CVS import: src/crypto/external/bsd/openssh/dist

["Christos Zoulas" <christos%netbsd.org@localhost>]

Module Name:    src
Committed By:   christos
Date:           Sun Dec 25 00:00:17 UTC 2016

Update of /cvsroot/src/crypto/external/bsd/openssh/dist
In directory ivanova.netbsd.org:/tmp/cvs-serv20944

Log Message:
Import OpenSSH-7.4

OpenSSH 7.4 has just been released. It will be available from the
mirrors listed at http://www.openssh.com/ shortly.

OpenSSH is a 100% complete SSH protocol 2.0 implementation and
includes sftp client and server support. OpenSSH also includes
transitional support for the legacy SSH 1.3 and 1.5 protocols
that may be enabled at compile-time.

Once again, we would like to thank the OpenSSH community for their
continued support of the project, especially those who contributed
code or patches, reported bugs, tested snapshots or donated to the
project. More information on donations may be found at:
http://www.openssh.com/donations.html

Future deprecation notice
=========================

We plan on retiring more legacy cryptography in future releases,
specifically:

 * In approximately August 2017, removing remaining support for the
   SSH v.1 protocol (client-only and currently compile-time disabled).

 * In the same release, removing support for Blowfish and RC4 ciphers
   and the RIPE-MD160 HMAC. (These are currently run-time disabled).

 * Refusing all RSA keys smaller than 1024 bits (the current minimum
   is 768 bits)

 * The next release of OpenSSH will remove support for running sshd(8)
   with privilege separation disabled.

 * The next release of portable OpenSSH will remove support for
   OpenSSL version prior to 1.0.1.

This list reflects our current intentions, but please check the final
release notes for future releases.

Potentially-incompatible changes
================================

This release includes a number of changes that may affect existing
configurations:

 * This release removes server support for the SSH v.1 protocol.

 * ssh(1): Remove 3des-cbc from the client's default proposal. 64-bit
   block ciphers are not safe in 2016 and we don't want to wait until
   attacks like SWEET32 are extended to SSH. As 3des-cbc was the
   only mandatory cipher in the SSH RFCs, this may cause problems
   connecting to older devices using the default configuration,
   but it's highly likely that such devices already need explicit
   configuration for key exchange and hostkey algorithms already
   anyway.
    
 * sshd(8): Remove support for pre-authentication compression.
   Doing compression early in the protocol probably seemed reasonable
   in the 1990s, but today it's clearly a bad idea in terms of both
   cryptography (cf. multiple compression oracle attacks in TLS) and
   attack surface. Pre-auth compression support has been disabled by
   default for >10 years. Support remains in the client.
    
 * ssh-agent will refuse to load PKCS#11 modules outside a whitelist
   of trusted paths by default. The path whitelist may be specified
   at run-time.

 * sshd(8): When a forced-command appears in both a certificate and
   an authorized keys/principals command= restriction, sshd will now
   refuse to accept the certificate unless they are identical.
   The previous (documented) behaviour of having the certificate
   forced-command override the other could be a bit confusing and
   error-prone.
    
 * sshd(8): Remove the UseLogin configuration directive and support
   for having /bin/login manage login sessions.
    

Status:

Vendor Tag:     OPENSSH
Release Tags:   v74-20161219
                
U src/crypto/external/bsd/openssh/dist/PROTOCOL.agent
U src/crypto/external/bsd/openssh/dist/kexc25519.c
U src/crypto/external/bsd/openssh/dist/LICENCE
U src/crypto/external/bsd/openssh/dist/OVERVIEW
U src/crypto/external/bsd/openssh/dist/PROTOCOL
U src/crypto/external/bsd/openssh/dist/PROTOCOL.chacha20poly1305
U src/crypto/external/bsd/openssh/dist/PROTOCOL.certkeys
U src/crypto/external/bsd/openssh/dist/auth-bsdauth.c
U src/crypto/external/bsd/openssh/dist/PROTOCOL.key
U src/crypto/external/bsd/openssh/dist/PROTOCOL.krl
U src/crypto/external/bsd/openssh/dist/PROTOCOL.mux
U src/crypto/external/bsd/openssh/dist/README
C src/crypto/external/bsd/openssh/dist/addrmatch.c
C src/crypto/external/bsd/openssh/dist/atomicio.c
U src/crypto/external/bsd/openssh/dist/atomicio.h
C src/crypto/external/bsd/openssh/dist/auth-options.c
U src/crypto/external/bsd/openssh/dist/auth-krb5.c
U src/crypto/external/bsd/openssh/dist/auth2-hostbased.c
C src/crypto/external/bsd/openssh/dist/auth-options.h
U src/crypto/external/bsd/openssh/dist/auth-passwd.c
C src/crypto/external/bsd/openssh/dist/kex.h
C src/crypto/external/bsd/openssh/dist/auth-rhosts.c
C src/crypto/external/bsd/openssh/dist/auth.c
C src/crypto/external/bsd/openssh/dist/auth.h
U src/crypto/external/bsd/openssh/dist/auth2-chall.c
U src/crypto/external/bsd/openssh/dist/auth2-gss.c
U src/crypto/external/bsd/openssh/dist/auth2-kbdint.c
U src/crypto/external/bsd/openssh/dist/auth2-none.c
U src/crypto/external/bsd/openssh/dist/auth2-passwd.c
C src/crypto/external/bsd/openssh/dist/auth2-pubkey.c
U src/crypto/external/bsd/openssh/dist/auth2.c
U src/crypto/external/bsd/openssh/dist/authfd.c
U src/crypto/external/bsd/openssh/dist/authfd.h
C src/crypto/external/bsd/openssh/dist/authfile.c
U src/crypto/external/bsd/openssh/dist/authfile.h
U src/crypto/external/bsd/openssh/dist/bitmap.c
U src/crypto/external/bsd/openssh/dist/bitmap.h
U src/crypto/external/bsd/openssh/dist/blocks.c
U src/crypto/external/bsd/openssh/dist/bufaux.c
U src/crypto/external/bsd/openssh/dist/bufbn.c
U src/crypto/external/bsd/openssh/dist/bufec.c
U src/crypto/external/bsd/openssh/dist/buffer.c
U src/crypto/external/bsd/openssh/dist/buffer.h
U src/crypto/external/bsd/openssh/dist/cipher-3des1.c
U src/crypto/external/bsd/openssh/dist/canohost.c
U src/crypto/external/bsd/openssh/dist/canohost.h
U src/crypto/external/bsd/openssh/dist/chacha.c
U src/crypto/external/bsd/openssh/dist/chacha.h
C src/crypto/external/bsd/openssh/dist/channels.c
C src/crypto/external/bsd/openssh/dist/channels.h
C src/crypto/external/bsd/openssh/dist/cipher-chachapoly.c
U src/crypto/external/bsd/openssh/dist/cipher-aesctr.c
U src/crypto/external/bsd/openssh/dist/cipher-aesctr.h
U src/crypto/external/bsd/openssh/dist/cipher-bf1.c
U src/crypto/external/bsd/openssh/dist/digest.h
C src/crypto/external/bsd/openssh/dist/dh.c
U src/crypto/external/bsd/openssh/dist/cipher-chachapoly.h
C src/crypto/external/bsd/openssh/dist/cipher.c
C src/crypto/external/bsd/openssh/dist/cipher.h
U src/crypto/external/bsd/openssh/dist/cleanup.c
C src/crypto/external/bsd/openssh/dist/clientloop.c
