New upstream release (6.9p1).

1 files changed, 1532 insertions, 1181 deletions

diff --git a/ChangeLog b/ChangeLog
index 092cc48ef..c63681f16 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,1535 @@
+commit 7de4b03a6e4071d454b72927ffaf52949fa34545
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Wed Jul 1 02:32:17 2015 +0000
+
+    upstream commit
+    
+    twiddle; (this commit marks the openssh-6.9 release)
+    
+    Upstream-ID: 78500582819f61dd8adee36ec5cc9b9ac9351234
+
+commit 1bf477d3cdf1a864646d59820878783d42357a1d
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Wed Jul 1 02:26:31 2015 +0000
+
+    upstream commit
+    
+    better refuse ForwardX11Trusted=no connections attempted
+     after ForwardX11Timeout expires; reported by Jann Horn
+    
+    Upstream-ID: bf0fddadc1b46a0334e26c080038313b4b6dea21
+
+commit 47aa7a0f8551b471fcae0447c1d78464f6dba869
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Wed Jul 1 01:56:13 2015 +0000
+
+    upstream commit
+    
+    put back default PermitRootLogin=no
+    
+    Upstream-ID: 7bdedd5cead99c57ed5571f3b6b7840922d5f728
+
+commit 984b064fe2a23733733262f88d2e1b2a1a501662
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Wed Jul 1 01:55:13 2015 +0000
+
+    upstream commit
+    
+    openssh-6.9
+    
+    Upstream-ID: 6cfe8e1904812531080e6ab6e752d7001b5b2d45
+
+commit d921082ed670f516652eeba50705e1e9f6325346
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Wed Jul 1 01:55:00 2015 +0000
+
+    upstream commit
+    
+    reset default PermitRootLogin to 'yes' (momentarily, for
+     release)
+    
+    Upstream-ID: cad8513527066e65dd7a1c16363d6903e8cefa24
+
+commit 66295e0e1ba860e527f191b6325d2d77dec4dbce
+Author: Damien Miller <djm@mindrot.org>
+Date:   Wed Jul 1 11:49:12 2015 +1000
+
+    crank version numbers for release
+
+commit 37035c07d4f26bb1fbe000d2acf78efdb008681d
+Author: Damien Miller <djm@mindrot.org>
+Date:   Wed Jul 1 10:49:37 2015 +1000
+
+    s/--with-ssh1/--without-ssh1/
+
+commit 629df770dbadc2accfbe1c81b3f31f876d0acd84
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Tue Jun 30 05:25:07 2015 +0000
+
+    upstream commit
+    
+    fatal() when a remote window update causes the window
+     value to overflow. Reported by Georg Wicherski, ok markus@
+    
+    Upstream-ID: ead397a9aceb3bf74ebfa5fcaf259d72e569f351
+
+commit f715afebe735d61df3fd30ad72d9ac1c8bd3b5f2
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Tue Jun 30 05:23:25 2015 +0000
+
+    upstream commit
+    
+    Fix math error in remote window calculations that causes
+     eventual stalls for datagram channels. Reported by Georg Wicherski, ok
+     markus@
+    
+    Upstream-ID: be54059d11bf64e0d85061f7257f53067842e2ab
+
+commit 52fb6b9b034fcfd24bf88cc7be313e9c31de9889
+Author: Damien Miller <djm@mindrot.org>
+Date:   Tue Jun 30 16:05:40 2015 +1000
+
+    skip IPv6-related portions on hosts without IPv6
+    
+    with Tim Rice
+
+commit 512caddf590857af6aa12218461b5c0441028cf5
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Mon Jun 29 22:35:12 2015 +0000
+
+    upstream commit
+    
+    add getpid to sandbox, reachable by grace_alarm_handler
+    
+    reported by Jakub Jelen; bz#2419
+    
+    Upstream-ID: d0da1117c16d4c223954995d35b0f47c8f684cd8
+
+commit 78c2a4f883ea9aba866358e2acd9793a7f42ca93
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Fri Jun 26 05:13:20 2015 +0000
+
+    upstream commit
+    
+    Fix \-escaping bug that caused forward path parsing to skip
+     two characters and skip past the end of the string.
+    
+    Based on patch by Salvador Fandino; ok dtucker@
+    
+    Upstream-ID: 7b879dc446335677cbe4cb549495636a0535f3bd
+
+commit bc20205c91c9920361d12b15d253d4997dba494a
+Author: Damien Miller <djm@mindrot.org>
+Date:   Thu Jun 25 09:51:39 2015 +1000
+
+    add missing pselect6
+    
+    patch from Jakub Jelen
+
+commit 9d27fb73b4a4e5e99cb880af790d5b1ce44f720a
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Wed Jun 24 23:47:23 2015 +0000
+
+    upstream commit
+    
+    correct test to sshkey_sign(); spotted by Albert S.
+    
+    Upstream-ID: 5f7347f40f0ca6abdaca2edb3bd62f4776518933
+
+commit 7ed01a96a1911d8b4a9ef4f3d064e1923bfad7e3
+Author: dtucker@openbsd.org <dtucker@openbsd.org>
+Date:   Wed Jun 24 01:49:19 2015 +0000
+
+    upstream commit
+    
+    Revert previous commit.  We still want to call setgroups
+     in the case where there are zero groups to remove any that we might otherwise
+     inherit (as pointed out by grawity at gmail.com) and since the 2nd argument
+     to setgroups is always a static global it's always valid to dereference in
+     this case.  ok deraadt@ djm@
+    
+    Upstream-ID: 895b5ac560a10befc6b82afa778641315725fd01
+
+commit 882f8bf94f79528caa65b0ba71c185d705bb7195
+Author: dtucker@openbsd.org <dtucker@openbsd.org>
+Date:   Wed Jun 24 01:49:19 2015 +0000
+
+    upstream commit
+    
+    Revert previous commit.  We still want to call setgroups in
+     the case where there are zero groups to remove any that we might otherwise
+     inherit (as pointed out by grawity at gmail.com) and since the 2nd argument
+     to setgroups is always a static global it's always valid to dereference in
+     this case.  ok deraadt@ djm@
+    
+    Upstream-ID: 895b5ac560a10befc6b82afa778641315725fd01
+
+commit 9488538a726951e82b3a4374f3c558d72c80a89b
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Mon Jun 22 23:42:16 2015 +0000
+
+    upstream commit
+    
+    Don't count successful partial authentication as failures
+     in monitor; this may have caused the monitor to refuse multiple
+     authentications that would otherwise have successfully completed; ok markus@
+    
+    Upstream-ID: eb74b8e506714d0f649bd5c300f762a527af04a3
+
+commit 63b78d003bd8ca111a736e6cea6333da50f5f09b
+Author: dtucker@openbsd.org <dtucker@openbsd.org>
+Date:   Mon Jun 22 12:29:57 2015 +0000
+
+    upstream commit
+    
+    Don't call setgroups if we have zero groups; there's no
+     guarantee that it won't try to deref the pointer.  Based on a patch from mail
+     at quitesimple.org, ok djm deraadt
+    
+    Upstream-ID: 2fff85e11d7a9a387ef7fddf41fbfaf566708ab1
+
+commit 5c15e22c691c79a47747bcf5490126656f97cecd
+Author: Damien Miller <djm@mindrot.org>
+Date:   Thu Jun 18 15:07:56 2015 +1000
+
+    fix syntax error
+
+commit 596dbca82f3f567fb3d2d69af4b4e1d3ba1e6403
+Author: jsing@openbsd.org <jsing@openbsd.org>
+Date:   Mon Jun 15 18:44:22 2015 +0000
+
+    upstream commit
+    
+    If AuthorizedPrincipalsCommand is specified, however
+     AuthorizedPrincipalsFile is not (or is set to "none"), authentication will
+     potentially fail due to key_cert_check_authority() failing to locate a
+     principal that matches the username, even though an authorized principal has
+     already been matched in the output of the subprocess. Fix this by using the
+     same logic to determine if pw->pw_name should be passed, as is used to
+     determine if a authorized principal must be matched earlier on.
+    
+    ok djm@
+    
+    Upstream-ID: 43b42302ec846b0ea68aceb40677245391b9409d
+
+commit aff3e94c0d75d0d0fa84ea392b50ab04f8c57905
+Author: jsing@openbsd.org <jsing@openbsd.org>
+Date:   Mon Jun 15 18:42:19 2015 +0000
+
+    upstream commit
+    
+    Make the arguments to match_principals_command() similar
+     to match_principals_file(), by changing the last argument a struct
+     sshkey_cert * and dereferencing key->cert in the caller.
+    
+    No functional change.
+    
+    ok djm@
+    
+    Upstream-ID: 533f99b844b21b47342b32b62e198dfffcf8651c
+
+commit 97e2e1596c202a4693468378b16b2353fd2d6c5e
+Author: Damien Miller <djm@mindrot.org>
+Date:   Wed Jun 17 14:36:54 2015 +1000
+
+    trivial optimisation for seccomp-bpf
+    
+    When doing arg inspection and the syscall doesn't match, skip
+    past the instruction that reloads the syscall into the accumulator,
+    since the accumulator hasn't been modified at this point.
+
+commit 99f33d7304893bd9fa04d227cb6e870171cded19
+Author: Damien Miller <djm@mindrot.org>
+Date:   Wed Jun 17 10:50:51 2015 +1000
+
+    aarch64 support for seccomp-bpf sandbox
+    
+    Also resort and tidy syscall list. Based on patches by Jakub Jelen
+    bz#2361; ok dtucker@
+
+commit 4ef702e1244633c1025ec7cfe044b9ab267097bf
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Mon Jun 15 01:32:50 2015 +0000
+
+    upstream commit
+    
+    return failure on RSA signature error; reported by Albert S
+    
+    Upstream-ID: e61bb93dbe0349625807b0810bc213a6822121fa
+
+commit a170f22baf18af0b1acf2788b8b715605f41a1f9
+Author: Tim Rice <tim@multitalents.net>
+Date:   Tue Jun 9 22:41:13 2015 -0700
+
+    Fix t12 rules for out of tree builds.
+
+commit ec04dc4a5515c913121bc04ed261857e68fa5c18
+Author: millert@openbsd.org <millert@openbsd.org>
+Date:   Fri Jun 5 15:13:13 2015 +0000
+
+    upstream commit
+    
+    For "ssh -L 12345:/tmp/sock" don't fail with "No forward host
+     name." (we have a path, not a host name).  Based on a diff from Jared
+     Yanovich. OK djm@
+    
+    Upstream-ID: 2846b0a8c7de037e33657f95afbd282837fc213f
+
+commit 732d61f417a6aea0aa5308b59cb0f563bcd6edd6
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Fri Jun 5 03:44:14 2015 +0000
+
+    upstream commit
+    
+    typo: accidental repetition; bz#2386
+    
+    Upstream-ID: 45e620d99f6bc301e5949d34a54027374991c88b
+
+commit adfb24c69d1b6f5e758db200866c711e25a2ba73
+Author: Darren Tucker <dtucker@zip.com.au>
+Date:   Fri Jun 5 14:51:40 2015 +1000
+
+    Add Linux powerpc64le and powerpcle entries.
+    
+    Stopgap to resolve bz#2409 because we are so close to release and will
+    update config.guess and friends shortly after the release.  ok djm@
+
+commit a1195a0fdc9eddddb04d3e9e44c4775431cb77da
+Merge: 6397eed d2480bc
+Author: Tim Rice <tim@multitalents.net>
+Date:   Wed Jun 3 21:43:13 2015 -0700
+
+    Merge branch 'master' of git.mindrot.org:/var/git/openssh
+
+commit 6397eedf953b2b973d2d7cbb504ab501a07f8ddc
+Author: Tim Rice <tim@multitalents.net>
+Date:   Wed Jun 3 21:41:11 2015 -0700
+
+    Remove unneeded backslashes. Patch from Ángel González
+
+commit d2480bcac1caf31b03068de877a47d6e1027bf6d
+Author: Darren Tucker <dtucker@zip.com.au>
+Date:   Thu Jun 4 14:10:55 2015 +1000
+
+    Remove redundant include of stdarg.h.  bz#2410
+
+commit 5e67859a623826ccdf2df284cbb37e2d8e2787eb
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Tue Jun 2 09:10:40 2015 +0000
+
+    upstream commit
+    
+    mention CheckHostIP adding addresses to known_hosts;
+     bz#1993; ok dtucker@
+    
+    Upstream-ID: fd44b68440fd0dc29abf9f2d3f703d74a2396cb7
+
+commit d7a58bbac6583e33fd5eca8e2c2cc70c57617818
+Author: Darren Tucker <dtucker@zip.com.au>
+Date:   Tue Jun 2 20:15:26 2015 +1000
+
+    Replace strcpy with strlcpy.
+    
+    ok djm, sanity check by Corinna Vinschen.
