diff --git a/ChangeLog b/ChangeLog
index 83ee8b648..c20d611b5 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -69,6 +69,10 @@
      [regress/cipher-speed.sh regress/try-ciphers.sh]
      test umac-64@openssh.com
      ok djm@
+   - djm@cvs.openbsd.org 2007/10/24 03:32:35
+     [regress/sftp-cmds.sh regress/sftp-glob.sh regress/test-exec.sh]
+     comprehensive tests for sftp escaping its interaction with globbing;
+     ok dtucker@
 
 20070927
  - (dtucker) [configure.ac atomicio.c] Fall back to including <sys/poll.h> if
@@ -3340,4 +3344,4 @@
    OpenServer 6 and add osr5bigcrypt support so when someone migrates
    passwords between UnixWare and OpenServer they will still work. OK dtucker@
 
-$Id: ChangeLog,v 1.4775 2007/10/26 04:45:57 djm Exp $
+$Id: ChangeLog,v 1.4776 2007/10/26 04:54:12 djm Exp $
diff --git a/regress/sftp-cmds.sh b/regress/sftp-cmds.sh
index 78416735d..5625c5b26 100644
--- a/regress/sftp-cmds.sh
+++ b/regress/sftp-cmds.sh
@@ -1,4 +1,4 @@
-#	$OpenBSD: sftp-cmds.sh,v 1.7 2006/08/29 09:44:00 djm Exp $
+#	$OpenBSD: sftp-cmds.sh,v 1.8 2007/10/24 03:32:35 djm Exp $
 #	Placed in the Public Domain.
 
 # XXX - TODO: 
@@ -34,6 +34,11 @@ fi
 # Path with embedded quote
 QUOTECOPY=${COPY}".\"blah\""
 QUOTECOPY_ARG=${COPY}'.\"blah\"'
+# File with spaces
+SPACECOPY="${COPY} this has spaces.txt"
+SPACECOPY_ARG="${COPY}\ this\ has\ spaces.txt"
+# File with glob metacharacters
+GLOBMETACOPY="${COPY} [metachar].txt"
 
 rm -rf ${COPY} ${COPY}.1 ${COPY}.2 ${COPY}.dd ${COPY}.dd2
 mkdir ${COPY}.dd
@@ -89,12 +94,27 @@ if [ "$os" != "cygwin" ]; then
 rm -f ${QUOTECOPY}
 cp $DATA ${QUOTECOPY}
 verbose "$tid: get filename with quotes"
-echo "get \"$QUOTECOPY_ARG\" ${COPY}" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
-	|| fail "put failed"
+echo "get \"$QUOTECOPY_ARG\" ${COPY}" | \
+    ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \ || fail "get failed"
 cmp ${COPY} ${QUOTECOPY} || fail "corrupted copy after get with quotes"
 rm -f ${QUOTECOPY} ${COPY}
 fi
 
+rm -f "$SPACECOPY" ${COPY}
+cp $DATA "$SPACECOPY"
+verbose "$tid: get filename with spaces"
+echo "get ${SPACECOPY_ARG} ${COPY}" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
+        || fail "get failed"
+cmp ${COPY} "$SPACECOPY" || fail "corrupted copy after get with spaces"
+
+rm -f "$GLOBMETACOPY" ${COPY}
+cp $DATA "$GLOBMETACOPY"
+verbose "$tid: get filename with glob metacharacters"
+echo "get \"${GLOBMETACOPY}\" ${COPY}" | \
+	${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 || fail "get failed"
+cmp ${COPY} "$GLOBMETACOPY" || \
+	fail "corrupted copy after get with glob metacharacters"
+
 rm -f ${COPY}.dd/*
 verbose "$tid: get to directory"
 echo "get $DATA ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
@@ -125,18 +145,24 @@ done
 
 rm -f ${COPY}
 verbose "$tid: put"
-echo "put $DATA $COPY" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
-	|| fail "put failed"
+echo "put $DATA $COPY" | \
+	${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 || fail "put failed"
 cmp $DATA ${COPY} || fail "corrupted copy after put"
 
 if [ "$os" != "cygwin" ]; then
 rm -f ${QUOTECOPY}
 verbose "$tid: put filename with quotes"
-echo "put $DATA \"$QUOTECOPY_ARG\"" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
-	|| fail "put failed"
+echo "put $DATA \"$QUOTECOPY_ARG\"" | \
+	${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 || fail "put failed"
 cmp $DATA ${QUOTECOPY} || fail "corrupted copy after put with quotes"
 fi
 
