git: vendor/OPENSSH vendor/openssh: upgrade from 8.0p1 to 8.3p1

Daniel Fojt deef at crater.dragonflybsd.org
Mon Aug 3 07:28:06 PDT 2020


commit 0cbfa66cdb87e23928a110d9b02839f403e32c11
Author: Daniel Fojt <df at neosystem.org>
Date:   Wed Jul 22 17:18:18 2020 +0200

    vendor/openssh: upgrade from 8.0p1 to 8.3p1
    
    Summary of notable changes:
    
    - ssh(1), sshd(8), ssh-agent(1): add protection for private keys at
      rest in RAM against speculation and memory side-channel attacks like
      Spectre, Meltdown and Rambleed, openssh 8.1 and later encrypts private
      keys when they are not in use with a symmetric key that is derived from
      a relatively large "prekey" consisting of random data (currently 16KB)
    
    - ssh(1), sshd(8), ssh-keygen(1): openssh 8.2 removes the "ssh-rsa"
      (RSA/SHA1) algorithm from those accepted for certificate signatures
      (i.e. the client and server CASignatureAlgorithms option) and will
      use the rsa-sha2-512 signature algorithm by default when the
      ssh-keygen(1) CA signs new certificates
    
    - ssh(1), sshd(8): openssh 8.2 removes diffie-hellman-group14-sha1 from
      the default key exchange proposal for both the client and server
    
    - ssh-keygen(1): the command-line options related to the generation and
      screening of safe prime numbers used by the diffie-hellman-group-* key
      exchange algorithms have changed, most options have been folded under
      the -O flag
    
    - support PKCS8 as an optional format for storage of private keys to disk,
      native key format remains the default, but PKCS8 is a superior format to
      PEM if interoperability with non-OpenSSH software is required
    
    - ssh(1), sshd(8): prefer to use chacha20 from libcrypto
    
    - sshd(8): the sshd listener process title visible to ps(1) has changed
      to include information about the number of connections that are
      currently attempting authentication and the limits configured
      by MaxStartups
    
    - sshd(8): when clients get denied by MaxStartups, send a notification
      prior to the SSH2 protocol banner according to RFC4253 section 4.2
    
    - sshd(8): add an Include sshd_config keyword that allows including
      additional configuration files via glob(3) patterns
    
    - sshd(8): make IgnoreRhosts a tri-state option: "yes" to ignore
      rhosts/shosts, "no" allow rhosts/shosts or (new) "shosts-only"
      to allow .shosts files but not .rhosts
    
    - sshd(8): allow the IgnoreRhosts directive to appear anywhere in a
      sshd_config, not just before any Match blocks
    
    - ssh(1), sshd(8): allow prepending a list of algorithms to the default
      set by starting the list with the '^' character, e.g.
      "HostKeyAlgorithms ^ssh-ed25519"
    
    - ssh(1): allow forwarding a different agent socket to the path specified
      by $SSH_AUTH_SOCK, by extending the existing ForwardAgent option to
      accepting an explicit path or the name of an environment variable in
      addition to yes/no
    
    - ssh(1): add %TOKEN percent expansion for the LocalFoward and
      RemoteForward keywords when used for Unix domain socket forwarding
    
    - ssh(1): allow %n to be expanded in ProxyCommand strings
    
    - sftp(1): reject an argument of "-1" in the same way as ssh(1) and
      scp(1) do instead of accepting and silently ignoring it
    
    - sftp(1): check for user at host when parsing sftp target, this allows
      user@[1.2.3.4] to work without a path
    
    - sftp(1): fix a race condition in the SIGCHILD handler that could
      turn in to a kill(-1)
    
    For detailed list of all improvements, enhancements and bugfixes see
    release notes:
    
