The NetBSD Project

CVS log for src/crypto/external/bsd/openssh/dist/ssh2.h

[BACK] Up to [cvs.NetBSD.org] / src / crypto / external / bsd / openssh / dist

Request diff between arbitrary revisions


Default branch: MAIN


Revision 1.12.2.1 / (download) - annotate - [select for diffs], Mon Dec 25 12:31:09 2023 UTC (3 months, 3 weeks ago) by martin
Branch: netbsd-9
Changes since 1.12: +9 -3 lines
Diff to previous 1.12 (colored) next main 1.13 (colored)

Pull up the following, requested by kim in ticket #1780:

	crypto/external/bsd/openssh/Makefile.inc        up to 1.15 (+patch)
	crypto/external/bsd/openssh/bin/Makefile.inc    up to 1.4
	crypto/external/bsd/openssh/bin/scp/Makefile    up to 1.6
	crypto/external/bsd/openssh/bin/sftp/Makefile   up to 1.11
	crypto/external/bsd/openssh/bin/sftp-server/Makefile up to 1.4
	crypto/external/bsd/openssh/bin/ssh/Makefile    up to 1.20
	crypto/external/bsd/openssh/bin/ssh-add/Makefile up to 1.3
	crypto/external/bsd/openssh/bin/ssh-agent/Makefile up to 1.7
	crypto/external/bsd/openssh/bin/ssh-keygen/Makefile up to 1.10
	crypto/external/bsd/openssh/bin/ssh-keyscan/Makefile up to 1.6
	crypto/external/bsd/openssh/bin/ssh-pkcs11-helper/Makefile up to 1.4
	crypto/external/bsd/openssh/bin/sshd/Makefile   up to 1.27 (+patch)
	crypto/external/bsd/openssh/dist/PROTOCOL.sshsig up to 1.1.1.2
	crypto/external/bsd/openssh/dist/srclimit.c     up to 1.3
	crypto/external/bsd/openssh/dist/sftp-realpath.c up to 1.3
	crypto/external/bsd/openssh/dist/sntrup761.c    up to 1.3
	crypto/external/bsd/openssh/dist/sntrup761.sh   up to 1.1.1.2
	crypto/external/bsd/openssh/dist/sshsig.c       up to 1.12
	crypto/external/bsd/openssh/dist/sshsig.h       up to 1.1.1.5
	crypto/external/bsd/openssh/dist/addr.c         up to 1.6
	crypto/external/bsd/openssh/dist/PROTOCOL.u2f   up to 1.1.1.3
	crypto/external/bsd/openssh/dist/sk-api.h       up to 1.1.1.6
	crypto/external/bsd/openssh/dist/sk-usbhid.c    up to 1.9
	crypto/external/bsd/openssh/dist/ssh-ecdsa-sk.c up to 1.4
	crypto/external/bsd/openssh/dist/ssh-ed25519-sk.c up to 1.5
	crypto/external/bsd/openssh/dist/ssh-sk-client.c up to 1.6
	crypto/external/bsd/openssh/dist/ssh-sk-helper.8 up to 1.1.1.2
	crypto/external/bsd/openssh/dist/ssh-sk-helper.c up to 1.7
	crypto/external/bsd/openssh/dist/ssh-sk.c       up to 1.8
	crypto/external/bsd/openssh/dist/ssh-sk.h       up to 1.1.1.2
	crypto/external/bsd/openssh/dist/sshbuf-io.c    up to 1.2
	crypto/external/bsd/openssh/dist/addr.h         up to 1.1.1.2
	crypto/external/bsd/openssh/dist/kexsntrup761x25519.c up to 1.3
	crypto/external/bsd/openssh/dist/cipher-chachapoly-libcrypto.c up to 1.3
	crypto/external/bsd/openssh/dist/srclimit.h     up to 1.1.1.1
	crypto/external/bsd/openssh/dist/auth2-pubkeyfile.c up to 1.3
	crypto/external/bsd/openssh/dist/sftp-usergroup.c up to 1.3
	crypto/external/bsd/openssh/dist/sftp-usergroup.h up to 1.1.1.1
	crypto/external/bsd/openssh/dist/ed25519.sh     up to 1.1.1.1
	crypto/external/bsd/openssh/dist/crc32.c        delete
	crypto/external/bsd/openssh/dist/crc32.h        delete
	crypto/external/bsd/openssh/dist/fe25519.c      delete
	crypto/external/bsd/openssh/dist/fe25519.h      delete
	crypto/external/bsd/openssh/dist/ge25519.c      delete
	crypto/external/bsd/openssh/dist/ge25519.h      delete
	crypto/external/bsd/openssh/dist/ge25519_base.data delete
	crypto/external/bsd/openssh/dist/kexsntrup4591761x25519.c delete
	crypto/external/bsd/openssh/dist/sc25519.c      delete
	crypto/external/bsd/openssh/dist/sc25519.h      delete
	crypto/external/bsd/openssh/dist/sntrup4591761.c delete
	crypto/external/bsd/openssh/dist/sntrup4591761.sh delete
	crypto/external/bsd/openssh/dist/uuencode.c     delete
	crypto/external/bsd/openssh/dist/uuencode.h     delete
	crypto/external/bsd/openssh/dist/verify.c       delete
	crypto/external/bsd/openssh/dist/LICENCE        up to 1.7
	crypto/external/bsd/openssh/dist/PROTOCOL       up to 1.23
	crypto/external/bsd/openssh/dist/PROTOCOL.agent up to 1.15
	crypto/external/bsd/openssh/dist/PROTOCOL.certkeys up to 1.13
	crypto/external/bsd/openssh/dist/PROTOCOL.chacha20poly1305 up to 1.1.1.4
	crypto/external/bsd/openssh/dist/PROTOCOL.key   up to 1.1.1.3
	crypto/external/bsd/openssh/dist/PROTOCOL.krl   up to 1.1.1.5
	crypto/external/bsd/openssh/dist/PROTOCOL.mux   up to 1.12
	crypto/external/bsd/openssh/dist/addrmatch.c    up to 1.15
	crypto/external/bsd/openssh/dist/auth-krb5.c    up to 1.16
	crypto/external/bsd/openssh/dist/auth-options.c up to 1.29
	crypto/external/bsd/openssh/dist/auth-options.h up to 1.15
	crypto/external/bsd/openssh/dist/auth-pam.c     up to 1.21
	crypto/external/bsd/openssh/dist/auth-passwd.c  up to 1.13
	crypto/external/bsd/openssh/dist/auth-rhosts.c  up to 1.16
	crypto/external/bsd/openssh/dist/auth.c         up to 1.34
	crypto/external/bsd/openssh/dist/auth.h         up to 1.23
	crypto/external/bsd/openssh/dist/auth2-chall.c  up to 1.19
	crypto/external/bsd/openssh/dist/auth2-gss.c    up to 1.17
	crypto/external/bsd/openssh/dist/auth2-hostbased.c up to 1.23
	crypto/external/bsd/openssh/dist/auth2-kbdint.c up to 1.15
	crypto/external/bsd/openssh/dist/auth2-krb5.c   up to 1.10
	crypto/external/bsd/openssh/dist/auth2-none.c   up to 1.14
	crypto/external/bsd/openssh/dist/auth2-passwd.c up to 1.16
	crypto/external/bsd/openssh/dist/auth2-pubkey.c up to 1.34
	crypto/external/bsd/openssh/dist/auth2.c        up to 1.29
	crypto/external/bsd/openssh/dist/authfd.c       up to 1.27
	crypto/external/bsd/openssh/dist/authfd.h       up to 1.17
	crypto/external/bsd/openssh/dist/authfile.c     up to 1.28
	crypto/external/bsd/openssh/dist/authfile.h     up to 1.10
	crypto/external/bsd/openssh/dist/canohost.c     up to 1.16
	crypto/external/bsd/openssh/dist/chacha.c       up to 1.6
	crypto/external/bsd/openssh/dist/chacha.h       up to 1.3
	crypto/external/bsd/openssh/dist/channels.c     up to 1.42
	crypto/external/bsd/openssh/dist/channels.h     up to 1.26
	crypto/external/bsd/openssh/dist/cipher-chachapoly.c up to 1.7
	crypto/external/bsd/openssh/dist/cipher-chachapoly.h up to 1.3
	crypto/external/bsd/openssh/dist/cipher.c       up to 1.21
	crypto/external/bsd/openssh/dist/cipher.h       up to 1.17
	crypto/external/bsd/openssh/dist/clientloop.c   up to 1.39
	crypto/external/bsd/openssh/dist/clientloop.h   up to 1.18
	crypto/external/bsd/openssh/dist/compat.c       up to 1.26
	crypto/external/bsd/openssh/dist/compat.h       up to 1.18
	crypto/external/bsd/openssh/dist/crypto_api.h   up to 1.5
	crypto/external/bsd/openssh/dist/dh.c           up to 1.20
	crypto/external/bsd/openssh/dist/dh.h           up to 1.13
	crypto/external/bsd/openssh/dist/digest-libc.c  up to 1.8
	crypto/external/bsd/openssh/dist/digest-openssl.c up to 1.9
	crypto/external/bsd/openssh/dist/dispatch.c     up to 1.11
	crypto/external/bsd/openssh/dist/dns.c          up to 1.23
	crypto/external/bsd/openssh/dist/dns.h          up to 1.13
	crypto/external/bsd/openssh/dist/ed25519.c      up to 1.6
	crypto/external/bsd/openssh/dist/fatal.c        up to 1.7
	crypto/external/bsd/openssh/dist/getrrsetbyname.c up to 1.6
	crypto/external/bsd/openssh/dist/gss-genr.c     up to 1.11
	crypto/external/bsd/openssh/dist/gss-serv.c     up to 1.15
	crypto/external/bsd/openssh/dist/hash.c         up to 1.7
	crypto/external/bsd/openssh/dist/hmac.c         up to 1.8
	crypto/external/bsd/openssh/dist/hostfile.c     up to 1.23
	crypto/external/bsd/openssh/dist/hostfile.h     up to 1.11
	crypto/external/bsd/openssh/dist/includes.h     up to 1.9
	crypto/external/bsd/openssh/dist/kex.c          up to 1.34
	crypto/external/bsd/openssh/dist/kex.h          up to 1.24
	crypto/external/bsd/openssh/dist/kexdh.c        up to 1.10
	crypto/external/bsd/openssh/dist/kexgen.c       up to 1.7
	crypto/external/bsd/openssh/dist/kexgexc.c      up to 1.17
	crypto/external/bsd/openssh/dist/kexgexs.c      up to 1.23
	crypto/external/bsd/openssh/dist/krl.c          up to 1.23
	crypto/external/bsd/openssh/dist/krl.h          up to 1.6
	crypto/external/bsd/openssh/dist/ldapauth.c     up to 1.8
	crypto/external/bsd/openssh/dist/ldapauth.h     up to 1.6
	crypto/external/bsd/openssh/dist/log.c          up to 1.27
	crypto/external/bsd/openssh/dist/log.h          up to 1.17
	crypto/external/bsd/openssh/dist/mac.c          up to 1.16
	crypto/external/bsd/openssh/dist/match.c        up to 1.16
	crypto/external/bsd/openssh/dist/match.h        up to 1.11
	crypto/external/bsd/openssh/dist/misc.c         up to 1.35
	crypto/external/bsd/openssh/dist/misc.h         up to 1.27
	crypto/external/bsd/openssh/dist/moduli         up to 1.10
	crypto/external/bsd/openssh/dist/moduli.c       up to 1.17
	crypto/external/bsd/openssh/dist/monitor.c      up to 1.43
	crypto/external/bsd/openssh/dist/monitor.h      up to 1.13
	crypto/external/bsd/openssh/dist/monitor_fdpass.c up to 1.9
	crypto/external/bsd/openssh/dist/monitor_wrap.c up to 1.34
	crypto/external/bsd/openssh/dist/monitor_wrap.h up to 1.23
	crypto/external/bsd/openssh/dist/msg.c          up to 1.11
	crypto/external/bsd/openssh/dist/mux.c          up to 1.35
	crypto/external/bsd/openssh/dist/myproposal.h   up to 1.24
	crypto/external/bsd/openssh/dist/namespace.h    up to 1.10
	crypto/external/bsd/openssh/dist/nchan.c        up to 1.14
	crypto/external/bsd/openssh/dist/packet.c       up to 1.50
	crypto/external/bsd/openssh/dist/packet.h       up to 1.26
	crypto/external/bsd/openssh/dist/pathnames.h    up to 1.15
	crypto/external/bsd/openssh/dist/pfilter.c      up to 1.8 (+patch)
	crypto/external/bsd/openssh/dist/poly1305.c     up to 1.6
	crypto/external/bsd/openssh/dist/progressmeter.c up to 1.15
	crypto/external/bsd/openssh/dist/readconf.c     up to 1.44
	crypto/external/bsd/openssh/dist/readconf.h     up to 1.34
	crypto/external/bsd/openssh/dist/readpass.c     up to 1.18
	crypto/external/bsd/openssh/dist/rijndael.h     up to 1.3
	crypto/external/bsd/openssh/dist/sandbox-pledge.c up to 1.3
	crypto/external/bsd/openssh/dist/sandbox-rlimit.c up to 1.7
	crypto/external/bsd/openssh/dist/scp.1          up to 1.31
	crypto/external/bsd/openssh/dist/scp.c          up to 1.41
	crypto/external/bsd/openssh/dist/servconf.c     up to 1.44
	crypto/external/bsd/openssh/dist/servconf.h     up to 1.30
	crypto/external/bsd/openssh/dist/serverloop.c   up to 1.35
	crypto/external/bsd/openssh/dist/session.c      up to 1.38
	crypto/external/bsd/openssh/dist/session.h      up to 1.10
	crypto/external/bsd/openssh/dist/sftp-client.c  up to 1.35
	crypto/external/bsd/openssh/dist/sftp-client.h  up to 1.18
	crypto/external/bsd/openssh/dist/sftp-common.c  up to 1.14
	crypto/external/bsd/openssh/dist/sftp-common.h  up to 1.8
	crypto/external/bsd/openssh/dist/sftp-glob.c    up to 1.15
	crypto/external/bsd/openssh/dist/sftp-server-main.c up to 1.8
	crypto/external/bsd/openssh/dist/sftp-server.8  up to 1.14
	crypto/external/bsd/openssh/dist/sftp-server.c  up to 1.30
	crypto/external/bsd/openssh/dist/sftp.1         up to 1.30
	crypto/external/bsd/openssh/dist/sftp.c         up to 1.39
	crypto/external/bsd/openssh/dist/ssh-add.1      up to 1.18
	crypto/external/bsd/openssh/dist/ssh-add.c      up to 1.30
	crypto/external/bsd/openssh/dist/ssh-agent.1    up to 1.19
	crypto/external/bsd/openssh/dist/ssh-agent.c    up to 1.37
	crypto/external/bsd/openssh/dist/ssh-dss.c      up to 1.18
	crypto/external/bsd/openssh/dist/ssh-ecdsa.c    up to 1.15
	crypto/external/bsd/openssh/dist/ssh-ed25519.c  up to 1.10
	crypto/external/bsd/openssh/dist/ssh-gss.h      up to 1.10
	crypto/external/bsd/openssh/dist/ssh-keygen.1   up to 1.34
	crypto/external/bsd/openssh/dist/ssh-keygen.c   up to 1.46
	crypto/external/bsd/openssh/dist/ssh-keyscan.1  up to 1.18
	crypto/external/bsd/openssh/dist/ssh-keyscan.c  up to 1.32
	crypto/external/bsd/openssh/dist/ssh-keysign.8  up to 1.14
	crypto/external/bsd/openssh/dist/ssh-keysign.c  up to 1.24
	crypto/external/bsd/openssh/dist/ssh-pkcs11-client.c up to 1.19
	crypto/external/bsd/openssh/dist/ssh-pkcs11-helper.8 up to 1.12
	crypto/external/bsd/openssh/dist/ssh-pkcs11-helper.c up to 1.22
	crypto/external/bsd/openssh/dist/ssh-pkcs11.c   up to 1.26
	crypto/external/bsd/openssh/dist/ssh-pkcs11.h   up to 1.9
	crypto/external/bsd/openssh/dist/ssh-rsa.c      up to 1.19
	crypto/external/bsd/openssh/dist/ssh-xmss.c     up to 1.6
	crypto/external/bsd/openssh/dist/ssh.1          up to 1.39
	crypto/external/bsd/openssh/dist/ssh.c          up to 1.45
	crypto/external/bsd/openssh/dist/ssh.h          up to 1.13
	crypto/external/bsd/openssh/dist/ssh2.h         up to 1.15
	crypto/external/bsd/openssh/dist/ssh_api.c      up to 1.15
	crypto/external/bsd/openssh/dist/ssh_config     up to 1.16
	crypto/external/bsd/openssh/dist/ssh_config.5   up to 1.40
	crypto/external/bsd/openssh/dist/sshbuf-getput-basic.c up to 1.12
	crypto/external/bsd/openssh/dist/sshbuf-getput-crypto.c up to 1.11
	crypto/external/bsd/openssh/dist/sshbuf-misc.c  up to 1.14
	crypto/external/bsd/openssh/dist/sshbuf.c       up to 1.14
	crypto/external/bsd/openssh/dist/sshbuf.h       up to 1.19
	crypto/external/bsd/openssh/dist/sshconnect.c   up to 1.37
	crypto/external/bsd/openssh/dist/sshconnect.h   up to 1.17
	crypto/external/bsd/openssh/dist/sshconnect2.c  up to 1.46
	crypto/external/bsd/openssh/dist/sshd.8         up to 1.31
	crypto/external/bsd/openssh/dist/sshd.c         up to 1.50
	crypto/external/bsd/openssh/dist/sshd_config    up to 1.28
	crypto/external/bsd/openssh/dist/sshd_config.5  up to 1.42
	crypto/external/bsd/openssh/dist/ssherr.c       up to 1.10
	crypto/external/bsd/openssh/dist/ssherr.h       up to 1.4
	crypto/external/bsd/openssh/dist/sshkey-xmss.c  up to 1.10
	crypto/external/bsd/openssh/dist/sshkey-xmss.h  up to 1.5
	crypto/external/bsd/openssh/dist/sshkey.c       up to 1.32
	crypto/external/bsd/openssh/dist/sshkey.h       up to 1.19
	crypto/external/bsd/openssh/dist/sshlogin.c     up to 1.13
	crypto/external/bsd/openssh/dist/sshpty.c       up to 1.8
	crypto/external/bsd/openssh/dist/ttymodes.c     up to 1.12
	crypto/external/bsd/openssh/dist/uidswap.c      up to 1.10
	crypto/external/bsd/openssh/dist/umac.c         up to 1.22
	crypto/external/bsd/openssh/dist/umac.h         up to 1.10
	crypto/external/bsd/openssh/dist/utf8.c         up to 1.9
	crypto/external/bsd/openssh/dist/utf8.h         up to 1.5
	crypto/external/bsd/openssh/dist/version.h      up to 1.44
	crypto/external/bsd/openssh/dist/xmalloc.c      up to 1.13
	crypto/external/bsd/openssh/dist/xmalloc.h      up to 1.16
	crypto/external/bsd/openssh/dist/xmss_hash.c    up to 1.3
	crypto/external/bsd/openssh/dist/moduli-gen/Makefile up to 1.3
	crypto/external/bsd/openssh/dist/moduli-gen/moduli-gen.sh up to 1.1.1.3
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.2048 up to 1.16
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.3072 up to 1.18
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.4096 up to 1.18
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.6144 up to 1.18
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.7680 up to 1.18
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.8192 up to 1.18
	crypto/external/bsd/openssh/lib/Makefile        up to 1.38
	crypto/external/bsd/openssh/lib/shlib_version   up to 1.36
	crypto/external/bsd/openssh/openssh2netbsd      up to 1.4
	lib/libpam/modules/pam_ssh/Makefile             up to 1.13
	lib/libpam/modules/pam_ssh/pam_ssh.c            up to 1.30
	distrib/sets/lists/base/shl.mi			(apply patch)
	distrib/sets/lists/debug/shl.mi			(apply patch)
	doc/3RDPARTY					(apply patch)

