdef DEBUG_KEXDH
-	fprintf(stderr, "dh_client_pub= ");
-	BN_print_fp(stderr, dh_client_pub);
-	fprintf(stderr, "\n");
-	debug("bits %d", BN_num_bits(dh_client_pub));
-#endif
-
-#ifdef DEBUG_KEXDH
-	DHparams_print_fp(stderr, dh);
-	fprintf(stderr, "pub= ");
-	BN_print_fp(stderr, dh->pub_key);
-	fprintf(stderr, "\n");
-#endif
-	if (!dh_pub_is_valid(dh, dh_client_pub))
-		packet_disconnect("bad client public DH value");
-
-	klen = DH_size(dh);
-	kbuf = xmalloc(klen);
-	kout = DH_compute_key(kbuf, dh_client_pub, dh);
-#ifdef DEBUG_KEXDH
-	dump_digest("shared secret", kbuf, kout);
-#endif
-	if ((shared_secret = BN_new()) == NULL)
-		fatal("kexdh_server: BN_new failed");
-	BN_bin2bn(kbuf, kout, shared_secret);
-	memset(kbuf, 0, klen);
-	xfree(kbuf);
-
-	key_to_blob(server_host_key, &server_host_key_blob, &sbloblen);
-
-	/* calc H */
-	hash = kex_dh_hash(
-	    kex->client_version_string,
-	    kex->server_version_string,
-	    buffer_ptr(&kex->peer), buffer_len(&kex->peer),
-	    buffer_ptr(&kex->my), buffer_len(&kex->my),
-	    server_host_key_blob, sbloblen,
-	    dh_client_pub,
-	    dh->pub_key,
-	    shared_secret
-	);
-	BN_clear_free(dh_client_pub);
-
-	/* save session id := H */
-	/* XXX hashlen depends on KEX */
-	if (kex->session_id == NULL) {
-		kex->session_id_len = 20;
-		kex->session_id = xmalloc(kex->session_id_len);
-		memcpy(kex->session_id, hash, kex->session_id_len);
-	}
-
-	/* sign H */
-	/* XXX hashlen depends on KEX */
-	PRIVSEP(key_sign(server_host_key, &signature, &slen, hash, 20));
-
-	/* destroy_sensitive_data(); */
-
-	/* send server hostkey, DH pubkey 'f' and singed H */
-	packet_start(SSH2_MSG_KEXDH_REPLY);
-	packet_put_string(server_host_key_blob, sbloblen);
-	packet_put_bignum2(dh->pub_key);	/* f */
-	packet_put_string(signature, slen);
-	packet_send();
-
-	xfree(signature);
-	xfree(server_host_key_blob);
-	/* have keys, free DH */
-	DH_free(dh);
-
-	kex_derive_keys(kex, hash, shared_secret);
-	BN_clear_free(shared_secret);
-	kex_finish(kex);
-}
diff --git a/crypto/openssh/kexgex.c b/crypto/openssh/kexgex.c
deleted file mode 100644
index b0c39c8cbcd5..000000000000
--- a/crypto/openssh/kexgex.c
+++ /dev/null
@@ -1,92 +0,0 @@
-/*
- * Copyright (c) 2000 Niels Provos.  All rights reserved.
- * Copyright (c) 2001 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: kexgex.c,v 1.23 2003/02/16 17:09:57 markus Exp $");
-
-#include <openssl/evp.h>
-
-#include "buffer.h"
-#include "bufaux.h"
-#include "kex.h"
-#include "ssh2.h"
-
-u_char *
-kexgex_hash(
-    char *client_version_string,
-    char *server_version_string,
-    char *ckexinit, int ckexinitlen,
-    char *skexinit, int skexinitlen,
-    u_char *serverhostkeyblob, int sbloblen,
-    int min, int wantbits, int max, BIGNUM *prime, BIGNUM *gen,
-    BIGNUM *client_dh_pub,
-    BIGNUM *server_dh_pub,
-    BIGNUM *shared_secret)
-{
-	Buffer b;
-	static u_char digest[EVP_MAX_MD_SIZE];
-	const EVP_MD *evp_md = EVP_sha1();
-	EVP_MD_CTX md;
-
-	buffer_init(&b);
-	buffer_put_cstring(&b, client_version_string);
-	buffer_put_cstring(&b, server_version_string);
-
-	/* kexinit messages: fake header: len+SSH2_MSG_KEXINIT */
-	buffer_put_int(&b, ckexinitlen+1);
-	buffer_put_char(&b, SSH2_MSG_KEXINIT);
-	buffer_append(&b, ckexinit, ckexinitlen);
-	buffer_put_int(&b, skexinitlen+1);
-	buffer_put_char(&b, SSH2_MSG_KEXINIT);
-	buffer_append(&b, skexinit, skexinitlen);
-
-	buffer_put_string(&b, serverhostkeyblob, sbloblen);
-	if (min == -1 || max == -1)
-		buffer_put_int(&b, wantbits);
-	else {
-		buffer_put_int(&b, min);
-		buffer_put_int(&b, wantbits);
-		buffer_put_int(&b, max);
-	}
-	buffer_put_bignum2(&b, prime);
-	buffer_put_bignum2(&b, gen);
-	buffer_put_bignum2(&b, client_dh_pub);
-	buffer_put_bignum2(&b, server_dh_pub);
-	buffer_put_bignum2(&b, shared_secret);
-
-#ifdef DEBUG_KEXDH
-	buffer_dump(&b);
-#endif
-	EVP_DigestInit(&md, evp_md);
-	EVP_DigestUpdate(&md, buffer_ptr(&b), buffer_len(&b));
-	EVP_DigestFinal(&md, digest, NULL);
-
-	buffer_free(&b);
-
-#ifdef DEBUG_KEXDH
-	dump_digest("hash", digest, EVP_MD_size(evp_md));
-#endif
-	return digest;
-}
diff --git a/crypto/openssh/kexgexc.c b/crypto/openssh/kexgexc.c
deleted file mode 100644
index f14ac44ca043..000000000000
--- a/crypto/openssh/kexgexc.c
+++ /dev/null
@@ -1,189 +0,0 @@
-/*
- * Copyright (c) 2000 Niels Provos.  All rights reserved.
- * Copyright (c) 2001 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: kexgexc.c,v 1.1 2003/02/16 17:09:57 markus Exp $");
-
-#include "xmalloc.h"
-#include "key.h"
-#include "kex.h"
-#include "log.h"
-#include "packet.h"
-#include "dh.h"
-#include "ssh2.h"
-#include "compat.h"
-
-void
-kexgex_client(Kex *kex)
-{
-	BIGNUM *dh_server_pub = NULL, *shared_secret = NULL;
-	BIGNUM *p = NULL, *g = NULL;
-	Key *server_host_key;
-	u_char *kbuf, *hash, *signature = NULL, *server_host_key_blob = NULL;
-	u_int klen, kout, slen, sbloblen;
-	int min, max, nbits;
-	DH *dh;
-
-	nbits = dh_estimate(kex->we_need * 8);
-
-	if (datafellows & SSH_OLD_DHGEX) {
-		debug("SSH2_MSG_KEX_DH_GEX_REQUEST_OLD sent");
-
-		/* Old GEX request */
-		packet_start(SSH2_MSG_KEX_DH_GEX_REQUEST_OLD);
-		packet_put_int(nbits);
-		min = DH_GRP_MIN;
-		max = DH_GRP_MAX;
-	} else {
-		debug("SSH2_MSG_KEX_DH_GEX_REQUEST sent");
-
-		/* New GEX request */
-		min = DH_GRP_MIN;
-		max = DH_GRP_MAX;
-		packet_start(SSH2_MSG_KEX_DH_GEX_REQUEST);
-		packet_put_int(min);
-		packet_put_int(nbits);
-		packet_put_int(max);
-	}
-#ifdef DEBUG_KEXDH
-	fprintf(stderr, "\nmin = %d, nbits = %d, max = %d\n",
-	    min, nbits, max);
-#endif
-	packet_send();
-
-	debug("expecting SSH2_MSG_KEX_DH_GEX_GROUP");
-	packet_read_expect(SSH2_MSG_KEX_DH_GEX_GROUP);
-
-	if ((p = BN_new()) == NULL)
-		fatal("BN_new");
-	packet_get_bignum2(p);
-	if ((g = BN_new()) == NULL)
-		fatal("BN_new");
-	packet_get_bignum2(g);
-	packet_check_eom();
-
-	if (BN_num_bits(p) < min || BN_num_bits(p) > max)
-		fatal("DH_GEX group out of range: %d !< %d !< %d",
-		    min, BN_num_bits(p), max);
-
-	dh = dh_new_group(g, p);
-	dh_gen_key(dh, kex->we_need * 8);
-
-#ifdef DEBUG_KEXDH
-	DHparams_print_fp(stderr, dh);
-	fprintf(stderr, "pub= ");
-	BN_print_fp(stderr, dh->pub_key);
-	fprintf(stderr, "\n");
-#endif
-
-	debug("SSH2_MSG_KEX_DH_GEX_INIT sent");
-	/* generate and send 'e', client DH public key */
-	packet_start(SSH2_MSG_KEX_DH_GEX_INIT);
-	packet_put_bignum2(dh->pub_key);
-	packet_send();
-
-	debug("expecting SSH2_MSG_KEX_DH_GEX_REPLY");
-	packet_read_expect(SSH2_MSG_KEX_DH_GEX_REPLY);
-
-	/* key, cert */
-	server_host_key_blob = packet_get_string(&sbloblen);
-	server_host_key = key_from_blob(server_host_key_blob, sbloblen);
-	if (server_host_key == NULL)
-		fatal("cannot decode server_host_key_blob");
-	if (server_host_key->type != kex->hostkey_type)
-		fatal("type mismatch for decoded server_host_key_blob");
-	if (kex->verify_host_key == NULL)
-		fatal("cannot verify server_host_key");
-	if (kex->verify_host_key(server_host_key) == -1)
-		fatal("server_host_key verification failed");
-
-	/* DH paramter f, server public DH key */
-	if ((dh_server_pub = BN_new()) == NULL)
-		fatal("dh_server_pub == NULL");
-	packet_get_bignum2(dh_server_pub);
-
-#ifdef DEBUG_KEXDH
-	fprintf(stderr, "dh_server_pub= ");
-	BN_print_fp(stderr, dh_server_pub);
-	fprintf(stderr, "\n");
-	debug("bits %d", BN_num_bits(dh_server_pub));
-#endif
-
-	/* signed H */
-	signature = packet_get_string(&slen);
-	packet_check_eom();
-
-	if (!dh_pub_is_valid(dh, dh_server_pub))
-		packet_disconnect("bad server public DH value");
-
-	klen = DH_size(dh);
-	kbuf = xmalloc(klen);
-	kout = DH_compute_key(kbuf, dh_server_pub, dh);
-#ifdef DEBUG_KEXDH
-	dump_digest("shared secret", kbuf, kout);
-#endif
-	if ((shared_secret = BN_new()) == NULL)
-		fatal("kexgex_client: BN_new failed");
-	BN_bin2bn(kbuf, kout, shared_secret);
-	memset(kbuf, 0, klen);
-	xfree(kbuf);
-
-	if (datafellows & SSH_OLD_DHGEX)
-		min = max = -1;
-
-	/* calc and verify H */
-	hash = kexgex_hash(
-	    kex->client_version_string,
-	    kex->server_version_string,
-	    buffer_ptr(&kex->my), buffer_len(&kex->my),
-	    buffer_ptr(&kex->peer), buffer_len(&kex->peer),
-	    server_host_key_blob, sbloblen,
-	    min, nbits, max,
-	    dh->p, dh->g,
-	    dh->pub_key,
-	    dh_server_pub,
-	    shared_secret
-	);
-	/* have keys, free DH */
-	DH_free(dh);
-	xfree(server_host_key_blob);
-	BN_clear_free(dh_server_pub);
-
-	if (key_verify(server_host_key, signature, slen, hash, 20) != 1)
-		fatal("key_verify failed for server_host_key");
-	key_free(server_host_key);
-	xfree(signature);
-
-	/* save session id */
-	if (kex->session_id == NULL) {
-		kex->session_id_len = 20;
-		kex->session_id = xmalloc(kex->session_id_len);
-		memcpy(kex->session_id, hash, kex->session_id_len);
-	}
-	kex_derive_keys(kex, hash, shared_secret);
-	BN_clear_free(shared_secret);
-
-	kex_finish(kex);
-}
diff --git a/crypto/openssh/kexgexs.c b/crypto/openssh/kexgexs.c
deleted file mode 100644
index baebfcfb0fa8..000000000000
--- a/crypto/openssh/kexgexs.c
+++ /dev/null
@@ -1,186 +0,0 @@
-/*
- * Copyright (c) 2000 Niels Provos.  All rights reserved.
- * Copyright (c) 2001 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: kexgexs.c,v 1.1 2003/02/16 17:09:57 markus Exp $");
-
-#include "xmalloc.h"
-#include "key.h"
-#include "kex.h"
-#include "log.h"
-#include "packet.h"
-#include "dh.h"
-#include "ssh2.h"
-#include "compat.h"
-#include "monitor_wrap.h"
-
-void
-kexgex_server(Kex *kex)
-{
-	BIGNUM *shared_secret = NULL, *dh_client_pub = NULL;
-	Key *server_host_key;
-	DH *dh;
-	u_char *kbuf, *hash, *signature = NULL, *server_host_key_blob = NULL;
-	u_int sbloblen, klen, kout, slen;
-	int min = -1, max = -1, nbits = -1, type;
-
-	if (kex->load_host_key == NULL)
-		fatal("Cannot load hostkey");
-	server_host_key = kex->load_host_key(kex->hostkey_type);
-	if (server_host_key == NULL)
-		fatal("Unsupported hostkey type %d", kex->hostkey_type);
-
-	type = packet_read();
-	switch (type) {
-	case SSH2_MSG_KEX_DH_GEX_REQUEST:
-		debug("SSH2_MSG_KEX_DH_GEX_REQUEST received");
-		min = packet_get_int();
-		nbits = packet_get_int();
-		max = packet_get_int();
-		min = MAX(DH_GRP_MIN, min);
-		max = MIN(DH_GRP_MAX, max);
-		break;
-	case SSH2_MSG_KEX_DH_GEX_REQUEST_OLD:
-		debug("SSH2_MSG_KEX_DH_GEX_REQUEST_OLD received");
-		nbits = packet_get_int();
-		min = DH_GRP_MIN;
-		max = DH_GRP_MAX;
-		/* unused for old GEX */
-		break;
-	default:
-		fatal("protocol error during kex, no DH_GEX_REQUEST: %d", type);
-	}
-	packet_check_eom();
-
-	if (max < min || nbits < min || max < nbits)
-		fatal("DH_GEX_REQUEST, bad parameters: %d !< %d !< %d",
-		    min, nbits, max);
-
-	/* Contact privileged parent */
-	dh = PRIVSEP(choose_dh(min, nbits, max));
-	if (dh == NULL)
-		packet_disconnect("Protocol error: no matching DH grp found");
-
-	debug("SSH2_MSG_KEX_DH_GEX_GROUP sent");
-	packet_start(SSH2_MSG_KEX_DH_GEX_GROUP);
-	packet_put_bignum2(dh->p);
-	packet_put_bignum2(dh->g);
-	packet_send();
-
-	/* flush */
-	packet_write_wait();
-
-	/* Compute our exchange value in parallel with the client */
-	dh_gen_key(dh, kex->we_need * 8);
-
-	debug("expecting SSH2_MSG_KEX_DH_GEX_INIT");
-	packet_read_expect(SSH2_MSG_KEX_DH_GEX_INIT);
-
-	/* key, cert */
-	if ((dh_client_pub = BN_new()) == NULL)
-		fatal("dh_client_pub == NULL");
-	packet_get_bignum2(dh_client_pub);
-	packet_check_eom();
-
-#ifdef DEBUG_KEXDH
-	fprintf(stderr, "dh_client_pub= ");
-	BN_print_fp(stderr, dh_client_pub);
-	fprintf(stderr, "\n");
-	debug("bits %d", BN_num_bits(dh_client_pub));
-#endif
-
-#ifdef DEBUG_KEXDH
-	DHparams_print_fp(stderr, dh);
-	fprintf(stderr, "pub= ");
-	BN_print_fp(stderr, dh->pub_key);
-	fprintf(stderr, "\n");
-#endif
-	if (!dh_pub_is_valid(dh, dh_client_pub))
-		packet_disconnect("bad client public DH value");
-
-	klen = DH_size(dh);
-	kbuf = xmalloc(klen);
-	kout = DH_compute_key(kbuf, dh_client_pub, dh);
-#ifdef DEBUG_KEXDH
-	dump_digest("shared secret", kbuf, kout);
-#endif
-	if ((shared_secret = BN_new()) == NULL)
-		fatal("kexgex_server: BN_new failed");
-	BN_bin2bn(kbuf, kout, shared_secret);
-	memset(kbuf, 0, klen);
-	xfree(kbuf);
-
-	key_to_blob(server_host_key, &server_host_key_blob, &sbloblen);
-
-	if (type == SSH2_MSG_KEX_DH_GEX_REQUEST_OLD)
-		min = max = -1;
-
-	/* calc H */			/* XXX depends on 'kex' */
-	hash = kexgex_hash(
-	    kex->client_version_string,
-	    kex->server_version_string,
-	    buffer_ptr(&kex->peer), buffer_len(&kex->peer),
-	    buffer_ptr(&kex->my), buffer_len(&kex->my),
-	    server_host_key_blob, sbloblen,
-	    min, nbits, max,
-	    dh->p, dh->g,
-	    dh_client_pub,
-	    dh->pub_key,
-	    shared_secret
-	);
-	BN_clear_free(dh_client_pub);
-
-	/* save session id := H */
-	/* XXX hashlen depends on KEX */
-	if (kex->session_id == NULL) {
-		kex->session_id_len = 20;
-		kex->session_id = xmalloc(kex->session_id_len);
-		memcpy(kex->session_id, hash, kex->session_id_len);
-	}
-
-	/* sign H */
-	/* XXX hashlen depends on KEX */
-	PRIVSEP(key_sign(server_host_key, &signature, &slen, hash, 20));
-
-	/* destroy_sensitive_data(); */
-
-	/* send server hostkey, DH pubkey 'f' and singed H */
-	debug("SSH2_MSG_KEX_DH_GEX_REPLY sent");
-	packet_start(SSH2_MSG_KEX_DH_GEX_REPLY);
-	packet_put_string(server_host_key_blob, sbloblen);
-	packet_put_bignum2(dh->pub_key);	/* f */
-	packet_put_string(signature, slen);
-	packet_send();
-
-	xfree(signature);
-	xfree(server_host_key_blob);
-	/* have keys, free DH */
-	DH_free(dh);
-
-	kex_derive_keys(kex, hash, shared_secret);
-	BN_clear_free(shared_secret);
-
-	kex_finish(kex);
-}
diff --git a/crypto/openssh/key.c b/crypto/openssh/key.c
deleted file mode 100644
index 060b63745a3d..000000000000
--- a/crypto/openssh/key.c
+++ /dev/null
@@ -1,854 +0,0 @@
-/*
- * read_bignum():
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- *
- *
- * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#include "includes.h"
-RCSID("$OpenBSD: key.c,v 1.51 2003/02/12 09:33:04 markus Exp $");
-
-#include <openssl/evp.h>
-
-#include "xmalloc.h"
-#include "key.h"
-#include "rsa.h"
-#include "uuencode.h"
-#include "buffer.h"
-#include "bufaux.h"
-#include "log.h"
-
-Key *
-key_new(int type)
-{
-	Key *k;
-	RSA *rsa;
-	DSA *dsa;
-	k = xmalloc(sizeof(*k));
-	k->type = type;
-	k->flags = 0;
-	k->dsa = NULL;
-	k->rsa = NULL;
-	switch (k->type) {
-	case KEY_RSA1:
-	case KEY_RSA:
-		if ((rsa = RSA_new()) == NULL)
-			fatal("key_new: RSA_new failed");
-		if ((rsa->n = BN_new()) == NULL)
-			fatal("key_new: BN_new failed");
-		if ((rsa->e = BN_new()) == NULL)
-			fatal("key_new: BN_new failed");
-		k->rsa = rsa;
-		break;
-	case KEY_DSA:
-		if ((dsa = DSA_new()) == NULL)
-			fatal("key_new: DSA_new failed");
-		if ((dsa->p = BN_new()) == NULL)
-			fatal("key_new: BN_new failed");
-		if ((dsa->q = BN_new()) == NULL)
-			fatal("key_new: BN_new failed");
-		if ((dsa->g = BN_new()) == NULL)
-			fatal("key_new: BN_new failed");
-		if ((dsa->pub_key = BN_new()) == NULL)
-			fatal("key_new: BN_new failed");
-		k->dsa = dsa;
-		break;
-	case KEY_UNSPEC:
-		break;
-	default:
-		fatal("key_new: bad key type %d", k->type);
-		break;
-	}
-	return k;
-}
-
-Key *
-key_new_private(int type)
-{
-	Key *k = key_new(type);
-	switch (k->type) {
-	case KEY_RSA1:
-	case KEY_RSA:
-		if ((k->rsa->d = BN_new()) == NULL)
-			fatal("key_new_private: BN_new failed");
-		if ((k->rsa->iqmp = BN_new()) == NULL)
-			fatal("key_new_private: BN_new failed");
-		if ((k->rsa->q = BN_new()) == NULL)
-			fatal("key_new_private: BN_new failed");
-		if ((k->rsa->p = BN_new()) == NULL)
-			fatal("key_new_private: BN_new failed");
-		if ((k->rsa->dmq1 = BN_new()) == NULL)
-			fatal("key_new_private: BN_new failed");
-		if ((k->rsa->dmp1 = BN_new()) == NULL)
-			fatal("key_new_private: BN_new failed");
-		break;
-	case KEY_DSA:
-		if ((k->dsa->priv_key = BN_new()) == NULL)
-			fatal("key_new_private: BN_new failed");
-		break;
-	case KEY_UNSPEC:
-		break;
-	default:
-		break;
-	}
-	return k;
-}
-
-void
-key_free(Key *k)
-{
-	switch (k->type) {
-	case KEY_RSA1:
-	case KEY_RSA:
-		if (k->rsa != NULL)
-			RSA_free(k->rsa);
-		k->rsa = NULL;
-		break;
-	case KEY_DSA:
-		if (k->dsa != NULL)
-			DSA_free(k->dsa);
-		k->dsa = NULL;
-		break;
-	case KEY_UNSPEC:
-		break;
-	default:
-		fatal("key_free: bad key type %d", k->type);
-		break;
-	}
-	xfree(k);
-}
-int
-key_equal(Key *a, Key *b)
-{
-	if (a == NULL || b == NULL || a->type != b->type)
-		return 0;
-	switch (a->type) {
-	case KEY_RSA1:
-	case KEY_RSA:
-		return a->rsa != NULL && b->rsa != NULL &&
-		    BN_cmp(a->rsa->e, b->rsa->e) == 0 &&
-		    BN_cmp(a->rsa->n, b->rsa->n) == 0;
-		break;
-	case KEY_DSA:
-		return a->dsa != NULL && b->dsa != NULL &&
-		    BN_cmp(a->dsa->p, b->dsa->p) == 0 &&
-		    BN_cmp(a->dsa->q, b->dsa->q) == 0 &&
-		    BN_cmp(a->dsa->g, b->dsa->g) == 0 &&
-		    BN_cmp(a->dsa->pub_key, b->dsa->pub_key) == 0;
-		break;
-	default:
-		fatal("key_equal: bad key type %d", a->type);
-		break;
-	}
-	return 0;
-}
-
-static u_char *
-key_fingerprint_raw(Key *k, enum fp_type dgst_type, u_int *dgst_raw_length)
-{
-	const EVP_MD *md = NULL;
-	EVP_MD_CTX ctx;
-	u_char *blob = NULL;
-	u_char *retval = NULL;
-	u_int len = 0;
-	int nlen, elen;
-
-	*dgst_raw_length = 0;
-
-	switch (dgst_type) {
-	case SSH_FP_MD5:
-		md = EVP_md5();
-		break;
-	case SSH_FP_SHA1:
-		md = EVP_sha1();
-		break;
-	default:
-		fatal("key_fingerprint_raw: bad digest type %d",
-		    dgst_type);
-	}
-	switch (k->type) {
-	case KEY_RSA1:
-		nlen = BN_num_bytes(k->rsa->n);
-		elen = BN_num_bytes(k->rsa->e);
-		len = nlen + elen;
-		blob = xmalloc(len);
-		BN_bn2bin(k->rsa->n, blob);
-		BN_bn2bin(k->rsa->e, blob + nlen);
-		break;
-	case KEY_DSA:
-	case KEY_RSA:
-		key_to_blob(k, &blob, &len);
-		break;
-	case KEY_UNSPEC:
-		return retval;
-		break;
-	default:
-		fatal("key_fingerprint_raw: bad key type %d", k->type);
-		break;
-	}
-	if (blob != NULL) {
-		retval = xmalloc(EVP_MAX_MD_SIZE);
-		EVP_DigestInit(&ctx, md);
-		EVP_DigestUpdate(&ctx, blob, len);
-		EVP_DigestFinal(&ctx, retval, dgst_raw_length);
-		memset(blob, 0, len);
-		xfree(blob);
-	} else {
-		fatal("key_fingerprint_raw: blob is null");
-	}
-	return retval;
-}
-
-static char *
-key_fingerprint_hex(u_char *dgst_raw, u_int dgst_raw_len)
-{
-	char *retval;
-	int i;
-
-	retval = xmalloc(dgst_raw_len * 3 + 1);
-	retval[0] = '\0';
-	for (i = 0; i < dgst_raw_len; i++) {
-		char hex[4];
-		snprintf(hex, sizeof(hex), "%02x:", dgst_raw[i]);
-		strlcat(retval, hex, dgst_raw_len * 3);
-	}
-	retval[(dgst_raw_len * 3) - 1] = '\0';
-	return retval;
-}
-
-static char *
-key_fingerprint_bubblebabble(u_char *dgst_raw, u_int dgst_raw_len)
-{
-	char vowels[] = { 'a', 'e', 'i', 'o', 'u', 'y' };
-	char consonants[] = { 'b', 'c', 'd', 'f', 'g', 'h', 'k', 'l', 'm',
-	    'n', 'p', 'r', 's', 't', 'v', 'z', 'x' };
-	u_int i, j = 0, rounds, seed = 1;
-	char *retval;
-
-	rounds = (dgst_raw_len / 2) + 1;
-	retval = xmalloc(sizeof(char) * (rounds*6));
-	retval[j++] = 'x';
-	for (i = 0; i < rounds; i++) {
-		u_int idx0, idx1, idx2, idx3, idx4;
-		if ((i + 1 < rounds) || (dgst_raw_len % 2 != 0)) {
-			idx0 = (((((u_int)(dgst_raw[2 * i])) >> 6) & 3) +
-			    seed) % 6;
-			idx1 = (((u_int)(dgst_raw[2 * i])) >> 2) & 15;
-			idx2 = ((((u_int)(dgst_raw[2 * i])) & 3) +
-			    (seed / 6)) % 6;
-			retval[j++] = vowels[idx0];
-			retval[j++] = consonants[idx1];
-			retval[j++] = vowels[idx2];
-			if ((i + 1) < rounds) {
-				idx3 = (((u_int)(dgst_raw[(2 * i) + 1])) >> 4) & 15;
-				idx4 = (((u_int)(dgst_raw[(2 * i) + 1]))) & 15;
-				retval[j++] = consonants[idx3];
-				retval[j++] = '-';
-				retval[j++] = consonants[idx4];
-				seed = ((seed * 5) +
-				    ((((u_int)(dgst_raw[2 * i])) * 7) +
-				    ((u_int)(dgst_raw[(2 * i) + 1])))) % 36;
-			}
-		} else {
-			idx0 = seed % 6;
-			idx1 = 16;
-			idx2 = seed / 6;
-			retval[j++] = vowels[idx0];
-			retval[j++] = consonants[idx1];
-			retval[j++] = vowels[idx2];
-		}
-	}
-	retval[j++] = 'x';
-	retval[j++] = '\0';
-	return retval;
-}
-
-char *
-key_fingerprint(Key *k, enum fp_type dgst_type, enum fp_rep dgst_rep)
-{
-	char *retval = NULL;
-	u_char *dgst_raw;
-	u_int dgst_raw_len;
-
-	dgst_raw = key_fingerprint_raw(k, dgst_type, &dgst_raw_len);
-	if (!dgst_raw)
-		fatal("key_fingerprint: null from key_fingerprint_raw()");
-	switch (dgst_rep) {
-	case SSH_FP_HEX:
-		retval = key_fingerprint_hex(dgst_raw, dgst_raw_len);
-		break;
-	case SSH_FP_BUBBLEBABBLE:
-		retval = key_fingerprint_bubblebabble(dgst_raw, dgst_raw_len);
-		break;
-	default:
-		fatal("key_fingerprint_ex: bad digest representation %d",
-		    dgst_rep);
-		break;
-	}
-	memset(dgst_raw, 0, dgst_raw_len);
-	xfree(dgst_raw);
-	return retval;
-}
-
-/*
- * Reads a multiple-precision integer in decimal from the buffer, and advances
- * the pointer.  The integer must already be initialized.  This function is
- * permitted to modify the buffer.  This leaves *cpp to point just beyond the
- * last processed (and maybe modified) character.  Note that this may modify
- * the buffer containing the number.
- */
-static int
-read_bignum(char **cpp, BIGNUM * value)
-{
-	char *cp = *cpp;
-	int old;
-
-	/* Skip any leading whitespace. */
-	for (; *cp == ' ' || *cp == '\t'; cp++)
-		;
-
-	/* Check that it begins with a decimal digit. */
-	if (*cp < '0' || *cp > '9')
-		return 0;
-
-	/* Save starting position. */
-	*cpp = cp;
-
-	/* Move forward until all decimal digits skipped. */
-	for (; *cp >= '0' && *cp <= '9'; cp++)
-		;
-
-	/* Save the old terminating character, and replace it by \0. */
-	old = *cp;
-	*cp = 0;
-
-	/* Parse the number. */
-	if (BN_dec2bn(&value, *cpp) == 0)
-		return 0;
-
-	/* Restore old terminating character. */
-	*cp = old;
-
-	/* Move beyond the number and return success. */
-	*cpp = cp;
-	return 1;
-}
-
-static int
-write_bignum(FILE *f, BIGNUM *num)
-{
-	char *buf = BN_bn2dec(num);
-	if (buf == NULL) {
-		error("write_bignum: BN_bn2dec() failed");
-		return 0;
-	}
-	fprintf(f, " %s", buf);
-	OPENSSL_free(buf);
-	return 1;
-}
-
-/* returns 1 ok, -1 error */
-int
-key_read(Key *ret, char **cpp)
-{
-	Key *k;
-	int success = -1;
-	char *cp, *space;
-	int len, n, type;
-	u_int bits;
-	u_char *blob;
-
-	cp = *cpp;
-
-	switch (ret->type) {
-	case KEY_RSA1:
-		/* Get number of bits. */
-		if (*cp < '0' || *cp > '9')
-			return -1;	/* Bad bit count... */
-		for (bits = 0; *cp >= '0' && *cp <= '9'; cp++)
-			bits = 10 * bits + *cp - '0';
-		if (bits == 0)
-			return -1;
-		*cpp = cp;
-		/* Get public exponent, public modulus. */
-		if (!read_bignum(cpp, ret->rsa->e))
-			return -1;
-		if (!read_bignum(cpp, ret->rsa->n))
-			return -1;
-		success = 1;
-		break;
-	case KEY_UNSPEC:
-	case KEY_RSA:
-	case KEY_DSA:
-		space = strchr(cp, ' ');
-		if (space == NULL) {
-			debug3("key_read: missing whitespace");
-			return -1;
-		}
-		*space = '\0';
-		type = key_type_from_name(cp);
-		*space = ' ';
-		if (type == KEY_UNSPEC) {
-			debug3("key_read: missing keytype");
-			return -1;
-		}
-		cp = space+1;
-		if (*cp == '\0') {
-			debug3("key_read: short string");
-			return -1;
-		}
-		if (ret->type == KEY_UNSPEC) {
-			ret->type = type;
-		} else if (ret->type != type) {
-			/* is a key, but different type */
-			debug3("key_read: type mismatch");
-			return -1;
-		}
-		len = 2*strlen(cp);
-		blob = xmalloc(len);
-		n = uudecode(cp, blob, len);
-		if (n < 0) {
-			error("key_read: uudecode %s failed", cp);
-			xfree(blob);
-			return -1;
-		}
-		k = key_from_blob(blob, n);
-		xfree(blob);
-		if (k == NULL) {
-			error("key_read: key_from_blob %s failed", cp);
-			return -1;
-		}
-		if (k->type != type) {
-			error("key_read: type mismatch: encoding error");
-			key_free(k);
-			return -1;
-		}
-/*XXXX*/
-		if (ret->type == KEY_RSA) {
-			if (ret->rsa != NULL)
-				RSA_free(ret->rsa);
-			ret->rsa = k->rsa;
-			k->rsa = NULL;
-			success = 1;
-#ifdef DEBUG_PK
-			RSA_print_fp(stderr, ret->rsa, 8);
-#endif
-		} else {
-			if (ret->dsa != NULL)
-				DSA_free(ret->dsa);
-			ret->dsa = k->dsa;
-			k->dsa = NULL;
-			success = 1;
-#ifdef DEBUG_PK
-			DSA_print_fp(stderr, ret->dsa, 8);
-#endif
-		}
-/*XXXX*/
-		key_free(k);
-		if (success != 1)
-			break;
-		/* advance cp: skip whitespace and data */
-		while (*cp == ' ' || *cp == '\t')
-			cp++;
-		while (*cp != '\0' && *cp != ' ' && *cp != '\t')
-			cp++;
-		*cpp = cp;
-		break;
-	default:
-		fatal("key_read: bad key type: %d", ret->type);
-		break;
-	}
-	return success;
-}
-
-int
-key_write(Key *key, FILE *f)
-{
-	int n, success = 0;
-	u_int len, bits = 0;
-	u_char *blob;
-	char *uu;
-
-	if (key->type == KEY_RSA1 && key->rsa != NULL) {
-		/* size of modulus 'n' */
-		bits = BN_num_bits(key->rsa->n);
-		fprintf(f, "%u", bits);
-		if (write_bignum(f, key->rsa->e) &&
-		    write_bignum(f, key->rsa->n)) {
-			success = 1;
-		} else {
-			error("key_write: failed for RSA key");
-		}
-	} else if ((key->type == KEY_DSA && key->dsa != NULL) ||
-	    (key->type == KEY_RSA && key->rsa != NULL)) {
-		key_to_blob(key, &blob, &len);
-		uu = xmalloc(2*len);
-		n = uuencode(blob, len, uu, 2*len);
-		if (n > 0) {
-			fprintf(f, "%s %s", key_ssh_name(key), uu);
-			success = 1;
-		}
-		xfree(blob);
-		xfree(uu);
-	}
-	return success;
-}
-
-char *
-key_type(Key *k)
-{
-	switch (k->type) {
-	case KEY_RSA1:
-		return "RSA1";
-		break;
-	case KEY_RSA:
-		return "RSA";
-		break;
-	case KEY_DSA:
-		return "DSA";
-		break;
-	}
-	return "unknown";
-}
-
-char *
-key_ssh_name(Key *k)
-{
-	switch (k->type) {
-	case KEY_RSA:
-		return "ssh-rsa";
-		break;
-	case KEY_DSA:
-		return "ssh-dss";
-		break;
-	}
-	return "ssh-unknown";
-}
-
-u_int
-key_size(Key *k)
-{
-	switch (k->type) {
-	case KEY_RSA1:
-	case KEY_RSA:
-		return BN_num_bits(k->rsa->n);
-		break;
-	case KEY_DSA:
-		return BN_num_bits(k->dsa->p);
-		break;
-	}
-	return 0;
-}
-
-static RSA *
-rsa_generate_private_key(u_int bits)
-{
-	RSA *private;
-	private = RSA_generate_key(bits, 35, NULL, NULL);
-	if (private == NULL)
-		fatal("rsa_generate_private_key: key generation failed.");
-	return private;
-}
-
-static DSA*
-dsa_generate_private_key(u_int bits)
-{
-	DSA *private = DSA_generate_parameters(bits, NULL, 0, NULL, NULL, NULL, NULL);
-	if (private == NULL)
-		fatal("dsa_generate_private_key: DSA_generate_parameters failed");
-	if (!DSA_generate_key(private))
-		fatal("dsa_generate_private_key: DSA_generate_key failed.");
-	if (private == NULL)
-		fatal("dsa_generate_private_key: NULL.");
-	return private;
-}
-
-Key *
-key_generate(int type, u_int bits)
-{
-	Key *k = key_new(KEY_UNSPEC);
-	switch (type) {
-	case KEY_DSA:
-		k->dsa = dsa_generate_private_key(bits);
-		break;
-	case KEY_RSA:
-	case KEY_RSA1:
-		k->rsa = rsa_generate_private_key(bits);
-		break;
-	default:
-		fatal("key_generate: unknown type %d", type);
-	}
-	k->type = type;
-	return k;
-}
-
-Key *
-key_from_private(Key *k)
-{
-	Key *n = NULL;
-	switch (k->type) {
-	case KEY_DSA:
-		n = key_new(k->type);
-		BN_copy(n->dsa->p, k->dsa->p);
-		BN_copy(n->dsa->q, k->dsa->q);
-		BN_copy(n->dsa->g, k->dsa->g);
-		BN_copy(n->dsa->pub_key, k->dsa->pub_key);
-		break;
-	case KEY_RSA:
-	case KEY_RSA1:
-		n = key_new(k->type);
-		BN_copy(n->rsa->n, k->rsa->n);
-		BN_copy(n->rsa->e, k->rsa->e);
-		break;
-	default:
-		fatal("key_from_private: unknown type %d", k->type);
-		break;
-	}
-	return n;
-}
-
-int
-key_type_from_name(char *name)
-{
-	if (strcmp(name, "rsa1") == 0) {
-		return KEY_RSA1;
-	} else if (strcmp(name, "rsa") == 0) {
-		return KEY_RSA;
-	} else if (strcmp(name, "dsa") == 0) {
-		return KEY_DSA;
-	} else if (strcmp(name, "ssh-rsa") == 0) {
-		return KEY_RSA;
-	} else if (strcmp(name, "ssh-dss") == 0) {
-		return KEY_DSA;
-	}
-	debug2("key_type_from_name: unknown key type '%s'", name);
-	return KEY_UNSPEC;
-}
-
-int
-key_names_valid2(const char *names)
-{
-	char *s, *cp, *p;
-
-	if (names == NULL || strcmp(names, "") == 0)
-		return 0;
-	s = cp = xstrdup(names);
-	for ((p = strsep(&cp, ",")); p && *p != '\0';
-	    (p = strsep(&cp, ","))) {
-		switch (key_type_from_name(p)) {
-		case KEY_RSA1:
-		case KEY_UNSPEC:
-			xfree(s);
-			return 0;
-		}
-	}
-	debug3("key names ok: [%s]", names);
-	xfree(s);
-	return 1;
-}
-
-Key *
-key_from_blob(u_char *blob, int blen)
-{
-	Buffer b;
-	char *ktype;
-	int rlen, type;
-	Key *key = NULL;
-
-#ifdef DEBUG_PK
-	dump_base64(stderr, blob, blen);
-#endif
-	buffer_init(&b);
-	buffer_append(&b, blob, blen);
-	ktype = buffer_get_string(&b, NULL);
-	type = key_type_from_name(ktype);
-
-	switch (type) {
-	case KEY_RSA:
-		key = key_new(type);
-		buffer_get_bignum2(&b, key->rsa->e);
-		buffer_get_bignum2(&b, key->rsa->n);
-#ifdef DEBUG_PK
-		RSA_print_fp(stderr, key->rsa, 8);
-#endif
-		break;
-	case KEY_DSA:
-		key = key_new(type);
-		buffer_get_bignum2(&b, key->dsa->p);
-		buffer_get_bignum2(&b, key->dsa->q);
-		buffer_get_bignum2(&b, key->dsa->g);
-		buffer_get_bignum2(&b, key->dsa->pub_key);
-#ifdef DEBUG_PK
-		DSA_print_fp(stderr, key->dsa, 8);
-#endif
-		break;
-	case KEY_UNSPEC:
-		key = key_new(type);
-		break;
-	default:
-		error("key_from_blob: cannot handle type %s", ktype);
-		break;
-	}
-	rlen = buffer_len(&b);
-	if (key != NULL && rlen != 0)
-		error("key_from_blob: remaining bytes in key blob %d", rlen);
-	xfree(ktype);
-	buffer_free(&b);
-	return key;
-}
-
-int
-key_to_blob(Key *key, u_char **blobp, u_int *lenp)
-{
-	Buffer b;
-	int len;
-
-	if (key == NULL) {
-		error("key_to_blob: key == NULL");
-		return 0;
-	}
-	buffer_init(&b);
-	switch (key->type) {
-	case KEY_DSA:
-		buffer_put_cstring(&b, key_ssh_name(key));
-		buffer_put_bignum2(&b, key->dsa->p);
-		buffer_put_bignum2(&b, key->dsa->q);
-		buffer_put_bignum2(&b, key->dsa->g);
-		buffer_put_bignum2(&b, key->dsa->pub_key);
-		break;
-	case KEY_RSA:
-		buffer_put_cstring(&b, key_ssh_name(key));
-		buffer_put_bignum2(&b, key->rsa->e);
-		buffer_put_bignum2(&b, key->rsa->n);
-		break;
-	default:
-		error("key_to_blob: unsupported key type %d", key->type);
-		buffer_free(&b);
-		return 0;
-	}
-	len = buffer_len(&b);
-	if (lenp != NULL)
-		*lenp = len;
-	if (blobp != NULL) {
-		*blobp = xmalloc(len);
-		memcpy(*blobp, buffer_ptr(&b), len);
-	}
-	memset(buffer_ptr(&b), 0, len);
-	buffer_free(&b);
-	return len;
-}
-
-int
-key_sign(
-    Key *key,
-    u_char **sigp, u_int *lenp,
-    u_char *data, u_int datalen)
-{
-	switch (key->type) {
-	case KEY_DSA:
-		return ssh_dss_sign(key, sigp, lenp, data, datalen);
-		break;
-	case KEY_RSA:
-		return ssh_rsa_sign(key, sigp, lenp, data, datalen);
-		break;
-	default:
-		error("key_sign: illegal key type %d", key->type);
-		return -1;
-		break;
-	}
-}
-
-/*
- * key_verify returns 1 for a correct signature, 0 for an incorrect signature
- * and -1 on error.
- */
-int
-key_verify(
-    Key *key,
-    u_char *signature, u_int signaturelen,
-    u_char *data, u_int datalen)
-{
-	if (signaturelen == 0)
-		return -1;
-
-	switch (key->type) {
-	case KEY_DSA:
-		return ssh_dss_verify(key, signature, signaturelen, data, datalen);
-		break;
-	case KEY_RSA:
-		return ssh_rsa_verify(key, signature, signaturelen, data, datalen);
-		break;
-	default:
-		error("key_verify: illegal key type %d", key->type);
-		return -1;
-		break;
-	}
-}
-
-/* Converts a private to a public key */
-Key *
-key_demote(Key *k)
-{
-	Key *pk;
-
-	pk = xmalloc(sizeof(*pk));
-	pk->type = k->type;
-	pk->flags = k->flags;
-	pk->dsa = NULL;
-	pk->rsa = NULL;
-
-	switch (k->type) {
-	case KEY_RSA1:
-	case KEY_RSA:
-		if ((pk->rsa = RSA_new()) == NULL)
-			fatal("key_demote: RSA_new failed");
-		if ((pk->rsa->e = BN_dup(k->rsa->e)) == NULL)
-			fatal("key_demote: BN_dup failed");
-		if ((pk->rsa->n = BN_dup(k->rsa->n)) == NULL)
-			fatal("key_demote: BN_dup failed");
-		break;
-	case KEY_DSA:
-		if ((pk->dsa = DSA_new()) == NULL)
-			fatal("key_demote: DSA_new failed");
-		if ((pk->dsa->p = BN_dup(k->dsa->p)) == NULL)
-			fatal("key_demote: BN_dup failed");
-		if ((pk->dsa->q = BN_dup(k->dsa->q)) == NULL)
-			fatal("key_demote: BN_dup failed");
-		if ((pk->dsa->g = BN_dup(k->dsa->g)) == NULL)
-			fatal("key_demote: BN_dup failed");
-		if ((pk->dsa->pub_key = BN_dup(k->dsa->pub_key)) == NULL)
-			fatal("key_demote: BN_dup failed");
-		break;
-	default:
-		fatal("key_free: bad key type %d", k->type);
-		break;
-	}
-
-	return (pk);
-}
diff --git a/crypto/openssh/key.h b/crypto/openssh/key.h
deleted file mode 100644
index 725c7a04a7bf..000000000000
--- a/crypto/openssh/key.h
+++ /dev/null
@@ -1,86 +0,0 @@
-/*	$OpenBSD: key.h,v 1.20 2003/02/12 09:33:04 markus Exp $	*/
-
-/*
- * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#ifndef KEY_H
-#define KEY_H
-
-#include <openssl/rsa.h>
-#include <openssl/dsa.h>
-
-typedef struct Key Key;
-enum types {
-	KEY_RSA1,
-	KEY_RSA,
-	KEY_DSA,
-	KEY_UNSPEC
-};
-enum fp_type {
-	SSH_FP_SHA1,
-	SSH_FP_MD5
-};
-enum fp_rep {
-	SSH_FP_HEX,
-	SSH_FP_BUBBLEBABBLE
-};
-
-/* key is stored in external hardware */
-#define KEY_FLAG_EXT		0x0001
-
-struct Key {
-	int	 type;
-	int	 flags;
-	RSA	*rsa;
-	DSA	*dsa;
-};
-
-Key	*key_new(int);
-Key	*key_new_private(int);
-void	 key_free(Key *);
-Key	*key_demote(Key *);
-int	 key_equal(Key *, Key *);
-char	*key_fingerprint(Key *, enum fp_type, enum fp_rep);
-char	*key_type(Key *);
-int	 key_write(Key *, FILE *);
-int	 key_read(Key *, char **);
-u_int	 key_size(Key *);
-
-Key	*key_generate(int, u_int);
-Key	*key_from_private(Key *);
-int	 key_type_from_name(char *);
-
-Key	*key_from_blob(u_char *, int);
-int	 key_to_blob(Key *, u_char **, u_int *);
-char	*key_ssh_name(Key *);
-int	 key_names_valid2(const char *);
-
-int	 key_sign(Key *, u_char **, u_int *, u_char *, u_int);
-int	 key_verify(Key *, u_char *, u_int, u_char *, u_int);
-
-int	 ssh_dss_sign(Key *, u_char **, u_int *, u_char *, u_int);
-int	 ssh_dss_verify(Key *, u_char *, u_int, u_char *, u_int);
-int	 ssh_rsa_sign(Key *, u_char **, u_int *, u_char *, u_int);
-int	 ssh_rsa_verify(Key *, u_char *, u_int, u_char *, u_int);
-
-#endif
diff --git a/crypto/openssh/lib/Makefile b/crypto/openssh/lib/Makefile
deleted file mode 100644
index ac950a9ac3af..000000000000
--- a/crypto/openssh/lib/Makefile
+++ /dev/null
@@ -1,35 +0,0 @@
-#	$OpenBSD: Makefile,v 1.36 2002/06/11 15:23:29 hin Exp $
-
-.PATH:		${.CURDIR}/..
-
-LIB=	ssh
-SRCS=	authfd.c authfile.c bufaux.c buffer.c canohost.c channels.c \
-	cipher.c compat.c compress.c crc32.c deattack.c fatal.c \
-	hostfile.c log.c match.c mpaux.c nchan.c packet.c readpass.c \
-	rsa.c tildexpand.c ttymodes.c xmalloc.c atomicio.c \
-	key.c dispatch.c kex.c mac.c uuencode.c misc.c \
-	rijndael.c ssh-dss.c ssh-rsa.c dh.c kexdh.c kexgex.c \
-	scard.c monitor_wrap.c monitor_fdpass.c msg.c
-
-DEBUGLIBS= no
-NOPROFILE= yes
-NOPIC=	yes
-
-install:
-	@echo -n
-
-.include <bsd.own.mk>
-
-.if (${KERBEROS5:L} == "yes")
-CFLAGS+= -DKRB5 -I${DESTDIR}/usr/include/kerberosV
-.endif # KERBEROS5
-
-.if (${KERBEROS:L} == "yes")
-CFLAGS+= -DKRB4 -I${DESTDIR}/usr/include/kerberosIV
-.if (${AFS:L} == "yes")
-CFLAGS+= -DAFS
-SRCS+=  radix.c
-.endif # AFS
-.endif # KERBEROS
-
-.include <bsd.lib.mk>
diff --git a/crypto/openssh/log-client.c b/crypto/openssh/log-client.c
deleted file mode 100644
index 505c8c33787a..000000000000
--- a/crypto/openssh/log-client.c
+++ /dev/null
@@ -1,84 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * Client-side versions of debug(), log(), etc.  These print to stderr.
- * This is a stripped down version of log-server.c.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- *
- *
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: log-client.c,v 1.12 2000/09/12 20:53:10 markus Exp $");
-
-#include "xmalloc.h"
-#include "ssh.h"
-
-static LogLevel log_level = SYSLOG_LEVEL_INFO;
-
-/* Initialize the log.
- *   av0	program name (should be argv[0])
- *   level	logging level
- */
-
-void
-log_init(char *av0, LogLevel level, SyslogFacility ignored1, int ignored2)
-{
-	switch (level) {
-	case SYSLOG_LEVEL_QUIET:
-	case SYSLOG_LEVEL_ERROR:
-	case SYSLOG_LEVEL_FATAL:
-	case SYSLOG_LEVEL_INFO:
-	case SYSLOG_LEVEL_VERBOSE:
-	case SYSLOG_LEVEL_DEBUG1:
-	case SYSLOG_LEVEL_DEBUG2:
-	case SYSLOG_LEVEL_DEBUG3:
-		log_level = level;
-		break;
-	default:
-		/* unchanged */
-		break;
-	}
-}
-
-#define MSGBUFSIZ 1024
-
-void
-do_log(LogLevel level, const char *fmt, va_list args)
-{
-	char msgbuf[MSGBUFSIZ];
-
-	if (level > log_level)
-		return;
-	if (level >= SYSLOG_LEVEL_DEBUG1)
-		fprintf(stderr, "debug: ");
-	vsnprintf(msgbuf, sizeof(msgbuf), fmt, args);
-	fprintf(stderr, "%s\r\n", msgbuf);
-}
diff --git a/crypto/openssh/log-server.c b/crypto/openssh/log-server.c
deleted file mode 100644
index de3d5cfeb970..000000000000
--- a/crypto/openssh/log-server.c
+++ /dev/null
@@ -1,173 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * Server-side versions of debug(), log(), etc.  These normally send the output
- * to the system log.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- *
- *
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: log-server.c,v 1.17 2000/09/12 20:53:10 markus Exp $");
-
-#include <syslog.h>
-#include "packet.h"
-#include "xmalloc.h"
-#include "ssh.h"
-
-static LogLevel log_level = SYSLOG_LEVEL_INFO;
-static int log_on_stderr = 0;
-static int log_facility = LOG_AUTH;
-
-/* Initialize the log.
- *   av0	program name (should be argv[0])
- *   on_stderr	print also on stderr
- *   level	logging level
- */
-
-void
-log_init(char *av0, LogLevel level, SyslogFacility facility, int on_stderr)
-{
-	switch (level) {
-	case SYSLOG_LEVEL_QUIET:
-	case SYSLOG_LEVEL_ERROR:
-	case SYSLOG_LEVEL_FATAL:
-	case SYSLOG_LEVEL_INFO:
-	case SYSLOG_LEVEL_VERBOSE:
-	case SYSLOG_LEVEL_DEBUG1:
-	case SYSLOG_LEVEL_DEBUG2:
-	case SYSLOG_LEVEL_DEBUG3:
-		log_level = level;
-		break;
-	default:
-		fprintf(stderr, "Unrecognized internal syslog level code %d\n",
-			(int) level);
-		exit(1);
-	}
-	switch (facility) {
-	case SYSLOG_FACILITY_DAEMON:
-		log_facility = LOG_DAEMON;
-		break;
-	case SYSLOG_FACILITY_USER:
-		log_facility = LOG_USER;
-		break;
-	case SYSLOG_FACILITY_AUTH:
-		log_facility = LOG_AUTH;
-		break;
-	case SYSLOG_FACILITY_LOCAL0:
-		log_facility = LOG_LOCAL0;
-		break;
-	case SYSLOG_FACILITY_LOCAL1:
-		log_facility = LOG_LOCAL1;
-		break;
-	case SYSLOG_FACILITY_LOCAL2:
-		log_facility = LOG_LOCAL2;
-		break;
-	case SYSLOG_FACILITY_LOCAL3:
-		log_facility = LOG_LOCAL3;
-		break;
-	case SYSLOG_FACILITY_LOCAL4:
-		log_facility = LOG_LOCAL4;
-		break;
-	case SYSLOG_FACILITY_LOCAL5:
-		log_facility = LOG_LOCAL5;
-		break;
-	case SYSLOG_FACILITY_LOCAL6:
-		log_facility = LOG_LOCAL6;
-		break;
-	case SYSLOG_FACILITY_LOCAL7:
-		log_facility = LOG_LOCAL7;
-		break;
-	default:
-		fprintf(stderr, "Unrecognized internal syslog facility code %d\n",
-			(int) facility);
-		exit(1);
-	}
-	log_on_stderr = on_stderr;
-}
-
-#define MSGBUFSIZ 1024
-
-void
-do_log(LogLevel level, const char *fmt, va_list args)
-{
-	char msgbuf[MSGBUFSIZ];
-	char fmtbuf[MSGBUFSIZ];
-	char *txt = NULL;
-	int pri = LOG_INFO;
-	extern char *__progname;
-
-	if (level > log_level)
-		return;
-	switch (level) {
-	case SYSLOG_LEVEL_ERROR:
-		txt = "error";
-		pri = LOG_ERR;
-		break;
-	case SYSLOG_LEVEL_FATAL:
-		txt = "fatal";
-		pri = LOG_ERR;
-		break;
-	case SYSLOG_LEVEL_INFO:
-	case SYSLOG_LEVEL_VERBOSE:
-		pri = LOG_INFO;
-		break;
-	case SYSLOG_LEVEL_DEBUG1:
-		txt = "debug1";
-		pri = LOG_DEBUG;
-		break;
-	case SYSLOG_LEVEL_DEBUG2:
-		txt = "debug2";
-		pri = LOG_DEBUG;
-		break;
-	case SYSLOG_LEVEL_DEBUG3:
-		txt = "debug3";
-		pri = LOG_DEBUG;
-		break;
-	default:
-		txt = "internal error";
-		pri = LOG_ERR;
-		break;
-	}
-	if (txt != NULL) {
-		snprintf(fmtbuf, sizeof(fmtbuf), "%s: %s", txt, fmt);
-		vsnprintf(msgbuf, sizeof(msgbuf), fmtbuf, args);
-	} else {
-		vsnprintf(msgbuf, sizeof(msgbuf), fmt, args);
-	}
-	if (log_on_stderr) {
-		fprintf(stderr, "%s\n", msgbuf);
-	} else {
-		openlog(__progname, LOG_PID, log_facility);
-		syslog(pri, "%.500s", msgbuf);
-		closelog();
-	}
-}
diff --git a/crypto/openssh/log.c b/crypto/openssh/log.c
deleted file mode 100644
index 84e4ce0ac105..000000000000
--- a/crypto/openssh/log.c
+++ /dev/null
@@ -1,400 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-/*
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: log.c,v 1.25 2003/01/11 18:29:43 markus Exp $");
-
-#include "log.h"
-#include "xmalloc.h"
-
-#include <syslog.h>
-
-static LogLevel log_level = SYSLOG_LEVEL_INFO;
-static int log_on_stderr = 1;
-static int log_facility = LOG_AUTH;
-static char *argv0;
-
-extern char *__progname;
-
-/* textual representation of log-facilities/levels */
-
-static struct {
-	const char *name;
-	SyslogFacility val;
-} log_facilities[] = {
-	{ "DAEMON",	SYSLOG_FACILITY_DAEMON },
-	{ "USER",	SYSLOG_FACILITY_USER },
-	{ "AUTH",	SYSLOG_FACILITY_AUTH },
-#ifdef LOG_AUTHPRIV
-	{ "AUTHPRIV",	SYSLOG_FACILITY_AUTHPRIV },
-#endif
-	{ "LOCAL0",	SYSLOG_FACILITY_LOCAL0 },
-	{ "LOCAL1",	SYSLOG_FACILITY_LOCAL1 },
-	{ "LOCAL2",	SYSLOG_FACILITY_LOCAL2 },
-	{ "LOCAL3",	SYSLOG_FACILITY_LOCAL3 },
-	{ "LOCAL4",	SYSLOG_FACILITY_LOCAL4 },
-	{ "LOCAL5",	SYSLOG_FACILITY_LOCAL5 },
-	{ "LOCAL6",	SYSLOG_FACILITY_LOCAL6 },
-	{ "LOCAL7",	SYSLOG_FACILITY_LOCAL7 },
-	{ NULL,		SYSLOG_FACILITY_NOT_SET }
-};
-
-static struct {
-	const char *name;
-	LogLevel val;
-} log_levels[] =
-{
-	{ "QUIET",	SYSLOG_LEVEL_QUIET },
-	{ "FATAL",	SYSLOG_LEVEL_FATAL },
-	{ "ERROR",	SYSLOG_LEVEL_ERROR },
-	{ "INFO",	SYSLOG_LEVEL_INFO },
-	{ "VERBOSE",	SYSLOG_LEVEL_VERBOSE },
-	{ "DEBUG",	SYSLOG_LEVEL_DEBUG1 },
-	{ "DEBUG1",	SYSLOG_LEVEL_DEBUG1 },
-	{ "DEBUG2",	SYSLOG_LEVEL_DEBUG2 },
-	{ "DEBUG3",	SYSLOG_LEVEL_DEBUG3 },
-	{ NULL,		SYSLOG_LEVEL_NOT_SET }
-};
-
-SyslogFacility
-log_facility_number(char *name)
-{
-	int i;
-
-	if (name != NULL)
-		for (i = 0; log_facilities[i].name; i++)
-			if (strcasecmp(log_facilities[i].name, name) == 0)
-				return log_facilities[i].val;
-	return SYSLOG_FACILITY_NOT_SET;
-}
-
-LogLevel
-log_level_number(char *name)
-{
-	int i;
-
-	if (name != NULL)
-		for (i = 0; log_levels[i].name; i++)
-			if (strcasecmp(log_levels[i].name, name) == 0)
-				return log_levels[i].val;
-	return SYSLOG_LEVEL_NOT_SET;
-}
-
-/* Error messages that should be logged. */
-
-void
-error(const char *fmt,...)
-{
-	va_list args;
-
-	va_start(args, fmt);
-	do_log(SYSLOG_LEVEL_ERROR, fmt, args);
-	va_end(args);
-}
-
-/* Log this message (information that usually should go to the log). */
-
-void
-log(const char *fmt,...)
-{
-	va_list args;
-
-	va_start(args, fmt);
-	do_log(SYSLOG_LEVEL_INFO, fmt, args);
-	va_end(args);
-}
-
-/* More detailed messages (information that does not need to go to the log). */
-
-void
-verbose(const char *fmt,...)
-{
-	va_list args;
-
-	va_start(args, fmt);
-	do_log(SYSLOG_LEVEL_VERBOSE, fmt, args);
-	va_end(args);
-}
-
-/* Debugging messages that should not be logged during normal operation. */
-
-void
-debug(const char *fmt,...)
-{
-	va_list args;
-
-	va_start(args, fmt);
-	do_log(SYSLOG_LEVEL_DEBUG1, fmt, args);
-	va_end(args);
-}
-
-void
-debug2(const char *fmt,...)
-{
-	va_list args;
-
-	va_start(args, fmt);
-	do_log(SYSLOG_LEVEL_DEBUG2, fmt, args);
-	va_end(args);
-}
-
-void
-debug3(const char *fmt,...)
-{
-	va_list args;
-
-	va_start(args, fmt);
-	do_log(SYSLOG_LEVEL_DEBUG3, fmt, args);
-	va_end(args);
-}
-
-/* Fatal cleanup */
-
-struct fatal_cleanup {
-	struct fatal_cleanup *next;
-	void (*proc) (void *);
-	void *context;
-};
-
-static struct fatal_cleanup *fatal_cleanups = NULL;
-
-/* Registers a cleanup function to be called by fatal() before exiting. */
-
-void
-fatal_add_cleanup(void (*proc) (void *), void *context)
-{
-	struct fatal_cleanup *cu;
-
-	cu = xmalloc(sizeof(*cu));
-	cu->proc = proc;
-	cu->context = context;
-	cu->next = fatal_cleanups;
-	fatal_cleanups = cu;
-}
-
-/* Removes a cleanup frunction to be called at fatal(). */
-
-void
-fatal_remove_cleanup(void (*proc) (void *context), void *context)
-{
-	struct fatal_cleanup **cup, *cu;
-
-	for (cup = &fatal_cleanups; *cup; cup = &cu->next) {
-		cu = *cup;
-		if (cu->proc == proc && cu->context == context) {
-			*cup = cu->next;
-			xfree(cu);
-			return;
-		}
-	}
-	fatal("fatal_remove_cleanup: no such cleanup function: 0x%lx 0x%lx",
-	    (u_long) proc, (u_long) context);
-}
-
-/* Remove all cleanups, to be called after fork() */
-void
-fatal_remove_all_cleanups(void)
-{
-	struct fatal_cleanup *cu, *next_cu;
-
-	for (cu = fatal_cleanups; cu; cu = next_cu) {
-		next_cu = cu->next;
-		xfree(cu);
-	}
-	fatal_cleanups = NULL;
-}
-
-/* Cleanup and exit */
-void
-fatal_cleanup(void)
-{
-	struct fatal_cleanup *cu, *next_cu;
-	static int called = 0;
-
-	if (called)
-		exit(255);
-	called = 1;
-	/* Call cleanup functions. */
-	for (cu = fatal_cleanups; cu; cu = next_cu) {
-		next_cu = cu->next;
-		debug("Calling cleanup 0x%lx(0x%lx)",
-		    (u_long) cu->proc, (u_long) cu->context);
-		(*cu->proc) (cu->context);
-	}
-	exit(255);
-}
-
-
-/*
- * Initialize the log.
- */
-
-void
-log_init(char *av0, LogLevel level, SyslogFacility facility, int on_stderr)
-{
-	argv0 = av0;
-
-	switch (level) {
-	case SYSLOG_LEVEL_QUIET:
-	case SYSLOG_LEVEL_FATAL:
-	case SYSLOG_LEVEL_ERROR:
-	case SYSLOG_LEVEL_INFO:
-	case SYSLOG_LEVEL_VERBOSE:
-	case SYSLOG_LEVEL_DEBUG1:
-	case SYSLOG_LEVEL_DEBUG2:
-	case SYSLOG_LEVEL_DEBUG3:
-		log_level = level;
-		break;
-	default:
-		fprintf(stderr, "Unrecognized internal syslog level code %d\n",
-		    (int) level);
-		exit(1);
-	}
-
-	log_on_stderr = on_stderr;
-	if (on_stderr)
-		return;
-
-	switch (facility) {
-	case SYSLOG_FACILITY_DAEMON:
-		log_facility = LOG_DAEMON;
-		break;
-	case SYSLOG_FACILITY_USER:
-		log_facility = LOG_USER;
-		break;
-	case SYSLOG_FACILITY_AUTH:
-		log_facility = LOG_AUTH;
-		break;
-#ifdef LOG_AUTHPRIV
-	case SYSLOG_FACILITY_AUTHPRIV:
-		log_facility = LOG_AUTHPRIV;
-		break;
-#endif
-	case SYSLOG_FACILITY_LOCAL0:
-		log_facility = LOG_LOCAL0;
-		break;
-	case SYSLOG_FACILITY_LOCAL1:
-		log_facility = LOG_LOCAL1;
-		break;
-	case SYSLOG_FACILITY_LOCAL2:
-		log_facility = LOG_LOCAL2;
-		break;
-	case SYSLOG_FACILITY_LOCAL3:
-		log_facility = LOG_LOCAL3;
-		break;
-	case SYSLOG_FACILITY_LOCAL4:
-		log_facility = LOG_LOCAL4;
-		break;
-	case SYSLOG_FACILITY_LOCAL5:
-		log_facility = LOG_LOCAL5;
-		break;
-	case SYSLOG_FACILITY_LOCAL6:
-		log_facility = LOG_LOCAL6;
-		break;
-	case SYSLOG_FACILITY_LOCAL7:
-		log_facility = LOG_LOCAL7;
-		break;
-	default:
-		fprintf(stderr,
-		    "Unrecognized internal syslog facility code %d\n",
-		    (int) facility);
-		exit(1);
-	}
-}
-
-#define MSGBUFSIZ 1024
-
-void
-do_log(LogLevel level, const char *fmt, va_list args)
-{
-	char msgbuf[MSGBUFSIZ];
-	char fmtbuf[MSGBUFSIZ];
-	char *txt = NULL;
-	int pri = LOG_INFO;
-
-	if (level > log_level)
-		return;
-
-	switch (level) {
-	case SYSLOG_LEVEL_FATAL:
-		if (!log_on_stderr)
-			txt = "fatal";
-		pri = LOG_CRIT;
-		break;
-	case SYSLOG_LEVEL_ERROR:
-		if (!log_on_stderr)
-			txt = "error";
-		pri = LOG_ERR;
-		break;
-	case SYSLOG_LEVEL_INFO:
-		pri = LOG_INFO;
-		break;
-	case SYSLOG_LEVEL_VERBOSE:
-		pri = LOG_INFO;
-		break;
-	case SYSLOG_LEVEL_DEBUG1:
-		txt = "debug1";
-		pri = LOG_DEBUG;
-		break;
-	case SYSLOG_LEVEL_DEBUG2:
-		txt = "debug2";
-		pri = LOG_DEBUG;
-		break;
-	case SYSLOG_LEVEL_DEBUG3:
-		txt = "debug3";
-		pri = LOG_DEBUG;
-		break;
-	default:
-		txt = "internal error";
-		pri = LOG_ERR;
-		break;
-	}
-	if (txt != NULL) {
-		snprintf(fmtbuf, sizeof(fmtbuf), "%s: %s", txt, fmt);
-		vsnprintf(msgbuf, sizeof(msgbuf), fmtbuf, args);
-	} else {
-		vsnprintf(msgbuf, sizeof(msgbuf), fmt, args);
-	}
-	/* Escape magic chars in output. */
-	strnvis(fmtbuf, msgbuf, sizeof(fmtbuf), VIS_OCTAL);
-	
-	if (log_on_stderr) {
-		fprintf(stderr, "%s\r\n", fmtbuf);
-	} else {
-		openlog(argv0 ? argv0 : __progname, LOG_PID, log_facility);
-		syslog(pri, "%.500s", fmtbuf);
-		closelog();
-	}
-}
diff --git a/crypto/openssh/log.h b/crypto/openssh/log.h
deleted file mode 100644
index 917fafa69179..000000000000
--- a/crypto/openssh/log.h
+++ /dev/null
@@ -1,71 +0,0 @@
-/*	$OpenBSD: log.h,v 1.8 2002/07/19 15:43:33 markus Exp $	*/
-
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#ifndef SSH_LOG_H
-#define SSH_LOG_H
-
-#include <syslog.h> /* Needed for LOG_AUTHPRIV (if present) */
-
-/* Supported syslog facilities and levels. */
-typedef enum {
-	SYSLOG_FACILITY_DAEMON,
-	SYSLOG_FACILITY_USER,
-	SYSLOG_FACILITY_AUTH,
-#ifdef LOG_AUTHPRIV
-	SYSLOG_FACILITY_AUTHPRIV,
-#endif
-	SYSLOG_FACILITY_LOCAL0,
-	SYSLOG_FACILITY_LOCAL1,
-	SYSLOG_FACILITY_LOCAL2,
-	SYSLOG_FACILITY_LOCAL3,
-	SYSLOG_FACILITY_LOCAL4,
-	SYSLOG_FACILITY_LOCAL5,
-	SYSLOG_FACILITY_LOCAL6,
-	SYSLOG_FACILITY_LOCAL7,
-	SYSLOG_FACILITY_NOT_SET = -1
-}       SyslogFacility;
-
-typedef enum {
-	SYSLOG_LEVEL_QUIET,
-	SYSLOG_LEVEL_FATAL,
-	SYSLOG_LEVEL_ERROR,
-	SYSLOG_LEVEL_INFO,
-	SYSLOG_LEVEL_VERBOSE,
-	SYSLOG_LEVEL_DEBUG1,
-	SYSLOG_LEVEL_DEBUG2,
-	SYSLOG_LEVEL_DEBUG3,
-	SYSLOG_LEVEL_NOT_SET = -1
-}       LogLevel;
-
-void     log_init(char *, LogLevel, SyslogFacility, int);
-
-SyslogFacility	log_facility_number(char *);
-LogLevel log_level_number(char *);
-
-void     fatal(const char *, ...) __attribute__((format(printf, 1, 2)));
-void     error(const char *, ...) __attribute__((format(printf, 1, 2)));
-void     log(const char *, ...) __attribute__((format(printf, 1, 2)));
-void     verbose(const char *, ...) __attribute__((format(printf, 1, 2)));
-void     debug(const char *, ...) __attribute__((format(printf, 1, 2)));
-void     debug2(const char *, ...) __attribute__((format(printf, 1, 2)));
-void     debug3(const char *, ...) __attribute__((format(printf, 1, 2)));
-
-void     fatal_cleanup(void);
-void     fatal_add_cleanup(void (*) (void *), void *);
-void     fatal_remove_cleanup(void (*) (void *), void *);
-void     fatal_remove_all_cleanups(void);
-
-void	 do_log(LogLevel, const char *, va_list);
-
-#endif
diff --git a/crypto/openssh/login.c b/crypto/openssh/login.c
deleted file mode 100644
index 1d59cd825f73..000000000000
--- a/crypto/openssh/login.c
+++ /dev/null
@@ -1,145 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * This file performs some of the things login(1) normally does.  We cannot
- * easily use something like login -p -h host -f user, because there are
- * several different logins around, and it is hard to determined what kind of
- * login the current system has.  Also, we want to be able to execute commands
- * on a tty.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- *
- * Copyright (c) 1999 Theo de Raadt.  All rights reserved.
- * Copyright (c) 1999 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: login.c,v 1.15 2000/09/07 20:27:52 deraadt Exp $");
-
-#include <util.h>
-#include <utmp.h>
-#include "ssh.h"
-
-/*
- * Returns the time when the user last logged in.  Returns 0 if the
- * information is not available.  This must be called before record_login.
- * The host the user logged in from will be returned in buf.
- */
-
-/*
- * Returns the time when the user last logged in (or 0 if no previous login
- * is found).  The name of the host used last time is returned in buf.
- */
-
-unsigned long
-get_last_login_time(uid_t uid, const char *logname,
-		    char *buf, unsigned int bufsize)
-{
-	struct lastlog ll;
-	char *lastlog;
-	int fd;
-
-	lastlog = _PATH_LASTLOG;
-	buf[0] = '\0';
-
-	fd = open(lastlog, O_RDONLY);
-	if (fd < 0)
-		return 0;
-	lseek(fd, (off_t) ((long) uid * sizeof(ll)), SEEK_SET);
-	if (read(fd, &ll, sizeof(ll)) != sizeof(ll)) {
-		close(fd);
-		return 0;
-	}
-	close(fd);
-	if (bufsize > sizeof(ll.ll_host) + 1)
-		bufsize = sizeof(ll.ll_host) + 1;
-	strncpy(buf, ll.ll_host, bufsize - 1);
-	buf[bufsize - 1] = 0;
-	return ll.ll_time;
-}
-
-/*
- * Records that the user has logged in.  I these parts of operating systems
- * were more standardized.
- */
-
-void
-record_login(pid_t pid, const char *ttyname, const char *user, uid_t uid,
-	     const char *host, struct sockaddr * addr)
-{
-	int fd;
-	struct lastlog ll;
-	char *lastlog;
-	struct utmp u;
-	const char *utmp, *wtmp;
-
-	/* Construct an utmp/wtmp entry. */
-	memset(&u, 0, sizeof(u));
-	strncpy(u.ut_line, ttyname + 5, sizeof(u.ut_line));
-	u.ut_time = time(NULL);
-	strncpy(u.ut_name, user, sizeof(u.ut_name));
-	strncpy(u.ut_host, host, sizeof(u.ut_host));
-
-	/* Figure out the file names. */
-	utmp = _PATH_UTMP;
-	wtmp = _PATH_WTMP;
-
-	login(&u);
-	lastlog = _PATH_LASTLOG;
-
-	/* Update lastlog unless actually recording a logout. */
-	if (strcmp(user, "") != 0) {
-		/*
-		 * It is safer to bzero the lastlog structure first because
-		 * some systems might have some extra fields in it (e.g. SGI)
-		 */
-		memset(&ll, 0, sizeof(ll));
-
-		/* Update lastlog. */
-		ll.ll_time = time(NULL);
-		strncpy(ll.ll_line, ttyname + 5, sizeof(ll.ll_line));
-		strncpy(ll.ll_host, host, sizeof(ll.ll_host));
-		fd = open(lastlog, O_RDWR);
-		if (fd >= 0) {
-			lseek(fd, (off_t) ((long) uid * sizeof(ll)), SEEK_SET);
-			if (write(fd, &ll, sizeof(ll)) != sizeof(ll))
-				log("Could not write %.100s: %.100s", lastlog, strerror(errno));
-			close(fd);
-		}
-	}
-}
-
-/* Records that the user has logged out. */
-
-void
-record_logout(pid_t pid, const char *ttyname)
-{
-	const char *line = ttyname + 5;	/* /dev/ttyq8 -> ttyq8 */
-	if (logout(line))
-		logwtmp(line, "", "");
-}
diff --git a/crypto/openssh/loginrec.c b/crypto/openssh/loginrec.c
deleted file mode 100644
index 6697ca7b038d..000000000000
--- a/crypto/openssh/loginrec.c
+++ /dev/null
@@ -1,1554 +0,0 @@
-/*
- * Copyright (c) 2000 Andre Lucas.  All rights reserved.
- * Portions copyright (c) 1998 Todd C. Miller
- * Portions copyright (c) 1996 Jason Downs
- * Portions copyright (c) 1996 Theo de Raadt
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by Markus Friedl.
- * 4. The name of the author may not be used to endorse or promote products
- *    derived from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- ** loginrec.c:  platform-independent login recording and lastlog retrieval
- **/
-
-/*
-  The new login code explained
-  ============================
-
-  This code attempts to provide a common interface to login recording
-  (utmp and friends) and last login time retrieval.
-
-  Its primary means of achieving this is to use 'struct logininfo', a
-  union of all the useful fields in the various different types of
-  system login record structures one finds on UNIX variants.
-
-  We depend on autoconf to define which recording methods are to be
-  used, and which fields are contained in the relevant data structures
-  on the local system. Many C preprocessor symbols affect which code
-  gets compiled here.
-
-  The code is designed to make it easy to modify a particular
-  recording method, without affecting other methods nor requiring so
-  many nested conditional compilation blocks as were commonplace in
-  the old code.
-
-  For login recording, we try to use the local system's libraries as
-  these are clearly most likely to work correctly. For utmp systems
-  this usually means login() and logout() or setutent() etc., probably
-  in libutil, along with logwtmp() etc. On these systems, we fall back
-  to writing the files directly if we have to, though this method
-  requires very thorough testing so we do not corrupt local auditing
-  information. These files and their access methods are very system
-  specific indeed.
-
-  For utmpx systems, the corresponding library functions are
-  setutxent() etc. To the author's knowledge, all utmpx systems have
-  these library functions and so no direct write is attempted. If such
-  a system exists and needs support, direct analogues of the [uw]tmp
-  code should suffice.
-
-  Retrieving the time of last login ('lastlog') is in some ways even
-  more problemmatic than login recording. Some systems provide a
-  simple table of all users which we seek based on uid and retrieve a
-  relatively standard structure. Others record the same information in
-  a directory with a separate file, and others don't record the
-  information separately at all. For systems in the latter category,
-  we look backwards in the wtmp or wtmpx file for the last login entry
-  for our user. Naturally this is slower and on busy systems could
-  incur a significant performance penalty.
-
-  Calling the new code
-  --------------------
-
-  In OpenSSH all login recording and retrieval is performed in
-  login.c. Here you'll find working examples. Also, in the logintest.c
-  program there are more examples.
-
-  Internal handler calling method
-  -------------------------------
-
-  When a call is made to login_login() or login_logout(), both
-  routines set a struct logininfo flag defining which action (log in,
-  or log out) is to be taken. They both then call login_write(), which
-  calls whichever of the many structure-specific handlers autoconf
-  selects for the local system.
-
-  The handlers themselves handle system data structure specifics. Both
-  struct utmp and struct utmpx have utility functions (see
-  construct_utmp*()) to try to make it simpler to add extra systems
-  that introduce new features to either structure.
-
-  While it may seem terribly wasteful to replicate so much similar
-  code for each method, experience has shown that maintaining code to
-  write both struct utmp and utmpx in one function, whilst maintaining
-  support for all systems whether they have library support or not, is
-  a difficult and time-consuming task.
-
-  Lastlog support proceeds similarly. Functions login_get_lastlog()
-  (and its OpenSSH-tuned friend login_get_lastlog_time()) call
-  getlast_entry(), which tries one of three methods to find the last
-  login time. It uses local system lastlog support if it can,
-  otherwise it tries wtmp or wtmpx before giving up and returning 0,
-  meaning "tilt".
-
-  Maintenance
-  -----------
-
-  In many cases it's possible to tweak autoconf to select the correct
-  methods for a particular platform, either by improving the detection
-  code (best), or by presetting DISABLE_<method> or CONF_<method>_FILE
-  symbols for the platform.
-
-  Use logintest to check which symbols are defined before modifying
-  configure.ac and loginrec.c. (You have to build logintest yourself
-  with 'make logintest' as it's not built by default.)
-
-  Otherwise, patches to the specific method(s) are very helpful!
-
-*/
-
-/**
- ** TODO:
- **   homegrown ttyslot()
- **   test, test, test
- **
- ** Platform status:
- ** ----------------
- **
- ** Known good:
- **   Linux (Redhat 6.2, Debian)
- **   Solaris
- **   HP-UX 10.20 (gcc only)
- **   IRIX
- **   NeXT - M68k/HPPA/Sparc (4.2/3.3)
- **
- ** Testing required: Please send reports!
- **   NetBSD
- **   HP-UX 11
- **   AIX
- **
- ** Platforms with known problems:
- **   Some variants of Slackware Linux
- **
- **/
-
-#include "includes.h"
-
-#include "ssh.h"
-#include "xmalloc.h"
-#include "loginrec.h"
-#include "log.h"
-#include "atomicio.h"
-
-RCSID("$Id: loginrec.c,v 1.47 2003/03/10 00:23:07 djm Exp $");
-
-#ifdef HAVE_UTIL_H
-#  include <util.h>
-#endif
-
-#ifdef HAVE_LIBUTIL_H
-#   include <libutil.h>
-#endif
-
-/**
- ** prototypes for helper functions in this file
- **/
-
-#if HAVE_UTMP_H
-void set_utmp_time(struct logininfo *li, struct utmp *ut);
-void construct_utmp(struct logininfo *li, struct utmp *ut);
-#endif
-
-#ifdef HAVE_UTMPX_H
-void set_utmpx_time(struct logininfo *li, struct utmpx *ut);
-void construct_utmpx(struct logininfo *li, struct utmpx *ut);
-#endif
-
-int utmp_write_entry(struct logininfo *li);
-int utmpx_write_entry(struct logininfo *li);
-int wtmp_write_entry(struct logininfo *li);
-int wtmpx_write_entry(struct logininfo *li);
-int lastlog_write_entry(struct logininfo *li);
-int syslogin_write_entry(struct logininfo *li);
-
-int getlast_entry(struct logininfo *li);
-int lastlog_get_entry(struct logininfo *li);
-int wtmp_get_entry(struct logininfo *li);
-int wtmpx_get_entry(struct logininfo *li);
-
-/* pick the shortest string */
-#define MIN_SIZEOF(s1,s2) ( sizeof(s1) < sizeof(s2) ? sizeof(s1) : sizeof(s2) )
-
-/**
- ** platform-independent login functions
- **/
-
-/* login_login(struct logininfo *)     -Record a login
- *
- * Call with a pointer to a struct logininfo initialised with
- * login_init_entry() or login_alloc_entry()
- *
- * Returns:
- *  >0 if successful
- *  0  on failure (will use OpenSSH's logging facilities for diagnostics)
- */
-int
-login_login (struct logininfo *li)
-{
-	li->type = LTYPE_LOGIN;
-	return login_write(li);
-}
-
-
-/* login_logout(struct logininfo *)     - Record a logout
- *
- * Call as with login_login()
- *
- * Returns:
- *  >0 if successful
- *  0  on failure (will use OpenSSH's logging facilities for diagnostics)
- */
-int
-login_logout(struct logininfo *li)
-{
-	li->type = LTYPE_LOGOUT;
-	return login_write(li);
-}
-
-/* login_get_lastlog_time(int)           - Retrieve the last login time
- *
- * Retrieve the last login time for the given uid. Will try to use the
- * system lastlog facilities if they are available, but will fall back
- * to looking in wtmp/wtmpx if necessary
- *
- * Returns:
- *   0 on failure, or if user has never logged in
- *   Time in seconds from the epoch if successful
- *
- * Useful preprocessor symbols:
- *   DISABLE_LASTLOG: If set, *never* even try to retrieve lastlog
- *                    info
- *   USE_LASTLOG: If set, indicates the presence of system lastlog
- *                facilities. If this and DISABLE_LASTLOG are not set,
- *                try to retrieve lastlog information from wtmp/wtmpx.
- */
-unsigned int
-login_get_lastlog_time(const int uid)
-{
-	struct logininfo li;
-
-	if (login_get_lastlog(&li, uid))
-		return li.tv_sec;
-	else
-		return 0;
-}
-
-/* login_get_lastlog(struct logininfo *, int)   - Retrieve a lastlog entry
- *
- * Retrieve a logininfo structure populated (only partially) with
- * information from the system lastlog data, or from wtmp/wtmpx if no
- * system lastlog information exists.
- *
- * Note this routine must be given a pre-allocated logininfo.
- *
- * Returns:
- *  >0: A pointer to your struct logininfo if successful
- *  0  on failure (will use OpenSSH's logging facilities for diagnostics)
- *
- */
-struct logininfo *
-login_get_lastlog(struct logininfo *li, const int uid)
-{
-	struct passwd *pw;
-
-	memset(li, '\0', sizeof(*li));
-	li->uid = uid;
-
-	/*
-	 * If we don't have a 'real' lastlog, we need the username to
-	 * reliably search wtmp(x) for the last login (see
-	 * wtmp_get_entry().)
-	 */
-	pw = getpwuid(uid);
-	if (pw == NULL)
-		fatal("login_get_lastlog: Cannot find account for uid %i", uid);
-
-	/* No MIN_SIZEOF here - we absolutely *must not* truncate the
-	 * username */
-	strlcpy(li->username, pw->pw_name, sizeof(li->username));
-
-	if (getlast_entry(li))
-		return li;
-	else
-		return NULL;
-}
-
-
-/* login_alloc_entry(int, char*, char*, char*)    - Allocate and initialise
- *                                                  a logininfo structure
- *
- * This function creates a new struct logininfo, a data structure
- * meant to carry the information required to portably record login info.
- *
- * Returns a pointer to a newly created struct logininfo. If memory
- * allocation fails, the program halts.
- */
-struct
-logininfo *login_alloc_entry(int pid, const char *username,
-			     const char *hostname, const char *line)
-{
-	struct logininfo *newli;
-
-	newli = (struct logininfo *) xmalloc (sizeof(*newli));
-	(void)login_init_entry(newli, pid, username, hostname, line);
-	return newli;
-}
-
-
-/* login_free_entry(struct logininfo *)    - free struct memory */
-void
-login_free_entry(struct logininfo *li)
-{
-	xfree(li);
-}
-
-
-/* login_init_entry(struct logininfo *, int, char*, char*, char*)
- *                                        - initialise a struct logininfo
- *
- * Populates a new struct logininfo, a data structure meant to carry
- * the information required to portably record login info.
- *
- * Returns: 1
- */
-int
-login_init_entry(struct logininfo *li, int pid, const char *username,
-		 const char *hostname, const char *line)
-{
-	struct passwd *pw;
-
-	memset(li, 0, sizeof(*li));
-
-	li->pid = pid;
-
-	/* set the line information */
-	if (line)
-		line_fullname(li->line, line, sizeof(li->line));
-
-	if (username) {
-		strlcpy(li->username, username, sizeof(li->username));
-		pw = getpwnam(li->username);
-		if (pw == NULL)
-			fatal("login_init_entry: Cannot find user \"%s\"", li->username);
-		li->uid = pw->pw_uid;
-	}
-
-	if (hostname)
-		strlcpy(li->hostname, hostname, sizeof(li->hostname));
-
-	return 1;
-}
-
-/* login_set_current_time(struct logininfo *)    - set the current time
- *
- * Set the current time in a logininfo structure. This function is
- * meant to eliminate the need to deal with system dependencies for
- * time handling.
- */
-void
-login_set_current_time(struct logininfo *li)
-{
-	struct timeval tv;
-
-	gettimeofday(&tv, NULL);
-
-	li->tv_sec = tv.tv_sec;
-	li->tv_usec = tv.tv_usec;
-}
-
-/* copy a sockaddr_* into our logininfo */
-void
-login_set_addr(struct logininfo *li, const struct sockaddr *sa,
-	       const unsigned int sa_size)
-{
-	unsigned int bufsize = sa_size;
-
-	/* make sure we don't overrun our union */
-	if (sizeof(li->hostaddr) < sa_size)
-		bufsize = sizeof(li->hostaddr);
-
-	memcpy((void *)&(li->hostaddr.sa), (const void *)sa, bufsize);
-}
-
-
-/**
- ** login_write: Call low-level recording functions based on autoconf
- ** results
- **/
-int
-login_write (struct logininfo *li)
-{
-#ifndef HAVE_CYGWIN
-	if ((int)geteuid() != 0) {
-	  log("Attempt to write login records by non-root user (aborting)");
-	  return 1;
-	}
-#endif
-
-	/* set the timestamp */
-	login_set_current_time(li);
-#ifdef USE_LOGIN
-	syslogin_write_entry(li);
-#endif
-#ifdef USE_LASTLOG
-	if (li->type == LTYPE_LOGIN) {
-		lastlog_write_entry(li);
-	}
-#endif
-#ifdef USE_UTMP
-	utmp_write_entry(li);
-#endif
-#ifdef USE_WTMP
-	wtmp_write_entry(li);
-#endif
-#ifdef USE_UTMPX
-	utmpx_write_entry(li);
-#endif
-#ifdef USE_WTMPX
-	wtmpx_write_entry(li);
-#endif
-	return 0;
-}
-
-#ifdef LOGIN_NEEDS_UTMPX
-int
-login_utmp_only(struct logininfo *li)
-{
-	li->type = LTYPE_LOGIN; 
-	login_set_current_time(li);
-# ifdef USE_UTMP
-	utmp_write_entry(li);
-# endif
-# ifdef USE_WTMP
-	wtmp_write_entry(li);
-# endif
-# ifdef USE_UTMPX
-	utmpx_write_entry(li);
-# endif
-# ifdef USE_WTMPX
-	wtmpx_write_entry(li);
-# endif
-	return 0;
-}
-#endif
-
-/**
- ** getlast_entry: Call low-level functions to retrieve the last login
- **                time.
- **/
-
-/* take the uid in li and return the last login time */
-int
-getlast_entry(struct logininfo *li)
-{
-#ifdef USE_LASTLOG
-	return(lastlog_get_entry(li));
-#else /* !USE_LASTLOG */
-
-#ifdef DISABLE_LASTLOG
-	/* On some systems we shouldn't even try to obtain last login
-	 * time, e.g. AIX */
-	return 0;
-# else /* DISABLE_LASTLOG */
-	/* Try to retrieve the last login time from wtmp */
-#  if defined(USE_WTMP) && (defined(HAVE_TIME_IN_UTMP) || defined(HAVE_TV_IN_UTMP))
-	/* retrieve last login time from utmp */
-	return (wtmp_get_entry(li));
-#  else /* defined(USE_WTMP) && (defined(HAVE_TIME_IN_UTMP) || defined(HAVE_TV_IN_UTMP)) */
-	/* If wtmp isn't available, try wtmpx */
-#   if defined(USE_WTMPX) && (defined(HAVE_TIME_IN_UTMPX) || defined(HAVE_TV_IN_UTMPX))
-	/* retrieve last login time from utmpx */
-	return (wtmpx_get_entry(li));
-#   else
-	/* Give up: No means of retrieving last login time */
-	return 0;
-#   endif /* USE_WTMPX && (HAVE_TIME_IN_UTMPX || HAVE_TV_IN_UTMPX) */
-#  endif /* USE_WTMP && (HAVE_TIME_IN_UTMP || HAVE_TV_IN_UTMP) */
-# endif /* DISABLE_LASTLOG */
-#endif /* USE_LASTLOG */
-}
-
-
-
-/*
- * 'line' string utility functions
- *
- * These functions process the 'line' string into one of three forms:
- *
- * 1. The full filename (including '/dev')
- * 2. The stripped name (excluding '/dev')
- * 3. The abbreviated name (e.g. /dev/ttyp00 -> yp00
- *                               /dev/pts/1  -> ts/1 )
- *
- * Form 3 is used on some systems to identify a .tmp.? entry when
- * attempting to remove it. Typically both addition and removal is
- * performed by one application - say, sshd - so as long as the choice
- * uniquely identifies a terminal it's ok.
- */
-
-
-/* line_fullname(): add the leading '/dev/' if it doesn't exist make
- * sure dst has enough space, if not just copy src (ugh) */
-char *
-line_fullname(char *dst, const char *src, int dstsize)
-{
-	memset(dst, '\0', dstsize);
-	if ((strncmp(src, "/dev/", 5) == 0) || (dstsize < (strlen(src) + 5))) {
-		strlcpy(dst, src, dstsize);
-	} else {
-		strlcpy(dst, "/dev/", dstsize);
-		strlcat(dst, src, dstsize);
-	}
-	return dst;
-}
-
-/* line_stripname(): strip the leading '/dev' if it exists, return dst */
-char *
-line_stripname(char *dst, const char *src, int dstsize)
-{
-	memset(dst, '\0', dstsize);
-	if (strncmp(src, "/dev/", 5) == 0)
-		strlcpy(dst, src + 5, dstsize);
-	else
-		strlcpy(dst, src, dstsize);
-	return dst;
-}
-
-/* line_abbrevname(): Return the abbreviated (usually four-character)
- * form of the line (Just use the last <dstsize> characters of the
- * full name.)
- *
- * NOTE: use strncpy because we do NOT necessarily want zero
- * termination */
-char *
-line_abbrevname(char *dst, const char *src, int dstsize)
-{
-	size_t len;
-
-	memset(dst, '\0', dstsize);
-
-	/* Always skip prefix if present */
-	if (strncmp(src, "/dev/", 5) == 0)
-		src += 5;
-
-#ifdef WITH_ABBREV_NO_TTY
-	if (strncmp(src, "tty", 3) == 0)
-		src += 3;
-#endif
-
-	len = strlen(src);
-
-	if (len > 0) {
-		if (((int)len - dstsize) > 0)
-			src +=  ((int)len - dstsize);
-
-		/* note: _don't_ change this to strlcpy */
-		strncpy(dst, src, (size_t)dstsize);
-	}
-
-	return dst;
-}
-
-/**
- ** utmp utility functions
- **
- ** These functions manipulate struct utmp, taking system differences
- ** into account.
- **/
-
-#if defined(USE_UTMP) || defined (USE_WTMP) || defined (USE_LOGIN)
-
-/* build the utmp structure */
-void
-set_utmp_time(struct logininfo *li, struct utmp *ut)
-{
-# ifdef HAVE_TV_IN_UTMP
-	ut->ut_tv.tv_sec = li->tv_sec;
-	ut->ut_tv.tv_usec = li->tv_usec;
-# else
-#  ifdef HAVE_TIME_IN_UTMP
-	ut->ut_time = li->tv_sec;
-#  endif
-# endif
-}
-
-void
-construct_utmp(struct logininfo *li,
-		    struct utmp *ut)
-{
-# ifdef HAVE_ADDR_V6_IN_UTMP
-	struct sockaddr_in6 *sa6;
-#  endif
-	memset(ut, '\0', sizeof(*ut));
-
-	/* First fill out fields used for both logins and logouts */
-
-# ifdef HAVE_ID_IN_UTMP
-	line_abbrevname(ut->ut_id, li->line, sizeof(ut->ut_id));
-# endif
-
-# ifdef HAVE_TYPE_IN_UTMP
-	/* This is done here to keep utmp constants out of struct logininfo */
-	switch (li->type) {
-	case LTYPE_LOGIN:
-		ut->ut_type = USER_PROCESS;
-#ifdef _UNICOS
-		cray_set_tmpdir(ut);
-#endif
-		break;
-	case LTYPE_LOGOUT:
-		ut->ut_type = DEAD_PROCESS;
-#ifdef _UNICOS
-		cray_retain_utmp(ut, li->pid);
-#endif
-		break;
-	}
-# endif
-	set_utmp_time(li, ut);
-
-	line_stripname(ut->ut_line, li->line, sizeof(ut->ut_line));
-
-# ifdef HAVE_PID_IN_UTMP
-	ut->ut_pid = li->pid;
-# endif
-
-	/* If we're logging out, leave all other fields blank */
-	if (li->type == LTYPE_LOGOUT)
-	  return;
-
-	/*
-	 * These fields are only used when logging in, and are blank
-	 * for logouts.
-	 */
-
-	/* Use strncpy because we don't necessarily want null termination */
-	strncpy(ut->ut_name, li->username, MIN_SIZEOF(ut->ut_name, li->username));
-# ifdef HAVE_HOST_IN_UTMP
-	strncpy(ut->ut_host, li->hostname, MIN_SIZEOF(ut->ut_host, li->hostname));
-# endif
-# ifdef HAVE_ADDR_IN_UTMP
-	/* this is just a 32-bit IP address */
-	if (li->hostaddr.sa.sa_family == AF_INET)
-		ut->ut_addr = li->hostaddr.sa_in.sin_addr.s_addr;
-# endif
-# ifdef HAVE_ADDR_V6_IN_UTMP
-	/* this is just a 128-bit IPv6 address */
-	if (li->hostaddr.sa.sa_family == AF_INET6) {
-		sa6 = ((struct sockaddr_in6 *)&li->hostaddr.sa);
-		memcpy(ut->ut_addr_v6, sa6->sin6_addr.s6_addr, 16);
-		if (IN6_IS_ADDR_V4MAPPED(&sa6->sin6_addr)) {
-			ut->ut_addr_v6[0] = ut->ut_addr_v6[3];
-			ut->ut_addr_v6[1] = 0;
-			ut->ut_addr_v6[2] = 0;
-			ut->ut_addr_v6[3] = 0;
-		}
-	}
-# endif
-}
-#endif /* USE_UTMP || USE_WTMP || USE_LOGIN */
-
-/**
- ** utmpx utility functions
- **
- ** These functions manipulate struct utmpx, accounting for system
- ** variations.
- **/
-
-#if defined(USE_UTMPX) || defined (USE_WTMPX)
-/* build the utmpx structure */
-void
-set_utmpx_time(struct logininfo *li, struct utmpx *utx)
-{
-# ifdef HAVE_TV_IN_UTMPX
-	utx->ut_tv.tv_sec = li->tv_sec;
-	utx->ut_tv.tv_usec = li->tv_usec;
-# else /* HAVE_TV_IN_UTMPX */
-#  ifdef HAVE_TIME_IN_UTMPX
-	utx->ut_time = li->tv_sec;
-#  endif /* HAVE_TIME_IN_UTMPX */
-# endif /* HAVE_TV_IN_UTMPX */
-}
-
-void
-construct_utmpx(struct logininfo *li, struct utmpx *utx)
-{
-# ifdef HAVE_ADDR_V6_IN_UTMP
-	struct sockaddr_in6 *sa6;
-#  endif
-	memset(utx, '\0', sizeof(*utx));
-# ifdef HAVE_ID_IN_UTMPX
-	line_abbrevname(utx->ut_id, li->line, sizeof(utx->ut_id));
-# endif
-
-	/* this is done here to keep utmp constants out of loginrec.h */
-	switch (li->type) {
-	case LTYPE_LOGIN:
-		utx->ut_type = USER_PROCESS;
-		break;
-	case LTYPE_LOGOUT:
-		utx->ut_type = DEAD_PROCESS;
-		break;
-	}
-	line_stripname(utx->ut_line, li->line, sizeof(utx->ut_line));
-	set_utmpx_time(li, utx);
-	utx->ut_pid = li->pid;
-	/* strncpy(): Don't necessarily want null termination */
-	strncpy(utx->ut_name, li->username, MIN_SIZEOF(utx->ut_name, li->username));
-
-	if (li->type == LTYPE_LOGOUT)
-		return;
-
-	/*
-	 * These fields are only used when logging in, and are blank
-	 * for logouts.
-	 */
-
-# ifdef HAVE_HOST_IN_UTMPX
-	strncpy(utx->ut_host, li->hostname, MIN_SIZEOF(utx->ut_host, li->hostname));
-# endif
-# ifdef HAVE_ADDR_IN_UTMPX
-	/* this is just a 32-bit IP address */
-	if (li->hostaddr.sa.sa_family == AF_INET)
-		utx->ut_addr = li->hostaddr.sa_in.sin_addr.s_addr;
-# endif
-# ifdef HAVE_ADDR_V6_IN_UTMP
-	/* this is just a 128-bit IPv6 address */
-	if (li->hostaddr.sa.sa_family == AF_INET6) {
-		sa6 = ((struct sockaddr_in6 *)&li->hostaddr.sa);
-		memcpy(ut->ut_addr_v6, sa6->sin6_addr.s6_addr, 16);
-		if (IN6_IS_ADDR_V4MAPPED(&sa6->sin6_addr)) {
-			ut->ut_addr_v6[0] = ut->ut_addr_v6[3];
-			ut->ut_addr_v6[1] = 0;
-			ut->ut_addr_v6[2] = 0;
-			ut->ut_addr_v6[3] = 0;
-		}
-	}
-# endif
-# ifdef HAVE_SYSLEN_IN_UTMPX
-	/* ut_syslen is the length of the utx_host string */
-	utx->ut_syslen = MIN(strlen(li->hostname), sizeof(utx->ut_host));
-# endif
-}
-#endif /* USE_UTMPX || USE_WTMPX */
-
-/**
- ** Low-level utmp functions
- **/
-
-/* FIXME: (ATL) utmp_write_direct needs testing */
-#ifdef USE_UTMP
-
-/* if we can, use pututline() etc. */
-# if !defined(DISABLE_PUTUTLINE) && defined(HAVE_SETUTENT) && \
-	defined(HAVE_PUTUTLINE)
-#  define UTMP_USE_LIBRARY
-# endif
-
-
-/* write a utmp entry with the system's help (pututline() and pals) */
-# ifdef UTMP_USE_LIBRARY
-static int
-utmp_write_library(struct logininfo *li, struct utmp *ut)
-{
-	setutent();
-	pututline(ut);
-
-#  ifdef HAVE_ENDUTENT
-	endutent();
-#  endif
-	return 1;
-}
-# else /* UTMP_USE_LIBRARY */
-
-/* write a utmp entry direct to the file */
-/* This is a slightly modification of code in OpenBSD's login.c */
-static int
-utmp_write_direct(struct logininfo *li, struct utmp *ut)
-{
-	struct utmp old_ut;
-	register int fd;
-	int tty;
-
-	/* FIXME: (ATL) ttyslot() needs local implementation */
-
-#if defined(HAVE_GETTTYENT)
-	register struct ttyent *ty;
-
-	tty=0;
-
-	setttyent();
-	while ((struct ttyent *)0 != (ty = getttyent())) {
-		tty++;
-		if (!strncmp(ty->ty_name, ut->ut_line, sizeof(ut->ut_line)))
-			break;
-	}
-	endttyent();
-
-	if((struct ttyent *)0 == ty) {
-		log("utmp_write_entry: tty not found");
-		return(1);
-	}
-#else /* FIXME */
-
-	tty = ttyslot(); /* seems only to work for /dev/ttyp? style names */
-
-#endif /* HAVE_GETTTYENT */
-
-	if (tty > 0 && (fd = open(UTMP_FILE, O_RDWR|O_CREAT, 0644)) >= 0) {
-		(void)lseek(fd, (off_t)(tty * sizeof(struct utmp)), SEEK_SET);
-		/*
-		 * Prevent luser from zero'ing out ut_host.
-		 * If the new ut_line is empty but the old one is not
-		 * and ut_line and ut_name match, preserve the old ut_line.
-		 */
-		if (atomicio(read, fd, &old_ut, sizeof(old_ut)) == sizeof(old_ut) &&
-			(ut->ut_host[0] == '\0') && (old_ut.ut_host[0] != '\0') &&
-			(strncmp(old_ut.ut_line, ut->ut_line, sizeof(ut->ut_line)) == 0) &&
-			(strncmp(old_ut.ut_name, ut->ut_name, sizeof(ut->ut_name)) == 0)) {
-			(void)memcpy(ut->ut_host, old_ut.ut_host, sizeof(ut->ut_host));
-		}
-
-		(void)lseek(fd, (off_t)(tty * sizeof(struct utmp)), SEEK_SET);
-		if (atomicio(write, fd, ut, sizeof(*ut)) != sizeof(*ut))
-			log("utmp_write_direct: error writing %s: %s",
-			    UTMP_FILE, strerror(errno));
-
-		(void)close(fd);
-		return 1;
-	} else {
-		return 0;
-	}
-}
-# endif /* UTMP_USE_LIBRARY */
-
-static int
-utmp_perform_login(struct logininfo *li)
-{
-	struct utmp ut;
-
-	construct_utmp(li, &ut);
-# ifdef UTMP_USE_LIBRARY
-	if (!utmp_write_library(li, &ut)) {
-		log("utmp_perform_login: utmp_write_library() failed");
-		return 0;
-	}
-# else
-	if (!utmp_write_direct(li, &ut)) {
-		log("utmp_perform_login: utmp_write_direct() failed");
-		return 0;
-	}
-# endif
-	return 1;
-}
-
-
-static int
-utmp_perform_logout(struct logininfo *li)
-{
-	struct utmp ut;
-
-	construct_utmp(li, &ut);
-# ifdef UTMP_USE_LIBRARY
-	if (!utmp_write_library(li, &ut)) {
-		log("utmp_perform_logout: utmp_write_library() failed");
-		return 0;
-	}
-# else
-	if (!utmp_write_direct(li, &ut)) {
-		log("utmp_perform_logout: utmp_write_direct() failed");
-		return 0;
-	}
-# endif
-	return 1;
-}
-
-
-int
-utmp_write_entry(struct logininfo *li)
-{
-	switch(li->type) {
-	case LTYPE_LOGIN:
-		return utmp_perform_login(li);
-
-	case LTYPE_LOGOUT:
-		return utmp_perform_logout(li);
-
-	default:
-		log("utmp_write_entry: invalid type field");
-		return 0;
-	}
-}
-#endif /* USE_UTMP */
-
-
-/**
- ** Low-level utmpx functions
- **/
-
-/* not much point if we don't want utmpx entries */
-#ifdef USE_UTMPX
-
-/* if we have the wherewithall, use pututxline etc. */
-# if !defined(DISABLE_PUTUTXLINE) && defined(HAVE_SETUTXENT) && \
-	defined(HAVE_PUTUTXLINE)
-#  define UTMPX_USE_LIBRARY
-# endif
-
-
-/* write a utmpx entry with the system's help (pututxline() and pals) */
-# ifdef UTMPX_USE_LIBRARY
-static int
-utmpx_write_library(struct logininfo *li, struct utmpx *utx)
-{
-	setutxent();
-	pututxline(utx);
-
-#  ifdef HAVE_ENDUTXENT
-	endutxent();
-#  endif
-	return 1;
-}
-
-# else /* UTMPX_USE_LIBRARY */
-
-/* write a utmp entry direct to the file */
-static int
-utmpx_write_direct(struct logininfo *li, struct utmpx *utx)
-{
-	log("utmpx_write_direct: not implemented!");
-	return 0;
-}
-# endif /* UTMPX_USE_LIBRARY */
-
-static int
-utmpx_perform_login(struct logininfo *li)
-{
-	struct utmpx utx;
-
-	construct_utmpx(li, &utx);
-# ifdef UTMPX_USE_LIBRARY
-	if (!utmpx_write_library(li, &utx)) {
-		log("utmpx_perform_login: utmp_write_library() failed");
-		return 0;
-	}
-# else
-	if (!utmpx_write_direct(li, &ut)) {
-		log("utmpx_perform_login: utmp_write_direct() failed");
-		return 0;
-	}
-# endif
-	return 1;
-}
-
-
-static int
-utmpx_perform_logout(struct logininfo *li)
-{
-	struct utmpx utx;
-
-	construct_utmpx(li, &utx);
-# ifdef HAVE_ID_IN_UTMPX
-	line_abbrevname(utx.ut_id, li->line, sizeof(utx.ut_id));
-# endif
-# ifdef HAVE_TYPE_IN_UTMPX
-	utx.ut_type = DEAD_PROCESS;
-# endif
-
-# ifdef UTMPX_USE_LIBRARY
-	utmpx_write_library(li, &utx);
-# else
-	utmpx_write_direct(li, &utx);
-# endif
-	return 1;
-}
-
-int
-utmpx_write_entry(struct logininfo *li)
-{
-	switch(li->type) {
-	case LTYPE_LOGIN:
-		return utmpx_perform_login(li);
-	case LTYPE_LOGOUT:
-		return utmpx_perform_logout(li);
-	default:
-		log("utmpx_write_entry: invalid type field");
-		return 0;
-	}
-}
-#endif /* USE_UTMPX */
-
-
-/**
- ** Low-level wtmp functions
- **/
-
-#ifdef USE_WTMP
-
-/* write a wtmp entry direct to the end of the file */
-/* This is a slight modification of code in OpenBSD's logwtmp.c */
-static int
-wtmp_write(struct logininfo *li, struct utmp *ut)
-{
-	struct stat buf;
-	int fd, ret = 1;
-
-	if ((fd = open(WTMP_FILE, O_WRONLY|O_APPEND, 0)) < 0) {
-		log("wtmp_write: problem writing %s: %s",
-		    WTMP_FILE, strerror(errno));
-		return 0;
-	}
-	if (fstat(fd, &buf) == 0)
-		if (atomicio(write, fd, ut, sizeof(*ut)) != sizeof(*ut)) {
-			ftruncate(fd, buf.st_size);
-			log("wtmp_write: problem writing %s: %s",
-			    WTMP_FILE, strerror(errno));
-			ret = 0;
-		}
-	(void)close(fd);
-	return ret;
-}
-
-static int
-wtmp_perform_login(struct logininfo *li)
-{
-	struct utmp ut;
-
-	construct_utmp(li, &ut);
-	return wtmp_write(li, &ut);
-}
-
-
-static int
-wtmp_perform_logout(struct logininfo *li)
-{
-	struct utmp ut;
-
-	construct_utmp(li, &ut);
-	return wtmp_write(li, &ut);
-}
-
-
-int
-wtmp_write_entry(struct logininfo *li)
-{
-	switch(li->type) {
-	case LTYPE_LOGIN:
-		return wtmp_perform_login(li);
-	case LTYPE_LOGOUT:
-		return wtmp_perform_logout(li);
-	default:
-		log("wtmp_write_entry: invalid type field");
-		return 0;
-	}
-}
-
-
-/* Notes on fetching login data from wtmp/wtmpx
- *
- * Logouts are usually recorded with (amongst other things) a blank
- * username on a given tty line.  However, some systems (HP-UX is one)
- * leave all fields set, but change the ut_type field to DEAD_PROCESS.
- *
- * Since we're only looking for logins here, we know that the username
- * must be set correctly. On systems that leave it in, we check for
- * ut_type==USER_PROCESS (indicating a login.)
- *
- * Portability: Some systems may set something other than USER_PROCESS
- * to indicate a login process. I don't know of any as I write. Also,
- * it's possible that some systems may both leave the username in
- * place and not have ut_type.
- */
-
-/* return true if this wtmp entry indicates a login */
-static int
-wtmp_islogin(struct logininfo *li, struct utmp *ut)
-{
-	if (strncmp(li->username, ut->ut_name,
-		MIN_SIZEOF(li->username, ut->ut_name)) == 0) {
-# ifdef HAVE_TYPE_IN_UTMP
-		if (ut->ut_type & USER_PROCESS)
-			return 1;
-# else
-		return 1;
-# endif
-	}
-	return 0;
-}
-
-int
-wtmp_get_entry(struct logininfo *li)
-{
-	struct stat st;
-	struct utmp ut;
-	int fd, found=0;
-
-	/* Clear the time entries in our logininfo */
-	li->tv_sec = li->tv_usec = 0;
-
-	if ((fd = open(WTMP_FILE, O_RDONLY)) < 0) {
-		log("wtmp_get_entry: problem opening %s: %s",
-		    WTMP_FILE, strerror(errno));
-		return 0;
-	}
-	if (fstat(fd, &st) != 0) {
-		log("wtmp_get_entry: couldn't stat %s: %s",
-		    WTMP_FILE, strerror(errno));
-		close(fd);
-		return 0;
-	}
-
-	/* Seek to the start of the last struct utmp */
-	if (lseek(fd, -(off_t)sizeof(struct utmp), SEEK_END) == -1) {
-		/* Looks like we've got a fresh wtmp file */
-		close(fd);
-		return 0;
-	}
-
-	while (!found) {
-		if (atomicio(read, fd, &ut, sizeof(ut)) != sizeof(ut)) {
-			log("wtmp_get_entry: read of %s failed: %s",
-			    WTMP_FILE, strerror(errno));
-			close (fd);
-			return 0;
-		}
-		if ( wtmp_islogin(li, &ut) ) {
-			found = 1;
-			/* We've already checked for a time in struct
-			 * utmp, in login_getlast(). */
-# ifdef HAVE_TIME_IN_UTMP
-			li->tv_sec = ut.ut_time;
-# else
-#  if HAVE_TV_IN_UTMP
-			li->tv_sec = ut.ut_tv.tv_sec;
-#  endif
-# endif
-			line_fullname(li->line, ut.ut_line,
-				      MIN_SIZEOF(li->line, ut.ut_line));
-# ifdef HAVE_HOST_IN_UTMP
-			strlcpy(li->hostname, ut.ut_host,
-				MIN_SIZEOF(li->hostname, ut.ut_host));
-# endif
-			continue;
-		}
-		/* Seek back 2 x struct utmp */
-		if (lseek(fd, -(off_t)(2 * sizeof(struct utmp)), SEEK_CUR) == -1) {
-			/* We've found the start of the file, so quit */
-			close (fd);
-			return 0;
-		}
-	}
-
-	/* We found an entry. Tidy up and return */
-	close(fd);
-	return 1;
-}
-# endif /* USE_WTMP */
-
-
-/**
- ** Low-level wtmpx functions
- **/
-
-#ifdef USE_WTMPX
-/* write a wtmpx entry direct to the end of the file */
-/* This is a slight modification of code in OpenBSD's logwtmp.c */
-static int
-wtmpx_write(struct logininfo *li, struct utmpx *utx)
-{
-	struct stat buf;
-	int fd, ret = 1;
-
-	if ((fd = open(WTMPX_FILE, O_WRONLY|O_APPEND, 0)) < 0) {
-		log("wtmpx_write: problem opening %s: %s",
-		    WTMPX_FILE, strerror(errno));
-		return 0;
-	}
-
-	if (fstat(fd, &buf) == 0)
-		if (atomicio(write, fd, utx, sizeof(*utx)) != sizeof(*utx)) {
-			ftruncate(fd, buf.st_size);
-			log("wtmpx_write: problem writing %s: %s",
-			    WTMPX_FILE, strerror(errno));
-			ret = 0;
-		}
-	(void)close(fd);
-
-	return ret;
-}
-
-
-static int
-wtmpx_perform_login(struct logininfo *li)
-{
-	struct utmpx utx;
-
-	construct_utmpx(li, &utx);
-	return wtmpx_write(li, &utx);
-}
-
-
-static int
-wtmpx_perform_logout(struct logininfo *li)
-{
-	struct utmpx utx;
-
-	construct_utmpx(li, &utx);
-	return wtmpx_write(li, &utx);
-}
-
-
-int
-wtmpx_write_entry(struct logininfo *li)
-{
-	switch(li->type) {
-	case LTYPE_LOGIN:
-		return wtmpx_perform_login(li);
-	case LTYPE_LOGOUT:
-		return wtmpx_perform_logout(li);
-	default:
-		log("wtmpx_write_entry: invalid type field");
-		return 0;
-	}
-}
-
-/* Please see the notes above wtmp_islogin() for information about the
-   next two functions */
-
-/* Return true if this wtmpx entry indicates a login */
-static int
-wtmpx_islogin(struct logininfo *li, struct utmpx *utx)
-{
-	if ( strncmp(li->username, utx->ut_name,
-		MIN_SIZEOF(li->username, utx->ut_name)) == 0 ) {
-# ifdef HAVE_TYPE_IN_UTMPX
-		if (utx->ut_type == USER_PROCESS)
-			return 1;
-# else
-		return 1;
-# endif
-	}
-	return 0;
-}
-
-
-int
-wtmpx_get_entry(struct logininfo *li)
-{
-	struct stat st;
-	struct utmpx utx;
-	int fd, found=0;
-
-	/* Clear the time entries */
-	li->tv_sec = li->tv_usec = 0;
-
-	if ((fd = open(WTMPX_FILE, O_RDONLY)) < 0) {
-		log("wtmpx_get_entry: problem opening %s: %s",
-		    WTMPX_FILE, strerror(errno));
-		return 0;
-	}
-	if (fstat(fd, &st) != 0) {
-		log("wtmpx_get_entry: couldn't stat %s: %s",
-		    WTMPX_FILE, strerror(errno));
-		close(fd);
-		return 0;
-	}
-
-	/* Seek to the start of the last struct utmpx */
-	if (lseek(fd, -(off_t)sizeof(struct utmpx), SEEK_END) == -1 ) {
-		/* probably a newly rotated wtmpx file */
-		close(fd);
-		return 0;
-	}
-
-	while (!found) {
-		if (atomicio(read, fd, &utx, sizeof(utx)) != sizeof(utx)) {
-			log("wtmpx_get_entry: read of %s failed: %s",
-			    WTMPX_FILE, strerror(errno));
-			close (fd);
-			return 0;
-		}
-		/* Logouts are recorded as a blank username on a particular line.
-		 * So, we just need to find the username in struct utmpx */
-		if ( wtmpx_islogin(li, &utx) ) {
-			found = 1;
-# ifdef HAVE_TV_IN_UTMPX
-			li->tv_sec = utx.ut_tv.tv_sec;
-# else
-#  ifdef HAVE_TIME_IN_UTMPX
-			li->tv_sec = utx.ut_time;
-#  endif
-# endif
-			line_fullname(li->line, utx.ut_line, sizeof(li->line));
-# ifdef HAVE_HOST_IN_UTMPX
-			strlcpy(li->hostname, utx.ut_host,
-				MIN_SIZEOF(li->hostname, utx.ut_host));
-# endif
-			continue;
-		}
-		if (lseek(fd, -(off_t)(2 * sizeof(struct utmpx)), SEEK_CUR) == -1) {
-			close (fd);
-			return 0;
-		}
-	}
-
-	close(fd);
-	return 1;
-}
-#endif /* USE_WTMPX */
-
-/**
- ** Low-level libutil login() functions
- **/
-
-#ifdef USE_LOGIN
-static int
-syslogin_perform_login(struct logininfo *li)
-{
-	struct utmp *ut;
-
-	if (! (ut = (struct utmp *)malloc(sizeof(*ut)))) {
-		log("syslogin_perform_login: couldn't malloc()");
-		return 0;
-	}
-	construct_utmp(li, ut);
-	login(ut);
-	free(ut);
-
-	return 1;
-}
-
-static int
-syslogin_perform_logout(struct logininfo *li)
-{
-# ifdef HAVE_LOGOUT
-	char line[8];
-
-	(void)line_stripname(line, li->line, sizeof(line));
-
-	if (!logout(line)) {
-		log("syslogin_perform_logout: logout() returned an error");
-#  ifdef HAVE_LOGWTMP
-	} else {
-		logwtmp(line, "", "");
-#  endif
-	}
-	/* FIXME: (ATL - if the need arises) What to do if we have
-	 * login, but no logout?  what if logout but no logwtmp? All
-	 * routines are in libutil so they should all be there,
-	 * but... */
-# endif
-	return 1;
-}
-
-int
-syslogin_write_entry(struct logininfo *li)
-{
-	switch (li->type) {
-	case LTYPE_LOGIN:
-		return syslogin_perform_login(li);
-	case LTYPE_LOGOUT:
-		return syslogin_perform_logout(li);
-	default:
-		log("syslogin_write_entry: Invalid type field");
-		return 0;
-	}
-}
-#endif /* USE_LOGIN */
-
-/* end of file log-syslogin.c */
-
-/**
- ** Low-level lastlog functions
- **/
-
-#ifdef USE_LASTLOG
-#define LL_FILE 1
-#define LL_DIR 2
-#define LL_OTHER 3
-
-static void
-lastlog_construct(struct logininfo *li, struct lastlog *last)
-{
-	/* clear the structure */
-	memset(last, '\0', sizeof(*last));
-
-	(void)line_stripname(last->ll_line, li->line, sizeof(last->ll_line));
-	strlcpy(last->ll_host, li->hostname,
-		MIN_SIZEOF(last->ll_host, li->hostname));
-	last->ll_time = li->tv_sec;
-}
-
-static int
-lastlog_filetype(char *filename)
-{
-	struct stat st;
-
-	if (stat(LASTLOG_FILE, &st) != 0) {
-		log("lastlog_perform_login: Couldn't stat %s: %s", LASTLOG_FILE,
-			strerror(errno));
-		return 0;
-	}
-	if (S_ISDIR(st.st_mode))
-		return LL_DIR;
-	else if (S_ISREG(st.st_mode))
-		return LL_FILE;
-	else
-		return LL_OTHER;
-}
-
-
-/* open the file (using filemode) and seek to the login entry */
-static int
-lastlog_openseek(struct logininfo *li, int *fd, int filemode)
-{
-	off_t offset;
-	int type;
-	char lastlog_file[1024];
-
-	type = lastlog_filetype(LASTLOG_FILE);
-	switch (type) {
-		case LL_FILE:
-			strlcpy(lastlog_file, LASTLOG_FILE, sizeof(lastlog_file));
-			break;
-		case LL_DIR:
-			snprintf(lastlog_file, sizeof(lastlog_file), "%s/%s",
-				 LASTLOG_FILE, li->username);
-			break;
-		default:
-			log("lastlog_openseek: %.100s is not a file or directory!",
-			    LASTLOG_FILE);
-			return 0;
-	}
-
-	*fd = open(lastlog_file, filemode);
-	if ( *fd < 0) {
-		debug("lastlog_openseek: Couldn't open %s: %s",
-		    lastlog_file, strerror(errno));
-		return 0;
-	}
-
-	if (type == LL_FILE) {
-		/* find this uid's offset in the lastlog file */
-		offset = (off_t) ((long)li->uid * sizeof(struct lastlog));
-
-		if ( lseek(*fd, offset, SEEK_SET) != offset ) {
-			log("lastlog_openseek: %s->lseek(): %s",
-			 lastlog_file, strerror(errno));
-			return 0;
-		}
-	}
-
-	return 1;
-}
-
-static int
-lastlog_perform_login(struct logininfo *li)
-{
-	struct lastlog last;
-	int fd;
-
-	/* create our struct lastlog */
-	lastlog_construct(li, &last);
-
-	if (!lastlog_openseek(li, &fd, O_RDWR|O_CREAT))
-		return(0);
-
-	/* write the entry */
-	if (atomicio(write, fd, &last, sizeof(last)) != sizeof(last)) {
-		close(fd);
-		log("lastlog_write_filemode: Error writing to %s: %s",
-		    LASTLOG_FILE, strerror(errno));
-		return 0;
-	}
-
-	close(fd);
-	return 1;
-}
-
-int
-lastlog_write_entry(struct logininfo *li)
-{
-	switch(li->type) {
-	case LTYPE_LOGIN:
-		return lastlog_perform_login(li);
-	default:
-		log("lastlog_write_entry: Invalid type field");
-		return 0;
-	}
-}
-
-static void
-lastlog_populate_entry(struct logininfo *li, struct lastlog *last)
-{
-	line_fullname(li->line, last->ll_line, sizeof(li->line));
-	strlcpy(li->hostname, last->ll_host,
-		MIN_SIZEOF(li->hostname, last->ll_host));
-	li->tv_sec = last->ll_time;
-}
-
-int
-lastlog_get_entry(struct logininfo *li)
-{
-	struct lastlog last;
-	int fd, ret;
-
-	if (!lastlog_openseek(li, &fd, O_RDONLY))
-		return (0);
-
-	ret = atomicio(read, fd, &last, sizeof(last));
-	close(fd);
-
-	switch (ret) {
-	case 0:
-		memset(&last, '\0', sizeof(last));
-		/* FALLTHRU */
-	case sizeof(last):
-		lastlog_populate_entry(li, &last);
-		return (1);
-	case -1:
-		error("%s: Error reading from %s: %s", __func__, 
-		    LASTLOG_FILE, strerror(errno));
-		return (0);
-	default:
-		error("%s: Error reading from %s: Expecting %d, got %d",
-		    __func__, LASTLOG_FILE, sizeof(last), ret);
-		return (0);
-	}
-
-	/* NOTREACHED */
-	return (0);
-}
-#endif /* USE_LASTLOG */
diff --git a/crypto/openssh/loginrec.h b/crypto/openssh/loginrec.h
deleted file mode 100644
index 732e21e116fe..000000000000
--- a/crypto/openssh/loginrec.h
+++ /dev/null
@@ -1,140 +0,0 @@
-#ifndef _HAVE_LOGINREC_H_
-#define _HAVE_LOGINREC_H_
-
-/*
- * Copyright (c) 2000 Andre Lucas.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by Markus Friedl.
- * 4. The name of the author may not be used to endorse or promote products
- *    derived from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- ** loginrec.h:  platform-independent login recording and lastlog retrieval
- **/
-
-#include "includes.h"
-
-#include <sys/types.h>
-#include <netinet/in.h>
-#include <sys/socket.h>
-
-/* RCSID("$Id: loginrec.h,v 1.6 2001/05/08 20:33:06 mouring Exp $"); */
-
-/**
- ** you should use the login_* calls to work around platform dependencies
- **/
-
-/*
- * login_netinfo structure
- */
-
-union login_netinfo {
-	struct sockaddr sa;
-	struct sockaddr_in sa_in;
-	struct sockaddr_storage sa_storage;
-};
-
-/*
- *   * logininfo structure  *
- */
-/* types - different to utmp.h 'type' macros */
-/* (though set to the same value as linux, openbsd and others...) */
-#define LTYPE_LOGIN    7
-#define LTYPE_LOGOUT   8
-
-/* string lengths - set very long */
-#define LINFO_PROGSIZE 64
-#define LINFO_LINESIZE 64
-#define LINFO_NAMESIZE 64
-#define LINFO_HOSTSIZE 256
-
-struct logininfo {
-	char       progname[LINFO_PROGSIZE];     /* name of program (for PAM) */
-	int        progname_null;
-	short int  type;                         /* type of login (LTYPE_*) */
-	int        pid;                          /* PID of login process */
-	int        uid;                          /* UID of this user */
-	char       line[LINFO_LINESIZE];         /* tty/pty name */
-	char       username[LINFO_NAMESIZE];     /* login username */
-	char       hostname[LINFO_HOSTSIZE];     /* remote hostname */
-	/* 'exit_status' structure components */
-	int        exit;                        /* process exit status */
-	int        termination;                 /* process termination status */
-	/* struct timeval (sys/time.h) isn't always available, if it isn't we'll
-	 * use time_t's value as tv_sec and set tv_usec to 0
-	 */
-	unsigned int tv_sec;
-	unsigned int tv_usec;
-	union login_netinfo hostaddr;       /* caller's host address(es) */
-}; /* struct logininfo */
-
-/*
- * login recording functions
- */
-
-/** 'public' functions */
-
-/* construct a new login entry */
-struct logininfo *login_alloc_entry(int pid, const char *username,
-				    const char *hostname, const char *line);
-/* free a structure */
-void login_free_entry(struct logininfo *li);
-/* fill out a pre-allocated structure with useful information */
-int login_init_entry(struct logininfo *li, int pid, const char *username,
-		     const char *hostname, const char *line);
-/* place the current time in a logininfo struct */
-void login_set_current_time(struct logininfo *li);
-
-/* record the entry */
-int login_login (struct logininfo *li);
-int login_logout(struct logininfo *li);
-#ifdef LOGIN_NEEDS_UTMPX
-int login_utmp_only(struct logininfo *li);
-#endif
-
-/** End of public functions */
-
-/* record the entry */
-int login_write (struct logininfo *li);
-int login_log_entry(struct logininfo *li);
-
-/* set the network address based on network address type */
-void login_set_addr(struct logininfo *li, const struct sockaddr *sa,
-		    const unsigned int sa_size);
-
-/*
- * lastlog retrieval functions
- */
-/* lastlog *entry* functions fill out a logininfo */
-struct logininfo *login_get_lastlog(struct logininfo *li, const int uid);
-/* lastlog *time* functions return time_t equivalent (uint) */
-unsigned int login_get_lastlog_time(const int uid);
-
-/* produce various forms of the line filename */
-char *line_fullname(char *dst, const char *src, int dstsize);
-char *line_stripname(char *dst, const char *src, int dstsize);
-char *line_abbrevname(char *dst, const char *src, int dstsize);
-
-#endif /* _HAVE_LOGINREC_H_ */
diff --git a/crypto/openssh/logintest.c b/crypto/openssh/logintest.c
deleted file mode 100644
index da9ea50eca0a..000000000000
--- a/crypto/openssh/logintest.c
+++ /dev/null
@@ -1,315 +0,0 @@
-/*
- * Copyright (c) 2000 Andre Lucas.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by Markus Friedl.
- * 4. The name of the author may not be used to endorse or promote products
- *    derived from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- ** logintest.c:  simple test driver for platform-independent login recording
- **               and lastlog retrieval
- **/
-
-#include "includes.h"
-
-#include <sys/types.h>
-#include <sys/wait.h>
-#include <unistd.h>
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <pwd.h>
-#include <netdb.h>
-#ifdef HAVE_TIME_H
-#include <time.h>
-#endif
-
-#include "loginrec.h"
-
-RCSID("$Id: logintest.c,v 1.8 2001/04/05 23:05:22 stevesk Exp $");
-
-#ifdef HAVE___PROGNAME
-extern char *__progname;
-#else
-char *__progname;
-#endif
-
-#define PAUSE_BEFORE_LOGOUT 3
-
-int nologtest = 0;
-int compile_opts_only = 0;
-int be_verbose = 0;
-
-
-/* Dump a logininfo to stdout. Assumes a tab size of 8 chars. */
-void
-dump_logininfo(struct logininfo *li, char *descname)
-{
-	/* yes I know how nasty this is */
-	printf("struct logininfo %s = {\n\t"
-	       "progname\t'%s'\n\ttype\t\t%d\n\t"
-	       "pid\t\t%d\n\tuid\t\t%d\n\t"
-	       "line\t\t'%s'\n\tusername\t'%s'\n\t"
-	       "hostname\t'%s'\n\texit\t\t%d\n\ttermination\t%d\n\t"
-	       "tv_sec\t%d\n\ttv_usec\t%d\n\t"
-	       "struct login_netinfo hostaddr {\n\t\t"
-	       "struct sockaddr sa {\n"
-	       "\t\t\tfamily\t%d\n\t\t}\n"
-	       "\t}\n"
-	       "}\n",
-	       descname, li->progname, li->type,
-	       li->pid, li->uid, li->line,
-	       li->username, li->hostname, li->exit,
-	       li->termination, li->tv_sec, li->tv_usec,
-	       li->hostaddr.sa.sa_family);
-}
-
-
-int
-testAPI()
-{
-	struct logininfo *li1;
-	struct passwd *pw;
-	struct hostent *he;
-	struct sockaddr_in sa_in4;
-	char cmdstring[256], stripline[8];
-	char username[32];
-#ifdef HAVE_TIME_H
-	time_t t0, t1, t2, logintime, logouttime;
-	char s_t0[64],s_t1[64],s_t2[64];
-	char s_logintime[64], s_logouttime[64]; /* ctime() strings */
-#endif
-
-	printf("**\n** Testing the API...\n**\n");
-
-	pw = getpwuid(getuid());
-	strlcpy(username, pw->pw_name, sizeof(username));
-
-	/* gethostname(hostname, sizeof(hostname)); */
-
-	printf("login_alloc_entry test (no host info):\n");
-
-	/* FIXME fake tty more effectively - this could upset some platforms */
-	li1 = login_alloc_entry((int)getpid(), username, NULL, ttyname(0));
-	strlcpy(li1->progname, "OpenSSH-logintest", sizeof(li1->progname));
-
-	if (be_verbose)
-		dump_logininfo(li1, "li1");
-
-	printf("Setting host address info for 'localhost' (may call out):\n");
-	if (! (he = gethostbyname("localhost"))) {
-		printf("Couldn't set hostname(lookup failed)\n");
-	} else {
-		/* NOTE: this is messy, but typically a program wouldn't have to set
-		 *  any of this, a sockaddr_in* would be already prepared */
-		memcpy((void *)&(sa_in4.sin_addr), (void *)&(he->h_addr_list[0][0]),
-		       sizeof(struct in_addr));
-		login_set_addr(li1, (struct sockaddr *) &sa_in4, sizeof(sa_in4));
-		strlcpy(li1->hostname, "localhost", sizeof(li1->hostname));
-	}
-	if (be_verbose)
-		dump_logininfo(li1, "li1");
-
-	if ((int)geteuid() != 0) {
-		printf("NOT RUNNING LOGIN TESTS - you are not root!\n");
-		return 1;
-	}
-
-	if (nologtest)
-		return 1;
-
-	line_stripname(stripline, li1->line, sizeof(stripline));
-
-	printf("Performing an invalid login attempt (no type field)\n--\n");
-	login_write(li1);
-	printf("--\n(Should have written errors to stderr)\n");
-
-#ifdef HAVE_TIME_H
-	(void)time(&t0);
-	strlcpy(s_t0, ctime(&t0), sizeof(s_t0));
-	t1 = login_get_lastlog_time(getuid());
-	strlcpy(s_t1, ctime(&t1), sizeof(s_t1));
-	printf("Before logging in:\n\tcurrent time is %d - %s\t"
-	       "lastlog time is %d - %s\n",
-	       (int)t0, s_t0, (int)t1, s_t1);
-#endif
-
-	printf("Performing a login on line %s ", stripline);
-#ifdef HAVE_TIME_H
-	(void)time(&logintime);
-	strlcpy(s_logintime, ctime(&logintime), sizeof(s_logintime));
-	printf("at %d - %s", (int)logintime, s_logintime);
-#endif
-	printf("--\n");
-	login_login(li1);
-
-	snprintf(cmdstring, sizeof(cmdstring), "who | grep '%s '",
-		 stripline);
-	system(cmdstring);
-
-	printf("--\nPausing for %d second(s)...\n", PAUSE_BEFORE_LOGOUT);
-	sleep(PAUSE_BEFORE_LOGOUT);
-
-	printf("Performing a logout ");
-#ifdef HAVE_TIME_H
-	(void)time(&logouttime);
-	strlcpy(s_logouttime, ctime(&logouttime), sizeof(s_logouttime));
-	printf("at %d - %s", (int)logouttime, s_logouttime);
-#endif
-	printf("\nThe root login shown above should be gone.\n"
-	       "If the root login hasn't gone, but another user on the same\n"
-	       "pty has, this is OK - we're hacking it here, and there\n"
-	       "shouldn't be two users on one pty in reality...\n"
-	       "-- ('who' output follows)\n");
-	login_logout(li1);
-
-	system(cmdstring);
-	printf("-- ('who' output ends)\n");
-
-#ifdef HAVE_TIME_H
-	t2 = login_get_lastlog_time(getuid());
-	strlcpy(s_t2, ctime(&t2), sizeof(s_t2));
-	printf("After logging in, lastlog time is %d - %s\n", (int)t2, s_t2);
-	if (t1 == t2)
-		printf("The lastlog times before and after logging in are the "
-		       "same.\nThis indicates that lastlog is ** NOT WORKING "
-		       "CORRECTLY **\n");
-	else if (t0 != t2)
-		/* We can be off by a second or so, even when recording works fine.
-		 * I'm not 100% sure why, but it's true. */
-		printf("** The login time and the lastlog time differ.\n"
-		       "** This indicates that lastlog is either recording the "
-		       "wrong time,\n** or retrieving the wrong entry.\n"
-		       "If it's off by less than %d second(s) "
-		       "run the test again.\n", PAUSE_BEFORE_LOGOUT);
-	else
-		printf("lastlog agrees with the login time. This is a good thing.\n");
-
-#endif
-
-	printf("--\nThe output of 'last' shown next should have "
-	       "an entry for root \n  on %s for the time shown above:\n--\n",
-	       stripline);
-	snprintf(cmdstring, sizeof(cmdstring), "last | grep '%s ' | head -3",
-		 stripline);
-	system(cmdstring);
-
-	printf("--\nEnd of login test.\n");
-
-	login_free_entry(li1);
-
-	return 1;
-} /* testAPI() */
-
-
-void
-testLineName(char *line)
-{
-	/* have to null-terminate - these functions are designed for
-	 * structures with fixed-length char arrays, and don't null-term.*/
-	char full[17], strip[9], abbrev[5];
-
-	memset(full, '\0', sizeof(full));
-	memset(strip, '\0', sizeof(strip));
-	memset(abbrev, '\0', sizeof(abbrev));
-
-	line_fullname(full, line, sizeof(full)-1);
-	line_stripname(strip, full, sizeof(strip)-1);
-	line_abbrevname(abbrev, full, sizeof(abbrev)-1);
-	printf("%s: %s, %s, %s\n", line, full, strip, abbrev);
-
-} /* testLineName() */
-
-
-int
-testOutput()
-{
-	printf("**\n** Testing linename functions\n**\n");
-	testLineName("/dev/pts/1");
-	testLineName("pts/1");
-	testLineName("pts/999");
-	testLineName("/dev/ttyp00");
-	testLineName("ttyp00");
-
-	return 1;
-} /* testOutput() */
-
-
-/* show which options got compiled in */
-void
-showOptions(void)
-{
-	printf("**\n** Compile-time options\n**\n");
-
-	printf("login recording methods selected:\n");
-#ifdef USE_LOGIN
-	printf("\tUSE_LOGIN\n");
-#endif
-#ifdef USE_UTMP
-	printf("\tUSE_UTMP (UTMP_FILE=%s)\n", UTMP_FILE);
-#endif
-#ifdef USE_UTMPX
-	printf("\tUSE_UTMPX (UTMPX_FILE=%s)\n", UTMPX_FILE);
-#endif
-#ifdef USE_WTMP
-	printf("\tUSE_WTMP (WTMP_FILE=%s)\n", WTMP_FILE);
-#endif
-#ifdef USE_WTMPX
-	printf("\tUSE_WTMPX (WTMPX_FILE=%s)\n", WTMPX_FILE);
-#endif
-#ifdef USE_LASTLOG
-	printf("\tUSE_LASTLOG (LASTLOG_FILE=%s)\n", LASTLOG_FILE);
-#endif
-	printf("\n");
-
-} /* showOptions() */
-
-
-int
-main(int argc, char *argv[])
-{
-	printf("Platform-independent login recording test driver\n");
-
-	__progname = get_progname(argv[0]);
-	if (argc == 2) {
-		if (strncmp(argv[1], "-i", 3) == 0)
-			compile_opts_only = 1;
-		else if (strncmp(argv[1], "-v", 3) == 0)
-			be_verbose=1;
-	}
-
-	if (!compile_opts_only) {
-		if (be_verbose && !testOutput())
-			return 1;
-
-		if (!testAPI())
-			return 1;
-	}
-
-	showOptions();
-
-	return 0;
-} /* main() */
-
diff --git a/crypto/openssh/mac.c b/crypto/openssh/mac.c
deleted file mode 100644
index ab9a03d84e86..000000000000
--- a/crypto/openssh/mac.c
+++ /dev/null
@@ -1,114 +0,0 @@
-/*
- * Copyright (c) 2001 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: mac.c,v 1.5 2002/05/16 22:02:50 markus Exp $");
-
-#include <openssl/hmac.h>
-
-#include "xmalloc.h"
-#include "getput.h"
-#include "log.h"
-#include "cipher.h"
-#include "kex.h"
-#include "mac.h"
-
-struct {
-	char		*name;
-	const EVP_MD *	(*mdfunc)(void);
-	int		truncatebits;	/* truncate digest if != 0 */
-} macs[] = {
-	{ "hmac-sha1",			EVP_sha1, 0, },
-	{ "hmac-sha1-96",		EVP_sha1, 96 },
-	{ "hmac-md5",			EVP_md5, 0 },
-	{ "hmac-md5-96",		EVP_md5, 96 },
-	{ "hmac-ripemd160",		EVP_ripemd160, 0 },
-	{ "hmac-ripemd160@openssh.com",	EVP_ripemd160, 0 },
-	{ NULL,				NULL, 0 }
-};
-
-int
-mac_init(Mac *mac, char *name)
-{
-	int i;
-	for (i = 0; macs[i].name; i++) {
-		if (strcmp(name, macs[i].name) == 0) {
-			if (mac != NULL) {
-				mac->md = (*macs[i].mdfunc)();
-				mac->key_len = mac->mac_len = EVP_MD_size(mac->md);
-				if (macs[i].truncatebits != 0)
-					mac->mac_len = macs[i].truncatebits/8;
-			}
-			debug2("mac_init: found %s", name);
-			return (0);
-		}
-	}
-	debug2("mac_init: unknown %s", name);
-	return (-1);
-}
-
-u_char *
-mac_compute(Mac *mac, u_int32_t seqno, u_char *data, int datalen)
-{
-	HMAC_CTX c;
-	static u_char m[EVP_MAX_MD_SIZE];
-	u_char b[4];
-
-	if (mac->key == NULL)
-		fatal("mac_compute: no key");
-	if (mac->mac_len > sizeof(m))
-		fatal("mac_compute: mac too long");
-	HMAC_Init(&c, mac->key, mac->key_len, mac->md);
-	PUT_32BIT(b, seqno);
-	HMAC_Update(&c, b, sizeof(b));
-	HMAC_Update(&c, data, datalen);
-	HMAC_Final(&c, m, NULL);
-	HMAC_cleanup(&c);
-	return (m);
-}
-
-/* XXX copied from ciphers_valid */
-#define	MAC_SEP	","
-int
-mac_valid(const char *names)
-{
-	char *maclist, *cp, *p;
-
-	if (names == NULL || strcmp(names, "") == 0)
-		return (0);
-	maclist = cp = xstrdup(names);
-	for ((p = strsep(&cp, MAC_SEP)); p && *p != '\0';
-	    (p = strsep(&cp, MAC_SEP))) {
-		if (mac_init(NULL, p) < 0) {
-			debug("bad mac %s [%s]", p, names);
-			xfree(maclist);
-			return (0);
-		} else {
-			debug3("mac ok: %s [%s]", p, names);
-		}
-	}
-	debug3("macs ok: [%s]", names);
-	xfree(maclist);
-	return (1);
-}
diff --git a/crypto/openssh/mac.h b/crypto/openssh/mac.h
deleted file mode 100644
index 43b485dd92be..000000000000
--- a/crypto/openssh/mac.h
+++ /dev/null
@@ -1,28 +0,0 @@
-/*      $OpenBSD: mac.h,v 1.3 2001/06/26 17:27:24 markus Exp $   */
-/*
- * Copyright (c) 2001 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-int	 mac_valid(const char *);
-int	 mac_init(Mac *, char *);
-u_char	*mac_compute(Mac *, u_int32_t, u_char *, int);
diff --git a/crypto/openssh/match.c b/crypto/openssh/match.c
deleted file mode 100644
index 3ddb62730271..000000000000
--- a/crypto/openssh/match.c
+++ /dev/null
@@ -1,269 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * Simple pattern matching, with '*' and '?' as wildcards.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-/*
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: match.c,v 1.19 2002/03/01 13:12:10 markus Exp $");
-
-#include "match.h"
-#include "xmalloc.h"
-
-/*
- * Returns true if the given string matches the pattern (which may contain ?
- * and * as wildcards), and zero if it does not match.
- */
-
-int
-match_pattern(const char *s, const char *pattern)
-{
-	for (;;) {
-		/* If at end of pattern, accept if also at end of string. */
-		if (!*pattern)
-			return !*s;
-
-		if (*pattern == '*') {
-			/* Skip the asterisk. */
-			pattern++;
-
-			/* If at end of pattern, accept immediately. */
-			if (!*pattern)
-				return 1;
-
-			/* If next character in pattern is known, optimize. */
-			if (*pattern != '?' && *pattern != '*') {
-				/*
-				 * Look instances of the next character in
-				 * pattern, and try to match starting from
-				 * those.
-				 */
-				for (; *s; s++)
-					if (*s == *pattern &&
-					    match_pattern(s + 1, pattern + 1))
-						return 1;
-				/* Failed. */
-				return 0;
-			}
-			/*
-			 * Move ahead one character at a time and try to
-			 * match at each position.
-			 */
-			for (; *s; s++)
-				if (match_pattern(s, pattern))
-					return 1;
-			/* Failed. */
-			return 0;
-		}
-		/*
-		 * There must be at least one more character in the string.
-		 * If we are at the end, fail.
-		 */
-		if (!*s)
-			return 0;
-
-		/* Check if the next character of the string is acceptable. */
-		if (*pattern != '?' && *pattern != *s)
-			return 0;
-
-		/* Move to the next character, both in string and in pattern. */
-		s++;
-		pattern++;
-	}
-	/* NOTREACHED */
-}
-
-/*
- * Tries to match the string against the
- * comma-separated sequence of subpatterns (each possibly preceded by ! to
- * indicate negation).  Returns -1 if negation matches, 1 if there is
- * a positive match, 0 if there is no match at all.
- */
-
-int
-match_pattern_list(const char *string, const char *pattern, u_int len,
-    int dolower)
-{
-	char sub[1024];
-	int negated;
-	int got_positive;
-	u_int i, subi;
-
-	got_positive = 0;
-	for (i = 0; i < len;) {
-		/* Check if the subpattern is negated. */
-		if (pattern[i] == '!') {
-			negated = 1;
-			i++;
-		} else
-			negated = 0;
-
-		/*
-		 * Extract the subpattern up to a comma or end.  Convert the
-		 * subpattern to lowercase.
-		 */
-		for (subi = 0;
-		    i < len && subi < sizeof(sub) - 1 && pattern[i] != ',';
-		    subi++, i++)
-			sub[subi] = dolower && isupper(pattern[i]) ?
-			    tolower(pattern[i]) : pattern[i];
-		/* If subpattern too long, return failure (no match). */
-		if (subi >= sizeof(sub) - 1)
-			return 0;
-
-		/* If the subpattern was terminated by a comma, skip the comma. */
-		if (i < len && pattern[i] == ',')
-			i++;
-
-		/* Null-terminate the subpattern. */
-		sub[subi] = '\0';
-
-		/* Try to match the subpattern against the string. */
-		if (match_pattern(string, sub)) {
-			if (negated)
-				return -1;		/* Negative */
-			else
-				got_positive = 1;	/* Positive */
-		}
-	}
-
-	/*
-	 * Return success if got a positive match.  If there was a negative
-	 * match, we have already returned -1 and never get here.
-	 */
-	return got_positive;
-}
-
-/*
- * Tries to match the host name (which must be in all lowercase) against the
- * comma-separated sequence of subpatterns (each possibly preceded by ! to
- * indicate negation).  Returns -1 if negation matches, 1 if there is
- * a positive match, 0 if there is no match at all.
- */
-int
-match_hostname(const char *host, const char *pattern, u_int len)
-{
-	return match_pattern_list(host, pattern, len, 1);
-}
-
-/*
- * returns 0 if we get a negative match for the hostname or the ip
- * or if we get no match at all.  returns 1 otherwise.
- */
-int
-match_host_and_ip(const char *host, const char *ipaddr,
-    const char *patterns)
-{
-	int mhost, mip;
-
-	/* negative ipaddr match */
-	if ((mip = match_hostname(ipaddr, patterns, strlen(patterns))) == -1)
-		return 0;
-	/* negative hostname match */
-	if ((mhost = match_hostname(host, patterns, strlen(patterns))) == -1)
-		return 0;
-	/* no match at all */
-	if (mhost == 0 && mip == 0)
-		return 0;
-	return 1;
-}
-
-/*
- * match user, user@host_or_ip, user@host_or_ip_list against pattern
- */
-int
-match_user(const char *user, const char *host, const char *ipaddr,
-    const char *pattern)
-{
-	char *p, *pat;
-	int ret;
-
-	if ((p = strchr(pattern,'@')) == NULL)
-		return match_pattern(user, pattern);
-
-	pat = xstrdup(pattern);
-	p = strchr(pat, '@');
-	*p++ = '\0';
-
-	if ((ret = match_pattern(user, pat)) == 1)
-		ret = match_host_and_ip(host, ipaddr, p);
-	xfree(pat);
-
-	return ret;
-}
-
-/*
- * Returns first item from client-list that is also supported by server-list,
- * caller must xfree() returned string.
- */
-#define	MAX_PROP	40
-#define	SEP	","
-char *
-match_list(const char *client, const char *server, u_int *next)
-{
-	char *sproposals[MAX_PROP];
-	char *c, *s, *p, *ret, *cp, *sp;
-	int i, j, nproposals;
-
-	c = cp = xstrdup(client);
-	s = sp = xstrdup(server);
-
-	for ((p = strsep(&sp, SEP)), i=0; p && *p != '\0';
-	    (p = strsep(&sp, SEP)), i++) {
-		if (i < MAX_PROP)
-			sproposals[i] = p;
-		else
-			break;
-	}
-	nproposals = i;
-
-	for ((p = strsep(&cp, SEP)), i=0; p && *p != '\0';
-	    (p = strsep(&cp, SEP)), i++) {
-		for (j = 0; j < nproposals; j++) {
-			if (strcmp(p, sproposals[j]) == 0) {
-				ret = xstrdup(p);
-				if (next != NULL)
-					*next = (cp == NULL) ?
-					    strlen(c) : cp - c;
-				xfree(c);
-				xfree(s);
-				return ret;
-			}
-		}
-	}
-	if (next != NULL)
-		*next = strlen(c);
-	xfree(c);
-	xfree(s);
-	return NULL;
-}
diff --git a/crypto/openssh/match.h b/crypto/openssh/match.h
deleted file mode 100644
index a0764e0013f9..000000000000
--- a/crypto/openssh/match.h
+++ /dev/null
@@ -1,24 +0,0 @@
-/*	$OpenBSD: match.h,v 1.12 2002/03/01 13:12:10 markus Exp $	*/
-
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-#ifndef MATCH_H
-#define MATCH_H
-
-int	 match_pattern(const char *, const char *);
-int	 match_pattern_list(const char *, const char *, u_int, int);
-int	 match_hostname(const char *, const char *, u_int);
-int	 match_host_and_ip(const char *, const char *, const char *);
-int	 match_user(const char *, const char *, const char *, const char *);
-char	*match_list(const char *, const char *, u_int *);
-
-#endif
diff --git a/crypto/openssh/md5crypt.c b/crypto/openssh/md5crypt.c
deleted file mode 100644
index ba98ccccc2ba..000000000000
--- a/crypto/openssh/md5crypt.c
+++ /dev/null
@@ -1,159 +0,0 @@
-/*
- * ----------------------------------------------------------------------------
- * "THE BEER-WARE LICENSE" (Revision 42):
- * <phk@login.dknet.dk> wrote this file.  As long as you retain this notice you
- * can do whatever you want with this stuff. If we meet some day, and you think
- * this stuff is worth it, you can buy me a beer in return.   Poul-Henning Kamp
- * ----------------------------------------------------------------------------
- */
-
-/*
- * Ported from FreeBSD to Linux, only minimal changes.  --marekm
- */
-
-/*
- * Adapted from shadow-19990607 by Tudor Bosman, tudorb@jm.nu
- */
-
-#include "includes.h"
-
-RCSID("$Id: md5crypt.c,v 1.5 2001/02/09 01:55:36 djm Exp $");
-
-#if defined(HAVE_MD5_PASSWORDS) && !defined(HAVE_MD5_CRYPT)
-
-#include <openssl/md5.h>
-
-static unsigned char itoa64[] =		/* 0 ... 63 => ascii - 64 */
-	"./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
-
-static char	*magic = "$1$";	/*
-				 * This string is magic for
-				 * this algorithm.  Having
-				 * it this way, we can get
-				 * get better later on
-				 */
-
-static void
-to64(char *s, unsigned long v, int n)
-{
-	while (--n >= 0) {
-		*s++ = itoa64[v&0x3f];
-		v >>= 6;
-	}
-}
-
-int
-is_md5_salt(const char *salt)
-{
-	return (!strncmp(salt, magic, strlen(magic)));
-}
-
-/*
- * UNIX password
- *
- * Use MD5 for what it is best at...
- */
-
-char *
-md5_crypt(const char *pw, const char *salt)
-{
-	static char     passwd[120], *p;
-	static const char *sp,*ep;
-	unsigned char	final[16];
-	int sl,pl,i,j;
-	MD5_CTX	ctx,ctx1;
-	unsigned long l;
-
-	/* Refine the Salt first */
-	sp = salt;
-
-	/* If it starts with the magic string, then skip that */
-	if(!strncmp(sp,magic,strlen(magic)))
-		sp += strlen(magic);
-
-	/* It stops at the first '$', max 8 chars */
-	for(ep=sp;*ep && *ep != '$' && ep < (sp+8);ep++)
-		continue;
-
-	/* get the length of the true salt */
-	sl = ep - sp;
-
-	MD5_Init(&ctx);
-
-	/* The password first, since that is what is most unknown */
-	MD5_Update(&ctx,pw,strlen(pw));
-
-	/* Then our magic string */
-	MD5_Update(&ctx,magic,strlen(magic));
-
-	/* Then the raw salt */
-	MD5_Update(&ctx,sp,sl);
-
-	/* Then just as many characters of the MD5(pw,salt,pw) */
-	MD5_Init(&ctx1);
-	MD5_Update(&ctx1,pw,strlen(pw));
-	MD5_Update(&ctx1,sp,sl);
-	MD5_Update(&ctx1,pw,strlen(pw));
-	MD5_Final(final,&ctx1);
-	for(pl = strlen(pw); pl > 0; pl -= 16)
-		MD5_Update(&ctx,final,pl>16 ? 16 : pl);
-
-	/* Don't leave anything around in vm they could use. */
-	memset(final,0,sizeof final);
-
-	/* Then something really weird... */
-	for (j=0,i = strlen(pw); i ; i >>= 1)
-		if(i&1)
-		    MD5_Update(&ctx, final+j, 1);
-		else
-		    MD5_Update(&ctx, pw+j, 1);
-
-	/* Now make the output string */
-	strcpy(passwd,magic);
-	strncat(passwd,sp,sl);
-	strcat(passwd,"$");
-
-	MD5_Final(final,&ctx);
-
-	/*
-	 * and now, just to make sure things don't run too fast
-	 * On a 60 Mhz Pentium this takes 34 msec, so you would
-	 * need 30 seconds to build a 1000 entry dictionary...
-	 */
-	for(i=0;i<1000;i++) {
-		MD5_Init(&ctx1);
-		if(i & 1)
-			MD5_Update(&ctx1,pw,strlen(pw));
-		else
-			MD5_Update(&ctx1,final,16);
-
-		if(i % 3)
-			MD5_Update(&ctx1,sp,sl);
-
-		if(i % 7)
-			MD5_Update(&ctx1,pw,strlen(pw));
-
-		if(i & 1)
-			MD5_Update(&ctx1,final,16);
-		else
-			MD5_Update(&ctx1,pw,strlen(pw));
-		MD5_Final(final,&ctx1);
-	}
-
-	p = passwd + strlen(passwd);
-
-	l = (final[ 0]<<16) | (final[ 6]<<8) | final[12]; to64(p,l,4); p += 4;
-	l = (final[ 1]<<16) | (final[ 7]<<8) | final[13]; to64(p,l,4); p += 4;
-	l = (final[ 2]<<16) | (final[ 8]<<8) | final[14]; to64(p,l,4); p += 4;
-	l = (final[ 3]<<16) | (final[ 9]<<8) | final[15]; to64(p,l,4); p += 4;
-	l = (final[ 4]<<16) | (final[10]<<8) | final[ 5]; to64(p,l,4); p += 4;
-	l =                    final[11]                ; to64(p,l,2); p += 2;
-	*p = '\0';
-
-	/* Don't leave anything around in vm they could use. */
-	memset(final,0,sizeof final);
-
-	return passwd;
-}
-
-#endif /* defined(HAVE_MD5_PASSWORDS) && !defined(HAVE_MD5_CRYPT) */
diff --git a/crypto/openssh/md5crypt.h b/crypto/openssh/md5crypt.h
deleted file mode 100644
index 21356fbe7621..000000000000
--- a/crypto/openssh/md5crypt.h
+++ /dev/null
@@ -1,32 +0,0 @@
-/*
- * ----------------------------------------------------------------------------
- * "THE BEER-WARE LICENSE" (Revision 42):
- * <phk@login.dknet.dk> wrote this file.  As long as you retain this notice you
- * can do whatever you want with this stuff. If we meet some day, and you think
- * this stuff is worth it, you can buy me a beer in return.   Poul-Henning Kamp
- * ----------------------------------------------------------------------------
- */
-
-/*
- * Ported from FreeBSD to Linux, only minimal changes.  --marekm
- */
-
-/*
- * Adapted from shadow-19990607 by Tudor Bosman, tudorb@jm.nu
- */
-
-/* $Id: md5crypt.h,v 1.3 2001/02/09 01:55:36 djm Exp $ */
-
-#ifndef _MD5CRYPT_H
-#define _MD5CRYPT_H
-
-#include "config.h"
-
-#if defined(HAVE_MD5_PASSWORDS) && !defined(HAVE_MD5_CRYPT)
-
-int is_md5_salt(const char *salt);
-char *md5_crypt(const char *pw, const char *salt);
-
-#endif /* defined(HAVE_MD5_PASSWORDS) && !defined(HAVE_MD5_CRYPT) */
-
-#endif /* MD5CRYPT_H */
diff --git a/crypto/openssh/mdoc2man.pl b/crypto/openssh/mdoc2man.pl
deleted file mode 100644
index 928fc5d7a334..000000000000
--- a/crypto/openssh/mdoc2man.pl
+++ /dev/null
@@ -1,592 +0,0 @@
-#!/usr/bin/perl
-###
-### Quick usage:  mdoc2man.pl < mdoc_manpage.8 > man_manpage.8
-###
-###
-###  Copyright (c) 2001 University of Illinois Board of Trustees
-###  Copyright (c) 2001 Mark D. Roth
-###  All rights reserved.
-### 
-###  Redistribution and use in source and binary forms, with or without
-###  modification, are permitted provided that the following conditions
-###  are met:
-###  1. Redistributions of source code must retain the above copyright
-###     notice, this list of conditions and the following disclaimer.
-###  2. Redistributions in binary form must reproduce the above copyright
-###     notice, this list of conditions and the following disclaimer in the
-###     documentation and/or other materials provided with the distribution.
-###  3. All advertising materials mentioning features or use of this software
-###     must display the following acknowledgement:
-###     This product includes software developed by the University of
-###     Illinois at Urbana, and their contributors.
-###  4. The University nor the names of their
-###     contributors may be used to endorse or promote products derived from
-###     this software without specific prior written permission.
-### 
-###  THIS SOFTWARE IS PROVIDED BY THE TRUSTEES AND CONTRIBUTORS ``AS IS'' AND
-###  ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-###  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-###  ARE DISCLAIMED.  IN NO EVENT SHALL THE TRUSTEES OR CONTRIBUTORS BE LIABLE
-###  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-###  DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-###  OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-###  HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-###  LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-###  OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-###  SUCH DAMAGE.
-###
-
-use strict;
-
-my ($name, $date, $id);
-my ($line);
-my ($optlist, $oldoptlist, $nospace, $enum, $synopsis);
-my ($reference, $block, $ext, $extopt, $literal);
-my (@refauthors, $reftitle, $refissue, $refdate, $refopt);
-
-
-$optlist = 0;		### 1 = bullet, 2 = enum, 3 = tag, 4 = item
-$oldoptlist = 0;
-$nospace = 0;
-$synopsis = 0;
-$reference = 0;
-$block = 0;
-$ext = 0;
-$extopt = 0;
-$literal = 0;
-
-while ($line = <STDIN>)
-{
-	if ($line !~ /^\./)
-	{
-		print $line;
-		print ".br\n"
-			if ($literal);
-		next;
-	}
-
-	$line =~ s/^\.//;
-
-	next
-		if ($line =~ m/\\"/);
-
-	$line = ParseMacro($line);
-	print($line)
-		if (defined $line);
-}
-
-
-
-sub ParseMacro # ($line)
-{
-	my ($line) = @_;
-	my (@words, $retval, $option, $parens);
-
-	@words = split(/\s+/, $line);
-	$retval = '';
-	$option = 0;
-	$parens = 0;
-
-#	print('@words = ', scalar(@words), ': ', join(' ', @words), "\n");
-
-	while ($_ = shift @words)
-	{
-#		print "WORD: $_\n";
-
-		next
-			if (/^(Li|Pf)$/);
-
-		if (/^Xo$/)
-		{
-			$ext = 1;
-			$retval .= ' '
-				if ($retval ne '' && $retval !~ m/[\n ]$/);
-			next;
-		}
-
-		if (/^Xc$/)
-		{
-			$ext = 0;
-			$retval .= "\n"
-				if (! $extopt);
-			last;
-		}
-
-		if (/^Bd$/)
-		{
-			$literal = 1
-				if ($words[0] eq '-literal');
-			$retval .= "\n";
-			last;
-		}
-
-		if (/^Ed$/)
-		{
-			$literal = 0;
-			last;
-		}
-
-		if (/^Ns$/)
-		{
-			$nospace = 1
-				if (! $nospace);
-			$retval =~ s/ $//;
-			next;
-		}
-
-		if (/^No$/)
-		{
-			$retval =~ s/ $//;
-			$retval .= shift @words;
-			next;
-		}
-
-		if (/^Dq$/)
-		{
-			$retval .= '``';
-			do
-			{
-				$retval .= (shift @words) . ' ';
-			}
-			while (@words > 0 && $words[0] !~ m/^[\.,]/);
-			$retval =~ s/ $//;
-			$retval .= '\'\'';
-			$nospace = 1
-				if (! $nospace && $words[0] =~ m/^[\.,]/);
-			next;
-		}
-
-		if (/^(Sq|Ql)$/)
-		{
-			$retval .= '`' . (shift @words) . '\'';
-			$nospace = 1
-				if (! $nospace && $words[0] =~ m/^[\.,]/);
-			next;
-		}
-
-#		if (/^Ic$/)
-#		{
-#			$retval .= '\\fB' . shift(@words) . '\\fP';
-#			next;
-#		}
-
-		if (/^Oo$/)
-		{
-#			$retval .= "[\\c\n";
-			$extopt = 1;
-			$nospace = 1
-				if (! $nospace);
-			$retval .= '[';
-			next;
-		}
-
-		if (/^Oc$/)
-		{
-			$extopt = 0;
-			$retval .= ']';
-			next;
-		}
-
-		$retval .= ' '
-			if (! $nospace && $retval ne '' && $retval !~ m/[\n ]$/);
-		$nospace = 0
-			if ($nospace == 1);
-
-		if (/^Dd$/)
-		{
-			$date = join(' ', @words);
-			return undef;
-		}
-
-		if (/^Dt$/)
-		{
-			$id = join(' ', @words);
-			return undef;
-		}
-
-		if (/^Os$/)
-		{
-			$retval .= '.TH '
-				. $id
-				. " \"$date\" \""
-				. join(' ', @words)
-				. "\"";
-			last;
-		}
-
-		if (/^Sh$/)
-		{
-			$retval .= '.SH';
-			if ($words[0] eq 'SYNOPSIS')
-			{
-				$synopsis = 1;
-			}
-			else
-			{
-				$synopsis = 0;
-			}
-			next;
-		}
-
-		if (/^Xr$/)
-		{
-			$retval .= '\\fB' . (shift @words) .
-				'\\fP(' . (shift @words) . ')'
-				. (shift @words);
-			last;
-		}
-
-		if (/^Rs/)
-		{
-			@refauthors = ();
-			$reftitle = '';
-			$refissue = '';
-			$refdate = '';
-			$refopt = '';
-			$reference = 1;
-			last;
-		}
-
-		if (/^Re/)
-		{
-			$retval .= "\n";
-
-			# authors
-			while (scalar(@refauthors) > 1)
-			{
-				$retval .= shift(@refauthors) . ', ';
-			}
-			$retval .= 'and '
-				if ($retval ne '');
-			$retval .= shift(@refauthors);
-			
-			# title 
-			$retval .= ', \\fI' . $reftitle . '\\fP';
-
-			# issue
-			$retval .= ', ' . $refissue
-				if ($refissue ne '');
-
-			# date
-			$retval .= ', ' . $refdate
-				if ($refdate ne '');
-
-			# optional info
-			$retval .= ', ' . $refopt
-				if ($refopt ne '');
-
-			$retval .= ".\n";
-
-			$reference = 0;
-			last;
-		}
-
-		if ($reference)
-		{
-			if (/^%A$/)
-			{
-				unshift(@refauthors, join(' ', @words));
-				last;
-			}
-
-			if (/^%T$/)
-			{
-				$reftitle = join(' ', @words);
-				$reftitle =~ s/^"//;
-				$reftitle =~ s/"$//;
-				last;
-			}
-
-			if (/^%N$/)
-			{
-				$refissue = join(' ', @words);
-				last;
-			}
-
-			if (/^%D$/)
-			{
-				$refdate = join(' ', @words);
-				last;
-			}
-
-			if (/^%O$/)
-			{
-				$refopt = join(' ', @words);
-				last;
-			}
-		}
-
-		if (/^Nm$/)
-		{
-			my $n = $name;
-			$n = shift @words
-				if (@words > 0);
-			$name = $n unless $name;
-			$retval .= ".br\n"
-				if ($synopsis);
-			$retval .= "\\fB$n\\fP";
-			$nospace = 1
-				if (! $nospace && $words[0] =~ m/^[\.,]/);
-			next;
-		}
-
-		if (/^Nd$/)
-		{
-			$retval .= '\\-';
-			next;
-		}
-
-		if (/^Fl$/)
-		{
-			$retval .= '\\fB\\-' . (shift @words) . '\\fP';
-			$nospace = 1
-				if (! $nospace && $words[0] =~ m/^[\.,]/);
-			next;
-		}
-
-		if (/^Ar$/)
-		{
-			$retval .= '\\fI';
-			if (! defined $words[0])
-			{
-				$retval .= 'file ...\\fP';
-			}
-			else
-			{
-				$retval .= shift(@words) . '\\fP';
-				while ($words[0] eq '|')
-				{
-					$retval .= ' ' . shift(@words);
-					$retval .= ' \\fI' . shift(@words);
-					$retval .= '\\fP';
-				}
-			}
-			$nospace = 1
-				if (! $nospace && $words[0] =~ m/^[\.,]/);
-			next;
-		}
-
-		if (/^Cm$/)
-		{
-			$retval .= '\\fB' . (shift @words) . '\\fP';
-			while ($words[0] =~ m/^[\.,:)]$/)
-			{
-				$retval .= shift(@words);
-			}
-			next;
-		}
-
-		if (/^Op$/)
-		{
-			$option = 1;
-			$nospace = 1
-				if (! $nospace);
-			$retval .= '[';
-#			my $tmp = pop(@words);
-#			$tmp .= ']';
-#			push(@words, $tmp);
-			next;
-		}
-
-		if (/^Pp$/)
-		{
-			$retval .= "\n";
-			next;
-		}
-
-		if (/^Ss$/)
-		{
-			$retval .= '.SS';
-			next;
-		}
-
-		if (/^Pa$/ && ! $option)
-		{
-			$retval .= '\\fI';
-			$retval .= '\\&'
-				if ($words[0] =~ m/^\./);
-			$retval .= (shift @words) . '\\fP';
-			while ($words[0] =~ m/^[\.,:;)]$/)
-			{
-				$retval .= shift(@words);
-			}
-#			$nospace = 1
-#				if (! $nospace && $words[0] =~ m/^[\.,:)]/);
-			next;
-		}
-
-		if (/^Dv$/)
-		{
-			$retval .= '.BR';
-			next;
-		}
-
-		if (/^(Em|Ev)$/)
-		{
-			$retval .= '.IR';
-			next;
-		}
-
-		if (/^Pq$/)
-		{
-			$retval .= '(';
-			$nospace = 1;
-			$parens = 1;
-			next;
-		}
-
-		if (/^(S[xy])$/)
-		{
-			$retval .= '.B ' . join(' ', @words);
-			last;
-		}
-
-		if (/^Ic$/)
-		{
-			$retval .= '\\fB';
-			while (defined $words[0]
-				&& $words[0] !~ m/^[\.,]/)
-			{
-				if ($words[0] eq 'Op')
-				{
-					shift(@words);
-					$retval .= '[';
-					my $tmp = pop(@words);
-					$tmp .= ']';
-					push(@words, $tmp);
-					next;
-				}
-				if ($words[0] eq 'Ar')
-				{
-					shift @words;
-					$retval .= '\\fI';
-					$retval .= shift @words;
-					$retval .= '\\fP';
-				}
-				else
-				{
-					$retval .= shift @words;
-				}
-				$retval .= ' '
-					if (! $nospace);
-			}
-			$retval =~ s/ $//;
-			$retval .= '\\fP';
-			$retval .= shift @words
-				if (defined $words[0]);
-			last;
-		}
-
-		if (/^Bl$/)
-		{
-			$oldoptlist = $optlist;
-			if ($words[0] eq '-bullet')
-			{
-				$optlist = 1;
-			}
-			elsif ($words[0] eq '-enum')
-			{
-				$optlist = 2;
-				$enum = 0;
-			}
-			elsif ($words[0] eq '-tag')
-			{
-				$optlist = 3;
-			}
-			elsif ($words[0] eq '-item')
-			{
-				$optlist = 4;
-			}
-			last;
-		}
-
-		if (/^El$/)
-		{
-			$optlist = $oldoptlist;
-			next;
-		}
-
-		if ($optlist && /^It$/)
-		{
-			if ($optlist == 1)
-			{
-				# bullets
-				$retval .= '.IP \\(bu';
-				next;
-			}
-
-			if ($optlist == 2)
-			{
-				# enum
-				$retval .= '.IP ' . (++$enum) . '.';
-				next;
-			}
-
-			if ($optlist == 3)
-			{
-				# tags
-				$retval .= ".TP\n";
-				if ($words[0] =~ m/^(Pa|Ev)$/)
-				{
-					shift @words;
-					$retval .= '.B';
-				}
-				next;
-			}
-
-			if ($optlist == 4)
-			{
-				# item
-				$retval .= ".IP\n";
-				next;
-			}
-
-			next;
-		}
-
-		if (/^Sm$/)
-		{
-			if ($words[0] eq 'off')
-			{
-				$nospace = 2;
-			}
-			elsif ($words[0] eq 'on')
-			{
-#				$retval .= "\n";
-				$nospace = 0;
-			}
-			shift @words;
-			next;
-		}
-
-		$retval .= "$_";
-	}
-
-	return undef
-		if ($retval eq '.');
-
-	$retval =~ s/^\.([^a-zA-Z])/$1/;
-#	$retval =~ s/ $//;
-
-	$retval .= ')'
-		if ($parens == 1);
-
-	$retval .= ']'
-		if ($option == 1);
-
-#	$retval .= ' '
-#		if ($nospace && $retval ne '' && $retval !~ m/\n$/);
-
-#	$retval .= ' '
-#		if ($extended && $retval !~ m/ $/);
-
-	$retval .= ' '
-		if ($ext && ! $extopt && $retval !~ m/ $/);
-
-	$retval .= "\n"
-		if (! $ext && ! $extopt && $retval ne '' && $retval !~ m/\n$/);
-
-	return $retval;
-}
-
-
diff --git a/crypto/openssh/misc.c b/crypto/openssh/misc.c
deleted file mode 100644
index 512fb22fbe5a..000000000000
--- a/crypto/openssh/misc.c
+++ /dev/null
@@ -1,351 +0,0 @@
-/*
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: misc.c,v 1.20 2002/12/13 10:03:15 markus Exp $");
-
-#include "misc.h"
-#include "log.h"
-#include "xmalloc.h"
-
-/* remove newline at end of string */
-char *
-chop(char *s)
-{
-	char *t = s;
-	while (*t) {
-		if (*t == '\n' || *t == '\r') {
-			*t = '\0';
-			return s;
-		}
-		t++;
-	}
-	return s;
-
-}
-
-/* set/unset filedescriptor to non-blocking */
-void
-set_nonblock(int fd)
-{
-	int val;
-
-	val = fcntl(fd, F_GETFL, 0);
-	if (val < 0) {
-		error("fcntl(%d, F_GETFL, 0): %s", fd, strerror(errno));
-		return;
-	}
-	if (val & O_NONBLOCK) {
-		debug2("fd %d is O_NONBLOCK", fd);
-		return;
-	}
-	debug("fd %d setting O_NONBLOCK", fd);
-	val |= O_NONBLOCK;
-	if (fcntl(fd, F_SETFL, val) == -1)
-		debug("fcntl(%d, F_SETFL, O_NONBLOCK): %s",
-		    fd, strerror(errno));
-}
-
-void
-unset_nonblock(int fd)
-{
-	int val;
-
-	val = fcntl(fd, F_GETFL, 0);
-	if (val < 0) {
-		error("fcntl(%d, F_GETFL, 0): %s", fd, strerror(errno));
-		return;
-	}
-	if (!(val & O_NONBLOCK)) {
-		debug2("fd %d is not O_NONBLOCK", fd);
-		return;
-	}
-	debug("fd %d clearing O_NONBLOCK", fd);
-	val &= ~O_NONBLOCK;
-	if (fcntl(fd, F_SETFL, val) == -1)
-		debug("fcntl(%d, F_SETFL, O_NONBLOCK): %s",
-		    fd, strerror(errno));
-}
-
-/* disable nagle on socket */
-void
-set_nodelay(int fd)
-{
-	int opt;
-	socklen_t optlen;
-
-	optlen = sizeof opt;
-	if (getsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &opt, &optlen) == -1) {
-		error("getsockopt TCP_NODELAY: %.100s", strerror(errno));
-		return;
-	}
-	if (opt == 1) {
-		debug2("fd %d is TCP_NODELAY", fd);
-		return;
-	}
-	opt = 1;
-	debug2("fd %d setting TCP_NODELAY", fd);
-	if (setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &opt, sizeof opt) == -1)
-		error("setsockopt TCP_NODELAY: %.100s", strerror(errno));
-}
-
-/* Characters considered whitespace in strsep calls. */
-#define WHITESPACE " \t\r\n"
-
-/* return next token in configuration line */
-char *
-strdelim(char **s)
-{
-	char *old;
-	int wspace = 0;
-
-	if (*s == NULL)
-		return NULL;
-
-	old = *s;
-
-	*s = strpbrk(*s, WHITESPACE "=");
-	if (*s == NULL)
-		return (old);
-
-	/* Allow only one '=' to be skipped */
-	if (*s[0] == '=')
-		wspace = 1;
-	*s[0] = '\0';
-
-	*s += strspn(*s + 1, WHITESPACE) + 1;
-	if (*s[0] == '=' && !wspace)
-		*s += strspn(*s + 1, WHITESPACE) + 1;
-
-	return (old);
-}
-
-struct passwd *
-pwcopy(struct passwd *pw)
-{
-	struct passwd *copy = xmalloc(sizeof(*copy));
-
-	memset(copy, 0, sizeof(*copy));
-	copy->pw_name = xstrdup(pw->pw_name);
-	copy->pw_passwd = xstrdup(pw->pw_passwd);
-	copy->pw_gecos = xstrdup(pw->pw_gecos);
-	copy->pw_uid = pw->pw_uid;
-	copy->pw_gid = pw->pw_gid;
-#ifdef HAVE_PW_EXPIRE_IN_PASSWD
-	copy->pw_expire = pw->pw_expire;
-#endif
-#ifdef HAVE_PW_CHANGE_IN_PASSWD
-	copy->pw_change = pw->pw_change;
-#endif
-#ifdef HAVE_PW_CLASS_IN_PASSWD
-	copy->pw_class = xstrdup(pw->pw_class);
-#endif
-	copy->pw_dir = xstrdup(pw->pw_dir);
-	copy->pw_shell = xstrdup(pw->pw_shell);
-	return copy;
-}
-
-/*
- * Convert ASCII string to TCP/IP port number.
- * Port must be >0 and <=65535.
- * Return 0 if invalid.
- */
-int
-a2port(const char *s)
-{
-	long port;
-	char *endp;
-
-	errno = 0;
-	port = strtol(s, &endp, 0);
-	if (s == endp || *endp != '\0' ||
-	    (errno == ERANGE && (port == LONG_MIN || port == LONG_MAX)) ||
-	    port <= 0 || port > 65535)
-		return 0;
-
-	return port;
-}
-
-#define SECONDS		1
-#define MINUTES		(SECONDS * 60)
-#define HOURS		(MINUTES * 60)
-#define DAYS		(HOURS * 24)
-#define WEEKS		(DAYS * 7)
-
-/*
- * Convert a time string into seconds; format is
- * a sequence of:
- *      time[qualifier]
- *
- * Valid time qualifiers are:
- *      <none>  seconds
- *      s|S     seconds
- *      m|M     minutes
- *      h|H     hours
- *      d|D     days
- *      w|W     weeks
- *
- * Examples:
- *      90m     90 minutes
- *      1h30m   90 minutes
- *      2d      2 days
- *      1w      1 week
- *
- * Return -1 if time string is invalid.
- */
-long
-convtime(const char *s)
-{
-	long total, secs;
-	const char *p;
-	char *endp;
-
-	errno = 0;
-	total = 0;
-	p = s;
-
-	if (p == NULL || *p == '\0')
-		return -1;
-
-	while (*p) {
-		secs = strtol(p, &endp, 10);
-		if (p == endp ||
-		    (errno == ERANGE && (secs == LONG_MIN || secs == LONG_MAX)) ||
-		    secs < 0)
-			return -1;
-
-		switch (*endp++) {
-		case '\0':
-			endp--;
-		case 's':
-		case 'S':
-			break;
-		case 'm':
-		case 'M':
-			secs *= MINUTES;
-			break;
-		case 'h':
-		case 'H':
-			secs *= HOURS;
-			break;
-		case 'd':
-		case 'D':
-			secs *= DAYS;
-			break;
-		case 'w':
-		case 'W':
-			secs *= WEEKS;
-			break;
-		default:
-			return -1;
-		}
-		total += secs;
-		if (total < 0)
-			return -1;
-		p = endp;
-	}
-
-	return total;
-}
-
-char *
-cleanhostname(char *host)
-{
-	if (*host == '[' && host[strlen(host) - 1] == ']') {
-		host[strlen(host) - 1] = '\0';
-		return (host + 1);
-	} else
-		return host;
-}
-
-char *
-colon(char *cp)
-{
-	int flag = 0;
-
-	if (*cp == ':')		/* Leading colon is part of file name. */
-		return (0);
-	if (*cp == '[')
-		flag = 1;
-
-	for (; *cp; ++cp) {
-		if (*cp == '@' && *(cp+1) == '[')
-			flag = 1;
-		if (*cp == ']' && *(cp+1) == ':' && flag)
-			return (cp+1);
-		if (*cp == ':' && !flag)
-			return (cp);
-		if (*cp == '/')
-			return (0);
-	}
-	return (0);
-}
-
-/* function to assist building execv() arguments */
-void
-addargs(arglist *args, char *fmt, ...)
-{
-	va_list ap;
-	char buf[1024];
-
-	va_start(ap, fmt);
-	vsnprintf(buf, sizeof(buf), fmt, ap);
-	va_end(ap);
-
-	if (args->list == NULL) {
-		args->nalloc = 32;
-		args->num = 0;
-	} else if (args->num+2 >= args->nalloc)
-		args->nalloc *= 2;
-
-	args->list = xrealloc(args->list, args->nalloc * sizeof(char *));
-	args->list[args->num++] = xstrdup(buf);
-	args->list[args->num] = NULL;
-}
-
-mysig_t
-mysignal(int sig, mysig_t act)
-{
-#ifdef HAVE_SIGACTION
-	struct sigaction sa, osa;
-
-	if (sigaction(sig, NULL, &osa) == -1)
-		return (mysig_t) -1;
-	if (osa.sa_handler != act) {
-		memset(&sa, 0, sizeof(sa));
-		sigemptyset(&sa.sa_mask);
-		sa.sa_flags = 0;
-#if defined(SA_INTERRUPT)
-		if (sig == SIGALRM)
-			sa.sa_flags |= SA_INTERRUPT;
-#endif
-		sa.sa_handler = act;
-		if (sigaction(sig, &sa, NULL) == -1)
-			return (mysig_t) -1;
-	}
-	return (osa.sa_handler);
-#else
-	return (signal(sig, act));
-#endif
-}
diff --git a/crypto/openssh/misc.h b/crypto/openssh/misc.h
deleted file mode 100644
index 3b4b879676f4..000000000000
--- a/crypto/openssh/misc.h
+++ /dev/null
@@ -1,37 +0,0 @@
-/*	$OpenBSD: misc.h,v 1.12 2002/03/19 10:49:35 markus Exp $	*/
-
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-char	*chop(char *);
-char	*strdelim(char **);
-void	 set_nonblock(int);
-void	 unset_nonblock(int);
-void	 set_nodelay(int);
-int	 a2port(const char *);
-char	*cleanhostname(char *);
-char	*colon(char *);
-long	 convtime(const char *);
-
-struct passwd *pwcopy(struct passwd *);
-
-typedef struct arglist arglist;
-struct arglist {
-	char    **list;
-	int     num;
-	int     nalloc;
-};
-void	 addargs(arglist *, char *, ...) __attribute__((format(printf, 2, 3)));
-
-/* wrapper for signal interface */
-typedef void (*mysig_t)(int);
-mysig_t mysignal(int sig, mysig_t act);
diff --git a/crypto/openssh/mkinstalldirs b/crypto/openssh/mkinstalldirs
deleted file mode 100755
index 614ef33d8824..000000000000
--- a/crypto/openssh/mkinstalldirs
+++ /dev/null
@@ -1,40 +0,0 @@
-#! /bin/sh
-# mkinstalldirs --- make directory hierarchy
-# Author: Noah Friedman <friedman@prep.ai.mit.edu>
-# Created: 1993-05-16
-# Public domain
-
-# $Id: mkinstalldirs,v 1.1 2000/05/20 05:33:45 damien Exp $
-
-errstatus=0
-
-for file
-do
-   set fnord `echo ":$file" | sed -ne 's/^:\//#/;s/^://;s/\// /g;s/^#/\//;p'`
-   shift
-
-   pathcomp=
-   for d
-   do
-     pathcomp="$pathcomp$d"
-     case "$pathcomp" in
-       -* ) pathcomp=./$pathcomp ;;
-     esac
-
-     if test ! -d "$pathcomp"; then
-        echo "mkdir $pathcomp"
-
-        mkdir "$pathcomp" || lasterr=$?
-
-        if test ! -d "$pathcomp"; then
-  	  errstatus=$lasterr
-        fi
-     fi
-
-     pathcomp="$pathcomp/"
-   done
-done
-
-exit $errstatus
-
-# mkinstalldirs ends here
diff --git a/crypto/openssh/moduli b/crypto/openssh/moduli
deleted file mode 100644
index 6b94e2e231d7..000000000000
--- a/crypto/openssh/moduli
+++ /dev/null
@@ -1,158 +0,0 @@
-#	$OpenBSD: moduli,v 1.1 2001/06/22 22:07:54 provos Exp $
-
-# Time Type Tests Tries Size Generator Modulus
-20010328182134 2 6 100 1023 2 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF5449C221CB
-20010328182222 2 6 100 1023 2 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF5449C95A43
-20010328182256 2 6 100 1023 2 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF5449CC8CFB
-20010328182409 2 6 100 1023 5 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF5449D9BDB7
-20010328182628 2 6 100 1023 2 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF5449FB6EF3
-20010328182708 2 6 100 1023 2 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF544A000153
-20010328182758 2 6 100 1023 2 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF544A06E9EB
-20010328182946 2 6 100 1023 2 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF544A1F2C93
-20010328183015 2 6 100 1023 2 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF544A206ADB
-20010328183112 2 6 100 1023 2 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF544A2A109B
-20010328183143 2 6 100 1023 2 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF544A2BC1BB
-20010328183301 2 6 100 1023 2 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF544A3ADCEB
-20010328183532 2 6 100 1023 5 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF544A5E8BAF
-20010328183646 2 6 100 1023 5 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF544A6D54D7
-20010328183712 2 6 100 1023 5 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF544A6EC46F
-20010328184223 2 6 100 1023 5 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF544AB8626F
-20010328184337 2 6 100 1023 2 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF544AC7DC73
-20010328184634 2 6 100 1023 2 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF544AEFF073
-20010328184714 2 6 100 1023 5 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF544AF594FF
-20010328184807 2 6 100 1023 2 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF544AFEEC53
-20010328184910 2 6 100 1023 2 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF544B0B3513
-20010328185030 2 6 100 1023 5 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF544B165707
-20010328185334 2 6 100 1023 2 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF544B3A9673
-20010328185423 2 6 100 1023 2 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF544B426623
-20010328185451 2 6 100 1023 2 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF544B4427DB
-20010328185637 2 6 100 1023 5 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF544B5E3FC7
-20010328185720 2 6 100 1023 2 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF544B65964B
-20010328185757 2 6 100 1023 2 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF544B6A9373
-20010328185844 2 6 100 1023 2 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF544B7203B3
-20010328185933 2 6 100 1023 5 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF544B7A9FFF
-20010328190006 2 6 100 1023 2 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF544B7DAAD3
-20010328190054 2 6 100 1023 5 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF544B855C2F
-20010328190139 2 6 100 1023 2 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF544B8C53EB
-20010328190304 2 6 100 1023 2 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF544B9F26C3
-20010328190329 2 6 100 1023 5 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF544BA00697
-20010328190412 2 6 100 1023 2 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF544BA54313
-20010328190506 2 6 100 1023 5 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF544BAEEF27
-20010328190550 2 6 100 1023 2 DCFAC4EFE89F5B082962AB9A67E8D63E84FA491E5D3874978815868595469163DA0661E6208A8C2CD4F83893B53864ADFD2154E8D8EFA146BAD808562E4BF6C90348FD79EEB3387D93FC7943BC450BA55399BA3CF3DFBD0D4E71800007B0E9D5F12E7A2CB7EA4E49812E715F8DC570C478DC2DEB1C49B0AE87A5DF544BB5CE0B
-20010328200734 2 6 100 1534 5 6DFD16D9669EDAF42EF5D4EED82AA84B0541DEC2045B6AF55021A184F32BCADE614A114137022C9A8B41C09AFC38199E7305864F70A8708F37FC2127264ECF4FA32391F243CC62B89602D3813082679E5BDF496BA9DFA4C818AD21EC261B6F11841E6F2DE1574CE95095841DAF052868CCD5E9BFCA543E0934B50A76A598E693136DE2D479AEF3785D97BAFF4FB85AB8D46DA424C4CC5E11ABCAF718837E16350982BF8A27728318EC02C71ED164F57CDB121B72614B7B7C406613EC33395187
-20010328201124 2 6 100 1534 2 6DFD16D9669EDAF42EF5D4EED82AA84B0541DEC2045B6AF55021A184F32BCADE614A114137022C9A8B41C09AFC38199E7305864F70A8708F37FC2127264ECF4FA32391F243CC62B89602D3813082679E5BDF496BA9DFA4C818AD21EC261B6F11841E6F2DE1574CE95095841DAF052868CCD5E9BFCA543E0934B50A76A598E693136DE2D479AEF3785D97BAFF4FB85AB8D46DA424C4CC5E11ABCAF718837E16350982BF8A27728318EC02C71ED164F57CDB121B72614B7B7C406613EC334ED15B
-20010328201358 2 6 100 1534 5 6DFD16D9669EDAF42EF5D4EED82AA84B0541DEC2045B6AF55021A184F32BCADE614A114137022C9A8B41C09AFC38199E7305864F70A8708F37FC2127264ECF4FA32391F243CC62B89602D3813082679E5BDF496BA9DFA4C818AD21EC261B6F11841E6F2DE1574CE95095841DAF052868CCD5E9BFCA543E0934B50A76A598E693136DE2D479AEF3785D97BAFF4FB85AB8D46DA424C4CC5E11ABCAF718837E16350982BF8A27728318EC02C71ED164F57CDB121B72614B7B7C406613EC3359FC07
-20010328201537 2 6 100 1534 2 6DFD16D9669EDAF42EF5D4EED82AA84B0541DEC2045B6AF55021A184F32BCADE614A114137022C9A8B41C09AFC38199E7305864F70A8708F37FC2127264ECF4FA32391F243CC62B89602D3813082679E5BDF496BA9DFA4C818AD21EC261B6F11841E6F2DE1574CE95095841DAF052868CCD5E9BFCA543E0934B50A76A598E693136DE2D479AEF3785D97BAFF4FB85AB8D46DA424C4CC5E11ABCAF718837E16350982BF8A27728318EC02C71ED164F57CDB121B72614B7B7C406613EC335F7A83
-20010328201829 2 6 100 1534 2 6DFD16D9669EDAF42EF5D4EED82AA84B0541DEC2045B6AF55021A184F32BCADE614A114137022C9A8B41C09AFC38199E7305864F70A8708F37FC2127264ECF4FA32391F243CC62B89602D3813082679E5BDF496BA9DFA4C818AD21EC261B6F11841E6F2DE1574CE95095841DAF052868CCD5E9BFCA543E0934B50A76A598E693136DE2D479AEF3785D97BAFF4FB85AB8D46DA424C4CC5E11ABCAF718837E16350982BF8A27728318EC02C71ED164F57CDB121B72614B7B7C406613EC336D1433
-20010328202120 2 6 100 1534 2 6DFD16D9669EDAF42EF5D4EED82AA84B0541DEC2045B6AF55021A184F32BCADE614A114137022C9A8B41C09AFC38199E7305864F70A8708F37FC2127264ECF4FA32391F243CC62B89602D3813082679E5BDF496BA9DFA4C818AD21EC261B6F11841E6F2DE1574CE95095841DAF052868CCD5E9BFCA543E0934B50A76A598E693136DE2D479AEF3785D97BAFF4FB85AB8D46DA424C4CC5E11ABCAF718837E16350982BF8A27728318EC02C71ED164F57CDB121B72614B7B7C406613EC337B253B
-20010328202848 2 6 100 1534 5 6DFD16D9669EDAF42EF5D4EED82AA84B0541DEC2045B6AF55021A184F32BCADE614A114137022C9A8B41C09AFC38199E7305864F70A8708F37FC2127264ECF4FA32391F243CC62B89602D3813082679E5BDF496BA9DFA4C818AD21EC261B6F11841E6F2DE1574CE95095841DAF052868CCD5E9BFCA543E0934B50A76A598E693136DE2D479AEF3785D97BAFF4FB85AB8D46DA424C4CC5E11ABCAF718837E16350982BF8A27728318EC02C71ED164F57CDB121B72614B7B7C406613EC33A3D43F
-20010328203335 2 6 100 1534 2 6DFD16D9669EDAF42EF5D4EED82AA84B0541DEC2045B6AF55021A184F32BCADE614A114137022C9A8B41C09AFC38199E7305864F70A8708F37FC2127264ECF4FA32391F243CC62B89602D3813082679E5BDF496BA9DFA4C818AD21EC261B6F11841E6F2DE1574CE95095841DAF052868CCD5E9BFCA543E0934B50A76A598E693136DE2D479AEF3785D97BAFF4FB85AB8D46DA424C4CC5E11ABCAF718837E16350982BF8A27728318EC02C71ED164F57CDB121B72614B7B7C406613EC33BF24A3
-20010328204332 2 6 100 1534 2 6DFD16D9669EDAF42EF5D4EED82AA84B0541DEC2045B6AF55021A184F32BCADE614A114137022C9A8B41C09AFC38199E7305864F70A8708F37FC2127264ECF4FA32391F243CC62B89602D3813082679E5BDF496BA9DFA4C818AD21EC261B6F11841E6F2DE1574CE95095841DAF052868CCD5E9BFCA543E0934B50A76A598E693136DE2D479AEF3785D97BAFF4FB85AB8D46DA424C4CC5E11ABCAF718837E16350982BF8A27728318EC02C71ED164F57CDB121B72614B7B7C406613EC34011B8B
-20010328204443 2 6 100 1534 5 6DFD16D9669EDAF42EF5D4EED82AA84B0541DEC2045B6AF55021A184F32BCADE614A114137022C9A8B41C09AFC38199E7305864F70A8708F37FC2127264ECF4FA32391F243CC62B89602D3813082679E5BDF496BA9DFA4C818AD21EC261B6F11841E6F2DE1574CE95095841DAF052868CCD5E9BFCA543E0934B50A76A598E693136DE2D479AEF3785D97BAFF4FB85AB8D46DA424C4CC5E11ABCAF718837E16350982BF8A27728318EC02C71ED164F57CDB121B72614B7B7C406613EC3402A92F
-20010328204617 2 6 100 1534 2 6DFD16D9669EDAF42EF5D4EED82AA84B0541DEC2045B6AF55021A184F32BCADE614A114137022C9A8B41C09AFC38199E7305864F70A8708F37FC2127264ECF4FA32391F243CC62B89602D3813082679E5BDF496BA9DFA4C818AD21EC261B6F11841E6F2DE1574CE95095841DAF052868CCD5E9BFCA543E0934B50A76A598E693136DE2D479AEF3785D97BAFF4FB85AB8D46DA424C4CC5E11ABCAF718837E16350982BF8A27728318EC02C71ED164F57CDB121B72614B7B7C406613EC3406D343
-20010328205458 2 6 100 1534 2 6DFD16D9669EDAF42EF5D4EED82AA84B0541DEC2045B6AF55021A184F32BCADE614A114137022C9A8B41C09AFC38199E7305864F70A8708F37FC2127264ECF4FA32391F243CC62B89602D3813082679E5BDF496BA9DFA4C818AD21EC261B6F11841E6F2DE1574CE95095841DAF052868CCD5E9BFCA543E0934B50A76A598E693136DE2D479AEF3785D97BAFF4FB85AB8D46DA424C4CC5E11ABCAF718837E16350982BF8A27728318EC02C71ED164F57CDB121B72614B7B7C406613EC3436FA2B
-20010328210413 2 6 100 1534 2 6DFD16D9669EDAF42EF5D4EED82AA84B0541DEC2045B6AF55021A184F32BCADE614A114137022C9A8B41C09AFC38199E7305864F70A8708F37FC2127264ECF4FA32391F243CC62B89602D3813082679E5BDF496BA9DFA4C818AD21EC261B6F11841E6F2DE1574CE95095841DAF052868CCD5E9BFCA543E0934B50A76A598E693136DE2D479AEF3785D97BAFF4FB85AB8D46DA424C4CC5E11ABCAF718837E16350982BF8A27728318EC02C71ED164F57CDB121B72614B7B7C406613EC3471CF1B
-20010328213513 2 6 100 1534 5 6DFD16D9669EDAF42EF5D4EED82AA84B0541DEC2045B6AF55021A184F32BCADE614A114137022C9A8B41C09AFC38199E7305864F70A8708F37FC2127264ECF4FA32391F243CC62B89602D3813082679E5BDF496BA9DFA4C818AD21EC261B6F11841E6F2DE1574CE95095841DAF052868CCD5E9BFCA543E0934B50A76A598E693136DE2D479AEF3785D97BAFF4FB85AB8D46DA424C4CC5E11ABCAF718837E16350982BF8A27728318EC02C71ED164F57CDB121B72614B7B7C406613EC352AF5EF
-20010328215014 2 6 100 1534 2 6DFD16D9669EDAF42EF5D4EED82AA84B0541DEC2045B6AF55021A184F32BCADE614A114137022C9A8B41C09AFC38199E7305864F70A8708F37FC2127264ECF4FA32391F243CC62B89602D3813082679E5BDF496BA9DFA4C818AD21EC261B6F11841E6F2DE1574CE95095841DAF052868CCD5E9BFCA543E0934B50A76A598E693136DE2D479AEF3785D97BAFF4FB85AB8D46DA424C4CC5E11ABCAF718837E16350982BF8A27728318EC02C71ED164F57CDB121B72614B7B7C406613EC358CC3CB
-20010328215520 2 6 100 1534 5 6DFD16D9669EDAF42EF5D4EED82AA84B0541DEC2045B6AF55021A184F32BCADE614A114137022C9A8B41C09AFC38199E7305864F70A8708F37FC2127264ECF4FA32391F243CC62B89602D3813082679E5BDF496BA9DFA4C818AD21EC261B6F11841E6F2DE1574CE95095841DAF052868CCD5E9BFCA543E0934B50A76A598E693136DE2D479AEF3785D97BAFF4FB85AB8D46DA424C4CC5E11ABCAF718837E16350982BF8A27728318EC02C71ED164F57CDB121B72614B7B7C406613EC35A9B7FF
-20010328215733 2 6 100 1534 5 6DFD16D9669EDAF42EF5D4EED82AA84B0541DEC2045B6AF55021A184F32BCADE614A114137022C9A8B41C09AFC38199E7305864F70A8708F37FC2127264ECF4FA32391F243CC62B89602D3813082679E5BDF496BA9DFA4C818AD21EC261B6F11841E6F2DE1574CE95095841DAF052868CCD5E9BFCA543E0934B50A76A598E693136DE2D479AEF3785D97BAFF4FB85AB8D46DA424C4CC5E11ABCAF718837E16350982BF8A27728318EC02C71ED164F57CDB121B72614B7B7C406613EC35B2927F
-20010328220114 2 6 100 1534 2 6DFD16D9669EDAF42EF5D4EED82AA84B0541DEC2045B6AF55021A184F32BCADE614A114137022C9A8B41C09AFC38199E7305864F70A8708F37FC2127264ECF4FA32391F243CC62B89602D3813082679E5BDF496BA9DFA4C818AD21EC261B6F11841E6F2DE1574CE95095841DAF052868CCD5E9BFCA543E0934B50A76A598E693136DE2D479AEF3785D97BAFF4FB85AB8D46DA424C4CC5E11ABCAF718837E16350982BF8A27728318EC02C71ED164F57CDB121B72614B7B7C406613EC35C47323
-20010328220334 2 6 100 1534 2 6DFD16D9669EDAF42EF5D4EED82AA84B0541DEC2045B6AF55021A184F32BCADE614A114137022C9A8B41C09AFC38199E7305864F70A8708F37FC2127264ECF4FA32391F243CC62B89602D3813082679E5BDF496BA9DFA4C818AD21EC261B6F11841E6F2DE1574CE95095841DAF052868CCD5E9BFCA543E0934B50A76A598E693136DE2D479AEF3785D97BAFF4FB85AB8D46DA424C4CC5E11ABCAF718837E16350982BF8A27728318EC02C71ED164F57CDB121B72614B7B7C406613EC35CFA9C3
-20010328220653 2 6 100 1534 5 6DFD16D9669EDAF42EF5D4EED82AA84B0541DEC2045B6AF55021A184F32BCADE614A114137022C9A8B41C09AFC38199E7305864F70A8708F37FC2127264ECF4FA32391F243CC62B89602D3813082679E5BDF496BA9DFA4C818AD21EC261B6F11841E6F2DE1574CE95095841DAF052868CCD5E9BFCA543E0934B50A76A598E693136DE2D479AEF3785D97BAFF4FB85AB8D46DA424C4CC5E11ABCAF718837E16350982BF8A27728318EC02C71ED164F57CDB121B72614B7B7C406613EC35E0BB37
-20010328220915 2 6 100 1534 2 6DFD16D9669EDAF42EF5D4EED82AA84B0541DEC2045B6AF55021A184F32BCADE614A114137022C9A8B41C09AFC38199E7305864F70A8708F37FC2127264ECF4FA32391F243CC62B89602D3813082679E5BDF496BA9DFA4C818AD21EC261B6F11841E6F2DE1574CE95095841DAF052868CCD5E9BFCA543E0934B50A76A598E693136DE2D479AEF3785D97BAFF4FB85AB8D46DA424C4CC5E11ABCAF718837E16350982BF8A27728318EC02C71ED164F57CDB121B72614B7B7C406613EC35E9CC23
-20010328221256 2 6 100 1534 5 6DFD16D9669EDAF42EF5D4EED82AA84B0541DEC2045B6AF55021A184F32BCADE614A114137022C9A8B41C09AFC38199E7305864F70A8708F37FC2127264ECF4FA32391F243CC62B89602D3813082679E5BDF496BA9DFA4C818AD21EC261B6F11841E6F2DE1574CE95095841DAF052868CCD5E9BFCA543E0934B50A76A598E693136DE2D479AEF3785D97BAFF4FB85AB8D46DA424C4CC5E11ABCAF718837E16350982BF8A27728318EC02C71ED164F57CDB121B72614B7B7C406613EC35FD7D67
-20010328221457 2 6 100 1534 2 6DFD16D9669EDAF42EF5D4EED82AA84B0541DEC2045B6AF55021A184F32BCADE614A114137022C9A8B41C09AFC38199E7305864F70A8708F37FC2127264ECF4FA32391F243CC62B89602D3813082679E5BDF496BA9DFA4C818AD21EC261B6F11841E6F2DE1574CE95095841DAF052868CCD5E9BFCA543E0934B50A76A598E693136DE2D479AEF3785D97BAFF4FB85AB8D46DA424C4CC5E11ABCAF718837E16350982BF8A27728318EC02C71ED164F57CDB121B72614B7B7C406613EC36052CCB
-20010328222639 2 6 100 1534 5 6DFD16D9669EDAF42EF5D4EED82AA84B0541DEC2045B6AF55021A184F32BCADE614A114137022C9A8B41C09AFC38199E7305864F70A8708F37FC2127264ECF4FA32391F243CC62B89602D3813082679E5BDF496BA9DFA4C818AD21EC261B6F11841E6F2DE1574CE95095841DAF052868CCD5E9BFCA543E0934B50A76A598E693136DE2D479AEF3785D97BAFF4FB85AB8D46DA424C4CC5E11ABCAF718837E16350982BF8A27728318EC02C71ED164F57CDB121B72614B7B7C406613EC364A1E07
-20010328224126 2 6 100 1534 5 6DFD16D9669EDAF42EF5D4EED82AA84B0541DEC2045B6AF55021A184F32BCADE614A114137022C9A8B41C09AFC38199E7305864F70A8708F37FC2127264ECF4FA32391F243CC62B89602D3813082679E5BDF496BA9DFA4C818AD21EC261B6F11841E6F2DE1574CE95095841DAF052868CCD5E9BFCA543E0934B50A76A598E693136DE2D479AEF3785D97BAFF4FB85AB8D46DA424C4CC5E11ABCAF718837E16350982BF8A27728318EC02C71ED164F57CDB121B72614B7B7C406613EC36AD5557
-20010328225125 2 6 100 1534 5 6DFD16D9669EDAF42EF5D4EED82AA84B0541DEC2045B6AF55021A184F32BCADE614A114137022C9A8B41C09AFC38199E7305864F70A8708F37FC2127264ECF4FA32391F243CC62B89602D3813082679E5BDF496BA9DFA4C818AD21EC261B6F11841E6F2DE1574CE95095841DAF052868CCD5E9BFCA543E0934B50A76A598E693136DE2D479AEF3785D97BAFF4FB85AB8D46DA424C4CC5E11ABCAF718837E16350982BF8A27728318EC02C71ED164F57CDB121B72614B7B7C406613EC36EE57BF
-20010328225751 2 6 100 1534 2 6DFD16D9669EDAF42EF5D4EED82AA84B0541DEC2045B6AF55021A184F32BCADE614A114137022C9A8B41C09AFC38199E7305864F70A8708F37FC2127264ECF4FA32391F243CC62B89602D3813082679E5BDF496BA9DFA4C818AD21EC261B6F11841E6F2DE1574CE95095841DAF052868CCD5E9BFCA543E0934B50A76A598E693136DE2D479AEF3785D97BAFF4FB85AB8D46DA424C4CC5E11ABCAF718837E16350982BF8A27728318EC02C71ED164F57CDB121B72614B7B7C406613EC3716A70B
-20010328225943 2 6 100 1534 2 6DFD16D9669EDAF42EF5D4EED82AA84B0541DEC2045B6AF55021A184F32BCADE614A114137022C9A8B41C09AFC38199E7305864F70A8708F37FC2127264ECF4FA32391F243CC62B89602D3813082679E5BDF496BA9DFA4C818AD21EC261B6F11841E6F2DE1574CE95095841DAF052868CCD5E9BFCA543E0934B50A76A598E693136DE2D479AEF3785D97BAFF4FB85AB8D46DA424C4CC5E11ABCAF718837E16350982BF8A27728318EC02C71ED164F57CDB121B72614B7B7C406613EC371D010B
-20010328230054 2 6 100 1534 5 6DFD16D9669EDAF42EF5D4EED82AA84B0541DEC2045B6AF55021A184F32BCADE614A114137022C9A8B41C09AFC38199E7305864F70A8708F37FC2127264ECF4FA32391F243CC62B89602D3813082679E5BDF496BA9DFA4C818AD21EC261B6F11841E6F2DE1574CE95095841DAF052868CCD5E9BFCA543E0934B50A76A598E693136DE2D479AEF3785D97BAFF4FB85AB8D46DA424C4CC5E11ABCAF718837E16350982BF8A27728318EC02C71ED164F57CDB121B72614B7B7C406613EC371EB5C7
-20010328230301 2 6 100 1534 2 6DFD16D9669EDAF42EF5D4EED82AA84B0541DEC2045B6AF55021A184F32BCADE614A114137022C9A8B41C09AFC38199E7305864F70A8708F37FC2127264ECF4FA32391F243CC62B89602D3813082679E5BDF496BA9DFA4C818AD21EC261B6F11841E6F2DE1574CE95095841DAF052868CCD5E9BFCA543E0934B50A76A598E693136DE2D479AEF3785D97BAFF4FB85AB8D46DA424C4CC5E11ABCAF718837E16350982BF8A27728318EC02C71ED164F57CDB121B72614B7B7C406613EC37275F4B
-20010328230628 2 6 100 1534 2 6DFD16D9669EDAF42EF5D4EED82AA84B0541DEC2045B6AF55021A184F32BCADE614A114137022C9A8B41C09AFC38199E7305864F70A8708F37FC2127264ECF4FA32391F243CC62B89602D3813082679E5BDF496BA9DFA4C818AD21EC261B6F11841E6F2DE1574CE95095841DAF052868CCD5E9BFCA543E0934B50A76A598E693136DE2D479AEF3785D97BAFF4FB85AB8D46DA424C4CC5E11ABCAF718837E16350982BF8A27728318EC02C71ED164F57CDB121B72614B7B7C406613EC3738C3F3
-20010329000424 2 6 100 2046 2 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC34993853ACAACAB
-20010329001637 2 6 100 2046 5 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC34993853AE5BE0F
-20010329002229 2 6 100 2046 2 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC34993853AEDE2D3
-20010329003652 2 6 100 2046 2 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC34993853B0F32CB
-20010329005040 2 6 100 2046 2 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC34993853B30E503
-20010329014643 2 6 100 2046 5 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC34993853BC9AF57
-20010329021950 2 6 100 2046 2 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC34993853C205263
-20010329023256 2 6 100 2046 2 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC34993853C3F2E53
-20010329031049 2 6 100 2046 5 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC34993853CA28BBF
-20010329032045 2 6 100 2046 2 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC34993853CB81103
-20010329052113 2 6 100 2046 5 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC34993853DF13B47
-20010329052449 2 6 100 2046 2 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC34993853DF3ED53
-20010329060404 2 6 100 2046 5 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC34993853E5D25E7
-20010329062856 2 6 100 2046 2 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC34993853E9CF013
-20010329063152 2 6 100 2046 2 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC34993853E9E1CEB
-20010329070601 2 6 100 2046 5 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC34993853EF58B7F
-20010329071302 2 6 100 2046 5 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC34993853F017697
-20010329072011 2 6 100 2046 2 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC34993853F0E72D3
-20010329072445 2 6 100 2046 5 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC34993853F14CE17
-20010329073641 2 6 100 2046 2 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC34993853F2EEBA3
-20010329075209 2 6 100 2046 5 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC34993853F52E927
-20010329080750 2 6 100 2046 2 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC34993853F776F8B
-20010329084002 2 6 100 2046 2 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC34993853FC98043
-20010329084744 2 6 100 2046 5 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC34993853FD7EAAF
-20010329090209 2 6 100 2046 5 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC34993853FF9AF5F
-20010329093527 2 6 100 2046 2 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC3499385404E330B
-20010329094652 2 6 100 2046 5 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC349938540672D1F
-20010329103445 2 6 100 2046 2 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC349938540E4B213
-20010329111418 2 6 100 2046 5 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC34993854144947F
-20010329112031 2 6 100 2046 2 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC3499385414F223B
-20010329112413 2 6 100 2046 2 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC349938541522073
-20010329114209 2 6 100 2046 2 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC3499385417C8E53
-20010329125026 2 6 100 2046 2 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC3499385422E41AB
-20010329132045 2 6 100 2046 5 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC3499385427DD3FF
-20010329134105 2 6 100 2046 5 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC349938542AFA2D7
-20010329134914 2 6 100 2046 5 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB94B92BE771D535B4EA9C5D14D84CD7649E25C7CFEA2C914486CC2BFDE77C4C0DF1D6DDED65FEE2F53A7FA690AFE38EE00C154FBAEFF935466B176CB0AED02458A552929F4EA7FC3E6F9F758DE7F22CC1F49641F492820441BDC109F0CE18F883FC93EA9AC4C1432682BA1C5B67BED8C861152A5F952A8CDCF1BCE02B8D93E80C113CE9FE2E4ACA49B2978B99A8C5FA231A77F5E7C604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC349938542C04A37
-20010403222140 2 6 100 3190 5 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B0AB16DAF
-20010403225231 2 6 100 3190 5 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B0AC56CFF
-20010404053436 2 6 100 3190 5 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B0C2F4B7F
-20010404092851 2 6 100 3190 5 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B0D04E7F7
-20010404093943 2 6 100 3190 2 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B0D07794B
-20010404102659 2 6 100 3190 5 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B0D2BE8CF
-20010404112553 2 6 100 3190 2 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B0D5D012B
-20010404174625 2 6 100 3190 5 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B0EA59E17
-20010404184645 2 6 100 3190 5 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B0ED6DA4F
-20010404193402 2 6 100 3190 2 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B0EFB39B3
-20010404230716 2 6 100 3190 2 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B0FB07C1B
-20010405044433 2 6 100 3190 2 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B10DD9FC3
-20010405053429 2 6 100 3190 5 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B11038737
-20010405062826 2 6 100 3190 5 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B112E24E7
-20010405092601 2 6 100 3190 2 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B11C9E9FB
-20010405113007 2 6 100 3190 2 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B123803EB
-20010405122212 2 6 100 3190 2 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B12612ED3
-20010405182035 2 6 100 3190 5 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B13A25087
-20010405210758 2 6 100 3190 2 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B142C4E23
-20010405220222 2 6 100 3190 2 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B145878F3
-20010406020130 2 6 100 3190 2 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B152AF6AB
-20010406053538 2 6 100 3190 2 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B15E78C8B
-20010406073014 2 6 100 3190 5 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B1649BFEF
-20010406074100 2 6 100 3190 5 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B164D4E3F
-20010406103625 2 6 100 3190 2 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B16E07B33
-20010406131946 2 6 100 3190 2 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B17706243
-20010406170234 2 6 100 3190 5 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B182FD957
-20010406182949 2 6 100 3190 2 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B18768903
-20010406203157 2 6 100 3190 2 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B18DCFC3B
-20010407022825 2 6 100 3190 5 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B1A1AF797
-20010407071024 2 6 100 3190 5 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B1B1551E7
-20010407112402 2 6 100 3190 5 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B1BF78EC7
-20010407123215 2 6 100 3190 2 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B1C30021B
-20010407161504 2 6 100 3190 2 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B1CF27743
-20010407171629 2 6 100 3190 5 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B1D25FAD7
-20010407191502 2 6 100 3190 2 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A61C261E891A0F91D9FFC8F30CA12CF809DD8290DD786FA8B041FFAC5793C38F38757EA6790472AC2692185B554B0046E8C065C983C0ACC8D2F85AB4BEDF7CE233009218C9691FE44261580D4149F1D4471B0B5DF79E224252474EBC3B7B5490950BB438BF498E79F8794498B3A3B5FBB42829C3BBEA4067F28C23BE40377B986BD5443CCCF02405B8CCCAA09E8179F0168D4969994171A6AD98F81015BC84E10A44E1EFD2E0862C5D1AAFE99014715A36800DBD9A6C51C0226CC82A651DAE4F73D54C4D103C13D1C15CF8CCA67D5CB39F03C66F3B7467F8FFDCC5074CD0C1B2538FBF956971BF39314CEDD20E1B10DE16D86E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B1D8C2753
-20010420002705 2 6 100 4094 2 65B5B9F5ECFADB4CCB38D1BC894302E95B4843290F1A7A40579DF3E2FF98C1D3DA9F210857C784433DF32ADF9E0C80121211690E1FFB41B8DB4E86AFE388A09C9BB2C98EDC581C2E65D57F61BB920C3D1B7B058B5FADFF65D607DAFF443B8BA1ACE1A3A7B16EA0713F62537C6689E3C4A0F61198F3B054FCF140CFADD8622C0E7621998331E59DA6F72E9D608D0E58F526E95F485C7CA30A416617DA3CCFF722BB82362606283D054B34B83ECDB4C91BAB835944010EBE5E9FA7B016ED89891DD553CC71B5CF76EDB2A184B377F670D6AF191763EEFD175E48EA37EE18B9E44E2D017D845C444C8111816819866E490B52F7F879A0C6F401CF7859674F93E304365F4E8CB8C312EFB725732A46D7CF0C9D2939AEE25F428CEFC90959DBF8ADD612F343EF9BFCA2FBA61BD4BF93E1E54626D227FDA812E18D071579AB4EEAC9901DAB183BCB0D9F48732D92CE66B386EAE5D8212C9FD156DC3F09B171B5603E17A468D244F3B6880EBCDA189BA9E23E4A4C6C2995ACF264F8CE9D54B27316343C0BC19221F75E6A2AC68011741695E599F73460B7A042E0461DB189CDCE223B40336BF2251AE3B363159960C9F63B47EFC43790D474DABB9A686DAF21E0DD76533749FCA9F144FA9C243CEF1364C79D981ED81DC4635C73B7F8908BA190AA920ED370F815BC2F9B3D28ED87BE34A01498836222C17B70C246C03CA1C10C1E08F3
-20010420005243 2 6 100 4094 2 65B5B9F5ECFADB4CCB38D1BC894302E95B4843290F1A7A40579DF3E2FF98C1D3DA9F210857C784433DF32ADF9E0C80121211690E1FFB41B8DB4E86AFE388A09C9BB2C98EDC581C2E65D57F61BB920C3D1B7B058B5FADFF65D607DAFF443B8BA1ACE1A3A7B16EA0713F62537C6689E3C4A0F61198F3B054FCF140CFADD8622C0E7621998331E59DA6F72E9D608D0E58F526E95F485C7CA30A416617DA3CCFF722BB82362606283D054B34B83ECDB4C91BAB835944010EBE5E9FA7B016ED89891DD553CC71B5CF76EDB2A184B377F670D6AF191763EEFD175E48EA37EE18B9E44E2D017D845C444C8111816819866E490B52F7F879A0C6F401CF7859674F93E304365F4E8CB8C312EFB725732A46D7CF0C9D2939AEE25F428CEFC90959DBF8ADD612F343EF9BFCA2FBA61BD4BF93E1E54626D227FDA812E18D071579AB4EEAC9901DAB183BCB0D9F48732D92CE66B386EAE5D8212C9FD156DC3F09B171B5603E17A468D244F3B6880EBCDA189BA9E23E4A4C6C2995ACF264F8CE9D54B27316343C0BC19221F75E6A2AC68011741695E599F73460B7A042E0461DB189CDCE223B40336BF2251AE3B363159960C9F63B47EFC43790D474DABB9A686DAF21E0DD76533749FCA9F144FA9C243CEF1364C79D981ED81DC4635C73B7F8908BA190AA920ED370F815BC2F9B3D28ED87BE34A01498836222C17B70C246C03CA1C10C219FB3
-20010420035225 2 6 100 4094 5 65B5B9F5ECFADB4CCB38D1BC894302E95B4843290F1A7A40579DF3E2FF98C1D3DA9F210857C784433DF32ADF9E0C80121211690E1FFB41B8DB4E86AFE388A09C9BB2C98EDC581C2E65D57F61BB920C3D1B7B058B5FADFF65D607DAFF443B8BA1ACE1A3A7B16EA0713F62537C6689E3C4A0F61198F3B054FCF140CFADD8622C0E7621998331E59DA6F72E9D608D0E58F526E95F485C7CA30A416617DA3CCFF722BB82362606283D054B34B83ECDB4C91BAB835944010EBE5E9FA7B016ED89891DD553CC71B5CF76EDB2A184B377F670D6AF191763EEFD175E48EA37EE18B9E44E2D017D845C444C8111816819866E490B52F7F879A0C6F401CF7859674F93E304365F4E8CB8C312EFB725732A46D7CF0C9D2939AEE25F428CEFC90959DBF8ADD612F343EF9BFCA2FBA61BD4BF93E1E54626D227FDA812E18D071579AB4EEAC9901DAB183BCB0D9F48732D92CE66B386EAE5D8212C9FD156DC3F09B171B5603E17A468D244F3B6880EBCDA189BA9E23E4A4C6C2995ACF264F8CE9D54B27316343C0BC19221F75E6A2AC68011741695E599F73460B7A042E0461DB189CDCE223B40336BF2251AE3B363159960C9F63B47EFC43790D474DABB9A686DAF21E0DD76533749FCA9F144FA9C243CEF1364C79D981ED81DC4635C73B7F8908BA190AA920ED370F815BC2F9B3D28ED87BE34A01498836222C17B70C246C03CA1C10C660B3F
-20010420145749 2 6 100 4094 2 65B5B9F5ECFADB4CCB38D1BC894302E95B4843290F1A7A40579DF3E2FF98C1D3DA9F210857C784433DF32ADF9E0C80121211690E1FFB41B8DB4E86AFE388A09C9BB2C98EDC581C2E65D57F61BB920C3D1B7B058B5FADFF65D607DAFF443B8BA1ACE1A3A7B16EA0713F62537C6689E3C4A0F61198F3B054FCF140CFADD8622C0E7621998331E59DA6F72E9D608D0E58F526E95F485C7CA30A416617DA3CCFF722BB82362606283D054B34B83ECDB4C91BAB835944010EBE5E9FA7B016ED89891DD553CC71B5CF76EDB2A184B377F670D6AF191763EEFD175E48EA37EE18B9E44E2D017D845C444C8111816819866E490B52F7F879A0C6F401CF7859674F93E304365F4E8CB8C312EFB725732A46D7CF0C9D2939AEE25F428CEFC90959DBF8ADD612F343EF9BFCA2FBA61BD4BF93E1E54626D227FDA812E18D071579AB4EEAC9901DAB183BCB0D9F48732D92CE66B386EAE5D8212C9FD156DC3F09B171B5603E17A468D244F3B6880EBCDA189BA9E23E4A4C6C2995ACF264F8CE9D54B27316343C0BC19221F75E6A2AC68011741695E599F73460B7A042E0461DB189CDCE223B40336BF2251AE3B363159960C9F63B47EFC43790D474DABB9A686DAF21E0DD76533749FCA9F144FA9C243CEF1364C79D981ED81DC4635C73B7F8908BA190AA920ED370F815BC2F9B3D28ED87BE34A01498836222C17B70C246C03CA1C10D741313
-20010420205718 2 6 100 4094 2 65B5B9F5ECFADB4CCB38D1BC894302E95B4843290F1A7A40579DF3E2FF98C1D3DA9F210857C784433DF32ADF9E0C80121211690E1FFB41B8DB4E86AFE388A09C9BB2C98EDC581C2E65D57F61BB920C3D1B7B058B5FADFF65D607DAFF443B8BA1ACE1A3A7B16EA0713F62537C6689E3C4A0F61198F3B054FCF140CFADD8622C0E7621998331E59DA6F72E9D608D0E58F526E95F485C7CA30A416617DA3CCFF722BB82362606283D054B34B83ECDB4C91BAB835944010EBE5E9FA7B016ED89891DD553CC71B5CF76EDB2A184B377F670D6AF191763EEFD175E48EA37EE18B9E44E2D017D845C444C8111816819866E490B52F7F879A0C6F401CF7859674F93E304365F4E8CB8C312EFB725732A46D7CF0C9D2939AEE25F428CEFC90959DBF8ADD612F343EF9BFCA2FBA61BD4BF93E1E54626D227FDA812E18D071579AB4EEAC9901DAB183BCB0D9F48732D92CE66B386EAE5D8212C9FD156DC3F09B171B5603E17A468D244F3B6880EBCDA189BA9E23E4A4C6C2995ACF264F8CE9D54B27316343C0BC19221F75E6A2AC68011741695E599F73460B7A042E0461DB189CDCE223B40336BF2251AE3B363159960C9F63B47EFC43790D474DABB9A686DAF21E0DD76533749FCA9F144FA9C243CEF1364C79D981ED81DC4635C73B7F8908BA190AA920ED370F815BC2F9B3D28ED87BE34A01498836222C17B70C246C03CA1C10DD41193
-20010420232458 2 6 100 4094 5 65B5B9F5ECFADB4CCB38D1BC894302E95B4843290F1A7A40579DF3E2FF98C1D3DA9F210857C784433DF32ADF9E0C80121211690E1FFB41B8DB4E86AFE388A09C9BB2C98EDC581C2E65D57F61BB920C3D1B7B058B5FADFF65D607DAFF443B8BA1ACE1A3A7B16EA0713F62537C6689E3C4A0F61198F3B054FCF140CFADD8622C0E7621998331E59DA6F72E9D608D0E58F526E95F485C7CA30A416617DA3CCFF722BB82362606283D054B34B83ECDB4C91BAB835944010EBE5E9FA7B016ED89891DD553CC71B5CF76EDB2A184B377F670D6AF191763EEFD175E48EA37EE18B9E44E2D017D845C444C8111816819866E490B52F7F879A0C6F401CF7859674F93E304365F4E8CB8C312EFB725732A46D7CF0C9D2939AEE25F428CEFC90959DBF8ADD612F343EF9BFCA2FBA61BD4BF93E1E54626D227FDA812E18D071579AB4EEAC9901DAB183BCB0D9F48732D92CE66B386EAE5D8212C9FD156DC3F09B171B5603E17A468D244F3B6880EBCDA189BA9E23E4A4C6C2995ACF264F8CE9D54B27316343C0BC19221F75E6A2AC68011741695E599F73460B7A042E0461DB189CDCE223B40336BF2251AE3B363159960C9F63B47EFC43790D474DABB9A686DAF21E0DD76533749FCA9F144FA9C243CEF1364C79D981ED81DC4635C73B7F8908BA190AA920ED370F815BC2F9B3D28ED87BE34A01498836222C17B70C246C03CA1C10E0AB4EF
-20010421003952 2 6 100 4094 5 65B5B9F5ECFADB4CCB38D1BC894302E95B4843290F1A7A40579DF3E2FF98C1D3DA9F210857C784433DF32ADF9E0C80121211690E1FFB41B8DB4E86AFE388A09C9BB2C98EDC581C2E65D57F61BB920C3D1B7B058B5FADFF65D607DAFF443B8BA1ACE1A3A7B16EA0713F62537C6689E3C4A0F61198F3B054FCF140CFADD8622C0E7621998331E59DA6F72E9D608D0E58F526E95F485C7CA30A416617DA3CCFF722BB82362606283D054B34B83ECDB4C91BAB835944010EBE5E9FA7B016ED89891DD553CC71B5CF76EDB2A184B377F670D6AF191763EEFD175E48EA37EE18B9E44E2D017D845C444C8111816819866E490B52F7F879A0C6F401CF7859674F93E304365F4E8CB8C312EFB725732A46D7CF0C9D2939AEE25F428CEFC90959DBF8ADD612F343EF9BFCA2FBA61BD4BF93E1E54626D227FDA812E18D071579AB4EEAC9901DAB183BCB0D9F48732D92CE66B386EAE5D8212C9FD156DC3F09B171B5603E17A468D244F3B6880EBCDA189BA9E23E4A4C6C2995ACF264F8CE9D54B27316343C0BC19221F75E6A2AC68011741695E599F73460B7A042E0461DB189CDCE223B40336BF2251AE3B363159960C9F63B47EFC43790D474DABB9A686DAF21E0DD76533749FCA9F144FA9C243CEF1364C79D981ED81DC4635C73B7F8908BA190AA920ED370F815BC2F9B3D28ED87BE34A01498836222C17B70C246C03CA1C10E22F857
-20010421013245 2 6 100 4094 2 65B5B9F5ECFADB4CCB38D1BC894302E95B4843290F1A7A40579DF3E2FF98C1D3DA9F210857C784433DF32ADF9E0C80121211690E1FFB41B8DB4E86AFE388A09C9BB2C98EDC581C2E65D57F61BB920C3D1B7B058B5FADFF65D607DAFF443B8BA1ACE1A3A7B16EA0713F62537C6689E3C4A0F61198F3B054FCF140CFADD8622C0E7621998331E59DA6F72E9D608D0E58F526E95F485C7CA30A416617DA3CCFF722BB82362606283D054B34B83ECDB4C91BAB835944010EBE5E9FA7B016ED89891DD553CC71B5CF76EDB2A184B377F670D6AF191763EEFD175E48EA37EE18B9E44E2D017D845C444C8111816819866E490B52F7F879A0C6F401CF7859674F93E304365F4E8CB8C312EFB725732A46D7CF0C9D2939AEE25F428CEFC90959DBF8ADD612F343EF9BFCA2FBA61BD4BF93E1E54626D227FDA812E18D071579AB4EEAC9901DAB183BCB0D9F48732D92CE66B386EAE5D8212C9FD156DC3F09B171B5603E17A468D244F3B6880EBCDA189BA9E23E4A4C6C2995ACF264F8CE9D54B27316343C0BC19221F75E6A2AC68011741695E599F73460B7A042E0461DB189CDCE223B40336BF2251AE3B363159960C9F63B47EFC43790D474DABB9A686DAF21E0DD76533749FCA9F144FA9C243CEF1364C79D981ED81DC4635C73B7F8908BA190AA920ED370F815BC2F9B3D28ED87BE34A01498836222C17B70C246C03CA1C10E31828B
-20010421085157 2 6 100 4094 2 65B5B9F5ECFADB4CCB38D1BC894302E95B4843290F1A7A40579DF3E2FF98C1D3DA9F210857C784433DF32ADF9E0C80121211690E1FFB41B8DB4E86AFE388A09C9BB2C98EDC581C2E65D57F61BB920C3D1B7B058B5FADFF65D607DAFF443B8BA1ACE1A3A7B16EA0713F62537C6689E3C4A0F61198F3B054FCF140CFADD8622C0E7621998331E59DA6F72E9D608D0E58F526E95F485C7CA30A416617DA3CCFF722BB82362606283D054B34B83ECDB4C91BAB835944010EBE5E9FA7B016ED89891DD553CC71B5CF76EDB2A184B377F670D6AF191763EEFD175E48EA37EE18B9E44E2D017D845C444C8111816819866E490B52F7F879A0C6F401CF7859674F93E304365F4E8CB8C312EFB725732A46D7CF0C9D2939AEE25F428CEFC90959DBF8ADD612F343EF9BFCA2FBA61BD4BF93E1E54626D227FDA812E18D071579AB4EEAC9901DAB183BCB0D9F48732D92CE66B386EAE5D8212C9FD156DC3F09B171B5603E17A468D244F3B6880EBCDA189BA9E23E4A4C6C2995ACF264F8CE9D54B27316343C0BC19221F75E6A2AC68011741695E599F73460B7A042E0461DB189CDCE223B40336BF2251AE3B363159960C9F63B47EFC43790D474DABB9A686DAF21E0DD76533749FCA9F144FA9C243CEF1364C79D981ED81DC4635C73B7F8908BA190AA920ED370F815BC2F9B3D28ED87BE34A01498836222C17B70C246C03CA1C10EE28B2B
-20010421092617 2 6 100 4094 2 65B5B9F5ECFADB4CCB38D1BC894302E95B4843290F1A7A40579DF3E2FF98C1D3DA9F210857C784433DF32ADF9E0C80121211690E1FFB41B8DB4E86AFE388A09C9BB2C98EDC581C2E65D57F61BB920C3D1B7B058B5FADFF65D607DAFF443B8BA1ACE1A3A7B16EA0713F62537C6689E3C4A0F61198F3B054FCF140CFADD8622C0E7621998331E59DA6F72E9D608D0E58F526E95F485C7CA30A416617DA3CCFF722BB82362606283D054B34B83ECDB4C91BAB835944010EBE5E9FA7B016ED89891DD553CC71B5CF76EDB2A184B377F670D6AF191763EEFD175E48EA37EE18B9E44E2D017D845C444C8111816819866E490B52F7F879A0C6F401CF7859674F93E304365F4E8CB8C312EFB725732A46D7CF0C9D2939AEE25F428CEFC90959DBF8ADD612F343EF9BFCA2FBA61BD4BF93E1E54626D227FDA812E18D071579AB4EEAC9901DAB183BCB0D9F48732D92CE66B386EAE5D8212C9FD156DC3F09B171B5603E17A468D244F3B6880EBCDA189BA9E23E4A4C6C2995ACF264F8CE9D54B27316343C0BC19221F75E6A2AC68011741695E599F73460B7A042E0461DB189CDCE223B40336BF2251AE3B363159960C9F63B47EFC43790D474DABB9A686DAF21E0DD76533749FCA9F144FA9C243CEF1364C79D981ED81DC4635C73B7F8908BA190AA920ED370F815BC2F9B3D28ED87BE34A01498836222C17B70C246C03CA1C10EE97A3B
-20010421135621 2 6 100 4094 2 65B5B9F5ECFADB4CCB38D1BC894302E95B4843290F1A7A40579DF3E2FF98C1D3DA9F210857C784433DF32ADF9E0C80121211690E1FFB41B8DB4E86AFE388A09C9BB2C98EDC581C2E65D57F61BB920C3D1B7B058B5FADFF65D607DAFF443B8BA1ACE1A3A7B16EA0713F62537C6689E3C4A0F61198F3B054FCF140CFADD8622C0E7621998331E59DA6F72E9D608D0E58F526E95F485C7CA30A416617DA3CCFF722BB82362606283D054B34B83ECDB4C91BAB835944010EBE5E9FA7B016ED89891DD553CC71B5CF76EDB2A184B377F670D6AF191763EEFD175E48EA37EE18B9E44E2D017D845C444C8111816819866E490B52F7F879A0C6F401CF7859674F93E304365F4E8CB8C312EFB725732A46D7CF0C9D2939AEE25F428CEFC90959DBF8ADD612F343EF9BFCA2FBA61BD4BF93E1E54626D227FDA812E18D071579AB4EEAC9901DAB183BCB0D9F48732D92CE66B386EAE5D8212C9FD156DC3F09B171B5603E17A468D244F3B6880EBCDA189BA9E23E4A4C6C2995ACF264F8CE9D54B27316343C0BC19221F75E6A2AC68011741695E599F73460B7A042E0461DB189CDCE223B40336BF2251AE3B363159960C9F63B47EFC43790D474DABB9A686DAF21E0DD76533749FCA9F144FA9C243CEF1364C79D981ED81DC4635C73B7F8908BA190AA920ED370F815BC2F9B3D28ED87BE34A01498836222C17B70C246C03CA1C10F52C463
-20010422012438 2 6 100 4094 2 65B5B9F5ECFADB4CCB38D1BC894302E95B4843290F1A7A40579DF3E2FF98C1D3DA9F210857C784433DF32ADF9E0C80121211690E1FFB41B8DB4E86AFE388A09C9BB2C98EDC581C2E65D57F61BB920C3D1B7B058B5FADFF65D607DAFF443B8BA1ACE1A3A7B16EA0713F62537C6689E3C4A0F61198F3B054FCF140CFADD8622C0E7621998331E59DA6F72E9D608D0E58F526E95F485C7CA30A416617DA3CCFF722BB82362606283D054B34B83ECDB4C91BAB835944010EBE5E9FA7B016ED89891DD553CC71B5CF76EDB2A184B377F670D6AF191763EEFD175E48EA37EE18B9E44E2D017D845C444C8111816819866E490B52F7F879A0C6F401CF7859674F93E304365F4E8CB8C312EFB725732A46D7CF0C9D2939AEE25F428CEFC90959DBF8ADD612F343EF9BFCA2FBA61BD4BF93E1E54626D227FDA812E18D071579AB4EEAC9901DAB183BCB0D9F48732D92CE66B386EAE5D8212C9FD156DC3F09B171B5603E17A468D244F3B6880EBCDA189BA9E23E4A4C6C2995ACF264F8CE9D54B27316343C0BC19221F75E6A2AC68011741695E599F73460B7A042E0461DB189CDCE223B40336BF2251AE3B363159960C9F63B47EFC43790D474DABB9A686DAF21E0DD76533749FCA9F144FA9C243CEF1364C79D981ED81DC4635C73B7F8908BA190AA920ED370F815BC2F9B3D28ED87BE34A01498836222C17B70C246C03CA1C110627AF3
-20010422042530 2 6 100 4094 2 65B5B9F5ECFADB4CCB38D1BC894302E95B4843290F1A7A40579DF3E2FF98C1D3DA9F210857C784433DF32ADF9E0C80121211690E1FFB41B8DB4E86AFE388A09C9BB2C98EDC581C2E65D57F61BB920C3D1B7B058B5FADFF65D607DAFF443B8BA1ACE1A3A7B16EA0713F62537C6689E3C4A0F61198F3B054FCF140CFADD8622C0E7621998331E59DA6F72E9D608D0E58F526E95F485C7CA30A416617DA3CCFF722BB82362606283D054B34B83ECDB4C91BAB835944010EBE5E9FA7B016ED89891DD553CC71B5CF76EDB2A184B377F670D6AF191763EEFD175E48EA37EE18B9E44E2D017D845C444C8111816819866E490B52F7F879A0C6F401CF7859674F93E304365F4E8CB8C312EFB725732A46D7CF0C9D2939AEE25F428CEFC90959DBF8ADD612F343EF9BFCA2FBA61BD4BF93E1E54626D227FDA812E18D071579AB4EEAC9901DAB183BCB0D9F48732D92CE66B386EAE5D8212C9FD156DC3F09B171B5603E17A468D244F3B6880EBCDA189BA9E23E4A4C6C2995ACF264F8CE9D54B27316343C0BC19221F75E6A2AC68011741695E599F73460B7A042E0461DB189CDCE223B40336BF2251AE3B363159960C9F63B47EFC43790D474DABB9A686DAF21E0DD76533749FCA9F144FA9C243CEF1364C79D981ED81DC4635C73B7F8908BA190AA920ED370F815BC2F9B3D28ED87BE34A01498836222C17B70C246C03CA1C110A793B3
-20010422163438 2 6 100 4094 5 65B5B9F5ECFADB4CCB38D1BC894302E95B4843290F1A7A40579DF3E2FF98C1D3DA9F210857C784433DF32ADF9E0C80121211690E1FFB41B8DB4E86AFE388A09C9BB2C98EDC581C2E65D57F61BB920C3D1B7B058B5FADFF65D607DAFF443B8BA1ACE1A3A7B16EA0713F62537C6689E3C4A0F61198F3B054FCF140CFADD8622C0E7621998331E59DA6F72E9D608D0E58F526E95F485C7CA30A416617DA3CCFF722BB82362606283D054B34B83ECDB4C91BAB835944010EBE5E9FA7B016ED89891DD553CC71B5CF76EDB2A184B377F670D6AF191763EEFD175E48EA37EE18B9E44E2D017D845C444C8111816819866E490B52F7F879A0C6F401CF7859674F93E304365F4E8CB8C312EFB725732A46D7CF0C9D2939AEE25F428CEFC90959DBF8ADD612F343EF9BFCA2FBA61BD4BF93E1E54626D227FDA812E18D071579AB4EEAC9901DAB183BCB0D9F48732D92CE66B386EAE5D8212C9FD156DC3F09B171B5603E17A468D244F3B6880EBCDA189BA9E23E4A4C6C2995ACF264F8CE9D54B27316343C0BC19221F75E6A2AC68011741695E599F73460B7A042E0461DB189CDCE223B40336BF2251AE3B363159960C9F63B47EFC43790D474DABB9A686DAF21E0DD76533749FCA9F144FA9C243CEF1364C79D981ED81DC4635C73B7F8908BA190AA920ED370F815BC2F9B3D28ED87BE34A01498836222C17B70C246C03CA1C111D2A227
diff --git a/crypto/openssh/monitor.c b/crypto/openssh/monitor.c
deleted file mode 100644
index bcd007e607bf..000000000000
--- a/crypto/openssh/monitor.c
+++ /dev/null
@@ -1,1650 +0,0 @@
-/*
- * Copyright 2002 Niels Provos <provos@citi.umich.edu>
- * Copyright 2002 Markus Friedl <markus@openbsd.org>
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: monitor.c,v 1.36 2003/04/01 10:22:21 markus Exp $");
-
-#include <openssl/dh.h>
-
-#ifdef SKEY
-#include <skey.h>
-#endif
-
-#include "ssh.h"
-#include "auth.h"
-#include "kex.h"
-#include "dh.h"
-#include "zlib.h"
-#include "packet.h"
-#include "auth-options.h"
-#include "sshpty.h"
-#include "channels.h"
-#include "session.h"
-#include "sshlogin.h"
-#include "canohost.h"
-#include "log.h"
-#include "servconf.h"
-#include "monitor.h"
-#include "monitor_mm.h"
-#include "monitor_wrap.h"
-#include "monitor_fdpass.h"
-#include "xmalloc.h"
-#include "misc.h"
-#include "buffer.h"
-#include "bufaux.h"
-#include "compat.h"
-#include "ssh2.h"
-#include "mpaux.h"
-
-/* Imports */
-extern ServerOptions options;
-extern u_int utmp_len;
-extern Newkeys *current_keys[];
-extern z_stream incoming_stream;
-extern z_stream outgoing_stream;
-extern u_char session_id[];
-extern Buffer input, output;
-extern Buffer auth_debug;
-extern int auth_debug_init;
-
-/* State exported from the child */
-
-struct {
-	z_stream incoming;
-	z_stream outgoing;
-	u_char *keyin;
-	u_int keyinlen;
-	u_char *keyout;
-	u_int keyoutlen;
-	u_char *ivin;
-	u_int ivinlen;
-	u_char *ivout;
-	u_int ivoutlen;
-	u_char *ssh1key;
-	u_int ssh1keylen;
-	int ssh1cipher;
-	int ssh1protoflags;
-	u_char *input;
-	u_int ilen;
-	u_char *output;
-	u_int olen;
-} child_state;
-
-/* Functions on the montior that answer unprivileged requests */
-
-int mm_answer_moduli(int, Buffer *);
-int mm_answer_sign(int, Buffer *);
-int mm_answer_pwnamallow(int, Buffer *);
-int mm_answer_auth2_read_banner(int, Buffer *);
-int mm_answer_authserv(int, Buffer *);
-int mm_answer_authpassword(int, Buffer *);
-int mm_answer_bsdauthquery(int, Buffer *);
-int mm_answer_bsdauthrespond(int, Buffer *);
-int mm_answer_skeyquery(int, Buffer *);
-int mm_answer_skeyrespond(int, Buffer *);
-int mm_answer_keyallowed(int, Buffer *);
-int mm_answer_keyverify(int, Buffer *);
-int mm_answer_pty(int, Buffer *);
-int mm_answer_pty_cleanup(int, Buffer *);
-int mm_answer_term(int, Buffer *);
-int mm_answer_rsa_keyallowed(int, Buffer *);
-int mm_answer_rsa_challenge(int, Buffer *);
-int mm_answer_rsa_response(int, Buffer *);
-int mm_answer_sesskey(int, Buffer *);
-int mm_answer_sessid(int, Buffer *);
-
-#ifdef USE_PAM
-int mm_answer_pam_start(int, Buffer *);
-#endif
-
-#ifdef KRB4
-int mm_answer_krb4(int, Buffer *);
-#endif
-#ifdef KRB5
-int mm_answer_krb5(int, Buffer *);
-#endif
-
-static Authctxt *authctxt;
-static BIGNUM *ssh1_challenge = NULL;	/* used for ssh1 rsa auth */
-
-/* local state for key verify */
-static u_char *key_blob = NULL;
-static u_int key_bloblen = 0;
-static int key_blobtype = MM_NOKEY;
-static char *hostbased_cuser = NULL;
-static char *hostbased_chost = NULL;
-static char *auth_method = "unknown";
-static int session_id2_len = 0;
-static u_char *session_id2 = NULL;
-
-struct mon_table {
-	enum monitor_reqtype type;
-	int flags;
-	int (*f)(int, Buffer *);
-};
-
-#define MON_ISAUTH	0x0004	/* Required for Authentication */
-#define MON_AUTHDECIDE	0x0008	/* Decides Authentication */
-#define MON_ONCE	0x0010	/* Disable after calling */
-
-#define MON_AUTH	(MON_ISAUTH|MON_AUTHDECIDE)
-
-#define MON_PERMIT	0x1000	/* Request is permitted */
-
-struct mon_table mon_dispatch_proto20[] = {
-    {MONITOR_REQ_MODULI, MON_ONCE, mm_answer_moduli},
-    {MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign},
-    {MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow},
-    {MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv},
-    {MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner},
-    {MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword},
-#ifdef USE_PAM
-    {MONITOR_REQ_PAM_START, MON_ONCE, mm_answer_pam_start},
-#endif
-#ifdef BSD_AUTH
-    {MONITOR_REQ_BSDAUTHQUERY, MON_ISAUTH, mm_answer_bsdauthquery},
-    {MONITOR_REQ_BSDAUTHRESPOND, MON_AUTH,mm_answer_bsdauthrespond},
-#endif
-#ifdef SKEY
-    {MONITOR_REQ_SKEYQUERY, MON_ISAUTH, mm_answer_skeyquery},
-    {MONITOR_REQ_SKEYRESPOND, MON_AUTH, mm_answer_skeyrespond},
-#endif
-    {MONITOR_REQ_KEYALLOWED, MON_ISAUTH, mm_answer_keyallowed},
-    {MONITOR_REQ_KEYVERIFY, MON_AUTH, mm_answer_keyverify},
-    {0, 0, NULL}
-};
-
-struct mon_table mon_dispatch_postauth20[] = {
-    {MONITOR_REQ_MODULI, 0, mm_answer_moduli},
-    {MONITOR_REQ_SIGN, 0, mm_answer_sign},
-    {MONITOR_REQ_PTY, 0, mm_answer_pty},
-    {MONITOR_REQ_PTYCLEANUP, 0, mm_answer_pty_cleanup},
-    {MONITOR_REQ_TERM, 0, mm_answer_term},
-    {0, 0, NULL}
-};
-
-struct mon_table mon_dispatch_proto15[] = {
-    {MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow},
-    {MONITOR_REQ_SESSKEY, MON_ONCE, mm_answer_sesskey},
-    {MONITOR_REQ_SESSID, MON_ONCE, mm_answer_sessid},
-    {MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword},
-    {MONITOR_REQ_RSAKEYALLOWED, MON_ISAUTH, mm_answer_rsa_keyallowed},
-    {MONITOR_REQ_KEYALLOWED, MON_ISAUTH, mm_answer_keyallowed},
-    {MONITOR_REQ_RSACHALLENGE, MON_ONCE, mm_answer_rsa_challenge},
-    {MONITOR_REQ_RSARESPONSE, MON_ONCE|MON_AUTHDECIDE, mm_answer_rsa_response},
-#ifdef BSD_AUTH
-    {MONITOR_REQ_BSDAUTHQUERY, MON_ISAUTH, mm_answer_bsdauthquery},
-    {MONITOR_REQ_BSDAUTHRESPOND, MON_AUTH,mm_answer_bsdauthrespond},
-#endif
-#ifdef SKEY
-    {MONITOR_REQ_SKEYQUERY, MON_ISAUTH, mm_answer_skeyquery},
-    {MONITOR_REQ_SKEYRESPOND, MON_AUTH, mm_answer_skeyrespond},
-#endif
-#ifdef USE_PAM
-    {MONITOR_REQ_PAM_START, MON_ONCE, mm_answer_pam_start},
-#endif
-#ifdef KRB4
-    {MONITOR_REQ_KRB4, MON_ONCE|MON_AUTH, mm_answer_krb4},
-#endif
-#ifdef KRB5
-    {MONITOR_REQ_KRB5, MON_ONCE|MON_AUTH, mm_answer_krb5},
-#endif
-    {0, 0, NULL}
-};
-
-struct mon_table mon_dispatch_postauth15[] = {
-    {MONITOR_REQ_PTY, MON_ONCE, mm_answer_pty},
-    {MONITOR_REQ_PTYCLEANUP, MON_ONCE, mm_answer_pty_cleanup},
-    {MONITOR_REQ_TERM, 0, mm_answer_term},
-    {0, 0, NULL}
-};
-
-struct mon_table *mon_dispatch;
-
-/* Specifies if a certain message is allowed at the moment */
-
-static void
-monitor_permit(struct mon_table *ent, enum monitor_reqtype type, int permit)
-{
-	while (ent->f != NULL) {
-		if (ent->type == type) {
-			ent->flags &= ~MON_PERMIT;
-			ent->flags |= permit ? MON_PERMIT : 0;
-			return;
-		}
-		ent++;
-	}
-}
-
-static void
-monitor_permit_authentications(int permit)
-{
-	struct mon_table *ent = mon_dispatch;
-
-	while (ent->f != NULL) {
-		if (ent->flags & MON_AUTH) {
-			ent->flags &= ~MON_PERMIT;
-			ent->flags |= permit ? MON_PERMIT : 0;
-		}
-		ent++;
-	}
-}
-
-Authctxt *
-monitor_child_preauth(struct monitor *pmonitor)
-{
-	struct mon_table *ent;
-	int authenticated = 0;
-
-	debug3("preauth child monitor started");
-
-	if (compat20) {
-		mon_dispatch = mon_dispatch_proto20;
-
-		/* Permit requests for moduli and signatures */
-		monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
-		monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
-	} else {
-		mon_dispatch = mon_dispatch_proto15;
-
-		monitor_permit(mon_dispatch, MONITOR_REQ_SESSKEY, 1);
-	}
-
-	authctxt = authctxt_new();
-
-	/* The first few requests do not require asynchronous access */
-	while (!authenticated) {
-		authenticated = monitor_read(pmonitor, mon_dispatch, &ent);
-		if (authenticated) {
-			if (!(ent->flags & MON_AUTHDECIDE))
-				fatal("%s: unexpected authentication from %d",
-				    __func__, ent->type);
-			if (authctxt->pw->pw_uid == 0 &&
-			    !auth_root_allowed(auth_method))
-				authenticated = 0;
-#ifdef USE_PAM
-			if (!do_pam_account(authctxt->pw->pw_name, NULL))
-				authenticated = 0;
-#endif
-		}
-
-		if (ent->flags & MON_AUTHDECIDE) {
-			auth_log(authctxt, authenticated, auth_method,
-			    compat20 ? " ssh2" : "");
-			if (!authenticated)
-				authctxt->failures++;
-		}
-	}
-
-	if (!authctxt->valid)
-		fatal("%s: authenticated invalid user", __func__);
-
-	debug("%s: %s has been authenticated by privileged process",
-	    __func__, authctxt->user);
-
-	mm_get_keystate(pmonitor);
-
-	return (authctxt);
-}
-
-void
-monitor_child_postauth(struct monitor *pmonitor)
-{
-	if (compat20) {
-		mon_dispatch = mon_dispatch_postauth20;
-
-		/* Permit requests for moduli and signatures */
-		monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
-		monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
-		monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1);
-
-	} else {
-		mon_dispatch = mon_dispatch_postauth15;
-		monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1);
-	}
-	if (!no_pty_flag) {
-		monitor_permit(mon_dispatch, MONITOR_REQ_PTY, 1);
-		monitor_permit(mon_dispatch, MONITOR_REQ_PTYCLEANUP, 1);
-	}
-
-	for (;;)
-		monitor_read(pmonitor, mon_dispatch, NULL);
-}
-
-void
-monitor_sync(struct monitor *pmonitor)
-{
-	if (options.compression) {
-		/* The member allocation is not visible, so sync it */
-		mm_share_sync(&pmonitor->m_zlib, &pmonitor->m_zback);
-	}
-}
-
-int
-monitor_read(struct monitor *pmonitor, struct mon_table *ent,
-    struct mon_table **pent)
-{
-	Buffer m;
-	int ret;
-	u_char type;
-
-	buffer_init(&m);
-
-	mm_request_receive(pmonitor->m_sendfd, &m);
-	type = buffer_get_char(&m);
-
-	debug3("%s: checking request %d", __func__, type);
-
-	while (ent->f != NULL) {
-		if (ent->type == type)
-			break;
-		ent++;
-	}
-
-	if (ent->f != NULL) {
-		if (!(ent->flags & MON_PERMIT))
-			fatal("%s: unpermitted request %d", __func__,
-			    type);
-		ret = (*ent->f)(pmonitor->m_sendfd, &m);
-		buffer_free(&m);
-
-		/* The child may use this request only once, disable it */
-		if (ent->flags & MON_ONCE) {
-			debug2("%s: %d used once, disabling now", __func__,
-			    type);
-			ent->flags &= ~MON_PERMIT;
-		}
-
-		if (pent != NULL)
-			*pent = ent;
-
-		return ret;
-	}
-
-	fatal("%s: unsupported request: %d", __func__, type);
-
-	/* NOTREACHED */
-	return (-1);
-}
-
-/* allowed key state */
-static int
-monitor_allowed_key(u_char *blob, u_int bloblen)
-{
-	/* make sure key is allowed */
-	if (key_blob == NULL || key_bloblen != bloblen ||
-	    memcmp(key_blob, blob, key_bloblen))
-		return (0);
-	return (1);
-}
-
-static void
-monitor_reset_key_state(void)
-{
-	/* reset state */
-	if (key_blob != NULL)
-		xfree(key_blob);
-	if (hostbased_cuser != NULL)
-		xfree(hostbased_cuser);
-	if (hostbased_chost != NULL)
-		xfree(hostbased_chost);
-	key_blob = NULL;
-	key_bloblen = 0;
-	key_blobtype = MM_NOKEY;
-	hostbased_cuser = NULL;
-	hostbased_chost = NULL;
-}
-
-int
-mm_answer_moduli(int socket, Buffer *m)
-{
-	DH *dh;
-	int min, want, max;
-
-	min = buffer_get_int(m);
-	want = buffer_get_int(m);
-	max = buffer_get_int(m);
-
-	debug3("%s: got parameters: %d %d %d",
-	    __func__, min, want, max);
-	/* We need to check here, too, in case the child got corrupted */
-	if (max < min || want < min || max < want)
-		fatal("%s: bad parameters: %d %d %d",
-		    __func__, min, want, max);
-
-	buffer_clear(m);
-
-	dh = choose_dh(min, want, max);
-	if (dh == NULL) {
-		buffer_put_char(m, 0);
-		return (0);
-	} else {
-		/* Send first bignum */
-		buffer_put_char(m, 1);
-		buffer_put_bignum2(m, dh->p);
-		buffer_put_bignum2(m, dh->g);
-
-		DH_free(dh);
-	}
-	mm_request_send(socket, MONITOR_ANS_MODULI, m);
-	return (0);
-}
-
-int
-mm_answer_sign(int socket, Buffer *m)
-{
-	Key *key;
-	u_char *p;
-	u_char *signature;
-	u_int siglen, datlen;
-	int keyid;
-
-	debug3("%s", __func__);
-
-	keyid = buffer_get_int(m);
-	p = buffer_get_string(m, &datlen);
-
-	if (datlen != 20)
-		fatal("%s: data length incorrect: %u", __func__, datlen);
-
-	/* save session id, it will be passed on the first call */
-	if (session_id2_len == 0) {
-		session_id2_len = datlen;
-		session_id2 = xmalloc(session_id2_len);
-		memcpy(session_id2, p, session_id2_len);
-	}
-
-	if ((key = get_hostkey_by_index(keyid)) == NULL)
-		fatal("%s: no hostkey from index %d", __func__, keyid);
-	if (key_sign(key, &signature, &siglen, p, datlen) < 0)
-		fatal("%s: key_sign failed", __func__);
-
-	debug3("%s: signature %p(%u)", __func__, signature, siglen);
-
-	buffer_clear(m);
-	buffer_put_string(m, signature, siglen);
-
-	xfree(p);
-	xfree(signature);
-
-	mm_request_send(socket, MONITOR_ANS_SIGN, m);
-
-	/* Turn on permissions for getpwnam */
-	monitor_permit(mon_dispatch, MONITOR_REQ_PWNAM, 1);
-
-	return (0);
-}
-
-/* Retrieves the password entry and also checks if the user is permitted */
-
-int
-mm_answer_pwnamallow(int socket, Buffer *m)
-{
-	char *login;
-	struct passwd *pwent;
-	int allowed = 0;
-
-	debug3("%s", __func__);
-
-	if (authctxt->attempt++ != 0)
-		fatal("%s: multiple attempts for getpwnam", __func__);
-
-	login = buffer_get_string(m, NULL);
-
-	pwent = getpwnamallow(login);
-
-	authctxt->user = xstrdup(login);
-	setproctitle("%s [priv]", pwent ? login : "unknown");
-	xfree(login);
-
-	buffer_clear(m);
-
-	if (pwent == NULL) {
-		buffer_put_char(m, 0);
-		goto out;
-	}
-
-	allowed = 1;
-	authctxt->pw = pwent;
-	authctxt->valid = 1;
-
-	buffer_put_char(m, 1);
-	buffer_put_string(m, pwent, sizeof(struct passwd));
-	buffer_put_cstring(m, pwent->pw_name);
-	buffer_put_cstring(m, "*");
-	buffer_put_cstring(m, pwent->pw_gecos);
-#ifdef HAVE_PW_CLASS_IN_PASSWD
-	buffer_put_cstring(m, pwent->pw_class);
-#endif
-	buffer_put_cstring(m, pwent->pw_dir);
-	buffer_put_cstring(m, pwent->pw_shell);
-
- out:
-	debug3("%s: sending MONITOR_ANS_PWNAM: %d", __func__, allowed);
-	mm_request_send(socket, MONITOR_ANS_PWNAM, m);
-
-	/* For SSHv1 allow authentication now */
-	if (!compat20)
-		monitor_permit_authentications(1);
-	else {
-		/* Allow service/style information on the auth context */
-		monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1);
-		monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1);
-	}
-
-#ifdef USE_PAM
-	monitor_permit(mon_dispatch, MONITOR_REQ_PAM_START, 1);
-#endif
-
-	return (0);
-}
-
-int mm_answer_auth2_read_banner(int socket, Buffer *m)
-{
-	char *banner;
-
-	buffer_clear(m);
-	banner = auth2_read_banner();
-	buffer_put_cstring(m, banner != NULL ? banner : "");
-	mm_request_send(socket, MONITOR_ANS_AUTH2_READ_BANNER, m);
-
-	if (banner != NULL)
-		xfree(banner);
-
-	return (0);
-}
-
-int
-mm_answer_authserv(int socket, Buffer *m)
-{
-	monitor_permit_authentications(1);
-
-	authctxt->service = buffer_get_string(m, NULL);
-	authctxt->style = buffer_get_string(m, NULL);
-	debug3("%s: service=%s, style=%s",
-	    __func__, authctxt->service, authctxt->style);
-
-	if (strlen(authctxt->style) == 0) {
-		xfree(authctxt->style);
-		authctxt->style = NULL;
-	}
-
-	return (0);
-}
-
-int
-mm_answer_authpassword(int socket, Buffer *m)
-{
-	static int call_count;
-	char *passwd;
-	int authenticated;
-	u_int plen;
-
-	passwd = buffer_get_string(m, &plen);
-	/* Only authenticate if the context is valid */
-	authenticated = options.password_authentication &&
-	    authctxt->valid && auth_password(authctxt, passwd);
-	memset(passwd, 0, strlen(passwd));
-	xfree(passwd);
-
-	buffer_clear(m);
-	buffer_put_int(m, authenticated);
-
-	debug3("%s: sending result %d", __func__, authenticated);
-	mm_request_send(socket, MONITOR_ANS_AUTHPASSWORD, m);
-
-	call_count++;
-	if (plen == 0 && call_count == 1)
-		auth_method = "none";
-	else
-		auth_method = "password";
-
-	/* Causes monitor loop to terminate if authenticated */
-	return (authenticated);
-}
-
-#ifdef BSD_AUTH
-int
-mm_answer_bsdauthquery(int socket, Buffer *m)
-{
-	char *name, *infotxt;
-	u_int numprompts;
-	u_int *echo_on;
-	char **prompts;
-	u_int success;
-
-	success = bsdauth_query(authctxt, &name, &infotxt, &numprompts,
-	    &prompts, &echo_on) < 0 ? 0 : 1;
-
-	buffer_clear(m);
-	buffer_put_int(m, success);
-	if (success)
-		buffer_put_cstring(m, prompts[0]);
-
-	debug3("%s: sending challenge success: %u", __func__, success);
-	mm_request_send(socket, MONITOR_ANS_BSDAUTHQUERY, m);
-
-	if (success) {
-		xfree(name);
-		xfree(infotxt);
-		xfree(prompts);
-		xfree(echo_on);
-	}
-
-	return (0);
-}
-
-int
-mm_answer_bsdauthrespond(int socket, Buffer *m)
-{
-	char *response;
-	int authok;
-
-	if (authctxt->as == 0)
-		fatal("%s: no bsd auth session", __func__);
-
-	response = buffer_get_string(m, NULL);
-	authok = options.challenge_response_authentication &&
-	    auth_userresponse(authctxt->as, response, 0);
-	authctxt->as = NULL;
-	debug3("%s: <%s> = <%d>", __func__, response, authok);
-	xfree(response);
-
-	buffer_clear(m);
-	buffer_put_int(m, authok);
-
-	debug3("%s: sending authenticated: %d", __func__, authok);
-	mm_request_send(socket, MONITOR_ANS_BSDAUTHRESPOND, m);
-
-	auth_method = "bsdauth";
-
-	return (authok != 0);
-}
-#endif
-
-#ifdef SKEY
-int
-mm_answer_skeyquery(int socket, Buffer *m)
-{
-	struct skey skey;
-	char challenge[1024];
-	u_int success;
-
-	success = skeychallenge(&skey, authctxt->user, challenge) < 0 ? 0 : 1;
-
-	buffer_clear(m);
-	buffer_put_int(m, success);
-	if (success)
-		buffer_put_cstring(m, challenge);
-
-	debug3("%s: sending challenge success: %u", __func__, success);
-	mm_request_send(socket, MONITOR_ANS_SKEYQUERY, m);
-
-	return (0);
-}
-
-int
-mm_answer_skeyrespond(int socket, Buffer *m)
-{
-	char *response;
-	int authok;
-
-	response = buffer_get_string(m, NULL);
-
-	authok = (options.challenge_response_authentication &&
-	    authctxt->valid &&
-	    skey_haskey(authctxt->pw->pw_name) == 0 &&
-	    skey_passcheck(authctxt->pw->pw_name, response) != -1);
-
-	xfree(response);
-
-	buffer_clear(m);
-	buffer_put_int(m, authok);
-
-	debug3("%s: sending authenticated: %d", __func__, authok);
-	mm_request_send(socket, MONITOR_ANS_SKEYRESPOND, m);
-
-	auth_method = "skey";
-
-	return (authok != 0);
-}
-#endif
-
-#ifdef USE_PAM
-int
-mm_answer_pam_start(int socket, Buffer *m)
-{
-	char *user;
-	
-	user = buffer_get_string(m, NULL);
-
-	start_pam(user);
-
-	xfree(user);
-
-	return (0);
-}
-#endif
-
-static void
-mm_append_debug(Buffer *m)
-{
-	if (auth_debug_init && buffer_len(&auth_debug)) {
-		debug3("%s: Appending debug messages for child", __func__);
-		buffer_append(m, buffer_ptr(&auth_debug),
-		    buffer_len(&auth_debug));
-		buffer_clear(&auth_debug);
-	}
-}
-
-int
-mm_answer_keyallowed(int socket, Buffer *m)
-{
-	Key *key;
-	char *cuser, *chost;
-	u_char *blob;
-	u_int bloblen;
-	enum mm_keytype type = 0;
-	int allowed = 0;
-
-	debug3("%s entering", __func__);
-
-	type = buffer_get_int(m);
-	cuser = buffer_get_string(m, NULL);
-	chost = buffer_get_string(m, NULL);
-	blob = buffer_get_string(m, &bloblen);
-
-	key = key_from_blob(blob, bloblen);
-
-	if ((compat20 && type == MM_RSAHOSTKEY) ||
-	    (!compat20 && type != MM_RSAHOSTKEY))
-		fatal("%s: key type and protocol mismatch", __func__);
-
-	debug3("%s: key_from_blob: %p", __func__, key);
-
-	if (key != NULL && authctxt->pw != NULL) {
-		switch(type) {
-		case MM_USERKEY:
-			allowed = options.pubkey_authentication &&
-			    user_key_allowed(authctxt->pw, key);
-			break;
-		case MM_HOSTKEY:
-			allowed = options.hostbased_authentication &&
-			    hostbased_key_allowed(authctxt->pw,
-			    cuser, chost, key);
-			break;
-		case MM_RSAHOSTKEY:
-			key->type = KEY_RSA1; /* XXX */
-			allowed = options.rhosts_rsa_authentication &&
-			    auth_rhosts_rsa_key_allowed(authctxt->pw,
-			    cuser, chost, key);
-			break;
-		default:
-			fatal("%s: unknown key type %d", __func__, type);
-			break;
-		}
-	}
-	if (key != NULL)
-		key_free(key);
-
-	/* clear temporarily storage (used by verify) */
-	monitor_reset_key_state();
-
-	if (allowed) {
-		/* Save temporarily for comparison in verify */
-		key_blob = blob;
-		key_bloblen = bloblen;
-		key_blobtype = type;
-		hostbased_cuser = cuser;
-		hostbased_chost = chost;
-	}
-
-	debug3("%s: key %p is %s",
-	    __func__, key, allowed ? "allowed" : "disallowed");
-
-	buffer_clear(m);
-	buffer_put_int(m, allowed);
-	buffer_put_int(m, forced_command != NULL);
-
-	mm_append_debug(m);
-
-	mm_request_send(socket, MONITOR_ANS_KEYALLOWED, m);
-
-	if (type == MM_RSAHOSTKEY)
-		monitor_permit(mon_dispatch, MONITOR_REQ_RSACHALLENGE, allowed);
-
-	return (0);
-}
-
-static int
-monitor_valid_userblob(u_char *data, u_int datalen)
-{
-	Buffer b;
-	char *p;
-	u_int len;
-	int fail = 0;
-
-	buffer_init(&b);
-	buffer_append(&b, data, datalen);
-
-	if (datafellows & SSH_OLD_SESSIONID) {
-		p = buffer_ptr(&b);
-		len = buffer_len(&b);
-		if ((session_id2 == NULL) ||
-		    (len < session_id2_len) ||
-		    (memcmp(p, session_id2, session_id2_len) != 0))
-			fail++;
-		buffer_consume(&b, session_id2_len);
-	} else {
-		p = buffer_get_string(&b, &len);
-		if ((session_id2 == NULL) ||
-		    (len != session_id2_len) ||
-		    (memcmp(p, session_id2, session_id2_len) != 0))
-			fail++;
-		xfree(p);
-	}
-	if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST)
-		fail++;
-	p = buffer_get_string(&b, NULL);
-	if (strcmp(authctxt->user, p) != 0) {
-		log("wrong user name passed to monitor: expected %s != %.100s",
-		    authctxt->user, p);
-		fail++;
-	}
-	xfree(p);
-	buffer_skip_string(&b);
-	if (datafellows & SSH_BUG_PKAUTH) {
-		if (!buffer_get_char(&b))
-			fail++;
-	} else {
-		p = buffer_get_string(&b, NULL);
-		if (strcmp("publickey", p) != 0)
-			fail++;
-		xfree(p);
-		if (!buffer_get_char(&b))
-			fail++;
-		buffer_skip_string(&b);
-	}
-	buffer_skip_string(&b);
-	if (buffer_len(&b) != 0)
-		fail++;
-	buffer_free(&b);
-	return (fail == 0);
-}
-
-static int
-monitor_valid_hostbasedblob(u_char *data, u_int datalen, char *cuser,
-    char *chost)
-{
-	Buffer b;
-	char *p;
-	u_int len;
-	int fail = 0;
-
-	buffer_init(&b);
-	buffer_append(&b, data, datalen);
-
-	p = buffer_get_string(&b, &len);
-	if ((session_id2 == NULL) ||
-	    (len != session_id2_len) ||
-	    (memcmp(p, session_id2, session_id2_len) != 0))
-		fail++;
-	xfree(p);
-
-	if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST)
-		fail++;
-	p = buffer_get_string(&b, NULL);
-	if (strcmp(authctxt->user, p) != 0) {
-		log("wrong user name passed to monitor: expected %s != %.100s",
-		    authctxt->user, p);
-		fail++;
-	}
-	xfree(p);
-	buffer_skip_string(&b);	/* service */
-	p = buffer_get_string(&b, NULL);
-	if (strcmp(p, "hostbased") != 0)
-		fail++;
-	xfree(p);
-	buffer_skip_string(&b);	/* pkalg */
-	buffer_skip_string(&b);	/* pkblob */
-
-	/* verify client host, strip trailing dot if necessary */
-	p = buffer_get_string(&b, NULL);
-	if (((len = strlen(p)) > 0) && p[len - 1] == '.')
