main/openssh: upgrade to 6.8p1

rebase manually the hpn patch

4 files changed, 152 insertions, 184 deletions

diff --git a/main/openssh/APKBUILD b/main/openssh/APKBUILD
index 7e0dbc17fda..6f784f69cae 100644
--- a/main/openssh/APKBUILD
+++ b/main/openssh/APKBUILD
@@ -1,6 +1,6 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=openssh
-pkgver=6.7_p1
+pkgver=6.8_p1
 _myver=${pkgver%_*}${pkgver#*_}
 pkgrel=0
 pkgdesc="Port of OpenBSD's free SSH release"
@@ -12,9 +12,8 @@ depends="openssh-client"
 makedepends="openssl-dev zlib-dev"
 subpackages="$pkgname-doc $pkgname-client $pkgname-keysign"
 source="ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/$pkgname-$_myver.tar.gz
-	openssh6.7-dynwindows.diff
 	openssh6.5-peaktput.diff
-	openssh-fix-includes.diff
+	openssh6.8-dynwindows.diff
 	openssh-fix-utmp.diff
 	sshd.initd
 	sshd.confd
@@ -107,27 +106,24 @@ keysign() {
 		"$subpkgdir"/usr/lib/ssh/ || return 1
 }
 
-md5sums="3246aa79317b1d23cae783a3bf8275d6  openssh-6.7p1.tar.gz
-2121bdcba3751877b13f2f90802d4399  openssh6.7-dynwindows.diff
+md5sums="08f72de6751acfbd0892b5f003922701  openssh-6.8p1.tar.gz
 cd52fe99cb4b7d0d847bf5d710d93564  openssh6.5-peaktput.diff
-7c86680602f7ad71b0773d9e98a30d73  openssh-fix-includes.diff
-f7d9d6f96940ef66bd3c3a0aa27e57a7  openssh-fix-utmp.diff
+c6e29d7d88529a66d857657753f39694  openssh6.8-dynwindows.diff
+37fbfe9cfb9a5e2454382ea8c79ed2e1  openssh-fix-utmp.diff
 bcf990d4ef7ff446160cde7dbd32bf1f  sshd.initd
 b35e9f3829f4cfca07168fcba98749c7  sshd.confd
 2dd7e366607e95f9762273067309fd6e  openssh-sftp-interactive.diff"
-sha256sums="b2f8394eae858dabbdef7dac10b99aec00c95462753e80342e530bbb6f725507  openssh-6.7p1.tar.gz
-7d02930524d1357232770e9dc5a92746e654d6dafcbd5762c8618b059f0bf7b9  openssh6.7-dynwindows.diff
+sha256sums="3ff64ce73ee124480b5bf767b9830d7d3c03bbcb6abe716b78f0192c37ce160e  openssh-6.8p1.tar.gz
 bf49212e47a86d10650f739532cea514a310925e6445b4f8011031b6b55f3249  openssh6.5-peaktput.diff
-c3189ba0e17e60e83851ac2d6f18ad5b08cb90cccfce31d61cccb9fd76d44d59  openssh-fix-includes.diff
-f2748da45d0bc31055727f8c80d93e1872cc043ced3202e2f6d150aca3c08dde  openssh-fix-utmp.diff
+bf0f00bd88a7224ea0618f6e347a6a805c4e5acd869196725a3923d711ff1246  openssh6.8-dynwindows.diff
+1c85437fd94aa4fc269e6297e4eb790baa98c39949ec0410792c09ee31ba9782  openssh-fix-utmp.diff
 2a9889ab224be7202ece80a7085aa3e85bbba9432467031b436dcd77cb92a2ac  sshd.initd
 29c6d57ac3ec6018cadc6ba6cd9b90c9ed46e20049b970fdcc68ee2481a2ee41  sshd.confd
 4ce1ad5f767c0f4e854a0cfeef0e2e400f333c649e552df1ecc317e6a6557376  openssh-sftp-interactive.diff"
-sha512sums="2469dfcd289948374843311dd9e5f7e144ce1cebd4bfce0d387d0b75cb59f3e1af1b9ebf96bd4ab6407dfa77a013c5d25742971053e61cae2541054aeaca559d  openssh-6.7p1.tar.gz
-4985134b4b1b06d9c8bc81af9f0e0690c3f23d78f3df2af70cd0030cc7ab5bd8d9aad60031ce8069902c6bb8ae6dde754aa87d6fd4587cdc6e99e7bb33f0d1bb  openssh6.7-dynwindows.diff
+sha512sums="7c4457e4525a56cdabb1164ffaf6bed1c094294ae7d06dd3484dcffcd87738fcffe7019b6cae0032c254b0389832644522d5a9f2603b50637ffeb9999b5fcede  openssh-6.8p1.tar.gz
 e041398e177674f698480e23be037160bd07b751c754956a3ddf1b964da24c85e826fb75e7c23c9826d36761da73d08db9583c047d58a08dc7b2149a949075b1  openssh6.5-peaktput.diff
-70e2c6613ab77ec379e03ddf029c1c38e5d852bb225db40ceaa63e642d58b0261fa7c954b288710736bb1dc71f8057f2598ea0d1f5b1214135fa5e9541d5f05a  openssh-fix-includes.diff
