The NetBSD Project

CVS log for src/crypto/external/bsd/openssh/dist/krl.h

[BACK] Up to [cvs.NetBSD.org] / src / crypto / external / bsd / openssh / dist

Request diff between arbitrary revisions


Default branch: MAIN


Revision 1.3.2.1 / (download) - annotate - [select for diffs], Mon Dec 25 12:31:04 2023 UTC (3 months, 2 weeks ago) by martin
Branch: netbsd-9
Changes since 1.3: +7 -6 lines
Diff to previous 1.3 (colored) next main 1.4 (colored)

Pull up the following, requested by kim in ticket #1780:

	crypto/external/bsd/openssh/Makefile.inc        up to 1.15 (+patch)
	crypto/external/bsd/openssh/bin/Makefile.inc    up to 1.4
	crypto/external/bsd/openssh/bin/scp/Makefile    up to 1.6
	crypto/external/bsd/openssh/bin/sftp/Makefile   up to 1.11
	crypto/external/bsd/openssh/bin/sftp-server/Makefile up to 1.4
	crypto/external/bsd/openssh/bin/ssh/Makefile    up to 1.20
	crypto/external/bsd/openssh/bin/ssh-add/Makefile up to 1.3
	crypto/external/bsd/openssh/bin/ssh-agent/Makefile up to 1.7
	crypto/external/bsd/openssh/bin/ssh-keygen/Makefile up to 1.10
	crypto/external/bsd/openssh/bin/ssh-keyscan/Makefile up to 1.6
	crypto/external/bsd/openssh/bin/ssh-pkcs11-helper/Makefile up to 1.4
	crypto/external/bsd/openssh/bin/sshd/Makefile   up to 1.27 (+patch)
	crypto/external/bsd/openssh/dist/PROTOCOL.sshsig up to 1.1.1.2
	crypto/external/bsd/openssh/dist/srclimit.c     up to 1.3
	crypto/external/bsd/openssh/dist/sftp-realpath.c up to 1.3
	crypto/external/bsd/openssh/dist/sntrup761.c    up to 1.3
	crypto/external/bsd/openssh/dist/sntrup761.sh   up to 1.1.1.2
	crypto/external/bsd/openssh/dist/sshsig.c       up to 1.12
	crypto/external/bsd/openssh/dist/sshsig.h       up to 1.1.1.5
	crypto/external/bsd/openssh/dist/addr.c         up to 1.6
	crypto/external/bsd/openssh/dist/PROTOCOL.u2f   up to 1.1.1.3
	crypto/external/bsd/openssh/dist/sk-api.h       up to 1.1.1.6
	crypto/external/bsd/openssh/dist/sk-usbhid.c    up to 1.9
	crypto/external/bsd/openssh/dist/ssh-ecdsa-sk.c up to 1.4
	crypto/external/bsd/openssh/dist/ssh-ed25519-sk.c up to 1.5
	crypto/external/bsd/openssh/dist/ssh-sk-client.c up to 1.6
	crypto/external/bsd/openssh/dist/ssh-sk-helper.8 up to 1.1.1.2
	crypto/external/bsd/openssh/dist/ssh-sk-helper.c up to 1.7
	crypto/external/bsd/openssh/dist/ssh-sk.c       up to 1.8
	crypto/external/bsd/openssh/dist/ssh-sk.h       up to 1.1.1.2
	crypto/external/bsd/openssh/dist/sshbuf-io.c    up to 1.2
	crypto/external/bsd/openssh/dist/addr.h         up to 1.1.1.2
	crypto/external/bsd/openssh/dist/kexsntrup761x25519.c up to 1.3
	crypto/external/bsd/openssh/dist/cipher-chachapoly-libcrypto.c up to 1.3
	crypto/external/bsd/openssh/dist/srclimit.h     up to 1.1.1.1
	crypto/external/bsd/openssh/dist/auth2-pubkeyfile.c up to 1.3
	crypto/external/bsd/openssh/dist/sftp-usergroup.c up to 1.3
	crypto/external/bsd/openssh/dist/sftp-usergroup.h up to 1.1.1.1
	crypto/external/bsd/openssh/dist/ed25519.sh     up to 1.1.1.1
	crypto/external/bsd/openssh/dist/crc32.c        delete
	crypto/external/bsd/openssh/dist/crc32.h        delete
	crypto/external/bsd/openssh/dist/fe25519.c      delete
	crypto/external/bsd/openssh/dist/fe25519.h      delete
	crypto/external/bsd/openssh/dist/ge25519.c      delete
	crypto/external/bsd/openssh/dist/ge25519.h      delete
	crypto/external/bsd/openssh/dist/ge25519_base.data delete
	crypto/external/bsd/openssh/dist/kexsntrup4591761x25519.c delete
	crypto/external/bsd/openssh/dist/sc25519.c      delete
	crypto/external/bsd/openssh/dist/sc25519.h      delete
	crypto/external/bsd/openssh/dist/sntrup4591761.c delete
	crypto/external/bsd/openssh/dist/sntrup4591761.sh delete
	crypto/external/bsd/openssh/dist/uuencode.c     delete
	crypto/external/bsd/openssh/dist/uuencode.h     delete
	crypto/external/bsd/openssh/dist/verify.c       delete
	crypto/external/bsd/openssh/dist/LICENCE        up to 1.7
	crypto/external/bsd/openssh/dist/PROTOCOL       up to 1.23
	crypto/external/bsd/openssh/dist/PROTOCOL.agent up to 1.15
	crypto/external/bsd/openssh/dist/PROTOCOL.certkeys up to 1.13
	crypto/external/bsd/openssh/dist/PROTOCOL.chacha20poly1305 up to 1.1.1.4
	crypto/external/bsd/openssh/dist/PROTOCOL.key   up to 1.1.1.3
	crypto/external/bsd/openssh/dist/PROTOCOL.krl   up to 1.1.1.5
	crypto/external/bsd/openssh/dist/PROTOCOL.mux   up to 1.12
	crypto/external/bsd/openssh/dist/addrmatch.c    up to 1.15
	crypto/external/bsd/openssh/dist/auth-krb5.c    up to 1.16
	crypto/external/bsd/openssh/dist/auth-options.c up to 1.29
	crypto/external/bsd/openssh/dist/auth-options.h up to 1.15
	crypto/external/bsd/openssh/dist/auth-pam.c     up to 1.21
	crypto/external/bsd/openssh/dist/auth-passwd.c  up to 1.13
	crypto/external/bsd/openssh/dist/auth-rhosts.c  up to 1.16
	crypto/external/bsd/openssh/dist/auth.c         up to 1.34
	crypto/external/bsd/openssh/dist/auth.h         up to 1.23
	crypto/external/bsd/openssh/dist/auth2-chall.c  up to 1.19
	crypto/external/bsd/openssh/dist/auth2-gss.c    up to 1.17
	crypto/external/bsd/openssh/dist/auth2-hostbased.c up to 1.23
	crypto/external/bsd/openssh/dist/auth2-kbdint.c up to 1.15
	crypto/external/bsd/openssh/dist/auth2-krb5.c   up to 1.10
	crypto/external/bsd/openssh/dist/auth2-none.c   up to 1.14
	crypto/external/bsd/openssh/dist/auth2-passwd.c up to 1.16
	crypto/external/bsd/openssh/dist/auth2-pubkey.c up to 1.34
	crypto/external/bsd/openssh/dist/auth2.c        up to 1.29
	crypto/external/bsd/openssh/dist/authfd.c       up to 1.27
	crypto/external/bsd/openssh/dist/authfd.h       up to 1.17
	crypto/external/bsd/openssh/dist/authfile.c     up to 1.28
	crypto/external/bsd/openssh/dist/authfile.h     up to 1.10
	crypto/external/bsd/openssh/dist/canohost.c     up to 1.16
	crypto/external/bsd/openssh/dist/chacha.c       up to 1.6
	crypto/external/bsd/openssh/dist/chacha.h       up to 1.3
	crypto/external/bsd/openssh/dist/channels.c     up to 1.42
	crypto/external/bsd/openssh/dist/channels.h     up to 1.26
	crypto/external/bsd/openssh/dist/cipher-chachapoly.c up to 1.7
	crypto/external/bsd/openssh/dist/cipher-chachapoly.h up to 1.3
	crypto/external/bsd/openssh/dist/cipher.c       up to 1.21
	crypto/external/bsd/openssh/dist/cipher.h       up to 1.17
	crypto/external/bsd/openssh/dist/clientloop.c   up to 1.39
	crypto/external/bsd/openssh/dist/clientloop.h   up to 1.18
	crypto/external/bsd/openssh/dist/compat.c       up to 1.26
	crypto/external/bsd/openssh/dist/compat.h       up to 1.18
	crypto/external/bsd/openssh/dist/crypto_api.h   up to 1.5
	crypto/external/bsd/openssh/dist/dh.c           up to 1.20
	crypto/external/bsd/openssh/dist/dh.h           up to 1.13
	crypto/external/bsd/openssh/dist/digest-libc.c  up to 1.8
	crypto/external/bsd/openssh/dist/digest-openssl.c up to 1.9
	crypto/external/bsd/openssh/dist/dispatch.c     up to 1.11
	crypto/external/bsd/openssh/dist/dns.c          up to 1.23
	crypto/external/bsd/openssh/dist/dns.h          up to 1.13
	crypto/external/bsd/openssh/dist/ed25519.c      up to 1.6
	crypto/external/bsd/openssh/dist/fatal.c        up to 1.7
	crypto/external/bsd/openssh/dist/getrrsetbyname.c up to 1.6
	crypto/external/bsd/openssh/dist/gss-genr.c     up to 1.11
	crypto/external/bsd/openssh/dist/gss-serv.c     up to 1.15
	crypto/external/bsd/openssh/dist/hash.c         up to 1.7
	crypto/external/bsd/openssh/dist/hmac.c         up to 1.8
	crypto/external/bsd/openssh/dist/hostfile.c     up to 1.23
	crypto/external/bsd/openssh/dist/hostfile.h     up to 1.11
	crypto/external/bsd/openssh/dist/includes.h     up to 1.9
	crypto/external/bsd/openssh/dist/kex.c          up to 1.34
	crypto/external/bsd/openssh/dist/kex.h          up to 1.24
	crypto/external/bsd/openssh/dist/kexdh.c        up to 1.10
	crypto/external/bsd/openssh/dist/kexgen.c       up to 1.7
	crypto/external/bsd/openssh/dist/kexgexc.c      up to 1.17
	crypto/external/bsd/openssh/dist/kexgexs.c      up to 1.23
	crypto/external/bsd/openssh/dist/krl.c          up to 1.23
	crypto/external/bsd/openssh/dist/krl.h          up to 1.6
	crypto/external/bsd/openssh/dist/ldapauth.c     up to 1.8
	crypto/external/bsd/openssh/dist/ldapauth.h     up to 1.6
	crypto/external/bsd/openssh/dist/log.c          up to 1.27
	crypto/external/bsd/openssh/dist/log.h          up to 1.17
	crypto/external/bsd/openssh/dist/mac.c          up to 1.16
	crypto/external/bsd/openssh/dist/match.c        up to 1.16
	crypto/external/bsd/openssh/dist/match.h        up to 1.11
	crypto/external/bsd/openssh/dist/misc.c         up to 1.35
	crypto/external/bsd/openssh/dist/misc.h         up to 1.27
	crypto/external/bsd/openssh/dist/moduli         up to 1.10
	crypto/external/bsd/openssh/dist/moduli.c       up to 1.17
	crypto/external/bsd/openssh/dist/monitor.c      up to 1.43
	crypto/external/bsd/openssh/dist/monitor.h      up to 1.13
	crypto/external/bsd/openssh/dist/monitor_fdpass.c up to 1.9
	crypto/external/bsd/openssh/dist/monitor_wrap.c up to 1.34
	crypto/external/bsd/openssh/dist/monitor_wrap.h up to 1.23
	crypto/external/bsd/openssh/dist/msg.c          up to 1.11
	crypto/external/bsd/openssh/dist/mux.c          up to 1.35
	crypto/external/bsd/openssh/dist/myproposal.h   up to 1.24
	crypto/external/bsd/openssh/dist/namespace.h    up to 1.10
	crypto/external/bsd/openssh/dist/nchan.c        up to 1.14
	crypto/external/bsd/openssh/dist/packet.c       up to 1.50
	crypto/external/bsd/openssh/dist/packet.h       up to 1.26
	crypto/external/bsd/openssh/dist/pathnames.h    up to 1.15
	crypto/external/bsd/openssh/dist/pfilter.c      up to 1.8 (+patch)
	crypto/external/bsd/openssh/dist/poly1305.c     up to 1.6
	crypto/external/bsd/openssh/dist/progressmeter.c up to 1.15
	crypto/external/bsd/openssh/dist/readconf.c     up to 1.44
	crypto/external/bsd/openssh/dist/readconf.h     up to 1.34
	crypto/external/bsd/openssh/dist/readpass.c     up to 1.18
	crypto/external/bsd/openssh/dist/rijndael.h     up to 1.3
	crypto/external/bsd/openssh/dist/sandbox-pledge.c up to 1.3
	crypto/external/bsd/openssh/dist/sandbox-rlimit.c up to 1.7
	crypto/external/bsd/openssh/dist/scp.1          up to 1.31
	crypto/external/bsd/openssh/dist/scp.c          up to 1.41
	crypto/external/bsd/openssh/dist/servconf.c     up to 1.44
	crypto/external/bsd/openssh/dist/servconf.h     up to 1.30
	crypto/external/bsd/openssh/dist/serverloop.c   up to 1.35
	crypto/external/bsd/openssh/dist/session.c      up to 1.38
	crypto/external/bsd/openssh/dist/session.h      up to 1.10
	crypto/external/bsd/openssh/dist/sftp-client.c  up to 1.35
	crypto/external/bsd/openssh/dist/sftp-client.h  up to 1.18
	crypto/external/bsd/openssh/dist/sftp-common.c  up to 1.14
	crypto/external/bsd/openssh/dist/sftp-common.h  up to 1.8
	crypto/external/bsd/openssh/dist/sftp-glob.c    up to 1.15
	crypto/external/bsd/openssh/dist/sftp-server-main.c up to 1.8
	crypto/external/bsd/openssh/dist/sftp-server.8  up to 1.14
	crypto/external/bsd/openssh/dist/sftp-server.c  up to 1.30
	crypto/external/bsd/openssh/dist/sftp.1         up to 1.30
	crypto/external/bsd/openssh/dist/sftp.c         up to 1.39
	crypto/external/bsd/openssh/dist/ssh-add.1      up to 1.18
	crypto/external/bsd/openssh/dist/ssh-add.c      up to 1.30
	crypto/external/bsd/openssh/dist/ssh-agent.1    up to 1.19
	crypto/external/bsd/openssh/dist/ssh-agent.c    up to 1.37
	crypto/external/bsd/openssh/dist/ssh-dss.c      up to 1.18
	crypto/external/bsd/openssh/dist/ssh-ecdsa.c    up to 1.15
	crypto/external/bsd/openssh/dist/ssh-ed25519.c  up to 1.10
	crypto/external/bsd/openssh/dist/ssh-gss.h      up to 1.10
	crypto/external/bsd/openssh/dist/ssh-keygen.1   up to 1.34
	crypto/external/bsd/openssh/dist/ssh-keygen.c   up to 1.46
	crypto/external/bsd/openssh/dist/ssh-keyscan.1  up to 1.18
	crypto/external/bsd/openssh/dist/ssh-keyscan.c  up to 1.32
	crypto/external/bsd/openssh/dist/ssh-keysign.8  up to 1.14
	crypto/external/bsd/openssh/dist/ssh-keysign.c  up to 1.24
	crypto/external/bsd/openssh/dist/ssh-pkcs11-client.c up to 1.19
	crypto/external/bsd/openssh/dist/ssh-pkcs11-helper.8 up to 1.12
	crypto/external/bsd/openssh/dist/ssh-pkcs11-helper.c up to 1.22
	crypto/external/bsd/openssh/dist/ssh-pkcs11.c   up to 1.26
	crypto/external/bsd/openssh/dist/ssh-pkcs11.h   up to 1.9
	crypto/external/bsd/openssh/dist/ssh-rsa.c      up to 1.19
	crypto/external/bsd/openssh/dist/ssh-xmss.c     up to 1.6
	crypto/external/bsd/openssh/dist/ssh.1          up to 1.39
	crypto/external/bsd/openssh/dist/ssh.c          up to 1.45
	crypto/external/bsd/openssh/dist/ssh.h          up to 1.13
	crypto/external/bsd/openssh/dist/ssh2.h         up to 1.15
	crypto/external/bsd/openssh/dist/ssh_api.c      up to 1.15
	crypto/external/bsd/openssh/dist/ssh_config     up to 1.16
	crypto/external/bsd/openssh/dist/ssh_config.5   up to 1.40
	crypto/external/bsd/openssh/dist/sshbuf-getput-basic.c up to 1.12
	crypto/external/bsd/openssh/dist/sshbuf-getput-crypto.c up to 1.11
	crypto/external/bsd/openssh/dist/sshbuf-misc.c  up to 1.14
	crypto/external/bsd/openssh/dist/sshbuf.c       up to 1.14
	crypto/external/bsd/openssh/dist/sshbuf.h       up to 1.19
	crypto/external/bsd/openssh/dist/sshconnect.c   up to 1.37
	crypto/external/bsd/openssh/dist/sshconnect.h   up to 1.17
	crypto/external/bsd/openssh/dist/sshconnect2.c  up to 1.46
	crypto/external/bsd/openssh/dist/sshd.8         up to 1.31
	crypto/external/bsd/openssh/dist/sshd.c         up to 1.50
	crypto/external/bsd/openssh/dist/sshd_config    up to 1.28
	crypto/external/bsd/openssh/dist/sshd_config.5  up to 1.42
	crypto/external/bsd/openssh/dist/ssherr.c       up to 1.10
	crypto/external/bsd/openssh/dist/ssherr.h       up to 1.4
	crypto/external/bsd/openssh/dist/sshkey-xmss.c  up to 1.10
	crypto/external/bsd/openssh/dist/sshkey-xmss.h  up to 1.5
	crypto/external/bsd/openssh/dist/sshkey.c       up to 1.32
	crypto/external/bsd/openssh/dist/sshkey.h       up to 1.19
	crypto/external/bsd/openssh/dist/sshlogin.c     up to 1.13
	crypto/external/bsd/openssh/dist/sshpty.c       up to 1.8
	crypto/external/bsd/openssh/dist/ttymodes.c     up to 1.12
	crypto/external/bsd/openssh/dist/uidswap.c      up to 1.10
	crypto/external/bsd/openssh/dist/umac.c         up to 1.22
	crypto/external/bsd/openssh/dist/umac.h         up to 1.10
	crypto/external/bsd/openssh/dist/utf8.c         up to 1.9
	crypto/external/bsd/openssh/dist/utf8.h         up to 1.5
	crypto/external/bsd/openssh/dist/version.h      up to 1.44
	crypto/external/bsd/openssh/dist/xmalloc.c      up to 1.13
	crypto/external/bsd/openssh/dist/xmalloc.h      up to 1.16
	crypto/external/bsd/openssh/dist/xmss_hash.c    up to 1.3
	crypto/external/bsd/openssh/dist/moduli-gen/Makefile up to 1.3
	crypto/external/bsd/openssh/dist/moduli-gen/moduli-gen.sh up to 1.1.1.3
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.2048 up to 1.16
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.3072 up to 1.18
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.4096 up to 1.18
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.6144 up to 1.18
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.7680 up to 1.18
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.8192 up to 1.18
	crypto/external/bsd/openssh/lib/Makefile        up to 1.38
	crypto/external/bsd/openssh/lib/shlib_version   up to 1.36
	crypto/external/bsd/openssh/openssh2netbsd      up to 1.4
	lib/libpam/modules/pam_ssh/Makefile             up to 1.13
	lib/libpam/modules/pam_ssh/pam_ssh.c            up to 1.30
	distrib/sets/lists/base/shl.mi			(apply patch)
	distrib/sets/lists/debug/shl.mi			(apply patch)
	doc/3RDPARTY					(apply patch)