Update OpenSSH to 9.6.

Revision 1.13.6.2 / (download) - annotate - [select for diffs], Mon Dec 25 12:22:56 2023 UTC (3 months, 3 weeks ago) by martin
Branch: netbsd-10
CVS Tags: netbsd-10-0-RELEASE, netbsd-10-0-RC6, netbsd-10-0-RC5, netbsd-10-0-RC4, netbsd-10-0-RC3, netbsd-10-0-RC2
Changes since 1.13.6.1: +3 -2 lines
Diff to previous 1.13.6.1 (colored) to branchpoint 1.13 (colored) next main 1.14 (colored)

Pullup the following, requested by kim in ticket #517:

	crypto/external/bsd/openssh/bin/Makefile.inc    up to 1.4
	crypto/external/bsd/openssh/bin/sftp/Makefile   up to 1.11 (+patch)
	crypto/external/bsd/openssh/bin/ssh/Makefile    up to 1.20 (+patch)
	crypto/external/bsd/openssh/bin/ssh-agent/Makefile up to 1.7 (+patch)
	crypto/external/bsd/openssh/bin/ssh-keygen/Makefile up to 1.10 (+patch)
	crypto/external/bsd/openssh/bin/sshd/Makefile   up to 1.27 (+patch)
	crypto/external/bsd/openssh/dist/PROTOCOL       up to 1.23
	crypto/external/bsd/openssh/dist/PROTOCOL.agent up to 1.15
	crypto/external/bsd/openssh/dist/auth2.c        up to 1.29
	crypto/external/bsd/openssh/dist/authfd.c       up to 1.27
	crypto/external/bsd/openssh/dist/authfd.h       up to 1.17
	crypto/external/bsd/openssh/dist/channels.c     up to 1.42
	crypto/external/bsd/openssh/dist/channels.h     up to 1.26
	crypto/external/bsd/openssh/dist/cipher.c       up to 1.21
	crypto/external/bsd/openssh/dist/cipher.h       up to 1.17
	crypto/external/bsd/openssh/dist/clientloop.c   up to 1.39
	crypto/external/bsd/openssh/dist/kex.c          up to 1.34
	crypto/external/bsd/openssh/dist/kex.h          up to 1.24
	crypto/external/bsd/openssh/dist/log.c          up to 1.27
	crypto/external/bsd/openssh/dist/misc.c         up to 1.35
	crypto/external/bsd/openssh/dist/misc.h         up to 1.27
	crypto/external/bsd/openssh/dist/monitor_wrap.c up to 1.34
	crypto/external/bsd/openssh/dist/mux.c          up to 1.35
	crypto/external/bsd/openssh/dist/packet.c       up to 1.50
	crypto/external/bsd/openssh/dist/packet.h       up to 1.26
	crypto/external/bsd/openssh/dist/readconf.c     up to 1.44
	crypto/external/bsd/openssh/dist/readconf.h     up to 1.34
	crypto/external/bsd/openssh/dist/scp.1          up to 1.31
	crypto/external/bsd/openssh/dist/scp.c          up to 1.41
	crypto/external/bsd/openssh/dist/servconf.c     up to 1.44
	crypto/external/bsd/openssh/dist/sftp-client.c  up to 1.35
	crypto/external/bsd/openssh/dist/sftp.1         up to 1.30
	crypto/external/bsd/openssh/dist/ssh-add.1      up to 1.18
	crypto/external/bsd/openssh/dist/ssh-add.c      up to 1.30
	crypto/external/bsd/openssh/dist/ssh-agent.c    up to 1.37
	crypto/external/bsd/openssh/dist/ssh-pkcs11-client.c up to 1.19
	crypto/external/bsd/openssh/dist/ssh-pkcs11.h   up to 1.9
	crypto/external/bsd/openssh/dist/ssh.1          up to 1.39
	crypto/external/bsd/openssh/dist/ssh.c          up to 1.45
	crypto/external/bsd/openssh/dist/ssh2.h         up to 1.15
	crypto/external/bsd/openssh/dist/ssh_config.5   up to 1.40
	crypto/external/bsd/openssh/dist/sshconnect.c   up to 1.37
	crypto/external/bsd/openssh/dist/sshconnect.h   up to 1.17
	crypto/external/bsd/openssh/dist/sshconnect2.c  up to 1.46
	crypto/external/bsd/openssh/dist/sshd.c         up to 1.50
	crypto/external/bsd/openssh/dist/sshkey.c       up to 1.32
	crypto/external/bsd/openssh/dist/sshsig.c       up to 1.12
	crypto/external/bsd/openssh/dist/version.h      up to 1.44
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.2048 up to 1.16
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.3072 up to 1.18
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.4096 up to 1.18
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.6144 up to 1.18
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.7680 up to 1.18
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.8192 up to 1.18
	crypto/external/bsd/openssh/lib/Makefile        up to 1.38 (+patch)
	crypto/external/bsd/openssh/lib/shlib_version   up to 1.36
	distrib/sets/lists/base/shl.mi			(apply patch)
	distrib/sets/lists/debug/shl.mi			(apply patch)
	doc/3RDPARTY					(apply patch)

Update OpenSSH to 9.6.

Revision 1.15 / (download) - annotate - [select for diffs], Wed Dec 20 17:15:21 2023 UTC (3 months, 3 weeks ago) by christos
Branch: MAIN
CVS Tags: HEAD
Changes since 1.14: +2 -1 lines
Diff to previous 1.14 (colored)

Merge conflicts between 9.5 and 9.6

Revision 1.1.1.9 / (download) - annotate - [select for diffs] (vendor branch), Wed Dec 20 17:11:27 2023 UTC (3 months, 3 weeks ago) by christos
Branch: OPENSSH
CVS Tags: v96-20231218
Changes since 1.1.1.8: +2 -1 lines
Diff to previous 1.1.1.8 (colored)

Import OpenSSH 9.6/9.6p1 (2023-12-18)
Last was 9.5

Changes since OpenSSH 9.5
=========================

This release contains a number of security fixes, some small features
and bugfixes.

Security
========

This release contains fixes for a newly-discovered weakness in the
SSH transport protocol, a logic error relating to constrained PKCS#11
keys in ssh-agent(1) and countermeasures for programs that invoke
ssh(1) with user or hostnames containing invalid characters.

 * ssh(1), sshd(8): implement protocol extensions to thwart the
   so-called "Terrapin attack" discovered by Fabian BÁ÷mer, Marcus
   Brinkmann and Jg Schwenk. This attack allows a MITM to effect a
   limited break of the integrity of the early encrypted SSH transport
   protocol by sending extra messages prior to the commencement of
   encryption, and deleting an equal number of consecutive messages
   immediately after encryption starts. A peer SSH client/server
   would not be able to detect that messages were deleted.

   While cryptographically novel, the security impact of this attack
   is fortunately very limited as it only allows deletion of
   consecutive messages, and deleting most messages at this stage of
   the protocol prevents user user authentication from proceeding and
   results in a stuck connection.

   The most serious identified impact is that it lets a MITM to
   delete the SSH2_MSG_EXT_INFO message sent before authentication
   starts, allowing the attacker to disable a subset of the keystroke
   timing obfuscation features introduced in OpenSSH 9.5. There is no
   other discernable impact to session secrecy or session integrity.

   OpenSSH 9.6 addresses this protocol weakness through a new "strict
   KEX" protocol extension that will be automatically enabled when
   both the client and server support it. This extension makes
   two changes to the SSH transport protocol to improve the integrity
   of the initial key exchange.

   Firstly, it requires endpoints to terminate the connection if any
   unnecessary or unexpected message is received during key exchange
   (including messages that were previously legal but not strictly
   required like SSH2_MSG_DEBUG). This removes most malleability from
   the early protocol.

   Secondly, it resets the Message Authentication Code counter at the
   conclusion of each key exchange, preventing previously inserted
   messages from being able to make persistent changes to the
   sequence number across completion of a key exchange. Either of
   these changes should be sufficient to thwart the Terrapin Attack.

   More details of these changes are in the PROTOCOL file in the
   OpenSSH source distribition.

 * ssh-agent(1): when adding PKCS#11-hosted private keys while
   specifying destination constraints, if the PKCS#11 token returned
   multiple keys then only the first key had the constraints applied.
   Use of regular private keys, FIDO tokens and unconstrained keys
   are unaffected.

 * ssh(1): if an invalid user or hostname that contained shell
   metacharacters was passed to ssh(1), and a ProxyCommand,
   LocalCommand directive or "match exec" predicate referenced the
   user or hostname via %u, %h or similar expansion token, then
   an attacker who could supply arbitrary user/hostnames to ssh(1)
   could potentially perform command injection depending on what
   quoting was present in the user-supplied ssh_config(5) directive.

   This situation could arise in the case of git submodules, where
   a repository could contain a submodule with shell characters in
   its user/hostname. Git does not ban shell metacharacters in user
   or host names when checking out repositories from untrusted
   sources.

   Although we believe it is the user's responsibility to ensure
   validity of arguments passed to ssh(1), especially across a
   security boundary such as the git example above, OpenSSH 9.6 now
   bans most shell metacharacters from user and hostnames supplied
   via the command-line. This countermeasure is not guaranteed to be
   effective in all situations, as it is infeasible for ssh(1) to
   universally filter shell metacharacters potentially relevant to
   user-supplied commands.

   User/hostnames provided via ssh_config(5) are not subject to these
   restrictions, allowing configurations that use strange names to
   continue to be used, under the assumption that the user knows what
   they are doing in their own configuration files.

Potentially incompatible changes
--------------------------------

 * ssh(1), sshd(8): the RFC4254 connection/channels protocol provides
   a TCP-like window mechanism that limits the amount of data that
   can be sent without acceptance from the peer. In cases where this
   limit was exceeded by a non-conforming peer SSH implementation,
   ssh(1)/sshd(8) previously discarded the extra data. From OpenSSH
   9.6, ssh(1)/sshd(8) will now terminate the connection if a peer
   exceeds the window limit by more than a small grace factor. This
   change should have no effect of SSH implementations that follow
   the specification.

New features
------------

 * ssh(1): add a %j token that expands to the configured ProxyJump
   hostname (or the empty string if this option is not being used)
   that can be used in a number of ssh_config(5) keywords. bz3610

 * ssh(1): add ChannelTimeout support to the client, mirroring the
   same option in the server and allowing ssh(1) to terminate
   quiescent channels.

 * ssh(1), sshd(8), ssh-add(1), ssh-keygen(1): add support for
   reading ED25519 private keys in PEM PKCS8 format. Previously
   only the OpenSSH private key format was supported.

 * ssh(1), sshd(8): introduce a protocol extension to allow
   renegotiation of acceptable signature algorithms for public key
   authentication after the server has learned the username being
   used for authentication. This allows varying sshd_config(5)
   PubkeyAcceptedAlgorithms in a "Match user" block.

 * ssh-add(1), ssh-agent(1): add an agent protocol extension to allow
   specifying certificates when loading PKCS#11 keys. This allows the
   use of certificates backed by PKCS#11 private keys in all OpenSSH
   tools that support ssh-agent(1). Previously only ssh(1) supported
   this use-case.

Bugfixes
--------

 * ssh(1): when deciding whether to enable the keystroke timing
   obfuscation, enable it only if a channel with a TTY is active.

 * ssh(1): switch mainloop from poll(3) to ppoll(3) and mask signals
   before checking flags set in signal handler. Avoids potential
   race condition between signaling ssh to exit and polling. bz3531

 * ssh(1): when connecting to a destination with both the
   AddressFamily and CanonicalizeHostname directives in use,
   the AddressFamily directive could be ignored. bz5326

 * sftp(1): correct handling of the limits@openssh.com option when
   the server returned an unexpected message.

 * A number of fixes to the PuTTY and Dropbear regress/integration
   tests.

 * ssh(1): release GSS OIDs only at end of authentication, avoiding
   unnecessary init/cleanup cycles. bz2982

 * ssh_config(5): mention "none" is a valid argument to IdentityFile
   in the manual. bz3080

 * scp(1): improved debugging for paths from the server rejected for
   not matching the client's glob(3) pattern in old SCP/RCP protocol
   mode.

 * ssh-agent(1): refuse signing operations on destination-constrained
   keys if a previous session-bind operation has failed. This may
   prevent a fail-open situation in future if a user uses a mismatched
   ssh(1) client and ssh-agent(1) where the client supports a key type
   that the agent does not support.