-cc909f68d9da1b264926973b96d36162b5c588299c98d62f526faf2ef1273d98bb8d8dea4d482770a2aef88bcbf15fa61144401aef9ab916c15e1623bcf449b5  openssh-fix-utmp.diff
+307ca56d2bae53f2f2852a695de440843a457c4000524d1b7dbcf2f46f70ae4f8ba7309273b62287ad5eef2005e2911dd737a0f55605352397b8f557d78e18df  openssh6.8-dynwindows.diff
+f35fffcd26635249ce5d820e7b3e406e586f2d2d7f6a045f221e2f9fb53aebc1ab1dd1e603b3389462296ed77921a1d08456e7aaa3825cbed08f405b381a58e1  openssh-fix-utmp.diff
 eeafefcb8a3357b498591480b39dc0116ab3440c88faeaeaddeac0b860f9e268abe6f603bc27893b79945acde06a45a7616d1bdc6ca27201cd8dc522f49b207e  sshd.initd
 b9ae816af54a55e134a9307e376f05367b815f1b3fd545c2a2c312d18aedcf907f413e8bad8db980cdd9aad4011a72a79e1e94594f69500939a9cb46287f2f81  sshd.confd
 c1d09c65dbc347f0904edc30f91aa9a24b0baee50309536182455b544f1e3f85a8cecfa959e32be8b101d8282ef06dde3febbbc3f315489339dcf04155c859a9  openssh-sftp-interactive.diff"
diff --git a/main/openssh/openssh-fix-includes.diff b/main/openssh/openssh-fix-includes.diff
deleted file mode 100644
index 33c0f8a2fee..00000000000
--- a/main/openssh/openssh-fix-includes.diff
+++ /dev/null
@@ -1,12 +0,0 @@
---- openssh-6.2p2/includes.h.orig
-+++ openssh-6.2p2/includes.h
-@@ -21,6 +21,8 @@
- #define _GNU_SOURCE /* activate extra prototypes for glibc */
- 
- #include <sys/types.h>
-+#include <sys/param.h>
-+#include <sys/time.h>
- #include <sys/socket.h> /* For CMSG_* */
- 
- #ifdef HAVE_LIMITS_H
-
diff --git a/main/openssh/openssh-fix-utmp.diff b/main/openssh/openssh-fix-utmp.diff
index 6bfe49df65d..275e80590dd 100644
--- a/main/openssh/openssh-fix-utmp.diff
+++ b/main/openssh/openssh-fix-utmp.diff
@@ -1,21 +1,11 @@
---- openssh-6.2p2/loginrec.c.orig
-+++ openssh-6.2p2/loginrec.c
-@@ -784,12 +784,12 @@
+--- openssh-6.8p1.orig/loginrec.c	2015-03-17 07:49:20.000000000 -0200
++++ openssh-6.8p1/loginrec.c	2015-03-19 10:45:45.780276841 -0200
+@@ -783,7 +783,7 @@
+ 	if (li->hostaddr.sa.sa_family == AF_INET)
+ 		utx->ut_addr = li->hostaddr.sa_in.sin_addr.s_addr;
+ # endif
+-# ifdef HAVE_ADDR_V6_IN_UTMP
++# ifdef HAVE_ADDR_V6_IN_UTMPX
  	/* this is just a 128-bit IPv6 address */
  	if (li->hostaddr.sa.sa_family == AF_INET6) {
  		sa6 = ((struct sockaddr_in6 *)&li->hostaddr.sa);
--		memcpy(ut->ut_addr_v6, sa6->sin6_addr.s6_addr, 16);
-+		memcpy(utx->ut_addr_v6, sa6->sin6_addr.s6_addr, 16);
- 		if (IN6_IS_ADDR_V4MAPPED(&sa6->sin6_addr)) {
--			ut->ut_addr_v6[0] = ut->ut_addr_v6[3];
--			ut->ut_addr_v6[1] = 0;
--			ut->ut_addr_v6[2] = 0;
--			ut->ut_addr_v6[3] = 0;
-+			utx->ut_addr_v6[0] = utx->ut_addr_v6[3];
-+			utx->ut_addr_v6[1] = 0;
-+			utx->ut_addr_v6[2] = 0;
-+			utx->ut_addr_v6[3] = 0;
- 		}
- 	}
- # endif
-
diff --git a/main/openssh/openssh6.7-dynwindows.diff b/main/openssh/openssh6.8-dynwindows.diff
index b49e7688b0b..161173dbb38 100644
--- a/main/openssh/openssh6.7-dynwindows.diff
+++ b/main/openssh/openssh6.8-dynwindows.diff
@@ -1,6 +1,6 @@
-diff -ru openssh-6.7p1.orig/buffer.h openssh-6.7p1/buffer.h
---- openssh-6.7p1.orig/buffer.h	2014-05-15 07:33:44.000000000 -0300
-+++ openssh-6.7p1/buffer.h	2014-11-21 09:42:27.601954473 -0200
+diff -ruNp openssh-6.8p1.orig/buffer.h openssh-6.8p1/buffer.h
+--- openssh-6.8p1.orig/buffer.h	2015-03-17 07:49:20.000000000 -0200
++++ openssh-6.8p1/buffer.h	2015-03-19 10:13:33.493591054 -0200
 @@ -16,6 +16,9 @@
   * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
   */
@@ -11,10 +11,10 @@ diff -ru openssh-6.7p1.orig/buffer.h openssh-6.7p1/buffer.h
  /* Emulation wrappers for legacy OpenSSH buffer API atop sshbuf */
  
