From 674a60748884dc55ee7091b7c23a41240e75f73c Mon Sep 17 00:00:00 2001
From: Matt Johnston <matt@ucc.asn.au>
Date: Tue, 1 Jun 2004 02:46:09 +0000
Subject: Makefile.in contains updated files required

--HG--
extra : convert_revision : cc8a8c49dc70e632c352853a39801089b08149be
---
 dropbearkey.c | 272 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 272 insertions(+)
 create mode 100644 dropbearkey.c

(limited to 'dropbearkey.c')

diff --git a/dropbearkey.c b/dropbearkey.c
new file mode 100644
index 0000000..bc2b1ae
--- /dev/null
+++ b/dropbearkey.c
@@ -0,0 +1,272 @@
+/*
+ * Dropbear - a SSH2 server
+ * 
+ * Copyright (c) 2002,2003 Matt Johnston
+ * All rights reserved.
+ * 
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ * 
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ * 
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE. */
+
+/* The format of the keyfiles is basically a raw dump of the buffer. Data types
+ * are specified in the transport draft - string is a 32-bit len then the
+ * non-null-terminated string, mp_int is a 32-bit len then the bignum data.
+ * The actual functions are buf_put_rsa_priv_key() and buf_put_dss_priv_key()
+
+ * RSA:
+ * string	"ssh-rsa"
+ * mp_int	e
+ * mp_int	n
+ * mp_int	d
+ * mp_int	p (newer versions only)
+ * mp_int	q (newer versions only) 
+ *
+ * DSS:
+ * string	"ssh-dss"
+ * mp_int	p
+ * mp_int	q
+ * mp_int	g
+ * mp_int	y
+ * mp_int	x
+ *
+ */
+#include "includes.h"
+#include "runopts.h"
+#include "signkey.h"
+#include "buffer.h"
+#include "dbutil.h"
+
+#include "genrsa.h"
+#include "gendss.h"
+
+static void printhelp(char * progname);
+
+#define BUF_SIZE 2000
+
+#define RSA_SIZE (1024/8) /* 1024 bit */
+#define DSS_SIZE (1024/8) /* 1024 bit */
+
+static void buf_writefile(buffer * buf, const char * filename);
+
+/* Print a help message */
+static void printhelp(char * progname) {
+
+	fprintf(stderr, "Usage: %s -t <type> -f <filename> [-s bits]\n"
+					"Options are:\n"
+					"-t type           Type of key to generate. One of:\n"
+#ifdef DROPBEAR_RSA
+					"                  rsa\n"
+#endif
+#ifdef DROPBEAR_DSS
+					"                  dss\n"
+#endif
+					"-f filename       Use filename for the secret key\n"
+					"-s bits           Key size in bits, should be "
+					"multiple of 8 (optional)\n",
+					progname);
+}
+
+#if defined(DBMULTI_KEY) || !defined(DROPBEAR_MULTI)
+#if defined(DBMULTI_KEY) && defined(DROPBEAR_MULTI)
+int dropbearkey_main(int argc, char ** argv) {
+#else
+int main(int argc, char ** argv) {
+#endif
+
+	int i;
+	char ** next = 0;
+	sign_key *key;
+	buffer *buf;
+	char * filename = NULL;
+	int keytype = -1;
+	char * typetext = NULL;
+	char * sizetext = NULL;
+	unsigned int bits;
+	unsigned int keysize;
+
+	/* get the commandline options */
+	for (i = 1; i < argc; i++) {
+		if (next) {
+			*next = argv[i];
+			if (*next == NULL) {
+				fprintf(stderr, "Invalid null argument");
+			}
+			next = 0x00;
+			continue;
+		}
+
+		if (argv[i][0] == '-') {
+			switch (argv[i][1]) {
+				case 'f':
+					next = &filename;
+					break;
+				case 't':
+					next = &typetext;
+					break;
+				case 's':
+					next = &sizetext;
+					break;
+				case 'h':
+					printhelp(argv[0]);
+					exit(EXIT_SUCCESS);
+					break;
+				default:
+					fprintf(stderr, "Unknown argument %s\n", argv[i]);
+					printhelp(argv[0]);
+					exit(EXIT_FAILURE);
+					break;
+			}
+		}
+	}
+
+	/* check/parse args */
+	if (!typetext) {
+		fprintf(stderr, "Must specify file type, one of:\n"
+#ifdef DROPBEAR_RSA
+				"rsa\n"
+#endif
+#ifdef DROPBEAR_DSS
+				"dss\n"
+#endif
+				"\n"
+			   );
+		printhelp(argv[0]);
+		exit(EXIT_FAILURE);
+	}
+
+	if (strlen(typetext) == 3) {
+#ifdef DROPBEAR_RSA
+		if (strncmp(typetext, "rsa", 3) == 0) {
+			keytype = DROPBEAR_SIGNKEY_RSA;
+			TRACE(("type is rsa"));
+		}
+#endif
+#ifdef DROPBEAR_DSS
+		if (strncmp(typetext, "dss", 3) == 0) {
+			keytype = DROPBEAR_SIGNKEY_DSS;
+			TRACE(("type is dss"));
+		}
+#endif
+	}
+	if (keytype == -1) {
+		fprintf(stderr, "Unknown key type '%s'\n", typetext);
+		printhelp(argv[0]);
+		exit(EXIT_FAILURE);
+	}
+
+	if (sizetext) {
+		if (sscanf(sizetext, "%u", &bits) != 1) {
+			fprintf(stderr, "Bits must be an integer\n");
+			exit(EXIT_FAILURE);
+		}
+	
+		if (bits < 512 || bits > 4096 || (bits % 8 != 0)) {
+			fprintf(stderr, "Bits must satisfy 512 <= bits <= 4096, and be a"
+					" multiple of 8\n");
+			exit(EXIT_FAILURE);
+		}
+
+		keysize = bits / 8;
+	} else {
+		if (keytype == DROPBEAR_SIGNKEY_DSS) {
+			keysize = DSS_SIZE;
+		} else if (keytype == DROPBEAR_SIGNKEY_RSA) {
+			keysize = RSA_SIZE;
+		} else {
+			exit(EXIT_FAILURE); /* not reached */
+		}
+	}
+
+	if (!filename) {
+		fprintf(stderr, "Must specify a key filename\n");
+		printhelp(argv[0]);
+		exit(EXIT_FAILURE);
+	}
+
+	fprintf(stderr, "Will output %d bit %s secret key to '%s'\n", keysize*8,
+			typetext, filename);
+
+	/* don't want the file readable by others */
+	umask(077);
+
+	/* now we can generate the key */
+	key = new_sign_key();
+	
+	fprintf(stderr, "Generating key, this may take a while...\n");
+	switch(keytype) {
+#ifdef DROPBEAR_RSA
+		case DROPBEAR_SIGNKEY_RSA:
+			key->rsakey = gen_rsa_priv_key(keysize); /* 128 bytes = 1024 bit */
+			break;
+#endif
+#ifdef DROPBEAR_DSS
+		case DROPBEAR_SIGNKEY_DSS:
+			key->dsskey = gen_dss_priv_key(keysize); /* 128 bytes = 1024 bit */
+			break;
+#endif
+		default:
+			fprintf(stderr, "Internal error, bad key type\n");
+			exit(EXIT_FAILURE);
+	}
+
+	buf = buf_new(BUF_SIZE); 
+
+	buf_put_priv_key(buf, key, keytype);
+	buf_setpos(buf, 0);
+	buf_writefile(buf, filename);
+
+	buf_burn(buf);
+	buf_free(buf);
+	sign_key_free(key);
+
+	fprintf(stderr, "Done.\n");
+
+	return EXIT_SUCCESS;
+}
+#endif
+
+/* Write a buffer to a file specified, failing if the file exists */
+static void buf_writefile(buffer * buf, const char * filename) {
+
+	int fd;
+	int len;
+
+	fd = open(filename, O_RDWR | O_CREAT | O_EXCL, S_IRUSR | S_IWUSR);
+	if (fd < 0) {
+		fprintf(stderr, "Couldn't create new file %s\n", filename);
+		perror("Reason");
+		buf_burn(buf);
+		exit(EXIT_FAILURE);
+	}
+
+	/* write the file now */
+	while (buf->pos != buf->len) {
+		len = write(fd, buf_getptr(buf, buf->len - buf->pos),
+				buf->len - buf->pos);
+		if (errno == EINTR) {
+			continue;
+		}
+		if (len <= 0) {
+			fprintf(stderr, "Failed writing file '%s'\n",filename);
+			perror("Reason");
+			exit(EXIT_FAILURE);
+		}
+		buf_incrpos(buf, len);
+	}
+
+	close(fd);
+}
-- 
cgit v1.2.3


From 8b6ddcb06620031611f7482561c88346a1245f57 Mon Sep 17 00:00:00 2001
From: Matt Johnston <matt@ucc.asn.au>
Date: Tue, 27 Jul 2004 14:44:43 +0000
Subject: Switching to the magical new Makefile, and new dbmulti style

--HG--
extra : convert_revision : 3f8efcdd56aab197d30a1ea81527c37dfee2f928
---
 Makefile.in       |  69 ++++++-----
 dbmulti.c         |  21 +++-
 dropbearconvert.c |   4 +-
 dropbearkey.c     |   4 +-
 main.c            | 347 ------------------------------------------------------
 svr-main.c        | 347 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 6 files changed, 405 insertions(+), 387 deletions(-)
 delete mode 100644 main.c
 create mode 100644 svr-main.c

(limited to 'dropbearkey.c')

diff --git a/Makefile.in b/Makefile.in
index de01aff..fcaa6f2 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -10,18 +10,17 @@
 # This makefile is quite evil.
 
 ifndef PROGRAMS
-	PROGRAMS="dropbear dbclient dropbearkey dropbearmulti"
+	PROGRAMS=dropbear dbclient dropbearkey dropbearmulti
 endif
 
 LTC=libtomcrypt/libtomcrypt.a
 LTM=libtommath/libtommath.a
 
-COMMONOBJS=dbutil.o common-session.o packet.o common-algo.o buffer.o \
-		common-kex.o dss.o bignum.o \
-		signkey.o rsa.o random.o common-channel.o \
-		common-chansession.o queue.o termcodes.o  \
-		loginrec.o atomicio.o tcpfwd-direct.o compat.o \
-		tcpfwd-remote.o listener.o process-packet.o common-runopts.o
+COMMONOBJS=dbutil.o buffer.o \
+		dss.o bignum.o \
+		signkey.o rsa.o random.o \
+		queue.o \
+		atomicio.o compat.o 
 
 SVROBJS=svr-kex.o svr-algo.o svr-auth.o sshpty.o \
 		svr-authpasswd.o svr-authpubkey.o svr-session.o svr-service.o \
@@ -30,9 +29,12 @@ SVROBJS=svr-kex.o svr-algo.o svr-auth.o sshpty.o \
 CLIOBJS=cli-algo.o cli-main.o cli-auth.o cli-authpasswd.o cli-kex.o \
 		cli-session.o cli-service.o
 
-DROPBEAROBJS=
+CLISVROBJS=common-session.o packet.o common-algo.o common-kex.o \
+			common-channel.o common-chansession.o termcodes.o loginrec.o \
+			tcpfwd-direct.o tcpfwd-remote.o listener.o process-packet.o \
+			common-runopts.o
 
-DROPBEARKEYOBJS=dropbearkey.o gendss.o genrsa.o
+KEYOBJS=dropbearkey.o gendss.o genrsa.o
 
 CONVERTOBJS=dropbearconvert.o keyimport.o
 
@@ -45,8 +47,8 @@ HEADERS=options.h dbutil.h session.h packet.h algo.h ssh.h buffer.h kex.h \
 		loginrec.h atomicio.h x11fwd.h agentfwd.h tcpfwd-direct.h compat.h \
 		tcpfwd-remote.h listener.h
 
-dropbearobjs=$(COMMONOBJS) $(SVROBJS) 
-dbclientobjs=$(COMMONOBJS) $(CLIOBJS)
+dropbearobjs=$(COMMONOBJS) $(CLISVROBJS) $(SVROBJS) 
+dbclientobjs=$(COMMONOBJS) $(CLISVROBJS) $(CLIOBJS)
 dropbearkeyobjs=$(COMMONOBJS) $(KEYOBJS)
 dropbearconvertobjs=$(COMMONOBJS) $(CONVERTOBJS)
 scpobjs=$(SCPOBJS)
@@ -57,7 +59,7 @@ bindir=${exec_prefix}/bin
 sbindir=${exec_prefix}/sbin
 
 CC=@CC@
-LD=@CC@
+LD=@LD@
 AR=@AR@
 RANLIB=@RANLIB@
 STRIP=@STRIP@
@@ -69,17 +71,15 @@ LDFLAGS=@LDFLAGS@
 EXEEXT=@EXEEXT@
 
 # whether we're building client, server, or both for the common objects.
-space:= $(empty) $(empty)
-CLISVRFLAGS=
 # evilness so we detect 'dropbear' by itself as a word
-ifneq (,$(findstring $(space)dropbear$(space), $(space)$(PROGRAMS)$(space)))
-	CLISVRFLAGS+= -DDROPBEAR_SERVER
+space:= $(empty) $(empty)
+ifneq (,$(strip $(foreach prog, $(PROGRAMS), $(findstring ZdropbearZ, Z$(prog)Z))))
+	CFLAGS+= -DDROPBEAR_SERVER
 endif
-ifneq (,$(findstring $(space)dbclient$(space), $(space)$(PROGRAMS)$(space)))
-	CLISVRFLAGS+= -DDROPBEAR_CLIENT
+ifneq (,$(strip $(foreach prog, $(PROGRAMS), $(findstring ZdbclientZ, Z$(prog)Z))))
+	CFLAGS+= -DDROPBEAR_CLIENT
 endif
 
-CFLAGS+=$(CLISVRFLAGS)
 
 # these are exported so that libtomcrypt's makefile will use them
 export CC
@@ -108,12 +108,15 @@ endif
 #%: $(HEADERS) Makefile
 # TODO
 
+all: $(TARGETS)
 
-strip: $(TARGETS)
-	$(STRIP) $(foreach prog, $(TARGETS), $(SPREFIX)$(prog)$(EXEEXT))
+test:
+	 @echo Z$(sort $(foreach prog, $(PROGRAMS), $($(prog)objs)))Z
 
+strip: $(TARGETS)
+	$(STRIP) $(addsuffix $(EXEEXT), $(addprefix $(SPREFIX), $(TARGETS)))
 
-install: $(foreach prog, $(TARGETS), install$prog)
+install: $(addprefix install, $(TARGETS))
 
 # dropbear should go in sbin, so it needs a seperate rule
 installdropbear: dropbear
@@ -128,33 +131,39 @@ install%: $*
 	-chown root $(DESTDIR)$(sbindir)/$(SPREFIX)$*$(EXEEXT)
 	-chgrp 0 $(DESTDIR)$(sbindir)/$(SPREFIX)$*$(EXEEXT)
 	ifeq ($(MULTI), 1)
+		@echo 
 		@echo "You must manually create links for $*"
 	endif
 
 
 
-# The actual binaries
+# for some reason the rule further down doesn't like $($@objs) as a prereq.
 dropbear: $(dropbearobjs)
+dbclient: $(dbclientobjs)
+dropbearkey: $(dropbearkeyobjs)
+dropbearconvert: $(dropbearconvertobjs)
 
-dropbear dbclient dropbearkey dropbearconvert: $($($@objs)) $(HEADERS) \
-														$(LTC) $(LTM)
-	@echo $(CLISVRFLAGS)
+dropbear dbclient dropbearkey dropbearconvert: $(HEADERS)  $(LTC) $(LTM)
 	$(LD) $(LDFLAGS) -o $(SPREFIX)$@$(EXEEXT) $($@objs) $(LIBS)
 
-
 # scp doesn't use the libs so is special.
 scp: $(SCPOBJS)  $(HEADERS)
 	$(LD) $(LDFLAGS) -o $(SPREFIX)$@$(EXEEXT) $(SCPOBJS)
 
 
-MULTIOBJS=dbmulti.o
+# multi-binary compilation.
+MULTIOBJS=
 ifeq ($(MULTI),1)
-	deftarget=multi
-	MULTIOBJS=$(foreach prog, $(PROGRAMS), $($(prog)objs))
+	MULTIOBJS=dbmulti.o $(sort $(foreach prog, $(PROGRAMS), $($(prog)objs)))
+	CFLAGS+=$(addprefix -DDBMULTI_, $(PROGRAMS)) -DDROPBEAR_MULTI
 endif
 
+testfoo:
+	echo $(MULTIOBJS)
+
 dropbearmulti: $(HEADERS) $(MULTIOBJS) $(LTC) $(LTM)
 	$(LD) $(LDFLAGS) -o $(SPREFIX)$@$(EXEEXT) $(MULTIOBJS) $(LIBS)
+	@echo
 	@echo "You should now create symlinks to the programs you have included"
 	@echo "ie 'ln -s dropbearmulti dropbear'"
 
diff --git a/dbmulti.c b/dbmulti.c
index d82eff0..8f39227 100644
--- a/dbmulti.c
+++ b/dbmulti.c
@@ -4,6 +4,7 @@
 int dropbear_main(int argc, char ** argv);
 int dropbearkey_main(int argc, char ** argv);
 int dropbearconvert_main(int argc, char ** argv);
+int scp_main(int argc, char ** argv);
 
 int main(int argc, char ** argv) {
 
@@ -13,33 +14,41 @@ int main(int argc, char ** argv) {
 		/* figure which form we're being called as */
 		progname = basename(argv[0]);
 
-#ifdef DBMULTI_DROPBEAR
+#ifdef DBMULTI_dropbear
 		if (strcmp(progname, "dropbear") == 0) {
 			return dropbear_main(argc, argv);
 		}
 #endif
-#ifdef DBMULTI_KEY
+#ifdef DBMULTI_dropbearkey
 		if (strcmp(progname, "dropbearkey") == 0) {
 			return dropbearkey_main(argc, argv);
 		}
 #endif
-#ifdef DBMULTI_CONVERT
+#ifdef DBMULTI_dropbearconvert
 		if (strcmp(progname, "dropbearconvert") == 0) {
 			return dropbearconvert_main(argc, argv);
 		}
+#endif
+#ifdef DBMULTI_scp
+		if (strcmp(progname, "scp") == 0) {
+			return scp_main(argc, argv);
+		}
 #endif
 	}
 
 	fprintf(stderr, "Dropbear multi-purpose version %s\n"
 			"Make a symlink pointing at this binary with one of the following names:\n"
-#ifdef DBMULTI_DROPBEAR
+#ifdef DBMULTI_dropbear
 			"'dropbear' - the Dropbear server\n"
 #endif
-#ifdef DBMULTI_KEY
+#ifdef DBMULTI_dropbearkey
 			"'dropbearkey' - the key generator\n"
 #endif
-#ifdef DBMULTI_CONVERT
+#ifdef DBMULTI_dropbearconvert
 			"'dropbearconvert' - the key converter\n"
+#endif
+#ifdef DBMULTI_scp
+			"'scp' - secure copy\n"
 #endif
 			,
 			DROPBEAR_VERSION);
diff --git a/dropbearconvert.c b/dropbearconvert.c
index 0929ba8..3ceccff 100644
--- a/dropbearconvert.c
+++ b/dropbearconvert.c
@@ -53,8 +53,8 @@ static void printhelp(char * progname) {
 					"standard input or standard output.\n", progname);
 }
 
-#if defined(DBMULTI_CONVERT) || !defined(DROPBEAR_MULTI)
-#if defined(DBMULTI_CONVERT) && defined(DROPBEAR_MULTI)
+#if defined(DBMULTI_dropbearconvert) || !defined(DROPBEAR_MULTI)
+#if defined(DBMULTI_dropbearconvert) && defined(DROPBEAR_MULTI)
 int dropbearconvert_main(int argc, char ** argv) {
 #else 
 int main(int argc, char ** argv) {
diff --git a/dropbearkey.c b/dropbearkey.c
index bc2b1ae..eac0823 100644
--- a/dropbearkey.c
+++ b/dropbearkey.c
@@ -80,8 +80,8 @@ static void printhelp(char * progname) {
 					progname);
 }
 
-#if defined(DBMULTI_KEY) || !defined(DROPBEAR_MULTI)
-#if defined(DBMULTI_KEY) && defined(DROPBEAR_MULTI)
+#if defined(DBMULTI_dropbearkey) || !defined(DROPBEAR_MULTI)
+#if defined(DBMULTI_dropbearkey) && defined(DROPBEAR_MULTI)
 int dropbearkey_main(int argc, char ** argv) {
 #else
 int main(int argc, char ** argv) {
diff --git a/main.c b/main.c
deleted file mode 100644
index 0ef1e62..0000000
--- a/main.c
+++ /dev/null
@@ -1,347 +0,0 @@
-/*
- * Dropbear - a SSH2 server
- * 
- * Copyright (c) 2002,2003 Matt Johnston
- * All rights reserved.
- * 
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- * 
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- * 
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE. */
-
-#include "includes.h"
-#include "dbutil.h"
-#include "session.h"
-#include "buffer.h"
-#include "signkey.h"
-#include "runopts.h"
-
-static int listensockets(int *sock, int *maxfd);
-static void sigchld_handler(int dummy);
-static void sigsegv_handler(int);
-static void sigintterm_handler(int fish);
-
-static int childpipes[MAX_UNAUTH_CLIENTS];
-
-#if defined(DBMULTI_DROPBEAR) || !defined(DROPBEAR_MULTI)
-#if defined(DBMULTI_DROPBEAR) && defined(DROPBEAR_MULTI)
-int dropbear_main(int argc, char ** argv)
-#else
-int main(int argc, char ** argv)
-#endif
-{
-	
-	fd_set fds;
-	struct timeval seltimeout;
-	unsigned int i, j;
-	int val;
-	int maxsock = -1;
-	struct sockaddr remoteaddr;
-	int remoteaddrlen;
-	int listensocks[MAX_LISTEN_ADDR];
-	unsigned int listensockcount = 0;
-	FILE * pidfile;
-
-	int childsock;
-	pid_t childpid;
-	int childpipe[2];
-
-	struct sigaction sa_chld;
-
-	_dropbear_exit = svr_dropbear_exit;
-	_dropbear_log = svr_dropbear_log;
-
-	/* get commandline options */
-	svr_getopts(argc, argv);
-
-	/* fork */
-	if (svr_opts.forkbg) {
-		int closefds = 0;
-#ifndef DEBUG_TRACE
-		if (!svr_opts.usingsyslog) {
-			closefds = 1;
-		}
-#endif
-		if (daemon(0, closefds) < 0) {
-			dropbear_exit("Failed to create background process: %s",
-					strerror(errno));
-		}
-	}
-
-#ifndef DISABLE_SYSLOG
-	if (svr_opts.usingsyslog) {
-		startsyslog();
-	}
-#endif
-
-	/* should be done after syslog is working */
-	if (svr_opts.forkbg) {
-		dropbear_log(LOG_INFO, "Running in background");
-	} else {
-		dropbear_log(LOG_INFO, "Not forking");
-	}
-
-	/* create a PID file so that we can be killed easily */
-	pidfile = fopen(DROPBEAR_PIDFILE, "w");
-	if (pidfile) {
-		fprintf(pidfile, "%d\n", getpid());
-		fclose(pidfile);
-	}
-
-	/* set up cleanup handler */
-	if (signal(SIGINT, sigintterm_handler) == SIG_ERR || 
-#ifndef DEBUG_VALGRIND
-		signal(SIGTERM, sigintterm_handler) == SIG_ERR ||
-#endif
-		signal(SIGPIPE, SIG_IGN) == SIG_ERR) {
-		dropbear_exit("signal() error");
-	}
-
-	/* catch and reap zombie children */
-	sa_chld.sa_handler = sigchld_handler;
-	sa_chld.sa_flags = SA_NOCLDSTOP;
-	if (sigaction(SIGCHLD, &sa_chld, NULL) < 0) {
-		dropbear_exit("signal() error");
-	}
-	if (signal(SIGSEGV, sigsegv_handler) == SIG_ERR) {
-		dropbear_exit("signal() error");
-	}
-
-	/* sockets to identify pre-authenticated clients */
-	for (i = 0; i < MAX_UNAUTH_CLIENTS; i++) {
-		childpipes[i] = -1;
-	}
-	
-	/* Set up the listening sockets */
-	/* XXX XXX ports */
-	listensockcount = listensockets(listensocks, &maxsock);
-
-	/* incoming connection select loop */
-	for(;;) {
-
-		FD_ZERO(&fds);
-		
-		seltimeout.tv_sec = 60;
-		seltimeout.tv_usec = 0;
-		
-		/* listening sockets */
-		for (i = 0; i < listensockcount; i++) {
-			FD_SET(listensocks[i], &fds);
-		}
-
-		/* pre-authentication clients */
-		for (i = 0; i < MAX_UNAUTH_CLIENTS; i++) {
-			if (childpipes[i] >= 0) {
-				FD_SET(childpipes[i], &fds);
-				maxsock = MAX(maxsock, childpipes[i]);
-			}
-		}
-
-		val = select(maxsock+1, &fds, NULL, NULL, &seltimeout);
-
-		if (exitflag) {
-			unlink(DROPBEAR_PIDFILE);
-			dropbear_exit("Terminated by signal");
-		}
-		
-		if (val == 0) {
-			/* timeout reached */
-			continue;
-		}
-
-		if (val < 0) {
-			if (errno == EINTR) {
-				continue;
-			}
-			dropbear_exit("Listening socket error");
-		}
-
-		/* close fds which have been authed or closed - auth.c handles
-		 * closing the auth sockets on success */
-		for (i = 0; i < MAX_UNAUTH_CLIENTS; i++) {
-			if (childpipes[i] >= 0 && FD_ISSET(childpipes[i], &fds)) {
-				close(childpipes[i]);
-				childpipes[i] = -1;
-			}
-		}
-
-		/* handle each socket which has something to say */
-		for (i = 0; i < listensockcount; i++) {
-			if (!FD_ISSET(listensocks[i], &fds)) 
-				continue;
-
-			/* child connection XXX - ip6 stuff here */
-			remoteaddrlen = sizeof(struct sockaddr_in);
-			childsock = accept(listensocks[i], &remoteaddr, &remoteaddrlen);
-
-			if (childsock < 0) {
-				/* accept failed */
-				continue;
-			}
-
-			/* check for max number of connections not authorised */
-			for (j = 0; j < MAX_UNAUTH_CLIENTS; j++) {
-				if (childpipes[j] < 0) {
-					break;
-				}
-			}
-
-			if (j == MAX_UNAUTH_CLIENTS) {
-				/* no free connections */
-				/* TODO - possibly log, though this would be an easy way
-				 * to fill logs/disk */
-				close(childsock);
-				continue;
-			}
-
-			if (pipe(childpipe) < 0) {
-				TRACE(("error creating child pipe"));
-				close(childsock);
-				continue;
-			}
-
-			if ((childpid = fork()) == 0) {
-
-				/* child */
-				char * addrstring = NULL;
-#ifdef DEBUG_FORKGPROF
-				extern void _start(void), etext(void);
-				monstartup((u_long)&_start, (u_long)&etext);
-#endif /* DEBUG_FORKGPROF */
-
-				addrstring = getaddrstring(&remoteaddr);
-				dropbear_log(LOG_INFO, "Child connection from %s", addrstring);
-				m_free(addrstring);
-
-				if (setsid() < 0) {
-					dropbear_exit("setsid: %s", strerror(errno));
-				}
-
-				/* make sure we close sockets */
-				for (i = 0; i < listensockcount; i++) {
-					if (m_close(listensocks[i]) == DROPBEAR_FAILURE) {
-						dropbear_exit("Couldn't close socket");
-					}
-				}
-
-				if (m_close(childpipe[0]) == DROPBEAR_FAILURE) {
-					dropbear_exit("Couldn't close socket");
-				}
-
-				/* start the session */
-				svr_session(childsock, childpipe[1], 
-								getaddrhostname(&remoteaddr));
-				/* don't return */
-				assert(0);
-			}
-			
-			/* parent */
-			childpipes[j] = childpipe[0];
-			if (m_close(childpipe[1]) == DROPBEAR_FAILURE
-					|| m_close(childsock) == DROPBEAR_FAILURE) {
-				dropbear_exit("Couldn't close socket");
-			}
-		}
-	} /* for(;;) loop */
-
-	/* don't reach here */
-	return -1;
-}
-#endif
-
-/* catch + reap zombie children */
-static void sigchld_handler(int fish) {
-	struct sigaction sa_chld;
-
-	while(waitpid(-1, NULL, WNOHANG) > 0); 
-
-	sa_chld.sa_handler = sigchld_handler;
-	sa_chld.sa_flags = SA_NOCLDSTOP;
-	if (sigaction(SIGCHLD, &sa_chld, NULL) < 0) {
-		dropbear_exit("signal() error");
-	}
-}
-
-/* catch any segvs */
-static void sigsegv_handler(int fish) {
-	fprintf(stderr, "Aiee, segfault! You should probably report "
-			"this as a bug to the developer\n");
-	exit(EXIT_FAILURE);
-}
-
-/* catch ctrl-c or sigterm */
-static void sigintterm_handler(int fish) {
-
-	exitflag = 1;
-}
-
-/* Set up listening sockets for all the requested ports */
-static int listensockets(int *sock, int *maxfd) {
-	
-	int listensock; /* listening fd */
-	struct sockaddr_in listen_addr;
-	struct linger linger;
-	unsigned int i;
-	int val;
-
-	for (i = 0; i < svr_opts.portcount; i++) {
-
-		/* iterate through all the sockets to listen on */
-		listensock = socket(PF_INET, SOCK_STREAM, 0);
-		if (listensock < 0) {
-			dropbear_exit("Failed to create socket");
-		}
-
-		val = 1;
-		/* set to reuse, quick timeout */
-		setsockopt(listensock, SOL_SOCKET, SO_REUSEADDR,
-				(void*) &val, sizeof(val));
-		linger.l_onoff = 1;
-		linger.l_linger = 5;
-		setsockopt(listensock, SOL_SOCKET, SO_LINGER,
-				(void*)&linger, sizeof(linger));
-
-		/* disable nagle */
-		setsockopt(listensock, IPPROTO_TCP, TCP_NODELAY,
-				(void*)&val, sizeof(val));
-
-		memset((void*)&listen_addr, 0x0, sizeof(listen_addr));
-		listen_addr.sin_family = AF_INET;
-		listen_addr.sin_port = htons(svr_opts.ports[i]);
-		listen_addr.sin_addr.s_addr = htonl(INADDR_ANY);
-		memset(&(listen_addr.sin_zero), '\0', 8);
-
-		if (bind(listensock, (struct sockaddr *)&listen_addr,
-					sizeof(listen_addr)) < 0) {
-			dropbear_exit("Bind failed port %d", svr_opts.ports[i]);
-		}
-
-		/* listen */
-		if (listen(listensock, 20) < 0) { /* TODO set listen count */
-			dropbear_exit("Listen failed");
-		}
-
-		/* nonblock */
-		if (fcntl(listensock, F_SETFL, O_NONBLOCK) < 0) {
-			dropbear_exit("Failed to set non-blocking");
-		}
-
-		sock[i] = listensock;
-		*maxfd = MAX(listensock, *maxfd);
-	}
-
-	return svr_opts.portcount;
-}
diff --git a/svr-main.c b/svr-main.c
new file mode 100644
index 0000000..312e47c
--- /dev/null
+++ b/svr-main.c
@@ -0,0 +1,347 @@
+/*
+ * Dropbear - a SSH2 server
+ * 
+ * Copyright (c) 2002,2003 Matt Johnston
+ * All rights reserved.
+ * 
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ * 
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ * 
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE. */
+
+#include "includes.h"
+#include "dbutil.h"
+#include "session.h"
+#include "buffer.h"
+#include "signkey.h"
+#include "runopts.h"
+
+static int listensockets(int *sock, int *maxfd);
+static void sigchld_handler(int dummy);
+static void sigsegv_handler(int);
+static void sigintterm_handler(int fish);
+
+static int childpipes[MAX_UNAUTH_CLIENTS];
+
+#if defined(DBMULTI_dropbear) || !defined(DROPBEAR_MULTI)
+#if defined(DBMULTI_dropbear) && defined(DROPBEAR_MULTI)
+int dropbear_main(int argc, char ** argv)
+#else
+int main(int argc, char ** argv)
+#endif
+{
+	
+	fd_set fds;
+	struct timeval seltimeout;
+	unsigned int i, j;
+	int val;
+	int maxsock = -1;
+	struct sockaddr remoteaddr;
+	int remoteaddrlen;
+	int listensocks[MAX_LISTEN_ADDR];
+	unsigned int listensockcount = 0;
+	FILE * pidfile;
+
+	int childsock;
+	pid_t childpid;
+	int childpipe[2];
+
+	struct sigaction sa_chld;
+
+	_dropbear_exit = svr_dropbear_exit;
+	_dropbear_log = svr_dropbear_log;
+
+	/* get commandline options */
+	svr_getopts(argc, argv);
+
+	/* fork */
+	if (svr_opts.forkbg) {
+		int closefds = 0;
+#ifndef DEBUG_TRACE
+		if (!svr_opts.usingsyslog) {
+			closefds = 1;
+		}
+#endif
+		if (daemon(0, closefds) < 0) {
+			dropbear_exit("Failed to create background process: %s",
+					strerror(errno));
+		}
+	}
+
+#ifndef DISABLE_SYSLOG
+	if (svr_opts.usingsyslog) {
+		startsyslog();
+	}
+#endif
+
+	/* should be done after syslog is working */
+	if (svr_opts.forkbg) {
+		dropbear_log(LOG_INFO, "Running in background");
+	} else {
+		dropbear_log(LOG_INFO, "Not forking");
+	}
+
+	/* create a PID file so that we can be killed easily */
+	pidfile = fopen(DROPBEAR_PIDFILE, "w");
+	if (pidfile) {
+		fprintf(pidfile, "%d\n", getpid());
+		fclose(pidfile);
+	}
+
+	/* set up cleanup handler */
+	if (signal(SIGINT, sigintterm_handler) == SIG_ERR || 
+#ifndef DEBUG_VALGRIND
+		signal(SIGTERM, sigintterm_handler) == SIG_ERR ||
+#endif
+		signal(SIGPIPE, SIG_IGN) == SIG_ERR) {
+		dropbear_exit("signal() error");
+	}
+
+	/* catch and reap zombie children */
+	sa_chld.sa_handler = sigchld_handler;
+	sa_chld.sa_flags = SA_NOCLDSTOP;
+	if (sigaction(SIGCHLD, &sa_chld, NULL) < 0) {
+		dropbear_exit("signal() error");
+	}
+	if (signal(SIGSEGV, sigsegv_handler) == SIG_ERR) {
+		dropbear_exit("signal() error");
+	}
+
+	/* sockets to identify pre-authenticated clients */
+	for (i = 0; i < MAX_UNAUTH_CLIENTS; i++) {
+		childpipes[i] = -1;
+	}
+	
+	/* Set up the listening sockets */
+	/* XXX XXX ports */
+	listensockcount = listensockets(listensocks, &maxsock);
+
+	/* incoming connection select loop */
+	for(;;) {
+
+		FD_ZERO(&fds);
+		
+		seltimeout.tv_sec = 60;
+		seltimeout.tv_usec = 0;
+		
+		/* listening sockets */
+		for (i = 0; i < listensockcount; i++) {
+			FD_SET(listensocks[i], &fds);
+		}
+
+		/* pre-authentication clients */
+		for (i = 0; i < MAX_UNAUTH_CLIENTS; i++) {
+			if (childpipes[i] >= 0) {
+				FD_SET(childpipes[i], &fds);
+				maxsock = MAX(maxsock, childpipes[i]);
+			}
+		}
+
+		val = select(maxsock+1, &fds, NULL, NULL, &seltimeout);
+
+		if (exitflag) {
+			unlink(DROPBEAR_PIDFILE);
+			dropbear_exit("Terminated by signal");
+		}
+		
+		if (val == 0) {
+			/* timeout reached */
+			continue;
+		}
+
+		if (val < 0) {
+			if (errno == EINTR) {
+				continue;
+			}
+			dropbear_exit("Listening socket error");
+		}
+
+		/* close fds which have been authed or closed - auth.c handles
+		 * closing the auth sockets on success */
+		for (i = 0; i < MAX_UNAUTH_CLIENTS; i++) {
+			if (childpipes[i] >= 0 && FD_ISSET(childpipes[i], &fds)) {
+				close(childpipes[i]);
+				childpipes[i] = -1;
+			}
+		}
+
+		/* handle each socket which has something to say */
+		for (i = 0; i < listensockcount; i++) {
+			if (!FD_ISSET(listensocks[i], &fds)) 
+				continue;
+
+			/* child connection XXX - ip6 stuff here */
+			remoteaddrlen = sizeof(struct sockaddr_in);
+			childsock = accept(listensocks[i], &remoteaddr, &remoteaddrlen);
+
+			if (childsock < 0) {
+				/* accept failed */
+				continue;
+			}
+
+			/* check for max number of connections not authorised */
+			for (j = 0; j < MAX_UNAUTH_CLIENTS; j++) {
+				if (childpipes[j] < 0) {
+					break;
+				}
+			}
+
+			if (j == MAX_UNAUTH_CLIENTS) {
+				/* no free connections */
+				/* TODO - possibly log, though this would be an easy way
+				 * to fill logs/disk */
+				close(childsock);
+				continue;
+			}
+
+			if (pipe(childpipe) < 0) {
+				TRACE(("error creating child pipe"));
+				close(childsock);
+				continue;
+			}
+
+			if ((childpid = fork()) == 0) {
+
+				/* child */
+				char * addrstring = NULL;
+#ifdef DEBUG_FORKGPROF
+				extern void _start(void), etext(void);
+				monstartup((u_long)&_start, (u_long)&etext);
+#endif /* DEBUG_FORKGPROF */
+
+				addrstring = getaddrstring(&remoteaddr);
+				dropbear_log(LOG_INFO, "Child connection from %s", addrstring);
+				m_free(addrstring);
+
+				if (setsid() < 0) {
+					dropbear_exit("setsid: %s", strerror(errno));
+				}
+
+				/* make sure we close sockets */
+				for (i = 0; i < listensockcount; i++) {
+					if (m_close(listensocks[i]) == DROPBEAR_FAILURE) {
+						dropbear_exit("Couldn't close socket");
+					}
+				}
+
+				if (m_close(childpipe[0]) == DROPBEAR_FAILURE) {
+					dropbear_exit("Couldn't close socket");
+				}
+
+				/* start the session */
+				svr_session(childsock, childpipe[1], 
+								getaddrhostname(&remoteaddr));
+				/* don't return */
+				assert(0);
+			}
+			
+			/* parent */
+			childpipes[j] = childpipe[0];
+			if (m_close(childpipe[1]) == DROPBEAR_FAILURE
+					|| m_close(childsock) == DROPBEAR_FAILURE) {
+				dropbear_exit("Couldn't close socket");
+			}
+		}
+	} /* for(;;) loop */
+
+	/* don't reach here */
+	return -1;
+}
+#endif
+
+/* catch + reap zombie children */
+static void sigchld_handler(int fish) {
+	struct sigaction sa_chld;
+
+	while(waitpid(-1, NULL, WNOHANG) > 0); 
+
+	sa_chld.sa_handler = sigchld_handler;
+	sa_chld.sa_flags = SA_NOCLDSTOP;
+	if (sigaction(SIGCHLD, &sa_chld, NULL) < 0) {
+		dropbear_exit("signal() error");
+	}
+}
+
+/* catch any segvs */
+static void sigsegv_handler(int fish) {
+	fprintf(stderr, "Aiee, segfault! You should probably report "
+			"this as a bug to the developer\n");
+	exit(EXIT_FAILURE);
+}
+
+/* catch ctrl-c or sigterm */
+static void sigintterm_handler(int fish) {
+
+	exitflag = 1;
+}
+
+/* Set up listening sockets for all the requested ports */
+static int listensockets(int *sock, int *maxfd) {
+	
+	int listensock; /* listening fd */
+	struct sockaddr_in listen_addr;
+	struct linger linger;
+	unsigned int i;
+	int val;
+
+	for (i = 0; i < svr_opts.portcount; i++) {
+
+		/* iterate through all the sockets to listen on */
+		listensock = socket(PF_INET, SOCK_STREAM, 0);
+		if (listensock < 0) {
+			dropbear_exit("Failed to create socket");
+		}
+
+		val = 1;
+		/* set to reuse, quick timeout */
+		setsockopt(listensock, SOL_SOCKET, SO_REUSEADDR,
+				(void*) &val, sizeof(val));
+		linger.l_onoff = 1;
+		linger.l_linger = 5;
+		setsockopt(listensock, SOL_SOCKET, SO_LINGER,
+				(void*)&linger, sizeof(linger));
+
+		/* disable nagle */
+		setsockopt(listensock, IPPROTO_TCP, TCP_NODELAY,
+				(void*)&val, sizeof(val));
+
+		memset((void*)&listen_addr, 0x0, sizeof(listen_addr));
+		listen_addr.sin_family = AF_INET;
+		listen_addr.sin_port = htons(svr_opts.ports[i]);
+		listen_addr.sin_addr.s_addr = htonl(INADDR_ANY);
+		memset(&(listen_addr.sin_zero), '\0', 8);
+
+		if (bind(listensock, (struct sockaddr *)&listen_addr,
+					sizeof(listen_addr)) < 0) {
+			dropbear_exit("Bind failed port %d", svr_opts.ports[i]);
+		}
+
+		/* listen */
+		if (listen(listensock, 20) < 0) { /* TODO set listen count */
+			dropbear_exit("Listen failed");
+		}
+
+		/* nonblock */
+		if (fcntl(listensock, F_SETFL, O_NONBLOCK) < 0) {
+			dropbear_exit("Failed to set non-blocking");
+		}
+
+		sock[i] = listensock;
+		*maxfd = MAX(listensock, *maxfd);
+	}
+
+	return svr_opts.portcount;
+}
-- 
cgit v1.2.3


