commit 279261e1ea8150c7c64ab5fe7cb4a4ea17acbb29
Author: Damien Miller <djm@mindrot.org>
Date:   Sun Sep 27 17:25:01 2020 +1000

    update version numbers

commit 58ca6ab6ff035ed12b5078e3e9c7199fe72c8587
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Sun Sep 27 07:22:05 2020 +0000

    upstream: openssh 8.4
    
    OpenBSD-Commit-ID: a29e5b372d2c00e297da8a35a3b87c9beb3b4a58

commit 9bb8a303ce05ff13fb421de991b495930be103c3
Author: Damien Miller <djm@mindrot.org>
Date:   Tue Sep 22 10:07:43 2020 +1000

    sync with upstream ssh-copy-id rev f0da1a1b7

commit 0a4a5571ada76b1b012bec9cf6ad1203fc19ec8d
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Mon Sep 21 07:29:09 2020 +0000

    upstream: close stdin when forking after authentication too; ok markus
    
    OpenBSD-Commit-ID: 43db17e4abc3e6b4a7b033aa8cdab326a7cb6c24

commit d14fe25e6c3b89f8af17e2894046164ac3b45688
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Sun Sep 20 23:31:46 2020 +0000

    upstream: close stdout/stderr after "ssh -f ..." forking
    
    bz#3137, ok markus
    
    OpenBSD-Commit-ID: e2d83cc4dea1665651a7aa924ad1ed6bcaaab3e2

commit 53a33a0d745179c02108589e1722457ca8ae4372
Author: Damien Miller <djm@mindrot.org>
Date:   Sun Sep 20 15:57:09 2020 +1000

    .depend

commit 107eb3eeafcd390e1fa7cc7672a05e994d14013e
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Sun Sep 20 05:47:25 2020 +0000

    upstream: cap channel input buffer size at 16MB; avoids high memory use
    
    when peer advertises a large window but is slow to consume the data we send
    (e.g. because of a slow network)
    
    reported by Pierre-Yves David
    
    fix with & ok markus@
    
    OpenBSD-Commit-ID: 1452771f5e5e768876d3bfe2544e3866d6ade216

commit acfe2ac5fe033e227ad3a56624fbbe4af8b5da04
Author: Damien Miller <djm@mindrot.org>
Date:   Fri Sep 18 22:02:53 2020 +1000

    libfido2 1.5.0 is recommended

commit 52a03e9fca2d74eef953ddd4709250f365ca3975
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Fri Sep 18 08:16:38 2020 +0000

    upstream: handle multiple messages in a single read()
    
    PR#183 by Dennis Kaarsemaker; feedback and ok markus@
    
    OpenBSD-Commit-ID: 8570bb4d02d00cf70b98590716ea6a7d1cce68d1

commit dc098405b2939146e17567a25b08fc6122893cdf
Author: pedro martelletto <pedro@ambientworks.net>
Date:   Fri Sep 18 08:57:29 2020 +0200

    configure.ac: add missing includes
    
    when testing, make sure to include the relevant header files that
    declare the types of the functions used by the test:
    
    - stdio.h for printf();
    - stdlib.h for exit();
    - string.h for strcmp();
    - unistd.h for unlink(), _exit(), fork(), getppid(), sleep().

commit b3855ff053f5078ec3d3c653cdaedefaa5fc362d
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Fri Sep 18 05:23:03 2020 +0000

    upstream: tweak the client hostkey preference ordering algorithm to
    
    prefer the default ordering if the user has a key that matches the
    best-preference default algorithm.
    
    feedback and ok markus@
    
    OpenBSD-Commit-ID: a92dd7d7520ddd95c0a16786a7519e6d0167d35f

commit f93b187ab900c7d12875952cc63350fe4de8a0a8
Author: Damien Miller <djm@mindrot.org>
Date:   Fri Sep 18 14:55:48 2020 +1000

    control over the colours in gnome-ssh-askpass[23]
    
    Optionally set the textarea colours via $GNOME_SSH_ASKPASS_FG_COLOR and
    $GNOME_SSH_ASKPASS_BG_COLOR. These accept the usual three or six digit
    hex colours.

commit 9d3d36bdb10b66abd1af42e8655502487b6ba1fa
Author: Damien Miller <djm@mindrot.org>
Date:   Fri Sep 18 14:50:38 2020 +1000

    focus improvement for gnome-ssh-askpass[23]
    
    When serving a SSH_ASKPASS_PROMPT=none information dialog, ensure
    then <enter> doesn't immediately close the dialog. Instead, require an
    explicit <tab> to reach the close button, or <esc>.

commit d6f507f37e6c75a899db0ef8224e72797c5563b6
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Wed Sep 16 03:07:31 2020 +0000

    upstream: Remove unused buf, last user was removed when switching
    
    to the sshbuf API. Patch from Sebastian Andrzej Siewior.
    