  #ifndef BUFFER_H
-diff -ru openssh-6.7p1.orig/channels.c openssh-6.7p1/channels.c
---- openssh-6.7p1.orig/channels.c	2014-07-18 07:11:25.000000000 -0300
-+++ openssh-6.7p1/channels.c	2014-11-21 09:42:27.601954473 -0200
-@@ -179,8 +179,14 @@
+diff -ruNp openssh-6.8p1.orig/channels.c openssh-6.8p1/channels.c
+--- openssh-6.8p1.orig/channels.c	2015-03-17 07:49:20.000000000 -0200
++++ openssh-6.8p1/channels.c	2015-03-19 10:13:33.496924388 -0200
+@@ -183,8 +183,14 @@ static void port_open_helper(Channel *c,
  static int connect_next(struct channel_connect *);
  static void channel_connect_ctx_free(struct channel_connect *);
  
@@ -29,7 +29,7 @@ diff -ru openssh-6.7p1.orig/channels.c openssh-6.7p1/channels.c
  Channel *
  channel_by_id(int id)
  {
-@@ -329,6 +335,7 @@
+@@ -333,6 +339,7 @@ channel_new(char *ctype, int type, int r
  	c->local_window_max = window;
  	c->local_consumed = 0;
  	c->local_maxpacket = maxpack;
@@ -37,7 +37,7 @@ diff -ru openssh-6.7p1.orig/channels.c openssh-6.7p1/channels.c
  	c->remote_id = -1;
  	c->remote_name = xstrdup(remote_name);
  	c->remote_window = 0;
-@@ -833,11 +840,35 @@
+@@ -837,11 +844,35 @@ channel_pre_open_13(Channel *c, fd_set *
  		FD_SET(c->sock, writeset);
  }
  
@@ -73,7 +73,7 @@ diff -ru openssh-6.7p1.orig/channels.c openssh-6.7p1/channels.c
  	if (c->istate == CHAN_INPUT_OPEN &&
  	    limit > 0 &&
  	    buffer_len(&c->input) < limit &&
-@@ -1842,14 +1873,21 @@
+@@ -1846,14 +1877,21 @@ channel_check_window(Channel *c)
  	    c->local_maxpacket*3) ||
  	    c->local_window < c->local_window_max/2) &&
  	    c->local_consumed > 0) {
@@ -97,7 +97,7 @@ diff -ru openssh-6.7p1.orig/channels.c openssh-6.7p1/channels.c
  		c->local_consumed = 0;
  	}
  	return 1;
-@@ -2781,6 +2819,15 @@
+@@ -2794,6 +2832,15 @@ channel_fwd_bind_addr(const char *listen
  	return addr;
  }
  
