The NetBSD Project

CVS log for src/crypto/external/bsd/openssh/dist/auth2-pubkeyfile.c

[BACK] Up to [cvs.NetBSD.org] / src / crypto / external / bsd / openssh / dist

Request diff between arbitrary revisions


Default branch: MAIN


Revision 1.3.2.2 / (download) - annotate - [select for diffs], Mon Dec 25 12:31:03 2023 UTC (2 months ago) by martin
Branch: netbsd-9
Changes since 1.3.2.1: +586 -0 lines
Diff to previous 1.3.2.1 (colored) to branchpoint 1.3 (colored)

Pull up the following, requested by kim in ticket #1780:

	crypto/external/bsd/openssh/Makefile.inc        up to 1.15 (+patch)
	crypto/external/bsd/openssh/bin/Makefile.inc    up to 1.4
	crypto/external/bsd/openssh/bin/scp/Makefile    up to 1.6
	crypto/external/bsd/openssh/bin/sftp/Makefile   up to 1.11
	crypto/external/bsd/openssh/bin/sftp-server/Makefile up to 1.4
	crypto/external/bsd/openssh/bin/ssh/Makefile    up to 1.20
	crypto/external/bsd/openssh/bin/ssh-add/Makefile up to 1.3
	crypto/external/bsd/openssh/bin/ssh-agent/Makefile up to 1.7
	crypto/external/bsd/openssh/bin/ssh-keygen/Makefile up to 1.10
	crypto/external/bsd/openssh/bin/ssh-keyscan/Makefile up to 1.6
	crypto/external/bsd/openssh/bin/ssh-pkcs11-helper/Makefile up to 1.4
	crypto/external/bsd/openssh/bin/sshd/Makefile   up to 1.27 (+patch)
	crypto/external/bsd/openssh/dist/PROTOCOL.sshsig up to 1.1.1.2
	crypto/external/bsd/openssh/dist/srclimit.c     up to 1.3
	crypto/external/bsd/openssh/dist/sftp-realpath.c up to 1.3
	crypto/external/bsd/openssh/dist/sntrup761.c    up to 1.3
	crypto/external/bsd/openssh/dist/sntrup761.sh   up to 1.1.1.2
	crypto/external/bsd/openssh/dist/sshsig.c       up to 1.12
	crypto/external/bsd/openssh/dist/sshsig.h       up to 1.1.1.5
	crypto/external/bsd/openssh/dist/addr.c         up to 1.6
	crypto/external/bsd/openssh/dist/PROTOCOL.u2f   up to 1.1.1.3
	crypto/external/bsd/openssh/dist/sk-api.h       up to 1.1.1.6
	crypto/external/bsd/openssh/dist/sk-usbhid.c    up to 1.9
	crypto/external/bsd/openssh/dist/ssh-ecdsa-sk.c up to 1.4
	crypto/external/bsd/openssh/dist/ssh-ed25519-sk.c up to 1.5
	crypto/external/bsd/openssh/dist/ssh-sk-client.c up to 1.6
	crypto/external/bsd/openssh/dist/ssh-sk-helper.8 up to 1.1.1.2
	crypto/external/bsd/openssh/dist/ssh-sk-helper.c up to 1.7
	crypto/external/bsd/openssh/dist/ssh-sk.c       up to 1.8
	crypto/external/bsd/openssh/dist/ssh-sk.h       up to 1.1.1.2
	crypto/external/bsd/openssh/dist/sshbuf-io.c    up to 1.2
	crypto/external/bsd/openssh/dist/addr.h         up to 1.1.1.2
	crypto/external/bsd/openssh/dist/kexsntrup761x25519.c up to 1.3
	crypto/external/bsd/openssh/dist/cipher-chachapoly-libcrypto.c up to 1.3
	crypto/external/bsd/openssh/dist/srclimit.h     up to 1.1.1.1
	crypto/external/bsd/openssh/dist/auth2-pubkeyfile.c up to 1.3
	crypto/external/bsd/openssh/dist/sftp-usergroup.c up to 1.3
	crypto/external/bsd/openssh/dist/sftp-usergroup.h up to 1.1.1.1
	crypto/external/bsd/openssh/dist/ed25519.sh     up to 1.1.1.1
	crypto/external/bsd/openssh/dist/crc32.c        delete
	crypto/external/bsd/openssh/dist/crc32.h        delete
	crypto/external/bsd/openssh/dist/fe25519.c      delete
	crypto/external/bsd/openssh/dist/fe25519.h      delete
	crypto/external/bsd/openssh/dist/ge25519.c      delete
	crypto/external/bsd/openssh/dist/ge25519.h      delete
	crypto/external/bsd/openssh/dist/ge25519_base.data delete
	crypto/external/bsd/openssh/dist/kexsntrup4591761x25519.c delete
	crypto/external/bsd/openssh/dist/sc25519.c      delete
	crypto/external/bsd/openssh/dist/sc25519.h      delete
	crypto/external/bsd/openssh/dist/sntrup4591761.c delete
	crypto/external/bsd/openssh/dist/sntrup4591761.sh delete
	crypto/external/bsd/openssh/dist/uuencode.c     delete
	crypto/external/bsd/openssh/dist/uuencode.h     delete
	crypto/external/bsd/openssh/dist/verify.c       delete
	crypto/external/bsd/openssh/dist/LICENCE        up to 1.7
	crypto/external/bsd/openssh/dist/PROTOCOL       up to 1.23
	crypto/external/bsd/openssh/dist/PROTOCOL.agent up to 1.15
	crypto/external/bsd/openssh/dist/PROTOCOL.certkeys up to 1.13
	crypto/external/bsd/openssh/dist/PROTOCOL.chacha20poly1305 up to 1.1.1.4
	crypto/external/bsd/openssh/dist/PROTOCOL.key   up to 1.1.1.3
	crypto/external/bsd/openssh/dist/PROTOCOL.krl   up to 1.1.1.5
	crypto/external/bsd/openssh/dist/PROTOCOL.mux   up to 1.12
	crypto/external/bsd/openssh/dist/addrmatch.c    up to 1.15
	crypto/external/bsd/openssh/dist/auth-krb5.c    up to 1.16
	crypto/external/bsd/openssh/dist/auth-options.c up to 1.29
	crypto/external/bsd/openssh/dist/auth-options.h up to 1.15
	crypto/external/bsd/openssh/dist/auth-pam.c     up to 1.21
	crypto/external/bsd/openssh/dist/auth-passwd.c  up to 1.13
	crypto/external/bsd/openssh/dist/auth-rhosts.c  up to 1.16
	crypto/external/bsd/openssh/dist/auth.c         up to 1.34
	crypto/external/bsd/openssh/dist/auth.h         up to 1.23
	crypto/external/bsd/openssh/dist/auth2-chall.c  up to 1.19
	crypto/external/bsd/openssh/dist/auth2-gss.c    up to 1.17
	crypto/external/bsd/openssh/dist/auth2-hostbased.c up to 1.23
	crypto/external/bsd/openssh/dist/auth2-kbdint.c up to 1.15
	crypto/external/bsd/openssh/dist/auth2-krb5.c   up to 1.10
