main/openssh: upgrade to 7.1_p1

7 files changed, 99 insertions, 207 deletions

diff --git a/main/openssh/APKBUILD b/main/openssh/APKBUILD
index 70bd50deea..b648c8a647 100644
--- a/main/openssh/APKBUILD
+++ b/main/openssh/APKBUILD
@@ -1,8 +1,8 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=openssh
-pkgver=6.9_p1
+pkgver=7.1_p1
 _myver=${pkgver%_*}${pkgver#*_}
-pkgrel=5
+pkgrel=0
 pkgdesc="Port of OpenBSD's free SSH release"
 url="http://www.openssh.org/portable.html"
 arch="all"
@@ -13,13 +13,10 @@ makedepends="openssl-dev zlib-dev linux-headers"
 subpackages="$pkgname-doc $pkgname-client $pkgname-keysign
 	$pkgname-sftp-server:sftp"
 source="ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/$pkgname-$_myver.tar.gz
-	CVE-2015-5600.patch
-	CVE-2015-6563.patch
-	CVE-2015-6564.patch
-	CVE-2015-6565.patch
 	openssh6.5-peaktput.diff
-	openssh6.9-dynwindows.diff
+	openssh7.1-dynwindows.diff
 	openssh-fix-utmp.diff
+	bsd-compatible-realpath.patch
 	sshd.initd
 	sshd.confd
 	openssh-sftp-interactive.diff
@@ -120,36 +117,27 @@ sftp() {
 		"$subpkgdir"/usr/lib/ssh/ || return 1
 }
 