From 8e1ec24f55be1a9af2595a58bb4b805bebd7fa9d Mon Sep 17 00:00:00 2001
From: Matt Johnston <matt@ucc.asn.au>
Date: Thu, 12 Aug 2004 16:41:58 +0000
Subject: Merging in the changes from 0.41-0.43 main Dropbear tree

--HG--
extra : convert_revision : 4c3428781bc8faf0fd7cadd7099fbd7f4ea386e7
---
 buffer.c                      |   9 +-
 channel.h                     |   3 +
 cli-tcpfwd.c                  |   9 +-
 common-channel.c              |  27 +++++-
 configure.in                  |   2 +-
 dbutil.c                      |   6 +-
 debian/README.runit           |  46 +++++++++
 debian/changelog              |  52 +++++++++++
 debian/control                |  24 +++--
 debian/copyright.in           |   6 +-
 debian/dropbear.README.Debian |  41 +++++++++
 debian/dropbear.conffiles     |   3 +
 debian/dropbear.docs          |   3 +
 debian/dropbear.init          |  60 ++++--------
 debian/dropbear.postinst      |  68 ++++++++++++++
 debian/dropbear.postrm        |  12 +++
 debian/dropbear.prerm         |  11 +++
 debian/implicit               |  79 ++++++++++++++++
 debian/rules                  | 210 +++++++++++++++++-------------------------
 debian/service/log            |   2 +
 debian/service/run            |   3 +
 dropbearkey.c                 |   1 -
 dss.c                         |   4 +-
 gendss.c                      |   1 -
 includes.h                    |   6 +-
 options.h                     |   7 +-
 packet.c                      |   4 +-
 random.c                      |   5 +-
 rsa.c                         |  16 ++--
 signkey.c                     |   4 +-
 svr-agentfwd.c                |   4 +-
 svr-auth.c                    |   4 +-
 svr-authpasswd.c              |   8 +-
 svr-authpubkey.c              |   2 +-
 svr-chansession.c             |  35 +++++--
 svr-tcpfwd.c                  |   9 +-
 svr-x11fwd.c                  |   4 +-
 37 files changed, 554 insertions(+), 236 deletions(-)
 create mode 100644 debian/README.runit
 create mode 100644 debian/dropbear.README.Debian
 create mode 100644 debian/dropbear.conffiles
 create mode 100644 debian/dropbear.docs
 create mode 100644 debian/dropbear.postinst
 create mode 100644 debian/dropbear.postrm
 create mode 100644 debian/dropbear.prerm
 create mode 100644 debian/implicit
 create mode 100644 debian/service/log
 create mode 100644 debian/service/run

(limited to 'dropbearkey.c')

diff --git a/buffer.c b/buffer.c
index 7181fca..df608d9 100644
--- a/buffer.c
+++ b/buffer.c
@@ -34,8 +34,8 @@
 #define BUF_MAX_INCR 1000000000
 #define BUF_MAX_SIZE 1000000000
 
-/* avoid excessively large numbers, > 5000 bit */
-#define BUF_MAX_MPINT (5000 / 8)
+/* avoid excessively large numbers, > ~8192 bits */
+#define BUF_MAX_MPINT (8240 / 8)
 
 /* Create (malloc) a new buffer of size */
 buffer* buf_new(unsigned int size) {
@@ -76,7 +76,8 @@ void buf_burn(buffer* buf) {
 
 }
 
-/* resize a buffer, pos and len will be repositioned if required */
+/* resize a buffer, pos and len will be repositioned if required when
+ * downsizing */
 void buf_resize(buffer *buf, unsigned int newsize) {
 
 	if (newsize > BUF_MAX_SIZE) {
@@ -151,6 +152,8 @@ void buf_incrpos(buffer* buf,  int incr) {
 /* Get a byte from the buffer and increment the pos */
 unsigned char buf_getbyte(buffer* buf) {
 
+	/* This check is really just ==, but the >= allows us to check for the
+	 * assert()able case of pos > len, which should _never_ happen. */
 	if (buf->pos >= buf->len) {
 		dropbear_exit("bad buf_getbyte");
 	}
diff --git a/channel.h b/channel.h
index e1bdae2..2289de1 100644
--- a/channel.h
+++ b/channel.h
@@ -41,6 +41,9 @@
 #define SSH_OPEN_UNKNOWN_CHANNEL_TYPE           3
 #define SSH_OPEN_RESOURCE_SHORTAGE              4
 
+/* Not a real type */
+#define SSH_OPEN_IN_PROGRESS					99
+
 #define MAX_CHANNELS 60 /* simple mem restriction, includes each tcp/x11
 							connection, so can't be _too_ small */
 
diff --git a/cli-tcpfwd.c b/cli-tcpfwd.c
index 52268b9..8d8e605 100644
--- a/cli-tcpfwd.c
+++ b/cli-tcpfwd.c
@@ -120,7 +120,7 @@ static int newtcpforwarded(struct Channel * channel) {
 	struct TCPFwdList * iter = NULL;
 	char portstring[NI_MAXSERV];
 	int sock;
-	int ret = DROPBEAR_FAILURE;
+	int err = SSH_OPEN_ADMINISTRATIVELY_PROHIBITED;
 
 	/* We don't care what address they connected to */
 	buf_eatstring(ses.payload);
@@ -148,6 +148,7 @@ static int newtcpforwarded(struct Channel * channel) {
 	sock = connect_remote(iter->connectaddr, portstring, 1, NULL);
 	if (sock < 0) {
 		TRACE(("leave newtcpdirect: sock failed"));
+		err = SSH_OPEN_CONNECT_FAILED;
 		goto out;
 	}
 
@@ -160,9 +161,9 @@ static int newtcpforwarded(struct Channel * channel) {
 	channel->infd = sock;
 	channel->initconn = 1;
 	
-	ret = DROPBEAR_SUCCESS;
+	err = SSH_OPEN_IN_PROGRESS;
 
 out:
-	TRACE(("leave newtcpdirect: ret %d", ret));
-	return ret;
+	TRACE(("leave newtcpdirect: err %d", err));
+	return err;
 }
diff --git a/common-channel.c b/common-channel.c
index 5079031..64ea466 100644
--- a/common-channel.c
+++ b/common-channel.c
@@ -172,6 +172,7 @@ void channelio(fd_set *readfd, fd_set *writefd) {
 
 	struct Channel *channel;
 	unsigned int i;
+	int ret;
 
 	/* iterate through all the possible channels */
 	for (i = 0; i < ses.chansize; i++) {
@@ -196,8 +197,15 @@ void channelio(fd_set *readfd, fd_set *writefd) {
 		 * see if it has errors */
 		if (channel->infd >= 0 && channel->infd != channel->outfd
 				&& FD_ISSET(channel->infd, readfd)) {
-			int ret;
-			ret = write(channel->infd, NULL, 0);
+			if (channel->initconn) {
+				/* Handling for "in progress" connection - this is needed
+				 * to avoid spinning 100% CPU when we connect to a server
+				 * which doesn't send anything (tcpfwding) */
+				checkinitdone(channel);
+				continue; /* Important not to use the channel after 
+							 checkinitdone(), as it may be NULL */
+			}
+			ret = write(channel->infd, NULL, 0); /* Fake write */
 			if (ret < 0 && errno != EINTR && errno != EAGAIN) {
 				closeinfd(channel);
 			}
@@ -209,9 +217,8 @@ void channelio(fd_set *readfd, fd_set *writefd) {
 				checkinitdone(channel);
 				continue; /* Important not to use the channel after
 							 checkinitdone(), as it may be NULL */
-			} else {
-				writechannel(channel);
 			}
+			writechannel(channel);
 		}
 	
 		/* now handle any of the channel-closing type stuff */
@@ -285,10 +292,14 @@ static void checkinitdone(struct Channel *channel) {
 
 	if (getsockopt(channel->infd, SOL_SOCKET, SO_ERROR, &val, &vallen)
 			|| val != 0) {
+		send_msg_channel_open_failure(channel->remotechan,
+				SSH_OPEN_CONNECT_FAILED, "", "");
 		close(channel->infd);
 		deletechannel(channel);
 		TRACE(("leave checkinitdone: fail"));
 	} else {
+		send_msg_channel_open_confirmation(channel, channel->recvwindow,
+				channel->recvmaxpacket);
 		channel->outfd = channel->infd;
 		channel->initconn = 0;
 		TRACE(("leave checkinitdone: success"));
@@ -489,6 +500,7 @@ static void removechannel(struct Channel * channel) {
 	TRACE(("channel index is %d", channel->index));
 
 	buf_free(channel->writebuf);
+	channel->writebuf = NULL;
 
 	/* close the FDs in case they haven't been done
 	 * yet (ie they were shutdown etc */
@@ -497,6 +509,7 @@ static void removechannel(struct Channel * channel) {
 	if (channel->errfd >= 0) {
 		close(channel->errfd);
 	}
+	channel->typedata = NULL;
 
 	deletechannel(channel);
 
@@ -587,6 +600,7 @@ static void send_msg_channel_data(struct Channel *channel, int isextended,
 			TRACE(("leave send_msg_channel_data: read err %d", channel->index));
 		}
 		buf_free(buf);
+		buf = NULL;
 		return;
 	}
 	buf_incrlen(buf, len);
@@ -601,6 +615,7 @@ static void send_msg_channel_data(struct Channel *channel, int isextended,
 
 	buf_putstring(ses.writepayload, buf_getptr(buf, len), len);
 	buf_free(buf);
+	buf = NULL;
 
 	channel->transwindow -= len;
 
@@ -764,6 +779,10 @@ void recv_msg_channel_open() {
 	if (channel->type->inithandler) {
 		ret = channel->type->inithandler(channel);
 		if (ret > 0) {
+			if (ret == SSH_OPEN_IN_PROGRESS) {
+				/* We'll send the confirmation later */
+				goto cleanup;
+			}
 			errtype = ret;
 			deletechannel(channel);
 			TRACE(("inithandler returned failure %d", ret));
diff --git a/configure.in b/configure.in
index bffd0da..10988c2 100644
--- a/configure.in
+++ b/configure.in
@@ -169,7 +169,7 @@ AC_ARG_ENABLE(shadow,
 # Checks for header files.
 AC_HEADER_STDC
 AC_HEADER_SYS_WAIT
-AC_CHECK_HEADERS([fcntl.h limits.h netinet/in.h netinet/tcp.h stdlib.h string.h sys/socket.h sys/time.h termios.h unistd.h crypt.h pty.h ioctl.h libutil.h libgen.h inttypes.h stropts.h utmp.h utmpx.h lastlog.h paths.h util.h netdb.h sys/dirent.h])
+AC_CHECK_HEADERS([fcntl.h limits.h netinet/in.h netinet/tcp.h stdlib.h string.h sys/socket.h sys/time.h termios.h unistd.h crypt.h pty.h ioctl.h libutil.h libgen.h inttypes.h stropts.h utmp.h utmpx.h lastlog.h paths.h util.h netdb.h])
 
 # Checks for typedefs, structures, and compiler characteristics.
 AC_C_CONST
diff --git a/dbutil.c b/dbutil.c
index 5436cbb..30b5708 100644
--- a/dbutil.c
+++ b/dbutil.c
@@ -121,7 +121,7 @@ void dropbear_trace(const char* format, ...) {
 int dropbear_listen(const char* address, const char* port,
 		int *socks, unsigned int sockcount, char **errstring, int *maxfd) {
 
-	struct addrinfo hints, *res, *res0;
+	struct addrinfo hints, *res = NULL, *res0 = NULL;
 	int err;
 	unsigned int nsock;
 	struct linger linger;
@@ -273,7 +273,7 @@ int connect_remote(const char* remotehost, const char* remoteport,
 		}
 
 		if (connect(sock, res->ai_addr, res->ai_addrlen) < 0) {
-			if (errno == EINPROGRESS) {
+			if (errno == EINPROGRESS && nonblocking) {
 				TRACE(("Connect in progress"));
 				break;
 			} else {
@@ -287,7 +287,7 @@ int connect_remote(const char* remotehost, const char* remoteport,
 		break; /* Success */
 	}
 
-	if (sock < 0) {
+	if (sock < 0 && !(errno == EINPROGRESS && nonblocking)) {
 		/* Failed */
 		if (errstring != NULL && *errstring == NULL) {
 			int len;
diff --git a/debian/README.runit b/debian/README.runit
new file mode 100644
index 0000000..4ac2814
--- /dev/null
+++ b/debian/README.runit
@@ -0,0 +1,46 @@
+Using the dropbear SSH server with runit's services supervision
+---------------------------------------------------------------
+
+The dropbear SSH server is perfectly suited to be run under runit's
+service supervision, and this package already has prepared an adequate
+service directory.  Follow these steps to enable the dropbear service
+using the runit package.
+
+If not yet installed on your system, install the runit package, and make
+sure its service supervision is enabled (it's by default)
+
+ # apt-get install runit
+
+Make sure the dropbear service normally handled through the sysv init
+script is stopped
+
+ # /etc/init.d/dropbear stop
+
+Create the system user ``dropbearlog'' which will run the logger service,
+and own the logs
+
+ # adduser --system --home /var/log/dropbear --no-create-home dropbearlog
+
+Create the log directory and make the newly created system user the owner
+of this directory
+
+ # mkdir -p /var/log/dropbear && chown dropbearlog /var/log/dropbear
+
+Optionally adjust the configuration of the dropbear service by editing the
+run script
+
+ # vi /etc/dropbear/run
+
+Finally enable the service by linking dropbear's service directory to
+/var/service/.  The service will be started within five seconds, and
+automatically at boot time.  The sysv init script is disabled; see the
+runsvctrl(8) program for information on how to control services handled by
+runit.  See the svlogd(8) program on how to configure the log service.
+
+ # ln -s /etc/dropbear /var/service/
+
+Optionally check the status of the service a few seconds later
+
+ # runsvstat -l /var/service/dropbear
+
+ -- Gerrit Pape <pape@smarden.org>, Sun, 16 May 2004 15:52:34 +0000
diff --git a/debian/changelog b/debian/changelog
index cb7253f..d9da388 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,55 @@
+dropbear (0.43-1) unstable; urgency=high
+
+  * New upstream release 0.43
+  * SECURITY: Don't attempt to free uninitialised buffers in DSS verification
+    code
+  * Handle portforwarding to servers which don't send any initial data
+    (Closes: #258426)
+
+ -- Matt Johnston <matt@ucc.asn.au>  Fri, 16 July 2004 17:44:54 +0800
+
+dropbear (0.42-1) unstable; urgency=low
+
+  * New upstream release 0.42
+
+ -- Matt Johnston <matt@ucc.asn.au>  Wed, 16 June 2004 12:44:54 +0800
+
+dropbear (0.41-3) unstable; urgency=low
+
+  * 1st upload to the Debian archive (closes: #216553).
+  * debian/diff/cvs-20040520.diff: new; stable cvs snapshot.
+  * debian/rules: new target patch: apply diffs in debian/diff/, reverse
+    apply in target clean; install man pages.
+  * debian/control: Priority: optional.
+
+ -- Gerrit Pape <pape@smarden.org>  Sun, 23 May 2004 08:32:37 +0000
+
+dropbear (0.41-2) unstable; urgency=low
+
+  * new maintainer.
+  * debian/control: no longer Build-Depends: debhelper; Build-Depends:
+    libz-dev; Standards-Version: 3.6.1.0; Suggests: runit; update
+    descriptions.
+  * debian/rules: stop using debhelper, use implicit rules; cleanup;
+    install dropbearconvert into /usr/lib/dropbear/.
+  * debian/impicit: new; implicit rules.
+  * debian/copyright.in: adapt.
+  * debian/dropbear.init: minor adaptions; test for dropbear service
+    directory.
+  * debian/README.runit: new; how to use dropbear with runit.
+  * debian/README.Debian, debian/docs: rename to debian/dropbear.*.
+  * debian/dropbear.docs: add debian/README.runit
+  * debian/conffiles: rename to debian/dropbear.conffiles; add init
+    script, and run scripts.
+  * debian/postinst: rename to debian/dropbear.postinst; adapt; use
+    invloke-rc.d dropbear start.
+  * debian/dropbear.prerm: new; invoke-rc.d dropbear stop.
+  * debian/postrm: rename to debian/dropbear.postrm; adapt; clean up
+    service directories.
+  * debian/compat, debian/dirs, dropbear.default: remove; obsolete.
+
+ -- Gerrit Pape <pape@smarden.org>  Sun, 16 May 2004 16:50:55 +0000
+
 dropbear (0.41-1) unstable; urgency=low
 
   * Updated to 0.41 release.
diff --git a/debian/control b/debian/control
index e528454..33c717c 100644
--- a/debian/control
+++ b/debian/control
@@ -1,14 +1,20 @@
 Source: dropbear
 Section: net
-Priority: standard
-Maintainer: Grahame Bowland <grahame@angrygoats.net>
-Build-Depends: debhelper (>> 4.0.0), zlib1g-dev
-Standards-Version: 3.5.8
+Priority: optional
+Maintainer: Gerrit Pape <pape@smarden.org>
+Build-Depends: libz-dev
+Standards-Version: 3.6.1.0
 
 Package: dropbear
 Architecture: any
-Depends: ${shlibs:Depends} ${misc:Depends}
-Suggests: ssh
-Description: a minimal SSH2 server
- A small secure shell version 2 server.
-
+Depends: ${shlibs:Depends}
+Suggests: ssh, runit
+Description: lightweight SSH2 server
+ dropbear is a SSH 2 server designed to be small enough to be used in small
+ memory environments, while still being functional and secure enough for
+ general use.
+ .
+ It implements most required features of the SSH 2 protocol, and other
+ features such as X11 and authentication agent forwarding.
+ .
+ See http://matt.ucc.asn.au/dropbear/dropbear.html
diff --git a/debian/copyright.in b/debian/copyright.in
index 015d9ab..79526d3 100644
--- a/debian/copyright.in
+++ b/debian/copyright.in
@@ -1,9 +1,11 @@
 This package was debianized by Grahame Bowland <grahame.angrygoats.net> on
-Tue, 17 Jun 2003 15:04:47 +0800.
+Tue, 17 Jun 2003 15:04:47 +0800, maintained temporarily by Matt Johnston
+<matt@ucc.asn.au>, and was adopted by Gerrit Pape <pape@smarden.org> on
+Sun, 16 May 2004 14:38:33 +0000.
 
 It was downloaded from http://matt.ucc.asn.au/dropbear/
 
-Upstream Author(s): Matt Johnston <matt@ucc.asn.au>
+Upstream Author: Matt Johnston <matt@ucc.asn.au>
 
 Copyright: 
 
diff --git a/debian/dropbear.README.Debian b/debian/dropbear.README.Debian
new file mode 100644
index 0000000..8cdac38
--- /dev/null
+++ b/debian/dropbear.README.Debian
@@ -0,0 +1,41 @@
+Dropbear for Debian
+-------------------
+
+This package will attempt to listen on port 22. If the OpenSSH 
+package ("ssh") is installed, the file /etc/default/dropbear 
+will be set up so that the server does not start by default.
+
+You can run Dropbear concurrently with OpenSSH 'sshd' by 
+modifying /etc/default/dropbear so that "NO_START" is set to 
+"0" and changing the port number that Dropbear runs on. Follow 
+the instructions in the file.
+
+This package suggests you install the "ssh" package. This package 
+provides the "ssh" client program, as well as the "/usr/bin/scp" 
+binary you will need to be able to retrieve files from a server 
+running Dropbear via SCP.
+
+Replacing OpenSSH "sshd" with Dropbear
+--------------------------------------
+
+You will still want to have the "ssh" package installed, as it 
+provides the "ssh" and "scp" binaries. When you install this 
+package, it checks for existing OpenSSH host keys and if found, 
+converts them to the Dropbear format.
+
+If this appears to have worked, you should be able to change over 
+by following these steps:
+
+1. Stop the OpenSSH server
+   % /etc/init.d/ssh stop
+2. Prevent the OpenSSH server from starting in the future
+   % touch /etc/ssh/sshd_not_to_be_run
+3. Modify the Dropbear defaults file, set NO_START to 0 and 
+   ensure DROPBEAR_PORT is set to 22.
+   % editor /etc/default/dropbear
+4. Restart the Dropbear server.
+   % /etc/init.d/dropbear restart
+
+See the Dropbear homepage for more information:
+  http://matt.ucc.asn.au/dropbear/dropbear.html
+
diff --git a/debian/dropbear.conffiles b/debian/dropbear.conffiles
new file mode 100644
index 0000000..6919006
--- /dev/null
+++ b/debian/dropbear.conffiles
@@ -0,0 +1,3 @@
+/etc/init.d/dropbear
+/etc/dropbear/run
+/etc/dropbear/log/run
diff --git a/debian/dropbear.docs b/debian/dropbear.docs
new file mode 100644
index 0000000..599d48c
--- /dev/null
+++ b/debian/dropbear.docs
@@ -0,0 +1,3 @@
+README
+TODO
+debian/README.runit
diff --git a/debian/dropbear.init b/debian/dropbear.init
index 25eda9f..d9578db 100644
--- a/debian/dropbear.init
+++ b/debian/dropbear.init
@@ -1,15 +1,4 @@
-#! /bin/sh
-#
-# skeleton	example file to build /etc/init.d/ scripts.
-#		This file should be used to construct scripts for /etc/init.d.
-#
-#		Written by Miquel van Smoorenburg <miquels@cistron.nl>.
-#		Modified for Debian 
-#		by Ian Murdock <imurdock@gnu.ai.mit.edu>.
-#
-# Version:	@(#)skeleton  1.9  26-Feb-2001  miquels@cistron.nl
-#
-
+#!/bin/sh
 #
 # Do not configure this file. Edit /etc/default/dropbear instead!
 #
@@ -22,54 +11,45 @@ DESC="Dropbear SSH server"
 DROPBEAR_PORT=22
 DROPBEAR_EXTRA_ARGS=
 NO_START=0
-set -e
-test -f /etc/default/dropbear && . /etc/default/dropbear
-
-if [ -n "$DROPBEAR_BANNER" ]; then
-	DROPBEAR_EXTRA_ARGS="$DROPBEAR_EXTRA_ARGS -b $DROPBEAR_BANNER"
-fi
 
-if [ -z "$DROPBEAR_RSAKEY" ]; then
-	DROPBEAR_RSAKEY="/etc/dropbear/dropbear_rsa_host_key"
-fi
-
-if [ -z "$DROPBEAR_DSSKEY" ]; then
-	DROPBEAR_DSSKEY="/etc/dropbear/dropbear_dss_host_key"
-fi
+set -e
 
-test "$NO_START" != "0" && exit 0
+test ! -r /etc/default/dropbear || . /etc/default/dropbear
+test "$NO_START" = "0" || exit 0
+test -x "$DAEMON" || exit 0
+test ! -h /var/service/dropbear || exit 0
 
-test -x $DAEMON || exit 0
+test -z "$DROPBEAR_BANNER" || \
+  DROPBEAR_EXTRA_ARGS="$DROPBEAR_EXTRA_ARGS -b $DROPBEAR_BANNER"
+test -n "$DROPBEAR_RSAKEY" || \
+  DROPBEAR_RSAKEY="/etc/dropbear/dropbear_rsa_host_key"
+test -n "$DROPBEAR_DSSKEY" || \
+  DROPBEAR_DSSKEY="/etc/dropbear/dropbear_dss_host_key"
 
 case "$1" in
   start)
 	echo -n "Starting $DESC: "
-	start-stop-daemon --start --quiet --pidfile /var/run/$NAME.pid \
-		--exec $DAEMON -- -d $DROPBEAR_DSSKEY -r $DROPBEAR_RSAKEY -p $DROPBEAR_PORT $DROPBEAR_EXTRA_ARGS
+	start-stop-daemon --start --quiet --pidfile /var/run/"$NAME".pid \
+	  --exec "$DAEMON" -- -d "$DROPBEAR_DSSKEY" -r "$DROPBEAR_RSAKEY" \
+	    -p "$DROPBEAR_PORT" $DROPBEAR_EXTRA_ARGS
 	echo "$NAME."
 	;;
   stop)
 	echo -n "Stopping $DESC: "
-	start-stop-daemon --stop --quiet --oknodo --pidfile /var/run/$NAME.pid
+	start-stop-daemon --stop --quiet --oknodo --pidfile /var/run/"$NAME".pid
 	echo "$NAME."
 	;;
   restart|force-reload)
-	#
-	#	If the "reload" option is implemented, move the "force-reload"
-	#	option to the "reload" entry above. If not, "force-reload" is
-	#	just the same as "restart".
-	#
 	echo -n "Restarting $DESC: "
-	start-stop-daemon --stop --quiet --oknodo --pidfile \
-		/var/run/$NAME.pid
+	start-stop-daemon --stop --quiet --oknodo --pidfile /var/run/"$NAME".pid
 	sleep 1
-	start-stop-daemon --start --quiet --pidfile /var/run/$NAME.pid \
-		--exec $DAEMON -- -d $DROPBEAR_DSSKEY -r $DROPBEAR_RSAKEY -p $DROPBEAR_PORT $DROPBEAR_EXTRA_ARGS
+	start-stop-daemon --start --quiet --pidfile /var/run/"$NAME".pid \
+	  --exec "$DAEMON" -- -d "$DROPBEAR_DSSKEY" -r "$DROPBEAR_RSAKEY" \
+	    -p "$DROPBEAR_PORT" $DROPBEAR_EXTRA_ARGS
 	echo "$NAME."
 	;;
   *)
 	N=/etc/init.d/$NAME
-	# echo "Usage: $N {start|stop|restart|reload|force-reload}" >&2
 	echo "Usage: $N {start|stop|restart|force-reload}" >&2
 	exit 1
 	;;
diff --git a/debian/dropbear.postinst b/debian/dropbear.postinst
new file mode 100644
index 0000000..749ffd1
--- /dev/null
+++ b/debian/dropbear.postinst
@@ -0,0 +1,68 @@
+#!/bin/sh
+set -e
+
+test "$1" = 'configure' || exit 0
+test -n "$2" || chown log /etc/dropbear/log/main || true
+
+if test ! -e /etc/dropbear/dropbear_rsa_host_key; then
+  if test -f /etc/ssh/ssh_host_rsa_key; then
+    echo "Converting existing OpenSSH RSA host key to Dropbear format."
+    /usr/lib/dropbear/dropbearconvert openssh dropbear \
+      /etc/ssh/ssh_host_rsa_key /etc/dropbear/dropbear_rsa_host_key
+  else
+    echo "Generating Dropbear RSA key. Please wait."
+    dropbearkey -t rsa -f /etc/dropbear/dropbear_rsa_host_key
+  fi
+fi
+if test ! -e /etc/dropbear/dropbear_dss_host_key; then
+  if test -f /etc/ssh/ssh_host_dsa_key; then
+    echo "Converting existing OpenSSH RSA host key to Dropbear format."
+    /usr/lib/dropbear/dropbearconvert openssh dropbear \
+      /etc/ssh/ssh_host_dsa_key /etc/dropbear/dropbear_dss_host_key
+  else
+    echo "Generating Dropbear DSS key. Please wait."
+    dropbearkey -t dss -f /etc/dropbear/dropbear_dss_host_key
+  fi
+fi
+if test ! -s /etc/default/dropbear; then 
+  # check whether OpenSSH seems to be installed.
+  if test -x /usr/sbin/sshd; then
+    cat <<EOT
+OpenSSH appears to be installed.  Setting /etc/default/dropbear so that
+Dropbear will not start by default.  Edit this file to change this behaviour.
+
+EOT
+    cat >>/etc/default/dropbear <<EOT
+# disabled because OpenSSH is installed
+# change to NO_START=0 to enable Dropbear
+NO_START=1
+
+EOT
+  fi
+  cat >>/etc/default/dropbear <<EOT
+# the TCP port that Dropbear listens on
+DROPBEAR_PORT=22
+
+# any additional arguments for Dropbear
+DROPBEAR_EXTRA_ARGS=
+
+# specify an optional banner file containing a message to be
+# sent to clients before they connect, such as "/etc/issue.net"
+DROPBEAR_BANNER=""
+
+# RSA hostkey file (default: /etc/dropbear/dropbear_rsa_host_key)
+#DROPBEAR_RSAKEY="/etc/dropbear/dropbear_rsa_host_key"
+
+# DSS hostkey file (default: /etc/dropbear/dropbear_dss_host_key)
+#DROPBEAR_DSSKEY="/etc/dropbear/dropbear_dss_host_key"
+EOT
+fi
+
+if test -x /etc/init.d/dropbear; then
+  update-rc.d dropbear defaults >/dev/null
+  if test -x /usr/sbin/invoke-rc.d; then
+    invoke-rc.d dropbear start
+  else
+    /etc/init.d/dropbear start
+  fi
+fi
diff --git a/debian/dropbear.postrm b/debian/dropbear.postrm
new file mode 100644
index 0000000..d09dab0
--- /dev/null
+++ b/debian/dropbear.postrm
@@ -0,0 +1,12 @@
+#! /bin/sh
+set -e
+
+test "$1" = 'purge' || exit 0
+if test -e /etc/dropbear; then
+  rm -f /etc/dropbear/dropbear_rsa_host_key
+  rm -f /etc/dropbear/dropbear_dss_host_key
+  rmdir --ignore-fail-on-non-empty /etc/dropbear
+fi
+update-rc.d dropbear remove >/dev/null
+rm -f /etc/default/dropbear
+rm -rf /etc/dropbear/supervise /etc/dropbear/log/supervise
diff --git a/debian/dropbear.prerm b/debian/dropbear.prerm
new file mode 100644
index 0000000..89bb5b6
--- /dev/null
+++ b/debian/dropbear.prerm
@@ -0,0 +1,11 @@
+#!/bin/sh
+set -u
+
+test "$1" = 'remove' || test "$1" = 'deconfigure' || exit 0
+if test -x /etc/init.d/dropbear; then
+  if test -x /usr/sbin/invoke-rc.d; then
+    invoke-rc.d dropbear stop
+  else
+    /etc/init.d/dropbear stop
+  fi
+fi
diff --git a/debian/implicit b/debian/implicit
new file mode 100644
index 0000000..d28b629
--- /dev/null
+++ b/debian/implicit
@@ -0,0 +1,79 @@
+# $Id: implicit,v 1.1 2004/06/16 05:08:32 matt Exp $
+
+.PHONY: deb-checkdir deb-checkuid
+
+deb-checkdir:
+	@test -e debian/control || sh -cx '! : wrong directory'
+deb-checkuid:
+	@test "`id -u`" -eq 0 || sh -cx '! : need root privileges'
+
+%.deb: %.deb-docs %.deb-DEBIAN
+	@rm -f $*.deb $*.deb-checkdir $*.deb-docs $*.deb-docs-base \
+	  $*.deb-docs-docs $*.deb-docs-examples $*.deb-DEBIAN \
+	  $*.deb-DEBIAN-dir $*.deb-DEBIAN-scripts $*.deb-DEBIAN-md5sums
+
+%.deb-checkdir:
+	@test -d debian/$* || sh -cx '! : directory debian/$* missing'
+	@test "`id -u`" -eq 0 || sh -cx '! : need root privileges'
+
+%.deb-docs-base:
+	: implicit
+	@rm -f debian/$*/usr/share/doc/$*/* || :
+	@install -d -m0755 debian/$*/usr/share/doc/$*
+	: debian/$*/usr/share/doc/$*/
+	@sh -cx 'install -m0644 debian/copyright debian/$*/usr/share/doc/$*/'
+	@sh -cx 'install -m0644 debian/changelog \
+	  debian/$*/usr/share/doc/$*/changelog.Debian'
+	@test ! -r changelog || \
+	  sh -cx 'install -m0644 changelog debian/$*/usr/share/doc/$*/'
+	@test -r debian/$*/usr/share/doc/$*/changelog || \
+	  sh -cx 'mv debian/$*/usr/share/doc/$*/changelog.Debian \
+	    debian/$*/usr/share/doc/$*/changelog'
+	@gzip -9 debian/$*/usr/share/doc/$*/changelog*
+%.deb-docs-docs:
+	@for i in `cat debian/$*.docs 2>/dev/null || :`; do \
+	  sh -cx "install -m0644 $$i debian/$*/usr/share/doc/$*/" || exit 1; \
+	done
+	@test ! -r debian/$*.README.Debian || \
+	  sh -cx 'install -m0644 debian/$*.README.Debian \
+	    debian/$*/usr/share/doc/$*/README.Debian'
+	@if test -r debian/$*.NEWS.Debian; then \
+	  sh -cx 'install -m0644 debian/$*.NEWS.Debian \
+	    debian/$*/usr/share/doc/$*/NEWS.Debian && \
+	      gzip -9 debian/$*/usr/share/doc/$*/NEWS.Debian'; \
+	fi
+%.deb-docs-examples:
+	@rm -rf debian/$*/usr/share/doc/$*/examples
+	: debian/$*/usr/share/doc/$*/examples/
+	@test ! -r debian/$*.examples || \
+	  install -d -m0755 debian/$*/usr/share/doc/$*/examples
+	@for i in `cat debian/$*.examples 2>/dev/null || :`; do \
+	  sh -cx "install -m0644 $$i debian/$*/usr/share/doc/$*/examples/" \
+	    || exit 1; \
+	done
+%.deb-docs: %.deb-checkdir %.deb-docs-base %.deb-docs-docs %.deb-docs-examples
+	: debian/$*/usr/share/doc/$*/ ok
+
+%.deb-DEBIAN-base:
+	@rm -rf debian/$*/DEBIAN
+	: debian/$*/DEBIAN/
+	@install -d -m0755 debian/$*/DEBIAN
+	@for i in conffiles shlibs; do \
+	  test ! -r debian/$*.$$i || \
+	    sh -cx "install -m0644 debian/$*.$$i debian/$*/DEBIAN/$$i" \
+	      || exit 1; \
+	done
+%.deb-DEBIAN-scripts:
+	@for i in preinst prerm postinst postrm; do \
+	  test ! -r debian/$*.$$i || \
+	    sh -cx "install -m0755 debian/$*.$$i debian/$*/DEBIAN/$$i" \
+	      || exit 1; \
+	done
+%.deb-DEBIAN-md5sums:
+	: debian/$*/DEBIAN/md5sums
+	@rm -f debian/$*/DEBIAN/md5sums
+	@cd debian/$* && find * -path 'DEBIAN' -prune -o \
+	  -type f -exec md5sum {} >>DEBIAN/md5sums \;
+%.deb-DEBIAN: %.deb-checkdir %.deb-DEBIAN-base %.deb-DEBIAN-scripts \
+	  %.deb-DEBIAN-md5sums
+	: debian/$*/DEBIAN/ ok
diff --git a/debian/rules b/debian/rules
index 4d73093..ee7b14a 100644
--- a/debian/rules
+++ b/debian/rules
@@ -1,134 +1,96 @@
 #!/usr/bin/make -f
-# Sample debian/rules that uses debhelper.
-# GNU copyright 1997 to 1999 by Joey Hess.
-#
-# Modified to make a template file for a multi-binary package with separated
-# build-arch and build-indep targets  by Bill Allombert 2001
 