	crypto/external/bsd/openssh/dist/auth2-none.c   up to 1.14
	crypto/external/bsd/openssh/dist/auth2-passwd.c up to 1.16
	crypto/external/bsd/openssh/dist/auth2-pubkey.c up to 1.34
	crypto/external/bsd/openssh/dist/auth2.c        up to 1.29
	crypto/external/bsd/openssh/dist/authfd.c       up to 1.27
	crypto/external/bsd/openssh/dist/authfd.h       up to 1.17
	crypto/external/bsd/openssh/dist/authfile.c     up to 1.28
	crypto/external/bsd/openssh/dist/authfile.h     up to 1.10
	crypto/external/bsd/openssh/dist/canohost.c     up to 1.16
	crypto/external/bsd/openssh/dist/chacha.c       up to 1.6
	crypto/external/bsd/openssh/dist/chacha.h       up to 1.3
	crypto/external/bsd/openssh/dist/channels.c     up to 1.42
	crypto/external/bsd/openssh/dist/channels.h     up to 1.26
	crypto/external/bsd/openssh/dist/cipher-chachapoly.c up to 1.7
	crypto/external/bsd/openssh/dist/cipher-chachapoly.h up to 1.3
	crypto/external/bsd/openssh/dist/cipher.c       up to 1.21
	crypto/external/bsd/openssh/dist/cipher.h       up to 1.17
	crypto/external/bsd/openssh/dist/clientloop.c   up to 1.39
	crypto/external/bsd/openssh/dist/clientloop.h   up to 1.18
	crypto/external/bsd/openssh/dist/compat.c       up to 1.26
	crypto/external/bsd/openssh/dist/compat.h       up to 1.18
	crypto/external/bsd/openssh/dist/crypto_api.h   up to 1.5
	crypto/external/bsd/openssh/dist/dh.c           up to 1.20
	crypto/external/bsd/openssh/dist/dh.h           up to 1.13
	crypto/external/bsd/openssh/dist/digest-libc.c  up to 1.8
	crypto/external/bsd/openssh/dist/digest-openssl.c up to 1.9
	crypto/external/bsd/openssh/dist/dispatch.c     up to 1.11
	crypto/external/bsd/openssh/dist/dns.c          up to 1.23
	crypto/external/bsd/openssh/dist/dns.h          up to 1.13
	crypto/external/bsd/openssh/dist/ed25519.c      up to 1.6
	crypto/external/bsd/openssh/dist/fatal.c        up to 1.7
	crypto/external/bsd/openssh/dist/getrrsetbyname.c up to 1.6
	crypto/external/bsd/openssh/dist/gss-genr.c     up to 1.11
	crypto/external/bsd/openssh/dist/gss-serv.c     up to 1.15
	crypto/external/bsd/openssh/dist/hash.c         up to 1.7
	crypto/external/bsd/openssh/dist/hmac.c         up to 1.8
	crypto/external/bsd/openssh/dist/hostfile.c     up to 1.23
	crypto/external/bsd/openssh/dist/hostfile.h     up to 1.11
	crypto/external/bsd/openssh/dist/includes.h     up to 1.9
	crypto/external/bsd/openssh/dist/kex.c          up to 1.34
	crypto/external/bsd/openssh/dist/kex.h          up to 1.24
	crypto/external/bsd/openssh/dist/kexdh.c        up to 1.10
	crypto/external/bsd/openssh/dist/kexgen.c       up to 1.7
	crypto/external/bsd/openssh/dist/kexgexc.c      up to 1.17
	crypto/external/bsd/openssh/dist/kexgexs.c      up to 1.23
	crypto/external/bsd/openssh/dist/krl.c          up to 1.23
	crypto/external/bsd/openssh/dist/krl.h          up to 1.6
	crypto/external/bsd/openssh/dist/ldapauth.c     up to 1.8
	crypto/external/bsd/openssh/dist/ldapauth.h     up to 1.6
	crypto/external/bsd/openssh/dist/log.c          up to 1.27
	crypto/external/bsd/openssh/dist/log.h          up to 1.17
	crypto/external/bsd/openssh/dist/mac.c          up to 1.16
	crypto/external/bsd/openssh/dist/match.c        up to 1.16
	crypto/external/bsd/openssh/dist/match.h        up to 1.11
	crypto/external/bsd/openssh/dist/misc.c         up to 1.35
	crypto/external/bsd/openssh/dist/misc.h         up to 1.27
	crypto/external/bsd/openssh/dist/moduli         up to 1.10
	crypto/external/bsd/openssh/dist/moduli.c       up to 1.17
	crypto/external/bsd/openssh/dist/monitor.c      up to 1.43
	crypto/external/bsd/openssh/dist/monitor.h      up to 1.13
	crypto/external/bsd/openssh/dist/monitor_fdpass.c up to 1.9
	crypto/external/bsd/openssh/dist/monitor_wrap.c up to 1.34
	crypto/external/bsd/openssh/dist/monitor_wrap.h up to 1.23
	crypto/external/bsd/openssh/dist/msg.c          up to 1.11
	crypto/external/bsd/openssh/dist/mux.c          up to 1.35
	crypto/external/bsd/openssh/dist/myproposal.h   up to 1.24
	crypto/external/bsd/openssh/dist/namespace.h    up to 1.10
	crypto/external/bsd/openssh/dist/nchan.c        up to 1.14
	crypto/external/bsd/openssh/dist/packet.c       up to 1.50
	crypto/external/bsd/openssh/dist/packet.h       up to 1.26
	crypto/external/bsd/openssh/dist/pathnames.h    up to 1.15
	crypto/external/bsd/openssh/dist/pfilter.c      up to 1.8 (+patch)
	crypto/external/bsd/openssh/dist/poly1305.c     up to 1.6
	crypto/external/bsd/openssh/dist/progressmeter.c up to 1.15
	crypto/external/bsd/openssh/dist/readconf.c     up to 1.44
	crypto/external/bsd/openssh/dist/readconf.h     up to 1.34
	crypto/external/bsd/openssh/dist/readpass.c     up to 1.18
	crypto/external/bsd/openssh/dist/rijndael.h     up to 1.3
	crypto/external/bsd/openssh/dist/sandbox-pledge.c up to 1.3
	crypto/external/bsd/openssh/dist/sandbox-rlimit.c up to 1.7
	crypto/external/bsd/openssh/dist/scp.1          up to 1.31
	crypto/external/bsd/openssh/dist/scp.c          up to 1.41
	crypto/external/bsd/openssh/dist/servconf.c     up to 1.44
	crypto/external/bsd/openssh/dist/servconf.h     up to 1.30
	crypto/external/bsd/openssh/dist/serverloop.c   up to 1.35
	crypto/external/bsd/openssh/dist/session.c      up to 1.38
