xref: /freebsd/crypto/openssh/ChangeLog (revision 1669d8afc64812c8d2d1d147ae1fd42ff441e1b1)
120061107
2 - (dtucker) [sshd.c] Use privsep_pw if we have it, but only require it
3   if we absolutely need it.  Pointed out by Corinna, ok djm@
4 - (dtucker) OpenBSD CVS Sync
5   - markus@cvs.openbsd.org 2006/11/06 21:25:28
6     [auth-rsa.c kexgexc.c kexdhs.c key.c ssh-dss.c sshd.c kexgexs.c
7     ssh-keygen.c bufbn.c moduli.c scard.c kexdhc.c sshconnect1.c dh.c rsa.c]
8     add missing checks for openssl return codes; with & ok djm@
9   - markus@cvs.openbsd.org 2006/11/07 10:31:31
10     [monitor.c version.h]
11     correctly check for bad signatures in the monitor, otherwise the monitor
12     and the unpriv process can get out of sync. with dtucker@, ok djm@,
13     dtucker@
14 - (dtucker) [README contrib/{caldera,redhat,contrib}/openssh.spec] Bump
15   versions.
16 - (dtucker) [dh.c] Type fix for BN_hex2bn; ok markus@
17 - (dtucker) Release 4.5p1.
18
1920061105
20 - (djm) OpenBSD CVS Sync
21   - otto@cvs.openbsd.org 2006/10/28 18:08:10
22     [ssh.1]
23     correct/expand example of usage of -w; ok jmc@ stevesk@
24   - markus@cvs.openbsd.org 2006/10/31 16:33:12
25     [kexdhc.c kexdhs.c kexgexc.c kexgexs.c]
26     check DH_compute_key() for -1 even if it should not happen because of
27     earlier calls to dh_pub_is_valid(); report krahmer at suse.de; ok djm
28
2920061101
30 - (dtucker) [openbsd-compat/port-solaris.c] Bug #1255: Make only hwerr
31   events fatal in Solaris process contract support and tell it to signal
32   only processes in the same process group when something happens.
33   Based on information from andrew.benham at thus.net and similar to
34   a patch from Chad Mynhier.  ok djm@
35
3620061027
37- (djm) [auth.c] gc some dead code
38
3920061023
40 - (djm) OpenBSD CVS Sync
41   - ray@cvs.openbsd.org 2006/09/30 17:48:22
42     [sftp.c]
43     Clear errno before calling the strtol functions.
44     From Paul Stoeber <x0001 at x dot de1 dot cc>.
45     OK deraadt@.
46   - djm@cvs.openbsd.org 2006/10/06 02:29:19
47     [ssh-agent.c ssh-keyscan.c ssh.c]
48     sys/resource.h needs sys/time.h; prompted by brad@
49     (NB. Id sync only for portable)
50   - djm@cvs.openbsd.org 2006/10/09 23:36:11
51     [session.c]
52     xmalloc -> xcalloc that was missed previously, from portable
53     (NB. Id sync only for portable, obviously)
54   - markus@cvs.openbsd.org 2006/10/10 10:12:45
55     [sshconnect.c]
56     sleep before retrying (not after) since sleep changes errno; fixes
57     pr 5250; rad@twig.com; ok dtucker djm
58   - markus@cvs.openbsd.org 2006/10/11 12:38:03
59     [clientloop.c serverloop.c]
60     exit instead of doing a blocking tcp send if we detect a client/server
61     timeout, since the tcp sendqueue might be already full (of alive
62     requests); ok dtucker, report mpf
63   - djm@cvs.openbsd.org 2006/10/22 02:25:50
64     [sftp-client.c]
65     cancel progress meter when upload write fails; ok deraadt@
66 - (tim) [Makefile.in scard/Makefile.in] Add datarootdir= lines to keep
67   autoconf 2.60 from complaining.
68
6920061018
70 - (dtucker) OpenBSD CVS Sync
71   - ray@cvs.openbsd.org 2006/09/25 04:55:38
72     [ssh-keyscan.1 ssh.1]
73     Change "a SSH" to "an SSH".  Hurray, I'm not the only one who
74     pronounces "SSH" as "ess-ess-aich".
75     OK jmc@ and stevesk@.
76 - (dtucker) [sshd.c] Reshuffle storing of pw struct; prevents warnings
77   on older versions of OS X.  ok djm@
78
7920061016
80 - (dtucker) [monitor_fdpass.c] Include sys/in.h, required for cmsg macros
81   on older (2.0) Linuxes.  Based on patch from thmo-13 at gmx de.
82
8320061006
84 - (tim) [buildpkg.sh.in] Use uname -r instead of -v in OS_VER for Solaris.
85   Differentiate between OpenServer 5 and OpenServer 6
86 - (dtucker) [configure.ac] Set put -lselinux into $LIBS while testing for
87   SELinux functions so they're detected correctly.  Patch from pebenito at
88   gentoo.org.
89 - (tim) [buildpkg.sh.in] Some systems have really limited nawk (OpenServer).
90   Allow setting alternate awk in openssh-config.local.
91
9220061003
93 - (tim) [configure.ac] Move CHECK_HEADERS test before platform specific
94   section so additional platform specific CHECK_HEADER tests will work
95   correctly. Fixes "<net/if_tap.h> on FreeBSD" problem report by des AT des.no
96   Feedback and "seems like a good idea" dtucker@
97
9820061001
99 - (dtucker) [audit-bsm.c] Include errno.h.  Pointed out by des at des.no.
100
10120060929
102 - (dtucker) [configure.ac] Bug #1239: Fix configure test for OpenSSH engine
103   support.  Patch from andrew.benham at thus net.
104
10520060928
106 - (dtucker) [entropy.c] Bug #1238: include signal.h to fix compilation error
107   on Solaris 8 w/out /dev/random or prngd.  Patch from rl at
108   math.technion.ac.il.
109
11020060926
111 - (dtucker) [bufaux.h] nuke bufaux.h; it's already gone from OpenBSD and not
112   referenced any more.  ok djm@
113 - (dtucker) [sftp-server.8] Resync; spotted by djm@
114 - (dtucker) Release 4.4p1.
115
11620060924
117 - (tim) [configure.ac] Remove CFLAGS hack for UnixWare 1.x/2.x (added
118   to rev 1.308) to work around broken gcc 2.x header file.
119
12020060923
121 - (dtucker) [configure.ac] Bug #1234: Put opensc libs into $LIBS rather than
122   $LDFLAGS.  Patch from vapier at gentoo org.
123
12420060922
125 - (dtucker) [packet.c canohost.c] Include arpa/inet.h for htonl macros on
126   some platforms (eg HP-UX 11.00).  From santhi.amirta at gmail com.
127
12820060921
129 - (dtucker) OpenBSD CVS Sync
130   - otto@cvs.openbsd.org 2006/09/19 05:52:23
131     [sftp.c]
132     Use S_IS* macros insted of masking with S_IF* flags. The latter may
133     have multiple bits set, which lead to surprising results. Spotted by
134     Paul Stoeber, more to come. ok millert@ pedro@ jaredy@ djm@
135   - markus@cvs.openbsd.org 2006/09/19 21:14:08
136     [packet.c]
137     client NULL deref on protocol error; Tavis Ormandy, Google Security Team
138 - (dtucker) [defines.h] Include unistd.h before defining getpgrp; fixes
139   build error on Ultrix.  From Bernhard Simon.
140
14120060918
142 - (dtucker) [configure.ac] On AIX, check to see if the compiler will allow
143   macro redefinitions, and if not, remove "-qlanglvl=ansi" from the flags.
144   Allows build out of the box with older VAC and XLC compilers.  Found by
145   David Bronder and Bernhard Simon.
146 - (dtucker) [openbsd-compat/port-aix.{c,h}] Reduce scope of includes.
147   Prevents macro redefinition warnings of "RDONLY".
148
14920060916
150 - OpenBSD CVS Sync
151   - djm@cvs.openbsd.org 2006/09/16 19:53:37
152     [deattack.c deattack.h packet.c]
153     limit maximum work performed by the CRC compensation attack detector,
154     problem reported by Tavis Ormandy, Google Security Team;
155     ok markus@ deraadt@
156 - (djm) Add openssh.xml to .cvsignore and sort it
157 - (dtucker) [auth-pam.c] Propogate TZ environment variable to PAM auth
158   process so that any logging it does is with the right timezone.  From
159   Scott Strickler, ok djm@.
160 - (dtucker) [monitor.c] Correctly handle auditing of single commands when
161   using Protocol 1.  From jhb at freebsd.
162 - (djm) [sshd.c] Fix warning/API abuse; ok dtucker@
163 - (dtucker) [INSTALL] Add info about audit support.
164
16520060912
166 - (djm) [Makefile.in buildpkg.sh.in configure.ac openssh.xml.in]
167   Support SMF in Solaris Packages if enabled by configure. Patch from
168   Chad Mynhier, tested by dtucker@
169
17020060911
171 - (dtucker) [cipher-aes.c] Include string.h for memcpy and friends.  Noted
172   by Pekka Savola.
173
17420060910
175 - (dtucker) [contrib/aix/buildbff.sh] Ensure that perl is available.
176 - (dtucker) [configure.ac] Add -lcrypt to let DragonFly build OOTB.
177
17820060909
179 - (dtucker) [openbsd-compat/bsd-snprintf.c] Add stdarg.h.
180 - (dtucker) [contrib/aix/buildbff.sh] Always create privsep user.
181 - (dtucker) [buildpkg.sh.in] Always create privsep user.  ok djm@
182
18320060908
184 - (dtucker) [auth-sia.c] Add includes required for build on Tru64.  Patch
185   from Chris Adams.
186 - (dtucker) [configure.ac] The BSM header test needs time.h in some cases.
187
18820060907
189 - (djm) [sshd.c auth.c] Set up fakepw() with privsep uid/gid, so it can
190   be used to drop privilege to; fixes Solaris GSSAPI crash reported by
191   Magnus Abrante; suggestion and feedback dtucker@
192   NB. this change will require that the privilege separation user must
193   exist on all the time, not just when UsePrivilegeSeparation=yes
194 - (tim) [configure.ac] s/BROKEN_UPDWTMP/BROKEN_UPDWTMPX/ on SCO OSR6
195 - (dtucker) [loginrec.c] Wrap paths.h in HAVE_PATHS_H.
196 - (dtucker) [regress/cfgmatch.sh] stop_client is racy, so give us a better
197   chance of winning.
198
19920060905
200 - (dtucker) [configure.ac] s/AC_DEFINES/AC_DEFINE/ spotted by Roumen Petrov.
201 - (dtucker) [loginrec.c] Include paths.h for _PATH_BTMP.
202
20320060904
204 - (dtucker) [configure.ac] Define BROKEN_UPDWTMP on SCO OSR6 as the native
205   updwdtmp seems to generate invalid wtmp entries.  From Roger Cornelius,
206   ok djm@
207
20820060903
209 - (dtucker) [configure.ac openbsd-compat/openbsd-compat.h] Check for
210   declaration of writev(2) and declare it ourselves if necessary.  Makes
211   the atomiciov() calls build on really old systems.  ok djm@
212
21320060902
214 - (dtucker) [openbsd-compat/port-irix.c] Add errno.h, found by Iain Morgan.
215 - (dtucker) [ssh-keyscan.c ssh-rand-helper.c ssh.c sshconnect.c
216   openbsd-compat/bindresvport.c openbsd-compat/getrrsetbyname.c
217   openbsd-compat/port-tun.c openbsd-compat/rresvport.c] Include <arpa/inet.h>
218   for hton* and ntoh* macros.  Required on (at least) HP-UX since we define
219   _XOPEN_SOURCE_EXTENDED.  Found by santhi.amirta at gmail com.
220
22120060901
222 - (djm) [audit-bsm.c audit.c auth-bsdauth.c auth-chall.c auth-pam.c]
223   [auth-rsa.c auth-shadow.c auth-sia.c auth1.c auth2-chall.c]
224   [auth2-gss.c auth2-kbdint.c auth2-none.c authfd.c authfile.c]
225   [cipher-3des1.c cipher-aes.c cipher-bf1.c cipher-ctr.c clientloop.c]
226   [dh.c dns.c entropy.c gss-serv-krb5.c gss-serv.c hostfile.c kex.c]
227   [kexdhc.c kexdhs.c kexgexc.c kexgexs.c key.c loginrec.c mac.c]
228   [md5crypt.c monitor.c monitor_wrap.c readconf.c rsa.c]
229   [scard-opensc.c scard.c session.c ssh-add.c ssh-agent.c ssh-dss.c]
230   [ssh-keygen.c ssh-keysign.c ssh-rsa.c ssh.c sshconnect.c]
231   [sshconnect1.c sshconnect2.c sshd.c]
232   [openbsd-compat/bsd-cray.c openbsd-compat/port-aix.c]
233   [openbsd-compat/port-linux.c openbsd-compat/port-solaris.c]
234   [openbsd-compat/port-uw.c]
235   Lots of headers for SCO OSR6, mainly adding stdarg.h for log.h;
236   compile problems reported by rac AT tenzing.org
237 - (djm) [includes.h monitor.c openbsd-compat/bindresvport.c]
238   [openbsd-compat/rresvport.c] Some more headers: netinet/in.h
239   sys/socket.h and unistd.h in various places
240 - (dtucker) [openbsd-compat/bsd-cygwin_util.c] Fix implict declaration
241   warnings for binary_open and binary_close.  Patch from Corinna Vinschen.
242 - (dtucker) [configure.ac includes.h openbsd-compat/glob.{c,h}] Explicitly
243   test for GLOB_NOMATCH and use our glob functions if it's not found.
244   Stops sftp from segfaulting when attempting to get a nonexistent file on
245   Cygwin (previous versions of OpenSSH didn't use the native glob). Partly
246   from and tested by Corinna Vinschen.
247 - (dtucker) [README contrib/{caldera,redhat,suse}/openssh.spec]  Crank
248   versions.
249
25020060831
251 - (djm) [CREDITS LICENCE Makefile.in auth.c configure.ac includes.h ]
252   [platform.c platform.h sshd.c openbsd-compat/Makefile.in]
253   [openbsd-compat/openbsd-compat.h openbsd-compat/port-solaris.c]
254   [openbsd-compat/port-solaris.h] Add support for Solaris process
255   contracts, enabled with --use-solaris-contracts. Patch from Chad
256   Mynhier, tweaked by dtucker@ and myself; ok dtucker@
257 - (dtucker) [contrib/cygwin/ssh-host-config] Add SeTcbPrivilege privilege
258   while setting up the ssh service account.  Patch from Corinna Vinschen.
259
26020060830
261 - (djm) OpenBSD CVS Sync
262   - dtucker@cvs.openbsd.org 2006/08/21 08:14:01
263     [sshd_config.5]
264     Document HostbasedUsesNameFromPacketOnly.  Corrections from jmc@,
265     ok jmc@ djm@
266   - dtucker@cvs.openbsd.org 2006/08/21 08:15:57
267     [sshd.8]
268     Add more detail about what permissions are and aren't accepted for
269     authorized_keys files.  Corrections jmc@, ok djm@, "looks good" jmc@
270   - djm@cvs.openbsd.org 2006/08/29 10:40:19
271     [channels.c session.c]
272     normalise some inconsistent (but harmless) NULL pointer checks
273     spotted by the Stanford SATURN tool, via Isil Dillig;
274     ok markus@ deraadt@
275   - dtucker@cvs.openbsd.org 2006/08/29 12:02:30
276     [gss-genr.c]
277     Work around a problem in Heimdal that occurs when KRB5CCNAME file is
278     missing, by checking whether or not kerberos allocated us a context
279     before attempting to free it.  Patch from Simon Wilkinson, tested by
280     biorn@, ok djm@
281   - dtucker@cvs.openbsd.org 2006/08/30 00:06:51
282     [sshconnect2.c]
283     Fix regression where SSH2 banner is printed at loglevels ERROR and FATAL
284     where previously it weren't.  bz #1221, found by Dean Kopesky, ok djm@
285   - djm@cvs.openbsd.org 2006/08/30 00:14:37
286     [version.h]
287     crank to 4.4
288 - (djm) [openbsd-compat/xcrypt.c] needs unistd.h
289 - (dtucker) [auth.c openbsd-compat/port-aix.c] Bug #1207: always call
290   loginsuccess on AIX immediately after authentication to clear the failed
291   login count.  Previously this would only happen when an interactive
292   session starts (ie when a pty is allocated) but this means that accounts
293   that have primarily non-interactive sessions (eg scp's) may gradually
294   accumulate enough failures to lock out an account.  This change may have
295   a side effect of creating two audit records, one with a tty of "ssh"
296   corresponding to the authentication and one with the allocated pty per
297   interactive session.
298
29920060824
300 - (dtucker) [openbsd-compat/basename.c] Include errno.h.
301 - (dtucker) [openbsd-compat/bsd-misc.c] Add includes needed for select(2) on
302   older systems.
303 - (dtucker) [openbsd-compat/bsd-misc.c] Include <sys/select.h> for select(2)
304   on POSIX systems.
305 - (dtucker) [openbsd-compat/bsd-openpty.c] Include for ioctl(2).
306 - (dtucker) [openbsd-compat/rresvport.c] Include <stdlib.h> for malloc.
307 - (dtucker) [openbsd-compat/xmmap.c] Move #define HAVE_MMAP to prevent
308   unused variable warning when we have a broken or missing mmap(2).
309
31020060822
311 - (dtucker) [Makefile.in] Bug #1177: fix incorrect path for sshrc in
312   Makefile.  Patch from santhi.amirta at gmail, ok djm.
313
31420060820
315 - (dtucker) [log.c] Move ifdef to prevent unused variable warning.
316 - (dtucker) [configure.ac] Save $LIBS during PAM library tests and restore
317   afterward.  Removes the need to mangle $LIBS later to remove -lpam and -ldl.
318 - (dtucker) [configure.ac] Relocate --with-pam parts in preparation for
319   fixing bug #1181.  No changes yet.
320 - (dtucker) [configure.ac] Bug #1181: Explicitly test to see if OpenSSL
321   (0.9.8a and presumably newer) requires -ldl to successfully link.
322 - (dtucker) [configure.ac] Remove errant "-".
323
32420060819
325 - (djm) OpenBSD CVS Sync
326   - djm@cvs.openbsd.org 2006/08/18 22:41:29
327     [gss-genr.c]
328     GSSAPI error code should be 0 and not -1; from simon@sxw.org.uk
329 - (dtucker) [openbsd-compat/regress/Makefile.in] Add $(EXEEXT) and add a
330   single rule for the test progs.
331
33220060818
333 - (dtucker) [configure.ac openbsd-compat/bsd-closefrom.c] Resync with
334   closefrom.c from sudo.
335 - (dtucker) [openbsd-compat/bsd-closefrom.c] Comment out rcsid.
336 - (dtucker) [openbsd-compat/regress/snprintftest.c] Newline on error.