-# Uncomment this to turn on verbose mode.
-#export DH_VERBOSE=1
+#export DH_OPTIONS
+DEB_HOST_GNU_TYPE ?=$(shell dpkg-architecture -qDEB_HOST_GNU_TYPE)
+DEB_BUILD_GNU_TYPE ?=$(shell dpkg-architecture -qDEB_BUILD_GNU_TYPE)
 
-# This has to be exported to make some magic below work.
-export DH_OPTIONS
-
-# These are used for cross-compiling and for saving the configure script
-# from having to guess our platform (since we know it already)
-DEB_HOST_GNU_TYPE   ?= $(shell dpkg-architecture -qDEB_HOST_GNU_TYPE)
-DEB_BUILD_GNU_TYPE  ?= $(shell dpkg-architecture -qDEB_BUILD_GNU_TYPE)
-
-
-CFLAGS = -Wall -g
+STRIP =strip
+ifneq (,$(findstring nostrip,$(DEB_BUILD_OPTIONS)))
+  STRIP =: nostrip
+endif
 
+CFLAGS =-Wall -g
 ifneq (,$(findstring noopt,$(DEB_BUILD_OPTIONS)))
-	CFLAGS += -O0
+  CFLAGS +=-O0
 else
-	CFLAGS += -O2
-endif
-ifeq (,$(findstring nostrip,$(DEB_BUILD_OPTIONS)))
-	INSTALL_PROGRAM += -s
+  CFLAGS +=-O2
 endif
 
-config.status: configure
-	dh_testdir
-	# Add here commands to configure the package.
-	CFLAGS='-DSFTPSERVER_PATH="\"/usr/lib/sftp-server\""' ./configure --host=$(DEB_HOST_GNU_TYPE) --build=$(DEB_BUILD_GNU_TYPE) --prefix=/usr --mandir=\$${prefix}/share/man --infodir=\$${prefix}/share/info
-
-
-#Architecture 
-build: build-arch #build-indep
-
-build-arch: build-arch-stamp
-build-arch-stamp:  config.status
-	
-	# Add here commands to compile the arch part of the package.
-	$(MAKE) CC=gcc LD=gcc
-
-build-indep: build-indep-stamp
-build-indep-stamp:  config.status
-	
-	# Add here commands to compile the indep part of the package.
-	#$(MAKE) doc
-
-clean:
-	dh_testdir
-	dh_testroot
-	rm -f build-arch-stamp build-indep-stamp config-stamp
-
-	# Add here commands to clean up after the build process.
-	-$(MAKE) clean
-ifneq "$(wildcard /usr/share/misc/config.sub)" ""
-	cp -f /usr/share/misc/config.sub config.sub
-endif
-ifneq "$(wildcard /usr/share/misc/config.guess)" ""
-	cp -f /usr/share/misc/config.guess config.guess
+CC =gcc
+ifneq (,$(findstring diet,$(DEB_BUILD_OPTIONS)))
+  CC =diet -v -Os gcc
 endif
 
-	
-	dh_clean
-
-install: install-indep install-arch
-install-indep:
-	dh_testdir
-	dh_testroot
-	dh_clean -k -i
-	dh_installdirs -i
-	
-	# Add here commands to install the indep part of the package into
-	# debian/<package>-doc.
-	#INSTALLDOC#
-	
-	dh_install -i
-
-install-arch:
-	dh_testdir
-	dh_testroot
-	dh_clean -k -a
-	dh_installdirs -a
-	dh_installdirs /etc/dropbear
-
-	# Add here commands to install the arch part of the package into 
-	# debian/tmp.
-	$(MAKE) install prefix=$(CURDIR)/debian/dropbear/usr
-
-	dh_install -a
-# Must not depend on anything. This is to be called by
-# binary-arch/binary-multi
-# in another 'make' thread.
-binary-common:
-	cat $(CURDIR)/debian/copyright.in $(CURDIR)/LICENSE > $(CURDIR)/debian/copyright
-	dh_testdir
-	dh_testroot
-	dh_installchangelogs CHANGES
-	dh_installdocs
-	dh_installexamples
-#	dh_installmenu
-#	dh_installdebconf	
-#	dh_installlogrotate	
-#	dh_installemacsen
-#	dh_installpam
-#	dh_installmime
-	dh_installinit
-#	dh_installcron
-#	dh_installinfo
-	dh_installman
-	dh_link
-	dh_strip
-	dh_compress 
-	dh_fixperms
-#	dh_perl
-#	dh_python
-	dh_makeshlibs
-	dh_installdeb
-	dh_gencontrol
-	dh_md5sums
-	dh_builddeb
-# Build architecture independant packages using the common target.
-binary-indep: build-indep install-indep
-	$(MAKE) -f debian/rules DH_OPTIONS=-i binary-common
-
-# Build architecture dependant packages using the common target.
-binary-arch: build-arch install-arch
-	$(MAKE) -f debian/rules DH_OPTIONS=-a binary-common
-
-binary: binary-arch #binary-indep
-.PHONY: build clean binary-indep binary-arch binary install install-indep install-arch 
+DIR=`pwd`/debian/dropbear
+
+patch: deb-checkdir patch-stamp
+patch-stamp:
+#	no patches for now
+#	for i in debian/diff/*.diff; do patch -p0 <$$i || exit 1; done
+	touch patch-stamp
+
+config.status: patch-stamp configure
+	CFLAGS="$(CFLAGS)"' -DSFTPSERVER_PATH="\"/usr/lib/sftp-server\""' \
+	  ./configure --host="$(DEB_HOST_GNU_TYPE)" \
+	    --build="$(DEB_BUILD_GNU_TYPE)" --prefix=/usr \
+	    --mandir=\$${prefix}/share/man --infodir=\$${prefix}/share/info
+
+build: deb-checkdir build-stamp
+build-stamp: config.status
+	$(MAKE) CC="$(CC)" LD="$(CC)"
+	touch build-stamp
+
+clean: deb-checkdir deb-checkuid
+	-$(MAKE) distclean
+#	test ! -e patch-stamp || \
+#	  for i in debian/diff/*.diff; do patch -p0 -R <$$i; done
+	rm -f patch-stamp build-stamp config.log config.status
+	rm -rf "$(DIR)"
+	rm -f debian/files debian/substvars debian/copyright changelog
+
+install: deb-checkdir deb-checkuid build-stamp
+	rm -rf "$(DIR)"
+	install -d -m0755 "$(DIR)"/etc/dropbear
+	# programs
+	install -d -m0755 "$(DIR)"/usr/sbin
+	install -m0755 dropbear "$(DIR)"/usr/sbin/dropbear
+	install -d -m0755 "$(DIR)"/usr/bin
+	install -m0755 dropbearkey "$(DIR)"/usr/bin/dropbearkey
+	install -d -m0755 "$(DIR)"/usr/lib/dropbear
+	install -m0755 dropbearconvert \
+	  "$(DIR)"/usr/lib/dropbear/dropbearconvert
+	$(STRIP) -R .comment -R .note "$(DIR)"/usr/sbin/* \
+	  "$(DIR)"/usr/bin/* "$(DIR)"/usr/lib/dropbear/*
+	# init and run scripts
+	install -d -m0755 "$(DIR)"/etc/init.d
+	install -m0755 debian/dropbear.init "$(DIR)"/etc/init.d/dropbear
+	install -m0755 debian/service/run "$(DIR)"/etc/dropbear/run
+	install -d -m0755 "$(DIR)"/etc/dropbear/log
+	install -m0755 debian/service/log "$(DIR)"/etc/dropbear/log/run
+	ln -s /var/log/dropbear "$(DIR)"/etc/dropbear/log/main
+	ln -s /var/run/dropbear "$(DIR)"/etc/dropbear/supervise
+	ln -s /var/run/dropbear.log "$(DIR)"/etc/dropbear/log/supervise
+	# man pages
+	install -d -m0755 "$(DIR)"/usr/share/man/man8
+	for i in dropbear.8 dropbearkey.8; do \
+	  install -m644 $$i "$(DIR)"/usr/share/man/man8/ || exit 1; \
+	done
+	gzip -9 "$(DIR)"/usr/share/man/man8/*.8
+	# copyright, changelog
+	cat debian/copyright.in LICENSE >debian/copyright
+	ln -s CHANGES changelog
+
+binary-indep:
+
+binary-arch: install dropbear.deb
+	test "$(CC)" != 'gcc' || \
+	  dpkg-shlibdeps "$(DIR)"/usr/sbin/* "$(DIR)"/usr/bin/* \
+	    "$(DIR)"/usr/lib/dropbear/*
+	dpkg-gencontrol -isp -pdropbear -P"$(DIR)"
+	dpkg -b "$(DIR)" ..
+
+binary: binary-arch binary-indep
+
+.PHONY: patch build clean install binary-indep binary-arch binary
+
+include debian/implicit
diff --git a/debian/service/log b/debian/service/log
new file mode 100644
index 0000000..2ffb13d
--- /dev/null
+++ b/debian/service/log
@@ -0,0 +1,2 @@
+#!/bin/sh
+exec chpst -udropbearlog svlogd -tt ./main
diff --git a/debian/service/run b/debian/service/run
new file mode 100644
index 0000000..f208085
--- /dev/null
+++ b/debian/service/run
@@ -0,0 +1,3 @@
+#!/bin/sh
+exec 2>&1
+exec dropbear -d ./dropbear_dss_host_key -r ./dropbear_rsa_host_key -F -E -p 22
diff --git a/dropbearkey.c b/dropbearkey.c
index eac0823..5d4475b 100644
--- a/dropbearkey.c
+++ b/dropbearkey.c
@@ -45,7 +45,6 @@
  *
  */
 #include "includes.h"
-#include "runopts.h"
 #include "signkey.h"
 #include "buffer.h"
 #include "dbutil.h"
diff --git a/dss.c b/dss.c
index 74b92c7..9b56f10 100644
--- a/dss.c
+++ b/dss.c
@@ -171,6 +171,8 @@ int buf_dss_verify(buffer* buf, dss_key *key, const unsigned char* data,
 	TRACE(("enter buf_dss_verify"));
 	assert(key != NULL);
 
+	m_mp_init_multi(&val1, &val2, &val3, &val4, NULL);
+
 	/* get blob, check length */
 	string = buf_getstring(buf, &stringlen);
 	if (stringlen != 2*SHA1_HASH_SIZE) {
@@ -182,8 +184,6 @@ int buf_dss_verify(buffer* buf, dss_key *key, const unsigned char* data,
 	sha1_process(&hs, data, len);
 	sha1_done(&hs, msghash);
 
-	m_mp_init_multi(&val1, &val2, &val3, &val4, NULL);
-
 	/* create the signature - s' and r' are the received signatures in buf */
 	/* w = (s')-1 mod q */
 	/* let val1 = s' */
diff --git a/gendss.c b/gendss.c
index 3e9db09..5a440a1 100644
--- a/gendss.c
+++ b/gendss.c
@@ -31,7 +31,6 @@
 #include "gendss.h"
 #include "dss.h"
 
-#define PSIZE 128 /* 1024 bit*/
 #define QSIZE 20 /* 160 bit */
 
 #ifdef DROPBEAR_DSS
diff --git a/includes.h b/includes.h
index 52c48ed..b37422b 100644
--- a/includes.h
+++ b/includes.h
@@ -38,7 +38,6 @@
 #include <sys/time.h>
 #include <sys/un.h>
 #include <sys/wait.h>
-#include <sys/dir.h>
 
 #include <stdio.h>
 #include <errno.h>
@@ -56,6 +55,7 @@
 #include <netdb.h>
 #include <ctype.h>
 #include <stdarg.h>
+#include <dirent.h>
 
 #include <arpa/inet.h>
 
@@ -111,10 +111,6 @@
 #include <libgen.h>
 #endif
 
-#ifdef HAVE_SYS_DIRENT_H
-#include <sys/dirent.h>
-#endif
-
 #include "libtomcrypt/mycrypt_custom.h"
 #include "libtommath/tommath.h"
 
diff --git a/options.h b/options.h
index f0831b9..c687a8c 100644
--- a/options.h
+++ b/options.h
@@ -47,6 +47,11 @@
  * if you want to use this) */
 /*#define NO_FAST_EXPTMOD*/
 
+/* Set this if you want to use the DROPBEAR_SMALL_CODE option. This can save
+several kB in binary size, however will make the symmetrical ciphers (AES, DES
+etc) slower (perhaps by 50%). Recommended for most small systems. */
+#define DROPBEAR_SMALL_CODE
+
 /* Enable X11 Forwarding - server only */
 #define ENABLE_X11FWD
 
@@ -175,7 +180,7 @@
  *******************************************************************/
 
 #ifndef DROPBEAR_VERSION
-#define DROPBEAR_VERSION "0.41-and-client"
+#define DROPBEAR_VERSION "0.45-beta1"
 #endif
 
 #define LOCAL_IDENT "SSH-2.0-dropbear_" DROPBEAR_VERSION
diff --git a/packet.c b/packet.c
index 997bc6f..5e8e14d 100644
--- a/packet.c
+++ b/packet.c
@@ -50,7 +50,7 @@ static void buf_compress(buffer * dest, buffer * src, unsigned int len);
 void write_packet() {
 
 	int len, written;
-	buffer * writebuf;
+	buffer * writebuf = NULL;
 	
 	TRACE(("enter write_packet"));
 	assert(!isempty(&ses.writequeue));
@@ -80,6 +80,7 @@ void write_packet() {
 		/* We've finished with the packet, free it */
 		dequeue(&ses.writequeue);
 		buf_free(writebuf);
+		writebuf = NULL;
 	} else {
 		/* More packet left to write, leave it in the queue for later */
 		buf_incrpos(writebuf, written);
@@ -503,6 +504,7 @@ void encrypt_packet() {
 
 	/* clearwritebuf is finished with */
 	buf_free(clearwritebuf);
+	clearwritebuf = NULL;
 
 	/* enqueue the packet for sending */
 	buf_setpos(writebuf, 0);
diff --git a/random.c b/random.c
index 725b29c..65a9c64 100644
--- a/random.c
+++ b/random.c
@@ -60,7 +60,7 @@ static void readrand(unsigned char* buf, unsigned int buflen) {
 
 #ifdef DROPBEAR_DEV_URANDOM
 	readfd = open(DEV_URANDOM, O_RDONLY);
-	if (!readfd) {
+	if (readfd < 0) {
 		dropbear_exit("couldn't open random device");
 	}
 #endif
@@ -71,7 +71,8 @@ static void readrand(unsigned char* buf, unsigned int buflen) {
 	strlcpy(egdsock.sun_path, DROPBEAR_EGD_SOCKET,
 			sizeof(egdsock.sun_path));
 
-	if ((readfd = socket(PF_UNIX, SOCK_STREAM, 0)) < 0) {
+	readfd = socket(PF_UNIX, SOCK_STREAM, 0);
+	if (readfd < 0) {
 		dropbear_exit("couldn't open random device");
 	}
 	/* todo - try various common locations */
diff --git a/rsa.c b/rsa.c
index 2d63c02..1130e93 100644
--- a/rsa.c
+++ b/rsa.c
@@ -244,8 +244,11 @@ int buf_rsa_verify(buffer * buf, rsa_key *key, const unsigned char* data,
 	}
 
 out:
-	mp_clear_multi(rsa_em, &rsa_mdash, &rsa_s, NULL);
-	m_free(rsa_em);
+	if (rsa_em) {
+		mp_clear(rsa_em);
+		m_free(rsa_em);
+	}
+	mp_clear_multi(&rsa_mdash, &rsa_s, NULL);
 	TRACE(("leave buf_rsa_verify: ret %d", ret));
 	return ret;
 
@@ -260,15 +263,16 @@ void buf_put_rsa_sign(buffer* buf, rsa_key *key, const unsigned char* data,
 	unsigned int nsize, ssize;
 	unsigned int i;
 	mp_int rsa_s;
-	mp_int *rsa_em;
+	mp_int *rsa_em = NULL;
 	
 	TRACE(("enter buf_put_rsa_sign"));
 	assert(key != NULL);
 
 	rsa_em = rsa_pad_em(key, data, len);
 
-	/* the actual signing of the padded data */
 	m_mp_init(&rsa_s);
+
+	/* the actual signing of the padded data */
 	/* s = em^d mod n */
 	if (mp_exptmod(rsa_em, key->d, key->n, &rsa_s) != MP_OKAY) {
 		dropbear_exit("rsa error");
@@ -322,10 +326,10 @@ static mp_int * rsa_pad_em(rsa_key * key,
 		{0x00, 0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 
 		 0x0e, 0x03, 0x02, 0x1a, 0x05, 0x00, 0x04, 0x14};
 #define RSA_ASN1_MAGIC_LEN 16
-	buffer * rsa_EM;
+	buffer * rsa_EM = NULL;
 	hash_state hs;
 	unsigned int nsize;
-	mp_int * rsa_em;
+	mp_int * rsa_em = NULL;
 	
 	assert(key != NULL);
 	assert(data != NULL);
diff --git a/signkey.c b/signkey.c
index 3efcc2b..7ae08b8 100644
--- a/signkey.c
+++ b/signkey.c
@@ -194,7 +194,7 @@ void buf_put_pub_key(buffer* buf, sign_key *key, int type) {
 	buffer *pubkeys;
 
 	TRACE(("enter buf_put_pub_key"));
-	pubkeys = buf_new(1000);
+	pubkeys = buf_new(MAX_PUBKEY_SIZE);
 	
 #ifdef DROPBEAR_DSS
 	if (type == DROPBEAR_SIGNKEY_DSS) {
@@ -356,7 +356,7 @@ void buf_put_sign(buffer* buf, sign_key *key, int type,
 
 	buffer *sigblob;
 
-	sigblob = buf_new(1000);
+	sigblob = buf_new(MAX_PUBKEY_SIZE);
 
 #ifdef DROPBEAR_DSS
 	if (type == DROPBEAR_SIGNKEY_DSS) {
diff --git a/svr-agentfwd.c b/svr-agentfwd.c
index b588586..4e9aa56 100644
--- a/svr-agentfwd.c
+++ b/svr-agentfwd.c
@@ -64,7 +64,7 @@ int agentreq(struct ChanSess * chansess) {
 
 	/* create the unix socket dir and file */
 	if (bindagent(fd, chansess) == DROPBEAR_FAILURE) {
-		return DROPBEAR_FAILURE;
+		goto fail;
 	}
 
 	/* listen */
@@ -146,7 +146,7 @@ void agentcleanup(struct ChanSess * chansess) {
 		chansess->agentlistener = NULL;
 	}
 
-	if (chansess->agentfile && chansess->agentdir) {
+	if (chansess->agentfile != NULL && chansess->agentdir != NULL) {
 
 		/* Remove the dir as the user. That way they can't cause problems except
 		 * for themselves */
diff --git a/svr-auth.c b/svr-auth.c
index 314171f..ae7ead2 100644
--- a/svr-auth.c
+++ b/svr-auth.c
@@ -91,7 +91,7 @@ static void send_msg_userauth_banner() {
  * checking, and handle success or failure */
 void recv_msg_userauth_request() {
 
-	unsigned char *username, *servicename, *methodname;
+	unsigned char *username = NULL, *servicename = NULL, *methodname = NULL;
 	unsigned int userlen, servicelen, methodlen;
 
 	TRACE(("enter recv_msg_userauth_request"));
@@ -275,7 +275,7 @@ goodshell:
  * failures */
 void send_msg_userauth_failure(int partial, int incrfail) {
 
-	buffer *typebuf;
+	buffer *typebuf = NULL;
 
 	TRACE(("enter send_msg_userauth_failure"));
 
diff --git a/svr-authpasswd.c b/svr-authpasswd.c
index 7c6c7b7..6f7c909 100644
--- a/svr-authpasswd.c
+++ b/svr-authpasswd.c
@@ -37,14 +37,14 @@
 void svr_auth_password() {
 	
 #ifdef HAVE_SHADOW_H
-	struct spwd *spasswd;
+	struct spwd *spasswd = NULL;
 #endif
-	char * passwdcrypt; /* the crypt from /etc/passwd or /etc/shadow */
-	char * testcrypt; /* crypt generated from the user's password sent */
+	char * passwdcrypt = NULL; /* the crypt from /etc/passwd or /etc/shadow */
+	char * testcrypt = NULL; /* crypt generated from the user's password sent */
 	unsigned char * password;
 	unsigned int passwordlen;
 
-	unsigned char changepw;
+	unsigned int changepw;
 
 	passwdcrypt = ses.authstate.pw->pw_passwd;
 #ifdef HAVE_SHADOW_H
diff --git a/svr-authpubkey.c b/svr-authpubkey.c
index 9205078..14b5a78 100644
--- a/svr-authpubkey.c
+++ b/svr-authpubkey.c
@@ -53,7 +53,7 @@ void svr_auth_pubkey() {
 	unsigned char testkey; /* whether we're just checking if a key is usable */
 	unsigned char* algo = NULL; /* pubkey algo */
 	unsigned int algolen;
-	unsigned char* keyblob;
+	unsigned char* keyblob = NULL;
 	unsigned int keybloblen;
 	buffer * signbuf = NULL;
 	sign_key * key = NULL;
diff --git a/svr-chansession.c b/svr-chansession.c
index a0e877c..01612f4 100644
--- a/svr-chansession.c
+++ b/svr-chansession.c
@@ -273,7 +273,7 @@ static void closechansess(struct Channel *channel) {
  * or x11/authagent forwarding. These are passed to appropriate handlers */
 static void chansessionrequest(struct Channel *channel) {
 
-	unsigned char * type;
+	unsigned char * type = NULL;
 	unsigned int typelen;
 	unsigned char wantreply;
 	int ret = 1;
@@ -320,7 +320,7 @@ static void chansessionrequest(struct Channel *channel) {
 out:
 
 	if (wantreply) {
-		if (ret == 0) {
+		if (ret == DROPBEAR_SUCCESS) {
 			send_msg_channel_success(channel);
 		} else {
 			send_msg_channel_failure(channel);
@@ -336,7 +336,7 @@ out:
 static int sessionsignal(struct ChanSess *chansess) {
 
 	int sig = 0;
-	unsigned char* signame;
+	unsigned char* signame = NULL;
 	int i;
 
 	if (chansess->pid == 0) {
@@ -528,11 +528,14 @@ static int sessioncommand(struct Channel *channel, struct ChanSess *chansess,
 		int iscmd, int issubsys) {
 
 	unsigned int cmdlen;
+	int ret;
 
 	TRACE(("enter sessioncommand"));
 
 	if (chansess->cmd != NULL) {
-		/* TODO - send error - multiple commands? */
+		/* Note that only one command can _succeed_. The client might try
+		 * one command (which fails), then try another. Ie fallback
+		 * from sftp to scp */
 		return DROPBEAR_FAILURE;
 	}
 
@@ -541,6 +544,7 @@ static int sessioncommand(struct Channel *channel, struct ChanSess *chansess,
 		chansess->cmd = buf_getstring(ses.payload, &cmdlen);
 
 		if (cmdlen > MAX_CMD_LEN) {
+			m_free(chansess->cmd);
 			/* TODO - send error - too long ? */
 			return DROPBEAR_FAILURE;
 		}
@@ -552,6 +556,7 @@ static int sessioncommand(struct Channel *channel, struct ChanSess *chansess,
 			} else 
 #endif
 			{
+				m_free(chansess->cmd);
 				return DROPBEAR_FAILURE;
 			}
 		}
@@ -559,11 +564,16 @@ static int sessioncommand(struct Channel *channel, struct ChanSess *chansess,
 
 	if (chansess->term == NULL) {
 		/* no pty */
-		return noptycommand(channel, chansess);
+		ret = noptycommand(channel, chansess);
 	} else {
 		/* want pty */
-		 return ptycommand(channel, chansess);
+		ret = ptycommand(channel, chansess);
+	}
+
+	if (ret == DROPBEAR_FAILURE) {
+		m_free(chansess->cmd);
 	}
+	return ret;
 }
 
 /* Execute a command and set up redirection of stdin/stdout/stderr without a
@@ -650,7 +660,7 @@ static int noptycommand(struct Channel *channel, struct ChanSess *chansess) {
 static int ptycommand(struct Channel *channel, struct ChanSess *chansess) {
 
 	pid_t pid;
-	struct logininfo *li;
+	struct logininfo *li = NULL;
 #ifdef DO_MOTD
 	buffer * motdbuf = NULL;
 	int len;
@@ -778,8 +788,8 @@ static void addchildpid(struct ChanSess *chansess, pid_t pid) {
 static void execchild(struct ChanSess *chansess) {
 
 	char *argv[4];
-	char * usershell;
-	char * baseshell;
+	char * usershell = NULL;
+	char * baseshell = NULL;
 	unsigned int i;
 
 	/* wipe the hostkey */
@@ -863,6 +873,11 @@ static void execchild(struct ChanSess *chansess) {
 	agentset(chansess);
 #endif
 
+	/* Re-enable SIGPIPE for the executed process */
+	if (signal(SIGPIPE, SIG_DFL) == SIG_ERR) {
+		dropbear_exit("signal() error");
+	}
+
 	baseshell = basename(usershell);
 
 	if (chansess->cmd != NULL) {
@@ -921,7 +936,7 @@ void svr_chansessinitialise() {
 /* add a new environment variable, allocating space for the entry */
 void addnewvar(const char* param, const char* var) {
 
-	char* newvar;
+	char* newvar = NULL;
 	int plen, vlen;
 
 	plen = strlen(param);
diff --git a/svr-tcpfwd.c b/svr-tcpfwd.c
index 0eccae4..0f22a23 100644
--- a/svr-tcpfwd.c
+++ b/svr-tcpfwd.c
@@ -208,7 +208,7 @@ static int newtcpdirect(struct Channel * channel) {
 	char portstring[NI_MAXSERV];
 	int sock;
 	int len;
-	int ret = DROPBEAR_FAILURE;
+	int err = SSH_OPEN_ADMINISTRATIVELY_PROHIBITED;
 
 	if (opts.nolocaltcp) {
 		TRACE(("leave newtcpdirect: local tcp forwarding disabled"));
@@ -240,6 +240,7 @@ static int newtcpdirect(struct Channel * channel) {
 	snprintf(portstring, sizeof(portstring), "%d", destport);
 	sock = connect_remote(desthost, portstring, 1, NULL);
 	if (sock < 0) {
+		err = SSH_OPEN_CONNECT_FAILED;
 		TRACE(("leave newtcpdirect: sock failed"));
 		goto out;
 	}
@@ -253,13 +254,13 @@ static int newtcpdirect(struct Channel * channel) {
 	channel->infd = sock;
 	channel->initconn = 1;
 	
-	ret = DROPBEAR_SUCCESS;
+	err = SSH_OPEN_IN_PROGRESS;
 
 out:
 	m_free(desthost);
 	m_free(orighost);
-	TRACE(("leave newtcpdirect: ret %d", ret));
-	return ret;
+	TRACE(("leave newtcpdirect: err %d", err));
+	return err;
 }
 
 #endif
diff --git a/svr-x11fwd.c b/svr-x11fwd.c
index 0f4f71e..a8d1cd5 100644
--- a/svr-x11fwd.c
+++ b/svr-x11fwd.c
@@ -131,7 +131,7 @@ static void x11accept(struct Listener* listener, int sock) {
 void x11setauth(struct ChanSess *chansess) {
 
 	char display[20]; /* space for "localhost:12345.123" */
-	FILE * authprog;
+	FILE * authprog = NULL;
 	int val;
 
 	if (chansess->x11listener == NULL) {
@@ -187,7 +187,7 @@ static const struct ChanType chan_x11 = {
 
 static int send_msg_channel_open_x11(int fd, struct sockaddr_in* addr) {
 
-	char* ipstring;
+	char* ipstring = NULL;
 
 	if (send_msg_channel_open_init(fd, &chan_x11) == DROPBEAR_SUCCESS) {
 		ipstring = inet_ntoa(addr->sin_addr);
-- 
cgit v1.2.3


From 403c18a30092921f008d55a6d22995c854bce0f3 Mon Sep 17 00:00:00 2001
From: Matt Johnston <matt@ucc.asn.au>
Date: Sat, 14 Aug 2004 17:35:28 +0000
Subject: Dropbearkey can now print out pubkey portions

--HG--
extra : convert_revision : 2d897b12ba8710efe0b042b36b1fd31b2469eb15
---
 Makefile.in       |   2 +-
 dbutil.c          |  33 ++++++++++++-
 dropbearconvert.c |   2 +-
 dropbearkey.c     | 138 ++++++++++++++++++++++++++++++++++++++++++------------
 keyimport.c       |  23 ++-------
 5 files changed, 145 insertions(+), 53 deletions(-)

(limited to 'dropbearkey.c')

diff --git a/Makefile.in b/Makefile.in
index 761a3c9..b3e5658 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -10,7 +10,7 @@
 # This makefile is quite evil.
 
 ifndef PROGRAMS
-	PROGRAMS=dropbear dbclient dropbearkey dropbearkey
+	PROGRAMS=dropbear dbclient dropbearkey dropbearconvert
 endif
 
 LTC=libtomcrypt/libtomcrypt.a
diff --git a/dbutil.c b/dbutil.c
index 30b5708..d8ecad5 100644
--- a/dbutil.c
+++ b/dbutil.c
@@ -56,8 +56,15 @@
 
 #define MAX_FMT 100
 
-void (*_dropbear_exit)(int exitcode, const char* format, va_list param) = NULL;
-void (*_dropbear_log)(int priority, const char* format, va_list param) = NULL;
+static void generic_dropbear_exit(int exitcode, const char* format, 
+		va_list param);
+static void generic_dropbear_log(int priority, const char* format, 
+		va_list param);
+
+void (*_dropbear_exit)(int exitcode, const char* format, va_list param) 
+						= generic_dropbear_exit;
+void (*_dropbear_log)(int priority, const char* format, va_list param)
+						= generic_dropbear_log;
 
 int usingsyslog = 0; /* set by runopts, but required externally to sessions */
 #ifndef DISABLE_SYSLOG
@@ -88,6 +95,28 @@ void dropbear_exit(const char* format, ...) {
 	va_end(param);
 }
 
+static void generic_dropbear_exit(int exitcode, const char* format, 
+		va_list param) {
+
+	char fmtbuf[300];
+
+	snprintf(fmtbuf, sizeof(fmtbuf), "Exited: %s", format);
+
+	_dropbear_log(LOG_INFO, fmtbuf, param);
+
+	exit(exitcode);
+}
+
+static void generic_dropbear_log(int priority, const char* format, 
+		va_list param) {
+
+	char printbuf[1024];
+
+	vsnprintf(printbuf, sizeof(printbuf), format, param);
+
+	fprintf(stderr, "%s\n", printbuf);
+
+}
 
 /* this is what can be called to write arbitrary log messages */
 void dropbear_log(int priority, const char* format, ...) {
diff --git a/dropbearconvert.c b/dropbearconvert.c
index 3ceccff..e0d4baf 100644
--- a/dropbearconvert.c
+++ b/dropbearconvert.c
@@ -49,7 +49,7 @@ static void printhelp(char * progname) {
 					"Example:\n"
 					"dropbearconvert openssh dropbear /etc/ssh/ssh_host_rsa_key /etc/dropbear_rsa_host_key\n"
 					"\n"
-					"The inputfile and output file can be '-' to specify\n"
+					"The inputfile and outputfile can be '-' to specify\n"
 					"standard input or standard output.\n", progname);
 }
 
diff --git a/dropbearkey.c b/dropbearkey.c
index 5d4475b..6a10eab 100644
--- a/dropbearkey.c
+++ b/dropbearkey.c
@@ -54,28 +54,28 @@
 
 static void printhelp(char * progname);
 
-#define BUF_SIZE 2000
-
 #define RSA_SIZE (1024/8) /* 1024 bit */
 #define DSS_SIZE (1024/8) /* 1024 bit */
 
 static void buf_writefile(buffer * buf, const char * filename);
+static void printpubkey(sign_key * key, int keytype);
+static void justprintpub(const char* filename);
 
 /* Print a help message */
 static void printhelp(char * progname) {
 
 	fprintf(stderr, "Usage: %s -t <type> -f <filename> [-s bits]\n"
 					"Options are:\n"
-					"-t type           Type of key to generate. One of:\n"
+					"-t type	Type of key to generate. One of:\n"
 #ifdef DROPBEAR_RSA
-					"                  rsa\n"
+					"		rsa\n"
 #endif
 #ifdef DROPBEAR_DSS
-					"                  dss\n"
+					"		dss\n"
 #endif
-					"-f filename       Use filename for the secret key\n"
-					"-s bits           Key size in bits, should be "
-					"multiple of 8 (optional)\n",
+					"-f filename	Use filename for the secret key\n"
+					"-s bits	Key size in bits, should be a multiple of 8 (optional)\n"
+					"-y		Just print the publickey and fingerprint for the\n		private key in <filename>.\n",
 					progname);
 }
 
@@ -88,23 +88,24 @@ int main(int argc, char ** argv) {
 
 	int i;
 	char ** next = 0;
-	sign_key *key;
-	buffer *buf;
+	sign_key *key = NULL;
+	buffer *buf = NULL;
 	char * filename = NULL;
 	int keytype = -1;
 	char * typetext = NULL;
 	char * sizetext = NULL;
 	unsigned int bits;
 	unsigned int keysize;
+	int printpub = 0;
 
