Log message:
openssh: update to 10.2p1.

This is a bugfix release, primarily to fix a problem that rendered
ssh(1) unusable when ControlPersist was enabled.

Log message:
openssh: update to 10.1p1.

Changes since OpenSSH 10.0
==========================

This release contains a minor security fix as well as a number of
feature improvements and bugfixes.

Security
========

* ssh(1): disallow control characters in usernames passed via the
  commandline or expanded using %-sequences from the configuration
  file, and disallow \0 characters in ssh:// URIs.

  If an ssh(1) commandline was constructed using usernames or URIs
  obtained from an untrusted source, and if a ProxyCommand that uses
  the %u expansion was configured, then it may be possible for an
  attacker to inject shell expressions that may be executed when the
  proxy command is started.

  We strongly recommend against using untrusted inputs to construct
  ssh(1) commandlines.

  This change also relaxes the validity checks in one small way:
  usernames supplied via the configuration file as literals (i.e.
  that have no % expansion characters) are not subject to these
  validity checks. This allows usernames that contain arbitrary
  characters to be used, but only via configuration files. This is
  done on the basis that ssh's configuration is trusted.

  This issue was reported by David Leadbeater.

New features
------------

 * ssh(1), sshd(8): add SIGINFO handlers to log active channel and
   session information.

 * sshd(8): when refusing a certificate for user authentication, log
   enough information to identify the certificate in addition to the
   reason why it was being denied. Makes debugging certificate
   authorisation problems a bit easier.

 * ssh(1), ssh-agent(1): support ed25519 keys hosted on PKCS#11
   tokens.

 * ssh(1): add an ssh_config(5) RefuseConnection option that, when
   encountered while processing an active section in a
   configuration, terminates ssh(1) with an error message that
   contains the argument to the option.

   This may be useful for expressing reminders or warnings in config
   files, for example:

   Match host foo
            RefuseConnection "foo is deprecated, use splork instead"

 * sshd(8): make the X11 display number check relative to
   X11DisplayOffset. This will allow people to use X11DisplayOffset
   to configure much higher port ranges if they really want, while
   not changing the default behaviour.

 * unit tests: the unit test framework now includes some basic
   benchmarking capabilities. Run with "make UNITTEST_BENCHMARK=yes"
   on OpenBSD or "make unit-bench" on Portable OpenSSH.

Bugfixes
--------

 * sshd(8): fix mistracking of MaxStartups process exits in some
   situations. At worst, this could cause all MaxStartups slots to
   fill and sshd to refuse new connections.

 * ssh(1): fix delay on X client startup when ObscureKeystrokeTiming
   is enabled. bz#3820

 * sshd(8): increase the maximum size of the supported configuration
   from 256KB to 4MB, which ought to be enough for anybody. Fail
   early and visibly when this limit is breached. bz3808

 * sftp(1): during sftp uploads, avoid a condition where a failed
   write could be ignored if a subsequent write succeeded. This is
   unlikely but technically possible because sftp servers are
   allowed to reorder requests.

 * sshd(8): avoid a race condition when the sshd-auth process exits
   that could cause a spurious error message to be logged.

 * sshd(8): log at level INFO when PerSourcePenalties actually
   blocks access to a source address range. Previously this was
   logged at level VERBOSE, which hid enforcement actions under
   default config settings.

 * sshd(8): GssStrictAcceptor was missing from sshd -T output; fix

 * sshd(8): Make the MaxStartups and PerSourceNetBlockSize options
   first-match-wins as advertised. bz3859

 * ssh(1): fix an incorrect return value check in the local forward
   cancellation path that would cause failed cancellations not to be
   logged.

 * sshd(8): make "Match !final" not trigger a second parsing pass
   of ssh_config (unless hostname canonicalisation or a separate
   "Match final" does). bz3843

 * ssh(1): better debug diagnostics when loading keys. Will now list
   key fingerprint and algorithm (not just algorithm number) as well
   as making it explicit which keys didn't load.

 * All: fix a number of memory leaks found by LeakSanitizer,
   Coverity and manual inspection.

 * sshd(8): Output the current name for PermitRootLogin's
   "prohibit-password" in sshd -T instead of its deprecated alias
   "without-password".  bz#3788

 * ssh(1): make writing known_hosts lines more atomic by writing
   the entire line in one operation and using unbuffered stdio.

   Usually writes to this file are serialised on the "Are you sure
   you want to continue connecting?" prompt, but if host key
   checking is disabled and connections were being made with high
   concurrency then interleaved writes might have been possible.

Portability
-----------

 * sshd(8): check the username didn't change during the PAM
   transactions.

   PAM modules can change the user during their execution, but
   this is not supported by sshd(8). If such a case was incorrectly
   configured by the system administrator, then sshd(8) could end up
   using a different username to the one authorised by PAM.