337 - (dtucker) [openbsd-compat/regress/Makefile.in] Use implicit rules for the
338   test progs instead; they work better than what we have.
339 - (djm) OpenBSD CVS Sync
340   - stevesk@cvs.openbsd.org 2006/08/06 01:13:32
341     [compress.c monitor.c monitor_wrap.c]
342     "zlib.h" can be <zlib.h>; ok djm@ markus@
343   - miod@cvs.openbsd.org 2006/08/12 20:46:46
344     [monitor.c monitor_wrap.c]
345     Revert previous include file ordering change, for ssh to compile under
346     gcc2 (or until openssl include files are cleaned of parameter names
347     in function prototypes)
348   - dtucker@cvs.openbsd.org 2006/08/14 12:40:25
349     [servconf.c servconf.h sshd_config.5]
350     Add ability to match groups to Match keyword in sshd_config.  Feedback
351     djm@, stevesk@, ok stevesk@.
352   - djm@cvs.openbsd.org 2006/08/16 11:47:15
353     [sshd.c]
354     factor inetd connection, TCP listen and main TCP accept loop out of
355     main() into separate functions to improve readability; ok markus@
356   - deraadt@cvs.openbsd.org 2006/08/18 09:13:26
357     [log.c log.h sshd.c]
358     make signal handler termination path shorter; risky code pointed out by
359     mark dowd; ok djm markus
360   - markus@cvs.openbsd.org 2006/08/18 09:15:20
361     [auth.h session.c sshd.c]
362     delay authentication related cleanups until we're authenticated and
363     all alarms have been cancelled; ok deraadt
364   - djm@cvs.openbsd.org 2006/08/18 10:27:16
365     [misc.h]
366     reorder so prototypes are sorted by the files they refer to; no
367     binary change
368   - djm@cvs.openbsd.org 2006/08/18 13:54:54
369     [gss-genr.c ssh-gss.h sshconnect2.c]
370     bz #1218 - disable SPNEGO as per RFC4462; diff from simon AT sxw.org.uk
371     ok markus@
372   - djm@cvs.openbsd.org 2006/08/18 14:40:34
373     [gss-genr.c ssh-gss.h]
374     constify host argument to match the rest of the GSSAPI functions and
375     unbreak compilation with -Werror
376 - (djm) Disable sigdie() for platforms that cannot safely syslog inside
377   a signal handler (basically all of them, excepting OpenBSD);
378   ok dtucker@
379
38020060817
381 - (dtucker) [openbsd-compat/fake-rfc2553.c openbsd-compat/setproctitle.c]
382   Include stdlib.h for malloc and friends.
383 - (dtucker) [configure.ac openbsd-compat/bsd-closefrom.c] Use F_CLOSEM fcntl
384   for closefrom() on AIX.  Pointed out by William Ahern.
385 - (dtucker) [openbsd-compat/regress/{Makefile.in,closefromtest.c}] Regress
386   test for closefrom() in compat code.
387
38820060816
389 - (djm) [audit-bsm.c] Sprinkle in some headers
390
39120060815
392 - (dtucker) [LICENCE] Add Reyk to the list for the compat dir.
393
39420060806
395 - (djm) [openbsd-compat/bsd-getpeereid.c] Add some headers to quiet warnings
396   on Solaris 10
397
39820060806
399 - (dtucker) [defines.h] With the includes.h changes we no longer get the
400   name clash on "YES" so we can remove the workaround for it.
401 - (dtucker) [openbsd-compat/{bsd-asprintf.c,bsd-openpty.c,bsd-snprintf.c,
402   glob.c}] Include stdlib.h for malloc and friends in compat code.
403
40420060805
405 - (djm) OpenBSD CVS Sync
406   - stevesk@cvs.openbsd.org 2006/07/24 13:58:22
407     [sshconnect.c]
408     disable tunnel forwarding when no strict host key checking
409     and key changed; ok djm@ markus@ dtucker@
410   - stevesk@cvs.openbsd.org 2006/07/25 02:01:34
411     [scard.c]
412     need #include <string.h>
413   - stevesk@cvs.openbsd.org 2006/07/25 02:59:21
414     [channels.c clientloop.c packet.c scp.c serverloop.c sftp-client.c]
415     [sftp-server.c ssh-agent.c ssh-keyscan.c sshconnect.c sshd.c]
416     move #include <sys/time.h> out of includes.h
417   - stevesk@cvs.openbsd.org 2006/07/26 02:35:17
418     [atomicio.c auth.c dh.c authfile.c buffer.c clientloop.c kex.c]
419     [groupaccess.c gss-genr.c kexgexs.c misc.c monitor.c monitor_mm.c]
420     [packet.c scp.c serverloop.c session.c sftp-client.c sftp-common.c]
421     [sftp-server.c sftp.c ssh-add.c ssh-agent.c ssh-keygen.c sshlogin.c]
422     [uidswap.c xmalloc.c]
423     move #include <sys/param.h> out of includes.h
424   - stevesk@cvs.openbsd.org 2006/07/26 13:57:17
425     [authfd.c authfile.c dh.c canohost.c channels.c clientloop.c compat.c]
426     [hostfile.c kex.c log.c misc.c moduli.c monitor.c packet.c readpass.c]
427     [scp.c servconf.c session.c sftp-server.c sftp.c ssh-add.c ssh-agent.c]
428     [ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh.c sshconnect.c]
429     [sshconnect1.c sshd.c xmalloc.c]
430     move #include <stdlib.h> out of includes.h
431   - jmc@cvs.openbsd.org 2006/07/27 08:00:50
432     [ssh_config.5]
433     avoid confusing wording in HashKnownHosts:
434     originally spotted by alan amesbury;
435     ok deraadt
436   - jmc@cvs.openbsd.org 2006/07/27 08:00:50
437     [ssh_config.5]
438     avoid confusing wording in HashKnownHosts:
439     originally spotted by alan amesbury;
440     ok deraadt
441   - dtucker@cvs.openbsd.org 2006/08/01 11:34:36
442     [sshconnect.c]
443     Allow fallback to known_hosts entries without port qualifiers for
444     non-standard ports too, so that all existing known_hosts entries will be
445     recognised.  Requested by, feedback and ok markus@
446   - stevesk@cvs.openbsd.org 2006/08/01 23:22:48
447     [auth-passwd.c auth-rhosts.c auth-rsa.c auth.c auth.h auth1.c]
448     [auth2-chall.c auth2-pubkey.c authfile.c buffer.c canohost.c]
449     [channels.c clientloop.c dh.c dns.c dns.h hostfile.c kex.c kexdhc.c]
450     [kexgexc.c kexgexs.c key.c key.h log.c misc.c misc.h moduli.c]
451     [monitor_wrap.c packet.c progressmeter.c readconf.c readpass.c scp.c]
452     [servconf.c session.c sftp-client.c sftp-common.c sftp-server.c sftp.c]
453     [ssh-add.c ssh-agent.c ssh-keygen.c ssh-keyscan.c ssh.c sshconnect.c]
454     [sshconnect1.c sshconnect2.c sshd.c sshlogin.c sshtty.c uuencode.c]
455     [uuencode.h xmalloc.c]
456     move #include <stdio.h> out of includes.h
457   - stevesk@cvs.openbsd.org 2006/08/01 23:36:12
458     [authfile.c channels.c progressmeter.c scard.c servconf.c ssh.c]
459     clean extra spaces
460   - deraadt@cvs.openbsd.org 2006/08/03 03:34:42
461     [OVERVIEW atomicio.c atomicio.h auth-bsdauth.c auth-chall.c auth-krb5.c]
462     [auth-options.c auth-options.h auth-passwd.c auth-rh-rsa.c auth-rhosts.c]
463     [auth-rsa.c auth-skey.c auth.c auth.h auth1.c auth2-chall.c auth2-gss.c]
464     [auth2-hostbased.c auth2-kbdint.c auth2-none.c auth2-passwd.c ]
465     [auth2-pubkey.c auth2.c authfd.c authfd.h authfile.c bufaux.c bufbn.c]
466     [buffer.c buffer.h canohost.c channels.c channels.h cipher-3des1.c]
467     [cipher-bf1.c cipher-ctr.c cipher.c cleanup.c clientloop.c compat.c]
468     [compress.c deattack.c dh.c dispatch.c dns.c dns.h fatal.c groupaccess.c]
469     [groupaccess.h gss-genr.c gss-serv-krb5.c gss-serv.c hostfile.c kex.c]
470     [kex.h kexdh.c kexdhc.c kexdhs.c kexgex.c kexgexc.c kexgexs.c key.c]
471     [key.h log.c log.h mac.c match.c md-sha256.c misc.c misc.h moduli.c]
472     [monitor.c monitor_fdpass.c monitor_mm.c monitor_mm.h monitor_wrap.c]
473     [monitor_wrap.h msg.c nchan.c packet.c progressmeter.c readconf.c]
474     [readconf.h readpass.c rsa.c scard.c scard.h scp.c servconf.c servconf.h]
475     [serverloop.c session.c session.h sftp-client.c sftp-common.c]
476     [sftp-common.h sftp-glob.c sftp-server.c sftp.c ssh-add.c ssh-agent.c]
477     [ssh-dss.c ssh-gss.h ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh-rsa.c]
478     [ssh.c ssh.h sshconnect.c sshconnect.h sshconnect1.c sshconnect2.c]
479     [sshd.c sshlogin.c sshlogin.h sshpty.c sshpty.h sshtty.c ttymodes.c]
480     [uidswap.c uidswap.h uuencode.c uuencode.h xmalloc.c xmalloc.h]
481     [loginrec.c loginrec.h openbsd-compat/port-aix.c openbsd-compat/port-tun.h]
482     almost entirely get rid of the culture of ".h files that include .h files"
483     ok djm, sort of ok stevesk
484     makes the pain stop in one easy step
485     NB. portable commit contains everything *except* removing includes.h, as
486     that will take a fair bit more work as we move headers that are required
487     for portability workarounds to defines.h. (also, this step wasn't "easy")
488   - stevesk@cvs.openbsd.org 2006/08/04 20:46:05
489     [monitor.c session.c ssh-agent.c]
490     spaces
491 - (djm) [auth-pam.c defines.h] Move PAM related bits to auth-pam.c
492 - (djm) [auth-pam.c auth.c bufaux.h entropy.c openbsd-compat/port-tun.c]
493   remove last traces of bufaux.h - it was merged into buffer.h in the big
494   includes.h commit
495 - (djm) [auth.c loginrec.c] Missing netinet/in.h for loginrec
496 - (djm) [openbsd-compat/regress/snprintftest.c]
497   [openbsd-compat/regress/strduptest.c] Add missing includes so they pass
498   compilation with "-Wall -Werror"
499 - (djm) [auth-pam.c auth-shadow.c auth2-none.c cleanup.c sshd.c]
500   [openbsd-compat/port-tun.c openbsd-compat/port-tun.h] Sprinkle more
501   includes for Linux in
502 - (dtucker) [cleanup.c] Need defines.h for __dead.
503 - (dtucker) [auth2-gss.c] We still need the #ifdef GSSAPI in -portable.
504 - (dtucker) [openbsd-compat/{bsd-arc4random.c,port-tun.c,xmmap.c}] Lots of
505   #include stdarg.h, needed for log.h.
506 - (dtucker) [entropy.c] Needs unistd.h too.
507 - (dtucker) [ssh-rand-helper.c] Needs stdarg.h for log.h.
508 - (dtucker) [openbsd-compat/getrrsetbyname.c] Nees stdlib.h for malloc.
509 - (dtucker) [openbsd-compat/strtonum.c] Include stdlib.h for strtoll,
510   otherwise it is implicitly declared as returning an int.
511 - (dtucker) OpenBSD CVS Sync
512   - dtucker@cvs.openbsd.org 2006/08/05 07:52:52
513     [auth2-none.c sshd.c monitor_wrap.c]
514     Add headers required to build with KERBEROS5=no.  ok djm@
515   - dtucker@cvs.openbsd.org 2006/08/05 08:00:33
516     [auth-skey.c]
517     Add headers required to build with -DSKEY.  ok djm@
518   - dtucker@cvs.openbsd.org 2006/08/05 08:28:24
519     [monitor_wrap.c auth-skey.c auth2-chall.c]
520     Zap unused variables in -DSKEY code.  ok djm@
521   - dtucker@cvs.openbsd.org 2006/08/05 08:34:04
522     [packet.c]
523     Typo in comment
524 - (dtucker) [openbsd-compat/bsd-cygwin_util.c] Add headers required to compile
525   on Cygwin.
526 - (dtucker) [openbsd-compat/fake-rfc2553.c] Add headers needed for inet_ntoa.
527 - (dtucker) [auth-skey.c] monitor_wrap.h needs ssh-gss.h.
528 - (dtucker) [audit.c audit.h] Repair headers.
529 - (dtucker) [audit-bsm.c] Add additional headers now required.
530
53120060804
532 - (dtucker) [configure.ac] The "crippled AES" test does not work on recent
533   versions of Solaris, so use AC_LINK_IFELSE to actually link the test program
534   rather than just compiling it.  Spotted by dlg@.
535
53620060802
537 - (dtucker) [openbsd-compat/daemon.c] Add unistd.h for fork() prototype.
538
53920060725
540 - (dtucker) [openbsd-compat/xmmap.c] Need fcntl.h for O_RDRW.
541
54220060724
543 - (djm) OpenBSD CVS Sync
544   - jmc@cvs.openbsd.org 2006/07/12 13:39:55
545     [sshd_config.5]
546      - new sentence, new line
547      - s/The the/The/
548      - kill a bad comma
549   - stevesk@cvs.openbsd.org 2006/07/12 22:28:52
550     [auth-options.c canohost.c channels.c includes.h readconf.c]
551     [servconf.c ssh-keyscan.c ssh.c sshconnect.c sshd.c]
552     move #include <netdb.h> out of includes.h; ok djm@
553   - stevesk@cvs.openbsd.org 2006/07/12 22:42:32
554     [includes.h ssh.c ssh-rand-helper.c]
555     move #include <stddef.h> out of includes.h
556   - stevesk@cvs.openbsd.org 2006/07/14 01:15:28
557     [monitor_wrap.h]
558     don't need incompletely-typed 'struct passwd' now with
559     #include <pwd.h>; ok markus@
560   - stevesk@cvs.openbsd.org 2006/07/17 01:31:10
561     [authfd.c authfile.c channels.c cleanup.c clientloop.c groupaccess.c]
562     [includes.h log.c misc.c msg.c packet.c progressmeter.c readconf.c]
563     [readpass.c scp.c servconf.c sftp-client.c sftp-server.c sftp.c]
564     [ssh-add.c ssh-agent.c ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh.c]
565     [sshconnect.c sshlogin.c sshpty.c uidswap.c]
566     move #include <unistd.h> out of includes.h
567   - dtucker@cvs.openbsd.org 2006/07/17 12:02:24
568     [auth-options.c]
569     Use '\0' rather than 0 to terminates strings; ok djm@
570   - dtucker@cvs.openbsd.org 2006/07/17 12:06:00
571     [channels.c channels.h servconf.c sshd_config.5]
572     Add PermitOpen directive to sshd_config which is equivalent to the
573     "permitopen" key option.  Allows server admin to allow TCP port
574     forwarding only two specific host/port pairs.  Useful when combined
575     with Match.
576     If permitopen is used in both sshd_config and a key option, both
577     must allow a given connection before it will be permitted.
578     Note that users can still use external forwarders such as netcat,
579     so to be those must be controlled too for the limits to be effective.
580     Feedback & ok djm@, man page corrections & ok jmc@.
581   - jmc@cvs.openbsd.org 2006/07/18 07:50:40
582     [sshd_config.5]
583     tweak; ok dtucker
584   - jmc@cvs.openbsd.org 2006/07/18 07:56:28
585     [scp.1]
586     replace DIAGNOSTICS with .Ex;
587   - jmc@cvs.openbsd.org 2006/07/18 08:03:09
588     [ssh-agent.1 sshd_config.5]
589     mark up angle brackets;
590   - dtucker@cvs.openbsd.org 2006/07/18 08:22:23
591     [sshd_config.5]
592     Clarify description of Match, with minor correction from jmc@
593   - stevesk@cvs.openbsd.org 2006/07/18 22:27:55
594     [dh.c]
595     remove unneeded includes; ok djm@
596   - dtucker@cvs.openbsd.org 2006/07/19 08:56:41
597     [servconf.c sshd_config.5]
598     Add support for X11Forwaring, X11DisplayOffset and X11UseLocalhost to
599     Match.  ok djm@
600   - dtucker@cvs.openbsd.org 2006/07/19 13:07:10
601     [servconf.c servconf.h session.c sshd.8 sshd_config sshd_config.5]
602     Add ForceCommand keyword to sshd_config, equivalent to the "command="
603     key option, man page entry and example in sshd_config.
