- deraadt@cvs.openbsd.org 2014/06/13 08:26:29
     [sandbox-systrace.c]
     permit SYS_getentropy
     from matthew
   - matthew@cvs.openbsd.org 2014/06/18 02:59:13
     [sandbox-systrace.c]
     Now that we have a dedicated getentropy(2) system call for
     arc4random(3), we can disallow __sysctl(2) in OpenSSH's systrace
     sandbox.

     ok djm
   - naddy@cvs.openbsd.org 2014/06/18 15:42:09
     [sshbuf-getput-crypto.c]
     The ssh_get_bignum functions must accept the same range of bignums
     the corresponding ssh_put_bignum functions create.  This fixes the
     use of 16384-bit RSA keys (bug reported by Eivind Evensen).
     ok djm@
   - djm@cvs.openbsd.org 2014/06/24 00:52:02
     [krl.c]
     fix bug in KRL generation: multiple consecutive revoked certificate
     serial number ranges could be serialised to an invalid format.

     Readers of a broken KRL caused by this bug will fail closed, so no
     should-have-been-revoked key will be accepted.
   - djm@cvs.openbsd.org 2014/06/24 01:13:21
     [Makefile.in auth-bsdauth.c auth-chall.c auth-options.c auth-rsa.c
     [auth2-none.c auth2-pubkey.c authfile.c authfile.h cipher-3des1.c
     [cipher-chachapoly.c cipher-chachapoly.h cipher.c cipher.h
     [digest-libc.c digest-openssl.c digest.h dns.c entropy.c hmac.h
     [hostfile.c key.c key.h krl.c monitor.c packet.c rsa.c rsa.h
     [ssh-add.c ssh-agent.c ssh-dss.c ssh-ecdsa.c ssh-ed25519.c
     [ssh-keygen.c ssh-pkcs11-client.c ssh-pkcs11-helper.c ssh-pkcs11.c
     [ssh-rsa.c sshbuf-misc.c sshbuf.h sshconnect.c sshconnect1.c
     [sshconnect2.c sshd.c sshkey.c sshkey.h
     [openbsd-compat/openssl-compat.c openbsd-compat/openssl-compat.h]
     New key API: refactor key-related functions to be more library-like,
     existing API is offered as a set of wrappers.

     with and ok markus@

     Thanks also to Ben Hawkes, David Tomaschik, Ivan Fratric, Matthew
     Dempsky and Ron Bowes for a detailed review a few months ago.

     NB. This commit also removes portable OpenSSH support for OpenSSL
     <0.9.8e.
   - djm@cvs.openbsd.org 2014/06/24 02:19:48
     [ssh.c]
     don't fatal() when hostname canonicalisation fails with a
     ProxyCommand in use; continue and allow the ProxyCommand to
     connect anyway (e.g. to a host with a name outside the DNS
     behind a bastion)
   - djm@cvs.openbsd.org 2014/06/24 02:21:01
     [scp.c]
     when copying local->remote fails during read, don't send uninitialised
     heap to the remote end. Reported by Jann Horn
   - deraadt@cvs.openbsd.org 2014/06/25 14:16:09
     [sshbuf.c]
     unblock SIGSEGV before raising it
     ok djm
   - markus@cvs.openbsd.org 2014/06/27 16:41:56
     [channels.c channels.h clientloop.c ssh.c]
     fix remote fwding with same listen port but different listen address
     with gerhard@, ok djm@
   - markus@cvs.openbsd.org 2014/06/27 18:50:39
     [ssh-add.c]
     fix loading of private keys
   - djm@cvs.openbsd.org 2014/06/30 12:54:39
     [key.c]
     suppress spurious error message when loading key with a passphrase;
     reported by kettenis@ ok markus@
   - djm@cvs.openbsd.org 2014/07/02 04:59:06
     [cipher-3des1.c]
     fix ssh protocol 1 on the server that regressed with the sshkey change
     (sometimes fatal() after auth completed), make file return useful status
     codes.
     NB. Id sync only for these two. They were bundled into the sshkey merge
     above, since it was easier to sync the entire file and then apply
     portable-specific changed atop it.