Update OpenSSH to 9.6.

Revision 1.5.6.1 / (download) - annotate - [select for diffs], Thu Nov 2 22:15:21 2023 UTC (5 months, 1 week ago) by sborrill
Branch: netbsd-10
CVS Tags: netbsd-10-0-RELEASE, netbsd-10-0-RC6, netbsd-10-0-RC5, netbsd-10-0-RC4, netbsd-10-0-RC3, netbsd-10-0-RC2, netbsd-10-0-RC1
Changes since 1.5: +6 -6 lines
Diff to previous 1.5 (colored) next main 1.6 (colored)

Pull up the following revisions(s) (requested by martin in ticket #443):
	crypto/external/bsd/openssh/dist sync with HEAD
	crypto/external/bsd/openssh/dist/PROTOCOL:       up to 1.22
	crypto/external/bsd/openssh/dist/PROTOCOL.agent: up to 1.14
	crypto/external/bsd/openssh/dist/PROTOCOL.krl:   up to 1.1.1.5
	crypto/external/bsd/openssh/dist/addr.c:         up to 1.6
	crypto/external/bsd/openssh/dist/auth-options.c: up to 1.29
	crypto/external/bsd/openssh/dist/auth-pam.c:     up to 1.21
	crypto/external/bsd/openssh/dist/auth2-gss.c:    up to 1.17
	crypto/external/bsd/openssh/dist/auth2-pubkey.c: up to 1.34
	crypto/external/bsd/openssh/dist/auth2.c:        up to 1.28
	crypto/external/bsd/openssh/dist/canohost.c:     up to 1.16
	crypto/external/bsd/openssh/dist/chacha.c:       up to 1.6
	crypto/external/bsd/openssh/dist/channels.c      up to 1.41
	crypto/external/bsd/openssh/dist/channels.h:     up to 1.25
	crypto/external/bsd/openssh/dist/cipher-chachapoly-libcrypto.c: up to 1.3
	crypto/external/bsd/openssh/dist/cipher-chachapoly.c: up to 1.7
	crypto/external/bsd/openssh/dist/clientloop.c:   up to 1.38
	crypto/external/bsd/openssh/dist/kex.c:          up to 1.33
	crypto/external/bsd/openssh/dist/kex.h:          up to 1.23
	crypto/external/bsd/openssh/dist/kexgexs.c:      up to 1.23
	crypto/external/bsd/openssh/dist/krl.c:          up to 1.23
	crypto/external/bsd/openssh/dist/krl.h:          up to 1.6
	crypto/external/bsd/openssh/dist/match.c:        up to 1.16
	crypto/external/bsd/openssh/dist/misc.c;         up to 1.34
	crypto/external/bsd/openssh/dist/misc.h:         up to 1.26
	crypto/external/bsd/openssh/dist/moduli:         up to 1.10
	crypto/external/bsd/openssh/dist/monitor.c:      up to 1.43
	crypto/external/bsd/openssh/dist/monitor_wrap.c: up to 1.33
	crypto/external/bsd/openssh/dist/mux.c:          up to 1.34
	crypto/external/bsd/openssh/dist/packet.c:       up to 1.49
	crypto/external/bsd/openssh/dist/packet.h:       up to 1.25
	crypto/external/bsd/openssh/dist/poly1305.c:     up to 1.6
	crypto/external/bsd/openssh/dist/progressmeter.c: up to 1.15
	crypto/external/bsd/openssh/dist/readconf.c:     up to 1.42
	crypto/external/bsd/openssh/dist/readconf.h:     up to 1.32
	crypto/external/bsd/openssh/dist/scp.c:          up to 1.40
	crypto/external/bsd/openssh/dist/servconf.c:     up to 1.43
	crypto/external/bsd/openssh/dist/servconf.h:     up to 1.30
	crypto/external/bsd/openssh/dist/serverloop.c:   up to 1.35
	crypto/external/bsd/openssh/dist/session.c:      up to 1.38
	crypto/external/bsd/openssh/dist/sftp-client.c:  up to 1.34
	crypto/external/bsd/openssh/dist/sftp-client.h:  up to 1.18
	crypto/external/bsd/openssh/dist/sftp-common.c:  up to 1.14
	crypto/external/bsd/openssh/dist/sftp-glob.c:    up to 1.15
	crypto/external/bsd/openssh/dist/sftp-server.c:  up to 1.30
	crypto/external/bsd/openssh/dist/sftp-usergroup.c: up to 1.3
	crypto/external/bsd/openssh/dist/sftp.c:         up to 1.39
	crypto/external/bsd/openssh/dist/sk-usbhid.c:    up to 1.9
	crypto/external/bsd/openssh/dist/ssh-add.c:      up to 1.29
	crypto/external/bsd/openssh/dist/ssh-agent.1:    up to 1.19
	crypto/external/bsd/openssh/dist/ssh-agent.c:    up to 1.36
	crypto/external/bsd/openssh/dist/ssh-keygen.1:   up to 1.34
	crypto/external/bsd/openssh/dist/ssh-keygen.c:   up to 1.46
	crypto/external/bsd/openssh/dist/ssh-keyscan.c:  up to 1.32
	crypto/external/bsd/openssh/dist/ssh-pkcs11-client.c: up to 1.18
	crypto/external/bsd/openssh/dist/ssh-pkcs11.c:   up to 1.26
	crypto/external/bsd/openssh/dist/ssh-sk.c:       up to 1.8
	crypto/external/bsd/openssh/dist/ssh.1:          up to 1.37
	crypto/external/bsd/openssh/dist/ssh.c:          up to 1.44
	crypto/external/bsd/openssh/dist/ssh2.h:         up to 1.14
	crypto/external/bsd/openssh/dist/ssh_config:     up to 1.16
	crypto/external/bsd/openssh/dist/ssh_config.5:   up to 1.38
	crypto/external/bsd/openssh/dist/sshconnect2.c:  up to 1.45
	crypto/external/bsd/openssh/dist/sshd.8:         up to 1.31
	crypto/external/bsd/openssh/dist/sshd_config.5:  up to 1.42
	crypto/external/bsd/openssh/dist/sshkey.c:       up to 1.31
	crypto/external/bsd/openssh/dist/sshkey.h:       up to 1.19
	crypto/external/bsd/openssh/dist/sshsig.c:       up to 1.11
	crypto/external/bsd/openssh/dist/version.h:      up to 1.43
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.2048: up to 1.15
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.3072: up to 1.17
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.4096: up to 1.17
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.6144: up to 1.17
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.7680: up to 1.17
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.8192: up to 1.17
	crypto/external/bsd/openssh/lib/shlib_version:	1.35
	distrib/sets/lists/base/shl.mi:			1.972 via patch
	distrib/sets/lists/debug/shl.mi:		1.333
	doc/3RDPARTY:					1.1962 via patch

ssh(1): update to OpenSSH 9.5

Revision 1.6 / (download) - annotate - [select for diffs], Wed Oct 25 20:19:57 2023 UTC (5 months, 2 weeks ago) by christos
Branch: MAIN
CVS Tags: HEAD
Changes since 1.5: +5 -5 lines
Diff to previous 1.5 (colored)

Merge conflicts between 9.3 and 9.5

Revision 1.1.1.7 / (download) - annotate - [select for diffs] (vendor branch), Wed Oct 25 20:14:31 2023 UTC (5 months, 2 weeks ago) by christos
Branch: OPENSSH
CVS Tags: v96-20231218, v95-20231004
Changes since 1.1.1.6: +5 -5 lines
Diff to previous 1.1.1.6 (colored)

Import OpenSSH 9.5 (Last was OpenSSH 9.3)

OpenSSH 9.5/9.5p1 (2023-10-04)
OpenSSH 9.5 was released on 2023-10-04. It is available from the
mirrors listed at https://www.openssh.com/.
OpenSSH is a 100% complete SSH protocol 2.0 implementation and
includes sftp client and server support.