604     Feedback & ok djm@, man page corrections & ok jmc@
605   - stevesk@cvs.openbsd.org 2006/07/20 15:26:15
606     [auth1.c serverloop.c session.c sshconnect2.c]
607     missed some needed #include <unistd.h> when KERBEROS5=no; issue from
608     massimo@cedoc.mo.it
609   - dtucker@cvs.openbsd.org 2006/07/21 12:43:36
610     [channels.c channels.h servconf.c servconf.h sshd_config.5]
611     Make PermitOpen take a list of permitted ports and act more like most
612     other keywords (ie the first match is the effective setting). This
613     also makes it easier to override a previously set PermitOpen. ok djm@
614   - stevesk@cvs.openbsd.org 2006/07/21 21:13:30
615     [channels.c]
616     more ARGSUSED (lint) for dispatch table-driven functions; ok djm@
617   - stevesk@cvs.openbsd.org 2006/07/21 21:26:55
618     [progressmeter.c]
619     ARGSUSED for signal handler
620   - stevesk@cvs.openbsd.org 2006/07/22 19:08:54
621     [includes.h moduli.c progressmeter.c scp.c sftp-common.c]
622     [sftp-server.c ssh-agent.c sshlogin.c]
623     move #include <time.h> out of includes.h
624   - stevesk@cvs.openbsd.org 2006/07/22 20:48:23
625     [atomicio.c auth-options.c auth-passwd.c auth-rhosts.c auth-rsa.c]
626     [auth.c auth1.c auth2-chall.c auth2-hostbased.c auth2-passwd.c auth2.c]
627     [authfd.c authfile.c bufaux.c bufbn.c buffer.c canohost.c channels.c]
628     [cipher-3des1.c cipher-bf1.c cipher-ctr.c cipher.c clientloop.c]
629     [compat.c deattack.c dh.c dns.c gss-genr.c gss-serv.c hostfile.c]
630     [includes.h kex.c kexdhc.c kexdhs.c kexgexc.c kexgexs.c key.c log.c]
631     [mac.c match.c md-sha256.c misc.c moduli.c monitor.c monitor_fdpass.c]
632     [monitor_mm.c monitor_wrap.c msg.c nchan.c packet.c rsa.c]
633     [progressmeter.c readconf.c readpass.c scp.c servconf.c serverloop.c]
634     [session.c sftp-client.c sftp-common.c sftp-glob.c sftp-server.c sftp.c]
635     [ssh-add.c ssh-agent.c ssh-dss.c ssh-keygen.c ssh-keyscan.c]
636     [ssh-keysign.c ssh-rsa.c ssh.c sshconnect.c sshconnect1.c sshconnect2.c]
637     [sshd.c sshlogin.c sshpty.c ttymodes.c uidswap.c xmalloc.c]
638     move #include <string.h> out of includes.h
639   - stevesk@cvs.openbsd.org 2006/07/23 01:11:05
640     [auth.h dispatch.c kex.h sftp-client.c]
641     #include <signal.h> for sig_atomic_t; need this prior to <sys/param.h>
642     move
643 - (djm) [acss.c auth-krb5.c auth-options.c auth-pam.c auth-shadow.c]
644   [canohost.c channels.c cipher-acss.c defines.h dns.c gss-genr.c]
645   [gss-serv-krb5.c gss-serv.c log.h loginrec.c logintest.c readconf.c]
646   [servconf.c ssh-keygen.c ssh-keyscan.c ssh-keysign.c ssh-rand-helper.c]
647   [ssh.c sshconnect.c sshd.c openbsd-compat/bindresvport.c]
648   [openbsd-compat/bsd-arc4random.c openbsd-compat/bsd-misc.c]
649   [openbsd-compat/getrrsetbyname.c openbsd-compat/glob.c]
650   [openbsd-compat/mktemp.c openbsd-compat/port-linux.c]
651   [openbsd-compat/port-tun.c openbsd-compat/readpassphrase.c]
652   [openbsd-compat/setproctitle.c openbsd-compat/xmmap.c]
653   make the portable tree compile again - sprinkle unistd.h and string.h
654   back in. Don't redefine __unused, as it turned out to be used in
655   headers on Linux, and replace its use in auth-pam.c with ARGSUSED
656 - (djm) [openbsd-compat/glob.c]
657   Move get_arg_max() into the ifdef HAVE_GLOB block so that it compiles
658   on OpenBSD (or other platforms with a decent glob implementation) with
659   -Werror
660 - (djm) [uuencode.c]
661   Add resolv.h, is it contains the prototypes for __b64_ntop/__b64_pton on
662   some platforms
663 - (djm) [session.c]
664   fix compile error with -Werror -Wall: 'path' is only used in
665   do_setup_env() if HAVE_LOGIN_CAP is not defined
666 - (djm) [openbsd-compat/basename.c openbsd-compat/bsd-closefrom.c]
667   [openbsd-compat/bsd-cray.c openbsd-compat/bsd-openpty.c]
668   [openbsd-compat/bsd-snprintf.c openbsd-compat/fake-rfc2553.c]
669   [openbsd-compat/port-aix.c openbsd-compat/port-irix.c]
670   [openbsd-compat/rresvport.c]
671   These look to need string.h and/or unistd.h (based on a grep for function
672   names)
673 - (djm) [Makefile.in]
674   Remove generated openbsd-compat/regress/Makefile in distclean target
675 - (djm) [regress/Makefile regress/agent-getpeereid.sh regress/cfgmatch.sh]
676   [regress/cipher-speed.sh regress/forcecommand.sh regress/forwarding.sh]
677   Sync regress tests to -current; include dtucker@'s new cfgmatch and
678   forcecommand tests. Add cipher-speed.sh test (not linked in yet)
679 - (dtucker) [cleanup.c] Since config.h defines _LARGE_FILES on AIX, including
680   system headers before defines.h will cause conflicting definitions.
681 - (dtucker) [regress/forcecommand.sh] Portablize.
682
68320060713
684 - (dtucker) [auth-krb5.c auth-pam.c] Still more errno.h
685
68620060712
687 - (dtucker) [configure.ac defines.h] Only define SHUT_RD (and friends) and
688   O_NONBLOCK if they're really needed.  Fixes build errors on HP-UX, old
689   Linuxes and probably more.
690 - (dtucker) [configure.ac] OpenBSD needs <sys/types.h> before <sys/socket.h>
691   for SHUT_RD.
692 - (dtucker) [openbsd-compat/port-tun.c] OpenBSD needs <netinet/in.h> before
693   <netinet/ip.h>.
694 - (dtucker) OpenBSD CVS Sync
695   - stevesk@cvs.openbsd.org 2006/07/10 16:01:57
696     [sftp-glob.c sftp-common.h sftp.c]
697     buffer.h only needed in sftp-common.h and remove some unneeded
698     user includes; ok djm@
699   - jmc@cvs.openbsd.org 2006/07/10 16:04:21
700     [sshd.8]
701     s/and and/and/
702   - stevesk@cvs.openbsd.org 2006/07/10 16:37:36
703     [readpass.c log.h scp.c fatal.c xmalloc.c includes.h ssh-keyscan.c misc.c
704     auth.c packet.c log.c]
705     move #include <stdarg.h> out of includes.h; ok markus@
706   - dtucker@cvs.openbsd.org 2006/07/11 10:12:07
707     [ssh.c]
708     Only copy the part of environment variable that we actually use.  Prevents
709     ssh bailing when SendEnv is used and an environment variable with a really
710     long value exists.  ok djm@
711   - markus@cvs.openbsd.org 2006/07/11 18:50:48
712     [clientloop.c ssh.1 ssh.c channels.c ssh_config.5 readconf.h session.c
713     channels.h readconf.c]
714     add ExitOnForwardFailure: terminate the connection if ssh(1)
715     cannot set up all requested dynamic, local, and remote port
716     forwardings. ok djm, dtucker, stevesk, jmc
717   - stevesk@cvs.openbsd.org 2006/07/11 20:07:25
718     [scp.c auth.c monitor.c serverloop.c sftp-server.c sshpty.c readpass.c
719     sshd.c monitor_wrap.c monitor_fdpass.c ssh-agent.c ttymodes.c atomicio.c
720     includes.h session.c sshlogin.c monitor_mm.c packet.c sshconnect2.c
721     sftp-client.c nchan.c clientloop.c sftp.c misc.c canohost.c channels.c
722     ssh-keygen.c progressmeter.c uidswap.c msg.c readconf.c sshconnect.c]
723     move #include <errno.h> out of includes.h; ok markus@
724   - stevesk@cvs.openbsd.org 2006/07/11 20:16:43
725     [ssh.c]
726     cast asterisk field precision argument to int to remove warning;
727     ok markus@
728   - stevesk@cvs.openbsd.org 2006/07/11 20:27:56
729     [authfile.c ssh.c]
730     need <errno.h> here also (it's also included in <openssl/err.h>)
731   - dtucker@cvs.openbsd.org 2006/07/12 11:34:58
732     [sshd.c servconf.h servconf.c sshd_config.5 auth.c]
733     Add support for conditional directives to sshd_config via a "Match"
734     keyword, which works similarly to the "Host" directive in ssh_config.
735     Lines after a Match line override the default set in the main section
736     if the condition on the Match line is true, eg
737     AllowTcpForwarding yes
738     Match User anoncvs
739             AllowTcpForwarding no
740     will allow port forwarding by all users except "anoncvs".
741     Currently only a very small subset of directives are supported.
742     ok djm@
743 - (dtucker) [loginrec.c openbsd-compat/xmmap.c openbsd-compat/bindresvport.c
744   openbsd-compat/glob.c openbsd-compat/mktemp.c openbsd-compat/port-tun.c
745   openbsd-compat/readpassphrase.c openbsd-compat/strtonum.c] Include <errno.h>.
746 - (dtucker) [openbsd-compat/setproctitle.c] Include stdarg.h.
747 - (dtucker) [ssh-keyscan.c ssh-rand-helper.c] More errno.h here too.
748 - (dtucker) [openbsd-compat/openbsd-compat.h] v*printf needs stdarg.h.
749 - (dtucker) [openbsd-compat/bsd-asprintf.c openbsd-compat/port-aix.c
750   openbsd-compat/rresvport.c] More errno.h.
751
75220060711
753 - (dtucker) [configure.ac ssh-keygen.c openbsd-compat/bsd-openpty.c
754   openbsd-compat/daemon.c] Add includes needed by open(2).  Conditionally
755   include paths.h.  Fixes build error on Solaris.
756 - (dtucker) [entropy.c] More fcntl.h, this time on AIX (and probably
757   others).
758
75920060710
760 - (dtucker) [INSTALL] New autoconf version: 2.60.
761 - OpenBSD CVS Sync
762   - djm@cvs.openbsd.org 2006/06/14 10:50:42
763     [sshconnect.c]
764     limit the number of pre-banner characters we will accept; ok markus@
765   - djm@cvs.openbsd.org 2006/06/26 10:36:15
766     [clientloop.c]
767     mention optional bind_address in runtime port forwarding setup
768     command-line help. patch from santhi.amirta AT gmail.com
769   - stevesk@cvs.openbsd.org 2006/07/02 17:12:58
770     [ssh.1 ssh.c ssh_config.5 sshd_config.5]
771     more details and clarity for tun(4) device forwarding; ok and help
772     jmc@
773   - stevesk@cvs.openbsd.org 2006/07/02 18:36:47
774     [gss-serv-krb5.c gss-serv.c]
775     no "servconf.h" needed here
776     (gss-serv-krb5.c change not applied, portable needs the server options)
777   - stevesk@cvs.openbsd.org 2006/07/02 22:45:59
778     [groupaccess.c groupaccess.h includes.h session.c sftp-common.c sshpty.c]
779     move #include <grp.h> out of includes.h
780     (portable needed uidswap.c too)
781   - stevesk@cvs.openbsd.org 2006/07/02 23:01:55
782     [clientloop.c ssh.1]
783     use -KR[bind_address:]port here; ok djm@
784   - stevesk@cvs.openbsd.org 2006/07/03 08:54:20
785     [includes.h ssh.c sshconnect.c sshd.c]
786     move #include "version.h" out of includes.h; ok markus@
787   - stevesk@cvs.openbsd.org 2006/07/03 17:59:32
788     [channels.c includes.h]
789     move #include <arpa/inet.h> out of includes.h; old ok djm@
790     (portable needed session.c too)
791   - stevesk@cvs.openbsd.org 2006/07/05 02:42:09
792     [canohost.c hostfile.c includes.h misc.c packet.c readconf.c]
793     [serverloop.c sshconnect.c uuencode.c]
794     move #include <netinet/in.h> out of includes.h; ok deraadt@
795     (also ssh-rand-helper.c logintest.c loginrec.c)
796   - djm@cvs.openbsd.org 2006/07/06 10:47:05
797     [servconf.c servconf.h session.c sshd_config.5]
798     support arguments to Subsystem commands; ok markus@
799   - djm@cvs.openbsd.org 2006/07/06 10:47:57
800     [sftp-server.8 sftp-server.c]
801     add commandline options to enable logging of transactions; ok markus@
802   - stevesk@cvs.openbsd.org 2006/07/06 16:03:53
803     [auth-options.c auth-options.h auth-passwd.c auth-rh-rsa.c]
804     [auth-rhosts.c auth-rsa.c auth.c auth.h auth2-hostbased.c]
805     [auth2-pubkey.c auth2.c includes.h misc.c misc.h monitor.c]
806     [monitor_wrap.c monitor_wrap.h scp.c serverloop.c session.c]
807     [session.h sftp-common.c ssh-add.c ssh-keygen.c ssh-keysign.c]
808     [ssh.c sshconnect.c sshconnect.h sshd.c sshpty.c sshpty.h uidswap.c]
809     [uidswap.h]
810     move #include <pwd.h> out of includes.h; ok markus@
811   - stevesk@cvs.openbsd.org 2006/07/06 16:22:39
812     [ssh-keygen.c]
813     move #include "dns.h" up
814   - stevesk@cvs.openbsd.org 2006/07/06 17:36:37
815     [monitor_wrap.h]
816     typo in comment
817   - stevesk@cvs.openbsd.org 2006/07/08 21:47:12
818     [authfd.c canohost.c clientloop.c dns.c dns.h includes.h]
819     [monitor_fdpass.c nchan.c packet.c servconf.c sftp.c ssh-agent.c]
820     [ssh-keyscan.c ssh.c sshconnect.h sshd.c sshlogin.h]
821     move #include <sys/socket.h> out of includes.h
822   - stevesk@cvs.openbsd.org 2006/07/08 21:48:53
823     [monitor.c session.c]
824     missed these from last commit:
825     move #include <sys/socket.h> out of includes.h
826   - stevesk@cvs.openbsd.org 2006/07/08 23:30:06
827     [log.c]
828     move user includes after /usr/include files
829   - stevesk@cvs.openbsd.org 2006/07/09 15:15:11
830     [auth2-none.c authfd.c authfile.c includes.h misc.c monitor.c]
831     [readpass.c scp.c serverloop.c sftp-client.c sftp-server.c]
832     [ssh-add.c ssh-agent.c ssh-keygen.c ssh-keysign.c ssh.c sshd.c]
833     [sshlogin.c sshpty.c]
834     move #include <fcntl.h> out of includes.h
835   - stevesk@cvs.openbsd.org 2006/07/09 15:27:59
836     [ssh-add.c]
837     use O_RDONLY vs. 0 in open(); no binary change
838   - djm@cvs.openbsd.org 2006/07/10 11:24:54
839     [sftp-server.c]
840     remove optind - it isn't used here
841   - djm@cvs.openbsd.org 2006/07/10 11:25:53
842     [sftp-server.c]
843     don't log variables that aren't yet set
844 - (djm) [loginrec.c ssh-rand-helper.c sshd.c openbsd-compat/glob.c]
845   [openbsd-compat/mktemp.c openbsd-compat/openbsd-compat.h]
846   [openbsd-compat/port-tun.c openbsd-compat/readpassphrase.c]
847   [openbsd-compat/xcrypt.c] Fix includes.h fallout, mainly fcntl.h
848 - OpenBSD CVS Sync
849   - djm@cvs.openbsd.org 2006/07/10 12:03:20
850     [scp.c]
851     duplicate argv at the start of main() because it gets modified later;
852     pointed out by deraadt@ ok markus@
853   - djm@cvs.openbsd.org 2006/07/10 12:08:08
854     [channels.c]
855     fix misparsing of SOCKS 5 packets that could result in a crash;
856     reported by mk@ ok markus@
857   - dtucker@cvs.openbsd.org 2006/07/10 12:46:51
858     [misc.c misc.h sshd.8 sshconnect.c]
859     Add port identifier to known_hosts for non-default ports, based originally
860     on a patch from Devin Nate in bz#910.
861     For any connection using the default port or using a HostKeyAlias the
862     format is unchanged, otherwise the host name or address is enclosed
863     within square brackets in the same format as sshd's ListenAddress.
864     Tested by many, ok markus@.
865 - (dtucker) [openbsd-compat/openbsd-compat.h] Need to include <sys/socket.h>
866   for struct sockaddr on platforms that use the fake-rfc stuff.
867
86820060706
869 - (dtucker) [configure.ac] Try AIX blibpath test in different order when
870   compiling with gcc.  gcc 4.1.x will accept (but ignore) -b flags so
871   configure would not select the correct libpath linker flags.
872 - (dtucker) [INSTALL] A bit more info on autoconf.
873
87420060705
875 - (dtucker) [ssh-rand-helper.c] Don't exit if mkdir fails because the
876   target already exists.
877
87820060630
879 - (dtucker) [openbsd-compat/openbsd-compat.h] SNPRINTF_CONST for snprintf
880   declaration too.  Patch from russ at sludge.net.
881 - (dtucker) [openbsd-compat/getrrsetbyname.c] Undef _res before defining it,
882   prevents warnings on platforms where _res is in the system headers.
883 - (dtucker) [INSTALL] Bug #1202: Note when autoconf is required and which
884   version.
885
88620060627
887 - (dtucker) [configure.ac] Bug #1203: Add missing '[', which causes problems
888   with autoconf 2.60.  Patch from vapier at gentoo.org.
889
89020060625
891 - (dtucker) [channels.c serverloop.c] Apply the bug #1102 workaround to ptys
892   only, otherwise sshd can hang exiting non-interactive sessions.
893
89420060624
895 - (dtucker) [configure.ac] Bug #1193: Define PASSWD_NEEDS_USERNAME on Solaris.
896   Works around limitation in Solaris' passwd program for changing passwords
897   where the username is longer than 8 characters.  ok djm@
898 - (dtucker) [serverloop.c] Get ifdef/ifndef the right way around for the bug
899   #1102 workaround.
900
90120060623
902 - (dtucker) [README.platform configure.ac openbsd-compat/port-tun.c] Add
903   tunnel support for Mac OS X/Darwin via a third-party tun driver.  Patch
904   from reyk@, tested by anil@
905 - (dtucker) [channels.c configure.ac serverloop.c] Bug #1102: Around AIX
906   4.3.3 ML3 or so, the AIX pty layer starting passing zero-length writes
907   on the pty slave as zero-length reads on the pty master, which sshd
908   interprets as the descriptor closing.  Since most things don't do zero
909   length writes this rarely matters, but occasionally it happens, and when
910   it does the SSH pty session appears to hang, so we add a special case for
911   this condition.  ok djm@
912
91320060613
914 - (djm) [getput.h] This file has been replaced by functions in misc.c
915 - OpenBSD CVS Sync
916   - djm@cvs.openbsd.org 2006/05/08 10:49:48
917     [sshconnect2.c]
918     uint32_t -> u_int32_t (which we use everywhere else)
919     (Id sync only - portable already had this)
920   - markus@cvs.openbsd.org 2006/05/16 09:00:00
921     [clientloop.c]
922     missing free; from Kylene Hall
923   - markus@cvs.openbsd.org 2006/05/17 12:43:34
924     [scp.c sftp.c ssh-agent.c ssh-keygen.c sshconnect.c]
925     fix leak; coverity via Kylene Jo Hall
926   - miod@cvs.openbsd.org 2006/05/18 21:27:25
927     [kexdhc.c kexgexc.c]
928     paramter -> parameter
929   - dtucker@cvs.openbsd.org 2006/05/29 12:54:08
930     [ssh_config.5]
931     Add gssapi-with-mic to PreferredAuthentications default list; ok jmc
932   - dtucker@cvs.openbsd.org 2006/05/29 12:56:33
933     [ssh_config]
934     Add GSSAPIAuthentication and GSSAPIDelegateCredentials to examples in
935     sample ssh_config.  ok markus@
936   - jmc@cvs.openbsd.org 2006/05/29 16:10:03
937     [ssh_config.5]
938     oops - previous was too long; split the list of auths up
939   - mk@cvs.openbsd.org 2006/05/30 11:46:38
940     [ssh-add.c]
941     Sync usage() with man page and reality.
942     ok deraadt dtucker
943   - jmc@cvs.openbsd.org 2006/05/29 16:13:23
944     [ssh.1]
945     add GSSAPI to the list of authentication methods supported;
946   - mk@cvs.openbsd.org 2006/05/30 11:46:38
947     [ssh-add.c]
948     Sync usage() with man page and reality.
949     ok deraadt dtucker
950   - markus@cvs.openbsd.org 2006/06/01 09:21:48
951     [sshd.c]
952     call get_remote_ipaddr() early; fixes logging after client disconnects;
953     report mpf@; ok dtucker@
954   - markus@cvs.openbsd.org 2006/06/06 10:20:20
955     [readpass.c sshconnect.c sshconnect.h sshconnect2.c uidswap.c]
956     replace remaining setuid() calls with permanently_set_uid() and
957     check seteuid() return values; report Marcus Meissner; ok dtucker djm
958   - markus@cvs.openbsd.org 2006/06/08 14:45:49
959     [readpass.c sshconnect.c sshconnect2.c uidswap.c uidswap.h]
960     do not set the gid, noted by solar; ok djm
961   - djm@cvs.openbsd.org 2006/06/13 01:18:36
962     [ssh-agent.c]
963     always use a format string, even when printing a constant
964   - djm@cvs.openbsd.org 2006/06/13 02:17:07
965     [ssh-agent.c]
966     revert; i am on drugs. spotted by alexander AT beard.se
967
96820060521
969 - (dtucker) [auth.c monitor.c] Now that we don't log from both the monitor
970   and slave, we can remove the special-case handling in the audit hook in
971   auth_log.
