Updated security/openssh to 5.5.1

Lots of changes, including

 * After a transition period of about 10 years, this release disables
   SSH protocol 1 by default. Clients and servers that need to use the
   legacy protocol must explicitly enable it in ssh_config / sshd_config
   or on the command-line.

 * Remove the libsectok/OpenSC-based smartcard code and add support for
   PKCS#11 tokens. This support is automatically enabled on all
   platforms that support dlopen(3) and was inspired by patches written
   by Alon Bar-Lev. Details in the ssh(1) and ssh-add(1) manpages.

 * Add support for certificate authentication of users and hosts using a
   new, minimal OpenSSH certificate format (not X.509). Certificates
   contain a public key, identity information and some validity
   constraints and are signed with a standard SSH public key using
   ssh-keygen(1). CA keys may be marked as trusted in authorized_keys
   or via a TrustedUserCAKeys option in sshd_config(5) (for user
   authentication), or in known_hosts (for host authentication).

   Documentation for certificate support may be found in ssh-keygen(1),
   sshd(8) and ssh(1) and a description of the protocol extensions in
   PROTOCOL.certkeys.

 * Added a 'netcat mode' to ssh(1): "ssh -W host:port ..." This connects
   stdio on the client to a single port forward on the server. This
   allows, for example, using ssh as a ProxyCommand to route connections
   via intermediate servers. bz#1618

12 files changed, 105 insertions, 144 deletions

diff --git a/security/openssh/Makefile b/security/openssh/Makefile
index 8351220393a..024fce9d76c 100644
--- a/security/openssh/Makefile
+++ b/security/openssh/Makefile
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.196 2010/04/17 10:42:55 zafer Exp $
+# $NetBSD: Makefile,v 1.197 2010/06/11 20:41:41 martti Exp $
 
-DISTNAME=		openssh-5.3p1
-PKGNAME=		openssh-5.3.1
+DISTNAME=		openssh-5.5p1
+PKGNAME=		openssh-5.5.1
 SVR4_PKGNAME=		ossh
 CATEGORIES=		security
 MASTER_SITES=		ftp://ftp.openssh.com/pub/OpenBSD/OpenSSH/portable/ \
@@ -12,7 +12,6 @@ MASTER_SITES=		ftp://ftp.openssh.com/pub/OpenBSD/OpenSSH/portable/ \
 			ftp://ftp.belnet.be/packages/openbsd/OpenSSH/portable/
 # Don't delete the last entry -- it's there if the pkgsrc version is not
 # up-to-date and the mirrors already removed the old distfile.
-DIST_SUBDIR=		${PKGBASE}-5.3.1-20100218
 
 MAINTAINER=		pkgsrc-users@NetBSD.org
 HOMEPAGE=		http://www.openssh.com/
diff --git a/security/openssh/PLIST b/security/openssh/PLIST
index 2d1302747de..ec9da386841 100644
--- a/security/openssh/PLIST
+++ b/security/openssh/PLIST
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.13 2009/06/14 18:13:34 joerg Exp $
+@comment $NetBSD: PLIST,v 1.14 2010/06/11 20:41:41 martti Exp $
 bin/scp
 bin/sftp
 bin/slogin
@@ -9,6 +9,7 @@ bin/ssh-keygen
 bin/ssh-keyscan
 libexec/sftp-server
 libexec/ssh-keysign
+libexec/ssh-pkcs11-helper
 man/man1/scp.1
 man/man1/sftp.1
 man/man1/slogin.1
@@ -22,6 +23,7 @@ man/man5/ssh_config.5
 man/man5/sshd_config.5
 man/man8/sftp-server.8
 man/man8/ssh-keysign.8
+man/man8/ssh-pkcs11-helper.8
 man/man8/sshd.8
 sbin/sshd
 share/examples/openssh/moduli
diff --git a/security/openssh/distinfo b/security/openssh/distinfo
index 7562a927dec..7a789682423 100644
--- a/security/openssh/distinfo
+++ b/security/openssh/distinfo
@@ -1,29 +1,26 @@
-$NetBSD: distinfo,v 1.75 2010/02/19 10:17:33 martti Exp $
+$NetBSD: distinfo,v 1.76 2010/06/11 20:41:41 martti Exp $
 
