MFH (r314306,r314720): Upgrade OpenSSH to 7.4p1.

MFH (r314527,r314576,r314601,r317998): Upgrade OpenSSH to 7.3p1.

MFC r314658:

crypto: normalize paths using SRCTOP-relative paths or :H when possible

This simplifies make logic/output

MFC r311140:

Only bake krb5_config.h support in to ssh(3), etc if both MK_GSSAPI and
MK_KERBEROS_SUPPORT != no

This fixes the odd case where someone specified MK_GSSAPI=no and
MK_KERBEROS_SUPPORT=yes (which admittedly, probably doesn't make sense,
but the build system doesn't prevent this case today, and it didn't when
I filed the bug back in 2011 either).

PR: 159745

Copy head@r302406 to stable/11 as part of the 11.0-RELEASE cycle.
Prune svn:mergeinfo from the new branch, as nothing has been merged
here.

Additional commits post-branch will follow.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Merge the projects/release-pkg branch to head.

This allows packaging the base system with pkg(8), including
but not limited to providing the ability to provide upstream
binary update possibilities for non-tier-1 architectures.

This merge is a requirement of the 11.0-RELEASE, and as such,
thank you to everyone that has tested the project branch.

Documentation in build(7) etc. is still somewhat sparse, but
updates to those parts will follow.

Sponsored by: The FreeBSD Foundation

Upgrade to OpenSSH 7.2p2.

Upgrade to OpenSSH 7.0p1.

List source files (foo.c) instead of object files in SRCS.

Reviewed by: bdrewery

Upgrade to OpenSSH 6.8p1.

Upgrade to OpenSSH 6.7p1, retaining libwrap support (which has been removed
upstream) and a number of security fixes which we had already backported.

MFC after: 1 week

Replace unneeded manual dependency on header by adding it to SRCS.

bsd.lib.mk and bsd.prog.mk already depend all objs on headers in SRCS if
there is not yet a depend file. The headers in SRCS are never built or
installed. After 'make depend' the header was already added as a proper
dependency on the objects where needed.

MFC after: 2 weeks
Sponsored by: EMC / Isilon Storage Division

Retire the NONE cipher option.

Reduce overlinking
The framework now ensure by itself that pthread is added to the link chain
as the last component if linked to kerberos hence avoid with out any explicit
addition prevent issue like CVE-2014-8475

Convert to LIBADD
Reduce overlinking

Rework privatelib/internallib

Make sure everything linking to a privatelib and/or an internallib does it directly
from the OBJDIR rather than DESTDIR.
Add src.libnames.mk so bsd.libnames.mk is not polluted by libraries not existsing
in final installation
Introduce the LD* variable which is what ld(1) is expecting (via LDADD) to link to
internal/privatelib
Directly link to the .so in case of private library to avoid having to complexify
LDFLAGS.

Phabric: https://phabric.freebsd.org/D553
Reviewed by: imp, emaste

Use src.opts.mk in preference to bsd.own.mk except where we need stuff
from the latter.

Upgrade to OpenSSH 6.6p1.

Upgrade to OpenSSH 6.5p1.

Unbreak the WITHOUT_KERBEROS build and try to reduce the odds of a
repeat performance by introducing a script that runs configure with and
without Kerberos, diffs the result and generates krb5_config.h, which
contains the preprocessor macros that need to be defined in the Kerberos
case and undefined otherwise.

Approved by: re (marius)

Clean up the OpenSSH build. It is now possible to build most components
as static binaries, if desired. The one exception is sshd, which runs
into trouble due to libpam.a's includion of pam_ssh.

Make OpenSSH use LDNS if available. This allows it to verify signed
SSHFP records.

Approved by: re (blanket)

Make libldns and libssh private.

Approved by: re (blanket)

Upgrade to OpenSSH 6.2p1. The most important new features are support
for a key revocation list and more fine-grained authentication control.

Add a src.conf(5) option to allow users to compile in the "NONE cipher",
which, only after authentication, disables crypto, and only for sessions
without a terminal.

Submitted by: Jeremy Chadwick (freebsd jdc.parodius.com)
PR: bin/163095
MFC after: 10 days

Upgrade OpenSSH to 6.1p1.

Upgrade to OpenSSH 5.8p2.

Upgrade to OpenSSH 5.4p1.

MFC after: 1 month

Fix globbing

Noticed by: delphij, David Cornejo <dave@dogwood.com>
Forgotten by: des

Bump the version of all non-symbol-versioned shared libraries in
preparation for 8.0-RELEASE. Add the previous version of those
libraries to ObsoleteFiles.inc and bump __FreeBSD_Version.

Reviewed by: kib
Approved by: re (rwatson)

Use the closefrom(2) system call.

Reviewed by: des

Upgrade to OpenSSH 5.2p1.

MFC after: 3 months

Upgrade to OpenSSH 5.1p1.

I have worked hard to reduce diffs against the vendor branch. One
notable change in that respect is that we no longer prefer DSA over
RSA - the reasons for doing so went away years ago. This may cause
some surprises, as ssh will warn about unknown host keys even for
hosts whose keys haven't changed.

MFC after: 6 weeks

Fix conflicts after heimdal-1.1 import and add build infrastructure. Import
all non-style changes made by heimdal to our own libgssapi.

- Bump share library version which were missed in last bump

Reported by: jhb
Discussed with: deischen, des, doubg, harti
Approved by: re (kensmith)

Update for OpenSSH 4.4p1.