 * sshd(8): don't log audit messages with UNKNOWN hostname to avoid
   slow DNS lookups in the audit subsystem.

 * All: when making a copy of struct passwd, ensure struct fields are
   non-NULL. Android libc can return NULL pw_gecos, for example.

 * All: Remove status bits from OpenSSL >=3 version check.

 * sshd(8), ssh(1): Use SSH_TUN_COMPAT_AF on FreeBSD. Otherwise tun
   forwarding from other OSes fails as soon as the first IPv6 message
   is sent by the other side (which is usually a Router Solicitation
   ICMPv6 message which is sent as soon as the interface is up).

 * ssh(1), ssh-agent(8): check for nlist function presence before
   attempting to use it instead of relying on the presence of the
   nlist.h header.  Mac OS X, for example, has the header but not
   the function in the 64bit libraries.

 * All: fill in missing system header files.

   Create replacement header files inside openbsd-compat for common
   headers that are missing on a given platform. Usually these are
   just empty, but in some cases they'll include the equivalent file.
   This avoids having to wrap those includes in '#ifdef HAVE_FOO_H'
   and reduces the diff between Portable OpenSSH and OpenBSD.

 * sshd(8): handle futex_time64 properly in seccomp sandbox
   Previously we only allowed __NR_futex, but some 32-bit systems
   apparently support __NR_futex_time64. We had support for this
   in the sandbox, but because of a macro error only __NR_futex was
   allowlisted.

 * Add contrib/gnome-ssh-askpass4 for GNOME 40+ using the GCR API.

 * sshd(8): let ga_init() fail gracefully if getgrouplist does.
   Apparently getgrouplist() can fail on OSX when passed a
   non-existent group name. Other platforms seem to return a group
   list consisting of the numeric gid passed to the function. bz3848

 * ssh-agent(1): exit 0 from SIGTERM under systemd socket-activation,
   preventing a graceful shutdown of an agent via systemd from
   incorrectly marking the service as "failed".

 * build: wrap some autoconf macros in AC_CACHE_CHECK.

   This allows skipping/overriding the OSSH_CHECK_CFLAG_COMPILE and
   OSSH_CHECK_CFLAG_LINK macros used to discover supported compiler
   or linker flags. E.g.

     $ ./configure ossh_cv_cflag__fzero_call_used_regs_used=no
     [...]
     checking if cc supports compile flag -fzero-call-used-regs=used
     and linking succeeds... (cached) no

Log message:
security/openssh: revert most recent commit

It is more appropriate to point to a built-in openssh mk/tools.
See: https://mail-index.netbsd.org/pkgsrc-changes/2025/06/01/msg324963.html

Log message:
openssh: define OPENSSH in builtin.mk

Log message:
security/openssh: add buidlink/builtin.mk support

Log message:
openssh: update to 10.0p1.

Potentially-incompatible changes
--------------------------------

 * This release removes support for the weak DSA signature
   algorithm, completing the deprecation process that began in
   2015 (when DSA was disabled by default) and repeatedly warned
   over the last 12 months.

 * scp(1), sftp(1): pass "ControlMaster no" to ssh when invoked by
   scp & sftp. This disables implicit session creation by these
   tools when ControlMaster was set to yes/auto by configuration,
   which some users found surprising. This change will not prevent
   scp/sftp from using an existing multiplexing session if one had
   already been created. GHPR557

 * This release has the version number 10.0 and announces itself
   as "SSH-2.0-OpenSSH_10.0". Software that naively matches
   versions using patterns like "OpenSSH_1*" may be confused by
   this.

 * sshd(8): this release removes the code responsible for the
   user authentication phase of the protocol from the per-
   connection sshd-session binary to a new sshd-auth binary.
   Splitting this code into a separate binary ensures that the
   crucial pre-authentication attack surface has an entirely
   disjoint address space from the code used for the rest of the
   connection. It also yields a small runtime memory saving as the
   authentication code will be unloaded after the authentication
   phase completes. This change should be largely invisible to
   users, though some log messages may now come from "sshd-auth"
   instead of "sshd-session". Downstream distributors of OpenSSH
   will need to package the sshd-auth binary.

 * sshd(8): this release disables finite field (a.k.a modp)
   Diffie-Hellman key exchange in sshd by default. Specifically,
   this removes the "diffie-hellman-group*" and
   "diffie-hellman-group-exchange-*" methods from the default
   KEXAlgorithms list. The client is unchanged and continues to
   support these methods by default. Finite field Diffie Hellman
   is slow and computationally expensive for the same security
   level as Elliptic Curve DH or PQ key agreement while offering
   no redeeming advantages. ECDH has been specified for the SSH
   protocol for 15 years and some form of ECDH has been the default
   key exchange in OpenSSH for the last 14 years.