-SHA1 (openssh-5.3.1-20100218/openssh-5.3p1-hpn13v7.diff.gz) = 724aa137c8c42e89af454ce904845a3a2d9e8ed9
-RMD160 (openssh-5.3.1-20100218/openssh-5.3p1-hpn13v7.diff.gz) = a57c038d6b57a2869295e3000abd50658ebb5b93
-Size (openssh-5.3.1-20100218/openssh-5.3p1-hpn13v7.diff.gz) = 22734 bytes
-SHA1 (openssh-5.3.1-20100218/openssh-5.3p1.tar.gz) = d411fde2584ef6022187f565360b2c63a05602b5
-RMD160 (openssh-5.3.1-20100218/openssh-5.3p1.tar.gz) = f8c98b4b91b7e0e02b33837ef6978e8b7570cf9e
-Size (openssh-5.3.1-20100218/openssh-5.3p1.tar.gz) = 1027130 bytes
-SHA1 (patch-aa) = 94b4427cd6ed2cc4c15728c6721f98b678eafb5d
-SHA1 (patch-ab) = ddb47d597893895314b03bdd13d7e2cb9c4c3b6b
+SHA1 (openssh-5.5p1.tar.gz) = 361c6335e74809b26ea096b34062ba8ff6c97cd6
+RMD160 (openssh-5.5p1.tar.gz) = 7cee614112b691da5daac9f2579becba2409b727
+Size (openssh-5.5p1.tar.gz) = 1097574 bytes
+SHA1 (patch-aa) = 508d47bb19f746acc29d3659f5140ee13cc4f848
+SHA1 (patch-ab) = b93e976f71a358637c6a50bc70073755cbe3e230
 SHA1 (patch-ac) = 5c63cb47ffb556a15f685011bc3291d2219613dc
-SHA1 (patch-ad) = 254e11c5f56a72bf0b30bb8860e45156b3a0adf2
+SHA1 (patch-ad) = a02e5a24fee128d925939785c06f3fa985fc6f2f
 SHA1 (patch-ae) = 4ec1007b03d4bf28ddd1dcfdf2ec7c5295a69df5
 SHA1 (patch-af) = ca3224af0b648803404776a8c12ed678db4f8ff6
-SHA1 (patch-ag) = b91f89ede11f5ed7ba99cfea883ede969796c0ac
-SHA1 (patch-ah) = 0deb24fae95f0a696048d486b11463b380899cb3
+SHA1 (patch-ag) = 385874017f160626d3a95b6ce4a298d442cf9393
+SHA1 (patch-ah) = c8d4b57fd72260e26960ac67d672bebb40759bed
 SHA1 (patch-ai) = becad6262e5daeef2a6db14097a8971c40088403
 SHA1 (patch-aj) = 5c89b4a7da59f05c50c16083aa6dd6e465cd0305
-SHA1 (patch-ak) = 550eae0b47dc220dac2439f57b39b7e4319057c5
+SHA1 (patch-ak) = c718c24c7fd5e2989e40d1a0272faea6434ec578
 SHA1 (patch-al) = ffd15b2ef3cb6b57419c0f6f1f4f795e497382d7
 SHA1 (patch-am) = 4893a8a059d611d35c1fb9ff03b598c590e0355e
-SHA1 (patch-an) = 5b41d9493028dd4dce4a73ea78e43f3a073108e5
-SHA1 (patch-ao) = a02f861855403e4a77323460a2611707d64b2e6b
+SHA1 (patch-an) = bb82f8f7f9d3949fde0d797a4c1253ae402f0311
+SHA1 (patch-ao) = cff08e03d10c32175803c6f09992e4659c3e62bd
 SHA1 (patch-ap) = 5c0ae4dbcdcd50312d1db037867cbaed7c80931d
 SHA1 (patch-aq) = 1a7d8a4c5e70a0c6211247ba583534ed8ce317d0
 SHA1 (patch-ar) = a1099e0175a2b14f3b19db04261891179b1e3299
 SHA1 (patch-au) = 6cfdfc531e2267017a15e66ea48c7ecfa2a3926f
-SHA1 (patch-av) = ef1274ad93846c7af2a6bdeb20ae59044fac0f1b
+SHA1 (patch-av) = 5b4a63dcf8312745253f5c5e68e1d9628ff9e46d
 SHA1 (patch-aw) = 532f2aebcb93cae5e0dd26a5faa1593a7d3a3c51
diff --git a/security/openssh/patches/patch-aa b/security/openssh/patches/patch-aa
index 8bf1e657323..9d5807e3bce 100644
--- a/security/openssh/patches/patch-aa
+++ b/security/openssh/patches/patch-aa
@@ -1,8 +1,8 @@
-$NetBSD: patch-aa,v 1.45 2010/02/19 10:17:33 martti Exp $
+$NetBSD: patch-aa,v 1.46 2010/06/11 20:41:42 martti Exp $
 