-md5sums="0b161c44fc31fbc6b76a6f8ae639f16f  openssh-6.9p1.tar.gz
-f3e17e9514d246d415fb6388609bc0f8  CVE-2015-5600.patch
-ae3ac6c890f3172327118f3b793e7f05  CVE-2015-6563.patch
-9e107e2636250f33199ba47550ceca1e  CVE-2015-6564.patch
-449775b5ce63d85331f78784eeb70f78  CVE-2015-6565.patch
+md5sums="8709736bc8a8c253bc4eeb4829888ca5  openssh-7.1p1.tar.gz
 cd52fe99cb4b7d0d847bf5d710d93564  openssh6.5-peaktput.diff
-3880d0b657ed1c58f8747c17e6be4483  openssh6.9-dynwindows.diff
+c17db9b1c9ee354ed66328e3e2b13e98  openssh7.1-dynwindows.diff
 37fbfe9cfb9a5e2454382ea8c79ed2e1  openssh-fix-utmp.diff
+8a2b8457148c29d9bf90955f6c142269  bsd-compatible-realpath.patch
 e3fd4d42e2664b6c37f0c636f5e7a5d8  sshd.initd
 b35e9f3829f4cfca07168fcba98749c7  sshd.confd
 2dd7e366607e95f9762273067309fd6e  openssh-sftp-interactive.diff"
-sha256sums="6e074df538f357d440be6cf93dc581a21f22d39e236f217fcd8eacbb6c896cfe  openssh-6.9p1.tar.gz
-8ce7fa061a4d3a0ac94f07ac694551ac1c5c1e5f82daf04a6434b69761c2fb6e  CVE-2015-5600.patch
-044c3ceeb69c4812414bc605d3fd1f49e48623fe75b958f130420c9a3a3d3914  CVE-2015-6563.patch
-0f4db4d65edbbef21862ac10714bdd4f8911cf9f9b6eb220f94663be0c4872c8  CVE-2015-6564.patch
-cd30c1f083f810d71d91eb03ad08e2cb46652cb80dc40560729e308d4fab8a81  CVE-2015-6565.patch
+sha256sums="fc0a6d2d1d063d5c66dffd952493d0cda256cad204f681de0f84ef85b2ad8428  openssh-7.1p1.tar.gz
 bf49212e47a86d10650f739532cea514a310925e6445b4f8011031b6b55f3249  openssh6.5-peaktput.diff
-6340934b3178fda8ce9f70a2349389fcd2d17c156209f7d08ba38076bee73560  openssh6.9-dynwindows.diff
+cdfb88c155a8472e26bf1a116979ecda65b3b7aafc953158302b61a55eba1ebd  openssh7.1-dynwindows.diff
 1c85437fd94aa4fc269e6297e4eb790baa98c39949ec0410792c09ee31ba9782  openssh-fix-utmp.diff
+d17751be027684424a72d0d9fe2561a70a72396d75f30248688422687fa5b730  bsd-compatible-realpath.patch
 cf053bee46c7037bdab3b3575c7080f4b514d8623c023a4dcfccb4cdcff179cf  sshd.initd
 29c6d57ac3ec6018cadc6ba6cd9b90c9ed46e20049b970fdcc68ee2481a2ee41  sshd.confd
 4ce1ad5f767c0f4e854a0cfeef0e2e400f333c649e552df1ecc317e6a6557376  openssh-sftp-interactive.diff"
-sha512sums="68fec9b4e512fe126a5d35b01e2cc656d810b75052ed8a36bc85cd0a05de7318b15ed287bc95cf9bcb3fa2f385029151d85aced55e07fbcc79e6c779bee6751d  openssh-6.9p1.tar.gz
-30decd1e2f66e9a772389b190e3576722d554015c2ee2418b83bc77ed692c3e3d8ec0a8caf389b054c7db23571742d9eadd0017e8f95441759401867ceaf1fd1  CVE-2015-5600.patch
-7ab16c39dc02d38c2b8498a187c43637f6e8a06dc9786d1746010d2d416d979c34103bd6f95365664a143641d85d6985f73bcf055f5eb481ec34ad2a7ee2e939  CVE-2015-6563.patch
-e5a7d536837aefb07260b01c2863f96d0db2521d7739ded69f92490fad4c8537c853320458cdbc3a86cd90805d54fc87e081ece1dd4cb19392599888f9078e26  CVE-2015-6564.patch
-1199d18e14dcd9d296894c87b26288ac17744497f2aca0a0c9eae2f0e13e45b193160895cad5334ca282aece3a337831549debea22b98852fc221aec7dbc34eb  CVE-2015-6565.patch
+sha512sums="f1491ca5a0a733eb27ede966590642a412cb7be7178dcb7b9e5844bbdc8383032f4b00435192b95fc0365b6fe74d6c5ac8d6facbe9d51e1532d049e2f784e8f7  openssh-7.1p1.tar.gz
 e041398e177674f698480e23be037160bd07b751c754956a3ddf1b964da24c85e826fb75e7c23c9826d36761da73d08db9583c047d58a08dc7b2149a949075b1  openssh6.5-peaktput.diff
-b86f78d7de20c957f58a228a5a1385e6ccf9608c280630524cdbdd1300b04d8382fb86cf42852354f24f0a7d7132520a7c7edb4f2227ce70a99bec269ff33438  openssh6.9-dynwindows.diff
+390214cecb1ffd9eaa10e1d74b353739dcb710c0c180077e7e3fa35f6f9bf0c38be7d0bea58b0d108de1ec37bf8cac721e5564cea387a0d3e3c58b125bbe9241  openssh7.1-dynwindows.diff
 f35fffcd26635249ce5d820e7b3e406e586f2d2d7f6a045f221e2f9fb53aebc1ab1dd1e603b3389462296ed77921a1d08456e7aaa3825cbed08f405b381a58e1  openssh-fix-utmp.diff
+4e551e341e3237cda1bfaf00e770a8b98a2e5ac72238ef305f793279d046c26649b44388b792f79bfc0814468099aa040216407ea9244dfe31ce87d33475b642  bsd-compatible-realpath.patch
 4c24dd9c3cc9ca97bc77bbabb4128e9e043d71523a4bfb93dae65882db1b397f80dc432a9dd013a0aafba1bc0864700d0c8613d444de244d540ff026ffc57e80  sshd.initd
 b9ae816af54a55e134a9307e376f05367b815f1b3fd545c2a2c312d18aedcf907f413e8bad8db980cdd9aad4011a72a79e1e94594f69500939a9cb46287f2f81  sshd.confd
 c1d09c65dbc347f0904edc30f91aa9a24b0baee50309536182455b544f1e3f85a8cecfa959e32be8b101d8282ef06dde3febbbc3f315489339dcf04155c859a9  openssh-sftp-interactive.diff"