972
97320060517
974 - (dtucker) [ssh-rand-helper.c] Check return code of mkdir and fix file
975   pointer leak.  From kjhall at us.ibm.com, found by coverity.
976
97720060515
978 - (dtucker) [openbsd-compat/getrrsetbyname.c] Use _compat_res instead of
979   _res, prevents problems on some platforms that have _res as a global but
980   don't have getrrsetbyname(), eg IRIX 5.3.  Found and tested by
981   georg.schwarz at freenet.de, ok djm@.
982 - (dtucker) [defines.h] Find a value for IOV_MAX or use a conservative
983   default.  Patch originally from tim@, ok djm
984 - (dtucker) [auth-pam.c] Bug #1188: pass result of do_pam_account back and
985   do not allow kbdint again after the PAM account check fails.  ok djm@
986
98720060506
988 - (dtucker) OpenBSD CVS Sync
989   - dtucker@cvs.openbsd.org 2006/04/25 08:02:27
990     [authfile.c authfile.h sshconnect2.c ssh.c sshconnect1.c]
991     Prevent ssh from trying to open private keys with bad permissions more than
992     once or prompting for their passphrases (which it subsequently ignores
993     anyway), similar to a previous change in ssh-add.  bz #1186, ok djm@
994   - djm@cvs.openbsd.org 2006/05/04 14:55:23
995     [dh.c]
996     tighter DH exponent checks here too; feedback and ok markus@
997   - djm@cvs.openbsd.org 2006/04/01 05:37:46
998     [OVERVIEW]
999     $OpenBSD$ in here too
1000   - dtucker@cvs.openbsd.org 2006/05/06 08:35:40
1001     [auth-krb5.c]
1002     Add $OpenBSD$ in comment here too
1003
100420060504
1005 - (dtucker) [auth-pam.c groupaccess.c monitor.c monitor_wrap.c scard-opensc.c
1006   session.c ssh-rand-helper.c sshd.c openbsd-compat/bsd-cygwin_util.c
1007   openbsd-compat/setproctitle.c] Convert malloc(foo*bar) -> calloc(foo,bar)
1008   in Portable-only code; since calloc zeros, remove now-redundant memsets.
1009   Also add a couple of sanity checks.  With & ok djm@
1010
101120060503
1012 - (dtucker) [packet.c] Remove in_systm.h since it's also in includes.h
1013   and double including it on IRIX 5.3 causes problems.  From Georg Schwarz,
1014   "no objections" tim@
1015
101620060423
1017 - (djm) OpenBSD CVS Sync
1018   - deraadt@cvs.openbsd.org 2006/04/01 05:42:20
1019     [scp.c]
1020     minimal lint cleanup (unused crud, and some size_t); ok djm
1021   - djm@cvs.openbsd.org 2006/04/01 05:50:29
1022     [scp.c]
1023     xasprintification; ok deraadt@
1024   - djm@cvs.openbsd.org 2006/04/01 05:51:34
1025     [atomicio.c]
1026     ANSIfy; requested deraadt@
1027   - dtucker@cvs.openbsd.org 2006/04/02 08:34:52
1028     [ssh-keysign.c]
1029     sessionid can be 32 bytes now too when sha256 kex is used; ok djm@
1030   - djm@cvs.openbsd.org 2006/04/03 07:10:38
1031     [gss-genr.c]
1032     GSSAPI buffers shouldn't be nul-terminated, spotted in bugzilla #1066
1033     by dleonard AT vintela.com. use xasprintf() to simplify code while in
1034     there; "looks right" deraadt@
1035   - djm@cvs.openbsd.org 2006/04/16 00:48:52
1036     [buffer.c buffer.h channels.c]
1037     Fix condition where we could exit with a fatal error when an input
1038     buffer became too large and the remote end had advertised a big window.
1039     The problem was a mismatch in the backoff math between the channels code
1040     and the buffer code, so make a buffer_check_alloc() function that the
1041     channels code can use to propsectivly check whether an incremental
1042     allocation will succeed.  bz #1131, debugged with the assistance of
1043     cove AT wildpackets.com; ok dtucker@ deraadt@
1044   - djm@cvs.openbsd.org 2006/04/16 00:52:55
1045     [atomicio.c atomicio.h]
1046     introduce atomiciov() function that wraps readv/writev to retry
1047     interrupted transfers like atomicio() does for read/write;
1048     feedback deraadt@ dtucker@ stevesk@ ok deraadt@
1049   - djm@cvs.openbsd.org 2006/04/16 00:54:10
1050     [sftp-client.c]
1051     avoid making a tiny 4-byte write to send the packet length of sftp
1052     commands, which would result in a separate tiny packet on the wire by
1053     using atomiciov(writev, ...) to write the length and the command in one
1054     pass; ok deraadt@
1055   - djm@cvs.openbsd.org 2006/04/16 07:59:00
1056     [atomicio.c]
1057     reorder sanity test so that it cannot dereference past the end of the
1058     iov array; well spotted canacar@!
1059   - dtucker@cvs.openbsd.org 2006/04/18 10:44:28
1060     [bufaux.c bufbn.c Makefile.in]
1061     Move Buffer bignum functions into their own file, bufbn.c. This means
1062     that sftp and sftp-server (which use the Buffer functions in bufaux.c
1063     but not the bignum ones) no longer need to be linked with libcrypto.
1064     ok markus@
1065   - djm@cvs.openbsd.org 2006/04/20 09:27:09
1066     [auth.h clientloop.c dispatch.c dispatch.h kex.h]
1067     replace the last non-sig_atomic_t flag used in a signal handler with a
1068     sig_atomic_t, unfortunately with some knock-on effects in other (non-
1069     signal) contexts in which it is used; ok markus@
1070   - markus@cvs.openbsd.org 2006/04/20 09:47:59
1071     [sshconnect.c]
1072     simplify; ok djm@
1073   - djm@cvs.openbsd.org 2006/04/20 21:53:44
1074     [includes.h session.c sftp.c]
1075     Switch from using pipes to socketpairs for communication between
1076     sftp/scp and ssh, and between sshd and its subprocesses. This saves
1077     a file descriptor per session and apparently makes userland ppp over
1078     ssh work; ok markus@ deraadt@ (ID Sync only - portable makes this
1079     decision on a per-platform basis)
1080   - djm@cvs.openbsd.org 2006/04/22 04:06:51
1081     [uidswap.c]
1082     use setres[ug]id() to permanently revoke privileges; ok deraadt@
1083     (ID Sync only - portable already uses setres[ug]id() whenever possible)
1084   - stevesk@cvs.openbsd.org 2006/04/22 18:29:33
1085     [crc32.c]
1086     remove extra spaces
1087 - (djm) [auth.h dispatch.h kex.h] sprinkle in signal.h to get
1088   sig_atomic_t
1089
109020060421
1091 - (djm) [Makefile.in configure.ac session.c sshpty.c]
1092   [contrib/redhat/sshd.init openbsd-compat/Makefile.in]
1093   [openbsd-compat/openbsd-compat.h openbsd-compat/port-linux.c]
1094   [openbsd-compat/port-linux.h] Add support for SELinux, setting
1095   the execution and TTY contexts. based on patch from Daniel Walsh,
1096   bz #880; ok dtucker@
1097
109820060418
1099 - (djm) [canohost.c] Reorder IP options check so that it isn't broken
1100   by mapped addresses; bz #1179 reported by markw wtech-llc.com;
1101   ok dtucker@
1102
110320060331
1104 - OpenBSD CVS Sync
1105   - deraadt@cvs.openbsd.org 2006/03/27 01:21:18
1106     [xmalloc.c]
1107     we can do the size & nmemb check before the integer overflow check;
1108     evol
1109   - deraadt@cvs.openbsd.org 2006/03/27 13:03:54
1110     [dh.c]
1111     use strtonum() instead of atoi(), limit dhg size to 64k; ok djm
1112   - djm@cvs.openbsd.org 2006/03/27 23:15:46
1113     [sftp.c]
1114     always use a format string for addargs; spotted by mouring@
1115   - deraadt@cvs.openbsd.org 2006/03/28 00:12:31
1116     [README.tun ssh.c]
1117     spacing
1118   - deraadt@cvs.openbsd.org 2006/03/28 01:52:28
1119     [channels.c]
1120     do not accept unreasonable X ports numbers; ok djm
1121   - deraadt@cvs.openbsd.org 2006/03/28 01:53:43
1122     [ssh-agent.c]
1123     use strtonum() to parse the pid from the file, and range check it
1124     better; ok djm
1125   - djm@cvs.openbsd.org 2006/03/30 09:41:25
1126     [channels.c]
1127     ARGSUSED for dispatch table-driven functions
1128   - djm@cvs.openbsd.org 2006/03/30 09:58:16
1129     [authfd.c bufaux.c deattack.c gss-serv.c mac.c misc.c misc.h]
1130     [monitor_wrap.c msg.c packet.c sftp-client.c sftp-server.c ssh-agent.c]
1131     replace {GET,PUT}_XXBIT macros with functionally similar functions,
1132     silencing a heap of lint warnings. also allows them to use
1133     __bounded__ checking which can't be applied to macros; requested
1134     by and feedback from deraadt@
1135   - djm@cvs.openbsd.org 2006/03/30 10:41:25
1136     [ssh.c ssh_config.5]
1137     add percent escape chars to the IdentityFile option, bz #1159 based
1138     on a patch by imaging AT math.ualberta.ca; feedback and ok dtucker@
1139   - dtucker@cvs.openbsd.org 2006/03/30 11:05:17
1140     [ssh-keygen.c]
1141     Correctly handle truncated files while converting keys; ok djm@
1142   - dtucker@cvs.openbsd.org 2006/03/30 11:40:21
1143     [auth.c monitor.c]
1144     Prevent duplicate log messages when privsep=yes; ok djm@
1145   - jmc@cvs.openbsd.org 2006/03/31 09:09:30
1146     [ssh_config.5]
1147     kill trailing whitespace;
1148   - djm@cvs.openbsd.org 2006/03/31 09:13:56
1149     [ssh_config.5]
1150     remote user escape is %r not %h; spotted by jmc@
1151
115220060326
1153 - OpenBSD CVS Sync
1154   - jakob@cvs.openbsd.org 2006/03/15 08:46:44
1155     [ssh-keygen.c]
1156     if no key file are given when printing the DNS host record, use the
1157     host key file(s) as default. ok djm@
1158   - biorn@cvs.openbsd.org 2006/03/16 10:31:45
1159     [scp.c]
1160     Try to display errormessage even if remout == -1
1161     ok djm@, markus@
1162   - djm@cvs.openbsd.org 2006/03/17 22:31:50
1163     [authfd.c]
1164     another unreachable found by lint
1165   - djm@cvs.openbsd.org 2006/03/17 22:31:11
1166     [authfd.c]
1167     unreachanble statement, found by lint
1168   - djm@cvs.openbsd.org 2006/03/19 02:22:32
1169     [serverloop.c]
1170     memory leaks detected by Coverity via elad AT netbsd.org;
1171     ok deraadt@ dtucker@
1172   - djm@cvs.openbsd.org 2006/03/19 02:22:56
1173     [sftp.c]
1174     more memory leaks detected by Coverity via elad AT netbsd.org;
1175     deraadt@ ok
1176   - djm@cvs.openbsd.org 2006/03/19 02:23:26
1177     [hostfile.c]
1178     FILE* leak detected by Coverity via elad AT netbsd.org;
1179     ok deraadt@
1180   - djm@cvs.openbsd.org 2006/03/19 02:24:05
1181     [dh.c readconf.c servconf.c]
1182     potential NULL pointer dereferences detected by Coverity
1183     via elad AT netbsd.org; ok deraadt@
1184   - djm@cvs.openbsd.org 2006/03/19 07:41:30
1185     [sshconnect2.c]
1186     memory leaks detected by Coverity via elad AT netbsd.org;
1187     deraadt@ ok
1188   - dtucker@cvs.openbsd.org 2006/03/19 11:51:52
1189     [servconf.c]
1190     Correct strdelim null test; ok djm@
1191   - deraadt@cvs.openbsd.org 2006/03/19 18:52:11
1192     [auth1.c authfd.c channels.c]
1193     spacing
1194   - deraadt@cvs.openbsd.org 2006/03/19 18:53:12
1195     [kex.c kex.h monitor.c myproposal.h session.c]
1196     spacing
1197   - deraadt@cvs.openbsd.org 2006/03/19 18:56:41
1198     [clientloop.c progressmeter.c serverloop.c sshd.c]
1199     ARGSUSED for signal handlers
1200   - deraadt@cvs.openbsd.org 2006/03/19 18:59:49
1201     [ssh-keyscan.c]
1202     please lint
1203   - deraadt@cvs.openbsd.org 2006/03/19 18:59:30
1204     [ssh.c]
1205     spacing
1206   - deraadt@cvs.openbsd.org 2006/03/19 18:59:09
1207     [authfile.c]
1208     whoever thought that break after return was a good idea needs to
1209     get their head examimed
1210   - djm@cvs.openbsd.org 2006/03/20 04:09:44
1211     [monitor.c]
1212     memory leaks detected by Coverity via elad AT netbsd.org;
1213     deraadt@ ok
1214     that should be all of them now
1215   - djm@cvs.openbsd.org 2006/03/20 11:38:46
1216     [key.c]
1217     (really) last of the Coverity diffs: avoid possible NULL deref in
1218     key_free. via elad AT netbsd.org; markus@ ok
1219   - deraadt@cvs.openbsd.org 2006/03/20 17:10:19
1220     [auth.c key.c misc.c packet.c ssh-add.c]
1221     in a switch (), break after return or goto is stupid
1222   - deraadt@cvs.openbsd.org 2006/03/20 17:13:16
1223     [key.c]
1224     djm did a typo
1225   - deraadt@cvs.openbsd.org 2006/03/20 17:17:23
1226     [ssh-rsa.c]
1227     in a switch (), break after return or goto is stupid
1228   - deraadt@cvs.openbsd.org 2006/03/20 18:14:02
1229     [channels.c clientloop.c monitor_wrap.c monitor_wrap.h serverloop.c]
1230     [ssh.c sshpty.c sshpty.h]
1231     sprinkle u_int throughout pty subsystem, ok markus
1232   - deraadt@cvs.openbsd.org 2006/03/20 18:17:20
1233     [auth1.c auth2.c sshd.c]
1234     sprinkle some ARGSUSED for table driven functions (which sometimes
1235     must ignore their args)
1236   - deraadt@cvs.openbsd.org 2006/03/20 18:26:55
1237     [channels.c monitor.c session.c session.h ssh-agent.c ssh-keygen.c]
1238     [ssh-rsa.c ssh.c sshlogin.c]
1239     annoying spacing fixes getting in the way of real diffs
1240   - deraadt@cvs.openbsd.org 2006/03/20 18:27:50
1241     [monitor.c]
1242     spacing
1243   - deraadt@cvs.openbsd.org 2006/03/20 18:35:12
1244     [channels.c]
1245     x11_fake_data is only ever used as u_char *
1246   - deraadt@cvs.openbsd.org 2006/03/20 18:41:43
1247     [dns.c]
1248     cast xstrdup to propert u_char *
1249   - deraadt@cvs.openbsd.org 2006/03/20 18:42:27
1250     [canohost.c match.c ssh.c sshconnect.c]
1251     be strict with tolower() casting
1252   - deraadt@cvs.openbsd.org 2006/03/20 18:48:34
1253     [channels.c fatal.c kex.c packet.c serverloop.c]
1254     spacing
1255   - deraadt@cvs.openbsd.org 2006/03/20 21:11:53
1256     [ttymodes.c]
1257     spacing
1258   - djm@cvs.openbsd.org 2006/03/25 00:05:41
1259     [auth-bsdauth.c auth-skey.c auth.c auth2-chall.c channels.c]
1260     [clientloop.c deattack.c gss-genr.c kex.c key.c misc.c moduli.c]
1261     [monitor.c monitor_wrap.c packet.c scard.c sftp-server.c ssh-agent.c]
1262     [ssh-keyscan.c ssh.c sshconnect.c sshconnect2.c sshd.c uuencode.c]
1263     [xmalloc.c xmalloc.h]
1264     introduce xcalloc() and xasprintf() failure-checked allocations
1265     functions and use them throughout openssh
1266
1267     xcalloc is particularly important because malloc(nmemb * size) is a
1268     dangerous idiom (subject to integer overflow) and it is time for it
1269     to die
1270
1271     feedback and ok deraadt@
1272   - djm@cvs.openbsd.org 2006/03/25 01:13:23
1273     [buffer.c channels.c deattack.c misc.c scp.c session.c sftp-client.c]
1274     [sftp-server.c ssh-agent.c ssh-rsa.c xmalloc.c xmalloc.h auth-pam.c]
1275     [uidswap.c]
1276     change OpenSSH's xrealloc() function from being xrealloc(p, new_size)
1277     to xrealloc(p, new_nmemb, new_itemsize).
