security/openssh-portable 10.6.p1,1

- Update to 7.2p2 which fixes X11Forwarding command injection vulnerability.

Changelog:	http://www.openssh.com/txt/release-7.2p2
Advisory:	http://www.openssh.com/txt/x11fwd.adv

- Update to 7.2p1 - Mark X509 and KERB_GSSAPI as BROKEN.

Changelog: http://www.openssh.com/txt/release-7.2

With help from:	brnrd

Remove security/openssh-portable-devel since it is outdated, insecure, and no longer needed.

x11/xterm: document ncurses requirement (USES+=ncurses)

also link to libncurses rather than libcurses

approved by:	infrastructure blanket

Fix the KERB_GSSAPI option using the latest patch from Debian.

This slightly refactors some of the HPN patch to avoid a conflict.

PR:		206346
Submitted by:	Garret Wollman

Update to 7.1p2

Changes: http://www.openssh.com/txt/release-7.1p2

MFH:		2016Q1
Security:	CVE-2016-0777
Security:	CVE-2016-0778

Make portlint stop spamming me.  It's gotten quite silly.

There's no reason to regenerate these for the sake of having 'UTC' in the patch
and it also considers patches with comments to be invalid.

WARN: /root/svn/ports/security/openssh-portable/files/patch-auth.c: patch was not generated using ``make makepatch''.  It is recommended to use ``make makepatch'' when you need to [re-]generate a patch to ensure proper patch format.
WARN: /root/svn/ports/security/openssh-portable/files/patch-auth2.c: patch was not generated using ``make makepatch''.  It is recommended to use ``make makepatch'' when you need to [re-]generate a patch to ensure proper patch format.
WARN: /root/svn/ports/security/openssh-portable/files/patch-readconf.c: patch was not generated using ``make makepatch''.  It is recommended to use ``make makepatch'' when you need to [re-]generate a patch to ensure proper patch format.
WARN: /root/svn/ports/security/openssh-portable/files/patch-regress__test-exec.sh: patch was not generated using ``make makepatch''.  It is recommended to use ``make makepatch'' when you need to [re-]generate a patch to ensure proper patch format.
WARN: /root/svn/ports/security/openssh-portable/files/patch-servconf.c: patch was not generated using ``make makepatch''.  It is recommended to use ``make makepatch'' when you need to [re-]generate a patch to ensure proper patch format.
WARN: /root/svn/ports/security/openssh-portable/files/patch-session.c: patch was not generated using ``make makepatch''.  It is recommended to use ``make makepatch'' when you need to [re-]generate a patch to ensure proper patch format.
WARN: /root/svn/ports/security/openssh-portable/files/patch-ssh-agent.1: patch was not generated using ``make makepatch''.  It is recommended to use ``make makepatch'' when you need to [re-]generate a patch to ensure proper patch format.
WARN: /root/svn/ports/security/openssh-portable/files/patch-ssh-agent.c: patch was not generated using ``make makepatch''.  It is recommended to use ``make makepatch'' when you need to [re-]generate a patch to ensure proper patch format.
WARN: /root/svn/ports/security/openssh-portable/files/patch-ssh.c: patch was not generated using ``make makepatch''.  It is recommended to use ``make makepatch'' when you need to [re-]generate a patch to ensure proper patch format.
WARN: /root/svn/ports/security/openssh-portable/files/patch-ssh_config: patch was not generated using ``make makepatch''.  It is recommended to use ``make makepatch'' when you need to [re-]generate a patch to ensure proper patch format.
WARN: /root/svn/ports/security/openssh-portable/files/patch-ssh_config.5: patch was not generated using ``make makepatch''.  It is recommended to use ``make makepatch'' when you need to [re-]generate a patch to ensure proper patch format.
WARN: /root/svn/ports/security/openssh-portable/files/patch-sshconnect.c: patch was not generated using ``make makepatch''.  It is recommended to use ``make makepatch'' when you need to [re-]generate a patch to ensure proper patch format.
WARN: /root/svn/ports/security/openssh-portable/files/patch-sshd.8: patch was not generated using ``make makepatch''.  It is recommended to use ``make makepatch'' when you need to [re-]generate a patch to ensure proper patch format.
WARN: /root/svn/ports/security/openssh-portable/files/patch-sshd.c: patch was not generated using ``make makepatch''.  It is recommended to use ``make makepatch'' when you need to [re-]generate a patch to ensure proper patch format.
WARN: /root/svn/ports/security/openssh-portable/files/patch-sshd_config: patch was not generated using ``make makepatch''.  It is recommended to use ``make makepatch'' when you need to [re-]generate a patch to ensure proper patch format.
WARN: /root/svn/ports/security/openssh-portable/files/patch-sshd_config.5: patch was not generated using ``make makepatch''.  It is recommended to use ``make makepatch'' when you need to [re-]generate a patch to ensure proper patch format.