-		p[len - 1] = '\0';
-	if (strcmp(p, chost) != 0)
-		fail++;
-	xfree(p);
-
-	/* verify client user */
-	p = buffer_get_string(&b, NULL);
-	if (strcmp(p, cuser) != 0)
-		fail++;
-	xfree(p);
-
-	if (buffer_len(&b) != 0)
-		fail++;
-	buffer_free(&b);
-	return (fail == 0);
-}
-
-int
-mm_answer_keyverify(int socket, Buffer *m)
-{
-	Key *key;
-	u_char *signature, *data, *blob;
-	u_int signaturelen, datalen, bloblen;
-	int verified = 0;
-	int valid_data = 0;
-
-	blob = buffer_get_string(m, &bloblen);
-	signature = buffer_get_string(m, &signaturelen);
-	data = buffer_get_string(m, &datalen);
-
-	if (hostbased_cuser == NULL || hostbased_chost == NULL ||
-	  !monitor_allowed_key(blob, bloblen))
-		fatal("%s: bad key, not previously allowed", __func__);
-
-	key = key_from_blob(blob, bloblen);
-	if (key == NULL)
-		fatal("%s: bad public key blob", __func__);
-
-	switch (key_blobtype) {
-	case MM_USERKEY:
-		valid_data = monitor_valid_userblob(data, datalen);
-		break;
-	case MM_HOSTKEY:
-		valid_data = monitor_valid_hostbasedblob(data, datalen,
-		    hostbased_cuser, hostbased_chost);
-		break;
-	default:
-		valid_data = 0;
-		break;
-	}
-	if (!valid_data)
-		fatal("%s: bad signature data blob", __func__);
-
-	verified = key_verify(key, signature, signaturelen, data, datalen);
-	debug3("%s: key %p signature %s",
-	    __func__, key, verified ? "verified" : "unverified");
-
-	key_free(key);
-	xfree(blob);
-	xfree(signature);
-	xfree(data);
-
-	auth_method = key_blobtype == MM_USERKEY ? "publickey" : "hostbased";
-
-	monitor_reset_key_state();
-
-	buffer_clear(m);
-	buffer_put_int(m, verified);
-	mm_request_send(socket, MONITOR_ANS_KEYVERIFY, m);
-
-	return (verified);
-}
-
-static void
-mm_record_login(Session *s, struct passwd *pw)
-{
-	socklen_t fromlen;
-	struct sockaddr_storage from;
-
-	/*
-	 * Get IP address of client. If the connection is not a socket, let
-	 * the address be 0.0.0.0.
-	 */
-	memset(&from, 0, sizeof(from));
-	fromlen = sizeof(from);
-	if (packet_connection_is_on_socket()) {
-		if (getpeername(packet_get_connection_in(),
-			(struct sockaddr *) & from, &fromlen) < 0) {
-			debug("getpeername: %.100s", strerror(errno));
-			fatal_cleanup();
-		}
-	}
-	/* Record that there was a login on that tty from the remote host. */
-	record_login(s->pid, s->tty, pw->pw_name, pw->pw_uid,
-	    get_remote_name_or_ip(utmp_len, options.verify_reverse_mapping),
-	    (struct sockaddr *)&from, fromlen);
-}
-
-static void
-mm_session_close(Session *s)
-{
-	debug3("%s: session %d pid %d", __func__, s->self, s->pid);
-	if (s->ttyfd != -1) {
-		debug3("%s: tty %s ptyfd %d",  __func__, s->tty, s->ptyfd);
-		fatal_remove_cleanup(session_pty_cleanup2, (void *)s);
-		session_pty_cleanup2(s);
-	}
-	s->used = 0;
-}
-
-int
-mm_answer_pty(int socket, Buffer *m)
-{
-	extern struct monitor *pmonitor;
-	Session *s;
-	int res, fd0;
-
-	debug3("%s entering", __func__);
-
-	buffer_clear(m);
-	s = session_new();
-	if (s == NULL)
-		goto error;
-	s->authctxt = authctxt;
-	s->pw = authctxt->pw;
-	s->pid = pmonitor->m_pid;
-	res = pty_allocate(&s->ptyfd, &s->ttyfd, s->tty, sizeof(s->tty));
-	if (res == 0)
-		goto error;
-	fatal_add_cleanup(session_pty_cleanup2, (void *)s);
-	pty_setowner(authctxt->pw, s->tty);
-
-	buffer_put_int(m, 1);
-	buffer_put_cstring(m, s->tty);
-	mm_request_send(socket, MONITOR_ANS_PTY, m);
-
-	mm_send_fd(socket, s->ptyfd);
-	mm_send_fd(socket, s->ttyfd);
-
-	/* We need to trick ttyslot */
-	if (dup2(s->ttyfd, 0) == -1)
-		fatal("%s: dup2", __func__);
-
-	mm_record_login(s, authctxt->pw);
-
-	/* Now we can close the file descriptor again */
-	close(0);
-
-	/* make sure nothing uses fd 0 */
-	if ((fd0 = open(_PATH_DEVNULL, O_RDONLY)) < 0)
-		fatal("%s: open(/dev/null): %s", __func__, strerror(errno));
-	if (fd0 != 0)
-		error("%s: fd0 %d != 0", __func__, fd0);
-
-	/* slave is not needed */
-	close(s->ttyfd);
-	s->ttyfd = s->ptyfd;
-	/* no need to dup() because nobody closes ptyfd */
-	s->ptymaster = s->ptyfd;
-
-	debug3("%s: tty %s ptyfd %d",  __func__, s->tty, s->ttyfd);
-
-	return (0);
-
- error:
-	if (s != NULL)
-		mm_session_close(s);
-	buffer_put_int(m, 0);
-	mm_request_send(socket, MONITOR_ANS_PTY, m);
-	return (0);
-}
-
-int
-mm_answer_pty_cleanup(int socket, Buffer *m)
-{
-	Session *s;
-	char *tty;
-
-	debug3("%s entering", __func__);
-
-	tty = buffer_get_string(m, NULL);
-	if ((s = session_by_tty(tty)) != NULL)
-		mm_session_close(s);
-	buffer_clear(m);
-	xfree(tty);
-	return (0);
-}
-
-int
-mm_answer_sesskey(int socket, Buffer *m)
-{
-	BIGNUM *p;
-	int rsafail;
-
-	/* Turn off permissions */
-	monitor_permit(mon_dispatch, MONITOR_REQ_SESSKEY, 1);
-
-	if ((p = BN_new()) == NULL)
-		fatal("%s: BN_new", __func__);
-
-	buffer_get_bignum2(m, p);
-
-	rsafail = ssh1_session_key(p);
-
-	buffer_clear(m);
-	buffer_put_int(m, rsafail);
-	buffer_put_bignum2(m, p);
-
-	BN_clear_free(p);
-
-	mm_request_send(socket, MONITOR_ANS_SESSKEY, m);
-
-	/* Turn on permissions for sessid passing */
-	monitor_permit(mon_dispatch, MONITOR_REQ_SESSID, 1);
-
-	return (0);
-}
-
-int
-mm_answer_sessid(int socket, Buffer *m)
-{
-	int i;
-
-	debug3("%s entering", __func__);
-
-	if (buffer_len(m) != 16)
-		fatal("%s: bad ssh1 session id", __func__);
-	for (i = 0; i < 16; i++)
-		session_id[i] = buffer_get_char(m);
-
-	/* Turn on permissions for getpwnam */
-	monitor_permit(mon_dispatch, MONITOR_REQ_PWNAM, 1);
-
-	return (0);
-}
-
-int
-mm_answer_rsa_keyallowed(int socket, Buffer *m)
-{
-	BIGNUM *client_n;
-	Key *key = NULL;
-	u_char *blob = NULL;
-	u_int blen = 0;
-	int allowed = 0;
-
-	debug3("%s entering", __func__);
-
-	if (options.rsa_authentication && authctxt->valid) {
-		if ((client_n = BN_new()) == NULL)
-			fatal("%s: BN_new", __func__);
-		buffer_get_bignum2(m, client_n);
-		allowed = auth_rsa_key_allowed(authctxt->pw, client_n, &key);
-		BN_clear_free(client_n);
-	}
-	buffer_clear(m);
-	buffer_put_int(m, allowed);
-	buffer_put_int(m, forced_command != NULL);
-
-	/* clear temporarily storage (used by generate challenge) */
-	monitor_reset_key_state();
-
-	if (allowed && key != NULL) {
-		key->type = KEY_RSA;	/* cheat for key_to_blob */
-		if (key_to_blob(key, &blob, &blen) == 0)
-			fatal("%s: key_to_blob failed", __func__);
-		buffer_put_string(m, blob, blen);
-
-		/* Save temporarily for comparison in verify */
-		key_blob = blob;
-		key_bloblen = blen;
-		key_blobtype = MM_RSAUSERKEY;
-	}
-	if (key != NULL)
-		key_free(key);
-
-	mm_append_debug(m);
-
-	mm_request_send(socket, MONITOR_ANS_RSAKEYALLOWED, m);
-
-	monitor_permit(mon_dispatch, MONITOR_REQ_RSACHALLENGE, allowed);
-	monitor_permit(mon_dispatch, MONITOR_REQ_RSARESPONSE, 0);
-	return (0);
-}
-
-int
-mm_answer_rsa_challenge(int socket, Buffer *m)
-{
-	Key *key = NULL;
-	u_char *blob;
-	u_int blen;
-
-	debug3("%s entering", __func__);
-
-	if (!authctxt->valid)
-		fatal("%s: authctxt not valid", __func__);
-	blob = buffer_get_string(m, &blen);
-	if (!monitor_allowed_key(blob, blen))
-		fatal("%s: bad key, not previously allowed", __func__);
-	if (key_blobtype != MM_RSAUSERKEY && key_blobtype != MM_RSAHOSTKEY)
-		fatal("%s: key type mismatch", __func__);
-	if ((key = key_from_blob(blob, blen)) == NULL)
-		fatal("%s: received bad key", __func__);
-
-	if (ssh1_challenge)
-		BN_clear_free(ssh1_challenge);
-	ssh1_challenge = auth_rsa_generate_challenge(key);
-
-	buffer_clear(m);
-	buffer_put_bignum2(m, ssh1_challenge);
-
-	debug3("%s sending reply", __func__);
-	mm_request_send(socket, MONITOR_ANS_RSACHALLENGE, m);
-
-	monitor_permit(mon_dispatch, MONITOR_REQ_RSARESPONSE, 1);
-
-	xfree(blob);
-	key_free(key);
-	return (0);
-}
-
-int
-mm_answer_rsa_response(int socket, Buffer *m)
-{
-	Key *key = NULL;
-	u_char *blob, *response;
-	u_int blen, len;
-	int success;
-
-	debug3("%s entering", __func__);
-
-	if (!authctxt->valid)
-		fatal("%s: authctxt not valid", __func__);
-	if (ssh1_challenge == NULL)
-		fatal("%s: no ssh1_challenge", __func__);
-
-	blob = buffer_get_string(m, &blen);
-	if (!monitor_allowed_key(blob, blen))
-		fatal("%s: bad key, not previously allowed", __func__);
-	if (key_blobtype != MM_RSAUSERKEY && key_blobtype != MM_RSAHOSTKEY)
-		fatal("%s: key type mismatch: %d", __func__, key_blobtype);
-	if ((key = key_from_blob(blob, blen)) == NULL)
-		fatal("%s: received bad key", __func__);
-	response = buffer_get_string(m, &len);
-	if (len != 16)
-		fatal("%s: received bad response to challenge", __func__);
-	success = auth_rsa_verify_response(key, ssh1_challenge, response);
-
-	xfree(blob);
-	key_free(key);
-	xfree(response);
-
-	auth_method = key_blobtype == MM_RSAUSERKEY ? "rsa" : "rhosts-rsa";
-
-	/* reset state */
-	BN_clear_free(ssh1_challenge);
-	ssh1_challenge = NULL;
-	monitor_reset_key_state();
-
-	buffer_clear(m);
-	buffer_put_int(m, success);
-	mm_request_send(socket, MONITOR_ANS_RSARESPONSE, m);
-
-	return (success);
-}
-
-#ifdef KRB4
-int
-mm_answer_krb4(int socket, Buffer *m)
-{
-	KTEXT_ST auth, reply;
-	char  *client, *p;
-	int success;
-	u_int alen;
-
-	reply.length = auth.length = 0;
- 
-	p = buffer_get_string(m, &alen);
-	if (alen >=  MAX_KTXT_LEN)
-		 fatal("%s: auth too large", __func__);
-	memcpy(auth.dat, p, alen);
-	auth.length = alen;
-	memset(p, 0, alen);
-	xfree(p);
-
-	success = options.kerberos_authentication &&
-	    authctxt->valid &&
-	    auth_krb4(authctxt, &auth, &client, &reply);
-
-	memset(auth.dat, 0, alen);
-	buffer_clear(m);
-	buffer_put_int(m, success);
-
-	if (success) {
-		buffer_put_cstring(m, client);
-		buffer_put_string(m, reply.dat, reply.length);
-		if (client)
-			xfree(client);
-		if (reply.length)
-			memset(reply.dat, 0, reply.length);
-	}
-
-	debug3("%s: sending result %d", __func__, success);
-	mm_request_send(socket, MONITOR_ANS_KRB4, m);
-
-	auth_method = "kerberos";
-
-	/* Causes monitor loop to terminate if authenticated */
-	return (success);
-}
-#endif
-
-#ifdef KRB5
-int
-mm_answer_krb5(int socket, Buffer *m)
-{
-	krb5_data tkt, reply;
-	char *client_user;
-	u_int len;
-	int success;
-
-	/* use temporary var to avoid size issues on 64bit arch */
-	tkt.data = buffer_get_string(m, &len);
-	tkt.length = len;
-
-	success = options.kerberos_authentication &&
-	    authctxt->valid &&
-	    auth_krb5(authctxt, &tkt, &client_user, &reply);
-
-	if (tkt.length)
-		xfree(tkt.data);
-
-	buffer_clear(m);
-	buffer_put_int(m, success);
-
-	if (success) {
-		buffer_put_cstring(m, client_user);
-		buffer_put_string(m, reply.data, reply.length);
-		if (client_user)
-			xfree(client_user);
-		if (reply.length)
-			xfree(reply.data);
-	}
-	mm_request_send(socket, MONITOR_ANS_KRB5, m);
-
-	return success;
-}
-#endif
-
-int
-mm_answer_term(int socket, Buffer *req)
-{
-	extern struct monitor *pmonitor;
-	int res, status;
-
-	debug3("%s: tearing down sessions", __func__);
-
-	/* The child is terminating */
-	session_destroy_all(&mm_session_close);
-
-	while (waitpid(pmonitor->m_pid, &status, 0) == -1)
-		if (errno != EINTR)
-			exit(1);
-
-	res = WIFEXITED(status) ? WEXITSTATUS(status) : 1;
-
-	/* Terminate process */
-	exit (res);
-}
-
-void
-monitor_apply_keystate(struct monitor *pmonitor)
-{
-	if (compat20) {
-		set_newkeys(MODE_IN);
-		set_newkeys(MODE_OUT);
-	} else {
-		packet_set_protocol_flags(child_state.ssh1protoflags);
-		packet_set_encryption_key(child_state.ssh1key,
-		    child_state.ssh1keylen, child_state.ssh1cipher);
-		xfree(child_state.ssh1key);
-	}
-
-	/* for rc4 and other stateful ciphers */
-	packet_set_keycontext(MODE_OUT, child_state.keyout);
-	xfree(child_state.keyout);
-	packet_set_keycontext(MODE_IN, child_state.keyin);
-	xfree(child_state.keyin);
-
-	if (!compat20) {
-		packet_set_iv(MODE_OUT, child_state.ivout);
-		xfree(child_state.ivout);
-		packet_set_iv(MODE_IN, child_state.ivin);
-		xfree(child_state.ivin);
-	}
-
-	memcpy(&incoming_stream, &child_state.incoming,
-	    sizeof(incoming_stream));
-	memcpy(&outgoing_stream, &child_state.outgoing,
-	    sizeof(outgoing_stream));
-
-	/* Update with new address */
-	if (options.compression)
-		mm_init_compression(pmonitor->m_zlib);
-
-	/* Network I/O buffers */
-	/* XXX inefficient for large buffers, need: buffer_init_from_string */
-	buffer_clear(&input);
-	buffer_append(&input, child_state.input, child_state.ilen);
-	memset(child_state.input, 0, child_state.ilen);
-	xfree(child_state.input);
-
-	buffer_clear(&output);
-	buffer_append(&output, child_state.output, child_state.olen);
-	memset(child_state.output, 0, child_state.olen);
-	xfree(child_state.output);
-}
-
-static Kex *
-mm_get_kex(Buffer *m)
-{
-	Kex *kex;
-	void *blob;
-	u_int bloblen;
-
-	kex = xmalloc(sizeof(*kex));
-	memset(kex, 0, sizeof(*kex));
-	kex->session_id = buffer_get_string(m, &kex->session_id_len);
-	if ((session_id2 == NULL) ||
-	    (kex->session_id_len != session_id2_len) ||
-	    (memcmp(kex->session_id, session_id2, session_id2_len) != 0))
-		fatal("mm_get_get: internal error: bad session id");
-	kex->we_need = buffer_get_int(m);
-	kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server;
-	kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
-	kex->server = 1;
-	kex->hostkey_type = buffer_get_int(m);
-	kex->kex_type = buffer_get_int(m);
-	blob = buffer_get_string(m, &bloblen);
-	buffer_init(&kex->my);
-	buffer_append(&kex->my, blob, bloblen);
-	xfree(blob);
-	blob = buffer_get_string(m, &bloblen);
-	buffer_init(&kex->peer);
-	buffer_append(&kex->peer, blob, bloblen);
-	xfree(blob);
-	kex->done = 1;
-	kex->flags = buffer_get_int(m);
-	kex->client_version_string = buffer_get_string(m, NULL);
-	kex->server_version_string = buffer_get_string(m, NULL);
-	kex->load_host_key=&get_hostkey_by_type;
-	kex->host_key_index=&get_hostkey_index;
-
-	return (kex);
-}
-
-/* This function requries careful sanity checking */
-
-void
-mm_get_keystate(struct monitor *pmonitor)
-{
-	Buffer m;
-	u_char *blob, *p;
-	u_int bloblen, plen;
-
-	debug3("%s: Waiting for new keys", __func__);
-
-	buffer_init(&m);
-	mm_request_receive_expect(pmonitor->m_sendfd, MONITOR_REQ_KEYEXPORT, &m);
-	if (!compat20) {
-		child_state.ssh1protoflags = buffer_get_int(&m);
-		child_state.ssh1cipher = buffer_get_int(&m);
-		child_state.ssh1key = buffer_get_string(&m,
-		    &child_state.ssh1keylen);
-		child_state.ivout = buffer_get_string(&m,
-		    &child_state.ivoutlen);
-		child_state.ivin = buffer_get_string(&m, &child_state.ivinlen);
-		goto skip;
-	} else {
-		/* Get the Kex for rekeying */
-		*pmonitor->m_pkex = mm_get_kex(&m);
-	}
-
-	blob = buffer_get_string(&m, &bloblen);
-	current_keys[MODE_OUT] = mm_newkeys_from_blob(blob, bloblen);
-	xfree(blob);
-
-	debug3("%s: Waiting for second key", __func__);
-	blob = buffer_get_string(&m, &bloblen);
-	current_keys[MODE_IN] = mm_newkeys_from_blob(blob, bloblen);
-	xfree(blob);
-
-	/* Now get sequence numbers for the packets */
-	packet_set_seqnr(MODE_OUT, buffer_get_int(&m));
-	packet_set_seqnr(MODE_IN, buffer_get_int(&m));
-
- skip:
-	/* Get the key context */
-	child_state.keyout = buffer_get_string(&m, &child_state.keyoutlen);
-	child_state.keyin  = buffer_get_string(&m, &child_state.keyinlen);
-
-	debug3("%s: Getting compression state", __func__);
-	/* Get compression state */
-	p = buffer_get_string(&m, &plen);
-	if (plen != sizeof(child_state.outgoing))
-		fatal("%s: bad request size", __func__);
-	memcpy(&child_state.outgoing, p, sizeof(child_state.outgoing));
-	xfree(p);
-
-	p = buffer_get_string(&m, &plen);
-	if (plen != sizeof(child_state.incoming))
-		fatal("%s: bad request size", __func__);
-	memcpy(&child_state.incoming, p, sizeof(child_state.incoming));
-	xfree(p);
-
-	/* Network I/O buffers */
-	debug3("%s: Getting Network I/O buffers", __func__);
-	child_state.input = buffer_get_string(&m, &child_state.ilen);
-	child_state.output = buffer_get_string(&m, &child_state.olen);
-
-	buffer_free(&m);
-}
-
-
-/* Allocation functions for zlib */
-void *
-mm_zalloc(struct mm_master *mm, u_int ncount, u_int size)
-{
-	size_t len = (size_t) size * ncount;
-	void *address;
-
-	if (len == 0 || ncount > SIZE_T_MAX / size)
-		fatal("%s: mm_zalloc(%u, %u)", __func__, ncount, size);
-
-	address = mm_malloc(mm, len);
-
-	return (address);
-}
-
-void
-mm_zfree(struct mm_master *mm, void *address)
-{
-	mm_free(mm, address);
-}
-
-void
-mm_init_compression(struct mm_master *mm)
-{
-	outgoing_stream.zalloc = (alloc_func)mm_zalloc;
-	outgoing_stream.zfree = (free_func)mm_zfree;
-	outgoing_stream.opaque = mm;
-
-	incoming_stream.zalloc = (alloc_func)mm_zalloc;
-	incoming_stream.zfree = (free_func)mm_zfree;
-	incoming_stream.opaque = mm;
-}
-
-/* XXX */
-
-#define FD_CLOSEONEXEC(x) do { \
-	if (fcntl(x, F_SETFD, 1) == -1) \
-		fatal("fcntl(%d, F_SETFD)", x); \
-} while (0)
-
-static void
-monitor_socketpair(int *pair)
-{
-#ifdef HAVE_SOCKETPAIR
-	if (socketpair(AF_UNIX, SOCK_STREAM, 0, pair) == -1)
-		fatal("%s: socketpair", __func__);
-#else
-	fatal("%s: UsePrivilegeSeparation=yes not supported",
-	    __func__);
-#endif
-	FD_CLOSEONEXEC(pair[0]);
-	FD_CLOSEONEXEC(pair[1]);
-}
-
-#define MM_MEMSIZE	65536
-
-struct monitor *
-monitor_init(void)
-{
-	struct monitor *mon;
-	int pair[2];
-
-	mon = xmalloc(sizeof(*mon));
-
-	monitor_socketpair(pair);
-
-	mon->m_recvfd = pair[0];
-	mon->m_sendfd = pair[1];
-
-	/* Used to share zlib space across processes */
-	if (options.compression) {
-		mon->m_zback = mm_create(NULL, MM_MEMSIZE);
-		mon->m_zlib = mm_create(mon->m_zback, 20 * MM_MEMSIZE);
-
-		/* Compression needs to share state across borders */
-		mm_init_compression(mon->m_zlib);
-	}
-
-	return mon;
-}
-
-void
-monitor_reinit(struct monitor *mon)
-{
-	int pair[2];
-
-	monitor_socketpair(pair);
-
-	mon->m_recvfd = pair[0];
-	mon->m_sendfd = pair[1];
-}
diff --git a/crypto/openssh/monitor.h b/crypto/openssh/monitor.h
deleted file mode 100644
index 668ac98970dd..000000000000
--- a/crypto/openssh/monitor.h
+++ /dev/null
@@ -1,84 +0,0 @@
-/*	$OpenBSD: monitor.h,v 1.8 2002/09/26 11:38:43 markus Exp $	*/
-
-/*
- * Copyright 2002 Niels Provos <provos@citi.umich.edu>
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef _MONITOR_H_
-#define _MONITOR_H_
-
-enum monitor_reqtype {
-	MONITOR_REQ_MODULI, MONITOR_ANS_MODULI,
-	MONITOR_REQ_FREE, MONITOR_REQ_AUTHSERV,
-	MONITOR_REQ_SIGN, MONITOR_ANS_SIGN,
-	MONITOR_REQ_PWNAM, MONITOR_ANS_PWNAM,
-	MONITOR_REQ_AUTH2_READ_BANNER, MONITOR_ANS_AUTH2_READ_BANNER,
-	MONITOR_REQ_AUTHPASSWORD, MONITOR_ANS_AUTHPASSWORD,
-	MONITOR_REQ_BSDAUTHQUERY, MONITOR_ANS_BSDAUTHQUERY,
-	MONITOR_REQ_BSDAUTHRESPOND, MONITOR_ANS_BSDAUTHRESPOND,
-	MONITOR_REQ_SKEYQUERY, MONITOR_ANS_SKEYQUERY,
-	MONITOR_REQ_SKEYRESPOND, MONITOR_ANS_SKEYRESPOND,
-	MONITOR_REQ_KEYALLOWED, MONITOR_ANS_KEYALLOWED,
-	MONITOR_REQ_KEYVERIFY, MONITOR_ANS_KEYVERIFY,
-	MONITOR_REQ_KEYEXPORT,
-	MONITOR_REQ_PTY, MONITOR_ANS_PTY,
-	MONITOR_REQ_PTYCLEANUP,
-	MONITOR_REQ_SESSKEY, MONITOR_ANS_SESSKEY,
-	MONITOR_REQ_SESSID,
-	MONITOR_REQ_RSAKEYALLOWED, MONITOR_ANS_RSAKEYALLOWED,
-	MONITOR_REQ_RSACHALLENGE, MONITOR_ANS_RSACHALLENGE,
-	MONITOR_REQ_RSARESPONSE, MONITOR_ANS_RSARESPONSE,
-	MONITOR_REQ_KRB4, MONITOR_ANS_KRB4,
- 	MONITOR_REQ_KRB5, MONITOR_ANS_KRB5,
-	MONITOR_REQ_PAM_START,
-	MONITOR_REQ_TERM
-};
-
-struct mm_master;
-struct monitor {
-	int			 m_recvfd;
-	int			 m_sendfd;
-	struct mm_master	*m_zback;
-	struct mm_master	*m_zlib;
-	struct Kex		**m_pkex;
-	pid_t			 m_pid;
-};
-
-struct monitor *monitor_init(void);
-void monitor_reinit(struct monitor *);
-void monitor_sync(struct monitor *);
-
-struct Authctxt;
-struct Authctxt *monitor_child_preauth(struct monitor *);
-void monitor_child_postauth(struct monitor *);
-
-struct mon_table;
-int monitor_read(struct monitor*, struct mon_table *, struct mon_table **);
-
-/* Prototypes for request sending and receiving */
-void mm_request_send(int, enum monitor_reqtype, Buffer *);
-void mm_request_receive(int, Buffer *);
-void mm_request_receive_expect(int, enum monitor_reqtype, Buffer *);
-
-#endif /* _MONITOR_H_ */
diff --git a/crypto/openssh/monitor_fdpass.c b/crypto/openssh/monitor_fdpass.c
deleted file mode 100644
index 641ce721ef51..000000000000
--- a/crypto/openssh/monitor_fdpass.c
+++ /dev/null
@@ -1,126 +0,0 @@
-/*
- * Copyright 2001 Niels Provos <provos@citi.umich.edu>
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: monitor_fdpass.c,v 1.4 2002/06/26 14:50:04 deraadt Exp $");
-
-#include <sys/uio.h>
-
-#include "log.h"
-#include "monitor_fdpass.h"
-
-void
-mm_send_fd(int socket, int fd)
-{
-#if defined(HAVE_SENDMSG) && (defined(HAVE_ACCRIGHTS_IN_MSGHDR) || defined(HAVE_CONTROL_IN_MSGHDR))
-	struct msghdr msg;
-	struct iovec vec;
-	char ch = '\0';
-	ssize_t n;
-#ifndef HAVE_ACCRIGHTS_IN_MSGHDR
-	char tmp[CMSG_SPACE(sizeof(int))];
-	struct cmsghdr *cmsg;
-#endif
-
-	memset(&msg, 0, sizeof(msg));
-#ifdef HAVE_ACCRIGHTS_IN_MSGHDR
-	msg.msg_accrights = (caddr_t)&fd;
-	msg.msg_accrightslen = sizeof(fd);
-#else
-	msg.msg_control = (caddr_t)tmp;
-	msg.msg_controllen = CMSG_LEN(sizeof(int));
-	cmsg = CMSG_FIRSTHDR(&msg);
-	cmsg->cmsg_len = CMSG_LEN(sizeof(int));
-	cmsg->cmsg_level = SOL_SOCKET;
-	cmsg->cmsg_type = SCM_RIGHTS;
-	*(int *)CMSG_DATA(cmsg) = fd;
-#endif
-
-	vec.iov_base = &ch;
-	vec.iov_len = 1;
-	msg.msg_iov = &vec;
-	msg.msg_iovlen = 1;
-
-	if ((n = sendmsg(socket, &msg, 0)) == -1)
-		fatal("%s: sendmsg(%d): %s", __func__, fd,
-		    strerror(errno));
-	if (n != 1)
-		fatal("%s: sendmsg: expected sent 1 got %ld",
-		    __func__, (long)n);
-#else
-	fatal("%s: UsePrivilegeSeparation=yes not supported",
-	    __func__);
-#endif
-}
-
-int
-mm_receive_fd(int socket)
-{
-#if defined(HAVE_RECVMSG) && (defined(HAVE_ACCRIGHTS_IN_MSGHDR) || defined(HAVE_CONTROL_IN_MSGHDR))
-	struct msghdr msg;
-	struct iovec vec;
-	ssize_t n;
-	char ch;
-	int fd;
-#ifndef HAVE_ACCRIGHTS_IN_MSGHDR
-	char tmp[CMSG_SPACE(sizeof(int))];
-	struct cmsghdr *cmsg;
-#endif
-
-	memset(&msg, 0, sizeof(msg));
-	vec.iov_base = &ch;
-	vec.iov_len = 1;
-	msg.msg_iov = &vec;
-	msg.msg_iovlen = 1;
-#ifdef HAVE_ACCRIGHTS_IN_MSGHDR
-	msg.msg_accrights = (caddr_t)&fd;
-	msg.msg_accrightslen = sizeof(fd);
-#else
-	msg.msg_control = tmp;
-	msg.msg_controllen = sizeof(tmp);
-#endif
-
-	if ((n = recvmsg(socket, &msg, 0)) == -1)
-		fatal("%s: recvmsg: %s", __func__, strerror(errno));
-	if (n != 1)
-		fatal("%s: recvmsg: expected received 1 got %ld",
-		    __func__, (long)n);
-
-#ifdef HAVE_ACCRIGHTS_IN_MSGHDR
-	if (msg.msg_accrightslen != sizeof(fd))
-		fatal("%s: no fd", __func__);
-#else
-	cmsg = CMSG_FIRSTHDR(&msg);
-	if (cmsg->cmsg_type != SCM_RIGHTS)
-		fatal("%s: expected type %d got %d", __func__,
-		    SCM_RIGHTS, cmsg->cmsg_type);
-	fd = (*(int *)CMSG_DATA(cmsg));
-#endif
-	return fd;
-#else
-	fatal("%s: UsePrivilegeSeparation=yes not supported",
-	    __func__);
-#endif
-}
diff --git a/crypto/openssh/monitor_fdpass.h b/crypto/openssh/monitor_fdpass.h
deleted file mode 100644
index 31d080e21ed6..000000000000
--- a/crypto/openssh/monitor_fdpass.h
+++ /dev/null
@@ -1,34 +0,0 @@
-/*	$OpenBSD: monitor_fdpass.h,v 1.2 2002/03/26 03:24:01 stevesk Exp $	*/
-
-/*
- * Copyright 2002 Niels Provos <provos@citi.umich.edu>
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef _MM_FDPASS_H_
-#define _MM_FDPASS_H_
-
-void mm_send_fd(int, int);
-int mm_receive_fd(int);
-
-#endif /* _MM_FDPASS_H_ */
diff --git a/crypto/openssh/monitor_mm.c b/crypto/openssh/monitor_mm.c
deleted file mode 100644
index b4a6e40c90bf..000000000000
--- a/crypto/openssh/monitor_mm.c
+++ /dev/null
@@ -1,346 +0,0 @@
-/*
- * Copyright 2002 Niels Provos <provos@citi.umich.edu>
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: monitor_mm.c,v 1.8 2002/08/02 14:43:15 millert Exp $");
-
-#ifdef HAVE_SYS_MMAN_H
-#include <sys/mman.h>
-#endif
-
-#include "openbsd-compat/xmmap.h"
-#include "ssh.h"
-#include "xmalloc.h"
-#include "log.h"
-#include "monitor_mm.h"
-
-static int
-mm_compare(struct mm_share *a, struct mm_share *b)
-{
-	long diff = (char *)a->address - (char *)b->address;
-
-	if (diff == 0)
-		return (0);
-	else if (diff < 0)
-		return (-1);
-	else
-		return (1);
-}
-
-RB_GENERATE(mmtree, mm_share, next, mm_compare)
-
-static struct mm_share *
-mm_make_entry(struct mm_master *mm, struct mmtree *head,
-    void *address, size_t size)
-{
-	struct mm_share *tmp, *tmp2;
-
-	if (mm->mmalloc == NULL)
-		tmp = xmalloc(sizeof(struct mm_share));
-	else
-		tmp = mm_xmalloc(mm->mmalloc, sizeof(struct mm_share));
-	tmp->address = address;
-	tmp->size = size;
-
-	tmp2 = RB_INSERT(mmtree, head, tmp);
-	if (tmp2 != NULL)
-		fatal("mm_make_entry(%p): double address %p->%p(%lu)",
-		    mm, tmp2, address, (u_long)size);
-
-	return (tmp);
-}
-
-/* Creates a shared memory area of a certain size */
-
-struct mm_master *
-mm_create(struct mm_master *mmalloc, size_t size)
-{
-	void *address;
-	struct mm_master *mm;
-
-	if (mmalloc == NULL)
-		mm = xmalloc(sizeof(struct mm_master));
-	else
-		mm = mm_xmalloc(mmalloc, sizeof(struct mm_master));
-
-	/*
-	 * If the memory map has a mm_master it can be completely
-	 * shared including authentication between the child
-	 * and the client.
-	 */
-	mm->mmalloc = mmalloc;
-
-	address = xmmap(size);
-	if (address == MAP_FAILED)
-		fatal("mmap(%lu): %s", (u_long)size, strerror(errno));
-
-	mm->address = address;
-	mm->size = size;
-
-	RB_INIT(&mm->rb_free);
-	RB_INIT(&mm->rb_allocated);
-
-	mm_make_entry(mm, &mm->rb_free, address, size);
-
-	return (mm);
-}
-
-/* Frees either the allocated or the free list */
-
-static void
-mm_freelist(struct mm_master *mmalloc, struct mmtree *head)
-{
-	struct mm_share *mms, *next;
-
-	for (mms = RB_ROOT(head); mms; mms = next) {
-		next = RB_NEXT(mmtree, head, mms);
-		RB_REMOVE(mmtree, head, mms);
-		if (mmalloc == NULL)
-			xfree(mms);
-		else
-			mm_free(mmalloc, mms);
-	}
-}
-
-/* Destroys a memory mapped area */
-
-void
-mm_destroy(struct mm_master *mm)
-{
-	mm_freelist(mm->mmalloc, &mm->rb_free);
-	mm_freelist(mm->mmalloc, &mm->rb_allocated);
-
-#ifdef HAVE_MMAP
-	if (munmap(mm->address, mm->size) == -1)
-		fatal("munmap(%p, %lu): %s", mm->address, (u_long)mm->size,
-		    strerror(errno));
-#else
-	fatal("%s: UsePrivilegeSeparation=yes and Compression=yes not supported",
-	    __func__);
-#endif
-	if (mm->mmalloc == NULL)
-		xfree(mm);
-	else
-		mm_free(mm->mmalloc, mm);
-}
-
-void *
-mm_xmalloc(struct mm_master *mm, size_t size)
-{
-	void *address;
-
-	address = mm_malloc(mm, size);
-	if (address == NULL)
-		fatal("%s: mm_malloc(%lu)", __func__, (u_long)size);
-	return (address);
-}
-
-
-/* Allocates data from a memory mapped area */
-
-void *
-mm_malloc(struct mm_master *mm, size_t size)
-{
-	struct mm_share *mms, *tmp;
-
-	if (size == 0)
-		fatal("mm_malloc: try to allocate 0 space");
-	if (size > SIZE_T_MAX - MM_MINSIZE + 1)
-		fatal("mm_malloc: size too big");
-
-	size = ((size + (MM_MINSIZE - 1)) / MM_MINSIZE) * MM_MINSIZE;
-
-	RB_FOREACH(mms, mmtree, &mm->rb_free) {
-		if (mms->size >= size)
-			break;
-	}
-
-	if (mms == NULL)
-		return (NULL);
-
-	/* Debug */
-	memset(mms->address, 0xd0, size);
-
-	tmp = mm_make_entry(mm, &mm->rb_allocated, mms->address, size);
-
-	/* Does not change order in RB tree */
-	mms->size -= size;
-	mms->address = (u_char *)mms->address + size;
-
-	if (mms->size == 0) {
-		RB_REMOVE(mmtree, &mm->rb_free, mms);
-		if (mm->mmalloc == NULL)
-			xfree(mms);
-		else
-			mm_free(mm->mmalloc, mms);
-	}
-
-	return (tmp->address);
-}
-
-/* Frees memory in a memory mapped area */
-
-void
-mm_free(struct mm_master *mm, void *address)
-{
-	struct mm_share *mms, *prev, tmp;
-
-	tmp.address = address;
-	mms = RB_FIND(mmtree, &mm->rb_allocated, &tmp);
-	if (mms == NULL)
-		fatal("mm_free(%p): can not find %p", mm, address);
-
-	/* Debug */
-	memset(mms->address, 0xd0, mms->size);
-
-	/* Remove from allocated list and insert in free list */
-	RB_REMOVE(mmtree, &mm->rb_allocated, mms);
-	if (RB_INSERT(mmtree, &mm->rb_free, mms) != NULL)
-		fatal("mm_free(%p): double address %p", mm, address);
-
-	/* Find previous entry */
-	prev = mms;
-	if (RB_LEFT(prev, next)) {
-		prev = RB_LEFT(prev, next);
-		while (RB_RIGHT(prev, next))
-			prev = RB_RIGHT(prev, next);
-	} else {
-		if (RB_PARENT(prev, next) &&
-		    (prev == RB_RIGHT(RB_PARENT(prev, next), next)))
-			prev = RB_PARENT(prev, next);
-		else {
-			while (RB_PARENT(prev, next) &&
-			    (prev == RB_LEFT(RB_PARENT(prev, next), next)))
-				prev = RB_PARENT(prev, next);
-			prev = RB_PARENT(prev, next);
-		}
-	}
-
-	/* Check if range does not overlap */
-	if (prev != NULL && MM_ADDRESS_END(prev) > address)
-		fatal("mm_free: memory corruption: %p(%lu) > %p",
-		    prev->address, (u_long)prev->size, address);
-
-	/* See if we can merge backwards */
-	if (prev != NULL && MM_ADDRESS_END(prev) == address) {
-		prev->size += mms->size;
-		RB_REMOVE(mmtree, &mm->rb_free, mms);
-		if (mm->mmalloc == NULL)
-			xfree(mms);
-		else
-			mm_free(mm->mmalloc, mms);
-	} else
-		prev = mms;
-
-	if (prev == NULL)
-		return;
-
-	/* Check if we can merge forwards */
-	mms = RB_NEXT(mmtree, &mm->rb_free, prev);
-	if (mms == NULL)
-		return;
-
-	if (MM_ADDRESS_END(prev) > mms->address)
-		fatal("mm_free: memory corruption: %p < %p(%lu)",
-		    mms->address, prev->address, (u_long)prev->size);
-	if (MM_ADDRESS_END(prev) != mms->address)
-		return;
-
-	prev->size += mms->size;
-	RB_REMOVE(mmtree, &mm->rb_free, mms);
-
-	if (mm->mmalloc == NULL)
-		xfree(mms);
-	else
-		mm_free(mm->mmalloc, mms);
-}
-
-static void
-mm_sync_list(struct mmtree *oldtree, struct mmtree *newtree,
-    struct mm_master *mm, struct mm_master *mmold)
-{
-	struct mm_master *mmalloc = mm->mmalloc;
-	struct mm_share *mms, *new;
-
-	/* Sync free list */
-	RB_FOREACH(mms, mmtree, oldtree) {
-		/* Check the values */
-		mm_memvalid(mmold, mms, sizeof(struct mm_share));
-		mm_memvalid(mm, mms->address, mms->size);
-
-		new = mm_xmalloc(mmalloc, sizeof(struct mm_share));
-		memcpy(new, mms, sizeof(struct mm_share));
-		RB_INSERT(mmtree, newtree, new);
-	}
-}
-
-void
-mm_share_sync(struct mm_master **pmm, struct mm_master **pmmalloc)
-{
-	struct mm_master *mm;
-	struct mm_master *mmalloc;
-	struct mm_master *mmold;
-	struct mmtree rb_free, rb_allocated;
-
-	debug3("%s: Share sync", __func__);
-
-	mm = *pmm;
-	mmold = mm->mmalloc;
-	mm_memvalid(mmold, mm, sizeof(*mm));
-
-	mmalloc = mm_create(NULL, mm->size);
-	mm = mm_xmalloc(mmalloc, sizeof(struct mm_master));
-	memcpy(mm, *pmm, sizeof(struct mm_master));
-	mm->mmalloc = mmalloc;
-
-	rb_free = mm->rb_free;
-	rb_allocated = mm->rb_allocated;
-
-	RB_INIT(&mm->rb_free);
-	RB_INIT(&mm->rb_allocated);
-
-	mm_sync_list(&rb_free, &mm->rb_free, mm, mmold);
-	mm_sync_list(&rb_allocated, &mm->rb_allocated, mm, mmold);
-
-	mm_destroy(mmold);
-
-	*pmm = mm;
-	*pmmalloc = mmalloc;
-
-	debug3("%s: Share sync end", __func__);
-}
-
-void
-mm_memvalid(struct mm_master *mm, void *address, size_t size)
-{
-	void *end = (u_char *)address + size;
-
-	if (address < mm->address)
-		fatal("mm_memvalid: address too small: %p", address);
-	if (end < address)
-		fatal("mm_memvalid: end < address: %p < %p", end, address);
-	if (end > (void *)((u_char *)mm->address + mm->size))
-		fatal("mm_memvalid: address too large: %p", address);
-}
diff --git a/crypto/openssh/monitor_mm.h b/crypto/openssh/monitor_mm.h
deleted file mode 100644
index a1323b9a8d25..000000000000
--- a/crypto/openssh/monitor_mm.h
+++ /dev/null
@@ -1,66 +0,0 @@
-/*	$OpenBSD: monitor_mm.h,v 1.2 2002/03/26 03:24:01 stevesk Exp $	*/
-
-/*
- * Copyright 2002 Niels Provos <provos@citi.umich.edu>
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef _MM_H_
-#define _MM_H_
-#include "openbsd-compat/sys-tree.h"
-
-struct mm_share {
-	RB_ENTRY(mm_share) next;
-	void *address;
-	size_t size;
-};
-
-struct mm_master {
-	RB_HEAD(mmtree, mm_share) rb_free;
-	struct mmtree rb_allocated;
-	void *address;
-	size_t size;
-
-	struct mm_master *mmalloc;	/* Used to completely share */
-
-	int write;		/* used to writing to other party */
-	int read;		/* used for reading from other party */
-};
-
-RB_PROTOTYPE(mmtree, mm_share, next, mm_compare)
-
-#define MM_MINSIZE		128
-
-#define MM_ADDRESS_END(x)	(void *)((u_char *)(x)->address + (x)->size)
-
-struct mm_master *mm_create(struct mm_master *, size_t);
-void mm_destroy(struct mm_master *);
-
-void mm_share_sync(struct mm_master **, struct mm_master **);
-
-void *mm_malloc(struct mm_master *, size_t);
-void *mm_xmalloc(struct mm_master *, size_t);
-void mm_free(struct mm_master *, void *);
-
-void mm_memvalid(struct mm_master *, void *, size_t);
-#endif /* _MM_H_ */
diff --git a/crypto/openssh/monitor_wrap.c b/crypto/openssh/monitor_wrap.c
deleted file mode 100644
index c9714138ada7..000000000000
--- a/crypto/openssh/monitor_wrap.c
+++ /dev/null
@@ -1,1021 +0,0 @@
-/*
- * Copyright 2002 Niels Provos <provos@citi.umich.edu>
- * Copyright 2002 Markus Friedl <markus@openbsd.org>
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: monitor_wrap.c,v 1.24 2003/04/01 10:22:21 markus Exp $");
-
-#include <openssl/bn.h>
-#include <openssl/dh.h>
-
-#include "ssh.h"
-#include "dh.h"
-#include "kex.h"
-#include "auth.h"
-#include "auth-options.h"
-#include "buffer.h"
-#include "bufaux.h"
-#include "packet.h"
-#include "mac.h"
-#include "log.h"
-#include "zlib.h"
-#include "monitor.h"
-#include "monitor_wrap.h"
-#include "xmalloc.h"
-#include "atomicio.h"
-#include "monitor_fdpass.h"
-#include "getput.h"
-
-#include "auth.h"
-#include "channels.h"
-#include "session.h"
-
-/* Imports */
-extern int compat20;
-extern Newkeys *newkeys[];
-extern z_stream incoming_stream;
-extern z_stream outgoing_stream;
-extern struct monitor *pmonitor;
-extern Buffer input, output;
-
-void
-mm_request_send(int socket, enum monitor_reqtype type, Buffer *m)
-{
-	u_int mlen = buffer_len(m);
-	u_char buf[5];
-
-	debug3("%s entering: type %d", __func__, type);
-
-	PUT_32BIT(buf, mlen + 1);
-	buf[4] = (u_char) type;		/* 1st byte of payload is mesg-type */
-	if (atomicio(write, socket, buf, sizeof(buf)) != sizeof(buf))
-		fatal("%s: write", __func__);
-	if (atomicio(write, socket, buffer_ptr(m), mlen) != mlen)
-		fatal("%s: write", __func__);
-}
-
-void
-mm_request_receive(int socket, Buffer *m)
-{
-	u_char buf[4];
-	u_int msg_len;
-	ssize_t res;
-
-	debug3("%s entering", __func__);
-
-	res = atomicio(read, socket, buf, sizeof(buf));
-	if (res != sizeof(buf)) {
-		if (res == 0)
-			fatal_cleanup();
-		fatal("%s: read: %ld", __func__, (long)res);
-	}
-	msg_len = GET_32BIT(buf);
-	if (msg_len > 256 * 1024)
-		fatal("%s: read: bad msg_len %d", __func__, msg_len);
-	buffer_clear(m);
-	buffer_append_space(m, msg_len);
-	res = atomicio(read, socket, buffer_ptr(m), msg_len);
-	if (res != msg_len)
-		fatal("%s: read: %ld != msg_len", __func__, (long)res);
-}
-
-void
-mm_request_receive_expect(int socket, enum monitor_reqtype type, Buffer *m)
-{
-	u_char rtype;
-
-	debug3("%s entering: type %d", __func__, type);
-
-	mm_request_receive(socket, m);
-	rtype = buffer_get_char(m);
-	if (rtype != type)
-		fatal("%s: read: rtype %d != type %d", __func__,
-		    rtype, type);
-}
-
-DH *
-mm_choose_dh(int min, int nbits, int max)
-{
-	BIGNUM *p, *g;
-	int success = 0;
-	Buffer m;
-
-	buffer_init(&m);
-	buffer_put_int(&m, min);
-	buffer_put_int(&m, nbits);
-	buffer_put_int(&m, max);
-
-	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_MODULI, &m);
-
-	debug3("%s: waiting for MONITOR_ANS_MODULI", __func__);
-	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_MODULI, &m);
-
-	success = buffer_get_char(&m);
-	if (success == 0)
-		fatal("%s: MONITOR_ANS_MODULI failed", __func__);
-
-	if ((p = BN_new()) == NULL)
-		fatal("%s: BN_new failed", __func__);
-	if ((g = BN_new()) == NULL)
-		fatal("%s: BN_new failed", __func__);
-	buffer_get_bignum2(&m, p);
-	buffer_get_bignum2(&m, g);
-
-	debug3("%s: remaining %d", __func__, buffer_len(&m));
-	buffer_free(&m);
-
-	return (dh_new_group(g, p));
-}
-
-int
-mm_key_sign(Key *key, u_char **sigp, u_int *lenp, u_char *data, u_int datalen)
-{
-	Kex *kex = *pmonitor->m_pkex;
-	Buffer m;
-
-	debug3("%s entering", __func__);
-
-	buffer_init(&m);
-	buffer_put_int(&m, kex->host_key_index(key));
-	buffer_put_string(&m, data, datalen);
-
-	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_SIGN, &m);
-
-	debug3("%s: waiting for MONITOR_ANS_SIGN", __func__);
-	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_SIGN, &m);
-	*sigp  = buffer_get_string(&m, lenp);
-	buffer_free(&m);
-
-	return (0);
-}
-
-struct passwd *
-mm_getpwnamallow(const char *login)
-{
-	Buffer m;
-	struct passwd *pw;
-	u_int pwlen;
-
-	debug3("%s entering", __func__);
-
-	buffer_init(&m);
-	buffer_put_cstring(&m, login);
-
-	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PWNAM, &m);
-
-	debug3("%s: waiting for MONITOR_ANS_PWNAM", __func__);
-	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_PWNAM, &m);
-
-	if (buffer_get_char(&m) == 0) {
-		buffer_free(&m);
-		return (NULL);
-	}
-	pw = buffer_get_string(&m, &pwlen);
-	if (pwlen != sizeof(struct passwd))
-		fatal("%s: struct passwd size mismatch", __func__);
-	pw->pw_name = buffer_get_string(&m, NULL);
-	pw->pw_passwd = buffer_get_string(&m, NULL);
-	pw->pw_gecos = buffer_get_string(&m, NULL);
-#ifdef HAVE_PW_CLASS_IN_PASSWD
-	pw->pw_class = buffer_get_string(&m, NULL);
-#endif
-	pw->pw_dir = buffer_get_string(&m, NULL);
-	pw->pw_shell = buffer_get_string(&m, NULL);
-	buffer_free(&m);
-
-	return (pw);
-}
-
-char *mm_auth2_read_banner(void)
-{
-	Buffer m;
-	char *banner;
-
-	debug3("%s entering", __func__);
-
-	buffer_init(&m);
-	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTH2_READ_BANNER, &m);
-	buffer_clear(&m);
-
-	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_AUTH2_READ_BANNER, &m);
-	banner = buffer_get_string(&m, NULL);
-	buffer_free(&m);
-
-	return (banner);
-}
-
-/* Inform the privileged process about service and style */
-
-void
-mm_inform_authserv(char *service, char *style)
-{
-	Buffer m;
-
-	debug3("%s entering", __func__);
-
-	buffer_init(&m);
-	buffer_put_cstring(&m, service);
-	buffer_put_cstring(&m, style ? style : "");
-
-	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHSERV, &m);
-
-	buffer_free(&m);
-}
-
-/* Do the password authentication */
-int
-mm_auth_password(Authctxt *authctxt, char *password)
-{
-	Buffer m;
-	int authenticated = 0;
-
-	debug3("%s entering", __func__);
-
-	buffer_init(&m);
-	buffer_put_cstring(&m, password);
-	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHPASSWORD, &m);
-
-	debug3("%s: waiting for MONITOR_ANS_AUTHPASSWORD", __func__);
-	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_AUTHPASSWORD, &m);
-
-	authenticated = buffer_get_int(&m);
-
-	buffer_free(&m);
-
-	debug3("%s: user %sauthenticated",
-	    __func__, authenticated ? "" : "not ");
-	return (authenticated);
-}
-
-int
-mm_user_key_allowed(struct passwd *pw, Key *key)
-{
-	return (mm_key_allowed(MM_USERKEY, NULL, NULL, key));
-}
-
-int
-mm_hostbased_key_allowed(struct passwd *pw, char *user, char *host,
-    Key *key)
-{
-	return (mm_key_allowed(MM_HOSTKEY, user, host, key));
-}
-
-int
-mm_auth_rhosts_rsa_key_allowed(struct passwd *pw, char *user,
-    char *host, Key *key)
-{
-	int ret;
-
-	key->type = KEY_RSA; /* XXX hack for key_to_blob */
-	ret = mm_key_allowed(MM_RSAHOSTKEY, user, host, key);
-	key->type = KEY_RSA1;
-	return (ret);
-}
-
-static void
-mm_send_debug(Buffer *m)
-{
-	char *msg;
-
-	while (buffer_len(m)) {
-		msg = buffer_get_string(m, NULL);
-		debug3("%s: Sending debug: %s", __func__, msg);
-		packet_send_debug("%s", msg);
-		xfree(msg);
-	}
-}
-
-int
-mm_key_allowed(enum mm_keytype type, char *user, char *host, Key *key)
-{
-	Buffer m;
-	u_char *blob;
-	u_int len;
-	int allowed = 0, have_forced = 0;
-
-	debug3("%s entering", __func__);
-
-	/* Convert the key to a blob and the pass it over */
-	if (!key_to_blob(key, &blob, &len))
-		return (0);
-
-	buffer_init(&m);
-	buffer_put_int(&m, type);
-	buffer_put_cstring(&m, user ? user : "");
-	buffer_put_cstring(&m, host ? host : "");
-	buffer_put_string(&m, blob, len);
-	xfree(blob);
-
-	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_KEYALLOWED, &m);
-
-	debug3("%s: waiting for MONITOR_ANS_KEYALLOWED", __func__);
-	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_KEYALLOWED, &m);
-
-	allowed = buffer_get_int(&m);
-
-	/* fake forced command */
-	auth_clear_options();
-	have_forced = buffer_get_int(&m);
-	forced_command = have_forced ? xstrdup("true") : NULL;
-
-	/* Send potential debug messages */
-	mm_send_debug(&m);
-
-	buffer_free(&m);
-
-	return (allowed);
-}
-
-/*
- * This key verify needs to send the key type along, because the
- * privileged parent makes the decision if the key is allowed
- * for authentication.
- */
-
-int
-mm_key_verify(Key *key, u_char *sig, u_int siglen, u_char *data, u_int datalen)
-{
-	Buffer m;
-	u_char *blob;
-	u_int len;
-	int verified = 0;
-
-	debug3("%s entering", __func__);
-
-	/* Convert the key to a blob and the pass it over */
-	if (!key_to_blob(key, &blob, &len))
-		return (0);
-
-	buffer_init(&m);
-	buffer_put_string(&m, blob, len);
-	buffer_put_string(&m, sig, siglen);
-	buffer_put_string(&m, data, datalen);
-	xfree(blob);
-
-	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_KEYVERIFY, &m);
-
-	debug3("%s: waiting for MONITOR_ANS_KEYVERIFY", __func__);
-	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_KEYVERIFY, &m);
-
-	verified = buffer_get_int(&m);
-
-	buffer_free(&m);
-
-	return (verified);
-}
-
-/* Export key state after authentication */
-Newkeys *
-mm_newkeys_from_blob(u_char *blob, int blen)
-{
-	Buffer b;
-	u_int len;
-	Newkeys *newkey = NULL;
-	Enc *enc;
-	Mac *mac;
-	Comp *comp;
-
-	debug3("%s: %p(%d)", __func__, blob, blen);
-#ifdef DEBUG_PK
-	dump_base64(stderr, blob, blen);
-#endif
-	buffer_init(&b);
-	buffer_append(&b, blob, blen);
-
-	newkey = xmalloc(sizeof(*newkey));
-	enc = &newkey->enc;
-	mac = &newkey->mac;
-	comp = &newkey->comp;
-
-	/* Enc structure */
-	enc->name = buffer_get_string(&b, NULL);
-	buffer_get(&b, &enc->cipher, sizeof(enc->cipher));
-	enc->enabled = buffer_get_int(&b);
-	enc->block_size = buffer_get_int(&b);
-	enc->key = buffer_get_string(&b, &enc->key_len);
-	enc->iv = buffer_get_string(&b, &len);
-	if (len != enc->block_size)
-		fatal("%s: bad ivlen: expected %u != %u", __func__,
-		    enc->block_size, len);
-
-	if (enc->name == NULL || cipher_by_name(enc->name) != enc->cipher)
-		fatal("%s: bad cipher name %s or pointer %p", __func__,
-		    enc->name, enc->cipher);
-
-	/* Mac structure */
-	mac->name = buffer_get_string(&b, NULL);
-	if (mac->name == NULL || mac_init(mac, mac->name) == -1)
-		fatal("%s: can not init mac %s", __func__, mac->name);
-	mac->enabled = buffer_get_int(&b);
-	mac->key = buffer_get_string(&b, &len);
-	if (len > mac->key_len)
-		fatal("%s: bad mac key length: %u > %d", __func__, len,
-		    mac->key_len);
-	mac->key_len = len;
-
-	/* Comp structure */
-	comp->type = buffer_get_int(&b);
-	comp->enabled = buffer_get_int(&b);
-	comp->name = buffer_get_string(&b, NULL);
-
-	len = buffer_len(&b);
-	if (len != 0)
-		error("newkeys_from_blob: remaining bytes in blob %u", len);
-	buffer_free(&b);
-	return (newkey);
-}
-
-int
-mm_newkeys_to_blob(int mode, u_char **blobp, u_int *lenp)
-{
-	Buffer b;
-	int len;
-	Enc *enc;
-	Mac *mac;
-	Comp *comp;
-	Newkeys *newkey = newkeys[mode];
-
-	debug3("%s: converting %p", __func__, newkey);
-
-	if (newkey == NULL) {
-		error("%s: newkey == NULL", __func__);
-		return 0;
-	}
-	enc = &newkey->enc;
-	mac = &newkey->mac;
-	comp = &newkey->comp;
-
-	buffer_init(&b);
-	/* Enc structure */
-	buffer_put_cstring(&b, enc->name);
-	/* The cipher struct is constant and shared, you export pointer */
-	buffer_append(&b, &enc->cipher, sizeof(enc->cipher));
-	buffer_put_int(&b, enc->enabled);
-	buffer_put_int(&b, enc->block_size);
-	buffer_put_string(&b, enc->key, enc->key_len);
-	packet_get_keyiv(mode, enc->iv, enc->block_size);
-	buffer_put_string(&b, enc->iv, enc->block_size);
-
-	/* Mac structure */
-	buffer_put_cstring(&b, mac->name);
-	buffer_put_int(&b, mac->enabled);
-	buffer_put_string(&b, mac->key, mac->key_len);
-
-	/* Comp structure */
-	buffer_put_int(&b, comp->type);
-	buffer_put_int(&b, comp->enabled);
-	buffer_put_cstring(&b, comp->name);
-
-	len = buffer_len(&b);
-	if (lenp != NULL)
-		*lenp = len;
-	if (blobp != NULL) {
-		*blobp = xmalloc(len);
-		memcpy(*blobp, buffer_ptr(&b), len);
-	}
-	memset(buffer_ptr(&b), 0, len);
-	buffer_free(&b);
-	return len;
-}
-
-static void
-mm_send_kex(Buffer *m, Kex *kex)
-{
-	buffer_put_string(m, kex->session_id, kex->session_id_len);
-	buffer_put_int(m, kex->we_need);
-	buffer_put_int(m, kex->hostkey_type);
-	buffer_put_int(m, kex->kex_type);
-	buffer_put_string(m, buffer_ptr(&kex->my), buffer_len(&kex->my));
-	buffer_put_string(m, buffer_ptr(&kex->peer), buffer_len(&kex->peer));
-	buffer_put_int(m, kex->flags);
-	buffer_put_cstring(m, kex->client_version_string);
-	buffer_put_cstring(m, kex->server_version_string);
-}
-
-void
-mm_send_keystate(struct monitor *pmonitor)
-{
-	Buffer m;
-	u_char *blob, *p;
-	u_int bloblen, plen;
-
-	buffer_init(&m);
-
-	if (!compat20) {
-		u_char iv[24];
-		u_char *key;
-		u_int ivlen, keylen;
-
-		buffer_put_int(&m, packet_get_protocol_flags());
-
-		buffer_put_int(&m, packet_get_ssh1_cipher());
-
-		debug3("%s: Sending ssh1 KEY+IV", __func__);
-		keylen = packet_get_encryption_key(NULL);
-		key = xmalloc(keylen+1);	/* add 1 if keylen == 0 */
-		keylen = packet_get_encryption_key(key);
-		buffer_put_string(&m, key, keylen);
-		memset(key, 0, keylen);
-		xfree(key);
-
-		ivlen = packet_get_keyiv_len(MODE_OUT);
-		packet_get_keyiv(MODE_OUT, iv, ivlen);
-		buffer_put_string(&m, iv, ivlen);
-		ivlen = packet_get_keyiv_len(MODE_OUT);
-		packet_get_keyiv(MODE_IN, iv, ivlen);
-		buffer_put_string(&m, iv, ivlen);
-		goto skip;
-	} else {
-		/* Kex for rekeying */
-		mm_send_kex(&m, *pmonitor->m_pkex);
-	}
-
-	debug3("%s: Sending new keys: %p %p",
-	    __func__, newkeys[MODE_OUT], newkeys[MODE_IN]);
-
-	/* Keys from Kex */
-	if (!mm_newkeys_to_blob(MODE_OUT, &blob, &bloblen))
-		fatal("%s: conversion of newkeys failed", __func__);
-
-	buffer_put_string(&m, blob, bloblen);
-	xfree(blob);
-
-	if (!mm_newkeys_to_blob(MODE_IN, &blob, &bloblen))
-		fatal("%s: conversion of newkeys failed", __func__);
-
-	buffer_put_string(&m, blob, bloblen);
-	xfree(blob);
-
-	buffer_put_int(&m, packet_get_seqnr(MODE_OUT));
-	buffer_put_int(&m, packet_get_seqnr(MODE_IN));
-
-	debug3("%s: New keys have been sent", __func__);
- skip:
-	/* More key context */
-	plen = packet_get_keycontext(MODE_OUT, NULL);
-	p = xmalloc(plen+1);
-	packet_get_keycontext(MODE_OUT, p);
-	buffer_put_string(&m, p, plen);
-	xfree(p);
-
-	plen = packet_get_keycontext(MODE_IN, NULL);
-	p = xmalloc(plen+1);
-	packet_get_keycontext(MODE_IN, p);
-	buffer_put_string(&m, p, plen);
-	xfree(p);
-
-	/* Compression state */
-	debug3("%s: Sending compression state", __func__);
-	buffer_put_string(&m, &outgoing_stream, sizeof(outgoing_stream));
-	buffer_put_string(&m, &incoming_stream, sizeof(incoming_stream));
-
-	/* Network I/O buffers */
-	buffer_put_string(&m, buffer_ptr(&input), buffer_len(&input));
-	buffer_put_string(&m, buffer_ptr(&output), buffer_len(&output));
-
-	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_KEYEXPORT, &m);
-	debug3("%s: Finished sending state", __func__);
-
-	buffer_free(&m);
-}
-
-int
-mm_pty_allocate(int *ptyfd, int *ttyfd, char *namebuf, int namebuflen)
-{
-	Buffer m;
-	char *p;
-	int success = 0;
-
-	buffer_init(&m);
-	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PTY, &m);
-
-	debug3("%s: waiting for MONITOR_ANS_PTY", __func__);
-	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_PTY, &m);
-
-	success = buffer_get_int(&m);
-	if (success == 0) {
-		debug3("%s: pty alloc failed", __func__);
-		buffer_free(&m);
-		return (0);
-	}
-	p = buffer_get_string(&m, NULL);
-	buffer_free(&m);
-
-	strlcpy(namebuf, p, namebuflen); /* Possible truncation */
-	xfree(p);
-
-	*ptyfd = mm_receive_fd(pmonitor->m_recvfd);
-	*ttyfd = mm_receive_fd(pmonitor->m_recvfd);
-
-	/* Success */
-	return (1);
-}
-
-void
-mm_session_pty_cleanup2(void *session)
-{
-	Session *s = session;
-	Buffer m;
-
-	if (s->ttyfd == -1)
-		return;
-	buffer_init(&m);
-	buffer_put_cstring(&m, s->tty);
-	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PTYCLEANUP, &m);
-	buffer_free(&m);
-
-	/* closed dup'ed master */
-	if (close(s->ptymaster) < 0)
-		error("close(s->ptymaster): %s", strerror(errno));
-
-	/* unlink pty from session */
-	s->ttyfd = -1;
-}
-
-#ifdef USE_PAM
-void
-mm_start_pam(char *user)
-{
-	Buffer m;
-
-	debug3("%s entering", __func__);
-
-	buffer_init(&m);
-	buffer_put_cstring(&m, user);
-
-	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_START, &m);
-
-	buffer_free(&m);
-}
-#endif /* USE_PAM */
-
-/* Request process termination */
-
-void
-mm_terminate(void)
-{
-	Buffer m;
-
-	buffer_init(&m);
-	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_TERM, &m);
-	buffer_free(&m);
-}
-
-int
-mm_ssh1_session_key(BIGNUM *num)
-{
-	int rsafail;
-	Buffer m;
-
-	buffer_init(&m);
-	buffer_put_bignum2(&m, num);
-	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_SESSKEY, &m);
-
-	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_SESSKEY, &m);
-
-	rsafail = buffer_get_int(&m);
-	buffer_get_bignum2(&m, num);
-
-	buffer_free(&m);
-
-	return (rsafail);
-}
-
-static void
-mm_chall_setup(char **name, char **infotxt, u_int *numprompts,
-    char ***prompts, u_int **echo_on)
-{
-	*name = xstrdup("");
-	*infotxt = xstrdup("");
-	*numprompts = 1;
-	*prompts = xmalloc(*numprompts * sizeof(char *));
-	*echo_on = xmalloc(*numprompts * sizeof(u_int));
-	(*echo_on)[0] = 0;
-}
-
-int
-mm_bsdauth_query(void *ctx, char **name, char **infotxt,
-   u_int *numprompts, char ***prompts, u_int **echo_on)
-{
-	Buffer m;
-	u_int success;
-	char *challenge;
-
-	debug3("%s: entering", __func__);
-
-	buffer_init(&m);
-	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_BSDAUTHQUERY, &m);
-
-	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_BSDAUTHQUERY,
-	    &m);
-	success = buffer_get_int(&m);
-	if (success == 0) {
-		debug3("%s: no challenge", __func__);
-		buffer_free(&m);
-		return (-1);
-	}
-
-	/* Get the challenge, and format the response */
-	challenge  = buffer_get_string(&m, NULL);
-	buffer_free(&m);
-
-	mm_chall_setup(name, infotxt, numprompts, prompts, echo_on);
-	(*prompts)[0] = challenge;
-
-	debug3("%s: received challenge: %s", __func__, challenge);
-
-	return (0);
-}
-
-int
-mm_bsdauth_respond(void *ctx, u_int numresponses, char **responses)
-{
-	Buffer m;
-	int authok;
-
-	debug3("%s: entering", __func__);
-	if (numresponses != 1)
-		return (-1);
-
-	buffer_init(&m);
-	buffer_put_cstring(&m, responses[0]);
-	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_BSDAUTHRESPOND, &m);
-
-	mm_request_receive_expect(pmonitor->m_recvfd,
-	    MONITOR_ANS_BSDAUTHRESPOND, &m);
-
-	authok = buffer_get_int(&m);
-	buffer_free(&m);
-
-	return ((authok == 0) ? -1 : 0);
-}
-
-int
-mm_skey_query(void *ctx, char **name, char **infotxt,
-   u_int *numprompts, char ***prompts, u_int **echo_on)
-{
-	Buffer m;
-	int len;
-	u_int success;
-	char *p, *challenge;
-
-	debug3("%s: entering", __func__);
-
-	buffer_init(&m);
-	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_SKEYQUERY, &m);
-
-	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_SKEYQUERY,
-	    &m);
-	success = buffer_get_int(&m);
-	if (success == 0) {
-		debug3("%s: no challenge", __func__);
-		buffer_free(&m);
-		return (-1);
-	}
-
-	/* Get the challenge, and format the response */
-	challenge  = buffer_get_string(&m, NULL);
-	buffer_free(&m);
-
-	debug3("%s: received challenge: %s", __func__, challenge);
-
-	mm_chall_setup(name, infotxt, numprompts, prompts, echo_on);
-
-	len = strlen(challenge) + strlen(SKEY_PROMPT) + 1;
-	p = xmalloc(len);
-	strlcpy(p, challenge, len);
-	strlcat(p, SKEY_PROMPT, len);
-	(*prompts)[0] = p;
-	xfree(challenge);
-
-	return (0);
-}
-
-int
-mm_skey_respond(void *ctx, u_int numresponses, char **responses)
-{
-	Buffer m;
-	int authok;
-
-	debug3("%s: entering", __func__);
-	if (numresponses != 1)
-		return (-1);
-
-	buffer_init(&m);
-	buffer_put_cstring(&m, responses[0]);
-	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_SKEYRESPOND, &m);
-
-	mm_request_receive_expect(pmonitor->m_recvfd,
-	    MONITOR_ANS_SKEYRESPOND, &m);
-
-	authok = buffer_get_int(&m);
-	buffer_free(&m);
-
-	return ((authok == 0) ? -1 : 0);
-}
-
-void
-mm_ssh1_session_id(u_char session_id[16])
-{
-	Buffer m;
-	int i;
-
-	debug3("%s entering", __func__);
-
-	buffer_init(&m);
-	for (i = 0; i < 16; i++)
-		buffer_put_char(&m, session_id[i]);
-
-	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_SESSID, &m);
-	buffer_free(&m);
-}
-
-int
-mm_auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey)
-{
-	Buffer m;
-	Key *key;
-	u_char *blob;
-	u_int blen;
-	int allowed = 0, have_forced = 0;
-
-	debug3("%s entering", __func__);
-
-	buffer_init(&m);
-	buffer_put_bignum2(&m, client_n);
-
-	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_RSAKEYALLOWED, &m);
-	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_RSAKEYALLOWED, &m);
-
-	allowed = buffer_get_int(&m);
-
-	/* fake forced command */
-	auth_clear_options();
-	have_forced = buffer_get_int(&m);
-	forced_command = have_forced ? xstrdup("true") : NULL;
-
-	if (allowed && rkey != NULL) {
-		blob = buffer_get_string(&m, &blen);
-		if ((key = key_from_blob(blob, blen)) == NULL)
-			fatal("%s: key_from_blob failed", __func__);
-		*rkey = key;
-		xfree(blob);
-	}
-	mm_send_debug(&m);
-	buffer_free(&m);
-
-	return (allowed);
-}
-
-BIGNUM *
-mm_auth_rsa_generate_challenge(Key *key)
-{
-	Buffer m;
-	BIGNUM *challenge;
-	u_char *blob;
-	u_int blen;
-
-	debug3("%s entering", __func__);
-
-	if ((challenge = BN_new()) == NULL)
-		fatal("%s: BN_new failed", __func__);
-
-	key->type = KEY_RSA;    /* XXX cheat for key_to_blob */
-	if (key_to_blob(key, &blob, &blen) == 0)
-		fatal("%s: key_to_blob failed", __func__);
-	key->type = KEY_RSA1;
-
-	buffer_init(&m);
-	buffer_put_string(&m, blob, blen);
-	xfree(blob);
-
-	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_RSACHALLENGE, &m);
-	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_RSACHALLENGE, &m);
-
-	buffer_get_bignum2(&m, challenge);
-	buffer_free(&m);
-
-	return (challenge);
-}
-
-int
-mm_auth_rsa_verify_response(Key *key, BIGNUM *p, u_char response[16])
-{
-	Buffer m;
-	u_char *blob;
-	u_int blen;
-	int success = 0;
-
-	debug3("%s entering", __func__);
-
-	key->type = KEY_RSA;    /* XXX cheat for key_to_blob */
-	if (key_to_blob(key, &blob, &blen) == 0)
-		fatal("%s: key_to_blob failed", __func__);
-	key->type = KEY_RSA1;
-
-	buffer_init(&m);
-	buffer_put_string(&m, blob, blen);
-	buffer_put_string(&m, response, 16);
-	xfree(blob);
-
-	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_RSARESPONSE, &m);
-	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_RSARESPONSE, &m);
-
-	success = buffer_get_int(&m);
-	buffer_free(&m);
-
-	return (success);
-}
-
-#ifdef KRB4
-int
-mm_auth_krb4(Authctxt *authctxt, void *_auth, char **client, void *_reply)
-{
-	KTEXT auth, reply;
- 	Buffer m;
-	u_int rlen;
-	int success = 0;
-	char *p;
-
-	debug3("%s entering", __func__);
-	auth = _auth;
-	reply = _reply;
-
-	buffer_init(&m);
-	buffer_put_string(&m, auth->dat, auth->length);
-
-	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_KRB4, &m);
-	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_KRB4, &m);
-
-	success = buffer_get_int(&m);
-	if (success) {
-		*client = buffer_get_string(&m, NULL);
-		p = buffer_get_string(&m, &rlen);
-		if (rlen >= MAX_KTXT_LEN)
-			fatal("%s: reply from monitor too large", __func__);
-		reply->length = rlen;
-		memcpy(reply->dat, p, rlen);
-		memset(p, 0, rlen);
-		xfree(p);
-	}
-	buffer_free(&m);
-	return (success);
-}
-#endif
-
-#ifdef KRB5
-int
-mm_auth_krb5(void *ctx, void *argp, char **userp, void *resp)
-{
-	krb5_data *tkt, *reply;
-	Buffer m;
-	int success;
-
-	debug3("%s entering", __func__);
-	tkt = (krb5_data *) argp;
-	reply = (krb5_data *) resp;
-
-	buffer_init(&m);
-	buffer_put_string(&m, tkt->data, tkt->length);
-
-	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_KRB5, &m);
-	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_KRB5, &m);
-
-	success = buffer_get_int(&m);
-	if (success) {
-		u_int len;
-
-		*userp = buffer_get_string(&m, NULL);
-		reply->data = buffer_get_string(&m, &len);
-		reply->length = len;
-	} else {
-		memset(reply, 0, sizeof(*reply));
-		*userp = NULL;
-	}
-
-	buffer_free(&m);
-	return (success);
-}
-#endif
diff --git a/crypto/openssh/monitor_wrap.h b/crypto/openssh/monitor_wrap.h
deleted file mode 100644
index d960a3d0b4c1..000000000000
--- a/crypto/openssh/monitor_wrap.h
+++ /dev/null
@@ -1,102 +0,0 @@
-/*	$OpenBSD: monitor_wrap.h,v 1.8 2002/09/26 11:38:43 markus Exp $	*/
-
-/*
- * Copyright 2002 Niels Provos <provos@citi.umich.edu>
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef _MM_WRAP_H_
-#define _MM_WRAP_H_
-#include "key.h"
-#include "buffer.h"
-
-extern int use_privsep;
-#define PRIVSEP(x)	(use_privsep ? mm_##x : x)
-
-enum mm_keytype {MM_NOKEY, MM_HOSTKEY, MM_USERKEY, MM_RSAHOSTKEY, MM_RSAUSERKEY};
-
-struct monitor;
-struct mm_master;
-struct passwd;
-struct Authctxt;
-
-DH *mm_choose_dh(int, int, int);
-int mm_key_sign(Key *, u_char **, u_int *, u_char *, u_int);
-void mm_inform_authserv(char *, char *);
-struct passwd *mm_getpwnamallow(const char *);
-char *mm_auth2_read_banner(void);
-int mm_auth_password(struct Authctxt *, char *);
-int mm_key_allowed(enum mm_keytype, char *, char *, Key *);
-int mm_user_key_allowed(struct passwd *, Key *);
-int mm_hostbased_key_allowed(struct passwd *, char *, char *, Key *);
-int mm_auth_rhosts_rsa_key_allowed(struct passwd *, char *, char *, Key *);
-int mm_key_verify(Key *, u_char *, u_int, u_char *, u_int);
-int mm_auth_rsa_key_allowed(struct passwd *, BIGNUM *, Key **);
-int mm_auth_rsa_verify_response(Key *, BIGNUM *, u_char *);
-BIGNUM *mm_auth_rsa_generate_challenge(Key *);
-
-#ifdef USE_PAM
-void mm_start_pam(char *);
-#endif
-
-void mm_terminate(void);
-int mm_pty_allocate(int *, int *, char *, int);
-void mm_session_pty_cleanup2(void *);
-
-/* SSHv1 interfaces */
-void mm_ssh1_session_id(u_char *);
-int mm_ssh1_session_key(BIGNUM *);
-
-/* Key export functions */
-struct Newkeys *mm_newkeys_from_blob(u_char *, int);
-int mm_newkeys_to_blob(int, u_char **, u_int *);
-
-void monitor_apply_keystate(struct monitor *);
-void mm_get_keystate(struct monitor *);
-void mm_send_keystate(struct monitor*);
-
-/* bsdauth */
-int mm_bsdauth_query(void *, char **, char **, u_int *, char ***, u_int **);
-int mm_bsdauth_respond(void *, u_int, char **);
-
-/* skey */
-int mm_skey_query(void *, char **, char **, u_int *, char ***, u_int **);
-int mm_skey_respond(void *, u_int, char **);
-
-/* auth_krb */
-#ifdef KRB4
-int mm_auth_krb4(struct Authctxt *, void *, char **, void *);
-#endif
-#ifdef KRB5
-/* auth and reply are really krb5_data objects, but we don't want to
- * include all of the krb5 headers here */
-int mm_auth_krb5(void *authctxt, void *auth, char **client, void *reply);
-#endif
-
-/* zlib allocation hooks */
-
-void *mm_zalloc(struct mm_master *, u_int, u_int);
-void mm_zfree(struct mm_master *, void *);
-void mm_init_compression(struct mm_master *);
-
-#endif /* _MM_H_ */
diff --git a/crypto/openssh/mpaux.c b/crypto/openssh/mpaux.c
deleted file mode 100644
index 0c486275ffbc..000000000000
--- a/crypto/openssh/mpaux.c
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * This file contains various auxiliary functions related to multiple
- * precision integers.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: mpaux.c,v 1.16 2001/02/08 19:30:52 itojun Exp $");
-
-#include <openssl/bn.h>
-#include "getput.h"
-#include "xmalloc.h"
-
-#include <openssl/md5.h>
-
-#include "mpaux.h"
-
-void
-compute_session_id(u_char session_id[16],
-    u_char cookie[8],
-    BIGNUM* host_key_n,
-    BIGNUM* session_key_n)
-{
-	u_int host_key_bytes = BN_num_bytes(host_key_n);
-	u_int session_key_bytes = BN_num_bytes(session_key_n);
-	u_int bytes = host_key_bytes + session_key_bytes;
-	u_char *buf = xmalloc(bytes);
-	MD5_CTX md;
-
-	BN_bn2bin(host_key_n, buf);
-	BN_bn2bin(session_key_n, buf + host_key_bytes);
-	MD5_Init(&md);
-	MD5_Update(&md, buf, bytes);
-	MD5_Update(&md, cookie, 8);
-	MD5_Final(session_id, &md);
-	memset(buf, 0, bytes);
-	xfree(buf);
-}
diff --git a/crypto/openssh/mpaux.h b/crypto/openssh/mpaux.h
deleted file mode 100644
index 2a312f5cb212..000000000000
--- a/crypto/openssh/mpaux.h
+++ /dev/null
@@ -1,22 +0,0 @@
-/*	$OpenBSD: mpaux.h,v 1.12 2002/03/04 17:27:39 stevesk Exp $	*/
-
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * This file contains various auxiliary functions related to multiple
- * precision integers.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#ifndef MPAUX_H
-#define MPAUX_H
-
-void	 compute_session_id(u_char[16], u_char[8], BIGNUM *, BIGNUM *);
-
-#endif				/* MPAUX_H */
diff --git a/crypto/openssh/msg.c b/crypto/openssh/msg.c
deleted file mode 100644
index 5d266c207e57..000000000000
--- a/crypto/openssh/msg.c
+++ /dev/null
@@ -1,73 +0,0 @@
-/*
- * Copyright (c) 2002 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#include "includes.h"
-RCSID("$OpenBSD: msg.c,v 1.5 2002/12/19 00:07:02 djm Exp $");
-
-#include "buffer.h"
-#include "getput.h"
-#include "log.h"
-#include "atomicio.h"
-#include "msg.h"
-
-void
-ssh_msg_send(int fd, u_char type, Buffer *m)
-{
-	u_char buf[5];
-	u_int mlen = buffer_len(m);
-
-	debug3("ssh_msg_send: type %u", (unsigned int)type & 0xff);
-
-	PUT_32BIT(buf, mlen + 1);
-	buf[4] = type;		/* 1st byte of payload is mesg-type */
-	if (atomicio(write, fd, buf, sizeof(buf)) != sizeof(buf))
-		fatal("ssh_msg_send: write");
-	if (atomicio(write, fd, buffer_ptr(m), mlen) != mlen)
-		fatal("ssh_msg_send: write");
-}
-
-int
-ssh_msg_recv(int fd, Buffer *m)
-{
-	u_char buf[4];
-	ssize_t res;
-	u_int msg_len;
-
-	debug3("ssh_msg_recv entering");
-
-	res = atomicio(read, fd, buf, sizeof(buf));
-	if (res != sizeof(buf)) {
-		if (res == 0)
-			return -1;
-		fatal("ssh_msg_recv: read: header %ld", (long)res);
-	}
-	msg_len = GET_32BIT(buf);
-	if (msg_len > 256 * 1024)
-		fatal("ssh_msg_recv: read: bad msg_len %u", msg_len);
-	buffer_clear(m);
-	buffer_append_space(m, msg_len);
-	res = atomicio(read, fd, buffer_ptr(m), msg_len);
-	if (res != msg_len)
-		fatal("ssh_msg_recv: read: %ld != msg_len", (long)res);
-	return 0;
-}
diff --git a/crypto/openssh/msg.h b/crypto/openssh/msg.h
deleted file mode 100644
index c07df88a7acd..000000000000
--- a/crypto/openssh/msg.h
+++ /dev/null
@@ -1,31 +0,0 @@
-/*	$OpenBSD: msg.h,v 1.2 2002/12/19 00:07:02 djm Exp $	*/
-/*
- * Copyright (c) 2002 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#ifndef SSH_MSG_H
-#define SSH_MSG_H
-
-void	 ssh_msg_send(int, u_char, Buffer *);
-int	 ssh_msg_recv(int, Buffer *);
-
-#endif
diff --git a/crypto/openssh/myproposal.h b/crypto/openssh/myproposal.h
deleted file mode 100644
index 62f5cfb655ec..000000000000
--- a/crypto/openssh/myproposal.h
+++ /dev/null
@@ -1,50 +0,0 @@
-/*	$OpenBSD: myproposal.h,v 1.14 2002/04/03 09:26:11 markus Exp $	*/
-
-/*
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#define KEX_DEFAULT_KEX		"diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1"
-#define	KEX_DEFAULT_PK_ALG	"ssh-rsa,ssh-dss"
-#define	KEX_DEFAULT_ENCRYPT \
-	"aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour," \
-	"aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se"
-#define	KEX_DEFAULT_MAC \
-	"hmac-md5,hmac-sha1,hmac-ripemd160," \
-	"hmac-ripemd160@openssh.com," \
-	"hmac-sha1-96,hmac-md5-96"
-#define	KEX_DEFAULT_COMP	"none,zlib"
-#define	KEX_DEFAULT_LANG	""
-
-
-static char *myproposal[PROPOSAL_MAX] = {
-	KEX_DEFAULT_KEX,
-	KEX_DEFAULT_PK_ALG,
-	KEX_DEFAULT_ENCRYPT,
-	KEX_DEFAULT_ENCRYPT,
-	KEX_DEFAULT_MAC,
-	KEX_DEFAULT_MAC,
-	KEX_DEFAULT_COMP,
-	KEX_DEFAULT_COMP,
-	KEX_DEFAULT_LANG,
-	KEX_DEFAULT_LANG
-};
diff --git a/crypto/openssh/nchan.c b/crypto/openssh/nchan.c
deleted file mode 100644
index bce7325b3fcd..000000000000
--- a/crypto/openssh/nchan.c
+++ /dev/null
@@ -1,483 +0,0 @@
-/*
- * Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: nchan.c,v 1.47 2002/06/19 00:27:55 deraadt Exp $");
-
-#include "ssh1.h"
-#include "ssh2.h"
-#include "buffer.h"
-#include "packet.h"
-#include "channels.h"
-#include "compat.h"
-#include "log.h"
-
-/*
- * SSH Protocol 1.5 aka New Channel Protocol
- * Thanks to Martina, Axel and everyone who left Erlangen, leaving me bored.
- * Written by Markus Friedl in October 1999
- *
- * Protocol versions 1.3 and 1.5 differ in the handshake protocol used for the
- * tear down of channels:
- *
- * 1.3:	strict request-ack-protocol:
- * 	CLOSE	->
- * 		<-  CLOSE_CONFIRM
- *
- * 1.5:	uses variations of:
- * 	IEOF	->
- * 		<-  OCLOSE
- * 		<-  IEOF
- * 	OCLOSE	->
- * 	i.e. both sides have to close the channel
- *
- * 2.0: the EOF messages are optional
- *
- * See the debugging output from 'ssh -v' and 'sshd -d' of
- * ssh-1.2.27 as an example.
- *
- */
-
-/* functions manipulating channel states */
-/*
- * EVENTS update channel input/output states execute ACTIONS
- */
-/*
- * ACTIONS: should never update the channel states
- */
-static void	chan_send_ieof1(Channel *);
-static void	chan_send_oclose1(Channel *);
-static void	chan_send_close2(Channel *);
-static void	chan_send_eof2(Channel *);
-
-/* helper */
-static void	chan_shutdown_write(Channel *);
-static void	chan_shutdown_read(Channel *);
-
-static char *ostates[] = { "open", "drain", "wait_ieof", "closed" };
-static char *istates[] = { "open", "drain", "wait_oclose", "closed" };
-
-static void
-chan_set_istate(Channel *c, u_int next)
-{
-	if (c->istate > CHAN_INPUT_CLOSED || next > CHAN_INPUT_CLOSED)
-		fatal("chan_set_istate: bad state %d -> %d", c->istate, next);
-	debug("channel %d: input %s -> %s", c->self, istates[c->istate],
-	    istates[next]);
-	c->istate = next;
-}
-static void
-chan_set_ostate(Channel *c, u_int next)
-{
-	if (c->ostate > CHAN_OUTPUT_CLOSED || next > CHAN_OUTPUT_CLOSED)
-		fatal("chan_set_ostate: bad state %d -> %d", c->ostate, next);
-	debug("channel %d: output %s -> %s", c->self, ostates[c->ostate],
-	    ostates[next]);
-	c->ostate = next;
-}
-
-/*
- * SSH1 specific implementation of event functions
- */
-
-static void
-chan_rcvd_oclose1(Channel *c)
-{
-	debug("channel %d: rcvd oclose", c->self);
-	switch (c->istate) {
-	case CHAN_INPUT_WAIT_OCLOSE:
-		chan_set_istate(c, CHAN_INPUT_CLOSED);
-		break;
-	case CHAN_INPUT_OPEN:
-		chan_shutdown_read(c);
-		chan_send_ieof1(c);
-		chan_set_istate(c, CHAN_INPUT_CLOSED);
-		break;
-	case CHAN_INPUT_WAIT_DRAIN:
-		/* both local read_failed and remote write_failed  */
-		chan_send_ieof1(c);
-		chan_set_istate(c, CHAN_INPUT_CLOSED);
-		break;
-	default:
-		error("channel %d: protocol error: rcvd_oclose for istate %d",
-		    c->self, c->istate);
-		return;
-	}
-}
-void
-chan_read_failed(Channel *c)
-{
-	debug("channel %d: read failed", c->self);
-	switch (c->istate) {
-	case CHAN_INPUT_OPEN:
-		chan_shutdown_read(c);
-		chan_set_istate(c, CHAN_INPUT_WAIT_DRAIN);
-		break;
-	default:
-		error("channel %d: chan_read_failed for istate %d",
-		    c->self, c->istate);
-		break;
-	}
-}
-void
-chan_ibuf_empty(Channel *c)
-{
-	debug("channel %d: ibuf empty", c->self);
-	if (buffer_len(&c->input)) {
-		error("channel %d: chan_ibuf_empty for non empty buffer",
-		    c->self);
-		return;
-	}
-	switch (c->istate) {
-	case CHAN_INPUT_WAIT_DRAIN:
-		if (compat20) {
-			if (!(c->flags & CHAN_CLOSE_SENT))
-				chan_send_eof2(c);
-			chan_set_istate(c, CHAN_INPUT_CLOSED);
-		} else {
-			chan_send_ieof1(c);
-			chan_set_istate(c, CHAN_INPUT_WAIT_OCLOSE);
-		}
-		break;
-	default:
-		error("channel %d: chan_ibuf_empty for istate %d",
-		    c->self, c->istate);
-		break;
-	}
-}
-static void
-chan_rcvd_ieof1(Channel *c)
-{
-	debug("channel %d: rcvd ieof", c->self);
-	switch (c->ostate) {
-	case CHAN_OUTPUT_OPEN:
-		chan_set_ostate(c, CHAN_OUTPUT_WAIT_DRAIN);
-		break;
-	case CHAN_OUTPUT_WAIT_IEOF:
-		chan_set_ostate(c, CHAN_OUTPUT_CLOSED);
-		break;
-	default:
-		error("channel %d: protocol error: rcvd_ieof for ostate %d",
-		    c->self, c->ostate);
-		break;
-	}
-}
-static void
-chan_write_failed1(Channel *c)
-{
-	debug("channel %d: write failed", c->self);
-	switch (c->ostate) {
-	case CHAN_OUTPUT_OPEN:
-		chan_shutdown_write(c);
-		chan_send_oclose1(c);
-		chan_set_ostate(c, CHAN_OUTPUT_WAIT_IEOF);
-		break;
-	case CHAN_OUTPUT_WAIT_DRAIN:
-		chan_shutdown_write(c);
-		chan_send_oclose1(c);
-		chan_set_ostate(c, CHAN_OUTPUT_CLOSED);
-		break;
-	default:
-		error("channel %d: chan_write_failed for ostate %d",
-		    c->self, c->ostate);
-		break;
-	}
-}
-void
-chan_obuf_empty(Channel *c)
-{
-	debug("channel %d: obuf empty", c->self);
-	if (buffer_len(&c->output)) {
-		error("channel %d: chan_obuf_empty for non empty buffer",
-		    c->self);
-		return;
-	}
-	switch (c->ostate) {
-	case CHAN_OUTPUT_WAIT_DRAIN:
-		chan_shutdown_write(c);
-		if (!compat20)
-			chan_send_oclose1(c);
-		chan_set_ostate(c, CHAN_OUTPUT_CLOSED);
-		break;
-	default:
-		error("channel %d: internal error: obuf_empty for ostate %d",
-		    c->self, c->ostate);
-		break;
-	}
-}
-static void
-chan_send_ieof1(Channel *c)
-{
-	debug("channel %d: send ieof", c->self);
-	switch (c->istate) {
-	case CHAN_INPUT_OPEN:
-	case CHAN_INPUT_WAIT_DRAIN:
-		packet_start(SSH_MSG_CHANNEL_INPUT_EOF);
-		packet_put_int(c->remote_id);
-		packet_send();
-		break;
-	default:
-		error("channel %d: cannot send ieof for istate %d",
-		    c->self, c->istate);
-		break;
-	}
-}
-static void
-chan_send_oclose1(Channel *c)
-{
-	debug("channel %d: send oclose", c->self);
-	switch (c->ostate) {
-	case CHAN_OUTPUT_OPEN:
-	case CHAN_OUTPUT_WAIT_DRAIN:
-		buffer_clear(&c->output);
-		packet_start(SSH_MSG_CHANNEL_OUTPUT_CLOSE);
-		packet_put_int(c->remote_id);
-		packet_send();
-		break;
-	default:
-		error("channel %d: cannot send oclose for ostate %d",
-		    c->self, c->ostate);
-		break;
-	}
-}
-
-/*
- * the same for SSH2
- */
-static void
-chan_rcvd_close2(Channel *c)
-{
-	debug("channel %d: rcvd close", c->self);
-	if (c->flags & CHAN_CLOSE_RCVD)
-		error("channel %d: protocol error: close rcvd twice", c->self);
-	c->flags |= CHAN_CLOSE_RCVD;
-	if (c->type == SSH_CHANNEL_LARVAL) {
-		/* tear down larval channels immediately */
-		chan_set_ostate(c, CHAN_OUTPUT_CLOSED);
-		chan_set_istate(c, CHAN_INPUT_CLOSED);
-		return;
-	}
-	switch (c->ostate) {
-	case CHAN_OUTPUT_OPEN:
-		/*
-		 * wait until a data from the channel is consumed if a CLOSE
-		 * is received
-		 */
-		chan_set_ostate(c, CHAN_OUTPUT_WAIT_DRAIN);
-		break;
-	}
-	switch (c->istate) {
-	case CHAN_INPUT_OPEN:
-		chan_shutdown_read(c);
-		chan_set_istate(c, CHAN_INPUT_CLOSED);
-		break;
-	case CHAN_INPUT_WAIT_DRAIN:
-		chan_send_eof2(c);
-		chan_set_istate(c, CHAN_INPUT_CLOSED);
-		break;
-	}
-}
-static void
-chan_rcvd_eof2(Channel *c)
-{
-	debug("channel %d: rcvd eof", c->self);
-	c->flags |= CHAN_EOF_RCVD;
-	if (c->ostate == CHAN_OUTPUT_OPEN)
-		chan_set_ostate(c, CHAN_OUTPUT_WAIT_DRAIN);
-}
-static void
-chan_write_failed2(Channel *c)
-{
-	debug("channel %d: write failed", c->self);
-	switch (c->ostate) {
-	case CHAN_OUTPUT_OPEN:
-	case CHAN_OUTPUT_WAIT_DRAIN:
-		chan_shutdown_write(c);
-		chan_set_ostate(c, CHAN_OUTPUT_CLOSED);
-		break;
-	default:
-		error("channel %d: chan_write_failed for ostate %d",
-		    c->self, c->ostate);
-		break;
-	}
-}
-static void
-chan_send_eof2(Channel *c)
-{
-	debug("channel %d: send eof", c->self);
-	switch (c->istate) {
-	case CHAN_INPUT_WAIT_DRAIN:
-		packet_start(SSH2_MSG_CHANNEL_EOF);
-		packet_put_int(c->remote_id);
-		packet_send();
-		c->flags |= CHAN_EOF_SENT;
-		break;
-	default:
-		error("channel %d: cannot send eof for istate %d",
-		    c->self, c->istate);
-		break;
-	}
-}
-static void
-chan_send_close2(Channel *c)
-{
-	debug("channel %d: send close", c->self);
-	if (c->ostate != CHAN_OUTPUT_CLOSED ||
-	    c->istate != CHAN_INPUT_CLOSED) {
-		error("channel %d: cannot send close for istate/ostate %d/%d",
-		    c->self, c->istate, c->ostate);
-	} else if (c->flags & CHAN_CLOSE_SENT) {
-		error("channel %d: already sent close", c->self);
-	} else {
-		packet_start(SSH2_MSG_CHANNEL_CLOSE);
-		packet_put_int(c->remote_id);
-		packet_send();
-		c->flags |= CHAN_CLOSE_SENT;
-	}
-}
-
-/* shared */
-
-void
-chan_rcvd_ieof(Channel *c)
-{
-	if (compat20)
-		chan_rcvd_eof2(c);
-	else
-		chan_rcvd_ieof1(c);
-	if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN &&
-	    buffer_len(&c->output) == 0 &&
-	    !CHANNEL_EFD_OUTPUT_ACTIVE(c))
-		chan_obuf_empty(c);
-}
-void
-chan_rcvd_oclose(Channel *c)
-{
-	if (compat20)
-		chan_rcvd_close2(c);
-	else
-		chan_rcvd_oclose1(c);
-}
-void
-chan_write_failed(Channel *c)
-{
-	if (compat20)
-		chan_write_failed2(c);
-	else
-		chan_write_failed1(c);
-}
-
-void
-chan_mark_dead(Channel *c)
-{
-	c->type = SSH_CHANNEL_ZOMBIE;
-}
-
-int
-chan_is_dead(Channel *c, int send)
-{
-	if (c->type == SSH_CHANNEL_ZOMBIE) {
-		debug("channel %d: zombie", c->self);
-		return 1;
-	}
-	if (c->istate != CHAN_INPUT_CLOSED || c->ostate != CHAN_OUTPUT_CLOSED)
-		return 0;
-	if (!compat20) {
-		debug("channel %d: is dead", c->self);
-		return 1;
-	}
-	if ((datafellows & SSH_BUG_EXTEOF) &&
-	    c->extended_usage == CHAN_EXTENDED_WRITE &&
-	    c->efd != -1 &&
-	    buffer_len(&c->extended) > 0) {
-		debug2("channel %d: active efd: %d len %d",
-		    c->self, c->efd, buffer_len(&c->extended));
-		return 0;
-	}
-	if (!(c->flags & CHAN_CLOSE_SENT)) {
-		if (send) {
-			chan_send_close2(c);
-		} else {
-			/* channel would be dead if we sent a close */
-			if (c->flags & CHAN_CLOSE_RCVD) {
-				debug("channel %d: almost dead",
-				    c->self);
-				return 1;
-			}
-		}
-	}
-	if ((c->flags & CHAN_CLOSE_SENT) &&
-	    (c->flags & CHAN_CLOSE_RCVD)) {
-		debug("channel %d: is dead", c->self);
-		return 1;
-	}
-	return 0;
-}
-
-/* helper */
-static void
-chan_shutdown_write(Channel *c)
-{
-	buffer_clear(&c->output);
-	if (compat20 && c->type == SSH_CHANNEL_LARVAL)
-		return;
-	/* shutdown failure is allowed if write failed already */
-	debug("channel %d: close_write", c->self);
-	if (c->sock != -1) {
-		if (shutdown(c->sock, SHUT_WR) < 0)
-			debug("channel %d: chan_shutdown_write: "
-			    "shutdown() failed for fd%d: %.100s",
-			    c->self, c->sock, strerror(errno));
-	} else {
-		if (channel_close_fd(&c->wfd) < 0)
-			log("channel %d: chan_shutdown_write: "
-			    "close() failed for fd%d: %.100s",
-			    c->self, c->wfd, strerror(errno));
-	}
-}
-static void
-chan_shutdown_read(Channel *c)
-{
-	if (compat20 && c->type == SSH_CHANNEL_LARVAL)
-		return;
-	debug("channel %d: close_read", c->self);
-	if (c->sock != -1) {
-		/*
-		 * shutdown(sock, SHUT_READ) may return ENOTCONN if the
-		 * write side has been closed already. (bug on Linux)
-		 * HP-UX may return ENOTCONN also.
-		 */
-		if (shutdown(c->sock, SHUT_RD) < 0
-		    && errno != ENOTCONN)
-			error("channel %d: chan_shutdown_read: "
-			    "shutdown() failed for fd%d [i%d o%d]: %.100s",
-			    c->self, c->sock, c->istate, c->ostate,
-			    strerror(errno));
-	} else {
-		if (channel_close_fd(&c->rfd) < 0)
-			log("channel %d: chan_shutdown_read: "
-			    "close() failed for fd%d: %.100s",
-			    c->self, c->rfd, strerror(errno));
-	}
-}
diff --git a/crypto/openssh/nchan.h b/crypto/openssh/nchan.h
deleted file mode 100644
index 623ecccc31cf..000000000000
--- a/crypto/openssh/nchan.h
+++ /dev/null
@@ -1,91 +0,0 @@
-/*
- * Copyright (c) 1999 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/* RCSID("$OpenBSD: nchan.h,v 1.10 2001/02/28 08:54:55 markus Exp $"); */
-
-#ifndef NCHAN_H
-#define NCHAN_H
-
-/*
- * SSH Protocol 1.5 aka New Channel Protocol
- * Thanks to Martina, Axel and everyone who left Erlangen, leaving me bored.
- * Written by Markus Friedl in October 1999
- *
- * Protocol versions 1.3 and 1.5 differ in the handshake protocol used for the
- * tear down of channels:
- *
- * 1.3:	strict request-ack-protocol:
- * 	CLOSE	->
- * 		<-  CLOSE_CONFIRM
- *
- * 1.5:	uses variations of:
- * 	IEOF	->
- * 		<-  OCLOSE
- * 		<-  IEOF
- * 	OCLOSE	->
- * 	i.e. both sides have to close the channel
- *
- * See the debugging output from 'ssh -v' and 'sshd -d' of
- * ssh-1.2.27 as an example.
- *
- */
-
-/* ssh-proto-1.5 overloads prot-1.3-message-types */
-#define SSH_MSG_CHANNEL_INPUT_EOF	SSH_MSG_CHANNEL_CLOSE
-#define SSH_MSG_CHANNEL_OUTPUT_CLOSE	SSH_MSG_CHANNEL_CLOSE_CONFIRMATION
-
-/* possible input states */
-#define CHAN_INPUT_OPEN			0x01
-#define CHAN_INPUT_WAIT_DRAIN		0x02
-#define CHAN_INPUT_WAIT_OCLOSE		0x04
-#define CHAN_INPUT_CLOSED		0x08
-
-/* possible output states */
-#define CHAN_OUTPUT_OPEN		0x10
-#define CHAN_OUTPUT_WAIT_DRAIN		0x20
-#define CHAN_OUTPUT_WAIT_IEOF		0x40
-#define CHAN_OUTPUT_CLOSED		0x80
-
-#define CHAN_CLOSE_SENT			0x01
-#define CHAN_CLOSE_RCVD			0x02
-
-
-/* Channel EVENTS */
-typedef void    chan_event_fn(Channel * c);
-
-/* for the input state */
-extern chan_event_fn	*chan_rcvd_oclose;
-extern chan_event_fn	*chan_read_failed;
-extern chan_event_fn	*chan_ibuf_empty;
-
-/* for the output state */
-extern chan_event_fn	*chan_rcvd_ieof;
-extern chan_event_fn	*chan_write_failed;
-extern chan_event_fn	*chan_obuf_empty;
-
-int chan_is_dead(Channel * c);
-
-void    chan_init_iostates(Channel * c);
-void	chan_init(void);
-#endif
diff --git a/crypto/openssh/nchan.ms b/crypto/openssh/nchan.ms
deleted file mode 100644
index 2d080228c75f..000000000000
--- a/crypto/openssh/nchan.ms
+++ /dev/null
@@ -1,99 +0,0 @@
-.\"	$OpenBSD: nchan.ms,v 1.7 2001/01/29 01:58:17 niklas Exp $
-.\"
-.\" 
-.\" Copyright (c) 1999 Markus Friedl.  All rights reserved.
-.\" 
-.\" Redistribution and use in source and binary forms, with or without
-.\" modification, are permitted provided that the following conditions
-.\" are met:
-.\" 1. Redistributions of source code must retain the above copyright
-.\"    notice, this list of conditions and the following disclaimer.
-.\" 2. Redistributions in binary form must reproduce the above copyright
-.\"    notice, this list of conditions and the following disclaimer in the
-.\"    documentation and/or other materials provided with the distribution.
-.\" 
-.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-.\"
-.TL
-OpenSSH Channel Close Protocol 1.5 Implementation
-.SH
-Channel Input State Diagram
-.PS
-reset
-l=1
-s=1.2
-ellipsewid=s*ellipsewid
-boxwid=s*boxwid
-ellipseht=s*ellipseht
-S1: ellipse "INPUT" "OPEN"
-move right 2*l from last ellipse.e
-S4: ellipse "INPUT" "CLOSED"
-move down l from last ellipse.s
-S3: ellipse "INPUT" "WAIT" "OCLOSED"
-move down l from 1st ellipse.s
-S2: ellipse "INPUT" "WAIT" "DRAIN"
-arrow "" "rcvd OCLOSE/" "shutdown_read" "send IEOF" from S1.e to S4.w
-arrow "ibuf_empty/" "send IEOF" from S2.e to S3.w
-arrow from S1.s to S2.n
-box invis "read_failed/" "shutdown_read" with .e at last arrow.c
-arrow  from S3.n to S4.s
-box invis "rcvd OCLOSE/" "-" with .w at last arrow.c
-ellipse wid .9*ellipsewid ht .9*ellipseht at S4
-arrow "start" "" from S1.w+(-0.5,0) to S1.w
-arrow from S2.ne to S4.sw
-box invis "rcvd OCLOSE/     " with .e at last arrow.c
-box invis " send IEOF" with .w at last arrow.c
-.PE
-.SH
-Channel Output State Diagram
-.PS
-S1: ellipse "OUTPUT" "OPEN"
-move right 2*l from last ellipse.e
-S3: ellipse "OUTPUT" "WAIT" "IEOF"
-move down l from last ellipse.s
-S4: ellipse "OUTPUT" "CLOSED"
-move down l from 1st ellipse.s
-S2: ellipse "OUTPUT" "WAIT" "DRAIN"
-arrow "" "write_failed/" "shutdown_write" "send OCLOSE" from S1.e to S3.w
-arrow "obuf_empty ||" "write_failed/" "shutdown_write" "send OCLOSE" from S2.e to S4.w
-arrow from S1.s to S2.n
-box invis "rcvd IEOF/" "-" with .e at last arrow.c
-arrow from S3.s to S4.n
-box invis "rcvd IEOF/" "-" with .w at last arrow.c
-ellipse wid .9*ellipsewid ht .9*ellipseht at S4
-arrow "start" "" from S1.w+(-0.5,0) to S1.w
-.PE
-.SH
-Notes
-.PP
-The input buffer is filled with data from the socket
-(the socket represents the local consumer/producer of the
-forwarded channel).
-The data is then sent over the INPUT-end (transmit-end) of the channel to the
-remote peer.
-Data sent by the peer is received on the OUTPUT-end (receive-end),
-saved in the output buffer and written to the socket.
-.PP
-If the local protocol instance has forwarded all data on the
-INPUT-end of the channel, it sends an IEOF message to the peer.
-If the peer receives the IEOF and has consumed all
-data he replies with an OCLOSE.
-When the local instance receives the OCLOSE
-he considers the INPUT-half of the channel closed.
-The peer has his OUTOUT-half closed.
-.PP
-A channel can be deallocated by a protocol instance
-if both the INPUT- and the OUTOUT-half on his
-side of the channel are closed.
-Note that when an instance is unable to consume the
-received data, he is permitted to send an OCLOSE
-before the matching IEOF is received.
diff --git a/crypto/openssh/nchan2.ms b/crypto/openssh/nchan2.ms
deleted file mode 100644
index 1cc51fa12b37..000000000000
--- a/crypto/openssh/nchan2.ms
+++ /dev/null
@@ -1,88 +0,0 @@
-.\"	$OpenBSD: nchan2.ms,v 1.2 2001/10/03 10:05:57 markus Exp $
-.\" 
-.\" Copyright (c) 2000 Markus Friedl.  All rights reserved.
-.\" 
-.\" Redistribution and use in source and binary forms, with or without
-.\" modification, are permitted provided that the following conditions
-.\" are met:
-.\" 1. Redistributions of source code must retain the above copyright
-.\"    notice, this list of conditions and the following disclaimer.
-.\" 2. Redistributions in binary form must reproduce the above copyright
-.\"    notice, this list of conditions and the following disclaimer in the
-.\"    documentation and/or other materials provided with the distribution.
-.\" 
-.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-.\"
-.TL
-OpenSSH Channel Close Protocol 2.0 Implementation
-.SH
-Channel Input State Diagram
-.PS
-reset
-l=1
-s=1.2
-ellipsewid=s*ellipsewid
-boxwid=s*boxwid
-ellipseht=s*ellipseht
-S1: ellipse "INPUT" "OPEN"
-move right 2*l from last ellipse.e
-S3: ellipse invis
-move down l from last ellipse.s
-S4: ellipse "INPUT" "CLOSED"
-move down l from 1st ellipse.s
-S2: ellipse "INPUT" "WAIT" "DRAIN"
-arrow from S1.e to S4.n
-box invis "rcvd CLOSE/" "shutdown_read" with .sw at last arrow.c
-arrow "ibuf_empty ||" "rcvd CLOSE/" "send EOF" "" from S2.e to S4.w
-arrow from S1.s to S2.n
-box invis "read_failed/" "shutdown_read" with .e at last arrow.c
-ellipse wid .9*ellipsewid ht .9*ellipseht at S4
-arrow "start" "" from S1.w+(-0.5,0) to S1.w
-.PE
-.SH
-Channel Output State Diagram
-.PS
-S1: ellipse "OUTPUT" "OPEN"
-move right 2*l from last ellipse.e
-S3: ellipse invis
-move down l from last ellipse.s
-S4: ellipse "OUTPUT" "CLOSED"
-move down l from 1st ellipse.s
-S2: ellipse "OUTPUT" "WAIT" "DRAIN"
-arrow from S1.e to S4.n
-box invis "write_failed/" "shutdown_write" with .sw at last arrow.c
-arrow "obuf_empty ||" "write_failed/" "shutdown_write" "" from S2.e to S4.w
-arrow from S1.s to S2.n
-box invis "rcvd EOF ||" "rcvd CLOSE/" "-" with .e at last arrow.c
-ellipse wid .9*ellipsewid ht .9*ellipseht at S4
-arrow "start" "" from S1.w+(-0.5,0) to S1.w
-.PE
-.SH
-Notes
-.PP
-The input buffer is filled with data from the socket
-(the socket represents the local consumer/producer of the
-forwarded channel).
-The data is then sent over the INPUT-end (transmit-end) of the channel to the
-remote peer.
-Data sent by the peer is received on the OUTPUT-end (receive-end),
-saved in the output buffer and written to the socket.
-.PP
-If the local protocol instance has forwarded all data on the
-INPUT-end of the channel, it sends an EOF message to the peer.
-.PP
-A CLOSE message is sent to the peer if
-both the INPUT- and the OUTOUT-half of the local
-end of the channel are closed.
-.PP
-The channel can be deallocated by a protocol instance
-if a CLOSE message he been both sent and received.
diff --git a/crypto/openssh/openbsd-compat/Makefile.in b/crypto/openssh/openbsd-compat/Makefile.in
deleted file mode 100644
index 8615e3633aa4..000000000000
--- a/crypto/openssh/openbsd-compat/Makefile.in
+++ /dev/null
@@ -1,42 +0,0 @@
-# $Id: Makefile.in,v 1.25 2003/02/24 01:55:56 djm Exp $
-
-sysconfdir=@sysconfdir@
-piddir=@piddir@
-srcdir=@srcdir@
-top_srcdir=@top_srcdir@
-
-VPATH=@srcdir@
-CC=@CC@
-LD=@LD@
-CFLAGS=@CFLAGS@
-CPPFLAGS=-I. -I.. -I$(srcdir) -I$(srcdir)/.. @CPPFLAGS@ @DEFS@
-LIBS=@LIBS@
-AR=@AR@
-RANLIB=@RANLIB@
-INSTALL=@INSTALL@
-LDFLAGS=-L. @LDFLAGS@
-
-OPENBSD=base64.o basename.o bindresvport.o daemon.o dirname.o getcwd.o getgrouplist.o getopt.o glob.o inet_aton.o inet_ntoa.o inet_ntop.o mktemp.o readpassphrase.o realpath.o rresvport.o setenv.o setproctitle.o sigact.o strlcat.o strlcpy.o strmode.o strsep.o vis.o
-
-COMPAT=bsd-arc4random.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o bsd-misc.o bsd-nextstep.o bsd-snprintf.o bsd-waitpid.o fake-getaddrinfo.o fake-getnameinfo.o xmmap.o
-
-PORTS=port-irix.o port-aix.o
-
-.c.o:
-	$(CC) $(CFLAGS) $(CPPFLAGS) -c $<
-
-all: libopenbsd-compat.a
-
-$(COMPAT): ../config.h
-$(OPENBSD): ../config.h
-$(PORTS): ../config.h
-
-libopenbsd-compat.a:  $(COMPAT) $(OPENBSD) $(PORTS)
-	$(AR) rv $@ $(COMPAT) $(OPENBSD) $(PORTS)
-	$(RANLIB) $@
-
-clean:
-	rm -f *.o *.a core 
-
-distclean: clean
-	rm -f Makefile *~
diff --git a/crypto/openssh/openbsd-compat/base64.c b/crypto/openssh/openbsd-compat/base64.c
deleted file mode 100644
index 91a5ab0ed824..000000000000
--- a/crypto/openssh/openbsd-compat/base64.c
+++ /dev/null
@@ -1,322 +0,0 @@
-/*	$OpenBSD: base64.c,v 1.4 2002/01/02 23:00:10 deraadt Exp $	*/
-
-/*
- * Copyright (c) 1996 by Internet Software Consortium.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
- * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
- * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
- * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
- * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
- * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
- * SOFTWARE.
- */
-
-/*
- * Portions Copyright (c) 1995 by International Business Machines, Inc.
- *
- * International Business Machines, Inc. (hereinafter called IBM) grants
- * permission under its copyrights to use, copy, modify, and distribute this
- * Software with or without fee, provided that the above copyright notice and
- * all paragraphs of this notice appear in all copies, and that the name of IBM
- * not be used in connection with the marketing of any product incorporating
- * the Software or modifications thereof, without specific, written prior
- * permission.
- *
- * To the extent it has a right to do so, IBM grants an immunity from suit
- * under its patents, if any, for the use, sale or manufacture of products to
- * the extent that such products are used for performing Domain Name System
- * dynamic updates in TCP/IP networks by means of the Software.  No immunity is
- * granted for any product per se or for any other function of any product.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", AND IBM DISCLAIMS ALL WARRANTIES,
- * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
- * PARTICULAR PURPOSE.  IN NO EVENT SHALL IBM BE LIABLE FOR ANY SPECIAL,
- * DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER ARISING
- * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE, EVEN
- * IF IBM IS APPRISED OF THE POSSIBILITY OF SUCH DAMAGES.
- */
-
-#include "includes.h"
-
-#if (!defined(HAVE_B64_NTOP) && !defined(HAVE___B64_NTOP)) || (!defined(HAVE_B64_PTON) && !defined(HAVE___B64_PTON))
-
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/socket.h>
-#include <netinet/in.h>
-#include <arpa/inet.h>
-
-#include <ctype.h>
-#include <stdio.h>
-
-#include <stdlib.h>
-#include <string.h>
-
-#include "base64.h"
-
-/* XXX abort illegal in library */
-#define Assert(Cond) if (!(Cond)) abort()
-
-static const char Base64[] =
-	"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
-static const char Pad64 = '=';
-
-/* (From RFC1521 and draft-ietf-dnssec-secext-03.txt)
-   The following encoding technique is taken from RFC 1521 by Borenstein
-   and Freed.  It is reproduced here in a slightly edited form for
-   convenience.
-
-   A 65-character subset of US-ASCII is used, enabling 6 bits to be
-   represented per printable character. (The extra 65th character, "=",
-   is used to signify a special processing function.)
-
-   The encoding process represents 24-bit groups of input bits as output
-   strings of 4 encoded characters. Proceeding from left to right, a
-   24-bit input group is formed by concatenating 3 8-bit input groups.
-   These 24 bits are then treated as 4 concatenated 6-bit groups, each
-   of which is translated into a single digit in the base64 alphabet.
-
-   Each 6-bit group is used as an index into an array of 64 printable
-   characters. The character referenced by the index is placed in the
-   output string.
-
-                         Table 1: The Base64 Alphabet
-
-      Value Encoding  Value Encoding  Value Encoding  Value Encoding
-          0 A            17 R            34 i            51 z
-          1 B            18 S            35 j            52 0
-          2 C            19 T            36 k            53 1
-          3 D            20 U            37 l            54 2
-          4 E            21 V            38 m            55 3
-          5 F            22 W            39 n            56 4
-          6 G            23 X            40 o            57 5
-          7 H            24 Y            41 p            58 6
-          8 I            25 Z            42 q            59 7
-          9 J            26 a            43 r            60 8
-         10 K            27 b            44 s            61 9
-         11 L            28 c            45 t            62 +
-         12 M            29 d            46 u            63 /
-         13 N            30 e            47 v
-         14 O            31 f            48 w         (pad) =
-         15 P            32 g            49 x
-         16 Q            33 h            50 y
-
-   Special processing is performed if fewer than 24 bits are available
-   at the end of the data being encoded.  A full encoding quantum is
-   always completed at the end of a quantity.  When fewer than 24 input
-   bits are available in an input group, zero bits are added (on the
-   right) to form an integral number of 6-bit groups.  Padding at the
-   end of the data is performed using the '=' character.
-
-   Since all base64 input is an integral number of octets, only the
-         -------------------------------------------------                       
-   following cases can arise:
-   
-       (1) the final quantum of encoding input is an integral
-           multiple of 24 bits; here, the final unit of encoded
-	   output will be an integral multiple of 4 characters
-	   with no "=" padding,
-       (2) the final quantum of encoding input is exactly 8 bits;
-           here, the final unit of encoded output will be two
-	   characters followed by two "=" padding characters, or
-       (3) the final quantum of encoding input is exactly 16 bits;
-           here, the final unit of encoded output will be three
-	   characters followed by one "=" padding character.
-   */
-
-#if !defined(HAVE_B64_NTOP) && !defined(HAVE___B64_NTOP) 
-int
-b64_ntop(u_char const *src, size_t srclength, char *target, size_t targsize)
-{
-	size_t datalength = 0;
-	u_char input[3];
-	u_char output[4];
-	int i;
-
-	while (2 < srclength) {
-		input[0] = *src++;
-		input[1] = *src++;
-		input[2] = *src++;
-		srclength -= 3;
-
-		output[0] = input[0] >> 2;
-		output[1] = ((input[0] & 0x03) << 4) + (input[1] >> 4);
-		output[2] = ((input[1] & 0x0f) << 2) + (input[2] >> 6);
-		output[3] = input[2] & 0x3f;
-		Assert(output[0] < 64);
-		Assert(output[1] < 64);
-		Assert(output[2] < 64);
-		Assert(output[3] < 64);
-
-		if (datalength + 4 > targsize)
-			return (-1);
-		target[datalength++] = Base64[output[0]];
-		target[datalength++] = Base64[output[1]];
-		target[datalength++] = Base64[output[2]];
-		target[datalength++] = Base64[output[3]];
-	}
-    
-	/* Now we worry about padding. */
-	if (0 != srclength) {
-		/* Get what's left. */
-		input[0] = input[1] = input[2] = '\0';
-		for (i = 0; i < srclength; i++)
-			input[i] = *src++;
-	
-		output[0] = input[0] >> 2;
-		output[1] = ((input[0] & 0x03) << 4) + (input[1] >> 4);
-		output[2] = ((input[1] & 0x0f) << 2) + (input[2] >> 6);
-		Assert(output[0] < 64);
-		Assert(output[1] < 64);
-		Assert(output[2] < 64);
-
-		if (datalength + 4 > targsize)
-			return (-1);
-		target[datalength++] = Base64[output[0]];
-		target[datalength++] = Base64[output[1]];
-		if (srclength == 1)
-			target[datalength++] = Pad64;
-		else
-			target[datalength++] = Base64[output[2]];
-		target[datalength++] = Pad64;
-	}
-	if (datalength >= targsize)
-		return (-1);
-	target[datalength] = '\0';	/* Returned value doesn't count \0. */
-	return (datalength);
-}
-#endif /* !defined(HAVE_B64_NTOP) && !defined(HAVE___B64_NTOP) */
-
-#if !defined(HAVE_B64_PTON) && !defined(HAVE___B64_PTON)
-
-/* skips all whitespace anywhere.
-   converts characters, four at a time, starting at (or after)
-   src from base - 64 numbers into three 8 bit bytes in the target area.
-   it returns the number of data bytes stored at the target, or -1 on error.
- */
-
-int
-b64_pton(char const *src, u_char *target, size_t targsize)
-{
-	int tarindex, state, ch;
-	char *pos;
-
-	state = 0;
-	tarindex = 0;
-
-	while ((ch = *src++) != '\0') {
-		if (isspace(ch))	/* Skip whitespace anywhere. */
-			continue;
-
-		if (ch == Pad64)
-			break;
-
-		pos = strchr(Base64, ch);
-		if (pos == 0) 		/* A non-base64 character. */
-			return (-1);
-
-		switch (state) {
-		case 0:
-			if (target) {
-				if (tarindex >= targsize)
-					return (-1);
-				target[tarindex] = (pos - Base64) << 2;
-			}
-			state = 1;
-			break;
-		case 1:
-			if (target) {
-				if (tarindex + 1 >= targsize)
-					return (-1);
-				target[tarindex]   |=  (pos - Base64) >> 4;
-				target[tarindex+1]  = ((pos - Base64) & 0x0f)
-							<< 4 ;
-			}
-			tarindex++;
-			state = 2;
-			break;
-		case 2:
-			if (target) {
-				if (tarindex + 1 >= targsize)
-					return (-1);
-				target[tarindex]   |=  (pos - Base64) >> 2;
-				target[tarindex+1]  = ((pos - Base64) & 0x03)
-							<< 6;
-			}
-			tarindex++;
-			state = 3;
-			break;
-		case 3:
-			if (target) {
-				if (tarindex >= targsize)
-					return (-1);
-				target[tarindex] |= (pos - Base64);
-			}
-			tarindex++;
-			state = 0;
-			break;
-		}
-	}
-
-	/*
-	 * We are done decoding Base-64 chars.  Let's see if we ended
-	 * on a byte boundary, and/or with erroneous trailing characters.
-	 */
-
-	if (ch == Pad64) {		/* We got a pad char. */
-		ch = *src++;		/* Skip it, get next. */
-		switch (state) {
-		case 0:		/* Invalid = in first position */
-		case 1:		/* Invalid = in second position */
-			return (-1);
-
-		case 2:		/* Valid, means one byte of info */
-			/* Skip any number of spaces. */
-			for (; ch != '\0'; ch = *src++)
-				if (!isspace(ch))
-					break;
-			/* Make sure there is another trailing = sign. */
-			if (ch != Pad64)
-				return (-1);
-			ch = *src++;		/* Skip the = */
-			/* Fall through to "single trailing =" case. */
-			/* FALLTHROUGH */
-
-		case 3:		/* Valid, means two bytes of info */
-			/*
-			 * We know this char is an =.  Is there anything but
-			 * whitespace after it?
-			 */
-			for (; ch != '\0'; ch = *src++)
-				if (!isspace(ch))
-					return (-1);
-
-			/*
-			 * Now make sure for cases 2 and 3 that the "extra"
-			 * bits that slopped past the last full byte were
-			 * zeros.  If we don't check them, they become a
-			 * subliminal channel.
-			 */
-			if (target && target[tarindex] != 0)
-				return (-1);
-		}
-	} else {
-		/*
-		 * We ended by seeing the end of the string.  Make sure we
-		 * have no partial bytes lying around.
-		 */
-		if (state != 0)
-			return (-1);
-	}
-
-	return (tarindex);
-}
-
-#endif /* !defined(HAVE_B64_PTON) && !defined(HAVE___B64_PTON) */
-#endif 
diff --git a/crypto/openssh/openbsd-compat/base64.h b/crypto/openssh/openbsd-compat/base64.h
deleted file mode 100644
index 72db3ffc7fca..000000000000
--- a/crypto/openssh/openbsd-compat/base64.h
+++ /dev/null
@@ -1,23 +0,0 @@
-/* $Id: base64.h,v 1.4 2003/02/24 04:45:43 djm Exp $ */
-
-#ifndef _BSD_BASE64_H
-#define _BSD_BASE64_H
-
-#include "config.h"
-
-#ifndef HAVE___B64_NTOP
-# ifndef HAVE_B64_NTOP
-int b64_ntop(u_char const *src, size_t srclength, char *target, 
-    size_t targsize);
-# endif /* !HAVE_B64_NTOP */
-# define __b64_ntop b64_ntop
-#endif /* HAVE___B64_NTOP */
-
-#ifndef HAVE___B64_PTON
-# ifndef HAVE_B64_PTON
-int b64_pton(char const *src, u_char *target, size_t targsize);
-# endif /* !HAVE_B64_PTON */
-# define __b64_pton b64_pton
-#endif /* HAVE___B64_PTON */
-
-#endif /* _BSD_BASE64_H */
diff --git a/crypto/openssh/openbsd-compat/basename.c b/crypto/openssh/openbsd-compat/basename.c
deleted file mode 100644
index 5a3823bc5153..000000000000
--- a/crypto/openssh/openbsd-compat/basename.c
+++ /dev/null
@@ -1,73 +0,0 @@
-/*	$OpenBSD: basename.c,v 1.8 2002/06/09 05:03:59 deraadt Exp $	*/
-
-/*
- * Copyright (c) 1997 Todd C. Miller <Todd.Miller@courtesan.com>
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. The name of the author may not be used to endorse or promote products
- *    derived from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
- * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL
- * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
- * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
- * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
- * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
- * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#include "includes.h"
-
-#if !defined(HAVE_BASENAME)
-
-#ifndef lint
-static char rcsid[] = "$OpenBSD: basename.c,v 1.8 2002/06/09 05:03:59 deraadt Exp $";
-#endif /* not lint */
-
-char *
-basename(const char *path)
-{
-	static char bname[MAXPATHLEN];
-	register const char *endp, *startp;
-
-	/* Empty or NULL string gets treated as "." */
-	if (path == NULL || *path == '\0') {
-		(void)strlcpy(bname, ".", sizeof bname);
-		return(bname);
-	}
-
-	/* Strip trailing slashes */
-	endp = path + strlen(path) - 1;
-	while (endp > path && *endp == '/')
-		endp--;
-
-	/* All slashes become "/" */
-	if (endp == path && *endp == '/') {
-		(void)strlcpy(bname, "/", sizeof bname);
-		return(bname);
-	}
-
-	/* Find the start of the base */
-	startp = endp;
-	while (startp > path && *(startp - 1) != '/')
-		startp--;
-
-	if (endp - startp + 2 > sizeof(bname)) {
-		errno = ENAMETOOLONG;
-		return(NULL);
-	}
-	strlcpy(bname, startp, endp - startp + 2);
-	return(bname);
-}
-
-#endif /* !defined(HAVE_BASENAME) */
diff --git a/crypto/openssh/openbsd-compat/basename.h b/crypto/openssh/openbsd-compat/basename.h
deleted file mode 100644
index a8bd6c17c708..000000000000
--- a/crypto/openssh/openbsd-compat/basename.h
+++ /dev/null
@@ -1,12 +0,0 @@
-/* $Id: basename.h,v 1.3 2003/02/25 03:32:16 djm Exp $ */
-
-#ifndef _BASENAME_H 
-#define _BASENAME_H
-#include "config.h"
-
-#if !defined(HAVE_BASENAME)
-
-char *basename(const char *path);
-
-#endif /* !defined(HAVE_BASENAME) */
-#endif /* _BASENAME_H */
diff --git a/crypto/openssh/openbsd-compat/bindresvport.c b/crypto/openssh/openbsd-compat/bindresvport.c
deleted file mode 100644
index 620f980ed110..000000000000
--- a/crypto/openssh/openbsd-compat/bindresvport.c
+++ /dev/null
@@ -1,123 +0,0 @@
-/* This file has be modified from the original OpenBSD source */
-
-/*
- * Sun RPC is a product of Sun Microsystems, Inc. and is provided for
- * unrestricted use provided that this legend is included on all tape
- * media and as a part of the software program in whole or part.  Users
- * may copy or modify Sun RPC without charge, but are not authorized
- * to license or distribute it to anyone else except as part of a product or
- * program developed by the user.
- * 
- * SUN RPC IS PROVIDED AS IS WITH NO WARRANTIES OF ANY KIND INCLUDING THE
- * WARRANTIES OF DESIGN, MERCHANTIBILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE, OR ARISING FROM A COURSE OF DEALING, USAGE OR TRADE PRACTICE.
- * 
- * Sun RPC is provided with no support and without any obligation on the
- * part of Sun Microsystems, Inc. to assist in its use, correction,
- * modification or enhancement.
- * 
- * SUN MICROSYSTEMS, INC. SHALL HAVE NO LIABILITY WITH RESPECT TO THE
- * INFRINGEMENT OF COPYRIGHTS, TRADE SECRETS OR ANY PATENTS BY SUN RPC
- * OR ANY PART THEREOF.
- * 
- * In no event will Sun Microsystems, Inc. be liable for any lost revenue
- * or profits or other special, indirect and consequential damages, even if
- * Sun has been advised of the possibility of such damages.
- * 
- * Sun Microsystems, Inc.
- * 2550 Garcia Avenue
- * Mountain View, California  94043
- */
-
-#include "includes.h"
-
-#ifndef HAVE_BINDRESVPORT_SA
-
-#if defined(LIBC_SCCS) && !defined(lint)
-static char *rcsid = "$OpenBSD: bindresvport.c,v 1.13 2000/01/26 03:43:21 deraadt Exp $";
-#endif /* LIBC_SCCS and not lint */
-
-/*
- * Copyright (c) 1987 by Sun Microsystems, Inc.
- *
- * Portions Copyright(C) 1996, Jason Downs.  All rights reserved.
- */
-
-#include "includes.h"
-
-#define STARTPORT 600
-#define ENDPORT (IPPORT_RESERVED - 1)
-#define NPORTS	(ENDPORT - STARTPORT + 1)
-
-/*
- * Bind a socket to a privileged IP port
- */
-int
-bindresvport_sa(sd, sa)
-	int sd;
-	struct sockaddr *sa;
-{
-	int error, af;
-	struct sockaddr_storage myaddr;
-	struct sockaddr_in *sin;
-	struct sockaddr_in6 *sin6;
-	u_int16_t *portp;
-	u_int16_t port;
-	socklen_t salen;
-	int i;
-
-	if (sa == NULL) {
-		memset(&myaddr, 0, sizeof(myaddr));
-		sa = (struct sockaddr *)&myaddr;
-
-		if (getsockname(sd, sa, &salen) == -1)
-			return -1;	/* errno is correctly set */
-
-		af = sa->sa_family;
-		memset(&myaddr, 0, salen);
-	} else
-		af = sa->sa_family;
-
-	if (af == AF_INET) {
-		sin = (struct sockaddr_in *)sa;
-		salen = sizeof(struct sockaddr_in);
-		portp = &sin->sin_port;
-	} else if (af == AF_INET6) {
-		sin6 = (struct sockaddr_in6 *)sa;
-		salen = sizeof(struct sockaddr_in6);
-		portp = &sin6->sin6_port;
-	} else {
-		errno = EPFNOSUPPORT;
-		return (-1);
-	}
-	sa->sa_family = af;
-
-	port = ntohs(*portp);
-	if (port == 0)
-		port = (arc4random() % NPORTS) + STARTPORT;
-
-	/* Avoid warning */
-	error = -1;
-
-	for(i = 0; i < NPORTS; i++) {
-		*portp = htons(port);
-		
-		error = bind(sd, sa, salen);
-
-		/* Terminate on success */
-		if (error == 0)
-			break;
-			
-		/* Terminate on errors, except "address already in use" */
-		if ((error < 0) && !((errno == EADDRINUSE) || (errno == EINVAL)))
-			break;
-			
-		port++;
-		if (port > ENDPORT)
-			port = STARTPORT;
-	}
-
-	return (error);
-}
-
-#endif /* HAVE_BINDRESVPORT_SA */
diff --git a/crypto/openssh/openbsd-compat/bindresvport.h b/crypto/openssh/openbsd-compat/bindresvport.h
deleted file mode 100644
index b42f469838f0..000000000000
--- a/crypto/openssh/openbsd-compat/bindresvport.h
+++ /dev/null
@@ -1,12 +0,0 @@
-/* $Id: bindresvport.h,v 1.2 2001/02/09 01:55:36 djm Exp $ */
-
-#ifndef _BSD_BINDRESVPORT_H
-#define _BSD_BINDRESVPORT_H
-
-#include "config.h"
-
-#ifndef HAVE_BINDRESVPORT_SA
-int bindresvport_sa(int sd, struct sockaddr *sa);
-#endif /* !HAVE_BINDRESVPORT_SA */
-
-#endif /* _BSD_BINDRESVPORT_H */
diff --git a/crypto/openssh/openbsd-compat/bsd-arc4random.c b/crypto/openssh/openbsd-compat/bsd-arc4random.c
deleted file mode 100644
index dd08130d586e..000000000000
--- a/crypto/openssh/openbsd-compat/bsd-arc4random.c
+++ /dev/null
@@ -1,77 +0,0 @@
-/*
- * Copyright (c) 1999-2000 Damien Miller.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-#include "log.h"
-
-RCSID("$Id: bsd-arc4random.c,v 1.6 2003/03/17 05:13:53 djm Exp $");
-
-#ifndef HAVE_ARC4RANDOM
-
-#include <openssl/rand.h>
-#include <openssl/rc4.h>
-#include <openssl/err.h>
-
-/* Size of key to use */
-#define SEED_SIZE 20
-
-/* Number of bytes to reseed after */
-#define REKEY_BYTES	(1 << 24)
-
-static int rc4_ready = 0;
-static RC4_KEY rc4;
-
-unsigned int arc4random(void)
-{
-	unsigned int r = 0;
-	static int first_time = 1;
-
-	if (rc4_ready <= 0) {
-		if (first_time)
-			seed_rng();
-		first_time = 0;
-		arc4random_stir();
-	}
-
-	RC4(&rc4, sizeof(r), (unsigned char *)&r, (unsigned char *)&r);
-
-	rc4_ready -= sizeof(r);
-	
-	return(r);
-}
-
-void arc4random_stir(void)
-{
-	unsigned char rand_buf[SEED_SIZE];
-
-	memset(&rc4, 0, sizeof(rc4));
-	if (RAND_bytes(rand_buf, sizeof(rand_buf)) <= 0)
-		fatal("Couldn't obtain random bytes (error %ld)",
-		    ERR_get_error());
-	RC4_set_key(&rc4, sizeof(rand_buf), rand_buf);
-	memset(rand_buf, 0, sizeof(rand_buf));
-
-	rc4_ready = REKEY_BYTES;
-}
-#endif /* !HAVE_ARC4RANDOM */
diff --git a/crypto/openssh/openbsd-compat/bsd-arc4random.h b/crypto/openssh/openbsd-compat/bsd-arc4random.h
deleted file mode 100644
index 7af757b2d487..000000000000
--- a/crypto/openssh/openbsd-compat/bsd-arc4random.h
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * Copyright (c) 1999-2000 Damien Miller.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/* $Id: bsd-arc4random.h,v 1.2 2001/02/09 01:55:36 djm Exp $ */
-
-#ifndef _BSD_ARC4RANDOM_H
-#define _BSD_ARC4RANDOM_H
-
-#include "config.h"
-
-#ifndef HAVE_ARC4RANDOM
-unsigned int arc4random(void);
-void arc4random_stir(void);
-#endif /* !HAVE_ARC4RANDOM */
-
-#endif /* _BSD_ARC4RANDOM_H */
diff --git a/crypto/openssh/openbsd-compat/bsd-cray.c b/crypto/openssh/openbsd-compat/bsd-cray.c
deleted file mode 100644
index edb3112b3c76..000000000000
--- a/crypto/openssh/openbsd-compat/bsd-cray.c
+++ /dev/null
@@ -1,797 +0,0 @@
-/* 
- * $Id: bsd-cray.c,v 1.8 2002/09/26 00:38:51 tim Exp $
- *
- * bsd-cray.c
- *
- * Copyright (c) 2002, Cray Inc.  (Wendy Palm <wendyp@cray.com>)
- * Significant portions provided by 
- *          Wayne Schroeder, SDSC <schroeder@sdsc.edu>
- *          William Jones, UTexas <jones@tacc.utexas.edu>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- * Created: Apr 22 16.34:00 2002 wp
- *
- * This file contains functions required for proper execution
- * on UNICOS systems.
- *
- */
-#ifdef _UNICOS
-
-#include <udb.h>
-#include <tmpdir.h>
-#include <unistd.h>
-#include <sys/category.h>
-#include <utmp.h>
-#include <sys/jtab.h>
-#include <signal.h>
-#include <sys/priv.h>
-#include <sys/secparm.h>
-#include <sys/tfm.h>
-#include <sys/usrv.h>
-#include <sys/sysv.h>
-#include <sys/sectab.h>
-#include <sys/secstat.h>
-#include <sys/stat.h>
-#include <sys/session.h>
-#include <stdlib.h>
-#include <pwd.h>
-#include <fcntl.h>
-#include <errno.h>
-#include <ia.h>
-#include <urm.h>
-#include "ssh.h"
-#include "log.h"
-#include "servconf.h"
-#include "bsd-cray.h"
-
-#define MAXACID 80
-
-extern ServerOptions options;
-
-char cray_tmpdir[TPATHSIZ+1];		    /* job TMPDIR path */
-
-struct		sysv sysv;	/* system security structure */
-struct		usrv usrv;      /* user   security structure */
-
-/*
- * Functions.
- */
-void cray_retain_utmp(struct utmp *, int);
-void cray_delete_tmpdir(char *, int, uid_t);
-void cray_init_job(struct passwd *);
-void cray_set_tmpdir(struct utmp *);
-void cray_login_failure(char *, int);
-int cray_setup(uid_t, char *, const char *);
-int cray_access_denied(char *);
-
-void
-cray_login_failure(char *username, int errcode)
-{
-	struct udb	*ueptr;		/* UDB pointer for username */
-	ia_failure_t	fsent;		/* ia_failure structure */
-	ia_failure_ret_t fret;		/* ia_failure return stuff */
-	struct jtab	jtab;		/* job table structure */
-	int		jid = 0;	/* job id */
-
-	if ((jid = getjtab(&jtab)) < 0) {
-		debug("cray_login_failure(): getjtab error");
-	}
-	getsysudb();
-	if ((ueptr = getudbnam(username)) == UDB_NULL) {
-		debug("cray_login_failure(): getudbname() returned NULL");
-	}
-	endudb();
-	fsent.revision	= 0;
-	fsent.uname	= username;
-	fsent.host	= (char *)get_canonical_hostname(options.verify_reverse_mapping);
-	fsent.ttyn	= "sshd";
-	fsent.caller	= IA_SSHD;
-	fsent.flags	= IA_INTERACTIVE;
-	fsent.ueptr	= ueptr;
-	fsent.jid	= jid;
-	fsent.errcode	= errcode;
-	fsent.pwdp	= NULL;
-	fsent.exitcode	= 0;	/* dont exit in ia_failure() */
-
-	fret.revision	= 0;
-	fret.normal	= 0;
-
-	/*
-	 * Call ia_failure because of an login failure.
-	 */
-	ia_failure(&fsent,&fret);
-}
-
-/*
- *  Cray access denied
- */
-int
-cray_access_denied(char *username)
-{
-	struct udb	*ueptr;		/* UDB pointer for username */
-	int 		errcode;	/* IA errorcode */
-
-	errcode = 0;
-	getsysudb();
-	if ((ueptr = getudbnam(username)) == UDB_NULL) {
-		debug("cray_login_failure(): getudbname() returned NULL");
-	}
-	endudb();
-	if (ueptr && ueptr->ue_disabled)
-		errcode = IA_DISABLED;
-	if (errcode)
-		cray_login_failure(username, errcode);
-	return (errcode);
-}
-
-int
-cray_setup (uid_t uid, char *username, const char *command)
-{
-	extern struct udb *getudb();
-	extern char *setlimits();
-
-	int err;                      /* error return */
-	time_t		system_time;	/* current system clock */
-	time_t		expiration_time; /* password expiration time */
-	int		maxattempts;	/* maximum no. of failed login attempts */
-	int		SecureSys;	/* unicos security flag */
-	int		minslevel = 0;	/* system minimum security level */
-	int		i, j;
-	int		valid_acct = -1; /* flag for reading valid acct */
-	char acct_name[MAXACID]  = { "" }; /* used to read acct name */
-	struct		jtab jtab;	/* Job table struct */
-	struct		udb ue;		/* udb entry for logging-in user */
-	struct		udb *up;	/* pointer to UDB entry */
-	struct		secstat secinfo; /* file  security attributes */
-	struct          servprov init_info; /* used for sesscntl() call */
-	int		jid;		/* job ID */
-	int		pid;		/* process ID */
-	char		*sr;            /* status return from setlimits() */
-	char		*ttyn = NULL;	/* ttyname or command name*/
-	char		hostname[MAXHOSTNAMELEN];
-	passwd_t	pwdacm,
-			pwddialup,
-			pwdudb,
-			pwdwal,
-			pwddce;		/* passwd stuff for ia_user */
-	ia_user_ret_t	uret;		/* stuff returned from ia_user */
-	ia_user_t	usent;		/* ia_user main structure */
-	int		ia_rcode;	/* ia_user return code */
-	ia_failure_t	fsent;		/* ia_failure structure */
-	ia_failure_ret_t fret;		/* ia_failure return stuff */
-	ia_success_t	ssent;		/* ia_success structure */
-	ia_success_ret_t sret;		/* ia_success return stuff */
-	int		ia_mlsrcode;    /* ia_mlsuser return code */
-	int		secstatrc;      /* [f]secstat return code */
-
-	if (SecureSys = (int)sysconf(_SC_CRAY_SECURE_SYS)) {
-		getsysv(&sysv, sizeof(struct sysv));
-		minslevel = sysv.sy_minlvl;
-		if (getusrv(&usrv) < 0) {
-			debug("getusrv() failed, errno = %d",errno);
-			exit(1);
-		}
-	}
-	hostname[0] = '\0';
-	strncpy(hostname,
-	   (char *)get_canonical_hostname(options.verify_reverse_mapping),
-	   MAXHOSTNAMELEN);
-        /*
-         *  Fetch user's UDB entry.
-         */
-        getsysudb();
-        if ((up = getudbnam(username)) == UDB_NULL) {
-                debug("cannot fetch user's UDB entry");
-                exit(1);
-        }
-
-        /*
-         *  Prevent any possible fudging so perform a data
-         *  safety check and compare the supplied uid against
-         *  the udb's uid.
-         */
-        if (up->ue_uid != uid) {
-                debug("IA uid missmatch");
-                exit(1);
-        }
-	endudb();
-
-	if ((jid = getjtab (&jtab)) < 0) {
-		debug("getjtab");
-		return -1;
-	}
-	pid = getpid();
-	ttyn = ttyname(0);
-	if (SecureSys) {
-		if (ttyn) {
-			secstatrc = secstat(ttyn, &secinfo);
-		} else {
-			secstatrc = fsecstat(1, &secinfo);
-		}
-		if (secstatrc == 0) {
-			debug("[f]secstat() successful");
-		} else {
-			debug("[f]secstat() error, rc = %d", secstatrc);
-			exit(1);
-		}
-	}
-	if ((ttyn == NULL) && ((char *)command != NULL))
-		ttyn = (char *)command;
-        /*
-         *  Initialize all structures to call ia_user
-         */
-        usent.revision = 0;
-        usent.uname    = username;
-        usent.host     = hostname;
-        usent.ttyn     = ttyn;
-        usent.caller   = IA_SSHD; 
-        usent.pswdlist = &pwdacm;
-        usent.ueptr    = &ue;
-        usent.flags    = IA_INTERACTIVE | IA_FFLAG;
-        pwdacm.atype   = IA_SECURID;
-        pwdacm.pwdp    = NULL;
-        pwdacm.next    = &pwdudb;
-
-        pwdudb.atype   = IA_UDB;
-        pwdudb.pwdp    = NULL;
-        pwdudb.next    = &pwddce;
-
-        pwddce.atype   = IA_DCE;
-        pwddce.pwdp    = NULL;
-        pwddce.next    = &pwddialup;
-
-        pwddialup.atype = IA_DIALUP;
-        pwddialup.pwdp  = NULL;
-        /* pwddialup.next  = &pwdwal; */
-        pwddialup.next  = NULL;
-
-        pwdwal.atype = IA_WAL;
-        pwdwal.pwdp  = NULL;
-        pwdwal.next  = NULL;
-
-        uret.revision = 0;
-        uret.pswd     = NULL;
-        uret.normal   = 0;
-
-        ia_rcode = ia_user(&usent, &uret);
-
-        switch (ia_rcode) {
-                /*
-                 *  These are acceptable return codes from ia_user()
-                 */
-                case IA_UDBWEEK:        /* Password Expires in 1 week */
-		     expiration_time = ue.ue_pwage.time + ue.ue_pwage.maxage;
-		     printf ("WARNING - your current password will expire %s\n",
-                     ctime((const time_t *)&expiration_time));
-                     break;
-                case IA_UDBEXPIRED:
-		     if (ttyname(0) != NULL) {
-		     /* Force a password change */
-		         printf("Your password has expired; Choose a new one.\n");
-		         execl("/bin/passwd", "passwd", username, 0);
-		         exit(9);
-		     }
-
-		     break;
-                case IA_NORMAL:         /* Normal Return Code */
-                     break;
-                case IA_BACKDOOR:
-                     strcpy(ue.ue_name, "root");
-                     strcpy(ue.ue_passwd, "");
-                     strcpy(ue.ue_dir, "/");
-                     strcpy(ue.ue_shell, "/bin/sh");
-                     strcpy(ue.ue_age, "");
-                     strcpy(ue.ue_comment, "");
-                     strcpy(ue.ue_loghost, "");
-                     strcpy(ue.ue_logline, "");
-                     ue.ue_uid=-1;
-                     ue.ue_nice[UDBRC_INTER]=0;
-                     for (i=0;i<MAXVIDS;i++)
-                         ue.ue_gids[i]=0;
-                     ue.ue_logfails=0;
-                     ue.ue_minlvl=minslevel; 
-                     ue.ue_maxlvl=minslevel;
-                     ue.ue_deflvl=minslevel;
-                     ue.ue_defcomps=0;
-                     ue.ue_comparts=0;
-                     ue.ue_permits=0;
-                     ue.ue_trap=0;
-                     ue.ue_disabled=0;
-                     ue.ue_logtime=0;
-                     break;
-                case IA_CONSOLE:        /* Superuser not from Console */
-		case IA_TRUSTED:	/* Trusted user */
-		     if (options.permit_root_login > PERMIT_NO)
-                     	break;		/* Accept root login */
-   	        default:
-                /*
-                 *  These are failed return codes from ia_user()
-                 */
-		     switch (ia_rcode) 
-		       {
-		       case IA_BADAUTH:
-			 printf ("Bad authorization, access denied.\n");
-			 break;
-		       case IA_DIALUPERR:
-			 break;
-		       case IA_DISABLED:
-			 printf ("Your login has been disabled. Contact the system ");
-			 printf ("administrator for assistance.\n");
-			 break;
-		       case IA_GETSYSV:
-			 printf ("getsysv() failed - errno = %d\n", errno);
-			 break;
-		       case IA_LOCALHOST:
-			 break;
-		       case IA_MAXLOGS:
-			 printf ("Maximum number of failed login attempts exceeded.\n");
-			 printf ("Access denied.\n");
-			 break;
-		       case IA_NOPASS:
-			 break;
-		       case IA_PUBLIC:
-			 break;
-		       case IA_SECURIDERR:
-			 break;
-		       case IA_CONSOLE:
-			 break;
-		       case IA_TRUSTED:
-			 break;
-		       case IA_UDBERR:
-			 break;
-		       case IA_UDBPWDNULL:
-			 /* 
-			  * NULL password not allowed on MLS systems
-			  */
-			 if (SecureSys) {
-			   printf("NULL Password not allowed on MLS systems.\n");
-			 }
-			 break;
-		       case IA_UNKNOWN:
-			 break;
-		       case IA_UNKNOWNYP:
-			 break;
-		       case IA_WALERR:
-			 break;
-		       default:
-			 /* nothing special */
-			 ;
-		       }   /* 2. switch  (ia_rcode) */
-		     /*
-		      *  Authentication failed.
-		      */
-		     printf("sshd: Login incorrect, (0%o)\n",
-			    ia_rcode-IA_ERRORCODE);
-		     
-		     /*
-		      *  Initialize structure for ia_failure
-		      *  which will exit.
-		      */
-		     fsent.revision = 0;
-		     fsent.uname    = username;
-		     fsent.host     = hostname;
-		     fsent.ttyn     = ttyn;
-		     fsent.caller   = IA_SSHD;
-		     fsent.flags    = IA_INTERACTIVE;
-		     fsent.ueptr    = &ue;
-		     fsent.jid      = jid;
-		     fsent.errcode  = ia_rcode;
-		     fsent.pwdp     = uret.pswd;
-		     fsent.exitcode = 1;
-		     
-		     fret.revision  = 0;
-		     fret.normal    = 0;
-		     
-		     /*
-		      *  Call ia_failure because of an IA failure.
-		      *  There is no return because ia_failure exits.
-		      */
-	
-		     ia_failure(&fsent,&fret);
-
-		     exit(1); 
-	}   /* 1. switch  (ia_rcode) */
-	ia_mlsrcode = IA_NORMAL;
-	if (SecureSys) {
-		debug("calling ia_mlsuser()");
-		ia_mlsrcode = ia_mlsuser (&ue, &secinfo, &usrv, NULL, 0);
-	}
-	if (ia_mlsrcode != IA_NORMAL) {
-		printf("sshd: Login incorrect, (0%o)\n",
-		ia_mlsrcode-IA_ERRORCODE);
-		/*
- 		 *  Initialize structure for ia_failure
- 		 *  which will exit.
-		*/
-		fsent.revision = 0;
-		fsent.uname    = username;
-		fsent.host     = hostname;
-		fsent.ttyn     = ttyn;
-		fsent.caller   = IA_SSHD;
-		fsent.flags    = IA_INTERACTIVE;
-		fsent.ueptr    = &ue;
-		fsent.jid      = jid;
-		fsent.errcode  = ia_mlsrcode;
-		fsent.pwdp     = uret.pswd;
-		fsent.exitcode = 1;
-		fret.revision  = 0;
-		fret.normal    = 0;
-
-		/*
-		*  Call ia_failure because of an IA failure.
-		*  There is no return because ia_failure exits.
-		*/
-		ia_failure(&fsent,&fret);
-		exit(1); 
-	}
-
-        /* Provide login status information */
-        if (options.print_lastlog && ue.ue_logtime != 0) {
-            printf("Last successful login was : %.*s ",
-                    19, (char *)ctime(&ue.ue_logtime));
-  
-           if (*ue.ue_loghost != '\0')
-                printf("from %.*s\n", sizeof(ue.ue_loghost), ue.ue_loghost);
- 
-            else printf("on %.*s\n", sizeof(ue.ue_logline), ue.ue_logline);
- 
-            if ( SecureSys && (ue.ue_logfails != 0)) 
-                printf("  followed by %d failed attempts\n", ue.ue_logfails);
-        }
-
-	
-	/*
-	 * Call ia_success to process successful I/A.
-	 */
-	ssent.revision = 0;
-	ssent.uname = username;
-	ssent.host = hostname;
-	ssent.ttyn = ttyn;
-	ssent.caller = IA_SSHD;
-	ssent.flags = IA_INTERACTIVE;
-	ssent.ueptr = &ue;
-	ssent.jid = jid;
-	ssent.errcode = ia_rcode;
-	ssent.us = NULL;
-	ssent.time = 1;      		 /* Set ue_logtime */
-
-	sret.revision = 0;
-	sret.normal = 0;
-
-	ia_success(&ssent,&sret);
-
-        /*
-         * Query for account, iff > 1 valid acid & askacid permbit
-         */
-        if (((ue.ue_permbits & PERMBITS_ACCTID) ||
-             (ue.ue_acids[0] >= 0) && (ue.ue_acids[1] >= 0)) &&
-            ue.ue_permbits & PERMBITS_ASKACID) {
-		if (ttyname(0) != NULL) {
-		  debug("cray_setup: ttyname true case, %.100s", ttyname);
-                  while (valid_acct == -1) {
-                        printf("Account (? for available accounts)"
-                               " [%s]: ", acid2nam(ue.ue_acids[0]));
-                        gets(acct_name);
-                        switch (acct_name[0]) {
-                        case EOF:
-                                exit(0);
-                                break;
-                        case '\0':
-                                valid_acct = ue.ue_acids[0];
-                                strcpy(acct_name, acid2nam(valid_acct));
-                                break;
-                        case '?':
-                                /* Print the list 3 wide */
-                                for (i = 0, j = 0; i < MAXVIDS; i++) {
-                                        if (ue.ue_acids[i] == -1) {
-                                                printf("\n");
-                                                break;
-                                        }
-                                        if (++j == 4) {
-                                                j = 1;
-                                                printf("\n");
-                                        }
-                                        printf(" %s",
-                                               acid2nam(ue.ue_acids[i]));
-                                }
-                                if (ue.ue_permbits & PERMBITS_ACCTID)
-                                        printf("\"acctid\" permbit also allows"
-                                               " you to select any valid "
-                                               "account name.\n");
-                                printf("\n");
-                                break;
-                        default:
-                                if ((valid_acct = nam2acid(acct_name)) == -1)                                        printf("Account id not found for"
-                                               " account name \"%s\"\n\n",
-                                               acct_name);
-                                break;
-                        }
-                        /*
-                         * If an account was given, search the user's
-                         * acids array to verify they can use this account.
-                         */
-                        if ((valid_acct != -1) &&
-                            !(ue.ue_permbits & PERMBITS_ACCTID)) {
-                                for (i = 0; i < MAXVIDS; i++) {
-                                        if (ue.ue_acids[i] == -1)
-                                                break;
-                                        if (valid_acct == ue.ue_acids[i])
-                                                break;
-                                }
-                                if (i == MAXVIDS ||
-                                    ue.ue_acids[i] == -1) {
-                                        fprintf(stderr, "Cannot set"
-                                                " account name to "
-                                                "\"%s\", permission "
-                                                "denied\n\n", acct_name);
-                                        valid_acct = -1;
-                                }
-                        }
-                  }
-		} else {
-			/*
-			 * The client isn't connected to a terminal and can't
-			 * respond to an acid prompt.  Use default acid.
-			 */
-			debug("cray_setup: ttyname false case, %.100s", ttyname);
-			valid_acct = ue.ue_acids[0];
-		}
-        } else {
-                /*
-                 * The user doesn't have the askacid permbit set or
-                 * only has one valid account to use.
-                 */
-                valid_acct = ue.ue_acids[0];
-        }
-        if (acctid(0, valid_acct) < 0) {
-                printf ("Bad account id: %d\n", valid_acct);
-                exit(1);
-        }
-
-/* set up shares and quotas */
-/* Now set shares, quotas, limits, including CPU time for the (interactive) 
- * job and process, and set up permissions (for chown etc), etc.
- */
-	if (setshares(ue.ue_uid, valid_acct, printf, 0, 0)) {
-		printf("Unable to give %d shares to <%s>(%d/%d)\n", ue.ue_shares, ue.ue_name, ue.ue_uid, valid_acct);
-		exit(1);
-        }
-
-	sr = setlimits(username, C_PROC, pid, UDBRC_INTER);
-	if (sr != NULL) {
-		debug("%.200s", sr);
-		exit(1);
-	}
-	sr = setlimits(username, C_JOB, jid, UDBRC_INTER);
-	if (sr != NULL) {
-		debug("%.200s", sr);
-		exit(1);
-	}
-	/*
- 	 * Place the service provider information into
-	 * the session table (Unicos) or job table (Unicos/mk).
-	 * There exist double defines for the job/session table in
-	 * unicos/mk (jtab.h) so no need for a compile time switch.
-	 */
-	bzero((char *)&init_info, sizeof(struct servprov));
-	init_info.s_sessinit.si_id  = URM_SPT_LOGIN;
-	init_info.s_sessinit.si_pid = getpid();
-	init_info.s_sessinit.si_sid = jid;
-	init_info.s_routing.seqno = 0;
-	init_info.s_routing.iadrs = 0;
-	sesscntl(0, S_SETSERVPO, (int)&init_info);
-
-	/*
-	 * Set user and controlling tty security attributes.
-	 */
-	if (SecureSys) {
-		if (setusrv(&usrv) == -1) {
-			debug("setusrv() failed, errno = %d",errno);
-			exit(1);
-		}
-	}
-
-        return(0);
-}
-
-/*
- * The rc.* and /etc/sdaemon methods of starting a program on unicos/unicosmk
- * can have pal privileges that sshd can inherit which
- * could allow a user to su to root with out a password.
- * This subroutine clears all privileges.
- */
-void
-drop_cray_privs()
-{
-#if defined(_SC_CRAY_PRIV_SU)
-	priv_proc_t*		  privstate;
-	int			  result;
-	extern	    int		  priv_set_proc();
-	extern	    priv_proc_t*  priv_init_proc();
-
-	/*
-	 * If ether of theses two flags are not set
-	 * then don't allow this version of ssh to run.
-	 */
-	if (!sysconf(_SC_CRAY_PRIV_SU))
-		fatal("Not PRIV_SU system.");
-	if (!sysconf(_SC_CRAY_POSIX_PRIV))
-		fatal("Not POSIX_PRIV.");
-
-	debug("Setting MLS labels.");;
-
-	if (sysconf(_SC_CRAY_SECURE_MAC)) {
-		usrv.sv_minlvl = SYSLOW;
-		usrv.sv_actlvl = SYSHIGH;
-		usrv.sv_maxlvl = SYSHIGH;
-	} else {
-		usrv.sv_minlvl = sysv.sy_minlvl;
-		usrv.sv_actlvl = sysv.sy_minlvl;
-		usrv.sv_maxlvl = sysv.sy_maxlvl;
-	}       
-	usrv.sv_actcmp = 0;
-	usrv.sv_valcmp = sysv.sy_valcmp;
-
-	usrv.sv_intcat = TFM_SYSTEM;
-	usrv.sv_valcat |= (TFM_SYSTEM | TFM_SYSFILE);
-
-	if (setusrv(&usrv) < 0)
-		fatal("%s(%d): setusrv(): %s", __FILE__, __LINE__,
-		    strerror(errno));
-
-	if ((privstate = priv_init_proc()) != NULL) {
-		result = priv_set_proc(privstate);
-		if (result != 0 )
-			fatal("%s(%d): priv_set_proc(): %s",
-			    __FILE__, __LINE__, strerror(errno));
-		priv_free_proc(privstate);
-	}
-	debug ("Privileges should be cleared...");
-#else
-	/* XXX: do this differently */
-#	error Cray systems must be run with _SC_CRAY_PRIV_SU on!
-#endif
-}
-
-
-/*
- *  Retain utmp/wtmp information - used by cray accounting.
- */
-void
-cray_retain_utmp(struct utmp *ut, int pid)
-{
-	int fd;
-	struct utmp utmp;
-
-	if ((fd = open(UTMP_FILE, O_RDONLY)) != -1) {
-		while (read(fd, (char *)&utmp, sizeof(utmp)) == sizeof(utmp)) {
-			if (pid == utmp.ut_pid) {
-				ut->ut_jid = utmp.ut_jid;
-				strncpy(ut->ut_tpath, utmp.ut_tpath, sizeof(utmp.ut_tpath));
-				strncpy(ut->ut_host, utmp.ut_host, sizeof(utmp.ut_host));
-				strncpy(ut->ut_name, utmp.ut_name, sizeof(utmp.ut_name));
-				break;
-			}
-		}
-		close(fd);
-	}
-	else
-	fatal("Unable to open utmp file");
-}
-
-/*
- * tmpdir support.
- */
-
-/*
- * find and delete jobs tmpdir.
- */
-void
-cray_delete_tmpdir(char *login, int jid, uid_t uid)
-{
-	int child;
-	static char jtmp[TPATHSIZ];
-	struct stat statbuf;
-	int c;
-	int wstat;
-
-	for (c = 'a'; c <= 'z'; c++) {
-		snprintf(jtmp, TPATHSIZ, "%s/jtmp.%06d%c", JTMPDIR, jid, c);
-		if (stat(jtmp, &statbuf) == 0 && statbuf.st_uid == uid)
-			break;
-	}
-
-	if (c > 'z')
-		return;
-
-	if ((child = fork()) == 0) {
-		execl(CLEANTMPCMD, CLEANTMPCMD, login, jtmp, (char *)NULL);
-		fatal("cray_delete_tmpdir: execl of CLEANTMPCMD failed");
-	}
-
-	while (waitpid(child, &wstat, 0) == -1 && errno == EINTR)
-		;
-}
-
-/*
- * Remove tmpdir on job termination.
- */
-void
-cray_job_termination_handler(int sig)
-{
-	int jid;
-	char *login = NULL;
-	struct jtab jtab;
-
-	debug("received signal %d",sig);
-
-	if ((jid = waitjob(&jtab)) == -1 ||
-	    (login = uid2nam(jtab.j_uid)) == NULL)
-		return;
-
-	cray_delete_tmpdir(login, jid, jtab.j_uid);
-}
-
-/*
- * Set job id and create tmpdir directory.
- */
-void
-cray_init_job(struct passwd *pw)
-{
-	int jid;
-	int c;
-
-	jid = setjob(pw->pw_uid, WJSIGNAL);
-	if (jid < 0)
-		fatal("System call setjob failure");
-
-	for (c = 'a'; c <= 'z'; c++) {
-		snprintf(cray_tmpdir, TPATHSIZ, "%s/jtmp.%06d%c", JTMPDIR, jid, c);
-		if (mkdir(cray_tmpdir, JTMPMODE) != 0)
-			continue;
-		if (chown(cray_tmpdir,	pw->pw_uid, pw->pw_gid) != 0) {
-			rmdir(cray_tmpdir);
-			continue;
-		}
-		break;
-	}
-
-	if (c > 'z')
-		cray_tmpdir[0] = '\0';
-}
-
-void
-cray_set_tmpdir(struct utmp *ut)
-{
-	int jid;
-	struct jtab jbuf;
-
-	if ((jid = getjtab(&jbuf)) < 0)
-		return;
-
-	/*
-	 * Set jid and tmpdir in utmp record.
-	 */
-	ut->ut_jid = jid;
-	strncpy(ut->ut_tpath, cray_tmpdir, TPATHSIZ);
-}
-#endif
diff --git a/crypto/openssh/openbsd-compat/bsd-cray.h b/crypto/openssh/openbsd-compat/bsd-cray.h
deleted file mode 100644
index a09954f2f40b..000000000000
--- a/crypto/openssh/openbsd-compat/bsd-cray.h
+++ /dev/null
@@ -1,58 +0,0 @@
-/* 
- * $Id: bsd-cray.h,v 1.7 2003/03/21 01:05:38 mouring Exp $
- *
- * bsd-cray.h
- *
- * Copyright (c) 2002, Cray Inc.  (Wendy Palm <wendyp@cray.com>)
- * Significant portions provided by 
- *          Wayne Schroeder, SDSC <schroeder@sdsc.edu>
- *          William Jones, UTexas <jones@tacc.utexas.edu>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- * Created: Apr 22 16.34:00 2002 wp
- *
- * This file contains functions required for proper execution
- * on UNICOS systems.
- *
- */
-#ifndef _BSD_CRAY_H
-#define _BSD_CRAY_H
-
-#ifdef _UNICOS
-void cray_init_job(struct passwd *);		/* init cray job */
-void cray_job_termination_handler(int);		/* process end of job signal */
-void cray_login_failure(char *username, int errcode);
-int cray_access_denied(char *username);
-extern	char   cray_tmpdir[];			/* cray tmpdir */
-#ifndef IA_SSHD
-#define IA_SSHD IA_LOGIN
-#endif
-#ifndef MAXHOSTNAMELEN
-#define MAXHOSTNAMELEN  64
-#endif
-#ifndef _CRAYT3E
-#include <sys/ttold.h>
-#define TIOCGPGRP (tIOC|20)
-#endif
-#endif
-
-#endif /* _BSD_CRAY_H */
diff --git a/crypto/openssh/openbsd-compat/bsd-cygwin_util.c b/crypto/openssh/openbsd-compat/bsd-cygwin_util.c
deleted file mode 100644
index 0fa5964bcb95..000000000000
--- a/crypto/openssh/openbsd-compat/bsd-cygwin_util.c
+++ /dev/null
@@ -1,230 +0,0 @@
-/*
- * cygwin_util.c
- *
- * Copyright (c) 2000, 2001, Corinna Vinschen <vinschen@cygnus.com>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- * Created: Sat Sep 02 12:17:00 2000 cv
- *
- * This file contains functions for forcing opened file descriptors to
- * binary mode on Windows systems.
- */
-
-#include "includes.h"
-
-RCSID("$Id: bsd-cygwin_util.c,v 1.9 2002/11/09 15:59:29 mouring Exp $");
-
-#ifdef HAVE_CYGWIN
-
-#include <fcntl.h>
-#include <stdlib.h>
-#include <sys/utsname.h>
-#include <sys/vfs.h>
-#include <windows.h>
-#define is_winnt       (GetVersion() < 0x80000000)
-
-#define ntsec_on(c)	((c) && strstr((c),"ntsec") && !strstr((c),"nontsec"))
-#define ntsec_off(c)	((c) && strstr((c),"nontsec"))
-#define ntea_on(c)	((c) && strstr((c),"ntea") && !strstr((c),"nontea"))
-
-#if defined(open) && open == binary_open
-# undef open
-#endif
-#if defined(pipe) && open == binary_pipe
-# undef pipe
-#endif
-
-int binary_open(const char *filename, int flags, ...)
-{
-	va_list ap;
-	mode_t mode;
-	
-	va_start(ap, flags);
-	mode = va_arg(ap, mode_t);
-	va_end(ap);
-	return open(filename, flags | O_BINARY, mode);
-}
-
-int binary_pipe(int fd[2])
-{
-	int ret = pipe(fd);
-
-	if (!ret) {
-		setmode (fd[0], O_BINARY);
-		setmode (fd[1], O_BINARY);
-	}
-	return ret;
-}
-
-#define HAS_CREATE_TOKEN 1
-#define HAS_NTSEC_BY_DEFAULT 2
-
-static int has_capability(int what)
-{
-	/* has_capability() basically calls uname() and checks if
-	   specific capabilities of Cygwin can be evaluated from that.
-	   This simplifies the calling functions which only have to ask
-	   for a capability using has_capability() instead of having
-	   to figure that out by themselves. */
-	static int inited;
-	static int has_create_token;
-	static int has_ntsec_by_default;
-
-	if (!inited) {
-		struct utsname uts;
-		char *c;
-		
-		if (!uname(&uts)) {
-			int major_high = 0;
-			int major_low = 0;
-			int minor = 0;
-			int api_major_version = 0;
-			int api_minor_version = 0;
-			char *c;
-
-			sscanf(uts.release, "%d.%d.%d", &major_high,
-			       &major_low, &minor);
-			c = strchr(uts.release, '(');
-			if (c)
-				sscanf(c + 1, "%d.%d", &api_major_version,
-				       &api_minor_version);
-			if (major_high > 1 ||
-			    (major_high == 1 && (major_low > 3 ||
-			     (major_low == 3 && minor >= 2))))
-				has_create_token = 1;
-			if (api_major_version > 0 || api_minor_version >= 56)
-				has_ntsec_by_default = 1;
-			inited = 1;
-		}
-	}
-	switch (what) {
-	case HAS_CREATE_TOKEN:
-		return has_create_token;
-	case HAS_NTSEC_BY_DEFAULT:
-		return has_ntsec_by_default;
-	}
-	return 0;
-}
-
-int check_nt_auth(int pwd_authenticated, struct passwd *pw)
-{
-	/*
-	* The only authentication which is able to change the user
-	* context on NT systems is the password authentication. So
-	* we deny all requsts for changing the user context if another
-	* authentication method is used.
-	*
-	* This doesn't apply to Cygwin versions >= 1.3.2 anymore which
-	* uses the undocumented NtCreateToken() call to create a user
-	* token if the process has the appropriate privileges and if
-	* CYGWIN ntsec setting is on.
-	*/
-	static int has_create_token = -1;
-
-	if (pw == NULL)
-		return 0;
-	if (is_winnt) {
-		if (has_create_token < 0) {
-			char *cygwin = getenv("CYGWIN");
-
-			has_create_token = 0;
-			if (has_capability(HAS_CREATE_TOKEN) &&
-			    (ntsec_on(cygwin) ||
-			     (has_capability(HAS_NTSEC_BY_DEFAULT) &&
-			      !ntsec_off(cygwin))))
-				has_create_token = 1;
-		}
-		if (has_create_token < 1 &&
-		    !pwd_authenticated && geteuid() != pw->pw_uid)
-			return 0;
-	}
-	return 1;
-}
-
-int check_ntsec(const char *filename)
-{
-	char *cygwin;
-	int allow_ntea = 0;
-	int allow_ntsec = 0;
-	struct statfs fsstat;
-
-	/* Windows 95/98/ME don't support file system security at all. */
-	if (!is_winnt)
-		return 0;
-
-	/* Evaluate current CYGWIN settings. */
-	cygwin = getenv("CYGWIN");
-	allow_ntea = ntea_on(cygwin);
-	allow_ntsec = ntsec_on(cygwin) ||
-		      (has_capability(HAS_NTSEC_BY_DEFAULT) &&
-		       !ntsec_off(cygwin));
-
-	/*
-	 * `ntea' is an emulation of POSIX attributes. It doesn't support
-	 * real file level security as ntsec on NTFS file systems does
-	 * but it supports FAT filesystems. `ntea' is minimum requirement
-	 * for security checks.
-	 */
-	if (allow_ntea)
-		return 1;
-
-	/*
-	 * Retrieve file system flags. In Cygwin, file system flags are
-	 * copied to f_type which has no meaning in Win32 itself.
-	 */
-	if (statfs(filename, &fsstat))
-		return 1;
-
-	/*
-	 * Only file systems supporting ACLs are able to set permissions.
-	 * `ntsec' is the setting in Cygwin which switches using of NTFS
-	 * ACLs to support POSIX permissions on files.
-	 */
-	if (fsstat.f_type & FS_PERSISTENT_ACLS)
-		return allow_ntsec;
-
-	return 0;
-}
-
-void register_9x_service(void)
-{
-        HINSTANCE kerneldll;
-        DWORD (*RegisterServiceProcess)(DWORD, DWORD);
-
-	/* The service register mechanism in 9x/Me is pretty different from
-	 * NT/2K/XP.  In NT/2K/XP we're using a special service starter
-	 * application to register and control sshd as service.  This method
-	 * doesn't play nicely with 9x/Me.  For that reason we register here
-	 * as service when running under 9x/Me.  This function is only called
-	 * by the child sshd when it's going to daemonize.
-	 */
-	if (is_winnt)
-		return;
-	if (! (kerneldll = LoadLibrary("KERNEL32.DLL")))
-		return;
-	if (! (RegisterServiceProcess = (DWORD (*)(DWORD, DWORD))
-			  GetProcAddress(kerneldll, "RegisterServiceProcess")))
-		return;
-	RegisterServiceProcess(0, 1);
-}
-
-#endif /* HAVE_CYGWIN */
diff --git a/crypto/openssh/openbsd-compat/bsd-cygwin_util.h b/crypto/openssh/openbsd-compat/bsd-cygwin_util.h
deleted file mode 100644
index af470bdd8d86..000000000000
--- a/crypto/openssh/openbsd-compat/bsd-cygwin_util.h
+++ /dev/null
@@ -1,52 +0,0 @@
-/* $Id: bsd-cygwin_util.h,v 1.7 2002/04/15 22:00:52 stevesk Exp $ */
-
-/*
- * cygwin_util.c
- *
- * Copyright (c) 2000, 2001, Corinna Vinschen <vinschen@cygnus.com>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- * Created: Sat Sep 02 12:17:00 2000 cv
- *
- * This file contains functions for forcing opened file descriptors to
- * binary mode on Windows systems.
- */
-
-#ifndef _BSD_CYGWIN_UTIL_H
-#define _BSD_CYGWIN_UTIL_H
-
-#ifdef HAVE_CYGWIN
-
-#include <io.h>
-
-int binary_open(const char *filename, int flags, ...);
-int binary_pipe(int fd[2]);
-int check_nt_auth(int pwd_authenticated, struct passwd *pw);
-int check_ntsec(const char *filename);
-void register_9x_service(void);
-
-#define open binary_open
-#define pipe binary_pipe
-
-#endif /* HAVE_CYGWIN */
-
-#endif /* _BSD_CYGWIN_UTIL_H */
diff --git a/crypto/openssh/openbsd-compat/bsd-getpeereid.c b/crypto/openssh/openbsd-compat/bsd-getpeereid.c
deleted file mode 100644
index bcda2c155c95..000000000000
--- a/crypto/openssh/openbsd-compat/bsd-getpeereid.c
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- * Copyright (c) 2002 Damien Miller.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-
-RCSID("$Id: bsd-getpeereid.c,v 1.2 2003/03/24 22:07:52 djm Exp $");
-
-#if !defined(HAVE_GETPEEREID)
-
-#if defined(SO_PEERCRED)
-int
-getpeereid(int s, uid_t *euid, gid_t *gid)
-{
-	struct ucred cred;
-	socklen_t len = sizeof(cred);
-
-	if (getsockopt(s, SOL_SOCKET, SO_PEERCRED, &cred, &len) < 0)
-		return (-1);
-	*euid = cred.uid;
-	*gid = cred.gid;
-
-	return (0);
-}
-#else
-int
-getpeereid(int s, uid_t *euid, gid_t *gid)
-{
-	*euid = geteuid();
-	*gid = getgid();
-
-	return (0);
-}
-#endif /* defined(SO_PEERCRED) */
-
-#endif /* !defined(HAVE_GETPEEREID) */
diff --git a/crypto/openssh/openbsd-compat/bsd-getpeereid.h b/crypto/openssh/openbsd-compat/bsd-getpeereid.h
deleted file mode 100644
index 2e9f077f917e..000000000000
--- a/crypto/openssh/openbsd-compat/bsd-getpeereid.h
+++ /dev/null
@@ -1,14 +0,0 @@
-/* $Id: bsd-getpeereid.h,v 1.1 2002/09/12 00:33:02 djm Exp $ */
-
-#ifndef _BSD_GETPEEREID_H
-#define _BSD_GETPEEREID_H
-
-#include "config.h"
-
-#include <sys/types.h> /* For uid_t, gid_t */
-
-#ifndef HAVE_GETPEEREID
-int	 getpeereid(int , uid_t *, gid_t *);
-#endif /* HAVE_GETPEEREID */
-
-#endif /* _BSD_GETPEEREID_H */
diff --git a/crypto/openssh/openbsd-compat/bsd-misc.c b/crypto/openssh/openbsd-compat/bsd-misc.c
deleted file mode 100644
index b8e9996d585e..000000000000
--- a/crypto/openssh/openbsd-compat/bsd-misc.c
+++ /dev/null
@@ -1,168 +0,0 @@
-/*
- * Copyright (c) 1999-2000 Damien Miller.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-#include "xmalloc.h"
-
-RCSID("$Id: bsd-misc.c,v 1.12 2003/03/18 18:21:41 tim Exp $");
-
-/*
- * NB. duplicate __progname in case it is an alias for argv[0]
- * Otherwise it may get clobbered by setproctitle()
- */
-char *get_progname(char *argv0)
-{
-#ifdef HAVE___PROGNAME
-	extern char *__progname;
-
-	return xstrdup(__progname);
-#else
-	char *p;
-
-	if (argv0 == NULL)
-		return "unknown";	/* XXX */
-	p = strrchr(argv0, '/');
-	if (p == NULL)
-		p = argv0;
-	else
-		p++;
-
-	return xstrdup(p);
-#endif
-}
-
-#ifndef HAVE_SETLOGIN
-int setlogin(const char *name)
-{
-	return(0);
-}
-#endif /* !HAVE_SETLOGIN */
-
-#ifndef HAVE_INNETGR
-int innetgr(const char *netgroup, const char *host, 
-            const char *user, const char *domain)
-{
-	return(0);
-}
-#endif /* HAVE_INNETGR */
-
-#if !defined(HAVE_SETEUID) && defined(HAVE_SETREUID)
-int seteuid(uid_t euid)
-{
-	return(setreuid(-1,euid));
-}
-#endif /* !defined(HAVE_SETEUID) && defined(HAVE_SETREUID) */
-
-#if !defined(HAVE_SETEGID) && defined(HAVE_SETRESGID)
-int setegid(uid_t egid)
-{
-	return(setresgid(-1,egid,-1));
-}
-#endif /* !defined(HAVE_SETEGID) && defined(HAVE_SETRESGID) */
-
-#if !defined(HAVE_STRERROR) && defined(HAVE_SYS_ERRLIST) && defined(HAVE_SYS_NERR)
-const char *strerror(int e)
-{
-	extern int sys_nerr;
-	extern char *sys_errlist[];
-	
-	if ((e >= 0) && (e < sys_nerr))
-		return(sys_errlist[e]);
-	else
-		return("unlisted error");
-}
-#endif
-
-#ifndef HAVE_UTIMES
-int utimes(char *filename, struct timeval *tvp)
-{
-	struct utimbuf ub;
-
-	ub.actime = tvp[0].tv_sec;
-	ub.modtime = tvp[1].tv_sec;
-	
-	return(utime(filename, &ub));
-}
-#endif 
-
-#ifndef HAVE_TRUNCATE
-int truncate (const char *path, off_t length)
-{
-	int fd, ret, saverrno;
-
-	fd = open(path, O_WRONLY);
-	if (fd < 0)
-		return -1;
-
-	ret = ftruncate(fd, length);
-	saverrno = errno;
-	(void) close (fd);
-	if (ret == -1)
-		errno = saverrno;
-	return(ret);
-}
-#endif /* HAVE_TRUNCATE */
-
-#if !defined(HAVE_SETGROUPS) && defined(SETGROUPS_NOOP)
-/*
- * Cygwin setgroups should be a noop.
- */
-int
-setgroups(size_t size, const gid_t *list)
-{
-	return 0;
-}
-#endif 
-
-#if !defined(HAVE_NANOSLEEP) && !defined(HAVE_NSLEEP)
-int nanosleep(const struct timespec *req, struct timespec *rem)
-{
-	int rc, saverrno;
-	extern int errno;
-	struct timeval tstart, tstop, tremain, time2wait;
-
-	TIMESPEC_TO_TIMEVAL(&time2wait, req)
-	(void) gettimeofday(&tstart, NULL);
-	rc = select(0, NULL, NULL, NULL, &time2wait);
-	if (rc == -1) {
-		saverrno = errno;
-		(void) gettimeofday (&tstop, NULL);
-		errno = saverrno;
-		tremain.tv_sec = time2wait.tv_sec - 
-			(tstop.tv_sec - tstart.tv_sec);
-		tremain.tv_usec = time2wait.tv_usec - 
-			(tstop.tv_usec - tstart.tv_usec);
-		tremain.tv_sec += tremain.tv_usec / 1000000L;
-		tremain.tv_usec %= 1000000L;
-	} else {
-		tremain.tv_sec = 0;
-		tremain.tv_usec = 0;
-	}
-	TIMEVAL_TO_TIMESPEC(&tremain, rem)
-
-	return(rc);
-}
-
-#endif
-
diff --git a/crypto/openssh/openbsd-compat/bsd-misc.h b/crypto/openssh/openbsd-compat/bsd-misc.h
deleted file mode 100644
index 78d9ccdd4d2a..000000000000
--- a/crypto/openssh/openbsd-compat/bsd-misc.h
+++ /dev/null
@@ -1,93 +0,0 @@
-/*
- * Copyright (c) 1999-2000 Damien Miller.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/* $Id: bsd-misc.h,v 1.7 2003/03/18 18:21:41 tim Exp $ */
-
-#ifndef _BSD_MISC_H
-#define _BSD_MISC_H
-
-#include "config.h"
-
-char *get_progname(char *argv0);
-
-#ifndef HAVE_SETSID
-#define setsid() setpgrp(0, getpid())
-#endif /* !HAVE_SETSID */
-
-#ifndef HAVE_SETENV
-int setenv(const char *name, const char *value, int overwrite);
-#endif /* !HAVE_SETENV */
-
-#ifndef HAVE_SETLOGIN
-int setlogin(const char *name);
-#endif /* !HAVE_SETLOGIN */
-
-#ifndef HAVE_INNETGR
-int innetgr(const char *netgroup, const char *host, 
-            const char *user, const char *domain);
-#endif /* HAVE_INNETGR */
-
-#if !defined(HAVE_SETEUID) && defined(HAVE_SETREUID)
-int seteuid(uid_t euid);
-#endif /* !defined(HAVE_SETEUID) && defined(HAVE_SETREUID) */
-
-#if !defined(HAVE_SETEGID) && defined(HAVE_SETRESGID)
-int setegid(uid_t egid);
-#endif /* !defined(HAVE_SETEGID) && defined(HAVE_SETRESGID) */
-
-#if !defined(HAVE_STRERROR) && defined(HAVE_SYS_ERRLIST) && defined(HAVE_SYS_NERR)
-const char *strerror(int e);
-#endif 
-
-
-#ifndef HAVE_UTIMES
-#ifndef HAVE_STRUCT_TIMEVAL
-struct timeval {
-	long tv_sec;
-	long tv_usec;
-}
-#endif /* HAVE_STRUCT_TIMEVAL */
-
-int utimes(char *filename, struct timeval *tvp);
-#endif /* HAVE_UTIMES */
-
-#ifndef HAVE_TRUNCATE
-int truncate (const char *path, off_t length);
-#endif /* HAVE_TRUNCATE */
-
-#if !defined(HAVE_SETGROUPS) && defined(SETGROUPS_NOOP)
-int setgroups(size_t size, const gid_t *list);
-#endif
-
-#if !defined(HAVE_NANOSLEEP) && !defined(HAVE_NSLEEP)
-#ifndef HAVE_STRUCT_TIMESPEC
-struct timespec {
-	time_t	tv_sec;
-	long	tv_nsec;
-};
-#endif
-int nanosleep(const struct timespec *req, struct timespec *rem);
-#endif
-
-#endif /* _BSD_MISC_H */
diff --git a/crypto/openssh/openbsd-compat/bsd-nextstep.c b/crypto/openssh/openbsd-compat/bsd-nextstep.c
deleted file mode 100644
index 85b298a48ffc..000000000000
--- a/crypto/openssh/openbsd-compat/bsd-nextstep.c
+++ /dev/null
@@ -1,103 +0,0 @@
-/*
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-
-RCSID("$Id: bsd-nextstep.c,v 1.4 2001/03/26 05:35:34 mouring Exp $");
-
-#ifdef HAVE_NEXT
-#include <errno.h>
-#include <sys/wait.h>
-#include "bsd-nextstep.h"
-
-pid_t 
-posix_wait(int *status)
-{
-	union wait statusp;
-	pid_t wait_pid;
-
-	#undef wait			/* Use NeXT's wait() function */
-	wait_pid = wait(&statusp);
-	if (status)
-		*status = (int) statusp.w_status;
-
-	return wait_pid;
-}
-
-int
-tcgetattr(int fd, struct termios *t)
-{
-	return (ioctl(fd, TIOCGETA, t));
-}
-
-int
-tcsetattr(int fd, int opt, const struct termios *t)
-{
-	struct termios localterm;
-
-	if (opt & TCSASOFT) {
-		localterm = *t;
-		localterm.c_cflag |= CIGNORE;
-		t = &localterm;
-	}
-	switch (opt & ~TCSASOFT) {
-	case TCSANOW:
-		return (ioctl(fd, TIOCSETA, t));
-	case TCSADRAIN:
-		return (ioctl(fd, TIOCSETAW, t));
-	case TCSAFLUSH:
-		return (ioctl(fd, TIOCSETAF, t));
-	default:
-		errno = EINVAL;
-		return (-1);
-	}
-}
-
-int tcsetpgrp(int fd, pid_t pgrp)
-{
-	return (ioctl(fd, TIOCSPGRP, &pgrp));
-}
-
-speed_t cfgetospeed(const struct termios *t)
-{
-	return (t->c_ospeed);
-}
-
-speed_t cfgetispeed(const struct termios *t)
-{
-	return (t->c_ispeed);
-}
-
-int
-cfsetospeed(struct termios *t,int speed)
-{
-	t->c_ospeed = speed;
-	return (0);
-}
-
-int
-cfsetispeed(struct termios *t, int speed)
-{
-	t->c_ispeed = speed;
-	return (0);
-}
-#endif /* HAVE_NEXT */
diff --git a/crypto/openssh/openbsd-compat/bsd-nextstep.h b/crypto/openssh/openbsd-compat/bsd-nextstep.h
deleted file mode 100644
index c6a7019c6219..000000000000
--- a/crypto/openssh/openbsd-compat/bsd-nextstep.h
+++ /dev/null
@@ -1,58 +0,0 @@
-/*
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- */
-
-/* $Id: bsd-nextstep.h,v 1.6 2001/03/19 13:42:22 mouring Exp $ */
-
-#ifndef _NEXT_POSIX_H
-#define _NEXT_POSIX_H
-
-#ifdef HAVE_NEXT
-#include <sys/dir.h>
-
-/* NGROUPS_MAX is behind -lposix.  Use the BSD version which is NGROUPS */
-#undef NGROUPS_MAX
-#define NGROUPS_MAX NGROUPS
-
-/* NeXT's readdir() is BSD (struct direct) not POSIX (struct dirent) */
-#define dirent direct
-
-/* Swap out NeXT's BSD wait() for a more POSIX complient one */
-pid_t posix_wait(int *status);
-#define wait(a) posix_wait(a)
-
-/* #ifdef wrapped functions that need defining for clean compiling */
-pid_t getppid(void);
-void vhangup(void);
-int innetgr(const char *netgroup, const char *host, const char *user, 
-            const char *domain);
-
-/* TERMCAP */
-int tcgetattr(int fd, struct termios *t);
-int tcsetattr(int fd, int opt, const struct termios *t);
-int tcsetpgrp(int fd, pid_t pgrp);
-speed_t cfgetospeed(const struct termios *t);
-speed_t cfgetispeed(const struct termios *t);
-int cfsetospeed(struct termios *t, int speed);
-int cfsetispeed(struct termios *t, int speed);
-#endif /* HAVE_NEXT */
-#endif /* _NEXT_POSIX_H */
diff --git a/crypto/openssh/openbsd-compat/bsd-snprintf.c b/crypto/openssh/openbsd-compat/bsd-snprintf.c
deleted file mode 100644
index 2f82180d13d4..000000000000
--- a/crypto/openssh/openbsd-compat/bsd-snprintf.c
+++ /dev/null
@@ -1,751 +0,0 @@
-/*
- * Copyright Patrick Powell 1995
- * This code is based on code written by Patrick Powell (papowell@astart.com)
- * It may be used for any purpose as long as this notice remains intact
- * on all source code distributions
- */
-
-/**************************************************************
- * Original:
- * Patrick Powell Tue Apr 11 09:48:21 PDT 1995
- * A bombproof version of doprnt (dopr) included.
- * Sigh.  This sort of thing is always nasty do deal with.  Note that
- * the version here does not include floating point...
- *
- * snprintf() is used instead of sprintf() as it does limit checks
- * for string length.  This covers a nasty loophole.
- *
- * The other functions are there to prevent NULL pointers from
- * causing nast effects.
- *
- * More Recently:
- *  Brandon Long <blong@fiction.net> 9/15/96 for mutt 0.43
- *  This was ugly.  It is still ugly.  I opted out of floating point
- *  numbers, but the formatter understands just about everything
- *  from the normal C string format, at least as far as I can tell from
- *  the Solaris 2.5 printf(3S) man page.
- *
- *  Brandon Long <blong@fiction.net> 10/22/97 for mutt 0.87.1
- *    Ok, added some minimal floating point support, which means this
- *    probably requires libm on most operating systems.  Don't yet
- *    support the exponent (e,E) and sigfig (g,G).  Also, fmtint()
- *    was pretty badly broken, it just wasn't being exercised in ways
- *    which showed it, so that's been fixed.  Also, formated the code
- *    to mutt conventions, and removed dead code left over from the
- *    original.  Also, there is now a builtin-test, just compile with:
- *           gcc -DTEST_SNPRINTF -o snprintf snprintf.c -lm
- *    and run snprintf for results.
- * 
- *  Thomas Roessler <roessler@guug.de> 01/27/98 for mutt 0.89i
- *    The PGP code was using unsigned hexadecimal formats. 
- *    Unfortunately, unsigned formats simply didn't work.
- *
- *  Michael Elkins <me@cs.hmc.edu> 03/05/98 for mutt 0.90.8
- *    The original code assumed that both snprintf() and vsnprintf() were
- *    missing.  Some systems only have snprintf() but not vsnprintf(), so
- *    the code is now broken down under HAVE_SNPRINTF and HAVE_VSNPRINTF.
- *
- *  Ben Lindstrom <mouring@eviladmin.org> 09/27/00 for OpenSSH
- *    Welcome to the world of %lld and %qd support.  With other
- *    long long support.  This is needed for sftp-server to work
- *    right.
- *
- *  Ben Lindstrom <mouring@eviladmin.org> 02/12/01 for OpenSSH
- *    Removed all hint of VARARGS stuff and banished it to the void,
- *    and did a bit of KNF style work to make things a bit more
- *    acceptable.  Consider stealing from mutt or enlightenment.
- **************************************************************/
-
-#include "includes.h"
-
-RCSID("$Id: bsd-snprintf.c,v 1.6 2003/04/01 11:31:56 djm Exp $");
-
-#if defined(BROKEN_SNPRINTF)		/* For those with broken snprintf() */
-# undef HAVE_SNPRINTF
-# undef HAVE_VSNPRINTF
-#endif
-
-#if !defined(HAVE_SNPRINTF) || !defined(HAVE_VSNPRINTF)
-
-static void 
-dopr(char *buffer, size_t maxlen, const char *format, va_list args);
-
-static void 
-fmtstr(char *buffer, size_t *currlen, size_t maxlen, char *value, int flags, 
-       int min, int max);
-
-static void 
-fmtint(char *buffer, size_t *currlen, size_t maxlen, long value, int base, 
-       int min, int max, int flags);
-
-static void 
-fmtfp(char *buffer, size_t *currlen, size_t maxlen, long double fvalue, 
-      int min, int max, int flags);
-
-static void
-dopr_outch(char *buffer, size_t *currlen, size_t maxlen, char c);
-
-/*
- * dopr(): poor man's version of doprintf
- */
-
-/* format read states */
-#define DP_S_DEFAULT 0
-#define DP_S_FLAGS   1
-#define DP_S_MIN     2
-#define DP_S_DOT     3
-#define DP_S_MAX     4
-#define DP_S_MOD     5
-#define DP_S_CONV    6
-#define DP_S_DONE    7
-
-/* format flags - Bits */
-#define DP_F_MINUS 	(1 << 0)
-#define DP_F_PLUS  	(1 << 1)
-#define DP_F_SPACE 	(1 << 2)
-#define DP_F_NUM   	(1 << 3)
-#define DP_F_ZERO  	(1 << 4)
-#define DP_F_UP    	(1 << 5)
-#define DP_F_UNSIGNED 	(1 << 6)
-
-/* Conversion Flags */
-#define DP_C_SHORT     1
-#define DP_C_LONG      2
-#define DP_C_LDOUBLE   3
-#define DP_C_LONG_LONG 4
-
-#define char_to_int(p) (p - '0')
-#define abs_val(p) (p < 0 ? -p : p)
-
-
-static void 
-dopr(char *buffer, size_t maxlen, const char *format, va_list args)
-{
-	char *strvalue;
-	char ch;
-	long value;
-	long double fvalue;
-	int min = 0;
-	int max = -1;
-	int state = DP_S_DEFAULT;
-	int flags = 0;
-	int cflags = 0;
-	size_t currlen = 0;
-  
-	ch = *format++;
-
-	while (state != DP_S_DONE) {
-		if ((ch == '\0') || (currlen >= maxlen)) 
-			state = DP_S_DONE;
-
-		switch(state) {
-			case DP_S_DEFAULT:
-				if (ch == '%') 
-					state = DP_S_FLAGS;
-				else 
-					dopr_outch(buffer, &currlen, maxlen, ch);
-				ch = *format++;
-				break;
-			case DP_S_FLAGS:
-				switch (ch) {
-					case '-':
-						flags |= DP_F_MINUS;
-						ch = *format++;
-						break;
-					case '+':
-						flags |= DP_F_PLUS;
-						ch = *format++;
-						break;
-					case ' ':
-						flags |= DP_F_SPACE;
-						ch = *format++;
-						break;
-					case '#':
-						flags |= DP_F_NUM;
-						ch = *format++;
-						break;
-					case '0':
-						flags |= DP_F_ZERO;
-						ch = *format++;
-						break;
-					default:
-						state = DP_S_MIN;
-						break;
-				}
-				break;
-			case DP_S_MIN:
-				if (isdigit((unsigned char)ch)) {
-					min = 10*min + char_to_int (ch);
-					ch = *format++;
-				} else if (ch == '*') {
-					min = va_arg (args, int);
-					ch = *format++;
-					state = DP_S_DOT;
-				} else 
-					state = DP_S_DOT;
-				break;
-			case DP_S_DOT:
-				if (ch == '.') {
-					state = DP_S_MAX;
-					ch = *format++;
-				} else 
-					state = DP_S_MOD;
-				break;
-			case DP_S_MAX:
-				if (isdigit((unsigned char)ch)) {
-					if (max < 0)
-						max = 0;
-					max = 10*max + char_to_int(ch);
-					ch = *format++;
-				} else if (ch == '*') {
-					max = va_arg (args, int);
-					ch = *format++;
-					state = DP_S_MOD;
-				} else 
-					state = DP_S_MOD;
-				break;
-			case DP_S_MOD:
-				switch (ch) {
-					case 'h':
-						cflags = DP_C_SHORT;
-						ch = *format++;
-						break;
-					case 'l':
-						cflags = DP_C_LONG;
-						ch = *format++;
-						if (ch == 'l') {
-							cflags = DP_C_LONG_LONG;
-							ch = *format++;
-						}
-						break;
-					case 'q':
-						cflags = DP_C_LONG_LONG;
-						ch = *format++;
-						break;
-					case 'L':
-						cflags = DP_C_LDOUBLE;
-						ch = *format++;
-						break;
-					default:
-						break;
-				}
-				state = DP_S_CONV;
-				break;
-			case DP_S_CONV:
-				switch (ch) {
-					case 'd':
-					case 'i':
-						if (cflags == DP_C_SHORT) 
-							value = va_arg(args, int);
-						else if (cflags == DP_C_LONG)
-							value = va_arg(args, long int);
-						else if (cflags == DP_C_LONG_LONG)
-							value = va_arg (args, long long);
-						else
-							value = va_arg (args, int);
-						fmtint(buffer, &currlen, maxlen, value, 10, min, max, flags);
-						break;
-					case 'o':
-						flags |= DP_F_UNSIGNED;
-						if (cflags == DP_C_SHORT)
-							value = va_arg(args, unsigned int);
-						else if (cflags == DP_C_LONG)
-							value = va_arg(args, unsigned long int);
-						else if (cflags == DP_C_LONG_LONG)
-							value = va_arg(args, unsigned long long);
-						else
-							value = va_arg(args, unsigned int);
-						fmtint(buffer, &currlen, maxlen, value, 8, min, max, flags);
-						break;
-					case 'u':
-						flags |= DP_F_UNSIGNED;
-						if (cflags == DP_C_SHORT)
-							value = va_arg(args, unsigned int);
-						else if (cflags == DP_C_LONG)
-							value = va_arg(args, unsigned long int);
-						else if (cflags == DP_C_LONG_LONG)
-							value = va_arg(args, unsigned long long);
-						else
-							value = va_arg(args, unsigned int);
-						fmtint (buffer, &currlen, maxlen, value, 10, min, max, flags);
-						break;
-					case 'X':
-						flags |= DP_F_UP;
-					case 'x':
-						flags |= DP_F_UNSIGNED;
-						if (cflags == DP_C_SHORT)
-							value = va_arg(args, unsigned int);
-						else if (cflags == DP_C_LONG)
-							value = va_arg(args, unsigned long int);
-						else if (cflags == DP_C_LONG_LONG)
-							value = va_arg(args, unsigned long long);
-						else
-							value = va_arg(args, unsigned int);
-						fmtint(buffer, &currlen, maxlen, value, 16, min, max, flags);
-						break;
-					case 'f':
-						if (cflags == DP_C_LDOUBLE)
-							fvalue = va_arg(args, long double);
-						else
-							fvalue = va_arg(args, double);
-						/* um, floating point? */
-						fmtfp(buffer, &currlen, maxlen, fvalue, min, max, flags);
-						break;
-					case 'E':
-						flags |= DP_F_UP;
-					case 'e':
-						if (cflags == DP_C_LDOUBLE)
-							fvalue = va_arg(args, long double);
-						else
-							fvalue = va_arg(args, double);
-						break;
-					case 'G':
-						flags |= DP_F_UP;
-					case 'g':
-						if (cflags == DP_C_LDOUBLE)
-							fvalue = va_arg(args, long double);
-						else
-							fvalue = va_arg(args, double);
-						break;
-					case 'c':
-						dopr_outch(buffer, &currlen, maxlen, va_arg(args, int));
-						break;
-					case 's':
-						strvalue = va_arg(args, char *);
-						if (max < 0) 
-							max = maxlen; /* ie, no max */
-						fmtstr(buffer, &currlen, maxlen, strvalue, flags, min, max);
-						break;
-					case 'p':
-						strvalue = va_arg(args, void *);
-						fmtint(buffer, &currlen, maxlen, (long) strvalue, 16, min, max, flags);
-						break;
-					case 'n':
-						if (cflags == DP_C_SHORT) {
-							short int *num;
-							num = va_arg(args, short int *);
-							*num = currlen;
-						} else if (cflags == DP_C_LONG) {
-							long int *num;
-							num = va_arg(args, long int *);
-							*num = currlen;
-						} else if (cflags == DP_C_LONG_LONG) {
-							long long *num;
-							num = va_arg(args, long long *);
-							*num = currlen;
-						} else {
-							int *num;
-							num = va_arg(args, int *);
-							*num = currlen;
-						}
-						break;
-					case '%':
-						dopr_outch(buffer, &currlen, maxlen, ch);
-						break;
-					case 'w': /* not supported yet, treat as next char */
-						ch = *format++;
-						break;
-					default: /* Unknown, skip */
-					break;
-				}
-				ch = *format++;
-				state = DP_S_DEFAULT;
-				flags = cflags = min = 0;
-				max = -1;
-				break;
-			case DP_S_DONE:
-				break;
-			default: /* hmm? */
-				break; /* some picky compilers need this */
-		}
-	}
-	if (currlen < maxlen - 1) 
-		buffer[currlen] = '\0';
-	else 
-		buffer[maxlen - 1] = '\0';
-}
-
-static void
-fmtstr(char *buffer, size_t *currlen, size_t maxlen,
-       char *value, int flags, int min, int max)
-{
-	int padlen, strln;     /* amount to pad */
-	int cnt = 0;
-  
-	if (value == 0) 
-		value = "<NULL>";
-
-	for (strln = 0; value[strln]; ++strln); /* strlen */
-	padlen = min - strln;
-	if (padlen < 0) 
-		padlen = 0;
-	if (flags & DP_F_MINUS) 
-		padlen = -padlen; /* Left Justify */
-
-	while ((padlen > 0) && (cnt < max)) {
-		dopr_outch(buffer, currlen, maxlen, ' ');
-		--padlen;
-		++cnt;
-	}
-	while (*value && (cnt < max)) {
-		dopr_outch(buffer, currlen, maxlen, *value++);
-		++cnt;
-	}
-	while ((padlen < 0) && (cnt < max)) {
-		dopr_outch(buffer, currlen, maxlen, ' ');
-		++padlen;
-		++cnt;
-	}
-}
-
-/* Have to handle DP_F_NUM (ie 0x and 0 alternates) */
-
-static void 
-fmtint(char *buffer, size_t *currlen, size_t maxlen,
-       long value, int base, int min, int max, int flags)
-{
-	unsigned long uvalue;
-	char convert[20];
-	int signvalue = 0;
-	int place = 0;
-	int spadlen = 0; /* amount to space pad */
-	int zpadlen = 0; /* amount to zero pad */
-	int caps = 0;
-  
-	if (max < 0)
-		max = 0;
-
-	uvalue = value;
-
-	if (!(flags & DP_F_UNSIGNED)) {
-		if (value < 0) {
-			signvalue = '-';
-			uvalue = -value;
-		} else if (flags & DP_F_PLUS)  /* Do a sign (+/i) */
-			signvalue = '+';
-		else if (flags & DP_F_SPACE)
-			signvalue = ' ';
-	}
-  
-	if (flags & DP_F_UP) 
-		caps = 1; /* Should characters be upper case? */
-
-	do {
-		convert[place++] =
-			(caps? "0123456789ABCDEF":"0123456789abcdef")
-			[uvalue % (unsigned)base];
-		uvalue = (uvalue / (unsigned)base );
-	} while (uvalue && (place < 20));
-	if (place == 20) 
-		place--;
-	convert[place] = 0;
-
-	zpadlen = max - place;
-	spadlen = min - MAX (max, place) - (signvalue ? 1 : 0);
-	if (zpadlen < 0)
-		zpadlen = 0;
-	if (spadlen < 0)
-		spadlen = 0;
-	if (flags & DP_F_ZERO) {
-		zpadlen = MAX(zpadlen, spadlen);
-		spadlen = 0;
-	}
-	if (flags & DP_F_MINUS) 
-		spadlen = -spadlen; /* Left Justifty */
-
-
-	/* Spaces */
-	while (spadlen > 0) {
-		dopr_outch(buffer, currlen, maxlen, ' ');
-		--spadlen;
-	}
-
-	/* Sign */
-	if (signvalue) 
-		dopr_outch(buffer, currlen, maxlen, signvalue);
-
-	/* Zeros */
-	if (zpadlen > 0) {
-		while (zpadlen > 0) {
-			dopr_outch(buffer, currlen, maxlen, '0');
-			--zpadlen;
-		}
-	}
-
-	/* Digits */
-	while (place > 0) 
-		dopr_outch(buffer, currlen, maxlen, convert[--place]);
-  
-	/* Left Justified spaces */
-	while (spadlen < 0) {
-		dopr_outch (buffer, currlen, maxlen, ' ');
-		++spadlen;
-	}
-}
-
-static long double 
-pow10(int exp)
-{
-	long double result = 1;
-
-	while (exp) {
-		result *= 10;
-		exp--;
-	}
-  
-	return result;
-}
-
-static long 
-round(long double value)
-{
-	long intpart = value;
-
-	value -= intpart;
-	if (value >= 0.5)
-		intpart++;
-
-	return intpart;
-}
-
-static void 
-fmtfp(char *buffer, size_t *currlen, size_t maxlen, long double fvalue, 
-      int min, int max, int flags)
-{
-	char iconvert[20];
-	char fconvert[20];
-	int signvalue = 0;
-	int iplace = 0;
-	int fplace = 0;
-	int padlen = 0; /* amount to pad */
-	int zpadlen = 0; 
-	int caps = 0;
-	long intpart;
-	long fracpart;
-	long double ufvalue;
-  
-	/* 
-	 * AIX manpage says the default is 0, but Solaris says the default
-	 * is 6, and sprintf on AIX defaults to 6
-	 */
-	if (max < 0)
-		max = 6;
-
-	ufvalue = abs_val(fvalue);
-
-	if (fvalue < 0)
-		signvalue = '-';
-	else if (flags & DP_F_PLUS)  /* Do a sign (+/i) */
-		signvalue = '+';
-	else if (flags & DP_F_SPACE)
-		signvalue = ' ';
-
-	intpart = ufvalue;
-
-	/* 
-	 * Sorry, we only support 9 digits past the decimal because of our 
-	 * conversion method
-	 */
-	if (max > 9)
-		max = 9;
-
-	/* We "cheat" by converting the fractional part to integer by
-	 * multiplying by a factor of 10
-	 */
-	fracpart = round((pow10 (max)) * (ufvalue - intpart));
-
-	if (fracpart >= pow10 (max)) {
-		intpart++;
-		fracpart -= pow10 (max);
-	}
-
-	/* Convert integer part */
-	do {
-		iconvert[iplace++] =
-		  (caps? "0123456789ABCDEF":"0123456789abcdef")[intpart % 10];
-		intpart = (intpart / 10);
-	} while(intpart && (iplace < 20));
-	if (iplace == 20) 
-		iplace--;
-	iconvert[iplace] = 0;
-
-	/* Convert fractional part */
-	do {
-		fconvert[fplace++] =
-		  (caps? "0123456789ABCDEF":"0123456789abcdef")[fracpart % 10];
-		fracpart = (fracpart / 10);
-	} while(fracpart && (fplace < 20));
-	if (fplace == 20) 
-		fplace--;
-	fconvert[fplace] = 0;
-
-	/* -1 for decimal point, another -1 if we are printing a sign */
-	padlen = min - iplace - max - 1 - ((signvalue) ? 1 : 0); 
-	zpadlen = max - fplace;
-	if (zpadlen < 0)
-		zpadlen = 0;
-	if (padlen < 0) 
-		padlen = 0;
-	if (flags & DP_F_MINUS) 
-		padlen = -padlen; /* Left Justifty */
-
-	if ((flags & DP_F_ZERO) && (padlen > 0)) {
-		if (signvalue) {
-			dopr_outch(buffer, currlen, maxlen, signvalue);
-			--padlen;
-			signvalue = 0;
-		}
-		while (padlen > 0) {
-			dopr_outch(buffer, currlen, maxlen, '0');
-			--padlen;
-		}
-	}
-	while (padlen > 0) {
-		dopr_outch(buffer, currlen, maxlen, ' ');
-		--padlen;
-	}
-	if (signvalue) 
-		dopr_outch(buffer, currlen, maxlen, signvalue);
-
-	while (iplace > 0) 
-		dopr_outch(buffer, currlen, maxlen, iconvert[--iplace]);
-
-	/*
-	 * Decimal point.  This should probably use locale to find the correct
-	 * char to print out.
-	 */
-	dopr_outch(buffer, currlen, maxlen, '.');
-
-	while (fplace > 0) 
-		dopr_outch(buffer, currlen, maxlen, fconvert[--fplace]);
-
-	while (zpadlen > 0) {
-		dopr_outch(buffer, currlen, maxlen, '0');
-		--zpadlen;
-	}
-
-	while (padlen < 0) {
-		dopr_outch(buffer, currlen, maxlen, ' ');
-		++padlen;
-	}
-}
-
-static void 
-dopr_outch(char *buffer, size_t *currlen, size_t maxlen, char c)
-{
-	if (*currlen < maxlen)
-		buffer[(*currlen)++] = c;
-}
-#endif /* !defined(HAVE_SNPRINTF) || !defined(HAVE_VSNPRINTF) */
-
-#ifndef HAVE_VSNPRINTF
-int 
-vsnprintf(char *str, size_t count, const char *fmt, va_list args)
-{
-	str[0] = 0;
-	dopr(str, count, fmt, args);
-
-	return(strlen(str));
-}
-#endif /* !HAVE_VSNPRINTF */
-
-#ifndef HAVE_SNPRINTF
-int 
-snprintf(char *str,size_t count,const char *fmt,...)
-{
-	va_list ap;
-
-	va_start(ap, fmt);
-	(void) vsnprintf(str, count, fmt, ap);
-	va_end(ap);
-
-	return(strlen(str));
-}
-
-#ifdef TEST_SNPRINTF
-int 
-main(void)
-{
-#define LONG_STRING 1024
-	char buf1[LONG_STRING];
-	char buf2[LONG_STRING];
-	char *fp_fmt[] = {
-		"%-1.5f",
-		"%1.5f",
-		"%123.9f",
-		"%10.5f",
-		"% 10.5f",
-		"%+22.9f",
-		"%+4.9f",
-		"%01.3f",
-		"%4f",
-		"%3.1f",
-		"%3.2f",
-		NULL
-	};
-	double fp_nums[] = { 
-		-1.5, 
-		134.21, 
-		91340.2, 
-		341.1234, 
-		0203.9, 
-		0.96, 
-		0.996, 
-		0.9996, 
-		1.996, 
-		4.136, 
-		0
-	};
-	char *int_fmt[] = {
-		"%-1.5d",
-		"%1.5d",
-		"%123.9d",
-		"%5.5d",
-		"%10.5d",
-		"% 10.5d",
-		"%+22.33d",
-		"%01.3d",
-		"%4d",
-		"%lld",
-		"%qd",
-		NULL
-	};
-	long long int_nums[] = { -1, 134, 91340, 341, 0203, 0, 9999999 };
-	int x, y;
-	int fail = 0;
-	int num = 0;
-
-	printf("Testing snprintf format codes against system sprintf...\n");
-
-	for (x = 0; fp_fmt[x] != NULL ; x++) {
-		for (y = 0; fp_nums[y] != 0 ; y++) {
-			snprintf(buf1, sizeof (buf1), fp_fmt[x], fp_nums[y]);
-			sprintf (buf2, fp_fmt[x], fp_nums[y]);
-			if (strcmp (buf1, buf2)) {
-				printf("snprintf doesn't match Format: %s\n\t"
-                                       "snprintf = %s\n\tsprintf  = %s\n", 
-					fp_fmt[x], buf1, buf2);
-				fail++;
-			}
-			num++;
-		}
-	}
-	for (x = 0; int_fmt[x] != NULL ; x++) {
-		for (y = 0; int_nums[y] != 0 ; y++) {
-			snprintf(buf1, sizeof (buf1), int_fmt[x], int_nums[y]);
-			sprintf(buf2, int_fmt[x], int_nums[y]);
-			if (strcmp (buf1, buf2)) {
-				printf("snprintf doesn't match Format: %s\n\t"
-				       "snprintf = %s\n\tsprintf  = %s\n", 
-					int_fmt[x], buf1, buf2);
-				fail++;
-			}
-			num++;
-		}
-	}
-	printf("%d tests failed out of %d.\n", fail, num);
-	return(0);
-}
-#endif /* SNPRINTF_TEST */
-
-#endif /* !HAVE_SNPRINTF */
diff --git a/crypto/openssh/openbsd-compat/bsd-snprintf.h b/crypto/openssh/openbsd-compat/bsd-snprintf.h
deleted file mode 100644
index 002b764e3422..000000000000
--- a/crypto/openssh/openbsd-compat/bsd-snprintf.h
+++ /dev/null
@@ -1,19 +0,0 @@
-/* $Id: bsd-snprintf.h,v 1.2 2001/02/09 01:55:36 djm Exp $ */
-
-#ifndef _BSD_SNPRINTF_H
-#define _BSD_SNPRINTF_H
-
-#include "config.h"
-
-#include <sys/types.h> /* For size_t */
-
-#ifndef HAVE_SNPRINTF
-int snprintf(char *str, size_t count, const char *fmt, ...);
-#endif /* !HAVE_SNPRINTF */
-
-#ifndef HAVE_VSNPRINTF
-int vsnprintf(char *str, size_t count, const char *fmt, va_list args);
-#endif /* !HAVE_SNPRINTF */
-
-
-#endif /* _BSD_SNPRINTF_H */
diff --git a/crypto/openssh/openbsd-compat/bsd-waitpid.c b/crypto/openssh/openbsd-compat/bsd-waitpid.c
deleted file mode 100644
index 47b4446dcac0..000000000000
--- a/crypto/openssh/openbsd-compat/bsd-waitpid.c
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-
-RCSID("$Id: bsd-waitpid.c,v 1.3 2001/03/26 05:35:34 mouring Exp $");
-
-#ifndef HAVE_WAITPID 
-#include <errno.h>
-#include <sys/wait.h>
-#include "bsd-waitpid.h"
-
-pid_t
-waitpid(int pid, int *stat_loc, int options)
-{
-	union wait statusp;
-	pid_t wait_pid;
-
-	if (pid <= 0) {
-		if (pid != -1) {
-			errno = EINVAL;
-			return -1;
-		}
-		pid = 0;   /* wait4() wants pid=0 for indiscriminate wait. */
-	}
-        wait_pid = wait4(pid, &statusp, options, NULL);
-	if (stat_loc)
-        	*stat_loc = (int) statusp.w_status;            
-
-        return wait_pid;                               
-}
-
-#endif /* !HAVE_WAITPID */
diff --git a/crypto/openssh/openbsd-compat/bsd-waitpid.h b/crypto/openssh/openbsd-compat/bsd-waitpid.h
deleted file mode 100644
index e24edd7914a9..000000000000
--- a/crypto/openssh/openbsd-compat/bsd-waitpid.h
+++ /dev/null
@@ -1,49 +0,0 @@
-/*
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- */
-
-/* $Id: bsd-waitpid.h,v 1.2 2001/02/09 01:55:36 djm Exp $ */
-
-#ifndef _BSD_WAITPID_H
-#define _BSD_WAITPID_H
-
-#ifndef HAVE_WAITPID
-/* Clean out any potental issues */
-#undef WIFEXITED
-#undef WIFSTOPPED
-#undef WIFSIGNALED
-
-/* Define required functions to mimic a POSIX look and feel */
-#define _W_INT(w)	(*(int*)&(w))	/* convert union wait to int */
-#define WIFEXITED(w)	(!((_W_INT(w)) & 0377))
-#define WIFSTOPPED(w)	((_W_INT(w)) & 0100)
-#define WIFSIGNALED(w)	(!WIFEXITED(w) && !WIFSTOPPED(w))
-#define WEXITSTATUS(w)	(int)(WIFEXITED(w) ? ((_W_INT(w) >> 8) & 0377) : -1)
-#define WTERMSIG(w)	(int)(WIFSIGNALED(w) ? (_W_INT(w) & 0177) : -1)
-#define WCOREFLAG	0x80
-#define WCOREDUMP(w) 	((_W_INT(w)) & WCOREFLAG)
-
-/* Prototype */
-pid_t waitpid(int pid, int *stat_loc, int options);
-
-#endif /* !HAVE_WAITPID */
-#endif /* _BSD_WAITPID_H */
diff --git a/crypto/openssh/openbsd-compat/daemon.c b/crypto/openssh/openbsd-compat/daemon.c
deleted file mode 100644
index 7d23b2467b94..000000000000
--- a/crypto/openssh/openbsd-compat/daemon.c
+++ /dev/null
@@ -1,84 +0,0 @@
-/*-
- * Copyright (c) 1990, 1993
- *	The Regents of the University of California.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *	This product includes software developed by the University of
- *	California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "includes.h"
-
-#ifndef HAVE_DAEMON
-
-#if defined(LIBC_SCCS) && !defined(lint)
-static char rcsid[] = "$OpenBSD: daemon.c,v 1.2 1996/08/19 08:22:13 tholo Exp $";
-#endif /* LIBC_SCCS and not lint */
-
-int
-daemon(nochdir, noclose)
-	int nochdir, noclose;
-{
-	int fd;
-
-	switch (fork()) {
-	case -1:
-		return (-1);
-	case 0:
-#ifdef HAVE_CYGWIN
-		register_9x_service();
-#endif
-		break;
-	default:
-#ifdef HAVE_CYGWIN
-		/*
-		 * This sleep avoids a race condition which kills the
-		 * child process if parent is started by a NT/W2K service.
-		 */
-		sleep(1);
-#endif
-		_exit(0);
-	}
-
-	if (setsid() == -1)
-		return (-1);
-
-	if (!nochdir)
-		(void)chdir("/");
-
-	if (!noclose && (fd = open(_PATH_DEVNULL, O_RDWR, 0)) != -1) {
-		(void)dup2(fd, STDIN_FILENO);
-		(void)dup2(fd, STDOUT_FILENO);
-		(void)dup2(fd, STDERR_FILENO);
-		if (fd > 2)
-			(void)close (fd);
-	}
-	return (0);
-}
-
-#endif /* !HAVE_DAEMON */
-
diff --git a/crypto/openssh/openbsd-compat/daemon.h b/crypto/openssh/openbsd-compat/daemon.h
deleted file mode 100644
index 95a077359868..000000000000
--- a/crypto/openssh/openbsd-compat/daemon.h
+++ /dev/null
@@ -1,11 +0,0 @@
-/* $Id: daemon.h,v 1.2 2001/02/09 01:55:36 djm Exp $ */
-
-#ifndef _BSD_DAEMON_H
-#define _BSD_DAEMON_H
-
-#include "config.h"
-#ifndef HAVE_DAEMON
-int daemon(int nochdir, int noclose);
-#endif /* !HAVE_DAEMON */
-
-#endif /* _BSD_DAEMON_H */
diff --git a/crypto/openssh/openbsd-compat/dirname.c b/crypto/openssh/openbsd-compat/dirname.c
deleted file mode 100644
index 35c7d8ec7e22..000000000000
--- a/crypto/openssh/openbsd-compat/dirname.c
+++ /dev/null
@@ -1,80 +0,0 @@
-/*	$OpenBSD: dirname.c,v 1.7 2002/05/24 21:22:37 deraadt Exp $	*/
-
-/*
- * Copyright (c) 1997 Todd C. Miller <Todd.Miller@courtesan.com>
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. The name of the author may not be used to endorse or promote products
- *    derived from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
- * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL
- * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
- * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
- * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
- * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
- * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-#ifndef HAVE_DIRNAME
-
-#if defined(LIBC_SCCS) && !defined(lint)
-static char rcsid[] = "$OpenBSD: dirname.c,v 1.7 2002/05/24 21:22:37 deraadt Exp $";
-#endif /* LIBC_SCCS and not lint */
-
-#include <errno.h>
-#include <string.h>
-#include <sys/param.h>
-
-char *
-dirname(path)
-	const char *path;
-{
-	static char bname[MAXPATHLEN];
-	register const char *endp;
-
-	/* Empty or NULL string gets treated as "." */
-	if (path == NULL || *path == '\0') {
-		(void)strlcpy(bname, ".", sizeof bname);
-		return(bname);
-	}
-
-	/* Strip trailing slashes */
-	endp = path + strlen(path) - 1;
-	while (endp > path && *endp == '/')
-		endp--;
-
-	/* Find the start of the dir */
-	while (endp > path && *endp != '/')
-		endp--;
-
-	/* Either the dir is "/" or there are no slashes */
-	if (endp == path) {
-		(void)strlcpy(bname, *endp == '/' ? "/" : ".", sizeof bname);
-		return(bname);
-	} else {
-		do {
-			endp--;
-		} while (endp > path && *endp == '/');
-	}
-
-	if (endp - path + 2 > sizeof(bname)) {
-		errno = ENAMETOOLONG;
-		return(NULL);
-	}
-	strlcpy(bname, path, endp - path + 2);
-	return(bname);
-}
-#endif
diff --git a/crypto/openssh/openbsd-compat/dirname.h b/crypto/openssh/openbsd-compat/dirname.h
deleted file mode 100644
index 1d61dd06ca21..000000000000
--- a/crypto/openssh/openbsd-compat/dirname.h
+++ /dev/null
@@ -1,5 +0,0 @@
-#ifndef HAVE_DIRNAME
-
-char *dirname(const char *path);
-
-#endif
diff --git a/crypto/openssh/openbsd-compat/fake-gai-errnos.h b/crypto/openssh/openbsd-compat/fake-gai-errnos.h
deleted file mode 100644
index 5edc31b59339..000000000000
--- a/crypto/openssh/openbsd-compat/fake-gai-errnos.h
+++ /dev/null
@@ -1,14 +0,0 @@
-/*
- * fake library for ssh
- *
- * This file is included in getaddrinfo.c and getnameinfo.c.
- * See getaddrinfo.c and getnameinfo.c.
- */
-
-/* $Id: fake-gai-errnos.h,v 1.2 2001/02/09 01:55:36 djm Exp $ */
-
-/* for old netdb.h */
-#ifndef EAI_NODATA
-#define EAI_NODATA	1
-#define EAI_MEMORY	2
-#endif
diff --git a/crypto/openssh/openbsd-compat/fake-getaddrinfo.c b/crypto/openssh/openbsd-compat/fake-getaddrinfo.c
deleted file mode 100644
index e63bda9704de..000000000000
--- a/crypto/openssh/openbsd-compat/fake-getaddrinfo.c
+++ /dev/null
@@ -1,135 +0,0 @@
-/*
- * fake library for ssh
- *
- * This file includes getaddrinfo(), freeaddrinfo() and gai_strerror().
- * These funtions are defined in rfc2133.
- *
- * But these functions are not implemented correctly. The minimum subset
- * is implemented for ssh use only. For exapmle, this routine assumes
- * that ai_family is AF_INET. Don't use it for another purpose.
- */
-
-#include "includes.h"
-#include "ssh.h"
-
-RCSID("$Id: fake-getaddrinfo.c,v 1.5 2003/03/24 02:35:59 djm Exp $");
-
-#ifndef HAVE_GAI_STRERROR
-char *gai_strerror(int ecode)
-{
-	switch (ecode) {
-		case EAI_NODATA:
-			return "no address associated with hostname.";
-		case EAI_MEMORY:
-			return "memory allocation failure.";
-		default:
-			return "unknown error.";
-	}
-}    
-#endif /* !HAVE_GAI_STRERROR */
-
-#ifndef HAVE_FREEADDRINFO
-void freeaddrinfo(struct addrinfo *ai)
-{
-	struct addrinfo *next;
-
-	do {
-		next = ai->ai_next;
-		free(ai);
-	} while (NULL != (ai = next));
-}
-#endif /* !HAVE_FREEADDRINFO */
-
-#ifndef HAVE_GETADDRINFO
-static struct addrinfo *malloc_ai(int port, u_long addr)
-{
-	struct addrinfo *ai;
-
-	ai = malloc(sizeof(struct addrinfo) + sizeof(struct sockaddr_in));
-	if (ai == NULL)
-		return(NULL);
-	
-	memset(ai, 0, sizeof(struct addrinfo) + sizeof(struct sockaddr_in));
-	
-	ai->ai_addr = (struct sockaddr *)(ai + 1);
-	/* XXX -- ssh doesn't use sa_len */
-	ai->ai_addrlen = sizeof(struct sockaddr_in);
-	ai->ai_addr->sa_family = ai->ai_family = AF_INET;
-
-	((struct sockaddr_in *)(ai)->ai_addr)->sin_port = port;
-	((struct sockaddr_in *)(ai)->ai_addr)->sin_addr.s_addr = addr;
-	
-	return(ai);
-}
-
-int getaddrinfo(const char *hostname, const char *servname, 
-                const struct addrinfo *hints, struct addrinfo **res)
-{
-	struct addrinfo *cur, *prev = NULL;
-	struct hostent *hp;
-	struct servent *sp;
-	struct in_addr in;
-	int i;
-	long int port;
-	u_long addr;
-
-	port = 0;
-	if (servname != NULL) {
-		char *cp;
-
-		port = strtol(servname, &cp, 10);
-		if (port > 0 && port <= 65535 && *cp == '\0')
-			port = htons(port);
-		else if ((sp = getservbyname(servname, NULL)) != NULL)
-			port = sp->s_port;
-		else
-			port = 0;
-	}
-
-	if (hints && hints->ai_flags & AI_PASSIVE) {
-		addr = htonl(0x00000000);
-		if (hostname && inet_aton(hostname, &in) != 0)
-			addr = in.s_addr;
-		if (NULL != (*res = malloc_ai(port, addr)))
-			return 0;
-		else
-			return EAI_MEMORY;
-	}
-		
-	if (!hostname) {
-		if (NULL != (*res = malloc_ai(port, htonl(0x7f000001))))
-			return 0;
-		else
-			return EAI_MEMORY;
-	}
-	
-	if (inet_aton(hostname, &in)) {
-		if (NULL != (*res = malloc_ai(port, in.s_addr)))
-			return 0;
-		else
-			return EAI_MEMORY;
-	}
-	
-	hp = gethostbyname(hostname);
-	if (hp && hp->h_name && hp->h_name[0] && hp->h_addr_list[0]) {
-		for (i = 0; hp->h_addr_list[i]; i++) {
-			cur = malloc_ai(port, ((struct in_addr *)hp->h_addr_list[i])->s_addr);
-			if (cur == NULL) {
-				if (*res)
-					freeaddrinfo(*res);
-				return EAI_MEMORY;
-			}
-			
-			if (prev)
-				prev->ai_next = cur;
-			else
-				*res = cur;
-
-			prev = cur;
-		}
-		return 0;
-	}
-	
-	return EAI_NODATA;
-}
-#endif /* !HAVE_GETADDRINFO */
diff --git a/crypto/openssh/openbsd-compat/fake-getaddrinfo.h b/crypto/openssh/openbsd-compat/fake-getaddrinfo.h
deleted file mode 100644
index 6943378e9850..000000000000
--- a/crypto/openssh/openbsd-compat/fake-getaddrinfo.h
+++ /dev/null
@@ -1,47 +0,0 @@
-/* $Id: fake-getaddrinfo.h,v 1.4 2003/02/24 01:35:09 djm Exp $ */
-
-#ifndef _FAKE_GETADDRINFO_H
-#define _FAKE_GETADDRINFO_H
-
-#include "config.h"
-
-#include "fake-gai-errnos.h"
-
-#ifndef AI_PASSIVE
-# define AI_PASSIVE        1
-# define AI_CANONNAME      2
-#endif
-
-#ifndef NI_NUMERICHOST
-# define NI_NUMERICHOST    2
-# define NI_NAMEREQD       4
-# define NI_NUMERICSERV    8
-#endif
-
-#ifndef HAVE_STRUCT_ADDRINFO
-struct addrinfo {
-	int	ai_flags;	/* AI_PASSIVE, AI_CANONNAME */
-	int	ai_family;	/* PF_xxx */
-	int	ai_socktype;	/* SOCK_xxx */
-	int	ai_protocol;	/* 0 or IPPROTO_xxx for IPv4 and IPv6 */
-	size_t	ai_addrlen;	/* length of ai_addr */
-	char	*ai_canonname;	/* canonical name for hostname */
-	struct sockaddr *ai_addr;	/* binary address */
-	struct addrinfo *ai_next;	/* next structure in linked list */
-};
-#endif /* !HAVE_STRUCT_ADDRINFO */
-
-#ifndef HAVE_GETADDRINFO
-int getaddrinfo(const char *hostname, const char *servname, 
-                const struct addrinfo *hints, struct addrinfo **res);
-#endif /* !HAVE_GETADDRINFO */
-
-#ifndef HAVE_GAI_STRERROR
-char *gai_strerror(int ecode);
-#endif /* !HAVE_GAI_STRERROR */
-
-#ifndef HAVE_FREEADDRINFO
-void freeaddrinfo(struct addrinfo *ai);
-#endif /* !HAVE_FREEADDRINFO */
-
-#endif /* _FAKE_GETADDRINFO_H */
diff --git a/crypto/openssh/openbsd-compat/fake-getnameinfo.c b/crypto/openssh/openbsd-compat/fake-getnameinfo.c
deleted file mode 100644
index e255ed333eba..000000000000
--- a/crypto/openssh/openbsd-compat/fake-getnameinfo.c
+++ /dev/null
@@ -1,55 +0,0 @@
-/*
- * fake library for ssh
- *
- * This file includes getnameinfo().
- * These funtions are defined in rfc2133.
- *
- * But these functions are not implemented correctly. The minimum subset
- * is implemented for ssh use only. For exapmle, this routine assumes
- * that ai_family is AF_INET. Don't use it for another purpose.
- */
-
-#include "includes.h"
-#include "ssh.h"
-
-RCSID("$Id: fake-getnameinfo.c,v 1.2 2001/02/09 01:55:36 djm Exp $");
-
-#ifndef HAVE_GETNAMEINFO
-int getnameinfo(const struct sockaddr *sa, size_t salen, char *host, 
-                size_t hostlen, char *serv, size_t servlen, int flags)
-{
-	struct sockaddr_in *sin = (struct sockaddr_in *)sa;
-	struct hostent *hp;
-	char tmpserv[16];
-
-	if (serv) {
-		snprintf(tmpserv, sizeof(tmpserv), "%d", ntohs(sin->sin_port));
-		if (strlen(tmpserv) >= servlen)
-			return EAI_MEMORY;
-		else
-			strcpy(serv, tmpserv);
-	}
-
-	if (host) {
-		if (flags & NI_NUMERICHOST) {
-			if (strlen(inet_ntoa(sin->sin_addr)) >= hostlen)
-				return EAI_MEMORY;
-
-			strcpy(host, inet_ntoa(sin->sin_addr));
-			return 0;
-		} else {
-			hp = gethostbyaddr((char *)&sin->sin_addr, 
-				sizeof(struct in_addr), AF_INET);
-			if (hp == NULL)
-				return EAI_NODATA;
-			
-			if (strlen(hp->h_name) >= hostlen)
-				return EAI_MEMORY;
-
-			strcpy(host, hp->h_name);
-			return 0;
-		}
-	}
-	return 0;
-}
-#endif /* !HAVE_GETNAMEINFO */
diff --git a/crypto/openssh/openbsd-compat/fake-getnameinfo.h b/crypto/openssh/openbsd-compat/fake-getnameinfo.h
deleted file mode 100644
index c9b7908aa22f..000000000000
--- a/crypto/openssh/openbsd-compat/fake-getnameinfo.h
+++ /dev/null
@@ -1,20 +0,0 @@
-/* $Id: fake-getnameinfo.h,v 1.2 2001/02/09 01:55:36 djm Exp $ */
-
-#ifndef _FAKE_GETNAMEINFO_H
-#define _FAKE_GETNAMEINFO_H
-
-#include "config.h"
-
-#ifndef HAVE_GETNAMEINFO
-int getnameinfo(const struct sockaddr *sa, size_t salen, char *host, 
-                size_t hostlen, char *serv, size_t servlen, int flags);
-#endif /* !HAVE_GETNAMEINFO */
-
-#ifndef NI_MAXSERV
-# define NI_MAXSERV 32
-#endif /* !NI_MAXSERV */
-#ifndef NI_MAXHOST
-# define NI_MAXHOST 1025
-#endif /* !NI_MAXHOST */
-
-#endif /* _FAKE_GETNAMEINFO_H */
diff --git a/crypto/openssh/openbsd-compat/fake-queue.h b/crypto/openssh/openbsd-compat/fake-queue.h
deleted file mode 100644
index 176fe31741c3..000000000000
--- a/crypto/openssh/openbsd-compat/fake-queue.h
+++ /dev/null
@@ -1,584 +0,0 @@
-/*	$OpenBSD: queue.h,v 1.22 2001/06/23 04:39:35 angelos Exp $	*/
-/*	$NetBSD: queue.h,v 1.11 1996/05/16 05:17:14 mycroft Exp $	*/
-
-/*
- * Copyright (c) 1991, 1993
- *	The Regents of the University of California.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *	This product includes software developed by the University of
- *	California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- *	@(#)queue.h	8.5 (Berkeley) 8/20/94
- */
-
-#ifndef	_FAKE_QUEUE_H_
-#define	_FAKE_QUEUE_H_
-
-/*
- * Ignore all <sys/queue.h> since older platforms have broken/incomplete
- * <sys/queue.h> that are too hard to work around.
- */
-#undef SLIST_HEAD
-#undef SLIST_HEAD_INITIALIZER
-#undef SLIST_ENTRY
-#undef SLIST_FIRST
-#undef SLIST_END
-#undef SLIST_EMPTY
-#undef SLIST_NEXT
-#undef SLIST_FOREACH
-#undef SLIST_INIT
-#undef SLIST_INSERT_AFTER
-#undef SLIST_INSERT_HEAD
-#undef SLIST_REMOVE_HEAD
-#undef SLIST_REMOVE
-#undef LIST_HEAD
-#undef LIST_HEAD_INITIALIZER
-#undef LIST_ENTRY
-#undef LIST_FIRST
-#undef LIST_END
-#undef LIST_EMPTY
-#undef LIST_NEXT
-#undef LIST_FOREACH
-#undef LIST_INIT
-#undef LIST_INSERT_AFTER
-#undef LIST_INSERT_BEFORE
-#undef LIST_INSERT_HEAD
-#undef LIST_REMOVE
-#undef LIST_REPLACE
-#undef SIMPLEQ_HEAD
-#undef SIMPLEQ_HEAD_INITIALIZER
-#undef SIMPLEQ_ENTRY
-#undef SIMPLEQ_FIRST
-#undef SIMPLEQ_END
-#undef SIMPLEQ_EMPTY
-#undef SIMPLEQ_NEXT
-#undef SIMPLEQ_FOREACH
-#undef SIMPLEQ_INIT
-#undef SIMPLEQ_INSERT_HEAD
-#undef SIMPLEQ_INSERT_TAIL
-#undef SIMPLEQ_INSERT_AFTER
-#undef SIMPLEQ_REMOVE_HEAD
-#undef TAILQ_HEAD
-#undef TAILQ_HEAD_INITIALIZER
-#undef TAILQ_ENTRY
-#undef TAILQ_FIRST
-#undef TAILQ_END
-#undef TAILQ_NEXT
-#undef TAILQ_LAST
-#undef TAILQ_PREV
-#undef TAILQ_EMPTY
-#undef TAILQ_FOREACH
-#undef TAILQ_FOREACH_REVERSE
-#undef TAILQ_INIT
-#undef TAILQ_INSERT_HEAD
-#undef TAILQ_INSERT_TAIL
-#undef TAILQ_INSERT_AFTER
-#undef TAILQ_INSERT_BEFORE
-#undef TAILQ_REMOVE
-#undef TAILQ_REPLACE
-#undef CIRCLEQ_HEAD
-#undef CIRCLEQ_HEAD_INITIALIZER
-#undef CIRCLEQ_ENTRY
-#undef CIRCLEQ_FIRST
-#undef CIRCLEQ_LAST
-#undef CIRCLEQ_END
-#undef CIRCLEQ_NEXT
-#undef CIRCLEQ_PREV
-#undef CIRCLEQ_EMPTY
-#undef CIRCLEQ_FOREACH
-#undef CIRCLEQ_FOREACH_REVERSE
-#undef CIRCLEQ_INIT
-#undef CIRCLEQ_INSERT_AFTER
-#undef CIRCLEQ_INSERT_BEFORE
-#undef CIRCLEQ_INSERT_HEAD
-#undef CIRCLEQ_INSERT_TAIL
-#undef CIRCLEQ_REMOVE
-#undef CIRCLEQ_REPLACE
-
-/*
- * This file defines five types of data structures: singly-linked lists, 
- * lists, simple queues, tail queues, and circular queues.
- *
- *
- * A singly-linked list is headed by a single forward pointer. The elements
- * are singly linked for minimum space and pointer manipulation overhead at
- * the expense of O(n) removal for arbitrary elements. New elements can be
- * added to the list after an existing element or at the head of the list.
- * Elements being removed from the head of the list should use the explicit
- * macro for this purpose for optimum efficiency. A singly-linked list may
- * only be traversed in the forward direction.  Singly-linked lists are ideal
- * for applications with large datasets and few or no removals or for
- * implementing a LIFO queue.
- *
- * A list is headed by a single forward pointer (or an array of forward
- * pointers for a hash table header). The elements are doubly linked
- * so that an arbitrary element can be removed without a need to
- * traverse the list. New elements can be added to the list before
- * or after an existing element or at the head of the list. A list
- * may only be traversed in the forward direction.
- *
- * A simple queue is headed by a pair of pointers, one the head of the
- * list and the other to the tail of the list. The elements are singly
- * linked to save space, so elements can only be removed from the
- * head of the list. New elements can be added to the list before or after
- * an existing element, at the head of the list, or at the end of the
- * list. A simple queue may only be traversed in the forward direction.
- *
- * A tail queue is headed by a pair of pointers, one to the head of the
- * list and the other to the tail of the list. The elements are doubly
- * linked so that an arbitrary element can be removed without a need to
- * traverse the list. New elements can be added to the list before or
- * after an existing element, at the head of the list, or at the end of
- * the list. A tail queue may be traversed in either direction.
- *
- * A circle queue is headed by a pair of pointers, one to the head of the
- * list and the other to the tail of the list. The elements are doubly
- * linked so that an arbitrary element can be removed without a need to
- * traverse the list. New elements can be added to the list before or after
- * an existing element, at the head of the list, or at the end of the list.
- * A circle queue may be traversed in either direction, but has a more
- * complex end of list detection.
- *
- * For details on the use of these macros, see the queue(3) manual page.
- */
-
-/*
- * Singly-linked List definitions.
- */
-#define SLIST_HEAD(name, type)						\
-struct name {								\
-	struct type *slh_first;	/* first element */			\
-}
- 
-#define	SLIST_HEAD_INITIALIZER(head)					\
-	{ NULL }
- 
-#define SLIST_ENTRY(type)						\
-struct {								\
-	struct type *sle_next;	/* next element */			\
-}
- 
-/*
- * Singly-linked List access methods.
- */
-#define	SLIST_FIRST(head)	((head)->slh_first)
-#define	SLIST_END(head)		NULL
-#define	SLIST_EMPTY(head)	(SLIST_FIRST(head) == SLIST_END(head))
-#define	SLIST_NEXT(elm, field)	((elm)->field.sle_next)
-
-#define	SLIST_FOREACH(var, head, field)					\
-	for((var) = SLIST_FIRST(head);					\
-	    (var) != SLIST_END(head);					\
-	    (var) = SLIST_NEXT(var, field))
-
-/*
- * Singly-linked List functions.