    https://www.openssh.com/releasenotes.html

Summary of changes:
 crypto/openssh/CREDITS                             |    2 +-
 crypto/openssh/LICENCE                             |    2 +-
 crypto/openssh/PROTOCOL                            |    6 +-
 crypto/openssh/PROTOCOL.certkeys                   |    9 +-
 crypto/openssh/PROTOCOL.chacha20poly1305           |    4 +-
 crypto/openssh/PROTOCOL.mux                        |    4 +-
 crypto/openssh/PROTOCOL.sshsig                     |   99 ++
 crypto/openssh/README                              |   36 +-
 crypto/openssh/README.dns                          |    8 +-
 crypto/openssh/auth-options.c                      |  124 +-
 crypto/openssh/auth-options.h                      |    8 +-
 crypto/openssh/auth-pam.c                          |   46 +-
 crypto/openssh/auth-rhosts.c                       |   15 +-
 crypto/openssh/auth.c                              |   42 +-
 crypto/openssh/auth.h                              |    8 +-
 crypto/openssh/auth2-chall.c                       |    8 +-
 crypto/openssh/auth2-hostbased.c                   |    5 +-
 crypto/openssh/auth2-kbdint.c                      |    4 +-
 crypto/openssh/auth2-passwd.c                      |    7 +-
 crypto/openssh/auth2-pubkey.c                      |  109 +-
 crypto/openssh/auth2.c                             |   10 +-
 crypto/openssh/authfd.c                            |  103 +-
 crypto/openssh/authfd.h                            |   10 +-
 crypto/openssh/authfile.c                          |  257 ++--
 crypto/openssh/authfile.h                          |   10 +-
 crypto/openssh/canohost.c                          |    6 +-
 crypto/openssh/channels.c                          |  123 +-
 crypto/openssh/channels.h                          |   10 +-
 ...-chachapoly.c => cipher-chachapoly-libcrypto.c} |   95 +-
 crypto/openssh/cipher-chachapoly.h                 |   13 +-
 crypto/openssh/cipher.c                            |   40 +-
 crypto/openssh/cipher.h                            |    5 +-
 crypto/openssh/clientloop.c                        |  178 ++-
 crypto/openssh/clientloop.h                        |    5 +-
 crypto/openssh/contrib/ssh-copy-id.1               |    2 +-
 crypto/openssh/crc32.h                             |   30 -
 crypto/openssh/defines.h                           |   37 +-
 crypto/openssh/dh.c                                |    8 +-
 crypto/openssh/dh.h                                |    7 +-
 crypto/openssh/digest-openssl.c                    |    9 +-
 crypto/openssh/dns.c                               |    1 -
 crypto/openssh/entropy.c                           |   19 +-
 crypto/openssh/hash.c                              |   34 +-
 crypto/openssh/hmac.c                              |    7 +-
 crypto/openssh/hostfile.c                          |   16 +-
 crypto/openssh/kex.c                               |  127 +-
 crypto/openssh/kex.h                               |    9 +-
 crypto/openssh/kexecdh.c                           |   28 +
 crypto/openssh/kexgen.c                            |    5 +-
 crypto/openssh/kexgexc.c                           |    4 +-
 crypto/openssh/krl.c                               |  118 +-
 crypto/openssh/krl.h                               |    5 +-
 crypto/openssh/log.h                               |    4 +-
 crypto/openssh/loginrec.c                          |    2 +
 crypto/openssh/mac.c                               |    7 +-
 crypto/openssh/match.c                             |    7 +-
 crypto/openssh/misc.c                              |  208 ++-
 crypto/openssh/misc.h                              |   17 +-
 crypto/openssh/moduli                              |  865 ++++++------
 crypto/openssh/moduli.c                            |   16 +-
 crypto/openssh/monitor.c                           |  109 +-
 crypto/openssh/monitor_wrap.c                      |   29 +-
 crypto/openssh/monitor_wrap.h                      |    9 +-
 crypto/openssh/msg.c                               |   14 +-
 crypto/openssh/mux.c                               |   29 +-
 crypto/openssh/myproposal.h                        |  135 +-
 crypto/openssh/nchan.c                             |    6 +-
 crypto/openssh/packet.c                            |   68 +-
 crypto/openssh/packet.h                            |    5 +-
 crypto/openssh/pathnames.h                         |    9 +-
 crypto/openssh/platform.c                          |    1 +
 crypto/openssh/progressmeter.c                     |   12 +-
 crypto/openssh/readconf.c                          |  215 ++-
 crypto/openssh/readconf.h                          |    7 +-
 crypto/openssh/readpass.c                          |  127 +-
 crypto/openssh/scp.1                               |   13 +-
 crypto/openssh/scp.c                               |  147 +-
 crypto/openssh/servconf.c                          |  326 ++++-
 crypto/openssh/servconf.h                          |   32 +-