---- configure.orig	2009-09-26 09:31:15.000000000 +0300
-+++ configure	2010-02-19 12:06:28.000000000 +0200
-@@ -5997,6 +5997,9 @@
+--- configure.orig	2010-04-16 03:17:11.000000000 +0300
++++ configure	2010-06-09 21:30:29.000000000 +0300
+@@ -5665,6 +5665,9 @@
  fi
  
  
@@ -12,7 +12,7 @@ $NetBSD: patch-aa,v 1.45 2010/02/19 10:17:33 martti Exp $
  # Allow user to specify flags
  
  # Check whether --with-cflags was given.
-@@ -6142,6 +6145,7 @@
+@@ -5810,6 +5813,7 @@
  	maillock.h \
  	ndir.h \
  	net/if_tun.h \
@@ -20,7 +20,7 @@ $NetBSD: patch-aa,v 1.45 2010/02/19 10:17:33 martti Exp $
  	netdb.h \
  	netgroup.h \
  	pam/pam_appl.h \
-@@ -7965,6 +7969,36 @@
+@@ -7660,6 +7664,36 @@
  		;;
  	esac
  	;;
@@ -57,7 +57,7 @@ $NetBSD: patch-aa,v 1.45 2010/02/19 10:17:33 martti Exp $
  *-*-irix5*)
  	PATH="$PATH:/usr/etc"
  
-@@ -8537,7 +8571,7 @@
+@@ -8226,7 +8260,7 @@
  _ACEOF
  
  	;;
@@ -66,33 +66,16 @@ $NetBSD: patch-aa,v 1.45 2010/02/19 10:17:33 martti Exp $
  	check_for_libcrypt_later=1
  
  cat >>confdefs.h <<\_ACEOF
-@@ -30831,14 +30865,21 @@
- rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
- if test -z "$conf_utmpx_location"; then
- 	if test x"$system_utmpx_path" = x"no" ; then
--		cat >>confdefs.h <<\_ACEOF
-+		for f in /var/run/utmpx; do
-+			if test -f $f ; then
-+				conf_utmpx_location=$f
-+			fi
-+		done
-+		if test -z "$conf_utmpx_location"; then
-+			cat >>confdefs.h <<\_ACEOF
- #define DISABLE_UTMPX 1
- _ACEOF
-+		fi
- 
- 	fi
--else
--
--cat >>confdefs.h <<_ACEOF
-+fi
-+if test -n "$conf_utmpx_location"; then
-+	cat >>confdefs.h <<_ACEOF
- #define CONF_UTMPX_FILE "$conf_utmpx_location"
- _ACEOF
- 
-@@ -30903,14 +30944,20 @@
+@@ -12468,7 +12502,7 @@
+ 				LDFLAGS="-L${withval}/lib ${LDFLAGS}"
+ 			fi
+ 		fi
+-		if test "x$use_pkgconfig_for_libedit" == "xyes"; then
++		if test "x$use_pkgconfig_for_libedit" = "xyes"; then
+ 			LIBEDIT=`$PKGCONFIG --libs-only-l libedit`
+ 			CPPFLAGS="$CPPFLAGS `$PKGCONFIG --cflags libedit`"
+ 		else
+@@ -29573,14 +29607,20 @@
  rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
  if test -z "$conf_wtmpx_location"; then
  	if test x"$system_wtmpx_path" = x"no" ; then
@@ -118,7 +101,7 @@ $NetBSD: patch-aa,v 1.45 2010/02/19 10:17:33 martti Exp $
  #define CONF_WTMPX_FILE "$conf_wtmpx_location"
  _ACEOF
  