Fix the NONECIPHER not actually being offered by the server.

Upstream issue: https://github.com/rapier1/openssh-portable/issues/3

Update advice to disable ChallengeResponseAuthentication for key usage.

PR:		204475
Reported by:	Mark.Martinec@ijs.si

Drop 8 support.

With hat:	portmgr
Sponsored by:	Absolight
Differential Revision:	https://reviews.freebsd.org/D3694

- Update to latest snapshot. - Remove obsoleted RSA Protocol 1 ssh_host_key support from the rc script [1]

PR:		202792 [1]

Stop trying to create the RSA protocol 1 key from the rc.d file.  It is no longer supported by default since 7.0. [1]

I do plan to make this configurable based on PR 202169 [2] soon.

PR:		202792 [1]
PR:		202169 [2]
Submitted by:	chrysalis@chrysalisnet.org [1]

It seems some people keep adding $FreeBSD$ to patch files.

Patches must not be changed by the vcs, this includes the
svn:keyword expansion.  Set fbsd:nokeywords to a couple of patches.

With hat:	portmgr
Sponsored by:	Absolight

Fix patch from r395182 on head. The patch(1) command works fine on 8.4 and 9.3 but not head with this patch.

Apply upstream fix for 'HostkeyAlgorithms +' support.

Update to 7.1p1

Changes: http://www.openssh.com/txt/release-7.1

Update to 20150821 snapshot

- Update to OpenSSH 7.0p1 - Update X509 patch to 8.5

Changes: http://www.openssh.com/txt/release-7.0

Update to snapshot 20150817

Add upstream fix to address CVE-2015-5600 for MaxAuthTries bypass.

Security:	5b74a5bc-348f-11e5-ba05-c80aa9043978

Fix accidental revert of PermitRootLogin default to NO.

This was due to the patch not being needed in the snapshot version
which I based the 6.9 update off of. The default is changed in
the upcoming 7.0 release

Update to snapshot 20150727

- Update to 6.9p1 - Update X509 patch to 8.4

Changes:	http://www.openssh.com/txt/release-6.9

Bring over ETCDIR and libedit updates from main port

Use new USES=libedit

Support changed ETCDIR in pkg-plist

Allow user overriding ETCDIR

Update to 20150624 snapshot

Update to 20150608 snapshot

Add openssh-portable-devel which is based on the upstream snapshots for staging and testing.

Its initial version is 20150602 which is nearly the upcoming 6.9 version.

Remove $FreeBSD$ from patches files everywhere.

With hat:	portmgr
Sponsored by:	Absolight

Avoid a potential read overflow. This was not deemed a security issue by upstream; it was fixed upstream comprehensively a few weeks ago in 77199d6ec8986d470487e66f8ea8f4cf43d2e20c.

PR:		200241
Patch by:	Hanno Böck <hanno@hboeck.de>
Obtained from:	http://www.openwall.com/lists/oss-security/2015/05/16/3

MASTER_SITES cleanup.

- Replace ${MASTER_SITE_FOO} with FOO.
- Merge MASTER_SITE_SUBDIR into MASTER_SITES when possible. (This means 99.9%
  of the time.)
- Remove occurrences of MASTER_SITE_LOCAL when no subdirectory was present and
  no hint of what it should be was present.
- Fix some logic.
- And generally, make things more simple and easy to understand.