+
+commit 51a1c2115265c6e80ede8a5c9dccada9aeed7143
+Author: Damien Miller <djm@mindrot.org>
+Date:   Fri May 29 18:27:21 2015 +1000
+
+    skip, rather than fatal when run without SUDO set
+
+commit 599f01142a376645b15cbc9349d7e8975e1cf245
+Author: Damien Miller <djm@mindrot.org>
+Date:   Fri May 29 18:03:15 2015 +1000
+
+    fix merge botch that left ",," in KEX algs
+
+commit 0c2a81dfc21822f2423edd30751e5ec53467b347
+Author: Damien Miller <djm@mindrot.org>
+Date:   Fri May 29 17:08:28 2015 +1000
+
+    re-enable SSH protocol 1 at compile time
+
+commit db438f9285d64282d3ac9e8c0944f59f037c0151
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Fri May 29 03:05:13 2015 +0000
+
+    upstream commit
+    
+    make this work without SUDO set; ok dtucker@
+    
+    Upstream-Regress-ID: bca88217b70bce2fe52b23b8e06bdeb82d98c715
+
+commit 1d9a2e2849c9864fe75daabf433436341c968e14
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Thu May 28 07:37:31 2015 +0000
+
+    upstream commit
+    
+    wrap all moduli-related code in #ifdef WITH_OPENSSL.
+     based on patch from Reuben Hawkins; bz#2388 feedback and ok dtucker@
+    
+    Upstream-ID: d80cfc8be3e6ec65b3fac9e87c4466533b31b7cf
+
+commit 496aeb25bc2d6c434171292e4714771b594bd00e
+Author: dtucker@openbsd.org <dtucker@openbsd.org>
+Date:   Thu May 28 05:41:29 2015 +0000
+
+    upstream commit
+    
+    Increase the allowed length of the known host file name
+     in the log message to be consistent with other cases.  Part of bz#1993, ok
+     deraadt.
+    
+    Upstream-ID: a9e97567be49f25daf286721450968251ff78397
+
+commit dd2cfeb586c646ff8d70eb93567b2e559ace5b14
+Author: dtucker@openbsd.org <dtucker@openbsd.org>
+Date:   Thu May 28 05:09:45 2015 +0000
+
+    upstream commit
+    
+    Fix typo (keywork->keyword)
+    
+    Upstream-ID: 8aacd0f4089c0a244cf43417f4f9045dfaeab534
+
+commit 9cc6842493fbf23025ccc1edab064869640d3bec
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Thu May 28 04:50:53 2015 +0000
+
+    upstream commit
+    
+    add error message on ftruncate failure; bz#2176
+    
+    Upstream-ID: cbcc606e0b748520c74a210d8f3cc9718d3148cf
+
+commit d1958793a0072c22be26d136dbda5ae263e717a0
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Thu May 28 04:40:13 2015 +0000
+
+    upstream commit
+    
+    make ssh-keygen default to ed25519 keys when compiled
+     without OpenSSL; bz#2388, ok dtucker@
+    
+    Upstream-ID: 85a471fa6d3fa57a7b8e882d22cfbfc1d84cdc71
+
+commit 3ecde664c9fc5fb3667aedf9e6671462600f6496
+Author: dtucker@openbsd.org <dtucker@openbsd.org>
+Date:   Wed May 27 23:51:10 2015 +0000
+
+    upstream commit
+    
+    Reorder client proposal to prefer
+     diffie-hellman-group-exchange-sha1 over diffie-hellman-group14-sha1.  ok djm@
+    
+    Upstream-ID: 552c08d47347c3ee1a9a57d88441ab50abe17058
+
+commit 40f64292b907afd0a674fdbf3e4c2356d17a7d68
+Author: dtucker@openbsd.org <dtucker@openbsd.org>
+Date:   Wed May 27 23:39:18 2015 +0000
+
+    upstream commit
+    
+    Add a stronger (4k bit) fallback group that sshd can use
+     when the moduli file is missing or broken, sourced from RFC3526.  bz#2302, ok
+     markus@ (earlier version), djm@
+    
+    Upstream-ID: b635215746a25a829d117673d5e5a76d4baee7f4
+
+commit 5ab7d5fa03ad55bc438fab45dfb3aeb30a3c237a
+Author: Darren Tucker <dtucker@zip.com.au>
+Date:   Thu May 28 10:03:40 2015 +1000
+
+    New moduli file from OpenBSD, removing 1k groups.
+    
+    Remove 1k bit groups.  ok deraadt@, markus@
+
+commit a71ba58adf34e599f30cdda6e9b93ae6e3937eea
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Wed May 27 05:15:02 2015 +0000
+
+    upstream commit
+    
+    support PKCS#11 devices with external PIN entry devices
+     bz#2240, based on patch from Dirk-Willem van Gulik; feedback and ok dtucker@
+    
+    Upstream-ID: 504568992b55a8fc984375242b1bd505ced61b0d
+
+commit b282fec1aa05246ed3482270eb70fc3ec5f39a00
+Author: dtucker@openbsd.org <dtucker@openbsd.org>
+Date:   Tue May 26 23:23:40 2015 +0000
+
+    upstream commit
+    
+    Cap DH-GEX group size at 4kbits for Cisco implementations.
+     Some of them will choke when asked for preferred sizes >4k instead of
+     returning the 4k group that they do have.  bz#2209, ok djm@
+    
+    Upstream-ID: 54b863a19713446b7431f9d06ad0532b4fcfef8d
+
+commit 3e91b4e8b0dc2b4b7e7d42cf6e8994a32e4cb55e
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Sun May 24 23:39:16 2015 +0000
+
+    upstream commit
+    
+    add missing 'c' option to getopt(), case statement was
+     already there; from Felix Bolte
+    
+    Upstream-ID: 9b19b4e2e0b54d6fefa0dfac707c51cf4bae3081
+
+commit 64a89ec07660abba4d0da7c0095b7371c98bab62
+Author: jsg@openbsd.org <jsg@openbsd.org>
+Date:   Sat May 23 14:28:37 2015 +0000
+
+    upstream commit
+    
+    fix a memory leak in an error path ok markus@ dtucker@
+    
+    Upstream-ID: bc1da0f205494944918533d8780fde65dff6c598
+
+commit f948737449257d2cb83ffcfe7275eb79b677fd4a
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Fri May 22 05:28:45 2015 +0000
+
+    upstream commit
+    
+    mention ssh-keygen -E for comparing legacy MD5
+     fingerprints; bz#2332
+    
+    Upstream-ID: 079a3669549041dbf10dbc072d9563f0dc3b2859
+
+commit 0882332616e4f0272c31cc47bf2018f9cb258a4e
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Fri May 22 04:45:52 2015 +0000
+
+    upstream commit
+    
+    Reorder EscapeChar option parsing to avoid a single-byte
+     out- of-bounds read. bz#2396 from Jaak Ristioja; ok dtucker@
+    
+    Upstream-ID: 1dc6b5b63d1c8d9a88619da0b27ade461d79b060
+
+commit d7c31da4d42c115843edee2074d7d501f8804420
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Fri May 22 03:50:02 2015 +0000
+
+    upstream commit
+    
+    add knob to relax GSSAPI host credential check for
+     multihomed hosts bz#928, patch by Simon Wilkinson; ok dtucker
+     (kerberos/GSSAPI is not compiled by default on OpenBSD)
+    
+    Upstream-ID: 15ddf1c6f7fd9d98eea9962f480079ae3637285d
+
+commit aa72196a00be6e0b666215edcffbc10af234cb0e
+Author: Darren Tucker <dtucker@zip.com.au>
+Date:   Fri May 22 17:49:46 2015 +1000
+
+    Include signal.h for sig_atomic_t, used by kex.h.
+    
+    bz#2402, from tomas.kuthan at oracle com.
+
+commit 8b02481143d75e91c49d1bfae0876ac1fbf9511a
+Author: Darren Tucker <dtucker@zip.com.au>
+Date:   Fri May 22 12:47:24 2015 +1000
+
+    Import updated moduli file from OpenBSD.
+
+commit 4739e8d5e1c0be49624082bd9f6b077e9e758db9
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Thu May 21 12:01:19 2015 +0000
+
+    upstream commit
+    
+    Support "ssh-keygen -lF hostname" to find search known_hosts
+     and print key hashes. Already advertised by ssh-keygen(1), but not delivered
+     by code; ok dtucker@
+    
+    Upstream-ID: 459e0e2bf39825e41b0811c336db2d56a1c23387
+
+commit e97201feca10b5196da35819ae516d0b87cf3a50
+Author: Damien Miller <djm@mindrot.org>
+Date:   Thu May 21 17:55:15 2015 +1000
+
+    conditionalise util.h inclusion
+
+commit 13640798c7dd011ece0a7d02841fe48e94cfa0e0
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Thu May 21 06:44:25 2015 +0000
+
+    upstream commit
+    
+    regress test for AuthorizedPrincipalsCommand
+    
+    Upstream-Regress-ID: c658fbf1ab6b6011dc83b73402322e396f1e1219
+
+commit 84452c5d03c21f9bfb28c234e0dc1dc67dd817b1
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Thu May 21 06:40:02 2015 +0000
+
+    upstream commit
+    
+    regress test for AuthorizedKeysCommand arguments
+    
+    Upstream-Regress-ID: bbd65c13c6b3be9a442ec115800bff9625898f12
+
+commit bcc50d816187fa9a03907ac1f3a52f04a52e10d1
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Thu May 21 06:43:30 2015 +0000
+
+    upstream commit
+    
+    add AuthorizedPrincipalsCommand that allows getting
+     authorized_principals from a subprocess rather than a file, which is quite
+     useful in deployments with large userbases
+    
+    feedback and ok markus@
+    
+    Upstream-ID: aa1bdac7b16fc6d2fa3524ef08f04c7258d247f6
+
+commit 24232a3e5ab467678a86aa67968bbb915caffed4
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Thu May 21 06:38:35 2015 +0000
+
+    upstream commit
+    
+    support arguments to AuthorizedKeysCommand
+    
+    bz#2081 loosely based on patch by Sami Hartikainen
+    feedback and ok markus@
+    
+    Upstream-ID: b080387a14aa67dddd8ece67c00f268d626541f7
+
+commit d80fbe41a57c72420c87a628444da16d09d66ca7
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Thu May 21 04:55:51 2015 +0000
+
+    upstream commit
+    
+    refactor: split base64 encoding of pubkey into its own
+     sshkey_to_base64() function and out of sshkey_write(); ok markus@
+    
+    Upstream-ID: 54fc38f5832e9b91028900819bda46c3959a0c1a
+
+commit 7cc44ef74133a473734bbcbd3484f24d6a7328c5
+Author: deraadt@openbsd.org <deraadt@openbsd.org>
+Date:   Mon May 18 15:06:05 2015 +0000
+
+    upstream commit
+    
+    getentropy() and sendsyslog() have been around long
+     enough. openssh-portable may want the #ifdef's but not base. discussed with
+     djm few weeks back
+    
+    Upstream-ID: 0506a4334de108e3fb6c66f8d6e0f9c112866926
+
+commit 9173d0fbe44de7ebcad8a15618e13a8b8d78902e
+Author: dtucker@openbsd.org <dtucker@openbsd.org>
+Date:   Fri May 15 05:44:21 2015 +0000
+
+    upstream commit
+    
+    Use a salted hash of the lock passphrase instead of plain
+     text and do constant-time comparisons of it. Should prevent leaking any
+     information about it via timing, pointed out by Ryan Castellucci.  Add a 0.1s
+     incrementing delay for each failed unlock attempt up to 10s.  ok markus@
+     (earlier version), djm@
+    
+    Upstream-ID: c599fcc325aa1cc65496b25220b622d22208c85f
+
+commit d028d5d3a697c71b21e4066d8672cacab3caa0a8
+Author: Damien Miller <djm@mindrot.org>
+Date:   Tue May 5 19:10:58 2015 +1000
+
+    upstream commit
+    
+       - tedu@cvs.openbsd.org 2015/01/12 03:20:04
+         [bcrypt_pbkdf.c]
+         rename blocks to words. bcrypt "blocks" are unrelated to blowfish blocks,
+         nor are they the same size.
+
+commit f6391d4e59b058984163ab28f4e317e7a72478f1
+Author: Damien Miller <djm@mindrot.org>
+Date:   Tue May 5 19:10:23 2015 +1000
+
+    upstream commit
+    
+       - deraadt@cvs.openbsd.org 2015/01/08 00:30:07
+         [bcrypt_pbkdf.c]
+         declare a local version of MIN(), call it MINIMUM()
+
+commit 8ac6b13cc9113eb47cd9e86c97d7b26b4b71b77f
+Author: Damien Miller <djm@mindrot.org>
+Date:   Tue May 5 19:09:46 2015 +1000
+
+    upstream commit
+    
+       - djm@cvs.openbsd.org 2014/12/30 01:41:43
+         [bcrypt_pbkdf.c]
+         typo in comment: ouput => output
+
+commit 1f792489d5cf86a4f4e3003e6e9177654033f0f2
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Mon May 4 06:10:48 2015 +0000
+
+    upstream commit
+    
+    Remove pattern length argument from match_pattern_list(), we
+     only ever use it for strlen(pattern).
+    
+    Prompted by hanno AT hboeck.de pointing an out-of-bound read
+    error caused by an incorrect pattern length found using AFL
+    and his own tools.