	crypto/external/bsd/openssh/dist/session.h      up to 1.10
	crypto/external/bsd/openssh/dist/sftp-client.c  up to 1.35
	crypto/external/bsd/openssh/dist/sftp-client.h  up to 1.18
	crypto/external/bsd/openssh/dist/sftp-common.c  up to 1.14
	crypto/external/bsd/openssh/dist/sftp-common.h  up to 1.8
	crypto/external/bsd/openssh/dist/sftp-glob.c    up to 1.15
	crypto/external/bsd/openssh/dist/sftp-server-main.c up to 1.8
	crypto/external/bsd/openssh/dist/sftp-server.8  up to 1.14
	crypto/external/bsd/openssh/dist/sftp-server.c  up to 1.30
	crypto/external/bsd/openssh/dist/sftp.1         up to 1.30
	crypto/external/bsd/openssh/dist/sftp.c         up to 1.39
	crypto/external/bsd/openssh/dist/ssh-add.1      up to 1.18
	crypto/external/bsd/openssh/dist/ssh-add.c      up to 1.30
	crypto/external/bsd/openssh/dist/ssh-agent.1    up to 1.19
	crypto/external/bsd/openssh/dist/ssh-agent.c    up to 1.37
	crypto/external/bsd/openssh/dist/ssh-dss.c      up to 1.18
	crypto/external/bsd/openssh/dist/ssh-ecdsa.c    up to 1.15
	crypto/external/bsd/openssh/dist/ssh-ed25519.c  up to 1.10
	crypto/external/bsd/openssh/dist/ssh-gss.h      up to 1.10
	crypto/external/bsd/openssh/dist/ssh-keygen.1   up to 1.34
	crypto/external/bsd/openssh/dist/ssh-keygen.c   up to 1.46
	crypto/external/bsd/openssh/dist/ssh-keyscan.1  up to 1.18
	crypto/external/bsd/openssh/dist/ssh-keyscan.c  up to 1.32
	crypto/external/bsd/openssh/dist/ssh-keysign.8  up to 1.14
	crypto/external/bsd/openssh/dist/ssh-keysign.c  up to 1.24
	crypto/external/bsd/openssh/dist/ssh-pkcs11-client.c up to 1.19
	crypto/external/bsd/openssh/dist/ssh-pkcs11-helper.8 up to 1.12
	crypto/external/bsd/openssh/dist/ssh-pkcs11-helper.c up to 1.22
	crypto/external/bsd/openssh/dist/ssh-pkcs11.c   up to 1.26
	crypto/external/bsd/openssh/dist/ssh-pkcs11.h   up to 1.9
	crypto/external/bsd/openssh/dist/ssh-rsa.c      up to 1.19
	crypto/external/bsd/openssh/dist/ssh-xmss.c     up to 1.6
	crypto/external/bsd/openssh/dist/ssh.1          up to 1.39
	crypto/external/bsd/openssh/dist/ssh.c          up to 1.45
	crypto/external/bsd/openssh/dist/ssh.h          up to 1.13
	crypto/external/bsd/openssh/dist/ssh2.h         up to 1.15
	crypto/external/bsd/openssh/dist/ssh_api.c      up to 1.15
	crypto/external/bsd/openssh/dist/ssh_config     up to 1.16
	crypto/external/bsd/openssh/dist/ssh_config.5   up to 1.40
	crypto/external/bsd/openssh/dist/sshbuf-getput-basic.c up to 1.12
	crypto/external/bsd/openssh/dist/sshbuf-getput-crypto.c up to 1.11
	crypto/external/bsd/openssh/dist/sshbuf-misc.c  up to 1.14
	crypto/external/bsd/openssh/dist/sshbuf.c       up to 1.14
	crypto/external/bsd/openssh/dist/sshbuf.h       up to 1.19
	crypto/external/bsd/openssh/dist/sshconnect.c   up to 1.37
	crypto/external/bsd/openssh/dist/sshconnect.h   up to 1.17
	crypto/external/bsd/openssh/dist/sshconnect2.c  up to 1.46
	crypto/external/bsd/openssh/dist/sshd.8         up to 1.31
	crypto/external/bsd/openssh/dist/sshd.c         up to 1.50
	crypto/external/bsd/openssh/dist/sshd_config    up to 1.28
	crypto/external/bsd/openssh/dist/sshd_config.5  up to 1.42
	crypto/external/bsd/openssh/dist/ssherr.c       up to 1.10
	crypto/external/bsd/openssh/dist/ssherr.h       up to 1.4
	crypto/external/bsd/openssh/dist/sshkey-xmss.c  up to 1.10
	crypto/external/bsd/openssh/dist/sshkey-xmss.h  up to 1.5
	crypto/external/bsd/openssh/dist/sshkey.c       up to 1.32
	crypto/external/bsd/openssh/dist/sshkey.h       up to 1.19
	crypto/external/bsd/openssh/dist/sshlogin.c     up to 1.13
	crypto/external/bsd/openssh/dist/sshpty.c       up to 1.8
	crypto/external/bsd/openssh/dist/ttymodes.c     up to 1.12
	crypto/external/bsd/openssh/dist/uidswap.c      up to 1.10
	crypto/external/bsd/openssh/dist/umac.c         up to 1.22
	crypto/external/bsd/openssh/dist/umac.h         up to 1.10
	crypto/external/bsd/openssh/dist/utf8.c         up to 1.9
	crypto/external/bsd/openssh/dist/utf8.h         up to 1.5
	crypto/external/bsd/openssh/dist/version.h      up to 1.44
	crypto/external/bsd/openssh/dist/xmalloc.c      up to 1.13
	crypto/external/bsd/openssh/dist/xmalloc.h      up to 1.16
	crypto/external/bsd/openssh/dist/xmss_hash.c    up to 1.3
	crypto/external/bsd/openssh/dist/moduli-gen/Makefile up to 1.3
	crypto/external/bsd/openssh/dist/moduli-gen/moduli-gen.sh up to 1.1.1.3
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.2048 up to 1.16
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.3072 up to 1.18
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.4096 up to 1.18
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.6144 up to 1.18
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.7680 up to 1.18
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.8192 up to 1.18
	crypto/external/bsd/openssh/lib/Makefile        up to 1.38
	crypto/external/bsd/openssh/lib/shlib_version   up to 1.36
	crypto/external/bsd/openssh/openssh2netbsd      up to 1.4
	lib/libpam/modules/pam_ssh/Makefile             up to 1.13
	lib/libpam/modules/pam_ssh/pam_ssh.c            up to 1.30
	distrib/sets/lists/base/shl.mi			(apply patch)
	distrib/sets/lists/debug/shl.mi			(apply patch)
	doc/3RDPARTY					(apply patch)

