+20070306
+ - (djm) OpenBSD CVS Sync
+ - jmc@cvs.openbsd.org 2007/03/01 16:19:33
+ [sshd_config.5]
+ sort the `match' keywords;
+ - djm@cvs.openbsd.org 2007/03/06 10:13:14
+ [version.h]
+ openssh-4.6; "please" deraadt@
+ - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
+ [contrib/suse/openssh.spec] crank spec files for release
+ - (djm) [README] correct link to release notes
+ - (djm) Release 4.6p1
+
+20070304
+ - (djm) [configure.ac] add a --without-openssl-header-check option to
+ configure, as some platforms (OS X) ship OpenSSL headers whose version
+ does not match that of the shipping library. ok dtucker@
+ - (dtucker) [openbsd-compat/openssl-compat.h] Bug #1291: Work around a
+ bug in OpenSSL 0.9.8e that prevents aes256-ctr, aes192-ctr and arcfour256
+ ciphers from working correctly (disconnects with "Bad packet length"
+ errors) as found by Ben Harris. ok djm@
+
+20070303
+ - (dtucker) [regress/agent-ptrace.sh] Make ttrace gdb error a little more
+ general to cover newer gdb versions on HP-UX.
+
+20070302
+ - (dtucker) [configure.ac] For Cygwin, read files in textmode (which allows
+ CRLF as well as LF lineendings) and write in binary mode. Patch from
+ vinschen at redhat.com.
+ - (dtucker) [INSTALL] Update to autoconf-2.61.
+
+20070301
+ - (dtucker) OpenBSD CVS Sync
+ - dtucker@cvs.openbsd.org 2007/03/01 10:28:02
+ [auth2.c sshd_config.5 servconf.c]
+ Remove ChallengeResponseAuthentication support inside a Match
+ block as its interaction with KbdInteractive makes it difficult to
+ support. Also, relocate the CR/kbdint option special-case code into
+ servconf. "please commit" djm@, ok markus@ for the relocation.
+ - (tim) [buildpkg.sh.in openssh.xml.in] Clean up Solaris 10 smf(5) bits.
+ "Looks sane" dtucker@
+
+20070228
+ - (dtucker) OpenBSD CVS Sync
+ - dtucker@cvs.openbsd.org 2007/02/28 00:55:30
+ [ssh-agent.c]
+ Remove expired keys periodically so they don't remain in memory when
+ the agent is entirely idle, as noted by David R. Piegdon. This is the
+ simple fix, a more efficient one will be done later. With markus,
+ deraadt, with & ok djm.
+
+20070225
+ - (dtucker) OpenBSD CVS Sync
+ - djm@cvs.openbsd.org 2007/02/20 10:25:14
+ [clientloop.c]
+ set maximum packet and window sizes the same for multiplexed clients
+ as normal connections; ok markus@
+ - dtucker@cvs.openbsd.org 2007/02/21 11:00:05
+ [sshd.c]
+ Clear alarm() before restarting sshd on SIGHUP. Without this, if there's
+ a SIGALRM pending (for SSH1 key regeneration) when sshd is SIGHUP'ed, the
+ newly exec'ed sshd will get the SIGALRM and not have a handler for it,
+ and the default action will terminate the listening sshd. Analysis and
+ patch from andrew at gaul.org.
+ - dtucker@cvs.openbsd.org 2007/02/22 12:58:40
+ [servconf.c]
+ Check activep so Match and GatewayPorts work together; ok markus@
+ - ray@cvs.openbsd.org 2007/02/24 03:30:11
+ [moduli.c]
+ - strlen returns size_t, not int.
+ - Pass full buffer size to fgets.
+ OK djm@, millert@, and moritz@.
+
+20070219
+ - (dtucker) OpenBSD CVS Sync
+ - jmc@cvs.openbsd.org 2007/01/10 13:23:22
+ [ssh_config.5]
+ do not use a list for SYNOPSIS;
+ this is actually part of a larger report sent by eric s. raymond
+ and forwarded by brad, but i only read half of it. spotted by brad.