+rm -f "$SPACECOPY"
+verbose "$tid: put filename with spaces"
+echo "put $DATA ${SPACECOPY_ARG}" | \
+	${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 || fail "put failed"
+cmp $DATA "$SPACECOPY" || fail "corrupted copy after put with spaces"
+
 rm -f ${COPY}.dd/*
 verbose "$tid: put to directory"
 echo "put $DATA ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
@@ -172,8 +198,9 @@ test -f ${COPY}.1 || fail "missing file after rename"
 cmp $DATA ${COPY}.1 >/dev/null 2>&1 || fail "corrupted copy after rename"
 
 verbose "$tid: rename directory"
-echo "rename ${COPY}.dd ${COPY}.dd2" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
-	|| fail "rename directory failed"
+echo "rename ${COPY}.dd ${COPY}.dd2" | \
+	${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 || \
+	fail "rename directory failed"
 test -d ${COPY}.dd && fail "oldname exists after rename directory"
 test -d ${COPY}.dd2 || fail "missing newname after rename directory"
 
@@ -207,5 +234,5 @@ echo "lchdir ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \
 	|| fail "lchdir failed"
 
 rm -rf ${COPY} ${COPY}.1 ${COPY}.2 ${COPY}.dd ${COPY}.dd2
-rm -rf ${QUOTECOPY}
+rm -rf ${QUOTECOPY} "$SPACECOPY" "$GLOBMETACOPY"
 
diff --git a/regress/sftp-glob.sh b/regress/sftp-glob.sh
index e238356a2..d5ebf9fd6 100644
--- a/regress/sftp-glob.sh
+++ b/regress/sftp-glob.sh
@@ -1,28 +1,65 @@
-#	$OpenBSD: sftp-glob.sh,v 1.1 2004/12/10 01:31:30 fgsch Exp $
+#	$OpenBSD: sftp-glob.sh,v 1.2 2007/10/24 03:32:35 djm Exp $
 #	Placed in the Public Domain.
 
 tid="sftp glob"
 
+sftp_ls() {
+	target=$1
+	errtag=$2
+	expected=$3
+	unexpected=$4
+	verbose "$tid: $errtag"
+	$ECHOE "ls -l ${target}" | \
+		${SFTP} -b - -P ${SFTPSERVER} 2>/dev/null | \
+		grep -v "^sftp>" > ${RESULTS}
+	if [ $? -ne 0 ]; then
+		fail "$errtag failed"
+	fi
+	if test "x$expected" != "x" && \
+	   ! fgrep "$expected" ${RESULTS} >/dev/null 2>&1 ; then
+		fail "$expected missing from $errtag results"
+	fi
+	if test "x$unexpected" != "x" && \
+	   fgrep "$unexpected" ${RESULTS} >/dev/null 2>&1 ; then
+		fail "$unexpected present in $errtag results"
+	fi
+	rm -f ${RESULTS}
+}
+
 BASE=${OBJ}/glob
+RESULTS=${OBJ}/results
 DIR=${BASE}/dir
 DATA=${DIR}/file
 
+GLOB1="${DIR}/g-wild*"
+GLOB2="${DIR}/g-wildx"
+QUOTE="${DIR}/g-quote\""
+SLASH="${DIR}/g-sl\\ash"
+ESLASH="${DIR}/g-slash\\"
+QSLASH="${DIR}/g-qs\\\""
+SPACE="${DIR}/g-q space"
+
 rm -rf ${BASE}
 mkdir -p ${DIR}
-touch ${DATA}
+touch "${DATA}" "${GLOB1}" "${GLOB2}" "${QUOTE}"
+touch "${QSLASH}" "${ESLASH}" "${SLASH}" "${SPACE}"
 