-@@ -32200,7 +32247,7 @@
+@@ -30888,7 +30930,7 @@
  echo "                     User binaries: $B"
  echo "                   System binaries: $C"
  echo "               Configuration files: $D"
diff --git a/security/openssh/patches/patch-ab b/security/openssh/patches/patch-ab
index 5b27d68ab4f..db3c963f681 100644
--- a/security/openssh/patches/patch-ab
+++ b/security/openssh/patches/patch-ab
@@ -1,7 +1,7 @@
-$NetBSD: patch-ab,v 1.27 2010/02/19 10:17:33 martti Exp $
+$NetBSD: patch-ab,v 1.28 2010/06/11 20:41:42 martti Exp $
 
---- configure.ac.orig	2009-09-11 07:56:08.000000000 +0300
-+++ configure.ac	2010-02-19 12:13:02.000000000 +0200
+--- configure.ac.orig	2010-04-10 15:58:01.000000000 +0300
++++ configure.ac	2010-06-09 21:32:22.000000000 +0300
 @@ -191,6 +191,9 @@
  	]
  )
@@ -20,7 +20,7 @@ $NetBSD: patch-ab,v 1.27 2010/02/19 10:17:33 martti Exp $
  	netdb.h \
  	netgroup.h \
  	pam/pam_appl.h \
-@@ -535,6 +539,15 @@
+@@ -541,6 +545,15 @@
  		;;
  	esac
  	;;
@@ -36,27 +36,16 @@ $NetBSD: patch-ab,v 1.27 2010/02/19 10:17:33 martti Exp $
  *-*-irix5*)
  	PATH="$PATH:/usr/etc"
  	AC_DEFINE(BROKEN_INET_NTOA, 1,
-@@ -4129,9 +4142,17 @@
- )
- if test -z "$conf_utmpx_location"; then
- 	if test x"$system_utmpx_path" = x"no" ; then
--		AC_DEFINE(DISABLE_UTMPX)
-+		for f in /var/run/utmpx; do
-+			if test -f $f ; then
-+				conf_utmpx_location=$f
-+			fi
-+		done
-+		if test -z "$conf_utmpx_location"; then
-+			AC_DEFINE(DISABLE_UTMPX)
-+		fi
- 	fi
--else
-+fi
-+if test -n "$conf_utmpx_location"; then
- 	AC_DEFINE_UNQUOTED(CONF_UTMPX_FILE, "$conf_utmpx_location",
- 		[Define if you want to specify the path to your utmpx file])
- fi
-@@ -4155,9 +4176,17 @@
+@@ -1273,7 +1286,7 @@
+ 				LDFLAGS="-L${withval}/lib ${LDFLAGS}"
+ 			fi
+ 		fi
+-		if test "x$use_pkgconfig_for_libedit" == "xyes"; then
++		if test "x$use_pkgconfig_for_libedit" = "xyes"; then
+ 			LIBEDIT=`$PKGCONFIG --libs-only-l libedit`
+ 			CPPFLAGS="$CPPFLAGS `$PKGCONFIG --cflags libedit`"
+ 		else
+@@ -4106,9 +4119,17 @@
  )
  if test -z "$conf_wtmpx_location"; then
  	if test x"$system_wtmpx_path" = x"no" ; then
@@ -76,7 +65,7 @@ $NetBSD: patch-ab,v 1.27 2010/02/19 10:17:33 martti Exp $
  	AC_DEFINE_UNQUOTED(CONF_WTMPX_FILE, "$conf_wtmpx_location",
  		[Define if you want to specify the path to your wtmpx file])
  fi
-@@ -4204,7 +4233,7 @@
+@@ -4156,7 +4177,7 @@
  echo "                     User binaries: $B"
  echo "                   System binaries: $C"
  echo "               Configuration files: $D"
diff --git a/security/openssh/patches/patch-ad b/security/openssh/patches/patch-ad
index 0e40539f65d..128d71e16f6 100644
--- a/security/openssh/patches/patch-ad
+++ b/security/openssh/patches/patch-ad
@@ -1,8 +1,8 @@
-$NetBSD: patch-ad,v 1.13 2009/05/21 03:22:29 taca Exp $
+$NetBSD: patch-ad,v 1.14 2010/06/11 20:41:42 martti Exp $
 