+    
+    ok markus@
+
+commit 639d6bc57b1942393ed12fb48f00bc05d4e093e4
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Fri May 1 07:10:01 2015 +0000
+
+    upstream commit
+    
+    refactor ssh_dispatch_run_fatal() to use sshpkt_fatal()
+     to better report error conditions. Teach sshpkt_fatal() about ECONNRESET.
+    
+    Improves error messages on TCP connection resets. bz#2257
+    
+    ok dtucker@
+
+commit 9559d7de34c572d4d3fd990ca211f8ec99f62c4d
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Fri May 1 07:08:08 2015 +0000
+
+    upstream commit
+    
+    a couple of parse targets were missing activep checks,
+     causing them to be misapplied in match context; bz#2272 diagnosis and
+     original patch from Sami Hartikainen ok dtucker@
+
+commit 7e8528cad04b2775c3b7db08abf8fb42e47e6b2a
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Fri May 1 04:17:51 2015 +0000
+
+    upstream commit
+    
+    make handling of AuthorizedPrincipalsFile=none more
+     consistent with other =none options; bz#2288 from Jakub Jelen; ok dtucker@
+
+commit ca430d4d9cc0f62eca3b1fb1e2928395b7ce80f7
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Fri May 1 04:03:20 2015 +0000
+
+    upstream commit
+    
+    remove failed remote forwards established by muliplexing
+     from the list of active forwards; bz#2363, patch mostly by Yoann Ricordel; ok
+     dtucker@
+
+commit 8312cfb8ad88657517b3e23ac8c56c8e38eb9792
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Fri May 1 04:01:58 2015 +0000
+
+    upstream commit
+    
+    reduce stderr spam when using ssh -S /path/mux -O forward
+     -R 0:... ok dtucker@
+
+commit 179be0f5e62f1f492462571944e45a3da660d82b
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Fri May 1 03:23:51 2015 +0000
+
+    upstream commit
+    
+    prevent authorized_keys options picked up on public key
+     tests without a corresponding private key authentication being applied to
+     other authentication methods. Reported by halex@, ok markus@
+
+commit a42d67be65b719a430b7fcaba2a4e4118382723a
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Fri May 1 03:20:54 2015 +0000
+
+    upstream commit
+    
+    Don't make parsing of authorized_keys' environment=
+     option conditional on PermitUserEnv - always parse it, but only use the
+     result if the option is enabled. This prevents the syntax of authorized_keys
+     changing depending on which sshd_config options were enabled.
+    
+    bz#2329; based on patch from coladict AT gmail.com, ok dtucker@
+
+commit e661a86353e11592c7ed6a847e19a83609f49e77
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Mon May 4 06:10:48 2015 +0000
+
+    upstream commit
+    
+    Remove pattern length argument from match_pattern_list(), we
+     only ever use it for strlen(pattern).
+    
+    Prompted by hanno AT hboeck.de pointing an out-of-bound read
+    error caused by an incorrect pattern length found using AFL
+    and his own tools.
+    
+    ok markus@
+
+commit 0ef1de742be2ee4b10381193fe90730925b7f027
+Author: dtucker@openbsd.org <dtucker@openbsd.org>
+Date:   Thu Apr 23 05:01:19 2015 +0000
+
+    upstream commit
+    
+    Add a simple regression test for sshd's configuration
+     parser.  Right now, all it does is run the output of sshd -T back through
+     itself and ensure the output is valid and invariant.
+
+commit 368f83c793275faa2c52f60eaa9bdac155c4254b
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Wed Apr 22 01:38:36 2015 +0000
+
+    upstream commit
+    
+    use correct key for nested certificate test
+
+commit 8d4d1bfddbbd7d21f545dc6997081d1ea1fbc99a
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Fri May 1 07:11:47 2015 +0000
+
+    upstream commit
+    
+    mention that the user's shell from /etc/passwd is used
+     for commands too; bz#1459 ok dtucker@
+
+commit 5ab283d0016bbc9d4d71e8e5284d011bc5a930cf
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Fri May 8 07:29:00 2015 +0000
+
+    upstream commit
+    
+    whitespace
+    
+    Upstream-Regress-ID: 6b708a3e709d5b7fd37890f874bafdff1f597519
+
+commit 8377d5008ad260048192e1e56ad7d15a56d103dd
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Fri May 8 07:26:13 2015 +0000
+
+    upstream commit
+    
+    whitespace at EOL
+    
+    Upstream-Regress-ID: 9c48911643d5b05173b36a012041bed4080b8554
+
+commit c28a3436fa8737709ea88e4437f8f23a6ab50359
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Fri May 8 06:45:13 2015 +0000
+
+    upstream commit
+    
+    moar whitespace at eol
+    
+    Upstream-ID: 64eaf872a3ba52ed41e494287e80d40aaba4b515
+
+commit 2b64c490468fd4ca35ac8d5cc31c0520dc1508bb
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Fri May 8 06:41:56 2015 +0000
+
+    upstream commit
+    
+    whitespace at EOL
+    
+    Upstream-ID: 57bcf67d666c6fc1ad798aee448fdc3f70f7ec2c
+
+commit 4e636cf201ce6e7e3b9088568218f9d4e2c51712
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Fri May 8 03:56:51 2015 +0000
+
+    upstream commit
+    
+    whitespace at EOL
+
+commit 38b8272f823dc1dd4e29dbcee83943ed48bb12fa
+Author: dtucker@openbsd.org <dtucker@openbsd.org>
+Date:   Mon May 4 01:47:53 2015 +0000
+
+    upstream commit
+    
+    Use diff w/out -u for better portability
+
+commit 297060f42d5189a4065ea1b6f0afdf6371fb0507
+Author: dtucker@openbsd.org <dtucker@openbsd.org>
+Date:   Fri May 8 03:25:07 2015 +0000
+
+    upstream commit
+    
+    Use xcalloc for permitted_adm_opens instead of xmalloc to
+     ensure it's zeroed. Fixes post-auth crash with permitopen=none.  bz#2355, ok
+     djm@
+
+commit 63ebf019be863b2d90492a85e248cf55a6e87403
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Fri May 8 03:17:49 2015 +0000
+
+    upstream commit
+    
+    don't choke on new-format private keys encrypted with an
+     AEAD cipher; bz#2366, patch from Ron Frederick; ok markus@
+
+commit f8484dac678ab3098ae522a5f03bb2530f822987
+Author: dtucker@openbsd.org <dtucker@openbsd.org>
+Date:   Wed May 6 05:45:17 2015 +0000
+
+    upstream commit
+    
+    Clarify pseudo-terminal request behaviour and use
+     "pseudo-terminal" consistently.  bz#1716, ok jmc@ "I like it" deraadt@.
+
+commit ea139507bef8bad26e86ed99a42c7233ad115c38
+Author: dtucker@openbsd.org <dtucker@openbsd.org>
+Date:   Wed May 6 04:07:18 2015 +0000
+
+    upstream commit
+    
+    Blacklist DH-GEX for specific PuTTY versions known to
+     send non-RFC4419 DH-GEX messages rather than all versions of PuTTY.
+     According to Simon Tatham, 0.65 and newer versions will send RFC4419 DH-GEX
+     messages.  ok djm@
+
+commit b58234f00ee3872eb84f6e9e572a9a34e902e36e
+Author: dtucker@openbsd.org <dtucker@openbsd.org>
+Date:   Tue May 5 10:17:49 2015 +0000
+
+    upstream commit
+    
+    WinSCP doesn't implement RFC4419 DH-GEX so flag it so we
+     don't offer that KEX method.  ok markus@
+
+commit d5b1507a207253b39e810e91e68f9598691b7a29
+Author: jsg@openbsd.org <jsg@openbsd.org>
+Date:   Tue May 5 02:48:17 2015 +0000
+
+    upstream commit
+    
+    use the sizeof the struct not the sizeof a pointer to the
+     struct in ssh_digest_start()
+    
+    This file is only used if ssh is built with OPENSSL=no
+    
+    ok markus@
+
+commit a647b9b8e616c231594b2710c925d31b1b8afea3
+Author: Darren Tucker <dtucker@zip.com.au>
+Date:   Fri May 8 11:07:27 2015 +1000
+
+    Put brackets around mblen() compat constant.
+    
+    This might help with the reported problem cross compiling for Android
+    ("error: expected identifier or '(' before numeric constant") but
+    shouldn't hurt in any case.
+
+commit d1680d36e17244d9af3843aeb5025cb8e40d6c07
+Author: Darren Tucker <dtucker@zip.com.au>
+Date:   Thu Apr 30 09:18:11 2015 +1000
+
+    xrealloc -> xreallocarray in portable code too.
+
+commit 531a57a3893f9fcd4aaaba8c312b612bbbcc021e
+Author: dtucker@openbsd.org <dtucker@openbsd.org>
+Date:   Wed Apr 29 03:48:56 2015 +0000
+
+    upstream commit
+    
+    Allow ListenAddress, Port and AddressFamily in any
+     order.  bz#68, ok djm@, jmc@ (for the man page bit).
+
+commit c1d5bcf1aaf1209af02f79e48ba1cbc76a87b56f
+Author: jmc@openbsd.org <jmc@openbsd.org>
+Date:   Tue Apr 28 13:47:38 2015 +0000
+
+    upstream commit
+    
+    enviroment -> environment: apologies to darren for not
+     spotting that first time round...
+
+commit 43beea053db191cac47c2cd8d3dc1930158aff1a
+Author: dtucker@openbsd.org <dtucker@openbsd.org>
+Date:   Tue Apr 28 10:25:15 2015 +0000
+
+    upstream commit
+    
+    Fix typo in previous
+
+commit 85b96ef41374f3ddc9139581f87da09b2cd9199e
+Author: dtucker@openbsd.org <dtucker@openbsd.org>
+Date:   Tue Apr 28 10:17:58 2015 +0000
+
+    upstream commit
+    
+    Document that the TERM environment variable is not
+     subject to SendEnv and AcceptEnv.  bz#2386, based loosely on a patch from
+     jjelen at redhat, help and ok jmc@
+
+commit 88a7c598a94ff53f76df228eeaae238d2d467565
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Mon Apr 27 21:42:48 2015 +0000
+
+    upstream commit
+    
+    Make sshd default to PermitRootLogin=no; ok deraadt@
+     rpe@
+
+commit 734226b4480a6c736096c729fcf6f391400599c7
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Mon Apr 27 01:52:30 2015 +0000
+
+    upstream commit
+    
+    fix compilation with OPENSSL=no; ok dtucker@
+
+commit a4b9d2ce1eb7703eaf0809b0c8a82ded8aa4f1c6
+Author: dtucker@openbsd.org <dtucker@openbsd.org>
+Date:   Mon Apr 27 00:37:53 2015 +0000
+
+    upstream commit
+    
+    Include stdio.h for FILE (used in sshkey.h) so it
+     compiles with OPENSSL=no.
+
+commit dbcc652f4ca11fe04e5930c7ef18a219318c6cda
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Mon Apr 27 00:21:21 2015 +0000
+
+    upstream commit
+    
+    allow "sshd -f none" to skip reading the config file,
+     much like "ssh -F none" does. ok dtucker
+
+commit b7ca276fca316c952f0b90f5adb1448c8481eedc
+Author: jmc@openbsd.org <jmc@openbsd.org>
+Date:   Fri Apr 24 06:26:49 2015 +0000
+
+    upstream commit
+    
+    combine -Dd onto one line and update usage();
+
+commit 2ea974630d7017e4c7666d14d9dc939707613e96
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Fri Apr 24 05:26:44 2015 +0000
+
+    upstream commit
+    
+    add ssh-agent -D to leave ssh-agent in foreground
+     without enabling debug mode; bz#2381 ok dtucker@
+
+commit 8ac2ffd7aa06042f6b924c87139f2fea5c5682f7
+Author: deraadt@openbsd.org <deraadt@openbsd.org>
+Date:   Fri Apr 24 01:36:24 2015 +0000
+
+    upstream commit
+    
+    2*len -> use xreallocarray() ok djm
+
+commit 657a5fbc0d0aff309079ff8fb386f17e964963c2
+Author: deraadt@openbsd.org <deraadt@openbsd.org>
+Date:   Fri Apr 24 01:36:00 2015 +0000
+
+    upstream commit
+    
+    rename xrealloc() to xreallocarray() since it follows
+     that form. ok djm
+
+commit 1108ae242fdd2c304307b68ddf46aebe43ebffaa
+Author: dtucker@openbsd.org <dtucker@openbsd.org>
+Date:   Thu Apr 23 04:59:10 2015 +0000
+
+    upstream commit
+    
+    Two small fixes for sshd -T: ListenAddress'es are added
+     to a list head so reverse the order when printing them to ensure the
+     behaviour remains the same, and print StreamLocalBindMask as octal with
+     leading zero.  ok deraadt@
+
+commit bd902b8473e1168f19378d5d0ae68d0c203525df
+Author: dtucker@openbsd.org <dtucker@openbsd.org>
+Date:   Thu Apr 23 04:53:53 2015 +0000
+
+    upstream commit
+    
+    Check for and reject missing arguments for
+     VersionAddendum and ForceCommand. bz#2281, patch from plautrba at redhat com,
+     ok djm@
+
+commit ca42c1758575e592239de1d5755140e054b91a0d
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Wed Apr 22 01:24:01 2015 +0000
+
+    upstream commit
+    
+    unknown certificate extensions are non-fatal, so don't
+     fatal when they are encountered; bz#2387 reported by Bob Van Zant; ok
+     dtucker@
+
+commit 39bfbf7caad231cc4bda6909fb1af0705bca04d8
+Author: jsg@openbsd.org <jsg@openbsd.org>
+Date:   Tue Apr 21 07:01:00 2015 +0000
+
+    upstream commit
+    
+    Add back a backslash removed in rev 1.42 so
+     KEX_SERVER_ENCRYPT will include aes again.
