upstream: Fix UpdateHostkeys/HashKnownHosts/CheckHostIP bug

When all of UpdateHostkeys, HashKnownHosts and ChechHostIP
were enabled and new host keys were learned, known_hosts IP
ent

upstream: Fix UpdateHostkeys/HashKnownHosts/CheckHostIP bug

When all of UpdateHostkeys, HashKnownHosts and ChechHostIP
were enabled and new host keys were learned, known_hosts IP
entries were not being recorded for new host keys.

reported by matthieu@ ok markus@

OpenBSD-Commit-ID: a654a8290bd1c930aac509e8158cf85e42e49cb7

show more ...

upstream: don't UpdateHostkeys when the hostkey is verified by the

GlobalKnownHostsFile file, support only UserKnownHostsFile matches

suggested by Mark D. Baushke; feedback and ok m

upstream: don't UpdateHostkeys when the hostkey is verified by the

GlobalKnownHostsFile file, support only UserKnownHostsFile matches

suggested by Mark D. Baushke; feedback and ok markus@

OpenBSD-Commit-ID: eabb771a6add676c398d38a143a1aff5f04abbb9

show more ...

upstream: revert kex->flags cert hostkey downgrade back to a plain

key (commitid VtF8vozGOF8DMKVg). We now do this a simpler way that needs less
plumbing.

ok markus@

Op

upstream: revert kex->flags cert hostkey downgrade back to a plain

key (commitid VtF8vozGOF8DMKVg). We now do this a simpler way that needs less
plumbing.

ok markus@

OpenBSD-Commit-ID: fb92d25b216bff8c136da818ac2221efaadf18ed

show more ...

upstream: simply disable UpdateHostkeys when a certificate

successfully authenticated the host; simpler than the complicated plumbing
via kex->flags we have now.

ok markus@

upstream: simply disable UpdateHostkeys when a certificate

successfully authenticated the host; simpler than the complicated plumbing
via kex->flags we have now.

ok markus@

OpenBSD-Commit-ID: 80e39644eed75717d563a7f177e8117a0e14f42c

show more ...

upstream: disable UpdateHostkeys by default if VerifyHostKeyDNS is

enabled; suggested by Mark D. Baushke

OpenBSD-Commit-ID: 85a1b88592c81bc85df7ee7787dbbe721a0542bf

upstream: Agent protocol draft is now at rev 4. ok djm@

OpenBSD-Commit-ID: 8c01ea3aae48aab45e01b7421b0fca2dad5e7837

upstream: when ordering host key algorithms in the client, consider

the ECDSA key subtype; ok markus@

OpenBSD-Commit-ID: 3097686f853c61ff61772ea35f8b699931392ece

upstream: Allow full range of UIDs and GIDs for sftp chown and

chgrp on 32bit platforms instead of being limited by LONG_MAX. bz#3206,
found by booking00 at sina.cn, ok markus@

upstream: Allow full range of UIDs and GIDs for sftp chown and

chgrp on 32bit platforms instead of being limited by LONG_MAX. bz#3206,
found by booking00 at sina.cn, ok markus@

OpenBSD-Commit-ID: 373b7bbf1f15ae482d39567ce30d18b51c9229b5

show more ...

upstream: There are lots of place where we want to redirect stdin,

stdout and/or stderr to /dev/null. Factor all these out to a single
stdfd_devnull() function that allows selection of w

upstream: There are lots of place where we want to redirect stdin,

stdout and/or stderr to /dev/null. Factor all these out to a single
stdfd_devnull() function that allows selection of which of these to redirect.
ok markus@

OpenBSD-Commit-ID: 3033ba5a4c47cacfd5def020d42cabc52fad3099

show more ...

upstream: enable UpdateHostkeys by default when the configuration

has not overridden UserKnownHostsFile; ok markus@ "The timing is perfect"
deraadt@

OpenBSD-Commit-ID: 62df71c9c

upstream: enable UpdateHostkeys by default when the configuration

has not overridden UserKnownHostsFile; ok markus@ "The timing is perfect"
deraadt@

OpenBSD-Commit-ID: 62df71c9c5242da5763cb473c2a2deefbd0cef60

show more ...

upstream: disable UpdateHostkeys when a wildcard hostname pattern

is encountered or when a certificate host key is in use. feedback/ok markus@

OpenBSD-Commit-ID: b6e5575af7e6732322b

upstream: disable UpdateHostkeys when a wildcard hostname pattern

is encountered or when a certificate host key is in use. feedback/ok markus@

OpenBSD-Commit-ID: b6e5575af7e6732322be82ec299e09051a5413bd

show more ...

upstream: record when the host key checking code downgrades a

certificate host key to a plain key. This occurs when the user connects to a
host with a certificate host key but no corresp

upstream: record when the host key checking code downgrades a

certificate host key to a plain key. This occurs when the user connects to a
host with a certificate host key but no corresponding CA key configured in
known_hosts; feedback and ok markus@

OpenBSD-Commit-ID: 2ada81853ff9ee7824c62f440bcf4ad62030c901

show more ...

upstream: prefer ed25519 signature algorithm variants to ECDSA; ok

markus@

OpenBSD-Commit-ID: 82187926fca96d35a5b5afbc091afa84e0966e5b

upstream: want time.h here too

OpenBSD-Commit-ID: fafee8f1108c64ad8b282f9a1ed5ea830d8c58a7

upstream: split introductory paragraph, and insert ominous words about

the glob issue, which cannot be fully fixed and really requires completely
replacing scp with a completely differen

upstream: split introductory paragraph, and insert ominous words about

the glob issue, which cannot be fully fixed and really requires completely
replacing scp with a completely different subsystem. team effort to find the
right words..

OpenBSD-Commit-ID: 58e1f72d292687f63eb357183036ee242513691c

show more ...

use relative rather than system include here

add some openbsd-compat licenses we missed

un-nest $() to make ksh cheerful

ksh doesn't grok 'local'

and AFAICT it's not actually doing anything useful in the code, so let's
see how things go without it.

Fix `EOF: command not found` error in ssh-copy-id

upstream: Regen moduli.

OpenBSD-Commit-ID: 04967f8c43e9854ac34b917bcd6f5ac96c53a693

Restore first section title of INSTALL

update version numbers

upstream: openssh 8.4

OpenBSD-Commit-ID: a29e5b372d2c00e297da8a35a3b87c9beb3b4a58

sync with upstream ssh-copy-id rev f0da1a1b7