C src/crypto/external/bsd/openssh/dist/clientloop.h
U src/crypto/external/bsd/openssh/dist/compat.c
U src/crypto/external/bsd/openssh/dist/compat.h
U src/crypto/external/bsd/openssh/dist/crc32.c
U src/crypto/external/bsd/openssh/dist/crc32.h
U src/crypto/external/bsd/openssh/dist/crypto_api.h
U src/crypto/external/bsd/openssh/dist/deattack.c
U src/crypto/external/bsd/openssh/dist/deattack.h
U src/crypto/external/bsd/openssh/dist/dh.h
U src/crypto/external/bsd/openssh/dist/ge25519_base.data
U src/crypto/external/bsd/openssh/dist/digest-libc.c
U src/crypto/external/bsd/openssh/dist/digest-openssl.c
U src/crypto/external/bsd/openssh/dist/dispatch.c
U src/crypto/external/bsd/openssh/dist/dispatch.h
U src/crypto/external/bsd/openssh/dist/dns.c
U src/crypto/external/bsd/openssh/dist/dns.h
U src/crypto/external/bsd/openssh/dist/ed25519.c
U src/crypto/external/bsd/openssh/dist/fatal.c
U src/crypto/external/bsd/openssh/dist/fe25519.c
U src/crypto/external/bsd/openssh/dist/fe25519.h
U src/crypto/external/bsd/openssh/dist/ge25519.c
U src/crypto/external/bsd/openssh/dist/ge25519.h
U src/crypto/external/bsd/openssh/dist/monitor_fdpass.c
U src/crypto/external/bsd/openssh/dist/groupaccess.c
U src/crypto/external/bsd/openssh/dist/groupaccess.h
C src/crypto/external/bsd/openssh/dist/gss-genr.c
U src/crypto/external/bsd/openssh/dist/gss-serv-krb5.c
U src/crypto/external/bsd/openssh/dist/gss-serv.c
U src/crypto/external/bsd/openssh/dist/hash.c
U src/crypto/external/bsd/openssh/dist/hmac.c
U src/crypto/external/bsd/openssh/dist/hmac.h
C src/crypto/external/bsd/openssh/dist/hostfile.c
U src/crypto/external/bsd/openssh/dist/hostfile.h
C src/crypto/external/bsd/openssh/dist/kex.c
U src/crypto/external/bsd/openssh/dist/kexc25519c.c
U src/crypto/external/bsd/openssh/dist/kexc25519s.c
U src/crypto/external/bsd/openssh/dist/kexdh.c
U src/crypto/external/bsd/openssh/dist/kexdhc.c
U src/crypto/external/bsd/openssh/dist/kexdhs.c
U src/crypto/external/bsd/openssh/dist/kexecdh.c
U src/crypto/external/bsd/openssh/dist/kexecdhc.c
U src/crypto/external/bsd/openssh/dist/kexecdhs.c
U src/crypto/external/bsd/openssh/dist/kexgex.c
C src/crypto/external/bsd/openssh/dist/kexgexc.c
C src/crypto/external/bsd/openssh/dist/kexgexs.c
U src/crypto/external/bsd/openssh/dist/key.c
C src/crypto/external/bsd/openssh/dist/key.h
C src/crypto/external/bsd/openssh/dist/krl.c
U src/crypto/external/bsd/openssh/dist/krl.h
U src/crypto/external/bsd/openssh/dist/log.c
U src/crypto/external/bsd/openssh/dist/log.h
U src/crypto/external/bsd/openssh/dist/mac.c
U src/crypto/external/bsd/openssh/dist/mac.h
C src/crypto/external/bsd/openssh/dist/match.c
U src/crypto/external/bsd/openssh/dist/match.h
C src/crypto/external/bsd/openssh/dist/misc.c
C src/crypto/external/bsd/openssh/dist/misc.h
U src/crypto/external/bsd/openssh/dist/nchan.c
C src/crypto/external/bsd/openssh/dist/moduli.c
C src/crypto/external/bsd/openssh/dist/monitor.c
C src/crypto/external/bsd/openssh/dist/monitor.h
U src/crypto/external/bsd/openssh/dist/msg.c
U src/crypto/external/bsd/openssh/dist/monitor_fdpass.h
C src/crypto/external/bsd/openssh/dist/monitor_wrap.c
C src/crypto/external/bsd/openssh/dist/monitor_wrap.h
