+20090223
+ - (djm) OpenBSD CVS Sync
+ - djm@cvs.openbsd.org 2009/02/22 23:50:57
+ [ssh_config.5 sshd_config.5]
+ don't advertise experimental options
+
+20090222
+ - (djm) OpenBSD CVS Sync
+ - tobias@cvs.openbsd.org 2009/02/21 19:32:04
+ [misc.c sftp-server-main.c ssh-keygen.c]
+ Added missing newlines in error messages.
+ ok dtucker
+
+20090221
+ - (djm) OpenBSD CVS Sync
+ - djm@cvs.openbsd.org 2009/02/17 01:28:32
+ [ssh_config]
+ sync with revised default ciphers; pointed out by dkrause@
+ - djm@cvs.openbsd.org 2009/02/18 04:31:21
+ [schnorr.c]
+ signature should hash over the entire group, not just the generator
+ (this is still disabled code)
+ - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
+ [contrib/suse/openssh.spec] Prepare for 5.2p1
+
+20090216
+ - (djm) [regress/conch-ciphers.sh regress/putty-ciphers.sh]
+ [regress/putty-kex.sh regress/putty-transfer.sh] Downgrade disabled
+ interop tests from FATAL error to a warning. Allows some interop
+ tests to proceed if others are missing necessary prerequisites.
+ - (djm) [configure.ac] support GNU/kFreeBSD and GNU/kOpensolaris
+ systems; patch from Aurelien Jarno via rmh AT aybabtu.com
+
+20090214
+ - (djm) OpenBSD CVS Sync
+ - dtucker@cvs.openbsd.org 2009/02/02 11:15:14
+ [sftp.c]
+ Initialize a few variables to prevent spurious "may be used
+ uninitialized" warnings from newer gcc's. ok djm@
+ - djm@cvs.openbsd.org 2009/02/12 03:00:56
+ [canohost.c canohost.h channels.c channels.h clientloop.c readconf.c]
+ [readconf.h serverloop.c ssh.c]
+ support remote port forwarding with a zero listen port (-R0:...) to
+ dyamically allocate a listen port at runtime (this is actually
+ specified in rfc4254); bz#1003 ok markus@
+ - djm@cvs.openbsd.org 2009/02/12 03:16:01
+ [serverloop.c]
+ tighten check for -R0:... forwarding: only allow dynamic allocation
+ if want_reply is set in the packet
+ - djm@cvs.openbsd.org 2009/02/12 03:26:22
+ [monitor.c]
+ some paranoia: check that the serialised key is really KEY_RSA before
+ diddling its internals
+ - djm@cvs.openbsd.org 2009/02/12 03:42:09
+ [ssh.1]
+ document -R0:... usage
+ - djm@cvs.openbsd.org 2009/02/12 03:44:25
+ [ssh.1]
+ consistency: Dq => Ql
+ - djm@cvs.openbsd.org 2009/02/12 03:46:17
+ [ssh_config.5]
+ document RemoteForward usage with 0 listen port
+ - jmc@cvs.openbsd.org 2009/02/12 07:34:20
+ [ssh_config.5]
+ kill trailing whitespace;
+ - markus@cvs.openbsd.org 2009/02/13 11:50:21
+ [packet.c]
+ check for enc !=NULL in packet_start_discard
+ - djm@cvs.openbsd.org 2009/02/14 06:35:49
+ [PROTOCOL]
+ mention that eow and no-more-sessions extensions are sent only to
+ OpenSSH peers
+
+20090212
+ - (djm) [sshpty.c] bz#1419: OSX uses cloning ptys that automagically
+ set ownership and modes, so avoid explicitly setting them
+ - (djm) [configure.ac loginrec.c] bz#1421: fix lastlog support for OSX.
+ OSX provides a getlastlogxbyname function that automates the reading of
+ a lastlog file. Also, the pututxline function will update lastlog so
+ there is no need for loginrec.c to do it explicitly. Collapse some
+ overly verbose code while I'm in there.
+
+20090201
+ - (dtucker) [defines.h sshconnect.c] INET6_ADDRSTRLEN is now needed in
+ channels.c too, so move the definition for non-IP6 platforms to defines.h
+ where it can be shared.
+
+20090129
+ - (tim) [contrib/cygwin/ssh-host-config] Patch from Corinna Vinschen.
+ If the CYGWIN environment variable is empty, the installer script
+ should not install the service with an empty CYGWIN variable, but
+ rather without setting CYGWNI entirely.
+ - (tim) [contrib/cygwin/ssh-host-config] Whitespace cleanup. No code changes.
+
+20090128
+ - (tim) [contrib/cygwin/ssh-host-config] Patch from Corinna Vinschen.
+ Changes to work on Cygwin 1.5.x as well as on the new Cygwin 1.7.x.
+ The information given for the setting of the CYGWIN environment variable
+ is wrong for both releases so I just removed it, together with the
+ unnecessary (Cygwin 1.5.x) or wrong (Cygwin 1.7.x) default setting.