Once again, we would like to thank the OpenSSH community for their
continued support of the project, especially those who contributed
code or patches, reported bugs, tested snapshots or donated to the
project. More information on donations may be found at:
https://www.openssh.com/donations.html

Changes since OpenSSH 9.4
=========================

This release fixes a number of bugs and adds some small features.

Potentially incompatible changes
--------------------------------

 * ssh-keygen(1): generate Ed25519 keys by default. Ed25519 public keys
   are very convenient due to their small size. Ed25519 keys are
   specified in RFC 8709 and OpenSSH has supported them since version 6.5
   (January 2014).

 * sshd(8): the Subsystem directive now accurately preserves quoting of
   subsystem commands and arguments. This may change behaviour for exotic
   configurations, but the most common subsystem configuration
   (sftp-server) is unlikely to be affected.

New features
------------

 * ssh(1): add keystroke timing obfuscation to the client. This attempts
   to hide inter-keystroke timings by sending interactive traffic at
   fixed intervals (default: every 20ms) when there is only a small
   amount of data being sent. It also sends fake "chaff" keystrokes for
   a random interval after the last real keystroke. These are
   controlled by a new ssh_config ObscureKeystrokeTiming keyword.

 * ssh(1), sshd(8): Introduce a transport-level ping facility. This adds
   a pair of SSH transport protocol messages SSH2_MSG_PING/PONG to
   implement a ping capability. These messages use numbers in the "local
   extensions" number space and are advertised using a "ping@openssh.com"
   ext-info message with a string version number of "0".

 * sshd(8): allow override of Subsystem directives in sshd Match blocks.

Bugfixes
--------

 * scp(1): fix scp in SFTP mode recursive upload and download of
   directories that contain symlinks to other directories. In scp mode,
   the links would be followed, but in SFTP mode they were not. bz3611

 * ssh-keygen(1): handle cr+lf (instead of just cr) line endings in
   sshsig signature files.

 * ssh(1): interactive mode for ControlPersist sessions if they
   originally requested a tty.

 * sshd(8): make PerSourceMaxStartups first-match-wins

 * sshd(8): limit artificial login delay to a reasonable maximum (5s)
   and don't delay at all for the "none" authentication mechanism.cw
    bz3602

 * sshd(8): Log errors in kex_exchange_identification() with level
   verbose instead of error to reduce preauth log spam. All of those
   get logged with a more generic error message by sshpkt_fatal().

 * sshd(8): correct math for ClientAliveInterval that caused the probes
    to be sent less frequently than configured.

 * ssh(1): fix regression in OpenSSH 9.4 (mux.c r1.99) that caused
   multiplexed sessions to ignore SIGINT under some circumstances.

Portability
-----------

 * Avoid clang zero-call-used-regs=all bug on Apple compilers, which
   for some reason have version numbers that do not match the upstream
   clang version numbers. bz#3584

 * Fix configure test for zlib 1.3 and later/development versions. bz3604

Checksums:
==========

 - SHA1 (openssh-9.5.tar.gz) = 8a0bd3a91fac338d97d91817af58df731f6509a3
 - SHA256 (openssh-9.5.tar.gz) = sVMxeM3d6g65qBMktJIofxmK4Ipg9dblKif0VnhPeO0=

 - SHA1 (openssh-9.5p1.tar.gz) = 35c16dcc6e7d0a9465faa241476ef24f76b196cc
 - SHA256 (openssh-9.5p1.tar.gz) = 8Cbnt5un+1QPdRgq+W3IqPHbOV+SK7yfbKYDZyaGCGs=

Please note that the SHA256 signatures are base64 encoded and not
hexadecimal (which is the default for most checksum tools). The PGP
key used to sign the releases is available from the mirror sites:
https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/RELEASE_KEY.asc

Reporting Bugs:
===============

- Please read https://www.openssh.com/report.html
  Security bugs should be reported directly to openssh@openssh.com
OpenSSH 9.4/9.4p1 (2023-08-10)
OpenSSH 9.4 was released on 2023-08-10. It is available from the
mirrors listed at https://www.openssh.com/.
OpenSSH is a 100% complete SSH protocol 2.0 implementation and
includes sftp client and server support.

Once again, we would like to thank the OpenSSH community for their
continued support of the project, especially those who contributed
code or patches, reported bugs, tested snapshots or donated to the
project. More information on donations may be found at:
https://www.openssh.com/donations.html

Changes since OpenSSH 9.3p2
===========================

This release fixes a number of bugs and adds some small features.

Potentially incompatible changes
--------------------------------

 * This release removes support for older versions of libcrypto.
   OpenSSH now requires LibreSSL >= 3.1.0 or OpenSSL >= 1.1.1.
   Note that these versions are already deprecated by their upstream
   vendors.

 * ssh-agent(1): PKCS#11 modules must now be specified by their full
   paths. Previously dlopen(3) could search for them in system
   library directories.

New features
------------

 * ssh(1): allow forwarding Unix Domain sockets via ssh -W.

 * ssh(1): add support for configuration tags to ssh(1).
   This adds a ssh_config(5) "Tag" directive and corresponding
   "Match tag" predicate that may be used to select blocks of
   configuration similar to the pf.conf(5) keywords of the same
   name.

 * ssh(1): add a "match localnetwork" predicate. This allows matching
   on the addresses of available network interfaces and may be used to
   vary the effective client configuration based on network location.

 * ssh(1), sshd(8), ssh-keygen(1): infrastructure support for KRL
   extensions.  This defines wire formats for optional KRL extensions
   and implements parsing of the new submessages. No actual extensions
   are supported at this point.

 * sshd(8): AuthorizedPrincipalsCommand and AuthorizedKeysCommand now
   accept two additional %-expansion sequences: %D which expands to
   the routing domain of the connected session and %C which expands
   to the addresses and port numbers for the source and destination
   of the connection.

 * ssh-keygen(1): increase the default work factor (rounds) for the
   bcrypt KDF used to derive symmetric encryption keys for passphrase
   protected key files by 50%.

Bugfixes
--------

 * ssh-agent(1): improve isolation between loaded PKCS#11 modules
   by running separate ssh-pkcs11-helpers for each loaded provider.

 * ssh(1): make -f (fork after authentication) work correctly with
   multiplexed connections, including ControlPersist. bz3589 bz3589

 * ssh(1): make ConnectTimeout apply to multiplexing sockets and not
   just to network connections.

 * ssh-agent(1), ssh(1): improve defences against invalid PKCS#11
   modules being loaded by checking that the requested module
   contains the required symbol before loading it.

 * sshd(8): fix AuthorizedPrincipalsCommand when AuthorizedKeysCommand
   appears before it in sshd_config. Since OpenSSH 8.7 the
   AuthorizedPrincipalsCommand directive was incorrectly ignored in
   this situation. bz3574

 * sshd(8), ssh(1), ssh-keygen(1): remove vestigal support for KRL
   signatures When the KRL format was originally defined, it included
   support for signing of KRL objects. However, the code to sign KRLs
   and verify KRL signatues was never completed in OpenSSH. This
   release removes the partially-implemented code to verify KRLs.
   All OpenSSH tools now ignore KRL_SECTION_SIGNATURE sections in
   KRL files.

 * All: fix a number of memory leaks and unreachable/harmless integer
   overflows.

 * ssh-agent(1), ssh(1): don't truncate strings logged from PKCS#11
   modules; GHPR406

 * sshd(8), ssh(1): better validate CASignatureAlgorithms in
   ssh_config and sshd_config. Previously this directive would accept
   certificate algorithm names, but these were unusable in practice as
   OpenSSH does not support CA chains. bz3577

 * ssh(1): make `ssh -Q CASignatureAlgorithms` only list signature
   algorithms that are valid for CA signing. Previous behaviour was
   to list all signing algorithms, including certificate algorithms.

 * ssh-keyscan(1): gracefully handle systems where rlimits or the
   maximum number of open files is larger than INT_MAX; bz3581

 * ssh-keygen(1): fix "no comment" not showing on when running
   `ssh-keygen -l` on multiple keys where one has a comment and other
   following keys do not. bz3580

 * scp(1), sftp(1): adjust ftruncate() logic to handle servers that
   reorder requests. Previously, if the server reordered requests then
   the resultant file would be erroneously truncated.

 * ssh(1): don't incorrectly disable hostname canonicalization when
   CanonicalizeHostname=yes and ProxyJump was expicitly set to
   "none". bz3567

 * scp(1): when copying local->remote, check that the source file
   exists before opening an SFTP connection to the server. Based on
   GHPR#370

Portability
-----------

 * All: a number of build fixes for various platforms and
   configuration combinations.

 * sshd(8): provide a replacement for the SELinux matchpathcon()
   function, which is deprecated.

 * All: relax libcrypto version checks for OpenSSL >=3. Beyond
   OpenSSL 3.0, the ABI compatibility guarantees are wider (only
   the library major must match instead of major and minor in
   earlier versions).  bz#3548.

 * Tests: fix build problems for the sk-dummy.so FIDO provider module
   used in some tests.

Checksums:
==========

 - SHA1 (openssh-9.4.tar.gz) = d88126d8d7b8e5bf4656587ac4a16055560641cc
 - SHA256 (openssh-9.4.tar.gz) = 7eqFjx2hAunw+1Jy7f1JQXq//3AMr9B3dKtASDtq8go=

 - SHA1 (openssh-9.4p1.tar.gz) = 5dea1f3c88f9cfe53a711a3c893ee8b7d3ffecff
 - SHA256 (openssh-9.4p1.tar.gz) = Ngj9kIjbIWPOs+YAyFq3nQ3j0iHlkZLqGSPiMmOGaoU=

Please note that the SHA256 signatures are base64 encoded and not
hexadecimal (which is the default for most checksum tools). The PGP
key used to sign the releases is available from the mirror sites:
https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/RELEASE_KEY.asc

Reporting Bugs:
===============

- Please read https://www.openssh.com/report.html
  Security bugs should be reported directly to openssh@openssh.com

Revision 1.5 / (download) - annotate - [select for diffs], Thu May 28 17:05:49 2020 UTC (3 years, 10 months ago) by christos
Branch: MAIN
CVS Tags: netbsd-10-base, cjep_sun2x-base1, cjep_sun2x-base, cjep_sun2x, cjep_staticlib_x-base1, cjep_staticlib_x-base, cjep_staticlib_x
Branch point for: netbsd-10
Changes since 1.4: +2 -1 lines
Diff to previous 1.4 (colored)

Merge conflicts

Revision 1.1.1.6 / (download) - annotate - [select for diffs] (vendor branch), Thu May 28 17:02:59 2020 UTC (3 years, 10 months ago) by christos
Branch: OPENSSH
CVS Tags: v93p2-20230719, v93-20230719, v91-20221004, v90-20220408, v89-20220223, v88-20210926, v87-20210820, v86-20210419, v85_20210303, v84-20200927, v83-20200527
Changes since 1.1.1.5: +2 -1 lines
Diff to previous 1.1.1.5 (colored)

OpenSSH 8.3 was released on 2020-05-27. It is available from the
mirrors listed at https://www.openssh.com/.

OpenSSH is a 100% complete SSH protocol 2.0 implementation and
includes sftp client and server support.

Once again, we would like to thank the OpenSSH community for their
continued support of the project, especially those who contributed
code or patches, reported bugs, tested snapshots or donated to the
project. More information on donations may be found at:
https://www.openssh.com/donations.html

Future deprecation notice
=========================

It is now possible[1] to perform chosen-prefix attacks against the
SHA-1 algorithm for less than USD$50K. For this reason, we will be
disabling the "ssh-rsa" public key signature algorithm by default in a
near-future release.

This algorithm is unfortunately still used widely despite the
existence of better alternatives, being the only remaining public key
signature algorithm specified by the original SSH RFCs.

The better alternatives include:

 * The RFC8332 RSA SHA-2 signature algorithms rsa-sha2-256/512. These
   algorithms have the advantage of using the same key type as
   "ssh-rsa" but use the safe SHA-2 hash algorithms. These have been
   supported since OpenSSH 7.2 and are already used by default if the
   client and server support them.

 * The ssh-ed25519 signature algorithm. It has been supported in
   OpenSSH since release 6.5.

 * The RFC5656 ECDSA algorithms: ecdsa-sha2-nistp256/384/521. These
   have been supported by OpenSSH since release 5.7.

