From nobody Fri Oct 07 14:04:36 2022 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4MkVRn24llz4dq6t; Fri, 7 Oct 2022 14:04:37 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4MkVRn1BQlz3rvW; Fri, 7 Oct 2022 14:04:37 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1665151477; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=aNsI3/MwHAmfpjVCdTkMWOm1puCJoJ6rP01SzNibL1A=; b=Brf84VWBbzE1cyqLPdoqdJUdQMChNPkJFsX71ElIEl5B1+lZ4UBh3dUY0MK29h/Py1o1up pxuOE51Xi7YuS6NpGoREZ2nS9IA31AAg7c48WNJ5jYJWU5rkDf5zzQrwOfDrlRQQ48XJlW ciqCwIS57T05xBkiVZ4SXZk5SpfkTzelHA5J8vhPSPkH1sSxWMM36pXRwIYBSzViEMznbL 0QJkc3qpKxmxdJyvnEndDrfDHRPpjtgF/bhV0Pv/7u418V9nvV6YIBpjx1MnurWQAlGR82 OIG0NeNBfX2JFtLOUdMBHiXuLT/BW03bnyj0i0J+iVcUzWX0l1cKERDhqeQWMQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4MkVRn08tBzcyK; Fri, 7 Oct 2022 14:04:37 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 297E4bu8047818; Fri, 7 Oct 2022 14:04:37 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 297E4aj7047817; Fri, 7 Oct 2022 14:04:36 GMT (envelope-from git) Date: Fri, 7 Oct 2022 14:04:36 GMT Message-Id: <202210071404.297E4aj7047817@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Ed Maste Subject: git: bcfd20915794 - stable/12 - ssh: update to OpenSSH v8.9p1 List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: emaste X-Git-Repository: src X-Git-Refname: refs/heads/stable/12 X-Git-Reftype: branch X-Git-Commit: bcfd209157947d63f959a729cfd978a6efd51a14 Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1665151477; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=aNsI3/MwHAmfpjVCdTkMWOm1puCJoJ6rP01SzNibL1A=; b=NKpPDDHLfE3VQMRddinjpn4wLyFGz7mLPCFERnQMT8NaN3fSIdC0OXt9RE0SUw20/metQE 7WjNVMu/WJbThAhJ2ffhGMuCpg1Je9HJ1f8GzpW8sh7Wh4tqsvxQLeqhARhwJr3PS3bfJn 8Yzd6VcWDdrstXvCykNVcmn3LN0rJq63GiYXMje+DJvzW8X6tR9+OzB+UnsuXzGxc2CClT ySW+ytkrTvUvT+DI8dza5in+LI7pG+hVCKIrkABDOZdLZqFKX3GK+9ejcC4Tjcy7sH2Ivk vDXws+9U17nRYXDoZIoIB97XWKV/O7ObcrGZ3NwFAD4SfJ38uYThWXRW9zZNnw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1665151477; a=rsa-sha256; cv=none; b=BVE4Q64VEjADCIkHlrBIq5vhYPBIpSMk/FG1fPEbv68dn+5aGUpjx8PfeYn/OQaqFL401H KRjgSgs2E8eXiTEKPjW1h1oxF3m1E1/awFgqn69R5JD7qkv2Oqv5wZY1IzxbKePKvDj5uV 77I/7+cabOeWT2vWtgHmQuejrwB1faHvGCbHUDLZh/Rnq1T9Uq4kqvi5GwPZ+Irc06kKkb /h/JhJqiGqRF7DkBsfvZONz8mUXB5xW6a5hTlL6IiksqsOSxH+0tP7mKT4U14m2DL4QZAa 12eZfhalrvltGPDS4asvjde92sgVGuxXdjX9liiVcgpNIgdDluS7RmzeZ80urQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch stable/12 has been updated by emaste: URL: https://cgit.FreeBSD.org/src/commit/?id=bcfd209157947d63f959a729cfd978a6efd51a14 commit bcfd209157947d63f959a729cfd978a6efd51a14 Author: Ed Maste AuthorDate: 2022-04-13 20:00:56 +0000 Commit: Ed Maste CommitDate: 2022-10-07 13:22:10 +0000 ssh: update to OpenSSH v8.9p1 Release notes are available at https://www.openssh.com/txt/release-8.9 Some highlights: * ssh(1), sshd(8), ssh-add(1), ssh-agent(1): add a system for restricting forwarding and use of keys added to ssh-agent(1) * ssh(1), sshd(8): add the sntrup761x25519-sha512@openssh.com hybrid ECDH/x25519 + Streamlined NTRU Prime post-quantum KEX to the default KEXAlgorithms list (after the ECDH methods but before the prime-group DH ones). The next release of OpenSSH is likely to make this key exchange the default method. * sshd(8), portable OpenSSH only: this release removes in-built support for MD5-hashed passwords. If you require these on your system then we recommend linking against libxcrypt or similar. Future deprecation notice ========================= A near-future release of OpenSSH will switch scp(1) from using the legacy scp/rcp protocol to using SFTP by default. Legacy scp/rcp performs wildcard expansion of remote filenames (e.g. "scp host:* .") through the remote shell. This has the side effect of requiring double quoting of shell meta-characters in file names included on scp(1) command-lines, otherwise they could be interpreted as shell commands on the remote side. MFC after: 1 month Relnotes: Yes Sponsored by: The FreeBSD Foundation (cherry picked from commit 1323ec571215a77ddd21294f0871979d5ad6b992) (cherry picked from commit 58def461e256e3a05c3ff15a87ed702fe0c3662c) (cherry picked from commit 6ac1039d047aafcaae5fec13504ece8fdc764c5a) --- crypto/openssh/.depend | 11 +- crypto/openssh/.github/configs | 76 +- crypto/openssh/.github/configure.sh | 17 +- crypto/openssh/.github/setup_ci.sh | 41 +- crypto/openssh/.github/workflows/c-cpp.yml | 24 +- crypto/openssh/.github/workflows/selfhosted.yml | 14 +- crypto/openssh/.github/workflows/upstream.yml | 3 +- crypto/openssh/.skipped-commit-ids | 1 + crypto/openssh/ChangeLog | 17378 +++++++++---------- crypto/openssh/INSTALL | 5 - crypto/openssh/LICENCE | 21 +- crypto/openssh/Makefile.in | 55 +- crypto/openssh/PROTOCOL | 69 +- crypto/openssh/PROTOCOL.agent | 85 +- crypto/openssh/PROTOCOL.mux | 6 +- crypto/openssh/README | 2 +- crypto/openssh/SECURITY.md | 5 + crypto/openssh/addr.c | 30 +- crypto/openssh/atomicio.c | 1 - crypto/openssh/auth-options.c | 4 +- crypto/openssh/auth-rhosts.c | 41 +- crypto/openssh/auth.c | 16 +- crypto/openssh/auth.h | 5 +- crypto/openssh/auth2-gss.c | 5 +- crypto/openssh/auth2-hostbased.c | 11 +- crypto/openssh/auth2-kbdint.c | 5 +- crypto/openssh/auth2-none.c | 5 +- crypto/openssh/auth2-passwd.c | 5 +- crypto/openssh/auth2-pubkey.c | 49 +- crypto/openssh/auth2.c | 70 +- crypto/openssh/authfd.c | 116 +- crypto/openssh/authfd.h | 35 +- crypto/openssh/authfile.c | 4 +- crypto/openssh/channels.c | 554 +- crypto/openssh/channels.h | 31 +- crypto/openssh/clientloop.c | 236 +- crypto/openssh/config.h | 36 +- crypto/openssh/configure.ac | 126 +- crypto/openssh/contrib/redhat/openssh.spec | 10 +- crypto/openssh/contrib/suse/openssh.spec | 2 +- crypto/openssh/defines.h | 39 +- crypto/openssh/digest-libc.c | 10 + crypto/openssh/dns.c | 4 +- crypto/openssh/gss-genr.c | 1 + crypto/openssh/hostfile.c | 22 +- crypto/openssh/includes.h | 1 - crypto/openssh/kex.c | 48 +- crypto/openssh/kex.h | 13 +- crypto/openssh/kexgen.c | 35 +- crypto/openssh/kexgexc.c | 24 +- crypto/openssh/kexgexs.c | 14 +- crypto/openssh/kexsntrup761x25519.c | 4 +- crypto/openssh/loginrec.c | 3 +- crypto/openssh/md5crypt.c | 165 - crypto/openssh/md5crypt.h | 22 - crypto/openssh/misc.c | 90 +- crypto/openssh/misc.h | 4 +- crypto/openssh/moduli | 831 +- crypto/openssh/monitor.c | 31 +- crypto/openssh/mux.c | 4 +- crypto/openssh/myproposal.h | 3 +- crypto/openssh/nchan.c | 10 +- crypto/openssh/openbsd-compat/arc4random.c | 8 +- crypto/openssh/openbsd-compat/base64.c | 1 - crypto/openssh/openbsd-compat/bcrypt_pbkdf.c | 41 +- crypto/openssh/openbsd-compat/bindresvport.c | 1 + crypto/openssh/openbsd-compat/blf.h | 7 +- crypto/openssh/openbsd-compat/blowfish.c | 7 +- crypto/openssh/openbsd-compat/bsd-closefrom.c | 8 +- crypto/openssh/openbsd-compat/bsd-cygwin_util.c | 4 +- crypto/openssh/openbsd-compat/bsd-getline.c | 2 +- crypto/openssh/openbsd-compat/bsd-openpty.c | 76 +- crypto/openssh/openbsd-compat/bsd-poll.c | 68 +- crypto/openssh/openbsd-compat/bsd-poll.h | 26 +- crypto/openssh/openbsd-compat/bsd-statvfs.c | 1 - crypto/openssh/openbsd-compat/dirname.c | 1 - crypto/openssh/openbsd-compat/fmt_scaled.c | 32 +- crypto/openssh/openbsd-compat/getcwd.c | 1 - crypto/openssh/openbsd-compat/inet_aton.c | 1 - crypto/openssh/openbsd-compat/inet_ntop.c | 1 - crypto/openssh/openbsd-compat/openbsd-compat.h | 4 +- crypto/openssh/openbsd-compat/port-solaris.c | 1 - crypto/openssh/openbsd-compat/xcrypt.c | 17 +- crypto/openssh/packet.c | 103 +- crypto/openssh/packet.h | 3 +- crypto/openssh/platform-tracing.c | 13 +- crypto/openssh/readconf.c | 27 +- crypto/openssh/readconf.h | 7 +- crypto/openssh/regress/Makefile | 14 +- crypto/openssh/regress/agent-getpeereid.sh | 3 + crypto/openssh/regress/agent-restrict.sh | 495 + crypto/openssh/regress/cert-hostkey.sh | 86 +- crypto/openssh/regress/cert-userkey.sh | 326 +- crypto/openssh/regress/cipher-speed.sh | 10 + crypto/openssh/regress/hostbased.sh | 66 + crypto/openssh/regress/hostkey-agent.sh | 84 +- crypto/openssh/regress/hostkey-rotate.sh | 17 +- crypto/openssh/regress/keys-command.sh | 6 +- crypto/openssh/regress/knownhosts.sh | 17 + crypto/openssh/regress/login-timeout.sh | 4 +- crypto/openssh/regress/misc/fuzz-harness/Makefile | 2 +- .../openssh/regress/misc/fuzz-harness/kex_fuzz.cc | 3 +- .../regress/misc/fuzz-harness/ssh-sk-null.cc | 3 +- crypto/openssh/regress/misc/sk-dummy/sk-dummy.c | 55 +- crypto/openssh/regress/percent.sh | 5 +- crypto/openssh/regress/principals-command.sh | 220 +- crypto/openssh/regress/sshd-log-wrapper.sh | 3 +- crypto/openssh/regress/sshsig.sh | 256 +- crypto/openssh/regress/test-exec.sh | 30 +- crypto/openssh/regress/unittests/authopt/tests.c | 3 +- crypto/openssh/regress/unittests/bitmap/tests.c | 3 +- .../openssh/regress/unittests/conversion/tests.c | 3 +- .../regress/unittests/hostkeys/test_iterate.c | 3 +- crypto/openssh/regress/unittests/kex/test_kex.c | 3 +- crypto/openssh/regress/unittests/match/tests.c | 3 +- crypto/openssh/regress/unittests/misc/test_argv.c | 3 +- .../openssh/regress/unittests/misc/test_convtime.c | 4 +- .../openssh/regress/unittests/misc/test_expand.c | 3 +- .../openssh/regress/unittests/misc/test_hpdelim.c | 82 + crypto/openssh/regress/unittests/misc/test_parse.c | 3 +- .../openssh/regress/unittests/misc/test_strdelim.c | 3 +- crypto/openssh/regress/unittests/misc/tests.c | 5 +- .../openssh/regress/unittests/sshbuf/test_sshbuf.c | 7 +- .../regress/unittests/sshbuf/test_sshbuf_fixed.c | 3 +- .../regress/unittests/sshbuf/test_sshbuf_fuzz.c | 5 +- .../unittests/sshbuf/test_sshbuf_getput_basic.c | 3 +- .../unittests/sshbuf/test_sshbuf_getput_crypto.c | 3 +- .../unittests/sshbuf/test_sshbuf_getput_fuzz.c | 5 +- .../regress/unittests/sshbuf/test_sshbuf_misc.c | 3 +- crypto/openssh/regress/unittests/sshkey/common.c | 3 +- .../openssh/regress/unittests/sshkey/test_file.c | 5 +- .../openssh/regress/unittests/sshkey/test_fuzz.c | 5 +- .../openssh/regress/unittests/sshkey/test_sshkey.c | 5 +- crypto/openssh/regress/unittests/sshsig/tests.c | 7 +- .../openssh/regress/unittests/sshsig/webauthn.html | 6 +- .../regress/unittests/test_helper/test_helper.c | 11 +- crypto/openssh/rijndael.h | 5 +- crypto/openssh/sandbox-capsicum.c | 1 - crypto/openssh/sandbox-seccomp-filter.c | 17 +- crypto/openssh/scp.1 | 4 +- crypto/openssh/scp.c | 85 +- crypto/openssh/servconf.c | 21 +- crypto/openssh/serverloop.c | 157 +- crypto/openssh/session.c | 5 +- crypto/openssh/sftp-client.c | 200 +- crypto/openssh/sftp-client.h | 4 +- crypto/openssh/sftp-server.c | 85 +- crypto/openssh/sftp.c | 1 - crypto/openssh/sk-api.h | 7 +- crypto/openssh/sk-usbhid.c | 225 +- crypto/openssh/ssh-add.1 | 88 +- crypto/openssh/ssh-add.c | 218 +- crypto/openssh/ssh-agent.c | 716 +- crypto/openssh/ssh-keygen.1 | 37 +- crypto/openssh/ssh-keygen.c | 246 +- crypto/openssh/ssh-keyscan.c | 70 +- crypto/openssh/ssh-keysign.c | 42 +- crypto/openssh/ssh-pkcs11-client.c | 16 +- crypto/openssh/ssh-pkcs11-helper.c | 4 +- crypto/openssh/ssh-pkcs11.c | 35 +- crypto/openssh/ssh-sk-client.c | 98 +- crypto/openssh/ssh-sk-helper.c | 33 +- crypto/openssh/ssh-sk.c | 106 +- crypto/openssh/ssh-sk.h | 14 +- crypto/openssh/ssh.1 | 10 +- crypto/openssh/ssh.c | 20 +- crypto/openssh/ssh_config | 2 +- crypto/openssh/ssh_config.5 | 22 +- crypto/openssh/ssh_namespace.h | 40 +- crypto/openssh/sshbuf-misc.c | 39 +- crypto/openssh/sshbuf.h | 8 +- crypto/openssh/sshconnect.c | 4 +- crypto/openssh/sshconnect2.c | 79 +- crypto/openssh/sshd.c | 91 +- crypto/openssh/sshd_config | 2 +- crypto/openssh/sshd_config.5 | 8 +- crypto/openssh/sshkey.c | 31 +- crypto/openssh/sshkey.h | 6 +- crypto/openssh/sshsig.c | 284 +- crypto/openssh/sshsig.h | 6 +- crypto/openssh/umac.c | 4 +- crypto/openssh/umac.h | 4 +- crypto/openssh/version.h | 6 +- lib/libpam/modules/pam_ssh/pam_ssh.c | 2 +- secure/usr.sbin/sshd/Makefile | 2 +- 185 files changed, 13910 insertions(+), 12246 deletions(-) diff --git a/crypto/openssh/.depend b/crypto/openssh/.depend index a94a82d0e6f7..945a01dcc05d 100644 --- a/crypto/openssh/.depend +++ b/crypto/openssh/.depend @@ -13,7 +13,7 @@ auth-krb5.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-com auth-options.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h openbsd-compat/sys-queue.h xmalloc.h ssherr.h log.h sshbuf.h misc.h sshkey.h match.h ssh2.h auth-options.h auth-pam.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h auth-passwd.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h packet.h openbsd-compat/sys-queue.h dispatch.h sshbuf.h ssherr.h log.h misc.h servconf.h sshkey.h hostfile.h auth.h auth-pam.h audit.h loginrec.h auth-options.h -auth-rhosts.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h packet.h openbsd-compat/sys-queue.h dispatch.h uidswap.h pathnames.h log.h ssherr.h misc.h sshbuf.h sshkey.h servconf.h canohost.h hostfile.h auth.h auth-pam.h audit.h loginrec.h +auth-rhosts.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h packet.h openbsd-compat/sys-queue.h dispatch.h uidswap.h pathnames.h log.h ssherr.h misc.h xmalloc.h sshbuf.h sshkey.h servconf.h canohost.h hostfile.h auth.h auth-pam.h audit.h loginrec.h auth-shadow.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h auth-sia.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h auth.o: authfile.h monitor_wrap.h compat.h channels.h @@ -74,11 +74,10 @@ kexgexs.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compa kexsntrup761x25519.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h ssherr.h krl.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h ./openbsd-compat/sys-tree.h openbsd-compat/sys-queue.h sshbuf.h ssherr.h sshkey.h authfile.h misc.h log.h digest.h bitmap.h utf8.h krl.h log.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h log.h ssherr.h match.h -loginrec.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h sshkey.h hostfile.h ssh.h loginrec.h log.h ssherr.h atomicio.h packet.h openbsd-compat/sys-queue.h dispatch.h canohost.h auth.h auth-pam.h audit.h sshbuf.h +loginrec.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h sshkey.h hostfile.h ssh.h loginrec.h log.h ssherr.h atomicio.h packet.h openbsd-compat/sys-queue.h dispatch.h canohost.h auth.h auth-pam.h audit.h sshbuf.h misc.h logintest.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h loginrec.h mac.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h digest.h hmac.h umac.h mac.h misc.h ssherr.h sshbuf.h openbsd-compat/openssl-compat.h match.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h match.h misc.h -md5crypt.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h misc.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h misc.h log.h ssherr.h ssh.h sshbuf.h moduli.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h monitor.o: chacha.h poly1305.h cipher-aesctr.h rijndael.h kex.h mac.h crypto_api.h dh.h packet.h dispatch.h auth-options.h sshpty.h channels.h session.h sshlogin.h canohost.h log.h ssherr.h misc.h servconf.h monitor.h monitor_wrap.h monitor_fdpass.h compat.h ssh2.h authfd.h match.h sk-api.h @@ -110,7 +109,7 @@ sandbox-seccomp-filter.o: includes.h config.h defines.h platform.h openbsd-compa sandbox-solaris.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h sandbox-systrace.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h sc25519.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h sc25519.h crypto_api.h -scp.