CVS import: src/crypto/external/bsd/openssh/dist

["Christos Zoulas" <christos%netbsd.org@localhost>]

Module Name:    src
Committed By:   christos
Date:           Sun Oct 19 16:28:40 UTC 2014

Update of /cvsroot/src/crypto/external/bsd/openssh/dist
In directory ivanova.netbsd.org:/tmp/cvs-serv3513

Log Message:
Changes since OpenSSH 6.6
=========================

Potentially-incompatible changes

 * sshd(8): The default set of ciphers and MACs has been altered to
   remove unsafe algorithms. In particular, CBC ciphers and arcfour*
   are disabled by default.

   The full set of algorithms remains available if configured
   explicitly via the Ciphers and MACs sshd_config options.

 * sshd(8): Support for tcpwrappers/libwrap has been removed.

 * OpenSSH 6.5 and 6.6 have a bug that causes ~0.2% of connections
   using the curve25519-sha256%libssh.org@localhost KEX exchange method to fail
   when connecting with something that implements the specification
   correctly. OpenSSH 6.7 disables this KEX method when speaking to
   one of the affected versions.

New Features

 * Major internal refactoring to begin to make part of OpenSSH usable
   as a library. So far the wire parsing, key handling and KRL code
   has been refactored. Please note that we do not consider the API
   stable yet, nor do we offer the library in separable form.

 * ssh(1), sshd(8): Add support for Unix domain socket forwarding.
   A remote TCP port may be forwarded to a local Unix domain socket
   and vice versa or both ends may be a Unix domain socket.

 * ssh(1), ssh-keygen(1): Add support for SSHFP DNS records for
   ED25519 key types.

 * sftp(1): Allow resumption of interrupted uploads.

 * ssh(1): When rekeying, skip file/DNS lookups of the hostkey if it
   is the same as the one sent during initial key exchange; bz#2154

 * sshd(8): Allow explicit ::1 and 127.0.0.1 forwarding bind
   addresses when GatewayPorts=no; allows client to choose address
   family; bz#2222

 * sshd(8): Add a sshd_config PermitUserRC option to control whether
   ~/.ssh/rc is executed, mirroring the no-user-rc authorized_keys
   option; bz#2160

 * ssh(1): Add a %C escape sequence for LocalCommand and ControlPath
   that expands to a unique identifer based on a hash of the tuple of
   (local host, remote user, hostname, port). Helps avoid exceeding
   miserly pathname limits for Unix domain sockets in multiplexing
   control paths; bz#2220

 * sshd(8): Make the "Too many authentication failures" message
   include the user, source address, port and protocol in a format
   similar to the authentication success / failure messages; bz#2199

 * Added unit and fuzz tests for refactored code. These are run
   automatically in portable OpenSSH via the "make tests" target.

Bugfixes

 * sshd(8): Fix remote forwarding with the same listen port but
   different listen address.

 * ssh(1): Fix inverted test that caused PKCS#11 keys that were
   explicitly listed in ssh_config or on the commandline not to be
   preferred.

 * ssh-keygen(1): Fix bug in KRL generation: multiple consecutive
   revoked certificate serial number ranges could be serialised to an
   invalid format. Readers of a broken KRL caused by this bug will
   fail closed, so no should-have-been-revoked key will be accepted.

 * ssh(1): Reflect stdio-forward ("ssh -W host:port ...") failures in
   exit status. Previously we were always returning 0; bz#2255

 * ssh(1), ssh-keygen(1): Make Ed25519 keys' title fit properly in the
   randomart border; bz#2247

 * ssh-agent(1): Only cleanup agent socket in the main agent process
   and not in any subprocesses it may have started (e.g. forked
   askpass). Fixes agent sockets being zapped when askpass processes
   fatal(); bz#2236

 * ssh-add(1): Make stdout line-buffered; saves partial output getting
   lost when ssh-add fatal()s part-way through (e.g. when listing keys
   from an agent that supports key types that ssh-add doesn't);
   bz#2234

 * ssh-keygen(1): When hashing or removing hosts, don't choke on
   @revoked markers and don't remove @cert-authority markers; bz#2241

 * ssh(1): Don't fatal when hostname canonicalisation fails and a
   ProxyCommand is in use; continue and allow the ProxyCommand to
   connect anyway (e.g. to a host with a name outside the DNS behind
   a bastion)

 * scp(1): When copying local->remote fails during read, don't send
   uninitialised heap to the remote end.

