summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--ChangeLog249
-rw-r--r--README6
-rw-r--r--auth.c4
-rw-r--r--compat.c15
-rw-r--r--contrib/README2
-rw-r--r--contrib/redhat/openssh.spec2
-rw-r--r--contrib/suse/openssh.spec2
-rw-r--r--dns.c4
-rw-r--r--mux.c6
-rw-r--r--packet.c6
-rw-r--r--sftp-server.c6
-rw-r--r--sftp.c6
-rw-r--r--ssh-keygen.06
-rw-r--r--ssh-keygen.18
-rw-r--r--ssh-keygen.c5
-rw-r--r--ssh-pkcs11-helper.c6
-rw-r--r--ssh_config.04
-rw-r--r--ssh_config.56
-rw-r--r--sshconnect.c4
-rw-r--r--sshd.c4
-rw-r--r--sshd_config.08
-rw-r--r--sshd_config.510
-rw-r--r--sshkey.c3
-rw-r--r--version.h4
24 files changed, 191 insertions, 185 deletions
diff --git a/ChangeLog b/ChangeLog
index ed0502115..0e0dd8787 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,121 @@
1commit e91346dc2bbf460246df2ab591b7613908c1b0ad
2Author: Damien Miller <djm@mindrot.org>
3Date: Fri Aug 21 14:49:03 2015 +1000
4
5 we don't use Github for issues/pull-requests
6
7commit a4f5b507c708cc3dc2c8dd2d02e4416d7514dc23
8Author: Damien Miller <djm@mindrot.org>
9Date: Fri Aug 21 14:43:55 2015 +1000
10
11 fix URL for connect.c
12
13commit d026a8d3da0f8186598442997c7d0a28e7275414
14Author: Damien Miller <djm@mindrot.org>
15Date: Fri Aug 21 13:47:10 2015 +1000
16
17 update version numbers for 7.1
18
19commit 78f8f589f0ca1c9f41e5a9bae3cda5ce8a6b42ed
20Author: djm@openbsd.org <djm@openbsd.org>
21Date: Fri Aug 21 03:45:26 2015 +0000
22
23 upstream commit
24
25 openssh-7.1
26
27 Upstream-ID: ff7b1ef4b06caddfb45e08ba998128c88be3d73f
28
29commit 32a181980c62fce94f7f9ffaf6a79d90f0c309cf
30Author: djm@openbsd.org <djm@openbsd.org>
31Date: Fri Aug 21 03:42:19 2015 +0000
32
33 upstream commit
34
35 fix inverted logic that broke PermitRootLogin; reported
36 by Mantas Mikulenas; ok markus@
37
38 Upstream-ID: 260dd6a904c1bb7e43267e394b1c9cf70bdd5ea5
39
40commit ce445b0ed927e45bd5bdce8f836eb353998dd65c
41Author: deraadt@openbsd.org <deraadt@openbsd.org>
42Date: Thu Aug 20 22:32:42 2015 +0000
43
44 upstream commit
45
46 Do not cast result of malloc/calloc/realloc* if stdlib.h
47 is in scope ok krw millert
48
49 Upstream-ID: 5e50ded78cadf3841556649a16cc4b1cb6c58667
50
51commit 05291e5288704d1a98bacda269eb5a0153599146
52Author: naddy@openbsd.org <naddy@openbsd.org>
53Date: Thu Aug 20 19:20:06 2015 +0000
54
55 upstream commit
56
57 In the certificates section, be consistent about using
58 "host_key" and "user_key" for the respective key types. ok sthen@ deraadt@
59
60 Upstream-ID: 9e037ea3b15577b238604c5533e082a3947f13cb
61
62commit 8543d4ef6f2e9f98c3e6b77c894ceec30c5e4ae4
63Author: djm@openbsd.org <djm@openbsd.org>
64Date: Wed Aug 19 23:21:42 2015 +0000
65
66 upstream commit
67
68 Better compat matching for WinSCP, add compat matching
69 for FuTTY (fork of PuTTY); ok markus@ deraadt@
70
71 Upstream-ID: 24001d1ac115fa3260fbdc329a4b9aeb283c5389
72
73commit ec6eda16ebab771aa3dfc90629b41953b999cb1e
74Author: djm@openbsd.org <djm@openbsd.org>
75Date: Wed Aug 19 23:19:01 2015 +0000
76
77 upstream commit
78
79 fix double-free() in error path of DSA key generation
80 reported by Mateusz Kocielski; ok markus@
81
82 Upstream-ID: 4735d8f888b10599a935fa1b374787089116713c
83
84commit 45b0eb752c94954a6de046bfaaf129e518ad4b5b
85Author: djm@openbsd.org <djm@openbsd.org>
86Date: Wed Aug 19 23:18:26 2015 +0000
87
88 upstream commit
89
90 fix free() of uninitialised pointer reported by Mateusz
91 Kocielski; ok markus@
92
93 Upstream-ID: 519552b050618501a06b7b023de5cb104e2c5663
94
95commit c837643b93509a3ef538cb6624b678c5fe32ff79
96Author: djm@openbsd.org <djm@openbsd.org>
97Date: Wed Aug 19 23:17:51 2015 +0000
98
99 upstream commit
100
101 fixed unlink([uninitialised memory]) reported by Mateusz
102 Kocielski; ok markus@
103
104 Upstream-ID: 14a0c4e7d891f5a8dabc4b89d4f6b7c0d5a20109
105
106commit 1f8d3d629cd553031021068eb9c646a5f1e50994
107Author: jmc@openbsd.org <jmc@openbsd.org>
108Date: Fri Aug 14 15:32:41 2015 +0000
109
110 upstream commit
111
112 match myproposal.h order; from brian conway (i snuck in a
113 tweak while here)
114
115 ok dtucker
116
117 Upstream-ID: 35174a19b5237ea36aa3798f042bf5933b772c67
118
1commit 1dc8d93ce69d6565747eb44446ed117187621b26 119commit 1dc8d93ce69d6565747eb44446ed117187621b26
2Author: deraadt@openbsd.org <deraadt@openbsd.org> 120Author: deraadt@openbsd.org <deraadt@openbsd.org>
3Date: Thu Aug 6 14:53:21 2015 +0000 121Date: Thu Aug 6 14:53:21 2015 +0000
@@ -9013,134 +9131,3 @@ Date: Wed Aug 28 12:49:43 2013 +1000
9013 - (djm) [openbsd-compat/bsd-snprintf.c] teach our local snprintf code the 9131 - (djm) [openbsd-compat/bsd-snprintf.c] teach our local snprintf code the
9014 'j' (intmax_t/uintmax_t) and 'z' (size_t/ssize_t) conversions in case we 9132 'j' (intmax_t/uintmax_t) and 'z' (size_t/ssize_t) conversions in case we
9015 start to use them in the future. 9133 start to use them in the future.