@@ -113,7 +113,7 @@ diff -ru openssh-6.7p1.orig/channels.c openssh-6.7p1/channels.c
  static int
  channel_setup_fwd_listener_tcpip(int type, struct Forward *fwd,
      int *allocated_listen_port, struct ForwardOptions *fwd_opts)
-@@ -2905,9 +2952,15 @@
+@@ -2918,9 +2965,15 @@ channel_setup_fwd_listener_tcpip(int typ
  		}
  
  		/* Allocate a channel number for the socket. */
@@ -129,7 +129,7 @@ diff -ru openssh-6.7p1.orig/channels.c openssh-6.7p1/channels.c
  		c->path = xstrdup(host);
  		c->host_port = fwd->connect_port;
  		c->listening_addr = addr == NULL ? NULL : xstrdup(addr);
-@@ -3939,10 +3992,17 @@
+@@ -3952,10 +4005,17 @@ x11_create_display_inet(int x11_display_
  	*chanids = xcalloc(num_socks + 1, sizeof(**chanids));
  	for (n = 0; n < num_socks; n++) {
  		sock = socks[n];
@@ -147,10 +147,10 @@ diff -ru openssh-6.7p1.orig/channels.c openssh-6.7p1/channels.c
  		nc->single_connection = single_connection;
  		(*chanids)[n] = nc->self;
  	}
-diff -ru openssh-6.7p1.orig/channels.h openssh-6.7p1/channels.h
---- openssh-6.7p1.orig/channels.h	2014-07-18 07:11:26.000000000 -0300
-+++ openssh-6.7p1/channels.h	2014-11-21 09:42:27.601954473 -0200
-@@ -134,8 +134,10 @@
+diff -ruNp openssh-6.8p1.orig/channels.h openssh-6.8p1/channels.h
+--- openssh-6.8p1.orig/channels.h	2015-03-17 07:49:20.000000000 -0200
++++ openssh-6.8p1/channels.h	2015-03-19 10:13:33.496924388 -0200
+@@ -134,8 +134,10 @@ struct Channel {
  	u_int	local_window_max;
  	u_int	local_consumed;
  	u_int	local_maxpacket;
@@ -161,7 +161,7 @@ diff -ru openssh-6.7p1.orig/channels.h openssh-6.7p1/channels.h
  
  	char   *ctype;		/* type */
  
-@@ -171,8 +173,10 @@
+@@ -171,8 +173,10 @@ struct Channel {
  /* default window/packet sizes for tcp/x11-fwd-channel */
  #define CHAN_SES_PACKET_DEFAULT	(32*1024)
  #define CHAN_SES_WINDOW_DEFAULT	(64*CHAN_SES_PACKET_DEFAULT)
@@ -172,7 +172,7 @@ diff -ru openssh-6.7p1.orig/channels.h openssh-6.7p1/channels.h
  #define CHAN_X11_PACKET_DEFAULT	(16*1024)
  #define CHAN_X11_WINDOW_DEFAULT	(4*CHAN_X11_PACKET_DEFAULT)
  
-@@ -311,4 +315,7 @@
+@@ -311,4 +315,7 @@ void	 chan_rcvd_ieof(Channel *);
  void	 chan_write_failed(Channel *);
  void	 chan_obuf_empty(Channel *);
  