diff --git a/main/openssh/CVE-2015-5600.patch b/main/openssh/CVE-2015-5600.patch
deleted file mode 100644
index 32014259ea..0000000000
--- a/main/openssh/CVE-2015-5600.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-===================================================================
-RCS file: /cvs/src/usr.bin/ssh/auth2-chall.c,v
-retrieving revision 1.42
-retrieving revision 1.43
-diff -u -r1.42 -r1.43
---- a/auth2-chall.c	2015/01/19 20:07:45	1.42
-+++ b/auth2-chall.c	2015/07/18 07:57:14	1.43
-@@ -1,4 +1,4 @@
--/* $OpenBSD: auth2-chall.c,v 1.42 2015/01/19 20:07:45 markus Exp $ */
-+/* $OpenBSD: auth2-chall.c,v 1.43 2015/07/18 07:57:14 djm Exp $ */
- /*
-  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
-  * Copyright (c) 2001 Per Allansson.  All rights reserved.
-@@ -57,6 +57,7 @@
- 	void *ctxt;
- 	KbdintDevice *device;
- 	u_int nreq;
-+	u_int devices_done;
- };
- 
- static KbdintAuthctxt *
-@@ -123,11 +124,15 @@
- 		if (len == 0)
- 			break;
- 		for (i = 0; devices[i]; i++) {
--			if (!auth2_method_allowed(authctxt,
-+			if ((kbdintctxt->devices_done & (1 << i)) != 0 ||
-+			    !auth2_method_allowed(authctxt,
- 			    "keyboard-interactive", devices[i]->name))
- 				continue;
--			if (strncmp(kbdintctxt->devices, devices[i]->name, len) == 0)
-+			if (strncmp(kbdintctxt->devices, devices[i]->name,
-+			    len) == 0) {
- 				kbdintctxt->device = devices[i];
-+				kbdintctxt->devices_done |= 1 << i;
-+			}
- 		}
- 		t = kbdintctxt->devices;
- 		kbdintctxt->devices = t[len] ? xstrdup(t+len+1) : NULL;
diff --git a/main/openssh/CVE-2015-6563.patch b/main/openssh/CVE-2015-6563.patch
deleted file mode 100644
index d3bdcac132..0000000000
--- a/main/openssh/CVE-2015-6563.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From d4697fe9a28dab7255c60433e4dd23cf7fce8a8b Mon Sep 17 00:00:00 2001
-From: Damien Miller <djm@mindrot.org>
-Date: Tue, 11 Aug 2015 13:33:24 +1000
-Subject: [PATCH] Don't resend username to PAM; it already has it.
-
-Pointed out by Moritz Jodeit; ok dtucker@
----
- monitor.c      | 2 --
- monitor_wrap.c | 1 -
- 2 files changed, 3 deletions(-)
-
-diff --git a/monitor.c b/monitor.c
-index b410965..f1b873d 100644
---- a/monitor.c
-+++ b/monitor.c
-@@ -1084,9 +1084,7 @@ extern KbdintDevice sshpam_device;
- int
- mm_answer_pam_init_ctx(int sock, Buffer *m)
- {
--
- 	debug3("%s", __func__);
--	authctxt->user = buffer_get_string(m, NULL);
- 	sshpam_ctxt = (sshpam_device.init_ctx)(authctxt);
- 	sshpam_authok = NULL;
- 	buffer_clear(m);
-diff --git a/monitor_wrap.c b/monitor_wrap.c
-index e6217b3..eac421b 100644
---- a/monitor_wrap.c
-+++ b/monitor_wrap.c
-@@ -614,7 +614,6 @@ mm_sshpam_init_ctx(Authctxt *authctxt)
- 
- 	debug3("%s", __func__);
- 	buffer_init(&m);
--	buffer_put_cstring(&m, authctxt->user);
- 	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_INIT_CTX, &m);
- 	debug3("%s: waiting for MONITOR_ANS_PAM_INIT_CTX", __func__);
- 	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_PAM_INIT_CTX, &m);
diff --git a/main/openssh/CVE-2015-6564.patch b/main/openssh/CVE-2015-6564.patch
deleted file mode 100644
index e278dd7414..0000000000
--- a/main/openssh/CVE-2015-6564.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 5e75f5198769056089fb06c4d738ab0e5abc66f7 Mon Sep 17 00:00:00 2001
-From: Damien Miller <djm@mindrot.org>
-Date: Tue, 11 Aug 2015 13:34:12 +1000
-Subject: [PATCH] set sshpam_ctxt to NULL after free
-
-Avoids use-after-free in monitor when privsep child is compromised.
-Reported by Moritz Jodeit; ok dtucker@
----
- monitor.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/monitor.c b/monitor.c
-index f1b873d..a914209 100644
---- a/monitor.c
-+++ b/monitor.c
-@@ -1166,14 +1166,16 @@ mm_answer_pam_respond(int sock, Buffer *m)
- int
- mm_answer_pam_free_ctx(int sock, Buffer *m)
- {
-+	int r = sshpam_authok != NULL && sshpam_authok == sshpam_ctxt;
- 
- 	debug3("%s", __func__);
- 	(sshpam_device.free_ctx)(sshpam_ctxt);
-+	sshpam_ctxt = sshpam_authok = NULL;
- 	buffer_clear(m);
- 	mm_request_send(sock, MONITOR_ANS_PAM_FREE_CTX, m);
- 	auth_method = "keyboard-interactive";
- 	auth_submethod = "pam";
--	return (sshpam_authok == sshpam_ctxt);
-+	return r;
- }
- #endif
- 
diff --git a/main/openssh/CVE-2015-6565.patch b/main/openssh/CVE-2015-6565.patch
deleted file mode 100644