Update OpenSSH to 9.6.

Revision 1.2.2.1 / (download) - annotate - [select for diffs], Fri Aug 11 15:36:39 2023 UTC (6 months, 2 weeks ago) by martin
Branch: netbsd-10
CVS Tags: netbsd-10-0-RC4, netbsd-10-0-RC3, netbsd-10-0-RC2, netbsd-10-0-RC1
Changes since 1.2: +3 -5 lines
Diff to previous 1.2 (colored) next main 1.3 (colored)

Pull up following revision(s) (requested by maya in ticket #322):

	distrib/sets/lists/base/shl.mi: revision 1.953
	distrib/sets/lists/debug/shl.mi: revision 1.315
	crypto/external/bsd/openssh/dist/ed25519.sh     up to 1.1.1.1
	crypto/external/bsd/openssh/dist/fe25519.c      delete
	crypto/external/bsd/openssh/dist/fe25519.h      delete
	crypto/external/bsd/openssh/dist/ge25519.c      delete
	crypto/external/bsd/openssh/dist/ge25519.h      delete
	crypto/external/bsd/openssh/dist/ge25519_base.data delete
	crypto/external/bsd/openssh/dist/sc25519.c      delete
	crypto/external/bsd/openssh/dist/sc25519.h      delete
	crypto/external/bsd/openssh/dist/verify.c       delete
	crypto/external/bsd/openssh/bin/sftp/Makefile   up to 1.11
	crypto/external/bsd/openssh/bin/ssh/Makefile    up to 1.19
	crypto/external/bsd/openssh/bin/ssh-agent/Makefile up to 1.7
	crypto/external/bsd/openssh/bin/ssh-keygen/Makefile up to 1.10
	crypto/external/bsd/openssh/bin/sshd/Makefile   up to 1.27
	crypto/external/bsd/openssh/dist/LICENCE        up to 1.7
	crypto/external/bsd/openssh/dist/PROTOCOL       up to 1.21
	crypto/external/bsd/openssh/dist/addr.c         up to 1.5
	crypto/external/bsd/openssh/dist/addr.h         up to 1.1.1.2
	crypto/external/bsd/openssh/dist/auth-passwd.c  up to 1.13
	crypto/external/bsd/openssh/dist/auth-rhosts.c  up to 1.16
	crypto/external/bsd/openssh/dist/auth.c         up to 1.34
	crypto/external/bsd/openssh/dist/auth2-hostbased.c up to 1.23
	crypto/external/bsd/openssh/dist/auth2-none.c   up to 1.14
	crypto/external/bsd/openssh/dist/auth2-pubkey.c up to 1.33
	crypto/external/bsd/openssh/dist/auth2-pubkeyfile.c up to 1.3
	crypto/external/bsd/openssh/dist/auth2.c        up to 1.27
	crypto/external/bsd/openssh/dist/authfd.c       up to 1.26
	crypto/external/bsd/openssh/dist/authfile.c     up to 1.28
	crypto/external/bsd/openssh/dist/canohost.c     up to 1.15
	crypto/external/bsd/openssh/dist/channels.c     up to 1.40
	crypto/external/bsd/openssh/dist/channels.h     up to 1.24
	crypto/external/bsd/openssh/dist/cipher.h       up to 1.16
	crypto/external/bsd/openssh/dist/clientloop.c   up to 1.37
	crypto/external/bsd/openssh/dist/compat.c       up to 1.26
	crypto/external/bsd/openssh/dist/compat.h       up to 1.18
	crypto/external/bsd/openssh/dist/crypto_api.h   up to 1.5
	crypto/external/bsd/openssh/dist/dispatch.c     up to 1.11
	crypto/external/bsd/openssh/dist/dns.c          up to 1.23
	crypto/external/bsd/openssh/dist/dns.h          up to 1.13
	crypto/external/bsd/openssh/dist/ed25519.c      up to 1.6
	crypto/external/bsd/openssh/dist/hostfile.c     up to 1.23
	crypto/external/bsd/openssh/dist/kex.c          up to 1.32
	crypto/external/bsd/openssh/dist/kex.h          up to 1.22
	crypto/external/bsd/openssh/dist/kexgexs.c      up to 1.22
	crypto/external/bsd/openssh/dist/krl.c          up to 1.22
	crypto/external/bsd/openssh/dist/misc.c         up to 1.33
	crypto/external/bsd/openssh/dist/misc.h         up to 1.25
	crypto/external/bsd/openssh/dist/moduli.c       up to 1.17
	crypto/external/bsd/openssh/dist/monitor.c      up to 1.42
	crypto/external/bsd/openssh/dist/monitor.h      up to 1.13
	crypto/external/bsd/openssh/dist/monitor_wrap.c up to 1.32
	crypto/external/bsd/openssh/dist/mux.c          up to 1.33
	crypto/external/bsd/openssh/dist/packet.c       up to 1.48
	crypto/external/bsd/openssh/dist/progressmeter.c up to 1.14
	crypto/external/bsd/openssh/dist/readconf.c     up to 1.41
	crypto/external/bsd/openssh/dist/readconf.h     up to 1.31
	crypto/external/bsd/openssh/dist/scp.1          up to 1.30
	crypto/external/bsd/openssh/dist/scp.c          up to 1.39
	crypto/external/bsd/openssh/dist/servconf.c     up to 1.42
	crypto/external/bsd/openssh/dist/servconf.h     up to 1.29
	crypto/external/bsd/openssh/dist/serverloop.c   up to 1.34
	crypto/external/bsd/openssh/dist/session.c      up to 1.37
	crypto/external/bsd/openssh/dist/session.h      up to 1.10
	crypto/external/bsd/openssh/dist/sftp-client.c  up to 1.33
	crypto/external/bsd/openssh/dist/sftp-glob.c    up to 1.14
	crypto/external/bsd/openssh/dist/sftp-server.c  up to 1.29
	crypto/external/bsd/openssh/dist/sftp.1         up to 1.29
	crypto/external/bsd/openssh/dist/sftp.c         up to 1.38
	crypto/external/bsd/openssh/dist/sntrup761.c    up to 1.3
	crypto/external/bsd/openssh/dist/sntrup761.sh   up to 1.1.1.2
	crypto/external/bsd/openssh/dist/ssh-add.c      up to 1.28
	crypto/external/bsd/openssh/dist/ssh-agent.1    up to 1.18
	crypto/external/bsd/openssh/dist/ssh-agent.c    up to 1.35
	crypto/external/bsd/openssh/dist/ssh-dss.c      up to 1.18
	crypto/external/bsd/openssh/dist/ssh-ecdsa-sk.c up to 1.4
	crypto/external/bsd/openssh/dist/ssh-ecdsa.c    up to 1.15
	crypto/external/bsd/openssh/dist/ssh-ed25519-sk.c up to 1.5
	crypto/external/bsd/openssh/dist/ssh-ed25519.c  up to 1.10
	crypto/external/bsd/openssh/dist/ssh-keygen.1   up to 1.33
	crypto/external/bsd/openssh/dist/ssh-keygen.c   up to 1.45
	crypto/external/bsd/openssh/dist/ssh-keyscan.1  up to 1.18
	crypto/external/bsd/openssh/dist/ssh-keyscan.c  up to 1.31
	crypto/external/bsd/openssh/dist/ssh-pkcs11-helper.8 up to 1.12
	crypto/external/bsd/openssh/dist/ssh-pkcs11.c   up to 1.25
	crypto/external/bsd/openssh/dist/ssh-rsa.c      up to 1.19
	crypto/external/bsd/openssh/dist/ssh-sk-helper.c up to 1.7
	crypto/external/bsd/openssh/dist/ssh-xmss.c     up to 1.6
	crypto/external/bsd/openssh/dist/ssh.1          up to 1.36
	crypto/external/bsd/openssh/dist/ssh.c          up to 1.43
	crypto/external/bsd/openssh/dist/ssh_api.c      up to 1.15
	crypto/external/bsd/openssh/dist/ssh_config.5   up to 1.37
	crypto/external/bsd/openssh/dist/sshbuf.c       up to 1.14
	crypto/external/bsd/openssh/dist/sshbuf.h       up to 1.19
	crypto/external/bsd/openssh/dist/sshconnect.c   up to 1.35
	crypto/external/bsd/openssh/dist/sshconnect2.c  up to 1.44
	crypto/external/bsd/openssh/dist/sshd.8         up to 1.30
	crypto/external/bsd/openssh/dist/sshd.c         up to 1.49
	crypto/external/bsd/openssh/dist/sshd_config.5  up to 1.41
	crypto/external/bsd/openssh/dist/sshkey-xmss.c  up to 1.10
	crypto/external/bsd/openssh/dist/sshkey-xmss.h  up to 1.5
	crypto/external/bsd/openssh/dist/sshkey.c       up to 1.30
	crypto/external/bsd/openssh/dist/sshkey.h       up to 1.18
	crypto/external/bsd/openssh/dist/umac.c         up to 1.22
	crypto/external/bsd/openssh/dist/version.h      up to 1.42
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.2048 up to 1.14
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.3072 up to 1.16
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.4096 up to 1.16
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.6144 up to 1.16
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.7680 up to 1.16
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.8192 up to 1.16
	crypto/external/bsd/openssh/lib/Makefile        up to 1.37
	crypto/external/bsd/openssh/lib/shlib_version   up to 1.34
	doc/3DPARTY					(apply patch)