9016
9017commit f2f6c315a920a256937e1b6a3702757f3195a592
9018Author: Damien Miller <djm@mindrot.org>
9019Date: Wed Aug 21 02:44:58 2013 +1000
9020
9021 - jmc@cvs.openbsd.org 2013/08/20 06:56:07
9022 [ssh.1 ssh_config.5]
9023 some proxyusefdpass tweaks;
9024
9025commit 1262b6638f7d01ab110fd373dd90d915c882fe1a
9026Author: Damien Miller <djm@mindrot.org>
9027Date: Wed Aug 21 02:44:24 2013 +1000
9028
9029 - djm@cvs.openbsd.org 2013/08/20 00:11:38
9030 [readconf.c readconf.h ssh_config.5 sshconnect.c]
9031 Add a ssh_config ProxyUseFDPass option that supports the use of
9032 ProxyCommands that establish a connection and then pass a connected
9033 file descriptor back to ssh(1). This allows the ProxyCommand to exit
9034 rather than have to shuffle data back and forth and enables ssh to use
9035 getpeername, etc. to obtain address information just like it does with
9036 regular directly-connected sockets. ok markus@
9037
9038commit b7727df37efde4dbe4f5a33b19cbf42022aabf66
9039Author: Damien Miller <djm@mindrot.org>
9040Date: Wed Aug 21 02:43:49 2013 +1000
9041
9042 - jmc@cvs.openbsd.org 2013/08/14 08:39:27
9043 [scp.1 ssh.1]
9044 some Bx/Ox conversion;
9045 From: Jan Stary
9046
9047commit d5d9d7b1fdacf0551de4c747728bd159be40590a
9048Author: Damien Miller <djm@mindrot.org>
9049Date: Wed Aug 21 02:43:27 2013 +1000
9050
9051 - djm@cvs.openbsd.org 2013/08/13 18:33:08
9052 [ssh-keygen.c]
9053 another of the same typo
9054
9055commit d234afb0b3a8de1be78cbeafed5fc86912594c3c
9056Author: Damien Miller <djm@mindrot.org>
9057Date: Wed Aug 21 02:42:58 2013 +1000
9058
9059 - djm@cvs.openbsd.org 2013/08/13 18:32:08
9060 [ssh-keygen.c]
9061 typo in error message; from Stephan Rickauer
9062
9063commit e0ee727b8281a7c2ae20630ce83f6b200b404059
9064Author: Damien Miller <djm@mindrot.org>
9065Date: Wed Aug 21 02:42:35 2013 +1000
9066
9067 - djm@cvs.openbsd.org 2013/08/09 03:56:42
9068 [sftp.c]
9069 enable ctrl-left-arrow and ctrl-right-arrow to move forward/back a word;
9070 matching ksh's relatively recent change.
9071
9072commit fec029f1dc2c338f3fae3fa82aabc988dc07868c
9073Author: Damien Miller <djm@mindrot.org>
9074Date: Wed Aug 21 02:42:12 2013 +1000
9075
9076 - djm@cvs.openbsd.org 2013/08/09 03:39:13
9077 [sftp-client.c]
9078 two problems found by a to-be-committed regress test: 1) msg_id was not
9079 being initialised so was starting at a random value from the heap
9080 (harmless, but confusing). 2) some error conditions were not being
9081 propagated back to the caller
9082
9083commit 036d30743fc914089f9849ca52d615891d47e616
9084Author: Damien Miller <djm@mindrot.org>
9085Date: Wed Aug 21 02:41:46 2013 +1000
9086
9087 - djm@cvs.openbsd.org 2013/08/09 03:37:25
9088 [sftp.c]
9089 do getopt parsing for all sftp commands (with an empty optstring for
9090 commands without arguments) to ensure consistent behaviour
9091
9092commit c7dba12bf95eb1d69711881a153cc286c1987663
9093Author: Damien Miller <djm@mindrot.org>
9094Date: Wed Aug 21 02:41:15 2013 +1000
9095
9096 - djm@cvs.openbsd.org 2013/08/08 05:04:03
9097 [sftp-client.c sftp-client.h sftp.c]
9098 add a "-l" flag for the rename command to force it to use the silly
9099 standard SSH_FXP_RENAME command instead of the POSIX-rename- like
9100 posix-rename@openssh.com extension.
9101
9102 intended for use in regress tests, so no documentation.