1278
1279     realloc is particularly prone to integer overflows because it is
1280     almost always allocating "n * size" bytes, so this is a far safer
1281     API; ok deraadt@
1282   - djm@cvs.openbsd.org 2006/03/25 01:30:23
1283     [sftp.c]
1284     "abormally" is a perfectly cromulent word, but "abnormally" is better
1285   - djm@cvs.openbsd.org 2006/03/25 13:17:03
1286     [atomicio.c auth-bsdauth.c auth-chall.c auth-options.c auth-passwd.c]
1287     [auth-rh-rsa.c auth-rhosts.c auth-rsa.c auth-skey.c auth.c auth1.c]
1288     [auth2-chall.c auth2-hostbased.c auth2-kbdint.c auth2-none.c]
1289     [auth2-passwd.c auth2-pubkey.c auth2.c authfd.c authfile.c bufaux.c]
1290     [buffer.c canohost.c channels.c cipher-3des1.c cipher-bf1.c]
1291     [cipher-ctr.c cipher.c cleanup.c clientloop.c compat.c compress.c]
1292     [deattack.c dh.c dispatch.c fatal.c groupaccess.c hostfile.c kex.c]
1293     [kexdh.c kexdhc.c kexdhs.c kexgex.c kexgexc.c kexgexs.c key.c log.c]
1294     [mac.c match.c md-sha256.c misc.c monitor.c monitor_fdpass.c]
1295     [monitor_mm.c monitor_wrap.c msg.c nchan.c packet.c progressmeter.c]
1296     [readconf.c readpass.c rsa.c scard.c scp.c servconf.c serverloop.c]
1297     [session.c sftp-client.c sftp-common.c sftp-glob.c sftp-server.c]
1298     [sftp.c ssh-add.c ssh-agent.c ssh-dss.c ssh-keygen.c ssh-keyscan.c]
1299     [ssh-keysign.c ssh-rsa.c ssh.c sshconnect.c sshconnect1.c]
1300     [sshconnect2.c sshd.c sshlogin.c sshpty.c sshtty.c ttymodes.c]
1301     [uidswap.c uuencode.c xmalloc.c]
1302     Put $OpenBSD$ tags back (as comments) to replace the RCSID()s that
1303     Theo nuked - our scripts to sync -portable need them in the files
1304   - deraadt@cvs.openbsd.org 2006/03/25 18:29:35
1305     [auth-rsa.c authfd.c packet.c]
1306     needed casts (always will be needed)
1307   - deraadt@cvs.openbsd.org 2006/03/25 18:30:55
1308     [clientloop.c serverloop.c]
1309     spacing
1310   - deraadt@cvs.openbsd.org 2006/03/25 18:36:15
1311     [sshlogin.c sshlogin.h]
1312     nicer size_t and time_t types
1313   - deraadt@cvs.openbsd.org 2006/03/25 18:40:14
1314     [ssh-keygen.c]
1315     cast strtonum() result to right type
1316   - deraadt@cvs.openbsd.org 2006/03/25 18:41:45
1317     [ssh-agent.c]
1318     mark two more signal handlers ARGSUSED
1319   - deraadt@cvs.openbsd.org 2006/03/25 18:43:30
1320     [channels.c]
1321     use strtonum() instead of atoi() [limit X screens to 400, sorry]
1322   - deraadt@cvs.openbsd.org 2006/03/25 18:56:55
1323     [bufaux.c channels.c packet.c]
1324     remove (char *) casts to a function that accepts void * for the arg
1325   - deraadt@cvs.openbsd.org 2006/03/25 18:58:10
1326     [channels.c]
1327     delete cast not required
1328   - djm@cvs.openbsd.org 2006/03/25 22:22:43
1329     [atomicio.h auth-options.h auth.h auth2-gss.c authfd.h authfile.h]
1330     [bufaux.h buffer.h canohost.h channels.h cipher.h clientloop.h]
1331     [compat.h compress.h crc32.c crc32.h deattack.h dh.h dispatch.h]
1332     [dns.c dns.h getput.h groupaccess.h gss-genr.c gss-serv-krb5.c]
1333     [gss-serv.c hostfile.h includes.h kex.h key.h log.h mac.h match.h]
1334     [misc.h monitor.h monitor_fdpass.h monitor_mm.h monitor_wrap.h msg.h]
1335     [myproposal.h packet.h pathnames.h progressmeter.h readconf.h rsa.h]
1336     [scard.h servconf.h serverloop.h session.h sftp-common.h sftp.h]
1337     [ssh-gss.h ssh.h ssh1.h ssh2.h sshconnect.h sshlogin.h sshpty.h]
1338     [ttymodes.h uidswap.h uuencode.h xmalloc.h]
1339     standardise spacing in $OpenBSD$ tags; requested by deraadt@
1340   - deraadt@cvs.openbsd.org 2006/03/26 01:31:48
1341     [uuencode.c]
1342     typo
1343
134420060325
1345 - OpenBSD CVS Sync
1346   - djm@cvs.openbsd.org 2006/03/16 04:24:42
1347     [ssh.1]
1348     Add RFC4419 (Diffie-Hellman group exchange KEX) to the list of SSH RFCs
1349     that OpenSSH supports
1350   - deraadt@cvs.openbsd.org 2006/03/19 18:51:18
1351     [atomicio.c auth-bsdauth.c auth-chall.c auth-krb5.c auth-options.c]
1352     [auth-pam.c auth-passwd.c auth-rh-rsa.c auth-rhosts.c auth-rsa.c]
1353     [auth-shadow.c auth-skey.c auth.c auth1.c auth2-chall.c]
1354     [auth2-hostbased.c auth2-kbdint.c auth2-none.c auth2-passwd.c]
1355     [auth2-pubkey.c auth2.c authfd.c authfile.c bufaux.c buffer.c]
1356     [canohost.c channels.c cipher-3des1.c cipher-acss.c cipher-aes.c]
1357     [cipher-bf1.c cipher-ctr.c cipher.c cleanup.c clientloop.c compat.c]
1358     [compress.c deattack.c dh.c dispatch.c dns.c entropy.c fatal.c]
1359     [groupaccess.c hostfile.c includes.h kex.c kexdh.c kexdhc.c]
1360     [kexdhs.c kexgex.c kexgexc.c kexgexs.c key.c log.c loginrec.c]
1361     [loginrec.h logintest.c mac.c match.c md-sha256.c md5crypt.c misc.c]
1362     [monitor.c monitor_fdpass.c monitor_mm.c monitor_wrap.c msg.c]
1363     [nchan.c packet.c progressmeter.c readconf.c readpass.c rsa.c]
1364     [scard.c scp.c servconf.c serverloop.c session.c sftp-client.c]
1365     [sftp-common.c sftp-glob.c sftp-server.c sftp.c ssh-add.c]
1366     [ssh-agent.c ssh-dss.c ssh-keygen.c ssh-keyscan.c ssh-keysign.c]
1367     [ssh-rand-helper.c ssh-rsa.c ssh.c sshconnect.c sshconnect1.c]
1368     [sshconnect2.c sshd.c sshlogin.c sshpty.c sshtty.c ttymodes.c]
1369     [uidswap.c uuencode.c xmalloc.c openbsd-compat/bsd-arc4random.c]
1370     [openbsd-compat/bsd-closefrom.c openbsd-compat/bsd-cygwin_util.c]
1371     [openbsd-compat/bsd-getpeereid.c openbsd-compat/bsd-misc.c]
1372     [openbsd-compat/bsd-nextstep.c openbsd-compat/bsd-snprintf.c]
1373     [openbsd-compat/bsd-waitpid.c openbsd-compat/fake-rfc2553.c]
1374     RCSID() can die
1375   - deraadt@cvs.openbsd.org 2006/03/19 18:53:12
1376     [kex.h myproposal.h]
1377     spacing
1378   - djm@cvs.openbsd.org 2006/03/20 04:07:22
1379     [auth2-gss.c]
1380     GSSAPI related leaks detected by Coverity via elad AT netbsd.org;
1381     reviewed by simon AT sxw.org.uk; deraadt@ ok
1382   - djm@cvs.openbsd.org 2006/03/20 04:07:49
1383     [gss-genr.c]
1384     more GSSAPI related leaks detected by Coverity via elad AT netbsd.org;
1385     reviewed by simon AT sxw.org.uk; deraadt@ ok
1386   - djm@cvs.openbsd.org 2006/03/20 04:08:18
1387     [gss-serv.c]
1388     last lot of GSSAPI related leaks detected by Coverity via
1389     elad AT netbsd.org; reviewed by simon AT sxw.org.uk; deraadt@ ok
1390   - deraadt@cvs.openbsd.org 2006/03/20 18:14:02
1391     [monitor_wrap.h sshpty.h]
1392     sprinkle u_int throughout pty subsystem, ok markus
1393   - deraadt@cvs.openbsd.org 2006/03/20 18:26:55
1394     [session.h]
1395     annoying spacing fixes getting in the way of real diffs
1396   - deraadt@cvs.openbsd.org 2006/03/20 18:41:43
1397     [dns.c]
1398     cast xstrdup to propert u_char *
1399   - jakob@cvs.openbsd.org 2006/03/22 21:16:24
1400     [ssh.1]
1401     simplify SSHFP example; ok jmc@
1402   - djm@cvs.openbsd.org 2006/03/22 21:27:15
1403     [deattack.c deattack.h]
1404     remove IV support from the CRC attack detector, OpenSSH has never used
1405     it - it only applied to IDEA-CFB, which we don't support.
1406     prompted by NetBSD Coverity report via elad AT netbsd.org;
1407     feedback markus@ "nuke it" deraadt@
1408
140920060318
1410 - (djm) [auth-pam.c] Fix memleak in error path, from Coverity via
1411   elad AT NetBSD.org
1412 - (dtucker) [openbsd-compat/bsd-snprintf.c] Bug #1173: make fmtint() take
1413   a LLONG rather than a long.  Fixes scp'ing of large files on platforms
1414   with missing/broken snprintfs.  Patch from e.borovac at bom.gov.au.
1415
141620060316
1417 - (dtucker) [entropy.c] Add headers for WIFEXITED and friends.
1418 - (dtucker) [configure.ac md-sha256.c] NetBSD has sha2.h in
1419   /usr/include/crypto.  Hint from djm@.
1420 - (tim) [kex.c myproposal.h md-sha256.c openbsd-compat/sha2.c,h]
1421   Disable sha256 when openssl < 0.9.7. Patch from djm@.
1422 - (djm) [kex.c] Slightly more clean deactivation of dhgex-sha256 on old
1423   OpenSSL; ok tim
1424
142520060315
1426 - (djm) OpenBSD CVS Sync:
1427   - msf@cvs.openbsd.org 2006/02/06 15:54:07
1428     [ssh.1]
1429     - typo fix
1430     ok jmc@
1431   - jmc@cvs.openbsd.org 2006/02/06 21:44:47
1432     [ssh.1]
1433     make this a little less ambiguous...
1434   - stevesk@cvs.openbsd.org 2006/02/07 01:08:04
1435     [auth-rhosts.c includes.h]
1436     move #include <netgroup.h> out of includes.h; ok markus@
1437   - stevesk@cvs.openbsd.org 2006/02/07 01:18:09
1438     [includes.h ssh-agent.c ssh-keyscan.c sshconnect2.c]
1439     move #include <sys/queue.h> out of includes.h; ok markus@
1440   - stevesk@cvs.openbsd.org 2006/02/07 01:42:00
1441     [channels.c clientloop.c clientloop.h includes.h packet.h]
1442     [serverloop.c sshpty.c sshpty.h sshtty.c ttymodes.c]
1443     move #include <termios.h> out of includes.h; ok markus@
1444   - stevesk@cvs.openbsd.org 2006/02/07 01:52:50
1445     [sshtty.c]
1446     "log.h" not needed
1447   - stevesk@cvs.openbsd.org 2006/02/07 03:47:05
1448     [hostfile.c]
1449     "packet.h" not needed
1450   - stevesk@cvs.openbsd.org 2006/02/07 03:59:20
1451     [deattack.c]
1452     duplicate #include
1453   - stevesk@cvs.openbsd.org 2006/02/08 12:15:27
1454     [auth.c clientloop.c includes.h misc.c monitor.c readpass.c]
1455     [session.c sftp.c ssh-agent.c ssh-keysign.c ssh.c sshconnect.c]
1456     [sshd.c sshpty.c]
1457     move #include <paths.h> out of includes.h; ok markus@
1458   - stevesk@cvs.openbsd.org 2006/02/08 12:32:49
1459     [includes.h misc.c]
1460     move #include <netinet/tcp.h> out of includes.h; ok markus@
1461   - stevesk@cvs.openbsd.org 2006/02/08 13:15:44
1462     [gss-serv.c monitor.c]
1463     small KNF
1464   - stevesk@cvs.openbsd.org 2006/02/08 14:16:59
1465     [sshconnect.c]
1466     <openssl/bn.h> not needed
1467   - stevesk@cvs.openbsd.org 2006/02/08 14:31:30
1468     [includes.h ssh-agent.c ssh-keyscan.c ssh.c]
1469     move #include <sys/resource.h> out of includes.h; ok markus@
1470   - stevesk@cvs.openbsd.org 2006/02/08 14:38:18
1471     [includes.h packet.c]
1472     move #include <netinet/in_systm.h> and <netinet/ip.h> out of
1473     includes.h; ok markus@
1474   - stevesk@cvs.openbsd.org 2006/02/08 23:51:24
1475     [includes.h scp.c sftp-glob.c sftp-server.c]
1476     move #include <dirent.h> out of includes.h; ok markus@
1477   - stevesk@cvs.openbsd.org 2006/02/09 00:32:07
1478     [includes.h]
1479     #include <sys/endian.h> not needed; ok djm@
1480     NB. ID Sync only - we still need this (but it may move later)
1481   - jmc@cvs.openbsd.org 2006/02/09 10:10:47
1482     [sshd.8]
1483     - move some text into a CAVEATS section
1484     - merge the COMMAND EXECUTION... section into AUTHENTICATION
1485   - stevesk@cvs.openbsd.org 2006/02/10 00:27:13
1486     [channels.c clientloop.c includes.h misc.c progressmeter.c sftp.c]
1487     [ssh.c sshd.c sshpty.c]
1488     move #include <sys/ioctl.h> out of includes.h; ok markus@
1489   - stevesk@cvs.openbsd.org 2006/02/10 01:44:27
1490     [includes.h monitor.c readpass.c scp.c serverloop.c session.c]
1491     [sftp.c sshconnect.c sshconnect2.c sshd.c]
1492     move #include <sys/wait.h> out of includes.h; ok markus@
1493   - otto@cvs.openbsd.org 2006/02/11 19:31:18
1494     [atomicio.c]
1495     type correctness; from Ray Lai in PR 5011; ok millert@
1496   - djm@cvs.openbsd.org 2006/02/12 06:45:34
1497     [ssh.c ssh_config.5]
1498     add a %l expansion code to the ControlPath, which is filled in with the
1499     local hostname at runtime. Requested by henning@ to avoid some problems
1500     with /home on NFS; ok dtucker@
1501   - djm@cvs.openbsd.org 2006/02/12 10:44:18
1502     [readconf.c]
1503     raise error when the user specifies a RekeyLimit that is smaller than 16
1504     (the smallest of our cipher's blocksize) or big enough to cause integer
1505     wraparound; ok & feedback dtucker@
1506   - jmc@cvs.openbsd.org 2006/02/12 10:49:44
1507     [ssh_config.5]
1508     slight rewording; ok djm
1509   - jmc@cvs.openbsd.org 2006/02/12 10:52:41
1510     [sshd.8]
1511     rework the description of authorized_keys a little;
1512   - jmc@cvs.openbsd.org 2006/02/12 17:57:19
1513     [sshd.8]
1514     sort the list of options permissable w/ authorized_keys;
1515     ok djm dtucker
1516   - jmc@cvs.openbsd.org 2006/02/13 10:16:39
1517     [sshd.8]
1518     no need to subsection the authorized_keys examples - instead, convert
1519     this to look like an actual file. also use proto 2 keys, and use IETF
1520     example addresses;
1521   - jmc@cvs.openbsd.org 2006/02/13 10:21:25
1522     [sshd.8]
1523     small tweaks for the ssh_known_hosts section;
1524   - jmc@cvs.openbsd.org 2006/02/13 11:02:26
1525     [sshd.8]
1526     turn this into an example ssh_known_hosts file; ok djm
1527   - jmc@cvs.openbsd.org 2006/02/13 11:08:43
1528     [sshd.8]
1529     - avoid nasty line split
1530     - `*' does not need to be escaped
1531   - jmc@cvs.openbsd.org 2006/02/13 11:27:25
1532     [sshd.8]
1533     sort FILES and use a -compact list;
1534   - david@cvs.openbsd.org 2006/02/15 05:08:24
1535     [sftp-client.c]
1536     typo in comment; ok djm@
1537   - jmc@cvs.openbsd.org 2006/02/15 16:53:20
1538     [ssh.1]
1539     remove the IETF draft references and replace them with some updated RFCs;
1540   - jmc@cvs.openbsd.org 2006/02/15 16:55:33
1541     [sshd.8]
1542     remove ietf draft references; RFC list now maintained in ssh.1;
1543   - jmc@cvs.openbsd.org 2006/02/16 09:05:34
1544     [sshd.8]
1545     sync some of the FILES entries w/ ssh.1;
1546   - jmc@cvs.openbsd.org 2006/02/19 19:52:10
1547     [sshd.8]
1548     move the sshrc stuff out of FILES, and into its own section:
1549     FILES is not a good place to document how stuff works;
1550   - jmc@cvs.openbsd.org 2006/02/19 20:02:17
1551     [sshd.8]
1552     sync the (s)hosts.equiv FILES entries w/ those from ssh.1;
1553   - jmc@cvs.openbsd.org 2006/02/19 20:05:00
1554     [sshd.8]
1555     grammar;
1556   - jmc@cvs.openbsd.org 2006/02/19 20:12:25
1557     [ssh_config.5]
1558     add some vertical space;
1559   - stevesk@cvs.openbsd.org 2006/02/20 16:36:15
1560     [authfd.c channels.c includes.h session.c ssh-agent.c ssh.c]
1561     move #include <sys/un.h> out of includes.h; ok djm@
1562   - stevesk@cvs.openbsd.org 2006/02/20 17:02:44
1563     [clientloop.c includes.h monitor.c progressmeter.c scp.c]
1564     [serverloop.c session.c sftp.c ssh-agent.c ssh.c sshd.c]
1565     move #include <signal.h> out of includes.h; ok markus@
1566   - stevesk@cvs.openbsd.org 2006/02/20 17:19:54
1567     [auth-rhosts.c auth-rsa.c auth.c auth2-none.c auth2-pubkey.c]
1568     [authfile.c clientloop.c includes.h readconf.c scp.c session.c]
1569     [sftp-client.c sftp-common.c sftp-common.h sftp-glob.c]
1570     [sftp-server.c sftp.c ssh-add.c ssh-keygen.c ssh.c sshconnect.c]
1571     [sshconnect2.c sshd.c sshpty.c]
1572     move #include <sys/stat.h> out of includes.h; ok markus@
1573   - stevesk@cvs.openbsd.org 2006/02/22 00:04:45
1574     [canohost.c clientloop.c includes.h match.c readconf.c scp.c ssh.c]
1575     [sshconnect.c]
1576     move #include <ctype.h> out of includes.h; ok djm@
1577   - jmc@cvs.openbsd.org 2006/02/24 10:25:14
1578     [ssh_config.5]
1579     add section on patterns;
1580     from dtucker + myself
1581   - jmc@cvs.openbsd.org 2006/02/24 10:33:54
1582     [sshd_config.5]
1583     signpost to PATTERNS;
1584   - jmc@cvs.openbsd.org 2006/02/24 10:37:07
1585     [ssh_config.5]
1586     tidy up the refs to PATTERNS;
1587   - jmc@cvs.openbsd.org 2006/02/24 10:39:52
1588     [sshd.8]
1589     signpost to PATTERNS section;
1590   - jmc@cvs.openbsd.org 2006/02/24 20:22:16
1591     [ssh-keysign.8 ssh_config.5 sshd_config.5]