@@ -180,10 +180,10 @@ diff -ru openssh-6.7p1.orig/channels.h openssh-6.7p1/channels.h
 +void     channel_set_hpn(int, int);
 +
  #endif
-diff -ru openssh-6.7p1.orig/clientloop.c openssh-6.7p1/clientloop.c
---- openssh-6.7p1.orig/clientloop.c	2014-07-18 07:11:26.000000000 -0300
-+++ openssh-6.7p1/clientloop.c	2014-11-21 09:42:27.601954473 -0200
-@@ -1899,9 +1899,15 @@
+diff -ruNp openssh-6.8p1.orig/clientloop.c openssh-6.8p1/clientloop.c
+--- openssh-6.8p1.orig/clientloop.c	2015-03-17 07:49:20.000000000 -0200
++++ openssh-6.8p1/clientloop.c	2015-03-19 10:16:54.303593060 -0200
+@@ -1909,9 +1909,15 @@ client_request_x11(const char *request_t
  	sock = x11_connect_display();
  	if (sock < 0)
  		return NULL;
@@ -199,24 +199,25 @@ diff -ru openssh-6.7p1.orig/clientloop.c openssh-6.7p1/clientloop.c
  	c->force_drain = 1;
  	return c;
  }
-@@ -1921,9 +1927,15 @@
- 	sock = ssh_get_authentication_socket();
- 	if (sock < 0)
+@@ -1934,10 +1940,16 @@ client_request_agent(const char *request
+ 			    __func__, ssh_err(r));
  		return NULL;
+ 	}
 +	if (options.hpn_disabled)
  	c = channel_new("authentication agent connection",
  	    SSH_CHANNEL_OPEN, sock, sock, -1,
 -	    CHAN_X11_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0,
-+		    CHAN_X11_WINDOW_DEFAULT, CHAN_TCP_WINDOW_DEFAULT, 0,
-+		    "authentication agent connection", 1);
++	    CHAN_X11_WINDOW_DEFAULT, CHAN_TCP_WINDOW_DEFAULT, 0,
+ 	    "authentication agent connection", 1);
 +	else
 +	c = channel_new("authentication agent connection",
 +	    SSH_CHANNEL_OPEN, sock, sock, -1,
 +	    options.hpn_buffer_size, options.hpn_buffer_size, 0,
- 	    "authentication agent connection", 1);
++ 	    "authentication agent connection", 1);
  	c->force_drain = 1;
  	return c;
-@@ -1951,10 +1963,18 @@
+ }
+@@ -1964,10 +1976,18 @@ client_request_tun_fwd(int tun_mode, int
  		return -1;
  	}
  
@@ -236,28 +237,25 @@ diff -ru openssh-6.7p1.orig/clientloop.c openssh-6.7p1/clientloop.c
  #if defined(SSH_TUN_FILTER)
  	if (options.tun_open == SSH_TUNMODE_POINTOPOINT)
  		channel_register_filter(c->self, sys_tun_infilter,
-diff -ru openssh-6.7p1.orig/compat.c openssh-6.7p1/compat.c
---- openssh-6.7p1.orig/compat.c	2014-04-20 06:33:59.000000000 -0300
-+++ openssh-6.7p1/compat.c	2014-11-21 09:42:27.601954473 -0200
-@@ -175,6 +175,15 @@
- 		if (match_pattern_list(version, check[i].pat,
- 		    strlen(check[i].pat), 0) == 1) {
- 			datafellows = check[i].bugs;
+diff -ruNp openssh-6.8p1.orig/compat.c openssh-6.8p1/compat.c
+--- openssh-6.8p1.orig/compat.c	2015-03-17 07:49:20.000000000 -0200
++++ openssh-6.8p1/compat.c	2015-03-19 10:25:00.433597851 -0200
+@@ -177,6 +177,12 @@ compat_datafellows(const char *version)
+ 			debug("match: %s pat %s compat 0x%08x",
+ 			    version, check[i].pat, check[i].bugs);
+ 			datafellows = check[i].bugs;	/* XXX for now */
 +			/* Check to see if the remote side is OpenSSH and not HPN */
-+			if(strstr(version,"OpenSSH") != NULL)
-+			{
-+				if (strstr(version,"hpn") == NULL)
-+				{
-+					datafellows |= SSH_BUG_LARGEWINDOW;
-+					debug("Remote is NON-HPN aware");
-+				}
++			if (strstr(version,"OpenSSH") != NULL &&
++			    strstr(version,"hpn") == NULL) {
++				datafellows |= SSH_BUG_LARGEWINDOW;
++				debug("Remote is NON-HPN aware");
 +			}
- 			debug("match: %s pat %s compat 0x%08x",
- 			    version, check[i].pat, datafellows);
- 			return;
-diff -ru openssh-6.7p1.orig/compat.h openssh-6.7p1/compat.h
---- openssh-6.7p1.orig/compat.h	2014-04-20 06:25:31.000000000 -0300
-+++ openssh-6.7p1/compat.h	2014-11-21 09:47:51.058623939 -0200
+ 			return check[i].bugs;
+ 		}
+ 	}
+diff -ruNp openssh-6.8p1.orig/compat.h openssh-6.8p1/compat.h
+--- openssh-6.8p1.orig/compat.h	2015-03-17 07:49:20.000000000 -0200
++++ openssh-6.8p1/compat.h	2015-03-19 10:13:33.496924388 -0200
 @@ -60,6 +60,7 @@
  #define SSH_NEW_OPENSSH		0x04000000
  #define SSH_BUG_DYNAMIC_RPORT	0x08000000
@@ -266,19 +264,19 @@ diff -ru openssh-6.7p1.orig/compat.h openssh-6.7p1/compat.h
  