9103
9104commit 034f27a0c09e69fe3589045b41f03f6e345b63f5
9105Author: Damien Miller <djm@mindrot.org>
9106Date: Wed Aug 21 02:40:44 2013 +1000
9107
9108 - djm@cvs.openbsd.org 2013/08/08 04:52:04
9109 [sftp.c]
9110 fix two year old regression: symlinking a file would incorrectly
9111 canonicalise the target path. bz#2129 report from delphij AT freebsd.org
9112
9113commit c6895c5c67492144dd28589e5788f783be9152ed
9114Author: Damien Miller <djm@mindrot.org>
9115Date: Wed Aug 21 02:40:21 2013 +1000
9116
9117 - jmc@cvs.openbsd.org 2013/08/07 06:24:51
9118 [sftp.1 sftp.c]
9119 sort -a;
9120
9121commit a6d6c1f38ac9b4a5e1bd4df889e1020a8370ed55
9122Author: Damien Miller <djm@mindrot.org>
9123Date: Wed Aug 21 02:40:01 2013 +1000
9124
9125 - djm@cvs.openbsd.org 2013/08/06 23:06:01
9126 [servconf.c]
9127 add cast to avoid format warning; from portable
9128
9129commit eec840673bce3f69ad269672fba7ed8ff05f154f
9130Author: Damien Miller <djm@mindrot.org>
9131Date: Wed Aug 21 02:39:39 2013 +1000
9132
9133 - djm@cvs.openbsd.org 2013/08/06 23:05:01
9134 [sftp.1]
9135 document top-level -a option (the -a option to 'get' was already
9136 documented)
9137
9138commit 02e878070d0eddad4e11f2c82644b275418eb112
9139Author: Damien Miller <djm@mindrot.org>
9140Date: Wed Aug 21 02:38:51 2013 +1000
9141
9142 - djm@cvs.openbsd.org 2013/08/06 23:03:49
9143 [sftp.c]
9144 fix some whitespace at EOL
9145 make list of commands an enum rather than a long list of defines
9146 add -a to usage()
diff --git a/README b/README
index c566f7b1b..9bbd3bac2 100644
--- a/README
+++ b/README
@@ -1,4 +1,8 @@
1See http://www.openssh.com/txt/release-7.0 for the release notes. 1See http://www.openssh.com/txt/release-7.1 for the release notes.
2
3Please read http://www.openssh.com/report.html for bug reporting
4instructions and note that we do not use Github for bug reporting or
5patch/pull-request management.
2 6
3- A Japanese translation of this document and of the OpenSSH FAQ is 7- A Japanese translation of this document and of the OpenSSH FAQ is
4- available at http://www.unixuser.org/~haruyama/security/openssh/index.html 8- available at http://www.unixuser.org/~haruyama/security/openssh/index.html
diff --git a/auth.c b/auth.c
index fc32f6c4b..214c2c708 100644
--- a/auth.c
+++ b/auth.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: auth.c,v 1.112 2015/08/06 14:53:21 deraadt Exp $ */ 1/* $OpenBSD: auth.c,v 1.113 2015/08/21 03:42:19 djm Exp $ */
2/* 2/*
3 * Copyright (c) 2000 Markus Friedl. All rights reserved. 3 * Copyright (c) 2000 Markus Friedl. All rights reserved.
4 * 4 *
@@ -354,7 +354,7 @@ auth_root_allowed(const char *method)
354 case PERMIT_NO_PASSWD: 354 case PERMIT_NO_PASSWD:
355 if (strcmp(method, "publickey") == 0 || 355 if (strcmp(method, "publickey") == 0 ||
356 strcmp(method, "hostbased") == 0 || 356 strcmp(method, "hostbased") == 0 ||
357 strcmp(method, "gssapi-with-mic")) 357 strcmp(method, "gssapi-with-mic") == 0)
358 return 1; 358 return 1;
359 break; 359 break;
360 case PERMIT_FORCED_ONLY: 360 case PERMIT_FORCED_ONLY:
diff --git a/compat.c b/compat.c
index eef5fbba5..55838044c 100644
--- a/compat.c
+++ b/compat.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: compat.c,v 1.96 2015/07/28 23:20:42 djm Exp $ */ 1/* $OpenBSD: compat.c,v 1.97 2015/08/19 23:21:42 djm Exp $ */
2/* 2/*
3 * Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl. All rights reserved. 3 * Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl. All rights reserved.
4 * 4 *
@@ -176,6 +176,7 @@ compat_datafellows(const char *version)
176 "PuTTY_Release_0.63*," 176 "PuTTY_Release_0.63*,"
177 "PuTTY_Release_0.64*", 177 "PuTTY_Release_0.64*",
178 SSH_OLD_DHGEX }, 178 SSH_OLD_DHGEX },
179 { "FuTTY*", SSH_OLD_DHGEX }, /* Putty Fork */
179 { "Probe-*", 180 { "Probe-*",
180 SSH_BUG_PROBE }, 181 SSH_BUG_PROBE },
181 { "TeraTerm SSH*," 182 { "TeraTerm SSH*,"
@@ -189,7 +190,17 @@ compat_datafellows(const char *version)
189 "TTSSH/2.70*," 190 "TTSSH/2.70*,"
190 "TTSSH/2.71*," 191 "TTSSH/2.71*,"
191 "TTSSH/2.72*", SSH_BUG_HOSTKEYS }, 192 "TTSSH/2.72*", SSH_BUG_HOSTKEYS },
192 { "WinSCP*", SSH_OLD_DHGEX }, 193 { "WinSCP_release_4*,"
194 "WinSCP_release_5.0*,"
195 "WinSCP_release_5.1*,"
196 "WinSCP_release_5.5*,"
197 "WinSCP_release_5.6*,"
198 "WinSCP_release_5.7,"
199 "WinSCP_release_5.7.1,"
200 "WinSCP_release_5.7.2,"
201 "WinSCP_release_5.7.3,"
202 "WinSCP_release_5.7.4",
203 SSH_OLD_DHGEX },
193 { NULL, 0 } 204 { NULL, 0 }
194 }; 205 };
195 206
diff --git a/contrib/README b/contrib/README
index c00223865..60e19ba9f 100644
--- a/contrib/README
+++ b/contrib/README
@@ -11,7 +11,7 @@ which allows the use of outbound SSH from behind a SOCKS4, SOCKS5 or
11https CONNECT style proxy server. His page for connect.c has extensive 11https CONNECT style proxy server. His page for connect.c has extensive
12documentation on its use as well as compiled versions for Win32. 12documentation on its use as well as compiled versions for Win32.