1592     some consistency fixes;
1593   - jmc@cvs.openbsd.org 2006/02/24 20:31:31
1594     [ssh.1 ssh_config.5 sshd.8 sshd_config.5]
1595     more consistency fixes;
1596   - jmc@cvs.openbsd.org 2006/02/24 23:20:07
1597     [ssh_config.5]
1598     some grammar/wording fixes;
1599   - jmc@cvs.openbsd.org 2006/02/24 23:43:57
1600     [sshd_config.5]
1601     some grammar/wording fixes;
1602   - jmc@cvs.openbsd.org 2006/02/24 23:51:17
1603     [sshd_config.5]
1604     oops - bits i missed;
1605   - jmc@cvs.openbsd.org 2006/02/25 12:26:17
1606     [ssh_config.5]
1607     document the possible values for KbdInteractiveDevices;
1608     help/ok dtucker
1609   - jmc@cvs.openbsd.org 2006/02/25 12:28:34
1610     [sshd_config.5]
1611     document the order in which allow/deny directives are processed;
1612     help/ok dtucker
1613   - jmc@cvs.openbsd.org 2006/02/26 17:17:18
1614     [ssh_config.5]
1615     move PATTERNS to the end of the main body; requested by dtucker
1616   - jmc@cvs.openbsd.org 2006/02/26 18:01:13
1617     [sshd_config.5]
1618     subsection is pointless here;
1619   - jmc@cvs.openbsd.org 2006/02/26 18:03:10
1620     [ssh_config.5]
1621     comma;
1622   - djm@cvs.openbsd.org 2006/02/28 01:10:21
1623     [session.c]
1624     fix logout recording when privilege separation is disabled, analysis and
1625     patch from vinschen at redhat.com; tested by dtucker@ ok deraadt@
1626     NB. ID sync only - patch already in portable
1627   - djm@cvs.openbsd.org 2006/03/04 04:12:58
1628     [serverloop.c]
1629     move a debug() outside of a signal handler; ok markus@ a little while back
1630   - djm@cvs.openbsd.org 2006/03/12 04:23:07
1631     [ssh.c]
1632     knf nit
1633   - djm@cvs.openbsd.org 2006/03/13 08:16:00
1634     [sshd.c]
1635     don't log that we are listening on a socket before the listen() call
1636     actually succeeds, bz #1162 reported by Senthil Kumar; ok dtucker@
1637   - dtucker@cvs.openbsd.org 2006/03/13 08:33:00
1638     [packet.c]
1639     Set TCP_NODELAY for all connections not just "interactive" ones.  Fixes
1640     poor performance and protocol stalls under some network conditions (mindrot
1641     bugs #556 and #981). Patch originally from markus@, ok djm@
1642   - dtucker@cvs.openbsd.org 2006/03/13 08:43:16
1643     [ssh-keygen.c]
1644     Make ssh-keygen handle CR and CRLF line termination when converting IETF
1645     format keys, in adition to vanilla LF.  mindrot #1157, tested by Chris
1646     Pepper, ok djm@
1647   - dtucker@cvs.openbsd.org 2006/03/13 10:14:29
1648     [misc.c ssh_config.5 sshd_config.5]
1649     Allow config directives to contain whitespace by surrounding them by double
1650     quotes.  mindrot #482, man page help from jmc@, ok djm@
1651   - dtucker@cvs.openbsd.org 2006/03/13 10:26:52
1652     [authfile.c authfile.h ssh-add.c]
1653     Make ssh-add check file permissions before attempting to load private
1654     key files multiple times; it will fail anyway and this prevents confusing
1655     multiple prompts and warnings.  mindrot #1138, ok djm@
1656   - djm@cvs.openbsd.org 2006/03/14 00:15:39
1657     [canohost.c]
1658     log the originating address and not just the name when a reverse
1659     mapping check fails, requested by linux AT linuon.com
1660   - markus@cvs.openbsd.org 2006/03/14 16:32:48
1661     [ssh_config.5 sshd_config.5]
1662     *AliveCountMax applies to protcol v2 only; ok dtucker, djm
1663   - djm@cvs.openbsd.org 2006/03/07 09:07:40
1664     [kex.c kex.h monitor.c myproposal.h ssh-keyscan.c sshconnect2.c sshd.c]
1665     Implement the diffie-hellman-group-exchange-sha256 key exchange method
1666     using the SHA256 code in libc (and wrapper to make it into an OpenSSL
1667     EVP), interop tested against CVS PuTTY
1668     NB. no portability bits committed yet
1669 - (djm) [configure.ac defines.h kex.c md-sha256.c]
1670   [openbsd-compat/sha2.h openbsd-compat/openbsd-compat.h]
1671   [openbsd-compat/sha2.c] First stab at portability glue for SHA256
1672   KEX support, should work with libc SHA256 support or OpenSSL
1673   EVP_sha256 if present
1674 - (djm) [includes.h] Restore accidentally dropped netinet/in.h
1675 - (djm) [Makefile.in openbsd-compat/Makefile.in] Add added files
1676 - (djm) [md-sha256.c configure.ac] md-sha256.c needs sha2.h if present
1677 - (djm) [regress/.cvsignore] Ignore Makefile here
1678 - (djm) [loginrec.c] Need stat.h
1679 - (djm) [openbsd-compat/sha2.h] Avoid include macro clash with
1680   system sha2.h
1681 - (djm) [ssh-rand-helper.c] Needs a bunch of headers
1682 - (djm) [ssh-agent.c] Restore dropped stat.h
1683 - (djm) [openbsd-compat/sha2.h openbsd-compat/sha2.c] Comment out
1684   SHA384, which we don't need and doesn't compile without tweaks
1685 - (djm) [auth-pam.c clientloop.c includes.h monitor.c session.c]
1686   [sftp-client.c ssh-keysign.c ssh.c sshconnect.c sshconnect2.c]
1687   [sshd.c openbsd-compat/bsd-misc.c openbsd-compat/bsd-openpty.c]
1688   [openbsd-compat/glob.c openbsd-compat/mktemp.c]
1689   [openbsd-compat/readpassphrase.c] Lots of include fixes for
1690   OpenSolaris
1691 - (tim) [includes.h] put sys/stat.h back in to quiet some "macro redefined:"
1692 - (tim) [openssh/sshpty.c openssh/openbsd-compat/port-tun.c] put in some
1693   includes removed from includes.h
1694 - (dtucker) [configure.ac] Fix glob test conversion to AC_TRY_COMPILE
1695 - (djm) [includes.h] Put back paths.h, it is needed in defines.h
1696 - (dtucker) [openbsd-compat/openbsd-compat.h] AIX (at least) needs
1697   sys/ioctl.h for struct winsize.
1698 - (dtucker) [configure.ac] login_cap.h requires sys/types.h on NetBSD.
1699
170020060313
1701 - (dtucker) [configure.ac] Bug #1171: Don't use printf("%lld", longlong)
1702   since not all platforms support it.  Instead, use internal equivalent while
1703   computing LLONG_MIN and LLONG_MAX.  Remove special case for alpha-dec-osf*
1704   as it's no longer required.  Tested by Bernhard Simon, ok djm@
1705
170620060304
1707 - (dtucker) [contrib/cygwin/ssh-host-config] Require use of lastlog as a
1708   file rather than directory, required as Cygwin will be importing lastlog(1).
1709   Also tightens up permissions on the file.  Patch from vinschen@redhat.com.
1710 - (dtucker) [gss-serv-krb5.c] Bug #1166: Correct #ifdefs for gssapi_krb5.h
1711   includes.  Patch from gentoo.riverrat at gmail.com.
1712
171320060226
1714 - (dtucker) [configure.ac] Bug #1156: QNX apparently needs SSHD_ACQUIRES_CTTY
1715   patch from kraai at ftbfs.org.
1716
171720060223
1718 - (dtucker) [sshd_config sshd_config.5] Update UsePAM to reflect current
1719   reality.  Pointed out by tryponraj at gmail.com.
1720
172120060222
1722 - (dtucker) [openbsd-compat/openssl-compat.{c,h}] Minor tidy up: only
1723   compile in compat code if required.
1724
172520060221
1726 - (dtucker) [openbsd-compat/openssl-compat.h] Prevent warning about
1727   redefinition of SSLeay_add_all_algorithms.
1728
172920060220
1730 - (dtucker) [INSTALL configure.ac openbsd-compat/openssl-compat.{c,h}]
1731   Add optional enabling of OpenSSL's (hardware) Engine support, via
1732   configure --with-ssl-engine.  Based in part on a diff by michal at
1733   logix.cz.
1734
173520060219
1736 - (dtucker) [Makefile.in configure.ac, added openbsd-compat/regress/]
1737   Add first attempt at regress tests for compat library.  ok djm@
1738
173920060214
1740 - (tim) [buildpkg.sh.in] Make the names consistent.
1741   s/pkg_post_make_install_fixes.sh/pkg-post-make-install-fixes.sh/ OK dtucker@
1742
174320060212
1744 - (dtucker) [openbsd-compat/bsd-cygwin_util.c] Make loop counter unsigned
1745   to silence compiler warning, from vinschen at redhat.com.
1746 - (tim) [configure.ac] Bug #1149. Disable /etc/default/login check for QNX.
1747 - (dtucker) [README version.h contrib/caldera/openssh.spec
1748   contrib/redhat/openssh.spec contrib/suse/openssh.spec] Bump version
1749   strings to match 4.3p2 release.
1750
175120060208
1752 - (tim) [session.c] Logout records were not updated on systems with
1753   post auth privsep disabled due to bug 1086 changes. Analysis and patch
1754   by vinschen at redhat.com. OK tim@, dtucker@.
1755 - (dtucker) [configure.ac] Typo in Ultrix and NewsOS sections (NEED_SETPRGP
1756   -> NEED_SETPGRP), reported by Bernhard Simon.  ok tim@
1757
175820060206
1759 - (tim) [configure.ac] Remove unnecessary tests for net/if.h and
1760   netinet/in_systm.h. OK dtucker@.
1761
176220060205
1763 - (tim) [configure.ac] Add AC_REVISION. Add sys/time.h to lastlog.h test
1764   for Solaris. OK dtucker@.
1765 - (tim) [configure.ac] Bug #1149. Changes in QNX section only. Patch by
1766   kraai at ftbfs.org.
1767
176820060203
1769 - (tim) [configure.ac] test for egrep (AC_PROG_EGREP) before first
1770   AC_CHECK_HEADERS test. Without it, if AC_CHECK_HEADERS is first run
1771   by a platform specific check, builtin standard includes tests will be
1772   skipped on the other platforms.
1773   Analysis and suggestion by vinschen at redhat.com, patch by dtucker@.
1774   OK tim@, djm@.
1775
177620060202
1777 - (dtucker) [configure.ac] Bug #1148: Fix "crippled AES" test so that it
1778   works with picky compilers.  Patch from alex.kiernan at thus.net.
1779
178020060201
1781 - (djm) [regress/test-exec.sh] Try 'logname' as well as 'whoami' to
1782   determine the user's login name - needed for regress tests on Solaris
1783   10 and OpenSolaris
1784 - (djm) OpenBSD CVS Sync
1785   - jmc@cvs.openbsd.org 2006/02/01 09:06:50
1786     [sshd.8]
1787     - merge sections on protocols 1 and 2 into a single section
1788     - remove configuration file section
1789     ok markus
1790   - jmc@cvs.openbsd.org 2006/02/01 09:11:41
1791     [sshd.8]
1792     small tweak;
1793 - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
1794   [contrib/suse/openssh.spec] Update versions ahead of release
1795   - markus@cvs.openbsd.org 2006/02/01 11:27:22
1796     [version.h]
1797     openssh 4.3
1798 - (djm) Release OpenSSH 4.3p1
1799
180020060131
1801 - (djm) OpenBSD CVS Sync
1802   - jmc@cvs.openbsd.org 2006/01/20 11:21:45
1803     [ssh_config.5]
1804     - word change, agreed w/ markus
1805     - consistency fixes
1806   - jmc@cvs.openbsd.org 2006/01/25 09:04:34
1807     [sshd.8]
1808     move the options description up the page, and a few additional tweaks
1809     whilst in here;
1810     ok markus
1811   - jmc@cvs.openbsd.org 2006/01/25 09:07:22
1812     [sshd.8]
1813     move subsections to full sections;
1814   - jmc@cvs.openbsd.org 2006/01/26 08:47:56
1815     [ssh.1]
1816     add a section on verifying host keys in dns;
1817     written with a lot of help from jakob;
1818     feedback dtucker/markus;
1819     ok markus
1820   - reyk@cvs.openbsd.org 2006/01/30 12:22:22
1821     [channels.c]
1822     mark channel as write failed or dead instead of read failed on error
1823     of the channel output filter.
1824     ok markus@
1825   - jmc@cvs.openbsd.org 2006/01/30 13:37:49
1826     [ssh.1]
1827     remove an incorrect sentence;
1828     reported by roumen petrov;
1829     ok djm markus
1830   - djm@cvs.openbsd.org 2006/01/31 10:19:02
1831     [misc.c misc.h scp.c sftp.c]
1832     fix local arbitrary command execution vulnerability on local/local and
1833     remote/remote copies (CVE-2006-0225, bz #1094), patch by
1834     t8m AT centrum.cz, polished by dtucker@ and myself; ok markus@
1835   - djm@cvs.openbsd.org 2006/01/31 10:35:43
1836     [scp.c]
1837     "scp a b c" shouldn't clobber "c" when it is not a directory, report and
1838     fix from biorn@; ok markus@
1839 - (djm) Sync regress tests to OpenBSD:
1840   - dtucker@cvs.openbsd.org 2005/03/10 10:20:39
1841     [regress/forwarding.sh]
1842     Regress test for ClearAllForwardings (bz #994); ok markus@
1843   - dtucker@cvs.openbsd.org 2005/04/25 09:54:09
1844     [regress/multiplex.sh]
1845     Don't call cleanup in multiplex as test-exec will cleanup anyway
1846     found by tim@, ok djm@
1847     NB. ID sync only, we already had this
1848   - djm@cvs.openbsd.org 2005/05/20 23:14:15
1849     [regress/test-exec.sh]
1850     force addressfamily=inet for tests, unbreaking dynamic-forward regress for
1851     recently committed nc SOCKS5 changes
1852   - djm@cvs.openbsd.org 2005/05/24 04:10:54
1853     [regress/try-ciphers.sh]
1854     oops, new arcfour modes here too
1855   - markus@cvs.openbsd.org 2005/06/30 11:02:37
1856     [regress/scp.sh]
1857     allow SUDO=sudo; from Alexander Bluhm
1858   - grunk@cvs.openbsd.org 2005/11/14 21:25:56
1859     [regress/agent-getpeereid.sh]
1860     all other scripts in this dir use $SUDO, not 'sudo', so pull this even
1861     ok markus@
1862   - dtucker@cvs.openbsd.org 2005/12/14 04:36:39
1863     [regress/scp-ssh-wrapper.sh]
1864     Fix assumption about how many args scp will pass; ok djm@
1865     NB. ID sync only, we already had this
1866   - djm@cvs.openbsd.org 2006/01/27 06:49:21
1867     [scp.sh]
1868     regress test for local to local scp copies; ok dtucker@
1869   - djm@cvs.openbsd.org 2006/01/31 10:23:23
1870     [scp.sh]
1871     regression test for CVE-2006-0225 written by dtucker@
1872   - djm@cvs.openbsd.org 2006/01/31 10:36:33
1873     [scp.sh]
1874     regress test for "scp a b c" where "c" is not a directory
1875
187620060129
1877 - (dtucker) [configure.ac opensshd.init.in] Bug #1144: Use /bin/sh for the
1878   opensshd.init script interpretter if /sbin/sh does not exist.  ok tim@
1879
188020060120
1881 - (dtucker) OpenBSD CVS Sync
1882   - jmc@cvs.openbsd.org 2006/01/15 17:37:05
1883     [ssh.1]
1884     correction from deraadt
1885   - jmc@cvs.openbsd.org 2006/01/18 10:53:29
1886     [ssh.1]
1887     add a section on ssh-based vpn, based on reyk's README.tun;
1888   - dtucker@cvs.openbsd.org 2006/01/20 00:14:55
1889     [scp.1 ssh.1 ssh_config.5 sftp.1]
1890     Document RekeyLimit.  Based on patch from jan.iven at cern.ch from mindrot
1891     #1056 with feedback from jmc, djm and markus; ok jmc@ djm@
1892
189320060114
1894 - (djm) OpenBSD CVS Sync
1895   - jmc@cvs.openbsd.org 2006/01/06 13:27:32
1896     [ssh.1]
1897     weed out some duplicate info in the known_hosts FILES entries;
1898     ok djm
1899   - jmc@cvs.openbsd.org 2006/01/06 13:29:10
1900     [ssh.1]
1901     final round of whacking FILES for duplicate info, and some consistency
1902     fixes;
1903     ok djm
1904   - jmc@cvs.openbsd.org 2006/01/12 14:44:12
1905     [ssh.1]
1906     split sections on tcp and x11 forwarding into two sections.
1907     add an example in the tcp section, based on sth i wrote for ssh faq;
1908     help + ok: djm markus dtucker
1909   - jmc@cvs.openbsd.org 2006/01/12 18:48:48
1910     [ssh.1]
1911     refer to `TCP' rather than `TCP/IP' in the context of connection
1912     forwarding;
1913     ok markus
1914   - jmc@cvs.openbsd.org 2006/01/12 22:20:00
1915     [sshd.8]
1916     refer to TCP forwarding, rather than TCP/IP forwarding;
1917   - jmc@cvs.openbsd.org 2006/01/12 22:26:02
1918     [ssh_config.5]
1919     refer to TCP forwarding, rather than TCP/IP forwarding;
1920   - jmc@cvs.openbsd.org 2006/01/12 22:34:12
1921     [ssh.1]
1922     back out a sentence - AUTHENTICATION already documents this;
1923
192420060109
1925 - (dtucker) [contrib/cygwin/ssh-host-config] Make sshd service depend on
1926   tcpip service so it's always started after IP is up.  Patch from
1927   vinschen at redhat.com.
1928
192920060106
1930 - (djm) OpenBSD CVS Sync
1931   - jmc@cvs.openbsd.org 2006/01/03 16:31:10
1932     [ssh.1]
1933     move FILES to a -compact list, and make each files an item in that list.
1934     this avoids nastly line wrap when we have long pathnames, and treats
1935     each file as a separate item;
1936     remove the .Pa too, since it is useless.
