+20040211
+ - (dtucker) [auth-passwd.c auth-shadow.c] Only enable shadow expiry check
+ if HAS_SHADOW_EXPIRY is set.
+
+20040210
+ - (dtucker) [auth-passwd.c auth.h openbsd-compat/port-aix.c
+ openbsd-compat/port-aix.h] Bug #14: Use do_pwchange to support AIX's
+ native password expiry.
+ - (dtucker) [LICENCE Makefile.in auth-passwd.c auth-shadow.c auth.c auth.h
+ defines.h] Bug #14: Use do_pwchange to support password expiry and force
+ change for platforms using /etc/shadow. ok djm@
+ - (dtucker) [openbsd-compat/fake-rfc2553.h] Bug #563: Prepend ssh_ to compat
+ functions to avoid conflicts with Heimdal's libroken. ok djm@
+ - (dtucker) [auth-pam.c auth-pam.h session.c] Bug #14: Use do_pwchange to
+ change expired PAM passwords for SSHv1 connections without privsep.
+ pam_chauthtok is still used when privsep is disabled. ok djm@
+ - (dtucker) [openbsd-compat/port-aix.c openbsd-compat/port-aix.h] Move
+ include from port-aix.h to port-aix.c and remove unnecessary function
+ definition. Fixes build errors on AIX.
+ - (dtucker) [configure.ac loginrec.c] Bug #464: Use updwtmpx on platforms
+ that support it. from & ok mouring@
+ - (dtucker) [configure.ac] Bug #345: Do not disable utmp on HP-UX 10.x.
+ ok djm@
+
+20040207
+ - (dtucker) OpenBSD CVS Sync
+ - dtucker@cvs.openbsd.org 2004/02/06 23:41:13
+ [cipher-ctr.c]
+ Use EVP_CIPHER_CTX_key_length for key length. ok markus@
+ (This will fix builds with OpenSSL 0.9.5)
+ - (dtucker) [cipher.c] enable AES counter modes with OpenSSL 0.9.5.
+ ok djm@, markus@
+
+20040206
+ - (dtucker) [acss.c acss.h] Fix $Id tags.
+ - (dtucker) [cipher-acss.c cipher.c] Enable acss only if building with
+ OpenSSL >= 0.9.7. ok djm@
+ - (dtucker) [session.c] Bug #789: Do not call do_pam_setcred as a non-root
+ user, since some modules might fail due to lack of privilege. ok djm@
+ - (dtucker) [configure.ac] Bug #748: Always define BROKEN_GETADDRINFO
+ for HP-UX 11.11. If there are known-good configs where this is not
+ required, please report them. ok djm@
+ - (dtucker) [sshd.c] Bug #757: Clear child's environment to prevent
+ accidentally inheriting from root's environment. ok djm@
+ - (dtucker) [openbsd-compat/port-aix.c openbsd-compat/port-aix.h] Bug #796:
+ Restore previous authdb setting after auth calls. Fixes problems with
+ setpcred failing on accounts that use AFS or NIS password registries.
+ - (dtucker) [configure.ac includes.h] Include <sys/stream.h> if present,
+ required on Solaris 2.5.1 for queue_t, which is used by <sys/ptms.h>.
+ - (dtucker) OpenBSD CVS Sync
+ - markus@cvs.openbsd.org 2004/01/30 09:48:57
+ [auth-passwd.c auth.h pathnames.h session.c]
+ support for password change; ok dtucker@
+ (set password-dead=1w in login.conf to use this).
+ In -Portable, this is currently only platforms using bsdauth.
+ - dtucker@cvs.openbsd.org 2004/02/05 05:37:17
+ [monitor.c sshd.c]
+ Pass SIGALRM through to privsep child if LoginGraceTime expires. ok markus@
+ - markus@cvs.openbsd.org 2004/02/05 15:33:33
+ [progressmeter.c]
+ fix ETA for > 4GB; bugzilla #791; ok henning@ deraadt@
+
+20040129
+ - (dtucker) OpenBSD CVS Sync regress/
+ - dtucker@cvs.openbsd.org 2003/10/11 11:49:49
+ [Makefile banner.sh]
+ Test missing banner file, suppression of banner with ssh -q, check return
+ code from ssh. ok markus@
+ - jmc@cvs.openbsd.org 2003/11/07 10:16:44
+ [ssh-com.sh]
+ adress -> address, and a few more; all from Jonathon Gray;
+ - djm@cvs.openbsd.org 2004/01/13 09:49:06
+ [sftp-batch.sh]
+ - (dtucker) [configure.ac] Add --without-zlib-version-check. Feedback from
+ tim@, ok several
+ - (dtucker) [configure.ac openbsd-compat/bsd-cray.c openbsd-compat/bsd-cray.h]
+ Bug #775: Cray fixes from wendy at cray.com
+
+20040128
+ - (dtucker) [regress/README.regress] Add tcpwrappers issue, noted by tim@
+ - (dtucker) [moduli] Import new moduli file from OpenBSD.