    OpenBSD-Commit-ID: 250fa17f0cec01039cc4abd95917d9746e24c889

commit c3c786c3a0973331ee0922b2c51832a3b8d7f20f
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Wed Sep 9 21:57:27 2020 +0000

    upstream: For the hostkey confirmation message:
    
    > Are you sure you want to continue connecting (yes/no/[fingerprint])?
    
    compare the fingerprint case sensitively; spotted Patrik Lundin
    ok dtucker
    
    OpenBSD-Commit-ID: 73097afee1b3a5929324e345ba4a4a42347409f2

commit f2950baf0bafe6aa20dfe2e8d1ca4b23528df617
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Fri Sep 11 14:45:23 2020 +1000

    New config-build-time dependency on automake.

commit 600c1c27abd496372bd0cf83d21a1c119dfdf9a5
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Sun Sep 6 21:56:36 2020 +1000

    Add aclocal.m4 and config.h.in~ to .gitignore.
    
    aclocal.m4 is now generated by autoreconf.

commit 4bf7e1d00b1dcd3a6b3239f77465c019e61c6715
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Sat Sep 5 17:50:03 2020 +0200

    Quote the definition of OSSH_CHECK_HEADER_FOR_FIELD
    
    autoreconf complains about underquoted definition of
    OSSH_CHECK_HEADER_FOR_FIELD after aclocal.m4 has been and now is beeing
    recreated.
    
    Quote OSSH_CHECK_HEADER_FOR_FIELD as suggested.
    
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit a2f3ae386b5f7938ed3c565ad71f30c4f7f010f1
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Sat Sep 5 17:50:02 2020 +0200

    Move the local m4 macros
    
    The `aclocal' step is skipped during `autoreconf' because aclocal.m4 is
    present.
    Move the current aclocal.m4 which contains local macros into the m4/
    folder. With this change the aclocal.m4 will be re-created during
    changes to the m4/ macro.
    This is needed so the `aclocal' can fetch m4 macros from the system if
    they are references in the configure script. This is a prerequisite to
    use PKG_CHECK_MODULES.
    
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit 8372bff3a895b84fd78a81dc39da10928b662f5a
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Sat Sep 5 17:50:01 2020 +0200

    Remove HAVE_MMAP and BROKEN_MMAP
    
    BROKEN_MMAP is no longer defined since commit
       1cfd5c06efb12 ("Remove portability support for mmap")
    
    this commit also removed other HAVE_MMAP user. I didn't find anything
    that defines HAVE_MMAP. The check does not trigger because compression
    on server side is by default COMP_DELAYED (2) so it never triggers.
    
    Remove remaining HAVE_MMAP and BROKEN_MMAP bits.
    
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit bbf20ac8065905f9cb9aeb8f1df57fcab52ee2fb
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Wed Sep 9 03:10:21 2020 +0000

    upstream: adapt to SSH_SK_VERSION_MAJOR crank
    
    OpenBSD-Regress-ID: 0f3e76bdc8f9dbd9d22707c7bdd86051d5112ab8

commit 9afe2a150893b20bdf9eab764978d817b9a7b783
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Fri Aug 28 03:17:13 2020 +0000

    upstream: Ensure that address/mask mismatches are flagged at
    
    config-check time. ok djm@
    
    OpenBSD-Regress-ID: 8f5f4c2c0bf00e6ceae7a1755a444666de0ea5c2

commit c76773524179cb654ff838dd43ba1ddb155bafaa
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Wed Sep 9 03:08:01 2020 +0000

    upstream: when writing an attestation blob for a FIDO key, record all
    
    the data needed to verify the attestation. Previously we were missing the
    "authenticator data" that is included in the signature.
    
    spotted by Ian Haken
    feedback Pedro Martelletto and Ian Haken; ok markus@
    
    OpenBSD-Commit-ID: 8439896e63792b2db99c6065dd9a45eabbdb7e0a

commit c1c44eeecddf093a7983bd91e70b446de789b363
Author: pedro martelletto <pedro@ambientworks.net>
Date:   Tue Sep 1 17:01:55 2020 +0200

    configure.ac: fix libfido2 back-compat
    
    - HAVE_FIDO_CRED_PROD -> HAVE_FIDO_CRED_PROT;
    - check for fido_dev_get_touch_begin(), so that
      HAVE_FIDO_DEV_GET_TOUCH_BEGIN gets defined.

