commit 71508e06fab14bc415a79a08f5535ad7bffa93d9
Author: Damien Miller <djm@mindrot.org>
Date:   Thu Aug 23 15:41:42 2018 +1000

    shorten temporary SSH_REGRESS_TMP path
    
    Previous path was exceeding max socket length on at least one platform (OSX)

commit 26739cf5bdc9030a583b41ae5261dedd862060f0
Author: Damien Miller <djm@mindrot.org>
Date:   Thu Aug 23 13:06:02 2018 +1000

    rebuild dependencies

commit ff729025c7463cf5d0a8d1ca1823306e48c6d4cf
Author: Damien Miller <djm@mindrot.org>
Date:   Thu Aug 23 13:03:32 2018 +1000

    fix path in distclean target
    
    Patch from Jakub Jelen

commit 7fef173c28f7462dcd8ee017fdf12b5073f54c02
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Thu Aug 23 03:01:08 2018 +0000

    upstream: memleak introduced in r1.83; from Colin Watson
    
    OpenBSD-Commit-ID: 5c019104c280cbd549a264a7217b67665e5732dc

commit b8ae02a2896778b8984c7f51566c7f0f56fa8b56
Author: schwarze@openbsd.org <schwarze@openbsd.org>
Date:   Tue Aug 21 13:56:27 2018 +0000

    upstream: AIX reports the CODESET as "ISO8859-1" in the POSIX locale.
    
    Treating that as a safe encoding is OK because even when other systems return
    that string for real ISO8859-1, it is still safe in the sense that it is
    ASCII-compatible and stateless.
    
    Issue reported by Val dot Baranov at duke dot edu.  Additional
    information provided by Michael dot Felt at felt dot demon dot nl.
    Tested by Michael Felt on AIX 6.1 and by Val Baranov on AIX 7.1.
    Tweak and OK djm@.
    
    OpenBSD-Commit-ID: 36f1210e0b229817d10eb490d6038f507b8256a7

commit bc44ee088ad269d232e514f037c87ada4c2fd3f0
Author: Tim Rice <tim@multitalents.net>
Date:   Tue Aug 21 08:57:24 2018 -0700

            modified:   openbsd-compat/port-uw.c
            remove obsolete and un-needed include

commit 829fc28a9c54e3f812ee7248c7a3e31eeb4f0b3a
Author: Damien Miller <djm@mindrot.org>
Date:   Mon Aug 20 15:57:29 2018 +1000

    Missing unistd.h for regress/mkdtemp.c

commit c8313e492355a368a91799131520d92743d8d16c
Author: Damien Miller <djm@mindrot.org>
Date:   Fri Aug 17 05:45:20 2018 +1000

    update version numbers in anticipation of release

commit 477b49a34b89f506f4794b35e3c70b3e2e83cd38
Author: Corinna Vinschen <vinschen@redhat.com>
Date:   Mon Aug 13 17:08:51 2018 +0200

    configure: work around GCC shortcoming on Cygwin
    
    Cygwin's latest 7.x GCC allows to specify -mfunction-return=thunk
    as well as -mindirect-branch=thunk on the command line, albeit
    producing invalid code, leading to an error at link stage.
    
    The check in configure.ac only checks if the option is present,
    but not if it produces valid code.
    
    This patch fixes it by special-casing Cygwin.  Another solution
    may be to change these to linker checks.
    
    Signed-off-by: Corinna Vinschen <vinschen@redhat.com>

commit b0917945efa374be7648d67dbbaaff323ab39edc
Author: Corinna Vinschen <vinschen@redhat.com>
Date:   Mon Aug 13 17:05:05 2018 +0200

    cygwin: add missing stdarg.h include
    
    Further header file standarization in Cygwin uncovered a lazy
    indirect include in bsd-cygwin_util.c
    
    Signed-off-by: Corinna Vinschen <vinschen@redhat.com>

commit c3903c38b0fd168ab3d925c2b129d1a599593426
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Mon Aug 13 02:41:05 2018 +0000

    upstream: revert compat.[ch] section of the following change. It
    
    causes double-free under some circumstances.
    
    --
    
    date: 2018/07/31 03:07:24;  author: djm;  state: Exp;  lines: +33 -18;  commitid: f7g4UI8eeOXReTPh;
    fix some memory leaks spotted by Coverity via Jakub Jelen in bz#2366
    feedback and ok dtucker@
    
    OpenBSD-Commit-ID: 1e77547f60fdb5e2ffe23e2e4733c54d8d2d1137

commit 1b9dd4aa15208100fbc3650f33ea052255578282
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Sun Aug 12 20:19:13 2018 +0000

    upstream: better diagnosics on alg list assembly errors; ok
    
    deraadt@ markus@
    
    OpenBSD-Commit-ID: 5a557e74b839daf13cc105924d2af06a1560faee

commit e36a5f61b0f5bebf6d49c215d228cd99dfe86e28
Author: Damien Miller <djm@mindrot.org>
Date:   Sat Aug 11 18:08:45 2018 -0700

    Some AIX fixes; report from Michael Felt

commit 2f4766ceefe6657c5ad5fe92d13c411872acae0e
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Fri Aug 10 01:35:49 2018 +0000

    upstream: The script that cooks up PuTTY format host keys does not
    
    understand the new key format so convert back to old format to create the
    PuTTY key and remove it once done.
    