To check whether a server is using the weak ssh-rsa public key
algorithm, for host authentication, try to connect to it after
removing the ssh-rsa algorithm from ssh(1)'s allowed list:

    ssh -oHostKeyAlgorithms=-ssh-rsa user@host

If the host key verification fails and no other supported host key
types are available, the server software on that host should be
upgraded.

A future release of OpenSSH will enable UpdateHostKeys by default
to allow the client to automatically migrate to better algorithms.
Users may consider enabling this option manually. Vendors of devices
that implement the SSH protocol should ensure that they support the
new signature algorithms for RSA keys.

[1] "SHA-1 is a Shambles: First Chosen-Prefix Collision on SHA-1 and
    Application to the PGP Web of Trust" Leurent, G and Peyrin, T
    (2020) https://eprint.iacr.org/2020/014.pdf

Security
========

 * scp(1): when receiving files, scp(1) could be become desynchronised
   if a utimes(2) system call failed. This could allow file contents
   to be interpreted as file metadata and thereby permit an adversary
   to craft a file system that, when copied with scp(1) in a
   configuration that caused utimes(2) to fail (e.g. under a SELinux
   policy or syscall sandbox), transferred different file names and
   contents to the actual file system layout.

   Exploitation of this is not likely as utimes(2) does not fail under
   normal circumstances. Successful exploitation is not silent - the
   output of scp(1) would show transfer errors followed by the actual
   file(s) that were received.

   Finally, filenames returned from the peer are (since openssh-8.0)
   matched against the user's requested destination, thereby
   disallowing a successful exploit from writing files outside the
   user's selected target glob (or directory, in the case of a
   recursive transfer). This ensures that this attack can achieve no
   more than a hostile peer is already able to achieve within the scp
   protocol.

Potentially-incompatible changes
================================

This release includes a number of changes that may affect existing
configurations:

 * sftp(1): reject an argument of "-1" in the same way as ssh(1) and
   scp(1) do instead of accepting and silently ignoring it.

Changes since OpenSSH 8.2
=========================

The focus of this release is bug fixing.

New Features
------------

 * sshd(8): make IgnoreRhosts a tri-state option: "yes" to ignore
   rhosts/shosts, "no" allow rhosts/shosts or (new) "shosts-only"
   to allow .shosts files but not .rhosts.

 * sshd(8): allow the IgnoreRhosts directive to appear anywhere in a
   sshd_config, not just before any Match blocks; bz3148

 * ssh(1): add %TOKEN percent expansion for the LocalFoward and
   RemoteForward keywords when used for Unix domain socket forwarding.
   bz#3014

 * all: allow loading public keys from the unencrypted envelope of a
   private key file if no corresponding public key file is present.

 * ssh(1), sshd(8): prefer to use chacha20 from libcrypto where
   possible instead of the (slower) portable C implementation included
   in OpenSSH.

 * ssh-keygen(1): add ability to dump the contents of a binary key
   revocation list via "ssh-keygen -lQf /path" bz#3132

Bugfixes
--------

 * ssh(1): fix IdentitiesOnly=yes to also apply to keys loaded from
   a PKCS11Provider; bz#3141

 * ssh-keygen(1): avoid NULL dereference when trying to convert an
   invalid RFC4716 private key.

 * scp(1): when performing remote-to-remote copies using "scp -3",
   start the second ssh(1) channel with BatchMode=yes enabled to
   avoid confusing and non-deterministic ordering of prompts.

 * ssh(1), ssh-keygen(1): when signing a challenge using a FIDO token,
   perform hashing of the message to be signed in the middleware layer
   rather than in OpenSSH code. This permits the use of security key
   middlewares that perform the hashing implicitly, such as Windows
   Hello.

 * ssh(1): fix incorrect error message for "too many known hosts
   files." bz#3149

 * ssh(1): make failures when establishing "Tunnel" forwarding
   terminate the connection when ExitOnForwardFailure is enabled;
   bz#3116

 * ssh-keygen(1): fix printing of fingerprints on private keys and add
   a regression test for same.

 * sshd(8): document order of checking AuthorizedKeysFile (first) and
   AuthorizedKeysCommand (subsequently, if the file doesn't match);
   bz#3134

 * sshd(8): document that /etc/hosts.equiv and /etc/shosts.equiv are
   not considered for HostbasedAuthentication when the target user is
   root; bz#3148

 * ssh(1), ssh-keygen(1): fix NULL dereference in private certificate
   key parsing (oss-fuzz #20074).

 * ssh(1), sshd(8): more consistency between sets of %TOKENS are
   accepted in various configuration options.

 * ssh(1), ssh-keygen(1): improve error messages for some common
   PKCS#11 C_Login failure cases; bz#3130

 * ssh(1), sshd(8): make error messages for problems during SSH banner
   exchange consistent with other SSH transport-layer error messages
   and ensure they include the relevant IP addresses bz#3129

 * various: fix a number of spelling errors in comments and debug/error
   messages

 * ssh-keygen(1), ssh-add(1): when downloading FIDO2 resident keys
   from a token, don't prompt for a PIN until the token has told us
   that it needs one. Avoids double-prompting on devices that
   implement on-device authentication.

 * sshd(8), ssh-keygen(1): no-touch-required FIDO certificate option
   should be an extension, not a critical option.

 * ssh(1), ssh-keygen(1), ssh-add(1): offer a better error message
   when trying to use a FIDO key function and SecurityKeyProvider is
   empty.

 * ssh-add(1), ssh-agent(8): ensure that a key lifetime fits within
   the values allowed by the wire format (u32). Prevents integer
   wraparound of the timeout values. bz#3119

 * ssh(1): detect and prevent trivial configuration loops when using
    ProxyJump. bz#3057.

Portability
-----------

 * Detect systems where signals flagged with SA_RESTART will interrupt
   select(2). POSIX permits implementations to choose whether
   select(2) will return when interrupted with a SA_RESTART-flagged
   signal, but OpenSSH requires interrupting behaviour.

 * Several compilation fixes for HP/UX and AIX.

 * On platforms that do not support setting process-wide routing
   domains (all excepting OpenBSD at present), fail to accept a
   configuration attempts to set one at process start time rather than
   fatally erroring at run time. bz#3126

 * Improve detection of egrep (used in regression tests) on platforms
   that offer a poor default one (e.g. Solaris).

 * A number of shell portability fixes for the regression tests.

 * Fix theoretical infinite loop in the glob(3) replacement
   implementation.

 * Fix seccomp sandbox compilation problems for some Linux
   configurations bz#3085

 * Improved detection of libfido2 and some compilation fixes for some
   configurations when --with-security-key-builtin is selected.

Revision 1.2.2.2 / (download) - annotate - [select for diffs], Mon Apr 13 07:45:20 2020 UTC (4 years ago) by martin
Branch: phil-wifi
Changes since 1.2.2.1: +3 -3 lines
Diff to previous 1.2.2.1 (colored) to branchpoint 1.2 (colored) next main 1.3 (colored)

Mostly merge changes from HEAD upto 20200411

Revision 1.4 / (download) - annotate - [select for diffs], Sat Oct 12 18:32:22 2019 UTC (4 years, 6 months ago) by christos
Branch: MAIN
CVS Tags: phil-wifi-20200421, phil-wifi-20200411, phil-wifi-20200406, phil-wifi-20191119, is-mlppp-base, is-mlppp
Changes since 1.3: +3 -3 lines
Diff to previous 1.3 (colored)

merge openssh-8.1

Revision 1.1.1.5 / (download) - annotate - [select for diffs] (vendor branch), Sat Oct 12 15:13:54 2019 UTC (4 years, 6 months ago) by christos
Branch: OPENSSH
CVS Tags: v82-20200214, v81-20191009
Changes since 1.1.1.4: +2 -2 lines
Diff to previous 1.1.1.4 (colored)

OpenSSH 8.1 was released on 2019-10-09. It is available from the
mirrors listed at https://www.openssh.com/.

OpenSSH is a 100% complete SSH protocol 2.0 implementation and
includes sftp client and server support.

Once again, we would like to thank the OpenSSH community for their
continued support of the project, especially those who contributed
code or patches, reported bugs, tested snapshots or donated to the
project. More information on donations may be found at:
http://www.openssh.com/donations.html

Security
========

 * ssh(1), sshd(8), ssh-add(1), ssh-keygen(1): an exploitable integer
   overflow bug was found in the private key parsing code for the XMSS
   key type. This key type is still experimental and support for it is
   not compiled by default. No user-facing autoconf option exists in
   portable OpenSSH to enable it. This bug was found by Adam Zabrocki
   and reported via SecuriTeam's SSD program.

 * ssh(1), sshd(8), ssh-agent(1): add protection for private keys at
   rest in RAM against speculation and memory side-channel attacks like
   Spectre, Meltdown and Rambleed. This release encrypts private keys
   when they are not in use with a symmetric key that is derived from a
   relatively large "prekey" consisting of random data (currently 16KB).

Potentially-incompatible changes
================================

This release includes a number of changes that may affect existing
configurations:

 * ssh-keygen(1): when acting as a CA and signing certificates with
   an RSA key, default to using the rsa-sha2-512 signature algorithm.
   Certificates signed by RSA keys will therefore be incompatible
   with OpenSSH versions prior to 7.2 unless the default is
   overridden (using "ssh-keygen -t ssh-rsa -s ...").

Revision 1.2.2.1 / (download) - annotate - [select for diffs], Mon Jun 10 21:41:12 2019 UTC (4 years, 10 months ago) by christos
Branch: phil-wifi
Changes since 1.2: +5 -3 lines
Diff to previous 1.2 (colored)

Sync with HEAD

Revision 1.3 / (download) - annotate - [select for diffs], Sat Apr 20 17:16:40 2019 UTC (4 years, 11 months ago) by christos
Branch: MAIN
CVS Tags: phil-wifi-20190609, netbsd-9-base, netbsd-9-3-RELEASE, netbsd-9-2-RELEASE, netbsd-9-1-RELEASE, netbsd-9-0-RELEASE, netbsd-9-0-RC2, netbsd-9-0-RC1
Branch point for: netbsd-9
Changes since 1.2: +4 -2 lines
Diff to previous 1.2 (colored)

merge conflicts.

Revision 1.1.1.4 / (download) - annotate - [select for diffs] (vendor branch), Sat Apr 20 17:13:53 2019 UTC (4 years, 11 months ago) by christos
Branch: OPENSSH
CVS Tags: v80-20190417
Changes since 1.1.1.3: +4 -2 lines
Diff to previous 1.1.1.3 (colored)

Import 8.0:

Security
========

This release contains mitigation for a weakness in the scp(1) tool
and protocol (CVE-2019-6111): when copying files from a remote system
to a local directory, scp(1) did not verify that the filenames that
the server sent matched those requested by the client. This could
allow a hostile server to create or clobber unexpected local files
with attacker-controlled content.

This release adds client-side checking that the filenames sent from
the server match the command-line request,

The scp protocol is outdated, inflexible and not readily fixed. We
recommend the use of more modern protocols like sftp and rsync for
file transfer instead.

Potentially-incompatible changes
================================

This release includes a number of changes that may affect existing
configurations:

 * scp(1): Relating to the above changes to scp(1); the scp protocol
   relies on the remote shell for wildcard expansion, so there is no
   infallible way for the client's wildcard matching to perfectly
   reflect the server's. If there is a difference between client and
   server wildcard expansion, the client may refuse files from the
   server. For this reason, we have provided a new "-T" flag to scp
   that disables these client-side checks at the risk of
   reintroducing the attack described above.

 * sshd(8): Remove support for obsolete "host/port" syntax. Slash-
   separated host/port was added in 2001 as an alternative to
   host:port syntax for the benefit of IPv6 users. These days there
   are establised standards for this like [::1]:22 and the slash
   syntax is easily mistaken for CIDR notation, which OpenSSH
   supports for some things. Remove the slash notation from
   ListenAddress and PermitOpen; bz#2335

Changes since OpenSSH 7.9
=========================

This release is focused on new features and internal refactoring.

New Features
------------

 * ssh(1), ssh-agent(1), ssh-add(1): Add support for ECDSA keys in
   PKCS#11 tokens.

 * ssh(1), sshd(8): Add experimental quantum-computing resistant
   key exchange method, based on a combination of Streamlined NTRU
   Prime 4591^761 and X25519.

 * ssh-keygen(1): Increase the default RSA key size to 3072 bits,
   following NIST Special Publication 800-57's guidance for a
   128-bit equivalent symmetric security level.

 * ssh(1): Allow "PKCS11Provider=none" to override later instances of
   the PKCS11Provider directive in ssh_config; bz#2974

 * sshd(8): Add a log message for situations where a connection is
   dropped for attempting to run a command but a sshd_config
   ForceCommand=internal-sftp restriction is in effect; bz#2960

 * ssh(1): When prompting whether to record a new host key, accept
   the key fingerprint as a synonym for "yes". This allows the user
   to paste a fingerprint obtained out of band at the prompt and
   have the client do the comparison for you.

 * ssh-keygen(1): When signing multiple certificates on a single
   command-line invocation, allow automatically incrementing the
   certificate serial number.

 * scp(1), sftp(1): Accept -J option as an alias to ProxyJump on
   the scp and sftp command-lines.

 * ssh-agent(1), ssh-pkcs11-helper(8), ssh-add(1): Accept "-v"
   command-line flags to increase the verbosity of output; pass
   verbose flags though to subprocesses, such as ssh-pkcs11-helper
   started from ssh-agent.