commit 785f0f315bf7ac5909e988bb1ac3e019fb5e1594
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Mon Aug 31 04:33:17 2020 +0000

    upstream: refuse to add verify-required (PINful) FIDO keys to
    
    ssh-agent until the agent supports them properly
    
    OpenBSD-Commit-ID: 125bd55a8df32c87c3ec33c6ebe437673a3d037e

commit 39e88aeff9c7cb6862b37ad1a87a03ebbb38c233
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Mon Aug 31 00:17:41 2020 +0000

    upstream: Add RCS IDs to the few files that are missing them; from
    
    Pedro Martelletto
    
    OpenBSD-Commit-ID: 39aa37a43d0c75ec87f1659f573d3b5867e4a3b3

commit 72730249b38a676da94a1366b54a6e96e6928bcb
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Fri Aug 28 03:15:52 2020 +0000

    upstream: Check that the addresses supplied to Match Address and
    
    Match LocalAddress are valid when parsing in config-test mode.  This will
    catch address/mask mismatches before they cause problems at runtime. Found by
    Daniel Stocker, ok djm@
    
    OpenBSD-Commit-ID: 2d0b10c69fad5d8fda4c703e7c6804935289378b

commit 2a3a9822311a565a9df48ed3b6a3c972f462bd7d
Author: jmc@openbsd.org <jmc@openbsd.org>
Date:   Thu Aug 27 12:34:00 2020 +0000

    upstream: sentence fix; from pedro martelletto
    
    OpenBSD-Commit-ID: f95b84a1e94e9913173229f3787448eea2f8a575

commit ce178be0d954b210c958bc2b9e998cd6a7aa73a9
Author: Damien Miller <djm@mindrot.org>
Date:   Thu Aug 27 20:01:52 2020 +1000

    tweak back-compat for older libfido2

commit d6f45cdde031acdf434bbb27235a1055621915f4
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Thu Aug 27 09:46:04 2020 +0000

    upstream: debug()-print a little info about FIDO-specific key
    
    fields via "ssh-keygen -vyf /path/key"
    
    OpenBSD-Commit-ID: cf315c4fe77db43947d111b00155165cb6b577cf

commit b969072cc3d62d05cb41bc6d6f3c22c764ed932f
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Thu Aug 27 09:43:28 2020 +0000

    upstream: skip a bit more FIDO token selection logic when only a
    
    single token is attached.
    
    with Pedro Martelletto
    
    OpenBSD-Commit-ID: e4a324bd9814227ec1faa8cb619580e661cca9ac

commit 744df42a129d7d7db26947b7561be32edac89f88
Author: jmc@openbsd.org <jmc@openbsd.org>
Date:   Thu Aug 27 06:15:22 2020 +0000

    upstream: tweak previous;
    
    OpenBSD-Commit-ID: 92714b6531e244e4da401b2defaa376374e24be7

commit e32479645ce649b444ba5c6e7151304306a09654
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Thu Aug 27 03:55:22 2020 +0000

    upstream: adapt to API changes
    
    OpenBSD-Regress-ID: 5f147990cb67094fe554333782ab268a572bb2dd

commit bbcc858ded3fbc46abfa7760e40389e3ca93884c
Author: Damien Miller <djm@mindrot.org>
Date:   Thu Aug 27 12:37:12 2020 +1000

    degrade semi-gracefully when libfido2 is too old

commit 9cbbdc12cb6a2ab1e9ffe9974cca91d213c185c2
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Thu Aug 27 01:15:36 2020 +0000

    upstream: dummy firmware needs to match API version numner crank (for
    
    verify-required resident keys) even though it doesn't implement this feature
    
    OpenBSD-Regress-ID: 86579ea2891e18e822e204413d011b2ae0e59657

commit c1e76c64956b424ba260fd4eec9970e5b5859039
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Thu Aug 27 02:11:09 2020 +0000

    upstream: remove unreachable code I forgot to delete in r1.334
    
    OpenBSD-Commit-ID: 9ed6078251a0959ee8deda443b9ae42484fd8b18

commit 0caff05350bd5fc635674c9e051a0322faba5ae3
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Thu Aug 27 01:08:45 2020 +0000

    upstream: Request PIN ahead of time for certain FIDO actions
    
    When we know that a particular action will require a PIN, such as
    downloading resident keys or generating a verify-required key, request
    the PIN before attempting it.
    
    joint work with Pedro Martelletto; ok markus@
    
    OpenBSD-Commit-ID: 863182d38ef075bad1f7d20ca485752a05edb727

commit b649b3daa6d4b8ebe1bd6de69b3db5d2c03c9af0
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Thu Aug 27 01:08:19 2020 +0000

    upstream: preserve verify-required for resident FIDO keys
    
    When downloading a resident, verify-required key from a FIDO token,
    preserve the verify-required in the private key that is written to
    disk. Previously we weren't doing that because of lack of support
    in the middleware API.
    
    from Pedro Martelletto; ok markus@ and myself
    
    OpenBSD-Commit-ID: 201c46ccdd227cddba3d64e1bdbd082afa956517

commit 642e06d0df983fa2af85126cf4b23440bb2985bf
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Thu Aug 27 01:07:51 2020 +0000

    upstream: major rework of FIDO token selection logic
    
    When PINs are in use and multiple FIDO tokens are attached to a host, we
    cannot just blast requests at all attached tokens with the PIN specified
    as this will cause the per-token PIN failure counter to increment. If
    this retry counter hits the token's limit (usually 3 attempts), then the
    token will lock itself and render all (web and SSH) of its keys invalid.
    We don't want this.
    