    OpenBSD-Regress-ID: 2a449a18846c3a144bc645135b551ba6177e38d3

commit e1b26ce504662a5d5b991091228984ccfd25f280
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Fri Aug 10 00:44:01 2018 +0000

    upstream: improve
    
    OpenBSD-Commit-ID: 40d839db0977b4e7ac8b647b16d5411d4faf2f60

commit 7c712966a3139622f7fb55045368d05de4e6782c
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Fri Aug 10 00:42:29 2018 +0000

    upstream: Describe pubkey format, prompted by bz#2853
    
    While I'm here, describe and link to the remaining local PROTOCOL.*
    docs that weren't already mentioned (PROTOCOL.key, PROTOCOL.krl and
    PROTOCOL.mux)
    
    OpenBSD-Commit-ID: 2a900f9b994ba4d53e7aeb467d44d75829fd1231

commit ef100a2c5a8ed83afac0b8f36520815803da227a
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Fri Aug 10 00:27:15 2018 +0000

    upstream: fix numbering
    
    OpenBSD-Commit-ID: bc7a1764dff23fa4c5ff0e3379c9c4d5b63c9596

commit ed7bd5d93fe14c7bd90febd29b858ea985d14d45
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Wed Aug 8 01:16:01 2018 +0000

    upstream: Use new private key format by default. This format is
    
    suported by OpenSSH >= 6.5 (released January 2014), so it should be supported
    by most OpenSSH versions in active use.
    
    It is possible to convert new-format private keys to the older
    format using "ssh-keygen -f /path/key -pm PEM".
    
    ok deraadt dtucker
    
    OpenBSD-Commit-ID: e3bd4f2509a2103bfa2f710733426af3ad6d8ab8

commit 967226a1bdde59ea137e8f0df871854ff7b91366
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Sat Aug 4 00:55:06 2018 +0000

    upstream: invalidate dh->priv_key after freeing it in error path;
    
    avoids unlikely double-free later. Reported by Viktor Dukhovni via
    https://github.com/openssh/openssh-portable/pull/96 feedback jsing@ tb@
    
    OpenBSD-Commit-ID: e317eb17c3e05500ae851f279ef6486f0457c805

commit 74287f5df9966a0648b4a68417451dd18f079ab8
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Tue Jul 31 03:10:27 2018 +0000

    upstream: delay bailout for invalid authentic
    
    =?UTF-8?q?ating=20user=20until=20after=20the=20packet=20containing=20the?=
    =?UTF-8?q?=20request=20has=20been=20fully=20parsed.=20Reported=20by=20Dar?=
    =?UTF-8?q?iusz=20Tytko=20and=20Micha=C5=82=20Sajdak;=20ok=20deraadt?=
    MIME-Version: 1.0
    Content-Type: text/plain; charset=UTF-8
    Content-Transfer-Encoding: 8bit
    
    OpenBSD-Commit-ID: b4891882fbe413f230fe8ac8a37349b03bd0b70d

commit 1a66079c0669813306cc69e5776a4acd9fb49015
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Tue Jul 31 03:07:24 2018 +0000

    upstream: fix some memory leaks spotted by Coverity via Jakub Jelen
    
    in bz#2366 feedback and ok dtucker@
    
    OpenBSD-Commit-ID: 8402bbae67d578bedbadb0ce68ff7c5a136ef563

commit 87f08be054b7eeadbb9cdeb3fb4872be79ccf218
Author: Damien Miller <djm@mindrot.org>
Date:   Fri Jul 20 13:18:28 2018 +1000

    Remove support for S/Key
    
    Most people will 1) be using modern multi-factor authentication methods
    like TOTP/OATH etc and 2) be getting support for multi-factor
    authentication via PAM or BSD Auth.

commit 5d14019ba2ff54acbfd20a6b9b96bb860a8c7c31
Author: markus@openbsd.org <markus@openbsd.org>
Date:   Fri Jul 27 12:03:17 2018 +0000

    upstream: avoid expensive channel_open_message() calls; ok djm@
    
    OpenBSD-Commit-ID: aea3b5512ad681cd8710367d743e8a753d4425d9

commit e655ee04a3cb7999dbf9641b25192353e2b69418
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Fri Jul 27 05:34:42 2018 +0000

    upstream: Now that ssh can't be setuid, remove the
    
    original_real_uid and original_effective_uid globals and replace with calls
    to plain getuid(). ok djm@
    