+
+20081228
+ - (djm) OpenBSD CVS Sync
+ - stevesk@cvs.openbsd.org 2008/12/09 03:20:42
+ [channels.c servconf.c]
+ channel_print_adm_permitted_opens() should deal with all the printing
+ for that config option. suggested by markus@; ok markus@ djm@
+ dtucker@
+ - djm@cvs.openbsd.org 2008/12/09 04:32:22
+ [auth2-chall.c]
+ replace by-hand string building with xasprinf(); ok deraadt@
+ - sobrado@cvs.openbsd.org 2008/12/09 15:35:00
+ [sftp.1 sftp.c]
+ update for the synopses displayed by the 'help' command, there are a
+ few missing flags; add 'bye' to the output of 'help'; sorting and spacing.
+ jmc@ suggested replacing .Oo/.Oc with a single .Op macro.
+ ok jmc@
+ - stevesk@cvs.openbsd.org 2008/12/09 22:37:33
+ [clientloop.c]
+ fix typo in error message
+ - stevesk@cvs.openbsd.org 2008/12/10 03:55:20
+ [addrmatch.c]
+ o cannot be NULL here but use xfree() to be consistent; ok djm@
+ - stevesk@cvs.openbsd.org 2008/12/29 01:12:36
+ [ssh-keyscan.1]
+ fix example, default key type is rsa for 3+ years; from
+ frederic.perrin@resel.fr
+ - stevesk@cvs.openbsd.org 2008/12/29 02:23:26
+ [pathnames.h]
+ no need to escape single quotes in comments
+ - okan@cvs.openbsd.org 2008/12/30 00:46:56
+ [sshd_config.5]
+ add AllowAgentForwarding to available Match keywords list
+ ok djm
+ - djm@cvs.openbsd.org 2009/01/01 21:14:35
+ [channels.c]
+ call channel destroy callbacks on receipt of open failure messages.
+ fixes client hangs when connecting to a server that has MaxSessions=0
+ set spotted by imorgan AT nas.nasa.gov; ok markus@
+ - djm@cvs.openbsd.org 2009/01/01 21:17:36
+ [kexgexs.c]
+ fix hash calculation for KEXGEX: hash over the original client-supplied
+ values and not the sanity checked versions that we acutally use;
+ bz#1540 reported by john.smith AT arrows.demon.co.uk
+ ok markus@
+ - djm@cvs.openbsd.org 2009/01/14 01:38:06
+ [channels.c]
+ support SOCKS4A protocol, from dwmw2 AT infradead.org via bz#1482;
+ "looks ok" markus@
+ - stevesk@cvs.openbsd.org 2009/01/15 17:38:43
+ [readconf.c]
+ 1) use obsolete instead of alias for consistency
+ 2) oUserKnownHostsFile not obsolete but oGlobalKnownHostsFile2 is
+ so move the comment.
+ 3) reorder so like options are together
+ ok djm@
+ - djm@cvs.openbsd.org 2009/01/22 09:46:01
+ [channels.c channels.h session.c]
+ make Channel->path an allocated string, saving a few bytes here and
+ there and fixing bz#1380 in the process; ok markus@
+ - djm@cvs.openbsd.org 2009/01/22 09:49:57
+ [channels.c]
+ oops! I committed the wrong version of the Channel->path diff,
+ it was missing some tweaks suggested by stevesk@
+ - djm@cvs.openbsd.org 2009/01/22 10:02:34
+ [clientloop.c misc.c readconf.c readconf.h servconf.c servconf.h]
+ [serverloop.c ssh-keyscan.c ssh.c sshd.c]
+ make a2port() return -1 when it encounters an invalid port number
+ rather than 0, which it will now treat as valid (needed for future work)
+ adjust current consumers of a2port() to check its return value is <= 0,
+ which in turn required some things to be converted from u_short => int
+ make use of int vs. u_short consistent in some other places too
+ feedback & ok markus@
+ - djm@cvs.openbsd.org 2009/01/22 10:09:16
+ [auth-options.c]
+ another chunk of a2port() diff that got away. wtfdjm??
+ - djm@cvs.openbsd.org 2009/01/23 07:58:11
+ [myproposal.h]
+ prefer CTR modes and revised arcfour (i.e w/ discard) modes to CBC
+ modes; ok markus@
+ - naddy@cvs.openbsd.org 2009/01/24 17:10:22
+ [ssh_config.5 sshd_config.5]
+ sync list of preferred ciphers; ok djm@
+ - markus@cvs.openbsd.org 2009/01/26 09:58:15
+ [cipher.c cipher.h packet.c]
+ Work around the CPNI-957037 Plaintext Recovery Attack by always
+ reading 256K of data on packet size or HMAC errors (in CBC mode only).
+ Help, feedback and ok djm@
+ Feedback from Martin Albrecht and Paterson Kenny
+
+20090107
+ - (djm) [uidswap.c] bz#1412: Support >16 supplemental groups in OS X.