    So this reworks the key selection logic for the specific case of
    multiple keys being attached. When multiple keys are attached and the
    operation requires a PIN, then the user must touch the key that they
    wish to use first in order to identify it.
    
    This may require multiple touches, but only if there are multiple keys
    attached AND (usually) the operation requires a PIN. The usual case of a
    single key attached should be unaffected.
    
    Work by Pedro Martelletto; ok myself and markus@
    
    OpenBSD-Commit-ID: 637d3049ced61b7a9ee796914bbc4843d999a864

commit 801c9f095e6d8b7b91aefd98f5001c652ea13488
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Thu Aug 27 01:07:09 2020 +0000

    upstream: support for requiring user verified FIDO keys in sshd
    
    This adds a "verify-required" authorized_keys flag and a corresponding
    sshd_config option that tells sshd to require that FIDO keys verify the
    user identity before completing the signing/authentication attempt.
    Whether or not user verification was performed is already baked into the
    signature made on the FIDO token, so this is just plumbing that flag
    through and adding ways to require it.
    
    feedback and ok markus@
    
    OpenBSD-Commit-ID: 3a2313aae153e043d57763d766bb6d55c4e276e6

commit 9b8ad93824c682ce841f53f3b5762cef4e7cc4dc
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Thu Aug 27 01:06:18 2020 +0000

    upstream: support for user-verified FIDO keys
    
    FIDO2 supports a notion of "user verification" where the user is
    required to demonstrate their identity to the token before particular
    operations (e.g. signing). Typically this is done by authenticating
    themselves using a PIN that has been set on the token.
    
    This adds support for generating and using user verified keys where
    the verification happens via PIN (other options might be added in the
    future, but none are in common use now). Practically, this adds
    another key generation option "verify-required" that yields a key that
    requires a PIN before each authentication.
    
    feedback markus@ and Pedro Martelletto; ok markus@
    
    OpenBSD-Commit-ID: 57fd461e4366f87c47502c5614ec08573e6d6a15

commit 1196d7f49d4fbc90f37e550de3056561613b0960
Author: cheloha@openbsd.org <cheloha@openbsd.org>
Date:   Wed Aug 12 01:23:45 2020 +0000

    upstream: ssh-keyscan(1): simplify conloop() with timercmp(3),
    
    timersub(3); ok djm@
    
    OpenBSD-Commit-ID: a102acb544f840d33ad73d40088adab4a687fa27

commit d0a195c89e26766d3eb8f3e4e2a00ebc98b57795
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Tue Aug 11 09:49:57 2020 +0000

    upstream: let ssh_config(5)'s AddKeysToAgent keyword accept a time
    
    limit for keys in addition to its current flag options. Time-limited keys
    will automatically be removed from ssh-agent after their expiry time has
    passed; ok markus@
    
    OpenBSD-Commit-ID: 792e71cacbbc25faab5424cf80bee4a006119f94

commit e9c2002891a7b8e66f4140557a982978f372e5a3
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Tue Aug 11 09:45:54 2020 +0000

    upstream: let the "Confirm user presence for key ..." ssh-askpass
    
    notification respect $SSH_ASKPASS_REQUIRE; ok markus@
    
    OpenBSD-Commit-ID: 7c1a616b348779bda3b9ad46bf592741f8e206c1

commit eaf8672b1b52db2815a229745f4e4b08681bed6d
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Fri Aug 21 00:04:13 2020 +1000

    Remove check for 'ent' command.
    
    It was added in 8d1fd57a9 for measuring entropy of ssh_prng_cmds which
    has long since been removed and there are no other references to it.

commit 05c215de8d224e094a872d97d45f37f60c06206b
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Mon Aug 17 21:34:32 2020 +1000

    Wrap stdint.h include in ifdef HAVE_STDINT_H.

commit eaf2765efe8bc74feba85c34295d067637fc6635
Author: Damien Miller <djm@mindrot.org>
Date:   Mon Aug 10 13:24:09 2020 +1000

    sync memmem.c with OpenBSD

commit ed6bef77f5bb5b8f9ca2914478949e29f2f0a780
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Fri Aug 7 17:12:16 2020 +1000

    Always send any PAM account messages.
    
