[ 17:16 bdrewery  ]

• 383231 security/openssh-portable/Makefile
• 383231 security/openssh-portable/distinfo
• 383231 security/openssh-portable/files/extra-patch-hpn
• 383231 security/openssh-portable/files/extra-patch-hpn-build-options
• 383231 security/openssh-portable/files/extra-patch-hpn-no-hpn
• 383231 security/openssh-portable/files/extra-patch-hpn-window-size
• 383231 security/openssh-portable/files/extra-patch-sshd-utmp-size
• 383231 security/openssh-portable/files/extra-patch-tcpwrappers
• 383231 security/openssh-portable/files/patch-regress__test-exec.sh
• 383231 security/openssh-portable/files/patch-servconf.c

- Update to 6.8p1
- Fix 'make test'
- HPN:
  - NONECIPHER is no longer default. This is not default in base and should not
    be default here as it introduces security holes.
  - HPN: I've audited the patch and included it in the port directory for
    transparency. I identified several bugs and submitted them to the new
    upstream: https://github.com/rapier1/openssh-portable/pull/2
  - HPN: The entire patch is now ifdef'd to ensure various bits are properly
    removed depending on the OPTIONS selected.
  - AES_THREADED is removed. It has questionable benefit on modern HW and is not
    stable.
  - The "enhanced logging" was removed from the patch as it is too
    intrusive and difficult to maintain in the port.
  - The progress meter "peak throughput" patch was removed.
  - Fixed HPN version showing in client/server version string when HPN
    was disabled in the config.
- KERB_GSSAPI is currently BROKEN as it does not apply.
- Update X509 to 8.3

Changelog: http://www.openssh.com/txt/release-6.8

[ 02:34 bdrewery  ]

• 374833 security/openssh-portable/Makefile
• 374833 security/openssh-portable/distinfo
• 374833 security/openssh-portable/files/extra-patch-hpn-build-options

- Fix HPN patches for 6.7p1
- Add back HPN and NONECIPHER for the default options and bump PORTREVISION
  due to this.

[ 17:35 bdrewery  ]

• 348420 security/openssh-portable/Makefile
• 348420 security/openssh-portable/distinfo
• 348420 security/openssh-portable/files/extra-patch-hpn-build-options
• 348420 security/openssh-portable/files/patch-sandbox-capsicum.c

- Update to 6.6
- Capsicum patch no longer needed
- Update X509 patch to 7.9

Changelog: http://www.openssh.org/txt/release-6.6

[ 01:40 bdrewery  ]

• 342618 security/openssh-portable/Makefile
• 342618 security/openssh-portable/distinfo
• 342618 security/openssh-portable/files/extra-patch-hpn-build-options
• 342618 security/openssh-portable/files/openssh.in
• 342618 security/openssh-portable/files/patch-readconf.c
• 342618 security/openssh-portable/files/patch-sandbox-capsicum.c
• 342618 security/openssh-portable/files/patch-servconf.c
• 342618 security/openssh-portable/files/patch-sshd.c
• 342618 security/openssh-portable/files/patch-sshd_config

- Update to 6.5
  ChangeLog: http://www.openssh.org/txt/release-6.5

- Update X509 patch to 7.8
- Update LIB_DEPENDS to new format
- Revert r328706 and re-enable privilege separation sandboxing by default
  as the issue causing crashes has been fixed upstream
- capsicum(4) is now enabled upstream. A local patch is added to fix an issue
  with it [1]
- KERB_GSSAPI is marked BROKEN. It does not build.
  This patch lacks an upstream and I have no way to test it. It needs
  a non-trivial amount of refactoring for 6.5 as the key handling API
  has changed quite a bit.

Submitted by:	pjd@ [1]

[ 02:20 bdrewery  ]

• 330200 security/openssh-portable/Makefile
• 330200 security/openssh-portable/distinfo
• 330200 security/openssh-portable/files/extra-patch-hpn-build-options
• 330200 security/openssh-portable/files/extra-patch-hpn-no-hpn
• 330200 security/openssh-portable/files/extra-patch-ldns
• 330200 security/openssh-portable/files/patch-session.c
• 330200 security/openssh-portable/files/patch-ssh-agent.c
• 330200 security/openssh-portable/pkg-message
• 330200 security/openssh-portable/pkg-plist

- Update to 6.3p1
  Changelog: http://www.openssh.org/txt/release-6.3
- Use options helpers where possible
- Use upstream patch mirror for x509 and HPN
- Update HPN patch to v14 and use upstream version
- Add option NONECIPHER to allow disabling NONE in HPN patch
- Update x509 patch from 7.4.1 to 7.6
- Add support for LDNS and enable by it and VerifyHostKeyDNS/SSHFP by default.
  See
http://lists.freebsd.org/pipermail/freebsd-security/2013-September/007180.html
  which describes this change, but is supported on releases before 10 as well
  with LDNS option.
- Update SCTP to patchlevel 2329
- Update recommendation on secure usage of SSH
- Add pkg-message warning about ECDSA key possibly being incorrect due to
  previously being written as DSA by the rc script and fixed in r299902 in
  2012