13 13
14http://www.taiyo.co.jp/~gotoh/ssh/connect.html 14https://bitbucket.org/gotoh/connect/wiki/Home
15 15
16 16
17X11 SSH Askpass: 17X11 SSH Askpass:
diff --git a/contrib/redhat/openssh.spec b/contrib/redhat/openssh.spec
index 5de787555..5b27106fb 100644
--- a/contrib/redhat/openssh.spec
+++ b/contrib/redhat/openssh.spec
@@ -1,4 +1,4 @@
1%define ver 7.0p1 1%define ver 7.1p1
2%define rel 1 2%define rel 1
3 3
4# OpenSSH privilege separation requires a user & group ID 4# OpenSSH privilege separation requires a user & group ID
diff --git a/contrib/suse/openssh.spec b/contrib/suse/openssh.spec
index dd9692da1..596895882 100644
--- a/contrib/suse/openssh.spec
+++ b/contrib/suse/openssh.spec
@@ -13,7 +13,7 @@
13 13
14Summary: OpenSSH, a free Secure Shell (SSH) protocol implementation 14Summary: OpenSSH, a free Secure Shell (SSH) protocol implementation
15Name: openssh 15Name: openssh
16Version: 7.0p1 16Version: 7.1p1
17URL: http://www.openssh.com/ 17URL: http://www.openssh.com/
18Release: 1 18Release: 1
19Source0: openssh-%{version}.tar.gz 19Source0: openssh-%{version}.tar.gz
diff --git a/dns.c b/dns.c
index f201b602e..e813afeae 100644
--- a/dns.c
+++ b/dns.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: dns.c,v 1.34 2015/01/28 22:36:00 djm Exp $ */ 1/* $OpenBSD: dns.c,v 1.35 2015/08/20 22:32:42 deraadt Exp $ */
2 2
3/* 3/*
4 * Copyright (c) 2003 Wesley Griffin. All rights reserved. 4 * Copyright (c) 2003 Wesley Griffin. All rights reserved.
@@ -154,7 +154,7 @@ dns_read_rdata(u_int8_t *algorithm, u_int8_t *digest_type,
154 *digest_len = rdata_len - 2; 154 *digest_len = rdata_len - 2;
155 155
156 if (*digest_len > 0) { 156 if (*digest_len > 0) {
157 *digest = (u_char *) xmalloc(*digest_len); 157 *digest = xmalloc(*digest_len);
158 memcpy(*digest, rdata + 2, *digest_len); 158 memcpy(*digest, rdata + 2, *digest_len);
159 } else { 159 } else {
160 *digest = (u_char *)xstrdup(""); 160 *digest = (u_char *)xstrdup("");
diff --git a/mux.c b/mux.c
index cdc01bd4f..e6136fd28 100644
--- a/mux.c
+++ b/mux.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: mux.c,v 1.53 2015/05/01 04:03:20 djm Exp $ */ 1/* $OpenBSD: mux.c,v 1.54 2015/08/19 23:18:26 djm Exp $ */
2/* 2/*
3 * Copyright (c) 2002-2008 Damien Miller <djm@openbsd.org> 3 * Copyright (c) 2002-2008 Damien Miller <djm@openbsd.org>
4 * 4 *
@@ -665,6 +665,8 @@ process_mux_open_fwd(u_int rid, Channel *c, Buffer *m, Buffer *r)
665 u_int lport, cport; 665 u_int lport, cport;
666 int i, ret = 0, freefwd = 1; 666 int i, ret = 0, freefwd = 1;
667 667
668 memset(&fwd, 0, sizeof(fwd));
669
668 /* XXX - lport/cport check redundant */ 670 /* XXX - lport/cport check redundant */
669 if (buffer_get_int_ret(&ftype, m) != 0 || 671 if (buffer_get_int_ret(&ftype, m) != 0 ||
670 (listen_addr = buffer_get_string_ret(m, NULL)) == NULL || 672 (listen_addr = buffer_get_string_ret(m, NULL)) == NULL ||
@@ -832,6 +834,8 @@ process_mux_close_fwd(u_int rid, Channel *c, Buffer *m, Buffer *r)
832 int i, ret = 0; 834 int i, ret = 0;
833 u_int lport, cport; 835 u_int lport, cport;
834 836
837 memset(&fwd, 0, sizeof(fwd));
838
835 if (buffer_get_int_ret(&ftype, m) != 0 || 839 if (buffer_get_int_ret(&ftype, m) != 0 ||
836 (listen_addr = buffer_get_string_ret(m, NULL)) == NULL || 840 (listen_addr = buffer_get_string_ret(m, NULL)) == NULL ||
837 buffer_get_int_ret(&lport, m) != 0 || 841 buffer_get_int_ret(&lport, m) != 0 ||
diff --git a/packet.c b/packet.c
index 6008c2d94..01d3e2970 100644
--- a/packet.c
+++ b/packet.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: packet.c,v 1.213 2015/07/29 04:43:06 djm Exp $ */ 1/* $OpenBSD: packet.c,v 1.214 2015/08/20 22:32:42 deraadt Exp $ */
2/* 2/*
3 * Author: Tatu Ylonen <ylo@cs.hut.fi> 3 * Author: Tatu Ylonen <ylo@cs.hut.fi>
4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -1272,7 +1272,7 @@ ssh_packet_read_seqnr(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
1272 1272
1273 DBG(debug("packet_read()")); 1273 DBG(debug("packet_read()"));
1274 1274
1275 setp = (fd_set *)calloc(howmany(state->connection_in + 1, 1275 setp = calloc(howmany(state->connection_in + 1,