 	/* get the commandline options */
 	for (i = 1; i < argc; i++) {
+		if (argv[i] == NULL) {
+			continue; /* Whack */
+		} 
 		if (next) {
 			*next = argv[i];
-			if (*next == NULL) {
-				fprintf(stderr, "Invalid null argument");
-			}
-			next = 0x00;
+			next = NULL;
 			continue;
 		}
 
@@ -119,6 +120,9 @@ int main(int argc, char ** argv) {
 				case 's':
 					next = &sizetext;
 					break;
+				case 'y':
+					printpub = 1;
+					break;
 				case 'h':
 					printhelp(argv[0]);
 					exit(EXIT_SUCCESS);
@@ -132,17 +136,20 @@ int main(int argc, char ** argv) {
 		}
 	}
 
+	if (!filename) {
+		fprintf(stderr, "Must specify a key filename\n");
+		printhelp(argv[0]);
+		exit(EXIT_FAILURE);
+	}
+
+	if (printpub) {
+		justprintpub(filename);
+		/* Not reached */
+	}
+
 	/* check/parse args */
 	if (!typetext) {
-		fprintf(stderr, "Must specify file type, one of:\n"
-#ifdef DROPBEAR_RSA
-				"rsa\n"
-#endif
-#ifdef DROPBEAR_DSS
-				"dss\n"
-#endif
-				"\n"
-			   );
+		fprintf(stderr, "Must specify key type\n");
 		printhelp(argv[0]);
 		exit(EXIT_FAILURE);
 	}
@@ -190,11 +197,6 @@ int main(int argc, char ** argv) {
 		}
 	}
 
-	if (!filename) {
-		fprintf(stderr, "Must specify a key filename\n");
-		printhelp(argv[0]);
-		exit(EXIT_FAILURE);
-	}
 
 	fprintf(stderr, "Will output %d bit %s secret key to '%s'\n", keysize*8,
 			typetext, filename);
@@ -222,7 +224,7 @@ int main(int argc, char ** argv) {
 			exit(EXIT_FAILURE);
 	}
 
-	buf = buf_new(BUF_SIZE); 
+	buf = buf_new(MAX_PRIVKEY_SIZE); 
 
 	buf_put_priv_key(buf, key, keytype);
 	buf_setpos(buf, 0);
@@ -230,14 +232,88 @@ int main(int argc, char ** argv) {
 
 	buf_burn(buf);
 	buf_free(buf);
-	sign_key_free(key);
 
-	fprintf(stderr, "Done.\n");
+	printpubkey(key, keytype);
+
+	sign_key_free(key);
 
 	return EXIT_SUCCESS;
 }
 #endif
 
+static void justprintpub(const char* filename) {
+
+	buffer *buf = NULL;
+	sign_key *key = NULL;
+	int keytype;
+	int ret;
+	int err = DROPBEAR_FAILURE;
+
+	buf = buf_new(MAX_PRIVKEY_SIZE);
+	ret = buf_readfile(buf, filename);
+
+	if (ret != DROPBEAR_SUCCESS) {
+		fprintf(stderr, "Failed reading '%s'\n", filename);
+		goto out;
+	}
+
+	key = new_sign_key();
+	keytype = DROPBEAR_SIGNKEY_ANY;
+
+	buf_setpos(buf, 0);
+	ret = buf_get_priv_key(buf, key, &keytype);
+	if (ret == DROPBEAR_FAILURE) {
+		fprintf(stderr, "Bad key in '%s'\n", filename);
+		goto out;
+	}
+
+	printpubkey(key, keytype);
+
+	err = DROPBEAR_SUCCESS;
+
+out:
+	buf_burn(buf);
+	buf_free(buf);
+	buf = NULL;
+	sign_key_free(key);
+	key = NULL;
+	exit(err);
+}
+
+static void printpubkey(sign_key * key, int keytype) {
+
+	buffer * buf = NULL;
+	unsigned char base64key[MAX_PUBKEY_SIZE*2];
+	unsigned long base64len;
+	int err;
+	const char * typestring = NULL;
+	char *fp = NULL;
+	int len;
+
+	buf = buf_new(MAX_PUBKEY_SIZE);
+	buf_put_pub_key(buf, key, keytype);
+	buf_setpos(buf, 4);
+
+	len = buf->len - buf->pos;
+
+	base64len = sizeof(base64key);
+	err = base64_encode(buf_getptr(buf, len), len, base64key, &base64len);
+
+	if (err != CRYPT_OK) {
+		fprintf(stderr, "base64 failed");
+	}
+
+	typestring = signkey_name_from_type(keytype, &err);
+
+	fp = sign_key_fingerprint(buf_getptr(buf, len), len);
+
+	printf("Public key portion is:\n%s %s\nFingerprint: %s\n",
+			typestring, base64key, fp);
+
+	m_free(fp);
+	buf_free(buf);
+}
+
 /* Write a buffer to a file specified, failing if the file exists */
 static void buf_writefile(buffer * buf, const char * filename) {
 
diff --git a/keyimport.c b/keyimport.c
index 34fac2f..32018b1 100644
--- a/keyimport.c
+++ b/keyimport.c
@@ -109,29 +109,16 @@ static sign_key *dropbear_read(const char* filename) {
 
 	buffer * buf = NULL;
 	int len, maxlen;
-	FILE *fp;
+	FILE *fp = NULL;
 	sign_key *ret = NULL;
 	int type;
 
-	buf = buf_new(2000);
-	/* can't use buf_readfile since we might have "-" as filename */
-	if (strlen(filename) == 1 && filename[0] == '-') {
-		fp = stdin;
-	} else {
-		fp = fopen(filename, "r");
-	}
-	if (!fp) {
+	buf = buf_new(MAX_PRIVKEY_SIZE);
+	/* buf_readfile knows about "-" */
+	if (buf_readfile(buf, filename) == DROPBEAR_FAILURE) {
 		goto error;
 	}
 
-	do {
-		maxlen = buf->size - buf->pos;
-		len = fread(buf_getwriteptr(buf, maxlen), 1, maxlen, fp);
-		buf_incrwritepos(buf, len);
-	} while (len != maxlen && len > 0);
-
-	fclose(fp);
-
 	buf_setpos(buf, 0);
 	ret = new_sign_key();
 
@@ -173,7 +160,7 @@ static int dropbear_write(const char*filename, sign_key * key) {
 	}
 #endif
 
-	buf = buf_new(2000);
+	buf = buf_new(MAX_PRIVKEY_SIZE);
 	buf_put_priv_key(buf, key, keytype);
 
 	if (strlen(filename) == 1 && filename[0] == '-') {
-- 
cgit v1.2.3


From 1e94425015464ee52dc50030dc7d87d1c8375f05 Mon Sep 17 00:00:00 2001
From: Matt Johnston <matt@ucc.asn.au>
Date: Wed, 18 Aug 2004 15:48:25 +0000
Subject: DEBUG_TRACE now only triggers with -v on the cmdline

--HG--
extra : convert_revision : 91ef4ca657cd116dba148a50a90c8bcc5d206d4b
---
 cli-runopts.c     |  8 ++++++++
 dbutil.c          |  8 ++++++++
 dbutil.h          |  1 +
 debug.h           |  8 +++++---
 dropbearconvert.c |  5 +++++
 dropbearkey.c     | 12 ++++++++++--
 svr-runopts.c     |  8 ++++++++
 7 files changed, 45 insertions(+), 5 deletions(-)

(limited to 'dropbearkey.c')

diff --git a/cli-runopts.c b/cli-runopts.c
index e66f860..05f637f 100644
--- a/cli-runopts.c
+++ b/cli-runopts.c
@@ -59,6 +59,9 @@ static void printhelp() {
 					"-R <listenport:remotehost:remoteport> Remote port forwarding\n"
 #endif
 					"-l <username>\n"
+#ifdef DEBUG_TRACE
+					"-v    verbose\n"
+#endif
 					,DROPBEAR_VERSION, cli_opts.progname);
 }
 
@@ -178,6 +181,11 @@ void cli_getopts(int argc, char ** argv) {
 					printhelp();
 					exit(EXIT_SUCCESS);
 					break;
+#ifdef DEBUG_TRACE
+				case 'v':
+					debug_trace = 1;
+					break;
+#endif
 				case 'F':
 				case 'e':
 				case 'c':
diff --git a/dbutil.c b/dbutil.c
index d8ecad5..f49c78f 100644
--- a/dbutil.c
+++ b/dbutil.c
@@ -66,6 +66,10 @@ void (*_dropbear_exit)(int exitcode, const char* format, va_list param)
 void (*_dropbear_log)(int priority, const char* format, va_list param)
 						= generic_dropbear_log;
 
+#ifdef DEBUG_TRACE
+int debug_trace = 0;
+#endif
+
 int usingsyslog = 0; /* set by runopts, but required externally to sessions */
 #ifndef DISABLE_SYSLOG
 void startsyslog() {
@@ -134,6 +138,10 @@ void dropbear_trace(const char* format, ...) {
 
 	va_list param;
 
+	if (!debug_trace) {
+		return;
+	}
+
 	va_start(param, format);
 	fprintf(stderr, "TRACE: ");
 	vfprintf(stderr, format, param);
diff --git a/dbutil.h b/dbutil.h
index ce0f311..0409e36 100644
--- a/dbutil.h
+++ b/dbutil.h
@@ -42,6 +42,7 @@ void dropbear_log(int priority, const char* format, ...);
 #ifdef DEBUG_TRACE
 void dropbear_trace(const char* format, ...);
 void printhex(unsigned char* buf, int len);
+extern int debug_trace;
 #endif
 char * stripcontrol(const char * text);
 unsigned char * getaddrstring(struct sockaddr_storage* addr, int withport);
diff --git a/debug.h b/debug.h
index 3ae7ca5..9bb840b 100644
--- a/debug.h
+++ b/debug.h
@@ -33,9 +33,11 @@
  * etc. Don't use this normally, it might cause problems */
 /* #define DEBUG_VALGRIND */
 
-/* Define this to print trace statements - very verbose */
-/* Caution: Don't use this in an unfriendly environment (ie unfirewalled),
- * since the printing does not sanitise strings etc */
+/* Define this to compile in trace debugging printf()s. You'll need to 
+ * run programs with "-v" to turn this on.
+ * Caution: Don't use this in an unfriendly environment (ie unfirewalled),
+ * since the printing may not sanitise strings etc. This will add a reasonable
+ * amount to your executable size. */
 /* #define DEBUG_TRACE */
 
 /* All functions writing to the cleartext payload buffer call
diff --git a/dropbearconvert.c b/dropbearconvert.c
index 482a820..9e16fe7 100644
--- a/dropbearconvert.c
+++ b/dropbearconvert.c
@@ -62,6 +62,11 @@ int main(int argc, char ** argv) {
 	const char* infile;
 	const char* outfile;
 
+#ifdef DEBUG_TRACE
+	/* It's hard for it to get in the way _too_ much */
+	debug_trace = 1;
+#endif
+
 	/* get the commandline options */
 	if (argc != 5) {
 		fprintf(stderr, "All arguments must be specified\n");
diff --git a/dropbearkey.c b/dropbearkey.c
index 6a10eab..364b765 100644
--- a/dropbearkey.c
+++ b/dropbearkey.c
@@ -75,8 +75,11 @@ static void printhelp(char * progname) {
 #endif
 					"-f filename	Use filename for the secret key\n"
 					"-s bits	Key size in bits, should be a multiple of 8 (optional)\n"
-					"-y		Just print the publickey and fingerprint for the\n		private key in <filename>.\n",
-					progname);
+					"-y		Just print the publickey and fingerprint for the\n		private key in <filename>.\n"
+#ifdef DEBUG_TRACE
+					"-v		verbose\n"
+#endif
+					,progname);
 }
 
 #if defined(DBMULTI_dropbearkey) || !defined(DROPBEAR_MULTI)
@@ -127,6 +130,11 @@ int main(int argc, char ** argv) {
 					printhelp(argv[0]);
 					exit(EXIT_SUCCESS);
 					break;
+#ifdef DEBUG_TRACE
+				case 'v':
+					debug_trace = 1;
+					break;
+#endif
 				default:
 					fprintf(stderr, "Unknown argument %s\n", argv[i]);
 					printhelp(argv[0]);
diff --git a/svr-runopts.c b/svr-runopts.c
index 82b6a30..3c4c660 100644
--- a/svr-runopts.c
+++ b/svr-runopts.c
@@ -75,6 +75,9 @@ static void printhelp(const char * progname) {
 					"		(default %d if none specified)\n"
 #ifdef INETD_MODE
 					"-i		Start for inetd\n"
+#endif
+#ifdef DEBUG_TRACE
+					"-v		verbose\n"
 #endif
 					,DROPBEAR_VERSION, progname,
 #ifdef DROPBEAR_DSS
@@ -193,6 +196,11 @@ void svr_getopts(int argc, char ** argv) {
 					printhelp(argv[0]);
 					exit(EXIT_FAILURE);
 					break;
+#ifdef DEBUG_TRACE
+				case 'v':
+					debug_trace = 1;
+					break;
+#endif
 					/*
 				case '4':
 					svr_opts.ipv4 = 0;
-- 
cgit v1.2.3


From 8c1a429c446d00ad2030814e9f3d7afccc08ddf8 Mon Sep 17 00:00:00 2001
From: Matt Johnston <matt@ucc.asn.au>
Date: Sun, 2 Jan 2005 20:25:56 +0000
Subject: Fixed DEBUG_TRACE macro so that we don't get semicolons left about
 the place

--HG--
extra : convert_revision : d928bc851e32be7bd429bf7504b148c0e4bf7e2f
---
 buffer.c          |   4 +-
 circbuffer.c      |   4 +-
 cli-algo.c        |   2 +-
 cli-auth.c        |  30 ++++++------
 cli-authpasswd.c  |   4 +-
 cli-authpubkey.c  |  32 ++++++-------
 cli-channel.c     |   8 ++--
 cli-chansession.c |  34 +++++++-------
 cli-kex.c         |  34 +++++++-------
 cli-main.c        |   2 +-
 cli-runopts.c     |  22 ++++-----
 cli-service.c     |  10 ++--
 cli-session.c     |  22 ++++-----
 cli-tcpfwd.c      |  22 ++++-----
 common-algo.c     |   2 +-
 common-channel.c  | 136 +++++++++++++++++++++++++++---------------------------
 common-kex.c      |  64 ++++++++++++-------------
 common-session.c  |  28 +++++------
 dbutil.c          |  42 ++++++++---------
 debug.h           |   4 +-
 dropbearkey.c     |   4 +-
 dss.c             |  24 +++++-----
 listener.c        |   4 +-
 packet.c          |  34 +++++++-------
 process-packet.c  |  14 +++---
 queue.c           |   6 +--
 rsa.c             |  50 ++++++++++----------
 signkey.c         |  36 +++++++--------
 svr-agentfwd.c    |   2 +-
 svr-algo.c        |   2 +-
 svr-auth.c        |  44 +++++++++---------
 svr-authpam.c     |  20 ++++----
 svr-authpubkey.c  |  38 +++++++--------
 svr-chansession.c |  54 +++++++++++-----------
 svr-kex.c         |   8 ++--
 svr-main.c        |   6 +--
 svr-runopts.c     |   4 +-
 svr-service.c     |   8 ++--
 svr-tcpfwd.c      |  38 +++++++--------
 svr-x11fwd.c      |   2 +-
 tcp-accept.c      |   8 ++--
 41 files changed, 456 insertions(+), 456 deletions(-)

(limited to 'dropbearkey.c')

diff --git a/buffer.c b/buffer.c
index 793eee1..dff861f 100644
--- a/buffer.c
+++ b/buffer.c
@@ -258,7 +258,7 @@ void buf_putbytes(buffer *buf, const unsigned char *bytes, unsigned int len) {
 void buf_putmpint(buffer* buf, mp_int * mp) {
 
 	unsigned int len, pad = 0;
-	TRACE(("enter buf_putmpint"));
+	TRACE(("enter buf_putmpint"))
 
 	assert(mp != NULL);
 
@@ -294,7 +294,7 @@ void buf_putmpint(buffer* buf, mp_int * mp) {
 		buf_incrwritepos(buf, len-pad);
 	}
 
-	TRACE(("leave buf_putmpint"));
+	TRACE(("leave buf_putmpint"))
 }
 
 /* Retrieve an mp_int from the buffer.
diff --git a/circbuffer.c b/circbuffer.c
index a2edcbb..6dc9179 100644
--- a/circbuffer.c
+++ b/circbuffer.c
@@ -70,7 +70,7 @@ unsigned int cbuf_readlen(circbuffer *cbuf) {
 	assert(((2*cbuf->size)+cbuf->readpos-cbuf->writepos)%cbuf->size == (cbuf->size-cbuf->used)%cbuf->size);
 
 	if (cbuf->used == 0) {
-		TRACE(("cbuf_readlen: unused buffer"));
+		TRACE(("cbuf_readlen: unused buffer"))
 		return 0;
 	}
 
@@ -88,7 +88,7 @@ unsigned int cbuf_writelen(circbuffer *cbuf) {
 	assert(((2*cbuf->size)+cbuf->readpos-cbuf->writepos)%cbuf->size == (cbuf->size-cbuf->used)%cbuf->size);
 
 	if (cbuf->used == cbuf->size) {
-		TRACE(("cbuf_writelen: full buffer"));
+		TRACE(("cbuf_writelen: full buffer"))
 		return 0; /* full */
 	}
 	
diff --git a/cli-algo.c b/cli-algo.c
index 5edd6a1..ec3a1ff 100644
--- a/cli-algo.c
+++ b/cli-algo.c
@@ -46,7 +46,7 @@ algo_type * cli_buf_match_algo(buffer* buf, algo_type localalgos[],
 
 	/* get the comma-separated list from the buffer ie "algo1,algo2,algo3" */
 	algolist = buf_getstring(buf, &len);
-	TRACE(("cli_buf_match_algo: %s", algolist));
+	TRACE(("cli_buf_match_algo: %s", algolist))
 	if (len > MAX_PROPOSED_ALGO*(MAX_NAME_LEN+1)) {
 		goto out; /* just a sanity check, no other use */
 	}
diff --git a/cli-auth.c b/cli-auth.c
index 9dedfa8..dfd9bbb 100644
--- a/cli-auth.c
+++ b/cli-auth.c
@@ -42,7 +42,7 @@ void cli_authinitialise() {
 /* Send a "none" auth request to get available methods */
 void cli_auth_getmethods() {
 
-	TRACE(("enter cli_auth_getmethods"));
+	TRACE(("enter cli_auth_getmethods"))
 
 	CHECKCLEARTOWRITE();
 
@@ -54,7 +54,7 @@ void cli_auth_getmethods() {
 	buf_putstring(ses.writepayload, "none", 4); /* 'none' method */
 
 	encrypt_packet();
-	TRACE(("leave cli_auth_getmethods"));
+	TRACE(("leave cli_auth_getmethods"))
 
 }
 
@@ -64,9 +64,9 @@ void recv_msg_userauth_banner() {
 	unsigned int bannerlen;
 	unsigned int i, linecount;
 
-	TRACE(("enter recv_msg_userauth_banner"));
+	TRACE(("enter recv_msg_userauth_banner"))
 	if (ses.authstate.authdone) {
-		TRACE(("leave recv_msg_userauth_banner: banner after auth done"));
+		TRACE(("leave recv_msg_userauth_banner: banner after auth done"))
 		return;
 	}
 
@@ -74,7 +74,7 @@ void recv_msg_userauth_banner() {
 	buf_eatstring(ses.payload); /* The language string */
 
 	if (bannerlen > MAX_BANNER_SIZE) {
-		TRACE(("recv_msg_userauth_banner: bannerlen too long: %d", bannerlen));
+		TRACE(("recv_msg_userauth_banner: bannerlen too long: %d", bannerlen))
 		goto out;
 	}
 
@@ -96,7 +96,7 @@ void recv_msg_userauth_banner() {
 
 out:
 	m_free(banner);
-	TRACE(("leave recv_msg_userauth_banner"));
+	TRACE(("leave recv_msg_userauth_banner"))
 }
 
 
@@ -108,12 +108,12 @@ void recv_msg_userauth_failure() {
 	unsigned int partial = 0;
 	unsigned int i = 0;
 
-	TRACE(("<- MSG_USERAUTH_FAILURE"));
-	TRACE(("enter recv_msg_userauth_failure"));
+	TRACE(("<- MSG_USERAUTH_FAILURE"))
+	TRACE(("enter recv_msg_userauth_failure"))
 
 	if (cli_ses.state != USERAUTH_REQ_SENT) {
 		/* Perhaps we should be more fatal? */
-		TRACE(("But we didn't send a userauth request!!!!!!"));
+		TRACE(("But we didn't send a userauth request!!!!!!"))
 		return;
 	}
 
@@ -135,7 +135,7 @@ void recv_msg_userauth_failure() {
 		ses.authstate.failcount++;
 	}
 
-	TRACE(("Methods (len %d): '%s'", methlen, methods));
+	TRACE(("Methods (len %d): '%s'", methlen, methods))
 
 	ses.authstate.authdone=0;
 	ses.authstate.authtypes=0;
@@ -150,7 +150,7 @@ void recv_msg_userauth_failure() {
 	tok = methods; /* tok stores the next method we'll compare */
 	for (i = 0; i <= methlen; i++) {
 		if (methods[i] == '\0') {
-			TRACE(("auth method '%s'", tok));
+			TRACE(("auth method '%s'", tok))
 #ifdef ENABLE_CLI_PUBKEY_AUTH
 			if (strncmp(AUTH_METHOD_PUBKEY, tok,
 				AUTH_METHOD_PUBKEY_LEN) == 0) {
@@ -173,18 +173,18 @@ void recv_msg_userauth_failure() {
 
 	cli_ses.state = USERAUTH_FAIL_RCVD;
 		
-	TRACE(("leave recv_msg_userauth_failure"));
+	TRACE(("leave recv_msg_userauth_failure"))
 }
 
 void recv_msg_userauth_success() {
-	TRACE(("received msg_userauth_success"));
+	TRACE(("received msg_userauth_success"))
 	ses.authstate.authdone = 1;
 	cli_ses.state = USERAUTH_SUCCESS_RCVD;
 }
 
 void cli_auth_try() {
 
-	TRACE(("enter cli_auth_try"));
+	TRACE(("enter cli_auth_try"))
 	int finished = 0;
 
 	CHECKCLEARTOWRITE();
@@ -208,5 +208,5 @@ void cli_auth_try() {
 		dropbear_exit("No auth methods could be used.");
 	}
 
-	TRACE(("leave cli_auth_try"));
+	TRACE(("leave cli_auth_try"))
 }
diff --git a/cli-authpasswd.c b/cli-authpasswd.c
index 724203b..02bce18 100644
--- a/cli-authpasswd.c
+++ b/cli-authpasswd.c
@@ -33,7 +33,7 @@
 int cli_auth_password() {
 
 	char* password = NULL;
-	TRACE(("enter cli_auth_password"));
+	TRACE(("enter cli_auth_password"))
 
 	CHECKCLEARTOWRITE();
 	password = getpass("Password: ");
@@ -56,7 +56,7 @@ int cli_auth_password() {
 	encrypt_packet();
 	m_burn(password, strlen(password));
 
-	TRACE(("leave cli_auth_password"));
+	TRACE(("leave cli_auth_password"))
 	return 1; /* Password auth can always be tried */
 
 }
diff --git a/cli-authpubkey.c b/cli-authpubkey.c
index d308dc3..61b17d9 100644
--- a/cli-authpubkey.c
+++ b/cli-authpubkey.c
@@ -41,7 +41,7 @@ void cli_pubkeyfail() {
 	struct PubkeyList *keyitem;
 	struct PubkeyList **previtem;
 
-	TRACE(("enter cli_pubkeyfail"));
+	TRACE(("enter cli_pubkeyfail"))
 	previtem = &cli_opts.pubkeys;
 
 	/* Find the key we failed with, and remove it */
@@ -55,7 +55,7 @@ void cli_pubkeyfail() {
 	sign_key_free(cli_ses.lastpubkey->key); /* It won't be used again */
 	m_free(cli_ses.lastpubkey);
 
-	TRACE(("leave cli_pubkeyfail"));
+	TRACE(("leave cli_pubkeyfail"))
 }
 
 void recv_msg_userauth_pk_ok() {
@@ -67,11 +67,11 @@ void recv_msg_userauth_pk_ok() {
 	int keytype;
 	unsigned int remotelen;
 
-	TRACE(("enter recv_msg_userauth_pk_ok"));
+	TRACE(("enter recv_msg_userauth_pk_ok"))
 
 	algotype = buf_getstring(ses.payload, &algolen);
 	keytype = signkey_type_from_name(algotype, algolen);
-	TRACE(("recv_msg_userauth_pk_ok: type %d", keytype));
+	TRACE(("recv_msg_userauth_pk_ok: type %d", keytype))
 	m_free(algotype);
 
 	keybuf = buf_new(MAX_PUBKEY_SIZE);
@@ -84,7 +84,7 @@ void recv_msg_userauth_pk_ok() {
 
 		if (keyitem->type != keytype) {
 			/* Types differed */
-			TRACE(("types differed"));
+			TRACE(("types differed"))
 			continue;
 		}
 
@@ -98,14 +98,14 @@ void recv_msg_userauth_pk_ok() {
 
 
 		if (keybuf->len-4 != remotelen) {
-			TRACE(("lengths differed: localh %d remote %d", keybuf->len, remotelen));
+			TRACE(("lengths differed: localh %d remote %d", keybuf->len, remotelen))
 			/* Lengths differed */
 			continue;
 		}
 		if (memcmp(buf_getptr(keybuf, remotelen),
 					buf_getptr(ses.payload, remotelen), remotelen) != 0) {
 			/* Data didn't match this key */
-			TRACE(("data differed"));
+			TRACE(("data differed"))
 			continue;
 		}
 
@@ -114,15 +114,15 @@ void recv_msg_userauth_pk_ok() {
 	}
 
 	if (keyitem != NULL) {
-		TRACE(("matching key"));
+		TRACE(("matching key"))
 		/* XXX TODO: if it's an encrypted key, here we ask for their
 		 * password */
 		send_msg_userauth_pubkey(keyitem->key, keytype, 1);
 	} else {
-		TRACE(("That was whacky. We got told that a key was valid, but it didn't match our list. Sounds like dodgy code on Dropbear's part"));
+		TRACE(("That was whacky. We got told that a key was valid, but it didn't match our list. Sounds like dodgy code on Dropbear's part"))
 	}
 
-	TRACE(("leave recv_msg_userauth_pk_ok"));
+	TRACE(("leave recv_msg_userauth_pk_ok"))
 }
 
 /* TODO: make it take an agent reference to use as well */
@@ -132,7 +132,7 @@ static void send_msg_userauth_pubkey(sign_key *key, int type, int realsign) {
 	int algolen;
 	buffer* sigbuf = NULL;
 
-	TRACE(("enter send_msg_userauth_pubkey"));
+	TRACE(("enter send_msg_userauth_pubkey"))
 	CHECKCLEARTOWRITE();
 
 	buf_putbyte(ses.writepayload, SSH_MSG_USERAUTH_REQUEST);
@@ -154,7 +154,7 @@ static void send_msg_userauth_pubkey(sign_key *key, int type, int realsign) {
 	buf_put_pub_key(ses.writepayload, key, type);
 
 	if (realsign) {
-		TRACE(("realsign"));
+		TRACE(("realsign"))
 		/* We put the signature as well - this contains string(session id), then
 		 * the contents of the write payload to this point */
 		sigbuf = buf_new(4 + SHA1_HASH_SIZE + ses.writepayload->len);
@@ -165,22 +165,22 @@ static void send_msg_userauth_pubkey(sign_key *key, int type, int realsign) {
 	}
 
 	encrypt_packet();
-	TRACE(("leave send_msg_userauth_pubkey"));
+	TRACE(("leave send_msg_userauth_pubkey"))
 }
 
 int cli_auth_pubkey() {
 
-	TRACE(("enter cli_auth_pubkey"));
+	TRACE(("enter cli_auth_pubkey"))
 
 	if (cli_opts.pubkeys != NULL) {
 		/* Send a trial request */
 		send_msg_userauth_pubkey(cli_opts.pubkeys->key,
 				cli_opts.pubkeys->type, 0);
 		cli_ses.lastpubkey = cli_opts.pubkeys;
-		TRACE(("leave cli_auth_pubkey-success"));
+		TRACE(("leave cli_auth_pubkey-success"))
 		return 1;
 	} else {
-		TRACE(("leave cli_auth_pubkey-failure"));
+		TRACE(("leave cli_auth_pubkey-failure"))
 		return 0;
 	}
 }
diff --git a/cli-channel.c b/cli-channel.c
index ea4af69..42e165b 100644
--- a/cli-channel.c
+++ b/cli-channel.c
@@ -37,7 +37,7 @@ void recv_msg_channel_extended_data() {
 	struct Channel *channel;
 	unsigned int datatype;
 
-	TRACE(("enter recv_msg_channel_extended_data"));
+	TRACE(("enter recv_msg_channel_extended_data"))
 
 	chan = buf_getint(ses.payload);
 	channel = getchannel(chan);
@@ -47,7 +47,7 @@ void recv_msg_channel_extended_data() {
 	}
 
 	if (channel->type != &clichansess) {
-		TRACE(("leave recv_msg_channel_extended_data: chantype is wrong"));
+		TRACE(("leave recv_msg_channel_extended_data: chantype is wrong"))
 		return; /* we just ignore it */
 	}
 
@@ -55,11 +55,11 @@ void recv_msg_channel_extended_data() {
 	
 	if (datatype != SSH_EXTENDED_DATA_STDERR) {
 		TRACE(("leave recv_msg_channel_extended_data: wrong datatype: %d",
-					datatype));
+					datatype))
 		return;	
 	}
 
 	common_recv_msg_channel_data(channel, channel->errfd, channel->extrabuf);
 
-	TRACE(("leave recv_msg_channel_extended_data"));
+	TRACE(("leave recv_msg_channel_extended_data"))
 }
diff --git a/cli-chansession.c b/cli-chansession.c
index 35be671..76e9dfa 100644
--- a/cli-chansession.c
+++ b/cli-chansession.c
@@ -59,20 +59,20 @@ static void cli_chansessreq(struct Channel *channel) {
 	unsigned char* type = NULL;
 	int wantreply;
 
-	TRACE(("enter cli_chansessreq"));
+	TRACE(("enter cli_chansessreq"))
 
 	type = buf_getstring(ses.payload, NULL);
 	wantreply = buf_getbyte(ses.payload);
 
 	if (strcmp(type, "exit-status") != 0) {
-		TRACE(("unknown request '%s'", type));
+		TRACE(("unknown request '%s'", type))
 		send_msg_channel_failure(channel);
 		goto out;
 	}
 		
 	/* We'll just trust what they tell us */
 	cli_ses.retval = buf_getint(ses.payload);
-	TRACE(("got exit-status of '%d'", cli_ses.retval));
+	TRACE(("got exit-status of '%d'", cli_ses.retval))
 
 out:
 	m_free(type);
@@ -108,10 +108,10 @@ static void cli_tty_setup() {
 
 	struct termios tio;
 
-	TRACE(("enter cli_pty_setup"));
+	TRACE(("enter cli_pty_setup"))
 
 	if (cli_ses.tty_raw_mode == 1) {
-		TRACE(("leave cli_tty_setup: already in raw mode!"));
+		TRACE(("leave cli_tty_setup: already in raw mode!"))
 		return;
 	}
 
@@ -139,15 +139,15 @@ static void cli_tty_setup() {
 	}
 
 	cli_ses.tty_raw_mode = 1;
-	TRACE(("leave cli_tty_setup"));
+	TRACE(("leave cli_tty_setup"))
 }
 
 void cli_tty_cleanup() {
 
-	TRACE(("enter cli_tty_cleanup"));
+	TRACE(("enter cli_tty_cleanup"))
 
 	if (cli_ses.tty_raw_mode == 0) {
-		TRACE(("leave cli_tty_cleanup: not in raw mode"));
+		TRACE(("leave cli_tty_cleanup: not in raw mode"))
 		return;
 	}
 
@@ -157,12 +157,12 @@ void cli_tty_cleanup() {
 		cli_ses.tty_raw_mode = 0; 
 	}
 
-	TRACE(("leave cli_tty_cleanup"));
+	TRACE(("leave cli_tty_cleanup"))
 }
 
 static void put_termcodes() {
 
-	TRACE(("enter put_termcodes"));
+	TRACE(("enter put_termcodes"))
 
 	struct termios tio;
 	unsigned int sshcode;
@@ -232,7 +232,7 @@ static void put_termcodes() {
 	buf_putint(ses.writepayload, bufpos2 - bufpos1 - 4); /* len(termcodes) */
 	buf_setpos(ses.writepayload, bufpos2); /* Back where we were */
 
-	TRACE(("leave put_termcodes"));
+	TRACE(("leave put_termcodes"))
 }
 
 static void put_winsize() {
@@ -284,7 +284,7 @@ static void send_chansess_pty_req(struct Channel *channel) {
 
 	unsigned char* term = NULL;
 
-	TRACE(("enter send_chansess_pty_req"));
+	TRACE(("enter send_chansess_pty_req"))
 
 	start_channel_request(channel, "pty-req");
 
@@ -310,14 +310,14 @@ static void send_chansess_pty_req(struct Channel *channel) {
 	if (signal(SIGWINCH, sigwinch_handler) == SIG_ERR) {
 		dropbear_exit("signal error");
 	}
-	TRACE(("leave send_chansess_pty_req"));
+	TRACE(("leave send_chansess_pty_req"))
 }
 
 static void send_chansess_shell_req(struct Channel *channel) {
 
 	unsigned char* reqtype = NULL;
 
-	TRACE(("enter send_chansess_shell_req"));
+	TRACE(("enter send_chansess_shell_req"))
 
 	if (cli_opts.cmd) {
 		reqtype = "exec";
@@ -334,7 +334,7 @@ static void send_chansess_shell_req(struct Channel *channel) {
 	}
 
 	encrypt_packet();
-	TRACE(("leave send_chansess_shell_req"));
+	TRACE(("leave send_chansess_shell_req"))
 }
 
 static int cli_initchansess(struct Channel *channel) {
@@ -367,7 +367,7 @@ static int cli_initchansess(struct Channel *channel) {
 
 void cli_send_chansess_request() {
 
-	TRACE(("enter cli_send_chansess_request"));
+	TRACE(("enter cli_send_chansess_request"))
 	if (send_msg_channel_open_init(STDIN_FILENO, &clichansess) 
 			== DROPBEAR_FAILURE) {
 		dropbear_exit("Couldn't open initial channel");
@@ -375,6 +375,6 @@ void cli_send_chansess_request() {
 
 	/* No special channel request data */
 	encrypt_packet();
-	TRACE(("leave cli_send_chansess_request"));
+	TRACE(("leave cli_send_chansess_request"))
 
 }
diff --git a/cli-kex.c b/cli-kex.c
index c8949ef..03a0670 100644
--- a/cli-kex.c
+++ b/cli-kex.c
@@ -65,14 +65,14 @@ void recv_msg_kexdh_reply() {
 	unsigned char* keyblob = NULL;
 
 
-	TRACE(("enter recv_msg_kexdh_reply"));
+	TRACE(("enter recv_msg_kexdh_reply"))
 
 	if (cli_ses.kex_state != KEXDH_INIT_SENT) {
 		dropbear_exit("Received out-of-order kexdhreply");
 	}
 	m_mp_init(&dh_f);
 	type = ses.newkeys->algo_hostkey;
-	TRACE(("type is %d", type));
+	TRACE(("type is %d", type))
 
 	hostkey = new_sign_key();
 	keybloblen = buf_getint(ses.payload);
@@ -84,12 +84,12 @@ void recv_msg_kexdh_reply() {
 	}
 
 	if (buf_get_pub_key(ses.payload, hostkey, &type) != DROPBEAR_SUCCESS) {
-		TRACE(("failed getting pubkey"));
+		TRACE(("failed getting pubkey"))
 		dropbear_exit("Bad KEX packet");
 	}
 
 	if (buf_getmpint(ses.payload, &dh_f) != DROPBEAR_SUCCESS) {
-		TRACE(("failed getting mpint"));
+		TRACE(("failed getting mpint"))
 		dropbear_exit("Bad KEX packet");
 	}
 