Import OpenSSH 9.3p2

Revision 1.3.2.1, Wed Jul 26 17:58:15 2023 UTC (7 months ago) by martin
Branch: netbsd-9
Changes since 1.3: +0 -586 lines
FILE REMOVED

file auth2-pubkeyfile.c was added on branch netbsd-9 on 2023-12-25 12:31:03 +0000

Revision 1.3 / (download) - annotate - [select for diffs], Wed Jul 26 17:58:15 2023 UTC (7 months ago) by christos
Branch: MAIN
CVS Tags: HEAD
Branch point for: netbsd-9
Changes since 1.2: +1 -3 lines
Diff to previous 1.2 (colored)

Merge changes between OpenSSH-9.1 and OpenSSH-9.3

Revision 1.1.1.2 / (download) - annotate - [select for diffs] (vendor branch), Wed Jul 26 17:31:29 2023 UTC (7 months ago) by christos
Branch: OPENSSH
CVS Tags: v96-20231218, v95-20231004, v93p2-20230719, v93-20230719
Changes since 1.1.1.1: +1 -2 lines
Diff to previous 1.1.1.1 (colored)

Import OpenSSH 9.3 + the fix from p2 for the PKCS#11 remote provider
The previous version was OpenSSH 9.1

OpenSSH 9.3p2 (2023-07-19)
OpenSSH 9.3p2 was released on 2023-07-19. It is available from the
mirrors listed at https://www.openssh.com/.
OpenSSH is a 100% complete SSH protocol 2.0 implementation and
includes sftp client and server support.

Once again, we would like to thank the OpenSSH community for their
continued support of the project, especially those who contributed
code or patches, reported bugs, tested snapshots or donated to the
project. More information on donations may be found at:
https://www.openssh.com/donations.html

Changes since OpenSSH 9.3
=========================

This release fixes a security bug.

Security
========

Fix CVE-2023-38408 - a condition where specific libaries loaded via
ssh-agent(1)'s PKCS#11 support could be abused to achieve remote
code execution via a forwarded agent socket if the following
conditions are met:

* Exploitation requires the presence of specific libraries on
  the victim system.
* Remote exploitation requires that the agent was forwarded
  to an attacker-controlled system.

Exploitation can also be prevented by starting ssh-agent(1) with an
empty PKCS#11/FIDO allowlist (ssh-agent -P '') or by configuring
an allowlist that contains only specific provider libraries.

This vulnerability was discovered and demonstrated to be exploitable
by the Qualys Security Advisory team.

In addition to removing the main precondition for exploitation,
this release removes the ability for remote ssh-agent(1) clients
to load PKCS#11 modules by default (see below).

Potentially-incompatible changes
--------------------------------

 * ssh-agent(8): the agent will now refuse requests to load PKCS#11
   modules issued by remote clients by default. A flag has been added
   to restore the previous behaviour "-Oallow-remote-pkcs11".

   Note that ssh-agent(8) depends on the SSH client to identify
   requests that are remote. The OpenSSH >=8.9 ssh(1) client does
   this, but forwarding access to an agent socket using other tools
   may circumvent this restriction.

Checksums:
==========

- SHA1 (openssh-9.3p2.tar.gz) = 219cf700c317f400bb20b001c0406056f7188ea4
- SHA256 (openssh-9.3p2.tar.gz) = IA6+FH9ss/EB/QzfngJEKvfdyimN/9n0VoeOfMrGdug=

Please note that the SHA256 signatures are base64 encoded and not
hexadecimal (which is the default for most checksum tools). The PGP
key used to sign the releases is available from the mirror sites:
https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/RELEASE_KEY.asc

Reporting Bugs:
===============

- Please read https://www.openssh.com/report.html
  Security bugs should be reported directly to openssh@openssh.com


OpenSSH 9.3/9.3p1 (2023-03-15)
OpenSSH 9.3 was released on 2023-03-15. It is available from the
mirrors listed at https://www.openssh.com/.
OpenSSH is a 100% complete SSH protocol 2.0 implementation and
includes sftp client and server support.

Once again, we would like to thank the OpenSSH community for their
continued support of the project, especially those who contributed
code or patches, reported bugs, tested snapshots or donated to the
project. More information on donations may be found at:
https://www.openssh.com/donations.html

Changes since OpenSSH 9.2
=========================

This release fixes a number of security bugs.

Security
========

This release contains fixes for a security problem and a memory
safety problem. The memory safety problem is not believed to be
exploitable, but we report most network-reachable memory faults as
security bugs.

 * ssh-add(1): when adding smartcard keys to ssh-agent(1) with the
   per-hop destination constraints (ssh-add -h ...) added in OpenSSH
   8.9, a logic error prevented the constraints from being
   communicated to the agent. This resulted in the keys being added
   without constraints. The common cases of non-smartcard keys and
   keys without destination constraints are unaffected. This problem
   was reported by Luci Stanescu.