 * sftp(1): Fix fatal "el_insertstr failed" errors when tab-completing
   filenames with  a single quote char somewhere in the string;
   bz#2238

 * ssh-keyscan(1): Scan for Ed25519 keys by default.

 * ssh(1): When using VerifyHostKeyDNS with a DNSSEC resolver, down-
   convert any certificate keys to plain keys and attempt SSHFP
   resolution.  Prevents a server from skipping SSHFP lookup and
   forcing a new-hostkey dialog by offering only certificate keys.
     
 * sshd(8): Avoid crash at exit via NULL pointer reference; bz#2225

 * Fix some strict-alignment errors.

Portable OpenSSH

 * Portable OpenSSH now supports building against libressl-portable.

 * Portable OpenSSH now requires openssl 0.9.8f or greater. Older
   versions are no longer supported.

 * In the OpenSSL version check, allow fix version upgrades (but not
   downgrades. Debian bug #748150.

 * sshd(8): On Cygwin, determine privilege separation user at runtime,
   since it may need to be a domain account.

 * sshd(8): Don't attempt to use vhangup on Linux. It doesn't work for
   non-root users, and for them it just messes up the tty settings.

 * Use CLOCK_BOOTTIME in preference to CLOCK_MONOTONIC when it is
   available. It considers time spent suspended, thereby ensuring
   timeouts (e.g. for expiring agent keys) fire correctly.  bz#2228

 * Add support for ed25519 to opensshd.init init script.

 * sftp-server(8): On platforms that support it, use prctl() to
   prevent sftp-server from accessing /proc/self/{mem,maps}

Changes since OpenSSH 6.5
=========================

This is primarily a bugfix release.

Security:

 * sshd(8): when using environment passing with a sshd_config(5)
   AcceptEnv pattern with a wildcard. OpenSSH prior to 6.6 could be
   tricked into accepting any enviornment variable that contains the
   characters before the wildcard character.

New / changed features:

 * ssh(1), sshd(8): this release removes the J-PAKE authentication code.
   This code was experimental, never enabled and had been unmaintained
   for some time.

 * ssh(1): when processing Match blocks, skip 'exec' clauses other clauses
   predicates failed to match.

 * ssh(1): if hostname canonicalisation is enabled and results in the
   destination hostname being changed, then re-parse ssh_config(5) files
   using the new destination hostname. This gives 'Host' and 'Match'
   directives that use the expanded hostname a chance to be applied.

Bugfixes:

 * ssh(1): avoid spurious "getsockname failed: Bad file descriptor" in
   ssh -W. bz#2200, debian#738692

 * sshd(8): allow the shutdown(2) syscall in seccomp-bpf and systrace
   sandbox modes, as it is reachable if the connection is terminated
   during the pre-auth phase.

 * ssh(1), sshd(8): fix unsigned overflow that in SSH protocol 1 bignum
   parsing. Minimum key length checks render this bug unexploitable to
   compromise SSH 1 sessions.

 * sshd_config(5): clarify behaviour of a keyword that appears in
   multiple matching Match blocks. bz#2184

 * ssh(1): avoid unnecessary hostname lookups when canonicalisation is
   disabled. bz#2205

 * sshd(8): avoid sandbox violation crashes in GSSAPI code by caching
   the supported list of GSSAPI mechanism OIDs before entering the
   sandbox. bz#2107

 * ssh(1): fix possible crashes in SOCKS4 parsing caused by assumption
   that the SOCKS username is nul-terminated.

 * ssh(1): fix regression for UsePrivilegedPort=yes when BindAddress is
   not specified.

 * ssh(1), sshd(8): fix memory leak in ECDSA signature verification.

 * ssh(1): fix matching of 'Host' directives in ssh_config(5) files
   to be case-insensitive again (regression in 6.5).