@@ -109,7 +109,7 @@ void recv_msg_kexdh_reply() {
 
 	send_msg_newkeys();
 	ses.requirenext = SSH_MSG_NEWKEYS;
-	TRACE(("leave recv_msg_kexdh_init"));
+	TRACE(("leave recv_msg_kexdh_init"))
 }
 
 static void ask_to_confirm(unsigned char* keyblob, unsigned int keybloblen) {
@@ -156,7 +156,7 @@ static void checkhostkey(unsigned char* keyblob, unsigned int keybloblen) {
 		if (errno != EEXIST) {
 			dropbear_log(LOG_INFO, "Warning: failed creating ~/.ssh: %s",
 					strerror(errno));
-			TRACE(("mkdir didn't work: %s", strerror(errno)));
+			TRACE(("mkdir didn't work: %s", strerror(errno)))
 			ask_to_confirm(keyblob, keybloblen);
 			goto out; /* only get here on success */
 		}
@@ -170,14 +170,14 @@ static void checkhostkey(unsigned char* keyblob, unsigned int keybloblen) {
 	} else {
 		/* We mightn't have been able to open it if it was read-only */
 		if (errno == EACCES || errno == EROFS) {
-				TRACE(("trying readonly: %s", strerror(errno)));
+				TRACE(("trying readonly: %s", strerror(errno)))
 				readonly = 1;
 				hostsfile = fopen(filename, "r");
 		}
 	}
 
 	if (hostsfile == NULL) {
-		TRACE(("hostsfile didn't open: %s", strerror(errno)));
+		TRACE(("hostsfile didn't open: %s", strerror(errno)))
 		ask_to_confirm(keyblob, keybloblen);
 		goto out; /* We only get here on success */
 	}
@@ -188,7 +188,7 @@ static void checkhostkey(unsigned char* keyblob, unsigned int keybloblen) {
 
 	do {
 		if (buf_getline(line, hostsfile) == DROPBEAR_FAILURE) {
-			TRACE(("failed reading line: prob EOF"));
+			TRACE(("failed reading line: prob EOF"))
 			break;
 		}
 
@@ -197,32 +197,32 @@ static void checkhostkey(unsigned char* keyblob, unsigned int keybloblen) {
 		 * buf_getfoo() past the end and die horribly - the base64 parsing
 		 * code is what tiptoes up to the end nicely */
 		if (line->len < (hostlen+30) ) {
-			TRACE(("line is too short to be sensible"));
+			TRACE(("line is too short to be sensible"))
 			continue;
 		}
 
 		/* Compare hostnames */
 		if (strncmp(cli_opts.remotehost, buf_getptr(line, hostlen),
 					hostlen) != 0) {
-			TRACE(("hosts don't match"));
+			TRACE(("hosts don't match"))
 			continue;
 		}
 
 		buf_incrpos(line, hostlen);
 		if (buf_getbyte(line) != ' ') {
 			/* there wasn't a space after the hostname, something dodgy */
-			TRACE(("missing space afte matching hostname"));
+			TRACE(("missing space afte matching hostname"))
 			continue;
 		}
 
 		if ( strncmp(buf_getptr(line, algolen), algoname, algolen) != 0) {
-			TRACE(("algo doesn't match"));
+			TRACE(("algo doesn't match"))
 			continue;
 		}
 
 		buf_incrpos(line, algolen);
 		if (buf_getbyte(line) != ' ') {
-			TRACE(("missing space after algo"));
+			TRACE(("missing space after algo"))
 			continue;
 		}
 
@@ -231,7 +231,7 @@ static void checkhostkey(unsigned char* keyblob, unsigned int keybloblen) {
 
 		if (ret == DROPBEAR_SUCCESS) {
 			/* Good matching key */
-			TRACE(("good matching key"));
+			TRACE(("good matching key"))
 			goto out;
 		}
 
@@ -244,7 +244,7 @@ static void checkhostkey(unsigned char* keyblob, unsigned int keybloblen) {
 	/* If we get here, they said yes */
 
 	if (readonly) {
-		TRACE(("readonly"));
+		TRACE(("readonly"))
 		goto out;
 	}
 
@@ -257,7 +257,7 @@ static void checkhostkey(unsigned char* keyblob, unsigned int keybloblen) {
 	buf_putbytes(line, algoname, algolen);
 	buf_putbyte(line, ' ');
 	len = line->size - line->pos;
-	TRACE(("keybloblen %d, len %d", keybloblen, len));
+	TRACE(("keybloblen %d, len %d", keybloblen, len))
 	/* The only failure with base64 is buffer_overflow, but buf_getwriteptr
 	 * will die horribly in the case anyway */
 	base64_encode(keyblob, keybloblen, buf_getwriteptr(line, len), &len);
diff --git a/cli-main.c b/cli-main.c
index def2c72..3f767c9 100644
--- a/cli-main.c
+++ b/cli-main.c
@@ -50,7 +50,7 @@ int main(int argc, char ** argv) {
 	cli_getopts(argc, argv);
 
 	TRACE(("user='%s' host='%s' port='%s'", cli_opts.username,
-				cli_opts.remotehost, cli_opts.remoteport));
+				cli_opts.remotehost, cli_opts.remoteport))
 
 	if (signal(SIGPIPE, SIG_IGN) == SIG_ERR) {
 		dropbear_exit("signal() error");
diff --git a/cli-runopts.c b/cli-runopts.c
index b8ecdc0..3ac5c2b 100644
--- a/cli-runopts.c
+++ b/cli-runopts.c
@@ -116,7 +116,7 @@ void cli_getopts(int argc, char ** argv) {
 #endif
 #ifdef ENABLE_CLI_REMOTETCPFWD
 		if (nextisremote) {
-			TRACE(("nextisremote true"));
+			TRACE(("nextisremote true"))
 			addforward(argv[i], &cli_opts.remotefwds);
 			nextisremote = 0;
 			continue;
@@ -124,7 +124,7 @@ void cli_getopts(int argc, char ** argv) {
 #endif
 #ifdef ENABLE_CLI_LOCALTCPFWD
 		if (nextislocal) {
-			TRACE(("nextislocal true"));
+			TRACE(("nextislocal true"))
 			addforward(argv[i], &cli_opts.localfwds);
 			nextislocal = 0;
 			continue;
@@ -214,7 +214,7 @@ void cli_getopts(int argc, char ** argv) {
 			continue; /* next argument */
 
 		} else {
-			TRACE(("non-flag arg: '%s'", argv[i]));
+			TRACE(("non-flag arg: '%s'", argv[i]))
 
 			/* Either the hostname or commands */
 
@@ -343,7 +343,7 @@ static void addforward(char* origstr, struct TCPFwdList** fwdlist) {
 	struct TCPFwdList* newfwd = NULL;
 	char * str = NULL;
 
-	TRACE(("enter addforward"));
+	TRACE(("enter addforward"))
 
 	/* We probably don't want to be editing argvs */
 	str = m_strdup(origstr);
@@ -352,7 +352,7 @@ static void addforward(char* origstr, struct TCPFwdList** fwdlist) {
 
 	connectaddr = strchr(str, ':');
 	if (connectaddr == NULL) {
-		TRACE(("connectaddr == NULL"));
+		TRACE(("connectaddr == NULL"))
 		goto fail;
 	}
 
@@ -361,7 +361,7 @@ static void addforward(char* origstr, struct TCPFwdList** fwdlist) {
 
 	connectport = strchr(connectaddr, ':');
 	if (connectport == NULL) {
-		TRACE(("connectport == NULL"));
+		TRACE(("connectport == NULL"))
 		goto fail;
 	}
 
@@ -374,32 +374,32 @@ static void addforward(char* origstr, struct TCPFwdList** fwdlist) {
 	 * the check later only checks for >= MAX_PORT */
 	newfwd->listenport = strtol(listenport, NULL, 10);
 	if (errno != 0) {
-		TRACE(("bad listenport strtol"));
+		TRACE(("bad listenport strtol"))
 		goto fail;
 	}
 
 	newfwd->connectport = strtol(connectport, NULL, 10);
 	if (errno != 0) {
-		TRACE(("bad connectport strtol"));
+		TRACE(("bad connectport strtol"))
 		goto fail;
 	}
 
 	newfwd->connectaddr = connectaddr;
 
 	if (newfwd->listenport > 65535) {
-		TRACE(("listenport > 65535"));
+		TRACE(("listenport > 65535"))
 		goto badport;
 	}
 		
 	if (newfwd->connectport > 65535) {
-		TRACE(("connectport > 65535"));
+		TRACE(("connectport > 65535"))
 		goto badport;
 	}
 
 	newfwd->next = *fwdlist;
 	*fwdlist = newfwd;
 
-	TRACE(("leave addforward: done"));
+	TRACE(("leave addforward: done"))
 	return;
 
 fail:
diff --git a/cli-service.c b/cli-service.c
index d14c77f..87b6ed2 100644
--- a/cli-service.c
+++ b/cli-service.c
@@ -33,7 +33,7 @@
 
 void send_msg_service_request(char* servicename) {
 
-	TRACE(("enter send_msg_service_request: servicename='%s'", servicename));
+	TRACE(("enter send_msg_service_request: servicename='%s'", servicename))
 
 	CHECKCLEARTOWRITE();
 
@@ -41,7 +41,7 @@ void send_msg_service_request(char* servicename) {
 	buf_putstring(ses.writepayload, servicename, strlen(servicename));
 
 	encrypt_packet();
-	TRACE(("leave send_msg_service_request"));
+	TRACE(("leave send_msg_service_request"))
 }
 
 /* This just sets up the state variables right for the main client session loop
@@ -51,7 +51,7 @@ void recv_msg_service_accept() {
 	unsigned char* servicename;
 	unsigned int len;
 
-	TRACE(("enter recv_msg_service_accept"));
+	TRACE(("enter recv_msg_service_accept"))
 
 	servicename = buf_getstring(ses.payload, &len);
 
@@ -62,7 +62,7 @@ void recv_msg_service_accept() {
 
 		cli_ses.state = SERVICE_AUTH_ACCEPT_RCVD;
 		m_free(servicename);
-		TRACE(("leave recv_msg_service_accept: done ssh-userauth"));
+		TRACE(("leave recv_msg_service_accept: done ssh-userauth"))
 		return;
 	}
 
@@ -77,7 +77,7 @@ void recv_msg_service_accept() {
 
 		cli_ses.state = SERVICE_CONN_ACCEPT_RCVD;
 		m_free(servicename);
-		TRACE(("leave recv_msg_service_accept: done ssh-connection"));
+		TRACE(("leave recv_msg_service_accept: done ssh-connection"))
 		return;
 	}
 
diff --git a/cli-session.c b/cli-session.c
index 0ea33af..4d6a645 100644
--- a/cli-session.c
+++ b/cli-session.c
@@ -139,7 +139,7 @@ static void cli_session_init() {
  * service, userauth and channel requests */
 static void cli_sessionloop() {
 
-	TRACE(("enter cli_sessionloop"));
+	TRACE(("enter cli_sessionloop"))
 
 	if (ses.lastpacket == SSH_MSG_KEXINIT && cli_ses.kex_state == KEX_NOTHING) {
 		cli_ses.kex_state = KEXINIT_RCVD;
@@ -151,7 +151,7 @@ static void cli_sessionloop() {
 		 * negotiation would have failed. */
 		send_msg_kexdh_init();
 		cli_ses.kex_state = KEXDH_INIT_SENT;
-		TRACE(("leave cli_sessionloop: done with KEXINIT_RCVD"));
+		TRACE(("leave cli_sessionloop: done with KEXINIT_RCVD"))
 		return;
 	}
 
@@ -163,14 +163,14 @@ static void cli_sessionloop() {
 
 	/* We shouldn't do anything else if a KEX is in progress */
 	if (cli_ses.kex_state != KEX_NOTHING) {
-		TRACE(("leave cli_sessionloop: kex_state != KEX_NOTHING"));
+		TRACE(("leave cli_sessionloop: kex_state != KEX_NOTHING"))
 		return;
 	}
 
 	/* We should exit if we haven't donefirstkex: we shouldn't reach here
 	 * in normal operation */
 	if (ses.kexstate.donefirstkex == 0) {
-		TRACE(("XXX XXX might be bad! leave cli_sessionloop: haven't donefirstkex"));
+		TRACE(("XXX XXX might be bad! leave cli_sessionloop: haven't donefirstkex"))
 		return;
 	}
 
@@ -181,32 +181,32 @@ static void cli_sessionloop() {
 			 * userauth */
 			send_msg_service_request(SSH_SERVICE_USERAUTH);
 			cli_ses.state = SERVICE_AUTH_REQ_SENT;
-			TRACE(("leave cli_sessionloop: sent userauth service req"));
+			TRACE(("leave cli_sessionloop: sent userauth service req"))
 			return;
 
 		/* userauth code */
 		case SERVICE_AUTH_ACCEPT_RCVD:
 			cli_auth_getmethods();
 			cli_ses.state = USERAUTH_REQ_SENT;
-			TRACE(("leave cli_sessionloop: sent userauth methods req"));
+			TRACE(("leave cli_sessionloop: sent userauth methods req"))
 			return;
 			
 		case USERAUTH_FAIL_RCVD:
 			cli_auth_try();
 			cli_ses.state = USERAUTH_REQ_SENT;
-			TRACE(("leave cli_sessionloop: cli_auth_try"));
+			TRACE(("leave cli_sessionloop: cli_auth_try"))
 			return;
 
 			/*
 		case USERAUTH_SUCCESS_RCVD:
 			send_msg_service_request(SSH_SERVICE_CONNECTION);
 			cli_ses.state = SERVICE_CONN_REQ_SENT;
-			TRACE(("leave cli_sessionloop: sent ssh-connection service req"));
+			TRACE(("leave cli_sessionloop: sent ssh-connection service req"))
 			return;
 
 		case SERVICE_CONN_ACCEPT_RCVD:
 			cli_send_chansess_request();
-			TRACE(("leave cli_sessionloop: cli_send_chansess_request"));
+			TRACE(("leave cli_sessionloop: cli_send_chansess_request"))
 			cli_ses.state = SESSION_RUNNING;
 			return;
 			*/
@@ -219,7 +219,7 @@ static void cli_sessionloop() {
 			setup_remotetcp();
 #endif
 			cli_send_chansess_request();
-			TRACE(("leave cli_sessionloop: cli_send_chansess_request"));
+			TRACE(("leave cli_sessionloop: cli_send_chansess_request"))
 			cli_ses.state = SESSION_RUNNING;
 			return;
 
@@ -240,7 +240,7 @@ static void cli_sessionloop() {
 		break;
 	}
 
-	TRACE(("leave cli_sessionloop: fell out"));
+	TRACE(("leave cli_sessionloop: fell out"))
 
 }
 
diff --git a/cli-tcpfwd.c b/cli-tcpfwd.c
index b4d99e9..aa5b720 100644
--- a/cli-tcpfwd.c
+++ b/cli-tcpfwd.c
@@ -62,10 +62,10 @@ void setup_localtcp() {
 
 	int ret;
 
-	TRACE(("enter setup_localtcp"));
+	TRACE(("enter setup_localtcp"))
 
 	if (cli_opts.localfwds == NULL) {
-		TRACE(("cli_opts.localfwds == NULL"));
+		TRACE(("cli_opts.localfwds == NULL"))
 	}
 
 	while (cli_opts.localfwds != NULL) {
@@ -81,7 +81,7 @@ void setup_localtcp() {
 
 		cli_opts.localfwds = cli_opts.localfwds->next;
 	}
-	TRACE(("leave setup_localtcp"));
+	TRACE(("leave setup_localtcp"))
 
 }
 
@@ -105,7 +105,7 @@ static int cli_localtcp(unsigned int listenport, const char* remoteaddr,
 	if (ret == DROPBEAR_FAILURE) {
 		m_free(tcpinfo);
 	}
-	TRACE(("leave cli_localtcp: %d", ret));
+	TRACE(("leave cli_localtcp: %d", ret))
 	return ret;
 }
 #endif /* ENABLE_CLI_LOCALTCPFWD */
@@ -113,7 +113,7 @@ static int cli_localtcp(unsigned int listenport, const char* remoteaddr,
 #ifdef  ENABLE_CLI_REMOTETCPFWD
 static void send_msg_global_request_remotetcp(int port) {
 
-	TRACE(("enter send_msg_global_request_remotetcp"));
+	TRACE(("enter send_msg_global_request_remotetcp"))
 
 	CHECKCLEARTOWRITE();
 	buf_putbyte(ses.writepayload, SSH_MSG_GLOBAL_REQUEST);
@@ -124,17 +124,17 @@ static void send_msg_global_request_remotetcp(int port) {
 
 	encrypt_packet();
 
-	TRACE(("leave send_msg_global_request_remotetcp"));
+	TRACE(("leave send_msg_global_request_remotetcp"))
 }
 
 void setup_remotetcp() {
 
 	struct TCPFwdList * iter = NULL;
 
-	TRACE(("enter setup_remotetcp"));
+	TRACE(("enter setup_remotetcp"))
 
 	if (cli_opts.remotefwds == NULL) {
-		TRACE(("cli_opts.remotefwds == NULL"));
+		TRACE(("cli_opts.remotefwds == NULL"))
 	}
 
 	iter = cli_opts.remotefwds;
@@ -143,7 +143,7 @@ void setup_remotetcp() {
 		send_msg_global_request_remotetcp(iter->listenport);
 		iter = iter->next;
 	}
-	TRACE(("leave setup_remotetcp"));
+	TRACE(("leave setup_remotetcp"))
 }
 
 static int newtcpforwarded(struct Channel * channel) {
@@ -179,7 +179,7 @@ static int newtcpforwarded(struct Channel * channel) {
 	snprintf(portstring, sizeof(portstring), "%d", iter->connectport);
 	sock = connect_remote(iter->connectaddr, portstring, 1, NULL);
 	if (sock < 0) {
-		TRACE(("leave newtcpdirect: sock failed"));
+		TRACE(("leave newtcpdirect: sock failed"))
 		err = SSH_OPEN_CONNECT_FAILED;
 		goto out;
 	}
@@ -196,7 +196,7 @@ static int newtcpforwarded(struct Channel * channel) {
 	err = SSH_OPEN_IN_PROGRESS;
 
 out:
-	TRACE(("leave newtcpdirect: err %d", err));
+	TRACE(("leave newtcpdirect: err %d", err))
 	return err;
 }
 #endif /* ENABLE_CLI_REMOTETCPFWD */
diff --git a/common-algo.c b/common-algo.c
index 22cdc70..1975864 100644
--- a/common-algo.c
+++ b/common-algo.c
@@ -202,6 +202,6 @@ void buf_put_algolist(buffer * buf, algo_type localalgos[]) {
 	}
 	str[pos]=0;
 	/* Debug this */
-	TRACE(("buf_put_algolist: %s", str));
+	TRACE(("buf_put_algolist: %s", str))
 	buf_putstring(buf, str, pos);
 }
diff --git a/common-channel.c b/common-channel.c
index 1d703a2..6f73fab 100644
--- a/common-channel.c
+++ b/common-channel.c
@@ -81,15 +81,15 @@ void chancleanup() {
 
 	unsigned int i;
 
-	TRACE(("enter chancleanup"));
+	TRACE(("enter chancleanup"))
 	for (i = 0; i < ses.chansize; i++) {
 		if (ses.channels[i] != NULL) {
-			TRACE(("channel %d closing", i));
+			TRACE(("channel %d closing", i))
 			removechannel(ses.channels[i]);
 		}
 	}
 	m_free(ses.channels);
-	TRACE(("leave chancleanup"));
+	TRACE(("leave chancleanup"))
 }
 
 /* Create a new channel entry, send a reply confirm or failure */
@@ -103,7 +103,7 @@ struct Channel* newchannel(unsigned int remotechan,
 	struct Channel * newchan;
 	unsigned int i, j;
 
-	TRACE(("enter newchannel"));
+	TRACE(("enter newchannel"))
 	
 	/* first see if we can use existing channels */
 	for (i = 0; i < ses.chansize; i++) {
@@ -115,7 +115,7 @@ struct Channel* newchannel(unsigned int remotechan,
 	/* otherwise extend the list */
 	if (i == ses.chansize) {
 		if (ses.chansize >= MAX_CHANNELS) {
-			TRACE(("leave newchannel: max chans reached"));
+			TRACE(("leave newchannel: max chans reached"))
 			return NULL;
 		}
 
@@ -157,7 +157,7 @@ struct Channel* newchannel(unsigned int remotechan,
 	ses.channels[i] = newchan;
 	ses.chancount++;
 
-	TRACE(("leave newchannel"));
+	TRACE(("leave newchannel"))
 
 	return newchan;
 }
@@ -246,13 +246,13 @@ void channelio(fd_set *readfd, fd_set *writefd) {
 /* do all the EOF/close type stuff checking for a channel */
 static void checkclose(struct Channel *channel) {
 
-	TRACE(("checkclose: infd %d, outfd %d, errfd %d, sentclosed %d, recvclosed %d", 
+	TRACE(("checkclose: infd %d, outfd %d, errfd %d, sentclosed %d, recvclosed %d",
 				channel->infd, channel->outfd,
-				channel->errfd, channel->sentclosed, channel->recvclosed));
+				channel->errfd, channel->sentclosed, channel->recvclosed))
 	TRACE(("writebuf %d extrabuf %s extrabuf %d",
 				cbuf_getused(channel->writebuf),
 				channel->writebuf,
-				channel->writebuf ? 0 : cbuf_getused(channel->extrabuf)));
+				channel->writebuf ? 0 : cbuf_getused(channel->extrabuf)))
 
 	if (!channel->sentclosed) {
 
@@ -289,7 +289,7 @@ static void checkclose(struct Channel *channel) {
 	 */
 	if (channel->recvclosed) {
 		if (! channel->sentclosed) {
-			TRACE(("Sending MSG_CHANNEL_CLOSE in response to same."));
+			TRACE(("Sending MSG_CHANNEL_CLOSE in response to same."))
 			send_msg_channel_close(channel);
 		}
 		removechannel(channel);
@@ -306,7 +306,7 @@ static void checkinitdone(struct Channel *channel) {
 	int val;
 	socklen_t vallen = sizeof(val);
 
-	TRACE(("enter checkinitdone"));
+	TRACE(("enter checkinitdone"))
 
 	if (getsockopt(channel->infd, SOL_SOCKET, SO_ERROR, &val, &vallen)
 			|| val != 0) {
@@ -314,13 +314,13 @@ static void checkinitdone(struct Channel *channel) {
 				SSH_OPEN_CONNECT_FAILED, "", "");
 		close(channel->infd);
 		deletechannel(channel);
-		TRACE(("leave checkinitdone: fail"));
+		TRACE(("leave checkinitdone: fail"))
 	} else {
 		send_msg_channel_open_confirmation(channel, channel->recvwindow,
 				channel->recvmaxpacket);
 		channel->outfd = channel->infd;
 		channel->initconn = 0;
-		TRACE(("leave checkinitdone: success"));
+		TRACE(("leave checkinitdone: success"))
 	}
 }
 
@@ -329,7 +329,7 @@ static void checkinitdone(struct Channel *channel) {
 /* Send the close message and set the channel as closed */
 static void send_msg_channel_close(struct Channel *channel) {
 
-	TRACE(("enter send_msg_channel_close"));
+	TRACE(("enter send_msg_channel_close"))
 	/* XXX server */
 	if (channel->type->closehandler) {
 		channel->type->closehandler(channel);
@@ -344,13 +344,13 @@ static void send_msg_channel_close(struct Channel *channel) {
 
 	channel->senteof = 1;
 	channel->sentclosed = 1;
-	TRACE(("leave send_msg_channel_close"));
+	TRACE(("leave send_msg_channel_close"))
 }
 
 /* call this when trans/eof channels are closed */
 static void send_msg_channel_eof(struct Channel *channel) {
 
-	TRACE(("enter send_msg_channel_eof"));
+	TRACE(("enter send_msg_channel_eof"))
 	CHECKCLEARTOWRITE();
 
 	buf_putbyte(ses.writepayload, SSH_MSG_CHANNEL_EOF);
@@ -360,7 +360,7 @@ static void send_msg_channel_eof(struct Channel *channel) {
 
 	channel->senteof = 1;
 
-	TRACE(("leave send_msg_channel_eof"));
+	TRACE(("leave send_msg_channel_eof"))
 }
 
 /* Called to write data out to the local side of the channel. 
@@ -370,7 +370,7 @@ static void writechannel(struct Channel* channel, int fd, circbuffer *cbuf) {
 
 	int len, maxlen;
 
-	TRACE(("enter writechannel"));
+	TRACE(("enter writechannel"))
 
 	maxlen = cbuf_readlen(cbuf);
 
@@ -382,7 +382,7 @@ static void writechannel(struct Channel* channel, int fd, circbuffer *cbuf) {
 			 * that's a nasty failure too */
 			closeinfd(channel);
 		}
-		TRACE(("leave writechannel: len <= 0"));
+		TRACE(("leave writechannel: len <= 0"))
 		return;
 	}
 
@@ -392,7 +392,7 @@ static void writechannel(struct Channel* channel, int fd, circbuffer *cbuf) {
 	if (fd == channel->infd && len == maxlen && channel->recveof) { 
 		/* Check if we're closing up */
 		closeinfd(channel);
-		TRACE(("leave writechannel: recveof set"));
+		TRACE(("leave writechannel: recveof set"))
 		return;
 	}
 
@@ -410,7 +410,7 @@ static void writechannel(struct Channel* channel, int fd, circbuffer *cbuf) {
 			channel->recvwindow <= cbuf_getavail(channel->extrabuf));
 	
 	
-	TRACE(("leave writechannel"));
+	TRACE(("leave writechannel"))
 }
 
 /* Set the file descriptors for the main select in session.c
@@ -444,7 +444,7 @@ void setchannelfds(fd_set *readfd, fd_set *writefd) {
 		TRACE(("infd = %d, outfd %d, errfd %d, bufused %d", 
 					channel->infd, channel->outfd,
 					channel->errfd,
-					cbuf_getused(channel->writebuf) ));
+					cbuf_getused(channel->writebuf) ))
 		if (channel->infd >= 0 && channel->infd != channel->outfd) {
 			FD_SET(channel->infd, readfd);
 		}
@@ -477,7 +477,7 @@ void recv_msg_channel_eof() {
 	unsigned int chan;
 	struct Channel * channel;
 
-	TRACE(("enter recv_msg_channel_eof"));
+	TRACE(("enter recv_msg_channel_eof"))
 
 	chan = buf_getint(ses.payload);
 	channel = getchannel(chan);
@@ -493,7 +493,7 @@ void recv_msg_channel_eof() {
 		closeinfd(channel);
 	}
 
-	TRACE(("leave recv_msg_channel_eof"));
+	TRACE(("leave recv_msg_channel_eof"))
 }
 
 
@@ -503,10 +503,10 @@ void recv_msg_channel_close() {
 	unsigned int chan;
 	struct Channel * channel;
 
-	TRACE(("enter recv_msg_channel_close"));
+	TRACE(("enter recv_msg_channel_close"))
 
 	chan = buf_getint(ses.payload);
-	TRACE(("close channel = %d", chan));
+	TRACE(("close channel = %d", chan))
 	channel = getchannel(chan);
 
 	if (channel == NULL) {
@@ -521,15 +521,15 @@ void recv_msg_channel_close() {
 		removechannel(channel);
 	}
 
-	TRACE(("leave recv_msg_channel_close"));
+	TRACE(("leave recv_msg_channel_close"))
 }
 
 /* Remove a channel entry, this is only executed after both sides have sent
  * channel close */
 static void removechannel(struct Channel * channel) {
 
-	TRACE(("enter removechannel"));
-	TRACE(("channel index is %d", channel->index));
+	TRACE(("enter removechannel"))
+	TRACE(("channel index is %d", channel->index))
 
 	cbuf_free(channel->writebuf);
 	channel->writebuf = NULL;
@@ -550,7 +550,7 @@ static void removechannel(struct Channel * channel) {
 
 	deletechannel(channel);
 
-	TRACE(("leave removechannel"));
+	TRACE(("leave removechannel"))
 }
 
 /* Remove a channel entry */
@@ -570,7 +570,7 @@ void recv_msg_channel_request() {
 	unsigned int chan;
 	struct Channel *channel;
 
-	TRACE(("enter recv_msg_channel_request"));
+	TRACE(("enter recv_msg_channel_request"))
 	
 	chan = buf_getint(ses.payload);
 	channel = getchannel(chan);
@@ -586,7 +586,7 @@ void recv_msg_channel_request() {
 		send_msg_channel_failure(channel);
 	}
 
-	TRACE(("leave recv_msg_channel_request"));
+	TRACE(("leave recv_msg_channel_request"))
 
 }
 
@@ -603,8 +603,8 @@ static void send_msg_channel_data(struct Channel *channel, int isextended,
 	unsigned int maxlen;
 	int fd;
 
-/*	TRACE(("enter send_msg_channel_data"));
-	TRACE(("extended = %d type = %d", isextended, exttype));*/
+/*	TRACE(("enter send_msg_channel_data"))
+	TRACE(("extended = %d type = %d", isextended, exttype))*/
 
 	CHECKCLEARTOWRITE();
 
@@ -623,14 +623,14 @@ static void send_msg_channel_data(struct Channel *channel, int isextended,
 	maxlen = MIN(maxlen, 
 			ses.writepayload->size - 1 - 4 - 4 - (isextended ? 4 : 0));
 	if (maxlen == 0) {
-		TRACE(("leave send_msg_channel_data: no window"));
+		TRACE(("leave send_msg_channel_data: no window"))
 		return; /* the data will get written later */
 	}
 
 	/* read the data */
-	TRACE(("maxlen %d", maxlen));
+	TRACE(("maxlen %d", maxlen))
 	buf = buf_new(maxlen);
-	TRACE(("buf pos %d data %x", buf->pos, buf->data));
+	TRACE(("buf pos %d data %x", buf->pos, buf->data))
 	len = read(fd, buf_getwriteptr(buf, maxlen), maxlen);
 	if (len <= 0) {
 		/* on error/eof, send eof */
@@ -660,7 +660,7 @@ static void send_msg_channel_data(struct Channel *channel, int isextended,
 	channel->transwindow -= len;
 
 	encrypt_packet();
-	TRACE(("leave send_msg_channel_data"));
+	TRACE(("leave send_msg_channel_data"))
 }
 
 /* We receive channel data */
@@ -689,7 +689,7 @@ void common_recv_msg_channel_data(struct Channel *channel, int fd,
 	unsigned int buflen;
 	unsigned int len;
 
-	TRACE(("enter recv_msg_channel_data"));
+	TRACE(("enter recv_msg_channel_data"))
 
 	if (channel->recveof) {
 		dropbear_exit("received data after eof");
@@ -730,7 +730,7 @@ void common_recv_msg_channel_data(struct Channel *channel, int fd,
 	channel->recvwindow -= datalen;
 	assert(channel->recvwindow <= RECV_MAXWINDOW);
 
-	TRACE(("leave recv_msg_channel_data"));
+	TRACE(("leave recv_msg_channel_data"))
 }
 
 /* Increment the outgoing data window for a channel - the remote end limits
@@ -750,7 +750,7 @@ void recv_msg_channel_window_adjust() {
 	}
 	
 	incr = buf_getint(ses.payload);
-	TRACE(("received window increment %d", incr));
+	TRACE(("received window increment %d", incr))
 	incr = MIN(incr, MAX_TRANS_WIN_INCR);
 	
 	channel->transwindow += incr;
@@ -763,7 +763,7 @@ void recv_msg_channel_window_adjust() {
 static void send_msg_channel_window_adjust(struct Channel* channel, 
 		unsigned int incr) {
 
-	TRACE(("sending window adjust %d", incr));
+	TRACE(("sending window adjust %d", incr))
 	CHECKCLEARTOWRITE();
 
 	buf_putbyte(ses.writepayload, SSH_MSG_CHANNEL_WINDOW_ADJUST);
@@ -787,7 +787,7 @@ void recv_msg_channel_open() {
 	int ret;
 
 
-	TRACE(("enter recv_msg_channel_open"));
+	TRACE(("enter recv_msg_channel_open"))
 
 	/* get the packet contents */
 	type = buf_getstring(ses.payload, &typelen);
@@ -815,17 +815,17 @@ void recv_msg_channel_open() {
 	}
 
 	if (chantype == NULL) {
-		TRACE(("No matching type for '%s'", type));
+		TRACE(("No matching type for '%s'", type))
 		goto failure;
 	}
 
-	TRACE(("matched type '%s'", type));
+	TRACE(("matched type '%s'", type))
 
 	/* create the channel */
 	channel = newchannel(remotechan, chantype, transwindow, transmaxpacket);
 
 	if (channel == NULL) {
-		TRACE(("newchannel returned NULL"));
+		TRACE(("newchannel returned NULL"))
 		goto failure;
 	}
 
@@ -838,7 +838,7 @@ void recv_msg_channel_open() {
 			}
 			errtype = ret;
 			deletechannel(channel);
-			TRACE(("inithandler returned failure %d", ret));
+			TRACE(("inithandler returned failure %d", ret))
 			goto failure;
 		}
 	}
@@ -849,39 +849,39 @@ void recv_msg_channel_open() {
 	goto cleanup;
 
 failure:
-	TRACE(("recv_msg_channel_open failure"));
+	TRACE(("recv_msg_channel_open failure"))
 	send_msg_channel_open_failure(remotechan, errtype, "", "");
 
 cleanup:
 	m_free(type);
 
-	TRACE(("leave recv_msg_channel_open"));
+	TRACE(("leave recv_msg_channel_open"))
 }
 
 /* Send a failure message */
 void send_msg_channel_failure(struct Channel *channel) {
 
-	TRACE(("enter send_msg_channel_failure"));
+	TRACE(("enter send_msg_channel_failure"))
 	CHECKCLEARTOWRITE();
 
 	buf_putbyte(ses.writepayload, SSH_MSG_CHANNEL_FAILURE);
 	buf_putint(ses.writepayload, channel->remotechan);
 
 	encrypt_packet();
-	TRACE(("leave send_msg_channel_failure"));
+	TRACE(("leave send_msg_channel_failure"))
 }
 
 /* Send a success message */
 void send_msg_channel_success(struct Channel *channel) {
 
-	TRACE(("enter send_msg_channel_success"));
+	TRACE(("enter send_msg_channel_success"))
 	CHECKCLEARTOWRITE();
 
 	buf_putbyte(ses.writepayload, SSH_MSG_CHANNEL_SUCCESS);
 	buf_putint(ses.writepayload, channel->remotechan);
 
 	encrypt_packet();
-	TRACE(("leave send_msg_channel_success"));
+	TRACE(("leave send_msg_channel_success"))
 }
 
 /* Send a channel open failure message, with a corresponding reason
@@ -889,7 +889,7 @@ void send_msg_channel_success(struct Channel *channel) {
 static void send_msg_channel_open_failure(unsigned int remotechan, 
 		int reason, const unsigned char *text, const unsigned char *lang) {
 
-	TRACE(("enter send_msg_channel_open_failure"));
+	TRACE(("enter send_msg_channel_open_failure"))
 	CHECKCLEARTOWRITE();
 	
 	buf_putbyte(ses.writepayload, SSH_MSG_CHANNEL_OPEN_FAILURE);
@@ -899,7 +899,7 @@ static void send_msg_channel_open_failure(unsigned int remotechan,
 	buf_putstring(ses.writepayload, lang, strlen((char*)lang));
 
 	encrypt_packet();
-	TRACE(("leave send_msg_channel_open_failure"));
+	TRACE(("leave send_msg_channel_open_failure"))
 }
 
 /* Confirm a channel open, and let the remote end know what number we've
@@ -908,7 +908,7 @@ static void send_msg_channel_open_confirmation(struct Channel* channel,
 		unsigned int recvwindow, 
 		unsigned int recvmaxpacket) {
 
-	TRACE(("enter send_msg_channel_open_confirmation"));
+	TRACE(("enter send_msg_channel_open_confirmation"))
 	CHECKCLEARTOWRITE();
 
 	buf_putbyte(ses.writepayload, SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
@@ -918,7 +918,7 @@ static void send_msg_channel_open_confirmation(struct Channel* channel,
 	buf_putint(ses.writepayload, recvmaxpacket);
 
 	encrypt_packet();
-	TRACE(("leave send_msg_channel_open_confirmation"));
+	TRACE(("leave send_msg_channel_open_confirmation"))
 }
 
 #if defined(USING_LISTENERS) || defined(DROPBEAR_CLIENT)
@@ -931,10 +931,10 @@ int send_msg_channel_open_init(int fd, const struct ChanType *type) {
 
 	struct Channel* chan;
 
-	TRACE(("enter send_msg_channel_open_init()"));
+	TRACE(("enter send_msg_channel_open_init()"))
 	chan = newchannel(0, type, 0, 0);
 	if (!chan) {
-		TRACE(("leave send_msg_channel_open_init() - FAILED in newchannel()"));
+		TRACE(("leave send_msg_channel_open_init() - FAILED in newchannel()"))
 		return DROPBEAR_FAILURE;
 	}
 