+    
+    ok deraadt@
+
+commit 6b0d576bb87eca3efd2b309fcfe4edfefc289f9c
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Fri Apr 17 13:32:09 2015 +0000
+
+    upstream commit
+    
+    s/recommended/required/ that private keys be og-r this
+     wording change was made a while ago but got accidentally reverted
+
+commit 44a8e7ce6f3ab4c2eb1ae49115c210b98e53c4df
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Fri Apr 17 13:25:52 2015 +0000
+
+    upstream commit
+    
+    don't try to cleanup NULL KEX proposals in
+     kex_prop_free(); found by Jukka Taimisto and Markus Hietava
+
+commit 3038a191872d2882052306098c1810d14835e704
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Fri Apr 17 13:19:22 2015 +0000
+
+    upstream commit
+    
+    use error/logit/fatal instead of fprintf(stderr, ...)
+     and exit(0), fix a few errors that were being printed to stdout instead of
+     stderr and a few non-errors that were going to stderr instead of stdout
+     bz#2325; ok dtucker
+
+commit a58be33cb6cd24441fa7e634db0e5babdd56f07f
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Fri Apr 17 13:16:48 2015 +0000
+
+    upstream commit
+    
+    debug log missing DISPLAY environment when X11
+     forwarding requested; bz#1682 ok dtucker@
+
+commit 17d4d9d9fbc8fb80e322f94d95eecc604588a474
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Fri Apr 17 04:32:31 2015 +0000
+
+    upstream commit
+    
+    don't call record_login() in monitor when UseLogin is
+     enabled; bz#278 reported by drk AT sgi.com; ok dtucker
+
+commit 40132ff87b6cbc3dc05fb5df2e9d8e3afa06aafd
+Author: dtucker@openbsd.org <dtucker@openbsd.org>
+Date:   Fri Apr 17 04:12:35 2015 +0000
+
+    upstream commit
+    
+    Add some missing options to sshd -T and fix the output
+     of VersionAddendum HostCertificate.  bz#2346, patch from jjelen at redhat
+     com, ok djm.
+
+commit 6cc7cfa936afde2d829e56ee6528c7ea47a42441
+Author: dtucker@openbsd.org <dtucker@openbsd.org>
+Date:   Thu Apr 16 23:25:50 2015 +0000
+
+    upstream commit
+    
+    Document "none" for PidFile XAuthLocation
+     TrustedUserCAKeys and RevokedKeys. bz#2382, feedback from jmc@, ok djm@
+
+commit 15fdfc9b1c6808b26bc54d4d61a38b54541763ed
+Author: dtucker@openbsd.org <dtucker@openbsd.org>
+Date:   Wed Apr 15 23:23:25 2015 +0000
+
+    upstream commit
+    
+    Plug leak of address passed to logging.  bz#2373, patch
+     from jjelen at redhat, ok markus@
+
+commit bb2289e2a47d465eaaaeff3dee2a6b7777b4c291
+Author: dtucker@openbsd.org <dtucker@openbsd.org>
+Date:   Tue Apr 14 04:17:03 2015 +0000
+
+    upstream commit
+    
+    Output remote username in debug output since with Host
+     and Match it's not always obvious what it will be.  bz#2368, ok djm@
+
+commit 70860b6d07461906730632f9758ff1b7c98c695a
+Author: Darren Tucker <dtucker@zip.com.au>
+Date:   Fri Apr 17 10:56:13 2015 +1000
+
+    Format UsePAM setting when using sshd -T.
+    
+    Part of bz#2346, patch from jjelen at redhat com.
+
+commit ee15d9c9f0720f5a8b0b34e4b10ecf21f9824814
+Author: Darren Tucker <dtucker@zip.com.au>
+Date:   Fri Apr 17 10:40:23 2015 +1000
+
+    Wrap endian.h include inside ifdef (bz#2370).
+
+commit 408f4c2ad4a4c41baa7b9b2b7423d875abbfa70b
+Author: Darren Tucker <dtucker@zip.com.au>
+Date:   Fri Apr 17 09:39:58 2015 +1000
+
+    Look for '${host}-ar' before 'ar'.
+    
+    This changes configure.ac to look for '${host}-ar' as set by
+    AC_CANONICAL_HOST before looking for the unprefixed 'ar'.
+    Useful when cross-compiling when all your binutils are prefixed.
+    
+    Patch from moben at exherbo org via astrand at lysator liu se and
+    bz#2352.
+
+commit 673a1c16ad078d41558247ce739fe812c960acc8
+Author: Damien Miller <djm@google.com>
+Date:   Thu Apr 16 11:40:20 2015 +1000
+
+    remove dependency on arpa/telnet.h
+
+commit 202d443eeda1829d336595a3cfc07827e49f45ed
+Author: Darren Tucker <dtucker@zip.com.au>
+Date:   Wed Apr 15 15:59:49 2015 +1000
+
+    Remove duplicate include of pwd.h.  bz#2337, patch from Mordy Ovits.
+
+commit 597986493412c499f2bc2209420cb195f97b3668
+Author: Damien Miller <djm@google.com>
+Date:   Thu Apr 9 10:14:48 2015 +1000
+
+    platform's with openpty don't need pty_release
+
+commit 318be28cda1fd9108f2e6f2f86b0b7589ba2aed0
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Mon Apr 13 02:04:08 2015 +0000
+
+    upstream commit
+    
+    deprecate ancient, pre-RFC4419 and undocumented
+     SSH2_MSG_KEX_DH_GEX_REQUEST_OLD message; ok markus@ deraadt@ "seems
+     reasonable" dtucker@
+
+commit d8f391caef62378463a0e6b36f940170dadfe605
+Author: dtucker@openbsd.org <dtucker@openbsd.org>
+Date:   Fri Apr 10 05:16:50 2015 +0000
+
+    upstream commit
+    
+    Don't send hostkey advertisments
+     (hostkeys-00@openssh.com) to current versions of Tera Term as they can't
+     handle them.  Newer versions should be OK.  Patch from Bryan Drewery and
+     IWAMOTO Kouichi, ok djm@
+
+commit 2c2cfe1a1c97eb9a08cc9817fd0678209680c636
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Fri Apr 10 00:08:55 2015 +0000
+
+    upstream commit
+    
+    include port number if a non-default one has been
+     specified; based on patch from Michael Handler
+
+commit 4492a4f222da4cf1e8eab12689196322e27b08c4
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Tue Apr 7 23:00:42 2015 +0000
+
+    upstream commit
+    
+    treat Protocol=1,2|2,1 as Protocol=2 when compiled
+     without SSH1 support; ok dtucker@ millert@
+
+commit c265e2e6e932efc6d86f6cc885dea33637a67564
+Author: miod@openbsd.org <miod@openbsd.org>
+Date:   Sun Apr 5 15:43:43 2015 +0000
+
+    upstream commit
+    
+    Do not use int for sig_atomic_t; spotted by
+     christos@netbsd; ok markus@
+
+commit e7bf3a5eda6a1b02bef6096fed78527ee11e54cc
+Author: Darren Tucker <dtucker@zip.com.au>
+Date:   Tue Apr 7 10:48:04 2015 +1000
+
+    Use do{}while(0) for no-op functions.
+    
+    From FreeBSD.
+
+commit bb99844abae2b6447272f79e7fa84134802eb4df
+Author: Darren Tucker <dtucker@zip.com.au>
+Date:   Tue Apr 7 10:47:15 2015 +1000
+
+    Wrap blf.h include in ifdef.  From FreeBSD.
+
+commit d9b9b43656091cf0ad55c122f08fadb07dad0abd
+Author: Darren Tucker <dtucker@zip.com.au>
+Date:   Tue Apr 7 09:10:00 2015 +1000
+
+    Fix misspellings of regress CONFOPTS env variables.
+    
+    Patch from Bryan Drewery.
+
+commit 3f4ea3c9ab1d32d43c9222c4351f58ca11144156
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Fri Apr 3 22:17:27 2015 +0000
+
+    upstream commit
+    
+    correct return value in pubkey parsing, spotted by Ben Hawkes
+     ok markus@
+
+commit 7da2be0cb9601ed25460c83aa4d44052b967ba0f
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Tue Mar 31 22:59:01 2015 +0000
+
+    upstream commit
+    
+    adapt to recent hostfile.c change: when parsing
+     known_hosts without fully parsing the keys therein, hostkeys_foreach() will
+     now correctly identify KEY_RSA1 keys; ok markus@ miod@
+
+commit 9e1777a0d1c706714b055811c12ab8cc21033e4a
+Author: markus@openbsd.org <markus@openbsd.org>
+Date:   Tue Mar 24 20:19:15 2015 +0000
+
+    upstream commit
+    
+    use ${SSH} for -Q instead of installed ssh
+
+commit ce1b358ea414a2cc88e4430cd5a2ea7fecd9de57
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Mon Mar 16 22:46:14 2015 +0000
+
+    upstream commit
+    
+    make CLEANFILES clean up more of the tests' droppings
+
+commit 398f9ef192d820b67beba01ec234d66faca65775
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Tue Mar 31 22:57:06 2015 +0000
+
+    upstream commit
+    
+    downgrade error() for known_hosts parse errors to debug()
+     to quiet warnings from ssh1 keys present when compiled !ssh1.
+    
+    also identify ssh1 keys when scanning, even when compiled !ssh1
+    
+    ok markus@ miod@
+
+commit 9a47ab80030a31f2d122b8fd95bd48c408b9fcd9
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Tue Mar 31 22:55:50 2015 +0000
+
+    upstream commit
+    
+    fd leak for !ssh1 case; found by unittests; ok markus@
+
+commit c9a0805a6280681901c270755a7cd630d7c5280e
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Tue Mar 31 22:55:24 2015 +0000
+
+    upstream commit
+    
+    don't fatal when a !ssh1 sshd is reexeced from a w/ssh1
+     listener; reported by miod@; ok miod@ markus@
+
+commit 704d8c88988cae38fb755a6243b119731d223222
+Author: tobias@openbsd.org <tobias@openbsd.org>
+Date:   Tue Mar 31 11:06:49 2015 +0000
+
+    upstream commit
+    
+    Comments are only supported for RSA1 keys. If a user
+     tried to add one and entered his passphrase, explicitly clear it before exit.
+     This is done in all other error paths, too.