 * ssh(1): Portable OpenSSH provides an implementation of the
   getrrsetbyname(3) function if the standard library does not
   provide it, for use by the VerifyHostKeyDNS feature. A
   specifically crafted DNS response could cause this function to
   perform an out-of-bounds read of adjacent stack data, but this
   condition does not appear to be exploitable beyond denial-of-
   service to the ssh(1) client.

   The getrrsetbyname(3) replacement is only included if the system's
   standard library lacks this function and portable OpenSSH was not
   compiled with the ldns library (--with-ldns). getrrsetbyname(3) is
   only invoked if using VerifyHostKeyDNS to fetch SSHFP records. This
   problem was found by the Coverity static analyzer.

New features
------------

 * ssh-keygen(1), ssh-keyscan(1): accept -Ohashalg=sha1|sha256 when
   outputting SSHFP fingerprints to allow algorithm selection. bz3493

 * sshd(8): add a `sshd -G` option that parses and prints the
   effective configuration without attempting to load private keys
   and perform other checks. This allows usage of the option before
   keys have been generated and for configuration evaluation and
   verification by unprivileged users.

Bugfixes
--------

 * scp(1), sftp(1): fix progressmeter corruption on wide displays;
   bz3534

 * ssh-add(1), ssh-keygen(1): use RSA/SHA256 when testing usability
   of private keys as some systems are starting to disable RSA/SHA1
   in libcrypto.

 * sftp-server(8): fix a memory leak. GHPR363

 * ssh(1), sshd(8), ssh-keyscan(1): remove vestigal protocol
   compatibility code and simplify what's left.

 * Fix a number of low-impact Coverity static analysis findings.
   These include several reported via bz2687

 * ssh_config(5), sshd_config(5): mention that some options are not
   first-match-wins.

 * Rework logging for the regression tests. Regression tests will now
   capture separate logs for each ssh and sshd invocation in a test.

 * ssh(1): make `ssh -Q CASignatureAlgorithms` work as the manpage
   says it should; bz3532.

 * ssh(1): ensure that there is a terminating newline when adding a
   new entry to known_hosts; bz3529

Portability
-----------

 * sshd(8): harden Linux seccomp sandbox. Move to an allowlist of
   mmap(2), madvise(2) and futex(2) flags, removing some concerning
   kernel attack surface.

 * sshd(8): improve Linux seccomp-bpf sandbox for older systems;
   bz3537

Checksums:
==========

- SHA1 (openssh-9.3.tar.gz) = 5f9d2f73ddfe94f3f0a78bdf46704b6ad7b66ec7
- SHA256 (openssh-9.3.tar.gz) = eRcXkFZByz70DUBUcyIdvU0pVxP2X280FrmV8pyUdrk=

- SHA1 (openssh-9.3p1.tar.gz) = 610959871bf8d6baafc3525811948f85b5dd84ab
- SHA256 (openssh-9.3p1.tar.gz) = 6bq6dwGnalHz2Fpiw4OjydzZf6kAuFm8fbEUwYaK+Kg=

Please note that the SHA256 signatures are base64 encoded and not
hexadecimal (which is the default for most checksum tools). The PGP
key used to sign the releases is available from the mirror sites:
https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/RELEASE_KEY.asc

Reporting Bugs:
===============

- Please read https://www.openssh.com/report.html
  Security bugs should be reported directly to openssh@openssh.com


OpenSSH 9.2/9.2p1 (2023-02-02)
OpenSSH 9.2 was released on 2023-02-02. It is available from the
mirrors listed at https://www.openssh.com/.
OpenSSH is a 100% complete SSH protocol 2.0 implementation and
includes sftp client and server support.

Once again, we would like to thank the OpenSSH community for their
continued support of the project, especially those who contributed
code or patches, reported bugs, tested snapshots or donated to the
project. More information on donations may be found at:
https://www.openssh.com/donations.html

Changes since OpenSSH 9.1
=========================

This release fixes a number of security bugs.

Security
========

This release contains fixes for two security problems and a memory
safety problem. The memory safety problem is not believed to be
exploitable, but we report most network-reachable memory faults as
security bugs.

 * sshd(8): fix a pre-authentication double-free memory fault
   introduced in OpenSSH 9.1. This is not believed to be exploitable,
   and it occurs in the unprivileged pre-auth process that is
   subject to chroot(2) and is further sandboxed on most major
   platforms.

 * ssh(8): in OpenSSH releases after 8.7, the PermitRemoteOpen option
   would ignore its first argument unless it was one of the special
   keywords "any" or "none", causing the permission list to fail open
   if only one permission was specified. bz3515

 * ssh(1): if the CanonicalizeHostname and CanonicalizePermittedCNAMEs
   options were enabled, and the system/libc resolver did not check
   that names in DNS responses were valid, then use of these options
   could allow an attacker with control of DNS to include invalid
   characters (possibly including wildcards) in names added to
   known_hosts files when they were updated. These names would still
   have to match the CanonicalizePermittedCNAMEs allow-list, so
   practical exploitation appears unlikely.

Potentially-incompatible changes
--------------------------------

 * ssh(1): add a new EnableEscapeCommandline ssh_config(5) option that
   controls whether the client-side ~C escape sequence that provides a
   command-line is available. Among other things, the ~C command-line
   could be used to add additional port-forwards at runtime.

   This option defaults to "no", disabling the ~C command-line that
   was previously enabled by default. Turning off the command-line
   allows platforms that support sandboxing of the ssh(1) client
   (currently only OpenBSD) to use a stricter default sandbox policy.

New features
------------

 * sshd(8): add support for channel inactivity timeouts via a new
   sshd_config(5) ChannelTimeout directive. This allows channels that
   have not seen traffic in a configurable interval to be
   automatically closed. Different timeouts may be applied to session,
   X11, agent and TCP forwarding channels.

 * sshd(8): add a sshd_config UnusedConnectionTimeout option to
   terminate client connections that have no open channels for a
   length of time. This complements the ChannelTimeout option above.

 * sshd(8): add a -V (version) option to sshd like the ssh client has.

 * ssh(1): add a "Host" line to the output of ssh -G showing the
   original hostname argument. bz3343

 * scp(1), sftp(1): add a -X option to both scp(1) and sftp(1) to
   allow control over some SFTP protocol parameters: the copy buffer
   length and the number of in-flight requests, both of which are used
   during upload/download. Previously these could be controlled in
   sftp(1) only. This makes them available in both SFTP protocol
   clients using the same option character sequence.

 * ssh-keyscan(1): allow scanning of complete CIDR address ranges,
   e.g.  "ssh-keyscan 192.168.0.0/24". If a CIDR range is passed, then
   it will be expanded to all possible addresses in the range
   including the all-0s and all-1s addresses. bz#976

 * ssh(1): support dynamic remote port forwarding in escape
   command-line's -R processing. bz#3499

Bugfixes
--------

 * ssh(1): when restoring non-blocking mode to stdio fds, restore
   exactly the flags that ssh started with and don't just clobber them
   with zero, as this could also remove the append flag from the set.
   bz3523

 * ssh(1): avoid printf("%s", NULL) if using UserKnownHostsFile=none
   and a hostkey in one of the system known hosts file changes.