  void     enable_compat13(void);
  void     enable_compat20(void);
-diff -ru openssh-6.7p1.orig/readconf.c openssh-6.7p1/readconf.c
---- openssh-6.7p1.orig/readconf.c	2014-07-18 07:11:26.000000000 -0300
-+++ openssh-6.7p1/readconf.c	2014-11-21 09:49:31.348624811 -0200
-@@ -151,6 +151,7 @@
- 	oCanonicalDomains, oCanonicalizeHostname, oCanonicalizeMaxDots,
+diff -ruNp openssh-6.8p1.orig/readconf.c openssh-6.8p1/readconf.c
+--- openssh-6.8p1.orig/readconf.c	2015-03-17 07:49:20.000000000 -0200
++++ openssh-6.8p1/readconf.c	2015-03-19 10:26:16.100265293 -0200
+@@ -157,6 +157,7 @@ typedef enum {
  	oCanonicalizeFallbackLocal, oCanonicalizePermittedCNAMEs,
- 	oStreamLocalBindMask, oStreamLocalBindUnlink,
+ 	oStreamLocalBindMask, oStreamLocalBindUnlink, oRevokedHostKeys,
+ 	oFingerprintHash, oUpdateHostkeys, oHostbasedKeyTypes,
 +	oTcpRcvBufPoll, oTcpRcvBuf, oHPNDisabled, oHPNBufferSize,
  	oIgnoredUnknownOption, oDeprecated, oUnsupported
  } OpCodes;
  
-@@ -267,6 +268,11 @@
- 	{ "streamlocalbindunlink", oStreamLocalBindUnlink },
+@@ -277,6 +278,11 @@ static struct {
+ 	{ "hostbasedkeytypes", oHostbasedKeyTypes },
  	{ "ignoreunknown", oIgnoreUnknown },
  
 +	{ "tcprcvbufpoll", oTcpRcvBufPoll },
@@ -289,7 +287,7 @@ diff -ru openssh-6.7p1.orig/readconf.c openssh-6.7p1/readconf.c
  	{ NULL, oBadOption }
  };
  
-@@ -877,6 +883,18 @@
+@@ -904,6 +910,18 @@ parse_time:
  		intptr = &options->check_host_ip;
  		goto parse_flag;
  
@@ -308,7 +306,7 @@ diff -ru openssh-6.7p1.orig/readconf.c openssh-6.7p1/readconf.c
  	case oVerifyHostKeyDNS:
  		intptr = &options->verify_host_key_dns;
  		multistate_ptr = multistate_yesnoask;
-@@ -1039,6 +1057,10 @@
+@@ -1067,6 +1085,10 @@ parse_int:
  		intptr = &options->connection_attempts;
  		goto parse_int;
  