Portable OpenSSH:

 * sshd(8): don't fatal if the FreeBSD Capsicum is offered by the
   system headers and libc but is not supported by the kernel.
 * Fix build using the HP-UX compiler.

Changes since OpenSSH 6.4
=========================

This is a feature-focused release.

New features:

 * ssh(1), sshd(8): Add support for key exchange using elliptic-curve
   Diffie Hellman in Daniel Bernstein's Curve25519. This key exchange
   method is the default when both the client and server support it.

 * ssh(1), sshd(8): Add support for Ed25519 as a public key type.
   Ed25519 is a elliptic curve signature scheme that offers
   better security than ECDSA and DSA and good performance. It may be
   used for both user and host keys.

 * Add a new private key format that uses a bcrypt KDF to better
   protect keys at rest. This format is used unconditionally for
   Ed25519 keys, but may be requested when generating or saving
   existing keys of other types via the -o ssh-keygen(1) option.
   We intend to make the new format the default in the near future.
   Details of the new format are in the PROTOCOL.key file.

 * ssh(1), sshd(8): Add a new transport cipher
   "chacha20-poly1305%openssh.com@localhost" that combines Daniel Bernstein's
   ChaCha20 stream cipher and Poly1305 MAC to build an authenticated
   encryption mode. Details are in the PROTOCOL.chacha20poly1305 file.

 * ssh(1), sshd(8): Refuse RSA keys from old proprietary clients and
   servers that use the obsolete RSA+MD5 signature scheme. It will
   still be possible to connect with these clients/servers but only
   DSA keys will be accepted, and OpenSSH will refuse connection
   entirely in a future release.

 * ssh(1), sshd(8): Refuse old proprietary clients and servers that
   use a weaker key exchange hash calculation.

 * ssh(1): Increase the size of the Diffie-Hellman groups requested
   for each symmetric key size. New values from NIST Special
   Publication 800-57 with the upper limit specified by RFC4419.

 * ssh(1), ssh-agent(1): Support PKCS#11 tokens that only provide
   X.509 certs instead of raw public keys (requested as bz#1908).

 * ssh(1): Add a ssh_config(5) "Match" keyword that allows
   conditional configuration to be applied by matching on hostname,
   user and result of arbitrary commands.

 * ssh(1): Add support for client-side hostname canonicalisation
   using a set of DNS suffixes and rules in ssh_config(5). This
   allows unqualified names to be canonicalised to fully-qualified
   domain names to eliminate ambiguity when looking up keys in
   known_hosts or checking host certificate names.

 * sftp-server(8): Add the ability to whitelist and/or blacklist sftp
   protocol requests by name.

 * sftp-server(8): Add a sftp "fsync%openssh.com@localhost" to support calling
   fsync(2) on an open file handle.

 * sshd(8): Add a ssh_config(5) PermitTTY to disallow TTY allocation,
   mirroring the longstanding no-pty authorized_keys option.

 * ssh(1): Add a ssh_config ProxyUseFDPass option that supports the
   use of ProxyCommands that establish a connection and then pass a
   connected file descriptor back to ssh(1). This allows the
   ProxyCommand to exit rather than staying around to transfer data.

Bugfixes:

 * ssh(1), sshd(8): Fix potential stack exhaustion caused by nested
   certificates.

 * ssh(1): bz#1211: make BindAddress work with UsePrivilegedPort.

 * sftp(1): bz#2137: fix the progress meter for resumed transfer.

 * ssh-add(1): bz#2187: do not request smartcard PIN when removing
   keys from ssh-agent.

 * sshd(8): bz#2139: fix re-exec fallback when original sshd binary
   cannot be executed.

 * ssh-keygen(1): Make relative-specified certificate expiry times
   relative to current time and not the validity start time.

 * sshd(8): bz#2161: fix AuthorizedKeysCommand inside a Match block.

 * sftp(1): bz#2129: symlinking a file would incorrectly canonicalise
   the target path.

 * ssh-agent(1): bz#2175: fix a use-after-free in the PKCS#11 agent
   helper executable.