 * scp(1): switch scp from using pipes to a socket-pair for
   communication with its ssh sub-processes, matching how sftp(1)
   operates.

 * sshd(8): clear signal mask early in main(); sshd may have been
   started with one or more signals masked (sigprocmask(2) is not
   cleared on fork/exec) and this could interfere with various things,
   e.g. the login grace timer. Execution environments that fail to
   clear the signal mask before running sshd are clearly broken, but
   apparently they do exist.

 * ssh(1): warn if no host keys for hostbased auth can be loaded.

 * sshd(8): Add server debugging for hostbased auth that is queued and
   sent to the client after successful authentication, but also logged
   to assist in diagnosis of HostbasedAuthentication problems. bz3507

 * ssh(1): document use of the IdentityFile option as being usable to
   list public keys as well as private keys. GHPR352

 * sshd(8): check for and disallow MaxStartups values less than or
   equal to zero during config parsing, rather than failing later at
   runtime.  bz3489

 * ssh-keygen(1): fix parsing of hex cert expiry times specified on
   the command-line when acting as a CA.

 * scp(1): when scp(1) is using the SFTP protocol for transport (the
   default), better match scp/rcp's handling of globs that don't match
   the globbed characters but do match literally (e.g. trying to
   transfer a file named "foo.[1]"). Previously scp(1) in SFTP mode
   would not match these pathnames but legacy scp/rcp mode would.
   bz3488

 * ssh-agent(1): document the "-O no-restrict-websafe" command-line
   option.

 * ssh(1): honour user's umask(2) if it is more restrictive then the
   ssh default (022).

Portability
-----------

 * sshd(8): allow writev(2) in the Linux seccomp sandbox. This seems
   to be used by recent glibcs at least in some configurations during
   error conditions. bz3512.

 * sshd(8): simply handling of SSH_CONNECTION PAM env var, removing
   global variable and checking the return value from pam_putenv.
   bz3508

 * sshd(8): disable SANDBOX_SECCOMP_FILTER_DEBUG that was mistakenly
   enabled during the OpenSSH 9.1 release cycle.

 * misc: update autotools and regenerate the config files using the
   latest autotools

 * all: use -fzero-call-used-regs=used on clang 15 instead of
   -fzero-call-used-reg=all, as some versions of clang 15 have
   miscompile code when it was enabled. bz3475

 * sshd(8): defer PRNG seeding until after the initial closefrom(2)
   call. PRNG seeding will initialize OpenSSL, and some engine
   providers (e.g. Intel's QAT) will open descriptors for their own
   use that closefrom(2) could clobber. bz3483

 * misc: in the poll(2)/ppoll(2) compatibility code, avoid assuming
   the layout of fd_set.

 * sftp-server(8), ssh-agent(1): fix ptrace(2) disabling on older
   FreeBSD kernels. Some versions do not support using id 0 to refer
   to the current PID for procctl, so try again with getpid()
   explicitly before failing.

 * configure.ac: fix -Wstrict-prototypes in configure test code.
   Clang 16 now warns on this and legacy prototypes will be removed
   in C23. GHPR355

 * configure.ac: fix setres*id checks to work with clang-16. glibc
   has the prototypes for setresuid behind _GNU_SOURCE, and clang 16
   will error out on implicit function definitions. bz3497

Checksums:
==========

- SHA1 (openssh-9.2.tar.gz) = e4b806b7c81b87d6c90afe97b3d016ba6cf3ba1c
- SHA256 (openssh-9.2.tar.gz) = yYe9uaaWSeetXGXOxuaaEiIsLnvITmGW+l5dgMZb9QU=

- SHA1 (openssh-9.2p1.tar.gz) = 3b172b8e971773a7018bbf3231f6589ae539ca4b
- SHA256 (openssh-9.2p1.tar.gz) = P2bb8WVftF9Q4cVtpiqwEhjCKIB7ITONY068351xz0Y=

Please note that the SHA256 signatures are base64 encoded and not
hexadecimal (which is the default for most checksum tools). The PGP
key used to sign the releases is available from the mirror sites:
https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/RELEASE_KEY.asc

Reporting Bugs:
===============

- Please read https://www.openssh.com/report.html
  Security bugs should be reported directly to openssh@openssh.com

Revision 1.2 / (download) - annotate - [select for diffs], Wed Oct 5 22:39:36 2022 UTC (16 months, 3 weeks ago) by christos
Branch: MAIN
CVS Tags: netbsd-10-base
Branch point for: netbsd-10
Changes since 1.1: +89 -1 lines
Diff to previous 1.1 (colored)

merge conflicts between 9.0 and 9.1

Revision 1.1.1.1 / (download) - annotate - [select for diffs] (vendor branch), Wed Oct 5 22:35:32 2022 UTC (16 months, 3 weeks ago) by christos
Branch: OPENSSH
CVS Tags: v91-20221004
Changes since 1.1: +0 -0 lines
Diff to previous 1.1 (colored)

Import OpenSSH-9.1 (previously we were on OpenSSH-9.0)

This release is focused on bug fixing.

Security
========

This release contains fixes for three minor memory safety problems.
None are believed to be exploitable, but we report most memory safety
problems as potential security vulnerabilities out of caution.

 * ssh-keyscan(1): fix a one-byte overflow in SSH- banner processing.
   Reported by Qualys

 * ssh-keygen(1): double free() in error path of file hashing step in
   signing/verify code; GHPR333

 * ssh-keysign(8): double-free in error path introduced in openssh-8.9

Potentially-incompatible changes
--------------------------------

 * The portable OpenSSH project now signs commits and release tags
   using git's recent SSH signature support. The list of developer
   signing keys is included in the repository as .git_allowed_signers
   and is cross-signed using the PGP key that is still used to sign
   release artifacts:
   https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/RELEASE_KEY.asc

 * ssh(1), sshd(8): SetEnv directives in ssh_config and sshd_config
   are now first-match-wins to match other directives. Previously
   if an environment variable was multiply specified the last set
   value would have been used. bz3438

 * ssh-keygen(8): ssh-keygen -A (generate all default host key types)
   will no longer generate DSA keys, as these are insecure and have
   not been used by default for some years.


New features
------------

 * ssh(1), sshd(8): add a RequiredRSASize directive to set a minimum
   RSA key length. Keys below this length will be ignored for user
   authentication and for host authentication in sshd(8).

   ssh(1) will terminate a connection if the server offers an RSA key
   that falls below this limit, as the SSH protocol does not include
   the ability to retry a failed key exchange.

 * sftp-server(8): add a "users-groups-by-id@openssh.com" extension
   request that allows the client to obtain user/group names that
   correspond to a set of uids/gids.