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h openbsd-compat/glob.h xmalloc.h ssh.h atomicio.h pathnames.h log.h ssherr.h misc.h progressmeter.h utf8.h sftp-common.h sftp-client.h +scp.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h openbsd-compat/glob.h xmalloc.h ssh.h atomicio.h pathnames.h log.h ssherr.h misc.h progressmeter.h utf8.h sftp.h sftp-common.h sftp-client.h servconf.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h openbsd-compat/glob.h openbsd-compat/sys-queue.h xmalloc.h ssh.h log.h ssherr.h sshbuf.h misc.h servconf.h compat.h pathnames.h cipher.h cipher-chachapoly.h chacha.h poly1305.h cipher-aesctr.h rijndael.h sshkey .h servconf.o: kex.h mac.h crypto_api.h match.h channels.h groupaccess.h canohost.h packet.h dispatch.h hostfile.h auth.h auth-pam.h audit.h loginrec.h myproposal.h digest.h serverloop.o: cipher-aesctr.h rijndael.h kex.h mac.h crypto_api.h hostfile.h auth.h auth-pam.h audit.h loginrec.h session.h auth-options.h serverloop.h @@ -127,8 +126,8 @@ sftp.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h sk-usbhid.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h sntrup761.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h srclimit.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h addr.h canohost.h log.h ssherr.h misc.h srclimit.h xmalloc.h -ssh-add.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h ssh.h log.h ssherr.h sshkey.h sshbuf.h authfd.h authfile.h pathnames.h misc.h digest.h ssh-sk.h sk-api.h -ssh-agent.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h openbsd-compat/sys-queue.h xmalloc.h ssh.h ssh2.h sshbuf.h sshkey.h authfd.h compat.h log.h ssherr.h misc.h digest.h match.h msg.h pathnames.h ssh-pkcs11.h sk-api.h +ssh-add.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h ssh.h log.h ssherr.h sshkey.h sshbuf.h authfd.h authfile.h pathnames.h misc.h digest.h ssh-sk.h sk-api.h hostfile.h +ssh-agent.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h openbsd-compat/sys-queue.h xmalloc.h ssh.h ssh2.h sshbuf.h sshkey.h authfd.h compat.h log.h ssherr.h misc.h digest.h match.h msg.h pathnames.h ssh-pkcs11.h sk-api.h myproposal.h ssh-dss.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h ssh-ecdsa-sk.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h openbsd-compat/openssl-compat.h sshbuf.h ssherr.h digest.h sshkey.h ssh-ecdsa.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h diff --git a/crypto/openssh/.github/configs b/crypto/openssh/.github/configs index 12578c067348..853da58a51e3 100755 --- a/crypto/openssh/.github/configs +++ b/crypto/openssh/.github/configs @@ -15,6 +15,8 @@ LTESTS="" SKIP_LTESTS="" SUDO=sudo # run with sudo by default TEST_SSH_UNSAFE_PERMISSIONS=1 +# Stop on first test failure to minimize logs +TEST_SSH_FAIL_FATAL=yes CONFIGFLAGS="" LIBCRYPTOFLAGS="" @@ -25,9 +27,29 @@ case "$config" in c89) CC="gcc" CFLAGS="-Wall -std=c89 -pedantic -Werror=vla" - CONFIGFLAGS="--without-openssl --without-zlib" + CONFIGFLAGS="--without-zlib" + LIBCRYPTOFLAGS="--without-openssl" TEST_TARGET=t-exec ;; + cygwin-release) + CONFIGFLAGS="--with-libedit --with-xauth=/usr/bin/xauth --disable-strip --with-security-key-builtin" + ;; + clang-12-Werror) + CC="clang-12" + # clang's implicit-fallthrough requires that the code be annotated with + # __attribute__((fallthrough)) and does not understand /* FALLTHROUGH */ + CFLAGS="-Wall -Wextra -O2 -Wno-error=implicit-fallthrough" + CONFIGFLAGS="--with-pam --with-Werror" + ;; + gcc-11-Werror) + CC="gcc" + # -Wnoformat-truncation in gcc 7.3.1 20180130 fails on fmt_scaled + CFLAGS="-Wall -Wextra -Wno-format-truncation -O2 -Wimplicit-fallthrough=4" + CONFIGFLAGS="--with-pam --with-Werror" + ;; + clang*|gcc*) + CC="$config" + ;; kitchensink) CONFIGFLAGS="--with-kerberos5 --with-libedit --with-pam" CONFIGFLAGS="${CONFIGFLAGS} --with-security-key-builtin --with-selinux" @@ -36,12 +58,21 @@ case "$config" in hardenedmalloc) CONFIGFLAGS="--with-ldflags=-lhardened_malloc" ;; - kerberos5) + tcmalloc) + CONFIGFLAGS="--with-ldflags=-ltcmalloc" + ;; + krb5|heimdal) CONFIGFLAGS="--with-kerberos5" ;; libedit) CONFIGFLAGS="--with-libedit" ;; + musl) + CC="musl-gcc" + CONFIGFLAGS="--without-zlib" + LIBCRYPTOFLAGS="--without-openssl" + TEST_TARGET="t-exec" + ;; pam-krb5) CONFIGFLAGS="--with-pam --with-kerberos5" SSHD_CONFOPTS="UsePam yes" @@ -76,9 +107,9 @@ case "$config" in # Valgrind slows things down enough that the agent timeout test # won't reliably pass, and the unit tests run longer than allowed # by github so split into three separate tests. - tests2="rekey integrity" - tests3="krl forward-control sshsig" - tests4="cert-userkey cert-hostkey kextype sftp-perm keygen-comment" + tests2="rekey integrity try-ciphers sftp" + tests3="krl forward-control sshsig agent-restrict kextype" + tests4="cert-userkey cert-hostkey kextype sftp-perm keygen-comment percent" case "$config" in valgrind-1) # All tests except agent-timeout (which is flaky under valgrind) @@ -122,22 +153,25 @@ case "${TARGET_HOST}" in SKIP_LTESTS="forwarding multiplex proxy-connect hostkey-agent agent-ptrace" ;; minix3) - CC="clang" - LIBCRYPTOFLAGS="--without-openssl" + LIBCRYPTOFLAGS="--without-openssl --disable-security-key" # Minix does not have a loopback interface so we