+
+20040127
+ - (djm) OpenBSD CVS Sync
+ - hshoexer@cvs.openbsd.org 2004/01/23 17:06:03
+ [cipher.c]
+ enable acss for ssh
+ ok deraadt@ markus@
+ - mouring@cvs.openbsd.org 2004/01/23 17:57:48
+ [sftp-int.c]
+ Fix issue pointed out with ls not handling large directories
+ with embeded paths correctly. OK damien@
+ - hshoexer@cvs.openbsd.org 2004/01/23 19:26:33
+ [cipher.c]
+ rename acss@opebsd.org to acss@openssh.org
+ ok deraadt@
+ - djm@cvs.openbsd.org 2004/01/25 03:49:09
+ [sshconnect.c]
+ reset nonblocking flag after ConnectTimeout > 0 connect; (bugzilla #785)
+ from jclonguet AT free.fr; ok millert@
+ - djm@cvs.openbsd.org 2004/01/27 10:08:10
+ [sftp.c]
+ reorder parsing so user:skey@host:file works (bugzilla #777)
+ patch from admorten AT umich.edu; ok markus@
+ - (djm) [acss.c acss.h cipher-acss.c] Portable support for ACSS
+ if libcrypto lacks it
+
+20040126
+ - (tim) Typo in regress/README.regress
+ - (tim) [regress/test-exec.sh] RhostsAuthentication is deprecated.
+ - (tim) [defines.h] Add defines for HFIXEDSZ and T_SIG
+ - (tim) [configure.ac includes.h] add <sys/ptms.h> for grantpt() and friends.
+ - (tim) [defines.h openbsd-compat/getrrsetbyname.h] Move defines for HFIXEDSZ
+ and T_SIG to getrrsetbyname.h
+
+20040124
+ - (djm) Typo in openbsd-compat/bsd-openpty.c; from wendyp AT cray.com
+
+20040123
+ - (djm) Do pam_session processing for systems with HAVE_LOGIN_CAP; from
+ ralf.hack AT pipex.net; ok dtucker@
+ - (djm) Bug #776: Update contrib/redhat/openssh.spec to dynamically detect
+ Kerberos location (and thus work with Fedora Core 1);
+ from jason AT devrandom.org
+ - (dtucker) [configure.ac] Bug #788: Test for zlib.h presence and for
+ zlib >= 1.1.4. Partly from jbasney at ncsa.uiuc.edu. ok djm@
+ - (dtucker) [contrib/cygwin/README] Document new ssh-host-config options.
+ Patch from vinschen at redhat.com.
+ - (dtucker) [acconfig.h configure.ac includes.h servconf.c session.c]
+ Change AFS symbol to USE_AFS to prevent namespace collisions, do not
+ include kafs.h unless necessary. From deengert at anl.gov.
+ - (tim) [configure.ac] Remove hard coded -L/usr/local/lib and
+ -I/usr/local/include. Users can do LDFLAGS="-L/usr/local/lib" \
+ CPPFLAGS="-I/usr/local/include" ./configure if needed.
+
+20040122
+ - (dtucker) [configure.ac] Use krb5-config where available for Kerberos/
+ GSSAPI detection, libs and includes. ok djm@
+ - (dtucker) [session.c] Enable AFS support in conjunction with KRB5 not
+ just HEIMDAL.
+ - (tim) [contrib/solaris/buildpkg.sh] Allow for the possibility of
+ /usr/local being a symbolic link. Fixes problem reported by Henry Grebler.