MFC after: 1 week

Add a manual dependency on ssh_namespace.h.

Discussed with: ru

Introduce a namespace munging hack inspired by NetBSD to avoid polluting
the namespace of applications which inadvertantly link in libssh (usually
through pam_ssh)

Suggested by: lukem@netbsd.org
MFC after: 6 weeks

Add port-tun.c.

Reimplementation of world/kernel build options. For details, see:

http://lists.freebsd.org/pipermail/freebsd-current/2006-March/061725.html

The src.conf(5) manpage is to follow in a few days.

Brought to you by: imp, jhb, kris, phk, ru (all bugs are mine)

Add a new extensible GSS-API layer which can support GSS-API plugins,
similar the the Solaris implementation. Repackage the krb5 GSS mechanism
as a plugin library for the new implementation. This also includes a
comprehensive set of manpages for the GSS-API functions with text mostly
taken from the RFC.

Reviewed by: Love Hörnquist Åstrand <lha@it.su.se>, ru (build system), des (openssh parts)

Update for OpenSSH 4.2p1.

Bump the shared library version number of all libraries that have not
been bumped since RELENG_5.

Reviewed by: ru
Approved by: re (not needed for commit check but in principle...)

Revert the commits that made libssh an INTERNALLIB; they caused too much
trouble, especially on amd64.

Requested by: ru

Make libssh an INTERNALLIB like it is in {Net,Open}BSD.

Update for OpenSSH 4.1p1.

NODOCCOMPRESS -> NO_DOCCOMPRESS
NOINFO -> NO_INFO
NOINFOCOMPRESS -> NO_INFOCOMPRESS
NOLINT -> NO_LINT
NOPIC -> NO_PIC
NOPROFILE -> NO_PROFILE

Update for OpenSSH 3.9p1.

For variables that are only checked with defined(), don't provide
any fake value.

Update for 3.8p1, including workaround for a bug in gss-genr.c.

Cosmetics: rearrange the dependency list to match that of ssh and sshd.

Reviewed by: des

Use += instead of = with DPADD / LDADD.

Enable GSSAPI support. [1]
Also remove some duplicates from ssh's SRCS.

Submitted by: [1] Björn Grönvall <bg@sics.se>

Previous commit erroneously listed some sources with .o suffixes.

Update Makefiles for OpenSSH 3.7.1p2.

Turn MAKE_KERBEROS5 into NO_KERBEROS by negating the logic. Some extra
cleanups were necessary in release/Makefile, and the tinderbox code
was syntax checked, not run checked.

Update for 3.6.1p1; also remove Kerberos IV shims.

Style sync with rest of FreeBSD.

Update for OpenSSH 3.5p1.

Don't lint contrib'ed sources, even if the builder has asked for linting.
Its Just Too Noisy.

No guts, no glory. Switch to OpenSSH-portable.

Sponsored by: DARPA, NAI Labs

Update Makefiles for OpenSSH 3.3.

The library itself does not depend on Kerberos bits.
Otherwise, we would have broken krb4 and krb5 dists.

Adjust for OpenSSH 3.1.

Sponsored by: DARPA, NAI Labs

Now that cross-tools ld(1) has been fixed to look for dynamic
dependencies in the correct place, record the fact that -lssh
depends on -lcrypto and -lz.

Removed false dependencies on -lz (except ssh(1) and sshd(8)).
Removed false dependencies on -lcrypto and -lutil for scp(1).

Reviewed by: markm

Add pam_ssh support to the static PAM library, libpam.a:

- Spam /usr/lib some more by making libssh a standard library.
- Tweak ${LIBPAM} and ${MINUSLPAM}.
- Garbage collect unused libssh_pic.a.
- Add fake -lz dependency to secure/ makefiles needed for
dynamic linkage with -lssh.

Reviewed by: des, markm
Approved by: markm

Install libssh and libssh_pic. These are needed when building
statically, and when building things (like login(8)) standalone.
libssh_pic is needed for libpam and modules.

Requested by: peter

Follow the OpenSSH 2.9 upgrade with the infrastructure. Two new
programs are now included: sftp(1) and ssh-keyscan(1).

Add the new version.c to libssh.

secure/ build fixes:

- TELNETOBJDIR is gone. `buildworld' already installs libtelnet.a
in ${WORLDTMP}/usr/lib, and we have LIBRARY_PATH pointing there.

- SSHDIR (formerly SSHSRC) is now shared between all SSH modules.
New LIBSSH is introduced for libssh.a (an internal static lib).
Previously, build without prior `obj' was broken; SSH modules
always looked for libssh.a in ${.OBJDIR}. Also, the dependancies
on the libssh.a were missing.

- libtelnet/ did not install the crypto version of telnet.h into
/usr/include/arpa.

- Removed BINOWN, BINMODE, BINDIR and SRCS with default values.

Reviewed by: markm

- MAN[1-9] -> MAN.

Update for OpenSSH 2.3.0.

Update for OpenSSH 2.2.0

Forced commit. This is to try and help folks that used the international
crypto repo and have slightly different files but with the same version.
cvsup in 'checkout mode' has no trouble with this, but cvs can get really
silly about it.

Add a new file to SRCS

Update for OpenSSH 2.1

Remove port components not needed in 4.n+

Submitted by: Half the freaking planet....

Add the OpenSSH userland-building Makefiles.