While there, add magic values to the FESTIVAL, GENTOO, GIMP, GNUPG, QT and
SAMBA macros.

Also, replace some EXTRACT_SUFX occurences with USES=tar:*.

Checked by:	make fetch-urlall-list
With hat:	portmgr
Sponsored by:	Absolight

Fix clients getting 'Bad packet length' and 'Disconnecting: Packet corrupt' when the NONECIPHER option is selected but not the HPN option.  The server banner was improperly sending a NULL byte after the newline causing confusion on the client.  This was an error in my own modifications to the HPN patch in r383231.

This may have occurred with stale builds as well, such as running
'make configure' then 'portsnap update' and then 'make build'.

Pointyhat to:	bdrewery
Reported by:	many
PR:		199352

Replace the TTSH patch from r383618 with the one that upstream took.

Obtained from upstream d8f391caef623

Cleanup some unneeded patches.

1. There's no need to patch the xauth(1) location as the OpenSSH build already
   does so based on the --with-xauth path provided. It also updates manpages.
2. Don't modify manpage for shosts location as it was wrong. The proper
   LOCALBASE path is now used due to OpenSSH's build already handling it
   properly.
3. Remove confusing UsePrivilegeSeparation change in sshd_config. The default
   upstream is to have it disabled by default. The sshd_config line is in
   upstream to enable it by default in new installations. We always enable
   it though. So remove the sshd_config change which makes it look like
   we don't use it; it was not a needed difference with upstream.

From discussion with:	TJ <tj@mrsk.me>

Limit the TTSSH bug fix in r383618 to only versions that have it.

Submitted by:	IWAMOTO Kouichi <sue@iwmt.org>

Fix TTSSH (Tera Type/Term) client crash:

Unexpected SSH2 message(80) on current stage(6)

This patch was submitted upstream. The client has fixed it in their SVN [1][2]
but not yet released a fixed build.

[1] http://en.sourceforge.jp/ticket/browse.php?group_id=1412&tid=35010
[2] http://en.sourceforge.jp/projects/ttssh2/scm/svn/commits/5829

Remove debugging leftover in release.

error: mm_request_receive: socket closed

Obtained from:	Upstream c7fe79ed7db427f1474e72b9f8b465901d61d3f6

- Update to 6.8p1 - Fix 'make test' - HPN:   - NONECIPHER is no longer default. This is not default in base and should not     be default here as it introduces security holes.   - HPN: I've audited the patch and included it in the port directory for     transparency. I identified several bugs and submitted them to the new     upstream: https://github.com/rapier1/openssh-portable/pull/2   - HPN: Th

Changelog: http://www.openssh.com/txt/release-6.8

Remove unused variable PRECIOUS

Make the check added in 2013 in r330200 for a bad ECDSA key actually work.

Remove useless IGNORE for TCP_WRAPPERS and PAM.

TCP_WRAPPERS: /usr/include/tcpd.h is always installed by the base system.
              It is only libwrap.so that is conditional on WITH_TCP_WRAPPERS.

PAM:          /usr/include/security/pam_modules.h is always installed.

This fixes FreshPorts claiming this port is ignored.

Make the VersionAddendum fix use the proper default.

Once I ran into the X509 issue previously I failed to retest that the patch
worked.

PR:		193127

security category: Remove $PTHREAD_LIBS

approved by:	PTHREAD blanket

Stop forcing the port version string into the server banner.

The port now uses VersionAddendum in the sshd_config to allow overriding
this value. Using "none" allows disabling the default of the port
version string. The default is kept to show the port version string to
remain close to the base version.

Support for the client VersionAddendum may be added soon as well to better
match base and not give surprises when switching from base to the port.

PR:		193127
Requested by:	many, including myself when this was broken years ago.

Fix incorrect reference to ETCSSH from r381709

Set proper ETCDIR. Mistake in r381709

Remove remnants of OVERWRITE_BASE which was removed in r376306

Fix application of GSSAPI patch when using HPN. It applies fine if done after HPN.

Reported by:	gwollman