1276 NFDBITS), sizeof(fd_mask)); 1276 NFDBITS), sizeof(fd_mask));
1277 if (setp == NULL) 1277 if (setp == NULL)
1278 return SSH_ERR_ALLOC_FAIL; 1278 return SSH_ERR_ALLOC_FAIL;
@@ -2036,7 +2036,7 @@ ssh_packet_write_wait(struct ssh *ssh)
2036 struct timeval start, timeout, *timeoutp = NULL; 2036 struct timeval start, timeout, *timeoutp = NULL;
2037 struct session_state *state = ssh->state; 2037 struct session_state *state = ssh->state;
2038 2038
2039 setp = (fd_set *)calloc(howmany(state->connection_out + 1, 2039 setp = calloc(howmany(state->connection_out + 1,
2040 NFDBITS), sizeof(fd_mask)); 2040 NFDBITS), sizeof(fd_mask));
2041 if (setp == NULL) 2041 if (setp == NULL)
2042 return SSH_ERR_ALLOC_FAIL; 2042 return SSH_ERR_ALLOC_FAIL;
diff --git a/sftp-server.c b/sftp-server.c
index d1831bf8d..eac11d7e6 100644
--- a/sftp-server.c
+++ b/sftp-server.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: sftp-server.c,v 1.106 2015/04/24 01:36:01 deraadt Exp $ */ 1/* $OpenBSD: sftp-server.c,v 1.107 2015/08/20 22:32:42 deraadt Exp $ */
2/* 2/*
3 * Copyright (c) 2000-2004 Markus Friedl. All rights reserved. 3 * Copyright (c) 2000-2004 Markus Friedl. All rights reserved.
4 * 4 *
@@ -1632,8 +1632,8 @@ sftp_server_main(int argc, char **argv, struct passwd *user_pw)
1632 fatal("%s: sshbuf_new failed", __func__); 1632 fatal("%s: sshbuf_new failed", __func__);
1633 1633
1634 set_size = howmany(max + 1, NFDBITS) * sizeof(fd_mask); 1634 set_size = howmany(max + 1, NFDBITS) * sizeof(fd_mask);
1635 rset = (fd_set *)xmalloc(set_size); 1635 rset = xmalloc(set_size);
1636 wset = (fd_set *)xmalloc(set_size); 1636 wset = xmalloc(set_size);
1637 1637
1638 if (homedir != NULL) { 1638 if (homedir != NULL) {
1639 if (chdir(homedir) != 0) { 1639 if (chdir(homedir) != 0) {
diff --git a/sftp.c b/sftp.c
index cb9b967ed..788601a8d 100644
--- a/sftp.c
+++ b/sftp.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: sftp.c,v 1.170 2015/01/20 23:14:00 deraadt Exp $ */ 1/* $OpenBSD: sftp.c,v 1.171 2015/08/20 22:32:42 deraadt Exp $ */
2/* 2/*
3 * Copyright (c) 2001-2004 Damien Miller <djm@openbsd.org> 3 * Copyright (c) 2001-2004 Damien Miller <djm@openbsd.org>
4 * 4 *
@@ -1958,7 +1958,7 @@ complete(EditLine *el, int ch)
1958 1958
1959 /* Figure out which argument the cursor points to */ 1959 /* Figure out which argument the cursor points to */
1960 cursor = lf->cursor - lf->buffer; 1960 cursor = lf->cursor - lf->buffer;
1961 line = (char *)xmalloc(cursor + 1); 1961 line = xmalloc(cursor + 1);
1962 memcpy(line, lf->buffer, cursor); 1962 memcpy(line, lf->buffer, cursor);
1963 line[cursor] = '\0'; 1963 line[cursor] = '\0';
1964 argv = makeargv(line, &carg, 1, &quote, &terminated); 1964 argv = makeargv(line, &carg, 1, &quote, &terminated);
@@ -1966,7 +1966,7 @@ complete(EditLine *el, int ch)
1966 1966
1967 /* Get all the arguments on the line */ 1967 /* Get all the arguments on the line */
1968 len = lf->lastchar - lf->buffer; 1968 len = lf->lastchar - lf->buffer;
1969 line = (char *)xmalloc(len + 1); 1969 line = xmalloc(len + 1);
1970 memcpy(line, lf->buffer, len); 1970 memcpy(line, lf->buffer, len);
1971 line[len] = '\0'; 1971 line[len] = '\0';
1972 argv = makeargv(line, &argc, 1, NULL, NULL); 1972 argv = makeargv(line, &argc, 1, NULL, NULL);
diff --git a/ssh-keygen.0 b/ssh-keygen.0
index a471a4055..07a45b36b 100644
--- a/ssh-keygen.0
+++ b/ssh-keygen.0
@@ -426,7 +426,7 @@ CERTIFICATES
426 providing the token library using -D and identifying the CA key by 426 providing the token library using -D and identifying the CA key by
427 providing its public half as an argument to -s: 427 providing its public half as an argument to -s:
428 428
429 $ ssh-keygen -s ca_key.pub -D libpkcs11.so -I key_id host_key.pub 429 $ ssh-keygen -s ca_key.pub -D libpkcs11.so -I key_id user_key.pub
430 430
431 In all cases, key_id is a "key identifier" that is logged by the server 431 In all cases, key_id is a "key identifier" that is logged by the server
432 when the certificate is used for authentication. 432 when the certificate is used for authentication.