+    
+    ok djm
+
+commit 78de1673c05ea2c33e0d4a4b64ecb5186b6ea2e9
+Author: jmc@openbsd.org <jmc@openbsd.org>
+Date:   Mon Mar 30 18:28:37 2015 +0000
+
+    upstream commit
+    
+    ssh-askpass(1) is the default, overridden by SSH_ASKPASS;
+     diff originally from jiri b;
+
+commit 26e0bcf766fadb4a44fb6199386fb1dcab65ad00
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Mon Mar 30 00:00:29 2015 +0000
+
+    upstream commit
+    
+    fix uninitialised memory read when parsing a config file
+     consisting of a single nul byte. Found by hanno AT hboeck.de using AFL; ok
+     dtucker
+
+commit fecede00a76fbb33a349f5121c0b2f9fbc04a777
+Author: markus@openbsd.org <markus@openbsd.org>
+Date:   Thu Mar 26 19:32:19 2015 +0000
+
+    upstream commit
+    
+    sigp and lenp are not optional in ssh_agent_sign(); ok
+     djm@
+
+commit 1b0ef3813244c78669e6d4d54c624f600945327d
+Author: naddy@openbsd.org <naddy@openbsd.org>
+Date:   Thu Mar 26 12:32:38 2015 +0000
+
+    upstream commit
+    
+    don't try to load .ssh/identity by default if SSH1 is
+     disabled; ok markus@
+
+commit f9b78852379b74a2d14e6fc94fe52af30b7e9c31
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Thu Mar 26 07:00:04 2015 +0000
+
+    upstream commit
+    
+    ban all-zero curve25519 keys as recommended by latest
+     CFRG curves draft; ok markus
+
+commit b8afbe2c1aaf573565e4da775261dfafc8b1ba9c
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Thu Mar 26 06:59:28 2015 +0000
+
+    upstream commit
+    
+    relax bits needed check to allow
+     diffie-hellman-group1-sha1 key exchange to complete for chacha20-poly1305 was
+     selected as symmetric cipher; ok markus
+
+commit 47842f71e31da130555353c1d57a1e5a8937f1c0
+Author: markus@openbsd.org <markus@openbsd.org>
+Date:   Wed Mar 25 19:29:58 2015 +0000
+
+    upstream commit
+    
+    ignore v1 errors on ssh-add -D; only try v2 keys on
+     -l/-L (unless WITH_SSH1) ok djm@
+
+commit 5f57e77f91bf2230c09eca96eb5ecec39e5f2da6
+Author: markus@openbsd.org <markus@openbsd.org>
+Date:   Wed Mar 25 19:21:48 2015 +0000
+
+    upstream commit
+    
+    unbreak ssh_agent_sign (lenp vs *lenp)
+
+commit 4daeb67181054f2a377677fac919ee8f9ed3490e
+Author: markus@openbsd.org <markus@openbsd.org>
+Date:   Tue Mar 24 20:10:08 2015 +0000
+
+    upstream commit
+    
+    don't leak 'setp' on error; noted by Nicholas Lemonias;
+     ok djm@
+
+commit 7d4f96f9de2a18af0d9fa75ea89a4990de0344f5
+Author: markus@openbsd.org <markus@openbsd.org>
+Date:   Tue Mar 24 20:09:11 2015 +0000
+
+    upstream commit
+    
+    consistent check for NULL as noted by Nicholas
+     Lemonias; ok djm@
+
+commit df100be51354e447d9345cf1ec22e6013c0eed50
+Author: markus@openbsd.org <markus@openbsd.org>
+Date:   Tue Mar 24 20:03:44 2015 +0000
+
+    upstream commit
+    
+    correct fmt-string for size_t as noted by Nicholas
+     Lemonias; ok djm@
+
+commit a22b9ef21285e81775732436f7c84a27bd3f71e0
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Tue Mar 24 09:17:21 2015 +0000
+
+    upstream commit
+    
+    promote chacha20-poly1305@openssh.com to be the default
+     cipher; ok markus
+
+commit 2aa9da1a3b360cf7b13e96fe1521534b91501fb5
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Tue Mar 24 01:29:19 2015 +0000
+
+    upstream commit
+    
+    Compile-time disable SSH protocol 1. You can turn it
+     back on using the Makefile.inc knob if you need it to talk to ancient
+     devices.
+
+commit 53097b2022154edf96b4e8526af5666f979503f7
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Tue Mar 24 01:11:12 2015 +0000
+
+    upstream commit
+    
+    fix double-negative error message "ssh1 is not
+     unsupported"
+
+commit 5c27e3b6ec2db711dfcd40e6359c0bcdd0b62ea9
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Mon Mar 23 06:06:38 2015 +0000
+
+    upstream commit
+    
+    for ssh-keygen -A, don't try (and fail) to generate ssh
+     v.1 keys when compiled without SSH1 support RSA/DSA/ECDSA keys when compiled
+     without OpenSSL based on patch by Mike Frysinger; bz#2369
+
+commit 725fd22a8c41db7de73a638539a5157b7e4424ae
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Wed Mar 18 01:44:21 2015 +0000
+
+    upstream commit
+    
+    KRL support doesn't need OpenSSL anymore, remove #ifdefs
+     from around call
+
+commit b07011c18e0b2e172c5fd09d21fb159a0bf5fcc7
+Author: djm@openbsd.org <djm@openbsd.org>
+Date:   Mon Mar 16 11:09:52 2015 +0000
+
+    upstream commit
+    
+    #if 0 some more arrays used only for decrypting (we don't
+     use since we only need encrypt for AES-CTR)
+
+commit 1cb3016635898d287e9d58b50c430995652d5358
+Author: jsg@openbsd.org <jsg@openbsd.org>
+Date:   Wed Mar 11 00:48:39 2015 +0000
+
+    upstream commit
+    
+    add back the changes from rev 1.206, djm reverted this by
+     mistake in rev 1.207
+
+commit 4d24b3b6a4a6383e05e7da26d183b79fa8663697
+Author: Damien Miller <djm@mindrot.org>
+Date:   Fri Mar 20 09:11:59 2015 +1100
+
+    remove error() accidentally inserted for debugging
+    
+    pointed out by Christian Hesse
+
 commit 9f82e5a9042f2d872e98f48a876fcab3e25dd9bb
 Author: Tim Rice <tim@multitalents.net>
 Date:   Mon Mar 16 22:49:20 2015 -0700
@@ -7401,1184 +8933,3 @@ Date:   Tue Jul 2 20:06:46 2013 +1000
        the Cygwin README file (which hasn't been updated for ages), drop
        unsupported OSes from the ssh-host-config help text, and drop an
        unneeded option from ssh-user-config.  Patch from vinschen at redhat com.
-
-commit b8ae92d08b91beaef34232c6ef34b9941473fdd6
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Tue Jun 11 12:10:02 2013 +1000
-
-     - (dtucker) [myproposal.h] Make the conditional algorithm support consistent
-       and add some comments so it's clear what goes where.
-
-commit 97b62f41adcb0dcbeff142d0540793a7ea17c910
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Tue Jun 11 11:47:24 2013 +1000
-
-     - (dtucker) [myproposal.h] Do not advertise AES GSM ciphers if we don't have
-       the required OpenSSL support.  Patch from naddy at freebsd.
-
-commit 6d8bd57448b45b42809da32857d7804444349ee7
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Tue Jun 11 11:26:10 2013 +1000
-
-     - (dtucker) [Makefile.in configure.ac fixalgorithms] Remove unsupported
-       algorithms (Ciphers, MACs and HostKeyAlgorithms) from man pages.
-
-commit 36187093ea0b2d2240c043417b8949611687e105
-Author: Damien Miller <djm@mindrot.org>
-Date:   Mon Jun 10 13:07:11 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/06/07 15:37:52
-         [channels.c channels.h clientloop.c]
-         Add an "ABANDONED" channel state and use for mux sessions that are
-         disconnected via the ~. escape sequence.  Channels in this state will
-         be able to close if the server responds, but do not count as active channels.
-         This means that if you ~. all of the mux clients when using ControlPersist
-         on a broken network, the backgrounded mux master will exit when the
-         Control Persist time expires rather than hanging around indefinitely.
-         bz#1917, also reported and tested by tedu@.  ok djm@ markus@.
-
-commit ae133d4b31af05bb232d797419f498f3ae7e9f2d
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Thu Jun 6 08:30:20 2013 +1000
-
-     - (dtucker) [configure.ac sftp.c openbsd-compat/openbsd-compat.h] Cater for
-        platforms that don't have multibyte character support (specifically,
-        mblen).
-
-commit 408eaf3ab716096f8faf30f091bd54a2c7a17a09
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Thu Jun 6 08:22:46 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/06/05 22:00:28
-         [readconf.c]
-         plug another memleak.  bz#1967, from Zhenbo Xu, detected by Melton, ok djm
-
-commit e52a260f16888ca75390f97de4606943e61785e8
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Thu Jun 6 08:22:05 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/06/05 12:52:38
-         [sshconnect2.c]
-         Fix memory leaks found by Zhenbo Xu and the Melton tool.  bz#1967, ok djm
-
-commit 0cca17fa1819d3a0ba06a6db41ab3eaa8d769587
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Thu Jun 6 08:21:14 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/06/05 02:27:50
-         [sshd.c]
-         When running sshd -D, close stderr unless we have explicitly requesting
-         logging to stderr. From james.hunt at ubuntu.com via bz#1976, djm's patch
-         so, err, ok dtucker.
-
-commit 746e9067bd9b3501876e1c86f38f3c510a12f895
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Thu Jun 6 08:20:13 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/06/05 02:07:29
-         [mux.c]
-         fix leaks in mux error paths, from Zhenbo Xu, found by Melton. bz#1967,
-         ok djm
-
-commit ea64721275a81c4788af36294d94bf4f74012e06
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Thu Jun 6 08:19:09 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/06/04 20:42:36
-         [sftp.c]
-         Make sftp's libedit interface marginally multibyte aware by building up
-         the quoted string by character instead of by byte.  Prevents failures
-         when linked against a libedit built with wide character support (bz#1990).
-         "looks ok" djm
-
-commit 194454d7a8f8cb8ac55f2b9d0199ef9445788bee
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Thu Jun 6 08:16:04 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/06/04 19:12:23
-         [scp.c]
-         use MAXPATHLEN for buffer size instead of fixed value.  ok markus
-
-commit 4ac66af091cf6db5a42c18e43738ca9c41e338e5
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Thu Jun 6 08:12:37 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/06/03 00:03:18
-         [mac.c]
-         force the MAC output to be 64-bit aligned so umac won't see unaligned
-         accesses on strict-alignment architectures.  bz#2101, patch from
-         tomas.kuthan at oracle.com, ok djm@
-
-commit ea8342c248ad6c0a4fe1a70de133f954973bd2b2
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Thu Jun 6 08:11:40 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/06/02 23:36:29
-         [clientloop.h clientloop.c mux.c]
-         No need for the mux cleanup callback to be visible so restore it to static
-         and call it through the detach_user function pointer.  ok djm@
-
-commit 5d12b8f05d79ba89d0807910a664fa80f6f3bf8c
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Thu Jun 6 08:09:10 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/06/02 21:01:51
-         [channels.h]
-         typo in comment
-
-commit dc62edbf121c41e8b5270904091039450206d98a
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Thu Jun 6 05:12:35 2013 +1000
-
-     - (dtucker) [Makefile.in] append $CFLAGS to compiler options when building
-       modpipe in case there's anything in there we need.
-
-commit 2a22873cd869679415104bc9f6bb154811ee604c
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Thu Jun 6 01:59:13 2013 +1000
-
-     - (dtucker) [regress/forwarding.sh] For (as yet unknown) reason, the
-       forwarding test is extremely slow copying data on some machines so switch
-       back to copying the much smaller ls binary until we can figure out why
-       this is.
-
-commit b4e00949f01176cd4fae3e0cef5ffa8dea379042
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Wed Jun 5 22:48:44 2013 +1000
-
-     - (dtucker) [contrib/ssh-copy-id] bz#2117: Use portable operator in test.
-       Patch from cjwatson at debian.
-
-commit 2ea9eb77a7fcab3190564ef5a6a5377a600aa391
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Wed Jun 5 15:04:00 2013 +1000
-
-     - (dtucker) Enable sha256 kex methods based on the presence of the necessary
-       functions, not from the openssl version.
-
-commit 16cac190ebb9b5612cccea63a7c22ac33bc9a07a
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Tue Jun 4 12:55:24 2013 +1000
-
-     - (dtucker) [configure.ac] Some other platforms need sys/types.h before
-       sys/socket.h.
-
-commit 0b43ffe143a5843703c3755fa040b8684fb04134
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Mon Jun 3 09:30:44 2013 +1000
-
-     - (dtucker) [configure.ac] Some platforms need sys/types.h before sys/un.h.
-
-commit 3f3064c82238c486706471d300217d73dd0f125e
-Author: Tim Rice <tim@multitalents.net>
-Date:   Sun Jun 2 15:13:09 2013 -0700
-
-     - (tim) [regress/sftp-chroot.sh] skip if no sudo. ok dtucker
-
-commit 01ec0af301f60fefdd0079647f13ef9abadd2db5
-Author: Tim Rice <tim@multitalents.net>
-Date:   Sun Jun 2 14:31:27 2013 -0700
-
-     - (tim) [aclocal.m4] Enhance OSSH_CHECK_CFLAG_COMPILE to check stderr.
-       feedback and ok dtucker
-
-commit 5ab9b63468100757479534edeb53f788a61fe08b
-Author: Tim Rice <tim@multitalents.net>
-Date:   Sun Jun 2 14:05:48 2013 -0700
-
-     - (tim) [configure.ac regress/Makefile] With rev 1.47 of test-exec.sh we
-       need a shell that can handle "[ file1 -nt file2 ]". Rather than keep
-       dealing with shell portability issues in regression tests, we let
-       configure find us a capable shell on those platforms with an old /bin/sh.
-
-commit 898ac935e56a7ac5d8b686c590fdb8b7aca27e59
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Mon Jun 3 02:03:25 2013 +1000
-
-     - (dtucker) [configure.ac] bz#2111: don't try to use lastlog on Android.
-       Patch from Nathan Osman.
-
-commit ef4901c3eb98c7ab1342c3cd8f2638da1f4b0678
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Mon Jun 3 01:59:13 2013 +1000
-
-     - (dtucker) [configure.ac]  sys/un.h needs sys/socket.h on some platforms
-       to prevent noise from configure. Patch from Nathan Osman.
-
-commit 073f795bc1c7728c320e5982c0d417376b0907f5
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Sun Jun 2 23:47:11 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/06/02 13:35:58
-         [ssh-agent.c]
-         Make parent_alive_interval time_t to avoid signed/unsigned comparison
-
-commit 00e1abb1ebe13ab24e812f68715f46e65e7c5271
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Sun Jun 2 23:46:24 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/06/02 13:33:05
-         [progressmeter.c]
-         Add misc.h for monotime prototype. (id sync only)
-
-commit 86211d1738695e63b2a68f0c3a4f60e1a9d9bda3
-Author: Tim Rice <tim@multitalents.net>
-Date:   Sat Jun 1 18:38:23 2013 -0700
-
-    20130602
-     - (tim) [Makefile.in] Make Solaris, UnixWare, & OpenServer linkers happy
-       linking regress/modpipe.
