CVS import: src/crypto/external/bsd/openssh/dist

["Christos Zoulas" <christos%netbsd.org@localhost>]

Module Name:    src
Committed By:   christos
Date:           Fri Jul  3 00:54:48 UTC 2015

Update of /cvsroot/src/crypto/external/bsd/openssh/dist
In directory ivanova.netbsd.org:/tmp/cvs-serv21228

Log Message:
Changes since OpenSSH 6.8
=========================

This is primarily a bugfix release.

Security
--------

 * ssh(1): when forwarding X11 connections with ForwardX11Trusted=no,
   connections made after ForwardX11Timeout expired could be permitted
   and no longer subject to XSECURITY restrictions because of an
   ineffective timeout check in ssh(1) coupled with "fail open"
   behaviour in the X11 server when clients attempted connections with
   expired credentials. This problem was reported by Jann Horn.

 * ssh-agent(1): fix weakness of agent locking (ssh-add -x) to
   password guessing by implementing an increasing failure delay,
   storing a salted hash of the password rather than the password
   itself and using a timing-safe comparison function for verifying
   unlock attempts. This problem was reported by Ryan Castellucci.

New Features
------------

 * ssh(1), sshd(8): promote chacha20-poly1305%openssh.com@localhost to be the
   default cipher

 * sshd(8): support admin-specified arguments to AuthorizedKeysCommand;
   bz#2081

 * sshd(8): add AuthorizedPrincipalsCommand that allows retrieving
   authorized principals information from a subprocess rather than
   a file.

 * ssh(1), ssh-add(1): support PKCS#11 devices with external PIN
   entry devices bz#2240

 * sshd(8): allow GSSAPI host credential check to be relaxed for
   multihomed hosts via GSSAPIStrictAcceptorCheck option; bz#928

 * ssh-keygen(1): support "ssh-keygen -lF hostname" to search
   known_hosts and print key hashes rather than full keys.

 * ssh-agent(1): add -D flag to leave ssh-agent in foreground without
   enabling debug mode; bz#2381

Bugfixes
--------

 * ssh(1), sshd(8): deprecate legacy SSH2_MSG_KEX_DH_GEX_REQUEST_OLD
   message and do not try to use it against some 3rd-party SSH
   implementations that use it (older PuTTY, WinSCP).

 * Many fixes for problems caused by compile-time deactivation of
   SSH1 support (including bz#2369)

 * ssh(1), sshd(8): cap DH-GEX group size at 4Kbits for Cisco
   implementations as some would fail when attempting to use group
   sizes >4K; bz#2209

 * ssh(1): fix out-of-bound read in EscapeChar configuration option
   parsing; bz#2396

 * sshd(8): fix application of PermitTunnel, LoginGraceTime,
   AuthenticationMethods and StreamLocalBindMask options in Match
   blocks

 * ssh(1), sshd(8): improve disconnection message on TCP reset;
   bz#2257

 * ssh(1): remove failed remote forwards established by muliplexing
   from the list of active forwards; bz#2363

 * sshd(8): make parsing of authorized_keys "environment=" options
   independent of PermitUserEnv being enabled; bz#2329

 * sshd(8): fix post-auth crash with permitopen=none; bz#2355

 * ssh(1), ssh-add(1), ssh-keygen(1): allow new-format private keys
   to be encrypted with AEAD ciphers; bz#2366

 * ssh(1): allow ListenAddress, Port and AddressFamily configuration
   options to appear in any order; bz#86

 * sshd(8): check for and reject missing arguments for VersionAddendum
   and ForceCommand; bz#2281

 * ssh(1), sshd(8): don't treat unknown certificate extensions as
   fatal; bz#2387

 * ssh-keygen(1): make stdout and stderr output consistent; bz#2325

 * ssh(1): mention missing DISPLAY environment in debug log when X11
   forwarding requested; bz#1682

 * sshd(8): correctly record login when UseLogin is set; bz#378

 * sshd(8): Add some missing options to sshd -T output and fix output
   of VersionAddendum and HostCertificate. bz#2346   

 * Document and improve consistency of options that accept a "none"
   argument" TrustedUserCAKeys, RevokedKeys (bz#2382),
   AuthorizedPrincipalsFile (bz#2288)

 * ssh(1): include remote username in debug output; bz#2368

 * sshd(8): avoid compatibility problem with some versions of Tera
   Term, which would crash when they received the hostkeys notification
   message (hostkeys-00%openssh.com@localhost)

 * sshd(8): mention ssh-keygen -E as useful when comparing legacy MD5
   host key fingerprints; bz#2332