Portability
-----------

 * Better identify unsupported and unstable compiler flags, such as
   -fzero-call-used-regs which has been unstable across a several
   clang releases.

 * A number of fixes to regression test reliability and log
   collection.

 * Update the OpenSSL dependency in the RPM specification.

 * sshd(8): for OpenSolaris systems that support privilege limitation
   via the getpflags() interface, prefer using the newer PRIV_XPOLICY
   to PRIV_LIMIT. bz2833

Revision 1.13.6.1 / (download) - annotate - [select for diffs], Thu Nov 2 22:15:22 2023 UTC (5 months, 2 weeks ago) by sborrill
Branch: netbsd-10
CVS Tags: netbsd-10-0-RC1
Changes since 1.13: +7 -2 lines
Diff to previous 1.13 (colored)

Pull up the following revisions(s) (requested by martin in ticket #443):
	crypto/external/bsd/openssh/dist sync with HEAD
	crypto/external/bsd/openssh/dist/PROTOCOL:       up to 1.22
	crypto/external/bsd/openssh/dist/PROTOCOL.agent: up to 1.14
	crypto/external/bsd/openssh/dist/PROTOCOL.krl:   up to 1.1.1.5
	crypto/external/bsd/openssh/dist/addr.c:         up to 1.6
	crypto/external/bsd/openssh/dist/auth-options.c: up to 1.29
	crypto/external/bsd/openssh/dist/auth-pam.c:     up to 1.21
	crypto/external/bsd/openssh/dist/auth2-gss.c:    up to 1.17
	crypto/external/bsd/openssh/dist/auth2-pubkey.c: up to 1.34
	crypto/external/bsd/openssh/dist/auth2.c:        up to 1.28
	crypto/external/bsd/openssh/dist/canohost.c:     up to 1.16
	crypto/external/bsd/openssh/dist/chacha.c:       up to 1.6
	crypto/external/bsd/openssh/dist/channels.c      up to 1.41
	crypto/external/bsd/openssh/dist/channels.h:     up to 1.25
	crypto/external/bsd/openssh/dist/cipher-chachapoly-libcrypto.c: up to 1.3
	crypto/external/bsd/openssh/dist/cipher-chachapoly.c: up to 1.7
	crypto/external/bsd/openssh/dist/clientloop.c:   up to 1.38
	crypto/external/bsd/openssh/dist/kex.c:          up to 1.33
	crypto/external/bsd/openssh/dist/kex.h:          up to 1.23
	crypto/external/bsd/openssh/dist/kexgexs.c:      up to 1.23
	crypto/external/bsd/openssh/dist/krl.c:          up to 1.23
	crypto/external/bsd/openssh/dist/krl.h:          up to 1.6
	crypto/external/bsd/openssh/dist/match.c:        up to 1.16
	crypto/external/bsd/openssh/dist/misc.c;         up to 1.34
	crypto/external/bsd/openssh/dist/misc.h:         up to 1.26
	crypto/external/bsd/openssh/dist/moduli:         up to 1.10
	crypto/external/bsd/openssh/dist/monitor.c:      up to 1.43
	crypto/external/bsd/openssh/dist/monitor_wrap.c: up to 1.33
	crypto/external/bsd/openssh/dist/mux.c:          up to 1.34
	crypto/external/bsd/openssh/dist/packet.c:       up to 1.49
	crypto/external/bsd/openssh/dist/packet.h:       up to 1.25
	crypto/external/bsd/openssh/dist/poly1305.c:     up to 1.6
	crypto/external/bsd/openssh/dist/progressmeter.c: up to 1.15
	crypto/external/bsd/openssh/dist/readconf.c:     up to 1.42
	crypto/external/bsd/openssh/dist/readconf.h:     up to 1.32
	crypto/external/bsd/openssh/dist/scp.c:          up to 1.40
	crypto/external/bsd/openssh/dist/servconf.c:     up to 1.43
	crypto/external/bsd/openssh/dist/servconf.h:     up to 1.30
	crypto/external/bsd/openssh/dist/serverloop.c:   up to 1.35
	crypto/external/bsd/openssh/dist/session.c:      up to 1.38
	crypto/external/bsd/openssh/dist/sftp-client.c:  up to 1.34
	crypto/external/bsd/openssh/dist/sftp-client.h:  up to 1.18
	crypto/external/bsd/openssh/dist/sftp-common.c:  up to 1.14
	crypto/external/bsd/openssh/dist/sftp-glob.c:    up to 1.15
	crypto/external/bsd/openssh/dist/sftp-server.c:  up to 1.30
	crypto/external/bsd/openssh/dist/sftp-usergroup.c: up to 1.3
	crypto/external/bsd/openssh/dist/sftp.c:         up to 1.39
	crypto/external/bsd/openssh/dist/sk-usbhid.c:    up to 1.9
	crypto/external/bsd/openssh/dist/ssh-add.c:      up to 1.29
	crypto/external/bsd/openssh/dist/ssh-agent.1:    up to 1.19
	crypto/external/bsd/openssh/dist/ssh-agent.c:    up to 1.36
	crypto/external/bsd/openssh/dist/ssh-keygen.1:   up to 1.34
	crypto/external/bsd/openssh/dist/ssh-keygen.c:   up to 1.46
	crypto/external/bsd/openssh/dist/ssh-keyscan.c:  up to 1.32
	crypto/external/bsd/openssh/dist/ssh-pkcs11-client.c: up to 1.18
	crypto/external/bsd/openssh/dist/ssh-pkcs11.c:   up to 1.26
	crypto/external/bsd/openssh/dist/ssh-sk.c:       up to 1.8
	crypto/external/bsd/openssh/dist/ssh.1:          up to 1.37
	crypto/external/bsd/openssh/dist/ssh.c:          up to 1.44
	crypto/external/bsd/openssh/dist/ssh2.h:         up to 1.14
	crypto/external/bsd/openssh/dist/ssh_config:     up to 1.16
	crypto/external/bsd/openssh/dist/ssh_config.5:   up to 1.38
	crypto/external/bsd/openssh/dist/sshconnect2.c:  up to 1.45
	crypto/external/bsd/openssh/dist/sshd.8:         up to 1.31
	crypto/external/bsd/openssh/dist/sshd_config.5:  up to 1.42
	crypto/external/bsd/openssh/dist/sshkey.c:       up to 1.31
	crypto/external/bsd/openssh/dist/sshkey.h:       up to 1.19
	crypto/external/bsd/openssh/dist/sshsig.c:       up to 1.11
	crypto/external/bsd/openssh/dist/version.h:      up to 1.43
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.2048: up to 1.15
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.3072: up to 1.17
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.4096: up to 1.17
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.6144: up to 1.17
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.7680: up to 1.17
	crypto/external/bsd/openssh/dist/moduli-gen/moduli.8192: up to 1.17
	crypto/external/bsd/openssh/lib/shlib_version:	1.35
	distrib/sets/lists/base/shl.mi:			1.972 via patch
	distrib/sets/lists/debug/shl.mi:		1.333
	doc/3RDPARTY:					1.1962 via patch

ssh(1): update to OpenSSH 9.5

Revision 1.14 / (download) - annotate - [select for diffs], Wed Oct 25 20:19:57 2023 UTC (5 months, 3 weeks ago) by christos
Branch: MAIN
Changes since 1.13: +6 -1 lines
Diff to previous 1.13 (colored)

Merge conflicts between 9.3 and 9.5

Revision 1.1.1.8 / (download) - annotate - [select for diffs] (vendor branch), Wed Oct 25 20:14:32 2023 UTC (5 months, 3 weeks ago) by christos
Branch: OPENSSH
CVS Tags: v95-20231004
Changes since 1.1.1.7: +6 -1 lines
Diff to previous 1.1.1.7 (colored)

Import OpenSSH 9.5 (Last was OpenSSH 9.3)

OpenSSH 9.5/9.5p1 (2023-10-04)
OpenSSH 9.5 was released on 2023-10-04. It is available from the
mirrors listed at https://www.openssh.com/.
OpenSSH is a 100% complete SSH protocol 2.0 implementation and
includes sftp client and server support.

Once again, we would like to thank the OpenSSH community for their
continued support of the project, especially those who contributed
code or patches, reported bugs, tested snapshots or donated to the
project. More information on donations may be found at:
https://www.openssh.com/donations.html

Changes since OpenSSH 9.4
=========================

This release fixes a number of bugs and adds some small features.

Potentially incompatible changes
--------------------------------

 * ssh-keygen(1): generate Ed25519 keys by default. Ed25519 public keys
   are very convenient due to their small size. Ed25519 keys are
   specified in RFC 8709 and OpenSSH has supported them since version 6.5
   (January 2014).

 * sshd(8): the Subsystem directive now accurately preserves quoting of
   subsystem commands and arguments. This may change behaviour for exotic
   configurations, but the most common subsystem configuration
   (sftp-server) is unlikely to be affected.

New features
------------

 * ssh(1): add keystroke timing obfuscation to the client. This attempts
   to hide inter-keystroke timings by sending interactive traffic at
   fixed intervals (default: every 20ms) when there is only a small
   amount of data being sent. It also sends fake "chaff" keystrokes for
   a random interval after the last real keystroke. These are
   controlled by a new ssh_config ObscureKeystrokeTiming keyword.

 * ssh(1), sshd(8): Introduce a transport-level ping facility. This adds
   a pair of SSH transport protocol messages SSH2_MSG_PING/PONG to
   implement a ping capability. These messages use numbers in the "local
   extensions" number space and are advertised using a "ping@openssh.com"
   ext-info message with a string version number of "0".

 * sshd(8): allow override of Subsystem directives in sshd Match blocks.

Bugfixes
--------

 * scp(1): fix scp in SFTP mode recursive upload and download of
   directories that contain symlinks to other directories. In scp mode,
   the links would be followed, but in SFTP mode they were not. bz3611

 * ssh-keygen(1): handle cr+lf (instead of just cr) line endings in
   sshsig signature files.

 * ssh(1): interactive mode for ControlPersist sessions if they
   originally requested a tty.

 * sshd(8): make PerSourceMaxStartups first-match-wins

 * sshd(8): limit artificial login delay to a reasonable maximum (5s)
   and don't delay at all for the "none" authentication mechanism.cw
    bz3602

 * sshd(8): Log errors in kex_exchange_identification() with level
   verbose instead of error to reduce preauth log spam. All of those
   get logged with a more generic error message by sshpkt_fatal().

 * sshd(8): correct math for ClientAliveInterval that caused the probes
    to be sent less frequently than configured.

 * ssh(1): fix regression in OpenSSH 9.4 (mux.c r1.99) that caused
   multiplexed sessions to ignore SIGINT under some circumstances.

Portability
-----------

 * Avoid clang zero-call-used-regs=all bug on Apple compilers, which
   for some reason have version numbers that do not match the upstream
   clang version numbers. bz#3584

 * Fix configure test for zlib 1.3 and later/development versions. bz3604

Checksums:
==========

 - SHA1 (openssh-9.5.tar.gz) = 8a0bd3a91fac338d97d91817af58df731f6509a3
 - SHA256 (openssh-9.5.tar.gz) = sVMxeM3d6g65qBMktJIofxmK4Ipg9dblKif0VnhPeO0=

 - SHA1 (openssh-9.5p1.tar.gz) = 35c16dcc6e7d0a9465faa241476ef24f76b196cc
 - SHA256 (openssh-9.5p1.tar.gz) = 8Cbnt5un+1QPdRgq+W3IqPHbOV+SK7yfbKYDZyaGCGs=

Please note that the SHA256 signatures are base64 encoded and not
hexadecimal (which is the default for most checksum tools). The PGP
key used to sign the releases is available from the mirror sites:
https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/RELEASE_KEY.asc

Reporting Bugs:
===============

- Please read https://www.openssh.com/report.html
  Security bugs should be reported directly to openssh@openssh.com
OpenSSH 9.4/9.4p1 (2023-08-10)
OpenSSH 9.4 was released on 2023-08-10. It is available from the
mirrors listed at https://www.openssh.com/.
OpenSSH is a 100% complete SSH protocol 2.0 implementation and
includes sftp client and server support.

Once again, we would like to thank the OpenSSH community for their
continued support of the project, especially those who contributed
code or patches, reported bugs, tested snapshots or donated to the
project. More information on donations may be found at:
https://www.openssh.com/donations.html

Changes since OpenSSH 9.3p2
===========================

This release fixes a number of bugs and adds some small features.

Potentially incompatible changes
--------------------------------

 * This release removes support for older versions of libcrypto.
   OpenSSH now requires LibreSSL >= 3.1.0 or OpenSSL >= 1.1.1.
   Note that these versions are already deprecated by their upstream
   vendors.

 * ssh-agent(1): PKCS#11 modules must now be specified by their full
   paths. Previously dlopen(3) could search for them in system
   library directories.

New features
------------

 * ssh(1): allow forwarding Unix Domain sockets via ssh -W.

 * ssh(1): add support for configuration tags to ssh(1).
   This adds a ssh_config(5) "Tag" directive and corresponding
   "Match tag" predicate that may be used to select blocks of
   configuration similar to the pf.conf(5) keywords of the same
   name.

 * ssh(1): add a "match localnetwork" predicate. This allows matching
   on the addresses of available network interfaces and may be used to
   vary the effective client configuration based on network location.

 * ssh(1), sshd(8), ssh-keygen(1): infrastructure support for KRL
   extensions.  This defines wire formats for optional KRL extensions
   and implements parsing of the new submessages. No actual extensions
   are supported at this point.

 * sshd(8): AuthorizedPrincipalsCommand and AuthorizedKeysCommand now
   accept two additional %-expansion sequences: %D which expands to
   the routing domain of the connected session and %C which expands
   to the addresses and port numbers for the source and destination
   of the connection.

 * ssh-keygen(1): increase the default work factor (rounds) for the
   bcrypt KDF used to derive symmetric encryption keys for passphrase
   protected key files by 50%.

Bugfixes
--------

 * ssh-agent(1): improve isolation between loaded PKCS#11 modules
   by running separate ssh-pkcs11-helpers for each loaded provider.

 * ssh(1): make -f (fork after authentication) work correctly with
   multiplexed connections, including ControlPersist. bz3589 bz3589

 * ssh(1): make ConnectTimeout apply to multiplexing sockets and not
   just to network connections.

 * ssh-agent(1), ssh(1): improve defences against invalid PKCS#11
   modules being loaded by checking that the requested module
   contains the required symbol before loading it.

 * sshd(8): fix AuthorizedPrincipalsCommand when AuthorizedKeysCommand
   appears before it in sshd_config. Since OpenSSH 8.7 the
   AuthorizedPrincipalsCommand directive was incorrectly ignored in
   this situation. bz3574

 * sshd(8), ssh(1), ssh-keygen(1): remove vestigal support for KRL
   signatures When the KRL format was originally defined, it included
   support for signing of KRL objects. However, the code to sign KRLs
   and verify KRL signatues was never completed in OpenSSH. This
   release removes the partially-implemented code to verify KRLs.
   All OpenSSH tools now ignore KRL_SECTION_SIGNATURE sections in
   KRL files.

 * All: fix a number of memory leaks and unreachable/harmless integer
   overflows.

 * ssh-agent(1), ssh(1): don't truncate strings logged from PKCS#11
   modules; GHPR406

 * sshd(8), ssh(1): better validate CASignatureAlgorithms in
   ssh_config and sshd_config. Previously this directive would accept
   certificate algorithm names, but these were unusable in practice as
   OpenSSH does not support CA chains. bz3577

 * ssh(1): make `ssh -Q CASignatureAlgorithms` only list signature
   algorithms that are valid for CA signing. Previous behaviour was
   to list all signing algorithms, including certificate algorithms.

 * ssh-keyscan(1): gracefully handle systems where rlimits or the
   maximum number of open files is larger than INT_MAX; bz3581

 * ssh-keygen(1): fix "no comment" not showing on when running
   `ssh-keygen -l` on multiple keys where one has a comment and other
   following keys do not. bz3580

 * scp(1), sftp(1): adjust ftruncate() logic to handle servers that
   reorder requests. Previously, if the server reordered requests then
   the resultant file would be erroneously truncated.