 * sshd(8): this release removes the implicit fallback to compiled-
   in groups for Diffie-Hellman Group Exchange KEX when the moduli
   file exists but does not contain moduli within the client-
   requested range.  The fallback behaviour remains for the case
   where the moduli file does not exist at all. This allows
   administrators more explicit control over which DH groups will
   be selected, but can lead to connection failures if the moduli
   file is edited incorrectly. bz#2793

Changes since OpenSSH 9.9
=========================

This release contains a minor security fix as well as a number of
feature improvements and bugfixes.

Security
========

* sshd(8): fix the DisableForwarding directive, which was failing
  to disable X11 forwarding and agent forwarding as documented.
  X11 forwarding is disabled by default in the server and agent
  forwarding is off by default in the client.

New features
------------

 * ssh(1): the hybrid post-quantum algorithm mlkem768x25519-sha256
   is now used by default for key agreement. This algorithm is
   considered to be safe against attack by quantum computers,
   is guaranteed to be no less strong than the popular
   curve25519-sha256 algorithm, has been standardised by NIST
   and is considerably faster than the previous default.

 * ssh(1): prefer AES-GCM to AES-CTR mode when selecting a cipher
   for the connection. The default cipher preference list is now
   Chacha20/Poly1305, AES-GCM (128/256) followed by AES-CTR
   (128/192/256).

 * ssh(1): add %-token and environment variable expansion to the
   ssh_config SetEnv directive.

 * ssh(1): allow %-token and environment variable expansion in
   the ssh_config User directive, with the exception of %r and %C
   which would be self-referential. bz#3477

 * ssh(1), sshd(8): add "Match version" support to ssh_config and
   sshd_config. Allows matching on the local version of OpenSSH,
   e.g. "Match version OpenSSH_10.*".

 * ssh(1): add support for "Match sessiontype" to ssh_config.
   Allows matching on the type of session initially requested,
   either "shell" for interactive sessions, "exec" for command
   execution sessions, "subsystem" for subsystem requests, such as
   sftp, or "none" for transport/forwarding-only sessions.

 * ssh(1): add support for "Match command ..." support to
   ssh_config, allowing matching on the remote command as specified
   on the command-line.

 * ssh(1): allow 'Match tagged ""' and 'Match command ""' to \ 
match
   empty tag and command values respectively.

 * sshd(8): allow glob(3) patterns to be used in sshd_config
   AuthorizedKeysFile and AuthorizedPrincipalsFile directives.
   bz2755

 * sshd(1): support the VersionAddendum in the client, mirroring
   the option of the same name in the server; bz2745

 * ssh-agent(1): the agent will now delete all loaded keys when
   signaled with SIGUSR1. This allows deletion of keys without
   having access to $SSH_AUTH_SOCK.

 * Portable OpenSSH, ssh-agent(1): support systemd-style socket
   activation in ssh-agent using the LISTEN_PID/LISTEN_FDS
   mechanism. Activated when these environment variables are set,
   the agent is started with the -d or -D option and no socket path
   is set. GHPR502

 * ssh-keygen(1): support FIDO tokens that return no attestation
   data, e.g. recent WinHello. GHPR542

 * ssh-agent(1): add a "-Owebsafe-allow=..." option to allow the
   default FIDO application ID allow-list to be overridden.

 * Add a work-in-progress tool to verify FIDO attestation blobs
   that ssh-keygen can optionally write when enrolling FIDO keys.
   This tool is available under regress/misc/ssh-verify-attestation
   for experimentation but is not installed by "make install".

 * ssh-keygen(1): allow "-" as output file for moduli screening.
   GHPR393

Bugfixes
--------

 * sshd(8): remove assumption that the sshd_config and any configs
   it includes can fit in a (possibly enlarged) socket buffer.
   Previously it was possible to create a sufficiently large
   configuration that could cause sshd to fail to accept any
   connection. sshd(8) will now actively manage sending its config
   to the sshd-session sub-process.

 * ssh(1): don't start the ObscureKeystrokeTiming mitigations if
   there has been traffic on a X11 forwarding channel recently.
   Should fix X11 forwarding performance problems when this setting
   is enabled. bz3655

 * ssh(1): prohibit the comma character in hostnames accepted, but
   allow an underscore as the first character in a hostname.

 * sftp(1): set high-water when resuming a "put". Prevents bogus
   "server reordered acks" debug message.

 * ssh(1), sshd(8): fix regression in openssh-9.8, which would fail
   to accept "Match criteria=argument" as well as the documented
   "Match criteria argument" syntax in ssh_config and sshd_config.
   bz3739

 * sftp(1), ssh(1): fix a number possible NULL dereference bugs,
   including Coverity CIDs 405019 and 477813.