@@ -953,7 +953,7 @@ int send_msg_channel_open_init(int fd, const struct ChanType *type) {
 	buf_putint(ses.writepayload, RECV_MAXWINDOW);
 	buf_putint(ses.writepayload, RECV_MAXPACKET);
 
-	TRACE(("leave send_msg_channel_open_init()"));
+	TRACE(("leave send_msg_channel_open_init()"))
 	return DROPBEAR_SUCCESS;
 }
 
@@ -965,7 +965,7 @@ void recv_msg_channel_open_confirmation() {
 	struct Channel * channel;
 	int ret;
 
-	TRACE(("enter recv_msg_channel_open_confirmation"));
+	TRACE(("enter recv_msg_channel_open_confirmation"))
 	chan = buf_getint(ses.payload);
 
 	channel = getchannel(chan);
@@ -977,19 +977,19 @@ void recv_msg_channel_open_confirmation() {
 	channel->transwindow = buf_getint(ses.payload);
 	channel->transmaxpacket = buf_getint(ses.payload);
 	
-	TRACE(("new chan remote %d localho %d", channel->remotechan, chan));
+	TRACE(("new chan remote %d localho %d", channel->remotechan, chan))
 
 	/* Run the inithandler callback */
 	if (channel->type->inithandler) {
 		ret = channel->type->inithandler(channel);
 		if (ret > 0) {
 			removechannel(channel);
-			TRACE(("inithandler returned failure %d", ret));
+			TRACE(("inithandler returned failure %d", ret))
 		}
 	}
 
 	
-	TRACE(("leave recv_msg_channel_open_confirmation"));
+	TRACE(("leave recv_msg_channel_open_confirmation"))
 }
 
 /* Notification that our channel open request failed */
@@ -1013,17 +1013,17 @@ static void closeoutfd(struct Channel * channel, int fd) {
 
 	/* don't close it if it is the same as infd,
 	 * unless infd is already set -1 */
-	TRACE(("enter closeoutfd"));
+	TRACE(("enter closeoutfd"))
 	closechanfd(channel, fd, 0);
-	TRACE(("leave closeoutfd"));
+	TRACE(("leave closeoutfd"))
 }
 
 /* close a stdin fd */
 static void closeinfd(struct Channel * channel) {
 
-	TRACE(("enter closeinfd"));
+	TRACE(("enter closeinfd"))
 	closechanfd(channel, channel->infd, 1);
-	TRACE(("leave closeinfd"));
+	TRACE(("leave closeinfd"))
 }
 
 /* close a fd, how is 0 for stdout/stderr, 1 for stdin */
diff --git a/common-kex.c b/common-kex.c
index 38ce090..97e341d 100644
--- a/common-kex.c
+++ b/common-kex.c
@@ -114,8 +114,8 @@ void send_msg_kexinit() {
 	encrypt_packet();
 	ses.dataallowed = 0; /* don't send other packets during kex */
 
-	TRACE(("DATAALLOWED=0"));
-	TRACE(("-> KEXINIT"));
+	TRACE(("DATAALLOWED=0"))
+	TRACE(("-> KEXINIT"))
 	ses.kexstate.sentkexinit = 1;
 }
 
@@ -128,7 +128,7 @@ void send_msg_kexinit() {
 /* Bring new keys into use after a key exchange, and let the client know*/
 void send_msg_newkeys() {
 
-	TRACE(("enter send_msg_newkeys"));
+	TRACE(("enter send_msg_newkeys"))
 
 	/* generate the kexinit request */
 	CHECKCLEARTOWRITE();
@@ -138,42 +138,42 @@ void send_msg_newkeys() {
 
 	/* set up our state */
 	if (ses.kexstate.recvnewkeys) {
-		TRACE(("while RECVNEWKEYS=1"));
+		TRACE(("while RECVNEWKEYS=1"))
 		gen_new_keys();
 		kexinitialise(); /* we've finished with this kex */
-		TRACE((" -> DATAALLOWED=1"));
+		TRACE((" -> DATAALLOWED=1"))
 		ses.dataallowed = 1; /* we can send other packets again now */
 		ses.kexstate.donefirstkex = 1;
 	} else {
 		ses.kexstate.sentnewkeys = 1;
-		TRACE(("SENTNEWKEYS=1"));
+		TRACE(("SENTNEWKEYS=1"))
 	}
 
-	TRACE(("-> MSG_NEWKEYS"));
-	TRACE(("leave send_msg_newkeys"));
+	TRACE(("-> MSG_NEWKEYS"))
+	TRACE(("leave send_msg_newkeys"))
 }
 
 /* Bring the new keys into use after a key exchange */
 void recv_msg_newkeys() {
 
-	TRACE(("<- MSG_NEWKEYS"));
-	TRACE(("enter recv_msg_newkeys"));
+	TRACE(("<- MSG_NEWKEYS"))
+	TRACE(("enter recv_msg_newkeys"))
 
 	/* simply check if we've sent SSH_MSG_NEWKEYS, and if so,
 	 * switch to the new keys */
 	if (ses.kexstate.sentnewkeys) {
-		TRACE(("while SENTNEWKEYS=1"));
+		TRACE(("while SENTNEWKEYS=1"))
 		gen_new_keys();
 		kexinitialise(); /* we've finished with this kex */
-	    TRACE((" -> DATAALLOWED=1"));
+	    TRACE((" -> DATAALLOWED=1"))
 	    ses.dataallowed = 1; /* we can send other packets again now */
 		ses.kexstate.donefirstkex = 1;
 	} else {
-		TRACE(("RECVNEWKEYS=1"));
+		TRACE(("RECVNEWKEYS=1"))
 		ses.kexstate.recvnewkeys = 1;
 	}
 	
-	TRACE(("leave recv_msg_newkeys"));
+	TRACE(("leave recv_msg_newkeys"))
 }
 
 
@@ -189,7 +189,7 @@ static void kexinitialise() {
 
 	struct timeval tv;
 
-	TRACE(("kexinitialise()"));
+	TRACE(("kexinitialise()"))
 
 	/* sent/recv'd MSG_KEXINIT */
 	ses.kexstate.sentkexinit = 0;
@@ -262,7 +262,7 @@ void gen_new_keys() {
 	unsigned int C2S_keysize, S2C_keysize;
 	char mactransletter, macrecvletter; /* Client or server specific */
 
-	TRACE(("enter gen_new_keys"));
+	TRACE(("enter gen_new_keys"))
 	/* the dh_K and hash are the start of all hashes, we make use of that */
 
 	sha1_init(&hs);
@@ -329,7 +329,7 @@ void gen_new_keys() {
 	ses.keys = ses.newkeys;
 	ses.newkeys = NULL;
 
-	TRACE(("leave gen_new_keys"));
+	TRACE(("leave gen_new_keys"))
 }
 
 #ifndef DISABLE_ZLIB
@@ -393,8 +393,8 @@ static void gen_new_zstreams() {
 /* Belongs in common_kex.c where it should be moved after review */
 void recv_msg_kexinit() {
 	
-	TRACE(("<- KEXINIT"));
-	TRACE(("enter recv_msg_kexinit"));
+	TRACE(("<- KEXINIT"))
+	TRACE(("enter recv_msg_kexinit"))
 	
 	/* start the kex hash */
 	ses.kexhashbuf = buf_new(MAX_KEXHASHBUF);
@@ -402,7 +402,7 @@ void recv_msg_kexinit() {
 	if (!ses.kexstate.sentkexinit) {
 		/* we need to send a kex packet */
 		send_msg_kexinit();
-		TRACE(("continue recv_msg_kexinit: sent kexinit"));
+		TRACE(("continue recv_msg_kexinit: sent kexinit"))
 	}
 
 
@@ -459,7 +459,7 @@ void recv_msg_kexinit() {
 	ses.kexstate.recvkexinit = 1;
 //	ses.expecting = 0; // client matt
 
-	TRACE(("leave recv_msg_kexinit"));
+	TRACE(("leave recv_msg_kexinit"))
 }
 
 /* Initialises and generate one side of the diffie-hellman key exchange values.
@@ -473,7 +473,7 @@ void gen_kexdh_vals(mp_int *dh_pub, mp_int *dh_priv) {
 	unsigned char randbuf[DH_P_LEN];
 	int dh_q_len;
 
-	TRACE(("enter send_msg_kexdh_reply"));
+	TRACE(("enter send_msg_kexdh_reply"))
 	
 	m_mp_init_multi(&dh_g, &dh_p, &dh_q, NULL);
 
@@ -619,7 +619,7 @@ static void read_kex_algos() {
 		erralgo = "kex";
 		goto error;
 	}
-	TRACE(("kex algo %s", algo->name));
+	TRACE(("kex algo %s", algo->name))
 	ses.newkeys->algo_kex = algo->val;
 
 	/* server_host_key_algorithms */
@@ -629,7 +629,7 @@ static void read_kex_algos() {
 		erralgo = "hostkey";
 		goto error;
 	}
-	TRACE(("hostkey algo %s", algo->name));
+	TRACE(("hostkey algo %s", algo->name))
 	ses.newkeys->algo_hostkey = algo->val;
 
 	/* encryption_algorithms_client_to_server */
@@ -638,7 +638,7 @@ static void read_kex_algos() {
 		erralgo = "enc c->s";
 		goto error;
 	}
-	TRACE(("c2s is  %s", c2s_cipher_algo->name));
+	TRACE(("c2s is  %s", c2s_cipher_algo->name))
 
 	/* encryption_algorithms_server_to_client */
 	s2c_cipher_algo = ses.buf_match_algo(ses.payload, sshciphers, &goodguess);
@@ -646,7 +646,7 @@ static void read_kex_algos() {
 		erralgo = "enc s->c";
 		goto error;
 	}
-	TRACE(("s2c is  %s", s2c_cipher_algo->name));
+	TRACE(("s2c is  %s", s2c_cipher_algo->name))
 
 	/* mac_algorithms_client_to_server */
 	c2s_hash_algo = ses.buf_match_algo(ses.payload, sshhashes, &goodguess);
@@ -717,12 +717,12 @@ static void read_kex_algos() {
 		ses.newkeys->trans_algo_comp = s2c_comp_algo->val;
 	}
 
-	TRACE(("enc algo recv %s", algo->name));
-	TRACE(("enc algo trans %s", algo->name));
-	TRACE(("mac algo recv %s", algo->name));
-	TRACE(("mac algo trans %s", algo->name));
-	TRACE(("comp algo recv %s", algo->name));
-	TRACE(("comp algo trans %s", algo->name));
+	TRACE(("enc algo recv %s", algo->name))
+	TRACE(("enc algo trans %s", algo->name))
+	TRACE(("mac algo recv %s", algo->name))
+	TRACE(("mac algo trans %s", algo->name))
+	TRACE(("comp algo recv %s", algo->name))
+	TRACE(("comp algo trans %s", algo->name))
 
 	/* reserved for future extensions */
 	buf_getint(ses.payload);
diff --git a/common-session.c b/common-session.c
index 2914069..06cdbd1 100644
--- a/common-session.c
+++ b/common-session.c
@@ -52,7 +52,7 @@ int exitflag = 0; /* GLOBAL */
 /* called only at the start of a session, set up initial state */
 void common_session_init(int sock, char* remotehost) {
 
-	TRACE(("enter session_init"));
+	TRACE(("enter session_init"))
 
 	ses.remotehost = remotehost;
 
@@ -110,7 +110,7 @@ void common_session_init(int sock, char* remotehost) {
 	ses.allowprivport = 0;
 
 
-	TRACE(("leave session_init"));
+	TRACE(("leave session_init"))
 }
 
 void session_loop(void(*loophandler)()) {
@@ -162,7 +162,7 @@ void session_loop(void(*loophandler)()) {
 		
 		if (val == 0) {
 			/* timeout */
-			TRACE(("select timeout"));
+			TRACE(("select timeout"))
 			continue;
 		}
 
@@ -201,11 +201,11 @@ void session_loop(void(*loophandler)()) {
 /* clean up a session on exit */
 void common_session_cleanup() {
 	
-	TRACE(("enter session_cleanup"));
+	TRACE(("enter session_cleanup"))
 	
 	/* we can't cleanup if we don't know the session state */
 	if (!sessinitdone) {
-		TRACE(("leave session_cleanup: !sessinitdone"));
+		TRACE(("leave session_cleanup: !sessinitdone"))
 		return;
 	}
 	
@@ -215,7 +215,7 @@ void common_session_cleanup() {
 
 	chancleanup();
 
-	TRACE(("leave session_cleanup"));
+	TRACE(("leave session_cleanup"))
 }
 
 
@@ -252,7 +252,7 @@ void session_identification() {
 	}
 
 	if (!done) {
-		TRACE(("err: %s for '%s'\n", strerror(errno), linebuf));
+		TRACE(("err: %s for '%s'\n", strerror(errno), linebuf))
 		dropbear_exit("Failed to get remote version");
 	} else {
 		/* linebuf is already null terminated */
@@ -260,7 +260,7 @@ void session_identification() {
 		memcpy(ses.remoteident, linebuf, len);
 	}
 
-	TRACE(("remoteident: %s", ses.remoteident));
+	TRACE(("remoteident: %s", ses.remoteident))
 
 }
 
@@ -274,7 +274,7 @@ static int ident_readln(int fd, char* buf, int count) {
 	fd_set fds;
 	struct timeval timeout;
 
-	TRACE(("enter ident_readln"));
+	TRACE(("enter ident_readln"))
 
 	if (count < 1) {
 		return -1;
@@ -295,7 +295,7 @@ static int ident_readln(int fd, char* buf, int count) {
 			if (errno == EINTR) {
 				continue;
 			}
-			TRACE(("leave ident_readln: select error"));
+			TRACE(("leave ident_readln: select error"))
 			return -1;
 		}
 
@@ -313,12 +313,12 @@ static int ident_readln(int fd, char* buf, int count) {
 				if (errno == EINTR) {
 					continue; /* not a real error */
 				}
-				TRACE(("leave ident_readln: read error"));
+				TRACE(("leave ident_readln: read error"))
 				return -1;
 			}
 			if (num == 0) {
 				/* EOF */
-				TRACE(("leave ident_readln: EOF"));
+				TRACE(("leave ident_readln: EOF"))
 				return -1;
 			}
 			if (in == '\n') {
@@ -334,7 +334,7 @@ static int ident_readln(int fd, char* buf, int count) {
 	}
 
 	buf[pos] = '\0';
-	TRACE(("leave ident_readln: return %d", pos+1));
+	TRACE(("leave ident_readln: return %d", pos+1))
 	return pos+1;
 }
 
@@ -363,7 +363,7 @@ static void checktimeouts() {
 	if (!ses.kexstate.sentkexinit
 			&& (secs - ses.kexstate.lastkextime >= KEX_REKEY_TIMEOUT
 			|| ses.kexstate.datarecv+ses.kexstate.datatrans >= KEX_REKEY_DATA)){
-		TRACE(("rekeying after timeout or max data reached"));
+		TRACE(("rekeying after timeout or max data reached"))
 		send_msg_kexinit();
 	}
 }
diff --git a/dbutil.c b/dbutil.c
index c77386f..3ead979 100644
--- a/dbutil.c
+++ b/dbutil.c
@@ -164,17 +164,17 @@ int dropbear_listen(const char* address, const char* port,
 	int val;
 	int sock;
 
-	TRACE(("enter dropbear_listen"));
+	TRACE(("enter dropbear_listen"))
 	
 	memset(&hints, 0, sizeof(hints));
 	hints.ai_family = AF_UNSPEC; /* TODO: let them flag v4 only etc */
 	hints.ai_socktype = SOCK_STREAM;
 
 	if (address && address[0] == '\0') {
-		TRACE(("dropbear_listen: local loopback"));
+		TRACE(("dropbear_listen: local loopback"))
 		address = NULL;
 	} else {
-		TRACE(("dropbear_listen: not local loopback"));
+		TRACE(("dropbear_listen: not local loopback"))
 		hints.ai_flags = AI_PASSIVE;
 	}
 	err = getaddrinfo(address, port, &hints, &res0);
@@ -186,7 +186,7 @@ int dropbear_listen(const char* address, const char* port,
 			*errstring = (char*)m_malloc(len);
 			snprintf(*errstring, len, "Error resolving: %s", gai_strerror(err));
 		}
-		TRACE(("leave dropbear_listen: failed resolving"));
+		TRACE(("leave dropbear_listen: failed resolving"))
 		return -1;
 	}
 
@@ -203,7 +203,7 @@ int dropbear_listen(const char* address, const char* port,
 
 		if (sock < 0) {
 			err = errno;
-			TRACE(("socket() failed"));
+			TRACE(("socket() failed"))
 			continue;
 		}
 
@@ -221,14 +221,14 @@ int dropbear_listen(const char* address, const char* port,
 		if (bind(sock, res->ai_addr, res->ai_addrlen) < 0) {
 			err = errno;
 			close(sock);
-			TRACE(("bind(%s) failed", port));
+			TRACE(("bind(%s) failed", port))
 			continue;
 		}
 
 		if (listen(sock, 20) < 0) {
 			err = errno;
 			close(sock);
-			TRACE(("listen() failed"));
+			TRACE(("listen() failed"))
 			continue;
 		}
 
@@ -243,12 +243,12 @@ int dropbear_listen(const char* address, const char* port,
 			len = 20 + strlen(strerror(err));
 			*errstring = (char*)m_malloc(len);
 			snprintf(*errstring, len, "Error listening: %s", strerror(err));
-			TRACE(("leave dropbear_listen: failure, %s", strerror(err)));
+			TRACE(("leave dropbear_listen: failure, %s", strerror(err)))
 			return -1;
 		}
 	}
 
-	TRACE(("leave dropbear_listen: success, %d socks bound", nsock));
+	TRACE(("leave dropbear_listen: success, %d socks bound", nsock))
 	return nsock;
 }
 
@@ -264,7 +264,7 @@ int connect_remote(const char* remotehost, const char* remoteport,
 	int sock;
 	int err;
 
-	TRACE(("enter connect_remote"));
+	TRACE(("enter connect_remote"))
 
 	if (errstring != NULL) {
 		*errstring = NULL;
@@ -282,7 +282,7 @@ int connect_remote(const char* remotehost, const char* remoteport,
 			*errstring = (char*)m_malloc(len);
 			snprintf(*errstring, len, "Error resolving: %s", gai_strerror(err));
 		}
-		TRACE(("Error resolving: %s", gai_strerror(err)));
+		TRACE(("Error resolving: %s", gai_strerror(err)))
 		return -1;
 	}
 
@@ -303,14 +303,14 @@ int connect_remote(const char* remotehost, const char* remoteport,
 				if (errstring != NULL && *errstring == NULL) {
 					*errstring = m_strdup("Failed non-blocking");
 				}
-				TRACE(("Failed non-blocking: %s", strerror(errno)));
+				TRACE(("Failed non-blocking: %s", strerror(errno)))
 				continue;
 			}
 		}
 
 		if (connect(sock, res->ai_addr, res->ai_addrlen) < 0) {
 			if (errno == EINPROGRESS && nonblocking) {
-				TRACE(("Connect in progress"));
+				TRACE(("Connect in progress"))
 				break;
 			} else {
 				err = errno;
@@ -331,7 +331,7 @@ int connect_remote(const char* remotehost, const char* remoteport,
 			*errstring = (char*)m_malloc(len);
 			snprintf(*errstring, len, "Error connecting: %s", strerror(err));
 		}
-		TRACE(("Error connecting: %s", strerror(err)));
+		TRACE(("Error connecting: %s", strerror(err)))
 	} else {
 		/* Success */
 		/* (err is used as a dummy var here) */
@@ -343,7 +343,7 @@ int connect_remote(const char* remotehost, const char* remoteport,
 		m_free(*errstring);
 	}
 
-	TRACE(("leave connect_remote: sock %d\n", sock));
+	TRACE(("leave connect_remote: sock %d\n", sock))
 	return sock;
 }
 
@@ -503,7 +503,7 @@ int buf_getline(buffer * line, FILE * authfile) {
 
 	int c = EOF;
 
-	TRACE(("enter buf_getline"));
+	TRACE(("enter buf_getline"))
 
 	buf_setpos(line, 0);
 	buf_setlen(line, 0);
@@ -518,7 +518,7 @@ int buf_getline(buffer * line, FILE * authfile) {
 		buf_putbyte(line, (unsigned char)c);
 	}
 
-	TRACE(("leave getauthline: line too long"));
+	TRACE(("leave getauthline: line too long"))
 	/* We return success, but the line length will be zeroed - ie we just
 	 * ignore that line */
 	buf_setlen(line, 0);
@@ -528,10 +528,10 @@ out:
 
 	/* if we didn't read anything before EOF or error, exit */
 	if (c == EOF && line->pos == 0) {
-		TRACE(("leave buf_getline: failure"));
+		TRACE(("leave buf_getline: failure"))
 		return DROPBEAR_FAILURE;
 	} else {
-		TRACE(("leave buf_getline: success"));
+		TRACE(("leave buf_getline: success"))
 		buf_setpos(line, 0);
 		return DROPBEAR_SUCCESS;
 	}
@@ -618,10 +618,10 @@ void m_burn(void *data, unsigned int len) {
 
 void setnonblocking(int fd) {
 
-	TRACE(("setnonblocking: %d", fd));
+	TRACE(("setnonblocking: %d", fd))
 
 	if (fcntl(fd, F_SETFL, O_NONBLOCK) < 0) {
 		dropbear_exit("Couldn't set nonblocking");
 	}
-	TRACE(("leave setnonblocking"));
+	TRACE(("leave setnonblocking"))
 }
diff --git a/debug.h b/debug.h
index 37f51ac..7b1e2b5 100644
--- a/debug.h
+++ b/debug.h
@@ -39,7 +39,7 @@
  * Caution: Don't use this in an unfriendly environment (ie unfirewalled),
  * since the printing may not sanitise strings etc. This will add a reasonable
  * amount to your executable size. */
-/* #define DEBUG_TRACE */
+ //#define DEBUG_TRACE 
 
 /* All functions writing to the cleartext payload buffer call
  * CHECKCLEARTOWRITE() before writing. This is only really useful if you're
@@ -60,7 +60,7 @@
 
 /* you don't need to touch this block */
 #ifdef DEBUG_TRACE
-#define TRACE(X) (dropbear_trace X)
+#define TRACE(X) dropbear_trace X;
 #else /*DEBUG_TRACE*/
 #define TRACE(X)
 #endif /*DEBUG_TRACE*/
diff --git a/dropbearkey.c b/dropbearkey.c
index 364b765..8ceefdc 100644
--- a/dropbearkey.c
+++ b/dropbearkey.c
@@ -166,13 +166,13 @@ int main(int argc, char ** argv) {
 #ifdef DROPBEAR_RSA
 		if (strncmp(typetext, "rsa", 3) == 0) {
 			keytype = DROPBEAR_SIGNKEY_RSA;
-			TRACE(("type is rsa"));
+			TRACE(("type is rsa"))
 		}
 #endif
 #ifdef DROPBEAR_DSS
 		if (strncmp(typetext, "dss", 3) == 0) {
 			keytype = DROPBEAR_SIGNKEY_DSS;
-			TRACE(("type is dss"));
+			TRACE(("type is dss"))
 		}
 #endif
 	}
diff --git a/dss.c b/dss.c
index 0cb437c..6429ede 100644
--- a/dss.c
+++ b/dss.c
@@ -45,7 +45,7 @@
  * Returns DROPBEAR_SUCCESS or DROPBEAR_FAILURE */
 int buf_get_dss_pub_key(buffer* buf, dss_key *key) {
 
-	TRACE(("enter buf_get_dss_pub_key"));
+	TRACE(("enter buf_get_dss_pub_key"))
 	assert(key != NULL);
 	key->p = m_malloc(sizeof(mp_int));
 	key->q = m_malloc(sizeof(mp_int));
@@ -59,17 +59,17 @@ int buf_get_dss_pub_key(buffer* buf, dss_key *key) {
 	 || buf_getmpint(buf, key->q) == DROPBEAR_FAILURE
 	 || buf_getmpint(buf, key->g) == DROPBEAR_FAILURE
 	 || buf_getmpint(buf, key->y) == DROPBEAR_FAILURE) {
-		TRACE(("leave buf_get_dss_pub_key: failed reading mpints"));
+		TRACE(("leave buf_get_dss_pub_key: failed reading mpints"))
 		return DROPBEAR_FAILURE;
 	}
 
 	if (mp_count_bits(key->p) < MIN_DSS_KEYLEN) {
 		dropbear_log(LOG_WARNING, "DSS key too short");
-		TRACE(("leave buf_get_dss_pub_key: short key"));
+		TRACE(("leave buf_get_dss_pub_key: short key"))
 		return DROPBEAR_FAILURE;
 	}
 
-	TRACE(("leave buf_get_dss_pub_key: success"));
+	TRACE(("leave buf_get_dss_pub_key: success"))
 	return DROPBEAR_SUCCESS;
 }
 
@@ -98,9 +98,9 @@ int buf_get_dss_priv_key(buffer* buf, dss_key *key) {
 /* Clear and free the memory used by a public or private key */
 void dss_key_free(dss_key *key) {
 
-	TRACE(("enter dsa_key_free"));
+	TRACE(("enter dsa_key_free"))
 	if (key == NULL) {
-		TRACE(("enter dsa_key_free: key == NULL"));
+		TRACE(("enter dsa_key_free: key == NULL"))
 		return;
 	}
 	if (key->p) {
@@ -124,7 +124,7 @@ void dss_key_free(dss_key *key) {
 		m_free(key->x);
 	}
 	m_free(key);
-	TRACE(("leave dsa_key_free"));
+	TRACE(("leave dsa_key_free"))
 }
 
 /* put the dss public key into the buffer in the required format:
@@ -171,7 +171,7 @@ int buf_dss_verify(buffer* buf, dss_key *key, const unsigned char* data,
 	char * string = NULL;
 	int stringlen;
 
-	TRACE(("enter buf_dss_verify"));
+	TRACE(("enter buf_dss_verify"))
 	assert(key != NULL);
 
 	m_mp_init_multi(&val1, &val2, &val3, &val4, NULL);
@@ -195,7 +195,7 @@ int buf_dss_verify(buffer* buf, dss_key *key, const unsigned char* data,
 		goto out;
 	}
 	if (mp_cmp(&val1, key->q) != MP_LT) {
-		TRACE(("verify failed, s' >= q"));
+		TRACE(("verify failed, s' >= q"))
 		goto out;
 	}
 	/* let val2 = w = (s')^-1 mod q*/
@@ -220,7 +220,7 @@ int buf_dss_verify(buffer* buf, dss_key *key, const unsigned char* data,
 		goto out;
 	}
 	if (mp_cmp(&val1, key->q) != MP_LT) {
-		TRACE(("verify failed, r' >= q"));
+		TRACE(("verify failed, r' >= q"))
 		goto out;
 	}
 	/* let val4 = u2 = ((r')w) mod q */
@@ -315,7 +315,7 @@ void buf_put_dss_sign(buffer* buf, dss_key *key, const unsigned char* data,
 	DEF_MP_INT(dss_s);
 	hash_state hs;
 	
-	TRACE(("enter buf_put_dss_sign"));
+	TRACE(("enter buf_put_dss_sign"))
 	assert(key != NULL);
 	
 	/* hash the data */
@@ -422,7 +422,7 @@ void buf_put_dss_sign(buffer* buf, dss_key *key, const unsigned char* data,
 	
 	/* create the signature to return */
 
-	TRACE(("leave buf_put_dss_sign"));
+	TRACE(("leave buf_put_dss_sign"))
 }
 
 #endif /* DROPBEAR_DSS */
diff --git a/listener.c b/listener.c
index 1a6da04..dd90c6b 100644
--- a/listener.c
+++ b/listener.c
@@ -93,7 +93,7 @@ struct Listener* new_listener(int socks[], unsigned int nsocks,
 	/* or create a new one */
 	if (i == ses.listensize) {
 		if (ses.listensize > MAX_LISTENERS) {
-			TRACE(("leave newlistener: too many already"));
+			TRACE(("leave newlistener: too many already"))
 			for (j = 0; j < nsocks; j++) {
 				close(socks[i]);
 			}
@@ -115,7 +115,7 @@ struct Listener* new_listener(int socks[], unsigned int nsocks,
 		ses.maxfd = MAX(ses.maxfd, socks[j]);
 	}
 
-	TRACE(("new listener num %d ", i));
+	TRACE(("new listener num %d ", i))
 
 	newlisten = (struct Listener*)m_malloc(sizeof(struct Listener));
 	newlisten->index = i;
diff --git a/packet.c b/packet.c
index 5e8e14d..56b31c2 100644
--- a/packet.c
+++ b/packet.c
@@ -52,7 +52,7 @@ void write_packet() {
 	int len, written;
 	buffer * writebuf = NULL;
 	
-	TRACE(("enter write_packet"));
+	TRACE(("enter write_packet"))
 	assert(!isempty(&ses.writequeue));
 
 	/* Get the next buffer in the queue of encrypted packets to write*/
@@ -65,7 +65,7 @@ void write_packet() {
 
 	if (written < 0) {
 		if (errno == EINTR) {
-			TRACE(("leave writepacket: EINTR"));
+			TRACE(("leave writepacket: EINTR"))
 			return;
 		} else {
 			dropbear_exit("error writing");
@@ -86,7 +86,7 @@ void write_packet() {
 		buf_incrpos(writebuf, written);
 	}
 
-	TRACE(("leave write_packet"));
+	TRACE(("leave write_packet"))
 }
 
 /* Non-blocking function reading available portion of a packet into the
@@ -98,7 +98,7 @@ void read_packet() {
 	unsigned int maxlen;
 	unsigned char blocksize;
 
-	TRACE(("enter read_packet"));
+	TRACE(("enter read_packet"))
 	blocksize = ses.keys->recv_algo_crypt->blocksize;
 	
 	if (ses.readbuf == NULL || ses.readbuf->len < blocksize) {
@@ -111,7 +111,7 @@ void read_packet() {
 		/* If we don't have the length of decryptreadbuf, we didn't read
 		 * a whole blocksize and should exit */
 		if (ses.decryptreadbuf->len == 0) {
-			TRACE(("leave read_packet: packetinit done"));
+			TRACE(("leave read_packet: packetinit done"))
 			return;
 		}
 	}
@@ -128,7 +128,7 @@ void read_packet() {
 
 	if (len < 0) {
 		if (errno == EINTR || errno == EAGAIN) {
-			TRACE(("leave read_packet: EINTR or EAGAIN"));
+			TRACE(("leave read_packet: EINTR or EAGAIN"))
 			return;
 		} else {
 			dropbear_exit("error reading: %s", strerror(errno));
@@ -143,7 +143,7 @@ void read_packet() {
 		/* The main select() loop process_packet() to
 		 * handle the packet contents... */
 	}
-	TRACE(("leave read_packet"));
+	TRACE(("leave read_packet"))
 }
 
 /* Function used to read the initial portion of a packet, and determine the
@@ -176,7 +176,7 @@ static void read_packet_init() {
 	}
 	if (len < 0) {
 		if (errno == EINTR) {
-			TRACE(("leave read_packet_init: EINTR"));
+			TRACE(("leave read_packet_init: EINTR"))
 			return;
 		}
 		dropbear_exit("error reading: %s", strerror(errno));
@@ -230,7 +230,7 @@ void decrypt_packet() {
 	unsigned int padlen;
 	unsigned int len;
 
-	TRACE(("enter decrypt_packet"));
+	TRACE(("enter decrypt_packet"))
 	blocksize = ses.keys->recv_algo_crypt->blocksize;
 	macsize = ses.keys->recv_algo_mac->hashsize;
 
@@ -305,7 +305,7 @@ void decrypt_packet() {
 
 	ses.recvseq++;
 
-	TRACE(("leave decrypt_packet"));
+	TRACE(("leave decrypt_packet"))
 }
 
 /* Checks the mac in hashbuf, for the data in readbuf.
@@ -413,8 +413,8 @@ void encrypt_packet() {
 	buffer * writebuf; /* the packet which will go on the wire */
 	buffer * clearwritebuf; /* unencrypted, possibly compressed */
 	
-	TRACE(("enter encrypt_packet()"));
-	TRACE(("encrypt_packet type is %d", ses.writepayload->data[0]));
+	TRACE(("enter encrypt_packet()"))
+	TRACE(("encrypt_packet type is %d", ses.writepayload->data[0]))
 	blocksize = ses.keys->trans_algo_crypt->blocksize;
 	macsize = ses.keys->trans_algo_mac->hashsize;
 
@@ -514,7 +514,7 @@ void encrypt_packet() {
 	ses.kexstate.datatrans += writebuf->len;
 	ses.transseq++;
 
-	TRACE(("leave encrypt_packet()"));
+	TRACE(("leave encrypt_packet()"))
 }
 
 
@@ -526,7 +526,7 @@ static void writemac(buffer * outputbuffer, buffer * clearwritebuf) {
 	unsigned long hashsize;
 	hmac_state hmac;
 
-	TRACE(("enter writemac"));
+	TRACE(("enter writemac"))
 
 	macsize = ses.keys->trans_algo_mac->hashsize;
 
@@ -561,7 +561,7 @@ static void writemac(buffer * outputbuffer, buffer * clearwritebuf) {
 		}
 		buf_incrwritepos(outputbuffer, macsize);
 	}
-	TRACE(("leave writemac"));
+	TRACE(("leave writemac"))
 }
 
 #ifndef DISABLE_ZLIB
@@ -572,7 +572,7 @@ static void buf_compress(buffer * dest, buffer * src, unsigned int len) {
 	unsigned int endpos = src->pos + len;
 	int result;
 
-	TRACE(("enter buf_compress"));
+	TRACE(("enter buf_compress"))
 
 	while (1) {
 
@@ -606,6 +606,6 @@ static void buf_compress(buffer * dest, buffer * src, unsigned int len) {
 		buf_resize(dest, dest->size + ZLIB_COMPRESS_INCR);
 
 	}
-	TRACE(("leave buf_compress"));
+	TRACE(("leave buf_compress"))
 }
 #endif
diff --git a/process-packet.c b/process-packet.c
index bdec032..07fc130 100644
--- a/process-packet.c
+++ b/process-packet.c
@@ -45,10 +45,10 @@ void process_packet() {
 	unsigned char type;
 	unsigned int i;
 
-	TRACE(("enter process_packet"));
+	TRACE(("enter process_packet"))
 
 	type = buf_getbyte(ses.payload);
-	TRACE(("process_packet: packet type = %d", type));
+	TRACE(("process_packet: packet type = %d", type))
 
 	ses.lastpacket = type;
 
@@ -57,12 +57,12 @@ void process_packet() {
 
 		case SSH_MSG_IGNORE:
 		case SSH_MSG_DEBUG:
-			TRACE(("received SSH_MSG_IGNORE or SSH_MSG_DEBUG"));
+			TRACE(("received SSH_MSG_IGNORE or SSH_MSG_DEBUG"))
 			goto out;
 
 		case SSH_MSG_UNIMPLEMENTED:
 			/* debugging XXX */
-			TRACE(("SSH_MSG_UNIMPLEMENTED"));
+			TRACE(("SSH_MSG_UNIMPLEMENTED"))
 			dropbear_exit("received SSH_MSG_UNIMPLEMENTED");
 			
 		case SSH_MSG_DISCONNECT:
@@ -87,7 +87,7 @@ void process_packet() {
 	/* Check if we should ignore this packet. Used currently only for
 	 * KEX code, with first_kex_packet_follows */
 	if (ses.ignorenext) {
-		TRACE(("Ignoring packet, type = %d", type));
+		TRACE(("Ignoring packet, type = %d", type))
 		ses.ignorenext = 0;
 		goto out;
 	}
@@ -115,7 +115,7 @@ void process_packet() {
 
 	
 	/* TODO do something more here? */
-	TRACE(("preauth unknown packet"));
+	TRACE(("preauth unknown packet"))
 	recv_unimplemented();
 
 out:
@@ -123,7 +123,7 @@ out:
 	buf_free(ses.payload);
 	ses.payload = NULL;
 
-	TRACE(("leave process_packet"));
+	TRACE(("leave process_packet"))
 }
 
 
diff --git a/queue.c b/queue.c
index a1352dc..caf6145 100644
--- a/queue.c
+++ b/queue.c
@@ -52,7 +52,7 @@ void* dequeue(struct Queue* queue) {
 	} else {
 		queue->head = NULL;
 		queue->tail = NULL;
-		TRACE(("empty queue dequeing"));
+		TRACE(("empty queue dequeing"))
 	}
 
 	m_free(oldhead);
@@ -70,7 +70,7 @@ void enqueue(struct Queue* queue, void* item) {
 
 	struct Link* newlink;
 