- */
-#define	SLIST_INIT(head) {						\
-	SLIST_FIRST(head) = SLIST_END(head);				\
-}
-
-#define	SLIST_INSERT_AFTER(slistelm, elm, field) do {			\
-	(elm)->field.sle_next = (slistelm)->field.sle_next;		\
-	(slistelm)->field.sle_next = (elm);				\
-} while (0)
-
-#define	SLIST_INSERT_HEAD(head, elm, field) do {			\
-	(elm)->field.sle_next = (head)->slh_first;			\
-	(head)->slh_first = (elm);					\
-} while (0)
-
-#define	SLIST_REMOVE_HEAD(head, field) do {				\
-	(head)->slh_first = (head)->slh_first->field.sle_next;		\
-} while (0)
-
-#define SLIST_REMOVE(head, elm, type, field) do {			\
-	if ((head)->slh_first == (elm)) {				\
-		SLIST_REMOVE_HEAD((head), field);			\
-	}								\
-	else {								\
-		struct type *curelm = (head)->slh_first;		\
-		while( curelm->field.sle_next != (elm) )		\
-			curelm = curelm->field.sle_next;		\
-		curelm->field.sle_next =				\
-		    curelm->field.sle_next->field.sle_next;		\
-	}								\
-} while (0)
-
-/*
- * List definitions.
- */
-#define LIST_HEAD(name, type)						\
-struct name {								\
-	struct type *lh_first;	/* first element */			\
-}
-
-#define LIST_HEAD_INITIALIZER(head)					\
-	{ NULL }
-
-#define LIST_ENTRY(type)						\
-struct {								\
-	struct type *le_next;	/* next element */			\
-	struct type **le_prev;	/* address of previous next element */	\
-}
-
-/*
- * List access methods
- */
-#define	LIST_FIRST(head)		((head)->lh_first)
-#define	LIST_END(head)			NULL
-#define	LIST_EMPTY(head)		(LIST_FIRST(head) == LIST_END(head))
-#define	LIST_NEXT(elm, field)		((elm)->field.le_next)
-
-#define LIST_FOREACH(var, head, field)					\
-	for((var) = LIST_FIRST(head);					\
-	    (var)!= LIST_END(head);					\
-	    (var) = LIST_NEXT(var, field))
-
-/*
- * List functions.
- */
-#define	LIST_INIT(head) do {						\
-	LIST_FIRST(head) = LIST_END(head);				\
-} while (0)
-
-#define LIST_INSERT_AFTER(listelm, elm, field) do {			\
-	if (((elm)->field.le_next = (listelm)->field.le_next) != NULL)	\
-		(listelm)->field.le_next->field.le_prev =		\
-		    &(elm)->field.le_next;				\
-	(listelm)->field.le_next = (elm);				\
-	(elm)->field.le_prev = &(listelm)->field.le_next;		\
-} while (0)
-
-#define	LIST_INSERT_BEFORE(listelm, elm, field) do {			\
-	(elm)->field.le_prev = (listelm)->field.le_prev;		\
-	(elm)->field.le_next = (listelm);				\
-	*(listelm)->field.le_prev = (elm);				\
-	(listelm)->field.le_prev = &(elm)->field.le_next;		\
-} while (0)
-
-#define LIST_INSERT_HEAD(head, elm, field) do {				\
-	if (((elm)->field.le_next = (head)->lh_first) != NULL)		\
-		(head)->lh_first->field.le_prev = &(elm)->field.le_next;\
-	(head)->lh_first = (elm);					\
-	(elm)->field.le_prev = &(head)->lh_first;			\
-} while (0)
-
-#define LIST_REMOVE(elm, field) do {					\
-	if ((elm)->field.le_next != NULL)				\
-		(elm)->field.le_next->field.le_prev =			\
-		    (elm)->field.le_prev;				\
-	*(elm)->field.le_prev = (elm)->field.le_next;			\
-} while (0)
-
-#define LIST_REPLACE(elm, elm2, field) do {				\
-	if (((elm2)->field.le_next = (elm)->field.le_next) != NULL)	\
-		(elm2)->field.le_next->field.le_prev =			\
-		    &(elm2)->field.le_next;				\
-	(elm2)->field.le_prev = (elm)->field.le_prev;			\
-	*(elm2)->field.le_prev = (elm2);				\
-} while (0)
-
-/*
- * Simple queue definitions.
- */
-#define SIMPLEQ_HEAD(name, type)					\
-struct name {								\
-	struct type *sqh_first;	/* first element */			\
-	struct type **sqh_last;	/* addr of last next element */		\
-}
-
-#define SIMPLEQ_HEAD_INITIALIZER(head)					\
-	{ NULL, &(head).sqh_first }
-
-#define SIMPLEQ_ENTRY(type)						\
-struct {								\
-	struct type *sqe_next;	/* next element */			\
-}
-
-/*
- * Simple queue access methods.
- */
-#define	SIMPLEQ_FIRST(head)	    ((head)->sqh_first)
-#define	SIMPLEQ_END(head)	    NULL
-#define	SIMPLEQ_EMPTY(head)	    (SIMPLEQ_FIRST(head) == SIMPLEQ_END(head))
-#define	SIMPLEQ_NEXT(elm, field)    ((elm)->field.sqe_next)
-
-#define SIMPLEQ_FOREACH(var, head, field)				\
-	for((var) = SIMPLEQ_FIRST(head);				\
-	    (var) != SIMPLEQ_END(head);					\
-	    (var) = SIMPLEQ_NEXT(var, field))
-
-/*
- * Simple queue functions.
- */
-#define	SIMPLEQ_INIT(head) do {						\
-	(head)->sqh_first = NULL;					\
-	(head)->sqh_last = &(head)->sqh_first;				\
-} while (0)
-
-#define SIMPLEQ_INSERT_HEAD(head, elm, field) do {			\
-	if (((elm)->field.sqe_next = (head)->sqh_first) == NULL)	\
-		(head)->sqh_last = &(elm)->field.sqe_next;		\
-	(head)->sqh_first = (elm);					\
-} while (0)
-
-#define SIMPLEQ_INSERT_TAIL(head, elm, field) do {			\
-	(elm)->field.sqe_next = NULL;					\
-	*(head)->sqh_last = (elm);					\
-	(head)->sqh_last = &(elm)->field.sqe_next;			\
-} while (0)
-
-#define SIMPLEQ_INSERT_AFTER(head, listelm, elm, field) do {		\
-	if (((elm)->field.sqe_next = (listelm)->field.sqe_next) == NULL)\
-		(head)->sqh_last = &(elm)->field.sqe_next;		\
-	(listelm)->field.sqe_next = (elm);				\
-} while (0)
-
-#define SIMPLEQ_REMOVE_HEAD(head, elm, field) do {			\
-	if (((head)->sqh_first = (elm)->field.sqe_next) == NULL)	\
-		(head)->sqh_last = &(head)->sqh_first;			\
-} while (0)
-
-/*
- * Tail queue definitions.
- */
-#define TAILQ_HEAD(name, type)						\
-struct name {								\
-	struct type *tqh_first;	/* first element */			\
-	struct type **tqh_last;	/* addr of last next element */		\
-}
-
-#define TAILQ_HEAD_INITIALIZER(head)					\
-	{ NULL, &(head).tqh_first }
-
-#define TAILQ_ENTRY(type)						\
-struct {								\
-	struct type *tqe_next;	/* next element */			\
-	struct type **tqe_prev;	/* address of previous next element */	\
-}
-
-/* 
- * tail queue access methods 
- */
-#define	TAILQ_FIRST(head)		((head)->tqh_first)
-#define	TAILQ_END(head)			NULL
-#define	TAILQ_NEXT(elm, field)		((elm)->field.tqe_next)
-#define TAILQ_LAST(head, headname)					\
-	(*(((struct headname *)((head)->tqh_last))->tqh_last))
-/* XXX */
-#define TAILQ_PREV(elm, headname, field)				\
-	(*(((struct headname *)((elm)->field.tqe_prev))->tqh_last))
-#define	TAILQ_EMPTY(head)						\
-	(TAILQ_FIRST(head) == TAILQ_END(head))
-
-#define TAILQ_FOREACH(var, head, field)					\
-	for((var) = TAILQ_FIRST(head);					\
-	    (var) != TAILQ_END(head);					\
-	    (var) = TAILQ_NEXT(var, field))
-
-#define TAILQ_FOREACH_REVERSE(var, head, field, headname)		\
-	for((var) = TAILQ_LAST(head, headname);				\
-	    (var) != TAILQ_END(head);					\
-	    (var) = TAILQ_PREV(var, headname, field))
-
-/*
- * Tail queue functions.
- */
-#define	TAILQ_INIT(head) do {						\
-	(head)->tqh_first = NULL;					\
-	(head)->tqh_last = &(head)->tqh_first;				\
-} while (0)
-
-#define TAILQ_INSERT_HEAD(head, elm, field) do {			\
-	if (((elm)->field.tqe_next = (head)->tqh_first) != NULL)	\
-		(head)->tqh_first->field.tqe_prev =			\
-		    &(elm)->field.tqe_next;				\
-	else								\
-		(head)->tqh_last = &(elm)->field.tqe_next;		\
-	(head)->tqh_first = (elm);					\
-	(elm)->field.tqe_prev = &(head)->tqh_first;			\
-} while (0)
-
-#define TAILQ_INSERT_TAIL(head, elm, field) do {			\
-	(elm)->field.tqe_next = NULL;					\
-	(elm)->field.tqe_prev = (head)->tqh_last;			\
-	*(head)->tqh_last = (elm);					\
-	(head)->tqh_last = &(elm)->field.tqe_next;			\
-} while (0)
-
-#define TAILQ_INSERT_AFTER(head, listelm, elm, field) do {		\
-	if (((elm)->field.tqe_next = (listelm)->field.tqe_next) != NULL)\
-		(elm)->field.tqe_next->field.tqe_prev =			\
-		    &(elm)->field.tqe_next;				\
-	else								\
-		(head)->tqh_last = &(elm)->field.tqe_next;		\
-	(listelm)->field.tqe_next = (elm);				\
-	(elm)->field.tqe_prev = &(listelm)->field.tqe_next;		\
-} while (0)
-
-#define	TAILQ_INSERT_BEFORE(listelm, elm, field) do {			\
-	(elm)->field.tqe_prev = (listelm)->field.tqe_prev;		\
-	(elm)->field.tqe_next = (listelm);				\
-	*(listelm)->field.tqe_prev = (elm);				\
-	(listelm)->field.tqe_prev = &(elm)->field.tqe_next;		\
-} while (0)
-
-#define TAILQ_REMOVE(head, elm, field) do {				\
-	if (((elm)->field.tqe_next) != NULL)				\
-		(elm)->field.tqe_next->field.tqe_prev =			\
-		    (elm)->field.tqe_prev;				\
-	else								\
-		(head)->tqh_last = (elm)->field.tqe_prev;		\
-	*(elm)->field.tqe_prev = (elm)->field.tqe_next;			\
-} while (0)
-
-#define TAILQ_REPLACE(head, elm, elm2, field) do {			\
-	if (((elm2)->field.tqe_next = (elm)->field.tqe_next) != NULL)	\
-		(elm2)->field.tqe_next->field.tqe_prev =		\
-		    &(elm2)->field.tqe_next;				\
-	else								\
-		(head)->tqh_last = &(elm2)->field.tqe_next;		\
-	(elm2)->field.tqe_prev = (elm)->field.tqe_prev;			\
-	*(elm2)->field.tqe_prev = (elm2);				\
-} while (0)
-
-/*
- * Circular queue definitions.
- */
-#define CIRCLEQ_HEAD(name, type)					\
-struct name {								\
-	struct type *cqh_first;		/* first element */		\
-	struct type *cqh_last;		/* last element */		\
-}
-
-#define CIRCLEQ_HEAD_INITIALIZER(head)					\
-	{ CIRCLEQ_END(&head), CIRCLEQ_END(&head) }
-
-#define CIRCLEQ_ENTRY(type)						\
-struct {								\
-	struct type *cqe_next;		/* next element */		\
-	struct type *cqe_prev;		/* previous element */		\
-}
-
-/*
- * Circular queue access methods 
- */
-#define	CIRCLEQ_FIRST(head)		((head)->cqh_first)
-#define	CIRCLEQ_LAST(head)		((head)->cqh_last)
-#define	CIRCLEQ_END(head)		((void *)(head))
-#define	CIRCLEQ_NEXT(elm, field)	((elm)->field.cqe_next)
-#define	CIRCLEQ_PREV(elm, field)	((elm)->field.cqe_prev)
-#define	CIRCLEQ_EMPTY(head)						\
-	(CIRCLEQ_FIRST(head) == CIRCLEQ_END(head))
-
-#define CIRCLEQ_FOREACH(var, head, field)				\
-	for((var) = CIRCLEQ_FIRST(head);				\
-	    (var) != CIRCLEQ_END(head);					\
-	    (var) = CIRCLEQ_NEXT(var, field))
-
-#define CIRCLEQ_FOREACH_REVERSE(var, head, field)			\
-	for((var) = CIRCLEQ_LAST(head);					\
-	    (var) != CIRCLEQ_END(head);					\
-	    (var) = CIRCLEQ_PREV(var, field))
-
-/*
- * Circular queue functions.
- */
-#define	CIRCLEQ_INIT(head) do {						\
-	(head)->cqh_first = CIRCLEQ_END(head);				\
-	(head)->cqh_last = CIRCLEQ_END(head);				\
-} while (0)
-
-#define CIRCLEQ_INSERT_AFTER(head, listelm, elm, field) do {		\
-	(elm)->field.cqe_next = (listelm)->field.cqe_next;		\
-	(elm)->field.cqe_prev = (listelm);				\
-	if ((listelm)->field.cqe_next == CIRCLEQ_END(head))		\
-		(head)->cqh_last = (elm);				\
-	else								\
-		(listelm)->field.cqe_next->field.cqe_prev = (elm);	\
-	(listelm)->field.cqe_next = (elm);				\
-} while (0)
-
-#define CIRCLEQ_INSERT_BEFORE(head, listelm, elm, field) do {		\
-	(elm)->field.cqe_next = (listelm);				\
-	(elm)->field.cqe_prev = (listelm)->field.cqe_prev;		\
-	if ((listelm)->field.cqe_prev == CIRCLEQ_END(head))		\
-		(head)->cqh_first = (elm);				\
-	else								\
-		(listelm)->field.cqe_prev->field.cqe_next = (elm);	\
-	(listelm)->field.cqe_prev = (elm);				\
-} while (0)
-
-#define CIRCLEQ_INSERT_HEAD(head, elm, field) do {			\
-	(elm)->field.cqe_next = (head)->cqh_first;			\
-	(elm)->field.cqe_prev = CIRCLEQ_END(head);			\
-	if ((head)->cqh_last == CIRCLEQ_END(head))			\
-		(head)->cqh_last = (elm);				\
-	else								\
-		(head)->cqh_first->field.cqe_prev = (elm);		\
-	(head)->cqh_first = (elm);					\
-} while (0)
-
-#define CIRCLEQ_INSERT_TAIL(head, elm, field) do {			\
-	(elm)->field.cqe_next = CIRCLEQ_END(head);			\
-	(elm)->field.cqe_prev = (head)->cqh_last;			\
-	if ((head)->cqh_first == CIRCLEQ_END(head))			\
-		(head)->cqh_first = (elm);				\
-	else								\
-		(head)->cqh_last->field.cqe_next = (elm);		\
-	(head)->cqh_last = (elm);					\
-} while (0)
-
-#define	CIRCLEQ_REMOVE(head, elm, field) do {				\
-	if ((elm)->field.cqe_next == CIRCLEQ_END(head))			\
-		(head)->cqh_last = (elm)->field.cqe_prev;		\
-	else								\
-		(elm)->field.cqe_next->field.cqe_prev =			\
-		    (elm)->field.cqe_prev;				\
-	if ((elm)->field.cqe_prev == CIRCLEQ_END(head))			\
-		(head)->cqh_first = (elm)->field.cqe_next;		\
-	else								\
-		(elm)->field.cqe_prev->field.cqe_next =			\
-		    (elm)->field.cqe_next;				\
-} while (0)
-
-#define CIRCLEQ_REPLACE(head, elm, elm2, field) do {			\
-	if (((elm2)->field.cqe_next = (elm)->field.cqe_next) ==		\
-	    CIRCLEQ_END(head))						\
-		(head).cqh_last = (elm2);				\
-	else								\
-		(elm2)->field.cqe_next->field.cqe_prev = (elm2);	\
-	if (((elm2)->field.cqe_prev = (elm)->field.cqe_prev) ==		\
-	    CIRCLEQ_END(head))						\
-		(head).cqh_first = (elm2);				\
-	else								\
-		(elm2)->field.cqe_prev->field.cqe_next = (elm2);	\
-} while (0)
-
-#endif	/* !_FAKE_QUEUE_H_ */
diff --git a/crypto/openssh/openbsd-compat/fake-socket.h b/crypto/openssh/openbsd-compat/fake-socket.h
deleted file mode 100644
index f364797fab5b..000000000000
--- a/crypto/openssh/openbsd-compat/fake-socket.h
+++ /dev/null
@@ -1,47 +0,0 @@
-/* $Id: fake-socket.h,v 1.3 2002/04/12 03:35:40 tim Exp $ */
-
-#ifndef _FAKE_SOCKET_H
-#define _FAKE_SOCKET_H
-
-#include "includes.h"
-#include "sys/types.h"
-
-#ifndef HAVE_STRUCT_SOCKADDR_STORAGE
-# define	_SS_MAXSIZE	128	/* Implementation specific max size */
-# define       _SS_PADSIZE     (_SS_MAXSIZE - sizeof (struct sockaddr))
-
-struct sockaddr_storage {
-	struct	sockaddr ss_sa;
-	char		__ss_pad2[_SS_PADSIZE];
-};
-# define ss_family ss_sa.sa_family
-#endif /* !HAVE_STRUCT_SOCKADDR_STORAGE */
-
-#ifndef IN6_IS_ADDR_LOOPBACK
-# define IN6_IS_ADDR_LOOPBACK(a) \
-	(((u_int32_t *) (a))[0] == 0 && ((u_int32_t *) (a))[1] == 0 && \
-	 ((u_int32_t *) (a))[2] == 0 && ((u_int32_t *) (a))[3] == htonl (1))
-#endif /* !IN6_IS_ADDR_LOOPBACK */
-
-#ifndef HAVE_STRUCT_IN6_ADDR
-struct in6_addr {
-	u_int8_t		s6_addr[16];
-};
-#endif /* !HAVE_STRUCT_IN6_ADDR */
-
-#ifndef HAVE_STRUCT_SOCKADDR_IN6
-struct sockaddr_in6 {
-   unsigned short sin6_family;
-	u_int16_t sin6_port;
-	u_int32_t sin6_flowinfo;
-	struct in6_addr sin6_addr;
-};
-#endif /* !HAVE_STRUCT_SOCKADDR_IN6 */
-
-#ifndef AF_INET6
-/* Define it to something that should never appear */
-#define AF_INET6 AF_MAX
-#endif
-
-#endif /* !_FAKE_SOCKET_H */
-
diff --git a/crypto/openssh/openbsd-compat/getcwd.c b/crypto/openssh/openbsd-compat/getcwd.c
deleted file mode 100644
index f4b98e824937..000000000000
--- a/crypto/openssh/openbsd-compat/getcwd.c
+++ /dev/null
@@ -1,237 +0,0 @@
-/*
- * Copyright (c) 1989, 1991, 1993
- *	The Regents of the University of California.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "includes.h"
-
-#if !defined(HAVE_GETCWD)
-
-#if defined(LIBC_SCCS) && !defined(lint)
-static char rcsid[] = "$OpenBSD: getcwd.c,v 1.7 2002/11/24 01:52:27 cloder Exp $";
-#endif /* LIBC_SCCS and not lint */
-
-#include <sys/param.h>
-#include <sys/stat.h>
-#include <errno.h>
-#include <dirent.h>
-#include <sys/dir.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include "includes.h"
-
-#define	ISDOT(dp) \
-	(dp->d_name[0] == '.' && (dp->d_name[1] == '\0' || \
-	    (dp->d_name[1] == '.' && dp->d_name[2] == '\0')))
-
-char *
-getcwd(char *pt,size_t size)
-{
-	register struct dirent *dp;
-	register DIR *dir = NULL;
-	register dev_t dev;
-	register ino_t ino;
-	register int first;
-	register char *bpt, *bup;
-	struct stat s;
-	dev_t root_dev;
-	ino_t root_ino;
-	size_t ptsize, upsize;
-	int save_errno;
-	char *ept, *eup, *up;
-
-	/*
-	 * If no buffer specified by the user, allocate one as necessary.
-	 * If a buffer is specified, the size has to be non-zero.  The path
-	 * is built from the end of the buffer backwards.
-	 */
-	if (pt) {
-		ptsize = 0;
-		if (!size) {
-			errno = EINVAL;
-			return (NULL);
-		}
-		ept = pt + size;
-	} else {
-		if ((pt = malloc(ptsize = 1024 - 4)) == NULL)
-			return (NULL);
-		ept = pt + ptsize;
-	}
-	bpt = ept - 1;
-	*bpt = '\0';
-
-	/*
-	 * Allocate bytes (1024 - malloc space) for the string of "../"'s.
-	 * Should always be enough (it's 340 levels).  If it's not, allocate
-	 * as necessary.  Special * case the first stat, it's ".", not "..".
-	 */
-	if ((up = malloc(upsize = 1024 - 4)) == NULL)
-		goto err;
-	eup = up + MAXPATHLEN;
-	bup = up;
-	up[0] = '.';
-	up[1] = '\0';
-
-	/* Save root values, so know when to stop. */
-	if (stat("/", &s))
-		goto err;
-	root_dev = s.st_dev;
-	root_ino = s.st_ino;
-
-	errno = 0;			/* XXX readdir has no error return. */
-
-	for (first = 1;; first = 0) {
-		/* Stat the current level. */
-		if (lstat(up, &s))
-			goto err;
-
-		/* Save current node values. */
-		ino = s.st_ino;
-		dev = s.st_dev;
-
-		/* Check for reaching root. */
-		if (root_dev == dev && root_ino == ino) {
-			*--bpt = '/';
-			/*
-			 * It's unclear that it's a requirement to copy the
-			 * path to the beginning of the buffer, but it's always
-			 * been that way and stuff would probably break.
-			 */
-			memmove(pt, bpt, ept - bpt);
-			free(up);
-			return (pt);
-		}
-
-		/*
-		 * Build pointer to the parent directory, allocating memory
-		 * as necessary.  Max length is 3 for "../", the largest
-		 * possible component name, plus a trailing NUL.
-		 */
-		if (bup + 3  + MAXNAMLEN + 1 >= eup) {
-			char *nup;
-
-			if ((nup = realloc(up, upsize *= 2)) == NULL)
-				goto err;
-			up = nup;
-			bup = up;
-			eup = up + upsize;
-		}
-		*bup++ = '.';
-		*bup++ = '.';
-		*bup = '\0';
-
-		/* Open and stat parent directory. 
-		 * RACE?? - replaced fstat(dirfd(dir), &s) w/ lstat(up,&s) 
-                 */
-		if (!(dir = opendir(up)) || lstat(up,&s))
-			goto err;
-
-		/* Add trailing slash for next directory. */
-		*bup++ = '/';
-
-		/*
-		 * If it's a mount point, have to stat each element because
-		 * the inode number in the directory is for the entry in the
-		 * parent directory, not the inode number of the mounted file.
-		 */
-		save_errno = 0;
-		if (s.st_dev == dev) {
-			for (;;) {
-				if (!(dp = readdir(dir)))
-					goto notfound;
-				if (dp->d_fileno == ino)
-					break;
-			}
-		} else
-			for (;;) {
-				if (!(dp = readdir(dir)))
-					goto notfound;
-				if (ISDOT(dp))
-					continue;
-				memmove(bup, dp->d_name, dp->d_namlen + 1);
-
-				/* Save the first error for later. */
-				if (lstat(up, &s)) {
-					if (!save_errno)
-						save_errno = errno;
-					errno = 0;
-					continue;
-				}
-				if (s.st_dev == dev && s.st_ino == ino)
-					break;
-			}
-
-		/*
-		 * Check for length of the current name, preceding slash,
-		 * leading slash.
-		 */
-		if (bpt - pt < dp->d_namlen + (first ? 1 : 2)) {
-			size_t len, off;
-			char *npt;
-
-			if (!ptsize) {
-				errno = ERANGE;
-				goto err;
-			}
-			off = bpt - pt;
-			len = ept - bpt;
-			if ((npt = realloc(pt, ptsize *= 2)) == NULL)
-				goto err;
-			pt = npt;
-			bpt = pt + off;
-			ept = pt + ptsize;
-			memmove(ept - len, bpt, len);
-			bpt = ept - len;
-		}
-		if (!first)
-			*--bpt = '/';
-		bpt -= dp->d_namlen;
-		memmove(bpt, dp->d_name, dp->d_namlen);
-		(void)closedir(dir);
-
-		/* Truncate any file name. */
-		*bup = '\0';
-	}
-
-notfound:
-	/*
-	 * If readdir set errno, use it, not any saved error; otherwise,
-	 * didn't find the current directory in its parent directory, set
-	 * errno to ENOENT.
-	 */
-	if (!errno)
-		errno = save_errno ? save_errno : ENOENT;
-	/* FALLTHROUGH */
-err:
-	if (ptsize)
-		free(pt);
-	if (up)
-		free(up);
-	if (dir)
-		(void)closedir(dir);
-	return (NULL);
-}
-
-#endif /* !defined(HAVE_GETCWD) */
diff --git a/crypto/openssh/openbsd-compat/getcwd.h b/crypto/openssh/openbsd-compat/getcwd.h
deleted file mode 100644
index 1137b3ed55bc..000000000000
--- a/crypto/openssh/openbsd-compat/getcwd.h
+++ /dev/null
@@ -1,12 +0,0 @@
-/* $Id: getcwd.h,v 1.2 2001/02/09 01:55:36 djm Exp $ */
-
-#ifndef _BSD_GETCWD_H 
-#define _BSD_GETCWD_H
-#include "config.h"
-
-#if !defined(HAVE_GETCWD)
-
-char *getcwd(char *pt, size_t size);
-
-#endif /* !defined(HAVE_GETCWD) */
-#endif /* _BSD_GETCWD_H */
diff --git a/crypto/openssh/openbsd-compat/getgrouplist.c b/crypto/openssh/openbsd-compat/getgrouplist.c
deleted file mode 100644
index f7a27c339bb1..000000000000
--- a/crypto/openssh/openbsd-compat/getgrouplist.c
+++ /dev/null
@@ -1,103 +0,0 @@
-/*
- * Copyright (c) 1991, 1993
- *	The Regents of the University of California.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *	This product includes software developed by the University of
- *	California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "includes.h"
-
-#ifndef HAVE_GETGROUPLIST
-
-#if defined(LIBC_SCCS) && !defined(lint)
-static char rcsid[] = "$OpenBSD: getgrouplist.c,v 1.7 1997/08/19 19:13:27 deraadt Exp $";
-#endif /* LIBC_SCCS and not lint */
-
-/*
- * get credential
- */
-#include <sys/types.h>
-#include <string.h>
-#include <grp.h>
-
-int
-getgrouplist(uname, agroup, groups, grpcnt)
-	const char *uname;
-	gid_t agroup;
-	register gid_t *groups;
-	int *grpcnt;
-{
-	register struct group *grp;
-	register int i, ngroups;
-	int ret, maxgroups;
-	int bail;
-
-	ret = 0;
-	ngroups = 0;
-	maxgroups = *grpcnt;
-
-	/*
-	 * install primary group
-	 */
-	if (ngroups >= maxgroups) {
-		*grpcnt = ngroups;
-		return (-1);
-	}
-	groups[ngroups++] = agroup;
-
-	/*
-	 * Scan the group file to find additional groups.
-	 */
-	setgrent();
-	while ((grp = getgrent())) {
-		if (grp->gr_gid == agroup)
-			continue;
-		for (bail = 0, i = 0; bail == 0 && i < ngroups; i++)
-			if (groups[i] == grp->gr_gid)
-				bail = 1;
-		if (bail)
-			continue;
-		for (i = 0; grp->gr_mem[i]; i++) {
-			if (!strcmp(grp->gr_mem[i], uname)) {
-				if (ngroups >= maxgroups) {
-					ret = -1;
-					goto out;
-				}
-				groups[ngroups++] = grp->gr_gid;
-				break;
-			}
-		}
-	}
-out:
-	endgrent();
-	*grpcnt = ngroups;
-	return (ret);
-}
-
-#endif /* HAVE_GETGROUPLIST */
diff --git a/crypto/openssh/openbsd-compat/getgrouplist.h b/crypto/openssh/openbsd-compat/getgrouplist.h
deleted file mode 100644
index 27a9703f2812..000000000000
--- a/crypto/openssh/openbsd-compat/getgrouplist.h
+++ /dev/null
@@ -1,16 +0,0 @@
-/* $Id: getgrouplist.h,v 1.2 2001/02/09 01:55:36 djm Exp $ */
-
-#ifndef _BSD_GETGROUPLIST_H
-#define _BSD_GETGROUPLIST_H
-
-#include "config.h"
-
-#ifndef HAVE_GETGROUPLIST
-
-#include <grp.h>
-
-int getgrouplist(const char *, gid_t, gid_t *, int *);
-
-#endif
-
-#endif
diff --git a/crypto/openssh/openbsd-compat/getopt.c b/crypto/openssh/openbsd-compat/getopt.c
deleted file mode 100644
index a3fe807ee402..000000000000
--- a/crypto/openssh/openbsd-compat/getopt.c
+++ /dev/null
@@ -1,125 +0,0 @@
-/*
- * Copyright (c) 1987, 1993, 1994
- *	The Regents of the University of California.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *	This product includes software developed by the University of
- *	California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "includes.h"
-#if !defined(HAVE_GETOPT) || !defined(HAVE_GETOPT_OPTRESET)
-
-#if defined(LIBC_SCCS) && !defined(lint)
-static char *rcsid = "$OpenBSD: getopt.c,v 1.4 2002/12/08 22:57:14 millert Exp $";
-#endif /* LIBC_SCCS and not lint */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-
-int	BSDopterr = 1,		/* if error message should be printed */
-	BSDoptind = 1,		/* index into parent argv vector */
-	BSDoptopt,		/* character checked for validity */
-	BSDoptreset;		/* reset getopt */
-char	*BSDoptarg;		/* argument associated with option */
-
-#define	BADCH	(int)'?'
-#define	BADARG	(int)':'
-#define	EMSG	""
-
-/*
- * getopt --
- *	Parse argc/argv argument vector.
- */
-int
-BSDgetopt(nargc, nargv, ostr)
-	int nargc;
-	char * const *nargv;
-	const char *ostr;
-{
-	extern char *__progname;
-	static char *place = EMSG;		/* option letter processing */
-	char *oli;				/* option letter list index */
-
-	if (ostr == NULL)
-		return (-1);
-
-	if (BSDoptreset || !*place) {		/* update scanning pointer */
-		BSDoptreset = 0;
-		if (BSDoptind >= nargc || *(place = nargv[BSDoptind]) != '-') {
-			place = EMSG;
-			return (-1);
-		}
-		if (place[1] && *++place == '-') {	/* found "--" */
-			++BSDoptind;
-			place = EMSG;
-			return (-1);
-		}
-	}					/* option letter okay? */
-	if ((BSDoptopt = (int)*place++) == (int)':' ||
-	    !(oli = strchr(ostr, BSDoptopt))) {
-		/*
-		 * if the user didn't specify '-' as an option,
-		 * assume it means -1.
-		 */
-		if (BSDoptopt == (int)'-')
-			return (-1);
-		if (!*place)
-			++BSDoptind;
-		if (BSDopterr && *ostr != ':')
-			(void)fprintf(stderr,
-			    "%s: illegal option -- %c\n", __progname, BSDoptopt);
-		return (BADCH);
-	}
-	if (*++oli != ':') {			/* don't need argument */
-		BSDoptarg = NULL;
-		if (!*place)
-			++BSDoptind;
-	}
-	else {					/* need an argument */
-		if (*place)			/* no white space */
-			BSDoptarg = place;
-		else if (nargc <= ++BSDoptind) {	/* no arg */
-			place = EMSG;
-			if (*ostr == ':')
-				return (BADARG);
-			if (BSDopterr)
-				(void)fprintf(stderr,
-				    "%s: option requires an argument -- %c\n",
-				    __progname, BSDoptopt);
-			return (BADCH);
-		}
-	 	else				/* white space */
-			BSDoptarg = nargv[BSDoptind];
-		place = EMSG;
-		++BSDoptind;
-	}
-	return (BSDoptopt);			/* dump back option letter */
-}
-
-#endif /* !defined(HAVE_GETOPT) || !defined(HAVE_OPTRESET) */
diff --git a/crypto/openssh/openbsd-compat/getopt.h b/crypto/openssh/openbsd-compat/getopt.h
deleted file mode 100644
index 9abdae8e958c..000000000000
--- a/crypto/openssh/openbsd-compat/getopt.h
+++ /dev/null
@@ -1,14 +0,0 @@
-/* $Id: getopt.h,v 1.4 2001/09/18 05:05:21 djm Exp $ */
-
-#ifndef _BSDGETOPT_H
-#define _BSDGETOPT_H
-
-#include "config.h"
-
-#if !defined(HAVE_GETOPT) || !defined(HAVE_GETOPT_OPTRESET)
-
-int BSDgetopt(int argc, char * const *argv, const char *opts);
-
-#endif
-
-#endif /* _BSDGETOPT_H */
diff --git a/crypto/openssh/openbsd-compat/glob.c b/crypto/openssh/openbsd-compat/glob.c
deleted file mode 100644
index e928a2272c15..000000000000
--- a/crypto/openssh/openbsd-compat/glob.c
+++ /dev/null
@@ -1,916 +0,0 @@
-/*
- * Copyright (c) 1989, 1993
- *	The Regents of the University of California.  All rights reserved.
- *
- * This code is derived from software contributed to Berkeley by
- * Guido van Rossum.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *	This product includes software developed by the University of
- *	California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "includes.h"
-#include <ctype.h>
-
-static long
-get_arg_max(void)
-{
-#ifdef ARG_MAX
-	return(ARG_MAX);
-#elif defined(HAVE_SYSCONF) && defined(_SC_ARG_MAX)
-	return(sysconf(_SC_ARG_MAX));
-#else
-	return(256); /* XXX: arbitrary */
-#endif
-}
-
-#if !defined(HAVE_GLOB) || !defined(GLOB_HAS_ALTDIRFUNC) || \
-    !defined(GLOB_HAS_GL_MATCHC)
-
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)glob.c	8.3 (Berkeley) 10/13/93";
-#else
-static char rcsid[] = "$OpenBSD: glob.c,v 1.20 2002/06/14 21:34:58 todd Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
-
-/*
- * glob(3) -- a superset of the one defined in POSIX 1003.2.
- *
- * The [!...] convention to negate a range is supported (SysV, Posix, ksh).
- *
- * Optional extra services, controlled by flags not defined by POSIX:
- *
- * GLOB_QUOTE:
- *	Escaping convention: \ inhibits any special meaning the following
- *	character might have (except \ at end of string is retained).
- * GLOB_MAGCHAR:
- *	Set in gl_flags if pattern contained a globbing character.
- * GLOB_NOMAGIC:
- *	Same as GLOB_NOCHECK, but it will only append pattern if it did
- *	not contain any magic characters.  [Used in csh style globbing]
- * GLOB_ALTDIRFUNC:
- *	Use alternately specified directory access functions.
- * GLOB_TILDE:
- *	expand ~user/foo to the /home/dir/of/user/foo
- * GLOB_BRACE:
- *	expand {1,2}{a,b} to 1a 1b 2a 2b
- * gl_matchc:
- *	Number of matches in the current invocation of glob.
- */
-
-
-#define	DOLLAR		'$'
-#define	DOT		'.'
-#define	EOS		'\0'
-#define	LBRACKET	'['
-#define	NOT		'!'
-#define	QUESTION	'?'
-#define	QUOTE		'\\'
-#define	RANGE		'-'
-#define	RBRACKET	']'
-#define	SEP		'/'
-#define	STAR		'*'
-#undef TILDE			/* Some platforms may already define it */
-#define	TILDE		'~'
-#define	UNDERSCORE	'_'
-#define	LBRACE		'{'
-#define	RBRACE		'}'
-#define	SLASH		'/'
-#define	COMMA		','
-
-#ifndef DEBUG
-
-#define	M_QUOTE		0x8000
-#define	M_PROTECT	0x4000
-#define	M_MASK		0xffff
-#define	M_ASCII		0x00ff
-
-typedef u_short Char;
-
-#else
-
-#define	M_QUOTE		0x80
-#define	M_PROTECT	0x40
-#define	M_MASK		0xff
-#define	M_ASCII		0x7f
-
-typedef char Char;
-
-#endif
-
-
-#define	CHAR(c)		((Char)((c)&M_ASCII))
-#define	META(c)		((Char)((c)|M_QUOTE))
-#define	M_ALL		META('*')
-#define	M_END		META(']')
-#define	M_NOT		META('!')
-#define	M_ONE		META('?')
-#define	M_RNG		META('-')
-#define	M_SET		META('[')
-#define	ismeta(c)	(((c)&M_QUOTE) != 0)
-
-
-static int	 compare(const void *, const void *);
-static int	 g_Ctoc(const Char *, char *, u_int);
-static int	 g_lstat(Char *, struct stat *, glob_t *);
-static DIR	*g_opendir(Char *, glob_t *);
-static Char	*g_strchr(Char *, int);
-static int	 g_stat(Char *, struct stat *, glob_t *);
-static int	 glob0(const Char *, glob_t *);
-static int	 glob1(Char *, Char *, glob_t *, size_t *);
-static int	 glob2(Char *, Char *, Char *, Char *, Char *, Char *,
-		    glob_t *, size_t *);
-static int	 glob3(Char *, Char *, Char *, Char *, Char *, Char *,
-		    Char *, Char *, glob_t *, size_t *);
-static int	 globextend(const Char *, glob_t *, size_t *);
-static const Char *
-		 globtilde(const Char *, Char *, size_t, glob_t *);
-static int	 globexp1(const Char *, glob_t *);
-static int	 globexp2(const Char *, const Char *, glob_t *, int *);
-static int	 match(Char *, Char *, Char *);
-#ifdef DEBUG
-static void	 qprintf(const char *, Char *);
-#endif
-
-int
-glob(pattern, flags, errfunc, pglob)
-	const char *pattern;
-	int flags, (*errfunc)(const char *, int);
-	glob_t *pglob;
-{
-	const u_char *patnext;
-	int c;
-	Char *bufnext, *bufend, patbuf[MAXPATHLEN];
-
-	patnext = (u_char *) pattern;
-	if (!(flags & GLOB_APPEND)) {
-		pglob->gl_pathc = 0;
-		pglob->gl_pathv = NULL;
-		if (!(flags & GLOB_DOOFFS))
-			pglob->gl_offs = 0;
-	}
-	pglob->gl_flags = flags & ~GLOB_MAGCHAR;
-	pglob->gl_errfunc = errfunc;
-	pglob->gl_matchc = 0;
-
-	bufnext = patbuf;
-	bufend = bufnext + MAXPATHLEN - 1;
-	if (flags & GLOB_NOESCAPE)
-		while (bufnext < bufend && (c = *patnext++) != EOS)
-			*bufnext++ = c;
-	else {
-		/* Protect the quoted characters. */
-		while (bufnext < bufend && (c = *patnext++) != EOS)
-			if (c == QUOTE) {
-				if ((c = *patnext++) == EOS) {
-					c = QUOTE;
-					--patnext;
-				}
-				*bufnext++ = c | M_PROTECT;
-			} else
-				*bufnext++ = c;
-	}
-	*bufnext = EOS;
-
-	if (flags & GLOB_BRACE)
-		return globexp1(patbuf, pglob);
-	else
-		return glob0(patbuf, pglob);
-}
-
-/*
- * Expand recursively a glob {} pattern. When there is no more expansion
- * invoke the standard globbing routine to glob the rest of the magic
- * characters
- */
-static int
-globexp1(pattern, pglob)
-	const Char *pattern;
-	glob_t *pglob;
-{
-	const Char* ptr = pattern;
-	int rv;
-
-	/* Protect a single {}, for find(1), like csh */
-	if (pattern[0] == LBRACE && pattern[1] == RBRACE && pattern[2] == EOS)
-		return glob0(pattern, pglob);
-
-	while ((ptr = (const Char *) g_strchr((Char *) ptr, LBRACE)) != NULL)
-		if (!globexp2(ptr, pattern, pglob, &rv))
-			return rv;
-
-	return glob0(pattern, pglob);
-}
-
-
-/*
- * Recursive brace globbing helper. Tries to expand a single brace.
- * If it succeeds then it invokes globexp1 with the new pattern.
- * If it fails then it tries to glob the rest of the pattern and returns.
- */
-static int
-globexp2(ptr, pattern, pglob, rv)
-	const Char *ptr, *pattern;
-	glob_t *pglob;
-	int *rv;
-{
-	int     i;
-	Char   *lm, *ls;
-	const Char *pe, *pm, *pl;
-	Char    patbuf[MAXPATHLEN];
-
-	/* copy part up to the brace */
-	for (lm = patbuf, pm = pattern; pm != ptr; *lm++ = *pm++)
-		;
-	*lm = EOS;
-	ls = lm;
-
-	/* Find the balanced brace */
-	for (i = 0, pe = ++ptr; *pe; pe++)
-		if (*pe == LBRACKET) {
-			/* Ignore everything between [] */
-			for (pm = pe++; *pe != RBRACKET && *pe != EOS; pe++)
-				;
-			if (*pe == EOS) {
-				/*
-				 * We could not find a matching RBRACKET.
-				 * Ignore and just look for RBRACE
-				 */
-				pe = pm;
-			}
-		} else if (*pe == LBRACE)
-			i++;
-		else if (*pe == RBRACE) {
-			if (i == 0)
-				break;
-			i--;
-		}
-
-	/* Non matching braces; just glob the pattern */
-	if (i != 0 || *pe == EOS) {
-		*rv = glob0(patbuf, pglob);
-		return 0;
-	}
-
-	for (i = 0, pl = pm = ptr; pm <= pe; pm++) {
-		switch (*pm) {
-		case LBRACKET:
-			/* Ignore everything between [] */
-			for (pl = pm++; *pm != RBRACKET && *pm != EOS; pm++)
-				;
-			if (*pm == EOS) {
-				/*
-				 * We could not find a matching RBRACKET.
-				 * Ignore and just look for RBRACE
-				 */
-				pm = pl;
-			}
-			break;
-
-		case LBRACE:
-			i++;
-			break;
-
-		case RBRACE:
-			if (i) {
-				i--;
-				break;
-			}
-			/* FALLTHROUGH */
-		case COMMA:
-			if (i && *pm == COMMA)
-				break;
-			else {
-				/* Append the current string */
-				for (lm = ls; (pl < pm); *lm++ = *pl++)
-					;
-
-				/*
-				 * Append the rest of the pattern after the
-				 * closing brace
-				 */
-				for (pl = pe + 1; (*lm++ = *pl++) != EOS; )
-					;
-
-				/* Expand the current pattern */
-#ifdef DEBUG
-				qprintf("globexp2:", patbuf);
-#endif
-				*rv = globexp1(patbuf, pglob);
-
-				/* move after the comma, to the next string */
-				pl = pm + 1;
-			}
-			break;
-
-		default:
-			break;
-		}
-	}
-	*rv = 0;
-	return 0;
-}
-
-
-
-/*
- * expand tilde from the passwd file.
- */
-static const Char *
-globtilde(pattern, patbuf, patbuf_len, pglob)
-	const Char *pattern;
-	Char *patbuf;
-	size_t patbuf_len;
-	glob_t *pglob;
-{
-	struct passwd *pwd;
-	char *h;
-	const Char *p;
-	Char *b, *eb;
-
-	if (*pattern != TILDE || !(pglob->gl_flags & GLOB_TILDE))
-		return pattern;
-
-	/* Copy up to the end of the string or / */
-	eb = &patbuf[patbuf_len - 1];
-	for (p = pattern + 1, h = (char *) patbuf;
-	    h < (char *)eb && *p && *p != SLASH; *h++ = *p++)
-		;
-
-	*h = EOS;
-
-#if 0
-	if (h == (char *)eb)
-		return what;
-#endif
-
-	if (((char *) patbuf)[0] == EOS) {
-		/*
-		 * handle a plain ~ or ~/ by expanding $HOME
-		 * first and then trying the password file
-		 */
-#if 0
-		if (issetugid() != 0 || (h = getenv("HOME")) == NULL) {
-#endif
-		if ((getuid() != geteuid()) || (h = getenv("HOME")) == NULL) {
-			if ((pwd = getpwuid(getuid())) == NULL)
-				return pattern;
-			else
-				h = pwd->pw_dir;
-		}
-	} else {
-		/*
-		 * Expand a ~user
-		 */
-		if ((pwd = getpwnam((char*) patbuf)) == NULL)
-			return pattern;
-		else
-			h = pwd->pw_dir;
-	}
-
-	/* Copy the home directory */
-	for (b = patbuf; b < eb && *h; *b++ = *h++)
-		;
-
-	/* Append the rest of the pattern */
-	while (b < eb && (*b++ = *p++) != EOS)
-		;
-	*b = EOS;
-
-	return patbuf;
-}
-
-
-/*
- * The main glob() routine: compiles the pattern (optionally processing
- * quotes), calls glob1() to do the real pattern matching, and finally
- * sorts the list (unless unsorted operation is requested).  Returns 0
- * if things went well, nonzero if errors occurred.  It is not an error
- * to find no matches.
- */
-static int
-glob0(pattern, pglob)
-	const Char *pattern;
-	glob_t *pglob;
-{
-	const Char *qpatnext;
-	int c, err, oldpathc;
-	Char *bufnext, patbuf[MAXPATHLEN];
-	size_t limit = 0;
-
-	qpatnext = globtilde(pattern, patbuf, MAXPATHLEN, pglob);
-	oldpathc = pglob->gl_pathc;
-	bufnext = patbuf;
-
-	/* We don't need to check for buffer overflow any more. */
-	while ((c = *qpatnext++) != EOS) {
-		switch (c) {
-		case LBRACKET:
-			c = *qpatnext;
-			if (c == NOT)
-				++qpatnext;
-			if (*qpatnext == EOS ||
-			    g_strchr((Char *) qpatnext+1, RBRACKET) == NULL) {
-				*bufnext++ = LBRACKET;
-				if (c == NOT)
-					--qpatnext;
-				break;
-			}
-			*bufnext++ = M_SET;
-			if (c == NOT)
-				*bufnext++ = M_NOT;
-			c = *qpatnext++;
-			do {
-				*bufnext++ = CHAR(c);
-				if (*qpatnext == RANGE &&
-				    (c = qpatnext[1]) != RBRACKET) {
-					*bufnext++ = M_RNG;
-					*bufnext++ = CHAR(c);
-					qpatnext += 2;
-				}
-			} while ((c = *qpatnext++) != RBRACKET);
-			pglob->gl_flags |= GLOB_MAGCHAR;
-			*bufnext++ = M_END;
-			break;
-		case QUESTION:
-			pglob->gl_flags |= GLOB_MAGCHAR;
-			*bufnext++ = M_ONE;
-			break;
-		case STAR:
-			pglob->gl_flags |= GLOB_MAGCHAR;
-			/* collapse adjacent stars to one,
-			 * to avoid exponential behavior
-			 */
-			if (bufnext == patbuf || bufnext[-1] != M_ALL)
-				*bufnext++ = M_ALL;
-			break;
-		default:
-			*bufnext++ = CHAR(c);
-			break;
-		}
-	}
-	*bufnext = EOS;
-#ifdef DEBUG
-	qprintf("glob0:", patbuf);
-#endif
-
-	if ((err = glob1(patbuf, patbuf+MAXPATHLEN-1, pglob, &limit)) != 0)
-		return(err);
-
-	/*
-	 * If there was no match we are going to append the pattern
-	 * if GLOB_NOCHECK was specified or if GLOB_NOMAGIC was specified
-	 * and the pattern did not contain any magic characters
-	 * GLOB_NOMAGIC is there just for compatibility with csh.
-	 */
-	if (pglob->gl_pathc == oldpathc) {
-		if ((pglob->gl_flags & GLOB_NOCHECK) ||
-		    ((pglob->gl_flags & GLOB_NOMAGIC) &&
-		    !(pglob->gl_flags & GLOB_MAGCHAR)))
-			return(globextend(pattern, pglob, &limit));
-		else
-			return(GLOB_NOMATCH);
-	}
-	if (!(pglob->gl_flags & GLOB_NOSORT))
-		qsort(pglob->gl_pathv + pglob->gl_offs + oldpathc,
-		    pglob->gl_pathc - oldpathc, sizeof(char *), compare);
-	return(0);
-}
-
-static int
-compare(p, q)
-	const void *p, *q;
-{
-	return(strcmp(*(char **)p, *(char **)q));
-}
-
-static int
-glob1(pattern, pattern_last, pglob, limitp)
-	Char *pattern, *pattern_last;
-	glob_t *pglob;
-	size_t *limitp;
-{
-	Char pathbuf[MAXPATHLEN];
-
-	/* A null pathname is invalid -- POSIX 1003.1 sect. 2.4. */
-	if (*pattern == EOS)
-		return(0);
-	return(glob2(pathbuf, pathbuf+MAXPATHLEN-1,
-	    pathbuf, pathbuf+MAXPATHLEN-1,
-	    pattern, pattern_last, pglob, limitp));
-}
-
-/*
- * The functions glob2 and glob3 are mutually recursive; there is one level
- * of recursion for each segment in the pattern that contains one or more
- * meta characters.
- */
-static int
-glob2(pathbuf, pathbuf_last, pathend, pathend_last, pattern,
-    pattern_last, pglob, limitp)
-	Char *pathbuf, *pathbuf_last, *pathend, *pathend_last;
-	Char *pattern, *pattern_last;
-	glob_t *pglob;
-	size_t *limitp;
-{
-	struct stat sb;
-	Char *p, *q;
-	int anymeta;
-
-	/*
-	 * Loop over pattern segments until end of pattern or until
-	 * segment with meta character found.
-	 */
-	for (anymeta = 0;;) {
-		if (*pattern == EOS) {		/* End of pattern? */
-			*pathend = EOS;
-			if (g_lstat(pathbuf, &sb, pglob))
-				return(0);
-
-			if (((pglob->gl_flags & GLOB_MARK) &&
-			    pathend[-1] != SEP) && (S_ISDIR(sb.st_mode) ||
-			    (S_ISLNK(sb.st_mode) &&
-			    (g_stat(pathbuf, &sb, pglob) == 0) &&
-			    S_ISDIR(sb.st_mode)))) {
-				if (pathend+1 > pathend_last)
-					return (1);
-				*pathend++ = SEP;
-				*pathend = EOS;
-			}
-			++pglob->gl_matchc;
-			return(globextend(pathbuf, pglob, limitp));
-		}
-
-		/* Find end of next segment, copy tentatively to pathend. */
-		q = pathend;
-		p = pattern;
-		while (*p != EOS && *p != SEP) {
-			if (ismeta(*p))
-				anymeta = 1;
-			if (q+1 > pathend_last)
-				return (1);
-			*q++ = *p++;
-		}
-
-		if (!anymeta) {		/* No expansion, do next segment. */
-			pathend = q;
-			pattern = p;
-			while (*pattern == SEP) {
-				if (pathend+1 > pathend_last)
-					return (1);
-				*pathend++ = *pattern++;
-			}
-		} else
-			/* Need expansion, recurse. */
-			return(glob3(pathbuf, pathbuf_last, pathend,
-			    pathend_last, pattern, pattern_last,
-			    p, pattern_last, pglob, limitp));
-	}
-	/* NOTREACHED */
-}
-
-static int
-glob3(pathbuf, pathbuf_last, pathend, pathend_last, pattern, pattern_last,
-    restpattern, restpattern_last, pglob, limitp)
-	Char *pathbuf, *pathbuf_last, *pathend, *pathend_last;
-	Char *pattern, *pattern_last, *restpattern, *restpattern_last;
-	glob_t *pglob;
-	size_t *limitp;
-{
-	register struct dirent *dp;
-	DIR *dirp;
-	int err;
-	char buf[MAXPATHLEN];
-
-	/*
-	 * The readdirfunc declaration can't be prototyped, because it is
-	 * assigned, below, to two functions which are prototyped in glob.h
-	 * and dirent.h as taking pointers to differently typed opaque
-	 * structures.
-	 */
-	struct dirent *(*readdirfunc)();
-
-	if (pathend > pathend_last)
-		return (1);
-	*pathend = EOS;
-	errno = 0;
-
-	if ((dirp = g_opendir(pathbuf, pglob)) == NULL) {
-		/* TODO: don't call for ENOENT or ENOTDIR? */
-		if (pglob->gl_errfunc) {
-			if (g_Ctoc(pathbuf, buf, sizeof(buf)))
-				return(GLOB_ABORTED);
-			if (pglob->gl_errfunc(buf, errno) ||
-			    pglob->gl_flags & GLOB_ERR)
-				return(GLOB_ABORTED);
-		}
-		return(0);
-	}
-
-	err = 0;
-
-	/* Search directory for matching names. */
-	if (pglob->gl_flags & GLOB_ALTDIRFUNC)
-		readdirfunc = pglob->gl_readdir;
-	else
-		readdirfunc = readdir;
-	while ((dp = (*readdirfunc)(dirp))) {
-		register u_char *sc;
-		register Char *dc;
-
-		/* Initial DOT must be matched literally. */
-		if (dp->d_name[0] == DOT && *pattern != DOT)
-			continue;
-		dc = pathend;
-		sc = (u_char *) dp->d_name;
-		while (dc < pathend_last && (*dc++ = *sc++) != EOS)
-			;
-		if (dc >= pathend_last) {
-			*dc = EOS;
-			err = 1;
-			break;
-		}
-
-		if (!match(pathend, pattern, restpattern)) {
-			*pathend = EOS;
-			continue;
-		}
-		err = glob2(pathbuf, pathbuf_last, --dc, pathend_last,
-		    restpattern, restpattern_last, pglob, limitp);
-		if (err)
-			break;
-	}
-
-	if (pglob->gl_flags & GLOB_ALTDIRFUNC)
-		(*pglob->gl_closedir)(dirp);
-	else
-		closedir(dirp);
-	return(err);
-}
-
-
-/*
- * Extend the gl_pathv member of a glob_t structure to accommodate a new item,
- * add the new item, and update gl_pathc.
- *
- * This assumes the BSD realloc, which only copies the block when its size
- * crosses a power-of-two boundary; for v7 realloc, this would cause quadratic
- * behavior.
- *
- * Return 0 if new item added, error code if memory couldn't be allocated.
- *
- * Invariant of the glob_t structure:
- *	Either gl_pathc is zero and gl_pathv is NULL; or gl_pathc > 0 and
- *	gl_pathv points to (gl_offs + gl_pathc + 1) items.
- */
-static int
-globextend(path, pglob, limitp)
-	const Char *path;
-	glob_t *pglob;
-	size_t *limitp;
-{
-	register char **pathv;
-	register int i;
-	u_int newsize, len;
-	char *copy;
-	const Char *p;
-
-	newsize = sizeof(*pathv) * (2 + pglob->gl_pathc + pglob->gl_offs);
-	pathv = pglob->gl_pathv ? realloc((char *)pglob->gl_pathv, newsize) :
-	    malloc(newsize);
-	if (pathv == NULL) {
-		if (pglob->gl_pathv) {
-			free(pglob->gl_pathv);
-			pglob->gl_pathv = NULL;
-		}
-		return(GLOB_NOSPACE);
-	}
-
-	if (pglob->gl_pathv == NULL && pglob->gl_offs > 0) {
-		/* first time around -- clear initial gl_offs items */
-		pathv += pglob->gl_offs;
-		for (i = pglob->gl_offs; --i >= 0; )
-			*--pathv = NULL;
-	}
-	pglob->gl_pathv = pathv;
-
-	for (p = path; *p++;)
-		;
-	len = (size_t)(p - path);
-	*limitp += len;
-	if ((copy = malloc(len)) != NULL) {
-		if (g_Ctoc(path, copy, len)) {
-			free(copy);
-			return(GLOB_NOSPACE);
-		}
-		pathv[pglob->gl_offs + pglob->gl_pathc++] = copy;
-	}
-	pathv[pglob->gl_offs + pglob->gl_pathc] = NULL;
-
-	if ((pglob->gl_flags & GLOB_LIMIT) &&
-	    newsize + *limitp >= (u_int) get_arg_max()) {
-		errno = 0;
-		return(GLOB_NOSPACE);
-	}
-
-	return(copy == NULL ? GLOB_NOSPACE : 0);
-}
-
-
-/*
- * pattern matching function for filenames.  Each occurrence of the *
- * pattern causes a recursion level.
- */
-static int
-match(name, pat, patend)
-	register Char *name, *pat, *patend;
-{
-	int ok, negate_range;
-	Char c, k;
-
-	while (pat < patend) {
-		c = *pat++;
-		switch (c & M_MASK) {
-		case M_ALL:
-			if (pat == patend)
-				return(1);
-			do
-			    if (match(name, pat, patend))
-				    return(1);
-			while (*name++ != EOS)
-				;
-			return(0);
-		case M_ONE:
-			if (*name++ == EOS)
-				return(0);
-			break;
-		case M_SET:
-			ok = 0;
-			if ((k = *name++) == EOS)
-				return(0);
-			if ((negate_range = ((*pat & M_MASK) == M_NOT)) != EOS)
-				++pat;
-			while (((c = *pat++) & M_MASK) != M_END)
-				if ((*pat & M_MASK) == M_RNG) {
-					if (c <= k && k <= pat[1])
-						ok = 1;
-					pat += 2;
-				} else if (c == k)
-					ok = 1;
-			if (ok == negate_range)
-				return(0);
-			break;
-		default:
-			if (*name++ != c)
-				return(0);
-			break;
-		}
-	}
-	return(*name == EOS);
-}
-
-/* Free allocated data belonging to a glob_t structure. */
-void
-globfree(pglob)
-	glob_t *pglob;
-{
-	register int i;
-	register char **pp;
-
-	if (pglob->gl_pathv != NULL) {
-		pp = pglob->gl_pathv + pglob->gl_offs;
-		for (i = pglob->gl_pathc; i--; ++pp)
-			if (*pp)
-				free(*pp);
-		free(pglob->gl_pathv);
-		pglob->gl_pathv = NULL;
-	}
-}
-
-static DIR *
-g_opendir(str, pglob)
-	register Char *str;
-	glob_t *pglob;
-{
-	char buf[MAXPATHLEN];
-
-	if (!*str)
-		strlcpy(buf, ".", sizeof buf);
-	else {
-		if (g_Ctoc(str, buf, sizeof(buf)))
-			return(NULL);
-	}
-
-	if (pglob->gl_flags & GLOB_ALTDIRFUNC)
-		return((*pglob->gl_opendir)(buf));
-
-	return(opendir(buf));
-}
-
-static int
-g_lstat(fn, sb, pglob)
-	register Char *fn;
-	struct stat *sb;
-	glob_t *pglob;
-{
-	char buf[MAXPATHLEN];
-
-	if (g_Ctoc(fn, buf, sizeof(buf)))
-		return(-1);
-	if (pglob->gl_flags & GLOB_ALTDIRFUNC)
-		return((*pglob->gl_lstat)(buf, sb));
-	return(lstat(buf, sb));
-}
-
-static int
-g_stat(fn, sb, pglob)
-	register Char *fn;
-	struct stat *sb;
-	glob_t *pglob;
-{
-	char buf[MAXPATHLEN];
-
-	if (g_Ctoc(fn, buf, sizeof(buf)))
-		return(-1);
-	if (pglob->gl_flags & GLOB_ALTDIRFUNC)
-		return((*pglob->gl_stat)(buf, sb));
-	return(stat(buf, sb));
-}
-
-static Char *
-g_strchr(str, ch)
-	Char *str;
-	int ch;
-{
-	do {
-		if (*str == ch)
-			return (str);
-	} while (*str++);
-	return (NULL);
-}
-
-static int
-g_Ctoc(str, buf, len)
-	register const Char *str;
-	char *buf;
-	u_int len;
-{
-
-	while (len--) {
-		if ((*buf++ = *str++) == EOS)
-			return (0);
-	}
-	return (1);
-}
-
-#ifdef DEBUG
-static void
-qprintf(str, s)
-	const char *str;
-	register Char *s;
-{
-	register Char *p;
-
-	(void)printf("%s:\n", str);
-	for (p = s; *p; p++)
-		(void)printf("%c", CHAR(*p));
-	(void)printf("\n");
-	for (p = s; *p; p++)
-		(void)printf("%c", *p & M_PROTECT ? '"' : ' ');
-	(void)printf("\n");
-	for (p = s; *p; p++)
-		(void)printf("%c", ismeta(*p) ? '_' : ' ');
-	(void)printf("\n");
-}
-#endif
-
-#endif /* !defined(HAVE_GLOB) || !defined(GLOB_HAS_ALTDIRFUNC) ||
-          !defined(GLOB_HAS_GL_MATCHC) */
-
diff --git a/crypto/openssh/openbsd-compat/glob.h b/crypto/openssh/openbsd-compat/glob.h
deleted file mode 100644
index 6421f7049a8b..000000000000
--- a/crypto/openssh/openbsd-compat/glob.h
+++ /dev/null
@@ -1,101 +0,0 @@
-/*	$OpenBSD: glob.h,v 1.7 2002/02/17 19:42:21 millert Exp $	*/
-/*	$NetBSD: glob.h,v 1.5 1994/10/26 00:55:56 cgd Exp $	*/
-
-/*
- * Copyright (c) 1989, 1993
- *	The Regents of the University of California.  All rights reserved.
- *
- * This code is derived from software contributed to Berkeley by
- * Guido van Rossum.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *	This product includes software developed by the University of
- *	California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- *	@(#)glob.h	8.1 (Berkeley) 6/2/93
- */
-
-#if !defined(HAVE_GLOB_H) || !defined(GLOB_HAS_ALTDIRFUNC) || \
-    !defined(GLOB_HAS_GL_MATCHC)
-
-#ifndef _GLOB_H_
-#define	_GLOB_H_
-
-struct stat;
-typedef struct {
-	int gl_pathc;		/* Count of total paths so far. */
-	int gl_matchc;		/* Count of paths matching pattern. */
-	int gl_offs;		/* Reserved at beginning of gl_pathv. */
-	int gl_flags;		/* Copy of flags parameter to glob. */
-	char **gl_pathv;	/* List of paths matching pattern. */
-				/* Copy of errfunc parameter to glob. */
-	int (*gl_errfunc)(const char *, int);
-
-	/*
-	 * Alternate filesystem access methods for glob; replacement
-	 * versions of closedir(3), readdir(3), opendir(3), stat(2)
-	 * and lstat(2).
-	 */
-	void (*gl_closedir)(void *);
-	struct dirent *(*gl_readdir)(void *);	
-	void *(*gl_opendir)(const char *);
-	int (*gl_lstat)(const char *, struct stat *);
-	int (*gl_stat)(const char *, struct stat *);
-} glob_t;
-
-/* Flags */
-#define	GLOB_APPEND	0x0001	/* Append to output from previous call. */
-#define	GLOB_DOOFFS	0x0002	/* Use gl_offs. */
-#define	GLOB_ERR	0x0004	/* Return on error. */
-#define	GLOB_MARK	0x0008	/* Append / to matching directories. */
-#define	GLOB_NOCHECK	0x0010	/* Return pattern itself if nothing matches. */
-#define	GLOB_NOSORT	0x0020	/* Don't sort. */
-
-#define	GLOB_ALTDIRFUNC	0x0040	/* Use alternately specified directory funcs. */
-#define	GLOB_BRACE	0x0080	/* Expand braces ala csh. */
-#define	GLOB_MAGCHAR	0x0100	/* Pattern had globbing characters. */
-#define	GLOB_NOMAGIC	0x0200	/* GLOB_NOCHECK without magic chars (csh). */
-#define	GLOB_QUOTE	0x0400	/* Quote special chars with \. */
-#define	GLOB_TILDE	0x0800	/* Expand tilde names from the passwd file. */
-#define	GLOB_NOESCAPE	0x1000	/* Disable backslash escaping. */
-#define GLOB_LIMIT	0x2000	/* Limit pattern match output to ARG_MAX */
-
-/* Error values returned by glob(3) */
-#define	GLOB_NOSPACE	(-1)	/* Malloc call failed. */
-#define	GLOB_ABORTED	(-2)	/* Unignored error. */
-#define	GLOB_NOMATCH	(-3)	/* No match and GLOB_NOCHECK not set. */
-#define	GLOB_NOSYS	(-4)	/* Function not supported. */
-#define GLOB_ABEND	GLOB_ABORTED
-
-int	glob(const char *, int, int (*)(const char *, int), glob_t *);
-void	globfree(glob_t *);
-
-#endif /* !_GLOB_H_ */
-
-#endif /* !defined(HAVE_GLOB_H) || !defined(GLOB_HAS_ALTDIRFUNC)  ||
-	  !defined(GLOB_HAS_GL_MATCHC */
-
diff --git a/crypto/openssh/openbsd-compat/inet_aton.c b/crypto/openssh/openbsd-compat/inet_aton.c
deleted file mode 100644
index 1fc001da60aa..000000000000
--- a/crypto/openssh/openbsd-compat/inet_aton.c
+++ /dev/null
@@ -1,193 +0,0 @@
-/*	$OpenBSD: inet_addr.c,v 1.6 1999/05/03 22:31:14 yanick Exp $	*/
-
-/*
- * ++Copyright++ 1983, 1990, 1993
- * -
- * Copyright (c) 1983, 1990, 1993
- *    The Regents of the University of California.  All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- * 	This product includes software developed by the University of
- * 	California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- * -
- * Portions Copyright (c) 1993 by Digital Equipment Corporation.
- * 
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies, and that
- * the name of Digital Equipment Corporation not be used in advertising or
- * publicity pertaining to distribution of the document or software without
- * specific, written prior permission.
- * 
- * THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL
- * WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS.   IN NO EVENT SHALL DIGITAL EQUIPMENT
- * CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
- * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
- * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
- * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
- * SOFTWARE.
- * -
- * --Copyright--
- */
-
-#include "includes.h"
-
-#if !defined(HAVE_INET_ATON)
-
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)inet_addr.c	8.1 (Berkeley) 6/17/93";
-static char rcsid[] = "$From: inet_addr.c,v 8.5 1996/08/05 08:31:35 vixie Exp $";
-#else
-static char rcsid[] = "$OpenBSD: inet_addr.c,v 1.6 1999/05/03 22:31:14 yanick Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
-
-#include <sys/types.h>
-#include <sys/param.h>
-#include <netinet/in.h>
-#include <arpa/inet.h>
-#include <ctype.h>
-
-#if 0
-/*
- * Ascii internet address interpretation routine.
- * The value returned is in network order.
- */
-in_addr_t
-inet_addr(cp)
-	register const char *cp;
-{
-	struct in_addr val;
-
-	if (inet_aton(cp, &val))
-		return (val.s_addr);
-	return (INADDR_NONE);
-}
-#endif
-
-/* 
- * Check whether "cp" is a valid ascii representation
- * of an Internet address and convert to a binary address.
- * Returns 1 if the address is valid, 0 if not.
- * This replaces inet_addr, the return value from which
- * cannot distinguish between failure and a local broadcast address.
- */
-int
-inet_aton(const char *cp, struct in_addr *addr)
-{
-	register u_int32_t val;
-	register int base, n;
-	register char c;
-	unsigned int parts[4];
-	register unsigned int *pp = parts;
-
-	c = *cp;
-	for (;;) {
-		/*
-		 * Collect number up to ``.''.
-		 * Values are specified as for C:
-		 * 0x=hex, 0=octal, isdigit=decimal.
-		 */
-		if (!isdigit(c))
-			return (0);
-		val = 0; base = 10;
-		if (c == '0') {
-			c = *++cp;
-			if (c == 'x' || c == 'X')
-				base = 16, c = *++cp;
-			else
-				base = 8;
-		}
-		for (;;) {
-			if (isascii(c) && isdigit(c)) {
-				val = (val * base) + (c - '0');
-				c = *++cp;
-			} else if (base == 16 && isascii(c) && isxdigit(c)) {
-				val = (val << 4) |
-					(c + 10 - (islower(c) ? 'a' : 'A'));
-				c = *++cp;
-			} else
-				break;
-		}
-		if (c == '.') {
-			/*
-			 * Internet format:
-			 *	a.b.c.d
-			 *	a.b.c	(with c treated as 16 bits)
-			 *	a.b	(with b treated as 24 bits)
-			 */
-			if (pp >= parts + 3)
-				return (0);
-			*pp++ = val;
-			c = *++cp;
-		} else
-			break;
-	}
-	/*
-	 * Check for trailing characters.
-	 */
-	if (c != '\0' && (!isascii(c) || !isspace(c)))
-		return (0);
-	/*
-	 * Concoct the address according to
-	 * the number of parts specified.
-	 */
-	n = pp - parts + 1;
-	switch (n) {
-
-	case 0:
-		return (0);		/* initial nondigit */
-
-	case 1:				/* a -- 32 bits */
-		break;
-
-	case 2:				/* a.b -- 8.24 bits */
-		if ((val > 0xffffff) || (parts[0] > 0xff))
-			return (0);
-		val |= parts[0] << 24;
-		break;
-
-	case 3:				/* a.b.c -- 8.8.16 bits */
-		if ((val > 0xffff) || (parts[0] > 0xff) || (parts[1] > 0xff))
-			return (0);
-		val |= (parts[0] << 24) | (parts[1] << 16);
-		break;
-
-	case 4:				/* a.b.c.d -- 8.8.8.8 bits */
-		if ((val > 0xff) || (parts[0] > 0xff) || (parts[1] > 0xff) || (parts[2] > 0xff))
-			return (0);
-		val |= (parts[0] << 24) | (parts[1] << 16) | (parts[2] << 8);
-		break;
-	}
-	if (addr)
-		addr->s_addr = htonl(val);
-	return (1);
-}
-
-#endif /* !defined(HAVE_INET_ATON) */
diff --git a/crypto/openssh/openbsd-compat/inet_aton.h b/crypto/openssh/openbsd-compat/inet_aton.h
deleted file mode 100644
index 9b59cb908a68..000000000000
--- a/crypto/openssh/openbsd-compat/inet_aton.h
+++ /dev/null
@@ -1,12 +0,0 @@
-/* $Id: inet_aton.h,v 1.4 2001/07/16 02:07:51 tim Exp $ */
-
-#ifndef _BSD_INET_ATON_H
-#define _BSD_INET_ATON_H
-
-#include "config.h"
-
-#ifndef HAVE_INET_ATON
-int inet_aton(const char *cp, struct in_addr *addr);
-#endif /* HAVE_INET_ATON */
-
-#endif /* _BSD_INET_ATON_H */
diff --git a/crypto/openssh/openbsd-compat/inet_ntoa.c b/crypto/openssh/openbsd-compat/inet_ntoa.c
deleted file mode 100644
index ac5f567081eb..000000000000
--- a/crypto/openssh/openbsd-compat/inet_ntoa.c
+++ /dev/null
@@ -1,64 +0,0 @@
-/*
- * Copyright (c) 1983, 1993
- *	The Regents of the University of California.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *	This product includes software developed by the University of
- *	California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "includes.h"
-
-#if defined(BROKEN_INET_NTOA) || !defined(HAVE_INET_NTOA)
-
-#if defined(LIBC_SCCS) && !defined(lint)
-static char rcsid[] = "$OpenBSD: inet_ntoa.c,v 1.3 2002/06/27 10:14:01 itojun Exp $";
-#endif /* LIBC_SCCS and not lint */
-
-/*
- * Convert network-format internet address
- * to base 256 d.d.d.d representation.
- */
-#include <sys/types.h>
-#include <netinet/in.h>
-#include <arpa/inet.h>
-#include <stdio.h>
-#include "inet_ntoa.h"
-
-char *inet_ntoa(struct in_addr in)
-{
-	static char b[18];
-	register char *p;
-
-	p = (char *)&in;
-#define	UC(b)	(((int)b)&0xff)
-	(void)snprintf(b, sizeof(b),
-	    "%u.%u.%u.%u", UC(p[0]), UC(p[1]), UC(p[2]), UC(p[3]));
-	return (b);
-}
-
-#endif /* defined(BROKEN_INET_NTOA) || !defined(HAVE_INET_NTOA) */
diff --git a/crypto/openssh/openbsd-compat/inet_ntoa.h b/crypto/openssh/openbsd-compat/inet_ntoa.h
deleted file mode 100644
index 85bc3d6fe43b..000000000000
--- a/crypto/openssh/openbsd-compat/inet_ntoa.h
+++ /dev/null
@@ -1,12 +0,0 @@
-/* $Id: inet_ntoa.h,v 1.2 2001/02/09 01:55:36 djm Exp $ */
-
-#ifndef _BSD_INET_NTOA_H
-#define _BSD_INET_NTOA_H
-
-#include "config.h"
-
-#if defined(BROKEN_INET_NTOA) || !defined(HAVE_INET_NTOA)
-char *inet_ntoa(struct in_addr in);
-#endif /* defined(BROKEN_INET_NTOA) || !defined(HAVE_INET_NTOA) */
-
-#endif /* _BSD_INET_NTOA_H */
diff --git a/crypto/openssh/openbsd-compat/inet_ntop.c b/crypto/openssh/openbsd-compat/inet_ntop.c
deleted file mode 100644
index 3bea519afb8c..000000000000
--- a/crypto/openssh/openbsd-compat/inet_ntop.c
+++ /dev/null
@@ -1,230 +0,0 @@
-/*	$OpenBSD: inet_ntop.c,v 1.5 2002/08/23 16:27:31 itojun Exp $	*/
-
-/* Copyright (c) 1996 by Internet Software Consortium.
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
- * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
- * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
- * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
- * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
- * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
- * SOFTWARE.
- */
-
-#include "includes.h"
-
-#ifndef HAVE_INET_NTOP
-
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char rcsid[] = "$From: inet_ntop.c,v 8.7 1996/08/05 08:41:18 vixie Exp $";
-#else
-static char rcsid[] = "$OpenBSD: inet_ntop.c,v 1.5 2002/08/23 16:27:31 itojun Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
-
-#include <sys/param.h>
-#include <sys/types.h>
-#include <sys/socket.h>
-#include "openbsd-compat/fake-socket.h"
-#include <netinet/in.h>
-#include <arpa/inet.h>
-#ifndef HAVE_CYGWIN
-#include <arpa/nameser.h>
-#endif
-#include <string.h>
-#include <errno.h>
-#include <stdio.h>
-
-#ifndef IN6ADDRSZ
-#define IN6ADDRSZ   16   /* IPv6 T_AAAA */                 
-#endif
-
-#ifndef INT16SZ
-#define INT16SZ     2    /* for systems without 16-bit ints */
-#endif
-
-/*
- * WARNING: Don't even consider trying to compile this on a system where
- * sizeof(int) < 4.  sizeof(int) > 4 is fine; all the world's not a VAX.
- */
-
-static const char *inet_ntop4(const u_char *src, char *dst, size_t size);
-static const char *inet_ntop6(const u_char *src, char *dst, size_t size);
-
-/* char *
- * inet_ntop(af, src, dst, size)
- *	convert a network format address to presentation format.
- * return:
- *	pointer to presentation format address (`dst'), or NULL (see errno).
- * author:
- *	Paul Vixie, 1996.
- */
-const char *
-inet_ntop(af, src, dst, size)
-	int af;
-	const void *src;
-	char *dst;
-	size_t size;
-{
-	switch (af) {
-	case AF_INET:
-		return (inet_ntop4(src, dst, size));
-	case AF_INET6:
-		return (inet_ntop6(src, dst, size));
-	default:
-		errno = EAFNOSUPPORT;
-		return (NULL);
-	}
-	/* NOTREACHED */
-}
-
-/* const char *
- * inet_ntop4(src, dst, size)
- *	format an IPv4 address, more or less like inet_ntoa()
- * return:
- *	`dst' (as a const)
- * notes:
- *	(1) uses no statics
- *	(2) takes a u_char* not an in_addr as input
- * author:
- *	Paul Vixie, 1996.
- */
-static const char *
-inet_ntop4(src, dst, size)
-	const u_char *src;
-	char *dst;
-	size_t size;
-{
-	static const char fmt[] = "%u.%u.%u.%u";
-	char tmp[sizeof "255.255.255.255"];
-	int l;
-
-	l = snprintf(tmp, size, fmt, src[0], src[1], src[2], src[3]);
-	if (l <= 0 || l >= size) {
-		errno = ENOSPC;
-		return (NULL);
-	}
-	strlcpy(dst, tmp, size);
-	return (dst);
-}
-
-/* const char *
- * inet_ntop6(src, dst, size)
- *	convert IPv6 binary address into presentation (printable) format
- * author:
- *	Paul Vixie, 1996.
- */
-static const char *
-inet_ntop6(src, dst, size)
-	const u_char *src;
-	char *dst;
-	size_t size;
-{
-	/*
-	 * Note that int32_t and int16_t need only be "at least" large enough
-	 * to contain a value of the specified size.  On some systems, like
-	 * Crays, there is no such thing as an integer variable with 16 bits.
-	 * Keep this in mind if you think this function should have been coded
-	 * to use pointer overlays.  All the world's not a VAX.
-	 */
-	char tmp[sizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255"];
-	char *tp, *ep;
-	struct { int base, len; } best, cur;
-	u_int words[IN6ADDRSZ / INT16SZ];
-	int i;
-	int advance;
-
-	/*
-	 * Preprocess:
-	 *	Copy the input (bytewise) array into a wordwise array.
-	 *	Find the longest run of 0x00's in src[] for :: shorthanding.
-	 */
-	memset(words, '\0', sizeof words);
-	for (i = 0; i < IN6ADDRSZ; i++)
-		words[i / 2] |= (src[i] << ((1 - (i % 2)) << 3));
-	best.base = -1;
-	cur.base = -1;
-	for (i = 0; i < (IN6ADDRSZ / INT16SZ); i++) {
-		if (words[i] == 0) {
-			if (cur.base == -1)
-				cur.base = i, cur.len = 1;
-			else
-				cur.len++;
-		} else {
-			if (cur.base != -1) {
-				if (best.base == -1 || cur.len > best.len)
-					best = cur;
-				cur.base = -1;
-			}
-		}
-	}
-	if (cur.base != -1) {
-		if (best.base == -1 || cur.len > best.len)
-			best = cur;
-	}
-	if (best.base != -1 && best.len < 2)
-		best.base = -1;
-
-	/*
-	 * Format the result.
-	 */
-	tp = tmp;
-	ep = tmp + sizeof(tmp);
-	for (i = 0; i < (IN6ADDRSZ / INT16SZ) && tp < ep; i++) {
-		/* Are we inside the best run of 0x00's? */
-		if (best.base != -1 && i >= best.base &&
-		    i < (best.base + best.len)) {
-			if (i == best.base) {
-				if (tp + 1 >= ep)
-					return (NULL);
-				*tp++ = ':';
-			}
-			continue;
-		}
-		/* Are we following an initial run of 0x00s or any real hex? */
-		if (i != 0) {
-			if (tp + 1 >= ep)
-				return (NULL);
-			*tp++ = ':';
-		}
-		/* Is this address an encapsulated IPv4? */
-		if (i == 6 && best.base == 0 &&
-		    (best.len == 6 || (best.len == 5 && words[5] == 0xffff))) {
-			if (!inet_ntop4(src+12, tp, (size_t)(ep - tp)))
-				return (NULL);
-			tp += strlen(tp);
-			break;
-		}
-		advance = snprintf(tp, ep - tp, "%x", words[i]);
-		if (advance <= 0 || advance >= ep - tp)
-			return (NULL);
-		tp += advance;
-	}
-	/* Was it a trailing run of 0x00's? */
-	if (best.base != -1 && (best.base + best.len) == (IN6ADDRSZ / INT16SZ)) {
-		if (tp + 1 >= ep)
-			return (NULL);
-		*tp++ = ':';
-	}
-	if (tp + 1 >= ep)
-		return (NULL);
-	*tp++ = '\0';
-
-	/*
-	 * Check for overflow, copy, and we're done.
-	 */
-	if ((size_t)(tp - tmp) > size) {
-		errno = ENOSPC;
-		return (NULL);
-	}
-	strlcpy(dst, tmp, size);
-	return (dst);
-}
-
-#endif /* !HAVE_INET_NTOP */
diff --git a/crypto/openssh/openbsd-compat/inet_ntop.h b/crypto/openssh/openbsd-compat/inet_ntop.h
deleted file mode 100644
index c774df95cc9d..000000000000
--- a/crypto/openssh/openbsd-compat/inet_ntop.h
+++ /dev/null
@@ -1,13 +0,0 @@
-/* $Id: inet_ntop.h,v 1.4 2001/08/09 00:56:53 mouring Exp $ */
-
-#ifndef _BSD_INET_NTOP_H
-#define _BSD_INET_NTOP_H
-
-#include "config.h"
-
-#ifndef HAVE_INET_NTOP
-const char *                 
-inet_ntop(int af, const void *src, char *dst, size_t size);
-#endif /* !HAVE_INET_NTOP */
-
-#endif /* _BSD_INET_NTOP_H */
diff --git a/crypto/openssh/openbsd-compat/mktemp.c b/crypto/openssh/openbsd-compat/mktemp.c
deleted file mode 100644
index c951050c0402..000000000000
--- a/crypto/openssh/openbsd-compat/mktemp.c
+++ /dev/null
@@ -1,184 +0,0 @@
-/* THIS FILE HAS BEEN MODIFIED FROM THE ORIGINAL OPENBSD SOURCE */
-/* Changes: Removed mktemp */
-
-/*
- * Copyright (c) 1987, 1993
- *	The Regents of the University of California.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *	This product includes software developed by the University of
- *	California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "includes.h"
-
-#if !defined(HAVE_MKDTEMP) || defined(HAVE_STRICT_MKSTEMP)
-
-#if defined(LIBC_SCCS) && !defined(lint)
-static char rcsid[] = "$OpenBSD: mktemp.c,v 1.16 2002/05/27 18:20:45 millert Exp $";
-#endif /* LIBC_SCCS and not lint */
-
-#ifdef HAVE_CYGWIN
-#define open binary_open
-extern int binary_open();
-#endif
-
-static int _gettemp(char *, int *, int, int);
-
-int
-mkstemps(path, slen)
-	char *path;
-	int slen;
-{
-	int fd;
-
-	return (_gettemp(path, &fd, 0, slen) ? fd : -1);
-}
-
-int
-mkstemp(path)
-	char *path;
-{
-	int fd;
-
-	return (_gettemp(path, &fd, 0, 0) ? fd : -1);
-}
-
-char *
-mkdtemp(path)
-	char *path;
-{
-	return(_gettemp(path, (int *)NULL, 1, 0) ? path : (char *)NULL);
-}
-
-static int
-_gettemp(path, doopen, domkdir, slen)
-	char *path;
-	register int *doopen;
-	int domkdir;
-	int slen;
-{
-	register char *start, *trv, *suffp;
-	struct stat sbuf;
-	int rval;
-	pid_t pid;
-
-	if (doopen && domkdir) {
-		errno = EINVAL;
-		return(0);
-	}
-
-	for (trv = path; *trv; ++trv)
-		;
-	trv -= slen;
-	suffp = trv;
-	--trv;
-	if (trv < path) {
-		errno = EINVAL;
-		return (0);
-	}
-	pid = getpid();
-	while (trv >= path && *trv == 'X' && pid != 0) {
-		*trv-- = (pid % 10) + '0';
-		pid /= 10;
-	}
-	while (trv >= path && *trv == 'X') {
-		char c;
-
-		pid = (arc4random() & 0xffff) % (26+26);
-		if (pid < 26)
-			c = pid + 'A';
-		else
-			c = (pid - 26) + 'a';
-		*trv-- = c;
-	}
-	start = trv + 1;
-
-	/*
-	 * check the target directory; if you have six X's and it
-	 * doesn't exist this runs for a *very* long time.
-	 */
-	if (doopen || domkdir) {
-		for (;; --trv) {
-			if (trv <= path)
-				break;
-			if (*trv == '/') {
-				*trv = '\0';
-				rval = stat(path, &sbuf);
-				*trv = '/';
-				if (rval != 0)
-					return(0);
-				if (!S_ISDIR(sbuf.st_mode)) {
-					errno = ENOTDIR;
-					return(0);
-				}
-				break;
-			}
-		}
-	}
-
-	for (;;) {
-		if (doopen) {
-			if ((*doopen =
-			    open(path, O_CREAT|O_EXCL|O_RDWR, 0600)) >= 0)
-				return(1);
-			if (errno != EEXIST)
-				return(0);
-		} else if (domkdir) {
-			if (mkdir(path, 0700) == 0)
-				return(1);
-			if (errno != EEXIST)
-				return(0);
-		} else if (lstat(path, &sbuf))
-			return(errno == ENOENT ? 1 : 0);
-
-		/* tricky little algorithm for backward compatibility */
-		for (trv = start;;) {
-			if (!*trv)
-				return (0);
-			if (*trv == 'Z') {
-				if (trv == suffp)
-					return (0);
-				*trv++ = 'a';
-			} else {
-				if (isdigit(*trv))
-					*trv = 'a';
-				else if (*trv == 'z')	/* inc from z to A */
-					*trv = 'A';
-				else {
-					if (trv == suffp)
-						return (0);
-					++*trv;
-				}
-				break;
-			}
-		}
-	}
-	/*NOTREACHED*/
-}
-
-#endif /* !defined(HAVE_MKDTEMP) || defined(HAVE_STRICT_MKSTEMP) */
diff --git a/crypto/openssh/openbsd-compat/mktemp.h b/crypto/openssh/openbsd-compat/mktemp.h
deleted file mode 100644
index 505ca6a1f23a..000000000000
--- a/crypto/openssh/openbsd-compat/mktemp.h
+++ /dev/null
@@ -1,13 +0,0 @@
-/* $Id: mktemp.h,v 1.3 2003/01/07 04:18:33 djm Exp $ */
-
-#ifndef _BSD_MKTEMP_H
-#define _BSD_MKTEMP_H
-
-#include "config.h"
-#if !defined(HAVE_MKDTEMP) || defined(HAVE_STRICT_MKSTEMP)
-int mkstemps(char *path, int slen);
-int mkstemp(char *path);
-char *mkdtemp(char *path);
-#endif /* !defined(HAVE_MKDTEMP) || defined(HAVE_STRICT_MKSTEMP) */
-
-#endif /* _BSD_MKTEMP_H */
diff --git a/crypto/openssh/openbsd-compat/openbsd-compat.h b/crypto/openssh/openbsd-compat/openbsd-compat.h
deleted file mode 100644
index c3e19b9cb8e1..000000000000
--- a/crypto/openssh/openbsd-compat/openbsd-compat.h
+++ /dev/null
@@ -1,49 +0,0 @@
-/* $Id: openbsd-compat.h,v 1.19 2003/02/24 01:55:56 djm Exp $ */
-
-#ifndef _OPENBSD_H
-#define _OPENBSD_H
-
-#include "config.h"
-
-/* OpenBSD function replacements */
-#include "basename.h"
-#include "bindresvport.h"
-#include "getcwd.h"
-#include "realpath.h"
-#include "rresvport.h"
-#include "strlcpy.h"
-#include "strlcat.h"
-#include "strmode.h"
-#include "mktemp.h"
-#include "daemon.h"
-#include "dirname.h"
-#include "base64.h"
-#include "sigact.h"
-#include "inet_ntoa.h"
-#include "inet_ntop.h"
-#include "strsep.h"
-#include "setproctitle.h"
-#include "getgrouplist.h"
-#include "glob.h"
-#include "readpassphrase.h"
-#include "getopt.h"
-#include "vis.h"
-
-/* Home grown routines */
-#include "bsd-arc4random.h"
-#include "bsd-getpeereid.h"
-#include "bsd-misc.h"
-#include "bsd-snprintf.h"
-#include "bsd-waitpid.h"
-
-/* rfc2553 socket API replacements */
-#include "fake-getaddrinfo.h"
-#include "fake-getnameinfo.h"
-#include "fake-socket.h"
-
-/* Routines for a single OS platform */
-#include "bsd-cray.h"
-#include "port-irix.h"
-#include "port-aix.h"
-
-#endif /* _OPENBSD_H */
diff --git a/crypto/openssh/openbsd-compat/port-aix.c b/crypto/openssh/openbsd-compat/port-aix.c
deleted file mode 100644
index 4c96a3171b90..000000000000
--- a/crypto/openssh/openbsd-compat/port-aix.c
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- *
- * Copyright (c) 2001 Gert Doering.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- */
-#include "includes.h"
-
-#ifdef _AIX
-
-#include <uinfo.h>
-#include <../xmalloc.h>
-
-/*
- * AIX has a "usrinfo" area where logname and other stuff is stored - 
- * a few applications actually use this and die if it's not set
- *
- * NOTE: TTY= should be set, but since no one uses it and it's hard to
- * acquire due to privsep code.  We will just drop support.
- */
-void
-aix_usrinfo(struct passwd *pw)
-{
-	u_int i;
-	char *cp;
-
-	cp = xmalloc(16 + 2 * strlen(pw->pw_name));
-	i = sprintf(cp, "LOGNAME=%s%cNAME=%s%c", pw->pw_name, 0, 
-	    pw->pw_name, 0);
-	if (usrinfo(SETUINFO, cp, i) == -1)
-		fatal("Couldn't set usrinfo: %s", strerror(errno));
-	debug3("AIX/UsrInfo: set len %d", i);
-	xfree(cp);
-}
-
-#endif /* _AIX */
-
diff --git a/crypto/openssh/openbsd-compat/port-aix.h b/crypto/openssh/openbsd-compat/port-aix.h
deleted file mode 100644
index 4abe003168b8..000000000000
--- a/crypto/openssh/openbsd-compat/port-aix.h
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
- *
- * Copyright (c) 2001 Gert Doering.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- */
-
-#ifdef _AIX
-
-/* AIX 4.2.x doesn't have nanosleep but does have nsleep which is equivalent */
-#if !defined(HAVE_NANOSLEEP) && defined(HAVE_NSLEEP)
-# define nanosleep(a,b) nsleep(a,b)
-#endif
-
-/* For struct timespec on AIX 4.2.x */
-#ifdef HAVE_SYS_TIMERS_H
-# include <sys/timers.h>
-#endif
-
-void aix_usrinfo(struct passwd *pw);
-#endif /* _AIX */
diff --git a/crypto/openssh/openbsd-compat/port-irix.c b/crypto/openssh/openbsd-compat/port-irix.c
deleted file mode 100644
index a63ec429a871..000000000000
--- a/crypto/openssh/openbsd-compat/port-irix.c
+++ /dev/null
@@ -1,61 +0,0 @@
-#include "includes.h"
-
-#if defined(WITH_IRIX_PROJECT) || defined(WITH_IRIX_JOBS) || defined(WITH_IRIX_ARRAY)
-
-#ifdef WITH_IRIX_PROJECT
-#include <proj.h>
-#endif /* WITH_IRIX_PROJECT */
-#ifdef WITH_IRIX_JOBS
-#include <sys/resource.h>
-#endif
-#ifdef WITH_IRIX_AUDIT
-#include <sat.h>
-#endif /* WITH_IRIX_AUDIT */
-
-void
-irix_setusercontext(struct passwd *pw)
-{
-#ifdef WITH_IRIX_PROJECT
-        prid_t projid;
-#endif /* WITH_IRIX_PROJECT */
-#ifdef WITH_IRIX_JOBS
-        jid_t jid = 0;
-#else
-# ifdef WITH_IRIX_ARRAY
-        int jid = 0;
-# endif /* WITH_IRIX_ARRAY */
-#endif /* WITH_IRIX_JOBS */
-
-#ifdef WITH_IRIX_JOBS
-        jid = jlimit_startjob(pw->pw_name, pw->pw_uid, "interactive");
-        if (jid == -1)
-                fatal("Failed to create job container: %.100s",
-                    strerror(errno));
-#endif /* WITH_IRIX_JOBS */
-#ifdef WITH_IRIX_ARRAY
-        /* initialize array session */
-        if (jid == 0  && newarraysess() != 0)
-                fatal("Failed to set up new array session: %.100s",
-                    strerror(errno));
-#endif /* WITH_IRIX_ARRAY */
-#ifdef WITH_IRIX_PROJECT
-        /* initialize irix project info */
-        if ((projid = getdfltprojuser(pw->pw_name)) == -1) {
-                debug("Failed to get project id, using projid 0");
-                projid = 0;
-        }
-        if (setprid(projid))
-                fatal("Failed to initialize project %d for %s: %.100s",
-                    (int)projid, pw->pw_name, strerror(errno));
-#endif /* WITH_IRIX_PROJECT */
-#ifdef WITH_IRIX_AUDIT
-        if (sysconf(_SC_AUDIT)) {
-                debug("Setting sat id to %d", (int) pw->pw_uid);
-                if (satsetid(pw->pw_uid))
-                        debug("error setting satid: %.100s", strerror(errno));
-        }
-#endif /* WITH_IRIX_AUDIT */
-}
-
-
-#endif /* defined(WITH_IRIX_PROJECT) || defined(WITH_IRIX_JOBS) || defined(WITH_IRIX_ARRAY) */
diff --git a/crypto/openssh/openbsd-compat/port-irix.h b/crypto/openssh/openbsd-compat/port-irix.h
deleted file mode 100644
index 2dd3c2e25d84..000000000000
--- a/crypto/openssh/openbsd-compat/port-irix.h
+++ /dev/null
@@ -1,5 +0,0 @@
-#if defined(WITH_IRIX_PROJECT) || defined(WITH_IRIX_JOBS) || defined(WITH_IRIX_ARRAY)
-
-void irix_setusercontext(struct passwd *pw);
-
-#endif /* defined(WITH_IRIX_PROJECT) || defined(WITH_IRIX_JOBS) || defined(WITH_IRIX_ARRAY) */
diff --git a/crypto/openssh/openbsd-compat/readpassphrase.c b/crypto/openssh/openbsd-compat/readpassphrase.c
deleted file mode 100644
index 4e549b62b91e..000000000000
--- a/crypto/openssh/openbsd-compat/readpassphrase.c
+++ /dev/null
@@ -1,190 +0,0 @@
-/*	$OpenBSD: readpassphrase.c,v 1.14 2002/06/28 01:43:58 millert Exp $	*/
-
-/*
- * Copyright (c) 2000-2002 Todd C. Miller <Todd.Miller@courtesan.com>
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. The name of the author may not be used to endorse or promote products
- *    derived from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
- * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL
- * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
- * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
- * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
- * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
- * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$OpenBSD: readpassphrase.c,v 1.14 2002/06/28 01:43:58 millert Exp $";
-#endif /* LIBC_SCCS and not lint */
-
-#include "includes.h"
-
-#ifndef HAVE_READPASSPHRASE
-
-#include <termios.h>
-#include <readpassphrase.h>
-
-#ifdef TCSASOFT
-# define _T_FLUSH	(TCSAFLUSH|TCSASOFT)
-#else
-# define _T_FLUSH	(TCSAFLUSH)
-#endif
-
-/* SunOS 4.x which lacks _POSIX_VDISABLE, but has VDISABLE */
-#if !defined(_POSIX_VDISABLE) && defined(VDISABLE)
-#  define _POSIX_VDISABLE       VDISABLE
-#endif
-
-static volatile sig_atomic_t signo;
-
-static void handler(int);
-
-char *
-readpassphrase(const char *prompt, char *buf, size_t bufsiz, int flags)
-{
-	ssize_t nr;
-	int input, output, save_errno;
-	char ch, *p, *end;
-	struct termios term, oterm;
-	struct sigaction sa, savealrm, saveint, savehup, savequit, saveterm;
-	struct sigaction savetstp, savettin, savettou, savepipe;
-
-	/* I suppose we could alloc on demand in this case (XXX). */
-	if (bufsiz == 0) {
-		errno = EINVAL;
-		return(NULL);
-	}
-
-restart:
-	signo = 0;
-	/*
-	 * Read and write to /dev/tty if available.  If not, read from
-	 * stdin and write to stderr unless a tty is required.
-	 */
-	if ((flags & RPP_STDIN) ||
-	    (input = output = open(_PATH_TTY, O_RDWR)) == -1) {
-		if (flags & RPP_REQUIRE_TTY) {
-			errno = ENOTTY;
-			return(NULL);
-		}
-		input = STDIN_FILENO;
-		output = STDERR_FILENO;
-	}
-
-	/*
-	 * Catch signals that would otherwise cause the user to end
-	 * up with echo turned off in the shell.  Don't worry about
-	 * things like SIGXCPU and SIGVTALRM for now.
-	 */
-	sigemptyset(&sa.sa_mask);
-	sa.sa_flags = 0;		/* don't restart system calls */
-	sa.sa_handler = handler;
-	(void)sigaction(SIGALRM, &sa, &savealrm);
-	(void)sigaction(SIGHUP, &sa, &savehup);
-	(void)sigaction(SIGINT, &sa, &saveint);
-	(void)sigaction(SIGPIPE, &sa, &savepipe);
-	(void)sigaction(SIGQUIT, &sa, &savequit);
-	(void)sigaction(SIGTERM, &sa, &saveterm);
-	(void)sigaction(SIGTSTP, &sa, &savetstp);
-	(void)sigaction(SIGTTIN, &sa, &savettin);
-	(void)sigaction(SIGTTOU, &sa, &savettou);
-
-	/* Turn off echo if possible. */
-	if (input != STDIN_FILENO && tcgetattr(input, &oterm) == 0) {
-		memcpy(&term, &oterm, sizeof(term));
-		if (!(flags & RPP_ECHO_ON))
-			term.c_lflag &= ~(ECHO | ECHONL);
-#ifdef VSTATUS
-		if (term.c_cc[VSTATUS] != _POSIX_VDISABLE)
-			term.c_cc[VSTATUS] = _POSIX_VDISABLE;
-#endif
-		(void)tcsetattr(input, _T_FLUSH, &term);
-	} else {
-		memset(&term, 0, sizeof(term));
-		term.c_lflag |= ECHO;
-		memset(&oterm, 0, sizeof(oterm));
-		oterm.c_lflag |= ECHO;
-	}
-
-	if (!(flags & RPP_STDIN))
-		(void)write(output, prompt, strlen(prompt));
-	end = buf + bufsiz - 1;
-	for (p = buf; (nr = read(input, &ch, 1)) == 1 && ch != '\n' && ch != '\r';) {
-		if (p < end) {
-			if ((flags & RPP_SEVENBIT))
-				ch &= 0x7f;
-			if (isalpha(ch)) {
-				if ((flags & RPP_FORCELOWER))
-					ch = tolower(ch);
-				if ((flags & RPP_FORCEUPPER))
-					ch = toupper(ch);
-			}
-			*p++ = ch;
-		}
-	}
-	*p = '\0';
-	save_errno = errno;
-	if (!(term.c_lflag & ECHO))
-		(void)write(output, "\n", 1);
-
-	/* Restore old terminal settings and signals. */
-	if (memcmp(&term, &oterm, sizeof(term)) != 0)
-		(void)tcsetattr(input, _T_FLUSH, &oterm);
-	(void)sigaction(SIGALRM, &savealrm, NULL);
-	(void)sigaction(SIGHUP, &savehup, NULL);
-	(void)sigaction(SIGINT, &saveint, NULL);
-	(void)sigaction(SIGQUIT, &savequit, NULL);
-	(void)sigaction(SIGPIPE, &savepipe, NULL);
-	(void)sigaction(SIGTERM, &saveterm, NULL);
-	(void)sigaction(SIGTSTP, &savetstp, NULL);
-	(void)sigaction(SIGTTIN, &savettin, NULL);
-	if (input != STDIN_FILENO)
-		(void)close(input);
-
-	/*
-	 * If we were interrupted by a signal, resend it to ourselves
-	 * now that we have restored the signal handlers.
-	 */
-	if (signo) {
-		kill(getpid(), signo);
-		switch (signo) {
-		case SIGTSTP:
-		case SIGTTIN:
-		case SIGTTOU:
-			goto restart;
-		}
-	}
-
-	errno = save_errno;
-	return(nr == -1 ? NULL : buf);
-}
-  
-#if 0
-char *
-getpass(const char *prompt)
-{
-	static char buf[_PASSWORD_LEN + 1];
-
-	return(readpassphrase(prompt, buf, sizeof(buf), RPP_ECHO_OFF));
-}
-#endif
-
-static void handler(int s)
-{
-	signo = s;
-}
-#endif /* HAVE_READPASSPHRASE */
diff --git a/crypto/openssh/openbsd-compat/readpassphrase.h b/crypto/openssh/openbsd-compat/readpassphrase.h
deleted file mode 100644
index 92908a489552..000000000000
--- a/crypto/openssh/openbsd-compat/readpassphrase.h
+++ /dev/null
@@ -1,49 +0,0 @@
-/*	$OpenBSD: readpassphrase.h,v 1.3 2002/06/28 12:32:22 millert Exp $	*/
-
-/*
- * Copyright (c) 2000 Todd C. Miller <Todd.Miller@courtesan.com>
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. The name of the author may not be used to endorse or promote products
- *    derived from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
- * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL
- * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
- * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
- * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
- * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
- * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef _READPASSPHRASE_H_
-#define _READPASSPHRASE_H_
-
-#include "includes.h"
-
-#ifndef HAVE_READPASSPHRASE
-
-#define RPP_ECHO_OFF    0x00		/* Turn off echo (default). */
-#define RPP_ECHO_ON     0x01		/* Leave echo on. */
-#define RPP_REQUIRE_TTY 0x02		/* Fail if there is no tty. */
-#define RPP_FORCELOWER  0x04		/* Force input to lower case. */
-#define RPP_FORCEUPPER  0x08		/* Force input to upper case. */
-#define RPP_SEVENBIT    0x10		/* Strip the high bit from input. */
-#define RPP_STDIN       0x20		/* Read from stdin, not /dev/tty */
-
-char * readpassphrase(const char *, char *, size_t, int);
-
-#endif /* HAVE_READPASSPHRASE */
-
-#endif /* !_READPASSPHRASE_H_ */
diff --git a/crypto/openssh/openbsd-compat/realpath.c b/crypto/openssh/openbsd-compat/realpath.c
deleted file mode 100644
index b9035ca229fb..000000000000
--- a/crypto/openssh/openbsd-compat/realpath.c
+++ /dev/null
@@ -1,166 +0,0 @@
-/*
- * Copyright (c) 1994
- *	The Regents of the University of California.  All rights reserved.
- *
- * This code is derived from software contributed to Berkeley by
- * Jan-Simon Pendry.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "includes.h"
-
-#if !defined(HAVE_REALPATH) || defined(BROKEN_REALPATH)
-
-#if defined(LIBC_SCCS) && !defined(lint)
-static char *rcsid = "$OpenBSD: realpath.c,v 1.7 2002/05/24 21:22:37 deraadt Exp $";
-#endif /* LIBC_SCCS and not lint */
-
-#include <sys/param.h>
-#include <sys/stat.h>
-
-#include <errno.h>
-#include <fcntl.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-
-/*
- * MAXSYMLINKS
- */
-#ifndef MAXSYMLINKS
-#define MAXSYMLINKS 5
-#endif
-
-/*
- * char *realpath(const char *path, char resolved_path[MAXPATHLEN]);
- *
- * Find the real name of path, by removing all ".", ".." and symlink
- * components.  Returns (resolved) on success, or (NULL) on failure,
- * in which case the path which caused trouble is left in (resolved).
- */
-char *
-realpath(const char *path, char *resolved)
-{
-	struct stat sb;
-	int fd, n, rootd, serrno = 0;
-	char *p, *q, wbuf[MAXPATHLEN], start[MAXPATHLEN];
-	int symlinks = 0;
-
-	/* Save the starting point. */
-	getcwd(start,MAXPATHLEN);	
-	if ((fd = open(".", O_RDONLY)) < 0) {
-		(void)strlcpy(resolved, ".", MAXPATHLEN);
-		return (NULL);
-	}
-	close(fd);
-
-	/* Convert "." -> "" to optimize away a needless lstat() and chdir() */
-	if (path[0] == '.' && path[1] == '\0')
-		path = "";
-
-	/*
-	 * Find the dirname and basename from the path to be resolved.
-	 * Change directory to the dirname component.
-	 * lstat the basename part.
-	 *     if it is a symlink, read in the value and loop.
-	 *     if it is a directory, then change to that directory.
-	 * get the current directory name and append the basename.
-	 */
-	strlcpy(resolved, path, MAXPATHLEN);
-loop:
-	q = strrchr(resolved, '/');
-	if (q != NULL) {
-		p = q + 1;
-		if (q == resolved)
-			q = "/";
-		else {
-			do {
-				--q;
-			} while (q > resolved && *q == '/');
-			q[1] = '\0';
-			q = resolved;
-		}
-		if (chdir(q) < 0)
-			goto err1;
-	} else
-		p = resolved;
-
-	/* Deal with the last component. */
-	if (*p != '\0' && lstat(p, &sb) == 0) {
-		if (S_ISLNK(sb.st_mode)) {
-			if (++symlinks > MAXSYMLINKS) {
-				serrno = ELOOP;
-				goto err1;
-			}
-			n = readlink(p, resolved, MAXPATHLEN-1);
-			if (n < 0)
-				goto err1;
-			resolved[n] = '\0';
-			goto loop;
-		}
-		if (S_ISDIR(sb.st_mode)) {
-			if (chdir(p) < 0)
-				goto err1;
-			p = "";
-		}
-	}
-
-	/*
-	 * Save the last component name and get the full pathname of
-	 * the current directory.
-	 */
-	(void)strlcpy(wbuf, p, sizeof wbuf);
-	if (getcwd(resolved, MAXPATHLEN) == 0)
-		goto err1;
-
-	/*
-	 * Join the two strings together, ensuring that the right thing
-	 * happens if the last component is empty, or the dirname is root.
-	 */
-	if (resolved[0] == '/' && resolved[1] == '\0')
-		rootd = 1;
-	else
-		rootd = 0;
-
-	if (*wbuf) {
-		if (strlen(resolved) + strlen(wbuf) + rootd + 1 > MAXPATHLEN) {
-			serrno = ENAMETOOLONG;
-			goto err1;
-		}
-		if (rootd == 0)
-			(void)strcat(resolved, "/");
-		(void)strcat(resolved, wbuf);
-	}
-
-	/* Go back to where we came from. */
-	if (chdir(start) < 0) {
-		serrno = errno;
-		goto err2;
-	}
-	return (resolved);
-
-err1:	chdir(start);
-err2:	errno = serrno;
-	return (NULL);
-}
-#endif /* !defined(HAVE_REALPATH) || defined(BROKEN_REALPATH) */
diff --git a/crypto/openssh/openbsd-compat/realpath.h b/crypto/openssh/openbsd-compat/realpath.h
deleted file mode 100644
index 25e4075d73b8..000000000000
--- a/crypto/openssh/openbsd-compat/realpath.h
+++ /dev/null
@@ -1,13 +0,0 @@
-/* $Id: realpath.h,v 1.2 2001/02/09 01:55:36 djm Exp $ */
-
-#ifndef _BSD_REALPATH_H
-#define _BSD_REALPATH_H
-
-#include "config.h"
-
-#if !defined(HAVE_REALPATH) || defined(BROKEN_REALPATH)
-
-char *realpath(const char *path, char *resolved);
-
-#endif /* !defined(HAVE_REALPATH) || defined(BROKEN_REALPATH) */
-#endif /* _BSD_REALPATH_H */
diff --git a/crypto/openssh/openbsd-compat/rresvport.c b/crypto/openssh/openbsd-compat/rresvport.c
deleted file mode 100644
index 9f058961de2d..000000000000
--- a/crypto/openssh/openbsd-compat/rresvport.c
+++ /dev/null
@@ -1,106 +0,0 @@
-/*
- * Copyright (c) 1995, 1996, 1998 Theo de Raadt.  All rights reserved.
- * Copyright (c) 1983, 1993, 1994
- *	The Regents of the University of California.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *	This product includes software developed by the University of
- *	California, Berkeley and its contributors.
- *	This product includes software developed by Theo de Raadt.
- * 4. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "includes.h"
-
-#ifndef HAVE_RRESVPORT_AF
-
-#if defined(LIBC_SCCS) && !defined(lint)
-static char *rcsid = "$OpenBSD: rresvport.c,v 1.5 2000/01/26 03:43:20 deraadt Exp $";
-#endif /* LIBC_SCCS and not lint */
-
-#include "includes.h"
-
-#if 0
-int
-rresvport(alport)
-	int *alport;
-{
-	return rresvport_af(alport, AF_INET);
-}
-#endif
-
-int 
-rresvport_af(int *alport, sa_family_t af)
-{
-	struct sockaddr_storage ss;
-	struct sockaddr *sa;
-	u_int16_t *portp;
-	int s;
-	socklen_t salen;
-
-	memset(&ss, '\0', sizeof ss);
-	sa = (struct sockaddr *)&ss;
-
-	switch (af) {
-	case AF_INET:
-		salen = sizeof(struct sockaddr_in);
-		portp = &((struct sockaddr_in *)sa)->sin_port;
-		break;
-	case AF_INET6:
-		salen = sizeof(struct sockaddr_in6);
-		portp = &((struct sockaddr_in6 *)sa)->sin6_port;
-		break;
-	default:
-		errno = EPFNOSUPPORT;
-		return (-1);
-	}
-	sa->sa_family = af;
-	
-	s = socket(af, SOCK_STREAM, 0);
-	if (s < 0)
-		return (-1);
-
-	*portp = htons(*alport);
-	if (*alport < IPPORT_RESERVED - 1) {
-		if (bind(s, sa, salen) >= 0)
-			return (s);
-		if (errno != EADDRINUSE) {
-			(void)close(s);
-			return (-1);
-		}
-	}
-
-	*portp = 0;
-	sa->sa_family = af;
-	if (bindresvport_sa(s, sa) == -1) {
-		(void)close(s);
-		return (-1);
-	}
-	*alport = ntohs(*portp);
-	return (s);
-}
-
-#endif /* HAVE_RRESVPORT_AF */
diff --git a/crypto/openssh/openbsd-compat/rresvport.h b/crypto/openssh/openbsd-compat/rresvport.h
deleted file mode 100644
index a52e4515be38..000000000000
--- a/crypto/openssh/openbsd-compat/rresvport.h
+++ /dev/null
@@ -1,12 +0,0 @@
-/* $Id: rresvport.h,v 1.2 2001/02/09 01:55:36 djm Exp $ */
-
-#ifndef _BSD_RRESVPORT_H
-#define _BSD_RRESVPORT_H
-
-#include "config.h"
-
-#ifndef HAVE_RRESVPORT_AF
-int rresvport_af(int *alport, sa_family_t af);
-#endif /* !HAVE_RRESVPORT_AF */
-
-#endif /* _BSD_RRESVPORT_H */
diff --git a/crypto/openssh/openbsd-compat/setenv.c b/crypto/openssh/openbsd-compat/setenv.c
deleted file mode 100644
index e5c5de62ec2d..000000000000
--- a/crypto/openssh/openbsd-compat/setenv.c
+++ /dev/null
@@ -1,163 +0,0 @@
-/*
- * Copyright (c) 1987 Regents of the University of California.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *	This product includes software developed by the University of
- *	California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "includes.h"
-#ifndef HAVE_SETENV
-
-#if defined(LIBC_SCCS) && !defined(lint)
-static char *rcsid = "$OpenBSD: setenv.c,v 1.5 2002/12/10 22:44:13 mickey Exp $";
-#endif /* LIBC_SCCS and not lint */
-
-#include <stdlib.h>
-#include <string.h>
-
-char *__findenv(const char *name, int *offset);
-
-/*
- * __findenv --
- *	Returns pointer to value associated with name, if any, else NULL.
- *	Sets offset to be the offset of the name/value combination in the
- *	environmental array, for use by setenv(3) and unsetenv(3).
- *	Explicitly removes '=' in argument name.
- *
- *	This routine *should* be a static; don't use it.
- */
-char *
-__findenv(name, offset)
-	register const char *name;
-	int *offset;
-{
-	extern char **environ;
-	register int len, i;
-	register const char *np;
-	register char **p, *cp;
-
-	if (name == NULL || environ == NULL)
-		return (NULL);
-	for (np = name; *np && *np != '='; ++np)
-		;
-	len = np - name;
-	for (p = environ; (cp = *p) != NULL; ++p) {
-		for (np = name, i = len; i && *cp; i--)
-			if (*cp++ != *np++)
-				break;
-		if (i == 0 && *cp++ == '=') {
-			*offset = p - environ;
-			return (cp);
-		}
-	}
-	return (NULL);
-}
-
-/*
- * setenv --
- *	Set the value of the environmental variable "name" to be
- *	"value".  If rewrite is set, replace any current value.
- */
-int
-setenv(name, value, rewrite)
-	register const char *name;
-	register const char *value;
-	int rewrite;
-{
-	extern char **environ;
-	static int alloced;			/* if allocated space before */
-	register char *C;
-	int l_value, offset;
-
-	if (*value == '=')			/* no `=' in value */
-		++value;
-	l_value = strlen(value);
-	if ((C = __findenv(name, &offset))) {	/* find if already exists */
-		if (!rewrite)
-			return (0);
-		if (strlen(C) >= l_value) {	/* old larger; copy over */
-			while ((*C++ = *value++))
-				;
-			return (0);
-		}
-	} else {					/* create new slot */
-		register int	cnt;
-		register char	**P;
-
-		for (P = environ, cnt = 0; *P; ++P, ++cnt);
-		if (alloced) {			/* just increase size */
-			P = (char **)realloc((void *)environ,
-			    (size_t)(sizeof(char *) * (cnt + 2)));
-			if (!P)
-				return (-1);
-			environ = P;
-		}
-		else {				/* get new space */
-			alloced = 1;		/* copy old entries into it */
-			P = (char **)malloc((size_t)(sizeof(char *) *
-			    (cnt + 2)));
-			if (!P)
-				return (-1);
-			memmove(P, environ, cnt * sizeof(char *));
-			environ = P;
-		}
-		environ[cnt + 1] = NULL;
-		offset = cnt;
-	}
-	for (C = (char *)name; *C && *C != '='; ++C);	/* no `=' in name */
-	if (!(environ[offset] =			/* name + `=' + value */
-	    malloc((size_t)((int)(C - name) + l_value + 2))))
-		return (-1);
-	for (C = environ[offset]; (*C = *name++) && *C != '='; ++C)
-		;
-	for (*C++ = '='; (*C++ = *value++); )
-		;
-	return (0);
-}
-
-/*
- * unsetenv(name) --
- *	Delete environmental variable "name".
- */
-void
-unsetenv(name)
-	const char	*name;
-{
-	extern char **environ;
-	register char **P;
-	int offset;
-	char *__findenv();
-
-	while (__findenv(name, &offset))		/* if set multiple times */
-		for (P = &environ[offset];; ++P)
-			if (!(*P = *(P + 1)))
-				break;
-}
-
-#endif /* HAVE_SETENV */
diff --git a/crypto/openssh/openbsd-compat/setenv.h b/crypto/openssh/openbsd-compat/setenv.h
deleted file mode 100644
index 77256d80293f..000000000000
--- a/crypto/openssh/openbsd-compat/setenv.h
+++ /dev/null
@@ -1,14 +0,0 @@
-/* $Id: setenv.h,v 1.2 2001/02/09 01:55:36 djm Exp $ */
-
-#ifndef _BSD_SETENV_H
-#define _BSD_SETENV_H
-
-#include "config.h"
-
-#ifndef HAVE_SETENV
-
-int setenv(register const char *name, register const char *value, int rewrite);
-
-#endif /* !HAVE_SETENV */
-
-#endif /* _BSD_SETENV_H */
diff --git a/crypto/openssh/openbsd-compat/setproctitle.c b/crypto/openssh/openbsd-compat/setproctitle.c
deleted file mode 100644
index 07af7e9c0919..000000000000
--- a/crypto/openssh/openbsd-compat/setproctitle.c
+++ /dev/null
@@ -1,243 +0,0 @@
-/*
- * Based on src/backend/utils/misc/pg_status.c from 
- * PostgreSQL Database Management System
- * 
- * Portions Copyright (c) 1996-2001, The PostgreSQL Global Development Group
- * 
- * Portions Copyright (c) 1994, The Regents of the University of California
- * 
- * Permission to use, copy, modify, and distribute this software and its
- * documentation for any purpose, without fee, and without a written agreement
- * is hereby granted, provided that the above copyright notice and this
- * paragraph and the following two paragraphs appear in all copies.
- * 
- * IN NO EVENT SHALL THE UNIVERSITY OF CALIFORNIA BE LIABLE TO ANY PARTY FOR
- * DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES, INCLUDING
- * LOST PROFITS, ARISING OUT OF THE USE OF THIS SOFTWARE AND ITS
- * DOCUMENTATION, EVEN IF THE UNIVERSITY OF CALIFORNIA HAS BEEN ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- * 
- * THE UNIVERSITY OF CALIFORNIA SPECIFICALLY DISCLAIMS ANY WARRANTIES,
- * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS FOR A PARTICULAR PURPOSE.  THE SOFTWARE PROVIDED HEREUNDER IS
- * ON AN "AS IS" BASIS, AND THE UNIVERSITY OF CALIFORNIA HAS NO OBLIGATIONS TO
- * PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS.
- */
-
-/*--------------------------------------------------------------------
- * ps_status.c
- *
- * Routines to support changing the ps display of PostgreSQL backends
- * to contain some useful information. Mechanism differs wildly across
- * platforms.
- *
- * $Header: /var/cvs/openssh/openbsd-compat/setproctitle.c,v 1.5 2003/01/20 02:15:11 djm Exp $
- *
- * Copyright 2000 by PostgreSQL Global Development Group
- * various details abducted from various places
- *--------------------------------------------------------------------
- */
-
-#include "includes.h"
-
-#ifndef HAVE_SETPROCTITLE
-
-#include <unistd.h>
-#ifdef HAVE_SYS_PSTAT_H
-#include <sys/pstat.h>		/* for HP-UX */
-#endif
-#ifdef HAVE_PS_STRINGS
-#include <machine/vmparam.h>	/* for old BSD */
-#include <sys/exec.h>
-#endif
-
-/*------
- * Alternative ways of updating ps display:
- *
- * SETPROCTITLE_STRATEGY == PS_USE_PSTAT
- *	   use the pstat(PSTAT_SETCMD, )
- *	   (HPUX)
- * SETPROCTITLE_STRATEGY == PS_USE_PS_STRINGS
- *	   assign PS_STRINGS->ps_argvstr = "string"
- *	   (some BSD systems)
- * SETPROCTITLE_STRATEGY == PS_USE_CHANGE_ARGV
- *	   assign argv[0] = "string"
- *	   (some other BSD systems)
- * SETPROCTITLE_STRATEGY == PS_USE_CLOBBER_ARGV
- *	   write over the argv and environment area
- *	   (most SysV-like systems)
- * SETPROCTITLE_STRATEGY == PS_USE_NONE
- *	   don't update ps display
- *	   (This is the default, as it is safest.)
- */
-
-#define PS_USE_NONE			0
-#define PS_USE_PSTAT			1
-#define PS_USE_PS_STRINGS		2
-#define PS_USE_CHANGE_ARGV		3
-#define PS_USE_CLOBBER_ARGV		4
-
-#ifndef SETPROCTITLE_STRATEGY
-# define SETPROCTITLE_STRATEGY	PS_USE_NONE 
-#endif
-
-#ifndef SETPROCTITLE_PS_PADDING
-# define SETPROCTITLE_PS_PADDING	' '
-#endif
-#endif /* HAVE_SETPROCTITLE */
-
-extern char **environ;
-
-/*
- * argv clobbering uses existing argv space, all other methods need a buffer
- */
-#if SETPROCTITLE_STRATEGY != PS_USE_CLOBBER_ARGV
-static char ps_buffer[256];
-static const size_t ps_buffer_size = sizeof(ps_buffer);
-#else
-static char *ps_buffer;			/* will point to argv area */
-static size_t ps_buffer_size;		/* space determined at run time */
-#endif
-
-/* save the original argv[] location here */
-static int	save_argc;
-static char **save_argv;
-
-extern char *__progname;
-
-#ifndef HAVE_SETPROCTITLE
-/*
- * Call this to update the ps status display to a fixed prefix plus an
- * indication of what you're currently doing passed in the argument.
- */
-void
-setproctitle(const char *fmt, ...)
-{
-#if SETPROCTITLE_STRATEGY == PS_USE_PSTAT
-	union pstun pst;
-#endif
-#if SETPROCTITLE_STRATEGY != PS_USE_NONE
-	ssize_t used;
-	va_list ap;
-
-	/* no ps display if you didn't call save_ps_display_args() */
-	if (save_argv == NULL)
-		return;
-#if SETPROCTITLE_STRATEGY == PS_USE_CLOBBER_ARGV
-	/* If ps_buffer is a pointer, it might still be null */
-	if (ps_buffer == NULL)
-		return;
-#endif /* PS_USE_CLOBBER_ARGV */
-
-	/*
-	 * Overwrite argv[] to point at appropriate space, if needed
-	 */
-#if SETPROCTITLE_STRATEGY == PS_USE_CHANGE_ARGV
-	save_argv[0] = ps_buffer;
-	save_argv[1] = NULL;
-#endif /* PS_USE_CHANGE_ARGV */
-
-#if SETPROCTITLE_STRATEGY == PS_USE_CLOBBER_ARGV
-	save_argv[1] = NULL;
-#endif /* PS_USE_CLOBBER_ARGV */
-
-	/*
-	 * Make fixed prefix of ps display.
-	 */
-
-	va_start(ap, fmt);
-	if (fmt == NULL)
-		snprintf(ps_buffer, ps_buffer_size, "%s", __progname);
-	else {
-		used = snprintf(ps_buffer, ps_buffer_size, "%s: ", __progname);
-		if (used == -1 || used >= ps_buffer_size)
-			used = ps_buffer_size;
-		vsnprintf(ps_buffer + used, ps_buffer_size - used, fmt, ap);
-	}
-	va_end(ap);
-
-#if SETPROCTITLE_STRATEGY == PS_USE_PSTAT
-	pst.pst_command = ps_buffer;
-	pstat(PSTAT_SETCMD, pst, strlen(ps_buffer), 0, 0);
-#endif   /* PS_USE_PSTAT */
-
-#if SETPROCTITLE_STRATEGY == PS_USE_PS_STRINGS
-	PS_STRINGS->ps_nargvstr = 1;
-	PS_STRINGS->ps_argvstr = ps_buffer;
-#endif   /* PS_USE_PS_STRINGS */
-
-#if SETPROCTITLE_STRATEGY == PS_USE_CLOBBER_ARGV
-	/* pad unused memory */
-	used = strlen(ps_buffer);
-	memset(ps_buffer + used, SETPROCTITLE_PS_PADDING, 
-	    ps_buffer_size - used);
-#endif   /* PS_USE_CLOBBER_ARGV */
-
-#endif /* PS_USE_NONE */
-}
-
-#endif /* HAVE_SETPROCTITLE */
-
-/*
- * Call this early in startup to save the original argc/argv values.
- *
- * argv[] will not be overwritten by this routine, but may be overwritten
- * during setproctitle. Also, the physical location of the environment
- * strings may be moved, so this should be called before any code that
- * might try to hang onto a getenv() result.
- */
-void
-compat_init_setproctitle(int argc, char *argv[])
-{
-#if SETPROCTITLE_STRATEGY == PS_USE_CLOBBER_ARGV
-	char *end_of_area = NULL;
-	char **new_environ;
-	int i;
-#endif
-
-	save_argc = argc;
-	save_argv = argv;
-
-#if SETPROCTITLE_STRATEGY == PS_USE_CLOBBER_ARGV
-	/*
-	 * If we're going to overwrite the argv area, count the available
-	 * space.  Also move the environment to make additional room.
-	 */
-
-	/*
-	 * check for contiguous argv strings
-	 */
-	for (i = 0; i < argc; i++) {
-		if (i == 0 || end_of_area + 1 == argv[i])
-			end_of_area = argv[i] + strlen(argv[i]);
-	}
-
-	/* probably can't happen? */
-	if (end_of_area == NULL) {
-		ps_buffer = NULL;
-		ps_buffer_size = 0;
-		return;
-	}
-
-	/*
-	 * check for contiguous environ strings following argv
-	 */
-	for (i = 0; environ[i] != NULL; i++) {
-		if (end_of_area + 1 == environ[i])
-			end_of_area = environ[i] + strlen(environ[i]);
-	}
-
-	ps_buffer = argv[0];
-	ps_buffer_size = end_of_area - argv[0] - 1;
-
-	/*
-	 * Duplicate and move the environment out of the way
-	 */
-	new_environ = malloc(sizeof(char *) * (i + 1));
-	for (i = 0; environ[i] != NULL; i++)
-		new_environ[i] = strdup(environ[i]);
-	new_environ[i] = NULL;
-	environ = new_environ;
-#endif /* PS_USE_CLOBBER_ARGV */
-}
-
diff --git a/crypto/openssh/openbsd-compat/setproctitle.h b/crypto/openssh/openbsd-compat/setproctitle.h
deleted file mode 100644
index 48d26c6ea365..000000000000
--- a/crypto/openssh/openbsd-compat/setproctitle.h
+++ /dev/null
@@ -1,13 +0,0 @@
-/* $Id: setproctitle.h,v 1.3 2003/01/09 22:53:13 djm Exp $ */
-
-#ifndef _BSD_SETPROCTITLE_H
-#define _BSD_SETPROCTITLE_H
-
-#include "config.h"
-
-#ifndef HAVE_SETPROCTITLE
-void setproctitle(const char *fmt, ...);
-void compat_init_setproctitle(int argc, char *argv[]);
-#endif
-
-#endif /* _BSD_SETPROCTITLE_H */
diff --git a/crypto/openssh/openbsd-compat/sigact.c b/crypto/openssh/openbsd-compat/sigact.c
deleted file mode 100644
index 35fbab0eb9d4..000000000000
--- a/crypto/openssh/openbsd-compat/sigact.c
+++ /dev/null
@@ -1,102 +0,0 @@
-/*	$OpenBSD: sigaction.c,v 1.3 1999/06/27 08:14:21 millert Exp $	*/
-
-/****************************************************************************
- * Copyright (c) 1998 Free Software Foundation, Inc.                        *
- *                                                                          *
- * Permission is hereby granted, free of charge, to any person obtaining a  *
- * copy of this software and associated documentation files (the            *
- * "Software"), to deal in the Software without restriction, including      *
- * without limitation the rights to use, copy, modify, merge, publish,      *
- * distribute, distribute with modifications, sublicense, and/or sell       *
- * copies of the Software, and to permit persons to whom the Software is    *
- * furnished to do so, subject to the following conditions:                 *
- *                                                                          *
- * The above copyright notice and this permission notice shall be included  *
- * in all copies or substantial portions of the Software.                   *
- *                                                                          *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS  *
- * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF               *
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.   *
- * IN NO EVENT SHALL THE ABOVE COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,   *
- * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR    *
- * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR    *
- * THE USE OR OTHER DEALINGS IN THE SOFTWARE.                               *
- *                                                                          *
- * Except as contained in this notice, the name(s) of the above copyright   *
- * holders shall not be used in advertising or otherwise to promote the     *
- * sale, use or other dealings in this Software without prior written       *
- * authorization.                                                           *
- ****************************************************************************/
-
-/****************************************************************************
- *  Author: Zeyd M. Ben-Halim <zmbenhal@netcom.com> 1992,1995               *
- *     and: Eric S. Raymond <esr@snark.thyrsus.com>                         *
- ****************************************************************************/
-
-#include "includes.h"
-#include <signal.h>
-#include "sigact.h"
-
-/* This file provides sigaction() emulation using sigvec() */
-/* Use only if this is non POSIX system */
-
-#if !HAVE_SIGACTION && HAVE_SIGVEC
-
-int
-sigaction(int sig, struct sigaction *sigact, struct sigaction *osigact)
-{
-	return sigvec(sig, &(sigact->sv), &(osigact->sv));
-}
-
-int
-sigemptyset (sigset_t * mask)
-{
-	*mask = 0;
-	return 0;
-}
-
-int
-sigprocmask (int mode, sigset_t * mask, sigset_t * omask)
-{
-	sigset_t current = sigsetmask(0);
-
-	if (omask) *omask = current;
-
-	if (mode==SIG_BLOCK)
-		current |= *mask;
-	else if (mode==SIG_UNBLOCK)
-		current &= ~*mask;
-	else if (mode==SIG_SETMASK)
-	current = *mask;
-
-	sigsetmask(current);
-	return 0;
-}
-
-int
-sigsuspend (sigset_t * mask)
-{
-	return sigpause(*mask);
-}
-
-int
-sigdelset (sigset_t * mask, int sig)
-{
-	*mask &= ~sigmask(sig);
-	return 0;
-}
-
-int
-sigaddset (sigset_t * mask, int sig)
-{
-	*mask |= sigmask(sig);
-	return 0;
-}
-
-int
-sigismember (sigset_t * mask, int sig)
-{
-	return (*mask & sigmask(sig)) != 0;
-}
-
-#endif
diff --git a/crypto/openssh/openbsd-compat/sigact.h b/crypto/openssh/openbsd-compat/sigact.h
deleted file mode 100644
index b37c1f84a8f1..000000000000
--- a/crypto/openssh/openbsd-compat/sigact.h
+++ /dev/null
@@ -1,88 +0,0 @@
-/*	$OpenBSD: SigAction.h,v 1.2 1999/06/27 08:15:19 millert Exp $	*/
-
-/****************************************************************************
- * Copyright (c) 1998 Free Software Foundation, Inc.                        *
- *                                                                          *
- * Permission is hereby granted, free of charge, to any person obtaining a  *
- * copy of this software and associated documentation files (the            *
- * "Software"), to deal in the Software without restriction, including      *
- * without limitation the rights to use, copy, modify, merge, publish,      *
- * distribute, distribute with modifications, sublicense, and/or sell       *
- * copies of the Software, and to permit persons to whom the Software is    *
- * furnished to do so, subject to the following conditions:                 *
- *                                                                          *
- * The above copyright notice and this permission notice shall be included  *
- * in all copies or substantial portions of the Software.                   *
- *                                                                          *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS  *
- * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF               *
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.   *
- * IN NO EVENT SHALL THE ABOVE COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,   *
- * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR    *
- * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR    *
- * THE USE OR OTHER DEALINGS IN THE SOFTWARE.                               *
- *                                                                          *
- * Except as contained in this notice, the name(s) of the above copyright   *
- * holders shall not be used in advertising or otherwise to promote the     *
- * sale, use or other dealings in this Software without prior written       *
- * authorization.                                                           *
- ****************************************************************************/
-
-/****************************************************************************
- *  Author: Zeyd M. Ben-Halim <zmbenhal@netcom.com> 1992,1995               *
- *     and: Eric S. Raymond <esr@snark.thyrsus.com>                         *
- ****************************************************************************/
-
-/*
- * $From: SigAction.h,v 1.5 1999/06/19 23:00:54 tom Exp $
- *
- * This file exists to handle non-POSIX systems which don't have <unistd.h>,
- * and usually no sigaction() nor <termios.h>
- */
-
-#ifndef _SIGACTION_H
-#define _SIGACTION_H
-
-#if !defined(HAVE_SIGACTION) && defined(HAVE_SIGVEC)
-
-#undef  SIG_BLOCK
-#define SIG_BLOCK       00
-
-#undef  SIG_UNBLOCK
-#define SIG_UNBLOCK     01
-
-#undef  SIG_SETMASK
-#define SIG_SETMASK     02
-
-/*
- * <bsd/signal.h> is in the Linux 1.2.8 + gcc 2.7.0 configuration,
- * and is useful for testing this header file.
- */
-#if HAVE_BSD_SIGNAL_H
-# include <bsd/signal.h>
-#endif
-
-struct sigaction
-{
-	struct sigvec sv;
-};
-
-typedef unsigned long sigset_t;
-
-#undef  sa_mask
-#define sa_mask sv.sv_mask
-#undef  sa_handler
-#define sa_handler sv.sv_handler
-#undef  sa_flags
-#define sa_flags sv.sv_flags
-
-int sigaction(int sig, struct sigaction *sigact, struct sigaction *osigact);
-int sigprocmask (int how, sigset_t *mask, sigset_t *omask);
-int sigemptyset (sigset_t *mask);
-int sigsuspend (sigset_t *mask);
-int sigdelset (sigset_t *mask, int sig);
-int sigaddset (sigset_t *mask, int sig);
-
-#endif /* !defined(HAVE_SIGACTION) && defined(HAVE_SIGVEC) */
-
-#endif /* !defined(_SIGACTION_H) */
diff --git a/crypto/openssh/openbsd-compat/strlcat.c b/crypto/openssh/openbsd-compat/strlcat.c
deleted file mode 100644
index 3a9b5d1a75f0..000000000000
--- a/crypto/openssh/openbsd-compat/strlcat.c
+++ /dev/null
@@ -1,79 +0,0 @@
-/*	$OpenBSD: strlcat.c,v 1.8 2001/05/13 15:40:15 deraadt Exp $	*/
-
-/*
- * Copyright (c) 1998 Todd C. Miller <Todd.Miller@courtesan.com>
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. The name of the author may not be used to endorse or promote products
- *    derived from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
- * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL
- * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
- * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
- * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
- * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
- * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-#ifndef HAVE_STRLCAT
-
-#if defined(LIBC_SCCS) && !defined(lint)
-static char *rcsid = "$OpenBSD: strlcat.c,v 1.8 2001/05/13 15:40:15 deraadt Exp $";
-#endif /* LIBC_SCCS and not lint */
-
-#include <sys/types.h>
-#include <string.h>
-#include "strlcat.h"
-
-/*
- * Appends src to string dst of size siz (unlike strncat, siz is the
- * full size of dst, not space left).  At most siz-1 characters
- * will be copied.  Always NUL terminates (unless siz <= strlen(dst)).
- * Returns strlen(src) + MIN(siz, strlen(initial dst)).
- * If retval >= siz, truncation occurred.
- */
-size_t
-strlcat(dst, src, siz)
-	char *dst;
-	const char *src;
-	size_t siz;
-{
-	register char *d = dst;
-	register const char *s = src;
-	register size_t n = siz;
-	size_t dlen;
-
-	/* Find the end of dst and adjust bytes left but don't go past end */
-	while (n-- != 0 && *d != '\0')
-		d++;
-	dlen = d - dst;
-	n = siz - dlen;
-
-	if (n == 0)
-		return(dlen + strlen(s));
-	while (*s != '\0') {
-		if (n != 1) {
-			*d++ = *s;
-			n--;
-		}
-		s++;
-	}
-	*d = '\0';
-
-	return(dlen + (s - src));	/* count does not include NUL */
-}
-
-#endif /* !HAVE_STRLCAT */
diff --git a/crypto/openssh/openbsd-compat/strlcat.h b/crypto/openssh/openbsd-compat/strlcat.h
deleted file mode 100644
index 75366856321b..000000000000
--- a/crypto/openssh/openbsd-compat/strlcat.h
+++ /dev/null
@@ -1,12 +0,0 @@
-/* $Id: strlcat.h,v 1.2 2001/02/09 01:55:36 djm Exp $ */
-
-#ifndef _BSD_STRLCAT_H
-#define _BSD_STRLCAT_H
-
-#include "config.h"
-#ifndef HAVE_STRLCAT
-#include <sys/types.h>
-size_t strlcat(char *dst, const char *src, size_t siz);
-#endif /* !HAVE_STRLCAT */
-
-#endif /* _BSD_STRLCAT_H */
diff --git a/crypto/openssh/openbsd-compat/strlcpy.c b/crypto/openssh/openbsd-compat/strlcpy.c
deleted file mode 100644
index 2f87eca44283..000000000000
--- a/crypto/openssh/openbsd-compat/strlcpy.c
+++ /dev/null
@@ -1,75 +0,0 @@
-/*	$OpenBSD: strlcpy.c,v 1.5 2001/05/13 15:40:16 deraadt Exp $	*/
-
-/*
- * Copyright (c) 1998 Todd C. Miller <Todd.Miller@courtesan.com>
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. The name of the author may not be used to endorse or promote products
- *    derived from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
- * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL
- * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
- * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
- * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
- * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
- * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-#ifndef HAVE_STRLCPY
-
-#if defined(LIBC_SCCS) && !defined(lint)
-static char *rcsid = "$OpenBSD: strlcpy.c,v 1.5 2001/05/13 15:40:16 deraadt Exp $";
-#endif /* LIBC_SCCS and not lint */
-
-#include <sys/types.h>
-#include <string.h>
-#include "strlcpy.h"
-
-/*
- * Copy src to string dst of size siz.  At most siz-1 characters
- * will be copied.  Always NUL terminates (unless siz == 0).
- * Returns strlen(src); if retval >= siz, truncation occurred.
- */
-size_t
-strlcpy(dst, src, siz)
-	char *dst;
-	const char *src;
-	size_t siz;
-{
-	register char *d = dst;
-	register const char *s = src;
-	register size_t n = siz;
-
-	/* Copy as many bytes as will fit */
-	if (n != 0 && --n != 0) {
-		do {
-			if ((*d++ = *s++) == 0)
-				break;
-		} while (--n != 0);
-	}
-
-	/* Not enough room in dst, add NUL and traverse rest of src */
-	if (n == 0) {
-		if (siz != 0)
-			*d = '\0';		/* NUL-terminate dst */
-		while (*s++)
-			;
-	}
-
-	return(s - src - 1);	/* count does not include NUL */
-}
-
-#endif /* !HAVE_STRLCPY */
diff --git a/crypto/openssh/openbsd-compat/strlcpy.h b/crypto/openssh/openbsd-compat/strlcpy.h
deleted file mode 100644
index 3b137670dd26..000000000000
--- a/crypto/openssh/openbsd-compat/strlcpy.h
+++ /dev/null
@@ -1,12 +0,0 @@
-/* $Id: strlcpy.h,v 1.2 2001/02/09 01:55:36 djm Exp $ */
-
-#ifndef _BSD_STRLCPY_H
-#define _BSD_STRLCPY_H
-
-#include "config.h"
-#ifndef HAVE_STRLCPY
-#include <sys/types.h>
-size_t strlcpy(char *dst, const char *src, size_t siz);
-#endif /* !HAVE_STRLCPY */
-
-#endif /* _BSD_STRLCPY_H */
diff --git a/crypto/openssh/openbsd-compat/strmode.c b/crypto/openssh/openbsd-compat/strmode.c
deleted file mode 100644
index e64d19869ebc..000000000000
--- a/crypto/openssh/openbsd-compat/strmode.c
+++ /dev/null
@@ -1,156 +0,0 @@
-/*-
- * Copyright (c) 1990 The Regents of the University of California.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *	This product includes software developed by the University of
- *	California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "includes.h"
-#ifndef HAVE_STRMODE
-
-#if defined(LIBC_SCCS) && !defined(lint)
-static char *rcsid = "$OpenBSD: strmode.c,v 1.3 1997/06/13 13:57:20 deraadt Exp $";
-#endif /* LIBC_SCCS and not lint */
-
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <string.h>
-
-void
-strmode(register mode_t mode, register char *p)
-{
-	 /* print type */
-	switch (mode & S_IFMT) {
-	case S_IFDIR:			/* directory */
-		*p++ = 'd';
-		break;
-	case S_IFCHR:			/* character special */
-		*p++ = 'c';
-		break;
-	case S_IFBLK:			/* block special */
-		*p++ = 'b';
-		break;
-	case S_IFREG:			/* regular */
-		*p++ = '-';
-		break;
-	case S_IFLNK:			/* symbolic link */
-		*p++ = 'l';
-		break;
-#ifdef S_IFSOCK
-	case S_IFSOCK:			/* socket */
-		*p++ = 's';
-		break;
-#endif
-#ifdef S_IFIFO
-	case S_IFIFO:			/* fifo */
-		*p++ = 'p';
-		break;
-#endif
-#ifdef S_IFWHT
-	case S_IFWHT:			/* whiteout */
-		*p++ = 'w';
-		break;
-#endif
-	default:			/* unknown */
-		*p++ = '?';
-		break;
-	}
-	/* usr */
-	if (mode & S_IRUSR)
-		*p++ = 'r';
-	else
-		*p++ = '-';
-	if (mode & S_IWUSR)
-		*p++ = 'w';
-	else
-		*p++ = '-';
-	switch (mode & (S_IXUSR | S_ISUID)) {
-	case 0:
-		*p++ = '-';
-		break;
-	case S_IXUSR:
-		*p++ = 'x';
-		break;
-	case S_ISUID:
-		*p++ = 'S';
-		break;
-	case S_IXUSR | S_ISUID:
-		*p++ = 's';
-		break;
-	}
-	/* group */
-	if (mode & S_IRGRP)
-		*p++ = 'r';
-	else
-		*p++ = '-';
-	if (mode & S_IWGRP)
-		*p++ = 'w';
-	else
-		*p++ = '-';
-	switch (mode & (S_IXGRP | S_ISGID)) {
-	case 0:
-		*p++ = '-';
-		break;
-	case S_IXGRP:
-		*p++ = 'x';
-		break;
-	case S_ISGID:
-		*p++ = 'S';
-		break;
-	case S_IXGRP | S_ISGID:
-		*p++ = 's';
-		break;
-	}
-	/* other */
-	if (mode & S_IROTH)
-		*p++ = 'r';
-	else
-		*p++ = '-';
-	if (mode & S_IWOTH)
-		*p++ = 'w';
-	else
-		*p++ = '-';
-	switch (mode & (S_IXOTH | S_ISVTX)) {
-	case 0:
-		*p++ = '-';
-		break;
-	case S_IXOTH:
-		*p++ = 'x';
-		break;
-	case S_ISVTX:
-		*p++ = 'T';
-		break;
-	case S_IXOTH | S_ISVTX:
-		*p++ = 't';
-		break;
-	}
-	*p++ = ' ';		/* will be a '+' if ACL's implemented */
-	*p = '\0';
-}
-#endif
diff --git a/crypto/openssh/openbsd-compat/strmode.h b/crypto/openssh/openbsd-compat/strmode.h
deleted file mode 100644
index 64f7c8aae0a4..000000000000
--- a/crypto/openssh/openbsd-compat/strmode.h
+++ /dev/null
@@ -1,7 +0,0 @@
-/* $Id: strmode.h,v 1.3 2001/06/09 02:22:17 mouring Exp $ */
-
-#ifndef HAVE_STRMODE
-
-void strmode(register mode_t mode, register char *p);
-
-#endif
diff --git a/crypto/openssh/openbsd-compat/strsep.c b/crypto/openssh/openbsd-compat/strsep.c
deleted file mode 100644
index d0afc44ae0f1..000000000000
--- a/crypto/openssh/openbsd-compat/strsep.c
+++ /dev/null
@@ -1,89 +0,0 @@
-/*	$OpenBSD: strsep.c,v 1.3 1997/08/20 04:28:14 millert Exp $	*/
-
-/*-
- * Copyright (c) 1990, 1993
- *	The Regents of the University of California.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *	This product includes software developed by the University of
- *	California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "includes.h"
-
-#if !defined(HAVE_STRSEP)
-
-#include <string.h>
-#include <stdio.h>
-
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)strsep.c	8.1 (Berkeley) 6/4/93";
-#else
-static char *rcsid = "$OpenBSD: strsep.c,v 1.3 1997/08/20 04:28:14 millert Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
-
-/*
- * Get next token from string *stringp, where tokens are possibly-empty
- * strings separated by characters from delim.  
- *
- * Writes NULs into the string at *stringp to end tokens.
- * delim need not remain constant from call to call.
- * On return, *stringp points past the last NUL written (if there might
- * be further tokens), or is NULL (if there are definitely no more tokens).
- *
- * If *stringp is NULL, strsep returns NULL.
- */
-char *
-strsep(char **stringp, const char *delim)
-{
-	register char *s;
-	register const char *spanp;
-	register int c, sc;
-	char *tok;
-
-	if ((s = *stringp) == NULL)
-		return (NULL);
-	for (tok = s;;) {
-		c = *s++;
-		spanp = delim;
-		do {
-			if ((sc = *spanp++) == c) {
-				if (c == 0)
-					s = NULL;
-				else
-					s[-1] = 0;
-				*stringp = s;
-				return (tok);
-			}
-		} while (sc != 0);
-	}
-	/* NOTREACHED */
-}
-
-#endif /* !defined(HAVE_STRSEP) */
diff --git a/crypto/openssh/openbsd-compat/strsep.h b/crypto/openssh/openbsd-compat/strsep.h
deleted file mode 100644
index 6ed810ac14ee..000000000000
--- a/crypto/openssh/openbsd-compat/strsep.h
+++ /dev/null
@@ -1,12 +0,0 @@
-/* $Id: strsep.h,v 1.2 2001/02/09 01:55:36 djm Exp $ */
-
-#ifndef _BSD_STRSEP_H
-#define _BSD_STRSEP_H
-
-#include "config.h"
-
-#ifndef HAVE_STRSEP
-char *strsep(char **stringp, const char *delim);
-#endif /* HAVE_STRSEP */
-
-#endif /* _BSD_STRSEP_H */
diff --git a/crypto/openssh/openbsd-compat/sys-queue.h b/crypto/openssh/openbsd-compat/sys-queue.h
deleted file mode 100644
index 176fe31741c3..000000000000
--- a/crypto/openssh/openbsd-compat/sys-queue.h
+++ /dev/null
@@ -1,584 +0,0 @@
-/*	$OpenBSD: queue.h,v 1.22 2001/06/23 04:39:35 angelos Exp $	*/
-/*	$NetBSD: queue.h,v 1.11 1996/05/16 05:17:14 mycroft Exp $	*/
-
-/*
- * Copyright (c) 1991, 1993
- *	The Regents of the University of California.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *	This product includes software developed by the University of
- *	California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- *	@(#)queue.h	8.5 (Berkeley) 8/20/94
- */
-
-#ifndef	_FAKE_QUEUE_H_
-#define	_FAKE_QUEUE_H_
-
-/*
- * Ignore all <sys/queue.h> since older platforms have broken/incomplete
- * <sys/queue.h> that are too hard to work around.
- */
-#undef SLIST_HEAD
-#undef SLIST_HEAD_INITIALIZER
-#undef SLIST_ENTRY
-#undef SLIST_FIRST
-#undef SLIST_END
-#undef SLIST_EMPTY
-#undef SLIST_NEXT
-#undef SLIST_FOREACH
-#undef SLIST_INIT
-#undef SLIST_INSERT_AFTER
-#undef SLIST_INSERT_HEAD
-#undef SLIST_REMOVE_HEAD
-#undef SLIST_REMOVE
-#undef LIST_HEAD
-#undef LIST_HEAD_INITIALIZER
-#undef LIST_ENTRY
-#undef LIST_FIRST
-#undef LIST_END
-#undef LIST_EMPTY
-#undef LIST_NEXT
-#undef LIST_FOREACH
-#undef LIST_INIT
-#undef LIST_INSERT_AFTER
-#undef LIST_INSERT_BEFORE
-#undef LIST_INSERT_HEAD
-#undef LIST_REMOVE
-#undef LIST_REPLACE
-#undef SIMPLEQ_HEAD
-#undef SIMPLEQ_HEAD_INITIALIZER
-#undef SIMPLEQ_ENTRY
-#undef SIMPLEQ_FIRST
-#undef SIMPLEQ_END
-#undef SIMPLEQ_EMPTY
-#undef SIMPLEQ_NEXT
-#undef SIMPLEQ_FOREACH
-#undef SIMPLEQ_INIT
-#undef SIMPLEQ_INSERT_HEAD
-#undef SIMPLEQ_INSERT_TAIL
-#undef SIMPLEQ_INSERT_AFTER
-#undef SIMPLEQ_REMOVE_HEAD
-#undef TAILQ_HEAD
-#undef TAILQ_HEAD_INITIALIZER
-#undef TAILQ_ENTRY
-#undef TAILQ_FIRST
-#undef TAILQ_END
-#undef TAILQ_NEXT
-#undef TAILQ_LAST
-#undef TAILQ_PREV
-#undef TAILQ_EMPTY
-#undef TAILQ_FOREACH
-#undef TAILQ_FOREACH_REVERSE
-#undef TAILQ_INIT
-#undef TAILQ_INSERT_HEAD
-#undef TAILQ_INSERT_TAIL
-#undef TAILQ_INSERT_AFTER
-#undef TAILQ_INSERT_BEFORE
-#undef TAILQ_REMOVE
-#undef TAILQ_REPLACE
-#undef CIRCLEQ_HEAD
-#undef CIRCLEQ_HEAD_INITIALIZER
-#undef CIRCLEQ_ENTRY
-#undef CIRCLEQ_FIRST
-#undef CIRCLEQ_LAST
-#undef CIRCLEQ_END
-#undef CIRCLEQ_NEXT
-#undef CIRCLEQ_PREV
-#undef CIRCLEQ_EMPTY
-#undef CIRCLEQ_FOREACH
-#undef CIRCLEQ_FOREACH_REVERSE
-#undef CIRCLEQ_INIT
-#undef CIRCLEQ_INSERT_AFTER
-#undef CIRCLEQ_INSERT_BEFORE
-#undef CIRCLEQ_INSERT_HEAD
-#undef CIRCLEQ_INSERT_TAIL
-#undef CIRCLEQ_REMOVE
-#undef CIRCLEQ_REPLACE
-
-/*
- * This file defines five types of data structures: singly-linked lists, 
- * lists, simple queues, tail queues, and circular queues.
- *
- *
- * A singly-linked list is headed by a single forward pointer. The elements
- * are singly linked for minimum space and pointer manipulation overhead at
- * the expense of O(n) removal for arbitrary elements. New elements can be
- * added to the list after an existing element or at the head of the list.
- * Elements being removed from the head of the list should use the explicit
- * macro for this purpose for optimum efficiency. A singly-linked list may
- * only be traversed in the forward direction.  Singly-linked lists are ideal
- * for applications with large datasets and few or no removals or for
- * implementing a LIFO queue.
- *
- * A list is headed by a single forward pointer (or an array of forward
- * pointers for a hash table header). The elements are doubly linked
- * so that an arbitrary element can be removed without a need to
- * traverse the list. New elements can be added to the list before
- * or after an existing element or at the head of the list. A list
- * may only be traversed in the forward direction.
- *
- * A simple queue is headed by a pair of pointers, one the head of the
- * list and the other to the tail of the list. The elements are singly
- * linked to save space, so elements can only be removed from the
- * head of the list. New elements can be added to the list before or after
- * an existing element, at the head of the list, or at the end of the
- * list. A simple queue may only be traversed in the forward direction.
- *
- * A tail queue is headed by a pair of pointers, one to the head of the
- * list and the other to the tail of the list. The elements are doubly
- * linked so that an arbitrary element can be removed without a need to
- * traverse the list. New elements can be added to the list before or
- * after an existing element, at the head of the list, or at the end of
- * the list. A tail queue may be traversed in either direction.
- *
- * A circle queue is headed by a pair of pointers, one to the head of the
- * list and the other to the tail of the list. The elements are doubly
- * linked so that an arbitrary element can be removed without a need to
- * traverse the list. New elements can be added to the list before or after
- * an existing element, at the head of the list, or at the end of the list.
- * A circle queue may be traversed in either direction, but has a more
- * complex end of list detection.
- *
- * For details on the use of these macros, see the queue(3) manual page.
- */
-
-/*
- * Singly-linked List definitions.
- */
-#define SLIST_HEAD(name, type)						\
-struct name {								\
-	struct type *slh_first;	/* first element */			\
-}
- 
-#define	SLIST_HEAD_INITIALIZER(head)					\
-	{ NULL }
- 
-#define SLIST_ENTRY(type)						\
-struct {								\
-	struct type *sle_next;	/* next element */			\
-}
- 
-/*
- * Singly-linked List access methods.
- */
-#define	SLIST_FIRST(head)	((head)->slh_first)
-#define	SLIST_END(head)		NULL
-#define	SLIST_EMPTY(head)	(SLIST_FIRST(head) == SLIST_END(head))
-#define	SLIST_NEXT(elm, field)	((elm)->field.sle_next)
-
-#define	SLIST_FOREACH(var, head, field)					\
-	for((var) = SLIST_FIRST(head);					\
-	    (var) != SLIST_END(head);					\
-	    (var) = SLIST_NEXT(var, field))
-
-/*
- * Singly-linked List functions.
- */
-#define	SLIST_INIT(head) {						\
-	SLIST_FIRST(head) = SLIST_END(head);				\
-}
-
-#define	SLIST_INSERT_AFTER(slistelm, elm, field) do {			\
-	(elm)->field.sle_next = (slistelm)->field.sle_next;		\
-	(slistelm)->field.sle_next = (elm);				\
-} while (0)
-
-#define	SLIST_INSERT_HEAD(head, elm, field) do {			\
-	(elm)->field.sle_next = (head)->slh_first;			\
-	(head)->slh_first = (elm);					\
-} while (0)
-
-#define	SLIST_REMOVE_HEAD(head, field) do {				\
-	(head)->slh_first = (head)->slh_first->field.sle_next;		\
-} while (0)
-
-#define SLIST_REMOVE(head, elm, type, field) do {			\
-	if ((head)->slh_first == (elm)) {				\
-		SLIST_REMOVE_HEAD((head), field);			\
-	}								\
-	else {								\
-		struct type *curelm = (head)->slh_first;		\
-		while( curelm->field.sle_next != (elm) )		\
-			curelm = curelm->field.sle_next;		\
-		curelm->field.sle_next =				\
-		    curelm->field.sle_next->field.sle_next;		\
-	}								\
-} while (0)
-
-/*
- * List definitions.
- */
-#define LIST_HEAD(name, type)						\
-struct name {								\
-	struct type *lh_first;	/* first element */			\
-}
-
-#define LIST_HEAD_INITIALIZER(head)					\
-	{ NULL }
-
-#define LIST_ENTRY(type)						\
-struct {								\
-	struct type *le_next;	/* next element */			\
-	struct type **le_prev;	/* address of previous next element */	\
-}
-
-/*
- * List access methods
- */
-#define	LIST_FIRST(head)		((head)->lh_first)
-#define	LIST_END(head)			NULL
-#define	LIST_EMPTY(head)		(LIST_FIRST(head) == LIST_END(head))
-#define	LIST_NEXT(elm, field)		((elm)->field.le_next)
-
-#define LIST_FOREACH(var, head, field)					\
-	for((var) = LIST_FIRST(head);					\
-	    (var)!= LIST_END(head);					\
-	    (var) = LIST_NEXT(var, field))
-
-/*
- * List functions.
- */
-#define	LIST_INIT(head) do {						\
-	LIST_FIRST(head) = LIST_END(head);				\
-} while (0)
-
-#define LIST_INSERT_AFTER(listelm, elm, field) do {			\
-	if (((elm)->field.le_next = (listelm)->field.le_next) != NULL)	\
-		(listelm)->field.le_next->field.le_prev =		\
-		    &(elm)->field.le_next;				\
-	(listelm)->field.le_next = (elm);				\
-	(elm)->field.le_prev = &(listelm)->field.le_next;		\
-} while (0)
-
-#define	LIST_INSERT_BEFORE(listelm, elm, field) do {			\
-	(elm)->field.le_prev = (listelm)->field.le_prev;		\
-	(elm)->field.le_next = (listelm);				\
-	*(listelm)->field.le_prev = (elm);				\
-	(listelm)->field.le_prev = &(elm)->field.le_next;		\
-} while (0)
-
-#define LIST_INSERT_HEAD(head, elm, field) do {				\
-	if (((elm)->field.le_next = (head)->lh_first) != NULL)		\
-		(head)->lh_first->field.le_prev = &(elm)->field.le_next;\
-	(head)->lh_first = (elm);					\
-	(elm)->field.le_prev = &(head)->lh_first;			\
-} while (0)
-
-#define LIST_REMOVE(elm, field) do {					\
-	if ((elm)->field.le_next != NULL)				\
-		(elm)->field.le_next->field.le_prev =			\
-		    (elm)->field.le_prev;				\
-	*(elm)->field.le_prev = (elm)->field.le_next;			\
-} while (0)
-
-#define LIST_REPLACE(elm, elm2, field) do {				\
-	if (((elm2)->field.le_next = (elm)->field.le_next) != NULL)	\
-		(elm2)->field.le_next->field.le_prev =			\
-		    &(elm2)->field.le_next;				\
-	(elm2)->field.le_prev = (elm)->field.le_prev;			\
-	*(elm2)->field.le_prev = (elm2);				\
-} while (0)
-
-/*
- * Simple queue definitions.
- */
-#define SIMPLEQ_HEAD(name, type)					\
-struct name {								\
-	struct type *sqh_first;	/* first element */			\
-	struct type **sqh_last;	/* addr of last next element */		\
-}
-
-#define SIMPLEQ_HEAD_INITIALIZER(head)					\
-	{ NULL, &(head).sqh_first }
-
-#define SIMPLEQ_ENTRY(type)						\
-struct {								\
-	struct type *sqe_next;	/* next element */			\
-}
-
-/*
- * Simple queue access methods.
- */
-#define	SIMPLEQ_FIRST(head)	    ((head)->sqh_first)
-#define	SIMPLEQ_END(head)	    NULL
-#define	SIMPLEQ_EMPTY(head)	    (SIMPLEQ_FIRST(head) == SIMPLEQ_END(head))
-#define	SIMPLEQ_NEXT(elm, field)    ((elm)->field.sqe_next)
-
-#define SIMPLEQ_FOREACH(var, head, field)				\
-	for((var) = SIMPLEQ_FIRST(head);				\
-	    (var) != SIMPLEQ_END(head);					\
-	    (var) = SIMPLEQ_NEXT(var, field))
-
-/*
- * Simple queue functions.
- */
-#define	SIMPLEQ_INIT(head) do {						\
-	(head)->sqh_first = NULL;					\
-	(head)->sqh_last = &(head)->sqh_first;				\
-} while (0)
-
-#define SIMPLEQ_INSERT_HEAD(head, elm, field) do {			\
-	if (((elm)->field.sqe_next = (head)->sqh_first) == NULL)	\
-		(head)->sqh_last = &(elm)->field.sqe_next;		\
-	(head)->sqh_first = (elm);					\
-} while (0)
-
-#define SIMPLEQ_INSERT_TAIL(head, elm, field) do {			\
-	(elm)->field.sqe_next = NULL;					\
-	*(head)->sqh_last = (elm);					\
-	(head)->sqh_last = &(elm)->field.sqe_next;			\
-} while (0)
-
-#define SIMPLEQ_INSERT_AFTER(head, listelm, elm, field) do {		\
-	if (((elm)->field.sqe_next = (listelm)->field.sqe_next) == NULL)\
-		(head)->sqh_last = &(elm)->field.sqe_next;		\
-	(listelm)->field.sqe_next = (elm);				\
-} while (0)
-
-#define SIMPLEQ_REMOVE_HEAD(head, elm, field) do {			\
-	if (((head)->sqh_first = (elm)->field.sqe_next) == NULL)	\
-		(head)->sqh_last = &(head)->sqh_first;			\
-} while (0)
-
-/*
- * Tail queue definitions.
- */
-#define TAILQ_HEAD(name, type)						\
-struct name {								\
-	struct type *tqh_first;	/* first element */			\
-	struct type **tqh_last;	/* addr of last next element */		\
-}
-
-#define TAILQ_HEAD_INITIALIZER(head)					\
-	{ NULL, &(head).tqh_first }
-
-#define TAILQ_ENTRY(type)						\
-struct {								\
-	struct type *tqe_next;	/* next element */			\
-	struct type **tqe_prev;	/* address of previous next element */	\
-}
-
-/* 
- * tail queue access methods 
- */
-#define	TAILQ_FIRST(head)		((head)->tqh_first)
-#define	TAILQ_END(head)			NULL
-#define	TAILQ_NEXT(elm, field)		((elm)->field.tqe_next)
-#define TAILQ_LAST(head, headname)					\
-	(*(((struct headname *)((head)->tqh_last))->tqh_last))
-/* XXX */
-#define TAILQ_PREV(elm, headname, field)				\
-	(*(((struct headname *)((elm)->field.tqe_prev))->tqh_last))
-#define	TAILQ_EMPTY(head)						\
-	(TAILQ_FIRST(head) == TAILQ_END(head))
-
-#define TAILQ_FOREACH(var, head, field)					\
-	for((var) = TAILQ_FIRST(head);					\
-	    (var) != TAILQ_END(head);					\
-	    (var) = TAILQ_NEXT(var, field))
-
-#define TAILQ_FOREACH_REVERSE(var, head, field, headname)		\
-	for((var) = TAILQ_LAST(head, headname);				\
-	    (var) != TAILQ_END(head);					\
-	    (var) = TAILQ_PREV(var, headname, field))
-
-/*
- * Tail queue functions.
- */
-#define	TAILQ_INIT(head) do {						\
-	(head)->tqh_first = NULL;					\
-	(head)->tqh_last = &(head)->tqh_first;				\
-} while (0)
-
-#define TAILQ_INSERT_HEAD(head, elm, field) do {			\
-	if (((elm)->field.tqe_next = (head)->tqh_first) != NULL)	\
-		(head)->tqh_first->field.tqe_prev =			\
-		    &(elm)->field.tqe_next;				\
-	else								\
-		(head)->tqh_last = &(elm)->field.tqe_next;		\
-	(head)->tqh_first = (elm);					\
-	(elm)->field.tqe_prev = &(head)->tqh_first;			\
-} while (0)
-
-#define TAILQ_INSERT_TAIL(head, elm, field) do {			\
-	(elm)->field.tqe_next = NULL;					\
-	(elm)->field.tqe_prev = (head)->tqh_last;			\
-	*(head)->tqh_last = (elm);					\
-	(head)->tqh_last = &(elm)->field.tqe_next;			\
-} while (0)
-
-#define TAILQ_INSERT_AFTER(head, listelm, elm, field) do {		\
-	if (((elm)->field.tqe_next = (listelm)->field.tqe_next) != NULL)\
-		(elm)->field.tqe_next->field.tqe_prev =			\
-		    &(elm)->field.tqe_next;				\
-	else								\
-		(head)->tqh_last = &(elm)->field.tqe_next;		\
-	(listelm)->field.tqe_next = (elm);				\
-	(elm)->field.tqe_prev = &(listelm)->field.tqe_next;		\
-} while (0)
-
-#define	TAILQ_INSERT_BEFORE(listelm, elm, field) do {			\
-	(elm)->field.tqe_prev = (listelm)->field.tqe_prev;		\
-	(elm)->field.tqe_next = (listelm);				\
-	*(listelm)->field.tqe_prev = (elm);				\
-	(listelm)->field.tqe_prev = &(elm)->field.tqe_next;		\
-} while (0)
-
-#define TAILQ_REMOVE(head, elm, field) do {				\
-	if (((elm)->field.tqe_next) != NULL)				\
-		(elm)->field.tqe_next->field.tqe_prev =			\
-		    (elm)->field.tqe_prev;				\
-	else								\
-		(head)->tqh_last = (elm)->field.tqe_prev;		\
-	*(elm)->field.tqe_prev = (elm)->field.tqe_next;			\
-} while (0)
-
-#define TAILQ_REPLACE(head, elm, elm2, field) do {			\
-	if (((elm2)->field.tqe_next = (elm)->field.tqe_next) != NULL)	\
-		(elm2)->field.tqe_next->field.tqe_prev =		\
-		    &(elm2)->field.tqe_next;				\
-	else								\
-		(head)->tqh_last = &(elm2)->field.tqe_next;		\
-	(elm2)->field.tqe_prev = (elm)->field.tqe_prev;			\
-	*(elm2)->field.tqe_prev = (elm2);				\
-} while (0)
-
-/*
- * Circular queue definitions.
- */
-#define CIRCLEQ_HEAD(name, type)					\
-struct name {								\
-	struct type *cqh_first;		/* first element */		\
-	struct type *cqh_last;		/* last element */		\
-}
-
-#define CIRCLEQ_HEAD_INITIALIZER(head)					\
-	{ CIRCLEQ_END(&head), CIRCLEQ_END(&head) }
-
-#define CIRCLEQ_ENTRY(type)						\
-struct {								\
-	struct type *cqe_next;		/* next element */		\
-	struct type *cqe_prev;		/* previous element */		\
-}
-
-/*
- * Circular queue access methods 
- */
-#define	CIRCLEQ_FIRST(head)		((head)->cqh_first)
-#define	CIRCLEQ_LAST(head)		((head)->cqh_last)
-#define	CIRCLEQ_END(head)		((void *)(head))
-#define	CIRCLEQ_NEXT(elm, field)	((elm)->field.cqe_next)
-#define	CIRCLEQ_PREV(elm, field)	((elm)->field.cqe_prev)
-#define	CIRCLEQ_EMPTY(head)						\
-	(CIRCLEQ_FIRST(head) == CIRCLEQ_END(head))
-
-#define CIRCLEQ_FOREACH(var, head, field)				\
-	for((var) = CIRCLEQ_FIRST(head);				\
-	    (var) != CIRCLEQ_END(head);					\
-	    (var) = CIRCLEQ_NEXT(var, field))
-
-#define CIRCLEQ_FOREACH_REVERSE(var, head, field)			\
-	for((var) = CIRCLEQ_LAST(head);					\
-	    (var) != CIRCLEQ_END(head);					\
-	    (var) = CIRCLEQ_PREV(var, field))
-
-/*
- * Circular queue functions.
- */
-#define	CIRCLEQ_INIT(head) do {						\
-	(head)->cqh_first = CIRCLEQ_END(head);				\
-	(head)->cqh_last = CIRCLEQ_END(head);				\
-} while (0)
-
-#define CIRCLEQ_INSERT_AFTER(head, listelm, elm, field) do {		\
-	(elm)->field.cqe_next = (listelm)->field.cqe_next;		\
-	(elm)->field.cqe_prev = (listelm);				\
-	if ((listelm)->field.cqe_next == CIRCLEQ_END(head))		\
-		(head)->cqh_last = (elm);				\
-	else								\
-		(listelm)->field.cqe_next->field.cqe_prev = (elm);	\
-	(listelm)->field.cqe_next = (elm);				\
-} while (0)
-
-#define CIRCLEQ_INSERT_BEFORE(head, listelm, elm, field) do {		\
-	(elm)->field.cqe_next = (listelm);				\
-	(elm)->field.cqe_prev = (listelm)->field.cqe_prev;		\
-	if ((listelm)->field.cqe_prev == CIRCLEQ_END(head))		\
-		(head)->cqh_first = (elm);				\
-	else								\
-		(listelm)->field.cqe_prev->field.cqe_next = (elm);	\
-	(listelm)->field.cqe_prev = (elm);				\
-} while (0)
-
-#define CIRCLEQ_INSERT_HEAD(head, elm, field) do {			\
-	(elm)->field.cqe_next = (head)->cqh_first;			\
-	(elm)->field.cqe_prev = CIRCLEQ_END(head);			\
-	if ((head)->cqh_last == CIRCLEQ_END(head))			\
-		(head)->cqh_last = (elm);				\
-	else								\
-		(head)->cqh_first->field.cqe_prev = (elm);		\
-	(head)->cqh_first = (elm);					\
-} while (0)
-
-#define CIRCLEQ_INSERT_TAIL(head, elm, field) do {			\
-	(elm)->field.cqe_next = CIRCLEQ_END(head);			\
-	(elm)->field.cqe_prev = (head)->cqh_last;			\
-	if ((head)->cqh_first == CIRCLEQ_END(head))			\
-		(head)->cqh_first = (elm);				\
-	else								\
-		(head)->cqh_last->field.cqe_next = (elm);		\
-	(head)->cqh_last = (elm);					\
-} while (0)
-
-#define	CIRCLEQ_REMOVE(head, elm, field) do {				\
-	if ((elm)->field.cqe_next == CIRCLEQ_END(head))			\
-		(head)->cqh_last = (elm)->field.cqe_prev;		\
-	else								\
-		(elm)->field.cqe_next->field.cqe_prev =			\
-		    (elm)->field.cqe_prev;				\
-	if ((elm)->field.cqe_prev == CIRCLEQ_END(head))			\
-		(head)->cqh_first = (elm)->field.cqe_next;		\
-	else								\
-		(elm)->field.cqe_prev->field.cqe_next =			\
-		    (elm)->field.cqe_next;				\
-} while (0)
-
-#define CIRCLEQ_REPLACE(head, elm, elm2, field) do {			\
-	if (((elm2)->field.cqe_next = (elm)->field.cqe_next) ==		\
-	    CIRCLEQ_END(head))						\
-		(head).cqh_last = (elm2);				\
-	else								\
-		(elm2)->field.cqe_next->field.cqe_prev = (elm2);	\
-	if (((elm2)->field.cqe_prev = (elm)->field.cqe_prev) ==		\
-	    CIRCLEQ_END(head))						\
-		(head).cqh_first = (elm2);				\
-	else								\
-		(elm2)->field.cqe_prev->field.cqe_next = (elm2);	\
-} while (0)
-
-#endif	/* !_FAKE_QUEUE_H_ */
diff --git a/crypto/openssh/openbsd-compat/sys-tree.h b/crypto/openssh/openbsd-compat/sys-tree.h
deleted file mode 100644
index 927ca04cd76b..000000000000
--- a/crypto/openssh/openbsd-compat/sys-tree.h
+++ /dev/null
@@ -1,677 +0,0 @@
-/*	$OpenBSD: tree.h,v 1.7 2002/10/17 21:51:54 art Exp $	*/
-/*
- * Copyright 2002 Niels Provos <provos@citi.umich.edu>
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef	_SYS_TREE_H_
-#define	_SYS_TREE_H_
-
-/*
- * This file defines data structures for different types of trees:
- * splay trees and red-black trees.
- *
- * A splay tree is a self-organizing data structure.  Every operation
- * on the tree causes a splay to happen.  The splay moves the requested
- * node to the root of the tree and partly rebalances it.
- *
- * This has the benefit that request locality causes faster lookups as
- * the requested nodes move to the top of the tree.  On the other hand,
- * every lookup causes memory writes.
- *
- * The Balance Theorem bounds the total access time for m operations
- * and n inserts on an initially empty tree as O((m + n)lg n).  The
- * amortized cost for a sequence of m accesses to a splay tree is O(lg n);
- *
- * A red-black tree is a binary search tree with the node color as an
- * extra attribute.  It fulfills a set of conditions:
- *	- every search path from the root to a leaf consists of the
- *	  same number of black nodes,
- *	- each red node (except for the root) has a black parent,
- *	- each leaf node is black.
- *
- * Every operation on a red-black tree is bounded as O(lg n).
- * The maximum height of a red-black tree is 2lg (n+1).
- */
-
-#define SPLAY_HEAD(name, type)						\
-struct name {								\
-	struct type *sph_root; /* root of the tree */			\
-}
-
-#define SPLAY_INITIALIZER(root)						\
-	{ NULL }
-
-#define SPLAY_INIT(root) do {						\
-	(root)->sph_root = NULL;					\
-} while (0)
-
-#define SPLAY_ENTRY(type)						\
-struct {								\
-	struct type *spe_left; /* left element */			\
-	struct type *spe_right; /* right element */			\
-}
-
-#define SPLAY_LEFT(elm, field)		(elm)->field.spe_left
-#define SPLAY_RIGHT(elm, field)		(elm)->field.spe_right
-#define SPLAY_ROOT(head)		(head)->sph_root
-#define SPLAY_EMPTY(head)		(SPLAY_ROOT(head) == NULL)
-
-/* SPLAY_ROTATE_{LEFT,RIGHT} expect that tmp hold SPLAY_{RIGHT,LEFT} */
-#define SPLAY_ROTATE_RIGHT(head, tmp, field) do {			\
-	SPLAY_LEFT((head)->sph_root, field) = SPLAY_RIGHT(tmp, field);	\
-	SPLAY_RIGHT(tmp, field) = (head)->sph_root;			\
-	(head)->sph_root = tmp;						\
-} while (0)
-	
-#define SPLAY_ROTATE_LEFT(head, tmp, field) do {			\
-	SPLAY_RIGHT((head)->sph_root, field) = SPLAY_LEFT(tmp, field);	\
-	SPLAY_LEFT(tmp, field) = (head)->sph_root;			\
-	(head)->sph_root = tmp;						\
-} while (0)
-
-#define SPLAY_LINKLEFT(head, tmp, field) do {				\
-	SPLAY_LEFT(tmp, field) = (head)->sph_root;			\
-	tmp = (head)->sph_root;						\
-	(head)->sph_root = SPLAY_LEFT((head)->sph_root, field);		\
-} while (0)
-
-#define SPLAY_LINKRIGHT(head, tmp, field) do {				\
-	SPLAY_RIGHT(tmp, field) = (head)->sph_root;			\
-	tmp = (head)->sph_root;						\
-	(head)->sph_root = SPLAY_RIGHT((head)->sph_root, field);	\
-} while (0)
-
-#define SPLAY_ASSEMBLE(head, node, left, right, field) do {		\
-	SPLAY_RIGHT(left, field) = SPLAY_LEFT((head)->sph_root, field);	\
-	SPLAY_LEFT(right, field) = SPLAY_RIGHT((head)->sph_root, field);\
-	SPLAY_LEFT((head)->sph_root, field) = SPLAY_RIGHT(node, field);	\
-	SPLAY_RIGHT((head)->sph_root, field) = SPLAY_LEFT(node, field);	\
-} while (0)
-
-/* Generates prototypes and inline functions */
-
-#define SPLAY_PROTOTYPE(name, type, field, cmp)				\
-void name##_SPLAY(struct name *, struct type *);			\
-void name##_SPLAY_MINMAX(struct name *, int);				\
-struct type *name##_SPLAY_INSERT(struct name *, struct type *);		\
-struct type *name##_SPLAY_REMOVE(struct name *, struct type *);		\
-									\
-/* Finds the node with the same key as elm */				\
-static __inline struct type *						\
-name##_SPLAY_FIND(struct name *head, struct type *elm)			\
-{									\
-	if (SPLAY_EMPTY(head))						\
-		return(NULL);						\
-	name##_SPLAY(head, elm);					\
-	if ((cmp)(elm, (head)->sph_root) == 0)				\
-		return (head->sph_root);				\
-	return (NULL);							\
-}									\
-									\
-static __inline struct type *						\
-name##_SPLAY_NEXT(struct name *head, struct type *elm)			\
-{									\
-	name##_SPLAY(head, elm);					\
-	if (SPLAY_RIGHT(elm, field) != NULL) {				\
-		elm = SPLAY_RIGHT(elm, field);				\
-		while (SPLAY_LEFT(elm, field) != NULL) {		\
-			elm = SPLAY_LEFT(elm, field);			\
-		}							\
-	} else								\
-		elm = NULL;						\
-	return (elm);							\
-}									\
-									\
-static __inline struct type *						\
-name##_SPLAY_MIN_MAX(struct name *head, int val)			\
-{									\
-	name##_SPLAY_MINMAX(head, val);					\
-        return (SPLAY_ROOT(head));					\
-}
-
-/* Main splay operation.
- * Moves node close to the key of elm to top
- */
-#define SPLAY_GENERATE(name, type, field, cmp)				\
-struct type *								\
-name##_SPLAY_INSERT(struct name *head, struct type *elm)		\
-{									\
-    if (SPLAY_EMPTY(head)) {						\
-	    SPLAY_LEFT(elm, field) = SPLAY_RIGHT(elm, field) = NULL;	\
-    } else {								\
-	    int __comp;							\
-	    name##_SPLAY(head, elm);					\
-	    __comp = (cmp)(elm, (head)->sph_root);			\
-	    if(__comp < 0) {						\
-		    SPLAY_LEFT(elm, field) = SPLAY_LEFT((head)->sph_root, field);\
-		    SPLAY_RIGHT(elm, field) = (head)->sph_root;		\
-		    SPLAY_LEFT((head)->sph_root, field) = NULL;		\
-	    } else if (__comp > 0) {					\
-		    SPLAY_RIGHT(elm, field) = SPLAY_RIGHT((head)->sph_root, field);\
-		    SPLAY_LEFT(elm, field) = (head)->sph_root;		\
-		    SPLAY_RIGHT((head)->sph_root, field) = NULL;	\
-	    } else							\
-		    return ((head)->sph_root);				\
-    }									\
-    (head)->sph_root = (elm);						\
-    return (NULL);							\
-}									\
-									\
-struct type *								\
-name##_SPLAY_REMOVE(struct name *head, struct type *elm)		\
-{									\
-	struct type *__tmp;						\
-	if (SPLAY_EMPTY(head))						\
-		return (NULL);						\
-	name##_SPLAY(head, elm);					\
-	if ((cmp)(elm, (head)->sph_root) == 0) {			\
-		if (SPLAY_LEFT((head)->sph_root, field) == NULL) {	\
-			(head)->sph_root = SPLAY_RIGHT((head)->sph_root, field);\
-		} else {						\
-			__tmp = SPLAY_RIGHT((head)->sph_root, field);	\
-			(head)->sph_root = SPLAY_LEFT((head)->sph_root, field);\
-			name##_SPLAY(head, elm);			\
-			SPLAY_RIGHT((head)->sph_root, field) = __tmp;	\
-		}							\
-		return (elm);						\
-	}								\
-	return (NULL);							\
-}									\
-									\
-void									\
-name##_SPLAY(struct name *head, struct type *elm)			\
-{									\
-	struct type __node, *__left, *__right, *__tmp;			\
-	int __comp;							\
-\
-	SPLAY_LEFT(&__node, field) = SPLAY_RIGHT(&__node, field) = NULL;\
-	__left = __right = &__node;					\
-\
-	while ((__comp = (cmp)(elm, (head)->sph_root))) {		\
-		if (__comp < 0) {					\
-			__tmp = SPLAY_LEFT((head)->sph_root, field);	\
-			if (__tmp == NULL)				\
-				break;					\
-			if ((cmp)(elm, __tmp) < 0){			\
-				SPLAY_ROTATE_RIGHT(head, __tmp, field);	\
-				if (SPLAY_LEFT((head)->sph_root, field) == NULL)\
-					break;				\
-			}						\
-			SPLAY_LINKLEFT(head, __right, field);		\
-		} else if (__comp > 0) {				\
-			__tmp = SPLAY_RIGHT((head)->sph_root, field);	\
-			if (__tmp == NULL)				\
-				break;					\
-			if ((cmp)(elm, __tmp) > 0){			\
-				SPLAY_ROTATE_LEFT(head, __tmp, field);	\
-				if (SPLAY_RIGHT((head)->sph_root, field) == NULL)\
-					break;				\
-			}						\
-			SPLAY_LINKRIGHT(head, __left, field);		\
-		}							\
-	}								\
-	SPLAY_ASSEMBLE(head, &__node, __left, __right, field);		\
-}									\
-									\
-/* Splay with either the minimum or the maximum element			\
- * Used to find minimum or maximum element in tree.			\
- */									\
-void name##_SPLAY_MINMAX(struct name *head, int __comp) \
-{									\
-	struct type __node, *__left, *__right, *__tmp;			\
-\
-	SPLAY_LEFT(&__node, field) = SPLAY_RIGHT(&__node, field) = NULL;\
-	__left = __right = &__node;					\
-\
-	while (1) {							\
-		if (__comp < 0) {					\
-			__tmp = SPLAY_LEFT((head)->sph_root, field);	\
-			if (__tmp == NULL)				\
-				break;					\
-			if (__comp < 0){				\
-				SPLAY_ROTATE_RIGHT(head, __tmp, field);	\
-				if (SPLAY_LEFT((head)->sph_root, field) == NULL)\
-					break;				\
-			}						\
-			SPLAY_LINKLEFT(head, __right, field);		\
-		} else if (__comp > 0) {				\
-			__tmp = SPLAY_RIGHT((head)->sph_root, field);	\
-			if (__tmp == NULL)				\
-				break;					\
-			if (__comp > 0) {				\
-				SPLAY_ROTATE_LEFT(head, __tmp, field);	\
-				if (SPLAY_RIGHT((head)->sph_root, field) == NULL)\
-					break;				\
-			}						\
-			SPLAY_LINKRIGHT(head, __left, field);		\
-		}							\
-	}								\
-	SPLAY_ASSEMBLE(head, &__node, __left, __right, field);		\
-}
-
-#define SPLAY_NEGINF	-1
-#define SPLAY_INF	1
-
-#define SPLAY_INSERT(name, x, y)	name##_SPLAY_INSERT(x, y)
-#define SPLAY_REMOVE(name, x, y)	name##_SPLAY_REMOVE(x, y)
-#define SPLAY_FIND(name, x, y)		name##_SPLAY_FIND(x, y)
-#define SPLAY_NEXT(name, x, y)		name##_SPLAY_NEXT(x, y)
-#define SPLAY_MIN(name, x)		(SPLAY_EMPTY(x) ? NULL	\
-					: name##_SPLAY_MIN_MAX(x, SPLAY_NEGINF))
-#define SPLAY_MAX(name, x)		(SPLAY_EMPTY(x) ? NULL	\
-					: name##_SPLAY_MIN_MAX(x, SPLAY_INF))
-
-#define SPLAY_FOREACH(x, name, head)					\
-	for ((x) = SPLAY_MIN(name, head);				\
-	     (x) != NULL;						\
-	     (x) = SPLAY_NEXT(name, head, x))
-
-/* Macros that define a red-back tree */
-#define RB_HEAD(name, type)						\
-struct name {								\
-	struct type *rbh_root; /* root of the tree */			\
-}
-
-#define RB_INITIALIZER(root)						\
-	{ NULL }
-
-#define RB_INIT(root) do {						\
-	(root)->rbh_root = NULL;					\
-} while (0)
-
-#define RB_BLACK	0
-#define RB_RED		1
-#define RB_ENTRY(type)							\
-struct {								\
-	struct type *rbe_left;		/* left element */		\
-	struct type *rbe_right;		/* right element */		\
-	struct type *rbe_parent;	/* parent element */		\
-	int rbe_color;			/* node color */		\
-}
-
-#define RB_LEFT(elm, field)		(elm)->field.rbe_left
-#define RB_RIGHT(elm, field)		(elm)->field.rbe_right
-#define RB_PARENT(elm, field)		(elm)->field.rbe_parent
-#define RB_COLOR(elm, field)		(elm)->field.rbe_color
-#define RB_ROOT(head)			(head)->rbh_root
-#define RB_EMPTY(head)			(RB_ROOT(head) == NULL)
-
-#define RB_SET(elm, parent, field) do {					\
-	RB_PARENT(elm, field) = parent;					\
-	RB_LEFT(elm, field) = RB_RIGHT(elm, field) = NULL;		\
-	RB_COLOR(elm, field) = RB_RED;					\
-} while (0)
-
-#define RB_SET_BLACKRED(black, red, field) do {				\
-	RB_COLOR(black, field) = RB_BLACK;				\
-	RB_COLOR(red, field) = RB_RED;					\
-} while (0)
-
-#ifndef RB_AUGMENT
-#define RB_AUGMENT(x)
-#endif
-
-#define RB_ROTATE_LEFT(head, elm, tmp, field) do {			\
-	(tmp) = RB_RIGHT(elm, field);					\
-	if ((RB_RIGHT(elm, field) = RB_LEFT(tmp, field))) {		\
-		RB_PARENT(RB_LEFT(tmp, field), field) = (elm);		\
-	}								\
-	RB_AUGMENT(elm);						\
-	if ((RB_PARENT(tmp, field) = RB_PARENT(elm, field))) {		\
-		if ((elm) == RB_LEFT(RB_PARENT(elm, field), field))	\
-			RB_LEFT(RB_PARENT(elm, field), field) = (tmp);	\
-		else							\
-			RB_RIGHT(RB_PARENT(elm, field), field) = (tmp);	\
-	} else								\
-		(head)->rbh_root = (tmp);				\
-	RB_LEFT(tmp, field) = (elm);					\
-	RB_PARENT(elm, field) = (tmp);					\
-	RB_AUGMENT(tmp);						\
-	if ((RB_PARENT(tmp, field)))					\
-		RB_AUGMENT(RB_PARENT(tmp, field));			\
-} while (0)
-
-#define RB_ROTATE_RIGHT(head, elm, tmp, field) do {			\
-	(tmp) = RB_LEFT(elm, field);					\
-	if ((RB_LEFT(elm, field) = RB_RIGHT(tmp, field))) {		\
-		RB_PARENT(RB_RIGHT(tmp, field), field) = (elm);		\
-	}								\
-	RB_AUGMENT(elm);						\
-	if ((RB_PARENT(tmp, field) = RB_PARENT(elm, field))) {		\
-		if ((elm) == RB_LEFT(RB_PARENT(elm, field), field))	\
-			RB_LEFT(RB_PARENT(elm, field), field) = (tmp);	\
-		else							\
-			RB_RIGHT(RB_PARENT(elm, field), field) = (tmp);	\
-	} else								\
-		(head)->rbh_root = (tmp);				\
-	RB_RIGHT(tmp, field) = (elm);					\
-	RB_PARENT(elm, field) = (tmp);					\
-	RB_AUGMENT(tmp);						\
-	if ((RB_PARENT(tmp, field)))					\
-		RB_AUGMENT(RB_PARENT(tmp, field));			\
-} while (0)
-
-/* Generates prototypes and inline functions */
-#define RB_PROTOTYPE(name, type, field, cmp)				\
-void name##_RB_INSERT_COLOR(struct name *, struct type *);	\
-void name##_RB_REMOVE_COLOR(struct name *, struct type *, struct type *);\
-struct type *name##_RB_REMOVE(struct name *, struct type *);		\
-struct type *name##_RB_INSERT(struct name *, struct type *);		\
-struct type *name##_RB_FIND(struct name *, struct type *);		\
-struct type *name##_RB_NEXT(struct name *, struct type *);		\
-struct type *name##_RB_MINMAX(struct name *, int);			\
-									\
-
-/* Main rb operation.
- * Moves node close to the key of elm to top
- */
-#define RB_GENERATE(name, type, field, cmp)				\
-void									\
-name##_RB_INSERT_COLOR(struct name *head, struct type *elm)		\
-{									\
-	struct type *parent, *gparent, *tmp;				\
-	while ((parent = RB_PARENT(elm, field)) &&			\
-	    RB_COLOR(parent, field) == RB_RED) {			\
-		gparent = RB_PARENT(parent, field);			\
-		if (parent == RB_LEFT(gparent, field)) {		\
-			tmp = RB_RIGHT(gparent, field);			\
-			if (tmp && RB_COLOR(tmp, field) == RB_RED) {	\
-				RB_COLOR(tmp, field) = RB_BLACK;	\
-				RB_SET_BLACKRED(parent, gparent, field);\
-				elm = gparent;				\
-				continue;				\
-			}						\
-			if (RB_RIGHT(parent, field) == elm) {		\
-				RB_ROTATE_LEFT(head, parent, tmp, field);\
-				tmp = parent;				\
-				parent = elm;				\
-				elm = tmp;				\
-			}						\
-			RB_SET_BLACKRED(parent, gparent, field);	\
-			RB_ROTATE_RIGHT(head, gparent, tmp, field);	\
-		} else {						\
-			tmp = RB_LEFT(gparent, field);			\
-			if (tmp && RB_COLOR(tmp, field) == RB_RED) {	\
-				RB_COLOR(tmp, field) = RB_BLACK;	\
-				RB_SET_BLACKRED(parent, gparent, field);\
-				elm = gparent;				\
-				continue;				\
-			}						\
-			if (RB_LEFT(parent, field) == elm) {		\
-				RB_ROTATE_RIGHT(head, parent, tmp, field);\
-				tmp = parent;				\
-				parent = elm;				\
-				elm = tmp;				\
-			}						\
-			RB_SET_BLACKRED(parent, gparent, field);	\
-			RB_ROTATE_LEFT(head, gparent, tmp, field);	\
-		}							\
-	}								\
-	RB_COLOR(head->rbh_root, field) = RB_BLACK;			\
-}									\
-									\
-void									\
-name##_RB_REMOVE_COLOR(struct name *head, struct type *parent, struct type *elm) \
-{									\
-	struct type *tmp;						\
-	while ((elm == NULL || RB_COLOR(elm, field) == RB_BLACK) &&	\
-	    elm != RB_ROOT(head)) {					\
-		if (RB_LEFT(parent, field) == elm) {			\
-			tmp = RB_RIGHT(parent, field);			\
-			if (RB_COLOR(tmp, field) == RB_RED) {		\
-				RB_SET_BLACKRED(tmp, parent, field);	\
-				RB_ROTATE_LEFT(head, parent, tmp, field);\
-				tmp = RB_RIGHT(parent, field);		\
-			}						\
-			if ((RB_LEFT(tmp, field) == NULL ||		\
-			    RB_COLOR(RB_LEFT(tmp, field), field) == RB_BLACK) &&\
-			    (RB_RIGHT(tmp, field) == NULL ||		\
-			    RB_COLOR(RB_RIGHT(tmp, field), field) == RB_BLACK)) {\
-				RB_COLOR(tmp, field) = RB_RED;		\
-				elm = parent;				\
-				parent = RB_PARENT(elm, field);		\
-			} else {					\
-				if (RB_RIGHT(tmp, field) == NULL ||	\
-				    RB_COLOR(RB_RIGHT(tmp, field), field) == RB_BLACK) {\
-					struct type *oleft;		\
-					if ((oleft = RB_LEFT(tmp, field)))\
-						RB_COLOR(oleft, field) = RB_BLACK;\
-					RB_COLOR(tmp, field) = RB_RED;	\
-					RB_ROTATE_RIGHT(head, tmp, oleft, field);\
-					tmp = RB_RIGHT(parent, field);	\
-				}					\
-				RB_COLOR(tmp, field) = RB_COLOR(parent, field);\
-				RB_COLOR(parent, field) = RB_BLACK;	\
-				if (RB_RIGHT(tmp, field))		\
-					RB_COLOR(RB_RIGHT(tmp, field), field) = RB_BLACK;\
-				RB_ROTATE_LEFT(head, parent, tmp, field);\
-				elm = RB_ROOT(head);			\
-				break;					\
-			}						\
-		} else {						\
-			tmp = RB_LEFT(parent, field);			\
-			if (RB_COLOR(tmp, field) == RB_RED) {		\
-				RB_SET_BLACKRED(tmp, parent, field);	\
-				RB_ROTATE_RIGHT(head, parent, tmp, field);\
-				tmp = RB_LEFT(parent, field);		\
-			}						\
-			if ((RB_LEFT(tmp, field) == NULL ||		\
-			    RB_COLOR(RB_LEFT(tmp, field), field) == RB_BLACK) &&\
-			    (RB_RIGHT(tmp, field) == NULL ||		\
-			    RB_COLOR(RB_RIGHT(tmp, field), field) == RB_BLACK)) {\
-				RB_COLOR(tmp, field) = RB_RED;		\
-				elm = parent;				\
-				parent = RB_PARENT(elm, field);		\
-			} else {					\
-				if (RB_LEFT(tmp, field) == NULL ||	\
-				    RB_COLOR(RB_LEFT(tmp, field), field) == RB_BLACK) {\
-					struct type *oright;		\
-					if ((oright = RB_RIGHT(tmp, field)))\
-						RB_COLOR(oright, field) = RB_BLACK;\
-					RB_COLOR(tmp, field) = RB_RED;	\
-					RB_ROTATE_LEFT(head, tmp, oright, field);\
-					tmp = RB_LEFT(parent, field);	\
-				}					\
-				RB_COLOR(tmp, field) = RB_COLOR(parent, field);\
-				RB_COLOR(parent, field) = RB_BLACK;	\
-				if (RB_LEFT(tmp, field))		\
-					RB_COLOR(RB_LEFT(tmp, field), field) = RB_BLACK;\
-				RB_ROTATE_RIGHT(head, parent, tmp, field);\
-				elm = RB_ROOT(head);			\
-				break;					\
-			}						\
-		}							\
-	}								\
-	if (elm)							\
-		RB_COLOR(elm, field) = RB_BLACK;			\
-}									\
-									\
-struct type *								\
-name##_RB_REMOVE(struct name *head, struct type *elm)			\
-{									\
-	struct type *child, *parent, *old = elm;			\
-	int color;							\
-	if (RB_LEFT(elm, field) == NULL)				\
-		child = RB_RIGHT(elm, field);				\
-	else if (RB_RIGHT(elm, field) == NULL)				\
-		child = RB_LEFT(elm, field);				\
-	else {								\
-		struct type *left;					\
-		elm = RB_RIGHT(elm, field);				\
-		while ((left = RB_LEFT(elm, field)))			\
-			elm = left;					\
-		child = RB_RIGHT(elm, field);				\
-		parent = RB_PARENT(elm, field);				\
-		color = RB_COLOR(elm, field);				\
-		if (child)						\
-			RB_PARENT(child, field) = parent;		\
-		if (parent) {						\
-			if (RB_LEFT(parent, field) == elm)		\
-				RB_LEFT(parent, field) = child;		\
-			else						\
-				RB_RIGHT(parent, field) = child;	\
-			RB_AUGMENT(parent);				\
-		} else							\
-			RB_ROOT(head) = child;				\
-		if (RB_PARENT(elm, field) == old)			\
-			parent = elm;					\
-		(elm)->field = (old)->field;				\
-		if (RB_PARENT(old, field)) {				\
-			if (RB_LEFT(RB_PARENT(old, field), field) == old)\
-				RB_LEFT(RB_PARENT(old, field), field) = elm;\
-			else						\
-				RB_RIGHT(RB_PARENT(old, field), field) = elm;\
-			RB_AUGMENT(RB_PARENT(old, field));		\
-		} else							\
-			RB_ROOT(head) = elm;				\
-		RB_PARENT(RB_LEFT(old, field), field) = elm;		\
-		if (RB_RIGHT(old, field))				\
-			RB_PARENT(RB_RIGHT(old, field), field) = elm;	\
-		if (parent) {						\
-			left = parent;					\
-			do {						\
-				RB_AUGMENT(left);			\
-			} while ((left = RB_PARENT(left, field)));	\
-		}							\
-		goto color;						\
-	}								\
-	parent = RB_PARENT(elm, field);					\
-	color = RB_COLOR(elm, field);					\
-	if (child)							\
-		RB_PARENT(child, field) = parent;			\
-	if (parent) {							\
-		if (RB_LEFT(parent, field) == elm)			\
-			RB_LEFT(parent, field) = child;			\
-		else							\
-			RB_RIGHT(parent, field) = child;		\
-		RB_AUGMENT(parent);					\
-	} else								\
-		RB_ROOT(head) = child;					\
-color:									\
-	if (color == RB_BLACK)						\
-		name##_RB_REMOVE_COLOR(head, parent, child);		\
-	return (old);							\
-}									\
-									\
-/* Inserts a node into the RB tree */					\
-struct type *								\
-name##_RB_INSERT(struct name *head, struct type *elm)			\
-{									\
-	struct type *tmp;						\
-	struct type *parent = NULL;					\
-	int comp = 0;							\
-	tmp = RB_ROOT(head);						\
-	while (tmp) {							\
-		parent = tmp;						\
-		comp = (cmp)(elm, parent);				\
-		if (comp < 0)						\
-			tmp = RB_LEFT(tmp, field);			\
-		else if (comp > 0)					\
-			tmp = RB_RIGHT(tmp, field);			\
-		else							\
-			return (tmp);					\
-	}								\
-	RB_SET(elm, parent, field);					\
-	if (parent != NULL) {						\
-		if (comp < 0)						\
-			RB_LEFT(parent, field) = elm;			\
-		else							\
-			RB_RIGHT(parent, field) = elm;			\
-		RB_AUGMENT(parent);					\
-	} else								\
-		RB_ROOT(head) = elm;					\
-	name##_RB_INSERT_COLOR(head, elm);				\
-	return (NULL);							\
-}									\
-									\
-/* Finds the node with the same key as elm */				\
-struct type *								\
-name##_RB_FIND(struct name *head, struct type *elm)			\
-{									\
-	struct type *tmp = RB_ROOT(head);				\
-	int comp;							\
-	while (tmp) {							\
-		comp = cmp(elm, tmp);					\
-		if (comp < 0)						\
-			tmp = RB_LEFT(tmp, field);			\
-		else if (comp > 0)					\
-			tmp = RB_RIGHT(tmp, field);			\
-		else							\
-			return (tmp);					\
-	}								\
-	return (NULL);							\
-}									\
-									\
-struct type *								\
-name##_RB_NEXT(struct name *head, struct type *elm)			\
-{									\
-	if (RB_RIGHT(elm, field)) {					\
-		elm = RB_RIGHT(elm, field);				\
-		while (RB_LEFT(elm, field))				\
-			elm = RB_LEFT(elm, field);			\
-	} else {							\
-		if (RB_PARENT(elm, field) &&				\
-		    (elm == RB_LEFT(RB_PARENT(elm, field), field)))	\
-			elm = RB_PARENT(elm, field);			\
-		else {							\
-			while (RB_PARENT(elm, field) &&			\
-			    (elm == RB_RIGHT(RB_PARENT(elm, field), field)))\
-				elm = RB_PARENT(elm, field);		\
-			elm = RB_PARENT(elm, field);			\
-		}							\
-	}								\
-	return (elm);							\
-}									\
-									\
-struct type *								\
-name##_RB_MINMAX(struct name *head, int val)				\
-{									\
-	struct type *tmp = RB_ROOT(head);				\
-	struct type *parent = NULL;					\
-	while (tmp) {							\
-		parent = tmp;						\
-		if (val < 0)						\
-			tmp = RB_LEFT(tmp, field);			\
-		else							\
-			tmp = RB_RIGHT(tmp, field);			\
-	}								\
-	return (parent);						\
-}
-
-#define RB_NEGINF	-1
-#define RB_INF	1
-
-#define RB_INSERT(name, x, y)	name##_RB_INSERT(x, y)
-#define RB_REMOVE(name, x, y)	name##_RB_REMOVE(x, y)
-#define RB_FIND(name, x, y)	name##_RB_FIND(x, y)
-#define RB_NEXT(name, x, y)	name##_RB_NEXT(x, y)
-#define RB_MIN(name, x)		name##_RB_MINMAX(x, RB_NEGINF)
-#define RB_MAX(name, x)		name##_RB_MINMAX(x, RB_INF)
-
-#define RB_FOREACH(x, name, head)					\
-	for ((x) = RB_MIN(name, head);					\
-	     (x) != NULL;						\
-	     (x) = name##_RB_NEXT(head, x))
-
-#endif	/* _SYS_TREE_H_ */
diff --git a/crypto/openssh/openbsd-compat/tree.h b/crypto/openssh/openbsd-compat/tree.h
deleted file mode 100644
index 30b4a8561ce3..000000000000
--- a/crypto/openssh/openbsd-compat/tree.h
+++ /dev/null
@@ -1,667 +0,0 @@
-/*
- * Copyright 2002 Niels Provos <provos@citi.umich.edu>
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef	_SYS_TREE_H_
-#define	_SYS_TREE_H_
-
-/*
- * This file defines data structures for different types of trees:
- * splay trees and red-black trees.
- *
- * A splay tree is a self-organizing data structure.  Every operation
- * on the tree causes a splay to happen.  The splay moves the requested
- * node to the root of the tree and partly rebalances it.
- *
- * This has the benefit that request locality causes faster lookups as
- * the requested nodes move to the top of the tree.  On the other hand,
- * every lookup causes memory writes.
- *
- * The Balance Theorem bounds the total access time for m operations
- * and n inserts on an initially empty tree as O((m + n)lg n).  The
- * amortized cost for a sequence of m accesses to a splay tree is O(lg n);
- *
- * A red-black tree is a binary search tree with the node color as an
- * extra attribute.  It fulfills a set of conditions:
- *	- every search path from the root to a leaf consists of the
- *	  same number of black nodes,
- *	- each red node (except for the root) has a black parent,
- *	- each leaf node is black.
- *
- * Every operation on a red-black tree is bounded as O(lg n).
- * The maximum height of a red-black tree is 2lg (n+1).
- */
-
-#define SPLAY_HEAD(name, type)						\
-struct name {								\
-	struct type *sph_root; /* root of the tree */			\
-}
-
-#define SPLAY_INITIALIZER(root)						\
-	{ NULL }
-
-#define SPLAY_INIT(root) do {						\
-	(root)->sph_root = NULL;					\
-} while (0)
-
-#define SPLAY_ENTRY(type)						\
-struct {								\
-	struct type *spe_left; /* left element */			\
-	struct type *spe_right; /* right element */			\
-}
-
-#define SPLAY_LEFT(elm, field)		(elm)->field.spe_left
-#define SPLAY_RIGHT(elm, field)		(elm)->field.spe_right
-#define SPLAY_ROOT(head)		(head)->sph_root
-#define SPLAY_EMPTY(head)		(SPLAY_ROOT(head) == NULL)
-
-/* SPLAY_ROTATE_{LEFT,RIGHT} expect that tmp hold SPLAY_{RIGHT,LEFT} */
-#define SPLAY_ROTATE_RIGHT(head, tmp, field) do {			\
-	SPLAY_LEFT((head)->sph_root, field) = SPLAY_RIGHT(tmp, field);	\
-	SPLAY_RIGHT(tmp, field) = (head)->sph_root;			\
-	(head)->sph_root = tmp;						\
-} while (0)
-	
-#define SPLAY_ROTATE_LEFT(head, tmp, field) do {			\
-	SPLAY_RIGHT((head)->sph_root, field) = SPLAY_LEFT(tmp, field);	\
-	SPLAY_LEFT(tmp, field) = (head)->sph_root;			\
-	(head)->sph_root = tmp;						\
-} while (0)
-
-#define SPLAY_LINKLEFT(head, tmp, field) do {				\
-	SPLAY_LEFT(tmp, field) = (head)->sph_root;			\
-	tmp = (head)->sph_root;						\
-	(head)->sph_root = SPLAY_LEFT((head)->sph_root, field);		\
-} while (0)
-
-#define SPLAY_LINKRIGHT(head, tmp, field) do {				\
-	SPLAY_RIGHT(tmp, field) = (head)->sph_root;			\
-	tmp = (head)->sph_root;						\
-	(head)->sph_root = SPLAY_RIGHT((head)->sph_root, field);	\
-} while (0)
-
-#define SPLAY_ASSEMBLE(head, node, left, right, field) do {		\
-	SPLAY_RIGHT(left, field) = SPLAY_LEFT((head)->sph_root, field);	\
-	SPLAY_LEFT(right, field) = SPLAY_RIGHT((head)->sph_root, field);\
-	SPLAY_LEFT((head)->sph_root, field) = SPLAY_RIGHT(node, field);	\
-	SPLAY_RIGHT((head)->sph_root, field) = SPLAY_LEFT(node, field);	\
-} while (0)
-
-/* Generates prototypes and inline functions */
-
-#define SPLAY_PROTOTYPE(name, type, field, cmp)				\
-void name##_SPLAY(struct name *, struct type *);			\
-void name##_SPLAY_MINMAX(struct name *, int);				\
-									\
-static __inline void							\
-name##_SPLAY_INSERT(struct name *head, struct type *elm)		\
-{									\
-    if (SPLAY_EMPTY(head)) {						\
-	    SPLAY_LEFT(elm, field) = SPLAY_RIGHT(elm, field) = NULL;	\
-    } else {								\
-	    int __comp;							\
-	    name##_SPLAY(head, elm);					\
-	    __comp = (cmp)(elm, (head)->sph_root);			\
-	    if(__comp < 0) {						\
-		    SPLAY_LEFT(elm, field) = SPLAY_LEFT((head)->sph_root, field);\
-		    SPLAY_RIGHT(elm, field) = (head)->sph_root;		\
-		    SPLAY_LEFT((head)->sph_root, field) = NULL;		\
-	    } else if (__comp > 0) {					\
-		    SPLAY_RIGHT(elm, field) = SPLAY_RIGHT((head)->sph_root, field);\
-		    SPLAY_LEFT(elm, field) = (head)->sph_root;		\
-		    SPLAY_RIGHT((head)->sph_root, field) = NULL;	\
-	    } else							\
-		    return;						\
-    }									\
-    (head)->sph_root = (elm);						\
-}									\
-									\
-static __inline void							\
-name##_SPLAY_REMOVE(struct name *head, struct type *elm)		\
-{									\
-	struct type *__tmp;						\
-	if (SPLAY_EMPTY(head))						\
-		return;							\
-	name##_SPLAY(head, elm);					\
-	if ((cmp)(elm, (head)->sph_root) == 0) {			\
-		if (SPLAY_LEFT((head)->sph_root, field) == NULL) {	\
-			(head)->sph_root = SPLAY_RIGHT((head)->sph_root, field);\
-		} else {						\
-			__tmp = SPLAY_RIGHT((head)->sph_root, field);	\
-			(head)->sph_root = SPLAY_LEFT((head)->sph_root, field);\
-			name##_SPLAY(head, elm);			\
-			SPLAY_RIGHT((head)->sph_root, field) = __tmp;	\
-		}							\
-	}								\
-}									\
-									\
-/* Finds the node with the same key as elm */				\
-static __inline struct type *						\
-name##_SPLAY_FIND(struct name *head, struct type *elm)			\
-{									\
-	if (SPLAY_EMPTY(head))						\
-		return(NULL);						\
-	name##_SPLAY(head, elm);					\
-	if ((cmp)(elm, (head)->sph_root) == 0)				\
-		return (head->sph_root);				\
-	return (NULL);							\
-}									\
-									\
-static __inline struct type *						\
-name##_SPLAY_NEXT(struct name *head, struct type *elm)			\
-{									\
-	name##_SPLAY(head, elm);					\
-	if (SPLAY_RIGHT(elm, field) != NULL) {				\
-		elm = SPLAY_RIGHT(elm, field);				\
-		while (SPLAY_LEFT(elm, field) != NULL) {		\
-			elm = SPLAY_LEFT(elm, field);			\
-		}							\
-	} else								\
-		elm = NULL;						\
-	return (elm);							\
-}									\
-									\
-static __inline struct type *						\
-name##_SPLAY_MIN_MAX(struct name *head, int val)			\
-{									\
-	name##_SPLAY_MINMAX(head, val);					\
-        return (SPLAY_ROOT(head));					\
-}
-
-/* Main splay operation.
- * Moves node close to the key of elm to top
- */
-#define SPLAY_GENERATE(name, type, field, cmp)				\
-void name##_SPLAY(struct name *head, struct type *elm)			\
-{									\
-	struct type __node, *__left, *__right, *__tmp;			\
-	int __comp;							\
-\
-	SPLAY_LEFT(&__node, field) = SPLAY_RIGHT(&__node, field) = NULL;\
-	__left = __right = &__node;					\
-\
-	while ((__comp = (cmp)(elm, (head)->sph_root))) {		\
-		if (__comp < 0) {					\
-			__tmp = SPLAY_LEFT((head)->sph_root, field);	\
-			if (__tmp == NULL)				\
-				break;					\
-			if ((cmp)(elm, __tmp) < 0){			\
-				SPLAY_ROTATE_RIGHT(head, __tmp, field);	\
-				if (SPLAY_LEFT((head)->sph_root, field) == NULL)\
-					break;				\
-			}						\
-			SPLAY_LINKLEFT(head, __right, field);		\
-		} else if (__comp > 0) {				\
-			__tmp = SPLAY_RIGHT((head)->sph_root, field);	\
-			if (__tmp == NULL)				\
-				break;					\
-			if ((cmp)(elm, __tmp) > 0){			\
-				SPLAY_ROTATE_LEFT(head, __tmp, field);	\
-				if (SPLAY_RIGHT((head)->sph_root, field) == NULL)\
-					break;				\
-			}						\
-			SPLAY_LINKRIGHT(head, __left, field);		\
-		}							\
-	}								\
-	SPLAY_ASSEMBLE(head, &__node, __left, __right, field);		\
-}									\
-									\
-/* Splay with either the minimum or the maximum element			\
- * Used to find minimum or maximum element in tree.			\
- */									\
-void name##_SPLAY_MINMAX(struct name *head, int __comp) \
-{									\
-	struct type __node, *__left, *__right, *__tmp;			\
-\
-	SPLAY_LEFT(&__node, field) = SPLAY_RIGHT(&__node, field) = NULL;\
-	__left = __right = &__node;					\
-\
-	while (1) {							\
-		if (__comp < 0) {					\
-			__tmp = SPLAY_LEFT((head)->sph_root, field);	\
-			if (__tmp == NULL)				\
-				break;					\
-			if (__comp < 0){				\
-				SPLAY_ROTATE_RIGHT(head, __tmp, field);	\
-				if (SPLAY_LEFT((head)->sph_root, field) == NULL)\
-					break;				\
-			}						\
-			SPLAY_LINKLEFT(head, __right, field);		\
-		} else if (__comp > 0) {				\
-			__tmp = SPLAY_RIGHT((head)->sph_root, field);	\
-			if (__tmp == NULL)				\
-				break;					\
-			if (__comp > 0) {				\
-				SPLAY_ROTATE_LEFT(head, __tmp, field);	\
-				if (SPLAY_RIGHT((head)->sph_root, field) == NULL)\
-					break;				\
-			}						\
-			SPLAY_LINKRIGHT(head, __left, field);		\
-		}							\
-	}								\
-	SPLAY_ASSEMBLE(head, &__node, __left, __right, field);		\
-}
-
-#define SPLAY_NEGINF	-1
-#define SPLAY_INF	1
-
-#define SPLAY_INSERT(name, x, y)	name##_SPLAY_INSERT(x, y)
-#define SPLAY_REMOVE(name, x, y)	name##_SPLAY_REMOVE(x, y)
-#define SPLAY_FIND(name, x, y)		name##_SPLAY_FIND(x, y)
-#define SPLAY_NEXT(name, x, y)		name##_SPLAY_NEXT(x, y)
-#define SPLAY_MIN(name, x)		(SPLAY_EMPTY(x) ? NULL	\
-					: name##_SPLAY_MIN_MAX(x, SPLAY_NEGINF))
-#define SPLAY_MAX(name, x)		(SPLAY_EMPTY(x) ? NULL	\
-					: name##_SPLAY_MIN_MAX(x, SPLAY_INF))
-
-#define SPLAY_FOREACH(x, name, head)					\
-	for ((x) = SPLAY_MIN(name, head);				\
-	     (x) != NULL;						\
-	     (x) = SPLAY_NEXT(name, head, x))
-
-/* Macros that define a red-back tree */
-#define RB_HEAD(name, type)						\
-struct name {								\
-	struct type *rbh_root; /* root of the tree */			\
-}
-
-#define RB_INITIALIZER(root)						\
-	{ NULL }
-
-#define RB_INIT(root) do {						\
-	(root)->rbh_root = NULL;					\
-} while (0)
-
-#define RB_BLACK	0
-#define RB_RED		1
-#define RB_ENTRY(type)							\
-struct {								\
-	struct type *rbe_left;		/* left element */		\
-	struct type *rbe_right;		/* right element */		\
-	struct type *rbe_parent;	/* parent element */		\
-	int rbe_color;			/* node color */		\
-}
-
-#define RB_LEFT(elm, field)		(elm)->field.rbe_left
-#define RB_RIGHT(elm, field)		(elm)->field.rbe_right
-#define RB_PARENT(elm, field)		(elm)->field.rbe_parent
-#define RB_COLOR(elm, field)		(elm)->field.rbe_color
-#define RB_ROOT(head)			(head)->rbh_root
-#define RB_EMPTY(head)			(RB_ROOT(head) == NULL)
-
-#define RB_SET(elm, parent, field) do {					\
-	RB_PARENT(elm, field) = parent;					\
-	RB_LEFT(elm, field) = RB_RIGHT(elm, field) = NULL;		\
-	RB_COLOR(elm, field) = RB_RED;					\
-} while (0)
-
-#define RB_SET_BLACKRED(black, red, field) do {				\
-	RB_COLOR(black, field) = RB_BLACK;				\
-	RB_COLOR(red, field) = RB_RED;					\
-} while (0)
-
-#ifndef RB_AUGMENT
-#define RB_AUGMENT(x)
-#endif
-
-#define RB_ROTATE_LEFT(head, elm, tmp, field) do {			\
-	(tmp) = RB_RIGHT(elm, field);					\
-	if ((RB_RIGHT(elm, field) = RB_LEFT(tmp, field))) {		\
-		RB_PARENT(RB_LEFT(tmp, field), field) = (elm);		\
-	}								\
-	RB_AUGMENT(elm);						\
-	if ((RB_PARENT(tmp, field) = RB_PARENT(elm, field))) {		\
-		if ((elm) == RB_LEFT(RB_PARENT(elm, field), field))	\
-			RB_LEFT(RB_PARENT(elm, field), field) = (tmp);	\
-		else							\
-			RB_RIGHT(RB_PARENT(elm, field), field) = (tmp);	\
-		RB_AUGMENT(RB_PARENT(elm, field));			\
-	} else								\
-		(head)->rbh_root = (tmp);				\
-	RB_LEFT(tmp, field) = (elm);					\
-	RB_PARENT(elm, field) = (tmp);					\
-	RB_AUGMENT(tmp);						\
-} while (0)
-
-#define RB_ROTATE_RIGHT(head, elm, tmp, field) do {			\
-	(tmp) = RB_LEFT(elm, field);					\
-	if ((RB_LEFT(elm, field) = RB_RIGHT(tmp, field))) {		\
-		RB_PARENT(RB_RIGHT(tmp, field), field) = (elm);		\
-	}								\
-	RB_AUGMENT(elm);						\
-	if ((RB_PARENT(tmp, field) = RB_PARENT(elm, field))) {		\
-		if ((elm) == RB_LEFT(RB_PARENT(elm, field), field))	\
-			RB_LEFT(RB_PARENT(elm, field), field) = (tmp);	\
-		else							\
-			RB_RIGHT(RB_PARENT(elm, field), field) = (tmp);	\
-		RB_AUGMENT(RB_PARENT(elm, field));			\
-	} else								\
-		(head)->rbh_root = (tmp);				\
-	RB_RIGHT(tmp, field) = (elm);					\
-	RB_PARENT(elm, field) = (tmp);					\
-	RB_AUGMENT(tmp);						\
-} while (0)
-
-/* Generates prototypes and inline functions */
-#define RB_PROTOTYPE(name, type, field, cmp)				\
-void name##_RB_INSERT_COLOR(struct name *, struct type *);	\
-void name##_RB_REMOVE_COLOR(struct name *, struct type *, struct type *);\
-void name##_RB_REMOVE(struct name *, struct type *);			\
-struct type *name##_RB_INSERT(struct name *, struct type *);		\
-struct type *name##_RB_FIND(struct name *, struct type *);		\
-struct type *name##_RB_NEXT(struct name *, struct type *);		\
-struct type *name##_RB_MINMAX(struct name *, int);			\
-									\
-
-/* Main rb operation.
- * Moves node close to the key of elm to top
- */
-#define RB_GENERATE(name, type, field, cmp)				\
-void									\
-name##_RB_INSERT_COLOR(struct name *head, struct type *elm)		\
-{									\
-	struct type *parent, *gparent, *tmp;				\
-	while ((parent = RB_PARENT(elm, field)) &&			\
-	    RB_COLOR(parent, field) == RB_RED) {			\
-		gparent = RB_PARENT(parent, field);			\
-		if (parent == RB_LEFT(gparent, field)) {		\
-			tmp = RB_RIGHT(gparent, field);			\
-			if (tmp && RB_COLOR(tmp, field) == RB_RED) {	\
-				RB_COLOR(tmp, field) = RB_BLACK;	\
-				RB_SET_BLACKRED(parent, gparent, field);\
-				elm = gparent;				\
-				continue;				\
-			}						\
-			if (RB_RIGHT(parent, field) == elm) {		\
-				RB_ROTATE_LEFT(head, parent, tmp, field);\
-				tmp = parent;				\
-				parent = elm;				\
-				elm = tmp;				\
-			}						\
-			RB_SET_BLACKRED(parent, gparent, field);	\
-			RB_ROTATE_RIGHT(head, gparent, tmp, field);	\
-		} else {						\
-			tmp = RB_LEFT(gparent, field);			\
-			if (tmp && RB_COLOR(tmp, field) == RB_RED) {	\
-				RB_COLOR(tmp, field) = RB_BLACK;	\
-				RB_SET_BLACKRED(parent, gparent, field);\
-				elm = gparent;				\
-				continue;				\
-			}						\
-			if (RB_LEFT(parent, field) == elm) {		\
-				RB_ROTATE_RIGHT(head, parent, tmp, field);\
-				tmp = parent;				\
-				parent = elm;				\
-				elm = tmp;				\
-			}						\
-			RB_SET_BLACKRED(parent, gparent, field);	\
-			RB_ROTATE_LEFT(head, gparent, tmp, field);	\
-		}							\
-	}								\
-	RB_COLOR(head->rbh_root, field) = RB_BLACK;			\
-}									\
-									\
-void									\
-name##_RB_REMOVE_COLOR(struct name *head, struct type *parent, struct type *elm) \
-{									\
-	struct type *tmp;						\
-	while ((elm == NULL || RB_COLOR(elm, field) == RB_BLACK) &&	\
-	    elm != RB_ROOT(head)) {					\
-		if (RB_LEFT(parent, field) == elm) {			\
-			tmp = RB_RIGHT(parent, field);			\
-			if (RB_COLOR(tmp, field) == RB_RED) {		\
-				RB_SET_BLACKRED(tmp, parent, field);	\
-				RB_ROTATE_LEFT(head, parent, tmp, field);\
-				tmp = RB_RIGHT(parent, field);		\
-			}						\
-			if ((RB_LEFT(tmp, field) == NULL ||		\
-			    RB_COLOR(RB_LEFT(tmp, field), field) == RB_BLACK) &&\
-			    (RB_RIGHT(tmp, field) == NULL ||		\
-			    RB_COLOR(RB_RIGHT(tmp, field), field) == RB_BLACK)) {\
-				RB_COLOR(tmp, field) = RB_RED;		\
-				elm = parent;				\
-				parent = RB_PARENT(elm, field);		\
-			} else {					\
-				if (RB_RIGHT(tmp, field) == NULL ||	\
-				    RB_COLOR(RB_RIGHT(tmp, field), field) == RB_BLACK) {\
-					struct type *oleft;		\
-					if ((oleft = RB_LEFT(tmp, field)))\
-						RB_COLOR(oleft, field) = RB_BLACK;\
-					RB_COLOR(tmp, field) = RB_RED;	\
-					RB_ROTATE_RIGHT(head, tmp, oleft, field);\
-					tmp = RB_RIGHT(parent, field);	\
-				}					\
-				RB_COLOR(tmp, field) = RB_COLOR(parent, field);\
-				RB_COLOR(parent, field) = RB_BLACK;	\
-				if (RB_RIGHT(tmp, field))		\
-					RB_COLOR(RB_RIGHT(tmp, field), field) = RB_BLACK;\
-				RB_ROTATE_LEFT(head, parent, tmp, field);\
-				elm = RB_ROOT(head);			\
-				break;					\
-			}						\
-		} else {						\
-			tmp = RB_LEFT(parent, field);			\
-			if (RB_COLOR(tmp, field) == RB_RED) {		\
-				RB_SET_BLACKRED(tmp, parent, field);	\
-				RB_ROTATE_RIGHT(head, parent, tmp, field);\
-				tmp = RB_LEFT(parent, field);		\
-			}						\
-			if ((RB_LEFT(tmp, field) == NULL ||		\
-			    RB_COLOR(RB_LEFT(tmp, field), field) == RB_BLACK) &&\
-			    (RB_RIGHT(tmp, field) == NULL ||		\
-			    RB_COLOR(RB_RIGHT(tmp, field), field) == RB_BLACK)) {\
-				RB_COLOR(tmp, field) = RB_RED;		\
-				elm = parent;				\
-				parent = RB_PARENT(elm, field);		\
-			} else {					\
-				if (RB_LEFT(tmp, field) == NULL ||	\
-				    RB_COLOR(RB_LEFT(tmp, field), field) == RB_BLACK) {\
-					struct type *oright;		\
-					if ((oright = RB_RIGHT(tmp, field)))\
-						RB_COLOR(oright, field) = RB_BLACK;\
-					RB_COLOR(tmp, field) = RB_RED;	\
-					RB_ROTATE_LEFT(head, tmp, oright, field);\
-					tmp = RB_LEFT(parent, field);	\
-				}					\
-				RB_COLOR(tmp, field) = RB_COLOR(parent, field);\
-				RB_COLOR(parent, field) = RB_BLACK;	\
-				if (RB_LEFT(tmp, field))		\
-					RB_COLOR(RB_LEFT(tmp, field), field) = RB_BLACK;\
-				RB_ROTATE_RIGHT(head, parent, tmp, field);\
-				elm = RB_ROOT(head);			\
-				break;					\
-			}						\
-		}							\
-	}								\
-	if (elm)							\
-		RB_COLOR(elm, field) = RB_BLACK;			\
-}									\
-									\
-void									\
-name##_RB_REMOVE(struct name *head, struct type *elm)			\
-{									\
-	struct type *child, *parent;					\
-	int color;							\
-	if (RB_LEFT(elm, field) == NULL)				\
-		child = RB_RIGHT(elm, field);				\
-	else if (RB_RIGHT(elm, field) == NULL)				\
-		child = RB_LEFT(elm, field);				\
-	else {								\
-		struct type *old = elm, *left;				\
-		elm = RB_RIGHT(elm, field);				\
-		while ((left = RB_LEFT(elm, field)))			\
-			elm = left;					\
-		child = RB_RIGHT(elm, field);				\
-		parent = RB_PARENT(elm, field);				\
-		color = RB_COLOR(elm, field);				\
-		if (child)						\
-			RB_PARENT(child, field) = parent;		\
-		if (parent) {						\
-			if (RB_LEFT(parent, field) == elm)		\
-				RB_LEFT(parent, field) = child;		\
-			else						\
-				RB_RIGHT(parent, field) = child;	\
-			RB_AUGMENT(parent);				\
-		} else							\
-			RB_ROOT(head) = child;				\
-		if (RB_PARENT(elm, field) == old)			\
-			parent = elm;					\
-		(elm)->field = (old)->field;				\
-		if (RB_PARENT(old, field)) {				\
-			if (RB_LEFT(RB_PARENT(old, field), field) == old)\
-				RB_LEFT(RB_PARENT(old, field), field) = elm;\
-			else						\
-				RB_RIGHT(RB_PARENT(old, field), field) = elm;\
-			RB_AUGMENT(RB_PARENT(old, field));		\
-		} else							\
-			RB_ROOT(head) = elm;				\
-		RB_PARENT(RB_LEFT(old, field), field) = elm;		\
-		if (RB_RIGHT(old, field))				\
-			RB_PARENT(RB_RIGHT(old, field), field) = elm;	\
-		if (parent) {						\
-			left = parent;					\
-			do {						\
-				RB_AUGMENT(left);			\
-			} while ((left = RB_PARENT(left, field)));	\
-		}							\
-		goto color;						\
-	}								\
-	parent = RB_PARENT(elm, field);					\
-	color = RB_COLOR(elm, field);					\
-	if (child)							\
-		RB_PARENT(child, field) = parent;			\
-	if (parent) {							\
-		if (RB_LEFT(parent, field) == elm)			\
-			RB_LEFT(parent, field) = child;			\
-		else							\
-			RB_RIGHT(parent, field) = child;		\
-		RB_AUGMENT(parent);					\
-	} else								\
-		RB_ROOT(head) = child;					\
-color:									\
-	if (color == RB_BLACK)						\
-		name##_RB_REMOVE_COLOR(head, parent, child);		\
-}									\
-									\
-/* Inserts a node into the RB tree */					\
-struct type *								\
-name##_RB_INSERT(struct name *head, struct type *elm)			\
-{									\
-	struct type *tmp;						\
-	struct type *parent = NULL;					\
-	int comp = 0;							\
-	tmp = RB_ROOT(head);						\
-	while (tmp) {							\
-		parent = tmp;						\
-		comp = (cmp)(elm, parent);				\
-		if (comp < 0)						\
-			tmp = RB_LEFT(tmp, field);			\
-		else if (comp > 0)					\
-			tmp = RB_RIGHT(tmp, field);			\
-		else							\
-			return (tmp);					\
-	}								\
-	RB_SET(elm, parent, field);					\
-	if (parent != NULL) {						\
-		if (comp < 0)						\
-			RB_LEFT(parent, field) = elm;			\
-		else							\
-			RB_RIGHT(parent, field) = elm;			\
-		RB_AUGMENT(parent);					\
-	} else								\
-		RB_ROOT(head) = elm;					\
-	name##_RB_INSERT_COLOR(head, elm);				\
-	return (NULL);							\
-}									\
-									\
-/* Finds the node with the same key as elm */				\
-struct type *								\
-name##_RB_FIND(struct name *head, struct type *elm)			\
-{									\
-	struct type *tmp = RB_ROOT(head);				\
-	int comp;							\
-	while (tmp) {							\
-		comp = cmp(elm, tmp);					\
-		if (comp < 0)						\
-			tmp = RB_LEFT(tmp, field);			\
-		else if (comp > 0)					\
-			tmp = RB_RIGHT(tmp, field);			\
-		else							\
-			return (tmp);					\
-	}								\
-	return (NULL);							\
-}									\
-									\
-struct type *								\
-name##_RB_NEXT(struct name *head, struct type *elm)			\
-{									\
-	if (RB_RIGHT(elm, field)) {					\
-		elm = RB_RIGHT(elm, field);				\
-		while (RB_LEFT(elm, field))				\
-			elm = RB_LEFT(elm, field);			\
-	} else {							\
-		if (RB_PARENT(elm, field) &&				\
-		    (elm == RB_LEFT(RB_PARENT(elm, field), field)))	\
-			elm = RB_PARENT(elm, field);			\
-		else {							\
-			while (RB_PARENT(elm, field) &&			\
-			    (elm == RB_RIGHT(RB_PARENT(elm, field), field)))\
-				elm = RB_PARENT(elm, field);		\
-			elm = RB_PARENT(elm, field);			\
-		}							\
-	}								\
-	return (elm);							\
-}									\
-									\
-struct type *								\
-name##_RB_MINMAX(struct name *head, int val)				\
-{									\
-	struct type *tmp = RB_ROOT(head);				\
-	struct type *parent = NULL;					\
-	while (tmp) {							\
-		parent = tmp;						\
-		if (val < 0)						\
-			tmp = RB_LEFT(tmp, field);			\
-		else							\
-			tmp = RB_RIGHT(tmp, field);			\
-	}								\
-	return (parent);						\
-}
-
-#define RB_NEGINF	-1
-#define RB_INF	1
-
-#define RB_INSERT(name, x, y)	name##_RB_INSERT(x, y)
-#define RB_REMOVE(name, x, y)	name##_RB_REMOVE(x, y)
-#define RB_FIND(name, x, y)	name##_RB_FIND(x, y)
-#define RB_NEXT(name, x, y)	name##_RB_NEXT(x, y)
-#define RB_MIN(name, x)		name##_RB_MINMAX(x, RB_NEGINF)
-#define RB_MAX(name, x)		name##_RB_MINMAX(x, RB_INF)
-
-#define RB_FOREACH(x, name, head)					\
-	for ((x) = RB_MIN(name, head);					\
-	     (x) != NULL;						\
-	     (x) = name##_RB_NEXT(head, x))
-
-#endif	/* _SYS_TREE_H_ */
diff --git a/crypto/openssh/openbsd-compat/vis.c b/crypto/openssh/openbsd-compat/vis.c
deleted file mode 100644
index fc57413907bd..000000000000
--- a/crypto/openssh/openbsd-compat/vis.c
+++ /dev/null
@@ -1,232 +0,0 @@
-/*-
- * Copyright (c) 1989, 1993
- *	The Regents of the University of California.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *	This product includes software developed by the University of
- *	California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-#include "config.h"
-#if !defined(HAVE_STRNVIS)
-
-#if defined(LIBC_SCCS) && !defined(lint)
-static char rcsid[] = "$OpenBSD: vis.c,v 1.8 2002/02/19 19:39:36 millert Exp $";
-#endif /* LIBC_SCCS and not lint */
-
-#include <ctype.h>
-
-#include "vis.h"
-
-#define	isoctal(c)	(((u_char)(c)) >= '0' && ((u_char)(c)) <= '7')
-#define isvisible(c)	(((u_int)(c) <= UCHAR_MAX && isascii((u_char)(c)) && \
-				isgraph((u_char)(c))) ||		     \
-				((flag & VIS_SP) == 0 && (c) == ' ') ||	     \
-				((flag & VIS_TAB) == 0 && (c) == '\t') ||    \
-				((flag & VIS_NL) == 0 && (c) == '\n') ||     \
-				((flag & VIS_SAFE) &&			     \
-				((c) == '\b' || (c) == '\007' || (c) == '\r')))
-
-/*
- * vis - visually encode characters
- */
-char *
-vis(dst, c, flag, nextc)
-	register char *dst;
-	int c, nextc;
-	register int flag;
-{
-	if (isvisible(c)) {
-		*dst++ = c;
-		if (c == '\\' && (flag & VIS_NOSLASH) == 0)
-			*dst++ = '\\';
-		*dst = '\0';
-		return (dst);
-	}
-
-	if (flag & VIS_CSTYLE) {
-		switch(c) {
-		case '\n':
-			*dst++ = '\\';
-			*dst++ = 'n';
-			goto done;
-		case '\r':
-			*dst++ = '\\';
-			*dst++ = 'r';
-			goto done;
-		case '\b':
-			*dst++ = '\\';
-			*dst++ = 'b';
-			goto done;
-		case '\a':
-			*dst++ = '\\';
-			*dst++ = 'a';
-			goto done;
-		case '\v':
-			*dst++ = '\\';
-			*dst++ = 'v';
-			goto done;
-		case '\t':
-			*dst++ = '\\';
-			*dst++ = 't';
-			goto done;
-		case '\f':
-			*dst++ = '\\';
-			*dst++ = 'f';
-			goto done;
-		case ' ':
-			*dst++ = '\\';
-			*dst++ = 's';
-			goto done;
-		case '\0':
-			*dst++ = '\\';
-			*dst++ = '0';
-			if (isoctal(nextc)) {
-				*dst++ = '0';
-				*dst++ = '0';
-			}
-			goto done;
-		}
-	}
-	if (((c & 0177) == ' ') || (flag & VIS_OCTAL)) {	
-		*dst++ = '\\';
-		*dst++ = ((u_char)c >> 6 & 07) + '0';
-		*dst++ = ((u_char)c >> 3 & 07) + '0';
-		*dst++ = ((u_char)c & 07) + '0';
-		goto done;
-	}
-	if ((flag & VIS_NOSLASH) == 0)
-		*dst++ = '\\';
-	if (c & 0200) {
-		c &= 0177;
-		*dst++ = 'M';
-	}
-	if (iscntrl(c)) {
-		*dst++ = '^';
-		if (c == 0177)
-			*dst++ = '?';
-		else
-			*dst++ = c + '@';
-	} else {
-		*dst++ = '-';
-		*dst++ = c;
-	}
-done:
-	*dst = '\0';
-	return (dst);
-}
-
-/*
- * strvis, strnvis, strvisx - visually encode characters from src into dst
- *	
- *	Dst must be 4 times the size of src to account for possible
- *	expansion.  The length of dst, not including the trailing NULL,
- *	is returned. 
- *
- *	Strnvis will write no more than siz-1 bytes (and will NULL terminate).
- *	The number of bytes needed to fully encode the string is returned.
- *
- *	Strvisx encodes exactly len bytes from src into dst.
- *	This is useful for encoding a block of data.
- */
-int
-strvis(dst, src, flag)
-	register char *dst;
-	register const char *src;
-	int flag;
-{
-	register char c;
-	char *start;
-
-	for (start = dst; (c = *src);)
-		dst = vis(dst, c, flag, *++src);
-	*dst = '\0';
-	return (dst - start);
-}
-
-int
-strnvis(dst, src, siz, flag)
-	register char *dst;
-	register const char *src;
-	size_t siz;
-	int flag;
-{
-	register char c;
-	char *start, *end;
-
-	for (start = dst, end = start + siz - 1; (c = *src) && dst < end; ) {
-		if (isvisible(c)) {
-			*dst++ = c;
-			if (c == '\\' && (flag & VIS_NOSLASH) == 0) {
-				/* need space for the extra '\\' */
-				if (dst < end)
-					*dst++ = '\\';
-				else {
-					dst--;
-					break;
-				}
-			}
-			src++;
-		} else {
-			/* vis(3) requires up to 4 chars */
-			if (dst + 3 < end)
-				dst = vis(dst, c, flag, *++src);
-			else
-				break;
-		}
-	}
-	*dst = '\0';
-	if (dst >= end) {
-		char tbuf[5];
-
-		/* adjust return value for truncation */
-		while ((c = *src))
-			dst += vis(tbuf, c, flag, *++src) - tbuf;
-	}
-	return (dst - start);
-}
-
-int
-strvisx(dst, src, len, flag)
-	register char *dst;
-	register const char *src;
-	register size_t len;
-	int flag;
-{
-	register char c;
-	char *start;
-
-	for (start = dst; len > 1; len--) {
-		c = *src;
-		dst = vis(dst, c, flag, *++src);
-	}
-	if (len)
-		dst = vis(dst, *src, flag, '\0');
-	*dst = '\0';
-	return (dst - start);
-}
-
-#endif
diff --git a/crypto/openssh/openbsd-compat/vis.h b/crypto/openssh/openbsd-compat/vis.h
deleted file mode 100644
index 5df6f3694fce..000000000000
--- a/crypto/openssh/openbsd-compat/vis.h
+++ /dev/null
@@ -1,91 +0,0 @@
-/*	$OpenBSD: vis.h,v 1.5 2002/02/16 21:27:17 millert Exp $	*/
-/*	$NetBSD: vis.h,v 1.4 1994/10/26 00:56:41 cgd Exp $	*/
-
-/*-
- * Copyright (c) 1990 The Regents of the University of California.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *	This product includes software developed by the University of
- *	California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- *	@(#)vis.h	5.9 (Berkeley) 4/3/91
- */
-#include "config.h"
-#if !defined(HAVE_STRNVIS)
-
-#ifndef _VIS_H_
-#define	_VIS_H_
-
-#include <sys/types.h>
-#include <limits.h>
-
-/*
- * to select alternate encoding format
- */
-#define	VIS_OCTAL	0x01	/* use octal \ddd format */
-#define	VIS_CSTYLE	0x02	/* use \[nrft0..] where appropriate */
-
-/*
- * to alter set of characters encoded (default is to encode all
- * non-graphic except space, tab, and newline).
- */
-#define	VIS_SP		0x04	/* also encode space */
-#define	VIS_TAB		0x08	/* also encode tab */
-#define	VIS_NL		0x10	/* also encode newline */
-#define	VIS_WHITE	(VIS_SP | VIS_TAB | VIS_NL)
-#define	VIS_SAFE	0x20	/* only encode "unsafe" characters */
-
-/*
- * other
- */
-#define	VIS_NOSLASH	0x40	/* inhibit printing '\' */
-
-/*
- * unvis return codes
- */
-#define	UNVIS_VALID	 1	/* character valid */
-#define	UNVIS_VALIDPUSH	 2	/* character valid, push back passed char */
-#define	UNVIS_NOCHAR	 3	/* valid sequence, no character produced */
-#define	UNVIS_SYNBAD	-1	/* unrecognized escape sequence */
-#define	UNVIS_ERROR	-2	/* decoder in unknown state (unrecoverable) */
-
-/*
- * unvis flags
- */
-#define	UNVIS_END	1	/* no more characters */
-
-char	*vis(char *, int, int, int);
-int	strvis(char *, const char *, int);
-int	strnvis(char *, const char *, size_t, int);
-int	strvisx(char *, const char *, size_t, int);
-int	strunvis(char *, const char *);
-int	unvis(char *, char, int *, int);
-
-#endif /* !_VIS_H_ */
-
-#endif /* !HAVE_STRNVIS */
diff --git a/crypto/openssh/openbsd-compat/xmmap.c b/crypto/openssh/openbsd-compat/xmmap.c
deleted file mode 100644
index 8f1d2022cd4c..000000000000
--- a/crypto/openssh/openbsd-compat/xmmap.c
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-
-#ifdef HAVE_SYS_MMAN_H
-#include <sys/mman.h>
-#endif
-
-#include "log.h"
-
-void *xmmap(size_t size)
-{
-	void *address;
-
-#ifdef HAVE_MMAP
-# ifdef MAP_ANON
-	address = mmap(NULL, size, PROT_WRITE|PROT_READ, MAP_ANON|MAP_SHARED,
-	    -1, 0);
-# else
-	address = mmap(NULL, size, PROT_WRITE|PROT_READ, MAP_SHARED,
-	    open("/dev/zero", O_RDWR), 0);
-# endif
-
-#define MM_SWAP_TEMPLATE "/var/run/sshd.mm.XXXXXXXX"
-	if (address == MAP_FAILED) {
-		char tmpname[sizeof(MM_SWAP_TEMPLATE)] = MM_SWAP_TEMPLATE;
-		int tmpfd;
-
-		tmpfd = mkstemp(tmpname);
-		if (tmpfd == -1)
-			fatal("mkstemp(\"%s\"): %s",
-			    MM_SWAP_TEMPLATE, strerror(errno));
-		unlink(tmpname);
-		ftruncate(tmpfd, size);
-		address = mmap(NULL, size, PROT_WRITE|PROT_READ, MAP_SHARED,
-		    tmpfd, 0);
-		close(tmpfd);
-	}
-
-	return (address);
-#else
-	fatal("%s: UsePrivilegeSeparation=yes and Compression=yes not supported",
-	    __func__);
-#endif /* HAVE_MMAP */
-
-}
-
diff --git a/crypto/openssh/openbsd-compat/xmmap.h b/crypto/openssh/openbsd-compat/xmmap.h
deleted file mode 100644
index c0fa04aca3ae..000000000000
--- a/crypto/openssh/openbsd-compat/xmmap.h
+++ /dev/null
@@ -1,23 +0,0 @@
-/*
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-void *xmmap(size_t size);
diff --git a/crypto/openssh/packet.c b/crypto/openssh/packet.c
deleted file mode 100644
index 77860d626284..000000000000
--- a/crypto/openssh/packet.c
+++ /dev/null
@@ -1,1416 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * This file contains code implementing the packet protocol and communication
- * with the other side.  This same code is used both on client and server side.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- *
- *
- * SSH2 packet format added by Markus Friedl.
- * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: packet.c,v 1.104 2003/04/01 10:22:21 markus Exp $");
-
-#include "xmalloc.h"
-#include "buffer.h"
-#include "packet.h"
-#include "bufaux.h"
-#include "crc32.h"
-#include "getput.h"
-
-#include "compress.h"
-#include "deattack.h"
-#include "channels.h"
-
-#include "compat.h"
-#include "ssh1.h"
-#include "ssh2.h"
-
-#include "cipher.h"
-#include "kex.h"
-#include "mac.h"
-#include "log.h"
-#include "canohost.h"
-#include "misc.h"
-#include "ssh.h"
-
-#ifdef PACKET_DEBUG
-#define DBG(x) x
-#else
-#define DBG(x)
-#endif
-
-/*
- * This variable contains the file descriptors used for communicating with
- * the other side.  connection_in is used for reading; connection_out for
- * writing.  These can be the same descriptor, in which case it is assumed to
- * be a socket.
- */
-static int connection_in = -1;
-static int connection_out = -1;
-
-/* Protocol flags for the remote side. */
-static u_int remote_protocol_flags = 0;
-
-/* Encryption context for receiving data.  This is only used for decryption. */
-static CipherContext receive_context;
-
-/* Encryption context for sending data.  This is only used for encryption. */
-static CipherContext send_context;
-
-/* Buffer for raw input data from the socket. */
-Buffer input;
-
-/* Buffer for raw output data going to the socket. */
-Buffer output;
-
-/* Buffer for the partial outgoing packet being constructed. */
-static Buffer outgoing_packet;
-
-/* Buffer for the incoming packet currently being processed. */
-static Buffer incoming_packet;
-
-/* Scratch buffer for packet compression/decompression. */
-static Buffer compression_buffer;
-static int compression_buffer_ready = 0;
-
-/* Flag indicating whether packet compression/decompression is enabled. */
-static int packet_compression = 0;
-
-/* default maximum packet size */
-int max_packet_size = 32768;
-
-/* Flag indicating whether this module has been initialized. */
-static int initialized = 0;
-
-/* Set to true if the connection is interactive. */
-static int interactive_mode = 0;
-
-/* Session key information for Encryption and MAC */
-Newkeys *newkeys[MODE_MAX];
-static u_int32_t read_seqnr = 0;
-static u_int32_t send_seqnr = 0;
-
-/* Session key for protocol v1 */
-static u_char ssh1_key[SSH_SESSION_KEY_LENGTH];
-static u_int ssh1_keylen;
-
-/* roundup current message to extra_pad bytes */
-static u_char extra_pad = 0;
-
-/*
- * Sets the descriptors used for communication.  Disables encryption until
- * packet_set_encryption_key is called.
- */
-void
-packet_set_connection(int fd_in, int fd_out)
-{
-	Cipher *none = cipher_by_name("none");
-
-	if (none == NULL)
-		fatal("packet_set_connection: cannot load cipher 'none'");
-	connection_in = fd_in;
-	connection_out = fd_out;
-	cipher_init(&send_context, none, "", 0, NULL, 0, CIPHER_ENCRYPT);
-	cipher_init(&receive_context, none, "", 0, NULL, 0, CIPHER_DECRYPT);
-	newkeys[MODE_IN] = newkeys[MODE_OUT] = NULL;
-	if (!initialized) {
-		initialized = 1;
-		buffer_init(&input);
-		buffer_init(&output);
-		buffer_init(&outgoing_packet);
-		buffer_init(&incoming_packet);
-	}
-	/* Kludge: arrange the close function to be called from fatal(). */
-	fatal_add_cleanup((void (*) (void *)) packet_close, NULL);
-}
-
-/* Returns 1 if remote host is connected via socket, 0 if not. */
-
-int
-packet_connection_is_on_socket(void)
-{
-	struct sockaddr_storage from, to;
-	socklen_t fromlen, tolen;
-
-	/* filedescriptors in and out are the same, so it's a socket */
-	if (connection_in == connection_out)
-		return 1;
-	fromlen = sizeof(from);
-	memset(&from, 0, sizeof(from));
-	if (getpeername(connection_in, (struct sockaddr *)&from, &fromlen) < 0)
-		return 0;
-	tolen = sizeof(to);
-	memset(&to, 0, sizeof(to));
-	if (getpeername(connection_out, (struct sockaddr *)&to, &tolen) < 0)
-		return 0;
-	if (fromlen != tolen || memcmp(&from, &to, fromlen) != 0)
-		return 0;
-	if (from.ss_family != AF_INET && from.ss_family != AF_INET6)
-		return 0;
-	return 1;
-}
-
-/*
- * Exports an IV from the CipherContext required to export the key
- * state back from the unprivileged child to the privileged parent
- * process.
- */
-
-void
-packet_get_keyiv(int mode, u_char *iv, u_int len)
-{
-	CipherContext *cc;
-
-	if (mode == MODE_OUT)
-		cc = &send_context;
-	else
-		cc = &receive_context;
-
-	cipher_get_keyiv(cc, iv, len);
-}
-
-int
-packet_get_keycontext(int mode, u_char *dat)
-{
-	CipherContext *cc;
-
-	if (mode == MODE_OUT)
-		cc = &send_context;
-	else
-		cc = &receive_context;
-
-	return (cipher_get_keycontext(cc, dat));
-}
-
-void
-packet_set_keycontext(int mode, u_char *dat)
-{
-	CipherContext *cc;
-
-	if (mode == MODE_OUT)
-		cc = &send_context;
-	else
-		cc = &receive_context;
-
-	cipher_set_keycontext(cc, dat);
-}
-
-int
-packet_get_keyiv_len(int mode)
-{
-	CipherContext *cc;
-
-	if (mode == MODE_OUT)
-		cc = &send_context;
-	else
-		cc = &receive_context;
-
-	return (cipher_get_keyiv_len(cc));
-}
-void
-packet_set_iv(int mode, u_char *dat)
-{
-	CipherContext *cc;
-
-	if (mode == MODE_OUT)
-		cc = &send_context;
-	else
-		cc = &receive_context;
-
-	cipher_set_keyiv(cc, dat);
-}
-int
-packet_get_ssh1_cipher()
-{
-	return (cipher_get_number(receive_context.cipher));
-}
-
-
-u_int32_t
-packet_get_seqnr(int mode)
-{
-	return (mode == MODE_IN ? read_seqnr : send_seqnr);
-}
-
-void
-packet_set_seqnr(int mode, u_int32_t seqnr)
-{
-	if (mode == MODE_IN)
-		read_seqnr = seqnr;
-	else if (mode == MODE_OUT)
-		send_seqnr = seqnr;
-	else
-		fatal("packet_set_seqnr: bad mode %d", mode);
-}
-
-/* returns 1 if connection is via ipv4 */
-
-int
-packet_connection_is_ipv4(void)
-{
-	struct sockaddr_storage to;
-	socklen_t tolen = sizeof(to);
-
-	memset(&to, 0, sizeof(to));
-	if (getsockname(connection_out, (struct sockaddr *)&to, &tolen) < 0)
-		return 0;
-	if (to.ss_family == AF_INET)
-		return 1;
-#ifdef IPV4_IN_IPV6
-	if (to.ss_family == AF_INET6 && 
-	    IN6_IS_ADDR_V4MAPPED(&((struct sockaddr_in6 *)&to)->sin6_addr))
-		return 1;
-#endif
-	return 0;
-}
-
-/* Sets the connection into non-blocking mode. */
-
-void
-packet_set_nonblocking(void)
-{
-	/* Set the socket into non-blocking mode. */
-	if (fcntl(connection_in, F_SETFL, O_NONBLOCK) < 0)
-		error("fcntl O_NONBLOCK: %.100s", strerror(errno));
-
-	if (connection_out != connection_in) {
-		if (fcntl(connection_out, F_SETFL, O_NONBLOCK) < 0)
-			error("fcntl O_NONBLOCK: %.100s", strerror(errno));
-	}
-}
-
-/* Returns the socket used for reading. */
-
-int
-packet_get_connection_in(void)
-{
-	return connection_in;
-}
-
-/* Returns the descriptor used for writing. */
-
-int
-packet_get_connection_out(void)
-{
-	return connection_out;
-}
-
-/* Closes the connection and clears and frees internal data structures. */
-
-void
-packet_close(void)
-{
-	if (!initialized)
-		return;
-	initialized = 0;
-	if (connection_in == connection_out) {
-		shutdown(connection_out, SHUT_RDWR);
-		close(connection_out);
-	} else {
-		close(connection_in);
-		close(connection_out);
-	}
-	buffer_free(&input);
-	buffer_free(&output);
-	buffer_free(&outgoing_packet);
-	buffer_free(&incoming_packet);
-	if (compression_buffer_ready) {
-		buffer_free(&compression_buffer);
-		buffer_compress_uninit();
-	}
-	cipher_cleanup(&send_context);
-	cipher_cleanup(&receive_context);
-}
-
-/* Sets remote side protocol flags. */
-
-void
-packet_set_protocol_flags(u_int protocol_flags)
-{
-	remote_protocol_flags = protocol_flags;
-}
-
-/* Returns the remote protocol flags set earlier by the above function. */
-
-u_int
-packet_get_protocol_flags(void)
-{
-	return remote_protocol_flags;
-}
-
-/*
- * Starts packet compression from the next packet on in both directions.
- * Level is compression level 1 (fastest) - 9 (slow, best) as in gzip.
- */
-
-static void
-packet_init_compression(void)
-{
-	if (compression_buffer_ready == 1)
-		return;
-	compression_buffer_ready = 1;
-	buffer_init(&compression_buffer);
-}
-
-void
-packet_start_compression(int level)
-{
-	if (packet_compression && !compat20)
-		fatal("Compression already enabled.");
-	packet_compression = 1;
-	packet_init_compression();
-	buffer_compress_init_send(level);
-	buffer_compress_init_recv();
-}
-
-/*
- * Causes any further packets to be encrypted using the given key.  The same
- * key is used for both sending and reception.  However, both directions are
- * encrypted independently of each other.
- */
-
-void
-packet_set_encryption_key(const u_char *key, u_int keylen,
-    int number)
-{
-	Cipher *cipher = cipher_by_number(number);
-
-	if (cipher == NULL)
-		fatal("packet_set_encryption_key: unknown cipher number %d", number);
-	if (keylen < 20)
-		fatal("packet_set_encryption_key: keylen too small: %d", keylen);
-	if (keylen > SSH_SESSION_KEY_LENGTH)
-		fatal("packet_set_encryption_key: keylen too big: %d", keylen);
-	memcpy(ssh1_key, key, keylen);
-	ssh1_keylen = keylen;
-	cipher_init(&send_context, cipher, key, keylen, NULL, 0, CIPHER_ENCRYPT);
-	cipher_init(&receive_context, cipher, key, keylen, NULL, 0, CIPHER_DECRYPT);
-}
-
-u_int
-packet_get_encryption_key(u_char *key)
-{
-	if (key == NULL)
-		return (ssh1_keylen);
-	memcpy(key, ssh1_key, ssh1_keylen);
-	return (ssh1_keylen);
-}
-
-/* Start constructing a packet to send. */
-void
-packet_start(u_char type)
-{
-	u_char buf[9];
-	int len;
-
-	DBG(debug("packet_start[%d]", type));
-	len = compat20 ? 6 : 9;
-	memset(buf, 0, len - 1);
-	buf[len - 1] = type;
-	buffer_clear(&outgoing_packet);
-	buffer_append(&outgoing_packet, buf, len);
-}
-
-/* Append payload. */
-void
-packet_put_char(int value)
-{
-	char ch = value;
-
-	buffer_append(&outgoing_packet, &ch, 1);
-}
-void
-packet_put_int(u_int value)
-{
-	buffer_put_int(&outgoing_packet, value);
-}
-void
-packet_put_string(const void *buf, u_int len)
-{
-	buffer_put_string(&outgoing_packet, buf, len);
-}
-void
-packet_put_cstring(const char *str)
-{
-	buffer_put_cstring(&outgoing_packet, str);
-}
-void
-packet_put_raw(const void *buf, u_int len)
-{
-	buffer_append(&outgoing_packet, buf, len);
-}
-void
-packet_put_bignum(BIGNUM * value)
-{
-	buffer_put_bignum(&outgoing_packet, value);
-}
-void
-packet_put_bignum2(BIGNUM * value)
-{
-	buffer_put_bignum2(&outgoing_packet, value);
-}
-
-/*
- * Finalizes and sends the packet.  If the encryption key has been set,
- * encrypts the packet before sending.