---- loginrec.c.orig	2009-02-12 11:12:22.000000000 +0900
-+++ loginrec.c
-@@ -431,8 +431,8 @@ login_set_addr(struct logininfo *li, con
+--- loginrec.c.orig	2010-04-09 11:13:27.000000000 +0300
++++ loginrec.c	2010-06-09 21:16:25.000000000 +0300
+@@ -432,8 +432,8 @@ login_set_addr(struct logininfo *li, con
  int
  login_write(struct logininfo *li)
  {
@@ -13,7 +13,7 @@ $NetBSD: patch-ad,v 1.13 2009/05/21 03:22:29 taca Exp $
  		logit("Attempt to write login records by non-root user (aborting)");
  		return (1);
  	}
-@@ -440,7 +440,7 @@ login_write(struct logininfo *li)
+@@ -441,7 +441,7 @@ login_write(struct logininfo *li)
  
  	/* set the timestamp */
  	login_set_current_time(li);
@@ -22,7 +22,7 @@ $NetBSD: patch-ad,v 1.13 2009/05/21 03:22:29 taca Exp $
  	syslogin_write_entry(li);
  #endif
  #ifdef USE_LASTLOG
-@@ -620,7 +620,7 @@ line_abbrevname(char *dst, const char *s
+@@ -625,7 +625,7 @@ line_abbrevname(char *dst, const char *s
   ** into account.
   **/
  
@@ -31,18 +31,18 @@ $NetBSD: patch-ad,v 1.13 2009/05/21 03:22:29 taca Exp $
  
  /* build the utmp structure */
  void
-@@ -757,10 +757,6 @@ construct_utmpx(struct logininfo *li, st
+@@ -762,10 +762,6 @@ construct_utmpx(struct logininfo *li, st
  	set_utmpx_time(li, utx);
  	utx->ut_pid = li->pid;
  
 -	/* strncpy(): Don't necessarily want null termination */
--	strncpy(utx->ut_name, li->username,
--	    MIN_SIZEOF(utx->ut_name, li->username));
+-	strncpy(utx->ut_user, li->username,
+-	    MIN_SIZEOF(utx->ut_user, li->username));
 -
  	if (li->type == LTYPE_LOGOUT)
  		return;
  
-@@ -769,6 +765,8 @@ construct_utmpx(struct logininfo *li, st
+@@ -774,6 +770,8 @@ construct_utmpx(struct logininfo *li, st
  	 * for logouts.
  	 */
  
@@ -51,7 +51,7 @@ $NetBSD: patch-ad,v 1.13 2009/05/21 03:22:29 taca Exp $
  # ifdef HAVE_HOST_IN_UTMPX
  	strncpy(utx->ut_host, li->hostname,
  	    MIN_SIZEOF(utx->ut_host, li->hostname));
-@@ -1398,7 +1396,7 @@ wtmpx_get_entry(struct logininfo *li)
+@@ -1403,7 +1401,7 @@ wtmpx_get_entry(struct logininfo *li)
   ** Low-level libutil login() functions
   **/
  
diff --git a/security/openssh/patches/patch-ag b/security/openssh/patches/patch-ag
index 88bd15b7f07..76aa3e86b4e 100644
--- a/security/openssh/patches/patch-ag
+++ b/security/openssh/patches/patch-ag
@@ -1,8 +1,8 @@
-$NetBSD: patch-ag,v 1.12 2010/02/19 10:17:33 martti Exp $
+$NetBSD: patch-ag,v 1.13 2010/06/11 20:41:42 martti Exp $
 
---- config.h.in.orig	2009-09-26 09:31:14.000000000 +0300
-+++ config.h.in	2010-02-19 12:08:03.000000000 +0200
-@@ -518,6 +518,9 @@
+--- config.h.in.orig	2010-04-16 03:17:09.000000000 +0300
++++ config.h.in	2010-06-09 20:27:35.000000000 +0300
+@@ -521,6 +521,9 @@
  /* define if you have int64_t data type */
  #undef HAVE_INT64_T
  
@@ -12,7 +12,7 @@ $NetBSD: patch-ag,v 1.12 2010/02/19 10:17:33 martti Exp $
  /* Define to 1 if you have the <inttypes.h> header file. */
  #undef HAVE_INTTYPES_H
  