@@ -437,7 +437,7 @@ CERTIFICATES
437 principals: 437 principals:
438 438
439 $ ssh-keygen -s ca_key -I key_id -n user1,user2 user_key.pub 439 $ ssh-keygen -s ca_key -I key_id -n user1,user2 user_key.pub
440 $ ssh-keygen -s ca_key -I key_id -h -n host.domain user_key.pub 440 $ ssh-keygen -s ca_key -I key_id -h -n host.domain host_key.pub
441 441
442 Additional limitations on the validity and use of user certificates may 442 Additional limitations on the validity and use of user certificates may
443 be specified through certificate options. A certificate option may 443 be specified through certificate options. A certificate option may
@@ -563,4 +563,4 @@ AUTHORS
563 created OpenSSH. Markus Friedl contributed the support for SSH protocol 563 created OpenSSH. Markus Friedl contributed the support for SSH protocol
564 versions 1.5 and 2.0. 564 versions 1.5 and 2.0.
565 565
566OpenBSD 5.8 July 3, 2015 OpenBSD 5.8 566OpenBSD 5.8 August 20, 2015 OpenBSD 5.8
diff --git a/ssh-keygen.1 b/ssh-keygen.1
index 8c3317be7..ed17a08fa 100644
--- a/ssh-keygen.1
+++ b/ssh-keygen.1
@@ -1,4 +1,4 @@
1.\" $OpenBSD: ssh-keygen.1,v 1.126 2015/07/03 03:49:45 djm Exp $ 1.\" $OpenBSD: ssh-keygen.1,v 1.127 2015/08/20 19:20:06 naddy Exp $
2.\" 2.\"
3.\" Author: Tatu Ylonen <ylo@cs.hut.fi> 3.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
4.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -35,7 +35,7 @@
35.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 35.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
36.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 36.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
37.\" 37.\"
38.Dd $Mdocdate: July 3 2015 $ 38.Dd $Mdocdate: August 20 2015 $
39.Dt SSH-KEYGEN 1 39.Dt SSH-KEYGEN 1
40.Os 40.Os
41.Sh NAME 41.Sh NAME
@@ -680,7 +680,7 @@ and identifying the CA key by providing its public half as an argument
680to 680to
681.Fl s : 681.Fl s :
682.Pp 682.Pp
683.Dl $ ssh-keygen -s ca_key.pub -D libpkcs11.so -I key_id host_key.pub 683.Dl $ ssh-keygen -s ca_key.pub -D libpkcs11.so -I key_id user_key.pub
684.Pp 684.Pp
685In all cases, 685In all cases,
686.Ar key_id 686.Ar key_id
@@ -693,7 +693,7 @@ By default, generated certificates are valid for all users or hosts.
693To generate a certificate for a specified set of principals: 693To generate a certificate for a specified set of principals:
694.Pp 694.Pp
695.Dl $ ssh-keygen -s ca_key -I key_id -n user1,user2 user_key.pub 695.Dl $ ssh-keygen -s ca_key -I key_id -n user1,user2 user_key.pub
696.Dl "$ ssh-keygen -s ca_key -I key_id -h -n host.domain user_key.pub" 696.Dl "$ ssh-keygen -s ca_key -I key_id -h -n host.domain host_key.pub"
697.Pp 697.Pp
698Additional limitations on the validity and use of user certificates may 698Additional limitations on the validity and use of user certificates may
699be specified through certificate options. 699be specified through certificate options.
diff --git a/ssh-keygen.c b/ssh-keygen.c
index ea5f1e49e..4e0a85554 100644
--- a/ssh-keygen.c
+++ b/ssh-keygen.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssh-keygen.c,v 1.276 2015/07/03 03:49:45 djm Exp $ */ 1/* $OpenBSD: ssh-keygen.c,v 1.277 2015/08/19 23:17:51 djm Exp $ */
2/* 2/*
3 * Author: Tatu Ylonen <ylo@cs.hut.fi> 3 * Author: Tatu Ylonen <ylo@cs.hut.fi>
4 * Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4 * Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -1201,7 +1201,8 @@ do_known_hosts(struct passwd *pw, const char *name)
1201 exit(1); 1201 exit(1);
1202 } else if (delete_host && !ctx.found_key) { 1202 } else if (delete_host && !ctx.found_key) {
1203 logit("Host %s not found in %s", name, identity_file); 1203 logit("Host %s not found in %s", name, identity_file);
1204 unlink(tmp); 1204 if (inplace)
1205 unlink(tmp);
1205 } else if (inplace) { 1206 } else if (inplace) {
1206 /* Backup existing file */ 1207 /* Backup existing file */
1207 if (unlink(old) == -1 && errno != ENOENT) 1208 if (unlink(old) == -1 && errno != ENOENT)
diff --git a/ssh-pkcs11-helper.c b/ssh-pkcs11-helper.c
index ceabc8ba7..f2d586395 100644
--- a/ssh-pkcs11-helper.c
+++ b/ssh-pkcs11-helper.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssh-pkcs11-helper.c,v 1.10 2015/01/20 23:14:00 deraadt Exp $ */ 1/* $OpenBSD: ssh-pkcs11-helper.c,v 1.11 2015/08/20 22:32:42 deraadt Exp $ */
2/* 2/*
3 * Copyright (c) 2010 Markus Friedl. All rights reserved. 3 * Copyright (c) 2010 Markus Friedl. All rights reserved.