have to skip any - # test that relies on it. + # test that relies on one. + # Also, Minix seems to be very limited in the number of select() + # calls that can be operating concurrently, so prune additional tests for that. + T="addrmatch agent-restrict brokenkeys cfgmatch cfgmatchlisten cfgparse connect + connect-uri exit-status forward-control forwarding hostkey-agent + key-options keyscan knownhosts-command login-timeout multiplex + reconfigure reexec rekey scp scp-uri scp3 sftp sftp-badcmds + sftp-batch sftp-cmds sftp-glob sftp-perm sftp-uri stderr-data + transfer" + SKIP_LTESTS="$(echo $T)" TEST_TARGET=t-exec - SKIP_LTESTS="addrmatch cfgparse key-options reexec agent connect" - SKIP_LTESTS="$SKIP_LTESTS keyscan rekey allow-deny-users connect-uri" - SKIP_LTESTS="$SKIP_LTESTS knownhosts-command sftp-uri brokenkeys" - SKIP_LTESTS="$SKIP_LTESTS exit-status login-timeout stderr-data" - SKIP_LTESTS="$SKIP_LTESTS cfgmatch forward-control multiplex transfer" - SKIP_LTESTS="$SKIP_LTESTS cfgmatchlisten forwarding reconfigure" SUDO="" ;; nbsd4) # System compiler will ICE on some files with fstack-protector - CONFIGFLAGS="${CONFIGFLAGS} --without-hardening" + # SHA256 functions in sha2.h conflict with OpenSSL's breaking sk-dummy + CONFIGFLAGS="${CONFIGFLAGS} --without-hardening --disable-security-key" ;; sol10|sol11) # sol10 VM is 32bit and the unit tests are slow. @@ -150,6 +184,15 @@ case "${TARGET_HOST}" in ;; esac +# Unless specified otherwise, build without OpenSSL on Mac OS since +# modern versions don't ship with libcrypto. +case "`./config.guess`" in +*-darwin*) + LIBCRYPTOFLAGS="--without-openssl" + TEST_TARGET=t-exec + ;; +esac + # If we have a local openssl/libressl, use that. if [ -z "${LIBCRYPTOFLAGS}" ]; then # last-match @@ -167,4 +210,5 @@ if [ -x "$(which plink 2>/dev/null)" ]; then export REGRESS_INTEROP_PUTTY fi -export CC CFLAGS LTESTS SUDO TEST_TARGET TEST_SSH_UNSAFE_PERMISSIONS +export CC CFLAGS LTESTS SUDO +export TEST_TARGET TEST_SSH_UNSAFE_PERMISSIONS TEST_SSH_FAIL_FATAL diff --git a/crypto/openssh/.github/configure.sh b/crypto/openssh/.github/configure.sh index e098730f02d6..502bf5f0d407 100755 --- a/crypto/openssh/.github/configure.sh +++ b/crypto/openssh/.github/configure.sh @@ -2,5 +2,20 @@ . .github/configs $1 -set -x +printf "$ " + +if [ "x$CC" != "x" ]; then + printf "CC='$CC' " +fi +if [ "x$CFLAGS" != "x" ]; then + printf "CFLAGS='$CFLAGS' " +fi +if [ "x$CPPFLAGS" != "x" ]; then + printf "CPPFLAGS='$CPPFLAGS' " +fi +if [ "x$LDFLAGS" != "x" ]; then + printf "LDFLAGS='$LDFLAGS' " +fi + +echo ./configure ${CONFIGFLAGS} ./configure ${CONFIGFLAGS} diff --git a/crypto/openssh/.github/setup_ci.sh b/crypto/openssh/.github/setup_ci.sh index 107c049c4175..ca37f8c5512f 100755 --- a/crypto/openssh/.github/setup_ci.sh +++ b/crypto/openssh/.github/setup_ci.sh @@ -1,6 +1,8 @@ #!/bin/sh -case $(./config.guess) in + . .github/configs $@ + +case "`./config.guess`" in *-darwin*) brew install automake exit 0 @@ -20,23 +22,30 @@ set -ex lsb_release -a if [ "${TARGETS}" = "kitchensink" ]; then - TARGETS="kerberos5 libedit pam sk selinux" + TARGETS="krb5 libedit pam sk selinux" fi +for flag in $CONFIGFLAGS; do + case "$flag" in + --with-pam) PACKAGES="${PACKAGES} libpam0g-dev" ;; + --with-libedit) PACKAGES="${PACKAGES} libedit-dev" ;; + esac +done + for TARGET in $TARGETS; do case $TARGET in - default|without-openssl|without-zlib|c89) + default|without-openssl|without-zlib|c89|libedit|*pam) # nothing to do ;; - kerberos5) - PACKAGES="$PACKAGES heimdal-dev" - #PACKAGES="$PACKAGES libkrb5-dev" - ;; - libedit) - PACKAGES="$PACKAGES libedit-dev" + clang-*|gcc-*) + compiler=$(echo $TARGET | sed 's/-Werror//') + PACKAGES="$PACKAGES $compiler" ;; - *pam) - PACKAGES="$PACKAGES libpam0g-dev" + krb5) + PACKAGES="$PACKAGES libkrb5-dev" + ;; + heimdal) + PACKAGES="$PACKAGES heimdal-dev" ;; sk) INSTALL_FIDO_PPA="yes" @@ -47,7 +56,13 @@ for TARGET in $TARGETS; do ;; hardenedmalloc) INSTALL_HARDENED_MALLOC=yes - ;; + ;; + musl) + PACKAGES="$PACKAGES musl-tools" + ;; + tcmalloc) + PACKAGES="$PACKAGES libgoogle-perftools-dev" + ;; openssl-noec) INSTALL_OPENSSL=OpenSSL_1_1_1k SSLCONFOPTS="no-ec" @@ -93,7 +108,7 @@ if [ "${INSTALL_HARDENED_MALLOC}" = "yes" ]; then (cd ${HOME} && git clone https://github.com/GrapheneOS/hardened_malloc.git && cd ${HOME}/hardened_malloc && - make -j2 && sudo cp libhardened_malloc.so /usr/lib/) + make -j2 && sudo cp out/libhardened_malloc.so /usr/lib/) fi if [ ! -z "${INSTALL_OPENSSL}" ]; then diff --git a/crypto/openssh/.github/workflows/c-cpp.yml b/crypto/openssh/.github/workflows/c-cpp.yml index 152ddaa4fba6..5ee896308478 100644 --- a/crypto/openssh/.github/workflows/c-cpp.yml +++ b/crypto/openssh/.github/workflows/c-cpp.yml @@ -24,16 +24,28 @@ jobs: - { os: ubuntu-20.04, configs: valgrind-4 } - { os: ubuntu-20.04, configs: valgrind-unit } - { os: ubuntu-20.04, configs: c89 } + - { os: ubuntu-20.04, configs: clang-6.0 } + - { os: ubuntu-20.04, configs: clang-8 } + - { os: ubuntu-20.04, configs: clang-9 } + - { os: ubuntu-20.04, configs: clang-10 } + - { os: ubuntu-20.04, configs: clang-11 } + - { os: ubuntu-20.04, configs: clang-12-Werror } + - { os: ubuntu-20.04, configs: gcc-7 } + - { os: ubuntu-20.04, configs: gcc-8 } + - { os: ubuntu-20.04, configs: gcc-10 } + - { os: ubuntu-20.04, configs: gcc-11-Werror } - { os: ubuntu-20.04, configs: pam } - { os: ubuntu-20.04, configs: kitchensink } - { os: ubuntu-20.04, configs: hardenedmalloc } + - { os: ubuntu-20.04, configs: tcmalloc } + - { os: ubuntu-20.04, configs: musl } - { os: ubuntu-latest, configs: libressl-master } - { os: ubuntu-latest, configs: libressl-2.2.9 } - { os: ubuntu-latest, configs: libressl-2.8.3 } - { os: ubuntu-latest, configs: libressl-3.0.2 } - { os: ubuntu-latest, configs: libressl-3.2.6 } - { os: ubuntu-latest, configs: libressl-3.3.4 } - - { os: ubuntu-latest, configs: libressl-3.4.0 } + - { os: ubuntu-latest, configs: libressl-3.4.1 } - { os: ubuntu-latest, configs: openssl-master } - { os: ubuntu-latest, configs: openssl-noec } - { os: ubuntu-latest, configs: openssl-1.0.1 } @@ -46,7 +58,8 @@ jobs: - { os: ubuntu-latest, configs: openssl-1.1.1_stable } # stable branch - { os: ubuntu-latest, configs: openssl-3.0 } # stable branch - { os: ubuntu-18.04, configs: pam } - - { os: ubuntu-18.04, configs: kerberos5 } + - { os: ubuntu-18.04, configs: krb5 } + - { os: ubuntu-18.04, configs: heimdal } - { os: ubuntu-18.04, configs: libedit } - { os: ubuntu-18.04, configs: sk } - { os: ubuntu-18.04, configs: selinux } @@ -63,6 +76,13 @@ jobs: run: autoreconf - name: configure run: ./.github/configure.sh ${{ matrix.configs }} + - name: save config + uses: actions/upload-artifact@v2 + with: + name: ${{ matrix.os }}-${{ matrix.configs }}-config + path: config.h + - name: make clean + run: make clean - name: make run: make -j2 - name: make tests diff --git a/crypto/openssh/.github/workflows/selfhosted.yml b/crypto/openssh/.github/workflows/selfhosted.yml index df6eca714fb5..09f7af939912 100644 --- a/crypto/openssh/.github/workflows/selfhosted.yml +++ b/crypto/openssh/.github/workflows/selfhosted.yml @@ -17,6 +17,7 @@ jobs: matrix: os: - ARM64 + - alpine - bbone - dfly30 - dfly48 @@ -26,7 +27,7 @@ jobs: - fbsd10 - fbsd12 - fbsd13 - - hurd + # - hurd - minix3 # - nbsd2 - nbsd3 @@ -35,8 +36,8 @@ jobs: - nbsd9 - obsd51 - obsd67 - - obsd68 - obsd69 + - obsd70 - obsdsnap - openindiana # - rocky84 @@ -64,6 +65,7 @@ jobs: - { os: sol11, configs: pam-krb5 } - { os: sol11, configs: sol64 } # - { os: sol11, configs: sol64-pam } + - { os: win10, configs: cygwin-release } steps: - uses: actions/checkout@v2 - name: autoreconf @@ -74,10 +76,18 @@ jobs: run: vmstartup - name: configure run: vmrun ./.github/configure.sh ${{ matrix.configs }} + - name: save config + uses: actions/upload-artifact@v2 + with: + name: ${{ matrix.os }}-${{ matrix.configs }}-config + path: config.h + - name: make clean + run: vmrun make clean - name: make run: vmrun make - name: make tests run: vmrun ./.github/run_test.sh ${{ matrix.configs }} + timeout-minutes: 300 - name: save logs if: failure() uses: actions/upload-artifact@v2 diff --git a/crypto/openssh/.github/workflows/upstream.yml b/crypto/openssh/.github/workflows/upstream.yml index f0493c12d7d5..b91083c65184 100644 --- a/crypto/openssh/.github/workflows/upstream.yml +++ b/crypto/openssh/.github/workflows/upstream.yml @@ -13,7 +13,7 @@ jobs: strategy: fail-fast: false matrix: - os: [ obsdsnap, obsdsnap-i386, obsd69, obsd68 ] + os: [ obsdsnap, obsdsnap-i386 ] configs: [ default, without-openssl ] steps: - uses: actions/checkout@v2 @@ -31,6 +31,7 @@ jobs: run: vmrun "cd /usr/src/usr.bin/ssh && sudo make install" - name: make tests run: vmrun "cd /usr/src/regress/usr.bin/ssh && make obj && make clean && if test '${{ matrix.configs }}' = 'without-openssl'; then make SUDO=sudo OPENSSL=no; else make SUDO=sudo; fi" + timeout-minutes: 300 - name: save logs if: failure() uses: actions/upload-artifact@v2 diff --git a/crypto/openssh/.skipped-commit-ids b/crypto/openssh/.skipped-commit-ids index 1de78172232a..c606eaee6c51 100644 --- a/crypto/openssh/.skipped-commit-ids +++ b/crypto/openssh/.skipped-commit-ids @@ -23,6 +23,7 @@ d9b910e412d139141b072a905e66714870c38ac0 Makefile.inc 07b5031e9f49f2b69ac5e85b8da4fc9e393992a0 Makefile.inc cc12a9029833d222043aecd252d654965c351a69 moduli-gen Makefile 7ac6c252d2a5be8fbad4c66d9d35db507c9dac5b moduli update +6b52cd2b637f3d29ef543f0ce532a2bce6d86af5 makefile change Old upstream tree: diff --git a/crypto/openssh/ChangeLog b/crypto/openssh/ChangeLog index 9e660ec37ef3..c225b94dfd3e 100644 --- a/crypto/openssh/ChangeLog +++ b/crypto/openssh/ChangeLog @@ -1,13611 +1,11979 @@ -commit bf944e3794eff5413f2df1ef37cddf96918c6bde +commit 166456cedad3962b83b848b1e9caf80794831f0f Author: Damien Miller -Date: Mon Sep 27 00:03:19 2021 +1000 +Date: Wed Feb 23 22:31:11 2022 +1100 - initgroups needs grp.h + makedepend -commit 8c5b5655149bd76ea21026d7fe73ab387dbc3bc7 +commit 32ebaa0dbca5d0bb86e384e72bebc153f48413e4 Author: djm@openbsd.org -Date: Sun Sep 26 14:01:11 2021 +0000 +Date: Wed Feb 23 11:18:13 2022 +0000 - upstream: openssh-8.8 + upstream: avoid integer overflow of auth attempts (harmless, caught - OpenBSD-Commit-ID: 12357794602ac979eb7312a1fb190c453f492ec4 + by monitor) + + OpenBSD-Commit-ID: 