-@@ -638,6 +641,9 @@
+@@ -641,6 +644,9 @@
  /* Define to 1 if you have the <net/if_tun.h> header file. */
  #undef HAVE_NET_IF_TUN_H
  
diff --git a/security/openssh/patches/patch-ah b/security/openssh/patches/patch-ah
index 80635cd7bf4..91aab5b63c9 100644
--- a/security/openssh/patches/patch-ah
+++ b/security/openssh/patches/patch-ah
@@ -1,7 +1,7 @@
-$NetBSD: patch-ah,v 1.27 2010/02/19 10:17:33 martti Exp $
+$NetBSD: patch-ah,v 1.28 2010/06/11 20:41:42 martti Exp $
 
---- Makefile.in.orig	2009-08-28 03:47:38.000000000 +0300
-+++ Makefile.in	2010-02-19 12:08:24.000000000 +0200
+--- Makefile.in.orig	2010-03-13 23:41:34.000000000 +0200
++++ Makefile.in	2010-06-09 20:28:52.000000000 +0300
 @@ -22,7 +22,7 @@
  DESTDIR=
  VPATH=@srcdir@
@@ -10,9 +10,9 @@ $NetBSD: patch-ah,v 1.27 2010/02/19 10:17:33 martti Exp $
 +#ASKPASS_PROGRAM=$(libexecdir)/ssh-askpass
  SFTP_SERVER=$(libexecdir)/sftp-server
  SSH_KEYSIGN=$(libexecdir)/ssh-keysign
- RAND_HELPER=$(libexecdir)/ssh-rand-helper
-@@ -235,7 +235,7 @@
- 	(cd scard && $(MAKE) -f Makefile.in distprep)
+ SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
+@@ -239,7 +239,7 @@
+ 	-rm -rf autom4te.cache
  
  install: $(CONFIGFILES) ssh_prng_cmds.out $(MANPAGES) $(TARGETS) install-files install-sysconf host-key check-config
 -install-nokeys: $(CONFIGFILES) ssh_prng_cmds.out $(MANPAGES) $(TARGETS) install-files install-sysconf
@@ -20,12 +20,3 @@ $NetBSD: patch-ah,v 1.27 2010/02/19 10:17:33 martti Exp $
  install-nosysconf: $(CONFIGFILES) ssh_prng_cmds.out $(MANPAGES) $(TARGETS) install-files
  
  check-config:
-@@ -244,7 +244,7 @@
- scard-install:
- 	(cd scard && env DESTDIR=$(DESTDIR) $(MAKE) DESTDIR=$(DESTDIR) install)
- 
--install-files: scard-install
-+install-files:
- 	$(srcdir)/mkinstalldirs $(DESTDIR)$(bindir)
- 	$(srcdir)/mkinstalldirs $(DESTDIR)$(sbindir)
- 	$(srcdir)/mkinstalldirs $(DESTDIR)$(mandir)
diff --git a/security/openssh/patches/patch-ak b/security/openssh/patches/patch-ak
index a4c009b6204..ac82f89baac 100644
--- a/security/openssh/patches/patch-ak
+++ b/security/openssh/patches/patch-ak
@@ -1,8 +1,8 @@
-$NetBSD: patch-ak,v 1.9 2009/05/21 03:22:29 taca Exp $
+$NetBSD: patch-ak,v 1.10 2010/06/11 20:41:42 martti Exp $
 
---- auth.c.orig	2008-11-05 14:12:54.000000000 +0900
-+++ auth.c
-@@ -378,7 +378,7 @@ check_key_in_hostfiles(struct passwd *pw
+--- auth.c.orig	2010-03-07 02:57:00.000000000 +0200
++++ auth.c	2010-06-09 20:33:47.000000000 +0300
+@@ -384,7 +384,7 @@
  		user_hostfile = tilde_expand_filename(userfile, pw->pw_uid);
  		if (options.strict_modes &&
  		    (stat(user_hostfile, &st) == 0) &&
@@ -11,7 +11,7 @@ $NetBSD: patch-ak,v 1.9 2009/05/21 03:22:29 taca Exp $
  		    (st.st_mode & 022) != 0)) {
  			logit("Authentication refused for %.100s: "
  			    "bad owner or modes for %.200s",
-@@ -431,7 +431,7 @@ secure_filename(FILE *f, const char *fil
+@@ -437,7 +437,7 @@
  