-	TRACE(("enter enqueue"));
+	TRACE(("enter enqueue"))
 	newlink = (struct Link*)m_malloc(sizeof(struct Link));
 
 	newlink->item = item;
@@ -85,5 +85,5 @@ void enqueue(struct Queue* queue, void* item) {
 		queue->head = newlink;
 	}
 	queue->count++;
-	TRACE(("leave enqueue"));
+	TRACE(("leave enqueue"))
 }
diff --git a/rsa.c b/rsa.c
index 7e891e0..1ac0357 100644
--- a/rsa.c
+++ b/rsa.c
@@ -47,7 +47,7 @@ static mp_int * rsa_pad_em(rsa_key * key,
  * Returns DROPBEAR_SUCCESS or DROPBEAR_FAILURE */
 int buf_get_rsa_pub_key(buffer* buf, rsa_key *key) {
 
-	TRACE(("enter buf_get_rsa_pub_key"));
+	TRACE(("enter buf_get_rsa_pub_key"))
 	assert(key != NULL);
 	key->e = m_malloc(sizeof(mp_int));
 	key->n = m_malloc(sizeof(mp_int));
@@ -60,7 +60,7 @@ int buf_get_rsa_pub_key(buffer* buf, rsa_key *key) {
 
 	if (buf_getmpint(buf, key->e) == DROPBEAR_FAILURE
 	 || buf_getmpint(buf, key->n) == DROPBEAR_FAILURE) {
-		TRACE(("leave buf_get_rsa_pub_key: failure"));
+		TRACE(("leave buf_get_rsa_pub_key: failure"))
 		return DROPBEAR_FAILURE;
 	}
 
@@ -69,7 +69,7 @@ int buf_get_rsa_pub_key(buffer* buf, rsa_key *key) {
 		return DROPBEAR_FAILURE;
 	}
 
-	TRACE(("leave buf_get_rsa_pub_key: success"));
+	TRACE(("leave buf_get_rsa_pub_key: success"))
 	return DROPBEAR_SUCCESS;
 
 }
@@ -81,17 +81,17 @@ int buf_get_rsa_priv_key(buffer* buf, rsa_key *key) {
 
 	assert(key != NULL);
 
-	TRACE(("enter buf_get_rsa_priv_key"));
+	TRACE(("enter buf_get_rsa_priv_key"))
 
 	if (buf_get_rsa_pub_key(buf, key) == DROPBEAR_FAILURE) {
-		TRACE(("leave buf_get_rsa_priv_key: pub: ret == DROPBEAR_FAILURE"));
+		TRACE(("leave buf_get_rsa_priv_key: pub: ret == DROPBEAR_FAILURE"))
 		return DROPBEAR_FAILURE;
 	}
 
 	key->d = m_malloc(sizeof(mp_int));
 	m_mp_init(key->d);
 	if (buf_getmpint(buf, key->d) == DROPBEAR_FAILURE) {
-		TRACE(("leave buf_get_rsa_priv_key: d: ret == DROPBEAR_FAILURE"));
+		TRACE(("leave buf_get_rsa_priv_key: d: ret == DROPBEAR_FAILURE"))
 		return DROPBEAR_FAILURE;
 	}
 
@@ -105,17 +105,17 @@ int buf_get_rsa_priv_key(buffer* buf, rsa_key *key) {
 		m_mp_init_multi(key->p, key->q, NULL);
 
 		if (buf_getmpint(buf, key->p) == DROPBEAR_FAILURE) {
-			TRACE(("leave buf_get_rsa_priv_key: p: ret == DROPBEAR_FAILURE"));
+			TRACE(("leave buf_get_rsa_priv_key: p: ret == DROPBEAR_FAILURE"))
 			return DROPBEAR_FAILURE;
 		}
 
 		if (buf_getmpint(buf, key->q) == DROPBEAR_FAILURE) {
-			TRACE(("leave buf_get_rsa_priv_key: q: ret == DROPBEAR_FAILURE"));
+			TRACE(("leave buf_get_rsa_priv_key: q: ret == DROPBEAR_FAILURE"))
 			return DROPBEAR_FAILURE;
 		}
 	}
 
-	TRACE(("leave buf_get_rsa_priv_key"));
+	TRACE(("leave buf_get_rsa_priv_key"))
 	return DROPBEAR_SUCCESS;
 }
 	
@@ -123,10 +123,10 @@ int buf_get_rsa_priv_key(buffer* buf, rsa_key *key) {
 /* Clear and free the memory used by a public or private key */
 void rsa_key_free(rsa_key *key) {
 
-	TRACE(("enter rsa_key_free"));
+	TRACE(("enter rsa_key_free"))
 
 	if (key == NULL) {
-		TRACE(("leave rsa_key_free: key == NULL"));
+		TRACE(("leave rsa_key_free: key == NULL"))
 		return;
 	}
 	if (key->d) {
@@ -150,7 +150,7 @@ void rsa_key_free(rsa_key *key) {
 		m_free(key->q);
 	}
 	m_free(key);
-	TRACE(("leave rsa_key_free"));
+	TRACE(("leave rsa_key_free"))
 }
 
 /* Put the public rsa key into the buffer in the required format:
@@ -161,21 +161,21 @@ void rsa_key_free(rsa_key *key) {
  */
 void buf_put_rsa_pub_key(buffer* buf, rsa_key *key) {
 
-	TRACE(("enter buf_put_rsa_pub_key"));
+	TRACE(("enter buf_put_rsa_pub_key"))
 	assert(key != NULL);
 
 	buf_putstring(buf, SSH_SIGNKEY_RSA, SSH_SIGNKEY_RSA_LEN);
 	buf_putmpint(buf, key->e);
 	buf_putmpint(buf, key->n);
 
-	TRACE(("leave buf_put_rsa_pub_key"));
+	TRACE(("leave buf_put_rsa_pub_key"))
 
 }
 
 /* Same as buf_put_rsa_pub_key, but with the private "x" key appended */
 void buf_put_rsa_priv_key(buffer* buf, rsa_key *key) {
 
-	TRACE(("enter buf_put_rsa_priv_key"));
+	TRACE(("enter buf_put_rsa_priv_key"))
 
 	assert(key != NULL);
 	buf_put_rsa_pub_key(buf, key);
@@ -190,7 +190,7 @@ void buf_put_rsa_priv_key(buffer* buf, rsa_key *key) {
 	}
 
 
-	TRACE(("leave buf_put_rsa_priv_key"));
+	TRACE(("leave buf_put_rsa_priv_key"))
 
 }
 
@@ -206,7 +206,7 @@ int buf_rsa_verify(buffer * buf, rsa_key *key, const unsigned char* data,
 	mp_int *rsa_em = NULL;
 	int ret = DROPBEAR_FAILURE;
 
-	TRACE(("enter buf_rsa_verify"));
+	TRACE(("enter buf_rsa_verify"))
 
 	assert(key != NULL);
 
@@ -214,19 +214,19 @@ int buf_rsa_verify(buffer * buf, rsa_key *key, const unsigned char* data,
 
 	slen = buf_getint(buf);
 	if (slen != (unsigned int)mp_unsigned_bin_size(key->n)) {
-		TRACE(("bad size"));
+		TRACE(("bad size"))
 		goto out;
 	}
 
 	if (mp_read_unsigned_bin(&rsa_s, buf_getptr(buf, buf->len - buf->pos),
 				buf->len - buf->pos) != MP_OKAY) {
-		TRACE(("failed reading rsa_s"));
+		TRACE(("failed reading rsa_s"))
 		goto out;
 	}
 
 	/* check that s <= n-1 */
 	if (mp_cmp(&rsa_s, key->n) != MP_LT) {
-		TRACE(("s > n-1"));
+		TRACE(("s > n-1"))
 		goto out;
 	}
 
@@ -234,13 +234,13 @@ int buf_rsa_verify(buffer * buf, rsa_key *key, const unsigned char* data,
 	rsa_em = rsa_pad_em(key, data, len);
 
 	if (mp_exptmod(&rsa_s, key->e, key->n, &rsa_mdash) != MP_OKAY) {
-		TRACE(("failed exptmod rsa_s"));
+		TRACE(("failed exptmod rsa_s"))
 		goto out;
 	}
 
 	if (mp_cmp(rsa_em, &rsa_mdash) == MP_EQ) {
 		/* signature is valid */
-		TRACE(("success!"));
+		TRACE(("success!"))
 		ret = DROPBEAR_SUCCESS;
 	}
 
@@ -250,7 +250,7 @@ out:
 		m_free(rsa_em);
 	}
 	mp_clear_multi(&rsa_mdash, &rsa_s, NULL);
-	TRACE(("leave buf_rsa_verify: ret %d", ret));
+	TRACE(("leave buf_rsa_verify: ret %d", ret))
 	return ret;
 
 }
@@ -266,7 +266,7 @@ void buf_put_rsa_sign(buffer* buf, rsa_key *key, const unsigned char* data,
 	DEF_MP_INT(rsa_s);
 	mp_int *rsa_em = NULL;
 	
-	TRACE(("enter buf_put_rsa_sign"));
+	TRACE(("enter buf_put_rsa_sign"))
 	assert(key != NULL);
 
 	rsa_em = rsa_pad_em(key, data, len);
@@ -306,7 +306,7 @@ void buf_put_rsa_sign(buffer* buf, rsa_key *key, const unsigned char* data,
 #endif
 	
 
-	TRACE(("leave buf_put_rsa_sign"));
+	TRACE(("leave buf_put_rsa_sign"))
 }
 
 /* Creates the message value as expected by PKCS, see rfc2437 etc */
diff --git a/signkey.c b/signkey.c
index 2c8da55..b6b8bdc 100644
--- a/signkey.c
+++ b/signkey.c
@@ -94,7 +94,7 @@ int buf_get_pub_key(buffer *buf, sign_key *key, int *type) {
 	int keytype;
 	int ret = DROPBEAR_FAILURE;
 
-	TRACE(("enter buf_get_pub_key"));
+	TRACE(("enter buf_get_pub_key"))
 
 	ident = buf_getstring(buf, &len);
 	keytype = signkey_type_from_name(ident, len);
@@ -130,7 +130,7 @@ int buf_get_pub_key(buffer *buf, sign_key *key, int *type) {
 	}
 #endif
 
-	TRACE(("leave buf_get_pub_key"));
+	TRACE(("leave buf_get_pub_key"))
 
 	return ret;
 	
@@ -146,14 +146,14 @@ int buf_get_priv_key(buffer *buf, sign_key *key, int *type) {
 	int keytype;
 	int ret = DROPBEAR_FAILURE;
 
-	TRACE(("enter buf_get_priv_key"));
+	TRACE(("enter buf_get_priv_key"))
 
 	ident = buf_getstring(buf, &len);
 	keytype = signkey_type_from_name(ident, len);
 	m_free(ident);
 
 	if (*type != DROPBEAR_SIGNKEY_ANY && *type != keytype) {
-		TRACE(("wrong key type: %d %d", *type, keytype));
+		TRACE(("wrong key type: %d %d", *type, keytype))
 		return DROPBEAR_FAILURE;
 	}
 
@@ -183,7 +183,7 @@ int buf_get_priv_key(buffer *buf, sign_key *key, int *type) {
 	}
 #endif
 
-	TRACE(("leave buf_get_priv_key"));
+	TRACE(("leave buf_get_priv_key"))
 
 	return ret;
 	
@@ -194,7 +194,7 @@ void buf_put_pub_key(buffer* buf, sign_key *key, int type) {
 
 	buffer *pubkeys;
 
-	TRACE(("enter buf_put_pub_key"));
+	TRACE(("enter buf_put_pub_key"))
 	pubkeys = buf_new(MAX_PUBKEY_SIZE);
 	
 #ifdef DROPBEAR_DSS
@@ -216,26 +216,26 @@ void buf_put_pub_key(buffer* buf, sign_key *key, int type) {
 			pubkeys->len);
 	
 	buf_free(pubkeys);
-	TRACE(("leave buf_put_pub_key"));
+	TRACE(("leave buf_put_pub_key"))
 }
 
 /* type is either DROPBEAR_SIGNKEY_DSS or DROPBEAR_SIGNKEY_RSA */
 void buf_put_priv_key(buffer* buf, sign_key *key, int type) {
 
-	TRACE(("enter buf_put_priv_key"));
-	TRACE(("type is %d", type));
+	TRACE(("enter buf_put_priv_key"))
+	TRACE(("type is %d", type))
 
 #ifdef DROPBEAR_DSS
 	if (type == DROPBEAR_SIGNKEY_DSS) {
 		buf_put_dss_priv_key(buf, key->dsskey);
-	TRACE(("leave buf_put_priv_key: dss done"));
+	TRACE(("leave buf_put_priv_key: dss done"))
 	return;
 	}
 #endif
 #ifdef DROPBEAR_RSA
 	if (type == DROPBEAR_SIGNKEY_RSA) {
 		buf_put_rsa_priv_key(buf, key->rsakey);
-	TRACE(("leave buf_put_priv_key: rsa done"));
+	TRACE(("leave buf_put_priv_key: rsa done"))
 	return;
 	}
 #endif
@@ -244,7 +244,7 @@ void buf_put_priv_key(buffer* buf, sign_key *key, int type) {
 
 void sign_key_free(sign_key *key) {
 
-	TRACE(("enter sign_key_free"));
+	TRACE(("enter sign_key_free"))
 
 #ifdef DROPBEAR_DSS
 	dss_key_free(key->dsskey);
@@ -256,7 +256,7 @@ void sign_key_free(sign_key *key) {
 #endif
 
 	m_free(key);
-	TRACE(("leave sign_key_free"));
+	TRACE(("leave sign_key_free"))
 }
 
 static char hexdig(unsigned char x) {
@@ -393,7 +393,7 @@ int buf_verify(buffer * buf, sign_key *key, const unsigned char *data,
 	unsigned char * ident = NULL;
 	unsigned int identlen = 0;
 
-	TRACE(("enter buf_verify"));
+	TRACE(("enter buf_verify"))
 
 	bloblen = buf_getint(buf);
 	ident = buf_getstring(buf, &identlen);
@@ -442,17 +442,17 @@ int cmp_base64_key(const unsigned char* keyblob, unsigned int keybloblen,
 	if (base64_decode(buf_getptr(line, len), len,
 				buf_getwriteptr(decodekey, decodekey->size),
 				&decodekeylen) != CRYPT_OK) {
-		TRACE(("checkpubkey: base64 decode failed"));
+		TRACE(("checkpubkey: base64 decode failed"))
 		goto out;
 	}
-	TRACE(("checkpubkey: base64_decode success"));
+	TRACE(("checkpubkey: base64_decode success"))
 	buf_incrlen(decodekey, decodekeylen);
 	
 	/* compare the keys */
 	if ( ( decodekeylen != keybloblen )
 			|| memcmp( buf_getptr(decodekey, decodekey->len),
 						keyblob, decodekey->len) != 0) {
-		TRACE(("checkpubkey: compare failed"));
+		TRACE(("checkpubkey: compare failed"))
 		goto out;
 	}
 
@@ -461,7 +461,7 @@ int cmp_base64_key(const unsigned char* keyblob, unsigned int keybloblen,
 	filealgolen = buf_getint(decodekey);
 	filealgo = buf_getptr(decodekey, filealgolen);
 	if (filealgolen != algolen || memcmp(filealgo, algoname, algolen) != 0) {
-		TRACE(("checkpubkey: algo match failed")); 
+		TRACE(("checkpubkey: algo match failed")) 
 		goto out;
 	}
 
diff --git a/svr-agentfwd.c b/svr-agentfwd.c
index 60c23f7..5127158 100644
--- a/svr-agentfwd.c
+++ b/svr-agentfwd.c
@@ -101,7 +101,7 @@ static void agentaccept(struct Listener *UNUSED(listener), int sock) {
 
 	fd = accept(sock, NULL, NULL);
 	if (fd < 0) {
-		TRACE(("accept failed"));
+		TRACE(("accept failed"))
 		return;
 	}
 
diff --git a/svr-algo.c b/svr-algo.c
index 5559da6..c0b7823 100644
--- a/svr-algo.c
+++ b/svr-algo.c
@@ -47,7 +47,7 @@ algo_type * svr_buf_match_algo(buffer* buf, algo_type localalgos[],
 	/* get the comma-separated list from the buffer ie "algo1,algo2,algo3" */
 	algolist = buf_getstring(buf, &len);
 	/* Debug this */
-	TRACE(("buf_match_algo: %s", algolist));
+	TRACE(("buf_match_algo: %s", algolist))
 	if (len > MAX_PROPOSED_ALGO*(MAX_NAME_LEN+1)) {
 		goto out; /* just a sanity check, no other use */
 	}
diff --git a/svr-auth.c b/svr-auth.c
index 5eb3e27..f0fca38 100644
--- a/svr-auth.c
+++ b/svr-auth.c
@@ -67,9 +67,9 @@ static void authclear() {
  * ignore this, but possibly serves as a legal "no trespassing" sign */
 static void send_msg_userauth_banner() {
 
-	TRACE(("enter send_msg_userauth_banner"));
+	TRACE(("enter send_msg_userauth_banner"))
 	if (svr_opts.banner == NULL) {
-		TRACE(("leave send_msg_userauth_banner: banner is NULL"));
+		TRACE(("leave send_msg_userauth_banner: banner is NULL"))
 		return;
 	}
 
@@ -84,7 +84,7 @@ static void send_msg_userauth_banner() {
 	buf_free(svr_opts.banner);
 	svr_opts.banner = NULL;
 
-	TRACE(("leave send_msg_userauth_banner"));
+	TRACE(("leave send_msg_userauth_banner"))
 }
 
 /* handle a userauth request, check validity, pass to password or pubkey
@@ -94,11 +94,11 @@ void recv_msg_userauth_request() {
 	unsigned char *username = NULL, *servicename = NULL, *methodname = NULL;
 	unsigned int userlen, servicelen, methodlen;
 
-	TRACE(("enter recv_msg_userauth_request"));
+	TRACE(("enter recv_msg_userauth_request"))
 
 	/* ignore packets if auth is already done */
 	if (ses.authstate.authdone == 1) {
-		TRACE(("leave recv_msg_userauth_request: authdone already"));
+		TRACE(("leave recv_msg_userauth_request: authdone already"))
 		return;
 	}
 
@@ -128,7 +128,7 @@ void recv_msg_userauth_request() {
 	if (methodlen == AUTH_METHOD_NONE_LEN &&
 			strncmp(methodname, AUTH_METHOD_NONE,
 				AUTH_METHOD_NONE_LEN) == 0) {
-		TRACE(("recv_msg_userauth_request: 'none' request"));
+		TRACE(("recv_msg_userauth_request: 'none' request"))
 		send_msg_userauth_failure(0, 0);
 		goto out;
 	}
@@ -136,7 +136,7 @@ void recv_msg_userauth_request() {
 	/* check username is good before continuing */
 	if (checkusername(username, userlen) == DROPBEAR_FAILURE) {
 		/* username is invalid/no shell/etc - send failure */
-		TRACE(("sending checkusername failure"));
+		TRACE(("sending checkusername failure"))
 		send_msg_userauth_failure(0, 1);
 		goto out;
 	}
@@ -195,7 +195,7 @@ static int checkusername(unsigned char *username, unsigned int userlen) {
 	char* listshell = NULL;
 	char* usershell = NULL;
 	
-	TRACE(("enter checkusername"));
+	TRACE(("enter checkusername"))
 	if (userlen > MAX_USERNAME_LEN) {
 		return DROPBEAR_FAILURE;
 	}
@@ -217,7 +217,7 @@ static int checkusername(unsigned char *username, unsigned int userlen) {
 
 	/* check that user exists */
 	if (ses.authstate.pw == NULL) {
-		TRACE(("leave checkusername: user '%s' doesn't exist", username));
+		TRACE(("leave checkusername: user '%s' doesn't exist", username))
 		dropbear_log(LOG_WARNING,
 				"login attempt for nonexistent user from %s",
 				svr_ses.addrstring);
@@ -230,7 +230,7 @@ static int checkusername(unsigned char *username, unsigned int userlen) {
 
 	/* check for non-root if desired */
 	if (svr_opts.norootlogin && ses.authstate.pw->pw_uid == 0) {
-		TRACE(("leave checkusername: root login disabled"));
+		TRACE(("leave checkusername: root login disabled"))
 		dropbear_log(LOG_WARNING, "root login rejected");
 		send_msg_userauth_failure(0, 1);
 		return DROPBEAR_FAILURE;
@@ -238,14 +238,14 @@ static int checkusername(unsigned char *username, unsigned int userlen) {
 
 	/* check for an empty password */
 	if (ses.authstate.pw->pw_passwd[0] == '\0') {
-		TRACE(("leave checkusername: empty pword"));
+		TRACE(("leave checkusername: empty pword"))
 		dropbear_log(LOG_WARNING, "user '%s' has blank password, rejected",
 				ses.authstate.printableuser);
 		send_msg_userauth_failure(0, 1);
 		return DROPBEAR_FAILURE;
 	}
 
-	TRACE(("shell is %s", ses.authstate.pw->pw_shell));
+	TRACE(("shell is %s", ses.authstate.pw->pw_shell))
 
 	/* check that the shell is set */
 	usershell = ses.authstate.pw->pw_shell;
@@ -259,7 +259,7 @@ static int checkusername(unsigned char *username, unsigned int userlen) {
 	 * is platform-specific) */
 	setusershell();
 	while ((listshell = getusershell()) != NULL) {
-		TRACE(("test shell is '%s'", listshell));
+		TRACE(("test shell is '%s'", listshell))
 		if (strcmp(listshell, usershell) == 0) {
 			/* have a match */
 			goto goodshell;
@@ -267,7 +267,7 @@ static int checkusername(unsigned char *username, unsigned int userlen) {
 	}
 	/* no matching shell */
 	endusershell();
-	TRACE(("no matching shell"));
+	TRACE(("no matching shell"))
 	dropbear_log(LOG_WARNING, "user '%s' has invalid shell, rejected",
 				ses.authstate.printableuser);
 	send_msg_userauth_failure(0, 1);
@@ -275,10 +275,10 @@ static int checkusername(unsigned char *username, unsigned int userlen) {
 	
 goodshell:
 	endusershell();
-	TRACE(("matching shell"));
+	TRACE(("matching shell"))
 
-	TRACE(("uid = %d", ses.authstate.pw->pw_uid));
-	TRACE(("leave checkusername"));
+	TRACE(("uid = %d", ses.authstate.pw->pw_uid))
+	TRACE(("leave checkusername"))
 	return DROPBEAR_SUCCESS;
 
 }
@@ -292,7 +292,7 @@ void send_msg_userauth_failure(int partial, int incrfail) {
 
 	buffer *typebuf = NULL;
 
-	TRACE(("enter send_msg_userauth_failure"));
+	TRACE(("enter send_msg_userauth_failure"))
 
 	CHECKCLEARTOWRITE();
 	
@@ -331,7 +331,7 @@ void send_msg_userauth_failure(int partial, int incrfail) {
 	if (ses.authstate.failcount >= MAX_AUTH_TRIES) {
 		char * userstr;
 		/* XXX - send disconnect ? */
-		TRACE(("Max auth tries reached, exiting"));
+		TRACE(("Max auth tries reached, exiting"))
 
 		if (ses.authstate.printableuser == NULL) {
 			userstr = "is invalid";
@@ -342,13 +342,13 @@ void send_msg_userauth_failure(int partial, int incrfail) {
 				userstr, svr_ses.addrstring);
 	}
 	
-	TRACE(("leave send_msg_userauth_failure"));
+	TRACE(("leave send_msg_userauth_failure"))
 }
 
 /* Send a success message to the user, and set the "authdone" flag */
 void send_msg_userauth_success() {
 
-	TRACE(("enter send_msg_userauth_success"));
+	TRACE(("enter send_msg_userauth_success"))
 
 	CHECKCLEARTOWRITE();
 
@@ -368,6 +368,6 @@ void send_msg_userauth_success() {
 	 * logins - a nasty situation. */							
 	m_close(svr_ses.childpipe);
 
-	TRACE(("leave send_msg_userauth_success"));
+	TRACE(("leave send_msg_userauth_success"))
 
 }
diff --git a/svr-authpam.c b/svr-authpam.c
index 4937fa6..4b16616 100644
--- a/svr-authpam.c
+++ b/svr-authpam.c
@@ -57,7 +57,7 @@ pamConvFunc(int num_msg,
 
 	const char* message = (*msg)->msg;
 
-	TRACE(("enter pamConvFunc"));
+	TRACE(("enter pamConvFunc"))
 
 	if (num_msg != 1) {
 		/* If you're getting here - Dropbear probably can't support your pam
@@ -67,11 +67,11 @@ pamConvFunc(int num_msg,
 		return PAM_CONV_ERR;
 	}
 	
-	TRACE(("msg_style is %d", (*msg)->msg_style));
+	TRACE(("msg_style is %d", (*msg)->msg_style))
 	if (message) {
-		TRACE(("message is '%s'", message));
+		TRACE(("message is '%s'", message))
 	} else {
-		TRACE(("null message"));
+		TRACE(("null message"))
 	}
 
 	switch((*msg)->msg_style) {
@@ -79,7 +79,7 @@ pamConvFunc(int num_msg,
 		case PAM_PROMPT_ECHO_OFF:
 
 			if (strcmp(message, "Password:") != 0) {
-					TRACE(("PAM_PROMPT_ECHO_OFF: unrecognized prompt"));
+					TRACE(("PAM_PROMPT_ECHO_OFF: unrecognized prompt"))
 					rc = PAM_CONV_ERR;
 					break;
 			}
@@ -102,7 +102,7 @@ pamConvFunc(int num_msg,
 			if ((strcmp(message, "login: " ) != 0) 
 					&& (strcmp(message, "login:" ) != 0)
 					&& (strcmp(message, "Please enter username: " ) != 0)) {
-				TRACE(("PAM_PROMPT_ECHO_ON: unrecognized prompt"));
+				TRACE(("PAM_PROMPT_ECHO_ON: unrecognized prompt"))
 				rc = PAM_CONV_ERR;
 				break;
 			}
@@ -117,17 +117,17 @@ pamConvFunc(int num_msg,
 			/* Safe to just use the direct pointer (no strdup) since
 			 * it shouldn't be getting munged at all */
 			resp->resp = m_strdup(userDatap->user);
-			TRACE(("userDatap->user='%s'", userDatap->user));
+			TRACE(("userDatap->user='%s'", userDatap->user))
 			(*respp) = resp;
 			break;
 
 		default:
-			TRACE(("Unknown message type"));
+			TRACE(("Unknown message type"))
 			rc = PAM_CONV_ERR;
 			break;      
 	}
 
-	TRACE(("leave pamConvFunc, rc %d", rc));
+	TRACE(("leave pamConvFunc, rc %d", rc))
 
 	return rc;
 }
@@ -224,7 +224,7 @@ cleanup:
 		m_free(password);
 	}
 	if (pamHandlep != NULL) {
-		TRACE(("pam_end"));
+		TRACE(("pam_end"))
 		(void) pam_end(pamHandlep, 0 /* pam_status */);
 	}
 }
diff --git a/svr-authpubkey.c b/svr-authpubkey.c
index 5052b10..5daba0f 100644
--- a/svr-authpubkey.c
+++ b/svr-authpubkey.c
@@ -60,7 +60,7 @@ void svr_auth_pubkey() {
 	char* fp = NULL;
 	int type = -1;
 
-	TRACE(("enter pubkeyauth"));
+	TRACE(("enter pubkeyauth"))
 
 	/* 0 indicates user just wants to check if key can be used, 1 is an
 	 * actual attempt*/
@@ -127,7 +127,7 @@ out:
 		sign_key_free(key);
 		key = NULL;
 	}
-	TRACE(("leave pubkeyauth"));
+	TRACE(("leave pubkeyauth"))
 }
 
 /* Reply that the key is valid for auth, this is sent when the user sends
@@ -136,7 +136,7 @@ out:
 static void send_msg_userauth_pk_ok(unsigned char* algo, unsigned int algolen,
 		unsigned char* keyblob, unsigned int keybloblen) {
 
-	TRACE(("enter send_msg_userauth_pk_ok"));
+	TRACE(("enter send_msg_userauth_pk_ok"))
 	CHECKCLEARTOWRITE();
 
 	buf_putbyte(ses.writepayload, SSH_MSG_USERAUTH_PK_OK);
@@ -144,7 +144,7 @@ static void send_msg_userauth_pk_ok(unsigned char* algo, unsigned int algolen,
 	buf_putstring(ses.writepayload, keyblob, keybloblen);
 
 	encrypt_packet();
-	TRACE(("leave send_msg_userauth_pk_ok"));
+	TRACE(("leave send_msg_userauth_pk_ok"))
 
 }
 
@@ -160,7 +160,7 @@ static int checkpubkey(unsigned char* algo, unsigned int algolen,
 	buffer * line = NULL;
 	unsigned int len, pos;
 	
-	TRACE(("enter checkpubkey"));
+	TRACE(("enter checkpubkey"))
 
 	/* check that we can use the algo */
 	if (have_algo(algo, algolen, sshhostkey) == DROPBEAR_FAILURE) {
@@ -172,7 +172,7 @@ static int checkpubkey(unsigned char* algo, unsigned int algolen,
 
 	/* check file permissions, also whether file exists */
 	if (checkpubkeyperms() == DROPBEAR_FAILURE) {
-		TRACE(("bad authorized_keys permissions, or file doesn't exist"));
+		TRACE(("bad authorized_keys permissions, or file doesn't exist"))
 		goto out;
 	}
 
@@ -190,7 +190,7 @@ static int checkpubkey(unsigned char* algo, unsigned int algolen,
 	if (authfile == NULL) {
 		goto out;
 	}
-	TRACE(("checkpubkey: opened authorized_keys OK"));
+	TRACE(("checkpubkey: opened authorized_keys OK"))
 
 	line = buf_new(MAX_AUTHKEYS_LINE);
 
@@ -199,12 +199,12 @@ static int checkpubkey(unsigned char* algo, unsigned int algolen,
 
 		if (buf_getline(line, authfile) == DROPBEAR_FAILURE) {
 			/* EOF reached */
-			TRACE(("checkpubkey: authorized_keys EOF reached"));
+			TRACE(("checkpubkey: authorized_keys EOF reached"))
 			break;
 		}
 
 		if (line->len < MIN_AUTHKEYS_LINE) {
-			TRACE(("checkpubkey: line too short"));
+			TRACE(("checkpubkey: line too short"))
 			continue; /* line is too short for it to be a valid key */
 		}
 
@@ -217,7 +217,7 @@ static int checkpubkey(unsigned char* algo, unsigned int algolen,
 		
 		/* check for space (' ') character */
 		if (buf_getbyte(line) != ' ') {
-			TRACE(("checkpubkey: space character expected, isn't there"));
+			TRACE(("checkpubkey: space character expected, isn't there"))
 			continue;
 		}
 
@@ -229,7 +229,7 @@ static int checkpubkey(unsigned char* algo, unsigned int algolen,
 		buf_setpos(line, pos);
 		buf_setlen(line, line->pos + len);
 
-		TRACE(("checkpubkey: line pos = %d len = %d", line->pos, line->len));
+		TRACE(("checkpubkey: line pos = %d len = %d", line->pos, line->len))
 
 		ret = cmp_base64_key(keyblob, keybloblen, algo, algolen, line);
 		if (ret == DROPBEAR_SUCCESS) {
@@ -248,7 +248,7 @@ out:
 		buf_free(line);
 	}
 	m_free(filename);
-	TRACE(("leave checkpubkey: ret=%d", ret));
+	TRACE(("leave checkpubkey: ret=%d", ret))
 	return ret;
 }
 
@@ -264,7 +264,7 @@ static int checkpubkeyperms() {
 	int ret = DROPBEAR_FAILURE;
 	unsigned int len;
 
-	TRACE(("enter checkpubkeyperms"));
+	TRACE(("enter checkpubkeyperms"))
 
 	assert(ses.authstate.pw);
 	if (ses.authstate.pw->pw_dir == NULL) {
@@ -303,7 +303,7 @@ static int checkpubkeyperms() {
 out:
 	m_free(filename);
 
-	TRACE(("leave checkpubkeyperms"));
+	TRACE(("leave checkpubkeyperms"))
 	return ret;
 }
 
@@ -313,24 +313,24 @@ out:
 static int checkfileperm(char * filename) {
 	struct stat filestat;
 
-	TRACE(("enter checkfileperm(%s)", filename));
+	TRACE(("enter checkfileperm(%s)", filename))
 
 	if (stat(filename, &filestat) != 0) {
-		TRACE(("leave checkfileperm: stat() != 0"));
+		TRACE(("leave checkfileperm: stat() != 0"))
 		return DROPBEAR_FAILURE;
 	}
 	/* check ownership - user or root only*/
 	if (filestat.st_uid != ses.authstate.pw->pw_uid
 			&& filestat.st_uid != 0) {
-		TRACE(("leave checkfileperm: wrong ownership"));
+		TRACE(("leave checkfileperm: wrong ownership"))
 		return DROPBEAR_FAILURE;
 	}
 	/* check permissions - don't want group or others +w */
 	if (filestat.st_mode & (S_IWGRP | S_IWOTH)) {
-		TRACE(("leave checkfileperm: wrong perms"));
+		TRACE(("leave checkfileperm: wrong perms"))
 		return DROPBEAR_FAILURE;
 	}
-	TRACE(("leave checkfileperm: success"));
+	TRACE(("leave checkfileperm: success"))
 	return DROPBEAR_SUCCESS;
 }
 
diff --git a/svr-chansession.c b/svr-chansession.c
index f1e9c88..c365114 100644
--- a/svr-chansession.c
+++ b/svr-chansession.c
@@ -87,7 +87,7 @@ static void sesssigchild_handler(int UNUSED(dummy)) {
 	struct sigaction sa_chld;
 	struct exitinfo *exit = NULL;
 
-	TRACE(("enter sigchld handler"));
+	TRACE(("enter sigchld handler"))
 	while ((pid = waitpid(-1, &status, WNOHANG)) > 0) {
 		/* find the corresponding chansess */
 		for (i = 0; i < svr_ses.childpidsize; i++) {
@@ -126,7 +126,7 @@ static void sesssigchild_handler(int UNUSED(dummy)) {
 	sa_chld.sa_handler = sesssigchild_handler;
 	sa_chld.sa_flags = SA_NOCLDSTOP;
 	sigaction(SIGCHLD, &sa_chld, NULL);
-	TRACE(("leave sigchld handler"));
+	TRACE(("leave sigchld handler"))
 }
 
 /* send the exit status or the signal causing termination for a session */
@@ -248,9 +248,9 @@ static void closechansess(struct Channel *channel) {
 
 	send_exitsignalstatus(channel);
 
-	TRACE(("enter closechansess"));
+	TRACE(("enter closechansess"))
 	if (chansess == NULL) {
-		TRACE(("leave closechansess: chansess == NULL"));
+		TRACE(("leave closechansess: chansess == NULL"))
 		return;
 	}
 
@@ -280,8 +280,8 @@ static void closechansess(struct Channel *channel) {
 	for (i = 0; i < svr_ses.childpidsize; i++) {
 		if (svr_ses.childpids[i].chansess == chansess) {
 			assert(svr_ses.childpids[i].pid > 0);
-			TRACE(("closing pid %d", svr_ses.childpids[i].pid));
-			TRACE(("exitpid = %d", chansess->exit.exitpid));
+			TRACE(("closing pid %d", svr_ses.childpids[i].pid))
+			TRACE(("exitpid = %d", chansess->exit.exitpid))
 			svr_ses.childpids[i].pid = -1;
 			svr_ses.childpids[i].chansess = NULL;
 		}
@@ -289,7 +289,7 @@ static void closechansess(struct Channel *channel) {
 				
 	m_free(chansess);
 
-	TRACE(("leave closechansess"));
+	TRACE(("leave closechansess"))
 }
 
 /* Handle requests for a channel. These can be execution requests,
@@ -302,19 +302,19 @@ static void chansessionrequest(struct Channel *channel) {
 	int ret = 1;
 	struct ChanSess *chansess;
 
-	TRACE(("enter chansessionrequest"));
+	TRACE(("enter chansessionrequest"))
 
 	type = buf_getstring(ses.payload, &typelen);
 	wantreply = buf_getbyte(ses.payload);
 
 	if (typelen > MAX_NAME_LEN) {
-		TRACE(("leave chansessionrequest: type too long")); /* XXX send error?*/
+		TRACE(("leave chansessionrequest: type too long")) /* XXX send error?*/
 		goto out;
 	}
 
 	chansess = (struct ChanSess*)channel->typedata;
 	assert(chansess != NULL);
-	TRACE(("type is %s", type));
+	TRACE(("type is %s", type))
 
 	if (strcmp(type, "window-change") == 0) {
 		ret = sessionwinchange(chansess);
@@ -351,7 +351,7 @@ out:
 	}
 
 	m_free(type);
-	TRACE(("leave chansessionrequest"));
+	TRACE(("leave chansessionrequest"))
 }
 