1937   - jmc@cvs.openbsd.org 2006/01/03 16:35:30
1938     [ssh.1]
1939     use a larger width for the ENVIRONMENT list;
1940   - jmc@cvs.openbsd.org 2006/01/03 16:52:36
1941     [ssh.1]
1942     put FILES in some sort of order: sort by pathname
1943   - jmc@cvs.openbsd.org 2006/01/03 16:55:18
1944     [ssh.1]
1945     tweak the description of ~/.ssh/environment
1946   - jmc@cvs.openbsd.org 2006/01/04 18:42:46
1947     [ssh.1]
1948     chop out some duplication in the .{r,s}hosts/{h,sh}osts.equiv FILES
1949     entries;
1950     ok markus
1951   - jmc@cvs.openbsd.org 2006/01/04 18:45:01
1952     [ssh.1]
1953     remove .Xr's to rsh(1) and telnet(1): they are hardly needed;
1954   - jmc@cvs.openbsd.org 2006/01/04 19:40:24
1955     [ssh.1]
1956     +.Xr ssh-keyscan 1 ,
1957   - jmc@cvs.openbsd.org 2006/01/04 19:50:09
1958     [ssh.1]
1959     -.Xr gzip 1 ,
1960   - djm@cvs.openbsd.org 2006/01/05 23:43:53
1961     [misc.c]
1962     check that stdio file descriptors are actually closed before clobbering
1963     them in sanitise_stdfd(). problems occurred when a lower numbered fd was
1964     closed, but higher ones weren't. spotted by, and patch tested by
1965     Fr�d�ric Olivi�
1966
196720060103
1968 - (djm) [channels.c] clean up harmless merge error, from reyk@
1969
197020060103
1971 - (djm) OpenBSD CVS Sync
1972   - jmc@cvs.openbsd.org 2006/01/02 17:09:49
1973     [ssh_config.5 sshd_config.5]
1974     some corrections from michael knudsen;
1975
197620060102
1977 - (djm) [README.tun] Add README.tun, missed during sync of tun(4) support
1978 - (djm) OpenBSD CVS Sync
1979   - jmc@cvs.openbsd.org 2005/12/31 10:46:17
1980     [ssh.1]
1981     merge the "LOGIN SESSION AND REMOTE EXECUTION" and "SERVER
1982     AUTHENTICATION" sections into "AUTHENTICATION";
1983     some rewording done to make the text read better, plus some
1984     improvements from djm;
1985     ok djm
1986   - jmc@cvs.openbsd.org 2005/12/31 13:44:04
1987     [ssh.1]
1988     clean up ENVIRONMENT a little;
1989   - jmc@cvs.openbsd.org 2005/12/31 13:45:19
1990     [ssh.1]
1991     .Nm does not require an argument;
1992   - stevesk@cvs.openbsd.org 2006/01/01 08:59:27
1993     [includes.h misc.c]
1994     move <net/if.h>; ok djm@
1995   - stevesk@cvs.openbsd.org 2006/01/01 10:08:48
1996     [misc.c]
1997     no trailing "\n" for debug()
1998   - djm@cvs.openbsd.org 2006/01/02 01:20:31
1999     [sftp-client.c sftp-common.h sftp-server.c]
2000     use a common max. packet length, no binary change
2001   - reyk@cvs.openbsd.org 2006/01/02 07:53:44
2002     [misc.c]
2003     clarify tun(4) opening - set the mode and bring the interface up. also
2004     (re)sets the tun(4) layer 2 LINK0 flag for existing tunnel interfaces.
2005     suggested and ok by djm@
2006   - jmc@cvs.openbsd.org 2006/01/02 12:31:06
2007     [ssh.1]
2008     start to cut some duplicate info from FILES;
2009     help/ok djm
2010
201120060101
2012 - (djm) [Makefile.in configure.ac includes.h misc.c]
2013         [openbsd-compat/port-tun.c openbsd-compat/port-tun.h] Add support
2014         for tunnel forwarding for FreeBSD and NetBSD. NetBSD's support is
2015         limited to IPv4 tunnels only, and most versions don't support the
2016         tap(4) device at all.
2017 - (djm) [configure.ac] Fix linux/if_tun.h test
2018 - (djm) [openbsd-compat/port-tun.c] Linux needs linux/if.h too
2019
202020051229
2021 - (djm) OpenBSD CVS Sync
2022   - stevesk@cvs.openbsd.org 2005/12/28 22:46:06
2023     [canohost.c channels.c clientloop.c]
2024     use 'break-in' for consistency; ok deraadt@ ok and input jmc@
2025   - reyk@cvs.openbsd.org 2005/12/30 15:56:37
2026     [channels.c channels.h clientloop.c]
2027     add channel output filter interface.
2028     ok djm@, suggested by markus@
2029   - jmc@cvs.openbsd.org 2005/12/30 16:59:00
2030     [sftp.1]
2031     do not suggest that interactive authentication will work
2032     with the -b flag;
2033     based on a diff from john l. scarfone;
2034     ok djm
2035   - stevesk@cvs.openbsd.org 2005/12/31 01:38:45
2036     [ssh.1]
2037     document -MM; ok djm@
2038 - (djm) [openbsd-compat/port-tun.c openbsd-compat/port-tun.h configure.ac]
2039   [serverloop.c ssh.c openbsd-compat/Makefile.in]
2040   [openbsd-compat/openbsd-compat.h] Implement tun(4) forwarding
2041   compatability support for Linux, diff from reyk@
2042 - (djm) [configure.ac] Disable Linux tun(4) compat code if linux/tun.h does
2043   not exist
2044 - (djm) [configure.ac] oops, make that linux/if_tun.h
2045
204620051229
2047 - (tim) [buildpkg.sh.in] grep for $SSHDUID instead of $SSHDGID on /etc/passwd
2048
204920051224
2050 - (djm) OpenBSD CVS Sync
2051   - jmc@cvs.openbsd.org 2005/12/20 21:59:43
2052     [ssh.1]
2053     merge the sections on protocols 1 and 2 into one section on
2054     authentication;
2055     feedback djm dtucker
2056     ok deraadt markus dtucker
2057   - jmc@cvs.openbsd.org 2005/12/20 22:02:50
2058     [ssh.1]
2059     .Ss -> .Sh: subsections have not made this page more readable
2060   - jmc@cvs.openbsd.org 2005/12/20 22:09:41
2061     [ssh.1]
2062     move info on ssh return values and config files up into the main
2063     description;
2064   - jmc@cvs.openbsd.org 2005/12/21 11:48:16
2065     [ssh.1]
2066     -L and -R descriptions are now above, not below, ~C description;
2067   - jmc@cvs.openbsd.org 2005/12/21 11:57:25
2068     [ssh.1]
2069     options now described `above', rather than `later';
2070   - jmc@cvs.openbsd.org 2005/12/21 12:53:31
2071     [ssh.1]
2072     -Y does X11 forwarding too;
2073     ok markus
2074   - stevesk@cvs.openbsd.org 2005/12/21 22:44:26
2075     [sshd.8]
2076     clarify precedence of -p, Port, ListenAddress; ok and help jmc@
2077   - jmc@cvs.openbsd.org 2005/12/22 10:31:40
2078     [ssh_config.5]
2079     put the description of "UsePrivilegedPort" in the correct place;
2080   - jmc@cvs.openbsd.org 2005/12/22 11:23:42
2081     [ssh.1]
2082     expand the description of -w somewhat;
2083     help/ok reyk
2084   - jmc@cvs.openbsd.org 2005/12/23 14:55:53
2085     [ssh.1]
2086     - sync the description of -e w/ synopsis
2087     - simplify the description of -I
2088     - note that -I is only available if support compiled in, and that it
2089     isn't by default
2090     feedback/ok djm@
2091   - jmc@cvs.openbsd.org 2005/12/23 23:46:23
2092     [ssh.1]
2093     less mark up for -c;
2094   - djm@cvs.openbsd.org 2005/12/24 02:27:41
2095     [session.c sshd.c]
2096     eliminate some code duplicated in privsep and non-privsep paths, and
2097     explicitly clear SIGALRM handler; "groovy" deraadt@
2098
209920051220
2100 - (dtucker) OpenBSD CVS Sync
2101   - reyk@cvs.openbsd.org 2005/12/13 15:03:02
2102     [serverloop.c]
2103     if forced_tun_device is not set, it is -1 and not SSH_TUNID_ANY
2104   - jmc@cvs.openbsd.org 2005/12/16 18:07:08
2105     [ssh.1]
2106     move the option descriptions up the page: start of a restructure;
2107     ok markus deraadt
2108   - jmc@cvs.openbsd.org 2005/12/16 18:08:53
2109     [ssh.1]
2110     simplify a sentence;
2111   - jmc@cvs.openbsd.org 2005/12/16 18:12:22
2112     [ssh.1]
2113     make the description of -c a little nicer;
2114   - jmc@cvs.openbsd.org 2005/12/16 18:14:40
2115     [ssh.1]
2116     signpost the protocol sections;
2117   - stevesk@cvs.openbsd.org 2005/12/17 21:13:05
2118     [ssh_config.5 session.c]
2119     spelling: fowarding, fowarded
2120   - stevesk@cvs.openbsd.org 2005/12/17 21:36:42
2121     [ssh_config.5]
2122     spelling: intented -> intended
2123   - dtucker@cvs.openbsd.org 2005/12/20 04:41:07
2124     [ssh.c]
2125     exit(255) on error to match description in ssh(1); bz #1137; ok deraadt@
2126
212720051219
2128 - (dtucker) [cipher-aes.c cipher-ctr.c cipher.c configure.ac
2129   openbsd-compat/openssl-compat.h] Check for and work around broken AES
2130   ciphers >128bit on (some) Solaris 10 systems.  ok djm@
2131
213220051217
2133 - (dtucker) [defines.h] HP-UX system headers define "YES" and "NO" which
2134   scp.c also uses, so undef them here.
2135 - (dtucker) [configure.ac openbsd-compat/bsd-snprintf.c] Bug #1133: Our
2136   snprintf replacement can have a conflicting declaration in HP-UX's system
2137   headers (const vs. no const) so we now check for and work around it.  Patch
2138   from the dynamic duo of David Leonard and Ted Percival.
2139
214020051214
2141 - (dtucker) OpenBSD CVS Sync (regress/)
2142   - dtucker@cvs.openbsd.org 2005/12/30 04:36:39
2143     [regress/scp-ssh-wrapper.sh]
2144     Fix assumption about how many args scp will pass; ok djm@
2145
214620051213
2147 - (djm) OpenBSD CVS Sync
2148   - jmc@cvs.openbsd.org 2005/11/30 11:18:27
2149     [ssh.1]
2150     timezone -> time zone
2151   - jmc@cvs.openbsd.org 2005/11/30 11:45:20
2152     [ssh.1]
2153     avoid ambiguities in describing TZ;
2154     ok djm@
2155   - reyk@cvs.openbsd.org 2005/12/06 22:38:28
2156     [auth-options.c auth-options.h channels.c channels.h clientloop.c]
2157     [misc.c misc.h readconf.c readconf.h scp.c servconf.c servconf.h]
2158     [serverloop.c sftp.c ssh.1 ssh.c ssh_config ssh_config.5 sshconnect.c]
2159     [sshconnect.h sshd.8 sshd_config sshd_config.5]
2160     Add support for tun(4) forwarding over OpenSSH, based on an idea and
2161     initial channel code bits by markus@. This is a simple and easy way to
2162     use OpenSSH for ad hoc virtual private network connections, e.g.
2163     administrative tunnels or secure wireless access. It's based on a new
2164     ssh channel and works similar to the existing TCP forwarding support,
2165     except that it depends on the tun(4) network interface on both ends of
2166     the connection for layer 2 or layer 3 tunneling. This diff also adds
2167     support for LocalCommand in the ssh(1) client.
2168     ok djm@, markus@, jmc@ (manpages), tested and discussed with others
2169   - djm@cvs.openbsd.org 2005/12/07 03:52:22
2170     [clientloop.c]
2171     reyk forgot to compile with -Werror (missing header)
2172   - jmc@cvs.openbsd.org 2005/12/07 10:52:13
2173     [ssh.1]
2174     - avoid line split in SYNOPSIS
2175     - add args to -w
2176     - kill trailing whitespace
2177   - jmc@cvs.openbsd.org 2005/12/08 14:59:44
2178     [ssh.1 ssh_config.5]
2179     make `!command' a little clearer;
2180     ok reyk
2181   - jmc@cvs.openbsd.org 2005/12/08 15:06:29
2182     [ssh_config.5]
2183     keep options in order;
2184   - reyk@cvs.openbsd.org 2005/12/08 18:34:11
2185     [auth-options.c includes.h misc.c misc.h readconf.c servconf.c]
2186     [serverloop.c ssh.c ssh_config.5 sshd_config.5 configure.ac]
2187     two changes to the new ssh tunnel support. this breaks compatibility
2188     with the initial commit but is required for a portable approach.
2189     - make the tunnel id u_int and platform friendly, use predefined types.
2190     - support configuration of layer 2 (ethernet) or layer 3
2191     (point-to-point, default) modes. configuration is done using the
2192     Tunnel (yes|point-to-point|ethernet|no) option is ssh_config(5) and
2193     restricted by the PermitTunnel (yes|point-to-point|ethernet|no) option
2194     in sshd_config(5).
2195     ok djm@, man page bits by jmc@
2196   - jmc@cvs.openbsd.org 2005/12/08 21:37:50
2197     [ssh_config.5]
2198     new sentence, new line;
2199   - markus@cvs.openbsd.org 2005/12/12 13:46:18
2200     [channels.c channels.h session.c]
2201     make sure protocol messages for internal channels are ignored.
2202     allow adjust messages for non-open channels; with and ok djm@
2203 - (djm) [misc.c] Disable tunnel code for non-OpenBSD (for now), enable
2204   again by providing a sys_tun_open() function for your platform and
2205   setting the CUSTOM_SYS_TUN_OPEN define. More work is required to match
2206   OpenBSD's tunnel protocol, which prepends the address family to the
2207   packet
2208
220920051201
2210 - (djm) [envpass.sh] Remove regress script that was accidentally committed
2211   in top level directory and not noticed for over a year :)
2212
221320051129
2214 - (tim) [ssh-keygen.c] Move DSA length test after setting default when
2215   bits == 0.
2216 - (dtucker) OpenBSD CVS Sync
2217   - dtucker@cvs.openbsd.org 2005/11/29 02:04:55
2218     [ssh-keygen.c]
2219     Populate default key sizes before checking them; from & ok tim@
2220 - (tim) [configure.ac sshd.8] Enable locked account check (a "*LK*" string)
2221   for UnixWare.
2222
222320051128
2224 - (dtucker) [regress/yes-head.sh] Work around breakage caused by some
2225   versions of GNU head.  Based on patch from zappaman at buraphalinux.org
2226 - (dtucker) [includes.h] Bug #1122: __USE_GNU is a glibc internal macro, use
2227   _GNU_SOURCE instead.  Patch from t8m at centrum.cz.
2228 - (dtucker) OpenBSD CVS Sync
2229   - dtucker@cvs.openbsd.org 2005/11/28 05:16:53
2230     [ssh-keygen.1 ssh-keygen.c]
2231     Enforce DSA key length of exactly 1024 bits to comply with FIPS-186-2,
2232     increase minumum RSA key size to 768 bits and update man page to reflect
2233     these.  Patch originally bz#1119 (senthilkumar_sen at hotpop.com),
2234     ok djm@, grudging ok deraadt@.
2235   - dtucker@cvs.openbsd.org 2005/11/28 06:02:56
2236     [ssh-agent.1]
2237     Update agent socket path templates to reflect reality, correct xref for
2238     time formats.  bz#1121, patch from openssh at roumenpetrov.info, ok djm@
2239
224020051126
2241 - (dtucker) [configure.ac] Bug #1126: AIX 5.2 and 5.3 (and presumably newer,
2242   when they're available) need the real UID set otherwise pam_chauthtok will
2243   set ADMCHG after changing the password, forcing the user to change it
2244   again immediately.
2245
224620051125
2247 - (dtucker) [configure.ac] Apply tim's fix for older systems where the
2248   resolver state in resolv.h is "state" not "__res_state".  With slight
2249   modification by me to also work on old AIXes.  ok djm@
2250 - (dtucker) [progressmeter.c scp.c sftp-server.c] Use correct casts for
2251   snprintf formats, fixes warnings on some 64 bit platforms.  Patch from
2252   shaw at vranix.com, ok djm@
2253
225420051124
2255 - (djm) [configure.ac openbsd-compat/Makefile.in openbsd-compat/bsd-asprintf.c
2256   openbsd-compat/bsd-snprintf.c openbsd-compat/openbsd-compat.h] Add an
2257   asprintf() implementation, after syncing our {v,}snprintf() implementation
2258   with some extra fixes from Samba's version. With help and debugging from
2259   dtucker and tim; ok dtucker@
2260 - (dtucker) [configure.ac] Fix typos in comments and AC_SEARCH_LIB argument
2261   order in Reliant Unix block.  Patch from johane at lysator.liu.se.
2262 - (dtucker) [regress/test-exec.sh] Use 1024 bit keys since we generate so
2263   many and use them only once.  Speeds up testing on older/slower hardware.
2264
226520051122
2266 - (dtucker) OpenBSD CVS Sync
2267   - deraadt@cvs.openbsd.org 2005/11/12 18:37:59
2268     [ssh-add.c]
2269     space
2270   - deraadt@cvs.openbsd.org 2005/11/12 18:38:15
2271     [scp.c]
2272     avoid close(-1), as in rcp; ok cloder
2273   - millert@cvs.openbsd.org 2005/11/15 11:59:54
2274     [includes.h]
2275     Include sys/queue.h explicitly instead of assuming some other header
2276     will pull it in.  At the moment it gets pulled in by sys/select.h
2277     (which ssh has no business including) via event.h.  OK markus@
2278     (ID sync only in -portable)
2279   - dtucker@cvs.openbsd.org 2005/11/21 09:42:10
2280     [auth-krb5.c]
2281     Perform Kerberos calls even for invalid users to prevent leaking
2282     information about account validity.  bz #975, patch originally from
2283     Senthil Kumar, sanity checked by Simon Wilkinson, tested by djm@, biorn@,
2284     ok markus@
2285   - dtucker@cvs.openbsd.org 2005/11/22 03:36:03
2286     [hostfile.c]
2287     Correct format/arguments to debug call; spotted by shaw at vranix.com
2288     ok djm@
2289 - (dtucker) [loginrec.c] Add casts to prevent compiler warnings, patch
2290   from shaw at vranix.com.
2291
229220051120
2293 - (dtucker) [openbsd-compat/openssl-compat.h] Add comment explaining what
2294   is going on.
2295
229620051112
2297 - (dtucker) [openbsd-compat/getrrsetbyname.c] Restore Portable-specific
2298   ifdef lost during sync.  Spotted by tim@.
2299 - (dtucker) [openbsd-compat/{realpath.c,stroll.c,rresvport.c}] $OpenBSD tag.