488ad570b003b21e0cd9e7a00349cfc1003b4d86 -commit f3cbe43e28fe71427d41cfe3a17125b972710455 +commit 6e0258c64c901753df695e06498b26f9f4812ea6 Author: djm@openbsd.org -Date: Sun Sep 26 14:01:03 2021 +0000 +Date: Wed Feb 23 11:17:10 2022 +0000 - upstream: need initgroups() before setresgid(); reported by anton@, + upstream: randomise the password used in fakepw - ok deraadt@ + OpenBSD-Commit-ID: 34e159f73b1fbf0a924a9c042d8d61edde293947 + +commit bf114d6f0a9df0b8369823d9a0daa6c72b0c4cc9 +Author: djm@openbsd.org +Date: Wed Feb 23 11:15:57 2022 +0000 + + upstream: use asprintf to construct .rhosts paths - OpenBSD-Commit-ID: 6aa003ee658b316960d94078f2a16edbc25087ce + OpenBSD-Commit-ID: 8286e8d3d2c6ff916ff13d041d1713073f738a8b -commit 8acaff41f7518be40774c626334157b1b1c5583c -Author: Damien Miller -Date: Sun Sep 26 22:16:36 2021 +1000 +commit c07e154fbdc7285e9ec54e78d8a31f7325d43537 +Author: djm@openbsd.org +Date: Wed Feb 23 11:07:09 2022 +0000 - update version numbers for release + upstream: openssh-8.9 + + OpenBSD-Commit-ID: 5c5f791c87c483cdab6d9266b43acdd9ca7bde0e -commit d39039ddc0010baa91c70a0fa0753a2699bbf435 -Author: kn@openbsd.org -Date: Sat Sep 25 09:40:33 2021 +0000 +commit bc16667b4a1c3cad7029304853c143a32ae04bd4 +Author: Darren Tucker +Date: Tue Feb 22 15:29:22 2022 +1100 - upstream: RSA/SHA-1 is not used by default anymore + Extend select+rlimit sanbox test to include poll. - OK dtucker deraadt djm + POSIX specifies that poll() shall fail if "nfds argument is greater + than {OPEN_MAX}". The setrlimit sandbox sets this to effectively zero + so this causes poll() to fail in the preauth privsep process. - OpenBSD-Commit-ID: 055c51a221c3f099dd75c95362f902da1b8678c6 + This is likely the underlying cause for the previously observed similar + behaviour of select() on plaforms where it is implement in userspace on + top of poll(). -commit 9b2ee74e3aa8c461eb5552a6ebf260449bb06f7e +commit 6520c488de95366be031d49287ed243620399e23 Author: Darren Tucker -Date: Fri Sep 24 11:08:03 2021 +1000 +Date: Tue Feb 22 13:08:59 2022 +1100 - Move the fgrep replacement to hostkey-rotate.sh. - - The fgrep replacement for buggy greps doesn't work in the sftp-glob test - so move it to just where we know it's needed. + Add Alpine Linux test VM. -commit f7039541570d4b66d76e6f574544db176d8d5c02 +commit a4b325a3fc82d11e0f5d61f62e7fde29415f7afb Author: Darren Tucker -Date: Fri Sep 24 08:04:14 2021 +1000 +Date: Tue Feb 22 12:27:07 2022 +1100 - Replacement function for buggy fgrep. + Include sys/param.h if present. - GNU (f)grep <=2.18, as shipped by FreeBSD<=12 and NetBSD<=9 will - occasionally fail to find ssh host keys in the hostkey-rotate test. - If we have those versions, use awk instead. + Needed for howmany() on MUSL systems such as Alpine. -commit f6a660e5bf28a01962af87568e118a2d2e79eaa0 -Author: David Manouchehri -Date: Thu Sep 23 17:03:18 2021 -0400 +commit 5a102e9cb287a43bd7dfe594b775a89a8e94697c +Author: Darren Tucker +Date: Tue Feb 22 12:25:52 2022 +1100 - Don't prompt for yes/no questions. + Only include sys/poll.h if we don't have poll.h. + + Prevents warnings on MUSL based systems such as Alpine. -commit 7ed1a3117c09f8c3f1add35aad77d3ebe1b85b4d -Author: djm@openbsd.org -Date: Mon Sep 20 06:53:56 2021 +0000 +commit 7c0d4ce911d5c58b6166b2db754a4e91f352adf5 +Author: Damien Miller +Date: Tue Feb 22 11:14:51 2022 +1100 - upstream: fix missing -s in SYNOPSYS and usage() as well as a + disable agent-restrict test on minix3 - capitalisation mistake; spotted by jmc@ + Minix seems to have a platform-wide limit on the number of + select(2) syscalls that can be concurrently issued. This test + seems to exceed this limit. - OpenBSD-Commit-ID: 0ed8ee085c7503c60578941d8b45f3a61d4c9710 + Refer to: + + https://github.com/Stichting-MINIX-Research-Foundation/minix/blob/R3.3.0/minix/servers/vfs/select.c#L114 + https://github.com/Stichting-MINIX-Research-Foundation/minix/blob/R3.3.0/minix/servers/vfs/select.c#L30-L31 -commit 8c07170135dde82a26886b600a8bf6fb290b633d +commit 81d33d8e3cf7ea5ce3a5653c6102b623e019428a +Author: Darren Tucker +Date: Mon Feb 21 21:27:20 2022 +1100 + + Skip agent-getpeereid when running as root. + +commit fbd772570a25436a33924d91c164d2b24021f010 Author: dtucker@openbsd.org -Date: Mon Sep 20 04:02:13 2021 +0000 +Date: Sun Feb 20 03:47:26 2022 +0000 - upstream: Fix "Allocated port" debug message + upstream: Aproximate realpath on the expected output by deduping - for unix domain sockets. From peder.stray at gmail.com via github PR#272, - ok deraadt@ + leading slashes. Fixes test failure when user's home dir is / which is + possible in some portable configurations. - OpenBSD-Commit-ID: 8d5ef3fbdcdd29ebb0792b5022a4942db03f017e + OpenBSD-Regress-ID: 53b8c53734f8893806961475c7106397f98d9f63 -commit 277d3c6adfb128b4129db08e3d65195d94b55fe7 -Author: djm@openbsd.org -Date: Mon Sep 20 01:55:42 2021 +0000 +commit 336685d223a59f893faeedf0a562e053fd84058e +Author: Darren Tucker +Date: Sun Feb 20 13:30:52 2022 +1100 - upstream: Switch scp back to use the old protocol by default, ahead of - - release. We'll wait a little longer for people to pick up sftp-server(8) that - supports the extension that scp needs