+
+20040121
+ - (djm) OpenBSD CVS Sync
+ - djm@cvs.openbsd.org 2004/01/13 09:25:05
+ [sftp-int.c sftp.1 sftp.c]
+ Tidy sftp batchmode handling, eliminate junk to stderr (bugzilla #754) and
+ enable use of "-b -" to accept batchfile from stdin; ok markus@
+ - jmc@cvs.openbsd.org 2004/01/13 12:17:33
+ [sftp.1]
+ remove unnecessary Ic's;
+ kill whitespace at EOL;
+ ok djm@
+ - markus@cvs.openbsd.org 2004/01/13 19:23:15
+ [compress.c session.c]
+ -Wall; ok henning
+ - markus@cvs.openbsd.org 2004/01/13 19:45:15
+ [compress.c]
+ cast for portability; millert@
+ - markus@cvs.openbsd.org 2004/01/19 09:24:21
+ [channels.c]
+ fake consumption for half closed channels since the peer is waiting for
+ window adjust messages; bugzilla #790 Matthew Dillon; test + ok dtucker@
+ reproduce with sh -c 'ulimit -f 10; ssh host -n od /bsd | cat > foo'
+ - markus@cvs.openbsd.org 2004/01/19 21:25:15
+ [auth2-hostbased.c auth2-pubkey.c serverloop.c ssh-keysign.c sshconnect2.c]
+ fix mem leaks; some fixes from Pete Flugstad; tested dtucker@
+ - djm@cvs.openbsd.org 2004/01/21 03:07:59
+ [sftp.c]
+ initialise infile in main, rather than statically - from portable
+ - deraadt@cvs.openbsd.org 2004/01/11 21:55:06
+ [sshpty.c]
+ for pty opening, only use the openpty() path. the other stuff only needs
+ to be in openssh-p; markus ok
+ - (djm) [openbsd-compat/bsd-openpty.c] Rework old sshpty.c code into an
+ openpty() replacement
+
+20040114
+ - (dtucker) [auth-pam.c] Have monitor die if PAM authentication thread exits
+ unexpectedly. with & ok djm@
+ - (dtucker) [auth-pam.c] Reset signal handler in pthread_cancel too, add
+ test for case where cleanup has already run.
+ - (dtucker) [auth-pam.c] Add minor debugging.
+
+20040113
+ - (dtucker) [auth-pam.c] Relocate struct pam_ctxt and prototypes. No
+ functional changes.
+
+20040108
+ - (dtucker) [auth-pam.c defines.h] Bug #783: move __unused to defines.h and
+ only define if not already. From des at freebsd.org.
+ - (dtucker) [configure.ac] Remove extra (typo) comma.
+
+20040105
+ - (dtucker) [contrib/ssh-copy-id] Bug #781: exit if ssh fails. Patch from
+ cjwatson at debian.org.
+ - (dtucker) [acconfig.h configure.ac includes.h servconf.c session.c]
+ Only enable KerberosGetAFSToken if Heimdal's libkafs is found. with jakob@
+
+20040102
+ - (djm) OSX/Darwin needs BIND_8_COMPAT to build getrrsetbyname. Report from
+ jakob@
+ - (djm) Remove useless DNS support configure summary message. from jakob@
+ - (djm) OSX/Darwin put the PAM headers in a different place, detect this.
+ Report from jakob@
+
+20031231
+ - (dtucker) OpenBSD CVS Sync
+ - djm@cvs.openbsd.org 2003/12/22 09:16:58
+ [moduli.c ssh-keygen.1 ssh-keygen.c]
+ tidy up moduli generation debugging, add -v (verbose/debug) option to
+ ssh-keygen; ok markus@
+ - markus@cvs.openbsd.org 2003/12/22 20:29:55
+ [cipher-3des1.c]
+ EVP_CIPHER_CTX_cleanup() for the des contexts; pruiksma@freesurf.fr
+ - jakob@cvs.openbsd.org 2003/12/23 16:12:10
+ [servconf.c servconf.h session.c sshd_config]
+ implement KerberosGetAFSToken server option. ok markus@, beck@
+ - millert@cvs.openbsd.org 2003/12/29 16:39:50
+ [sshd_config]
+ KeepAlive has been obsoleted, use TCPKeepAlive instead; markus@ OK
+ - dtucker@cvs.openbsd.org 2003/12/31 00:24:50
+ [auth2-passwd.c]
+ Ignore password change request during password auth (which we currently
+ don't support) and discard proposed new password. corrections/ok markus@
+ - (dtucker) [configure.ac] Only test setresuid and setresgid if they exist.
+
+20031219
+ - (dtucker) [defines.h] Bug #458: Define SIZE_T_MAX as UINT_MAX if we
+ typedef size_t ourselves.
+
+20031218
+ - (dtucker) [configure.ac] Don't use setre[ug]id on DG-UX, from Tom Orban.
+ - (dtucker) [auth-pam.c] Do PAM chauthtok during SSH2 keyboard-interactive
+ authentication. Partially fixes bug #423. Feedback & ok djm@
+
+20031217
+ - (djm) OpenBSD CVS Sync
+ - markus@cvs.openbsd.org 2003/12/09 15:28:43
+ [serverloop.c]
+ make ClientKeepAlive work for ssh -N, too (no login shell requested).