 * ssh(1): don't incorrectly disable hostname canonicalization when
   CanonicalizeHostname=yes and ProxyJump was expicitly set to
   "none". bz3567

 * scp(1): when copying local->remote, check that the source file
   exists before opening an SFTP connection to the server. Based on
   GHPR#370

Portability
-----------

 * All: a number of build fixes for various platforms and
   configuration combinations.

 * sshd(8): provide a replacement for the SELinux matchpathcon()
   function, which is deprecated.

 * All: relax libcrypto version checks for OpenSSL >=3. Beyond
   OpenSSL 3.0, the ABI compatibility guarantees are wider (only
   the library major must match instead of major and minor in
   earlier versions).  bz#3548.

 * Tests: fix build problems for the sk-dummy.so FIDO provider module
   used in some tests.

Checksums:
==========

 - SHA1 (openssh-9.4.tar.gz) = d88126d8d7b8e5bf4656587ac4a16055560641cc
 - SHA256 (openssh-9.4.tar.gz) = 7eqFjx2hAunw+1Jy7f1JQXq//3AMr9B3dKtASDtq8go=

 - SHA1 (openssh-9.4p1.tar.gz) = 5dea1f3c88f9cfe53a711a3c893ee8b7d3ffecff
 - SHA256 (openssh-9.4p1.tar.gz) = Ngj9kIjbIWPOs+YAyFq3nQ3j0iHlkZLqGSPiMmOGaoU=

Please note that the SHA256 signatures are base64 encoded and not
hexadecimal (which is the default for most checksum tools). The PGP
key used to sign the releases is available from the mirror sites:
https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/RELEASE_KEY.asc

Reporting Bugs:
===============

- Please read https://www.openssh.com/report.html
  Security bugs should be reported directly to openssh@openssh.com

Revision 1.13 / (download) - annotate - [select for diffs], Fri Mar 5 17:47:16 2021 UTC (3 years, 1 month ago) by christos
Branch: MAIN
CVS Tags: netbsd-10-base, cjep_sun2x-base1, cjep_sun2x-base, cjep_sun2x, cjep_staticlib_x-base1, cjep_staticlib_x-base, cjep_staticlib_x
Branch point for: netbsd-10
Changes since 1.12: +2 -2 lines
Diff to previous 1.12 (colored)

merge local changes between openssh 8.4 and 8.5

Revision 1.1.1.7 / (download) - annotate - [select for diffs] (vendor branch), Fri Mar 5 17:45:26 2021 UTC (3 years, 1 month ago) by christos
Branch: OPENSSH
CVS Tags: v93p2-20230719, v93-20230719, v91-20221004, v90-20220408, v89-20220223, v88-20210926, v87-20210820, v86-20210419, v85_20210303
Changes since 1.1.1.6: +2 -2 lines
Diff to previous 1.1.1.6 (colored)

OpenSSH 8.5/8.5p1 (2021-03-03)

OpenSSH 8.5 was released on 2021-03-03. It is available from the
mirrors listed at https://www.openssh.com/.
OpenSSH is a 100% complete SSH protocol 2.0 implementation and
includes sftp client and server support.

Once again, we would like to thank the OpenSSH community for their
continued support of the project, especially those who contributed
code or patches, reported bugs, tested snapshots or donated to the
project. More information on donations may be found at:
https://www.openssh.com/donations.html

Future deprecation notice
=========================

It is now possible[1] to perform chosen-prefix attacks against the
SHA-1 algorithm for less than USD$50K.

In the SSH protocol, the "ssh-rsa" signature scheme uses the SHA-1
hash algorithm in conjunction with the RSA public key algorithm.
OpenSSH will disable this signature scheme by default in the near
future.

Note that the deactivation of "ssh-rsa" signatures does not necessarily
require cessation of use for RSA keys. In the SSH protocol, keys may be
capable of signing using multiple algorithms. In particular, "ssh-rsa"
keys are capable of signing using "rsa-sha2-256" (RSA/SHA256),
"rsa-sha2-512" (RSA/SHA512) and "ssh-rsa" (RSA/SHA1). Only the last of
these is being turned off by default.

This algorithm is unfortunately still used widely despite the
existence of better alternatives, being the only remaining public key
signature algorithm specified by the original SSH RFCs that is still
enabled by default.

The better alternatives include:

 * The RFC8332 RSA SHA-2 signature algorithms rsa-sha2-256/512. These
   algorithms have the advantage of using the same key type as
   "ssh-rsa" but use the safe SHA-2 hash algorithms. These have been
   supported since OpenSSH 7.2 and are already used by default if the
   client and server support them.

 * The RFC8709 ssh-ed25519 signature algorithm. It has been supported
   in OpenSSH since release 6.5.

 * The RFC5656 ECDSA algorithms: ecdsa-sha2-nistp256/384/521. These
   have been supported by OpenSSH since release 5.7.

To check whether a server is using the weak ssh-rsa public key
algorithm, for host authentication, try to connect to it after
removing the ssh-rsa algorithm from ssh(1)'s allowed list:

    ssh -oHostKeyAlgorithms=-ssh-rsa user@host

If the host key verification fails and no other supported host key
types are available, the server software on that host should be
upgraded.

This release enables the UpdateHostKeys option by default to assist
the client by automatically migrating to better algorithms.

[1] "SHA-1 is a Shambles: First Chosen-Prefix Collision on SHA-1 and
    Application to the PGP Web of Trust" Leurent, G and Peyrin, T
    (2020) https://eprint.iacr.org/2020/014.pdf

Security
========

 * ssh-agent(1): fixed a double-free memory corruption that was
   introduced in OpenSSH 8.2 . We treat all such memory faults as
   potentially exploitable. This bug could be reached by an attacker
   with access to the agent socket.

   On modern operating systems where the OS can provide information
   about the user identity connected to a socket, OpenSSH ssh-agent
   and sshd limit agent socket access only to the originating user
   and root. Additional mitigation may be afforded by the system's
   malloc(3)/free(3) implementation, if it detects double-free
   conditions.

   The most likely scenario for exploitation is a user forwarding an
   agent either to an account shared with a malicious user or to a
   host with an attacker holding root access.

 * Portable sshd(8): Prevent excessively long username going to PAM.
   This is a mitigation for a buffer overflow in Solaris' PAM username
   handling (CVE-2020-14871), and is only enabled for Sun-derived PAM
   implementations.  This is not a problem in sshd itself, it only
   prevents sshd from being used as a vector to attack Solaris' PAM.
   It does not prevent the bug in PAM from being exploited via some
   other PAM application. GHPR212


Potentially-incompatible changes
================================

This release includes a number of changes that may affect existing
configurations:

 * ssh(1), sshd(8): this release changes the first-preference signature
   algorithm from ECDSA to ED25519.

 * ssh(1), sshd(8): set the TOS/DSCP specified in the configuration
   for interactive use prior to TCP connect. The connection phase of
   the SSH session is time-sensitive and often explicitly interactive.
   The ultimate interactive/bulk TOS/DSCP will be set after
   authentication completes.

 * ssh(1), sshd(8): remove the pre-standardization cipher
   rijndael-cbc@lysator.liu.se. It is an alias for aes256-cbc before
   it was standardized in RFC4253 (2006), has been deprecated and
   disabled by default since OpenSSH 7.2 (2016) and was only briefly
   documented in ssh.1 in 2001.

 * ssh(1), sshd(8): update/replace the experimental post-quantum
   hybrid key exchange method based on Streamlined NTRU Prime coupled
   with X25519.

   The previous sntrup4591761x25519-sha512@tinyssh.org method is
   replaced with sntrup761x25519-sha512@openssh.com. Per its
   designers, the sntrup4591761 algorithm was superseded almost two
   years ago by sntrup761.

   (note this both the updated method and the one that it replaced are
   disabled by default)

 * ssh(1): disable CheckHostIP by default. It provides insignificant
   benefits while making key rotation significantly more difficult,
   especially for hosts behind IP-based load-balancers.

Changes since OpenSSH 8.4
=========================

New features
------------

 * ssh(1): this release enables UpdateHostkeys by default subject to
   some conservative preconditions:
    - The key was matched in the UserKnownHostsFile (and not in the
      GlobalKnownHostsFile).
    - The same key does not exist under another name.
    - A certificate host key is not in use.
    - known_hosts contains no matching wildcard hostname pattern.
    - VerifyHostKeyDNS is not enabled.
    - The default UserKnownHostsFile is in use.

   We expect some of these conditions will be modified or relaxed in
   future.

 * ssh(1), sshd(8): add a new LogVerbose configuration directive for
   that allows forcing maximum debug logging by file/function/line
   pattern-lists.

 * ssh(1): when prompting the user to accept a new hostkey, display
   any other host names/addresses already associated with the key.

 * ssh(1): allow UserKnownHostsFile=none to indicate that no
   known_hosts file should be used to identify host keys.

 * ssh(1): add a ssh_config KnownHostsCommand option that allows the
   client to obtain known_hosts data from a command in addition to
   the usual files.

 * ssh(1): add a ssh_config PermitRemoteOpen option that allows the
   client to restrict the destination when RemoteForward is used
   with SOCKS.

 * ssh(1): for FIDO keys, if a signature operation fails with a
   "incorrect PIN" reason and no PIN was initially requested from the
   user, then request a PIN and retry the operation. This supports
   some biometric devices that fall back to requiring PIN when reading
   of the biometric failed, and devices that require PINs for all
   hosted credentials.

 * sshd(8): implement client address-based rate-limiting via new
   sshd_config(5) PerSourceMaxStartups and PerSourceNetBlockSize
   directives that provide more fine-grained control on a per-origin
   address basis than the global MaxStartups limit.

Bugfixes
--------

 * ssh(1): Prefix keyboard interactive prompts with "(user@host)" to
   make it easier to determine which connection they are associated
   with in cases like scp -3, ProxyJump, etc. bz#3224

 * sshd(8): fix sshd_config SetEnv directives located inside Match
   blocks. GHPR201

 * ssh(1): when requesting a FIDO token touch on stderr, inform the
   user once the touch has been recorded.

 * ssh(1): prevent integer overflow when ridiculously large
   ConnectTimeout values are specified, capping the effective value
   (for most platforms) at 24 days. bz#3229

 * ssh(1): consider the ECDSA key subtype when ordering host key
   algorithms in the client.

 * ssh(1), sshd(8): rename the PubkeyAcceptedKeyTypes keyword to
   PubkeyAcceptedAlgorithms. The previous name incorrectly suggested
   that it control allowed key algorithms, when this option actually
   specifies the signature algorithms that are accepted. The previous
   name remains available as an alias. bz#3253

 * ssh(1), sshd(8): similarly, rename HostbasedKeyTypes (ssh) and
   HostbasedAcceptedKeyTypes (sshd) to HostbasedAcceptedAlgorithms.

 * sftp-server(8): add missing lsetstat@openssh.com documentation
   and advertisement in the server's SSH2_FXP_VERSION hello packet.

 * ssh(1), sshd(8): more strictly enforce KEX state-machine by
   banning packet types once they are received. Fixes memleak caused
   by duplicate SSH2_MSG_KEX_DH_GEX_REQUEST (oss-fuzz #30078).

 * sftp(1): allow the full range of UIDs/GIDs for chown/chgrp on 32bit
   platforms instead of being limited by LONG_MAX. bz#3206

 * Minor man page fixes (capitalization, commas, etc.) bz#3223

 * sftp(1): when doing an sftp recursive upload or download of a
   read-only directory, ensure that the directory is created with
   write and execute permissions in the interim so that the transfer
   can actually complete, then set the directory permission as the
   final step. bz#3222

 * ssh-keygen(1): document the -Z, check the validity of its argument
   earlier and provide a better error message if it's not correct.
   bz#2879

 * ssh(1): ignore comments at the end of config lines in ssh_config,
   similar to what we already do for sshd_config. bz#2320

 * sshd_config(5): mention that DisableForwarding is valid in a
   sshd_config Match block. bz3239

 * sftp(1): fix incorrect sorting of "ls -ltr" under some
   circumstances. bz3248.

 * ssh(1), sshd(8): fix potential integer truncation of (unlikely)
   timeout values. bz#3250

 * ssh(1): make hostbased authentication send the signature algorithm
   in its SSH2_MSG_USERAUTH_REQUEST packets instead of the key type.
   This make HostbasedAcceptedAlgorithms do what it is supposed to -
   filter on signature algorithm and not key type.

Portability
-----------

 * sshd(8): add a number of platform-specific syscalls to the Linux
   seccomp-bpf sandbox. bz#3232 bz#3260

 * sshd(8): remove debug message from sigchld handler that could cause
   deadlock on some platforms. bz#3259

 * Sync contrib/ssh-copy-id with upstream.

 * unittests: add a hostname function for systems that don't have it.
   Some systems don't have a hostname command (it's not required by
   POSIX). The do have uname -n (which is), but not all of those have
   it report the FQDN.

Checksums:
==========

 - SHA1 (openssh-8.5.tar.gz) = 04cae43c389fb411227c01219e4eb46e3113f34e
 - SHA256 (openssh-8.5.tar.gz) = 5qB2CgzNG4io4DmChTjHgCWqRWvEOvCKJskLdJCz+SU=

 - SHA1 (openssh-8.5p1.tar.gz) = 72eadcbe313b07b1dd3b693e41d3cd56d354e24e
 - SHA256 (openssh-8.5p1.tar.gz) = 9S8/QdQpqpkY44zyAK8iXM3Y5m8FLaVyhwyJc3ZG7CU=

Please note that the SHA256 signatures are base64 encoded and not
hexadecimal (which is the default for most checksum tools). The PGP
key used to sign the releases is available from the mirror sites:
https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/RELEASE_KEY.asc

Please note that the OpenPGP key used to sign releases has been
rotated for this release. The new key has been signed by the previous
key to provide continuity.

Reporting Bugs:
===============

- Please read https://www.openssh.com/report.html
  Security bugs should be reported directly to openssh@openssh.com

Revision 1.11.12.1 / (download) - annotate - [select for diffs], Mon Jun 10 21:41:12 2019 UTC (4 years, 10 months ago) by christos
Branch: phil-wifi
Changes since 1.11: +1 -1 lines
Diff to previous 1.11 (colored) next main 1.12 (colored)

Sync with HEAD

Revision 1.12 / (download) - annotate - [select for diffs], Sat Apr 20 17:16:40 2019 UTC (4 years, 11 months ago) by christos
Branch: MAIN
CVS Tags: phil-wifi-20200421, phil-wifi-20200411, phil-wifi-20200406, phil-wifi-20191119, phil-wifi-20190609, netbsd-9-base, netbsd-9-3-RELEASE, netbsd-9-2-RELEASE, netbsd-9-1-RELEASE, netbsd-9-0-RELEASE, netbsd-9-0-RC2, netbsd-9-0-RC1, is-mlppp-base, is-mlppp
Branch point for: netbsd-9
Changes since 1.11: +0 -0 lines
Diff to previous 1.11 (colored)

merge conflicts.

Revision 1.4.4.1 / (download) - annotate - [select for diffs], Tue Aug 15 05:27:53 2017 UTC (6 years, 8 months ago) by snj
Branch: netbsd-6
Changes since 1.4: +7 -15 lines
Diff to previous 1.4 (colored) next main 1.5 (colored)

Apply patch (requested by mrg in ticket #1468):
Update OpenSSH to 7.5.

Revision 1.4.18.1 / (download) - annotate - [select for diffs], Tue Aug 15 04:40:17 2017 UTC (6 years, 8 months ago) by snj
Branch: netbsd-6-1
Changes since 1.4: +7 -15 lines
Diff to previous 1.4 (colored) next main 1.5 (colored)

Apply patch (requested by mrg in ticket #1468):
Update OpenSSH to 7.5.

Revision 1.4.10.1 / (download) - annotate - [select for diffs], Tue Aug 15 04:39:21 2017 UTC (6 years, 8 months ago) by snj
Branch: netbsd-6-0
Changes since 1.4: +7 -15 lines
Diff to previous 1.4 (colored) next main 1.5 (colored)

Apply patch (requested by mrg in ticket #1468):
Update OpenSSH to 7.5.