 crypto/openssh/serverloop.c                        |   32 +-
 crypto/openssh/session.c                           |   62 +-
 crypto/openssh/sftp-client.c                       |   12 +-
 crypto/openssh/sftp-glob.c                         |    4 +-
 crypto/openssh/sftp-realpath.c                     |  226 +++
 crypto/openssh/sftp-server-main.c                  |    3 +-
 crypto/openssh/sftp-server.8                       |    6 +-
 crypto/openssh/sftp-server.c                       |   29 +-
 crypto/openssh/sftp.1                              |   56 +-
 crypto/openssh/sftp.c                              |   83 +-
 crypto/openssh/sk-api.h                            |   95 ++
 crypto/openssh/ssh-add.1                           |   33 +-
 crypto/openssh/ssh-add.c                           |  171 ++-
 crypto/openssh/ssh-agent.1                         |  170 ++-
 crypto/openssh/ssh-agent.c                         |  168 ++-
 crypto/openssh/ssh-dss.c                           |    8 +-
 crypto/openssh/{ssh-ecdsa.c => ssh-ecdsa-sk.c}     |  183 +--
 crypto/openssh/ssh-ed25519-sk.c                    |  164 +++
 crypto/openssh/ssh-ed25519.c                       |   20 +-
 crypto/openssh/ssh-keygen.1                        |  599 +++++---
 crypto/openssh/ssh-keygen.c                        | 1479 +++++++++++++++-----
 crypto/openssh/ssh-keyscan.1                       |    6 +-
 crypto/openssh/ssh-keyscan.c                       |   44 +-
 crypto/openssh/ssh-keysign.8                       |    6 +-
 crypto/openssh/ssh-keysign.c                       |   11 +-
 crypto/openssh/ssh-pkcs11-helper.8                 |    6 +-
 crypto/openssh/ssh-pkcs11-helper.c                 |   56 +-
 crypto/openssh/ssh-pkcs11.h                        |    4 +-
 crypto/openssh/ssh-sk-client.c                     |  449 ++++++
 crypto/openssh/ssh-sk.h                            |   69 +
 crypto/openssh/ssh.1                               |   43 +-
 crypto/openssh/ssh.c                               |  396 ++++--
 crypto/openssh/ssh_api.c                           |   51 +-
 crypto/openssh/ssh_config.5                        |  230 +--
 crypto/openssh/sshbuf-getput-basic.c               |  169 ++-
 crypto/openssh/sshbuf-getput-crypto.c              |   15 +-
 crypto/openssh/sshbuf-io.c                         |  117 ++
 crypto/openssh/sshbuf-misc.c                       |  105 +-
 crypto/openssh/sshbuf.c                            |    7 +-
 crypto/openssh/sshbuf.h                            |   71 +-
 crypto/openssh/sshconnect.c                        |  102 +-
 crypto/openssh/sshconnect.h                        |   10 +-
 crypto/openssh/sshconnect2.c                       |  215 ++-
 crypto/openssh/sshd.8                              |   64 +-
 crypto/openssh/sshd.c                              |  222 ++-
 crypto/openssh/sshd_config.5                       |  203 ++-
 crypto/openssh/ssherr.c                            |    6 +-
 crypto/openssh/ssherr.h                            |    4 +-
 crypto/openssh/sshkey.c                            | 1302 ++++++++++++-----
 crypto/openssh/sshkey.h                            |   84 +-
 crypto/openssh/sshlogin.c                          |    7 +-
 crypto/openssh/sshpty.c                            |   22 +-
 crypto/openssh/sshsig.c                            | 1041 ++++++++++++++
 crypto/openssh/sshsig.h                            |  104 ++
 crypto/openssh/uidswap.c                           |   38 +-
 crypto/openssh/umac.c                              |    8 +-
 crypto/openssh/umac.h                              |    6 +-
 crypto/openssh/utf8.c                              |   27 +-
 crypto/openssh/utf8.h                              |    5 +-
 crypto/openssh/uuencode.c                          |   95 --
 crypto/openssh/uuencode.h                          |   29 -
 crypto/openssh/version.h                           |    4 +-
 crypto/openssh/xmalloc.c                           |   31 +-
 crypto/openssh/xmalloc.h                           |    5 +-
 143 files changed, 9705 insertions(+), 3683 deletions(-)
 create mode 100644 crypto/openssh/PROTOCOL.sshsig
 rename crypto/openssh/{cipher-chachapoly.c => cipher-chachapoly-libcrypto.c} (57%)
 delete mode 100644 crypto/openssh/crc32.h
 create mode 100644 crypto/openssh/sftp-realpath.c
 create mode 100644 crypto/openssh/sk-api.h
 copy crypto/openssh/{ssh-ecdsa.c => ssh-ecdsa-sk.c} (50%)
 create mode 100644 crypto/openssh/ssh-ed25519-sk.c
 create mode 100644 crypto/openssh/ssh-sk-client.c
 create mode 100644 crypto/openssh/ssh-sk.h
 create mode 100644 crypto/openssh/sshbuf-io.c
 create mode 100644 crypto/openssh/sshsig.c
 create mode 100644 crypto/openssh/sshsig.h
 delete mode 100644 crypto/openssh/uuencode.c
 delete mode 100644 crypto/openssh/uuencode.h

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/0cbfa66cdb87e23928a110d9b02839f403e32c11


-- 
DragonFly BSD source repository



More information about the Commits mailing list