CVS import: src/crypto/external/bsd/openssh/dist

["Christos Zoulas" <christos%netbsd.org@localhost>]

Module Name:    src
Committed By:   christos
Date:           Tue Jun 25 16:30:51 UTC 2024

Update of /cvsroot/src/crypto/external/bsd/openssh/dist
In directory ivanova.netbsd.org:/tmp/cvs-serv3615

Log Message:
Import OpenSSH-9.7 (previous was 9.6)

Future deprecation notice
=========================

OpenSSH plans to remove support for the DSA signature algorithm in
early 2025 and compile-time disable it later this year.

DSA, as specified in the SSHv2 protocol, is inherently weak - being
limited to a 160 bit private key and use of the SHA1 digest. Its
estimated security level is only 80 bits symmetric equivalent.

OpenSSH has disabled DSA keys by default since 2015 but has retained
run-time optional support for them. DSA was the only mandatory-to-
implement algorithm in the SSHv2 RFCs[3], mostly because alternative
algorithms were encumbered by patents when the SSHv2 protocol was
specified.

This has not been the case for decades at this point and better
algorithms are well supported by all actively-maintained SSH
implementations. We do not consider the costs of maintaining DSA in
OpenSSH to be justified and hope that removing it from OpenSSH can
accelerate its wider deprecation in supporting cryptography
libraries.

This release makes DSA support in OpenSSH compile-time optional,
defaulting to on. We intend the next release to change the default
to disable DSA at compile time. The first OpenSSH release of 2025
will remove DSA support entirely.

Changes since OpenSSH 9.6
=========================

This release contains mostly bugfixes.

New features
------------

 * ssh(1), sshd(8): add a "global" ChannelTimeout type that watches
   all open channels and will close all open channels if there is no
   traffic on any of them for the specified interval. This is in
   addition to the existing per-channel timeouts added recently.

   This supports situations like having both session and x11
   forwarding channels open where one may be idle for an extended
   period but the other is actively used. The global timeout could
   close both channels when both have been idle for too long.

 * All: make DSA key support compile-time optional, defaulting to on.

Bugfixes
--------

 * sshd(8): don't append an unnecessary space to the end of subsystem
   arguments (bz3667)

 * ssh(1): fix the multiplexing "channel proxy" mode, broken when
   keystroke timing obfuscation was added. (GHPR#463)

 * ssh(1), sshd(8): fix spurious configuration parsing errors when
   options that accept array arguments are overridden (bz3657).

 * ssh-agent(1): fix potential spin in signal handler (bz3670)

 * Many fixes to manual pages and other documentation, including
   GHPR#462, GHPR#454, GHPR#442 and GHPR#441.

 * Greatly improve interop testing against PuTTY.

Portability
-----------

 * Improve the error message when the autoconf OpenSSL header check
   fails (bz#3668)

 * Improve detection of broken toolchain -fzero-call-used-regs support
   (bz3645).

 * Fix regress/misc/fuzz-harness fuzzers and make them compile without
   warnings when using clang16

Status:

Vendor Tag:     OPENSSH
Release Tags:   v97-20240311
                
U src/crypto/external/bsd/openssh/dist/packet.h
U src/crypto/external/bsd/openssh/dist/LICENCE
U src/crypto/external/bsd/openssh/dist/OVERVIEW
C src/crypto/external/bsd/openssh/dist/PROTOCOL
C src/crypto/external/bsd/openssh/dist/PROTOCOL.agent
U src/crypto/external/bsd/openssh/dist/PROTOCOL.certkeys
U src/crypto/external/bsd/openssh/dist/PROTOCOL.chacha20poly1305
U src/crypto/external/bsd/openssh/dist/PROTOCOL.key
U src/crypto/external/bsd/openssh/dist/PROTOCOL.krl
C src/crypto/external/bsd/openssh/dist/PROTOCOL.mux
U src/crypto/external/bsd/openssh/dist/PROTOCOL.sshsig
U src/crypto/external/bsd/openssh/dist/PROTOCOL.u2f
U src/crypto/external/bsd/openssh/dist/README
U src/crypto/external/bsd/openssh/dist/addr.c
U src/crypto/external/bsd/openssh/dist/addr.h
U src/crypto/external/bsd/openssh/dist/addrmatch.c
U src/crypto/external/bsd/openssh/dist/atomicio.c
U src/crypto/external/bsd/openssh/dist/atomicio.h
U src/crypto/external/bsd/openssh/dist/auth-bsdauth.c
U src/crypto/external/bsd/openssh/dist/auth-krb5.c
U src/crypto/external/bsd/openssh/dist/auth-options.c
U src/crypto/external/bsd/openssh/dist/auth-options.h
U src/crypto/external/bsd/openssh/dist/auth-passwd.c
U src/crypto/external/bsd/openssh/dist/auth-rhosts.c
U src/crypto/external/bsd/openssh/dist/auth.c
U src/crypto/external/bsd/openssh/dist/auth.h
U src/crypto/external/bsd/openssh/dist/auth2-chall.c
U src/crypto/external/bsd/openssh/dist/auth2-gss.c
U src/crypto/external/bsd/openssh/dist/auth2-hostbased.c
U src/crypto/external/bsd/openssh/dist/auth2-kbdint.c
U src/crypto/external/bsd/openssh/dist/auth2-none.c
U src/crypto/external/bsd/openssh/dist/auth2-passwd.c
U src/crypto/external/bsd/openssh/dist/auth2-pubkey.c
U src/crypto/external/bsd/openssh/dist/auth2-pubkeyfile.c
U src/crypto/external/bsd/openssh/dist/auth2.c
U src/crypto/external/bsd/openssh/dist/authfd.c
U src/crypto/external/bsd/openssh/dist/authfd.h
U src/crypto/external/bsd/openssh/dist/authfile.c
U src/crypto/external/bsd/openssh/dist/authfile.h
U src/crypto/external/bsd/openssh/dist/bitmap.c
U src/crypto/external/bsd/openssh/dist/bitmap.h
U src/crypto/external/bsd/openssh/dist/canohost.c
U src/crypto/external/bsd/openssh/dist/canohost.h
U src/crypto/external/bsd/openssh/dist/chacha.c
U src/crypto/external/bsd/openssh/dist/chacha.h
C src/crypto/external/bsd/openssh/dist/channels.c
U src/crypto/external/bsd/openssh/dist/channels.h
U src/crypto/external/bsd/openssh/dist/cipher-aesctr.c
U src/crypto/external/bsd/openssh/dist/cipher-aesctr.h
U src/crypto/external/bsd/openssh/dist/cipher-chachapoly-libcrypto.c
U src/crypto/external/bsd/openssh/dist/cipher-chachapoly.c
U src/crypto/external/bsd/openssh/dist/cipher-chachapoly.h
U src/crypto/external/bsd/openssh/dist/cipher.c
U src/crypto/external/bsd/openssh/dist/cipher.h
U src/crypto/external/bsd/openssh/dist/cleanup.c
C src/crypto/external/bsd/openssh/dist/clientloop.c
U src/crypto/external/bsd/openssh/dist/clientloop.h
U src/crypto/external/bsd/openssh/dist/compat.c
U src/crypto/external/bsd/openssh/dist/compat.h
U src/crypto/external/bsd/openssh/dist/crypto_api.h
U src/crypto/external/bsd/openssh/dist/dh.c
U src/crypto/external/bsd/openssh/dist/dh.h