Revision 1.8.2.3 / (download) - annotate - [select for diffs], Wed Apr 26 02:52:15 2017 UTC (6 years, 11 months ago) by pgoyette
Branch: pgoyette-localcount
Changes since 1.8.2.2: +1 -1 lines
Diff to previous 1.8.2.2 (colored) to branchpoint 1.8 (colored) next main 1.9 (colored)

Sync with HEAD

Revision 1.10.2.1 / (download) - annotate - [select for diffs], Fri Apr 21 16:50:57 2017 UTC (6 years, 11 months ago) by bouyer
Branch: bouyer-socketcan
Changes since 1.10: +1 -1 lines
Diff to previous 1.10 (colored) next main 1.11 (colored)

Sync with HEAD

Revision 1.11 / (download) - annotate - [select for diffs], Tue Apr 18 18:41:46 2017 UTC (7 years ago) by christos
Branch: MAIN
CVS Tags: prg-localcount2-base3, prg-localcount2-base2, prg-localcount2-base1, prg-localcount2-base, prg-localcount2, phil-wifi-base, pgoyette-localcount-20170426, pgoyette-compat-merge-20190127, pgoyette-compat-base, pgoyette-compat-20190127, pgoyette-compat-20190118, pgoyette-compat-1226, pgoyette-compat-1126, pgoyette-compat-1020, pgoyette-compat-0930, pgoyette-compat-0906, pgoyette-compat-0728, pgoyette-compat-0625, pgoyette-compat-0521, pgoyette-compat-0502, pgoyette-compat-0422, pgoyette-compat-0415, pgoyette-compat-0407, pgoyette-compat-0330, pgoyette-compat-0322, pgoyette-compat-0315, pgoyette-compat, perseant-stdc-iso10646-base, perseant-stdc-iso10646, netbsd-8-base, netbsd-8-2-RELEASE, netbsd-8-1-RELEASE, netbsd-8-1-RC1, netbsd-8-0-RELEASE, netbsd-8-0-RC2, netbsd-8-0-RC1, netbsd-8, matt-nb8-mediatek-base, matt-nb8-mediatek, bouyer-socketcan-base1
Branch point for: phil-wifi
Changes since 1.10: +0 -0 lines
Diff to previous 1.10 (colored)

merge conflicts

Revision 1.8.2.2 / (download) - annotate - [select for diffs], Sat Jan 7 08:53:42 2017 UTC (7 years, 3 months ago) by pgoyette
Branch: pgoyette-localcount
Changes since 1.8.2.1: +1 -1 lines
Diff to previous 1.8.2.1 (colored) to branchpoint 1.8 (colored)

Sync with HEAD.  (Note that most of these changes are simply $NetBSD$
tag issues.)

Revision 1.10 / (download) - annotate - [select for diffs], Sun Dec 25 00:07:47 2016 UTC (7 years, 3 months ago) by christos
Branch: MAIN
CVS Tags: pgoyette-localcount-20170320, pgoyette-localcount-20170107, bouyer-socketcan-base
Branch point for: bouyer-socketcan
Changes since 1.9: +0 -0 lines
Diff to previous 1.9 (colored)

merge conflicts

Revision 1.8.2.1 / (download) - annotate - [select for diffs], Sat Aug 6 00:18:39 2016 UTC (7 years, 8 months ago) by pgoyette
Branch: pgoyette-localcount
Changes since 1.8: +6 -2 lines
Diff to previous 1.8 (colored)

Sync with HEAD

Revision 1.9 / (download) - annotate - [select for diffs], Tue Aug 2 13:45:12 2016 UTC (7 years, 8 months ago) by christos
Branch: MAIN
CVS Tags: pgoyette-localcount-20161104, pgoyette-localcount-20160806, localcount-20160914
Changes since 1.8: +5 -1 lines
Diff to previous 1.8 (colored)

merge conflicts.

Revision 1.1.1.6 / (download) - annotate - [select for diffs] (vendor branch), Tue Aug 2 13:30:02 2016 UTC (7 years, 8 months ago) by christos
Branch: OPENSSH
CVS Tags: v84-20200927, v83-20200527, v82-20200214, v81-20191009, v80-20190417, v78-20180824, v77-20180405, v76-20171003, v75-20170418, v74-20161219, v73-20160802
Changes since 1.1.1.5: +5 -1 lines
Diff to previous 1.1.1.5 (colored)

OpenSSH 7.3 has just been released. It will be available from the
mirrors listed at http://www.openssh.com/ shortly.

OpenSSH is a 100% complete SSH protocol 2.0 implementation and
includes sftp client and server support. OpenSSH also includes
transitional support for the legacy SSH 1.3 and 1.5 protocols
that may be enabled at compile-time.

Once again, we would like to thank the OpenSSH community for their
continued support of the project, especially those who contributed
code or patches, reported bugs, tested snapshots or donated to the
project. More information on donations may be found at:
http://www.openssh.com/donations.html

Future deprecation notice
=========================

We plan on retiring more legacy cryptography in a near-future
release, specifically:

 * Refusing all RSA keys smaller than 1024 bits (the current minimum
   is 768 bits)
 * Removing server-side support for the SSH v.1 protocol (currently
   compile-time disabled).
 * In approximately 1 year, removing all support for the SSH v.1
   protocol (currently compile-time disabled).

This list reflects our current intentions, but please check the final
release notes for future releases.

Changes since OpenSSH 7.2
=========================

This is primarily a bugfix release.

Security
--------

 * sshd(8): Mitigate a potential denial-of-service attack against
   the system's crypt(3) function via sshd(8). An attacker could
   send very long passwords that would cause excessive CPU use in
   crypt(3). sshd(8) now refuses to accept password authentication
   requests of length greater than 1024 characters. Independently
   reported by Tomas Kuthan (Oracle), Andres Rojas and Javier Nieto.

 * sshd(8): Mitigate timing differences in password authentication
   that could be used to discern valid from invalid account names
   when long passwords were sent and particular password hashing
   algorithms are in use on the server. CVE-2016-6210, reported by
   EddieEzra.Harari at verint.com

 * ssh(1), sshd(8): Fix observable timing weakness in the CBC padding
   oracle countermeasures. Reported by Jean Paul Degabriele, Kenny
   Paterson, Torben Hansen and Martin Albrecht. Note that CBC ciphers
   are disabled by default and only included for legacy compatibility.

 * ssh(1), sshd(8): Improve operation ordering of MAC verification for
   Encrypt-then-MAC (EtM) mode transport MAC algorithms to verify the
   MAC before decrypting any ciphertext. This removes the possibility
   of timing differences leaking facts about the plaintext, though no
   such leakage has been observed.  Reported by Jean Paul Degabriele,
   Kenny Paterson, Torben Hansen and Martin Albrecht.

 * sshd(8): (portable only) Ignore PAM environment vars when
   UseLogin=yes. If PAM is configured to read user-specified
   environment variables and UseLogin=yes in sshd_config, then a
   hostile local user may attack /bin/login via LD_PRELOAD or
   similar environment variables set via PAM. CVE-2015-8325,
   found by Shayan Sadigh.

New Features
------------

 * ssh(1): Add a ProxyJump option and corresponding -J command-line
   flag to allow simplified indirection through a one or more SSH
   bastions or "jump hosts".

 * ssh(1): Add an IdentityAgent option to allow specifying specific
   agent sockets instead of accepting one from the environment.

 * ssh(1): Allow ExitOnForwardFailure and ClearAllForwardings to be
   optionally overridden when using ssh -W. bz#2577

 * ssh(1), sshd(8): Implement support for the IUTF8 terminal mode as
   per draft-sgtatham-secsh-iutf8-00.

 * ssh(1), sshd(8): Add support for additional fixed Diffie-Hellman
   2K, 4K and 8K groups from draft-ietf-curdle-ssh-kex-sha2-03.

 * ssh-keygen(1), ssh(1), sshd(8): support SHA256 and SHA512 RSA
   signatures in certificates;

 * ssh(1): Add an Include directive for ssh_config(5) files.

 * ssh(1): Permit UTF-8 characters in pre-authentication banners sent
   from the server. bz#2058

Bugfixes
--------

 * ssh(1), sshd(8): Reduce the syslog level of some relatively common
   protocol events from LOG_CRIT. bz#2585

 * sshd(8): Refuse AuthenticationMethods="" in configurations and
   accept AuthenticationMethods=any for the default behaviour of not
   requiring multiple authentication. bz#2398

 * sshd(8): Remove obsolete and misleading "POSSIBLE BREAK-IN
   ATTEMPT!" message when forward and reverse DNS don't match. bz#2585

 * ssh(1): Close ControlPersist background process stderr except
   in debug mode or when logging to syslog. bz#1988

 * misc: Make PROTOCOL description for direct-streamlocal@openssh.com
   channel open messages match deployed code. bz#2529

 * ssh(1): Deduplicate LocalForward and RemoteForward entries to fix
   failures when both ExitOnForwardFailure and hostname
   canonicalisation are enabled. bz#2562

 * sshd(8): Remove fallback from moduli to obsolete "primes" file
   that was deprecated in 2001. bz#2559.

 * sshd_config(5): Correct description of UseDNS: it affects ssh
   hostname processing for authorized_keys, not known_hosts; bz#2554

 * ssh(1): Fix authentication using lone certificate keys in an agent
   without corresponding private keys on the filesystem. bz#2550

 * sshd(8): Send ClientAliveInterval pings when a time-based
   RekeyLimit is set; previously keepalive packets were not being
   sent. bz#2252

Portability
-----------

 * ssh(1), sshd(8): Fix compilation by automatically disabling ciphers
   not supported by OpenSSL. bz#2466

 * misc: Fix compilation failures on some versions of AIX's compiler
   related to the definition of the VA_COPY macro. bz#2589

 * sshd(8): Whitelist more architectures to enable the seccomp-bpf
   sandbox. bz#2590

 * ssh-agent(1), sftp-server(8): Disable process tracing on Solaris
   using setpflags(__PROC_PROTECT, ...). bz#2584

 * sshd(8): On Solaris, don't call Solaris setproject() with
   UsePAM=yes it's PAM's responsibility. bz#2425

Checksums:
==========

 - SHA1 (openssh-7.3.tar.gz) = b1641e5265d9ec68a9a19decc3a7edd1203cbd33
 - SHA256 (openssh-7.3.tar.gz) = vS0X35qrX9OOPBkyDMYhOje/DBwHBVEV7nv5rkzw4vM=

 - SHA1 (openssh-7.3p1.tar.gz) = bfade84283fcba885e2084343ab19a08c7d123a5
 - SHA256 (openssh-7.3p1.tar.gz) = P/uYmm3KppWUw7VQ1IVaWi4XGMzd5/XjY4e0JCIPvsw=

Please note that the SHA256 signatures are base64 encoded and not
hexadecimal (which is the default for most checksum tools). The PGP
key used to sign the releases is available as RELEASE_KEY.asc from
the mirror sites.

Reporting Bugs:
===============

- Please read http://www.openssh.com/report.html
  Security bugs should be reported directly to openssh@openssh.com

OpenSSH is brought to you by Markus Friedl, Niels Provos, Theo de
Raadt, Kevin Steves, Damien Miller, Darren Tucker, Jason McIntyre,
Tim Rice and Ben Lindstrom.

Revision 1.8 / (download) - annotate - [select for diffs], Fri Mar 11 01:55:00 2016 UTC (8 years, 1 month ago) by christos
Branch: MAIN
CVS Tags: pgoyette-localcount-base, pgoyette-localcount-20160726
Branch point for: pgoyette-localcount
Changes since 1.7: +2 -1 lines
Diff to previous 1.7 (colored)

merge conflicts

Revision 1.1.1.5 / (download) - annotate - [select for diffs] (vendor branch), Fri Mar 11 01:50:01 2016 UTC (8 years, 1 month ago) by christos
Branch: OPENSSH
CVS Tags: v72-20160310
Changes since 1.1.1.4: +2 -8 lines
Diff to previous 1.1.1.4 (colored)

Future deprecation notice
=========================

We plan on retiring more legacy cryptography in a near-future
release, specifically:

 * Refusing all RSA keys smaller than 1024 bits (the current minimum
   is 768 bits)

This list reflects our current intentions, but please check the final
release notes for future releases.

Potentially-incompatible changes
================================

This release disables a number of legacy cryptographic algorithms
by default in ssh:

 * Several ciphers blowfish-cbc, cast128-cbc, all arcfour variants
   and the rijndael-cbc aliases for AES.

 * MD5-based and truncated HMAC algorithms.

These algorithms are already disabled by default in sshd.

Changes since OpenSSH 7.1p2
===========================

This is primarily a bugfix release.

Security
--------

 * ssh(1), sshd(8): remove unfinished and unused roaming code (was
   already forcibly disabled in OpenSSH 7.1p2).

 * ssh(1): eliminate fallback from untrusted X11 forwarding to
   trusted forwarding when the X server disables the SECURITY
   extension.

 * ssh(1), sshd(8): increase the minimum modulus size supported for
   diffie-hellman-group-exchange to 2048 bits.

 * sshd(8): pre-auth sandboxing is now enabled by default (previous
   releases enabled it for new installations via sshd_config).

New Features
------------

 * all: add support for RSA signatures using SHA-256/512 hash
   algorithms based on draft-rsa-dsa-sha2-256-03.txt and
   draft-ssh-ext-info-04.txt.

 * ssh(1): Add an AddKeysToAgent client option which can be set to
   'yes', 'no', 'ask', or 'confirm', and defaults to 'no'.  When
   enabled, a private key that is used during authentication will be
   added to ssh-agent if it is running (with confirmation enabled if
   set to 'confirm').

 * sshd(8): add a new authorized_keys option "restrict" that includes
   all current and future key restrictions (no-*-forwarding, etc.).
   Also add permissive versions of the existing restrictions, e.g.
   "no-pty" -> "pty". This simplifies the task of setting up
   restricted keys and ensures they are maximally-restricted,
   regardless of any permissions we might implement in the future.

 * ssh(1): add ssh_config CertificateFile option to explicitly list
   certificates. bz#2436

 * ssh-keygen(1): allow ssh-keygen to change the key comment for all
   supported formats.

 * ssh-keygen(1): allow fingerprinting from standard input, e.g.
   "ssh-keygen -lf -"

 * ssh-keygen(1): allow fingerprinting multiple public keys in a
   file, e.g. "ssh-keygen -lf ~/.ssh/authorized_keys" bz#1319

 * sshd(8): support "none" as an argument for sshd_config
   Foreground and ChrootDirectory. Useful inside Match blocks to
   override a global default. bz#2486

 * ssh-keygen(1): support multiple certificates (one per line) and
   reading from standard input (using "-f -") for "ssh-keygen -L"

 * ssh-keyscan(1): add "ssh-keyscan -c ..." flag to allow fetching
   certificates instead of plain keys.

 * ssh(1): better handle anchored FQDNs (e.g. 'cvs.openbsd.org.') in
   hostname canonicalisation - treat them as already canonical and
   remove the trailing '.' before matching ssh_config.

Bugfixes
--------

 * sftp(1): existing destination directories should not terminate
   recursive uploads (regression in openssh 6.8) bz#2528

 * ssh(1), sshd(8): correctly send back SSH2_MSG_UNIMPLEMENTED
   replies to unexpected messages during key exchange. bz#2949

 * ssh(1): refuse attempts to set ConnectionAttempts=0, which does
   not make sense and would cause ssh to print an uninitialised stack
   variable. bz#2500

 * ssh(1): fix errors when attempting to connect to scoped IPv6
   addresses with hostname canonicalisation enabled.

 * sshd_config(5): list a couple more options usable in Match blocks.
   bz#2489

 * sshd(8): fix "PubkeyAcceptedKeyTypes +..." inside a Match block.

 * ssh(1): expand tilde characters in filenames passed to -i options
   before checking whether or not the identity file exists. Avoids
   confusion for cases where shell doesn't expand (e.g. "-i ~/file"
   vs. "-i~/file"). bz#2481

 * ssh(1): do not prepend "exec" to the shell command run by "Match
   exec" in a config file, which could cause some commands to fail
   in certain environments. bz#2471

 * ssh-keyscan(1): fix output for multiple hosts/addrs on one line
   when host hashing or a non standard port is in use bz#2479

 * sshd(8): skip "Could not chdir to home directory" message when
   ChrootDirectory is active. bz#2485

 * ssh(1): include PubkeyAcceptedKeyTypes in ssh -G config dump.

