Three commits in one (since they touch the same heavily-diverged file
repeatedly):

   - markus@cvs.openbsd.org 2014/03/25 09:40:03
     [myproposal.h]
     trimm default proposals.

     This commit removes the weaker pre-SHA2 hashes, the broken ciphers
     (arcfour), and the broken modes (CBC) from the default configuration
     (the patch only changes the default, all the modes are still available
     for the config files).

     ok djm@, reminded by tedu@ & naddy@ and discussed with many
   - deraadt@cvs.openbsd.org 2014/03/26 17:16:26
     [myproposal.h]
     The current sharing of myproposal[] between both client and server code
     makes the previous diff highly unpallatable.  We want to go in that
     direction for the server, but not for the client.  Sigh.
     Brought up by naddy.
   - markus@cvs.openbsd.org 2014/03/27 23:01:27
     [myproposal.h ssh-keyscan.c sshconnect2.c sshd.c]
     disable weak proposals in sshd, but keep them in ssh; ok djm@
   - djm@cvs.openbsd.org 2014/03/26 04:55:35
     [chacha.h cipher-chachapoly.h digest.h hmac.h kex.h kexc25519.c
     [misc.h poly1305.h ssh-pkcs11.c]
     use __bounded(...) attribute recently added to sys/cdefs.h instead of
     longform __attribute__(__bounded(...));

     for brevity and a warning free compilation with llvm/clang
   - tedu@cvs.openbsd.org 2014/03/26 19:58:37
     [sshd.8 sshd.c]
     remove libwrap support. ok deraadt djm mfriedl
   - naddy@cvs.openbsd.org 2014/03/28 05:17:11
     [ssh_config.5 sshd_config.5]
     sync available and default algorithms, improve algorithm list formatting
     help from jmc@ and schwarze@, ok deraadt@
   - jmc@cvs.openbsd.org 2014/03/31 13:39:34
     [ssh-keygen.1]
     the text for the -K option was inserted in the wrong place in -r1.108;
     fix From: Matthew Clarke
   - djm@cvs.openbsd.org 2014/04/01 02:05:27
     [ssh-keysign.c]
     include fingerprint of key not found
     use arc4random_buf() instead of loop+arc4random()
   - djm@cvs.openbsd.org 2014/04/01 03:34:10
     [sshconnect.c]
     When using VerifyHostKeyDNS with a DNSSEC resolver, down-convert any
     certificate keys to plain keys and attempt SSHFP resolution.

     Prevents a server from skipping SSHFP lookup and forcing a new-hostkey
     dialog by offering only certificate keys.

     Reported by mcv21 AT cam.ac.uk
   - djm@cvs.openbsd.org 2014/04/01 05:32:57
     [packet.c]
     demote a debug3 to PACKET_DEBUG; ok markus@
   - djm@cvs.openbsd.org 2014/04/12 04:55:53
     [sshd.c]
     avoid crash at exit: check that pmonitor!=NULL before dereferencing;
     bz#2225, patch from kavi AT juniper.net
   - djm@cvs.openbsd.org 2014/04/16 23:22:45
     [bufaux.c]
     skip leading zero bytes in buffer_put_bignum2_from_string();
     reported by jan AT mojzis.com; ok markus@
   - djm@cvs.openbsd.org 2014/04/16 23:28:12
     [ssh-agent.1]
     remove the identity files from this manpage - ssh-agent doesn't deal
     with them at all and the same information is duplicated in ssh-add.1
     (which does deal with them); prodded by deraadt@
   - djm@cvs.openbsd.org 2014/04/18 23:52:25
     [compat.c compat.h sshconnect2.c sshd.c version.h]
     OpenSSH 6.5 and 6.6 have a bug that causes ~0.2% of connections
     using the curve25519-sha256@libssh.org KEX exchange method to fail
     when connecting with something that implements the spec properly.

     Disable this KEX method when speaking to one of the affected
     versions.

     reported by Aris Adamantiadis; ok markus@
   - djm@cvs.openbsd.org 2014/04/19 05:54:59
     [compat.c]
     missing wildcard; pointed out by naddy@
   - tedu@cvs.openbsd.org 2014/04/19 14:53:48
     [ssh-keysign.c sshd.c]
     Delete futile calls to RAND_seed. ok djm
     NB. Id sync only. This only applies to OpenBSD's libcrypto slashathon
   - tedu@cvs.openbsd.org 2014/04/19 18:15:16
     [sshd.8]
     remove some really old rsh references
   - tedu@cvs.openbsd.org 2014/04/19 18:42:19
     [ssh.1]
     delete .xr to hosts.equiv. there's still an unfortunate amount of
     documentation referring to rhosts equivalency in here.
   - djm@cvs.openbsd.org 2014/04/20 02:30:25
     [misc.c misc.h umac.c]
     use get/put_u32 to load values rather than *((UINT32 *)p) that breaks on
     strict-alignment architectures; reported by and ok stsp@
   - djm@cvs.openbsd.org 2014/04/20 02:49:32
     [compat.c]
     add a canonical 6.6 + curve25519 bignum fix fake version that I can
     recommend people use ahead of the openssh-6.7 release