security/openssh-portable 10.6.p1,1

Drop the ipv6 virtual category for s* category as it is not relevant anymore

Bump PORTREVISION on ldns consumers

Shared lib version changed in update

Reported by:	sunpoet

Convert to UCL & cleanup pkg-message (categories s)

- Update gssapi patch for 8.0 - Rework how the gssapi patch is fetched/mirrored so we can fetch   directly from debian.

PR:		239290
Submitted by:	david@dcrosstech.com (based on)
Tested by:	vrwmiller@gmail.com

Fix BROKEN handling for x509/gssapi FLAVORS

Update to 8.0p1

Changes: https://www.openssh.com/txt/release-8.0

With help from:	Lee Prokowich
Sponsored by:	DellEMC

- Fix X509 build after r484765 openssl fix - Fix patch URL for KERB_GSSAPI - Add FLAVORs for x509 and gssapi since they are distinct types of   OpenSSH rather than feature flags.

Approved by:	portmgr (implicit)

- Update KERB_GSSAPI for 7.9p1

- Fix HPN for 7.9p1 - DOCS is required for HPN but it's not exclusively a flavor so needs to be   in the default list. - Fix a build-time OpenSSL version comparison [1]

PR:		233157 [1]
Reported by:	Robert Schulze <rs@bytecamp.net> [1]
Obtained from:	upstream c0a35265907533be10ca151ac797f34ae0d68969 [1]

Update to 7.9p1.

- Fixes build on 12, head, and openssl-devel.
- GSSAPI and HPN are currently marked BROKEN as I don't want to block
  the main update for anyone.

  http://www.openssh.com/txt/release-7.8
  http://www.openssh.com/txt/release-7.9

MFH:	2018Q4 (due to being broken on 12+head)

security/openssl-devel was removed, but there is a security/openssl111 now.

Add DOCS options to ports that should have one.

Also various fixes related to said option.

PR:		230864
Submitted by:	mat
exp-runs by:	antoine

Simplify CONFLICTS_INSTALL.

Reported by:	mat

- Fix and update HPN patch to latest from upstream but leave it off by   default. - Add an 'hpn' FLAVOR to produce a package for users with HPN and   NONECIPHER enabled.

Approved by:	portmgr (implicit)

Update x509 patch to 11.3.2

Forgot PORTREVISION bump for r472797.

PR:		229147

Fix nologin check when PAM option is disabled in the port.

PR:		229147
Submitted by:	Robert Schulze <rs@bytecamp.net>

Add lost metadata on why this patch exists

- Add XMSS option to enable experimental key support added in 7.7 [1] - Bring in upstream patches post 7.7 to fix various issues [2]:   b81b2d120e9c8a83489e241620843687758925ad - Fix tunnel forwarding broken in 7.7p1   341727df910e12e26ef161508ed76d91c40a61eb - don't kill ssh-agent's listening socket entriely if we fail to accept a connection   85fe48fd49f2e81fa30902841b362cfbb7f1933b - don't free

PR:		227758 [1]
Submitted by:	IWAMOTO Kouichi <sue@iwmt.org> [1]
PR:		227551 [2]
Reported by:	rozhuk.im@gmail.com [2]
Obtained from:	upstream mirror https://github.com/openssh/openssh-portable [2]

Update the KERB_GSSAPI patch from debian.

https://sources.debian.org/data/main/o/openssh/1:7.7p1-2/debian/patches/gssapi.patch
is mirrored due to not being filename-unique and not gzipped.

PR:		226789
Submitted by:	Rick Miller <vmiller@verisign.com> (based on)
Tested by:	Rick Miller <vmiller@verisign.com>
Reported by:	david@dcrosstech.com

The block of code that canonicallizes the hostname supplied on the command line added by patch-ssh.c misapplies to 7.7p1 and moves from main() to to ssh_session2(). This breaks ssh SSHFP support for non-canonical hostnames. For example, "ssh zinc" correctly discovers the FQDN (zinc.ee.lbl.gov) and uses it to look up A and AAAA records but the non-canonical version (zinc) is used in the SSHFP recor

Regenerate the patch.

Reviewed by:	bdrewery, ler (mentor)
Approved by:	bdrewery, ler (mentor)
Differential Revision:	https://reviews.freebsd.org/D15053

Make BROKEN lines more clear

Update to 7.7p1

- Update x509 patch to 11.3
- Remove SCTP option as it has not had a patch available since 7.2.

Changes: https://www.openssh.com/txt/release-7.7

Notable changes:
 * ssh(1)/sshd(8): Drop compatibility support for some very old SSH
   implementations, including ssh.com <=2.* and OpenSSH <= 3.*. These
   versions were all released in or before 2001 and predate the final
   SSH RFCs. The support in question isn't necessary for RFC-compliant
   SSH implementations.

libressl support was fixed in r452358

Mark some ports broken with openssl-devel.