 * sshd(8): avoid changing TunnelForwarding device flags if they are
   already what is needed; makes it possible to use tun/tap
   networking as non-root user if device permissions and interface
   flags are pre-established

 * ssh(1), sshd(8): RekeyLimits could be exceeded by one packet.
   bz#2521

 * ssh(1): fix multiplexing master failure to notice client exit.

 * ssh(1), ssh-agent(1): avoid fatal() for PKCS11 tokens that present
   empty key IDs. bz#1773

 * sshd(8): avoid printf of NULL argument. bz#2535

 * ssh(1), sshd(8): allow RekeyLimits larger than 4GB. bz#2521

 * ssh-keygen(1): sshd(8): fix several bugs in (unused) KRL signature
   support.

 * ssh(1), sshd(8): fix connections with peers that use the key
   exchange guess feature of the protocol. bz#2515

 * sshd(8): include remote port number in log messages. bz#2503

 * ssh(1): don't try to load SSHv1 private key when compiled without
   SSHv1 support. bz#2505

 * ssh-agent(1), ssh(1): fix incorrect error messages during key
   loading and signing errors. bz#2507

 * ssh-keygen(1): don't leave empty temporary files when performing
   known_hosts file edits when known_hosts doesn't exist.

 * sshd(8): correct packet format for tcpip-forward replies for
   requests that don't allocate a port bz#2509

 * ssh(1), sshd(8): fix possible hang on closed output. bz#2469

 * ssh(1): expand %i in ControlPath to UID. bz#2449

 * ssh(1), sshd(8): fix return type of openssh_RSA_verify. bz#2460

 * ssh(1), sshd(8): fix some option parsing memory leaks. bz#2182

 * ssh(1): add a some debug output before DNS resolution; it's a
   place where ssh could previously silently stall in cases of
   unresponsive DNS servers. bz#2433

 * ssh(1): remove spurious newline in visual hostkey. bz#2686

 * ssh(1): fix printing (ssh -G ...) of HostKeyAlgorithms=+...

 * ssh(1): fix expansion of HostkeyAlgorithms=+...

Documentation
-------------

 * ssh_config(5), sshd_config(5): update default algorithm lists to
   match current reality. bz#2527

 * ssh(1): mention -Q key-plain and -Q key-cert query options.
   bz#2455

 * sshd_config(8): more clearly describe what AuthorizedKeysFile=none
   does.

 * ssh_config(5): better document ExitOnForwardFailure. bz#2444

 * sshd(5): mention internal DH-GEX fallback groups in manual.
   bz#2302

 * sshd_config(5): better description for MaxSessions option.
   bz#2531

Portability
-----------

 * ssh(1), sftp-server(8), ssh-agent(1), sshd(8): Support Illumos/
   Solaris fine-grained privileges. Including a pre-auth privsep
   sandbox and several pledge() emulations. bz#2511

 * Renovate redhat/openssh.spec, removing deprecated options and
   syntax.

 * configure: allow --without-ssl-engine with --without-openssl

 * sshd(8): fix multiple authentication using S/Key. bz#2502

 * sshd(8): read back from libcrypto RAND_* before dropping
   privileges.  Avoids sandboxing violations with BoringSSL.

 * Fix name collision with system-provided glob(3) functions.
   bz#2463

 * Adapt Makefile to use ssh-keygen -A when generating host keys.
   bz#2459

 * configure: correct default value for --with-ssh1 bz#2457

 * configure: better detection of _res symbol bz#2259

 * support getrandom() syscall on Linux

Revision 1.7 / (download) - annotate - [select for diffs], Thu Jan 14 22:30:04 2016 UTC (8 years, 3 months ago) by christos
Branch: MAIN
Changes since 1.6: +0 -7 lines
Diff to previous 1.6 (colored)

get rid of roaming (CVE-2016-0777)

Revision 1.4.22.1 / (download) - annotate - [select for diffs], Thu Apr 30 06:07:30 2015 UTC (8 years, 11 months ago) by riz
Branch: netbsd-7
CVS Tags: netbsd-7-nhusb-base-20170116, netbsd-7-nhusb-base, netbsd-7-nhusb, netbsd-7-2-RELEASE, netbsd-7-1-RELEASE, netbsd-7-1-RC2, netbsd-7-1-RC1, netbsd-7-1-2-RELEASE, netbsd-7-1-1-RELEASE, netbsd-7-1, netbsd-7-0-RELEASE, netbsd-7-0-RC3, netbsd-7-0-RC2, netbsd-7-0-RC1, netbsd-7-0-2-RELEASE, netbsd-7-0-1-RELEASE, netbsd-7-0
Changes since 1.4: +2 -8 lines
Diff to previous 1.4 (colored) next main 1.5 (colored)