 * ssh-add(1): Add a "-T" option to allowing testing whether keys in
   an agent are usable by performing a signature and a verification.

 * sftp-server(8): Add a "lsetstat@openssh.com" protocol extension
   that replicates the functionality of the existing SSH2_FXP_SETSTAT
   operation but does not follow symlinks. bz#2067

 * sftp(1): Add "-h" flag to chown/chgrp/chmod commands to request
   they do not follow symlinks.

 * sshd(8): Expose $SSH_CONNECTION in the PAM environment. This makes
   the connection 4-tuple available to PAM modules that wish to use
   it in decision-making. bz#2741

 * sshd(8): Add a ssh_config "Match final" predicate Matches in same
   pass as "Match canonical" but doesn't require hostname
   canonicalisation be enabled. bz#2906

 * sftp(1): Support a prefix of '@' to suppress echo of sftp batch
   commands; bz#2926

 * ssh-keygen(1): When printing certificate contents using
   "ssh-keygen -Lf /path/certificate", include the algorithm that
   the CA used to sign the cert.

Bugfixes
--------

 * sshd(8): Fix authentication failures when sshd_config contains
   "AuthenticationMethods any" inside a Match block that overrides
   a more restrictive default.

 * sshd(8): Avoid sending duplicate keepalives when ClientAliveCount
   is enabled.

 * sshd(8): Fix two race conditions related to SIGHUP daemon restart.
   Remnant file descriptors in recently-forked child processes could
   block the parent sshd's attempt to listen(2) to the configured
   addresses. Also, the restarting parent sshd could exit before any
   child processes that were awaiting their re-execution state had
   completed reading it, leaving them in a fallback path.

 * ssh(1): Fix stdout potentially being redirected to /dev/null when
   ProxyCommand=- was in use.

 * sshd(8): Avoid sending SIGPIPE to child processes if they attempt
   to write to stderr after their parent processes have exited;
   bz#2071

 * ssh(1): Fix bad interaction between the ssh_config ConnectTimeout
   and ConnectionAttempts directives - connection attempts after the
   first were ignoring the requested timeout; bz#2918

 * ssh-keyscan(1): Return a non-zero exit status if no keys were
   found; bz#2903

 * scp(1): Sanitize scp filenames to allow UTF-8 characters without
   terminal control sequences;  bz#2434

 * sshd(8): Fix confusion between ClientAliveInterval and time-based
   RekeyLimit that could cause connections to be incorrectly closed.
   bz#2757

 * ssh(1), ssh-add(1): Correct some bugs in PKCS#11 token PIN
   handling at initial token login. The attempt to read the PIN
   could be skipped in some cases, particularly on devices with
   integrated PIN readers. This would lead to an inability to
   retrieve keys from these tokens. bz#2652

 * ssh(1), ssh-add(1): Support keys on PKCS#11 tokens that set the
   CKA_ALWAYS_AUTHENTICATE flag by requring a fresh login after the
   C_SignInit operation. bz#2638

 * ssh(1): Improve documentation for ProxyJump/-J, clarifying that
   local configuration does not apply to jump hosts.

 * ssh-keygen(1): Clarify manual - ssh-keygen -e only writes
   public keys, not private.

 * ssh(1), sshd(8): be more strict in processing protocol banners,
   allowing \r characters only immediately before \n.

 * Various: fix a number of memory leaks, including bz#2942 and
   bz#2938

 * scp(1), sftp(1): fix calculation of initial bandwidth limits.
   Account for bytes written before the timer starts and adjust the
   schedule on which recalculations are performed. Avoids an initial
   burst of traffic and yields more accurate bandwidth limits;
   bz#2927

 * sshd(8): Only consider the ext-info-c extension during the initial
   key eschange. It shouldn't be sent in subsequent ones, but if it
   is present we should ignore it. This prevents sshd from sending a
   SSH_MSG_EXT_INFO for REKEX for buggy these clients. bz#2929

 * ssh-keygen(1): Clarify manual that ssh-keygen -F (find host in
   authorized_keys) and -R (remove host from authorized_keys) options
   may accept either a bare hostname or a [hostname]:port combo.
   bz#2935

 * ssh(1): Don't attempt to connect to empty SSH_AUTH_SOCK; bz#2936

 * sshd(8): Silence error messages when sshd fails to load some of
   the default host keys. Failure to load an explicitly-configured
   hostkey is still an error, and failure to load any host key is
   still fatal. pr/103

 * ssh(1): Redirect stderr of ProxyCommands to /dev/null when ssh is
   started with ControlPersist; prevents random ProxyCommand output
   from interfering with session output.

 * ssh(1): The ssh client was keeping a redundant ssh-agent socket
   (leftover from authentication) around for the life of the
   connection; bz#2912

 * sshd(8): Fix bug in HostbasedAcceptedKeyTypes and
   PubkeyAcceptedKeyTypes options. If only RSA-SHA2 siganture types
   were specified, then authentication would always fail for RSA keys
   as the monitor checks only the base key (not the signature
   algorithm) type against *AcceptedKeyTypes. bz#2746

 * ssh(1): Request correct signature types from ssh-agent when
   certificate keys and RSA-SHA2 signatures are in use.

Portability
-----------

 * sshd(8): On Cygwin, run as SYSTEM where possible, using S4U for
   token creation if it supports MsV1_0 S4U Logon.

 * sshd(8): On Cygwin, use custom user/group matching code that
   respects the OS' behaviour of case-insensitive matching.

 * sshd(8): Don't set $MAIL if UsePAM=yes as PAM typically specifies
   the user environment if it's enabled; bz#2937

 * sshd(8) Cygwin: Change service name to cygsshd to avoid collision
   with Microsoft's OpenSSH port.

 * Allow building against OpenSSL -dev (3.x)

 * Fix a number of build problems against version configurations and
   versions of OpenSSL. Including bz#2931 and bz#2921

 * Improve warnings in cygwin service setup. bz#2922

 * Remove hardcoded service name in cygwin setup. bz#2922

Revision 1.1.1.3.20.1 / (download) - annotate - [select for diffs], Sat Apr 7 04:11:48 2018 UTC (6 years ago) by pgoyette
Branch: pgoyette-compat
CVS Tags: pgoyette-compat-merge-20190127
Changes since 1.1.1.3: +1 -0 lines
Diff to previous 1.1.1.3 (colored) next main 1.1.1.4 (colored)

Sync with HEAD.  77 conflicts resolved - all of them $NetBSD$

Revision 1.2 / (download) - annotate - [select for diffs], Fri Apr 6 18:59:00 2018 UTC (6 years ago) by christos
Branch: MAIN
CVS Tags: phil-wifi-base, pgoyette-compat-20190127, pgoyette-compat-20190118, pgoyette-compat-1226, pgoyette-compat-1126, pgoyette-compat-1020, pgoyette-compat-0930, pgoyette-compat-0906, pgoyette-compat-0728, pgoyette-compat-0625, pgoyette-compat-0521, pgoyette-compat-0502, pgoyette-compat-0422, pgoyette-compat-0415, pgoyette-compat-0407
Branch point for: phil-wifi
Changes since 1.1: +20 -18 lines
Diff to previous 1.1 (colored)

merge conflicts

Revision 1.1.1.3.16.2 / (download) - annotate - [select for diffs], Tue Aug 15 05:27:52 2017 UTC (6 years, 8 months ago) by snj
Branch: netbsd-6
Changes since 1.1.1.3.16.1: +64 -0 lines
Diff to previous 1.1.1.3.16.1 (colored) to branchpoint 1.1.1.3 (colored) next main 1.1.1.4 (colored)

Apply patch (requested by mrg in ticket #1468):
Update OpenSSH to 7.5.

Revision 1.1.1.3.14.2 / (download) - annotate - [select for diffs], Tue Aug 15 05:17:58 2017 UTC (6 years, 8 months ago) by snj
Branch: netbsd-6-1
Changes since 1.1.1.3.14.1: +64 -0 lines
Diff to previous 1.1.1.3.14.1 (colored) to branchpoint 1.1.1.3 (colored) next main 1.1.1.4 (colored)

Apply patch (requested by mrg in ticket #1468):
Update OpenSSH to 7.5.

Revision 1.1.1.3.12.2 / (download) - annotate - [select for diffs], Tue Aug 15 04:53:01 2017 UTC (6 years, 8 months ago) by snj
Branch: netbsd-6-0
Changes since 1.1.1.3.12.1: +64 -0 lines
Diff to previous 1.1.1.3.12.1 (colored) to branchpoint 1.1.1.3 (colored) next main 1.1.1.4 (colored)

Apply patch (requested by mrg in ticket #1468):
Update OpenSSH to 7.5.

Revision 1.1.1.3.16.1, Fri Mar 11 01:49:59 2016 UTC (8 years, 1 month ago) by snj
Branch: netbsd-6
Changes since 1.1.1.3: +0 -64 lines
FILE REMOVED

file krl.h was added on branch netbsd-6 on 2017-08-15 05:27:52 +0000

Revision 1.1.1.3.14.1, Fri Mar 11 01:49:59 2016 UTC (8 years, 1 month ago) by snj
Branch: netbsd-6-1
Changes since 1.1.1.3: +0 -64 lines
FILE REMOVED

file krl.h was added on branch netbsd-6-1 on 2017-08-15 05:17:58 +0000

Revision 1.1.1.3.12.1, Fri Mar 11 01:49:59 2016 UTC (8 years, 1 month ago) by snj
Branch: netbsd-6-0
Changes since 1.1.1.3: +0 -64 lines
FILE REMOVED

file krl.h was added on branch netbsd-6-0 on 2017-08-15 04:53:01 +0000

Revision 1.1.1.3 / (download) - annotate - [select for diffs] (vendor branch), Fri Mar 11 01:49:59 2016 UTC (8 years, 1 month ago) by christos
Branch: OPENSSH
CVS Tags: v78-20180824, v77-20180405, v76-20171003, v75-20170418, v74-20161219, v73-20160802, v72-20160310, prg-localcount2-base3, prg-localcount2-base2, prg-localcount2-base1, prg-localcount2-base, prg-localcount2, pgoyette-localcount-base, pgoyette-localcount-20170426, pgoyette-localcount-20170320, pgoyette-localcount-20170107, pgoyette-localcount-20161104, pgoyette-localcount-20160806, pgoyette-localcount-20160726, pgoyette-localcount, pgoyette-compat-base, pgoyette-compat-0330, pgoyette-compat-0322, pgoyette-compat-0315, perseant-stdc-iso10646-base, perseant-stdc-iso10646, netbsd-8-base, netbsd-8-2-RELEASE, netbsd-8-1-RELEASE, netbsd-8-1-RC1, netbsd-8-0-RELEASE, netbsd-8-0-RC2, netbsd-8-0-RC1, netbsd-8, matt-nb8-mediatek-base, matt-nb8-mediatek, localcount-20160914, bouyer-socketcan-base1, bouyer-socketcan-base, bouyer-socketcan
Branch point for: pgoyette-compat, netbsd-6-1, netbsd-6-0, netbsd-6
Changes since 1.1.1.2: +1 -2 lines
Diff to previous 1.1.1.2 (colored)

Future deprecation notice
=========================

We plan on retiring more legacy cryptography in a near-future
release, specifically:

 * Refusing all RSA keys smaller than 1024 bits (the current minimum
   is 768 bits)

This list reflects our current intentions, but please check the final
release notes for future releases.

Potentially-incompatible changes
================================

This release disables a number of legacy cryptographic algorithms
by default in ssh:

 * Several ciphers blowfish-cbc, cast128-cbc, all arcfour variants
   and the rijndael-cbc aliases for AES.

 * MD5-based and truncated HMAC algorithms.

These algorithms are already disabled by default in sshd.

Changes since OpenSSH 7.1p2
===========================

This is primarily a bugfix release.

Security
--------

 * ssh(1), sshd(8): remove unfinished and unused roaming code (was
   already forcibly disabled in OpenSSH 7.1p2).

 * ssh(1): eliminate fallback from untrusted X11 forwarding to
   trusted forwarding when the X server disables the SECURITY
   extension.

 * ssh(1), sshd(8): increase the minimum modulus size supported for
   diffie-hellman-group-exchange to 2048 bits.

 * sshd(8): pre-auth sandboxing is now enabled by default (previous
   releases enabled it for new installations via sshd_config).

New Features
------------

 * all: add support for RSA signatures using SHA-256/512 hash
   algorithms based on draft-rsa-dsa-sha2-256-03.txt and
   draft-ssh-ext-info-04.txt.

 * ssh(1): Add an AddKeysToAgent client option which can be set to
   'yes', 'no', 'ask', or 'confirm', and defaults to 'no'.  When
   enabled, a private key that is used during authentication will be
   added to ssh-agent if it is running (with confirmation enabled if
   set to 'confirm').

 * sshd(8): add a new authorized_keys option "restrict" that includes
   all current and future key restrictions (no-*-forwarding, etc.).
   Also add permissive versions of the existing restrictions, e.g.
   "no-pty" -> "pty". This simplifies the task of setting up
   restricted keys and ensures they are maximally-restricted,
   regardless of any permissions we might implement in the future.

 * ssh(1): add ssh_config CertificateFile option to explicitly list
   certificates. bz#2436

 * ssh-keygen(1): allow ssh-keygen to change the key comment for all
   supported formats.