- */
-
-static void
-packet_send1(void)
-{
-	u_char buf[8], *cp;
-	int i, padding, len;
-	u_int checksum;
-	u_int32_t rand = 0;
-
-	/*
-	 * If using packet compression, compress the payload of the outgoing
-	 * packet.
-	 */
-	if (packet_compression) {
-		buffer_clear(&compression_buffer);
-		/* Skip padding. */
-		buffer_consume(&outgoing_packet, 8);
-		/* padding */
-		buffer_append(&compression_buffer, "\0\0\0\0\0\0\0\0", 8);
-		buffer_compress(&outgoing_packet, &compression_buffer);
-		buffer_clear(&outgoing_packet);
-		buffer_append(&outgoing_packet, buffer_ptr(&compression_buffer),
-		    buffer_len(&compression_buffer));
-	}
-	/* Compute packet length without padding (add checksum, remove padding). */
-	len = buffer_len(&outgoing_packet) + 4 - 8;
-
-	/* Insert padding. Initialized to zero in packet_start1() */
-	padding = 8 - len % 8;
-	if (!send_context.plaintext) {
-		cp = buffer_ptr(&outgoing_packet);
-		for (i = 0; i < padding; i++) {
-			if (i % 4 == 0)
-				rand = arc4random();
-			cp[7 - i] = rand & 0xff;
-			rand >>= 8;
-		}
-	}
-	buffer_consume(&outgoing_packet, 8 - padding);
-
-	/* Add check bytes. */
-	checksum = ssh_crc32(buffer_ptr(&outgoing_packet),
-	    buffer_len(&outgoing_packet));
-	PUT_32BIT(buf, checksum);
-	buffer_append(&outgoing_packet, buf, 4);
-
-#ifdef PACKET_DEBUG
-	fprintf(stderr, "packet_send plain: ");
-	buffer_dump(&outgoing_packet);
-#endif
-
-	/* Append to output. */
-	PUT_32BIT(buf, len);
-	buffer_append(&output, buf, 4);
-	cp = buffer_append_space(&output, buffer_len(&outgoing_packet));
-	cipher_crypt(&send_context, cp, buffer_ptr(&outgoing_packet),
-	    buffer_len(&outgoing_packet));
-
-#ifdef PACKET_DEBUG
-	fprintf(stderr, "encrypted: ");
-	buffer_dump(&output);
-#endif
-
-	buffer_clear(&outgoing_packet);
-
-	/*
-	 * Note that the packet is now only buffered in output.  It won\'t be
-	 * actually sent until packet_write_wait or packet_write_poll is
-	 * called.
-	 */
-}
-
-void
-set_newkeys(int mode)
-{
-	Enc *enc;
-	Mac *mac;
-	Comp *comp;
-	CipherContext *cc;
-	int encrypt;
-
-	debug2("set_newkeys: mode %d", mode);
-
-	if (mode == MODE_OUT) {
-		cc = &send_context;
-		encrypt = CIPHER_ENCRYPT;
-	} else {
-		cc = &receive_context;
-		encrypt = CIPHER_DECRYPT;
-	}
-	if (newkeys[mode] != NULL) {
-		debug("set_newkeys: rekeying");
-		cipher_cleanup(cc);
-		enc  = &newkeys[mode]->enc;
-		mac  = &newkeys[mode]->mac;
-		comp = &newkeys[mode]->comp;
-		memset(mac->key, 0, mac->key_len);
-		xfree(enc->name);
-		xfree(enc->iv);
-		xfree(enc->key);
-		xfree(mac->name);
-		xfree(mac->key);
-		xfree(comp->name);
-		xfree(newkeys[mode]);
-	}
-	newkeys[mode] = kex_get_newkeys(mode);
-	if (newkeys[mode] == NULL)
-		fatal("newkeys: no keys for mode %d", mode);
-	enc  = &newkeys[mode]->enc;
-	mac  = &newkeys[mode]->mac;
-	comp = &newkeys[mode]->comp;
-	if (mac->md != NULL)
-		mac->enabled = 1;
-	DBG(debug("cipher_init_context: %d", mode));
-	cipher_init(cc, enc->cipher, enc->key, enc->key_len,
-	    enc->iv, enc->block_size, encrypt);
-	/* Deleting the keys does not gain extra security */
-	/* memset(enc->iv,  0, enc->block_size);
-	   memset(enc->key, 0, enc->key_len); */
-	if (comp->type != 0 && comp->enabled == 0) {
-		packet_init_compression();
-		if (mode == MODE_OUT)
-			buffer_compress_init_send(6);
-		else
-			buffer_compress_init_recv();
-		comp->enabled = 1;
-	}
-}
-
-/*
- * Finalize packet in SSH2 format (compress, mac, encrypt, enqueue)
- */
-static void
-packet_send2(void)
-{
-	u_char type, *cp, *macbuf = NULL;
-	u_char padlen, pad;
-	u_int packet_length = 0;
-	u_int i, len;
-	u_int32_t rand = 0;
-	Enc *enc   = NULL;
-	Mac *mac   = NULL;
-	Comp *comp = NULL;
-	int block_size;
-
-	if (newkeys[MODE_OUT] != NULL) {
-		enc  = &newkeys[MODE_OUT]->enc;
-		mac  = &newkeys[MODE_OUT]->mac;
-		comp = &newkeys[MODE_OUT]->comp;
-	}
-	block_size = enc ? enc->block_size : 8;
-
-	cp = buffer_ptr(&outgoing_packet);
-	type = cp[5];
-
-#ifdef PACKET_DEBUG
-	fprintf(stderr, "plain:     ");
-	buffer_dump(&outgoing_packet);
-#endif
-
-	if (comp && comp->enabled) {
-		len = buffer_len(&outgoing_packet);
-		/* skip header, compress only payload */
-		buffer_consume(&outgoing_packet, 5);
-		buffer_clear(&compression_buffer);
-		buffer_compress(&outgoing_packet, &compression_buffer);
-		buffer_clear(&outgoing_packet);
-		buffer_append(&outgoing_packet, "\0\0\0\0\0", 5);
-		buffer_append(&outgoing_packet, buffer_ptr(&compression_buffer),
-		    buffer_len(&compression_buffer));
-		DBG(debug("compression: raw %d compressed %d", len,
-		    buffer_len(&outgoing_packet)));
-	}
-
-	/* sizeof (packet_len + pad_len + payload) */
-	len = buffer_len(&outgoing_packet);
-
-	/*
-	 * calc size of padding, alloc space, get random data,
-	 * minimum padding is 4 bytes
-	 */
-	padlen = block_size - (len % block_size);
-	if (padlen < 4)
-		padlen += block_size;
-	if (extra_pad) {
-		/* will wrap if extra_pad+padlen > 255 */
-		extra_pad  = roundup(extra_pad, block_size);
-		pad = extra_pad - ((len + padlen) % extra_pad);
-		debug3("packet_send2: adding %d (len %d padlen %d extra_pad %d)",
-		    pad, len, padlen, extra_pad);
-		padlen += pad;
-		extra_pad = 0;
-	}
-	cp = buffer_append_space(&outgoing_packet, padlen);
-	if (enc && !send_context.plaintext) {
-		/* random padding */
-		for (i = 0; i < padlen; i++) {
-			if (i % 4 == 0)
-				rand = arc4random();
-			cp[i] = rand & 0xff;
-			rand >>= 8;
-		}
-	} else {
-		/* clear padding */
-		memset(cp, 0, padlen);
-	}
-	/* packet_length includes payload, padding and padding length field */
-	packet_length = buffer_len(&outgoing_packet) - 4;
-	cp = buffer_ptr(&outgoing_packet);
-	PUT_32BIT(cp, packet_length);
-	cp[4] = padlen;
-	DBG(debug("send: len %d (includes padlen %d)", packet_length+4, padlen));
-
-	/* compute MAC over seqnr and packet(length fields, payload, padding) */
-	if (mac && mac->enabled) {
-		macbuf = mac_compute(mac, send_seqnr,
-		    buffer_ptr(&outgoing_packet),
-		    buffer_len(&outgoing_packet));
-		DBG(debug("done calc MAC out #%d", send_seqnr));
-	}
-	/* encrypt packet and append to output buffer. */
-	cp = buffer_append_space(&output, buffer_len(&outgoing_packet));
-	cipher_crypt(&send_context, cp, buffer_ptr(&outgoing_packet),
-	    buffer_len(&outgoing_packet));
-	/* append unencrypted MAC */
-	if (mac && mac->enabled)
-		buffer_append(&output, (char *)macbuf, mac->mac_len);
-#ifdef PACKET_DEBUG
-	fprintf(stderr, "encrypted: ");
-	buffer_dump(&output);
-#endif
-	/* increment sequence number for outgoing packets */
-	if (++send_seqnr == 0)
-		log("outgoing seqnr wraps around");
-	buffer_clear(&outgoing_packet);
-
-	if (type == SSH2_MSG_NEWKEYS)
-		set_newkeys(MODE_OUT);
-}
-
-void
-packet_send(void)
-{
-	if (compat20)
-		packet_send2();
-	else
-		packet_send1();
-	DBG(debug("packet_send done"));
-}
-
-/*
- * Waits until a packet has been received, and returns its type.  Note that
- * no other data is processed until this returns, so this function should not
- * be used during the interactive session.
- */
-
-int
-packet_read_seqnr(u_int32_t *seqnr_p)
-{
-	int type, len;
-	fd_set *setp;
-	char buf[8192];
-	DBG(debug("packet_read()"));
-
-	setp = (fd_set *)xmalloc(howmany(connection_in+1, NFDBITS) *
-	    sizeof(fd_mask));
-
-	/* Since we are blocking, ensure that all written packets have been sent. */
-	packet_write_wait();
-
-	/* Stay in the loop until we have received a complete packet. */
-	for (;;) {
-		/* Try to read a packet from the buffer. */
-		type = packet_read_poll_seqnr(seqnr_p);
-		if (!compat20 && (
-		    type == SSH_SMSG_SUCCESS
-		    || type == SSH_SMSG_FAILURE
-		    || type == SSH_CMSG_EOF
-		    || type == SSH_CMSG_EXIT_CONFIRMATION))
-			packet_check_eom();
-		/* If we got a packet, return it. */
-		if (type != SSH_MSG_NONE) {
-			xfree(setp);
-			return type;
-		}
-		/*
-		 * Otherwise, wait for some data to arrive, add it to the
-		 * buffer, and try again.
-		 */
-		memset(setp, 0, howmany(connection_in + 1, NFDBITS) *
-		    sizeof(fd_mask));
-		FD_SET(connection_in, setp);
-
-		/* Wait for some data to arrive. */
-		while (select(connection_in + 1, setp, NULL, NULL, NULL) == -1 &&
-		    (errno == EAGAIN || errno == EINTR))
-			;
-
-		/* Read data from the socket. */
-		len = read(connection_in, buf, sizeof(buf));
-		if (len == 0) {
-			log("Connection closed by %.200s", get_remote_ipaddr());
-			fatal_cleanup();
-		}
-		if (len < 0)
-			fatal("Read from socket failed: %.100s", strerror(errno));
-		/* Append it to the buffer. */
-		packet_process_incoming(buf, len);
-	}
-	/* NOTREACHED */
-}
-
-int
-packet_read(void)
-{
-	return packet_read_seqnr(NULL);
-}
-
-/*
- * Waits until a packet has been received, verifies that its type matches
- * that given, and gives a fatal error and exits if there is a mismatch.
- */
-
-void
-packet_read_expect(int expected_type)
-{
-	int type;
-
-	type = packet_read();
-	if (type != expected_type)
-		packet_disconnect("Protocol error: expected packet type %d, got %d",
-		    expected_type, type);
-}
-
-/* Checks if a full packet is available in the data received so far via
- * packet_process_incoming.  If so, reads the packet; otherwise returns
- * SSH_MSG_NONE.  This does not wait for data from the connection.
- *
- * SSH_MSG_DISCONNECT is handled specially here.  Also,
- * SSH_MSG_IGNORE messages are skipped by this function and are never returned
- * to higher levels.
- */
-
-static int
-packet_read_poll1(void)
-{
-	u_int len, padded_len;
-	u_char *cp, type;
-	u_int checksum, stored_checksum;
-
-	/* Check if input size is less than minimum packet size. */
-	if (buffer_len(&input) < 4 + 8)
-		return SSH_MSG_NONE;
-	/* Get length of incoming packet. */
-	cp = buffer_ptr(&input);
-	len = GET_32BIT(cp);
-	if (len < 1 + 2 + 2 || len > 256 * 1024)
-		packet_disconnect("Bad packet length %u.", len);
-	padded_len = (len + 8) & ~7;
-
-	/* Check if the packet has been entirely received. */
-	if (buffer_len(&input) < 4 + padded_len)
-		return SSH_MSG_NONE;
-
-	/* The entire packet is in buffer. */
-
-	/* Consume packet length. */
-	buffer_consume(&input, 4);
-
-	/*
-	 * Cryptographic attack detector for ssh
-	 * (C)1998 CORE-SDI, Buenos Aires Argentina
-	 * Ariel Futoransky(futo@core-sdi.com)
-	 */
-	if (!receive_context.plaintext &&
-	    detect_attack(buffer_ptr(&input), padded_len, NULL) == DEATTACK_DETECTED)
-		packet_disconnect("crc32 compensation attack: network attack detected");
-
-	/* Decrypt data to incoming_packet. */
-	buffer_clear(&incoming_packet);
-	cp = buffer_append_space(&incoming_packet, padded_len);
-	cipher_crypt(&receive_context, cp, buffer_ptr(&input), padded_len);
-
-	buffer_consume(&input, padded_len);
-
-#ifdef PACKET_DEBUG
-	fprintf(stderr, "read_poll plain: ");
-	buffer_dump(&incoming_packet);
-#endif
-
-	/* Compute packet checksum. */
-	checksum = ssh_crc32(buffer_ptr(&incoming_packet),
-	    buffer_len(&incoming_packet) - 4);
-
-	/* Skip padding. */
-	buffer_consume(&incoming_packet, 8 - len % 8);
-
-	/* Test check bytes. */
-	if (len != buffer_len(&incoming_packet))
-		packet_disconnect("packet_read_poll1: len %d != buffer_len %d.",
-		    len, buffer_len(&incoming_packet));
-
-	cp = (u_char *)buffer_ptr(&incoming_packet) + len - 4;
-	stored_checksum = GET_32BIT(cp);
-	if (checksum != stored_checksum)
-		packet_disconnect("Corrupted check bytes on input.");
-	buffer_consume_end(&incoming_packet, 4);
-
-	if (packet_compression) {
-		buffer_clear(&compression_buffer);
-		buffer_uncompress(&incoming_packet, &compression_buffer);
-		buffer_clear(&incoming_packet);
-		buffer_append(&incoming_packet, buffer_ptr(&compression_buffer),
-		    buffer_len(&compression_buffer));
-	}
-	type = buffer_get_char(&incoming_packet);
-	return type;
-}
-
-static int
-packet_read_poll2(u_int32_t *seqnr_p)
-{
-	static u_int packet_length = 0;
-	u_int padlen, need;
-	u_char *macbuf, *cp, type;
-	int maclen, block_size;
-	Enc *enc   = NULL;
-	Mac *mac   = NULL;
-	Comp *comp = NULL;
-
-	if (newkeys[MODE_IN] != NULL) {
-		enc  = &newkeys[MODE_IN]->enc;
-		mac  = &newkeys[MODE_IN]->mac;
-		comp = &newkeys[MODE_IN]->comp;
-	}
-	maclen = mac && mac->enabled ? mac->mac_len : 0;
-	block_size = enc ? enc->block_size : 8;
-
-	if (packet_length == 0) {
-		/*
-		 * check if input size is less than the cipher block size,
-		 * decrypt first block and extract length of incoming packet
-		 */
-		if (buffer_len(&input) < block_size)
-			return SSH_MSG_NONE;
-		buffer_clear(&incoming_packet);
-		cp = buffer_append_space(&incoming_packet, block_size);
-		cipher_crypt(&receive_context, cp, buffer_ptr(&input),
-		    block_size);
-		cp = buffer_ptr(&incoming_packet);
-		packet_length = GET_32BIT(cp);
-		if (packet_length < 1 + 4 || packet_length > 256 * 1024) {
-			buffer_dump(&incoming_packet);
-			packet_disconnect("Bad packet length %u.", packet_length);
-		}
-		DBG(debug("input: packet len %u", packet_length+4));
-		buffer_consume(&input, block_size);
-	}
-	/* we have a partial packet of block_size bytes */
-	need = 4 + packet_length - block_size;
-	DBG(debug("partial packet %d, need %d, maclen %d", block_size,
-	    need, maclen));
-	if (need % block_size != 0)
-		fatal("padding error: need %d block %d mod %d",
-		    need, block_size, need % block_size);
-	/*
-	 * check if the entire packet has been received and
-	 * decrypt into incoming_packet
-	 */
-	if (buffer_len(&input) < need + maclen)
-		return SSH_MSG_NONE;
-#ifdef PACKET_DEBUG
-	fprintf(stderr, "read_poll enc/full: ");
-	buffer_dump(&input);
-#endif
-	cp = buffer_append_space(&incoming_packet, need);
-	cipher_crypt(&receive_context, cp, buffer_ptr(&input), need);
-	buffer_consume(&input, need);
-	/*
-	 * compute MAC over seqnr and packet,
-	 * increment sequence number for incoming packet
-	 */
-	if (mac && mac->enabled) {
-		macbuf = mac_compute(mac, read_seqnr,
-		    buffer_ptr(&incoming_packet),
-		    buffer_len(&incoming_packet));
-		if (memcmp(macbuf, buffer_ptr(&input), mac->mac_len) != 0)
-			packet_disconnect("Corrupted MAC on input.");
-		DBG(debug("MAC #%d ok", read_seqnr));
-		buffer_consume(&input, mac->mac_len);
-	}
-	if (seqnr_p != NULL)
-		*seqnr_p = read_seqnr;
-	if (++read_seqnr == 0)
-		log("incoming seqnr wraps around");
-
-	/* get padlen */
-	cp = buffer_ptr(&incoming_packet);
-	padlen = cp[4];
-	DBG(debug("input: padlen %d", padlen));
-	if (padlen < 4)
-		packet_disconnect("Corrupted padlen %d on input.", padlen);
-
-	/* skip packet size + padlen, discard padding */
-	buffer_consume(&incoming_packet, 4 + 1);
-	buffer_consume_end(&incoming_packet, padlen);
-
-	DBG(debug("input: len before de-compress %d", buffer_len(&incoming_packet)));
-	if (comp && comp->enabled) {
-		buffer_clear(&compression_buffer);
-		buffer_uncompress(&incoming_packet, &compression_buffer);
-		buffer_clear(&incoming_packet);
-		buffer_append(&incoming_packet, buffer_ptr(&compression_buffer),
-		    buffer_len(&compression_buffer));
-		DBG(debug("input: len after de-compress %d",
-		    buffer_len(&incoming_packet)));
-	}
-	/*
-	 * get packet type, implies consume.
-	 * return length of payload (without type field)
-	 */
-	type = buffer_get_char(&incoming_packet);
-	if (type == SSH2_MSG_NEWKEYS)
-		set_newkeys(MODE_IN);
-#ifdef PACKET_DEBUG
-	fprintf(stderr, "read/plain[%d]:\r\n", type);
-	buffer_dump(&incoming_packet);
-#endif
-	/* reset for next packet */
-	packet_length = 0;
-	return type;
-}
-
-int
-packet_read_poll_seqnr(u_int32_t *seqnr_p)
-{
-	u_int reason, seqnr;
-	u_char type;
-	char *msg;
-
-	for (;;) {
-		if (compat20) {
-			type = packet_read_poll2(seqnr_p);
-			if (type)
-				DBG(debug("received packet type %d", type));
-			switch (type) {
-			case SSH2_MSG_IGNORE:
-				break;
-			case SSH2_MSG_DEBUG:
-				packet_get_char();
-				msg = packet_get_string(NULL);
-				debug("Remote: %.900s", msg);
-				xfree(msg);
-				msg = packet_get_string(NULL);
-				xfree(msg);
-				break;
-			case SSH2_MSG_DISCONNECT:
-				reason = packet_get_int();
-				msg = packet_get_string(NULL);
-				log("Received disconnect from %s: %u: %.400s",
-				    get_remote_ipaddr(), reason, msg);
-				xfree(msg);
-				fatal_cleanup();
-				break;
-			case SSH2_MSG_UNIMPLEMENTED:
-				seqnr = packet_get_int();
-				debug("Received SSH2_MSG_UNIMPLEMENTED for %u",
-				    seqnr);
-				break;
-			default:
-				return type;
-				break;
-			}
-		} else {
-			type = packet_read_poll1();
-			switch (type) {
-			case SSH_MSG_IGNORE:
-				break;
-			case SSH_MSG_DEBUG:
-				msg = packet_get_string(NULL);
-				debug("Remote: %.900s", msg);
-				xfree(msg);
-				break;
-			case SSH_MSG_DISCONNECT:
-				msg = packet_get_string(NULL);
-				log("Received disconnect from %s: %.400s",
-				    get_remote_ipaddr(), msg);
-				fatal_cleanup();
-				xfree(msg);
-				break;
-			default:
-				if (type)
-					DBG(debug("received packet type %d", type));
-				return type;
-				break;
-			}
-		}
-	}
-}
-
-int
-packet_read_poll(void)
-{
-	return packet_read_poll_seqnr(NULL);
-}
-
-/*
- * Buffers the given amount of input characters.  This is intended to be used
- * together with packet_read_poll.
- */
-
-void
-packet_process_incoming(const char *buf, u_int len)
-{
-	buffer_append(&input, buf, len);
-}
-
-/* Returns a character from the packet. */
-
-u_int
-packet_get_char(void)
-{
-	char ch;
-
-	buffer_get(&incoming_packet, &ch, 1);
-	return (u_char) ch;
-}
-
-/* Returns an integer from the packet data. */
-
-u_int
-packet_get_int(void)
-{
-	return buffer_get_int(&incoming_packet);
-}
-
-/*
- * Returns an arbitrary precision integer from the packet data.  The integer
- * must have been initialized before this call.
- */
-
-void
-packet_get_bignum(BIGNUM * value)
-{
-	buffer_get_bignum(&incoming_packet, value);
-}
-
-void
-packet_get_bignum2(BIGNUM * value)
-{
-	buffer_get_bignum2(&incoming_packet, value);
-}
-
-void *
-packet_get_raw(int *length_ptr)
-{
-	int bytes = buffer_len(&incoming_packet);
-
-	if (length_ptr != NULL)
-		*length_ptr = bytes;
-	return buffer_ptr(&incoming_packet);
-}
-
-int
-packet_remaining(void)
-{
-	return buffer_len(&incoming_packet);
-}
-
-/*
- * Returns a string from the packet data.  The string is allocated using
- * xmalloc; it is the responsibility of the calling program to free it when
- * no longer needed.  The length_ptr argument may be NULL, or point to an
- * integer into which the length of the string is stored.
- */
-
-void *
-packet_get_string(u_int *length_ptr)
-{
-	return buffer_get_string(&incoming_packet, length_ptr);
-}
-
-/*
- * Sends a diagnostic message from the server to the client.  This message
- * can be sent at any time (but not while constructing another message). The
- * message is printed immediately, but only if the client is being executed
- * in verbose mode.  These messages are primarily intended to ease debugging
- * authentication problems.   The length of the formatted message must not
- * exceed 1024 bytes.  This will automatically call packet_write_wait.
- */
-
-void
-packet_send_debug(const char *fmt,...)
-{
-	char buf[1024];
-	va_list args;
-
-	if (compat20 && (datafellows & SSH_BUG_DEBUG))
-		return;
-
-	va_start(args, fmt);
-	vsnprintf(buf, sizeof(buf), fmt, args);
-	va_end(args);
-
-	if (compat20) {
-		packet_start(SSH2_MSG_DEBUG);
-		packet_put_char(0);	/* bool: always display */
-		packet_put_cstring(buf);
-		packet_put_cstring("");
-	} else {
-		packet_start(SSH_MSG_DEBUG);
-		packet_put_cstring(buf);
-	}
-	packet_send();
-	packet_write_wait();
-}
-
-/*
- * Logs the error plus constructs and sends a disconnect packet, closes the
- * connection, and exits.  This function never returns. The error message
- * should not contain a newline.  The length of the formatted message must
- * not exceed 1024 bytes.
- */
-
-void
-packet_disconnect(const char *fmt,...)
-{
-	char buf[1024];
-	va_list args;
-	static int disconnecting = 0;
-
-	if (disconnecting)	/* Guard against recursive invocations. */
-		fatal("packet_disconnect called recursively.");
-	disconnecting = 1;
-
-	/*
-	 * Format the message.  Note that the caller must make sure the
-	 * message is of limited size.
-	 */
-	va_start(args, fmt);
-	vsnprintf(buf, sizeof(buf), fmt, args);
-	va_end(args);
-
-	/* Display the error locally */
-	log("Disconnecting: %.100s", buf);
-
-	/* Send the disconnect message to the other side, and wait for it to get sent. */
-	if (compat20) {
-		packet_start(SSH2_MSG_DISCONNECT);
-		packet_put_int(SSH2_DISCONNECT_PROTOCOL_ERROR);
-		packet_put_cstring(buf);
-		packet_put_cstring("");
-	} else {
-		packet_start(SSH_MSG_DISCONNECT);
-		packet_put_cstring(buf);
-	}
-	packet_send();
-	packet_write_wait();
-
-	/* Stop listening for connections. */
-	channel_close_all();
-
-	/* Close the connection. */
-	packet_close();
-
-	fatal_cleanup();
-}
-
-/* Checks if there is any buffered output, and tries to write some of the output. */
-
-void
-packet_write_poll(void)
-{
-	int len = buffer_len(&output);
-
-	if (len > 0) {
-		len = write(connection_out, buffer_ptr(&output), len);
-		if (len <= 0) {
-			if (errno == EAGAIN)
-				return;
-			else
-				fatal("Write failed: %.100s", strerror(errno));
-		}
-		buffer_consume(&output, len);
-	}
-}
-
-/*
- * Calls packet_write_poll repeatedly until all pending output data has been
- * written.
- */
-
-void
-packet_write_wait(void)
-{
-	fd_set *setp;
-
-	setp = (fd_set *)xmalloc(howmany(connection_out + 1, NFDBITS) *
-	    sizeof(fd_mask));
-	packet_write_poll();
-	while (packet_have_data_to_write()) {
-		memset(setp, 0, howmany(connection_out + 1, NFDBITS) *
-		    sizeof(fd_mask));
-		FD_SET(connection_out, setp);
-		while (select(connection_out + 1, NULL, setp, NULL, NULL) == -1 &&
-		    (errno == EAGAIN || errno == EINTR))
-			;
-		packet_write_poll();
-	}
-	xfree(setp);
-}
-
-/* Returns true if there is buffered data to write to the connection. */
-
-int
-packet_have_data_to_write(void)
-{
-	return buffer_len(&output) != 0;
-}
-
-/* Returns true if there is not too much data to write to the connection. */
-
-int
-packet_not_very_much_data_to_write(void)
-{
-	if (interactive_mode)
-		return buffer_len(&output) < 16384;
-	else
-		return buffer_len(&output) < 128 * 1024;
-}
-
-static void
-packet_set_tos(int interactive)
-{
-	int tos = interactive ? IPTOS_LOWDELAY : IPTOS_THROUGHPUT;
-
-	if (!packet_connection_is_on_socket() ||
-	    !packet_connection_is_ipv4())
-		return;
-	if (setsockopt(connection_in, IPPROTO_IP, IP_TOS, &tos,
-	    sizeof(tos)) < 0)
-		error("setsockopt IP_TOS %d: %.100s:",
-		    tos, strerror(errno));
-}
-
-/* Informs that the current session is interactive.  Sets IP flags for that. */
-
-void
-packet_set_interactive(int interactive)
-{
-	static int called = 0;
-
-	if (called)
-		return;
-	called = 1;
-
-	/* Record that we are in interactive mode. */
-	interactive_mode = interactive;
-
-	/* Only set socket options if using a socket.  */
-	if (!packet_connection_is_on_socket())
-		return;
-	if (interactive)
-		set_nodelay(connection_in);
-#if defined(IP_TOS) && !defined(IP_TOS_IS_BROKEN)
-	packet_set_tos(interactive);
-#endif
-
-}
-
-/* Returns true if the current connection is interactive. */
-
-int
-packet_is_interactive(void)
-{
-	return interactive_mode;
-}
-
-int
-packet_set_maxsize(int s)
-{
-	static int called = 0;
-
-	if (called) {
-		log("packet_set_maxsize: called twice: old %d new %d",
-		    max_packet_size, s);
-		return -1;
-	}
-	if (s < 4 * 1024 || s > 1024 * 1024) {
-		log("packet_set_maxsize: bad size %d", s);
-		return -1;
-	}
-	called = 1;
-	debug("packet_set_maxsize: setting to %d", s);
-	max_packet_size = s;
-	return s;
-}
-
-/* roundup current message to pad bytes */
-void
-packet_add_padding(u_char pad)
-{
-	extra_pad = pad;
-}
-
-/*
- * 9.2.  Ignored Data Message
- *
- *   byte      SSH_MSG_IGNORE
- *   string    data
- *
- * All implementations MUST understand (and ignore) this message at any
- * time (after receiving the protocol version). No implementation is
- * required to send them. This message can be used as an additional
- * protection measure against advanced traffic analysis techniques.
- */
-void
-packet_send_ignore(int nbytes)
-{
-	u_int32_t rand = 0;
-	int i;
-
-	packet_start(compat20 ? SSH2_MSG_IGNORE : SSH_MSG_IGNORE);
-	packet_put_int(nbytes);
-	for (i = 0; i < nbytes; i++) {
-		if (i % 4 == 0)
-			rand = arc4random();
-		packet_put_char(rand & 0xff);
-		rand >>= 8;
-	}
-}
diff --git a/crypto/openssh/packet.h b/crypto/openssh/packet.h
deleted file mode 100644
index 46830c3df912..000000000000
--- a/crypto/openssh/packet.h
+++ /dev/null
@@ -1,99 +0,0 @@
-/*	$OpenBSD: packet.h,v 1.37 2003/04/01 10:22:21 markus Exp $	*/
-
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * Interface for the packet protocol functions.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#ifndef PACKET_H
-#define PACKET_H
-
-#include <openssl/bn.h>
-
-void     packet_set_connection(int, int);
-void     packet_set_nonblocking(void);
-int      packet_get_connection_in(void);
-int      packet_get_connection_out(void);
-void     packet_close(void);
-void	 packet_set_encryption_key(const u_char *, u_int, int);
-u_int	 packet_get_encryption_key(u_char *);
-void     packet_set_protocol_flags(u_int);
-u_int	 packet_get_protocol_flags(void);
-void     packet_start_compression(int);
-void     packet_set_interactive(int);
-int      packet_is_interactive(void);
-
-void     packet_start(u_char);
-void     packet_put_char(int ch);
-void     packet_put_int(u_int value);
-void     packet_put_bignum(BIGNUM * value);
-void     packet_put_bignum2(BIGNUM * value);
-void     packet_put_string(const void *buf, u_int len);
-void     packet_put_cstring(const char *str);
-void     packet_put_raw(const void *buf, u_int len);
-void     packet_send(void);
-
-int      packet_read(void);
-void     packet_read_expect(int type);
-int      packet_read_poll(void);
-void     packet_process_incoming(const char *buf, u_int len);
-int      packet_read_seqnr(u_int32_t *seqnr_p);
-int      packet_read_poll_seqnr(u_int32_t *seqnr_p);
-
-u_int	 packet_get_char(void);
-u_int	 packet_get_int(void);
-void     packet_get_bignum(BIGNUM * value);
-void     packet_get_bignum2(BIGNUM * value);
-void	*packet_get_raw(int *length_ptr);
-void	*packet_get_string(u_int *length_ptr);
-void     packet_disconnect(const char *fmt,...) __attribute__((format(printf, 1, 2)));
-void     packet_send_debug(const char *fmt,...) __attribute__((format(printf, 1, 2)));
-
-void	 set_newkeys(int mode);
-int	 packet_get_keyiv_len(int);
-void	 packet_get_keyiv(int, u_char *, u_int);
-int	 packet_get_keycontext(int, u_char *);
-void	 packet_set_keycontext(int, u_char *);
-u_int32_t packet_get_seqnr(int);
-void	 packet_set_seqnr(int, u_int32_t);
-int	 packet_get_ssh1_cipher(void);
-void	 packet_set_iv(int, u_char *);
-
-void     packet_write_poll(void);
-void     packet_write_wait(void);
-int      packet_have_data_to_write(void);
-int      packet_not_very_much_data_to_write(void);
-
-int	 packet_connection_is_on_socket(void);
-int	 packet_connection_is_ipv4(void);
-int	 packet_remaining(void);
-void	 packet_send_ignore(int);
-void	 packet_add_padding(u_char);
-
-void	 tty_make_modes(int, struct termios *);
-void	 tty_parse_modes(int, int *);
-
-extern int max_packet_size;
-int      packet_set_maxsize(int);
-#define  packet_get_maxsize() max_packet_size
-
-/* don't allow remaining bytes after the end of the message */
-#define packet_check_eom() \
-do { \
-	int _len = packet_remaining(); \
-	if (_len > 0) { \
-		log("Packet integrity error (%d bytes remaining) at %s:%d", \
-		    _len ,__FILE__, __LINE__); \
-		packet_disconnect("Packet integrity error."); \
-	} \
-} while (0)
-
-#endif				/* PACKET_H */
diff --git a/crypto/openssh/pathnames.h b/crypto/openssh/pathnames.h
deleted file mode 100644
index 89e22c77abe1..000000000000
--- a/crypto/openssh/pathnames.h
+++ /dev/null
@@ -1,169 +0,0 @@
-/*	$OpenBSD: pathnames.h,v 1.13 2002/05/23 19:24:30 markus Exp $	*/
-
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#define ETCDIR				"/etc"
-
-#ifndef SSHDIR
-#define SSHDIR				ETCDIR "/ssh"
-#endif
-
-#ifndef _PATH_SSH_PIDDIR
-#define _PATH_SSH_PIDDIR		"/var/run"
-#endif
-
-/*
- * System-wide file containing host keys of known hosts.  This file should be
- * world-readable.
- */
-#define _PATH_SSH_SYSTEM_HOSTFILE	SSHDIR "/ssh_known_hosts"
-/* backward compat for protocol 2 */
-#define _PATH_SSH_SYSTEM_HOSTFILE2	SSHDIR "/ssh_known_hosts2"
-
-/*
- * Of these, ssh_host_key must be readable only by root, whereas ssh_config
- * should be world-readable.
- */
-#define _PATH_SERVER_CONFIG_FILE	SSHDIR "/sshd_config"
-#define _PATH_HOST_CONFIG_FILE		SSHDIR "/ssh_config"
-#define _PATH_HOST_KEY_FILE		SSHDIR "/ssh_host_key"
-#define _PATH_HOST_DSA_KEY_FILE		SSHDIR "/ssh_host_dsa_key"
-#define _PATH_HOST_RSA_KEY_FILE		SSHDIR "/ssh_host_rsa_key"
-#define _PATH_DH_MODULI			SSHDIR "/moduli"
-/* Backwards compatibility */
-#define _PATH_DH_PRIMES			SSHDIR "/primes"
-
-#ifndef _PATH_SSH_PROGRAM
-#define _PATH_SSH_PROGRAM		"/usr/bin/ssh"
-#endif
-
-/*
- * The process id of the daemon listening for connections is saved here to
- * make it easier to kill the correct daemon when necessary.
- */
-#define _PATH_SSH_DAEMON_PID_FILE	_PATH_SSH_PIDDIR "/sshd.pid"
-
-/*
- * The directory in user\'s home directory in which the files reside. The
- * directory should be world-readable (though not all files are).
- */
-#define _PATH_SSH_USER_DIR		".ssh"
-
-/*
- * Per-user file containing host keys of known hosts.  This file need not be
- * readable by anyone except the user him/herself, though this does not
- * contain anything particularly secret.
- */
-#define _PATH_SSH_USER_HOSTFILE		"~/.ssh/known_hosts"
-/* backward compat for protocol 2 */
-#define _PATH_SSH_USER_HOSTFILE2	"~/.ssh/known_hosts2"
-
-/*
- * Name of the default file containing client-side authentication key. This
- * file should only be readable by the user him/herself.
- */
-#define _PATH_SSH_CLIENT_IDENTITY	".ssh/identity"
-#define _PATH_SSH_CLIENT_ID_DSA		".ssh/id_dsa"
-#define _PATH_SSH_CLIENT_ID_RSA		".ssh/id_rsa"
-
-/*
- * Configuration file in user\'s home directory.  This file need not be
- * readable by anyone but the user him/herself, but does not contain anything
- * particularly secret.  If the user\'s home directory resides on an NFS
- * volume where root is mapped to nobody, this may need to be world-readable.
- */
-#define _PATH_SSH_USER_CONFFILE		".ssh/config"
-
-/*
- * File containing a list of those rsa keys that permit logging in as this
- * user.  This file need not be readable by anyone but the user him/herself,
- * but does not contain anything particularly secret.  If the user\'s home
- * directory resides on an NFS volume where root is mapped to nobody, this
- * may need to be world-readable.  (This file is read by the daemon which is
- * running as root.)
- */
-#define _PATH_SSH_USER_PERMITTED_KEYS	".ssh/authorized_keys"
-
-/* backward compat for protocol v2 */
-#define _PATH_SSH_USER_PERMITTED_KEYS2	".ssh/authorized_keys2"
-
-/*
- * Per-user and system-wide ssh "rc" files.  These files are executed with
- * /bin/sh before starting the shell or command if they exist.  They will be
- * passed "proto cookie" as arguments if X11 forwarding with spoofing is in
- * use.  xauth will be run if neither of these exists.
- */
-#define _PATH_SSH_USER_RC		".ssh/rc"
-#define _PATH_SSH_SYSTEM_RC		SSHDIR "/sshrc"
-
-/*
- * Ssh-only version of /etc/hosts.equiv.  Additionally, the daemon may use
- * ~/.rhosts and /etc/hosts.equiv if rhosts authentication is enabled.
- */
-#define _PATH_SSH_HOSTS_EQUIV		SSHDIR "/shosts.equiv"
-#define _PATH_RHOSTS_EQUIV		"/etc/hosts.equiv"
-
-/*
- * Default location of askpass
- */
-#ifndef _PATH_SSH_ASKPASS_DEFAULT
-#define _PATH_SSH_ASKPASS_DEFAULT	"/usr/X11R6/bin/ssh-askpass"
-#endif
-
-/* Location of ssh-keysign for hostbased authentication */
-#ifndef _PATH_SSH_KEY_SIGN
-#define _PATH_SSH_KEY_SIGN            "/usr/libexec/ssh-keysign"
-#endif
-
-/* xauth for X11 forwarding */
-#ifndef _PATH_XAUTH
-#define _PATH_XAUTH			"/usr/X11R6/bin/xauth"
-#endif
-
-/* UNIX domain socket for X11 server; displaynum will replace %u */
-#ifndef _PATH_UNIX_X
-#define _PATH_UNIX_X "/tmp/.X11-unix/X%u"
-#endif
-
-/* for scp */
-#ifndef _PATH_CP
-#define _PATH_CP			"cp"
-#endif
-
-/* for sftp */
-#ifndef _PATH_SFTP_SERVER
-#define _PATH_SFTP_SERVER		"/usr/libexec/sftp-server"
-#endif
-
-/* chroot directory for unprivileged user when UsePrivilegeSeparation=yes */
-#ifndef _PATH_PRIVSEP_CHROOT_DIR
-#define _PATH_PRIVSEP_CHROOT_DIR	"/var/empty"
-#endif
-
-#ifndef _PATH_LS
-#define _PATH_LS			"ls"
-#endif
-
-/* path to login program */
-#ifndef LOGIN_PROGRAM
-# ifdef LOGIN_PROGRAM_FALLBACK
-#  define LOGIN_PROGRAM         LOGIN_PROGRAM_FALLBACK
-# else
-#  define LOGIN_PROGRAM         "/usr/bin/login"
-# endif
-#endif /* LOGIN_PROGRAM */
-
-/* Askpass program define */
-#ifndef ASKPASS_PROGRAM
-#define ASKPASS_PROGRAM         "/usr/lib/ssh/ssh-askpass"
-#endif /* ASKPASS_PROGRAM */
diff --git a/crypto/openssh/progressmeter.c b/crypto/openssh/progressmeter.c
deleted file mode 100644
index 90eb97f375f3..000000000000
--- a/crypto/openssh/progressmeter.c
+++ /dev/null
@@ -1,282 +0,0 @@
-/*
- * Copyright (c) 1999 Theo de Raadt.  All rights reserved.
- * Copyright (c) 1999 Aaron Campbell.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/*
- * Parts from:
- *
- * Copyright (c) 1983, 1990, 1992, 1993, 1995
- *	The Regents of the University of California.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *	This product includes software developed by the University of
- *	California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: progressmeter.c,v 1.3 2003/03/17 10:38:38 markus Exp $");
-
-#ifdef HAVE_LIBGEN_H
-#include <libgen.h>
-#endif
-
-#include "atomicio.h"
-#include "progressmeter.h"
-
-/* Number of seconds before xfer considered "stalled". */
-#define STALLTIME	5
-/* alarm() interval for updating progress meter. */
-#define PROGRESSTIME	1
-
-/* Signal handler used for updating the progress meter. */
-static void update_progress_meter(int);
-
-/* Returns non-zero if we are the foreground process. */
-static int foregroundproc(void);
-
-/* Returns width of the terminal (for progress meter calculations). */
-static int get_tty_width(void);
-
-/* Visual statistics about files as they are transferred. */
-static void draw_progress_meter(void);
-
-/* Time a transfer started. */
-static struct timeval start;
-
-/* Number of bytes of current file transferred so far. */
-static volatile off_t *statbytes;
-
-/* Total size of current file. */
-static off_t totalbytes;
-
-/* Name of current file being transferred. */
-static char *curfile;
-
-/* Time of last update. */
-static struct timeval lastupdate;
-
-/* Size at the time of the last update. */
-static off_t lastsize;
-
-void
-start_progress_meter(char *file, off_t filesize, off_t *counter)
-{
-	if ((curfile = basename(file)) == NULL)
-		curfile = file;
-
-	totalbytes = filesize;
-	statbytes = counter;
-	(void) gettimeofday(&start, (struct timezone *) 0);
-	lastupdate = start;
-	lastsize = 0;
-
-	draw_progress_meter();
-	signal(SIGALRM, update_progress_meter);
-	alarm(PROGRESSTIME);
-}
-
-void
-stop_progress_meter()
-{
-	alarm(0);
-	draw_progress_meter();
-	if (foregroundproc() != 0)
-		atomicio(write, fileno(stdout), "\n", 1);
-}
-
-static void
-update_progress_meter(int ignore)
-{
-	int save_errno = errno;
-
-	draw_progress_meter();
-	signal(SIGALRM, update_progress_meter);
-	alarm(PROGRESSTIME);
-	errno = save_errno;
-}
-
-static int
-foregroundproc(void)
-{
-	static pid_t pgrp = -1;
-	int ctty_pgrp;
-
-	if (pgrp == -1)
-		pgrp = getpgrp();
-
-#ifdef HAVE_TCGETPGRP
-        return ((ctty_pgrp = tcgetpgrp(STDOUT_FILENO)) != -1 &&
-	                ctty_pgrp == pgrp);
-#else
-	return ((ioctl(STDOUT_FILENO, TIOCGPGRP, &ctty_pgrp) != -1 &&
-		 ctty_pgrp == pgrp));
-#endif
-}
-
-static void
-draw_progress_meter()
-{
-	static const char spaces[] = "                          "
-	    "                                                   "
-	    "                                                   "
-	    "                                                   "
-	    "                                                   "
-	    "                                                   ";
-	static const char prefixes[] = " KMGTP";
-	struct timeval now, td, wait;
-	off_t cursize, abbrevsize, bytespersec;
-	double elapsed;
-	int ratio, remaining, i, ai, bi, nspaces;
-	char buf[512];
-
-	if (foregroundproc() == 0)
-		return;
-
-	(void) gettimeofday(&now, (struct timezone *) 0);
-	cursize = *statbytes;
-	if (totalbytes != 0) {
-		ratio = 100.0 * cursize / totalbytes;
-		ratio = MAX(ratio, 0);
-		ratio = MIN(ratio, 100);
-	} else
-		ratio = 100;
-
-	abbrevsize = cursize;
-	for (ai = 0; abbrevsize >= 10000 && ai < sizeof(prefixes); ai++)
-		abbrevsize >>= 10;
-
-	timersub(&now, &lastupdate, &wait);
-	if (cursize > lastsize) {
-		lastupdate = now;
-		lastsize = cursize;
-		wait.tv_sec = 0;
-	}
-	timersub(&now, &start, &td);
-	elapsed = td.tv_sec + (td.tv_usec / 1000000.0);
-
-	bytespersec = 0;
-	if (cursize > 0) {
-		bytespersec = cursize;
-		if (elapsed > 0.0)
-			bytespersec /= elapsed;
-	}
-	for (bi = 1; bytespersec >= 1024000 && bi < sizeof(prefixes); bi++)
-		bytespersec >>= 10;
-
-    	nspaces = MIN(get_tty_width() - 79, sizeof(spaces) - 1);
-
-#ifdef HAVE_LONG_LONG_INT
-	snprintf(buf, sizeof(buf),
-	    "\r%-45.45s%.*s%3d%% %4lld%c%c %3lld.%01d%cB/s",
-	    curfile,
-	    nspaces,
-	    spaces,
-	    ratio,
-	    (long long)abbrevsize,
-	    prefixes[ai],
-	    ai == 0 ? ' ' : 'B',
-	    (long long)(bytespersec / 1024),
-	    (int)((bytespersec % 1024) * 10 / 1024),
-	    prefixes[bi]
-	);
-#else
-		/* XXX: Handle integer overflow? */
-	snprintf(buf, sizeof(buf),
-	    "\r%-45.45s%.*s%3d%% %4lu%c%c %3lu.%01d%cB/s",
-	    curfile,
-	    nspaces,
-	    spaces,
-	    ratio,
-	    (u_long)abbrevsize,
-	    prefixes[ai],
-	    ai == 0 ? ' ' : 'B',
-	    (u_long)(bytespersec / 1024),
-	    (int)((bytespersec % 1024) * 10 / 1024),
-	    prefixes[bi]
-	);
-#endif
-
-	if (cursize <= 0 || elapsed <= 0.0 || cursize > totalbytes) {
-		snprintf(buf + strlen(buf), sizeof(buf) - strlen(buf),
-		    "   --:-- ETA");
-	} else if (wait.tv_sec >= STALLTIME) {
-		snprintf(buf + strlen(buf), sizeof(buf) - strlen(buf),
-		    " - stalled -");
-	} else {
-		if (cursize != totalbytes)
-			remaining = (int)(totalbytes / (cursize / elapsed) -
-			    elapsed);
-		else
-			remaining = elapsed;
-
-		i = remaining / 3600;
-		if (i)
-			snprintf(buf + strlen(buf), sizeof(buf) - strlen(buf),
-			    "%2d:", i);
-		else
-			snprintf(buf + strlen(buf), sizeof(buf) - strlen(buf),
-			    "   ");
-		i = remaining % 3600;
-		snprintf(buf + strlen(buf), sizeof(buf) - strlen(buf),
-		    "%02d:%02d%s", i / 60, i % 60,
-		    (cursize != totalbytes) ? " ETA" : "    ");
-	}
-	atomicio(write, fileno(stdout), buf, strlen(buf));
-}
-
-static int
-get_tty_width(void)
-{
-	struct winsize winsize;
-
-	if (ioctl(fileno(stdout), TIOCGWINSZ, &winsize) != -1)
-		return (winsize.ws_col ? winsize.ws_col : 80);
-	else
-		return (80);
-}
diff --git a/crypto/openssh/progressmeter.h b/crypto/openssh/progressmeter.h
deleted file mode 100644
index bfb9a0b770fd..000000000000
--- a/crypto/openssh/progressmeter.h
+++ /dev/null
@@ -1,27 +0,0 @@
-/*	$OpenBSD: progressmeter.h,v 1.1 2003/01/10 08:19:07 fgsch Exp $	*/
-/*
- * Copyright (c) 2002 Nils Nordman.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-void	start_progress_meter(char *, off_t, off_t *);
-void	stop_progress_meter(void);
diff --git a/crypto/openssh/pty.c b/crypto/openssh/pty.c
deleted file mode 100644
index 9300bd530415..000000000000
--- a/crypto/openssh/pty.c
+++ /dev/null
@@ -1,275 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * Allocating a pseudo-terminal, and making it the controlling tty.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: pty.c,v 1.16 2000/09/07 21:13:37 markus Exp $");
-
-#include <util.h>
-#include "pty.h"
-#include "ssh.h"
-
-/* Pty allocated with _getpty gets broken if we do I_PUSH:es to it. */
-#if defined(HAVE__GETPTY) || defined(HAVE_OPENPTY)
-#undef HAVE_DEV_PTMX
-#endif
-
-#ifndef O_NOCTTY
-#define O_NOCTTY 0
-#endif
-
-/*
- * Allocates and opens a pty.  Returns 0 if no pty could be allocated, or
- * nonzero if a pty was successfully allocated.  On success, open file
- * descriptors for the pty and tty sides and the name of the tty side are
- * returned (the buffer must be able to hold at least 64 characters).
- */
-
-int
-pty_allocate(int *ptyfd, int *ttyfd, char *namebuf, int namebuflen)
-{
-#if defined(HAVE_OPENPTY) || defined(BSD4_4)
-	/* openpty(3) exists in OSF/1 and some other os'es */
-	char buf[64];
-	int i;
-
-	i = openpty(ptyfd, ttyfd, buf, NULL, NULL);
-	if (i < 0) {
-		error("openpty: %.100s", strerror(errno));
-		return 0;
-	}
-	strlcpy(namebuf, buf, namebuflen);	/* possible truncation */
-	return 1;
-#else /* HAVE_OPENPTY */
-#ifdef HAVE__GETPTY
-	/*
-	 * _getpty(3) exists in SGI Irix 4.x, 5.x & 6.x -- it generates more
-	 * pty's automagically when needed
-	 */
-	char *slave;
-
-	slave = _getpty(ptyfd, O_RDWR, 0622, 0);
-	if (slave == NULL) {
-		error("_getpty: %.100s", strerror(errno));
-		return 0;
-	}
-	strlcpy(namebuf, slave, namebuflen);
-	/* Open the slave side. */
-	*ttyfd = open(namebuf, O_RDWR | O_NOCTTY);
-	if (*ttyfd < 0) {
-		error("%.200s: %.100s", namebuf, strerror(errno));
-		close(*ptyfd);
-		return 0;
-	}
-	return 1;
-#else /* HAVE__GETPTY */
-#ifdef HAVE_DEV_PTMX
-	/*
-	 * This code is used e.g. on Solaris 2.x.  (Note that Solaris 2.3
-	 * also has bsd-style ptys, but they simply do not work.)
-	 */
-	int ptm;
-	char *pts;
-
-	ptm = open("/dev/ptmx", O_RDWR | O_NOCTTY);
-	if (ptm < 0) {
-		error("/dev/ptmx: %.100s", strerror(errno));
-		return 0;
-	}
-	if (grantpt(ptm) < 0) {
-		error("grantpt: %.100s", strerror(errno));
-		return 0;
-	}
-	if (unlockpt(ptm) < 0) {
-		error("unlockpt: %.100s", strerror(errno));
-		return 0;
-	}
-	pts = ptsname(ptm);
-	if (pts == NULL)
-		error("Slave pty side name could not be obtained.");
-	strlcpy(namebuf, pts, namebuflen);
-	*ptyfd = ptm;
-
-	/* Open the slave side. */
-	*ttyfd = open(namebuf, O_RDWR | O_NOCTTY);
-	if (*ttyfd < 0) {
-		error("%.100s: %.100s", namebuf, strerror(errno));
-		close(*ptyfd);
-		return 0;
-	}
-	/* Push the appropriate streams modules, as described in Solaris pts(7). */
-	if (ioctl(*ttyfd, I_PUSH, "ptem") < 0)
-		error("ioctl I_PUSH ptem: %.100s", strerror(errno));
-	if (ioctl(*ttyfd, I_PUSH, "ldterm") < 0)
-		error("ioctl I_PUSH ldterm: %.100s", strerror(errno));
-	if (ioctl(*ttyfd, I_PUSH, "ttcompat") < 0)
-		error("ioctl I_PUSH ttcompat: %.100s", strerror(errno));
-	return 1;
-#else /* HAVE_DEV_PTMX */
-#ifdef HAVE_DEV_PTS_AND_PTC
-	/* AIX-style pty code. */
-	const char *name;
-
-	*ptyfd = open("/dev/ptc", O_RDWR | O_NOCTTY);
-	if (*ptyfd < 0) {
-		error("Could not open /dev/ptc: %.100s", strerror(errno));
-		return 0;
-	}
-	name = ttyname(*ptyfd);
-	if (!name)
-		fatal("Open of /dev/ptc returns device for which ttyname fails.");
-	strlcpy(namebuf, name, namebuflen);
-	*ttyfd = open(name, O_RDWR | O_NOCTTY);
-	if (*ttyfd < 0) {
-		error("Could not open pty slave side %.100s: %.100s",
-		      name, strerror(errno));
-		close(*ptyfd);
-		return 0;
-	}
-	return 1;
-#else /* HAVE_DEV_PTS_AND_PTC */
-	/* BSD-style pty code. */
-	char buf[64];
-	int i;
-	const char *ptymajors = "pqrstuvwxyzabcdefghijklmnoABCDEFGHIJKLMNOPQRSTUVWXYZ";
-	const char *ptyminors = "0123456789abcdef";
-	int num_minors = strlen(ptyminors);
-	int num_ptys = strlen(ptymajors) * num_minors;
-
-	for (i = 0; i < num_ptys; i++) {
-		snprintf(buf, sizeof buf, "/dev/pty%c%c", ptymajors[i / num_minors],
-			 ptyminors[i % num_minors]);
-		*ptyfd = open(buf, O_RDWR | O_NOCTTY);
-		if (*ptyfd < 0)
-			continue;
-		snprintf(namebuf, namebuflen, "/dev/tty%c%c",
-		    ptymajors[i / num_minors], ptyminors[i % num_minors]);
-
-		/* Open the slave side. */
-		*ttyfd = open(namebuf, O_RDWR | O_NOCTTY);
-		if (*ttyfd < 0) {
-			error("%.100s: %.100s", namebuf, strerror(errno));
-			close(*ptyfd);
-			return 0;
-		}
-		return 1;
-	}
-	return 0;
-#endif /* HAVE_DEV_PTS_AND_PTC */
-#endif /* HAVE_DEV_PTMX */
-#endif /* HAVE__GETPTY */
-#endif /* HAVE_OPENPTY */
-}
-
-/* Releases the tty.  Its ownership is returned to root, and permissions to 0666. */
-
-void
-pty_release(const char *ttyname)
-{
-	if (chown(ttyname, (uid_t) 0, (gid_t) 0) < 0)
-		error("chown %.100s 0 0 failed: %.100s", ttyname, strerror(errno));
-	if (chmod(ttyname, (mode_t) 0666) < 0)
-		error("chmod %.100s 0666 failed: %.100s", ttyname, strerror(errno));
-}
-
-/* Makes the tty the processes controlling tty and sets it to sane modes. */
-
-void
-pty_make_controlling_tty(int *ttyfd, const char *ttyname)
-{
-	int fd;
-
-	/* First disconnect from the old controlling tty. */
-#ifdef TIOCNOTTY
-	fd = open("/dev/tty", O_RDWR | O_NOCTTY);
-	if (fd >= 0) {
-		(void) ioctl(fd, TIOCNOTTY, NULL);
-		close(fd);
-	}
-#endif /* TIOCNOTTY */
-	if (setsid() < 0)
-		error("setsid: %.100s", strerror(errno));
-
-	/*
-	 * Verify that we are successfully disconnected from the controlling
-	 * tty.
-	 */
-	fd = open("/dev/tty", O_RDWR | O_NOCTTY);
-	if (fd >= 0) {
-		error("Failed to disconnect from controlling tty.");
-		close(fd);
-	}
-	/* Make it our controlling tty. */
-#ifdef TIOCSCTTY
-	debug("Setting controlling tty using TIOCSCTTY.");
-	/*
-	 * We ignore errors from this, because HPSUX defines TIOCSCTTY, but
-	 * returns EINVAL with these arguments, and there is absolutely no
-	 * documentation.
-	 */
-	ioctl(*ttyfd, TIOCSCTTY, NULL);
-#endif /* TIOCSCTTY */
-	fd = open(ttyname, O_RDWR);
-	if (fd < 0)
-		error("%.100s: %.100s", ttyname, strerror(errno));
-	else
-		close(fd);
-
-	/* Verify that we now have a controlling tty. */
-	fd = open("/dev/tty", O_WRONLY);
-	if (fd < 0)
-		error("open /dev/tty failed - could not set controlling tty: %.100s",
-		      strerror(errno));
-	else {
-		close(fd);
-	}
-}
-
-/* Changes the window size associated with the pty. */
-
-void
-pty_change_window_size(int ptyfd, int row, int col,
-		       int xpixel, int ypixel)
-{
-	struct winsize w;
-	w.ws_row = row;
-	w.ws_col = col;
-	w.ws_xpixel = xpixel;
-	w.ws_ypixel = ypixel;
-	(void) ioctl(ptyfd, TIOCSWINSZ, &w);
-}
-
-void
-pty_setowner(struct passwd *pw, const char *ttyname)
-{
-	struct group *grp;
-	gid_t gid;
-	mode_t mode;
-
-	/* Determine the group to make the owner of the tty. */
-	grp = getgrnam("tty");
-	if (grp) {
-		gid = grp->gr_gid;
-		mode = S_IRUSR | S_IWUSR | S_IWGRP;
-	} else {
-		gid = pw->pw_gid;
-		mode = S_IRUSR | S_IWUSR | S_IWGRP | S_IWOTH;
-	}
-
-	/* Change ownership of the tty. */
-	if (chown(ttyname, pw->pw_uid, gid) < 0)
-		fatal("chown(%.100s, %d, %d) failed: %.100s",
-		    ttyname, pw->pw_uid, gid, strerror(errno));
-	if (chmod(ttyname, mode) < 0)
-		fatal("chmod(%.100s, 0%o) failed: %.100s",
-		    ttyname, mode, strerror(errno));
-}
diff --git a/crypto/openssh/pty.h b/crypto/openssh/pty.h
deleted file mode 100644
index 13d8e6026cc3..000000000000
--- a/crypto/openssh/pty.h
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * Functions for allocating a pseudo-terminal and making it the controlling
- * tty.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-/* RCSID("$OpenBSD: pty.h,v 1.8 2000/09/07 20:27:52 deraadt Exp $"); */
-
-#ifndef PTY_H
-#define PTY_H
-
-/*
- * Allocates and opens a pty.  Returns 0 if no pty could be allocated, or
- * nonzero if a pty was successfully allocated.  On success, open file
- * descriptors for the pty and tty sides and the name of the tty side are
- * returned (the buffer must be able to hold at least 64 characters).
- */
-int     pty_allocate(int *ptyfd, int *ttyfd, char *ttyname, int ttynamelen);
-
-/*
- * Releases the tty.  Its ownership is returned to root, and permissions to
- * 0666.
- */
-void    pty_release(const char *ttyname);
-
-/*
- * Makes the tty the processes controlling tty and sets it to sane modes.
- * This may need to reopen the tty to get rid of possible eavesdroppers.
- */
-void    pty_make_controlling_tty(int *ttyfd, const char *ttyname);
-
-/* Changes the window size associated with the pty. */
-void
-pty_change_window_size(int ptyfd, int row, int col,
-    int xpixel, int ypixel);
-
-void	pty_setowner(struct passwd *pw, const char *ttyname);
-
-#endif				/* PTY_H */
diff --git a/crypto/openssh/radix.c b/crypto/openssh/radix.c
deleted file mode 100644
index c680d6bf3f63..000000000000
--- a/crypto/openssh/radix.c
+++ /dev/null
@@ -1,158 +0,0 @@
-/*
- * Copyright (c) 1999 Dug Song.  All rights reserved.
- * Copyright (c) 2002 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-#include "uuencode.h"
-
-RCSID("$OpenBSD: radix.c,v 1.22 2002/09/09 14:54:15 markus Exp $");
-
-#ifdef AFS
-#include <krb.h>
-
-#include <radix.h>
-#include "bufaux.h"
-
-int
-creds_to_radix(CREDENTIALS *creds, u_char *buf, size_t buflen)
-{
-	Buffer b;
-	int ret;
-
-	buffer_init(&b);
-
-	buffer_put_char(&b, 1);	/* version */
-
-	buffer_append(&b, creds->service, strlen(creds->service));
-	buffer_put_char(&b, '\0');
-	buffer_append(&b, creds->instance, strlen(creds->instance));
-	buffer_put_char(&b, '\0');
-	buffer_append(&b, creds->realm, strlen(creds->realm));
-	buffer_put_char(&b, '\0');
-	buffer_append(&b, creds->pname, strlen(creds->pname));
-	buffer_put_char(&b, '\0');
-	buffer_append(&b, creds->pinst, strlen(creds->pinst));
-	buffer_put_char(&b, '\0');
-
-	/* Null string to repeat the realm. */
-	buffer_put_char(&b, '\0');
-
-	buffer_put_int(&b, creds->issue_date);
-	buffer_put_int(&b, krb_life_to_time(creds->issue_date,
-	    creds->lifetime));
-	buffer_append(&b, creds->session, sizeof(creds->session));
-	buffer_put_short(&b, creds->kvno);
-
-	/* 32 bit size + data */
-	buffer_put_string(&b, creds->ticket_st.dat, creds->ticket_st.length);
-
-	ret = uuencode(buffer_ptr(&b), buffer_len(&b), (char *)buf, buflen);
-
-	buffer_free(&b);
-	return ret;
-}
-
-#define GETSTRING(b, t, tlen) \
-	do { \
-		int i, found = 0; \
-		for (i = 0; i < tlen; i++) { \
-			if (buffer_len(b) == 0) \
-				goto done; \
-			t[i] = buffer_get_char(b); \
-			if (t[i] == '\0') { \
-				found = 1; \
-				break; \
-			} \
-		} \
-		if (!found) \
-			goto done; \
-	} while(0)
-
-int
-radix_to_creds(const char *buf, CREDENTIALS *creds)
-{
-	Buffer b;
-	u_char *space;
-	char c, version, *p;
-	u_int endTime, len;
-	int blen, ret;
-
-	ret = 0;
-	blen = strlen(buf);
-
-	/* sanity check for size */
-	if (blen > 8192)
-		return 0;
-
-	buffer_init(&b);
-	space = buffer_append_space(&b, blen);
-
-	/* check version and length! */
-	len = uudecode(buf, space, blen);
-	if (len < 1)
-		goto done;
-
-	version = buffer_get_char(&b);
-
-	GETSTRING(&b, creds->service, sizeof creds->service);
-	GETSTRING(&b, creds->instance, sizeof creds->instance);
-	GETSTRING(&b, creds->realm, sizeof creds->realm);
-	GETSTRING(&b, creds->pname, sizeof creds->pname);
-	GETSTRING(&b, creds->pinst, sizeof creds->pinst);
-
-	if (buffer_len(&b) == 0)
-		goto done;
-
-	/* Ignore possibly different realm. */
-	while (buffer_len(&b) > 0 && (c = buffer_get_char(&b)) != '\0')
-		;
-
-	if (buffer_len(&b) == 0)
-		goto done;
-
-	creds->issue_date = buffer_get_int(&b);
-
-	endTime = buffer_get_int(&b);
-	creds->lifetime = krb_time_to_life(creds->issue_date, endTime);
-
-	len = buffer_len(&b);
-	if (len < sizeof(creds->session))
-		goto done;
-	memcpy(&creds->session, buffer_ptr(&b), sizeof(creds->session));
-	buffer_consume(&b, sizeof(creds->session));
-
-	creds->kvno = buffer_get_short(&b);
-
-	p = buffer_get_string(&b, &len);
-	if (len < 0 || len > sizeof(creds->ticket_st.dat))
-		goto done;
-	memcpy(&creds->ticket_st.dat, p, len);
-	creds->ticket_st.length = len;
-
-	ret = 1;
-done:
-	buffer_free(&b);
-	return ret;
-}
-#endif /* AFS */
diff --git a/crypto/openssh/radix.h b/crypto/openssh/radix.h
deleted file mode 100644
index e94e4acc6adf..000000000000
--- a/crypto/openssh/radix.h
+++ /dev/null
@@ -1,28 +0,0 @@
-/*	$OpenBSD: radix.h,v 1.4 2001/06/26 17:27:24 markus Exp $	*/
-
-/*
- * Copyright (c) 1999 Dug Song.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-int	 creds_to_radix(CREDENTIALS *, u_char *, size_t);
-int	 radix_to_creds(const char *, CREDENTIALS *);
diff --git a/crypto/openssh/readconf.c b/crypto/openssh/readconf.c
deleted file mode 100644
index 1df5ce2d9b9d..000000000000
--- a/crypto/openssh/readconf.c
+++ /dev/null
@@ -1,919 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * Functions for reading the configuration files.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: readconf.c,v 1.104 2003/04/01 10:22:21 markus Exp $");
-
-#include "ssh.h"
-#include "xmalloc.h"
-#include "compat.h"
-#include "cipher.h"
-#include "pathnames.h"
-#include "log.h"
-#include "readconf.h"
-#include "match.h"
-#include "misc.h"
-#include "kex.h"
-#include "mac.h"
-
-/* Format of the configuration file:
-
-   # Configuration data is parsed as follows:
-   #  1. command line options
-   #  2. user-specific file
-   #  3. system-wide file
-   # Any configuration value is only changed the first time it is set.
-   # Thus, host-specific definitions should be at the beginning of the
-   # configuration file, and defaults at the end.
-
-   # Host-specific declarations.  These may override anything above.  A single
-   # host may match multiple declarations; these are processed in the order
-   # that they are given in.
-
-   Host *.ngs.fi ngs.fi
-     User foo
-
-   Host fake.com
-     HostName another.host.name.real.org
-     User blaah
-     Port 34289
-     ForwardX11 no
-     ForwardAgent no
-
-   Host books.com
-     RemoteForward 9999 shadows.cs.hut.fi:9999
-     Cipher 3des
-
-   Host fascist.blob.com
-     Port 23123
-     User tylonen
-     RhostsAuthentication no
-     PasswordAuthentication no
-
-   Host puukko.hut.fi
-     User t35124p
-     ProxyCommand ssh-proxy %h %p
-
-   Host *.fr
-     PublicKeyAuthentication no
-
-   Host *.su
-     Cipher none
-     PasswordAuthentication no
-
-   # Defaults for various options
-   Host *
-     ForwardAgent no
-     ForwardX11 no
-     RhostsAuthentication yes
-     PasswordAuthentication yes
-     RSAAuthentication yes
-     RhostsRSAAuthentication yes
-     StrictHostKeyChecking yes
-     KeepAlives no
-     IdentityFile ~/.ssh/identity
-     Port 22
-     EscapeChar ~
-
-*/
-
-/* Keyword tokens. */
-
-typedef enum {
-	oBadOption,
-	oForwardAgent, oForwardX11, oGatewayPorts, oRhostsAuthentication,
-	oPasswordAuthentication, oRSAAuthentication,
-	oChallengeResponseAuthentication, oXAuthLocation,
-#if defined(KRB4) || defined(KRB5)
-	oKerberosAuthentication,
-#endif
-#if defined(AFS) || defined(KRB5)
-	oKerberosTgtPassing,
-#endif
-#ifdef AFS
-	oAFSTokenPassing,
-#endif
-	oIdentityFile, oHostName, oPort, oCipher, oRemoteForward, oLocalForward,
-	oUser, oHost, oEscapeChar, oRhostsRSAAuthentication, oProxyCommand,
-	oGlobalKnownHostsFile, oUserKnownHostsFile, oConnectionAttempts,
-	oBatchMode, oCheckHostIP, oStrictHostKeyChecking, oCompression,
-	oCompressionLevel, oKeepAlives, oNumberOfPasswordPrompts,
-	oUsePrivilegedPort, oLogLevel, oCiphers, oProtocol, oMacs,
-	oGlobalKnownHostsFile2, oUserKnownHostsFile2, oPubkeyAuthentication,
-	oKbdInteractiveAuthentication, oKbdInteractiveDevices, oHostKeyAlias,
-	oDynamicForward, oPreferredAuthentications, oHostbasedAuthentication,
-	oHostKeyAlgorithms, oBindAddress, oSmartcardDevice,
-	oClearAllForwardings, oNoHostAuthenticationForLocalhost,
-	oEnableSSHKeysign,
-	oDeprecated
-} OpCodes;
-
-/* Textual representations of the tokens. */
-
-static struct {
-	const char *name;
-	OpCodes opcode;
-} keywords[] = {
-	{ "forwardagent", oForwardAgent },
-	{ "forwardx11", oForwardX11 },
-	{ "xauthlocation", oXAuthLocation },
-	{ "gatewayports", oGatewayPorts },
-	{ "useprivilegedport", oUsePrivilegedPort },
-	{ "rhostsauthentication", oRhostsAuthentication },
-	{ "passwordauthentication", oPasswordAuthentication },
-	{ "kbdinteractiveauthentication", oKbdInteractiveAuthentication },
-	{ "kbdinteractivedevices", oKbdInteractiveDevices },
-	{ "rsaauthentication", oRSAAuthentication },
-	{ "pubkeyauthentication", oPubkeyAuthentication },
-	{ "dsaauthentication", oPubkeyAuthentication },		    /* alias */
-	{ "rhostsrsaauthentication", oRhostsRSAAuthentication },
-	{ "hostbasedauthentication", oHostbasedAuthentication },
-	{ "challengeresponseauthentication", oChallengeResponseAuthentication },
-	{ "skeyauthentication", oChallengeResponseAuthentication }, /* alias */
-	{ "tisauthentication", oChallengeResponseAuthentication },  /* alias */
-#if defined(KRB4) || defined(KRB5)
-	{ "kerberosauthentication", oKerberosAuthentication },
-#endif
-#if defined(AFS) || defined(KRB5)
-	{ "kerberostgtpassing", oKerberosTgtPassing },
-#endif
-#ifdef AFS
-	{ "afstokenpassing", oAFSTokenPassing },
-#endif
-	{ "fallbacktorsh", oDeprecated },
-	{ "usersh", oDeprecated },
-	{ "identityfile", oIdentityFile },
-	{ "identityfile2", oIdentityFile },			/* alias */
-	{ "hostname", oHostName },
-	{ "hostkeyalias", oHostKeyAlias },
-	{ "proxycommand", oProxyCommand },
-	{ "port", oPort },
-	{ "cipher", oCipher },
-	{ "ciphers", oCiphers },
-	{ "macs", oMacs },
-	{ "protocol", oProtocol },
-	{ "remoteforward", oRemoteForward },
-	{ "localforward", oLocalForward },
-	{ "user", oUser },
-	{ "host", oHost },
-	{ "escapechar", oEscapeChar },
-	{ "globalknownhostsfile", oGlobalKnownHostsFile },
-	{ "userknownhostsfile", oUserKnownHostsFile },		/* obsolete */
-	{ "globalknownhostsfile2", oGlobalKnownHostsFile2 },
-	{ "userknownhostsfile2", oUserKnownHostsFile2 },	/* obsolete */
-	{ "connectionattempts", oConnectionAttempts },
-	{ "batchmode", oBatchMode },
-	{ "checkhostip", oCheckHostIP },
-	{ "stricthostkeychecking", oStrictHostKeyChecking },
-	{ "compression", oCompression },
-	{ "compressionlevel", oCompressionLevel },
-	{ "keepalive", oKeepAlives },
-	{ "numberofpasswordprompts", oNumberOfPasswordPrompts },
-	{ "loglevel", oLogLevel },
-	{ "dynamicforward", oDynamicForward },
-	{ "preferredauthentications", oPreferredAuthentications },
-	{ "hostkeyalgorithms", oHostKeyAlgorithms },
-	{ "bindaddress", oBindAddress },
-	{ "smartcarddevice", oSmartcardDevice },
-	{ "clearallforwardings", oClearAllForwardings },
-	{ "enablesshkeysign", oEnableSSHKeysign },
-	{ "nohostauthenticationforlocalhost", oNoHostAuthenticationForLocalhost },
-	{ NULL, oBadOption }
-};
-
-/*
- * Adds a local TCP/IP port forward to options.  Never returns if there is an
- * error.
- */
-
-void
-add_local_forward(Options *options, u_short port, const char *host,
-		  u_short host_port)
-{
-	Forward *fwd;
-#ifndef NO_IPPORT_RESERVED_CONCEPT
-	extern uid_t original_real_uid;
-	if (port < IPPORT_RESERVED && original_real_uid != 0)
-		fatal("Privileged ports can only be forwarded by root.");
-#endif
-	if (options->num_local_forwards >= SSH_MAX_FORWARDS_PER_DIRECTION)
-		fatal("Too many local forwards (max %d).", SSH_MAX_FORWARDS_PER_DIRECTION);
-	fwd = &options->local_forwards[options->num_local_forwards++];
-	fwd->port = port;
-	fwd->host = xstrdup(host);
-	fwd->host_port = host_port;
-}
-
-/*
- * Adds a remote TCP/IP port forward to options.  Never returns if there is
- * an error.
- */
-
-void
-add_remote_forward(Options *options, u_short port, const char *host,
-		   u_short host_port)
-{
-	Forward *fwd;
-	if (options->num_remote_forwards >= SSH_MAX_FORWARDS_PER_DIRECTION)
-		fatal("Too many remote forwards (max %d).",
-		    SSH_MAX_FORWARDS_PER_DIRECTION);
-	fwd = &options->remote_forwards[options->num_remote_forwards++];
-	fwd->port = port;
-	fwd->host = xstrdup(host);
-	fwd->host_port = host_port;
-}
-
-static void
-clear_forwardings(Options *options)
-{
-	int i;
-
-	for (i = 0; i < options->num_local_forwards; i++)
-		xfree(options->local_forwards[i].host);
-	options->num_local_forwards = 0;
-	for (i = 0; i < options->num_remote_forwards; i++)
-		xfree(options->remote_forwards[i].host);
-	options->num_remote_forwards = 0;
-}
-
-/*
- * Returns the number of the token pointed to by cp or oBadOption.
- */
-
-static OpCodes
-parse_token(const char *cp, const char *filename, int linenum)
-{
-	u_int i;
-
-	for (i = 0; keywords[i].name; i++)
-		if (strcasecmp(cp, keywords[i].name) == 0)
-			return keywords[i].opcode;
-
-	error("%s: line %d: Bad configuration option: %s",
-	    filename, linenum, cp);
-	return oBadOption;
-}
-
-/*
- * Processes a single option line as used in the configuration files. This
- * only sets those values that have not already been set.
- */
-#define WHITESPACE " \t\r\n"
-
-int
-process_config_line(Options *options, const char *host,
-		    char *line, const char *filename, int linenum,
-		    int *activep)
-{
-	char buf[256], *s, **charptr, *endofnumber, *keyword, *arg;
-	int opcode, *intptr, value;
-	size_t len;
-	u_short fwd_port, fwd_host_port;
-	char sfwd_host_port[6];
-
-	s = line;
-	/* Get the keyword. (Each line is supposed to begin with a keyword). */
-	keyword = strdelim(&s);
-	/* Ignore leading whitespace. */
-	if (*keyword == '\0')
-		keyword = strdelim(&s);
-	if (keyword == NULL || !*keyword || *keyword == '\n' || *keyword == '#')
-		return 0;
-
-	opcode = parse_token(keyword, filename, linenum);
-
-	switch (opcode) {
-	case oBadOption:
-		/* don't panic, but count bad options */
-		return -1;
-		/* NOTREACHED */
-	case oForwardAgent:
-		intptr = &options->forward_agent;
-parse_flag:
-		arg = strdelim(&s);
-		if (!arg || *arg == '\0')
-			fatal("%.200s line %d: Missing yes/no argument.", filename, linenum);
-		value = 0;	/* To avoid compiler warning... */
-		if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0)
-			value = 1;
-		else if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0)
-			value = 0;
-		else
-			fatal("%.200s line %d: Bad yes/no argument.", filename, linenum);
-		if (*activep && *intptr == -1)
-			*intptr = value;
-		break;
-
-	case oForwardX11:
-		intptr = &options->forward_x11;
-		goto parse_flag;
-
-	case oGatewayPorts:
-		intptr = &options->gateway_ports;
-		goto parse_flag;
-
-	case oUsePrivilegedPort:
-		intptr = &options->use_privileged_port;
-		goto parse_flag;
-
-	case oRhostsAuthentication:
-		intptr = &options->rhosts_authentication;
-		goto parse_flag;
-
-	case oPasswordAuthentication:
-		intptr = &options->password_authentication;
-		goto parse_flag;
-
-	case oKbdInteractiveAuthentication:
-		intptr = &options->kbd_interactive_authentication;
-		goto parse_flag;
-
-	case oKbdInteractiveDevices:
-		charptr = &options->kbd_interactive_devices;
-		goto parse_string;
-
-	case oPubkeyAuthentication:
-		intptr = &options->pubkey_authentication;
-		goto parse_flag;
-
-	case oRSAAuthentication:
-		intptr = &options->rsa_authentication;
-		goto parse_flag;
-
-	case oRhostsRSAAuthentication:
-		intptr = &options->rhosts_rsa_authentication;
-		goto parse_flag;
-
-	case oHostbasedAuthentication:
-		intptr = &options->hostbased_authentication;
-		goto parse_flag;
-
-	case oChallengeResponseAuthentication:
-		intptr = &options->challenge_response_authentication;
-		goto parse_flag;
-#if defined(KRB4) || defined(KRB5)
-	case oKerberosAuthentication:
-		intptr = &options->kerberos_authentication;
-		goto parse_flag;
-#endif
-#if defined(AFS) || defined(KRB5)
-	case oKerberosTgtPassing:
-		intptr = &options->kerberos_tgt_passing;
-		goto parse_flag;
-#endif
-#ifdef AFS
-	case oAFSTokenPassing:
-		intptr = &options->afs_token_passing;
-		goto parse_flag;
-#endif
-	case oBatchMode:
-		intptr = &options->batch_mode;
-		goto parse_flag;
-
-	case oCheckHostIP:
-		intptr = &options->check_host_ip;
-		goto parse_flag;
-
-	case oStrictHostKeyChecking:
-		intptr = &options->strict_host_key_checking;
-		arg = strdelim(&s);
-		if (!arg || *arg == '\0')
-			fatal("%.200s line %d: Missing yes/no/ask argument.",
-			    filename, linenum);
-		value = 0;	/* To avoid compiler warning... */
-		if (strcmp(arg, "yes") == 0 || strcmp(arg, "true") == 0)
-			value = 1;
-		else if (strcmp(arg, "no") == 0 || strcmp(arg, "false") == 0)
-			value = 0;
-		else if (strcmp(arg, "ask") == 0)
-			value = 2;
-		else
-			fatal("%.200s line %d: Bad yes/no/ask argument.", filename, linenum);
-		if (*activep && *intptr == -1)
-			*intptr = value;
-		break;
-
-	case oCompression:
-		intptr = &options->compression;
-		goto parse_flag;
-
-	case oKeepAlives:
-		intptr = &options->keepalives;
-		goto parse_flag;
-
-	case oNoHostAuthenticationForLocalhost:
-		intptr = &options->no_host_authentication_for_localhost;
-		goto parse_flag;
-
-	case oNumberOfPasswordPrompts:
-		intptr = &options->number_of_password_prompts;
-		goto parse_int;
-
-	case oCompressionLevel:
-		intptr = &options->compression_level;
-		goto parse_int;
-
-	case oIdentityFile:
-		arg = strdelim(&s);
-		if (!arg || *arg == '\0')
-			fatal("%.200s line %d: Missing argument.", filename, linenum);
-		if (*activep) {
-			intptr = &options->num_identity_files;
-			if (*intptr >= SSH_MAX_IDENTITY_FILES)
-				fatal("%.200s line %d: Too many identity files specified (max %d).",
-				    filename, linenum, SSH_MAX_IDENTITY_FILES);
-			charptr =  &options->identity_files[*intptr];
-			*charptr = xstrdup(arg);
-			*intptr = *intptr + 1;
-		}
-		break;
-
-	case oXAuthLocation:
-		charptr=&options->xauth_location;
-		goto parse_string;
-
-	case oUser:
-		charptr = &options->user;
-parse_string:
-		arg = strdelim(&s);
-		if (!arg || *arg == '\0')
-			fatal("%.200s line %d: Missing argument.", filename, linenum);
-		if (*activep && *charptr == NULL)
-			*charptr = xstrdup(arg);
-		break;
-
-	case oGlobalKnownHostsFile:
-		charptr = &options->system_hostfile;
-		goto parse_string;
-
-	case oUserKnownHostsFile:
-		charptr = &options->user_hostfile;
-		goto parse_string;
-
-	case oGlobalKnownHostsFile2:
-		charptr = &options->system_hostfile2;
-		goto parse_string;
-
-	case oUserKnownHostsFile2:
-		charptr = &options->user_hostfile2;
-		goto parse_string;
-
-	case oHostName:
-		charptr = &options->hostname;
-		goto parse_string;
-
-	case oHostKeyAlias:
-		charptr = &options->host_key_alias;
-		goto parse_string;
-
-	case oPreferredAuthentications:
-		charptr = &options->preferred_authentications;
-		goto parse_string;
-
-	case oBindAddress:
-		charptr = &options->bind_address;
-		goto parse_string;
-
-	case oSmartcardDevice:
-		charptr = &options->smartcard_device;
-		goto parse_string;
-
-	case oProxyCommand:
-		charptr = &options->proxy_command;
-		len = strspn(s, WHITESPACE "=");
-		if (*activep && *charptr == NULL)
-			*charptr = xstrdup(s + len);
-		return 0;
-
-	case oPort:
-		intptr = &options->port;
-parse_int:
-		arg = strdelim(&s);
-		if (!arg || *arg == '\0')
-			fatal("%.200s line %d: Missing argument.", filename, linenum);
-		if (arg[0] < '0' || arg[0] > '9')
-			fatal("%.200s line %d: Bad number.", filename, linenum);
-
-		/* Octal, decimal, or hex format? */
-		value = strtol(arg, &endofnumber, 0);
-		if (arg == endofnumber)
-			fatal("%.200s line %d: Bad number.", filename, linenum);
-		if (*activep && *intptr == -1)
-			*intptr = value;
-		break;
-
-	case oConnectionAttempts:
-		intptr = &options->connection_attempts;
-		goto parse_int;
-
-	case oCipher:
-		intptr = &options->cipher;
-		arg = strdelim(&s);
-		if (!arg || *arg == '\0')
-			fatal("%.200s line %d: Missing argument.", filename, linenum);
-		value = cipher_number(arg);
-		if (value == -1)
-			fatal("%.200s line %d: Bad cipher '%s'.",
-			    filename, linenum, arg ? arg : "<NONE>");
-		if (*activep && *intptr == -1)
-			*intptr = value;
-		break;
-
-	case oCiphers:
-		arg = strdelim(&s);
-		if (!arg || *arg == '\0')
-			fatal("%.200s line %d: Missing argument.", filename, linenum);
-		if (!ciphers_valid(arg))
-			fatal("%.200s line %d: Bad SSH2 cipher spec '%s'.",
-			    filename, linenum, arg ? arg : "<NONE>");
-		if (*activep && options->ciphers == NULL)
-			options->ciphers = xstrdup(arg);
-		break;
-
-	case oMacs:
-		arg = strdelim(&s);
-		if (!arg || *arg == '\0')
-			fatal("%.200s line %d: Missing argument.", filename, linenum);
-		if (!mac_valid(arg))
-			fatal("%.200s line %d: Bad SSH2 Mac spec '%s'.",
-			    filename, linenum, arg ? arg : "<NONE>");
-		if (*activep && options->macs == NULL)
-			options->macs = xstrdup(arg);
-		break;
-
-	case oHostKeyAlgorithms:
-		arg = strdelim(&s);
-		if (!arg || *arg == '\0')
-			fatal("%.200s line %d: Missing argument.", filename, linenum);
-		if (!key_names_valid2(arg))
-			fatal("%.200s line %d: Bad protocol 2 host key algorithms '%s'.",
-			    filename, linenum, arg ? arg : "<NONE>");
-		if (*activep && options->hostkeyalgorithms == NULL)
-			options->hostkeyalgorithms = xstrdup(arg);
-		break;
-
-	case oProtocol:
-		intptr = &options->protocol;
-		arg = strdelim(&s);
-		if (!arg || *arg == '\0')
-			fatal("%.200s line %d: Missing argument.", filename, linenum);
-		value = proto_spec(arg);
-		if (value == SSH_PROTO_UNKNOWN)
-			fatal("%.200s line %d: Bad protocol spec '%s'.",
-			    filename, linenum, arg ? arg : "<NONE>");
-		if (*activep && *intptr == SSH_PROTO_UNKNOWN)
-			*intptr = value;
-		break;
-
-	case oLogLevel:
-		intptr = (int *) &options->log_level;
-		arg = strdelim(&s);
-		value = log_level_number(arg);
-		if (value == SYSLOG_LEVEL_NOT_SET)
-			fatal("%.200s line %d: unsupported log level '%s'",
-			    filename, linenum, arg ? arg : "<NONE>");
-		if (*activep && (LogLevel) *intptr == SYSLOG_LEVEL_NOT_SET)
-			*intptr = (LogLevel) value;
-		break;
-
-	case oLocalForward:
-	case oRemoteForward:
-		arg = strdelim(&s);
-		if (!arg || *arg == '\0')
-			fatal("%.200s line %d: Missing port argument.",
-			    filename, linenum);
-		if ((fwd_port = a2port(arg)) == 0)
-			fatal("%.200s line %d: Bad listen port.",
-			    filename, linenum);
-		arg = strdelim(&s);
-		if (!arg || *arg == '\0')
-			fatal("%.200s line %d: Missing second argument.",
-			    filename, linenum);
-		if (sscanf(arg, "%255[^:]:%5[0-9]", buf, sfwd_host_port) != 2 &&
-		    sscanf(arg, "%255[^/]/%5[0-9]", buf, sfwd_host_port) != 2)
-			fatal("%.200s line %d: Bad forwarding specification.",
-			    filename, linenum);
-		if ((fwd_host_port = a2port(sfwd_host_port)) == 0)
-			fatal("%.200s line %d: Bad forwarding port.",
-			    filename, linenum);
-		if (*activep) {
-			if (opcode == oLocalForward)
-				add_local_forward(options, fwd_port, buf,
-				    fwd_host_port);
-			else if (opcode == oRemoteForward)
-				add_remote_forward(options, fwd_port, buf,
-				    fwd_host_port);
-		}
-		break;
-
-	case oDynamicForward:
-		arg = strdelim(&s);
-		if (!arg || *arg == '\0')
-			fatal("%.200s line %d: Missing port argument.",
-			    filename, linenum);
-		fwd_port = a2port(arg);
-		if (fwd_port == 0)
-			fatal("%.200s line %d: Badly formatted port number.",
-			    filename, linenum);
-		if (*activep)
-			add_local_forward(options, fwd_port, "socks4", 0);
-		break;
-
-	case oClearAllForwardings:
-		intptr = &options->clear_forwardings;
-		goto parse_flag;
-
-	case oHost:
-		*activep = 0;
-		while ((arg = strdelim(&s)) != NULL && *arg != '\0')
-			if (match_pattern(host, arg)) {
-				debug("Applying options for %.100s", arg);
-				*activep = 1;
-				break;
-			}
-		/* Avoid garbage check below, as strdelim is done. */
-		return 0;
-
-	case oEscapeChar:
-		intptr = &options->escape_char;
-		arg = strdelim(&s);
-		if (!arg || *arg == '\0')
-			fatal("%.200s line %d: Missing argument.", filename, linenum);
-		if (arg[0] == '^' && arg[2] == 0 &&
-		    (u_char) arg[1] >= 64 && (u_char) arg[1] < 128)
-			value = (u_char) arg[1] & 31;
-		else if (strlen(arg) == 1)
-			value = (u_char) arg[0];
-		else if (strcmp(arg, "none") == 0)
-			value = SSH_ESCAPECHAR_NONE;
-		else {
-			fatal("%.200s line %d: Bad escape character.",
-			    filename, linenum);
-			/* NOTREACHED */
-			value = 0;	/* Avoid compiler warning. */
-		}
-		if (*activep && *intptr == -1)
-			*intptr = value;
-		break;
-
-	case oEnableSSHKeysign:
-		intptr = &options->enable_ssh_keysign;
-		goto parse_flag;
-
-	case oDeprecated:
-		debug("%s line %d: Deprecated option \"%s\"",
-		    filename, linenum, keyword);
-		return 0;
-
-	default:
-		fatal("process_config_line: Unimplemented opcode %d", opcode);
-	}
-
-	/* Check that there is no garbage at end of line. */
-	if ((arg = strdelim(&s)) != NULL && *arg != '\0') {
-		fatal("%.200s line %d: garbage at end of line; \"%.200s\".",
-		     filename, linenum, arg);
-	}
-	return 0;
-}
-
-
-/*
- * Reads the config file and modifies the options accordingly.  Options
- * should already be initialized before this call.  This never returns if
- * there is an error.  If the file does not exist, this returns 0.
- */
-
-int
-read_config_file(const char *filename, const char *host, Options *options)
-{
-	FILE *f;
-	char line[1024];
-	int active, linenum;
-	int bad_options = 0;
-
-	/* Open the file. */
-	f = fopen(filename, "r");
-	if (!f)
-		return 0;
-
-	debug("Reading configuration data %.200s", filename);
-
-	/*
-	 * Mark that we are now processing the options.  This flag is turned
-	 * on/off by Host specifications.
-	 */
-	active = 1;
-	linenum = 0;
-	while (fgets(line, sizeof(line), f)) {
-		/* Update line number counter. */
-		linenum++;
-		if (process_config_line(options, host, line, filename, linenum, &active) != 0)
-			bad_options++;
-	}
-	fclose(f);
-	if (bad_options > 0)
-		fatal("%s: terminating, %d bad configuration options",
-		    filename, bad_options);
-	return 1;
-}
-
-/*
- * Initializes options to special values that indicate that they have not yet
- * been set.  Read_config_file will only set options with this value. Options
- * are processed in the following order: command line, user config file,
- * system config file.  Last, fill_default_options is called.
- */
-
-void
-initialize_options(Options * options)
-{
-	memset(options, 'X', sizeof(*options));
-	options->forward_agent = -1;
-	options->forward_x11 = -1;
-	options->xauth_location = NULL;
-	options->gateway_ports = -1;
-	options->use_privileged_port = -1;
-	options->rhosts_authentication = -1;
-	options->rsa_authentication = -1;
-	options->pubkey_authentication = -1;
-	options->challenge_response_authentication = -1;
-#if defined(KRB4) || defined(KRB5)
-	options->kerberos_authentication = -1;
-#endif
-#if defined(AFS) || defined(KRB5)
-	options->kerberos_tgt_passing = -1;
-#endif
-#ifdef AFS
-	options->afs_token_passing = -1;
-#endif
-	options->password_authentication = -1;
-	options->kbd_interactive_authentication = -1;
-	options->kbd_interactive_devices = NULL;
-	options->rhosts_rsa_authentication = -1;
-	options->hostbased_authentication = -1;
-	options->batch_mode = -1;
-	options->check_host_ip = -1;
-	options->strict_host_key_checking = -1;
-	options->compression = -1;
-	options->keepalives = -1;
-	options->compression_level = -1;
-	options->port = -1;
-	options->connection_attempts = -1;
-	options->number_of_password_prompts = -1;
-	options->cipher = -1;
-	options->ciphers = NULL;
-	options->macs = NULL;
-	options->hostkeyalgorithms = NULL;
-	options->protocol = SSH_PROTO_UNKNOWN;
-	options->num_identity_files = 0;
-	options->hostname = NULL;
-	options->host_key_alias = NULL;
-	options->proxy_command = NULL;
-	options->user = NULL;
-	options->escape_char = -1;
-	options->system_hostfile = NULL;
-	options->user_hostfile = NULL;
-	options->system_hostfile2 = NULL;
-	options->user_hostfile2 = NULL;
-	options->num_local_forwards = 0;
-	options->num_remote_forwards = 0;
-	options->clear_forwardings = -1;
-	options->log_level = SYSLOG_LEVEL_NOT_SET;
-	options->preferred_authentications = NULL;
-	options->bind_address = NULL;
-	options->smartcard_device = NULL;
-	options->enable_ssh_keysign = - 1;
-	options->no_host_authentication_for_localhost = - 1;
-}
-
-/*
- * Called after processing other sources of option data, this fills those
- * options for which no value has been specified with their default values.
- */
-
-void
-fill_default_options(Options * options)
-{
-	int len;
-
-	if (options->forward_agent == -1)
-		options->forward_agent = 0;
-	if (options->forward_x11 == -1)
-		options->forward_x11 = 0;
-	if (options->xauth_location == NULL)
-		options->xauth_location = _PATH_XAUTH;
-	if (options->gateway_ports == -1)
-		options->gateway_ports = 0;
-	if (options->use_privileged_port == -1)
-		options->use_privileged_port = 0;
-	if (options->rhosts_authentication == -1)
-		options->rhosts_authentication = 0;
-	if (options->rsa_authentication == -1)
-		options->rsa_authentication = 1;
-	if (options->pubkey_authentication == -1)
-		options->pubkey_authentication = 1;
-	if (options->challenge_response_authentication == -1)
-		options->challenge_response_authentication = 1;
-#if defined(KRB4) || defined(KRB5)
-	if (options->kerberos_authentication == -1)
-		options->kerberos_authentication = 1;
-#endif
-#if defined(AFS) || defined(KRB5)
-	if (options->kerberos_tgt_passing == -1)
-		options->kerberos_tgt_passing = 1;
-#endif
-#ifdef AFS
-	if (options->afs_token_passing == -1)
-		options->afs_token_passing = 1;
-#endif
-	if (options->password_authentication == -1)
-		options->password_authentication = 1;
-	if (options->kbd_interactive_authentication == -1)
-		options->kbd_interactive_authentication = 1;
-	if (options->rhosts_rsa_authentication == -1)
-		options->rhosts_rsa_authentication = 0;
-	if (options->hostbased_authentication == -1)
-		options->hostbased_authentication = 0;
-	if (options->batch_mode == -1)
-		options->batch_mode = 0;
-	if (options->check_host_ip == -1)
-		options->check_host_ip = 1;
-	if (options->strict_host_key_checking == -1)
-		options->strict_host_key_checking = 2;	/* 2 is default */
-	if (options->compression == -1)
-		options->compression = 0;
-	if (options->keepalives == -1)
-		options->keepalives = 1;
-	if (options->compression_level == -1)
-		options->compression_level = 6;
-	if (options->port == -1)
-		options->port = 0;	/* Filled in ssh_connect. */
-	if (options->connection_attempts == -1)
-		options->connection_attempts = 1;
-	if (options->number_of_password_prompts == -1)
-		options->number_of_password_prompts = 3;
-	/* Selected in ssh_login(). */
-	if (options->cipher == -1)
-		options->cipher = SSH_CIPHER_NOT_SET;
-	/* options->ciphers, default set in myproposals.h */
-	/* options->macs, default set in myproposals.h */
-	/* options->hostkeyalgorithms, default set in myproposals.h */
-	if (options->protocol == SSH_PROTO_UNKNOWN)
-		options->protocol = SSH_PROTO_1|SSH_PROTO_2;
-	if (options->num_identity_files == 0) {
-		if (options->protocol & SSH_PROTO_1) {
-			len = 2 + strlen(_PATH_SSH_CLIENT_IDENTITY) + 1;
-			options->identity_files[options->num_identity_files] =
-			    xmalloc(len);
-			snprintf(options->identity_files[options->num_identity_files++],
-			    len, "~/%.100s", _PATH_SSH_CLIENT_IDENTITY);
-		}
-		if (options->protocol & SSH_PROTO_2) {
-			len = 2 + strlen(_PATH_SSH_CLIENT_ID_RSA) + 1;
-			options->identity_files[options->num_identity_files] =
-			    xmalloc(len);
-			snprintf(options->identity_files[options->num_identity_files++],
-			    len, "~/%.100s", _PATH_SSH_CLIENT_ID_RSA);
-
-			len = 2 + strlen(_PATH_SSH_CLIENT_ID_DSA) + 1;
-			options->identity_files[options->num_identity_files] =
-			    xmalloc(len);
-			snprintf(options->identity_files[options->num_identity_files++],
-			    len, "~/%.100s", _PATH_SSH_CLIENT_ID_DSA);
-		}
-	}
-	if (options->escape_char == -1)
-		options->escape_char = '~';
-	if (options->system_hostfile == NULL)
-		options->system_hostfile = _PATH_SSH_SYSTEM_HOSTFILE;
-	if (options->user_hostfile == NULL)
-		options->user_hostfile = _PATH_SSH_USER_HOSTFILE;
-	if (options->system_hostfile2 == NULL)
-		options->system_hostfile2 = _PATH_SSH_SYSTEM_HOSTFILE2;
-	if (options->user_hostfile2 == NULL)
-		options->user_hostfile2 = _PATH_SSH_USER_HOSTFILE2;
-	if (options->log_level == SYSLOG_LEVEL_NOT_SET)
-		options->log_level = SYSLOG_LEVEL_INFO;
-	if (options->clear_forwardings == 1)
-		clear_forwardings(options);
-	if (options->no_host_authentication_for_localhost == - 1)
-		options->no_host_authentication_for_localhost = 0;
-	if (options->enable_ssh_keysign == -1)
-		options->enable_ssh_keysign = 0;
-	/* options->proxy_command should not be set by default */
-	/* options->user will be set in the main program if appropriate */
-	/* options->hostname will be set in the main program if appropriate */
-	/* options->host_key_alias should not be set by default */
-	/* options->preferred_authentications will be set in ssh */
-}
diff --git a/crypto/openssh/readconf.h b/crypto/openssh/readconf.h
deleted file mode 100644
index 78e04fedf98b..000000000000
--- a/crypto/openssh/readconf.h
+++ /dev/null
@@ -1,118 +0,0 @@
-/*	$OpenBSD: readconf.h,v 1.46 2003/04/01 10:22:21 markus Exp $	*/
-
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * Functions for reading the configuration file.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#ifndef READCONF_H
-#define READCONF_H
-
-#include "key.h"
-
-/* Data structure for representing a forwarding request. */
-
-typedef struct {
-	u_short	  port;		/* Port to forward. */
-	char	 *host;		/* Host to connect. */
-	u_short	  host_port;	/* Port to connect on host. */
-}       Forward;
-/* Data structure for representing option data. */
-
-typedef struct {
-	int     forward_agent;	/* Forward authentication agent. */
-	int     forward_x11;	/* Forward X11 display. */
-	char   *xauth_location;	/* Location for xauth program */
-	int     gateway_ports;	/* Allow remote connects to forwarded ports. */
-	int     use_privileged_port;	/* Don't use privileged port if false. */
-	int     rhosts_authentication;	/* Try rhosts authentication. */
-	int     rhosts_rsa_authentication;	/* Try rhosts with RSA
-						 * authentication. */
-	int     rsa_authentication;	/* Try RSA authentication. */
-	int     pubkey_authentication;	/* Try ssh2 pubkey authentication. */
-	int     hostbased_authentication;	/* ssh2's rhosts_rsa */
-	int     challenge_response_authentication;
-					/* Try S/Key or TIS, authentication. */
-#if defined(KRB4) || defined(KRB5)
-	int     kerberos_authentication;	/* Try Kerberos authentication. */
-#endif
-#if defined(AFS) || defined(KRB5)
-	int     kerberos_tgt_passing;	/* Try Kerberos TGT passing. */
-#endif
-#ifdef AFS
-	int     afs_token_passing;	/* Try AFS token passing. */
-#endif
-	int     password_authentication;	/* Try password
-						 * authentication. */
-	int     kbd_interactive_authentication; /* Try keyboard-interactive auth. */
-	char	*kbd_interactive_devices; /* Keyboard-interactive auth devices. */
-	int     batch_mode;	/* Batch mode: do not ask for passwords. */
-	int     check_host_ip;	/* Also keep track of keys for IP address */
-	int     strict_host_key_checking;	/* Strict host key checking. */
-	int     compression;	/* Compress packets in both directions. */
-	int     compression_level;	/* Compression level 1 (fast) to 9
-					 * (best). */
-	int     keepalives;	/* Set SO_KEEPALIVE. */
-	LogLevel log_level;	/* Level for logging. */
-
-	int     port;		/* Port to connect. */
-	int     connection_attempts;	/* Max attempts (seconds) before
-					 * giving up */
-	int     number_of_password_prompts;	/* Max number of password
-						 * prompts. */
-	int     cipher;		/* Cipher to use. */
-	char   *ciphers;	/* SSH2 ciphers in order of preference. */
-	char   *macs;		/* SSH2 macs in order of preference. */
-	char   *hostkeyalgorithms;	/* SSH2 server key types in order of preference. */
-	int	protocol;	/* Protocol in order of preference. */
-	char   *hostname;	/* Real host to connect. */
-	char   *host_key_alias;	/* hostname alias for .ssh/known_hosts */
-	char   *proxy_command;	/* Proxy command for connecting the host. */
-	char   *user;		/* User to log in as. */
-	int     escape_char;	/* Escape character; -2 = none */
-
-	char   *system_hostfile;/* Path for /etc/ssh/ssh_known_hosts. */
-	char   *user_hostfile;	/* Path for $HOME/.ssh/known_hosts. */
-	char   *system_hostfile2;
-	char   *user_hostfile2;
-	char   *preferred_authentications;
-	char   *bind_address;	/* local socket address for connection to sshd */
-	char   *smartcard_device; /* Smartcard reader device */
-
-	int     num_identity_files;	/* Number of files for RSA/DSA identities. */
-	char   *identity_files[SSH_MAX_IDENTITY_FILES];
-	Key    *identity_keys[SSH_MAX_IDENTITY_FILES];
-
-	/* Local TCP/IP forward requests. */
-	int     num_local_forwards;
-	Forward local_forwards[SSH_MAX_FORWARDS_PER_DIRECTION];
-
-	/* Remote TCP/IP forward requests. */
-	int     num_remote_forwards;
-	Forward remote_forwards[SSH_MAX_FORWARDS_PER_DIRECTION];
-	int	clear_forwardings;
-
-	int	enable_ssh_keysign;
-	int	no_host_authentication_for_localhost;
-}       Options;
-
-
-void     initialize_options(Options *);
-void     fill_default_options(Options *);
-int	 read_config_file(const char *, const char *, Options *);
-
-int
-process_config_line(Options *, const char *, char *, const char *, int, int *);
-
-void	 add_local_forward(Options *, u_short, const char *, u_short);
-void	 add_remote_forward(Options *, u_short, const char *, u_short);
-
-#endif				/* READCONF_H */
diff --git a/crypto/openssh/readpass.c b/crypto/openssh/readpass.c
deleted file mode 100644
index 95ec5d873898..000000000000
--- a/crypto/openssh/readpass.c
+++ /dev/null
@@ -1,138 +0,0 @@
-/*
- * Copyright (c) 2001 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: readpass.c,v 1.28 2003/01/23 13:50:27 markus Exp $");
-
-#include "xmalloc.h"
-#include "readpass.h"
-#include "pathnames.h"
-#include "log.h"
-#include "ssh.h"
-
-static char *
-ssh_askpass(char *askpass, const char *msg)
-{
-	pid_t pid;
-	size_t len;
-	char *pass;
-	int p[2], status, ret;
-	char buf[1024];
-
-	if (fflush(stdout) != 0)
-		error("ssh_askpass: fflush: %s", strerror(errno));
-	if (askpass == NULL)
-		fatal("internal error: askpass undefined");
-	if (pipe(p) < 0) {
-		error("ssh_askpass: pipe: %s", strerror(errno));
-		return NULL;
-	}
-	if ((pid = fork()) < 0) {
-		error("ssh_askpass: fork: %s", strerror(errno));
-		return NULL;
-	}
-	if (pid == 0) {
-		seteuid(getuid());
-		setuid(getuid());
-		close(p[0]);
-		if (dup2(p[1], STDOUT_FILENO) < 0)
-			fatal("ssh_askpass: dup2: %s", strerror(errno));
-		execlp(askpass, askpass, msg, (char *) 0);
-		fatal("ssh_askpass: exec(%s): %s", askpass, strerror(errno));
-	}
-	close(p[1]);
-
-	len = ret = 0;
-	do {
-		ret = read(p[0], buf + len, sizeof(buf) - 1 - len);
-		if (ret == -1 && errno == EINTR)
-			continue;
-		if (ret <= 0)
-			break;
-		len += ret;
-	} while (sizeof(buf) - 1 - len > 0);
-	buf[len] = '\0';
-
-	close(p[0]);
-	while (waitpid(pid, &status, 0) < 0)
-		if (errno != EINTR)
-			break;
-
-	if (!WIFEXITED(status) || WEXITSTATUS(status) != 0) {
-		memset(buf, 0, sizeof(buf));
-		return NULL;
-	}
-
-	buf[strcspn(buf, "\r\n")] = '\0';
-	pass = xstrdup(buf);
-	memset(buf, 0, sizeof(buf));
-	return pass;
-}
-
-/*
- * Reads a passphrase from /dev/tty with echo turned off/on.  Returns the
- * passphrase (allocated with xmalloc).  Exits if EOF is encountered. If
- * RP_ALLOW_STDIN is set, the passphrase will be read from stdin if no
- * tty is available
- */
-char *
-read_passphrase(const char *prompt, int flags)
-{
-	char *askpass = NULL, *ret, buf[1024];
-	int rppflags, use_askpass = 0, ttyfd;
-
-	rppflags = (flags & RP_ECHO) ? RPP_ECHO_ON : RPP_ECHO_OFF;
-	if (flags & RP_ALLOW_STDIN) {
-		if (!isatty(STDIN_FILENO))
-			use_askpass = 1;
-	} else {
-		rppflags |= RPP_REQUIRE_TTY;
-		ttyfd = open(_PATH_TTY, O_RDWR);
-		if (ttyfd >= 0)
-			close(ttyfd);
-		else
-			use_askpass = 1;
-	}
-
-	if (use_askpass && getenv("DISPLAY")) {
-		if (getenv(SSH_ASKPASS_ENV))
-			askpass = getenv(SSH_ASKPASS_ENV);
-		else
-			askpass = _PATH_SSH_ASKPASS_DEFAULT;
-		if ((ret = ssh_askpass(askpass, prompt)) == NULL)
-			if (!(flags & RP_ALLOW_EOF))
-				return xstrdup("");
-		return ret;
-	}
-
-	if (readpassphrase(prompt, buf, sizeof buf, rppflags) == NULL) {
-		if (flags & RP_ALLOW_EOF)
-			return NULL;
-		return xstrdup("");
-	}
-
-	ret = xstrdup(buf);
-	memset(buf, 'x', sizeof buf);
-	return ret;
-}
diff --git a/crypto/openssh/readpass.h b/crypto/openssh/readpass.h
deleted file mode 100644
index a45d32f2a76b..000000000000
--- a/crypto/openssh/readpass.h
+++ /dev/null
@@ -1,19 +0,0 @@
-/*	$OpenBSD: readpass.h,v 1.7 2002/03/26 15:58:46 markus Exp $	*/
-
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#define RP_ECHO			0x0001
-#define RP_ALLOW_STDIN		0x0002
-#define RP_ALLOW_EOF		0x0004
-
-char	*read_passphrase(const char *, int);
diff --git a/crypto/openssh/regress/Makefile b/crypto/openssh/regress/Makefile
deleted file mode 100644
index 6e2029348b86..000000000000
--- a/crypto/openssh/regress/Makefile
+++ /dev/null
@@ -1,79 +0,0 @@
-#	$OpenBSD: Makefile,v 1.20 2003/01/08 23:54:22 djm Exp $
-
-REGRESS_TARGETS=	t1 t2 t3 t4 t5 t6 t7
-
-CLEANFILES+=	t2.out t6.out1 t6.out2 t7.out t7.out.pub copy.1 copy.2
-
-LTESTS= 	connect \
-		proxy-connect \
-		connect-privsep \
-		proto-version \
-		proto-mismatch \
-		exit-status \
-		transfer \
-		stderr-data \
-		stderr-after-eof \
-		broken-pipe \
-		try-ciphers \
-		yes-head \
-		agent \
-		agent-getpeereid \
-		agent-timeout \
-		agent-ptrace \
-		keyscan \
-		keygen-change \
-		sftp \
-		sftp-cmds \
-		sftp-batch \
-		forwarding
-
-USER!=		id -un
-CLEANFILES+=	authorized_keys_${USER} known_hosts pidfile \
-		ssh_config ssh_proxy sshd_config sshd_proxy \
-		rsa.pub rsa rsa1.pub rsa1 host.rsa host.rsa1 \
-		rsa-agent rsa-agent.pub rsa1-agent rsa1-agent.pub \
-		ls.copy
-
-#LTESTS+=	ssh-com ssh-com-client ssh-com-keygen ssh-com-sftp
-
-t1:
-	ssh-keygen -if ${.CURDIR}/rsa_ssh2.prv | diff - ${.CURDIR}/rsa_openssh.prv
-
-t2:
-	cat ${.CURDIR}/rsa_openssh.prv > t2.out
-	chmod 600 t2.out
-	ssh-keygen -yf t2.out | diff - ${.CURDIR}/rsa_openssh.pub
-
-t3:
-	ssh-keygen -ef ${.CURDIR}/rsa_openssh.pub |\
-		ssh-keygen -if /dev/stdin |\
-		diff - ${.CURDIR}/rsa_openssh.pub
-
-t4:
-	ssh-keygen -lf ${.CURDIR}/rsa_openssh.pub |\
-		awk '{print $$2}' | diff - ${.CURDIR}/t4.ok
-
-t5:
-	ssh-keygen -Bf ${.CURDIR}/rsa_openssh.pub |\
-		awk '{print $$2}' | diff - ${.CURDIR}/t5.ok
-
-t6:
-	ssh-keygen -if ${.CURDIR}/dsa_ssh2.prv > t6.out1
-	ssh-keygen -if ${.CURDIR}/dsa_ssh2.pub > t6.out2
-	chmod 600 t6.out1
-	ssh-keygen -yf t6.out1 | diff - t6.out2
-
-t7.out:
-	ssh-keygen -q -t rsa -N '' -f $@
-
-t7: t7.out
-	ssh-keygen -lf t7.out > /dev/null
-	ssh-keygen -Bf t7.out > /dev/null
-
-.for t in ${LTESTS}
-REGRESS_TARGETS+=t-${t}
-t-${t}:
-	sh ${.CURDIR}/test-exec.sh ${.OBJDIR} ${.CURDIR}/${t}.sh
-.endfor
-
-.include "bsd.regress.mk"
diff --git a/crypto/openssh/regress/agent-getpeereid.sh b/crypto/openssh/regress/agent-getpeereid.sh
deleted file mode 100644
index 0889fe80e3f0..000000000000
--- a/crypto/openssh/regress/agent-getpeereid.sh
+++ /dev/null
@@ -1,34 +0,0 @@
-#	$OpenBSD: agent-getpeereid.sh,v 1.1 2002/12/09 16:05:02 markus Exp $
-#	Placed in the Public Domain.
-
-tid="disallow agent attach from other uid"
-
-UNPRIV=nobody
-ASOCK=${OBJ}/agent
-SSH_AUTH_SOCK=/nonexistant
-
-trace "start agent"
-eval `${SSHAGENT} -s -a ${ASOCK}` > /dev/null
-r=$?
-if [ $r -ne 0 ]; then
-	fail "could not start ssh-agent: exit code $r"
-else
-	chmod 644 ${SSH_AUTH_SOCK}
-
-	ssh-add -l > /dev/null 2>&1
-	r=$?
-	if [ $r -ne 1 ]; then
-		fail "ssh-add failed with $r != 1"
-	fi
-
-	< /dev/null sudo -S -u ${UNPRIV} ssh-add -l > /dev/null 2>&1
-	r=$?
-	if [ $r -lt 2 ]; then
-		fail "ssh-add did not fail for ${UNPRIV}: $r < 2"
-	fi
-
-	trace "kill agent"
-	${SSHAGENT} -k > /dev/null
-fi
-
-rm -f ${OBJ}/agent
diff --git a/crypto/openssh/regress/agent-ptrace.sh b/crypto/openssh/regress/agent-ptrace.sh
deleted file mode 100644
index 9f9c99960ca6..000000000000
--- a/crypto/openssh/regress/agent-ptrace.sh
+++ /dev/null
@@ -1,28 +0,0 @@
-#	$OpenBSD: agent-ptrace.sh,v 1.1 2002/12/09 15:38:30 markus Exp $
-#	Placed in the Public Domain.
-
-tid="disallow agent ptrace attach"
-
-trace "start agent"
-eval `${SSHAGENT} -s` > /dev/null
-r=$?
-if [ $r -ne 0 ]; then
-	fail "could not start ssh-agent: exit code $r"
-else
-	# ls -l ${SSH_AUTH_SOCK}
-	gdb ${SSHAGENT} ${SSH_AGENT_PID} > ${OBJ}/gdb.out 2>&1 << EOF
-		quit
-EOF
-	if [ $? -ne 0 ]; then
-		fail "gdb failed: exit code $?"
-	fi
-	grep -q 'ptrace: Operation not permitted.' ${OBJ}/gdb.out
-	r=$?
-	rm -f ${OBJ}/gdb.out
-	if [ $r -ne 0 ]; then
-		fail "ptrace succeeded?: exit code $r"
-	fi
-
-	trace "kill agent"
-	${SSHAGENT} -k > /dev/null
-fi
diff --git a/crypto/openssh/regress/agent-timeout.sh b/crypto/openssh/regress/agent-timeout.sh
deleted file mode 100644
index 28b1be028113..000000000000
--- a/crypto/openssh/regress/agent-timeout.sh
+++ /dev/null
@@ -1,36 +0,0 @@
-#	$OpenBSD: agent-timeout.sh,v 1.1 2002/06/06 00:38:40 markus Exp $
-#	Placed in the Public Domain.
-
-tid="agent timeout test"
-
-TIMEOUT=5
-
-trace "start agent"
-eval `${SSHAGENT} -s` > /dev/null
-r=$?
-if [ $r -ne 0 ]; then
-	fail "could not start ssh-agent: exit code $r"
-else
-	trace "add keys with timeout"
-	for t in rsa rsa1; do
-		${SSHADD} -t ${TIMEOUT} $OBJ/$t > /dev/null 2>&1
-		if [ $? -ne 0 ]; then
-			fail "ssh-add did succeed exit code 0"
-		fi
-	done
-	n=`${SSHADD} -l 2> /dev/null | wc -l`
-	trace "agent has $n keys"
-	if [ $n -ne 2 ]; then
-		fail "ssh-add -l did not return 2 keys: $n"
-	fi
-	trace "sleeping 2*${TIMEOUT} seconds"
-	sleep ${TIMEOUT}
-	sleep ${TIMEOUT}
-	${SSHADD} -l 2> /dev/null | grep -q 'The agent has no identities.'
-	if [ $? -ne 0 ]; then
-		fail "ssh-add -l still returns keys after timeout"
-	fi
-
-	trace "kill agent"
-	${SSHAGENT} -k > /dev/null
-fi
diff --git a/crypto/openssh/regress/agent.sh b/crypto/openssh/regress/agent.sh
deleted file mode 100644
index 7e9b4cb1870a..000000000000
--- a/crypto/openssh/regress/agent.sh
+++ /dev/null
@@ -1,75 +0,0 @@
-#	$OpenBSD: agent.sh,v 1.6 2002/03/15 13:08:56 markus Exp $
-#	Placed in the Public Domain.
-
-tid="simple agent test"
-
-SSH_AUTH_SOCK=/nonexistant ${SSHADD} -l > /dev/null 2>&1
-if [ $? -ne 2 ]; then
-	fail "ssh-add -l did not fail with exit code 2"
-fi
-
-trace "start agent"
-eval `${SSHAGENT} -s` > /dev/null
-r=$?
-if [ $r -ne 0 ]; then
-	fail "could not start ssh-agent: exit code $r"
-else
-	${SSHADD} -l > /dev/null 2>&1
-	if [ $? -ne 1 ]; then
-		fail "ssh-add -l did not fail with exit code 1"
-	fi
-	trace "overwrite authorized keys"
-	echo -n > $OBJ/authorized_keys_$USER
-	for t in rsa rsa1; do
-		# generate user key for agent
-		rm -f $OBJ/$t-agent
-		${SSHKEYGEN} -q -N '' -t $t -f $OBJ/$t-agent ||\
-			 fail "ssh-keygen for $t-agent failed"
-		# add to authorized keys
-		cat $OBJ/$t-agent.pub >> $OBJ/authorized_keys_$USER
-		# add privat key to agent
-		${SSHADD} $OBJ/$t-agent > /dev/null 2>&1
-		if [ $? -ne 0 ]; then
-			fail "ssh-add did succeed exit code 0"
-		fi
-	done
-	${SSHADD} -l > /dev/null 2>&1
-	if [ $? -ne 0 ]; then
-		fail "ssh-add -l failed: exit code $?"
-	fi
-	# the same for full pubkey output
-	${SSHADD} -L > /dev/null 2>&1
-	if [ $? -ne 0 ]; then
-		fail "ssh-add -L failed: exit code $?"
-	fi
-
-	trace "simple connect via agent"
-	for p in 1 2; do
-		${SSH} -$p -F $OBJ/ssh_proxy somehost exit 5$p
-		if [ $? -ne 5$p ]; then
-			fail "ssh connect with protocol $p failed (exit code $?)"
-		fi
-	done
-
-	trace "agent forwarding"
-	for p in 1 2; do
-		${SSH} -A -$p -F $OBJ/ssh_proxy somehost ${SSHADD} -l > /dev/null 2>&1
-		if [ $? -ne 0 ]; then
-			fail "ssh-add -l via agent fwd proto $p failed (exit code $?)"
-		fi
-		${SSH} -A -$p -F $OBJ/ssh_proxy somehost \
-			"${SSH} -$p -F $OBJ/ssh_proxy somehost exit 5$p"
-		if [ $? -ne 5$p ]; then
-			fail "agent fwd proto $p failed (exit code $?)"
-		fi
-	done
-
-	trace "delete all agent keys"
-	${SSHADD} -D > /dev/null 2>&1
-	if [ $? -ne 0 ]; then
-		fail "ssh-add -D failed: exit code $?"
-	fi
-
-	trace "kill agent"
-	${SSHAGENT} -k > /dev/null
-fi
diff --git a/crypto/openssh/regress/authorized_keys_root b/crypto/openssh/regress/authorized_keys_root
deleted file mode 100644
index 328537120b68..000000000000
--- a/crypto/openssh/regress/authorized_keys_root
+++ /dev/null
@@ -1,2 +0,0 @@
-ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAt6ttBacbgvLPsF1VWWfT51t55/5Mj62Xp8EaoH5SNSaLiGIgrrja077lKEept75U4uKFUYU5JJX9GPE9A7Y43LXv+/A6Jm4rEj/U0s4H8tf0UmzVC3t6xh0sRK0hYVNILyoHnIAgdY8CmOiybw7p6DxJY8MRAehD3n9+kFcachU= root@xenon
-1024 35 132789427207755621599908461558918671787816692978751485815532032934821830960131244604702969298486352138126114080367609979552547448841583955126231410604842765726397407176910594168641969541792069550006878863592030567875913190224374005367884774859544943329148178663694126456638431428703289837638970464685771819219 root@xenon
diff --git a/crypto/openssh/regress/broken-pipe.sh b/crypto/openssh/regress/broken-pipe.sh
deleted file mode 100644
index c08c849a7581..000000000000
--- a/crypto/openssh/regress/broken-pipe.sh
+++ /dev/null
@@ -1,15 +0,0 @@
-#	$OpenBSD: broken-pipe.sh,v 1.4 2002/03/15 13:08:56 markus Exp $
-#	Placed in the Public Domain.
-
-tid="broken pipe test"
-
-for p in 1 2; do
-	trace "protocol $p"
-	for i in 1 2 3 4; do
-		${SSH} -$p -F $OBJ/ssh_config_config nexthost echo $i 2> /dev/null | true
-		r=$?
-		if [ $r -ne 0 ]; then
-			fail "broken pipe returns $r for protocol $p"
-		fi
-	done
-done
diff --git a/crypto/openssh/regress/bsd.regress.mk b/crypto/openssh/regress/bsd.regress.mk
deleted file mode 100644
index 9b8011a01af6..000000000000
--- a/crypto/openssh/regress/bsd.regress.mk
+++ /dev/null
@@ -1,79 +0,0 @@
-#	$OpenBSD: bsd.regress.mk,v 1.9 2002/02/17 01:10:15 marc Exp $
-# No man pages for regression tests.
-NOMAN=
-
-# No installation.
-install:
-
-# If REGRESSTARGETS is defined and PROG is not defined, set NOPROG
-.if defined(REGRESSTARGETS) && !defined(PROG)
-NOPROG=
-.endif
-
-.include <bsd.prog.mk>
-
-.MAIN: all
-all: regress
-
-# XXX - Need full path to REGRESSLOG, otherwise there will be much pain.
-
-REGRESSLOG?=/dev/null
-REGRESSNAME=${.CURDIR:S/${BSDSRCDIR}\/regress\///}
-
-.if defined(PROG) && !empty(PROG)
-run-regress-${PROG}: ${PROG}
-	./${PROG}
-.endif
-
-.if !defined(REGRESSTARGETS)
-REGRESSTARGETS=run-regress-${PROG}
-.  if defined(REGRESSSKIP)
-REGRESSSKIPTARGETS=run-regress-${PROG}
-.  endif
-.endif
-
-REGRESSSKIPSLOW?=no
-
-#.if (${REGRESSSKIPSLOW:L} == "yes") && defined(REGRESSSLOWTARGETS)
-
-.if (${REGRESSSKIPSLOW} == "yes") && defined(REGRESSSLOWTARGETS)
-REGRESSSKIPTARGETS+=${REGRESSSLOWTARGETS}
-.endif
-
-.if defined(REGRESSROOTTARGETS)
-ROOTUSER!=id -g
-SUDO?=
-. if (${ROOTUSER} != 0) && empty(SUDO)
-REGRESSSKIPTARGETS+=${REGRESSROOTTARGETS}
-. endif
-.endif
-
-REGRESSSKIPTARGETS?=
-
-regress:
-.for RT in ${REGRESSTARGETS} 
-.  if ${REGRESSSKIPTARGETS:M${RT}}
-	@echo -n "SKIP " >> ${REGRESSLOG}
-.  else
-# XXX - we need a better method to see if a test fails due to timeout or just
-#       normal failure.
-.   if !defined(REGRESSMAXTIME)
-	@if cd ${.CURDIR} && ${MAKE} ${RT}; then \
-	    echo -n "SUCCESS " >> ${REGRESSLOG} ; \
-	else \
-	    echo -n "FAIL " >> ${REGRESSLOG} ; \
-	    echo FAILED ; \
-	fi
-.   else
-	@if cd ${.CURDIR} && (ulimit -t ${REGRESSMAXTIME} ; ${MAKE} ${RT}); then \
-	    echo -n "SUCCESS " >> ${REGRESSLOG} ; \
-	else \
-	    echo -n "FAIL (possible timeout) " >> ${REGRESSLOG} ; \
-	    echo FAILED ; \
-	fi
-.   endif
-.  endif
-	@echo ${REGRESSNAME}/${RT:S/^run-regress-//} >> ${REGRESSLOG}
-.endfor
-
-.PHONY: regress
diff --git a/crypto/openssh/regress/connect-privsep.sh b/crypto/openssh/regress/connect-privsep.sh
deleted file mode 100644
index d23cadba5255..000000000000
--- a/crypto/openssh/regress/connect-privsep.sh
+++ /dev/null
@@ -1,13 +0,0 @@
-#	$OpenBSD: connect-privsep.sh,v 1.1 2002/03/21 21:45:07 markus Exp $
-#	Placed in the Public Domain.
-
-tid="proxy connect with privsep"
-
-echo 'UsePrivilegeSeparation yes' >> $OBJ/sshd_proxy
-
-for p in 1 2; do
-	${SSH} -$p -F $OBJ/ssh_proxy 999.999.999.999 true
-	if [ $? -ne 0 ]; then
-		fail "ssh privsep+proxyconnect protocol $p failed"
-	fi
-done
diff --git a/crypto/openssh/regress/connect.sh b/crypto/openssh/regress/connect.sh
deleted file mode 100644
index 2186fa6e7eb9..000000000000
--- a/crypto/openssh/regress/connect.sh
+++ /dev/null
@@ -1,13 +0,0 @@
-#	$OpenBSD: connect.sh,v 1.4 2002/03/15 13:08:56 markus Exp $
-#	Placed in the Public Domain.
-
-tid="simple connect"
-
-start_sshd
-
-for p in 1 2; do
-	${SSH} -o "Protocol=$p" -F $OBJ/ssh_config somehost true
-	if [ $? -ne 0 ]; then
-		fail "ssh connect with protocol $p failed"
-	fi
-done
diff --git a/crypto/openssh/regress/copy.1 b/crypto/openssh/regress/copy.1
deleted file mode 100755
index 92d4d20f9fba..000000000000
--- a/crypto/openssh/regress/copy.1
+++ /dev/null
diff --git a/crypto/openssh/regress/copy.2 b/crypto/openssh/regress/copy.2
deleted file mode 100755
index 92d4d20f9fba..000000000000
--- a/crypto/openssh/regress/copy.2
+++ /dev/null
diff --git a/crypto/openssh/regress/dsa_ssh2.prv b/crypto/openssh/regress/dsa_ssh2.prv
deleted file mode 100644
index c93b4037194c..000000000000
--- a/crypto/openssh/regress/dsa_ssh2.prv
+++ /dev/null
@@ -1,14 +0,0 @@
----- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----
-Subject: ssh-keygen test
-Comment: "1024-bit dsa, Tue Jan 08 2002 22:00:23 +0100"
-P2/56wAAAgIAAAAmZGwtbW9kcHtzaWdue2RzYS1uaXN0LXNoYTF9LGRoe3BsYWlufX0AAA
-AEbm9uZQAAAcQAAAHAAAAAAAAABACwUfm3AxZTut3icBmwCcD48nY64HzuELlQ+vEqjIcR
-Lo49es/DQTeLNQ+kdKRCfouosGNv0WqxRtF0tUsWdXxS37oHGa4QPugBdHRd7YlZGZv8kg
-x7FsoepY7v7E683/97dv2zxL3AGagTEzWr7fl0yPexAaZoDvtQrrjX44BLmwAABACWQkvv
-MxnD8eFkS1konFfMJ1CkuRfTN34CBZ6dY7VTSGemy4QwtFdMKmoufD0eKgy3p5WOeWCYKt
-F4FhjHKZk/aaxFjjIbtkrnlvXg64QI11dSZyBN6/ViQkHPSkUDF+A6AAEhrNbQbAFSvao1
-kTvNtPCtL0AkUIduEMzGQfLCTAAAAKDeC043YVo9Zo0zAEeIA4uZh4LBCQAAA/9aj7Y5ik
-ehygJ4qTDSlVypsPuV+n59tMS0e2pfrSG87yf5r94AKBmJeho5OO6wYaXCxsVB7AFbSUD6
-75AK8mHF4v1/+7SWKk5f8xlMCMSPZ9K0+j/W1d/q2qkhnnDZolOHDomLA+U00i5ya/jnTV
-zyDPWLFpWK8u3xGBPAYX324gAAAKDHFvooRnaXdZbeWGTTqmgHB1GU9A==
----- END SSH2 ENCRYPTED PRIVATE KEY ----
diff --git a/crypto/openssh/regress/dsa_ssh2.pub b/crypto/openssh/regress/dsa_ssh2.pub
deleted file mode 100644
index 215d73baef31..000000000000
--- a/crypto/openssh/regress/dsa_ssh2.pub
+++ /dev/null
@@ -1,13 +0,0 @@
----- BEGIN SSH2 PUBLIC KEY ----
-Subject: ssh-keygen test
-Comment: "1024-bit dsa, Tue Jan 08 2002 22:00:23 +0100"
-AAAAB3NzaC1kc3MAAACBALBR+bcDFlO63eJwGbAJwPjydjrgfO4QuVD68SqMhxEujj16z8
-NBN4s1D6R0pEJ+i6iwY2/RarFG0XS1SxZ1fFLfugcZrhA+6AF0dF3tiVkZm/ySDHsWyh6l
-ju/sTrzf/3t2/bPEvcAZqBMTNavt+XTI97EBpmgO+1CuuNfjgEubAAAAFQDeC043YVo9Zo
-0zAEeIA4uZh4LBCQAAAIEAlkJL7zMZw/HhZEtZKJxXzCdQpLkX0zd+AgWenWO1U0hnpsuE
-MLRXTCpqLnw9HioMt6eVjnlgmCrReBYYxymZP2msRY4yG7ZK55b14OuECNdXUmcgTev1Yk
-JBz0pFAxfgOgABIazW0GwBUr2qNZE7zbTwrS9AJFCHbhDMxkHywkwAAACAWo+2OYpHocoC
-eKkw0pVcqbD7lfp+fbTEtHtqX60hvO8n+a/eACgZiXoaOTjusGGlwsbFQewBW0lA+u+QCv
-JhxeL9f/u0lipOX/MZTAjEj2fStPo/1tXf6tqpIZ5w2aJThw6JiwPlNNIucmv4501c8gz1
-ixaVivLt8RgTwGF99uI=
----- END SSH2 PUBLIC KEY ----
diff --git a/crypto/openssh/regress/exit-status.sh b/crypto/openssh/regress/exit-status.sh
deleted file mode 100644
index 56b78a622b7a..000000000000
--- a/crypto/openssh/regress/exit-status.sh
+++ /dev/null
@@ -1,24 +0,0 @@
-#	$OpenBSD: exit-status.sh,v 1.6 2002/03/15 13:08:56 markus Exp $
-#	Placed in the Public Domain.
-
-tid="remote exit status"
-
-for p in 1 2; do
-	for s in 0 1 4 5 44; do
-		trace "proto $p status $s"
-		verbose "test $tid: proto $p status $s"
-		${SSH} -$p -F $OBJ/ssh_proxy otherhost exit $s
-		r=$?
-		if [ $r -ne $s ]; then
-			fail "exit code mismatch for protocol $p: $r != $s"
-		fi
-
-		# same with early close of stdout/err
-		${SSH} -$p -F $OBJ/ssh_proxy -n otherhost \
-                	exec sh -c \'"sleep 2; exec > /dev/null 2>&1; sleep 3; exit $s"\'
-		r=$?
-		if [ $r -ne $s ]; then
-			fail "exit code (with sleep) mismatch for protocol $p: $r != $s"
-		fi
-	done
-done
diff --git a/crypto/openssh/regress/forwarding.sh b/crypto/openssh/regress/forwarding.sh
deleted file mode 100644
index 7b281c0133d4..000000000000
--- a/crypto/openssh/regress/forwarding.sh
+++ /dev/null
@@ -1,33 +0,0 @@
-#	$OpenBSD: forwarding.sh,v 1.4 2002/03/15 13:08:56 markus Exp $
-#	Placed in the Public Domain.
-
-tid="local and remote forwarding"
-
-start_sshd
-
-base=33
-last=$PORT
-fwd=""
-for j in 0 1 2; do
-	for i in 0 1 2; do
-		a=$base$j$i
-		b=`expr $a + 50`
-		c=$last
-		# fwd chain: $a -> $b -> $c
-		fwd="$fwd -L$a:127.0.0.1:$b -R$b:127.0.0.1:$c"
-		last=$a
-	done
-done
-for p in 1 2; do
-	q=`expr 3 - $p`
-	trace "start forwarding, fork to background"
-	${SSH} -$p -F $OBJ/ssh_config -f $fwd somehost sleep 10
-
-	trace "transfer over forwarded channels and check result"
-	${SSH} -$q -F $OBJ/ssh_config -p$last -o 'ConnectionAttempts=4' \
-		somehost cat /bin/ls > $OBJ/ls.copy
-	test -f $OBJ/ls.copy			|| fail "failed copy /bin/ls"
-	cmp /bin/ls $OBJ/ls.copy		|| fail "corrupted copy of /bin/ls"
-
-	sleep 10
-done
diff --git a/crypto/openssh/regress/keygen-change.sh b/crypto/openssh/regress/keygen-change.sh
deleted file mode 100644
index 08d35902301b..000000000000
--- a/crypto/openssh/regress/keygen-change.sh
+++ /dev/null
@@ -1,23 +0,0 @@
-#	$OpenBSD: keygen-change.sh,v 1.2 2002/07/16 09:15:55 markus Exp $
-#	Placed in the Public Domain.
-
-tid="change passphrase for key"
-
-S1="secret1"
-S2="2secret"
-
-for t in rsa dsa rsa1; do
-	# generate user key for agent
-	trace "generating $t key"
-	rm -f $OBJ/$t-key
-	${SSHKEYGEN} -q -N ${S1} -t $t -f $OBJ/$t-key
-	if [ $? -eq 0 ]; then
-		${SSHKEYGEN} -p -P ${S1} -N ${S2} -f $OBJ/$t-key > /dev/null
-		if [ $? -ne 0 ]; then
-			fail "ssh-keygen -p failed for $t-key"
-		fi
-	else
-		fail "ssh-keygen for $t-key failed"
-	fi
-	rm -f $OBJ/$t-key $OBJ/$t-key.pub
-done
diff --git a/crypto/openssh/regress/keyscan.sh b/crypto/openssh/regress/keyscan.sh
deleted file mode 100644
index 33f14f0fcc9d..000000000000
--- a/crypto/openssh/regress/keyscan.sh
+++ /dev/null
@@ -1,19 +0,0 @@
-#	$OpenBSD: keyscan.sh,v 1.3 2002/03/15 13:08:56 markus Exp $
-#	Placed in the Public Domain.
-
-tid="keyscan"
-
-# remove DSA hostkey
-rm -f ${OBJ}/host.dsa
-
-start_sshd
-
-for t in rsa1 rsa dsa; do
-	trace "keyscan type $t"
-	${SSHKEYSCAN} -t $t -p $PORT 127.0.0.1 127.0.0.1 127.0.0.1 \
-		> /dev/null 2>&1
-	r=$?
-	if [ $r -ne 0 ]; then
-		fail "ssh-keyscan -t $t failed with: $r"
-	fi
-done
diff --git a/crypto/openssh/regress/proto-mismatch.sh b/crypto/openssh/regress/proto-mismatch.sh
deleted file mode 100644
index fb521f214fd1..000000000000
--- a/crypto/openssh/regress/proto-mismatch.sh
+++ /dev/null
@@ -1,19 +0,0 @@
-#	$OpenBSD: proto-mismatch.sh,v 1.3 2002/03/15 13:08:56 markus Exp $
-#	Placed in the Public Domain.
-
-tid="protocol version mismatch"
-
-mismatch ()
-{
-	server=$1
-	client=$2
-	banner=`echo ${client} | ${SSHD} -o "Protocol=${server}" -i -f ${OBJ}/sshd_proxy`
-	r=$?
-	trace "sshd prints ${banner}"
-	if [ $r -ne 255 ]; then
-		fail "sshd prints ${banner} and accepts connect with version ${client}"
-	fi
-}
-
-mismatch	2	SSH-1.5-HALLO
-mismatch	1	SSH-2.0-HALLO
diff --git a/crypto/openssh/regress/proto-version.sh b/crypto/openssh/regress/proto-version.sh
deleted file mode 100644
index 7dc616f5fedd..000000000000
--- a/crypto/openssh/regress/proto-version.sh
+++ /dev/null
@@ -1,34 +0,0 @@
-#	$OpenBSD: proto-version.sh,v 1.3 2002/03/15 13:08:56 markus Exp $
-#	Placed in the Public Domain.
-
-tid="sshd version with different protocol combinations"
-
-# we just start sshd in inetd mode and check the banner
-check_version ()
-{
-	version=$1
-	expect=$2
-	banner=`echo -n | ${SSHD} -o "Protocol=${version}" -i -f ${OBJ}/sshd_proxy`
-	case ${banner} in
-	SSH-1.99-*)
-		proto=199
-		;;
-	SSH-2.0-*)
-		proto=20
-		;;
-	SSH-1.5-*)
-		proto=15
-		;;
-	*)
-		proto=0
-		;;
-	esac
-	if [ ${expect} -ne ${proto} ]; then
-		fail "wrong protocol version ${banner} for ${version}"
-	fi
-}
-
-check_version	2,1	199
-check_version	1,2	199
-check_version	2	20
-check_version	1	15
diff --git a/crypto/openssh/regress/proxy-connect.sh b/crypto/openssh/regress/proxy-connect.sh
deleted file mode 100644
index 6a36b2513b5a..000000000000
--- a/crypto/openssh/regress/proxy-connect.sh
+++ /dev/null
@@ -1,18 +0,0 @@
-#	$OpenBSD: proxy-connect.sh,v 1.5 2002/12/09 15:28:46 markus Exp $
-#	Placed in the Public Domain.
-
-tid="proxy connect"
-
-for p in 1 2; do
-	${SSH} -$p -F $OBJ/ssh_proxy 999.999.999.999 true
-	if [ $? -ne 0 ]; then
-		fail "ssh proxyconnect protocol $p failed"
-	fi
-	SSH_CONNECTION=`${SSH} -$p -F $OBJ/ssh_proxy 999.999.999.999 'echo $SSH_CONNECTION'`
-	if [ $? -ne 0 ]; then
-		fail "ssh proxyconnect protocol $p failed"
-	fi
-	if [ "$SSH_CONNECTION" != "UNKNOWN 65535 UNKNOWN 65535" ]; then
-		fail "bad SSH_CONNECTION"
-	fi
-done
diff --git a/crypto/openssh/regress/rsa_openssh.prv b/crypto/openssh/regress/rsa_openssh.prv
deleted file mode 100644
index 2675555723b5..000000000000
--- a/crypto/openssh/regress/rsa_openssh.prv
+++ /dev/null
@@ -1,15 +0,0 @@
------BEGIN RSA PRIVATE KEY-----
-MIICWgIBAAKBgQDsilwKcaKN6wSMNd1WgQ9+HRqQEkD0kCTVttrazGu0OhBU3Uko
-+dFD1Ip0CxdXmN25JQWxOYF7h/Ocu8P3jzv3RTX87xKR0YzlXTLX+SLtF/ySebS3
-xWPrlfRUDhh03hR5V+8xxvvy9widPYKw/oItwGSueOsEq1LTczCDv2dAjQIDAQAB
-An8nH5VzvHkMbSqJ6eOYDsVwomRvYbH5IEaYl1x6VATITNvAu9kUdQ4NsSpuMc+7
-Jj9gKZvmO1y2YCKc0P/iO+i/eV0L+yQh1Rw18jQZll+12T+LZrKRav03YNvMx0gN
-wqWY48Kt6hv2/N/ebQzKRe79+D0t2cTh92hT7xENFLIBAkEBGnoGKFjAUkJCwO1V
-mzpUqMHpRZVOrqP9hUmPjzNJ5oBPFGe4+h1hoSRFOAzaNuZt8ssbqaLCkzB8bfzj
-qhZqAQJBANZekuUpp8iBLeLSagw5FkcPwPzq6zfExbhvsZXb8Bo/4SflNs4JHXwI
-7SD9Z8aJLvM4uQ/5M70lblDMQ40i3o0CQQDIJvBYBFL5tlOgakq/O7yi+wt0L5BZ
-9H79w5rCSAA0IHRoK/qI1urHiHC3f3vbbLk5UStfrqEaND/mm0shyNIBAkBLsYdC
-/ctt5Bc0wUGK4Vl5bBmj9LtrrMJ4FpBpLwj/69BwCuKoK9XKZ0h73p6XHveCEGRg
-PIlFX4MtaoLrwgU9AkBV2k4dgIws+X8YX65EsyyFjnlDqX4x0nSOjQB1msIKfHBr
-dh5XLDBTTCxnKhMJ0Yx/opgOvf09XHBFwaQntR5i
------END RSA PRIVATE KEY-----
diff --git a/crypto/openssh/regress/rsa_openssh.pub b/crypto/openssh/regress/rsa_openssh.pub
deleted file mode 100644
index b504730f3bb8..000000000000
--- a/crypto/openssh/regress/rsa_openssh.pub
+++ /dev/null
@@ -1 +0,0 @@
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDsilwKcaKN6wSMNd1WgQ9+HRqQEkD0kCTVttrazGu0OhBU3Uko+dFD1Ip0CxdXmN25JQWxOYF7h/Ocu8P3jzv3RTX87xKR0YzlXTLX+SLtF/ySebS3xWPrlfRUDhh03hR5V+8xxvvy9widPYKw/oItwGSueOsEq1LTczCDv2dAjQ==
diff --git a/crypto/openssh/regress/rsa_ssh2.prv b/crypto/openssh/regress/rsa_ssh2.prv
deleted file mode 100644
index 1ece3d7de559..000000000000
--- a/crypto/openssh/regress/rsa_ssh2.prv
+++ /dev/null
@@ -1,16 +0,0 @@
----- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----
-Subject: ssh-keygen test
-Comment: "1024-bit rsa, Sat Jun 23 2001 12:21:26 -0400"
-P2/56wAAAi4AAAA3aWYtbW9kbntzaWdue3JzYS1wa2NzMS1zaGExfSxlbmNyeXB0e3JzYS
-1wa2NzMXYyLW9hZXB9fQAAAARub25lAAAB3wAAAdsAAAARAQABAAAD9icflXO8eQxtKonp
-45gOxXCiZG9hsfkgRpiXXHpUBMhM28C72RR1Dg2xKm4xz7smP2Apm+Y7XLZgIpzQ/+I76L
-95XQv7JCHVHDXyNBmWX7XZP4tmspFq/Tdg28zHSA3CpZjjwq3qG/b8395tDMpF7v34PS3Z
-xOH3aFPvEQ0UsgEAAAQA7IpcCnGijesEjDXdVoEPfh0akBJA9JAk1bba2sxrtDoQVN1JKP
-nRQ9SKdAsXV5jduSUFsTmBe4fznLvD948790U1/O8SkdGM5V0y1/ki7Rf8knm0t8Vj65X0
-VA4YdN4UeVfvMcb78vcInT2CsP6CLcBkrnjrBKtS03Mwg79nQI0AAAH/VdpOHYCMLPl/GF
-+uRLMshY55Q6l+MdJ0jo0AdZrCCnxwa3YeVywwU0wsZyoTCdGMf6KYDr39PVxwRcGkJ7Ue
-YgAAAgDWXpLlKafIgS3i0moMORZHD8D86us3xMW4b7GV2/AaP+En5TbOCR18CO0g/WfGiS
-7zOLkP+TO9JW5QzEONIt6NAAACAQEaegYoWMBSQkLA7VWbOlSowelFlU6uo/2FSY+PM0nm
-gE8UZ7j6HWGhJEU4DNo25m3yyxuposKTMHxt/OOqFmoB
----- END SSH2 ENCRYPTED PRIVATE KEY ----
----
diff --git a/crypto/openssh/regress/runtests.sh b/crypto/openssh/regress/runtests.sh
deleted file mode 100755
index 9808eb8a7651..000000000000
--- a/crypto/openssh/regress/runtests.sh
+++ /dev/null
@@ -1,13 +0,0 @@
-#!/bin/sh
-
-TEST_SSH_SSH=../ssh
-TEST_SSH_SSHD=../sshd
-TEST_SSH_SSHAGENT=../ssh-agent
-TEST_SSH_SSHADD=../ssh-add
-TEST_SSH_SSHKEYGEN=../ssh-keygen
-TEST_SSH_SSHKEYSCAN=../ssh-keyscan
-TEST_SSH_SFTP=../sftp
-TEST_SSH_SFTPSERVER=../sftp-server
-
-pmake
-
diff --git a/crypto/openssh/regress/sftp-batch.sh b/crypto/openssh/regress/sftp-batch.sh
deleted file mode 100644
index cffacb6df1c7..000000000000
--- a/crypto/openssh/regress/sftp-batch.sh
+++ /dev/null
@@ -1,57 +0,0 @@
-#	$OpenBSD: sftp-batch.sh,v 1.2 2003/01/10 07:52:41 djm Exp $
-#	Placed in the Public Domain.
-
-tid="sftp batchfile"
-
-DATA=/bin/ls
-COPY=${OBJ}/copy
-BATCH=${OBJ}/sftp-batch
-
-rm -rf ${COPY} ${COPY}.1 ${COPY}.2 ${COPY}.dd ${BATCH}.*
-
-cat << EOF > ${BATCH}.pass.1
-	get $DATA $COPY
-	put ${COPY} ${COPY}.1
-	rm ${COPY}
-	-put ${COPY} ${COPY}.2
-EOF
-
-cat << EOF > ${BATCH}.pass.2
-	# This is a comment
-
-	# That was a blank line
-	ls
-EOF
-
-cat << EOF > ${BATCH}.fail.1
-	get $DATA $COPY
-	put ${COPY} ${COPY}.3
-	rm ${COPY}.*
-	# The next command should fail
-	put ${COPY}.3 ${COPY}.4
-EOF
-
-cat << EOF > ${BATCH}.fail.2
-	# The next command should fail
-	jajajajaja
-EOF
-
-verbose "$tid: good commands"
-${SFTP} -b ${BATCH}.pass.1 -P ${SFTPSERVER} >/dev/null 2>&1 \
-	|| fail "good commands failed"
-
-verbose "$tid: bad commands"
-${SFTP} -b ${BATCH}.fail.1 -P ${SFTPSERVER} >/dev/null 2>&1 \
-	&& fail "bad commands succeeded"
-
-verbose "$tid: comments and blanks"
-${SFTP} -b ${BATCH}.pass.2 -P ${SFTPSERVER} >/dev/null 2>&1 \
-	|| fail "comments & blanks failed"
-
-verbose "$tid: junk command"
-${SFTP} -b ${BATCH}.fail.2 -P ${SFTPSERVER} >/dev/null 2>&1 \
-	&& fail "junk command succeeded"
-
-rm -rf ${COPY} ${COPY}.1 ${COPY}.2 ${COPY}.dd ${BATCH}.*
-
-
diff --git a/crypto/openssh/regress/sftp-cmds.sh b/crypto/openssh/regress/sftp-cmds.sh
deleted file mode 100644
index 462c6802f41d..000000000000
--- a/crypto/openssh/regress/sftp-cmds.sh
+++ /dev/null
@@ -1,100 +0,0 @@
-#	$OpenBSD: sftp-cmds.sh,v 1.2 2003/01/10 07:52:41 djm Exp $
-#	Placed in the Public Domain.
-
-# XXX - TODO: 
-# - globbed operations
-# - chmod / chown / chgrp
-# - -p flag for get & put
-
-tid="sftp commands"
-
-DATA=/bin/ls
-COPY=${OBJ}/copy
-
-rm -rf ${COPY} ${COPY}.1 ${COPY}.2 ${COPY}.dd ${BATCH}.*
-
-verbose "$tid: lls"
-echo "lls ${OBJ}" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
-	|| fail "lls failed"
-# XXX always successful
-
-verbose "$tid: ls"
-echo "ls ${OBJ}" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
-	|| fail "ls failed"
-# XXX always successful
-
-verbose "$tid: shell"
-echo "!echo hi there" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
-	|| fail "shell failed"
-# XXX always successful
-
-verbose "$tid: pwd"
-echo "pwd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
-	|| fail "pwd failed"
-# XXX always successful
-
-verbose "$tid: lpwd"
-echo "lpwd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
-	|| fail "lpwd failed"
-# XXX always successful
-
-verbose "$tid: quit"
-echo "quit" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
-	|| fail "quit failed"
-# XXX always successful
-
-verbose "$tid: help"
-echo "help" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
-	|| fail "help failed"
-# XXX always successful
-
-rm -f ${COPY}
-verbose "$tid: get"
-echo "get $DATA $COPY" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
-	|| fail "get failed"
-cmp $DATA ${COPY} || fail "corrupted copy after get"
-
-rm -f ${COPY}
-verbose "$tid: put"
-echo "put $DATA $COPY" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
-	|| fail "put failed"
-cmp $DATA ${COPY} || fail "corrupted copy after put"
-
-verbose "$tid: rename"
-echo "rename $COPY ${COPY}.1" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
-	|| fail "rename failed"
-test -f ${COPY}.1 || fail "missing file after rename"
-cmp $DATA ${COPY}.1 >/dev/null 2>&1 || fail "corrupted copy after rename"
-
-verbose "$tid: ln"
-echo "ln ${COPY}.1 ${COPY}.2" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 || fail "ln failed"
-test -L ${COPY}.2 || fail "missing file after ln"
-
-verbose "$tid: mkdir"
-echo "mkdir ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
-	|| fail "mkdir failed"
-test -d ${COPY}.dd || fail "missing directory after mkdir"
-
-# XXX do more here
-verbose "$tid: chdir"
-echo "chdir ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
-	|| fail "chdir failed"
-
-verbose "$tid: rmdir"
-echo "rmdir ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
-	|| fail "rmdir failed"
-test -d ${COPY}.1 && fail "present directory after rmdir"
-
-verbose "$tid: lmkdir"
-echo "lmkdir ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
-	|| fail "lmkdir failed"
-test -d ${COPY}.dd || fail "missing directory after lmkdir"
-
-# XXX do more here
-verbose "$tid: lchdir"
-echo "lchdir ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
-	|| fail "lchdir failed"
-
-rm -rf ${COPY} ${COPY}.1 ${COPY}.2 ${COPY}.dd ${BATCH}.*
-
-
diff --git a/crypto/openssh/regress/sftp.sh b/crypto/openssh/regress/sftp.sh
deleted file mode 100644
index e8d473123658..000000000000
--- a/crypto/openssh/regress/sftp.sh
+++ /dev/null
@@ -1,29 +0,0 @@
-#	$OpenBSD: sftp.sh,v 1.2 2002/03/27 22:39:52 markus Exp $
-#	Placed in the Public Domain.
-
-tid="basic sftp put/get"
-
-DATA=/bin/ls
-COPY=${OBJ}/copy
-
-BUFFERSIZE="5 1000 32000 64000"
-REQUESTS="1 2 10"
-
-for B in ${BUFFERSIZE}; do
-	for R in ${REQUESTS}; do
-                verbose "test $tid: buffer_size $B num_requests $R"
-		rm -f ${COPY}.1 ${COPY}.2
-		${SFTP} -P ${SFTPSERVER} -B $B -R $R -b /dev/stdin \
-		> /dev/null 2>&1 << EOF
-		version
-		get $DATA ${COPY}.1
-		put $DATA ${COPY}.2
-EOF
-		r=$?
-		if [ $r -ne 0 ]; then
-			fail "sftp failed with $r"
-		fi
-		cmp $DATA ${COPY}.1 || fail "corrupted copy after get"
-		cmp $DATA ${COPY}.2 || fail "corrupted copy after put"
-	done
-done
diff --git a/crypto/openssh/regress/ssh-com-client.sh b/crypto/openssh/regress/ssh-com-client.sh
deleted file mode 100644
index 015ebbb8c0b9..000000000000
--- a/crypto/openssh/regress/ssh-com-client.sh
+++ /dev/null
@@ -1,129 +0,0 @@
-#	$OpenBSD: ssh-com-client.sh,v 1.4 2002/07/16 08:58:16 markus Exp $
-#	Placed in the Public Domain.
-
-tid="connect with ssh.com client"
-
-#TEST_COMBASE=/path/to/ssh/com/binaries
-if [ "X${TEST_COMBASE}" = "X" ]; then
-	fatal '$TEST_COMBASE is not set'
-fi
-
-VERSIONS="
-	2.1.0
-	2.2.0
-	2.3.0
-	2.3.1
-	2.4.0
-	3.0.0
-	3.1.0
-	3.2.0
-	3.3.0"
-
-# 2.0.10 2.0.12 2.0.13 don't like the test setup
-
-# setup authorized keys
-SRC=`dirname ${SCRIPT}`
-cp ${SRC}/dsa_ssh2.prv ${OBJ}/id.com
-chmod 600 ${OBJ}/id.com
-${SSHKEYGEN} -i -f ${OBJ}/id.com	> $OBJ/id.openssh
-chmod 600 ${OBJ}/id.openssh
-${SSHKEYGEN} -y -f ${OBJ}/id.openssh	> $OBJ/authorized_keys_$USER
-${SSHKEYGEN} -e -f ${OBJ}/id.openssh	> $OBJ/id.com.pub
-echo IdKey ${OBJ}/id.com > ${OBJ}/id.list
-
-# we need a DSA host key
-t=dsa
-rm -f                             ${OBJ}/$t ${OBJ}/$t.pub
-${SSHKEYGEN} -q -N '' -t $t -f	  ${OBJ}/$t
-$SUDO cp $OBJ/$t $OBJ/host.$t
-echo HostKey $OBJ/host.$t >> $OBJ/sshd_config
-
-# add hostkeys to known hosts
-mkdir -p ${OBJ}/${USER}/hostkeys
-HK=${OBJ}/${USER}/hostkeys/key_${PORT}_127.0.0.1
-${SSHKEYGEN} -e -f ${OBJ}/rsa.pub > ${HK}.ssh-rsa.pub
-${SSHKEYGEN} -e -f ${OBJ}/dsa.pub > ${HK}.ssh-dss.pub
-
-cat > ${OBJ}/ssh2_config << EOF
-*:
-	QuietMode			yes
-	StrictHostKeyChecking		yes
-	Port				${PORT}
-	User				${USER}
-	Host				127.0.0.1
-	IdentityFile			${OBJ}/id.list
-	RandomSeedFile			${OBJ}/random_seed
-        UserConfigDirectory             ${OBJ}/%U
-	AuthenticationSuccessMsg	no
-	BatchMode			yes
-	ForwardX11			no
-EOF
-
-# we need a real server (no ProxyConnect option)
-start_sshd
-
-DATA=/bin/ls
-COPY=${OBJ}/copy
-rm -f ${COPY}
-
-# go for it
-for v in ${VERSIONS}; do
-	ssh2=${TEST_COMBASE}/${v}/ssh2
-	if [ ! -x ${ssh2} ]; then
-		continue
-	fi
-	verbose "ssh2 ${v}"
-	key=ssh-dss
-	skipcat=0
-        case $v in
-        2.1.*|2.3.0)
-                skipcat=1
-                ;;
-        3.0.*)
-                key=ssh-rsa
-                ;;
-        esac
-	cp ${HK}.$key.pub ${HK}.pub
-
-	# check exit status
-	${ssh2} -q -F ${OBJ}/ssh2_config somehost exit 42
-	r=$?
-        if [ $r -ne 42 ]; then
-                fail "ssh2 ${v} exit code test failed (got $r, expected 42)"
-        fi
-
-	# data transfer
-	rm -f ${COPY}
-	${ssh2} -F ${OBJ}/ssh2_config somehost cat ${DATA} > ${COPY}
-        if [ $? -ne 0 ]; then
-                fail "ssh2 ${v} cat test (receive) failed"
-        fi
-	cmp ${DATA} ${COPY}	|| fail "ssh2 ${v} cat test (receive) data mismatch"
-
-	# data transfer, again
-	if [ $skipcat -eq 0 ]; then
-		rm -f ${COPY}
-		cat ${DATA} | \
-			${ssh2} -F ${OBJ}/ssh2_config host "cat > ${COPY}"
-		if [ $? -ne 0 ]; then
-			fail "ssh2 ${v} cat test (send) failed"
-		fi
-		cmp ${DATA} ${COPY}	|| \
-			fail "ssh2 ${v} cat test (send) data mismatch"
-	fi
-
-	# no stderr after eof
-	rm -f ${COPY}
-	${ssh2} -F ${OBJ}/ssh2_config somehost \
-		exec sh -c \'"exec > /dev/null; sleep 1; echo bla 1>&2; exit 0"\' \
-		2> /dev/null
-        if [ $? -ne 0 ]; then
-                fail "ssh2 ${v} stderr test failed"
-        fi
-done
-
-rm -rf ${OBJ}/${USER}
-for i in ssh2_config random_seed dsa.pub dsa host.dsa \
-    id.list id.com id.com.pub id.openssh; do
-	rm -f ${OBJ}/$i
-done
diff --git a/crypto/openssh/regress/ssh-com-keygen.sh b/crypto/openssh/regress/ssh-com-keygen.sh
deleted file mode 100644
index e93dc78c9a8a..000000000000
--- a/crypto/openssh/regress/ssh-com-keygen.sh
+++ /dev/null
@@ -1,69 +0,0 @@
-#	$OpenBSD: ssh-com-keygen.sh,v 1.2 2002/07/16 08:58:16 markus Exp $
-#	Placed in the Public Domain.
-
-tid="ssh.com key import"
-
-#TEST_COMBASE=/path/to/ssh/com/binaries
-if [ "X${TEST_COMBASE}" = "X" ]; then
-	fatal '$TEST_COMBASE is not set'
-fi
-
-VERSIONS="
-	2.0.10
-	2.0.12
-	2.0.13
-	2.1.0
-	2.2.0
-	2.3.0
-	2.3.1
-	2.4.0
-	3.0.0
-	3.1.0
-	3.2.0
-	3.3.0"
-
-COMPRV=${OBJ}/comkey
-COMPUB=${COMPRV}.pub
-OPENSSHPRV=${OBJ}/opensshkey
-OPENSSHPUB=${OPENSSHPRV}.pub
-
-# go for it
-for v in ${VERSIONS}; do
-	keygen=${TEST_COMBASE}/${v}/ssh-keygen2
-	if [ ! -x ${keygen} ]; then
-		continue
-	fi
-	types="dss"
-        case $v in
-        2.3.1|3.*)
-                types="$types rsa"
-                ;;
-        esac
-	for t in $types; do
-		verbose "ssh-keygen $v/$t"
-		rm -f $COMPRV $COMPUB $OPENSSHPRV $OPENSSHPUB
-		${keygen} -q -P -t $t ${COMPRV} > /dev/null 2>&1
-		if [ $? -ne 0 ]; then
-			fail "${keygen} -t $t failed"
-			continue
-		fi
-		${SSHKEYGEN} -if ${COMPUB} > ${OPENSSHPUB}
-		if [ $? -ne 0 ]; then
-			fail "import public key ($v/$t) failed"
-			continue
-		fi
-		${SSHKEYGEN} -if ${COMPRV} > ${OPENSSHPRV}
-		if [ $? -ne 0 ]; then
-			fail "import private key ($v/$t) failed"
-			continue
-		fi
-		chmod 600 ${OPENSSHPRV}
-		${SSHKEYGEN} -yf ${OPENSSHPRV} |\
-			diff - ${OPENSSHPUB}
-		if [ $? -ne 0 ]; then
-			fail "public keys ($v/$t) differ"
-		fi
-	done
-done
-
-rm -f $COMPRV $COMPUB $OPENSSHPRV $OPENSSHPUB
diff --git a/crypto/openssh/regress/ssh-com-sftp.sh b/crypto/openssh/regress/ssh-com-sftp.sh
deleted file mode 100644
index f08018b84706..000000000000
--- a/crypto/openssh/regress/ssh-com-sftp.sh
+++ /dev/null
@@ -1,56 +0,0 @@
-#	$OpenBSD: ssh-com-sftp.sh,v 1.3 2002/07/16 08:58:16 markus Exp $
-#	Placed in the Public Domain.
-
-tid="basic sftp put/get with ssh.com server"
-
-DATA=/bin/ls
-COPY=${OBJ}/copy
-
-BUFFERSIZE="5 1000 32000 64000"
-REQUESTS="1 2 10"
-
-#TEST_COMBASE=/path/to/ssh/com/binaries
-if [ "X${TEST_COMBASE}" = "X" ]; then
-	fatal '$TEST_COMBASE is not set'
-fi
-
-VERSIONS="
-	2.0.10
-	2.0.12
-	2.0.13
-	2.1.0
-	2.2.0
-	2.3.0
-	2.3.1
-	2.4.0
-	3.0.0
-	3.1.0
-	3.2.0
-	3.3.0"
-
-# go for it
-for v in ${VERSIONS}; do
-	server=${TEST_COMBASE}/${v}/sftp-server2
-	if [ ! -x ${server} ]; then
-		continue
-	fi
-	verbose "sftp-server $v"
-	for B in ${BUFFERSIZE}; do
-		for R in ${REQUESTS}; do
-			verbose "test $tid: buffer_size $B num_requests $R"
-			rm -f ${COPY}.1 ${COPY}.2
-			${SFTP} -P ${server} -B $B -R $R -b /dev/stdin \
-			> /dev/null 2>&1 << EOF
-			version
-			get $DATA ${COPY}.1
-			put $DATA ${COPY}.2
-EOF
-			r=$?
-			if [ $r -ne 0 ]; then
-				fail "sftp failed with $r"
-			fi
-			cmp $DATA ${COPY}.1 || fail "corrupted copy after get"
-			cmp $DATA ${COPY}.2 || fail "corrupted copy after put"
-		done
-	done
-done
diff --git a/crypto/openssh/regress/ssh-com.sh b/crypto/openssh/regress/ssh-com.sh
deleted file mode 100644
index c2bd15380754..000000000000
--- a/crypto/openssh/regress/ssh-com.sh
+++ /dev/null
@@ -1,114 +0,0 @@
-#	$OpenBSD: ssh-com.sh,v 1.4 2002/07/16 08:58:16 markus Exp $
-#	Placed in the Public Domain.
-
-tid="connect to ssh.com server"
-
-#TEST_COMBASE=/path/to/ssh/com/binaries
-if [ "X${TEST_COMBASE}" = "X" ]; then
-	fatal '$TEST_COMBASE is not set'
-fi
-
-VERSIONS="
-	2.0.12
-	2.0.13
-	2.1.0
-	2.2.0
-	2.3.0
-	2.4.0
-	3.0.0
-	3.1.0
-	3.2.0
-	3.3.0"
-# 2.0.10 does not support UserConfigDirectory
-# 2.3.1 requires a config in $HOME/.ssh2
-
-SRC=`dirname ${SCRIPT}`
-
-# ssh.com
-cat << EOF > $OBJ/sshd2_config
-#*:
-	# Port and ListenAdress are not used.
-	QuietMode			yes
-	Port				4343
-	ListenAddress			127.0.0.1
-	UserConfigDirectory		${OBJ}/%U
-	Ciphers				AnyCipher
-	PubKeyAuthentication		yes
-	#AllowedAuthentications		publickey
-	AuthorizationFile		authorization
-	HostKeyFile			${SRC}/dsa_ssh2.prv
-	PublicHostKeyFile		${SRC}/dsa_ssh2.pub
-	RandomSeedFile			${OBJ}/random_seed
-	MaxConnections			0 
-	PermitRootLogin			yes
-	VerboseMode			no
-	CheckMail			no
-	Ssh1Compatibility		no
-EOF
-
-# create client config 
-sed "s/HostKeyAlias.*/HostKeyAlias ssh2-localhost-with-alias/" \
-	< $OBJ/ssh_config > $OBJ/ssh_config_com
-
-# we need a DSA key for
-rm -f                             ${OBJ}/dsa ${OBJ}/dsa.pub
-${SSHKEYGEN} -q -N '' -t dsa -f	  ${OBJ}/dsa
-
-# setup userdir, try rsa first
-mkdir -p ${OBJ}/${USER}
-cp /dev/null ${OBJ}/${USER}/authorization
-for t in rsa dsa; do
-	${SSHKEYGEN} -e -f ${OBJ}/$t.pub	>  ${OBJ}/${USER}/$t.com
-	echo Key $t.com			>> ${OBJ}/${USER}/authorization
-	echo IdentityFile ${OBJ}/$t	>> ${OBJ}/ssh_config_com
-done
-
-# convert and append DSA hostkey
-(
-	echo -n 'ssh2-localhost-with-alias,127.0.0.1,::1 '
-	${SSHKEYGEN} -if ${SRC}/dsa_ssh2.pub
-) >> $OBJ/known_hosts
-
-# go for it
-for v in ${VERSIONS}; do
-	sshd2=${TEST_COMBASE}/${v}/sshd2
-	if [ ! -x ${sshd2} ]; then
-		continue
-	fi
-	trace "sshd2 ${v}"
-	PROXY="proxycommand ${sshd2} -qif ${OBJ}/sshd2_config 2> /dev/null"
-	${SSH} -qF ${OBJ}/ssh_config_com -o "${PROXY}" dummy exit 0
-        if [ $? -ne 0 ]; then
-                fail "ssh connect to sshd2 ${v} failed"
-        fi
-
-	ciphers="3des-cbc blowfish-cbc arcfour"
-	macs="hmac-md5"
-	case $v in
-	2.4.*)
-		ciphers="$ciphers cast128-cbc"
-		macs="$macs hmac-sha1 hmac-sha1-96 hmac-md5-96"
-		;;
-	3.*)
-		ciphers="$ciphers aes128-cbc cast128-cbc"
-		macs="$macs hmac-sha1 hmac-sha1-96 hmac-md5-96"
-		;;
-	esac
-	#ciphers="3des-cbc"
-	for m in $macs; do
-	for c in $ciphers; do
-		trace "sshd2 ${v} cipher $c mac $m"
-		verbose "test ${tid}: sshd2 ${v} cipher $c mac $m"
-		${SSH} -c $c -m $m -qF ${OBJ}/ssh_config_com -o "${PROXY}" dummy exit 0
-		if [ $? -ne 0 ]; then
-			fail "ssh connect to sshd2 ${v} with $c/$m failed"
-		fi
-	done
-	done
-done
-
-rm -rf ${OBJ}/${USER}
-for i in sshd_config_proxy ssh_config_proxy random_seed \
-	sshd2_config dsa.pub dsa ssh_config_com; do
-	rm -f ${OBJ}/$i
-done
diff --git a/crypto/openssh/regress/stderr-after-eof.sh b/crypto/openssh/regress/stderr-after-eof.sh
deleted file mode 100644
index bebd700bf0cd..000000000000
--- a/crypto/openssh/regress/stderr-after-eof.sh
+++ /dev/null
@@ -1,30 +0,0 @@
-#	$OpenBSD: stderr-after-eof.sh,v 1.1 2002/03/23 16:38:09 markus Exp $
-#	Placed in the Public Domain.
-
-tid="stderr data after eof"
-
-DATA=/etc/motd
-DATA=${OBJ}/data
-COPY=${OBJ}/copy
-
-MD5=md5sum
-
-# setup data
-rm -f ${DATA} ${COPY}
-cp /dev/null ${DATA}
-for i in 1 2 3 4 5 6; do
-	(date;echo $i) | $MD5 >> ${DATA}
-done
-
-${SSH} -2 -F $OBJ/ssh_proxy otherhost \
-	exec sh -c \'"exec > /dev/null; sleep 2; cat ${DATA} 1>&2 $s"\' \
-	2> ${COPY}
-r=$?
-if [ $r -ne 0 ]; then
-	fail "ssh failed with exit code $r"
-fi
-egrep 'Disconnecting: Received extended_data after EOF' ${COPY} &&
-	fail "ext data received after eof"
-cmp ${DATA} ${COPY}	|| fail "stderr corrupt"
-
-rm -f ${DATA} ${COPY}
diff --git a/crypto/openssh/regress/stderr-data.sh b/crypto/openssh/regress/stderr-data.sh
deleted file mode 100644
index 0157690b0c7e..000000000000
--- a/crypto/openssh/regress/stderr-data.sh
+++ /dev/null
@@ -1,33 +0,0 @@
-#	$OpenBSD: stderr-data.sh,v 1.2 2002/03/27 22:39:52 markus Exp $
-#	Placed in the Public Domain.
-
-tid="stderr data transfer"
-
-DATA=/bin/ls
-COPY=${OBJ}/copy
-rm -f ${COPY}
-
-for n in '' -n; do
-for p in 1 2; do
-	verbose "test $tid: proto $p ($n)"
-	${SSH} $n -$p -F $OBJ/ssh_proxy otherhost \
-		exec sh -c \'"exec > /dev/null; sleep 3; cat ${DATA} 1>&2 $s"\' \
-		2> ${COPY}
-	r=$?
-	if [ $r -ne 0 ]; then
-		fail "ssh failed with exit code $r"
-	fi
-	cmp ${DATA} ${COPY}	|| fail "stderr corrupt"
-	rm -f ${COPY}
-
-	${SSH} $n -$p -F $OBJ/ssh_proxy otherhost \
-		exec sh -c \'"echo a; exec > /dev/null; sleep 3; cat ${DATA} 1>&2 $s"\' \
-		> /dev/null 2> ${COPY}
-	r=$?
-	if [ $r -ne 0 ]; then
-		fail "ssh failed with exit code $r"
-	fi
-	cmp ${DATA} ${COPY}	|| fail "stderr corrupt"
-	rm -f ${COPY}
-done
-done
diff --git a/crypto/openssh/regress/t4.ok b/crypto/openssh/regress/t4.ok
deleted file mode 100644
index 8c4942bf177b..000000000000
--- a/crypto/openssh/regress/t4.ok
+++ /dev/null
@@ -1 +0,0 @@
-3b:dd:44:e9:49:18:84:95:f1:e7:33:6b:9d:93:b1:36
diff --git a/crypto/openssh/regress/t5.ok b/crypto/openssh/regress/t5.ok
deleted file mode 100644
index bd622f300c07..000000000000
--- a/crypto/openssh/regress/t5.ok
+++ /dev/null
@@ -1 +0,0 @@
-xokes-lylis-byleh-zebib-kalus-bihas-tevah-haroz-suhar-foved-noxex
diff --git a/crypto/openssh/regress/test-exec.sh b/crypto/openssh/regress/test-exec.sh
deleted file mode 100644
index a7a8ddbe606f..000000000000
--- a/crypto/openssh/regress/test-exec.sh
+++ /dev/null
@@ -1,224 +0,0 @@
-#	$OpenBSD: test-exec.sh,v 1.14 2002/04/15 15:19:48 markus Exp $
-#	Placed in the Public Domain.
-
-PORT=4242
-USER=`id -un`
-SUDO=
-#SUDO=sudo
-
-OBJ=$1
-if [ "x$OBJ" = "x" ]; then
-	echo '$OBJ not defined'
-	exit 2
-fi
-if [ ! -d $OBJ ]; then
-	echo "not a directory: $OBJ"
-	exit 2
-fi
-SCRIPT=$2
-if [ "x$SCRIPT" = "x" ]; then
-	echo '$SCRIPT not defined'
-	exit 2
-fi
-if [ ! -f $SCRIPT ]; then
-	echo "not a file: $SCRIPT"
-	exit 2
-fi
-if sh -n $SCRIPT; then
-	true
-else
-	echo "syntax error in $SCRIPT"
-	exit 2
-fi
-unset SSH_AUTH_SOCK
-
-# defaults
-SSH=ssh
-SSHD=sshd
-SSHAGENT=ssh-agent
-SSHADD=ssh-add
-SSHKEYGEN=ssh-keygen
-SSHKEYSCAN=ssh-keyscan
-SFTP=sftp
-SFTPSERVER=/usr/libexec/openssh/sftp-server
-
-if [ "x$TEST_SSH_SSH" != "x" ]; then
-	SSH=${TEST_SSH_SSH}
-fi
-if [ "x$TEST_SSH_SSHD" != "x" ]; then
-	SSHD=${TEST_SSH_SSHD}
-fi
-if [ "x$TEST_SSH_SSHAGENT" != "x" ]; then
-	SSHAGENT=${TEST_SSH_SSHAGENT}
-fi
-if [ "x$TEST_SSH_SSHADD" != "x" ]; then
-	SSHADD=${TEST_SSH_SSHADD}
-fi
-if [ "x$TEST_SSH_SSHKEYGEN" != "x" ]; then
-	SSHKEYGEN=${TEST_SSH_SSHKEYGEN}
-fi
-if [ "x$TEST_SSH_SSHKEYSCAN" != "x" ]; then
-	SSHKEYSCAN=${TEST_SSH_SSHKEYSCAN}
-fi
-if [ "x$TEST_SSH_SFTP" != "x" ]; then
-	SFTP=${TEST_SSH_SFTP}
-fi
-if [ "x$TEST_SSH_SFTPSERVER" != "x" ]; then
-	SFTPSERVER=${TEST_SSH_SFTPSERVER}
-fi
-
-# these should be used in tests
-export SSH SSHD SSHAGENT SSHADD SSHKEYGEN SSHKEYSCAN SFTP SFTPSERVER
-#echo $SSH $SSHD $SSHAGENT $SSHADD $SSHKEYGEN $SSHKEYSCAN $SFTP $SFTPSERVER
-
-# helper
-cleanup ()
-{
-	if [ -f $PIDFILE ]; then
-		pid=`cat $PIDFILE`
-		if [ "X$pid" = "X" ]; then
-			echo no sshd running
-		else
-			if [ $pid -lt 2 ]; then
-				echo bad pid for ssd: $pid
-			else
-				$SUDO kill $pid
-			fi
-		fi
-	fi
-}
-
-trace ()
-{
-	if [ "X$TEST_SSH_TRACE" = "Xyes" ]; then
-		echo "$@"
-	fi
-}
-
-verbose ()
-{
-	if [ "X$TEST_SSH_QUIET" != "Xyes" ]; then
-		echo "$@"
-	fi
-}
-
-
-fail ()
-{
-	RESULT=1
-	echo "$@"
-}
-
-fatal ()
-{
-	echo -n "FATAL: "
-	fail "$@"
-	cleanup
-	exit $RESULT
-}
-
-RESULT=0
-PIDFILE=$OBJ/pidfile
-
-trap fatal 3 2
-
-# create server config
-cat << EOF > $OBJ/sshd_config
-	Port			$PORT
-	ListenAddress		127.0.0.1
-	#ListenAddress		::1
-	PidFile			$PIDFILE
-	AuthorizedKeysFile	$OBJ/authorized_keys_%u
-	LogLevel		QUIET
-EOF
-
-# server config for proxy connects
-cp $OBJ/sshd_config $OBJ/sshd_proxy
-
-# allow group-writable directories in proxy-mode
-echo 'StrictModes no' >> $OBJ/sshd_proxy
-
-# create client config
-cat << EOF > $OBJ/ssh_config
-Host *
-	Hostname		127.0.0.1
-	HostKeyAlias		localhost-with-alias
-	Port			$PORT
-	User			$USER
-	GlobalKnownHostsFile	$OBJ/known_hosts
-	UserKnownHostsFile	$OBJ/known_hosts
-	RSAAuthentication	yes
-	PubkeyAuthentication	yes
-	ChallengeResponseAuthentication	no
-	HostbasedAuthentication	no
-	PasswordAuthentication	no
-	RhostsAuthentication	no
-	RhostsRSAAuthentication	no
-	BatchMode		yes
-	StrictHostKeyChecking	yes
-EOF
-
-rm -f $OBJ/known_hosts $OBJ/authorized_keys_$USER
-
-trace "generate keys"
-for t in rsa rsa1; do
-	# generate user key
-	rm -f $OBJ/$t
-	${SSHKEYGEN} -q -N '' -t $t  -f $OBJ/$t ||\
-		fail "ssh-keygen for $t failed"
-
-	# known hosts file for client
-	(
-		echo -n 'localhost-with-alias,127.0.0.1,::1 '
-		cat $OBJ/$t.pub
-	) >> $OBJ/known_hosts
-
-	# setup authorized keys
-	cat $OBJ/$t.pub >> $OBJ/authorized_keys_$USER
-	echo IdentityFile $OBJ/$t >> $OBJ/ssh_config
-
-	# use key as host key, too
-	$SUDO cp $OBJ/$t $OBJ/host.$t
-	echo HostKey $OBJ/host.$t >> $OBJ/sshd_config
-
-	# don't use SUDO for proxy connect
-	echo HostKey $OBJ/$t >> $OBJ/sshd_proxy
-done
-chmod 644 $OBJ/authorized_keys_$USER
-
-# create a proxy version of the client config
-(
-	cat $OBJ/ssh_config
-	echo proxycommand ${SSHD} -i -f $OBJ/sshd_proxy
-) > $OBJ/ssh_proxy
-
-# check proxy config
-${SSHD} -t -f $OBJ/sshd_proxy	|| fatal "sshd_proxy broken"
-
-start_sshd ()
-{
-	# start sshd
-	$SUDO ${SSHD} -f $OBJ/sshd_config -t	|| fatal "sshd_config broken"
-	$SUDO ${SSHD} -f $OBJ/sshd_config
-
-	trace "wait for sshd"
-	i=0;
-	while [ ! -f $PIDFILE -a $i -lt 5 ]; do
-		i=`expr $i + 1`
-		sleep $i
-	done
-
-	test -f $PIDFILE || fatal "no sshd running on port $PORT"
-}
-
-# source test body
-. $SCRIPT
-
-# kill sshd
-cleanup
-if [ $RESULT -eq 0 ]; then
-	verbose ok $tid
-else
-	echo failed $tid
-fi
-exit $RESULT
diff --git a/crypto/openssh/regress/transfer.sh b/crypto/openssh/regress/transfer.sh
deleted file mode 100644
index 31cdc0ce36b0..000000000000
--- a/crypto/openssh/regress/transfer.sh
+++ /dev/null
@@ -1,29 +0,0 @@
-#	$OpenBSD: transfer.sh,v 1.1 2002/03/27 00:03:37 markus Exp $
-#	Placed in the Public Domain.
-
-tid="transfer data"
-
-DATA=/bin/ls
-COPY=${OBJ}/copy
-
-for p in 1 2; do
-	verbose "$tid: proto $p"
-	rm -f ${COPY}
-	${SSH} -n -q -$p -F $OBJ/ssh_proxy somehost cat ${DATA} > ${COPY}
-	if [ $? -ne 0 ]; then
-		fail "ssh cat $DATA failed"
-	fi
-	cmp ${DATA} ${COPY}		|| fail "corrupted copy"
-
-	for s in 10 100 1k 32k 64k 128k 256k; do
-		trace "proto $p dd-size ${s}"
-		rm -f ${COPY}
-		dd if=$DATA obs=${s} 2> /dev/null | \
-			${SSH} -q -$p -F $OBJ/ssh_proxy somehost "cat > ${COPY}"
-		if [ $? -ne 0 ]; then
-			fail "ssh cat $DATA failed"
-		fi
-		cmp $DATA ${COPY}		|| fail "corrupted copy"
-	done
-done
-rm -f ${COPY}
diff --git a/crypto/openssh/regress/try-ciphers.sh b/crypto/openssh/regress/try-ciphers.sh
deleted file mode 100644
index 161f039c0728..000000000000
--- a/crypto/openssh/regress/try-ciphers.sh
+++ /dev/null
@@ -1,29 +0,0 @@
-#	$OpenBSD: try-ciphers.sh,v 1.7 2002/04/03 09:30:01 markus Exp $
-#	Placed in the Public Domain.
-
-tid="try ciphers"
-
-ciphers="aes128-cbc 3des-cbc blowfish-cbc cast128-cbc arcfour 
-	aes192-cbc aes256-cbc rijndael-cbc@lysator.liu.se"
-macs="hmac-sha1 hmac-md5 hmac-sha1-96 hmac-md5-96"
-
-for c in $ciphers; do
-	for m in $macs; do
-		trace "proto 2 cipher $c mac $m"
-		verbose "test $tid: proto 2 cipher $c mac $m"
-		${SSH} -F $OBJ/ssh_proxy -2 -m $m -c $c somehost true
-		if [ $? -ne 0 ]; then
-			fail "ssh -2 failed with mac $m cipher $c"
-		fi
-	done
-done
-
-ciphers="3des blowfish"
-for c in $ciphers; do
-	trace "proto 1 cipher $c"
-	verbose "test $tid: proto 1 cipher $c"
-	${SSH} -F $OBJ/ssh_proxy -1 -c $c somehost true
-	if [ $? -ne 0 ]; then
-		fail "ssh -1 failed with cipher $c"
-	fi
-done
diff --git a/crypto/openssh/regress/yes-head.sh b/crypto/openssh/regress/yes-head.sh
deleted file mode 100644
index f213f6863ca7..000000000000
--- a/crypto/openssh/regress/yes-head.sh
+++ /dev/null
@@ -1,15 +0,0 @@
-#	$OpenBSD: yes-head.sh,v 1.4 2002/03/15 13:08:56 markus Exp $
-#	Placed in the Public Domain.
-
-tid="yes pipe head"
-
-for p in 1 2; do
-	lines=`${SSH} -$p -F $OBJ/ssh_proxy thishost 'yes | head -2000' | (sleep 3 ; wc -l)`
-	if [ $? -ne 0 ]; then
-		fail "yes|head test failed"
-		lines = 0;
-	fi
-	if [ $lines -ne 2000 ]; then
-		fail "yes|head returns $lines lines instead of 2000"
-	fi
-done
diff --git a/crypto/openssh/rijndael.c b/crypto/openssh/rijndael.c
deleted file mode 100644
index 6965ca3b0de6..000000000000
--- a/crypto/openssh/rijndael.c
+++ /dev/null
@@ -1,1244 +0,0 @@
-/*	$OpenBSD: rijndael.c,v 1.14 2002/07/10 17:53:54 deraadt Exp $ */
-
-/**
- * rijndael-alg-fst.c
- *
- * @version 3.0 (December 2000)
- *
- * Optimised ANSI C code for the Rijndael cipher (now AES)
- *
- * @author Vincent Rijmen <vincent.rijmen@esat.kuleuven.ac.be>
- * @author Antoon Bosselaers <antoon.bosselaers@esat.kuleuven.ac.be>
- * @author Paulo Barreto <paulo.barreto@terra.com.br>
- *
- * This code is hereby placed in the public domain.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ''AS IS'' AND ANY EXPRESS
- * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
- * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
- * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
- * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
- * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#include "includes.h"
-
-#include <stdlib.h>
-#include <string.h>
-
-#include "rijndael.h"
-
-#define FULL_UNROLL
-
-/*
-Te0[x] = S [x].[02, 01, 01, 03];
-Te1[x] = S [x].[03, 02, 01, 01];
-Te2[x] = S [x].[01, 03, 02, 01];
-Te3[x] = S [x].[01, 01, 03, 02];
-Te4[x] = S [x].[01, 01, 01, 01];
-
-Td0[x] = Si[x].[0e, 09, 0d, 0b];
-Td1[x] = Si[x].[0b, 0e, 09, 0d];
-Td2[x] = Si[x].[0d, 0b, 0e, 09];
-Td3[x] = Si[x].[09, 0d, 0b, 0e];
-Td4[x] = Si[x].[01, 01, 01, 01];
-*/
-
-static const u32 Te0[256] = {
-    0xc66363a5U, 0xf87c7c84U, 0xee777799U, 0xf67b7b8dU,
-    0xfff2f20dU, 0xd66b6bbdU, 0xde6f6fb1U, 0x91c5c554U,
-    0x60303050U, 0x02010103U, 0xce6767a9U, 0x562b2b7dU,
-    0xe7fefe19U, 0xb5d7d762U, 0x4dababe6U, 0xec76769aU,
-    0x8fcaca45U, 0x1f82829dU, 0x89c9c940U, 0xfa7d7d87U,
-    0xeffafa15U, 0xb25959ebU, 0x8e4747c9U, 0xfbf0f00bU,
-    0x41adadecU, 0xb3d4d467U, 0x5fa2a2fdU, 0x45afafeaU,
-    0x239c9cbfU, 0x53a4a4f7U, 0xe4727296U, 0x9bc0c05bU,
-    0x75b7b7c2U, 0xe1fdfd1cU, 0x3d9393aeU, 0x4c26266aU,
-    0x6c36365aU, 0x7e3f3f41U, 0xf5f7f702U, 0x83cccc4fU,
-    0x6834345cU, 0x51a5a5f4U, 0xd1e5e534U, 0xf9f1f108U,
-    0xe2717193U, 0xabd8d873U, 0x62313153U, 0x2a15153fU,
-    0x0804040cU, 0x95c7c752U, 0x46232365U, 0x9dc3c35eU,
-    0x30181828U, 0x379696a1U, 0x0a05050fU, 0x2f9a9ab5U,
-    0x0e070709U, 0x24121236U, 0x1b80809bU, 0xdfe2e23dU,
-    0xcdebeb26U, 0x4e272769U, 0x7fb2b2cdU, 0xea75759fU,
-    0x1209091bU, 0x1d83839eU, 0x582c2c74U, 0x341a1a2eU,
-    0x361b1b2dU, 0xdc6e6eb2U, 0xb45a5aeeU, 0x5ba0a0fbU,
-    0xa45252f6U, 0x763b3b4dU, 0xb7d6d661U, 0x7db3b3ceU,
-    0x5229297bU, 0xdde3e33eU, 0x5e2f2f71U, 0x13848497U,
-    0xa65353f5U, 0xb9d1d168U, 0x00000000U, 0xc1eded2cU,
-    0x40202060U, 0xe3fcfc1fU, 0x79b1b1c8U, 0xb65b5bedU,
-    0xd46a6abeU, 0x8dcbcb46U, 0x67bebed9U, 0x7239394bU,
-    0x944a4adeU, 0x984c4cd4U, 0xb05858e8U, 0x85cfcf4aU,
-    0xbbd0d06bU, 0xc5efef2aU, 0x4faaaae5U, 0xedfbfb16U,
-    0x864343c5U, 0x9a4d4dd7U, 0x66333355U, 0x11858594U,
-    0x8a4545cfU, 0xe9f9f910U, 0x04020206U, 0xfe7f7f81U,
-    0xa05050f0U, 0x783c3c44U, 0x259f9fbaU, 0x4ba8a8e3U,
-    0xa25151f3U, 0x5da3a3feU, 0x804040c0U, 0x058f8f8aU,
-    0x3f9292adU, 0x219d9dbcU, 0x70383848U, 0xf1f5f504U,
-    0x63bcbcdfU, 0x77b6b6c1U, 0xafdada75U, 0x42212163U,
-    0x20101030U, 0xe5ffff1aU, 0xfdf3f30eU, 0xbfd2d26dU,
-    0x81cdcd4cU, 0x180c0c14U, 0x26131335U, 0xc3ecec2fU,
-    0xbe5f5fe1U, 0x359797a2U, 0x884444ccU, 0x2e171739U,
-    0x93c4c457U, 0x55a7a7f2U, 0xfc7e7e82U, 0x7a3d3d47U,
-    0xc86464acU, 0xba5d5de7U, 0x3219192bU, 0xe6737395U,
-    0xc06060a0U, 0x19818198U, 0x9e4f4fd1U, 0xa3dcdc7fU,
-    0x44222266U, 0x542a2a7eU, 0x3b9090abU, 0x0b888883U,
-    0x8c4646caU, 0xc7eeee29U, 0x6bb8b8d3U, 0x2814143cU,
-    0xa7dede79U, 0xbc5e5ee2U, 0x160b0b1dU, 0xaddbdb76U,
-    0xdbe0e03bU, 0x64323256U, 0x743a3a4eU, 0x140a0a1eU,
-    0x924949dbU, 0x0c06060aU, 0x4824246cU, 0xb85c5ce4U,
-    0x9fc2c25dU, 0xbdd3d36eU, 0x43acacefU, 0xc46262a6U,
-    0x399191a8U, 0x319595a4U, 0xd3e4e437U, 0xf279798bU,
-    0xd5e7e732U, 0x8bc8c843U, 0x6e373759U, 0xda6d6db7U,
-    0x018d8d8cU, 0xb1d5d564U, 0x9c4e4ed2U, 0x49a9a9e0U,
-    0xd86c6cb4U, 0xac5656faU, 0xf3f4f407U, 0xcfeaea25U,
-    0xca6565afU, 0xf47a7a8eU, 0x47aeaee9U, 0x10080818U,
-    0x6fbabad5U, 0xf0787888U, 0x4a25256fU, 0x5c2e2e72U,
-    0x381c1c24U, 0x57a6a6f1U, 0x73b4b4c7U, 0x97c6c651U,
-    0xcbe8e823U, 0xa1dddd7cU, 0xe874749cU, 0x3e1f1f21U,
-    0x964b4bddU, 0x61bdbddcU, 0x0d8b8b86U, 0x0f8a8a85U,
-    0xe0707090U, 0x7c3e3e42U, 0x71b5b5c4U, 0xcc6666aaU,
-    0x904848d8U, 0x06030305U, 0xf7f6f601U, 0x1c0e0e12U,
-    0xc26161a3U, 0x6a35355fU, 0xae5757f9U, 0x69b9b9d0U,
-    0x17868691U, 0x99c1c158U, 0x3a1d1d27U, 0x279e9eb9U,
-    0xd9e1e138U, 0xebf8f813U, 0x2b9898b3U, 0x22111133U,
-    0xd26969bbU, 0xa9d9d970U, 0x078e8e89U, 0x339494a7U,
-    0x2d9b9bb6U, 0x3c1e1e22U, 0x15878792U, 0xc9e9e920U,
-    0x87cece49U, 0xaa5555ffU, 0x50282878U, 0xa5dfdf7aU,
-    0x038c8c8fU, 0x59a1a1f8U, 0x09898980U, 0x1a0d0d17U,
-    0x65bfbfdaU, 0xd7e6e631U, 0x844242c6U, 0xd06868b8U,
-    0x824141c3U, 0x299999b0U, 0x5a2d2d77U, 0x1e0f0f11U,
-    0x7bb0b0cbU, 0xa85454fcU, 0x6dbbbbd6U, 0x2c16163aU,
-};
-static const u32 Te1[256] = {
-    0xa5c66363U, 0x84f87c7cU, 0x99ee7777U, 0x8df67b7bU,
-    0x0dfff2f2U, 0xbdd66b6bU, 0xb1de6f6fU, 0x5491c5c5U,
-    0x50603030U, 0x03020101U, 0xa9ce6767U, 0x7d562b2bU,
-    0x19e7fefeU, 0x62b5d7d7U, 0xe64dababU, 0x9aec7676U,
-    0x458fcacaU, 0x9d1f8282U, 0x4089c9c9U, 0x87fa7d7dU,
-    0x15effafaU, 0xebb25959U, 0xc98e4747U, 0x0bfbf0f0U,
-    0xec41adadU, 0x67b3d4d4U, 0xfd5fa2a2U, 0xea45afafU,
-    0xbf239c9cU, 0xf753a4a4U, 0x96e47272U, 0x5b9bc0c0U,
-    0xc275b7b7U, 0x1ce1fdfdU, 0xae3d9393U, 0x6a4c2626U,
-    0x5a6c3636U, 0x417e3f3fU, 0x02f5f7f7U, 0x4f83ccccU,
-    0x5c683434U, 0xf451a5a5U, 0x34d1e5e5U, 0x08f9f1f1U,
-    0x93e27171U, 0x73abd8d8U, 0x53623131U, 0x3f2a1515U,
-    0x0c080404U, 0x5295c7c7U, 0x65462323U, 0x5e9dc3c3U,
-    0x28301818U, 0xa1379696U, 0x0f0a0505U, 0xb52f9a9aU,
-    0x090e0707U, 0x36241212U, 0x9b1b8080U, 0x3ddfe2e2U,
-    0x26cdebebU, 0x694e2727U, 0xcd7fb2b2U, 0x9fea7575U,
-    0x1b120909U, 0x9e1d8383U, 0x74582c2cU, 0x2e341a1aU,
-    0x2d361b1bU, 0xb2dc6e6eU, 0xeeb45a5aU, 0xfb5ba0a0U,
-    0xf6a45252U, 0x4d763b3bU, 0x61b7d6d6U, 0xce7db3b3U,
-    0x7b522929U, 0x3edde3e3U, 0x715e2f2fU, 0x97138484U,
-    0xf5a65353U, 0x68b9d1d1U, 0x00000000U, 0x2cc1ededU,
-    0x60402020U, 0x1fe3fcfcU, 0xc879b1b1U, 0xedb65b5bU,
-    0xbed46a6aU, 0x468dcbcbU, 0xd967bebeU, 0x4b723939U,
-    0xde944a4aU, 0xd4984c4cU, 0xe8b05858U, 0x4a85cfcfU,
-    0x6bbbd0d0U, 0x2ac5efefU, 0xe54faaaaU, 0x16edfbfbU,
-    0xc5864343U, 0xd79a4d4dU, 0x55663333U, 0x94118585U,
-    0xcf8a4545U, 0x10e9f9f9U, 0x06040202U, 0x81fe7f7fU,
-    0xf0a05050U, 0x44783c3cU, 0xba259f9fU, 0xe34ba8a8U,
-    0xf3a25151U, 0xfe5da3a3U, 0xc0804040U, 0x8a058f8fU,
-    0xad3f9292U, 0xbc219d9dU, 0x48703838U, 0x04f1f5f5U,
-    0xdf63bcbcU, 0xc177b6b6U, 0x75afdadaU, 0x63422121U,
-    0x30201010U, 0x1ae5ffffU, 0x0efdf3f3U, 0x6dbfd2d2U,
-    0x4c81cdcdU, 0x14180c0cU, 0x35261313U, 0x2fc3ececU,
-    0xe1be5f5fU, 0xa2359797U, 0xcc884444U, 0x392e1717U,
-    0x5793c4c4U, 0xf255a7a7U, 0x82fc7e7eU, 0x477a3d3dU,
-    0xacc86464U, 0xe7ba5d5dU, 0x2b321919U, 0x95e67373U,
-    0xa0c06060U, 0x98198181U, 0xd19e4f4fU, 0x7fa3dcdcU,
-    0x66442222U, 0x7e542a2aU, 0xab3b9090U, 0x830b8888U,
-    0xca8c4646U, 0x29c7eeeeU, 0xd36bb8b8U, 0x3c281414U,
-    0x79a7dedeU, 0xe2bc5e5eU, 0x1d160b0bU, 0x76addbdbU,
-    0x3bdbe0e0U, 0x56643232U, 0x4e743a3aU, 0x1e140a0aU,
-    0xdb924949U, 0x0a0c0606U, 0x6c482424U, 0xe4b85c5cU,
-    0x5d9fc2c2U, 0x6ebdd3d3U, 0xef43acacU, 0xa6c46262U,
-    0xa8399191U, 0xa4319595U, 0x37d3e4e4U, 0x8bf27979U,
-    0x32d5e7e7U, 0x438bc8c8U, 0x596e3737U, 0xb7da6d6dU,
-    0x8c018d8dU, 0x64b1d5d5U, 0xd29c4e4eU, 0xe049a9a9U,
-    0xb4d86c6cU, 0xfaac5656U, 0x07f3f4f4U, 0x25cfeaeaU,
-    0xafca6565U, 0x8ef47a7aU, 0xe947aeaeU, 0x18100808U,
-    0xd56fbabaU, 0x88f07878U, 0x6f4a2525U, 0x725c2e2eU,
-    0x24381c1cU, 0xf157a6a6U, 0xc773b4b4U, 0x5197c6c6U,
-    0x23cbe8e8U, 0x7ca1ddddU, 0x9ce87474U, 0x213e1f1fU,
-    0xdd964b4bU, 0xdc61bdbdU, 0x860d8b8bU, 0x850f8a8aU,
-    0x90e07070U, 0x427c3e3eU, 0xc471b5b5U, 0xaacc6666U,
-    0xd8904848U, 0x05060303U, 0x01f7f6f6U, 0x121c0e0eU,
-    0xa3c26161U, 0x5f6a3535U, 0xf9ae5757U, 0xd069b9b9U,
-    0x91178686U, 0x5899c1c1U, 0x273a1d1dU, 0xb9279e9eU,
-    0x38d9e1e1U, 0x13ebf8f8U, 0xb32b9898U, 0x33221111U,
-    0xbbd26969U, 0x70a9d9d9U, 0x89078e8eU, 0xa7339494U,
-    0xb62d9b9bU, 0x223c1e1eU, 0x92158787U, 0x20c9e9e9U,
-    0x4987ceceU, 0xffaa5555U, 0x78502828U, 0x7aa5dfdfU,
-    0x8f038c8cU, 0xf859a1a1U, 0x80098989U, 0x171a0d0dU,
-    0xda65bfbfU, 0x31d7e6e6U, 0xc6844242U, 0xb8d06868U,
-    0xc3824141U, 0xb0299999U, 0x775a2d2dU, 0x111e0f0fU,
-    0xcb7bb0b0U, 0xfca85454U, 0xd66dbbbbU, 0x3a2c1616U,
-};
-static const u32 Te2[256] = {
-    0x63a5c663U, 0x7c84f87cU, 0x7799ee77U, 0x7b8df67bU,
-    0xf20dfff2U, 0x6bbdd66bU, 0x6fb1de6fU, 0xc55491c5U,
-    0x30506030U, 0x01030201U, 0x67a9ce67U, 0x2b7d562bU,
-    0xfe19e7feU, 0xd762b5d7U, 0xabe64dabU, 0x769aec76U,
-    0xca458fcaU, 0x829d1f82U, 0xc94089c9U, 0x7d87fa7dU,
-    0xfa15effaU, 0x59ebb259U, 0x47c98e47U, 0xf00bfbf0U,
-    0xadec41adU, 0xd467b3d4U, 0xa2fd5fa2U, 0xafea45afU,
-    0x9cbf239cU, 0xa4f753a4U, 0x7296e472U, 0xc05b9bc0U,
-    0xb7c275b7U, 0xfd1ce1fdU, 0x93ae3d93U, 0x266a4c26U,
-    0x365a6c36U, 0x3f417e3fU, 0xf702f5f7U, 0xcc4f83ccU,
-    0x345c6834U, 0xa5f451a5U, 0xe534d1e5U, 0xf108f9f1U,
-    0x7193e271U, 0xd873abd8U, 0x31536231U, 0x153f2a15U,
-    0x040c0804U, 0xc75295c7U, 0x23654623U, 0xc35e9dc3U,
-    0x18283018U, 0x96a13796U, 0x050f0a05U, 0x9ab52f9aU,
-    0x07090e07U, 0x12362412U, 0x809b1b80U, 0xe23ddfe2U,
-    0xeb26cdebU, 0x27694e27U, 0xb2cd7fb2U, 0x759fea75U,
-    0x091b1209U, 0x839e1d83U, 0x2c74582cU, 0x1a2e341aU,
-    0x1b2d361bU, 0x6eb2dc6eU, 0x5aeeb45aU, 0xa0fb5ba0U,
-    0x52f6a452U, 0x3b4d763bU, 0xd661b7d6U, 0xb3ce7db3U,
-    0x297b5229U, 0xe33edde3U, 0x2f715e2fU, 0x84971384U,
-    0x53f5a653U, 0xd168b9d1U, 0x00000000U, 0xed2cc1edU,
-    0x20604020U, 0xfc1fe3fcU, 0xb1c879b1U, 0x5bedb65bU,
-    0x6abed46aU, 0xcb468dcbU, 0xbed967beU, 0x394b7239U,
-    0x4ade944aU, 0x4cd4984cU, 0x58e8b058U, 0xcf4a85cfU,
-    0xd06bbbd0U, 0xef2ac5efU, 0xaae54faaU, 0xfb16edfbU,
-    0x43c58643U, 0x4dd79a4dU, 0x33556633U, 0x85941185U,
-    0x45cf8a45U, 0xf910e9f9U, 0x02060402U, 0x7f81fe7fU,
-    0x50f0a050U, 0x3c44783cU, 0x9fba259fU, 0xa8e34ba8U,
-    0x51f3a251U, 0xa3fe5da3U, 0x40c08040U, 0x8f8a058fU,
-    0x92ad3f92U, 0x9dbc219dU, 0x38487038U, 0xf504f1f5U,
-    0xbcdf63bcU, 0xb6c177b6U, 0xda75afdaU, 0x21634221U,
-    0x10302010U, 0xff1ae5ffU, 0xf30efdf3U, 0xd26dbfd2U,
-    0xcd4c81cdU, 0x0c14180cU, 0x13352613U, 0xec2fc3ecU,
-    0x5fe1be5fU, 0x97a23597U, 0x44cc8844U, 0x17392e17U,
-    0xc45793c4U, 0xa7f255a7U, 0x7e82fc7eU, 0x3d477a3dU,
-    0x64acc864U, 0x5de7ba5dU, 0x192b3219U, 0x7395e673U,
-    0x60a0c060U, 0x81981981U, 0x4fd19e4fU, 0xdc7fa3dcU,
-    0x22664422U, 0x2a7e542aU, 0x90ab3b90U, 0x88830b88U,
-    0x46ca8c46U, 0xee29c7eeU, 0xb8d36bb8U, 0x143c2814U,
-    0xde79a7deU, 0x5ee2bc5eU, 0x0b1d160bU, 0xdb76addbU,
-    0xe03bdbe0U, 0x32566432U, 0x3a4e743aU, 0x0a1e140aU,
-    0x49db9249U, 0x060a0c06U, 0x246c4824U, 0x5ce4b85cU,
-    0xc25d9fc2U, 0xd36ebdd3U, 0xacef43acU, 0x62a6c462U,
-    0x91a83991U, 0x95a43195U, 0xe437d3e4U, 0x798bf279U,
-    0xe732d5e7U, 0xc8438bc8U, 0x37596e37U, 0x6db7da6dU,
-    0x8d8c018dU, 0xd564b1d5U, 0x4ed29c4eU, 0xa9e049a9U,
-    0x6cb4d86cU, 0x56faac56U, 0xf407f3f4U, 0xea25cfeaU,
-    0x65afca65U, 0x7a8ef47aU, 0xaee947aeU, 0x08181008U,
-    0xbad56fbaU, 0x7888f078U, 0x256f4a25U, 0x2e725c2eU,
-    0x1c24381cU, 0xa6f157a6U, 0xb4c773b4U, 0xc65197c6U,
-    0xe823cbe8U, 0xdd7ca1ddU, 0x749ce874U, 0x1f213e1fU,
-    0x4bdd964bU, 0xbddc61bdU, 0x8b860d8bU, 0x8a850f8aU,
-    0x7090e070U, 0x3e427c3eU, 0xb5c471b5U, 0x66aacc66U,
-    0x48d89048U, 0x03050603U, 0xf601f7f6U, 0x0e121c0eU,
-    0x61a3c261U, 0x355f6a35U, 0x57f9ae57U, 0xb9d069b9U,
-    0x86911786U, 0xc15899c1U, 0x1d273a1dU, 0x9eb9279eU,
-    0xe138d9e1U, 0xf813ebf8U, 0x98b32b98U, 0x11332211U,
-    0x69bbd269U, 0xd970a9d9U, 0x8e89078eU, 0x94a73394U,
-    0x9bb62d9bU, 0x1e223c1eU, 0x87921587U, 0xe920c9e9U,
-    0xce4987ceU, 0x55ffaa55U, 0x28785028U, 0xdf7aa5dfU,
-    0x8c8f038cU, 0xa1f859a1U, 0x89800989U, 0x0d171a0dU,
-    0xbfda65bfU, 0xe631d7e6U, 0x42c68442U, 0x68b8d068U,
-    0x41c38241U, 0x99b02999U, 0x2d775a2dU, 0x0f111e0fU,
-    0xb0cb7bb0U, 0x54fca854U, 0xbbd66dbbU, 0x163a2c16U,
-};
-static const u32 Te3[256] = {
-
-    0x6363a5c6U, 0x7c7c84f8U, 0x777799eeU, 0x7b7b8df6U,
-    0xf2f20dffU, 0x6b6bbdd6U, 0x6f6fb1deU, 0xc5c55491U,
-    0x30305060U, 0x01010302U, 0x6767a9ceU, 0x2b2b7d56U,
-    0xfefe19e7U, 0xd7d762b5U, 0xababe64dU, 0x76769aecU,
-    0xcaca458fU, 0x82829d1fU, 0xc9c94089U, 0x7d7d87faU,
-    0xfafa15efU, 0x5959ebb2U, 0x4747c98eU, 0xf0f00bfbU,
-    0xadadec41U, 0xd4d467b3U, 0xa2a2fd5fU, 0xafafea45U,
-    0x9c9cbf23U, 0xa4a4f753U, 0x727296e4U, 0xc0c05b9bU,
-    0xb7b7c275U, 0xfdfd1ce1U, 0x9393ae3dU, 0x26266a4cU,
-    0x36365a6cU, 0x3f3f417eU, 0xf7f702f5U, 0xcccc4f83U,
-    0x34345c68U, 0xa5a5f451U, 0xe5e534d1U, 0xf1f108f9U,
-    0x717193e2U, 0xd8d873abU, 0x31315362U, 0x15153f2aU,
-    0x04040c08U, 0xc7c75295U, 0x23236546U, 0xc3c35e9dU,
-    0x18182830U, 0x9696a137U, 0x05050f0aU, 0x9a9ab52fU,
-    0x0707090eU, 0x12123624U, 0x80809b1bU, 0xe2e23ddfU,
-    0xebeb26cdU, 0x2727694eU, 0xb2b2cd7fU, 0x75759feaU,
-    0x09091b12U, 0x83839e1dU, 0x2c2c7458U, 0x1a1a2e34U,
-    0x1b1b2d36U, 0x6e6eb2dcU, 0x5a5aeeb4U, 0xa0a0fb5bU,
-    0x5252f6a4U, 0x3b3b4d76U, 0xd6d661b7U, 0xb3b3ce7dU,
-    0x29297b52U, 0xe3e33eddU, 0x2f2f715eU, 0x84849713U,
-    0x5353f5a6U, 0xd1d168b9U, 0x00000000U, 0xeded2cc1U,
-    0x20206040U, 0xfcfc1fe3U, 0xb1b1c879U, 0x5b5bedb6U,
-    0x6a6abed4U, 0xcbcb468dU, 0xbebed967U, 0x39394b72U,
-    0x4a4ade94U, 0x4c4cd498U, 0x5858e8b0U, 0xcfcf4a85U,
-    0xd0d06bbbU, 0xefef2ac5U, 0xaaaae54fU, 0xfbfb16edU,
-    0x4343c586U, 0x4d4dd79aU, 0x33335566U, 0x85859411U,
-    0x4545cf8aU, 0xf9f910e9U, 0x02020604U, 0x7f7f81feU,
-    0x5050f0a0U, 0x3c3c4478U, 0x9f9fba25U, 0xa8a8e34bU,
-    0x5151f3a2U, 0xa3a3fe5dU, 0x4040c080U, 0x8f8f8a05U,
-    0x9292ad3fU, 0x9d9dbc21U, 0x38384870U, 0xf5f504f1U,
-    0xbcbcdf63U, 0xb6b6c177U, 0xdada75afU, 0x21216342U,
-    0x10103020U, 0xffff1ae5U, 0xf3f30efdU, 0xd2d26dbfU,
-    0xcdcd4c81U, 0x0c0c1418U, 0x13133526U, 0xecec2fc3U,
-    0x5f5fe1beU, 0x9797a235U, 0x4444cc88U, 0x1717392eU,
-    0xc4c45793U, 0xa7a7f255U, 0x7e7e82fcU, 0x3d3d477aU,
-    0x6464acc8U, 0x5d5de7baU, 0x19192b32U, 0x737395e6U,
-    0x6060a0c0U, 0x81819819U, 0x4f4fd19eU, 0xdcdc7fa3U,
-    0x22226644U, 0x2a2a7e54U, 0x9090ab3bU, 0x8888830bU,
-    0x4646ca8cU, 0xeeee29c7U, 0xb8b8d36bU, 0x14143c28U,
-    0xdede79a7U, 0x5e5ee2bcU, 0x0b0b1d16U, 0xdbdb76adU,
-    0xe0e03bdbU, 0x32325664U, 0x3a3a4e74U, 0x0a0a1e14U,
-    0x4949db92U, 0x06060a0cU, 0x24246c48U, 0x5c5ce4b8U,
-    0xc2c25d9fU, 0xd3d36ebdU, 0xacacef43U, 0x6262a6c4U,
-    0x9191a839U, 0x9595a431U, 0xe4e437d3U, 0x79798bf2U,
-    0xe7e732d5U, 0xc8c8438bU, 0x3737596eU, 0x6d6db7daU,
-    0x8d8d8c01U, 0xd5d564b1U, 0x4e4ed29cU, 0xa9a9e049U,
-    0x6c6cb4d8U, 0x5656faacU, 0xf4f407f3U, 0xeaea25cfU,
-    0x6565afcaU, 0x7a7a8ef4U, 0xaeaee947U, 0x08081810U,
-    0xbabad56fU, 0x787888f0U, 0x25256f4aU, 0x2e2e725cU,
-    0x1c1c2438U, 0xa6a6f157U, 0xb4b4c773U, 0xc6c65197U,
-    0xe8e823cbU, 0xdddd7ca1U, 0x74749ce8U, 0x1f1f213eU,
-    0x4b4bdd96U, 0xbdbddc61U, 0x8b8b860dU, 0x8a8a850fU,
-    0x707090e0U, 0x3e3e427cU, 0xb5b5c471U, 0x6666aaccU,
-    0x4848d890U, 0x03030506U, 0xf6f601f7U, 0x0e0e121cU,
-    0x6161a3c2U, 0x35355f6aU, 0x5757f9aeU, 0xb9b9d069U,
-    0x86869117U, 0xc1c15899U, 0x1d1d273aU, 0x9e9eb927U,
-    0xe1e138d9U, 0xf8f813ebU, 0x9898b32bU, 0x11113322U,
-    0x6969bbd2U, 0xd9d970a9U, 0x8e8e8907U, 0x9494a733U,
-    0x9b9bb62dU, 0x1e1e223cU, 0x87879215U, 0xe9e920c9U,
-    0xcece4987U, 0x5555ffaaU, 0x28287850U, 0xdfdf7aa5U,
-    0x8c8c8f03U, 0xa1a1f859U, 0x89898009U, 0x0d0d171aU,
-    0xbfbfda65U, 0xe6e631d7U, 0x4242c684U, 0x6868b8d0U,
-    0x4141c382U, 0x9999b029U, 0x2d2d775aU, 0x0f0f111eU,
-    0xb0b0cb7bU, 0x5454fca8U, 0xbbbbd66dU, 0x16163a2cU,
-};
-static const u32 Te4[256] = {
-    0x63636363U, 0x7c7c7c7cU, 0x77777777U, 0x7b7b7b7bU,
-    0xf2f2f2f2U, 0x6b6b6b6bU, 0x6f6f6f6fU, 0xc5c5c5c5U,
-    0x30303030U, 0x01010101U, 0x67676767U, 0x2b2b2b2bU,
-    0xfefefefeU, 0xd7d7d7d7U, 0xababababU, 0x76767676U,
-    0xcacacacaU, 0x82828282U, 0xc9c9c9c9U, 0x7d7d7d7dU,
-    0xfafafafaU, 0x59595959U, 0x47474747U, 0xf0f0f0f0U,
-    0xadadadadU, 0xd4d4d4d4U, 0xa2a2a2a2U, 0xafafafafU,
-    0x9c9c9c9cU, 0xa4a4a4a4U, 0x72727272U, 0xc0c0c0c0U,
-    0xb7b7b7b7U, 0xfdfdfdfdU, 0x93939393U, 0x26262626U,
-    0x36363636U, 0x3f3f3f3fU, 0xf7f7f7f7U, 0xccccccccU,
-    0x34343434U, 0xa5a5a5a5U, 0xe5e5e5e5U, 0xf1f1f1f1U,
-    0x71717171U, 0xd8d8d8d8U, 0x31313131U, 0x15151515U,
-    0x04040404U, 0xc7c7c7c7U, 0x23232323U, 0xc3c3c3c3U,
-    0x18181818U, 0x96969696U, 0x05050505U, 0x9a9a9a9aU,
-    0x07070707U, 0x12121212U, 0x80808080U, 0xe2e2e2e2U,
-    0xebebebebU, 0x27272727U, 0xb2b2b2b2U, 0x75757575U,
-    0x09090909U, 0x83838383U, 0x2c2c2c2cU, 0x1a1a1a1aU,
-    0x1b1b1b1bU, 0x6e6e6e6eU, 0x5a5a5a5aU, 0xa0a0a0a0U,
-    0x52525252U, 0x3b3b3b3bU, 0xd6d6d6d6U, 0xb3b3b3b3U,
-    0x29292929U, 0xe3e3e3e3U, 0x2f2f2f2fU, 0x84848484U,
-    0x53535353U, 0xd1d1d1d1U, 0x00000000U, 0xededededU,
-    0x20202020U, 0xfcfcfcfcU, 0xb1b1b1b1U, 0x5b5b5b5bU,
-    0x6a6a6a6aU, 0xcbcbcbcbU, 0xbebebebeU, 0x39393939U,
-    0x4a4a4a4aU, 0x4c4c4c4cU, 0x58585858U, 0xcfcfcfcfU,
-    0xd0d0d0d0U, 0xefefefefU, 0xaaaaaaaaU, 0xfbfbfbfbU,
-    0x43434343U, 0x4d4d4d4dU, 0x33333333U, 0x85858585U,
-    0x45454545U, 0xf9f9f9f9U, 0x02020202U, 0x7f7f7f7fU,
-    0x50505050U, 0x3c3c3c3cU, 0x9f9f9f9fU, 0xa8a8a8a8U,
-    0x51515151U, 0xa3a3a3a3U, 0x40404040U, 0x8f8f8f8fU,
-    0x92929292U, 0x9d9d9d9dU, 0x38383838U, 0xf5f5f5f5U,
-    0xbcbcbcbcU, 0xb6b6b6b6U, 0xdadadadaU, 0x21212121U,
-    0x10101010U, 0xffffffffU, 0xf3f3f3f3U, 0xd2d2d2d2U,
-    0xcdcdcdcdU, 0x0c0c0c0cU, 0x13131313U, 0xececececU,
-    0x5f5f5f5fU, 0x97979797U, 0x44444444U, 0x17171717U,
-    0xc4c4c4c4U, 0xa7a7a7a7U, 0x7e7e7e7eU, 0x3d3d3d3dU,
-    0x64646464U, 0x5d5d5d5dU, 0x19191919U, 0x73737373U,
-    0x60606060U, 0x81818181U, 0x4f4f4f4fU, 0xdcdcdcdcU,
-    0x22222222U, 0x2a2a2a2aU, 0x90909090U, 0x88888888U,
-    0x46464646U, 0xeeeeeeeeU, 0xb8b8b8b8U, 0x14141414U,
-    0xdedededeU, 0x5e5e5e5eU, 0x0b0b0b0bU, 0xdbdbdbdbU,
-    0xe0e0e0e0U, 0x32323232U, 0x3a3a3a3aU, 0x0a0a0a0aU,
-    0x49494949U, 0x06060606U, 0x24242424U, 0x5c5c5c5cU,
-    0xc2c2c2c2U, 0xd3d3d3d3U, 0xacacacacU, 0x62626262U,
-    0x91919191U, 0x95959595U, 0xe4e4e4e4U, 0x79797979U,
-    0xe7e7e7e7U, 0xc8c8c8c8U, 0x37373737U, 0x6d6d6d6dU,
-    0x8d8d8d8dU, 0xd5d5d5d5U, 0x4e4e4e4eU, 0xa9a9a9a9U,
-    0x6c6c6c6cU, 0x56565656U, 0xf4f4f4f4U, 0xeaeaeaeaU,
-    0x65656565U, 0x7a7a7a7aU, 0xaeaeaeaeU, 0x08080808U,
-    0xbabababaU, 0x78787878U, 0x25252525U, 0x2e2e2e2eU,
-    0x1c1c1c1cU, 0xa6a6a6a6U, 0xb4b4b4b4U, 0xc6c6c6c6U,
-    0xe8e8e8e8U, 0xddddddddU, 0x74747474U, 0x1f1f1f1fU,
-    0x4b4b4b4bU, 0xbdbdbdbdU, 0x8b8b8b8bU, 0x8a8a8a8aU,
-    0x70707070U, 0x3e3e3e3eU, 0xb5b5b5b5U, 0x66666666U,
-    0x48484848U, 0x03030303U, 0xf6f6f6f6U, 0x0e0e0e0eU,
-    0x61616161U, 0x35353535U, 0x57575757U, 0xb9b9b9b9U,
-    0x86868686U, 0xc1c1c1c1U, 0x1d1d1d1dU, 0x9e9e9e9eU,
-    0xe1e1e1e1U, 0xf8f8f8f8U, 0x98989898U, 0x11111111U,
-    0x69696969U, 0xd9d9d9d9U, 0x8e8e8e8eU, 0x94949494U,
-    0x9b9b9b9bU, 0x1e1e1e1eU, 0x87878787U, 0xe9e9e9e9U,
-    0xcecececeU, 0x55555555U, 0x28282828U, 0xdfdfdfdfU,
-    0x8c8c8c8cU, 0xa1a1a1a1U, 0x89898989U, 0x0d0d0d0dU,
-    0xbfbfbfbfU, 0xe6e6e6e6U, 0x42424242U, 0x68686868U,
-    0x41414141U, 0x99999999U, 0x2d2d2d2dU, 0x0f0f0f0fU,
-    0xb0b0b0b0U, 0x54545454U, 0xbbbbbbbbU, 0x16161616U,
-};
-static const u32 Td0[256] = {
-    0x51f4a750U, 0x7e416553U, 0x1a17a4c3U, 0x3a275e96U,
-    0x3bab6bcbU, 0x1f9d45f1U, 0xacfa58abU, 0x4be30393U,
-    0x2030fa55U, 0xad766df6U, 0x88cc7691U, 0xf5024c25U,
-    0x4fe5d7fcU, 0xc52acbd7U, 0x26354480U, 0xb562a38fU,
-    0xdeb15a49U, 0x25ba1b67U, 0x45ea0e98U, 0x5dfec0e1U,
-    0xc32f7502U, 0x814cf012U, 0x8d4697a3U, 0x6bd3f9c6U,
-    0x038f5fe7U, 0x15929c95U, 0xbf6d7aebU, 0x955259daU,
-    0xd4be832dU, 0x587421d3U, 0x49e06929U, 0x8ec9c844U,
-    0x75c2896aU, 0xf48e7978U, 0x99583e6bU, 0x27b971ddU,
-    0xbee14fb6U, 0xf088ad17U, 0xc920ac66U, 0x7dce3ab4U,
-    0x63df4a18U, 0xe51a3182U, 0x97513360U, 0x62537f45U,
-    0xb16477e0U, 0xbb6bae84U, 0xfe81a01cU, 0xf9082b94U,
-    0x70486858U, 0x8f45fd19U, 0x94de6c87U, 0x527bf8b7U,
-    0xab73d323U, 0x724b02e2U, 0xe31f8f57U, 0x6655ab2aU,
-    0xb2eb2807U, 0x2fb5c203U, 0x86c57b9aU, 0xd33708a5U,
-    0x302887f2U, 0x23bfa5b2U, 0x02036abaU, 0xed16825cU,
-    0x8acf1c2bU, 0xa779b492U, 0xf307f2f0U, 0x4e69e2a1U,
-    0x65daf4cdU, 0x0605bed5U, 0xd134621fU, 0xc4a6fe8aU,
-    0x342e539dU, 0xa2f355a0U, 0x058ae132U, 0xa4f6eb75U,
-    0x0b83ec39U, 0x4060efaaU, 0x5e719f06U, 0xbd6e1051U,
-    0x3e218af9U, 0x96dd063dU, 0xdd3e05aeU, 0x4de6bd46U,
-    0x91548db5U, 0x71c45d05U, 0x0406d46fU, 0x605015ffU,
-    0x1998fb24U, 0xd6bde997U, 0x894043ccU, 0x67d99e77U,
-    0xb0e842bdU, 0x07898b88U, 0xe7195b38U, 0x79c8eedbU,
-    0xa17c0a47U, 0x7c420fe9U, 0xf8841ec9U, 0x00000000U,
-    0x09808683U, 0x322bed48U, 0x1e1170acU, 0x6c5a724eU,
-    0xfd0efffbU, 0x0f853856U, 0x3daed51eU, 0x362d3927U,
-    0x0a0fd964U, 0x685ca621U, 0x9b5b54d1U, 0x24362e3aU,
-    0x0c0a67b1U, 0x9357e70fU, 0xb4ee96d2U, 0x1b9b919eU,
-    0x80c0c54fU, 0x61dc20a2U, 0x5a774b69U, 0x1c121a16U,
-    0xe293ba0aU, 0xc0a02ae5U, 0x3c22e043U, 0x121b171dU,
-    0x0e090d0bU, 0xf28bc7adU, 0x2db6a8b9U, 0x141ea9c8U,
-    0x57f11985U, 0xaf75074cU, 0xee99ddbbU, 0xa37f60fdU,
-    0xf701269fU, 0x5c72f5bcU, 0x44663bc5U, 0x5bfb7e34U,
-    0x8b432976U, 0xcb23c6dcU, 0xb6edfc68U, 0xb8e4f163U,
-    0xd731dccaU, 0x42638510U, 0x13972240U, 0x84c61120U,
-    0x854a247dU, 0xd2bb3df8U, 0xaef93211U, 0xc729a16dU,
-    0x1d9e2f4bU, 0xdcb230f3U, 0x0d8652ecU, 0x77c1e3d0U,
-    0x2bb3166cU, 0xa970b999U, 0x119448faU, 0x47e96422U,
-    0xa8fc8cc4U, 0xa0f03f1aU, 0x567d2cd8U, 0x223390efU,
-    0x87494ec7U, 0xd938d1c1U, 0x8ccaa2feU, 0x98d40b36U,
-    0xa6f581cfU, 0xa57ade28U, 0xdab78e26U, 0x3fadbfa4U,
-    0x2c3a9de4U, 0x5078920dU, 0x6a5fcc9bU, 0x547e4662U,
-    0xf68d13c2U, 0x90d8b8e8U, 0x2e39f75eU, 0x82c3aff5U,
-    0x9f5d80beU, 0x69d0937cU, 0x6fd52da9U, 0xcf2512b3U,
-    0xc8ac993bU, 0x10187da7U, 0xe89c636eU, 0xdb3bbb7bU,
-    0xcd267809U, 0x6e5918f4U, 0xec9ab701U, 0x834f9aa8U,
-    0xe6956e65U, 0xaaffe67eU, 0x21bccf08U, 0xef15e8e6U,
-    0xbae79bd9U, 0x4a6f36ceU, 0xea9f09d4U, 0x29b07cd6U,
-    0x31a4b2afU, 0x2a3f2331U, 0xc6a59430U, 0x35a266c0U,
-    0x744ebc37U, 0xfc82caa6U, 0xe090d0b0U, 0x33a7d815U,
-    0xf104984aU, 0x41ecdaf7U, 0x7fcd500eU, 0x1791f62fU,
-    0x764dd68dU, 0x43efb04dU, 0xccaa4d54U, 0xe49604dfU,
-    0x9ed1b5e3U, 0x4c6a881bU, 0xc12c1fb8U, 0x4665517fU,
-    0x9d5eea04U, 0x018c355dU, 0xfa877473U, 0xfb0b412eU,
-    0xb3671d5aU, 0x92dbd252U, 0xe9105633U, 0x6dd64713U,
-    0x9ad7618cU, 0x37a10c7aU, 0x59f8148eU, 0xeb133c89U,
-    0xcea927eeU, 0xb761c935U, 0xe11ce5edU, 0x7a47b13cU,
-    0x9cd2df59U, 0x55f2733fU, 0x1814ce79U, 0x73c737bfU,
-    0x53f7cdeaU, 0x5ffdaa5bU, 0xdf3d6f14U, 0x7844db86U,
-    0xcaaff381U, 0xb968c43eU, 0x3824342cU, 0xc2a3405fU,
-    0x161dc372U, 0xbce2250cU, 0x283c498bU, 0xff0d9541U,
-    0x39a80171U, 0x080cb3deU, 0xd8b4e49cU, 0x6456c190U,
-    0x7bcb8461U, 0xd532b670U, 0x486c5c74U, 0xd0b85742U,
-};
-static const u32 Td1[256] = {
-    0x5051f4a7U, 0x537e4165U, 0xc31a17a4U, 0x963a275eU,
-    0xcb3bab6bU, 0xf11f9d45U, 0xabacfa58U, 0x934be303U,
-    0x552030faU, 0xf6ad766dU, 0x9188cc76U, 0x25f5024cU,
-    0xfc4fe5d7U, 0xd7c52acbU, 0x80263544U, 0x8fb562a3U,
-    0x49deb15aU, 0x6725ba1bU, 0x9845ea0eU, 0xe15dfec0U,
-    0x02c32f75U, 0x12814cf0U, 0xa38d4697U, 0xc66bd3f9U,
-    0xe7038f5fU, 0x9515929cU, 0xebbf6d7aU, 0xda955259U,
-    0x2dd4be83U, 0xd3587421U, 0x2949e069U, 0x448ec9c8U,
-    0x6a75c289U, 0x78f48e79U, 0x6b99583eU, 0xdd27b971U,
-    0xb6bee14fU, 0x17f088adU, 0x66c920acU, 0xb47dce3aU,
-    0x1863df4aU, 0x82e51a31U, 0x60975133U, 0x4562537fU,
-    0xe0b16477U, 0x84bb6baeU, 0x1cfe81a0U, 0x94f9082bU,
-    0x58704868U, 0x198f45fdU, 0x8794de6cU, 0xb7527bf8U,
-    0x23ab73d3U, 0xe2724b02U, 0x57e31f8fU, 0x2a6655abU,
-    0x07b2eb28U, 0x032fb5c2U, 0x9a86c57bU, 0xa5d33708U,
-    0xf2302887U, 0xb223bfa5U, 0xba02036aU, 0x5ced1682U,
-    0x2b8acf1cU, 0x92a779b4U, 0xf0f307f2U, 0xa14e69e2U,
-    0xcd65daf4U, 0xd50605beU, 0x1fd13462U, 0x8ac4a6feU,
-    0x9d342e53U, 0xa0a2f355U, 0x32058ae1U, 0x75a4f6ebU,
-    0x390b83ecU, 0xaa4060efU, 0x065e719fU, 0x51bd6e10U,
-    0xf93e218aU, 0x3d96dd06U, 0xaedd3e05U, 0x464de6bdU,
-    0xb591548dU, 0x0571c45dU, 0x6f0406d4U, 0xff605015U,
-    0x241998fbU, 0x97d6bde9U, 0xcc894043U, 0x7767d99eU,
-    0xbdb0e842U, 0x8807898bU, 0x38e7195bU, 0xdb79c8eeU,
-    0x47a17c0aU, 0xe97c420fU, 0xc9f8841eU, 0x00000000U,
-    0x83098086U, 0x48322bedU, 0xac1e1170U, 0x4e6c5a72U,
-    0xfbfd0effU, 0x560f8538U, 0x1e3daed5U, 0x27362d39U,
-    0x640a0fd9U, 0x21685ca6U, 0xd19b5b54U, 0x3a24362eU,
-    0xb10c0a67U, 0x0f9357e7U, 0xd2b4ee96U, 0x9e1b9b91U,
-    0x4f80c0c5U, 0xa261dc20U, 0x695a774bU, 0x161c121aU,
-    0x0ae293baU, 0xe5c0a02aU, 0x433c22e0U, 0x1d121b17U,
-    0x0b0e090dU, 0xadf28bc7U, 0xb92db6a8U, 0xc8141ea9U,
-    0x8557f119U, 0x4caf7507U, 0xbbee99ddU, 0xfda37f60U,
-    0x9ff70126U, 0xbc5c72f5U, 0xc544663bU, 0x345bfb7eU,
-    0x768b4329U, 0xdccb23c6U, 0x68b6edfcU, 0x63b8e4f1U,
-    0xcad731dcU, 0x10426385U, 0x40139722U, 0x2084c611U,
-    0x7d854a24U, 0xf8d2bb3dU, 0x11aef932U, 0x6dc729a1U,
-    0x4b1d9e2fU, 0xf3dcb230U, 0xec0d8652U, 0xd077c1e3U,
-    0x6c2bb316U, 0x99a970b9U, 0xfa119448U, 0x2247e964U,
-    0xc4a8fc8cU, 0x1aa0f03fU, 0xd8567d2cU, 0xef223390U,
-    0xc787494eU, 0xc1d938d1U, 0xfe8ccaa2U, 0x3698d40bU,
-    0xcfa6f581U, 0x28a57adeU, 0x26dab78eU, 0xa43fadbfU,
-    0xe42c3a9dU, 0x0d507892U, 0x9b6a5fccU, 0x62547e46U,
-    0xc2f68d13U, 0xe890d8b8U, 0x5e2e39f7U, 0xf582c3afU,
-    0xbe9f5d80U, 0x7c69d093U, 0xa96fd52dU, 0xb3cf2512U,
-    0x3bc8ac99U, 0xa710187dU, 0x6ee89c63U, 0x7bdb3bbbU,
-    0x09cd2678U, 0xf46e5918U, 0x01ec9ab7U, 0xa8834f9aU,
-    0x65e6956eU, 0x7eaaffe6U, 0x0821bccfU, 0xe6ef15e8U,
-    0xd9bae79bU, 0xce4a6f36U, 0xd4ea9f09U, 0xd629b07cU,
-    0xaf31a4b2U, 0x312a3f23U, 0x30c6a594U, 0xc035a266U,
-    0x37744ebcU, 0xa6fc82caU, 0xb0e090d0U, 0x1533a7d8U,
-    0x4af10498U, 0xf741ecdaU, 0x0e7fcd50U, 0x2f1791f6U,
-    0x8d764dd6U, 0x4d43efb0U, 0x54ccaa4dU, 0xdfe49604U,
-    0xe39ed1b5U, 0x1b4c6a88U, 0xb8c12c1fU, 0x7f466551U,
-    0x049d5eeaU, 0x5d018c35U, 0x73fa8774U, 0x2efb0b41U,
-    0x5ab3671dU, 0x5292dbd2U, 0x33e91056U, 0x136dd647U,
-    0x8c9ad761U, 0x7a37a10cU, 0x8e59f814U, 0x89eb133cU,
-    0xeecea927U, 0x35b761c9U, 0xede11ce5U, 0x3c7a47b1U,
-    0x599cd2dfU, 0x3f55f273U, 0x791814ceU, 0xbf73c737U,
-    0xea53f7cdU, 0x5b5ffdaaU, 0x14df3d6fU, 0x867844dbU,
-    0x81caaff3U, 0x3eb968c4U, 0x2c382434U, 0x5fc2a340U,
-    0x72161dc3U, 0x0cbce225U, 0x8b283c49U, 0x41ff0d95U,
-    0x7139a801U, 0xde080cb3U, 0x9cd8b4e4U, 0x906456c1U,
-    0x617bcb84U, 0x70d532b6U, 0x74486c5cU, 0x42d0b857U,
-};
-static const u32 Td2[256] = {
-    0xa75051f4U, 0x65537e41U, 0xa4c31a17U, 0x5e963a27U,
-    0x6bcb3babU, 0x45f11f9dU, 0x58abacfaU, 0x03934be3U,
-    0xfa552030U, 0x6df6ad76U, 0x769188ccU, 0x4c25f502U,
-    0xd7fc4fe5U, 0xcbd7c52aU, 0x44802635U, 0xa38fb562U,
-    0x5a49deb1U, 0x1b6725baU, 0x0e9845eaU, 0xc0e15dfeU,
-    0x7502c32fU, 0xf012814cU, 0x97a38d46U, 0xf9c66bd3U,
-    0x5fe7038fU, 0x9c951592U, 0x7aebbf6dU, 0x59da9552U,
-    0x832dd4beU, 0x21d35874U, 0x692949e0U, 0xc8448ec9U,
-    0x896a75c2U, 0x7978f48eU, 0x3e6b9958U, 0x71dd27b9U,
-    0x4fb6bee1U, 0xad17f088U, 0xac66c920U, 0x3ab47dceU,
-    0x4a1863dfU, 0x3182e51aU, 0x33609751U, 0x7f456253U,
-    0x77e0b164U, 0xae84bb6bU, 0xa01cfe81U, 0x2b94f908U,
-    0x68587048U, 0xfd198f45U, 0x6c8794deU, 0xf8b7527bU,
-    0xd323ab73U, 0x02e2724bU, 0x8f57e31fU, 0xab2a6655U,
-    0x2807b2ebU, 0xc2032fb5U, 0x7b9a86c5U, 0x08a5d337U,
-    0x87f23028U, 0xa5b223bfU, 0x6aba0203U, 0x825ced16U,
-    0x1c2b8acfU, 0xb492a779U, 0xf2f0f307U, 0xe2a14e69U,
-    0xf4cd65daU, 0xbed50605U, 0x621fd134U, 0xfe8ac4a6U,
-    0x539d342eU, 0x55a0a2f3U, 0xe132058aU, 0xeb75a4f6U,
-    0xec390b83U, 0xefaa4060U, 0x9f065e71U, 0x1051bd6eU,
-
-    0x8af93e21U, 0x063d96ddU, 0x05aedd3eU, 0xbd464de6U,
-    0x8db59154U, 0x5d0571c4U, 0xd46f0406U, 0x15ff6050U,
-    0xfb241998U, 0xe997d6bdU, 0x43cc8940U, 0x9e7767d9U,
-    0x42bdb0e8U, 0x8b880789U, 0x5b38e719U, 0xeedb79c8U,
-    0x0a47a17cU, 0x0fe97c42U, 0x1ec9f884U, 0x00000000U,
-    0x86830980U, 0xed48322bU, 0x70ac1e11U, 0x724e6c5aU,
-    0xfffbfd0eU, 0x38560f85U, 0xd51e3daeU, 0x3927362dU,
-    0xd9640a0fU, 0xa621685cU, 0x54d19b5bU, 0x2e3a2436U,
-    0x67b10c0aU, 0xe70f9357U, 0x96d2b4eeU, 0x919e1b9bU,
-    0xc54f80c0U, 0x20a261dcU, 0x4b695a77U, 0x1a161c12U,
-    0xba0ae293U, 0x2ae5c0a0U, 0xe0433c22U, 0x171d121bU,
-    0x0d0b0e09U, 0xc7adf28bU, 0xa8b92db6U, 0xa9c8141eU,
-    0x198557f1U, 0x074caf75U, 0xddbbee99U, 0x60fda37fU,
-    0x269ff701U, 0xf5bc5c72U, 0x3bc54466U, 0x7e345bfbU,
-    0x29768b43U, 0xc6dccb23U, 0xfc68b6edU, 0xf163b8e4U,
-    0xdccad731U, 0x85104263U, 0x22401397U, 0x112084c6U,
-    0x247d854aU, 0x3df8d2bbU, 0x3211aef9U, 0xa16dc729U,
-    0x2f4b1d9eU, 0x30f3dcb2U, 0x52ec0d86U, 0xe3d077c1U,
-    0x166c2bb3U, 0xb999a970U, 0x48fa1194U, 0x642247e9U,
-    0x8cc4a8fcU, 0x3f1aa0f0U, 0x2cd8567dU, 0x90ef2233U,
-    0x4ec78749U, 0xd1c1d938U, 0xa2fe8ccaU, 0x0b3698d4U,
-    0x81cfa6f5U, 0xde28a57aU, 0x8e26dab7U, 0xbfa43fadU,
-    0x9de42c3aU, 0x920d5078U, 0xcc9b6a5fU, 0x4662547eU,
-    0x13c2f68dU, 0xb8e890d8U, 0xf75e2e39U, 0xaff582c3U,
-    0x80be9f5dU, 0x937c69d0U, 0x2da96fd5U, 0x12b3cf25U,
-    0x993bc8acU, 0x7da71018U, 0x636ee89cU, 0xbb7bdb3bU,
-    0x7809cd26U, 0x18f46e59U, 0xb701ec9aU, 0x9aa8834fU,
-    0x6e65e695U, 0xe67eaaffU, 0xcf0821bcU, 0xe8e6ef15U,
-    0x9bd9bae7U, 0x36ce4a6fU, 0x09d4ea9fU, 0x7cd629b0U,
-    0xb2af31a4U, 0x23312a3fU, 0x9430c6a5U, 0x66c035a2U,
-    0xbc37744eU, 0xcaa6fc82U, 0xd0b0e090U, 0xd81533a7U,
-    0x984af104U, 0xdaf741ecU, 0x500e7fcdU, 0xf62f1791U,
-    0xd68d764dU, 0xb04d43efU, 0x4d54ccaaU, 0x04dfe496U,
-    0xb5e39ed1U, 0x881b4c6aU, 0x1fb8c12cU, 0x517f4665U,
-    0xea049d5eU, 0x355d018cU, 0x7473fa87U, 0x412efb0bU,
-    0x1d5ab367U, 0xd25292dbU, 0x5633e910U, 0x47136dd6U,
-    0x618c9ad7U, 0x0c7a37a1U, 0x148e59f8U, 0x3c89eb13U,
-    0x27eecea9U, 0xc935b761U, 0xe5ede11cU, 0xb13c7a47U,
-    0xdf599cd2U, 0x733f55f2U, 0xce791814U, 0x37bf73c7U,
-    0xcdea53f7U, 0xaa5b5ffdU, 0x6f14df3dU, 0xdb867844U,
-    0xf381caafU, 0xc43eb968U, 0x342c3824U, 0x405fc2a3U,
-    0xc372161dU, 0x250cbce2U, 0x498b283cU, 0x9541ff0dU,
-    0x017139a8U, 0xb3de080cU, 0xe49cd8b4U, 0xc1906456U,
-    0x84617bcbU, 0xb670d532U, 0x5c74486cU, 0x5742d0b8U,
-};
-static const u32 Td3[256] = {
-    0xf4a75051U, 0x4165537eU, 0x17a4c31aU, 0x275e963aU,
-    0xab6bcb3bU, 0x9d45f11fU, 0xfa58abacU, 0xe303934bU,
-    0x30fa5520U, 0x766df6adU, 0xcc769188U, 0x024c25f5U,
-    0xe5d7fc4fU, 0x2acbd7c5U, 0x35448026U, 0x62a38fb5U,
-    0xb15a49deU, 0xba1b6725U, 0xea0e9845U, 0xfec0e15dU,
-    0x2f7502c3U, 0x4cf01281U, 0x4697a38dU, 0xd3f9c66bU,
-    0x8f5fe703U, 0x929c9515U, 0x6d7aebbfU, 0x5259da95U,
-    0xbe832dd4U, 0x7421d358U, 0xe0692949U, 0xc9c8448eU,
-    0xc2896a75U, 0x8e7978f4U, 0x583e6b99U, 0xb971dd27U,
-    0xe14fb6beU, 0x88ad17f0U, 0x20ac66c9U, 0xce3ab47dU,
-    0xdf4a1863U, 0x1a3182e5U, 0x51336097U, 0x537f4562U,
-    0x6477e0b1U, 0x6bae84bbU, 0x81a01cfeU, 0x082b94f9U,
-    0x48685870U, 0x45fd198fU, 0xde6c8794U, 0x7bf8b752U,
-    0x73d323abU, 0x4b02e272U, 0x1f8f57e3U, 0x55ab2a66U,
-    0xeb2807b2U, 0xb5c2032fU, 0xc57b9a86U, 0x3708a5d3U,
-    0x2887f230U, 0xbfa5b223U, 0x036aba02U, 0x16825cedU,
-    0xcf1c2b8aU, 0x79b492a7U, 0x07f2f0f3U, 0x69e2a14eU,
-    0xdaf4cd65U, 0x05bed506U, 0x34621fd1U, 0xa6fe8ac4U,
-    0x2e539d34U, 0xf355a0a2U, 0x8ae13205U, 0xf6eb75a4U,
-    0x83ec390bU, 0x60efaa40U, 0x719f065eU, 0x6e1051bdU,
-    0x218af93eU, 0xdd063d96U, 0x3e05aeddU, 0xe6bd464dU,
-    0x548db591U, 0xc45d0571U, 0x06d46f04U, 0x5015ff60U,
-    0x98fb2419U, 0xbde997d6U, 0x4043cc89U, 0xd99e7767U,
-    0xe842bdb0U, 0x898b8807U, 0x195b38e7U, 0xc8eedb79U,
-    0x7c0a47a1U, 0x420fe97cU, 0x841ec9f8U, 0x00000000U,
-    0x80868309U, 0x2bed4832U, 0x1170ac1eU, 0x5a724e6cU,
-    0x0efffbfdU, 0x8538560fU, 0xaed51e3dU, 0x2d392736U,
-    0x0fd9640aU, 0x5ca62168U, 0x5b54d19bU, 0x362e3a24U,
-    0x0a67b10cU, 0x57e70f93U, 0xee96d2b4U, 0x9b919e1bU,
-    0xc0c54f80U, 0xdc20a261U, 0x774b695aU, 0x121a161cU,
-    0x93ba0ae2U, 0xa02ae5c0U, 0x22e0433cU, 0x1b171d12U,
-    0x090d0b0eU, 0x8bc7adf2U, 0xb6a8b92dU, 0x1ea9c814U,
-    0xf1198557U, 0x75074cafU, 0x99ddbbeeU, 0x7f60fda3U,
-    0x01269ff7U, 0x72f5bc5cU, 0x663bc544U, 0xfb7e345bU,
-    0x4329768bU, 0x23c6dccbU, 0xedfc68b6U, 0xe4f163b8U,
-    0x31dccad7U, 0x63851042U, 0x97224013U, 0xc6112084U,
-    0x4a247d85U, 0xbb3df8d2U, 0xf93211aeU, 0x29a16dc7U,
-    0x9e2f4b1dU, 0xb230f3dcU, 0x8652ec0dU, 0xc1e3d077U,
-    0xb3166c2bU, 0x70b999a9U, 0x9448fa11U, 0xe9642247U,
-    0xfc8cc4a8U, 0xf03f1aa0U, 0x7d2cd856U, 0x3390ef22U,
-    0x494ec787U, 0x38d1c1d9U, 0xcaa2fe8cU, 0xd40b3698U,
-    0xf581cfa6U, 0x7ade28a5U, 0xb78e26daU, 0xadbfa43fU,
-    0x3a9de42cU, 0x78920d50U, 0x5fcc9b6aU, 0x7e466254U,
-    0x8d13c2f6U, 0xd8b8e890U, 0x39f75e2eU, 0xc3aff582U,
-    0x5d80be9fU, 0xd0937c69U, 0xd52da96fU, 0x2512b3cfU,
-    0xac993bc8U, 0x187da710U, 0x9c636ee8U, 0x3bbb7bdbU,
-    0x267809cdU, 0x5918f46eU, 0x9ab701ecU, 0x4f9aa883U,
-    0x956e65e6U, 0xffe67eaaU, 0xbccf0821U, 0x15e8e6efU,
-    0xe79bd9baU, 0x6f36ce4aU, 0x9f09d4eaU, 0xb07cd629U,
-    0xa4b2af31U, 0x3f23312aU, 0xa59430c6U, 0xa266c035U,
-    0x4ebc3774U, 0x82caa6fcU, 0x90d0b0e0U, 0xa7d81533U,
-    0x04984af1U, 0xecdaf741U, 0xcd500e7fU, 0x91f62f17U,
-    0x4dd68d76U, 0xefb04d43U, 0xaa4d54ccU, 0x9604dfe4U,
-    0xd1b5e39eU, 0x6a881b4cU, 0x2c1fb8c1U, 0x65517f46U,
-    0x5eea049dU, 0x8c355d01U, 0x877473faU, 0x0b412efbU,
-    0x671d5ab3U, 0xdbd25292U, 0x105633e9U, 0xd647136dU,
-    0xd7618c9aU, 0xa10c7a37U, 0xf8148e59U, 0x133c89ebU,
-    0xa927eeceU, 0x61c935b7U, 0x1ce5ede1U, 0x47b13c7aU,
-    0xd2df599cU, 0xf2733f55U, 0x14ce7918U, 0xc737bf73U,
-    0xf7cdea53U, 0xfdaa5b5fU, 0x3d6f14dfU, 0x44db8678U,
-    0xaff381caU, 0x68c43eb9U, 0x24342c38U, 0xa3405fc2U,
-    0x1dc37216U, 0xe2250cbcU, 0x3c498b28U, 0x0d9541ffU,
-    0xa8017139U, 0x0cb3de08U, 0xb4e49cd8U, 0x56c19064U,
-    0xcb84617bU, 0x32b670d5U, 0x6c5c7448U, 0xb85742d0U,
-};
-static const u32 Td4[256] = {
-    0x52525252U, 0x09090909U, 0x6a6a6a6aU, 0xd5d5d5d5U,
-    0x30303030U, 0x36363636U, 0xa5a5a5a5U, 0x38383838U,
-    0xbfbfbfbfU, 0x40404040U, 0xa3a3a3a3U, 0x9e9e9e9eU,
-    0x81818181U, 0xf3f3f3f3U, 0xd7d7d7d7U, 0xfbfbfbfbU,
-    0x7c7c7c7cU, 0xe3e3e3e3U, 0x39393939U, 0x82828282U,
-    0x9b9b9b9bU, 0x2f2f2f2fU, 0xffffffffU, 0x87878787U,
-    0x34343434U, 0x8e8e8e8eU, 0x43434343U, 0x44444444U,
-    0xc4c4c4c4U, 0xdedededeU, 0xe9e9e9e9U, 0xcbcbcbcbU,
-    0x54545454U, 0x7b7b7b7bU, 0x94949494U, 0x32323232U,
-    0xa6a6a6a6U, 0xc2c2c2c2U, 0x23232323U, 0x3d3d3d3dU,
-    0xeeeeeeeeU, 0x4c4c4c4cU, 0x95959595U, 0x0b0b0b0bU,
-    0x42424242U, 0xfafafafaU, 0xc3c3c3c3U, 0x4e4e4e4eU,
-    0x08080808U, 0x2e2e2e2eU, 0xa1a1a1a1U, 0x66666666U,
-    0x28282828U, 0xd9d9d9d9U, 0x24242424U, 0xb2b2b2b2U,
-    0x76767676U, 0x5b5b5b5bU, 0xa2a2a2a2U, 0x49494949U,
-    0x6d6d6d6dU, 0x8b8b8b8bU, 0xd1d1d1d1U, 0x25252525U,
-    0x72727272U, 0xf8f8f8f8U, 0xf6f6f6f6U, 0x64646464U,
-    0x86868686U, 0x68686868U, 0x98989898U, 0x16161616U,
-    0xd4d4d4d4U, 0xa4a4a4a4U, 0x5c5c5c5cU, 0xccccccccU,
-    0x5d5d5d5dU, 0x65656565U, 0xb6b6b6b6U, 0x92929292U,
-    0x6c6c6c6cU, 0x70707070U, 0x48484848U, 0x50505050U,
-    0xfdfdfdfdU, 0xededededU, 0xb9b9b9b9U, 0xdadadadaU,
-    0x5e5e5e5eU, 0x15151515U, 0x46464646U, 0x57575757U,
-    0xa7a7a7a7U, 0x8d8d8d8dU, 0x9d9d9d9dU, 0x84848484U,
-    0x90909090U, 0xd8d8d8d8U, 0xababababU, 0x00000000U,
-    0x8c8c8c8cU, 0xbcbcbcbcU, 0xd3d3d3d3U, 0x0a0a0a0aU,
-    0xf7f7f7f7U, 0xe4e4e4e4U, 0x58585858U, 0x05050505U,
-    0xb8b8b8b8U, 0xb3b3b3b3U, 0x45454545U, 0x06060606U,
-    0xd0d0d0d0U, 0x2c2c2c2cU, 0x1e1e1e1eU, 0x8f8f8f8fU,
-    0xcacacacaU, 0x3f3f3f3fU, 0x0f0f0f0fU, 0x02020202U,
-    0xc1c1c1c1U, 0xafafafafU, 0xbdbdbdbdU, 0x03030303U,
-    0x01010101U, 0x13131313U, 0x8a8a8a8aU, 0x6b6b6b6bU,
-    0x3a3a3a3aU, 0x91919191U, 0x11111111U, 0x41414141U,
-    0x4f4f4f4fU, 0x67676767U, 0xdcdcdcdcU, 0xeaeaeaeaU,
-    0x97979797U, 0xf2f2f2f2U, 0xcfcfcfcfU, 0xcecececeU,
-    0xf0f0f0f0U, 0xb4b4b4b4U, 0xe6e6e6e6U, 0x73737373U,
-    0x96969696U, 0xacacacacU, 0x74747474U, 0x22222222U,
-    0xe7e7e7e7U, 0xadadadadU, 0x35353535U, 0x85858585U,
-    0xe2e2e2e2U, 0xf9f9f9f9U, 0x37373737U, 0xe8e8e8e8U,
-    0x1c1c1c1cU, 0x75757575U, 0xdfdfdfdfU, 0x6e6e6e6eU,
-    0x47474747U, 0xf1f1f1f1U, 0x1a1a1a1aU, 0x71717171U,
-    0x1d1d1d1dU, 0x29292929U, 0xc5c5c5c5U, 0x89898989U,
-    0x6f6f6f6fU, 0xb7b7b7b7U, 0x62626262U, 0x0e0e0e0eU,
-    0xaaaaaaaaU, 0x18181818U, 0xbebebebeU, 0x1b1b1b1bU,
-    0xfcfcfcfcU, 0x56565656U, 0x3e3e3e3eU, 0x4b4b4b4bU,
-    0xc6c6c6c6U, 0xd2d2d2d2U, 0x79797979U, 0x20202020U,
-    0x9a9a9a9aU, 0xdbdbdbdbU, 0xc0c0c0c0U, 0xfefefefeU,
-    0x78787878U, 0xcdcdcdcdU, 0x5a5a5a5aU, 0xf4f4f4f4U,
-    0x1f1f1f1fU, 0xddddddddU, 0xa8a8a8a8U, 0x33333333U,
-    0x88888888U, 0x07070707U, 0xc7c7c7c7U, 0x31313131U,
-    0xb1b1b1b1U, 0x12121212U, 0x10101010U, 0x59595959U,
-    0x27272727U, 0x80808080U, 0xececececU, 0x5f5f5f5fU,
-    0x60606060U, 0x51515151U, 0x7f7f7f7fU, 0xa9a9a9a9U,
-    0x19191919U, 0xb5b5b5b5U, 0x4a4a4a4aU, 0x0d0d0d0dU,
-    0x2d2d2d2dU, 0xe5e5e5e5U, 0x7a7a7a7aU, 0x9f9f9f9fU,
-    0x93939393U, 0xc9c9c9c9U, 0x9c9c9c9cU, 0xefefefefU,
-    0xa0a0a0a0U, 0xe0e0e0e0U, 0x3b3b3b3bU, 0x4d4d4d4dU,
-    0xaeaeaeaeU, 0x2a2a2a2aU, 0xf5f5f5f5U, 0xb0b0b0b0U,
-    0xc8c8c8c8U, 0xebebebebU, 0xbbbbbbbbU, 0x3c3c3c3cU,
-    0x83838383U, 0x53535353U, 0x99999999U, 0x61616161U,
-    0x17171717U, 0x2b2b2b2bU, 0x04040404U, 0x7e7e7e7eU,
-    0xbabababaU, 0x77777777U, 0xd6d6d6d6U, 0x26262626U,
-    0xe1e1e1e1U, 0x69696969U, 0x14141414U, 0x63636363U,
-    0x55555555U, 0x21212121U, 0x0c0c0c0cU, 0x7d7d7d7dU,
-};
-static const u32 rcon[] = {
-	0x01000000, 0x02000000, 0x04000000, 0x08000000,
-	0x10000000, 0x20000000, 0x40000000, 0x80000000,
-	0x1B000000, 0x36000000, /* for 128-bit blocks, Rijndael never uses more than 10 rcon values */
-};
-
-#define GETU32(pt) (((u32)(pt)[0] << 24) ^ ((u32)(pt)[1] << 16) ^ ((u32)(pt)[2] <<  8) ^ ((u32)(pt)[3]))
-#define PUTU32(ct, st) { (ct)[0] = (u8)((st) >> 24); (ct)[1] = (u8)((st) >> 16); (ct)[2] = (u8)((st) >>  8); (ct)[3] = (u8)(st); }
-
-/**
- * Expand the cipher key into the encryption key schedule.