    OpenBSD-Commit-ID: 92561c0cd418d34e6841e20ba09160583e27b68c

commit 73ddb25bae4c33a0db361ac13f2e3a60d7c6c4a5
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Fri Jul 27 05:13:02 2018 +0000

    upstream: Remove uid checks from low port binds. Now that ssh
    
    cannot be setuid and sshd always has privsep on, we can remove the uid checks
    for low port binds and just let the system do the check. We leave a sanity
    check for the !privsep case so long as the code is stil there.  with & ok
    djm@
    
    OpenBSD-Commit-ID: 9535cfdbd1cd54486fdbedfaee44ce4367ec7ca0

commit c12033e102760d043bc5c98e6c8180e4d331b0df
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Fri Jul 27 03:55:22 2018 +0000

    upstream: ssh(1) no longer supports being setuid root. Remove reference
    
    to crc32 which went with protocol 1.  Pointed out by deraadt@.
    
    OpenBSD-Commit-ID: f8763c25fd96ed91dd1abdab5667fd2e27e377b6

commit 4492e2ec4e1956a277ef507f51d66e5c2aafaaf8
Author: Damien Miller <djm@mindrot.org>
Date:   Fri Jul 27 14:15:28 2018 +1000

    correct snprintf truncation check in closefrom()
    
    Truncation cannot happen unless the system has set PATH_MAX to some
    nonsensically low value.
    
    bz#2862, patch from Daniel Le

commit 149cab325a8599a003364ed833f878449c15f259
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Fri Jul 27 13:46:06 2018 +1000

    Include stdarg.h in mkdtemp for va_list.

commit 6728f31bdfdc864d192773c32465b1860e23f556
Author: deraadt@openbsd.org <deraadt@openbsd.org>
Date:   Wed Jul 25 17:12:35 2018 +0000

    upstream: Don't redefine Makefile choices which come correct from
    
    bsd.*.mk ok markus
    
    OpenBSD-Commit-ID: 814b2f670df75759e1581ecef530980b2b3d7e0f

commit 21fd477a855753c1a8e450963669e28e39c3b5d2
Author: deraadt@openbsd.org <deraadt@openbsd.org>
Date:   Wed Jul 25 13:56:23 2018 +0000

    upstream: fix indent; Clemens Goessnitzer
    
    OpenBSD-Commit-ID: b5149a6d92b264d35f879d24608087b254857a83

commit 8e433c2083db8664c41499ee146448ea7ebe7dbf
Author: beck@openbsd.org <beck@openbsd.org>
Date:   Wed Jul 25 13:10:56 2018 +0000

    upstream: Use the caller provided (copied) pwent struct in
    
    load_public_identity_files instead of calling getpwuid() again and discarding
    the argument. This prevents a client crash where tilde_expand_filename calls
    getpwuid() again before the pwent pointer is used. Issue noticed and reported
    by Pierre-Olivier Martel <pom@apple.com> ok djm@ deraadt@
    
    OpenBSD-Commit-ID: a067d74b5b098763736c94cc1368de8ea3f0b157

commit e2127abb105ae72b6fda64fff150e6b24b3f1317
Author: jmc@openbsd.org <jmc@openbsd.org>
Date:   Mon Jul 23 19:53:55 2018 +0000

    upstream: oops, failed to notice that SEE ALSO got messed up;
    
    OpenBSD-Commit-ID: 61c1306542cefdc6e59ac331751afe961557427d

commit ddf1b797c2d26bbbc9d410aa4f484cbe94673587
Author: kn@openbsd.org <kn@openbsd.org>
Date:   Mon Jul 23 19:02:49 2018 +0000

    upstream: Point to glob in section 7 for the actual list of special
    
    characters instead the C API in section 3.
    
    OK millert jmc nicm, "the right idea" deraadt
    
    OpenBSD-Commit-ID: a74fd215488c382809e4d041613aeba4a4b1ffc6

commit 01c98d9661d0ed6156e8602b650f72eed9fc4d12
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Sun Jul 22 12:16:59 2018 +0000

    upstream: Switch authorized_keys example from ssh-dss to ssh-rsa
    
    since the former is no longer enabled by default.  Pointed out by Daniel A.
    Maierhofer, ok jmc
    
    OpenBSD-Commit-ID: 6a196cef53d7524e0c9b58cdbc1b5609debaf8c7

commit 472269f8fe19343971c2d08f504ab5cbb8234b33
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Fri Jul 20 05:01:10 2018 +0000

    upstream: slightly-clearer description for AuthenticationMethods - the
    
    lists have comma-separated elements; bz#2663 from Hans Meier
    
    OpenBSD-Commit-ID: 931c983d0fde4764d0942fb2c2b5017635993b5a

commit c59aca8adbdf7f5597084ad360a19bedb3f80970
Author: Damien Miller <djm@mindrot.org>
Date:   Fri Jul 20 14:53:42 2018 +1000

    Create control sockets in clean temp directories
    
    Adds a regress/mkdtemp tool and uses it to create empty temp
    directories for tests needing control sockets.
    