 * ssh-keygen(1): allow fingerprinting from standard input, e.g.
   "ssh-keygen -lf -"

 * ssh-keygen(1): allow fingerprinting multiple public keys in a
   file, e.g. "ssh-keygen -lf ~/.ssh/authorized_keys" bz#1319

 * sshd(8): support "none" as an argument for sshd_config
   Foreground and ChrootDirectory. Useful inside Match blocks to
   override a global default. bz#2486

 * ssh-keygen(1): support multiple certificates (one per line) and
   reading from standard input (using "-f -") for "ssh-keygen -L"

 * ssh-keyscan(1): add "ssh-keyscan -c ..." flag to allow fetching
   certificates instead of plain keys.

 * ssh(1): better handle anchored FQDNs (e.g. 'cvs.openbsd.org.') in
   hostname canonicalisation - treat them as already canonical and
   remove the trailing '.' before matching ssh_config.

Bugfixes
--------

 * sftp(1): existing destination directories should not terminate
   recursive uploads (regression in openssh 6.8) bz#2528

 * ssh(1), sshd(8): correctly send back SSH2_MSG_UNIMPLEMENTED
   replies to unexpected messages during key exchange. bz#2949

 * ssh(1): refuse attempts to set ConnectionAttempts=0, which does
   not make sense and would cause ssh to print an uninitialised stack
   variable. bz#2500

 * ssh(1): fix errors when attempting to connect to scoped IPv6
   addresses with hostname canonicalisation enabled.

 * sshd_config(5): list a couple more options usable in Match blocks.
   bz#2489

 * sshd(8): fix "PubkeyAcceptedKeyTypes +..." inside a Match block.

 * ssh(1): expand tilde characters in filenames passed to -i options
   before checking whether or not the identity file exists. Avoids
   confusion for cases where shell doesn't expand (e.g. "-i ~/file"
   vs. "-i~/file"). bz#2481

 * ssh(1): do not prepend "exec" to the shell command run by "Match
   exec" in a config file, which could cause some commands to fail
   in certain environments. bz#2471

 * ssh-keyscan(1): fix output for multiple hosts/addrs on one line
   when host hashing or a non standard port is in use bz#2479

 * sshd(8): skip "Could not chdir to home directory" message when
   ChrootDirectory is active. bz#2485

 * ssh(1): include PubkeyAcceptedKeyTypes in ssh -G config dump.

 * sshd(8): avoid changing TunnelForwarding device flags if they are
   already what is needed; makes it possible to use tun/tap
   networking as non-root user if device permissions and interface
   flags are pre-established

 * ssh(1), sshd(8): RekeyLimits could be exceeded by one packet.
   bz#2521

 * ssh(1): fix multiplexing master failure to notice client exit.

 * ssh(1), ssh-agent(1): avoid fatal() for PKCS11 tokens that present
   empty key IDs. bz#1773

 * sshd(8): avoid printf of NULL argument. bz#2535

 * ssh(1), sshd(8): allow RekeyLimits larger than 4GB. bz#2521

 * ssh-keygen(1): sshd(8): fix several bugs in (unused) KRL signature
   support.

 * ssh(1), sshd(8): fix connections with peers that use the key
   exchange guess feature of the protocol. bz#2515

 * sshd(8): include remote port number in log messages. bz#2503

 * ssh(1): don't try to load SSHv1 private key when compiled without
   SSHv1 support. bz#2505

 * ssh-agent(1), ssh(1): fix incorrect error messages during key
   loading and signing errors. bz#2507

 * ssh-keygen(1): don't leave empty temporary files when performing
   known_hosts file edits when known_hosts doesn't exist.

 * sshd(8): correct packet format for tcpip-forward replies for
   requests that don't allocate a port bz#2509

 * ssh(1), sshd(8): fix possible hang on closed output. bz#2469

 * ssh(1): expand %i in ControlPath to UID. bz#2449

 * ssh(1), sshd(8): fix return type of openssh_RSA_verify. bz#2460

 * ssh(1), sshd(8): fix some option parsing memory leaks. bz#2182

 * ssh(1): add a some debug output before DNS resolution; it's a
   place where ssh could previously silently stall in cases of
   unresponsive DNS servers. bz#2433

 * ssh(1): remove spurious newline in visual hostkey. bz#2686

 * ssh(1): fix printing (ssh -G ...) of HostKeyAlgorithms=+...

 * ssh(1): fix expansion of HostkeyAlgorithms=+...

Documentation
-------------

 * ssh_config(5), sshd_config(5): update default algorithm lists to
   match current reality. bz#2527

 * ssh(1): mention -Q key-plain and -Q key-cert query options.
   bz#2455

 * sshd_config(8): more clearly describe what AuthorizedKeysFile=none
   does.

 * ssh_config(5): better document ExitOnForwardFailure. bz#2444

 * sshd(5): mention internal DH-GEX fallback groups in manual.
   bz#2302

 * sshd_config(5): better description for MaxSessions option.
   bz#2531

Portability
-----------

 * ssh(1), sftp-server(8), ssh-agent(1), sshd(8): Support Illumos/
   Solaris fine-grained privileges. Including a pre-auth privsep
   sandbox and several pledge() emulations. bz#2511

 * Renovate redhat/openssh.spec, removing deprecated options and
   syntax.

 * configure: allow --without-ssl-engine with --without-openssl

 * sshd(8): fix multiple authentication using S/Key. bz#2502

 * sshd(8): read back from libcrypto RAND_* before dropping
   privileges.  Avoids sandboxing violations with BoringSSL.

 * Fix name collision with system-provided glob(3) functions.
   bz#2463

 * Adapt Makefile to use ssh-keygen -A when generating host keys.
   bz#2459

 * configure: correct default value for --with-ssh1 bz#2457

 * configure: better detection of _res symbol bz#2259

 * support getrandom() syscall on Linux

Revision 1.1.1.1.12.1 / (download) - annotate - [select for diffs], Thu Apr 30 06:07:30 2015 UTC (8 years, 11 months ago) by riz
Branch: netbsd-7
CVS Tags: netbsd-7-nhusb-base-20170116, netbsd-7-nhusb-base, netbsd-7-nhusb, netbsd-7-2-RELEASE, netbsd-7-1-RELEASE, netbsd-7-1-RC2, netbsd-7-1-RC1, netbsd-7-1-2-RELEASE, netbsd-7-1-1-RELEASE, netbsd-7-1, netbsd-7-0-RELEASE, netbsd-7-0-RC3, netbsd-7-0-RC2, netbsd-7-0-RC1, netbsd-7-0-2-RELEASE, netbsd-7-0-1-RELEASE, netbsd-7-0
Changes since 1.1.1.1: +20 -18 lines
Diff to previous 1.1.1.1 (colored) next main 1.1.1.2 (colored)