U src/crypto/external/bsd/openssh/dist/msg.h
C src/crypto/external/bsd/openssh/dist/mux.c
U src/crypto/external/bsd/openssh/dist/progressmeter.c
C src/crypto/external/bsd/openssh/dist/myproposal.h
U src/crypto/external/bsd/openssh/dist/nchan.ms
U src/crypto/external/bsd/openssh/dist/nchan2.ms
U src/crypto/external/bsd/openssh/dist/opacket.c
C src/crypto/external/bsd/openssh/dist/opacket.h
C src/crypto/external/bsd/openssh/dist/packet.c
C src/crypto/external/bsd/openssh/dist/packet.h
U src/crypto/external/bsd/openssh/dist/pathnames.h
U src/crypto/external/bsd/openssh/dist/pkcs11.h
U src/crypto/external/bsd/openssh/dist/poly1305.c
U src/crypto/external/bsd/openssh/dist/poly1305.h
U src/crypto/external/bsd/openssh/dist/sandbox-pledge.c
U src/crypto/external/bsd/openssh/dist/readconf.h
U src/crypto/external/bsd/openssh/dist/progressmeter.h
C src/crypto/external/bsd/openssh/dist/readconf.c
U src/crypto/external/bsd/openssh/dist/readpass.c
U src/crypto/external/bsd/openssh/dist/rijndael.c
U src/crypto/external/bsd/openssh/dist/rijndael.h
U src/crypto/external/bsd/openssh/dist/rsa.c
U src/crypto/external/bsd/openssh/dist/rsa.h
U src/crypto/external/bsd/openssh/dist/sftp-server-main.c
C src/crypto/external/bsd/openssh/dist/sandbox-rlimit.c
U src/crypto/external/bsd/openssh/dist/sc25519.c
U src/crypto/external/bsd/openssh/dist/sc25519.h
U src/crypto/external/bsd/openssh/dist/scp.1
C src/crypto/external/bsd/openssh/dist/scp.c
C src/crypto/external/bsd/openssh/dist/servconf.c
C src/crypto/external/bsd/openssh/dist/servconf.h
C src/crypto/external/bsd/openssh/dist/serverloop.c
C src/crypto/external/bsd/openssh/dist/serverloop.h
C src/crypto/external/bsd/openssh/dist/session.c
C src/crypto/external/bsd/openssh/dist/session.h
C src/crypto/external/bsd/openssh/dist/sftp-client.c
U src/crypto/external/bsd/openssh/dist/sftp-client.h
C src/crypto/external/bsd/openssh/dist/sftp-common.c
U src/crypto/external/bsd/openssh/dist/sftp-common.h
U src/crypto/external/bsd/openssh/dist/sftp-glob.c
U src/crypto/external/bsd/openssh/dist/smult_curve25519_ref.c
U src/crypto/external/bsd/openssh/dist/sftp-server.8
C src/crypto/external/bsd/openssh/dist/sftp-server.c
U src/crypto/external/bsd/openssh/dist/sftp.1
C src/crypto/external/bsd/openssh/dist/sftp.c
U src/crypto/external/bsd/openssh/dist/sftp.h
U src/crypto/external/bsd/openssh/dist/ssh-ed25519.c
U src/crypto/external/bsd/openssh/dist/ssh-add.1
U src/crypto/external/bsd/openssh/dist/ssh-add.c
C src/crypto/external/bsd/openssh/dist/ssh-agent.1
C src/crypto/external/bsd/openssh/dist/ssh-agent.c
U src/crypto/external/bsd/openssh/dist/ssh-dss.c
U src/crypto/external/bsd/openssh/dist/ssh-ecdsa.c
U src/crypto/external/bsd/openssh/dist/ssh-keyscan.1
U src/crypto/external/bsd/openssh/dist/ssh-gss.h
U src/crypto/external/bsd/openssh/dist/ssh-keygen.1
C src/crypto/external/bsd/openssh/dist/ssh-keygen.c
U src/crypto/external/bsd/openssh/dist/ssh-pkcs11-client.c
U src/crypto/external/bsd/openssh/dist/ssh-keyscan.c
U src/crypto/external/bsd/openssh/dist/ssh-keysign.8
U src/crypto/external/bsd/openssh/dist/ssh-keysign.c
U src/crypto/external/bsd/openssh/dist/sshbuf-getput-basic.c