U src/crypto/external/bsd/openssh/dist/digest-libc.c
U src/crypto/external/bsd/openssh/dist/digest-openssl.c
U src/crypto/external/bsd/openssh/dist/digest.h
U src/crypto/external/bsd/openssh/dist/dispatch.c
U src/crypto/external/bsd/openssh/dist/dispatch.h
U src/crypto/external/bsd/openssh/dist/dns.c
U src/crypto/external/bsd/openssh/dist/dns.h
U src/crypto/external/bsd/openssh/dist/ed25519.c
U src/crypto/external/bsd/openssh/dist/ed25519.sh
U src/crypto/external/bsd/openssh/dist/fatal.c
U src/crypto/external/bsd/openssh/dist/groupaccess.c
U src/crypto/external/bsd/openssh/dist/groupaccess.h
C src/crypto/external/bsd/openssh/dist/gss-genr.c
U src/crypto/external/bsd/openssh/dist/gss-serv-krb5.c
U src/crypto/external/bsd/openssh/dist/gss-serv.c
U src/crypto/external/bsd/openssh/dist/hash.c
U src/crypto/external/bsd/openssh/dist/hmac.c
U src/crypto/external/bsd/openssh/dist/hmac.h
U src/crypto/external/bsd/openssh/dist/hostfile.c
U src/crypto/external/bsd/openssh/dist/hostfile.h
C src/crypto/external/bsd/openssh/dist/kex.c
C src/crypto/external/bsd/openssh/dist/kex.h
U src/crypto/external/bsd/openssh/dist/kexc25519.c
U src/crypto/external/bsd/openssh/dist/kexdh.c
U src/crypto/external/bsd/openssh/dist/kexecdh.c
U src/crypto/external/bsd/openssh/dist/kexgen.c
U src/crypto/external/bsd/openssh/dist/kexgex.c
U src/crypto/external/bsd/openssh/dist/kexgexc.c
U src/crypto/external/bsd/openssh/dist/kexgexs.c
U src/crypto/external/bsd/openssh/dist/krl.c
U src/crypto/external/bsd/openssh/dist/kexsntrup761x25519.c
U src/crypto/external/bsd/openssh/dist/krl.h
U src/crypto/external/bsd/openssh/dist/log.c
U src/crypto/external/bsd/openssh/dist/log.h
U src/crypto/external/bsd/openssh/dist/mac.c
U src/crypto/external/bsd/openssh/dist/mac.h
U src/crypto/external/bsd/openssh/dist/match.c
U src/crypto/external/bsd/openssh/dist/match.h
C src/crypto/external/bsd/openssh/dist/misc.c
C src/crypto/external/bsd/openssh/dist/misc.h
U src/crypto/external/bsd/openssh/dist/moduli.c
U src/crypto/external/bsd/openssh/dist/monitor.c
U src/crypto/external/bsd/openssh/dist/monitor.h
U src/crypto/external/bsd/openssh/dist/monitor_fdpass.c
U src/crypto/external/bsd/openssh/dist/monitor_fdpass.h
U src/crypto/external/bsd/openssh/dist/monitor_wrap.c
U src/crypto/external/bsd/openssh/dist/monitor_wrap.h
U src/crypto/external/bsd/openssh/dist/msg.c
U src/crypto/external/bsd/openssh/dist/msg.h
U src/crypto/external/bsd/openssh/dist/mux.c
U src/crypto/external/bsd/openssh/dist/myproposal.h
C src/crypto/external/bsd/openssh/dist/nchan.c
U src/crypto/external/bsd/openssh/dist/nchan.ms
U src/crypto/external/bsd/openssh/dist/nchan2.ms
U src/crypto/external/bsd/openssh/dist/packet.c
U src/crypto/external/bsd/openssh/dist/pathnames.h
U src/crypto/external/bsd/openssh/dist/pkcs11.h
U src/crypto/external/bsd/openssh/dist/poly1305.c
U src/crypto/external/bsd/openssh/dist/poly1305.h
U src/crypto/external/bsd/openssh/dist/progressmeter.c
U src/crypto/external/bsd/openssh/dist/progressmeter.h
C src/crypto/external/bsd/openssh/dist/readconf.c
C src/crypto/external/bsd/openssh/dist/readconf.h
U src/crypto/external/bsd/openssh/dist/readpass.c
U src/crypto/external/bsd/openssh/dist/rijndael.c
U src/crypto/external/bsd/openssh/dist/rijndael.h
U src/crypto/external/bsd/openssh/dist/sandbox-pledge.c