Pull up blacklistd(8), requested by christos in ticket #711:
crypto/external/bsd/openssh/dist/moduli-gen/Makefile up to 1.1.1.1
crypto/external/bsd/openssh/dist/moduli-gen/moduli up to 1.1.1.1
crypto/external/bsd/openssh/dist/moduli-gen/moduli-gen.sh up to 1.1.1.1
crypto/external/bsd/openssh/dist/moduli-gen/moduli.1024 up to 1.1.1.1
crypto/external/bsd/openssh/dist/moduli-gen/moduli.1536 up to 1.1.1.1
crypto/external/bsd/openssh/dist/moduli-gen/moduli.2048 up to 1.1.1.1
crypto/external/bsd/openssh/dist/moduli-gen/moduli.3072 up to 1.1.1.1
crypto/external/bsd/openssh/dist/moduli-gen/moduli.4096 up to 1.1.1.1
crypto/external/bsd/openssh/dist/moduli-gen/moduli.6144 up to 1.1.1.1
crypto/external/bsd/openssh/dist/moduli-gen/moduli.7680 up to 1.1.1.1
crypto/external/bsd/openssh/dist/moduli-gen/moduli.8192 up to 1.1.1.1
crypto/external/bsd/openssh/dist/bcrypt_pbkdf.c up to 1.2
crypto/external/bsd/openssh/dist/kexc25519.c    up to 1.3
crypto/external/bsd/openssh/dist/smult_curve25519_ref.c up to 1.3
crypto/external/bsd/openssh/dist/bitmap.c       up to 1.2 plus patch
crypto/external/bsd/openssh/dist/PROTOCOL.chacha20poly1305 up to 1.1.1.1
crypto/external/bsd/openssh/dist/PROTOCOL.key   up to 1.1.1.1
crypto/external/bsd/openssh/dist/blf.h          up to 1.1
crypto/external/bsd/openssh/dist/blocks.c       up to 1.3
crypto/external/bsd/openssh/dist/blowfish.c     up to 1.2
crypto/external/bsd/openssh/dist/chacha.c       up to 1.3
crypto/external/bsd/openssh/dist/chacha.h       up to 1.1.1.1
crypto/external/bsd/openssh/dist/cipher-aesctr.c up to 1.1.1.2
crypto/external/bsd/openssh/dist/cipher-aesctr.h up to 1.1.1.1
crypto/external/bsd/openssh/dist/cipher-chachapoly.c up to 1.3
crypto/external/bsd/openssh/dist/cipher-chachapoly.h up to 1.1.1.1
crypto/external/bsd/openssh/dist/crypto_api.h   up to 1.1.1.1
crypto/external/bsd/openssh/dist/digest-libc.c  up to 1.3
crypto/external/bsd/openssh/dist/digest-openssl.c up to 1.3
crypto/external/bsd/openssh/dist/digest.h       up to 1.1.1.2
crypto/external/bsd/openssh/dist/ed25519.c      up to 1.3
crypto/external/bsd/openssh/dist/fe25519.c      up to 1.3
crypto/external/bsd/openssh/dist/fe25519.h      up to 1.1.1.1
crypto/external/bsd/openssh/dist/ge25519.c      up to 1.3
crypto/external/bsd/openssh/dist/ge25519.h      up to 1.1.1.2
crypto/external/bsd/openssh/dist/ge25519_base.data up to 1.1.1.1
crypto/external/bsd/openssh/dist/hash.c         up to 1.3
crypto/external/bsd/openssh/dist/hmac.c         up to 1.3
crypto/external/bsd/openssh/dist/hmac.h         up to 1.1.1.1
crypto/external/bsd/openssh/dist/kexc25519c.c   up to 1.3
crypto/external/bsd/openssh/dist/kexc25519s.c   up to 1.3
crypto/external/bsd/openssh/dist/poly1305.c     up to 1.3
crypto/external/bsd/openssh/dist/poly1305.h     up to 1.1.1.1
crypto/external/bsd/openssh/dist/rijndael.c     up to 1.1.1.2
crypto/external/bsd/openssh/dist/rijndael.h     up to 1.1.1.1
crypto/external/bsd/openssh/dist/sc25519.c      up to 1.3
crypto/external/bsd/openssh/dist/sc25519.h      up to 1.1.1.1
crypto/external/bsd/openssh/dist/ssh-ed25519.c  up to 1.3
crypto/external/bsd/openssh/dist/sshbuf-getput-basic.c up to 1.3
crypto/external/bsd/openssh/dist/sshbuf-getput-crypto.c up to 1.3
crypto/external/bsd/openssh/dist/sshbuf-misc.c  up to 1.3
crypto/external/bsd/openssh/dist/sshbuf.c       up to 1.3
crypto/external/bsd/openssh/dist/sshbuf.h       up to 1.4
crypto/external/bsd/openssh/dist/ssherr.c       up to 1.3
crypto/external/bsd/openssh/dist/ssherr.h       up to 1.1.1.2
crypto/external/bsd/openssh/dist/sshkey.c       up to 1.3
crypto/external/bsd/openssh/dist/sshkey.h       up to 1.1.1.2
crypto/external/bsd/openssh/dist/verify.c       up to 1.3
crypto/external/bsd/openssh/dist/opacket.c      up to 1.2
crypto/external/bsd/openssh/dist/umac128.c      up to 1.1
crypto/external/bsd/openssh/dist/pfilter.c      up to 1.2
crypto/external/bsd/openssh/dist/pfilter.h      up to 1.1
crypto/external/bsd/openssh/dist/bitmap.h       up to 1.2
crypto/external/bsd/openssh/dist/opacket.h      up to 1.2
crypto/external/bsd/openssh/dist/ssh_api.c      up to 1.2
crypto/external/bsd/openssh/dist/ssh_api.h      up to 1.2
crypto/external/bsd/openssh/dist/auth2-jpake.c  delete
crypto/external/bsd/openssh/dist/compress.c     delete
crypto/external/bsd/openssh/dist/compress.h     delete
crypto/external/bsd/openssh/dist/jpake.c        delete
crypto/external/bsd/openssh/dist/jpake.h        delete
crypto/external/bsd/openssh/dist/schnorr.c      delete
crypto/external/bsd/openssh/dist/schnorr.h      delete
crypto/external/bsd/openssh/dist/strtonum.c     1.1
crypto/external/bsd/openssh/Makefile.inc        up to 1.8
crypto/external/bsd/openssh/bin/Makefile.inc    up to 1.3
crypto/external/bsd/openssh/bin/ssh-keyscan/Makefile up to 1.2
crypto/external/bsd/openssh/bin/sshd/Makefile   up to 1.12
crypto/external/bsd/openssh/dist/PROTOCOL       up to 1.5
crypto/external/bsd/openssh/dist/PROTOCOL.krl   up to 1.1.1.2
crypto/external/bsd/openssh/dist/addrmatch.c    up to 1.8
crypto/external/bsd/openssh/dist/atomicio.c     up to 1.6
crypto/external/bsd/openssh/dist/auth-bsdauth.c up to 1.4
crypto/external/bsd/openssh/dist/auth-chall.c   up to 1.6
crypto/external/bsd/openssh/dist/auth-krb5.c    up to 1.7
crypto/external/bsd/openssh/dist/auth-options.c up to 1.9
crypto/external/bsd/openssh/dist/auth-options.h up to 1.6
crypto/external/bsd/openssh/dist/auth-passwd.c  up to 1.4
crypto/external/bsd/openssh/dist/auth-rh-rsa.c  up to 1.6
crypto/external/bsd/openssh/dist/auth-rhosts.c  up to 1.5
crypto/external/bsd/openssh/dist/auth-rsa.c     up to 1.10
crypto/external/bsd/openssh/dist/auth.c         up to 1.12
crypto/external/bsd/openssh/dist/auth.h         up to 1.10
crypto/external/bsd/openssh/dist/auth1.c        up to 1.11
crypto/external/bsd/openssh/dist/auth2-chall.c  up to 1.7
crypto/external/bsd/openssh/dist/auth2-gss.c    up to 1.8
crypto/external/bsd/openssh/dist/auth2-hostbased.c up to 1.7
crypto/external/bsd/openssh/dist/auth2-kbdint.c up to 1.5
crypto/external/bsd/openssh/dist/auth2-krb5.c   up to 1.4
crypto/external/bsd/openssh/dist/auth2-none.c   up to 1.5
crypto/external/bsd/openssh/dist/auth2-passwd.c up to 1.5
crypto/external/bsd/openssh/dist/auth2-pubkey.c up to 1.11
crypto/external/bsd/openssh/dist/auth2.c        up to 1.11
crypto/external/bsd/openssh/dist/authfd.c       up to 1.8
crypto/external/bsd/openssh/dist/authfd.h       up to 1.5
crypto/external/bsd/openssh/dist/authfile.c     up to 1.10
crypto/external/bsd/openssh/dist/authfile.h     up to 1.6
crypto/external/bsd/openssh/dist/bufaux.c       up to 1.7
crypto/external/bsd/openssh/dist/bufbn.c        up to 1.5
crypto/external/bsd/openssh/dist/bufec.c        up to 1.5
crypto/external/bsd/openssh/dist/buffer.c       up to 1.6
crypto/external/bsd/openssh/dist/buffer.h       up to 1.7
crypto/external/bsd/openssh/dist/canohost.c     up to 1.8
crypto/external/bsd/openssh/dist/channels.c     up to 1.13
crypto/external/bsd/openssh/dist/channels.h     up to 1.10
crypto/external/bsd/openssh/dist/cipher-3des1.c up to 1.7
crypto/external/bsd/openssh/dist/cipher-bf1.c   up to 1.6
crypto/external/bsd/openssh/dist/cipher.c       up to 1.7
crypto/external/bsd/openssh/dist/cipher.h       up to 1.7
crypto/external/bsd/openssh/dist/clientloop.c   up to 1.13
crypto/external/bsd/openssh/dist/compat.c       up to 1.9
crypto/external/bsd/openssh/dist/compat.h       up to 1.6
crypto/external/bsd/openssh/dist/deattack.c     up to 1.4
crypto/external/bsd/openssh/dist/deattack.h     up to 1.4
crypto/external/bsd/openssh/dist/dh.c           up to 1.8
crypto/external/bsd/openssh/dist/dh.h           up to 1.4
crypto/external/bsd/openssh/dist/dispatch.c     up to 1.5
crypto/external/bsd/openssh/dist/dispatch.h     up to 1.4
crypto/external/bsd/openssh/dist/dns.c          up to 1.11
crypto/external/bsd/openssh/dist/dns.h          up to 1.6
crypto/external/bsd/openssh/dist/groupaccess.c  up to 1.5
crypto/external/bsd/openssh/dist/gss-genr.c     up to 1.7
crypto/external/bsd/openssh/dist/gss-serv-krb5.c up to 1.8
crypto/external/bsd/openssh/dist/gss-serv.c     up to 1.7
crypto/external/bsd/openssh/dist/hostfile.c     up to 1.7
crypto/external/bsd/openssh/dist/hostfile.h     up to 1.7
crypto/external/bsd/openssh/dist/includes.h     up to 1.4
crypto/external/bsd/openssh/dist/kex.c          up to 1.10
crypto/external/bsd/openssh/dist/kex.h          up to 1.9
crypto/external/bsd/openssh/dist/kexdh.c        up to 1.4
crypto/external/bsd/openssh/dist/kexdhc.c       up to 1.6
crypto/external/bsd/openssh/dist/kexdhs.c       up to 1.8
crypto/external/bsd/openssh/dist/kexecdh.c      up to 1.5
crypto/external/bsd/openssh/dist/kexecdhc.c     up to 1.5
crypto/external/bsd/openssh/dist/kexecdhs.c     up to 1.5
crypto/external/bsd/openssh/dist/kexgex.c       up to 1.4
crypto/external/bsd/openssh/dist/kexgexc.c      up to 1.6
crypto/external/bsd/openssh/dist/kexgexs.c      up to 1.8
crypto/external/bsd/openssh/dist/key.c          up to 1.16
crypto/external/bsd/openssh/dist/key.h          up to 1.9
crypto/external/bsd/openssh/dist/krl.c          up to 1.5
crypto/external/bsd/openssh/dist/krl.h          up to 1.1.1.2
crypto/external/bsd/openssh/dist/mac.c          up to 1.11
crypto/external/bsd/openssh/dist/mac.h          up to 1.5
crypto/external/bsd/openssh/dist/match.c        up to 1.5
crypto/external/bsd/openssh/dist/misc.c         up to 1.10
crypto/external/bsd/openssh/dist/misc.h         up to 1.9 plus patch
crypto/external/bsd/openssh/dist/moduli.c       up to 1.8
crypto/external/bsd/openssh/dist/monitor.c      up to 1.14
crypto/external/bsd/openssh/dist/monitor.h      up to 1.7
crypto/external/bsd/openssh/dist/monitor_fdpass.c up to 1.5
crypto/external/bsd/openssh/dist/monitor_mm.c   up to 1.6
crypto/external/bsd/openssh/dist/monitor_mm.h   up to 1.4
crypto/external/bsd/openssh/dist/monitor_wrap.c up to 1.11
crypto/external/bsd/openssh/dist/monitor_wrap.h up to 1.8
crypto/external/bsd/openssh/dist/msg.c          up to 1.4
crypto/external/bsd/openssh/dist/msg.h          up to 1.4
crypto/external/bsd/openssh/dist/mux.c          up to 1.11
crypto/external/bsd/openssh/dist/myproposal.h   up to 1.10
crypto/external/bsd/openssh/dist/namespace.h    up to 1.5
crypto/external/bsd/openssh/dist/packet.c       up to 1.18
crypto/external/bsd/openssh/dist/packet.h       up to 1.11
crypto/external/bsd/openssh/dist/pathnames.h    up to 1.9
crypto/external/bsd/openssh/dist/pkcs11.h       up to 1.4
crypto/external/bsd/openssh/dist/progressmeter.c up to 1.7
crypto/external/bsd/openssh/dist/progressmeter.h up to 1.4
crypto/external/bsd/openssh/dist/reallocarray.c new
crypto/external/bsd/openssh/dist/readconf.c     up to 1.13
crypto/external/bsd/openssh/dist/readconf.h     up to 1.12
crypto/external/bsd/openssh/dist/readpass.c     up to 1.6
crypto/external/bsd/openssh/dist/roaming_client.c up to 1.7
crypto/external/bsd/openssh/dist/roaming_common.c up to 1.9
crypto/external/bsd/openssh/dist/roaming_dummy.c up to 1.4
crypto/external/bsd/openssh/dist/rsa.c          up to 1.5
crypto/external/bsd/openssh/dist/rsa.h          up to 1.4
crypto/external/bsd/openssh/dist/sandbox-systrace.c up to 1.1.1.5
crypto/external/bsd/openssh/dist/scp.1          up to 1.9
crypto/external/bsd/openssh/dist/scp.c          up to 1.11
crypto/external/bsd/openssh/dist/servconf.c     up to 1.17
crypto/external/bsd/openssh/dist/servconf.h     up to 1.11
crypto/external/bsd/openssh/dist/serverloop.c   up to 1.12
crypto/external/bsd/openssh/dist/session.c      up to 1.14
crypto/external/bsd/openssh/dist/session.h      up to 1.4
crypto/external/bsd/openssh/dist/sftp-client.c  up to 1.13
crypto/external/bsd/openssh/dist/sftp-client.h  up to 1.7
crypto/external/bsd/openssh/dist/sftp-common.c  up to 1.7
crypto/external/bsd/openssh/dist/sftp-common.h  up to 1.5
crypto/external/bsd/openssh/dist/sftp-glob.c    up to 1.8
crypto/external/bsd/openssh/dist/sftp-server.8  up to 1.9
crypto/external/bsd/openssh/dist/sftp-server.c  up to 1.11
crypto/external/bsd/openssh/dist/sftp.1         up to 1.11
crypto/external/bsd/openssh/dist/sftp.c         up to 1.15
crypto/external/bsd/openssh/dist/ssh-add.1      up to 1.9
crypto/external/bsd/openssh/dist/ssh-add.c      up to 1.10
crypto/external/bsd/openssh/dist/ssh-agent.1    up to 1.8
crypto/external/bsd/openssh/dist/ssh-agent.c    up to 1.14
crypto/external/bsd/openssh/dist/ssh-dss.c      up to 1.7
crypto/external/bsd/openssh/dist/ssh-ecdsa.c    up to 1.6
crypto/external/bsd/openssh/dist/ssh-gss.h      up to 1.5
crypto/external/bsd/openssh/dist/ssh-keygen.1   up to 1.13
crypto/external/bsd/openssh/dist/ssh-keygen.c   up to 1.16
crypto/external/bsd/openssh/dist/ssh-keyscan.1  up to 1.10
crypto/external/bsd/openssh/dist/ssh-keyscan.c  up to 1.13
crypto/external/bsd/openssh/dist/ssh-keysign.8  up to 1.9
crypto/external/bsd/openssh/dist/ssh-keysign.c  up to 1.8
crypto/external/bsd/openssh/dist/ssh-pkcs11-client.c up to 1.6
crypto/external/bsd/openssh/dist/ssh-pkcs11-helper.c up to 1.8
crypto/external/bsd/openssh/dist/ssh-pkcs11.c   up to 1.7
crypto/external/bsd/openssh/dist/ssh-pkcs11.h   up to 1.4
crypto/external/bsd/openssh/dist/ssh-rsa.c      up to 1.7
crypto/external/bsd/openssh/dist/ssh.1          up to 1.14
crypto/external/bsd/openssh/dist/ssh.c          up to 1.16
crypto/external/bsd/openssh/dist/ssh2.h         up to 1.6
crypto/external/bsd/openssh/dist/ssh_config     up to 1.8
crypto/external/bsd/openssh/dist/ssh_config.5   up to 1.13
crypto/external/bsd/openssh/dist/sshconnect.c   up to 1.11
crypto/external/bsd/openssh/dist/sshconnect.h   up to 1.6
crypto/external/bsd/openssh/dist/sshconnect1.c  up to 1.6
crypto/external/bsd/openssh/dist/sshconnect2.c  up to 1.19
crypto/external/bsd/openssh/dist/sshd.8         up to 1.13
crypto/external/bsd/openssh/dist/sshd.c         up to 1.18
crypto/external/bsd/openssh/dist/sshd_config    up to 1.13
crypto/external/bsd/openssh/dist/sshd_config.5  up to 1.17
crypto/external/bsd/openssh/dist/sshlogin.c     up to 1.6
crypto/external/bsd/openssh/dist/sshpty.c       up to 1.4
crypto/external/bsd/openssh/dist/uidswap.c      up to 1.4
crypto/external/bsd/openssh/dist/umac.c         up to 1.9
crypto/external/bsd/openssh/dist/version.h      up to 1.14
crypto/external/bsd/openssh/dist/xmalloc.c      up to 1.5
crypto/external/bsd/openssh/lib/Makefile        up to 1.17 plus patch
crypto/external/bsd/openssh/lib/shlib_version   up to 1.13
distrib/sets/lists/base/ad.aarch64		patch
distrib/sets/lists/base/ad.arm			patch
distrib/sets/lists/base/ad.mips			patch
distrib/sets/lists/base/ad.powerpc		patch
distrib/sets/lists/base/md.amd64		patch
distrib/sets/lists/base/md.sparc64		patch
distrib/sets/lists/base/mi			patch
distrib/sets/lists/base/shl.mi			patch
distrib/sets/lists/comp/ad.aarch64		patch
distrib/sets/lists/comp/ad.arm			patch
distrib/sets/lists/comp/ad.mips			patch
distrib/sets/lists/comp/ad.powerpc		patch
distrib/sets/lists/comp/md.amd64		patch
distrib/sets/lists/comp/md.sparc64		patch
distrib/sets/lists/comp/mi			patch
distrib/sets/lists/comp/shl.mi			patch
distrib/sets/lists/debug/ad.aarch64		patch
distrib/sets/lists/debug/ad.arm			patch
distrib/sets/lists/debug/ad.mips		patch
distrib/sets/lists/debug/ad.powerpc		patch
distrib/sets/lists/debug/md.amd64		patch
distrib/sets/lists/debug/md.sparc64		patch
distrib/sets/lists/debug/shl.mi			patch
distrib/sets/lists/etc/mi			patch
distrib/sets/lists/man/mi			patch
etc/defaults/rc.conf				1.130
etc/mtree/NetBSD.dist.base			1.142
external/bsd/Makefile                           up to 1.48
external/bsd/blacklist/bin/Makefile             up to 1.11 plus patch
external/bsd/blacklist/bin/blacklistctl.8       up to 1.6
external/bsd/blacklist/bin/blacklistctl.c       up to 1.17
external/bsd/blacklist/bin/blacklistd.8         up to 1.10
external/bsd/blacklist/bin/blacklistd.c         up to 1.32
external/bsd/blacklist/bin/blacklistd.conf.5    up to 1.2
external/bsd/blacklist/bin/conf.c               up to 1.18
external/bsd/blacklist/bin/conf.h               up to 1.6
external/bsd/blacklist/bin/internal.c           up to 1.5
external/bsd/blacklist/bin/internal.h           up to 1.12
external/bsd/blacklist/bin/run.c                up to 1.12
external/bsd/blacklist/bin/run.h                up to 1.5
external/bsd/blacklist/bin/state.c              up to 1.15
external/bsd/blacklist/bin/state.h              up to 1.5
external/bsd/blacklist/bin/support.c            up to 1.6
external/bsd/blacklist/bin/support.h            up to 1.5
external/bsd/blacklist/etc/rc.d/Makefile        up to 1.1
external/bsd/blacklist/etc/rc.d/blacklistd      up to 1.1
external/bsd/blacklist/etc/Makefile             up to 1.3
external/bsd/blacklist/etc/blacklistd.conf      up to 1.3
external/bsd/blacklist/etc/npf.conf             up to 1.1
external/bsd/blacklist/Makefile                 up to 1.2
external/bsd/blacklist/Makefile.inc             up to 1.3
external/bsd/blacklist/README                   up to 1.7
external/bsd/blacklist/TODO                     up to 1.7
external/bsd/blacklist/diff/ftpd.diff           up to 1.1
external/bsd/blacklist/diff/named.diff          up to 1.6
external/bsd/blacklist/diff/ssh.diff            up to 1.6
external/bsd/blacklist/include/Makefile         up to 1.1
external/bsd/blacklist/include/bl.h             up to 1.12
external/bsd/blacklist/include/blacklist.h      up to 1.3
external/bsd/blacklist/include/config.h		new
external/bsd/blacklist/lib/Makefile             up to 1.3
external/bsd/blacklist/lib/bl.c                 up to 1.24
external/bsd/blacklist/lib/blacklist.c          up to 1.5
external/bsd/blacklist/lib/libblacklist.3       up to 1.3
external/bsd/blacklist/lib/shlib_version        up to 1.1
external/bsd/blacklist/libexec/Makefile         up to 1.1
external/bsd/blacklist/libexec/blacklistd-helper up to 1.4
external/bsd/blacklist/port/m4/.cvsignore       up to 1.1
external/bsd/blacklist/port/Makefile.am         up to 1.4
external/bsd/blacklist/port/_strtoi.h           up to 1.1
external/bsd/blacklist/port/clock_gettime.c     up to 1.2
external/bsd/blacklist/port/configure.ac        up to 1.7
external/bsd/blacklist/port/fgetln.c            up to 1.1
external/bsd/blacklist/port/fparseln.c          up to 1.1
external/bsd/blacklist/port/getprogname.c       up to 1.4
external/bsd/blacklist/port/pidfile.c           up to 1.1
external/bsd/blacklist/port/popenve.c           up to 1.2
external/bsd/blacklist/port/port.h              up to 1.6
external/bsd/blacklist/port/sockaddr_snprintf.c up to 1.9
external/bsd/blacklist/port/strlcat.c           up to 1.2
external/bsd/blacklist/port/strlcpy.c           up to 1.2
external/bsd/blacklist/port/strtoi.c            up to 1.3
external/bsd/blacklist/test/Makefile            up to 1.2
external/bsd/blacklist/test/cltest.c            up to 1.6
external/bsd/blacklist/test/srvtest.c           up to 1.9
lib/libpam/modules/pam_ssh/pam_ssh.c            up to 1.23
libexec/ftpd/pfilter.c                          up to 1.1
libexec/ftpd/pfilter.h                          up to 1.1
libexec/ftpd/Makefile                           up to 1.64
libexec/ftpd/ftpd.c                             up to 1.201