    If the PAM account stack reaturns any messages, send them to the user
    not just if the check succeeds.  bz#2049, ok djm@

commit a09e98dcae1e26f026029b7142b0e0d10130056f
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Fri Aug 7 15:37:37 2020 +1000

    Output test debug logs on failure.

commit eb122b1eebe58b29a83a507ee814cbcf8aeded1b
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Fri Aug 7 15:11:42 2020 +1000

    Add ability to specify exact test target.

commit c2ec7a07f8caabb4d8e00c66e7cd46bf2cd1e922
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Fri Aug 7 14:21:15 2020 +1000

    Document --without-openssl and --without-zlib.

commit 651bb3a31949bbdc3a78b2ede95a77bce0c72984
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Fri Aug 7 14:15:11 2020 +1000

    Add without-openssl without-zlib test target.

commit 9499f2bb01dc1032ae155999b2d7764b9491341f
Author: Stefan Schindler <dns2utf8@estada.ch>
Date:   Wed Aug 5 19:00:52 2020 +0200

    Add CI with prepare script
    
    * Only use heimdal kerberos implementation
    * Fetch yubico/libfido2 (see: https://github.com/Yubico/libfido2)
    * Add one target for
        * all features
        * each feature alone
        * no features

commit ea1f649046546a860f68b97ddc3015b7e44346ca
Author: Damien Miller <djm@mindrot.org>
Date:   Wed Aug 5 08:58:57 2020 +1000

    support NetBSD's utmpx.ut_ss address field
    
    bz#960, ok dtucker

commit 32c63e75a70a0ed9d6887a55fcb0e4531a6ad617
Author: Damien Miller <djm@mindrot.org>
Date:   Tue Aug 4 14:59:21 2020 +1000

    wrap a declaration in the same ifdefs as its use
    
    avoids warnings on NetBSD

commit c9e3be9f4b41fda32a2a0138d54c7a6b563bc94d
Author: Damien Miller <djm@mindrot.org>
Date:   Tue Aug 4 14:58:46 2020 +1000

    undef TAILQ_CONCAT and friends
    
    Needed for NetBSD. etc that supply these macros

commit 2d8a3b7e8b0408dfeb933ac5cfd3a58f5bac49af
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Mon Aug 3 02:53:51 2020 +0000

    upstream: ensure that certificate extensions are lexically sorted.
    
    Previously if the user specified a custom extension then the everything would
    be in order except the custom ones. bz3198 ok dtucker markus
    
    OpenBSD-Commit-ID: d97deb90587b06cb227c66ffebb2d9667bf886f0

commit a8732d74cb8e72f0c6366015687f1e649f60be87
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Mon Aug 3 02:43:41 2020 +0000

    upstream: allow -A to explicitly enable agent forwarding in scp and
    
    sftp. The default remains to not forward an agent, even when ssh_config
    enables it. ok jmc dtucker markus
    
    OpenBSD-Commit-ID: 36cc526aa3b0f94e4704b8d7b969dd63e8576822

commit ab9105470a83ed5d8197959a1b1f367399958ba1
Author: deraadt@openbsd.org <deraadt@openbsd.org>
Date:   Mon Aug 3 02:42:49 2020 +0000

    upstream: clang -Wimplicit-fallthrough does not recognise /*
    
    FALLTHROUGH */ comments, which is the style we currently use, and gives too
    many boring warnings. ok djm
    
    OpenBSD-Commit-ID: 07b5031e9f49f2b69ac5e85b8da4fc9e393992a0

commit ced327b9fb78c94d143879ef4b2a02cbc5d38690
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Fri Jul 31 04:19:37 2020 +0000

    upstream: Also compare username when checking for JumpHost loops.
    
    bz#3057, ok djm@
    
    OpenBSD-Commit-ID: 9bbc1d138adb34c54f3c03a15a91f75dbf418782

commit ae7527010c44b3376b85d036a498f136597b2099
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Fri Jul 31 15:19:04 2020 +1000

    Remove AC_REVISION.
    
    It hasn't been useful since we switched to git in 2014.  ok djm@

commit 89fc3f414be0ce4e8008332a9739a7d721269e50
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Tue Jul 28 19:40:30 2020 +1000

    Use argv in OSSH_CHECK_CFLAG_COMPILE test.
    
    configure.ac is not detecting -Wextra in compilers that implement the
    option. The problem is that -Wextra implies -Wunused-parameter, and the
    C excerpt used by aclocal.m4 does not use argv.  Patch from pedro at
    ambientworks.net, ok djm@

commit 62c81ef531b0cc7ff655455dd34f5f0c94f48e82
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Mon Jul 20 22:12:07 2020 +1000

    Skip ECDSA-SK webauthn test when built w/out ECC

commit 3ec9a6d7317236a9994887d8bd5d246af403a00d
Author: Damien Miller <djm@mindrot.org>
Date:   Mon Jul 20 13:09:25 2020 +1000

    Add ssh-sk-helper and manpage to RPM spec file
    
    Based on patch from Fabio Pedretti

commit a2855c048b3f4b17d8787bd3f24232ec0cd79abe
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Fri Jul 17 07:09:24 2020 +0000

    upstream: Add %k to the TOKENs for Match Exec for consistency with
    
    the other keywords that recently got %k.
    