  	/* check the open file to avoid races */
  	if (fstat(fileno(f), &st) < 0 ||
@@ -20,7 +20,7 @@ $NetBSD: patch-ak,v 1.9 2009/05/21 03:22:29 taca Exp $
  	    (st.st_mode & 022) != 0) {
  		snprintf(err, errlen, "bad ownership or modes for file %s",
  		    buf);
-@@ -448,7 +448,7 @@ secure_filename(FILE *f, const char *fil
+@@ -454,7 +454,7 @@
  
  		debug3("secure_filename: checking '%s'", buf);
  		if (stat(buf, &st) < 0 ||
diff --git a/security/openssh/patches/patch-an b/security/openssh/patches/patch-an
index d837aea414e..722e984862f 100644
--- a/security/openssh/patches/patch-an
+++ b/security/openssh/patches/patch-an
@@ -1,8 +1,8 @@
-$NetBSD: patch-an,v 1.10 2009/05/21 03:22:29 taca Exp $
+$NetBSD: patch-an,v 1.11 2010/06/11 20:41:42 martti Exp $
 
---- scp.c.orig	2008-11-03 17:23:45.000000000 +0900
-+++ scp.c
-@@ -390,7 +390,11 @@ main(int argc, char **argv)
+--- scp.c.orig	2010-01-08 09:53:43.000000000 +0200
++++ scp.c	2010-06-09 20:34:26.000000000 +0300
+@@ -395,7 +395,11 @@
  	argc -= optind;
  	argv += optind;
  
@@ -14,7 +14,7 @@ $NetBSD: patch-an,v 1.10 2009/05/21 03:22:29 taca Exp $
  		fatal("unknown user %u", (u_int) userid);
  
  	if (!isatty(STDOUT_FILENO))
-@@ -782,8 +786,10 @@ rsource(char *name, struct stat *statp)
+@@ -789,8 +793,10 @@
  		return;
  	}
  	while ((dp = readdir(dirp)) != NULL) {
@@ -25,7 +25,7 @@ $NetBSD: patch-an,v 1.10 2009/05/21 03:22:29 taca Exp $
  		if (!strcmp(dp->d_name, ".") || !strcmp(dp->d_name, ".."))
  			continue;
  		if (strlen(name) + 1 + strlen(dp->d_name) >= sizeof(path) - 1) {
-@@ -1233,7 +1239,9 @@ okname(char *cp0)
+@@ -1240,7 +1246,9 @@
  			case '\'':
  			case '"':
  			case '`':
diff --git a/security/openssh/patches/patch-ao b/security/openssh/patches/patch-ao
index 01ea164d96e..881f5e0c98b 100644
--- a/security/openssh/patches/patch-ao
+++ b/security/openssh/patches/patch-ao
@@ -1,12 +1,12 @@
-$NetBSD: patch-ao,v 1.15 2010/02/19 10:17:34 martti Exp $
+$NetBSD: patch-ao,v 1.16 2010/06/11 20:41:42 martti Exp $
 
 One more replacing 0 with ROOTUID is handled by using SUBST framework
 because patch can't handle it when hpn-patch option is enabled.
 So, don't simply update this file with mkpatch command.
 
---- session.c.orig	2009-08-20 09:20:50.000000000 +0300
-+++ session.c	2010-02-19 12:09:09.000000000 +0200
-@@ -1066,7 +1066,7 @@
+--- session.c.orig	2010-03-26 02:04:09.000000000 +0200
++++ session.c	2010-06-09 20:35:03.000000000 +0300
+@@ -1071,7 +1071,7 @@
  	if (tmpenv == NULL)
  		return;
  
@@ -15,7 +15,7 @@ So, don't simply update this file with mkpatch command.
  		var = child_get_env(tmpenv, "SUPATH");
  	else
  		var = child_get_env(tmpenv, "PATH");
-@@ -1175,7 +1175,7 @@
+@@ -1180,7 +1180,7 @@
  #  endif /* HAVE_ETC_DEFAULT_LOGIN */
  		if (path == NULL || *path == '\0') {
  			child_set_env(&env, &envsize, "PATH",
@@ -24,7 +24,7 @@ So, don't simply update this file with mkpatch command.
  				SUPERUSER_PATH : _PATH_STDPATH);
  		}
  # endif /* HAVE_CYGWIN */
-@@ -1289,6 +1289,18 @@
+@@ -1294,6 +1294,18 @@
  		    strcmp(pw->pw_dir, "/") ? pw->pw_dir : "");
  		read_environment_file(&env, &envsize, buf);
  	}
@@ -43,7 +43,7 @@ So, don't simply update this file with mkpatch command.
  	if (debug_flag) {
  		/* dump the environment */
  		fprintf(stderr, "Environment:\n");
-@@ -1462,9 +1474,9 @@
+@@ -1473,9 +1485,9 @@
  	(void)ssh_selinux_enabled();
  #endif
  