index 2b762de405..0000000000
--- a/main/openssh/CVE-2015-6565.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From 6f941396b6835ad18018845f515b0c4fe20be21a Mon Sep 17 00:00:00 2001
-From: "djm@openbsd.org" <djm@openbsd.org>
-Date: Thu, 30 Jul 2015 23:09:15 +0000
-Subject: upstream commit
-
-fix pty permissions; patch from Nikolay Edigaryev; ok
- deraadt
-
-Upstream-ID: 40ff076d2878b916fbfd8e4f45dbe5bec019e550
----
- sshpty.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/sshpty.c b/sshpty.c
-index 7bb7641..15da8c6 100644
---- a/sshpty.c
-+++ b/sshpty.c
-@@ -1,4 +1,4 @@
--/* $OpenBSD: sshpty.c,v 1.29 2014/09/03 18:55:07 djm Exp $ */
-+/* $OpenBSD: sshpty.c,v 1.30 2015/07/30 23:09:15 djm Exp $ */
- /*
-  * Author: Tatu Ylonen <ylo@cs.hut.fi>
-  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
-@@ -197,7 +197,7 @@ pty_setowner(struct passwd *pw, const char *tty)
- 	/* Determine the group to make the owner of the tty. */
- 	grp = getgrnam("tty");
- 	gid = (grp != NULL) ? grp->gr_gid : pw->pw_gid;
--	mode = (grp != NULL) ? 0622 : 0600;
-+	mode = (grp != NULL) ? 0620 : 0600;
- 
- 	/*
- 	 * Change owner and mode of the tty as required.
--- 
-cgit v0.11.2
-
diff --git a/main/openssh/bsd-compatible-realpath.patch b/main/openssh/bsd-compatible-realpath.patch
new file mode 100644
index 0000000000..6931143bb0
--- /dev/null
+++ b/main/openssh/bsd-compatible-realpath.patch
@@ -0,0 +1,48 @@
+fix issues with fortify-headers and the way openssh handles the needed
+BSD compatible realpath(3)
+
+diff --git a/openbsd-compat/openbsd-compat.h b/openbsd-compat/openbsd-compat.h
+index 1ff7114..e552a10 100644
+--- a/openbsd-compat/openbsd-compat.h
++++ b/openbsd-compat/openbsd-compat.h
+@@ -70,12 +70,8 @@ void *reallocarray(void *, size_t, size_t);
+ #endif
+ 
+ #if !defined(HAVE_REALPATH) || defined(BROKEN_REALPATH)
+-/*
+- * glibc's FORTIFY_SOURCE can redefine this and prevent us picking up the
+- * compat version.
+- */
+-# ifdef BROKEN_REALPATH
+-#  define realpath(x, y) _ssh_compat_realpath(x, y)
++# if !defined(BROKEN_REALPATH)
++#  define ssh_realpath(x, y) realpath(x, y)
+ # endif
+ 
+ char *realpath(const char *path, char *resolved);
+diff --git a/openbsd-compat/realpath.c b/openbsd-compat/realpath.c
+index ba4cea9..1e67ebc 100644
+--- a/openbsd-compat/realpath.c
++++ b/openbsd-compat/realpath.c
+@@ -51,7 +51,7 @@
+  * in which case the path which caused trouble is left in (resolved).
+  */
+ char *
+-realpath(const char *path, char resolved[PATH_MAX])
++ssh_realpath(const char *path, char resolved[PATH_MAX])
+ {
+ 	struct stat sb;
+ 	char *p, *q, *s;
+diff --git a/sftp-server.c b/sftp-server.c
+index eac11d7..ac51ca3 100644
+--- a/sftp-server.c
++++ b/sftp-server.c
+@@ -1162,7 +1162,7 @@ process_realpath(u_int32_t id)
+ 	}
+ 	debug3("request %u: realpath", id);
+ 	verbose("realpath \"%s\"", path);
+-	if (realpath(path, resolvedname) == NULL) {
++	if (ssh_realpath(path, resolvedname) == NULL) {
+ 		send_status(id, errno_to_portable(errno));
+ 	} else {
+ 		Stat s;
diff --git a/main/openssh/openssh6.9-dynwindows.diff b/main/openssh/openssh7.1-dynwindows.diff
index 1fb5a89b93..2b9911c6fb 100644
--- a/main/openssh/openssh6.9-dynwindows.diff
+++ b/main/openssh/openssh7.1-dynwindows.diff
@@ -184,10 +184,10 @@ index 9d76c9d..ecece7f 100644
 +
  #endif
 diff --git a/clientloop.c b/clientloop.c
-index dc0e557..1e52726 100644
+index 87ceb3d..33c59cc 100644
 --- a/clientloop.c
 +++ b/clientloop.c
-@@ -1922,9 +1922,15 @@ client_request_x11(const char *request_type, int rchan)
+@@ -1923,9 +1923,15 @@ client_request_x11(const char *request_type, int rchan)
  	sock = x11_connect_display();
  	if (sock < 0)
  		return NULL;
@@ -203,7 +203,7 @@ index dc0e557..1e52726 100644
  	c->force_drain = 1;
  	return c;
  }
-@@ -1947,10 +1953,16 @@ client_request_agent(const char *request_type, int rchan)
+@@ -1948,10 +1954,16 @@ client_request_agent(const char *request_type, int rchan)
  			    __func__, ssh_err(r));
  		return NULL;
  	}
@@ -221,7 +221,7 @@ index dc0e557..1e52726 100644
  	c->force_drain = 1;
  	return c;
  }
-@@ -1977,10 +1989,18 @@ client_request_tun_fwd(int tun_mode, int local_tun, int remote_tun)
+@@ -1978,10 +1990,18 @@ client_request_tun_fwd(int tun_mode, int local_tun, int remote_tun)
  		return -1;
  	}
  