    Patch from Colin Watson via bz#2660; ok dtucker

commit 6ad8648e83e4f4ace37b742a05c2a6b6b872514e
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Fri Jul 20 03:46:34 2018 +0000

    upstream: remove unused zlib.h
    
    OpenBSD-Commit-ID: 8d274a9b467c7958df12668b49144056819f79f1

commit 3ba6e6883527fe517b6e4a824876e2fe62af22fc
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Thu Jul 19 23:03:16 2018 +0000

    upstream: Fix typo in comment. From Alexandru Iacob via github.
    
    OpenBSD-Commit-ID: eff4ec07c6c8c5483533da43a4dda37d72ef7f1d

commit c77bc73c91bc656e343a1961756e09dd1b170820
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Fri Jul 20 13:48:51 2018 +1000

    Explicitly include openssl before zlib.
    
    Some versions of OpenSSL have "free_func" in their headers, which zlib
    typedefs.  Including openssl after zlib (eg via sshkey.h) results in
    "syntax error before `free_func'", which this fixes.

commit 95d41e90eafcd1286a901e8e361e4a37b98aeb52
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Thu Jul 19 10:28:47 2018 +0000

    upstream: Deprecate UsePrivilegedPort now that support for running
    
    ssh(1) setuid has been removed, remove supporting code and clean up
    references to it in the man pages
    
    We have not shipped ssh(1) the setuid bit since 2002.  If ayone
    really needs to make connections from a low port number this can
    be implemented via a small setuid ProxyCommand.
    
    ok markus@ jmc@ djm@
    
    OpenBSD-Commit-ID: d03364610b7123ae4c6792f5274bd147b6de717e

commit 258dc8bb07dfb35a46e52b0822a2c5b7027df60a
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Wed Jul 18 11:34:04 2018 +0000

    upstream: Remove support for running ssh(1) setuid and fatal if
    
    attempted. Do not link uidwap.c into ssh any more.  Neuters
    UsePrivilegedPort, which will be marked as deprecated shortly. ok markus@
    djm@
    
    OpenBSD-Commit-ID: c4ba5bf9c096f57a6ed15b713a1d7e9e2e373c42

commit ac590760b251506b0a152551abbf8e8d6dc2f527
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Mon Jul 16 22:25:01 2018 +0000

    upstream: Slot 0 in the hostbased key array was previously RSA1,
    
    but that is now gone and the slot is unused so remove it.  Remove two
    now-unused macros, and add an array bounds check to the two remaining ones
    (array is statically sized, so mostly a safety check on future changes). ok
    markus@
    
    OpenBSD-Commit-ID: 2e4c0ca6cc1d8daeccead2aa56192a3f9d5e1e7a

commit 26efc2f5df0e3bcf6a6bbdd0506fd682d60c2145
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Mon Jul 16 11:05:41 2018 +0000

    upstream: Remove support for loading HostBasedAuthentication keys
    
    directly in ssh(1) and always use ssh-keysign.  This removes one of the few
    remaining reasons why ssh(1) might be setuid.  ok markus@
    
    OpenBSD-Commit-ID: 97f01e1448707129a20d75f86bad5d27c3cf0b7d

commit 3eb7f1038d17af7aea3c2c62d1e30cd545607640
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Mon Jul 16 07:06:50 2018 +0000

    upstream: keep options.identity_file_userprovided array in sync when we
    
    load keys, fixing some spurious error messages; ok markus
    
    OpenBSD-Commit-ID: c63e3d5200ee2cf9e35bda98de847302566c6a00

commit 2f131e1b34502aa19f345e89cabf6fa3fc097f09
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Mon Jul 16 03:09:59 2018 +0000

    upstream: memleak in unittest; found by valgrind
    
    OpenBSD-Regress-ID: 168c23b0fb09fc3d0b438628990d3fd9260a8a5e

commit de2997a4cf22ca0a524f0e5b451693c583e2fd89
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Mon Jul 16 03:09:13 2018 +0000

    upstream: memleaks; found by valgrind
    
    OpenBSD-Commit-ID: 6c3ba22be53e753c899545f771e8399fc93cd844

commit 61cc0003eb37fa07603c969c12b7c795caa498f3
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Sat Jul 14 16:49:01 2018 +1000

    Undef a few new macros in sys-queue.h.
    
    Prevents macro redefinition warnings on OSX.

commit 30a2c213877a54a44dfdffb6ca8db70be5b457e0
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Fri Jul 13 13:40:20 2018 +1000

    Include unistd.h for geteuid declaration.

commit 1dd32c23f2a85714dfafe2a9cc516971d187caa4
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Fri Jul 13 13:38:10 2018 +1000

    Fallout from buffer conversion in AUDIT_EVENTS.
    