Sponsored by:	Absolight

Remove OVERWRITE_BASE compat - it was marked IGNORE in 2015

LibreSSL + LDNS: Fix random crashes.

This happens due to ldns-config --libs adding in too many libraries
(overlinking), and -lcrypto again, which causes some strange
conflict/corruption.  By specifying the path to --with-ldns, configure only
adds in -ldns rather than every library ldns itself needs.

PR:		223000
Reported by:	many

security/openssh-portable: Remove groff dependency

An unconditional dependency on groff was added in ports r441907 [1] as part
of bug 213725 (groff removal from base). OpenSSH release-5.7 notes the
following:

 * Use mandoc as preferred manpage formatter if it is present, followed
   by nroff and groff respectively.

This change removes groff as an unconditional dependency allowing mandoc
to be used, and reduces many subsequence dependencies accordingly.

It additionally explicitly sets 'mantype', which ensures that man pages
are installed in the same location (LOCALBASE/man) independently from the
generator used. Without this, a packaging (pkg-plist) error is observed
(installing man pages into LOCALBASE/doc not LOCALBASE/man), which was
presumably the genesis of the groff dependency addition in the first place.

[1] http://svnweb.freebsd.org/changeset/ports/441907

Reviewed by:		bdrewery (maintainer), allanjude
Approved by:		bdrewery (maintainer)
Differential Revision:	D11793

Mark broken with libressl as it has several random crashses.

PR:		223000

Bring in upstream fix for PermitOpen from commit 7c9613fac337

Update to 7.6p1

- Update x509 patch to 11.0
- HPN/NONECIPHER do not apply currently and are disabled by default,
  same as the base sshd.  A compatibility patch is applied if
  these options are disabled to prevent startup failures; the options
  are kept as deprecated.
- SCTP patch does not apply.

Changes: https://www.openssh.com/txt/release-7.6

Notable changes:
  - SSH version 1 support dropped.
  - Dropped support for hmac-ripemd160 MAC.
  - Dropped support for the ciphers arcfour, blowfish and CAST.
  - RSA keys less than 1024 bits are refused.

Fix LDNS detection.

This is the same fix made upstream as well.

PR:		218472
Submitted by:	leres@ee.lbl.gov
MFH:		2017Q2

Register dependency on groff

PR:		213725

Mark those as not building with openssl-devel.

Sponsored by:	Absolight

- Update to 7.5p1. - Update X509 to 10.1. - Disable KERB_GSSAPI for now as it does not build.

Changes: https://www.openssh.com/txt/release-7.5

- Change USE_AUTOTOOLS to USES= autoreconf - Change @exec to @postexec in pkg-plist

Submitted by:	brnrd
PR:		217962

Remove all USE_OPENSSL occurrences.

Sponsored by:	Absolight

- Chase ldns shlip bump

PR:		217495

Fix build with NONE_CIPHER.

Update to 7.4p1.

- Update X509 patch to 9.3
- SCTP patch from soralx@cydem.org

Changes: https://www.openssh.com/txt/release-7.4

Fix to only enable SCTP patch with option from r431441

Add forgotten patch in r431438 for CVE-2016-10009 and CVE-2016-10010.

Security:	2c948527-d823-11e6-9171-14dae9d210b8
Submitted by:	Tim Zingelman <zingelman@gmail.com>
MFH:		2017Q1

Add working SCTP patch.

This has 2 minor changes from the upstream bug 1604

PR:		215632
Submitted by:	soralx@cydem.org

Add patches to cover security issues CVE-2016-10009 and CVE-2016-10010.

Security:	2c948527-d823-11e6-9171-14dae9d210b8
Submitted by:	Tim Zingelman <zingelman@gmail.com>
MFH:		2017Q1

Bring in upstream commit ec165c392ca54317dbe3064a8c200de6531e89ad:   Unregister the KEXINIT handler after message has been   received. Otherwise an unauthenticated peer can repeat the KEXINIT and cause   allocation of up to 128MB -- until the connection is closed. Reported by   shilei-c at 360.cn

Security:	CVE-2016-8858

- Update to 7.3p1 - X509: Unbreak and update to 9.0 - SCTP: Mark BROKEN - KERB_GSSAPI: Unbreak and update from Debian's patch

Release notes: http://www.openssh.com/txt/release-7.3

- Fix trailing whitespace in pkg-messages

Approved by:	portmgr blanket

- Fix trailing whitespace in pkg-descrs, categories [p-x]*

Approved by:	portmgr blanket

Bring in updated SCTP patch from gentoo.

Submitted by:	Eduardo Morras <emorrasg@yahoo.es>

Remove ${PORTSDIR}/ from dependencies, categories r, s, t, and u.

With hat:	portmgr
Sponsored by:	Absolight