@@ -242,7 +242,7 @@ index dc0e557..1e52726 100644
  	if (options.tun_open == SSH_TUNMODE_POINTOPOINT)
  		channel_register_filter(c->self, sys_tun_infilter,
 diff --git a/compat.c b/compat.c
-index 0631024..7cee2f0 100644
+index 5583804..9b3d672 100644
 --- a/compat.c
 +++ b/compat.c
 @@ -40,7 +40,7 @@
@@ -263,7 +263,7 @@ index 0631024..7cee2f0 100644
  	} check[] = {
  		{ "OpenSSH-2.0*,"
  		  "OpenSSH-2.1*,"
-@@ -197,6 +197,12 @@ compat_datafellows(const char *version)
+@@ -210,6 +210,12 @@ compat_datafellows(const char *version)
  			debug("match: %s pat %s compat 0x%08x",
  			    version, check[i].pat, check[i].bugs);
  			datafellows = check[i].bugs;	/* XXX for now */
@@ -296,19 +296,19 @@ index 2be290a..453c85e 100644
 +extern unsigned int datafellows;
  #endif
 diff --git a/readconf.c b/readconf.c
-index db7d0bb..d6ddeec 100644
+index 1d03bdf..78d815a 100644
 --- a/readconf.c
 +++ b/readconf.c
-@@ -157,6 +157,7 @@ typedef enum {
- 	oCanonicalizeFallbackLocal, oCanonicalizePermittedCNAMEs,
+@@ -158,6 +158,7 @@ typedef enum {
  	oStreamLocalBindMask, oStreamLocalBindUnlink, oRevokedHostKeys,
  	oFingerprintHash, oUpdateHostkeys, oHostbasedKeyTypes,
+ 	oPubkeyAcceptedKeyTypes,
 +	oTcpRcvBufPoll, oTcpRcvBuf, oHPNDisabled, oHPNBufferSize,
  	oIgnoredUnknownOption, oDeprecated, oUnsupported
  } OpCodes;
  