 * sftp(1): use "users-groups-by-id@openssh.com" sftp-server
   extension (when available) to fill in user/group names for
   directory listings.

 * sftp-server(8): support the "home-directory" extension request
   defined in draft-ietf-secsh-filexfer-extensions-00. This overlaps
   a bit with the existing "expand-path@openssh.com", but some other
   clients support it.

 * ssh-keygen(1), sshd(8): allow certificate validity intervals,
   sshsig verification times and authorized_keys expiry-time options
   to accept dates in the UTC time zone in addition to the default
   of interpreting them in the system time zone. YYYYMMDD and
   YYMMDDHHMM[SS] dates/times will be interpreted as UTC if suffixed
   with a 'Z' character.

   Also allow certificate validity intervals to be specified in raw
   seconds-since-epoch as hex value, e.g. -V 0x1234:0x4567890. This
   is intended for use by regress tests and other tools that call
   ssh-keygen as part of a CA workflow. bz3468

 * sftp(1): allow arguments to the sftp -D option, e.g. sftp -D
   "/usr/libexec/sftp-server -el debug3"

 * ssh-keygen(1): allow the existing -U (use agent) flag to work
   with "-Y sign" operations, where it will be interpreted to require
   that the private keys is hosted in an agent; bz3429

Bugfixes
--------

 * ssh-keygen(1): implement the "verify-required" certificate option.
   This was already documented when support for user-verified FIDO
   keys was added, but the ssh-keygen(1) code was missing.

 * ssh-agent(1): hook up the restrict_websafe command-line flag;
   previously the flag was accepted but never actually used.

 * sftp(1): improve filename tab completions: never try to complete
   names to non-existent commands, and better match the completion
   type (local or remote filename) against the argument position
   being completed.

 * ssh-keygen(1), ssh(1), ssh-agent(1): several fixes to FIDO key
   handling, especially relating to keys that request
   user-verification. These should reduce the number of unnecessary
   PIN prompts for keys that support intrinsic user verification.
   GHPR302, GHPR329

 * ssh-keygen(1): when enrolling a FIDO resident key, check if a
   credential with matching application and user ID strings already
   exists and, if so, prompt the user for confirmation before
   overwriting the credential. GHPR329

 * sshd(8): improve logging of errors when opening authorized_keys
   files. bz2042

 * ssh(1): avoid multiplexing operations that could cause SIGPIPE from
   causing the client to exit early. bz3454

 * ssh_config(5), sshd_config(5): clarify that the RekeyLimit
   directive applies to both transmitted and received data. GHPR328

 * ssh-keygen(1): avoid double fclose() in error path.

 * sshd(8): log an error if pipe() fails while accepting a
   connection. bz3447

 * ssh(1), ssh-keygen(1): fix possible NULL deref when built without
   FIDO support. bz3443

 * ssh-keyscan(1): add missing *-sk types to ssh-keyscan manpage.
   GHPR294.

 * sshd(8): ensure that authentication passwords are cleared from
   memory in error paths. GHPR286

 * ssh(1), ssh-agent(1): avoid possibility of notifier code executing
   kill(-1). GHPR286

 * ssh_config(5): note that the ProxyJump directive also accepts the
   same tokens as ProxyCommand. GHPR305.

 * scp(1): do not not ftruncate(3) files early when in sftp mode. The
   previous behaviour of unconditionally truncating the destination
   file would cause "scp ~/foo localhost:foo" and the reverse
   "scp localhost:foo ~/foo" to delete all the contents of their
   destination. bz3431

 * ssh-keygen(1): improve error message when 'ssh-keygen -Y sign' is
   unable to load a private key; bz3429

 * sftp(1), scp(1): when performing operations that glob(3) a remote
   path, ensure that the implicit working directory used to construct
   that path escapes glob(3) characters. This prevents glob characters
   from being processed in places they shouldn't, e.g. "cd /tmp/a*/",
   "get *.txt" should have the get operation treat the path "/tmp/a*"
   literally and not attempt to expand it.

 * ssh(1), sshd(8): be stricter in which characters will be accepted
   in specifying a mask length; allow only 0-9. GHPR278

 * ssh-keygen(1): avoid printing hash algorithm twice when dumping a
   KRL

 * ssh(1), sshd(8): continue running local I/O for open channels
   during SSH transport rekeying. This should make ~-escapes work in
   the client (e.g. to exit) if the connection happened to have
   stalled during a rekey event.

 * ssh(1), sshd(8): avoid potential poll() spin during rekeying

 * Further hardening for sshbuf internals: disallow "reparenting" a
   hierarchical sshbuf and zero the entire buffer if reallocation
   fails. GHPR287

Portability
-----------

 * ssh(1), ssh-keygen(1), sshd(8): automatically enable the built-in
   FIDO security key support if libfido2 is found and usable, unless
   --without-security-key-builtin was requested.

 * ssh(1), ssh-keygen(1), sshd(8): many fixes to make the WinHello
   FIDO device usable on Cygwin. The windows://hello FIDO device will
   be automatically used by default on this platform unless requested
   otherwise, or when probing resident FIDO credentials (an operation
   not currently supported by WinHello).

 * Portable OpenSSH: remove workarounds for obsolete and unsupported
   versions of OpenSSL libcrypto. In particular, this release removes
   fallback support for OpenSSL that lacks AES-CTR or AES-GCM.

   Those AES cipher modes were added to OpenSSL prior to the minimum
   version currently supported by OpenSSH, so this is not expected to
   impact any currently supported configurations.

 * sshd(8): fix SANDBOX_SECCOMP_FILTER_DEBUG on current Linux/glibc

 * All: resync and clean up internal CSPRNG code.

 * scp(1), sftp(1), sftp-server(8): avoid linking these programs with
   unnecessary libraries. They are no longer linked against libz and
   libcrypto. This may be of benefit to space constrained systems
   using any of those components in isolation.

 * sshd(8): add AUDIT_ARCH_PPC to supported seccomp sandbox
   architectures.

 * configure: remove special casing of crypt(). configure will no
   longer search for crypt() in libcrypto, as it was removed from
   there years ago. configure will now only search libc and libcrypt.

 * configure: refuse to use OpenSSL 3.0.4 due to potential RCE in its
   RSA implementation (CVE-2022-2274) on x86_64.

 * All: request 1.1x API compatibility for OpenSSL >=3.x; GHPR322

 * ssh(1), ssh-keygen(1), sshd(8): fix a number of missing includes
   required by the XMSS code on some platforms.

 * sshd(8): cache timezone data in capsicum sandbox.

Revision 1.1 / (download) - annotate - [select for diffs], Wed Oct 5 22:35:32 2022 UTC (16 months, 3 weeks ago) by christos
Branch: MAIN

Initial revision

This form allows you to request diff's between any two revisions of a file. You may select a symbolic revision name using the selection box or you may type in a numeric name using the type-in text box.




CVSweb <webmaster@jp.NetBSD.org>