* New upstream release (LP: #535029).

  - After a transition period of about 10 years, this release disables SSH
    protocol 1 by default.  Clients and servers that need to use the
    legacy protocol must explicitly enable it in ssh_config / sshd_config
    or on the command-line.
  - Remove the libsectok/OpenSC-based smartcard code and add support for
    PKCS#11 tokens.  This support is enabled by default in the Debian
    packaging, since it now doesn't involve additional library
    dependencies (closes: #231472, LP: #16918).
  - Add support for certificate authentication of users and hosts using a
    new, minimal OpenSSH certificate format (closes: #482806).
  - Added a 'netcat mode' to ssh(1): "ssh -W host:port ...".
  - Add the ability to revoke keys in sshd(8) and ssh(1).  (For the Debian
    package, this overlaps with the key blacklisting facility added in
    openssh 1:4.7p1-9, but with different file formats and slightly
    different scopes; for the moment, I've roughly merged the two.)
  - Various multiplexing improvements, including support for requesting
    port-forwardings via the multiplex protocol (closes: #360151).
  - Allow setting an explicit umask on the sftp-server(8) commandline to
    override whatever default the user has (closes: #496843).
  - Many sftp client improvements, including tab-completion, more options,
    and recursive transfer support for get/put (LP: #33378).  The old
    mget/mput commands never worked properly and have been removed
    (closes: #270399, #428082).
  - Do not prompt for a passphrase if we fail to open a keyfile, and log
    the reason why the open failed to debug (closes: #431538).
  - Prevent sftp from crashing when given a "-" without a command.  Also,
    allow whitespace to follow a "-" (closes: #531561).

1 files changed, 18 insertions, 18 deletions

diff --git a/debian/patches/debian-banner.patch b/debian/patches/debian-banner.patch
index a9b38e281..c0567f264 100644
--- a/debian/patches/debian-banner.patch
+++ b/debian/patches/debian-banner.patch
@@ -10,15 +10,15 @@ Index: b/servconf.c
 ===================================================================
 --- a/servconf.c
 +++ b/servconf.c
-@@ -132,6 +132,7 @@
-        options->adm_forced_command = NULL;
-        options->chroot_directory = NULL;
+@@ -135,6 +135,7 @@
         options->zero_knowledge_password_authentication = -1;
+        options->revoked_keys_file = NULL;
+        options->trusted_user_ca_keys = NULL;
 +       options->debian_banner = -1;
  }
  
  void
-@@ -273,6 +274,8 @@
+@@ -277,6 +278,8 @@
                 options->permit_tun = SSH_TUNMODE_NO;
         if (options->zero_knowledge_password_authentication == -1)
                 options->zero_knowledge_password_authentication = 0;
@@ -27,25 +27,25 @@ Index: b/servconf.c
  
         /* Turn privilege separation on by default */
         if (use_privsep == -1)
-@@ -320,6 +323,7 @@
-        sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
+@@ -325,6 +328,7 @@
         sUsePrivilegeSeparation, sAllowAgentForwarding,
-        sZeroKnowledgePasswordAuthentication,
+        sZeroKnowledgePasswordAuthentication, sHostCertificate,
+        sRevokedKeys, sTrustedUserCAKeys,
 +       sDebianBanner,
         sDeprecated, sUnsupported
  } ServerOpCodes;
  
-@@ -449,6 +453,7 @@
-        { "permitopen", sPermitOpen, SSHCFG_ALL },
-        { "forcecommand", sForceCommand, SSHCFG_ALL },
-        { "chrootdirectory", sChrootDirectory, SSHCFG_ALL },
+@@ -457,6 +461,7 @@
+        { "hostcertificate", sHostCertificate, SSHCFG_GLOBAL },
+        { "revokedkeys", sRevokedKeys, SSHCFG_ALL },
+        { "trustedusercakeys", sTrustedUserCAKeys, SSHCFG_ALL },
 +       { "debianbanner", sDebianBanner, SSHCFG_GLOBAL },
         { NULL, sBadOption, 0 }
  };
  
-@@ -1335,6 +1340,10 @@
-                        *charptr = xstrdup(arg);
-                break;
+@@ -1377,6 +1382,10 @@
+                charptr = &options->revoked_keys_file;
+                goto parse_filename;
  
 +       case sDebianBanner:
 +               intptr = &options->debian_banner;
@@ -58,20 +58,20 @@ Index: b/servconf.h
 ===================================================================
 --- a/servconf.h
 +++ b/servconf.h
-@@ -154,6 +154,8 @@
+@@ -157,6 +157,8 @@
  
         int     num_permitted_opens;
  
 +       int     debian_banner;
 +
         char   *chroot_directory;
- }       ServerOptions;
- 
+        char   *revoked_keys_file;
+        char   *trusted_user_ca_keys;
 Index: b/sshd.c
 ===================================================================
 --- a/sshd.c
 +++ b/sshd.c
-@@ -426,7 +426,8 @@
+@@ -422,7 +422,8 @@
                 minor = PROTOCOL_MINOR_1;
         }
         snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s%s", major, minor,