-
-commit e9887d1c37940b9d6c72d55cfad7a40de4c6e28d
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Sun Jun 2 09:17:09 2013 +1000
-
-     - (dtucker) [sandbox-seccomp-filter.c] Allow clock_gettimeofday.
-
-commit 65cf74079a2d563c4ede649116a13ca78c8cc2a4
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Sun Jun 2 09:11:19 2013 +1000
-
-    fix typo
-
-commit c9a1991b95a4c9f04f9dcef299a8110d2ec80d3e
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Sun Jun 2 08:37:05 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/06/01 22:34:50
-         [sftp-client.c]
-         Update progressmeter when data is acked, not when it's sent.  bz#2108, from
-         Debian via Colin Watson, ok djm@
-
-commit a710891659202c82545e84725d4e5cd77aef567c
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Sun Jun 2 08:18:31 2013 +1000
-
-     - (dtucker) [configure.ac misc.c] Look for clock_gettime in librt and fall
-       back to time(NULL) if we can't find it anywhere.
-
-commit f60845fde29cead9d75e812db1c04916b4c58ffd
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Sun Jun 2 08:07:31 2013 +1000
-
-     - (dtucker) [M auth-chall.c auth-krb5.c auth-pam.c cipher-aes.c cipher-ctr.c
-       groupaccess.c loginrec.c monitor.c monitor_wrap.c session.c sshd.c
-       sshlogin.c uidswap.c openbsd-compat/bsd-cygwin_util.c
-       openbsd-compat/getrrsetbyname-ldns.c openbsd-compat/port-aix.c
-       openbsd-compat/port-linux.c] Replace portable-specific instances of xfree
-       with the equivalent calls to free.
-
-commit 12f6533215c0a36ab29d11ff52a853fce45573b4
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Sun Jun 2 08:01:24 2013 +1000
-
-    Remove stray '+' accidentally introduced in sync
-
-commit 3750fce6ac6b287f62584ac55a4406df95c71b92
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Sun Jun 2 07:52:21 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/06/01 20:59:25
-         [scp.c sftp-client.c]
-         Replace S_IWRITE, which isn't standardized, with S_IWUSR, which is.  Patch
-         from Nathan Osman via bz#2113.  ok deraadt.
-    
-    (note: corrected bug number from 2085)
-
-commit b759c9c2efebe7b416ab81093ca8eb17836b6933
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Sun Jun 2 07:46:16 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/06/01 13:15:52
-         [ssh-agent.c clientloop.c misc.h packet.c progressmeter.c misc.c
-         channels.c sandbox-systrace.c]
-         Use clock_gettime(CLOCK_MONOTONIC ...) for ssh timers so that things like
-         keepalives and rekeying will work properly over clock steps.  Suggested by
-         markus@, "looks good" djm@.
-
-commit 55119253c64808b0d3b2ab5d2bc67ee9dac3430b
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Sun Jun 2 07:43:59 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/05/31 12:28:10
-         [ssh-agent.c]
-         Use time_t where appropriate.  ok djm
-
-commit 0acca3797d53d958d240c69a5f222f2aa8444858
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Sun Jun 2 07:41:51 2013 +1000
-
-       - djm@cvs.openbsd.org 2013/05/19 02:42:42
-         [auth.h auth.c key.c monitor.c auth-rsa.c auth2.c auth1.c key.h]
-         Standardise logging of supplemental information during userauth. Keys
-         and ruser is now logged in the auth success/failure message alongside
-         the local username, remote host/port and protocol in use. Certificates
-         contents and CA are logged too.
-         Pushing all logging onto a single line simplifies log analysis as it is
-         no longer necessary to relate information scattered across multiple log
-         entries. "I like it" markus@
-
-commit 74836ae0fabcc1a76b9d9eacd1629c88a054b2d0
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Sun Jun 2 07:32:00 2013 +1000
-
-       - djm@cvs.openbsd.org 2013/05/19 02:38:28
-         [auth2-pubkey.c]
-         fix failure to recognise cert-authority keys if a key of a different type
-         appeared in authorized_keys before it; ok markus@
-
-commit a627d42e51ffa71e014d7b2d2c07118122fd3ec3
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Sun Jun 2 07:31:17 2013 +1000
-
-       - djm@cvs.openbsd.org 2013/05/17 00:13:13
-         [xmalloc.h cipher.c sftp-glob.c ssh-keyscan.c ssh.c sftp-common.c
-         ssh-ecdsa.c auth2-chall.c compat.c readconf.c kexgexs.c monitor.c
-         gss-genr.c cipher-3des1.c kex.c monitor_wrap.c ssh-pkcs11-client.c
-         auth-options.c rsa.c auth2-pubkey.c sftp.c hostfile.c auth2.c
-         servconf.c auth.c authfile.c xmalloc.c uuencode.c sftp-client.c
-         auth2-gss.c sftp-server.c bufaux.c mac.c session.c jpake.c kexgexc.c
-         sshconnect.c auth-chall.c auth2-passwd.c sshconnect1.c buffer.c
-         kexecdhs.c kexdhs.c ssh-rsa.c auth1.c ssh-pkcs11.c auth2-kbdint.c
-         kexdhc.c sshd.c umac.c ssh-dss.c auth2-jpake.c bufbn.c clientloop.c
-         monitor_mm.c scp.c roaming_client.c serverloop.c key.c auth-rsa.c
-         ssh-pkcs11-helper.c ssh-keysign.c ssh-keygen.c match.c channels.c
-         sshconnect2.c addrmatch.c mux.c canohost.c kexecdhc.c schnorr.c
-         ssh-add.c misc.c auth2-hostbased.c ssh-agent.c bufec.c groupaccess.c
-         dns.c packet.c readpass.c authfd.c moduli.c]
-         bye, bye xfree(); ok markus@
-
-commit c7aad0058c957afeb26a3f703e8cb0eddeb62365
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Sun Jun 2 07:18:47 2013 +1000
-
-     - (dtucker) [configure.ac defines.h] Test for fd_mask, howmany and NFDBITS
-       rather than trying to enumerate the plaforms that don't have them.
-       Based on a patch from Nathan Osman, with help from tim@.
-
-commit c0c3373216801797053e123b5f62d35bf41b3611
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Sun Jun 2 06:28:03 2013 +1000
-
-     - (dtucker) [configure.ac openbsd-compat/xcrypt.c] bz#2112: fall back to
-       using openssl's DES_crpyt function on platorms that don't have a native
-       one, eg Android.  Based on a patch from Nathan Osman.
-
-commit efdf5342143a887013a1daae583167dadf6752a7
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Thu May 30 08:29:08 2013 +1000
-
-      - (dtucker) [configure.ac openbsd-compat/bsd-misc.h] bz#2087: Add a null
-        implementation of endgrent for platforms that don't have it (eg Android).
-        Loosely based on a patch from Nathan Osman, ok djm
-
-commit 9b42d327380e5cd04efde6fb70e1535fecedf0d7
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 20:48:59 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/05/17 10:35:43
-         [regress/scp.sh]
-         use a file extention that's not special on some platforms.  from portable
-         (id sync only)
-
-commit 0a404b0ed79ba45ccaf7ed5528a8f5004c3698cb
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 20:47:29 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/05/17 10:34:30
-         [regress/portnum.sh]
-         use a more portable negated if structure.  from portable (id sync only)
-
-commit 62ee222e6f3f5ee288434f58b5136ae3d56f5164
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 20:46:00 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/05/17 10:33:09
-         [regress/agent-getpeereid.sh]
-         don't redirect stdout from sudo.  from portable (id sync only)
-
-commit 00478d30cb4bcc18dc1ced8144d16b03cdf790f6
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 20:45:06 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/05/17 10:30:07
-         [regress/test-exec.sh]
-         wait a bit longer for startup and use case for absolute path.
-         from portable (id sync only)
-
-commit 98989eb95eef0aefed7e9fb4e65c2f625be946f6
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 20:44:09 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/05/17 10:28:11
-         [regress/sftp.sh]
-         only compare copied data if sftp succeeds.  from portable (id sync only)
-
-commit 438f60eb9a5f7cd40bb242cfec865e4fde71b07c
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 20:43:13 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/05/17 10:26:26
-         [regress/sftp-badcmds.sh]
-         remove unused BATCH variable. (id sync only)
-
-commit 1466bd25a8d1ff7ae455a795d2d7d52dc17d2938
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 20:42:05 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/05/17 10:24:48
-         [localcommand.sh]
-         use backticks for portability. (id sync only)
-
-commit 05b5e518c9969d63471f2ccfd85b1de6e724d30b
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 20:41:07 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/05/17 10:23:52
-         [regress/login-timeout.sh regress/reexec.sh regress/test-exec.sh]
-         Use SUDO when cat'ing pid files and running the sshd log wrapper so that
-         it works with a restrictive umask and the pid files are not world readable.
-         Changes from -portable.  (id sync only)
-
-commit dd669173f93ea8c8397e0af758eaf13ab4f1c591
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 20:39:57 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/05/17 10:16:26
-         [regress/try-ciphers.sh]
-         use expr for math to keep diffs vs portable down
-         (id sync only)
-
-commit 044f32f4c6fd342f9f5949bb0ca77624c0db4494
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 20:12:57 2013 +1000
-
-     - (dtucker) [regress/cfgmatch.sh] Remove unneeded sleep renderd obsolete by
-       rev 1.6 which calls wait.
-
-commit 9cc8ff7b63f175661c8807006f6d2649d56ac402
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 20:01:52 2013 +1000
-
-     - (dtucker) [regress/runtests.sh] Remove obsolete test driver script.
-
-commit f8d5b3451726530a864b172c556c311370c244e1
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 19:53:25 2013 +1000
-
-     - (dtucker) [regress/stderr-after-eof.sh regress/test-exec.sh] Move the md5
-       helper function to the portable part of test-exec.sh.
-
-commit 6f66981ed3c6bb83b937959f329323975e356c33
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 19:28:51 2013 +1000
-
-     - (dtucker) [regress/test-exec.sh] Move the portable-specific functions
-       together and add a couple of missing lines from openbsd.
-
-commit 5f1a89a3b67264f4aa83e057cd4f74fd60b9ffa4
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 19:17:58 2013 +1000
-
-     - (dtucker) [regress/integrity.sh regress/krl.sh regress/test-exec.sh]
-       Move the jot helper function to portable-specific part of test-exec.sh.
-
-commit 96457a54d05dea81f34ecb4e059d2f8b98382b85
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 19:03:38 2013 +1000
-
-     - (dtucker) [regress/agent-getpeereid.sh] Resync spaces with openbsd.
-
-commit 7f193236594e8328ad133ea05eded31f837b45b5
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 19:02:28 2013 +1000
-
-     - (dtucker) [regress/cfgmatch.sh] Resync config file setup with openbsd.
-
-commit 8654dd2d737800d09e7730b3dfc2a54411f4cf90
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 16:03:48 2013 +1000
-
-     - (dtucker) [openbsd-compat/getopt.h] Remove unneeded bits.
-
-commit 59d928d3b47e8298f4a8b4b3fb37fb8c8ce1b098
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 15:32:29 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/05/17 04:29:14
-         [regress/sftp.sh regress/putty-ciphers.sh regress/cipher-speed.sh
-         regress/test-exec.sh regress/sftp-batch.sh regress/dynamic-forward.sh
-         regress/putty-transfer.sh regress/conch-ciphers.sh regress/sftp-cmds.sh
-         regress/scp.sh regress/ssh-com-sftp.sh regress/rekey.sh
-         regress/putty-kex.sh regress/stderr-data.sh regress/stderr-after-eof.sh
-         regress/sftp-badcmds.sh regress/reexec.sh regress/ssh-com-client.sh
-         regress/sftp-chroot.sh regress/forwarding.sh regress/transfer.sh
-         regress/multiplex.sh]
-         Move the setting of DATA and COPY into test-exec.sh
-
-commit 34035be27b7ddd84706fe95c39d37cba7d5c9572
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 14:47:51 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/05/17 01:32:11
-         [regress/integrity.sh]
-         don't print output from ssh before getting it (it's available in ssh.log)
-
-commit b8b96b0aa634d440feba4331c80ae4de9dda2081
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 14:46:20 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/05/17 01:16:09
-         [regress/agent-timeout.sh]
-         Pull back some portability changes from -portable:
-          - TIMEOUT is a read-only variable in some shells
-          - not all greps have -q so redirect to /dev/null instead.
-         (ID sync only)
-
-commit a40d97ff46831c9081a6a4472036689360847fb1
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 14:44:53 2013 +1000
-
-    sync missing ID
-
-commit 56347efe796a0506e846621ae65562b978e45f1d
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 13:28:36 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/05/17 00:37:40
-         [regress/agent.sh regress/keytype.sh regress/cfgmatch.sh
-         regress/forcecommand.sh regress/proto-version.sh regress/test-exec.sh
-         regress/cipher-speed.sh regress/cert-hostkey.sh regress/cert-userkey.sh
-         regress/ssh-com.sh]
-         replace 'echo -n' with 'printf' since it's more portable
-         also remove "echon" hack.