 * sshd(8): fix PerSourcePenalty incorrectly using "crash" penalty
   when LoginGraceTime was exceeded. bz3797

 * sshd(8): fix "Match invalid-user" from incorrectly being
   activated in initial configuration pass when no other predicates
   were present on the match line

 * sshd(8): fix debug logging of user specific delay. GHPR#552

 * sshd(8): improve debug logging across sub-process boundaries.
   Previously some log messages were lost early in the sshd-auth and
   sshd-session processes' life.

 * ssh(1): require control-escape character sequences passed via
   the '-e ^x' command-line to be exactly two characters long. Avoids
   one byte out-of-bounds read if ssh is invoked as "ssh -e^ ..."
   GHPR368

 * ssh(1), sshd(8): prevent integer overflow in x11 port handling.
   These are theoretically possible if the admin misconfigured
   X11DisplayOffset or the user misconfigures their own $DISPLAY,
   but don't happen in normal operation. bz#3730

 * ssh-keygen(1): don't mess up ssh-keygen -l output when the file
   contains CR characters; GHPR236 bz3385.

 * sshd(8): add rate limits to logging of connections dropped by
   PerSourcePenalties. Previously these could be noisy in logs.

 * ssh(1): fix argument of "Compression" directive in ssh -G config
   dump, which regressed in openssh-9.8.

 * sshd(8): fix a corner-case triggered by UpdateHostKeys when sshd
   refuses to accept the signature returned by an agent holding host
   keys during the hostkey rotation sub-protocol. This situation
   could occur in situations where a PKCS#11 smartcard that lacked
   support for particular signature algorithms was used to store
   host keys.

 * ssh-keygen(1): when using RSA keys to sign messages with
   "ssh-keygen -Y", select the signature algorithm based on the
   requested hash algorithm ("-Ohashalg=xxx"). This allows using
   something other than the default of rsa-sha2-512, which may not
   be supported on all signing backends, e.g. some smartcards only
   support SHA256.

 * ssh(1), sshd(8), ssh-keyscan(1): fix ML-KEM768x25519 KEX on
   big-endian systems.

 * Many regression and interop test improvements.

Portability
-----------

 * All: add support for AWS-LC (AWS libcrypto). bz3784

 * sshd(8): add wtmpdb support as a Y2038 safe wtmp replacement.

 * sshd(8): add support for locking sshd into memory, enabled with
   the --with-linux-memlock-onfault configure flag.

 * Add support for building a standalone sk-libfido2 library,
   enabled by --with-security-key-standalone

 * ssh(1), sshd(8), ssh-keyscan(1): include __builtin_popcount
   replacement function. for compilers that lack it.

 * All: Check for and replace le32toh, le64toh, htole64 separately.
   It appears that at least some versions of endian.h in glibc do
   not have the latter two. bz#3794

 * Remove ancient RHL 6.x config in RPM spec.

Log message:
*: recursive bump for default Kerberos implementation switch

Log message:
openssh: update to 9.9p2.

pkgsrc: fix patch offsets

Changes:

    openssh-9.9p2

    upstream: Fix cases where error codes were not correctly set
    Reported by the Qualys Security Advisory team. ok markus@

    upstream: Don't reply to PING in preauth phase or during KEX
    Reported by the Qualys Security Advisory team. ok markus@

    upstream: fix "Match invalid-user" from incorrectly being activated
    in initial configuration pass when no other predicates were present on the
    match line

    fix uint64_t types; reported by Tom G. Christensen

    htole64() etc for systems without endian.h

    upstream: explicitly include endian.h

    upstream: fix ML-KEM768x25519 KEX on big-endian systems; spotted by
    jsg@ feedback/ok deraadt@

    upstream: fix previous change to ssh_config Match, which broken on
    negated Matches; spotted by phessler@ ok deraadt@

    upstream: fix regression introduced when I switched the "Match"
    criteria tokeniser to a more shell-like one. Apparently the old tokeniser
    (accidentally?) allowed "Match criteria=argument" as well as the \ 
"Match
    criteria argument" syntax that we tested for.
    People were using this syntax so this adds back support for
    "Match criteria=argument"
    bz3739 ok dtucker

    gss-serv.c needs sys/param.h
    From Void Linux

    build construct_utmp() when USE_BTMP is set
    Fixes compile error on Void Linux/Musl

    fix utmpx ifdef
    02e16ad95fb1f56ab004b01a10aab89f7103c55d did a copy-paste for
    utmpx, but forgot to change the ifdef appropriately

    Remove non-9.9 branch statuses.

    Add 9.9 branch to CI status console.

    autogenerated files for release

    update version numbers