- *
- * @return	the number of rounds for the given cipher key size.
- */
-static int rijndaelKeySetupEnc(u32 rk[/*4*(Nr + 1)*/], const u8 cipherKey[], int keyBits) {
-   	int i = 0;
-	u32 temp;
-
-	rk[0] = GETU32(cipherKey     );
-	rk[1] = GETU32(cipherKey +  4);
-	rk[2] = GETU32(cipherKey +  8);
-	rk[3] = GETU32(cipherKey + 12);
-	if (keyBits == 128) {
-		for (;;) {
-			temp  = rk[3];
-			rk[4] = rk[0] ^
-				(Te4[(temp >> 16) & 0xff] & 0xff000000) ^
-				(Te4[(temp >>  8) & 0xff] & 0x00ff0000) ^
-				(Te4[(temp      ) & 0xff] & 0x0000ff00) ^
-				(Te4[(temp >> 24)       ] & 0x000000ff) ^
-				rcon[i];
-			rk[5] = rk[1] ^ rk[4];
-			rk[6] = rk[2] ^ rk[5];
-			rk[7] = rk[3] ^ rk[6];
-			if (++i == 10) {
-				return 10;
-			}
-			rk += 4;
-		}
-	}
-	rk[4] = GETU32(cipherKey + 16);
-	rk[5] = GETU32(cipherKey + 20);
-	if (keyBits == 192) {
-		for (;;) {
-			temp = rk[ 5];
-			rk[ 6] = rk[ 0] ^
-				(Te4[(temp >> 16) & 0xff] & 0xff000000) ^
-				(Te4[(temp >>  8) & 0xff] & 0x00ff0000) ^
-				(Te4[(temp      ) & 0xff] & 0x0000ff00) ^
-				(Te4[(temp >> 24)       ] & 0x000000ff) ^
-				rcon[i];
-			rk[ 7] = rk[ 1] ^ rk[ 6];
-			rk[ 8] = rk[ 2] ^ rk[ 7];
-			rk[ 9] = rk[ 3] ^ rk[ 8];
-			if (++i == 8) {
-				return 12;
-			}
-			rk[10] = rk[ 4] ^ rk[ 9];
-			rk[11] = rk[ 5] ^ rk[10];
-			rk += 6;
-		}
-	}
-	rk[6] = GETU32(cipherKey + 24);
-	rk[7] = GETU32(cipherKey + 28);
-	if (keyBits == 256) {
-		for (;;) {
-			temp = rk[ 7];
-			rk[ 8] = rk[ 0] ^
-				(Te4[(temp >> 16) & 0xff] & 0xff000000) ^
-				(Te4[(temp >>  8) & 0xff] & 0x00ff0000) ^
-				(Te4[(temp      ) & 0xff] & 0x0000ff00) ^
-				(Te4[(temp >> 24)       ] & 0x000000ff) ^
-				rcon[i];
-			rk[ 9] = rk[ 1] ^ rk[ 8];
-			rk[10] = rk[ 2] ^ rk[ 9];
-			rk[11] = rk[ 3] ^ rk[10];
-				if (++i == 7) {
-					return 14;
-				}
-			temp = rk[11];
-			rk[12] = rk[ 4] ^
-				(Te4[(temp >> 24)       ] & 0xff000000) ^
-				(Te4[(temp >> 16) & 0xff] & 0x00ff0000) ^
-				(Te4[(temp >>  8) & 0xff] & 0x0000ff00) ^
-				(Te4[(temp      ) & 0xff] & 0x000000ff);
-			rk[13] = rk[ 5] ^ rk[12];
-			rk[14] = rk[ 6] ^ rk[13];
-		     	rk[15] = rk[ 7] ^ rk[14];
-			rk += 8;
-		}
-	}
-	return 0;
-}
-
-/**
- * Expand the cipher key into the decryption key schedule.
- *
- * @return	the number of rounds for the given cipher key size.
- */
-static int
-rijndaelKeySetupDec(u32 rk[/*4*(Nr + 1)*/], const u8 cipherKey[], int keyBits,
-    int have_encrypt) {
-	int Nr, i, j;
-	u32 temp;
-
-	if (have_encrypt) {
-		Nr = have_encrypt;
-	} else {
-		/* expand the cipher key: */
-		Nr = rijndaelKeySetupEnc(rk, cipherKey, keyBits);
-	}
-	/* invert the order of the round keys: */
-	for (i = 0, j = 4*Nr; i < j; i += 4, j -= 4) {
-		temp = rk[i    ]; rk[i    ] = rk[j    ]; rk[j    ] = temp;
-		temp = rk[i + 1]; rk[i + 1] = rk[j + 1]; rk[j + 1] = temp;
-		temp = rk[i + 2]; rk[i + 2] = rk[j + 2]; rk[j + 2] = temp;
-		temp = rk[i + 3]; rk[i + 3] = rk[j + 3]; rk[j + 3] = temp;
-	}
-	/* apply the inverse MixColumn transform to all round keys but the first and the last: */
-	for (i = 1; i < Nr; i++) {
-		rk += 4;
-		rk[0] =
-			Td0[Te4[(rk[0] >> 24)       ] & 0xff] ^
-			Td1[Te4[(rk[0] >> 16) & 0xff] & 0xff] ^
-			Td2[Te4[(rk[0] >>  8) & 0xff] & 0xff] ^
-			Td3[Te4[(rk[0]      ) & 0xff] & 0xff];
-		rk[1] =
-			Td0[Te4[(rk[1] >> 24)       ] & 0xff] ^
-			Td1[Te4[(rk[1] >> 16) & 0xff] & 0xff] ^
-			Td2[Te4[(rk[1] >>  8) & 0xff] & 0xff] ^
-			Td3[Te4[(rk[1]      ) & 0xff] & 0xff];
-		rk[2] =
-			Td0[Te4[(rk[2] >> 24)       ] & 0xff] ^
-			Td1[Te4[(rk[2] >> 16) & 0xff] & 0xff] ^
-			Td2[Te4[(rk[2] >>  8) & 0xff] & 0xff] ^
-			Td3[Te4[(rk[2]      ) & 0xff] & 0xff];
-		rk[3] =
-			Td0[Te4[(rk[3] >> 24)       ] & 0xff] ^
-			Td1[Te4[(rk[3] >> 16) & 0xff] & 0xff] ^
-			Td2[Te4[(rk[3] >>  8) & 0xff] & 0xff] ^
-			Td3[Te4[(rk[3]      ) & 0xff] & 0xff];
-	}
-	return Nr;
-}
-
-static void rijndaelEncrypt(const u32 rk[/*4*(Nr + 1)*/], int Nr, const u8 pt[16], u8 ct[16]) {
-	u32 s0, s1, s2, s3, t0, t1, t2, t3;
-#ifndef FULL_UNROLL
-    int r;
-#endif /* ?FULL_UNROLL */
-
-    /*
-	 * map byte array block to cipher state
-	 * and add initial round key:
-	 */
-	s0 = GETU32(pt     ) ^ rk[0];
-	s1 = GETU32(pt +  4) ^ rk[1];
-	s2 = GETU32(pt +  8) ^ rk[2];
-	s3 = GETU32(pt + 12) ^ rk[3];
-#ifdef FULL_UNROLL
-    /* round 1: */
-   	t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >>  8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[ 4];
-   	t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >>  8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[ 5];
-   	t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >>  8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[ 6];
-   	t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >>  8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[ 7];
-   	/* round 2: */
-   	s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >>  8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[ 8];
-   	s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >>  8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[ 9];
-   	s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >>  8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[10];
-   	s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >>  8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[11];
-    /* round 3: */
-   	t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >>  8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[12];
-   	t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >>  8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[13];
-   	t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >>  8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[14];
-   	t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >>  8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[15];
-   	/* round 4: */
-   	s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >>  8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[16];
-   	s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >>  8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[17];
-   	s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >>  8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[18];
-   	s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >>  8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[19];
-    /* round 5: */
-   	t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >>  8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[20];
-   	t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >>  8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[21];
-   	t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >>  8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[22];
-   	t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >>  8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[23];
-   	/* round 6: */
-   	s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >>  8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[24];
-   	s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >>  8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[25];
-   	s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >>  8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[26];
-   	s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >>  8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[27];
-    /* round 7: */
-   	t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >>  8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[28];
-   	t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >>  8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[29];
-   	t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >>  8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[30];
-   	t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >>  8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[31];
-   	/* round 8: */
-   	s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >>  8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[32];
-   	s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >>  8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[33];
-   	s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >>  8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[34];
-   	s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >>  8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[35];
-    /* round 9: */
-   	t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >>  8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[36];
-   	t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >>  8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[37];
-   	t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >>  8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[38];
-   	t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >>  8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[39];
-    if (Nr > 10) {
-	/* round 10: */
-	s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >>  8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[40];
-	s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >>  8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[41];
-	s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >>  8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[42];
-	s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >>  8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[43];
-	/* round 11: */
-	t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >>  8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[44];
-	t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >>  8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[45];
-	t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >>  8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[46];
-	t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >>  8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[47];
-	if (Nr > 12) {
-	    /* round 12: */
-	    s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >>  8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[48];
-	    s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >>  8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[49];
-	    s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >>  8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[50];
-	    s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >>  8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[51];
-	    /* round 13: */
-	    t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >>  8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[52];
-	    t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >>  8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[53];
-	    t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >>  8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[54];
-	    t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >>  8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[55];
-	}
-    }
-    rk += Nr << 2;
-#else  /* !FULL_UNROLL */
-    /*
-	 * Nr - 1 full rounds:
-	 */
-    r = Nr >> 1;
-    for (;;) {
-	t0 =
-	    Te0[(s0 >> 24)       ] ^
-	    Te1[(s1 >> 16) & 0xff] ^
-	    Te2[(s2 >>  8) & 0xff] ^
-	    Te3[(s3      ) & 0xff] ^
-	    rk[4];
-	t1 =
-	    Te0[(s1 >> 24)       ] ^
-	    Te1[(s2 >> 16) & 0xff] ^
-	    Te2[(s3 >>  8) & 0xff] ^
-	    Te3[(s0      ) & 0xff] ^
-	    rk[5];
-	t2 =
-	    Te0[(s2 >> 24)       ] ^
-	    Te1[(s3 >> 16) & 0xff] ^
-	    Te2[(s0 >>  8) & 0xff] ^
-	    Te3[(s1      ) & 0xff] ^
-	    rk[6];
-	t3 =
-	    Te0[(s3 >> 24)       ] ^
-	    Te1[(s0 >> 16) & 0xff] ^
-	    Te2[(s1 >>  8) & 0xff] ^
-	    Te3[(s2      ) & 0xff] ^
-	    rk[7];
-
-	rk += 8;
-	if (--r == 0) {
-	    break;
-	}
-
-	s0 =
-	    Te0[(t0 >> 24)       ] ^
-	    Te1[(t1 >> 16) & 0xff] ^
-	    Te2[(t2 >>  8) & 0xff] ^
-	    Te3[(t3      ) & 0xff] ^
-	    rk[0];
-	s1 =
-	    Te0[(t1 >> 24)       ] ^
-	    Te1[(t2 >> 16) & 0xff] ^
-	    Te2[(t3 >>  8) & 0xff] ^
-	    Te3[(t0      ) & 0xff] ^
-	    rk[1];
-	s2 =
-	    Te0[(t2 >> 24)       ] ^
-	    Te1[(t3 >> 16) & 0xff] ^
-	    Te2[(t0 >>  8) & 0xff] ^
-	    Te3[(t1      ) & 0xff] ^
-	    rk[2];
-	s3 =
-	    Te0[(t3 >> 24)       ] ^
-	    Te1[(t0 >> 16) & 0xff] ^
-	    Te2[(t1 >>  8) & 0xff] ^
-	    Te3[(t2      ) & 0xff] ^
-	    rk[3];
-    }
-#endif /* ?FULL_UNROLL */
-    /*
-	 * apply last round and
-	 * map cipher state to byte array block:
-	 */
-	s0 =
-		(Te4[(t0 >> 24)       ] & 0xff000000) ^
-		(Te4[(t1 >> 16) & 0xff] & 0x00ff0000) ^
-		(Te4[(t2 >>  8) & 0xff] & 0x0000ff00) ^
-		(Te4[(t3      ) & 0xff] & 0x000000ff) ^
-		rk[0];
-	PUTU32(ct     , s0);
-	s1 =
-		(Te4[(t1 >> 24)       ] & 0xff000000) ^
-		(Te4[(t2 >> 16) & 0xff] & 0x00ff0000) ^
-		(Te4[(t3 >>  8) & 0xff] & 0x0000ff00) ^
-		(Te4[(t0      ) & 0xff] & 0x000000ff) ^
-		rk[1];
-	PUTU32(ct +  4, s1);
-	s2 =
-		(Te4[(t2 >> 24)       ] & 0xff000000) ^
-		(Te4[(t3 >> 16) & 0xff] & 0x00ff0000) ^
-		(Te4[(t0 >>  8) & 0xff] & 0x0000ff00) ^
-		(Te4[(t1      ) & 0xff] & 0x000000ff) ^
-		rk[2];
-	PUTU32(ct +  8, s2);
-	s3 =
-		(Te4[(t3 >> 24)       ] & 0xff000000) ^
-		(Te4[(t0 >> 16) & 0xff] & 0x00ff0000) ^
-		(Te4[(t1 >>  8) & 0xff] & 0x0000ff00) ^
-		(Te4[(t2      ) & 0xff] & 0x000000ff) ^
-		rk[3];
-	PUTU32(ct + 12, s3);
-}
-
-static void rijndaelDecrypt(const u32 rk[/*4*(Nr + 1)*/], int Nr, const u8 ct[16], u8 pt[16]) {
-	u32 s0, s1, s2, s3, t0, t1, t2, t3;
-#ifndef FULL_UNROLL
-    int r;
-#endif /* ?FULL_UNROLL */
-
-    /*
-	 * map byte array block to cipher state
-	 * and add initial round key:
-	 */
-    s0 = GETU32(ct     ) ^ rk[0];
-    s1 = GETU32(ct +  4) ^ rk[1];
-    s2 = GETU32(ct +  8) ^ rk[2];
-    s3 = GETU32(ct + 12) ^ rk[3];
-#ifdef FULL_UNROLL
-    /* round 1: */
-    t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >>  8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[ 4];
-    t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >>  8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[ 5];
-    t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >>  8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[ 6];
-    t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >>  8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[ 7];
-    /* round 2: */
-    s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >>  8) & 0xff] ^ Td3[t1 & 0xff] ^ rk[ 8];
-    s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >>  8) & 0xff] ^ Td3[t2 & 0xff] ^ rk[ 9];
-    s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >>  8) & 0xff] ^ Td3[t3 & 0xff] ^ rk[10];
-    s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >>  8) & 0xff] ^ Td3[t0 & 0xff] ^ rk[11];
-    /* round 3: */
-    t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >>  8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[12];
-    t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >>  8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[13];
-    t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >>  8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[14];
-    t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >>  8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[15];
-    /* round 4: */
-    s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >>  8) & 0xff] ^ Td3[t1 & 0xff] ^ rk[16];
-    s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >>  8) & 0xff] ^ Td3[t2 & 0xff] ^ rk[17];
-    s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >>  8) & 0xff] ^ Td3[t3 & 0xff] ^ rk[18];
-    s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >>  8) & 0xff] ^ Td3[t0 & 0xff] ^ rk[19];
-    /* round 5: */
-    t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >>  8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[20];
-    t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >>  8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[21];
-    t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >>  8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[22];
-    t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >>  8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[23];
-    /* round 6: */
-    s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >>  8) & 0xff] ^ Td3[t1 & 0xff] ^ rk[24];
-    s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >>  8) & 0xff] ^ Td3[t2 & 0xff] ^ rk[25];
-    s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >>  8) & 0xff] ^ Td3[t3 & 0xff] ^ rk[26];
-    s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >>  8) & 0xff] ^ Td3[t0 & 0xff] ^ rk[27];
-    /* round 7: */
-    t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >>  8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[28];
-    t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >>  8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[29];
-    t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >>  8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[30];
-    t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >>  8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[31];
-    /* round 8: */
-    s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >>  8) & 0xff] ^ Td3[t1 & 0xff] ^ rk[32];
-    s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >>  8) & 0xff] ^ Td3[t2 & 0xff] ^ rk[33];
-    s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >>  8) & 0xff] ^ Td3[t3 & 0xff] ^ rk[34];
-    s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >>  8) & 0xff] ^ Td3[t0 & 0xff] ^ rk[35];
-    /* round 9: */
-    t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >>  8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[36];
-    t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >>  8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[37];
-    t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >>  8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[38];
-    t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >>  8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[39];
-    if (Nr > 10) {
-	/* round 10: */
-	s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >>  8) & 0xff] ^ Td3[t1 & 0xff] ^ rk[40];
-	s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >>  8) & 0xff] ^ Td3[t2 & 0xff] ^ rk[41];
-	s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >>  8) & 0xff] ^ Td3[t3 & 0xff] ^ rk[42];
-	s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >>  8) & 0xff] ^ Td3[t0 & 0xff] ^ rk[43];
-	/* round 11: */
-	t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >>  8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[44];
-	t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >>  8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[45];
-	t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >>  8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[46];
-	t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >>  8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[47];
-	if (Nr > 12) {
-	    /* round 12: */
-	    s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >>  8) & 0xff] ^ Td3[t1 & 0xff] ^ rk[48];
-	    s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >>  8) & 0xff] ^ Td3[t2 & 0xff] ^ rk[49];
-	    s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >>  8) & 0xff] ^ Td3[t3 & 0xff] ^ rk[50];
-	    s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >>  8) & 0xff] ^ Td3[t0 & 0xff] ^ rk[51];
-	    /* round 13: */
-	    t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >>  8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[52];
-	    t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >>  8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[53];
-	    t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >>  8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[54];
-	    t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >>  8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[55];
-	}
-    }
-	rk += Nr << 2;
-#else  /* !FULL_UNROLL */
-    /*
-     * Nr - 1 full rounds:
-     */
-    r = Nr >> 1;
-    for (;;) {
-	t0 =
-	    Td0[(s0 >> 24)       ] ^
-	    Td1[(s3 >> 16) & 0xff] ^
-	    Td2[(s2 >>  8) & 0xff] ^
-	    Td3[(s1      ) & 0xff] ^
-	    rk[4];
-	t1 =
-	    Td0[(s1 >> 24)       ] ^
-	    Td1[(s0 >> 16) & 0xff] ^
-	    Td2[(s3 >>  8) & 0xff] ^
-	    Td3[(s2      ) & 0xff] ^
-	    rk[5];
-	t2 =
-	    Td0[(s2 >> 24)       ] ^
-	    Td1[(s1 >> 16) & 0xff] ^
-	    Td2[(s0 >>  8) & 0xff] ^
-	    Td3[(s3      ) & 0xff] ^
-	    rk[6];
-	t3 =
-	    Td0[(s3 >> 24)       ] ^
-	    Td1[(s2 >> 16) & 0xff] ^
-	    Td2[(s1 >>  8) & 0xff] ^
-	    Td3[(s0      ) & 0xff] ^
-	    rk[7];
-
-	rk += 8;
-	if (--r == 0) {
-	    break;
-	}
-
-	s0 =
-	    Td0[(t0 >> 24)       ] ^
-	    Td1[(t3 >> 16) & 0xff] ^
-	    Td2[(t2 >>  8) & 0xff] ^
-	    Td3[(t1      ) & 0xff] ^
-	    rk[0];
-	s1 =
-	    Td0[(t1 >> 24)       ] ^
-	    Td1[(t0 >> 16) & 0xff] ^
-	    Td2[(t3 >>  8) & 0xff] ^
-	    Td3[(t2      ) & 0xff] ^
-	    rk[1];
-	s2 =
-	    Td0[(t2 >> 24)       ] ^
-	    Td1[(t1 >> 16) & 0xff] ^
-	    Td2[(t0 >>  8) & 0xff] ^
-	    Td3[(t3      ) & 0xff] ^
-	    rk[2];
-	s3 =
-	    Td0[(t3 >> 24)       ] ^
-	    Td1[(t2 >> 16) & 0xff] ^
-	    Td2[(t1 >>  8) & 0xff] ^
-	    Td3[(t0      ) & 0xff] ^
-	    rk[3];
-    }
-#endif /* ?FULL_UNROLL */
-    /*
-	 * apply last round and
-	 * map cipher state to byte array block:
-	 */
-   	s0 =
-   		(Td4[(t0 >> 24)       ] & 0xff000000) ^
-   		(Td4[(t3 >> 16) & 0xff] & 0x00ff0000) ^
-   		(Td4[(t2 >>  8) & 0xff] & 0x0000ff00) ^
-   		(Td4[(t1      ) & 0xff] & 0x000000ff) ^
-   		rk[0];
-	PUTU32(pt     , s0);
-   	s1 =
-   		(Td4[(t1 >> 24)       ] & 0xff000000) ^
-   		(Td4[(t0 >> 16) & 0xff] & 0x00ff0000) ^
-   		(Td4[(t3 >>  8) & 0xff] & 0x0000ff00) ^
-   		(Td4[(t2      ) & 0xff] & 0x000000ff) ^
-   		rk[1];
-	PUTU32(pt +  4, s1);
-   	s2 =
-   		(Td4[(t2 >> 24)       ] & 0xff000000) ^
-   		(Td4[(t1 >> 16) & 0xff] & 0x00ff0000) ^
-   		(Td4[(t0 >>  8) & 0xff] & 0x0000ff00) ^
-   		(Td4[(t3      ) & 0xff] & 0x000000ff) ^
-   		rk[2];
-	PUTU32(pt +  8, s2);
-   	s3 =
-   		(Td4[(t3 >> 24)       ] & 0xff000000) ^
-   		(Td4[(t2 >> 16) & 0xff] & 0x00ff0000) ^
-   		(Td4[(t1 >>  8) & 0xff] & 0x0000ff00) ^
-   		(Td4[(t0      ) & 0xff] & 0x000000ff) ^
-   		rk[3];
-	PUTU32(pt + 12, s3);
-}
-
-void
-rijndael_set_key(rijndael_ctx *ctx, u_char *key, int bits, int encrypt)
-{
-	ctx->Nr = rijndaelKeySetupEnc(ctx->ek, key, bits);
-	if (encrypt) {
-		ctx->decrypt = 0;
-		memset(ctx->dk, 0, sizeof(ctx->dk));
-	} else {
-		ctx->decrypt = 1;
-		memcpy(ctx->dk, ctx->ek, sizeof(ctx->dk));
-		rijndaelKeySetupDec(ctx->dk, key, bits, ctx->Nr);
-	}
-}
-
-void
-rijndael_decrypt(rijndael_ctx *ctx, u_char *src, u_char *dst)
-{
-	rijndaelDecrypt(ctx->dk, ctx->Nr, src, dst);
-}
-
-void
-rijndael_encrypt(rijndael_ctx *ctx, u_char *src, u_char *dst)
-{
-	rijndaelEncrypt(ctx->ek, ctx->Nr, src, dst);
-}
diff --git a/crypto/openssh/rijndael.h b/crypto/openssh/rijndael.h
deleted file mode 100644
index c614bb18877f..000000000000
--- a/crypto/openssh/rijndael.h
+++ /dev/null
@@ -1,51 +0,0 @@
-/*	$OpenBSD: rijndael.h,v 1.12 2001/12/19 07:18:56 deraadt Exp $ */
-
-/**
- * rijndael-alg-fst.h
- *
- * @version 3.0 (December 2000)
- *
- * Optimised ANSI C code for the Rijndael cipher (now AES)
- *
- * @author Vincent Rijmen <vincent.rijmen@esat.kuleuven.ac.be>
- * @author Antoon Bosselaers <antoon.bosselaers@esat.kuleuven.ac.be>
- * @author Paulo Barreto <paulo.barreto@terra.com.br>
- *
- * This code is hereby placed in the public domain.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ''AS IS'' AND ANY EXPRESS
- * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
- * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
- * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
- * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
- * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#ifndef __RIJNDAEL_H
-#define __RIJNDAEL_H
-
-#define MAXKC	(256/32)
-#define MAXKB	(256/8)
-#define MAXNR	14
-
-typedef unsigned char	u8;
-typedef unsigned short	u16;
-typedef unsigned int	u32;
-
-/*  The structure for key information */
-typedef struct {
-	int	decrypt;
-	int	Nr;			/* key-length-dependent number of rounds */
-	u32	ek[4*(MAXNR + 1)];	/* encrypt key schedule */
-	u32	dk[4*(MAXNR + 1)];	/* decrypt key schedule */
-} rijndael_ctx;
-
-void	 rijndael_set_key(rijndael_ctx *, u_char *, int, int);
-void	 rijndael_decrypt(rijndael_ctx *, u_char *, u_char *);
-void	 rijndael_encrypt(rijndael_ctx *, u_char *, u_char *);
-
-#endif /* __RIJNDAEL_H */
diff --git a/crypto/openssh/rsa.c b/crypto/openssh/rsa.c
deleted file mode 100644
index 66561a4213b5..000000000000
--- a/crypto/openssh/rsa.c
+++ /dev/null
@@ -1,144 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- *
- *
- * Copyright (c) 1999 Niels Provos.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *
- * Description of the RSA algorithm can be found e.g. from the following
- * sources:
- *
- *   Bruce Schneier: Applied Cryptography.  John Wiley & Sons, 1994.
- *
- *   Jennifer Seberry and Josed Pieprzyk: Cryptography: An Introduction to
- *   Computer Security.  Prentice-Hall, 1989.
- *
- *   Man Young Rhee: Cryptography and Secure Data Communications.  McGraw-Hill,
- *   1994.
- *
- *   R. Rivest, A. Shamir, and L. M. Adleman: Cryptographic Communications
- *   System and Method.  US Patent 4,405,829, 1983.
- *
- *   Hans Riesel: Prime Numbers and Computer Methods for Factorization.
- *   Birkhauser, 1994.
- *
- *   The RSA Frequently Asked Questions document by RSA Data Security,
- *   Inc., 1995.
- *
- *   RSA in 3 lines of perl by Adam Back <aba@atlax.ex.ac.uk>, 1995, as
- * included below:
- *
- *     [gone - had to be deleted - what a pity]
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: rsa.c,v 1.24 2001/12/27 18:22:16 markus Exp $");
-
-#include "rsa.h"
-#include "log.h"
-#include "xmalloc.h"
-
-void
-rsa_public_encrypt(BIGNUM *out, BIGNUM *in, RSA *key)
-{
-	u_char *inbuf, *outbuf;
-	int len, ilen, olen;
-
-	if (BN_num_bits(key->e) < 2 || !BN_is_odd(key->e))
-		fatal("rsa_public_encrypt() exponent too small or not odd");
-
-	olen = BN_num_bytes(key->n);
-	outbuf = xmalloc(olen);
-
-	ilen = BN_num_bytes(in);
-	inbuf = xmalloc(ilen);
-	BN_bn2bin(in, inbuf);
-
-	if ((len = RSA_public_encrypt(ilen, inbuf, outbuf, key,
-	    RSA_PKCS1_PADDING)) <= 0)
-		fatal("rsa_public_encrypt() failed");
-
-	BN_bin2bn(outbuf, len, out);
-
-	memset(outbuf, 0, olen);
-	memset(inbuf, 0, ilen);
-	xfree(outbuf);
-	xfree(inbuf);
-}
-
-int
-rsa_private_decrypt(BIGNUM *out, BIGNUM *in, RSA *key)
-{
-	u_char *inbuf, *outbuf;
-	int len, ilen, olen;
-
-	olen = BN_num_bytes(key->n);
-	outbuf = xmalloc(olen);
-
-	ilen = BN_num_bytes(in);
-	inbuf = xmalloc(ilen);
-	BN_bn2bin(in, inbuf);
-
-	if ((len = RSA_private_decrypt(ilen, inbuf, outbuf, key,
-	    RSA_PKCS1_PADDING)) <= 0) {
-		error("rsa_private_decrypt() failed");
-	} else {
-		BN_bin2bn(outbuf, len, out);
-	}
-	memset(outbuf, 0, olen);
-	memset(inbuf, 0, ilen);
-	xfree(outbuf);
-	xfree(inbuf);
-	return len;
-}
-
-/* calculate p-1 and q-1 */
-void
-rsa_generate_additional_parameters(RSA *rsa)
-{
-	BIGNUM *aux;
-	BN_CTX *ctx;
-
-	if ((aux = BN_new()) == NULL)
-		fatal("rsa_generate_additional_parameters: BN_new failed");
-	if ((ctx = BN_CTX_new()) == NULL)
-		fatal("rsa_generate_additional_parameters: BN_CTX_new failed");
-
-	BN_sub(aux, rsa->q, BN_value_one());
-	BN_mod(rsa->dmq1, rsa->d, aux, ctx);
-
-	BN_sub(aux, rsa->p, BN_value_one());
-	BN_mod(rsa->dmp1, rsa->d, aux, ctx);
-
-	BN_clear_free(aux);
-	BN_CTX_free(ctx);
-}
-
diff --git a/crypto/openssh/rsa.h b/crypto/openssh/rsa.h
deleted file mode 100644
index 957d865522d2..000000000000
--- a/crypto/openssh/rsa.h
+++ /dev/null
@@ -1,26 +0,0 @@
-/*	$OpenBSD: rsa.h,v 1.15 2002/03/04 17:27:39 stevesk Exp $	*/
-
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * RSA key generation, encryption and decryption.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#ifndef RSA_H
-#define RSA_H
-
-#include <openssl/bn.h>
-#include <openssl/rsa.h>
-
-void	 rsa_public_encrypt(BIGNUM *, BIGNUM *, RSA *);
-int	 rsa_private_decrypt(BIGNUM *, BIGNUM *, RSA *);
-void	 rsa_generate_additional_parameters(RSA *);
-
-#endif				/* RSA_H */
diff --git a/crypto/openssh/scard-opensc.c b/crypto/openssh/scard-opensc.c
deleted file mode 100644
index dd21de39ab29..000000000000
--- a/crypto/openssh/scard-opensc.c
+++ /dev/null
@@ -1,462 +0,0 @@
-/*
- * Copyright (c) 2002 Juha Yrjölä.  All rights reserved.
- * Copyright (c) 2001 Markus Friedl.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-#if defined(SMARTCARD) && defined(USE_OPENSC)
-
-#include <openssl/evp.h>
-#include <openssl/x509.h>
-
-#include <opensc/opensc.h>
-#include <opensc/pkcs15.h>
-
-#include "key.h"
-#include "log.h"
-#include "xmalloc.h"
-#include "readpass.h"
-#include "scard.h"
-
-#if OPENSSL_VERSION_NUMBER < 0x00907000L && defined(CRYPTO_LOCK_ENGINE)
-#define USE_ENGINE
-#define RSA_get_default_method RSA_get_default_openssl_method
-#else
-#endif
-
-#ifdef USE_ENGINE
-#include <openssl/engine.h>
-#define sc_get_rsa sc_get_engine
-#else
-#define sc_get_rsa sc_get_rsa_method
-#endif
-
-static int sc_reader_id;
-static sc_context_t *ctx = NULL;
-static sc_card_t *card = NULL;
-static sc_pkcs15_card_t *p15card = NULL;
-
-static char *sc_pin = NULL;
-
-struct sc_priv_data
-{
-	struct sc_pkcs15_id cert_id;
-	int ref_count;
-};
-
-void
-sc_close(void)
-{
-	if (p15card) {
-		sc_pkcs15_unbind(p15card);
-		p15card = NULL;
-	}
-	if (card) {
-		sc_disconnect_card(card, 0);
-		card = NULL;
-	}
-	if (ctx) {
-		sc_release_context(ctx);
-		ctx = NULL;
-	}
-}
-
-static int 
-sc_init(void)
-{
-	int r;
-
-	r = sc_establish_context(&ctx, "openssh");
-	if (r)
-		goto err;
-	r = sc_connect_card(ctx->reader[sc_reader_id], 0, &card);
-	if (r)
-		goto err;
-	r = sc_pkcs15_bind(card, &p15card);
-	if (r)
-		goto err;
-	return 0;
-err:
-	sc_close();
-	return r;
-}
-
-/* private key operations */
-
-static int
-sc_prkey_op_init(RSA *rsa, struct sc_pkcs15_object **key_obj_out)
-{
-	int r;
-	struct sc_priv_data *priv;
-	struct sc_pkcs15_object *key_obj;
-	struct sc_pkcs15_prkey_info *key;
-	struct sc_pkcs15_object *pin_obj;
-	struct sc_pkcs15_pin_info *pin;
-
-	priv = (struct sc_priv_data *) RSA_get_app_data(rsa);
-	if (priv == NULL)
-		return -1;
-	if (p15card == NULL) {
-		sc_close();
-		r = sc_init();
-		if (r) {
-			error("SmartCard init failed: %s", sc_strerror(r));
-			goto err;
-		}
-	}
-	r = sc_pkcs15_find_prkey_by_id(p15card, &priv->cert_id, &key_obj);
-	if (r) {
-		error("Unable to find private key from SmartCard: %s",
-		      sc_strerror(r));
-		goto err;
-	}
-	key = key_obj->data;
-	r = sc_pkcs15_find_pin_by_auth_id(p15card, &key_obj->auth_id,
-					  &pin_obj);
-	if (r) {
-		error("Unable to find PIN object from SmartCard: %s",
-		      sc_strerror(r));
-		goto err;
-	}
-	pin = pin_obj->data;
-	r = sc_lock(card);
-	if (r) {
-		error("Unable to lock smartcard: %s", sc_strerror(r));
-		goto err;
-	}
-	if (sc_pin != NULL) {
-		r = sc_pkcs15_verify_pin(p15card, pin, sc_pin,
-					 strlen(sc_pin));
-		if (r) {
-			sc_unlock(card);
-			error("PIN code verification failed: %s",
-			      sc_strerror(r));
-			goto err;
-		}
-	}
-	*key_obj_out = key_obj;
-	return 0;
-err:
-	sc_close();
-	return -1;
-}
-
-static int
-sc_private_decrypt(int flen, u_char *from, u_char *to, RSA *rsa,
-    int padding)
-{
-	struct sc_pkcs15_object *key_obj;
-	int r;
-
-	if (padding != RSA_PKCS1_PADDING)
-		return -1;	
-	r = sc_prkey_op_init(rsa, &key_obj);
-	if (r)
-		return -1;
-	r = sc_pkcs15_decipher(p15card, key_obj, 0, from, flen, to, flen);
-	sc_unlock(card);
-	if (r < 0) {
-		error("sc_pkcs15_decipher() failed: %s", sc_strerror(r));
-		goto err;
-	}
-	return r;
-err:
-	sc_close();
-	return -1;
-}
-
-static int
-sc_sign(int type, u_char *m, unsigned int m_len,
-	unsigned char *sigret, unsigned int *siglen, RSA *rsa)
-{
-	struct sc_pkcs15_object *key_obj;
-	int r;
-	unsigned long flags = 0;
-
-	r = sc_prkey_op_init(rsa, &key_obj);
-	if (r)
-		return -1;
-	/* FIXME: length of sigret correct? */
-	/* FIXME: check 'type' and modify flags accordingly */
-	flags = SC_ALGORITHM_RSA_PAD_PKCS1 | SC_ALGORITHM_RSA_HASH_SHA1;
-	r = sc_pkcs15_compute_signature(p15card, key_obj, flags,
-					m, m_len, sigret, RSA_size(rsa));
-	sc_unlock(card);
-	if (r < 0) {
-		error("sc_pkcs15_compute_signature() failed: %s",
-		      sc_strerror(r));
-		goto err;
-	}
-	*siglen = r;
-	return 1;
-err:
-	sc_close();
-	return 0;
-}
-
-static int
-sc_private_encrypt(int flen, u_char *from, u_char *to, RSA *rsa,
-    int padding)
-{
-	error("Private key encryption not supported");
-	return -1;
-}
-
-/* called on free */
-
-static int (*orig_finish)(RSA *rsa) = NULL;
-
-static int
-sc_finish(RSA *rsa)
-{
-	struct sc_priv_data *priv;
-
-	priv = RSA_get_app_data(rsa);
-	priv->ref_count--;
-	if (priv->ref_count == 0) {
-		free(priv);
-		sc_close();
-	}
-	if (orig_finish)
-		orig_finish(rsa);
-	return 1;
-}
-
-/* engine for overloading private key operations */
-
-static RSA_METHOD *
-sc_get_rsa_method(void)
-{
-	static RSA_METHOD smart_rsa;
-	const RSA_METHOD *def = RSA_get_default_method();
-
-	/* use the OpenSSL version */
-	memcpy(&smart_rsa, def, sizeof(smart_rsa));
-
-	smart_rsa.name		= "opensc";
-
-	/* overload */
-	smart_rsa.rsa_priv_enc	= sc_private_encrypt;
-	smart_rsa.rsa_priv_dec	= sc_private_decrypt;
-	smart_rsa.rsa_sign	= sc_sign;
-
-	/* save original */
-	orig_finish		= def->finish;
-	smart_rsa.finish	= sc_finish;
-
-	return &smart_rsa;
-}
-
-#ifdef USE_ENGINE
-static ENGINE *
-sc_get_engine(void)
-{
-	static ENGINE *smart_engine = NULL;
-
-	if ((smart_engine = ENGINE_new()) == NULL)
-		fatal("ENGINE_new failed");
-
-	ENGINE_set_id(smart_engine, "opensc");
-	ENGINE_set_name(smart_engine, "OpenSC");
-
-	ENGINE_set_RSA(smart_engine, sc_get_rsa_method());
-	ENGINE_set_DSA(smart_engine, DSA_get_default_openssl_method());
-	ENGINE_set_DH(smart_engine, DH_get_default_openssl_method());
-	ENGINE_set_RAND(smart_engine, RAND_SSLeay());
-	ENGINE_set_BN_mod_exp(smart_engine, BN_mod_exp);
-
-	return smart_engine;
-}
-#endif
-
-static void
-convert_rsa_to_rsa1(Key * in, Key * out)
-{
-	struct sc_priv_data *priv;
-	
-	out->rsa->flags = in->rsa->flags;
-	out->flags = in->flags;
-	RSA_set_method(out->rsa, RSA_get_method(in->rsa));
-	BN_copy(out->rsa->n, in->rsa->n);
-	BN_copy(out->rsa->e, in->rsa->e);
-	priv = RSA_get_app_data(in->rsa);
-	priv->ref_count++;
-	RSA_set_app_data(out->rsa, priv);
-	return;
-}
-
-static int 
-sc_read_pubkey(Key * k, const struct sc_pkcs15_object *cert_obj)
-{
-	int r;
-	sc_pkcs15_cert_t *cert = NULL;
-	struct sc_priv_data *priv = NULL;
-	sc_pkcs15_cert_info_t *cinfo = cert_obj->data;
-
-	X509 *x509 = NULL;
-	EVP_PKEY *pubkey = NULL;
-	u8 *p;
-	char *tmp;
-	
-	debug("sc_read_pubkey() with cert id %02X", cinfo->id.value[0]);
-	r = sc_pkcs15_read_certificate(p15card, cinfo, &cert);
-	if (r) {
-		log("Certificate read failed: %s", sc_strerror(r));
-		goto err;
-	}
-	x509 = X509_new();
-	if (x509 == NULL) {
-		r = -1; 
-		goto err;
-	}
-	p = cert->data;
-	if (!d2i_X509(&x509, &p, cert->data_len)) {
-		log("Unable to parse X.509 certificate");
-		r = -1;
-		goto err;
-	}
-	sc_pkcs15_free_certificate(cert);
-	cert = NULL;
-	pubkey = X509_get_pubkey(x509);
-	X509_free(x509);
-	x509 = NULL;
-	if (pubkey->type != EVP_PKEY_RSA) {
-		log("Public key is of unknown type");
-		r = -1;
-		goto err;
-	}
-	k->rsa = EVP_PKEY_get1_RSA(pubkey);
-	EVP_PKEY_free(pubkey);
-
-	k->rsa->flags |= RSA_FLAG_SIGN_VER;
-	RSA_set_method(k->rsa, sc_get_rsa_method());
-	priv = xmalloc(sizeof(struct sc_priv_data));
-	priv->cert_id = cinfo->id;
-	priv->ref_count = 1;
-	RSA_set_app_data(k->rsa, priv);
-
-	k->flags = KEY_FLAG_EXT;
-	tmp = key_fingerprint(k, SSH_FP_MD5, SSH_FP_HEX);
-	debug("fingerprint %d %s", key_size(k), tmp);
-	xfree(tmp);
-	
-	return 0;
-err:
-	if (cert)
-		sc_pkcs15_free_certificate(cert);
-	if (pubkey)
-		EVP_PKEY_free(pubkey);
-	if (x509)
-		X509_free(x509);
-	return r;
-}
-
-Key **
-sc_get_keys(const char *id, const char *pin)
-{
-	Key *k, **keys;
-	int i, r, real_count = 0, key_count;
-	sc_pkcs15_id_t cert_id;
-	sc_pkcs15_object_t *certs[32];
-	char *buf = xstrdup(id), *p;
-
-	debug("sc_get_keys called: id = %s", id);
-
-	if (sc_pin != NULL)
-		xfree(sc_pin);
-	sc_pin = (pin == NULL) ? NULL : xstrdup(pin);
-
-	cert_id.len = 0;
-	if ((p = strchr(buf, ':')) != NULL) {
-		*p = 0;
-		p++;
-		sc_pkcs15_hex_string_to_id(p, &cert_id);
-	}
-	r = sscanf(buf, "%d", &sc_reader_id);
-	xfree(buf);
-	if (r != 1)
-		goto err;
-	if (p15card == NULL) {
-		sc_close();
-		r = sc_init();
-		if (r) {
-			error("Smartcard init failed: %s", sc_strerror(r));
-			goto err;
-		}
-	}
-	if (cert_id.len) {
-		r = sc_pkcs15_find_cert_by_id(p15card, &cert_id, &certs[0]);
-		if (r < 0)
-			goto err;
-		key_count = 1;
-	} else {
-		r = sc_pkcs15_get_objects(p15card, SC_PKCS15_TYPE_CERT_X509,
-					  certs, 32);
-		if (r == 0) {
-			log("No certificates found on smartcard");
-			r = -1;
-			goto err;
-		} else if (r < 0) {
-			error("Certificate enumeration failed: %s",
-			      sc_strerror(r));
-			goto err;
-		}
-		key_count = r;
-	}
-	/* FIXME: only keep entries with a corresponding private key */
-	keys = xmalloc(sizeof(Key *) * (key_count*2+1));
-	for (i = 0; i < key_count; i++) {
-		k = key_new(KEY_RSA);
-		if (k == NULL)
-			break;
-		r = sc_read_pubkey(k, certs[i]);
-		if (r) {
-			error("sc_read_pubkey failed: %s", sc_strerror(r));
-			key_free(k);
-			continue;
-		}
-		keys[real_count] = k;
-		real_count++;
-		k = key_new(KEY_RSA1);
-		if (k == NULL)
-			break;
-		convert_rsa_to_rsa1(keys[real_count-1], k);
-		keys[real_count] = k;
-		real_count++;
-	}
-	keys[real_count] = NULL;
-
-	return keys;
-err:
-	sc_close();
-	return NULL;
-}
-
-int
-sc_put_key(Key *prv, const char *id)
-{
-	error("key uploading not yet supported");
-	return -1;
-}
-
-#endif /* SMARTCARD */
diff --git a/crypto/openssh/scard.c b/crypto/openssh/scard.c
deleted file mode 100644
index 9791938c0b5a..000000000000
--- a/crypto/openssh/scard.c
+++ /dev/null
@@ -1,557 +0,0 @@
-/*
- * Copyright (c) 2001 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-#if defined(SMARTCARD) && defined(USE_SECTOK)
-RCSID("$OpenBSD: scard.c,v 1.26 2002/06/23 03:30:17 deraadt Exp $");
-
-#include <openssl/evp.h>
-#include <sectok.h>
-
-#include "key.h"
-#include "log.h"
-#include "xmalloc.h"
-#include "readpass.h"
-#include "scard.h"
-
-#if OPENSSL_VERSION_NUMBER < 0x00907000L
-#define USE_ENGINE
-#define RSA_get_default_method RSA_get_default_openssl_method
-#else
-#endif
-
-#ifdef USE_ENGINE
-#include <openssl/engine.h>
-#define sc_get_rsa sc_get_engine
-#else
-#define sc_get_rsa sc_get_rsa_method
-#endif
-
-#define CLA_SSH 0x05
-#define INS_DECRYPT 0x10
-#define INS_GET_KEYLENGTH 0x20
-#define INS_GET_PUBKEY 0x30
-#define INS_GET_RESPONSE 0xc0
-
-#define MAX_BUF_SIZE 256
-
-u_char DEFAUT0[] = {0xad, 0x9f, 0x61, 0xfe, 0xfa, 0x20, 0xce, 0x63};
-
-static int sc_fd = -1;
-static char *sc_reader_id = NULL;
-static char *sc_pin = NULL;
-static int cla = 0x00;	/* class */
-
-static void sc_mk_digest(const char *pin, u_char *digest);
-static int get_AUT0(u_char *aut0);
-static int try_AUT0(void);
-
-/* interface to libsectok */
-
-static int
-sc_open(void)
-{
-	int sw;
-
-	if (sc_fd >= 0)
-		return sc_fd;
-
-	sc_fd = sectok_friendly_open(sc_reader_id, STONOWAIT, &sw);
-	if (sc_fd < 0) {
-		error("sectok_open failed: %s", sectok_get_sw(sw));
-		return SCARD_ERROR_FAIL;
-	}
-	if (! sectok_cardpresent(sc_fd)) {
-		debug("smartcard in reader %s not present, skipping",
-		    sc_reader_id);
-		sc_close();
-		return SCARD_ERROR_NOCARD;
-	}
-	if (sectok_reset(sc_fd, 0, NULL, &sw) <= 0) {
-		error("sectok_reset failed: %s", sectok_get_sw(sw));
-		sc_fd = -1;
-		return SCARD_ERROR_FAIL;
-	}
-	if ((cla = cyberflex_inq_class(sc_fd)) < 0)
-		cla = 0;
-
-	debug("sc_open ok %d", sc_fd);
-	return sc_fd;
-}
-
-static int
-sc_enable_applet(void)
-{
-	static u_char aid[] = {0xfc, 0x53, 0x73, 0x68, 0x2e, 0x62, 0x69, 0x6e};
-	int sw = 0;
-
-	/* select applet id */
-	sectok_apdu(sc_fd, cla, 0xa4, 0x04, 0, sizeof aid, aid, 0, NULL, &sw);
-	if (!sectok_swOK(sw)) {
-		error("sectok_apdu failed: %s", sectok_get_sw(sw));
-		sc_close();
-		return -1;
-	}
-	return 0;
-}
-
-static int
-sc_init(void)
-{
-	int status;
-
-	status = sc_open();
-	if (status == SCARD_ERROR_NOCARD) {
-		return SCARD_ERROR_NOCARD;
-	}
-	if (status < 0 ) {
-		error("sc_open failed");
-		return status;
-	}
-	if (sc_enable_applet() < 0) {
-		error("sc_enable_applet failed");
-		return SCARD_ERROR_APPLET;
-	}
-	return 0;
-}
-
-static int
-sc_read_pubkey(Key * k)
-{
-	u_char buf[2], *n;
-	char *p;
-	int len, sw, status = -1;
-
-	len = sw = 0;
-	n = NULL;
-
-	if (sc_fd < 0) {
-		if (sc_init() < 0)
-			goto err;
-	}
-
-	/* get key size */
-	sectok_apdu(sc_fd, CLA_SSH, INS_GET_KEYLENGTH, 0, 0, 0, NULL,
-	    sizeof(buf), buf, &sw);
-	if (!sectok_swOK(sw)) {
-		error("could not obtain key length: %s", sectok_get_sw(sw));
-		goto err;
-	}
-	len = (buf[0] << 8) | buf[1];
-	len /= 8;
-	debug("INS_GET_KEYLENGTH: len %d sw %s", len, sectok_get_sw(sw));
-
-	n = xmalloc(len);
-	/* get n */
-	sectok_apdu(sc_fd, CLA_SSH, INS_GET_PUBKEY, 0, 0, 0, NULL, len, n, &sw);
-
-	if (sw == 0x6982) {
-		if (try_AUT0() < 0)
-			goto err;
-		sectok_apdu(sc_fd, CLA_SSH, INS_GET_PUBKEY, 0, 0, 0, NULL, len, n, &sw);
-	}
-	if (!sectok_swOK(sw)) {
-		error("could not obtain public key: %s", sectok_get_sw(sw));
-		goto err;
-	}
-
-	debug("INS_GET_KEYLENGTH: sw %s", sectok_get_sw(sw));
-
-	if (BN_bin2bn(n, len, k->rsa->n) == NULL) {
-		error("c_read_pubkey: BN_bin2bn failed");
-		goto err;
-	}
-
-	/* currently the java applet just stores 'n' */
-	if (!BN_set_word(k->rsa->e, 35)) {
-		error("c_read_pubkey: BN_set_word(e, 35) failed");
-		goto err;
-	}
-
-	status = 0;
-	p = key_fingerprint(k, SSH_FP_MD5, SSH_FP_HEX);
-	debug("fingerprint %u %s", key_size(k), p);
-	xfree(p);
-
-err:
-	if (n != NULL)
-		xfree(n);
-	sc_close();
-	return status;
-}
-
-/* private key operations */
-
-static int
-sc_private_decrypt(int flen, u_char *from, u_char *to, RSA *rsa,
-    int padding)
-{
-	u_char *padded = NULL;
-	int sw, len, olen, status = -1;
-
-	debug("sc_private_decrypt called");
-
-	olen = len = sw = 0;
-	if (sc_fd < 0) {
-		status = sc_init();
-		if (status < 0 )
-			goto err;
-	}
-	if (padding != RSA_PKCS1_PADDING)
-		goto err;
-
-	len = BN_num_bytes(rsa->n);
-	padded = xmalloc(len);
-
-	sectok_apdu(sc_fd, CLA_SSH, INS_DECRYPT, 0, 0, len, from, len, padded, &sw);
-
-	if (sw == 0x6982) {
-		if (try_AUT0() < 0)
-			goto err;
-		sectok_apdu(sc_fd, CLA_SSH, INS_DECRYPT, 0, 0, len, from, len, padded, &sw);
-	}
-	if (!sectok_swOK(sw)) {
-		error("sc_private_decrypt: INS_DECRYPT failed: %s",
-		    sectok_get_sw(sw));
-		goto err;
-	}
-	olen = RSA_padding_check_PKCS1_type_2(to, len, padded + 1, len - 1,
-	    len);
-err:
-	if (padded)
-		xfree(padded);
-	sc_close();
-	return (olen >= 0 ? olen : status);
-}
-
-static int
-sc_private_encrypt(int flen, u_char *from, u_char *to, RSA *rsa,
-    int padding)
-{
-	u_char *padded = NULL;
-	int sw, len, status = -1;
-
-	len = sw = 0;
-	if (sc_fd < 0) {
-		status = sc_init();
-		if (status < 0 )
-			goto err;
-	}
-	if (padding != RSA_PKCS1_PADDING)
-		goto err;
-
-	debug("sc_private_encrypt called");
-	len = BN_num_bytes(rsa->n);
-	padded = xmalloc(len);
-
-	if (RSA_padding_add_PKCS1_type_1(padded, len, (u_char *)from, flen) <= 0) {
-		error("RSA_padding_add_PKCS1_type_1 failed");
-		goto err;
-	}
-	sectok_apdu(sc_fd, CLA_SSH, INS_DECRYPT, 0, 0, len, padded, len, to, &sw);
-	if (sw == 0x6982) {
-		if (try_AUT0() < 0)
-			goto err;
-		sectok_apdu(sc_fd, CLA_SSH, INS_DECRYPT, 0, 0, len, padded, len, to, &sw);
-	}
-	if (!sectok_swOK(sw)) {
-		error("sc_private_encrypt: INS_DECRYPT failed: %s",
-		    sectok_get_sw(sw));
-		goto err;
-	}
-err:
-	if (padded)
-		xfree(padded);
-	sc_close();
-	return (len >= 0 ? len : status);
-}
-
-/* called on free */
-
-static int (*orig_finish)(RSA *rsa) = NULL;
-
-static int
-sc_finish(RSA *rsa)
-{
-	if (orig_finish)
-		orig_finish(rsa);
-	sc_close();
-	return 1;
-}
-
-/* engine for overloading private key operations */
-
-static RSA_METHOD *
-sc_get_rsa_method(void)
-{
-	static RSA_METHOD smart_rsa;
-	const RSA_METHOD *def = RSA_get_default_method();
-
-	/* use the OpenSSL version */
-	memcpy(&smart_rsa, def, sizeof(smart_rsa));
-
-	smart_rsa.name		= "sectok";
-
-	/* overload */
-	smart_rsa.rsa_priv_enc	= sc_private_encrypt;
-	smart_rsa.rsa_priv_dec	= sc_private_decrypt;
-
-	/* save original */
-	orig_finish		= def->finish;
-	smart_rsa.finish	= sc_finish;
-
-	return &smart_rsa;
-}
-
-#ifdef USE_ENGINE
-static ENGINE *
-sc_get_engine(void)
-{
-	static ENGINE *smart_engine = NULL;
-
-	if ((smart_engine = ENGINE_new()) == NULL)
-		fatal("ENGINE_new failed");
-
-	ENGINE_set_id(smart_engine, "sectok");
-	ENGINE_set_name(smart_engine, "libsectok");
-
-	ENGINE_set_RSA(smart_engine, sc_get_rsa_method());
-	ENGINE_set_DSA(smart_engine, DSA_get_default_openssl_method());
-	ENGINE_set_DH(smart_engine, DH_get_default_openssl_method());
-	ENGINE_set_RAND(smart_engine, RAND_SSLeay());
-	ENGINE_set_BN_mod_exp(smart_engine, BN_mod_exp);
-
-	return smart_engine;
-}
-#endif
-
-void
-sc_close(void)
-{
-	if (sc_fd >= 0) {
-		sectok_close(sc_fd);
-		sc_fd = -1;
-	}
-}
-
-Key **
-sc_get_keys(const char *id, const char *pin)
-{
-	Key *k, *n, **keys;
-	int status, nkeys = 2;
-
-	if (sc_reader_id != NULL)
-		xfree(sc_reader_id);
-	sc_reader_id = xstrdup(id);
-
-	if (sc_pin != NULL)
-		xfree(sc_pin);
-	sc_pin = (pin == NULL) ? NULL : xstrdup(pin);
-
-	k = key_new(KEY_RSA);
-	if (k == NULL) {
-		return NULL;
-	}
-	status = sc_read_pubkey(k);
-	if (status == SCARD_ERROR_NOCARD) {
-		key_free(k);
-		return NULL;
-	}
-	if (status < 0 ) {
-		error("sc_read_pubkey failed");
-		key_free(k);
-		return NULL;
-	}
-	keys = xmalloc((nkeys+1) * sizeof(Key *));
-
-	n = key_new(KEY_RSA1);
-	BN_copy(n->rsa->n, k->rsa->n);
-	BN_copy(n->rsa->e, k->rsa->e);
-	RSA_set_method(n->rsa, sc_get_rsa());
-	n->flags |= KEY_FLAG_EXT;
-	keys[0] = n;
-
-	n = key_new(KEY_RSA);
-	BN_copy(n->rsa->n, k->rsa->n);
-	BN_copy(n->rsa->e, k->rsa->e);
-	RSA_set_method(n->rsa, sc_get_rsa());
-	n->flags |= KEY_FLAG_EXT;
-	keys[1] = n;
-
-	keys[2] = NULL;
-
-	key_free(k);
-	return keys;
-}
-
-#define NUM_RSA_KEY_ELEMENTS 5+1
-#define COPY_RSA_KEY(x, i) \
-	do { \
-		len = BN_num_bytes(prv->rsa->x); \
-		elements[i] = xmalloc(len); \
-		debug("#bytes %d", len); \
-		if (BN_bn2bin(prv->rsa->x, elements[i]) < 0) \
-			goto done; \
-	} while (0)
-
-static void
-sc_mk_digest(const char *pin, u_char *digest)
-{
-	const EVP_MD *evp_md = EVP_sha1();
-	EVP_MD_CTX md;
-
-	EVP_DigestInit(&md, evp_md);
-	EVP_DigestUpdate(&md, pin, strlen(pin));
-	EVP_DigestFinal(&md, digest, NULL);
-}
-
-static int
-get_AUT0(u_char *aut0)
-{
-	char *pass;
-
-	pass = read_passphrase("Enter passphrase for smartcard: ", RP_ALLOW_STDIN);
-	if (pass == NULL)
-		return -1;
-	if (!strcmp(pass, "-")) {
-		memcpy(aut0, DEFAUT0, sizeof DEFAUT0);
-		return 0;
-	}
-	sc_mk_digest(pass, aut0);
-	memset(pass, 0, strlen(pass));
-	xfree(pass);
-	return 0;
-}
-
-static int
-try_AUT0(void)
-{
-	u_char aut0[EVP_MAX_MD_SIZE];
-
-	/* permission denied; try PIN if provided */
-	if (sc_pin && strlen(sc_pin) > 0) {
-		sc_mk_digest(sc_pin, aut0);
-		if (cyberflex_verify_AUT0(sc_fd, cla, aut0, 8) < 0) {
-			error("smartcard passphrase incorrect");
-			return (-1);
-		}
-	} else {
-		/* try default AUT0 key */
-		if (cyberflex_verify_AUT0(sc_fd, cla, DEFAUT0, 8) < 0) {
-			/* default AUT0 key failed; prompt for passphrase */
-			if (get_AUT0(aut0) < 0 ||
-			    cyberflex_verify_AUT0(sc_fd, cla, aut0, 8) < 0) {
-				error("smartcard passphrase incorrect");
-				return (-1);
-			}
-		}
-	}
-	return (0);
-}
-
-int
-sc_put_key(Key *prv, const char *id)
-{
-	u_char *elements[NUM_RSA_KEY_ELEMENTS];
-	u_char key_fid[2];
-	u_char AUT0[EVP_MAX_MD_SIZE];
-	int len, status = -1, i, fd = -1, ret;
-	int sw = 0, cla = 0x00;
-
-	for (i = 0; i < NUM_RSA_KEY_ELEMENTS; i++)
-		elements[i] = NULL;
-
-	COPY_RSA_KEY(q, 0);
-	COPY_RSA_KEY(p, 1);
-	COPY_RSA_KEY(iqmp, 2);
-	COPY_RSA_KEY(dmq1, 3);
-	COPY_RSA_KEY(dmp1, 4);
-	COPY_RSA_KEY(n, 5);
-	len = BN_num_bytes(prv->rsa->n);
-	fd = sectok_friendly_open(id, STONOWAIT, &sw);
-	if (fd < 0) {
-		error("sectok_open failed: %s", sectok_get_sw(sw));
-		goto done;
-	}
-	if (! sectok_cardpresent(fd)) {
-		error("smartcard in reader %s not present", id);
-		goto done;
-	}
-	ret = sectok_reset(fd, 0, NULL, &sw);
-	if (ret <= 0) {
-		error("sectok_reset failed: %s", sectok_get_sw(sw));
-		goto done;
-	}
-	if ((cla = cyberflex_inq_class(fd)) < 0) {
-		error("cyberflex_inq_class failed");
-		goto done;
-	}
-	memcpy(AUT0, DEFAUT0, sizeof(DEFAUT0));
-	if (cyberflex_verify_AUT0(fd, cla, AUT0, sizeof(DEFAUT0)) < 0) {
-		if (get_AUT0(AUT0) < 0 ||
-		    cyberflex_verify_AUT0(fd, cla, AUT0, sizeof(DEFAUT0)) < 0) {
-			memset(AUT0, 0, sizeof(DEFAUT0));
-			error("smartcard passphrase incorrect");
-			goto done;
-		}
-	}
-	memset(AUT0, 0, sizeof(DEFAUT0));
-	key_fid[0] = 0x00;
-	key_fid[1] = 0x12;
-	if (cyberflex_load_rsa_priv(fd, cla, key_fid, 5, 8*len, elements,
-	    &sw) < 0) {
-		error("cyberflex_load_rsa_priv failed: %s", sectok_get_sw(sw));
-		goto done;
-	}
-	if (!sectok_swOK(sw))
-		goto done;
-	log("cyberflex_load_rsa_priv done");
-	key_fid[0] = 0x73;
-	key_fid[1] = 0x68;
-	if (cyberflex_load_rsa_pub(fd, cla, key_fid, len, elements[5],
-	    &sw) < 0) {
-		error("cyberflex_load_rsa_pub failed: %s", sectok_get_sw(sw));
-		goto done;
-	}
-	if (!sectok_swOK(sw))
-		goto done;
-	log("cyberflex_load_rsa_pub done");
-	status = 0;
-
-done:
-	memset(elements[0], '\0', BN_num_bytes(prv->rsa->q));
-	memset(elements[1], '\0', BN_num_bytes(prv->rsa->p));
-	memset(elements[2], '\0', BN_num_bytes(prv->rsa->iqmp));
-	memset(elements[3], '\0', BN_num_bytes(prv->rsa->dmq1));
-	memset(elements[4], '\0', BN_num_bytes(prv->rsa->dmp1));
-	memset(elements[5], '\0', BN_num_bytes(prv->rsa->n));
-
-	for (i = 0; i < NUM_RSA_KEY_ELEMENTS; i++)
-		if (elements[i])
-			xfree(elements[i]);
-	if (fd != -1)
-		sectok_close(fd);
-	return (status);
-}
-#endif /* SMARTCARD && USE_SECTOK */
diff --git a/crypto/openssh/scard.h b/crypto/openssh/scard.h
deleted file mode 100644
index 00999cb09deb..000000000000
--- a/crypto/openssh/scard.h
+++ /dev/null
@@ -1,40 +0,0 @@
-/*	$OpenBSD: scard.h,v 1.11 2002/06/30 21:59:45 deraadt Exp $	*/
-
-/*
- * Copyright (c) 2001 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef SCARD_H
-#define SCARD_H
-
-#include "key.h"
-
-#define SCARD_ERROR_FAIL	-1
-#define SCARD_ERROR_NOCARD	-2
-#define SCARD_ERROR_APPLET	-3
-
-Key	**sc_get_keys(const char *, const char *);
-void	 sc_close(void);
-int	 sc_put_key(Key *, const char *);
-
-#endif
diff --git a/crypto/openssh/scard/Makefile b/crypto/openssh/scard/Makefile
deleted file mode 100644
index 1cf7bbd2ca1e..000000000000
--- a/crypto/openssh/scard/Makefile
+++ /dev/null
@@ -1,20 +0,0 @@
-#	$OpenBSD: Makefile,v 1.2 2001/06/29 07:02:09 markus Exp $
-
-.PATH:		${.CURDIR}/..
-
-CARDLET=	Ssh.bin
-DATADIR=	/usr/libdata/ssh
-
-all: ${CARDLET}
-
-clean:
-	rm -f ${CARDLET}
-
-install: ${CARDLET}
-	install -c -m ${LIBMODE} -o ${LIBOWN} -g ${LIBGRP} \
-	    ${CARDLET} ${DESTDIR}${DATADIR}
-
-Ssh.bin: ${.CURDIR}/Ssh.bin.uu
-	uudecode ${.CURDIR}/$@.uu
-
-.include <bsd.prog.mk>
diff --git a/crypto/openssh/scard/Makefile.in b/crypto/openssh/scard/Makefile.in
deleted file mode 100644
index ab4e22043949..000000000000
--- a/crypto/openssh/scard/Makefile.in
+++ /dev/null
@@ -1,28 +0,0 @@
-# $Id: Makefile.in,v 1.4 2002/04/26 01:25:41 djm Exp $
-
-prefix=@prefix@
-datadir=@datadir@
-srcdir=@srcdir@
-top_srcdir=@top_srcdir@
-
-INSTALL=@INSTALL@
-
-VPATH=@srcdir@
-
-all:
-
-#Ssh.bin:  Ssh.bin.uu
-#	uudecode Ssh.bin.uu
-
-clean:
-#	rm -rf Ssh.bin
-
-distprep:
-	uudecode Ssh.bin.uu
-
-distclean: clean
-	rm -f Makefile *~
-
-install: $(srcdir)/Ssh.bin
-	$(top_srcdir)/mkinstalldirs $(DESTDIR)$(datadir)
-	$(INSTALL) -m 0644 $(srcdir)/Ssh.bin $(DESTDIR)$(datadir)/Ssh.bin
diff --git a/crypto/openssh/scard/Ssh.bin b/crypto/openssh/scard/Ssh.bin
deleted file mode 100644
index edbadc6186c1..000000000000
--- a/crypto/openssh/scard/Ssh.bin
+++ /dev/null
diff --git a/crypto/openssh/scard/Ssh.bin.uu b/crypto/openssh/scard/Ssh.bin.uu
deleted file mode 100644
index ea3986a694af..000000000000
--- a/crypto/openssh/scard/Ssh.bin.uu
+++ /dev/null
@@ -1,17 +0,0 @@
-begin 644 Ssh.bin
-M`P)!&P`801X`>``!`E@"`/Y@\`4`_J'P!0!!&T$=`?Z@\`4`01M!'`'^>/,!
-M`4$;01X!_G#S%P'^0],1`?Y@\!0`_G/S'0#^<]4``D$;L`4`_F'3``#^8=,%
-M`/ZAT`$!_J#0)P'^H],*`?ZCTPD`_G/5"P7^8=,'`OZAT`H`_J#0$@3^:-,@
-M`T$;`P`%`/Y@`<P``$$<\@\``$$=\B$``$$>\A```/`0__(%`@8!`0H``&``
-M0205!!D)I$L`"0J0`&``*!4$&58``````.P````%____P````.D````0````
-M,P```"````#'````,````(T````R````V!4#&0A*``D*;@!@`"@5!QD*`/\]
-M(6``1A)*``D*9P!@`"@*/P!@`$LK"1)@`$LK!6``4!P$#00#2@`.#01@`%5@
-M`%I@`"@37``>%0@2%0A>`%\($F``9%(`:`H_`&``2RL*<VA@`$LK8`!I"1`U
-M(14#`Q)@`&X<!`T$`TL`"P,28`!D4@`.#01@`%5@`%I@`"A2`"X5`PH$`&``
-M<RL#!6``9%(`'14#"@$"8`!S*P,%8`!D4@`,4@`)"FT`8``H60``\`+_\@$!
-M`0D`"```"I``8``H60#P$__R`0$""0`,``!B01LM7P`\*UD```#P$O_V`0$#
-M`0`8```37``>7@`R10`/$UP`'@H`R`D07@`W!%>P!?_R`0$$`@`\```37P``
-M$V+^H2U?``5=``H38OZ@+5\`#UT`%!-B_G@M"@0`7P`970`>"@0`8``C10`)
-/"F<`8``H$UX`+5D`````
-`
-end
diff --git a/crypto/openssh/scard/Ssh.java b/crypto/openssh/scard/Ssh.java
deleted file mode 100644
index 6418957c2465..000000000000
--- a/crypto/openssh/scard/Ssh.java
+++ /dev/null
@@ -1,164 +0,0 @@
-// $Id: Ssh.java,v 1.3 2002/05/22 04:24:02 djm Exp $
-//
-// Ssh.java
-// SSH / smartcard integration project, smartcard side
-//
-// Tomoko Fukuzawa, created, Feb., 2000
-//
-// Naomaru Itoi, modified, Apr., 2000
-//
-
-// copyright 2000
-// the regents of the university of michigan
-// all rights reserved
-//
-// permission is granted to use, copy, create derivative works
-// and redistribute this software and such derivative works
-// for any purpose, so long as the name of the university of
-// michigan is not used in any advertising or publicity
-// pertaining to the use or distribution of this software
-// without specific, written prior authorization.  if the
-// above copyright notice or any other identification of the
-// university of michigan is included in any copy of any
-// portion of this software, then the disclaimer below must
-// also be included.
-//
-// this software is provided as is, without representation
-// from the university of michigan as to its fitness for any
-// purpose, and without warranty by the university of
-// michigan of any kind, either express or implied, including
-// without limitation the implied warranties of
-// merchantability and fitness for a particular purpose. the
-// regents of the university of michigan shall not be liable
-// for any damages, including special, indirect, incidental, or
-// consequential damages, with respect to any claim arising
-// out of or in connection with the use of the software, even
-// if it has been or is hereafter advised of the possibility of
-// such damages.
-
-import javacard.framework.*;
-import javacardx.framework.*;
-import javacardx.crypto.*;
-
-public class Ssh extends javacard.framework.Applet
-{
-    // Change this when the applet changes; hi byte is major, low byte is minor
-    static final short applet_version = (short)0x0102;
-
-    /* constants declaration */
-    // code of CLA byte in the command APDU header
-    static final byte Ssh_CLA =(byte)0x05;
-
-    // codes of INS byte in the command APDU header
-    static final byte DECRYPT = (byte) 0x10;
-    static final byte GET_KEYLENGTH = (byte) 0x20;
-    static final byte GET_PUBKEY = (byte) 0x30;
-    static final byte GET_VERSION = (byte) 0x32;
-    static final byte GET_RESPONSE = (byte) 0xc0;
-
-    static final short keysize = 1024;
-    static final short root_fid = (short)0x3f00;
-    static final short privkey_fid = (short)0x0012;
-    static final short pubkey_fid = (short)(('s'<<8)|'h');
-
-    /* instance variables declaration */
-    AsymKey rsakey;
-    CyberflexFile file;
-    CyberflexOS os;
-
-    private Ssh()
-    {
-	file = new CyberflexFile();
-	os = new CyberflexOS();
-
-	rsakey = new RSA_CRT_PrivateKey (keysize);
-
-	if ( ! rsakey.isSupportedLength (keysize) )
-	    ISOException.throwIt (ISO.SW_WRONG_LENGTH);
-
-	register();
-    } // end of the constructor
-
-    public boolean select() {
-	if (!rsakey.isInitialized())
-	    rsakey.setKeyInstance ((short)0xc8, (short)0x10);
-
-	return true;
-    }
-
-    public static void install(APDU apdu)
-    {
-	new Ssh();	// create a Ssh applet instance (card)
-    } // end of install method
-
-    public static void main(String args[]) {
-	ISOException.throwIt((short) 0x9000);
-    }
-
-    public void process(APDU apdu)
-    {
-	// APDU object carries a byte array (buffer) to
-	// transfer incoming and outgoing APDU header
-	// and data bytes between card and CAD
-	byte buffer[] = apdu.getBuffer();
-	short size, st;
-
-	// verify that if the applet can accept this
-	// APDU message
-	// NI: change suggested by Wayne Dyksen, Purdue
-	if (buffer[ISO.OFFSET_INS] == ISO.INS_SELECT)
-	    ISOException.throwIt(ISO.SW_NO_ERROR);
-
-	switch (buffer[ISO.OFFSET_INS]) {
-	case DECRYPT:
-	    if (buffer[ISO.OFFSET_CLA] != Ssh_CLA)
-		ISOException.throwIt(ISO.SW_CLA_NOT_SUPPORTED);
-	    //decrypt (apdu);
-	    size = (short) (buffer[ISO.OFFSET_LC] & 0x00FF);
-
-	    if (apdu.setIncomingAndReceive() != size)
-		ISOException.throwIt (ISO.SW_WRONG_LENGTH);
-
-	    // check access; depends on bit 2 (x/a)
-	    file.selectFile(root_fid);
-	    file.selectFile(privkey_fid);
-	    st = os.checkAccess(ACL.EXECUTE);
-	    if (st != ST.ACCESS_CLEARED) {
-		CyberflexAPDU.prepareSW1SW2(st);
-		ISOException.throwIt(CyberflexAPDU.getSW1SW2());
-	    }
-
-	    rsakey.cryptoUpdate (buffer, (short) ISO.OFFSET_CDATA, size,
-				 buffer, (short) ISO.OFFSET_CDATA);
-
-	    apdu.setOutgoingAndSend ((short) ISO.OFFSET_CDATA, size);
-	    break;
-	case GET_PUBKEY:
-	    file.selectFile(root_fid); // select root
-	    file.selectFile(pubkey_fid); // select public key file
-	    size = (short)(file.getFileSize() - 16);
-	    st = os.readBinaryFile(buffer, (short)0, (short)0, size);
-	    if (st == ST.SUCCESS)
-		apdu.setOutgoingAndSend((short)0, size);
-	    else {
-		CyberflexAPDU.prepareSW1SW2(st);
-		ISOException.throwIt(CyberflexAPDU.getSW1SW2());
-	    }
-	    break;
-	case GET_KEYLENGTH:
-	    Util.setShort(buffer, (short)0, keysize);
-	    apdu.setOutgoingAndSend ((short)0, (short)2);
-	    break;
-	case GET_VERSION:
-	    Util.setShort(buffer, (short)0, applet_version);
-	    apdu.setOutgoingAndSend ((short)0, (short)2);
-	    break;
-	case GET_RESPONSE:
-	    break;
-	default:
-	    ISOException.throwIt (ISO.SW_INS_NOT_SUPPORTED);
-	}
-
-    } // end of process method
-
-} // end of class Ssh
diff --git a/crypto/openssh/scp-common.c b/crypto/openssh/scp-common.c
deleted file mode 100644
index 7e5f09c74fae..000000000000
--- a/crypto/openssh/scp-common.c
+++ /dev/null
@@ -1,98 +0,0 @@
-/*
- * Copyright (c) 1999 Theo de Raadt.  All rights reserved.
- * Copyright (c) 1999 Aaron Campbell.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/*
- * Parts from:
- *
- * Copyright (c) 1983, 1990, 1992, 1993, 1995
- *	The Regents of the University of California.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *	This product includes software developed by the University of
- *	California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: scp-common.c,v 1.1 2001/04/16 02:31:43 mouring Exp $");
-
-char *
-cleanhostname(host)
-	char *host;
-{
-	if (*host == '[' && host[strlen(host) - 1] == ']') {
-		host[strlen(host) - 1] = '\0';
-		return (host + 1);
-	} else
-		return host;
-}
-
-char *
-colon(cp)
-	char *cp;
-{
-	int flag = 0;
-
-	if (*cp == ':')		/* Leading colon is part of file name. */
-		return (0);
-	if (*cp == '[')
-		flag = 1;
-
-	for (; *cp; ++cp) {
-		if (*cp == '@' && *(cp+1) == '[')
-			flag = 1;
-		if (*cp == ']' && *(cp+1) == ':' && flag)
-			return (cp+1);
-		if (*cp == ':' && !flag)
-			return (cp);
-		if (*cp == '/')
-			return (0);
-	}
-	return (0);
-}
diff --git a/crypto/openssh/scp-common.h b/crypto/openssh/scp-common.h
deleted file mode 100644
index e0ab6ec32a7d..000000000000
--- a/crypto/openssh/scp-common.h
+++ /dev/null
@@ -1,64 +0,0 @@
-/* $OpenBSD: scp-common.h,v 1.1 2001/04/16 02:31:43 mouring Exp $ */
-/*
- * Copyright (c) 1999 Theo de Raadt.  All rights reserved.
- * Copyright (c) 1999 Aaron Campbell.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/*
- * Parts from:
- *
- * Copyright (c) 1983, 1990, 1992, 1993, 1995
- *	The Regents of the University of California.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *	This product includes software developed by the University of
- *	California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- */
-
-char *cleanhostname(char *host);
-char *colon(char *cp);
diff --git a/crypto/openssh/scp.1 b/crypto/openssh/scp.1
deleted file mode 100644
index a3ec2e0c61e6..000000000000
--- a/crypto/openssh/scp.1
+++ /dev/null
@@ -1,167 +0,0 @@
-.\"  -*- nroff -*-
-.\"
-.\" scp.1
-.\"
-.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
-.\"
-.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
-.\"                    All rights reserved
-.\"
-.\" Created: Sun May  7 00:14:37 1995 ylo
-.\"
-.\" $OpenBSD: scp.1,v 1.27 2003/03/28 10:11:43 jmc Exp $
-.\"
-.Dd September 25, 1999
-.Dt SCP 1
-.Os
-.Sh NAME
-.Nm scp
-.Nd secure copy (remote file copy program)
-.Sh SYNOPSIS
-.Nm scp
-.Bk -words
-.Op Fl pqrvBC1246
-.Op Fl F Ar ssh_config
-.Op Fl S Ar program
-.Op Fl P Ar port
-.Op Fl c Ar cipher
-.Op Fl i Ar identity_file
-.Op Fl l Ar limit
-.Op Fl o Ar ssh_option
-.Sm off
-.Oo
-.Op Ar user@
-.Ar host1 No :
-.Oc Ns Ar file1
-.Sm on
-.Op Ar ...
-.Sm off
-.Oo
-.Op Ar user@
-.Ar host2 No :
-.Oc Ar file2
-.Sm on
-.Ek
-.Sh DESCRIPTION
-.Nm
-copies files between hosts on a network.
-It uses
-.Xr ssh 1
-for data transfer, and uses the same authentication and provides the
-same security as
-.Xr ssh 1 .
-Unlike
-.Xr rcp 1 ,
-.Nm
-will ask for passwords or passphrases if they are needed for
-authentication.
-.Pp
-Any file name may contain a host and user specification to indicate
-that the file is to be copied to/from that host.
-Copies between two remote hosts are permitted.
-.Pp
-The options are as follows:
-.Bl -tag -width Ds
-.It Fl c Ar cipher
-Selects the cipher to use for encrypting the data transfer.
-This option is directly passed to
-.Xr ssh 1 .
-.It Fl i Ar identity_file
-Selects the file from which the identity (private key) for RSA
-authentication is read.
-This option is directly passed to
-.Xr ssh 1 .
-.It Fl l Ar limit
-Limits the used bandwidth, specified in Kbit/s.
-.It Fl p
-Preserves modification times, access times, and modes from the
-original file.
-.It Fl r
-Recursively copy entire directories.
-.It Fl v
-Verbose mode.
-Causes
-.Nm
-and
-.Xr ssh 1
-to print debugging messages about their progress.
-This is helpful in
-debugging connection, authentication, and configuration problems.
-.It Fl B
-Selects batch mode (prevents asking for passwords or passphrases).
-.It Fl q
-Disables the progress meter.
-.It Fl C
-Compression enable.
-Passes the
-.Fl C
-flag to
-.Xr ssh 1
-to enable compression.
-.It Fl F Ar ssh_config
-Specifies an alternative
-per-user configuration file for
-.Nm ssh .
-This option is directly passed to
-.Xr ssh 1 .
-.It Fl P Ar port
-Specifies the port to connect to on the remote host.
-Note that this option is written with a capital
-.Sq P ,
-because
-.Fl p
-is already reserved for preserving the times and modes of the file in
-.Xr rcp 1 .
-.It Fl S Ar program
-Name of
-.Ar program
-to use for the encrypted connection.
-The program must understand
-.Xr ssh 1
-options.
-.It Fl o Ar ssh_option
-Can be used to pass options to
-.Nm ssh
-in the format used in
-.Xr ssh_config 5 .
-This is useful for specifying options
-for which there is no separate
-.Nm scp
-command-line flag.
-.It Fl 1
-Forces
-.Nm
-to use protocol 1.
-.It Fl 2
-Forces
-.Nm
-to use protocol 2.
-.It Fl 4
-Forces
-.Nm
-to use IPv4 addresses only.
-.It Fl 6
-Forces
-.Nm
-to use IPv6 addresses only.
-.El
-.Sh DIAGNOSTICS
-.Nm
-exits with 0 on success or >0 if an error occurred.
-.Sh AUTHORS
-Timo Rinne <tri@iki.fi> and Tatu Ylonen <ylo@cs.hut.fi>
-.Sh HISTORY
-.Nm
-is based on the
-.Xr rcp 1
-program in BSD source code from the Regents of the University of
-California.
-.Sh SEE ALSO
-.Xr rcp 1 ,
-.Xr sftp 1 ,
-.Xr ssh 1 ,
-.Xr ssh-add 1 ,
-.Xr ssh-agent 1 ,
-.Xr ssh-keygen 1 ,
-.Xr ssh_config 5 ,
-.Xr sshd 8
diff --git a/crypto/openssh/scp.c b/crypto/openssh/scp.c
deleted file mode 100644
index 35d4c5f7143e..000000000000
--- a/crypto/openssh/scp.c
+++ /dev/null
@@ -1,1149 +0,0 @@
-/*
- * scp - secure remote copy.  This is basically patched BSD rcp which
- * uses ssh to do the data transfer (instead of using rcmd).
- *
- * NOTE: This version should NOT be suid root.  (This uses ssh to
- * do the transfer and ssh has the necessary privileges.)
- *
- * 1995 Timo Rinne <tri@iki.fi>, Tatu Ylonen <ylo@cs.hut.fi>
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-/*
- * Copyright (c) 1999 Theo de Raadt.  All rights reserved.
- * Copyright (c) 1999 Aaron Campbell.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/*
- * Parts from:
- *
- * Copyright (c) 1983, 1990, 1992, 1993, 1995
- *	The Regents of the University of California.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *	This product includes software developed by the University of
- *	California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: scp.c,v 1.102 2003/03/05 22:33:43 markus Exp $");
-
-#include "xmalloc.h"
-#include "atomicio.h"
-#include "pathnames.h"
-#include "log.h"
-#include "misc.h"
-#include "progressmeter.h"
-
-#ifdef HAVE___PROGNAME
-extern char *__progname;
-#else
-char *__progname;
-#endif
-
-void bwlimit(int);
-
-/* Struct for addargs */
-arglist args;
-
-/* Bandwidth limit */
-off_t limitbw = 0;
-
-/* Name of current file being transferred. */
-char *curfile;
-
-/* This is set to non-zero to enable verbose mode. */
-int verbose_mode = 0;
-
-/* This is set to zero if the progressmeter is not desired. */
-int showprogress = 1;
-
-/* This is the program to execute for the secured connection. ("ssh" or -S) */
-char *ssh_program = _PATH_SSH_PROGRAM;
-
-/* This is used to store the pid of ssh_program */
-pid_t do_cmd_pid;
-
-/*
- * This function executes the given command as the specified user on the
- * given host.  This returns < 0 if execution fails, and >= 0 otherwise. This
- * assigns the input and output file descriptors on success.
- */
-
-int
-do_cmd(char *host, char *remuser, char *cmd, int *fdin, int *fdout, int argc)
-{
-	int pin[2], pout[2], reserved[2];
-
-	if (verbose_mode)
-		fprintf(stderr,
-		    "Executing: program %s host %s, user %s, command %s\n",
-		    ssh_program, host,
-		    remuser ? remuser : "(unspecified)", cmd);
-
-	/*
-	 * Reserve two descriptors so that the real pipes won't get
-	 * descriptors 0 and 1 because that will screw up dup2 below.
-	 */
-	pipe(reserved);
-
-	/* Create a socket pair for communicating with ssh. */
-	if (pipe(pin) < 0)
-		fatal("pipe: %s", strerror(errno));
-	if (pipe(pout) < 0)
-		fatal("pipe: %s", strerror(errno));
-
-	/* Free the reserved descriptors. */
-	close(reserved[0]);
-	close(reserved[1]);
-
-	/* For a child to execute the command on the remote host using ssh. */
-	do_cmd_pid = fork();
-	if (do_cmd_pid == 0) {
-		/* Child. */
-		close(pin[1]);
-		close(pout[0]);
-		dup2(pin[0], 0);
-		dup2(pout[1], 1);
-		close(pin[0]);
-		close(pout[1]);
-
-		args.list[0] = ssh_program;
-		if (remuser != NULL)
-			addargs(&args, "-l%s", remuser);
-		addargs(&args, "%s", host);
-		addargs(&args, "%s", cmd);
-
-		execvp(ssh_program, args.list);
-		perror(ssh_program);
-		exit(1);
-	} else if (do_cmd_pid == -1) {
-		fatal("fork: %s", strerror(errno));
-	}
-	/* Parent.  Close the other side, and return the local side. */
-	close(pin[0]);
-	*fdout = pin[1];
-	close(pout[1]);
-	*fdin = pout[0];
-	return 0;
-}
-
-typedef struct {
-	int cnt;
-	char *buf;
-} BUF;
-
-BUF *allocbuf(BUF *, int, int);
-void lostconn(int);
-void nospace(void);
-int okname(char *);
-void run_err(const char *,...);
-void verifydir(char *);
-
-struct passwd *pwd;
-uid_t userid;
-int errs, remin, remout;
-int pflag, iamremote, iamrecursive, targetshouldbedirectory;
-
-#define	CMDNEEDS	64
-char cmd[CMDNEEDS];		/* must hold "rcp -r -p -d\0" */
-
-int response(void);
-void rsource(char *, struct stat *);
-void sink(int, char *[]);
-void source(int, char *[]);
-void tolocal(int, char *[]);
-void toremote(char *, int, char *[]);
-void usage(void);
-
-int
-main(argc, argv)
-	int argc;
-	char *argv[];
-{
-	int ch, fflag, tflag, status;
-	double speed;
-	char *targ, *endp;
-	extern char *optarg;
-	extern int optind;
-
-	__progname = get_progname(argv[0]);
-
-	args.list = NULL;
-	addargs(&args, "ssh");		/* overwritten with ssh_program */
-	addargs(&args, "-x");
-	addargs(&args, "-oForwardAgent no");
-	addargs(&args, "-oClearAllForwardings yes");
-
-	fflag = tflag = 0;
-	while ((ch = getopt(argc, argv, "dfl:prtvBCc:i:P:q1246S:o:F:")) != -1)
-		switch (ch) {
-		/* User-visible flags. */
-		case '1':
-		case '2':
-		case '4':
-		case '6':
-		case 'C':
-			addargs(&args, "-%c", ch);
-			break;
-		case 'o':
-		case 'c':
-		case 'i':
-		case 'F':
-			addargs(&args, "-%c%s", ch, optarg);
-			break;
-		case 'P':
-			addargs(&args, "-p%s", optarg);
-			break;
-		case 'B':
-			addargs(&args, "-oBatchmode yes");
-			break;
-		case 'l':
-			speed = strtod(optarg, &endp);
-			if (speed <= 0 || *endp != '\0')
-				usage();
-			limitbw = speed * 1024;
-			break;
-		case 'p':
-			pflag = 1;
-			break;
-		case 'r':
-			iamrecursive = 1;
-			break;
-		case 'S':
-			ssh_program = xstrdup(optarg);
-			break;
-		case 'v':
-			addargs(&args, "-v");
-			verbose_mode = 1;
-			break;
-		case 'q':
-			showprogress = 0;
-			break;
-
-		/* Server options. */
-		case 'd':
-			targetshouldbedirectory = 1;
-			break;
-		case 'f':	/* "from" */
-			iamremote = 1;
-			fflag = 1;
-			break;
-		case 't':	/* "to" */
-			iamremote = 1;
-			tflag = 1;
-#ifdef HAVE_CYGWIN
-			setmode(0, O_BINARY);
-#endif
-			break;
-		default:
-			usage();
-		}
-	argc -= optind;
-	argv += optind;
-
-	if ((pwd = getpwuid(userid = getuid())) == NULL)
-		fatal("unknown user %d", (int) userid);
-
-	if (!isatty(STDERR_FILENO))
-		showprogress = 0;
-
-	remin = STDIN_FILENO;
-	remout = STDOUT_FILENO;
-
-	if (fflag) {
-		/* Follow "protocol", send data. */
-		(void) response();
-		source(argc, argv);
-		exit(errs != 0);
-	}
-	if (tflag) {
-		/* Receive data. */
-		sink(argc, argv);
-		exit(errs != 0);
-	}
-	if (argc < 2)
-		usage();
-	if (argc > 2)
-		targetshouldbedirectory = 1;
-
-	remin = remout = -1;
-	do_cmd_pid = -1;
-	/* Command to be executed on remote system using "ssh". */
-	(void) snprintf(cmd, sizeof cmd, "scp%s%s%s%s",
-	    verbose_mode ? " -v" : "",
-	    iamrecursive ? " -r" : "", pflag ? " -p" : "",
-	    targetshouldbedirectory ? " -d" : "");
-
-	(void) signal(SIGPIPE, lostconn);
-
-	if ((targ = colon(argv[argc - 1])))	/* Dest is remote host. */
-		toremote(targ, argc, argv);
-	else {
-		tolocal(argc, argv);	/* Dest is local host. */
-		if (targetshouldbedirectory)
-			verifydir(argv[argc - 1]);
-	}
-	/*
-	 * Finally check the exit status of the ssh process, if one was forked
-	 * and no error has occured yet
-	 */
-	if (do_cmd_pid != -1 && errs == 0) {
-		if (remin != -1)
-		    (void) close(remin);
-		if (remout != -1)
-		    (void) close(remout);
-		if (waitpid(do_cmd_pid, &status, 0) == -1)
-			errs = 1;
-		else {
-			if (!WIFEXITED(status) || WEXITSTATUS(status) != 0)
-				errs = 1;
-		}
-	}
-	exit(errs != 0);
-}
-
-void
-toremote(targ, argc, argv)
-	char *targ, *argv[];
-	int argc;
-{
-	int i, len;
-	char *bp, *host, *src, *suser, *thost, *tuser;
-
-	*targ++ = 0;
-	if (*targ == 0)
-		targ = ".";
-
-	if ((thost = strrchr(argv[argc - 1], '@'))) {
-		/* user@host */
-		*thost++ = 0;
-		tuser = argv[argc - 1];
-		if (*tuser == '\0')
-			tuser = NULL;
-	} else {
-		thost = argv[argc - 1];
-		tuser = NULL;
-	}
-
-	for (i = 0; i < argc - 1; i++) {
-		src = colon(argv[i]);
-		if (src) {	/* remote to remote */
-			static char *ssh_options =
-			    "-x -o'ClearAllForwardings yes'";
-			*src++ = 0;
-			if (*src == 0)
-				src = ".";
-			host = strrchr(argv[i], '@');
-			len = strlen(ssh_program) + strlen(argv[i]) +
-			    strlen(src) + (tuser ? strlen(tuser) : 0) +
-			    strlen(thost) + strlen(targ) +
-			    strlen(ssh_options) + CMDNEEDS + 20;
-			bp = xmalloc(len);
-			if (host) {
-				*host++ = 0;
-				host = cleanhostname(host);
-				suser = argv[i];
-				if (*suser == '\0')
-					suser = pwd->pw_name;
-				else if (!okname(suser)) {
-					xfree(bp);
-					continue;
-				}
-				if (tuser && !okname(tuser)) {
-					xfree(bp);
-					continue;
-				}
-				snprintf(bp, len,
-				    "%s%s %s -n "
-				    "-l %s %s %s %s '%s%s%s:%s'",
-				    ssh_program, verbose_mode ? " -v" : "",
-				    ssh_options, suser, host, cmd, src,
-				    tuser ? tuser : "", tuser ? "@" : "",
-				    thost, targ);
-			} else {
-				host = cleanhostname(argv[i]);
-				snprintf(bp, len,
-				    "exec %s%s %s -n %s "
-				    "%s %s '%s%s%s:%s'",
-				    ssh_program, verbose_mode ? " -v" : "",
-				    ssh_options, host, cmd, src,
-				    tuser ? tuser : "", tuser ? "@" : "",
-				    thost, targ);
-			}
-			if (verbose_mode)
-				fprintf(stderr, "Executing: %s\n", bp);
-			(void) system(bp);
-			(void) xfree(bp);
-		} else {	/* local to remote */
-			if (remin == -1) {
-				len = strlen(targ) + CMDNEEDS + 20;
-				bp = xmalloc(len);
-				(void) snprintf(bp, len, "%s -t %s", cmd, targ);
-				host = cleanhostname(thost);
-				if (do_cmd(host, tuser, bp, &remin,
-				    &remout, argc) < 0)
-					exit(1);
-				if (response() < 0)
-					exit(1);
-				(void) xfree(bp);
-			}
-			source(1, argv + i);
-		}
-	}
-}
-
-void
-tolocal(argc, argv)
-	int argc;
-	char *argv[];
-{
-	int i, len;
-	char *bp, *host, *src, *suser;
-
-	for (i = 0; i < argc - 1; i++) {
-		if (!(src = colon(argv[i]))) {	/* Local to local. */
-			len = strlen(_PATH_CP) + strlen(argv[i]) +
-			    strlen(argv[argc - 1]) + 20;
-			bp = xmalloc(len);
-			(void) snprintf(bp, len, "exec %s%s%s %s %s", _PATH_CP,
-			    iamrecursive ? " -r" : "", pflag ? " -p" : "",
-			    argv[i], argv[argc - 1]);
-			if (verbose_mode)
-				fprintf(stderr, "Executing: %s\n", bp);
-			if (system(bp))
-				++errs;
-			(void) xfree(bp);
-			continue;
-		}
-		*src++ = 0;
-		if (*src == 0)
-			src = ".";
-		if ((host = strrchr(argv[i], '@')) == NULL) {
-			host = argv[i];
-			suser = NULL;
-		} else {
-			*host++ = 0;
-			suser = argv[i];
-			if (*suser == '\0')
-				suser = pwd->pw_name;
-		}
-		host = cleanhostname(host);
-		len = strlen(src) + CMDNEEDS + 20;
-		bp = xmalloc(len);
-		(void) snprintf(bp, len, "%s -f %s", cmd, src);
-		if (do_cmd(host, suser, bp, &remin, &remout, argc) < 0) {
-			(void) xfree(bp);
-			++errs;
-			continue;
-		}
-		xfree(bp);
-		sink(1, argv + argc - 1);
-		(void) close(remin);
-		remin = remout = -1;
-	}
-}
-
-void
-source(argc, argv)
-	int argc;
-	char *argv[];
-{
-	struct stat stb;
-	static BUF buffer;
-	BUF *bp;
-	off_t i, amt, result, statbytes;
-	int fd, haderr, indx;
-	char *last, *name, buf[2048];
-	int len;
-
-	for (indx = 0; indx < argc; ++indx) {
-		name = argv[indx];
-		statbytes = 0;
-		len = strlen(name);
-		while (len > 1 && name[len-1] == '/')
-			name[--len] = '\0';
-		if (strchr(name, '\n') != NULL) {
-			run_err("%s: skipping, filename contains a newline",
-			    name);
-			goto next;
-		}
-		if ((fd = open(name, O_RDONLY, 0)) < 0)
-			goto syserr;
-		if (fstat(fd, &stb) < 0) {
-syserr:			run_err("%s: %s", name, strerror(errno));
-			goto next;
-		}
-		switch (stb.st_mode & S_IFMT) {
-		case S_IFREG:
-			break;
-		case S_IFDIR:
-			if (iamrecursive) {
-				rsource(name, &stb);
-				goto next;
-			}
-			/* FALLTHROUGH */
-		default:
-			run_err("%s: not a regular file", name);
-			goto next;
-		}
-		if ((last = strrchr(name, '/')) == NULL)
-			last = name;
-		else
-			++last;
-		curfile = last;
-		if (pflag) {
-			/*
-			 * Make it compatible with possible future
-			 * versions expecting microseconds.
-			 */
-			(void) snprintf(buf, sizeof buf, "T%lu 0 %lu 0\n",
-			    (u_long) stb.st_mtime,
-			    (u_long) stb.st_atime);
-			(void) atomicio(write, remout, buf, strlen(buf));
-			if (response() < 0)
-				goto next;
-		}
-#define	FILEMODEMASK	(S_ISUID|S_ISGID|S_IRWXU|S_IRWXG|S_IRWXO)
-#ifdef HAVE_LONG_LONG_INT
-		snprintf(buf, sizeof buf, "C%04o %lld %s\n",
-		    (u_int) (stb.st_mode & FILEMODEMASK),
-		    (long long)stb.st_size, last);
-#else
-		/* XXX: Handle integer overflow? */
-		snprintf(buf, sizeof buf, "C%04o %lu %s\n",
-		    (u_int) (stb.st_mode & FILEMODEMASK),
-		    (u_long) stb.st_size, last);
-#endif
-		if (verbose_mode) {
-			fprintf(stderr, "Sending file modes: %s", buf);
-		}
-		(void) atomicio(write, remout, buf, strlen(buf));
-		if (response() < 0)
-			goto next;
-		if ((bp = allocbuf(&buffer, fd, 2048)) == NULL) {
-next:			(void) close(fd);
-			continue;
-		}
-		if (showprogress)
-			start_progress_meter(curfile, stb.st_size, &statbytes);
-		/* Keep writing after an error so that we stay sync'd up. */
-		for (haderr = i = 0; i < stb.st_size; i += bp->cnt) {
-			amt = bp->cnt;
-			if (i + amt > stb.st_size)
-				amt = stb.st_size - i;
-			if (!haderr) {
-				result = atomicio(read, fd, bp->buf, amt);
-				if (result != amt)
-					haderr = result >= 0 ? EIO : errno;
-			}
-			if (haderr)
-				(void) atomicio(write, remout, bp->buf, amt);
-			else {
-				result = atomicio(write, remout, bp->buf, amt);
-				if (result != amt)
-					haderr = result >= 0 ? EIO : errno;
-				statbytes += result;
-			}
-			if (limitbw)
-				bwlimit(amt);
-		}
-		if (showprogress)
-			stop_progress_meter();
-
-		if (close(fd) < 0 && !haderr)
-			haderr = errno;
-		if (!haderr)
-			(void) atomicio(write, remout, "", 1);
-		else
-			run_err("%s: %s", name, strerror(haderr));
-		(void) response();
-	}
-}
-
-void
-rsource(name, statp)
-	char *name;
-	struct stat *statp;
-{
-	DIR *dirp;
-	struct dirent *dp;
-	char *last, *vect[1], path[1100];
-
-	if (!(dirp = opendir(name))) {
-		run_err("%s: %s", name, strerror(errno));
-		return;
-	}
-	last = strrchr(name, '/');
-	if (last == 0)
-		last = name;
-	else
-		last++;
-	if (pflag) {
-		(void) snprintf(path, sizeof(path), "T%lu 0 %lu 0\n",
-		    (u_long) statp->st_mtime,
-		    (u_long) statp->st_atime);
-		(void) atomicio(write, remout, path, strlen(path));
-		if (response() < 0) {
-			closedir(dirp);
-			return;
-		}
-	}
-	(void) snprintf(path, sizeof path, "D%04o %d %.1024s\n",
-	    (u_int) (statp->st_mode & FILEMODEMASK), 0, last);
-	if (verbose_mode)
-		fprintf(stderr, "Entering directory: %s", path);
-	(void) atomicio(write, remout, path, strlen(path));
-	if (response() < 0) {
-		closedir(dirp);
-		return;
-	}
-	while ((dp = readdir(dirp)) != NULL) {
-		if (dp->d_ino == 0)
-			continue;
-		if (!strcmp(dp->d_name, ".") || !strcmp(dp->d_name, ".."))
-			continue;
-		if (strlen(name) + 1 + strlen(dp->d_name) >= sizeof(path) - 1) {
-			run_err("%s/%s: name too long", name, dp->d_name);
-			continue;
-		}
-		(void) snprintf(path, sizeof path, "%s/%s", name, dp->d_name);
-		vect[0] = path;
-		source(1, vect);
-	}
-	(void) closedir(dirp);
-	(void) atomicio(write, remout, "E\n", 2);
-	(void) response();
-}
-
-void
-bwlimit(int amount)
-{
-	static struct timeval bwstart, bwend;
-	static int lamt, thresh = 16384;
-	u_int64_t wait;
-	struct timespec ts, rm;
-
-	if (!timerisset(&bwstart)) {
-		gettimeofday(&bwstart, NULL);
-		return;
-	}
-
-	lamt += amount;
-	if (lamt < thresh)
-		return;
-
-	gettimeofday(&bwend, NULL);
-	timersub(&bwend, &bwstart, &bwend);
-	if (!timerisset(&bwend))
-		return;
-
-	lamt *= 8;
-	wait = (double)1000000L * lamt / limitbw;
-
-	bwstart.tv_sec = wait / 1000000L;
-	bwstart.tv_usec = wait % 1000000L;
-
-	if (timercmp(&bwstart, &bwend, >)) {
-		timersub(&bwstart, &bwend, &bwend);
-
-		/* Adjust the wait time */
-		if (bwend.tv_sec) {
-			thresh /= 2;
-			if (thresh < 2048)
-				thresh = 2048;
-		} else if (bwend.tv_usec < 100) {
-			thresh *= 2;
-			if (thresh > 32768)
-				thresh = 32768;
-		}
-
-		TIMEVAL_TO_TIMESPEC(&bwend, &ts);
-		while (nanosleep(&ts, &rm) == -1) {
-			if (errno != EINTR)
-				break;
-			ts = rm;
-		}
-	}
-
-	lamt = 0;
-	gettimeofday(&bwstart, NULL);
-}
-
-void
-sink(argc, argv)
-	int argc;
-	char *argv[];
-{
-	static BUF buffer;
-	struct stat stb;
-	enum {
-		YES, NO, DISPLAYED
-	} wrerr;
-	BUF *bp;
-	off_t i, j;
-	int amt, count, exists, first, mask, mode, ofd, omode;
-	off_t size, statbytes;
-	int setimes, targisdir, wrerrno = 0;
-	char ch, *cp, *np, *targ, *why, *vect[1], buf[2048];
-	struct timeval tv[2];
-
-#define	atime	tv[0]
-#define	mtime	tv[1]
-#define	SCREWUP(str)	do { why = str; goto screwup; } while (0)
-
-	setimes = targisdir = 0;
-	mask = umask(0);
-	if (!pflag)
-		(void) umask(mask);
-	if (argc != 1) {
-		run_err("ambiguous target");
-		exit(1);
-	}
-	targ = *argv;
-	if (targetshouldbedirectory)
-		verifydir(targ);
-
-	(void) atomicio(write, remout, "", 1);
-	if (stat(targ, &stb) == 0 && S_ISDIR(stb.st_mode))
-		targisdir = 1;
-	for (first = 1;; first = 0) {
-		cp = buf;
-		if (atomicio(read, remin, cp, 1) <= 0)
-			return;
-		if (*cp++ == '\n')
-			SCREWUP("unexpected <newline>");
-		do {
-			if (atomicio(read, remin, &ch, sizeof(ch)) != sizeof(ch))
-				SCREWUP("lost connection");
-			*cp++ = ch;
-		} while (cp < &buf[sizeof(buf) - 1] && ch != '\n');
-		*cp = 0;
-
-		if (buf[0] == '\01' || buf[0] == '\02') {
-			if (iamremote == 0)
-				(void) atomicio(write, STDERR_FILENO,
-				    buf + 1, strlen(buf + 1));
-			if (buf[0] == '\02')
-				exit(1);
-			++errs;
-			continue;
-		}
-		if (buf[0] == 'E') {
-			(void) atomicio(write, remout, "", 1);
-			return;
-		}
-		if (ch == '\n')
-			*--cp = 0;
-
-		cp = buf;
-		if (*cp == 'T') {
-			setimes++;
-			cp++;
-			mtime.tv_sec = strtol(cp, &cp, 10);
-			if (!cp || *cp++ != ' ')
-				SCREWUP("mtime.sec not delimited");
-			mtime.tv_usec = strtol(cp, &cp, 10);
-			if (!cp || *cp++ != ' ')
-				SCREWUP("mtime.usec not delimited");
-			atime.tv_sec = strtol(cp, &cp, 10);
-			if (!cp || *cp++ != ' ')
-				SCREWUP("atime.sec not delimited");
-			atime.tv_usec = strtol(cp, &cp, 10);
-			if (!cp || *cp++ != '\0')
-				SCREWUP("atime.usec not delimited");
-			(void) atomicio(write, remout, "", 1);
-			continue;
-		}
-		if (*cp != 'C' && *cp != 'D') {
-			/*
-			 * Check for the case "rcp remote:foo\* local:bar".
-			 * In this case, the line "No match." can be returned
-			 * by the shell before the rcp command on the remote is
-			 * executed so the ^Aerror_message convention isn't
-			 * followed.
-			 */
-			if (first) {
-				run_err("%s", cp);
-				exit(1);
-			}
-			SCREWUP("expected control record");
-		}
-		mode = 0;
-		for (++cp; cp < buf + 5; cp++) {
-			if (*cp < '0' || *cp > '7')
-				SCREWUP("bad mode");
-			mode = (mode << 3) | (*cp - '0');
-		}
-		if (*cp++ != ' ')
-			SCREWUP("mode not delimited");
-
-		for (size = 0; isdigit(*cp);)
-			size = size * 10 + (*cp++ - '0');
-		if (*cp++ != ' ')
-			SCREWUP("size not delimited");
-		if (targisdir) {
-			static char *namebuf;
-			static int cursize;
-			size_t need;
-
-			need = strlen(targ) + strlen(cp) + 250;
-			if (need > cursize) {
-				if (namebuf)
-					xfree(namebuf);
-				namebuf = xmalloc(need);
-				cursize = need;
-			}
-			(void) snprintf(namebuf, need, "%s%s%s", targ,
-			    strcmp(targ, "/") ? "/" : "", cp);
-			np = namebuf;
-		} else
-			np = targ;
-		curfile = cp;
-		exists = stat(np, &stb) == 0;
-		if (buf[0] == 'D') {
-			int mod_flag = pflag;
-			if (exists) {
-				if (!S_ISDIR(stb.st_mode)) {
-					errno = ENOTDIR;
-					goto bad;
-				}
-				if (pflag)
-					(void) chmod(np, mode);
-			} else {
-				/* Handle copying from a read-only
-				   directory */
-				mod_flag = 1;
-				if (mkdir(np, mode | S_IRWXU) < 0)
-					goto bad;
-			}
-			vect[0] = xstrdup(np);
-			sink(1, vect);
-			if (setimes) {
-				setimes = 0;
-				if (utimes(vect[0], tv) < 0)
-					run_err("%s: set times: %s",
-					    vect[0], strerror(errno));
-			}
-			if (mod_flag)
-				(void) chmod(vect[0], mode);
-			if (vect[0])
-				xfree(vect[0]);
-			continue;
-		}
-		omode = mode;
-		mode |= S_IWRITE;
-		if ((ofd = open(np, O_WRONLY|O_CREAT, mode)) < 0) {
-bad:			run_err("%s: %s", np, strerror(errno));
-			continue;
-		}
-		(void) atomicio(write, remout, "", 1);
-		if ((bp = allocbuf(&buffer, ofd, 4096)) == NULL) {
-			(void) close(ofd);
-			continue;
-		}
-		cp = bp->buf;
-		wrerr = NO;
-
-		statbytes = 0;
-		if (showprogress)
-			start_progress_meter(curfile, size, &statbytes);
-		for (count = i = 0; i < size; i += 4096) {
-			amt = 4096;
-			if (i + amt > size)
-				amt = size - i;
-			count += amt;
-			do {
-				j = read(remin, cp, amt);
-				if (j == -1 && (errno == EINTR ||
-				    errno == EAGAIN)) {
-					continue;
-				} else if (j <= 0) {
-					run_err("%s", j ? strerror(errno) :
-					    "dropped connection");
-					exit(1);
-				}
-				amt -= j;
-				cp += j;
-				statbytes += j;
-			} while (amt > 0);
-		
-			if (limitbw)
-				bwlimit(4096);
-
-			if (count == bp->cnt) {
-				/* Keep reading so we stay sync'd up. */
-				if (wrerr == NO) {
-					j = atomicio(write, ofd, bp->buf, count);
-					if (j != count) {
-						wrerr = YES;
-						wrerrno = j >= 0 ? EIO : errno;
-					}
-				}
-				count = 0;
-				cp = bp->buf;
-			}
-		}
-		if (showprogress)
-			stop_progress_meter();
-		if (count != 0 && wrerr == NO &&
-		    (j = atomicio(write, ofd, bp->buf, count)) != count) {
-			wrerr = YES;
-			wrerrno = j >= 0 ? EIO : errno;
-		}
-		if (wrerr == NO && ftruncate(ofd, size) != 0) {
-			run_err("%s: truncate: %s", np, strerror(errno));
-			wrerr = DISPLAYED;
-		}
-		if (pflag) {
-			if (exists || omode != mode)
-#ifdef HAVE_FCHMOD
-				if (fchmod(ofd, omode))
-#else /* HAVE_FCHMOD */
-				if (chmod(np, omode))
-#endif /* HAVE_FCHMOD */
-					run_err("%s: set mode: %s",
-					    np, strerror(errno));
-		} else {
-			if (!exists && omode != mode)
-#ifdef HAVE_FCHMOD
-				if (fchmod(ofd, omode & ~mask))
-#else /* HAVE_FCHMOD */
-				if (chmod(np, omode & ~mask))
-#endif /* HAVE_FCHMOD */
-					run_err("%s: set mode: %s",
-					    np, strerror(errno));
-		}
-		if (close(ofd) == -1) {
-			wrerr = YES;
-			wrerrno = errno;
-		}
-		(void) response();
-		if (setimes && wrerr == NO) {
-			setimes = 0;
-			if (utimes(np, tv) < 0) {
-				run_err("%s: set times: %s",
-				    np, strerror(errno));
-				wrerr = DISPLAYED;
-			}
-		}
-		switch (wrerr) {
-		case YES:
-			run_err("%s: %s", np, strerror(wrerrno));
-			break;
-		case NO:
-			(void) atomicio(write, remout, "", 1);
-			break;
-		case DISPLAYED:
-			break;
-		}
-	}
-screwup:
-	run_err("protocol error: %s", why);
-	exit(1);
-}
-
-int
-response(void)
-{
-	char ch, *cp, resp, rbuf[2048];
-
-	if (atomicio(read, remin, &resp, sizeof(resp)) != sizeof(resp))
-		lostconn(0);
-
-	cp = rbuf;
-	switch (resp) {
-	case 0:		/* ok */
-		return (0);
-	default:
-		*cp++ = resp;
-		/* FALLTHROUGH */
-	case 1:		/* error, followed by error msg */
-	case 2:		/* fatal error, "" */
-		do {
-			if (atomicio(read, remin, &ch, sizeof(ch)) != sizeof(ch))
-				lostconn(0);
-			*cp++ = ch;
-		} while (cp < &rbuf[sizeof(rbuf) - 1] && ch != '\n');
-
-		if (!iamremote)
-			(void) atomicio(write, STDERR_FILENO, rbuf, cp - rbuf);
-		++errs;
-		if (resp == 1)
-			return (-1);
-		exit(1);
-	}
-	/* NOTREACHED */
-}
-
-void
-usage(void)
-{
-	(void) fprintf(stderr,
-	    "usage: scp [-pqrvBC1246] [-F config] [-S program] [-P port]\n"
-	    "           [-c cipher] [-i identity] [-l limit] [-o option]\n"
-	    "           [[user@]host1:]file1 [...] [[user@]host2:]file2\n");
-	exit(1);
-}
-
-void
-run_err(const char *fmt,...)
-{
-	static FILE *fp;
-	va_list ap;
-
-	++errs;
-	if (fp == NULL && !(fp = fdopen(remout, "w")))
-		return;
-	(void) fprintf(fp, "%c", 0x01);
-	(void) fprintf(fp, "scp: ");
-	va_start(ap, fmt);
-	(void) vfprintf(fp, fmt, ap);
-	va_end(ap);
-	(void) fprintf(fp, "\n");
-	(void) fflush(fp);
-
-	if (!iamremote) {
-		va_start(ap, fmt);
-		vfprintf(stderr, fmt, ap);
-		va_end(ap);
-		fprintf(stderr, "\n");
-	}
-}
-
-void
-verifydir(cp)
-	char *cp;
-{
-	struct stat stb;
-
-	if (!stat(cp, &stb)) {
-		if (S_ISDIR(stb.st_mode))
-			return;
-		errno = ENOTDIR;
-	}
-	run_err("%s: %s", cp, strerror(errno));
-	exit(1);
-}
-
-int
-okname(cp0)
-	char *cp0;
-{
-	int c;
-	char *cp;
-
-	cp = cp0;
-	do {
-		c = (int)*cp;
-		if (c & 0200)
-			goto bad;
-		if (!isalpha(c) && !isdigit(c)) {
-			switch (c) {
-			case '\'':
-			case '"':
-			case '`':
-			case ' ':
-			case '#':
-				goto bad;
-			default:
-				break;
-			}
-		}
-	} while (*++cp);
-	return (1);
-
-bad:	fprintf(stderr, "%s: invalid user name\n", cp0);
-	return (0);
-}
-
-BUF *
-allocbuf(bp, fd, blksize)
-	BUF *bp;
-	int fd, blksize;
-{
-	size_t size;
-#ifdef HAVE_STRUCT_STAT_ST_BLKSIZE
-	struct stat stb;
-
-	if (fstat(fd, &stb) < 0) {
-		run_err("fstat: %s", strerror(errno));
-		return (0);
-	}
-	size = roundup(stb.st_blksize, blksize);
-	if (size == 0)
-		size = blksize;
-#else /* HAVE_STRUCT_STAT_ST_BLKSIZE */
-	size = blksize;
-#endif /* HAVE_STRUCT_STAT_ST_BLKSIZE */
-	if (bp->cnt >= size)
-		return (bp);
-	if (bp->buf == NULL)
-		bp->buf = xmalloc(size);
-	else
-		bp->buf = xrealloc(bp->buf, size);
-	memset(bp->buf, 0, size);
-	bp->cnt = size;
-	return (bp);
-}
-
-void
-lostconn(signo)
-	int signo;
-{
-	if (!iamremote)
-		write(STDERR_FILENO, "lost connection\n", 16);
-	if (signo)
-		_exit(1);
-	else
-		exit(1);
-}
diff --git a/crypto/openssh/scp/Makefile b/crypto/openssh/scp/Makefile
deleted file mode 100644
index c8959bbf6d2d..000000000000
--- a/crypto/openssh/scp/Makefile
+++ /dev/null
@@ -1,15 +0,0 @@
-#	$OpenBSD: Makefile,v 1.13 2001/05/03 23:09:55 mouring Exp $
-
-.PATH:		${.CURDIR}/..
-
-PROG=	scp
-BINOWN=	root
-
-BINMODE?=555
-
-BINDIR=	/usr/bin
-MAN=	scp.1
-
-SRCS=	scp.c misc.c
-
-.include <bsd.prog.mk>
diff --git a/crypto/openssh/servconf.c b/crypto/openssh/servconf.c
deleted file mode 100644
index 2510659ee4b9..000000000000
--- a/crypto/openssh/servconf.c
+++ /dev/null
@@ -1,955 +0,0 @@
-/*
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: servconf.c,v 1.116 2003/02/21 09:05:53 markus Exp $");
-
-#if defined(KRB4)
-#include <krb.h>
-#endif
-#if defined(KRB5)
-#ifdef HEIMDAL
-#include <krb.h>
-#else
-/* Bodge - but then, so is using the kerberos IV KEYFILE to get a Kerberos V
- * keytab */
-#define KEYFILE "/etc/krb5.keytab"
-#endif
-#endif
-#ifdef AFS
-#include <kafs.h>
-#endif
-
-#include "ssh.h"
-#include "log.h"
-#include "servconf.h"
-#include "xmalloc.h"
-#include "compat.h"
-#include "pathnames.h"
-#include "tildexpand.h"
-#include "misc.h"
-#include "cipher.h"
-#include "kex.h"
-#include "mac.h"
-
-static void add_listen_addr(ServerOptions *, char *, u_short);
-static void add_one_listen_addr(ServerOptions *, char *, u_short);
-
-/* AF_UNSPEC or AF_INET or AF_INET6 */
-extern int IPv4or6;
-/* Use of privilege separation or not */
-extern int use_privsep;
-
-/* Initializes the server options to their default values. */
-
-void
-initialize_server_options(ServerOptions *options)
-{
-	memset(options, 0, sizeof(*options));
-
-	/* Portable-specific options */
-	options->pam_authentication_via_kbd_int = -1;
-
-	/* Standard Options */
-	options->num_ports = 0;
-	options->ports_from_cmdline = 0;
-	options->listen_addrs = NULL;
-	options->num_host_key_files = 0;
-	options->pid_file = NULL;
-	options->server_key_bits = -1;
-	options->login_grace_time = -1;
-	options->key_regeneration_time = -1;
-	options->permit_root_login = PERMIT_NOT_SET;
-	options->ignore_rhosts = -1;
-	options->ignore_user_known_hosts = -1;
-	options->print_motd = -1;
-	options->print_lastlog = -1;
-	options->x11_forwarding = -1;
-	options->x11_display_offset = -1;
-	options->x11_use_localhost = -1;
-	options->xauth_location = NULL;
-	options->strict_modes = -1;
-	options->keepalives = -1;
-	options->log_facility = SYSLOG_FACILITY_NOT_SET;
-	options->log_level = SYSLOG_LEVEL_NOT_SET;
-	options->rhosts_authentication = -1;
-	options->rhosts_rsa_authentication = -1;
-	options->hostbased_authentication = -1;
-	options->hostbased_uses_name_from_packet_only = -1;
-	options->rsa_authentication = -1;
-	options->pubkey_authentication = -1;
-#if defined(KRB4) || defined(KRB5)
-	options->kerberos_authentication = -1;
-	options->kerberos_or_local_passwd = -1;
-	options->kerberos_ticket_cleanup = -1;
-#endif
-#if defined(AFS) || defined(KRB5)
-	options->kerberos_tgt_passing = -1;
-#endif
-#ifdef AFS
-	options->afs_token_passing = -1;
-#endif
-	options->password_authentication = -1;
-	options->kbd_interactive_authentication = -1;
-	options->challenge_response_authentication = -1;
-	options->permit_empty_passwd = -1;
-	options->permit_user_env = -1;
-	options->use_login = -1;
-	options->compression = -1;
-	options->allow_tcp_forwarding = -1;
-	options->num_allow_users = 0;
-	options->num_deny_users = 0;
-	options->num_allow_groups = 0;
-	options->num_deny_groups = 0;
-	options->ciphers = NULL;
-	options->macs = NULL;
-	options->protocol = SSH_PROTO_UNKNOWN;
-	options->gateway_ports = -1;
-	options->num_subsystems = 0;
-	options->max_startups_begin = -1;
-	options->max_startups_rate = -1;
-	options->max_startups = -1;
-	options->banner = NULL;
-	options->verify_reverse_mapping = -1;
-	options->client_alive_interval = -1;
-	options->client_alive_count_max = -1;
-	options->authorized_keys_file = NULL;
-	options->authorized_keys_file2 = NULL;
-
-	/* Needs to be accessable in many places */
-	use_privsep = -1;
-}
-
-void
-fill_default_server_options(ServerOptions *options)
-{
-	/* Portable-specific options */
-	if (options->pam_authentication_via_kbd_int == -1)
-		options->pam_authentication_via_kbd_int = 0;
-
-	/* Standard Options */
-	if (options->protocol == SSH_PROTO_UNKNOWN)
-		options->protocol = SSH_PROTO_1|SSH_PROTO_2;
-	if (options->num_host_key_files == 0) {
-		/* fill default hostkeys for protocols */
-		if (options->protocol & SSH_PROTO_1)
-			options->host_key_files[options->num_host_key_files++] =
-			    _PATH_HOST_KEY_FILE;
-		if (options->protocol & SSH_PROTO_2) {
-			options->host_key_files[options->num_host_key_files++] =
-			    _PATH_HOST_RSA_KEY_FILE;
-			options->host_key_files[options->num_host_key_files++] =
-			    _PATH_HOST_DSA_KEY_FILE;
-		}
-	}
-	if (options->num_ports == 0)
-		options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
-	if (options->listen_addrs == NULL)
-		add_listen_addr(options, NULL, 0);
-	if (options->pid_file == NULL)
-		options->pid_file = _PATH_SSH_DAEMON_PID_FILE;
-	if (options->server_key_bits == -1)
-		options->server_key_bits = 768;
-	if (options->login_grace_time == -1)
-		options->login_grace_time = 120;
-	if (options->key_regeneration_time == -1)
-		options->key_regeneration_time = 3600;
-	if (options->permit_root_login == PERMIT_NOT_SET)
-		options->permit_root_login = PERMIT_YES;
-	if (options->ignore_rhosts == -1)
-		options->ignore_rhosts = 1;
-	if (options->ignore_user_known_hosts == -1)
-		options->ignore_user_known_hosts = 0;
-	if (options->print_motd == -1)
-		options->print_motd = 1;
-	if (options->print_lastlog == -1)
-		options->print_lastlog = 1;
-	if (options->x11_forwarding == -1)
-		options->x11_forwarding = 0;
-	if (options->x11_display_offset == -1)
-		options->x11_display_offset = 10;
-	if (options->x11_use_localhost == -1)
-		options->x11_use_localhost = 1;
-	if (options->xauth_location == NULL)
-		options->xauth_location = _PATH_XAUTH;
-	if (options->strict_modes == -1)
-		options->strict_modes = 1;
-	if (options->keepalives == -1)
-		options->keepalives = 1;
-	if (options->log_facility == SYSLOG_FACILITY_NOT_SET)
-		options->log_facility = SYSLOG_FACILITY_AUTH;
-	if (options->log_level == SYSLOG_LEVEL_NOT_SET)
-		options->log_level = SYSLOG_LEVEL_INFO;
-	if (options->rhosts_authentication == -1)
-		options->rhosts_authentication = 0;
-	if (options->rhosts_rsa_authentication == -1)
-		options->rhosts_rsa_authentication = 0;
-	if (options->hostbased_authentication == -1)
-		options->hostbased_authentication = 0;
-	if (options->hostbased_uses_name_from_packet_only == -1)
-		options->hostbased_uses_name_from_packet_only = 0;
-	if (options->rsa_authentication == -1)
-		options->rsa_authentication = 1;
-	if (options->pubkey_authentication == -1)
-		options->pubkey_authentication = 1;
-#if defined(KRB4) || defined(KRB5)
-	if (options->kerberos_authentication == -1)
-		options->kerberos_authentication = 0;
-	if (options->kerberos_or_local_passwd == -1)
-		options->kerberos_or_local_passwd = 1;
-	if (options->kerberos_ticket_cleanup == -1)
-		options->kerberos_ticket_cleanup = 1;
-#endif
-#if defined(AFS) || defined(KRB5)
-	if (options->kerberos_tgt_passing == -1)
-		options->kerberos_tgt_passing = 0;
-#endif
-#ifdef AFS
-	if (options->afs_token_passing == -1)
-		options->afs_token_passing = 0;
-#endif
-	if (options->password_authentication == -1)
-		options->password_authentication = 1;
-	if (options->kbd_interactive_authentication == -1)
-		options->kbd_interactive_authentication = 0;
-	if (options->challenge_response_authentication == -1)
-		options->challenge_response_authentication = 1;
-	if (options->permit_empty_passwd == -1)
-		options->permit_empty_passwd = 0;
-	if (options->permit_user_env == -1)
-		options->permit_user_env = 0;
-	if (options->use_login == -1)
-		options->use_login = 0;
-	if (options->compression == -1)
-		options->compression = 1;
-	if (options->allow_tcp_forwarding == -1)
-		options->allow_tcp_forwarding = 1;
-	if (options->gateway_ports == -1)
-		options->gateway_ports = 0;
-	if (options->max_startups == -1)
-		options->max_startups = 10;
-	if (options->max_startups_rate == -1)
-		options->max_startups_rate = 100;		/* 100% */
-	if (options->max_startups_begin == -1)
-		options->max_startups_begin = options->max_startups;
-	if (options->verify_reverse_mapping == -1)
-		options->verify_reverse_mapping = 0;
-	if (options->client_alive_interval == -1)
-		options->client_alive_interval = 0;
-	if (options->client_alive_count_max == -1)
-		options->client_alive_count_max = 3;
-	if (options->authorized_keys_file2 == NULL) {
-		/* authorized_keys_file2 falls back to authorized_keys_file */
-		if (options->authorized_keys_file != NULL)
-			options->authorized_keys_file2 = options->authorized_keys_file;
-		else
-			options->authorized_keys_file2 = _PATH_SSH_USER_PERMITTED_KEYS2;
-	}
-	if (options->authorized_keys_file == NULL)
-		options->authorized_keys_file = _PATH_SSH_USER_PERMITTED_KEYS;
-
-	/* Turn privilege separation on by default */
-	if (use_privsep == -1)
-		use_privsep = 1;
-
-#ifndef HAVE_MMAP
-	if (use_privsep && options->compression == 1) {
-		error("This platform does not support both privilege "
-		    "separation and compression");
-		error("Compression disabled");
-		options->compression = 0;
-	}
-#endif
-
-}
-
-/* Keyword tokens. */
-typedef enum {
-	sBadOption,		/* == unknown option */
-	/* Portable-specific options */
-	sPAMAuthenticationViaKbdInt,
-	/* Standard Options */
-	sPort, sHostKeyFile, sServerKeyBits, sLoginGraceTime, sKeyRegenerationTime,
-	sPermitRootLogin, sLogFacility, sLogLevel,
-	sRhostsAuthentication, sRhostsRSAAuthentication, sRSAAuthentication,
-#if defined(KRB4) || defined(KRB5)
-	sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
-#endif
-#if defined(AFS) || defined(KRB5)
-	sKerberosTgtPassing,
-#endif
-#ifdef AFS
-	sAFSTokenPassing,
-#endif
-	sChallengeResponseAuthentication,
-	sPasswordAuthentication, sKbdInteractiveAuthentication, sListenAddress,
-	sPrintMotd, sPrintLastLog, sIgnoreRhosts,
-	sX11Forwarding, sX11DisplayOffset, sX11UseLocalhost,
-	sStrictModes, sEmptyPasswd, sKeepAlives,
-	sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression,
-	sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
-	sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
-	sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem, sMaxStartups,
-	sBanner, sVerifyReverseMapping, sHostbasedAuthentication,
-	sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
-	sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2,
-	sUsePrivilegeSeparation,
-	sDeprecated
-} ServerOpCodes;
-
-/* Textual representation of the tokens. */
-static struct {
-	const char *name;
-	ServerOpCodes opcode;
-} keywords[] = {
-	/* Portable-specific options */
-	{ "PAMAuthenticationViaKbdInt", sPAMAuthenticationViaKbdInt },
-	/* Standard Options */
-	{ "port", sPort },
-	{ "hostkey", sHostKeyFile },
-	{ "hostdsakey", sHostKeyFile },					/* alias */
-	{ "pidfile", sPidFile },
-	{ "serverkeybits", sServerKeyBits },
-	{ "logingracetime", sLoginGraceTime },
-	{ "keyregenerationinterval", sKeyRegenerationTime },
-	{ "permitrootlogin", sPermitRootLogin },
-	{ "syslogfacility", sLogFacility },
-	{ "loglevel", sLogLevel },
-	{ "rhostsauthentication", sRhostsAuthentication },
-	{ "rhostsrsaauthentication", sRhostsRSAAuthentication },
-	{ "hostbasedauthentication", sHostbasedAuthentication },
-	{ "hostbasedusesnamefrompacketonly", sHostbasedUsesNameFromPacketOnly },
-	{ "rsaauthentication", sRSAAuthentication },
-	{ "pubkeyauthentication", sPubkeyAuthentication },
-	{ "dsaauthentication", sPubkeyAuthentication },			/* alias */
-#if defined(KRB4) || defined(KRB5)
-	{ "kerberosauthentication", sKerberosAuthentication },
-	{ "kerberosorlocalpasswd", sKerberosOrLocalPasswd },
-	{ "kerberosticketcleanup", sKerberosTicketCleanup },
-#endif
-#if defined(AFS) || defined(KRB5)
-	{ "kerberostgtpassing", sKerberosTgtPassing },
-#endif
-#ifdef AFS
-	{ "afstokenpassing", sAFSTokenPassing },
-#endif
-	{ "passwordauthentication", sPasswordAuthentication },
-	{ "kbdinteractiveauthentication", sKbdInteractiveAuthentication },
-	{ "challengeresponseauthentication", sChallengeResponseAuthentication },
-	{ "skeyauthentication", sChallengeResponseAuthentication }, /* alias */
-	{ "checkmail", sDeprecated },
-	{ "listenaddress", sListenAddress },
-	{ "printmotd", sPrintMotd },
-	{ "printlastlog", sPrintLastLog },
-	{ "ignorerhosts", sIgnoreRhosts },
-	{ "ignoreuserknownhosts", sIgnoreUserKnownHosts },
-	{ "x11forwarding", sX11Forwarding },
-	{ "x11displayoffset", sX11DisplayOffset },
-	{ "x11uselocalhost", sX11UseLocalhost },
-	{ "xauthlocation", sXAuthLocation },
-	{ "strictmodes", sStrictModes },
-	{ "permitemptypasswords", sEmptyPasswd },
-	{ "permituserenvironment", sPermitUserEnvironment },
-	{ "uselogin", sUseLogin },
-	{ "compression", sCompression },
-	{ "keepalive", sKeepAlives },
-	{ "allowtcpforwarding", sAllowTcpForwarding },
-	{ "allowusers", sAllowUsers },
-	{ "denyusers", sDenyUsers },
-	{ "allowgroups", sAllowGroups },
-	{ "denygroups", sDenyGroups },
-	{ "ciphers", sCiphers },
-	{ "macs", sMacs },
-	{ "protocol", sProtocol },
-	{ "gatewayports", sGatewayPorts },
-	{ "subsystem", sSubsystem },
-	{ "maxstartups", sMaxStartups },
-	{ "banner", sBanner },
-	{ "verifyreversemapping", sVerifyReverseMapping },
-	{ "reversemappingcheck", sVerifyReverseMapping },
-	{ "clientaliveinterval", sClientAliveInterval },
-	{ "clientalivecountmax", sClientAliveCountMax },
-	{ "authorizedkeysfile", sAuthorizedKeysFile },
-	{ "authorizedkeysfile2", sAuthorizedKeysFile2 },
-	{ "useprivilegeseparation", sUsePrivilegeSeparation},
-	{ NULL, sBadOption }
-};
-
-/*
- * Returns the number of the token pointed to by cp or sBadOption.
- */
-
-static ServerOpCodes
-parse_token(const char *cp, const char *filename,
-	    int linenum)
-{
-	u_int i;
-
-	for (i = 0; keywords[i].name; i++)
-		if (strcasecmp(cp, keywords[i].name) == 0)
-			return keywords[i].opcode;
-
-	error("%s: line %d: Bad configuration option: %s",
-	    filename, linenum, cp);
-	return sBadOption;
-}
-
-static void
-add_listen_addr(ServerOptions *options, char *addr, u_short port)
-{
-	int i;
-
-	if (options->num_ports == 0)
-		options->ports[options->num_ports++] = SSH_DEFAULT_PORT;
-	if (port == 0)
-		for (i = 0; i < options->num_ports; i++)
-			add_one_listen_addr(options, addr, options->ports[i]);
-	else
-		add_one_listen_addr(options, addr, port);
-}
-
-static void
-add_one_listen_addr(ServerOptions *options, char *addr, u_short port)
-{
-	struct addrinfo hints, *ai, *aitop;
-	char strport[NI_MAXSERV];
-	int gaierr;
-
-	memset(&hints, 0, sizeof(hints));
-	hints.ai_family = IPv4or6;
-	hints.ai_socktype = SOCK_STREAM;
-	hints.ai_flags = (addr == NULL) ? AI_PASSIVE : 0;
-	snprintf(strport, sizeof strport, "%u", port);
-	if ((gaierr = getaddrinfo(addr, strport, &hints, &aitop)) != 0)
-		fatal("bad addr or host: %s (%s)",
-		    addr ? addr : "<NULL>",
-		    gai_strerror(gaierr));
-	for (ai = aitop; ai->ai_next; ai = ai->ai_next)
-		;
-	ai->ai_next = options->listen_addrs;
-	options->listen_addrs = aitop;
-}
-
-int
-process_server_config_line(ServerOptions *options, char *line,
-    const char *filename, int linenum)
-{
-	char *cp, **charptr, *arg, *p;
-	int *intptr, value, i, n;
-	ServerOpCodes opcode;
-
-	cp = line;
-	arg = strdelim(&cp);
-	/* Ignore leading whitespace */
-	if (*arg == '\0')
-		arg = strdelim(&cp);
-	if (!arg || !*arg || *arg == '#')
-		return 0;
-	intptr = NULL;
-	charptr = NULL;
-	opcode = parse_token(arg, filename, linenum);
-	switch (opcode) {
-	/* Portable-specific options */
-	case sPAMAuthenticationViaKbdInt:
-		intptr = &options->pam_authentication_via_kbd_int;
-		goto parse_flag;
-
-	/* Standard Options */
-	case sBadOption:
-		return -1;
-	case sPort:
-		/* ignore ports from configfile if cmdline specifies ports */
-		if (options->ports_from_cmdline)
-			return 0;
-		if (options->listen_addrs != NULL)
-			fatal("%s line %d: ports must be specified before "
-			    "ListenAddress.", filename, linenum);
-		if (options->num_ports >= MAX_PORTS)
-			fatal("%s line %d: too many ports.",
-			    filename, linenum);
-		arg = strdelim(&cp);
-		if (!arg || *arg == '\0')
-			fatal("%s line %d: missing port number.",
-			    filename, linenum);
-		options->ports[options->num_ports++] = a2port(arg);
-		if (options->ports[options->num_ports-1] == 0)
-			fatal("%s line %d: Badly formatted port number.",
-			    filename, linenum);
-		break;
-
-	case sServerKeyBits:
-		intptr = &options->server_key_bits;
-parse_int:
-		arg = strdelim(&cp);
-		if (!arg || *arg == '\0')
-			fatal("%s line %d: missing integer value.",
-			    filename, linenum);
-		value = atoi(arg);
-		if (*intptr == -1)
-			*intptr = value;
-		break;
-
-	case sLoginGraceTime:
-		intptr = &options->login_grace_time;
-parse_time:
-		arg = strdelim(&cp);
-		if (!arg || *arg == '\0')
-			fatal("%s line %d: missing time value.",
-			    filename, linenum);
-		if ((value = convtime(arg)) == -1)
-			fatal("%s line %d: invalid time value.",
-			    filename, linenum);
-		if (*intptr == -1)
-			*intptr = value;
-		break;
-
-	case sKeyRegenerationTime:
-		intptr = &options->key_regeneration_time;
-		goto parse_time;
-
-	case sListenAddress:
-		arg = strdelim(&cp);
-		if (!arg || *arg == '\0' || strncmp(arg, "[]", 2) == 0)
-			fatal("%s line %d: missing inet addr.",
-			    filename, linenum);
-		if (*arg == '[') {
-			if ((p = strchr(arg, ']')) == NULL)
-				fatal("%s line %d: bad ipv6 inet addr usage.",
-				    filename, linenum);
-			arg++;
-			memmove(p, p+1, strlen(p+1)+1);
-		} else if (((p = strchr(arg, ':')) == NULL) ||
-			    (strchr(p+1, ':') != NULL)) {
-			add_listen_addr(options, arg, 0);
-			break;
-		}
-		if (*p == ':') {
-			u_short port;
-
-			p++;
-			if (*p == '\0')
-				fatal("%s line %d: bad inet addr:port usage.",
-				    filename, linenum);
-			else {
-				*(p-1) = '\0';
-				if ((port = a2port(p)) == 0)
-					fatal("%s line %d: bad port number.",
-					    filename, linenum);
-				add_listen_addr(options, arg, port);
-			}
-		} else if (*p == '\0')
-			add_listen_addr(options, arg, 0);
-		else
-			fatal("%s line %d: bad inet addr usage.",
-			    filename, linenum);
-		break;
-
-	case sHostKeyFile:
-		intptr = &options->num_host_key_files;
-		if (*intptr >= MAX_HOSTKEYS)
-			fatal("%s line %d: too many host keys specified (max %d).",
-			    filename, linenum, MAX_HOSTKEYS);
-		charptr = &options->host_key_files[*intptr];
-parse_filename:
-		arg = strdelim(&cp);
-		if (!arg || *arg == '\0')
-			fatal("%s line %d: missing file name.",
-			    filename, linenum);
-		if (*charptr == NULL) {
-			*charptr = tilde_expand_filename(arg, getuid());
-			/* increase optional counter */
-			if (intptr != NULL)
-				*intptr = *intptr + 1;
-		}
-		break;
-
-	case sPidFile:
-		charptr = &options->pid_file;
-		goto parse_filename;
-
-	case sPermitRootLogin:
-		intptr = &options->permit_root_login;
-		arg = strdelim(&cp);
-		if (!arg || *arg == '\0')
-			fatal("%s line %d: missing yes/"
-			    "without-password/forced-commands-only/no "
-			    "argument.", filename, linenum);
-		value = 0;	/* silence compiler */
-		if (strcmp(arg, "without-password") == 0)
-			value = PERMIT_NO_PASSWD;
-		else if (strcmp(arg, "forced-commands-only") == 0)
-			value = PERMIT_FORCED_ONLY;
-		else if (strcmp(arg, "yes") == 0)
-			value = PERMIT_YES;
-		else if (strcmp(arg, "no") == 0)
-			value = PERMIT_NO;
-		else
-			fatal("%s line %d: Bad yes/"
-			    "without-password/forced-commands-only/no "
-			    "argument: %s", filename, linenum, arg);
-		if (*intptr == -1)
-			*intptr = value;
-		break;
-
-	case sIgnoreRhosts:
-		intptr = &options->ignore_rhosts;
-parse_flag:
-		arg = strdelim(&cp);
-		if (!arg || *arg == '\0')
-			fatal("%s line %d: missing yes/no argument.",
-			    filename, linenum);
-		value = 0;	/* silence compiler */
-		if (strcmp(arg, "yes") == 0)
-			value = 1;
-		else if (strcmp(arg, "no") == 0)
-			value = 0;
-		else
-			fatal("%s line %d: Bad yes/no argument: %s",
-				filename, linenum, arg);
-		if (*intptr == -1)
-			*intptr = value;
-		break;
-
-	case sIgnoreUserKnownHosts:
-		intptr = &options->ignore_user_known_hosts;
-		goto parse_flag;
-
-	case sRhostsAuthentication:
-		intptr = &options->rhosts_authentication;
-		goto parse_flag;
-
-	case sRhostsRSAAuthentication:
-		intptr = &options->rhosts_rsa_authentication;
-		goto parse_flag;
-
-	case sHostbasedAuthentication:
-		intptr = &options->hostbased_authentication;
-		goto parse_flag;
-
-	case sHostbasedUsesNameFromPacketOnly:
-		intptr = &options->hostbased_uses_name_from_packet_only;
-		goto parse_flag;
-
-	case sRSAAuthentication:
-		intptr = &options->rsa_authentication;
-		goto parse_flag;
-
-	case sPubkeyAuthentication:
-		intptr = &options->pubkey_authentication;
-		goto parse_flag;
-#if defined(KRB4) || defined(KRB5)
-	case sKerberosAuthentication:
-		intptr = &options->kerberos_authentication;
-		goto parse_flag;
-
-	case sKerberosOrLocalPasswd:
-		intptr = &options->kerberos_or_local_passwd;
-		goto parse_flag;
-
-	case sKerberosTicketCleanup:
-		intptr = &options->kerberos_ticket_cleanup;
-		goto parse_flag;
-#endif
-#if defined(AFS) || defined(KRB5)
-	case sKerberosTgtPassing:
-		intptr = &options->kerberos_tgt_passing;
-		goto parse_flag;
-#endif
-#ifdef AFS
-	case sAFSTokenPassing:
-		intptr = &options->afs_token_passing;
-		goto parse_flag;
-#endif
-
-	case sPasswordAuthentication:
-		intptr = &options->password_authentication;
-		goto parse_flag;
-
-	case sKbdInteractiveAuthentication:
-		intptr = &options->kbd_interactive_authentication;
-		goto parse_flag;
-
-	case sChallengeResponseAuthentication:
-		intptr = &options->challenge_response_authentication;
-		goto parse_flag;
-
-	case sPrintMotd:
-		intptr = &options->print_motd;
-		goto parse_flag;
-
-	case sPrintLastLog:
-		intptr = &options->print_lastlog;
-		goto parse_flag;
-
-	case sX11Forwarding:
-		intptr = &options->x11_forwarding;
-		goto parse_flag;
-
-	case sX11DisplayOffset:
-		intptr = &options->x11_display_offset;
-		goto parse_int;
-
-	case sX11UseLocalhost:
-		intptr = &options->x11_use_localhost;
-		goto parse_flag;
-
-	case sXAuthLocation:
-		charptr = &options->xauth_location;
-		goto parse_filename;
-
-	case sStrictModes:
-		intptr = &options->strict_modes;
-		goto parse_flag;
-
-	case sKeepAlives:
-		intptr = &options->keepalives;
-		goto parse_flag;
-
-	case sEmptyPasswd:
-		intptr = &options->permit_empty_passwd;
-		goto parse_flag;
-
-	case sPermitUserEnvironment:
-		intptr = &options->permit_user_env;
-		goto parse_flag;
-
-	case sUseLogin:
-		intptr = &options->use_login;
-		goto parse_flag;
-
-	case sCompression:
-		intptr = &options->compression;
-		goto parse_flag;
-
-	case sGatewayPorts:
-		intptr = &options->gateway_ports;
-		goto parse_flag;
-
-	case sVerifyReverseMapping:
-		intptr = &options->verify_reverse_mapping;
-		goto parse_flag;
-
-	case sLogFacility:
-		intptr = (int *) &options->log_facility;
-		arg = strdelim(&cp);
-		value = log_facility_number(arg);
-		if (value == SYSLOG_FACILITY_NOT_SET)
-			fatal("%.200s line %d: unsupported log facility '%s'",
-			    filename, linenum, arg ? arg : "<NONE>");
-		if (*intptr == -1)
-			*intptr = (SyslogFacility) value;
-		break;
-
-	case sLogLevel:
-		intptr = (int *) &options->log_level;
-		arg = strdelim(&cp);
-		value = log_level_number(arg);
-		if (value == SYSLOG_LEVEL_NOT_SET)
-			fatal("%.200s line %d: unsupported log level '%s'",
-			    filename, linenum, arg ? arg : "<NONE>");
-		if (*intptr == -1)
-			*intptr = (LogLevel) value;
-		break;
-
-	case sAllowTcpForwarding:
-		intptr = &options->allow_tcp_forwarding;
-		goto parse_flag;
-
-	case sUsePrivilegeSeparation:
-		intptr = &use_privsep;
-		goto parse_flag;
-
-	case sAllowUsers:
-		while ((arg = strdelim(&cp)) && *arg != '\0') {
-			if (options->num_allow_users >= MAX_ALLOW_USERS)
-				fatal("%s line %d: too many allow users.",
-				    filename, linenum);
-			options->allow_users[options->num_allow_users++] =
-			    xstrdup(arg);
-		}
-		break;
-
-	case sDenyUsers:
-		while ((arg = strdelim(&cp)) && *arg != '\0') {
-			if (options->num_deny_users >= MAX_DENY_USERS)
-				fatal( "%s line %d: too many deny users.",
-				    filename, linenum);
-			options->deny_users[options->num_deny_users++] =
-			    xstrdup(arg);
-		}
-		break;
-
-	case sAllowGroups:
-		while ((arg = strdelim(&cp)) && *arg != '\0') {
-			if (options->num_allow_groups >= MAX_ALLOW_GROUPS)
-				fatal("%s line %d: too many allow groups.",
-				    filename, linenum);
-			options->allow_groups[options->num_allow_groups++] =
-			    xstrdup(arg);
-		}
-		break;
-
-	case sDenyGroups:
-		while ((arg = strdelim(&cp)) && *arg != '\0') {
-			if (options->num_deny_groups >= MAX_DENY_GROUPS)
-				fatal("%s line %d: too many deny groups.",
-				    filename, linenum);
-			options->deny_groups[options->num_deny_groups++] = xstrdup(arg);
-		}
-		break;
-
-	case sCiphers:
-		arg = strdelim(&cp);
-		if (!arg || *arg == '\0')
-			fatal("%s line %d: Missing argument.", filename, linenum);
-		if (!ciphers_valid(arg))
-			fatal("%s line %d: Bad SSH2 cipher spec '%s'.",
-			    filename, linenum, arg ? arg : "<NONE>");
-		if (options->ciphers == NULL)
-			options->ciphers = xstrdup(arg);
-		break;
-
-	case sMacs:
-		arg = strdelim(&cp);
-		if (!arg || *arg == '\0')
-			fatal("%s line %d: Missing argument.", filename, linenum);
-		if (!mac_valid(arg))
-			fatal("%s line %d: Bad SSH2 mac spec '%s'.",
-			    filename, linenum, arg ? arg : "<NONE>");
-		if (options->macs == NULL)
-			options->macs = xstrdup(arg);
-		break;
-
-	case sProtocol:
-		intptr = &options->protocol;
-		arg = strdelim(&cp);
-		if (!arg || *arg == '\0')
-			fatal("%s line %d: Missing argument.", filename, linenum);
-		value = proto_spec(arg);
-		if (value == SSH_PROTO_UNKNOWN)
-			fatal("%s line %d: Bad protocol spec '%s'.",
-			    filename, linenum, arg ? arg : "<NONE>");
-		if (*intptr == SSH_PROTO_UNKNOWN)
-			*intptr = value;
-		break;
-
-	case sSubsystem:
-		if (options->num_subsystems >= MAX_SUBSYSTEMS) {
-			fatal("%s line %d: too many subsystems defined.",
-			    filename, linenum);
-		}
-		arg = strdelim(&cp);
-		if (!arg || *arg == '\0')
-			fatal("%s line %d: Missing subsystem name.",
-			    filename, linenum);
-		for (i = 0; i < options->num_subsystems; i++)
-			if (strcmp(arg, options->subsystem_name[i]) == 0)
-				fatal("%s line %d: Subsystem '%s' already defined.",
-				    filename, linenum, arg);
-		options->subsystem_name[options->num_subsystems] = xstrdup(arg);
-		arg = strdelim(&cp);
-		if (!arg || *arg == '\0')
-			fatal("%s line %d: Missing subsystem command.",
-			    filename, linenum);
-		options->subsystem_command[options->num_subsystems] = xstrdup(arg);
-		options->num_subsystems++;
-		break;
-
-	case sMaxStartups:
-		arg = strdelim(&cp);
-		if (!arg || *arg == '\0')
-			fatal("%s line %d: Missing MaxStartups spec.",
-			    filename, linenum);
-		if ((n = sscanf(arg, "%d:%d:%d",
-		    &options->max_startups_begin,
-		    &options->max_startups_rate,
-		    &options->max_startups)) == 3) {
-			if (options->max_startups_begin >
-			    options->max_startups ||
-			    options->max_startups_rate > 100 ||
-			    options->max_startups_rate < 1)
-				fatal("%s line %d: Illegal MaxStartups spec.",
-				    filename, linenum);
-		} else if (n != 1)
-			fatal("%s line %d: Illegal MaxStartups spec.",
-			    filename, linenum);
-		else
-			options->max_startups = options->max_startups_begin;
-		break;
-
-	case sBanner:
-		charptr = &options->banner;
-		goto parse_filename;
-	/*
-	 * These options can contain %X options expanded at
-	 * connect time, so that you can specify paths like:
-	 *
-	 * AuthorizedKeysFile	/etc/ssh_keys/%u
-	 */
-	case sAuthorizedKeysFile:
-	case sAuthorizedKeysFile2:
-		charptr = (opcode == sAuthorizedKeysFile ) ?
-		    &options->authorized_keys_file :
-		    &options->authorized_keys_file2;
-		goto parse_filename;
-
-	case sClientAliveInterval:
-		intptr = &options->client_alive_interval;
-		goto parse_time;
-
-	case sClientAliveCountMax:
-		intptr = &options->client_alive_count_max;
-		goto parse_int;
-
-	case sDeprecated:
-		log("%s line %d: Deprecated option %s",
-		    filename, linenum, arg);
-		while (arg)
-		    arg = strdelim(&cp);
-		break;
-
-	default:
-		fatal("%s line %d: Missing handler for opcode %s (%d)",
-		    filename, linenum, arg, opcode);
-	}
-	if ((arg = strdelim(&cp)) != NULL && *arg != '\0')
-		fatal("%s line %d: garbage at end of line; \"%.200s\".",
-		    filename, linenum, arg);
-	return 0;
-}
-
-/* Reads the server configuration file. */
-
-void
-read_server_config(ServerOptions *options, const char *filename)
-{
-	int linenum, bad_options = 0;
-	char line[1024];
-	FILE *f;
-
-	debug2("read_server_config: filename %s", filename);
-	f = fopen(filename, "r");
-	if (!f) {
-		perror(filename);
-		exit(1);
-	}
-	linenum = 0;
-	while (fgets(line, sizeof(line), f)) {
-		/* Update line number counter. */
-		linenum++;
-		if (process_server_config_line(options, line, filename, linenum) != 0)
-			bad_options++;
-	}
-	fclose(f);
-	if (bad_options > 0)
-		fatal("%s: terminating, %d bad configuration options",
-		    filename, bad_options);
-}
diff --git a/crypto/openssh/servconf.h b/crypto/openssh/servconf.h
deleted file mode 100644
index 024987dd6983..000000000000
--- a/crypto/openssh/servconf.h
+++ /dev/null
@@ -1,143 +0,0 @@
-/*	$OpenBSD: servconf.h,v 1.59 2002/07/30 17:03:55 markus Exp $	*/
-
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * Definitions for server configuration data and for the functions reading it.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#ifndef SERVCONF_H
-#define SERVCONF_H
-
-#define MAX_PORTS		256	/* Max # ports. */
-
-#define MAX_ALLOW_USERS		256	/* Max # users on allow list. */
-#define MAX_DENY_USERS		256	/* Max # users on deny list. */
-#define MAX_ALLOW_GROUPS	256	/* Max # groups on allow list. */
-#define MAX_DENY_GROUPS		256	/* Max # groups on deny list. */
-#define MAX_SUBSYSTEMS		256	/* Max # subsystems. */
-#define MAX_HOSTKEYS		256	/* Max # hostkeys. */
-
-/* permit_root_login */
-#define	PERMIT_NOT_SET		-1
-#define	PERMIT_NO		0
-#define	PERMIT_FORCED_ONLY	1
-#define	PERMIT_NO_PASSWD	2
-#define	PERMIT_YES		3
-
-
-typedef struct {
-	u_int num_ports;
-	u_int ports_from_cmdline;
-	u_short ports[MAX_PORTS];	/* Port number to listen on. */
-	char   *listen_addr;		/* Address on which the server listens. */
-	struct addrinfo *listen_addrs;	/* Addresses on which the server listens. */
-	char   *host_key_files[MAX_HOSTKEYS];	/* Files containing host keys. */
-	int     num_host_key_files;     /* Number of files for host keys. */
-	char   *pid_file;	/* Where to put our pid */
-	int     server_key_bits;/* Size of the server key. */
-	int     login_grace_time;	/* Disconnect if no auth in this time
-					 * (sec). */
-	int     key_regeneration_time;	/* Server key lifetime (seconds). */
-	int     permit_root_login;	/* PERMIT_*, see above */
-	int     ignore_rhosts;	/* Ignore .rhosts and .shosts. */
-	int     ignore_user_known_hosts;	/* Ignore ~/.ssh/known_hosts
-						 * for RhostsRsaAuth */
-	int     print_motd;	/* If true, print /etc/motd. */
-	int	print_lastlog;	/* If true, print lastlog */
-	int     x11_forwarding;	/* If true, permit inet (spoofing) X11 fwd. */
-	int     x11_display_offset;	/* What DISPLAY number to start
-					 * searching at */
-	int     x11_use_localhost;	/* If true, use localhost for fake X11 server. */
-	char   *xauth_location;	/* Location of xauth program */
-	int     strict_modes;	/* If true, require string home dir modes. */
-	int     keepalives;	/* If true, set SO_KEEPALIVE. */
-	char   *ciphers;	/* Supported SSH2 ciphers. */
-	char   *macs;		/* Supported SSH2 macs. */
-	int	protocol;	/* Supported protocol versions. */
-	int     gateway_ports;	/* If true, allow remote connects to forwarded ports. */
-	SyslogFacility log_facility;	/* Facility for system logging. */
-	LogLevel log_level;	/* Level for system logging. */
-	int     rhosts_authentication;	/* If true, permit rhosts
-					 * authentication. */
-	int     rhosts_rsa_authentication;	/* If true, permit rhosts RSA
-						 * authentication. */
-	int     hostbased_authentication;	/* If true, permit ssh2 hostbased auth */
-	int     hostbased_uses_name_from_packet_only; /* experimental */
-	int     rsa_authentication;	/* If true, permit RSA authentication. */
-	int     pubkey_authentication;	/* If true, permit ssh2 pubkey authentication. */
-#if defined(KRB4) || defined(KRB5)
-	int     kerberos_authentication;	/* If true, permit Kerberos
-						 * authentication. */
-	int     kerberos_or_local_passwd;	/* If true, permit kerberos
-						 * and any other password
-						 * authentication mechanism,
-						 * such as SecurID or
-						 * /etc/passwd */
-	int     kerberos_ticket_cleanup;	/* If true, destroy ticket
-						 * file on logout. */
-#endif
-#if defined(AFS) || defined(KRB5)
-	int     kerberos_tgt_passing;	/* If true, permit Kerberos TGT
-					 * passing. */
-#endif
-#ifdef AFS
-	int     afs_token_passing;	/* If true, permit AFS token passing. */
-#endif
-	int     password_authentication;	/* If true, permit password
-						 * authentication. */
-	int     kbd_interactive_authentication;	/* If true, permit */
-	int     challenge_response_authentication;
-	int     permit_empty_passwd;	/* If false, do not permit empty
-					 * passwords. */
-	int     permit_user_env;	/* If true, read ~/.ssh/environment */
-	int     use_login;	/* If true, login(1) is used */
-	int     compression;	/* If true, compression is allowed */
-	int	allow_tcp_forwarding;
-	u_int num_allow_users;
-	char   *allow_users[MAX_ALLOW_USERS];
-	u_int num_deny_users;
-	char   *deny_users[MAX_DENY_USERS];
-	u_int num_allow_groups;
-	char   *allow_groups[MAX_ALLOW_GROUPS];
-	u_int num_deny_groups;
-	char   *deny_groups[MAX_DENY_GROUPS];
-
-	u_int num_subsystems;
-	char   *subsystem_name[MAX_SUBSYSTEMS];
-	char   *subsystem_command[MAX_SUBSYSTEMS];
-
-	int	max_startups_begin;
-	int	max_startups_rate;
-	int	max_startups;
-	char   *banner;			/* SSH-2 banner message */
-	int	verify_reverse_mapping;	/* cross-check ip and dns */
-	int	client_alive_interval;	/*
-					 * poke the client this often to
-					 * see if it's still there
-					 */
-	int	client_alive_count_max;	/*
-					 * If the client is unresponsive
-					 * for this many intervals above,
-					 * disconnect the session
-					 */
-
-	char   *authorized_keys_file;	/* File containing public keys */
-	char   *authorized_keys_file2;
-	int	pam_authentication_via_kbd_int;
-}       ServerOptions;
-
-void	 initialize_server_options(ServerOptions *);
-void	 read_server_config(ServerOptions *, const char *);
-void	 fill_default_server_options(ServerOptions *);
-int	 process_server_config_line(ServerOptions *, char *, const char *, int);
-
-
-#endif				/* SERVCONF_H */
diff --git a/crypto/openssh/serverloop.c b/crypto/openssh/serverloop.c
deleted file mode 100644
index f4df9cccb015..000000000000
--- a/crypto/openssh/serverloop.c
+++ /dev/null
@@ -1,1083 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * Server main loop for handling the interactive session.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- *
- * SSH2 support by Markus Friedl.
- * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: serverloop.c,v 1.106 2003/04/01 10:22:21 markus Exp $");
-
-#include "xmalloc.h"
-#include "packet.h"
-#include "buffer.h"
-#include "log.h"
-#include "servconf.h"
-#include "canohost.h"
-#include "sshpty.h"
-#include "channels.h"
-#include "compat.h"
-#include "ssh1.h"
-#include "ssh2.h"
-#include "auth.h"
-#include "session.h"
-#include "dispatch.h"
-#include "auth-options.h"
-#include "serverloop.h"
-#include "misc.h"
-#include "kex.h"
-
-extern ServerOptions options;
-
-/* XXX */
-extern Kex *xxx_kex;
-static Authctxt *xxx_authctxt;
-
-static Buffer stdin_buffer;	/* Buffer for stdin data. */
-static Buffer stdout_buffer;	/* Buffer for stdout data. */
-static Buffer stderr_buffer;	/* Buffer for stderr data. */
-static int fdin;		/* Descriptor for stdin (for writing) */
-static int fdout;		/* Descriptor for stdout (for reading);
-				   May be same number as fdin. */
-static int fderr;		/* Descriptor for stderr.  May be -1. */
-static long stdin_bytes = 0;	/* Number of bytes written to stdin. */
-static long stdout_bytes = 0;	/* Number of stdout bytes sent to client. */
-static long stderr_bytes = 0;	/* Number of stderr bytes sent to client. */
-static long fdout_bytes = 0;	/* Number of stdout bytes read from program. */
-static int stdin_eof = 0;	/* EOF message received from client. */
-static int fdout_eof = 0;	/* EOF encountered reading from fdout. */
-static int fderr_eof = 0;	/* EOF encountered readung from fderr. */
-static int fdin_is_tty = 0;	/* fdin points to a tty. */
-static int connection_in;	/* Connection to client (input). */
-static int connection_out;	/* Connection to client (output). */
-static int connection_closed = 0;	/* Connection to client closed. */
-static u_int buffer_high;	/* "Soft" max buffer size. */
-static int client_alive_timeouts = 0;
-
-/*
- * This SIGCHLD kludge is used to detect when the child exits.  The server
- * will exit after that, as soon as forwarded connections have terminated.
- */
-
-static volatile sig_atomic_t child_terminated = 0;	/* The child has terminated. */
-
-/* prototypes */
-static void server_init_dispatch(void);
-
-/*
- * we write to this pipe if a SIGCHLD is caught in order to avoid
- * the race between select() and child_terminated
- */
-static int notify_pipe[2];
-static void
-notify_setup(void)
-{
-	if (pipe(notify_pipe) < 0) {
-		error("pipe(notify_pipe) failed %s", strerror(errno));
-	} else if ((fcntl(notify_pipe[0], F_SETFD, 1) == -1) ||
-	    (fcntl(notify_pipe[1], F_SETFD, 1) == -1)) {
-		error("fcntl(notify_pipe, F_SETFD) failed %s", strerror(errno));
-		close(notify_pipe[0]);
-		close(notify_pipe[1]);
-	} else {
-		set_nonblock(notify_pipe[0]);
-		set_nonblock(notify_pipe[1]);
-		return;
-	}
-	notify_pipe[0] = -1;	/* read end */
-	notify_pipe[1] = -1;	/* write end */
-}
-static void
-notify_parent(void)
-{
-	if (notify_pipe[1] != -1)
-		write(notify_pipe[1], "", 1);
-}
-static void
-notify_prepare(fd_set *readset)
-{
-	if (notify_pipe[0] != -1)
-		FD_SET(notify_pipe[0], readset);
-}
-static void
-notify_done(fd_set *readset)
-{
-	char c;
-
-	if (notify_pipe[0] != -1 && FD_ISSET(notify_pipe[0], readset))
-		while (read(notify_pipe[0], &c, 1) != -1)
-			debug2("notify_done: reading");
-}
-
-static void
-sigchld_handler(int sig)
-{
-	int save_errno = errno;
-	debug("Received SIGCHLD.");
-	child_terminated = 1;
-#ifndef _UNICOS
-	mysignal(SIGCHLD, sigchld_handler);
-#endif
-	notify_parent();
-	errno = save_errno;
-}
-
-/*
- * Make packets from buffered stderr data, and buffer it for sending
- * to the client.
- */
-static void
-make_packets_from_stderr_data(void)
-{
-	int len;
-
-	/* Send buffered stderr data to the client. */
-	while (buffer_len(&stderr_buffer) > 0 &&
-	    packet_not_very_much_data_to_write()) {
-		len = buffer_len(&stderr_buffer);
-		if (packet_is_interactive()) {
-			if (len > 512)
-				len = 512;
-		} else {
-			/* Keep the packets at reasonable size. */
-			if (len > packet_get_maxsize())
-				len = packet_get_maxsize();
-		}
-		packet_start(SSH_SMSG_STDERR_DATA);
-		packet_put_string(buffer_ptr(&stderr_buffer), len);
-		packet_send();
-		buffer_consume(&stderr_buffer, len);
-		stderr_bytes += len;
-	}
-}
-
-/*
- * Make packets from buffered stdout data, and buffer it for sending to the
- * client.
- */
-static void
-make_packets_from_stdout_data(void)
-{
-	int len;
-
-	/* Send buffered stdout data to the client. */
-	while (buffer_len(&stdout_buffer) > 0 &&
-	    packet_not_very_much_data_to_write()) {
-		len = buffer_len(&stdout_buffer);
-		if (packet_is_interactive()) {
-			if (len > 512)
-				len = 512;
-		} else {
-			/* Keep the packets at reasonable size. */
-			if (len > packet_get_maxsize())
-				len = packet_get_maxsize();
-		}
-		packet_start(SSH_SMSG_STDOUT_DATA);
-		packet_put_string(buffer_ptr(&stdout_buffer), len);
-		packet_send();
-		buffer_consume(&stdout_buffer, len);
-		stdout_bytes += len;
-	}
-}
-
-static void
-client_alive_check(void)
-{
-	static int had_channel = 0;
-	int id;
-
-	id = channel_find_open();
-	if (id == -1) {
-		if (!had_channel)
-			return;
-		packet_disconnect("No open channels after timeout!");
-	}
-	had_channel = 1;
-
-	/* timeout, check to see how many we have had */
-	if (++client_alive_timeouts > options.client_alive_count_max)
-		packet_disconnect("Timeout, your session not responding.");
-
-	/*
-	 * send a bogus channel request with "wantreply",
-	 * we should get back a failure
-	 */
-	channel_request_start(id, "keepalive@openssh.com", 1);
-	packet_send();
-}
-
-/*
- * Sleep in select() until we can do something.  This will initialize the
- * select masks.  Upon return, the masks will indicate which descriptors
- * have data or can accept data.  Optionally, a maximum time can be specified
- * for the duration of the wait (0 = infinite).
- */
-static void
-wait_until_can_do_something(fd_set **readsetp, fd_set **writesetp, int *maxfdp,
-    int *nallocp, u_int max_time_milliseconds)
-{
-	struct timeval tv, *tvp;
-	int ret;
-	int client_alive_scheduled = 0;
-
-	/*
-	 * if using client_alive, set the max timeout accordingly,
-	 * and indicate that this particular timeout was for client
-	 * alive by setting the client_alive_scheduled flag.
-	 *
-	 * this could be randomized somewhat to make traffic
-	 * analysis more difficult, but we're not doing it yet.
-	 */
-	if (compat20 &&
-	    max_time_milliseconds == 0 && options.client_alive_interval) {
-		client_alive_scheduled = 1;
-		max_time_milliseconds = options.client_alive_interval * 1000;
-	}
-
-	/* Allocate and update select() masks for channel descriptors. */
-	channel_prepare_select(readsetp, writesetp, maxfdp, nallocp, 0);
-
-	if (compat20) {
-#if 0
-		/* wrong: bad condition XXX */
-		if (channel_not_very_much_buffered_data())
-#endif
-		FD_SET(connection_in, *readsetp);
-	} else {
-		/*
-		 * Read packets from the client unless we have too much
-		 * buffered stdin or channel data.
-		 */
-		if (buffer_len(&stdin_buffer) < buffer_high &&
-		    channel_not_very_much_buffered_data())
-			FD_SET(connection_in, *readsetp);
-		/*
-		 * If there is not too much data already buffered going to
-		 * the client, try to get some more data from the program.
-		 */
-		if (packet_not_very_much_data_to_write()) {
-			if (!fdout_eof)
-				FD_SET(fdout, *readsetp);
-			if (!fderr_eof)
-				FD_SET(fderr, *readsetp);
-		}
-		/*
-		 * If we have buffered data, try to write some of that data
-		 * to the program.
-		 */
-		if (fdin != -1 && buffer_len(&stdin_buffer) > 0)
-			FD_SET(fdin, *writesetp);
-	}
-	notify_prepare(*readsetp);
-
-	/*
-	 * If we have buffered packet data going to the client, mark that
-	 * descriptor.
-	 */
-	if (packet_have_data_to_write())
-		FD_SET(connection_out, *writesetp);
-
-	/*
-	 * If child has terminated and there is enough buffer space to read
-	 * from it, then read as much as is available and exit.
-	 */
-	if (child_terminated && packet_not_very_much_data_to_write())
-		if (max_time_milliseconds == 0 || client_alive_scheduled)
-			max_time_milliseconds = 100;
-
-	if (max_time_milliseconds == 0)
-		tvp = NULL;
-	else {
-		tv.tv_sec = max_time_milliseconds / 1000;
-		tv.tv_usec = 1000 * (max_time_milliseconds % 1000);
-		tvp = &tv;
-	}
-
-	/* Wait for something to happen, or the timeout to expire. */
-	ret = select((*maxfdp)+1, *readsetp, *writesetp, NULL, tvp);
-
-	if (ret == -1) {
-		memset(*readsetp, 0, *nallocp);
-		memset(*writesetp, 0, *nallocp);
-		if (errno != EINTR)
-			error("select: %.100s", strerror(errno));
-	} else if (ret == 0 && client_alive_scheduled)
-		client_alive_check();
-
-	notify_done(*readsetp);
-}
-
-/*
- * Processes input from the client and the program.  Input data is stored
- * in buffers and processed later.
- */
-static void
-process_input(fd_set * readset)
-{
-	int len;
-	char buf[16384];
-
-	/* Read and buffer any input data from the client. */
-	if (FD_ISSET(connection_in, readset)) {
-		len = read(connection_in, buf, sizeof(buf));
-		if (len == 0) {
-			verbose("Connection closed by %.100s",
-			    get_remote_ipaddr());
-			connection_closed = 1;
-			if (compat20)
-				return;
-			fatal_cleanup();
-		} else if (len < 0) {
-			if (errno != EINTR && errno != EAGAIN) {
-				verbose("Read error from remote host "
-				    "%.100s: %.100s",
-				    get_remote_ipaddr(), strerror(errno));
-				fatal_cleanup();
-			}
-		} else {
-			/* Buffer any received data. */
-			packet_process_incoming(buf, len);
-		}
-	}
-	if (compat20)
-		return;
-
-	/* Read and buffer any available stdout data from the program. */
-	if (!fdout_eof && FD_ISSET(fdout, readset)) {
-		len = read(fdout, buf, sizeof(buf));
-		if (len < 0 && (errno == EINTR || errno == EAGAIN)) {
-			/* do nothing */
-		} else if (len <= 0) {
-			fdout_eof = 1;
-		} else {
-			buffer_append(&stdout_buffer, buf, len);
-			fdout_bytes += len;
-		}
-	}
-	/* Read and buffer any available stderr data from the program. */
-	if (!fderr_eof && FD_ISSET(fderr, readset)) {
-		len = read(fderr, buf, sizeof(buf));
-		if (len < 0 && (errno == EINTR || errno == EAGAIN)) {
-			/* do nothing */
-		} else if (len <= 0) {
-			fderr_eof = 1;
-		} else {
-			buffer_append(&stderr_buffer, buf, len);
-		}
-	}
-}
-
-/*
- * Sends data from internal buffers to client program stdin.
- */
-static void
-process_output(fd_set * writeset)
-{
-	struct termios tio;
-	u_char *data;
-	u_int dlen;
-	int len;
-
-	/* Write buffered data to program stdin. */
-	if (!compat20 && fdin != -1 && FD_ISSET(fdin, writeset)) {
-		data = buffer_ptr(&stdin_buffer);
-		dlen = buffer_len(&stdin_buffer);
-		len = write(fdin, data, dlen);
-		if (len < 0 && (errno == EINTR || errno == EAGAIN)) {
-			/* do nothing */
-		} else if (len <= 0) {
-			if (fdin != fdout)
-				close(fdin);
-			else
-				shutdown(fdin, SHUT_WR); /* We will no longer send. */
-			fdin = -1;
-		} else {
-			/* Successful write. */
-			if (fdin_is_tty && dlen >= 1 && data[0] != '\r' &&
-			    tcgetattr(fdin, &tio) == 0 &&
-			    !(tio.c_lflag & ECHO) && (tio.c_lflag & ICANON)) {
-				/*
-				 * Simulate echo to reduce the impact of
-				 * traffic analysis
-				 */
-				packet_send_ignore(len);
-				packet_send();
-			}
-			/* Consume the data from the buffer. */
-			buffer_consume(&stdin_buffer, len);
-			/* Update the count of bytes written to the program. */
-			stdin_bytes += len;
-		}
-	}
-	/* Send any buffered packet data to the client. */
-	if (FD_ISSET(connection_out, writeset))
-		packet_write_poll();
-}
-
-/*
- * Wait until all buffered output has been sent to the client.
- * This is used when the program terminates.
- */
-static void
-drain_output(void)
-{
-	/* Send any buffered stdout data to the client. */
-	if (buffer_len(&stdout_buffer) > 0) {
-		packet_start(SSH_SMSG_STDOUT_DATA);
-		packet_put_string(buffer_ptr(&stdout_buffer),
-				  buffer_len(&stdout_buffer));
-		packet_send();
-		/* Update the count of sent bytes. */
-		stdout_bytes += buffer_len(&stdout_buffer);
-	}
-	/* Send any buffered stderr data to the client. */
-	if (buffer_len(&stderr_buffer) > 0) {
-		packet_start(SSH_SMSG_STDERR_DATA);
-		packet_put_string(buffer_ptr(&stderr_buffer),
-				  buffer_len(&stderr_buffer));
-		packet_send();
-		/* Update the count of sent bytes. */
-		stderr_bytes += buffer_len(&stderr_buffer);
-	}
-	/* Wait until all buffered data has been written to the client. */
-	packet_write_wait();
-}
-
-static void
-process_buffered_input_packets(void)
-{
-	dispatch_run(DISPATCH_NONBLOCK, NULL, compat20 ? xxx_kex : NULL);
-}
-
-/*
- * Performs the interactive session.  This handles data transmission between
- * the client and the program.  Note that the notion of stdin, stdout, and
- * stderr in this function is sort of reversed: this function writes to
- * stdin (of the child program), and reads from stdout and stderr (of the
- * child program).
- */
-void
-server_loop(pid_t pid, int fdin_arg, int fdout_arg, int fderr_arg)
-{
-	fd_set *readset = NULL, *writeset = NULL;
-	int max_fd = 0, nalloc = 0;
-	int wait_status;	/* Status returned by wait(). */
-	pid_t wait_pid;		/* pid returned by wait(). */
-	int waiting_termination = 0;	/* Have displayed waiting close message. */
-	u_int max_time_milliseconds;
-	u_int previous_stdout_buffer_bytes;
-	u_int stdout_buffer_bytes;
-	int type;
-
-	debug("Entering interactive session.");
-
-	/* Initialize the SIGCHLD kludge. */
-	child_terminated = 0;
-	mysignal(SIGCHLD, sigchld_handler);
-
-	/* Initialize our global variables. */
-	fdin = fdin_arg;
-	fdout = fdout_arg;
-	fderr = fderr_arg;
-
-	/* nonblocking IO */
-	set_nonblock(fdin);
-	set_nonblock(fdout);
-	/* we don't have stderr for interactive terminal sessions, see below */
-	if (fderr != -1)
-		set_nonblock(fderr);
-
-	if (!(datafellows & SSH_BUG_IGNOREMSG) && isatty(fdin))
-		fdin_is_tty = 1;
-
-	connection_in = packet_get_connection_in();
-	connection_out = packet_get_connection_out();
-
-	notify_setup();
-
-	previous_stdout_buffer_bytes = 0;
-
-	/* Set approximate I/O buffer size. */
-	if (packet_is_interactive())
-		buffer_high = 4096;
-	else
-		buffer_high = 64 * 1024;
-
-#if 0
-	/* Initialize max_fd to the maximum of the known file descriptors. */
-	max_fd = MAX(connection_in, connection_out);
-	max_fd = MAX(max_fd, fdin);
-	max_fd = MAX(max_fd, fdout);
-	if (fderr != -1)
-		max_fd = MAX(max_fd, fderr);
-#endif
-
-	/* Initialize Initialize buffers. */
-	buffer_init(&stdin_buffer);
-	buffer_init(&stdout_buffer);
-	buffer_init(&stderr_buffer);
-
-	/*
-	 * If we have no separate fderr (which is the case when we have a pty
-	 * - there we cannot make difference between data sent to stdout and
-	 * stderr), indicate that we have seen an EOF from stderr.  This way
-	 * we don\'t need to check the descriptor everywhere.
-	 */
-	if (fderr == -1)
-		fderr_eof = 1;
-
-	server_init_dispatch();
-
-	/* Main loop of the server for the interactive session mode. */
-	for (;;) {
-
-		/* Process buffered packets from the client. */
-		process_buffered_input_packets();
-
-		/*
-		 * If we have received eof, and there is no more pending
-		 * input data, cause a real eof by closing fdin.
-		 */
-		if (stdin_eof && fdin != -1 && buffer_len(&stdin_buffer) == 0) {
-			if (fdin != fdout)
-				close(fdin);
-			else
-				shutdown(fdin, SHUT_WR); /* We will no longer send. */
-			fdin = -1;
-		}
-		/* Make packets from buffered stderr data to send to the client. */
-		make_packets_from_stderr_data();
-
-		/*
-		 * Make packets from buffered stdout data to send to the
-		 * client. If there is very little to send, this arranges to
-		 * not send them now, but to wait a short while to see if we
-		 * are getting more data. This is necessary, as some systems
-		 * wake up readers from a pty after each separate character.
-		 */
-		max_time_milliseconds = 0;
-		stdout_buffer_bytes = buffer_len(&stdout_buffer);
-		if (stdout_buffer_bytes != 0 && stdout_buffer_bytes < 256 &&
-		    stdout_buffer_bytes != previous_stdout_buffer_bytes) {
-			/* try again after a while */
-			max_time_milliseconds = 10;
-		} else {
-			/* Send it now. */
-			make_packets_from_stdout_data();
-		}
-		previous_stdout_buffer_bytes = buffer_len(&stdout_buffer);
-
-		/* Send channel data to the client. */
-		if (packet_not_very_much_data_to_write())
-			channel_output_poll();
-
-		/*
-		 * Bail out of the loop if the program has closed its output
-		 * descriptors, and we have no more data to send to the
-		 * client, and there is no pending buffered data.
-		 */
-		if (fdout_eof && fderr_eof && !packet_have_data_to_write() &&
-		    buffer_len(&stdout_buffer) == 0 && buffer_len(&stderr_buffer) == 0) {
-			if (!channel_still_open())
-				break;
-			if (!waiting_termination) {
-				const char *s = "Waiting for forwarded connections to terminate...\r\n";
-				char *cp;
-				waiting_termination = 1;
-				buffer_append(&stderr_buffer, s, strlen(s));
-
-				/* Display list of open channels. */
-				cp = channel_open_message();
-				buffer_append(&stderr_buffer, cp, strlen(cp));
-				xfree(cp);
-			}
-		}
-		max_fd = MAX(connection_in, connection_out);
-		max_fd = MAX(max_fd, fdin);
-		max_fd = MAX(max_fd, fdout);
-		max_fd = MAX(max_fd, fderr);
-		max_fd = MAX(max_fd, notify_pipe[0]);
-
-		/* Sleep in select() until we can do something. */
-		wait_until_can_do_something(&readset, &writeset, &max_fd,
-		    &nalloc, max_time_milliseconds);
-
-		/* Process any channel events. */
-		channel_after_select(readset, writeset);
-
-		/* Process input from the client and from program stdout/stderr. */
-		process_input(readset);
-
-		/* Process output to the client and to program stdin. */
-		process_output(writeset);
-	}
-	if (readset)
-		xfree(readset);
-	if (writeset)
-		xfree(writeset);
-
-	/* Cleanup and termination code. */
-
-	/* Wait until all output has been sent to the client. */
-	drain_output();
-
-	debug("End of interactive session; stdin %ld, stdout (read %ld, sent %ld), stderr %ld bytes.",
-	    stdin_bytes, fdout_bytes, stdout_bytes, stderr_bytes);
-
-	/* Free and clear the buffers. */
-	buffer_free(&stdin_buffer);
-	buffer_free(&stdout_buffer);
-	buffer_free(&stderr_buffer);
-
-	/* Close the file descriptors. */
-	if (fdout != -1)
-		close(fdout);
-	fdout = -1;
-	fdout_eof = 1;
-	if (fderr != -1)
-		close(fderr);
-	fderr = -1;
-	fderr_eof = 1;
-	if (fdin != -1)
-		close(fdin);
-	fdin = -1;
-
-	channel_free_all();
-
-	/* We no longer want our SIGCHLD handler to be called. */
-	mysignal(SIGCHLD, SIG_DFL);
-
-	while ((wait_pid = waitpid(-1, &wait_status, 0)) < 0)
-		if (errno != EINTR)
-			packet_disconnect("wait: %.100s", strerror(errno));
-	if (wait_pid != pid)
-		error("Strange, wait returned pid %ld, expected %ld",
-		    (long)wait_pid, (long)pid);
-
-	/* Check if it exited normally. */
-	if (WIFEXITED(wait_status)) {
-		/* Yes, normal exit.  Get exit status and send it to the client. */
-		debug("Command exited with status %d.", WEXITSTATUS(wait_status));
-		packet_start(SSH_SMSG_EXITSTATUS);
-		packet_put_int(WEXITSTATUS(wait_status));
-		packet_send();
-		packet_write_wait();
-
-		/*
-		 * Wait for exit confirmation.  Note that there might be
-		 * other packets coming before it; however, the program has
-		 * already died so we just ignore them.  The client is
-		 * supposed to respond with the confirmation when it receives
-		 * the exit status.
-		 */
-		do {
-			type = packet_read();
-		}
-		while (type != SSH_CMSG_EXIT_CONFIRMATION);
-
-		debug("Received exit confirmation.");
-		return;
-	}
-	/* Check if the program terminated due to a signal. */
-	if (WIFSIGNALED(wait_status))
-		packet_disconnect("Command terminated on signal %d.",
-				  WTERMSIG(wait_status));
-
-	/* Some weird exit cause.  Just exit. */
-	packet_disconnect("wait returned status %04x.", wait_status);
-	/* NOTREACHED */
-}
-
-static void
-collect_children(void)
-{
-	pid_t pid;
-	sigset_t oset, nset;
-	int status;
-
-	/* block SIGCHLD while we check for dead children */
-	sigemptyset(&nset);
-	sigaddset(&nset, SIGCHLD);
-	sigprocmask(SIG_BLOCK, &nset, &oset);
-	if (child_terminated) {
-		while ((pid = waitpid(-1, &status, WNOHANG)) > 0 ||
-		    (pid < 0 && errno == EINTR))
-			if (pid > 0)
-				session_close_by_pid(pid, status);
-		child_terminated = 0;
-	}
-	sigprocmask(SIG_SETMASK, &oset, NULL);
-}
-
-void
-server_loop2(Authctxt *authctxt)
-{
-	fd_set *readset = NULL, *writeset = NULL;
-	int rekeying = 0, max_fd, nalloc = 0;
-
-	debug("Entering interactive session for SSH2.");
-
-	mysignal(SIGCHLD, sigchld_handler);
-	child_terminated = 0;
-	connection_in = packet_get_connection_in();
-	connection_out = packet_get_connection_out();
-
-	notify_setup();
-
-	max_fd = MAX(connection_in, connection_out);
-	max_fd = MAX(max_fd, notify_pipe[0]);
-
-	xxx_authctxt = authctxt;
-
-	server_init_dispatch();
-
-	for (;;) {
-		process_buffered_input_packets();
-
-		rekeying = (xxx_kex != NULL && !xxx_kex->done);
-
-		if (!rekeying && packet_not_very_much_data_to_write())
-			channel_output_poll();
-		wait_until_can_do_something(&readset, &writeset, &max_fd,
-		    &nalloc, 0);
-
-		collect_children();
-		if (!rekeying)
-			channel_after_select(readset, writeset);
-		process_input(readset);
-		if (connection_closed)
-			break;
-		process_output(writeset);
-	}
-	collect_children();
-
-	if (readset)
-		xfree(readset);
-	if (writeset)
-		xfree(writeset);
-
-	/* free all channels, no more reads and writes */
-	channel_free_all();
-
-	/* free remaining sessions, e.g. remove wtmp entries */
-	session_destroy_all(NULL);
-}
-
-static void
-server_input_channel_failure(int type, u_int32_t seq, void *ctxt)
-{
-	debug("Got CHANNEL_FAILURE for keepalive");
-	/*
-	 * reset timeout, since we got a sane answer from the client.
-	 * even if this was generated by something other than
-	 * the bogus CHANNEL_REQUEST we send for keepalives.
-	 */
-	client_alive_timeouts = 0;
-}
-
-
-static void
-server_input_stdin_data(int type, u_int32_t seq, void *ctxt)
-{
-	char *data;
-	u_int data_len;
-
-	/* Stdin data from the client.  Append it to the buffer. */
-	/* Ignore any data if the client has closed stdin. */
-	if (fdin == -1)
-		return;
-	data = packet_get_string(&data_len);
-	packet_check_eom();
-	buffer_append(&stdin_buffer, data, data_len);
-	memset(data, 0, data_len);
-	xfree(data);
-}
-
-static void
-server_input_eof(int type, u_int32_t seq, void *ctxt)
-{
-	/*
-	 * Eof from the client.  The stdin descriptor to the
-	 * program will be closed when all buffered data has
-	 * drained.
-	 */
-	debug("EOF received for stdin.");
-	packet_check_eom();
-	stdin_eof = 1;
-}
-
-static void
-server_input_window_size(int type, u_int32_t seq, void *ctxt)
-{
-	int row = packet_get_int();
-	int col = packet_get_int();
-	int xpixel = packet_get_int();
-	int ypixel = packet_get_int();
-
-	debug("Window change received.");
-	packet_check_eom();
-	if (fdin != -1)
-		pty_change_window_size(fdin, row, col, xpixel, ypixel);
-}
-
-static Channel *
-server_request_direct_tcpip(char *ctype)
-{
-	Channel *c;
-	int sock;
-	char *target, *originator;
-	int target_port, originator_port;
-
-	target = packet_get_string(NULL);
-	target_port = packet_get_int();
-	originator = packet_get_string(NULL);
-	originator_port = packet_get_int();
-	packet_check_eom();
-
-	debug("server_request_direct_tcpip: originator %s port %d, target %s port %d",
-	   originator, originator_port, target, target_port);
-
-	/* XXX check permission */
-	sock = channel_connect_to(target, target_port);
-	xfree(target);
-	xfree(originator);
-	if (sock < 0)
-		return NULL;
-	c = channel_new(ctype, SSH_CHANNEL_CONNECTING,
-	    sock, sock, -1, CHAN_TCP_WINDOW_DEFAULT,
-	    CHAN_TCP_PACKET_DEFAULT, 0, xstrdup("direct-tcpip"), 1);
-	return c;
-}
-
-static Channel *
-server_request_session(char *ctype)
-{
-	Channel *c;
-
-	debug("input_session_request");
-	packet_check_eom();
-	/*
-	 * A server session has no fd to read or write until a
-	 * CHANNEL_REQUEST for a shell is made, so we set the type to
-	 * SSH_CHANNEL_LARVAL.  Additionally, a callback for handling all
-	 * CHANNEL_REQUEST messages is registered.
-	 */
-	c = channel_new(ctype, SSH_CHANNEL_LARVAL,
-	    -1, -1, -1, /*window size*/0, CHAN_SES_PACKET_DEFAULT,
-	    0, xstrdup("server-session"), 1);
-	if (session_open(xxx_authctxt, c->self) != 1) {
-		debug("session open failed, free channel %d", c->self);
-		channel_free(c);
-		return NULL;
-	}
-	channel_register_cleanup(c->self, session_close_by_channel);
-	return c;
-}
-
-static void
-server_input_channel_open(int type, u_int32_t seq, void *ctxt)
-{
-	Channel *c = NULL;
-	char *ctype;
-	int rchan;
-	u_int rmaxpack, rwindow, len;
-
-	ctype = packet_get_string(&len);
-	rchan = packet_get_int();
-	rwindow = packet_get_int();
-	rmaxpack = packet_get_int();
-
-	debug("server_input_channel_open: ctype %s rchan %d win %d max %d",
-	    ctype, rchan, rwindow, rmaxpack);
-
-	if (strcmp(ctype, "session") == 0) {
-		c = server_request_session(ctype);
-	} else if (strcmp(ctype, "direct-tcpip") == 0) {
-		c = server_request_direct_tcpip(ctype);
-	}
-	if (c != NULL) {
-		debug("server_input_channel_open: confirm %s", ctype);
-		c->remote_id = rchan;
-		c->remote_window = rwindow;
-		c->remote_maxpacket = rmaxpack;
-		if (c->type != SSH_CHANNEL_CONNECTING) {
-			packet_start(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION);
-			packet_put_int(c->remote_id);
-			packet_put_int(c->self);
-			packet_put_int(c->local_window);
-			packet_put_int(c->local_maxpacket);
-			packet_send();
-		}
-	} else {
-		debug("server_input_channel_open: failure %s", ctype);
-		packet_start(SSH2_MSG_CHANNEL_OPEN_FAILURE);
-		packet_put_int(rchan);
-		packet_put_int(SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED);
-		if (!(datafellows & SSH_BUG_OPENFAILURE)) {
-			packet_put_cstring("open failed");
-			packet_put_cstring("");
-		}
-		packet_send();
-	}
-	xfree(ctype);
-}
-
-static void
-server_input_global_request(int type, u_int32_t seq, void *ctxt)
-{
-	char *rtype;
-	int want_reply;
-	int success = 0;
-
-	rtype = packet_get_string(NULL);
-	want_reply = packet_get_char();
-	debug("server_input_global_request: rtype %s want_reply %d", rtype, want_reply);
-
-	/* -R style forwarding */
-	if (strcmp(rtype, "tcpip-forward") == 0) {
-		struct passwd *pw;
-		char *listen_address;
-		u_short listen_port;
-
-		pw = auth_get_user();
-		if (pw == NULL)
-			fatal("server_input_global_request: no user");
-		listen_address = packet_get_string(NULL); /* XXX currently ignored */
-		listen_port = (u_short)packet_get_int();
-		debug("server_input_global_request: tcpip-forward listen %s port %d",
-		    listen_address, listen_port);
-
-		/* check permissions */
-		if (!options.allow_tcp_forwarding ||
-		    no_port_forwarding_flag
-#ifndef NO_IPPORT_RESERVED_CONCEPT
-		    || (listen_port < IPPORT_RESERVED && pw->pw_uid != 0)
-#endif
-		   ) {
-			success = 0;
-			packet_send_debug("Server has disabled port forwarding.");
-		} else {
-			/* Start listening on the port */
-			success = channel_setup_remote_fwd_listener(
-			    listen_address, listen_port, options.gateway_ports);
-		}
-		xfree(listen_address);
-	}
-	if (want_reply) {
-		packet_start(success ?
-		    SSH2_MSG_REQUEST_SUCCESS : SSH2_MSG_REQUEST_FAILURE);
-		packet_send();
-		packet_write_wait();
-	}
-	xfree(rtype);
-}
-static void
-server_input_channel_req(int type, u_int32_t seq, void *ctxt)
-{
-	Channel *c;
-	int id, reply, success = 0;
-	char *rtype;
-
-	id = packet_get_int();
-	rtype = packet_get_string(NULL);
-	reply = packet_get_char();
-
-	debug("server_input_channel_req: channel %d request %s reply %d",
-	    id, rtype, reply);
-
-	if ((c = channel_lookup(id)) == NULL)
-		packet_disconnect("server_input_channel_req: "
-		    "unknown channel %d", id);
-	if (c->type == SSH_CHANNEL_LARVAL || c->type == SSH_CHANNEL_OPEN)
-		success = session_input_channel_req(c, rtype);
-	if (reply) {
-		packet_start(success ?
-		    SSH2_MSG_CHANNEL_SUCCESS : SSH2_MSG_CHANNEL_FAILURE);
-		packet_put_int(c->remote_id);
-		packet_send();
-	}
-	xfree(rtype);
-}
-
-static void
-server_init_dispatch_20(void)
-{
-	debug("server_init_dispatch_20");
-	dispatch_init(&dispatch_protocol_error);
-	dispatch_set(SSH2_MSG_CHANNEL_CLOSE, &channel_input_oclose);
-	dispatch_set(SSH2_MSG_CHANNEL_DATA, &channel_input_data);
-	dispatch_set(SSH2_MSG_CHANNEL_EOF, &channel_input_ieof);
-	dispatch_set(SSH2_MSG_CHANNEL_EXTENDED_DATA, &channel_input_extended_data);
-	dispatch_set(SSH2_MSG_CHANNEL_OPEN, &server_input_channel_open);
-	dispatch_set(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION, &channel_input_open_confirmation);
-	dispatch_set(SSH2_MSG_CHANNEL_OPEN_FAILURE, &channel_input_open_failure);
-	dispatch_set(SSH2_MSG_CHANNEL_REQUEST, &server_input_channel_req);
-	dispatch_set(SSH2_MSG_CHANNEL_WINDOW_ADJUST, &channel_input_window_adjust);
-	dispatch_set(SSH2_MSG_GLOBAL_REQUEST, &server_input_global_request);
-	/* client_alive */
-	dispatch_set(SSH2_MSG_CHANNEL_FAILURE, &server_input_channel_failure);
-	/* rekeying */
-	dispatch_set(SSH2_MSG_KEXINIT, &kex_input_kexinit);
-}
-static void
-server_init_dispatch_13(void)
-{
-	debug("server_init_dispatch_13");
-	dispatch_init(NULL);
-	dispatch_set(SSH_CMSG_EOF, &server_input_eof);
-	dispatch_set(SSH_CMSG_STDIN_DATA, &server_input_stdin_data);
-	dispatch_set(SSH_CMSG_WINDOW_SIZE, &server_input_window_size);
-	dispatch_set(SSH_MSG_CHANNEL_CLOSE, &channel_input_close);
-	dispatch_set(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION, &channel_input_close_confirmation);
-	dispatch_set(SSH_MSG_CHANNEL_DATA, &channel_input_data);
-	dispatch_set(SSH_MSG_CHANNEL_OPEN_CONFIRMATION, &channel_input_open_confirmation);
-	dispatch_set(SSH_MSG_CHANNEL_OPEN_FAILURE, &channel_input_open_failure);
-	dispatch_set(SSH_MSG_PORT_OPEN, &channel_input_port_open);
-}
-static void
-server_init_dispatch_15(void)
-{
-	server_init_dispatch_13();
-	debug("server_init_dispatch_15");
-	dispatch_set(SSH_MSG_CHANNEL_CLOSE, &channel_input_ieof);
-	dispatch_set(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION, &channel_input_oclose);
-}
-static void
-server_init_dispatch(void)
-{
-	if (compat20)
-		server_init_dispatch_20();
-	else if (compat13)
-		server_init_dispatch_13();
-	else
-		server_init_dispatch_15();
-}
diff --git a/crypto/openssh/serverloop.h b/crypto/openssh/serverloop.h
deleted file mode 100644
index f419198d1ce7..000000000000
--- a/crypto/openssh/serverloop.h
+++ /dev/null
@@ -1,27 +0,0 @@
-/*	$OpenBSD: serverloop.h,v 1.5 2001/06/27 02:12:53 markus Exp $	*/
-
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-/*
- * Performs the interactive session.  This handles data transmission between
- * the client and the program.  Note that the notion of stdin, stdout, and
- * stderr in this function is sort of reversed: this function writes to stdin
- * (of the child program), and reads from stdout and stderr (of the child
- * program).
- */
-#ifndef SERVERLOOP_H
-#define SERVERLOOP_H
-
-void    server_loop(pid_t, int, int, int);
-void    server_loop2(Authctxt *);
-
-#endif
diff --git a/crypto/openssh/session.c b/crypto/openssh/session.c
deleted file mode 100644
index c75fea966933..000000000000
--- a/crypto/openssh/session.c
+++ /dev/null
@@ -1,2124 +0,0 @@
-/*
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- *
- * SSH2 support by Markus Friedl.
- * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: session.c,v 1.154 2003/03/05 22:33:43 markus Exp $");
-
-#include "ssh.h"
-#include "ssh1.h"
-#include "ssh2.h"
-#include "xmalloc.h"
-#include "sshpty.h"
-#include "packet.h"
-#include "buffer.h"
-#include "mpaux.h"
-#include "uidswap.h"
-#include "compat.h"
-#include "channels.h"
-#include "bufaux.h"
-#include "auth.h"
-#include "auth-options.h"
-#include "pathnames.h"
-#include "log.h"
-#include "servconf.h"
-#include "sshlogin.h"
-#include "serverloop.h"
-#include "canohost.h"
-#include "session.h"
-#include "monitor_wrap.h"
-
-#ifdef HAVE_CYGWIN
-#include <windows.h>
-#include <sys/cygwin.h>
-#define is_winnt       (GetVersion() < 0x80000000)
-#endif
-
-/* func */
-
-Session *session_new(void);
-void	session_set_fds(Session *, int, int, int);
-void	session_pty_cleanup(void *);
-void	session_proctitle(Session *);
-int	session_setup_x11fwd(Session *);
-void	do_exec_pty(Session *, const char *);
-void	do_exec_no_pty(Session *, const char *);
-void	do_exec(Session *, const char *);
-void	do_login(Session *, const char *);
-#ifdef LOGIN_NEEDS_UTMPX
-static void	do_pre_login(Session *s);
-#endif
-void	do_child(Session *, const char *);
-void	do_motd(void);
-int	check_quietlogin(Session *, const char *);
-
-static void do_authenticated1(Authctxt *);
-static void do_authenticated2(Authctxt *);
-
-static int session_pty_req(Session *);
-
-/* import */
-extern ServerOptions options;
-extern char *__progname;
-extern int log_stderr;
-extern int debug_flag;
-extern u_int utmp_len;
-extern int startup_pipe;
-extern void destroy_sensitive_data(void);
-
-/* original command from peer. */
-const char *original_command = NULL;
-
-/* data */
-#define MAX_SESSIONS 10
-Session	sessions[MAX_SESSIONS];
-
-#ifdef WITH_AIXAUTHENTICATE
-char *aixloginmsg;
-#endif /* WITH_AIXAUTHENTICATE */
-
-#ifdef HAVE_LOGIN_CAP
-login_cap_t *lc;
-#endif
-
-/* Name and directory of socket for authentication agent forwarding. */
-static char *auth_sock_name = NULL;
-static char *auth_sock_dir = NULL;
-
-/* removes the agent forwarding socket */
-
-static void
-auth_sock_cleanup_proc(void *_pw)
-{
-	struct passwd *pw = _pw;
-
-	if (auth_sock_name != NULL) {
-		temporarily_use_uid(pw);
-		unlink(auth_sock_name);
-		rmdir(auth_sock_dir);
-		auth_sock_name = NULL;
-		restore_uid();
-	}
-}
-
-static int
-auth_input_request_forwarding(struct passwd * pw)
-{
-	Channel *nc;
-	int sock;
-	struct sockaddr_un sunaddr;
-
-	if (auth_sock_name != NULL) {
-		error("authentication forwarding requested twice.");
-		return 0;
-	}
-
-	/* Temporarily drop privileged uid for mkdir/bind. */
-	temporarily_use_uid(pw);
-
-	/* Allocate a buffer for the socket name, and format the name. */
-	auth_sock_name = xmalloc(MAXPATHLEN);
-	auth_sock_dir = xmalloc(MAXPATHLEN);
-	strlcpy(auth_sock_dir, "/tmp/ssh-XXXXXXXX", MAXPATHLEN);
-
-	/* Create private directory for socket */
-	if (mkdtemp(auth_sock_dir) == NULL) {
-		packet_send_debug("Agent forwarding disabled: "
-		    "mkdtemp() failed: %.100s", strerror(errno));
-		restore_uid();
-		xfree(auth_sock_name);
-		xfree(auth_sock_dir);
-		auth_sock_name = NULL;
-		auth_sock_dir = NULL;
-		return 0;
-	}
-	snprintf(auth_sock_name, MAXPATHLEN, "%s/agent.%ld",
-		 auth_sock_dir, (long) getpid());
-
-	/* delete agent socket on fatal() */
-	fatal_add_cleanup(auth_sock_cleanup_proc, pw);
-
-	/* Create the socket. */
-	sock = socket(AF_UNIX, SOCK_STREAM, 0);
-	if (sock < 0)
-		packet_disconnect("socket: %.100s", strerror(errno));
-
-	/* Bind it to the name. */
-	memset(&sunaddr, 0, sizeof(sunaddr));
-	sunaddr.sun_family = AF_UNIX;
-	strlcpy(sunaddr.sun_path, auth_sock_name, sizeof(sunaddr.sun_path));
-
-	if (bind(sock, (struct sockaddr *) & sunaddr, sizeof(sunaddr)) < 0)
-		packet_disconnect("bind: %.100s", strerror(errno));
-
-	/* Restore the privileged uid. */
-	restore_uid();
-
-	/* Start listening on the socket. */
-	if (listen(sock, 5) < 0)
-		packet_disconnect("listen: %.100s", strerror(errno));
-
-	/* Allocate a channel for the authentication agent socket. */
-	nc = channel_new("auth socket",
-	    SSH_CHANNEL_AUTH_SOCKET, sock, sock, -1,
-	    CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
-	    0, xstrdup("auth socket"), 1);
-	strlcpy(nc->path, auth_sock_name, sizeof(nc->path));
-	return 1;
-}
-
-
-void
-do_authenticated(Authctxt *authctxt)
-{
-	setproctitle("%s", authctxt->pw->pw_name);
-
-	/*
-	 * Cancel the alarm we set to limit the time taken for
-	 * authentication.
-	 */
-	alarm(0);
-	if (startup_pipe != -1) {
-		close(startup_pipe);
-		startup_pipe = -1;
-	}
-
-	/* setup the channel layer */
-	if (!no_port_forwarding_flag && options.allow_tcp_forwarding)
-		channel_permit_all_opens();
-
-	if (compat20)
-		do_authenticated2(authctxt);
-	else
-		do_authenticated1(authctxt);
-
-	/* remove agent socket */
-	if (auth_sock_name != NULL)
-		auth_sock_cleanup_proc(authctxt->pw);
-#ifdef KRB4
-	if (options.kerberos_ticket_cleanup)
-		krb4_cleanup_proc(authctxt);
-#endif
-#ifdef KRB5
-	if (options.kerberos_ticket_cleanup)
-		krb5_cleanup_proc(authctxt);
-#endif
-}
-
-/*
- * Prepares for an interactive session.  This is called after the user has
- * been successfully authenticated.  During this message exchange, pseudo
- * terminals are allocated, X11, TCP/IP, and authentication agent forwardings
- * are requested, etc.
- */
-static void
-do_authenticated1(Authctxt *authctxt)
-{
-	Session *s;
-	char *command;
-	int success, type, screen_flag;
-	int enable_compression_after_reply = 0;
-	u_int proto_len, data_len, dlen, compression_level = 0;
-
-	s = session_new();
-	s->authctxt = authctxt;
-	s->pw = authctxt->pw;
-
-	/*
-	 * We stay in this loop until the client requests to execute a shell
-	 * or a command.
-	 */
-	for (;;) {
-		success = 0;
-
-		/* Get a packet from the client. */
-		type = packet_read();
-
-		/* Process the packet. */
-		switch (type) {
-		case SSH_CMSG_REQUEST_COMPRESSION:
-			compression_level = packet_get_int();
-			packet_check_eom();
-			if (compression_level < 1 || compression_level > 9) {
-				packet_send_debug("Received illegal compression level %d.",
-				    compression_level);
-				break;
-			}
-			if (!options.compression) {
-				debug2("compression disabled");
-				break;
-			}
-			/* Enable compression after we have responded with SUCCESS. */
-			enable_compression_after_reply = 1;
-			success = 1;
-			break;
-
-		case SSH_CMSG_REQUEST_PTY:
-			success = session_pty_req(s);
-			break;
-
-		case SSH_CMSG_X11_REQUEST_FORWARDING:
-			s->auth_proto = packet_get_string(&proto_len);
-			s->auth_data = packet_get_string(&data_len);
-
-			screen_flag = packet_get_protocol_flags() &
-			    SSH_PROTOFLAG_SCREEN_NUMBER;
-			debug2("SSH_PROTOFLAG_SCREEN_NUMBER: %d", screen_flag);
-
-			if (packet_remaining() == 4) {
-				if (!screen_flag)
-					debug2("Buggy client: "
-					    "X11 screen flag missing");
-				s->screen = packet_get_int();
-			} else {
-				s->screen = 0;
-			}
-			packet_check_eom();
-			success = session_setup_x11fwd(s);
-			if (!success) {
-				xfree(s->auth_proto);
-				xfree(s->auth_data);
-				s->auth_proto = NULL;
-				s->auth_data = NULL;
-			}
-			break;
-
-		case SSH_CMSG_AGENT_REQUEST_FORWARDING:
-			if (no_agent_forwarding_flag || compat13) {
-				debug("Authentication agent forwarding not permitted for this authentication.");
-				break;
-			}
-			debug("Received authentication agent forwarding request.");
-			success = auth_input_request_forwarding(s->pw);
-			break;
-
-		case SSH_CMSG_PORT_FORWARD_REQUEST:
-			if (no_port_forwarding_flag) {
-				debug("Port forwarding not permitted for this authentication.");
-				break;
-			}
-			if (!options.allow_tcp_forwarding) {
-				debug("Port forwarding not permitted.");
-				break;
-			}
-			debug("Received TCP/IP port forwarding request.");
-			channel_input_port_forward_request(s->pw->pw_uid == 0, options.gateway_ports);
-			success = 1;
-			break;
-
-		case SSH_CMSG_MAX_PACKET_SIZE:
-			if (packet_set_maxsize(packet_get_int()) > 0)
-				success = 1;
-			break;
-
-#if defined(AFS) || defined(KRB5)
-		case SSH_CMSG_HAVE_KERBEROS_TGT:
-			if (!options.kerberos_tgt_passing) {
-				verbose("Kerberos TGT passing disabled.");
-			} else {
-				char *kdata = packet_get_string(&dlen);
-				packet_check_eom();
-
-				/* XXX - 0x41, see creds_to_radix version */
-				if (kdata[0] != 0x41) {
-#ifdef KRB5
-					krb5_data tgt;
-					tgt.data = kdata;
-					tgt.length = dlen;
-
-					if (auth_krb5_tgt(s->authctxt, &tgt))
-						success = 1;
-					else
-						verbose("Kerberos v5 TGT refused for %.100s", s->authctxt->user);
-#endif /* KRB5 */
-				} else {
-#ifdef AFS
-					if (auth_krb4_tgt(s->authctxt, kdata))
-						success = 1;
-					else
-						verbose("Kerberos v4 TGT refused for %.100s", s->authctxt->user);
-#endif /* AFS */
-				}
-				xfree(kdata);
-			}
-			break;
-#endif /* AFS || KRB5 */
-
-#ifdef AFS
-		case SSH_CMSG_HAVE_AFS_TOKEN:
-			if (!options.afs_token_passing || !k_hasafs()) {
-				verbose("AFS token passing disabled.");
-			} else {
-				/* Accept AFS token. */
-				char *token = packet_get_string(&dlen);
-				packet_check_eom();
-
-				if (auth_afs_token(s->authctxt, token))
-					success = 1;
-				else
-					verbose("AFS token refused for %.100s",
-					    s->authctxt->user);
-				xfree(token);
-			}
-			break;
-#endif /* AFS */
-
-		case SSH_CMSG_EXEC_SHELL:
-		case SSH_CMSG_EXEC_CMD:
-			if (type == SSH_CMSG_EXEC_CMD) {
-				command = packet_get_string(&dlen);
-				debug("Exec command '%.500s'", command);
-				do_exec(s, command);
-				xfree(command);
-			} else {
-				do_exec(s, NULL);
-			}
-			packet_check_eom();
-			session_close(s);
-			return;
-
-		default:
-			/*
-			 * Any unknown messages in this phase are ignored,
-			 * and a failure message is returned.
-			 */
-			log("Unknown packet type received after authentication: %d", type);
-		}
-		packet_start(success ? SSH_SMSG_SUCCESS : SSH_SMSG_FAILURE);
-		packet_send();
-		packet_write_wait();
-
-		/* Enable compression now that we have replied if appropriate. */
-		if (enable_compression_after_reply) {
-			enable_compression_after_reply = 0;
-			packet_start_compression(compression_level);
-		}
-	}
-}
-
-/*
- * This is called to fork and execute a command when we have no tty.  This
- * will call do_child from the child, and server_loop from the parent after
- * setting up file descriptors and such.
- */
-void
-do_exec_no_pty(Session *s, const char *command)
-{
-	pid_t pid;
-
-#ifdef USE_PIPES
-	int pin[2], pout[2], perr[2];
-	/* Allocate pipes for communicating with the program. */
-	if (pipe(pin) < 0 || pipe(pout) < 0 || pipe(perr) < 0)
-		packet_disconnect("Could not create pipes: %.100s",
-				  strerror(errno));
-#else /* USE_PIPES */
-	int inout[2], err[2];
-	/* Uses socket pairs to communicate with the program. */
-	if (socketpair(AF_UNIX, SOCK_STREAM, 0, inout) < 0 ||
-	    socketpair(AF_UNIX, SOCK_STREAM, 0, err) < 0)
-		packet_disconnect("Could not create socket pairs: %.100s",
-				  strerror(errno));
-#endif /* USE_PIPES */
-	if (s == NULL)
-		fatal("do_exec_no_pty: no session");
-
-	session_proctitle(s);
-
-#if defined(USE_PAM)
-	do_pam_session(s->pw->pw_name, NULL);
-	do_pam_setcred(1);
-	if (is_pam_password_change_required())
-		packet_disconnect("Password change required but no "
-		    "TTY available");
-#endif /* USE_PAM */
-
-	/* Fork the child. */
-	if ((pid = fork()) == 0) {
-		fatal_remove_all_cleanups();
-
-		/* Child.  Reinitialize the log since the pid has changed. */
-		log_init(__progname, options.log_level, options.log_facility, log_stderr);
-
-		/*
-		 * Create a new session and process group since the 4.4BSD
-		 * setlogin() affects the entire process group.
-		 */
-		if (setsid() < 0)
-			error("setsid failed: %.100s", strerror(errno));
-
-#ifdef USE_PIPES
-		/*
-		 * Redirect stdin.  We close the parent side of the socket
-		 * pair, and make the child side the standard input.
-		 */
-		close(pin[1]);
-		if (dup2(pin[0], 0) < 0)
-			perror("dup2 stdin");
-		close(pin[0]);
-
-		/* Redirect stdout. */
-		close(pout[0]);
-		if (dup2(pout[1], 1) < 0)
-			perror("dup2 stdout");
-		close(pout[1]);
-
-		/* Redirect stderr. */
-		close(perr[0]);
-		if (dup2(perr[1], 2) < 0)
-			perror("dup2 stderr");
-		close(perr[1]);
-#else /* USE_PIPES */
-		/*
-		 * Redirect stdin, stdout, and stderr.  Stdin and stdout will
-		 * use the same socket, as some programs (particularly rdist)
-		 * seem to depend on it.
-		 */
-		close(inout[1]);
-		close(err[1]);
-		if (dup2(inout[0], 0) < 0)	/* stdin */
-			perror("dup2 stdin");
-		if (dup2(inout[0], 1) < 0)	/* stdout.  Note: same socket as stdin. */
-			perror("dup2 stdout");
-		if (dup2(err[0], 2) < 0)	/* stderr */
-			perror("dup2 stderr");
-#endif /* USE_PIPES */
-
-#ifdef _UNICOS
-		cray_init_job(s->pw); /* set up cray jid and tmpdir */
-#endif
-
-		/* Do processing for the child (exec command etc). */
-		do_child(s, command);
-		/* NOTREACHED */
-	}
-#ifdef _UNICOS
-	signal(WJSIGNAL, cray_job_termination_handler);
-#endif /* _UNICOS */
-#ifdef HAVE_CYGWIN
-	if (is_winnt)
-		cygwin_set_impersonation_token(INVALID_HANDLE_VALUE);
-#endif
-	if (pid < 0)
-		packet_disconnect("fork failed: %.100s", strerror(errno));
-	s->pid = pid;
-	/* Set interactive/non-interactive mode. */
-	packet_set_interactive(s->display != NULL);
-#ifdef USE_PIPES
-	/* We are the parent.  Close the child sides of the pipes. */
-	close(pin[0]);
-	close(pout[1]);
-	close(perr[1]);
-
-	if (compat20) {
-		session_set_fds(s, pin[1], pout[0], s->is_subsystem ? -1 : perr[0]);
-	} else {
-		/* Enter the interactive session. */
-		server_loop(pid, pin[1], pout[0], perr[0]);
-		/* server_loop has closed pin[1], pout[0], and perr[0]. */
-	}
-#else /* USE_PIPES */
-	/* We are the parent.  Close the child sides of the socket pairs. */
-	close(inout[0]);
-	close(err[0]);
-
-	/*
-	 * Enter the interactive session.  Note: server_loop must be able to
-	 * handle the case that fdin and fdout are the same.
-	 */
-	if (compat20) {
-		session_set_fds(s, inout[1], inout[1], s->is_subsystem ? -1 : err[1]);
-	} else {
-		server_loop(pid, inout[1], inout[1], err[1]);
-		/* server_loop has closed inout[1] and err[1]. */
-	}
-#endif /* USE_PIPES */
-}
-
-/*
- * This is called to fork and execute a command when we have a tty.  This
- * will call do_child from the child, and server_loop from the parent after
- * setting up file descriptors, controlling tty, updating wtmp, utmp,
- * lastlog, and other such operations.
- */
-void
-do_exec_pty(Session *s, const char *command)
-{
-	int fdout, ptyfd, ttyfd, ptymaster;
-	pid_t pid;
-
-	if (s == NULL)
-		fatal("do_exec_pty: no session");
-	ptyfd = s->ptyfd;
-	ttyfd = s->ttyfd;
-
-#if defined(USE_PAM)
-	do_pam_session(s->pw->pw_name, s->tty);
-	do_pam_setcred(1);
-#endif
-
-	/* Fork the child. */
-	if ((pid = fork()) == 0) {
-		fatal_remove_all_cleanups();
-
-		/* Child.  Reinitialize the log because the pid has changed. */
-		log_init(__progname, options.log_level, options.log_facility, log_stderr);
-		/* Close the master side of the pseudo tty. */
-		close(ptyfd);
-
-		/* Make the pseudo tty our controlling tty. */
-		pty_make_controlling_tty(&ttyfd, s->tty);
-
-		/* Redirect stdin/stdout/stderr from the pseudo tty. */
-		if (dup2(ttyfd, 0) < 0)
-			error("dup2 stdin: %s", strerror(errno));
-		if (dup2(ttyfd, 1) < 0)
-			error("dup2 stdout: %s", strerror(errno));
-		if (dup2(ttyfd, 2) < 0)
-			error("dup2 stderr: %s", strerror(errno));
-
-		/* Close the extra descriptor for the pseudo tty. */
-		close(ttyfd);
-
-		/* record login, etc. similar to login(1) */
-#ifndef HAVE_OSF_SIA
-		if (!(options.use_login && command == NULL)) {
-#ifdef _UNICOS
-			cray_init_job(s->pw); /* set up cray jid and tmpdir */
-#endif /* _UNICOS */
-			do_login(s, command);
-		}
-# ifdef LOGIN_NEEDS_UTMPX
-		else
-			do_pre_login(s);
-# endif
-#endif
-
-		/* Do common processing for the child, such as execing the command. */
-		do_child(s, command);
-		/* NOTREACHED */
-	}
-#ifdef _UNICOS
-	signal(WJSIGNAL, cray_job_termination_handler);
-#endif /* _UNICOS */
-#ifdef HAVE_CYGWIN
-	if (is_winnt)
-		cygwin_set_impersonation_token(INVALID_HANDLE_VALUE);
-#endif
-	if (pid < 0)
-		packet_disconnect("fork failed: %.100s", strerror(errno));
-	s->pid = pid;
-
-	/* Parent.  Close the slave side of the pseudo tty. */
-	close(ttyfd);
-
-	/*
-	 * Create another descriptor of the pty master side for use as the
-	 * standard input.  We could use the original descriptor, but this
-	 * simplifies code in server_loop.  The descriptor is bidirectional.
-	 */
-	fdout = dup(ptyfd);
-	if (fdout < 0)
-		packet_disconnect("dup #1 failed: %.100s", strerror(errno));
-
-	/* we keep a reference to the pty master */
-	ptymaster = dup(ptyfd);
-	if (ptymaster < 0)
-		packet_disconnect("dup #2 failed: %.100s", strerror(errno));
-	s->ptymaster = ptymaster;
-
-	/* Enter interactive session. */
-	packet_set_interactive(1);
-	if (compat20) {
-		session_set_fds(s, ptyfd, fdout, -1);
-	} else {
-		server_loop(pid, ptyfd, fdout, -1);
-		/* server_loop _has_ closed ptyfd and fdout. */
-	}
-}
-
-#ifdef LOGIN_NEEDS_UTMPX
-static void
-do_pre_login(Session *s)
-{
-	socklen_t fromlen;
-	struct sockaddr_storage from;
-	pid_t pid = getpid();
-
-	/*
-	 * Get IP address of client. If the connection is not a socket, let
-	 * the address be 0.0.0.0.
-	 */
-	memset(&from, 0, sizeof(from));
-	fromlen = sizeof(from);
-	if (packet_connection_is_on_socket()) {
-		if (getpeername(packet_get_connection_in(),
-		    (struct sockaddr *) & from, &fromlen) < 0) {
-			debug("getpeername: %.100s", strerror(errno));
-			fatal_cleanup();
-		}
-	}
-
-	record_utmp_only(pid, s->tty, s->pw->pw_name,
-	    get_remote_name_or_ip(utmp_len, options.verify_reverse_mapping),
-	    (struct sockaddr *)&from, fromlen);
-}
-#endif
-
-/*
- * This is called to fork and execute a command.  If another command is
- * to be forced, execute that instead.
- */
-void
-do_exec(Session *s, const char *command)
-{
-	if (forced_command) {
-		original_command = command;
-		command = forced_command;
-		debug("Forced command '%.900s'", command);
-	}
-
-	if (s->ttyfd != -1)
-		do_exec_pty(s, command);
-	else
-		do_exec_no_pty(s, command);
-
-	original_command = NULL;
-}
-
-
-/* administrative, login(1)-like work */
-void
-do_login(Session *s, const char *command)
-{
-	char *time_string;
-	socklen_t fromlen;
-	struct sockaddr_storage from;
-	struct passwd * pw = s->pw;
-	pid_t pid = getpid();
-
-	/*
-	 * Get IP address of client. If the connection is not a socket, let
-	 * the address be 0.0.0.0.
-	 */
-	memset(&from, 0, sizeof(from));
-	fromlen = sizeof(from);
-	if (packet_connection_is_on_socket()) {
-		if (getpeername(packet_get_connection_in(),
-		    (struct sockaddr *) & from, &fromlen) < 0) {
-			debug("getpeername: %.100s", strerror(errno));
-			fatal_cleanup();
-		}
-	}
-
-	/* Record that there was a login on that tty from the remote host. */
-	if (!use_privsep)
-		record_login(pid, s->tty, pw->pw_name, pw->pw_uid,
-		    get_remote_name_or_ip(utmp_len,
-		    options.verify_reverse_mapping),
-		    (struct sockaddr *)&from, fromlen);
-
-#ifdef USE_PAM
-	/*
-	 * If password change is needed, do it now.
-	 * This needs to occur before the ~/.hushlogin check.
-	 */
-	if (is_pam_password_change_required()) {
-		print_pam_messages();
-		do_pam_chauthtok();
-	}
-#endif
-
-	if (check_quietlogin(s, command))
-		return;
-
-#ifdef USE_PAM
-	if (!is_pam_password_change_required())
-		print_pam_messages();
-#endif /* USE_PAM */
-#ifdef WITH_AIXAUTHENTICATE
-	if (aixloginmsg && *aixloginmsg)
-		printf("%s\n", aixloginmsg);
-#endif /* WITH_AIXAUTHENTICATE */
-
-#ifndef NO_SSH_LASTLOG
-	if (options.print_lastlog && s->last_login_time != 0) {
-		time_string = ctime(&s->last_login_time);
-		if (strchr(time_string, '\n'))
-			*strchr(time_string, '\n') = 0;
-		if (strcmp(s->hostname, "") == 0)
-			printf("Last login: %s\r\n", time_string);
-		else
-			printf("Last login: %s from %s\r\n", time_string,
-			    s->hostname);
-	}
-#endif /* NO_SSH_LASTLOG */
-
-	do_motd();
-}
-
-/*
- * Display the message of the day.
- */
-void
-do_motd(void)
-{
-	FILE *f;
-	char buf[256];
-
-	if (options.print_motd) {
-#ifdef HAVE_LOGIN_CAP
-		f = fopen(login_getcapstr(lc, "welcome", "/etc/motd",
-		    "/etc/motd"), "r");
-#else
-		f = fopen("/etc/motd", "r");
-#endif
-		if (f) {
-			while (fgets(buf, sizeof(buf), f))
-				fputs(buf, stdout);
-			fclose(f);
-		}
-	}
-}
-
-
-/*
- * Check for quiet login, either .hushlogin or command given.
- */
-int
-check_quietlogin(Session *s, const char *command)
-{
-	char buf[256];
-	struct passwd *pw = s->pw;
-	struct stat st;
-
-	/* Return 1 if .hushlogin exists or a command given. */
-	if (command != NULL)
-		return 1;
-	snprintf(buf, sizeof(buf), "%.200s/.hushlogin", pw->pw_dir);
-#ifdef HAVE_LOGIN_CAP
-	if (login_getcapbool(lc, "hushlogin", 0) || stat(buf, &st) >= 0)
-		return 1;
-#else
-	if (stat(buf, &st) >= 0)
-		return 1;
-#endif
-	return 0;
-}
-
-/*
- * Sets the value of the given variable in the environment.  If the variable
- * already exists, its value is overriden.
- */
-static void
-child_set_env(char ***envp, u_int *envsizep, const char *name,
-	const char *value)
-{
-	u_int i, namelen;
-	char **env;
-
-	/*
-	 * Find the slot where the value should be stored.  If the variable
-	 * already exists, we reuse the slot; otherwise we append a new slot
-	 * at the end of the array, expanding if necessary.
-	 */
-	env = *envp;
-	namelen = strlen(name);
-	for (i = 0; env[i]; i++)
-		if (strncmp(env[i], name, namelen) == 0 && env[i][namelen] == '=')
-			break;
-	if (env[i]) {
-		/* Reuse the slot. */
-		xfree(env[i]);
-	} else {
-		/* New variable.  Expand if necessary. */
-		if (i >= (*envsizep) - 1) {
-			if (*envsizep >= 1000)
-				fatal("child_set_env: too many env vars,"
-				    " skipping: %.100s", name);
-			(*envsizep) += 50;
-			env = (*envp) = xrealloc(env, (*envsizep) * sizeof(char *));
-		}
-		/* Need to set the NULL pointer at end of array beyond the new slot. */
-		env[i + 1] = NULL;
-	}
-
-	/* Allocate space and format the variable in the appropriate slot. */
-	env[i] = xmalloc(strlen(name) + 1 + strlen(value) + 1);
-	snprintf(env[i], strlen(name) + 1 + strlen(value) + 1, "%s=%s", name, value);
-}
-
-/*
- * Reads environment variables from the given file and adds/overrides them
- * into the environment.  If the file does not exist, this does nothing.
- * Otherwise, it must consist of empty lines, comments (line starts with '#')
- * and assignments of the form name=value.  No other forms are allowed.
- */
-static void
-read_environment_file(char ***env, u_int *envsize,
-	const char *filename)
-{
-	FILE *f;
-	char buf[4096];
-	char *cp, *value;
-	u_int lineno = 0;
-
-	f = fopen(filename, "r");
-	if (!f)
-		return;
-
-	while (fgets(buf, sizeof(buf), f)) {
-		if (++lineno > 1000)
-			fatal("Too many lines in environment file %s", filename);
-		for (cp = buf; *cp == ' ' || *cp == '\t'; cp++)
-			;
-		if (!*cp || *cp == '#' || *cp == '\n')
-			continue;
-		if (strchr(cp, '\n'))
-			*strchr(cp, '\n') = '\0';
-		value = strchr(cp, '=');
-		if (value == NULL) {
-			fprintf(stderr, "Bad line %u in %.100s\n", lineno,
-			    filename);
-			continue;
-		}
-		/*
-		 * Replace the equals sign by nul, and advance value to
-		 * the value string.
-		 */
-		*value = '\0';
-		value++;
-		child_set_env(env, envsize, cp, value);
-	}
-	fclose(f);
-}
-
-void copy_environment(char **source, char ***env, u_int *envsize)
-{
-	char *var_name, *var_val;
-	int i;
-
-	if (source == NULL)
-		return;
-
-	for(i = 0; source[i] != NULL; i++) {
-		var_name = xstrdup(source[i]);
-		if ((var_val = strstr(var_name, "=")) == NULL) {
-			xfree(var_name);
-			continue;
-		}
-		*var_val++ = '\0';
-
-		debug3("Copy environment: %s=%s", var_name, var_val);
-		child_set_env(env, envsize, var_name, var_val);
-		
-		xfree(var_name);
-	}
-}
-
-static char **
-do_setup_env(Session *s, const char *shell)
-{
-	char buf[256];
-	u_int i, envsize;
-	char **env, *laddr;
-	struct passwd *pw = s->pw;
-
-	/* Initialize the environment. */
-	envsize = 100;
-	env = xmalloc(envsize * sizeof(char *));
-	env[0] = NULL;
-
-#ifdef HAVE_CYGWIN
-	/*
-	 * The Windows environment contains some setting which are
-	 * important for a running system. They must not be dropped.
-	 */
-	copy_environment(environ, &env, &envsize);
-#endif
-
-	if (!options.use_login) {
-		/* Set basic environment. */
-		child_set_env(&env, &envsize, "USER", pw->pw_name);
-		child_set_env(&env, &envsize, "LOGNAME", pw->pw_name);
-#ifdef _AIX
-		child_set_env(&env, &envsize, "LOGIN", pw->pw_name);
-#endif
-		child_set_env(&env, &envsize, "HOME", pw->pw_dir);
-#ifdef HAVE_LOGIN_CAP
-		if (setusercontext(lc, pw, pw->pw_uid, LOGIN_SETPATH) < 0)
-			child_set_env(&env, &envsize, "PATH", _PATH_STDPATH);
-		else
-			child_set_env(&env, &envsize, "PATH", getenv("PATH"));
-#else /* HAVE_LOGIN_CAP */
-# ifndef HAVE_CYGWIN
-		/*
-		 * There's no standard path on Windows. The path contains
-		 * important components pointing to the system directories,
-		 * needed for loading shared libraries. So the path better
-		 * remains intact here.
-		 */
-#  ifdef SUPERUSER_PATH
-		child_set_env(&env, &envsize, "PATH", 
-		    s->pw->pw_uid == 0 ? SUPERUSER_PATH : _PATH_STDPATH);
-#  else 
-		child_set_env(&env, &envsize, "PATH", _PATH_STDPATH);
-#  endif /* SUPERUSER_PATH */
-# endif /* HAVE_CYGWIN */
-#endif /* HAVE_LOGIN_CAP */
-
-		snprintf(buf, sizeof buf, "%.200s/%.50s",
-			 _PATH_MAILDIR, pw->pw_name);
-		child_set_env(&env, &envsize, "MAIL", buf);
-
-		/* Normal systems set SHELL by default. */
-		child_set_env(&env, &envsize, "SHELL", shell);
-	}
-	if (getenv("TZ"))
-		child_set_env(&env, &envsize, "TZ", getenv("TZ"));
-
-	/* Set custom environment options from RSA authentication. */
-	if (!options.use_login) {
-		while (custom_environment) {
-			struct envstring *ce = custom_environment;
-			char *str = ce->s;
-
-			for (i = 0; str[i] != '=' && str[i]; i++)
-				;
-			if (str[i] == '=') {
-				str[i] = 0;
-				child_set_env(&env, &envsize, str, str + i + 1);
-			}
-			custom_environment = ce->next;
-			xfree(ce->s);
-			xfree(ce);
-		}
-	}
-
-	/* SSH_CLIENT deprecated */
-	snprintf(buf, sizeof buf, "%.50s %d %d",
-	    get_remote_ipaddr(), get_remote_port(), get_local_port());
-	child_set_env(&env, &envsize, "SSH_CLIENT", buf);
-
-	laddr = get_local_ipaddr(packet_get_connection_in());
-	snprintf(buf, sizeof buf, "%.50s %d %.50s %d",
-	    get_remote_ipaddr(), get_remote_port(), laddr, get_local_port());
-	xfree(laddr);
-	child_set_env(&env, &envsize, "SSH_CONNECTION", buf);
-
-	if (s->ttyfd != -1)
-		child_set_env(&env, &envsize, "SSH_TTY", s->tty);
-	if (s->term)
-		child_set_env(&env, &envsize, "TERM", s->term);
-	if (s->display)
-		child_set_env(&env, &envsize, "DISPLAY", s->display);
-	if (original_command)
-		child_set_env(&env, &envsize, "SSH_ORIGINAL_COMMAND",
-		    original_command);
-
-#ifdef _UNICOS
-	if (cray_tmpdir[0] != '\0')
-		child_set_env(&env, &envsize, "TMPDIR", cray_tmpdir);
-#endif /* _UNICOS */
-
-#ifdef _AIX
-	{
-		char *cp;
-
-		if ((cp = getenv("AUTHSTATE")) != NULL)
-			child_set_env(&env, &envsize, "AUTHSTATE", cp);
-		if ((cp = getenv("KRB5CCNAME")) != NULL)
-			child_set_env(&env, &envsize, "KRB5CCNAME", cp);
-		read_environment_file(&env, &envsize, "/etc/environment");
-	}
-#endif
-#ifdef KRB4
-	if (s->authctxt->krb4_ticket_file)
-		child_set_env(&env, &envsize, "KRBTKFILE",
-		    s->authctxt->krb4_ticket_file);
-#endif
-#ifdef KRB5
-	if (s->authctxt->krb5_ticket_file)
-		child_set_env(&env, &envsize, "KRB5CCNAME",
-		    s->authctxt->krb5_ticket_file);
-#endif
-#ifdef USE_PAM
-	/*
-	 * Pull in any environment variables that may have
-	 * been set by PAM.
-	 */
-	{
-		char **p;
-
-		p = fetch_pam_environment();
-		copy_environment(p, &env, &envsize);
-		free_pam_environment(p);
-	}
-#endif /* USE_PAM */
-
-	if (auth_sock_name != NULL)
-		child_set_env(&env, &envsize, SSH_AUTHSOCKET_ENV_NAME,
-		    auth_sock_name);
-
-	/* read $HOME/.ssh/environment. */
-	if (options.permit_user_env && !options.use_login) {
-		snprintf(buf, sizeof buf, "%.200s/.ssh/environment",
-		    strcmp(pw->pw_dir, "/") ? pw->pw_dir : "");
-		read_environment_file(&env, &envsize, buf);
-	}
-	if (debug_flag) {
-		/* dump the environment */
-		fprintf(stderr, "Environment:\n");
-		for (i = 0; env[i]; i++)
-			fprintf(stderr, "  %.200s\n", env[i]);
-	}
-	return env;
-}
-
-/*
- * Run $HOME/.ssh/rc, /etc/ssh/sshrc, or xauth (whichever is found
- * first in this order).
- */
-static void
-do_rc_files(Session *s, const char *shell)
-{
-	FILE *f = NULL;
-	char cmd[1024];
-	int do_xauth;
-	struct stat st;
-
-	do_xauth =
-	    s->display != NULL && s->auth_proto != NULL && s->auth_data != NULL;
-
-	/* ignore _PATH_SSH_USER_RC for subsystems */
-	if (!s->is_subsystem && (stat(_PATH_SSH_USER_RC, &st) >= 0)) {
-		snprintf(cmd, sizeof cmd, "%s -c '%s %s'",
-		    shell, _PATH_BSHELL, _PATH_SSH_USER_RC);
-		if (debug_flag)
-			fprintf(stderr, "Running %s\n", cmd);
-		f = popen(cmd, "w");
-		if (f) {
-			if (do_xauth)
-				fprintf(f, "%s %s\n", s->auth_proto,
-				    s->auth_data);
-			pclose(f);
-		} else
-			fprintf(stderr, "Could not run %s\n",
-			    _PATH_SSH_USER_RC);
-	} else if (stat(_PATH_SSH_SYSTEM_RC, &st) >= 0) {
-		if (debug_flag)
-			fprintf(stderr, "Running %s %s\n", _PATH_BSHELL,
-			    _PATH_SSH_SYSTEM_RC);
-		f = popen(_PATH_BSHELL " " _PATH_SSH_SYSTEM_RC, "w");
-		if (f) {
-			if (do_xauth)
-				fprintf(f, "%s %s\n", s->auth_proto,
-				    s->auth_data);
-			pclose(f);
-		} else
-			fprintf(stderr, "Could not run %s\n",
-			    _PATH_SSH_SYSTEM_RC);
-	} else if (do_xauth && options.xauth_location != NULL) {
-		/* Add authority data to .Xauthority if appropriate. */
-		if (debug_flag) {
-			fprintf(stderr,
-			    "Running %.500s remove %.100s\n",
-  			    options.xauth_location, s->auth_display);
-			fprintf(stderr,
-			    "%.500s add %.100s %.100s %.100s\n",
-			    options.xauth_location, s->auth_display,
-			    s->auth_proto, s->auth_data);
-		}
-		snprintf(cmd, sizeof cmd, "%s -q -",
-		    options.xauth_location);
-		f = popen(cmd, "w");
-		if (f) {
-			fprintf(f, "remove %s\n",
-			    s->auth_display);
-			fprintf(f, "add %s %s %s\n",
-			    s->auth_display, s->auth_proto,
-			    s->auth_data);
-			pclose(f);
-		} else {
-			fprintf(stderr, "Could not run %s\n",
-			    cmd);
-		}
-	}
-}
-
-static void
-do_nologin(struct passwd *pw)
-{
-	FILE *f = NULL;
-	char buf[1024];
-
-#ifdef HAVE_LOGIN_CAP
-	if (!login_getcapbool(lc, "ignorenologin", 0) && pw->pw_uid)
-		f = fopen(login_getcapstr(lc, "nologin", _PATH_NOLOGIN,
-		    _PATH_NOLOGIN), "r");
-#else
-	if (pw->pw_uid)
-		f = fopen(_PATH_NOLOGIN, "r");
-#endif
-	if (f) {
-		/* /etc/nologin exists.  Print its contents and exit. */
-		log("User %.100s not allowed because %s exists",
-		    pw->pw_name, _PATH_NOLOGIN);
-		while (fgets(buf, sizeof(buf), f))
-			fputs(buf, stderr);
-		fclose(f);
-		fflush(NULL);
-		exit(254);
-	}
-}
-
-/* Set login name, uid, gid, and groups. */
-void
-do_setusercontext(struct passwd *pw)
-{
-#ifndef HAVE_CYGWIN
-	if (getuid() == 0 || geteuid() == 0)
-#endif /* HAVE_CYGWIN */
-	{
-
-#ifdef HAVE_SETPCRED
-		setpcred(pw->pw_name);
-#endif /* HAVE_SETPCRED */
-#ifdef HAVE_LOGIN_CAP
-# ifdef __bsdi__
-		setpgid(0, 0);
-# endif
-		if (setusercontext(lc, pw, pw->pw_uid,
-		    (LOGIN_SETALL & ~LOGIN_SETPATH)) < 0) {
-			perror("unable to set user context");
-			exit(1);
-		}
-#else
-# if defined(HAVE_GETLUID) && defined(HAVE_SETLUID)
-		/* Sets login uid for accounting */
-		if (getluid() == -1 && setluid(pw->pw_uid) == -1)
-			error("setluid: %s", strerror(errno));
-# endif /* defined(HAVE_GETLUID) && defined(HAVE_SETLUID) */
-
-		if (setlogin(pw->pw_name) < 0)
-			error("setlogin failed: %s", strerror(errno));
-		if (setgid(pw->pw_gid) < 0) {
-			perror("setgid");
-			exit(1);
-		}
-		/* Initialize the group list. */
-		if (initgroups(pw->pw_name, pw->pw_gid) < 0) {
-			perror("initgroups");
-			exit(1);
-		}
-		endgrent();
-# ifdef USE_PAM
-		/*
-		 * PAM credentials may take the form of supplementary groups. 
-		 * These will have been wiped by the above initgroups() call.
-		 * Reestablish them here.
-		 */
-		do_pam_setcred(0);
-# endif /* USE_PAM */
-# if defined(WITH_IRIX_PROJECT) || defined(WITH_IRIX_JOBS) || defined(WITH_IRIX_ARRAY)
-		irix_setusercontext(pw);
-#  endif /* defined(WITH_IRIX_PROJECT) || defined(WITH_IRIX_JOBS) || defined(WITH_IRIX_ARRAY) */
-# ifdef _AIX
-		aix_usrinfo(pw);
-# endif /* _AIX */
-		/* Permanently switch to the desired uid. */
-		permanently_set_uid(pw);
-#endif
-	}
-
-#ifdef HAVE_CYGWIN
-	if (is_winnt)
-#endif
-	if (getuid() != pw->pw_uid || geteuid() != pw->pw_uid)
-		fatal("Failed to set uids to %u.", (u_int) pw->pw_uid);
-}
-
-static void
-launch_login(struct passwd *pw, const char *hostname)
-{
-	/* Launch login(1). */
-
-	execl(LOGIN_PROGRAM, "login", "-h", hostname,
-#ifdef xxxLOGIN_NEEDS_TERM
-		    (s->term ? s->term : "unknown"),
-#endif /* LOGIN_NEEDS_TERM */
-#ifdef LOGIN_NO_ENDOPT
-	    "-p", "-f", pw->pw_name, (char *)NULL);
-#else
-	    "-p", "-f", "--", pw->pw_name, (char *)NULL);
-#endif
-
-	/* Login couldn't be executed, die. */
-
-	perror("login");
-	exit(1);
-}
-
-/*
- * Performs common processing for the child, such as setting up the
- * environment, closing extra file descriptors, setting the user and group
- * ids, and executing the command or shell.
- */
-void
-do_child(Session *s, const char *command)
-{
-	extern char **environ;
-	char **env;
-	char *argv[10];
-	const char *shell, *shell0, *hostname = NULL;
-	struct passwd *pw = s->pw;
-	u_int i;
-
-	/* remove hostkey from the child's memory */
-	destroy_sensitive_data();
-
-	/* login(1) is only called if we execute the login shell */
-	if (options.use_login && command != NULL)
-		options.use_login = 0;
-
-#ifdef _UNICOS
-	cray_setup(pw->pw_uid, pw->pw_name, command);
-#endif /* _UNICOS */
-
-	/*
-	 * Login(1) does this as well, and it needs uid 0 for the "-h"
-	 * switch, so we let login(1) to this for us.
-	 */
-	if (!options.use_login) {
-#ifdef HAVE_OSF_SIA
-		session_setup_sia(pw, s->ttyfd == -1 ? NULL : s->tty);
-		if (!check_quietlogin(s, command))
-			do_motd();
-#else /* HAVE_OSF_SIA */
-		do_nologin(pw);
-		do_setusercontext(pw);
-#endif /* HAVE_OSF_SIA */
-	}
-
-	/*
-	 * Get the shell from the password data.  An empty shell field is
-	 * legal, and means /bin/sh.
-	 */
-	shell = (pw->pw_shell[0] == '\0') ? _PATH_BSHELL : pw->pw_shell;
-
-	/*
-	 * Make sure $SHELL points to the shell from the password file,
-	 * even if shell is overridden from login.conf
-	 */
-	env = do_setup_env(s, shell);
-
-#ifdef HAVE_LOGIN_CAP
-	shell = login_getcapstr(lc, "shell", (char *)shell, (char *)shell);
-#endif
-
-	/* we have to stash the hostname before we close our socket. */
-	if (options.use_login)
-		hostname = get_remote_name_or_ip(utmp_len,
-		    options.verify_reverse_mapping);
-	/*
-	 * Close the connection descriptors; note that this is the child, and
-	 * the server will still have the socket open, and it is important
-	 * that we do not shutdown it.  Note that the descriptors cannot be
-	 * closed before building the environment, as we call
-	 * get_remote_ipaddr there.
-	 */
-	if (packet_get_connection_in() == packet_get_connection_out())
-		close(packet_get_connection_in());
-	else {
-		close(packet_get_connection_in());
-		close(packet_get_connection_out());
-	}
-	/*
-	 * Close all descriptors related to channels.  They will still remain
-	 * open in the parent.
-	 */
-	/* XXX better use close-on-exec? -markus */
-	channel_close_all();
-
-	/*
-	 * Close any extra file descriptors.  Note that there may still be
-	 * descriptors left by system functions.  They will be closed later.
-	 */
-	endpwent();
-
-	/*
-	 * Close any extra open file descriptors so that we don\'t have them
-	 * hanging around in clients.  Note that we want to do this after
-	 * initgroups, because at least on Solaris 2.3 it leaves file
-	 * descriptors open.
-	 */
-	for (i = 3; i < 64; i++)
-		close(i);
-
-	/*
-	 * Must take new environment into use so that .ssh/rc,
-	 * /etc/ssh/sshrc and xauth are run in the proper environment.
-	 */
-	environ = env;
-
-#ifdef AFS
-	/* Try to get AFS tokens for the local cell. */
-	if (k_hasafs()) {
-		char cell[64];
-
-		if (k_afs_cell_of_file(pw->pw_dir, cell, sizeof(cell)) == 0)
-			krb_afslog(cell, 0);
-
-		krb_afslog(0, 0);
-	}
-#endif /* AFS */
-
-	/* Change current directory to the user\'s home directory. */
-	if (chdir(pw->pw_dir) < 0) {
-		fprintf(stderr, "Could not chdir to home directory %s: %s\n",
-		    pw->pw_dir, strerror(errno));
-#ifdef HAVE_LOGIN_CAP
-		if (login_getcapbool(lc, "requirehome", 0))
-			exit(1);
-#endif
-	}
-
-	if (!options.use_login)
-		do_rc_files(s, shell);
-
-	/* restore SIGPIPE for child */
-	signal(SIGPIPE,  SIG_DFL);
-
-	if (options.use_login) {
-		launch_login(pw, hostname);
-		/* NEVERREACHED */
-	}
-
-	/* Get the last component of the shell name. */
-	if ((shell0 = strrchr(shell, '/')) != NULL)
-		shell0++;
-	else
-		shell0 = shell;
-
-	/*
-	 * If we have no command, execute the shell.  In this case, the shell
-	 * name to be passed in argv[0] is preceded by '-' to indicate that
-	 * this is a login shell.
-	 */
-	if (!command) {
-		char argv0[256];
-
-		/* Start the shell.  Set initial character to '-'. */
-		argv0[0] = '-';
-
-		if (strlcpy(argv0 + 1, shell0, sizeof(argv0) - 1)
-		    >= sizeof(argv0) - 1) {
-			errno = EINVAL;
-			perror(shell);
-			exit(1);
-		}
-
-		/* Execute the shell. */
-		argv[0] = argv0;
-		argv[1] = NULL;
-		execve(shell, argv, env);
-
-		/* Executing the shell failed. */
-		perror(shell);
-		exit(1);
-	}
-	/*
-	 * Execute the command using the user's shell.  This uses the -c
-	 * option to execute the command.
-	 */
-	argv[0] = (char *) shell0;
-	argv[1] = "-c";
-	argv[2] = (char *) command;
-	argv[3] = NULL;
-	execve(shell, argv, env);
-	perror(shell);
-	exit(1);
-}
-
-Session *
-session_new(void)
-{
-	int i;
-	static int did_init = 0;
-	if (!did_init) {
-		debug("session_new: init");
-		for (i = 0; i < MAX_SESSIONS; i++) {
-			sessions[i].used = 0;
-		}
-		did_init = 1;
-	}
-	for (i = 0; i < MAX_SESSIONS; i++) {
-		Session *s = &sessions[i];
-		if (! s->used) {
-			memset(s, 0, sizeof(*s));
-			s->chanid = -1;
-			s->ptyfd = -1;
-			s->ttyfd = -1;
-			s->used = 1;
-			s->self = i;
-			debug("session_new: session %d", i);
-			return s;
-		}
-	}
-	return NULL;
-}
-
-static void
-session_dump(void)
-{
-	int i;
-	for (i = 0; i < MAX_SESSIONS; i++) {
-		Session *s = &sessions[i];
-		debug("dump: used %d session %d %p channel %d pid %ld",
-		    s->used,
-		    s->self,
-		    s,
-		    s->chanid,
-		    (long)s->pid);
-	}
-}
-
-int
-session_open(Authctxt *authctxt, int chanid)
-{
-	Session *s = session_new();
-	debug("session_open: channel %d", chanid);
-	if (s == NULL) {
-		error("no more sessions");
-		return 0;
-	}
-	s->authctxt = authctxt;
-	s->pw = authctxt->pw;
-	if (s->pw == NULL)
-		fatal("no user for session %d", s->self);
-	debug("session_open: session %d: link with channel %d", s->self, chanid);
-	s->chanid = chanid;
-	return 1;
-}
-
-Session *
-session_by_tty(char *tty)
-{
-	int i;
-	for (i = 0; i < MAX_SESSIONS; i++) {
-		Session *s = &sessions[i];
-		if (s->used && s->ttyfd != -1 && strcmp(s->tty, tty) == 0) {
-			debug("session_by_tty: session %d tty %s", i, tty);
-			return s;
-		}
-	}
-	debug("session_by_tty: unknown tty %.100s", tty);
-	session_dump();
-	return NULL;
-}
-
-static Session *
-session_by_channel(int id)
-{
-	int i;
-	for (i = 0; i < MAX_SESSIONS; i++) {
-		Session *s = &sessions[i];
-		if (s->used && s->chanid == id) {
-			debug("session_by_channel: session %d channel %d", i, id);
-			return s;
-		}
-	}
-	debug("session_by_channel: unknown channel %d", id);
-	session_dump();
-	return NULL;
-}
-
-static Session *
-session_by_pid(pid_t pid)
-{
-	int i;
-	debug("session_by_pid: pid %ld", (long)pid);
-	for (i = 0; i < MAX_SESSIONS; i++) {
-		Session *s = &sessions[i];
-		if (s->used && s->pid == pid)
-			return s;
-	}
-	error("session_by_pid: unknown pid %ld", (long)pid);
-	session_dump();
-	return NULL;
-}
-
-static int
-session_window_change_req(Session *s)
-{
-	s->col = packet_get_int();
-	s->row = packet_get_int();
-	s->xpixel = packet_get_int();
-	s->ypixel = packet_get_int();
-	packet_check_eom();
-	pty_change_window_size(s->ptyfd, s->row, s->col, s->xpixel, s->ypixel);
-	return 1;
-}
-
-static int
-session_pty_req(Session *s)
-{
-	u_int len;
-	int n_bytes;
-
-	if (no_pty_flag) {
-		debug("Allocating a pty not permitted for this authentication.");
-		return 0;
-	}
-	if (s->ttyfd != -1) {
-		packet_disconnect("Protocol error: you already have a pty.");
-		return 0;
-	}
-	/* Get the time and hostname when the user last logged in. */
-	if (options.print_lastlog) {
-		s->hostname[0] = '\0';
-		s->last_login_time = get_last_login_time(s->pw->pw_uid,
-		    s->pw->pw_name, s->hostname, sizeof(s->hostname));
-	}
-
-	s->term = packet_get_string(&len);
-
-	if (compat20) {
-		s->col = packet_get_int();
-		s->row = packet_get_int();
-	} else {
-		s->row = packet_get_int();
-		s->col = packet_get_int();
-	}
-	s->xpixel = packet_get_int();
-	s->ypixel = packet_get_int();
-
-	if (strcmp(s->term, "") == 0) {
-		xfree(s->term);
-		s->term = NULL;
-	}
-
-	/* Allocate a pty and open it. */
-	debug("Allocating pty.");
-	if (!PRIVSEP(pty_allocate(&s->ptyfd, &s->ttyfd, s->tty, sizeof(s->tty)))) {
-		if (s->term)
-			xfree(s->term);
-		s->term = NULL;
-		s->ptyfd = -1;
-		s->ttyfd = -1;
-		error("session_pty_req: session %d alloc failed", s->self);
-		return 0;
-	}
-	debug("session_pty_req: session %d alloc %s", s->self, s->tty);
-
-	/* for SSH1 the tty modes length is not given */
-	if (!compat20)
-		n_bytes = packet_remaining();
-	tty_parse_modes(s->ttyfd, &n_bytes);
-
-	/*
-	 * Add a cleanup function to clear the utmp entry and record logout
-	 * time in case we call fatal() (e.g., the connection gets closed).
-	 */
-	fatal_add_cleanup(session_pty_cleanup, (void *)s);
-	if (!use_privsep)
-		pty_setowner(s->pw, s->tty);
-
-	/* Set window size from the packet. */
-	pty_change_window_size(s->ptyfd, s->row, s->col, s->xpixel, s->ypixel);
-
-	packet_check_eom();
-	session_proctitle(s);
-	return 1;
-}
-
-static int
-session_subsystem_req(Session *s)
-{
-	struct stat st;
-	u_int len;
-	int success = 0;
-	char *cmd, *subsys = packet_get_string(&len);
-	int i;
-
-	packet_check_eom();
-	log("subsystem request for %.100s", subsys);
-
-	for (i = 0; i < options.num_subsystems; i++) {
-		if (strcmp(subsys, options.subsystem_name[i]) == 0) {
-			cmd = options.subsystem_command[i];
-			if (stat(cmd, &st) < 0) {
-				error("subsystem: cannot stat %s: %s", cmd,
-				    strerror(errno));
-				break;
-			}
-			debug("subsystem: exec() %s", cmd);
-			s->is_subsystem = 1;
-			do_exec(s, cmd);
-			success = 1;
-			break;
-		}
-	}
-
-	if (!success)
-		log("subsystem request for %.100s failed, subsystem not found",
-		    subsys);
-
-	xfree(subsys);
-	return success;
-}
-
-static int
-session_x11_req(Session *s)
-{
-	int success;
-
-	s->single_connection = packet_get_char();
-	s->auth_proto = packet_get_string(NULL);
-	s->auth_data = packet_get_string(NULL);
-	s->screen = packet_get_int();
-	packet_check_eom();
-
-	success = session_setup_x11fwd(s);
-	if (!success) {
-		xfree(s->auth_proto);
-		xfree(s->auth_data);
-		s->auth_proto = NULL;
-		s->auth_data = NULL;
-	}
-	return success;
-}
-
-static int
-session_shell_req(Session *s)
-{
-	packet_check_eom();
-	do_exec(s, NULL);
-	return 1;
-}
-
-static int
-session_exec_req(Session *s)
-{
-	u_int len;
-	char *command = packet_get_string(&len);
-	packet_check_eom();
-	do_exec(s, command);
-	xfree(command);
-	return 1;
-}
-
-static int
-session_auth_agent_req(Session *s)
-{
-	static int called = 0;
-	packet_check_eom();
-	if (no_agent_forwarding_flag) {
-		debug("session_auth_agent_req: no_agent_forwarding_flag");
-		return 0;
-	}
-	if (called) {
-		return 0;
-	} else {
-		called = 1;
-		return auth_input_request_forwarding(s->pw);
-	}
-}
-
-int
-session_input_channel_req(Channel *c, const char *rtype)
-{
-	int success = 0;
-	Session *s;
-
-	if ((s = session_by_channel(c->self)) == NULL) {
-		log("session_input_channel_req: no session %d req %.100s",
-		    c->self, rtype);
-		return 0;
-	}
-	debug("session_input_channel_req: session %d req %s", s->self, rtype);
-
-	/*
-	 * a session is in LARVAL state until a shell, a command
-	 * or a subsystem is executed
-	 */
-	if (c->type == SSH_CHANNEL_LARVAL) {
-		if (strcmp(rtype, "shell") == 0) {
-			success = session_shell_req(s);
-		} else if (strcmp(rtype, "exec") == 0) {
-			success = session_exec_req(s);
-		} else if (strcmp(rtype, "pty-req") == 0) {
-			success =  session_pty_req(s);
-		} else if (strcmp(rtype, "x11-req") == 0) {
-			success = session_x11_req(s);
-		} else if (strcmp(rtype, "auth-agent-req@openssh.com") == 0) {
-			success = session_auth_agent_req(s);
-		} else if (strcmp(rtype, "subsystem") == 0) {
-			success = session_subsystem_req(s);
-		}
-	}
-	if (strcmp(rtype, "window-change") == 0) {
-		success = session_window_change_req(s);
-	}
-	return success;
-}
-
-void
-session_set_fds(Session *s, int fdin, int fdout, int fderr)
-{
-	if (!compat20)
-		fatal("session_set_fds: called for proto != 2.0");
-	/*
-	 * now that have a child and a pipe to the child,
-	 * we can activate our channel and register the fd's
-	 */
-	if (s->chanid == -1)
-		fatal("no channel for session %d", s->self);
-	channel_set_fds(s->chanid,
-	    fdout, fdin, fderr,
-	    fderr == -1 ? CHAN_EXTENDED_IGNORE : CHAN_EXTENDED_READ,
-	    1,
-	    CHAN_SES_WINDOW_DEFAULT);
-}
-
-/*
- * Function to perform pty cleanup. Also called if we get aborted abnormally
- * (e.g., due to a dropped connection).