    Supply missing "int r" and fix error path for sshbuf_new().

commit 7449c178e943e5c4f6c8416a4e41d93b70c11c9e
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Fri Jul 13 02:13:50 2018 +0000

    upstream: make this use ssh_proxy rather than starting/stopping a
    
    daemon for each testcase
    
    OpenBSD-Regress-ID: 608b7655ea65b1ba8fff5a13ce9caa60ef0c8166

commit dbab02f9208d9baa134cec1d007054ec82b96ca9
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Fri Jul 13 02:13:19 2018 +0000

    upstream: fix leaks in unit test; with this, all unit tests are
    
    leak free (as far as valgrind can spot anyway)
    
    OpenBSD-Regress-ID: b824d8b27998365379963440e5d18b95ca03aa17

commit 2f6accff5085eb79b0dbe262d8b85ed017d1a51c
Author: Damien Miller <djm@mindrot.org>
Date:   Fri Jul 13 11:39:25 2018 +1000

    Enable leak checks for unit tests with valgrind
    
    Leave the leak checking on unconditionally when running with valgrind.
    The unit tests are leak-free and I want them to stay that way.

commit e46cfbd9db5e907b821bf4fd0184d4dab99815ee
Author: Damien Miller <djm@mindrot.org>
Date:   Fri Jul 13 11:38:59 2018 +1000

    increase timeout to match cfgmatch.sh
    
    lets test pass under valgrind (on my workstation at least)

commit 6aa1bf475cf3e7a2149acc5a1e80e904749f064c
Author: Damien Miller <djm@mindrot.org>
Date:   Thu Jul 12 14:54:18 2018 +1000

    rm regress/misc/kexfuzz/*.o in distclean target

commit eef1447ddb559c03725a23d4aa6d03f40e8b0049
Author: Damien Miller <djm@mindrot.org>
Date:   Thu Jul 12 14:49:26 2018 +1000

    repair !WITH_OPENSSL build

commit 4d3b2f36fd831941d1627ac587faae37b6d3570f
Author: Damien Miller <djm@mindrot.org>
Date:   Thu Jul 12 14:49:14 2018 +1000

    missing headers

commit 3f420a692b293921216549c1099c2e46ff284eae
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Thu Jul 12 14:57:46 2018 +1000

    Remove key.h from portable files too.
    
    Commit 5467fbcb removed key.h so stop including it in portable files
    too.  Fixes builds on lots of platforms.

commit e2c4af311543093f16005c10044f7e06af0426f0
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Thu Jul 12 04:35:25 2018 +0000

    upstream: remove prototype to long-gone function
    
    OpenBSD-Commit-ID: 0414642ac7ce01d176b9f359091a66a8bbb640bd

commit 394a842e60674bf8ee5130b9f15b01452a0b0285
Author: markus@openbsd.org <markus@openbsd.org>
Date:   Wed Jul 11 18:55:11 2018 +0000

    upstream: treat ssh_packet_write_wait() errors as fatal; ok djm@
    
    OpenBSD-Commit-ID: f88ba43c9d54ed2d911218aa8d3f6285430629c3

commit 5467fbcb09528ecdcb914f4f2452216c24796790
Author: markus@openbsd.org <markus@openbsd.org>
Date:   Wed Jul 11 18:53:29 2018 +0000

    upstream: remove legacy key emulation layer; ok djm@
    
    OpenBSD-Commit-ID: 2b1f9619259e222bbd4fe9a8d3a0973eafb9dd8d

commit 5dc4c59d5441a19c99e7945779f7ec9051126c25
Author: martijn@openbsd.org <martijn@openbsd.org>
Date:   Wed Jul 11 08:19:35 2018 +0000

    upstream: s/wuth/with/ in comment
    
    OpenBSD-Commit-ID: 9de41468afd75f54a7f47809d2ad664aa577902c

commit 1c688801e9dd7f9889fb2a29bc2b6fbfbc35a11f
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Wed Jul 11 12:12:38 2018 +1000

    Include stdlib.h for declaration of free.
    
    Fixes build with -Werror on at least Fedora and probably others.

commit fccfa239def497615f92ed28acc57cfe63da3666
Author: Damien Miller <djm@mindrot.org>
Date:   Wed Jul 11 10:19:56 2018 +1000

    VALGRIND_CHECK_LEAKS logic was backwards :(

commit 416287d45fcde0a8e66eee8b99aa73bd58607588
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Wed Jul 11 10:10:26 2018 +1000

    Fix sshbuf_new error path in skey.

commit 7aab109b8b90a353c1af780524f1ac0d3af47bab
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Wed Jul 11 10:06:18 2018 +1000

    Supply missing third arg in skey.
    