Pull up blacklistd(8), requested by christos in ticket #711:
crypto/external/bsd/openssh/dist/moduli-gen/Makefile up to 1.1.1.1
crypto/external/bsd/openssh/dist/moduli-gen/moduli up to 1.1.1.1
crypto/external/bsd/openssh/dist/moduli-gen/moduli-gen.sh up to 1.1.1.1
crypto/external/bsd/openssh/dist/moduli-gen/moduli.1024 up to 1.1.1.1
crypto/external/bsd/openssh/dist/moduli-gen/moduli.1536 up to 1.1.1.1
crypto/external/bsd/openssh/dist/moduli-gen/moduli.2048 up to 1.1.1.1
crypto/external/bsd/openssh/dist/moduli-gen/moduli.3072 up to 1.1.1.1
crypto/external/bsd/openssh/dist/moduli-gen/moduli.4096 up to 1.1.1.1
crypto/external/bsd/openssh/dist/moduli-gen/moduli.6144 up to 1.1.1.1
crypto/external/bsd/openssh/dist/moduli-gen/moduli.7680 up to 1.1.1.1
crypto/external/bsd/openssh/dist/moduli-gen/moduli.8192 up to 1.1.1.1
crypto/external/bsd/openssh/dist/bcrypt_pbkdf.c up to 1.2
crypto/external/bsd/openssh/dist/kexc25519.c    up to 1.3
crypto/external/bsd/openssh/dist/smult_curve25519_ref.c up to 1.3
crypto/external/bsd/openssh/dist/bitmap.c       up to 1.2 plus patch
crypto/external/bsd/openssh/dist/PROTOCOL.chacha20poly1305 up to 1.1.1.1
crypto/external/bsd/openssh/dist/PROTOCOL.key   up to 1.1.1.1
crypto/external/bsd/openssh/dist/blf.h          up to 1.1
crypto/external/bsd/openssh/dist/blocks.c       up to 1.3
crypto/external/bsd/openssh/dist/blowfish.c     up to 1.2
crypto/external/bsd/openssh/dist/chacha.c       up to 1.3
crypto/external/bsd/openssh/dist/chacha.h       up to 1.1.1.1
crypto/external/bsd/openssh/dist/cipher-aesctr.c up to 1.1.1.2
crypto/external/bsd/openssh/dist/cipher-aesctr.h up to 1.1.1.1
crypto/external/bsd/openssh/dist/cipher-chachapoly.c up to 1.3
crypto/external/bsd/openssh/dist/cipher-chachapoly.h up to 1.1.1.1
crypto/external/bsd/openssh/dist/crypto_api.h   up to 1.1.1.1
crypto/external/bsd/openssh/dist/digest-libc.c  up to 1.3
crypto/external/bsd/openssh/dist/digest-openssl.c up to 1.3
crypto/external/bsd/openssh/dist/digest.h       up to 1.1.1.2
crypto/external/bsd/openssh/dist/ed25519.c      up to 1.3
crypto/external/bsd/openssh/dist/fe25519.c      up to 1.3
crypto/external/bsd/openssh/dist/fe25519.h      up to 1.1.1.1
crypto/external/bsd/openssh/dist/ge25519.c      up to 1.3
crypto/external/bsd/openssh/dist/ge25519.h      up to 1.1.1.2
crypto/external/bsd/openssh/dist/ge25519_base.data up to 1.1.1.1
crypto/external/bsd/openssh/dist/hash.c         up to 1.3
crypto/external/bsd/openssh/dist/hmac.c         up to 1.3
crypto/external/bsd/openssh/dist/hmac.h         up to 1.1.1.1
crypto/external/bsd/openssh/dist/kexc25519c.c   up to 1.3
crypto/external/bsd/openssh/dist/kexc25519s.c   up to 1.3
crypto/external/bsd/openssh/dist/poly1305.c     up to 1.3
crypto/external/bsd/openssh/dist/poly1305.h     up to 1.1.1.1
crypto/external/bsd/openssh/dist/rijndael.c     up to 1.1.1.2
crypto/external/bsd/openssh/dist/rijndael.h     up to 1.1.1.1
crypto/external/bsd/openssh/dist/sc25519.c      up to 1.3
crypto/external/bsd/openssh/dist/sc25519.h      up to 1.1.1.1
crypto/external/bsd/openssh/dist/ssh-ed25519.c  up to 1.3
crypto/external/bsd/openssh/dist/sshbuf-getput-basic.c up to 1.3
crypto/external/bsd/openssh/dist/sshbuf-getput-crypto.c up to 1.3
crypto/external/bsd/openssh/dist/sshbuf-misc.c  up to 1.3
crypto/external/bsd/openssh/dist/sshbuf.c       up to 1.3
crypto/external/bsd/openssh/dist/sshbuf.h       up to 1.4
crypto/external/bsd/openssh/dist/ssherr.c       up to 1.3
crypto/external/bsd/openssh/dist/ssherr.h       up to 1.1.1.2
crypto/external/bsd/openssh/dist/sshkey.c       up to 1.3
crypto/external/bsd/openssh/dist/sshkey.h       up to 1.1.1.2
crypto/external/bsd/openssh/dist/verify.c       up to 1.3
crypto/external/bsd/openssh/dist/opacket.c      up to 1.2
crypto/external/bsd/openssh/dist/umac128.c      up to 1.1
crypto/external/bsd/openssh/dist/pfilter.c      up to 1.2
crypto/external/bsd/openssh/dist/pfilter.h      up to 1.1
crypto/external/bsd/openssh/dist/bitmap.h       up to 1.2
crypto/external/bsd/openssh/dist/opacket.h      up to 1.2
crypto/external/bsd/openssh/dist/ssh_api.c      up to 1.2
crypto/external/bsd/openssh/dist/ssh_api.h      up to 1.2
crypto/external/bsd/openssh/dist/auth2-jpake.c  delete
crypto/external/bsd/openssh/dist/compress.c     delete
crypto/external/bsd/openssh/dist/compress.h     delete
crypto/external/bsd/openssh/dist/jpake.c        delete
crypto/external/bsd/openssh/dist/jpake.h        delete
crypto/external/bsd/openssh/dist/schnorr.c      delete
crypto/external/bsd/openssh/dist/schnorr.h      delete
crypto/external/bsd/openssh/dist/strtonum.c     1.1
crypto/external/bsd/openssh/Makefile.inc        up to 1.8
crypto/external/bsd/openssh/bin/Makefile.inc    up to 1.3
crypto/external/bsd/openssh/bin/ssh-keyscan/Makefile up to 1.2
crypto/external/bsd/openssh/bin/sshd/Makefile   up to 1.12
crypto/external/bsd/openssh/dist/PROTOCOL       up to 1.5
crypto/external/bsd/openssh/dist/PROTOCOL.krl   up to 1.1.1.2
crypto/external/bsd/openssh/dist/addrmatch.c    up to 1.8
crypto/external/bsd/openssh/dist/atomicio.c     up to 1.6
crypto/external/bsd/openssh/dist/auth-bsdauth.c up to 1.4
crypto/external/bsd/openssh/dist/auth-chall.c   up to 1.6
crypto/external/bsd/openssh/dist/auth-krb5.c    up to 1.7
crypto/external/bsd/openssh/dist/auth-options.c up to 1.9
crypto/external/bsd/openssh/dist/auth-options.h up to 1.6
crypto/external/bsd/openssh/dist/auth-passwd.c  up to 1.4
crypto/external/bsd/openssh/dist/auth-rh-rsa.c  up to 1.6
crypto/external/bsd/openssh/dist/auth-rhosts.c  up to 1.5
crypto/external/bsd/openssh/dist/auth-rsa.c     up to 1.10
crypto/external/bsd/openssh/dist/auth.c         up to 1.12
crypto/external/bsd/openssh/dist/auth.h         up to 1.10
crypto/external/bsd/openssh/dist/auth1.c        up to 1.11
crypto/external/bsd/openssh/dist/auth2-chall.c  up to 1.7
crypto/external/bsd/openssh/dist/auth2-gss.c    up to 1.8
crypto/external/bsd/openssh/dist/auth2-hostbased.c up to 1.7
crypto/external/bsd/openssh/dist/auth2-kbdint.c up to 1.5
crypto/external/bsd/openssh/dist/auth2-krb5.c   up to 1.4
crypto/external/bsd/openssh/dist/auth2-none.c   up to 1.5
crypto/external/bsd/openssh/dist/auth2-passwd.c up to 1.5
crypto/external/bsd/openssh/dist/auth2-pubkey.c up to 1.11
crypto/external/bsd/openssh/dist/auth2.c        up to 1.11
crypto/external/bsd/openssh/dist/authfd.c       up to 1.8
crypto/external/bsd/openssh/dist/authfd.h       up to 1.5
crypto/external/bsd/openssh/dist/authfile.c     up to 1.10
crypto/external/bsd/openssh/dist/authfile.h     up to 1.6
crypto/external/bsd/openssh/dist/bufaux.c       up to 1.7
crypto/external/bsd/openssh/dist/bufbn.c        up to 1.5
crypto/external/bsd/openssh/dist/bufec.c        up to 1.5
crypto/external/bsd/openssh/dist/buffer.c       up to 1.6
crypto/external/bsd/openssh/dist/buffer.h       up to 1.7
crypto/external/bsd/openssh/dist/canohost.c     up to 1.8
crypto/external/bsd/openssh/dist/channels.c     up to 1.13
crypto/external/bsd/openssh/dist/channels.h     up to 1.10
crypto/external/bsd/openssh/dist/cipher-3des1.c up to 1.7
crypto/external/bsd/openssh/dist/cipher-bf1.c   up to 1.6
crypto/external/bsd/openssh/dist/cipher.c       up to 1.7
crypto/external/bsd/openssh/dist/cipher.h       up to 1.7
crypto/external/bsd/openssh/dist/clientloop.c   up to 1.13
crypto/external/bsd/openssh/dist/compat.c       up to 1.9
crypto/external/bsd/openssh/dist/compat.h       up to 1.6
crypto/external/bsd/openssh/dist/deattack.c     up to 1.4
crypto/external/bsd/openssh/dist/deattack.h     up to 1.4
crypto/external/bsd/openssh/dist/dh.c           up to 1.8
crypto/external/bsd/openssh/dist/dh.h           up to 1.4
crypto/external/bsd/openssh/dist/dispatch.c     up to 1.5
crypto/external/bsd/openssh/dist/dispatch.h     up to 1.4
crypto/external/bsd/openssh/dist/dns.c          up to 1.11
crypto/external/bsd/openssh/dist/dns.h          up to 1.6
crypto/external/bsd/openssh/dist/groupaccess.c  up to 1.5
crypto/external/bsd/openssh/dist/gss-genr.c     up to 1.7
crypto/external/bsd/openssh/dist/gss-serv-krb5.c up to 1.8
crypto/external/bsd/openssh/dist/gss-serv.c     up to 1.7
crypto/external/bsd/openssh/dist/hostfile.c     up to 1.7
crypto/external/bsd/openssh/dist/hostfile.h     up to 1.7
crypto/external/bsd/openssh/dist/includes.h     up to 1.4
crypto/external/bsd/openssh/dist/kex.c          up to 1.10
crypto/external/bsd/openssh/dist/kex.h          up to 1.9
crypto/external/bsd/openssh/dist/kexdh.c        up to 1.4
crypto/external/bsd/openssh/dist/kexdhc.c       up to 1.6
crypto/external/bsd/openssh/dist/kexdhs.c       up to 1.8
crypto/external/bsd/openssh/dist/kexecdh.c      up to 1.5
crypto/external/bsd/openssh/dist/kexecdhc.c     up to 1.5
crypto/external/bsd/openssh/dist/kexecdhs.c     up to 1.5
crypto/external/bsd/openssh/dist/kexgex.c       up to 1.4
crypto/external/bsd/openssh/dist/kexgexc.c      up to 1.6
crypto/external/bsd/openssh/dist/kexgexs.c      up to 1.8
crypto/external/bsd/openssh/dist/key.c          up to 1.16
crypto/external/bsd/openssh/dist/key.h          up to 1.9
crypto/external/bsd/openssh/dist/krl.c          up to 1.5
crypto/external/bsd/openssh/dist/krl.h          up to 1.1.1.2
crypto/external/bsd/openssh/dist/mac.c          up to 1.11
crypto/external/bsd/openssh/dist/mac.h          up to 1.5
crypto/external/bsd/openssh/dist/match.c        up to 1.5
crypto/external/bsd/openssh/dist/misc.c         up to 1.10
crypto/external/bsd/openssh/dist/misc.h         up to 1.9 plus patch
crypto/external/bsd/openssh/dist/moduli.c       up to 1.8
crypto/external/bsd/openssh/dist/monitor.c      up to 1.14
crypto/external/bsd/openssh/dist/monitor.h      up to 1.7
crypto/external/bsd/openssh/dist/monitor_fdpass.c up to 1.5
crypto/external/bsd/openssh/dist/monitor_mm.c   up to 1.6
crypto/external/bsd/openssh/dist/monitor_mm.h   up to 1.4
crypto/external/bsd/openssh/dist/monitor_wrap.c up to 1.11
crypto/external/bsd/openssh/dist/monitor_wrap.h up to 1.8
crypto/external/bsd/openssh/dist/msg.c          up to 1.4
crypto/external/bsd/openssh/dist/msg.h          up to 1.4
crypto/external/bsd/openssh/dist/mux.c          up to 1.11
crypto/external/bsd/openssh/dist/myproposal.h   up to 1.10
crypto/external/bsd/openssh/dist/namespace.h    up to 1.5
crypto/external/bsd/openssh/dist/packet.c       up to 1.18
crypto/external/bsd/openssh/dist/packet.h       up to 1.11
crypto/external/bsd/openssh/dist/pathnames.h    up to 1.9
crypto/external/bsd/openssh/dist/pkcs11.h       up to 1.4
crypto/external/bsd/openssh/dist/progressmeter.c up to 1.7
crypto/external/bsd/openssh/dist/progressmeter.h up to 1.4
crypto/external/bsd/openssh/dist/reallocarray.c new
crypto/external/bsd/openssh/dist/readconf.c     up to 1.13
crypto/external/bsd/openssh/dist/readconf.h     up to 1.12
crypto/external/bsd/openssh/dist/readpass.c     up to 1.6
crypto/external/bsd/openssh/dist/roaming_client.c up to 1.7
crypto/external/bsd/openssh/dist/roaming_common.c up to 1.9
crypto/external/bsd/openssh/dist/roaming_dummy.c up to 1.4
crypto/external/bsd/openssh/dist/rsa.c          up to 1.5
crypto/external/bsd/openssh/dist/rsa.h          up to 1.4
crypto/external/bsd/openssh/dist/sandbox-systrace.c up to 1.1.1.5
crypto/external/bsd/openssh/dist/scp.1          up to 1.9
crypto/external/bsd/openssh/dist/scp.c          up to 1.11
crypto/external/bsd/openssh/dist/servconf.c     up to 1.17
crypto/external/bsd/openssh/dist/servconf.h     up to 1.11
crypto/external/bsd/openssh/dist/serverloop.c   up to 1.12
crypto/external/bsd/openssh/dist/session.c      up to 1.14
crypto/external/bsd/openssh/dist/session.h      up to 1.4
crypto/external/bsd/openssh/dist/sftp-client.c  up to 1.13
crypto/external/bsd/openssh/dist/sftp-client.h  up to 1.7
crypto/external/bsd/openssh/dist/sftp-common.c  up to 1.7
crypto/external/bsd/openssh/dist/sftp-common.h  up to 1.5
crypto/external/bsd/openssh/dist/sftp-glob.c    up to 1.8
crypto/external/bsd/openssh/dist/sftp-server.8  up to 1.9
crypto/external/bsd/openssh/dist/sftp-server.c  up to 1.11
crypto/external/bsd/openssh/dist/sftp.1         up to 1.11
crypto/external/bsd/openssh/dist/sftp.c         up to 1.15
crypto/external/bsd/openssh/dist/ssh-add.1      up to 1.9
crypto/external/bsd/openssh/dist/ssh-add.c      up to 1.10
crypto/external/bsd/openssh/dist/ssh-agent.1    up to 1.8
crypto/external/bsd/openssh/dist/ssh-agent.c    up to 1.14
crypto/external/bsd/openssh/dist/ssh-dss.c      up to 1.7
crypto/external/bsd/openssh/dist/ssh-ecdsa.c    up to 1.6
crypto/external/bsd/openssh/dist/ssh-gss.h      up to 1.5
crypto/external/bsd/openssh/dist/ssh-keygen.1   up to 1.13
crypto/external/bsd/openssh/dist/ssh-keygen.c   up to 1.16
crypto/external/bsd/openssh/dist/ssh-keyscan.1  up to 1.10
crypto/external/bsd/openssh/dist/ssh-keyscan.c  up to 1.13
crypto/external/bsd/openssh/dist/ssh-keysign.8  up to 1.9
crypto/external/bsd/openssh/dist/ssh-keysign.c  up to 1.8
crypto/external/bsd/openssh/dist/ssh-pkcs11-client.c up to 1.6
crypto/external/bsd/openssh/dist/ssh-pkcs11-helper.c up to 1.8
crypto/external/bsd/openssh/dist/ssh-pkcs11.c   up to 1.7
crypto/external/bsd/openssh/dist/ssh-pkcs11.h   up to 1.4
crypto/external/bsd/openssh/dist/ssh-rsa.c      up to 1.7
crypto/external/bsd/openssh/dist/ssh.1          up to 1.14
crypto/external/bsd/openssh/dist/ssh.c          up to 1.16
crypto/external/bsd/openssh/dist/ssh2.h         up to 1.6
crypto/external/bsd/openssh/dist/ssh_config     up to 1.8
crypto/external/bsd/openssh/dist/ssh_config.5   up to 1.13
crypto/external/bsd/openssh/dist/sshconnect.c   up to 1.11
crypto/external/bsd/openssh/dist/sshconnect.h   up to 1.6
crypto/external/bsd/openssh/dist/sshconnect1.c  up to 1.6
crypto/external/bsd/openssh/dist/sshconnect2.c  up to 1.19
crypto/external/bsd/openssh/dist/sshd.8         up to 1.13
crypto/external/bsd/openssh/dist/sshd.c         up to 1.18
crypto/external/bsd/openssh/dist/sshd_config    up to 1.13
crypto/external/bsd/openssh/dist/sshd_config.5  up to 1.17
crypto/external/bsd/openssh/dist/sshlogin.c     up to 1.6
crypto/external/bsd/openssh/dist/sshpty.c       up to 1.4
crypto/external/bsd/openssh/dist/uidswap.c      up to 1.4
crypto/external/bsd/openssh/dist/umac.c         up to 1.9
crypto/external/bsd/openssh/dist/version.h      up to 1.14
crypto/external/bsd/openssh/dist/xmalloc.c      up to 1.5
crypto/external/bsd/openssh/lib/Makefile        up to 1.17 plus patch
crypto/external/bsd/openssh/lib/shlib_version   up to 1.13
distrib/sets/lists/base/ad.aarch64		patch
distrib/sets/lists/base/ad.arm			patch
distrib/sets/lists/base/ad.mips			patch
distrib/sets/lists/base/ad.powerpc		patch
distrib/sets/lists/base/md.amd64		patch
distrib/sets/lists/base/md.sparc64		patch
distrib/sets/lists/base/mi			patch
distrib/sets/lists/base/shl.mi			patch
distrib/sets/lists/comp/ad.aarch64		patch
distrib/sets/lists/comp/ad.arm			patch
distrib/sets/lists/comp/ad.mips			patch
distrib/sets/lists/comp/ad.powerpc		patch
distrib/sets/lists/comp/md.amd64		patch
distrib/sets/lists/comp/md.sparc64		patch
distrib/sets/lists/comp/mi			patch
distrib/sets/lists/comp/shl.mi			patch
distrib/sets/lists/debug/ad.aarch64		patch
distrib/sets/lists/debug/ad.arm			patch
distrib/sets/lists/debug/ad.mips		patch
distrib/sets/lists/debug/ad.powerpc		patch
distrib/sets/lists/debug/md.amd64		patch
distrib/sets/lists/debug/md.sparc64		patch
distrib/sets/lists/debug/shl.mi			patch
distrib/sets/lists/etc/mi			patch
distrib/sets/lists/man/mi			patch
etc/defaults/rc.conf				1.130
etc/mtree/NetBSD.dist.base			1.142
external/bsd/Makefile                           up to 1.48
external/bsd/blacklist/bin/Makefile             up to 1.11 plus patch
external/bsd/blacklist/bin/blacklistctl.8       up to 1.6
external/bsd/blacklist/bin/blacklistctl.c       up to 1.17
external/bsd/blacklist/bin/blacklistd.8         up to 1.10
external/bsd/blacklist/bin/blacklistd.c         up to 1.32
external/bsd/blacklist/bin/blacklistd.conf.5    up to 1.2
external/bsd/blacklist/bin/conf.c               up to 1.18
external/bsd/blacklist/bin/conf.h               up to 1.6
external/bsd/blacklist/bin/internal.c           up to 1.5
external/bsd/blacklist/bin/internal.h           up to 1.12
external/bsd/blacklist/bin/run.c                up to 1.12
external/bsd/blacklist/bin/run.h                up to 1.5
external/bsd/blacklist/bin/state.c              up to 1.15
external/bsd/blacklist/bin/state.h              up to 1.5
external/bsd/blacklist/bin/support.c            up to 1.6
external/bsd/blacklist/bin/support.h            up to 1.5
external/bsd/blacklist/etc/rc.d/Makefile        up to 1.1
external/bsd/blacklist/etc/rc.d/blacklistd      up to 1.1
external/bsd/blacklist/etc/Makefile             up to 1.3
external/bsd/blacklist/etc/blacklistd.conf      up to 1.3
external/bsd/blacklist/etc/npf.conf             up to 1.1
external/bsd/blacklist/Makefile                 up to 1.2
external/bsd/blacklist/Makefile.inc             up to 1.3
external/bsd/blacklist/README                   up to 1.7
external/bsd/blacklist/TODO                     up to 1.7
external/bsd/blacklist/diff/ftpd.diff           up to 1.1
external/bsd/blacklist/diff/named.diff          up to 1.6
external/bsd/blacklist/diff/ssh.diff            up to 1.6
external/bsd/blacklist/include/Makefile         up to 1.1
external/bsd/blacklist/include/bl.h             up to 1.12
external/bsd/blacklist/include/blacklist.h      up to 1.3
external/bsd/blacklist/include/config.h		new
external/bsd/blacklist/lib/Makefile             up to 1.3
external/bsd/blacklist/lib/bl.c                 up to 1.24
external/bsd/blacklist/lib/blacklist.c          up to 1.5
external/bsd/blacklist/lib/libblacklist.3       up to 1.3
external/bsd/blacklist/lib/shlib_version        up to 1.1
external/bsd/blacklist/libexec/Makefile         up to 1.1
external/bsd/blacklist/libexec/blacklistd-helper up to 1.4
external/bsd/blacklist/port/m4/.cvsignore       up to 1.1
external/bsd/blacklist/port/Makefile.am         up to 1.4
external/bsd/blacklist/port/_strtoi.h           up to 1.1
external/bsd/blacklist/port/clock_gettime.c     up to 1.2
external/bsd/blacklist/port/configure.ac        up to 1.7
external/bsd/blacklist/port/fgetln.c            up to 1.1
external/bsd/blacklist/port/fparseln.c          up to 1.1
external/bsd/blacklist/port/getprogname.c       up to 1.4
external/bsd/blacklist/port/pidfile.c           up to 1.1
external/bsd/blacklist/port/popenve.c           up to 1.2
external/bsd/blacklist/port/port.h              up to 1.6
external/bsd/blacklist/port/sockaddr_snprintf.c up to 1.9
external/bsd/blacklist/port/strlcat.c           up to 1.2
external/bsd/blacklist/port/strlcpy.c           up to 1.2
external/bsd/blacklist/port/strtoi.c            up to 1.3
external/bsd/blacklist/test/Makefile            up to 1.2
external/bsd/blacklist/test/cltest.c            up to 1.6
external/bsd/blacklist/test/srvtest.c           up to 1.9
lib/libpam/modules/pam_ssh/pam_ssh.c            up to 1.23
libexec/ftpd/pfilter.c                          up to 1.1
libexec/ftpd/pfilter.h                          up to 1.1
libexec/ftpd/Makefile                           up to 1.64
libexec/ftpd/ftpd.c                             up to 1.201

	Add blacklistd(8), a daemon to block and release network ports
	on demand to mitigate abuse, and related changes to system daemons
	to support it.
	[christos, ticket #711]

Revision 1.6 / (download) - annotate - [select for diffs], Fri Apr 3 23:58:19 2015 UTC (9 years ago) by christos
Branch: MAIN
Changes since 1.5: +0 -0 lines
Diff to previous 1.5 (colored)

Merge conflicts

Revision 1.5 / (download) - annotate - [select for diffs], Sun Oct 19 16:30:59 2014 UTC (9 years, 6 months ago) by christos
Branch: MAIN
Changes since 1.4: +1 -7 lines
Diff to previous 1.4 (colored)

merge openssh-6.7

Revision 1.1.1.4 / (download) - annotate - [select for diffs] (vendor branch), Sun Oct 19 16:28:38 2014 UTC (9 years, 6 months ago) by christos
Branch: OPENSSH
CVS Tags: v71-20150821, v70-20150812, v69-20150630, v68-20150318, v67-20141018
Changes since 1.1.1.3: +1 -7 lines
Diff to previous 1.1.1.3 (colored)

Changes since OpenSSH 6.6
=========================

Potentially-incompatible changes

 * sshd(8): The default set of ciphers and MACs has been altered to
   remove unsafe algorithms. In particular, CBC ciphers and arcfour*
   are disabled by default.

   The full set of algorithms remains available if configured
   explicitly via the Ciphers and MACs sshd_config options.

 * sshd(8): Support for tcpwrappers/libwrap has been removed.

 * OpenSSH 6.5 and 6.6 have a bug that causes ~0.2% of connections
   using the curve25519-sha256@libssh.org KEX exchange method to fail
   when connecting with something that implements the specification
   correctly. OpenSSH 6.7 disables this KEX method when speaking to
   one of the affected versions.

New Features

 * Major internal refactoring to begin to make part of OpenSSH usable
   as a library. So far the wire parsing, key handling and KRL code
   has been refactored. Please note that we do not consider the API
   stable yet, nor do we offer the library in separable form.

 * ssh(1), sshd(8): Add support for Unix domain socket forwarding.
   A remote TCP port may be forwarded to a local Unix domain socket
   and vice versa or both ends may be a Unix domain socket.

 * ssh(1), ssh-keygen(1): Add support for SSHFP DNS records for
   ED25519 key types.

 * sftp(1): Allow resumption of interrupted uploads.

 * ssh(1): When rekeying, skip file/DNS lookups of the hostkey if it
   is the same as the one sent during initial key exchange; bz#2154

 * sshd(8): Allow explicit ::1 and 127.0.0.1 forwarding bind
   addresses when GatewayPorts=no; allows client to choose address
   family; bz#2222

 * sshd(8): Add a sshd_config PermitUserRC option to control whether
   ~/.ssh/rc is executed, mirroring the no-user-rc authorized_keys
   option; bz#2160

 * ssh(1): Add a %C escape sequence for LocalCommand and ControlPath
   that expands to a unique identifer based on a hash of the tuple of
   (local host, remote user, hostname, port). Helps avoid exceeding
   miserly pathname limits for Unix domain sockets in multiplexing
   control paths; bz#2220

 * sshd(8): Make the "Too many authentication failures" message
   include the user, source address, port and protocol in a format
   similar to the authentication success / failure messages; bz#2199

 * Added unit and fuzz tests for refactored code. These are run
   automatically in portable OpenSSH via the "make tests" target.