 * sshd(8): Improve logging of sessions to include the user name,
   remote host and port, the session type (shell, command, etc.) and
   allocated TTY (if any).

 * sshd(8): bz#1297: tell the client (via a debug message) when
   their preferred listen address has been overridden by the
   server's GatewayPorts setting.

 * sshd(8): bz#2162: include report port in bad protocol banner
   message.

 * sftp(1): bz#2163: fix memory leak in error path in do_readdir().

 * sftp(1): bz#2171: don't leak file descriptor on error.

 * sshd(8): Include the local address and port in "Connection from
   ..." message (only shown at loglevel>=verbose).

Portable OpenSSH:

 * Please note that this is the last version of Portable OpenSSH that
   will support versions of OpenSSL prior to 0.9.6. Support (i.e.
   SSH_OLD_EVP) will be removed following the 6.5p1 release.

 * Portable OpenSSH will attempt compile and link as a Position
   Independent Executable on Linux, OS X and OpenBSD on recent gcc-
   like compilers. Other platforms and older/other compilers may
   request this using the --with-pie configure flag.

 * A number of other toolchain-related hardening options are used
   automatically if available, including -ftrapv to abort on signed
   integer overflow and options to write-protect dynamic linking
   information.  The use of these options may be disabled using the
   --without-hardening configure flag.

 * If the toolchain supports it, one of the -fstack-protector-strong,
   -fstack-protector-all or -fstack-protector compilation flag are
   used to add guards to mitigate attacks based on stack overflows.
   The use of these options may be disabled using the
   --without-stackprotect configure option.

 * sshd(8): Add support for pre-authentication sandboxing using the
   Capsicum API introduced in FreeBSD 10.

 * Switch to a ChaCha20-based arc4random() PRNG for platforms that do
   not provide their own.

 * sshd(8): bz#2156: restore Linux oom_adj setting when handling
   SIGHUP to maintain behaviour over retart.

 * sshd(8): bz#2032: use local username in krb5_kuserok check rather
   than full client name which may be of form user@REALM.

 * ssh(1), sshd(8): Test for both the presence of ECC NID numbers in
   OpenSSL and that they actually work. Fedora (at least) has
   NID_secp521r1 that doesn't work.

 * bz#2173: use pkg-config --libs to include correct -L location for
   libedit.

Status:

Vendor Tag:     OPENSSH
Release Tags:   v67-20141018
                
U src/crypto/external/bsd/openssh/dist/PROTOCOL.agent
C src/crypto/external/bsd/openssh/dist/hostfile.c
U src/crypto/external/bsd/openssh/dist/LICENCE
U src/crypto/external/bsd/openssh/dist/OVERVIEW
C src/crypto/external/bsd/openssh/dist/PROTOCOL
N src/crypto/external/bsd/openssh/dist/PROTOCOL.chacha20poly1305
U src/crypto/external/bsd/openssh/dist/PROTOCOL.certkeys
C src/crypto/external/bsd/openssh/dist/auth-bsdauth.c
N src/crypto/external/bsd/openssh/dist/PROTOCOL.key
U src/crypto/external/bsd/openssh/dist/PROTOCOL.krl
U src/crypto/external/bsd/openssh/dist/PROTOCOL.mux
U src/crypto/external/bsd/openssh/dist/README
C src/crypto/external/bsd/openssh/dist/addrmatch.c
U src/crypto/external/bsd/openssh/dist/atomicio.c
U src/crypto/external/bsd/openssh/dist/atomicio.h
C src/crypto/external/bsd/openssh/dist/canohost.c
C src/crypto/external/bsd/openssh/dist/auth-chall.c
U src/crypto/external/bsd/openssh/dist/auth-krb5.c
C src/crypto/external/bsd/openssh/dist/auth-options.c
C src/crypto/external/bsd/openssh/dist/bufec.c
U src/crypto/external/bsd/openssh/dist/auth-options.h
N src/crypto/external/bsd/openssh/dist/hmac.h
C src/crypto/external/bsd/openssh/dist/auth-passwd.c
C src/crypto/external/bsd/openssh/dist/auth-rh-rsa.c
C src/crypto/external/bsd/openssh/dist/auth-rhosts.c
C src/crypto/external/bsd/openssh/dist/auth-rsa.c
C src/crypto/external/bsd/openssh/dist/auth.c
C src/crypto/external/bsd/openssh/dist/auth.h
C src/crypto/external/bsd/openssh/dist/auth1.c
C src/crypto/external/bsd/openssh/dist/auth2-chall.c
C src/crypto/external/bsd/openssh/dist/auth2-gss.c
C src/crypto/external/bsd/openssh/dist/auth2-hostbased.c
C src/crypto/external/bsd/openssh/dist/auth2-kbdint.c
C src/crypto/external/bsd/openssh/dist/auth2-none.c
C src/crypto/external/bsd/openssh/dist/auth2-passwd.c
C src/crypto/external/bsd/openssh/dist/auth2-pubkey.c
C src/crypto/external/bsd/openssh/dist/auth2.c
C src/crypto/external/bsd/openssh/dist/authfd.c
U src/crypto/external/bsd/openssh/dist/authfd.h
C src/crypto/external/bsd/openssh/dist/authfile.c
C src/crypto/external/bsd/openssh/dist/authfile.h
N src/crypto/external/bsd/openssh/dist/blocks.c
C src/crypto/external/bsd/openssh/dist/bufaux.c
C src/crypto/external/bsd/openssh/dist/bufbn.c
C src/crypto/external/bsd/openssh/dist/buffer.c
U src/crypto/external/bsd/openssh/dist/crc32.c
C src/crypto/external/bsd/openssh/dist/buffer.h
C src/crypto/external/bsd/openssh/dist/cipher-3des1.c
U src/crypto/external/bsd/openssh/dist/canohost.h
N src/crypto/external/bsd/openssh/dist/chacha.c
N src/crypto/external/bsd/openssh/dist/chacha.h
C src/crypto/external/bsd/openssh/dist/channels.c
C src/crypto/external/bsd/openssh/dist/channels.h
N src/crypto/external/bsd/openssh/dist/cipher-chachapoly.c
N src/crypto/external/bsd/openssh/dist/cipher-aesctr.c
N src/crypto/external/bsd/openssh/dist/cipher-aesctr.h
U src/crypto/external/bsd/openssh/dist/cipher-bf1.c
N src/crypto/external/bsd/openssh/dist/digest-libc.c
N src/crypto/external/bsd/openssh/dist/cipher-chachapoly.h
C src/crypto/external/bsd/openssh/dist/cipher.c
C src/crypto/external/bsd/openssh/dist/cipher.h
U src/crypto/external/bsd/openssh/dist/cleanup.c
C src/crypto/external/bsd/openssh/dist/clientloop.c