- */
-void
-session_pty_cleanup2(void *session)
-{
-	Session *s = session;
-
-	if (s == NULL) {
-		error("session_pty_cleanup: no session");
-		return;
-	}
-	if (s->ttyfd == -1)
-		return;
-
-	debug("session_pty_cleanup: session %d release %s", s->self, s->tty);
-
-	/* Record that the user has logged out. */
-	if (s->pid != 0)
-		record_logout(s->pid, s->tty, s->pw->pw_name);
-
-	/* Release the pseudo-tty. */
-	if (getuid() == 0)
-		pty_release(s->tty);
-
-	/*
-	 * Close the server side of the socket pairs.  We must do this after
-	 * the pty cleanup, so that another process doesn't get this pty
-	 * while we're still cleaning up.
-	 */
-	if (close(s->ptymaster) < 0)
-		error("close(s->ptymaster/%d): %s", s->ptymaster, strerror(errno));
-
-	/* unlink pty from session */
-	s->ttyfd = -1;
-}
-
-void
-session_pty_cleanup(void *session)
-{
-	PRIVSEP(session_pty_cleanup2(session));
-}
-
-static char *
-sig2name(int sig)
-{
-#define SSH_SIG(x) if (sig == SIG ## x) return #x
-	SSH_SIG(ABRT);
-	SSH_SIG(ALRM);
-	SSH_SIG(FPE);
-	SSH_SIG(HUP);
-	SSH_SIG(ILL);
-	SSH_SIG(INT);
-	SSH_SIG(KILL);
-	SSH_SIG(PIPE);
-	SSH_SIG(QUIT);
-	SSH_SIG(SEGV);
-	SSH_SIG(TERM);
-	SSH_SIG(USR1);
-	SSH_SIG(USR2);
-#undef	SSH_SIG
-	return "SIG@openssh.com";
-}
-
-static void
-session_exit_message(Session *s, int status)
-{
-	Channel *c;
-
-	if ((c = channel_lookup(s->chanid)) == NULL)
-		fatal("session_exit_message: session %d: no channel %d",
-		    s->self, s->chanid);
-	debug("session_exit_message: session %d channel %d pid %ld",
-	    s->self, s->chanid, (long)s->pid);
-
-	if (WIFEXITED(status)) {
-		channel_request_start(s->chanid, "exit-status", 0);
-		packet_put_int(WEXITSTATUS(status));
-		packet_send();
-	} else if (WIFSIGNALED(status)) {
-		channel_request_start(s->chanid, "exit-signal", 0);
-		packet_put_cstring(sig2name(WTERMSIG(status)));
-#ifdef WCOREDUMP
-		packet_put_char(WCOREDUMP(status));
-#else /* WCOREDUMP */
-		packet_put_char(0);
-#endif /* WCOREDUMP */
-		packet_put_cstring("");
-		packet_put_cstring("");
-		packet_send();
-	} else {
-		/* Some weird exit cause.  Just exit. */
-		packet_disconnect("wait returned status %04x.", status);
-	}
-
-	/* disconnect channel */
-	debug("session_exit_message: release channel %d", s->chanid);
-	channel_cancel_cleanup(s->chanid);
-	/*
-	 * emulate a write failure with 'chan_write_failed', nobody will be
-	 * interested in data we write.
-	 * Note that we must not call 'chan_read_failed', since there could
-	 * be some more data waiting in the pipe.
-	 */
-	if (c->ostate != CHAN_OUTPUT_CLOSED)
-		chan_write_failed(c);
-	s->chanid = -1;
-}
-
-void
-session_close(Session *s)
-{
-	debug("session_close: session %d pid %ld", s->self, (long)s->pid);
-	if (s->ttyfd != -1) {
-		fatal_remove_cleanup(session_pty_cleanup, (void *)s);
-		session_pty_cleanup(s);
-	}
-	if (s->term)
-		xfree(s->term);
-	if (s->display)
-		xfree(s->display);
-	if (s->auth_display)
-		xfree(s->auth_display);
-	if (s->auth_data)
-		xfree(s->auth_data);
-	if (s->auth_proto)
-		xfree(s->auth_proto);
-	s->used = 0;
-	session_proctitle(s);
-}
-
-void
-session_close_by_pid(pid_t pid, int status)
-{
-	Session *s = session_by_pid(pid);
-	if (s == NULL) {
-		debug("session_close_by_pid: no session for pid %ld",
-		    (long)pid);
-		return;
-	}
-	if (s->chanid != -1)
-		session_exit_message(s, status);
-	session_close(s);
-}
-
-/*
- * this is called when a channel dies before
- * the session 'child' itself dies
- */
-void
-session_close_by_channel(int id, void *arg)
-{
-	Session *s = session_by_channel(id);
-	if (s == NULL) {
-		debug("session_close_by_channel: no session for id %d", id);
-		return;
-	}
-	debug("session_close_by_channel: channel %d child %ld",
-	    id, (long)s->pid);
-	if (s->pid != 0) {
-		debug("session_close_by_channel: channel %d: has child", id);
-		/*
-		 * delay detach of session, but release pty, since
-		 * the fd's to the child are already closed
-		 */
-		if (s->ttyfd != -1) {
-			fatal_remove_cleanup(session_pty_cleanup, (void *)s);
-			session_pty_cleanup(s);
-		}
-		return;
-	}
-	/* detach by removing callback */
-	channel_cancel_cleanup(s->chanid);
-	s->chanid = -1;
-	session_close(s);
-}
-
-void
-session_destroy_all(void (*closefunc)(Session *))
-{
-	int i;
-	for (i = 0; i < MAX_SESSIONS; i++) {
-		Session *s = &sessions[i];
-		if (s->used) {
-			if (closefunc != NULL)
-				closefunc(s);
-			else
-				session_close(s);
-		}
-	}
-}
-
-static char *
-session_tty_list(void)
-{
-	static char buf[1024];
-	int i;
-	char *cp;
-
-	buf[0] = '\0';
-	for (i = 0; i < MAX_SESSIONS; i++) {
-		Session *s = &sessions[i];
-		if (s->used && s->ttyfd != -1) {
-			
-			if (strncmp(s->tty, "/dev/", 5) != 0) {
-				cp = strrchr(s->tty, '/');
-				cp = (cp == NULL) ? s->tty : cp + 1;
-			} else
-				cp = s->tty + 5;
-			
-			if (buf[0] != '\0')
-				strlcat(buf, ",", sizeof buf);
-			strlcat(buf, cp, sizeof buf);
-		}
-	}
-	if (buf[0] == '\0')
-		strlcpy(buf, "notty", sizeof buf);
-	return buf;
-}
-
-void
-session_proctitle(Session *s)
-{
-	if (s->pw == NULL)
-		error("no user for session %d", s->self);
-	else
-		setproctitle("%s@%s", s->pw->pw_name, session_tty_list());
-}
-
-int
-session_setup_x11fwd(Session *s)
-{
-	struct stat st;
-	char display[512], auth_display[512];
-	char hostname[MAXHOSTNAMELEN];
-
-	if (no_x11_forwarding_flag) {
-		packet_send_debug("X11 forwarding disabled in user configuration file.");
-		return 0;
-	}
-	if (!options.x11_forwarding) {
-		debug("X11 forwarding disabled in server configuration file.");
-		return 0;
-	}
-	if (!options.xauth_location ||
-	    (stat(options.xauth_location, &st) == -1)) {
-		packet_send_debug("No xauth program; cannot forward with spoofing.");
-		return 0;
-	}
-	if (options.use_login) {
-		packet_send_debug("X11 forwarding disabled; "
-		    "not compatible with UseLogin=yes.");
-		return 0;
-	}
-	if (s->display != NULL) {
-		debug("X11 display already set.");
-		return 0;
-	}
-	if (x11_create_display_inet(options.x11_display_offset,
-	    options.x11_use_localhost, s->single_connection,
-	    &s->display_number) == -1) {
-		debug("x11_create_display_inet failed.");
-		return 0;
-	}
-
-	/* Set up a suitable value for the DISPLAY variable. */
-	if (gethostname(hostname, sizeof(hostname)) < 0)
-		fatal("gethostname: %.100s", strerror(errno));
-	/*
-	 * auth_display must be used as the displayname when the
-	 * authorization entry is added with xauth(1).  This will be
-	 * different than the DISPLAY string for localhost displays.
-	 */
-	if (options.x11_use_localhost) {
-		snprintf(display, sizeof display, "localhost:%u.%u",
-		    s->display_number, s->screen);
-		snprintf(auth_display, sizeof auth_display, "unix:%u.%u",
-		    s->display_number, s->screen);
-		s->display = xstrdup(display);
-		s->auth_display = xstrdup(auth_display);
-	} else {
-#ifdef IPADDR_IN_DISPLAY
-		struct hostent *he;
-		struct in_addr my_addr;
-
-		he = gethostbyname(hostname);
-		if (he == NULL) {
-			error("Can't get IP address for X11 DISPLAY.");
-			packet_send_debug("Can't get IP address for X11 DISPLAY.");
-			return 0;
-		}
-		memcpy(&my_addr, he->h_addr_list[0], sizeof(struct in_addr));
-		snprintf(display, sizeof display, "%.50s:%u.%u", inet_ntoa(my_addr),
-		    s->display_number, s->screen);
-#else
-		snprintf(display, sizeof display, "%.400s:%u.%u", hostname,
-		    s->display_number, s->screen);
-#endif
-		s->display = xstrdup(display);
-		s->auth_display = xstrdup(display);
-	}
-
-	return 1;
-}
-
-static void
-do_authenticated2(Authctxt *authctxt)
-{
-	server_loop2(authctxt);
-}
diff --git a/crypto/openssh/session.h b/crypto/openssh/session.h
deleted file mode 100644
index d3ddfab75f98..000000000000
--- a/crypto/openssh/session.h
+++ /dev/null
@@ -1,71 +0,0 @@
-/*	$OpenBSD: session.h,v 1.19 2002/06/30 21:59:45 deraadt Exp $	*/
-
-/*
- * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#ifndef SESSION_H
-#define SESSION_H
-
-#define TTYSZ 64
-typedef struct Session Session;
-struct Session {
-	int	used;
-	int	self;
-	struct passwd *pw;
-	Authctxt *authctxt;
-	pid_t	pid;
-	/* tty */
-	char	*term;
-	int	ptyfd, ttyfd, ptymaster;
-	u_int	row, col, xpixel, ypixel;
-	char	tty[TTYSZ];
-	/* last login */
-	char	hostname[MAXHOSTNAMELEN];
-	time_t	last_login_time;
-	/* X11 */
-	u_int	display_number;
-	char	*display;
-	u_int	screen;
-	char	*auth_display;
-	char	*auth_proto;
-	char	*auth_data;
-	int	single_connection;
-	/* proto 2 */
-	int	chanid;
-	int	is_subsystem;
-};
-
-void	 do_authenticated(Authctxt *);
-
-int	 session_open(Authctxt *, int);
-int	 session_input_channel_req(Channel *, const char *);
-void	 session_close_by_pid(pid_t, int);
-void	 session_close_by_channel(int, void *);
-void	 session_destroy_all(void (*)(Session *));
-void	 session_pty_cleanup2(void *);
-
-Session	*session_new(void);
-Session	*session_by_tty(char *);
-void	 session_close(Session *);
-void	 do_setusercontext(struct passwd *);
-#endif
diff --git a/crypto/openssh/sftp-client.c b/crypto/openssh/sftp-client.c
deleted file mode 100644
index 3b3279e65e87..000000000000
--- a/crypto/openssh/sftp-client.c
+++ /dev/null
@@ -1,1150 +0,0 @@
-/*
- * Copyright (c) 2001-2003 Damien Miller.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/* XXX: memleaks */
-/* XXX: signed vs unsigned */
-/* XXX: remove all logging, only return status codes */
-/* XXX: copy between two remote sites */
-
-#include "includes.h"
-RCSID("$OpenBSD: sftp-client.c,v 1.42 2003/03/05 22:33:43 markus Exp $");
-
-#include "openbsd-compat/sys-queue.h"
-
-#include "buffer.h"
-#include "bufaux.h"
-#include "getput.h"
-#include "xmalloc.h"
-#include "log.h"
-#include "atomicio.h"
-#include "progressmeter.h"
-
-#include "sftp.h"
-#include "sftp-common.h"
-#include "sftp-client.h"
-
-extern int showprogress;
-
-/* Minimum amount of data to read at at time */
-#define MIN_READ_SIZE	512
-
-/* Maximum packet size */
-#define MAX_MSG_LENGTH	(256 * 1024)
-
-struct sftp_conn {
-	int fd_in;
-	int fd_out;
-	u_int transfer_buflen;
-	u_int num_requests;
-	u_int version;
-	u_int msg_id;
-};
-
-static void
-send_msg(int fd, Buffer *m)
-{
-	u_char mlen[4];
-
-	if (buffer_len(m) > MAX_MSG_LENGTH)
-		fatal("Outbound message too long %u", buffer_len(m));
-
-	/* Send length first */
-	PUT_32BIT(mlen, buffer_len(m));
-	if (atomicio(write, fd, mlen, sizeof(mlen)) <= 0)
-		fatal("Couldn't send packet: %s", strerror(errno));
-
-	if (atomicio(write, fd, buffer_ptr(m), buffer_len(m)) <= 0)
-		fatal("Couldn't send packet: %s", strerror(errno));
-
-	buffer_clear(m);
-}
-
-static void
-get_msg(int fd, Buffer *m)
-{
-	ssize_t len;
-	u_int msg_len;
-
-	buffer_append_space(m, 4);
-	len = atomicio(read, fd, buffer_ptr(m), 4);
-	if (len == 0)
-		fatal("Connection closed");
-	else if (len == -1)
-		fatal("Couldn't read packet: %s", strerror(errno));
-
-	msg_len = buffer_get_int(m);
-	if (msg_len > MAX_MSG_LENGTH)
-		fatal("Received message too long %u", msg_len);
-
-	buffer_append_space(m, msg_len);
-	len = atomicio(read, fd, buffer_ptr(m), msg_len);
-	if (len == 0)
-		fatal("Connection closed");
-	else if (len == -1)
-		fatal("Read packet: %s", strerror(errno));
-}
-
-static void
-send_string_request(int fd, u_int id, u_int code, char *s,
-    u_int len)
-{
-	Buffer msg;
-
-	buffer_init(&msg);
-	buffer_put_char(&msg, code);
-	buffer_put_int(&msg, id);
-	buffer_put_string(&msg, s, len);
-	send_msg(fd, &msg);
-	debug3("Sent message fd %d T:%u I:%u", fd, code, id);
-	buffer_free(&msg);
-}
-
-static void
-send_string_attrs_request(int fd, u_int id, u_int code, char *s,
-    u_int len, Attrib *a)
-{
-	Buffer msg;
-
-	buffer_init(&msg);
-	buffer_put_char(&msg, code);
-	buffer_put_int(&msg, id);
-	buffer_put_string(&msg, s, len);
-	encode_attrib(&msg, a);
-	send_msg(fd, &msg);
-	debug3("Sent message fd %d T:%u I:%u", fd, code, id);
-	buffer_free(&msg);
-}
-
-static u_int
-get_status(int fd, u_int expected_id)
-{
-	Buffer msg;
-	u_int type, id, status;
-
-	buffer_init(&msg);
-	get_msg(fd, &msg);
-	type = buffer_get_char(&msg);
-	id = buffer_get_int(&msg);
-
-	if (id != expected_id)
-		fatal("ID mismatch (%u != %u)", id, expected_id);
-	if (type != SSH2_FXP_STATUS)
-		fatal("Expected SSH2_FXP_STATUS(%u) packet, got %u",
-		    SSH2_FXP_STATUS, type);
-
-	status = buffer_get_int(&msg);
-	buffer_free(&msg);
-
-	debug3("SSH2_FXP_STATUS %u", status);
-
-	return(status);
-}
-
-static char *
-get_handle(int fd, u_int expected_id, u_int *len)
-{
-	Buffer msg;
-	u_int type, id;
-	char *handle;
-
-	buffer_init(&msg);
-	get_msg(fd, &msg);
-	type = buffer_get_char(&msg);
-	id = buffer_get_int(&msg);
-
-	if (id != expected_id)
-		fatal("ID mismatch (%u != %u)", id, expected_id);
-	if (type == SSH2_FXP_STATUS) {
-		int status = buffer_get_int(&msg);
-
-		error("Couldn't get handle: %s", fx2txt(status));
-		return(NULL);
-	} else if (type != SSH2_FXP_HANDLE)
-		fatal("Expected SSH2_FXP_HANDLE(%u) packet, got %u",
-		    SSH2_FXP_HANDLE, type);
-
-	handle = buffer_get_string(&msg, len);
-	buffer_free(&msg);
-
-	return(handle);
-}
-
-static Attrib *
-get_decode_stat(int fd, u_int expected_id, int quiet)
-{
-	Buffer msg;
-	u_int type, id;
-	Attrib *a;
-
-	buffer_init(&msg);
-	get_msg(fd, &msg);
-
-	type = buffer_get_char(&msg);
-	id = buffer_get_int(&msg);
-
-	debug3("Received stat reply T:%u I:%u", type, id);
-	if (id != expected_id)
-		fatal("ID mismatch (%u != %u)", id, expected_id);
-	if (type == SSH2_FXP_STATUS) {
-		int status = buffer_get_int(&msg);
-
-		if (quiet)
-			debug("Couldn't stat remote file: %s", fx2txt(status));
-		else
-			error("Couldn't stat remote file: %s", fx2txt(status));
-		return(NULL);
-	} else if (type != SSH2_FXP_ATTRS) {
-		fatal("Expected SSH2_FXP_ATTRS(%u) packet, got %u",
-		    SSH2_FXP_ATTRS, type);
-	}
-	a = decode_attrib(&msg);
-	buffer_free(&msg);
-
-	return(a);
-}
-
-struct sftp_conn *
-do_init(int fd_in, int fd_out, u_int transfer_buflen, u_int num_requests)
-{
-	u_int type;
-	int version;
-	Buffer msg;
-	struct sftp_conn *ret;
-
-	buffer_init(&msg);
-	buffer_put_char(&msg, SSH2_FXP_INIT);
-	buffer_put_int(&msg, SSH2_FILEXFER_VERSION);
-	send_msg(fd_out, &msg);
-
-	buffer_clear(&msg);
-
-	get_msg(fd_in, &msg);
-
-	/* Expecting a VERSION reply */
-	if ((type = buffer_get_char(&msg)) != SSH2_FXP_VERSION) {
-		error("Invalid packet back from SSH2_FXP_INIT (type %u)",
-		    type);
-		buffer_free(&msg);
-		return(NULL);
-	}
-	version = buffer_get_int(&msg);
-
-	debug2("Remote version: %d", version);
-
-	/* Check for extensions */
-	while (buffer_len(&msg) > 0) {
-		char *name = buffer_get_string(&msg, NULL);
-		char *value = buffer_get_string(&msg, NULL);
-
-		debug2("Init extension: \"%s\"", name);
-		xfree(name);
-		xfree(value);
-	}
-
-	buffer_free(&msg);
-
-	ret = xmalloc(sizeof(*ret));
-	ret->fd_in = fd_in;
-	ret->fd_out = fd_out;
-	ret->transfer_buflen = transfer_buflen;
-	ret->num_requests = num_requests;
-	ret->version = version;
-	ret->msg_id = 1;
-
-	/* Some filexfer v.0 servers don't support large packets */
-	if (version == 0)
-		ret->transfer_buflen = MIN(ret->transfer_buflen, 20480);
-
-	return(ret);
-}
-
-u_int
-sftp_proto_version(struct sftp_conn *conn)
-{
-	return(conn->version);
-}
-
-int
-do_close(struct sftp_conn *conn, char *handle, u_int handle_len)
-{
-	u_int id, status;
-	Buffer msg;
-
-	buffer_init(&msg);
-
-	id = conn->msg_id++;
-	buffer_put_char(&msg, SSH2_FXP_CLOSE);
-	buffer_put_int(&msg, id);
-	buffer_put_string(&msg, handle, handle_len);
-	send_msg(conn->fd_out, &msg);
-	debug3("Sent message SSH2_FXP_CLOSE I:%u", id);
-
-	status = get_status(conn->fd_in, id);
-	if (status != SSH2_FX_OK)
-		error("Couldn't close file: %s", fx2txt(status));
-
-	buffer_free(&msg);
-
-	return(status);
-}
-
-
-static int
-do_lsreaddir(struct sftp_conn *conn, char *path, int printflag,
-    SFTP_DIRENT ***dir)
-{
-	Buffer msg;
-	u_int type, id, handle_len, i, expected_id, ents = 0;
-	char *handle;
-
-	id = conn->msg_id++;
-
-	buffer_init(&msg);
-	buffer_put_char(&msg, SSH2_FXP_OPENDIR);
-	buffer_put_int(&msg, id);
-	buffer_put_cstring(&msg, path);
-	send_msg(conn->fd_out, &msg);
-
-	buffer_clear(&msg);
-
-	handle = get_handle(conn->fd_in, id, &handle_len);
-	if (handle == NULL)
-		return(-1);
-
-	if (dir) {
-		ents = 0;
-		*dir = xmalloc(sizeof(**dir));
-		(*dir)[0] = NULL;
-	}
-
-	for (;;) {
-		int count;
-
-		id = expected_id = conn->msg_id++;
-
-		debug3("Sending SSH2_FXP_READDIR I:%u", id);
-
-		buffer_clear(&msg);
-		buffer_put_char(&msg, SSH2_FXP_READDIR);
-		buffer_put_int(&msg, id);
-		buffer_put_string(&msg, handle, handle_len);
-		send_msg(conn->fd_out, &msg);
-
-		buffer_clear(&msg);
-
-		get_msg(conn->fd_in, &msg);
-
-		type = buffer_get_char(&msg);
-		id = buffer_get_int(&msg);
-
-		debug3("Received reply T:%u I:%u", type, id);
-
-		if (id != expected_id)
-			fatal("ID mismatch (%u != %u)", id, expected_id);
-
-		if (type == SSH2_FXP_STATUS) {
-			int status = buffer_get_int(&msg);
-
-			debug3("Received SSH2_FXP_STATUS %d", status);
-
-			if (status == SSH2_FX_EOF) {
-				break;
-			} else {
-				error("Couldn't read directory: %s",
-				    fx2txt(status));
-				do_close(conn, handle, handle_len);
-				xfree(handle);
-				return(status);
-			}
-		} else if (type != SSH2_FXP_NAME)
-			fatal("Expected SSH2_FXP_NAME(%u) packet, got %u",
-			    SSH2_FXP_NAME, type);
-
-		count = buffer_get_int(&msg);
-		if (count == 0)
-			break;
-		debug3("Received %d SSH2_FXP_NAME responses", count);
-		for (i = 0; i < count; i++) {
-			char *filename, *longname;
-			Attrib *a;
-
-			filename = buffer_get_string(&msg, NULL);
-			longname = buffer_get_string(&msg, NULL);
-			a = decode_attrib(&msg);
-
-			if (printflag)
-				printf("%s\n", longname);
-
-			if (dir) {
-				*dir = xrealloc(*dir, sizeof(**dir) *
-				    (ents + 2));
-				(*dir)[ents] = xmalloc(sizeof(***dir));
-				(*dir)[ents]->filename = xstrdup(filename);
-				(*dir)[ents]->longname = xstrdup(longname);
-				memcpy(&(*dir)[ents]->a, a, sizeof(*a));
-				(*dir)[++ents] = NULL;
-			}
-
-			xfree(filename);
-			xfree(longname);
-		}
-	}
-
-	buffer_free(&msg);
-	do_close(conn, handle, handle_len);
-	xfree(handle);
-
-	return(0);
-}
-
-int
-do_readdir(struct sftp_conn *conn, char *path, SFTP_DIRENT ***dir)
-{
-	return(do_lsreaddir(conn, path, 0, dir));
-}
-
-void free_sftp_dirents(SFTP_DIRENT **s)
-{
-	int i;
-
-	for (i = 0; s[i]; i++) {
-		xfree(s[i]->filename);
-		xfree(s[i]->longname);
-		xfree(s[i]);
-	}
-	xfree(s);
-}
-
-int
-do_rm(struct sftp_conn *conn, char *path)
-{
-	u_int status, id;
-
-	debug2("Sending SSH2_FXP_REMOVE \"%s\"", path);
-
-	id = conn->msg_id++;
-	send_string_request(conn->fd_out, id, SSH2_FXP_REMOVE, path,
-	    strlen(path));
-	status = get_status(conn->fd_in, id);
-	if (status != SSH2_FX_OK)
-		error("Couldn't delete file: %s", fx2txt(status));
-	return(status);
-}
-
-int
-do_mkdir(struct sftp_conn *conn, char *path, Attrib *a)
-{
-	u_int status, id;
-
-	id = conn->msg_id++;
-	send_string_attrs_request(conn->fd_out, id, SSH2_FXP_MKDIR, path,
-	    strlen(path), a);
-
-	status = get_status(conn->fd_in, id);
-	if (status != SSH2_FX_OK)
-		error("Couldn't create directory: %s", fx2txt(status));
-
-	return(status);
-}
-
-int
-do_rmdir(struct sftp_conn *conn, char *path)
-{
-	u_int status, id;
-
-	id = conn->msg_id++;
-	send_string_request(conn->fd_out, id, SSH2_FXP_RMDIR, path,
-	    strlen(path));
-
-	status = get_status(conn->fd_in, id);
-	if (status != SSH2_FX_OK)
-		error("Couldn't remove directory: %s", fx2txt(status));
-
-	return(status);
-}
-
-Attrib *
-do_stat(struct sftp_conn *conn, char *path, int quiet)
-{
-	u_int id;
-
-	id = conn->msg_id++;
-
-	send_string_request(conn->fd_out, id,
-	    conn->version == 0 ? SSH2_FXP_STAT_VERSION_0 : SSH2_FXP_STAT,
-	    path, strlen(path));
-
-	return(get_decode_stat(conn->fd_in, id, quiet));
-}
-
-Attrib *
-do_lstat(struct sftp_conn *conn, char *path, int quiet)
-{
-	u_int id;
-
-	if (conn->version == 0) {
-		if (quiet)
-			debug("Server version does not support lstat operation");
-		else
-			log("Server version does not support lstat operation");
-		return(do_stat(conn, path, quiet));
-	}
-
-	id = conn->msg_id++;
-	send_string_request(conn->fd_out, id, SSH2_FXP_LSTAT, path,
-	    strlen(path));
-
-	return(get_decode_stat(conn->fd_in, id, quiet));
-}
-
-Attrib *
-do_fstat(struct sftp_conn *conn, char *handle, u_int handle_len, int quiet)
-{
-	u_int id;
-
-	id = conn->msg_id++;
-	send_string_request(conn->fd_out, id, SSH2_FXP_FSTAT, handle,
-	    handle_len);
-
-	return(get_decode_stat(conn->fd_in, id, quiet));
-}
-
-int
-do_setstat(struct sftp_conn *conn, char *path, Attrib *a)
-{
-	u_int status, id;
-
-	id = conn->msg_id++;
-	send_string_attrs_request(conn->fd_out, id, SSH2_FXP_SETSTAT, path,
-	    strlen(path), a);
-
-	status = get_status(conn->fd_in, id);
-	if (status != SSH2_FX_OK)
-		error("Couldn't setstat on \"%s\": %s", path,
-		    fx2txt(status));
-
-	return(status);
-}
-
-int
-do_fsetstat(struct sftp_conn *conn, char *handle, u_int handle_len,
-    Attrib *a)
-{
-	u_int status, id;
-
-	id = conn->msg_id++;
-	send_string_attrs_request(conn->fd_out, id, SSH2_FXP_FSETSTAT, handle,
-	    handle_len, a);
-
-	status = get_status(conn->fd_in, id);
-	if (status != SSH2_FX_OK)
-		error("Couldn't fsetstat: %s", fx2txt(status));
-
-	return(status);
-}
-
-char *
-do_realpath(struct sftp_conn *conn, char *path)
-{
-	Buffer msg;
-	u_int type, expected_id, count, id;
-	char *filename, *longname;
-	Attrib *a;
-
-	expected_id = id = conn->msg_id++;
-	send_string_request(conn->fd_out, id, SSH2_FXP_REALPATH, path,
-	    strlen(path));
-
-	buffer_init(&msg);
-
-	get_msg(conn->fd_in, &msg);
-	type = buffer_get_char(&msg);
-	id = buffer_get_int(&msg);
-
-	if (id != expected_id)
-		fatal("ID mismatch (%u != %u)", id, expected_id);
-
-	if (type == SSH2_FXP_STATUS) {
-		u_int status = buffer_get_int(&msg);
-
-		error("Couldn't canonicalise: %s", fx2txt(status));
-		return(NULL);
-	} else if (type != SSH2_FXP_NAME)
-		fatal("Expected SSH2_FXP_NAME(%u) packet, got %u",
-		    SSH2_FXP_NAME, type);
-
-	count = buffer_get_int(&msg);
-	if (count != 1)
-		fatal("Got multiple names (%d) from SSH_FXP_REALPATH", count);
-
-	filename = buffer_get_string(&msg, NULL);
-	longname = buffer_get_string(&msg, NULL);
-	a = decode_attrib(&msg);
-
-	debug3("SSH_FXP_REALPATH %s -> %s", path, filename);
-
-	xfree(longname);
-
-	buffer_free(&msg);
-
-	return(filename);
-}
-
-int
-do_rename(struct sftp_conn *conn, char *oldpath, char *newpath)
-{
-	Buffer msg;
-	u_int status, id;
-
-	buffer_init(&msg);
-
-	/* Send rename request */
-	id = conn->msg_id++;
-	buffer_put_char(&msg, SSH2_FXP_RENAME);
-	buffer_put_int(&msg, id);
-	buffer_put_cstring(&msg, oldpath);
-	buffer_put_cstring(&msg, newpath);
-	send_msg(conn->fd_out, &msg);
-	debug3("Sent message SSH2_FXP_RENAME \"%s\" -> \"%s\"", oldpath,
-	    newpath);
-	buffer_free(&msg);
-
-	status = get_status(conn->fd_in, id);
-	if (status != SSH2_FX_OK)
-		error("Couldn't rename file \"%s\" to \"%s\": %s", oldpath,
-		    newpath, fx2txt(status));
-
-	return(status);
-}
-
-int
-do_symlink(struct sftp_conn *conn, char *oldpath, char *newpath)
-{
-	Buffer msg;
-	u_int status, id;
-
-	if (conn->version < 3) {
-		error("This server does not support the symlink operation");
-		return(SSH2_FX_OP_UNSUPPORTED);
-	}
-
-	buffer_init(&msg);
-
-	/* Send rename request */
-	id = conn->msg_id++;
-	buffer_put_char(&msg, SSH2_FXP_SYMLINK);
-	buffer_put_int(&msg, id);
-	buffer_put_cstring(&msg, oldpath);
-	buffer_put_cstring(&msg, newpath);
-	send_msg(conn->fd_out, &msg);
-	debug3("Sent message SSH2_FXP_SYMLINK \"%s\" -> \"%s\"", oldpath,
-	    newpath);
-	buffer_free(&msg);
-
-	status = get_status(conn->fd_in, id);
-	if (status != SSH2_FX_OK)
-		error("Couldn't symlink file \"%s\" to \"%s\": %s", oldpath,
-		    newpath, fx2txt(status));
-
-	return(status);
-}
-
-char *
-do_readlink(struct sftp_conn *conn, char *path)
-{
-	Buffer msg;
-	u_int type, expected_id, count, id;
-	char *filename, *longname;
-	Attrib *a;
-
-	expected_id = id = conn->msg_id++;
-	send_string_request(conn->fd_out, id, SSH2_FXP_READLINK, path,
-	    strlen(path));
-
-	buffer_init(&msg);
-
-	get_msg(conn->fd_in, &msg);
-	type = buffer_get_char(&msg);
-	id = buffer_get_int(&msg);
-
-	if (id != expected_id)
-		fatal("ID mismatch (%u != %u)", id, expected_id);
-
-	if (type == SSH2_FXP_STATUS) {
-		u_int status = buffer_get_int(&msg);
-
-		error("Couldn't readlink: %s", fx2txt(status));
-		return(NULL);
-	} else if (type != SSH2_FXP_NAME)
-		fatal("Expected SSH2_FXP_NAME(%u) packet, got %u",
-		    SSH2_FXP_NAME, type);
-
-	count = buffer_get_int(&msg);
-	if (count != 1)
-		fatal("Got multiple names (%d) from SSH_FXP_READLINK", count);
-
-	filename = buffer_get_string(&msg, NULL);
-	longname = buffer_get_string(&msg, NULL);
-	a = decode_attrib(&msg);
-
-	debug3("SSH_FXP_READLINK %s -> %s", path, filename);
-
-	xfree(longname);
-
-	buffer_free(&msg);
-
-	return(filename);
-}
-
-static void
-send_read_request(int fd_out, u_int id, u_int64_t offset, u_int len,
-    char *handle, u_int handle_len)
-{
-	Buffer msg;
-
-	buffer_init(&msg);
-	buffer_clear(&msg);
-	buffer_put_char(&msg, SSH2_FXP_READ);
-	buffer_put_int(&msg, id);
-	buffer_put_string(&msg, handle, handle_len);
-	buffer_put_int64(&msg, offset);
-	buffer_put_int(&msg, len);
-	send_msg(fd_out, &msg);
-	buffer_free(&msg);
-}
-
-int
-do_download(struct sftp_conn *conn, char *remote_path, char *local_path,
-    int pflag)
-{
-	Attrib junk, *a;
-	Buffer msg;
-	char *handle;
-	int local_fd, status, num_req, max_req, write_error;
-	int read_error, write_errno;
-	u_int64_t offset, size;
-	u_int handle_len, mode, type, id, buflen;
-	off_t progress_counter;
-	struct request {
-		u_int id;
-		u_int len;
-		u_int64_t offset;
-		TAILQ_ENTRY(request) tq;
-	};
-	TAILQ_HEAD(reqhead, request) requests;
-	struct request *req;
-
-	TAILQ_INIT(&requests);
-
-	a = do_stat(conn, remote_path, 0);
-	if (a == NULL)
-		return(-1);
-
-	/* XXX: should we preserve set[ug]id? */
-	if (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS)
-		mode = a->perm & 0777;
-	else
-		mode = 0666;
-
-	if ((a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) &&
-	    (!S_ISREG(a->perm))) {
-		error("Cannot download non-regular file: %s", remote_path);
-		return(-1);
-	}
-
-	if (a->flags & SSH2_FILEXFER_ATTR_SIZE)
-		size = a->size;
-	else
-		size = 0;
-
-	buflen = conn->transfer_buflen;
-	buffer_init(&msg);
-
-	/* Send open request */
-	id = conn->msg_id++;
-	buffer_put_char(&msg, SSH2_FXP_OPEN);
-	buffer_put_int(&msg, id);
-	buffer_put_cstring(&msg, remote_path);
-	buffer_put_int(&msg, SSH2_FXF_READ);
-	attrib_clear(&junk); /* Send empty attributes */
-	encode_attrib(&msg, &junk);
-	send_msg(conn->fd_out, &msg);
-	debug3("Sent message SSH2_FXP_OPEN I:%u P:%s", id, remote_path);
-
-	handle = get_handle(conn->fd_in, id, &handle_len);
-	if (handle == NULL) {
-		buffer_free(&msg);
-		return(-1);
-	}
-
-	local_fd = open(local_path, O_WRONLY | O_CREAT | O_TRUNC, 
-	    mode | S_IWRITE);
-	if (local_fd == -1) {
-		error("Couldn't open local file \"%s\" for writing: %s",
-		    local_path, strerror(errno));
-		buffer_free(&msg);
-		xfree(handle);
-		return(-1);
-	}
-
-	/* Read from remote and write to local */
-	write_error = read_error = write_errno = num_req = offset = 0;
-	max_req = 1;
-	progress_counter = 0;
-
-	if (showprogress) {
-		if (size)
-			start_progress_meter(remote_path, size,
-			    &progress_counter);
-		else
-			printf("Fetching %s to %s\n", remote_path, local_path);
-	}
-
-	while (num_req > 0 || max_req > 0) {
-		char *data;
-		u_int len;
-
-		/* Send some more requests */
-		while (num_req < max_req) {
-			debug3("Request range %llu -> %llu (%d/%d)",
-			    (unsigned long long)offset,
-			    (unsigned long long)offset + buflen - 1,
-			    num_req, max_req);
-			req = xmalloc(sizeof(*req));
-			req->id = conn->msg_id++;
-			req->len = buflen;
-			req->offset = offset;
-			offset += buflen;
-			num_req++;
-			TAILQ_INSERT_TAIL(&requests, req, tq);
-			send_read_request(conn->fd_out, req->id, req->offset,
-			    req->len, handle, handle_len);
-		}
-
-		buffer_clear(&msg);
-		get_msg(conn->fd_in, &msg);
-		type = buffer_get_char(&msg);
-		id = buffer_get_int(&msg);
-		debug3("Received reply T:%u I:%u R:%d", type, id, max_req);
-
-		/* Find the request in our queue */
-		for(req = TAILQ_FIRST(&requests);
-		    req != NULL && req->id != id;
-		    req = TAILQ_NEXT(req, tq))
-			;
-		if (req == NULL)
-			fatal("Unexpected reply %u", id);
-
-		switch (type) {
-		case SSH2_FXP_STATUS:
-			status = buffer_get_int(&msg);
-			if (status != SSH2_FX_EOF)
-				read_error = 1;
-			max_req = 0;
-			TAILQ_REMOVE(&requests, req, tq);
-			xfree(req);
-			num_req--;
-			break;
-		case SSH2_FXP_DATA:
-			data = buffer_get_string(&msg, &len);
-			debug3("Received data %llu -> %llu",
-			    (unsigned long long)req->offset,
-			    (unsigned long long)req->offset + len - 1);
-			if (len > req->len)
-				fatal("Received more data than asked for "
-				    "%u > %u", len, req->len);
-			if ((lseek(local_fd, req->offset, SEEK_SET) == -1 ||
-			    atomicio(write, local_fd, data, len) != len) &&
-			    !write_error) {
-				write_errno = errno;
-				write_error = 1;
-				max_req = 0;
-			}
-			progress_counter += len;
-			xfree(data);
-
-			if (len == req->len) {
-				TAILQ_REMOVE(&requests, req, tq);
-				xfree(req);
-				num_req--;
-			} else {
-				/* Resend the request for the missing data */
-				debug3("Short data block, re-requesting "
-				    "%llu -> %llu (%2d)",
-				    (unsigned long long)req->offset + len,
-				    (unsigned long long)req->offset +
-				    req->len - 1, num_req);
-				req->id = conn->msg_id++;
-				req->len -= len;
-				req->offset += len;
-				send_read_request(conn->fd_out, req->id,
-				    req->offset, req->len, handle, handle_len);
-				/* Reduce the request size */
-				if (len < buflen)
-					buflen = MAX(MIN_READ_SIZE, len);
-			}
-			if (max_req > 0) { /* max_req = 0 iff EOF received */
-				if (size > 0 && offset > size) {
-					/* Only one request at a time
-					 * after the expected EOF */
-					debug3("Finish at %llu (%2d)",
-					    (unsigned long long)offset,
-					    num_req);
-					max_req = 1;
-				}
-				else if (max_req < conn->num_requests + 1) {
-					++max_req;
-				}
-			}
-			break;
-		default:
-			fatal("Expected SSH2_FXP_DATA(%u) packet, got %u",
-			    SSH2_FXP_DATA, type);
-		}
-	}
-
-	if (showprogress && size)
-		stop_progress_meter();
-
-	/* Sanity check */
-	if (TAILQ_FIRST(&requests) != NULL)
-		fatal("Transfer complete, but requests still in queue");
-
-	if (read_error) {
-		error("Couldn't read from remote file \"%s\" : %s",
-		    remote_path, fx2txt(status));
-		do_close(conn, handle, handle_len);
-	} else if (write_error) {
-		error("Couldn't write to \"%s\": %s", local_path,
-		    strerror(write_errno));
-		status = -1;
-		do_close(conn, handle, handle_len);
-	} else {
-		status = do_close(conn, handle, handle_len);
-
-		/* Override umask and utimes if asked */
-#ifdef HAVE_FCHMOD
-		if (pflag && fchmod(local_fd, mode) == -1)
-#else 
-		if (pflag && chmod(local_path, mode) == -1)
-#endif /* HAVE_FCHMOD */
-			error("Couldn't set mode on \"%s\": %s", local_path,
-			    strerror(errno));
-		if (pflag && (a->flags & SSH2_FILEXFER_ATTR_ACMODTIME)) {
-			struct timeval tv[2];
-			tv[0].tv_sec = a->atime;
-			tv[1].tv_sec = a->mtime;
-			tv[0].tv_usec = tv[1].tv_usec = 0;
-			if (utimes(local_path, tv) == -1)
-				error("Can't set times on \"%s\": %s",
-				    local_path, strerror(errno));
-		}
-	}
-	close(local_fd);
-	buffer_free(&msg);
-	xfree(handle);
-
-	return(status);
-}
-
-int
-do_upload(struct sftp_conn *conn, char *local_path, char *remote_path,
-    int pflag)
-{
-	int local_fd, status;
-	u_int handle_len, id, type;
-	u_int64_t offset;
-	char *handle, *data;
-	Buffer msg;
-	struct stat sb;
-	Attrib a;
-	u_int32_t startid;
-	u_int32_t ackid;
-	struct outstanding_ack {
-		u_int id;
-		u_int len;
-		u_int64_t offset;
-		TAILQ_ENTRY(outstanding_ack) tq;
-	};
-	TAILQ_HEAD(ackhead, outstanding_ack) acks;
-	struct outstanding_ack *ack;
-
-	TAILQ_INIT(&acks);
-
-	if ((local_fd = open(local_path, O_RDONLY, 0)) == -1) {
-		error("Couldn't open local file \"%s\" for reading: %s",
-		    local_path, strerror(errno));
-		return(-1);
-	}
-	if (fstat(local_fd, &sb) == -1) {
-		error("Couldn't fstat local file \"%s\": %s",
-		    local_path, strerror(errno));
-		close(local_fd);
-		return(-1);
-	}
-	if (!S_ISREG(sb.st_mode)) {
-		error("%s is not a regular file", local_path);
-		close(local_fd);
-		return(-1);
-	}
-	stat_to_attrib(&sb, &a);
-
-	a.flags &= ~SSH2_FILEXFER_ATTR_SIZE;
-	a.flags &= ~SSH2_FILEXFER_ATTR_UIDGID;
-	a.perm &= 0777;
-	if (!pflag)
-		a.flags &= ~SSH2_FILEXFER_ATTR_ACMODTIME;
-
-	buffer_init(&msg);
-
-	/* Send open request */
-	id = conn->msg_id++;
-	buffer_put_char(&msg, SSH2_FXP_OPEN);
-	buffer_put_int(&msg, id);
-	buffer_put_cstring(&msg, remote_path);
-	buffer_put_int(&msg, SSH2_FXF_WRITE|SSH2_FXF_CREAT|SSH2_FXF_TRUNC);
-	encode_attrib(&msg, &a);
-	send_msg(conn->fd_out, &msg);
-	debug3("Sent message SSH2_FXP_OPEN I:%u P:%s", id, remote_path);
-
-	buffer_clear(&msg);
-
-	handle = get_handle(conn->fd_in, id, &handle_len);
-	if (handle == NULL) {
-		close(local_fd);
-		buffer_free(&msg);
-		return(-1);
-	}
-
-	startid = ackid = id + 1;
-	data = xmalloc(conn->transfer_buflen);
-
-	/* Read from local and write to remote */
-	offset = 0;
-	if (showprogress)
-		start_progress_meter(local_path, sb.st_size, &offset);
-	else
-		printf("Uploading %s to %s\n", local_path, remote_path);
-
-	for (;;) {
-		int len;
-
-		/*
-		 * Can't use atomicio here because it returns 0 on EOF, thus losing
-		 * the last block of the file
-		 */
-		do
-			len = read(local_fd, data, conn->transfer_buflen);
-		while ((len == -1) && (errno == EINTR || errno == EAGAIN));
-
-		if (len == -1)
-			fatal("Couldn't read from \"%s\": %s", local_path,
-			    strerror(errno));
-
-		if (len != 0) {
-			ack = xmalloc(sizeof(*ack));
-			ack->id = ++id;
-			ack->offset = offset;
-			ack->len = len;
-			TAILQ_INSERT_TAIL(&acks, ack, tq);
-
-			buffer_clear(&msg);
-			buffer_put_char(&msg, SSH2_FXP_WRITE);
-			buffer_put_int(&msg, ack->id);
-			buffer_put_string(&msg, handle, handle_len);
-			buffer_put_int64(&msg, offset);
-			buffer_put_string(&msg, data, len);
-			send_msg(conn->fd_out, &msg);
-			debug3("Sent message SSH2_FXP_WRITE I:%u O:%llu S:%u",
-			    id, (unsigned long long)offset, len);
-		} else if (TAILQ_FIRST(&acks) == NULL)
-			break;
-
-		if (ack == NULL)
-			fatal("Unexpected ACK %u", id);
-
-		if (id == startid || len == 0 ||
-		    id - ackid >= conn->num_requests) {
-			u_int r_id;
-
-			buffer_clear(&msg);
-			get_msg(conn->fd_in, &msg);
-			type = buffer_get_char(&msg);
-			r_id = buffer_get_int(&msg);
-
-			if (type != SSH2_FXP_STATUS)
-				fatal("Expected SSH2_FXP_STATUS(%d) packet, "
-				    "got %d", SSH2_FXP_STATUS, type);
-
-			status = buffer_get_int(&msg);
-			debug3("SSH2_FXP_STATUS %d", status);
-
-			/* Find the request in our queue */
-			for(ack = TAILQ_FIRST(&acks);
-			    ack != NULL && ack->id != r_id;
-			    ack = TAILQ_NEXT(ack, tq))
-				;
-			if (ack == NULL)
-				fatal("Can't find request for ID %u", r_id);
-			TAILQ_REMOVE(&acks, ack, tq);
-
-			if (status != SSH2_FX_OK) {
-				error("Couldn't write to remote file \"%s\": %s",
-				    remote_path, fx2txt(status));
-				do_close(conn, handle, handle_len);
-				close(local_fd);
-				xfree(data);
-				xfree(ack);
-				goto done;
-			}
-			debug3("In write loop, ack for %u %u bytes at %llu",
-			   ack->id, ack->len, (unsigned long long)ack->offset);
-			++ackid;
-			xfree(ack);
-		}
-		offset += len;
-	}
-	if (showprogress)
-		stop_progress_meter();
-	xfree(data);
-
-	if (close(local_fd) == -1) {
-		error("Couldn't close local file \"%s\": %s", local_path,
-		    strerror(errno));
-		do_close(conn, handle, handle_len);
-		status = -1;
-		goto done;
-	}
-
-	/* Override umask and utimes if asked */
-	if (pflag)
-		do_fsetstat(conn, handle, handle_len, &a);
-
-	status = do_close(conn, handle, handle_len);
-
-done:
-	xfree(handle);
-	buffer_free(&msg);
-	return(status);
-}
diff --git a/crypto/openssh/sftp-client.h b/crypto/openssh/sftp-client.h
deleted file mode 100644
index 98e08ffa70d5..000000000000
--- a/crypto/openssh/sftp-client.h
+++ /dev/null
@@ -1,107 +0,0 @@
-/* $OpenBSD: sftp-client.h,v 1.11 2002/09/11 22:41:50 djm Exp $ */
-
-/*
- * Copyright (c) 2001,2002 Damien Miller.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/* Client side of SSH2 filexfer protocol */
-
-#ifndef _SFTP_CLIENT_H
-#define _SFTP_CLIENT_H
-
-typedef struct SFTP_DIRENT SFTP_DIRENT;
-
-struct SFTP_DIRENT {
-	char *filename;
-	char *longname;
-	Attrib a;
-};
-
-/*
- * Initialiase a SSH filexfer connection. Returns -1 on error or
- * protocol version on success.
- */
-struct sftp_conn *do_init(int, int, u_int, u_int);
-
-u_int sftp_proto_version(struct sftp_conn *);
-
-/* Close file referred to by 'handle' */
-int do_close(struct sftp_conn *, char *, u_int);
-
-/* Read contents of 'path' to NULL-terminated array 'dir' */
-int do_readdir(struct sftp_conn *, char *, SFTP_DIRENT ***);
-
-/* Frees a NULL-terminated array of SFTP_DIRENTs (eg. from do_readdir) */
-void free_sftp_dirents(SFTP_DIRENT **);
-
-/* Delete file 'path' */
-int do_rm(struct sftp_conn *, char *);
-
-/* Create directory 'path' */
-int do_mkdir(struct sftp_conn *, char *, Attrib *);
-
-/* Remove directory 'path' */
-int do_rmdir(struct sftp_conn *, char *);
-
-/* Get file attributes of 'path' (follows symlinks) */
-Attrib *do_stat(struct sftp_conn *, char *, int);
-
-/* Get file attributes of 'path' (does not follow symlinks) */
-Attrib *do_lstat(struct sftp_conn *, char *, int);
-
-/* Get file attributes of open file 'handle' */
-Attrib *do_fstat(struct sftp_conn *, char *, u_int, int);
-
-/* Set file attributes of 'path' */
-int do_setstat(struct sftp_conn *, char *, Attrib *);
-
-/* Set file attributes of open file 'handle' */
-int do_fsetstat(struct sftp_conn *, char *, u_int, Attrib *);
-
-/* Canonicalise 'path' - caller must free result */
-char *do_realpath(struct sftp_conn *, char *);
-
-/* Rename 'oldpath' to 'newpath' */
-int do_rename(struct sftp_conn *, char *, char *);
-
-/* Rename 'oldpath' to 'newpath' */
-int do_symlink(struct sftp_conn *, char *, char *);
-
-/* Return target of symlink 'path' - caller must free result */
-char *do_readlink(struct sftp_conn *, char *);
-
-/* XXX: add callbacks to do_download/do_upload so we can do progress meter */
-
-/*
- * Download 'remote_path' to 'local_path'. Preserve permissions and times
- * if 'pflag' is set
- */
-int do_download(struct sftp_conn *, char *, char *, int);
-
-/*
- * Upload 'local_path' to 'remote_path'. Preserve permissions and times
- * if 'pflag' is set
- */
-int do_upload(struct sftp_conn *, char *, char *, int);
-
-#endif
diff --git a/crypto/openssh/sftp-common.c b/crypto/openssh/sftp-common.c
deleted file mode 100644
index 31d41385bbd5..000000000000
--- a/crypto/openssh/sftp-common.c
+++ /dev/null
@@ -1,213 +0,0 @@
-/*
- * Copyright (c) 2001 Markus Friedl.  All rights reserved.
- * Copyright (c) 2001 Damien Miller.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: sftp-common.c,v 1.8 2002/10/16 14:31:48 itojun Exp $");
-
-#include "buffer.h"
-#include "bufaux.h"
-#include "log.h"
-#include "xmalloc.h"
-
-#include "sftp.h"
-#include "sftp-common.h"
-
-/* Clear contents of attributes structure */
-void
-attrib_clear(Attrib *a)
-{
-	a->flags = 0;
-	a->size = 0;
-	a->uid = 0;
-	a->gid = 0;
-	a->perm = 0;
-	a->atime = 0;
-	a->mtime = 0;
-}
-
-/* Convert from struct stat to filexfer attribs */
-void
-stat_to_attrib(struct stat *st, Attrib *a)
-{
-	attrib_clear(a);
-	a->flags = 0;
-	a->flags |= SSH2_FILEXFER_ATTR_SIZE;
-	a->size = st->st_size;
-	a->flags |= SSH2_FILEXFER_ATTR_UIDGID;
-	a->uid = st->st_uid;
-	a->gid = st->st_gid;
-	a->flags |= SSH2_FILEXFER_ATTR_PERMISSIONS;
-	a->perm = st->st_mode;
-	a->flags |= SSH2_FILEXFER_ATTR_ACMODTIME;
-	a->atime = st->st_atime;
-	a->mtime = st->st_mtime;
-}
-
-/* Convert from filexfer attribs to struct stat */
-void
-attrib_to_stat(Attrib *a, struct stat *st)
-{
-	memset(st, 0, sizeof(*st));
-
-	if (a->flags & SSH2_FILEXFER_ATTR_SIZE)
-		st->st_size = a->size;
-	if (a->flags & SSH2_FILEXFER_ATTR_UIDGID) {
-		st->st_uid = a->uid;
-		st->st_gid = a->gid;
-	}
-	if (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS)
-		st->st_mode = a->perm;
-	if (a->flags & SSH2_FILEXFER_ATTR_ACMODTIME) {
-		st->st_atime = a->atime;
-		st->st_mtime = a->mtime;
-	}
-}
-
-/* Decode attributes in buffer */
-Attrib *
-decode_attrib(Buffer *b)
-{
-	static Attrib a;
-
-	attrib_clear(&a);
-	a.flags = buffer_get_int(b);
-	if (a.flags & SSH2_FILEXFER_ATTR_SIZE)
-		a.size = buffer_get_int64(b);
-	if (a.flags & SSH2_FILEXFER_ATTR_UIDGID) {
-		a.uid = buffer_get_int(b);
-		a.gid = buffer_get_int(b);
-	}
-	if (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS)
-		a.perm = buffer_get_int(b);
-	if (a.flags & SSH2_FILEXFER_ATTR_ACMODTIME) {
-		a.atime = buffer_get_int(b);
-		a.mtime = buffer_get_int(b);
-	}
-	/* vendor-specific extensions */
-	if (a.flags & SSH2_FILEXFER_ATTR_EXTENDED) {
-		char *type, *data;
-		int i, count;
-
-		count = buffer_get_int(b);
-		for (i = 0; i < count; i++) {
-			type = buffer_get_string(b, NULL);
-			data = buffer_get_string(b, NULL);
-			debug3("Got file attribute \"%s\"", type);
-			xfree(type);
-			xfree(data);
-		}
-	}
-	return &a;
-}
-
-/* Encode attributes to buffer */
-void
-encode_attrib(Buffer *b, Attrib *a)
-{
-	buffer_put_int(b, a->flags);
-	if (a->flags & SSH2_FILEXFER_ATTR_SIZE)
-		buffer_put_int64(b, a->size);
-	if (a->flags & SSH2_FILEXFER_ATTR_UIDGID) {
-		buffer_put_int(b, a->uid);
-		buffer_put_int(b, a->gid);
-	}
-	if (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS)
-		buffer_put_int(b, a->perm);
-	if (a->flags & SSH2_FILEXFER_ATTR_ACMODTIME) {
-		buffer_put_int(b, a->atime);
-		buffer_put_int(b, a->mtime);
-	}
-}
-
-/* Convert from SSH2_FX_ status to text error message */
-const char *
-fx2txt(int status)
-{
-	switch (status) {
-	case SSH2_FX_OK:
-		return("No error");
-	case SSH2_FX_EOF:
-		return("End of file");
-	case SSH2_FX_NO_SUCH_FILE:
-		return("No such file or directory");
-	case SSH2_FX_PERMISSION_DENIED:
-		return("Permission denied");
-	case SSH2_FX_FAILURE:
-		return("Failure");
-	case SSH2_FX_BAD_MESSAGE:
-		return("Bad message");
-	case SSH2_FX_NO_CONNECTION:
-		return("No connection");
-	case SSH2_FX_CONNECTION_LOST:
-		return("Connection lost");
-	case SSH2_FX_OP_UNSUPPORTED:
-		return("Operation unsupported");
-	default:
-		return("Unknown status");
-	}
-	/* NOTREACHED */
-}
-
-/*
- * drwxr-xr-x    5 markus   markus       1024 Jan 13 18:39 .ssh
- */
-char *
-ls_file(char *name, struct stat *st, int remote)
-{
-	int ulen, glen, sz = 0;
-	struct passwd *pw;
-	struct group *gr;
-	struct tm *ltime = localtime(&st->st_mtime);
-	char *user, *group;
-	char buf[1024], mode[11+1], tbuf[12+1], ubuf[11+1], gbuf[11+1];
-
-	strmode(st->st_mode, mode);
-	if (!remote && (pw = getpwuid(st->st_uid)) != NULL) {
-		user = pw->pw_name;
-	} else {
-		snprintf(ubuf, sizeof ubuf, "%u", (u_int)st->st_uid);
-		user = ubuf;
-	}
-	if (!remote && (gr = getgrgid(st->st_gid)) != NULL) {
-		group = gr->gr_name;
-	} else {
-		snprintf(gbuf, sizeof gbuf, "%u", (u_int)st->st_gid);
-		group = gbuf;
-	}
-	if (ltime != NULL) {
-		if (time(NULL) - st->st_mtime < (365*24*60*60)/2)
-			sz = strftime(tbuf, sizeof tbuf, "%b %e %H:%M", ltime);
-		else
-			sz = strftime(tbuf, sizeof tbuf, "%b %e  %Y", ltime);
-	}
-	if (sz == 0)
-		tbuf[0] = '\0';
-	ulen = MAX(strlen(user), 8);
-	glen = MAX(strlen(group), 8);
-	snprintf(buf, sizeof buf, "%s %3d %-*s %-*s %8llu %s %s", mode,
-	    st->st_nlink, ulen, user, glen, group,
-	    (unsigned long long)st->st_size, tbuf, name);
-	return xstrdup(buf);
-}
diff --git a/crypto/openssh/sftp-common.h b/crypto/openssh/sftp-common.h
deleted file mode 100644
index 201611cc4bcb..000000000000
--- a/crypto/openssh/sftp-common.h
+++ /dev/null
@@ -1,48 +0,0 @@
-/*	$OpenBSD: sftp-common.h,v 1.4 2002/09/11 22:41:50 djm Exp $	*/
-
-/*
- * Copyright (c) 2001 Markus Friedl.  All rights reserved.
- * Copyright (c) 2001 Damien Miller.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-typedef struct Attrib Attrib;
-
-/* File attributes */
-struct Attrib {
-	u_int32_t	flags;
-	u_int64_t	size;
-	u_int32_t	uid;
-	u_int32_t	gid;
-	u_int32_t	perm;
-	u_int32_t	atime;
-	u_int32_t	mtime;
-};
-
-void	 attrib_clear(Attrib *);
-void	 stat_to_attrib(struct stat *, Attrib *);
-void	 attrib_to_stat(Attrib *, struct stat *);
-Attrib	*decode_attrib(Buffer *);
-void	 encode_attrib(Buffer *, Attrib *);
-char	*ls_file(char *, struct stat *, int);
-
-const char *fx2txt(int);
diff --git a/crypto/openssh/sftp-glob.c b/crypto/openssh/sftp-glob.c
deleted file mode 100644
index ee122a2cd586..000000000000
--- a/crypto/openssh/sftp-glob.c
+++ /dev/null
@@ -1,150 +0,0 @@
-/*
- * Copyright (c) 2001,2002 Damien Miller.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: sftp-glob.c,v 1.13 2002/09/11 22:41:50 djm Exp $");
-
-#include "buffer.h"
-#include "bufaux.h"
-#include "xmalloc.h"
-#include "log.h"
-
-#include "sftp.h"
-#include "sftp-common.h"
-#include "sftp-client.h"
-#include "sftp-glob.h"
-
-struct SFTP_OPENDIR {
-	SFTP_DIRENT **dir;
-	int offset;
-};
-
-static struct {
-	struct sftp_conn *conn;
-} cur;
-
-static void *
-fudge_opendir(const char *path)
-{
-	struct SFTP_OPENDIR *r;
-
-	r = xmalloc(sizeof(*r));
-
-	if (do_readdir(cur.conn, (char *)path, &r->dir)) {
-		xfree(r);
-		return(NULL);
-	}
-
-	r->offset = 0;
-
-	return((void *)r);
-}
-
-static struct dirent *
-fudge_readdir(struct SFTP_OPENDIR *od)
-{
-	/* Solaris needs sizeof(dirent) + path length (see below) */
-	static char buf[sizeof(struct dirent) + MAXPATHLEN];
-	struct dirent *ret = (struct dirent *)buf;
-#ifdef __GNU_LIBRARY__
-	static int inum = 1;
-#endif /* __GNU_LIBRARY__ */
-	
-	if (od->dir[od->offset] == NULL)
-		return(NULL);
-
-	memset(buf, 0, sizeof(buf));
-
-	/*
-	 * Solaris defines dirent->d_name as a one byte array and expects
-	 * you to hack around it.
-	 */
-#ifdef BROKEN_ONE_BYTE_DIRENT_D_NAME
-	strlcpy(ret->d_name, od->dir[od->offset++]->filename, MAXPATHLEN);
-#else
-	strlcpy(ret->d_name, od->dir[od->offset++]->filename,
-	    sizeof(ret->d_name));
-#endif
-#ifdef __GNU_LIBRARY__
-	/*
-	 * Idiot glibc uses extensions to struct dirent for readdir with
-	 * ALTDIRFUNCs. Not that this is documented anywhere but the 
-	 * source... Fake an inode number to appease it.
-	 */
-	ret->d_ino = inum++;
-	if (!inum)
-		inum = 1;
-#endif /* __GNU_LIBRARY__ */
-
-	return(ret);
-}
-
-static void
-fudge_closedir(struct SFTP_OPENDIR *od)
-{
-	free_sftp_dirents(od->dir);
-	xfree(od);
-}
-
-static int
-fudge_lstat(const char *path, struct stat *st)
-{
-	Attrib *a;
-
-	if (!(a = do_lstat(cur.conn, (char *)path, 0)))
-		return(-1);
-
-	attrib_to_stat(a, st);
-
-	return(0);
-}
-
-static int
-fudge_stat(const char *path, struct stat *st)
-{
-	Attrib *a;
-
-	if (!(a = do_stat(cur.conn, (char *)path, 0)))
-		return(-1);
-
-	attrib_to_stat(a, st);
-
-	return(0);
-}
-
-int
-remote_glob(struct sftp_conn *conn, const char *pattern, int flags,
-    int (*errfunc)(const char *, int), glob_t *pglob)
-{
-	pglob->gl_opendir = fudge_opendir;
-	pglob->gl_readdir = (struct dirent *(*)(void *))fudge_readdir;
-	pglob->gl_closedir = (void (*)(void *))fudge_closedir;
-	pglob->gl_lstat = fudge_lstat;
-	pglob->gl_stat = fudge_stat;
-
-	memset(&cur, 0, sizeof(cur));
-	cur.conn = conn;
-
-	return(glob(pattern, flags | GLOB_ALTDIRFUNC, errfunc, pglob));
-}
diff --git a/crypto/openssh/sftp-glob.h b/crypto/openssh/sftp-glob.h
deleted file mode 100644
index f879e8719b4b..000000000000
--- a/crypto/openssh/sftp-glob.h
+++ /dev/null
@@ -1,37 +0,0 @@
-/* $OpenBSD: sftp-glob.h,v 1.8 2002/09/11 22:41:50 djm Exp $ */
-
-/*
- * Copyright (c) 2001,2002 Damien Miller.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/* Remote sftp filename globbing */
-
-#ifndef _SFTP_GLOB_H
-#define _SFTP_GLOB_H
-
-#include "sftp-client.h"
-
-int remote_glob(struct sftp_conn *, const char *, int,
-    int (*)(const char *, int), glob_t *);
-
-#endif
diff --git a/crypto/openssh/sftp-int.c b/crypto/openssh/sftp-int.c
deleted file mode 100644
index 6987de9a3888..000000000000
--- a/crypto/openssh/sftp-int.c
+++ /dev/null
@@ -1,1147 +0,0 @@
-/*
- * Copyright (c) 2001,2002 Damien Miller.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/* XXX: recursive operations */
-
-#include "includes.h"
-RCSID("$OpenBSD: sftp-int.c,v 1.57 2003/03/05 22:33:43 markus Exp $");
-
-#include "buffer.h"
-#include "xmalloc.h"
-#include "log.h"
-#include "pathnames.h"
-
-#include "sftp.h"
-#include "sftp-common.h"
-#include "sftp-glob.h"
-#include "sftp-client.h"
-#include "sftp-int.h"
-
-/* File to read commands from */
-extern FILE *infile;
-
-/* Size of buffer used when copying files */
-extern size_t copy_buffer_len;
-
-/* Number of concurrent outstanding requests */
-extern int num_requests;
-
-/* This is set to 0 if the progressmeter is not desired. */
-int showprogress = 1;
-
-/* Seperators for interactive commands */
-#define WHITESPACE " \t\r\n"
-
-/* Commands for interactive mode */
-#define I_CHDIR		1
-#define I_CHGRP		2
-#define I_CHMOD		3
-#define I_CHOWN		4
-#define I_GET		5
-#define I_HELP		6
-#define I_LCHDIR	7
-#define I_LLS		8
-#define I_LMKDIR	9
-#define I_LPWD		10
-#define I_LS		11
-#define I_LUMASK	12
-#define I_MKDIR		13
-#define I_PUT		14
-#define I_PWD		15
-#define I_QUIT		16
-#define I_RENAME	17
-#define I_RM		18
-#define I_RMDIR		19
-#define I_SHELL		20
-#define I_SYMLINK	21
-#define I_VERSION	22
-#define I_PROGRESS	23
-
-struct CMD {
-	const char *c;
-	const int n;
-};
-
-static const struct CMD cmds[] = {
-	{ "bye",	I_QUIT },
-	{ "cd",		I_CHDIR },
-	{ "chdir",	I_CHDIR },
-	{ "chgrp",	I_CHGRP },
-	{ "chmod",	I_CHMOD },
-	{ "chown",	I_CHOWN },
-	{ "dir",	I_LS },
-	{ "exit",	I_QUIT },
-	{ "get",	I_GET },
-	{ "mget",	I_GET },
-	{ "help",	I_HELP },
-	{ "lcd",	I_LCHDIR },
-	{ "lchdir",	I_LCHDIR },
-	{ "lls",	I_LLS },
-	{ "lmkdir",	I_LMKDIR },
-	{ "ln",		I_SYMLINK },
-	{ "lpwd",	I_LPWD },
-	{ "ls",		I_LS },
-	{ "lumask",	I_LUMASK },
-	{ "mkdir",	I_MKDIR },
-	{ "progress",	I_PROGRESS },
-	{ "put",	I_PUT },
-	{ "mput",	I_PUT },
-	{ "pwd",	I_PWD },
-	{ "quit",	I_QUIT },
-	{ "rename",	I_RENAME },
-	{ "rm",		I_RM },
-	{ "rmdir",	I_RMDIR },
-	{ "symlink",	I_SYMLINK },
-	{ "version",	I_VERSION },
-	{ "!",		I_SHELL },
-	{ "?",		I_HELP },
-	{ NULL,			-1}
-};
-
-static void
-help(void)
-{
-	printf("Available commands:\n");
-	printf("cd path                       Change remote directory to 'path'\n");
-	printf("lcd path                      Change local directory to 'path'\n");
-	printf("chgrp grp path                Change group of file 'path' to 'grp'\n");
-	printf("chmod mode path               Change permissions of file 'path' to 'mode'\n");
-	printf("chown own path                Change owner of file 'path' to 'own'\n");
-	printf("help                          Display this help text\n");
-	printf("get remote-path [local-path]  Download file\n");
-	printf("lls [ls-options [path]]       Display local directory listing\n");
-	printf("ln oldpath newpath            Symlink remote file\n");
-	printf("lmkdir path                   Create local directory\n");
-	printf("lpwd                          Print local working directory\n");
-	printf("ls [path]                     Display remote directory listing\n");
-	printf("lumask umask                  Set local umask to 'umask'\n");
-	printf("mkdir path                    Create remote directory\n");
-	printf("progress                      Toggle display of progress meter\n");
-	printf("put local-path [remote-path]  Upload file\n");
-	printf("pwd                           Display remote working directory\n");
-	printf("exit                          Quit sftp\n");
-	printf("quit                          Quit sftp\n");
-	printf("rename oldpath newpath        Rename remote file\n");
-	printf("rmdir path                    Remove remote directory\n");
-	printf("rm path                       Delete remote file\n");
-	printf("symlink oldpath newpath       Symlink remote file\n");
-	printf("version                       Show SFTP version\n");
-	printf("!command                      Execute 'command' in local shell\n");
-	printf("!                             Escape to local shell\n");
-	printf("?                             Synonym for help\n");
-}
-
-static void
-local_do_shell(const char *args)
-{
-	int status;
-	char *shell;
-	pid_t pid;
-
-	if (!*args)
-		args = NULL;
-
-	if ((shell = getenv("SHELL")) == NULL)
-		shell = _PATH_BSHELL;
-
-	if ((pid = fork()) == -1)
-		fatal("Couldn't fork: %s", strerror(errno));
-
-	if (pid == 0) {
-		/* XXX: child has pipe fds to ssh subproc open - issue? */
-		if (args) {
-			debug3("Executing %s -c \"%s\"", shell, args);
-			execl(shell, shell, "-c", args, (char *)NULL);
-		} else {
-			debug3("Executing %s", shell);
-			execl(shell, shell, (char *)NULL);
-		}
-		fprintf(stderr, "Couldn't execute \"%s\": %s\n", shell,
-		    strerror(errno));
-		_exit(1);
-	}
-	while (waitpid(pid, &status, 0) == -1)
-		if (errno != EINTR)
-			fatal("Couldn't wait for child: %s", strerror(errno));
-	if (!WIFEXITED(status))
-		error("Shell exited abormally");
-	else if (WEXITSTATUS(status))
-		error("Shell exited with status %d", WEXITSTATUS(status));
-}
-
-static void
-local_do_ls(const char *args)
-{
-	if (!args || !*args)
-		local_do_shell(_PATH_LS);
-	else {
-		int len = strlen(_PATH_LS " ") + strlen(args) + 1;
-		char *buf = xmalloc(len);
-
-		/* XXX: quoting - rip quoting code from ftp? */
-		snprintf(buf, len, _PATH_LS " %s", args);
-		local_do_shell(buf);
-		xfree(buf);
-	}
-}
-
-/* Strip one path (usually the pwd) from the start of another */
-static char *
-path_strip(char *path, char *strip)
-{
-	size_t len;
-
-	if (strip == NULL)
-		return (xstrdup(path));
-
-	len = strlen(strip);
-	if (strip != NULL && strncmp(path, strip, len) == 0) {
-		if (strip[len - 1] != '/' && path[len] == '/')
-			len++;
-		return (xstrdup(path + len));
-	}
-
-	return (xstrdup(path));
-}
-
-static char *
-path_append(char *p1, char *p2)
-{
-	char *ret;
-	int len = strlen(p1) + strlen(p2) + 2;
-
-	ret = xmalloc(len);
-	strlcpy(ret, p1, len);
-	if (p1[strlen(p1) - 1] != '/')
-		strlcat(ret, "/", len);
-	strlcat(ret, p2, len);
-
-	return(ret);
-}
-
-static char *
-make_absolute(char *p, char *pwd)
-{
-	char *abs;
-
-	/* Derelativise */
-	if (p && p[0] != '/') {
-		abs = path_append(pwd, p);
-		xfree(p);
-		return(abs);
-	} else
-		return(p);
-}
-
-static int
-infer_path(const char *p, char **ifp)
-{
-	char *cp;
-
-	cp = strrchr(p, '/');
-	if (cp == NULL) {
-		*ifp = xstrdup(p);
-		return(0);
-	}
-
-	if (!cp[1]) {
-		error("Invalid path");
-		return(-1);
-	}
-
-	*ifp = xstrdup(cp + 1);
-	return(0);
-}
-
-static int
-parse_getput_flags(const char **cpp, int *pflag)
-{
-	const char *cp = *cpp;
-
-	/* Check for flags */
-	if (cp[0] == '-' && cp[1] && strchr(WHITESPACE, cp[2])) {
-		switch (cp[1]) {
-		case 'p':
-		case 'P':
-			*pflag = 1;
-			break;
-		default:
-			error("Invalid flag -%c", cp[1]);
-			return(-1);
-		}
-		cp += 2;
-		*cpp = cp + strspn(cp, WHITESPACE);
-	}
-
-	return(0);
-}
-
-static int
-parse_ls_flags(const char **cpp, int *lflag)
-{
-	const char *cp = *cpp;
-
-	/* Check for flags */
-	if (cp++[0] == '-') {
-		for(; strchr(WHITESPACE, *cp) == NULL; cp++) {
-			switch (*cp) {
-			case 'l':
-				*lflag = 1;
-				break;
-			default:
-				error("Invalid flag -%c", *cp);
-				return(-1);
-			}
-		}
-		*cpp = cp + strspn(cp, WHITESPACE);
-	}
-
-	return(0);
-}
-
-static int
-get_pathname(const char **cpp, char **path)
-{
-	const char *cp = *cpp, *end;
-	char quot;
-	int i;
-
-	cp += strspn(cp, WHITESPACE);
-	if (!*cp) {
-		*cpp = cp;
-		*path = NULL;
-		return (0);
-	}
-
-	/* Check for quoted filenames */
-	if (*cp == '\"' || *cp == '\'') {
-		quot = *cp++;
-
-		end = strchr(cp, quot);
-		if (end == NULL) {
-			error("Unterminated quote");
-			goto fail;
-		}
-		if (cp == end) {
-			error("Empty quotes");
-			goto fail;
-		}
-		*cpp = end + 1 + strspn(end + 1, WHITESPACE);
-	} else {
-		/* Read to end of filename */
-		end = strpbrk(cp, WHITESPACE);
-		if (end == NULL)
-			end = strchr(cp, '\0');
-		*cpp = end + strspn(end, WHITESPACE);
-	}
-
-	i = end - cp;
-
-	*path = xmalloc(i + 1);
-	memcpy(*path, cp, i);
-	(*path)[i] = '\0';
-	return(0);
-
- fail:
-	*path = NULL;
-	return (-1);
-}
-
-static int
-is_dir(char *path)
-{
-	struct stat sb;
-
-	/* XXX: report errors? */
-	if (stat(path, &sb) == -1)
-		return(0);
-
-	return(sb.st_mode & S_IFDIR);
-}
-
-static int
-is_reg(char *path)
-{
-	struct stat sb;
-
-	if (stat(path, &sb) == -1)
-		fatal("stat %s: %s", path, strerror(errno));
-
-	return(S_ISREG(sb.st_mode));
-}
-
-static int
-remote_is_dir(struct sftp_conn *conn, char *path)
-{
-	Attrib *a;
-
-	/* XXX: report errors? */
-	if ((a = do_stat(conn, path, 1)) == NULL)
-		return(0);
-	if (!(a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS))
-		return(0);
-	return(a->perm & S_IFDIR);
-}
-
-static int
-process_get(struct sftp_conn *conn, char *src, char *dst, char *pwd, int pflag)
-{
-	char *abs_src = NULL;
-	char *abs_dst = NULL;
-	char *tmp;
-	glob_t g;
-	int err = 0;
-	int i;
-
-	abs_src = xstrdup(src);
-	abs_src = make_absolute(abs_src, pwd);
-
-	memset(&g, 0, sizeof(g));
-	debug3("Looking up %s", abs_src);
-	if (remote_glob(conn, abs_src, 0, NULL, &g)) {
-		error("File \"%s\" not found.", abs_src);
-		err = -1;
-		goto out;
-	}
-
-	/* Only one match, dst may be file, directory or unspecified */
-	if (g.gl_pathv[0] && g.gl_matchc == 1) {
-		if (dst) {
-			/* If directory specified, append filename */
-			if (is_dir(dst)) {
-				if (infer_path(g.gl_pathv[0], &tmp)) {
-					err = 1;
-					goto out;
-				}
-				abs_dst = path_append(dst, tmp);
-				xfree(tmp);
-			} else
-				abs_dst = xstrdup(dst);
-		} else if (infer_path(g.gl_pathv[0], &abs_dst)) {
-			err = -1;
-			goto out;
-		}
-		err = do_download(conn, g.gl_pathv[0], abs_dst, pflag);
-		goto out;
-	}
-
-	/* Multiple matches, dst may be directory or unspecified */
-	if (dst && !is_dir(dst)) {
-		error("Multiple files match, but \"%s\" is not a directory",
-		    dst);
-		err = -1;
-		goto out;
-	}
-
-	for (i = 0; g.gl_pathv[i]; i++) {
-		if (infer_path(g.gl_pathv[i], &tmp)) {
-			err = -1;
-			goto out;
-		}
-		if (dst) {
-			abs_dst = path_append(dst, tmp);
-			xfree(tmp);
-		} else
-			abs_dst = tmp;
-
-		printf("Fetching %s to %s\n", g.gl_pathv[i], abs_dst);
-		if (do_download(conn, g.gl_pathv[i], abs_dst, pflag) == -1)
-			err = -1;
-		xfree(abs_dst);
-		abs_dst = NULL;
-	}
-
-out:
-	xfree(abs_src);
-	if (abs_dst)
-		xfree(abs_dst);
-	globfree(&g);
-	return(err);
-}
-
-static int
-process_put(struct sftp_conn *conn, char *src, char *dst, char *pwd, int pflag)
-{
-	char *tmp_dst = NULL;
-	char *abs_dst = NULL;
-	char *tmp;
-	glob_t g;
-	int err = 0;
-	int i;
-
-	if (dst) {
-		tmp_dst = xstrdup(dst);
-		tmp_dst = make_absolute(tmp_dst, pwd);
-	}
-
-	memset(&g, 0, sizeof(g));
-	debug3("Looking up %s", src);
-	if (glob(src, 0, NULL, &g)) {
-		error("File \"%s\" not found.", src);
-		err = -1;
-		goto out;
-	}
-
-	/* Only one match, dst may be file, directory or unspecified */
-	if (g.gl_pathv[0] && g.gl_matchc == 1) {
-		if (!is_reg(g.gl_pathv[0])) {
-			error("Can't upload %s: not a regular file",
-			    g.gl_pathv[0]);
-			err = 1;
-			goto out;
-		}
-		if (tmp_dst) {
-			/* If directory specified, append filename */
-			if (remote_is_dir(conn, tmp_dst)) {
-				if (infer_path(g.gl_pathv[0], &tmp)) {
-					err = 1;
-					goto out;
-				}
-				abs_dst = path_append(tmp_dst, tmp);
-				xfree(tmp);
-			} else
-				abs_dst = xstrdup(tmp_dst);
-		} else {
-			if (infer_path(g.gl_pathv[0], &abs_dst)) {
-				err = -1;
-				goto out;
-			}
-			abs_dst = make_absolute(abs_dst, pwd);
-		}
-		err = do_upload(conn, g.gl_pathv[0], abs_dst, pflag);
-		goto out;
-	}
-
-	/* Multiple matches, dst may be directory or unspecified */
-	if (tmp_dst && !remote_is_dir(conn, tmp_dst)) {
-		error("Multiple files match, but \"%s\" is not a directory",
-		    tmp_dst);
-		err = -1;
-		goto out;
-	}
-
-	for (i = 0; g.gl_pathv[i]; i++) {
-		if (!is_reg(g.gl_pathv[i])) {
-			error("skipping non-regular file %s", 
-			    g.gl_pathv[i]);
-			continue;
-		}
-		if (infer_path(g.gl_pathv[i], &tmp)) {
-			err = -1;
-			goto out;
-		}
-		if (tmp_dst) {
-			abs_dst = path_append(tmp_dst, tmp);
-			xfree(tmp);
-		} else
-			abs_dst = make_absolute(tmp, pwd);
-
-		printf("Uploading %s to %s\n", g.gl_pathv[i], abs_dst);
-		if (do_upload(conn, g.gl_pathv[i], abs_dst, pflag) == -1)
-			err = -1;
-	}
-
-out:
-	if (abs_dst)
-		xfree(abs_dst);
-	if (tmp_dst)
-		xfree(tmp_dst);
-	return(err);
-}
-
-static int
-sdirent_comp(const void *aa, const void *bb)
-{
-	SFTP_DIRENT *a = *(SFTP_DIRENT **)aa;
-	SFTP_DIRENT *b = *(SFTP_DIRENT **)bb;
-
-	return (strcmp(a->filename, b->filename));
-}
-
-/* sftp ls.1 replacement for directories */
-static int
-do_ls_dir(struct sftp_conn *conn, char *path, char *strip_path, int lflag)
-{
-	int n;
-	SFTP_DIRENT **d;
-
-	if ((n = do_readdir(conn, path, &d)) != 0)
-		return (n);
-
-	/* Count entries for sort */
-	for (n = 0; d[n] != NULL; n++)
-		;
-
-	qsort(d, n, sizeof(*d), sdirent_comp);
-
-	for (n = 0; d[n] != NULL; n++) {
-		char *tmp, *fname;
-
-		tmp = path_append(path, d[n]->filename);
-		fname = path_strip(tmp, strip_path);
-		xfree(tmp);
-
-		if (lflag) {
-			char *lname;
-			struct stat sb;
-
-			memset(&sb, 0, sizeof(sb));
-			attrib_to_stat(&d[n]->a, &sb);
-			lname = ls_file(fname, &sb, 1);
-			printf("%s\n", lname);
-			xfree(lname);
-		} else {
-			/* XXX - multicolumn display would be nice here */
-			printf("%s\n", fname);
-		}
-
-		xfree(fname);
-	}
-
-	free_sftp_dirents(d);
-	return (0);
-}
-
-/* sftp ls.1 replacement which handles path globs */
-static int
-do_globbed_ls(struct sftp_conn *conn, char *path, char *strip_path,
-    int lflag)
-{
-	glob_t g;
-	int i;
-	Attrib *a;
-	struct stat sb;
-
-	memset(&g, 0, sizeof(g));
-
-	if (remote_glob(conn, path, GLOB_MARK|GLOB_NOCHECK|GLOB_BRACE,
-	    NULL, &g)) {
-		error("Can't ls: \"%s\" not found", path);
-		return (-1);
-	}
-
-	/*
-	 * If the glob returns a single match, which is the same as the
-	 * input glob, and it is a directory, then just list its contents
-	 */
-	if (g.gl_pathc == 1 &&
-	    strncmp(path, g.gl_pathv[0], strlen(g.gl_pathv[0]) - 1) == 0) {
-		if ((a = do_lstat(conn, path, 1)) == NULL) {
-			globfree(&g);
-	    		return (-1);
-		}
-		if ((a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) &&
-		    S_ISDIR(a->perm)) {
-			globfree(&g);
-			return (do_ls_dir(conn, path, strip_path, lflag));
-		}
-	}
-
-	for (i = 0; g.gl_pathv[i]; i++) {
-		char *fname, *lname;
-
-		fname = path_strip(g.gl_pathv[i], strip_path);
-
-		if (lflag) {
-			/*
-			 * XXX: this is slow - 1 roundtrip per path
-			 * A solution to this is to fork glob() and
-			 * build a sftp specific version which keeps the
-			 * attribs (which currently get thrown away)
-			 * that the server returns as well as the filenames.
-			 */
-			memset(&sb, 0, sizeof(sb));
-			a = do_lstat(conn, g.gl_pathv[i], 1);
-			if (a != NULL)
-				attrib_to_stat(a, &sb);
-			lname = ls_file(fname, &sb, 1);
-			printf("%s\n", lname);
-			xfree(lname);
-		} else {
-			/* XXX - multicolumn display would be nice here */
-			printf("%s\n", fname);
-		}
-		xfree(fname);
-	}
-
-	if (g.gl_pathc)
-		globfree(&g);
-
-	return (0);
-}
-
-static int
-parse_args(const char **cpp, int *pflag, int *lflag, int *iflag,
-    unsigned long *n_arg, char **path1, char **path2)
-{
-	const char *cmd, *cp = *cpp;
-	char *cp2;
-	int base = 0;
-	long l;
-	int i, cmdnum;
-
-	/* Skip leading whitespace */
-	cp = cp + strspn(cp, WHITESPACE);
-
-	/* Ignore blank lines and lines which begin with comment '#' char */
-	if (*cp == '\0' || *cp == '#')
-		return (0);
-
-	/* Check for leading '-' (disable error processing) */
-	*iflag = 0;
-	if (*cp == '-') {
-		*iflag = 1;
-		cp++;
-	}
-		
-	/* Figure out which command we have */
-	for (i = 0; cmds[i].c; i++) {
-		int cmdlen = strlen(cmds[i].c);
-
-		/* Check for command followed by whitespace */
-		if (!strncasecmp(cp, cmds[i].c, cmdlen) &&
-		    strchr(WHITESPACE, cp[cmdlen])) {
-			cp += cmdlen;
-			cp = cp + strspn(cp, WHITESPACE);
-			break;
-		}
-	}
-	cmdnum = cmds[i].n;
-	cmd = cmds[i].c;
-
-	/* Special case */
-	if (*cp == '!') {
-		cp++;
-		cmdnum = I_SHELL;
-	} else if (cmdnum == -1) {
-		error("Invalid command.");
-		return (-1);
-	}
-
-	/* Get arguments and parse flags */
-	*lflag = *pflag = *n_arg = 0;
-	*path1 = *path2 = NULL;
-	switch (cmdnum) {
-	case I_GET:
-	case I_PUT:
-		if (parse_getput_flags(&cp, pflag))
-			return(-1);
-		/* Get first pathname (mandatory) */
-		if (get_pathname(&cp, path1))
-			return(-1);
-		if (*path1 == NULL) {
-			error("You must specify at least one path after a "
-			    "%s command.", cmd);
-			return(-1);
-		}
-		/* Try to get second pathname (optional) */
-		if (get_pathname(&cp, path2))
-			return(-1);
-		break;
-	case I_RENAME:
-	case I_SYMLINK:
-		if (get_pathname(&cp, path1))
-			return(-1);
-		if (get_pathname(&cp, path2))
-			return(-1);
-		if (!*path1 || !*path2) {
-			error("You must specify two paths after a %s "
-			    "command.", cmd);
-			return(-1);
-		}
-		break;
-	case I_RM:
-	case I_MKDIR:
-	case I_RMDIR:
-	case I_CHDIR:
-	case I_LCHDIR:
-	case I_LMKDIR:
-		/* Get pathname (mandatory) */
-		if (get_pathname(&cp, path1))
-			return(-1);
-		if (*path1 == NULL) {
-			error("You must specify a path after a %s command.",
-			    cmd);
-			return(-1);
-		}
-		break;
-	case I_LS:
-		if (parse_ls_flags(&cp, lflag))
-			return(-1);
-		/* Path is optional */
-		if (get_pathname(&cp, path1))
-			return(-1);
-		break;
-	case I_LLS:
-	case I_SHELL:
-		/* Uses the rest of the line */
-		break;
-	case I_LUMASK:
-		base = 8;
-	case I_CHMOD:
-		base = 8;
-	case I_CHOWN:
-	case I_CHGRP:
-		/* Get numeric arg (mandatory) */
-		l = strtol(cp, &cp2, base);
-		if (cp2 == cp || ((l == LONG_MIN || l == LONG_MAX) &&
-		    errno == ERANGE) || l < 0) {
-			error("You must supply a numeric argument "
-			    "to the %s command.", cmd);
-			return(-1);
-		}
-		cp = cp2;
-		*n_arg = l;
-		if (cmdnum == I_LUMASK && strchr(WHITESPACE, *cp))
-			break;
-		if (cmdnum == I_LUMASK || !strchr(WHITESPACE, *cp)) {
-			error("You must supply a numeric argument "
-			    "to the %s command.", cmd);
-			return(-1);
-		}
-		cp += strspn(cp, WHITESPACE);
-
-		/* Get pathname (mandatory) */
-		if (get_pathname(&cp, path1))
-			return(-1);
-		if (*path1 == NULL) {
-			error("You must specify a path after a %s command.",
-			    cmd);
-			return(-1);
-		}
-		break;
-	case I_QUIT:
-	case I_PWD:
-	case I_LPWD:
-	case I_HELP:
-	case I_VERSION:
-	case I_PROGRESS:
-		break;
-	default:
-		fatal("Command not implemented");
-	}
-
-	*cpp = cp;
-	return(cmdnum);
-}
-
-static int
-parse_dispatch_command(struct sftp_conn *conn, const char *cmd, char **pwd,
-    int err_abort)
-{
-	char *path1, *path2, *tmp;
-	int pflag, lflag, iflag, cmdnum, i;
-	unsigned long n_arg;
-	Attrib a, *aa;
-	char path_buf[MAXPATHLEN];
-	int err = 0;
-	glob_t g;
-
-	path1 = path2 = NULL;
-	cmdnum = parse_args(&cmd, &pflag, &lflag, &iflag, &n_arg,
-	    &path1, &path2);
-
-	if (iflag != 0)
-		err_abort = 0;
-
-	memset(&g, 0, sizeof(g));
-
-	/* Perform command */
-	switch (cmdnum) {
-	case 0:
-		/* Blank line */
-		break;
-	case -1:
-		/* Unrecognized command */
-		err = -1;
-		break;
-	case I_GET:
-		err = process_get(conn, path1, path2, *pwd, pflag);
-		break;
-	case I_PUT:
-		err = process_put(conn, path1, path2, *pwd, pflag);
-		break;
-	case I_RENAME:
-		path1 = make_absolute(path1, *pwd);
-		path2 = make_absolute(path2, *pwd);
-		err = do_rename(conn, path1, path2);
-		break;
-	case I_SYMLINK:
-		path2 = make_absolute(path2, *pwd);
-		err = do_symlink(conn, path1, path2);
-		break;
-	case I_RM:
-		path1 = make_absolute(path1, *pwd);
-		remote_glob(conn, path1, GLOB_NOCHECK, NULL, &g);
-		for (i = 0; g.gl_pathv[i]; i++) {
-			printf("Removing %s\n", g.gl_pathv[i]);
-			err = do_rm(conn, g.gl_pathv[i]);
-			if (err != 0 && err_abort)
-				break;
-		}
-		break;
-	case I_MKDIR:
-		path1 = make_absolute(path1, *pwd);
-		attrib_clear(&a);
-		a.flags |= SSH2_FILEXFER_ATTR_PERMISSIONS;
-		a.perm = 0777;
-		err = do_mkdir(conn, path1, &a);
-		break;
-	case I_RMDIR:
-		path1 = make_absolute(path1, *pwd);
-		err = do_rmdir(conn, path1);
-		break;
-	case I_CHDIR:
-		path1 = make_absolute(path1, *pwd);
-		if ((tmp = do_realpath(conn, path1)) == NULL) {
-			err = 1;
-			break;
-		}
-		if ((aa = do_stat(conn, tmp, 0)) == NULL) {
-			xfree(tmp);
-			err = 1;
-			break;
-		}
-		if (!(aa->flags & SSH2_FILEXFER_ATTR_PERMISSIONS)) {
-			error("Can't change directory: Can't check target");
-			xfree(tmp);
-			err = 1;
-			break;
-		}
-		if (!S_ISDIR(aa->perm)) {
-			error("Can't change directory: \"%s\" is not "
-			    "a directory", tmp);
-			xfree(tmp);
-			err = 1;
-			break;
-		}
-		xfree(*pwd);
-		*pwd = tmp;
-		break;
-	case I_LS:
-		if (!path1) {
-			do_globbed_ls(conn, *pwd, *pwd, lflag);
-			break;
-		}
-
-		/* Strip pwd off beginning of non-absolute paths */
-		tmp = NULL;
-		if (*path1 != '/')
-			tmp = *pwd;
-
-		path1 = make_absolute(path1, *pwd);
-		err = do_globbed_ls(conn, path1, tmp, lflag);
-		break;
-	case I_LCHDIR:
-		if (chdir(path1) == -1) {
-			error("Couldn't change local directory to "
-			    "\"%s\": %s", path1, strerror(errno));
-			err = 1;
-		}
-		break;
-	case I_LMKDIR:
-		if (mkdir(path1, 0777) == -1) {
-			error("Couldn't create local directory "
-			    "\"%s\": %s", path1, strerror(errno));
-			err = 1;
-		}
-		break;
-	case I_LLS:
-		local_do_ls(cmd);
-		break;
-	case I_SHELL:
-		local_do_shell(cmd);
-		break;
-	case I_LUMASK:
-		umask(n_arg);
-		printf("Local umask: %03lo\n", n_arg);
-		break;
-	case I_CHMOD:
-		path1 = make_absolute(path1, *pwd);
-		attrib_clear(&a);
-		a.flags |= SSH2_FILEXFER_ATTR_PERMISSIONS;
-		a.perm = n_arg;
-		remote_glob(conn, path1, GLOB_NOCHECK, NULL, &g);
-		for (i = 0; g.gl_pathv[i]; i++) {
-			printf("Changing mode on %s\n", g.gl_pathv[i]);
-			err = do_setstat(conn, g.gl_pathv[i], &a);
-			if (err != 0 && err_abort)
-				break;
-		}
-		break;
-	case I_CHOWN:
-	case I_CHGRP:
-		path1 = make_absolute(path1, *pwd);
-		remote_glob(conn, path1, GLOB_NOCHECK, NULL, &g);
-		for (i = 0; g.gl_pathv[i]; i++) {
-			if (!(aa = do_stat(conn, g.gl_pathv[i], 0))) {
-				if (err != 0 && err_abort)
-					break;
-				else
-					continue;
-			}
-			if (!(aa->flags & SSH2_FILEXFER_ATTR_UIDGID)) {
-				error("Can't get current ownership of "
-				    "remote file \"%s\"", g.gl_pathv[i]);
-				if (err != 0 && err_abort)
-					break;
-				else
-					continue;
-			}
-			aa->flags &= SSH2_FILEXFER_ATTR_UIDGID;
-			if (cmdnum == I_CHOWN) {
-				printf("Changing owner on %s\n", g.gl_pathv[i]);
-				aa->uid = n_arg;
-			} else {
-				printf("Changing group on %s\n", g.gl_pathv[i]);
-				aa->gid = n_arg;
-			}
-			err = do_setstat(conn, g.gl_pathv[i], aa);
-			if (err != 0 && err_abort)
-				break;
-		}
-		break;
-	case I_PWD:
-		printf("Remote working directory: %s\n", *pwd);
-		break;
-	case I_LPWD:
-		if (!getcwd(path_buf, sizeof(path_buf))) {
-			error("Couldn't get local cwd: %s", strerror(errno));
-			err = -1;
-			break;
-		}
-		printf("Local working directory: %s\n", path_buf);
-		break;
-	case I_QUIT:
-		/* Processed below */
-		break;
-	case I_HELP:
-		help();
-		break;
-	case I_VERSION:
-		printf("SFTP protocol version %u\n", sftp_proto_version(conn));
-		break;
-	case I_PROGRESS:
-		showprogress = !showprogress;
-		if (showprogress)
-			printf("Progress meter enabled\n");
-		else
-			printf("Progress meter disabled\n");
-		break;
-	default:
-		fatal("%d is not implemented", cmdnum);
-	}
-
-	if (g.gl_pathc)
-		globfree(&g);
-	if (path1)
-		xfree(path1);
-	if (path2)
-		xfree(path2);
-
-	/* If an unignored error occurs in batch mode we should abort. */
-	if (err_abort && err != 0)
-		return (-1);
-	else if (cmdnum == I_QUIT)
-		return (1);
-
-	return (0);
-}
-
-int
-interactive_loop(int fd_in, int fd_out, char *file1, char *file2)
-{
-	char *pwd;
-	char *dir = NULL;
-	char cmd[2048];
-	struct sftp_conn *conn;
-	int err;
-
-	conn = do_init(fd_in, fd_out, copy_buffer_len, num_requests);
-	if (conn == NULL)
-		fatal("Couldn't initialise connection to server");
-
-	pwd = do_realpath(conn, ".");
-	if (pwd == NULL)
-		fatal("Need cwd");
-
-	if (file1 != NULL) {
-		dir = xstrdup(file1);
-		dir = make_absolute(dir, pwd);
-
-		if (remote_is_dir(conn, dir) && file2 == NULL) {
-			printf("Changing to: %s\n", dir);
-			snprintf(cmd, sizeof cmd, "cd \"%s\"", dir);
-			if (parse_dispatch_command(conn, cmd, &pwd, 1) != 0)
-				return (-1);
-		} else {
-			if (file2 == NULL)
-				snprintf(cmd, sizeof cmd, "get %s", dir);
-			else
-				snprintf(cmd, sizeof cmd, "get %s %s", dir,
-				    file2);
-
-			err = parse_dispatch_command(conn, cmd, &pwd, 1);
-			xfree(dir);
-			xfree(pwd);
-			return (err);
-		}
-		xfree(dir);
-	}
-
-#if HAVE_SETVBUF
-	setvbuf(stdout, NULL, _IOLBF, 0);
-	setvbuf(infile, NULL, _IOLBF, 0);
-#else
-	setlinebuf(stdout);
-	setlinebuf(infile);
-#endif
-
-	err = 0;
-	for (;;) {
-		char *cp;
-
-		printf("sftp> ");
-
-		/* XXX: use libedit */
-		if (fgets(cmd, sizeof(cmd), infile) == NULL) {
-			printf("\n");
-			break;
-		} else if (infile != stdin) /* Bluff typing */
-			printf("%s", cmd);
-
-		cp = strrchr(cmd, '\n');
-		if (cp)
-			*cp = '\0';
-
-		err = parse_dispatch_command(conn, cmd, &pwd, infile != stdin);
-		if (err != 0)
-			break;
-	}
-	xfree(pwd);
-
-	/* err == 1 signifies normal "quit" exit */
-	return (err >= 0 ? 0 : -1);
-}
-
diff --git a/crypto/openssh/sftp-int.h b/crypto/openssh/sftp-int.h
deleted file mode 100644
index 8a04a03f6156..000000000000
--- a/crypto/openssh/sftp-int.h
+++ /dev/null
@@ -1,27 +0,0 @@
-/* $OpenBSD: sftp-int.h,v 1.6 2003/01/08 23:53:26 djm Exp $ */
-
-/*
- * Copyright (c) 2001,2002 Damien Miller.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-int	 interactive_loop(int, int, char *, char *);
diff --git a/crypto/openssh/sftp-server.8 b/crypto/openssh/sftp-server.8
deleted file mode 100644
index 0a0210a34e0a..000000000000
--- a/crypto/openssh/sftp-server.8
+++ /dev/null
@@ -1,62 +0,0 @@
-.\" $OpenBSD: sftp-server.8,v 1.8 2001/06/23 05:57:08 deraadt Exp $
-.\"
-.\" Copyright (c) 2000 Markus Friedl.  All rights reserved.
-.\"
-.\" Redistribution and use in source and binary forms, with or without
-.\" modification, are permitted provided that the following conditions
-.\" are met:
-.\" 1. Redistributions of source code must retain the above copyright
-.\"    notice, this list of conditions and the following disclaimer.
-.\" 2. Redistributions in binary form must reproduce the above copyright
-.\"    notice, this list of conditions and the following disclaimer in the
-.\"    documentation and/or other materials provided with the distribution.
-.\"
-.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-.\"
-.Dd August 30, 2000
-.Dt SFTP-SERVER 8
-.Os
-.Sh NAME
-.Nm sftp-server
-.Nd SFTP server subsystem
-.Sh SYNOPSIS
-.Nm sftp-server
-.Sh DESCRIPTION
-.Nm
-is a program that speaks the server side of SFTP protocol
-to stdout and expects client requests from stdin.
-.Nm
-is not intended to be called directly, but from
-.Xr sshd 8
-using the
-.Cm Subsystem
-option.
-See
-.Xr sshd 8
-for more information.
-.Sh SEE ALSO
-.Xr sftp 1 ,
-.Xr ssh 1 ,
-.Xr sshd 8
-.Rs
-.%A T. Ylonen
-.%A S. Lehtinen
-.%T "SSH File Transfer Protocol"
-.%N draft-ietf-secsh-filexfer-00.txt
-.%D January 2001
-.%O work in progress material
-.Re
-.Sh AUTHORS
-Markus Friedl <markus@openbsd.org>
-.Sh HISTORY
-.Nm
-first appeared in OpenBSD 2.8 .
diff --git a/crypto/openssh/sftp-server.c b/crypto/openssh/sftp-server.c
deleted file mode 100644
index 9a66b4de7c61..000000000000
--- a/crypto/openssh/sftp-server.c
+++ /dev/null
@@ -1,1103 +0,0 @@
-/*
- * Copyright (c) 2000, 2001, 2002 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#include "includes.h"
-RCSID("$OpenBSD: sftp-server.c,v 1.41 2003/03/26 04:02:51 deraadt Exp $");
-
-#include "buffer.h"
-#include "bufaux.h"
-#include "getput.h"
-#include "log.h"
-#include "xmalloc.h"
-
-#include "sftp.h"
-#include "sftp-common.h"
-
-/* helper */
-#define get_int64()			buffer_get_int64(&iqueue);
-#define get_int()			buffer_get_int(&iqueue);
-#define get_string(lenp)		buffer_get_string(&iqueue, lenp);
-#define TRACE				debug
-
-#ifdef HAVE___PROGNAME
-extern char *__progname;
-#else
-char *__progname;
-#endif
-
-/* input and output queue */
-Buffer iqueue;
-Buffer oqueue;
-
-/* Version of client */
-int version;
-
-/* portable attibutes, etc. */
-
-typedef struct Stat Stat;
-
-struct Stat {
-	char *name;
-	char *long_name;
-	Attrib attrib;
-};
-
-static int
-errno_to_portable(int unixerrno)
-{
-	int ret = 0;
-
-	switch (unixerrno) {
-	case 0:
-		ret = SSH2_FX_OK;
-		break;
-	case ENOENT:
-	case ENOTDIR:
-	case EBADF:
-	case ELOOP:
-		ret = SSH2_FX_NO_SUCH_FILE;
-		break;
-	case EPERM:
-	case EACCES:
-	case EFAULT:
-		ret = SSH2_FX_PERMISSION_DENIED;
-		break;
-	case ENAMETOOLONG:
-	case EINVAL:
-		ret = SSH2_FX_BAD_MESSAGE;
-		break;
-	default:
-		ret = SSH2_FX_FAILURE;
-		break;
-	}
-	return ret;
-}
-
-static int
-flags_from_portable(int pflags)
-{
-	int flags = 0;
-
-	if ((pflags & SSH2_FXF_READ) &&
-	    (pflags & SSH2_FXF_WRITE)) {
-		flags = O_RDWR;
-	} else if (pflags & SSH2_FXF_READ) {
-		flags = O_RDONLY;
-	} else if (pflags & SSH2_FXF_WRITE) {
-		flags = O_WRONLY;
-	}
-	if (pflags & SSH2_FXF_CREAT)
-		flags |= O_CREAT;
-	if (pflags & SSH2_FXF_TRUNC)
-		flags |= O_TRUNC;
-	if (pflags & SSH2_FXF_EXCL)
-		flags |= O_EXCL;
-	return flags;
-}
-
-static Attrib *
-get_attrib(void)
-{
-	return decode_attrib(&iqueue);
-}
-
-/* handle handles */
-
-typedef struct Handle Handle;
-struct Handle {
-	int use;
-	DIR *dirp;
-	int fd;
-	char *name;
-};
-
-enum {
-	HANDLE_UNUSED,
-	HANDLE_DIR,
-	HANDLE_FILE
-};
-
-Handle	handles[100];
-
-static void
-handle_init(void)
-{
-	int i;
-
-	for (i = 0; i < sizeof(handles)/sizeof(Handle); i++)
-		handles[i].use = HANDLE_UNUSED;
-}
-
-static int
-handle_new(int use, char *name, int fd, DIR *dirp)
-{
-	int i;
-
-	for (i = 0; i < sizeof(handles)/sizeof(Handle); i++) {
-		if (handles[i].use == HANDLE_UNUSED) {
-			handles[i].use = use;
-			handles[i].dirp = dirp;
-			handles[i].fd = fd;
-			handles[i].name = xstrdup(name);
-			return i;
-		}
-	}
-	return -1;
-}
-
-static int
-handle_is_ok(int i, int type)
-{
-	return i >= 0 && i < sizeof(handles)/sizeof(Handle) &&
-	    handles[i].use == type;
-}
-
-static int
-handle_to_string(int handle, char **stringp, int *hlenp)
-{
-	if (stringp == NULL || hlenp == NULL)
-		return -1;
-	*stringp = xmalloc(sizeof(int32_t));
-	PUT_32BIT(*stringp, handle);
-	*hlenp = sizeof(int32_t);
-	return 0;
-}
-
-static int
-handle_from_string(char *handle, u_int hlen)
-{
-	int val;
-
-	if (hlen != sizeof(int32_t))
-		return -1;
-	val = GET_32BIT(handle);
-	if (handle_is_ok(val, HANDLE_FILE) ||
-	    handle_is_ok(val, HANDLE_DIR))
-		return val;
-	return -1;
-}
-
-static char *
-handle_to_name(int handle)
-{
-	if (handle_is_ok(handle, HANDLE_DIR)||
-	    handle_is_ok(handle, HANDLE_FILE))
-		return handles[handle].name;
-	return NULL;
-}
-
-static DIR *
-handle_to_dir(int handle)
-{
-	if (handle_is_ok(handle, HANDLE_DIR))
-		return handles[handle].dirp;
-	return NULL;
-}
-
-static int
-handle_to_fd(int handle)
-{
-	if (handle_is_ok(handle, HANDLE_FILE))
-		return handles[handle].fd;
-	return -1;
-}
-
-static int
-handle_close(int handle)
-{
-	int ret = -1;
-
-	if (handle_is_ok(handle, HANDLE_FILE)) {
-		ret = close(handles[handle].fd);
-		handles[handle].use = HANDLE_UNUSED;
-		xfree(handles[handle].name);
-	} else if (handle_is_ok(handle, HANDLE_DIR)) {
-		ret = closedir(handles[handle].dirp);
-		handles[handle].use = HANDLE_UNUSED;
-		xfree(handles[handle].name);
-	} else {
-		errno = ENOENT;
-	}
-	return ret;
-}
-
-static int
-get_handle(void)
-{
-	char *handle;
-	int val = -1;
-	u_int hlen;
-
-	handle = get_string(&hlen);
-	if (hlen < 256)
-		val = handle_from_string(handle, hlen);
-	xfree(handle);
-	return val;
-}
-
-/* send replies */
-
-static void
-send_msg(Buffer *m)
-{
-	int mlen = buffer_len(m);
-
-	buffer_put_int(&oqueue, mlen);
-	buffer_append(&oqueue, buffer_ptr(m), mlen);
-	buffer_consume(m, mlen);
-}
-
-static void
-send_status(u_int32_t id, u_int32_t error)
-{
-	Buffer msg;
-	const char *status_messages[] = {
-		"Success",			/* SSH_FX_OK */
-		"End of file",			/* SSH_FX_EOF */
-		"No such file",			/* SSH_FX_NO_SUCH_FILE */
-		"Permission denied",		/* SSH_FX_PERMISSION_DENIED */
-		"Failure",			/* SSH_FX_FAILURE */
-		"Bad message",			/* SSH_FX_BAD_MESSAGE */
-		"No connection",		/* SSH_FX_NO_CONNECTION */
-		"Connection lost",		/* SSH_FX_CONNECTION_LOST */
-		"Operation unsupported",	/* SSH_FX_OP_UNSUPPORTED */
-		"Unknown error"			/* Others */
-	};
-
-	TRACE("sent status id %u error %u", id, error);
-	buffer_init(&msg);
-	buffer_put_char(&msg, SSH2_FXP_STATUS);
-	buffer_put_int(&msg, id);
-	buffer_put_int(&msg, error);
-	if (version >= 3) {
-		buffer_put_cstring(&msg,
-		    status_messages[MIN(error,SSH2_FX_MAX)]);
-		buffer_put_cstring(&msg, "");
-	}
-	send_msg(&msg);
-	buffer_free(&msg);
-}
-static void
-send_data_or_handle(char type, u_int32_t id, char *data, int dlen)
-{
-	Buffer msg;
-
-	buffer_init(&msg);
-	buffer_put_char(&msg, type);
-	buffer_put_int(&msg, id);
-	buffer_put_string(&msg, data, dlen);
-	send_msg(&msg);
-	buffer_free(&msg);
-}
-
-static void
-send_data(u_int32_t id, char *data, int dlen)
-{
-	TRACE("sent data id %u len %d", id, dlen);
-	send_data_or_handle(SSH2_FXP_DATA, id, data, dlen);
-}
-
-static void
-send_handle(u_int32_t id, int handle)
-{
-	char *string;
-	int hlen;
-
-	handle_to_string(handle, &string, &hlen);
-	TRACE("sent handle id %u handle %d", id, handle);
-	send_data_or_handle(SSH2_FXP_HANDLE, id, string, hlen);
-	xfree(string);
-}
-
-static void
-send_names(u_int32_t id, int count, Stat *stats)
-{
-	Buffer msg;
-	int i;
-
-	buffer_init(&msg);
-	buffer_put_char(&msg, SSH2_FXP_NAME);
-	buffer_put_int(&msg, id);
-	buffer_put_int(&msg, count);
-	TRACE("sent names id %u count %d", id, count);
-	for (i = 0; i < count; i++) {
-		buffer_put_cstring(&msg, stats[i].name);
-		buffer_put_cstring(&msg, stats[i].long_name);
-		encode_attrib(&msg, &stats[i].attrib);
-	}
-	send_msg(&msg);
-	buffer_free(&msg);
-}
-
-static void
-send_attrib(u_int32_t id, Attrib *a)
-{
-	Buffer msg;
-
-	TRACE("sent attrib id %u have 0x%x", id, a->flags);
-	buffer_init(&msg);
-	buffer_put_char(&msg, SSH2_FXP_ATTRS);
-	buffer_put_int(&msg, id);
-	encode_attrib(&msg, a);
-	send_msg(&msg);
-	buffer_free(&msg);
-}
-
-/* parse incoming */
-
-static void
-process_init(void)
-{
-	Buffer msg;
-
-	version = get_int();
-	TRACE("client version %d", version);
-	buffer_init(&msg);
-	buffer_put_char(&msg, SSH2_FXP_VERSION);
-	buffer_put_int(&msg, SSH2_FILEXFER_VERSION);
-	send_msg(&msg);
-	buffer_free(&msg);
-}
-
-static void
-process_open(void)
-{
-	u_int32_t id, pflags;
-	Attrib *a;
-	char *name;
-	int handle, fd, flags, mode, status = SSH2_FX_FAILURE;
-
-	id = get_int();
-	name = get_string(NULL);
-	pflags = get_int();		/* portable flags */
-	a = get_attrib();
-	flags = flags_from_portable(pflags);
-	mode = (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ? a->perm : 0666;
-	TRACE("open id %u name %s flags %d mode 0%o", id, name, pflags, mode);
-	fd = open(name, flags, mode);
-	if (fd < 0) {
-		status = errno_to_portable(errno);
-	} else {
-		handle = handle_new(HANDLE_FILE, name, fd, NULL);
-		if (handle < 0) {
-			close(fd);
-		} else {
-			send_handle(id, handle);
-			status = SSH2_FX_OK;
-		}
-	}
-	if (status != SSH2_FX_OK)
-		send_status(id, status);
-	xfree(name);
-}
-
-static void
-process_close(void)
-{
-	u_int32_t id;
-	int handle, ret, status = SSH2_FX_FAILURE;
-
-	id = get_int();
-	handle = get_handle();
-	TRACE("close id %u handle %d", id, handle);
-	ret = handle_close(handle);
-	status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
-	send_status(id, status);
-}
-
-static void
-process_read(void)
-{
-	char buf[64*1024];
-	u_int32_t id, len;
-	int handle, fd, ret, status = SSH2_FX_FAILURE;
-	u_int64_t off;
-
-	id = get_int();
-	handle = get_handle();
-	off = get_int64();
-	len = get_int();
-
-	TRACE("read id %u handle %d off %llu len %d", id, handle,
-	    (u_int64_t)off, len);
-	if (len > sizeof buf) {
-		len = sizeof buf;
-		log("read change len %d", len);
-	}
-	fd = handle_to_fd(handle);
-	if (fd >= 0) {
-		if (lseek(fd, off, SEEK_SET) < 0) {
-			error("process_read: seek failed");
-			status = errno_to_portable(errno);
-		} else {
-			ret = read(fd, buf, len);
-			if (ret < 0) {
-				status = errno_to_portable(errno);
-			} else if (ret == 0) {
-				status = SSH2_FX_EOF;
-			} else {
-				send_data(id, buf, ret);
-				status = SSH2_FX_OK;
-			}
-		}
-	}
-	if (status != SSH2_FX_OK)
-		send_status(id, status);
-}
-
-static void
-process_write(void)
-{
-	u_int32_t id;
-	u_int64_t off;
-	u_int len;
-	int handle, fd, ret, status = SSH2_FX_FAILURE;
-	char *data;
-
-	id = get_int();
-	handle = get_handle();
-	off = get_int64();
-	data = get_string(&len);
-
-	TRACE("write id %u handle %d off %llu len %d", id, handle,
-	    (u_int64_t)off, len);
-	fd = handle_to_fd(handle);
-	if (fd >= 0) {
-		if (lseek(fd, off, SEEK_SET) < 0) {
-			status = errno_to_portable(errno);
-			error("process_write: seek failed");
-		} else {
-/* XXX ATOMICIO ? */
-			ret = write(fd, data, len);
-			if (ret == -1) {
-				error("process_write: write failed");
-				status = errno_to_portable(errno);
-			} else if (ret == len) {
-				status = SSH2_FX_OK;
-			} else {
-				log("nothing at all written");
-			}
-		}
-	}
-	send_status(id, status);
-	xfree(data);
-}
-
-static void
-process_do_stat(int do_lstat)
-{
-	Attrib a;
-	struct stat st;
-	u_int32_t id;
-	char *name;
-	int ret, status = SSH2_FX_FAILURE;
-
-	id = get_int();
-	name = get_string(NULL);
-	TRACE("%sstat id %u name %s", do_lstat ? "l" : "", id, name);
-	ret = do_lstat ? lstat(name, &st) : stat(name, &st);
-	if (ret < 0) {
-		status = errno_to_portable(errno);
-	} else {
-		stat_to_attrib(&st, &a);
-		send_attrib(id, &a);
-		status = SSH2_FX_OK;
-	}
-	if (status != SSH2_FX_OK)
-		send_status(id, status);
-	xfree(name);
-}
-
-static void
-process_stat(void)
-{
-	process_do_stat(0);
-}
-
-static void
-process_lstat(void)
-{
-	process_do_stat(1);
-}
-
-static void
-process_fstat(void)
-{
-	Attrib a;
-	struct stat st;
-	u_int32_t id;
-	int fd, ret, handle, status = SSH2_FX_FAILURE;
-
-	id = get_int();
-	handle = get_handle();
-	TRACE("fstat id %u handle %d", id, handle);
-	fd = handle_to_fd(handle);
-	if (fd  >= 0) {
-		ret = fstat(fd, &st);
-		if (ret < 0) {
-			status = errno_to_portable(errno);
-		} else {
-			stat_to_attrib(&st, &a);
-			send_attrib(id, &a);
-			status = SSH2_FX_OK;
-		}
-	}
-	if (status != SSH2_FX_OK)
-		send_status(id, status);
-}
-
-static struct timeval *
-attrib_to_tv(Attrib *a)
-{
-	static struct timeval tv[2];
-
-	tv[0].tv_sec = a->atime;
-	tv[0].tv_usec = 0;
-	tv[1].tv_sec = a->mtime;
-	tv[1].tv_usec = 0;
-	return tv;
-}
-
-static void
-process_setstat(void)
-{
-	Attrib *a;
-	u_int32_t id;
-	char *name;
-	int status = SSH2_FX_OK, ret;
-
-	id = get_int();
-	name = get_string(NULL);
-	a = get_attrib();
-	TRACE("setstat id %u name %s", id, name);
-	if (a->flags & SSH2_FILEXFER_ATTR_SIZE) {
-		ret = truncate(name, a->size);
-		if (ret == -1)
-			status = errno_to_portable(errno);
-	}
-	if (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) {
-		ret = chmod(name, a->perm & 0777);
-		if (ret == -1)
-			status = errno_to_portable(errno);
-	}
-	if (a->flags & SSH2_FILEXFER_ATTR_ACMODTIME) {
-		ret = utimes(name, attrib_to_tv(a));
-		if (ret == -1)
-			status = errno_to_portable(errno);
-	}
-	if (a->flags & SSH2_FILEXFER_ATTR_UIDGID) {
-		ret = chown(name, a->uid, a->gid);
-		if (ret == -1)
-			status = errno_to_portable(errno);
-	}
-	send_status(id, status);
-	xfree(name);
-}
-
-static void
-process_fsetstat(void)
-{
-	Attrib *a;
-	u_int32_t id;
-	int handle, fd, ret;
-	int status = SSH2_FX_OK;
-	char *name;
-
-	id = get_int();
-	handle = get_handle();
-	a = get_attrib();
-	TRACE("fsetstat id %u handle %d", id, handle);
-	fd = handle_to_fd(handle);
-	name = handle_to_name(handle);
-	if (fd < 0 || name == NULL) {
-		status = SSH2_FX_FAILURE;
-	} else {
-		if (a->flags & SSH2_FILEXFER_ATTR_SIZE) {
-			ret = ftruncate(fd, a->size);
-			if (ret == -1)
-				status = errno_to_portable(errno);
-		}
-		if (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) {
-#ifdef HAVE_FCHMOD
-			ret = fchmod(fd, a->perm & 0777);
-#else
-			ret = chmod(name, a->perm & 0777);
-#endif
-			if (ret == -1)
-				status = errno_to_portable(errno);
-		}
-		if (a->flags & SSH2_FILEXFER_ATTR_ACMODTIME) {
-#ifdef HAVE_FUTIMES
-			ret = futimes(fd, attrib_to_tv(a));
-#else
-			ret = utimes(name, attrib_to_tv(a));
-#endif
-			if (ret == -1)
-				status = errno_to_portable(errno);
-		}
-		if (a->flags & SSH2_FILEXFER_ATTR_UIDGID) {
-#ifdef HAVE_FCHOWN
-			ret = fchown(fd, a->uid, a->gid);
-#else
-			ret = chown(name, a->uid, a->gid);
-#endif
-			if (ret == -1)
-				status = errno_to_portable(errno);
-		}
-	}
-	send_status(id, status);
-}
-
-static void
-process_opendir(void)
-{
-	DIR *dirp = NULL;
-	char *path;
-	int handle, status = SSH2_FX_FAILURE;
-	u_int32_t id;
-
-	id = get_int();
-	path = get_string(NULL);
-	TRACE("opendir id %u path %s", id, path);
-	dirp = opendir(path);
-	if (dirp == NULL) {
-		status = errno_to_portable(errno);
-	} else {
-		handle = handle_new(HANDLE_DIR, path, 0, dirp);
-		if (handle < 0) {
-			closedir(dirp);
-		} else {
-			send_handle(id, handle);
-			status = SSH2_FX_OK;
-		}
-
-	}
-	if (status != SSH2_FX_OK)
-		send_status(id, status);
-	xfree(path);
-}
-
-static void
-process_readdir(void)
-{
-	DIR *dirp;
-	struct dirent *dp;
-	char *path;
-	int handle;
-	u_int32_t id;
-
-	id = get_int();
-	handle = get_handle();
-	TRACE("readdir id %u handle %d", id, handle);
-	dirp = handle_to_dir(handle);
-	path = handle_to_name(handle);
-	if (dirp == NULL || path == NULL) {
-		send_status(id, SSH2_FX_FAILURE);
-	} else {
-		struct stat st;
-		char pathname[1024];
-		Stat *stats;
-		int nstats = 10, count = 0, i;
-
-		stats = xmalloc(nstats * sizeof(Stat));
-		while ((dp = readdir(dirp)) != NULL) {
-			if (count >= nstats) {
-				nstats *= 2;
-				stats = xrealloc(stats, nstats * sizeof(Stat));
-			}
-/* XXX OVERFLOW ? */
-			snprintf(pathname, sizeof pathname, "%s%s%s", path,
-			    strcmp(path, "/") ? "/" : "", dp->d_name);
-			if (lstat(pathname, &st) < 0)
-				continue;
-			stat_to_attrib(&st, &(stats[count].attrib));
-			stats[count].name = xstrdup(dp->d_name);
-			stats[count].long_name = ls_file(dp->d_name, &st, 0);
-			count++;
-			/* send up to 100 entries in one message */
-			/* XXX check packet size instead */
-			if (count == 100)
-				break;
-		}
-		if (count > 0) {
-			send_names(id, count, stats);
-			for (i = 0; i < count; i++) {
-				xfree(stats[i].name);
-				xfree(stats[i].long_name);
-			}
-		} else {
-			send_status(id, SSH2_FX_EOF);
-		}
-		xfree(stats);
-	}
-}
-
-static void
-process_remove(void)
-{
-	char *name;
-	u_int32_t id;
-	int status = SSH2_FX_FAILURE;
-	int ret;
-
-	id = get_int();
-	name = get_string(NULL);
-	TRACE("remove id %u name %s", id, name);
-	ret = unlink(name);
-	status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
-	send_status(id, status);
-	xfree(name);
-}
-
-static void
-process_mkdir(void)
-{
-	Attrib *a;
-	u_int32_t id;
-	char *name;
-	int ret, mode, status = SSH2_FX_FAILURE;
-
-	id = get_int();
-	name = get_string(NULL);
-	a = get_attrib();
-	mode = (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ?
-	    a->perm & 0777 : 0777;
-	TRACE("mkdir id %u name %s mode 0%o", id, name, mode);
-	ret = mkdir(name, mode);
-	status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
-	send_status(id, status);
-	xfree(name);
-}
-
-static void
-process_rmdir(void)
-{
-	u_int32_t id;
-	char *name;
-	int ret, status;
-
-	id = get_int();
-	name = get_string(NULL);
-	TRACE("rmdir id %u name %s", id, name);
-	ret = rmdir(name);
-	status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
-	send_status(id, status);
-	xfree(name);
-}
-
-static void
-process_realpath(void)
-{
-	char resolvedname[MAXPATHLEN];
-	u_int32_t id;
-	char *path;
-
-	id = get_int();
-	path = get_string(NULL);
-	if (path[0] == '\0') {
-		xfree(path);
-		path = xstrdup(".");
-	}
-	TRACE("realpath id %u path %s", id, path);
-	if (realpath(path, resolvedname) == NULL) {
-		send_status(id, errno_to_portable(errno));
-	} else {
-		Stat s;
-		attrib_clear(&s.attrib);
-		s.name = s.long_name = resolvedname;
-		send_names(id, 1, &s);
-	}
-	xfree(path);
-}
-
-static void
-process_rename(void)
-{
-	u_int32_t id;
-	char *oldpath, *newpath;
-	int status;
-	struct stat sb;
-
-	id = get_int();
-	oldpath = get_string(NULL);
-	newpath = get_string(NULL);
-	TRACE("rename id %u old %s new %s", id, oldpath, newpath);
-	status = SSH2_FX_FAILURE;
-	if (lstat(oldpath, &sb) == -1)
-		status = errno_to_portable(errno);
-	else if (S_ISREG(sb.st_mode)) {
-		/* Race-free rename of regular files */
-		if (link(oldpath, newpath) == -1)
-			status = errno_to_portable(errno);
-		else if (unlink(oldpath) == -1) {
-			status = errno_to_portable(errno);
-			/* clean spare link */
-			unlink(newpath);
-		} else
-			status = SSH2_FX_OK;
-	} else if (stat(newpath, &sb) == -1) {
-		if (rename(oldpath, newpath) == -1)
-			status = errno_to_portable(errno);
-		else
-			status = SSH2_FX_OK;
-	}
-	send_status(id, status);
-	xfree(oldpath);
-	xfree(newpath);
-}
-
-static void
-process_readlink(void)
-{
-	u_int32_t id;
-	int len;
-	char link[MAXPATHLEN];
-	char *path;
-
-	id = get_int();
-	path = get_string(NULL);
-	TRACE("readlink id %u path %s", id, path);
-	if ((len = readlink(path, link, sizeof(link) - 1)) == -1)
-		send_status(id, errno_to_portable(errno));
-	else {
-		Stat s;
-
-		link[len] = '\0';
-		attrib_clear(&s.attrib);
-		s.name = s.long_name = link;
-		send_names(id, 1, &s);
-	}
-	xfree(path);
-}
-
-static void
-process_symlink(void)
-{
-	u_int32_t id;
-	char *oldpath, *newpath;
-	int ret, status;
-
-	id = get_int();
-	oldpath = get_string(NULL);
-	newpath = get_string(NULL);
-	TRACE("symlink id %u old %s new %s", id, oldpath, newpath);
-	/* this will fail if 'newpath' exists */
-	ret = symlink(oldpath, newpath);
-	status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
-	send_status(id, status);
-	xfree(oldpath);
-	xfree(newpath);
-}
-
-static void
-process_extended(void)
-{
-	u_int32_t id;
-	char *request;
-
-	id = get_int();
-	request = get_string(NULL);
-	send_status(id, SSH2_FX_OP_UNSUPPORTED);		/* MUST */
-	xfree(request);
-}
-
-/* stolen from ssh-agent */
-
-static void
-process(void)
-{
-	u_int msg_len;
-	u_int buf_len;
-	u_int consumed;
-	u_int type;
-	u_char *cp;
-
-	buf_len = buffer_len(&iqueue);
-	if (buf_len < 5)
-		return;		/* Incomplete message. */
-	cp = buffer_ptr(&iqueue);
-	msg_len = GET_32BIT(cp);
-	if (msg_len > 256 * 1024) {
-		error("bad message ");
-		exit(11);
-	}
-	if (buf_len < msg_len + 4)
-		return;
-	buffer_consume(&iqueue, 4);
-	buf_len -= 4;
-	type = buffer_get_char(&iqueue);
-	switch (type) {
-	case SSH2_FXP_INIT:
-		process_init();
-		break;
-	case SSH2_FXP_OPEN:
-		process_open();
-		break;
-	case SSH2_FXP_CLOSE:
-		process_close();
-		break;
-	case SSH2_FXP_READ:
-		process_read();
-		break;
-	case SSH2_FXP_WRITE:
-		process_write();
-		break;
-	case SSH2_FXP_LSTAT:
-		process_lstat();
-		break;
-	case SSH2_FXP_FSTAT:
-		process_fstat();
-		break;
-	case SSH2_FXP_SETSTAT:
-		process_setstat();
-		break;
-	case SSH2_FXP_FSETSTAT:
-		process_fsetstat();
-		break;
-	case SSH2_FXP_OPENDIR:
-		process_opendir();
-		break;
-	case SSH2_FXP_READDIR:
-		process_readdir();
-		break;
-	case SSH2_FXP_REMOVE:
-		process_remove();
-		break;
-	case SSH2_FXP_MKDIR:
-		process_mkdir();
-		break;
-	case SSH2_FXP_RMDIR:
-		process_rmdir();
-		break;
-	case SSH2_FXP_REALPATH:
-		process_realpath();
-		break;
-	case SSH2_FXP_STAT:
-		process_stat();
-		break;
-	case SSH2_FXP_RENAME:
-		process_rename();
-		break;
-	case SSH2_FXP_READLINK:
-		process_readlink();
-		break;
-	case SSH2_FXP_SYMLINK:
-		process_symlink();
-		break;
-	case SSH2_FXP_EXTENDED:
-		process_extended();
-		break;
-	default:
-		error("Unknown message %d", type);
-		break;
-	}
-	/* discard the remaining bytes from the current packet */
-	if (buf_len < buffer_len(&iqueue))
-		fatal("iqueue grows");
-	consumed = buf_len - buffer_len(&iqueue);
-	if (msg_len < consumed)
-		fatal("msg_len %d < consumed %d", msg_len, consumed);
-	if (msg_len > consumed)
-		buffer_consume(&iqueue, msg_len - consumed);
-}
-
-int
-main(int ac, char **av)
-{
-	fd_set *rset, *wset;
-	int in, out, max;
-	ssize_t len, olen, set_size;
-
-	/* XXX should use getopt */
-
-	__progname = get_progname(av[0]);
-	handle_init();
-
-#ifdef DEBUG_SFTP_SERVER
-	log_init("sftp-server", SYSLOG_LEVEL_DEBUG1, SYSLOG_FACILITY_AUTH, 0);
-#endif
-
-	in = dup(STDIN_FILENO);
-	out = dup(STDOUT_FILENO);
-
-#ifdef HAVE_CYGWIN
-	setmode(in, O_BINARY);
-	setmode(out, O_BINARY);
-#endif
-
-	max = 0;
-	if (in > max)
-		max = in;
-	if (out > max)
-		max = out;
-
-	buffer_init(&iqueue);
-	buffer_init(&oqueue);
-
-	set_size = howmany(max + 1, NFDBITS) * sizeof(fd_mask);
-	rset = (fd_set *)xmalloc(set_size);
-	wset = (fd_set *)xmalloc(set_size);
-
-	for (;;) {
-		memset(rset, 0, set_size);
-		memset(wset, 0, set_size);
-
-		FD_SET(in, rset);
-		olen = buffer_len(&oqueue);
-		if (olen > 0)
-			FD_SET(out, wset);
-
-		if (select(max+1, rset, wset, NULL, NULL) < 0) {
-			if (errno == EINTR)
-				continue;
-			exit(2);
-		}
-
-		/* copy stdin to iqueue */
-		if (FD_ISSET(in, rset)) {
-			char buf[4*4096];
-			len = read(in, buf, sizeof buf);
-			if (len == 0) {
-				debug("read eof");
-				exit(0);
-			} else if (len < 0) {
-				error("read error");
-				exit(1);
-			} else {
-				buffer_append(&iqueue, buf, len);
-			}
-		}
-		/* send oqueue to stdout */
-		if (FD_ISSET(out, wset)) {
-			len = write(out, buffer_ptr(&oqueue), olen);
-			if (len < 0) {
-				error("write error");
-				exit(1);
-			} else {
-				buffer_consume(&oqueue, len);
-			}
-		}
-		/* process requests from client */
-		process();
-	}
-}
diff --git a/crypto/openssh/sftp-server/Makefile b/crypto/openssh/sftp-server/Makefile
deleted file mode 100644
index e0682391297b..000000000000
--- a/crypto/openssh/sftp-server/Makefile
+++ /dev/null
@@ -1,18 +0,0 @@
-#	$OpenBSD: Makefile,v 1.5 2001/03/03 23:59:36 markus Exp $
-
-.PATH:		${.CURDIR}/..
-
-PROG=	sftp-server
-BINOWN=	root
-
-BINMODE?=555
-
-BINDIR=	/usr/libexec
-MAN=	sftp-server.8
-
-SRCS=	sftp-server.c sftp-common.c
-
-.include <bsd.prog.mk>
-
-LDADD+=	-lcrypto
-DPADD+=	${LIBCRYPTO}
diff --git a/crypto/openssh/sftp.1 b/crypto/openssh/sftp.1
deleted file mode 100644
index 02d2c274bb36..000000000000
--- a/crypto/openssh/sftp.1
+++ /dev/null
@@ -1,301 +0,0 @@
-.\" $OpenBSD: sftp.1,v 1.41 2003/03/28 10:11:43 jmc Exp $
-.\"
-.\" Copyright (c) 2001 Damien Miller.  All rights reserved.
-.\"
-.\" Redistribution and use in source and binary forms, with or without
-.\" modification, are permitted provided that the following conditions
-.\" are met:
-.\" 1. Redistributions of source code must retain the above copyright
-.\"    notice, this list of conditions and the following disclaimer.
-.\" 2. Redistributions in binary form must reproduce the above copyright
-.\"    notice, this list of conditions and the following disclaimer in the
-.\"    documentation and/or other materials provided with the distribution.
-.\"
-.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-.\"
-.Dd February 4, 2001
-.Dt SFTP 1
-.Os
-.Sh NAME
-.Nm sftp
-.Nd Secure file transfer program
-.Sh SYNOPSIS
-.Nm sftp
-.Bk -words
-.Op Fl vC1
-.Op Fl b Ar batchfile
-.Op Fl o Ar ssh_option
-.Op Fl s Ar subsystem | sftp_server
-.Op Fl B Ar buffer_size
-.Op Fl F Ar ssh_config
-.Op Fl P Ar sftp_server path
-.Op Fl R Ar num_requests
-.Op Fl S Ar program
-.Ar host
-.Ek
-.Nm sftp
-.Oo Oo Ar user Ns No @ Oc Ns
-.Ar host Ns Oo : Ns Ar file Oo
-.Ar file Oc Oc Oc
-.Nm sftp
-.Oo Oo Ar user Ns No @ Oc Ns
-.Ar host Ns Oo : Ns Ar dir Ns
-.Oo Ar / Oc Oc Oc
-.Sh DESCRIPTION
-.Nm
-is an interactive file transfer program, similar to
-.Xr ftp 1 ,
-which performs all operations over an encrypted
-.Xr ssh 1
-transport.
-It may also use many features of ssh, such as public key authentication and
-compression.
-.Nm
-connects and logs into the specified
-.Ar host ,
-then enters an interactive command mode.
-.Pp
-The second usage format will retrieve files automatically if a non-interactive
-authentication method is used; otherwise it will do so after
-successful interactive authentication.
-.Pp
-The last usage format allows the sftp client to start in a remote directory.
-.Pp
-The options are as follows:
-.Bl -tag -width Ds
-.It Fl b Ar batchfile
-Batch mode reads a series of commands from an input
-.Ar batchfile
-instead of
-.Em stdin .
-Since it lacks user interaction it should be used in conjunction with
-non-interactive authentication.
-.Nm
-will abort if any of the following
-commands fail:
-.Ic get , put , rename , ln ,
-.Ic rm , mkdir , chdir , ls ,
-.Ic lchdir , chmod , chown , chgrp , lpwd
-and
-.Ic lmkdir .
-Termination on error can be suppressed on a command by command basis by
-prefixing the command with a
-.Ic '-'
-character (For example,
-.Ic -rm /tmp/blah*
-).
-.It Fl o Ar ssh_option
-Can be used to pass options to
-.Nm ssh
-in the format used in
-.Xr ssh_config 5 .
-This is useful for specifying options
-for which there is no separate
-.Nm sftp
-command-line flag. For example, to specify an alternate
-port use:
-.Ic sftp -oPort=24 .
-.It Fl s Ar subsystem | sftp_server
-Specifies the SSH2 subsystem or the path for an sftp server
-on the remote host. A path is useful for using sftp over
-protocol version 1, or when the remote
-.Nm sshd
-does not have an sftp subsystem configured.
-.It Fl v
-Raise logging level. This option is also passed to ssh.
-.It Fl B Ar buffer_size
-Specify the size of the buffer that
-.Nm
-uses when transferring files. Larger buffers require fewer round trips at
-the cost of higher memory consumption. The default is 32768 bytes.
-.It Fl C
-Enables compression (via ssh's
-.Fl C
-flag).
-.It Fl F Ar ssh_config
-Specifies an alternative
-per-user configuration file for
-.Nm ssh .
-This option is directly passed to
-.Xr ssh 1 .
-.It Fl P Ar sftp_server path
-Connect directly to a local
-.Nm sftp-server
-(rather than via
-.Nm ssh )
-This option may be useful in debugging the client and server.
-.It Fl R Ar num_requests
-Specify how many requests may be outstanding at any one time. Increasing
-this may slightly improve file transfer speed but will increase memory
-usage. The default is 16 outstanding requests.
-.It Fl S Ar program
-Name of the
-.Ar program
-to use for the encrypted connection.
-The program must understand
-.Xr ssh 1
-options.
-.It Fl 1
-Specify the use of protocol version 1.
-.El
-.Sh INTERACTIVE COMMANDS
-Once in interactive mode,
-.Nm
-understands a set of commands similar to those of
-.Xr ftp 1 .
-Commands are case insensitive and pathnames may be enclosed in quotes if they
-contain spaces.
-.Bl -tag -width Ds
-.It Ic bye
-Quit sftp.
-.It Ic cd Ar path
-Change remote directory to
-.Ar path .
-.It Ic lcd Ar path
-Change local directory to
-.Ar path .
-.It Ic chgrp Ar grp Ar path
-Change group of file
-.Ar path
-to
-.Ar grp .
-.Ar grp
-must be a numeric GID.
-.It Ic chmod Ar mode Ar path
-Change permissions of file
-.Ar path
-to
-.Ar mode .
-.It Ic chown Ar own Ar path
-Change owner of file
-.Ar path
-to
-.Ar own .
-.Ar own
-must be a numeric UID.
-.It Ic exit
-Quit sftp.
-.It Xo Ic get
-.Op Ar flags
-.Ar remote-path
-.Op Ar local-path
-.Xc
-Retrieve the
-.Ar remote-path
-and store it on the local machine.
-If the local
-path name is not specified, it is given the same name it has on the
-remote machine. If the
-.Fl P
-flag is specified, then the file's full permission and access time are
-copied too.
-.It Ic help
-Display help text.
-.It Ic lls Op Ar ls-options Op Ar path
-Display local directory listing of either
-.Ar path
-or current directory if
-.Ar path
-is not specified.
-.It Ic lmkdir Ar path
-Create local directory specified by
-.Ar path .
-.It Ic ln Ar oldpath Ar newpath
-Create a symbolic link from
-.Ar oldpath
-to
-.Ar newpath .
-.It Ic lpwd
-Print local working directory.
-.It Xo Ic ls
-.Op Ar flags
-.Op Ar path
-.Xc
-Display remote directory listing of either
-.Ar path
-or current directory if
-.Ar path
-is not specified. If the
-.Fl l
-flag is specified, then display additional details including permissions
-and ownership information.
-.It Ic lumask Ar umask
-Set local umask to
-.Ar umask .
-.It Ic mkdir Ar path
-Create remote directory specified by
-.Ar path .
-.It Ic progress
-Toggle display of progress meter.
-.It Xo Ic put
-.Op Ar flags
-.Ar local-path
-.Op Ar remote-path
-.Xc
-Upload
-.Ar local-path
-and store it on the remote machine. If the remote path name is not
-specified, it is given the same name it has on the local machine. If the
-.Fl P
-flag is specified, then the file's full permission and access time are
-copied too.
-.It Ic pwd
-Display remote working directory.
-.It Ic quit
-Quit sftp.
-.It Ic rename Ar oldpath Ar newpath
-Rename remote file from
-.Ar oldpath
-to
-.Ar newpath .
-.It Ic rmdir Ar path
-Remove remote directory specified by
-.Ar path .
-.It Ic rm Ar path
-Delete remote file specified by
-.Ar path .
-.It Ic symlink Ar oldpath Ar newpath
-Create a symbolic link from
-.Ar oldpath
-to
-.Ar newpath .
-.It Ic version
-Display the
-.Nm
-protocol version.
-.It Ic ! Ar command
-Execute
-.Ar command
-in local shell.
-.It Ic !
-Escape to local shell.
-.It Ic ?
-Synonym for help.
-.El
-.Sh AUTHORS
-Damien Miller <djm@mindrot.org>
-.Sh SEE ALSO
-.Xr scp 1 ,
-.Xr ssh 1 ,
-.Xr ssh-add 1 ,
-.Xr ssh-keygen 1 ,
-.Xr ssh_config 5 ,
-.Xr sftp-server 8 ,
-.Xr sshd 8
-.Rs
-.%A T. Ylonen
-.%A S. Lehtinen
-.%T "SSH File Transfer Protocol"
-.%N draft-ietf-secsh-filexfer-00.txt
-.%D January 2001
-.%O work in progress material
-.Re
diff --git a/crypto/openssh/sftp.c b/crypto/openssh/sftp.c
deleted file mode 100644
index e8adcba18f65..000000000000
--- a/crypto/openssh/sftp.c
+++ /dev/null
@@ -1,261 +0,0 @@
-/*
- * Copyright (c) 2001,2002 Damien Miller.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-
-RCSID("$OpenBSD: sftp.c,v 1.34 2003/01/10 08:19:07 fgsch Exp $");
-
-/* XXX: short-form remote directory listings (like 'ls -C') */
-
-#include "buffer.h"
-#include "xmalloc.h"
-#include "log.h"
-#include "pathnames.h"
-#include "misc.h"
-
-#include "sftp.h"
-#include "sftp-common.h"
-#include "sftp-client.h"
-#include "sftp-int.h"
-
-#ifdef HAVE___PROGNAME
-extern char *__progname;
-#else
-char *__progname;
-#endif
-
-FILE* infile;
-size_t copy_buffer_len = 32768;
-size_t num_requests = 16;
-
-extern int showprogress;
-
-static void
-connect_to_server(char *path, char **args, int *in, int *out, pid_t *sshpid)
-{
-	int c_in, c_out;
-
-#ifdef USE_PIPES
-	int pin[2], pout[2];
-
-	if ((pipe(pin) == -1) || (pipe(pout) == -1))
-		fatal("pipe: %s", strerror(errno));
-	*in = pin[0];
-	*out = pout[1];
-	c_in = pout[0];
-	c_out = pin[1];
-#else /* USE_PIPES */
-	int inout[2];
-
-	if (socketpair(AF_UNIX, SOCK_STREAM, 0, inout) == -1)
-		fatal("socketpair: %s", strerror(errno));
-	*in = *out = inout[0];
-	c_in = c_out = inout[1];
-#endif /* USE_PIPES */
-
-	if ((*sshpid = fork()) == -1)
-		fatal("fork: %s", strerror(errno));
-	else if (*sshpid == 0) {
-		if ((dup2(c_in, STDIN_FILENO) == -1) ||
-		    (dup2(c_out, STDOUT_FILENO) == -1)) {
-			fprintf(stderr, "dup2: %s\n", strerror(errno));
-			exit(1);
-		}
-		close(*in);
-		close(*out);
-		close(c_in);
-		close(c_out);
-		execv(path, args);
-		fprintf(stderr, "exec: %s: %s\n", path, strerror(errno));
-		exit(1);
-	}
-
-	close(c_in);
-	close(c_out);
-}
-
-static void
-usage(void)
-{
-	extern char *__progname;
-
-	fprintf(stderr,
-	    "usage: %s [-vC1] [-b batchfile] [-o option] [-s subsystem|path] [-B buffer_size]\n"
-	    "            [-F config] [-P direct server path] [-S program]\n"
-	    "            [user@]host[:file [file]]\n", __progname);
-	exit(1);
-}
-
-int
-main(int argc, char **argv)
-{
-	int in, out, ch, err;
-	pid_t sshpid;
-	char *host, *userhost, *cp, *file2;
-	int debug_level = 0, sshver = 2;
-	char *file1 = NULL, *sftp_server = NULL;
-	char *ssh_program = _PATH_SSH_PROGRAM, *sftp_direct = NULL;
-	LogLevel ll = SYSLOG_LEVEL_INFO;
-	arglist args;
-	extern int optind;
-	extern char *optarg;
-
-	__progname = get_progname(argv[0]);
-	args.list = NULL;
-	addargs(&args, "ssh");		/* overwritten with ssh_program */
-	addargs(&args, "-oForwardX11 no");
-	addargs(&args, "-oForwardAgent no");
-	addargs(&args, "-oClearAllForwardings yes");
-	ll = SYSLOG_LEVEL_INFO;
-	infile = stdin;		/* Read from STDIN unless changed by -b */
-
-	while ((ch = getopt(argc, argv, "1hvCo:s:S:b:B:F:P:R:")) != -1) {
-		switch (ch) {
-		case 'C':
-			addargs(&args, "-C");
-			break;
-		case 'v':
-			if (debug_level < 3) {
-				addargs(&args, "-v");
-				ll = SYSLOG_LEVEL_DEBUG1 + debug_level;
-			}
-			debug_level++;
-			break;
-		case 'F':
-		case 'o':
-			addargs(&args, "-%c%s", ch, optarg);
-			break;
-		case '1':
-			sshver = 1;
-			if (sftp_server == NULL)
-				sftp_server = _PATH_SFTP_SERVER;
-			break;
-		case 's':
-			sftp_server = optarg;
-			break;
-		case 'S':
-			ssh_program = optarg;
-			break;
-		case 'b':
-			if (infile == stdin) {
-				infile = fopen(optarg, "r");
-				if (infile == NULL)
-					fatal("%s (%s).", strerror(errno), optarg);
-			} else
-				fatal("Filename already specified.");
-			showprogress = 0;
-			break;
-		case 'P':
-			sftp_direct = optarg;
-			break;
-		case 'B':
-			copy_buffer_len = strtol(optarg, &cp, 10);
-			if (copy_buffer_len == 0 || *cp != '\0')
-				fatal("Invalid buffer size \"%s\"", optarg);
-			break;
-		case 'R':
-			num_requests = strtol(optarg, &cp, 10);
-			if (num_requests == 0 || *cp != '\0')
-				fatal("Invalid number of requests \"%s\"",
-				    optarg);
-			break;
-		case 'h':
-		default:
-			usage();
-		}
-	}
-
-	log_init(argv[0], ll, SYSLOG_FACILITY_USER, 1);
-
-	if (sftp_direct == NULL) {
-		if (optind == argc || argc > (optind + 2))
-			usage();
-
-		userhost = xstrdup(argv[optind]);
-		file2 = argv[optind+1];
-
-		if ((cp = colon(userhost)) != NULL) {
-			*cp++ = '\0';
-			file1 = cp;
-		}
-
-		if ((host = strrchr(userhost, '@')) == NULL)
-			host = userhost;
-		else {
-			*host++ = '\0';
-			if (!userhost[0]) {
-				fprintf(stderr, "Missing username\n");
-				usage();
-			}
-			addargs(&args, "-l%s",userhost);
-		}
-
-		host = cleanhostname(host);
-		if (!*host) {
-			fprintf(stderr, "Missing hostname\n");
-			usage();
-		}
-
-		addargs(&args, "-oProtocol %d", sshver);
-
-		/* no subsystem if the server-spec contains a '/' */
-		if (sftp_server == NULL || strchr(sftp_server, '/') == NULL)
-			addargs(&args, "-s");
-
-		addargs(&args, "%s", host);
-		addargs(&args, "%s", (sftp_server != NULL ?
-		    sftp_server : "sftp"));
-		args.list[0] = ssh_program;
-
-		fprintf(stderr, "Connecting to %s...\n", host);
-		connect_to_server(ssh_program, args.list, &in, &out,
-		    &sshpid);
-	} else {
-		args.list = NULL;
-		addargs(&args, "sftp-server");
-
-		fprintf(stderr, "Attaching to %s...\n", sftp_direct);
-		connect_to_server(sftp_direct, args.list, &in, &out,
-		    &sshpid);
-	}
-
-	err = interactive_loop(in, out, file1, file2);
-
-#if !defined(USE_PIPES)
-	shutdown(in, SHUT_RDWR);
-	shutdown(out, SHUT_RDWR);
-#endif
-
-	close(in);
-	close(out);
-	if (infile != stdin)
-		fclose(infile);
-
-	while (waitpid(sshpid, NULL, 0) == -1)
-		if (errno != EINTR)
-			fatal("Couldn't wait for ssh process: %s",
-			    strerror(errno));
-
-	exit(err == 0 ? 0 : 1);
-}
diff --git a/crypto/openssh/sftp.h b/crypto/openssh/sftp.h
deleted file mode 100644
index 675c6086e952..000000000000
--- a/crypto/openssh/sftp.h
+++ /dev/null
@@ -1,92 +0,0 @@
-/*	$OpenBSD: sftp.h,v 1.4 2002/02/13 00:59:23 djm Exp $	*/
-
-/*
- * Copyright (c) 2001 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/*
- * draft-ietf-secsh-filexfer-01.txt
- */
-
-/* version */
-#define	SSH2_FILEXFER_VERSION		3
-
-/* client to server */
-#define SSH2_FXP_INIT			1
-#define SSH2_FXP_OPEN			3
-#define SSH2_FXP_CLOSE			4
-#define SSH2_FXP_READ			5
-#define SSH2_FXP_WRITE			6
-#define SSH2_FXP_LSTAT			7
-#define SSH2_FXP_STAT_VERSION_0		7
-#define SSH2_FXP_FSTAT			8
-#define SSH2_FXP_SETSTAT		9
-#define SSH2_FXP_FSETSTAT		10
-#define SSH2_FXP_OPENDIR		11
-#define SSH2_FXP_READDIR		12
-#define SSH2_FXP_REMOVE			13
-#define SSH2_FXP_MKDIR			14
-#define SSH2_FXP_RMDIR			15
-#define SSH2_FXP_REALPATH		16
-#define SSH2_FXP_STAT			17
-#define SSH2_FXP_RENAME			18
-#define SSH2_FXP_READLINK		19
-#define SSH2_FXP_SYMLINK		20
-
-/* server to client */
-#define SSH2_FXP_VERSION		2
-#define SSH2_FXP_STATUS			101
-#define SSH2_FXP_HANDLE			102
-#define SSH2_FXP_DATA			103
-#define SSH2_FXP_NAME			104
-#define SSH2_FXP_ATTRS			105
-
-#define SSH2_FXP_EXTENDED		200
-#define SSH2_FXP_EXTENDED_REPLY		201
-
-/* attributes */
-#define SSH2_FILEXFER_ATTR_SIZE		0x00000001
-#define SSH2_FILEXFER_ATTR_UIDGID	0x00000002
-#define SSH2_FILEXFER_ATTR_PERMISSIONS	0x00000004
-#define SSH2_FILEXFER_ATTR_ACMODTIME	0x00000008
-#define SSH2_FILEXFER_ATTR_EXTENDED	0x80000000
-
-/* portable open modes */
-#define SSH2_FXF_READ			0x00000001
-#define SSH2_FXF_WRITE			0x00000002
-#define SSH2_FXF_APPEND			0x00000004
-#define SSH2_FXF_CREAT			0x00000008
-#define SSH2_FXF_TRUNC			0x00000010
-#define SSH2_FXF_EXCL			0x00000020
-
-/* status messages */
-#define SSH2_FX_OK			0
-#define SSH2_FX_EOF			1
-#define SSH2_FX_NO_SUCH_FILE		2
-#define SSH2_FX_PERMISSION_DENIED	3
-#define SSH2_FX_FAILURE			4
-#define SSH2_FX_BAD_MESSAGE		5
-#define SSH2_FX_NO_CONNECTION		6
-#define SSH2_FX_CONNECTION_LOST		7
-#define SSH2_FX_OP_UNSUPPORTED		8
-#define SSH2_FX_MAX			8
diff --git a/crypto/openssh/sftp/Makefile b/crypto/openssh/sftp/Makefile
deleted file mode 100644
index 3f5d866a5e9e..000000000000
--- a/crypto/openssh/sftp/Makefile
+++ /dev/null
@@ -1,19 +0,0 @@
-#	$OpenBSD: Makefile,v 1.5 2001/05/03 23:09:57 mouring Exp $
-
-.PATH:		${.CURDIR}/..
-
-PROG=	sftp
-BINOWN=	root
-
-BINMODE?=555
-
-BINDIR=	/usr/bin
-MAN=	sftp.1
-
-SRCS=	sftp.c sftp-client.c sftp-int.c sftp-common.c sftp-glob.c misc.c
-
-.include <bsd.prog.mk>
-
-LDADD+=	-lcrypto
-DPADD+=	${LIBCRYPTO}
-
diff --git a/crypto/openssh/ssh-add.1 b/crypto/openssh/ssh-add.1
deleted file mode 100644
index bcdb8e7f68f7..000000000000
--- a/crypto/openssh/ssh-add.1
+++ /dev/null
@@ -1,173 +0,0 @@
-.\"	$OpenBSD: ssh-add.1,v 1.38 2003/03/28 10:11:43 jmc Exp $
-.\"
-.\"  -*- nroff -*-
-.\"
-.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
-.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
-.\"                    All rights reserved
-.\"
-.\" As far as I am concerned, the code I have written for this software
-.\" can be used freely for any purpose.  Any derived versions of this
-.\" software must be clearly marked as such, and if the derived work is
-.\" incompatible with the protocol description in the RFC file, it must be
-.\" called by a name other than "ssh" or "Secure Shell".
-.\"
-.\"
-.\" Copyright (c) 1999,2000 Markus Friedl.  All rights reserved.
-.\" Copyright (c) 1999 Aaron Campbell.  All rights reserved.
-.\" Copyright (c) 1999 Theo de Raadt.  All rights reserved.
-.\"
-.\" Redistribution and use in source and binary forms, with or without
-.\" modification, are permitted provided that the following conditions
-.\" are met:
-.\" 1. Redistributions of source code must retain the above copyright
-.\"    notice, this list of conditions and the following disclaimer.
-.\" 2. Redistributions in binary form must reproduce the above copyright
-.\"    notice, this list of conditions and the following disclaimer in the
-.\"    documentation and/or other materials provided with the distribution.
-.\"
-.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-.\"
-.Dd September 25, 1999
-.Dt SSH-ADD 1
-.Os
-.Sh NAME
-.Nm ssh-add
-.Nd adds RSA or DSA identities to the authentication agent
-.Sh SYNOPSIS
-.Nm ssh-add
-.Op Fl lLdDxXc
-.Op Fl t Ar life
-.Op Ar
-.Nm ssh-add
-.Fl s Ar reader
-.Nm ssh-add
-.Fl e Ar reader
-.Sh DESCRIPTION
-.Nm
-adds RSA or DSA identities to the authentication agent,
-.Xr ssh-agent 1 .
-When run without arguments, it adds the files
-.Pa $HOME/.ssh/id_rsa ,
-.Pa $HOME/.ssh/id_dsa
-and
-.Pa $HOME/.ssh/identity .
-Alternative file names can be given on the command line.
-If any file requires a passphrase,
-.Nm
-asks for the passphrase from the user.
-The passphrase is read from the user's tty.
-.Nm
-retries the last passphrase if multiple identity files are given.
-.Pp
-The authentication agent must be running and must be an ancestor of
-the current process for
-.Nm
-to work.
-.Pp
-The options are as follows:
-.Bl -tag -width Ds
-.It Fl l
-Lists fingerprints of all identities currently represented by the agent.
-.It Fl L
-Lists public key parameters of all identities currently represented by the agent.
-.It Fl d
-Instead of adding the identity, removes the identity from the agent.
-.It Fl D
-Deletes all identities from the agent.
-.It Fl x
-Lock the agent with a password.
-.It Fl X
-Unlock the agent.
-.It Fl t Ar life
-Set a maximum lifetime when adding identities to an agent.
-The lifetime may be specified in seconds or in a time format
-specified in
-.Xr sshd_config 5 .
-.It Fl c
-Indicates that added identities should be subject to confirmation before
-being used for authentication.
-Confirmation is performed by the
-.Ev SSH_ASKPASS
-program mentioned below.
-Successful confirmation is signaled by a zero exit status from the
-.Ev SSH_ASKPASS
-program, rather than text entered into the requester.
-.It Fl s Ar reader
-Add key in smartcard
-.Ar reader .
-.It Fl e Ar reader
-Remove key in smartcard
-.Ar reader .
-.El
-.Sh FILES
-.Bl -tag -width Ds
-.It Pa $HOME/.ssh/identity
-Contains the protocol version 1 RSA authentication identity of the user.
-.It Pa $HOME/.ssh/id_dsa
-Contains the protocol version 2 DSA authentication identity of the user.
-.It Pa $HOME/.ssh/id_rsa
-Contains the protocol version 2 RSA authentication identity of the user.
-.El
-.Pp
-Identity files should not be readable by anyone but the user.
-Note that
-.Nm
-ignores identity files if they are accessible by others.
-.Sh ENVIRONMENT
-.Bl -tag -width Ds
-.It Ev "DISPLAY" and "SSH_ASKPASS"
-If
-.Nm
-needs a passphrase, it will read the passphrase from the current
-terminal if it was run from a terminal.
-If
-.Nm
-does not have a terminal associated with it but
-.Ev DISPLAY
-and
-.Ev SSH_ASKPASS
-are set, it will execute the program specified by
-.Ev SSH_ASKPASS
-and open an X11 window to read the passphrase.
-This is particularly useful when calling
-.Nm
-from a
-.Pa .Xsession
-or related script.
-(Note that on some machines it
-may be necessary to redirect the input from
-.Pa /dev/null
-to make this work.)
-.It Ev SSH_AUTH_SOCK
-Identifies the path of a unix-domain socket used to communicate with the
-agent.
-.El
-.Sh DIAGNOSTICS
-Exit status is 0 on success, 1 if the specified command fails,
-and 2 if
-.Nm
-is unable to contact the authentication agent.
-.Sh AUTHORS
-OpenSSH is a derivative of the original and free
-ssh 1.2.12 release by Tatu Ylonen.
-Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos,
-Theo de Raadt and Dug Song
-removed many bugs, re-added newer features and
-created OpenSSH.
-Markus Friedl contributed the support for SSH
-protocol versions 1.5 and 2.0.
-.Sh SEE ALSO
-.Xr ssh 1 ,
-.Xr ssh-agent 1 ,
-.Xr ssh-keygen 1 ,
-.Xr sshd 8
diff --git a/crypto/openssh/ssh-add.c b/crypto/openssh/ssh-add.c
deleted file mode 100644
index 9adec3094419..000000000000
--- a/crypto/openssh/ssh-add.c
+++ /dev/null
@@ -1,421 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * Adds an identity to the authentication server, or removes an identity.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- *
- * SSH2 implementation,
- * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: ssh-add.c,v 1.66 2003/03/05 22:33:43 markus Exp $");
-
-#include <openssl/evp.h>
-
-#include "ssh.h"
-#include "rsa.h"
-#include "log.h"
-#include "xmalloc.h"
-#include "key.h"
-#include "authfd.h"
-#include "authfile.h"
-#include "pathnames.h"
-#include "readpass.h"
-#include "misc.h"
-
-#ifdef HAVE___PROGNAME
-extern char *__progname;
-#else
-char *__progname;
-#endif
-
-/* argv0 */
-extern char *__progname;
-
-/* Default files to add */
-static char *default_files[] = {
-	_PATH_SSH_CLIENT_ID_RSA,
-	_PATH_SSH_CLIENT_ID_DSA,
-	_PATH_SSH_CLIENT_IDENTITY,
-	NULL
-};
-
-/* Default lifetime (0 == forever) */
-static int lifetime = 0;
-
-/* User has to confirm key use */
-static int confirm = 0;
-
-/* we keep a cache of one passphrases */
-static char *pass = NULL;
-static void
-clear_pass(void)
-{
-	if (pass) {
-		memset(pass, 0, strlen(pass));
-		xfree(pass);
-		pass = NULL;
-	}
-}
-
-static int
-delete_file(AuthenticationConnection *ac, const char *filename)
-{
-	Key *public;
-	char *comment = NULL;
-	int ret = -1;
-
-	public = key_load_public(filename, &comment);
-	if (public == NULL) {
-		printf("Bad key file %s\n", filename);
-		return -1;
-	}
-	if (ssh_remove_identity(ac, public)) {
-		fprintf(stderr, "Identity removed: %s (%s)\n", filename, comment);
-		ret = 0;
-	} else
-		fprintf(stderr, "Could not remove identity: %s\n", filename);
-
-	key_free(public);
-	xfree(comment);
-
-	return ret;
-}
-
-/* Send a request to remove all identities. */
-static int
-delete_all(AuthenticationConnection *ac)
-{
-	int ret = -1;
-
-	if (ssh_remove_all_identities(ac, 1))
-		ret = 0;
-	/* ignore error-code for ssh2 */
-	ssh_remove_all_identities(ac, 2);
-
-	if (ret == 0)
-		fprintf(stderr, "All identities removed.\n");
-	else
-		fprintf(stderr, "Failed to remove all identities.\n");
-
-	return ret;
-}
-
-static int
-add_file(AuthenticationConnection *ac, const char *filename)
-{
-	struct stat st;
-	Key *private;
-	char *comment = NULL;
-	char msg[1024];
-	int ret = -1;
-
-	if (stat(filename, &st) < 0) {
-		perror(filename);
-		return -1;
-	}
-	/* At first, try empty passphrase */
-	private = key_load_private(filename, "", &comment);
-	if (comment == NULL)
-		comment = xstrdup(filename);
-	/* try last */
-	if (private == NULL && pass != NULL)
-		private = key_load_private(filename, pass, NULL);
-	if (private == NULL) {
-		/* clear passphrase since it did not work */
-		clear_pass();
-		snprintf(msg, sizeof msg, "Enter passphrase for %.200s: ",
-		   comment);
-		for (;;) {
-			pass = read_passphrase(msg, RP_ALLOW_STDIN);
-			if (strcmp(pass, "") == 0) {
-				clear_pass();
-				xfree(comment);
-				return -1;
-			}
-			private = key_load_private(filename, pass, &comment);
-			if (private != NULL)
-				break;
-			clear_pass();
-			strlcpy(msg, "Bad passphrase, try again: ", sizeof msg);
-		}
-	}
-
- 	if (ssh_add_identity_constrained(ac, private, comment, lifetime,
- 	    confirm)) {
-		fprintf(stderr, "Identity added: %s (%s)\n", filename, comment);
-		ret = 0;
-		if (lifetime != 0)
-			fprintf(stderr,
-			    "Lifetime set to %d seconds\n", lifetime);
- 		if (confirm != 0)
-			fprintf(stderr,
-			    "The user has to confirm each use of the key\n");
-	} else if (ssh_add_identity(ac, private, comment)) {
-		fprintf(stderr, "Identity added: %s (%s)\n", filename, comment);
-		ret = 0;
-	} else {
-		fprintf(stderr, "Could not add identity: %s\n", filename);
-	}
-
-	xfree(comment);
-	key_free(private);
-
-	return ret;
-}
-
-static int
-update_card(AuthenticationConnection *ac, int add, const char *id)
-{
-	char *pin;
-	int ret = -1;
-
-	pin = read_passphrase("Enter passphrase for smartcard: ", RP_ALLOW_STDIN);
-	if (pin == NULL)
-		return -1;
-
-	if (ssh_update_card(ac, add, id, pin)) {
-		fprintf(stderr, "Card %s: %s\n",
-		    add ? "added" : "removed", id);
-		ret = 0;
-	} else {
-		fprintf(stderr, "Could not %s card: %s\n",
-		    add ? "add" : "remove", id);
-		ret = -1;
-	}
-	xfree(pin);
-	return ret;
-}
-
-static int
-list_identities(AuthenticationConnection *ac, int do_fp)
-{
-	Key *key;
-	char *comment, *fp;
-	int had_identities = 0;
-	int version;
-
-	for (version = 1; version <= 2; version++) {
-		for (key = ssh_get_first_identity(ac, &comment, version);
-		    key != NULL;
-		    key = ssh_get_next_identity(ac, &comment, version)) {
-			had_identities = 1;
-			if (do_fp) {
-				fp = key_fingerprint(key, SSH_FP_MD5,
-				    SSH_FP_HEX);
-				printf("%d %s %s (%s)\n",
-				    key_size(key), fp, comment, key_type(key));
-				xfree(fp);
-			} else {
-				if (!key_write(key, stdout))
-					fprintf(stderr, "key_write failed");
-				fprintf(stdout, " %s\n", comment);
-			}
-			key_free(key);
-			xfree(comment);
-		}
-	}
-	if (!had_identities) {
-		printf("The agent has no identities.\n");
-		return -1;
-	}
-	return 0;
-}
-
-static int
-lock_agent(AuthenticationConnection *ac, int lock)
-{
-	char prompt[100], *p1, *p2;
-	int passok = 1, ret = -1;
-
-	strlcpy(prompt, "Enter lock password: ", sizeof(prompt));
-	p1 = read_passphrase(prompt, RP_ALLOW_STDIN);
-	if (lock) {
-		strlcpy(prompt, "Again: ", sizeof prompt);
-		p2 = read_passphrase(prompt, RP_ALLOW_STDIN);
-		if (strcmp(p1, p2) != 0) {
-			fprintf(stderr, "Passwords do not match.\n");
-			passok = 0;
-		}
-		memset(p2, 0, strlen(p2));
-		xfree(p2);
-	}
-	if (passok && ssh_lock_agent(ac, lock, p1)) {
-		fprintf(stderr, "Agent %slocked.\n", lock ? "" : "un");
-		ret = 0;
-	} else
-		fprintf(stderr, "Failed to %slock agent.\n", lock ? "" : "un");
-	memset(p1, 0, strlen(p1));
-	xfree(p1);
-	return (ret);
-}
-
-static int
-do_file(AuthenticationConnection *ac, int deleting, char *file)
-{
-	if (deleting) {
-		if (delete_file(ac, file) == -1)
-			return -1;
-	} else {
-		if (add_file(ac, file) == -1)
-			return -1;
-	}
-	return 0;
-}
-
-static void
-usage(void)
-{
-	fprintf(stderr, "Usage: %s [options]\n", __progname);
-	fprintf(stderr, "Options:\n");
-	fprintf(stderr, "  -l          List fingerprints of all identities.\n");
-	fprintf(stderr, "  -L          List public key parameters of all identities.\n");
-	fprintf(stderr, "  -d          Delete identity.\n");
-	fprintf(stderr, "  -D          Delete all identities.\n");
-	fprintf(stderr, "  -x          Lock agent.\n");
-	fprintf(stderr, "  -X          Unlock agent.\n");
-	fprintf(stderr, "  -t life     Set lifetime (in seconds) when adding identities.\n");
-	fprintf(stderr, "  -c          Require confirmation to sign using identities\n");
-#ifdef SMARTCARD
-	fprintf(stderr, "  -s reader   Add key in smartcard reader.\n");
-	fprintf(stderr, "  -e reader   Remove key in smartcard reader.\n");
-#endif
-}
-
-int
-main(int argc, char **argv)
-{
-	extern char *optarg;
-	extern int optind;
-	AuthenticationConnection *ac = NULL;
-	char *sc_reader_id = NULL;
-	int i, ch, deleting = 0, ret = 0;
-
-	__progname = get_progname(argv[0]);
-	init_rng();
-	seed_rng();
-
-	SSLeay_add_all_algorithms();
-
-	/* At first, get a connection to the authentication agent. */
-	ac = ssh_get_authentication_connection();
-	if (ac == NULL) {
-		fprintf(stderr, "Could not open a connection to your authentication agent.\n");
-		exit(2);
-	}
-	while ((ch = getopt(argc, argv, "lLcdDxXe:s:t:")) != -1) {
-		switch (ch) {
-		case 'l':
-		case 'L':
-			if (list_identities(ac, ch == 'l' ? 1 : 0) == -1)
-				ret = 1;
-			goto done;
-			break;
-		case 'x':
-		case 'X':
-			if (lock_agent(ac, ch == 'x' ? 1 : 0) == -1)
-				ret = 1;
-			goto done;
-			break;
-		case 'c':
-			confirm = 1;
-			break;
-		case 'd':
-			deleting = 1;
-			break;
-		case 'D':
-			if (delete_all(ac) == -1)
-				ret = 1;
-			goto done;
-			break;
-		case 's':
-			sc_reader_id = optarg;
-			break;
-		case 'e':
-			deleting = 1;
-			sc_reader_id = optarg;
-			break;
-		case 't':
-			if ((lifetime = convtime(optarg)) == -1) {
-				fprintf(stderr, "Invalid lifetime\n");
-				ret = 1;
-				goto done;
-			}
-			break;
-		default:
-			usage();
-			ret = 1;
-			goto done;
-		}
-	}
-	argc -= optind;
-	argv += optind;
-	if (sc_reader_id != NULL) {
-		if (update_card(ac, !deleting, sc_reader_id) == -1)
-			ret = 1;
-		goto done;
-	}
-	if (argc == 0) {
-		char buf[MAXPATHLEN];
-		struct passwd *pw;
-		struct stat st;
-		int count = 0;
-
-		if ((pw = getpwuid(getuid())) == NULL) {
-			fprintf(stderr, "No user found with uid %u\n",
-			    (u_int)getuid());
-			ret = 1;
-			goto done;
-		}
-
-		for(i = 0; default_files[i]; i++) {
-			snprintf(buf, sizeof(buf), "%s/%s", pw->pw_dir,
-			    default_files[i]);
-			if (stat(buf, &st) < 0)
-				continue;
-			if (do_file(ac, deleting, buf) == -1)
-				ret = 1;
-			else
-				count++;
-		}
-		if (count == 0)
-			ret = 1;
-	} else {
-		for(i = 0; i < argc; i++) {
-			if (do_file(ac, deleting, argv[i]) == -1)
-				ret = 1;
-		}
-	}
-	clear_pass();
-
-done:
-	ssh_close_authentication_connection(ac);
-	return ret;
-}
diff --git a/crypto/openssh/ssh-add/Makefile b/crypto/openssh/ssh-add/Makefile
deleted file mode 100644
index 2f7bf42b53c2..000000000000
--- a/crypto/openssh/ssh-add/Makefile
+++ /dev/null
@@ -1,18 +0,0 @@
-#	$OpenBSD: Makefile,v 1.20 2001/03/04 00:51:25 markus Exp $
-
-.PATH:		${.CURDIR}/..
-
-PROG=	ssh-add
-BINOWN=	root
-
-BINMODE?=555
-
-BINDIR=	/usr/bin
-MAN=	ssh-add.1
-
-SRCS=	ssh-add.c
-
-.include <bsd.prog.mk>
-
-LDADD+=	-lcrypto
-DPADD+= ${LIBCRYPTO}
diff --git a/crypto/openssh/ssh-agent.1 b/crypto/openssh/ssh-agent.1
deleted file mode 100644
index fde4608bbb5f..000000000000
--- a/crypto/openssh/ssh-agent.1
+++ /dev/null
@@ -1,195 +0,0 @@
-.\" $OpenBSD: ssh-agent.1,v 1.37 2003/03/28 10:11:43 jmc Exp $
-.\"
-.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
-.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
-.\"                    All rights reserved
-.\"
-.\" As far as I am concerned, the code I have written for this software
-.\" can be used freely for any purpose.  Any derived versions of this
-.\" software must be clearly marked as such, and if the derived work is
-.\" incompatible with the protocol description in the RFC file, it must be
-.\" called by a name other than "ssh" or "Secure Shell".
-.\"
-.\" Copyright (c) 1999,2000 Markus Friedl.  All rights reserved.
-.\" Copyright (c) 1999 Aaron Campbell.  All rights reserved.
-.\" Copyright (c) 1999 Theo de Raadt.  All rights reserved.
-.\"
-.\" Redistribution and use in source and binary forms, with or without
-.\" modification, are permitted provided that the following conditions
-.\" are met:
-.\" 1. Redistributions of source code must retain the above copyright
-.\"    notice, this list of conditions and the following disclaimer.
-.\" 2. Redistributions in binary form must reproduce the above copyright
-.\"    notice, this list of conditions and the following disclaimer in the
-.\"    documentation and/or other materials provided with the distribution.
-.\"
-.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-.\"
-.Dd September 25, 1999
-.Dt SSH-AGENT 1
-.Os
-.Sh NAME
-.Nm ssh-agent
-.Nd authentication agent
-.Sh SYNOPSIS
-.Nm ssh-agent
-.Op Fl a Ar bind_address
-.Op Fl c Li | Fl s
-.Op Fl t Ar life
-.Op Fl d
-.Op Ar command Op Ar args ...
-.Nm ssh-agent
-.Op Fl c Li | Fl s
-.Fl k
-.Sh DESCRIPTION
-.Nm
-is a program to hold private keys used for public key authentication
-(RSA, DSA).
-The idea is that
-.Nm
-is started in the beginning of an X-session or a login session, and
-all other windows or programs are started as clients to the ssh-agent
-program.
-Through use of environment variables the agent can be located
-and automatically used for authentication when logging in to other
-machines using
-.Xr ssh 1 .
-.Pp
-The options are as follows:
-.Bl -tag -width Ds
-.It Fl a Ar bind_address
-Bind the agent to the unix-domain socket
-.Ar bind_address .
-The default is
-.Pa /tmp/ssh-XXXXXXXX/agent.<ppid> .
-.It Fl c
-Generate C-shell commands on
-.Dv stdout .
-This is the default if
-.Ev SHELL
-looks like it's a csh style of shell.
-.It Fl s
-Generate Bourne shell commands on
-.Dv stdout .
-This is the default if
-.Ev SHELL
-does not look like it's a csh style of shell.
-.It Fl k
-Kill the current agent (given by the
-.Ev SSH_AGENT_PID
-environment variable).
-.It Fl t Ar life
-Set a default value for the maximum lifetime of identities added to the agent.
-The lifetime may be specified in seconds or in a time format specified in
-.Xr sshd 8 .
-A lifetime specified for an identity with
-.Xr ssh-add 1
-overrides this value.
-Without this option the default maximum lifetime is forever.
-.It Fl d
-Debug mode.
-When this option is specified
-.Nm
-will not fork.
-.El
-.Pp
-If a commandline is given, this is executed as a subprocess of the agent.
-When the command dies, so does the agent.
-.Pp
-The agent initially does not have any private keys.
-Keys are added using
-.Xr ssh-add 1 .
-When executed without arguments,
-.Xr ssh-add 1
-adds the files
-.Pa $HOME/.ssh/id_rsa ,
-.Pa $HOME/.ssh/id_dsa
-and
-.Pa $HOME/.ssh/identity .
-If the identity has a passphrase,
-.Xr ssh-add 1
-asks for the passphrase (using a small X11 application if running
-under X11, or from the terminal if running without X).
-It then sends the identity to the agent.
-Several identities can be stored in the
-agent; the agent can automatically use any of these identities.
-.Ic ssh-add -l
-displays the identities currently held by the agent.
-.Pp
-The idea is that the agent is run in the user's local PC, laptop, or
-terminal.
-Authentication data need not be stored on any other
-machine, and authentication passphrases never go over the network.
-However, the connection to the agent is forwarded over SSH
-remote logins, and the user can thus use the privileges given by the
-identities anywhere in the network in a secure way.
-.Pp
-There are two main ways to get an agent setup:
-Either the agent starts a new subcommand into which some environment
-variables are exported, or the agent prints the needed shell commands
-(either
-.Xr sh 1
-or
-.Xr csh 1
-syntax can be generated) which can be evalled in the calling shell.
-Later
-.Xr ssh 1
-looks at these variables and uses them to establish a connection to the agent.
-.Pp
-The agent will never send a private key over its request channel.
-Instead, operations that require a private key will be performed
-by the agent, and the result will be returned to the requester.
-This way, private keys are not exposed to clients using the agent.
-.Pp
-A unix-domain socket is created
-and the name of this socket is stored in the
-.Ev SSH_AUTH_SOCK
-environment
-variable.
-The socket is made accessible only to the current user.
-This method is easily abused by root or another instance of the same
-user.
-.Pp
-The
-.Ev SSH_AGENT_PID
-environment variable holds the agent's process ID.
-.Pp
-The agent exits automatically when the command given on the command
-line terminates.
-.Sh FILES
-.Bl -tag -width Ds
-.It Pa $HOME/.ssh/identity
-Contains the protocol version 1 RSA authentication identity of the user.
-.It Pa $HOME/.ssh/id_dsa
-Contains the protocol version 2 DSA authentication identity of the user.
-.It Pa $HOME/.ssh/id_rsa
-Contains the protocol version 2 RSA authentication identity of the user.
-.It Pa /tmp/ssh-XXXXXXXX/agent.<ppid>
-Unix-domain sockets used to contain the connection to the
-authentication agent.
-These sockets should only be readable by the owner.
-The sockets should get automatically removed when the agent exits.
-.El
-.Sh AUTHORS
-OpenSSH is a derivative of the original and free
-ssh 1.2.12 release by Tatu Ylonen.
-Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos,
-Theo de Raadt and Dug Song
-removed many bugs, re-added newer features and
-created OpenSSH.
-Markus Friedl contributed the support for SSH
-protocol versions 1.5 and 2.0.
-.Sh SEE ALSO
-.Xr ssh 1 ,
-.Xr ssh-add 1 ,
-.Xr ssh-keygen 1 ,
-.Xr sshd 8
diff --git a/crypto/openssh/ssh-agent.c b/crypto/openssh/ssh-agent.c
deleted file mode 100644
index eb593de73f12..000000000000
--- a/crypto/openssh/ssh-agent.c
+++ /dev/null
@@ -1,1218 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * The authentication agent program.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- *
- * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-#include "openbsd-compat/sys-queue.h"
-RCSID("$OpenBSD: ssh-agent.c,v 1.108 2003/03/13 11:44:50 markus Exp $");
-
-#include <openssl/evp.h>
-#include <openssl/md5.h>
-
-#include "ssh.h"
-#include "rsa.h"
-#include "buffer.h"
-#include "bufaux.h"
-#include "xmalloc.h"
-#include "getput.h"
-#include "key.h"
-#include "authfd.h"
-#include "compat.h"
-#include "log.h"
-#include "readpass.h"
-#include "misc.h"
-
-#ifdef SMARTCARD
-#include "scard.h"
-#endif
-
-typedef enum {
-	AUTH_UNUSED,
-	AUTH_SOCKET,
-	AUTH_CONNECTION
-} sock_type;
-
-typedef struct {
-	int fd;
-	sock_type type;
-	Buffer input;
-	Buffer output;
-	Buffer request;
-} SocketEntry;
-
-u_int sockets_alloc = 0;
-SocketEntry *sockets = NULL;
-
-typedef struct identity {
-	TAILQ_ENTRY(identity) next;
-	Key *key;
-	char *comment;
-	u_int death;
-	u_int confirm;
-} Identity;
-
-typedef struct {
-	int nentries;
-	TAILQ_HEAD(idqueue, identity) idlist;
-} Idtab;
-
-/* private key table, one per protocol version */
-Idtab idtable[3];
-
-int max_fd = 0;
-
-/* pid of shell == parent of agent */
-pid_t parent_pid = -1;
-
-/* pathname and directory for AUTH_SOCKET */
-char socket_name[1024];
-char socket_dir[1024];
-
-/* locking */
-int locked = 0;
-char *lock_passwd = NULL;
-
-#ifdef HAVE___PROGNAME
-extern char *__progname;
-#else
-char *__progname;
-#endif
-
-/* Default lifetime (0 == forever) */
-static int lifetime = 0;
-
-static void
-close_socket(SocketEntry *e)
-{
-	close(e->fd);
-	e->fd = -1;
-	e->type = AUTH_UNUSED;
-	buffer_free(&e->input);
-	buffer_free(&e->output);
-	buffer_free(&e->request);
-}
-
-static void
-idtab_init(void)
-{
-	int i;
-
-	for (i = 0; i <=2; i++) {
-		TAILQ_INIT(&idtable[i].idlist);
-		idtable[i].nentries = 0;
-	}
-}
-
-/* return private key table for requested protocol version */
-static Idtab *
-idtab_lookup(int version)
-{
-	if (version < 1 || version > 2)
-		fatal("internal error, bad protocol version %d", version);
-	return &idtable[version];
-}
-
-static void
-free_identity(Identity *id)
-{
-	key_free(id->key);
-	xfree(id->comment);
-	xfree(id);
-}
-
-/* return matching private key for given public key */
-static Identity *
-lookup_identity(Key *key, int version)
-{
-	Identity *id;
-
-	Idtab *tab = idtab_lookup(version);
-	TAILQ_FOREACH(id, &tab->idlist, next) {
-		if (key_equal(key, id->key))
-			return (id);
-	}
-	return (NULL);
-}
-
-/* Check confirmation of keysign request */
-static int
-confirm_key(Identity *id)
-{
-	char *p, prompt[1024];
-	int ret = -1;
-
-	p = key_fingerprint(id->key, SSH_FP_MD5, SSH_FP_HEX);
-	snprintf(prompt, sizeof(prompt), "Allow use of key %s?\n"
-	    "Key fingerprint %s.", id->comment, p);
-	xfree(p);
-	p = read_passphrase(prompt, RP_ALLOW_EOF);
-	if (p != NULL) {
-		/*
-		 * Accept empty responses and responses consisting 
-		 * of the word "yes" as affirmative.
-		 */
-		if (*p == '\0' || *p == '\n' || strcasecmp(p, "yes") == 0)
-			ret = 0;
-		xfree(p);
-	}
-	return (ret);
-}
-
-/* send list of supported public keys to 'client' */
-static void
-process_request_identities(SocketEntry *e, int version)
-{
-	Idtab *tab = idtab_lookup(version);
-	Identity *id;
-	Buffer msg;
-
-	buffer_init(&msg);
-	buffer_put_char(&msg, (version == 1) ?
-	    SSH_AGENT_RSA_IDENTITIES_ANSWER : SSH2_AGENT_IDENTITIES_ANSWER);
-	buffer_put_int(&msg, tab->nentries);
-	TAILQ_FOREACH(id, &tab->idlist, next) {
-		if (id->key->type == KEY_RSA1) {
-			buffer_put_int(&msg, BN_num_bits(id->key->rsa->n));
-			buffer_put_bignum(&msg, id->key->rsa->e);
-			buffer_put_bignum(&msg, id->key->rsa->n);
-		} else {
-			u_char *blob;
-			u_int blen;
-			key_to_blob(id->key, &blob, &blen);
-			buffer_put_string(&msg, blob, blen);
-			xfree(blob);
-		}
-		buffer_put_cstring(&msg, id->comment);
-	}
-	buffer_put_int(&e->output, buffer_len(&msg));
-	buffer_append(&e->output, buffer_ptr(&msg), buffer_len(&msg));
-	buffer_free(&msg);
-}
-
-/* ssh1 only */
-static void
-process_authentication_challenge1(SocketEntry *e)
-{
-	u_char buf[32], mdbuf[16], session_id[16];
-	u_int response_type;
-	BIGNUM *challenge;
-	Identity *id;
-	int i, len;
-	Buffer msg;
-	MD5_CTX md;
-	Key *key;
-
-	buffer_init(&msg);
-	key = key_new(KEY_RSA1);
-	if ((challenge = BN_new()) == NULL)
-		fatal("process_authentication_challenge1: BN_new failed");
-
-	(void) buffer_get_int(&e->request);			/* ignored */
-	buffer_get_bignum(&e->request, key->rsa->e);
-	buffer_get_bignum(&e->request, key->rsa->n);
-	buffer_get_bignum(&e->request, challenge);
-
-	/* Only protocol 1.1 is supported */
-	if (buffer_len(&e->request) == 0)
-		goto failure;
-	buffer_get(&e->request, session_id, 16);
-	response_type = buffer_get_int(&e->request);
-	if (response_type != 1)
-		goto failure;
-
-	id = lookup_identity(key, 1);
-	if (id != NULL && (!id->confirm || confirm_key(id) == 0)) {
-		Key *private = id->key;
-		/* Decrypt the challenge using the private key. */
-		if (rsa_private_decrypt(challenge, challenge, private->rsa) <= 0)
-			goto failure;
-
-		/* The response is MD5 of decrypted challenge plus session id. */
-		len = BN_num_bytes(challenge);
-		if (len <= 0 || len > 32) {
-			log("process_authentication_challenge: bad challenge length %d", len);
-			goto failure;
-		}
-		memset(buf, 0, 32);
-		BN_bn2bin(challenge, buf + 32 - len);
-		MD5_Init(&md);
-		MD5_Update(&md, buf, 32);
-		MD5_Update(&md, session_id, 16);
-		MD5_Final(mdbuf, &md);
-
-		/* Send the response. */
-		buffer_put_char(&msg, SSH_AGENT_RSA_RESPONSE);
-		for (i = 0; i < 16; i++)
-			buffer_put_char(&msg, mdbuf[i]);
-		goto send;
-	}
-
-failure:
-	/* Unknown identity or protocol error.  Send failure. */
-	buffer_put_char(&msg, SSH_AGENT_FAILURE);
-send:
-	buffer_put_int(&e->output, buffer_len(&msg));
-	buffer_append(&e->output, buffer_ptr(&msg), buffer_len(&msg));
-	key_free(key);
-	BN_clear_free(challenge);
-	buffer_free(&msg);
-}
-
-/* ssh2 only */
-static void
-process_sign_request2(SocketEntry *e)
-{
-	u_char *blob, *data, *signature = NULL;
-	u_int blen, dlen, slen = 0;
-	extern int datafellows;
-	int ok = -1, flags;
-	Buffer msg;
-	Key *key;
-
-	datafellows = 0;
-
-	blob = buffer_get_string(&e->request, &blen);
-	data = buffer_get_string(&e->request, &dlen);
-
-	flags = buffer_get_int(&e->request);
-	if (flags & SSH_AGENT_OLD_SIGNATURE)
-		datafellows = SSH_BUG_SIGBLOB;
-
-	key = key_from_blob(blob, blen);
-	if (key != NULL) {
-		Identity *id = lookup_identity(key, 2);
-		if (id != NULL && (!id->confirm || confirm_key(id) == 0))
-			ok = key_sign(id->key, &signature, &slen, data, dlen);
-	}
-	key_free(key);
-	buffer_init(&msg);
-	if (ok == 0) {
-		buffer_put_char(&msg, SSH2_AGENT_SIGN_RESPONSE);
-		buffer_put_string(&msg, signature, slen);
-	} else {
-		buffer_put_char(&msg, SSH_AGENT_FAILURE);
-	}
-	buffer_put_int(&e->output, buffer_len(&msg));
-	buffer_append(&e->output, buffer_ptr(&msg),
-	    buffer_len(&msg));
-	buffer_free(&msg);
-	xfree(data);
-	xfree(blob);
-	if (signature != NULL)
-		xfree(signature);
-}
-
-/* shared */
-static void
-process_remove_identity(SocketEntry *e, int version)
-{
-	u_int blen, bits;
-	int success = 0;
-	Key *key = NULL;
-	u_char *blob;
-
-	switch (version) {
-	case 1:
-		key = key_new(KEY_RSA1);
-		bits = buffer_get_int(&e->request);
-		buffer_get_bignum(&e->request, key->rsa->e);
-		buffer_get_bignum(&e->request, key->rsa->n);
-
-		if (bits != key_size(key))
-			log("Warning: identity keysize mismatch: actual %u, announced %u",
-			    key_size(key), bits);
-		break;
-	case 2:
-		blob = buffer_get_string(&e->request, &blen);
-		key = key_from_blob(blob, blen);
-		xfree(blob);
-		break;
-	}
-	if (key != NULL) {
-		Identity *id = lookup_identity(key, version);
-		if (id != NULL) {
-			/*
-			 * We have this key.  Free the old key.  Since we
-			 * don\'t want to leave empty slots in the middle of
-			 * the array, we actually free the key there and move
-			 * all the entries between the empty slot and the end
-			 * of the array.
-			 */
-			Idtab *tab = idtab_lookup(version);
-			if (tab->nentries < 1)
-				fatal("process_remove_identity: "
-				    "internal error: tab->nentries %d",
-				    tab->nentries);
-			TAILQ_REMOVE(&tab->idlist, id, next);
-			free_identity(id);
-			tab->nentries--;
-			success = 1;
-		}
-		key_free(key);
-	}
-	buffer_put_int(&e->output, 1);
-	buffer_put_char(&e->output,
-	    success ? SSH_AGENT_SUCCESS : SSH_AGENT_FAILURE);
-}
-
-static void
-process_remove_all_identities(SocketEntry *e, int version)
-{
-	Idtab *tab = idtab_lookup(version);
-	Identity *id;
-
-	/* Loop over all identities and clear the keys. */
-	for (id = TAILQ_FIRST(&tab->idlist); id;
-	    id = TAILQ_FIRST(&tab->idlist)) {
-		TAILQ_REMOVE(&tab->idlist, id, next);
-		free_identity(id);
-	}
-
-	/* Mark that there are no identities. */
-	tab->nentries = 0;
-
-	/* Send success. */
-	buffer_put_int(&e->output, 1);
-	buffer_put_char(&e->output, SSH_AGENT_SUCCESS);
-}
-
-static void
-reaper(void)
-{
-	u_int now = time(NULL);
-	Identity *id, *nxt;
-	int version;
-	Idtab *tab;
-
-	for (version = 1; version < 3; version++) {
-		tab = idtab_lookup(version);
-		for (id = TAILQ_FIRST(&tab->idlist); id; id = nxt) {
-			nxt = TAILQ_NEXT(id, next);
-			if (id->death != 0 && now >= id->death) {
-				TAILQ_REMOVE(&tab->idlist, id, next);
-				free_identity(id);
-				tab->nentries--;
-			}
-		}
-	}
-}
-
-static void
-process_add_identity(SocketEntry *e, int version)
-{
-	Idtab *tab = idtab_lookup(version);
-	int type, success = 0, death = 0, confirm = 0;
-	char *type_name, *comment;
-	Key *k = NULL;
-
-	switch (version) {
-	case 1:
-		k = key_new_private(KEY_RSA1);
-		(void) buffer_get_int(&e->request);		/* ignored */
-		buffer_get_bignum(&e->request, k->rsa->n);
-		buffer_get_bignum(&e->request, k->rsa->e);
-		buffer_get_bignum(&e->request, k->rsa->d);
-		buffer_get_bignum(&e->request, k->rsa->iqmp);
-
-		/* SSH and SSL have p and q swapped */
-		buffer_get_bignum(&e->request, k->rsa->q);	/* p */
-		buffer_get_bignum(&e->request, k->rsa->p);	/* q */
-
-		/* Generate additional parameters */
-		rsa_generate_additional_parameters(k->rsa);
-		break;
-	case 2:
-		type_name = buffer_get_string(&e->request, NULL);
-		type = key_type_from_name(type_name);
-		xfree(type_name);
-		switch (type) {
-		case KEY_DSA:
-			k = key_new_private(type);
-			buffer_get_bignum2(&e->request, k->dsa->p);
-			buffer_get_bignum2(&e->request, k->dsa->q);
-			buffer_get_bignum2(&e->request, k->dsa->g);
-			buffer_get_bignum2(&e->request, k->dsa->pub_key);
-			buffer_get_bignum2(&e->request, k->dsa->priv_key);
-			break;
-		case KEY_RSA:
-			k = key_new_private(type);
-			buffer_get_bignum2(&e->request, k->rsa->n);
-			buffer_get_bignum2(&e->request, k->rsa->e);
-			buffer_get_bignum2(&e->request, k->rsa->d);
-			buffer_get_bignum2(&e->request, k->rsa->iqmp);
-			buffer_get_bignum2(&e->request, k->rsa->p);
-			buffer_get_bignum2(&e->request, k->rsa->q);
-
-			/* Generate additional parameters */
-			rsa_generate_additional_parameters(k->rsa);
-			break;
-		default:
-			buffer_clear(&e->request);
-			goto send;
-		}
-		break;
-	}
-	/* enable blinding */
-	switch (k->type) {
-	case KEY_RSA:
-	case KEY_RSA1:
-		if (RSA_blinding_on(k->rsa, NULL) != 1) {
-			error("process_add_identity: RSA_blinding_on failed");
-			key_free(k);
-			goto send;
-		}
-		break;
-	}
-	comment = buffer_get_string(&e->request, NULL);
-	if (k == NULL) {
-		xfree(comment);
-		goto send;
-	}
-	success = 1;
-	while (buffer_len(&e->request)) {
-		switch (buffer_get_char(&e->request)) {
-		case SSH_AGENT_CONSTRAIN_LIFETIME:
-			death = time(NULL) + buffer_get_int(&e->request);
-			break;
-		case SSH_AGENT_CONSTRAIN_CONFIRM:
-			confirm = 1;
-			break;
-		default:
-			break;
-		}
-	}
-	if (lifetime && !death)
-		death = time(NULL) + lifetime;
-	if (lookup_identity(k, version) == NULL) {
-		Identity *id = xmalloc(sizeof(Identity));
-		id->key = k;
-		id->comment = comment;
-		id->death = death;
-		id->confirm = confirm;
-		TAILQ_INSERT_TAIL(&tab->idlist, id, next);
-		/* Increment the number of identities. */
-		tab->nentries++;
-	} else {
-		key_free(k);
-		xfree(comment);
-	}
-send:
-	buffer_put_int(&e->output, 1);
-	buffer_put_char(&e->output,
-	    success ? SSH_AGENT_SUCCESS : SSH_AGENT_FAILURE);
-}
-
-/* XXX todo: encrypt sensitive data with passphrase */
-static void
-process_lock_agent(SocketEntry *e, int lock)
-{
-	int success = 0;
-	char *passwd;
-
-	passwd = buffer_get_string(&e->request, NULL);
-	if (locked && !lock && strcmp(passwd, lock_passwd) == 0) {
-		locked = 0;
-		memset(lock_passwd, 0, strlen(lock_passwd));
-		xfree(lock_passwd);
-		lock_passwd = NULL;
-		success = 1;
-	} else if (!locked && lock) {
-		locked = 1;
-		lock_passwd = xstrdup(passwd);
-		success = 1;
-	}
-	memset(passwd, 0, strlen(passwd));
-	xfree(passwd);
-
-	buffer_put_int(&e->output, 1);
-	buffer_put_char(&e->output,
-	    success ? SSH_AGENT_SUCCESS : SSH_AGENT_FAILURE);
-}
-
-static void
-no_identities(SocketEntry *e, u_int type)
-{
-	Buffer msg;
-
-	buffer_init(&msg);
-	buffer_put_char(&msg,
-	    (type == SSH_AGENTC_REQUEST_RSA_IDENTITIES) ?
-	    SSH_AGENT_RSA_IDENTITIES_ANSWER : SSH2_AGENT_IDENTITIES_ANSWER);
-	buffer_put_int(&msg, 0);
-	buffer_put_int(&e->output, buffer_len(&msg));
-	buffer_append(&e->output, buffer_ptr(&msg), buffer_len(&msg));
-	buffer_free(&msg);
-}
-
-#ifdef SMARTCARD
-static void
-process_add_smartcard_key (SocketEntry *e)
-{
-	char *sc_reader_id = NULL, *pin;
-	int i, version, success = 0;
-	Key **keys, *k;
-	Identity *id;
-	Idtab *tab;
-
-	sc_reader_id = buffer_get_string(&e->request, NULL);
-	pin = buffer_get_string(&e->request, NULL);
-	keys = sc_get_keys(sc_reader_id, pin);
-	xfree(sc_reader_id);
-	xfree(pin);
-
-	if (keys == NULL || keys[0] == NULL) {
-		error("sc_get_keys failed");
-		goto send;
-	}
-	for (i = 0; keys[i] != NULL; i++) {
-		k = keys[i];
-		version = k->type == KEY_RSA1 ? 1 : 2;
-		tab = idtab_lookup(version);
-		if (lookup_identity(k, version) == NULL) {
-			id = xmalloc(sizeof(Identity));
-			id->key = k;
-			id->comment = xstrdup("smartcard key");
-			id->death = 0;
-			id->confirm = 0;
-			TAILQ_INSERT_TAIL(&tab->idlist, id, next);
-			tab->nentries++;
-			success = 1;
-		} else {
-			key_free(k);
-		}
-		keys[i] = NULL;
-	}
-	xfree(keys);
-send:
-	buffer_put_int(&e->output, 1);
-	buffer_put_char(&e->output,
-	    success ? SSH_AGENT_SUCCESS : SSH_AGENT_FAILURE);
-}
-
-static void
-process_remove_smartcard_key(SocketEntry *e)
-{
-	char *sc_reader_id = NULL, *pin;
-	int i, version, success = 0;
-	Key **keys, *k = NULL;
-	Identity *id;
-	Idtab *tab;
-
-	sc_reader_id = buffer_get_string(&e->request, NULL);
-	pin = buffer_get_string(&e->request, NULL);
-	keys = sc_get_keys(sc_reader_id, pin);
-	xfree(sc_reader_id);
-	xfree(pin);
-
-	if (keys == NULL || keys[0] == NULL) {
-		error("sc_get_keys failed");
-		goto send;
-	}
-	for (i = 0; keys[i] != NULL; i++) {
-		k = keys[i];
-		version = k->type == KEY_RSA1 ? 1 : 2;
-		if ((id = lookup_identity(k, version)) != NULL) {
-			tab = idtab_lookup(version);
-			TAILQ_REMOVE(&tab->idlist, id, next);
-			tab->nentries--;
-			free_identity(id);
-			success = 1;
-		}
-		key_free(k);
-		keys[i] = NULL;
-	}
-	xfree(keys);
-send:
-	buffer_put_int(&e->output, 1);
-	buffer_put_char(&e->output,
-	    success ? SSH_AGENT_SUCCESS : SSH_AGENT_FAILURE);
-}
-#endif /* SMARTCARD */
-
-/* dispatch incoming messages */
-
-static void
-process_message(SocketEntry *e)
-{
-	u_int msg_len, type;
-	u_char *cp;
-
-	/* kill dead keys */
-	reaper();
-
-	if (buffer_len(&e->input) < 5)
-		return;		/* Incomplete message. */
-	cp = buffer_ptr(&e->input);
-	msg_len = GET_32BIT(cp);
-	if (msg_len > 256 * 1024) {
-		close_socket(e);
-		return;
-	}
-	if (buffer_len(&e->input) < msg_len + 4)
-		return;
-
-	/* move the current input to e->request */
-	buffer_consume(&e->input, 4);
-	buffer_clear(&e->request);
-	buffer_append(&e->request, buffer_ptr(&e->input), msg_len);
-	buffer_consume(&e->input, msg_len);
-	type = buffer_get_char(&e->request);
-
-	/* check wheter agent is locked */
-	if (locked && type != SSH_AGENTC_UNLOCK) {
-		buffer_clear(&e->request);
-		switch (type) {
-		case SSH_AGENTC_REQUEST_RSA_IDENTITIES:
-		case SSH2_AGENTC_REQUEST_IDENTITIES:
-			/* send empty lists */
-			no_identities(e, type);
-			break;
-		default:
-			/* send a fail message for all other request types */
-			buffer_put_int(&e->output, 1);
-			buffer_put_char(&e->output, SSH_AGENT_FAILURE);
-		}
-		return;
-	}
-
-	debug("type %d", type);
-	switch (type) {
-	case SSH_AGENTC_LOCK:
-	case SSH_AGENTC_UNLOCK:
-		process_lock_agent(e, type == SSH_AGENTC_LOCK);
-		break;
-	/* ssh1 */
-	case SSH_AGENTC_RSA_CHALLENGE:
-		process_authentication_challenge1(e);
-		break;
-	case SSH_AGENTC_REQUEST_RSA_IDENTITIES:
-		process_request_identities(e, 1);
-		break;
-	case SSH_AGENTC_ADD_RSA_IDENTITY:
-	case SSH_AGENTC_ADD_RSA_ID_CONSTRAINED:
-		process_add_identity(e, 1);
-		break;
-	case SSH_AGENTC_REMOVE_RSA_IDENTITY:
-		process_remove_identity(e, 1);
-		break;
-	case SSH_AGENTC_REMOVE_ALL_RSA_IDENTITIES:
-		process_remove_all_identities(e, 1);
-		break;
-	/* ssh2 */
-	case SSH2_AGENTC_SIGN_REQUEST:
-		process_sign_request2(e);
-		break;
-	case SSH2_AGENTC_REQUEST_IDENTITIES:
-		process_request_identities(e, 2);
-		break;
-	case SSH2_AGENTC_ADD_IDENTITY:
-	case SSH2_AGENTC_ADD_ID_CONSTRAINED:
-		process_add_identity(e, 2);
-		break;
-	case SSH2_AGENTC_REMOVE_IDENTITY:
-		process_remove_identity(e, 2);
-		break;
-	case SSH2_AGENTC_REMOVE_ALL_IDENTITIES:
-		process_remove_all_identities(e, 2);
-		break;
-#ifdef SMARTCARD
-	case SSH_AGENTC_ADD_SMARTCARD_KEY:
-		process_add_smartcard_key(e);
-		break;
-	case SSH_AGENTC_REMOVE_SMARTCARD_KEY:
-		process_remove_smartcard_key(e);
-		break;
-#endif /* SMARTCARD */
-	default:
-		/* Unknown message.  Respond with failure. */
-		error("Unknown message %d", type);
-		buffer_clear(&e->request);
-		buffer_put_int(&e->output, 1);
-		buffer_put_char(&e->output, SSH_AGENT_FAILURE);
-		break;
-	}
-}
-
-static void
-new_socket(sock_type type, int fd)
-{
-	u_int i, old_alloc;
-
-	if (fcntl(fd, F_SETFL, O_NONBLOCK) < 0)
-		error("fcntl O_NONBLOCK: %s", strerror(errno));
-
-	if (fd > max_fd)
-		max_fd = fd;
-
-	for (i = 0; i < sockets_alloc; i++)
-		if (sockets[i].type == AUTH_UNUSED) {
-			sockets[i].fd = fd;
-			sockets[i].type = type;
-			buffer_init(&sockets[i].input);
-			buffer_init(&sockets[i].output);
-			buffer_init(&sockets[i].request);
-			return;
-		}
-	old_alloc = sockets_alloc;
-	sockets_alloc += 10;
-	if (sockets)
-		sockets = xrealloc(sockets, sockets_alloc * sizeof(sockets[0]));
-	else
-		sockets = xmalloc(sockets_alloc * sizeof(sockets[0]));
-	for (i = old_alloc; i < sockets_alloc; i++)
-		sockets[i].type = AUTH_UNUSED;
-	sockets[old_alloc].type = type;
-	sockets[old_alloc].fd = fd;
-	buffer_init(&sockets[old_alloc].input);
-	buffer_init(&sockets[old_alloc].output);
-	buffer_init(&sockets[old_alloc].request);
-}
-
-static int
-prepare_select(fd_set **fdrp, fd_set **fdwp, int *fdl, int *nallocp)
-{
-	u_int i, sz;
-	int n = 0;
-
-	for (i = 0; i < sockets_alloc; i++) {
-		switch (sockets[i].type) {
-		case AUTH_SOCKET:
-		case AUTH_CONNECTION:
-			n = MAX(n, sockets[i].fd);
-			break;
-		case AUTH_UNUSED:
-			break;
-		default:
-			fatal("Unknown socket type %d", sockets[i].type);
-			break;
-		}
-	}
-
-	sz = howmany(n+1, NFDBITS) * sizeof(fd_mask);
-	if (*fdrp == NULL || sz > *nallocp) {
-		if (*fdrp)
-			xfree(*fdrp);
-		if (*fdwp)
-			xfree(*fdwp);
-		*fdrp = xmalloc(sz);
-		*fdwp = xmalloc(sz);
-		*nallocp = sz;
-	}
-	if (n < *fdl)
-		debug("XXX shrink: %d < %d", n, *fdl);
-	*fdl = n;
-	memset(*fdrp, 0, sz);
-	memset(*fdwp, 0, sz);
-
-	for (i = 0; i < sockets_alloc; i++) {
-		switch (sockets[i].type) {
-		case AUTH_SOCKET:
-		case AUTH_CONNECTION:
-			FD_SET(sockets[i].fd, *fdrp);
-			if (buffer_len(&sockets[i].output) > 0)
-				FD_SET(sockets[i].fd, *fdwp);
-			break;
-		default:
-			break;
-		}
-	}
-	return (1);
-}
-
-static void
-after_select(fd_set *readset, fd_set *writeset)
-{
-	struct sockaddr_un sunaddr;
-	socklen_t slen;
-	char buf[1024];
-	int len, sock;
-	u_int i;
-	uid_t euid;
-	gid_t egid;
-
-	for (i = 0; i < sockets_alloc; i++)
-		switch (sockets[i].type) {
-		case AUTH_UNUSED:
-			break;
-		case AUTH_SOCKET:
-			if (FD_ISSET(sockets[i].fd, readset)) {
-				slen = sizeof(sunaddr);
-				sock = accept(sockets[i].fd,
-				    (struct sockaddr *) &sunaddr, &slen);
-				if (sock < 0) {
-					error("accept from AUTH_SOCKET: %s",
-					    strerror(errno));
-					break;
-				}
-				if (getpeereid(sock, &euid, &egid) < 0) {
-					error("getpeereid %d failed: %s",
-					    sock, strerror(errno));
-					close(sock);
-					break;
-				}
-				if ((euid != 0) && (getuid() != euid)) {
-					error("uid mismatch: "
-					    "peer euid %u != uid %u",
-					    (u_int) euid, (u_int) getuid());
-					close(sock);
-					break;
-				}
-				new_socket(AUTH_CONNECTION, sock);
-			}
-			break;
-		case AUTH_CONNECTION:
-			if (buffer_len(&sockets[i].output) > 0 &&
-			    FD_ISSET(sockets[i].fd, writeset)) {
-				do {
-					len = write(sockets[i].fd,
-					    buffer_ptr(&sockets[i].output),
-					    buffer_len(&sockets[i].output));
-					if (len == -1 && (errno == EAGAIN ||
-					    errno == EINTR))
-						continue;
-					break;
-				} while (1);
-				if (len <= 0) {
-					close_socket(&sockets[i]);
-					break;
-				}
-				buffer_consume(&sockets[i].output, len);
-			}
-			if (FD_ISSET(sockets[i].fd, readset)) {
-				do {
-					len = read(sockets[i].fd, buf, sizeof(buf));
-					if (len == -1 && (errno == EAGAIN ||
-					    errno == EINTR))
-						continue;
-					break;
-				} while (1);
-				if (len <= 0) {
-					close_socket(&sockets[i]);
-					break;
-				}
-				buffer_append(&sockets[i].input, buf, len);
-				process_message(&sockets[i]);
-			}
-			break;
-		default:
-			fatal("Unknown type %d", sockets[i].type);
-		}
-}
-
-static void
-cleanup_socket(void *p)
-{
-	if (socket_name[0])
-		unlink(socket_name);
-	if (socket_dir[0])
-		rmdir(socket_dir);
-}
-
-static void
-cleanup_exit(int i)
-{
-	cleanup_socket(NULL);
-	exit(i);
-}
-
-static void
-cleanup_handler(int sig)
-{
-	cleanup_socket(NULL);
-	_exit(2);
-}
-
-static void
-check_parent_exists(int sig)
-{
-	int save_errno = errno;
-
-	if (parent_pid != -1 && kill(parent_pid, 0) < 0) {
-		/* printf("Parent has died - Authentication agent exiting.\n"); */
-		cleanup_handler(sig); /* safe */
-	}
-	signal(SIGALRM, check_parent_exists);
-	alarm(10);
-	errno = save_errno;
-}
-
-static void
-usage(void)
-{
-	fprintf(stderr, "Usage: %s [options] [command [args ...]]\n",
-	    __progname);
-	fprintf(stderr, "Options:\n");
-	fprintf(stderr, "  -c          Generate C-shell commands on stdout.\n");
-	fprintf(stderr, "  -s          Generate Bourne shell commands on stdout.\n");
-	fprintf(stderr, "  -k          Kill the current agent.\n");
-	fprintf(stderr, "  -d          Debug mode.\n");
-	fprintf(stderr, "  -a socket   Bind agent socket to given name.\n");
-	fprintf(stderr, "  -t life     Default identity lifetime (seconds).\n");
-	exit(1);
-}
-
-int
-main(int ac, char **av)
-{
-	int c_flag = 0, d_flag = 0, k_flag = 0, s_flag = 0;
-	int sock, fd,  ch, nalloc;
-	char *shell, *format, *pidstr, *agentsocket = NULL;
-	fd_set *readsetp = NULL, *writesetp = NULL;
-	struct sockaddr_un sunaddr;
-#ifdef HAVE_SETRLIMIT
-	struct rlimit rlim;
-#endif
-#ifdef HAVE_CYGWIN
-	int prev_mask;
-#endif
-	extern int optind;
-	extern char *optarg;
-	pid_t pid;
-	char pidstrbuf[1 + 3 * sizeof pid];
-
-	/* drop */
-	setegid(getgid());
-	setgid(getgid());
-
-	SSLeay_add_all_algorithms();
-
-	__progname = get_progname(av[0]);
-	init_rng();
-	seed_rng();
-
-	while ((ch = getopt(ac, av, "cdksa:t:")) != -1) {
-		switch (ch) {
-		case 'c':
-			if (s_flag)
-				usage();
-			c_flag++;
-			break;
-		case 'k':
-			k_flag++;
-			break;
-		case 's':
-			if (c_flag)
-				usage();
-			s_flag++;
-			break;
-		case 'd':
-			if (d_flag)
-				usage();
-			d_flag++;
-			break;
-		case 'a':
-			agentsocket = optarg;
-			break;
-		case 't':
-			if ((lifetime = convtime(optarg)) == -1) {
-				fprintf(stderr, "Invalid lifetime\n");
-				usage();
-			}
-			break;
-		default:
-			usage();
-		}
-	}
-	ac -= optind;
-	av += optind;
-
-	if (ac > 0 && (c_flag || k_flag || s_flag || d_flag))
-		usage();
-
-	if (ac == 0 && !c_flag && !s_flag) {
-		shell = getenv("SHELL");
-		if (shell != NULL && strncmp(shell + strlen(shell) - 3, "csh", 3) == 0)
-			c_flag = 1;
-	}
-	if (k_flag) {
-		pidstr = getenv(SSH_AGENTPID_ENV_NAME);
-		if (pidstr == NULL) {
-			fprintf(stderr, "%s not set, cannot kill agent\n",
-			    SSH_AGENTPID_ENV_NAME);
-			exit(1);
-		}
-		pid = atoi(pidstr);
-		if (pid < 1) {
-			fprintf(stderr, "%s=\"%s\", which is not a good PID\n",
-			    SSH_AGENTPID_ENV_NAME, pidstr);
-			exit(1);
-		}
-		if (kill(pid, SIGTERM) == -1) {
-			perror("kill");
-			exit(1);
-		}
-		format = c_flag ? "unsetenv %s;\n" : "unset %s;\n";
-		printf(format, SSH_AUTHSOCKET_ENV_NAME);
-		printf(format, SSH_AGENTPID_ENV_NAME);
-		printf("echo Agent pid %ld killed;\n", (long)pid);
-		exit(0);
-	}
-	parent_pid = getpid();
-
-	if (agentsocket == NULL) {
-		/* Create private directory for agent socket */
-		strlcpy(socket_dir, "/tmp/ssh-XXXXXXXX", sizeof socket_dir);
-		if (mkdtemp(socket_dir) == NULL) {
-			perror("mkdtemp: private socket dir");
-			exit(1);
-		}
-		snprintf(socket_name, sizeof socket_name, "%s/agent.%ld", socket_dir,
-		    (long)parent_pid);
-	} else {
-		/* Try to use specified agent socket */
-		socket_dir[0] = '\0';
-		strlcpy(socket_name, agentsocket, sizeof socket_name);
-	}
-
-	/*
-	 * Create socket early so it will exist before command gets run from
-	 * the parent.
-	 */
-	sock = socket(AF_UNIX, SOCK_STREAM, 0);
-	if (sock < 0) {
-		perror("socket");
-		cleanup_exit(1);
-	}
-	memset(&sunaddr, 0, sizeof(sunaddr));
-	sunaddr.sun_family = AF_UNIX;
-	strlcpy(sunaddr.sun_path, socket_name, sizeof(sunaddr.sun_path));
-#ifdef HAVE_CYGWIN
-	prev_mask = umask(0177);
-#endif
-	if (bind(sock, (struct sockaddr *) & sunaddr, sizeof(sunaddr)) < 0) {
-		perror("bind");
-#ifdef HAVE_CYGWIN
-		umask(prev_mask);
-#endif
-		cleanup_exit(1);
-	}
-#ifdef HAVE_CYGWIN
-	umask(prev_mask);
-#endif
-	if (listen(sock, 128) < 0) {
-		perror("listen");
-		cleanup_exit(1);
-	}
-
-	/*
-	 * Fork, and have the parent execute the command, if any, or present
-	 * the socket data.  The child continues as the authentication agent.
-	 */
-	if (d_flag) {
-		log_init(__progname, SYSLOG_LEVEL_DEBUG1, SYSLOG_FACILITY_AUTH, 1);
-		format = c_flag ? "setenv %s %s;\n" : "%s=%s; export %s;\n";
-		printf(format, SSH_AUTHSOCKET_ENV_NAME, socket_name,
-		    SSH_AUTHSOCKET_ENV_NAME);
-		printf("echo Agent pid %ld;\n", (long)parent_pid);
-		goto skip;
-	}
-	pid = fork();
-	if (pid == -1) {
-		perror("fork");
-		cleanup_exit(1);
-	}
-	if (pid != 0) {		/* Parent - execute the given command. */
-		close(sock);
-		snprintf(pidstrbuf, sizeof pidstrbuf, "%ld", (long)pid);
-		if (ac == 0) {
-			format = c_flag ? "setenv %s %s;\n" : "%s=%s; export %s;\n";
-			printf(format, SSH_AUTHSOCKET_ENV_NAME, socket_name,
-			    SSH_AUTHSOCKET_ENV_NAME);
-			printf(format, SSH_AGENTPID_ENV_NAME, pidstrbuf,
-			    SSH_AGENTPID_ENV_NAME);
-			printf("echo Agent pid %ld;\n", (long)pid);
-			exit(0);
-		}
-		if (setenv(SSH_AUTHSOCKET_ENV_NAME, socket_name, 1) == -1 ||
-		    setenv(SSH_AGENTPID_ENV_NAME, pidstrbuf, 1) == -1) {
-			perror("setenv");
-			exit(1);
-		}
-		execvp(av[0], av);
-		perror(av[0]);
-		exit(1);
-	}
-	/* child */
-	log_init(__progname, SYSLOG_LEVEL_INFO, SYSLOG_FACILITY_AUTH, 0);
-
-	if (setsid() == -1) {
-		error("setsid: %s", strerror(errno));
-		cleanup_exit(1);
-	}
-
-	(void)chdir("/");
-	if ((fd = open(_PATH_DEVNULL, O_RDWR, 0)) != -1) {
-		/* XXX might close listen socket */
-		(void)dup2(fd, STDIN_FILENO);
-		(void)dup2(fd, STDOUT_FILENO);
-		(void)dup2(fd, STDERR_FILENO);
-		if (fd > 2)
-			close(fd);
-	}
-
-#ifdef HAVE_SETRLIMIT
-	/* deny core dumps, since memory contains unencrypted private keys */
-	rlim.rlim_cur = rlim.rlim_max = 0;
-	if (setrlimit(RLIMIT_CORE, &rlim) < 0) {
-		error("setrlimit RLIMIT_CORE: %s", strerror(errno));
-		cleanup_exit(1);
-	}
-#endif
-
-skip:
-	fatal_add_cleanup(cleanup_socket, NULL);
-	new_socket(AUTH_SOCKET, sock);
-	if (ac > 0) {
-		signal(SIGALRM, check_parent_exists);
-		alarm(10);
-	}
-	idtab_init();
-	if (!d_flag)
-		signal(SIGINT, SIG_IGN);
-	signal(SIGPIPE, SIG_IGN);
-	signal(SIGHUP, cleanup_handler);
-	signal(SIGTERM, cleanup_handler);
-	nalloc = 0;
-
-	while (1) {
-		prepare_select(&readsetp, &writesetp, &max_fd, &nalloc);
-		if (select(max_fd + 1, readsetp, writesetp, NULL, NULL) < 0) {
-			if (errno == EINTR)
-				continue;
-			fatal("select: %s", strerror(errno));
-		}
-		after_select(readsetp, writesetp);
-	}
-	/* NOTREACHED */
-}
diff --git a/crypto/openssh/ssh-agent/Makefile b/crypto/openssh/ssh-agent/Makefile
deleted file mode 100644
index c252dbdad65e..000000000000
--- a/crypto/openssh/ssh-agent/Makefile
+++ /dev/null
@@ -1,18 +0,0 @@
-#	$OpenBSD: Makefile,v 1.21 2001/06/27 19:29:16 markus Exp $
-
-.PATH:		${.CURDIR}/..
-
-PROG=	ssh-agent
-BINOWN=	root
-
-BINMODE?=555
-
-BINDIR=	/usr/bin
-MAN=	ssh-agent.1
-
-SRCS=	ssh-agent.c
-
-.include <bsd.prog.mk>
-
-LDADD+=	-lcrypto
-DPADD+=	${LIBCRYPTO}
diff --git a/crypto/openssh/ssh-dss.c b/crypto/openssh/ssh-dss.c
deleted file mode 100644
index 6cedcc4dcd74..000000000000
--- a/crypto/openssh/ssh-dss.c
+++ /dev/null
@@ -1,180 +0,0 @@
-/*
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: ssh-dss.c,v 1.18 2003/02/12 09:33:04 markus Exp $");
-
-#include <openssl/bn.h>
-#include <openssl/evp.h>
-
-#include "xmalloc.h"
-#include "buffer.h"
-#include "bufaux.h"
-#include "compat.h"
-#include "log.h"
-#include "key.h"
-
-#define INTBLOB_LEN	20
-#define SIGBLOB_LEN	(2*INTBLOB_LEN)
-
-int
-ssh_dss_sign(Key *key, u_char **sigp, u_int *lenp,
-    u_char *data, u_int datalen)
-{
-	DSA_SIG *sig;
-	const EVP_MD *evp_md = EVP_sha1();
-	EVP_MD_CTX md;
-	u_char digest[EVP_MAX_MD_SIZE], sigblob[SIGBLOB_LEN];
-	u_int rlen, slen, len, dlen;
-	Buffer b;
-
-	if (key == NULL || key->type != KEY_DSA || key->dsa == NULL) {
-		error("ssh_dss_sign: no DSA key");
-		return -1;
-	}
-	EVP_DigestInit(&md, evp_md);
-	EVP_DigestUpdate(&md, data, datalen);
-	EVP_DigestFinal(&md, digest, &dlen);
-
-	sig = DSA_do_sign(digest, dlen, key->dsa);
-	memset(digest, 'd', sizeof(digest));
-
-	if (sig == NULL) {
-		error("ssh_dss_sign: sign failed");
-		return -1;
-	}
-
-	rlen = BN_num_bytes(sig->r);
-	slen = BN_num_bytes(sig->s);
-	if (rlen > INTBLOB_LEN || slen > INTBLOB_LEN) {
-		error("bad sig size %u %u", rlen, slen);
-		DSA_SIG_free(sig);
-		return -1;
-	}
-	memset(sigblob, 0, SIGBLOB_LEN);
-	BN_bn2bin(sig->r, sigblob+ SIGBLOB_LEN - INTBLOB_LEN - rlen);
-	BN_bn2bin(sig->s, sigblob+ SIGBLOB_LEN - slen);
-	DSA_SIG_free(sig);
-
-	if (datafellows & SSH_BUG_SIGBLOB) {
-		if (lenp != NULL)
-			*lenp = SIGBLOB_LEN;
-		if (sigp != NULL) {
-			*sigp = xmalloc(SIGBLOB_LEN);
-			memcpy(*sigp, sigblob, SIGBLOB_LEN);
-		}
-	} else {
-		/* ietf-drafts */
-		buffer_init(&b);
-		buffer_put_cstring(&b, "ssh-dss");
-		buffer_put_string(&b, sigblob, SIGBLOB_LEN);
-		len = buffer_len(&b);
-		if (lenp != NULL)
-			*lenp = len;
-		if (sigp != NULL) {
-			*sigp = xmalloc(len);
-			memcpy(*sigp, buffer_ptr(&b), len);
-		}
-		buffer_free(&b);
-	}
-	return 0;
-}
-int
-ssh_dss_verify(Key *key, u_char *signature, u_int signaturelen,
-    u_char *data, u_int datalen)
-{
-	DSA_SIG *sig;
-	const EVP_MD *evp_md = EVP_sha1();
-	EVP_MD_CTX md;
-	u_char digest[EVP_MAX_MD_SIZE], *sigblob;
-	u_int len, dlen;
-	int rlen, ret;
-	Buffer b;
-
-	if (key == NULL || key->type != KEY_DSA || key->dsa == NULL) {
-		error("ssh_dss_verify: no DSA key");
-		return -1;
-	}
-
-	/* fetch signature */
-	if (datafellows & SSH_BUG_SIGBLOB) {
-		sigblob = signature;
-		len = signaturelen;
-	} else {
-		/* ietf-drafts */
-		char *ktype;
-		buffer_init(&b);
-		buffer_append(&b, signature, signaturelen);
-		ktype = buffer_get_string(&b, NULL);
-		if (strcmp("ssh-dss", ktype) != 0) {
-			error("ssh_dss_verify: cannot handle type %s", ktype);
-			buffer_free(&b);
-			xfree(ktype);
-			return -1;
-		}
-		xfree(ktype);
-		sigblob = buffer_get_string(&b, &len);
-		rlen = buffer_len(&b);
-		buffer_free(&b);
-		if (rlen != 0) {
-			error("ssh_dss_verify: "
-			    "remaining bytes in signature %d", rlen);
-			xfree(sigblob);
-			return -1;
-		}
-	}
-
-	if (len != SIGBLOB_LEN) {
-		fatal("bad sigbloblen %u != SIGBLOB_LEN", len);
-	}
-
-	/* parse signature */
-	if ((sig = DSA_SIG_new()) == NULL)
-		fatal("ssh_dss_verify: DSA_SIG_new failed");
-	if ((sig->r = BN_new()) == NULL)
-		fatal("ssh_dss_verify: BN_new failed");
-	if ((sig->s = BN_new()) == NULL)
-		fatal("ssh_dss_verify: BN_new failed");
-	BN_bin2bn(sigblob, INTBLOB_LEN, sig->r);
-	BN_bin2bn(sigblob+ INTBLOB_LEN, INTBLOB_LEN, sig->s);
-
-	if (!(datafellows & SSH_BUG_SIGBLOB)) {
-		memset(sigblob, 0, len);
-		xfree(sigblob);
-	}
-
-	/* sha1 the data */
-	EVP_DigestInit(&md, evp_md);
-	EVP_DigestUpdate(&md, data, datalen);
-	EVP_DigestFinal(&md, digest, &dlen);
-
-	ret = DSA_do_verify(digest, dlen, sig, key->dsa);
-	memset(digest, 'd', sizeof(digest));
-
-	DSA_SIG_free(sig);
-
-	debug("ssh_dss_verify: signature %s",
-	    ret == 1 ? "correct" : ret == 0 ? "incorrect" : "error");
-	return ret;
-}
diff --git a/crypto/openssh/ssh-dss.h b/crypto/openssh/ssh-dss.h
deleted file mode 100644
index 94961b1e8ca7..000000000000
--- a/crypto/openssh/ssh-dss.h
+++ /dev/null
@@ -1,32 +0,0 @@
-/*	$OpenBSD: ssh-dss.h,v 1.6 2002/02/24 19:14:59 markus Exp $	*/
-
-/*
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#ifndef DSA_H
-#define DSA_H
-
-int	 ssh_dss_sign(Key *, u_char **, u_int *, u_char *, u_int);
-int	 ssh_dss_verify(Key *, u_char *, u_int, u_char *, u_int);
-
-#endif
diff --git a/crypto/openssh/ssh-keygen.1 b/crypto/openssh/ssh-keygen.1
deleted file mode 100644
index 000e8ff2a461..000000000000
--- a/crypto/openssh/ssh-keygen.1
+++ /dev/null
@@ -1,300 +0,0 @@
-.\"	$OpenBSD: ssh-keygen.1,v 1.56 2003/03/28 10:11:43 jmc Exp $
-.\"
-.\"  -*- nroff -*-
-.\"
-.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
-.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
-.\"                    All rights reserved
-.\"
-.\" As far as I am concerned, the code I have written for this software
-.\" can be used freely for any purpose.  Any derived versions of this
-.\" software must be clearly marked as such, and if the derived work is
-.\" incompatible with the protocol description in the RFC file, it must be
-.\" called by a name other than "ssh" or "Secure Shell".
-.\"
-.\"
-.\" Copyright (c) 1999,2000 Markus Friedl.  All rights reserved.
-.\" Copyright (c) 1999 Aaron Campbell.  All rights reserved.
-.\" Copyright (c) 1999 Theo de Raadt.  All rights reserved.
-.\"
-.\" Redistribution and use in source and binary forms, with or without
-.\" modification, are permitted provided that the following conditions
-.\" are met:
-.\" 1. Redistributions of source code must retain the above copyright
-.\"    notice, this list of conditions and the following disclaimer.
-.\" 2. Redistributions in binary form must reproduce the above copyright
-.\"    notice, this list of conditions and the following disclaimer in the
-.\"    documentation and/or other materials provided with the distribution.
-.\"
-.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-.\"
-.Dd September 25, 1999
-.Dt SSH-KEYGEN 1
-.Os
-.Sh NAME
-.Nm ssh-keygen
-.Nd authentication key generation, management and conversion
-.Sh SYNOPSIS
-.Nm ssh-keygen
-.Bk -words
-.Op Fl q
-.Op Fl b Ar bits
-.Fl t Ar type
-.Op Fl N Ar new_passphrase
-.Op Fl C Ar comment
-.Op Fl f Ar output_keyfile
-.Ek
-.Nm ssh-keygen
-.Fl p
-.Op Fl P Ar old_passphrase
-.Op Fl N Ar new_passphrase
-.Op Fl f Ar keyfile
-.Nm ssh-keygen
-.Fl i
-.Op Fl f Ar input_keyfile
-.Nm ssh-keygen
-.Fl e
-.Op Fl f Ar input_keyfile
-.Nm ssh-keygen
-.Fl y
-.Op Fl f Ar input_keyfile
-.Nm ssh-keygen
-.Fl c
-.Op Fl P Ar passphrase
-.Op Fl C Ar comment
-.Op Fl f Ar keyfile
-.Nm ssh-keygen
-.Fl l
-.Op Fl f Ar input_keyfile
-.Nm ssh-keygen
-.Fl B
-.Op Fl f Ar input_keyfile
-.Nm ssh-keygen
-.Fl D Ar reader
-.Nm ssh-keygen
-.Fl U Ar reader
-.Op Fl f Ar input_keyfile
-.Sh DESCRIPTION
-.Nm
-generates, manages and converts authentication keys for
-.Xr ssh 1 .
-.Nm
-can create RSA keys for use by SSH protocol version 1 and RSA or DSA
-keys for use by SSH protocol version 2. The type of key to be generated
-is specified with the
-.Fl t
-option.
-.Pp
-Normally each user wishing to use SSH
-with RSA or DSA authentication runs this once to create the authentication
-key in
-.Pa $HOME/.ssh/identity ,
-.Pa $HOME/.ssh/id_dsa
-or
-.Pa $HOME/.ssh/id_rsa .
-Additionally, the system administrator may use this to generate host keys,
-as seen in
-.Pa /etc/rc .
-.Pp
-Normally this program generates the key and asks for a file in which
-to store the private key.
-The public key is stored in a file with the same name but
-.Dq .pub
-appended.
-The program also asks for a passphrase.
-The passphrase may be empty to indicate no passphrase
-(host keys must have an empty passphrase), or it may be a string of
-arbitrary length.
-A passphrase is similar to a password, except it can be a phrase with a
-series of words, punctuation, numbers, whitespace, or any string of
-characters you want.
-Good passphrases are 10-30 characters long, are
-not simple sentences or otherwise easily guessable (English
-prose has only 1-2 bits of entropy per character, and provides very bad
-passphrases), and contain a mix of upper and lowercase letters,
-numbers, and non-alphanumeric characters.
-The passphrase can be changed later by using the
-.Fl p
-option.
-.Pp
-There is no way to recover a lost passphrase.
-If the passphrase is
-lost or forgotten, a new key must be generated and copied to the
-corresponding public key to other machines.
-.Pp
-For RSA1 keys,
-there is also a comment field in the key file that is only for
-convenience to the user to help identify the key.
-The comment can tell what the key is for, or whatever is useful.
-The comment is initialized to
-.Dq user@host
-when the key is created, but can be changed using the
-.Fl c
-option.
-.Pp
-After a key is generated, instructions below detail where the keys
-should be placed to be activated.
-.Pp
-The options are as follows:
-.Bl -tag -width Ds
-.It Fl b Ar bits
-Specifies the number of bits in the key to create.
-Minimum is 512 bits.
-Generally, 1024 bits is considered sufficient.
-The default is 1024 bits.
-.It Fl c
-Requests changing the comment in the private and public key files.
-This operation is only supported for RSA1 keys.
-The program will prompt for the file containing the private keys, for
-the passphrase if the key has one, and for the new comment.
-.It Fl e
-This option will read a private or public OpenSSH key file and
-print the key in a
-.Sq SECSH Public Key File Format
-to stdout.
-This option allows exporting keys for use by several commercial
-SSH implementations.
-.It Fl f Ar filename
-Specifies the filename of the key file.
-.It Fl i
-This option will read an unencrypted private (or public) key file
-in SSH2-compatible format and print an OpenSSH compatible private
-(or public) key to stdout.
-.Nm
-also reads the
-.Sq SECSH Public Key File Format .
-This option allows importing keys from several commercial
-SSH implementations.
-.It Fl l
-Show fingerprint of specified public key file.
-Private RSA1 keys are also supported.
-For RSA and DSA keys
-.Nm
-tries to find the matching public key file and prints its fingerprint.
-.It Fl p
-Requests changing the passphrase of a private key file instead of
-creating a new private key.
-The program will prompt for the file
-containing the private key, for the old passphrase, and twice for the
-new passphrase.
-.It Fl q
-Silence
-.Nm ssh-keygen .
-Used by
-.Pa /etc/rc
-when creating a new key.
-.It Fl y
-This option will read a private
-OpenSSH format file and print an OpenSSH public key to stdout.
-.It Fl t Ar type
-Specifies the type of the key to create.
-The possible values are
-.Dq rsa1
-for protocol version 1 and
-.Dq rsa
-or
-.Dq dsa
-for protocol version 2.
-.It Fl B
-Show the bubblebabble digest of specified private or public key file.
-.It Fl C Ar comment
-Provides the new comment.
-.It Fl D Ar reader
-Download the RSA public key stored in the smartcard in
-.Ar reader .
-.It Fl N Ar new_passphrase
-Provides the new passphrase.
-.It Fl P Ar passphrase
-Provides the (old) passphrase.
-.It Fl U Ar reader
-Upload an existing RSA private key into the smartcard in
-.Ar reader .
-.El
-.Sh FILES
-.Bl -tag -width Ds
-.It Pa $HOME/.ssh/identity
-Contains the protocol version 1 RSA authentication identity of the user.
-This file should not be readable by anyone but the user.
-It is possible to
-specify a passphrase when generating the key; that passphrase will be
-used to encrypt the private part of this file using 3DES.
-This file is not automatically accessed by
-.Nm
-but it is offered as the default file for the private key.
-.Xr ssh 1
-will read this file when a login attempt is made.
-.It Pa $HOME/.ssh/identity.pub
-Contains the protocol version 1 RSA public key for authentication.
-The contents of this file should be added to
-.Pa $HOME/.ssh/authorized_keys
-on all machines
-where the user wishes to log in using RSA authentication.
-There is no need to keep the contents of this file secret.
-.It Pa $HOME/.ssh/id_dsa
-Contains the protocol version 2 DSA authentication identity of the user.
-This file should not be readable by anyone but the user.
-It is possible to
-specify a passphrase when generating the key; that passphrase will be
-used to encrypt the private part of this file using 3DES.
-This file is not automatically accessed by
-.Nm
-but it is offered as the default file for the private key.
-.Xr ssh 1
-will read this file when a login attempt is made.
-.It Pa $HOME/.ssh/id_dsa.pub
-Contains the protocol version 2 DSA public key for authentication.
-The contents of this file should be added to
-.Pa $HOME/.ssh/authorized_keys
-on all machines
-where the user wishes to log in using public key authentication.
-There is no need to keep the contents of this file secret.
-.It Pa $HOME/.ssh/id_rsa
-Contains the protocol version 2 RSA authentication identity of the user.
-This file should not be readable by anyone but the user.
-It is possible to
-specify a passphrase when generating the key; that passphrase will be
-used to encrypt the private part of this file using 3DES.
-This file is not automatically accessed by
-.Nm
-but it is offered as the default file for the private key.
-.Xr ssh 1
-will read this file when a login attempt is made.
-.It Pa $HOME/.ssh/id_rsa.pub
-Contains the protocol version 2 RSA public key for authentication.
-The contents of this file should be added to
-.Pa $HOME/.ssh/authorized_keys
-on all machines
-where the user wishes to log in using public key authentication.
-There is no need to keep the contents of this file secret.
-.El
-.Sh AUTHORS
-OpenSSH is a derivative of the original and free
-ssh 1.2.12 release by Tatu Ylonen.
-Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos,
-Theo de Raadt and Dug Song
-removed many bugs, re-added newer features and
-created OpenSSH.
-Markus Friedl contributed the support for SSH
-protocol versions 1.5 and 2.0.
-.Sh SEE ALSO
-.Xr ssh 1 ,
-.Xr ssh-add 1 ,
-.Xr ssh-agent 1 ,
-.Xr sshd 8
-.Rs
-.%A J. Galbraith
-.%A R. Thayer
-.%T "SECSH Public Key File Format"
-.%N draft-ietf-secsh-publickeyfile-01.txt
-.%D March 2001
-.%O work in progress material
-.Re
diff --git a/crypto/openssh/ssh-keygen.c b/crypto/openssh/ssh-keygen.c
deleted file mode 100644
index 6a872bcfd208..000000000000
--- a/crypto/openssh/ssh-keygen.c
+++ /dev/null
@@ -1,1002 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * Identity and host key generation and maintenance.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: ssh-keygen.c,v 1.102 2002/11/26 00:45:03 wcobb Exp $");
-
-#include <openssl/evp.h>
-#include <openssl/pem.h>
-
-#include "xmalloc.h"
-#include "key.h"
-#include "rsa.h"
-#include "authfile.h"
-#include "uuencode.h"
-#include "buffer.h"
-#include "bufaux.h"
-#include "pathnames.h"
-#include "log.h"
-#include "readpass.h"
-
-#ifdef SMARTCARD
-#include "scard.h"
-#endif
-
-/* Number of bits in the RSA/DSA key.  This value can be changed on the command line. */
-int bits = 1024;
-
-/*
- * Flag indicating that we just want to change the passphrase.  This can be
- * set on the command line.
- */
-int change_passphrase = 0;
-
-/*
- * Flag indicating that we just want to change the comment.  This can be set
- * on the command line.
- */
-int change_comment = 0;
-
-int quiet = 0;
-
-/* Flag indicating that we just want to see the key fingerprint */
-int print_fingerprint = 0;
-int print_bubblebabble = 0;
-
-/* The identity file name, given on the command line or entered by the user. */
-char identity_file[1024];
-int have_identity = 0;
-
-/* This is set to the passphrase if given on the command line. */
-char *identity_passphrase = NULL;
-
-/* This is set to the new passphrase if given on the command line. */
-char *identity_new_passphrase = NULL;
-
-/* This is set to the new comment if given on the command line. */
-char *identity_comment = NULL;
-
-/* Dump public key file in format used by real and the original SSH 2 */
-int convert_to_ssh2 = 0;
-int convert_from_ssh2 = 0;
-int print_public = 0;
-
-char *key_type_name = NULL;
-
-/* argv0 */
-#ifdef HAVE___PROGNAME
-extern char *__progname;
-#else
-char *__progname;
-#endif
-
-char hostname[MAXHOSTNAMELEN];
-
-static void
-ask_filename(struct passwd *pw, const char *prompt)
-{
-	char buf[1024];
-	char *name = NULL;
-
-	if (key_type_name == NULL)
-		name = _PATH_SSH_CLIENT_ID_RSA;
-	else
-		switch (key_type_from_name(key_type_name)) {
-		case KEY_RSA1:
-			name = _PATH_SSH_CLIENT_IDENTITY;
-			break;
-		case KEY_DSA:
-			name = _PATH_SSH_CLIENT_ID_DSA;
-			break;
-		case KEY_RSA:
-			name = _PATH_SSH_CLIENT_ID_RSA;
-			break;
-		default:
-			fprintf(stderr, "bad key type");
-			exit(1);
-			break;
-		}
-
-	snprintf(identity_file, sizeof(identity_file), "%s/%s", pw->pw_dir, name);
-	fprintf(stderr, "%s (%s): ", prompt, identity_file);
-	if (fgets(buf, sizeof(buf), stdin) == NULL)
-		exit(1);
-	if (strchr(buf, '\n'))
-		*strchr(buf, '\n') = 0;
-	if (strcmp(buf, "") != 0)
-		strlcpy(identity_file, buf, sizeof(identity_file));
-	have_identity = 1;
-}
-
-static Key *
-load_identity(char *filename)
-{
-	char *pass;
-	Key *prv;
-
-	prv = key_load_private(filename, "", NULL);
-	if (prv == NULL) {
-		if (identity_passphrase)
-			pass = xstrdup(identity_passphrase);
-		else
-			pass = read_passphrase("Enter passphrase: ",
-			    RP_ALLOW_STDIN);
-		prv = key_load_private(filename, pass, NULL);
-		memset(pass, 0, strlen(pass));
-		xfree(pass);
-	}
-	return prv;
-}
-
-#define SSH_COM_PUBLIC_BEGIN		"---- BEGIN SSH2 PUBLIC KEY ----"
-#define SSH_COM_PUBLIC_END		"---- END SSH2 PUBLIC KEY ----"
-#define SSH_COM_PRIVATE_BEGIN		"---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----"
-#define	SSH_COM_PRIVATE_KEY_MAGIC	0x3f6ff9eb
-
-static void
-do_convert_to_ssh2(struct passwd *pw)
-{
-	Key *k;
-	u_int len;
-	u_char *blob;
-	struct stat st;
-
-	if (!have_identity)
-		ask_filename(pw, "Enter file in which the key is");
-	if (stat(identity_file, &st) < 0) {
-		perror(identity_file);
-		exit(1);
-	}
-	if ((k = key_load_public(identity_file, NULL)) == NULL) {
-		if ((k = load_identity(identity_file)) == NULL) {
-			fprintf(stderr, "load failed\n");
-			exit(1);
-		}
-	}
-	if (key_to_blob(k, &blob, &len) <= 0) {
-		fprintf(stderr, "key_to_blob failed\n");
-		exit(1);
-	}
-	fprintf(stdout, "%s\n", SSH_COM_PUBLIC_BEGIN);
-	fprintf(stdout,
-	    "Comment: \"%u-bit %s, converted from OpenSSH by %s@%s\"\n",
-	    key_size(k), key_type(k),
-	    pw->pw_name, hostname);
-	dump_base64(stdout, blob, len);
-	fprintf(stdout, "%s\n", SSH_COM_PUBLIC_END);
-	key_free(k);
-	xfree(blob);
-	exit(0);
-}
-
-static void
-buffer_get_bignum_bits(Buffer *b, BIGNUM *value)
-{
-	int bits = buffer_get_int(b);
-	int bytes = (bits + 7) / 8;
-
-	if (buffer_len(b) < bytes)
-		fatal("buffer_get_bignum_bits: input buffer too small: "
-		    "need %d have %d", bytes, buffer_len(b));
-	BN_bin2bn(buffer_ptr(b), bytes, value);
-	buffer_consume(b, bytes);
-}
-
-static Key *
-do_convert_private_ssh2_from_blob(u_char *blob, u_int blen)
-{
-	Buffer b;
-	Key *key = NULL;
-	char *type, *cipher;
-	u_char *sig, data[] = "abcde12345";
-	int magic, rlen, ktype, i1, i2, i3, i4;
-	u_int slen;
-	u_long e;
-
-	buffer_init(&b);
-	buffer_append(&b, blob, blen);
-
-	magic  = buffer_get_int(&b);
-	if (magic != SSH_COM_PRIVATE_KEY_MAGIC) {
-		error("bad magic 0x%x != 0x%x", magic, SSH_COM_PRIVATE_KEY_MAGIC);
-		buffer_free(&b);
-		return NULL;
-	}
-	i1 = buffer_get_int(&b);
-	type   = buffer_get_string(&b, NULL);
-	cipher = buffer_get_string(&b, NULL);
-	i2 = buffer_get_int(&b);
-	i3 = buffer_get_int(&b);
-	i4 = buffer_get_int(&b);
-	debug("ignore (%d %d %d %d)", i1,i2,i3,i4);
-	if (strcmp(cipher, "none") != 0) {
-		error("unsupported cipher %s", cipher);
-		xfree(cipher);
-		buffer_free(&b);
-		xfree(type);
-		return NULL;
-	}
-	xfree(cipher);
-
-	if (strstr(type, "dsa")) {
-		ktype = KEY_DSA;
-	} else if (strstr(type, "rsa")) {
-		ktype = KEY_RSA;
-	} else {
-		xfree(type);
-		return NULL;
-	}
-	key = key_new_private(ktype);
-	xfree(type);
-
-	switch (key->type) {
-	case KEY_DSA:
-		buffer_get_bignum_bits(&b, key->dsa->p);
-		buffer_get_bignum_bits(&b, key->dsa->g);
-		buffer_get_bignum_bits(&b, key->dsa->q);
-		buffer_get_bignum_bits(&b, key->dsa->pub_key);
-		buffer_get_bignum_bits(&b, key->dsa->priv_key);
-		break;
-	case KEY_RSA:
-		e  = buffer_get_char(&b);
-		debug("e %lx", e);
-		if (e < 30) {
-			e <<= 8;
-			e += buffer_get_char(&b);
-			debug("e %lx", e);
-			e <<= 8;
-			e += buffer_get_char(&b);
-			debug("e %lx", e);
-		}
-		if (!BN_set_word(key->rsa->e, e)) {
-			buffer_free(&b);
-			key_free(key);
-			return NULL;
-		}
-		buffer_get_bignum_bits(&b, key->rsa->d);
-		buffer_get_bignum_bits(&b, key->rsa->n);
-		buffer_get_bignum_bits(&b, key->rsa->iqmp);
-		buffer_get_bignum_bits(&b, key->rsa->q);
-		buffer_get_bignum_bits(&b, key->rsa->p);
-		rsa_generate_additional_parameters(key->rsa);
-		break;
-	}
-	rlen = buffer_len(&b);
-	if (rlen != 0)
-		error("do_convert_private_ssh2_from_blob: "
-		    "remaining bytes in key blob %d", rlen);
-	buffer_free(&b);
-
-	/* try the key */
-	key_sign(key, &sig, &slen, data, sizeof(data));
-	key_verify(key, sig, slen, data, sizeof(data));
-	xfree(sig);
-	return key;
-}
-
-static void
-do_convert_from_ssh2(struct passwd *pw)
-{
-	Key *k;
-	int blen;
-	u_int len;
-	char line[1024], *p;
-	u_char blob[8096];
-	char encoded[8096];
-	struct stat st;
-	int escaped = 0, private = 0, ok;
-	FILE *fp;
-
-	if (!have_identity)
-		ask_filename(pw, "Enter file in which the key is");
-	if (stat(identity_file, &st) < 0) {
-		perror(identity_file);
-		exit(1);
-	}
-	fp = fopen(identity_file, "r");
-	if (fp == NULL) {
-		perror(identity_file);
-		exit(1);
-	}
-	encoded[0] = '\0';
-	while (fgets(line, sizeof(line), fp)) {
-		if (!(p = strchr(line, '\n'))) {
-			fprintf(stderr, "input line too long.\n");
-			exit(1);
-		}
-		if (p > line && p[-1] == '\\')
-			escaped++;
-		if (strncmp(line, "----", 4) == 0 ||
-		    strstr(line, ": ") != NULL) {
-			if (strstr(line, SSH_COM_PRIVATE_BEGIN) != NULL)
-				private = 1;
-			if (strstr(line, " END ") != NULL) {
-				break;
-			}
-			/* fprintf(stderr, "ignore: %s", line); */
-			continue;
-		}
-		if (escaped) {
-			escaped--;
-			/* fprintf(stderr, "escaped: %s", line); */
-			continue;
-		}
-		*p = '\0';
-		strlcat(encoded, line, sizeof(encoded));
-	}
-	len = strlen(encoded);
-	if (((len % 4) == 3) &&
-	    (encoded[len-1] == '=') &&
-	    (encoded[len-2] == '=') &&
-	    (encoded[len-3] == '='))
-		encoded[len-3] = '\0';
-	blen = uudecode(encoded, blob, sizeof(blob));
-	if (blen < 0) {
-		fprintf(stderr, "uudecode failed.\n");
-		exit(1);
-	}
-	k = private ?
-	    do_convert_private_ssh2_from_blob(blob, blen) :
-	    key_from_blob(blob, blen);
-	if (k == NULL) {
-		fprintf(stderr, "decode blob failed.\n");
-		exit(1);
-	}
-	ok = private ?
-	    (k->type == KEY_DSA ?
-		 PEM_write_DSAPrivateKey(stdout, k->dsa, NULL, NULL, 0, NULL, NULL) :
-		 PEM_write_RSAPrivateKey(stdout, k->rsa, NULL, NULL, 0, NULL, NULL)) :
-	    key_write(k, stdout);
-	if (!ok) {
-		fprintf(stderr, "key write failed");
-		exit(1);
-	}
-	key_free(k);
-	if (!private)
-		fprintf(stdout, "\n");
-	fclose(fp);
-	exit(0);
-}
-
-static void
-do_print_public(struct passwd *pw)
-{
-	Key *prv;
-	struct stat st;
-
-	if (!have_identity)
-		ask_filename(pw, "Enter file in which the key is");
-	if (stat(identity_file, &st) < 0) {
-		perror(identity_file);
-		exit(1);
-	}
-	prv = load_identity(identity_file);
-	if (prv == NULL) {
-		fprintf(stderr, "load failed\n");
-		exit(1);
-	}
-	if (!key_write(prv, stdout))
-		fprintf(stderr, "key_write failed");
-	key_free(prv);
-	fprintf(stdout, "\n");
-	exit(0);
-}
-
-#ifdef SMARTCARD
-static void
-do_upload(struct passwd *pw, const char *sc_reader_id)
-{
-	Key *prv = NULL;
-	struct stat st;
-	int ret;
-
-	if (!have_identity)
-		ask_filename(pw, "Enter file in which the key is");
-	if (stat(identity_file, &st) < 0) {
-		perror(identity_file);
-		exit(1);
-	}
-	prv = load_identity(identity_file);
-	if (prv == NULL) {
-		error("load failed");
-		exit(1);
-	}
-	ret = sc_put_key(prv, sc_reader_id);
-	key_free(prv);
-	if (ret < 0)
-		exit(1);
-	log("loading key done");
-	exit(0);
-}
-
-static void
-do_download(struct passwd *pw, const char *sc_reader_id)
-{
-	Key **keys = NULL;
-	int i;
-
-	keys = sc_get_keys(sc_reader_id, NULL);
-	if (keys == NULL)
-		fatal("cannot read public key from smartcard");
-	for (i = 0; keys[i]; i++) {
-		key_write(keys[i], stdout);
-		key_free(keys[i]);
-		fprintf(stdout, "\n");
-	}
-	xfree(keys);
-	exit(0);
-}
-#endif /* SMARTCARD */
-
-static void
-do_fingerprint(struct passwd *pw)
-{
-	FILE *f;
-	Key *public;
-	char *comment = NULL, *cp, *ep, line[16*1024], *fp;
-	int i, skip = 0, num = 1, invalid = 1;
-	enum fp_rep rep;
-	enum fp_type fptype;
-	struct stat st;
-
-	fptype = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5;
-	rep =    print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX;
-
-	if (!have_identity)
-		ask_filename(pw, "Enter file in which the key is");
-	if (stat(identity_file, &st) < 0) {
-		perror(identity_file);
-		exit(1);
-	}
-	public = key_load_public(identity_file, &comment);
-	if (public != NULL) {
-		fp = key_fingerprint(public, fptype, rep);
-		printf("%u %s %s\n", key_size(public), fp, comment);
-		key_free(public);
-		xfree(comment);
-		xfree(fp);
-		exit(0);
-	}
-	if (comment)
-		xfree(comment);
-
-	f = fopen(identity_file, "r");
-	if (f != NULL) {
-		while (fgets(line, sizeof(line), f)) {
-			i = strlen(line) - 1;
-			if (line[i] != '\n') {
-				error("line %d too long: %.40s...", num, line);
-				skip = 1;
-				continue;
-			}
-			num++;
-			if (skip) {
-				skip = 0;
-				continue;
-			}
-			line[i] = '\0';
-
-			/* Skip leading whitespace, empty and comment lines. */
-			for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
-				;
-			if (!*cp || *cp == '\n' || *cp == '#')
-				continue ;
-			i = strtol(cp, &ep, 10);
-			if (i == 0 || ep == NULL || (*ep != ' ' && *ep != '\t')) {
-				int quoted = 0;
-				comment = cp;
-				for (; *cp && (quoted || (*cp != ' ' &&
-				    *cp != '\t')); cp++) {
-					if (*cp == '\\' && cp[1] == '"')
-						cp++;	/* Skip both */
-					else if (*cp == '"')
-						quoted = !quoted;
-				}
-				if (!*cp)
-					continue;
-				*cp++ = '\0';
-			}
-			ep = cp;
-			public = key_new(KEY_RSA1);
-			if (key_read(public, &cp) != 1) {
-				cp = ep;
-				key_free(public);
-				public = key_new(KEY_UNSPEC);
-				if (key_read(public, &cp) != 1) {
-					key_free(public);
-					continue;
-				}
-			}
-			comment = *cp ? cp : comment;
-			fp = key_fingerprint(public, fptype, rep);
-			printf("%u %s %s\n", key_size(public), fp,
-			    comment ? comment : "no comment");
-			xfree(fp);
-			key_free(public);
-			invalid = 0;
-		}
-		fclose(f);
-	}
-	if (invalid) {
-		printf("%s is not a public key file.\n", identity_file);
-		exit(1);
-	}
-	exit(0);
-}
-
-/*
- * Perform changing a passphrase.  The argument is the passwd structure
- * for the current user.