    During the change to the new buffer api the third arg to
    sshbuf_get_cstring was ommitted.  Fixes build when configured with skey.

commit 380320bb72cc353a901790ab04b6287fd335dc4a
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Wed Jul 11 10:03:34 2018 +1000

    Supply some more missing "int r" in skey

commit d20720d373d8563ee737d1a45dc5e0804d622dbc
Author: Damien Miller <djm@mindrot.org>
Date:   Wed Jul 11 09:56:36 2018 +1000

    disable valgrind memleak checking by default
    
    Add VALGRIND_CHECK_LEAKS knob to turn it back on.

commit 79c9d35018f3a5e30ae437880b669aa8636cd3cd
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Wed Jul 11 09:54:00 2018 +1000

    Supply missing "int r" in skey code.

commit 984bacfaacbbe31c35191b828fb5b5b2f0362c36
Author: sf@openbsd.org <sf@openbsd.org>
Date:   Tue Jul 10 09:36:58 2018 +0000

    upstream: re-remove some pre-auth compression bits
    
    This time, make sure to not remove things that are necessary for
    pre-auth compression on the client. Add a comment that pre-auth
    compression is still supported in the client.
    
    ok markus@
    
    OpenBSD-Commit-ID: 282c6fec7201f18a5c333bbb68d9339734d2f784

commit 120a1ec74e8d9d29f4eb9a27972ddd22351ddef9
Author: Damien Miller <djm@mindrot.org>
Date:   Tue Jul 10 19:39:52 2018 +1000

    Adapt portable to legacy buffer API removal

commit 0f3958c1e6ffb8ea4ba27e2a97a00326fce23246
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Tue Jul 10 09:13:30 2018 +0000

    upstream: kerberos/gssapi fixes for buffer removal
    
    OpenBSD-Commit-ID: 1cdf56fec95801e4563c47f21696f04cd8b60c4c

commit c74ae8e7c45f325f3387abd48fa7dfef07a08069
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Tue Jul 10 06:45:29 2018 +0000

    upstream: buffer.[ch] and bufaux.c are no more
    
    OpenBSD-Commit-ID: d1a1852284e554f39525eb4d4891b207cfb3d3a0

commit a881e5a133d661eca923fb0633a03152ab2b70b2
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Tue Jul 10 06:43:52 2018 +0000

    upstream: one mention of Buffer that almost got away :)
    
    OpenBSD-Commit-ID: 30d7c27a90b4544ad5dfacf654595710cd499f02

commit 49f47e656b60bcd1d1db98d88105295f4b4e600d
Author: markus@openbsd.org <markus@openbsd.org>
Date:   Mon Jul 9 21:59:10 2018 +0000

    upstream: replace cast with call to sshbuf_mutable_ptr(); ok djm@
    
    OpenBSD-Commit-ID: 4dfe9d29fa93d9231645c89084f7217304f7ba29

commit cb30cd47041edb03476be1c8ef7bc1f4b69d1555
Author: markus@openbsd.org <markus@openbsd.org>
Date:   Mon Jul 9 21:56:06 2018 +0000

    upstream: remove legacy buffer API emulation layer; ok djm@
    
    OpenBSD-Commit-ID: 2dd5dc17cbc23195be4299fa93be2707a0e08ad9

commit 235c7c4e3bf046982c2d8242f30aacffa01073d1
Author: markus@openbsd.org <markus@openbsd.org>
Date:   Mon Jul 9 21:53:45 2018 +0000

    upstream: sshd: switch monitor to sshbuf API; lots of help & ok
    
    djm@
    
    OpenBSD-Commit-ID: d89bd02d33974fd35ca0b8940d88572227b34a48

commit b8d9214d969775e409e1408ecdf0d58fad99b344
Author: markus@openbsd.org <markus@openbsd.org>
Date:   Mon Jul 9 21:37:55 2018 +0000

    upstream: sshd: switch GSSAPI to sshbuf API; ok djm@
    
    OpenBSD-Commit-ID: e48449ab4be3f006f7ba33c66241b7d652973e30

commit c7d39ac8dc3587c5f05bdd5bcd098eb5c201c0c8
Author: markus@openbsd.org <markus@openbsd.org>
Date:   Mon Jul 9 21:35:50 2018 +0000

    upstream: sshd: switch authentication to sshbuf API; ok djm@
    
    OpenBSD-Commit-ID: 880aa06bce4b140781e836bb56bec34873290641

commit c3cb7790e9efb14ba74b2d9f543ad593b3d55b31
Author: markus@openbsd.org <markus@openbsd.org>
Date:   Mon Jul 9 21:29:36 2018 +0000

    upstream: sshd: switch config to sshbuf API; ok djm@
    
    OpenBSD-Commit-ID: 72b02017bac7feac48c9dceff8355056bea300bd

commit 2808d18ca47ad3d251836c555f0e22aaca03d15c
Author: markus@openbsd.org <markus@openbsd.org>
Date:   Mon Jul 9 21:26:02 2018 +0000

    upstream: sshd: switch loginmsg to sshbuf API; ok djm@
    
    OpenBSD-Commit-ID: f3cb4e54bff15c593602d95cc43e32ee1a4bac42

commit 89dd615b8b531979be63f05f9d5624367c9b28e6
Author: markus@openbsd.org <markus@openbsd.org>
Date:   Mon Jul 9 21:20:26 2018 +0000