 * ssh(1): clarify pseudo-terminal request behaviour and use make
   manual language consistent; bz#1716

 * ssh(1): document that the TERM environment variable is not subject
   to SendEnv and AcceptEnv; bz#2386


Status:

Vendor Tag:     OPENSSH
Release Tags:   v69-20150530
                
C src/crypto/external/bsd/openssh/dist/PROTOCOL.agent
C src/crypto/external/bsd/openssh/dist/hostfile.c
U src/crypto/external/bsd/openssh/dist/LICENCE
U src/crypto/external/bsd/openssh/dist/OVERVIEW
C src/crypto/external/bsd/openssh/dist/PROTOCOL
U src/crypto/external/bsd/openssh/dist/PROTOCOL.chacha20poly1305
U src/crypto/external/bsd/openssh/dist/PROTOCOL.certkeys
U src/crypto/external/bsd/openssh/dist/auth-bsdauth.c
U src/crypto/external/bsd/openssh/dist/PROTOCOL.key
U src/crypto/external/bsd/openssh/dist/PROTOCOL.krl
U src/crypto/external/bsd/openssh/dist/PROTOCOL.mux
U src/crypto/external/bsd/openssh/dist/README
U src/crypto/external/bsd/openssh/dist/addrmatch.c
U src/crypto/external/bsd/openssh/dist/atomicio.c
U src/crypto/external/bsd/openssh/dist/atomicio.h
U src/crypto/external/bsd/openssh/dist/canohost.c
U src/crypto/external/bsd/openssh/dist/auth-chall.c
U src/crypto/external/bsd/openssh/dist/auth-krb5.c
C src/crypto/external/bsd/openssh/dist/auth-options.c
U src/crypto/external/bsd/openssh/dist/auth-options.h
C src/crypto/external/bsd/openssh/dist/hmac.c
U src/crypto/external/bsd/openssh/dist/auth-passwd.c
U src/crypto/external/bsd/openssh/dist/auth-rh-rsa.c
U src/crypto/external/bsd/openssh/dist/auth-rhosts.c
U src/crypto/external/bsd/openssh/dist/auth-rsa.c
C src/crypto/external/bsd/openssh/dist/auth.c
C src/crypto/external/bsd/openssh/dist/auth.h
U src/crypto/external/bsd/openssh/dist/auth1.c
U src/crypto/external/bsd/openssh/dist/auth2-chall.c
U src/crypto/external/bsd/openssh/dist/auth2-gss.c
C src/crypto/external/bsd/openssh/dist/auth2-hostbased.c
U src/crypto/external/bsd/openssh/dist/auth2-kbdint.c
U src/crypto/external/bsd/openssh/dist/auth2-none.c
U src/crypto/external/bsd/openssh/dist/auth2-passwd.c
C src/crypto/external/bsd/openssh/dist/auth2-pubkey.c
U src/crypto/external/bsd/openssh/dist/auth2.c
C src/crypto/external/bsd/openssh/dist/authfd.c
U src/crypto/external/bsd/openssh/dist/authfd.h
C src/crypto/external/bsd/openssh/dist/authfile.c
U src/crypto/external/bsd/openssh/dist/authfile.h
U src/crypto/external/bsd/openssh/dist/bitmap.c
U src/crypto/external/bsd/openssh/dist/bitmap.h
U src/crypto/external/bsd/openssh/dist/blocks.c
U src/crypto/external/bsd/openssh/dist/bufaux.c
U src/crypto/external/bsd/openssh/dist/bufbn.c
U src/crypto/external/bsd/openssh/dist/bufec.c
U src/crypto/external/bsd/openssh/dist/buffer.c
U src/crypto/external/bsd/openssh/dist/buffer.h
U src/crypto/external/bsd/openssh/dist/cipher-3des1.c
U src/crypto/external/bsd/openssh/dist/canohost.h
U src/crypto/external/bsd/openssh/dist/chacha.c
U src/crypto/external/bsd/openssh/dist/chacha.h
C src/crypto/external/bsd/openssh/dist/channels.c
C src/crypto/external/bsd/openssh/dist/channels.h
U src/crypto/external/bsd/openssh/dist/cipher-chachapoly.c
U src/crypto/external/bsd/openssh/dist/cipher-aesctr.c
U src/crypto/external/bsd/openssh/dist/cipher-aesctr.h
U src/crypto/external/bsd/openssh/dist/cipher-bf1.c
U src/crypto/external/bsd/openssh/dist/crypto_api.h
C src/crypto/external/bsd/openssh/dist/compat.c