 
@@ -421,7 +421,7 @@ static void get_termmodes(struct ChanSess *chansess) {
 	const struct TermCode * termcode;
 	unsigned int len;
 
-	TRACE(("enter get_termmodes"));
+	TRACE(("enter get_termmodes"))
 
 	/* Term modes */
 	/* We'll ignore errors and continue if we can't set modes.
@@ -438,7 +438,7 @@ static void get_termmodes(struct ChanSess *chansess) {
 	}
 
 	if (len == 0) {
-		TRACE(("leave get_termmodes: empty terminal modes string"));
+		TRACE(("leave get_termmodes: empty terminal modes string"))
 	}
 
 	while (((opcode = buf_getbyte(ses.payload)) != 0x00) && opcode <= 159) {
@@ -500,7 +500,7 @@ static void get_termmodes(struct ChanSess *chansess) {
 	if (tcsetattr(chansess->master, TCSANOW, &termio) < 0) {
 		dropbear_log(LOG_INFO, "error setting terminal attributes");
 	}
-	TRACE(("leave get_termmodes"));
+	TRACE(("leave get_termmodes"))
 }
 
 /* Set up a session pty which will be used to execute the shell or program.
@@ -511,11 +511,11 @@ static int sessionpty(struct ChanSess * chansess) {
 	unsigned int termlen;
 	unsigned char namebuf[65];
 
-	TRACE(("enter sessionpty"));
+	TRACE(("enter sessionpty"))
 	chansess->term = buf_getstring(ses.payload, &termlen);
 	if (termlen > MAX_TERM_LEN) {
 		/* TODO send disconnect ? */
-		TRACE(("leave sessionpty: term len too long"));
+		TRACE(("leave sessionpty: term len too long"))
 		return DROPBEAR_FAILURE;
 	}
 
@@ -524,7 +524,7 @@ static int sessionpty(struct ChanSess * chansess) {
 		dropbear_exit("multiple pty requests");
 	}
 	if (pty_allocate(&chansess->master, &chansess->slave, namebuf, 64) == 0) {
-		TRACE(("leave sessionpty: failed to allocate pty"));
+		TRACE(("leave sessionpty: failed to allocate pty"))
 		return DROPBEAR_FAILURE;
 	}
 	
@@ -541,7 +541,7 @@ static int sessionpty(struct ChanSess * chansess) {
 	/* Read the terminal modes */
 	get_termmodes(chansess);
 
-	TRACE(("leave sessionpty"));
+	TRACE(("leave sessionpty"))
 	return DROPBEAR_SUCCESS;
 }
 
@@ -555,7 +555,7 @@ static int sessioncommand(struct Channel *channel, struct ChanSess *chansess,
 	unsigned int cmdlen;
 	int ret;
 
-	TRACE(("enter sessioncommand"));
+	TRACE(("enter sessioncommand"))
 
 	if (chansess->cmd != NULL) {
 		/* Note that only one command can _succeed_. The client might try
@@ -612,7 +612,7 @@ static int noptycommand(struct Channel *channel, struct ChanSess *chansess) {
 	pid_t pid;
 	unsigned int i;
 
-	TRACE(("enter noptycommand"));
+	TRACE(("enter noptycommand"))
 
 	/* redirect stdin/stdout/stderr */
 	if (pipe(infds) != 0)
@@ -635,7 +635,7 @@ static int noptycommand(struct Channel *channel, struct ChanSess *chansess) {
 		if ((dup2(infds[FDIN], STDIN_FILENO) < 0) ||
 			(dup2(outfds[FDOUT], STDOUT_FILENO) < 0) ||
 			(dup2(errfds[FDOUT], STDERR_FILENO) < 0)) {
-			TRACE(("leave noptycommand: error redirecting FDs"));
+			TRACE(("leave noptycommand: error redirecting FDs"))
 			return DROPBEAR_FAILURE;
 		}
 
@@ -651,7 +651,7 @@ static int noptycommand(struct Channel *channel, struct ChanSess *chansess) {
 
 	} else {
 		/* parent */
-		TRACE(("continue noptycommand: parent"));
+		TRACE(("continue noptycommand: parent"))
 		chansess->pid = pid;
 
 		addchildpid(chansess, pid);
@@ -687,7 +687,7 @@ static int noptycommand(struct Channel *channel, struct ChanSess *chansess) {
 #undef FDIN
 #undef FDOUT
 
-	TRACE(("leave noptycommand"));
+	TRACE(("leave noptycommand"))
 	return DROPBEAR_SUCCESS;
 }
 
@@ -705,7 +705,7 @@ static int ptycommand(struct Channel *channel, struct ChanSess *chansess) {
 	char *hushpath = NULL;
 #endif
 
-	TRACE(("enter ptycommand"));
+	TRACE(("enter ptycommand"))
 
 	/* we need to have a pty allocated */
 	if (chansess->master == -1 || chansess->tty == NULL) {
@@ -728,7 +728,7 @@ static int ptycommand(struct Channel *channel, struct ChanSess *chansess) {
 		if ((dup2(chansess->slave, STDIN_FILENO) < 0) ||
 			(dup2(chansess->slave, STDERR_FILENO) < 0) ||
 			(dup2(chansess->slave, STDOUT_FILENO) < 0)) {
-			TRACE(("leave ptycommand: error redirecting filedesc"));
+			TRACE(("leave ptycommand: error redirecting filedesc"))
 			return DROPBEAR_FAILURE;
 		}
 
@@ -776,7 +776,7 @@ static int ptycommand(struct Channel *channel, struct ChanSess *chansess) {
 
 	} else {
 		/* parent */
-		TRACE(("continue ptycommand: parent"));
+		TRACE(("continue ptycommand: parent"))
 		chansess->pid = pid;
 
 		/* add a child pid */
@@ -792,7 +792,7 @@ static int ptycommand(struct Channel *channel, struct ChanSess *chansess) {
 
 	}
 
-	TRACE(("leave ptycommand"));
+	TRACE(("leave ptycommand"))
 	return DROPBEAR_SUCCESS;
 }
 
diff --git a/svr-kex.c b/svr-kex.c
index 47c540e..a9954bb 100644
--- a/svr-kex.c
+++ b/svr-kex.c
@@ -46,7 +46,7 @@ void recv_msg_kexdh_init() {
 
 	DEF_MP_INT(dh_e);
 
-	TRACE(("enter recv_msg_kexdh_init"));
+	TRACE(("enter recv_msg_kexdh_init"))
 	if (!ses.kexstate.recvkexinit) {
 		dropbear_exit("Premature kexdh_init message received");
 	}
@@ -60,7 +60,7 @@ void recv_msg_kexdh_init() {
 
 	send_msg_newkeys();
 	ses.requirenext = SSH_MSG_NEWKEYS;
-	TRACE(("leave recv_msg_kexdh_init"));
+	TRACE(("leave recv_msg_kexdh_init"))
 }
 	
 /* Generate our side of the diffie-hellman key exchange value (dh_f), and
@@ -74,7 +74,7 @@ static void send_msg_kexdh_reply(mp_int *dh_e) {
 	DEF_MP_INT(dh_y);
 	DEF_MP_INT(dh_f);
 
-	TRACE(("enter send_msg_kexdh_reply"));
+	TRACE(("enter send_msg_kexdh_reply"))
 	m_mp_init_multi(&dh_y, &dh_f, NULL);
 	
 	gen_kexdh_vals(&dh_f, &dh_y);
@@ -99,6 +99,6 @@ static void send_msg_kexdh_reply(mp_int *dh_e) {
 	/* the SSH_MSG_KEXDH_REPLY is done */
 	encrypt_packet();
 
-	TRACE(("leave send_msg_kexdh_reply"));
+	TRACE(("leave send_msg_kexdh_reply"))
 }
 
diff --git a/svr-main.c b/svr-main.c
index 48e6042..e39f3d9 100644
--- a/svr-main.c
+++ b/svr-main.c
@@ -247,7 +247,7 @@ void main_noinetd() {
 			}
 
 			if (pipe(childpipe) < 0) {
-				TRACE(("error creating child pipe"));
+				TRACE(("error creating child pipe"))
 				close(childsock);
 				continue;
 			}
@@ -369,11 +369,11 @@ static int listensockets(int *sock, int sockcount, int *maxfd) {
 	unsigned int sockpos = 0;
 	int nsock;
 
-	TRACE(("listensockets: %d to try\n", svr_opts.portcount));
+	TRACE(("listensockets: %d to try\n", svr_opts.portcount))
 
 	for (i = 0; i < svr_opts.portcount; i++) {
 
-		TRACE(("listening on '%s'", svr_opts.ports[i]));
+		TRACE(("listening on '%s'", svr_opts.ports[i]))
 
 		nsock = dropbear_listen(NULL, svr_opts.ports[i], &sock[sockpos], 
 				sockcount - sockpos,
diff --git a/svr-runopts.c b/svr-runopts.c
index 06ffafc..375797b 100644
--- a/svr-runopts.c
+++ b/svr-runopts.c
@@ -270,7 +270,7 @@ void loadhostkeys() {
 	int ret;
 	int type;
 
-	TRACE(("enter loadhostkeys"));
+	TRACE(("enter loadhostkeys"))
 
 	svr_opts.hostkey = new_sign_key();
 
@@ -300,5 +300,5 @@ void loadhostkeys() {
 		dropbear_exit("No hostkeys available");
 	}
 
-	TRACE(("leave loadhostkeys"));
+	TRACE(("leave loadhostkeys"))
 }
diff --git a/svr-service.c b/svr-service.c
index e823490..2c78e7d 100644
--- a/svr-service.c
+++ b/svr-service.c
@@ -39,7 +39,7 @@ void recv_msg_service_request() {
 	unsigned char * name;
 	unsigned int len;
 
-	TRACE(("enter recv_msg_service_request"));
+	TRACE(("enter recv_msg_service_request"))
 
 	name = buf_getstring(ses.payload, &len);
 
@@ -49,7 +49,7 @@ void recv_msg_service_request() {
 
 		send_msg_service_accept(name, len);
 		m_free(name);
-		TRACE(("leave recv_msg_service_request: done ssh-userauth"));
+		TRACE(("leave recv_msg_service_request: done ssh-userauth"))
 		return;
 	}
 
@@ -62,7 +62,7 @@ void recv_msg_service_request() {
 
 		send_msg_service_accept(name, len);
 		m_free(name);
-		TRACE(("leave recv_msg_service_request: done ssh-connection"));
+		TRACE(("leave recv_msg_service_request: done ssh-connection"))
 		return;
 	}
 
@@ -75,7 +75,7 @@ void recv_msg_service_request() {
 
 static void send_msg_service_accept(unsigned char *name, int len) {
 
-	TRACE(("accepting service %s", name));
+	TRACE(("accepting service %s", name))
 
 	CHECKCLEARTOWRITE();
 
diff --git a/svr-tcpfwd.c b/svr-tcpfwd.c
index 68ceba5..7fbc609 100644
--- a/svr-tcpfwd.c
+++ b/svr-tcpfwd.c
@@ -70,10 +70,10 @@ void recv_msg_global_request_remotetcp() {
 	unsigned int wantreply = 0;
 	int ret = DROPBEAR_FAILURE;
 
-	TRACE(("enter recv_msg_global_request_remotetcp"));
+	TRACE(("enter recv_msg_global_request_remotetcp"))
 
 	if (opts.noremotetcp) {
-		TRACE(("leave recv_msg_global_request_remotetcp: remote tcp forwarding disabled"));
+		TRACE(("leave recv_msg_global_request_remotetcp: remote tcp forwarding disabled"))
 		goto out;
 	}
 
@@ -81,7 +81,7 @@ void recv_msg_global_request_remotetcp() {
 	wantreply = buf_getbyte(ses.payload);
 
 	if (namelen > MAXNAMLEN) {
-		TRACE(("name len is wrong: %d", namelen));
+		TRACE(("name len is wrong: %d", namelen))
 		goto out;
 	}
 
@@ -90,7 +90,7 @@ void recv_msg_global_request_remotetcp() {
 	} else if (strcmp("cancel-tcpip-forward", reqname) == 0) {
 		ret = svr_cancelremotetcp();
 	} else {
-		TRACE(("reqname isn't tcpip-forward: '%s'", reqname));
+		TRACE(("reqname isn't tcpip-forward: '%s'", reqname))
 	}
 
 out:
@@ -104,7 +104,7 @@ out:
 
 	m_free(reqname);
 
-	TRACE(("leave recv_msg_global_request"));
+	TRACE(("leave recv_msg_global_request"))
 }
 
 
@@ -143,11 +143,11 @@ static int svr_cancelremotetcp() {
 	struct Listener * listener = NULL;
 	struct TCPListener tcpinfo;
 
-	TRACE(("enter cancelremotetcp"));
+	TRACE(("enter cancelremotetcp"))
 
 	bindaddr = buf_getstring(ses.payload, &addrlen);
 	if (addrlen > MAX_IP_LEN) {
-		TRACE(("addr len too long: %d", addrlen));
+		TRACE(("addr len too long: %d", addrlen))
 		goto out;
 	}
 
@@ -163,7 +163,7 @@ static int svr_cancelremotetcp() {
 
 out:
 	m_free(bindaddr);
-	TRACE(("leave cancelremotetcp"));
+	TRACE(("leave cancelremotetcp"))
 	return ret;
 }
 
@@ -175,12 +175,12 @@ static int svr_remotetcpreq() {
 	struct TCPListener *tcpinfo = NULL;
 	unsigned int port;
 
-	TRACE(("enter remotetcpreq"));
+	TRACE(("enter remotetcpreq"))
 
 	/* NOTE: at this stage, we ignore bindaddr. see below and listen_tcpfwd */
 	bindaddr = buf_getstring(ses.payload, &addrlen);
 	if (addrlen > MAX_IP_LEN) {
-		TRACE(("addr len too long: %d", addrlen));
+		TRACE(("addr len too long: %d", addrlen))
 		goto out;
 	}
 
@@ -192,12 +192,12 @@ static int svr_remotetcpreq() {
 	}
 
 	if (port < 1 || port > 65535) {
-		TRACE(("invalid port: %d", port));
+		TRACE(("invalid port: %d", port))
 		goto out;
 	}
 
 	if (!ses.allowprivport && port < IPPORT_RESERVED) {
-		TRACE(("can't assign port < 1024 for non-root"));
+		TRACE(("can't assign port < 1024 for non-root"))
 		goto out;
 	}
 
@@ -218,7 +218,7 @@ out:
 		m_free(tcpinfo->sendaddr);
 		m_free(tcpinfo);
 	}
-	TRACE(("leave remotetcpreq"));
+	TRACE(("leave remotetcpreq"))
 	return ret;
 }
 
@@ -236,13 +236,13 @@ static int newtcpdirect(struct Channel * channel) {
 	int err = SSH_OPEN_ADMINISTRATIVELY_PROHIBITED;
 
 	if (opts.nolocaltcp) {
-		TRACE(("leave newtcpdirect: local tcp forwarding disabled"));
+		TRACE(("leave newtcpdirect: local tcp forwarding disabled"))
 		goto out;
 	}
 
 	desthost = buf_getstring(ses.payload, &len);
 	if (len > MAX_HOST_LEN) {
-		TRACE(("leave newtcpdirect: desthost too long"));
+		TRACE(("leave newtcpdirect: desthost too long"))
 		goto out;
 	}
 
@@ -250,7 +250,7 @@ static int newtcpdirect(struct Channel * channel) {
 	
 	orighost = buf_getstring(ses.payload, &len);
 	if (len > MAX_HOST_LEN) {
-		TRACE(("leave newtcpdirect: orighost too long"));
+		TRACE(("leave newtcpdirect: orighost too long"))
 		goto out;
 	}
 
@@ -258,7 +258,7 @@ static int newtcpdirect(struct Channel * channel) {
 
 	/* best be sure */
 	if (origport > 65535 || destport > 65535) {
-		TRACE(("leave newtcpdirect: port > 65535"));
+		TRACE(("leave newtcpdirect: port > 65535"))
 		goto out;
 	}
 
@@ -266,7 +266,7 @@ static int newtcpdirect(struct Channel * channel) {
 	sock = connect_remote(desthost, portstring, 1, NULL);
 	if (sock < 0) {
 		err = SSH_OPEN_CONNECT_FAILED;
-		TRACE(("leave newtcpdirect: sock failed"));
+		TRACE(("leave newtcpdirect: sock failed"))
 		goto out;
 	}
 
@@ -284,7 +284,7 @@ static int newtcpdirect(struct Channel * channel) {
 out:
 	m_free(desthost);
 	m_free(orighost);
-	TRACE(("leave newtcpdirect: err %d", err));
+	TRACE(("leave newtcpdirect: err %d", err))
 	return err;
 }
 
diff --git a/svr-x11fwd.c b/svr-x11fwd.c
index 45c9060..e15fb82 100644
--- a/svr-x11fwd.c
+++ b/svr-x11fwd.c
@@ -170,7 +170,7 @@ void x11cleanup(struct ChanSess *chansess) {
 	m_free(chansess->x11authprot);
 	m_free(chansess->x11authcookie);
 
-	TRACE(("chansess %s", chansess));
+	TRACE(("chansess %s", chansess))
 	if (chansess->x11listener != NULL) {
 		remove_listener(chansess->x11listener);
 		chansess->x11listener = NULL;
diff --git a/tcp-accept.c b/tcp-accept.c
index c143319..e75224e 100644
--- a/tcp-accept.c
+++ b/tcp-accept.c
@@ -87,7 +87,7 @@ int listen_tcpfwd(struct TCPListener* tcpinfo) {
 	int nsocks;
 	char* errstring = NULL;
 
-	TRACE(("enter listen_tcpfwd"));
+	TRACE(("enter listen_tcpfwd"))
 
 	/* first we try to bind, so don't need to do so much cleanup on failure */
 	snprintf(portstring, sizeof(portstring), "%d", tcpinfo->listenport);
@@ -100,7 +100,7 @@ int listen_tcpfwd(struct TCPListener* tcpinfo) {
 	if (nsocks < 0) {
 		dropbear_log(LOG_INFO, "TCP forward failed: %s", errstring);
 		m_free(errstring);
-		TRACE(("leave listen_tcpfwd: dropbear_listen failed"));
+		TRACE(("leave listen_tcpfwd: dropbear_listen failed"))
 		return DROPBEAR_FAILURE;
 	}
 
@@ -109,11 +109,11 @@ int listen_tcpfwd(struct TCPListener* tcpinfo) {
 
 	if (listener == NULL) {
 		m_free(tcpinfo);
-		TRACE(("leave listen_tcpfwd: listener failed"));
+		TRACE(("leave listen_tcpfwd: listener failed"))
 		return DROPBEAR_FAILURE;
 	}
 
-	TRACE(("leave listen_tcpfwd: success"));
+	TRACE(("leave listen_tcpfwd: success"))
 	return DROPBEAR_SUCCESS;
 }
 
-- 
cgit v1.2.3


From 1428c01a5fd05e60ca30f9645202bfa44a0934f6 Mon Sep 17 00:00:00 2001
From: Matt Johnston <matt@ucc.asn.au>
Date: Wed, 7 Jun 2006 14:48:35 +0000
Subject: Include user@host in the pubkey line, since it's sometimes very
 useful

--HG--
extra : convert_revision : c3d6444f31a3b583e6405e1b99e666d020e89eac
---
 dropbearkey.c | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

(limited to 'dropbearkey.c')

diff --git a/dropbearkey.c b/dropbearkey.c
index 8ceefdc..0825053 100644
--- a/dropbearkey.c
+++ b/dropbearkey.c
@@ -297,6 +297,9 @@ static void printpubkey(sign_key * key, int keytype) {
 	const char * typestring = NULL;
 	char *fp = NULL;
 	int len;
+	struct passwd * pw = NULL;
+	char * username = NULL;
+	char hostname[100];
 
 	buf = buf_new(MAX_PUBKEY_SIZE);
 	buf_put_pub_key(buf, key, keytype);
@@ -315,8 +318,19 @@ static void printpubkey(sign_key * key, int keytype) {
 
 	fp = sign_key_fingerprint(buf_getptr(buf, len), len);
 
-	printf("Public key portion is:\n%s %s\nFingerprint: %s\n",
-			typestring, base64key, fp);
+	/* a user@host comment is informative */
+	username = "";
+	pw = getpwuid(getuid());
+	if (pw)
+	{
+		username = pw->pw_name;
+	}
+
+	gethostname(hostname, sizeof(hostname));
+	hostname[sizeof(hostname)-1] = '\0';
+
+	printf("Public key portion is:\n%s %s %s@%s\nFingerprint: %s\n",
+			typestring, base64key, username, hostname, fp);
 
 	m_free(fp);
 	buf_free(buf);
-- 
cgit v1.2.3


From be2b7d9725f8adef1b75bddc9944f69b87219120 Mon Sep 17 00:00:00 2001
From: Matt Johnston <matt@ucc.asn.au>
Date: Wed, 7 Jun 2006 15:01:20 +0000
Subject: Add -N "no remote command" dbclient option. Document -N in dbclient.1
 and -P in dropbear.8

--HG--
extra : convert_revision : 7cada79bf8f61e09a72e5d492170bd10ab0acee3
---
 cli-runopts.c | 5 +++++
 cli-session.c | 8 +++++---
 dbclient.1    | 3 +++
 dropbear.8    | 4 ++++
 dropbearkey.c | 3 +--
 runopts.h     | 1 +
 6 files changed, 19 insertions(+), 5 deletions(-)

(limited to 'dropbearkey.c')

diff --git a/cli-runopts.c b/cli-runopts.c
index 54d4875..2e7c0ac 100644
--- a/cli-runopts.c
+++ b/cli-runopts.c
@@ -50,6 +50,7 @@ static void printhelp() {
 					"-l <username>\n"
 					"-t    Allocate a pty\n"
 					"-T    Don't allocate a pty\n"
+					"-N    Don't run a remote command\n"
 #ifdef ENABLE_CLI_PUBKEY_AUTH
 					"-i <identityfile>   (multiple allowed)\n"
 #endif
@@ -88,6 +89,7 @@ void cli_getopts(int argc, char ** argv) {
 	cli_opts.remoteport = NULL;
 	cli_opts.username = NULL;
 	cli_opts.cmd = NULL;
+	cli_opts.no_cmd = 0;
 	cli_opts.wantpty = 9; /* 9 means "it hasn't been touched", gets set later */
 #ifdef ENABLE_CLI_PUBKEY_AUTH
 	cli_opts.privkeys = NULL;
@@ -163,6 +165,9 @@ void cli_getopts(int argc, char ** argv) {
 				case 'T': /* don't want a pty */
 					cli_opts.wantpty = 0;
 					break;
+				case 'N':
+					cli_opts.no_cmd = 1;
+					break;
 #ifdef ENABLE_CLI_LOCALTCPFWD
 				case 'L':
 					nextislocal = 1;
diff --git a/cli-session.c b/cli-session.c
index 35510fa..c47bd3b 100644
--- a/cli-session.c
+++ b/cli-session.c
@@ -218,13 +218,15 @@ static void cli_sessionloop() {
 #ifdef ENABLE_CLI_REMOTETCPFWD
 			setup_remotetcp();
 #endif
-			cli_send_chansess_request();
-			TRACE(("leave cli_sessionloop: cli_send_chansess_request"))
+			if (!cli_opts.no_cmd) {
+				cli_send_chansess_request();
+			}
+			TRACE(("leave cli_sessionloop: running"))
 			cli_ses.state = SESSION_RUNNING;
 			return;
 
 		case SESSION_RUNNING:
-			if (ses.chancount < 1) {
+			if (ses.chancount < 1 && !cli_opts.no_cmd) {
 				cli_finished();
 			}
 
diff --git a/dbclient.1 b/dbclient.1
index 4d7cc3c..27e2d20 100644
--- a/dbclient.1
+++ b/dbclient.1
@@ -60,6 +60,9 @@ Allocate a pty.
 .B \-T
 Don't allocate a pty.
 .TP
+.B \-N
+Don't request a remote shell or run any commands. Any command arguments are ignored.
+.TP
 .B \-g
 Allow non-local hosts to connect to forwarded ports. Applies to -L and -R
 forwarded ports, though remote connections to -R forwarded ports may be limited
diff --git a/dropbear.8 b/dropbear.8
index 38cf7e2..fbbb26b 100644
--- a/dropbear.8
+++ b/dropbear.8
@@ -72,6 +72,10 @@ Use this option to run
 under TCP/IP servers like inetd, tcpsvd, or tcpserver.
 In program mode the \-F option is implied, and \-p options are ignored.
 .TP
+.B \-P \fIpidfile
+Specify a pidfile to create when running as a daemon. If not specified, the 
+default is /var/run/dropbear.pid
+.TP
 .B \-a
 Allow remote hosts to connect to forwarded ports.
 .SH AUTHOR
diff --git a/dropbearkey.c b/dropbearkey.c
index 0825053..280e1b3 100644
--- a/dropbearkey.c
+++ b/dropbearkey.c
@@ -321,8 +321,7 @@ static void printpubkey(sign_key * key, int keytype) {
 	/* a user@host comment is informative */
 	username = "";
 	pw = getpwuid(getuid());
-	if (pw)
-	{
+	if (pw) {
 		username = pw->pw_name;
 	}
 
diff --git a/runopts.h b/runopts.h
index 1e102e6..cb5e4ca 100644
--- a/runopts.h
+++ b/runopts.h
@@ -102,6 +102,7 @@ typedef struct cli_runopts {
 
 	char *cmd;
 	int wantpty;
+	int no_cmd;
 #ifdef ENABLE_CLI_PUBKEY_AUTH
 	struct SignKeyList *privkeys; /* Keys to use for public-key auth */
 #endif
-- 
cgit v1.2.3


From 4cb673b6440091fe0568918e22f3f2ca0d94bef2 Mon Sep 17 00:00:00 2001
From: Matt Johnston <matt@ucc.asn.au>
Date: Fri, 7 Jul 2006 09:17:18 +0000
Subject: Fixes from Erik Hovland:

cli-authpubkey.c:
    fix leak of keybuf

cli-kex.c:
    fix leak of fingerprint fp

cli-service.c:
    remove commented out code

dropbearkey.c:
    don't attepmt to free NULL key on failure

common-kex.c:
    only free key if it is initialised

keyimport.c:
    remove dead encrypted-key code
    don't leak a FILE* loading OpenSSH keys

rsa.c, dss.c:
    check return values for some libtommath functions

svr-kex.c:
    check return value retrieving DH kex mpint

svr-tcpfwd.c:
    fix null-dereference if remote tcp forward request fails

tcp-accept.c:
    don't incorrectly free the tcpinfo var

--HG--
extra : convert_revision : 640a55bc710cbaa6d212453c750026c770e19193
---
 cli-authpubkey.c |  1 +
 cli-kex.c        |  2 +-
 cli-service.c    |  2 --
 dropbearkey.c    |  6 ++++--
 dss.c            |  4 +++-
 keyimport.c      | 45 ++++-----------------------------------------
 rsa.c            | 21 ++++++++++++++++-----
 svr-kex.c        |  4 +++-
 svr-tcpfwd.c     |  2 +-
 tcp-accept.c     |  1 -
 10 files changed, 33 insertions(+), 55 deletions(-)

(limited to 'dropbearkey.c')

diff --git a/cli-authpubkey.c b/cli-authpubkey.c
index 9d36bc3..8a8fb42 100644
--- a/cli-authpubkey.c
+++ b/cli-authpubkey.c
@@ -112,6 +112,7 @@ void recv_msg_userauth_pk_ok() {
 		/* Success */
 		break;
 	}
+	buf_free(keybuf);
 
 	if (keyitem != NULL) {
 		TRACE(("matching key"))
diff --git a/cli-kex.c b/cli-kex.c
index 3548f1c..467ae23 100644
--- a/cli-kex.c
+++ b/cli-kex.c
@@ -122,6 +122,7 @@ static void ask_to_confirm(unsigned char* keyblob, unsigned int keybloblen) {
 	fprintf(stderr, "\nHost '%s' is not in the trusted hosts file.\n(fingerprint %s)\nDo you want to continue connecting? (y/n)\n", 
 			cli_opts.remotehost, 
 			fp);
+	m_free(fp);
 
 	tty = fopen(_PATH_TTY, "r");
 	if (tty) {
@@ -132,7 +133,6 @@ static void ask_to_confirm(unsigned char* keyblob, unsigned int keybloblen) {
 	}
 
 	if (response == 'y') {
-		m_free(fp);
 		return;
 	}
 
diff --git a/cli-service.c b/cli-service.c
index 87b6ed2..57807be 100644
--- a/cli-service.c
+++ b/cli-service.c
@@ -82,6 +82,4 @@ void recv_msg_service_accept() {
 	}
 
 	dropbear_exit("unrecognised service accept");
-	/* m_free(servicename); not reached */
-
 }
diff --git a/dropbearkey.c b/dropbearkey.c
index 280e1b3..2433381 100644
--- a/dropbearkey.c
+++ b/dropbearkey.c
@@ -283,8 +283,10 @@ out:
 	buf_burn(buf);
 	buf_free(buf);
 	buf = NULL;
-	sign_key_free(key);
-	key = NULL;
+	if (key) {
+		sign_key_free(key);
+		key = NULL;
+	}
 	exit(err);
 }
 
diff --git a/dss.c b/dss.c
index 84a093c..95062c6 100644
--- a/dss.c
+++ b/dss.c
@@ -338,7 +338,9 @@ void buf_put_dss_sign(buffer* buf, dss_key *key, const unsigned char* data,
 	/* generate k */
 	m_mp_init(&dss_protok);
 	bytes_to_mp(&dss_protok, proto_k, SHA512_HASH_SIZE);
-	mp_mod(&dss_protok, key->q, &dss_k);
+	if (mp_mod(&dss_protok, key->q, &dss_k) != MP_OKAY) {
+		dropbear_exit("dss error");
+	}
 	mp_clear(&dss_protok);
 	m_burn(proto_k, SHA512_HASH_SIZE);
 #else /* DSS_PROTOK not defined*/
diff --git a/keyimport.c b/keyimport.c
index a0474f3..1d3e3f5 100644
--- a/keyimport.c
+++ b/keyimport.c
@@ -361,7 +361,7 @@ struct openssh_key {
 static struct openssh_key *load_openssh_key(const char *filename)
 {
 	struct openssh_key *ret;
-	FILE *fp;
+	FILE *fp = NULL;
 	char buffer[256];
 	char *errmsg = NULL, *p = NULL;
 	int headers_done;
@@ -482,6 +482,9 @@ static struct openssh_key *load_openssh_key(const char *filename)
 		memset(&ret, 0, sizeof(ret));
 		m_free(ret);
 	}
+	if (fp) {
+		fclose(fp);
+	}
 	if (errmsg) {
 		fprintf(stderr, "Error: %s\n", errmsg);
 	}
@@ -926,40 +929,6 @@ static int openssh_write(const char *filename, sign_key *key,
 	if (passphrase) {
 		fprintf(stderr, "Encrypted keys aren't supported currently\n");
 		goto error;
-#if 0
-		/*
-		 * Invent an iv. Then derive encryption key from passphrase
-		 * and iv/salt:
-		 * 
-		 *  - let block A equal MD5(passphrase || iv)
-		 *  - let block B equal MD5(A || passphrase || iv)
-		 *  - block C would be MD5(B || passphrase || iv) and so on
-		 *  - encryption key is the first N bytes of A || B
-		 */
-		struct MD5Context md5c;
-		unsigned char keybuf[32];
-
-		for (i = 0; i < 8; i++) iv[i] = random_byte();
-
-		MD5Init(&md5c);
-		MD5Update(&md5c, (unsigned char *)passphrase, strlen(passphrase));
-		MD5Update(&md5c, iv, 8);
-		MD5Final(keybuf, &md5c);
-
-		MD5Init(&md5c);
-		MD5Update(&md5c, keybuf, 16);
-		MD5Update(&md5c, (unsigned char *)passphrase, strlen(passphrase));
-		MD5Update(&md5c, iv, 8);
-		MD5Final(keybuf+16, &md5c);
-
-		/*
-		 * Now encrypt the key blob.
-		 */
-		des3_encrypt_pubkey_ossh(keybuf, iv, outblob, outlen);
-
-		memset(&md5c, 0, sizeof(md5c));
-		memset(keybuf, 0, sizeof(keybuf));
-#endif
 	}
 
 	/*
@@ -976,12 +945,6 @@ static int openssh_write(const char *filename, sign_key *key,
 		goto error;
 	}
 	fputs(header, fp);
-	if (passphrase) {
-		fprintf(fp, "Proc-Type: 4,ENCRYPTED\nDEK-Info: DES-EDE3-CBC,");
-		for (i = 0; i < 8; i++)
-			fprintf(fp, "%02X", iv[i]);
-		fprintf(fp, "\n\n");
-	}
 	base64_encode_fp(fp, outblob, outlen, 64);
 	fputs(footer, fp);
 	fclose(fp);
diff --git a/rsa.c b/rsa.c
index 005e4ca..8665673 100644
--- a/rsa.c
+++ b/rsa.c
@@ -285,18 +285,29 @@ void buf_put_rsa_sign(buffer* buf, rsa_key *key, const unsigned char* data,
 	/* rsa_tmp1 is em */
 	/* em' = em * r^e mod n */
 
-	mp_exptmod(&rsa_tmp2, key->e, key->n, &rsa_s); /* rsa_s used as a temp var*/
-	mp_invmod(&rsa_tmp2, key->n, &rsa_tmp3);
-	mp_mulmod(&rsa_tmp1, &rsa_s, key->n, &rsa_tmp2);
+	/* rsa_s used as a temp var*/
+	if (mp_exptmod(&rsa_tmp2, key->e, key->n, &rsa_s) != MP_OKAY) {
+		dropbear_exit("rsa error");
+	}
+	if (mp_invmod(&rsa_tmp2, key->n, &rsa_tmp3) != MP_OKAY) {
+		dropbear_exit("rsa error");
+	}
+	if (mp_mulmod(&rsa_tmp1, &rsa_s, key->n, &rsa_tmp2) != MP_OKAY) {
+		dropbear_exit("rsa error");
+	}
 
 	/* rsa_tmp2 is em' */
 	/* s' = (em')^d mod n */
-	mp_exptmod(&rsa_tmp2, key->d, key->n, &rsa_tmp1);
+	if (mp_exptmod(&rsa_tmp2, key->d, key->n, &rsa_tmp1) != MP_OKAY) {
+		dropbear_exit("rsa error");
+	}
 
 	/* rsa_tmp1 is s' */
 	/* rsa_tmp3 is r^(-1) mod n */
 	/* s = (s')r^(-1) mod n */
-	mp_mulmod(&rsa_tmp1, &rsa_tmp3, key->n, &rsa_s);
+	if (mp_mulmod(&rsa_tmp1, &rsa_tmp3, key->n, &rsa_s) != MP_OKAY) {
+		dropbear_exit("rsa error");
+	}
 
 #else
 
diff --git a/svr-kex.c b/svr-kex.c
index a9954bb..75cb090 100644
--- a/svr-kex.c
+++ b/svr-kex.c
@@ -52,7 +52,9 @@ void recv_msg_kexdh_init() {
 	}
 
 	m_mp_init(&dh_e);
-	buf_getmpint(ses.payload, &dh_e);
+	if (buf_getmpint(ses.payload, &dh_e) != DROPBEAR_SUCCESS) {
+		dropbear_exit("Failed to get kex value");
+	}
 
 	send_msg_kexdh_reply(&dh_e);
 
diff --git a/svr-tcpfwd.c b/svr-tcpfwd.c
index 6391c4c..d4dca6b 100644
--- a/svr-tcpfwd.c
+++ b/svr-tcpfwd.c
@@ -216,7 +216,7 @@ out:
 	if (ret == DROPBEAR_FAILURE) {
 		/* we only free it if a listener wasn't created, since the listener
 		 * has to remember it if it's to be cancelled */
-		m_free(tcpinfo->listenaddr);
+		m_free(bindaddr);
 		m_free(tcpinfo);
 	}
 	TRACE(("leave remotetcpreq"))
diff --git a/tcp-accept.c b/tcp-accept.c
index ffb175e..c2fb2fe 100644
--- a/tcp-accept.c
+++ b/tcp-accept.c
@@ -131,7 +131,6 @@ int listen_tcpfwd(struct TCPListener* tcpinfo) {
 			tcp_acceptor, cleanup_tcp);
 
 	if (listener == NULL) {
-		m_free(tcpinfo);
 		TRACE(("leave listen_tcpfwd: listener failed"))
 		return DROPBEAR_FAILURE;
 	}
-- 
cgit v1.2.3