U src/crypto/external/bsd/openssh/dist/clientloop.h
C src/crypto/external/bsd/openssh/dist/compat.c
C src/crypto/external/bsd/openssh/dist/compat.h
U src/crypto/external/bsd/openssh/dist/compress.c
U src/crypto/external/bsd/openssh/dist/compress.h
U src/crypto/external/bsd/openssh/dist/crc32.h
C src/crypto/external/bsd/openssh/dist/dh.c
N src/crypto/external/bsd/openssh/dist/crypto_api.h
U src/crypto/external/bsd/openssh/dist/deattack.c
U src/crypto/external/bsd/openssh/dist/deattack.h
C src/crypto/external/bsd/openssh/dist/dh.h
N src/crypto/external/bsd/openssh/dist/ge25519_base.data
N src/crypto/external/bsd/openssh/dist/digest-openssl.c
N src/crypto/external/bsd/openssh/dist/digest.h
U src/crypto/external/bsd/openssh/dist/dispatch.c
U src/crypto/external/bsd/openssh/dist/dispatch.h
C src/crypto/external/bsd/openssh/dist/dns.c
C src/crypto/external/bsd/openssh/dist/dns.h
N src/crypto/external/bsd/openssh/dist/ed25519.c
U src/crypto/external/bsd/openssh/dist/fatal.c
N src/crypto/external/bsd/openssh/dist/fe25519.c
N src/crypto/external/bsd/openssh/dist/fe25519.h
N src/crypto/external/bsd/openssh/dist/ge25519.c
N src/crypto/external/bsd/openssh/dist/ge25519.h
U src/crypto/external/bsd/openssh/dist/groupaccess.c
U src/crypto/external/bsd/openssh/dist/groupaccess.h
C src/crypto/external/bsd/openssh/dist/gss-genr.c
C src/crypto/external/bsd/openssh/dist/match.c
U src/crypto/external/bsd/openssh/dist/gss-serv-krb5.c
C src/crypto/external/bsd/openssh/dist/gss-serv.c
N src/crypto/external/bsd/openssh/dist/hash.c
N src/crypto/external/bsd/openssh/dist/hmac.c
U src/crypto/external/bsd/openssh/dist/hostfile.h
C src/crypto/external/bsd/openssh/dist/kex.c
C src/crypto/external/bsd/openssh/dist/kex.h
N src/crypto/external/bsd/openssh/dist/kexc25519.c
N src/crypto/external/bsd/openssh/dist/kexc25519c.c
N src/crypto/external/bsd/openssh/dist/kexc25519s.c
C src/crypto/external/bsd/openssh/dist/kexdh.c
C src/crypto/external/bsd/openssh/dist/kexdhc.c
C src/crypto/external/bsd/openssh/dist/kexdhs.c
C src/crypto/external/bsd/openssh/dist/kexecdh.c
C src/crypto/external/bsd/openssh/dist/kexecdhc.c
C src/crypto/external/bsd/openssh/dist/kexecdhs.c
C src/crypto/external/bsd/openssh/dist/kexgex.c
C src/crypto/external/bsd/openssh/dist/kexgexc.c
C src/crypto/external/bsd/openssh/dist/kexgexs.c
C src/crypto/external/bsd/openssh/dist/key.c
C src/crypto/external/bsd/openssh/dist/key.h
C src/crypto/external/bsd/openssh/dist/krl.c
U src/crypto/external/bsd/openssh/dist/krl.h
U src/crypto/external/bsd/openssh/dist/log.c
U src/crypto/external/bsd/openssh/dist/log.h
C src/crypto/external/bsd/openssh/dist/mac.c
C src/crypto/external/bsd/openssh/dist/mac.h
U src/crypto/external/bsd/openssh/dist/match.h
C src/crypto/external/bsd/openssh/dist/misc.c
C src/crypto/external/bsd/openssh/dist/misc.h
C src/crypto/external/bsd/openssh/dist/monitor.c
C src/crypto/external/bsd/openssh/dist/moduli.c
U src/crypto/external/bsd/openssh/dist/monitor_fdpass.c
C src/crypto/external/bsd/openssh/dist/monitor.h
U src/crypto/external/bsd/openssh/dist/sandbox-systrace.c
U src/crypto/external/bsd/openssh/dist/monitor_fdpass.h
C src/crypto/external/bsd/openssh/dist/monitor_mm.c
C src/crypto/external/bsd/openssh/dist/monitor_mm.h
C src/crypto/external/bsd/openssh/dist/monitor_wrap.c