    OpenBSD-Commit-ID: 1857d1c40f270cbc254fca91e66110641dddcfdb

commit 69860769fa9f4529d8612ec055ae11912f7344cf
Author: jmc@openbsd.org <jmc@openbsd.org>
Date:   Fri Jul 17 05:59:05 2020 +0000

    upstream: fix macro slip in previous;
    
    OpenBSD-Commit-ID: 624e47ab209450ad9ad5c69f54fa69244de5ed9a

commit 40649bd0822883b684183854b16d0b8461d5697b
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Fri Jul 17 07:10:24 2020 +0000

    upstream: Add test for '%k' (HostKeyAlias) TOKEN.
    
    OpenBSD-Regress-ID: 8ed1ba1a811790031aad3fcea860a34ad7910456

commit 6736fe680704a3518cb4f3f8f6723b00433bd3dd
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Fri Jul 17 03:26:58 2020 +0000

    upstream: Add tests for expansions on UserKnownHostsFile.
    
    OpenBSD-Regress-ID: bccf8060306c841bbcceb1392644f906a4d6ca51

commit 287dc6396e0f9cb2393f901816dbd7f2a7dfbb5f
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Fri Jul 17 03:51:32 2020 +0000

    upstream: log error message for process_write() write failures
    
    OpenBSD-Commit-ID: f733d7b3b05e3c68967dc18dfe39b9e8fad29851

commit 8df5774a42d2eaffe057bd7f293fc6a4b1aa411c
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Fri Jul 17 03:43:42 2020 +0000

    upstream: Add a '%k' TOKEN that expands to the effective HostKey of
    
    the destination.  This allows, eg, keeping host keys in individual files
    using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654, ok djm@, jmc@
    (man page bits)
    
    OpenBSD-Commit-ID: 7084d723c9cc987a5c47194219efd099af5beadc

commit c4f239944a4351810fd317edf408bdcd5c0102d9
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Fri Jul 17 03:23:10 2020 +0000

    upstream: Add %-TOKEN, environment variable and tilde expansion to
    
    UserKnownHostsFile, allowing the file to be automagically split up in the
    configuration (eg bz#1654).  ok djm@, man page parts jmc@
    
    OpenBSD-Commit-ID: 7e1b406caf147638bb51558836a72d6cc0bd1b18

commit dbaaa01daedb423c38124a72c471982fb08a16fb
Author: solene@openbsd.org <solene@openbsd.org>
Date:   Wed Jul 15 07:50:46 2020 +0000

    upstream: - Add [-a rounds] in ssh-keygen man page and usage() -
    
    Reorder parameters list in the first usage() case - Sentence rewording
    
    ok dtucker@
    jmc@ noticed usage() missed -a flag too
    
    OpenBSD-Commit-ID: f06b9afe91cc96f260b929a56e9930caecbde246

commit 69924a92c3af7b99a7541aa544a2334ec0fb092c
Author: jmc@openbsd.org <jmc@openbsd.org>
Date:   Wed Jul 15 05:40:05 2020 +0000

    upstream: start sentence with capital letter;
    
    OpenBSD-Commit-ID: ab06581d51b2b4cc1b4aab781f7f3cfa56cad973

commit 5b56bd0affea7b02b540bdbc4d1d271b0e4fc885
Author: Damien Miller <djm@mindrot.org>
Date:   Fri Jul 17 13:15:50 2020 +1000

    detect Linux/X32 systems
    
    This is a frankenstein monster of AMD64 instructions/calling conventions
    but with a 4GB address space. Allegedly deprecated but people still run
    into it causing weird sandbox failures, e.g. bz#3085

commit 9c9ddc1391d6af8d09580a2424ab467d0a5df3c7
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Wed Jul 15 06:43:16 2020 +0000

    upstream: Fix previous by calling the correct function.
    