4 * 4 *
@@ -301,8 +301,8 @@ main(int argc, char **argv)
301 buffer_init(&oqueue); 301 buffer_init(&oqueue);
302 302
303 set_size = howmany(max + 1, NFDBITS) * sizeof(fd_mask); 303 set_size = howmany(max + 1, NFDBITS) * sizeof(fd_mask);
304 rset = (fd_set *)xmalloc(set_size); 304 rset = xmalloc(set_size);
305 wset = (fd_set *)xmalloc(set_size); 305 wset = xmalloc(set_size);
306 306
307 for (;;) { 307 for (;;) {
308 memset(rset, 0, set_size); 308 memset(rset, 0, set_size);
diff --git a/ssh_config.0 b/ssh_config.0
index 654807779..67133cd4d 100644
--- a/ssh_config.0
+++ b/ssh_config.0
@@ -205,9 +205,9 @@ DESCRIPTION
205 205
206 The default is: 206 The default is:
207 207
208 chacha20-poly1305@openssh.com,
208 aes128-ctr,aes192-ctr,aes256-ctr, 209 aes128-ctr,aes192-ctr,aes256-ctr,
209 aes128-gcm@openssh.com,aes256-gcm@openssh.com, 210 aes128-gcm@openssh.com,aes256-gcm@openssh.com,
210 chacha20-poly1305@openssh.com,
211 arcfour256,arcfour128, 211 arcfour256,arcfour128,
212 aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc, 212 aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,
213 aes192-cbc,aes256-cbc,arcfour 213 aes192-cbc,aes256-cbc,arcfour
@@ -1023,4 +1023,4 @@ AUTHORS
1023 created OpenSSH. Markus Friedl contributed the support for SSH protocol 1023 created OpenSSH. Markus Friedl contributed the support for SSH protocol
1024 versions 1.5 and 2.0. 1024 versions 1.5 and 2.0.
1025 1025
1026OpenBSD 5.8 July 30, 2015 OpenBSD 5.8 1026OpenBSD 5.8 August 14, 2015 OpenBSD 5.8
diff --git a/ssh_config.5 b/ssh_config.5
index 5b0975f87..a47f3ca9e 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -33,8 +33,8 @@
33.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 33.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
34.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
35.\" 35.\"
36.\" $OpenBSD: ssh_config.5,v 1.214 2015/07/30 00:01:34 djm Exp $ 36.\" $OpenBSD: ssh_config.5,v 1.215 2015/08/14 15:32:41 jmc Exp $
37.Dd $Mdocdate: July 30 2015 $ 37.Dd $Mdocdate: August 14 2015 $
38.Dt SSH_CONFIG 5 38.Dt SSH_CONFIG 5
39.Os 39.Os
40.Sh NAME 40.Sh NAME
@@ -415,9 +415,9 @@ chacha20-poly1305@openssh.com
415.Pp 415.Pp
416The default is: 416The default is:
417.Bd -literal -offset indent 417.Bd -literal -offset indent
418chacha20-poly1305@openssh.com,
418aes128-ctr,aes192-ctr,aes256-ctr, 419aes128-ctr,aes192-ctr,aes256-ctr,
419aes128-gcm@openssh.com,aes256-gcm@openssh.com, 420aes128-gcm@openssh.com,aes256-gcm@openssh.com,
420chacha20-poly1305@openssh.com,
421arcfour256,arcfour128, 421arcfour256,arcfour128,
422aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc, 422aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,
423aes192-cbc,aes256-cbc,arcfour 423aes192-cbc,aes256-cbc,arcfour
diff --git a/sshconnect.c b/sshconnect.c
index f41960c5d..17fbe39b0 100644
--- a/sshconnect.c
+++ b/sshconnect.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: sshconnect.c,v 1.262 2015/05/28 05:41:29 dtucker Exp $ */ 1/* $OpenBSD: sshconnect.c,v 1.263 2015/08/20 22:32:42 deraadt Exp $ */
2/* 2/*
3 * Author: Tatu Ylonen <ylo@cs.hut.fi> 3 * Author: Tatu Ylonen <ylo@cs.hut.fi>
4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -356,7 +356,7 @@ timeout_connect(int sockfd, const struct sockaddr *serv_addr,
356 goto done; 356 goto done;
357 } 357 }
358 358
359 fdset = (fd_set *)xcalloc(howmany(sockfd + 1, NFDBITS), 359 fdset = xcalloc(howmany(sockfd + 1, NFDBITS),
360 sizeof(fd_mask)); 360 sizeof(fd_mask));
361 FD_SET(sockfd, fdset); 361 FD_SET(sockfd, fdset);
362 ms_to_timeval(&tv, *timeoutp); 362 ms_to_timeval(&tv, *timeoutp);
diff --git a/sshd.c b/sshd.c
index c7dd8cb7a..65ef7e850 100644
--- a/sshd.c
+++ b/sshd.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: sshd.c,v 1.457 2015/07/30 00:01:34 djm Exp $ */ 1/* $OpenBSD: sshd.c,v 1.458 2015/08/20 22:32:42 deraadt Exp $ */
2/* 2/*
3 * Author: Tatu Ylonen <ylo@cs.hut.fi> 3 * Author: Tatu Ylonen <ylo@cs.hut.fi>
4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -1253,7 +1253,7 @@ server_accept_loop(int *sock_in, int *sock_out, int *newsock, int *config_s)
1253 sighup_restart(); 1253 sighup_restart();
1254 if (fdset != NULL) 1254 if (fdset != NULL)
1255 free(fdset); 1255 free(fdset);
1256 fdset = (fd_set *)xcalloc(howmany(maxfd + 1, NFDBITS), 1256 fdset = xcalloc(howmany(maxfd + 1, NFDBITS),
1257 sizeof(fd_mask)); 1257 sizeof(fd_mask));
1258 1258
1259 for (i = 0; i < num_listen_socks; i++) 1259 for (i = 0; i < num_listen_socks; i++)
diff --git a/sshd_config.0 b/sshd_config.0
index 1cc7459f8..aae7fb6af 100644
--- a/sshd_config.0
+++ b/sshd_config.0
@@ -286,9 +286,9 @@ DESCRIPTION
286 286
287 The default is: 287 The default is:
288 288
289 chacha20-poly1305@openssh.com,
289 aes128-ctr,aes192-ctr,aes256-ctr, 290 aes128-ctr,aes192-ctr,aes256-ctr,
290 aes128-gcm@openssh.com,aes256-gcm@openssh.com, 291 aes128-gcm@openssh.com,aes256-gcm@openssh.com
291 chacha20-poly1305@openssh.com
292 292
293 The list of available ciphers may also be obtained using the -Q 293 The list of available ciphers may also be obtained using the -Q
294 option of ssh(1) with an argument of M-bM-^@M-^\cipherM-bM-^@M-^]. 294 option of ssh(1) with an argument of M-bM-^@M-^\cipherM-bM-^@M-^].