C src/crypto/external/bsd/openssh/dist/monitor_wrap.h
U src/crypto/external/bsd/openssh/dist/msg.c
U src/crypto/external/bsd/openssh/dist/msg.h
C src/crypto/external/bsd/openssh/dist/mux.c
C src/crypto/external/bsd/openssh/dist/myproposal.h
U src/crypto/external/bsd/openssh/dist/nchan.c
U src/crypto/external/bsd/openssh/dist/nchan.ms
U src/crypto/external/bsd/openssh/dist/nchan2.ms
C src/crypto/external/bsd/openssh/dist/packet.c
C src/crypto/external/bsd/openssh/dist/packet.h
C src/crypto/external/bsd/openssh/dist/pathnames.h
C src/crypto/external/bsd/openssh/dist/pkcs11.h
N src/crypto/external/bsd/openssh/dist/poly1305.c
N src/crypto/external/bsd/openssh/dist/poly1305.h
C src/crypto/external/bsd/openssh/dist/progressmeter.c
U src/crypto/external/bsd/openssh/dist/progressmeter.h
C src/crypto/external/bsd/openssh/dist/readconf.c
C src/crypto/external/bsd/openssh/dist/readconf.h
C src/crypto/external/bsd/openssh/dist/readpass.c
N src/crypto/external/bsd/openssh/dist/rijndael.c
N src/crypto/external/bsd/openssh/dist/rijndael.h
U src/crypto/external/bsd/openssh/dist/roaming.h
C src/crypto/external/bsd/openssh/dist/roaming_client.c
C src/crypto/external/bsd/openssh/dist/roaming_common.c
U src/crypto/external/bsd/openssh/dist/roaming_dummy.c
U src/crypto/external/bsd/openssh/dist/roaming_serv.c
C src/crypto/external/bsd/openssh/dist/rsa.c
C src/crypto/external/bsd/openssh/dist/rsa.h
U src/crypto/external/bsd/openssh/dist/sandbox-rlimit.c
C src/crypto/external/bsd/openssh/dist/sftp-client.c
N src/crypto/external/bsd/openssh/dist/sc25519.c
N src/crypto/external/bsd/openssh/dist/sc25519.h
C src/crypto/external/bsd/openssh/dist/scp.1
C src/crypto/external/bsd/openssh/dist/scp.c
C src/crypto/external/bsd/openssh/dist/servconf.c
C src/crypto/external/bsd/openssh/dist/servconf.h
C src/crypto/external/bsd/openssh/dist/serverloop.c
U src/crypto/external/bsd/openssh/dist/serverloop.h
C src/crypto/external/bsd/openssh/dist/session.c
C src/crypto/external/bsd/openssh/dist/session.h
U src/crypto/external/bsd/openssh/dist/sftp-server-main.c
C src/crypto/external/bsd/openssh/dist/sftp-client.h
C src/crypto/external/bsd/openssh/dist/sftp-common.c
U src/crypto/external/bsd/openssh/dist/sftp-common.h
C src/crypto/external/bsd/openssh/dist/sftp-glob.c
N src/crypto/external/bsd/openssh/dist/smult_curve25519_ref.c
C src/crypto/external/bsd/openssh/dist/sftp-server.8
C src/crypto/external/bsd/openssh/dist/sftp-server.c
C src/crypto/external/bsd/openssh/dist/sftp.1
C src/crypto/external/bsd/openssh/dist/sftp.c
U src/crypto/external/bsd/openssh/dist/sftp.h
C src/crypto/external/bsd/openssh/dist/ssh-pkcs11-client.c
C src/crypto/external/bsd/openssh/dist/ssh-add.1
C src/crypto/external/bsd/openssh/dist/ssh-add.c
C src/crypto/external/bsd/openssh/dist/ssh-agent.1
C src/crypto/external/bsd/openssh/dist/ssh-agent.c
C src/crypto/external/bsd/openssh/dist/ssh-dss.c
C src/crypto/external/bsd/openssh/dist/ssh-ecdsa.c
N src/crypto/external/bsd/openssh/dist/ssh-ed25519.c
C src/crypto/external/bsd/openssh/dist/ssh-gss.h
C src/crypto/external/bsd/openssh/dist/ssh-keygen.1
C src/crypto/external/bsd/openssh/dist/ssh-keygen.c
C src/crypto/external/bsd/openssh/dist/ssh-keyscan.1
C src/crypto/external/bsd/openssh/dist/ssh-keyscan.c
C src/crypto/external/bsd/openssh/dist/ssh-keysign.8