-
-commit 91af05c5167fe0aa5bd41d2e4a83757d9f627c18
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 13:16:59 2013 +1000
-
-     - (dtucker) [regress/integrity.sh].  Force fixed Diffie-Hellman key exchange
-       methods.  When the openssl version doesn't support ECDH then next one on
-       the list is DH group exchange, but that causes a bit more traffic which can
-       mean that the tests flip bits in the initial exchange rather than the MACed
-       traffic and we get different errors to what the tests look for.
-
-commit 6e1e60c3c2e16c32bb7ca0876caaa6182a4e4b2c
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 11:23:41 2013 +1000
-
-     - (dtucker) [regress/bsd.regress.mk] Remove unused file.  We've never used it
-       in portable and it's long gone in openbsd.
-
-commit 982b0cbc4c2b5ea14725f4b339393cdf343dd0fe
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 09:45:12 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/05/16 05:48:31
-         [regress/rekey.sh]
-         add tests for RekeyLimit parsing
-
-commit 14490fe7b0f45b1b19f8a3dc10eb3d214f27f5bd
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 09:44:20 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/05/16 04:26:10
-         [regress/rekey.sh]
-         add server-side rekey test
-
-commit c31c8729c15f83fba14ef9da0d66bda6215ff69a
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 09:43:33 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/05/16 03:33:30
-         [regress/rekey.sh]
-         test rekeying when there's no data being transferred
-
-commit a8a62fcc46c19997797846197a6256ed9a777a47
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 09:42:34 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/05/16 02:10:35
-         [rekey.sh]
-         Add test for time-based rekeying
-
-commit 5e95173715d516e6014485e2b6def1fb3db84036
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 09:41:33 2013 +1000
-
-       - djm@cvs.openbsd.org 2013/05/10 03:46:14
-         [modpipe.c]
-         sync some portability changes from portable OpenSSH (id sync only)
-
-commit a4df65b9fc68a555a7d8781700475fb03ed6e694
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 09:37:31 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/04/22 07:28:53
-         [multiplex.sh]
-         Add tests for -Oforward and -Ocancel for local and remote forwards
-
-commit 40aaff7e4bcb05b05e3d24938b6d34885be817da
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 09:36:20 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/04/22 07:23:08
-         [multiplex.sh]
-         Write mux master logs to regress.log instead of ssh.log to keep separate
-
-commit f3568fc62b73b50a0a3c8447e4a00f4892cab25e
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 09:35:26 2013 +1000
-
-       - djm@cvs.openbsd.org 2013/04/18 02:46:12
-         [Makefile regress/sftp-chroot.sh]
-         test sshd ChrootDirectory+internal-sftp; feedback & ok dtucker@
-
-commit dfea3bcdd7c980c2335402464b7dd8d8721e426d
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 09:31:39 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/04/07 02:16:03
-         [regress/Makefile regress/rekey.sh regress/integrity.sh
-         regress/sshd-log-wrapper.sh regress/forwarding.sh regress/test-exec.sh]
-         use -E option for ssh and sshd to write debuging logs to ssh{,d}.log and
-         save the output from any failing tests.  If a test fails the debug output
-         from ssh and sshd for the failing tests (and only the failing tests) should
-         be available in failed-ssh{,d}.log.
-
-commit 75129025a2d504b630d1718fef0da002f5662f63
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 09:19:10 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/04/06 06:00:22
-         [regress/rekey.sh regress/test-exec.sh regress/integrity.sh
-         regress/multiplex.sh Makefile regress/cfgmatch.sh]
-         Split the regress log into 3 parts: the debug output from ssh, the debug
-         log from sshd and the output from the client command (ssh, scp or sftp).
-         Somewhat functional now, will become more useful when ssh/sshd -E is added.
-
-commit 7c8b1e72331293b4707dc6f7f68a69e975a3fa70
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 09:10:20 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/03/23 11:09:43
-         [test-exec.sh]
-         Only regenerate host keys if they don't exist or if ssh-keygen has changed
-         since they were.  Reduces test runtime by 5-30% depending on machine
-         speed.
-
-commit 712de4d1100963b11bc618472f95ce36bf7e2ae3
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 17 09:07:12 2013 +1000
-
-      - djm@cvs.openbsd.org 2013/03/07 00:20:34
-         [regress/proxy-connect.sh]
-         repeat test with a style appended to the username
-
-commit 09c0f0325b2f538de9a1073e03b8ef26dece4c16
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Thu May 16 20:48:57 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/05/16 10:44:06
-         [servconf.c]
-         remove another now-unused variable
-
-commit 9113d0c2381202412c912a20c8083ab7d6824ec9
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Thu May 16 20:48:14 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/05/16 10:43:34
-         [servconf.c readconf.c]
-         remove now-unused variables
-
-commit e194ba4111ffd47cd1f4c8be1ddc8a4cb673d005
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Thu May 16 20:47:31 2013 +1000
-
-     - (dtucker) [configure.ac readconf.c servconf.c
-         openbsd-compat/openbsd-compat.h] Add compat bits for scan_scaled.
-
-commit b7ee8521448100e5b268111ff90feb017e657e44
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Thu May 16 20:33:10 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/05/16 09:12:31
-         [readconf.c servconf.c]
-         switch RekeyLimit traffic volume parsing to scan_scaled.  ok djm@
-
-commit dbee308253931f8c1aeebf781d7e7730ff6a0dc1
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Thu May 16 20:32:29 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/05/16 09:08:41
-         [log.c scp.c sshd.c serverloop.c schnorr.c sftp.c]
-         Fix some "unused result" warnings found via clang and -portable.
-         ok markus@
-
-commit 64d22946d664dad8165f1fae9e78b53831ed728d
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Thu May 16 20:31:29 2013 +1000
-
-       - jmc@cvs.openbsd.org 2013/05/16 06:30:06
-         [sshd_config.5]
-         oops! avoid Xr to self;
-
-commit 63e0df2b936770baadc8844617b99e5174b476d0
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Thu May 16 20:30:31 2013 +1000
-
-       - jmc@cvs.openbsd.org 2013/05/16 06:28:45
-         [ssh_config.5]
-         put IgnoreUnknown in the right place;
-
-commit 0763698f71efef8b3f8460c5700758359219eb7c
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Thu May 16 20:30:03 2013 +1000
-
-       - djm@cvs.openbsd.org 2013/05/16 04:27:50
-         [ssh_config.5 readconf.h readconf.c]
-         add the ability to ignore specific unrecognised ssh_config options;
-         bz#866; ok markus@
-
-commit 5f96f3b4bee11ae2b9b32ff9b881c3693e210f96
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Thu May 16 20:29:28 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/05/16 04:09:14
-         [sshd_config.5 servconf.c servconf.h packet.c serverloop.c monitor.c sshd_config
-         sshd.c] Add RekeyLimit to sshd with the same syntax as the client allowing
-         rekeying based on traffic volume or time.  ok djm@, help & ok jmc@ for the man
-         page.
-
-commit c53c2af173cf67fd1c26f98e7900299b1b65b6ec
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Thu May 16 20:28:16 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/05/16 02:00:34
-         [ssh_config sshconnect2.c packet.c readconf.h readconf.c clientloop.c
-         ssh_config.5 packet.h]
-         Add an optional second argument to RekeyLimit in the client to allow
-         rekeying based on elapsed time in addition to amount of traffic.
-         with djm@ jmc@, ok djm
-
-commit 64c6fceecd27e1739040b42de8f3759454260b39
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Thu May 16 20:27:14 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/05/10 10:13:50
-         [ssh-pkcs11-helper.c]
-         remove unused extern optarg.  ok markus@
-
-commit caf00109346e4ab6bb495b0e22bc5b1e7ee22f26
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Thu May 16 20:26:18 2013 +1000
-
-       - djm@cvs.openbsd.org 2013/05/10 04:08:01
-         [key.c]
-         memleak in cert_free(), wasn't actually freeing the struct;
-         bz#2096 from shm AT digitalsun.pl
-
-commit 7e831edbf7a1b0b9aeeb08328b9fceafaad1bf22
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Thu May 16 20:25:40 2013 +1000
-
-    add missing attribution
-
-commit 54da6be320495604ddf65d10ac4cc8cf7849c533
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Thu May 16 20:25:04 2013 +1000
-
-       - djm@cvs.openbsd.org 2013/05/10 03:40:07
-         [sshconnect2.c]
-         fix bzero(ptr_to_struct, sizeof(ptr_to_struct)); bz#2100 from
-
-commit 5d8b702d95c0dfc338726fecfbb709695afd1377
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Thu May 16 20:24:23 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/05/06 07:35:12
-         [sftp-server.8]
-         Reference the version of the sftp draft we actually implement.  ok djm@
-
-commit 026d9db3fbe311b5a7e98d62472cb666aa559648
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Thu May 16 20:23:52 2013 +1000
-
-       - tedu@cvs.openbsd.org 2013/04/24 16:01:46
-         [misc.c]
-         remove extra parens noticed by nicm
-
-commit 2ca51bf140ef2c2409fd220778529dc17c11d8fa
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Thu May 16 20:22:46 2013 +1000
-
-       - tedu@cvs.openbsd.org 2013/04/23 17:49:45
-         [misc.c]
-         use xasprintf instead of a series of strlcats and strdup. ok djm
-
-commit 6aa3eacc5e5f39702b6dd5b27970d9fd97bc2383
-Author: Damien Miller <djm@mindrot.org>
-Date:   Thu May 16 11:10:17 2013 +1000
-
-     - (djm) [contrib/ssh-copy-id] Fix bug that could cause "rm *" to be
-        executed if mktemp failed; bz#2105 ok dtucker@
-
-commit c54e3e0741a27119b3badd8ff92b1988b7e9bd50
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 10 18:53:14 2013 +1000
-
-     - (dtucker) [configure.ac] Add -Werror to the -Qunused-arguments test so
-       we don't get a warning on compilers that *don't* support it.  Add
-       -Wno-unknown-warning-option.  Move both to the start of the list for
-       maximum noise suppression.  Tested with gcc 4.6.3, gcc 2.95.4 and clang 2.9.
-
-commit a75d247a18a5099c60226395354eb252c097ac86
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 10 18:11:55 2013 +1000
-
-     - (dtucker) [kex.c] Only include sha256 and ECC key exchange methods when the
-       underlying libraries support them.
-
-commit 0abfb559e3f79d1f217773510d7626c3722aa3c1
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 10 18:08:49 2013 +1000
-
-    - (dtucker) [openbsd-compat/getopt.h openbsd-compat/getopt_long.c
-      openbsd-compat/openbsd-compat.h] pull in getopt.h from openbsd and plumb
-      in to use it when we're using our own getopt.
-
-commit ccfdfceacb7e23d1479ed4cc91976c5ac6e23c56
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 10 16:28:55 2013 +1000
-
-     - (dtucker) [openbsd-compat/Makefile.in openbsd-compat/getopt.c
-       openbsd-compat/getopt_long.c regress/modpipe.c] Remove getopt.c, add
-       portability code to getopt_long.c and switch over Makefile and the ugly
-       hack in modpipe.c.  Fixes bz#1448.
-
-commit 39332020078aa8fd4fc28e00b336438dc64b0f5a
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 10 15:38:11 2013 +1000
-
-     - (dtucker) [openbsd-compat/getopt_long.c] Import from OpenBSD.  No
-       portability changes yet.
-
-commit 35b2fe99bee4f332d1c1efa49107cdb3c67da07a
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 10 15:35:26 2013 +1000
-
-     - (dtucker) [openbsd-compat/getopt.c] Factor out portibility changes to
-       getopt.c.  Preprocessed source is identical other than line numbers.
-
-commit abbc7a7c02e45787d023f50a30f62d7a3e14fe9e
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri May 10 13:54:23 2013 +1000
-
-     - (dtucker) [configure.ac] Enable -Wsizeof-pointer-memaccess if the compiler
-       supports it.  Mentioned by Colin Watson in bz#2100, ok djm.