U src/crypto/external/bsd/openssh/dist/sandbox-rlimit.c
U src/crypto/external/bsd/openssh/dist/scp.1
U src/crypto/external/bsd/openssh/dist/scp.c
C src/crypto/external/bsd/openssh/dist/servconf.c
U src/crypto/external/bsd/openssh/dist/servconf.h
U src/crypto/external/bsd/openssh/dist/serverloop.c
U src/crypto/external/bsd/openssh/dist/serverloop.h
C src/crypto/external/bsd/openssh/dist/session.c
U src/crypto/external/bsd/openssh/dist/session.h
U src/crypto/external/bsd/openssh/dist/sftp-client.c
U src/crypto/external/bsd/openssh/dist/sftp-client.h
U src/crypto/external/bsd/openssh/dist/sftp-glob.c
U src/crypto/external/bsd/openssh/dist/sftp-common.c
U src/crypto/external/bsd/openssh/dist/sftp-common.h
U src/crypto/external/bsd/openssh/dist/sftp-realpath.c
U src/crypto/external/bsd/openssh/dist/sftp-server-main.c
U src/crypto/external/bsd/openssh/dist/sftp-server.8
U src/crypto/external/bsd/openssh/dist/sftp-server.c
U src/crypto/external/bsd/openssh/dist/sftp-usergroup.c
U src/crypto/external/bsd/openssh/dist/sftp-usergroup.h
U src/crypto/external/bsd/openssh/dist/sftp.1
C src/crypto/external/bsd/openssh/dist/sftp.c
U src/crypto/external/bsd/openssh/dist/sftp.h
U src/crypto/external/bsd/openssh/dist/sk-api.h
U src/crypto/external/bsd/openssh/dist/sk-usbhid.c
U src/crypto/external/bsd/openssh/dist/smult_curve25519_ref.c
U src/crypto/external/bsd/openssh/dist/sntrup761.c
U src/crypto/external/bsd/openssh/dist/sntrup761.sh
U src/crypto/external/bsd/openssh/dist/srclimit.c
U src/crypto/external/bsd/openssh/dist/srclimit.h
C src/crypto/external/bsd/openssh/dist/ssh-add.1
C src/crypto/external/bsd/openssh/dist/ssh-add.c
U src/crypto/external/bsd/openssh/dist/ssh-agent.1
C src/crypto/external/bsd/openssh/dist/ssh-agent.c
C src/crypto/external/bsd/openssh/dist/ssh-dss.c
U src/crypto/external/bsd/openssh/dist/ssh-ecdsa-sk.c
U src/crypto/external/bsd/openssh/dist/ssh-ecdsa.c
U src/crypto/external/bsd/openssh/dist/ssh-ed25519-sk.c
U src/crypto/external/bsd/openssh/dist/ssh-ed25519.c
U src/crypto/external/bsd/openssh/dist/ssh-gss.h
U src/crypto/external/bsd/openssh/dist/ssh-keygen.1
C src/crypto/external/bsd/openssh/dist/ssh-keygen.c
U src/crypto/external/bsd/openssh/dist/ssh-keyscan.1
C src/crypto/external/bsd/openssh/dist/ssh-keyscan.c
U src/crypto/external/bsd/openssh/dist/ssh-keysign.8
C src/crypto/external/bsd/openssh/dist/ssh-keysign.c
U src/crypto/external/bsd/openssh/dist/ssh-pkcs11-client.c
U src/crypto/external/bsd/openssh/dist/ssh-pkcs11-helper.8
U src/crypto/external/bsd/openssh/dist/ssh-pkcs11-helper.c
U src/crypto/external/bsd/openssh/dist/ssh-pkcs11.c
U src/crypto/external/bsd/openssh/dist/ssh-pkcs11.h
U src/crypto/external/bsd/openssh/dist/ssh-rsa.c
U src/crypto/external/bsd/openssh/dist/ssh-sandbox.h
U src/crypto/external/bsd/openssh/dist/ssh-sk-client.c
U src/crypto/external/bsd/openssh/dist/ssh-sk-helper.8
U src/crypto/external/bsd/openssh/dist/ssh-sk-helper.c
U src/crypto/external/bsd/openssh/dist/ssh-sk.c
U src/crypto/external/bsd/openssh/dist/ssh-sk.h
U src/crypto/external/bsd/openssh/dist/ssh-xmss.c
U src/crypto/external/bsd/openssh/dist/ssh.1
C src/crypto/external/bsd/openssh/dist/ssh.c
U src/crypto/external/bsd/openssh/dist/ssh.h
U src/crypto/external/bsd/openssh/dist/ssh2.h