C src/crypto/external/bsd/openssh/dist/ssh-keysign.c
N src/crypto/external/bsd/openssh/dist/sshbuf-getput-basic.c
U src/crypto/external/bsd/openssh/dist/ssh-pkcs11-helper.8
C src/crypto/external/bsd/openssh/dist/ssh-pkcs11-helper.c
C src/crypto/external/bsd/openssh/dist/ssh-pkcs11.c
C src/crypto/external/bsd/openssh/dist/ssh-pkcs11.h
C src/crypto/external/bsd/openssh/dist/ssh-rsa.c
U src/crypto/external/bsd/openssh/dist/ssh-sandbox.h
C src/crypto/external/bsd/openssh/dist/ssh.1
C src/crypto/external/bsd/openssh/dist/ssh.c
U src/crypto/external/bsd/openssh/dist/ssh.h
U src/crypto/external/bsd/openssh/dist/ssh1.h
C src/crypto/external/bsd/openssh/dist/ssh2.h
C src/crypto/external/bsd/openssh/dist/ssh_config
C src/crypto/external/bsd/openssh/dist/ssh_config.5
C src/crypto/external/bsd/openssh/dist/sshd_config
C src/crypto/external/bsd/openssh/dist/sshd.8
N src/crypto/external/bsd/openssh/dist/sshbuf-getput-crypto.c
N src/crypto/external/bsd/openssh/dist/sshbuf-misc.c
N src/crypto/external/bsd/openssh/dist/sshbuf.c
N src/crypto/external/bsd/openssh/dist/sshbuf.h
C src/crypto/external/bsd/openssh/dist/sshconnect.c
C src/crypto/external/bsd/openssh/dist/sshconnect.h
C src/crypto/external/bsd/openssh/dist/sshconnect1.c
C src/crypto/external/bsd/openssh/dist/sshconnect2.c
C src/crypto/external/bsd/openssh/dist/sshd.c
C src/crypto/external/bsd/openssh/dist/sshd_config.5
N src/crypto/external/bsd/openssh/dist/ssherr.c
N src/crypto/external/bsd/openssh/dist/ssherr.h
N src/crypto/external/bsd/openssh/dist/sshkey.c
N src/crypto/external/bsd/openssh/dist/sshkey.h
C src/crypto/external/bsd/openssh/dist/sshlogin.c
U src/crypto/external/bsd/openssh/dist/sshlogin.h
U src/crypto/external/bsd/openssh/dist/sshpty.c
U src/crypto/external/bsd/openssh/dist/sshpty.h
U src/crypto/external/bsd/openssh/dist/sshtty.c
U src/crypto/external/bsd/openssh/dist/ttymodes.c
U src/crypto/external/bsd/openssh/dist/ttymodes.h
C src/crypto/external/bsd/openssh/dist/uidswap.c
U src/crypto/external/bsd/openssh/dist/uidswap.h
C src/crypto/external/bsd/openssh/dist/umac.c
U src/crypto/external/bsd/openssh/dist/umac.h
U src/crypto/external/bsd/openssh/dist/uuencode.c
U src/crypto/external/bsd/openssh/dist/uuencode.h
N src/crypto/external/bsd/openssh/dist/verify.c
C src/crypto/external/bsd/openssh/dist/version.h
C src/crypto/external/bsd/openssh/dist/xmalloc.c
U src/crypto/external/bsd/openssh/dist/xmalloc.h
N src/crypto/external/bsd/openssh/dist/moduli-gen/moduli-gen.sh
N src/crypto/external/bsd/openssh/dist/moduli-gen/Makefile
N src/crypto/external/bsd/openssh/dist/moduli-gen/moduli
N src/crypto/external/bsd/openssh/dist/moduli-gen/moduli.1024
N src/crypto/external/bsd/openssh/dist/moduli-gen/moduli.1536
N src/crypto/external/bsd/openssh/dist/moduli-gen/moduli.2048
N src/crypto/external/bsd/openssh/dist/moduli-gen/moduli.3072
N src/crypto/external/bsd/openssh/dist/moduli-gen/moduli.4096
N src/crypto/external/bsd/openssh/dist/moduli-gen/moduli.6144
N src/crypto/external/bsd/openssh/dist/moduli-gen/moduli.7680
N src/crypto/external/bsd/openssh/dist/moduli-gen/moduli.8192

135 conflicts created by this import.
Use the following command to help the merge:

        cvs checkout -jOPENSSH:yesterday -jOPENSSH src/crypto/external/bsd/openssh/dist