2300 - (dtucker) [configure.ac] Use "$AWK" instead of "awk" in gcc version test.
2301 - (dtucker) [configure.ac] Remove duplicate utimes() check.  ok djm@
2302 - (dtucker) [regress/reconfigure.sh] Fix potential race in the reconfigure
2303   test: if sshd takes too long to reconfigure the subsequent connection will
2304   fail.  Zap pidfile before HUPing sshd which will rewrite it when it's ready.
2305
230620051110
2307 - (dtucker) [openbsd-compat/setenv.c] Merge changes for __findenv from
2308   OpenBSD getenv.c revs 1.4 - 1.8 (ANSIfication of arguments, removal of
2309   "register").
2310 - (dtucker) [openbsd-compat/setenv.c] Make __findenv static, remove
2311   unnecessary prototype.
2312 - (dtucker) [openbsd-compat/setenv.c] Sync changes from OpenBSD setenv.c
2313   revs 1.7 - 1.9.
2314 - (dtucker) [auth-krb5.c] Fix -Wsign-compare warning in non-Heimdal path.
2315   Patch from djm@.
2316 - (dtucker) [configure.ac] Disable pointer-sign warnings on gcc 4.0+
2317   since they're not useful right now.  Patch from djm@.
2318 - (dtucker) [openbsd-compat/getgrouplist.c] Sync OpenBSD revs 1.10 - 1.2 (ANSI
2319   prototypes, removal of "register").
2320 - (dtucker) [openbsd-compat/strlcat.c] Sync OpenBSD revs 1.11 - 1.12 (removal
2321   of "register").
2322 - (dtucker) [openbsd-compat/{LOTS}] Move the "OPENBSD ORIGINAL" markers to
2323   after the copyright notices.  Having them at the top next to the CVSIDs
2324   guarantees a conflict for each and every sync.
2325 - (dtucker) [openbsd-compat/strlcpy.c] Update from OpenBSD 1.8 -> 1.10.
2326 - (dtucker) [openbsd-compat/sigact.h] Add "OPENBSD ORIGINAL" marker.
2327 - (dtucker) [openbsd-compat/strmode.c] Update from OpenBSD 1.5 -> 1.7.
2328   Removal of rcsid, "whiteout" inode type.
2329 - (dtucker) [openbsd-compat/basename.c] Update from OpenBSD 1.11 -> 1.14.
2330   Removal of rcsid, will no longer strlcpy parts of the string.
2331 - (dtucker) [openbsd-compat/strtoll.c] Update from OpenBSD 1.4 -> 1.5.
2332 - (dtucker) [openbsd-compat/strtoul.c] Update from OpenBSD 1.5 -> 1.7.
2333 - (dtucker) [openbsd-compat/readpassphrase.c] Update from OpenBSD 1.16 -> 1.18.
2334 - (dtucker) [openbsd-compat/readpassphrase.h] Update from OpenBSD 1.3 -> 1.5.
2335 - (dtucker) [openbsd-compat/glob.c] Update from OpenBSD 1.22 -> 1.25.
2336 - (dtucker) [openbsd-compat/glob.h] Update from OpenBSD 1.8 -> 1.9.
2337 - (dtucker) [openbsd-compat/getcwd.c] Update from OpenBSD 1.9 -> 1.14.
2338 - (dtucker) [openbsd-compat/getcwd.c] Replace lstat with fstat to match up
2339   with OpenBSD code since we don't support platforms without fstat any more.
2340 - (dtucker) [openbsd-compat/inet_aton.c] Update from OpenBSD 1.7 -> 1.9.
2341 - (dtucker) [openbsd-compat/inet_ntoa.c] Update from OpenBSD 1.4 -> 1.6.
2342 - (dtucker) [openbsd-compat/inet_ntop.c] Update from OpenBSD 1.5 -> 1.7.
2343 - (dtucker) [openbsd-compat/daemon.c] Update from OpenBSD 1.5 -> 1.6.
2344 - (dtucker) [openbsd-compat/strsep.c] Update from OpenBSD 1.5 -> 1.6.
2345 - (dtucker) [openbsd-compat/daemon.c] Update from OpenBSD 1.10 -> 1.13.
2346 - (dtucker) [openbsd-compat/mktemp.c] Update from OpenBSD 1.17 -> 1.19.
2347 - (dtucker) [openbsd-compat/rresvport.c] Update from OpenBSD 1.6 -> 1.8.
2348 - (dtucker) [openbsd-compat/bindresvport.c] Add "OPENBSD ORIGINAL" marker.
2349 - (dtucker) [openbsd-compat/bindresvport.c] Update from OpenBSD 1.16 -> 1.17.
2350 - (dtucker) [openbsd-compat/sigact.c] Update from OpenBSD 1.3 -> 1.4.
2351   Id and copyright sync only, there were no substantial changes we need.
2352 - (dtucker) [openbsd-compat/bsd-closefrom.c openbsd-compat/base64.c]
2353   -Wsign-compare fixes from djm.
2354 - (dtucker) [openbsd-compat/sigact.h] Update from OpenBSD 1.2 -> 1.3.
2355   Id and copyright sync only, there were no substantial changes we need.
2356 - (dtucker) [configure.ac] Try to get the gcc version number in a way that
2357   doesn't change between versions, and use a safer default.
2358
235920051105
2360 - (djm) OpenBSD CVS Sync
2361   - markus@cvs.openbsd.org 2005/10/07 11:13:57
2362     [ssh-keygen.c]
2363     change DSA default back to 1024, as it's defined for 1024 bits only
2364     and this causes interop problems with other clients.  moreover,
2365     in order to improve the security of DSA you need to change more
2366     components of DSA key generation (e.g. the internal SHA1 hash);
2367     ok deraadt
2368   - djm@cvs.openbsd.org 2005/10/10 10:23:08
2369     [channels.c channels.h clientloop.c serverloop.c session.c]
2370     fix regression I introduced in 4.2: X11 forwardings initiated after
2371     a session has exited (e.g. "(sleep 5; xterm) &") would not start.
2372     bz #1086 reported by t8m AT centrum.cz; ok markus@ dtucker@
2373   - djm@cvs.openbsd.org 2005/10/11 23:37:37
2374     [channels.c]
2375     bz #1076 set SO_REUSEADDR on X11 forwarding listner sockets, preventing
2376     bind() failure when a previous connection's listeners are in TIME_WAIT,
2377     reported by plattner AT inf.ethz.ch; ok dtucker@
2378   - stevesk@cvs.openbsd.org 2005/10/13 14:03:01
2379     [auth2-gss.c gss-genr.c gss-serv.c]
2380     remove unneeded #includes; ok markus@
2381   - stevesk@cvs.openbsd.org 2005/10/13 14:20:37
2382     [gss-serv.c]
2383     spelling in comments
2384   - stevesk@cvs.openbsd.org 2005/10/13 19:08:08
2385     [gss-serv-krb5.c gss-serv.c]
2386     unused declarations; ok deraadt@
2387     (id sync only for gss-serv-krb5.c)
2388   - stevesk@cvs.openbsd.org 2005/10/13 19:13:41
2389     [dns.c]
2390     unneeded #include, unused declaration, little knf; ok deraadt@
2391   - stevesk@cvs.openbsd.org 2005/10/13 22:24:31
2392     [auth2-gss.c gss-genr.c gss-serv.c monitor.c]
2393     KNF; ok djm@
2394   - stevesk@cvs.openbsd.org 2005/10/14 02:17:59
2395     [ssh-keygen.c ssh.c sshconnect2.c]
2396     no trailing "\n" for log functions; ok djm@
2397   - stevesk@cvs.openbsd.org 2005/10/14 02:29:37
2398     [channels.c clientloop.c]
2399     free()->xfree(); ok djm@
2400   - stevesk@cvs.openbsd.org 2005/10/15 15:28:12
2401     [sshconnect.c]
2402     make external definition static; ok deraadt@
2403   - stevesk@cvs.openbsd.org 2005/10/17 13:45:05
2404     [dns.c]
2405     fix memory leaks from 2 sources:
2406         1) key_fingerprint_raw()
2407         2) malloc in dns_read_rdata()
2408     ok jakob@
2409   - stevesk@cvs.openbsd.org 2005/10/17 14:01:28
2410     [dns.c]
2411     remove #ifdef LWRES; ok jakob@
2412   - stevesk@cvs.openbsd.org 2005/10/17 14:13:35
2413     [dns.c dns.h]
2414     more cleanups; ok jakob@
2415   - djm@cvs.openbsd.org 2005/10/30 01:23:19
2416     [ssh_config.5]
2417     mention control socket fallback behaviour, reported by
2418     tryponraj AT gmail.com
2419   - djm@cvs.openbsd.org 2005/10/30 04:01:03
2420     [ssh-keyscan.c]
2421     make ssh-keygen discard junk from server before SSH- ident, spotted by
2422     dave AT cirt.net; ok dtucker@
2423   - djm@cvs.openbsd.org 2005/10/30 04:03:24
2424     [ssh.c]
2425     fix misleading debug message; ok dtucker@
2426   - dtucker@cvs.openbsd.org 2005/10/30 08:29:29
2427     [canohost.c sshd.c]
2428     Check for connections with IP options earlier and drop silently.  ok djm@
2429   - jmc@cvs.openbsd.org 2005/10/30 08:43:47
2430     [ssh_config.5]
2431     remove trailing whitespace;
2432   - djm@cvs.openbsd.org 2005/10/30 08:52:18
2433     [clientloop.c packet.c serverloop.c session.c ssh-agent.c ssh-keygen.c]
2434     [ssh.c sshconnect.c sshconnect1.c sshd.c]
2435     no need to escape single quotes in comments, no binary change
2436   - dtucker@cvs.openbsd.org 2005/10/31 06:15:04
2437     [sftp.c]
2438     Fix sorting with "ls -1" command. From Robert Tsai, "looks right" deraadt@
2439   - djm@cvs.openbsd.org 2005/10/31 11:12:49
2440     [ssh-keygen.1 ssh-keygen.c]
2441     generate a protocol 2 RSA key by default
2442   - djm@cvs.openbsd.org 2005/10/31 11:48:29
2443     [serverloop.c]
2444     make sure we clean up wtmp, etc. file when we receive a SIGTERM,
2445     SIGINT or SIGQUIT when running without privilege separation (the
2446     normal privsep case is already OK). Patch mainly by dtucker@ and
2447     senthilkumar_sen AT hotpop.com; ok dtucker@
2448   - jmc@cvs.openbsd.org 2005/10/31 19:55:25
2449     [ssh-keygen.1]
2450     grammar;
2451   - dtucker@cvs.openbsd.org 2005/11/03 13:38:29
2452     [canohost.c]
2453     Cache reverse lookups with and without DNS separately; ok markus@
2454   - djm@cvs.openbsd.org 2005/11/04 05:15:59
2455     [kex.c kex.h kexdh.c kexdhc.c kexdhs.c kexgex.c kexgexc.c kexgexs.c]
2456     remove hardcoded hash lengths in key exchange code, allowing
2457     implementation of KEX methods with different hashes (e.g. SHA-256);
2458     ok markus@ dtucker@ stevesk@
2459   - djm@cvs.openbsd.org 2005/11/05 05:01:15
2460     [bufaux.c]
2461     Fix leaks in error paths, bz #1109 and #1110 reported by kremenek AT
2462     cs.stanford.edu; ok dtucker@
2463 - (dtucker) [README.platform] Add PAM section.
2464 - (djm) [openbsd-compat/getrrsetbyname.c] Sync to latest OpenBSD version,
2465   resolving memory leak bz#1111 reported by kremenek AT cs.stanford.edu;
2466   ok dtucker@
2467
246820051102
2469 - (dtucker) [openbsd-compat/bsd-misc.c] Bug #1108: fix broken strdup().
2470   Reported by olavi at ipunplugged.com and antoine.brodin at laposte.net
2471   via FreeBSD.
2472
247320051030
2474 - (djm) [contrib/suse/openssh.spec contrib/suse/rc.
2475   sshd contrib/suse/sysconfig.ssh] Bug #1106: Updated SuSE spec and init
2476   files from imorgan AT nas.nasa.gov
2477 - (dtucker) [session.c] Bug #1045do not check /etc/nologin when PAM is
2478   enabled, instead allow PAM to handle it.  Note that on platforms using PAM,
2479   the pam_nologin module should be added to sshd's session stack in order to
2480   maintain exising behaviour.  Based on patch and discussion from t8m at
2481   centrum.cz, ok djm@
2482
248320051025
2484 - (dtucker) [configure.ac] Relocate LLONG_MAX calculation to after the
2485   sizeof(long long) checks, to make fixing bug #1104 easier (no changes
2486   yet).
2487 - (dtucker) [configure.ac] Bug #1104: Tru64's printf family doesn't
2488   understand "%lld", even though the compiler has "long long", so handle
2489   it as a special case.  Patch tested by mcaskill.scott at epa.gov.
2490 - (dtucker) [contrib/cygwin/ssh-user-config] Remove duplicate yes/no
2491   prompt.  Patch from vinschen at redhat.com.
2492
249320051017
2494 - (dtucker) [configure.ac] Bug #1097: Fix configure for cross-compiling.
2495   /etc/default/login report and testing from aabaker at iee.org, corrections
2496   from tim@.
2497
249820051009
2499 - (dtucker) [configure.ac defines.h openbsd-compat/vis.{c,h}] Sync current
2500   versions from OpenBSD.  ok djm@
2501
250220051008
2503 - (dtucker) [configure.ac] Bug #1098: define $MAIL for HP-UX; report from
2504   brian.smith at agilent com.
2505 - (djm) [configure.ac] missing 'test' call for -with-Werror test
2506
250720051005
2508 - (dtucker) [configure.ac sshd.8] Enable locked account check (a prepended
2509   "*LOCKED*" string) for FreeBSD.  Patch jeremie at le-hen.org and
2510   senthilkumar_sen at hotpop.com.
2511
251220051003
2513 - (dtucker) OpenBSD CVS Sync
2514   - markus@cvs.openbsd.org 2005/09/07 08:53:53
2515     [channels.c]
2516     enforce chanid != NULL; ok djm
2517   - markus@cvs.openbsd.org 2005/09/09 19:18:05
2518     [clientloop.c]
2519     typo; from mark at mcs.vuw.ac.nz, bug #1082
2520   - djm@cvs.openbsd.org 2005/09/13 23:40:07
2521     [sshd.c ssh.c misc.h sftp.c ssh-keygen.c ssh-keysign.c sftp-server.c
2522     scp.c misc.c ssh-keyscan.c ssh-add.c ssh-agent.c]
2523     ensure that stdio fds are attached; ok deraadt@
2524   - djm@cvs.openbsd.org 2005/09/19 11:37:34
2525     [ssh_config.5 ssh.1]
2526     mention ability to specify bind_address for DynamicForward and -D options;
2527     bz#1077 spotted by Haruyama Seigo
2528   - djm@cvs.openbsd.org 2005/09/19 11:47:09
2529     [sshd.c]
2530     stop connection abort on rekey with delayed compression enabled when
2531     post-auth privsep is disabled (e.g. when root is logged in); ok dtucker@
2532   - djm@cvs.openbsd.org 2005/09/19 11:48:10
2533     [gss-serv.c]
2534     typo
2535   - jmc@cvs.openbsd.org 2005/09/19 15:38:27
2536     [ssh.1]
2537     some more .Bk/.Ek to avoid ugly line split;
2538   - jmc@cvs.openbsd.org 2005/09/19 15:42:44
2539     [ssh.c]
2540     update -D usage here too;
2541   - djm@cvs.openbsd.org 2005/09/19 23:31:31
2542     [ssh.1]
2543     spelling nit from stevesk@
2544   - djm@cvs.openbsd.org 2005/09/21 23:36:54
2545     [sshd_config.5]
2546     aquire -> acquire, from stevesk@
2547   - djm@cvs.openbsd.org 2005/09/21 23:37:11
2548     [sshd.c]
2549     change label at markus@'s request
2550   - jaredy@cvs.openbsd.org 2005/09/30 20:34:26
2551     [ssh-keyscan.1]
2552     deploy .An -nosplit; ok jmc
2553   - dtucker@cvs.openbsd.org 2005/10/03 07:44:42
2554     [canohost.c]
2555     Relocate check_ip_options call to prevent logging of garbage for
2556     connections with IP options set.  bz#1092 from David Leonard,
2557     "looks good" deraadt@
2558 - (dtucker) [regress/README.regress] Bug #989: Document limitation that scp
2559   is required in the system path for the multiplex test to work.
2560
256120050930
2562 - (dtucker) [openbsd-compat/openbsd-compat.h] Bug #1096: Add prototype
2563   for strtoll.  Patch from o.flebbe at science-computing.de.
2564 - (dtucker) [monitor.c] Bug #1087: Send loginmsg to preauth privsep
2565   child during PAM account check without clearing it.  This restores the
2566   post-login warnings such as LDAP password expiry.  Patch from Tomas Mraz
2567   with help from several others.
2568
256920050929
2570 - (dtucker) [monitor_wrap.c] Remove duplicate definition of loginmsg
2571   introduced during sync.
2572
257320050928
2574 - (dtucker) [entropy.c] Use u_char for receiving RNG seed for consistency.
2575 - (dtucker) [auth-pam.c] Bug #1028: send final non-query messages from
2576   PAM via keyboard-interactive.  Patch tested by the folks at Vintela.
2577
257820050927
2579 - (dtucker) [entropy.c] Remove unnecessary tests for getuid and geteuid
2580   calls, since they can't possibly fail.  ok djm@
2581 - (dtucker) [entropy.c entropy.h sshd.c] Pass RNG seed to the reexec'ed
2582   process when sshd relies on ssh-random-helper.  Should result in faster
2583   logins on systems without a real random device or prngd.  ok djm@
2584
258520050924
2586 - (dtucker) [auth2.c] Move start_pam() calls out of if-else block to remove
2587   duplicate call.  ok djm@
2588
258920050922
2590 - (dtucker) [configure.ac] Use -R linker flag for libedit too; patch from
2591   skeleten at shillest.net.
2592 - (dtucker) [configure.ac] Fix help for --with-opensc; patch from skeleten at
2593   shillest.net.
2594
259520050919
2596 - (tim) [aclocal.m4 configure.ac] Delete acconfig.h and add templates to
2597   AC_DEFINE and AC_DEFINE_UNQUOTED to quiet autoconf 2.59 warning messages.
2598   ok dtucker@
2599
260020050912
2601 - (tim) [configure.ac] Bug 1078. Fix --without-kerberos5. Reported by
2602   Mike Frysinger.
2603
260420050908
2605 - (tim) [defines.h openbsd-compat/port-uw.c] Add long password support to
2606   OpenServer 6 and add osr5bigcrypt support so when someone migrates
2607   passwords between UnixWare and OpenServer they will still work. OK dtucker@
2608
2609$Id: ChangeLog,v 1.4588.2.1 2006/11/07 13:02:59 dtucker Exp $
2610