More fixes from upstream:
- X connection forwarding fixes
- more explicit_bzero
- more closing file descriptors
XXX: pullup-7

get rid of roaming (CVE-2016-0777)

merge conflicts

CID 1309355: check error return from closefrom(3) where appropriate.

merge conflicts

Merge conflicts

re-enable the none cipher, now that it has been tested.

- remove some more jpake remnants.
- try to fix umac; probably still broken on hosts that require strict
alignment, but it is still a start.

merge openssh-6.7

merge conflicts.

- provide the right size to the zeroing memory function
- remove unused variables

Identityfile warnings fixes.
https://bugzilla.mindrot.org/show_bug.cgi?id=2084

welcome to openssh-6.2

update to 6.1

This is primarily a bugfix release.

Features:

* sshd(8): This release turns on pre-auth sandboxing sshd by default for
new installs, by setting UsePrivilegeSeparation=sandbox in

update to 6.1

This is primarily a bugfix release.

Features:

* sshd(8): This release turns on pre-auth sandboxing sshd by default for
new installs, by setting UsePrivilegeSeparation=sandbox in sshd_config.
* ssh-keygen(1): Add options to specify starting line number and number of
lines to process when screening moduli candidates, allowing processing
of different parts of a candidate moduli file in parallel
* sshd(8): The Match directive now supports matching on the local (listen)
address and port upon which the incoming connection was received via
LocalAddress and LocalPort clauses.
* sshd(8): Extend sshd_config Match directive to allow setting AcceptEnv
and {Allow,Deny}{Users,Groups}
* Add support for RFC6594 SSHFP DNS records for ECDSA key types. bz#1978
* ssh-keygen(1): Allow conversion of RSA1 keys to public PEM and PKCS8
* sshd(8): Allow the sshd_config PermitOpen directive to accept "none" as
an argument to refuse all port-forwarding requests.
* sshd(8): Support "none" as an argument for AuthorizedPrincipalsFile
* ssh-keyscan(1): Look for ECDSA keys by default. bz#1971
* sshd(8): Add "VersionAddendum" to sshd_config to allow server operators
to append some arbitrary text to the server SSH protocol banner.

Bugfixes:

* ssh(1)/sshd(8): Don't spin in accept() in situations of file
descriptor exhaustion. Instead back off for a while.
* ssh(1)/sshd(8): Remove hmac-sha2-256-96 and hmac-sha2-512-96 MACs as
they were removed from the specification. bz#2023,
* sshd(8): Handle long comments in config files better. bz#2025
* ssh(1): Delay setting tty_flag so RequestTTY options are correctly
picked up. bz#1995
* sshd(8): Fix handling of /etc/nologin incorrectly being applied to root
on platforms that use login_cap.

show more ...

merge openssh-5.9

Use __dead

- Merge conflicts
- WARNS=5

Stop using functions that are marked as deprecated in Heimdal.

Fixed strvisx usage

Resolve conflicts

merge changes.

Fixed strvisx usage

Merge in our changes:
- conditionalize login_cap
- conditionalize bsd_auth
- bring in pam from portable
- restore krb5, krb4, afs, skey
- bring in hpn patches, disable mt aes cipher, keep speedups an

Merge in our changes:
- conditionalize login_cap
- conditionalize bsd_auth
- bring in pam from portable
- restore krb5, krb4, afs, skey
- bring in hpn patches, disable mt aes cipher, keep speedups and cipher none
- add ignore root rhosts option
- fix ctype macro arguments
- umac is broken, disable it
- better ~homedir handling
- netbsd style tunnels
- urandom, xhome, chrootdir, rescuedir NetBSD handling
- utmp/utmpx handling
- handle tty posix_vdisable properly
- handle setuid and unsetuid the posix way instead of setresuid()
- add all missing functions
- add new moduli
- add build glue

show more ...

import 5.2 from ftp.openbsd.org