U src/crypto/external/bsd/openssh/dist/cipher-chachapoly.h
U src/crypto/external/bsd/openssh/dist/cipher.c
U src/crypto/external/bsd/openssh/dist/cipher.h
U src/crypto/external/bsd/openssh/dist/cleanup.c
C src/crypto/external/bsd/openssh/dist/clientloop.c
U src/crypto/external/bsd/openssh/dist/clientloop.h
U src/crypto/external/bsd/openssh/dist/crc32.c
C src/crypto/external/bsd/openssh/dist/compat.h
U src/crypto/external/bsd/openssh/dist/crc32.h
C src/crypto/external/bsd/openssh/dist/digest-libc.c
U src/crypto/external/bsd/openssh/dist/deattack.c
U src/crypto/external/bsd/openssh/dist/deattack.h
C src/crypto/external/bsd/openssh/dist/dh.c
C src/crypto/external/bsd/openssh/dist/dh.h
U src/crypto/external/bsd/openssh/dist/ge25519_base.data
U src/crypto/external/bsd/openssh/dist/digest-openssl.c
U src/crypto/external/bsd/openssh/dist/digest.h
C src/crypto/external/bsd/openssh/dist/dispatch.c
U src/crypto/external/bsd/openssh/dist/dispatch.h
U src/crypto/external/bsd/openssh/dist/dns.c
C src/crypto/external/bsd/openssh/dist/dns.h
U src/crypto/external/bsd/openssh/dist/ed25519.c
U src/crypto/external/bsd/openssh/dist/fatal.c
U src/crypto/external/bsd/openssh/dist/fe25519.c
U src/crypto/external/bsd/openssh/dist/fe25519.h
U src/crypto/external/bsd/openssh/dist/ge25519.c
U src/crypto/external/bsd/openssh/dist/ge25519.h
C src/crypto/external/bsd/openssh/dist/match.c
C src/crypto/external/bsd/openssh/dist/groupaccess.c
U src/crypto/external/bsd/openssh/dist/groupaccess.h
U src/crypto/external/bsd/openssh/dist/gss-genr.c
U src/crypto/external/bsd/openssh/dist/gss-serv-krb5.c
C src/crypto/external/bsd/openssh/dist/gss-serv.c
U src/crypto/external/bsd/openssh/dist/hash.c
U src/crypto/external/bsd/openssh/dist/hmac.h
U src/crypto/external/bsd/openssh/dist/hostfile.h
C src/crypto/external/bsd/openssh/dist/kex.c
U src/crypto/external/bsd/openssh/dist/kex.h
C src/crypto/external/bsd/openssh/dist/kexc25519.c
U src/crypto/external/bsd/openssh/dist/kexc25519c.c
C src/crypto/external/bsd/openssh/dist/kexc25519s.c
U src/crypto/external/bsd/openssh/dist/kexdh.c
U src/crypto/external/bsd/openssh/dist/kexdhc.c
U src/crypto/external/bsd/openssh/dist/kexdhs.c
U src/crypto/external/bsd/openssh/dist/kexecdh.c
U src/crypto/external/bsd/openssh/dist/kexecdhc.c
U src/crypto/external/bsd/openssh/dist/kexecdhs.c
U src/crypto/external/bsd/openssh/dist/kexgex.c
C src/crypto/external/bsd/openssh/dist/kexgexc.c
C src/crypto/external/bsd/openssh/dist/kexgexs.c
U src/crypto/external/bsd/openssh/dist/key.c
U src/crypto/external/bsd/openssh/dist/key.h
C src/crypto/external/bsd/openssh/dist/krl.c
U src/crypto/external/bsd/openssh/dist/krl.h
U src/crypto/external/bsd/openssh/dist/log.c
U src/crypto/external/bsd/openssh/dist/log.h
U src/crypto/external/bsd/openssh/dist/mac.c
U src/crypto/external/bsd/openssh/dist/mac.h
C src/crypto/external/bsd/openssh/dist/match.h
C src/crypto/external/bsd/openssh/dist/misc.c
C src/crypto/external/bsd/openssh/dist/monitor.c
U src/crypto/external/bsd/openssh/dist/misc.h
U src/crypto/external/bsd/openssh/dist/moduli.c
U src/crypto/external/bsd/openssh/dist/monitor_fdpass.c
U src/crypto/external/bsd/openssh/dist/monitor.h
U src/crypto/external/bsd/openssh/dist/sandbox-systrace.c
U src/crypto/external/bsd/openssh/dist/monitor_fdpass.h
U src/crypto/external/bsd/openssh/dist/monitor_mm.c