    upstream: ttymodes: switch to sshbuf API; ok djm@
    
    OpenBSD-Commit-ID: 5df340c5965e822c9da21e19579d08dea3cbe429

commit f4608a7065480516ab46214f554e5f853fb7870f
Author: markus@openbsd.org <markus@openbsd.org>
Date:   Mon Jul 9 21:18:10 2018 +0000

    upstream: client: switch mux to sshbuf API; with & ok djm@
    
    OpenBSD-Commit-ID: 5948fb98d704f9c4e075b92edda64e0290b5feb2

commit cecee2d607099a7bba0a84803e2325d15be4277b
Author: markus@openbsd.org <markus@openbsd.org>
Date:   Mon Jul 9 21:03:30 2018 +0000

    upstream: client: switch to sshbuf API; ok djm@
    
    OpenBSD-Commit-ID: 60cb0356114acc7625ab85105f6f6a7cd44a8d05

commit ff55f4ad898137d4703e7a2bcc81167dfe8e9324
Author: markus@openbsd.org <markus@openbsd.org>
Date:   Mon Jul 9 20:39:28 2018 +0000

    upstream: pkcs11: switch to sshbuf API; ok djm@
    
    OpenBSD-Commit-ID: 98cc4e800f1617c51caf59a6cb3006f14492db79

commit 168b46f405d6736960ba7930389eecb9b6710b7e
Author: sf@openbsd.org <sf@openbsd.org>
Date:   Mon Jul 9 13:37:10 2018 +0000

    upstream: Revert previous two commits
    
    It turns out we still support pre-auth compression on the client.
    Therefore revert the previous two commits:
    
    date: 2018/07/06 09:06:14;  author: sf;  commitid: yZVYKIRtUZWD9CmE;
     Rename COMP_DELAYED to COMP_ZLIB
    
     Only delayed compression is supported nowadays.
    
     ok markus@
    
    date: 2018/07/06 09:05:01;  author: sf;  commitid: rEGuT5UgI9f6kddP;
     Remove leftovers from pre-authentication compression
    
     Support for this has been removed in 2016.
     COMP_DELAYED will be renamed in a later commit.
    
     ok markus@
    
    OpenBSD-Commit-ID: cdfef526357e4e1483c86cf599491b2dafb77772

commit ab39267fa1243d02b6c330615539fc4b21e17dc4
Author: sf@openbsd.org <sf@openbsd.org>
Date:   Fri Jul 6 09:06:14 2018 +0000

    upstream: Rename COMP_DELAYED to COMP_ZLIB
    
    Only delayed compression is supported nowadays.
    
    ok markus@
    
    OpenBSD-Commit-ID: 5b1dbaf3d9a4085aaa10fec0b7a4364396561821

commit 95db395d2e56a6f868193aead6cadb2493f036c6
Author: sf@openbsd.org <sf@openbsd.org>
Date:   Fri Jul 6 09:05:01 2018 +0000

    upstream: Remove leftovers from pre-authentication compression
    
    Support for this has been removed in 2016.
    COMP_DELAYED will be renamed in a later commit.
    
    ok markus@
    
    OpenBSD-Commit-ID: 6a99616c832627157113fcb0cf5a752daf2e6b58

commit f28a4d5cd24c4aa177e96b4f96957991e552cb70
Author: sf@openbsd.org <sf@openbsd.org>
Date:   Fri Jul 6 09:03:02 2018 +0000

    upstream: Remove unused ssh_packet_start_compression()
    
    ok markus@
    
    OpenBSD-Commit-ID: 9d34cf2f59aca5422021ae2857190578187dc2b4

commit 872517ddbb72deaff31d4760f28f2b0a1c16358f
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Fri Jul 6 13:32:02 2018 +1000

    Defer setting bufsiz in getdelim.
    
    Do not write to bufsiz until we are sure the malloc has succeeded,
    in case any callers rely on it (which they shouldn't).  ok djm@

commit 3deb56f7190a414dc264e21e087a934fa1847283
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Thu Jul 5 13:32:01 2018 +1000

    Fix other callers of read_environment_file.
    
    read_environment_file recently gained an extra argument   Some platform
    specific code also calls it so add the argument to those too.  Fixes
    build on Solaris and AIX.

commit 314908f451e6b2d4ccf6212ad246fa4619c721d3
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Wed Jul 4 13:51:45 2018 +0000

    upstream: deal with API rename: match_filter_list() =>
    
    match_filter_blacklist()
    