-verbose "$tid: ls file"
-echo "ls -l ${DIR}/fil*" | ${SFTP} -P ${SFTPSERVER} 2>/dev/null | \
-	grep ${DATA} >/dev/null 2>&1
-if [ $? -ne 0 ]; then
-	fail "globbed ls file failed"
-fi
-
-verbose "$tid: ls dir"
-echo "ls -l ${BASE}/d*" | ${SFTP} -P ${SFTPSERVER} 2>/dev/null | \
-	grep file >/dev/null 2>&1
-if [ $? -ne 0 ]; then
-	fail "globbed ls dir failed"
-fi
+#       target                   message                expected     unexpected
+sftp_ls "${DIR}/fil*"            "file glob"            "${DATA}"    ""
+sftp_ls "${BASE}/d*"             "dir glob"             "`basename ${DATA}`" ""
+sftp_ls "${DIR}/g-wild\"*\""     "quoted glob"          "g-wild*"    "g-wildx"
+sftp_ls "${DIR}/g-wild\*"        "escaped glob"         "g-wild*"    "g-wildx"
+sftp_ls "${DIR}/g-quote\\\""     "escaped quote"        "g-quote\""  ""
+sftp_ls "\"${DIR}/g-quote\\\"\"" "quoted quote"         "g-quote\""  ""
+sftp_ls "'${DIR}/g-quote\"'"     "single-quoted quote"  "g-quote\""  ""
+sftp_ls "${DIR}/g-sl\\\\ash"     "escaped slash"        "g-sl\\ash"  ""
+sftp_ls "'${DIR}/g-sl\\\\ash'"   "quoted slash"         "g-sl\\ash"  ""
+sftp_ls "${DIR}/g-slash\\\\"     "escaped slash at EOL" "g-slash\\"  ""
+sftp_ls "'${DIR}/g-slash\\\\'"   "quoted slash at EOL"  "g-slash\\"  ""
+sftp_ls "${DIR}/g-qs\\\\\\\""    "escaped slash+quote"  "g-qs\\\""   ""
+sftp_ls "'${DIR}/g-qs\\\\\"'"    "quoted slash+quote"   "g-qs\\\""   ""
+sftp_ls "${DIR}/g-q\\ space"     "escaped space"        "g-q space"  ""
+sftp_ls "'${DIR}/g-q space'"     "quoted space"         "g-q space"  ""
 
 rm -rf ${BASE}
+
diff --git a/regress/test-exec.sh b/regress/test-exec.sh
index 59ae33c08..650be419e 100644
--- a/regress/test-exec.sh
+++ b/regress/test-exec.sh
@@ -30,6 +30,9 @@ else
 	USER=`id -un`
 fi
 
+# XXX platforms that don't support -E may need a replacement
+ECHOE="echo -E"
+
 OBJ=$1
 if [ "x$OBJ" = "x" ]; then
 	echo '$OBJ not defined'
@@ -156,31 +159,31 @@ cleanup ()
 
 trace ()
 {
-	echo "trace: $@" >>$TEST_SSH_LOGFILE
+	$ECHOE "trace: $@" >>$TEST_SSH_LOGFILE
 	if [ "X$TEST_SSH_TRACE" = "Xyes" ]; then
-		echo "$@"
+		$ECHOE "$@"
 	fi
 }
 
 verbose ()
 {
-	echo "verbose: $@" >>$TEST_SSH_LOGFILE
+	$ECHOE "verbose: $@" >>$TEST_SSH_LOGFILE
 	if [ "X$TEST_SSH_QUIET" != "Xyes" ]; then
-		echo "$@"
+		$ECHOE "$@"
 	fi
 }
 
 
 fail ()
 {
-	echo "FAIL: $@" >>$TEST_SSH_LOGFILE
+	$ECHOE "FAIL: $@" >>$TEST_SSH_LOGFILE
 	RESULT=1
-	echo "$@"
+	$ECHOE "$@"
 }
 
 fatal ()
 {
-	echo "FATAL: $@" >>$TEST_SSH_LOGFILE
+	$ECHOE "FATAL: $@" >>$TEST_SSH_LOGFILE
 	echon "FATAL: "
 	fail "$@"
 	cleanup