U src/crypto/external/bsd/openssh/dist/monitor_mm.h
C src/crypto/external/bsd/openssh/dist/monitor_wrap.c
C src/crypto/external/bsd/openssh/dist/monitor_wrap.h
U src/crypto/external/bsd/openssh/dist/msg.c
U src/crypto/external/bsd/openssh/dist/msg.h
C src/crypto/external/bsd/openssh/dist/mux.c
C src/crypto/external/bsd/openssh/dist/myproposal.h
U src/crypto/external/bsd/openssh/dist/nchan.c
U src/crypto/external/bsd/openssh/dist/nchan.ms
U src/crypto/external/bsd/openssh/dist/nchan2.ms
C src/crypto/external/bsd/openssh/dist/opacket.c
U src/crypto/external/bsd/openssh/dist/opacket.h
C src/crypto/external/bsd/openssh/dist/packet.c
U src/crypto/external/bsd/openssh/dist/packet.h
U src/crypto/external/bsd/openssh/dist/pathnames.h
U src/crypto/external/bsd/openssh/dist/pkcs11.h
U src/crypto/external/bsd/openssh/dist/poly1305.c
U src/crypto/external/bsd/openssh/dist/rsa.c
U src/crypto/external/bsd/openssh/dist/poly1305.h
U src/crypto/external/bsd/openssh/dist/progressmeter.c
U src/crypto/external/bsd/openssh/dist/progressmeter.h
C src/crypto/external/bsd/openssh/dist/readconf.c
U src/crypto/external/bsd/openssh/dist/readconf.h
U src/crypto/external/bsd/openssh/dist/readpass.c
U src/crypto/external/bsd/openssh/dist/rijndael.c
U src/crypto/external/bsd/openssh/dist/rijndael.h
U src/crypto/external/bsd/openssh/dist/roaming.h
U src/crypto/external/bsd/openssh/dist/roaming_client.c
U src/crypto/external/bsd/openssh/dist/roaming_common.c
U src/crypto/external/bsd/openssh/dist/roaming_dummy.c
U src/crypto/external/bsd/openssh/dist/roaming_serv.c
U src/crypto/external/bsd/openssh/dist/rsa.h
U src/crypto/external/bsd/openssh/dist/sandbox-rlimit.c
C src/crypto/external/bsd/openssh/dist/sftp-client.c
U src/crypto/external/bsd/openssh/dist/sc25519.c
U src/crypto/external/bsd/openssh/dist/sc25519.h
U src/crypto/external/bsd/openssh/dist/scp.1
C src/crypto/external/bsd/openssh/dist/scp.c
C src/crypto/external/bsd/openssh/dist/servconf.c
C src/crypto/external/bsd/openssh/dist/servconf.h
U src/crypto/external/bsd/openssh/dist/serverloop.c
U src/crypto/external/bsd/openssh/dist/serverloop.h
C src/crypto/external/bsd/openssh/dist/session.c
U src/crypto/external/bsd/openssh/dist/session.h
U src/crypto/external/bsd/openssh/dist/sftp-server-main.c
C src/crypto/external/bsd/openssh/dist/sftp-client.h
U src/crypto/external/bsd/openssh/dist/sftp-common.c
U src/crypto/external/bsd/openssh/dist/sftp-common.h
U src/crypto/external/bsd/openssh/dist/sftp-glob.c
U src/crypto/external/bsd/openssh/dist/smult_curve25519_ref.c
U src/crypto/external/bsd/openssh/dist/sftp-server.8
C src/crypto/external/bsd/openssh/dist/sftp-server.c
U src/crypto/external/bsd/openssh/dist/sftp.1
U src/crypto/external/bsd/openssh/dist/sftp.c
U src/crypto/external/bsd/openssh/dist/sftp.h
U src/crypto/external/bsd/openssh/dist/ssh-ed25519.c
C src/crypto/external/bsd/openssh/dist/ssh-add.1
C src/crypto/external/bsd/openssh/dist/ssh-add.c
C src/crypto/external/bsd/openssh/dist/ssh-agent.1
C src/crypto/external/bsd/openssh/dist/ssh-agent.c
U src/crypto/external/bsd/openssh/dist/ssh-dss.c
U src/crypto/external/bsd/openssh/dist/ssh-ecdsa.c
C src/crypto/external/bsd/openssh/dist/ssh.1
U src/crypto/external/bsd/openssh/dist/ssh-gss.h
U src/crypto/external/bsd/openssh/dist/ssh-keyscan.1
U src/crypto/external/bsd/openssh/dist/ssh-keygen.1
C src/crypto/external/bsd/openssh/dist/ssh-keygen.c