for ~user paths to continue working in - SFTP protocol mode. Discussed with deraadt@ + Really move DSA to end of list. - OpenBSD-Commit-ID: f281f603a705fba317ff076e7b11bcf2df941871 + In commit ad16a84e syncing from OpenBSD, RSA was accidentally moved to + the end of the list instead of DSA. Spotted by andrew at fyfe.gb.net. -commit ace19b34cc15bea3482be90450c1ed0cd0dd0669 +commit 63bf4f49ed2fdf2da6f97136c9df0c8168546eb3 +Author: Darren Tucker +Date: Fri Feb 18 12:12:21 2022 +1100 + + Add test configs for MUSL C library. + +commit f7fc6a43f1173e8b2c38770bf6cee485a562d03b +Author: Damien Miller +Date: Thu Feb 17 22:54:19 2022 +1100 + + minix needs BROKEN_POLL too; chokes on /dev/null + +commit 667fec5d4fe4406745750a32f69b5d2e1a75e94b Author: djm@openbsd.org -Date: Sat Sep 18 02:03:25 2021 +0000 +Date: Thu Feb 17 10:58:27 2022 +0000 - upstream: better error message for ~user failures when the + upstream: check for EINTR/EAGAIN failures in the rfd fast-path; caught - sftp-server lacks the expand-path extension; ok deraadt@ + by dtucker's minix3 vm :) ok dtucker@ - OpenBSD-Commit-ID: 9c1d965d389411f7e86f0a445158bf09b8f9e4bc + OpenBSD-Commit-ID: 2e2c895a3e82ef347aa6694394a76a438be91361 -commit 6b1238ba971ee722a310d95037b498ede5539c03 -Author: djm@openbsd.org -Date: Thu Sep 16 15:22:22 2021 +0000 +commit 41417dbda9fb55a0af49a8236e3ef9d50d862644 +Author: Darren Tucker +Date: Thu Feb 17 22:05:29 2022 +1100 - upstream: make some more scp-in-SFTP mode better match Unix idioms - - suggested by deraadt@ + Comment hurd test, the VM is currently broken. + +commit b2aee35a1f0dc798339b3fcf96136da71b7e3f6d +Author: Damien Miller +Date: Thu Feb 17 21:15:16 2022 +1100 + + find sk-dummy.so when build_dir != src_dir - OpenBSD-Commit-ID: 0f2439404ed4cf0b0be8bf49a1ee734836e1ac87 + spotted by Corinna Vinschen; feedback & ok dtucker@ -commit e694f8ac4409931e67d08ac44ed251b20b10a957 +commit 62a2d4e50b2e89f2ef04576931895d5139a5d037 +Author: Damien Miller +Date: Wed Feb 16 16:26:17 2022 +1100 + + update versions in preparation for 8.9 release + +commit dd6d3dded721ac653ea73c017325e5bfeeec837f Author: djm@openbsd.org -Date: Thu Sep 16 15:11:19 2021 +0000 +Date: Tue Feb 15 05:13:36 2022 +0000 - upstream: allow log_stderr==2 to prefix log messages with argv[0] + upstream: document the unbound/host-bound options to - use this to make scp's SFTP mode error messages more scp-like + PubkeyAuthentication; spotted by HARUYAMA Seigo - prompted by and ok deraadt@ + OpenBSD-Commit-ID: 298f681b66a9ecd498f0700082c7a6c46e948981 + +commit df93529dd727fdf2fb290700cd4f1adb0c3c084b +Author: Darren Tucker +Date: Mon Feb 14 14:19:40 2022 +1100 + + Test if sshd accidentally acquires controlling tty - OpenBSD-Commit-ID: 0e821dbde423fc2280e47414bdc22aaa5b4e0733 + When SSHD_ACQUIRES_CTTY is defined, test for the problematic behaviour + in the STREAMS code before activating the workaround. ok djm@ -commit 8a7a06ee505cb833e613f74a07392e9296286c30 +commit 766176cfdbfd7ec38bb6118dde6e4daa0df34888 Author: Darren Tucker -Date: Fri Sep 17 13:03:31 2021 +1000 +Date: Sat Feb 12 10:24:56 2022 +1100 - Test against LibreSSL 3.2.6, 3.3.4, 3.4.0. + Add cygwin-release test config. + + This tests the flags used to build the cygwin release binaries. -commit c25c84074a47f700dd6534995b4af4b456927150 -Author: djm@openbsd.org -Date: Thu Sep 16 05:36:03 2021 +0000 +commit b30698662b862f5397116d23688aac0764e0886e +Author: Darren Tucker +Date: Fri Feb 11 21:00:35 2022 +1100 - upstream: missing space character in ssh -G output broke the + Move SSHD_ACQUIRES_CTTY workaround into compat. - t-sshcfgparse regression test; spotted by anton@ + On some (most? all?) SysV based systems with STREAMS based ptys, + sshd could acquire a controlling terminal during pty setup when + it pushed the "ptem" module, due to what is probably a bug in + the STREAMS driver that's old enough to vote. Because it was the + privileged sshd's controlling terminal, it was not available for + the user's session, which ended up without one. This is known to + affect at least Solaris <=10, derivatives such as OpenIndiana and + several other SysV systems. See bz#245 for the backstory. - OpenBSD-Commit-ID: bcc36fae2f233caac4baa8e58482da4aa350eed0 + In the we past worked around that by not calling setsid in the + privileged sshd child, which meant it was not a session or process + group leader. This solved controlling terminal problem because sshd + was not eligble to acquire one, but had other side effects such as + not cleaning up helper subprocesses in the SIGALRM handler since it + was not PG leader. Recent cleanups in the signal handler uncovered + this, resulting in the LoginGraceTime timer not cleaning up privsep + unprivileged processes. + + This change moves the workaround into the STREAMS pty allocation code, + by allocating a sacrificial pty to act as sshd's controlling terminal + before allocating user ptys, so those are still available for users' + sessions. + + On the down side: + - this will waste a pty per ssh connection on affected platforms. + + On the up side: + - it makes the process group behaviour consistent between platforms. + *** 37441 LINES SKIPPED ***