C src/crypto/external/bsd/openssh/dist/sshd.8
U src/crypto/external/bsd/openssh/dist/ssh-pkcs11-helper.8
U src/crypto/external/bsd/openssh/dist/ssh-pkcs11-helper.c
C src/crypto/external/bsd/openssh/dist/ssh-pkcs11.c
U src/crypto/external/bsd/openssh/dist/ssh.1
U src/crypto/external/bsd/openssh/dist/ssh-pkcs11.h
C src/crypto/external/bsd/openssh/dist/ssh-rsa.c
U src/crypto/external/bsd/openssh/dist/ssh-sandbox.h
C src/crypto/external/bsd/openssh/dist/ssh.c
U src/crypto/external/bsd/openssh/dist/ssh.h
U src/crypto/external/bsd/openssh/dist/ssh1.h
U src/crypto/external/bsd/openssh/dist/ssh2.h
U src/crypto/external/bsd/openssh/dist/ssh_api.c
U src/crypto/external/bsd/openssh/dist/ssh_api.h
U src/crypto/external/bsd/openssh/dist/ssh_config
C src/crypto/external/bsd/openssh/dist/ssh_config.5
U src/crypto/external/bsd/openssh/dist/sshbuf-getput-crypto.c
U src/crypto/external/bsd/openssh/dist/sshbuf-misc.c
C src/crypto/external/bsd/openssh/dist/sshbuf.c
C src/crypto/external/bsd/openssh/dist/sshbuf.h
C src/crypto/external/bsd/openssh/dist/sshconnect.c
U src/crypto/external/bsd/openssh/dist/sshconnect.h
C src/crypto/external/bsd/openssh/dist/sshconnect1.c
C src/crypto/external/bsd/openssh/dist/sshconnect2.c
C src/crypto/external/bsd/openssh/dist/sshd.c
C src/crypto/external/bsd/openssh/dist/sshd_config
U src/crypto/external/bsd/openssh/dist/ssherr.c
C src/crypto/external/bsd/openssh/dist/sshd_config.5
U src/crypto/external/bsd/openssh/dist/ssherr.h
C src/crypto/external/bsd/openssh/dist/sshkey.c
C src/crypto/external/bsd/openssh/dist/sshkey.h
U src/crypto/external/bsd/openssh/dist/sshlogin.c
U src/crypto/external/bsd/openssh/dist/sshlogin.h
C src/crypto/external/bsd/openssh/dist/sshpty.c
C src/crypto/external/bsd/openssh/dist/sshpty.h
U src/crypto/external/bsd/openssh/dist/sshtty.c
U src/crypto/external/bsd/openssh/dist/ttymodes.c
U src/crypto/external/bsd/openssh/dist/ttymodes.h
U src/crypto/external/bsd/openssh/dist/uidswap.c
U src/crypto/external/bsd/openssh/dist/uidswap.h
U src/crypto/external/bsd/openssh/dist/umac.c
U src/crypto/external/bsd/openssh/dist/umac.h
U src/crypto/external/bsd/openssh/dist/utf8.c
U src/crypto/external/bsd/openssh/dist/utf8.h
U src/crypto/external/bsd/openssh/dist/uuencode.c
U src/crypto/external/bsd/openssh/dist/uuencode.h
U src/crypto/external/bsd/openssh/dist/verify.c
C src/crypto/external/bsd/openssh/dist/version.h
U src/crypto/external/bsd/openssh/dist/xmalloc.c
U src/crypto/external/bsd/openssh/dist/xmalloc.h
U src/crypto/external/bsd/openssh/dist/moduli-gen/moduli-gen.sh
U src/crypto/external/bsd/openssh/dist/moduli-gen/Makefile
U src/crypto/external/bsd/openssh/dist/moduli-gen/moduli.2048
U src/crypto/external/bsd/openssh/dist/moduli-gen/moduli.3072
U src/crypto/external/bsd/openssh/dist/moduli-gen/moduli.4096
U src/crypto/external/bsd/openssh/dist/moduli-gen/moduli.6144
U src/crypto/external/bsd/openssh/dist/moduli-gen/moduli.7680
U src/crypto/external/bsd/openssh/dist/moduli-gen/moduli.8192

72 conflicts created by this import.
Use the following command to help the merge:

        cvs checkout -jOPENSSH:yesterday -jOPENSSH src/crypto/external/bsd/openssh/dist