U src/crypto/external/bsd/openssh/dist/ssh-pkcs11-client.c
C src/crypto/external/bsd/openssh/dist/ssh-keyscan.c
U src/crypto/external/bsd/openssh/dist/ssh-keysign.8
C src/crypto/external/bsd/openssh/dist/ssh-keysign.c
C src/crypto/external/bsd/openssh/dist/sshbuf-misc.c
U src/crypto/external/bsd/openssh/dist/ssh-pkcs11-helper.8
U src/crypto/external/bsd/openssh/dist/ssh-pkcs11-helper.c
C src/crypto/external/bsd/openssh/dist/ssh-pkcs11.c
U src/crypto/external/bsd/openssh/dist/ssh-pkcs11.h
C src/crypto/external/bsd/openssh/dist/ssh-rsa.c
U src/crypto/external/bsd/openssh/dist/ssh-sandbox.h
C src/crypto/external/bsd/openssh/dist/ssh.c
U src/crypto/external/bsd/openssh/dist/ssh.h
U src/crypto/external/bsd/openssh/dist/ssh1.h
U src/crypto/external/bsd/openssh/dist/ssh2.h
U src/crypto/external/bsd/openssh/dist/ssh_api.c
U src/crypto/external/bsd/openssh/dist/ssh_api.h
U src/crypto/external/bsd/openssh/dist/ssh_config
C src/crypto/external/bsd/openssh/dist/ssh_config.5
C src/crypto/external/bsd/openssh/dist/sshd_config
C src/crypto/external/bsd/openssh/dist/sshd.8
U src/crypto/external/bsd/openssh/dist/sshbuf-getput-basic.c
U src/crypto/external/bsd/openssh/dist/sshbuf-getput-crypto.c
U src/crypto/external/bsd/openssh/dist/sshbuf.c
U src/crypto/external/bsd/openssh/dist/sshbuf.h
C src/crypto/external/bsd/openssh/dist/sshconnect.c
U src/crypto/external/bsd/openssh/dist/sshconnect.h
U src/crypto/external/bsd/openssh/dist/sshconnect1.c
C src/crypto/external/bsd/openssh/dist/sshconnect2.c
C src/crypto/external/bsd/openssh/dist/sshd.c
U src/crypto/external/bsd/openssh/dist/ttymodes.c
C src/crypto/external/bsd/openssh/dist/sshd_config.5
U src/crypto/external/bsd/openssh/dist/ssherr.c
U src/crypto/external/bsd/openssh/dist/ssherr.h
C src/crypto/external/bsd/openssh/dist/sshkey.c
U src/crypto/external/bsd/openssh/dist/sshkey.h
U src/crypto/external/bsd/openssh/dist/sshlogin.c
U src/crypto/external/bsd/openssh/dist/sshlogin.h
U src/crypto/external/bsd/openssh/dist/sshpty.c
U src/crypto/external/bsd/openssh/dist/sshpty.h
U src/crypto/external/bsd/openssh/dist/sshtty.c
U src/crypto/external/bsd/openssh/dist/ttymodes.h
U src/crypto/external/bsd/openssh/dist/umac.c
C src/crypto/external/bsd/openssh/dist/uidswap.c
U src/crypto/external/bsd/openssh/dist/uidswap.h
U src/crypto/external/bsd/openssh/dist/umac.h
C src/crypto/external/bsd/openssh/dist/uuencode.c
U src/crypto/external/bsd/openssh/dist/uuencode.h
U src/crypto/external/bsd/openssh/dist/verify.c
C src/crypto/external/bsd/openssh/dist/version.h
C src/crypto/external/bsd/openssh/dist/xmalloc.c
C src/crypto/external/bsd/openssh/dist/xmalloc.h
U src/crypto/external/bsd/openssh/dist/moduli-gen/moduli-gen.sh
U src/crypto/external/bsd/openssh/dist/moduli-gen/Makefile
U src/crypto/external/bsd/openssh/dist/moduli-gen/moduli.1536
U src/crypto/external/bsd/openssh/dist/moduli-gen/moduli.2048
U src/crypto/external/bsd/openssh/dist/moduli-gen/moduli.3072
U src/crypto/external/bsd/openssh/dist/moduli-gen/moduli.4096
U src/crypto/external/bsd/openssh/dist/moduli-gen/moduli.6144
U src/crypto/external/bsd/openssh/dist/moduli-gen/moduli.7680
U src/crypto/external/bsd/openssh/dist/moduli-gen/moduli.8192

72 conflicts created by this import.
Use the following command to help the merge:

        cvs checkout -jOPENSSH:yesterday -jOPENSSH src/crypto/external/bsd/openssh/dist