-
-commit bc02f163f6e882d390abfb925b47b41e13ae523b
-Author: Damien Miller <djm@mindrot.org>
-Date:   Tue Apr 23 19:25:49 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/04/22 01:17:18
-         [mux.c]
-         typo in debug output: evitval->exitval
-
-commit f8b894e31dc3530c7eb6d0a378848260d54f74c4
-Author: Damien Miller <djm@mindrot.org>
-Date:   Tue Apr 23 19:25:29 2013 +1000
-
-       - djm@cvs.openbsd.org 2013/04/19 12:07:08
-         [kex.c]
-         remove duplicated list entry pointed out by naddy@
-
-commit 34bd20a1e53b63ceb01f06c1654d9112e6784b0a
-Author: Damien Miller <djm@mindrot.org>
-Date:   Tue Apr 23 19:25:00 2013 +1000
-
-       - djm@cvs.openbsd.org 2013/04/19 11:10:18
-         [ssh.c]
-         add -Q to usage; reminded by jmc@
-
-commit ea11119eee3c5e2429b1f5f8688b25b028fa991a
-Author: Damien Miller <djm@mindrot.org>
-Date:   Tue Apr 23 19:24:32 2013 +1000
-
-       - djm@cvs.openbsd.org 2013/04/19 01:06:50
-         [authfile.c cipher.c cipher.h kex.c kex.h kexecdh.c kexecdhc.c kexecdhs.c]
-         [key.c key.h mac.c mac.h packet.c ssh.1 ssh.c]
-         add the ability to query supported ciphers, MACs, key type and KEX
-         algorithms to ssh. Includes some refactoring of KEX and key type handling
-         to be table-driven; ok markus@
-
-commit a56086b9903b62c1c4fdedf01b68338fe4dc90e4
-Author: Damien Miller <djm@mindrot.org>
-Date:   Tue Apr 23 15:24:18 2013 +1000
-
-       - djm@cvs.openbsd.org 2013/04/19 01:03:01
-         [session.c]
-         reintroduce 1.262 without the connection-killing bug:
-         fatal() when ChrootDirectory specified by running without root privileges;
-         ok markus@
-
-commit 0d6771b4648889ae5bc4235f9e3fc6cd82b710bd
-Author: Damien Miller <djm@mindrot.org>
-Date:   Tue Apr 23 15:23:24 2013 +1000
-
-       - djm@cvs.openbsd.org 2013/04/19 01:01:00
-         [ssh-keygen.c]
-         fix some memory leaks; bz#2088 ok dtucker@
-
-commit 467b00c38ba244f9966466e57a89d003f3afb159
-Author: Damien Miller <djm@mindrot.org>
-Date:   Tue Apr 23 15:23:07 2013 +1000
-
-       - djm@cvs.openbsd.org 2013/04/19 01:00:10
-         [sshd_config.5]
-         document the requirment that the AuthorizedKeysCommand be owned by root;
-         ok dtucker@ markus@
-
-commit 9303e6527bb5ca7630c765f28624702c212bfd6c
-Author: Damien Miller <djm@mindrot.org>
-Date:   Tue Apr 23 15:22:40 2013 +1000
-
-       - djm@cvs.openbsd.org 2013/04/18 02:16:07
-         [sftp.c]
-         make "sftp -q" do what it says on the sticker: hush everything but errors;
-
-commit f1a02aea35504e8bef2ed9eef6f9ddeab12bacb3
-Author: Damien Miller <djm@mindrot.org>
-Date:   Tue Apr 23 15:22:13 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/04/17 09:04:09
-         [session.c]
-         revert rev 1.262; it fails because uid is already set here.  ok djm@
-
-commit d5edefd27a30768cc7a4817302e964b6cb2f9be7
-Author: Damien Miller <djm@mindrot.org>
-Date:   Tue Apr 23 15:21:39 2013 +1000
-
-       - djm@cvs.openbsd.org 2013/04/11 02:27:50
-         [packet.c]
-         quiet disconnect notifications on the server from error() back to logit()
-         if it is a normal client closure; bz#2057 ok+feedback dtucker@
-
-commit 6901032b05291fc5d2bd4067fc47904de3506fda
-Author: Damien Miller <djm@mindrot.org>
-Date:   Tue Apr 23 15:21:24 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/04/07 09:40:27
-         [sshd.8]
-         clarify -e text. suggested by & ok jmc@
-
-commit 03d4d7e60b16f913c75382e32e136ddfa8d6485f
-Author: Damien Miller <djm@mindrot.org>
-Date:   Tue Apr 23 15:21:06 2013 +1000
-
-       - dtucker@cvs.openbsd.org 2013/04/07 02:10:33
-         [log.c log.h ssh.1 ssh.c sshd.8 sshd.c]
-         Add -E option to ssh and sshd to append debugging logs to a specified file
-         instead of stderr or syslog.  ok markus@, man page help jmc@
-
-commit 37f1c08473b1ef2a188ee178ce2e11e841f88563
-Author: Damien Miller <djm@mindrot.org>
-Date:   Tue Apr 23 15:20:43 2013 +1000
-
-       - markus@cvs.openbsd.org 2013/04/06 16:07:00
-         [channels.c sshd.c]
-         handle ECONNABORTED for accept(); ok deraadt some time ago...
-
-commit 172859cff7df9fd8a29a1f0a4de568f644bbda50
-Author: Damien Miller <djm@mindrot.org>
-Date:   Tue Apr 23 15:19:27 2013 +1000
-
-       - djm@cvs.openbsd.org 2013/04/05 00:58:51
-         [mux.c]
-         cleanup mux-created channels that are in SSH_CHANNEL_OPENING state too
-         (in addition to ones already in OPEN); bz#2079, ok dtucker@
-
-commit 9f12b5dcd5f7772e633fb2786c63bfcbea1f1aea
-Author: Damien Miller <djm@mindrot.org>
-Date:   Tue Apr 23 15:19:11 2013 +1000
-
-       - djm@cvs.openbsd.org 2013/04/05 00:31:49
-         [pathnames.h]
-         use the existing _PATH_SSH_USER_RC define to construct the other
-         pathnames; bz#2077, ok dtucker@ (no binary change)
-
-commit d677ad14ff7efedf21745ee1694058350e758e18
-Author: Damien Miller <djm@mindrot.org>
-Date:   Tue Apr 23 15:18:51 2013 +1000
-
-       - djm@cvs.openbsd.org 2013/04/05 00:14:00
-         [auth2-gss.c krl.c sshconnect2.c]
-         hush some {unused, printf type} warnings
-
-commit 508b6c3d3b95c8ec078fd4801368597ab29b2db9
-Author: Damien Miller <djm@mindrot.org>
-Date:   Tue Apr 23 15:18:28 2013 +1000
-
-       - djm@cvs.openbsd.org 2013/03/08 06:32:58
-         [ssh.c]
-         allow "ssh -f none ..." ok markus@
-
-commit 91a55f28f35431f9000b95815c343b5a18fda712
-Author: Damien Miller <djm@mindrot.org>
-Date:   Tue Apr 23 15:18:10 2013 +1000
-
-       - markus@cvs.openbsd.org 2013/03/07 19:27:25
-         [auth.h auth2-chall.c auth2.c monitor.c sshd_config.5]
-         add submethod support to AuthenticationMethods; ok and freedback djm@
-
-commit 4ce189d9108c62090a0dd5dea973d175328440db
-Author: Damien Miller <djm@mindrot.org>
-Date:   Tue Apr 23 15:17:52 2013 +1000
-
-       - djm@cvs.openbsd.org 2013/03/07 00:19:59
-         [auth2-pubkey.c monitor.c]
-         reconstruct the original username that was sent by the client, which may
-         have included a style (e.g. "root:skey") when checking public key
-         signatures. Fixes public key and hostbased auth when the client specified
-         a style; ok markus@
-
-commit 5cbec4c25954b184e43bf3d3ac09e65eb474f5f9
-Author: Damien Miller <djm@mindrot.org>
-Date:   Tue Apr 23 15:17:12 2013 +1000
-
-       - djm@cvs.openbsd.org 2013/03/06 23:36:53
-         [readconf.c]
-         g/c unused variable (-Wunused)
-
-commit 998cc56b65682d490c9bbf5977dceb1aa84a0233
-Author: Damien Miller <djm@mindrot.org>
-Date:   Tue Apr 23 15:16:43 2013 +1000
-
-       - djm@cvs.openbsd.org 2013/03/06 23:35:23
-         [session.c]
-         fatal() when ChrootDirectory specified by running without root privileges;
-         ok markus@
-
-commit 62e9c4f9b6027620f9091a2f43328e057bdb33f1
-Author: Damien Miller <djm@mindrot.org>
-Date:   Tue Apr 23 15:15:49 2013 +1000
-
-     - (djm) OpenBSD CVS Sync
-       - markus@cvs.openbsd.org 2013/03/05 20:16:09
-         [sshconnect2.c]
-         reset pubkey order on partial success; ok djm@
-
-commit 6332da2ae88db623d7da8070dd807efa26d9dfe8
-Author: Damien Miller <djm@mindrot.org>
-Date:   Tue Apr 23 14:25:52 2013 +1000
-
-     - (djm) [auth.c configure.ac misc.c monitor.c monitor_wrap.c] Support
-       platforms, such as Android, that lack struct passwd.pw_gecos. Report
-       and initial patch from Nathan Osman bz#2086; feedback tim@ ok dtucker@
-
-commit ce1c9574fcfaf753a062276867335c1e237f725c
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Thu Apr 18 21:36:19 2013 +1000
-
-     - (dtucker) [configure.ac] Use -Qunused-arguments to suppress warnings from
-       unused argument warnings (in particular, -fno-builtin-memset) from clang.
-
-commit bc68f2451b836e6a3fa65df8774a8b1f10049ded
-Author: Damien Miller <djm@mindrot.org>
-Date:   Thu Apr 18 11:26:25 2013 +1000
-
-     - (djm) [config.guess config.sub] Update to last versions before they switch
-        to GPL3. ok dtucker@
-
-commit 15fd19c4c9943cf02bc6f462d52c86ee6a8f422e
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri Apr 5 11:22:26 2013 +1100
-
-       - djm@cvs.openbsd.org 2013/02/22 22:09:01
-         [ssh.c]
-         Allow IdenityFile=none; ok markus deraadt (and dtucker for an earlier
-         version)
-
-commit 5d1d9541a7c83963cd887b6b36e25b46463a05d4
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri Apr 5 11:20:00 2013 +1100
-
-       - markus@cvs.openbsd.org 2013/02/22 19:13:56
-         [sshconnect.c]
-         support ProxyCommand=- (stdin/out already point to the proxy); ok djm@
-
-commit aefa3682431f59cf1ad9a0f624114b135135aa44
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri Apr 5 11:18:35 2013 +1100
-
-       - dtucker@cvs.openbsd.org 2013/02/22 04:45:09
-         [ssh.c readconf.c readconf.h]
-         Don't complain if IdentityFiles specified in system-wide configs are
-         missing.  ok djm, deraadt
-
-commit f3c38142435622d056582e851579d8647a233c7f
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri Apr 5 11:16:52 2013 +1100
-
-       - dtucker@cvs.openbsd.org 2013/02/19 02:12:47
-         [krl.c]
-         Remove bogus include.  ok djm
-    (id sync only)
-
-commit 1910478c2d2c3d0e1edacaeff21ed388d70759e9
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri Apr 5 11:13:08 2013 +1100
-
-       - dtucker@cvs.openbsd.org 2013/02/17 23:16:57
-         [readconf.c ssh.c readconf.h sshconnect2.c]
-         Keep track of which IndentityFile options were manually supplied and which
-         were default options, and don't warn if the latter are missing.
-         ok markus@
-
-commit c9627cdbc65b25da943f24e6a953da899f08eefc
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Mon Apr 1 12:40:48 2013 +1100
-
-     - (dtucker) [openbsd-compat/bsd-cygwin_util.{c,h}] Don't include windows.h
-       to avoid conflicting definitions of __int64, adding the required bits.
-       Patch from Corinna Vinschen.
-
-commit 75db01d2ce29a85f8e5a2aff2011446896cf3f8a
-Author: Tim Rice <tim@multitalents.net>
-Date:   Fri Mar 22 10:14:32 2013 -0700
-
-     - (tim) [Makefile.in] remove some duplication introduced in 20130220 commit.
-
-commit 221b4b2436ac78a65c3b775c25ccd396a1fed208
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri Mar 22 12:51:09 2013 +1100
-
-     - (dtucker) [includes.h] Check if _GNU_SOURCE is already defined before
-       defining it again.  Prevents warnings if someone, eg, sets it in CFLAGS.
-
-commit c8a0f27c6d761d1335d13ed84d773e9ddf1d95c8
-Author: Darren Tucker <dtucker@zip.com.au>
-Date:   Fri Mar 22 12:49:14 2013 +1100
-
-     - (dtucker) [configure.ac] Add stdlib.h to zlib check for exit() prototype.
-
-commit eed8dc261018aea4d6b8606ca3addc9f8cf9ed1e
-Author: Damien Miller <djm@mindrot.org>
-Date:   Fri Mar 22 10:25:22 2013 +1100
-
-     - (djm) Release 6.2p1
-
-commit 83efe7c86168cc07b8e6cc6df6b54f7ace3b64a3
-Author: Damien Miller <djm@mindrot.org>
-Date:   Fri Mar 22 10:17:36 2013 +1100
-
-     - (djm) [contrib/ssh-copy-id contrib/ssh-copy-id.1] Updated to Phil
-        Hands' greatly revised version.
-
-commit 63b4bcd04e1c57b77eabb4e4d359508a4b2af685
-Author: Damien Miller <djm@mindrot.org>
-Date:   Wed Mar 20 12:55:14 2013 +1100
-
-     - (djm) [configure.ac log.c scp.c sshconnect2.c openbsd-compat/vis.c]
-       [openbsd-compat/vis.h] FreeBSD's strnvis isn't compatible with OpenBSD's
-       so mark it as broken. Patch from des AT des.no