[ 19:30 bdrewery  ]

• 431698 security/openssh-portable/Makefile
• 431698 security/openssh-portable/distinfo
• 431698 security/openssh-portable/files/extra-patch-hpn
• 431698 security/openssh-portable/files/extra-patch-ldns
• 431698 security/openssh-portable/files/extra-patch-sctp
• 431698 security/openssh-portable/files/extra-patch-tcpwrappers
• 431698 security/openssh-portable/files/extra-patch-x509-glue
• 431698 security/openssh-portable/files/patch-kex.c
• 431698 security/openssh-portable/files/patch-misc.c
• 431698 security/openssh-portable/files/patch-readconf.c

Update to 7.4p1.

- Update X509 patch to 9.3
- SCTP patch from soralx@cydem.org

Changes: https://www.openssh.com/txt/release-7.4

[ 18:36 bdrewery  ]

• 409823 security/openssh-portable/Makefile
• 409823 security/openssh-portable/distinfo
• 409823 security/openssh-portable/files/extra-patch-hostkeyalg_plus
• 409823 security/openssh-portable/files/extra-patch-hpn
• 409823 security/openssh-portable/files/extra-patch-ldns
• 409823 security/openssh-portable/files/patch-servconf.c
• 409823 security/openssh-portable/files/patch-ssh-agent.1
• 409823 security/openssh-portable/pkg-plist

- Update to 7.2p1
- Mark X509 and KERB_GSSAPI as BROKEN.

Changelog: http://www.openssh.com/txt/release-7.2

With help from:	brnrd

[ 02:20 bdrewery  ]

• 330200 security/openssh-portable/Makefile
• 330200 security/openssh-portable/distinfo
• 330200 security/openssh-portable/files/extra-patch-hpn-build-options
• 330200 security/openssh-portable/files/extra-patch-hpn-no-hpn
• 330200 security/openssh-portable/files/extra-patch-ldns
• 330200 security/openssh-portable/files/patch-session.c
• 330200 security/openssh-portable/files/patch-ssh-agent.c
• 330200 security/openssh-portable/pkg-message
• 330200 security/openssh-portable/pkg-plist

- Update to 6.3p1
  Changelog: http://www.openssh.org/txt/release-6.3
- Use options helpers where possible
- Use upstream patch mirror for x509 and HPN
- Update HPN patch to v14 and use upstream version
- Add option NONECIPHER to allow disabling NONE in HPN patch
- Update x509 patch from 7.4.1 to 7.6
- Add support for LDNS and enable by it and VerifyHostKeyDNS/SSHFP by default.
  See
http://lists.freebsd.org/pipermail/freebsd-security/2013-September/007180.html
  which describes this change, but is supported on releases before 10 as well
  with LDNS option.
- Update SCTP to patchlevel 2329
- Update recommendation on secure usage of SSH
- Add pkg-message warning about ECDSA key possibly being incorrect due to
  previously being written as DSA by the rc script and fixed in r299902 in
  2012