+ Patch based on one from vgiffin AT apple.com; ok dtucker@
+ - (djm) [channels.c] bz#1419: support "on demand" X11 forwarding via
+ launchd on OS X; patch from vgiffin AT apple.com, slightly tweaked;
+ ok dtucker@
+ - (djm) [contrib/ssh-copy-id.1 contrib/ssh-copy-id] bz#1492: Make
+ ssh-copy-id copy id_rsa.pub by default (instead of the legacy "identity"
+ key). Patch from cjwatson AT debian.org
+
+20090107
+ - (tim) [configure.ac defines.h openbsd-compat/port-uw.c
+ openbsd-compat/xcrypt.c] Add SECUREWARE support to OpenServer 6 SVR5 ABI.
+ OK djm@ dtucker@
+ - (tim) [configure.ac] Move check_for_libcrypt_later=1 in *-*-sysv5*) section.
+ OpenServer 6 doesn't need libcrypt.
+
+20081209
+ - (djm) OpenBSD CVS Sync
+ - djm@cvs.openbsd.org 2008/12/09 02:38:18
+ [clientloop.c]
+ The ~C escape handler does not work correctly for multiplexed sessions -
+ it opens a commandline on the master session, instead of on the slave
+ that requested it. Disable it on slave sessions until such time as it
+ is fixed; bz#1543 report from Adrian Bridgett via Colin Watson
+ ok markus@
+ - djm@cvs.openbsd.org 2008/12/09 02:39:59
+ [sftp.c]
+ Deal correctly with failures in remote stat() operation in sftp,
+ correcting fail-on-error behaviour in batchmode. bz#1541 report and
+ fix from anedvedicky AT gmail.com; ok markus@
+ - djm@cvs.openbsd.org 2008/12/09 02:58:16
+ [readconf.c]
+ don't leave junk (free'd) pointers around in Forward *fwd argument on
+ failure; avoids double-free in ~C -L handler when given an invalid
+ forwarding specification; bz#1539 report from adejong AT debian.org
+ via Colin Watson; ok markus@ dtucker@
+ - djm@cvs.openbsd.org 2008/12/09 03:02:37
+ [sftp.1 sftp.c]
+ correct sftp(1) and corresponding usage syntax;
+ bz#1518 patch from imorgan AT nas.nasa.gov; ok deraadt@ improved diff jmc@
+
+20081208
+ - (djm) [configure.ac] bz#1538: better test for ProPolice/SSP: actually
+ use some stack in main().
+ Report and suggested fix from vapier AT gentoo.org
+ - (djm) OpenBSD CVS Sync
+ - markus@cvs.openbsd.org 2008/12/02 19:01:07
+ [clientloop.c]
+ we have to use the recipient's channel number (RFC 4254) for
+ SSH2_MSG_CHANNEL_SUCCESS/SSH2_MSG_CHANNEL_FAILURE messages,
+ otherwise we trigger 'Non-public channel' error messages on sshd
+ systems with clientkeepalive enabled; noticed by sturm; ok djm;
+ - markus@cvs.openbsd.org 2008/12/02 19:08:59
+ [serverloop.c]
+ backout 1.149, since it's not necessary and openssh clients send
+ broken CHANNEL_FAILURE/SUCCESS messages since about 2004; ok djm@
+ - markus@cvs.openbsd.org 2008/12/02 19:09:38
+ [channels.c]
+ s/remote_id/id/ to be more consistent with other code; ok djm@
+
+20081201
+ - (dtucker) [contrib/cygwin/{Makefile,ssh-host-config}] Add new doc files
+ and tweak the is-sshd-running check in ssh-host-config. Patch from
+ vinschen at redhat com.
+ - (dtucker) OpenBSD CVS Sync
+ - markus@cvs.openbsd.org 2008/11/21 15:47:38
+ [packet.c]
+ packet_disconnect() on padding error, too. should reduce the success
+ probability for the CPNI-957037 Plaintext Recovery Attack to 2^-18
+ ok djm@
+ - dtucker@cvs.openbsd.org 2008/11/30 11:59:26
+ [monitor_fdpass.c]
+ Retry sendmsg/recvmsg on EAGAIN and EINTR; ok djm@
+
+20081123
+ - (dtucker) [monitor_fdpass.c] Reduce diff vs OpenBSD by moving some
+ declarations, removing an unnecessary union member and adding whitespace.
+ cmsgbuf.tmp thing spotted by des at des no, ok djm some time ago.
+
+20081118
+ - (tim) [addrmatch.c configure.ac] Some platforms do not have sin6_scope_id
+ member of sockaddr_in6. Also reported in Bug 1491 by David Leonard. OK and
+ feedback by djm@
+
20081111
- (dtucker) OpenBSD CVS Sync
- jmc@cvs.openbsd.org 2008/11/05 11:22:54