	Add blacklistd(8), a daemon to block and release network ports
	on demand to mitigate abuse, and related changes to system daemons
	to support it.
	[christos, ticket #711]

Revision 1.1.1.2 / (download) - annotate - [select for diffs] (vendor branch), Fri Apr 3 23:49:24 2015 UTC (9 years ago) by christos
Branch: OPENSSH
CVS Tags: v71-20150821, v70-20150812, v69-20150630, v68-20150318
Changes since 1.1.1.1: +20 -18 lines
Diff to previous 1.1.1.1 (colored)

Changes since OpenSSH 6.7
=========================

This is a major release, containing a number of new features as
well as a large internal re-factoring.

Potentially-incompatible changes
--------------------------------

 * sshd(8): UseDNS now defaults to 'no'. Configurations that match
   against the client host name (via sshd_config or authorized_keys)
   may need to re-enable it or convert to matching against addresses.

New Features
------------

 * Much of OpenSSH's internal code has been re-factored to be more
   library-like. These changes are mostly not user-visible, but
   have greatly improved OpenSSH's testability and internal layout.

 * Add FingerprintHash option to ssh(1) and sshd(8), and equivalent
   command-line flags to the other tools to control algorithm used
   for key fingerprints. The default changes from MD5 to SHA256 and
   format from hex to base64.

   Fingerprints now have the hash algorithm prepended. An example of
   the new format: SHA256:mVPwvezndPv/ARoIadVY98vAC0g+P/5633yTC4d/wXE
   Please note that visual host keys will also be different.

 * ssh(1), sshd(8): Experimental host key rotation support. Add a
   protocol extension for a server to inform a client of all its
   available host keys after authentication has completed. The client
   may record the keys in known_hosts, allowing it to upgrade to better
   host key algorithms and a server to gracefully rotate its keys.

   The client side of this is controlled by a UpdateHostkeys config
   option (default off).

 * ssh(1): Add a ssh_config HostbasedKeyType option to control which
   host public key types are tried during host-based authentication.

 * ssh(1), sshd(8): fix connection-killing host key mismatch errors
   when sshd offers multiple ECDSA keys of different lengths.

 * ssh(1): when host name canonicalisation is enabled, try to
   parse host names as addresses before looking them up for
   canonicalisation. fixes bz#2074 and avoiding needless DNS
   lookups in some cases.

 * ssh-keygen(1), sshd(8): Key Revocation Lists (KRLs) no longer
   require OpenSSH to be compiled with OpenSSL support.

 * ssh(1), ssh-keysign(8): Make ed25519 keys work for host based
   authentication.

 * sshd(8): SSH protocol v.1 workaround for the Meyer, et al,
   Bleichenbacher Side Channel Attack. Fake up a bignum key before
   RSA decryption.

 * sshd(8): Remember which public keys have been used for
   authentication and refuse to accept previously-used keys.
   This allows AuthenticationMethods=publickey,publickey to require
   that users authenticate using two _different_ public keys.

 * sshd(8): add sshd_config HostbasedAcceptedKeyTypes and
   PubkeyAcceptedKeyTypes options to allow sshd to control what
   public key types will be accepted. Currently defaults to all.

 * sshd(8): Don't count partial authentication success as a failure
   against MaxAuthTries.

 * ssh(1): Add RevokedHostKeys option for the client to allow
   text-file or KRL-based revocation of host keys.

 * ssh-keygen(1), sshd(8): Permit KRLs that revoke certificates by
   serial number or key ID without scoping to a particular CA.

 * ssh(1): Add a "Match canonical" criteria that allows ssh_config
   Match blocks to trigger only in the second config pass.

 * ssh(1): Add a -G option to ssh that causes it to parse its
   configuration and dump the result to stdout, similar to "sshd -T".

 * ssh(1): Allow Match criteria to be negated. E.g. "Match !host".

 * The regression test suite has been extended to cover more OpenSSH
   features. The unit tests have been expanded and now cover key
   exchange.

Bugfixes

 * ssh-keyscan(1): ssh-keyscan has been made much more robust again
   servers that hang or violate the SSH protocol.

 * ssh(1), ssh-keygen(1): Fix regression bz#2306: Key path names were
   being lost as comment fields.

 * ssh(1): Allow ssh_config Port options set in the second config
   parse phase to be applied (they were being ignored). bz#2286

 * ssh(1): Tweak config re-parsing with host canonicalisation - make
   the second pass through the config files always run when host name
   canonicalisation is enabled (and not whenever the host name
   changes) bz#2267

 * ssh(1): Fix passing of wildcard forward bind addresses when
   connection multiplexing is in use; bz#2324;

 * ssh-keygen(1): Fix broken private key conversion from non-OpenSSH
   formats; bz#2345.

 * ssh-keygen(1): Fix KRL generation bug when multiple CAs are in
   use.

 * Various fixes to manual pages: bz#2288, bz#2316, bz#2273

Portable OpenSSH

 * Support --without-openssl at configure time

   Disables and removes dependency on OpenSSL. Many features,
   including SSH protocol 1 are not supported and the set of crypto
   options is greatly restricted. This will only work on systems
   with native arc4random or /dev/urandom.

   Considered highly experimental for now.

 * Support --without-ssh1 option at configure time

   Allows disabling support for SSH protocol 1.

 * sshd(8): Fix compilation on systems with IPv6 support in utmpx; bz#2296

 * Allow custom service name for sshd on Cygwin. Permits the use of
   multiple sshd running with different service names.

Checksums:
==========

 - SHA1 (openssh-6.8.tar.gz) = 99903c6ca76e0a2c044711017f81127e12459d37
 - SHA256 (openssh-6.8.tar.gz) = N1uzVarFbrm2CzAwuDu3sRoszmqpK+5phAChP/QNyuw=

 - SHA1 (openssh-6.8p1.tar.gz) = cdbc51e46a902b30d263b05fdc71340920e91c92
 - SHA256 (openssh-6.8p1.tar.gz) = P/ZM5z7hJEgLW/dnuYMNfTwDu8tqvnFrePAZLDfOFg4=

Please note that the PGP key used to sign releases was recently rotated.
The new key has been signed by the old key to provide continuity. It is
available from the mirror sites as RELEASE_KEY.asc.

Reporting Bugs:
===============

- Please read http://www.openssh.com/report.html
  Security bugs should be reported directly to openssh@openssh.com

OpenSSH is brought to you by Markus Friedl, Niels Provos, Theo de Raadt,
Kevin Steves, Damien Miller, Darren Tucker, Jason McIntyre, Tim Rice and
Ben Lindstrom.

Revision 1.1.1.1.10.2 / (download) - annotate - [select for diffs], Thu May 22 13:21:35 2014 UTC (9 years, 10 months ago) by yamt
Branch: yamt-pagecache
Changes since 1.1.1.1.10.1: +63 -0 lines
Diff to previous 1.1.1.1.10.1 (colored) to branchpoint 1.1.1.1 (colored) next main 1.1.1.2 (colored)

sync with head.

for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.

this commit was splitted into small chunks to avoid
a limitation of cvs.  ("Protocol error: too many arguments")

Revision 1.1.1.1.4.2 / (download) - annotate - [select for diffs], Sun Jun 23 06:26:14 2013 UTC (10 years, 9 months ago) by tls
Branch: tls-maxphys
Changes since 1.1.1.1.4.1: +63 -0 lines
Diff to previous 1.1.1.1.4.1 (colored) to branchpoint 1.1.1.1 (colored) next main 1.1.1.2 (colored)

resync from head

Revision 1.1.1.1.10.1, Fri Mar 29 14:52:42 2013 UTC (11 years ago) by yamt
Branch: yamt-pagecache
Changes since 1.1.1.1: +0 -63 lines
FILE REMOVED

file krl.h was added on branch yamt-pagecache on 2014-05-22 13:21:35 +0000

Revision 1.1.1.1.4.1, Fri Mar 29 14:52:42 2013 UTC (11 years ago) by tls
Branch: tls-maxphys
Changes since 1.1.1.1: +0 -63 lines
FILE REMOVED

file krl.h was added on branch tls-maxphys on 2013-06-23 06:26:14 +0000

Revision 1.1.1.1 / (download) - annotate - [select for diffs] (vendor branch), Fri Mar 29 14:52:42 2013 UTC (11 years ago) by christos
Branch: OPENSSH
CVS Tags: yamt-pagecache-base9, v67-20141018, v64-20131107, v62-20130321, tls-maxphys-base, tls-earlyentropy-base, tls-earlyentropy, riastradh-xf86-video-intel-2-7-1-pre-2-21-15, riastradh-drm2-base3, riastradh-drm2-base2, riastradh-drm2-base1, riastradh-drm2-base, riastradh-drm2, netbsd-7-base, khorben-n900
Branch point for: yamt-pagecache, tls-maxphys, netbsd-7
Changes since 1.1: +0 -0 lines
Diff to previous 1.1 (colored)

from openbsd

Revision 1.1 / (download) - annotate - [select for diffs], Fri Mar 29 14:52:42 2013 UTC (11 years ago) by christos
Branch: MAIN

Initial revision

This form allows you to request diff's between any two revisions of a file. You may select a symbolic revision name using the selection box or you may type in a numeric name using the type-in text box.




CVSweb <webmaster@jp.NetBSD.org>