    OpenBSD-Regress-ID: 821cdd1dff9c502cceff4518b6afcb81767cad5a

commit f1a4798941b4372bfe5e46f1c0f8672fe692d9e4
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Wed Jul 15 05:36:50 2020 +0000

    upstream: Update test to match recent change in match.c
    
    OpenBSD-Regress-ID: 965bda1f95f09a765050707340c73ad755f41167

commit d7e71be4fd57b7c7e620d733cdf2333b27bfa924
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Wed Jul 15 15:30:43 2020 +1000

    Adjust portable code to match changes in 939d787d,

commit fec89f32a84fd0aa1afc81deec80a460cbaf451a
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Wed Jul 15 04:27:34 2020 +0000

    upstream: Add default for number of rounds (-a). ok djm@
    
    OpenBSD-Commit-ID: cb7e9aa04ace01a98e63e4bd77f34a42ab169b15

commit aaa8b609a7b332be836cd9a3b782422254972777
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Tue Jul 14 23:57:01 2020 +0000

    upstream: allow some additional control over the use of ssh-askpass
    
    via $SSH_ASKPASS_REQUIRE, including force-enable/disable. bz#69 ok markus@
    
    OpenBSD-Commit-ID: 3a1e6cbbf6241ddc4405c4246caa2c249f149eb2

commit 6368022cd4dd508671c4999a59ec5826df098530
Author: deraadt@openbsd.org <deraadt@openbsd.org>
Date:   Tue Jul 7 02:47:21 2020 +0000

    upstream: correct recently broken comments
    
    OpenBSD-Commit-ID: 964d9a88f7de1d0eedd3f8070b43fb6e426351f1

commit 6d755706a0059eb9e2d63517f288b75cbc3b4701
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Sun Jul 5 23:59:45 2020 +0000

    upstream: some language improvements; ok markus
    
    OpenBSD-Commit-ID: 939d787d571b4d5da50b3b721fd0b2ac236acaa8

commit b0c1e8384d5e136ebdf895d1434aea7dd8661a1c
Author: markus@openbsd.org <markus@openbsd.org>
Date:   Fri Jul 3 10:12:26 2020 +0000

    upstream: update setproctitle after re-exec; ok djm
    
    OpenBSD-Commit-ID: bc92d122f9184ec2a9471ade754b80edd034ce8b

commit cd119a5ec2bf0ed5df4daff3bd14f8f7566dafd3
Author: markus@openbsd.org <markus@openbsd.org>
Date:   Fri Jul 3 10:11:33 2020 +0000

    upstream: keep ignoring HUP after fork+exec; ok djm
    
    OpenBSD-Commit-ID: 7679985a84ee5ceb09839905bb6f3ddd568749a2

commit 8af4a743693ccbea3e15fc9e93edbeb610fa94f4
Author: markus@openbsd.org <markus@openbsd.org>
Date:   Fri Jul 3 10:10:17 2020 +0000

    upstream: don't exit the listener on send_rexec_state errors; ok
    
    djm
    
    OpenBSD-Commit-ID: 57cbd757d130d3f45b7d41310b3a15eeec137d5c

commit 03da4c2b70468f04ed1c08518ea0a70e67232739
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Wed Jul 15 04:55:47 2020 +0000

    upstream: Use $OBJ to find key files. Fixes test when run on an obj
    
    directory (on OpenBSD) or out of tree (in Portable).
    
    OpenBSD-Regress-ID: 938fa8ac86adaa527d64a305bd2135cfbb1c0a17

commit 73f20f195ad18f1cf633eb7d8be95dc1b6111eea
Author: Darren Tucker <dtucker@dtucker.net>
Date:   Sat Jul 4 23:11:23 2020 +1000

    Wrap stdint.h in ifdef HAVE_STDINT_H.

commit aa6fa4bf3023fa0e5761cd8f4b2cd015d2de74dd
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Fri Jul 3 07:25:18 2020 +0000

    upstream: put back the mux_ctx memleak fix, but only for channels of
    
    type SSH_CHANNEL_MUX_LISTENER; Specifically SSH_CHANNEL_MUX_PROXY channels
    should not have this structure freed.
    
    OpenBSD-Commit-ID: f3b213ae60405f77439e2b06262f054760c9d325

commit d8195914eb43b20b13381f4e5a74f9f8a14f0ded
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Fri Jul 3 07:17:35 2020 +0000

    upstream: revert r1.399 - the lifetime of c->mux_ctx is more complex;
    
    simply freeing it here causes other problems
    
    OpenBSD-Commit-ID: c6fee8ca94e2485faa783839541962be2834c5ed

commit 20b5fab9f773b3d3c7f06cb15b8f69a2c081ee80
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Fri Jul 3 07:02:37 2020 +0000

    upstream: avoid tilde_expand_filename() in expanding ~/.ssh/rc - if
    
    sshd is in chroot mode, the likely absence of a password database will cause
    tilde_expand_filename() to fatal; ok dtucker@
    
    OpenBSD-Commit-ID: e20aee6159e8b79190d18dba1513fc1b7c8b7ee1

commit c8935081db35d73ee6355999142fa0776a2af912
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Fri Jul 3 06:46:41 2020 +0000

    upstream: when redirecting sshd's log output to a file, undo this
    
    redirection after the session child process is forked(); ok dtucker@
    
    OpenBSD-Commit-ID: 6df86dd653c91f5bc8ac1916e7680d9d24690865

commit 183c4aaef944af3a1a909ffa01058c65bac55748
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Fri Jul 3 06:29:57 2020 +0000

    upstream: start ClientAliveInterval bookkeeping before first pass
    
    through select() loop; fixed theoretical case where busy sshd may ignore
    timeouts from client; inspired by and ok dtucker
    