@@ -927,7 +927,7 @@ DESCRIPTION
927 927
928 If this option is set to M-bM-^@M-^\noM-bM-^@M-^] (the default) then only addresses 928 If this option is set to M-bM-^@M-^\noM-bM-^@M-^] (the default) then only addresses
929 and not host names may be used in ~/.ssh/known_hosts from and 929 and not host names may be used in ~/.ssh/known_hosts from and
930 sshd_config(5) Match Host directives. 930 sshd_config Match Host directives.
931 931
932 UseLogin 932 UseLogin
933 Specifies whether login(1) is used for interactive login 933 Specifies whether login(1) is used for interactive login
@@ -1049,4 +1049,4 @@ AUTHORS
1049 versions 1.5 and 2.0. Niels Provos and Markus Friedl contributed support 1049 versions 1.5 and 2.0. Niels Provos and Markus Friedl contributed support
1050 for privilege separation. 1050 for privilege separation.
1051 1051
1052OpenBSD 5.8 August 6, 2015 OpenBSD 5.8 1052OpenBSD 5.8 August 14, 2015 OpenBSD 5.8
diff --git a/sshd_config.5 b/sshd_config.5
index 58e277f95..b18d340af 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -33,8 +33,8 @@
33.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 33.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
34.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
35.\" 35.\"
36.\" $OpenBSD: sshd_config.5,v 1.210 2015/08/06 14:53:21 deraadt Exp $ 36.\" $OpenBSD: sshd_config.5,v 1.211 2015/08/14 15:32:41 jmc Exp $
37.Dd $Mdocdate: August 6 2015 $ 37.Dd $Mdocdate: August 14 2015 $
38.Dt SSHD_CONFIG 5 38.Dt SSHD_CONFIG 5
39.Os 39.Os
40.Sh NAME 40.Sh NAME
@@ -476,9 +476,9 @@ chacha20-poly1305@openssh.com
476.Pp 476.Pp
477The default is: 477The default is:
478.Bd -literal -offset indent 478.Bd -literal -offset indent
479chacha20-poly1305@openssh.com,
479aes128-ctr,aes192-ctr,aes256-ctr, 480aes128-ctr,aes192-ctr,aes256-ctr,
480aes128-gcm@openssh.com,aes256-gcm@openssh.com, 481aes128-gcm@openssh.com,aes256-gcm@openssh.com
481chacha20-poly1305@openssh.com
482.Ed 482.Ed
483.Pp 483.Pp
484The list of available ciphers may also be obtained using the 484The list of available ciphers may also be obtained using the
@@ -1528,7 +1528,7 @@ If this option is set to
1528.Pa ~/.ssh/known_hosts 1528.Pa ~/.ssh/known_hosts
1529.Cm from 1529.Cm from
1530and 1530and
1531.Xr sshd_config 5 1531.Nm
1532.Cm Match 1532.Cm Match
1533.Cm Host 1533.Cm Host
1534directives. 1534directives.
diff --git a/sshkey.c b/sshkey.c
index dbb16e2fd..32dd8f225 100644
--- a/sshkey.c
+++ b/sshkey.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: sshkey.c,v 1.20 2015/07/03 03:43:18 djm Exp $ */ 1/* $OpenBSD: sshkey.c,v 1.21 2015/08/19 23:19:01 djm Exp $ */
2/* 2/*
3 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. 3 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
4 * Copyright (c) 2008 Alexander von Gernler. All rights reserved. 4 * Copyright (c) 2008 Alexander von Gernler. All rights reserved.
@@ -1556,7 +1556,6 @@ dsa_generate_private_key(u_int bits, DSA **dsap)
1556 *dsap = NULL; 1556 *dsap = NULL;
1557 if (!DSA_generate_parameters_ex(private, bits, NULL, 0, NULL, 1557 if (!DSA_generate_parameters_ex(private, bits, NULL, 0, NULL,
1558 NULL, NULL) || !DSA_generate_key(private)) { 1558 NULL, NULL) || !DSA_generate_key(private)) {
1559 DSA_free(private);
1560 ret = SSH_ERR_LIBCRYPTO_ERROR; 1559 ret = SSH_ERR_LIBCRYPTO_ERROR;
1561 goto out; 1560 goto out;
1562 } 1561 }
diff --git a/version.h b/version.h
index 7a5dbc8a2..d917ca1f6 100644
--- a/version.h
+++ b/version.h
@@ -1,6 +1,6 @@
1/* $OpenBSD: version.h,v 1.74 2015/08/02 09:56:42 djm Exp $ */ 1/* $OpenBSD: version.h,v 1.75 2015/08/21 03:45:26 djm Exp $ */
2 2
3#define SSH_VERSION "OpenSSH_7.0" 3#define SSH_VERSION "OpenSSH_7.1"
4 4
5#define SSH_PORTABLE "p1" 5#define SSH_PORTABLE "p1"
6#define SSH_RELEASE SSH_VERSION SSH_PORTABLE 6#define SSH_RELEASE SSH_VERSION SSH_PORTABLE