    OpenBSD-Regress-ID: 2da342be913efeb51806351af906fab01ba4367f

commit 89f54cdf6b9cf1cf5528fd33897f1443913ddfb4
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Wed Jul 4 13:51:12 2018 +0000

    upstream: exercise new expansion behaviour of
    
    PubkeyAcceptedKeyTypes and, by proxy, test kex_assemble_names()
    
    ok markus@
    
    OpenBSD-Regress-ID: 292978902e14d5729aa87e492dd166c842f72736

commit 187633f24c71564e970681c8906df5a6017dcccf
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Tue Jul 3 13:53:26 2018 +0000

    upstream: add a comment that could have saved me 45 minutes of wild
    
    goose chasing
    
    OpenBSD-Regress-ID: d469b29ffadd3402c090e21b792d627d46fa5297

commit 312d2f2861a2598ed08587cb6c45c0e98a85408f
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Wed Jul 4 13:49:31 2018 +0000

    upstream: repair PubkeyAcceptedKeyTypes (and friends) after RSA
    
    signature work - returns ability to add/remove/specify algorithms by
    wildcard.
    
    Algorithm lists are now fully expanded when the server/client configs
    are finalised, so errors are reported early and the config dumps
    (e.g. "ssh -G ...") now list the actual algorithms selected.
    
    Clarify that, while wildcards are accepted in algorithm lists, they
    aren't full pattern-lists that support negation.
    
    (lots of) feedback, ok markus@
    
    OpenBSD-Commit-ID: a8894c5c81f399a002f02ff4fe6b4fa46b1f3207

commit 303af5803bd74bf05d375c04e1a83b40c30b2be5
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Tue Jul 3 11:43:49 2018 +0000

    upstream: some magic for RSA-SHA2 checks
    
    OpenBSD-Regress-ID: e5a9b11368ff6d86e7b25ad10ebe43359b471cd4

commit 7d68e262944c1fff1574600fe0e5e92ec8b398f5
Author: Damien Miller <djm@mindrot.org>
Date:   Tue Jul 3 23:27:11 2018 +1000

    depend

commit b4d4eda633af433d20232cbf7e855ceac8b83fe5
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Tue Jul 3 13:20:25 2018 +0000

    upstream: some finesse to fix RSA-SHA2 certificate authentication
    
    for certs hosted in ssh-agent
    
    OpenBSD-Commit-ID: e5fd5edd726137dda2d020e1cdebc464110a010f

commit d78b75df4a57e0f92295f24298e5f2930e71c172
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Tue Jul 3 13:07:58 2018 +0000

    upstream: check correct variable; unbreak agent keys
    
    OpenBSD-Commit-ID: c36981fdf1f3ce04966d3310826a3e1e6233d93e

commit 2f30300c5e15929d0e34013f38d73e857f445e12
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Tue Jul 3 11:42:12 2018 +0000

    upstream: crank version number to 7.8; needed for new compat flag
    
    for prior version; part of RSA-SHA2 strictification, ok markus@
    
    OpenBSD-Commit-ID: 84a11fc0efd2674c050712336b5093f5d408e32b

commit 4ba0d54794814ec0de1ec87987d0c3b89379b436
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Tue Jul 3 11:39:54 2018 +0000

    upstream: Improve strictness and control over RSA-SHA2 signature
    
    In ssh, when an agent fails to return a RSA-SHA2 signature when
    requested and falls back to RSA-SHA1 instead, retry the signature to
    ensure that the public key algorithm sent in the SSH_MSG_USERAUTH
    matches the one in the signature itself.
    
    In sshd, strictly enforce that the public key algorithm sent in the
    SSH_MSG_USERAUTH message matches what appears in the signature.
    
    Make the sshd_config PubkeyAcceptedKeyTypes and
    HostbasedAcceptedKeyTypes options control accepted signature algorithms
    (previously they selected supported key types). This allows these
    options to ban RSA-SHA1 in favour of RSA-SHA2.
    
    Add new signature algorithms "rsa-sha2-256-cert-v01@openssh.com" and
    "rsa-sha2-512-cert-v01@openssh.com" to force use of RSA-SHA2 signatures
    with certificate keys.
    
    feedback and ok markus@
    
    OpenBSD-Commit-ID: c6e9f6d45eed8962ad502d315d7eaef32c419dde

commit 95344c257412b51199ead18d54eaed5bafb75617
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Tue Jul 3 10:59:35 2018 +0000

    upstream: allow sshd_config PermitUserEnvironment to accept a
    
    pattern-list of whitelisted environment variable names in addition to yes|no.
    
    bz#1800, feedback and ok markus@
    
    OpenBSD-Commit-ID: 77dc2b468e0bf04b53f333434ba257008a1fdf24

commit 6f56fe4b9578b0627667f8bce69d4d938a88324c
Author: millert@openbsd.org <millert@openbsd.org>
Date:   Tue Jun 26 11:23:59 2018 +0000

    upstream: Fix "WARNING: line 6 disappeared in /etc/moduli, giving up"
    
    when choosing a prime.  An extra increment of linenum snuck in as part of the
    conversion to getline().  OK djm@ markus@
    
    OpenBSD-Commit-ID: 0019225cb52ed621b71cd9f19ee2e78e57e3dd38