@@ -55,7 +55,7 @@ So, don't simply update this file with mkpatch command.
  	{
  #ifdef HAVE_LOGIN_CAP
  # ifdef __bsdi__
-@@ -1493,11 +1505,13 @@
+@@ -1504,11 +1516,13 @@
  			perror("setgid");
  			exit(1);
  		}
@@ -69,7 +69,7 @@ So, don't simply update this file with mkpatch command.
  		endgrent();
  # ifdef USE_PAM
  		/*
-@@ -2322,7 +2336,7 @@
+@@ -2356,7 +2370,7 @@
  		record_logout(s->pid, s->tty, s->pw->pw_name);
  
  	/* Release the pseudo-tty. */
diff --git a/security/openssh/patches/patch-av b/security/openssh/patches/patch-av
index e89bdca5ef1..8fc3fe3e7b9 100644
--- a/security/openssh/patches/patch-av
+++ b/security/openssh/patches/patch-av
@@ -1,8 +1,8 @@
-$NetBSD: patch-av,v 1.8 2010/02/19 10:17:34 martti Exp $
+$NetBSD: patch-av,v 1.9 2010/06/11 20:41:42 martti Exp $
 
---- sshd.c.orig	2009-06-21 13:26:17.000000000 +0300
-+++ sshd.c	2010-02-19 12:10:07.000000000 +0200
-@@ -235,7 +235,11 @@
+--- sshd.c.orig	2010-03-07 14:05:17.000000000 +0200
++++ sshd.c	2010-06-09 20:36:56.000000000 +0300
+@@ -236,7 +236,11 @@
  int startup_pipe;		/* in child */
  
  /* variables used for privilege separation */
@@ -14,7 +14,7 @@ $NetBSD: patch-av,v 1.8 2010/02/19 10:17:34 martti Exp $
  struct monitor *pmonitor = NULL;
  
  /* global authentication context */
-@@ -605,10 +609,15 @@
+@@ -612,10 +616,15 @@
  	/* XXX not ready, too heavy after chroot */
  	do_setusercontext(privsep_pw);
  #else
@@ -30,7 +30,7 @@ $NetBSD: patch-av,v 1.8 2010/02/19 10:17:34 martti Exp $
  #endif
  }
  
-@@ -648,7 +657,7 @@
+@@ -655,7 +664,7 @@
  		close(pmonitor->m_sendfd);
  
  		/* Demote the child */
@@ -39,7 +39,7 @@ $NetBSD: patch-av,v 1.8 2010/02/19 10:17:34 martti Exp $
  			privsep_preauth_child();
  		setproctitle("%s", "[net]");
  	}
-@@ -663,7 +672,7 @@
+@@ -670,7 +679,7 @@
  #ifdef DISABLE_FD_PASSING
  	if (1) {
  #else
@@ -48,7 +48,7 @@ $NetBSD: patch-av,v 1.8 2010/02/19 10:17:34 martti Exp $
  #endif
  		/* File descriptor passing is broken or root login */
  		use_privsep = 0;
-@@ -1273,8 +1282,10 @@
+@@ -1310,8 +1319,10 @@
  	av = saved_argv;
  #endif
  
@@ -60,7 +60,7 @@ $NetBSD: patch-av,v 1.8 2010/02/19 10:17:34 martti Exp $
  
  	/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
  	sanitise_stdfd();
-@@ -1578,7 +1589,7 @@
+@@ -1664,7 +1675,7 @@
  		    (st.st_uid != getuid () ||
  		    (st.st_mode & (S_IWGRP|S_IWOTH)) != 0))
  #else
@@ -69,7 +69,7 @@ $NetBSD: patch-av,v 1.8 2010/02/19 10:17:34 martti Exp $
  #endif
  			fatal("%s must be owned by root and not group or "
  			    "world-writable.", _PATH_PRIVSEP_CHROOT_DIR);
-@@ -1602,8 +1613,10 @@
+@@ -1688,8 +1699,10 @@
  	 * to create a file, and we can't control the code in every
  	 * module which might be used).
  	 */