- */
-static void
-do_change_passphrase(struct passwd *pw)
-{
-	char *comment;
-	char *old_passphrase, *passphrase1, *passphrase2;
-	struct stat st;
-	Key *private;
-
-	if (!have_identity)
-		ask_filename(pw, "Enter file in which the key is");
-	if (stat(identity_file, &st) < 0) {
-		perror(identity_file);
-		exit(1);
-	}
-	/* Try to load the file with empty passphrase. */
-	private = key_load_private(identity_file, "", &comment);
-	if (private == NULL) {
-		if (identity_passphrase)
-			old_passphrase = xstrdup(identity_passphrase);
-		else
-			old_passphrase =
-			    read_passphrase("Enter old passphrase: ",
-			    RP_ALLOW_STDIN);
-		private = key_load_private(identity_file, old_passphrase,
-		    &comment);
-		memset(old_passphrase, 0, strlen(old_passphrase));
-		xfree(old_passphrase);
-		if (private == NULL) {
-			printf("Bad passphrase.\n");
-			exit(1);
-		}
-	}
-	printf("Key has comment '%s'\n", comment);
-
-	/* Ask the new passphrase (twice). */
-	if (identity_new_passphrase) {
-		passphrase1 = xstrdup(identity_new_passphrase);
-		passphrase2 = NULL;
-	} else {
-		passphrase1 =
-			read_passphrase("Enter new passphrase (empty for no "
-			    "passphrase): ", RP_ALLOW_STDIN);
-		passphrase2 = read_passphrase("Enter same passphrase again: ",
-		    RP_ALLOW_STDIN);
-
-		/* Verify that they are the same. */
-		if (strcmp(passphrase1, passphrase2) != 0) {
-			memset(passphrase1, 0, strlen(passphrase1));
-			memset(passphrase2, 0, strlen(passphrase2));
-			xfree(passphrase1);
-			xfree(passphrase2);
-			printf("Pass phrases do not match.  Try again.\n");
-			exit(1);
-		}
-		/* Destroy the other copy. */
-		memset(passphrase2, 0, strlen(passphrase2));
-		xfree(passphrase2);
-	}
-
-	/* Save the file using the new passphrase. */
-	if (!key_save_private(private, identity_file, passphrase1, comment)) {
-		printf("Saving the key failed: %s.\n", identity_file);
-		memset(passphrase1, 0, strlen(passphrase1));
-		xfree(passphrase1);
-		key_free(private);
-		xfree(comment);
-		exit(1);
-	}
-	/* Destroy the passphrase and the copy of the key in memory. */
-	memset(passphrase1, 0, strlen(passphrase1));
-	xfree(passphrase1);
-	key_free(private);		 /* Destroys contents */
-	xfree(comment);
-
-	printf("Your identification has been saved with the new passphrase.\n");
-	exit(0);
-}
-
-/*
- * Change the comment of a private key file.
- */
-static void
-do_change_comment(struct passwd *pw)
-{
-	char new_comment[1024], *comment, *passphrase;
-	Key *private;
-	Key *public;
-	struct stat st;
-	FILE *f;
-	int fd;
-
-	if (!have_identity)
-		ask_filename(pw, "Enter file in which the key is");
-	if (stat(identity_file, &st) < 0) {
-		perror(identity_file);
-		exit(1);
-	}
-	private = key_load_private(identity_file, "", &comment);
-	if (private == NULL) {
-		if (identity_passphrase)
-			passphrase = xstrdup(identity_passphrase);
-		else if (identity_new_passphrase)
-			passphrase = xstrdup(identity_new_passphrase);
-		else
-			passphrase = read_passphrase("Enter passphrase: ",
-			    RP_ALLOW_STDIN);
-		/* Try to load using the passphrase. */
-		private = key_load_private(identity_file, passphrase, &comment);
-		if (private == NULL) {
-			memset(passphrase, 0, strlen(passphrase));
-			xfree(passphrase);
-			printf("Bad passphrase.\n");
-			exit(1);
-		}
-	} else {
-		passphrase = xstrdup("");
-	}
-	if (private->type != KEY_RSA1) {
-		fprintf(stderr, "Comments are only supported for RSA1 keys.\n");
-		key_free(private);
-		exit(1);
-	}
-	printf("Key now has comment '%s'\n", comment);
-
-	if (identity_comment) {
-		strlcpy(new_comment, identity_comment, sizeof(new_comment));
-	} else {
-		printf("Enter new comment: ");
-		fflush(stdout);
-		if (!fgets(new_comment, sizeof(new_comment), stdin)) {
-			memset(passphrase, 0, strlen(passphrase));
-			key_free(private);
-			exit(1);
-		}
-		if (strchr(new_comment, '\n'))
-			*strchr(new_comment, '\n') = 0;
-	}
-
-	/* Save the file using the new passphrase. */
-	if (!key_save_private(private, identity_file, passphrase, new_comment)) {
-		printf("Saving the key failed: %s.\n", identity_file);
-		memset(passphrase, 0, strlen(passphrase));
-		xfree(passphrase);
-		key_free(private);
-		xfree(comment);
-		exit(1);
-	}
-	memset(passphrase, 0, strlen(passphrase));
-	xfree(passphrase);
-	public = key_from_private(private);
-	key_free(private);
-
-	strlcat(identity_file, ".pub", sizeof(identity_file));
-	fd = open(identity_file, O_WRONLY | O_CREAT | O_TRUNC, 0644);
-	if (fd == -1) {
-		printf("Could not save your public key in %s\n", identity_file);
-		exit(1);
-	}
-	f = fdopen(fd, "w");
-	if (f == NULL) {
-		printf("fdopen %s failed", identity_file);
-		exit(1);
-	}
-	if (!key_write(public, f))
-		fprintf(stderr, "write key failed");
-	key_free(public);
-	fprintf(f, " %s\n", new_comment);
-	fclose(f);
-
-	xfree(comment);
-
-	printf("The comment in your key file has been changed.\n");
-	exit(0);
-}
-
-static void
-usage(void)
-{
-	fprintf(stderr, "Usage: %s [options]\n", __progname);
-	fprintf(stderr, "Options:\n");
-	fprintf(stderr, "  -b bits     Number of bits in the key to create.\n");
-	fprintf(stderr, "  -c          Change comment in private and public key files.\n");
-	fprintf(stderr, "  -e          Convert OpenSSH to IETF SECSH key file.\n");
-	fprintf(stderr, "  -f filename Filename of the key file.\n");
-	fprintf(stderr, "  -i          Convert IETF SECSH to OpenSSH key file.\n");
-	fprintf(stderr, "  -l          Show fingerprint of key file.\n");
-	fprintf(stderr, "  -p          Change passphrase of private key file.\n");
-	fprintf(stderr, "  -q          Quiet.\n");
-	fprintf(stderr, "  -y          Read private key file and print public key.\n");
-	fprintf(stderr, "  -t type     Specify type of key to create.\n");
-	fprintf(stderr, "  -B          Show bubblebabble digest of key file.\n");
-	fprintf(stderr, "  -C comment  Provide new comment.\n");
-	fprintf(stderr, "  -N phrase   Provide new passphrase.\n");
-	fprintf(stderr, "  -P phrase   Provide old passphrase.\n");
-#ifdef SMARTCARD
-	fprintf(stderr, "  -D reader   Download public key from smartcard.\n");
-	fprintf(stderr, "  -U reader   Upload private key to smartcard.\n");
-#endif /* SMARTCARD */
-
-	exit(1);
-}
-
-/*
- * Main program for key management.
- */
-int
-main(int ac, char **av)
-{
-	char dotsshdir[MAXPATHLEN], comment[1024], *passphrase1, *passphrase2;
-	char *reader_id = NULL;
-	Key *private, *public;
-	struct passwd *pw;
-	struct stat st;
-	int opt, type, fd, download = 0;
-	FILE *f;
-
-	extern int optind;
-	extern char *optarg;
-
-	__progname = get_progname(av[0]);
-
-	SSLeay_add_all_algorithms();
-	init_rng();
-	seed_rng();
-
-	/* we need this for the home * directory.  */
-	pw = getpwuid(getuid());
-	if (!pw) {
-		printf("You don't exist, go away!\n");
-		exit(1);
-	}
-	if (gethostname(hostname, sizeof(hostname)) < 0) {
-		perror("gethostname");
-		exit(1);
-	}
-
-	while ((opt = getopt(ac, av, "deiqpclBRxXyb:f:t:U:D:P:N:C:")) != -1) {
-		switch (opt) {
-		case 'b':
-			bits = atoi(optarg);
-			if (bits < 512 || bits > 32768) {
-				printf("Bits has bad value.\n");
-				exit(1);
-			}
-			break;
-		case 'l':
-			print_fingerprint = 1;
-			break;
-		case 'B':
-			print_bubblebabble = 1;
-			break;
-		case 'p':
-			change_passphrase = 1;
-			break;
-		case 'c':
-			change_comment = 1;
-			break;
-		case 'f':
-			strlcpy(identity_file, optarg, sizeof(identity_file));
-			have_identity = 1;
-			break;
-		case 'P':
-			identity_passphrase = optarg;
-			break;
-		case 'N':
-			identity_new_passphrase = optarg;
-			break;
-		case 'C':
-			identity_comment = optarg;
-			break;
-		case 'q':
-			quiet = 1;
-			break;
-		case 'R':
-			/* unused */
-			exit(0);
-			break;
-		case 'e':
-		case 'x':
-			/* export key */
-			convert_to_ssh2 = 1;
-			break;
-		case 'i':
-		case 'X':
-			/* import key */
-			convert_from_ssh2 = 1;
-			break;
-		case 'y':
-			print_public = 1;
-			break;
-		case 'd':
-			key_type_name = "dsa";
-			break;
-		case 't':
-			key_type_name = optarg;
-			break;
-		case 'D':
-			download = 1;
-		case 'U':
-			reader_id = optarg;
-			break;
-		case '?':
-		default:
-			usage();
-		}
-	}
-	if (optind < ac) {
-		printf("Too many arguments.\n");
-		usage();
-	}
-	if (change_passphrase && change_comment) {
-		printf("Can only have one of -p and -c.\n");
-		usage();
-	}
-	if (print_fingerprint || print_bubblebabble)
-		do_fingerprint(pw);
-	if (change_passphrase)
-		do_change_passphrase(pw);
-	if (change_comment)
-		do_change_comment(pw);
-	if (convert_to_ssh2)
-		do_convert_to_ssh2(pw);
-	if (convert_from_ssh2)
-		do_convert_from_ssh2(pw);
-	if (print_public)
-		do_print_public(pw);
-	if (reader_id != NULL) {
-#ifdef SMARTCARD
-		if (download)
-			do_download(pw, reader_id);
-		else
-			do_upload(pw, reader_id);
-#else /* SMARTCARD */
-		fatal("no support for smartcards.");
-#endif /* SMARTCARD */
-	}
-
-	arc4random_stir();
-
-	if (key_type_name == NULL) {
-		printf("You must specify a key type (-t).\n");
-		usage();
-	}
-	type = key_type_from_name(key_type_name);
-	if (type == KEY_UNSPEC) {
-		fprintf(stderr, "unknown key type %s\n", key_type_name);
-		exit(1);
-	}
-	if (!quiet)
-		printf("Generating public/private %s key pair.\n", key_type_name);
-	private = key_generate(type, bits);
-	if (private == NULL) {
-		fprintf(stderr, "key_generate failed");
-		exit(1);
-	}
-	public  = key_from_private(private);
-
-	if (!have_identity)
-		ask_filename(pw, "Enter file in which to save the key");
-
-	/* Create ~/.ssh directory if it doesn\'t already exist. */
-	snprintf(dotsshdir, sizeof dotsshdir, "%s/%s", pw->pw_dir, _PATH_SSH_USER_DIR);
-	if (strstr(identity_file, dotsshdir) != NULL &&
-	    stat(dotsshdir, &st) < 0) {
-		if (mkdir(dotsshdir, 0700) < 0)
-			error("Could not create directory '%s'.", dotsshdir);
-		else if (!quiet)
-			printf("Created directory '%s'.\n", dotsshdir);
-	}
-	/* If the file already exists, ask the user to confirm. */
-	if (stat(identity_file, &st) >= 0) {
-		char yesno[3];
-		printf("%s already exists.\n", identity_file);
-		printf("Overwrite (y/n)? ");
-		fflush(stdout);
-		if (fgets(yesno, sizeof(yesno), stdin) == NULL)
-			exit(1);
-		if (yesno[0] != 'y' && yesno[0] != 'Y')
-			exit(1);
-	}
-	/* Ask for a passphrase (twice). */
-	if (identity_passphrase)
-		passphrase1 = xstrdup(identity_passphrase);
-	else if (identity_new_passphrase)
-		passphrase1 = xstrdup(identity_new_passphrase);
-	else {
-passphrase_again:
-		passphrase1 =
-			read_passphrase("Enter passphrase (empty for no "
-			    "passphrase): ", RP_ALLOW_STDIN);
-		passphrase2 = read_passphrase("Enter same passphrase again: ",
-		    RP_ALLOW_STDIN);
-		if (strcmp(passphrase1, passphrase2) != 0) {
-			/*
-			 * The passphrases do not match.  Clear them and
-			 * retry.
-			 */
-			memset(passphrase1, 0, strlen(passphrase1));
-			memset(passphrase2, 0, strlen(passphrase2));
-			xfree(passphrase1);
-			xfree(passphrase2);
-			printf("Passphrases do not match.  Try again.\n");
-			goto passphrase_again;
-		}
-		/* Clear the other copy of the passphrase. */
-		memset(passphrase2, 0, strlen(passphrase2));
-		xfree(passphrase2);
-	}
-
-	if (identity_comment) {
-		strlcpy(comment, identity_comment, sizeof(comment));
-	} else {
-		/* Create default commend field for the passphrase. */
-		snprintf(comment, sizeof comment, "%s@%s", pw->pw_name, hostname);
-	}
-
-	/* Save the key with the given passphrase and comment. */
-	if (!key_save_private(private, identity_file, passphrase1, comment)) {
-		printf("Saving the key failed: %s.\n", identity_file);
-		memset(passphrase1, 0, strlen(passphrase1));
-		xfree(passphrase1);
-		exit(1);
-	}
-	/* Clear the passphrase. */
-	memset(passphrase1, 0, strlen(passphrase1));
-	xfree(passphrase1);
-
-	/* Clear the private key and the random number generator. */
-	key_free(private);
-	arc4random_stir();
-
-	if (!quiet)
-		printf("Your identification has been saved in %s.\n", identity_file);
-
-	strlcat(identity_file, ".pub", sizeof(identity_file));
-	fd = open(identity_file, O_WRONLY | O_CREAT | O_TRUNC, 0644);
-	if (fd == -1) {
-		printf("Could not save your public key in %s\n", identity_file);
-		exit(1);
-	}
-	f = fdopen(fd, "w");
-	if (f == NULL) {
-		printf("fdopen %s failed", identity_file);
-		exit(1);
-	}
-	if (!key_write(public, f))
-		fprintf(stderr, "write key failed");
-	fprintf(f, " %s\n", comment);
-	fclose(f);
-
-	if (!quiet) {
-		char *fp = key_fingerprint(public, SSH_FP_MD5, SSH_FP_HEX);
-		printf("Your public key has been saved in %s.\n",
-		    identity_file);
-		printf("The key fingerprint is:\n");
-		printf("%s %s\n", fp, comment);
-		xfree(fp);
-	}
-
-	key_free(public);
-	exit(0);
-}
diff --git a/crypto/openssh/ssh-keygen/Makefile b/crypto/openssh/ssh-keygen/Makefile
deleted file mode 100644
index d175813bc0cb..000000000000
--- a/crypto/openssh/ssh-keygen/Makefile
+++ /dev/null
@@ -1,18 +0,0 @@
-#	$OpenBSD: Makefile,v 1.21 2001/06/27 19:29:16 markus Exp $
-
-.PATH:		${.CURDIR}/..
-
-PROG=	ssh-keygen
-BINOWN=	root
-
-BINMODE?=555
-
-BINDIR=	/usr/bin
-MAN=	ssh-keygen.1
-
-SRCS=	ssh-keygen.c
-
-.include <bsd.prog.mk>
-
-LDADD+=	-lcrypto
-DPADD+=	${LIBCRYPTO}
diff --git a/crypto/openssh/ssh-keyscan.1 b/crypto/openssh/ssh-keyscan.1
deleted file mode 100644
index f6596c481314..000000000000
--- a/crypto/openssh/ssh-keyscan.1
+++ /dev/null
@@ -1,160 +0,0 @@
-.\"	$OpenBSD: ssh-keyscan.1,v 1.15 2003/03/28 10:11:43 jmc Exp $
-.\"
-.\" Copyright 1995, 1996 by David Mazieres <dm@lcs.mit.edu>.
-.\"
-.\" Modification and redistribution in source and binary forms is
-.\" permitted provided that due credit is given to the author and the
-.\" OpenBSD project by leaving this copyright notice intact.
-.\"
-.Dd January 1, 1996
-.Dt SSH-KEYSCAN 1
-.Os
-.Sh NAME
-.Nm ssh-keyscan
-.Nd gather ssh public keys
-.Sh SYNOPSIS
-.Nm ssh-keyscan
-.Bk -words
-.Op Fl v46
-.Op Fl p Ar port
-.Op Fl T Ar timeout
-.Op Fl t Ar type
-.Op Fl f Ar file
-.Op Ar host | addrlist namelist
-.Op Ar ...
-.Ek
-.Sh DESCRIPTION
-.Nm
-is a utility for gathering the public ssh host keys of a number of
-hosts.
-It was designed to aid in building and verifying
-.Pa ssh_known_hosts
-files.
-.Nm
-provides a minimal interface suitable for use by shell and perl
-scripts.
-.Pp
-.Nm
-uses non-blocking socket I/O to contact as many hosts as possible in
-parallel, so it is very efficient.
-The keys from a domain of 1,000
-hosts can be collected in tens of seconds, even when some of those
-hosts are down or do not run ssh.
-For scanning, one does not need
-login access to the machines that are being scanned, nor does the
-scanning process involve any encryption.
-.Pp
-The options are as follows:
-.Bl -tag -width Ds
-.It Fl p Ar port
-Port to connect to on the remote host.
-.It Fl T Ar timeout
-Set the timeout for connection attempts.
-If
-.Pa timeout
-seconds have elapsed since a connection was initiated to a host or since the
-last time anything was read from that host, then the connection is
-closed and the host in question considered unavailable.
-Default is 5 seconds.
-.It Fl t Ar type
-Specifies the type of the key to fetch from the scanned hosts.
-The possible values are
-.Dq rsa1
-for protocol version 1 and
-.Dq rsa
-or
-.Dq dsa
-for protocol version 2.
-Multiple values may be specified by separating them with commas.
-The default is
-.Dq rsa1 .
-.It Fl f Ar filename
-Read hosts or
-.Pa addrlist namelist
-pairs from this file, one per line.
-If
-.Pa -
-is supplied instead of a filename,
-.Nm
-will read hosts or
-.Pa addrlist namelist
-pairs from the standard input.
-.It Fl v
-Verbose mode.
-Causes
-.Nm
-to print debugging messages about its progress.
-.It Fl 4
-Forces
-.Nm
-to use IPv4 addresses only.
-.It Fl 6
-Forces
-.Nm
-to use IPv6 addresses only.
-.El
-.Sh SECURITY
-If a ssh_known_hosts file is constructed using
-.Nm
-without verifying the keys, users will be vulnerable to
-.I man in the middle
-attacks.
-On the other hand, if the security model allows such a risk,
-.Nm
-can help in the detection of tampered keyfiles or man in the middle
-attacks which have begun after the ssh_known_hosts file was created.
-.Sh EXAMPLES
-.Pp
-Print the
-.Pa rsa1
-host key for machine
-.Pa hostname :
-.Bd -literal
-$ ssh-keyscan hostname
-.Ed
-.Pp
-Find all hosts from the file
-.Pa ssh_hosts
-which have new or different keys from those in the sorted file
-.Pa ssh_known_hosts :
-.Bd -literal
-$ ssh-keyscan -t rsa,dsa -f ssh_hosts | \e\ 
-	sort -u - ssh_known_hosts | diff ssh_known_hosts -
-.Ed
-.Sh FILES
-.Pa Input format:
-.Bd -literal
-1.2.3.4,1.2.4.4 name.my.domain,name,n.my.domain,n,1.2.3.4,1.2.4.4
-.Ed
-.Pp
-.Pa Output format for rsa1 keys:
-.Bd -literal
-host-or-namelist bits exponent modulus
-.Ed
-.Pp
-.Pa Output format for rsa and dsa keys:
-.Bd -literal
-host-or-namelist keytype base64-encoded-key
-.Ed
-.Pp
-Where
-.Pa keytype
-is either
-.Dq ssh-rsa
-or
-.Dq ssh-dsa .
-.Pp
-.Pa /etc/ssh/ssh_known_hosts
-.Sh BUGS
-It generates "Connection closed by remote host" messages on the consoles
-of all the machines it scans if the server is older than version 2.9.
-This is because it opens a connection to the ssh port, reads the public
-key, and drops the connection as soon as it gets the key.
-.Sh SEE ALSO
-.Xr ssh 1 ,
-.Xr sshd 8
-.Sh AUTHORS
-David Mazieres <dm@lcs.mit.edu>
-wrote the initial version, and
-Wayne Davison <wayned@users.sourceforge.net>
-added support for protocol version 2.
diff --git a/crypto/openssh/ssh-keyscan.c b/crypto/openssh/ssh-keyscan.c
deleted file mode 100644
index 5b4eb82d1fc0..000000000000
--- a/crypto/openssh/ssh-keyscan.c
+++ /dev/null
@@ -1,818 +0,0 @@
-/*
- * Copyright 1995, 1996 by David Mazieres <dm@lcs.mit.edu>.
- *
- * Modification and redistribution in source and binary forms is
- * permitted provided that due credit is given to the author and the
- * OpenBSD project by leaving this copyright notice intact.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: ssh-keyscan.c,v 1.41 2003/02/16 17:09:57 markus Exp $");
-
-#include "openbsd-compat/sys-queue.h"
-
-#include <openssl/bn.h>
-
-#include <setjmp.h>
-#include "xmalloc.h"
-#include "ssh.h"
-#include "ssh1.h"
-#include "key.h"
-#include "kex.h"
-#include "compat.h"
-#include "myproposal.h"
-#include "packet.h"
-#include "dispatch.h"
-#include "buffer.h"
-#include "bufaux.h"
-#include "log.h"
-#include "atomicio.h"
-#include "misc.h"
-
-/* Flag indicating whether IPv4 or IPv6.  This can be set on the command line.
-   Default value is AF_UNSPEC means both IPv4 and IPv6. */
-#ifdef IPV4_DEFAULT
-int IPv4or6 = AF_INET;
-#else
-int IPv4or6 = AF_UNSPEC;
-#endif
-
-int ssh_port = SSH_DEFAULT_PORT;
-
-#define KT_RSA1	1
-#define KT_DSA	2
-#define KT_RSA	4
-
-int get_keytypes = KT_RSA1;	/* Get only RSA1 keys by default */
-
-#define MAXMAXFD 256
-
-/* The number of seconds after which to give up on a TCP connection */
-int timeout = 5;
-
-int maxfd;
-#define MAXCON (maxfd - 10)
-
-#ifdef HAVE___PROGNAME
-extern char *__progname;
-#else
-char *__progname;
-#endif
-fd_set *read_wait;
-size_t read_wait_size;
-int ncon;
-int nonfatal_fatal = 0;
-jmp_buf kexjmp;
-Key *kexjmp_key;
-
-/*
- * Keep a connection structure for each file descriptor.  The state
- * associated with file descriptor n is held in fdcon[n].
- */
-typedef struct Connection {
-	u_char c_status;	/* State of connection on this file desc. */
-#define CS_UNUSED 0		/* File descriptor unused */
-#define CS_CON 1		/* Waiting to connect/read greeting */
-#define CS_SIZE 2		/* Waiting to read initial packet size */
-#define CS_KEYS 3		/* Waiting to read public key packet */
-	int c_fd;		/* Quick lookup: c->c_fd == c - fdcon */
-	int c_plen;		/* Packet length field for ssh packet */
-	int c_len;		/* Total bytes which must be read. */
-	int c_off;		/* Length of data read so far. */
-	int c_keytype;		/* Only one of KT_RSA1, KT_DSA, or KT_RSA */
-	char *c_namebase;	/* Address to free for c_name and c_namelist */
-	char *c_name;		/* Hostname of connection for errors */
-	char *c_namelist;	/* Pointer to other possible addresses */
-	char *c_output_name;	/* Hostname of connection for output */
-	char *c_data;		/* Data read from this fd */
-	Kex *c_kex;		/* The key-exchange struct for ssh2 */
-	struct timeval c_tv;	/* Time at which connection gets aborted */
-	TAILQ_ENTRY(Connection) c_link;	/* List of connections in timeout order. */
-} con;
-
-TAILQ_HEAD(conlist, Connection) tq;	/* Timeout Queue */
-con *fdcon;
-
-/*
- *  This is just a wrapper around fgets() to make it usable.
- */
-
-/* Stress-test.  Increase this later. */
-#define LINEBUF_SIZE 16
-
-typedef struct {
-	char *buf;
-	u_int size;
-	int lineno;
-	const char *filename;
-	FILE *stream;
-	void (*errfun) (const char *,...);
-} Linebuf;
-
-static Linebuf *
-Linebuf_alloc(const char *filename, void (*errfun) (const char *,...))
-{
-	Linebuf *lb;
-
-	if (!(lb = malloc(sizeof(*lb)))) {
-		if (errfun)
-			(*errfun) ("linebuf (%s): malloc failed\n",
-			    filename ? filename : "(stdin)");
-		return (NULL);
-	}
-	if (filename) {
-		lb->filename = filename;
-		if (!(lb->stream = fopen(filename, "r"))) {
-			xfree(lb);
-			if (errfun)
-				(*errfun) ("%s: %s\n", filename, strerror(errno));
-			return (NULL);
-		}
-	} else {
-		lb->filename = "(stdin)";
-		lb->stream = stdin;
-	}
-
-	if (!(lb->buf = malloc(lb->size = LINEBUF_SIZE))) {
-		if (errfun)
-			(*errfun) ("linebuf (%s): malloc failed\n", lb->filename);
-		xfree(lb);
-		return (NULL);
-	}
-	lb->errfun = errfun;
-	lb->lineno = 0;
-	return (lb);
-}
-
-static void
-Linebuf_free(Linebuf * lb)
-{
-	fclose(lb->stream);
-	xfree(lb->buf);
-	xfree(lb);
-}
-
-#if 0
-static void
-Linebuf_restart(Linebuf * lb)
-{
-	clearerr(lb->stream);
-	rewind(lb->stream);
-	lb->lineno = 0;
-}
-
-static int
-Linebuf_lineno(Linebuf * lb)
-{
-	return (lb->lineno);
-}
-#endif
-
-static char *
-Linebuf_getline(Linebuf * lb)
-{
-	int n = 0;
-	void *p;
-
-	lb->lineno++;
-	for (;;) {
-		/* Read a line */
-		if (!fgets(&lb->buf[n], lb->size - n, lb->stream)) {
-			if (ferror(lb->stream) && lb->errfun)
-				(*lb->errfun)("%s: %s\n", lb->filename,
-				    strerror(errno));
-			return (NULL);
-		}
-		n = strlen(lb->buf);
-
-		/* Return it or an error if it fits */
-		if (n > 0 && lb->buf[n - 1] == '\n') {
-			lb->buf[n - 1] = '\0';
-			return (lb->buf);
-		}
-		if (n != lb->size - 1) {
-			if (lb->errfun)
-				(*lb->errfun)("%s: skipping incomplete last line\n",
-				    lb->filename);
-			return (NULL);
-		}
-		/* Double the buffer if we need more space */
-		lb->size *= 2;
-		if ((p = realloc(lb->buf, lb->size)) == NULL) {
-			lb->size /= 2;
-			if (lb->errfun)
-				(*lb->errfun)("linebuf (%s): realloc failed\n",
-				    lb->filename);
-			return (NULL);
-		}
-		lb->buf = p;
-	}
-}
-
-static int
-fdlim_get(int hard)
-{
-#if defined(HAVE_GETRLIMIT) && defined(RLIMIT_NOFILE)
-	struct rlimit rlfd;
-
-	if (getrlimit(RLIMIT_NOFILE, &rlfd) < 0)
-		return (-1);
-	if ((hard ? rlfd.rlim_max : rlfd.rlim_cur) == RLIM_INFINITY)
-		return 10000;
-	else
-		return hard ? rlfd.rlim_max : rlfd.rlim_cur;
-#elif defined (HAVE_SYSCONF)
-	return sysconf (_SC_OPEN_MAX);
-#else
-	return 10000;
-#endif
-}
-
-static int
-fdlim_set(int lim)
-{
-#if defined(HAVE_SETRLIMIT) && defined(RLIMIT_NOFILE)
-	struct rlimit rlfd;
-#endif
-
-	if (lim <= 0)
-		return (-1);
-#if defined(HAVE_SETRLIMIT) && defined(RLIMIT_NOFILE)
-	if (getrlimit(RLIMIT_NOFILE, &rlfd) < 0)
-		return (-1);
-	rlfd.rlim_cur = lim;
-	if (setrlimit(RLIMIT_NOFILE, &rlfd) < 0)
-		return (-1);
-#elif defined (HAVE_SETDTABLESIZE)
-	setdtablesize(lim);
-#endif
-	return (0);
-}
-
-/*
- * This is an strsep function that returns a null field for adjacent
- * separators.  This is the same as the 4.4BSD strsep, but different from the
- * one in the GNU libc.
- */
-static char *
-xstrsep(char **str, const char *delim)
-{
-	char *s, *e;
-
-	if (!**str)
-		return (NULL);
-
-	s = *str;
-	e = s + strcspn(s, delim);
-
-	if (*e != '\0')
-		*e++ = '\0';
-	*str = e;
-
-	return (s);
-}
-
-/*
- * Get the next non-null token (like GNU strsep).  Strsep() will return a
- * null token for two adjacent separators, so we may have to loop.
- */
-static char *
-strnnsep(char **stringp, char *delim)
-{
-	char *tok;
-
-	do {
-		tok = xstrsep(stringp, delim);
-	} while (tok && *tok == '\0');
-	return (tok);
-}
-
-static Key *
-keygrab_ssh1(con *c)
-{
-	static Key *rsa;
-	static Buffer msg;
-
-	if (rsa == NULL) {
-		buffer_init(&msg);
-		rsa = key_new(KEY_RSA1);
-	}
-	buffer_append(&msg, c->c_data, c->c_plen);
-	buffer_consume(&msg, 8 - (c->c_plen & 7));	/* padding */
-	if (buffer_get_char(&msg) != (int) SSH_SMSG_PUBLIC_KEY) {
-		error("%s: invalid packet type", c->c_name);
-		buffer_clear(&msg);
-		return NULL;
-	}
-	buffer_consume(&msg, 8);		/* cookie */
-
-	/* server key */
-	(void) buffer_get_int(&msg);
-	buffer_get_bignum(&msg, rsa->rsa->e);
-	buffer_get_bignum(&msg, rsa->rsa->n);
-
-	/* host key */
-	(void) buffer_get_int(&msg);
-	buffer_get_bignum(&msg, rsa->rsa->e);
-	buffer_get_bignum(&msg, rsa->rsa->n);
-
-	buffer_clear(&msg);
-
-	return (rsa);
-}
-
-static int
-hostjump(Key *hostkey)
-{
-	kexjmp_key = hostkey;
-	longjmp(kexjmp, 1);
-}
-
-static int
-ssh2_capable(int remote_major, int remote_minor)
-{
-	switch (remote_major) {
-	case 1:
-		if (remote_minor == 99)
-			return 1;
-		break;
-	case 2:
-		return 1;
-	default:
-		break;
-	}
-	return 0;
-}
-
-static Key *
-keygrab_ssh2(con *c)
-{
-	int j;
-
-	packet_set_connection(c->c_fd, c->c_fd);
-	enable_compat20();
-	myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = c->c_keytype == KT_DSA?
-	    "ssh-dss": "ssh-rsa";
-	c->c_kex = kex_setup(myproposal);
-	c->c_kex->kex[KEX_DH_GRP1_SHA1] = kexdh_client;
-	c->c_kex->kex[KEX_DH_GEX_SHA1] = kexgex_client;
-	c->c_kex->verify_host_key = hostjump;
-
-	if (!(j = setjmp(kexjmp))) {
-		nonfatal_fatal = 1;
-		dispatch_run(DISPATCH_BLOCK, &c->c_kex->done, c->c_kex);
-		fprintf(stderr, "Impossible! dispatch_run() returned!\n");
-		exit(1);
-	}
-	nonfatal_fatal = 0;
-	xfree(c->c_kex);
-	c->c_kex = NULL;
-	packet_close();
-
-	return j < 0? NULL : kexjmp_key;
-}
-
-static void
-keyprint(con *c, Key *key)
-{
-	if (!key)
-		return;
-
-	fprintf(stdout, "%s ", c->c_output_name ? c->c_output_name : c->c_name);
-	key_write(key, stdout);
-	fputs("\n", stdout);
-}
-
-static int
-tcpconnect(char *host)
-{
-	struct addrinfo hints, *ai, *aitop;
-	char strport[NI_MAXSERV];
-	int gaierr, s = -1;
-
-	snprintf(strport, sizeof strport, "%d", ssh_port);
-	memset(&hints, 0, sizeof(hints));
-	hints.ai_family = IPv4or6;
-	hints.ai_socktype = SOCK_STREAM;
-	if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0)
-		fatal("getaddrinfo %s: %s", host, gai_strerror(gaierr));
-	for (ai = aitop; ai; ai = ai->ai_next) {
-		s = socket(ai->ai_family, SOCK_STREAM, 0);
-		if (s < 0) {
-			error("socket: %s", strerror(errno));
-			continue;
-		}
-		if (fcntl(s, F_SETFL, O_NONBLOCK) < 0)
-			fatal("F_SETFL: %s", strerror(errno));
-		if (connect(s, ai->ai_addr, ai->ai_addrlen) < 0 &&
-		    errno != EINPROGRESS)
-			error("connect (`%s'): %s", host, strerror(errno));
-		else
-			break;
-		close(s);
-		s = -1;
-	}
-	freeaddrinfo(aitop);
-	return s;
-}
-
-static int
-conalloc(char *iname, char *oname, int keytype)
-{
-	char *namebase, *name, *namelist;
-	int s;
-
-	namebase = namelist = xstrdup(iname);
-
-	do {
-		name = xstrsep(&namelist, ",");
-		if (!name) {
-			xfree(namebase);
-			return (-1);
-		}
-	} while ((s = tcpconnect(name)) < 0);
-
-	if (s >= maxfd)
-		fatal("conalloc: fdno %d too high", s);
-	if (fdcon[s].c_status)
-		fatal("conalloc: attempt to reuse fdno %d", s);
-
-	fdcon[s].c_fd = s;
-	fdcon[s].c_status = CS_CON;
-	fdcon[s].c_namebase = namebase;
-	fdcon[s].c_name = name;
-	fdcon[s].c_namelist = namelist;
-	fdcon[s].c_output_name = xstrdup(oname);
-	fdcon[s].c_data = (char *) &fdcon[s].c_plen;
-	fdcon[s].c_len = 4;
-	fdcon[s].c_off = 0;
-	fdcon[s].c_keytype = keytype;
-	gettimeofday(&fdcon[s].c_tv, NULL);
-	fdcon[s].c_tv.tv_sec += timeout;
-	TAILQ_INSERT_TAIL(&tq, &fdcon[s], c_link);
-	FD_SET(s, read_wait);
-	ncon++;
-	return (s);
-}
-
-static void
-confree(int s)
-{
-	if (s >= maxfd || fdcon[s].c_status == CS_UNUSED)
-		fatal("confree: attempt to free bad fdno %d", s);
-	close(s);
-	xfree(fdcon[s].c_namebase);
-	xfree(fdcon[s].c_output_name);
-	if (fdcon[s].c_status == CS_KEYS)
-		xfree(fdcon[s].c_data);
-	fdcon[s].c_status = CS_UNUSED;
-	fdcon[s].c_keytype = 0;
-	TAILQ_REMOVE(&tq, &fdcon[s], c_link);
-	FD_CLR(s, read_wait);
-	ncon--;
-}
-
-static void
-contouch(int s)
-{
-	TAILQ_REMOVE(&tq, &fdcon[s], c_link);
-	gettimeofday(&fdcon[s].c_tv, NULL);
-	fdcon[s].c_tv.tv_sec += timeout;
-	TAILQ_INSERT_TAIL(&tq, &fdcon[s], c_link);
-}
-
-static int
-conrecycle(int s)
-{
-	con *c = &fdcon[s];
-	int ret;
-
-	ret = conalloc(c->c_namelist, c->c_output_name, c->c_keytype);
-	confree(s);
-	return (ret);
-}
-
-static void
-congreet(int s)
-{
-	int remote_major, remote_minor, n = 0;
-	char buf[256], *cp;
-	char remote_version[sizeof buf];
-	size_t bufsiz;
-	con *c = &fdcon[s];
-
-	bufsiz = sizeof(buf);
-	cp = buf;
-	while (bufsiz-- && (n = read(s, cp, 1)) == 1 && *cp != '\n') {
-		if (*cp == '\r')
-			*cp = '\n';
-		cp++;
-	}
-	if (n < 0) {
-		if (errno != ECONNREFUSED)
-			error("read (%s): %s", c->c_name, strerror(errno));
-		conrecycle(s);
-		return;
-	}
-	if (n == 0) {
-		error("%s: Connection closed by remote host", c->c_name);
-		conrecycle(s);
-		return;
-	}
-	if (*cp != '\n' && *cp != '\r') {
-		error("%s: bad greeting", c->c_name);
-		confree(s);
-		return;
-	}
-	*cp = '\0';
-	if (sscanf(buf, "SSH-%d.%d-%[^\n]\n",
-	    &remote_major, &remote_minor, remote_version) == 3)
-		compat_datafellows(remote_version);
-	else
-		datafellows = 0;
-	if (c->c_keytype != KT_RSA1) {
-		if (!ssh2_capable(remote_major, remote_minor)) {
-			debug("%s doesn't support ssh2", c->c_name);
-			confree(s);
-			return;
-		}
-	} else if (remote_major != 1) {
-		debug("%s doesn't support ssh1", c->c_name);
-		confree(s);
-		return;
-	}
-	fprintf(stderr, "# %s %s\n", c->c_name, chop(buf));
-	n = snprintf(buf, sizeof buf, "SSH-%d.%d-OpenSSH-keyscan\r\n",
-	    c->c_keytype == KT_RSA1? PROTOCOL_MAJOR_1 : PROTOCOL_MAJOR_2,
-	    c->c_keytype == KT_RSA1? PROTOCOL_MINOR_1 : PROTOCOL_MINOR_2);
-	if (atomicio(write, s, buf, n) != n) {
-		error("write (%s): %s", c->c_name, strerror(errno));
-		confree(s);
-		return;
-	}
-	if (c->c_keytype != KT_RSA1) {
-		keyprint(c, keygrab_ssh2(c));
-		confree(s);
-		return;
-	}
-	c->c_status = CS_SIZE;
-	contouch(s);
-}
-
-static void
-conread(int s)
-{
-	con *c = &fdcon[s];
-	int n;
-
-	if (c->c_status == CS_CON) {
-		congreet(s);
-		return;
-	}
-	n = read(s, c->c_data + c->c_off, c->c_len - c->c_off);
-	if (n < 0) {
-		error("read (%s): %s", c->c_name, strerror(errno));
-		confree(s);
-		return;
-	}
-	c->c_off += n;
-
-	if (c->c_off == c->c_len)
-		switch (c->c_status) {
-		case CS_SIZE:
-			c->c_plen = htonl(c->c_plen);
-			c->c_len = c->c_plen + 8 - (c->c_plen & 7);
-			c->c_off = 0;
-			c->c_data = xmalloc(c->c_len);
-			c->c_status = CS_KEYS;
-			break;
-		case CS_KEYS:
-			keyprint(c, keygrab_ssh1(c));
-			confree(s);
-			return;
-			break;
-		default:
-			fatal("conread: invalid status %d", c->c_status);
-			break;
-		}
-
-	contouch(s);
-}
-
-static void
-conloop(void)
-{
-	struct timeval seltime, now;
-	fd_set *r, *e;
-	con *c;
-	int i;
-
-	gettimeofday(&now, NULL);
-	c = TAILQ_FIRST(&tq);
-
-	if (c && (c->c_tv.tv_sec > now.tv_sec ||
-	    (c->c_tv.tv_sec == now.tv_sec && c->c_tv.tv_usec > now.tv_usec))) {
-		seltime = c->c_tv;
-		seltime.tv_sec -= now.tv_sec;
-		seltime.tv_usec -= now.tv_usec;
-		if (seltime.tv_usec < 0) {
-			seltime.tv_usec += 1000000;
-			seltime.tv_sec--;
-		}
-	} else
-		seltime.tv_sec = seltime.tv_usec = 0;
-
-	r = xmalloc(read_wait_size);
-	memcpy(r, read_wait, read_wait_size);
-	e = xmalloc(read_wait_size);
-	memcpy(e, read_wait, read_wait_size);
-
-	while (select(maxfd, r, NULL, e, &seltime) == -1 &&
-	    (errno == EAGAIN || errno == EINTR))
-		;
-
-	for (i = 0; i < maxfd; i++) {
-		if (FD_ISSET(i, e)) {
-			error("%s: exception!", fdcon[i].c_name);
-			confree(i);
-		} else if (FD_ISSET(i, r))
-			conread(i);
-	}
-	xfree(r);
-	xfree(e);
-
-	c = TAILQ_FIRST(&tq);
-	while (c && (c->c_tv.tv_sec < now.tv_sec ||
-	    (c->c_tv.tv_sec == now.tv_sec && c->c_tv.tv_usec < now.tv_usec))) {
-		int s = c->c_fd;
-
-		c = TAILQ_NEXT(c, c_link);
-		conrecycle(s);
-	}
-}
-
-static void
-do_host(char *host)
-{
-	char *name = strnnsep(&host, " \t\n");
-	int j;
-
-	if (name == NULL)
-		return;
-	for (j = KT_RSA1; j <= KT_RSA; j *= 2) {
-		if (get_keytypes & j) {
-			while (ncon >= MAXCON)
-				conloop();
-			conalloc(name, *host ? host : name, j);
-		}
-	}
-}
-
-void
-fatal(const char *fmt,...)
-{
-	va_list args;
-
-	va_start(args, fmt);
-	do_log(SYSLOG_LEVEL_FATAL, fmt, args);
-	va_end(args);
-	if (nonfatal_fatal)
-		longjmp(kexjmp, -1);
-	else
-		fatal_cleanup();
-}
-
-static void
-usage(void)
-{
-	fprintf(stderr, "usage: %s [-v46] [-p port] [-T timeout] [-f file]\n"
-	    "\t\t   [host | addrlist namelist] [...]\n",
-	    __progname);
-	exit(1);
-}
-
-int
-main(int argc, char **argv)
-{
-	int debug_flag = 0, log_level = SYSLOG_LEVEL_INFO;
-	int opt, fopt_count = 0;
-	char *tname;
-
-	extern int optind;
-	extern char *optarg;
-
-	__progname = get_progname(argv[0]);
-	init_rng();
-	seed_rng();
-	TAILQ_INIT(&tq);
-
-	if (argc <= 1)
-		usage();
-
-	while ((opt = getopt(argc, argv, "v46p:T:t:f:")) != -1) {
-		switch (opt) {
-		case 'p':
-			ssh_port = a2port(optarg);
-			if (ssh_port == 0) {
-				fprintf(stderr, "Bad port '%s'\n", optarg);
-				exit(1);
-			}
-			break;
-		case 'T':
-			timeout = convtime(optarg);
-			if (timeout == -1 || timeout == 0) {
-				fprintf(stderr, "Bad timeout '%s'\n", optarg);
-				usage();
-			}
-			break;
-		case 'v':
-			if (!debug_flag) {
-				debug_flag = 1;
-				log_level = SYSLOG_LEVEL_DEBUG1;
-			}
-			else if (log_level < SYSLOG_LEVEL_DEBUG3)
-				log_level++;
-			else
-				fatal("Too high debugging level.");
-			break;
-		case 'f':
-			if (strcmp(optarg, "-") == 0)
-				optarg = NULL;
-			argv[fopt_count++] = optarg;
-			break;
-		case 't':
-			get_keytypes = 0;
-			tname = strtok(optarg, ",");
-			while (tname) {
-				int type = key_type_from_name(tname);
-				switch (type) {
-				case KEY_RSA1:
-					get_keytypes |= KT_RSA1;
-					break;
-				case KEY_DSA:
-					get_keytypes |= KT_DSA;
-					break;
-				case KEY_RSA:
-					get_keytypes |= KT_RSA;
-					break;
-				case KEY_UNSPEC:
-					fatal("unknown key type %s", tname);
-				}
-				tname = strtok(NULL, ",");
-			}
-			break;
-		case '4':
-			IPv4or6 = AF_INET;
-			break;
-		case '6':
-			IPv4or6 = AF_INET6;
-			break;
-		case '?':
-		default:
-			usage();
-		}
-	}
-	if (optind == argc && !fopt_count)
-		usage();
-
-	log_init("ssh-keyscan", log_level, SYSLOG_FACILITY_USER, 1);
-
-	maxfd = fdlim_get(1);
-	if (maxfd < 0)
-		fatal("%s: fdlim_get: bad value", __progname);
-	if (maxfd > MAXMAXFD)
-		maxfd = MAXMAXFD;
-	if (MAXCON <= 0)
-		fatal("%s: not enough file descriptors", __progname);
-	if (maxfd > fdlim_get(0))
-		fdlim_set(maxfd);
-	fdcon = xmalloc(maxfd * sizeof(con));
-	memset(fdcon, 0, maxfd * sizeof(con));
-
-	read_wait_size = howmany(maxfd, NFDBITS) * sizeof(fd_mask);
-	read_wait = xmalloc(read_wait_size);
-	memset(read_wait, 0, read_wait_size);
-
-	if (fopt_count) {
-		Linebuf *lb;
-		char *line;
-		int j;
-
-		for (j = 0; j < fopt_count; j++) {
-			lb = Linebuf_alloc(argv[j], error);
-			if (!lb)
-				continue;
-			while ((line = Linebuf_getline(lb)) != NULL)
-				do_host(line);
-			Linebuf_free(lb);
-		}
-	}
-
-	while (optind < argc)
-		do_host(argv[optind++]);
-
-	while (ncon > 0)
-		conloop();
-
-	return (0);
-}
diff --git a/crypto/openssh/ssh-keyscan/Makefile b/crypto/openssh/ssh-keyscan/Makefile
deleted file mode 100644
index 2ea5c23934c4..000000000000
--- a/crypto/openssh/ssh-keyscan/Makefile
+++ /dev/null
@@ -1,18 +0,0 @@
-#	$OpenBSD: Makefile,v 1.4 2001/08/05 23:18:20 markus Exp $
-
-.PATH:		${.CURDIR}/..
-
-PROG=	ssh-keyscan
-BINOWN=	root
-
-BINMODE?=555
-
-BINDIR=	/usr/bin
-MAN=	ssh-keyscan.1
-
-SRCS=	ssh-keyscan.c
-
-.include <bsd.prog.mk>
-
-LDADD+= -lcrypto -lz
-DPADD+= ${LIBCRYPTO} ${LIBZ}
diff --git a/crypto/openssh/ssh-keysign.8 b/crypto/openssh/ssh-keysign.8
deleted file mode 100644
index 2e3f8ff3ef75..000000000000
--- a/crypto/openssh/ssh-keysign.8
+++ /dev/null
@@ -1,82 +0,0 @@
-.\" $OpenBSD: ssh-keysign.8,v 1.6 2003/03/28 10:11:43 jmc Exp $
-.\"
-.\" Copyright (c) 2002 Markus Friedl.  All rights reserved.
-.\"
-.\" Redistribution and use in source and binary forms, with or without
-.\" modification, are permitted provided that the following conditions
-.\" are met:
-.\" 1. Redistributions of source code must retain the above copyright
-.\"    notice, this list of conditions and the following disclaimer.
-.\" 2. Redistributions in binary form must reproduce the above copyright
-.\"    notice, this list of conditions and the following disclaimer in the
-.\"    documentation and/or other materials provided with the distribution.
-.\"
-.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-.\"
-.Dd May 24, 2002
-.Dt SSH-KEYSIGN 8
-.Os
-.Sh NAME
-.Nm ssh-keysign
-.Nd ssh helper program for hostbased authentication
-.Sh SYNOPSIS
-.Nm
-.Sh DESCRIPTION
-.Nm
-is used by
-.Xr ssh 1
-to access the local host keys and generate the digital signature
-required during hostbased authentication with SSH protocol version 2.
-.Pp
-.Nm
-is disabled by default and can only be enabled in the
-global client configuration file
-.Pa /etc/ssh/ssh_config
-by setting
-.Cm EnableSSHKeysign
-to
-.Dq yes .
-.Pp
-.Nm
-is not intended to be invoked by the user, but from
-.Xr ssh 1 .
-See
-.Xr ssh 1
-and
-.Xr sshd 8
-for more information about hostbased authentication.
-.Sh FILES
-.Bl -tag -width Ds
-.It Pa /etc/ssh/ssh_config
-Controls whether
-.Nm
-is enabled.
-.It Pa /etc/ssh/ssh_host_dsa_key, /etc/ssh/ssh_host_rsa_key
-These files contain the private parts of the host keys used to
-generate the digital signature.
-They should be owned by root, readable only by root, and not
-accessible to others.
-Since they are readable only by root,
-.Nm
-must be set-uid root if hostbased authentication is used.
-.El
-.Sh SEE ALSO
-.Xr ssh 1 ,
-.Xr ssh-keygen 1 ,
-.Xr ssh_config 5 ,
-.Xr sshd 8
-.Sh AUTHORS
-Markus Friedl <markus@openbsd.org>
-.Sh HISTORY
-.Nm
-first appeared in
-.Ox 3.2 .
diff --git a/crypto/openssh/ssh-keysign.c b/crypto/openssh/ssh-keysign.c
deleted file mode 100644
index 26c8faad2498..000000000000
--- a/crypto/openssh/ssh-keysign.c
+++ /dev/null
@@ -1,238 +0,0 @@
-/*
- * Copyright (c) 2002 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#include "includes.h"
-RCSID("$OpenBSD: ssh-keysign.c,v 1.10 2003/03/13 11:42:19 markus Exp $");
-
-#include <openssl/evp.h>
-#include <openssl/rand.h>
-#include <openssl/rsa.h>
-
-#include "log.h"
-#include "key.h"
-#include "ssh.h"
-#include "ssh2.h"
-#include "misc.h"
-#include "xmalloc.h"
-#include "buffer.h"
-#include "bufaux.h"
-#include "authfile.h"
-#include "msg.h"
-#include "canohost.h"
-#include "pathnames.h"
-#include "readconf.h"
-
-uid_t original_real_uid;	/* XXX readconf.c needs this */
-
-#ifdef HAVE___PROGNAME
-extern char *__progname;
-#else
-char *__progname;
-#endif
-
-static int
-valid_request(struct passwd *pw, char *host, Key **ret, u_char *data,
-    u_int datalen)
-{
-	Buffer b;
-	Key *key;
-	u_char *pkblob;
-	u_int blen, len;
-	char *pkalg, *p;
-	int pktype, fail;
-
-	fail = 0;
-
-	buffer_init(&b);
-	buffer_append(&b, data, datalen);
-
-	/* session id, currently limited to SHA1 (20 bytes) */
-	p = buffer_get_string(&b, &len);
-	if (len != 20)
-		fail++;
-	xfree(p);
-
-	if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST)
-		fail++;
-
-	/* server user */
-	buffer_skip_string(&b);
-
-	/* service */
-	p = buffer_get_string(&b, NULL);
-	if (strcmp("ssh-connection", p) != 0)
-		fail++;
-	xfree(p);
-
-	/* method */
-	p = buffer_get_string(&b, NULL);
-	if (strcmp("hostbased", p) != 0)
-		fail++;
-	xfree(p);
-
-	/* pubkey */
-	pkalg = buffer_get_string(&b, NULL);
-	pkblob = buffer_get_string(&b, &blen);
-
-	pktype = key_type_from_name(pkalg);
-	if (pktype == KEY_UNSPEC)
-		fail++;
-	else if ((key = key_from_blob(pkblob, blen)) == NULL)
-		fail++;
-	else if (key->type != pktype)
-		fail++;
-	xfree(pkalg);
-	xfree(pkblob);
-
-	/* client host name, handle trailing dot */
-	p = buffer_get_string(&b, &len);
-	debug2("valid_request: check expect chost %s got %s", host, p);
-	if (strlen(host) != len - 1)
-		fail++;
-	else if (p[len - 1] != '.')
-		fail++;
-	else if (strncasecmp(host, p, len - 1) != 0)
-		fail++;
-	xfree(p);
-
-	/* local user */
-	p = buffer_get_string(&b, NULL);
-
-	if (strcmp(pw->pw_name, p) != 0)
-		fail++;
-	xfree(p);
-
-	/* end of message */
-	if (buffer_len(&b) != 0)
-		fail++;
-
-	debug3("valid_request: fail %d", fail);
-
-	if (fail && key != NULL)
-		key_free(key);
-	else
-		*ret = key;
-
-	return (fail ? -1 : 0);
-}
-
-int
-main(int argc, char **argv)
-{
-	Buffer b;
-	Options options;
-	Key *keys[2], *key;
-	struct passwd *pw;
-	int key_fd[2], i, found, version = 2, fd;
-	u_char *signature, *data;
-	char *host;
-	u_int slen, dlen;
-	u_int32_t rnd[256];
-
-	key_fd[0] = open(_PATH_HOST_RSA_KEY_FILE, O_RDONLY);
-	key_fd[1] = open(_PATH_HOST_DSA_KEY_FILE, O_RDONLY);
-
-	seteuid(getuid());
-	setuid(getuid());
-
-	init_rng();
-	seed_rng();
-	arc4random_stir();
-
-#ifdef DEBUG_SSH_KEYSIGN
-	log_init("ssh-keysign", SYSLOG_LEVEL_DEBUG3, SYSLOG_FACILITY_AUTH, 0);
-#endif
-
-	/* verify that ssh-keysign is enabled by the admin */
-	original_real_uid = getuid();	/* XXX readconf.c needs this */
-	initialize_options(&options);
-	(void)read_config_file(_PATH_HOST_CONFIG_FILE, "", &options);
-	fill_default_options(&options);
-	if (options.enable_ssh_keysign != 1)
-		fatal("ssh-keysign not enabled in %s",
-		    _PATH_HOST_CONFIG_FILE);
-
-	if (key_fd[0] == -1 && key_fd[1] == -1)
-		fatal("could not open any host key");
-
-	if ((pw = getpwuid(getuid())) == NULL)
-		fatal("getpwuid failed");
-	pw = pwcopy(pw);
-
-	SSLeay_add_all_algorithms();
-	for (i = 0; i < 256; i++)
-		rnd[i] = arc4random();
-	RAND_seed(rnd, sizeof(rnd));
-
-	found = 0;
-	for (i = 0; i < 2; i++) {
-		keys[i] = NULL;
-		if (key_fd[i] == -1)
-			continue;
-		keys[i] = key_load_private_pem(key_fd[i], KEY_UNSPEC,
-		    NULL, NULL);
-		close(key_fd[i]);
-		if (keys[i] != NULL)
-			found = 1;
-	}
-	if (!found)
-		fatal("no hostkey found");
-
-	buffer_init(&b);
-	if (ssh_msg_recv(STDIN_FILENO, &b) < 0)
-		fatal("ssh_msg_recv failed");
-	if (buffer_get_char(&b) != version)
-		fatal("bad version");
-	fd = buffer_get_int(&b);
-	if ((fd == STDIN_FILENO) || (fd == STDOUT_FILENO))
-		fatal("bad fd");
-	if ((host = get_local_name(fd)) == NULL)
-		fatal("cannot get sockname for fd");
-
-	data = buffer_get_string(&b, &dlen);
-	if (valid_request(pw, host, &key, data, dlen) < 0)
-		fatal("not a valid request");
-	xfree(host);
-
-	found = 0;
-	for (i = 0; i < 2; i++) {
-		if (keys[i] != NULL &&
-		    key_equal(key, keys[i])) {
-			found = 1;
-			break;
-		}
-	}
-	if (!found)
-		fatal("no matching hostkey found");
-
-	if (key_sign(keys[i], &signature, &slen, data, dlen) != 0)
-		fatal("key_sign failed");
-	xfree(data);
-
-	/* send reply */
-	buffer_clear(&b);
-	buffer_put_string(&b, signature, slen);
-	ssh_msg_send(STDOUT_FILENO, version, &b);
-
-	return (0);
-}
diff --git a/crypto/openssh/ssh-keysign/Makefile b/crypto/openssh/ssh-keysign/Makefile
deleted file mode 100644
index 1a13d9ed358d..000000000000
--- a/crypto/openssh/ssh-keysign/Makefile
+++ /dev/null
@@ -1,18 +0,0 @@
-#	$OpenBSD: Makefile,v 1.3 2002/05/31 10:30:33 markus Exp $
-
-.PATH:		${.CURDIR}/..
-
-PROG=	ssh-keysign
-BINOWN=	root
-
-BINMODE?=4555
-
-BINDIR=	/usr/libexec
-MAN=	ssh-keysign.8
-
-SRCS=	ssh-keysign.c
-
-.include <bsd.prog.mk>
-
-LDADD+=	-lcrypto -lz
-DPADD+=	${LIBCRYPTO} ${LIBZ}
diff --git a/crypto/openssh/ssh-rand-helper.8 b/crypto/openssh/ssh-rand-helper.8
deleted file mode 100644
index a89185c0a42e..000000000000
--- a/crypto/openssh/ssh-rand-helper.8
+++ /dev/null
@@ -1,94 +0,0 @@
-.\" $Id: ssh-rand-helper.8,v 1.1 2002/04/14 09:27:13 djm Exp $
-.\"
-.\" Copyright (c) 2002 Damien Miller.  All rights reserved.
-.\"
-.\" Redistribution and use in source and binary forms, with or without
-.\" modification, are permitted provided that the following conditions
-.\" are met:
-.\" 1. Redistributions of source code must retain the above copyright
-.\"    notice, this list of conditions and the following disclaimer.
-.\" 2. Redistributions in binary form must reproduce the above copyright
-.\"    notice, this list of conditions and the following disclaimer in the
-.\"    documentation and/or other materials provided with the distribution.
-.\"
-.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-.\"
-.Dd April 14, 2002
-.Dt SSH-RAND-HELPER 8
-.Os
-.Sh NAME
-.Nm ssh-rand-helper
-.Nd Random number gatherer for OpenSSH
-.Sh SYNOPSIS
-.Nm ssh-rand-hlper
-.Op Fl vxXh
-.Op Fl b Ar bytes
-.Sh DESCRIPTION
-.Nm
-is a small helper program used by 
-.Xr ssh 1 ,
-.Xr ssh-add 1 ,
-.Xr ssh-agent 1 ,
-.Xr ssh-keygen 1 ,
-.Xr ssh-keyscan 1 
-and
-.Xr sshd 8
-to gather random numbers of cryptographic quality if the 
-.Xr openssl 4
-library has not been configured to provide them itself.
-.Pp
-Normally 
-.Nm
-will generate a strong random seed and provide it to the calling
-program via standard output. If standard output is a tty, 
-.Nm
-will instead print the seed in hexidecimal format unless told otherwise.
-.Pp
-.Nm
-will by default gather random numbers from the system commands listed
-in
-.Pa /etc/ssh/ssh_prng_cmds .
-The output of each of the commands listed will be hashed and used to 
-generate a random seed for the calling program. 
-.Nm
-will also store seed files in 
-.Pa ~/.ssh/prng_seed
-between executions.
-.Pp
-Alternately, 
-.Nm
-may be configured at build time to collect random numbers from a 
-EGD/PRNGd server via a unix domain or localhost tcp socket.
-.Pp
-This program is not intended to be run by the end-user, so the few 
-commandline options are for debugging purposes only.
-.Bl -tag -width Ds
-.It Fl b Ar bytes
-Specify the number of random bytes to include in the output.
-.It Fl x
-Output a hexidecimal instead of a binary seed.
-.It Fl X
-Force output of a binary seed, even if standard output is a tty
-.It Fl v
-Turn on debugging message. Multiple
-.Fl v
-options will increase the debugging level.
-.Fl h
-Display a summary of options.
-.El
-.Sh AUTHORS
-Damien Miller <djm@mindrot.org>
-.Sh SEE ALSO
-.Xr ssh 1 ,
-.Xr ssh-add 1 ,
-.Xr ssh-keygen 1 ,
-.Xr sshd 8
diff --git a/crypto/openssh/ssh-rand-helper.c b/crypto/openssh/ssh-rand-helper.c
deleted file mode 100644
index 68b77b208c71..000000000000
--- a/crypto/openssh/ssh-rand-helper.c
+++ /dev/null
@@ -1,867 +0,0 @@
-/*
- * Copyright (c) 2001-2002 Damien Miller.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-
-#include <openssl/rand.h>
-#include <openssl/sha.h>
-#include <openssl/crypto.h>
-
-/* SunOS 4.4.4 needs this */
-#ifdef HAVE_FLOATINGPOINT_H
-# include <floatingpoint.h>
-#endif /* HAVE_FLOATINGPOINT_H */
-
-#include "misc.h"
-#include "xmalloc.h"
-#include "atomicio.h"
-#include "pathnames.h"
-#include "log.h"
-
-RCSID("$Id: ssh-rand-helper.c,v 1.10 2003/03/17 05:13:53 djm Exp $");
-
-/* Number of bytes we write out */
-#define OUTPUT_SEED_SIZE	48
-
-/* Length of on-disk seedfiles */
-#define SEED_FILE_SIZE		1024
-
-/* Maximum number of command-line arguments to read from file */
-#define NUM_ARGS		10
-
-/* Minimum number of usable commands to be considered sufficient */
-#define MIN_ENTROPY_SOURCES	16
-
-/* Path to on-disk seed file (relative to user's home directory */
-#ifndef SSH_PRNG_SEED_FILE
-# define SSH_PRNG_SEED_FILE      _PATH_SSH_USER_DIR"/prng_seed"
-#endif
-
-/* Path to PRNG commands list */
-#ifndef SSH_PRNG_COMMAND_FILE
-# define SSH_PRNG_COMMAND_FILE   SSHDIR "/ssh_prng_cmds"
-#endif
-
-#ifdef HAVE___PROGNAME
-extern char *__progname;
-#else
-char *__progname;
-#endif
-
-#ifndef offsetof
-# define offsetof(type, member) ((size_t) &((type *)0)->member)
-#endif
-
-#define WHITESPACE " \t\n"
-
-#ifndef RUSAGE_SELF
-# define RUSAGE_SELF 0
-#endif
-#ifndef RUSAGE_CHILDREN
-# define RUSAGE_CHILDREN 0
-#endif
-
-#if !defined(PRNGD_SOCKET) && !defined(PRNGD_PORT)
-# define USE_SEED_FILES
-#endif
-
-typedef struct {
-	/* Proportion of data that is entropy */
-	double rate;
-	/* Counter goes positive if this command times out */
-	unsigned int badness;
-	/* Increases by factor of two each timeout */
-	unsigned int sticky_badness;
-	/* Path to executable */
-	char *path;
-	/* argv to pass to executable */
-	char *args[NUM_ARGS]; /* XXX: arbitrary limit */
-	/* full command string (debug) */
-	char *cmdstring;
-} entropy_cmd_t;
-
-/* slow command timeouts (all in milliseconds) */
-/* static int entropy_timeout_default = ENTROPY_TIMEOUT_MSEC; */
-static int entropy_timeout_current = ENTROPY_TIMEOUT_MSEC;
-
-/* this is initialised from a file, by prng_read_commands() */
-static entropy_cmd_t *entropy_cmds = NULL;
-
-/* Prototypes */
-double stir_from_system(void);
-double stir_from_programs(void);
-double stir_gettimeofday(double entropy_estimate);
-double stir_clock(double entropy_estimate);
-double stir_rusage(int who, double entropy_estimate);
-double hash_command_output(entropy_cmd_t *src, unsigned char *hash);
-int get_random_bytes_prngd(unsigned char *buf, int len, 
-    unsigned short tcp_port, char *socket_path);
-
-/*
- * Collect 'len' bytes of entropy into 'buf' from PRNGD/EGD daemon
- * listening either on 'tcp_port', or via Unix domain socket at *
- * 'socket_path'.
- * Either a non-zero tcp_port or a non-null socket_path must be 
- * supplied.
- * Returns 0 on success, -1 on error
- */
-int
-get_random_bytes_prngd(unsigned char *buf, int len, 
-    unsigned short tcp_port, char *socket_path)
-{
-	int fd, addr_len, rval, errors;
-	char msg[2];
-	struct sockaddr_storage addr;
-	struct sockaddr_in *addr_in = (struct sockaddr_in *)&addr;
-	struct sockaddr_un *addr_un = (struct sockaddr_un *)&addr;
-	mysig_t old_sigpipe;
-
-	/* Sanity checks */
-	if (socket_path == NULL && tcp_port == 0)
-		fatal("You must specify a port or a socket");
-	if (socket_path != NULL &&
-	    strlen(socket_path) >= sizeof(addr_un->sun_path))
-		fatal("Random pool path is too long");
-	if (len > 255)
-		fatal("Too many bytes to read from PRNGD");
-
-	memset(&addr, '\0', sizeof(addr));
-
-	if (tcp_port != 0) {
-		addr_in->sin_family = AF_INET;
-		addr_in->sin_addr.s_addr = htonl(INADDR_LOOPBACK);
-		addr_in->sin_port = htons(tcp_port);
-		addr_len = sizeof(*addr_in);
-	} else {
-		addr_un->sun_family = AF_UNIX;
-		strlcpy(addr_un->sun_path, socket_path,
-		    sizeof(addr_un->sun_path));
-		addr_len = offsetof(struct sockaddr_un, sun_path) +
-		    strlen(socket_path) + 1;
-	}
-
-	old_sigpipe = mysignal(SIGPIPE, SIG_IGN);
-
-	errors = 0;
-	rval = -1;
-reopen:
-	fd = socket(addr.ss_family, SOCK_STREAM, 0);
-	if (fd == -1) {
-		error("Couldn't create socket: %s", strerror(errno));
-		goto done;
-	}
-
-	if (connect(fd, (struct sockaddr*)&addr, addr_len) == -1) {
-		if (tcp_port != 0) {
-			error("Couldn't connect to PRNGD port %d: %s",
-			    tcp_port, strerror(errno));
-		} else {
-			error("Couldn't connect to PRNGD socket \"%s\": %s",
-			    addr_un->sun_path, strerror(errno));
-		}
-		goto done;
-	}
-
-	/* Send blocking read request to PRNGD */
-	msg[0] = 0x02;
-	msg[1] = len;
-
-	if (atomicio(write, fd, msg, sizeof(msg)) != sizeof(msg)) {
-		if (errno == EPIPE && errors < 10) {
-			close(fd);
-			errors++;
-			goto reopen;
-		}
-		error("Couldn't write to PRNGD socket: %s",
-		    strerror(errno));
-		goto done;
-	}
-
-	if (atomicio(read, fd, buf, len) != len) {
-		if (errno == EPIPE && errors < 10) {
-			close(fd);
-			errors++;
-			goto reopen;
-		}
-		error("Couldn't read from PRNGD socket: %s",
-		    strerror(errno));
-		goto done;
-	}
-
-	rval = 0;
-done:
-	mysignal(SIGPIPE, old_sigpipe);
-	if (fd != -1)
-		close(fd);
-	return rval;
-}
-
-double
-stir_gettimeofday(double entropy_estimate)
-{
-	struct timeval tv;
-
-	if (gettimeofday(&tv, NULL) == -1)
-		fatal("Couldn't gettimeofday: %s", strerror(errno));
-
-	RAND_add(&tv, sizeof(tv), entropy_estimate);
-
-	return entropy_estimate;
-}
-
-double
-stir_clock(double entropy_estimate)
-{
-#ifdef HAVE_CLOCK
-	clock_t c;
-
-	c = clock();
-	RAND_add(&c, sizeof(c), entropy_estimate);
-
-	return entropy_estimate;
-#else /* _HAVE_CLOCK */
-	return 0;
-#endif /* _HAVE_CLOCK */
-}
-
-double
-stir_rusage(int who, double entropy_estimate)
-{
-#ifdef HAVE_GETRUSAGE
-	struct rusage ru;
-
-	if (getrusage(who, &ru) == -1)
-		return 0;
-
-	RAND_add(&ru, sizeof(ru), entropy_estimate);
-
-	return entropy_estimate;
-#else /* _HAVE_GETRUSAGE */
-	return 0;
-#endif /* _HAVE_GETRUSAGE */
-}
-
-static int
-timeval_diff(struct timeval *t1, struct timeval *t2)
-{
-	int secdiff, usecdiff;
-
-	secdiff = t2->tv_sec - t1->tv_sec;
-	usecdiff = (secdiff*1000000) + (t2->tv_usec - t1->tv_usec);
-	return (int)(usecdiff / 1000);
-}
-
-double
-hash_command_output(entropy_cmd_t *src, unsigned char *hash)
-{
-	char buf[8192];
-	fd_set rdset;
-	int bytes_read, cmd_eof, error_abort, msec_elapsed, p[2];
-	int status, total_bytes_read;
-	static int devnull = -1;
-	pid_t pid;
-	SHA_CTX sha;
-	struct timeval tv_start, tv_current;
-
-	debug3("Reading output from \'%s\'", src->cmdstring);
-
-	if (devnull == -1) {
-		devnull = open("/dev/null", O_RDWR);
-		if (devnull == -1)
-			fatal("Couldn't open /dev/null: %s", 
-			    strerror(errno));
-	}
-
-	if (pipe(p) == -1)
-		fatal("Couldn't open pipe: %s", strerror(errno));
-
-	(void)gettimeofday(&tv_start, NULL); /* record start time */
-
-	switch (pid = fork()) {
-		case -1: /* Error */
-			close(p[0]);
-			close(p[1]);
-			fatal("Couldn't fork: %s", strerror(errno));
-			/* NOTREACHED */
-		case 0: /* Child */
-			dup2(devnull, STDIN_FILENO);
-			dup2(p[1], STDOUT_FILENO);
-			dup2(p[1], STDERR_FILENO);
-			close(p[0]);
-			close(p[1]);
-			close(devnull);
-
-			execv(src->path, (char**)(src->args));
-
-			debug("(child) Couldn't exec '%s': %s", 
-			    src->cmdstring, strerror(errno));
-			_exit(-1);
-		default: /* Parent */
-			break;
-	}
-
-	RAND_add(&pid, sizeof(&pid), 0.0);
-
-	close(p[1]);
-
-	/* Hash output from child */
-	SHA1_Init(&sha);
-
-	cmd_eof = error_abort = msec_elapsed = total_bytes_read = 0;
-	while (!error_abort && !cmd_eof) {
-		int ret;
-		struct timeval tv;
-		int msec_remaining;
-
-		(void) gettimeofday(&tv_current, 0);
-		msec_elapsed = timeval_diff(&tv_start, &tv_current);
-		if (msec_elapsed >= entropy_timeout_current) {
-			error_abort=1;
-			continue;
-		}
-		msec_remaining = entropy_timeout_current - msec_elapsed;
-
-		FD_ZERO(&rdset);
-		FD_SET(p[0], &rdset);
-		tv.tv_sec = msec_remaining / 1000;
-		tv.tv_usec = (msec_remaining % 1000) * 1000;
-
-		ret = select(p[0] + 1, &rdset, NULL, NULL, &tv);
-
-		RAND_add(&tv, sizeof(tv), 0.0);
-
-		switch (ret) {
-		case 0:
-			/* timer expired */
-			error_abort = 1;
-			kill(pid, SIGINT);
-			break;
-		case 1:
-			/* command input */
-			do {
-				bytes_read = read(p[0], buf, sizeof(buf));
-			} while (bytes_read == -1 && errno == EINTR);
-			RAND_add(&bytes_read, sizeof(&bytes_read), 0.0);
-			if (bytes_read == -1) {
-				error_abort = 1;
-				break;
-			} else if (bytes_read) {
-				SHA1_Update(&sha, buf, bytes_read);
-				total_bytes_read += bytes_read;
-			} else {
-				cmd_eof = 1;
-			}
-			break;
-		case -1:
-		default:
-			/* error */
-			debug("Command '%s': select() failed: %s", 
-			    src->cmdstring, strerror(errno));
-			error_abort = 1;
-			break;
-		}
-	}
-
-	SHA1_Final(hash, &sha);
-
-	close(p[0]);
-
-	debug3("Time elapsed: %d msec", msec_elapsed);
-
-	if (waitpid(pid, &status, 0) == -1) {
-	       error("Couldn't wait for child '%s' completion: %s",
-		   src->cmdstring, strerror(errno));
-		return 0.0;
-	}
-
-	RAND_add(&status, sizeof(&status), 0.0);
-
-	if (error_abort) {
-		/*
-		 * Closing p[0] on timeout causes the entropy command to
-		 * SIGPIPE. Take whatever output we got, and mark this 
-		 * command as slow 
-		 */
-		debug2("Command '%s' timed out", src->cmdstring);
-		src->sticky_badness *= 2;
-		src->badness = src->sticky_badness;
-		return total_bytes_read;
-	}
-
-	if (WIFEXITED(status)) {
-		if (WEXITSTATUS(status) == 0) {
-			return total_bytes_read;
-		} else {
-			debug2("Command '%s' exit status was %d",
-			    src->cmdstring, WEXITSTATUS(status));
-			src->badness = src->sticky_badness = 128;
-			return 0.0;
-		}
-	} else if (WIFSIGNALED(status)) {
-		debug2("Command '%s' returned on uncaught signal %d !",
-		    src->cmdstring, status);
-		src->badness = src->sticky_badness = 128;
-		return 0.0;
-	} else
-		return 0.0;
-}
-
-double
-stir_from_system(void)
-{
-	double total_entropy_estimate;
-	long int i;
-
-	total_entropy_estimate = 0;
-
-	i = getpid();
-	RAND_add(&i, sizeof(i), 0.5);
-	total_entropy_estimate += 0.1;
-
-	i = getppid();
-	RAND_add(&i, sizeof(i), 0.5);
-	total_entropy_estimate += 0.1;
-
-	i = getuid();
-	RAND_add(&i, sizeof(i), 0.0);
-	i = getgid();
-	RAND_add(&i, sizeof(i), 0.0);
-
-	total_entropy_estimate += stir_gettimeofday(1.0);
-	total_entropy_estimate += stir_clock(0.5);
-	total_entropy_estimate += stir_rusage(RUSAGE_SELF, 2.0);
-
-	return total_entropy_estimate;
-}
-
-double
-stir_from_programs(void)
-{
-	int c;
-	double entropy, total_entropy;
-	unsigned char hash[SHA_DIGEST_LENGTH];
-
-	total_entropy = 0;
-	for(c = 0; entropy_cmds[c].path != NULL; c++) {
-		if (!entropy_cmds[c].badness) {
-			/* Hash output from command */
-			entropy = hash_command_output(&entropy_cmds[c],
-			    hash);
-
-			/* Scale back estimate by command's rate */
-			entropy *= entropy_cmds[c].rate;
-
-			/* Upper bound of entropy is SHA_DIGEST_LENGTH */
-			if (entropy > SHA_DIGEST_LENGTH)
-				entropy = SHA_DIGEST_LENGTH;
-
-			/* Stir it in */
-			RAND_add(hash, sizeof(hash), entropy);
-
-			debug3("Got %0.2f bytes of entropy from '%s'", 
-			    entropy, entropy_cmds[c].cmdstring);
-
-			total_entropy += entropy;
-
-			/* Execution time should be a bit unpredictable */
-			total_entropy += stir_gettimeofday(0.05);
-			total_entropy += stir_clock(0.05);
-			total_entropy += stir_rusage(RUSAGE_SELF, 0.1);
-			total_entropy += stir_rusage(RUSAGE_CHILDREN, 0.1);
-		} else {
-			debug2("Command '%s' disabled (badness %d)",
-			    entropy_cmds[c].cmdstring, 
-			    entropy_cmds[c].badness);
-
-			if (entropy_cmds[c].badness > 0)
-				entropy_cmds[c].badness--;
-		}
-	}
-
-	return total_entropy;
-}
-
-/*
- * prng seedfile functions
- */
-int
-prng_check_seedfile(char *filename)
-{
-	struct stat st;
-
-	/*
-	 * XXX raceable: eg replace seed between this stat and subsequent 
-	 * open. Not such a problem because we don't really trust the 
-	 * seed file anyway.
-	 * XXX: use secure path checking as elsewhere in OpenSSH
-	 */
-	if (lstat(filename, &st) == -1) {
-		/* Give up on hard errors */
-		if (errno != ENOENT)
-			debug("WARNING: Couldn't stat random seed file "
-			    "\"%.100s\": %s", filename, strerror(errno));
-		return 0;
-	}
-
-	/* regular file? */
-	if (!S_ISREG(st.st_mode))
-		fatal("PRNG seedfile %.100s is not a regular file",
-		    filename);
-
-	/* mode 0600, owned by root or the current user? */
-	if (((st.st_mode & 0177) != 0) || !(st.st_uid == getuid())) {
-		debug("WARNING: PRNG seedfile %.100s must be mode 0600, "
-		    "owned by uid %d", filename, getuid());
-		return 0;
-	}
-
-	return 1;
-}
-
-void
-prng_write_seedfile(void)
-{
-	int fd;
-	unsigned char seed[SEED_FILE_SIZE];
-	char filename[MAXPATHLEN];
-	struct passwd *pw;
-
-	pw = getpwuid(getuid());
-	if (pw == NULL)
-		fatal("Couldn't get password entry for current user "
-		    "(%i): %s", getuid(), strerror(errno));
-
-	/* Try to ensure that the parent directory is there */
-	snprintf(filename, sizeof(filename), "%.512s/%s", pw->pw_dir,
-	    _PATH_SSH_USER_DIR);
-	mkdir(filename, 0700);
-
-	snprintf(filename, sizeof(filename), "%.512s/%s", pw->pw_dir,
-	    SSH_PRNG_SEED_FILE);
-
-	debug("writing PRNG seed to file %.100s", filename);
-
-	if (RAND_bytes(seed, sizeof(seed)) <= 0)
-		fatal("PRNG seed extration failed");
-
-	/* Don't care if the seed doesn't exist */
-	prng_check_seedfile(filename);
-
-	if ((fd = open(filename, O_WRONLY|O_TRUNC|O_CREAT, 0600)) == -1) {
-		debug("WARNING: couldn't access PRNG seedfile %.100s "
-		    "(%.100s)", filename, strerror(errno));
-	} else {
-		if (atomicio(write, fd, &seed, sizeof(seed)) < sizeof(seed))
-			fatal("problem writing PRNG seedfile %.100s "
-			    "(%.100s)", filename, strerror(errno));
-		close(fd);
-	}
-}
-
-void
-prng_read_seedfile(void)
-{
-	int fd;
-	char seed[SEED_FILE_SIZE], filename[MAXPATHLEN];
-	struct passwd *pw;
-
-	pw = getpwuid(getuid());
-	if (pw == NULL)
-		fatal("Couldn't get password entry for current user "
-		    "(%i): %s", getuid(), strerror(errno));
-
-	snprintf(filename, sizeof(filename), "%.512s/%s", pw->pw_dir,
-		SSH_PRNG_SEED_FILE);
-
-	debug("loading PRNG seed from file %.100s", filename);
-
-	if (!prng_check_seedfile(filename)) {
-		verbose("Random seed file not found or invalid, ignoring.");
-		return;
-	}
-
-	/* open the file and read in the seed */
-	fd = open(filename, O_RDONLY);
-	if (fd == -1)
-		fatal("could not open PRNG seedfile %.100s (%.100s)",
-		    filename, strerror(errno));
-
-	if (atomicio(read, fd, &seed, sizeof(seed)) < sizeof(seed)) {
-		verbose("invalid or short read from PRNG seedfile "
-		    "%.100s - ignoring", filename);
-		memset(seed, '\0', sizeof(seed));
-	}
-	close(fd);
-
-	/* stir in the seed, with estimated entropy zero */
-	RAND_add(&seed, sizeof(seed), 0.0);
-}
-
-
-/*
- * entropy command initialisation functions
- */
-int
-prng_read_commands(char *cmdfilename)
-{
-	char cmd[SEED_FILE_SIZE], *cp, line[1024], path[SEED_FILE_SIZE];
-	double est;
-	entropy_cmd_t *entcmd;
-	FILE *f;
-	int cur_cmd, linenum, num_cmds, arg;
-
-	if ((f = fopen(cmdfilename, "r")) == NULL) {
-		fatal("couldn't read entropy commands file %.100s: %.100s",
-		    cmdfilename, strerror(errno));
-	}
-
-	num_cmds = 64;
-	entcmd = xmalloc(num_cmds * sizeof(entropy_cmd_t));
-	memset(entcmd, '\0', num_cmds * sizeof(entropy_cmd_t));
-
-	/* Read in file */
-	cur_cmd = linenum = 0;
-	while (fgets(line, sizeof(line), f)) {
-		linenum++;
-
-		/* Skip leading whitespace, blank lines and comments */
-		cp = line + strspn(line, WHITESPACE);
-		if ((*cp == 0) || (*cp == '#'))
-			continue; /* done with this line */
-
-		/*
-		 * The first non-whitespace char should be a double quote 
-		 * delimiting the commandline
-		 */
-		if (*cp != '"') {
-			error("bad entropy command, %.100s line %d",
-			    cmdfilename, linenum);
-			continue;
-		}
-
-		/*
-		 * First token, command args (incl. argv[0]) in double
-		 * quotes
-		 */
-		cp = strtok(cp, "\"");
-		if (cp == NULL) {
-			error("missing or bad command string, %.100s "
-			    "line %d -- ignored", cmdfilename, linenum);
-			continue;
-		}
-		strlcpy(cmd, cp, sizeof(cmd));
-
-		/* Second token, full command path */
-		if ((cp = strtok(NULL, WHITESPACE)) == NULL) {
-			error("missing command path, %.100s "
-			    "line %d -- ignored", cmdfilename, linenum);
-			continue;
-		}
-
-		/* Did configure mark this as dead? */
-		if (strncmp("undef", cp, 5) == 0)
-			continue;
-
-		strlcpy(path, cp, sizeof(path));
-
-		/* Third token, entropy rate estimate for this command */
-		if ((cp = strtok(NULL, WHITESPACE)) == NULL) {
-			error("missing entropy estimate, %.100s "
-			    "line %d -- ignored", cmdfilename, linenum);
-			continue;
-		}
-		est = strtod(cp, NULL);
-
-		/* end of line */
-		if ((cp = strtok(NULL, WHITESPACE)) != NULL) {
-			error("garbage at end of line %d in %.100s "
-			    "-- ignored", linenum, cmdfilename);
-			continue;
-		}
-
-		/* save the command for debug messages */
-		entcmd[cur_cmd].cmdstring = xstrdup(cmd);
-
-		/* split the command args */
-		cp = strtok(cmd, WHITESPACE);
-		arg = 0;
-		do {
-			entcmd[cur_cmd].args[arg] = xstrdup(cp);
-			arg++;
-		} while(arg < NUM_ARGS && (cp = strtok(NULL, WHITESPACE)));
-
-		if (strtok(NULL, WHITESPACE))
-			error("ignored extra commands (max %d), %.100s "
-			    "line %d", NUM_ARGS, cmdfilename, linenum);
-
-		/* Copy the command path and rate estimate */
-		entcmd[cur_cmd].path = xstrdup(path);
-		entcmd[cur_cmd].rate = est;
-
-		/* Initialise other values */
-		entcmd[cur_cmd].sticky_badness = 1;
-
-		cur_cmd++;
-
-		/*
-		 * If we've filled the array, reallocate it twice the size
-		 * Do this now because even if this we're on the last 
-		 * command we need another slot to mark the last entry
-		 */
-		if (cur_cmd == num_cmds) {
-			num_cmds *= 2;
-			entcmd = xrealloc(entcmd, num_cmds *
-			    sizeof(entropy_cmd_t));
-		}
-	}
-
-	/* zero the last entry */
-	memset(&entcmd[cur_cmd], '\0', sizeof(entropy_cmd_t));
-
-	/* trim to size */
-	entropy_cmds = xrealloc(entcmd, (cur_cmd + 1) *
-	    sizeof(entropy_cmd_t));
-
-	debug("Loaded %d entropy commands from %.100s", cur_cmd,
-	    cmdfilename);
-
-	return cur_cmd < MIN_ENTROPY_SOURCES ? -1 : 0;
-}
-
-void
-usage(void)
-{
-	fprintf(stderr, "Usage: %s [options]\n", __progname);
-	fprintf(stderr, "  -v          Verbose; display verbose debugging messages.\n");
-	fprintf(stderr, "              Multiple -v increases verbosity.\n");
-	fprintf(stderr, "  -x          Force output in hexidecimal (for debugging)\n");
-	fprintf(stderr, "  -X          Force output in binary\n");
-	fprintf(stderr, "  -b bytes    Number of bytes to output (default %d)\n",
-	    OUTPUT_SEED_SIZE);
-}
-
-int 
-main(int argc, char **argv)
-{
-	unsigned char *buf;
-	int ret, ch, debug_level, output_hex, bytes;
-	extern char *optarg;
-	LogLevel ll;
-
-	__progname = get_progname(argv[0]);
-	log_init(argv[0], SYSLOG_LEVEL_INFO, SYSLOG_FACILITY_USER, 1);
-
-	ll = SYSLOG_LEVEL_INFO;
-	debug_level = output_hex = 0;
-	bytes = OUTPUT_SEED_SIZE;
-
-	/* Don't write binary data to a tty, unless we are forced to */
-	if (isatty(STDOUT_FILENO))
-		output_hex = 1;
-	
-	while ((ch = getopt(argc, argv, "vxXhb:")) != -1) {
-		switch (ch) {
-		case 'v':
-			if (debug_level < 3)
-				ll = SYSLOG_LEVEL_DEBUG1 + debug_level++;
-			break;
-		case 'x':
-			output_hex = 1;
-			break;
-		case 'X':
-			output_hex = 0;
-			break;
-		case 'b':
-			if ((bytes = atoi(optarg)) <= 0)
-				fatal("Invalid number of output bytes");
-			break;
-		case 'h':
-			usage();
-			exit(0);
-		default:
-			error("Invalid commandline option");
-			usage();
-		}
-	}
-
-	log_init(argv[0], ll, SYSLOG_FACILITY_USER, 1);
-	
-#ifdef USE_SEED_FILES
-	prng_read_seedfile();
-#endif
-
-	buf = xmalloc(bytes);
-
-	/*
-	 * Seed the RNG from wherever we can
-	 */
-	 
-	/* Take whatever is on the stack, but don't credit it */
-	RAND_add(buf, bytes, 0);
-
-	debug("Seeded RNG with %i bytes from system calls", 
-	    (int)stir_from_system());
-
-#ifdef PRNGD_PORT
-	if (get_random_bytes_prngd(buf, bytes, PRNGD_PORT, NULL) == -1)
-		fatal("Entropy collection failed");
-	RAND_add(buf, bytes, bytes);
-#elif defined(PRNGD_SOCKET)
-	if (get_random_bytes_prngd(buf, bytes, 0, PRNGD_SOCKET) == -1)
-		fatal("Entropy collection failed");
-	RAND_add(buf, bytes, bytes);
-#else
-	/* Read in collection commands */
-	if (prng_read_commands(SSH_PRNG_COMMAND_FILE) == -1)
-		fatal("PRNG initialisation failed -- exiting.");
-	debug("Seeded RNG with %i bytes from programs", 
-	    (int)stir_from_programs());
-#endif
-
-#ifdef USE_SEED_FILES
-	prng_write_seedfile();
-#endif
-
-	/*
-	 * Write the seed to stdout
-	 */
-
-	if (!RAND_status())
-		fatal("Not enough entropy in RNG");
-
-	if (RAND_bytes(buf, bytes) <= 0)
-		fatal("Couldn't extract entropy from PRNG");
-
-	if (output_hex) {
-		for(ret = 0; ret < bytes; ret++)
-			printf("%02x", (unsigned char)(buf[ret]));
-		printf("\n");
-	} else
-		ret = atomicio(write, STDOUT_FILENO, buf, bytes);
-		
-	memset(buf, '\0', bytes);
-	xfree(buf);
-	
-	return ret == bytes ? 0 : 1;
-}
diff --git a/crypto/openssh/ssh-rsa.c b/crypto/openssh/ssh-rsa.c
deleted file mode 100644
index efbc9e66496e..000000000000
--- a/crypto/openssh/ssh-rsa.c
+++ /dev/null
@@ -1,267 +0,0 @@
-/*
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: ssh-rsa.c,v 1.28 2003/02/12 09:33:04 markus Exp $");
-
-#include <openssl/evp.h>
-#include <openssl/err.h>
-
-#include "xmalloc.h"
-#include "log.h"
-#include "buffer.h"
-#include "bufaux.h"
-#include "key.h"
-#include "compat.h"
-#include "ssh.h"
-
-static int openssh_RSA_verify(int, u_char *, u_int, u_char *, u_int, RSA *);
-
-/* RSASSA-PKCS1-v1_5 (PKCS #1 v2.0 signature) with SHA1 */
-int
-ssh_rsa_sign(Key *key, u_char **sigp, u_int *lenp,
-    u_char *data, u_int datalen)
-{
-	const EVP_MD *evp_md;
-	EVP_MD_CTX md;
-	u_char digest[EVP_MAX_MD_SIZE], *sig;
-	u_int slen, dlen, len;
-	int ok, nid;
-	Buffer b;
-
-	if (key == NULL || key->type != KEY_RSA || key->rsa == NULL) {
-		error("ssh_rsa_sign: no RSA key");
-		return -1;
-	}
-	nid = (datafellows & SSH_BUG_RSASIGMD5) ? NID_md5 : NID_sha1;
-	if ((evp_md = EVP_get_digestbynid(nid)) == NULL) {
-		error("ssh_rsa_sign: EVP_get_digestbynid %d failed", nid);
-		return -1;
-	}
-	EVP_DigestInit(&md, evp_md);
-	EVP_DigestUpdate(&md, data, datalen);
-	EVP_DigestFinal(&md, digest, &dlen);
-
-	slen = RSA_size(key->rsa);
-	sig = xmalloc(slen);
-
-	ok = RSA_sign(nid, digest, dlen, sig, &len, key->rsa);
-	memset(digest, 'd', sizeof(digest));
-
-	if (ok != 1) {
-		int ecode = ERR_get_error();
-		error("ssh_rsa_sign: RSA_sign failed: %s",
-		    ERR_error_string(ecode, NULL));
-		xfree(sig);
-		return -1;
-	}
-	if (len < slen) {
-		u_int diff = slen - len;
-		debug("slen %u > len %u", slen, len);
-		memmove(sig + diff, sig, len);
-		memset(sig, 0, diff);
-	} else if (len > slen) {
-		error("ssh_rsa_sign: slen %u slen2 %u", slen, len);
-		xfree(sig);
-		return -1;
-	}
-	/* encode signature */
-	buffer_init(&b);
-	buffer_put_cstring(&b, "ssh-rsa");
-	buffer_put_string(&b, sig, slen);
-	len = buffer_len(&b);
-	if (lenp != NULL)
-		*lenp = len;
-	if (sigp != NULL) {
-		*sigp = xmalloc(len);
-		memcpy(*sigp, buffer_ptr(&b), len);
-	}
-	buffer_free(&b);
-	memset(sig, 's', slen);
-	xfree(sig);
-
-	return 0;
-}
-
-int
-ssh_rsa_verify(Key *key, u_char *signature, u_int signaturelen,
-    u_char *data, u_int datalen)
-{
-	Buffer b;
-	const EVP_MD *evp_md;
-	EVP_MD_CTX md;
-	char *ktype;
-	u_char digest[EVP_MAX_MD_SIZE], *sigblob;
-	u_int len, dlen, modlen;
-	int rlen, ret, nid;
-
-	if (key == NULL || key->type != KEY_RSA || key->rsa == NULL) {
-		error("ssh_rsa_verify: no RSA key");
-		return -1;
-	}
-	if (BN_num_bits(key->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE) {
-		error("ssh_rsa_verify: RSA modulus too small: %d < minimum %d bits",
-		    BN_num_bits(key->rsa->n), SSH_RSA_MINIMUM_MODULUS_SIZE);
-		return -1;
-	}
-	buffer_init(&b);
-	buffer_append(&b, signature, signaturelen);
-	ktype = buffer_get_string(&b, NULL);
-	if (strcmp("ssh-rsa", ktype) != 0) {
-		error("ssh_rsa_verify: cannot handle type %s", ktype);
-		buffer_free(&b);
-		xfree(ktype);
-		return -1;
-	}
-	xfree(ktype);
-	sigblob = buffer_get_string(&b, &len);
-	rlen = buffer_len(&b);
-	buffer_free(&b);
-	if (rlen != 0) {
-		error("ssh_rsa_verify: remaining bytes in signature %d", rlen);
-		xfree(sigblob);
-		return -1;
-	}
-	/* RSA_verify expects a signature of RSA_size */
-	modlen = RSA_size(key->rsa);
-	if (len > modlen) {
-		error("ssh_rsa_verify: len %u > modlen %u", len, modlen);
-		xfree(sigblob);
-		return -1;
-	} else if (len < modlen) {
-		u_int diff = modlen - len;
-		debug("ssh_rsa_verify: add padding: modlen %u > len %u",
-		    modlen, len);
-		sigblob = xrealloc(sigblob, modlen);
-		memmove(sigblob + diff, sigblob, len);
-		memset(sigblob, 0, diff);
-		len = modlen;
-	}
-	nid = (datafellows & SSH_BUG_RSASIGMD5) ? NID_md5 : NID_sha1;
-	if ((evp_md = EVP_get_digestbynid(nid)) == NULL) {
-		error("ssh_rsa_verify: EVP_get_digestbynid %d failed", nid);
-		xfree(sigblob);
-		return -1;
-	}
-	EVP_DigestInit(&md, evp_md);
-	EVP_DigestUpdate(&md, data, datalen);
-	EVP_DigestFinal(&md, digest, &dlen);
-
-	ret = openssh_RSA_verify(nid, digest, dlen, sigblob, len, key->rsa);
-	memset(digest, 'd', sizeof(digest));
-	memset(sigblob, 's', len);
-	xfree(sigblob);
-	debug("ssh_rsa_verify: signature %scorrect", (ret==0) ? "in" : "");
-	return ret;
-}
-
-/*
- * See:
- * http://www.rsasecurity.com/rsalabs/pkcs/pkcs-1/
- * ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1.asn
- */
-/*
- * id-sha1 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3)
- *	oiw(14) secsig(3) algorithms(2) 26 }
- */
-static const u_char id_sha1[] = {
-	0x30, 0x21, /* type Sequence, length 0x21 (33) */
-	0x30, 0x09, /* type Sequence, length 0x09 */
-	0x06, 0x05, /* type OID, length 0x05 */
-	0x2b, 0x0e, 0x03, 0x02, 0x1a, /* id-sha1 OID */
-	0x05, 0x00, /* NULL */
-	0x04, 0x14  /* Octet string, length 0x14 (20), followed by sha1 hash */
-};
-/*
- * id-md5 OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840)
- *	rsadsi(113549) digestAlgorithm(2) 5 }
- */
-static const u_char id_md5[] = {
-	0x30, 0x20, /* type Sequence, length 0x20 (32) */
-	0x30, 0x0c, /* type Sequence, length 0x09 */
-	0x06, 0x08, /* type OID, length 0x05 */
-	0x2a, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x02, 0x05, /* id-md5 */
-	0x05, 0x00, /* NULL */
-	0x04, 0x10  /* Octet string, length 0x10 (16), followed by md5 hash */
-};
-
-static int
-openssh_RSA_verify(int type, u_char *hash, u_int hashlen,
-    u_char *sigbuf, u_int siglen, RSA *rsa)
-{
-	u_int ret, rsasize, oidlen = 0, hlen = 0;
-	int len;
-	const u_char *oid = NULL;
-	u_char *decrypted = NULL;
-
-	ret = 0;
-	switch (type) {
-	case NID_sha1:
-		oid = id_sha1;
-		oidlen = sizeof(id_sha1);
-		hlen = 20;
-		break;
-	case NID_md5:
-		oid = id_md5;
-		oidlen = sizeof(id_md5);
-		hlen = 16;
-		break;
-	default:
-		goto done;
-		break;
-	}
-	if (hashlen != hlen) {
-		error("bad hashlen");
-		goto done;
-	}
-	rsasize = RSA_size(rsa);
-	if (siglen == 0 || siglen > rsasize) {
-		error("bad siglen");
-		goto done;
-	}
-	decrypted = xmalloc(rsasize);
-	if ((len = RSA_public_decrypt(siglen, sigbuf, decrypted, rsa,
-	    RSA_PKCS1_PADDING)) < 0) {
-		error("RSA_public_decrypt failed: %s",
-		    ERR_error_string(ERR_get_error(), NULL));
-		goto done;
-	}
-	if (len != hlen + oidlen) {
-		error("bad decrypted len: %d != %d + %d", len, hlen, oidlen);
-		goto done;
-	}
-	if (memcmp(decrypted, oid, oidlen) != 0) {
-		error("oid mismatch");
-		goto done;
-	}
-	if (memcmp(decrypted + oidlen, hash, hlen) != 0) {
-		error("hash mismatch");
-		goto done;
-	}
-	ret = 1;
-done:
-	if (decrypted)
-		xfree(decrypted);
-	return ret;
-}
diff --git a/crypto/openssh/ssh-rsa.h b/crypto/openssh/ssh-rsa.h
deleted file mode 100644
index 7177a3f92113..000000000000
--- a/crypto/openssh/ssh-rsa.h
+++ /dev/null
@@ -1,32 +0,0 @@
-/*	$OpenBSD: ssh-rsa.h,v 1.6 2002/02/24 19:14:59 markus Exp $	*/
-
-/*
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#ifndef SSH_RSA_H
-#define SSH_RSA_H
-
-int	 ssh_rsa_sign(Key *, u_char **, u_int *, u_char *, u_int);
-int	 ssh_rsa_verify(Key *, u_char *, u_int, u_char *, u_int);
-
-#endif
diff --git a/crypto/openssh/ssh.1 b/crypto/openssh/ssh.1
deleted file mode 100644
index fd822bb3d38b..000000000000
--- a/crypto/openssh/ssh.1
+++ /dev/null
@@ -1,991 +0,0 @@
-.\"  -*- nroff -*-
-.\"
-.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
-.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
-.\"                    All rights reserved
-.\"
-.\" As far as I am concerned, the code I have written for this software
-.\" can be used freely for any purpose.  Any derived versions of this
-.\" software must be clearly marked as such, and if the derived work is
-.\" incompatible with the protocol description in the RFC file, it must be
-.\" called by a name other than "ssh" or "Secure Shell".
-.\"
-.\" Copyright (c) 1999,2000 Markus Friedl.  All rights reserved.
-.\" Copyright (c) 1999 Aaron Campbell.  All rights reserved.
-.\" Copyright (c) 1999 Theo de Raadt.  All rights reserved.
-.\"
-.\" Redistribution and use in source and binary forms, with or without
-.\" modification, are permitted provided that the following conditions
-.\" are met:
-.\" 1. Redistributions of source code must retain the above copyright
-.\"    notice, this list of conditions and the following disclaimer.
-.\" 2. Redistributions in binary form must reproduce the above copyright
-.\"    notice, this list of conditions and the following disclaimer in the
-.\"    documentation and/or other materials provided with the distribution.
-.\"
-.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-.\"
-.\" $OpenBSD: ssh.1,v 1.168 2003/03/28 10:11:43 jmc Exp $
-.Dd September 25, 1999
-.Dt SSH 1
-.Os
-.Sh NAME
-.Nm ssh
-.Nd OpenSSH SSH client (remote login program)
-.Sh SYNOPSIS
-.Nm ssh
-.Op Fl l Ar login_name
-.Ar hostname | user@hostname
-.Op Ar command
-.Pp
-.Nm ssh
-.Bk -words
-.Op Fl afgknqstvxACNTX1246
-.Op Fl b Ar bind_address
-.Op Fl c Ar cipher_spec
-.Op Fl e Ar escape_char
-.Op Fl i Ar identity_file
-.Op Fl l Ar login_name
-.Op Fl m Ar mac_spec
-.Op Fl o Ar option
-.Op Fl p Ar port
-.Op Fl F Ar configfile
-.Oo Fl L Xo
-.Sm off
-.Ar port :
-.Ar host :
-.Ar hostport
-.Sm on
-.Xc
-.Oc
-.Ek
-.Bk -words
-.Oo Fl R Xo
-.Sm off
-.Ar port :
-.Ar host :
-.Ar hostport
-.Sm on
-.Xc
-.Oc
-.Op Fl D Ar port
-.Ar hostname | user@hostname
-.Op Ar command
-.Ek
-.Sh DESCRIPTION
-.Nm
-(SSH client) is a program for logging into a remote machine and for
-executing commands on a remote machine.
-It is intended to replace
-rlogin and rsh, and provide secure encrypted communications between
-two untrusted hosts over an insecure network.
-X11 connections and
-arbitrary TCP/IP ports can also be forwarded over the secure channel.
-.Pp
-.Nm
-connects and logs into the specified
-.Ar hostname .
-The user must prove
-his/her identity to the remote machine using one of several methods
-depending on the protocol version used:
-.Pp
-.Ss SSH protocol version 1
-.Pp
-First, if the machine the user logs in from is listed in
-.Pa /etc/hosts.equiv
-or
-.Pa /etc/shosts.equiv
-on the remote machine, and the user names are
-the same on both sides, the user is immediately permitted to log in.
-Second, if
-.Pa \&.rhosts
-or
-.Pa \&.shosts
-exists in the user's home directory on the
-remote machine and contains a line containing the name of the client
-machine and the name of the user on that machine, the user is
-permitted to log in.
-This form of authentication alone is normally not
-allowed by the server because it is not secure.
-.Pp
-The second authentication method is the
-.Pa rhosts
-or
-.Pa hosts.equiv
-method combined with RSA-based host authentication.
-It means that if the login would be permitted by
-.Pa $HOME/.rhosts ,
-.Pa $HOME/.shosts ,
-.Pa /etc/hosts.equiv ,
-or
-.Pa /etc/shosts.equiv ,
-and if additionally the server can verify the client's
-host key (see
-.Pa /etc/ssh/ssh_known_hosts
-and
-.Pa $HOME/.ssh/known_hosts
-in the
-.Sx FILES
-section), only then login is permitted.
-This authentication method closes security holes due to IP
-spoofing, DNS spoofing and routing spoofing.
-[Note to the administrator:
-.Pa /etc/hosts.equiv ,
-.Pa $HOME/.rhosts ,
-and the rlogin/rsh protocol in general, are inherently insecure and should be
-disabled if security is desired.]
-.Pp
-As a third authentication method,
-.Nm
-supports RSA based authentication.
-The scheme is based on public-key cryptography: there are cryptosystems
-where encryption and decryption are done using separate keys, and it
-is not possible to derive the decryption key from the encryption key.
-RSA is one such system.
-The idea is that each user creates a public/private
-key pair for authentication purposes.
-The server knows the public key, and only the user knows the private key.
-The file
-.Pa $HOME/.ssh/authorized_keys
-lists the public keys that are permitted for logging
-in.
-When the user logs in, the
-.Nm
-program tells the server which key pair it would like to use for
-authentication.
-The server checks if this key is permitted, and if
-so, sends the user (actually the
-.Nm
-program running on behalf of the user) a challenge, a random number,
-encrypted by the user's public key.
-The challenge can only be
-decrypted using the proper private key.
-The user's client then decrypts the
-challenge using the private key, proving that he/she knows the private
-key but without disclosing it to the server.
-.Pp
-.Nm
-implements the RSA authentication protocol automatically.
-The user creates his/her RSA key pair by running
-.Xr ssh-keygen 1 .
-This stores the private key in
-.Pa $HOME/.ssh/identity
-and the public key in
-.Pa $HOME/.ssh/identity.pub
-in the user's home directory.
-The user should then copy the
-.Pa identity.pub
-to
-.Pa $HOME/.ssh/authorized_keys
-in his/her home directory on the remote machine (the
-.Pa authorized_keys
-file corresponds to the conventional
-.Pa $HOME/.rhosts
-file, and has one key
-per line, though the lines can be very long).
-After this, the user can log in without giving the password.
-RSA authentication is much
-more secure than rhosts authentication.
-.Pp
-The most convenient way to use RSA authentication may be with an
-authentication agent.
-See
-.Xr ssh-agent 1
-for more information.
-.Pp
-If other authentication methods fail,
-.Nm
-prompts the user for a password.
-The password is sent to the remote
-host for checking; however, since all communications are encrypted,
-the password cannot be seen by someone listening on the network.
-.Pp
-.Ss SSH protocol version 2
-.Pp
-When a user connects using protocol version 2
-similar authentication methods are available.
-Using the default values for
-.Cm PreferredAuthentications ,
-the client will try to authenticate first using the hostbased method;
-if this method fails public key authentication is attempted,
-and finally if this method fails keyboard-interactive and
-password authentication are tried.
-.Pp
-The public key method is similar to RSA authentication described
-in the previous section and allows the RSA or DSA algorithm to be used:
-The client uses his private key,
-.Pa $HOME/.ssh/id_dsa
-or
-.Pa $HOME/.ssh/id_rsa ,
-to sign the session identifier and sends the result to the server.
-The server checks whether the matching public key is listed in
-.Pa $HOME/.ssh/authorized_keys
-and grants access if both the key is found and the signature is correct.
-The session identifier is derived from a shared Diffie-Hellman value
-and is only known to the client and the server.
-.Pp
-If public key authentication fails or is not available a password
-can be sent encrypted to the remote host for proving the user's identity.
-.Pp
-Additionally,
-.Nm
-supports hostbased or challenge response authentication.
-.Pp
-Protocol 2 provides additional mechanisms for confidentiality
-(the traffic is encrypted using 3DES, Blowfish, CAST128 or Arcfour)
-and integrity (hmac-md5, hmac-sha1).
-Note that protocol 1 lacks a strong mechanism for ensuring the
-integrity of the connection.
-.Pp
-.Ss Login session and remote execution
-.Pp
-When the user's identity has been accepted by the server, the server
-either executes the given command, or logs into the machine and gives
-the user a normal shell on the remote machine.
-All communication with
-the remote command or shell will be automatically encrypted.
-.Pp
-If a pseudo-terminal has been allocated (normal login session), the
-user may use the escape characters noted below.
-.Pp
-If no pseudo tty has been allocated, the
-session is transparent and can be used to reliably transfer binary
-data.
-On most systems, setting the escape character to
-.Dq none
-will also make the session transparent even if a tty is used.
-.Pp
-The session terminates when the command or shell on the remote
-machine exits and all X11 and TCP/IP connections have been closed.
-The exit status of the remote program is returned as the exit status
-of
-.Nm ssh .
-.Pp
-.Ss Escape Characters
-.Pp
-When a pseudo terminal has been requested, ssh supports a number of functions
-through the use of an escape character.
-.Pp
-A single tilde character can be sent as
-.Ic ~~
-or by following the tilde by a character other than those described below.
-The escape character must always follow a newline to be interpreted as
-special.
-The escape character can be changed in configuration files using the
-.Cm EscapeChar
-configuration directive or on the command line by the
-.Fl e
-option.
-.Pp
-The supported escapes (assuming the default
-.Ql ~ )
-are:
-.Bl -tag -width Ds
-.It Cm ~.
-Disconnect
-.It Cm ~^Z
-Background ssh
-.It Cm ~#
-List forwarded connections
-.It Cm ~&
-Background ssh at logout when waiting for forwarded connection / X11 sessions
-to terminate
-.It Cm ~?
-Display a list of escape characters
-.It Cm ~C
-Open command line (only useful for adding port forwardings using the
-.Fl L
-and
-.Fl R
-options)
-.It Cm ~R
-Request rekeying of the connection (only useful for SSH protocol version 2
-and if the peer supports it)
-.El
-.Pp
-.Ss X11 and TCP forwarding
-.Pp
-If the
-.Cm ForwardX11
-variable is set to
-.Dq yes
-(or, see the description of the
-.Fl X
-and
-.Fl x
-options described later)
-and the user is using X11 (the
-.Ev DISPLAY
-environment variable is set), the connection to the X11 display is
-automatically forwarded to the remote side in such a way that any X11
-programs started from the shell (or command) will go through the
-encrypted channel, and the connection to the real X server will be made
-from the local machine.
-The user should not manually set
-.Ev DISPLAY .
-Forwarding of X11 connections can be
-configured on the command line or in configuration files.
-.Pp
-The
-.Ev DISPLAY
-value set by
-.Nm
-will point to the server machine, but with a display number greater
-than zero.
-This is normal, and happens because
-.Nm
-creates a
-.Dq proxy
-X server on the server machine for forwarding the
-connections over the encrypted channel.
-.Pp
-.Nm
-will also automatically set up Xauthority data on the server machine.
-For this purpose, it will generate a random authorization cookie,
-store it in Xauthority on the server, and verify that any forwarded
-connections carry this cookie and replace it by the real cookie when
-the connection is opened.
-The real authentication cookie is never
-sent to the server machine (and no cookies are sent in the plain).
-.Pp
-If the
-.Cm ForwardAgent
-variable is set to
-.Dq yes
-(or, see the description of the
-.Fl A
-and
-.Fl a
-options described later) and
-the user is using an authentication agent, the connection to the agent
-is automatically forwarded to the remote side.
-.Pp
-Forwarding of arbitrary TCP/IP connections over the secure channel can
-be specified either on the command line or in a configuration file.
-One possible application of TCP/IP forwarding is a secure connection to an
-electronic purse; another is going through firewalls.
-.Pp
-.Ss Server authentication
-.Pp
-.Nm
-automatically maintains and checks a database containing
-identifications for all hosts it has ever been used with.
-Host keys are stored in
-.Pa $HOME/.ssh/known_hosts
-in the user's home directory.
-Additionally, the file
-.Pa /etc/ssh/ssh_known_hosts
-is automatically checked for known hosts.
-Any new hosts are automatically added to the user's file.
-If a host's identification
-ever changes,
-.Nm
-warns about this and disables password authentication to prevent a
-trojan horse from getting the user's password.
-Another purpose of
-this mechanism is to prevent man-in-the-middle attacks which could
-otherwise be used to circumvent the encryption.
-The
-.Cm StrictHostKeyChecking
-option can be used to prevent logins to machines whose
-host key is not known or has changed.
-.Pp
-The options are as follows:
-.Bl -tag -width Ds
-.It Fl a
-Disables forwarding of the authentication agent connection.
-.It Fl A
-Enables forwarding of the authentication agent connection.
-This can also be specified on a per-host basis in a configuration file.
-.Pp
-Agent forwarding should be enabled with caution.
-Users with the ability to bypass file permissions on the remote host
-(for the agent's Unix-domain socket)
-can access the local agent through the forwarded connection.
-An attacker cannot obtain key material from the agent,
-however they can perform operations on the keys that enable them to
-authenticate using the identities loaded into the agent.
-.It Fl b Ar bind_address
-Specify the interface to transmit from on machines with multiple
-interfaces or aliased addresses.
-.It Fl c Ar blowfish|3des|des
-Selects the cipher to use for encrypting the session.
-.Ar 3des
-is used by default.
-It is believed to be secure.
-.Ar 3des
-(triple-des) is an encrypt-decrypt-encrypt triple with three different keys.
-.Ar blowfish
-is a fast block cipher, it appears very secure and is much faster than
-.Ar 3des .
-.Ar des
-is only supported in the
-.Nm
-client for interoperability with legacy protocol 1 implementations
-that do not support the
-.Ar 3des
-cipher.
-Its use is strongly discouraged due to cryptographic weaknesses.
-.It Fl c Ar cipher_spec
-Additionally, for protocol version 2 a comma-separated list of ciphers can
-be specified in order of preference.
-See
-.Cm Ciphers
-for more information.
-.It Fl e Ar ch|^ch|none
-Sets the escape character for sessions with a pty (default:
-.Ql ~ ) .
-The escape character is only recognized at the beginning of a line.
-The escape character followed by a dot
-.Pq Ql \&.
-closes the connection, followed
-by control-Z suspends the connection, and followed by itself sends the
-escape character once.
-Setting the character to
-.Dq none
-disables any escapes and makes the session fully transparent.
-.It Fl f
-Requests
-.Nm
-to go to background just before command execution.
-This is useful if
-.Nm
-is going to ask for passwords or passphrases, but the user
-wants it in the background.
-This implies
-.Fl n .
-The recommended way to start X11 programs at a remote site is with
-something like
-.Ic ssh -f host xterm .
-.It Fl g
-Allows remote hosts to connect to local forwarded ports.
-.It Fl i Ar identity_file
-Selects a file from which the identity (private key) for
-RSA or DSA authentication is read.
-The default is
-.Pa $HOME/.ssh/identity
-for protocol version 1, and
-.Pa $HOME/.ssh/id_rsa
-and
-.Pa $HOME/.ssh/id_dsa
-for protocol version 2.
-Identity files may also be specified on
-a per-host basis in the configuration file.
-It is possible to have multiple
-.Fl i
-options (and multiple identities specified in
-configuration files).
-.It Fl I Ar smartcard_device
-Specifies which smartcard device to use. The argument is
-the device
-.Nm
-should use to communicate with a smartcard used for storing the user's
-private RSA key.
-.It Fl k
-Disables forwarding of Kerberos tickets and AFS tokens.
-This may also be specified on a per-host basis in the configuration file.
-.It Fl l Ar login_name
-Specifies the user to log in as on the remote machine.
-This also may be specified on a per-host basis in the configuration file.
-.It Fl m Ar mac_spec
-Additionally, for protocol version 2 a comma-separated list of MAC
-(message authentication code) algorithms can
-be specified in order of preference.
-See the
-.Cm MACs
-keyword for more information.
-.It Fl n
-Redirects stdin from
-.Pa /dev/null
-(actually, prevents reading from stdin).
-This must be used when
-.Nm
-is run in the background.
-A common trick is to use this to run X11 programs on a remote machine.
-For example,
-.Ic ssh -n shadows.cs.hut.fi emacs &
-will start an emacs on shadows.cs.hut.fi, and the X11
-connection will be automatically forwarded over an encrypted channel.
-The
-.Nm
-program will be put in the background.
-(This does not work if
-.Nm
-needs to ask for a password or passphrase; see also the
-.Fl f
-option.)
-.It Fl N
-Do not execute a remote command.
-This is useful for just forwarding ports
-(protocol version 2 only).
-.It Fl o Ar option
-Can be used to give options in the format used in the configuration file.
-This is useful for specifying options for which there is no separate
-command-line flag.
-.It Fl p Ar port
-Port to connect to on the remote host.
-This can be specified on a
-per-host basis in the configuration file.
-.It Fl q
-Quiet mode.
-Causes all warning and diagnostic messages to be suppressed.
-.It Fl s
-May be used to request invocation of a subsystem on the remote system. Subsystems are a feature of the SSH2 protocol which facilitate the use
-of SSH as a secure transport for other applications (eg. sftp). The
-subsystem is specified as the remote command.
-.It Fl t
-Force pseudo-tty allocation.
-This can be used to execute arbitrary
-screen-based programs on a remote machine, which can be very useful,
-e.g., when implementing menu services.
-Multiple
-.Fl t
-options force tty allocation, even if
-.Nm
-has no local tty.
-.It Fl T
-Disable pseudo-tty allocation.
-.It Fl v
-Verbose mode.
-Causes
-.Nm
-to print debugging messages about its progress.
-This is helpful in
-debugging connection, authentication, and configuration problems.
-Multiple
-.Fl v
-options increases the verbosity.
-Maximum is 3.
-.It Fl x
-Disables X11 forwarding.
-.It Fl X
-Enables X11 forwarding.
-This can also be specified on a per-host basis in a configuration file.
-.Pp
-X11 forwarding should be enabled with caution.
-Users with the ability to bypass file permissions on the remote host
-(for the user's X authorization database)
-can access the local X11 display through the forwarded connection.
-An attacker may then be able to perform activities such as keystroke monitoring.
-.It Fl C
-Requests compression of all data (including stdin, stdout, stderr, and
-data for forwarded X11 and TCP/IP connections).
-The compression algorithm is the same used by
-.Xr gzip 1 ,
-and the
-.Dq level
-can be controlled by the
-.Cm CompressionLevel
-option for protocol version 1.
-Compression is desirable on modem lines and other
-slow connections, but will only slow down things on fast networks.
-The default value can be set on a host-by-host basis in the
-configuration files; see the
-.Cm Compression
-option.
-.It Fl F Ar configfile
-Specifies an alternative per-user configuration file.
-If a configuration file is given on the command line,
-the system-wide configuration file
-.Pq Pa /etc/ssh/ssh_config
-will be ignored.
-The default for the per-user configuration file is
-.Pa $HOME/.ssh/config .
-.It Fl L Ar port:host:hostport
-Specifies that the given port on the local (client) host is to be
-forwarded to the given host and port on the remote side.
-This works by allocating a socket to listen to
-.Ar port
-on the local side, and whenever a connection is made to this port, the
-connection is forwarded over the secure channel, and a connection is
-made to
-.Ar host
-port
-.Ar hostport
-from the remote machine.
-Port forwardings can also be specified in the configuration file.
-Only root can forward privileged ports.
-IPv6 addresses can be specified with an alternative syntax:
-.Ar port/host/hostport
-.It Fl R Ar port:host:hostport
-Specifies that the given port on the remote (server) host is to be
-forwarded to the given host and port on the local side.
-This works by allocating a socket to listen to
-.Ar port
-on the remote side, and whenever a connection is made to this port, the
-connection is forwarded over the secure channel, and a connection is
-made to
-.Ar host
-port
-.Ar hostport
-from the local machine.
-Port forwardings can also be specified in the configuration file.
-Privileged ports can be forwarded only when
-logging in as root on the remote machine.
-IPv6 addresses can be specified with an alternative syntax:
-.Ar port/host/hostport
-.It Fl D Ar port
-Specifies a local
-.Dq dynamic
-application-level port forwarding.
-This works by allocating a socket to listen to
-.Ar port
-on the local side, and whenever a connection is made to this port, the
-connection is forwarded over the secure channel, and the application
-protocol is then used to determine where to connect to from the
-remote machine.
-Currently the SOCKS4 protocol is supported, and
-.Nm
-will act as a SOCKS4 server.
-Only root can forward privileged ports.
-Dynamic port forwardings can also be specified in the configuration file.
-.It Fl 1
-Forces
-.Nm
-to try protocol version 1 only.
-.It Fl 2
-Forces
-.Nm
-to try protocol version 2 only.
-.It Fl 4
-Forces
-.Nm
-to use IPv4 addresses only.
-.It Fl 6
-Forces
-.Nm
-to use IPv6 addresses only.
-.El
-.Sh CONFIGURATION FILES
-.Nm
-may additionally obtain configuration data from
-a per-user configuration file and a system-wide configuration file.
-The file format and configuration options are described in
-.Xr ssh_config 5 .
-.Sh ENVIRONMENT
-.Nm
-will normally set the following environment variables:
-.Bl -tag -width Ds
-.It Ev DISPLAY
-The
-.Ev DISPLAY
-variable indicates the location of the X11 server.
-It is automatically set by
-.Nm
-to point to a value of the form
-.Dq hostname:n
-where hostname indicates
-the host where the shell runs, and n is an integer >= 1.
-.Nm
-uses this special value to forward X11 connections over the secure
-channel.
-The user should normally not set
-.Ev DISPLAY
-explicitly, as that
-will render the X11 connection insecure (and will require the user to
-manually copy any required authorization cookies).
-.It Ev HOME
-Set to the path of the user's home directory.
-.It Ev LOGNAME
-Synonym for
-.Ev USER ;
-set for compatibility with systems that use this variable.
-.It Ev MAIL
-Set to the path of the user's mailbox.
-.It Ev PATH
-Set to the default
-.Ev PATH ,
-as specified when compiling
-.Nm ssh .
-.It Ev SSH_ASKPASS
-If
-.Nm
-needs a passphrase, it will read the passphrase from the current
-terminal if it was run from a terminal.
-If
-.Nm
-does not have a terminal associated with it but
-.Ev DISPLAY
-and
-.Ev SSH_ASKPASS
-are set, it will execute the program specified by
-.Ev SSH_ASKPASS
-and open an X11 window to read the passphrase.
-This is particularly useful when calling
-.Nm
-from a
-.Pa .Xsession
-or related script.
-(Note that on some machines it
-may be necessary to redirect the input from
-.Pa /dev/null
-to make this work.)
-.It Ev SSH_AUTH_SOCK
-Identifies the path of a unix-domain socket used to communicate with the
-agent.
-.It Ev SSH_CONNECTION
-Identifies the client and server ends of the connection.
-The variable contains
-four space-separated values: client ip-address, client port number,
-server ip-address and server port number.
-.It Ev SSH_ORIGINAL_COMMAND
-The variable contains the original command line if a forced command
-is executed.
-It can be used to extract the original arguments.
-.It Ev SSH_TTY
-This is set to the name of the tty (path to the device) associated
-with the current shell or command.
-If the current session has no tty,
-this variable is not set.
-.It Ev TZ
-The timezone variable is set to indicate the present timezone if it
-was set when the daemon was started (i.e., the daemon passes the value
-on to new connections).
-.It Ev USER
-Set to the name of the user logging in.
-.El
-.Pp
-Additionally,
-.Nm
-reads
-.Pa $HOME/.ssh/environment ,
-and adds lines of the format
-.Dq VARNAME=value
-to the environment if the file exists and if users are allowed to
-change their environment.
-See the
-.Cm PermitUserEnvironment
-option in
-.Xr sshd_config 5 .
-.Sh FILES
-.Bl -tag -width Ds
-.It Pa $HOME/.ssh/known_hosts
-Records host keys for all hosts the user has logged into that are not
-in
-.Pa /etc/ssh/ssh_known_hosts .
-See
-.Xr sshd 8 .
-.It Pa $HOME/.ssh/identity, $HOME/.ssh/id_dsa, $HOME/.ssh/id_rsa
-Contains the authentication identity of the user.
-They are for protocol 1 RSA, protocol 2 DSA, and protocol 2 RSA, respectively.
-These files
-contain sensitive data and should be readable by the user but not
-accessible by others (read/write/execute).
-Note that
-.Nm
-ignores a private key file if it is accessible by others.
-It is possible to specify a passphrase when
-generating the key; the passphrase will be used to encrypt the
-sensitive part of this file using 3DES.
-.It Pa $HOME/.ssh/identity.pub, $HOME/.ssh/id_dsa.pub, $HOME/.ssh/id_rsa.pub
-Contains the public key for authentication (public part of the
-identity file in human-readable form).
-The contents of the
-.Pa $HOME/.ssh/identity.pub
-file should be added to
-.Pa $HOME/.ssh/authorized_keys
-on all machines
-where the user wishes to log in using protocol version 1 RSA authentication.
-The contents of the
-.Pa $HOME/.ssh/id_dsa.pub
-and
-.Pa $HOME/.ssh/id_rsa.pub
-file should be added to
-.Pa $HOME/.ssh/authorized_keys
-on all machines
-where the user wishes to log in using protocol version 2 DSA/RSA authentication.
-These files are not
-sensitive and can (but need not) be readable by anyone.
-These files are
-never used automatically and are not necessary; they are only provided for
-the convenience of the user.
-.It Pa $HOME/.ssh/config
-This is the per-user configuration file.
-The file format and configuration options are described in
-.Xr ssh_config 5 .
-.It Pa $HOME/.ssh/authorized_keys
-Lists the public keys (RSA/DSA) that can be used for logging in as this user.
-The format of this file is described in the
-.Xr sshd 8
-manual page.
-In the simplest form the format is the same as the .pub
-identity files.
-This file is not highly sensitive, but the recommended
-permissions are read/write for the user, and not accessible by others.
-.It Pa /etc/ssh/ssh_known_hosts
-Systemwide list of known host keys.
-This file should be prepared by the
-system administrator to contain the public host keys of all machines in the
-organization.
-This file should be world-readable.
-This file contains
-public keys, one per line, in the following format (fields separated
-by spaces): system name, public key and optional comment field.
-When different names are used
-for the same machine, all such names should be listed, separated by
-commas.
-The format is described on the
-.Xr sshd 8
-manual page.
-.Pp
-The canonical system name (as returned by name servers) is used by
-.Xr sshd 8
-to verify the client host when logging in; other names are needed because
-.Nm
-does not convert the user-supplied name to a canonical name before
-checking the key, because someone with access to the name servers
-would then be able to fool host authentication.
-.It Pa /etc/ssh/ssh_config
-Systemwide configuration file.
-The file format and configuration options are described in
-.Xr ssh_config 5 .
-.It Pa /etc/ssh/ssh_host_key, /etc/ssh/ssh_host_dsa_key, /etc/ssh/ssh_host_rsa_key
-These three files contain the private parts of the host keys
-and are used for
-.Cm RhostsRSAAuthentication
-and
-.Cm HostbasedAuthentication .
-If the protocol version 1
-.Cm RhostsRSAAuthentication
-method is used,
-.Nm
-must be setuid root, since the host key is readable only by root.
-For protocol version 2,
-.Nm
-uses
-.Xr ssh-keysign 8
-to access the host keys for
-.Cm HostbasedAuthentication .
-This eliminates the requirement that
-.Nm
-be setuid root when that authentication method is used.
-By default
-.Nm
-is not setuid root.
-.It Pa $HOME/.rhosts
-This file is used in
-.Pa \&.rhosts
-authentication to list the
-host/user pairs that are permitted to log in.
-(Note that this file is
-also used by rlogin and rsh, which makes using this file insecure.)
-Each line of the file contains a host name (in the canonical form
-returned by name servers), and then a user name on that host,
-separated by a space.
-On some machines this file may need to be
-world-readable if the user's home directory is on a NFS partition,
-because
-.Xr sshd 8
-reads it as root.
-Additionally, this file must be owned by the user,
-and must not have write permissions for anyone else.
-The recommended
-permission for most machines is read/write for the user, and not
-accessible by others.
-.Pp
-Note that by default
-.Xr sshd 8
-will be installed so that it requires successful RSA host
-authentication before permitting \s+2.\s0rhosts authentication.
-If the server machine does not have the client's host key in
-.Pa /etc/ssh/ssh_known_hosts ,
-it can be stored in
-.Pa $HOME/.ssh/known_hosts .
-The easiest way to do this is to
-connect back to the client from the server machine using ssh; this
-will automatically add the host key to
-.Pa $HOME/.ssh/known_hosts .
-.It Pa $HOME/.shosts
-This file is used exactly the same way as
-.Pa \&.rhosts .
-The purpose for
-having this file is to be able to use rhosts authentication with
-.Nm
-without permitting login with
-.Nm rlogin
-or
-.Xr rsh 1 .
-.It Pa /etc/hosts.equiv
-This file is used during
-.Pa \&.rhosts authentication.
-It contains
-canonical hosts names, one per line (the full format is described on
-the
-.Xr sshd 8
-manual page).
-If the client host is found in this file, login is
-automatically permitted provided client and server user names are the
-same.
-Additionally, successful RSA host authentication is normally
-required.
-This file should only be writable by root.
-.It Pa /etc/shosts.equiv
-This file is processed exactly as
-.Pa /etc/hosts.equiv .
-This file may be useful to permit logins using
-.Nm
-but not using rsh/rlogin.
-.It Pa /etc/ssh/sshrc
-Commands in this file are executed by
-.Nm
-when the user logs in just before the user's shell (or command) is started.
-See the
-.Xr sshd 8
-manual page for more information.
-.It Pa $HOME/.ssh/rc
-Commands in this file are executed by
-.Nm
-when the user logs in just before the user's shell (or command) is
-started.
-See the
-.Xr sshd 8
-manual page for more information.
-.It Pa $HOME/.ssh/environment
-Contains additional definitions for environment variables, see section
-.Sx ENVIRONMENT
-above.
-.El
-.Sh DIAGNOSTICS
-.Nm
-exits with the exit status of the remote command or with 255
-if an error occurred.
-.Sh AUTHORS
-OpenSSH is a derivative of the original and free
-ssh 1.2.12 release by Tatu Ylonen.
-Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos,
-Theo de Raadt and Dug Song
-removed many bugs, re-added newer features and
-created OpenSSH.
-Markus Friedl contributed the support for SSH
-protocol versions 1.5 and 2.0.
-.Sh SEE ALSO
-.Xr rsh 1 ,
-.Xr scp 1 ,
-.Xr sftp 1 ,
-.Xr ssh-add 1 ,
-.Xr ssh-agent 1 ,
-.Xr ssh-keygen 1 ,
-.Xr telnet 1 ,
-.Xr ssh_config 5 ,
-.Xr ssh-keysign 8 ,
-.Xr sshd 8
-.Rs
-.%A T. Ylonen
-.%A T. Kivinen
-.%A M. Saarinen
-.%A T. Rinne
-.%A S. Lehtinen
-.%T "SSH Protocol Architecture"
-.%N draft-ietf-secsh-architecture-12.txt
-.%D January 2002
-.%O work in progress material
-.Re
diff --git a/crypto/openssh/ssh.c b/crypto/openssh/ssh.c
deleted file mode 100644
index 7206043941f7..000000000000
--- a/crypto/openssh/ssh.c
+++ /dev/null
@@ -1,1205 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * Ssh client program.  This program can be used to log into a remote machine.
- * The software supports strong authentication, encryption, and forwarding
- * of X11, TCP/IP, and authentication connections.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- *
- * Copyright (c) 1999 Niels Provos.  All rights reserved.
- * Copyright (c) 2000, 2001, 2002 Markus Friedl.  All rights reserved.
- *
- * Modified to work with SSL by Niels Provos <provos@citi.umich.edu>
- * in Canada (German citizen).
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: ssh.c,v 1.190 2003/02/06 09:27:29 markus Exp $");
-
-#include <openssl/evp.h>
-#include <openssl/err.h>
-
-#include "ssh.h"
-#include "ssh1.h"
-#include "ssh2.h"
-#include "compat.h"
-#include "cipher.h"
-#include "xmalloc.h"
-#include "packet.h"
-#include "buffer.h"
-#include "channels.h"
-#include "key.h"
-#include "authfd.h"
-#include "authfile.h"
-#include "pathnames.h"
-#include "clientloop.h"
-#include "log.h"
-#include "readconf.h"
-#include "sshconnect.h"
-#include "tildexpand.h"
-#include "dispatch.h"
-#include "misc.h"
-#include "kex.h"
-#include "mac.h"
-#include "sshtty.h"
-
-#ifdef SMARTCARD
-#include "scard.h"
-#endif
-
-#ifdef HAVE___PROGNAME
-extern char *__progname;
-#else
-char *__progname;
-#endif
-
-/* Flag indicating whether IPv4 or IPv6.  This can be set on the command line.
-   Default value is AF_UNSPEC means both IPv4 and IPv6. */
-#ifdef IPV4_DEFAULT
-int IPv4or6 = AF_INET;
-#else
-int IPv4or6 = AF_UNSPEC;
-#endif
-
-/* Flag indicating whether debug mode is on.  This can be set on the command line. */
-int debug_flag = 0;
-
-/* Flag indicating whether a tty should be allocated */
-int tty_flag = 0;
-int no_tty_flag = 0;
-int force_tty_flag = 0;
-
-/* don't exec a shell */
-int no_shell_flag = 0;
-
-/*
- * Flag indicating that nothing should be read from stdin.  This can be set
- * on the command line.
- */
-int stdin_null_flag = 0;
-
-/*
- * Flag indicating that ssh should fork after authentication.  This is useful
- * so that the passphrase can be entered manually, and then ssh goes to the
- * background.
- */
-int fork_after_authentication_flag = 0;
-
-/*
- * General data structure for command line options and options configurable
- * in configuration files.  See readconf.h.
- */
-Options options;
-
-/* optional user configfile */
-char *config = NULL;
-
-/*
- * Name of the host we are connecting to.  This is the name given on the
- * command line, or the HostName specified for the user-supplied name in a
- * configuration file.
- */
-char *host;
-
-/* socket address the host resolves to */
-struct sockaddr_storage hostaddr;
-
-/* Private host keys. */
-Sensitive sensitive_data;
-
-/* Original real UID. */
-uid_t original_real_uid;
-uid_t original_effective_uid;
-
-/* command to be executed */
-Buffer command;
-
-/* Should we execute a command or invoke a subsystem? */
-int subsystem_flag = 0;
-
-/* # of replies received for global requests */
-static int client_global_request_id = 0;
-
-/* pid of proxycommand child process */
-pid_t proxy_command_pid = 0;
-
-/* Prints a help message to the user.  This function never returns. */
-
-static void
-usage(void)
-{
-	fprintf(stderr, "Usage: %s [options] host [command]\n", __progname);
-	fprintf(stderr, "Options:\n");
-	fprintf(stderr, "  -l user     Log in using this user name.\n");
-	fprintf(stderr, "  -n          Redirect input from " _PATH_DEVNULL ".\n");
-	fprintf(stderr, "  -F config   Config file (default: ~/%s).\n",
-	     _PATH_SSH_USER_CONFFILE);
-	fprintf(stderr, "  -A          Enable authentication agent forwarding.\n");
-	fprintf(stderr, "  -a          Disable authentication agent forwarding (default).\n");
-#ifdef AFS
-	fprintf(stderr, "  -k          Disable Kerberos ticket and AFS token forwarding.\n");
-#endif				/* AFS */
-	fprintf(stderr, "  -X          Enable X11 connection forwarding.\n");
-	fprintf(stderr, "  -x          Disable X11 connection forwarding (default).\n");
-	fprintf(stderr, "  -i file     Identity for public key authentication "
-	    "(default: ~/.ssh/identity)\n");
-#ifdef SMARTCARD
-	fprintf(stderr, "  -I reader   Set smartcard reader.\n");
-#endif
-	fprintf(stderr, "  -t          Tty; allocate a tty even if command is given.\n");
-	fprintf(stderr, "  -T          Do not allocate a tty.\n");
-	fprintf(stderr, "  -v          Verbose; display verbose debugging messages.\n");
-	fprintf(stderr, "              Multiple -v increases verbosity.\n");
-	fprintf(stderr, "  -V          Display version number only.\n");
-	fprintf(stderr, "  -q          Quiet; don't display any warning messages.\n");
-	fprintf(stderr, "  -f          Fork into background after authentication.\n");
-	fprintf(stderr, "  -e char     Set escape character; ``none'' = disable (default: ~).\n");
-
-	fprintf(stderr, "  -c cipher   Select encryption algorithm\n");
-	fprintf(stderr, "  -m macs     Specify MAC algorithms for protocol version 2.\n");
-	fprintf(stderr, "  -p port     Connect to this port.  Server must be on the same port.\n");
-	fprintf(stderr, "  -L listen-port:host:port   Forward local port to remote address\n");
-	fprintf(stderr, "  -R listen-port:host:port   Forward remote port to local address\n");
-	fprintf(stderr, "              These cause %s to listen for connections on a port, and\n", __progname);
-	fprintf(stderr, "              forward them to the other side by connecting to host:port.\n");
-	fprintf(stderr, "  -D port     Enable dynamic application-level port forwarding.\n");
-	fprintf(stderr, "  -C          Enable compression.\n");
-	fprintf(stderr, "  -N          Do not execute a shell or command.\n");
-	fprintf(stderr, "  -g          Allow remote hosts to connect to forwarded ports.\n");
-	fprintf(stderr, "  -1          Force protocol version 1.\n");
-	fprintf(stderr, "  -2          Force protocol version 2.\n");
-	fprintf(stderr, "  -4          Use IPv4 only.\n");
-	fprintf(stderr, "  -6          Use IPv6 only.\n");
-	fprintf(stderr, "  -o 'option' Process the option as if it was read from a configuration file.\n");
-	fprintf(stderr, "  -s          Invoke command (mandatory) as SSH2 subsystem.\n");
-	fprintf(stderr, "  -b addr     Local IP address.\n");
-	exit(1);
-}
-
-static int ssh_session(void);
-static int ssh_session2(void);
-static void load_public_identity_files(void);
-
-/*
- * Main program for the ssh client.
- */
-int
-main(int ac, char **av)
-{
-	int i, opt, exit_status;
-	u_short fwd_port, fwd_host_port;
-	char sfwd_port[6], sfwd_host_port[6];
-	char *p, *cp, buf[256];
-	struct stat st;
-	struct passwd *pw;
-	int dummy;
-	extern int optind, optreset;
-	extern char *optarg;
-
-	__progname = get_progname(av[0]);
-	init_rng();
-
-	/*
-	 * Save the original real uid.  It will be needed later (uid-swapping
-	 * may clobber the real uid).
-	 */
-	original_real_uid = getuid();
-	original_effective_uid = geteuid();
- 
-	/*
-	 * Use uid-swapping to give up root privileges for the duration of
-	 * option processing.  We will re-instantiate the rights when we are
-	 * ready to create the privileged port, and will permanently drop
-	 * them when the port has been created (actually, when the connection
-	 * has been made, as we may need to create the port several times).
-	 */
-	PRIV_END;
-
-#ifdef HAVE_SETRLIMIT
-	/* If we are installed setuid root be careful to not drop core. */
-	if (original_real_uid != original_effective_uid) {
-		struct rlimit rlim;
-		rlim.rlim_cur = rlim.rlim_max = 0;
-		if (setrlimit(RLIMIT_CORE, &rlim) < 0)
-			fatal("setrlimit failed: %.100s", strerror(errno));
-	}
-#endif
-	/* Get user data. */
-	pw = getpwuid(original_real_uid);
-	if (!pw) {
-		log("You don't exist, go away!");
-		exit(1);
-	}
-	/* Take a copy of the returned structure. */
-	pw = pwcopy(pw);
-
-	/*
-	 * Set our umask to something reasonable, as some files are created
-	 * with the default umask.  This will make them world-readable but
-	 * writable only by the owner, which is ok for all files for which we
-	 * don't set the modes explicitly.
-	 */
-	umask(022);
-
-	/* Initialize option structure to indicate that no values have been set. */
-	initialize_options(&options);
-
-	/* Parse command-line arguments. */
-	host = NULL;
-
-again:
-	while ((opt = getopt(ac, av,
-	    "1246ab:c:e:fgi:kl:m:no:p:qstvxACD:F:I:L:NPR:TVX")) != -1) {
-		switch (opt) {
-		case '1':
-			options.protocol = SSH_PROTO_1;
-			break;
-		case '2':
-			options.protocol = SSH_PROTO_2;
-			break;
-		case '4':
-			IPv4or6 = AF_INET;
-			break;
-		case '6':
-			IPv4or6 = AF_INET6;
-			break;
-		case 'n':
-			stdin_null_flag = 1;
-			break;
-		case 'f':
-			fork_after_authentication_flag = 1;
-			stdin_null_flag = 1;
-			break;
-		case 'x':
-			options.forward_x11 = 0;
-			break;
-		case 'X':
-			options.forward_x11 = 1;
-			break;
-		case 'g':
-			options.gateway_ports = 1;
-			break;
-		case 'P':	/* deprecated */
-			options.use_privileged_port = 0;
-			break;
-		case 'a':
-			options.forward_agent = 0;
-			break;
-		case 'A':
-			options.forward_agent = 1;
-			break;
-#ifdef AFS
-		case 'k':
-			options.kerberos_tgt_passing = 0;
-			options.afs_token_passing = 0;
-			break;
-#endif
-		case 'i':
-			if (stat(optarg, &st) < 0) {
-				fprintf(stderr, "Warning: Identity file %s "
-				    "does not exist.\n", optarg);
-				break;
-			}
-			if (options.num_identity_files >=
-			    SSH_MAX_IDENTITY_FILES)
-				fatal("Too many identity files specified "
-				    "(max %d)", SSH_MAX_IDENTITY_FILES);
-			options.identity_files[options.num_identity_files++] =
-			    xstrdup(optarg);
-			break;
-		case 'I':
-#ifdef SMARTCARD
-			options.smartcard_device = xstrdup(optarg);
-#else
-			fprintf(stderr, "no support for smartcards.\n");
-#endif
-			break;
-		case 't':
-			if (tty_flag)
-				force_tty_flag = 1;
-			tty_flag = 1;
-			break;
-		case 'v':
-			if (0 == debug_flag) {
-				debug_flag = 1;
-				options.log_level = SYSLOG_LEVEL_DEBUG1;
-			} else if (options.log_level < SYSLOG_LEVEL_DEBUG3) {
-				options.log_level++;
-				break;
-			} else
-				fatal("Too high debugging level.");
-			/* fallthrough */
-		case 'V':
-			fprintf(stderr,
-			    "%s, SSH protocols %d.%d/%d.%d, OpenSSL 0x%8.8lx\n",
-			    SSH_VERSION,
-			    PROTOCOL_MAJOR_1, PROTOCOL_MINOR_1,
-			    PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2,
-			    SSLeay());
-			if (opt == 'V')
-				exit(0);
-			break;
-		case 'q':
-			options.log_level = SYSLOG_LEVEL_QUIET;
-			break;
-		case 'e':
-			if (optarg[0] == '^' && optarg[2] == 0 &&
-			    (u_char) optarg[1] >= 64 &&
-			    (u_char) optarg[1] < 128)
-				options.escape_char = (u_char) optarg[1] & 31;
-			else if (strlen(optarg) == 1)
-				options.escape_char = (u_char) optarg[0];
-			else if (strcmp(optarg, "none") == 0)
-				options.escape_char = SSH_ESCAPECHAR_NONE;
-			else {
-				fprintf(stderr, "Bad escape character '%s'.\n",
-				    optarg);
-				exit(1);
-			}
-			break;
-		case 'c':
-			if (ciphers_valid(optarg)) {
-				/* SSH2 only */
-				options.ciphers = xstrdup(optarg);
-				options.cipher = SSH_CIPHER_ILLEGAL;
-			} else {
-				/* SSH1 only */
-				options.cipher = cipher_number(optarg);
-				if (options.cipher == -1) {
-					fprintf(stderr,
-					    "Unknown cipher type '%s'\n",
-					    optarg);
-					exit(1);
-				}
-				if (options.cipher == SSH_CIPHER_3DES)
-					options.ciphers = "3des-cbc";
-				else if (options.cipher == SSH_CIPHER_BLOWFISH)
-					options.ciphers = "blowfish-cbc";
-				else
-					options.ciphers = (char *)-1;
-			}
-			break;
-		case 'm':
-			if (mac_valid(optarg))
-				options.macs = xstrdup(optarg);
-			else {
-				fprintf(stderr, "Unknown mac type '%s'\n",
-				    optarg);
-				exit(1);
-			}
-			break;
-		case 'p':
-			options.port = a2port(optarg);
-			if (options.port == 0) {
-				fprintf(stderr, "Bad port '%s'\n", optarg);
-				exit(1);
-			}
-			break;
-		case 'l':
-			options.user = optarg;
-			break;
-
-		case 'L':
-		case 'R':
-			if (sscanf(optarg, "%5[0-9]:%255[^:]:%5[0-9]",
-			    sfwd_port, buf, sfwd_host_port) != 3 &&
-			    sscanf(optarg, "%5[0-9]/%255[^/]/%5[0-9]",
-			    sfwd_port, buf, sfwd_host_port) != 3) {
-				fprintf(stderr,
-				    "Bad forwarding specification '%s'\n",
-				    optarg);
-				usage();
-				/* NOTREACHED */
-			}
-			if ((fwd_port = a2port(sfwd_port)) == 0 ||
-			    (fwd_host_port = a2port(sfwd_host_port)) == 0) {
-				fprintf(stderr,
-				    "Bad forwarding port(s) '%s'\n", optarg);
-				exit(1);
-			}
-			if (opt == 'L')
-				add_local_forward(&options, fwd_port, buf,
-				    fwd_host_port);
-			else if (opt == 'R')
-				add_remote_forward(&options, fwd_port, buf,
-				    fwd_host_port);
-			break;
-
-		case 'D':
-			fwd_port = a2port(optarg);
-			if (fwd_port == 0) {
-				fprintf(stderr, "Bad dynamic port '%s'\n",
-				    optarg);
-				exit(1);
-			}
-			add_local_forward(&options, fwd_port, "socks4", 0);
-			break;
-
-		case 'C':
-			options.compression = 1;
-			break;
-		case 'N':
-			no_shell_flag = 1;
-			no_tty_flag = 1;
-			break;
-		case 'T':
-			no_tty_flag = 1;
-			break;
-		case 'o':
-			dummy = 1;
-			if (process_config_line(&options, host ? host : "",
-			    optarg, "command-line", 0, &dummy) != 0)
-				exit(1);
-			break;
-		case 's':
-			subsystem_flag = 1;
-			break;
-		case 'b':
-			options.bind_address = optarg;
-			break;
-		case 'F':
-			config = optarg;
-			break;
-		default:
-			usage();
-		}
-	}
-
-	ac -= optind;
-	av += optind;
-
-	if (ac > 0 && !host && **av != '-') {
-		if (strrchr(*av, '@')) {
-			p = xstrdup(*av);
-			cp = strrchr(p, '@');
-			if (cp == NULL || cp == p)
-				usage();
-			options.user = p;
-			*cp = '\0';
-			host = ++cp;
-		} else
-			host = *av;
-		if (ac > 1) {
-			optind = optreset = 1;
-			goto again;
-		}
-		ac--, av++;
-	}
-
-	/* Check that we got a host name. */
-	if (!host)
-		usage();
-
-	SSLeay_add_all_algorithms();
-	ERR_load_crypto_strings();
-	channel_set_af(IPv4or6);
-
-	/* Initialize the command to execute on remote host. */
-	buffer_init(&command);
-
-	/*
-	 * Save the command to execute on the remote host in a buffer. There
-	 * is no limit on the length of the command, except by the maximum
-	 * packet size.  Also sets the tty flag if there is no command.
-	 */
-	if (!ac) {
-		/* No command specified - execute shell on a tty. */
-		tty_flag = 1;
-		if (subsystem_flag) {
-			fprintf(stderr,
-			    "You must specify a subsystem to invoke.\n");
-			usage();
-		}
-	} else {
-		/* A command has been specified.  Store it into the buffer. */
-		for (i = 0; i < ac; i++) {
-			if (i)
-				buffer_append(&command, " ", 1);
-			buffer_append(&command, av[i], strlen(av[i]));
-		}
-	}
-
-	/* Cannot fork to background if no command. */
-	if (fork_after_authentication_flag && buffer_len(&command) == 0 && !no_shell_flag)
-		fatal("Cannot fork into background without a command to execute.");
-
-	/* Allocate a tty by default if no command specified. */
-	if (buffer_len(&command) == 0)
-		tty_flag = 1;
-
-	/* Force no tty */
-	if (no_tty_flag)
-		tty_flag = 0;
-	/* Do not allocate a tty if stdin is not a tty. */
-	if (!isatty(fileno(stdin)) && !force_tty_flag) {
-		if (tty_flag)
-			log("Pseudo-terminal will not be allocated because stdin is not a terminal.");
-		tty_flag = 0;
-	}
-
-	/*
-	 * Initialize "log" output.  Since we are the client all output
-	 * actually goes to stderr.
-	 */
-	log_init(av[0], options.log_level == -1 ? SYSLOG_LEVEL_INFO : options.log_level,
-	    SYSLOG_FACILITY_USER, 1);
-
-	/*
-	 * Read per-user configuration file.  Ignore the system wide config
-	 * file if the user specifies a config file on the command line.
-	 */
-	if (config != NULL) {
-		if (!read_config_file(config, host, &options))
-			fatal("Can't open user config file %.100s: "
-			    "%.100s", config, strerror(errno));
-	} else  {
-		snprintf(buf, sizeof buf, "%.100s/%.100s", pw->pw_dir,
-		    _PATH_SSH_USER_CONFFILE);
-		(void)read_config_file(buf, host, &options);
-
-		/* Read systemwide configuration file after use config. */
-		(void)read_config_file(_PATH_HOST_CONFIG_FILE, host, &options);
-	}
-
-	/* Fill configuration defaults. */
-	fill_default_options(&options);
-
-	/* reinit */
-	log_init(av[0], options.log_level, SYSLOG_FACILITY_USER, 1);
-
-	seed_rng();
-
-	if (options.user == NULL)
-		options.user = xstrdup(pw->pw_name);
-
-	if (options.hostname != NULL)
-		host = options.hostname;
-
-	if (options.proxy_command != NULL &&
-	    strcmp(options.proxy_command, "none") == 0)
-		options.proxy_command = NULL;
-
-	/* Disable rhosts authentication if not running as root. */
-#ifdef HAVE_CYGWIN
-	/* Ignore uid if running under Windows */
-	if (!options.use_privileged_port) {
-#else
-	if (original_effective_uid != 0 || !options.use_privileged_port) {
-#endif
-		debug("Rhosts Authentication disabled, "
-		    "originating port will not be trusted.");
-		options.rhosts_authentication = 0;
-	}
-	/* Open a connection to the remote host. */
-
-	if (ssh_connect(host, &hostaddr, options.port, IPv4or6,
-	    options.connection_attempts,
-#ifdef HAVE_CYGWIN
-	    options.use_privileged_port,
-#else
-	    original_effective_uid == 0 && options.use_privileged_port,
-#endif
-	    options.proxy_command) != 0)
-		exit(1);
-
-	/*
-	 * If we successfully made the connection, load the host private key
-	 * in case we will need it later for combined rsa-rhosts
-	 * authentication. This must be done before releasing extra
-	 * privileges, because the file is only readable by root.
-	 * If we cannot access the private keys, load the public keys
-	 * instead and try to execute the ssh-keysign helper instead.
-	 */
-	sensitive_data.nkeys = 0;
-	sensitive_data.keys = NULL;
-	sensitive_data.external_keysign = 0;
-	if (options.rhosts_rsa_authentication ||
-	    options.hostbased_authentication) {
-		sensitive_data.nkeys = 3;
-		sensitive_data.keys = xmalloc(sensitive_data.nkeys *
-		    sizeof(Key));
-
-		PRIV_START;
-		sensitive_data.keys[0] = key_load_private_type(KEY_RSA1,
-		    _PATH_HOST_KEY_FILE, "", NULL);
-		sensitive_data.keys[1] = key_load_private_type(KEY_DSA,
-		    _PATH_HOST_DSA_KEY_FILE, "", NULL);
-		sensitive_data.keys[2] = key_load_private_type(KEY_RSA,
-		    _PATH_HOST_RSA_KEY_FILE, "", NULL);
-		PRIV_END;
-
-		if (options.hostbased_authentication == 1 &&
-		    sensitive_data.keys[0] == NULL &&
-		    sensitive_data.keys[1] == NULL &&
-		    sensitive_data.keys[2] == NULL) {
-			sensitive_data.keys[1] = key_load_public(
-			    _PATH_HOST_DSA_KEY_FILE, NULL);
-			sensitive_data.keys[2] = key_load_public(
-			    _PATH_HOST_RSA_KEY_FILE, NULL);
-			sensitive_data.external_keysign = 1;
-		}
-	}
-	/*
-	 * Get rid of any extra privileges that we may have.  We will no
-	 * longer need them.  Also, extra privileges could make it very hard
-	 * to read identity files and other non-world-readable files from the
-	 * user's home directory if it happens to be on a NFS volume where
-	 * root is mapped to nobody.
-	 */
-	seteuid(original_real_uid);
-	setuid(original_real_uid);
-
-	/*
-	 * Now that we are back to our own permissions, create ~/.ssh
-	 * directory if it doesn\'t already exist.
-	 */
-	snprintf(buf, sizeof buf, "%.100s%s%.100s", pw->pw_dir, strcmp(pw->pw_dir, "/") ? "/" : "", _PATH_SSH_USER_DIR);
-	if (stat(buf, &st) < 0)
-		if (mkdir(buf, 0700) < 0)
-			error("Could not create directory '%.200s'.", buf);
-
-	/* load options.identity_files */
-	load_public_identity_files();
-
-	/* Expand ~ in known host file names. */
-	/* XXX mem-leaks: */
-	options.system_hostfile =
-	    tilde_expand_filename(options.system_hostfile, original_real_uid);
-	options.user_hostfile =
-	    tilde_expand_filename(options.user_hostfile, original_real_uid);
-	options.system_hostfile2 =
-	    tilde_expand_filename(options.system_hostfile2, original_real_uid);
-	options.user_hostfile2 =
-	    tilde_expand_filename(options.user_hostfile2, original_real_uid);
-
-	signal(SIGPIPE, SIG_IGN); /* ignore SIGPIPE early */
-
-	/* Log into the remote system.  This never returns if the login fails. */
-	ssh_login(&sensitive_data, host, (struct sockaddr *)&hostaddr, pw);
-
-	/* We no longer need the private host keys.  Clear them now. */
-	if (sensitive_data.nkeys != 0) {
-		for (i = 0; i < sensitive_data.nkeys; i++) {
-			if (sensitive_data.keys[i] != NULL) {
-				/* Destroys contents safely */
-				debug3("clear hostkey %d", i);
-				key_free(sensitive_data.keys[i]);
-				sensitive_data.keys[i] = NULL;
-			}
-		}
-		xfree(sensitive_data.keys);
-	}
-	for (i = 0; i < options.num_identity_files; i++) {
-		if (options.identity_files[i]) {
-			xfree(options.identity_files[i]);
-			options.identity_files[i] = NULL;
-		}
-		if (options.identity_keys[i]) {
-			key_free(options.identity_keys[i]);
-			options.identity_keys[i] = NULL;
-		}
-	}
-
-	exit_status = compat20 ? ssh_session2() : ssh_session();
-	packet_close();
-
-	/*
-	 * Send SIGHUP to proxy command if used. We don't wait() in 
-	 * case it hangs and instead rely on init to reap the child
-	 */
-	if (proxy_command_pid > 1)
-		kill(proxy_command_pid, SIGHUP);
-
-	return exit_status;
-}
-
-static void
-x11_get_proto(char **_proto, char **_data)
-{
-	char line[512];
-	static char proto[512], data[512];
-	FILE *f;
-	int got_data = 0, i;
-	char *display;
-	struct stat st;
-
-	*_proto = proto;
-	*_data = data;
-	proto[0] = data[0] = '\0';
-	if (!options.xauth_location ||
-	    (stat(options.xauth_location, &st) == -1)) {
-		debug("No xauth program.");
-	} else {
-		if ((display = getenv("DISPLAY")) == NULL) {
-			debug("x11_get_proto: DISPLAY not set");
-			return;
-		}
-		/* Try to get Xauthority information for the display. */
-		if (strncmp(display, "localhost:", 10) == 0)
-			/*
-			 * Handle FamilyLocal case where $DISPLAY does
-			 * not match an authorization entry.  For this we
-			 * just try "xauth list unix:displaynum.screennum".
-			 * XXX: "localhost" match to determine FamilyLocal
-			 *      is not perfect.
-			 */
-			snprintf(line, sizeof line, "%s list unix:%s 2>"
-			    _PATH_DEVNULL, options.xauth_location, display+10);
-		else
-			snprintf(line, sizeof line, "%s list %.200s 2>"
-			    _PATH_DEVNULL, options.xauth_location, display);
-		debug2("x11_get_proto: %s", line);
-		f = popen(line, "r");
-		if (f && fgets(line, sizeof(line), f) &&
-		    sscanf(line, "%*s %511s %511s", proto, data) == 2)
-			got_data = 1;
-		if (f)
-			pclose(f);
-	}
-	/*
-	 * If we didn't get authentication data, just make up some
-	 * data.  The forwarding code will check the validity of the
-	 * response anyway, and substitute this data.  The X11
-	 * server, however, will ignore this fake data and use
-	 * whatever authentication mechanisms it was using otherwise
-	 * for the local connection.
-	 */
-	if (!got_data) {
-		u_int32_t rand = 0;
-
-		log("Warning: No xauth data; using fake authentication data for X11 forwarding.");
-		strlcpy(proto, "MIT-MAGIC-COOKIE-1", sizeof proto);
-		for (i = 0; i < 16; i++) {
-			if (i % 4 == 0)
-				rand = arc4random();
-			snprintf(data + 2 * i, sizeof data - 2 * i, "%02x", rand & 0xff);
-			rand >>= 8;
-		}
-	}
-}
-
-static void
-ssh_init_forwarding(void)
-{
-	int success = 0;
-	int i;
-
-	/* Initiate local TCP/IP port forwardings. */
-	for (i = 0; i < options.num_local_forwards; i++) {
-		debug("Connections to local port %d forwarded to remote address %.200s:%d",
-		    options.local_forwards[i].port,
-		    options.local_forwards[i].host,
-		    options.local_forwards[i].host_port);
-		success += channel_setup_local_fwd_listener(
-		    options.local_forwards[i].port,
-		    options.local_forwards[i].host,
-		    options.local_forwards[i].host_port,
-		    options.gateway_ports);
-	}
-	if (i > 0 && success == 0)
-		error("Could not request local forwarding.");
-
-	/* Initiate remote TCP/IP port forwardings. */
-	for (i = 0; i < options.num_remote_forwards; i++) {
-		debug("Connections to remote port %d forwarded to local address %.200s:%d",
-		    options.remote_forwards[i].port,
-		    options.remote_forwards[i].host,
-		    options.remote_forwards[i].host_port);
-		channel_request_remote_forwarding(
-		    options.remote_forwards[i].port,
-		    options.remote_forwards[i].host,
-		    options.remote_forwards[i].host_port);
-	}
-}
-
-static void
-check_agent_present(void)
-{
-	if (options.forward_agent) {
-		/* Clear agent forwarding if we don\'t have an agent. */
-		if (!ssh_agent_present())
-			options.forward_agent = 0;
-	}
-}
-
-static int
-ssh_session(void)
-{
-	int type;
-	int interactive = 0;
-	int have_tty = 0;
-	struct winsize ws;
-	char *cp;
-
-	/* Enable compression if requested. */
-	if (options.compression) {
-		debug("Requesting compression at level %d.", options.compression_level);
-
-		if (options.compression_level < 1 || options.compression_level > 9)
-			fatal("Compression level must be from 1 (fast) to 9 (slow, best).");
-
-		/* Send the request. */
-		packet_start(SSH_CMSG_REQUEST_COMPRESSION);
-		packet_put_int(options.compression_level);
-		packet_send();
-		packet_write_wait();
-		type = packet_read();
-		if (type == SSH_SMSG_SUCCESS)
-			packet_start_compression(options.compression_level);
-		else if (type == SSH_SMSG_FAILURE)
-			log("Warning: Remote host refused compression.");
-		else
-			packet_disconnect("Protocol error waiting for compression response.");
-	}
-	/* Allocate a pseudo tty if appropriate. */
-	if (tty_flag) {
-		debug("Requesting pty.");
-
-		/* Start the packet. */
-		packet_start(SSH_CMSG_REQUEST_PTY);
-
-		/* Store TERM in the packet.  There is no limit on the
-		   length of the string. */
-		cp = getenv("TERM");
-		if (!cp)
-			cp = "";
-		packet_put_cstring(cp);
-
-		/* Store window size in the packet. */
-		if (ioctl(fileno(stdin), TIOCGWINSZ, &ws) < 0)
-			memset(&ws, 0, sizeof(ws));
-		packet_put_int(ws.ws_row);
-		packet_put_int(ws.ws_col);
-		packet_put_int(ws.ws_xpixel);
-		packet_put_int(ws.ws_ypixel);
-
-		/* Store tty modes in the packet. */
-		tty_make_modes(fileno(stdin), NULL);
-
-		/* Send the packet, and wait for it to leave. */
-		packet_send();
-		packet_write_wait();
-
-		/* Read response from the server. */
-		type = packet_read();
-		if (type == SSH_SMSG_SUCCESS) {
-			interactive = 1;
-			have_tty = 1;
-		} else if (type == SSH_SMSG_FAILURE)
-			log("Warning: Remote host failed or refused to allocate a pseudo tty.");
-		else
-			packet_disconnect("Protocol error waiting for pty request response.");
-	}
-	/* Request X11 forwarding if enabled and DISPLAY is set. */
-	if (options.forward_x11 && getenv("DISPLAY") != NULL) {
-		char *proto, *data;
-		/* Get reasonable local authentication information. */
-		x11_get_proto(&proto, &data);
-		/* Request forwarding with authentication spoofing. */
-		debug("Requesting X11 forwarding with authentication spoofing.");
-		x11_request_forwarding_with_spoofing(0, proto, data);
-
-		/* Read response from the server. */
-		type = packet_read();
-		if (type == SSH_SMSG_SUCCESS) {
-			interactive = 1;
-		} else if (type == SSH_SMSG_FAILURE) {
-			log("Warning: Remote host denied X11 forwarding.");
-		} else {
-			packet_disconnect("Protocol error waiting for X11 forwarding");
-		}
-	}
-	/* Tell the packet module whether this is an interactive session. */
-	packet_set_interactive(interactive);
-
-	/* Request authentication agent forwarding if appropriate. */
-	check_agent_present();
-
-	if (options.forward_agent) {
-		debug("Requesting authentication agent forwarding.");
-		auth_request_forwarding();
-
-		/* Read response from the server. */
-		type = packet_read();
-		packet_check_eom();
-		if (type != SSH_SMSG_SUCCESS)
-			log("Warning: Remote host denied authentication agent forwarding.");
-	}
-
-	/* Initiate port forwardings. */
-	ssh_init_forwarding();
-
-	/* If requested, let ssh continue in the background. */
-	if (fork_after_authentication_flag)
-		if (daemon(1, 1) < 0)
-			fatal("daemon() failed: %.200s", strerror(errno));
-
-	/*
-	 * If a command was specified on the command line, execute the
-	 * command now. Otherwise request the server to start a shell.
-	 */
-	if (buffer_len(&command) > 0) {
-		int len = buffer_len(&command);
-		if (len > 900)
-			len = 900;
-		debug("Sending command: %.*s", len, (u_char *)buffer_ptr(&command));
-		packet_start(SSH_CMSG_EXEC_CMD);
-		packet_put_string(buffer_ptr(&command), buffer_len(&command));
-		packet_send();
-		packet_write_wait();
-	} else {
-		debug("Requesting shell.");
-		packet_start(SSH_CMSG_EXEC_SHELL);
-		packet_send();
-		packet_write_wait();
-	}
-
-	/* Enter the interactive session. */
-	return client_loop(have_tty, tty_flag ?
-	    options.escape_char : SSH_ESCAPECHAR_NONE, 0);
-}
-
-static void
-client_subsystem_reply(int type, u_int32_t seq, void *ctxt)
-{
-	int id, len;
-
-	id = packet_get_int();
-	len = buffer_len(&command);
-	if (len > 900)
-		len = 900;
-	packet_check_eom();
-	if (type == SSH2_MSG_CHANNEL_FAILURE)
-		fatal("Request for subsystem '%.*s' failed on channel %d",
-		    len, (u_char *)buffer_ptr(&command), id);
-}
-
-void
-client_global_request_reply(int type, u_int32_t seq, void *ctxt)
-{
-	int i;
-
-	i = client_global_request_id++;
-	if (i >= options.num_remote_forwards) {
-		debug("client_global_request_reply: too many replies %d > %d",
-		    i, options.num_remote_forwards);
-		return;
-	}
-	debug("remote forward %s for: listen %d, connect %s:%d",
-	    type == SSH2_MSG_REQUEST_SUCCESS ? "success" : "failure",
-	    options.remote_forwards[i].port,
-	    options.remote_forwards[i].host,
-	    options.remote_forwards[i].host_port);
-	if (type == SSH2_MSG_REQUEST_FAILURE)
-		log("Warning: remote port forwarding failed for listen port %d",
-		    options.remote_forwards[i].port);
-}
-
-/* request pty/x11/agent/tcpfwd/shell for channel */
-static void
-ssh_session2_setup(int id, void *arg)
-{
-	int len;
-	int interactive = 0;
-	struct termios tio;
-
-	debug2("ssh_session2_setup: id %d", id);
-
-	if (tty_flag) {
-		struct winsize ws;
-		char *cp;
-		cp = getenv("TERM");
-		if (!cp)
-			cp = "";
-		/* Store window size in the packet. */
-		if (ioctl(fileno(stdin), TIOCGWINSZ, &ws) < 0)
-			memset(&ws, 0, sizeof(ws));
-
-		channel_request_start(id, "pty-req", 0);
-		packet_put_cstring(cp);
-		packet_put_int(ws.ws_col);
-		packet_put_int(ws.ws_row);
-		packet_put_int(ws.ws_xpixel);
-		packet_put_int(ws.ws_ypixel);
-		tio = get_saved_tio();
-		tty_make_modes(/*ignored*/ 0, &tio);
-		packet_send();
-		interactive = 1;
-		/* XXX wait for reply */
-	}
-	if (options.forward_x11 &&
-	    getenv("DISPLAY") != NULL) {
-		char *proto, *data;
-		/* Get reasonable local authentication information. */
-		x11_get_proto(&proto, &data);
-		/* Request forwarding with authentication spoofing. */
-		debug("Requesting X11 forwarding with authentication spoofing.");
-		x11_request_forwarding_with_spoofing(id, proto, data);
-		interactive = 1;
-		/* XXX wait for reply */
-	}
-
-	check_agent_present();
-	if (options.forward_agent) {
-		debug("Requesting authentication agent forwarding.");
-		channel_request_start(id, "auth-agent-req@openssh.com", 0);
-		packet_send();
-	}
-
-	len = buffer_len(&command);
-	if (len > 0) {
-		if (len > 900)
-			len = 900;
-		if (subsystem_flag) {
-			debug("Sending subsystem: %.*s", len, (u_char *)buffer_ptr(&command));
-			channel_request_start(id, "subsystem", /*want reply*/ 1);
-			/* register callback for reply */
-			/* XXX we assume that client_loop has already been called */
-			dispatch_set(SSH2_MSG_CHANNEL_FAILURE, &client_subsystem_reply);
-			dispatch_set(SSH2_MSG_CHANNEL_SUCCESS, &client_subsystem_reply);
-		} else {
-			debug("Sending command: %.*s", len, (u_char *)buffer_ptr(&command));
-			channel_request_start(id, "exec", 0);
-		}
-		packet_put_string(buffer_ptr(&command), buffer_len(&command));
-		packet_send();
-	} else {
-		channel_request_start(id, "shell", 0);
-		packet_send();
-	}
-
-	packet_set_interactive(interactive);
-}
-
-/* open new channel for a session */
-static int
-ssh_session2_open(void)
-{
-	Channel *c;
-	int window, packetmax, in, out, err;
-
-	if (stdin_null_flag) {
-		in = open(_PATH_DEVNULL, O_RDONLY);
-	} else {
-		in = dup(STDIN_FILENO);
-	}
-	out = dup(STDOUT_FILENO);
-	err = dup(STDERR_FILENO);
-
-	if (in < 0 || out < 0 || err < 0)
-		fatal("dup() in/out/err failed");
-
-	/* enable nonblocking unless tty */
-	if (!isatty(in))
-		set_nonblock(in);
-	if (!isatty(out))
-		set_nonblock(out);
-	if (!isatty(err))
-		set_nonblock(err);
-
-	window = CHAN_SES_WINDOW_DEFAULT;
-	packetmax = CHAN_SES_PACKET_DEFAULT;
-	if (tty_flag) {
-		window >>= 1;
-		packetmax >>= 1;
-	}
-	c = channel_new(
-	    "session", SSH_CHANNEL_OPENING, in, out, err,
-	    window, packetmax, CHAN_EXTENDED_WRITE,
-	    xstrdup("client-session"), /*nonblock*/0);
-
-	debug3("ssh_session2_open: channel_new: %d", c->self);
-
-	channel_send_open(c->self);
-	if (!no_shell_flag)
-		channel_register_confirm(c->self, ssh_session2_setup);
-
-	return c->self;
-}
-
-static int
-ssh_session2(void)
-{
-	int id = -1;
-
-	/* XXX should be pre-session */
-	ssh_init_forwarding();
-
-	if (!no_shell_flag || (datafellows & SSH_BUG_DUMMYCHAN))
-		id = ssh_session2_open();
-
-	/* If requested, let ssh continue in the background. */
-	if (fork_after_authentication_flag)
-		if (daemon(1, 1) < 0)
-			fatal("daemon() failed: %.200s", strerror(errno));
-
-	return client_loop(tty_flag, tty_flag ?
-	    options.escape_char : SSH_ESCAPECHAR_NONE, id);
-}
-
-static void
-load_public_identity_files(void)
-{
-	char *filename;
-	int i = 0;
-	Key *public;
-#ifdef SMARTCARD
-	Key **keys;
-
-	if (options.smartcard_device != NULL &&
-	    options.num_identity_files < SSH_MAX_IDENTITY_FILES &&
-	    (keys = sc_get_keys(options.smartcard_device, NULL)) != NULL ) {
-		int count = 0;
-		for (i = 0; keys[i] != NULL; i++) {
-			count++;
-			memmove(&options.identity_files[1], &options.identity_files[0],
-			    sizeof(char *) * (SSH_MAX_IDENTITY_FILES - 1));
-			memmove(&options.identity_keys[1], &options.identity_keys[0],
-			    sizeof(Key *) * (SSH_MAX_IDENTITY_FILES - 1));
-			options.num_identity_files++;
-			options.identity_keys[0] = keys[i];
-			options.identity_files[0] = xstrdup("smartcard key");;
-		}
-		if (options.num_identity_files > SSH_MAX_IDENTITY_FILES)
-			options.num_identity_files = SSH_MAX_IDENTITY_FILES;
-		i = count;
-		xfree(keys);
-	}
-#endif /* SMARTCARD */
-	for (; i < options.num_identity_files; i++) {
-		filename = tilde_expand_filename(options.identity_files[i],
-		    original_real_uid);
-		public = key_load_public(filename, NULL);
-		debug("identity file %s type %d", filename,
-		    public ? public->type : -1);
-		xfree(options.identity_files[i]);
-		options.identity_files[i] = filename;
-		options.identity_keys[i] = public;
-	}
-}
diff --git a/crypto/openssh/ssh.h b/crypto/openssh/ssh.h
deleted file mode 100644
index 0a6ad1317b96..000000000000
--- a/crypto/openssh/ssh.h
+++ /dev/null
@@ -1,110 +0,0 @@
-/*	$OpenBSD: ssh.h,v 1.71 2002/06/22 02:00:29 stevesk Exp $	*/
-
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#ifndef SSH_H
-#define SSH_H
-
-#include <netinet/in.h> /* For struct sockaddr_in */
-#include <pwd.h> /* For struct pw */
-#include <stdarg.h> /* For va_list */
-#include <syslog.h> /* For LOG_AUTH and friends */
-#include <sys/socket.h> /* For struct sockaddr_storage */
-#include "openbsd-compat/fake-socket.h" /* For struct sockaddr_storage */
-#ifdef HAVE_SYS_SELECT_H
-# include <sys/select.h>
-#endif
-
-/* Cipher used for encrypting authentication files. */
-#define SSH_AUTHFILE_CIPHER	SSH_CIPHER_3DES
-
-/* Default port number. */
-#define SSH_DEFAULT_PORT	22
-
-/* Maximum number of TCP/IP ports forwarded per direction. */
-#define SSH_MAX_FORWARDS_PER_DIRECTION	100
-
-/*
- * Maximum number of RSA authentication identity files that can be specified
- * in configuration files or on the command line.
- */
-#define SSH_MAX_IDENTITY_FILES		100
-
-/*
- * Major protocol version.  Different version indicates major incompatibility
- * that prevents communication.
- *
- * Minor protocol version.  Different version indicates minor incompatibility
- * that does not prevent interoperation.
- */
-#define PROTOCOL_MAJOR_1	1
-#define PROTOCOL_MINOR_1	5
-
-/* We support both SSH1 and SSH2 */
-#define PROTOCOL_MAJOR_2	2
-#define PROTOCOL_MINOR_2	0
-
-/*
- * Name for the service.  The port named by this service overrides the
- * default port if present.
- */
-#define SSH_SERVICE_NAME	"ssh"
-
-/*
- * Name of the environment variable containing the process ID of the
- * authentication agent.
- */
-#define SSH_AGENTPID_ENV_NAME	"SSH_AGENT_PID"
-
-/*
- * Name of the environment variable containing the pathname of the
- * authentication socket.
- */
-#define SSH_AUTHSOCKET_ENV_NAME "SSH_AUTH_SOCK"
-
-/*
- * Environment variable for overwriting the default location of askpass
- */
-#define SSH_ASKPASS_ENV		"SSH_ASKPASS"
-
-/*
- * Force host key length and server key length to differ by at least this
- * many bits.  This is to make double encryption with rsaref work.
- */
-#define SSH_KEY_BITS_RESERVED		128
-
-/*
- * Length of the session key in bytes.  (Specified as 256 bits in the
- * protocol.)
- */
-#define SSH_SESSION_KEY_LENGTH		32
-
-/* Name of Kerberos service for SSH to use. */
-#define KRB4_SERVICE_NAME		"rcmd"
-
-/* Used to identify ``EscapeChar none'' */
-#define SSH_ESCAPECHAR_NONE		-2
-
-/*
- * unprivileged user when UsePrivilegeSeparation=yes;
- * sshd will change its privileges to this user and its
- * primary group.
- */
-#ifndef SSH_PRIVSEP_USER
-#define SSH_PRIVSEP_USER		"sshd"
-#endif
-
-/* Minimum modulus size (n) for RSA keys. */
-#define SSH_RSA_MINIMUM_MODULUS_SIZE	768
-
-#endif				/* SSH_H */
diff --git a/crypto/openssh/ssh/Makefile b/crypto/openssh/ssh/Makefile
deleted file mode 100644
index 80511de5f4e7..000000000000
--- a/crypto/openssh/ssh/Makefile
+++ /dev/null
@@ -1,40 +0,0 @@
-#	$OpenBSD: Makefile,v 1.42 2002/06/20 19:56:07 stevesk Exp $
-
-.PATH:		${.CURDIR}/..
-
-PROG=	ssh
-BINOWN=	root
-
-#BINMODE?=4555
-
-BINDIR=	/usr/bin
-MAN=	ssh.1 ssh_config.5
-LINKS=	${BINDIR}/ssh ${BINDIR}/slogin
-MLINKS=	ssh.1 slogin.1
-
-SRCS=	ssh.c readconf.c clientloop.c sshtty.c \
-	sshconnect.c sshconnect1.c sshconnect2.c
-
-.include <bsd.own.mk> # for AFS
-
-.if (${KERBEROS5:L} == "yes")
-CFLAGS+= -DKRB5 -I${DESTDIR}/usr/include/kerberosV
-LDADD+=  -lkrb5 -lasn1 -lcom_err
-DPADD+=  ${LIBKRB5} ${LIBASN1} ${LIBCOM_ERR}
-.endif # KERBEROS5
-
-.if (${KERBEROS:L} == "yes")
-CFLAGS+= -DKRB4 -I${DESTDIR}/usr/include/kerberosIV
-LDADD+=	 -lkrb
-DPADD+=	 ${LIBKRB}
-.if (${AFS:L} == "yes")
-CFLAGS+= -DAFS
-LDADD+=  -lkafs
-DPADD+=  ${LIBKAFS}
-.endif # AFS
-.endif # KERBEROS
-
-.include <bsd.prog.mk>
-
-LDADD+=	-lcrypto -lz -ldes
-DPADD+=	${LIBCRYPTO} ${LIBZ} ${LIBDES}
diff --git a/crypto/openssh/ssh1.h b/crypto/openssh/ssh1.h
deleted file mode 100644
index 98d1dc9303cc..000000000000
--- a/crypto/openssh/ssh1.h
+++ /dev/null
@@ -1,89 +0,0 @@
-/*	$OpenBSD: ssh1.h,v 1.3 2001/05/30 12:55:13 markus Exp $	*/
-
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-/*
- * Definition of message types.  New values can be added, but old values
- * should not be removed or without careful consideration of the consequences
- * for compatibility.  The maximum value is 254; value 255 is reserved for
- * future extension.
- */
-/* Message name */			/* msg code */	/* arguments */
-#define SSH_MSG_NONE				0	/* no message */
-#define SSH_MSG_DISCONNECT			1	/* cause (string) */
-#define SSH_SMSG_PUBLIC_KEY			2	/* ck,msk,srvk,hostk */
-#define SSH_CMSG_SESSION_KEY			3	/* key (BIGNUM) */
-#define SSH_CMSG_USER				4	/* user (string) */
-#define SSH_CMSG_AUTH_RHOSTS			5	/* user (string) */
-#define SSH_CMSG_AUTH_RSA			6	/* modulus (BIGNUM) */
-#define SSH_SMSG_AUTH_RSA_CHALLENGE		7	/* int (BIGNUM) */
-#define SSH_CMSG_AUTH_RSA_RESPONSE		8	/* int (BIGNUM) */
-#define SSH_CMSG_AUTH_PASSWORD			9	/* pass (string) */
-#define SSH_CMSG_REQUEST_PTY		        10	/* TERM, tty modes */
-#define SSH_CMSG_WINDOW_SIZE		        11	/* row,col,xpix,ypix */
-#define SSH_CMSG_EXEC_SHELL			12	/* */
-#define SSH_CMSG_EXEC_CMD			13	/* cmd (string) */
-#define SSH_SMSG_SUCCESS			14	/* */
-#define SSH_SMSG_FAILURE			15	/* */
-#define SSH_CMSG_STDIN_DATA			16	/* data (string) */
-#define SSH_SMSG_STDOUT_DATA			17	/* data (string) */
-#define SSH_SMSG_STDERR_DATA			18	/* data (string) */
-#define SSH_CMSG_EOF				19	/* */
-#define SSH_SMSG_EXITSTATUS			20	/* status (int) */
-#define SSH_MSG_CHANNEL_OPEN_CONFIRMATION	21	/* channel (int) */
-#define SSH_MSG_CHANNEL_OPEN_FAILURE		22	/* channel (int) */
-#define SSH_MSG_CHANNEL_DATA			23	/* ch,data (int,str) */
-#define SSH_MSG_CHANNEL_CLOSE			24	/* channel (int) */
-#define SSH_MSG_CHANNEL_CLOSE_CONFIRMATION	25	/* channel (int) */
-/*      SSH_CMSG_X11_REQUEST_FORWARDING         26         OBSOLETE */
-#define SSH_SMSG_X11_OPEN			27	/* channel (int) */
-#define SSH_CMSG_PORT_FORWARD_REQUEST		28	/* p,host,hp (i,s,i) */
-#define SSH_MSG_PORT_OPEN			29	/* ch,h,p (i,s,i) */
-#define SSH_CMSG_AGENT_REQUEST_FORWARDING	30	/* */
-#define SSH_SMSG_AGENT_OPEN			31	/* port (int) */
-#define SSH_MSG_IGNORE				32	/* string */
-#define SSH_CMSG_EXIT_CONFIRMATION		33	/* */
-#define SSH_CMSG_X11_REQUEST_FORWARDING		34	/* proto,data (s,s) */
-#define SSH_CMSG_AUTH_RHOSTS_RSA		35	/* user,mod (s,mpi) */
-#define SSH_MSG_DEBUG				36	/* string */
-#define SSH_CMSG_REQUEST_COMPRESSION		37	/* level 1-9 (int) */
-#define SSH_CMSG_MAX_PACKET_SIZE		38	/* size 4k-1024k (int) */
-#define SSH_CMSG_AUTH_TIS			39	/* we use this for s/key */
-#define SSH_SMSG_AUTH_TIS_CHALLENGE		40	/* challenge (string) */
-#define SSH_CMSG_AUTH_TIS_RESPONSE		41	/* response (string) */
-#define SSH_CMSG_AUTH_KERBEROS			42	/* (KTEXT) */
-#define SSH_SMSG_AUTH_KERBEROS_RESPONSE		43	/* (KTEXT) */
-#define SSH_CMSG_HAVE_KERBEROS_TGT		44	/* credentials (s) */
-#define SSH_CMSG_HAVE_AFS_TOKEN			65	/* token (s) */
-
-/* protocol version 1.5 overloads some version 1.3 message types */
-#define SSH_MSG_CHANNEL_INPUT_EOF	SSH_MSG_CHANNEL_CLOSE
-#define SSH_MSG_CHANNEL_OUTPUT_CLOSE	SSH_MSG_CHANNEL_CLOSE_CONFIRMATION
-
-/*
- * Authentication methods.  New types can be added, but old types should not
- * be removed for compatibility.  The maximum allowed value is 31.
- */
-#define SSH_AUTH_RHOSTS		1
-#define SSH_AUTH_RSA		2
-#define SSH_AUTH_PASSWORD	3
-#define SSH_AUTH_RHOSTS_RSA	4
-#define SSH_AUTH_TIS		5
-#define SSH_AUTH_KERBEROS	6
-#define SSH_PASS_KERBEROS_TGT	7
-				/* 8 to 15 are reserved */
-#define SSH_PASS_AFS_TOKEN	21
-
-/* Protocol flags.  These are bit masks. */
-#define SSH_PROTOFLAG_SCREEN_NUMBER	1	/* X11 forwarding includes screen */
-#define SSH_PROTOFLAG_HOST_IN_FWD_OPEN	2	/* forwarding opens contain host */
diff --git a/crypto/openssh/ssh2.h b/crypto/openssh/ssh2.h
deleted file mode 100644
index 091e52b139f1..000000000000
--- a/crypto/openssh/ssh2.h
+++ /dev/null
@@ -1,159 +0,0 @@
-/*	$OpenBSD: ssh2.h,v 1.8 2002/03/04 17:27:39 stevesk Exp $	*/
-
-/*
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/*
- * draft-ietf-secsh-architecture-05.txt
- *
- *   Transport layer protocol:
- *
- *     1-19     Transport layer generic (e.g. disconnect, ignore, debug,
- *              etc)
- *     20-29    Algorithm negotiation
- *     30-49    Key exchange method specific (numbers can be reused for
- *              different authentication methods)
- *
- *   User authentication protocol:
- *
- *     50-59    User authentication generic
- *     60-79    User authentication method specific (numbers can be reused
- *              for different authentication methods)
- *
- *   Connection protocol:
- *
- *     80-89    Connection protocol generic
- *     90-127   Channel related messages
- *
- *   Reserved for client protocols:
- *
- *     128-191  Reserved
- *
- *   Local extensions:
- *
- *     192-255  Local extensions
- */
-
-/* ranges */
-
-#define SSH2_MSG_TRANSPORT_MIN				1
-#define SSH2_MSG_TRANSPORT_MAX				49
-#define SSH2_MSG_USERAUTH_MIN				50
-#define SSH2_MSG_USERAUTH_MAX				79
-#define SSH2_MSG_CONNECTION_MIN				80
-#define SSH2_MSG_CONNECTION_MAX				127
-#define SSH2_MSG_RESERVED_MIN				128
-#define SSH2_MSG_RESERVED_MAX				191
-#define SSH2_MSG_LOCAL_MIN				192
-#define SSH2_MSG_LOCAL_MAX				255
-#define SSH2_MSG_MIN					1
-#define SSH2_MSG_MAX					255
-
-/* transport layer: generic */
-
-#define SSH2_MSG_DISCONNECT				1
-#define SSH2_MSG_IGNORE					2
-#define SSH2_MSG_UNIMPLEMENTED				3
-#define SSH2_MSG_DEBUG					4
-#define SSH2_MSG_SERVICE_REQUEST			5
-#define SSH2_MSG_SERVICE_ACCEPT				6
-
-/* transport layer: alg negotiation */
-
-#define SSH2_MSG_KEXINIT				20
-#define SSH2_MSG_NEWKEYS				21
-
-/* transport layer: kex specific messages, can be reused */
-
-#define SSH2_MSG_KEXDH_INIT				30
-#define SSH2_MSG_KEXDH_REPLY				31
-
-/* dh-group-exchange */
-#define SSH2_MSG_KEX_DH_GEX_REQUEST_OLD			30
-#define SSH2_MSG_KEX_DH_GEX_GROUP			31
-#define SSH2_MSG_KEX_DH_GEX_INIT			32
-#define SSH2_MSG_KEX_DH_GEX_REPLY			33
-#define SSH2_MSG_KEX_DH_GEX_REQUEST			34
-
-/* user authentication: generic */
-
-#define SSH2_MSG_USERAUTH_REQUEST			50
-#define SSH2_MSG_USERAUTH_FAILURE			51
-#define SSH2_MSG_USERAUTH_SUCCESS			52
-#define SSH2_MSG_USERAUTH_BANNER			53
-
-/* user authentication: method specific, can be reused */
-
-#define SSH2_MSG_USERAUTH_PK_OK				60
-#define SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ		60
-#define SSH2_MSG_USERAUTH_INFO_REQUEST			60
-#define SSH2_MSG_USERAUTH_INFO_RESPONSE			61
-
-/* connection protocol: generic */
-
-#define SSH2_MSG_GLOBAL_REQUEST				80
-#define SSH2_MSG_REQUEST_SUCCESS			81
-#define SSH2_MSG_REQUEST_FAILURE			82
-
-/* channel related messages */
-
-#define SSH2_MSG_CHANNEL_OPEN				90
-#define SSH2_MSG_CHANNEL_OPEN_CONFIRMATION		91
-#define SSH2_MSG_CHANNEL_OPEN_FAILURE			92
-#define SSH2_MSG_CHANNEL_WINDOW_ADJUST			93
-#define SSH2_MSG_CHANNEL_DATA				94
-#define SSH2_MSG_CHANNEL_EXTENDED_DATA			95
-#define SSH2_MSG_CHANNEL_EOF				96
-#define SSH2_MSG_CHANNEL_CLOSE				97
-#define SSH2_MSG_CHANNEL_REQUEST			98
-#define SSH2_MSG_CHANNEL_SUCCESS			99
-#define SSH2_MSG_CHANNEL_FAILURE			100
-
-/* disconnect reason code */
-
-#define SSH2_DISCONNECT_HOST_NOT_ALLOWED_TO_CONNECT	1
-#define SSH2_DISCONNECT_PROTOCOL_ERROR			2
-#define SSH2_DISCONNECT_KEY_EXCHANGE_FAILED		3
-#define SSH2_DISCONNECT_HOST_AUTHENTICATION_FAILED	4
-#define SSH2_DISCONNECT_RESERVED			4
-#define SSH2_DISCONNECT_MAC_ERROR			5
-#define SSH2_DISCONNECT_COMPRESSION_ERROR		6
-#define SSH2_DISCONNECT_SERVICE_NOT_AVAILABLE		7
-#define SSH2_DISCONNECT_PROTOCOL_VERSION_NOT_SUPPORTED	8
-#define SSH2_DISCONNECT_HOST_KEY_NOT_VERIFIABLE		9
-#define SSH2_DISCONNECT_CONNECTION_LOST			10
-#define SSH2_DISCONNECT_BY_APPLICATION			11
-#define SSH2_DISCONNECT_TOO_MANY_CONNECTIONS		12
-#define SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER		13
-#define SSH2_DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE	14
-#define SSH2_DISCONNECT_ILLEGAL_USER_NAME		15
-
-/* misc */
-
-#define SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED		1
-#define SSH2_OPEN_CONNECT_FAILED			2
-#define SSH2_OPEN_UNKNOWN_CHANNEL_TYPE			3
-#define SSH2_OPEN_RESOURCE_SHORTAGE			4
-
-#define SSH2_EXTENDED_DATA_STDERR			1
diff --git a/crypto/openssh/ssh_config b/crypto/openssh/ssh_config
deleted file mode 100644
index 94cffbf395aa..000000000000
--- a/crypto/openssh/ssh_config
+++ /dev/null
@@ -1,36 +0,0 @@
-#	$OpenBSD: ssh_config,v 1.16 2002/07/03 14:21:05 markus Exp $
-
-# This is the ssh client system-wide configuration file.  See
-# ssh_config(5) for more information.  This file provides defaults for
-# users, and the values can be changed in per-user configuration files
-# or on the command line.
-
-# Configuration data is parsed as follows:
-#  1. command line options
-#  2. user-specific file
-#  3. system-wide file
-# Any configuration value is only changed the first time it is set.
-# Thus, host-specific definitions should be at the beginning of the
-# configuration file, and defaults at the end.
-
-# Site-wide defaults for various options
-
-# Host *
-#   ForwardAgent no
-#   ForwardX11 no
-#   RhostsAuthentication no
-#   RhostsRSAAuthentication no
-#   RSAAuthentication yes
-#   PasswordAuthentication yes
-#   HostbasedAuthentication no
-#   BatchMode no
-#   CheckHostIP yes
-#   StrictHostKeyChecking ask
-#   IdentityFile ~/.ssh/identity
-#   IdentityFile ~/.ssh/id_rsa
-#   IdentityFile ~/.ssh/id_dsa
-#   Port 22
-#   Protocol 2,1
-#   Cipher 3des
-#   Ciphers aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
-#   EscapeChar ~
diff --git a/crypto/openssh/ssh_config.5 b/crypto/openssh/ssh_config.5
deleted file mode 100644
index 44208b431f59..000000000000
--- a/crypto/openssh/ssh_config.5
+++ /dev/null
@@ -1,656 +0,0 @@
-.\"  -*- nroff -*-
-.\"
-.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
-.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
-.\"                    All rights reserved
-.\"
-.\" As far as I am concerned, the code I have written for this software
-.\" can be used freely for any purpose.  Any derived versions of this
-.\" software must be clearly marked as such, and if the derived work is
-.\" incompatible with the protocol description in the RFC file, it must be
-.\" called by a name other than "ssh" or "Secure Shell".
-.\"
-.\" Copyright (c) 1999,2000 Markus Friedl.  All rights reserved.
-.\" Copyright (c) 1999 Aaron Campbell.  All rights reserved.
-.\" Copyright (c) 1999 Theo de Raadt.  All rights reserved.
-.\"
-.\" Redistribution and use in source and binary forms, with or without
-.\" modification, are permitted provided that the following conditions
-.\" are met:
-.\" 1. Redistributions of source code must retain the above copyright
-.\"    notice, this list of conditions and the following disclaimer.
-.\" 2. Redistributions in binary form must reproduce the above copyright
-.\"    notice, this list of conditions and the following disclaimer in the
-.\"    documentation and/or other materials provided with the distribution.
-.\"
-.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-.\"
-.\" $OpenBSD: ssh_config.5,v 1.7 2003/03/28 10:11:43 jmc Exp $
-.Dd September 25, 1999
-.Dt SSH_CONFIG 5
-.Os
-.Sh NAME
-.Nm ssh_config
-.Nd OpenSSH SSH client configuration files
-.Sh SYNOPSIS
-.Bl -tag -width Ds -compact
-.It Pa $HOME/.ssh/config
-.It Pa /etc/ssh/ssh_config
-.El
-.Sh DESCRIPTION
-.Nm ssh
-obtains configuration data from the following sources in
-the following order:
-.Bl -enum -offset indent -compact
-.It
-command-line options
-.It
-user's configuration file
-.Pq Pa $HOME/.ssh/config
-.It
-system-wide configuration file
-.Pq Pa /etc/ssh/ssh_config
-.El
-.Pp
-For each parameter, the first obtained value
-will be used.
-The configuration files contain sections bracketed by
-.Dq Host
-specifications, and that section is only applied for hosts that
-match one of the patterns given in the specification.
-The matched host name is the one given on the command line.
-.Pp
-Since the first obtained value for each parameter is used, more
-host-specific declarations should be given near the beginning of the
-file, and general defaults at the end.
-.Pp
-The configuration file has the following format:
-.Pp
-Empty lines and lines starting with
-.Ql #
-are comments.
-.Pp
-Otherwise a line is of the format
-.Dq keyword arguments .
-Configuration options may be separated by whitespace or
-optional whitespace and exactly one
-.Ql = ;
-the latter format is useful to avoid the need to quote whitespace
-when specifying configuration options using the
-.Nm ssh ,
-.Nm scp
-and
-.Nm sftp
-.Fl o
-option.
-.Pp
-The possible
-keywords and their meanings are as follows (note that
-keywords are case-insensitive and arguments are case-sensitive):
-.Bl -tag -width Ds
-.It Cm Host
-Restricts the following declarations (up to the next
-.Cm Host
-keyword) to be only for those hosts that match one of the patterns
-given after the keyword.
-.Ql \&*
-and
-.Ql ?
-can be used as wildcards in the
-patterns.
-A single
-.Ql \&*
-as a pattern can be used to provide global
-defaults for all hosts.
-The host is the
-.Ar hostname
-argument given on the command line (i.e., the name is not converted to
-a canonicalized host name before matching).
-.It Cm AFSTokenPassing
-Specifies whether to pass AFS tokens to remote host.
-The argument to this keyword must be
-.Dq yes
-or
-.Dq no .
-This option applies to protocol version 1 only.
-.It Cm BatchMode
-If set to
-.Dq yes ,
-passphrase/password querying will be disabled.
-This option is useful in scripts and other batch jobs where no user
-is present to supply the password.
-The argument must be
-.Dq yes
-or
-.Dq no .
-The default is
-.Dq no .
-.It Cm BindAddress
-Specify the interface to transmit from on machines with multiple
-interfaces or aliased addresses.
-Note that this option does not work if
-.Cm UsePrivilegedPort
-is set to
-.Dq yes .
-.It Cm ChallengeResponseAuthentication
-Specifies whether to use challenge response authentication.
-The argument to this keyword must be
-.Dq yes
-or
-.Dq no .
-The default is
-.Dq yes .
-.It Cm CheckHostIP
-If this flag is set to
-.Dq yes ,
-ssh will additionally check the host IP address in the
-.Pa known_hosts
-file.
-This allows ssh to detect if a host key changed due to DNS spoofing.
-If the option is set to
-.Dq no ,
-the check will not be executed.
-The default is
-.Dq yes .
-.It Cm Cipher
-Specifies the cipher to use for encrypting the session
-in protocol version 1.
-Currently,
-.Dq blowfish ,
-.Dq 3des ,
-and
-.Dq des
-are supported.
-.Ar des
-is only supported in the
-.Nm ssh
-client for interoperability with legacy protocol 1 implementations
-that do not support the
-.Ar 3des
-cipher.
-Its use is strongly discouraged due to cryptographic weaknesses.
-The default is
-.Dq 3des .
-.It Cm Ciphers
-Specifies the ciphers allowed for protocol version 2
-in order of preference.
-Multiple ciphers must be comma-separated.
-The default is
-.Pp
-.Bd -literal
-  ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
-    aes192-cbc,aes256-cbc''
-.Ed
-.It Cm ClearAllForwardings
-Specifies that all local, remote and dynamic port forwardings
-specified in the configuration files or on the command line be
-cleared.
-This option is primarily useful when used from the
-.Nm ssh
-command line to clear port forwardings set in
-configuration files, and is automatically set by
-.Xr scp 1
-and
-.Xr sftp 1 .
-The argument must be
-.Dq yes
-or
-.Dq no .
-The default is
-.Dq no .
-.It Cm Compression
-Specifies whether to use compression.
-The argument must be
-.Dq yes
-or
-.Dq no .
-The default is
-.Dq no .
-.It Cm CompressionLevel
-Specifies the compression level to use if compression is enabled.
-The argument must be an integer from 1 (fast) to 9 (slow, best).
-The default level is 6, which is good for most applications.
-The meaning of the values is the same as in
-.Xr gzip 1 .
-Note that this option applies to protocol version 1 only.
-.It Cm ConnectionAttempts
-Specifies the number of tries (one per second) to make before exiting.
-The argument must be an integer.
-This may be useful in scripts if the connection sometimes fails.
-The default is 1.
-.It Cm DynamicForward
-Specifies that a TCP/IP port on the local machine be forwarded
-over the secure channel, and the application
-protocol is then used to determine where to connect to from the
-remote machine.
-The argument must be a port number.
-Currently the SOCKS4 protocol is supported, and
-.Nm ssh
-will act as a SOCKS4 server.
-Multiple forwardings may be specified, and
-additional forwardings can be given on the command line.
-Only the superuser can forward privileged ports.
-.It Cm EscapeChar
-Sets the escape character (default:
-.Ql ~ ) .
-The escape character can also
-be set on the command line.
-The argument should be a single character,
-.Ql ^
-followed by a letter, or
-.Dq none
-to disable the escape
-character entirely (making the connection transparent for binary
-data).
-.It Cm ForwardAgent
-Specifies whether the connection to the authentication agent (if any)
-will be forwarded to the remote machine.
-The argument must be
-.Dq yes
-or
-.Dq no .
-The default is
-.Dq no .
-.Pp
-Agent forwarding should be enabled with caution.
-Users with the ability to bypass file permissions on the remote host
-(for the agent's Unix-domain socket)
-can access the local agent through the forwarded connection.
-An attacker cannot obtain key material from the agent,
-however they can perform operations on the keys that enable them to
-authenticate using the identities loaded into the agent.
-.It Cm ForwardX11
-Specifies whether X11 connections will be automatically redirected
-over the secure channel and
-.Ev DISPLAY
-set.
-The argument must be
-.Dq yes
-or
-.Dq no .
-The default is
-.Dq no .
-.Pp
-X11 forwarding should be enabled with caution.
-Users with the ability to bypass file permissions on the remote host
-(for the user's X authorization database)
-can access the local X11 display through the forwarded connection.
-An attacker may then be able to perform activities such as keystroke monitoring.
-.It Cm GatewayPorts
-Specifies whether remote hosts are allowed to connect to local
-forwarded ports.
-By default,
-.Nm ssh
-binds local port forwardings to the loopback address.
-This prevents other remote hosts from connecting to forwarded ports.
-.Cm GatewayPorts
-can be used to specify that
-.Nm ssh
-should bind local port forwardings to the wildcard address,
-thus allowing remote hosts to connect to forwarded ports.
-The argument must be
-.Dq yes
-or
-.Dq no .
-The default is
-.Dq no .
-.It Cm GlobalKnownHostsFile
-Specifies a file to use for the global
-host key database instead of
-.Pa /etc/ssh/ssh_known_hosts .
-.It Cm HostbasedAuthentication
-Specifies whether to try rhosts based authentication with public key
-authentication.
-The argument must be
-.Dq yes
-or
-.Dq no .
-The default is
-.Dq no .
-This option applies to protocol version 2 only and
-is similar to
-.Cm RhostsRSAAuthentication .
-.It Cm HostKeyAlgorithms
-Specifies the protocol version 2 host key algorithms
-that the client wants to use in order of preference.
-The default for this option is:
-.Dq ssh-rsa,ssh-dss .
-.It Cm HostKeyAlias
-Specifies an alias that should be used instead of the
-real host name when looking up or saving the host key
-in the host key database files.
-This option is useful for tunneling ssh connections
-or for multiple servers running on a single host.
-.It Cm HostName
-Specifies the real host name to log into.
-This can be used to specify nicknames or abbreviations for hosts.
-Default is the name given on the command line.
-Numeric IP addresses are also permitted (both on the command line and in
-.Cm HostName
-specifications).
-.It Cm IdentityFile
-Specifies a file from which the user's RSA or DSA authentication identity
-is read. The default is
-.Pa $HOME/.ssh/identity
-for protocol version 1, and
-.Pa $HOME/.ssh/id_rsa
-and
-.Pa $HOME/.ssh/id_dsa
-for protocol version 2.
-Additionally, any identities represented by the authentication agent
-will be used for authentication.
-The file name may use the tilde
-syntax to refer to a user's home directory.
-It is possible to have
-multiple identity files specified in configuration files; all these
-identities will be tried in sequence.
-.It Cm KeepAlive
-Specifies whether the system should send TCP keepalive messages to the
-other side.
-If they are sent, death of the connection or crash of one
-of the machines will be properly noticed.
-However, this means that
-connections will die if the route is down temporarily, and some people
-find it annoying.
-.Pp
-The default is
-.Dq yes
-(to send keepalives), and the client will notice
-if the network goes down or the remote host dies.
-This is important in scripts, and many users want it too.
-.Pp
-To disable keepalives, the value should be set to
-.Dq no .
-.It Cm KerberosAuthentication
-Specifies whether Kerberos authentication will be used.
-The argument to this keyword must be
-.Dq yes
-or
-.Dq no .
-.It Cm KerberosTgtPassing
-Specifies whether a Kerberos TGT will be forwarded to the server.
-This will only work if the Kerberos server is actually an AFS kaserver.
-The argument to this keyword must be
-.Dq yes
-or
-.Dq no .
-.It Cm LocalForward
-Specifies that a TCP/IP port on the local machine be forwarded over
-the secure channel to the specified host and port from the remote machine.
-The first argument must be a port number, and the second must be
-.Ar host:port .
-IPv6 addresses can be specified with an alternative syntax:
-.Ar host/port .
-Multiple forwardings may be specified, and additional
-forwardings can be given on the command line.
-Only the superuser can forward privileged ports.
-.It Cm LogLevel
-Gives the verbosity level that is used when logging messages from
-.Nm ssh .
-The possible values are:
-QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3.
-The default is INFO.
-DEBUG and DEBUG1 are equivalent.
-DEBUG2 and DEBUG3 each specify higher levels of verbose output.
-.It Cm MACs
-Specifies the MAC (message authentication code) algorithms
-in order of preference.
-The MAC algorithm is used in protocol version 2
-for data integrity protection.
-Multiple algorithms must be comma-separated.
-The default is
-.Dq hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96 .
-.It Cm NoHostAuthenticationForLocalhost
-This option can be used if the home directory is shared across machines.
-In this case localhost will refer to a different machine on each of
-the machines and the user will get many warnings about changed host keys.
-However, this option disables host authentication for localhost.
-The argument to this keyword must be
-.Dq yes
-or
-.Dq no .
-The default is to check the host key for localhost.
-.It Cm NumberOfPasswordPrompts
-Specifies the number of password prompts before giving up.
-The argument to this keyword must be an integer.
-Default is 3.
-.It Cm PasswordAuthentication
-Specifies whether to use password authentication.
-The argument to this keyword must be
-.Dq yes
-or
-.Dq no .
-The default is
-.Dq yes .
-.It Cm Port
-Specifies the port number to connect on the remote host.
-Default is 22.
-.It Cm PreferredAuthentications
-Specifies the order in which the client should try protocol 2
-authentication methods. This allows a client to prefer one method (e.g.
-.Cm keyboard-interactive )
-over another method (e.g.
-.Cm password )
-The default for this option is:
-.Dq hostbased,publickey,keyboard-interactive,password .
-.It Cm Protocol
-Specifies the protocol versions
-.Nm ssh
-should support in order of preference.
-The possible values are
-.Dq 1
-and
-.Dq 2 .
-Multiple versions must be comma-separated.
-The default is
-.Dq 2,1 .
-This means that
-.Nm ssh
-tries version 2 and falls back to version 1
-if version 2 is not available.
-.It Cm ProxyCommand
-Specifies the command to use to connect to the server.
-The command
-string extends to the end of the line, and is executed with
-.Pa /bin/sh .
-In the command string,
-.Ql %h
-will be substituted by the host name to
-connect and
-.Ql %p
-by the port.
-The command can be basically anything,
-and should read from its standard input and write to its standard output.
-It should eventually connect an
-.Xr sshd 8
-server running on some machine, or execute
-.Ic sshd -i
-somewhere.
-Host key management will be done using the
-HostName of the host being connected (defaulting to the name typed by
-the user).
-Setting the command to
-.Dq none
-disables this option entirely.
-Note that
-.Cm CheckHostIP
-is not available for connects with a proxy command.
-.Pp
-.It Cm PubkeyAuthentication
-Specifies whether to try public key authentication.
-The argument to this keyword must be
-.Dq yes
-or
-.Dq no .
-The default is
-.Dq yes .
-This option applies to protocol version 2 only.
-.It Cm RemoteForward
-Specifies that a TCP/IP port on the remote machine be forwarded over
-the secure channel to the specified host and port from the local machine.
-The first argument must be a port number, and the second must be
-.Ar host:port .
-IPv6 addresses can be specified with an alternative syntax:
-.Ar host/port .
-Multiple forwardings may be specified, and additional
-forwardings can be given on the command line.
-Only the superuser can forward privileged ports.
-.It Cm RhostsAuthentication
-Specifies whether to try rhosts based authentication.
-Note that this
-declaration only affects the client side and has no effect whatsoever
-on security.
-Most servers do not permit RhostsAuthentication because it
-is not secure (see
-.Cm RhostsRSAAuthentication ) .
-The argument to this keyword must be
-.Dq yes
-or
-.Dq no .
-The default is
-.Dq no .
-This option applies to protocol version 1 only and requires
-.Nm ssh
-to be setuid root and
-.Cm UsePrivilegedPort
-to be set to
-.Dq yes .
-.It Cm RhostsRSAAuthentication
-Specifies whether to try rhosts based authentication with RSA host
-authentication.
-The argument must be
-.Dq yes
-or
-.Dq no .
-The default is
-.Dq no .
-This option applies to protocol version 1 only and requires
-.Nm ssh
-to be setuid root.
-.It Cm RSAAuthentication
-Specifies whether to try RSA authentication.
-The argument to this keyword must be
-.Dq yes
-or
-.Dq no .
-RSA authentication will only be
-attempted if the identity file exists, or an authentication agent is
-running.
-The default is
-.Dq yes .
-Note that this option applies to protocol version 1 only.
-.It Cm SmartcardDevice
-Specifies which smartcard device to use. The argument to this keyword is
-the device
-.Nm ssh
-should use to communicate with a smartcard used for storing the user's
-private RSA key. By default, no device is specified and smartcard support
-is not activated.
-.It Cm StrictHostKeyChecking
-If this flag is set to
-.Dq yes ,
-.Nm ssh
-will never automatically add host keys to the
-.Pa $HOME/.ssh/known_hosts
-file, and refuses to connect to hosts whose host key has changed.
-This provides maximum protection against trojan horse attacks,
-however, can be annoying when the
-.Pa /etc/ssh/ssh_known_hosts
-file is poorly maintained, or connections to new hosts are
-frequently made.
-This option forces the user to manually
-add all new hosts.
-If this flag is set to
-.Dq no ,
-.Nm ssh
-will automatically add new host keys to the
-user known hosts files.
-If this flag is set to
-.Dq ask ,
-new host keys
-will be added to the user known host files only after the user
-has confirmed that is what they really want to do, and
-.Nm ssh
-will refuse to connect to hosts whose host key has changed.
-The host keys of
-known hosts will be verified automatically in all cases.
-The argument must be
-.Dq yes ,
-.Dq no
-or
-.Dq ask .
-The default is
-.Dq ask .
-.It Cm UsePrivilegedPort
-Specifies whether to use a privileged port for outgoing connections.
-The argument must be
-.Dq yes
-or
-.Dq no .
-The default is
-.Dq no .
-If set to
-.Dq yes
-.Nm ssh
-must be setuid root.
-Note that this option must be set to
-.Dq yes
-if
-.Cm RhostsAuthentication
-and
-.Cm RhostsRSAAuthentication
-authentications are needed with older servers.
-.It Cm User
-Specifies the user to log in as.
-This can be useful when a different user name is used on different machines.
-This saves the trouble of
-having to remember to give the user name on the command line.
-.It Cm UserKnownHostsFile
-Specifies a file to use for the user
-host key database instead of
-.Pa $HOME/.ssh/known_hosts .
-.It Cm XAuthLocation
-Specifies the full pathname of the
-.Xr xauth 1
-program.
-The default is
-.Pa /usr/X11R6/bin/xauth .
-.El
-.Sh FILES
-.Bl -tag -width Ds
-.It Pa $HOME/.ssh/config
-This is the per-user configuration file.
-The format of this file is described above.
-This file is used by the
-.Nm ssh
-client.
-This file does not usually contain any sensitive information,
-but the recommended permissions are read/write for the user, and not
-accessible by others.
-.It Pa /etc/ssh/ssh_config
-Systemwide configuration file.
-This file provides defaults for those
-values that are not specified in the user's configuration file, and
-for those users who do not have a configuration file.
-This file must be world-readable.
-.El
-.Sh AUTHORS
-OpenSSH is a derivative of the original and free
-ssh 1.2.12 release by Tatu Ylonen.
-Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos,
-Theo de Raadt and Dug Song
-removed many bugs, re-added newer features and
-created OpenSSH.
-Markus Friedl contributed the support for SSH
-protocol versions 1.5 and 2.0.
-.Sh SEE ALSO
-.Xr ssh 1
diff --git a/crypto/openssh/ssh_prng_cmds.in b/crypto/openssh/ssh_prng_cmds.in
deleted file mode 100644
index 50e7771f9b10..000000000000
--- a/crypto/openssh/ssh_prng_cmds.in
+++ /dev/null
@@ -1,75 +0,0 @@
-# entropy gathering commands
-
-# Format is: "program-name args" path rate
-
-# The "rate" represents the number of bits of usuable entropy per 
-# byte of command output. Be conservative.
-#
-# $Id: ssh_prng_cmds.in,v 1.8 2002/07/14 21:43:58 tim Exp $
-
-"ls -alni /var/log"			@PROG_LS@	0.02
-"ls -alni /var/adm"			@PROG_LS@	0.02
-"ls -alni /usr/adm"                     @PROG_LS@       0.02
-"ls -alni /var/mail"			@PROG_LS@	0.02
-"ls -alni /usr/mail"                    @PROG_LS@       0.02
-"ls -alni /var/adm/syslog"		@PROG_LS@	0.02
-"ls -alni /usr/adm/syslog"		@PROG_LS@	0.02
-"ls -alni /var/spool/mail"		@PROG_LS@	0.02
-"ls -alni /proc"			@PROG_LS@	0.02
-"ls -alni /tmp"				@PROG_LS@	0.02
-"ls -alni /var/tmp"			@PROG_LS@	0.02
-"ls -alni /usr/tmp"			@PROG_LS@	0.02
-"ls -alTi /var/log"			@PROG_LS@	0.02
-"ls -alTi /var/adm"			@PROG_LS@	0.02
-"ls -alTi /var/mail"			@PROG_LS@	0.02
-"ls -alTi /var/adm/syslog"		@PROG_LS@	0.02
-"ls -alTi /var/spool/mail"		@PROG_LS@	0.02
-"ls -alTi /proc"			@PROG_LS@	0.02
-"ls -alTi /tmp"				@PROG_LS@	0.02
-"ls -alTi /var/tmp"			@PROG_LS@	0.02
-"ls -alTi /usr/tmp"			@PROG_LS@	0.02
-
-"netstat -an"				@PROG_NETSTAT@	0.05
-"netstat -in"				@PROG_NETSTAT@	0.05
-"netstat -rn"				@PROG_NETSTAT@	0.02
-"netstat -pn"				@PROG_NETSTAT@	0.02
-"netstat -ia"                           @PROG_NETSTAT@  0.05
-"netstat -s"				@PROG_NETSTAT@	0.02
-"netstat -is"				@PROG_NETSTAT@	0.07
-
-"arp -n -a"				@PROG_ARP@	0.02
-
-"ifconfig -a"				@PROG_IFCONFIG@	0.02
-
-"ps laxww"				@PROG_PS@	0.03
-"ps -al"				@PROG_PS@	0.03
-"ps -efl"				@PROG_PS@	0.03
-"jstat"				        @PROG_JSTAT@    0.07
-
-"w"					@PROG_W@	0.05
-
-"who -i"				@PROG_WHO@	0.01
-
-"last"					@PROG_LAST@	0.01
-
-"lastlog"				@PROG_LASTLOG@	0.01
-
-"df"					@PROG_DF@	0.01
-"df -i"					@PROG_DF@	0.01
-
-"sar -d"				@PROG_SAR@	0.04
-
-"vmstat"				@PROG_VMSTAT@	0.01
-"uptime"				@PROG_UPTIME@	0.01
-
-"ipcs -a"				@PROG_IPCS@	0.01
-
-"tail -200 /var/log/messages"		@PROG_TAIL@	0.01
-"tail -200 /var/log/syslog"		@PROG_TAIL@	0.01
-"tail -200 /var/adm/messages"		@PROG_TAIL@	0.01
-"tail -200 /var/adm/syslog"		@PROG_TAIL@	0.01
-"tail -200 /var/adm/syslog/syslog.log"	@PROG_TAIL@	0.01
-"tail -200 /var/log/maillog"		@PROG_TAIL@	0.01
-"tail -200 /var/adm/maillog"		@PROG_TAIL@	0.01
-"tail -200 /var/adm/syslog/mail.log"	@PROG_TAIL@	0.01
-
diff --git a/crypto/openssh/sshconnect.c b/crypto/openssh/sshconnect.c
deleted file mode 100644
index dae25969a49d..000000000000
--- a/crypto/openssh/sshconnect.c
+++ /dev/null
@@ -1,926 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * Code to connect to a remote host, and to perform the client side of the
- * login (authentication) dialog.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: sshconnect.c,v 1.137 2002/11/21 23:03:51 deraadt Exp $");
-
-#include <openssl/bn.h>
-
-#include "ssh.h"
-#include "xmalloc.h"
-#include "rsa.h"
-#include "buffer.h"
-#include "packet.h"
-#include "uidswap.h"
-#include "compat.h"
-#include "key.h"
-#include "sshconnect.h"
-#include "hostfile.h"
-#include "log.h"
-#include "readconf.h"
-#include "atomicio.h"
-#include "misc.h"
-#include "readpass.h"
-
-char *client_version_string = NULL;
-char *server_version_string = NULL;
-
-/* import */
-extern Options options;
-extern char *__progname;
-extern uid_t original_real_uid;
-extern uid_t original_effective_uid;
-extern pid_t proxy_command_pid;
-
-#ifndef INET6_ADDRSTRLEN		/* for non IPv6 machines */
-#define INET6_ADDRSTRLEN 46
-#endif
-
-static int show_other_keys(const char *, Key *);
-
-/*
- * Connect to the given ssh server using a proxy command.
- */
-static int
-ssh_proxy_connect(const char *host, u_short port, const char *proxy_command)
-{
-	Buffer command;
-	const char *cp;
-	char *command_string;
-	int pin[2], pout[2];
-	pid_t pid;
-	char strport[NI_MAXSERV];
-
-	/* Convert the port number into a string. */
-	snprintf(strport, sizeof strport, "%hu", port);
-
-	/*
-	 * Build the final command string in the buffer by making the
-	 * appropriate substitutions to the given proxy command.
-	 *
-	 * Use "exec" to avoid "sh -c" processes on some platforms 
-	 * (e.g. Solaris)
-	 */
-	buffer_init(&command);
-	buffer_append(&command, "exec ", 5);
-
-	for (cp = proxy_command; *cp; cp++) {
-		if (cp[0] == '%' && cp[1] == '%') {
-			buffer_append(&command, "%", 1);
-			cp++;
-			continue;
-		}
-		if (cp[0] == '%' && cp[1] == 'h') {
-			buffer_append(&command, host, strlen(host));
-			cp++;
-			continue;
-		}
-		if (cp[0] == '%' && cp[1] == 'p') {
-			buffer_append(&command, strport, strlen(strport));
-			cp++;
-			continue;
-		}
-		buffer_append(&command, cp, 1);
-	}
-	buffer_append(&command, "\0", 1);
-
-	/* Get the final command string. */
-	command_string = buffer_ptr(&command);
-
-	/* Create pipes for communicating with the proxy. */
-	if (pipe(pin) < 0 || pipe(pout) < 0)
-		fatal("Could not create pipes to communicate with the proxy: %.100s",
-		    strerror(errno));
-
-	debug("Executing proxy command: %.500s", command_string);
-
-	/* Fork and execute the proxy command. */
-	if ((pid = fork()) == 0) {
-		char *argv[10];
-
-		/* Child.  Permanently give up superuser privileges. */
-		seteuid(original_real_uid);
-		setuid(original_real_uid);
-
-		/* Redirect stdin and stdout. */
-		close(pin[1]);
-		if (pin[0] != 0) {
-			if (dup2(pin[0], 0) < 0)
-				perror("dup2 stdin");
-			close(pin[0]);
-		}
-		close(pout[0]);
-		if (dup2(pout[1], 1) < 0)
-			perror("dup2 stdout");
-		/* Cannot be 1 because pin allocated two descriptors. */
-		close(pout[1]);
-
-		/* Stderr is left as it is so that error messages get
-		   printed on the user's terminal. */
-		argv[0] = _PATH_BSHELL;
-		argv[1] = "-c";
-		argv[2] = command_string;
-		argv[3] = NULL;
-
-		/* Execute the proxy command.  Note that we gave up any
-		   extra privileges above. */
-		execv(argv[0], argv);
-		perror(argv[0]);
-		exit(1);
-	}
-	/* Parent. */
-	if (pid < 0)
-		fatal("fork failed: %.100s", strerror(errno));
-	else
-		proxy_command_pid = pid; /* save pid to clean up later */
-
-	/* Close child side of the descriptors. */
-	close(pin[0]);
-	close(pout[1]);
-
-	/* Free the command name. */
-	buffer_free(&command);
-
-	/* Set the connection file descriptors. */
-	packet_set_connection(pout[0], pin[1]);
-
-	/* Indicate OK return */
-	return 0;
-}
-
-/*
- * Creates a (possibly privileged) socket for use as the ssh connection.
- */
-static int
-ssh_create_socket(int privileged, int family)
-{
-	int sock, gaierr;
-	struct addrinfo hints, *res;
-
-	/*
-	 * If we are running as root and want to connect to a privileged
-	 * port, bind our own socket to a privileged port.
-	 */
-	if (privileged) {
-		int p = IPPORT_RESERVED - 1;
-		PRIV_START;
-		sock = rresvport_af(&p, family);
-		PRIV_END;
-		if (sock < 0)
-			error("rresvport: af=%d %.100s", family, strerror(errno));
-		else
-			debug("Allocated local port %d.", p);
-		return sock;
-	}
-	sock = socket(family, SOCK_STREAM, 0);
-	if (sock < 0)
-		error("socket: %.100s", strerror(errno));
-
-	/* Bind the socket to an alternative local IP address */
-	if (options.bind_address == NULL)
-		return sock;
-
-	memset(&hints, 0, sizeof(hints));
-	hints.ai_family = family;
-	hints.ai_socktype = SOCK_STREAM;
-	hints.ai_flags = AI_PASSIVE;
-	gaierr = getaddrinfo(options.bind_address, "0", &hints, &res);
-	if (gaierr) {
-		error("getaddrinfo: %s: %s", options.bind_address,
-		    gai_strerror(gaierr));
-		close(sock);
-		return -1;
-	}
-	if (bind(sock, res->ai_addr, res->ai_addrlen) < 0) {
-		error("bind: %s: %s", options.bind_address, strerror(errno));
-		close(sock);
-		freeaddrinfo(res);
-		return -1;
-	}
-	freeaddrinfo(res);
-	return sock;
-}
-
-/*
- * Opens a TCP/IP connection to the remote server on the given host.
- * The address of the remote host will be returned in hostaddr.
- * If port is 0, the default port will be used.  If needpriv is true,
- * a privileged port will be allocated to make the connection.
- * This requires super-user privileges if needpriv is true.
- * Connection_attempts specifies the maximum number of tries (one per
- * second).  If proxy_command is non-NULL, it specifies the command (with %h
- * and %p substituted for host and port, respectively) to use to contact
- * the daemon.
- * Return values:
- *    0 for OK
- *    ECONNREFUSED if we got a "Connection Refused" by the peer on any address
- *    ECONNABORTED if we failed without a "Connection refused"
- * Suitable error messages for the connection failure will already have been
- * printed.
- */
-int
-ssh_connect(const char *host, struct sockaddr_storage * hostaddr,
-    u_short port, int family, int connection_attempts,
-    int needpriv, const char *proxy_command)
-{
-	int gaierr;
-	int on = 1;
-	int sock = -1, attempt;
-	char ntop[NI_MAXHOST], strport[NI_MAXSERV];
-	struct addrinfo hints, *ai, *aitop;
-	struct servent *sp;
-	/*
-	 * Did we get only other errors than "Connection refused" (which
-	 * should block fallback to rsh and similar), or did we get at least
-	 * one "Connection refused"?
-	 */
-	int full_failure = 1;
-
-	debug2("ssh_connect: needpriv %d", needpriv);
-
-	/* Get default port if port has not been set. */
-	if (port == 0) {
-		sp = getservbyname(SSH_SERVICE_NAME, "tcp");
-		if (sp)
-			port = ntohs(sp->s_port);
-		else
-			port = SSH_DEFAULT_PORT;
-	}
-	/* If a proxy command is given, connect using it. */
-	if (proxy_command != NULL)
-		return ssh_proxy_connect(host, port, proxy_command);
-
-	/* No proxy command. */
-
-	memset(&hints, 0, sizeof(hints));
-	hints.ai_family = family;
-	hints.ai_socktype = SOCK_STREAM;
-	snprintf(strport, sizeof strport, "%u", port);
-	if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0)
-		fatal("%s: %.100s: %s", __progname, host,
-		    gai_strerror(gaierr));
-
-	/*
-	 * Try to connect several times.  On some machines, the first time
-	 * will sometimes fail.  In general socket code appears to behave
-	 * quite magically on many machines.
-		 */
-	for (attempt = 0; ;) {
-		if (attempt > 0)
-			debug("Trying again...");
-
-		/* Loop through addresses for this host, and try each one in
-		   sequence until the connection succeeds. */
-		for (ai = aitop; ai; ai = ai->ai_next) {
-			if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
-				continue;
-			if (getnameinfo(ai->ai_addr, ai->ai_addrlen,
-			    ntop, sizeof(ntop), strport, sizeof(strport),
-			    NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
-				error("ssh_connect: getnameinfo failed");
-				continue;
-			}
-			debug("Connecting to %.200s [%.100s] port %s.",
-				host, ntop, strport);
-
-			/* Create a socket for connecting. */
-			sock = ssh_create_socket(needpriv, ai->ai_family);
-			if (sock < 0)
-				/* Any error is already output */
-				continue;
-
-			if (connect(sock, ai->ai_addr, ai->ai_addrlen) >= 0) {
-				/* Successful connection. */
-				memcpy(hostaddr, ai->ai_addr, ai->ai_addrlen);
-				break;
-			} else {
-				if (errno == ECONNREFUSED)
-					full_failure = 0;
-				debug("connect to address %s port %s: %s",
-				    ntop, strport, strerror(errno));
-				/*
-				 * Close the failed socket; there appear to
-				 * be some problems when reusing a socket for
-				 * which connect() has already returned an
-				 * error.
-				 */
-				close(sock);
-			}
-		}
-		if (ai)
-			break;	/* Successful connection. */
-
-		attempt++;
-		if (attempt >= connection_attempts)
-			break;
-		/* Sleep a moment before retrying. */
-		sleep(1);
-	}
-
-	freeaddrinfo(aitop);
-
-	/* Return failure if we didn't get a successful connection. */
-	if (attempt >= connection_attempts) {
-		log("ssh: connect to host %s port %s: %s",
-		    host, strport, strerror(errno));
-		return full_failure ? ECONNABORTED : ECONNREFUSED;
-	}
-
-	debug("Connection established.");
-
-	/* Set keepalives if requested. */
-	if (options.keepalives &&
-	    setsockopt(sock, SOL_SOCKET, SO_KEEPALIVE, (void *)&on,
-	    sizeof(on)) < 0)
-		error("setsockopt SO_KEEPALIVE: %.100s", strerror(errno));
-
-	/* Set the connection. */
-	packet_set_connection(sock, sock);
-
-	return 0;
-}
-
-/*
- * Waits for the server identification string, and sends our own
- * identification string.
- */
-static void
-ssh_exchange_identification(void)
-{
-	char buf[256], remote_version[256];	/* must be same size! */
-	int remote_major, remote_minor, i, mismatch;
-	int connection_in = packet_get_connection_in();
-	int connection_out = packet_get_connection_out();
-	int minor1 = PROTOCOL_MINOR_1;
-
-	/* Read other side\'s version identification. */
-	for (;;) {
-		for (i = 0; i < sizeof(buf) - 1; i++) {
-			int len = atomicio(read, connection_in, &buf[i], 1);
-			if (len < 0)
-				fatal("ssh_exchange_identification: read: %.100s", strerror(errno));
-			if (len != 1)
-				fatal("ssh_exchange_identification: Connection closed by remote host");
-			if (buf[i] == '\r') {
-				buf[i] = '\n';
-				buf[i + 1] = 0;
-				continue;		/**XXX wait for \n */
-			}
-			if (buf[i] == '\n') {
-				buf[i + 1] = 0;
-				break;
-			}
-		}
-		buf[sizeof(buf) - 1] = 0;
-		if (strncmp(buf, "SSH-", 4) == 0)
-			break;
-		debug("ssh_exchange_identification: %s", buf);
-	}
-	server_version_string = xstrdup(buf);
-
-	/*
-	 * Check that the versions match.  In future this might accept
-	 * several versions and set appropriate flags to handle them.
-	 */
-	if (sscanf(server_version_string, "SSH-%d.%d-%[^\n]\n",
-	    &remote_major, &remote_minor, remote_version) != 3)
-		fatal("Bad remote protocol version identification: '%.100s'", buf);
-	debug("Remote protocol version %d.%d, remote software version %.100s",
-	    remote_major, remote_minor, remote_version);
-
-	compat_datafellows(remote_version);
-	mismatch = 0;
-
-	switch (remote_major) {
-	case 1:
-		if (remote_minor == 99 &&
-		    (options.protocol & SSH_PROTO_2) &&
-		    !(options.protocol & SSH_PROTO_1_PREFERRED)) {
-			enable_compat20();
-			break;
-		}
-		if (!(options.protocol & SSH_PROTO_1)) {
-			mismatch = 1;
-			break;
-		}
-		if (remote_minor < 3) {
-			fatal("Remote machine has too old SSH software version.");
-		} else if (remote_minor == 3 || remote_minor == 4) {
-			/* We speak 1.3, too. */
-			enable_compat13();
-			minor1 = 3;
-			if (options.forward_agent) {
-				log("Agent forwarding disabled for protocol 1.3");
-				options.forward_agent = 0;
-			}
-		}
-		break;
-	case 2:
-		if (options.protocol & SSH_PROTO_2) {
-			enable_compat20();
-			break;
-		}
-		/* FALLTHROUGH */
-	default:
-		mismatch = 1;
-		break;
-	}
-	if (mismatch)
-		fatal("Protocol major versions differ: %d vs. %d",
-		    (options.protocol & SSH_PROTO_2) ? PROTOCOL_MAJOR_2 : PROTOCOL_MAJOR_1,
-		    remote_major);
-	/* Send our own protocol version identification. */
-	snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s\n",
-	    compat20 ? PROTOCOL_MAJOR_2 : PROTOCOL_MAJOR_1,
-	    compat20 ? PROTOCOL_MINOR_2 : minor1,
-	    SSH_VERSION);
-	if (atomicio(write, connection_out, buf, strlen(buf)) != strlen(buf))
-		fatal("write: %.100s", strerror(errno));
-	client_version_string = xstrdup(buf);
-	chop(client_version_string);
-	chop(server_version_string);
-	debug("Local version string %.100s", client_version_string);
-}
-
-/* defaults to 'no' */
-static int
-confirm(const char *prompt)
-{
-	const char *msg, *again = "Please type 'yes' or 'no': ";
-	char *p;
-	int ret = -1;
-
-	if (options.batch_mode)
-		return 0;
-	for (msg = prompt;;msg = again) {
-		p = read_passphrase(msg, RP_ECHO);
-		if (p == NULL ||
-		    (p[0] == '\0') || (p[0] == '\n') ||
-		    strncasecmp(p, "no", 2) == 0)
-			ret = 0;
-		if (p && strncasecmp(p, "yes", 3) == 0)
-			ret = 1;
-		if (p)
-			xfree(p);
-		if (ret != -1)
-			return ret;
-	}
-}
-
-/*
- * check whether the supplied host key is valid, return -1 if the key
- * is not valid. the user_hostfile will not be updated if 'readonly' is true.
- */
-static int
-check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
-    int readonly, const char *user_hostfile, const char *system_hostfile)
-{
-	Key *file_key;
-	char *type = key_type(host_key);
-	char *ip = NULL;
-	char hostline[1000], *hostp, *fp;
-	HostStatus host_status;
-	HostStatus ip_status;
-	int local = 0, host_ip_differ = 0;
-	int salen;
-	char ntop[NI_MAXHOST];
-	char msg[1024];
-	int len, host_line, ip_line, has_keys;
-	const char *host_file = NULL, *ip_file = NULL;
-
-	/*
-	 * Force accepting of the host key for loopback/localhost. The
-	 * problem is that if the home directory is NFS-mounted to multiple
-	 * machines, localhost will refer to a different machine in each of
-	 * them, and the user will get bogus HOST_CHANGED warnings.  This
-	 * essentially disables host authentication for localhost; however,
-	 * this is probably not a real problem.
-	 */
-	/**  hostaddr == 0! */
-	switch (hostaddr->sa_family) {
-	case AF_INET:
-		local = (ntohl(((struct sockaddr_in *)hostaddr)->
-		   sin_addr.s_addr) >> 24) == IN_LOOPBACKNET;
-		salen = sizeof(struct sockaddr_in);
-		break;
-	case AF_INET6:
-		local = IN6_IS_ADDR_LOOPBACK(
-		    &(((struct sockaddr_in6 *)hostaddr)->sin6_addr));
-		salen = sizeof(struct sockaddr_in6);
-		break;
-	default:
-		local = 0;
-		salen = sizeof(struct sockaddr_storage);
-		break;
-	}
-	if (options.no_host_authentication_for_localhost == 1 && local &&
-	    options.host_key_alias == NULL) {
-		debug("Forcing accepting of host key for "
-		    "loopback/localhost.");
-		return 0;
-	}
-
-	/*
-	 * We don't have the remote ip-address for connections
-	 * using a proxy command
-	 */
-	if (options.proxy_command == NULL) {
-		if (getnameinfo(hostaddr, salen, ntop, sizeof(ntop),
-		    NULL, 0, NI_NUMERICHOST) != 0)
-			fatal("check_host_key: getnameinfo failed");
-		ip = xstrdup(ntop);
-	} else {
-		ip = xstrdup("<no hostip for proxy command>");
-	}
-	/*
-	 * Turn off check_host_ip if the connection is to localhost, via proxy
-	 * command or if we don't have a hostname to compare with
-	 */
-	if (options.check_host_ip &&
-	    (local || strcmp(host, ip) == 0 || options.proxy_command != NULL))
-		options.check_host_ip = 0;
-
-	/*
-	 * Allow the user to record the key under a different name. This is
-	 * useful for ssh tunneling over forwarded connections or if you run
-	 * multiple sshd's on different ports on the same machine.
-	 */
-	if (options.host_key_alias != NULL) {
-		host = options.host_key_alias;
-		debug("using hostkeyalias: %s", host);
-	}
-
-	/*
-	 * Store the host key from the known host file in here so that we can
-	 * compare it with the key for the IP address.
-	 */
-	file_key = key_new(host_key->type);
-
-	/*
-	 * Check if the host key is present in the user\'s list of known
-	 * hosts or in the systemwide list.
-	 */
-	host_file = user_hostfile;
-	host_status = check_host_in_hostfile(host_file, host, host_key,
-	    file_key, &host_line);
-	if (host_status == HOST_NEW) {
-		host_file = system_hostfile;
-		host_status = check_host_in_hostfile(host_file, host, host_key,
-		    file_key, &host_line);
-	}
-	/*
-	 * Also perform check for the ip address, skip the check if we are
-	 * localhost or the hostname was an ip address to begin with
-	 */
-	if (options.check_host_ip) {
-		Key *ip_key = key_new(host_key->type);
-
-		ip_file = user_hostfile;
-		ip_status = check_host_in_hostfile(ip_file, ip, host_key,
-		    ip_key, &ip_line);
-		if (ip_status == HOST_NEW) {
-			ip_file = system_hostfile;
-			ip_status = check_host_in_hostfile(ip_file, ip,
-			    host_key, ip_key, &ip_line);
-		}
-		if (host_status == HOST_CHANGED &&
-		    (ip_status != HOST_CHANGED || !key_equal(ip_key, file_key)))
-			host_ip_differ = 1;
-
-		key_free(ip_key);
-	} else
-		ip_status = host_status;
-
-	key_free(file_key);
-
-	switch (host_status) {
-	case HOST_OK:
-		/* The host is known and the key matches. */
-		debug("Host '%.200s' is known and matches the %s host key.",
-		    host, type);
-		debug("Found key in %s:%d", host_file, host_line);
-		if (options.check_host_ip && ip_status == HOST_NEW) {
-			if (readonly)
-				log("%s host key for IP address "
-				    "'%.128s' not in list of known hosts.",
-				    type, ip);
-			else if (!add_host_to_hostfile(user_hostfile, ip,
-			    host_key))
-				log("Failed to add the %s host key for IP "
-				    "address '%.128s' to the list of known "
-				    "hosts (%.30s).", type, ip, user_hostfile);
-			else
-				log("Warning: Permanently added the %s host "
-				    "key for IP address '%.128s' to the list "
-				    "of known hosts.", type, ip);
-		}
-		break;
-	case HOST_NEW:
-		if (readonly)
-			goto fail;
-		/* The host is new. */
-		if (options.strict_host_key_checking == 1) {
-			/*
-			 * User has requested strict host key checking.  We
-			 * will not add the host key automatically.  The only
-			 * alternative left is to abort.
-			 */
-			error("No %s host key is known for %.200s and you "
-			    "have requested strict checking.", type, host);
-			goto fail;
-		} else if (options.strict_host_key_checking == 2) {
-			has_keys = show_other_keys(host, host_key);
-			/* The default */
-			fp = key_fingerprint(host_key, SSH_FP_MD5, SSH_FP_HEX);
-			snprintf(msg, sizeof(msg),
-			    "The authenticity of host '%.200s (%s)' can't be "
-			    "established%s\n"
-			    "%s key fingerprint is %s.\n"
-			    "Are you sure you want to continue connecting "
-			    "(yes/no)? ",
-			    host, ip,
-			    has_keys ? ",\nbut keys of different type are already "
-			    "known for this host." : ".",
-			    type, fp);
-			xfree(fp);
-			if (!confirm(msg))
-				goto fail;
-		}
-		if (options.check_host_ip && ip_status == HOST_NEW) {
-			snprintf(hostline, sizeof(hostline), "%s,%s", host, ip);
-			hostp = hostline;
-		} else
-			hostp = host;
-
-		/*
-		 * If not in strict mode, add the key automatically to the
-		 * local known_hosts file.
-		 */
-		if (!add_host_to_hostfile(user_hostfile, hostp, host_key))
-			log("Failed to add the host to the list of known "
-			    "hosts (%.500s).", user_hostfile);
-		else
-			log("Warning: Permanently added '%.200s' (%s) to the "
-			    "list of known hosts.", hostp, type);
-		break;
-	case HOST_CHANGED:
-		if (options.check_host_ip && host_ip_differ) {
-			char *msg;
-			if (ip_status == HOST_NEW)
-				msg = "is unknown";
-			else if (ip_status == HOST_OK)
-				msg = "is unchanged";
-			else
-				msg = "has a different value";
-			error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
-			error("@       WARNING: POSSIBLE DNS SPOOFING DETECTED!          @");
-			error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
-			error("The %s host key for %s has changed,", type, host);
-			error("and the key for the according IP address %s", ip);
-			error("%s. This could either mean that", msg);
-			error("DNS SPOOFING is happening or the IP address for the host");
-			error("and its host key have changed at the same time.");
-			if (ip_status != HOST_NEW)
-				error("Offending key for IP in %s:%d", ip_file, ip_line);
-		}
-		/* The host key has changed. */
-		fp = key_fingerprint(host_key, SSH_FP_MD5, SSH_FP_HEX);
-		error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
-		error("@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @");
-		error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
-		error("IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!");
-		error("Someone could be eavesdropping on you right now (man-in-the-middle attack)!");
-		error("It is also possible that the %s host key has just been changed.", type);
-		error("The fingerprint for the %s key sent by the remote host is\n%s.",
-		    type, fp);
-		error("Please contact your system administrator.");
-		error("Add correct host key in %.100s to get rid of this message.",
-		    user_hostfile);
-		error("Offending key in %s:%d", host_file, host_line);
-		xfree(fp);
-
-		/*
-		 * If strict host key checking is in use, the user will have
-		 * to edit the key manually and we can only abort.
-		 */
-		if (options.strict_host_key_checking) {
-			error("%s host key for %.200s has changed and you have "
-			    "requested strict checking.", type, host);
-			goto fail;
-		}
-
-		/*
-		 * If strict host key checking has not been requested, allow
-		 * the connection but without password authentication or
-		 * agent forwarding.
-		 */
-		if (options.password_authentication) {
-			error("Password authentication is disabled to avoid "
-			    "man-in-the-middle attacks.");
-			options.password_authentication = 0;
-		}
-		if (options.forward_agent) {
-			error("Agent forwarding is disabled to avoid "
-			    "man-in-the-middle attacks.");
-			options.forward_agent = 0;
-		}
-		if (options.forward_x11) {
-			error("X11 forwarding is disabled to avoid "
-			    "man-in-the-middle attacks.");
-			options.forward_x11 = 0;
-		}
-		if (options.num_local_forwards > 0 ||
-		    options.num_remote_forwards > 0) {
-			error("Port forwarding is disabled to avoid "
-			    "man-in-the-middle attacks.");
-			options.num_local_forwards =
-			    options.num_remote_forwards = 0;
-		}
-		/*
-		 * XXX Should permit the user to change to use the new id.
-		 * This could be done by converting the host key to an
-		 * identifying sentence, tell that the host identifies itself
-		 * by that sentence, and ask the user if he/she whishes to
-		 * accept the authentication.
-		 */
-		break;
-	case HOST_FOUND:
-		fatal("internal error");
-		break;
-	}
-
-	if (options.check_host_ip && host_status != HOST_CHANGED &&
-	    ip_status == HOST_CHANGED) {
-		snprintf(msg, sizeof(msg),
-		    "Warning: the %s host key for '%.200s' "
-		    "differs from the key for the IP address '%.128s'"
-		    "\nOffending key for IP in %s:%d",
-		    type, host, ip, ip_file, ip_line);
-		if (host_status == HOST_OK) {
-			len = strlen(msg);
-			snprintf(msg + len, sizeof(msg) - len,
-			    "\nMatching host key in %s:%d",
-			    host_file, host_line);
-		}
-		if (options.strict_host_key_checking == 1) {
-			log(msg);
-			error("Exiting, you have requested strict checking.");
-			goto fail;
-		} else if (options.strict_host_key_checking == 2) {
-			strlcat(msg, "\nAre you sure you want "
-			    "to continue connecting (yes/no)? ", sizeof(msg));
-			if (!confirm(msg))
-				goto fail;
-		} else {
-			log(msg);
-		}
-	}
-
-	xfree(ip);
-	return 0;
-
-fail:
-	xfree(ip);
-	return -1;
-}
-
-int
-verify_host_key(char *host, struct sockaddr *hostaddr, Key *host_key)
-{
-	struct stat st;
-
-	/* return ok if the key can be found in an old keyfile */
-	if (stat(options.system_hostfile2, &st) == 0 ||
-	    stat(options.user_hostfile2, &st) == 0) {
-		if (check_host_key(host, hostaddr, host_key, /*readonly*/ 1,
-		    options.user_hostfile2, options.system_hostfile2) == 0)
-			return 0;
-	}
-	return check_host_key(host, hostaddr, host_key, /*readonly*/ 0,
-	    options.user_hostfile, options.system_hostfile);
-}
-
-/*
- * Starts a dialog with the server, and authenticates the current user on the
- * server.  This does not need any extra privileges.  The basic connection
- * to the server must already have been established before this is called.
- * If login fails, this function prints an error and never returns.
- * This function does not require super-user privileges.
- */
-void
-ssh_login(Sensitive *sensitive, const char *orighost,
-    struct sockaddr *hostaddr, struct passwd *pw)
-{
-	char *host, *cp;
-	char *server_user, *local_user;
-
-	local_user = xstrdup(pw->pw_name);
-	server_user = options.user ? options.user : local_user;
-
-	/* Convert the user-supplied hostname into all lowercase. */
-	host = xstrdup(orighost);
-	for (cp = host; *cp; cp++)
-		if (isupper(*cp))
-			*cp = tolower(*cp);
-
-	/* Exchange protocol version identification strings with the server. */
-	ssh_exchange_identification();
-
-	/* Put the connection into non-blocking mode. */
-	packet_set_nonblocking();
-
-	/* key exchange */
-	/* authenticate user */
-	if (compat20) {
-		ssh_kex2(host, hostaddr);
-		ssh_userauth2(local_user, server_user, host, sensitive);
-	} else {
-		ssh_kex(host, hostaddr);
-		ssh_userauth1(local_user, server_user, host, sensitive);
-	}
-}
-
-void
-ssh_put_password(char *password)
-{
-	int size;
-	char *padded;
-
-	if (datafellows & SSH_BUG_PASSWORDPAD) {
-		packet_put_cstring(password);
-		return;
-	}
-	size = roundup(strlen(password) + 1, 32);
-	padded = xmalloc(size);
-	memset(padded, 0, size);
-	strlcpy(padded, password, size);
-	packet_put_string(padded, size);
-	memset(padded, 0, size);
-	xfree(padded);
-}
-
-static int
-show_key_from_file(const char *file, const char *host, int keytype)
-{
-	Key *found;
-	char *fp;
-	int line, ret;
-
-	found = key_new(keytype);
-	if ((ret = lookup_key_in_hostfile_by_type(file, host,
-	    keytype, found, &line))) {
-		fp = key_fingerprint(found, SSH_FP_MD5, SSH_FP_HEX);
-		log("WARNING: %s key found for host %s\n"
-		    "in %s:%d\n"
-		    "%s key fingerprint %s.",
-		    key_type(found), host, file, line,
-		    key_type(found), fp);
-		xfree(fp);
-	}
-	key_free(found);
-	return (ret);
-}
-
-/* print all known host keys for a given host, but skip keys of given type */
-static int
-show_other_keys(const char *host, Key *key)
-{
-	int type[] = { KEY_RSA1, KEY_RSA, KEY_DSA, -1};
-	int i, found = 0;
-
-	for (i = 0; type[i] != -1; i++) {
-		if (type[i] == key->type)
-			continue;
-		if (type[i] != KEY_RSA1 &&
-		    show_key_from_file(options.user_hostfile2, host, type[i])) {
-			found = 1;
-			continue;
-		}
-		if (type[i] != KEY_RSA1 &&
-		    show_key_from_file(options.system_hostfile2, host, type[i])) {
-			found = 1;
-			continue;
-		}
-		if (show_key_from_file(options.user_hostfile, host, type[i])) {
-			found = 1;
-			continue;
-		}
-		if (show_key_from_file(options.system_hostfile, host, type[i])) {
-			found = 1;
-			continue;
-		}
-		debug2("no key of type %d for host %s", type[i], host);
-	}
-	return (found);
-}
diff --git a/crypto/openssh/sshconnect.h b/crypto/openssh/sshconnect.h
deleted file mode 100644
index 0be30fe695aa..000000000000
--- a/crypto/openssh/sshconnect.h
+++ /dev/null
@@ -1,69 +0,0 @@
-/*	$OpenBSD: sshconnect.h,v 1.17 2002/06/19 00:27:55 deraadt Exp $	*/
-
-/*
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#ifndef SSHCONNECT_H
-#define SSHCONNECT_H
-
-typedef struct Sensitive Sensitive;
-struct Sensitive {
-	Key	**keys;
-	int	nkeys;
-	int	external_keysign;
-};
-
-int
-ssh_connect(const char *, struct sockaddr_storage *, u_short, int, int,
-    int, const char *);
-
-void
-ssh_login(Sensitive *, const char *, struct sockaddr *, struct passwd *);
-
-int	 verify_host_key(char *, struct sockaddr *, Key *);
-
-void	 ssh_kex(char *, struct sockaddr *);
-void	 ssh_kex2(char *, struct sockaddr *);
-
-void	 ssh_userauth1(const char *, const char *, char *, Sensitive *);
-void	 ssh_userauth2(const char *, const char *, char *, Sensitive *);
-
-void	 ssh_put_password(char *);
-
-
-/*
- * Macros to raise/lower permissions.
- */
-#define PRIV_START do {				\
-	int save_errno = errno;			\
-	(void)seteuid(original_effective_uid);	\
-	errno = save_errno;			\
-} while (0)
-
-#define PRIV_END do {				\
-	int save_errno = errno;			\
-	(void)seteuid(original_real_uid);	\
-	errno = save_errno;			\
-} while (0)
-
-#endif
diff --git a/crypto/openssh/sshconnect1.c b/crypto/openssh/sshconnect1.c
deleted file mode 100644
index 2fc9a981afca..000000000000
--- a/crypto/openssh/sshconnect1.c
+++ /dev/null
@@ -1,1306 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * Code to connect to a remote host, and to perform the client side of the
- * login (authentication) dialog.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: sshconnect1.c,v 1.52 2002/08/08 13:50:23 aaron Exp $");
-
-#include <openssl/bn.h>
-#include <openssl/md5.h>
-
-#ifdef KRB4
-#include <krb.h>
-#endif
-#ifdef KRB5
-#include <krb5.h>
-#ifndef HEIMDAL
-#define krb5_get_err_text(context,code) error_message(code)
-#endif /* !HEIMDAL */
-#endif
-#ifdef AFS
-#include <kafs.h>
-#include "radix.h"
-#endif
-
-#include "ssh.h"
-#include "ssh1.h"
-#include "xmalloc.h"
-#include "rsa.h"
-#include "buffer.h"
-#include "packet.h"
-#include "mpaux.h"
-#include "uidswap.h"
-#include "log.h"
-#include "readconf.h"
-#include "key.h"
-#include "authfd.h"
-#include "sshconnect.h"
-#include "authfile.h"
-#include "readpass.h"
-#include "cipher.h"
-#include "canohost.h"
-#include "auth.h"
-
-/* Session id for the current session. */
-u_char session_id[16];
-u_int supported_authentications = 0;
-
-extern Options options;
-extern char *__progname;
-
-/*
- * Checks if the user has an authentication agent, and if so, tries to
- * authenticate using the agent.
- */
-static int
-try_agent_authentication(void)
-{
-	int type;
-	char *comment;
-	AuthenticationConnection *auth;
-	u_char response[16];
-	u_int i;
-	Key *key;
-	BIGNUM *challenge;
-
-	/* Get connection to the agent. */
-	auth = ssh_get_authentication_connection();
-	if (!auth)
-		return 0;
-
-	if ((challenge = BN_new()) == NULL)
-		fatal("try_agent_authentication: BN_new failed");
-	/* Loop through identities served by the agent. */
-	for (key = ssh_get_first_identity(auth, &comment, 1);
-	    key != NULL;
-	    key = ssh_get_next_identity(auth, &comment, 1)) {
-
-		/* Try this identity. */
-		debug("Trying RSA authentication via agent with '%.100s'", comment);
-		xfree(comment);
-
-		/* Tell the server that we are willing to authenticate using this key. */
-		packet_start(SSH_CMSG_AUTH_RSA);
-		packet_put_bignum(key->rsa->n);
-		packet_send();
-		packet_write_wait();
-
-		/* Wait for server's response. */
-		type = packet_read();
-
-		/* The server sends failure if it doesn\'t like our key or
-		   does not support RSA authentication. */
-		if (type == SSH_SMSG_FAILURE) {
-			debug("Server refused our key.");
-			key_free(key);
-			continue;
-		}
-		/* Otherwise it should have sent a challenge. */
-		if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
-			packet_disconnect("Protocol error during RSA authentication: %d",
-					  type);
-
-		packet_get_bignum(challenge);
-		packet_check_eom();
-
-		debug("Received RSA challenge from server.");
-
-		/* Ask the agent to decrypt the challenge. */
-		if (!ssh_decrypt_challenge(auth, key, challenge, session_id, 1, response)) {
-			/*
-			 * The agent failed to authenticate this identifier
-			 * although it advertised it supports this.  Just
-			 * return a wrong value.
-			 */
-			log("Authentication agent failed to decrypt challenge.");
-			memset(response, 0, sizeof(response));
-		}
-		key_free(key);
-		debug("Sending response to RSA challenge.");
-
-		/* Send the decrypted challenge back to the server. */
-		packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
-		for (i = 0; i < 16; i++)
-			packet_put_char(response[i]);
-		packet_send();
-		packet_write_wait();
-
-		/* Wait for response from the server. */
-		type = packet_read();
-
-		/* The server returns success if it accepted the authentication. */
-		if (type == SSH_SMSG_SUCCESS) {
-			ssh_close_authentication_connection(auth);
-			BN_clear_free(challenge);
-			debug("RSA authentication accepted by server.");
-			return 1;
-		}
-		/* Otherwise it should return failure. */
-		if (type != SSH_SMSG_FAILURE)
-			packet_disconnect("Protocol error waiting RSA auth response: %d",
-					  type);
-	}
-	ssh_close_authentication_connection(auth);
-	BN_clear_free(challenge);
-	debug("RSA authentication using agent refused.");
-	return 0;
-}
-
-/*
- * Computes the proper response to a RSA challenge, and sends the response to
- * the server.
- */
-static void
-respond_to_rsa_challenge(BIGNUM * challenge, RSA * prv)
-{
-	u_char buf[32], response[16];
-	MD5_CTX md;
-	int i, len;
-
-	/* Decrypt the challenge using the private key. */
-	/* XXX think about Bleichenbacher, too */
-	if (rsa_private_decrypt(challenge, challenge, prv) <= 0)
-		packet_disconnect(
-		    "respond_to_rsa_challenge: rsa_private_decrypt failed");
-
-	/* Compute the response. */
-	/* The response is MD5 of decrypted challenge plus session id. */
-	len = BN_num_bytes(challenge);
-	if (len <= 0 || len > sizeof(buf))
-		packet_disconnect(
-		    "respond_to_rsa_challenge: bad challenge length %d", len);
-
-	memset(buf, 0, sizeof(buf));
-	BN_bn2bin(challenge, buf + sizeof(buf) - len);
-	MD5_Init(&md);
-	MD5_Update(&md, buf, 32);
-	MD5_Update(&md, session_id, 16);
-	MD5_Final(response, &md);
-
-	debug("Sending response to host key RSA challenge.");
-
-	/* Send the response back to the server. */
-	packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
-	for (i = 0; i < 16; i++)
-		packet_put_char(response[i]);
-	packet_send();
-	packet_write_wait();
-
-	memset(buf, 0, sizeof(buf));
-	memset(response, 0, sizeof(response));
-	memset(&md, 0, sizeof(md));
-}
-
-/*
- * Checks if the user has authentication file, and if so, tries to authenticate
- * the user using it.
- */
-static int
-try_rsa_authentication(int idx)
-{
-	BIGNUM *challenge;
-	Key *public, *private;
-	char buf[300], *passphrase, *comment, *authfile;
-	int i, type, quit;
-
-	public = options.identity_keys[idx];
-	authfile = options.identity_files[idx];
-	comment = xstrdup(authfile);
-
-	debug("Trying RSA authentication with key '%.100s'", comment);
-
-	/* Tell the server that we are willing to authenticate using this key. */
-	packet_start(SSH_CMSG_AUTH_RSA);
-	packet_put_bignum(public->rsa->n);
-	packet_send();
-	packet_write_wait();
-
-	/* Wait for server's response. */
-	type = packet_read();
-
-	/*
-	 * The server responds with failure if it doesn\'t like our key or
-	 * doesn\'t support RSA authentication.