    OpenBSD-Commit-ID: 96bfc4b1f86c7da313882a84755b2b47eb31957f

commit 6fcfd303d67f16695198cf23d109a988e40eefb6
Author: Damien Miller <djm@mindrot.org>
Date:   Fri Jul 3 15:28:27 2020 +1000

    add check for fido_cred_set_prot() to configure

commit f11b23346309e4d5138e733a49321aedd6eeaa2f
Author: dtucker@openbsd.org <dtucker@openbsd.org>
Date:   Fri Jul 3 05:09:06 2020 +0000

    upstream: Only reset the serveralive check when we receive traffic from
    
    the server and ignore traffic from a port forwarding client, preventing a
    client from keeping a connection alive when it should be terminated.  Based
    on a patch from jxraynor at gmail.com via openssh-unix-dev and bz#2265, ok
    djm@
    
    OpenBSD-Commit-ID: a941a575a5cbc244c0ef5d7abd0422bbf02c2dcd

commit adfdbf1211914b631c038f0867a447db7b519937
Author: Damien Miller <djm@mindrot.org>
Date:   Fri Jul 3 15:15:15 2020 +1000

    sync sys-queue.h with OpenBSD upstream
    
    needed for TAILQ_CONCAT

commit 1b90ddde49e2ff377204082b6eb130a096411dc1
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Fri Jul 3 05:08:41 2020 +0000

    upstream: fix memory leak of mux_ctx; patch from Sergiy Lozovsky
    
    via bz3189 ok dtucker
    
    OpenBSD-Commit-ID: db249bd4526fd42d0f4f43f72f7b8b7705253bde

commit 55ef3e9cbd5b336bd0f89205716924886fcf86de
Author: markus@openbsd.org <markus@openbsd.org>
Date:   Wed Jul 1 16:28:31 2020 +0000

    upstream: free kex in ssh_packet_close; ok djm semarie
    
    OpenBSD-Commit-ID: dbc181e90d3d32fd97b10d75e68e374270e070a2

commit e1c401109b61f7dbc199b5099933d579e7fc5dc9
Author: bket@openbsd.org <bket@openbsd.org>
Date:   Sat Jun 27 13:39:09 2020 +0000

    upstream: Replace TAILQ concatenation loops with TAILQ_CONCAT
    
    OK djm@
    
    OpenBSD-Commit-ID: 454b40e09a117ddb833794358970a65b14c431ef

commit 14beca57ac92d62830c42444c26ba861812dc837
Author: semarie@openbsd.org <semarie@openbsd.org>
Date:   Fri Jun 26 11:26:01 2020 +0000

    upstream: backout 1.293 fix kex mem-leak in ssh_packet_close at markus
    
    request
    
    the change introduced a NULL deref in sshpkt_vfatal() (uses of ssh->kex after
    calling ssh_packet_clear_keys())
    
    OpenBSD-Commit-ID: 9c9a6721411461b0b1c28dc00930d7251a798484

commit 598c3a5e3885080ced0d7c40fde00f1d5cdbb32b
Author: Damien Miller <djm@mindrot.org>
Date:   Fri Jun 26 16:07:12 2020 +1000

    document a PAM spec problem in a frustrated comment

commit 976c4f86286d52a0cb2aadf4a095d379c0da752e
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Fri Jun 26 05:42:16 2020 +0000

    upstream: avoid spurious error message when ssh-keygen creates files
    
    outside ~/.ssh; with dtucker@
    
    OpenBSD-Commit-ID: ac0c662d44607e00ec78c266ee60752beb1c7e08

commit 32b2502a9dfdfded1ccdc1fd6dc2b3fe41bfc205
Author: Damien Miller <djm@mindrot.org>
Date:   Fri Jun 26 15:30:06 2020 +1000

    missing ifdef SELINUX; spotted by dtucker

commit e073106f370cdd2679e41f6f55a37b491f0e82fe
Author: djm@openbsd.org <djm@openbsd.org>
Date:   Fri Jun 26 05:12:21 2020 +0000

    upstream: regress test for ssh-add -d; ok dtucker@
    
    OpenBSD-Regress-ID: 3a2e044be616afc7dd4f56c100179e83b33d8abf

commit c809daaa1bad6b1c305b0e0b5440360f32546c84
Author: markus@openbsd.org <markus@openbsd.org>
Date:   Wed Jun 24 15:16:23 2020 +0000

    upstream: add test for mux w/-Oproxy; ok djm
    