-@@ -277,6 +278,11 @@ static struct {
- 	{ "hostbasedkeytypes", oHostbasedKeyTypes },
+@@ -279,6 +280,11 @@ static struct {
+ 	{ "pubkeyacceptedkeytypes", oPubkeyAcceptedKeyTypes },
  	{ "ignoreunknown", oIgnoreUnknown },
  
 +	{ "tcprcvbufpoll", oTcpRcvBufPoll },
@@ -319,7 +319,7 @@ index db7d0bb..d6ddeec 100644
  	{ NULL, oBadOption }
  };
  
-@@ -904,6 +910,18 @@ parse_time:
+@@ -906,6 +912,18 @@ parse_time:
  		intptr = &options->check_host_ip;
  		goto parse_flag;
  
@@ -338,7 +338,7 @@ index db7d0bb..d6ddeec 100644
  	case oVerifyHostKeyDNS:
  		intptr = &options->verify_host_key_dns;
  		multistate_ptr = multistate_yesnoask;
-@@ -1067,6 +1085,10 @@ parse_int:
+@@ -1069,6 +1087,10 @@ parse_int:
  		intptr = &options->connection_attempts;
  		goto parse_int;
  
@@ -360,7 +360,7 @@ index db7d0bb..d6ddeec 100644
  	options->proxy_use_fdpass = -1;
  	options->ignored_unknown = NULL;
  	options->num_canonical_domains = 0;
-@@ -1819,6 +1845,28 @@ fill_default_options(Options * options)
+@@ -1817,6 +1843,28 @@ fill_default_options(Options * options)
  		options->server_alive_interval = 0;
  	if (options->server_alive_count_max == -1)
  		options->server_alive_count_max = 3;
@@ -390,7 +390,7 @@ index db7d0bb..d6ddeec 100644
  		options->control_master = 0;
  	if (options->control_persist == -1) {
 diff --git a/readconf.h b/readconf.h
-index 576b9e3..7ac9710 100644
+index bb2d552..6aec47e 100644
 --- a/readconf.h
 +++ b/readconf.h
 @@ -57,6 +57,10 @@ typedef struct {
@@ -427,10 +427,10 @@ index 593fe89..c6922ee 100644
  