-	 */
-	if (type == SSH_SMSG_FAILURE) {
-		debug("Server refused our key.");
-		xfree(comment);
-		return 0;
-	}
-	/* Otherwise, the server should respond with a challenge. */
-	if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
-		packet_disconnect("Protocol error during RSA authentication: %d", type);
-
-	/* Get the challenge from the packet. */
-	if ((challenge = BN_new()) == NULL)
-		fatal("try_rsa_authentication: BN_new failed");
-	packet_get_bignum(challenge);
-	packet_check_eom();
-
-	debug("Received RSA challenge from server.");
-
-	/*
-	 * If the key is not stored in external hardware, we have to
-	 * load the private key.  Try first with empty passphrase; if it
-	 * fails, ask for a passphrase.
-	 */
-	if (public->flags & KEY_FLAG_EXT)
-		private = public;
-	else
-		private = key_load_private_type(KEY_RSA1, authfile, "", NULL);
-	if (private == NULL && !options.batch_mode) {
-		snprintf(buf, sizeof(buf),
-		    "Enter passphrase for RSA key '%.100s': ", comment);
-		for (i = 0; i < options.number_of_password_prompts; i++) {
-			passphrase = read_passphrase(buf, 0);
-			if (strcmp(passphrase, "") != 0) {
-				private = key_load_private_type(KEY_RSA1,
-				    authfile, passphrase, NULL);
-				quit = 0;
-			} else {
-				debug2("no passphrase given, try next key");
-				quit = 1;
-			}
-			memset(passphrase, 0, strlen(passphrase));
-			xfree(passphrase);
-			if (private != NULL || quit)
-				break;
-			debug2("bad passphrase given, try again...");
-		}
-	}
-	/* We no longer need the comment. */
-	xfree(comment);
-
-	if (private == NULL) {
-		if (!options.batch_mode)
-			error("Bad passphrase.");
-
-		/* Send a dummy response packet to avoid protocol error. */
-		packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
-		for (i = 0; i < 16; i++)
-			packet_put_char(0);
-		packet_send();
-		packet_write_wait();
-
-		/* Expect the server to reject it... */
-		packet_read_expect(SSH_SMSG_FAILURE);
-		BN_clear_free(challenge);
-		return 0;
-	}
-
-	/* Compute and send a response to the challenge. */
-	respond_to_rsa_challenge(challenge, private->rsa);
-
-	/* Destroy the private key unless it in external hardware. */
-	if (!(private->flags & KEY_FLAG_EXT))
-		key_free(private);
-
-	/* We no longer need the challenge. */
-	BN_clear_free(challenge);
-
-	/* Wait for response from the server. */
-	type = packet_read();
-	if (type == SSH_SMSG_SUCCESS) {
-		debug("RSA authentication accepted by server.");
-		return 1;
-	}
-	if (type != SSH_SMSG_FAILURE)
-		packet_disconnect("Protocol error waiting RSA auth response: %d", type);
-	debug("RSA authentication refused.");
-	return 0;
-}
-
-/*
- * Tries to authenticate the user using combined rhosts or /etc/hosts.equiv
- * authentication and RSA host authentication.
- */
-static int
-try_rhosts_rsa_authentication(const char *local_user, Key * host_key)
-{
-	int type;
-	BIGNUM *challenge;
-
-	debug("Trying rhosts or /etc/hosts.equiv with RSA host authentication.");
-
-	/* Tell the server that we are willing to authenticate using this key. */
-	packet_start(SSH_CMSG_AUTH_RHOSTS_RSA);
-	packet_put_cstring(local_user);
-	packet_put_int(BN_num_bits(host_key->rsa->n));
-	packet_put_bignum(host_key->rsa->e);
-	packet_put_bignum(host_key->rsa->n);
-	packet_send();
-	packet_write_wait();
-
-	/* Wait for server's response. */
-	type = packet_read();
-
-	/* The server responds with failure if it doesn't admit our
-	   .rhosts authentication or doesn't know our host key. */
-	if (type == SSH_SMSG_FAILURE) {
-		debug("Server refused our rhosts authentication or host key.");
-		return 0;
-	}
-	/* Otherwise, the server should respond with a challenge. */
-	if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
-		packet_disconnect("Protocol error during RSA authentication: %d", type);
-
-	/* Get the challenge from the packet. */
-	if ((challenge = BN_new()) == NULL)
-		fatal("try_rhosts_rsa_authentication: BN_new failed");
-	packet_get_bignum(challenge);
-	packet_check_eom();
-
-	debug("Received RSA challenge for host key from server.");
-
-	/* Compute a response to the challenge. */
-	respond_to_rsa_challenge(challenge, host_key->rsa);
-
-	/* We no longer need the challenge. */
-	BN_clear_free(challenge);
-
-	/* Wait for response from the server. */
-	type = packet_read();
-	if (type == SSH_SMSG_SUCCESS) {
-		debug("Rhosts or /etc/hosts.equiv with RSA host authentication accepted by server.");
-		return 1;
-	}
-	if (type != SSH_SMSG_FAILURE)
-		packet_disconnect("Protocol error waiting RSA auth response: %d", type);
-	debug("Rhosts or /etc/hosts.equiv with RSA host authentication refused.");
-	return 0;
-}
-
-#ifdef KRB4
-static int
-try_krb4_authentication(void)
-{
-	KTEXT_ST auth;		/* Kerberos data */
-	char *reply;
-	char inst[INST_SZ];
-	char *realm;
-	CREDENTIALS cred;
-	int r, type;
-	socklen_t slen;
-	Key_schedule schedule;
-	u_long checksum, cksum;
-	MSG_DAT msg_data;
-	struct sockaddr_in local, foreign;
-	struct stat st;
-
-	/* Don't do anything if we don't have any tickets. */
-	if (stat(tkt_string(), &st) < 0)
-		return 0;
-
-	strlcpy(inst, (char *)krb_get_phost(get_canonical_hostname(1)),
-	    INST_SZ);
-
-	realm = (char *)krb_realmofhost(get_canonical_hostname(1));
-	if (!realm) {
-		debug("Kerberos v4: no realm for %s", get_canonical_hostname(1));
-		return 0;
-	}
-	/* This can really be anything. */
-	checksum = (u_long)getpid();
-
-	r = krb_mk_req(&auth, KRB4_SERVICE_NAME, inst, realm, checksum);
-	if (r != KSUCCESS) {
-		debug("Kerberos v4 krb_mk_req failed: %s", krb_err_txt[r]);
-		return 0;
-	}
-	/* Get session key to decrypt the server's reply with. */
-	r = krb_get_cred(KRB4_SERVICE_NAME, inst, realm, &cred);
-	if (r != KSUCCESS) {
-		debug("get_cred failed: %s", krb_err_txt[r]);
-		return 0;
-	}
-	des_key_sched((des_cblock *) cred.session, schedule);
-
-	/* Send authentication info to server. */
-	packet_start(SSH_CMSG_AUTH_KERBEROS);
-	packet_put_string((char *) auth.dat, auth.length);
-	packet_send();
-	packet_write_wait();
-
-	/* Zero the buffer. */
-	(void) memset(auth.dat, 0, MAX_KTXT_LEN);
-
-	slen = sizeof(local);
-	memset(&local, 0, sizeof(local));
-	if (getsockname(packet_get_connection_in(),
-	    (struct sockaddr *)&local, &slen) < 0)
-		debug("getsockname failed: %s", strerror(errno));
-
-	slen = sizeof(foreign);
-	memset(&foreign, 0, sizeof(foreign));
-	if (getpeername(packet_get_connection_in(),
-	    (struct sockaddr *)&foreign, &slen) < 0) {
-		debug("getpeername failed: %s", strerror(errno));
-		fatal_cleanup();
-	}
-	/* Get server reply. */
-	type = packet_read();
-	switch (type) {
-	case SSH_SMSG_FAILURE:
-		/* Should really be SSH_SMSG_AUTH_KERBEROS_FAILURE */
-		debug("Kerberos v4 authentication failed.");
-		return 0;
-		break;
-
-	case SSH_SMSG_AUTH_KERBEROS_RESPONSE:
-		/* SSH_SMSG_AUTH_KERBEROS_SUCCESS */
-		debug("Kerberos v4 authentication accepted.");
-
-		/* Get server's response. */
-		reply = packet_get_string((u_int *) &auth.length);
-		if (auth.length >= MAX_KTXT_LEN)
-			fatal("Kerberos v4: Malformed response from server");
-		memcpy(auth.dat, reply, auth.length);
-		xfree(reply);
-
-		packet_check_eom();
-
-		/*
-		 * If his response isn't properly encrypted with the session
-		 * key, and the decrypted checksum fails to match, he's
-		 * bogus. Bail out.
-		 */
-		r = krb_rd_priv(auth.dat, auth.length, schedule, &cred.session,
-		    &foreign, &local, &msg_data);
-		if (r != KSUCCESS) {
-			debug("Kerberos v4 krb_rd_priv failed: %s",
-			    krb_err_txt[r]);
-			packet_disconnect("Kerberos v4 challenge failed!");
-		}
-		/* Fetch the (incremented) checksum that we supplied in the request. */
-		memcpy((char *)&cksum, (char *)msg_data.app_data,
-		    sizeof(cksum));
-		cksum = ntohl(cksum);
-
-		/* If it matches, we're golden. */
-		if (cksum == checksum + 1) {
-			debug("Kerberos v4 challenge successful.");
-			return 1;
-		} else
-			packet_disconnect("Kerberos v4 challenge failed!");
-		break;
-
-	default:
-		packet_disconnect("Protocol error on Kerberos v4 response: %d", type);
-	}
-	return 0;
-}
-
-#endif /* KRB4 */
-
-#ifdef KRB5
-static int
-try_krb5_authentication(krb5_context *context, krb5_auth_context *auth_context)
-{
-	krb5_error_code problem;
-	const char *tkfile;
-	struct stat buf;
-	krb5_ccache ccache = NULL;
-	const char *remotehost;
-	krb5_data ap;
-	int type;
-	krb5_ap_rep_enc_part *reply = NULL;
-	int ret;
-
-	memset(&ap, 0, sizeof(ap));
-
-	problem = krb5_init_context(context);
-	if (problem) {
-		debug("Kerberos v5: krb5_init_context failed");
-		ret = 0;
-		goto out;
-	}
-	
-	problem = krb5_auth_con_init(*context, auth_context);
-	if (problem) {
-		debug("Kerberos v5: krb5_auth_con_init failed");
-		ret = 0;
-		goto out;
-	}
-
-#ifndef HEIMDAL
-	problem = krb5_auth_con_setflags(*context, *auth_context,
-					 KRB5_AUTH_CONTEXT_RET_TIME);
-	if (problem) {
-		debug("Keberos v5: krb5_auth_con_setflags failed");
-		ret = 0;
-		goto out;
-	}
-#endif
-
-	tkfile = krb5_cc_default_name(*context);
-	if (strncmp(tkfile, "FILE:", 5) == 0)
-		tkfile += 5;
-
-	if (stat(tkfile, &buf) == 0 && getuid() != buf.st_uid) {
-		debug("Kerberos v5: could not get default ccache (permission denied).");
-		ret = 0;
-		goto out;
-	}
-
-	problem = krb5_cc_default(*context, &ccache);
-	if (problem) {
-		debug("Kerberos v5: krb5_cc_default failed: %s",
-		    krb5_get_err_text(*context, problem));
-		ret = 0;
-		goto out;
-	}
-
-	remotehost = get_canonical_hostname(1);
-
-	problem = krb5_mk_req(*context, auth_context, AP_OPTS_MUTUAL_REQUIRED,
-	    "host", remotehost, NULL, ccache, &ap);
-	if (problem) {
-		debug("Kerberos v5: krb5_mk_req failed: %s",
-		    krb5_get_err_text(*context, problem));
-		ret = 0;
-		goto out;
-	}
-
-	packet_start(SSH_CMSG_AUTH_KERBEROS);
-	packet_put_string((char *) ap.data, ap.length);
-	packet_send();
-	packet_write_wait();
-
-	xfree(ap.data);
-	ap.length = 0;
-
-	type = packet_read();
-	switch (type) {
-	case SSH_SMSG_FAILURE:
-		/* Should really be SSH_SMSG_AUTH_KERBEROS_FAILURE */
-		debug("Kerberos v5 authentication failed.");
-		ret = 0;
-		break;
-
-	case SSH_SMSG_AUTH_KERBEROS_RESPONSE:
-		/* SSH_SMSG_AUTH_KERBEROS_SUCCESS */
-		debug("Kerberos v5 authentication accepted.");
-
-		/* Get server's response. */
-		ap.data = packet_get_string((unsigned int *) &ap.length);
-		packet_check_eom();
-		/* XXX je to dobre? */
-
-		problem = krb5_rd_rep(*context, *auth_context, &ap, &reply);
-		if (problem) {
-			ret = 0;
-		}
-		ret = 1;
-		break;
-
-	default:
-		packet_disconnect("Protocol error on Kerberos v5 response: %d",
-		    type);
-		ret = 0;
-		break;
-
-	}
-
- out:
-	if (ccache != NULL)
-		krb5_cc_close(*context, ccache);
-	if (reply != NULL)
-		krb5_free_ap_rep_enc_part(*context, reply);
-	if (ap.length > 0)
-#ifdef HEIMDAL
-		krb5_data_free(&ap);
-#else
-		krb5_free_data_contents(*context, &ap);
-#endif
-
-	return (ret);
-}
-
-static void
-send_krb5_tgt(krb5_context context, krb5_auth_context auth_context)
-{
-	int fd, type;
-	krb5_error_code problem;
-	krb5_data outbuf;
-	krb5_ccache ccache = NULL;
-	krb5_creds creds;
-#ifdef HEIMDAL
-	krb5_kdc_flags flags;
-#else
-	int forwardable;
-#endif
-	const char *remotehost;
-
-	memset(&creds, 0, sizeof(creds));
-	memset(&outbuf, 0, sizeof(outbuf));
-
-	fd = packet_get_connection_in();
-
-#ifdef HEIMDAL
-	problem = krb5_auth_con_setaddrs_from_fd(context, auth_context, &fd);
-#else
-	problem = krb5_auth_con_genaddrs(context, auth_context, fd,
-			KRB5_AUTH_CONTEXT_GENERATE_REMOTE_FULL_ADDR |
-			KRB5_AUTH_CONTEXT_GENERATE_LOCAL_FULL_ADDR);
-#endif
-	if (problem)
-		goto out;
-
-	problem = krb5_cc_default(context, &ccache);
-	if (problem)
-		goto out;
-
-	problem = krb5_cc_get_principal(context, ccache, &creds.client);
-	if (problem)
-		goto out;
-
-	remotehost = get_canonical_hostname(1);
-	
-#ifdef HEIMDAL
-	problem = krb5_build_principal(context, &creds.server,
-	    strlen(creds.client->realm), creds.client->realm,
-	    "krbtgt", creds.client->realm, NULL);
-#else
-	problem = krb5_build_principal(context, &creds.server,
-	    creds.client->realm.length, creds.client->realm.data,
-	    "host", remotehost, NULL);
-#endif
-	if (problem)
-		goto out;
-
-	creds.times.endtime = 0;
-
-#ifdef HEIMDAL
-	flags.i = 0;
-	flags.b.forwarded = 1;
-	flags.b.forwardable = krb5_config_get_bool(context,  NULL,
-	    "libdefaults", "forwardable", NULL);
-	problem = krb5_get_forwarded_creds(context, auth_context,
-	    ccache, flags.i, remotehost, &creds, &outbuf);
-#else
-	forwardable = 1;
-	problem = krb5_fwd_tgt_creds(context, auth_context, remotehost,
-	    creds.client, creds.server, ccache, forwardable, &outbuf);
-#endif
-
-	if (problem)
-		goto out;
-
-	packet_start(SSH_CMSG_HAVE_KERBEROS_TGT);
-	packet_put_string((char *)outbuf.data, outbuf.length);
-	packet_send();
-	packet_write_wait();
-
-	type = packet_read();
-
-	if (type == SSH_SMSG_SUCCESS) {
-		char *pname;
-
-		krb5_unparse_name(context, creds.client, &pname);
-		debug("Kerberos v5 TGT forwarded (%s).", pname);
-		xfree(pname);
-	} else
-		debug("Kerberos v5 TGT forwarding failed.");
-
-	return;
-
- out:
-	if (problem)
-		debug("Kerberos v5 TGT forwarding failed: %s",
-		    krb5_get_err_text(context, problem));
-	if (creds.client)
-		krb5_free_principal(context, creds.client);
-	if (creds.server)
-		krb5_free_principal(context, creds.server);
-	if (ccache)
-		krb5_cc_close(context, ccache);
-	if (outbuf.data)
-		xfree(outbuf.data);
-}
-#endif /* KRB5 */
-
-#ifdef AFS
-static void
-send_krb4_tgt(void)
-{
-	CREDENTIALS *creds;
-	struct stat st;
-	char buffer[4096], pname[ANAME_SZ], pinst[INST_SZ], prealm[REALM_SZ];
-	int problem, type;
-
-	/* Don't do anything if we don't have any tickets. */
-	if (stat(tkt_string(), &st) < 0)
-		return;
-
-	creds = xmalloc(sizeof(*creds));
-
-	problem = krb_get_tf_fullname(TKT_FILE, pname, pinst, prealm);
-	if (problem)
-		goto out;
-
-	problem = krb_get_cred("krbtgt", prealm, prealm, creds);
-	if (problem)
-		goto out;
-
-	if (time(0) > krb_life_to_time(creds->issue_date, creds->lifetime)) {
-		problem = RD_AP_EXP;
-		goto out;
-	}
-	creds_to_radix(creds, (u_char *)buffer, sizeof(buffer));
-
-	packet_start(SSH_CMSG_HAVE_KERBEROS_TGT);
-	packet_put_cstring(buffer);
-	packet_send();
-	packet_write_wait();
-
-	type = packet_read();
-
-	if (type == SSH_SMSG_SUCCESS)
-		debug("Kerberos v4 TGT forwarded (%s%s%s@%s).",
-		    creds->pname, creds->pinst[0] ? "." : "",
-		    creds->pinst, creds->realm);
-	else
-		debug("Kerberos v4 TGT rejected.");
-
-	xfree(creds);
-	return;
-
- out:
-	debug("Kerberos v4 TGT passing failed: %s", krb_err_txt[problem]);
-	xfree(creds);
-}
-
-static void
-send_afs_tokens(void)
-{
-	CREDENTIALS creds;
-	struct ViceIoctl parms;
-	struct ClearToken ct;
-	int i, type, len;
-	char buf[2048], *p, *server_cell;
-	char buffer[8192];
-
-	/* Move over ktc_GetToken, here's something leaner. */
-	for (i = 0; i < 100; i++) {	/* just in case */
-		parms.in = (char *) &i;
-		parms.in_size = sizeof(i);
-		parms.out = buf;
-		parms.out_size = sizeof(buf);
-		if (k_pioctl(0, VIOCGETTOK, &parms, 0) != 0)
-			break;
-		p = buf;
-
-		/* Get secret token. */
-		memcpy(&creds.ticket_st.length, p, sizeof(u_int));
-		if (creds.ticket_st.length > MAX_KTXT_LEN)
-			break;
-		p += sizeof(u_int);
-		memcpy(creds.ticket_st.dat, p, creds.ticket_st.length);
-		p += creds.ticket_st.length;
-
-		/* Get clear token. */
-		memcpy(&len, p, sizeof(len));
-		if (len != sizeof(struct ClearToken))
-			break;
-		p += sizeof(len);
-		memcpy(&ct, p, len);
-		p += len;
-		p += sizeof(len);	/* primary flag */
-		server_cell = p;
-
-		/* Flesh out our credentials. */
-		strlcpy(creds.service, "afs", sizeof(creds.service));
-		creds.instance[0] = '\0';
-		strlcpy(creds.realm, server_cell, REALM_SZ);
-		memcpy(creds.session, ct.HandShakeKey, DES_KEY_SZ);
-		creds.issue_date = ct.BeginTimestamp;
-		creds.lifetime = krb_time_to_life(creds.issue_date,
-		    ct.EndTimestamp);
-		creds.kvno = ct.AuthHandle;
-		snprintf(creds.pname, sizeof(creds.pname), "AFS ID %d", ct.ViceId);
-		creds.pinst[0] = '\0';
-
-		/* Encode token, ship it off. */
-		if (creds_to_radix(&creds, (u_char *)buffer,
-		    sizeof(buffer)) <= 0)
-			break;
-		packet_start(SSH_CMSG_HAVE_AFS_TOKEN);
-		packet_put_cstring(buffer);
-		packet_send();
-		packet_write_wait();
-
-		/* Roger, Roger. Clearance, Clarence. What's your vector,
-		   Victor? */
-		type = packet_read();
-
-		if (type == SSH_SMSG_FAILURE)
-			debug("AFS token for cell %s rejected.", server_cell);
-		else if (type != SSH_SMSG_SUCCESS)
-			packet_disconnect("Protocol error on AFS token response: %d", type);
-	}
-}
-
-#endif /* AFS */
-
-/*
- * Tries to authenticate with any string-based challenge/response system.
- * Note that the client code is not tied to s/key or TIS.
- */
-static int
-try_challenge_response_authentication(void)
-{
-	int type, i;
-	u_int clen;
-	char prompt[1024];
-	char *challenge, *response;
-
-	debug("Doing challenge response authentication.");
-
-	for (i = 0; i < options.number_of_password_prompts; i++) {
-		/* request a challenge */
-		packet_start(SSH_CMSG_AUTH_TIS);
-		packet_send();
-		packet_write_wait();
-
-		type = packet_read();
-		if (type != SSH_SMSG_FAILURE &&
-		    type != SSH_SMSG_AUTH_TIS_CHALLENGE) {
-			packet_disconnect("Protocol error: got %d in response "
-			    "to SSH_CMSG_AUTH_TIS", type);
-		}
-		if (type != SSH_SMSG_AUTH_TIS_CHALLENGE) {
-			debug("No challenge.");
-			return 0;
-		}
-		challenge = packet_get_string(&clen);
-		packet_check_eom();
-		snprintf(prompt, sizeof prompt, "%s%s", challenge,
-		    strchr(challenge, '\n') ? "" : "\nResponse: ");
-		xfree(challenge);
-		if (i != 0)
-			error("Permission denied, please try again.");
-		if (options.cipher == SSH_CIPHER_NONE)
-			log("WARNING: Encryption is disabled! "
-			    "Response will be transmitted in clear text.");
-		response = read_passphrase(prompt, 0);
-		if (strcmp(response, "") == 0) {
-			xfree(response);
-			break;
-		}
-		packet_start(SSH_CMSG_AUTH_TIS_RESPONSE);
-		ssh_put_password(response);
-		memset(response, 0, strlen(response));
-		xfree(response);
-		packet_send();
-		packet_write_wait();
-		type = packet_read();
-		if (type == SSH_SMSG_SUCCESS)
-			return 1;
-		if (type != SSH_SMSG_FAILURE)
-			packet_disconnect("Protocol error: got %d in response "
-			    "to SSH_CMSG_AUTH_TIS_RESPONSE", type);
-	}
-	/* failure */
-	return 0;
-}
-
-/*
- * Tries to authenticate with plain passwd authentication.
- */
-static int
-try_password_authentication(char *prompt)
-{
-	int type, i;
-	char *password;
-
-	debug("Doing password authentication.");
-	if (options.cipher == SSH_CIPHER_NONE)
-		log("WARNING: Encryption is disabled! Password will be transmitted in clear text.");
-	for (i = 0; i < options.number_of_password_prompts; i++) {
-		if (i != 0)
-			error("Permission denied, please try again.");
-		password = read_passphrase(prompt, 0);
-		packet_start(SSH_CMSG_AUTH_PASSWORD);
-		ssh_put_password(password);
-		memset(password, 0, strlen(password));
-		xfree(password);
-		packet_send();
-		packet_write_wait();
-
-		type = packet_read();
-		if (type == SSH_SMSG_SUCCESS)
-			return 1;
-		if (type != SSH_SMSG_FAILURE)
-			packet_disconnect("Protocol error: got %d in response to passwd auth", type);
-	}
-	/* failure */
-	return 0;
-}
-
-/*
- * SSH1 key exchange
- */
-void
-ssh_kex(char *host, struct sockaddr *hostaddr)
-{
-	int i;
-	BIGNUM *key;
-	Key *host_key, *server_key;
-	int bits, rbits;
-	int ssh_cipher_default = SSH_CIPHER_3DES;
-	u_char session_key[SSH_SESSION_KEY_LENGTH];
-	u_char cookie[8];
-	u_int supported_ciphers;
-	u_int server_flags, client_flags;
-	u_int32_t rand = 0;
-
-	debug("Waiting for server public key.");
-
-	/* Wait for a public key packet from the server. */
-	packet_read_expect(SSH_SMSG_PUBLIC_KEY);
-
-	/* Get cookie from the packet. */
-	for (i = 0; i < 8; i++)
-		cookie[i] = packet_get_char();
-
-	/* Get the public key. */
-	server_key = key_new(KEY_RSA1);
-	bits = packet_get_int();
-	packet_get_bignum(server_key->rsa->e);
-	packet_get_bignum(server_key->rsa->n);
-
-	rbits = BN_num_bits(server_key->rsa->n);
-	if (bits != rbits) {
-		log("Warning: Server lies about size of server public key: "
-		    "actual size is %d bits vs. announced %d.", rbits, bits);
-		log("Warning: This may be due to an old implementation of ssh.");
-	}
-	/* Get the host key. */
-	host_key = key_new(KEY_RSA1);
-	bits = packet_get_int();
-	packet_get_bignum(host_key->rsa->e);
-	packet_get_bignum(host_key->rsa->n);
-
-	rbits = BN_num_bits(host_key->rsa->n);
-	if (bits != rbits) {
-		log("Warning: Server lies about size of server host key: "
-		    "actual size is %d bits vs. announced %d.", rbits, bits);
-		log("Warning: This may be due to an old implementation of ssh.");
-	}
-
-	/* Get protocol flags. */
-	server_flags = packet_get_int();
-	packet_set_protocol_flags(server_flags);
-
-	supported_ciphers = packet_get_int();
-	supported_authentications = packet_get_int();
-	packet_check_eom();
-
-	debug("Received server public key (%d bits) and host key (%d bits).",
-	    BN_num_bits(server_key->rsa->n), BN_num_bits(host_key->rsa->n));
-
-	if (verify_host_key(host, hostaddr, host_key) == -1)
-		fatal("Host key verification failed.");
-
-	client_flags = SSH_PROTOFLAG_SCREEN_NUMBER | SSH_PROTOFLAG_HOST_IN_FWD_OPEN;
-
-	compute_session_id(session_id, cookie, host_key->rsa->n, server_key->rsa->n);
-
-	/* Generate a session key. */
-	arc4random_stir();
-
-	/*
-	 * Generate an encryption key for the session.   The key is a 256 bit
-	 * random number, interpreted as a 32-byte key, with the least
-	 * significant 8 bits being the first byte of the key.
-	 */
-	for (i = 0; i < 32; i++) {
-		if (i % 4 == 0)
-			rand = arc4random();
-		session_key[i] = rand & 0xff;
-		rand >>= 8;
-	}
-
-	/*
-	 * According to the protocol spec, the first byte of the session key
-	 * is the highest byte of the integer.  The session key is xored with
-	 * the first 16 bytes of the session id.
-	 */
-	if ((key = BN_new()) == NULL)
-		fatal("respond_to_rsa_challenge: BN_new failed");
-	BN_set_word(key, 0);
-	for (i = 0; i < SSH_SESSION_KEY_LENGTH; i++) {
-		BN_lshift(key, key, 8);
-		if (i < 16)
-			BN_add_word(key, session_key[i] ^ session_id[i]);
-		else
-			BN_add_word(key, session_key[i]);
-	}
-
-	/*
-	 * Encrypt the integer using the public key and host key of the
-	 * server (key with smaller modulus first).
-	 */
-	if (BN_cmp(server_key->rsa->n, host_key->rsa->n) < 0) {
-		/* Public key has smaller modulus. */
-		if (BN_num_bits(host_key->rsa->n) <
-		    BN_num_bits(server_key->rsa->n) + SSH_KEY_BITS_RESERVED) {
-			fatal("respond_to_rsa_challenge: host_key %d < server_key %d + "
-			    "SSH_KEY_BITS_RESERVED %d",
-			    BN_num_bits(host_key->rsa->n),
-			    BN_num_bits(server_key->rsa->n),
-			    SSH_KEY_BITS_RESERVED);
-		}
-		rsa_public_encrypt(key, key, server_key->rsa);
-		rsa_public_encrypt(key, key, host_key->rsa);
-	} else {
-		/* Host key has smaller modulus (or they are equal). */
-		if (BN_num_bits(server_key->rsa->n) <
-		    BN_num_bits(host_key->rsa->n) + SSH_KEY_BITS_RESERVED) {
-			fatal("respond_to_rsa_challenge: server_key %d < host_key %d + "
-			    "SSH_KEY_BITS_RESERVED %d",
-			    BN_num_bits(server_key->rsa->n),
-			    BN_num_bits(host_key->rsa->n),
-			    SSH_KEY_BITS_RESERVED);
-		}
-		rsa_public_encrypt(key, key, host_key->rsa);
-		rsa_public_encrypt(key, key, server_key->rsa);
-	}
-
-	/* Destroy the public keys since we no longer need them. */
-	key_free(server_key);
-	key_free(host_key);
-
-	if (options.cipher == SSH_CIPHER_NOT_SET) {
-		if (cipher_mask_ssh1(1) & supported_ciphers & (1 << ssh_cipher_default))
-			options.cipher = ssh_cipher_default;
-	} else if (options.cipher == SSH_CIPHER_ILLEGAL ||
-	    !(cipher_mask_ssh1(1) & (1 << options.cipher))) {
-		log("No valid SSH1 cipher, using %.100s instead.",
-		    cipher_name(ssh_cipher_default));
-		options.cipher = ssh_cipher_default;
-	}
-	/* Check that the selected cipher is supported. */
-	if (!(supported_ciphers & (1 << options.cipher)))
-		fatal("Selected cipher type %.100s not supported by server.",
-		    cipher_name(options.cipher));
-
-	debug("Encryption type: %.100s", cipher_name(options.cipher));
-
-	/* Send the encrypted session key to the server. */
-	packet_start(SSH_CMSG_SESSION_KEY);
-	packet_put_char(options.cipher);
-
-	/* Send the cookie back to the server. */
-	for (i = 0; i < 8; i++)
-		packet_put_char(cookie[i]);
-
-	/* Send and destroy the encrypted encryption key integer. */
-	packet_put_bignum(key);
-	BN_clear_free(key);
-
-	/* Send protocol flags. */
-	packet_put_int(client_flags);
-
-	/* Send the packet now. */
-	packet_send();
-	packet_write_wait();
-
-	debug("Sent encrypted session key.");
-
-	/* Set the encryption key. */
-	packet_set_encryption_key(session_key, SSH_SESSION_KEY_LENGTH, options.cipher);
-
-	/* We will no longer need the session key here.  Destroy any extra copies. */
-	memset(session_key, 0, sizeof(session_key));
-
-	/*
-	 * Expect a success message from the server.  Note that this message
-	 * will be received in encrypted form.
-	 */
-	packet_read_expect(SSH_SMSG_SUCCESS);
-
-	debug("Received encrypted confirmation.");
-}
-
-/*
- * Authenticate user
- */
-void
-ssh_userauth1(const char *local_user, const char *server_user, char *host,
-    Sensitive *sensitive)
-{
-#ifdef KRB5
-	krb5_context context = NULL;
-	krb5_auth_context auth_context = NULL;
-#endif
-	int i, type;
-
-	if (supported_authentications == 0)
-		fatal("ssh_userauth1: server supports no auth methods");
-
-	/* Send the name of the user to log in as on the server. */
-	packet_start(SSH_CMSG_USER);
-	packet_put_cstring(server_user);
-	packet_send();
-	packet_write_wait();
-
-	/*
-	 * The server should respond with success if no authentication is
-	 * needed (the user has no password).  Otherwise the server responds
-	 * with failure.
-	 */
-	type = packet_read();
-
-	/* check whether the connection was accepted without authentication. */
-	if (type == SSH_SMSG_SUCCESS)
-		goto success;
-	if (type != SSH_SMSG_FAILURE)
-		packet_disconnect("Protocol error: got %d in response to SSH_CMSG_USER", type);
-
-#ifdef KRB5
-	if ((supported_authentications & (1 << SSH_AUTH_KERBEROS)) &&
-	    options.kerberos_authentication) {
-		debug("Trying Kerberos v5 authentication.");
-
-		if (try_krb5_authentication(&context, &auth_context)) {
-			type = packet_read();
-			if (type == SSH_SMSG_SUCCESS)
-				goto success;
-			if (type != SSH_SMSG_FAILURE)
-				packet_disconnect("Protocol error: got %d in response to Kerberos v5 auth", type);
-		}
-	}
-#endif /* KRB5 */
-
-#ifdef KRB4
-	if ((supported_authentications & (1 << SSH_AUTH_KERBEROS)) &&
-	    options.kerberos_authentication) {
-		debug("Trying Kerberos v4 authentication.");
-
-		if (try_krb4_authentication()) {
-			type = packet_read();
-			if (type == SSH_SMSG_SUCCESS)
-				goto success;
-			if (type != SSH_SMSG_FAILURE)
-				packet_disconnect("Protocol error: got %d in response to Kerberos v4 auth", type);
-		}
-	}
-#endif /* KRB4 */
-
-	/*
-	 * Use rhosts authentication if running in privileged socket and we
-	 * do not wish to remain anonymous.
-	 */
-	if ((supported_authentications & (1 << SSH_AUTH_RHOSTS)) &&
-	    options.rhosts_authentication) {
-		debug("Trying rhosts authentication.");
-		packet_start(SSH_CMSG_AUTH_RHOSTS);
-		packet_put_cstring(local_user);
-		packet_send();
-		packet_write_wait();
-
-		/* The server should respond with success or failure. */
-		type = packet_read();
-		if (type == SSH_SMSG_SUCCESS)
-			goto success;
-		if (type != SSH_SMSG_FAILURE)
-			packet_disconnect("Protocol error: got %d in response to rhosts auth",
-					  type);
-	}
-	/*
-	 * Try .rhosts or /etc/hosts.equiv authentication with RSA host
-	 * authentication.
-	 */
-	if ((supported_authentications & (1 << SSH_AUTH_RHOSTS_RSA)) &&
-	    options.rhosts_rsa_authentication) {
-		for (i = 0; i < sensitive->nkeys; i++) {
-			if (sensitive->keys[i] != NULL &&
-			    sensitive->keys[i]->type == KEY_RSA1 &&
-			    try_rhosts_rsa_authentication(local_user,
-			    sensitive->keys[i]))
-				goto success;
-		}
-	}
-	/* Try RSA authentication if the server supports it. */
-	if ((supported_authentications & (1 << SSH_AUTH_RSA)) &&
-	    options.rsa_authentication) {
-		/*
-		 * Try RSA authentication using the authentication agent. The
-		 * agent is tried first because no passphrase is needed for
-		 * it, whereas identity files may require passphrases.
-		 */
-		if (try_agent_authentication())
-			goto success;
-
-		/* Try RSA authentication for each identity. */
-		for (i = 0; i < options.num_identity_files; i++)
-			if (options.identity_keys[i] != NULL &&
-			    options.identity_keys[i]->type == KEY_RSA1 &&
-			    try_rsa_authentication(i))
-				goto success;
-	}
-	/* Try challenge response authentication if the server supports it. */
-	if ((supported_authentications & (1 << SSH_AUTH_TIS)) &&
-	    options.challenge_response_authentication && !options.batch_mode) {
-		if (try_challenge_response_authentication())
-			goto success;
-	}
-	/* Try password authentication if the server supports it. */
-	if ((supported_authentications & (1 << SSH_AUTH_PASSWORD)) &&
-	    options.password_authentication && !options.batch_mode) {
-		char prompt[80];
-
-		snprintf(prompt, sizeof(prompt), "%.30s@%.128s's password: ",
-		    server_user, host);
-		if (try_password_authentication(prompt))
-			goto success;
-	}
-	/* All authentication methods have failed.  Exit with an error message. */
-	fatal("Permission denied.");
-	/* NOTREACHED */
-
- success:
-#ifdef KRB5
-	/* Try Kerberos v5 TGT passing. */
-	if ((supported_authentications & (1 << SSH_PASS_KERBEROS_TGT)) &&
-	    options.kerberos_tgt_passing && context && auth_context) {
-		if (options.cipher == SSH_CIPHER_NONE)
-			log("WARNING: Encryption is disabled! Ticket will be transmitted in the clear!");
-		send_krb5_tgt(context, auth_context);
-	}
-	if (auth_context)
-		krb5_auth_con_free(context, auth_context);
-	if (context)
-		krb5_free_context(context);
-#endif
-
-#ifdef AFS
-	/* Try Kerberos v4 TGT passing if the server supports it. */
-	if ((supported_authentications & (1 << SSH_PASS_KERBEROS_TGT)) &&
-	    options.kerberos_tgt_passing) {
-		if (options.cipher == SSH_CIPHER_NONE)
-			log("WARNING: Encryption is disabled! Ticket will be transmitted in the clear!");
-		send_krb4_tgt();
-	}
-	/* Try AFS token passing if the server supports it. */
-	if ((supported_authentications & (1 << SSH_PASS_AFS_TOKEN)) &&
-	    options.afs_token_passing && k_hasafs()) {
-		if (options.cipher == SSH_CIPHER_NONE)
-			log("WARNING: Encryption is disabled! Token will be transmitted in the clear!");
-		send_afs_tokens();
-	}
-#endif /* AFS */
-
-	return;	/* need statement after label */
-}
diff --git a/crypto/openssh/sshconnect2.c b/crypto/openssh/sshconnect2.c
deleted file mode 100644
index 642b34b9e494..000000000000
--- a/crypto/openssh/sshconnect2.c
+++ /dev/null
@@ -1,1168 +0,0 @@
-/*
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: sshconnect2.c,v 1.114 2003/04/01 10:22:21 markus Exp $");
-
-#include "ssh.h"
-#include "ssh2.h"
-#include "xmalloc.h"
-#include "buffer.h"
-#include "packet.h"
-#include "compat.h"
-#include "bufaux.h"
-#include "cipher.h"
-#include "kex.h"
-#include "myproposal.h"
-#include "sshconnect.h"
-#include "authfile.h"
-#include "dh.h"
-#include "authfd.h"
-#include "log.h"
-#include "readconf.h"
-#include "readpass.h"
-#include "match.h"
-#include "dispatch.h"
-#include "canohost.h"
-#include "msg.h"
-#include "pathnames.h"
-
-/* import */
-extern char *client_version_string;
-extern char *server_version_string;
-extern Options options;
-
-/*
- * SSH2 key exchange
- */
-
-u_char *session_id2 = NULL;
-int session_id2_len = 0;
-
-char *xxx_host;
-struct sockaddr *xxx_hostaddr;
-
-Kex *xxx_kex = NULL;
-
-static int
-verify_host_key_callback(Key *hostkey)
-{
-	if (verify_host_key(xxx_host, xxx_hostaddr, hostkey) == -1)
-		fatal("Host key verification failed.");
-	return 0;
-}
-
-void
-ssh_kex2(char *host, struct sockaddr *hostaddr)
-{
-	Kex *kex;
-
-	xxx_host = host;
-	xxx_hostaddr = hostaddr;
-
-	if (options.ciphers == (char *)-1) {
-		log("No valid ciphers for protocol version 2 given, using defaults.");
-		options.ciphers = NULL;
-	}
-	if (options.ciphers != NULL) {
-		myproposal[PROPOSAL_ENC_ALGS_CTOS] =
-		myproposal[PROPOSAL_ENC_ALGS_STOC] = options.ciphers;
-	}
-	myproposal[PROPOSAL_ENC_ALGS_CTOS] =
-	    compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_CTOS]);
-	myproposal[PROPOSAL_ENC_ALGS_STOC] =
-	    compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_STOC]);
-	if (options.compression) {
-		myproposal[PROPOSAL_COMP_ALGS_CTOS] =
-		myproposal[PROPOSAL_COMP_ALGS_STOC] = "zlib,none";
-	} else {
-		myproposal[PROPOSAL_COMP_ALGS_CTOS] =
-		myproposal[PROPOSAL_COMP_ALGS_STOC] = "none,zlib";
-	}
-	if (options.macs != NULL) {
-		myproposal[PROPOSAL_MAC_ALGS_CTOS] =
-		myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
-	}
-	if (options.hostkeyalgorithms != NULL)
-		myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
-		    options.hostkeyalgorithms;
-
-	/* start key exchange */
-	kex = kex_setup(myproposal);
-	kex->kex[KEX_DH_GRP1_SHA1] = kexdh_client;
-	kex->kex[KEX_DH_GEX_SHA1] = kexgex_client;
-	kex->client_version_string=client_version_string;
-	kex->server_version_string=server_version_string;
-	kex->verify_host_key=&verify_host_key_callback;
-
-	xxx_kex = kex;
-
-	dispatch_run(DISPATCH_BLOCK, &kex->done, kex);
-
-	session_id2 = kex->session_id;
-	session_id2_len = kex->session_id_len;
-
-#ifdef DEBUG_KEXDH
-	/* send 1st encrypted/maced/compressed message */
-	packet_start(SSH2_MSG_IGNORE);
-	packet_put_cstring("markus");
-	packet_send();
-	packet_write_wait();
-#endif
-}
-
-/*
- * Authenticate user
- */
-
-typedef struct Authctxt Authctxt;
-typedef struct Authmethod Authmethod;
-
-typedef int sign_cb_fn(
-    Authctxt *authctxt, Key *key,
-    u_char **sigp, u_int *lenp, u_char *data, u_int datalen);
-
-struct Authctxt {
-	const char *server_user;
-	const char *local_user;
-	const char *host;
-	const char *service;
-	Authmethod *method;
-	int success;
-	char *authlist;
-	/* pubkey */
-	Key *last_key;
-	sign_cb_fn *last_key_sign;
-	int last_key_hint;
-	AuthenticationConnection *agent;
-	/* hostbased */
-	Sensitive *sensitive;
-	/* kbd-interactive */
-	int info_req_seen;
-};
-struct Authmethod {
-	char	*name;		/* string to compare against server's list */
-	int	(*userauth)(Authctxt *authctxt);
-	int	*enabled;	/* flag in option struct that enables method */
-	int	*batch_flag;	/* flag in option struct that disables method */
-};
-
-void	input_userauth_success(int, u_int32_t, void *);
-void	input_userauth_failure(int, u_int32_t, void *);
-void	input_userauth_banner(int, u_int32_t, void *);
-void	input_userauth_error(int, u_int32_t, void *);
-void	input_userauth_info_req(int, u_int32_t, void *);
-void	input_userauth_pk_ok(int, u_int32_t, void *);
-void	input_userauth_passwd_changereq(int, u_int32_t, void *);
-
-int	userauth_none(Authctxt *);
-int	userauth_pubkey(Authctxt *);
-int	userauth_passwd(Authctxt *);
-int	userauth_kbdint(Authctxt *);
-int	userauth_hostbased(Authctxt *);
-
-void	userauth(Authctxt *, char *);
-
-static int sign_and_send_pubkey(Authctxt *, Key *, sign_cb_fn *);
-static void clear_auth_state(Authctxt *);
-
-static Authmethod *authmethod_get(char *authlist);
-static Authmethod *authmethod_lookup(const char *name);
-static char *authmethods_get(void);
-
-Authmethod authmethods[] = {
-	{"hostbased",
-		userauth_hostbased,
-		&options.hostbased_authentication,
-		NULL},
-	{"publickey",
-		userauth_pubkey,
-		&options.pubkey_authentication,
-		NULL},
-	{"keyboard-interactive",
-		userauth_kbdint,
-		&options.kbd_interactive_authentication,
-		&options.batch_mode},
-	{"password",
-		userauth_passwd,
-		&options.password_authentication,
-		&options.batch_mode},
-	{"none",
-		userauth_none,
-		NULL,
-		NULL},
-	{NULL, NULL, NULL, NULL}
-};
-
-void
-ssh_userauth2(const char *local_user, const char *server_user, char *host,
-    Sensitive *sensitive)
-{
-	Authctxt authctxt;
-	int type;
-
-	if (options.challenge_response_authentication)
-		options.kbd_interactive_authentication = 1;
-
-	packet_start(SSH2_MSG_SERVICE_REQUEST);
-	packet_put_cstring("ssh-userauth");
-	packet_send();
-	debug("SSH2_MSG_SERVICE_REQUEST sent");
-	packet_write_wait();
-	type = packet_read();
-	if (type != SSH2_MSG_SERVICE_ACCEPT)
-		fatal("Server denied authentication request: %d", type);
-	if (packet_remaining() > 0) {
-		char *reply = packet_get_string(NULL);
-		debug2("service_accept: %s", reply);
-		xfree(reply);
-	} else {
-		debug2("buggy server: service_accept w/o service");
-	}
-	packet_check_eom();
-	debug("SSH2_MSG_SERVICE_ACCEPT received");
-
-	if (options.preferred_authentications == NULL)
-		options.preferred_authentications = authmethods_get();
-
-	/* setup authentication context */
-	memset(&authctxt, 0, sizeof(authctxt));
-	authctxt.agent = ssh_get_authentication_connection();
-	authctxt.server_user = server_user;
-	authctxt.local_user = local_user;
-	authctxt.host = host;
-	authctxt.service = "ssh-connection";		/* service name */
-	authctxt.success = 0;
-	authctxt.method = authmethod_lookup("none");
-	authctxt.authlist = NULL;
-	authctxt.sensitive = sensitive;
-	authctxt.info_req_seen = 0;
-	if (authctxt.method == NULL)
-		fatal("ssh_userauth2: internal error: cannot send userauth none request");
-
-	/* initial userauth request */
-	userauth_none(&authctxt);
-
-	dispatch_init(&input_userauth_error);
-	dispatch_set(SSH2_MSG_USERAUTH_SUCCESS, &input_userauth_success);
-	dispatch_set(SSH2_MSG_USERAUTH_FAILURE, &input_userauth_failure);
-	dispatch_set(SSH2_MSG_USERAUTH_BANNER, &input_userauth_banner);
-	dispatch_run(DISPATCH_BLOCK, &authctxt.success, &authctxt);	/* loop until success */
-
-	if (authctxt.agent != NULL)
-		ssh_close_authentication_connection(authctxt.agent);
-
-	debug("Authentication succeeded (%s).", authctxt.method->name);
-}
-void
-userauth(Authctxt *authctxt, char *authlist)
-{
-	if (authlist == NULL) {
-		authlist = authctxt->authlist;
-	} else {
-		if (authctxt->authlist)
-			xfree(authctxt->authlist);
-		authctxt->authlist = authlist;
-	}
-	for (;;) {
-		Authmethod *method = authmethod_get(authlist);
-		if (method == NULL)
-			fatal("Permission denied (%s).", authlist);
-		authctxt->method = method;
-		if (method->userauth(authctxt) != 0) {
-			debug2("we sent a %s packet, wait for reply", method->name);
-			break;
-		} else {
-			debug2("we did not send a packet, disable method");
-			method->enabled = NULL;
-		}
-	}
-}
-
-void
-input_userauth_error(int type, u_int32_t seq, void *ctxt)
-{
-	fatal("input_userauth_error: bad message during authentication: "
-	   "type %d", type);
-}
-
-void
-input_userauth_banner(int type, u_int32_t seq, void *ctxt)
-{
-	char *msg, *lang;
-	debug3("input_userauth_banner");
-	msg = packet_get_string(NULL);
-	lang = packet_get_string(NULL);
-	fprintf(stderr, "%s", msg);
-	xfree(msg);
-	xfree(lang);
-}
-
-void
-input_userauth_success(int type, u_int32_t seq, void *ctxt)
-{
-	Authctxt *authctxt = ctxt;
-	if (authctxt == NULL)
-		fatal("input_userauth_success: no authentication context");
-	if (authctxt->authlist)
-		xfree(authctxt->authlist);
-	clear_auth_state(authctxt);
-	authctxt->success = 1;			/* break out */
-}
-
-void
-input_userauth_failure(int type, u_int32_t seq, void *ctxt)
-{
-	Authctxt *authctxt = ctxt;
-	char *authlist = NULL;
-	int partial;
-
-	if (authctxt == NULL)
-		fatal("input_userauth_failure: no authentication context");
-
-	authlist = packet_get_string(NULL);
-	partial = packet_get_char();
-	packet_check_eom();
-
-	if (partial != 0)
-		log("Authenticated with partial success.");
-	debug("Authentications that can continue: %s", authlist);
-
-	clear_auth_state(authctxt);
-	userauth(authctxt, authlist);
-}
-void
-input_userauth_pk_ok(int type, u_int32_t seq, void *ctxt)
-{
-	Authctxt *authctxt = ctxt;
-	Key *key = NULL;
-	Buffer b;
-	int pktype, sent = 0;
-	u_int alen, blen;
-	char *pkalg, *fp;
-	u_char *pkblob;
-
-	if (authctxt == NULL)
-		fatal("input_userauth_pk_ok: no authentication context");
-	if (datafellows & SSH_BUG_PKOK) {
-		/* this is similar to SSH_BUG_PKAUTH */
-		debug2("input_userauth_pk_ok: SSH_BUG_PKOK");
-		pkblob = packet_get_string(&blen);
-		buffer_init(&b);
-		buffer_append(&b, pkblob, blen);
-		pkalg = buffer_get_string(&b, &alen);
-		buffer_free(&b);
-	} else {
-		pkalg = packet_get_string(&alen);
-		pkblob = packet_get_string(&blen);
-	}
-	packet_check_eom();
-
-	debug("Server accepts key: pkalg %s blen %u lastkey %p hint %d",
-	    pkalg, blen, authctxt->last_key, authctxt->last_key_hint);
-
-	do {
-		if (authctxt->last_key == NULL ||
-		    authctxt->last_key_sign == NULL) {
-			debug("no last key or no sign cb");
-			break;
-		}
-		if ((pktype = key_type_from_name(pkalg)) == KEY_UNSPEC) {
-			debug("unknown pkalg %s", pkalg);
-			break;
-		}
-		if ((key = key_from_blob(pkblob, blen)) == NULL) {
-			debug("no key from blob. pkalg %s", pkalg);
-			break;
-		}
-		if (key->type != pktype) {
-			error("input_userauth_pk_ok: type mismatch "
-			    "for decoded key (received %d, expected %d)",
-			    key->type, pktype);
-			break;
-		}
-		fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
-		debug2("input_userauth_pk_ok: fp %s", fp);
-		xfree(fp);
-		if (!key_equal(key, authctxt->last_key)) {
-			debug("key != last_key");
-			break;
-		}
-		sent = sign_and_send_pubkey(authctxt, key,
-		   authctxt->last_key_sign);
-	} while (0);
-
-	if (key != NULL)
-		key_free(key);
-	xfree(pkalg);
-	xfree(pkblob);
-
-	/* unregister */
-	clear_auth_state(authctxt);
-	dispatch_set(SSH2_MSG_USERAUTH_PK_OK, NULL);
-
-	/* try another method if we did not send a packet */
-	if (sent == 0)
-		userauth(authctxt, NULL);
-
-}
-
-int
-userauth_none(Authctxt *authctxt)
-{
-	/* initial userauth request */
-	packet_start(SSH2_MSG_USERAUTH_REQUEST);
-	packet_put_cstring(authctxt->server_user);
-	packet_put_cstring(authctxt->service);
-	packet_put_cstring(authctxt->method->name);
-	packet_send();
-	return 1;
-}
-
-int
-userauth_passwd(Authctxt *authctxt)
-{
-	static int attempt = 0;
-	char prompt[150];
-	char *password;
-
-	if (attempt++ >= options.number_of_password_prompts)
-		return 0;
-
-	if (attempt != 1)
-		error("Permission denied, please try again.");
-
-	snprintf(prompt, sizeof(prompt), "%.30s@%.128s's password: ",
-	    authctxt->server_user, authctxt->host);
-	password = read_passphrase(prompt, 0);
-	packet_start(SSH2_MSG_USERAUTH_REQUEST);
-	packet_put_cstring(authctxt->server_user);
-	packet_put_cstring(authctxt->service);
-	packet_put_cstring(authctxt->method->name);
-	packet_put_char(0);
-	packet_put_cstring(password);
-	memset(password, 0, strlen(password));
-	xfree(password);
-	packet_add_padding(64);
-	packet_send();
-
-	dispatch_set(SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ,
-	    &input_userauth_passwd_changereq);
-
-	return 1;
-}
-/*
- * parse PASSWD_CHANGEREQ, prompt user and send SSH2_MSG_USERAUTH_REQUEST
- */
-void
-input_userauth_passwd_changereq(int type, u_int32_t seqnr, void *ctxt)
-{
-	Authctxt *authctxt = ctxt;
-	char *info, *lang, *password = NULL, *retype = NULL;
-	char prompt[150];
-
-	debug2("input_userauth_passwd_changereq");
-
-	if (authctxt == NULL)
-		fatal("input_userauth_passwd_changereq: "
-		    "no authentication context");
-
-	info = packet_get_string(NULL);
-	lang = packet_get_string(NULL);
-	if (strlen(info) > 0)
-		log("%s", info);
-	xfree(info);
-	xfree(lang);
-	packet_start(SSH2_MSG_USERAUTH_REQUEST);
-	packet_put_cstring(authctxt->server_user);
-	packet_put_cstring(authctxt->service);
-	packet_put_cstring(authctxt->method->name);
-	packet_put_char(1);			/* additional info */
-	snprintf(prompt, sizeof(prompt),
-	    "Enter %.30s@%.128s's old password: ",
-	    authctxt->server_user, authctxt->host);
-	password = read_passphrase(prompt, 0);
-	packet_put_cstring(password);
-	memset(password, 0, strlen(password));
-	xfree(password);
-	password = NULL;
-	while (password == NULL) {
-		snprintf(prompt, sizeof(prompt),
-		    "Enter %.30s@%.128s's new password: ",
-		    authctxt->server_user, authctxt->host);
-		password = read_passphrase(prompt, RP_ALLOW_EOF);
-		if (password == NULL) {
-			/* bail out */
-			return;
-		}
-		snprintf(prompt, sizeof(prompt),
-		    "Retype %.30s@%.128s's new password: ",
-		    authctxt->server_user, authctxt->host);
-		retype = read_passphrase(prompt, 0);
-		if (strcmp(password, retype) != 0) {
-			memset(password, 0, strlen(password));
-			xfree(password);
-			log("Mismatch; try again, EOF to quit.");
-			password = NULL;
-		}
-		memset(retype, 0, strlen(retype));
-		xfree(retype);
-	}
-	packet_put_cstring(password);
-	memset(password, 0, strlen(password));
-	xfree(password);
-	packet_add_padding(64);
-	packet_send();
-
-	dispatch_set(SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ,
-	    &input_userauth_passwd_changereq);
-}
-
-static void
-clear_auth_state(Authctxt *authctxt)
-{
-	/* XXX clear authentication state */
-	dispatch_set(SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ, NULL);
-
-	if (authctxt->last_key != NULL && authctxt->last_key_hint == -1) {
-		debug3("clear_auth_state: key_free %p", authctxt->last_key);
-		key_free(authctxt->last_key);
-	}
-	authctxt->last_key = NULL;
-	authctxt->last_key_hint = -2;
-	authctxt->last_key_sign = NULL;
-}
-
-static int
-sign_and_send_pubkey(Authctxt *authctxt, Key *k, sign_cb_fn *sign_callback)
-{
-	Buffer b;
-	u_char *blob, *signature;
-	u_int bloblen, slen;
-	int skip = 0;
-	int ret = -1;
-	int have_sig = 1;
-
-	debug3("sign_and_send_pubkey");
-
-	if (key_to_blob(k, &blob, &bloblen) == 0) {
-		/* we cannot handle this key */
-		debug3("sign_and_send_pubkey: cannot handle key");
-		return 0;
-	}
-	/* data to be signed */
-	buffer_init(&b);
-	if (datafellows & SSH_OLD_SESSIONID) {
-		buffer_append(&b, session_id2, session_id2_len);
-		skip = session_id2_len;
-	} else {
-		buffer_put_string(&b, session_id2, session_id2_len);
-		skip = buffer_len(&b);
-	}
-	buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
-	buffer_put_cstring(&b, authctxt->server_user);
-	buffer_put_cstring(&b,
-	    datafellows & SSH_BUG_PKSERVICE ?
-	    "ssh-userauth" :
-	    authctxt->service);
-	if (datafellows & SSH_BUG_PKAUTH) {
-		buffer_put_char(&b, have_sig);
-	} else {
-		buffer_put_cstring(&b, authctxt->method->name);
-		buffer_put_char(&b, have_sig);
-		buffer_put_cstring(&b, key_ssh_name(k));
-	}
-	buffer_put_string(&b, blob, bloblen);
-
-	/* generate signature */
-	ret = (*sign_callback)(authctxt, k, &signature, &slen,
-	    buffer_ptr(&b), buffer_len(&b));
-	if (ret == -1) {
-		xfree(blob);
-		buffer_free(&b);
-		return 0;
-	}
-#ifdef DEBUG_PK
-	buffer_dump(&b);
-#endif
-	if (datafellows & SSH_BUG_PKSERVICE) {
-		buffer_clear(&b);
-		buffer_append(&b, session_id2, session_id2_len);
-		skip = session_id2_len;
-		buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
-		buffer_put_cstring(&b, authctxt->server_user);
-		buffer_put_cstring(&b, authctxt->service);
-		buffer_put_cstring(&b, authctxt->method->name);
-		buffer_put_char(&b, have_sig);
-		if (!(datafellows & SSH_BUG_PKAUTH))
-			buffer_put_cstring(&b, key_ssh_name(k));
-		buffer_put_string(&b, blob, bloblen);
-	}
-	xfree(blob);
-
-	/* append signature */
-	buffer_put_string(&b, signature, slen);
-	xfree(signature);
-
-	/* skip session id and packet type */
-	if (buffer_len(&b) < skip + 1)
-		fatal("userauth_pubkey: internal error");
-	buffer_consume(&b, skip + 1);
-
-	/* put remaining data from buffer into packet */
-	packet_start(SSH2_MSG_USERAUTH_REQUEST);
-	packet_put_raw(buffer_ptr(&b), buffer_len(&b));
-	buffer_free(&b);
-	packet_send();
-
-	return 1;
-}
-
-static int
-send_pubkey_test(Authctxt *authctxt, Key *k, sign_cb_fn *sign_callback,
-    int hint)
-{
-	u_char *blob;
-	u_int bloblen, have_sig = 0;
-
-	debug3("send_pubkey_test");
-
-	if (key_to_blob(k, &blob, &bloblen) == 0) {
-		/* we cannot handle this key */
-		debug3("send_pubkey_test: cannot handle key");
-		return 0;
-	}
-	/* register callback for USERAUTH_PK_OK message */
-	authctxt->last_key_sign = sign_callback;
-	authctxt->last_key_hint = hint;
-	authctxt->last_key = k;
-	dispatch_set(SSH2_MSG_USERAUTH_PK_OK, &input_userauth_pk_ok);
-
-	packet_start(SSH2_MSG_USERAUTH_REQUEST);
-	packet_put_cstring(authctxt->server_user);
-	packet_put_cstring(authctxt->service);
-	packet_put_cstring(authctxt->method->name);
-	packet_put_char(have_sig);
-	if (!(datafellows & SSH_BUG_PKAUTH))
-		packet_put_cstring(key_ssh_name(k));
-	packet_put_string(blob, bloblen);
-	xfree(blob);
-	packet_send();
-	return 1;
-}
-
-static Key *
-load_identity_file(char *filename)
-{
-	Key *private;
-	char prompt[300], *passphrase;
-	int quit, i;
-	struct stat st;
-
-	if (stat(filename, &st) < 0) {
-		debug3("no such identity: %s", filename);
-		return NULL;
-	}
-	private = key_load_private_type(KEY_UNSPEC, filename, "", NULL);
-	if (private == NULL) {
-		if (options.batch_mode)
-			return NULL;
-		snprintf(prompt, sizeof prompt,
-		    "Enter passphrase for key '%.100s': ", filename);
-		for (i = 0; i < options.number_of_password_prompts; i++) {
-			passphrase = read_passphrase(prompt, 0);
-			if (strcmp(passphrase, "") != 0) {
-				private = key_load_private_type(KEY_UNSPEC, filename,
-				    passphrase, NULL);
-				quit = 0;
-			} else {
-				debug2("no passphrase given, try next key");
-				quit = 1;
-			}
-			memset(passphrase, 0, strlen(passphrase));
-			xfree(passphrase);
-			if (private != NULL || quit)
-				break;
-			debug2("bad passphrase given, try again...");
-		}
-	}
-	return private;
-}
-
-static int
-identity_sign_cb(Authctxt *authctxt, Key *key, u_char **sigp, u_int *lenp,
-    u_char *data, u_int datalen)
-{
-	Key *private;
-	int idx, ret;
-
-	idx = authctxt->last_key_hint;
-	if (idx < 0)
-		return -1;
-
-	/* private key is stored in external hardware */
-	if (options.identity_keys[idx]->flags & KEY_FLAG_EXT)
-		return key_sign(options.identity_keys[idx], sigp, lenp, data, datalen);
-
-	private = load_identity_file(options.identity_files[idx]);
-	if (private == NULL)
-		return -1;
-	ret = key_sign(private, sigp, lenp, data, datalen);
-	key_free(private);
-	return ret;
-}
-
-static int
-agent_sign_cb(Authctxt *authctxt, Key *key, u_char **sigp, u_int *lenp,
-    u_char *data, u_int datalen)
-{
-	return ssh_agent_sign(authctxt->agent, key, sigp, lenp, data, datalen);
-}
-
-static int
-key_sign_cb(Authctxt *authctxt, Key *key, u_char **sigp, u_int *lenp,
-    u_char *data, u_int datalen)
-{
-	return key_sign(key, sigp, lenp, data, datalen);
-}
-
-static int
-userauth_pubkey_agent(Authctxt *authctxt)
-{
-	static int called = 0;
-	int ret = 0;
-	char *comment;
-	Key *k;
-
-	if (called == 0) {
-		if (ssh_get_num_identities(authctxt->agent, 2) == 0)
-			debug2("userauth_pubkey_agent: no keys at all");
-		called = 1;
-	}
-	k = ssh_get_next_identity(authctxt->agent, &comment, 2);
-	if (k == NULL) {
-		debug2("userauth_pubkey_agent: no more keys");
-	} else {
-		debug("Offering agent key: %s", comment);
-		xfree(comment);
-		ret = send_pubkey_test(authctxt, k, agent_sign_cb, -1);
-		if (ret == 0)
-			key_free(k);
-	}
-	if (ret == 0)
-		debug2("userauth_pubkey_agent: no message sent");
-	return ret;
-}
-
-int
-userauth_pubkey(Authctxt *authctxt)
-{
-	static int idx = 0;
-	int sent = 0;
-	Key *key;
-	char *filename;
-
-	if (authctxt->agent != NULL) {
-		do {
-			sent = userauth_pubkey_agent(authctxt);
-		} while (!sent && authctxt->agent->howmany > 0);
-	}
-	while (!sent && idx < options.num_identity_files) {
-		key = options.identity_keys[idx];
-		filename = options.identity_files[idx];
-		if (key == NULL) {
-			debug("Trying private key: %s", filename);
-			key = load_identity_file(filename);
-			if (key != NULL) {
-				sent = sign_and_send_pubkey(authctxt, key,
-				    key_sign_cb);
-				key_free(key);
-			}
-		} else if (key->type != KEY_RSA1) {
-			debug("Offering public key: %s", filename);
-			sent = send_pubkey_test(authctxt, key,
-			    identity_sign_cb, idx);
-		}
-		idx++;
-	}
-	return sent;
-}
-
-/*
- * Send userauth request message specifying keyboard-interactive method.
- */
-int
-userauth_kbdint(Authctxt *authctxt)
-{
-	static int attempt = 0;
-
-	if (attempt++ >= options.number_of_password_prompts)
-		return 0;
-	/* disable if no SSH2_MSG_USERAUTH_INFO_REQUEST has been seen */
-	if (attempt > 1 && !authctxt->info_req_seen) {
-		debug3("userauth_kbdint: disable: no info_req_seen");
-		dispatch_set(SSH2_MSG_USERAUTH_INFO_REQUEST, NULL);
-		return 0;
-	}
-
-	debug2("userauth_kbdint");
-	packet_start(SSH2_MSG_USERAUTH_REQUEST);
-	packet_put_cstring(authctxt->server_user);
-	packet_put_cstring(authctxt->service);
-	packet_put_cstring(authctxt->method->name);
-	packet_put_cstring("");					/* lang */
-	packet_put_cstring(options.kbd_interactive_devices ?
-	    options.kbd_interactive_devices : "");
-	packet_send();
-
-	dispatch_set(SSH2_MSG_USERAUTH_INFO_REQUEST, &input_userauth_info_req);
-	return 1;
-}
-
-/*
- * parse INFO_REQUEST, prompt user and send INFO_RESPONSE
- */
-void
-input_userauth_info_req(int type, u_int32_t seq, void *ctxt)
-{
-	Authctxt *authctxt = ctxt;
-	char *name, *inst, *lang, *prompt, *response;
-	u_int num_prompts, i;
-	int echo = 0;
-
-	debug2("input_userauth_info_req");
-
-	if (authctxt == NULL)
-		fatal("input_userauth_info_req: no authentication context");
-
-	authctxt->info_req_seen = 1;
-
-	name = packet_get_string(NULL);
-	inst = packet_get_string(NULL);
-	lang = packet_get_string(NULL);
-	if (strlen(name) > 0)
-		log("%s", name);
-	if (strlen(inst) > 0)
-		log("%s", inst);
-	xfree(name);
-	xfree(inst);
-	xfree(lang);
-
-	num_prompts = packet_get_int();
-	/*
-	 * Begin to build info response packet based on prompts requested.
-	 * We commit to providing the correct number of responses, so if
-	 * further on we run into a problem that prevents this, we have to
-	 * be sure and clean this up and send a correct error response.
-	 */
-	packet_start(SSH2_MSG_USERAUTH_INFO_RESPONSE);
-	packet_put_int(num_prompts);
-
-	debug2("input_userauth_info_req: num_prompts %d", num_prompts);
-	for (i = 0; i < num_prompts; i++) {
-		prompt = packet_get_string(NULL);
-		echo = packet_get_char();
-
-		response = read_passphrase(prompt, echo ? RP_ECHO : 0);
-
-		packet_put_cstring(response);
-		memset(response, 0, strlen(response));
-		xfree(response);
-		xfree(prompt);
-	}
-	packet_check_eom(); /* done with parsing incoming message. */
-
-	packet_add_padding(64);
-	packet_send();
-}
-
-static int
-ssh_keysign(Key *key, u_char **sigp, u_int *lenp,
-    u_char *data, u_int datalen)
-{
-	Buffer b;
-	struct stat st;
-	pid_t pid;
-	int to[2], from[2], status, version = 2;
-
-	debug2("ssh_keysign called");
-
-	if (stat(_PATH_SSH_KEY_SIGN, &st) < 0) {
-		error("ssh_keysign: no installed: %s", strerror(errno));
-		return -1;
-	}
-	if (fflush(stdout) != 0)
-		error("ssh_keysign: fflush: %s", strerror(errno));
-	if (pipe(to) < 0) {
-		error("ssh_keysign: pipe: %s", strerror(errno));
-		return -1;
-	}
-	if (pipe(from) < 0) {
-		error("ssh_keysign: pipe: %s", strerror(errno));
-		return -1;
-	}
-	if ((pid = fork()) < 0) {
-		error("ssh_keysign: fork: %s", strerror(errno));
-		return -1;
-	}
-	if (pid == 0) {
-		seteuid(getuid());
-		setuid(getuid());
-		close(from[0]);
-		if (dup2(from[1], STDOUT_FILENO) < 0)
-			fatal("ssh_keysign: dup2: %s", strerror(errno));
-		close(to[1]);
-		if (dup2(to[0], STDIN_FILENO) < 0)
-			fatal("ssh_keysign: dup2: %s", strerror(errno));
-		close(from[1]);
-		close(to[0]);
-		execl(_PATH_SSH_KEY_SIGN, _PATH_SSH_KEY_SIGN, (char *) 0);
-		fatal("ssh_keysign: exec(%s): %s", _PATH_SSH_KEY_SIGN,
-		    strerror(errno));
-	}
-	close(from[1]);
-	close(to[0]);
-
-	buffer_init(&b);
-	buffer_put_int(&b, packet_get_connection_in()); /* send # of socket */
-	buffer_put_string(&b, data, datalen);
-	ssh_msg_send(to[1], version, &b);
-
-	if (ssh_msg_recv(from[0], &b) < 0) {
-		error("ssh_keysign: no reply");
-		buffer_clear(&b);
-		return -1;
-	}
-	close(from[0]);
-	close(to[1]);
-
-	while (waitpid(pid, &status, 0) < 0)
-		if (errno != EINTR)
-			break;
-
-	if (buffer_get_char(&b) != version) {
-		error("ssh_keysign: bad version");
-		buffer_clear(&b);
-		return -1;
-	}
-	*sigp = buffer_get_string(&b, lenp);
-	buffer_clear(&b);
-
-	return 0;
-}
-
-int
-userauth_hostbased(Authctxt *authctxt)
-{
-	Key *private = NULL;
-	Sensitive *sensitive = authctxt->sensitive;
-	Buffer b;
-	u_char *signature, *blob;
-	char *chost, *pkalg, *p;
-	const char *service;
-	u_int blen, slen;
-	int ok, i, len, found = 0;
-
-	/* check for a useful key */
-	for (i = 0; i < sensitive->nkeys; i++) {
-		private = sensitive->keys[i];
-		if (private && private->type != KEY_RSA1) {
-			found = 1;
-			/* we take and free the key */
-			sensitive->keys[i] = NULL;
-			break;
-		}
-	}
-	if (!found) {
-		debug("No more client hostkeys for hostbased authentication.");
-		return 0;
-	}
-	if (key_to_blob(private, &blob, &blen) == 0) {
-		key_free(private);
-		return 0;
-	}
-	/* figure out a name for the client host */
-	p = get_local_name(packet_get_connection_in());
-	if (p == NULL) {
-		error("userauth_hostbased: cannot get local ipaddr/name");
-		key_free(private);
-		return 0;
-	}
-	len = strlen(p) + 2;
-	chost = xmalloc(len);
-	strlcpy(chost, p, len);
-	strlcat(chost, ".", len);
-	debug2("userauth_hostbased: chost %s", chost);
-	xfree(p);
-
-	service = datafellows & SSH_BUG_HBSERVICE ? "ssh-userauth" :
-	    authctxt->service;
-	pkalg = xstrdup(key_ssh_name(private));
-	buffer_init(&b);
-	/* construct data */
-	buffer_put_string(&b, session_id2, session_id2_len);
-	buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
-	buffer_put_cstring(&b, authctxt->server_user);
-	buffer_put_cstring(&b, service);
-	buffer_put_cstring(&b, authctxt->method->name);
-	buffer_put_cstring(&b, pkalg);
-	buffer_put_string(&b, blob, blen);
-	buffer_put_cstring(&b, chost);
-	buffer_put_cstring(&b, authctxt->local_user);
-#ifdef DEBUG_PK
-	buffer_dump(&b);
-#endif
-	if (sensitive->external_keysign)
-		ok = ssh_keysign(private, &signature, &slen,
-		    buffer_ptr(&b), buffer_len(&b));
-	else
-		ok = key_sign(private, &signature, &slen,
-		    buffer_ptr(&b), buffer_len(&b));
-	key_free(private);
-	buffer_free(&b);
-	if (ok != 0) {
-		error("key_sign failed");
-		xfree(chost);
-		xfree(pkalg);
-		return 0;
-	}
-	packet_start(SSH2_MSG_USERAUTH_REQUEST);
-	packet_put_cstring(authctxt->server_user);
-	packet_put_cstring(authctxt->service);
-	packet_put_cstring(authctxt->method->name);
-	packet_put_cstring(pkalg);
-	packet_put_string(blob, blen);
-	packet_put_cstring(chost);
-	packet_put_cstring(authctxt->local_user);
-	packet_put_string(signature, slen);
-	memset(signature, 's', slen);
-	xfree(signature);
-	xfree(chost);
-	xfree(pkalg);
-
-	packet_send();
-	return 1;
-}
-
-/* find auth method */
-
-/*
- * given auth method name, if configurable options permit this method fill
- * in auth_ident field and return true, otherwise return false.
- */
-static int
-authmethod_is_enabled(Authmethod *method)
-{
-	if (method == NULL)
-		return 0;
-	/* return false if options indicate this method is disabled */
-	if  (method->enabled == NULL || *method->enabled == 0)
-		return 0;
-	/* return false if batch mode is enabled but method needs interactive mode */
-	if  (method->batch_flag != NULL && *method->batch_flag != 0)
-		return 0;
-	return 1;
-}
-
-static Authmethod *
-authmethod_lookup(const char *name)
-{
-	Authmethod *method = NULL;
-	if (name != NULL)
-		for (method = authmethods; method->name != NULL; method++)
-			if (strcmp(name, method->name) == 0)
-				return method;
-	debug2("Unrecognized authentication method name: %s", name ? name : "NULL");
-	return NULL;
-}
-
-/* XXX internal state */
-static Authmethod *current = NULL;
-static char *supported = NULL;
-static char *preferred = NULL;
-
-/*
- * Given the authentication method list sent by the server, return the
- * next method we should try.  If the server initially sends a nil list,
- * use a built-in default list.
- */
-static Authmethod *
-authmethod_get(char *authlist)
-{
-	char *name = NULL;
-	u_int next;
-
-	/* Use a suitable default if we're passed a nil list.  */
-	if (authlist == NULL || strlen(authlist) == 0)
-		authlist = options.preferred_authentications;
-
-	if (supported == NULL || strcmp(authlist, supported) != 0) {
-		debug3("start over, passed a different list %s", authlist);
-		if (supported != NULL)
-			xfree(supported);
-		supported = xstrdup(authlist);
-		preferred = options.preferred_authentications;
-		debug3("preferred %s", preferred);
-		current = NULL;
-	} else if (current != NULL && authmethod_is_enabled(current))
-		return current;
-
-	for (;;) {
-		if ((name = match_list(preferred, supported, &next)) == NULL) {
-			debug("No more authentication methods to try.");
-			current = NULL;
-			return NULL;
-		}
-		preferred += next;
-		debug3("authmethod_lookup %s", name);
-		debug3("remaining preferred: %s", preferred);
-		if ((current = authmethod_lookup(name)) != NULL &&
-		    authmethod_is_enabled(current)) {
-			debug3("authmethod_is_enabled %s", name);
-			debug("Next authentication method: %s", name);
-			return current;
-		}
-	}
-}
-
-static char *
-authmethods_get(void)
-{
-	Authmethod *method = NULL;
-	Buffer b;
-	char *list;
-
-	buffer_init(&b);
-	for (method = authmethods; method->name != NULL; method++) {
-		if (authmethod_is_enabled(method)) {
-			if (buffer_len(&b) > 0)
-				buffer_append(&b, ",", 1);
-			buffer_append(&b, method->name, strlen(method->name));
-		}
-	}
-	buffer_append(&b, "\0", 1);
-	list = xstrdup(buffer_ptr(&b));
-	buffer_free(&b);
-	return list;
-}
diff --git a/crypto/openssh/sshd.8 b/crypto/openssh/sshd.8
deleted file mode 100644
index a99c4f16273b..000000000000
--- a/crypto/openssh/sshd.8
+++ /dev/null
@@ -1,811 +0,0 @@
-.\"  -*- nroff -*-
-.\"
-.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
-.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
-.\"                    All rights reserved
-.\"
-.\" As far as I am concerned, the code I have written for this software
-.\" can be used freely for any purpose.  Any derived versions of this
-.\" software must be clearly marked as such, and if the derived work is
-.\" incompatible with the protocol description in the RFC file, it must be
-.\" called by a name other than "ssh" or "Secure Shell".
-.\"
-.\" Copyright (c) 1999,2000 Markus Friedl.  All rights reserved.
-.\" Copyright (c) 1999 Aaron Campbell.  All rights reserved.
-.\" Copyright (c) 1999 Theo de Raadt.  All rights reserved.
-.\"
-.\" Redistribution and use in source and binary forms, with or without
-.\" modification, are permitted provided that the following conditions
-.\" are met:
-.\" 1. Redistributions of source code must retain the above copyright
-.\"    notice, this list of conditions and the following disclaimer.
-.\" 2. Redistributions in binary form must reproduce the above copyright
-.\"    notice, this list of conditions and the following disclaimer in the
-.\"    documentation and/or other materials provided with the distribution.
-.\"
-.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-.\"
-.\" $OpenBSD: sshd.8,v 1.194 2003/01/31 21:54:40 jmc Exp $
-.Dd September 25, 1999
-.Dt SSHD 8
-.Os
-.Sh NAME
-.Nm sshd
-.Nd OpenSSH SSH daemon
-.Sh SYNOPSIS
-.Nm sshd
-.Bk -words
-.Op Fl deiqtD46
-.Op Fl b Ar bits
-.Op Fl f Ar config_file
-.Op Fl g Ar login_grace_time
-.Op Fl h Ar host_key_file
-.Op Fl k Ar key_gen_time
-.Op Fl o Ar option
-.Op Fl p Ar port
-.Op Fl u Ar len
-.Ek
-.Sh DESCRIPTION
-.Nm
-(SSH Daemon) is the daemon program for
-.Xr ssh 1 .
-Together these programs replace rlogin and rsh, and
-provide secure encrypted communications between two untrusted hosts
-over an insecure network.
-The programs are intended to be as easy to
-install and use as possible.
-.Pp
-.Nm
-is the daemon that listens for connections from clients.
-It is normally started at boot from
-.Pa /etc/rc .
-It forks a new
-daemon for each incoming connection.
-The forked daemons handle
-key exchange, encryption, authentication, command execution,
-and data exchange.
-This implementation of
-.Nm
-supports both SSH protocol version 1 and 2 simultaneously.
-.Nm
-works as follows:
-.Pp
-.Ss SSH protocol version 1
-.Pp
-Each host has a host-specific RSA key
-(normally 1024 bits) used to identify the host.
-Additionally, when
-the daemon starts, it generates a server RSA key (normally 768 bits).
-This key is normally regenerated every hour if it has been used, and
-is never stored on disk.
-.Pp
-Whenever a client connects, the daemon responds with its public
-host and server keys.
-The client compares the
-RSA host key against its own database to verify that it has not changed.
-The client then generates a 256 bit random number.
-It encrypts this
-random number using both the host key and the server key, and sends
-the encrypted number to the server.
-Both sides then use this
-random number as a session key which is used to encrypt all further
-communications in the session.
-The rest of the session is encrypted
-using a conventional cipher, currently Blowfish or 3DES, with 3DES
-being used by default.
-The client selects the encryption algorithm
-to use from those offered by the server.
-.Pp
-Next, the server and the client enter an authentication dialog.
-The client tries to authenticate itself using
-.Pa .rhosts
-authentication,
-.Pa .rhosts
-authentication combined with RSA host
-authentication, RSA challenge-response authentication, or password
-based authentication.
-.Pp
-Rhosts authentication is normally disabled
-because it is fundamentally insecure, but can be enabled in the server
-configuration file if desired.
-System security is not improved unless
-.Nm rshd ,
-.Nm rlogind ,
-and
-.Nm rexecd
-are disabled (thus completely disabling
-.Xr rlogin
-and
-.Xr rsh
-into the machine).
-.Pp
-.Ss SSH protocol version 2
-.Pp
-Version 2 works similarly:
-Each host has a host-specific key (RSA or DSA) used to identify the host.
-However, when the daemon starts, it does not generate a server key.
-Forward security is provided through a Diffie-Hellman key agreement.
-This key agreement results in a shared session key.
-.Pp
-The rest of the session is encrypted using a symmetric cipher, currently
-128 bit AES, Blowfish, 3DES, CAST128, Arcfour, 192 bit AES, or 256 bit AES.
-The client selects the encryption algorithm
-to use from those offered by the server.
-Additionally, session integrity is provided
-through a cryptographic message authentication code
-(hmac-sha1 or hmac-md5).
-.Pp
-Protocol version 2 provides a public key based
-user (PubkeyAuthentication) or
-client host (HostbasedAuthentication) authentication method,
-conventional password authentication and challenge response based methods.
-.Pp
-.Ss Command execution and data forwarding
-.Pp
-If the client successfully authenticates itself, a dialog for
-preparing the session is entered.
-At this time the client may request
-things like allocating a pseudo-tty, forwarding X11 connections,
-forwarding TCP/IP connections, or forwarding the authentication agent
-connection over the secure channel.
-.Pp
-Finally, the client either requests a shell or execution of a command.
-The sides then enter session mode.
-In this mode, either side may send
-data at any time, and such data is forwarded to/from the shell or
-command on the server side, and the user terminal in the client side.
-.Pp
-When the user program terminates and all forwarded X11 and other
-connections have been closed, the server sends command exit status to
-the client, and both sides exit.
-.Pp
-.Nm
-can be configured using command-line options or a configuration
-file.
-Command-line options override values specified in the
-configuration file.
-.Pp
-.Nm
-rereads its configuration file when it receives a hangup signal,
-.Dv SIGHUP ,
-by executing itself with the name it was started as, i.e.,
-.Pa /usr/sbin/sshd .
-.Pp
-The options are as follows:
-.Bl -tag -width Ds
-.It Fl b Ar bits
-Specifies the number of bits in the ephemeral protocol version 1
-server key (default 768).
-.It Fl d
-Debug mode.
-The server sends verbose debug output to the system
-log, and does not put itself in the background.
-The server also will not fork and will only process one connection.
-This option is only intended for debugging for the server.
-Multiple
-.Fl d
-options increase the debugging level.
-Maximum is 3.
-.It Fl e
-When this option is specified,
-.Nm
-will send the output to the standard error instead of the system log.
-.It Fl f Ar configuration_file
-Specifies the name of the configuration file.
-The default is
-.Pa /etc/ssh/sshd_config .
-.Nm
-refuses to start if there is no configuration file.
-.It Fl g Ar login_grace_time
-Gives the grace time for clients to authenticate themselves (default
-120 seconds).
-If the client fails to authenticate the user within
-this many seconds, the server disconnects and exits.
-A value of zero indicates no limit.
-.It Fl h Ar host_key_file
-Specifies a file from which a host key is read.
-This option must be given if
-.Nm
-is not run as root (as the normal
-host key files are normally not readable by anyone but root).
-The default is
-.Pa /etc/ssh/ssh_host_key
-for protocol version 1, and
-.Pa /etc/ssh/ssh_host_rsa_key
-and
-.Pa /etc/ssh/ssh_host_dsa_key
-for protocol version 2.
-It is possible to have multiple host key files for
-the different protocol versions and host key algorithms.
-.It Fl i
-Specifies that
-.Nm
-is being run from
-.Xr inetd 8 .
-.Nm
-is normally not run
-from inetd because it needs to generate the server key before it can
-respond to the client, and this may take tens of seconds.
-Clients would have to wait too long if the key was regenerated every time.
-However, with small key sizes (e.g., 512) using
-.Nm
-from inetd may
-be feasible.
-.It Fl k Ar key_gen_time
-Specifies how often the ephemeral protocol version 1 server key is
-regenerated (default 3600 seconds, or one hour).
-The motivation for regenerating the key fairly
-often is that the key is not stored anywhere, and after about an hour,
-it becomes impossible to recover the key for decrypting intercepted
-communications even if the machine is cracked into or physically
-seized.
-A value of zero indicates that the key will never be regenerated.
-.It Fl o Ar option
-Can be used to give options in the format used in the configuration file.
-This is useful for specifying options for which there is no separate
-command-line flag.
-.It Fl p Ar port
-Specifies the port on which the server listens for connections
-(default 22).
-Multiple port options are permitted.
-Ports specified in the configuration file are ignored when a
-command-line port is specified.
-.It Fl q
-Quiet mode.
-Nothing is sent to the system log.
-Normally the beginning,
-authentication, and termination of each connection is logged.
-.It Fl t
-Test mode.
-Only check the validity of the configuration file and sanity of the keys.
-This is useful for updating
-.Nm
-reliably as configuration options may change.
-.It Fl u Ar len
-This option is used to specify the size of the field
-in the
-.Li utmp
-structure that holds the remote host name.
-If the resolved host name is longer than
-.Ar len ,
-the dotted decimal value will be used instead.
-This allows hosts with very long host names that
-overflow this field to still be uniquely identified.
-Specifying
-.Fl u0
-indicates that only dotted decimal addresses
-should be put into the
-.Pa utmp
-file.
-.Fl u0
-may also be used to prevent
-.Nm
-from making DNS requests unless the authentication
-mechanism or configuration requires it.
-Authentication mechanisms that may require DNS include
-.Cm RhostsAuthentication ,
-.Cm RhostsRSAAuthentication ,
-.Cm HostbasedAuthentication
-and using a
-.Cm from="pattern-list"
-option in a key file.
-Configuration options that require DNS include using a
-USER@HOST pattern in
-.Cm AllowUsers
-or
-.Cm DenyUsers .
-.It Fl D
-When this option is specified
-.Nm
-will not detach and does not become a daemon.
-This allows easy monitoring of
-.Nm sshd .
-.It Fl 4
-Forces
-.Nm
-to use IPv4 addresses only.
-.It Fl 6
-Forces
-.Nm
-to use IPv6 addresses only.
-.El
-.Sh CONFIGURATION FILE
-.Nm
-reads configuration data from
-.Pa /etc/ssh/sshd_config
-(or the file specified with
-.Fl f
-on the command line).
-The file format and configuration options are described in
-.Xr sshd_config 5 .
-.Sh LOGIN PROCESS
-When a user successfully logs in,
-.Nm
-does the following:
-.Bl -enum -offset indent
-.It
-If the login is on a tty, and no command has been specified,
-prints last login time and
-.Pa /etc/motd
-(unless prevented in the configuration file or by
-.Pa $HOME/.hushlogin ;
-see the
-.Sx FILES
-section).
-.It
-If the login is on a tty, records login time.
-.It
-Checks
-.Pa /etc/nologin ;
-if it exists, prints contents and quits
-(unless root).
-.It
-Changes to run with normal user privileges.
-.It
-Sets up basic environment.
-.It
-Reads
-.Pa $HOME/.ssh/environment
-if it exists and users are allowed to change their environment.
-See the
-.Cm PermitUserEnvironment
-option in
-.Xr sshd_config 5 .
-.It
-Changes to user's home directory.
-.It
-If
-.Pa $HOME/.ssh/rc
-exists, runs it; else if
-.Pa /etc/ssh/sshrc
-exists, runs
-it; otherwise runs xauth.
-The
-.Dq rc
-files are given the X11
-authentication protocol and cookie in standard input.
-.It
-Runs user's shell or command.
-.El
-.Sh AUTHORIZED_KEYS FILE FORMAT
-.Pa $HOME/.ssh/authorized_keys
-is the default file that lists the public keys that are
-permitted for RSA authentication in protocol version 1
-and for public key authentication (PubkeyAuthentication)
-in protocol version 2.
-.Cm AuthorizedKeysFile
-may be used to specify an alternative file.
-.Pp
-Each line of the file contains one
-key (empty lines and lines starting with a
-.Ql #
-are ignored as
-comments).
-Each RSA public key consists of the following fields, separated by
-spaces: options, bits, exponent, modulus, comment.
-Each protocol version 2 public key consists of:
-options, keytype, base64 encoded key, comment.
-The options field
-is optional; its presence is determined by whether the line starts
-with a number or not (the options field never starts with a number).
-The bits, exponent, modulus and comment fields give the RSA key for
-protocol version 1; the
-comment field is not used for anything (but may be convenient for the
-user to identify the key).
-For protocol version 2 the keytype is
-.Dq ssh-dss
-or
-.Dq ssh-rsa .
-.Pp
-Note that lines in this file are usually several hundred bytes long
-(because of the size of the public key encoding).
-You don't want to type them in; instead, copy the
-.Pa identity.pub ,
-.Pa id_dsa.pub
-or the
-.Pa id_rsa.pub
-file and edit it.
-.Pp
-.Nm
-enforces a minimum RSA key modulus size for protocol 1
-and protocol 2 keys of 768 bits.
-.Pp
-The options (if present) consist of comma-separated option
-specifications.
-No spaces are permitted, except within double quotes.
-The following option specifications are supported (note
-that option keywords are case-insensitive):
-.Bl -tag -width Ds
-.It Cm from="pattern-list"
-Specifies that in addition to public key authentication, the canonical name
-of the remote host must be present in the comma-separated list of
-patterns
-.Pf ( Ql *
-and
-.Ql ?
-serve as wildcards).
-The list may also contain
-patterns negated by prefixing them with
-.Ql ! ;
-if the canonical host name matches a negated pattern, the key is not accepted.
-The purpose
-of this option is to optionally increase security: public key authentication
-by itself does not trust the network or name servers or anything (but
-the key); however, if somebody somehow steals the key, the key
-permits an intruder to log in from anywhere in the world.
-This additional option makes using a stolen key more difficult (name
-servers and/or routers would have to be compromised in addition to
-just the key).
-.It Cm command="command"
-Specifies that the command is executed whenever this key is used for
-authentication.
-The command supplied by the user (if any) is ignored.
-The command is run on a pty if the client requests a pty;
-otherwise it is run without a tty.
-If an 8-bit clean channel is required,
-one must not request a pty or should specify
-.Cm no-pty .
-A quote may be included in the command by quoting it with a backslash.
-This option might be useful
-to restrict certain public keys to perform just a specific operation.
-An example might be a key that permits remote backups but nothing else.
-Note that the client may specify TCP/IP and/or X11
-forwarding unless they are explicitly prohibited.
-Note that this option applies to shell, command or subsystem execution.
-.It Cm environment="NAME=value"
-Specifies that the string is to be added to the environment when
-logging in using this key.
-Environment variables set this way
-override other default environment values.
-Multiple options of this type are permitted.
-Environment processing is disabled by default and is
-controlled via the
-.Cm PermitUserEnvironment
-option.
-This option is automatically disabled if
-.Cm UseLogin
-is enabled.
-.It Cm no-port-forwarding
-Forbids TCP/IP forwarding when this key is used for authentication.
-Any port forward requests by the client will return an error.
-This might be used, e.g., in connection with the
-.Cm command
-option.
-.It Cm no-X11-forwarding
-Forbids X11 forwarding when this key is used for authentication.
-Any X11 forward requests by the client will return an error.
-.It Cm no-agent-forwarding
-Forbids authentication agent forwarding when this key is used for
-authentication.
-.It Cm no-pty
-Prevents tty allocation (a request to allocate a pty will fail).
-.It Cm permitopen="host:port"
-Limit local
-.Li ``ssh -L''
-port forwarding such that it may only connect to the specified host and
-port.
-IPv6 addresses can be specified with an alternative syntax:
-.Ar host/port .
-Multiple
-.Cm permitopen
-options may be applied separated by commas. No pattern matching is
-performed on the specified hostnames, they must be literal domains or
-addresses.
-.El
-.Ss Examples
-1024 33 12121.\|.\|.\|312314325 ylo@foo.bar
-.Pp
-from="*.niksula.hut.fi,!pc.niksula.hut.fi" 1024 35 23.\|.\|.\|2334 ylo@niksula
-.Pp
-command="dump /home",no-pty,no-port-forwarding 1024 33 23.\|.\|.\|2323 backup.hut.fi
-.Pp
-permitopen="10.2.1.55:80",permitopen="10.2.1.56:25" 1024 33 23.\|.\|.\|2323
-.Sh SSH_KNOWN_HOSTS FILE FORMAT
-The
-.Pa /etc/ssh/ssh_known_hosts
-and
-.Pa $HOME/.ssh/known_hosts
-files contain host public keys for all known hosts.
-The global file should
-be prepared by the administrator (optional), and the per-user file is
-maintained automatically: whenever the user connects from an unknown host
-its key is added to the per-user file.
-.Pp
-Each line in these files contains the following fields: hostnames,
-bits, exponent, modulus, comment.
-The fields are separated by spaces.
-.Pp
-Hostnames is a comma-separated list of patterns ('*' and '?' act as
-wildcards); each pattern in turn is matched against the canonical host
-name (when authenticating a client) or against the user-supplied
-name (when authenticating a server).
-A pattern may also be preceded by
-.Ql !
-to indicate negation: if the host name matches a negated
-pattern, it is not accepted (by that line) even if it matched another
-pattern on the line.
-.Pp
-Bits, exponent, and modulus are taken directly from the RSA host key; they
-can be obtained, e.g., from
-.Pa /etc/ssh/ssh_host_key.pub .
-The optional comment field continues to the end of the line, and is not used.
-.Pp
-Lines starting with
-.Ql #
-and empty lines are ignored as comments.
-.Pp
-When performing host authentication, authentication is accepted if any
-matching line has the proper key.
-It is thus permissible (but not
-recommended) to have several lines or different host keys for the same
-names.
-This will inevitably happen when short forms of host names
-from different domains are put in the file.
-It is possible
-that the files contain conflicting information; authentication is
-accepted if valid information can be found from either file.
-.Pp
-Note that the lines in these files are typically hundreds of characters
-long, and you definitely don't want to type in the host keys by hand.
-Rather, generate them by a script
-or by taking
-.Pa /etc/ssh/ssh_host_key.pub
-and adding the host names at the front.
-.Ss Examples
-.Bd -literal
-closenet,.\|.\|.\|,130.233.208.41 1024 37 159.\|.\|.93 closenet.hut.fi
-cvs.openbsd.org,199.185.137.3 ssh-rsa AAAA1234.....=
-.Ed
-.Sh FILES
-.Bl -tag -width Ds
-.It Pa /etc/ssh/sshd_config
-Contains configuration data for
-.Nm sshd .
-The file format and configuration options are described in
-.Xr sshd_config 5 .
-.It Pa /etc/ssh/ssh_host_key, /etc/ssh/ssh_host_dsa_key, /etc/ssh/ssh_host_rsa_key
-These three files contain the private parts of the host keys.
-These files should only be owned by root, readable only by root, and not
-accessible to others.
-Note that
-.Nm
-does not start if this file is group/world-accessible.
-.It Pa /etc/ssh/ssh_host_key.pub, /etc/ssh/ssh_host_dsa_key.pub, /etc/ssh/ssh_host_rsa_key.pub
-These three files contain the public parts of the host keys.
-These files should be world-readable but writable only by
-root.
-Their contents should match the respective private parts.
-These files are not
-really used for anything; they are provided for the convenience of
-the user so their contents can be copied to known hosts files.
-These files are created using
-.Xr ssh-keygen 1 .
-.It Pa /etc/moduli
-Contains Diffie-Hellman groups used for the "Diffie-Hellman Group Exchange".
-The file format is described in
-.Xr moduli 5 .
-.It Pa /var/empty
-.Xr chroot 2
-directory used by
-.Nm
-during privilege separation in the pre-authentication phase.
-The directory should not contain any files and must be owned by root
-and not group or world-writable.
-.It Pa /var/run/sshd.pid
-Contains the process ID of the
-.Nm
-listening for connections (if there are several daemons running
-concurrently for different ports, this contains the process ID of the one
-started last).
-The content of this file is not sensitive; it can be world-readable.
-.It Pa $HOME/.ssh/authorized_keys
-Lists the public keys (RSA or DSA) that can be used to log into the user's account.
-This file must be readable by root (which may on some machines imply
-it being world-readable if the user's home directory resides on an NFS
-volume).
-It is recommended that it not be accessible by others.
-The format of this file is described above.
-Users will place the contents of their
-.Pa identity.pub ,
-.Pa id_dsa.pub
-and/or
-.Pa id_rsa.pub
-files into this file, as described in
-.Xr ssh-keygen 1 .
-.It Pa "/etc/ssh/ssh_known_hosts" and "$HOME/.ssh/known_hosts"
-These files are consulted when using rhosts with RSA host
-authentication or protocol version 2 hostbased authentication
-to check the public key of the host.
-The key must be listed in one of these files to be accepted.
-The client uses the same files
-to verify that it is connecting to the correct remote host.
-These files should be writable only by root/the owner.
-.Pa /etc/ssh/ssh_known_hosts
-should be world-readable, and
-.Pa $HOME/.ssh/known_hosts
-can, but need not be, world-readable.
-.It Pa /etc/nologin
-If this file exists,
-.Nm
-refuses to let anyone except root log in.
-The contents of the file
-are displayed to anyone trying to log in, and non-root connections are
-refused.
-The file should be world-readable.
-.It Pa /etc/hosts.allow, /etc/hosts.deny
-Access controls that should be enforced by tcp-wrappers are defined here.
-Further details are described in
-.Xr hosts_access 5 .
-.It Pa $HOME/.rhosts
-This file contains host-username pairs, separated by a space, one per
-line.
-The given user on the corresponding host is permitted to log in
-without a password.
-The same file is used by rlogind and rshd.
-The file must
-be writable only by the user; it is recommended that it not be
-accessible by others.
-.Pp
-If is also possible to use netgroups in the file.
-Either host or user
-name may be of the form +@groupname to specify all hosts or all users
-in the group.
-.It Pa $HOME/.shosts
-For ssh,
-this file is exactly the same as for
-.Pa .rhosts .
-However, this file is
-not used by rlogin and rshd, so using this permits access using SSH only.
-.It Pa /etc/hosts.equiv
-This file is used during
-.Pa .rhosts
-authentication.
-In the simplest form, this file contains host names, one per line.
-Users on
-those hosts are permitted to log in without a password, provided they
-have the same user name on both machines.
-The host name may also be
-followed by a user name; such users are permitted to log in as
-.Em any
-user on this machine (except root).
-Additionally, the syntax
-.Dq +@group
-can be used to specify netgroups.
-Negated entries start with
-.Ql \&- .
-.Pp
-If the client host/user is successfully matched in this file, login is
-automatically permitted provided the client and server user names are the
-same.
-Additionally, successful RSA host authentication is normally required.
-This file must be writable only by root; it is recommended
-that it be world-readable.
-.Pp
-.Sy "Warning: It is almost never a good idea to use user names in"
-.Pa hosts.equiv .
-Beware that it really means that the named user(s) can log in as
-.Em anybody ,
-which includes bin, daemon, adm, and other accounts that own critical
-binaries and directories.
-Using a user name practically grants the user root access.
-The only valid use for user names that I can think
-of is in negative entries.
-.Pp
-Note that this warning also applies to rsh/rlogin.
-.It Pa /etc/shosts.equiv
-This is processed exactly as
-.Pa /etc/hosts.equiv .
-However, this file may be useful in environments that want to run both
-rsh/rlogin and ssh.
-.It Pa $HOME/.ssh/environment
-This file is read into the environment at login (if it exists).
-It can only contain empty lines, comment lines (that start with
-.Ql # ) ,
-and assignment lines of the form name=value.
-The file should be writable
-only by the user; it need not be readable by anyone else.
-Environment processing is disabled by default and is
-controlled via the
-.Cm PermitUserEnvironment
-option.
-.It Pa $HOME/.ssh/rc
-If this file exists, it is run with
-.Pa /bin/sh
-after reading the
-environment files but before starting the user's shell or command.
-It must not produce any output on stdout; stderr must be used
-instead.
-If X11 forwarding is in use, it will receive the "proto cookie" pair in
-its standard input (and
-.Ev DISPLAY
-in its environment).
-The script must call
-.Xr xauth 1
-because
-.Nm
-will not run xauth automatically to add X11 cookies.
-.Pp
-The primary purpose of this file is to run any initialization routines
-which may be needed before the user's home directory becomes
-accessible; AFS is a particular example of such an environment.
-.Pp
-This file will probably contain some initialization code followed by
-something similar to:
-.Bd -literal
-if read proto cookie && [ -n "$DISPLAY" ]; then
-	if [ `echo $DISPLAY | cut -c1-10` = 'localhost:' ]; then
-		# X11UseLocalhost=yes
-		echo add unix:`echo $DISPLAY |
-		    cut -c11-` $proto $cookie
-	else
-		# X11UseLocalhost=no
-		echo add $DISPLAY $proto $cookie
-	fi | xauth -q -
-fi
-.Ed
-.Pp
-If this file does not exist,
-.Pa /etc/ssh/sshrc
-is run, and if that
-does not exist either, xauth is used to add the cookie.
-.Pp
-This file should be writable only by the user, and need not be
-readable by anyone else.
-.It Pa /etc/ssh/sshrc
-Like
-.Pa $HOME/.ssh/rc .
-This can be used to specify
-machine-specific login-time initializations globally.
-This file should be writable only by root, and should be world-readable.
-.El
-.Sh AUTHORS
-OpenSSH is a derivative of the original and free
-ssh 1.2.12 release by Tatu Ylonen.
-Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos,
-Theo de Raadt and Dug Song
-removed many bugs, re-added newer features and
-created OpenSSH.
-Markus Friedl contributed the support for SSH
-protocol versions 1.5 and 2.0.
-Niels Provos and Markus Friedl contributed support
-for privilege separation.
-.Sh SEE ALSO
-.Xr scp 1 ,
-.Xr sftp 1 ,
-.Xr ssh 1 ,
-.Xr ssh-add 1 ,
-.Xr ssh-agent 1 ,
-.Xr ssh-keygen 1 ,
-.Xr login.conf 5 ,
-.Xr moduli 5 ,
-.Xr sshd_config 5 ,
-.Xr sftp-server 8
-.Rs
-.%A T. Ylonen
-.%A T. Kivinen
-.%A M. Saarinen
-.%A T. Rinne
-.%A S. Lehtinen
-.%T "SSH Protocol Architecture"
-.%N draft-ietf-secsh-architecture-12.txt
-.%D January 2002
-.%O work in progress material
-.Re
-.Rs
-.%A M. Friedl
-.%A N. Provos
-.%A W. A. Simpson
-.%T "Diffie-Hellman Group Exchange for the SSH Transport Layer Protocol"
-.%N draft-ietf-secsh-dh-group-exchange-02.txt
-.%D January 2002
-.%O work in progress material
-.Re
diff --git a/crypto/openssh/sshd.c b/crypto/openssh/sshd.c
deleted file mode 100644
index 0f2b2a3ce597..000000000000
--- a/crypto/openssh/sshd.c
+++ /dev/null
@@ -1,1844 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * This program is the ssh daemon.  It listens for connections from clients,
- * and performs authentication, executes use commands or shell, and forwards
- * information to/from the application to the user client over an encrypted
- * connection.  This can also handle forwarding of X11, TCP/IP, and
- * authentication agent connections.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- *
- * SSH2 implementation:
- * Privilege Separation:
- *
- * Copyright (c) 2000, 2001, 2002 Markus Friedl.  All rights reserved.
- * Copyright (c) 2002 Niels Provos.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: sshd.c,v 1.263 2003/02/16 17:09:57 markus Exp $");
-
-#include <openssl/dh.h>
-#include <openssl/bn.h>
-#include <openssl/md5.h>
-#include <openssl/rand.h>
-#ifdef HAVE_SECUREWARE
-#include <sys/security.h>
-#include <prot.h>
-#endif
-
-#include "ssh.h"
-#include "ssh1.h"
-#include "ssh2.h"
-#include "xmalloc.h"
-#include "rsa.h"
-#include "sshpty.h"
-#include "packet.h"
-#include "mpaux.h"
-#include "log.h"
-#include "servconf.h"
-#include "uidswap.h"
-#include "compat.h"
-#include "buffer.h"
-#include "cipher.h"
-#include "kex.h"
-#include "key.h"
-#include "dh.h"
-#include "myproposal.h"
-#include "authfile.h"
-#include "pathnames.h"
-#include "atomicio.h"
-#include "canohost.h"
-#include "auth.h"
-#include "misc.h"
-#include "dispatch.h"
-#include "channels.h"
-#include "session.h"
-#include "monitor_mm.h"
-#include "monitor.h"
-#include "monitor_wrap.h"
-#include "monitor_fdpass.h"
-
-#ifdef LIBWRAP
-#include <tcpd.h>
-#include <syslog.h>
-int allow_severity = LOG_INFO;
-int deny_severity = LOG_WARNING;
-#endif /* LIBWRAP */
-
-#ifndef O_NOCTTY
-#define O_NOCTTY	0
-#endif
-
-#ifdef HAVE___PROGNAME
-extern char *__progname;
-#else
-char *__progname;
-#endif
-
-/* Server configuration options. */
-ServerOptions options;
-
-/* Name of the server configuration file. */
-char *config_file_name = _PATH_SERVER_CONFIG_FILE;
-
-/*
- * Flag indicating whether IPv4 or IPv6.  This can be set on the command line.
- * Default value is AF_UNSPEC means both IPv4 and IPv6.
- */
-#ifdef IPV4_DEFAULT
-int IPv4or6 = AF_INET;
-#else
-int IPv4or6 = AF_UNSPEC;
-#endif
-
-/*
- * Debug mode flag.  This can be set on the command line.  If debug
- * mode is enabled, extra debugging output will be sent to the system
- * log, the daemon will not go to background, and will exit after processing
- * the first connection.
- */
-int debug_flag = 0;
-
-/* Flag indicating that the daemon should only test the configuration and keys. */
-int test_flag = 0;
-
-/* Flag indicating that the daemon is being started from inetd. */
-int inetd_flag = 0;
-
-/* Flag indicating that sshd should not detach and become a daemon. */
-int no_daemon_flag = 0;
-
-/* debug goes to stderr unless inetd_flag is set */
-int log_stderr = 0;
-
-/* Saved arguments to main(). */
-char **saved_argv;
-int saved_argc;
-
-/*
- * The sockets that the server is listening; this is used in the SIGHUP
- * signal handler.
- */
-#define	MAX_LISTEN_SOCKS	16
-int listen_socks[MAX_LISTEN_SOCKS];
-int num_listen_socks = 0;
-
-/*
- * the client's version string, passed by sshd2 in compat mode. if != NULL,
- * sshd will skip the version-number exchange
- */
-char *client_version_string = NULL;
-char *server_version_string = NULL;
-
-/* for rekeying XXX fixme */
-Kex *xxx_kex;
-
-/*
- * Any really sensitive data in the application is contained in this
- * structure. The idea is that this structure could be locked into memory so
- * that the pages do not get written into swap.  However, there are some
- * problems. The private key contains BIGNUMs, and we do not (in principle)
- * have access to the internals of them, and locking just the structure is
- * not very useful.  Currently, memory locking is not implemented.
- */
-struct {
-	Key	*server_key;		/* ephemeral server key */
-	Key	*ssh1_host_key;		/* ssh1 host key */
-	Key	**host_keys;		/* all private host keys */
-	int	have_ssh1_key;
-	int	have_ssh2_key;
-	u_char	ssh1_cookie[SSH_SESSION_KEY_LENGTH];
-} sensitive_data;
-
-/*
- * Flag indicating whether the RSA server key needs to be regenerated.
- * Is set in the SIGALRM handler and cleared when the key is regenerated.
- */
-static volatile sig_atomic_t key_do_regen = 0;
-
-/* This is set to true when a signal is received. */
-static volatile sig_atomic_t received_sighup = 0;
-static volatile sig_atomic_t received_sigterm = 0;
-
-/* session identifier, used by RSA-auth */
-u_char session_id[16];
-
-/* same for ssh2 */
-u_char *session_id2 = NULL;
-int session_id2_len = 0;
-
-/* record remote hostname or ip */
-u_int utmp_len = MAXHOSTNAMELEN;
-
-/* options.max_startup sized array of fd ints */
-int *startup_pipes = NULL;
-int startup_pipe;		/* in child */
-
-/* variables used for privilege separation */
-int use_privsep;
-struct monitor *pmonitor;
-
-/* Prototypes for various functions defined later in this file. */
-void destroy_sensitive_data(void);
-void demote_sensitive_data(void);
-
-static void do_ssh1_kex(void);
-static void do_ssh2_kex(void);
-
-/*
- * Close all listening sockets
- */
-static void
-close_listen_socks(void)
-{
-	int i;
-
-	for (i = 0; i < num_listen_socks; i++)
-		close(listen_socks[i]);
-	num_listen_socks = -1;
-}
-
-static void
-close_startup_pipes(void)
-{
-	int i;
-
-	if (startup_pipes)
-		for (i = 0; i < options.max_startups; i++)
-			if (startup_pipes[i] != -1)
-				close(startup_pipes[i]);
-}
-
-/*
- * Signal handler for SIGHUP.  Sshd execs itself when it receives SIGHUP;
- * the effect is to reread the configuration file (and to regenerate
- * the server key).
- */
-static void
-sighup_handler(int sig)
-{
-	int save_errno = errno;
-
-	received_sighup = 1;
-	signal(SIGHUP, sighup_handler);
-	errno = save_errno;
-}
-
-/*
- * Called from the main program after receiving SIGHUP.
- * Restarts the server.
- */
-static void
-sighup_restart(void)
-{
-	log("Received SIGHUP; restarting.");
-	close_listen_socks();
-	close_startup_pipes();
-	execv(saved_argv[0], saved_argv);
-	log("RESTART FAILED: av[0]='%.100s', error: %.100s.", saved_argv[0],
-	    strerror(errno));
-	exit(1);
-}
-
-/*
- * Generic signal handler for terminating signals in the master daemon.
- */
-static void
-sigterm_handler(int sig)
-{
-	received_sigterm = sig;
-}
-
-/*
- * SIGCHLD handler.  This is called whenever a child dies.  This will then
- * reap any zombies left by exited children.
- */
-static void
-main_sigchld_handler(int sig)
-{
-	int save_errno = errno;
-	pid_t pid;
-	int status;
-
-	while ((pid = waitpid(-1, &status, WNOHANG)) > 0 ||
-	    (pid < 0 && errno == EINTR))
-		;
-
-	signal(SIGCHLD, main_sigchld_handler);
-	errno = save_errno;
-}
-
-/*
- * Signal handler for the alarm after the login grace period has expired.
- */
-static void
-grace_alarm_handler(int sig)
-{
-	/* XXX no idea how fix this signal handler */
-
-	/* Log error and exit. */
-	fatal("Timeout before authentication for %s", get_remote_ipaddr());
-}
-
-/*
- * Signal handler for the key regeneration alarm.  Note that this
- * alarm only occurs in the daemon waiting for connections, and it does not
- * do anything with the private key or random state before forking.
- * Thus there should be no concurrency control/asynchronous execution
- * problems.
- */
-static void
-generate_ephemeral_server_key(void)
-{
-	u_int32_t rnd = 0;
-	int i;
-
-	verbose("Generating %s%d bit RSA key.",
-	    sensitive_data.server_key ? "new " : "", options.server_key_bits);
-	if (sensitive_data.server_key != NULL)
-		key_free(sensitive_data.server_key);
-	sensitive_data.server_key = key_generate(KEY_RSA1,
-	    options.server_key_bits);
-	verbose("RSA key generation complete.");
-
-	for (i = 0; i < SSH_SESSION_KEY_LENGTH; i++) {
-		if (i % 4 == 0)
-			rnd = arc4random();
-		sensitive_data.ssh1_cookie[i] = rnd & 0xff;
-		rnd >>= 8;
-	}
-	arc4random_stir();
-}
-
-static void
-key_regeneration_alarm(int sig)
-{
-	int save_errno = errno;
-
-	signal(SIGALRM, SIG_DFL);
-	errno = save_errno;
-	key_do_regen = 1;
-}
-
-static void
-sshd_exchange_identification(int sock_in, int sock_out)
-{
-	int i, mismatch;
-	int remote_major, remote_minor;
-	int major, minor;
-	char *s;
-	char buf[256];			/* Must not be larger than remote_version. */
-	char remote_version[256];	/* Must be at least as big as buf. */
-
-	if ((options.protocol & SSH_PROTO_1) &&
-	    (options.protocol & SSH_PROTO_2)) {
-		major = PROTOCOL_MAJOR_1;
-		minor = 99;
-	} else if (options.protocol & SSH_PROTO_2) {
-		major = PROTOCOL_MAJOR_2;
-		minor = PROTOCOL_MINOR_2;
-	} else {
-		major = PROTOCOL_MAJOR_1;
-		minor = PROTOCOL_MINOR_1;
-	}
-	snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s\n", major, minor, SSH_VERSION);
-	server_version_string = xstrdup(buf);
-
-	if (client_version_string == NULL) {
-		/* Send our protocol version identification. */
-		if (atomicio(write, sock_out, server_version_string,
-		    strlen(server_version_string))
-		    != strlen(server_version_string)) {
-			log("Could not write ident string to %s", get_remote_ipaddr());
-			fatal_cleanup();
-		}
-
-		/* Read other sides version identification. */
-		memset(buf, 0, sizeof(buf));
-		for (i = 0; i < sizeof(buf) - 1; i++) {
-			if (atomicio(read, sock_in, &buf[i], 1) != 1) {
-				log("Did not receive identification string from %s",
-				    get_remote_ipaddr());
-				fatal_cleanup();
-			}
-			if (buf[i] == '\r') {
-				buf[i] = 0;
-				/* Kludge for F-Secure Macintosh < 1.0.2 */
-				if (i == 12 &&
-				    strncmp(buf, "SSH-1.5-W1.0", 12) == 0)
-					break;
-				continue;
-			}
-			if (buf[i] == '\n') {
-				buf[i] = 0;
-				break;
-			}
-		}
-		buf[sizeof(buf) - 1] = 0;
-		client_version_string = xstrdup(buf);
-	}
-
-	/*
-	 * Check that the versions match.  In future this might accept
-	 * several versions and set appropriate flags to handle them.
-	 */
-	if (sscanf(client_version_string, "SSH-%d.%d-%[^\n]\n",
-	    &remote_major, &remote_minor, remote_version) != 3) {
-		s = "Protocol mismatch.\n";
-		(void) atomicio(write, sock_out, s, strlen(s));
-		close(sock_in);
-		close(sock_out);
-		log("Bad protocol version identification '%.100s' from %s",
-		    client_version_string, get_remote_ipaddr());
-		fatal_cleanup();
-	}
-	debug("Client protocol version %d.%d; client software version %.100s",
-	    remote_major, remote_minor, remote_version);
-
-	compat_datafellows(remote_version);
-
-	if (datafellows & SSH_BUG_PROBE) {
-		log("probed from %s with %s.  Don't panic.",
-		    get_remote_ipaddr(), client_version_string);
-		fatal_cleanup();
-	}
-
-	if (datafellows & SSH_BUG_SCANNER) {
-		log("scanned from %s with %s.  Don't panic.",
-		    get_remote_ipaddr(), client_version_string);
-		fatal_cleanup();
-	}
-
-	mismatch = 0;
-	switch (remote_major) {
-	case 1:
-		if (remote_minor == 99) {
-			if (options.protocol & SSH_PROTO_2)
-				enable_compat20();
-			else
-				mismatch = 1;
-			break;
-		}
-		if (!(options.protocol & SSH_PROTO_1)) {
-			mismatch = 1;
-			break;
-		}
-		if (remote_minor < 3) {
-			packet_disconnect("Your ssh version is too old and "
-			    "is no longer supported.  Please install a newer version.");
-		} else if (remote_minor == 3) {
-			/* note that this disables agent-forwarding */
-			enable_compat13();
-		}
-		break;
-	case 2:
-		if (options.protocol & SSH_PROTO_2) {
-			enable_compat20();
-			break;
-		}
-		/* FALLTHROUGH */
-	default:
-		mismatch = 1;
-		break;
-	}
-	chop(server_version_string);
-	debug("Local version string %.200s", server_version_string);
-
-	if (mismatch) {
-		s = "Protocol major versions differ.\n";
-		(void) atomicio(write, sock_out, s, strlen(s));
-		close(sock_in);
-		close(sock_out);
-		log("Protocol major versions differ for %s: %.200s vs. %.200s",
-		    get_remote_ipaddr(),
-		    server_version_string, client_version_string);
-		fatal_cleanup();
-	}
-}
-
-/* Destroy the host and server keys.  They will no longer be needed. */
-void
-destroy_sensitive_data(void)
-{
-	int i;
-
-	if (sensitive_data.server_key) {
-		key_free(sensitive_data.server_key);
-		sensitive_data.server_key = NULL;
-	}
-	for (i = 0; i < options.num_host_key_files; i++) {
-		if (sensitive_data.host_keys[i]) {
-			key_free(sensitive_data.host_keys[i]);
-			sensitive_data.host_keys[i] = NULL;
-		}
-	}
-	sensitive_data.ssh1_host_key = NULL;
-	memset(sensitive_data.ssh1_cookie, 0, SSH_SESSION_KEY_LENGTH);
-}
-
-/* Demote private to public keys for network child */
-void
-demote_sensitive_data(void)
-{
-	Key *tmp;
-	int i;
-
-	if (sensitive_data.server_key) {
-		tmp = key_demote(sensitive_data.server_key);
-		key_free(sensitive_data.server_key);
-		sensitive_data.server_key = tmp;
-	}
-
-	for (i = 0; i < options.num_host_key_files; i++) {
-		if (sensitive_data.host_keys[i]) {
-			tmp = key_demote(sensitive_data.host_keys[i]);
-			key_free(sensitive_data.host_keys[i]);
-			sensitive_data.host_keys[i] = tmp;
-			if (tmp->type == KEY_RSA1)
-				sensitive_data.ssh1_host_key = tmp;
-		}
-	}
-
-	/* We do not clear ssh1_host key and cookie.  XXX - Okay Niels? */
-}
-
-static void
-privsep_preauth_child(void)
-{
-	u_int32_t rnd[256];
-	gid_t gidset[1];
-	struct passwd *pw;
-	int i;
-
-	/* Enable challenge-response authentication for privilege separation */
-	privsep_challenge_enable();
-
-	for (i = 0; i < 256; i++)
-		rnd[i] = arc4random();
-	RAND_seed(rnd, sizeof(rnd));
-
-	/* Demote the private keys to public keys. */
-	demote_sensitive_data();
-
-	if ((pw = getpwnam(SSH_PRIVSEP_USER)) == NULL)
-		fatal("Privilege separation user %s does not exist",
-		    SSH_PRIVSEP_USER);
-	memset(pw->pw_passwd, 0, strlen(pw->pw_passwd));
-	endpwent();
-
-	/* Change our root directory */
-	if (chroot(_PATH_PRIVSEP_CHROOT_DIR) == -1)
-		fatal("chroot(\"%s\"): %s", _PATH_PRIVSEP_CHROOT_DIR,
-		    strerror(errno));
-	if (chdir("/") == -1)
-		fatal("chdir(\"/\"): %s", strerror(errno));
-
-	/* Drop our privileges */
-	debug3("privsep user:group %u:%u", (u_int)pw->pw_uid,
-	    (u_int)pw->pw_gid);
-#if 0
-	/* XXX not ready, to heavy after chroot */
-	do_setusercontext(pw);
-#else
-	gidset[0] = pw->pw_gid;
-	if (setgid(pw->pw_gid) < 0)
-		fatal("setgid failed for %u", pw->pw_gid );
-	if (setgroups(1, gidset) < 0)
-		fatal("setgroups: %.100s", strerror(errno));
-	permanently_set_uid(pw);
-#endif
-}
-
-static Authctxt *
-privsep_preauth(void)
-{
-	Authctxt *authctxt = NULL;
-	int status;
-	pid_t pid;
-
-	/* Set up unprivileged child process to deal with network data */
-	pmonitor = monitor_init();
-	/* Store a pointer to the kex for later rekeying */
-	pmonitor->m_pkex = &xxx_kex;
-
-	pid = fork();
-	if (pid == -1) {
-		fatal("fork of unprivileged child failed");
-	} else if (pid != 0) {
-		fatal_remove_cleanup((void (*) (void *)) packet_close, NULL);
-
-		debug2("Network child is on pid %ld", (long)pid);
-
-		close(pmonitor->m_recvfd);
-		authctxt = monitor_child_preauth(pmonitor);
-		close(pmonitor->m_sendfd);
-
-		/* Sync memory */
-		monitor_sync(pmonitor);
-
-		/* Wait for the child's exit status */
-		while (waitpid(pid, &status, 0) < 0)
-			if (errno != EINTR)
-				break;
-
-		/* Reinstall, since the child has finished */
-		fatal_add_cleanup((void (*) (void *)) packet_close, NULL);
-
-		return (authctxt);
-	} else {
-		/* child */
-
-		close(pmonitor->m_sendfd);
-
-		/* Demote the child */
-		if (getuid() == 0 || geteuid() == 0)
-			privsep_preauth_child();
-		setproctitle("%s", "[net]");
-	}
-	return (NULL);
-}
-
-static void
-privsep_postauth(Authctxt *authctxt)
-{
-	extern Authctxt *x_authctxt;
-
-	/* XXX - Remote port forwarding */
-	x_authctxt = authctxt;
-
-#ifdef DISABLE_FD_PASSING
-	if (1) {
-#else
-	if (authctxt->pw->pw_uid == 0 || options.use_login) {
-#endif
-		/* File descriptor passing is broken or root login */
-		monitor_apply_keystate(pmonitor);
-		use_privsep = 0;
-		return;
-	}
-
-	/* Authentication complete */
-	alarm(0);
-	if (startup_pipe != -1) {
-		close(startup_pipe);
-		startup_pipe = -1;
-	}
-
-	/* New socket pair */
-	monitor_reinit(pmonitor);
-
-	pmonitor->m_pid = fork();
-	if (pmonitor->m_pid == -1)
-		fatal("fork of unprivileged child failed");
-	else if (pmonitor->m_pid != 0) {
-		fatal_remove_cleanup((void (*) (void *)) packet_close, NULL);
-
-		debug2("User child is on pid %ld", (long)pmonitor->m_pid);
-		close(pmonitor->m_recvfd);
-		monitor_child_postauth(pmonitor);
-
-		/* NEVERREACHED */
-		exit(0);
-	}
-
-	close(pmonitor->m_sendfd);
-
-	/* Demote the private keys to public keys. */
-	demote_sensitive_data();
-
-	/* Drop privileges */
-	do_setusercontext(authctxt->pw);
-
-	/* It is safe now to apply the key state */
-	monitor_apply_keystate(pmonitor);
-}
-
-static char *
-list_hostkey_types(void)
-{
-	Buffer b;
-	char *p;
-	int i;
-
-	buffer_init(&b);
-	for (i = 0; i < options.num_host_key_files; i++) {
-		Key *key = sensitive_data.host_keys[i];
-		if (key == NULL)
-			continue;
-		switch (key->type) {
-		case KEY_RSA:
-		case KEY_DSA:
-			if (buffer_len(&b) > 0)
-				buffer_append(&b, ",", 1);
-			p = key_ssh_name(key);
-			buffer_append(&b, p, strlen(p));
-			break;
-		}
-	}
-	buffer_append(&b, "\0", 1);
-	p = xstrdup(buffer_ptr(&b));
-	buffer_free(&b);
-	debug("list_hostkey_types: %s", p);
-	return p;
-}
-
-Key *
-get_hostkey_by_type(int type)
-{
-	int i;
-
-	for (i = 0; i < options.num_host_key_files; i++) {
-		Key *key = sensitive_data.host_keys[i];
-		if (key != NULL && key->type == type)
-			return key;
-	}
-	return NULL;
-}
-
-Key *
-get_hostkey_by_index(int ind)
-{
-	if (ind < 0 || ind >= options.num_host_key_files)
-		return (NULL);
-	return (sensitive_data.host_keys[ind]);
-}
-
-int
-get_hostkey_index(Key *key)
-{
-	int i;
-
-	for (i = 0; i < options.num_host_key_files; i++) {
-		if (key == sensitive_data.host_keys[i])
-			return (i);
-	}
-	return (-1);
-}
-
-/*
- * returns 1 if connection should be dropped, 0 otherwise.
- * dropping starts at connection #max_startups_begin with a probability
- * of (max_startups_rate/100). the probability increases linearly until
- * all connections are dropped for startups > max_startups
- */
-static int
-drop_connection(int startups)
-{
-	double p, r;
-
-	if (startups < options.max_startups_begin)
-		return 0;
-	if (startups >= options.max_startups)
-		return 1;
-	if (options.max_startups_rate == 100)
-		return 1;
-
-	p  = 100 - options.max_startups_rate;
-	p *= startups - options.max_startups_begin;
-	p /= (double) (options.max_startups - options.max_startups_begin);
-	p += options.max_startups_rate;
-	p /= 100.0;
-	r = arc4random() / (double) UINT_MAX;
-
-	debug("drop_connection: p %g, r %g", p, r);
-	return (r < p) ? 1 : 0;
-}
-
-static void
-usage(void)
-{
-	fprintf(stderr, "sshd version %s\n", SSH_VERSION);
-	fprintf(stderr, "Usage: %s [options]\n", __progname);
-	fprintf(stderr, "Options:\n");
-	fprintf(stderr, "  -f file    Configuration file (default %s)\n", _PATH_SERVER_CONFIG_FILE);
-	fprintf(stderr, "  -d         Debugging mode (multiple -d means more debugging)\n");
-	fprintf(stderr, "  -i         Started from inetd\n");
-	fprintf(stderr, "  -D         Do not fork into daemon mode\n");
-	fprintf(stderr, "  -t         Only test configuration file and keys\n");
-	fprintf(stderr, "  -q         Quiet (no logging)\n");
-	fprintf(stderr, "  -p port    Listen on the specified port (default: 22)\n");
-	fprintf(stderr, "  -k seconds Regenerate server key every this many seconds (default: 3600)\n");
-	fprintf(stderr, "  -g seconds Grace period for authentication (default: 600)\n");
-	fprintf(stderr, "  -b bits    Size of server RSA key (default: 768 bits)\n");
-	fprintf(stderr, "  -h file    File from which to read host key (default: %s)\n",
-	    _PATH_HOST_KEY_FILE);
-	fprintf(stderr, "  -u len     Maximum hostname length for utmp recording\n");
-	fprintf(stderr, "  -4         Use IPv4 only\n");
-	fprintf(stderr, "  -6         Use IPv6 only\n");
-	fprintf(stderr, "  -o option  Process the option as if it was read from a configuration file.\n");
-	exit(1);
-}
-
-/*
- * Main program for the daemon.
- */
-int
-main(int ac, char **av)
-{
-	extern char *optarg;
-	extern int optind;
-	int opt, sock_in = 0, sock_out = 0, newsock, j, i, fdsetsz, on = 1;
-	pid_t pid;
-	socklen_t fromlen;
-	fd_set *fdset;
-	struct sockaddr_storage from;
-	const char *remote_ip;
-	int remote_port;
-	FILE *f;
-	struct addrinfo *ai;
-	char ntop[NI_MAXHOST], strport[NI_MAXSERV];
-	int listen_sock, maxfd;
-	int startup_p[2];
-	int startups = 0;
-	Authctxt *authctxt;
-	Key *key;
-	int ret, key_used = 0;
-
-#ifdef HAVE_SECUREWARE
-	(void)set_auth_parameters(ac, av);
-#endif
-	__progname = get_progname(av[0]);
-	init_rng();
-
-	/* Save argv. Duplicate so setproctitle emulation doesn't clobber it */
-	saved_argc = ac;
-	saved_argv = av;
-	saved_argv = xmalloc(sizeof(*saved_argv) * ac);
-	for (i = 0; i < ac; i++)
-		saved_argv[i] = xstrdup(av[i]);
-
-#ifndef HAVE_SETPROCTITLE
-	/* Prepare for later setproctitle emulation */
-	compat_init_setproctitle(ac, av);
-#endif
-
-	/* Initialize configuration options to their default values. */
-	initialize_server_options(&options);
-
-	/* Parse command-line arguments. */
-	while ((opt = getopt(ac, av, "f:p:b:k:h:g:V:u:o:dDeiqtQ46")) != -1) {
-		switch (opt) {
-		case '4':
-			IPv4or6 = AF_INET;
-			break;
-		case '6':
-			IPv4or6 = AF_INET6;
-			break;
-		case 'f':
-			config_file_name = optarg;
-			break;
-		case 'd':
-			if (0 == debug_flag) {
-				debug_flag = 1;
-				options.log_level = SYSLOG_LEVEL_DEBUG1;
-			} else if (options.log_level < SYSLOG_LEVEL_DEBUG3) {
-				options.log_level++;
-			} else {
-				fprintf(stderr, "Too high debugging level.\n");
-				exit(1);
-			}
-			break;
-		case 'D':
-			no_daemon_flag = 1;
-			break;
-		case 'e':
-			log_stderr = 1;
-			break;
-		case 'i':
-			inetd_flag = 1;
-			break;
-		case 'Q':
-			/* ignored */
-			break;
-		case 'q':
-			options.log_level = SYSLOG_LEVEL_QUIET;
-			break;
-		case 'b':
-			options.server_key_bits = atoi(optarg);
-			break;
-		case 'p':
-			options.ports_from_cmdline = 1;
-			if (options.num_ports >= MAX_PORTS) {
-				fprintf(stderr, "too many ports.\n");
-				exit(1);
-			}
-			options.ports[options.num_ports++] = a2port(optarg);
-			if (options.ports[options.num_ports-1] == 0) {
-				fprintf(stderr, "Bad port number.\n");
-				exit(1);
-			}
-			break;
-		case 'g':
-			if ((options.login_grace_time = convtime(optarg)) == -1) {
-				fprintf(stderr, "Invalid login grace time.\n");
-				exit(1);
-			}
-			break;
-		case 'k':
-			if ((options.key_regeneration_time = convtime(optarg)) == -1) {
-				fprintf(stderr, "Invalid key regeneration interval.\n");
-				exit(1);
-			}
-			break;
-		case 'h':
-			if (options.num_host_key_files >= MAX_HOSTKEYS) {
-				fprintf(stderr, "too many host keys.\n");
-				exit(1);
-			}
-			options.host_key_files[options.num_host_key_files++] = optarg;
-			break;
-		case 'V':
-			client_version_string = optarg;
-			/* only makes sense with inetd_flag, i.e. no listen() */
-			inetd_flag = 1;
-			break;
-		case 't':
-			test_flag = 1;
-			break;
-		case 'u':
-			utmp_len = atoi(optarg);
-			if (utmp_len > MAXHOSTNAMELEN) {
-				fprintf(stderr, "Invalid utmp length.\n");
-				exit(1);
-			}
-			break;
-		case 'o':
-			if (process_server_config_line(&options, optarg,
-			    "command-line", 0) != 0)
-				exit(1);
-			break;
-		case '?':
-		default:
-			usage();
-			break;
-		}
-	}
-	SSLeay_add_all_algorithms();
-	channel_set_af(IPv4or6);
-
-	/*
-	 * Force logging to stderr until we have loaded the private host
-	 * key (unless started from inetd)
-	 */
-	log_init(__progname,
-	    options.log_level == SYSLOG_LEVEL_NOT_SET ?
-	    SYSLOG_LEVEL_INFO : options.log_level,
-	    options.log_facility == SYSLOG_FACILITY_NOT_SET ?
-	    SYSLOG_FACILITY_AUTH : options.log_facility,
-	    log_stderr || !inetd_flag);
-
-#ifdef _UNICOS
-	/* Cray can define user privs drop all prives now!
-	 * Not needed on PRIV_SU systems!
-	 */
-	drop_cray_privs();
-#endif
-
-	seed_rng();
-
-	/* Read server configuration options from the configuration file. */
-	read_server_config(&options, config_file_name);
-
-	/* Fill in default values for those options not explicitly set. */
-	fill_default_server_options(&options);
-
-	/* Check that there are no remaining arguments. */
-	if (optind < ac) {
-		fprintf(stderr, "Extra argument %s.\n", av[optind]);
-		exit(1);
-	}
-
-	debug("sshd version %.100s", SSH_VERSION);
-
-	/* load private host keys */
-	sensitive_data.host_keys = xmalloc(options.num_host_key_files *
-	    sizeof(Key *));
-	for (i = 0; i < options.num_host_key_files; i++)
-		sensitive_data.host_keys[i] = NULL;
-	sensitive_data.server_key = NULL;
-	sensitive_data.ssh1_host_key = NULL;
-	sensitive_data.have_ssh1_key = 0;
-	sensitive_data.have_ssh2_key = 0;
-
-	for (i = 0; i < options.num_host_key_files; i++) {
-		key = key_load_private(options.host_key_files[i], "", NULL);
-		sensitive_data.host_keys[i] = key;
-		if (key == NULL) {
-			error("Could not load host key: %s",
-			    options.host_key_files[i]);
-			sensitive_data.host_keys[i] = NULL;
-			continue;
-		}
-		switch (key->type) {
-		case KEY_RSA1:
-			sensitive_data.ssh1_host_key = key;
-			sensitive_data.have_ssh1_key = 1;
-			break;
-		case KEY_RSA:
-		case KEY_DSA:
-			sensitive_data.have_ssh2_key = 1;
-			break;
-		}
-		debug("private host key: #%d type %d %s", i, key->type,
-		    key_type(key));
-	}
-	if ((options.protocol & SSH_PROTO_1) && !sensitive_data.have_ssh1_key) {
-		log("Disabling protocol version 1. Could not load host key");
-		options.protocol &= ~SSH_PROTO_1;
-	}
-	if ((options.protocol & SSH_PROTO_2) && !sensitive_data.have_ssh2_key) {
-		log("Disabling protocol version 2. Could not load host key");
-		options.protocol &= ~SSH_PROTO_2;
-	}
-	if (!(options.protocol & (SSH_PROTO_1|SSH_PROTO_2))) {
-		log("sshd: no hostkeys available -- exiting.");
-		exit(1);
-	}
-
-	/* Check certain values for sanity. */
-	if (options.protocol & SSH_PROTO_1) {
-		if (options.server_key_bits < 512 ||
-		    options.server_key_bits > 32768) {
-			fprintf(stderr, "Bad server key size.\n");
-			exit(1);
-		}
-		/*
-		 * Check that server and host key lengths differ sufficiently. This
-		 * is necessary to make double encryption work with rsaref. Oh, I
-		 * hate software patents. I dont know if this can go? Niels
-		 */
-		if (options.server_key_bits >
-		    BN_num_bits(sensitive_data.ssh1_host_key->rsa->n) -
-		    SSH_KEY_BITS_RESERVED && options.server_key_bits <
-		    BN_num_bits(sensitive_data.ssh1_host_key->rsa->n) +
-		    SSH_KEY_BITS_RESERVED) {
-			options.server_key_bits =
-			    BN_num_bits(sensitive_data.ssh1_host_key->rsa->n) +
-			    SSH_KEY_BITS_RESERVED;
-			debug("Forcing server key to %d bits to make it differ from host key.",
-			    options.server_key_bits);
-		}
-	}
-
-	if (use_privsep) {
-		struct passwd *pw;
-		struct stat st;
-
-		if ((pw = getpwnam(SSH_PRIVSEP_USER)) == NULL)
-			fatal("Privilege separation user %s does not exist",
-			    SSH_PRIVSEP_USER);
-		if ((stat(_PATH_PRIVSEP_CHROOT_DIR, &st) == -1) ||
-		    (S_ISDIR(st.st_mode) == 0))
-			fatal("Missing privilege separation directory: %s",
-			    _PATH_PRIVSEP_CHROOT_DIR);
-
-#ifdef HAVE_CYGWIN
-		if (check_ntsec(_PATH_PRIVSEP_CHROOT_DIR) &&
-		    (st.st_uid != getuid () ||
-		    (st.st_mode & (S_IWGRP|S_IWOTH)) != 0))
-#else
-		if (st.st_uid != 0 || (st.st_mode & (S_IWGRP|S_IWOTH)) != 0)
-#endif
-			fatal("%s must be owned by root and not group or "
-			    "world-writable.", _PATH_PRIVSEP_CHROOT_DIR);
-	}
-
-	/* Configuration looks good, so exit if in test mode. */
-	if (test_flag)
-		exit(0);
-
-	/*
-	 * Clear out any supplemental groups we may have inherited.  This
-	 * prevents inadvertent creation of files with bad modes (in the
-	 * portable version at least, it's certainly possible for PAM 
-	 * to create a file, and we can't control the code in every 
-	 * module which might be used).
-	 */
-	if (setgroups(0, NULL) < 0)
-		debug("setgroups() failed: %.200s", strerror(errno));
-
-	/* Initialize the log (it is reinitialized below in case we forked). */
-	if (debug_flag && !inetd_flag)
-		log_stderr = 1;
-	log_init(__progname, options.log_level, options.log_facility, log_stderr);
-
-	/*
-	 * If not in debugging mode, and not started from inetd, disconnect
-	 * from the controlling terminal, and fork.  The original process
-	 * exits.
-	 */
-	if (!(debug_flag || inetd_flag || no_daemon_flag)) {
-#ifdef TIOCNOTTY
-		int fd;
-#endif /* TIOCNOTTY */
-		if (daemon(0, 0) < 0)
-			fatal("daemon() failed: %.200s", strerror(errno));
-
-		/* Disconnect from the controlling tty. */
-#ifdef TIOCNOTTY
-		fd = open(_PATH_TTY, O_RDWR | O_NOCTTY);
-		if (fd >= 0) {
-			(void) ioctl(fd, TIOCNOTTY, NULL);
-			close(fd);
-		}
-#endif /* TIOCNOTTY */
-	}
-	/* Reinitialize the log (because of the fork above). */
-	log_init(__progname, options.log_level, options.log_facility, log_stderr);
-
-	/* Initialize the random number generator. */
-	arc4random_stir();
-
-	/* Chdir to the root directory so that the current disk can be
-	   unmounted if desired. */
-	chdir("/");
-
-	/* ignore SIGPIPE */
-	signal(SIGPIPE, SIG_IGN);
-
-	/* Start listening for a socket, unless started from inetd. */
-	if (inetd_flag) {
-		int s1;
-		s1 = dup(0);	/* Make sure descriptors 0, 1, and 2 are in use. */
-		dup(s1);
-		sock_in = dup(0);
-		sock_out = dup(1);
-		startup_pipe = -1;
-		/*
-		 * We intentionally do not close the descriptors 0, 1, and 2
-		 * as our code for setting the descriptors won\'t work if
-		 * ttyfd happens to be one of those.
-		 */
-		debug("inetd sockets after dupping: %d, %d", sock_in, sock_out);
-		if (options.protocol & SSH_PROTO_1)
-			generate_ephemeral_server_key();
-	} else {
-		for (ai = options.listen_addrs; ai; ai = ai->ai_next) {
-			if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
-				continue;
-			if (num_listen_socks >= MAX_LISTEN_SOCKS)
-				fatal("Too many listen sockets. "
-				    "Enlarge MAX_LISTEN_SOCKS");
-			if (getnameinfo(ai->ai_addr, ai->ai_addrlen,
-			    ntop, sizeof(ntop), strport, sizeof(strport),
-			    NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
-				error("getnameinfo failed");
-				continue;
-			}
-			/* Create socket for listening. */
-			listen_sock = socket(ai->ai_family, SOCK_STREAM, 0);
-			if (listen_sock < 0) {
-				/* kernel may not support ipv6 */
-				verbose("socket: %.100s", strerror(errno));
-				continue;
-			}
-			if (fcntl(listen_sock, F_SETFL, O_NONBLOCK) < 0) {
-				error("listen_sock O_NONBLOCK: %s", strerror(errno));
-				close(listen_sock);
-				continue;
-			}
-			/*
-			 * Set socket options.
-			 * Allow local port reuse in TIME_WAIT.
-			 */
-			if (setsockopt(listen_sock, SOL_SOCKET, SO_REUSEADDR,
-			    &on, sizeof(on)) == -1)
-				error("setsockopt SO_REUSEADDR: %s", strerror(errno));
-
-			debug("Bind to port %s on %s.", strport, ntop);
-
-			/* Bind the socket to the desired port. */
-			if (bind(listen_sock, ai->ai_addr, ai->ai_addrlen) < 0) {
-				if (!ai->ai_next)
-				    error("Bind to port %s on %s failed: %.200s.",
-					    strport, ntop, strerror(errno));
-				close(listen_sock);
-				continue;
-			}
-			listen_socks[num_listen_socks] = listen_sock;
-			num_listen_socks++;
-
-			/* Start listening on the port. */
-			log("Server listening on %s port %s.", ntop, strport);
-			if (listen(listen_sock, 5) < 0)
-				fatal("listen: %.100s", strerror(errno));
-
-		}
-		freeaddrinfo(options.listen_addrs);
-
-		if (!num_listen_socks)
-			fatal("Cannot bind any address.");
-
-		if (options.protocol & SSH_PROTO_1)
-			generate_ephemeral_server_key();
-
-		/*
-		 * Arrange to restart on SIGHUP.  The handler needs
-		 * listen_sock.
-		 */
-		signal(SIGHUP, sighup_handler);
-
-		signal(SIGTERM, sigterm_handler);
-		signal(SIGQUIT, sigterm_handler);
-
-		/* Arrange SIGCHLD to be caught. */
-		signal(SIGCHLD, main_sigchld_handler);
-
-		/* Write out the pid file after the sigterm handler is setup */
-		if (!debug_flag) {
-			/*
-			 * Record our pid in /var/run/sshd.pid to make it
-			 * easier to kill the correct sshd.  We don't want to
-			 * do this before the bind above because the bind will
-			 * fail if there already is a daemon, and this will
-			 * overwrite any old pid in the file.
-			 */
-			f = fopen(options.pid_file, "wb");
-			if (f) {
-				fprintf(f, "%ld\n", (long) getpid());
-				fclose(f);
-			}
-		}
-
-		/* setup fd set for listen */
-		fdset = NULL;
-		maxfd = 0;
-		for (i = 0; i < num_listen_socks; i++)
-			if (listen_socks[i] > maxfd)
-				maxfd = listen_socks[i];
-		/* pipes connected to unauthenticated childs */
-		startup_pipes = xmalloc(options.max_startups * sizeof(int));
-		for (i = 0; i < options.max_startups; i++)
-			startup_pipes[i] = -1;
-
-		/*
-		 * Stay listening for connections until the system crashes or
-		 * the daemon is killed with a signal.
-		 */
-		for (;;) {
-			if (received_sighup)
-				sighup_restart();
-			if (fdset != NULL)
-				xfree(fdset);
-			fdsetsz = howmany(maxfd+1, NFDBITS) * sizeof(fd_mask);
-			fdset = (fd_set *)xmalloc(fdsetsz);
-			memset(fdset, 0, fdsetsz);
-
-			for (i = 0; i < num_listen_socks; i++)
-				FD_SET(listen_socks[i], fdset);
-			for (i = 0; i < options.max_startups; i++)
-				if (startup_pipes[i] != -1)
-					FD_SET(startup_pipes[i], fdset);
-
-			/* Wait in select until there is a connection. */
-			ret = select(maxfd+1, fdset, NULL, NULL, NULL);
-			if (ret < 0 && errno != EINTR)
-				error("select: %.100s", strerror(errno));
-			if (received_sigterm) {
-				log("Received signal %d; terminating.",
-				    (int) received_sigterm);
-				close_listen_socks();
-				unlink(options.pid_file);
-				exit(255);
-			}
-			if (key_used && key_do_regen) {
-				generate_ephemeral_server_key();
-				key_used = 0;
-				key_do_regen = 0;
-			}
-			if (ret < 0)
-				continue;
-
-			for (i = 0; i < options.max_startups; i++)
-				if (startup_pipes[i] != -1 &&
-				    FD_ISSET(startup_pipes[i], fdset)) {
-					/*
-					 * the read end of the pipe is ready
-					 * if the child has closed the pipe
-					 * after successful authentication
-					 * or if the child has died
-					 */
-					close(startup_pipes[i]);
-					startup_pipes[i] = -1;
-					startups--;
-				}
-			for (i = 0; i < num_listen_socks; i++) {
-				if (!FD_ISSET(listen_socks[i], fdset))
-					continue;
-				fromlen = sizeof(from);
-				newsock = accept(listen_socks[i], (struct sockaddr *)&from,
-				    &fromlen);
-				if (newsock < 0) {
-					if (errno != EINTR && errno != EWOULDBLOCK)
-						error("accept: %.100s", strerror(errno));
-					continue;
-				}
-				if (fcntl(newsock, F_SETFL, 0) < 0) {
-					error("newsock del O_NONBLOCK: %s", strerror(errno));
-					close(newsock);
-					continue;
-				}
-				if (drop_connection(startups) == 1) {
-					debug("drop connection #%d", startups);
-					close(newsock);
-					continue;
-				}
-				if (pipe(startup_p) == -1) {
-					close(newsock);
-					continue;
-				}
-
-				for (j = 0; j < options.max_startups; j++)
-					if (startup_pipes[j] == -1) {
-						startup_pipes[j] = startup_p[0];
-						if (maxfd < startup_p[0])
-							maxfd = startup_p[0];
-						startups++;
-						break;
-					}
-
-				/*
-				 * Got connection.  Fork a child to handle it, unless
-				 * we are in debugging mode.
-				 */
-				if (debug_flag) {
-					/*
-					 * In debugging mode.  Close the listening
-					 * socket, and start processing the
-					 * connection without forking.
-					 */
-					debug("Server will not fork when running in debugging mode.");
-					close_listen_socks();
-					sock_in = newsock;
-					sock_out = newsock;
-					startup_pipe = -1;
-					pid = getpid();
-					break;
-				} else {
-					/*
-					 * Normal production daemon.  Fork, and have
-					 * the child process the connection. The
-					 * parent continues listening.
-					 */
-					if ((pid = fork()) == 0) {
-						/*
-						 * Child.  Close the listening and max_startup
-						 * sockets.  Start using the accepted socket.
-						 * Reinitialize logging (since our pid has
-						 * changed).  We break out of the loop to handle
-						 * the connection.
-						 */
-						startup_pipe = startup_p[1];
-						close_startup_pipes();
-						close_listen_socks();
-						sock_in = newsock;
-						sock_out = newsock;
-						log_init(__progname, options.log_level, options.log_facility, log_stderr);
-						break;
-					}
-				}
-
-				/* Parent.  Stay in the loop. */
-				if (pid < 0)
-					error("fork: %.100s", strerror(errno));
-				else
-					debug("Forked child %ld.", (long)pid);
-
-				close(startup_p[1]);
-
-				/* Mark that the key has been used (it was "given" to the child). */
-				if ((options.protocol & SSH_PROTO_1) &&
-				    key_used == 0) {
-					/* Schedule server key regeneration alarm. */
-					signal(SIGALRM, key_regeneration_alarm);
-					alarm(options.key_regeneration_time);
-					key_used = 1;
-				}
-
-				arc4random_stir();
-
-				/* Close the new socket (the child is now taking care of it). */
-				close(newsock);
-			}
-			/* child process check (or debug mode) */
-			if (num_listen_socks < 0)
-				break;
-		}
-	}
-
-	/* This is the child processing a new connection. */
-
-	/*
-	 * Create a new session and process group since the 4.4BSD
-	 * setlogin() affects the entire process group.  We don't
-	 * want the child to be able to affect the parent.
-	 */
-#if !defined(STREAMS_PUSH_ACQUIRES_CTTY)
-	/*
-	 * If setsid is called on Solaris, sshd will acquire the controlling
-	 * terminal while pushing STREAMS modules. This will prevent the
-	 * shell from acquiring it later.
-	 */
-	if (!debug_flag && !inetd_flag && setsid() < 0)
-		error("setsid: %.100s", strerror(errno));
-#endif
-
-	/*
-	 * Disable the key regeneration alarm.  We will not regenerate the
-	 * key since we are no longer in a position to give it to anyone. We
-	 * will not restart on SIGHUP since it no longer makes sense.
-	 */
-	alarm(0);
-	signal(SIGALRM, SIG_DFL);
-	signal(SIGHUP, SIG_DFL);
-	signal(SIGTERM, SIG_DFL);
-	signal(SIGQUIT, SIG_DFL);
-	signal(SIGCHLD, SIG_DFL);
-	signal(SIGINT, SIG_DFL);
-
-	/* Set keepalives if requested. */
-	if (options.keepalives &&
-	    setsockopt(sock_in, SOL_SOCKET, SO_KEEPALIVE, &on,
-	    sizeof(on)) < 0)
-		error("setsockopt SO_KEEPALIVE: %.100s", strerror(errno));
-
-	/*
-	 * Register our connection.  This turns encryption off because we do
-	 * not have a key.
-	 */
-	packet_set_connection(sock_in, sock_out);
-
-	remote_port = get_remote_port();
-	remote_ip = get_remote_ipaddr();
-
-#ifdef LIBWRAP
-	/* Check whether logins are denied from this host. */
-	{
-		struct request_info req;
-
-		request_init(&req, RQ_DAEMON, __progname, RQ_FILE, sock_in, 0);
-		fromhost(&req);
-
-		if (!hosts_access(&req)) {
-			debug("Connection refused by tcp wrapper");
-			refuse(&req);
-			/* NOTREACHED */
-			fatal("libwrap refuse returns");
-		}
-	}
-#endif /* LIBWRAP */
-
-	/* Log the connection. */
-	verbose("Connection from %.500s port %d", remote_ip, remote_port);
-
-	/*
-	 * We don\'t want to listen forever unless the other side
-	 * successfully authenticates itself.  So we set up an alarm which is
-	 * cleared after successful authentication.  A limit of zero
-	 * indicates no limit. Note that we don\'t set the alarm in debugging
-	 * mode; it is just annoying to have the server exit just when you
-	 * are about to discover the bug.
-	 */
-	signal(SIGALRM, grace_alarm_handler);
-	if (!debug_flag)
-		alarm(options.login_grace_time);
-
-	sshd_exchange_identification(sock_in, sock_out);
-	/*
-	 * Check that the connection comes from a privileged port.
-	 * Rhosts-Authentication only makes sense from privileged
-	 * programs.  Of course, if the intruder has root access on his local
-	 * machine, he can connect from any port.  So do not use these
-	 * authentication methods from machines that you do not trust.
-	 */
-	if (options.rhosts_authentication &&
-	    (remote_port >= IPPORT_RESERVED ||
-	    remote_port < IPPORT_RESERVED / 2)) {
-		debug("Rhosts Authentication disabled, "
-		    "originating port %d not trusted.", remote_port);
-		options.rhosts_authentication = 0;
-	}
-#if defined(KRB4) && !defined(KRB5)
-	if (!packet_connection_is_ipv4() &&
-	    options.kerberos_authentication) {
-		debug("Kerberos Authentication disabled, only available for IPv4.");
-		options.kerberos_authentication = 0;
-	}
-#endif /* KRB4 && !KRB5 */
-#ifdef AFS
-	/* If machine has AFS, set process authentication group. */
-	if (k_hasafs()) {
-		k_setpag();
-		k_unlog();
-	}
-#endif /* AFS */
-
-	packet_set_nonblocking();
-
-	if (use_privsep)
-		if ((authctxt = privsep_preauth()) != NULL)
-			goto authenticated;
-
-	/* perform the key exchange */
-	/* authenticate user and start session */
-	if (compat20) {
-		do_ssh2_kex();
-		authctxt = do_authentication2();
-	} else {
-		do_ssh1_kex();
-		authctxt = do_authentication();
-	}
-	/*
-	 * If we use privilege separation, the unprivileged child transfers
-	 * the current keystate and exits
-	 */
-	if (use_privsep) {
-		mm_send_keystate(pmonitor);
-		exit(0);
-	}
-
- authenticated:
-	/*
-	 * In privilege separation, we fork another child and prepare
-	 * file descriptor passing.
-	 */
-	if (use_privsep) {
-		privsep_postauth(authctxt);
-		/* the monitor process [priv] will not return */
-		if (!compat20)
-			destroy_sensitive_data();
-	}
-
-	/* Perform session preparation. */
-	do_authenticated(authctxt);
-
-	/* The connection has been terminated. */
-	verbose("Closing connection to %.100s", remote_ip);
-
-#ifdef USE_PAM
-	finish_pam();
-#endif /* USE_PAM */
-
-	packet_close();
-
-	if (use_privsep)
-		mm_terminate();
-
-	exit(0);
-}
-
-/*
- * Decrypt session_key_int using our private server key and private host key
- * (key with larger modulus first).
- */
-int
-ssh1_session_key(BIGNUM *session_key_int)
-{
-	int rsafail = 0;
-
-	if (BN_cmp(sensitive_data.server_key->rsa->n, sensitive_data.ssh1_host_key->rsa->n) > 0) {
-		/* Server key has bigger modulus. */
-		if (BN_num_bits(sensitive_data.server_key->rsa->n) <
-		    BN_num_bits(sensitive_data.ssh1_host_key->rsa->n) + SSH_KEY_BITS_RESERVED) {
-			fatal("do_connection: %s: server_key %d < host_key %d + SSH_KEY_BITS_RESERVED %d",
-			    get_remote_ipaddr(),
-			    BN_num_bits(sensitive_data.server_key->rsa->n),
-			    BN_num_bits(sensitive_data.ssh1_host_key->rsa->n),
-			    SSH_KEY_BITS_RESERVED);
-		}
-		if (rsa_private_decrypt(session_key_int, session_key_int,
-		    sensitive_data.server_key->rsa) <= 0)
-			rsafail++;
-		if (rsa_private_decrypt(session_key_int, session_key_int,
-		    sensitive_data.ssh1_host_key->rsa) <= 0)
-			rsafail++;
-	} else {
-		/* Host key has bigger modulus (or they are equal). */
-		if (BN_num_bits(sensitive_data.ssh1_host_key->rsa->n) <
-		    BN_num_bits(sensitive_data.server_key->rsa->n) + SSH_KEY_BITS_RESERVED) {
-			fatal("do_connection: %s: host_key %d < server_key %d + SSH_KEY_BITS_RESERVED %d",
-			    get_remote_ipaddr(),
-			    BN_num_bits(sensitive_data.ssh1_host_key->rsa->n),
-			    BN_num_bits(sensitive_data.server_key->rsa->n),
-			    SSH_KEY_BITS_RESERVED);
-		}
-		if (rsa_private_decrypt(session_key_int, session_key_int,
-		    sensitive_data.ssh1_host_key->rsa) < 0)
-			rsafail++;
-		if (rsa_private_decrypt(session_key_int, session_key_int,
-		    sensitive_data.server_key->rsa) < 0)
-			rsafail++;
-	}
-	return (rsafail);
-}
-/*
- * SSH1 key exchange
- */
-static void
-do_ssh1_kex(void)
-{
-	int i, len;
-	int rsafail = 0;
-	BIGNUM *session_key_int;
-	u_char session_key[SSH_SESSION_KEY_LENGTH];
-	u_char cookie[8];
-	u_int cipher_type, auth_mask, protocol_flags;
-	u_int32_t rnd = 0;
-
-	/*
-	 * Generate check bytes that the client must send back in the user
-	 * packet in order for it to be accepted; this is used to defy ip
-	 * spoofing attacks.  Note that this only works against somebody
-	 * doing IP spoofing from a remote machine; any machine on the local
-	 * network can still see outgoing packets and catch the random
-	 * cookie.  This only affects rhosts authentication, and this is one
-	 * of the reasons why it is inherently insecure.
-	 */
-	for (i = 0; i < 8; i++) {
-		if (i % 4 == 0)
-			rnd = arc4random();
-		cookie[i] = rnd & 0xff;
-		rnd >>= 8;
-	}
-
-	/*
-	 * Send our public key.  We include in the packet 64 bits of random
-	 * data that must be matched in the reply in order to prevent IP
-	 * spoofing.
-	 */
-	packet_start(SSH_SMSG_PUBLIC_KEY);
-	for (i = 0; i < 8; i++)
-		packet_put_char(cookie[i]);
-
-	/* Store our public server RSA key. */
-	packet_put_int(BN_num_bits(sensitive_data.server_key->rsa->n));
-	packet_put_bignum(sensitive_data.server_key->rsa->e);
-	packet_put_bignum(sensitive_data.server_key->rsa->n);
-
-	/* Store our public host RSA key. */
-	packet_put_int(BN_num_bits(sensitive_data.ssh1_host_key->rsa->n));
-	packet_put_bignum(sensitive_data.ssh1_host_key->rsa->e);
-	packet_put_bignum(sensitive_data.ssh1_host_key->rsa->n);
-
-	/* Put protocol flags. */
-	packet_put_int(SSH_PROTOFLAG_HOST_IN_FWD_OPEN);
-
-	/* Declare which ciphers we support. */
-	packet_put_int(cipher_mask_ssh1(0));
-
-	/* Declare supported authentication types. */
-	auth_mask = 0;
-	if (options.rhosts_authentication)
-		auth_mask |= 1 << SSH_AUTH_RHOSTS;
-	if (options.rhosts_rsa_authentication)
-		auth_mask |= 1 << SSH_AUTH_RHOSTS_RSA;
-	if (options.rsa_authentication)
-		auth_mask |= 1 << SSH_AUTH_RSA;
-#if defined(KRB4) || defined(KRB5)
-	if (options.kerberos_authentication)
-		auth_mask |= 1 << SSH_AUTH_KERBEROS;
-#endif
-#if defined(AFS) || defined(KRB5)
-	if (options.kerberos_tgt_passing)
-		auth_mask |= 1 << SSH_PASS_KERBEROS_TGT;
-#endif
-#ifdef AFS
-	if (options.afs_token_passing)
-		auth_mask |= 1 << SSH_PASS_AFS_TOKEN;
-#endif
-	if (options.challenge_response_authentication == 1)
-		auth_mask |= 1 << SSH_AUTH_TIS;
-	if (options.password_authentication)
-		auth_mask |= 1 << SSH_AUTH_PASSWORD;
-	packet_put_int(auth_mask);
-
-	/* Send the packet and wait for it to be sent. */
-	packet_send();
-	packet_write_wait();
-
-	debug("Sent %d bit server key and %d bit host key.",
-	    BN_num_bits(sensitive_data.server_key->rsa->n),
-	    BN_num_bits(sensitive_data.ssh1_host_key->rsa->n));
-
-	/* Read clients reply (cipher type and session key). */
-	packet_read_expect(SSH_CMSG_SESSION_KEY);
-
-	/* Get cipher type and check whether we accept this. */
-	cipher_type = packet_get_char();
-
-	if (!(cipher_mask_ssh1(0) & (1 << cipher_type)))
-		packet_disconnect("Warning: client selects unsupported cipher.");
-
-	/* Get check bytes from the packet.  These must match those we
-	   sent earlier with the public key packet. */
-	for (i = 0; i < 8; i++)
-		if (cookie[i] != packet_get_char())
-			packet_disconnect("IP Spoofing check bytes do not match.");
-
-	debug("Encryption type: %.200s", cipher_name(cipher_type));
-
-	/* Get the encrypted integer. */
-	if ((session_key_int = BN_new()) == NULL)
-		fatal("do_ssh1_kex: BN_new failed");
-	packet_get_bignum(session_key_int);
-
-	protocol_flags = packet_get_int();
-	packet_set_protocol_flags(protocol_flags);
-	packet_check_eom();
-
-	/* Decrypt session_key_int using host/server keys */
-	rsafail = PRIVSEP(ssh1_session_key(session_key_int));
-
-	/*
-	 * Extract session key from the decrypted integer.  The key is in the
-	 * least significant 256 bits of the integer; the first byte of the
-	 * key is in the highest bits.
-	 */
-	if (!rsafail) {
-		BN_mask_bits(session_key_int, sizeof(session_key) * 8);
-		len = BN_num_bytes(session_key_int);
-		if (len < 0 || len > sizeof(session_key)) {
-			error("do_connection: bad session key len from %s: "
-			    "session_key_int %d > sizeof(session_key) %lu",
-			    get_remote_ipaddr(), len, (u_long)sizeof(session_key));
-			rsafail++;
-		} else {
-			memset(session_key, 0, sizeof(session_key));
-			BN_bn2bin(session_key_int,
-			    session_key + sizeof(session_key) - len);
-
-			compute_session_id(session_id, cookie,
-			    sensitive_data.ssh1_host_key->rsa->n,
-			    sensitive_data.server_key->rsa->n);
-			/*
-			 * Xor the first 16 bytes of the session key with the
-			 * session id.
-			 */
-			for (i = 0; i < 16; i++)
-				session_key[i] ^= session_id[i];
-		}
-	}
-	if (rsafail) {
-		int bytes = BN_num_bytes(session_key_int);
-		u_char *buf = xmalloc(bytes);
-		MD5_CTX md;
-
-		log("do_connection: generating a fake encryption key");
-		BN_bn2bin(session_key_int, buf);
-		MD5_Init(&md);
-		MD5_Update(&md, buf, bytes);
-		MD5_Update(&md, sensitive_data.ssh1_cookie, SSH_SESSION_KEY_LENGTH);
-		MD5_Final(session_key, &md);
-		MD5_Init(&md);
-		MD5_Update(&md, session_key, 16);
-		MD5_Update(&md, buf, bytes);
-		MD5_Update(&md, sensitive_data.ssh1_cookie, SSH_SESSION_KEY_LENGTH);
-		MD5_Final(session_key + 16, &md);
-		memset(buf, 0, bytes);
-		xfree(buf);
-		for (i = 0; i < 16; i++)
-			session_id[i] = session_key[i] ^ session_key[i + 16];
-	}
-	/* Destroy the private and public keys. No longer. */
-	destroy_sensitive_data();
-
-	if (use_privsep)
-		mm_ssh1_session_id(session_id);
-
-	/* Destroy the decrypted integer.  It is no longer needed. */
-	BN_clear_free(session_key_int);
-
-	/* Set the session key.  From this on all communications will be encrypted. */
-	packet_set_encryption_key(session_key, SSH_SESSION_KEY_LENGTH, cipher_type);
-
-	/* Destroy our copy of the session key.  It is no longer needed. */
-	memset(session_key, 0, sizeof(session_key));
-
-	debug("Received session key; encryption turned on.");
-
-	/* Send an acknowledgment packet.  Note that this packet is sent encrypted. */
-	packet_start(SSH_SMSG_SUCCESS);
-	packet_send();
-	packet_write_wait();
-}
-
-/*
- * SSH2 key exchange: diffie-hellman-group1-sha1
- */
-static void
-do_ssh2_kex(void)
-{
-	Kex *kex;
-
-	if (options.ciphers != NULL) {
-		myproposal[PROPOSAL_ENC_ALGS_CTOS] =
-		myproposal[PROPOSAL_ENC_ALGS_STOC] = options.ciphers;
-	}
-	myproposal[PROPOSAL_ENC_ALGS_CTOS] =
-	    compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_CTOS]);
-	myproposal[PROPOSAL_ENC_ALGS_STOC] =
-	    compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_STOC]);
-
-	if (options.macs != NULL) {
-		myproposal[PROPOSAL_MAC_ALGS_CTOS] =
-		myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
-	}
-	if (!options.compression) {
-		myproposal[PROPOSAL_COMP_ALGS_CTOS] =
-		myproposal[PROPOSAL_COMP_ALGS_STOC] = "none";
-	}
-	myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = list_hostkey_types();
-
-	/* start key exchange */
-	kex = kex_setup(myproposal);
-	kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server;
-	kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
-	kex->server = 1;
-	kex->client_version_string=client_version_string;
-	kex->server_version_string=server_version_string;
-	kex->load_host_key=&get_hostkey_by_type;
-	kex->host_key_index=&get_hostkey_index;
-
-	xxx_kex = kex;
-
-	dispatch_run(DISPATCH_BLOCK, &kex->done, kex);
-
-	session_id2 = kex->session_id;
-	session_id2_len = kex->session_id_len;
-
-#ifdef DEBUG_KEXDH
-	/* send 1st encrypted/maced/compressed message */
-	packet_start(SSH2_MSG_IGNORE);
-	packet_put_cstring("markus");
-	packet_send();
-	packet_write_wait();
-#endif
-	debug("KEX done");
-}
diff --git a/crypto/openssh/sshd/Makefile b/crypto/openssh/sshd/Makefile
deleted file mode 100644
index 14ef3e0717bb..000000000000
--- a/crypto/openssh/sshd/Makefile
+++ /dev/null
@@ -1,56 +0,0 @@
-#	$OpenBSD: Makefile,v 1.51 2002/06/20 19:56:07 stevesk Exp $
-
-.PATH:		${.CURDIR}/..
-
-PROG=	sshd
-BINOWN=	root
-BINMODE=555
-BINDIR=	/usr/sbin
-MAN=	sshd.8 sshd_config.5
-CFLAGS+=-DHAVE_LOGIN_CAP -DBSD_AUTH
-
-SRCS=	sshd.c auth-rhosts.c auth-passwd.c auth-rsa.c auth-rh-rsa.c \
-	sshpty.c sshlogin.c servconf.c serverloop.c uidswap.c \
-	auth.c auth1.c auth2.c auth-options.c session.c \
-	auth-chall.c auth2-chall.c groupaccess.c \
-	auth-skey.c auth-bsdauth.c monitor_mm.c monitor.c \
-	auth2-none.c auth2-passwd.c auth2-pubkey.c \
-	auth2-hostbased.c auth2-kbdint.c
-
-.include <bsd.own.mk> # for KERBEROS and AFS
-
-.if (${KERBEROS5:L} == "yes")
-CFLAGS+=-DKRB5 -I${DESTDIR}/usr/include/kerberosV
-SRCS+=  auth-krb5.c
-LDADD+= -lkrb5 -lkafs -lasn1 -lcom_err
-DPADD+= ${LIBKRB5} ${LIBKAFS} ${LIBASN1} ${LIBCOM_ERR}
-.endif # KERBEROS5
-
-.if (${KERBEROS:L} == "yes")
-.if (${AFS:L} == "yes")
-CFLAGS+= -DAFS
-LDADD+=  -lkafs
-DPADD+=  ${LIBKAFS}
-.endif # AFS
-CFLAGS+= -DKRB4 -I${DESTDIR}/usr/include/kerberosIV
-SRCS+=	auth-krb4.c
-LDADD+=	 -lkrb
-DPADD+=	 ${LIBKRB}
-.endif # KERBEROS
-
-.include <bsd.prog.mk>
-
-LDADD+=	-lcrypto -lutil -lz -ldes
-DPADD+=	${LIBCRYPTO} ${LIBUTIL} ${LIBZ} ${LIBDES}
-
-.if (${TCP_WRAPPERS:L} == "yes")
-CFLAGS+= -DLIBWRAP
-LDADD+= -lwrap
-DPADD+= ${LIBWRAP}
-.endif
-
-#.if (${SKEY:L} == "yes")
-#CFLAGS+= -DSKEY
-#LDADD+= -lskey
-#DPADD+= ${SKEY}
-#.endif
diff --git a/crypto/openssh/sshd_config b/crypto/openssh/sshd_config
deleted file mode 100644
index 36429c9d0c72..000000000000
--- a/crypto/openssh/sshd_config
+++ /dev/null
@@ -1,93 +0,0 @@
-#	$OpenBSD: sshd_config,v 1.59 2002/09/25 11:17:16 markus Exp $
-
-# This is the sshd server system-wide configuration file.  See
-# sshd_config(5) for more information.
-
-# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
-
-# The strategy used for options in the default sshd_config shipped with
-# OpenSSH is to specify options with their default value where
-# possible, but leave them commented.  Uncommented options change a
-# default value.
-
-#Port 22
-#Protocol 2,1
-#ListenAddress 0.0.0.0
-#ListenAddress ::
-
-# HostKey for protocol version 1
-#HostKey /etc/ssh/ssh_host_key
-# HostKeys for protocol version 2
-#HostKey /etc/ssh/ssh_host_rsa_key
-#HostKey /etc/ssh/ssh_host_dsa_key
-
-# Lifetime and size of ephemeral version 1 server key
-#KeyRegenerationInterval 3600
-#ServerKeyBits 768
-
-# Logging
-#obsoletes QuietMode and FascistLogging
-#SyslogFacility AUTH
-#LogLevel INFO
-
-# Authentication:
-
-#LoginGraceTime 120
-#PermitRootLogin yes
-#StrictModes yes
-
-#RSAAuthentication yes
-#PubkeyAuthentication yes
-#AuthorizedKeysFile	.ssh/authorized_keys
-
-# rhosts authentication should not be used
-#RhostsAuthentication no
-# Don't read the user's ~/.rhosts and ~/.shosts files
-#IgnoreRhosts yes
-# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
-#RhostsRSAAuthentication no
-# similar for protocol version 2
-#HostbasedAuthentication no
-# Change to yes if you don't trust ~/.ssh/known_hosts for
-# RhostsRSAAuthentication and HostbasedAuthentication
-#IgnoreUserKnownHosts no
-
-# To disable tunneled clear text passwords, change to no here!
-#PasswordAuthentication yes
-#PermitEmptyPasswords no
-
-# Change to no to disable s/key passwords
-#ChallengeResponseAuthentication yes
-
-# Kerberos options
-#KerberosAuthentication no
-#KerberosOrLocalPasswd yes
-#KerberosTicketCleanup yes
-
-#AFSTokenPassing no
-
-# Kerberos TGT Passing only works with the AFS kaserver
-#KerberosTgtPassing no
-
-# Set this to 'yes' to enable PAM keyboard-interactive authentication 
-# Warning: enabling this may bypass the setting of 'PasswordAuthentication'
-#PAMAuthenticationViaKbdInt no
-
-#X11Forwarding no
-#X11DisplayOffset 10
-#X11UseLocalhost yes
-#PrintMotd yes
-#PrintLastLog yes
-#KeepAlive yes
-#UseLogin no
-#UsePrivilegeSeparation yes
-#PermitUserEnvironment no
-#Compression yes
-
-#MaxStartups 10
-# no default banner path
-#Banner /some/path
-#VerifyReverseMapping no
-
-# override default of no subsystems
-Subsystem	sftp	/usr/libexec/sftp-server
diff --git a/crypto/openssh/sshd_config.5 b/crypto/openssh/sshd_config.5
deleted file mode 100644
index 6f38a260aa4e..000000000000
--- a/crypto/openssh/sshd_config.5
+++ /dev/null
@@ -1,763 +0,0 @@
-.\"  -*- nroff -*-
-.\"
-.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
-.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
-.\"                    All rights reserved
-.\"
-.\" As far as I am concerned, the code I have written for this software
-.\" can be used freely for any purpose.  Any derived versions of this
-.\" software must be clearly marked as such, and if the derived work is
-.\" incompatible with the protocol description in the RFC file, it must be
-.\" called by a name other than "ssh" or "Secure Shell".
-.\"
-.\" Copyright (c) 1999,2000 Markus Friedl.  All rights reserved.
-.\" Copyright (c) 1999 Aaron Campbell.  All rights reserved.
-.\" Copyright (c) 1999 Theo de Raadt.  All rights reserved.
-.\"
-.\" Redistribution and use in source and binary forms, with or without
-.\" modification, are permitted provided that the following conditions
-.\" are met:
-.\" 1. Redistributions of source code must retain the above copyright
-.\"    notice, this list of conditions and the following disclaimer.
-.\" 2. Redistributions in binary form must reproduce the above copyright
-.\"    notice, this list of conditions and the following disclaimer in the
-.\"    documentation and/or other materials provided with the distribution.
-.\"
-.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-.\"
-.\" $OpenBSD: sshd_config.5,v 1.15 2003/03/28 10:11:43 jmc Exp $
-.Dd September 25, 1999
-.Dt SSHD_CONFIG 5
-.Os
-.Sh NAME
-.Nm sshd_config
-.Nd OpenSSH SSH daemon configuration file
-.Sh SYNOPSIS
-.Bl -tag -width Ds -compact
-.It Pa /etc/ssh/sshd_config
-.El
-.Sh DESCRIPTION
-.Nm sshd
-reads configuration data from
-.Pa /etc/ssh/sshd_config
-(or the file specified with
-.Fl f
-on the command line).
-The file contains keyword-argument pairs, one per line.
-Lines starting with
-.Ql #
-and empty lines are interpreted as comments.
-.Pp
-The possible
-keywords and their meanings are as follows (note that
-keywords are case-insensitive and arguments are case-sensitive):
-.Bl -tag -width Ds
-.It Cm AFSTokenPassing
-Specifies whether an AFS token may be forwarded to the server.
-Default is
-.Dq no .
-.It Cm AllowGroups
-This keyword can be followed by a list of group name patterns, separated
-by spaces.
-If specified, login is allowed only for users whose primary
-group or supplementary group list matches one of the patterns.
-.Ql \&*
-and
-.Ql ?
-can be used as
-wildcards in the patterns.
-Only group names are valid; a numerical group ID is not recognized.
-By default, login is allowed for all groups.
-.Pp
-.It Cm AllowTcpForwarding
-Specifies whether TCP forwarding is permitted.
-The default is
-.Dq yes .
-Note that disabling TCP forwarding does not improve security unless
-users are also denied shell access, as they can always install their
-own forwarders.
-.Pp
-.It Cm AllowUsers
-This keyword can be followed by a list of user name patterns, separated
-by spaces.
-If specified, login is allowed only for user names that
-match one of the patterns.
-.Ql \&*
-and
-.Ql ?
-can be used as
-wildcards in the patterns.
-Only user names are valid; a numerical user ID is not recognized.
-By default, login is allowed for all users.
-If the pattern takes the form USER@HOST then USER and HOST
-are separately checked, restricting logins to particular
-users from particular hosts.
-.Pp
-.It Cm AuthorizedKeysFile
-Specifies the file that contains the public keys that can be used
-for user authentication.
-.Cm AuthorizedKeysFile
-may contain tokens of the form %T which are substituted during connection
-set-up. The following tokens are defined: %% is replaced by a literal '%',
-%h is replaced by the home directory of the user being authenticated and
-%u is replaced by the username of that user.
-After expansion,
-.Cm AuthorizedKeysFile
-is taken to be an absolute path or one relative to the user's home
-directory.
-The default is
-.Dq .ssh/authorized_keys .
-.It Cm Banner
-In some jurisdictions, sending a warning message before authentication
-may be relevant for getting legal protection.
-The contents of the specified file are sent to the remote user before
-authentication is allowed.
-This option is only available for protocol version 2.
-By default, no banner is displayed.
-.Pp
-.It Cm ChallengeResponseAuthentication
-Specifies whether challenge response authentication is allowed.
-All authentication styles from
-.Xr login.conf 5
-are supported.
-The default is
-.Dq yes .
-.It Cm Ciphers
-Specifies the ciphers allowed for protocol version 2.
-Multiple ciphers must be comma-separated.
-The default is
-.Pp
-.Bd -literal
-  ``aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,
-    aes192-cbc,aes256-cbc''
-.Ed
-.It Cm ClientAliveInterval
-Sets a timeout interval in seconds after which if no data has been received
-from the client,
-.Nm sshd
-will send a message through the encrypted
-channel to request a response from the client.
-The default
-is 0, indicating that these messages will not be sent to the client.
-This option applies to protocol version 2 only.
-.It Cm ClientAliveCountMax
-Sets the number of client alive messages (see above) which may be
-sent without
-.Nm sshd
-receiving any messages back from the client. If this threshold is
-reached while client alive messages are being sent,
-.Nm sshd
-will disconnect the client, terminating the session. It is important
-to note that the use of client alive messages is very different from
-.Cm KeepAlive
-(below). The client alive messages are sent through the
-encrypted channel and therefore will not be spoofable. The TCP keepalive
-option enabled by
-.Cm KeepAlive
-is spoofable. The client alive mechanism is valuable when the client or
-server depend on knowing when a connection has become inactive.
-.Pp
-The default value is 3. If
-.Cm ClientAliveInterval
-(above) is set to 15, and
-.Cm ClientAliveCountMax
-is left at the default, unresponsive ssh clients
-will be disconnected after approximately 45 seconds.
-.It Cm Compression
-Specifies whether compression is allowed.
-The argument must be
-.Dq yes
-or
-.Dq no .
-The default is
-.Dq yes .
-.It Cm DenyGroups
-This keyword can be followed by a list of group name patterns, separated
-by spaces.
-Login is disallowed for users whose primary group or supplementary
-group list matches one of the patterns.
-.Ql \&*
-and
-.Ql ?
-can be used as
-wildcards in the patterns.
-Only group names are valid; a numerical group ID is not recognized.
-By default, login is allowed for all groups.
-.Pp
-.It Cm DenyUsers
-This keyword can be followed by a list of user name patterns, separated
-by spaces.
-Login is disallowed for user names that match one of the patterns.
-.Ql \&*
-and
-.Ql ?
-can be used as wildcards in the patterns.
-Only user names are valid; a numerical user ID is not recognized.
-By default, login is allowed for all users.
-If the pattern takes the form USER@HOST then USER and HOST
-are separately checked, restricting logins to particular
-users from particular hosts.
-.It Cm GatewayPorts
-Specifies whether remote hosts are allowed to connect to ports
-forwarded for the client.
-By default,
-.Nm sshd
-binds remote port forwardings to the loopback address.
-This prevents other remote hosts from connecting to forwarded ports.
-.Cm GatewayPorts
-can be used to specify that
-.Nm sshd
-should bind remote port forwardings to the wildcard address,
-thus allowing remote hosts to connect to forwarded ports.
-The argument must be
-.Dq yes
-or
-.Dq no .
-The default is
-.Dq no .
-.It Cm HostbasedAuthentication
-Specifies whether rhosts or /etc/hosts.equiv authentication together
-with successful public key client host authentication is allowed
-(hostbased authentication).
-This option is similar to
-.Cm RhostsRSAAuthentication
-and applies to protocol version 2 only.
-The default is
-.Dq no .
-.It Cm HostKey
-Specifies a file containing a private host key
-used by SSH.
-The default is
-.Pa /etc/ssh/ssh_host_key
-for protocol version 1, and
-.Pa /etc/ssh/ssh_host_rsa_key
-and
-.Pa /etc/ssh/ssh_host_dsa_key
-for protocol version 2.
-Note that
-.Nm sshd
-will refuse to use a file if it is group/world-accessible.
-It is possible to have multiple host key files.
-.Dq rsa1
-keys are used for version 1 and
-.Dq dsa
-or
-.Dq rsa
-are used for version 2 of the SSH protocol.
-.It Cm IgnoreRhosts
-Specifies that
-.Pa .rhosts
-and
-.Pa .shosts
-files will not be used in
-.Cm RhostsAuthentication ,
-.Cm RhostsRSAAuthentication
-or
-.Cm HostbasedAuthentication .
-.Pp
-.Pa /etc/hosts.equiv
-and
-.Pa /etc/shosts.equiv
-are still used.
-The default is
-.Dq yes .
-.It Cm IgnoreUserKnownHosts
-Specifies whether
-.Nm sshd
-should ignore the user's
-.Pa $HOME/.ssh/known_hosts
-during
-.Cm RhostsRSAAuthentication
-or
-.Cm HostbasedAuthentication .
-The default is
-.Dq no .
-.It Cm KeepAlive
-Specifies whether the system should send TCP keepalive messages to the
-other side.
-If they are sent, death of the connection or crash of one
-of the machines will be properly noticed.
-However, this means that
-connections will die if the route is down temporarily, and some people
-find it annoying.
-On the other hand, if keepalives are not sent,
-sessions may hang indefinitely on the server, leaving
-.Dq ghost
-users and consuming server resources.
-.Pp
-The default is
-.Dq yes
-(to send keepalives), and the server will notice
-if the network goes down or the client host crashes.
-This avoids infinitely hanging sessions.
-.Pp
-To disable keepalives, the value should be set to
-.Dq no .
-.It Cm KerberosAuthentication
-Specifies whether Kerberos authentication is allowed.
-This can be in the form of a Kerberos ticket, or if
-.Cm PasswordAuthentication
-is yes, the password provided by the user will be validated through
-the Kerberos KDC.
-To use this option, the server needs a
-Kerberos servtab which allows the verification of the KDC's identity.
-Default is
-.Dq no .
-.It Cm KerberosOrLocalPasswd
-If set then if password authentication through Kerberos fails then
-the password will be validated via any additional local mechanism
-such as
-.Pa /etc/passwd .
-Default is
-.Dq yes .
-.It Cm KerberosTgtPassing
-Specifies whether a Kerberos TGT may be forwarded to the server.
-Default is
-.Dq no ,
-as this only works when the Kerberos KDC is actually an AFS kaserver.
-.It Cm KerberosTicketCleanup
-Specifies whether to automatically destroy the user's ticket cache
-file on logout.
-Default is
-.Dq yes .
-.It Cm KeyRegenerationInterval
-In protocol version 1, the ephemeral server key is automatically regenerated
-after this many seconds (if it has been used).
-The purpose of regeneration is to prevent
-decrypting captured sessions by later breaking into the machine and
-stealing the keys.
-The key is never stored anywhere.
-If the value is 0, the key is never regenerated.
-The default is 3600 (seconds).
-.It Cm ListenAddress
-Specifies the local addresses
-.Nm sshd
-should listen on.
-The following forms may be used:
-.Pp
-.Bl -item -offset indent -compact
-.It
-.Cm ListenAddress
-.Sm off
-.Ar host No | Ar IPv4_addr No | Ar IPv6_addr
-.Sm on
-.It
-.Cm ListenAddress
-.Sm off
-.Ar host No | Ar IPv4_addr No : Ar port
-.Sm on
-.It
-.Cm ListenAddress
-.Sm off
-.Oo
-.Ar host No | Ar IPv6_addr Oc : Ar port
-.Sm on
-.El
-.Pp
-If
-.Ar port
-is not specified,
-.Nm sshd
-will listen on the address and all prior
-.Cm Port
-options specified. The default is to listen on all local
-addresses.
-Multiple
-.Cm ListenAddress
-options are permitted. Additionally, any
-.Cm Port
-options must precede this option for non port qualified addresses.
-.It Cm LoginGraceTime
-The server disconnects after this time if the user has not
-successfully logged in.
-If the value is 0, there is no time limit.
-The default is 120 seconds.
-.It Cm LogLevel
-Gives the verbosity level that is used when logging messages from
-.Nm sshd .
-The possible values are:
-QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3.
-The default is INFO.
-DEBUG and DEBUG1 are equivalent.
-DEBUG2 and DEBUG3 each specify higher levels of debugging output.
-Logging with a DEBUG level violates the privacy of users and is not recommended.
-.It Cm MACs
-Specifies the available MAC (message authentication code) algorithms.
-The MAC algorithm is used in protocol version 2
-for data integrity protection.
-Multiple algorithms must be comma-separated.
-The default is
-.Dq hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96 .
-.It Cm MaxStartups
-Specifies the maximum number of concurrent unauthenticated connections to the
-.Nm sshd
-daemon.
-Additional connections will be dropped until authentication succeeds or the
-.Cm LoginGraceTime
-expires for a connection.
-The default is 10.
-.Pp
-Alternatively, random early drop can be enabled by specifying
-the three colon separated values
-.Dq start:rate:full
-(e.g., "10:30:60").
-.Nm sshd
-will refuse connection attempts with a probability of
-.Dq rate/100
-(30%)
-if there are currently
-.Dq start
-(10)
-unauthenticated connections.
-The probability increases linearly and all connection attempts
-are refused if the number of unauthenticated connections reaches
-.Dq full
-(60).
-.It Cm PAMAuthenticationViaKbdInt
-Specifies whether PAM challenge response authentication is allowed. This
-allows the use of most PAM challenge response authentication modules, but
-it will allow password authentication regardless of whether
-.Cm PasswordAuthentication
-is enabled.
-.It Cm PasswordAuthentication
-Specifies whether password authentication is allowed.
-The default is
-.Dq yes .
-.It Cm PermitEmptyPasswords
-When password authentication is allowed, it specifies whether the
-server allows login to accounts with empty password strings.
-The default is
-.Dq no .
-.It Cm PermitRootLogin
-Specifies whether root can login using
-.Xr ssh 1 .
-The argument must be
-.Dq yes ,
-.Dq without-password ,
-.Dq forced-commands-only
-or
-.Dq no .
-The default is
-.Dq yes .
-.Pp
-If this option is set to
-.Dq without-password
-password authentication is disabled for root.
-.Pp
-If this option is set to
-.Dq forced-commands-only
-root login with public key authentication will be allowed,
-but only if the
-.Ar command
-option has been specified
-(which may be useful for taking remote backups even if root login is
-normally not allowed). All other authentication methods are disabled
-for root.
-.Pp
-If this option is set to
-.Dq no
-root is not allowed to login.
-.It Cm PermitUserEnvironment
-Specifies whether
-.Pa ~/.ssh/environment
-and
-.Cm environment=
-options in
-.Pa ~/.ssh/authorized_keys
-are processed by
-.Nm sshd .
-The default is
-.Dq no .
-Enabling environment processing may enable users to bypass access
-restrictions in some configurations using mechanisms such as
-.Ev LD_PRELOAD .
-.It Cm PidFile
-Specifies the file that contains the process ID of the
-.Nm sshd
-daemon.
-The default is
-.Pa /var/run/sshd.pid .
-.It Cm Port
-Specifies the port number that
-.Nm sshd
-listens on.
-The default is 22.
-Multiple options of this type are permitted.
-See also
-.Cm ListenAddress .
-.It Cm PrintLastLog
-Specifies whether
-.Nm sshd
-should print the date and time when the user last logged in.
-The default is
-.Dq yes .
-.It Cm PrintMotd
-Specifies whether
-.Nm sshd
-should print
-.Pa /etc/motd
-when a user logs in interactively.
-(On some systems it is also printed by the shell,
-.Pa /etc/profile ,
-or equivalent.)
-The default is
-.Dq yes .
-.It Cm Protocol
-Specifies the protocol versions
-.Nm sshd
-supports.
-The possible values are
-.Dq 1
-and
-.Dq 2 .
-Multiple versions must be comma-separated.
-The default is
-.Dq 2,1 .
-Note that the order of the protocol list does not indicate preference,
-because the client selects among multiple protocol versions offered
-by the server.
-Specifying
-.Dq 2,1
-is identical to
-.Dq 1,2 .
-.It Cm PubkeyAuthentication
-Specifies whether public key authentication is allowed.
-The default is
-.Dq yes .
-Note that this option applies to protocol version 2 only.
-.It Cm RhostsAuthentication
-Specifies whether authentication using rhosts or /etc/hosts.equiv
-files is sufficient.
-Normally, this method should not be permitted because it is insecure.
-.Cm RhostsRSAAuthentication
-should be used
-instead, because it performs RSA-based host authentication in addition
-to normal rhosts or /etc/hosts.equiv authentication.
-The default is
-.Dq no .
-This option applies to protocol version 1 only.
-.It Cm RhostsRSAAuthentication
-Specifies whether rhosts or /etc/hosts.equiv authentication together
-with successful RSA host authentication is allowed.
-The default is
-.Dq no .
-This option applies to protocol version 1 only.
-.It Cm RSAAuthentication
-Specifies whether pure RSA authentication is allowed.
-The default is
-.Dq yes .
-This option applies to protocol version 1 only.
-.It Cm ServerKeyBits
-Defines the number of bits in the ephemeral protocol version 1 server key.
-The minimum value is 512, and the default is 768.
-.It Cm StrictModes
-Specifies whether
-.Nm sshd
-should check file modes and ownership of the
-user's files and home directory before accepting login.
-This is normally desirable because novices sometimes accidentally leave their
-directory or files world-writable.
-The default is
-.Dq yes .
-.It Cm Subsystem
-Configures an external subsystem (e.g., file transfer daemon).
-Arguments should be a subsystem name and a command to execute upon subsystem
-request.
-The command
-.Xr sftp-server 8
-implements the
-.Dq sftp
-file transfer subsystem.
-By default no subsystems are defined.
-Note that this option applies to protocol version 2 only.
-.It Cm SyslogFacility
-Gives the facility code that is used when logging messages from
-.Nm sshd .
-The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2,
-LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
-The default is AUTH.
-.It Cm UseLogin
-Specifies whether
-.Xr login 1
-is used for interactive login sessions.
-The default is
-.Dq no .
-Note that
-.Xr login 1
-is never used for remote command execution.
-Note also, that if this is enabled,
-.Cm X11Forwarding
-will be disabled because
-.Xr login 1
-does not know how to handle
-.Xr xauth 1
-cookies.
-If
-.Cm UsePrivilegeSeparation
-is specified, it will be disabled after authentication.
-.It Cm UsePrivilegeSeparation
-Specifies whether
-.Nm sshd
-separates privileges by creating an unprivileged child process
-to deal with incoming network traffic.
-After successful authentication, another process will be created that has
-the privilege of the authenticated user.
-The goal of privilege separation is to prevent privilege
-escalation by containing any corruption within the unprivileged processes.
-The default is
-.Dq yes .
-.It Cm VerifyReverseMapping
-Specifies whether
-.Nm sshd
-should try to verify the remote host name and check that
-the resolved host name for the remote IP address maps back to the
-very same IP address.
-The default is
-.Dq no .
-.It Cm X11DisplayOffset
-Specifies the first display number available for
-.Nm sshd Ns 's
-X11 forwarding.
-This prevents
-.Nm sshd
-from interfering with real X11 servers.
-The default is 10.
-.It Cm X11Forwarding
-Specifies whether X11 forwarding is permitted.
-The argument must be
-.Dq yes
-or
-.Dq no .
-The default is
-.Dq no .
-.Pp
-When X11 forwarding is enabled, there may be additional exposure to
-the server and to client displays if the
-.Nm sshd
-proxy display is configured to listen on the wildcard address (see
-.Cm X11UseLocalhost
-below), however this is not the default.
-Additionally, the authentication spoofing and authentication data
-verification and substitution occur on the client side.
-The security risk of using X11 forwarding is that the client's X11
-display server may be exposed to attack when the ssh client requests
-forwarding (see the warnings for
-.Cm ForwardX11
-in
-.Xr ssh_config 5 ).
-A system administrator may have a stance in which they want to
-protect clients that may expose themselves to attack by unwittingly
-requesting X11 forwarding, which can warrant a
-.Dq no
-setting.
-.Pp
-Note that disabling X11 forwarding does not prevent users from
-forwarding X11 traffic, as users can always install their own forwarders.
-X11 forwarding is automatically disabled if
-.Cm UseLogin
-is enabled.
-.It Cm X11UseLocalhost
-Specifies whether
-.Nm sshd
-should bind the X11 forwarding server to the loopback address or to
-the wildcard address.
-By default,
-.Nm sshd
-binds the forwarding server to the loopback address and sets the
-hostname part of the
-.Ev DISPLAY
-environment variable to
-.Dq localhost .
-This prevents remote hosts from connecting to the proxy display.
-However, some older X11 clients may not function with this
-configuration.
-.Cm X11UseLocalhost
-may be set to
-.Dq no
-to specify that the forwarding server should be bound to the wildcard
-address.
-The argument must be
-.Dq yes
-or
-.Dq no .
-The default is
-.Dq yes .
-.It Cm XAuthLocation
-Specifies the full pathname of the
-.Xr xauth 1
-program.
-The default is
-.Pa /usr/X11R6/bin/xauth .
-.El
-.Ss Time Formats
-.Pp
-.Nm sshd
-command-line arguments and configuration file options that specify time
-may be expressed using a sequence of the form:
-.Sm off
-.Ar time Op Ar qualifier ,
-.Sm on
-where
-.Ar time
-is a positive integer value and
-.Ar qualifier
-is one of the following:
-.Pp
-.Bl -tag -width Ds -compact -offset indent
-.It Cm <none>
-seconds
-.It Cm s | Cm S
-seconds
-.It Cm m | Cm M
-minutes
-.It Cm h | Cm H
-hours
-.It Cm d | Cm D
-days
-.It Cm w | Cm W
-weeks
-.El
-.Pp
-Each member of the sequence is added together to calculate
-the total time value.
-.Pp
-Time format examples:
-.Pp
-.Bl -tag -width Ds -compact -offset indent
-.It 600
-600 seconds (10 minutes)
-.It 10m
-10 minutes
-.It 1h30m
-1 hour 30 minutes (90 minutes)
-.El
-.Sh FILES
-.Bl -tag -width Ds
-.It Pa /etc/ssh/sshd_config
-Contains configuration data for
-.Nm sshd .
-This file should be writable by root only, but it is recommended
-(though not necessary) that it be world-readable.
-.El
-.Sh AUTHORS
-OpenSSH is a derivative of the original and free
-ssh 1.2.12 release by Tatu Ylonen.
-Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos,
-Theo de Raadt and Dug Song
-removed many bugs, re-added newer features and
-created OpenSSH.
-Markus Friedl contributed the support for SSH
-protocol versions 1.5 and 2.0.
-Niels Provos and Markus Friedl contributed support
-for privilege separation.
-.Sh SEE ALSO
-.Xr sshd 8
diff --git a/crypto/openssh/sshlogin.c b/crypto/openssh/sshlogin.c
deleted file mode 100644
index 12555d635fdc..000000000000
--- a/crypto/openssh/sshlogin.c
+++ /dev/null
@@ -1,101 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * This file performs some of the things login(1) normally does.  We cannot
- * easily use something like login -p -h host -f user, because there are
- * several different logins around, and it is hard to determined what kind of
- * login the current system has.  Also, we want to be able to execute commands
- * on a tty.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- *
- * Copyright (c) 1999 Theo de Raadt.  All rights reserved.
- * Copyright (c) 1999 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: sshlogin.c,v 1.5 2002/08/29 15:57:25 stevesk Exp $");
-
-#include "loginrec.h"
-
-/*
- * Returns the time when the user last logged in.  Returns 0 if the
- * information is not available.  This must be called before record_login.
- * The host the user logged in from will be returned in buf.
- */
-u_long
-get_last_login_time(uid_t uid, const char *logname,
-    char *buf, u_int bufsize)
-{
-  struct logininfo li;
-
-  login_get_lastlog(&li, uid);
-  strlcpy(buf, li.hostname, bufsize);
-  return li.tv_sec;
-}
-
-/*
- * Records that the user has logged in.  I these parts of operating systems
- * were more standardized.
- */
-void
-record_login(pid_t pid, const char *ttyname, const char *user, uid_t uid,
-    const char *host, struct sockaddr * addr, socklen_t addrlen)
-{
-  struct logininfo *li;
-
-  li = login_alloc_entry(pid, user, host, ttyname);
-  login_set_addr(li, addr, addrlen);
-  login_login(li);
-  login_free_entry(li);
-}
-
-#ifdef LOGIN_NEEDS_UTMPX
-void
-record_utmp_only(pid_t pid, const char *ttyname, const char *user,
-		 const char *host, struct sockaddr * addr, socklen_t addrlen)
-{
-  struct logininfo *li;
-
-  li = login_alloc_entry(pid, user, host, ttyname);
-  login_set_addr(li, addr, addrlen);
-  login_utmp_only(li);
-  login_free_entry(li);
-}
-#endif
-
-/* Records that the user has logged out. */
-void
-record_logout(pid_t pid, const char *ttyname, const char *user)
-{
-  struct logininfo *li;
-
-  li = login_alloc_entry(pid, user, NULL, ttyname);
-  login_logout(li);
-  login_free_entry(li);
-}
diff --git a/crypto/openssh/sshlogin.h b/crypto/openssh/sshlogin.h
deleted file mode 100644
index 1c8bfad3233b..000000000000
--- a/crypto/openssh/sshlogin.h
+++ /dev/null
@@ -1,28 +0,0 @@
-/*	$OpenBSD: sshlogin.h,v 1.4 2002/08/29 15:57:25 stevesk Exp $	*/
-
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-#ifndef SSHLOGIN_H
-#define SSHLOGIN_H
-
-void
-record_login(pid_t, const char *, const char *, uid_t,
-    const char *, struct sockaddr *, socklen_t);
-void   record_logout(pid_t, const char *, const char *);
-u_long         get_last_login_time(uid_t, const char *, char *, u_int);
-
-#ifdef LOGIN_NEEDS_UTMPX
-void	record_utmp_only(pid_t, const char *, const char *, const char *,
-		struct sockaddr *, socklen_t);
-#endif
-
-#endif
diff --git a/crypto/openssh/sshpty.c b/crypto/openssh/sshpty.c
deleted file mode 100644
index d28947f620db..000000000000
--- a/crypto/openssh/sshpty.c
+++ /dev/null
@@ -1,418 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * Allocating a pseudo-terminal, and making it the controlling tty.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: sshpty.c,v 1.8 2003/02/03 08:56:16 markus Exp $");
-
-#ifdef HAVE_UTIL_H
-# include <util.h>
-#endif /* HAVE_UTIL_H */
-
-#include "sshpty.h"
-#include "log.h"
-#include "misc.h"
-
-/* Pty allocated with _getpty gets broken if we do I_PUSH:es to it. */
-#if defined(HAVE__GETPTY) || defined(HAVE_OPENPTY)
-#undef HAVE_DEV_PTMX
-#endif
-
-#ifdef HAVE_PTY_H
-# include <pty.h>
-#endif
-#if defined(HAVE_DEV_PTMX) && defined(HAVE_SYS_STROPTS_H)
-# include <sys/stropts.h>
-#endif
-
-#ifndef O_NOCTTY
-#define O_NOCTTY 0
-#endif
-
-/*
- * Allocates and opens a pty.  Returns 0 if no pty could be allocated, or
- * nonzero if a pty was successfully allocated.  On success, open file
- * descriptors for the pty and tty sides and the name of the tty side are
- * returned (the buffer must be able to hold at least 64 characters).
- */
-
-int
-pty_allocate(int *ptyfd, int *ttyfd, char *namebuf, int namebuflen)
-{
-#if defined(HAVE_OPENPTY) || defined(BSD4_4)
-	/* openpty(3) exists in OSF/1 and some other os'es */
-	char *name;
-	int i;
-
-	i = openpty(ptyfd, ttyfd, NULL, NULL, NULL);
-	if (i < 0) {
-		error("openpty: %.100s", strerror(errno));
-		return 0;
-	}
-	name = ttyname(*ttyfd);
-	if (!name)
-		fatal("openpty returns device for which ttyname fails.");
-
-	strlcpy(namebuf, name, namebuflen);	/* possible truncation */
-	return 1;
-#else /* HAVE_OPENPTY */
-#ifdef HAVE__GETPTY
-	/*
-	 * _getpty(3) exists in SGI Irix 4.x, 5.x & 6.x -- it generates more
-	 * pty's automagically when needed
-	 */
-	char *slave;
-
-	slave = _getpty(ptyfd, O_RDWR, 0622, 0);
-	if (slave == NULL) {
-		error("_getpty: %.100s", strerror(errno));
-		return 0;
-	}
-	strlcpy(namebuf, slave, namebuflen);
-	/* Open the slave side. */
-	*ttyfd = open(namebuf, O_RDWR | O_NOCTTY);
-	if (*ttyfd < 0) {
-		error("%.200s: %.100s", namebuf, strerror(errno));
-		close(*ptyfd);
-		return 0;
-	}
-	return 1;
-#else /* HAVE__GETPTY */
-#if defined(HAVE_DEV_PTMX)
-	/*
-	 * This code is used e.g. on Solaris 2.x.  (Note that Solaris 2.3
-	 * also has bsd-style ptys, but they simply do not work.)
-	 */
-	int ptm;
-	char *pts;
-	mysig_t old_signal;
-
-	ptm = open("/dev/ptmx", O_RDWR | O_NOCTTY);
-	if (ptm < 0) {
-		error("/dev/ptmx: %.100s", strerror(errno));
-		return 0;
-	}
-	old_signal = mysignal(SIGCHLD, SIG_DFL);
-	if (grantpt(ptm) < 0) {
-		error("grantpt: %.100s", strerror(errno));
-		return 0;
-	}
-	mysignal(SIGCHLD, old_signal);
-	if (unlockpt(ptm) < 0) {
-		error("unlockpt: %.100s", strerror(errno));
-		return 0;
-	}
-	pts = ptsname(ptm);
-	if (pts == NULL)
-		error("Slave pty side name could not be obtained.");
-	strlcpy(namebuf, pts, namebuflen);
-	*ptyfd = ptm;
-
-	/* Open the slave side. */
-	*ttyfd = open(namebuf, O_RDWR | O_NOCTTY);
-	if (*ttyfd < 0) {
-		error("%.100s: %.100s", namebuf, strerror(errno));
-		close(*ptyfd);
-		return 0;
-	}
-#ifndef HAVE_CYGWIN
-	/*
-	 * Push the appropriate streams modules, as described in Solaris pts(7).
-	 * HP-UX pts(7) doesn't have ttcompat module.
-	 */
-	if (ioctl(*ttyfd, I_PUSH, "ptem") < 0)
-		error("ioctl I_PUSH ptem: %.100s", strerror(errno));
-	if (ioctl(*ttyfd, I_PUSH, "ldterm") < 0)
-		error("ioctl I_PUSH ldterm: %.100s", strerror(errno));
-#ifndef __hpux
-	if (ioctl(*ttyfd, I_PUSH, "ttcompat") < 0)
-		error("ioctl I_PUSH ttcompat: %.100s", strerror(errno));
-#endif
-#endif
-	return 1;
-#else /* HAVE_DEV_PTMX */
-#ifdef HAVE_DEV_PTS_AND_PTC
-	/* AIX-style pty code. */
-	const char *name;
-
-	*ptyfd = open("/dev/ptc", O_RDWR | O_NOCTTY);
-	if (*ptyfd < 0) {
-		error("Could not open /dev/ptc: %.100s", strerror(errno));
-		return 0;
-	}
-	name = ttyname(*ptyfd);
-	if (!name)
-		fatal("Open of /dev/ptc returns device for which ttyname fails.");
-	strlcpy(namebuf, name, namebuflen);
-	*ttyfd = open(name, O_RDWR | O_NOCTTY);
-	if (*ttyfd < 0) {
-		error("Could not open pty slave side %.100s: %.100s",
-		    name, strerror(errno));
-		close(*ptyfd);
-		return 0;
-	}
-	return 1;
-#else /* HAVE_DEV_PTS_AND_PTC */
-#ifdef _UNICOS
-	char buf[64];
-	int i;
-	int highpty;
-
-#ifdef _SC_CRAY_NPTY
-	highpty = sysconf(_SC_CRAY_NPTY);
-	if (highpty == -1)
-		highpty = 128;
-#else
-	highpty = 128;
-#endif
-
-	for (i = 0; i < highpty; i++) {
-		snprintf(buf, sizeof(buf), "/dev/pty/%03d", i);
-		*ptyfd = open(buf, O_RDWR|O_NOCTTY);
-		if (*ptyfd < 0)
-			continue;
-		snprintf(namebuf, namebuflen, "/dev/ttyp%03d", i);
-		/* Open the slave side. */
-		*ttyfd = open(namebuf, O_RDWR|O_NOCTTY);
-		if (*ttyfd < 0) {
-			error("%.100s: %.100s", namebuf, strerror(errno));
-			close(*ptyfd);
-			return 0;
-		}
-		return 1;
-	}
-	return 0;
-#else
-	/* BSD-style pty code. */
-	char buf[64];
-	int i;
-	const char *ptymajors = "pqrstuvwxyzabcdefghijklmnoABCDEFGHIJKLMNOPQRSTUVWXYZ";
-	const char *ptyminors = "0123456789abcdef";
-	int num_minors = strlen(ptyminors);
-	int num_ptys = strlen(ptymajors) * num_minors;
-	struct termios tio;
-
-	for (i = 0; i < num_ptys; i++) {
-		snprintf(buf, sizeof buf, "/dev/pty%c%c", ptymajors[i / num_minors],
-			 ptyminors[i % num_minors]);
-		snprintf(namebuf, namebuflen, "/dev/tty%c%c",
-		    ptymajors[i / num_minors], ptyminors[i % num_minors]);
-
-		*ptyfd = open(buf, O_RDWR | O_NOCTTY);
-		if (*ptyfd < 0) {
-			/* Try SCO style naming */
-			snprintf(buf, sizeof buf, "/dev/ptyp%d", i);
-			snprintf(namebuf, namebuflen, "/dev/ttyp%d", i);
-			*ptyfd = open(buf, O_RDWR | O_NOCTTY);
-			if (*ptyfd < 0)
-				continue;
-		}
-
-		/* Open the slave side. */
-		*ttyfd = open(namebuf, O_RDWR | O_NOCTTY);
-		if (*ttyfd < 0) {
-			error("%.100s: %.100s", namebuf, strerror(errno));
-			close(*ptyfd);
-			return 0;
-		}
-		/* set tty modes to a sane state for broken clients */
-		if (tcgetattr(*ptyfd, &tio) < 0)
-			log("Getting tty modes for pty failed: %.100s", strerror(errno));
-		else {
-			tio.c_lflag |= (ECHO | ISIG | ICANON);
-			tio.c_oflag |= (OPOST | ONLCR);
-			tio.c_iflag |= ICRNL;
-
-			/* Set the new modes for the terminal. */
-			if (tcsetattr(*ptyfd, TCSANOW, &tio) < 0)
-				log("Setting tty modes for pty failed: %.100s", strerror(errno));
-		}
-
-		return 1;
-	}
-	return 0;
-#endif /* CRAY */
-#endif /* HAVE_DEV_PTS_AND_PTC */
-#endif /* HAVE_DEV_PTMX */
-#endif /* HAVE__GETPTY */
-#endif /* HAVE_OPENPTY */
-}
-
-/* Releases the tty.  Its ownership is returned to root, and permissions to 0666. */
-
-void
-pty_release(const char *ttyname)
-{
-	if (chown(ttyname, (uid_t) 0, (gid_t) 0) < 0)
-		error("chown %.100s 0 0 failed: %.100s", ttyname, strerror(errno));
-	if (chmod(ttyname, (mode_t) 0666) < 0)
-		error("chmod %.100s 0666 failed: %.100s", ttyname, strerror(errno));
-}
-
-/* Makes the tty the processes controlling tty and sets it to sane modes. */
-
-void
-pty_make_controlling_tty(int *ttyfd, const char *ttyname)
-{
-	int fd;
-#ifdef USE_VHANGUP
-	void *old;
-#endif /* USE_VHANGUP */
-
-#ifdef _UNICOS
-	if (setsid() < 0)
-		error("setsid: %.100s", strerror(errno));
-
-	fd = open(ttyname, O_RDWR|O_NOCTTY);
-	if (fd != -1) {
-		mysignal(SIGHUP, SIG_IGN);
-		ioctl(fd, TCVHUP, (char *)NULL);
-		mysignal(SIGHUP, SIG_DFL);
-		setpgid(0, 0);
-		close(fd);
-	} else {
-		error("Failed to disconnect from controlling tty.");
-	}
-
-	debug("Setting controlling tty using TCSETCTTY.");
-	ioctl(*ttyfd, TCSETCTTY, NULL);
-	fd = open("/dev/tty", O_RDWR);
-	if (fd < 0)
-		error("%.100s: %.100s", ttyname, strerror(errno));
-	close(*ttyfd);
-	*ttyfd = fd;
-#else /* _UNICOS */
-
-	/* First disconnect from the old controlling tty. */
-#ifdef TIOCNOTTY
-	fd = open(_PATH_TTY, O_RDWR | O_NOCTTY);
-	if (fd >= 0) {
-		(void) ioctl(fd, TIOCNOTTY, NULL);
-		close(fd);
-	}
-#endif /* TIOCNOTTY */
-	if (setsid() < 0)
-		error("setsid: %.100s", strerror(errno));
-
-	/*
-	 * Verify that we are successfully disconnected from the controlling
-	 * tty.
-	 */
-	fd = open(_PATH_TTY, O_RDWR | O_NOCTTY);
-	if (fd >= 0) {
-		error("Failed to disconnect from controlling tty.");
-		close(fd);
-	}
-	/* Make it our controlling tty. */
-#ifdef TIOCSCTTY
-	debug("Setting controlling tty using TIOCSCTTY.");
-	if (ioctl(*ttyfd, TIOCSCTTY, NULL) < 0)
-		error("ioctl(TIOCSCTTY): %.100s", strerror(errno));
-#endif /* TIOCSCTTY */
-#ifdef HAVE_NEWS4
-	if (setpgrp(0,0) < 0)
-		error("SETPGRP %s",strerror(errno));
-#endif /* HAVE_NEWS4 */
-#ifdef USE_VHANGUP
-	old = mysignal(SIGHUP, SIG_IGN);
-	vhangup();
-	mysignal(SIGHUP, old);
-#endif /* USE_VHANGUP */
-	fd = open(ttyname, O_RDWR);
-	if (fd < 0) {
-		error("%.100s: %.100s", ttyname, strerror(errno));
-	} else {
-#ifdef USE_VHANGUP
-		close(*ttyfd);
-		*ttyfd = fd;
-#else /* USE_VHANGUP */
-		close(fd);
-#endif /* USE_VHANGUP */
-	}
-	/* Verify that we now have a controlling tty. */
-	fd = open(_PATH_TTY, O_WRONLY);
-	if (fd < 0)
-		error("open /dev/tty failed - could not set controlling tty: %.100s",
-		    strerror(errno));
-	else 
-		close(fd);
-#endif /* _UNICOS */
-}
-
-/* Changes the window size associated with the pty. */
-
-void
-pty_change_window_size(int ptyfd, int row, int col,
-	int xpixel, int ypixel)
-{
-	struct winsize w;
-
-	w.ws_row = row;
-	w.ws_col = col;
-	w.ws_xpixel = xpixel;
-	w.ws_ypixel = ypixel;
-	(void) ioctl(ptyfd, TIOCSWINSZ, &w);
-}
-
-void
-pty_setowner(struct passwd *pw, const char *ttyname)
-{
-	struct group *grp;
-	gid_t gid;
-	mode_t mode;
-	struct stat st;
-
-	/* Determine the group to make the owner of the tty. */
-	grp = getgrnam("tty");
-	if (grp) {
-		gid = grp->gr_gid;
-		mode = S_IRUSR | S_IWUSR | S_IWGRP;
-	} else {
-		gid = pw->pw_gid;
-		mode = S_IRUSR | S_IWUSR | S_IWGRP | S_IWOTH;
-	}
-
-	/*
-	 * Change owner and mode of the tty as required.
-	 * Warn but continue if filesystem is read-only and the uids match/
-	 * tty is owned by root.
-	 */
-	if (stat(ttyname, &st))
-		fatal("stat(%.100s) failed: %.100s", ttyname,
-		    strerror(errno));
-
-	if (st.st_uid != pw->pw_uid || st.st_gid != gid) {
-		if (chown(ttyname, pw->pw_uid, gid) < 0) {
-			if (errno == EROFS &&
-			    (st.st_uid == pw->pw_uid || st.st_uid == 0))
-				debug("chown(%.100s, %u, %u) failed: %.100s",
-				    ttyname, (u_int)pw->pw_uid, (u_int)gid,
-				    strerror(errno));
-			else
-				fatal("chown(%.100s, %u, %u) failed: %.100s",
-				    ttyname, (u_int)pw->pw_uid, (u_int)gid,
-				    strerror(errno));
-		}
-	}
-
-	if ((st.st_mode & (S_IRWXU|S_IRWXG|S_IRWXO)) != mode) {
-		if (chmod(ttyname, mode) < 0) {
-			if (errno == EROFS &&
-			    (st.st_mode & (S_IRGRP | S_IROTH)) == 0)
-				debug("chmod(%.100s, 0%o) failed: %.100s",
-				    ttyname, mode, strerror(errno));
-			else
-				fatal("chmod(%.100s, 0%o) failed: %.100s",
-				    ttyname, mode, strerror(errno));
-		}
-	}
-}
diff --git a/crypto/openssh/sshpty.h b/crypto/openssh/sshpty.h
deleted file mode 100644
index df65e284e4c3..000000000000
--- a/crypto/openssh/sshpty.h
+++ /dev/null
@@ -1,26 +0,0 @@
-/*	$OpenBSD: sshpty.h,v 1.4 2002/03/04 17:27:39 stevesk Exp $	*/
-
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * Functions for allocating a pseudo-terminal and making it the controlling
- * tty.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#ifndef SSHPTY_H
-#define SSHPTY_H
-
-int	 pty_allocate(int *, int *, char *, int);
-void	 pty_release(const char *);
-void	 pty_make_controlling_tty(int *, const char *);
-void	 pty_change_window_size(int, int, int, int, int);
-void	 pty_setowner(struct passwd *, const char *);
-
-#endif				/* SSHPTY_H */
diff --git a/crypto/openssh/sshtty.c b/crypto/openssh/sshtty.c
deleted file mode 100644
index 5c016f80af87..000000000000
--- a/crypto/openssh/sshtty.c
+++ /dev/null
@@ -1,96 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-/*
- * Copyright (c) 2001 Markus Friedl.  All rights reserved.
- * Copyright (c) 2001 Kevin Steves.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: sshtty.c,v 1.3 2002/03/04 17:27:39 stevesk Exp $");
-
-#include "sshtty.h"
-#include "log.h"
-
-static struct termios _saved_tio;
-static int _in_raw_mode = 0;
-
-int
-in_raw_mode(void)
-{
-	return _in_raw_mode;
-}
-
-struct termios
-get_saved_tio(void)
-{
-	return _saved_tio;
-}
-
-void
-leave_raw_mode(void)
-{
-	if (!_in_raw_mode)
-		return;
-	if (tcsetattr(fileno(stdin), TCSADRAIN, &_saved_tio) == -1)
-		perror("tcsetattr");
-	else
-		_in_raw_mode = 0;
-
-	fatal_remove_cleanup((void (*) (void *)) leave_raw_mode, NULL);
-}
-
-void
-enter_raw_mode(void)
-{
-	struct termios tio;
-
-	if (tcgetattr(fileno(stdin), &tio) == -1) {
-		perror("tcgetattr");
-		return;
-	}
-	_saved_tio = tio;
-	tio.c_iflag |= IGNPAR;
-	tio.c_iflag &= ~(ISTRIP | INLCR | IGNCR | ICRNL | IXON | IXANY | IXOFF);
-	tio.c_lflag &= ~(ISIG | ICANON | ECHO | ECHOE | ECHOK | ECHONL);
-#ifdef IEXTEN
-	tio.c_lflag &= ~IEXTEN;
-#endif
-	tio.c_oflag &= ~OPOST;
-	tio.c_cc[VMIN] = 1;
-	tio.c_cc[VTIME] = 0;
-	if (tcsetattr(fileno(stdin), TCSADRAIN, &tio) == -1)
-		perror("tcsetattr");
-	else
-		_in_raw_mode = 1;
-
-	fatal_add_cleanup((void (*) (void *)) leave_raw_mode, NULL);
-}
diff --git a/crypto/openssh/sshtty.h b/crypto/openssh/sshtty.h
deleted file mode 100644
index 7ba4a2627273..000000000000
--- a/crypto/openssh/sshtty.h
+++ /dev/null
@@ -1,48 +0,0 @@
-/* $OpenBSD: sshtty.h,v 1.2 2001/06/26 17:27:25 markus Exp $ */
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-/*
- * Copyright (c) 2001 Markus Friedl.  All rights reserved.
- * Copyright (c) 2001 Kevin Steves.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef SSHTTY_H
-#define SSHTTY_H
-
-#include <termios.h>
-
-int	 in_raw_mode(void);
-struct termios get_saved_tio(void);
-void	 leave_raw_mode(void);
-void	 enter_raw_mode(void);
-
-#endif
diff --git a/crypto/openssh/tildexpand.c b/crypto/openssh/tildexpand.c
deleted file mode 100644
index cbe981146730..000000000000
--- a/crypto/openssh/tildexpand.c
+++ /dev/null
@@ -1,73 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: tildexpand.c,v 1.13 2002/06/23 03:25:50 deraadt Exp $");
-
-#include "xmalloc.h"
-#include "log.h"
-#include "tildexpand.h"
-
-/*
- * Expands tildes in the file name.  Returns data allocated by xmalloc.
- * Warning: this calls getpw*.
- */
-char *
-tilde_expand_filename(const char *filename, uid_t my_uid)
-{
-	const char *cp;
-	u_int userlen;
-	char *expanded;
-	struct passwd *pw;
-	char user[100];
-	int len;
-
-	/* Return immediately if no tilde. */
-	if (filename[0] != '~')
-		return xstrdup(filename);
-
-	/* Skip the tilde. */
-	filename++;
-
-	/* Find where the username ends. */
-	cp = strchr(filename, '/');
-	if (cp)
-		userlen = cp - filename;	/* Something after username. */
-	else
-		userlen = strlen(filename);	/* Nothing after username. */
-	if (userlen == 0)
-		pw = getpwuid(my_uid);		/* Own home directory. */
-	else {
-		/* Tilde refers to someone elses home directory. */
-		if (userlen > sizeof(user) - 1)
-			fatal("User name after tilde too long.");
-		memcpy(user, filename, userlen);
-		user[userlen] = 0;
-		pw = getpwnam(user);
-	}
-	if (!pw)
-		fatal("Unknown user %100s.", user);
-
-	/* If referring to someones home directory, return it now. */
-	if (!cp) {
-		/* Only home directory specified */
-		return xstrdup(pw->pw_dir);
-	}
-	/* Build a path combining the specified directory and path. */
-	len = strlen(pw->pw_dir) + strlen(cp + 1) + 2;
-	if (len > MAXPATHLEN)
-		fatal("Home directory too long (%d > %d", len-1, MAXPATHLEN-1);
-	expanded = xmalloc(len);
-	snprintf(expanded, len, "%s%s%s", pw->pw_dir,
-	    strcmp(pw->pw_dir, "/") ? "/" : "", cp + 1);
-	return expanded;
-}
diff --git a/crypto/openssh/tildexpand.h b/crypto/openssh/tildexpand.h
deleted file mode 100644
index f5e7e40bcc0d..000000000000
--- a/crypto/openssh/tildexpand.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*	$OpenBSD: tildexpand.h,v 1.4 2001/06/26 17:27:25 markus Exp $	*/
-
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-char	*tilde_expand_filename(const char *, uid_t);
diff --git a/crypto/openssh/ttymodes.c b/crypto/openssh/ttymodes.c
deleted file mode 100644
index 5cc13dcd5e06..000000000000
--- a/crypto/openssh/ttymodes.c
+++ /dev/null
@@ -1,459 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-/*
- * SSH2 tty modes support by Kevin Steves.
- * Copyright (c) 2001 Kevin Steves.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/*
- * Encoding and decoding of terminal modes in a portable way.
- * Much of the format is defined in ttymodes.h; it is included multiple times
- * into this file with the appropriate macro definitions to generate the
- * suitable code.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: ttymodes.c,v 1.18 2002/06/19 00:27:55 deraadt Exp $");
-
-#include "packet.h"
-#include "log.h"
-#include "ssh1.h"
-#include "compat.h"
-#include "buffer.h"
-#include "bufaux.h"
-
-#define TTY_OP_END		0
-/*
- * uint32 (u_int) follows speed in SSH1 and SSH2
- */
-#define TTY_OP_ISPEED_PROTO1	192
-#define TTY_OP_OSPEED_PROTO1	193
-#define TTY_OP_ISPEED_PROTO2	128
-#define TTY_OP_OSPEED_PROTO2	129
-
-/*
- * Converts POSIX speed_t to a baud rate.  The values of the
- * constants for speed_t are not themselves portable.
- */
-static int
-speed_to_baud(speed_t speed)
-{
-	switch (speed) {
-	case B0:
-		return 0;
-	case B50:
-		return 50;
-	case B75:
-		return 75;
-	case B110:
-		return 110;
-	case B134:
-		return 134;
-	case B150:
-		return 150;
-	case B200:
-		return 200;
-	case B300:
-		return 300;
-	case B600:
-		return 600;
-	case B1200:
-		return 1200;
-	case B1800:
-		return 1800;
-	case B2400:
-		return 2400;
-	case B4800:
-		return 4800;
-	case B9600:
-		return 9600;
-
-#ifdef B19200
-	case B19200:
-		return 19200;
-#else /* B19200 */
-#ifdef EXTA
-	case EXTA:
-		return 19200;
-#endif /* EXTA */
-#endif /* B19200 */
-
-#ifdef B38400
-	case B38400:
-		return 38400;
-#else /* B38400 */
-#ifdef EXTB
-	case EXTB:
-		return 38400;
-#endif /* EXTB */
-#endif /* B38400 */
-
-#ifdef B7200
-	case B7200:
-		return 7200;
-#endif /* B7200 */
-#ifdef B14400
-	case B14400:
-		return 14400;
-#endif /* B14400 */
-#ifdef B28800
-	case B28800:
-		return 28800;
-#endif /* B28800 */
-#ifdef B57600
-	case B57600:
-		return 57600;
-#endif /* B57600 */
-#ifdef B76800
-	case B76800:
-		return 76800;
-#endif /* B76800 */
-#ifdef B115200
-	case B115200:
-		return 115200;
-#endif /* B115200 */
-#ifdef B230400
-	case B230400:
-		return 230400;
-#endif /* B230400 */
-	default:
-		return 9600;
-	}
-}
-
-/*
- * Converts a numeric baud rate to a POSIX speed_t.
- */
-static speed_t
-baud_to_speed(int baud)
-{
-	switch (baud) {
-	case 0:
-		return B0;
-	case 50:
-		return B50;
-	case 75:
-		return B75;
-	case 110:
-		return B110;
-	case 134:
-		return B134;
-	case 150:
-		return B150;
-	case 200:
-		return B200;
-	case 300:
-		return B300;
-	case 600:
-		return B600;
-	case 1200:
-		return B1200;
-	case 1800:
-		return B1800;
-	case 2400:
-		return B2400;
-	case 4800:
-		return B4800;
-	case 9600:
-		return B9600;
-
-#ifdef B19200
-	case 19200:
-		return B19200;
-#else /* B19200 */
-#ifdef EXTA
-	case 19200:
-		return EXTA;
-#endif /* EXTA */
-#endif /* B19200 */
-
-#ifdef B38400
-	case 38400:
-		return B38400;
-#else /* B38400 */
-#ifdef EXTB
-	case 38400:
-		return EXTB;
-#endif /* EXTB */
-#endif /* B38400 */
-
-#ifdef B7200
-	case 7200:
-		return B7200;
-#endif /* B7200 */
-#ifdef B14400
-	case 14400:
-		return B14400;
-#endif /* B14400 */
-#ifdef B28800
-	case 28800:
-		return B28800;
-#endif /* B28800 */
-#ifdef B57600
-	case 57600:
-		return B57600;
-#endif /* B57600 */
-#ifdef B76800
-	case 76800:
-		return B76800;
-#endif /* B76800 */
-#ifdef B115200
-	case 115200:
-		return B115200;
-#endif /* B115200 */
-#ifdef B230400
-	case 230400:
-		return B230400;
-#endif /* B230400 */
-	default:
-		return B9600;
-	}
-}
-
-/*
- * Encodes terminal modes for the terminal referenced by fd
- * or tiop in a portable manner, and appends the modes to a packet
- * being constructed.
- */
-void
-tty_make_modes(int fd, struct termios *tiop)
-{
-	struct termios tio;
-	int baud;
-	Buffer buf;
-	int tty_op_ospeed, tty_op_ispeed;
-	void (*put_arg)(Buffer *, u_int);
-
-	buffer_init(&buf);
-	if (compat20) {
-		tty_op_ospeed = TTY_OP_OSPEED_PROTO2;
-		tty_op_ispeed = TTY_OP_ISPEED_PROTO2;
-		put_arg = buffer_put_int;
-	} else {
-		tty_op_ospeed = TTY_OP_OSPEED_PROTO1;
-		tty_op_ispeed = TTY_OP_ISPEED_PROTO1;
-		put_arg = (void (*)(Buffer *, u_int)) buffer_put_char;
-	}
-
-	if (tiop == NULL) {
-		if (tcgetattr(fd, &tio) == -1) {
-			log("tcgetattr: %.100s", strerror(errno));
-			goto end;
-		}
-	} else
-		tio = *tiop;
-
-	/* Store input and output baud rates. */
-	baud = speed_to_baud(cfgetospeed(&tio));
-	debug3("tty_make_modes: ospeed %d", baud);
-	buffer_put_char(&buf, tty_op_ospeed);
-	buffer_put_int(&buf, baud);
-	baud = speed_to_baud(cfgetispeed(&tio));
-	debug3("tty_make_modes: ispeed %d", baud);
-	buffer_put_char(&buf, tty_op_ispeed);
-	buffer_put_int(&buf, baud);
-
-	/* Store values of mode flags. */
-#define TTYCHAR(NAME, OP) \
-	debug3("tty_make_modes: %d %d", OP, tio.c_cc[NAME]); \
-	buffer_put_char(&buf, OP); \
-	put_arg(&buf, tio.c_cc[NAME]);
-
-#define TTYMODE(NAME, FIELD, OP) \
-	debug3("tty_make_modes: %d %d", OP, ((tio.FIELD & NAME) != 0)); \
-	buffer_put_char(&buf, OP); \
-	put_arg(&buf, ((tio.FIELD & NAME) != 0));
-
-#include "ttymodes.h"
-
-#undef TTYCHAR
-#undef TTYMODE
-
-end:
-	/* Mark end of mode data. */
-	buffer_put_char(&buf, TTY_OP_END);
-	if (compat20)
-		packet_put_string(buffer_ptr(&buf), buffer_len(&buf));
-	else
-		packet_put_raw(buffer_ptr(&buf), buffer_len(&buf));
-	buffer_free(&buf);
-}
-
-/*
- * Decodes terminal modes for the terminal referenced by fd in a portable
- * manner from a packet being read.
- */
-void
-tty_parse_modes(int fd, int *n_bytes_ptr)
-{
-	struct termios tio;
-	int opcode, baud;
-	int n_bytes = 0;
-	int failure = 0;
-	u_int (*get_arg)(void);
-	int arg, arg_size;
-
-	if (compat20) {
-		*n_bytes_ptr = packet_get_int();
-		debug3("tty_parse_modes: SSH2 n_bytes %d", *n_bytes_ptr);
-		if (*n_bytes_ptr == 0)
-			return;
-		get_arg = packet_get_int;
-		arg_size = 4;
-	} else {
-		get_arg = packet_get_char;
-		arg_size = 1;
-	}
-
-	/*
-	 * Get old attributes for the terminal.  We will modify these
-	 * flags. I am hoping that if there are any machine-specific
-	 * modes, they will initially have reasonable values.
-	 */
-	if (tcgetattr(fd, &tio) == -1) {
-		log("tcgetattr: %.100s", strerror(errno));
-		failure = -1;
-	}
-
-	for (;;) {
-		n_bytes += 1;
-		opcode = packet_get_char();
-		switch (opcode) {
-		case TTY_OP_END:
-			goto set;
-
-		/* XXX: future conflict possible */
-		case TTY_OP_ISPEED_PROTO1:
-		case TTY_OP_ISPEED_PROTO2:
-			n_bytes += 4;
-			baud = packet_get_int();
-			debug3("tty_parse_modes: ispeed %d", baud);
-			if (failure != -1 && cfsetispeed(&tio, baud_to_speed(baud)) == -1)
-				error("cfsetispeed failed for %d", baud);
-			break;
-
-		/* XXX: future conflict possible */
-		case TTY_OP_OSPEED_PROTO1:
-		case TTY_OP_OSPEED_PROTO2:
-			n_bytes += 4;
-			baud = packet_get_int();
-			debug3("tty_parse_modes: ospeed %d", baud);
-			if (failure != -1 && cfsetospeed(&tio, baud_to_speed(baud)) == -1)
-				error("cfsetospeed failed for %d", baud);
-			break;
-
-#define TTYCHAR(NAME, OP) \
-	case OP: \
-	  n_bytes += arg_size; \
-	  tio.c_cc[NAME] = get_arg(); \
-	  debug3("tty_parse_modes: %d %d", OP, tio.c_cc[NAME]); \
-	  break;
-#define TTYMODE(NAME, FIELD, OP) \
-	case OP: \
-	  n_bytes += arg_size; \
-	  if ((arg = get_arg())) \
-	    tio.FIELD |= NAME; \
-	  else \
-	    tio.FIELD &= ~NAME;	\
-	  debug3("tty_parse_modes: %d %d", OP, arg); \
-	  break;
-
-#include "ttymodes.h"
-
-#undef TTYCHAR
-#undef TTYMODE
-
-		default:
-			debug("Ignoring unsupported tty mode opcode %d (0x%x)",
-			    opcode, opcode);
-			if (!compat20) {
-				/*
-				 * SSH1:
-				 * Opcodes 1 to 127 are defined to have
-				 * a one-byte argument.
-				 * Opcodes 128 to 159 are defined to have
-				 * an integer argument.
-				 */
-				if (opcode > 0 && opcode < 128) {
-					n_bytes += 1;
-					(void) packet_get_char();
-					break;
-				} else if (opcode >= 128 && opcode < 160) {
-					n_bytes += 4;
-					(void) packet_get_int();
-					break;
-				} else {
-					/*
-					 * It is a truly undefined opcode (160 to 255).
-					 * We have no idea about its arguments.  So we
-					 * must stop parsing.  Note that some data may be
-					 * left in the packet; hopefully there is nothing
-					 * more coming after the mode data.
-					 */
-					log("parse_tty_modes: unknown opcode %d", opcode);
-					goto set;
-				}
-			} else {
-				/*
-				 * SSH2:
-				 * Opcodes 1 to 159 are defined to have
-				 * a uint32 argument.
-				 * Opcodes 160 to 255 are undefined and
-				 * cause parsing to stop.
-				 */
-				if (opcode > 0 && opcode < 160) {
-					n_bytes += 4;
-					(void) packet_get_int();
-					break;
-				} else {
-					log("parse_tty_modes: unknown opcode %d", opcode);
-					goto set;
-				}
-			}
-		}
-	}
-
-set:
-	if (*n_bytes_ptr != n_bytes) {
-		*n_bytes_ptr = n_bytes;
-		log("parse_tty_modes: n_bytes_ptr != n_bytes: %d %d",
-		    *n_bytes_ptr, n_bytes);
-		return;		/* Don't process bytes passed */
-	}
-	if (failure == -1)
-		return;		/* Packet parsed ok but tcgetattr() failed */
-
-	/* Set the new modes for the terminal. */
-	if (tcsetattr(fd, TCSANOW, &tio) == -1)
-		log("Setting tty modes failed: %.100s", strerror(errno));
-}
diff --git a/crypto/openssh/ttymodes.h b/crypto/openssh/ttymodes.h
deleted file mode 100644
index 7de4b83622ab..000000000000
--- a/crypto/openssh/ttymodes.h
+++ /dev/null
@@ -1,175 +0,0 @@
-/*	$OpenBSD: ttymodes.h,v 1.12 2002/03/04 17:27:39 stevesk Exp $	*/
-
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-/*
- * SSH2 tty modes support by Kevin Steves.
- * Copyright (c) 2001 Kevin Steves.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/*
- * SSH1:
- * The tty mode description is a stream of bytes.  The stream consists of
- * opcode-arguments pairs.  It is terminated by opcode TTY_OP_END (0).
- * Opcodes 1-127 have one-byte arguments.  Opcodes 128-159 have integer
- * arguments.  Opcodes 160-255 are not yet defined, and cause parsing to
- * stop (they should only be used after any other data).
- *
- * SSH2:
- * Differences between SSH1 and SSH2 terminal mode encoding include:
- * 1. Encoded terminal modes are represented as a string, and a stream
- *    of bytes within that string.
- * 2. Opcode arguments are uint32 (1-159); 160-255 remain undefined.
- * 3. The values for TTY_OP_ISPEED and TTY_OP_OSPEED are different;
- *    128 and 129 vs. 192 and 193 respectively.
- *
- * The client puts in the stream any modes it knows about, and the
- * server ignores any modes it does not know about.  This allows some degree
- * of machine-independence, at least between systems that use a posix-like
- * tty interface.  The protocol can support other systems as well, but might
- * require reimplementing as mode names would likely be different.
- */
-
-/*
- * Some constants and prototypes are defined in packet.h; this file
- * is only intended for including from ttymodes.c.
- */
-
-/* termios macro */
-/* name, op */
-TTYCHAR(VINTR, 1)
-TTYCHAR(VQUIT, 2)
-TTYCHAR(VERASE, 3)
-#if defined(VKILL)
-TTYCHAR(VKILL, 4)
-#endif /* VKILL */
-TTYCHAR(VEOF, 5)
-#if defined(VEOL)
-TTYCHAR(VEOL, 6)
-#endif /* VEOL */
-#ifdef VEOL2
-TTYCHAR(VEOL2, 7)
-#endif /* VEOL2 */
-TTYCHAR(VSTART, 8)
-TTYCHAR(VSTOP, 9)
-#if defined(VSUSP)
-TTYCHAR(VSUSP, 10)
-#endif /* VSUSP */
-#if defined(VDSUSP)
-TTYCHAR(VDSUSP, 11)
-#endif /* VDSUSP */
-#if defined(VREPRINT)
-TTYCHAR(VREPRINT, 12)
-#endif /* VREPRINT */
-#if defined(VWERASE)
-TTYCHAR(VWERASE, 13)
-#endif /* VWERASE */
-#if defined(VLNEXT)
-TTYCHAR(VLNEXT, 14)
-#endif /* VLNEXT */
-#if defined(VFLUSH)
-TTYCHAR(VFLUSH, 15)
-#endif /* VFLUSH */
-#ifdef VSWTCH
-TTYCHAR(VSWTCH, 16)
-#endif /* VSWTCH */
-#if defined(VSTATUS)
-TTYCHAR(VSTATUS, 17)
-#endif /* VSTATUS */
-#ifdef VDISCARD
-TTYCHAR(VDISCARD, 18)
-#endif /* VDISCARD */
-
-/* name, field, op */
-TTYMODE(IGNPAR,	c_iflag, 30)
-TTYMODE(PARMRK,	c_iflag, 31)
-TTYMODE(INPCK, 	c_iflag, 32)
-TTYMODE(ISTRIP,	c_iflag, 33)
-TTYMODE(INLCR, 	c_iflag, 34)
-TTYMODE(IGNCR, 	c_iflag, 35)
-TTYMODE(ICRNL, 	c_iflag, 36)
-#if defined(IUCLC)
-TTYMODE(IUCLC, 	c_iflag, 37)
-#endif
-TTYMODE(IXON,  	c_iflag, 38)
-TTYMODE(IXANY, 	c_iflag, 39)
-TTYMODE(IXOFF, 	c_iflag, 40)
-#ifdef IMAXBEL
-TTYMODE(IMAXBEL,c_iflag, 41)
-#endif /* IMAXBEL */
-
-TTYMODE(ISIG,	c_lflag, 50)
-TTYMODE(ICANON,	c_lflag, 51)
-#ifdef XCASE
-TTYMODE(XCASE,	c_lflag, 52)
-#endif
-TTYMODE(ECHO,	c_lflag, 53)
-TTYMODE(ECHOE,	c_lflag, 54)
-TTYMODE(ECHOK,	c_lflag, 55)
-TTYMODE(ECHONL,	c_lflag, 56)
-TTYMODE(NOFLSH,	c_lflag, 57)
-TTYMODE(TOSTOP,	c_lflag, 58)
-#ifdef IEXTEN
-TTYMODE(IEXTEN, c_lflag, 59)
-#endif /* IEXTEN */
-#if defined(ECHOCTL)
-TTYMODE(ECHOCTL,c_lflag, 60)
-#endif /* ECHOCTL */
-#ifdef ECHOKE
-TTYMODE(ECHOKE,	c_lflag, 61)
-#endif /* ECHOKE */
-#if defined(PENDIN)
-TTYMODE(PENDIN,	c_lflag, 62)
-#endif /* PENDIN */
-
-TTYMODE(OPOST,	c_oflag, 70)
-#if defined(OLCUC)
-TTYMODE(OLCUC,	c_oflag, 71)
-#endif
-#ifdef ONLCR
-TTYMODE(ONLCR,	c_oflag, 72)
-#endif
-#ifdef OCRNL
-TTYMODE(OCRNL,	c_oflag, 73)
-#endif
-#ifdef ONOCR
-TTYMODE(ONOCR,	c_oflag, 74)
-#endif
-#ifdef ONLRET
-TTYMODE(ONLRET,	c_oflag, 75)
-#endif
-
-TTYMODE(CS7,	c_cflag, 90)
-TTYMODE(CS8,	c_cflag, 91)
-TTYMODE(PARENB,	c_cflag, 92)
-TTYMODE(PARODD,	c_cflag, 93)
diff --git a/crypto/openssh/uidswap.c b/crypto/openssh/uidswap.c
deleted file mode 100644
index 86c61a4b0182..000000000000
--- a/crypto/openssh/uidswap.c
+++ /dev/null
@@ -1,154 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * Code for uid-swapping.
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: uidswap.c,v 1.23 2002/07/15 17:15:31 stevesk Exp $");
-
-#include "log.h"
-#include "uidswap.h"
-
-/*
- * Note: all these functions must work in all of the following cases:
- *    1. euid=0, ruid=0
- *    2. euid=0, ruid!=0
- *    3. euid!=0, ruid!=0
- * Additionally, they must work regardless of whether the system has
- * POSIX saved uids or not.
- */
-
-#if defined(_POSIX_SAVED_IDS) && !defined(BROKEN_SAVED_UIDS)
-/* Lets assume that posix saved ids also work with seteuid, even though that
-   is not part of the posix specification. */
-#define SAVED_IDS_WORK_WITH_SETEUID
-/* Saved effective uid. */
-static uid_t 	saved_euid = 0;
-static gid_t	saved_egid = 0;
-#endif
-
-/* Saved effective uid. */
-static int	privileged = 0;
-static int	temporarily_use_uid_effective = 0;
-static gid_t	saved_egroups[NGROUPS_MAX], user_groups[NGROUPS_MAX];
-static int	saved_egroupslen = -1, user_groupslen = -1;
-
-/*
- * Temporarily changes to the given uid.  If the effective user
- * id is not root, this does nothing.  This call cannot be nested.
- */
-void
-temporarily_use_uid(struct passwd *pw)
-{
-	/* Save the current euid, and egroups. */
-#ifdef SAVED_IDS_WORK_WITH_SETEUID
-	saved_euid = geteuid();
-	saved_egid = getegid();
-	debug("temporarily_use_uid: %u/%u (e=%u/%u)",
-	    (u_int)pw->pw_uid, (u_int)pw->pw_gid,
-	    (u_int)saved_euid, (u_int)saved_egid);
-	if (saved_euid != 0) {
-		privileged = 0;
-		return;
-	}
-#else
-	if (geteuid() != 0) {
-		privileged = 0;
-		return;
-	}
-#endif /* SAVED_IDS_WORK_WITH_SETEUID */
-
-	privileged = 1;
-	temporarily_use_uid_effective = 1;
-	saved_egroupslen = getgroups(NGROUPS_MAX, saved_egroups);
-	if (saved_egroupslen < 0)
-		fatal("getgroups: %.100s", strerror(errno));
-
-	/* set and save the user's groups */
-	if (user_groupslen == -1) {
-		if (initgroups(pw->pw_name, pw->pw_gid) < 0)
-			fatal("initgroups: %s: %.100s", pw->pw_name,
-			    strerror(errno));
-		user_groupslen = getgroups(NGROUPS_MAX, user_groups);
-		if (user_groupslen < 0)
-			fatal("getgroups: %.100s", strerror(errno));
-	}
-	/* Set the effective uid to the given (unprivileged) uid. */
-	if (setgroups(user_groupslen, user_groups) < 0)
-		fatal("setgroups: %.100s", strerror(errno));
-#ifndef SAVED_IDS_WORK_WITH_SETEUID
-	/* Propagate the privileged gid to all of our gids. */
-	if (setgid(getegid()) < 0)
-		debug("setgid %u: %.100s", (u_int) getegid(), strerror(errno));
-	/* Propagate the privileged uid to all of our uids. */
-	if (setuid(geteuid()) < 0)
-		debug("setuid %u: %.100s", (u_int) geteuid(), strerror(errno));
-#endif /* SAVED_IDS_WORK_WITH_SETEUID */
-	if (setegid(pw->pw_gid) < 0)
-		fatal("setegid %u: %.100s", (u_int)pw->pw_gid,
-		    strerror(errno));
-	if (seteuid(pw->pw_uid) == -1)
-		fatal("seteuid %u: %.100s", (u_int)pw->pw_uid,
-		    strerror(errno));
-}
-
-/*
- * Restores to the original (privileged) uid.
- */
-void
-restore_uid(void)
-{
-	/* it's a no-op unless privileged */
-	if (!privileged) {
-		debug("restore_uid: (unprivileged)");
-		return;
-	}
-	if (!temporarily_use_uid_effective)
-		fatal("restore_uid: temporarily_use_uid not effective");
-
-#ifdef SAVED_IDS_WORK_WITH_SETEUID
-	debug("restore_uid: %u/%u", (u_int)saved_euid, (u_int)saved_egid);
-	/* Set the effective uid back to the saved privileged uid. */
-	if (seteuid(saved_euid) < 0)
-		fatal("seteuid %u: %.100s", (u_int)saved_euid, strerror(errno));
-	if (setegid(saved_egid) < 0)
-		fatal("setegid %u: %.100s", (u_int)saved_egid, strerror(errno));
-#else /* SAVED_IDS_WORK_WITH_SETEUID */
-	/*
-	 * We are unable to restore the real uid to its unprivileged value.
-	 * Propagate the real uid (usually more privileged) to effective uid
-	 * as well.
-	 */
-	setuid(getuid());
-	setgid(getgid());
-#endif /* SAVED_IDS_WORK_WITH_SETEUID */
-
-	if (setgroups(saved_egroupslen, saved_egroups) < 0)
-		fatal("setgroups: %.100s", strerror(errno));
-	temporarily_use_uid_effective = 0;
-}
-
-/*
- * Permanently sets all uids to the given uid.  This cannot be
- * called while temporarily_use_uid is effective.
- */
-void
-permanently_set_uid(struct passwd *pw)
-{
-	if (temporarily_use_uid_effective)
-		fatal("permanently_set_uid: temporarily_use_uid effective");
-	debug("permanently_set_uid: %u/%u", (u_int)pw->pw_uid,
-	    (u_int)pw->pw_gid);
-	if (setgid(pw->pw_gid) < 0)
-		fatal("setgid %u: %.100s", (u_int)pw->pw_gid, strerror(errno));
-	if (setuid(pw->pw_uid) < 0)
-		fatal("setuid %u: %.100s", (u_int)pw->pw_uid, strerror(errno));
-}
diff --git a/crypto/openssh/uidswap.h b/crypto/openssh/uidswap.h
deleted file mode 100644
index 0726980d087d..000000000000
--- a/crypto/openssh/uidswap.h
+++ /dev/null
@@ -1,22 +0,0 @@
-/*	$OpenBSD: uidswap.h,v 1.9 2001/06/26 17:27:25 markus Exp $	*/
-
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#ifndef UIDSWAP_H
-#define UIDSWAP_H
-
-void	 temporarily_use_uid(struct passwd *);
-void	 restore_uid(void);
-void	 permanently_set_uid(struct passwd *);
-
-#endif				/* UIDSWAP_H */
diff --git a/crypto/openssh/util.c b/crypto/openssh/util.c
deleted file mode 100644
index 1a591a6f0f51..000000000000
--- a/crypto/openssh/util.c
+++ /dev/null
@@ -1,96 +0,0 @@
-/*	$OpenBSD: util.c,v 1.6 2000/10/27 07:32:19 markus Exp $	*/
-
-/*
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: util.c,v 1.6 2000/10/27 07:32:19 markus Exp $");
-
-#include "ssh.h"
-
-char *
-chop(char *s)
-{
-	char *t = s;
-	while (*t) {
-		if(*t == '\n' || *t == '\r') {
-			*t = '\0';
-			return s;
-		}
-		t++;
-	}
-	return s;
-
-}
-
-void
-set_nonblock(int fd)
-{
-	int val;
-	val = fcntl(fd, F_GETFL, 0);
-	if (val < 0) {
-		error("fcntl(%d, F_GETFL, 0): %s", fd, strerror(errno));
-		return;
-	}
-	if (val & O_NONBLOCK) {
-		debug("fd %d IS O_NONBLOCK", fd);
-		return;
-	}
-	debug("fd %d setting O_NONBLOCK", fd);
-	val |= O_NONBLOCK;
-	if (fcntl(fd, F_SETFL, val) == -1)
-		if (errno != ENODEV)
-			error("fcntl(%d, F_SETFL, O_NONBLOCK): %s",
-			    fd, strerror(errno));
-}
-
-/* Characters considered whitespace in strsep calls. */
-#define WHITESPACE " \t\r\n"
-
-char *
-strdelim(char **s)
-{
-	char *old;
-	int wspace = 0;
-
-	if (*s == NULL)
-		return NULL;
-
-	old = *s;
-
-	*s = strpbrk(*s, WHITESPACE "=");
-	if (*s == NULL)
-		return (old);
-
-	/* Allow only one '=' to be skipped */
-	if (*s[0] == '=')
-		wspace = 1;
-	*s[0] = '\0';
-
-	*s += strspn(*s + 1, WHITESPACE) + 1;
-	if (*s[0] == '=' && !wspace)
-		*s += strspn(*s + 1, WHITESPACE) + 1;
-
-	return (old);
-}
diff --git a/crypto/openssh/uuencode.c b/crypto/openssh/uuencode.c
deleted file mode 100644
index 21eaf4d3f43e..000000000000
--- a/crypto/openssh/uuencode.c
+++ /dev/null
@@ -1,73 +0,0 @@
-/*
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: uuencode.c,v 1.16 2002/09/09 14:54:15 markus Exp $");
-
-#include "xmalloc.h"
-#include "uuencode.h"
-
-int
-uuencode(u_char *src, u_int srclength,
-    char *target, size_t targsize)
-{
-	return __b64_ntop(src, srclength, target, targsize);
-}
-
-int
-uudecode(const char *src, u_char *target, size_t targsize)
-{
-	int len;
-	char *encoded, *p;
-
-	/* copy the 'readonly' source */
-	encoded = xstrdup(src);
-	/* skip whitespace and data */
-	for (p = encoded; *p == ' ' || *p == '\t'; p++)
-		;
-	for (; *p != '\0' && *p != ' ' && *p != '\t'; p++)
-		;
-	/* and remove trailing whitespace because __b64_pton needs this */
-	*p = '\0';
-	len = __b64_pton(encoded, target, targsize);
-	xfree(encoded);
-	return len;
-}
-
-void
-dump_base64(FILE *fp, u_char *data, u_int len)
-{
-	char *buf = xmalloc(2*len);
-	int i, n;
-
-	n = uuencode(data, len, buf, 2*len);
-	for (i = 0; i < n; i++) {
-		fprintf(fp, "%c", buf[i]);
-		if (i % 70 == 69)
-			fprintf(fp, "\n");
-	}
-	if (i % 70 != 69)
-		fprintf(fp, "\n");
-	xfree(buf);
-}
diff --git a/crypto/openssh/uuencode.h b/crypto/openssh/uuencode.h
deleted file mode 100644
index 682b623acb81..000000000000
--- a/crypto/openssh/uuencode.h
+++ /dev/null
@@ -1,32 +0,0 @@
-/*	$OpenBSD: uuencode.h,v 1.9 2002/02/25 16:33:27 markus Exp $	*/
-
-/*
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef UUENCODE_H
-#define UUENCODE_H
-int	 uuencode(u_char *, u_int, char *, size_t);
-int	 uudecode(const char *, u_char *, size_t);
-void	 dump_base64(FILE *, u_char *, u_int);
-#endif
diff --git a/crypto/openssh/version.h b/crypto/openssh/version.h
deleted file mode 100644
index 75a2b2554c4a..000000000000
--- a/crypto/openssh/version.h
+++ /dev/null
@@ -1,3 +0,0 @@
-/* $OpenBSD: version.h,v 1.37 2003/04/01 10:56:46 markus Exp $ */
-
-#define SSH_VERSION    "OpenSSH_3.6.1p1"
diff --git a/crypto/openssh/xmalloc.c b/crypto/openssh/xmalloc.c
deleted file mode 100644
index 99c6ac3301ae..000000000000
--- a/crypto/openssh/xmalloc.c
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * Versions of malloc and friends that check their results, and never return
- * failure (they call fatal if they encounter an error).
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#include "includes.h"
-RCSID("$OpenBSD: xmalloc.c,v 1.16 2001/07/23 18:21:46 stevesk Exp $");
-
-#include "xmalloc.h"
-#include "log.h"
-
-void *
-xmalloc(size_t size)
-{
-	void *ptr;
-
-	if (size == 0)
-		fatal("xmalloc: zero size");
-	ptr = malloc(size);
-	if (ptr == NULL)
-		fatal("xmalloc: out of memory (allocating %lu bytes)", (u_long) size);
-	return ptr;
-}
-
-void *
-xrealloc(void *ptr, size_t new_size)
-{
-	void *new_ptr;
-
-	if (new_size == 0)
-		fatal("xrealloc: zero size");
-	if (ptr == NULL)
-		new_ptr = malloc(new_size);
-	else
-		new_ptr = realloc(ptr, new_size);
-	if (new_ptr == NULL)
-		fatal("xrealloc: out of memory (new_size %lu bytes)", (u_long) new_size);
-	return new_ptr;
-}
-
-void
-xfree(void *ptr)
-{
-	if (ptr == NULL)
-		fatal("xfree: NULL pointer given as argument");
-	free(ptr);
-}
-
-char *
-xstrdup(const char *str)
-{
-	size_t len;
-	char *cp;
-
-	len = strlen(str) + 1;
-	cp = xmalloc(len);
-	strlcpy(cp, str, len);
-	return cp;
-}
diff --git a/crypto/openssh/xmalloc.h b/crypto/openssh/xmalloc.h
deleted file mode 100644
index 7ac4b13d64c9..000000000000
--- a/crypto/openssh/xmalloc.h
+++ /dev/null
@@ -1,27 +0,0 @@
-/*	$OpenBSD: xmalloc.h,v 1.9 2002/06/19 00:27:55 deraadt Exp $	*/
-
-/*
- * Author: Tatu Ylonen <ylo@cs.hut.fi>
- * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
- *                    All rights reserved
- * Created: Mon Mar 20 22:09:17 1995 ylo
- *
- * Versions of malloc and friends that check their results, and never return
- * failure (they call fatal if they encounter an error).
- *
- * As far as I am concerned, the code I have written for this software
- * can be used freely for any purpose.  Any derived versions of this
- * software must be clearly marked as such, and if the derived work is
- * incompatible with the protocol description in the RFC file, it must be
- * called by a name other than "ssh" or "Secure Shell".
- */
-
-#ifndef XMALLOC_H
-#define XMALLOC_H
-
-void	*xmalloc(size_t);
-void	*xrealloc(void *, size_t);
-void     xfree(void *);
-char	*xstrdup(const char *);
-
-#endif				/* XMALLOC_H */