FreshBSD

Add a ssh_config HostbasedKeyType option to control which
host public key types are tried during hostbased authentication.

This may be used to prevent too many keys being sent to the server,
and blowing past its MaxAuthTries limit.

bz#2211 based on patch by Iain Morgan; ok markus@

Fix the default interactive level to install the "default" dependencies.
Actually testing it caused me to write correct (and simpler) code...

set a timeout to prevent hangs when talking to busted servers;
ok markus@

remove tenex transfer support. if you still have TOPS20 machines in
service, you'll need to stick with openbsd 5.6.
bonus: remove references to ebcdic.
ok deraadt

Abolish struct tbl_head and replace it by an "int col" member in
struct tbl_cell.  No functional change, minus 40 lines of code.

Auditing the tbl(7) code for more NULL pointer accesses, i came out
empty-handed; so this is just KNF and some code simplifications,
no functional change.

avoid more fatal/exit in the packet.c paths that ssh-keyscan
uses; feedback and "looks good" markus@

regression test for 'wildcard CA' serial/key ID revocations

permit KRLs that revoke certificates by serial number or key ID
without scoping to a particular CA; ok markus@

missing parentheses after if in do_convert_from() broke
private key conversion from other formats some time in 2010;
bz#2345 reported by jjelen AT redhat.com

Make sure every layout line contains at least one cell;
fixing a NULL pointer access in term_tbl() that jsg@ found with afl.

fix ssh protocol 1, spotted by miod@

correctly handle table layout lines starting with a dot

Rework vis.3 so it has standard sections.

Moved the return values from the description to a proper return values
section.  Broke up the description into function description followed
by a subsection for the range and encoding.  Replaced srclen with
strlen(src) when srclen isn't an argument.  Moved the common flag argument
to its own paragraph.

input schwarze@, input + ok jmc@

reorg tbl(7) test suite

reorg tbl(7) test suite

reorg tbl(7) test suite

remove no-op simple locks
tested by jsg, ok miod

back bpf.c down to 1.113, from before most recent timeout changes.
nmap is broken, as reported by kent fritz.
pending further investigation, we should keep nmap working until a
better fix is developed for the original problem.

Correct buffer overflow in handling of pax extension headers, caught
by the memcpy() overlap check.

ok millert@ deraadt@

At upgrade time delete sendmail,named,nginx,openssl binaries because
they may reside earlier in the path than a pkg.
prompted by tedu, with halex

Fix a regression that removed support for using service names instead
of ports.  It is now possible to use "listen on * port www" again.

Found by ajacoutot@
OK ajacoutot@ blambert@

manual SAs described in ipsec.conf(5) not ipsecctl(8);
from paul gorman

Use .Rv where appropriate, and move it to RETURN VALUES;
remove .Tn, and a few minor macro adjustments.
Patch from Kaspars at Bankovskis dot net.

Radical cleanup of COMPATIBILITY sections:
Remove lots of lies, dozens of irrelevant implementation details,
and all references to groff versions older than 1.17.  Move relevant
information to the pages where it belongs, and out of mandoc(1) in
particular.  Add some missing general remarks to roff(7), where it
fits the character and purpose of the page much better.

dial the time back to about 0.1s, closer to the original targets and
friendlier for users. requested by deraadt

Add a test where the TLS handshake fails because of null ciphers.

update to new API (key_fingerprint => sshkey_fingerprint)
check sshkey_fingerprint return values;
ok markus

- Add PCH2 and PCH LPT to the list of chips capable of only 9K jumbos.
- Updated PBA values for the 82574 controller (20KB) and ICH9/10 with
  jumbos (14KB).

Tested by a few on 82574, ICH9 and PCH LPT

From FreeBSD

Revert rtdeletemsg conversion.  It was not ok'd, I misunderstood bluhm@'s
email.

avoid fatal() calls in packet code
makes ssh-keyscan more reliable against server failures
ok dtucker@ markus@

When comparing the LSA with the Ack, also check the age field.  This
ensures that a LSA withdrawal is not acked by a previous update.
From Florian Riehm;  OK claudio@

avoid fatal() calls in packet code
makes ssh-keyscan more reliable against server failures
ok dtucker@ markus@

Clean up eqn(7) error handling:
* When "define" fails, do not drop the whole equation.
* Free memory after "undef".
* Use standard mandoc error types instead of rolling our own.
* Delete obfuscating EQN_MSG() macro.
* Add function prototypes while here.

revert back to initial vnodes again so we can be sure nfs likes it

Test the x509 certificate validation of syslog over TLS.

If not explicitly disabled, syslogd verifies the x509 certificate
and hostname of the TLS server before sending any messages to it.
Per default /etc/ssl/cert.pem is used as CA file.
OK deraadt@

* Polish tbl(7) error reporting.
* Do not print out macro names in tbl(7) data blocks.
* Like with GNU tbl, let empty tables cause a blank line.
* Avoid producing empty tables in -Tman.

Remove ssl_by_mem_ctrl() and x509_mem_lookup to unbreak the build.  It
caused a conflict with a new function in LibreSSL but wasn't even used
by ldapd.  No functional change.

OK deraadt@

For now, it can't be helped that mandoc tbl(7) ignores high-level macros,
but stop throwing away their arguments.  This fixes information loss in a
handful of Xenocara manuals, at the price of a small amount of formatting
noise creeping through.

sync

remove obsolete comment

drm/radeon: allow geom rings to be setup on r600/r700 (v2)

From Dave Airlie
7c4c62a04a2a80e3feb5d6c97aca1e413b11c790 in mainline linux

drm/radeon: fix VGT_GS_INSTANCE_CNT register

From Dave Airlie
b7bc799903bbae16795cb15705ddcab80c8f17f1 in mainline linux

jcs found another remnant of cool running mode

implement the tbl(7) "center" layout option

Fix a number of issues relating to algorithms in signatures, Mostly
from OpenSSL with a hint of boring and some things done here. Addresses
CVE-2014-8275 for OpenSSL fully
ok miod@ doug@

Remove an unused macro and a stale comment. No functional change.

adjust formatting for the tbl(7) layout 'x' modifier (maximize column)
to match groff for up to six maximized columns

when doing a blocking read with a timeout, after the sleep reset
the start time so the next read behaves the same.

from Simon Mages