  #define	atime	tv[0]
 diff --git a/servconf.c b/servconf.c
-index df93fc4..ea821e7 100644
+index 6c7a91e..1499b6f 100644
 --- a/servconf.c
 +++ b/servconf.c
-@@ -163,6 +163,9 @@ initialize_server_options(ServerOptions *options)
+@@ -165,6 +165,9 @@ initialize_server_options(ServerOptions *options)
  	options->authorized_principals_file = NULL;
  	options->authorized_principals_command = NULL;
  	options->authorized_principals_command_user = NULL;
@@ -440,7 +440,7 @@ index df93fc4..ea821e7 100644
  	options->ip_qos_interactive = -1;
  	options->ip_qos_bulk = -1;
  	options->version_addendum = NULL;
-@@ -179,6 +182,7 @@ option_clear_or_none(const char *o)
+@@ -181,6 +184,7 @@ option_clear_or_none(const char *o)
  void
  fill_default_server_options(ServerOptions *options)
  {
@@ -490,7 +490,7 @@ index df93fc4..ea821e7 100644
  	if (options->ip_qos_interactive == -1)
  		options->ip_qos_interactive = IPTOS_LOWDELAY;
  	if (options->ip_qos_bulk == -1)
-@@ -407,6 +446,7 @@ typedef enum {
+@@ -418,6 +457,7 @@ typedef enum {
  	sHostCertificate,
  	sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile,
  	sAuthorizedPrincipalsCommand, sAuthorizedPrincipalsCommandUser,
@@ -498,7 +498,7 @@ index df93fc4..ea821e7 100644
  	sKexAlgorithms, sIPQoS, sVersionAddendum,
  	sAuthorizedKeysCommand, sAuthorizedKeysCommandUser,
  	sAuthenticationMethods, sHostKeyAgent, sPermitUserRC,
-@@ -537,6 +577,9 @@ static struct {
+@@ -549,6 +589,9 @@ static struct {
  	{ "revokedkeys", sRevokedKeys, SSHCFG_ALL },
  	{ "trustedusercakeys", sTrustedUserCAKeys, SSHCFG_ALL },
  	{ "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL },
@@ -508,7 +508,7 @@ index df93fc4..ea821e7 100644
  	{ "kexalgorithms", sKexAlgorithms, SSHCFG_GLOBAL },
  	{ "ipqos", sIPQoS, SSHCFG_ALL },
  	{ "authorizedkeyscommand", sAuthorizedKeysCommand, SSHCFG_ALL },
-@@ -575,6 +618,7 @@ parse_token(const char *cp, const char *filename,
+@@ -587,6 +630,7 @@ parse_token(const char *cp, const char *filename,
  
  	for (i = 0; keywords[i].name; i++)
  		if (strcasecmp(cp, keywords[i].name) == 0) {
@@ -516,7 +516,7 @@ index df93fc4..ea821e7 100644
  			*flags = keywords[i].flags;
  			return keywords[i].opcode;
  		}
-@@ -1152,6 +1196,19 @@ process_server_config_line(ServerOptions *options, char *line,
+@@ -1165,6 +1209,19 @@ process_server_config_line(ServerOptions *options, char *line,
  			*intptr = value;
  		break;
  
@@ -537,10 +537,10 @@ index df93fc4..ea821e7 100644
  		intptr = &options->ignore_user_known_hosts;
  		goto parse_flag;
 diff --git a/servconf.h b/servconf.h
-index 606d80c..d2854f2 100644
+index f4137af..cd6e8ad 100644
 --- a/servconf.h
 +++ b/servconf.h
-@@ -171,6 +171,9 @@ typedef struct {
+@@ -172,6 +172,9 @@ typedef struct {
  	char   *adm_forced_command;
  
  	int	use_pam;		/* Enable auth via PAM */
@@ -620,7 +620,7 @@ index 214f011..55d6eec 100644
  Recursively copy entire directories when uploading and downloading.
  Note that
 diff --git a/sftp.c b/sftp.c
-index cb9b967..dda3809 100644
+index 788601a..e749945 100644
 --- a/sftp.c
 +++ b/sftp.c
 @@ -71,7 +71,7 @@ typedef void EditLine;
@@ -633,10 +633,10 @@ index cb9b967..dda3809 100644
  /* File to read commands from */
  FILE* infile;
 diff --git a/ssh.c b/ssh.c
-index 3fd5a94..79f97c8 100644
+index 59c1f93..9eab41f 100644
 --- a/ssh.c
 +++ b/ssh.c
-@@ -1813,6 +1813,9 @@ ssh_session2_open(void)
+@@ -1814,6 +1814,9 @@ ssh_session2_open(void)
  {
  	Channel *c;
  	int window, packetmax, in, out, err;
@@ -646,7 +646,7 @@ index 3fd5a94..79f97c8 100644
  
  	if (stdin_null_flag) {
  		in = open(_PATH_DEVNULL, O_RDONLY);
-@@ -1833,9 +1836,74 @@ ssh_session2_open(void)
+@@ -1834,9 +1837,74 @@ ssh_session2_open(void)
  	if (!isatty(err))
  		set_nonblock(err);
  