C src/crypto/external/bsd/openssh/dist/ssh_api.c
U src/crypto/external/bsd/openssh/dist/ssh_api.h
U src/crypto/external/bsd/openssh/dist/ssh_config
C src/crypto/external/bsd/openssh/dist/ssh_config.5
U src/crypto/external/bsd/openssh/dist/sshbuf-getput-basic.c
C src/crypto/external/bsd/openssh/dist/sshbuf-getput-crypto.c
U src/crypto/external/bsd/openssh/dist/sshbuf-io.c
U src/crypto/external/bsd/openssh/dist/sshbuf-misc.c
U src/crypto/external/bsd/openssh/dist/sshbuf.c
U src/crypto/external/bsd/openssh/dist/sshbuf.h
C src/crypto/external/bsd/openssh/dist/sshconnect.c
U src/crypto/external/bsd/openssh/dist/sshconnect.h
C src/crypto/external/bsd/openssh/dist/sshconnect2.c
U src/crypto/external/bsd/openssh/dist/sshd.8
C src/crypto/external/bsd/openssh/dist/sshd.c
U src/crypto/external/bsd/openssh/dist/sshd_config
C src/crypto/external/bsd/openssh/dist/sshd_config.5
U src/crypto/external/bsd/openssh/dist/ssherr.c
U src/crypto/external/bsd/openssh/dist/ssherr.h
U src/crypto/external/bsd/openssh/dist/sshkey-xmss.c
U src/crypto/external/bsd/openssh/dist/sshkey-xmss.h
C src/crypto/external/bsd/openssh/dist/sshkey.c
U src/crypto/external/bsd/openssh/dist/sshkey.h
U src/crypto/external/bsd/openssh/dist/sshlogin.c
U src/crypto/external/bsd/openssh/dist/sshlogin.h
U src/crypto/external/bsd/openssh/dist/sshpty.c
U src/crypto/external/bsd/openssh/dist/sshpty.h
C src/crypto/external/bsd/openssh/dist/sshsig.c
U src/crypto/external/bsd/openssh/dist/sshsig.h
U src/crypto/external/bsd/openssh/dist/sshtty.c
U src/crypto/external/bsd/openssh/dist/ttymodes.c
U src/crypto/external/bsd/openssh/dist/ttymodes.h
U src/crypto/external/bsd/openssh/dist/uidswap.c
U src/crypto/external/bsd/openssh/dist/uidswap.h
U src/crypto/external/bsd/openssh/dist/umac.c
U src/crypto/external/bsd/openssh/dist/umac.h
U src/crypto/external/bsd/openssh/dist/umac128.c
U src/crypto/external/bsd/openssh/dist/utf8.c
U src/crypto/external/bsd/openssh/dist/utf8.h
C src/crypto/external/bsd/openssh/dist/version.h
U src/crypto/external/bsd/openssh/dist/xmalloc.c
U src/crypto/external/bsd/openssh/dist/xmalloc.h
U src/crypto/external/bsd/openssh/dist/xmss_fast.c
U src/crypto/external/bsd/openssh/dist/xmss_commons.c
U src/crypto/external/bsd/openssh/dist/xmss_commons.h
U src/crypto/external/bsd/openssh/dist/xmss_fast.h
C src/crypto/external/bsd/openssh/dist/xmss_hash.c
U src/crypto/external/bsd/openssh/dist/xmss_hash.h
U src/crypto/external/bsd/openssh/dist/xmss_hash_address.c
U src/crypto/external/bsd/openssh/dist/xmss_hash_address.h
U src/crypto/external/bsd/openssh/dist/xmss_wots.c
U src/crypto/external/bsd/openssh/dist/xmss_wots.h
U src/crypto/external/bsd/openssh/dist/moduli-gen/Makefile
U src/crypto/external/bsd/openssh/dist/moduli-gen/moduli-gen.sh
C src/crypto/external/bsd/openssh/dist/moduli-gen/moduli.2048
C src/crypto/external/bsd/openssh/dist/moduli-gen/moduli.3072
C src/crypto/external/bsd/openssh/dist/moduli-gen/moduli.4096
C src/crypto/external/bsd/openssh/dist/moduli-gen/moduli.6144
C src/crypto/external/bsd/openssh/dist/moduli-gen/moduli.7680
C src/crypto/external/bsd/openssh/dist/moduli-gen/moduli.8192

41 conflicts created by this import.
Use the following command to help the merge:

        cvs checkout -jOPENSSH:yesterday -jOPENSSH src/crypto/external/bsd/openssh/dist