+ - jmc@cvs.openbsd.org 2007/01/12 20:20:41
+ [ssh-keygen.1 ssh-keygen.c]
+ more secsh -> rfc 4716 updates;
+ spotted by wiz@netbsd
+ ok markus
+ - dtucker@cvs.openbsd.org 2007/01/17 23:22:52
+ [readconf.c]
+ Honour activep for times (eg ServerAliveInterval) while parsing
+ ssh_config and ~/.ssh/config so they work properly with Host directives.
+ From mario.lorenz@wincor-nixdorf.com via bz #1275. ok markus@
+ - stevesk@cvs.openbsd.org 2007/01/21 01:41:54
+ [auth-skey.c kex.c ssh-keygen.c session.c clientloop.c]
+ spaces
+ - stevesk@cvs.openbsd.org 2007/01/21 01:45:35
+ [readconf.c]
+ spaces
+ - djm@cvs.openbsd.org 2007/01/22 11:32:50
+ [sftp-client.c]
+ return error from do_upload() when a write fails. fixes bz#1252: zero
+ exit status from sftp when uploading to a full device. report from
+ jirkat AT atlas.cz; ok dtucker@
+ - djm@cvs.openbsd.org 2007/01/22 13:06:21
+ [scp.c]
+ fix detection of whether we should show progress meter or not: scp
+ tested isatty(stderr) but wrote the progress meter to stdout. This patch
+ makes it test stdout. bz#1265 reported by junkmail AT bitsculpture.com;
+ of dtucker@
+ - stevesk@cvs.openbsd.org 2007/02/14 14:32:00
+ [bufbn.c]
+ typos in comments; ok jmc@
+ - dtucker@cvs.openbsd.org 2007/02/19 10:45:58
+ [monitor_wrap.c servconf.c servconf.h monitor.c sshd_config.5]
+ Teach Match how handle config directives that are used before
+ authentication. This allows configurations such as permitting password
+ authentication from the local net only while requiring pubkey from
+ offsite. ok djm@, man page bits ok jmc@
+ - (dtucker) [contrib/findssl.sh] Add "which" as a shell function since some
+ platforms don't have it. Patch from dleonard at vintela.com.
+ - (dtucker) [openbsd-compat/getrrsetbyname.c] Don't attempt to calloc
+ an array for signatures when there are none since "calloc(0, n) returns
+ NULL on some platforms (eg Tru64), which is explicitly permitted by
+ POSIX. Diagnosis and patch by svallet genoscope.cns.fr.
+
+20070128
+ - (djm) [channels.c serverloop.c] Fix so-called "hang on exit" (bz #52)
+ when closing a tty session when a background process still holds tty
+ fds open. Great detective work and patch by Marc Aurele La France,
+ slightly tweaked by me; ok dtucker@
+
+20070123
+ - (dtucker) [openbsd-compat/bsd-snprintf.c] Static declarations for public
+ library interfaces aren't very helpful. Fix up the DOPR_OUTCH macro
+ so it works properly and modify its callers so that they don't pre or
+ post decrement arguments that are conditionally evaluated. While there,
+ put SNPRINTF_CONST back as it prevents build failures in some
+ configurations. ok djm@ (for most of it)
+
+20070122
+ - (djm) [ssh-rand-helper.8] manpage nits;
+ from dleonard AT vintela.com (bz#1529)
+
+20070117
+ - (dtucker) [packet.c] Re-remove in_systm.h since it's already in includes.h
+ and multiple including it causes problems on old IRIXes. (It snuck back
+ in during a sync.) Found (again) by Georg Schwarz.
+
20070114
- - (dtucker) [ssh-keygen.c] ac -> argv to match earlier sync.
+ - (dtucker) [ssh-keygen.c] av -> argv to match earlier sync.
+ - (djm) [openbsd-compat/bsd-snprintf.c] Fix integer overflow in return
+ value of snprintf replacement, similar to bugs in various libc
+ implementations. This overflow is not exploitable in OpenSSH.
+ While I'm fiddling with it, make it a fair bit faster by inlining the
+ append-char routine; ok dtucker@
20070105
- (djm) OpenBSD CVS Sync