Bugfixes

 * sshd(8): Fix remote forwarding with the same listen port but
   different listen address.

 * ssh(1): Fix inverted test that caused PKCS#11 keys that were
   explicitly listed in ssh_config or on the commandline not to be
   preferred.

 * ssh-keygen(1): Fix bug in KRL generation: multiple consecutive
   revoked certificate serial number ranges could be serialised to an
   invalid format. Readers of a broken KRL caused by this bug will
   fail closed, so no should-have-been-revoked key will be accepted.

 * ssh(1): Reflect stdio-forward ("ssh -W host:port ...") failures in
   exit status. Previously we were always returning 0; bz#2255

 * ssh(1), ssh-keygen(1): Make Ed25519 keys' title fit properly in the
   randomart border; bz#2247

 * ssh-agent(1): Only cleanup agent socket in the main agent process
   and not in any subprocesses it may have started (e.g. forked
   askpass). Fixes agent sockets being zapped when askpass processes
   fatal(); bz#2236

 * ssh-add(1): Make stdout line-buffered; saves partial output getting
   lost when ssh-add fatal()s part-way through (e.g. when listing keys
   from an agent that supports key types that ssh-add doesn't);
   bz#2234

 * ssh-keygen(1): When hashing or removing hosts, don't choke on
   @revoked markers and don't remove @cert-authority markers; bz#2241

 * ssh(1): Don't fatal when hostname canonicalisation fails and a
   ProxyCommand is in use; continue and allow the ProxyCommand to
   connect anyway (e.g. to a host with a name outside the DNS behind
   a bastion)

 * scp(1): When copying local->remote fails during read, don't send
   uninitialised heap to the remote end.

 * sftp(1): Fix fatal "el_insertstr failed" errors when tab-completing
   filenames with  a single quote char somewhere in the string;
   bz#2238

 * ssh-keyscan(1): Scan for Ed25519 keys by default.

 * ssh(1): When using VerifyHostKeyDNS with a DNSSEC resolver, down-
   convert any certificate keys to plain keys and attempt SSHFP
   resolution.  Prevents a server from skipping SSHFP lookup and
   forcing a new-hostkey dialog by offering only certificate keys.

 * sshd(8): Avoid crash at exit via NULL pointer reference; bz#2225

 * Fix some strict-alignment errors.

Portable OpenSSH

 * Portable OpenSSH now supports building against libressl-portable.

 * Portable OpenSSH now requires openssl 0.9.8f or greater. Older
   versions are no longer supported.

 * In the OpenSSL version check, allow fix version upgrades (but not
   downgrades. Debian bug #748150.

 * sshd(8): On Cygwin, determine privilege separation user at runtime,
   since it may need to be a domain account.

 * sshd(8): Don't attempt to use vhangup on Linux. It doesn't work for
   non-root users, and for them it just messes up the tty settings.

 * Use CLOCK_BOOTTIME in preference to CLOCK_MONOTONIC when it is
   available. It considers time spent suspended, thereby ensuring
   timeouts (e.g. for expiring agent keys) fire correctly.  bz#2228

 * Add support for ed25519 to opensshd.init init script.

 * sftp-server(8): On platforms that support it, use prctl() to
   prevent sftp-server from accessing /proc/self/{mem,maps}

Changes since OpenSSH 6.5
=========================

This is primarily a bugfix release.

Security:

 * sshd(8): when using environment passing with a sshd_config(5)
   AcceptEnv pattern with a wildcard. OpenSSH prior to 6.6 could be
   tricked into accepting any enviornment variable that contains the
   characters before the wildcard character.

New / changed features:

 * ssh(1), sshd(8): this release removes the J-PAKE authentication code.
   This code was experimental, never enabled and had been unmaintained
   for some time.

 * ssh(1): when processing Match blocks, skip 'exec' clauses other clauses
   predicates failed to match.

 * ssh(1): if hostname canonicalisation is enabled and results in the
   destination hostname being changed, then re-parse ssh_config(5) files
   using the new destination hostname. This gives 'Host' and 'Match'
   directives that use the expanded hostname a chance to be applied.

Bugfixes:

 * ssh(1): avoid spurious "getsockname failed: Bad file descriptor" in
   ssh -W. bz#2200, debian#738692

 * sshd(8): allow the shutdown(2) syscall in seccomp-bpf and systrace
   sandbox modes, as it is reachable if the connection is terminated
   during the pre-auth phase.

 * ssh(1), sshd(8): fix unsigned overflow that in SSH protocol 1 bignum
   parsing. Minimum key length checks render this bug unexploitable to
   compromise SSH 1 sessions.

 * sshd_config(5): clarify behaviour of a keyword that appears in
   multiple matching Match blocks. bz#2184

 * ssh(1): avoid unnecessary hostname lookups when canonicalisation is
   disabled. bz#2205

 * sshd(8): avoid sandbox violation crashes in GSSAPI code by caching
   the supported list of GSSAPI mechanism OIDs before entering the
   sandbox. bz#2107

 * ssh(1): fix possible crashes in SOCKS4 parsing caused by assumption
   that the SOCKS username is nul-terminated.

 * ssh(1): fix regression for UsePrivilegedPort=yes when BindAddress is
   not specified.

 * ssh(1), sshd(8): fix memory leak in ECDSA signature verification.

 * ssh(1): fix matching of 'Host' directives in ssh_config(5) files
   to be case-insensitive again (regression in 6.5).

Portable OpenSSH:

 * sshd(8): don't fatal if the FreeBSD Capsicum is offered by the
   system headers and libc but is not supported by the kernel.
 * Fix build using the HP-UX compiler.

Changes since OpenSSH 6.4
=========================

This is a feature-focused release.

New features:

 * ssh(1), sshd(8): Add support for key exchange using elliptic-curve
   Diffie Hellman in Daniel Bernstein's Curve25519. This key exchange
   method is the default when both the client and server support it.

 * ssh(1), sshd(8): Add support for Ed25519 as a public key type.
   Ed25519 is a elliptic curve signature scheme that offers
   better security than ECDSA and DSA and good performance. It may be
   used for both user and host keys.

 * Add a new private key format that uses a bcrypt KDF to better
   protect keys at rest. This format is used unconditionally for
   Ed25519 keys, but may be requested when generating or saving
   existing keys of other types via the -o ssh-keygen(1) option.
   We intend to make the new format the default in the near future.
   Details of the new format are in the PROTOCOL.key file.

 * ssh(1), sshd(8): Add a new transport cipher
   "chacha20-poly1305@openssh.com" that combines Daniel Bernstein's
   ChaCha20 stream cipher and Poly1305 MAC to build an authenticated
   encryption mode. Details are in the PROTOCOL.chacha20poly1305 file.

 * ssh(1), sshd(8): Refuse RSA keys from old proprietary clients and
   servers that use the obsolete RSA+MD5 signature scheme. It will
   still be possible to connect with these clients/servers but only
   DSA keys will be accepted, and OpenSSH will refuse connection
   entirely in a future release.

 * ssh(1), sshd(8): Refuse old proprietary clients and servers that
   use a weaker key exchange hash calculation.

 * ssh(1): Increase the size of the Diffie-Hellman groups requested
   for each symmetric key size. New values from NIST Special
   Publication 800-57 with the upper limit specified by RFC4419.

 * ssh(1), ssh-agent(1): Support PKCS#11 tokens that only provide
   X.509 certs instead of raw public keys (requested as bz#1908).

 * ssh(1): Add a ssh_config(5) "Match" keyword that allows
   conditional configuration to be applied by matching on hostname,
   user and result of arbitrary commands.

 * ssh(1): Add support for client-side hostname canonicalisation
   using a set of DNS suffixes and rules in ssh_config(5). This
   allows unqualified names to be canonicalised to fully-qualified
   domain names to eliminate ambiguity when looking up keys in
   known_hosts or checking host certificate names.

 * sftp-server(8): Add the ability to whitelist and/or blacklist sftp
   protocol requests by name.

 * sftp-server(8): Add a sftp "fsync@openssh.com" to support calling
   fsync(2) on an open file handle.

 * sshd(8): Add a ssh_config(5) PermitTTY to disallow TTY allocation,
   mirroring the longstanding no-pty authorized_keys option.

 * ssh(1): Add a ssh_config ProxyUseFDPass option that supports the
   use of ProxyCommands that establish a connection and then pass a
   connected file descriptor back to ssh(1). This allows the
   ProxyCommand to exit rather than staying around to transfer data.

Bugfixes:

 * ssh(1), sshd(8): Fix potential stack exhaustion caused by nested
   certificates.

 * ssh(1): bz#1211: make BindAddress work with UsePrivilegedPort.

 * sftp(1): bz#2137: fix the progress meter for resumed transfer.

 * ssh-add(1): bz#2187: do not request smartcard PIN when removing
   keys from ssh-agent.

 * sshd(8): bz#2139: fix re-exec fallback when original sshd binary
   cannot be executed.

 * ssh-keygen(1): Make relative-specified certificate expiry times
   relative to current time and not the validity start time.

 * sshd(8): bz#2161: fix AuthorizedKeysCommand inside a Match block.

 * sftp(1): bz#2129: symlinking a file would incorrectly canonicalise
   the target path.

 * ssh-agent(1): bz#2175: fix a use-after-free in the PKCS#11 agent
   helper executable.

 * sshd(8): Improve logging of sessions to include the user name,
   remote host and port, the session type (shell, command, etc.) and
   allocated TTY (if any).

 * sshd(8): bz#1297: tell the client (via a debug message) when
   their preferred listen address has been overridden by the
   server's GatewayPorts setting.

 * sshd(8): bz#2162: include report port in bad protocol banner
   message.

 * sftp(1): bz#2163: fix memory leak in error path in do_readdir().

 * sftp(1): bz#2171: don't leak file descriptor on error.

 * sshd(8): Include the local address and port in "Connection from
   ..." message (only shown at loglevel>=verbose).

Portable OpenSSH:

 * Please note that this is the last version of Portable OpenSSH that
   will support versions of OpenSSL prior to 0.9.6. Support (i.e.
   SSH_OLD_EVP) will be removed following the 6.5p1 release.

 * Portable OpenSSH will attempt compile and link as a Position
   Independent Executable on Linux, OS X and OpenBSD on recent gcc-
   like compilers. Other platforms and older/other compilers may
   request this using the --with-pie configure flag.

 * A number of other toolchain-related hardening options are used
   automatically if available, including -ftrapv to abort on signed
   integer overflow and options to write-protect dynamic linking
   information.  The use of these options may be disabled using the
   --without-hardening configure flag.

 * If the toolchain supports it, one of the -fstack-protector-strong,
   -fstack-protector-all or -fstack-protector compilation flag are
   used to add guards to mitigate attacks based on stack overflows.
   The use of these options may be disabled using the
   --without-stackprotect configure option.

 * sshd(8): Add support for pre-authentication sandboxing using the
   Capsicum API introduced in FreeBSD 10.

 * Switch to a ChaCha20-based arc4random() PRNG for platforms that do
   not provide their own.

 * sshd(8): bz#2156: restore Linux oom_adj setting when handling
   SIGHUP to maintain behaviour over retart.

 * sshd(8): bz#2032: use local username in krb5_kuserok check rather
   than full client name which may be of form user@REALM.

 * ssh(1), sshd(8): Test for both the presence of ECC NID numbers in
   OpenSSL and that they actually work. Fedora (at least) has
   NID_secp521r1 that doesn't work.

 * bz#2173: use pkg-config --libs to include correct -L location for
   libedit.

Revision 1.4 / (download) - annotate - [select for diffs], Mon Jul 25 03:03:11 2011 UTC (12 years, 8 months ago) by christos
Branch: MAIN
CVS Tags: yamt-pagecache-tag8, yamt-pagecache-base9, yamt-pagecache-base8, yamt-pagecache-base7, yamt-pagecache-base6, yamt-pagecache-base5, yamt-pagecache-base4, yamt-pagecache-base3, yamt-pagecache-base2, yamt-pagecache-base, yamt-pagecache, tls-maxphys-base, tls-maxphys, tls-earlyentropy-base, tls-earlyentropy, riastradh-xf86-video-intel-2-7-1-pre-2-21-15, riastradh-drm2-base3, riastradh-drm2-base2, riastradh-drm2-base1, riastradh-drm2-base, riastradh-drm2, netbsd-7-base, netbsd-6-base, netbsd-6-1-RELEASE, netbsd-6-1-RC4, netbsd-6-1-RC3, netbsd-6-1-RC2, netbsd-6-1-RC1, netbsd-6-1-5-RELEASE, netbsd-6-1-4-RELEASE, netbsd-6-1-3-RELEASE, netbsd-6-1-2-RELEASE, netbsd-6-1-1-RELEASE, netbsd-6-0-RELEASE, netbsd-6-0-RC2, netbsd-6-0-RC1, netbsd-6-0-6-RELEASE, netbsd-6-0-5-RELEASE, netbsd-6-0-4-RELEASE, netbsd-6-0-3-RELEASE, netbsd-6-0-2-RELEASE, netbsd-6-0-1-RELEASE, matt-nb6-plus-nbase, matt-nb6-plus-base, matt-nb6-plus, khorben-n900, agc-symver-base, agc-symver
Branch point for: netbsd-7, netbsd-6-1, netbsd-6-0, netbsd-6
Changes since 1.3: +6 -2 lines
Diff to previous 1.3 (colored)

- Merge conflicts
- WARNS=5

Revision 1.1.1.3 / (download) - annotate - [select for diffs] (vendor branch), Sun Jul 24 15:08:51 2011 UTC (12 years, 8 months ago) by christos
Branch: OPENSSH
CVS Tags: v64-20131107, v62-20130321, v61-20120828, v60-20120421, v59-20110906, v58-20110724
Changes since 1.1.1.2: +5 -2 lines
Diff to previous 1.1.1.2 (colored)

from ftp.openbsd.org

Revision 1.3 / (download) - annotate - [select for diffs], Sun Nov 21 18:29:49 2010 UTC (13 years, 4 months ago) by adam
Branch: MAIN
CVS Tags: matt-mips64-premerge-20101231, cherry-xenmp-base, cherry-xenmp, bouyer-quota2-nbase, bouyer-quota2-base, bouyer-quota2
Changes since 1.2: +12 -2 lines
Diff to previous 1.2 (colored)

Resolve conflicts

Revision 1.1.1.2 / (download) - annotate - [select for diffs] (vendor branch), Sun Nov 21 17:06:03 2010 UTC (13 years, 4 months ago) by adam
Branch: OPENSSH
CVS Tags: v56-20101121
Changes since 1.1.1.1: +11 -1 lines
Diff to previous 1.1.1.1 (colored)

Imported openssh-5.6

Revision 1.2 / (download) - annotate - [select for diffs], Sun Jun 7 22:38:47 2009 UTC (14 years, 10 months ago) by christos
Branch: MAIN
CVS Tags: matt-premerge-20091211
Changes since 1.1: +0 -0 lines
Diff to previous 1.1 (colored)

Merge in our changes:
- conditionalize login_cap
- conditionalize bsd_auth
- bring in pam from portable
- restore krb5, krb4, afs, skey
- bring in hpn patches, disable mt aes cipher, keep speedups and cipher none
- add ignore root rhosts option
- fix ctype macro arguments
- umac is broken, disable it
- better ~homedir handling
- netbsd style tunnels
- urandom, xhome, chrootdir, rescuedir NetBSD handling
- utmp/utmpx handling
- handle tty posix_vdisable properly
- handle setuid and unsetuid the posix way instead of setresuid()
- add all missing functions
- add new moduli
- add build glue

Revision 1.1.1.1 / (download) - annotate - [select for diffs] (vendor branch), Sun Jun 7 22:19:25 2009 UTC (14 years, 10 months ago) by christos
Branch: OPENSSH
CVS Tags: v53-20091226, v52-20090607
Changes since 1.1: +0 -0 lines
Diff to previous 1.1 (colored)

import 5.2 from ftp.openbsd.org

Revision 1.1 / (download) - annotate - [select for diffs], Sun Jun 7 22:19:25 2009 UTC (14 years, 10 months ago) by christos
Branch: MAIN

Initial revision

This form allows you to request diff's between any two revisions of a file. You may select a symbolic revision name using the selection box or you may type in a numeric name using the type-in text box.




CVSweb <webmaster@jp.NetBSD.org>