@@ -722,7 +722,7 @@ index 3fd5a94..79f97c8 100644
  		window >>= 1;
  		packetmax >>= 1;
  	}
-@@ -1844,6 +1912,10 @@ ssh_session2_open(void)
+@@ -1845,6 +1913,10 @@ ssh_session2_open(void)
  	    window, packetmax, CHAN_EXTENDED_WRITE,
  	    "client-session", /*nonblock*/0);
  
@@ -734,7 +734,7 @@ index 3fd5a94..79f97c8 100644
  
  	channel_send_open(c->self);
 diff --git a/sshconnect.c b/sshconnect.c
-index f41960c..a36834e 100644
+index 17fbe39..a965d7a 100644
 --- a/sshconnect.c
 +++ b/sshconnect.c
 @@ -267,6 +267,31 @@ ssh_kill_proxy_command(void)
@@ -793,10 +793,10 @@ index f41960c..a36834e 100644
  	if (roaming_atomicio(vwrite, connection_out, client_version_string,
  	    strlen(client_version_string)) != strlen(client_version_string))
 diff --git a/sshd.c b/sshd.c
-index 6f8c6f2..77888cb 100644
+index 65ef7e8..893a0ab 100644
 --- a/sshd.c
 +++ b/sshd.c
-@@ -431,7 +431,7 @@ sshd_exchange_identification(int sock_in, int sock_out)
+@@ -432,7 +432,7 @@ sshd_exchange_identification(int sock_in, int sock_out)
  	}
  
  	xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s%s",
@@ -805,7 +805,7 @@ index 6f8c6f2..77888cb 100644
  	    *options.version_addendum == '\0' ? "" : " ",
  	    options.version_addendum, newline);
  
-@@ -1151,6 +1151,8 @@ server_listen(void)
+@@ -1155,6 +1155,8 @@ server_listen(void)
  	int ret, listen_sock, on = 1;
  	struct addrinfo *ai;
  	char ntop[NI_MAXHOST], strport[NI_MAXSERV];
@@ -814,7 +814,7 @@ index 6f8c6f2..77888cb 100644
  
  	for (ai = options.listen_addrs; ai; ai = ai->ai_next) {
  		if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
-@@ -1191,6 +1193,11 @@ server_listen(void)
+@@ -1195,6 +1197,11 @@ server_listen(void)
  
  		debug("Bind to port %s on %s.", strport, ntop);
  
@@ -826,7 +826,7 @@ index 6f8c6f2..77888cb 100644
  		/* Bind the socket to the desired port. */
  		if (bind(listen_sock, ai->ai_addr, ai->ai_addrlen) < 0) {
  			error("Bind to port %s on %s failed: %.200s.",
-@@ -2141,6 +2148,9 @@ main(int ac, char **av)
+@@ -2145,6 +2152,9 @@ main(int ac, char **av)
  	    remote_ip, remote_port, laddr,  get_local_port());
  	free(laddr);
  
@@ -837,7 +837,7 @@ index 6f8c6f2..77888cb 100644
  	 * We don't want to listen forever unless the other side
  	 * successfully authenticates itself.  So we set up an alarm which is
 diff --git a/sshd_config b/sshd_config
-index cf7d8e1..0263bee 100644
+index 4d77f05..3153ffc 100644
 --- a/sshd_config
 +++ b/sshd_config
 @@ -125,6 +125,17 @@ UsePrivilegeSeparation sandbox		# Default for new installations.
@@ -859,11 +859,11 @@ index cf7d8e1..0263bee 100644
  #Match User anoncvs
  #	X11Forwarding no
 diff --git a/version.h b/version.h
-index b58fbe1..32b6aec 100644
+index d917ca1..41a6023 100644
 --- a/version.h
 +++ b/version.h
 @@ -3,4 +3,5 @@
- #define SSH_VERSION	"OpenSSH_6.9"
+ #define SSH_VERSION	"OpenSSH_7.1"
  
  #define SSH_PORTABLE	"p1"
 -#define SSH_RELEASE	SSH_VERSION SSH_PORTABLE