+ 1) send a bogus channel request if we find a channel
+ 2) send a bogus global request if we don't have a channel
+ ok + test beck@
+ - markus@cvs.openbsd.org 2003/12/09 17:29:04
+ [sshd.c]
+ fix -o and HUP; ok henning@
+ - markus@cvs.openbsd.org 2003/12/09 17:30:05
+ [ssh.c]
+ don't modify argv for ssh -o; similar to sshd.c 1.283
+ - markus@cvs.openbsd.org 2003/12/09 21:53:37
+ [readconf.c readconf.h scp.1 servconf.c servconf.h sftp.1 ssh.1]
+ [ssh_config.5 sshconnect.c sshd.c sshd_config.5]
+ rename keepalive to tcpkeepalive; the old name causes too much
+ confusion; ok djm, dtucker; with help from jmc@
+ - dtucker@cvs.openbsd.org 2003/12/09 23:45:32
+ [clientloop.c]
+ Clear exit code when ssh -N is terminated with a SIGTERM. ok markus@
+ - markus@cvs.openbsd.org 2003/12/14 12:37:21
+ [ssh_config.5]
+ we don't support GSS KEX; from Simon Wilkinson
+ - markus@cvs.openbsd.org 2003/12/16 15:49:51
+ [clientloop.c clientloop.h readconf.c readconf.h scp.1 sftp.1 ssh.1]
+ [ssh.c ssh_config.5]
+ application layer keep alive (ServerAliveInterval ServerAliveCountMax)
+ for ssh(1), similar to the sshd(8) option; ok beck@; with help from
+ jmc and dtucker@
+ - markus@cvs.openbsd.org 2003/12/16 15:51:54
+ [dh.c]
+ use <= instead of < in dh_estimate; ok provos/hshoexer;
+ do not return < DH_GRP_MIN
+ - (dtucker) [acconfig.h configure.ac uidswap.c] Bug #645: Check for
+ setres[ug]id() present but not implemented (eg some Linux/glibc
+ combinations).
+ - (bal) [openbsd-compat/bsd-misc.c] unset 'signal' defined if we are
+ using a real 'signal()' (Noticed by a NeXT Compile)
+
+20031209
+ - (dtucker) OpenBSD CVS Sync
+ - matthieu@cvs.openbsd.org 2003/11/25 23:10:08
+ [ssh-add.1]
+ ssh-add doesn't need to be a descendant of ssh-agent. Ok markus@, jmc@.
+ - djm@cvs.openbsd.org 2003/11/26 21:44:29
+ [cipher-aes.c]
+ fix #ifdef before #define; ok markus@
+ (RCS ID sync only, Portable already had this)
+ - markus@cvs.openbsd.org 2003/12/02 12:15:10
+ [progressmeter.c]
+ improvments from andreas@:
+ * saner speed estimate for transfers that takes less than a second by
+ rounding the time to 1 second.
+ * when the transfer is finished calculate the actual total speed
+ rather than the current speed which is given during the transfer
+ - markus@cvs.openbsd.org 2003/12/02 17:01:15
+ [channels.c session.c ssh-agent.c ssh.h sshd.c]
+ use SSH_LISTEN_BACKLOG (=128) in listen(2).
+ - djm@cvs.openbsd.org 2003/12/07 06:34:18
+ [moduli.c]
+ remove unused debugging #define templates
+ - markus@cvs.openbsd.org 2003/12/08 11:00:47
+ [kexgexc.c]
+ print requested group size in debug; ok djm
+ - dtucker@cvs.openbsd.org 2003/12/09 13:52:55
+ [moduli.c]
+ Prevent ssh-keygen -T from outputting moduli with a generator of 0, since
+ they can't be used for Diffie-Hellman. Assistance and ok djm@
+ - (dtucker) [ssh-keyscan.c] Sync RCSIDs, missed in SSH_SSFDMAX change below.
+
+20031208
+ - (tim) [configure.ac] Bug 770. Fix --without-rpath.
+
20031123
- (djm) [canohost.c] Move IPv4inV6 mapped address normalisation to its own
function and call it unconditionally
[ssh-keyscan.c]
from portable - use sysconf to detect fd limit; ok markus@
(tidy diff by adding SSH_SSFDMAX macro to defines.h)
+ - djm@cvs.openbsd.org 2003/11/23 23:18:45
+ [ssh-keygen.c]
+ consistency PATH_MAX -> MAXPATHLEN; ok markus@
+ (RCS ID sync only)
+ - djm@cvs.openbsd.org 2003/11/23 23:21:21
+ [scp.c]
+ from portable: rename clashing variable limit-> limit_rate; ok markus@
+ (RCS ID sync only)
+ - dtucker@cvs.openbsd.org 2003/11/24 00:16:35
+ [ssh.1 ssh.c]
+ Make ssh -k mean GSSAPIDelegateCredentials=no. Suggestion & ok markus@
+ - (djm) Annotate OpenBSD-derived files in openbsd-compat/ with original
+ source file path (in OpenBSD tree).
20031122
- (dtucker) [channels.c] Make AIX write limit code clearer. Suggested by djm@