@@ -319,7 +317,7 @@ diff -ru openssh-6.7p1.orig/readconf.c openssh-6.7p1/readconf.c
  	case oCipher:
  		intptr = &options->cipher;
  		arg = strdelim(&s);
-@@ -1602,6 +1624,10 @@
+@@ -1665,6 +1687,10 @@ initialize_options(Options * options)
  	options->ip_qos_interactive = -1;
  	options->ip_qos_bulk = -1;
  	options->request_tty = -1;
@@ -330,7 +328,7 @@ diff -ru openssh-6.7p1.orig/readconf.c openssh-6.7p1/readconf.c
  	options->proxy_use_fdpass = -1;
  	options->ignored_unknown = NULL;
  	options->num_canonical_domains = 0;
-@@ -1752,6 +1778,28 @@
+@@ -1819,6 +1845,28 @@ fill_default_options(Options * options)
  		options->server_alive_interval = 0;
  	if (options->server_alive_count_max == -1)
  		options->server_alive_count_max = 3;
@@ -359,10 +357,10 @@ diff -ru openssh-6.7p1.orig/readconf.c openssh-6.7p1/readconf.c
  	if (options->control_master == -1)
  		options->control_master = 0;
  	if (options->control_persist == -1) {
-diff -ru openssh-6.7p1.orig/readconf.h openssh-6.7p1/readconf.h
---- openssh-6.7p1.orig/readconf.h	2014-07-18 07:11:26.000000000 -0300
-+++ openssh-6.7p1/readconf.h	2014-11-21 09:42:27.605287806 -0200
-@@ -57,6 +57,10 @@
+diff -ruNp openssh-6.8p1.orig/readconf.h openssh-6.8p1/readconf.h
+--- openssh-6.8p1.orig/readconf.h	2015-03-17 07:49:20.000000000 -0200
++++ openssh-6.8p1/readconf.h	2015-03-19 10:13:33.496924388 -0200
+@@ -57,6 +57,10 @@ typedef struct {
  	int     compression_level;	/* Compression level 1 (fast) to 9
  					 * (best). */
  	int     tcp_keep_alive;	/* Set SO_KEEPALIVE. */
@@ -373,19 +371,19 @@ diff -ru openssh-6.7p1.orig/readconf.h openssh-6.7p1/readconf.h
  	int	ip_qos_interactive;	/* IP ToS/DSCP/class for interactive */
  	int	ip_qos_bulk;		/* IP ToS/DSCP/class for bulk traffic */
  	LogLevel log_level;	/* Level for logging. */
-diff -ru openssh-6.7p1.orig/scp.c openssh-6.7p1/scp.c
---- openssh-6.7p1.orig/scp.c	2014-07-02 08:29:01.000000000 -0300
-+++ openssh-6.7p1/scp.c	2014-11-21 09:42:27.605287806 -0200
-@@ -749,7 +749,7 @@
+diff -ruNp openssh-6.8p1.orig/scp.c openssh-6.8p1/scp.c
+--- openssh-6.8p1.orig/scp.c	2015-03-17 07:49:20.000000000 -0200
++++ openssh-6.8p1/scp.c	2015-03-19 10:14:40.790258386 -0200
+@@ -750,7 +750,7 @@ source(int argc, char **argv)
  	off_t i, statbytes;
  	size_t amt, nr;
  	int fd = -1, haderr, indx;
--	char *last, *name, buf[2048], encname[MAXPATHLEN];
-+	char *last, *name, buf[16384], encname[MAXPATHLEN];
+-	char *last, *name, buf[2048], encname[PATH_MAX];
++	char *last, *name, buf[16384], encname[PATH_MAX];
  	int len;
  
  	for (indx = 0; indx < argc; ++indx) {
-@@ -918,7 +918,7 @@
+@@ -919,7 +919,7 @@ sink(int argc, char **argv)
  	off_t size, statbytes;
  	unsigned long long ull;
  	int setimes, targisdir, wrerrno = 0;
@@ -394,10 +392,10 @@ diff -ru openssh-6.7p1.orig/scp.c openssh-6.7p1/scp.c
  	struct timeval tv[2];
  
  #define	atime	tv[0]
-diff -ru openssh-6.7p1.orig/servconf.c openssh-6.7p1/servconf.c
---- openssh-6.7p1.orig/servconf.c	2014-07-18 07:11:26.000000000 -0300
-+++ openssh-6.7p1/servconf.c	2014-11-21 09:42:27.605287806 -0200
-@@ -154,6 +154,9 @@
+diff -ruNp openssh-6.8p1.orig/servconf.c openssh-6.8p1/servconf.c
+--- openssh-6.8p1.orig/servconf.c	2015-03-17 07:49:20.000000000 -0200
++++ openssh-6.8p1/servconf.c	2015-03-19 10:27:19.056932557 -0200
+@@ -159,6 +159,9 @@ initialize_server_options(ServerOptions
  	options->revoked_keys_file = NULL;
  	options->trusted_user_ca_keys = NULL;
  	options->authorized_principals_file = NULL;
@@ -407,19 +405,15 @@ diff -ru openssh-6.7p1.orig/servconf.c openssh-6.7p1/servconf.c
  	options->ip_qos_interactive = -1;
  	options->ip_qos_bulk = -1;
  	options->version_addendum = NULL;
-@@ -162,6 +165,11 @@
+@@ -175,6 +178,7 @@ option_clear_or_none(const char *o)
  void
  fill_default_server_options(ServerOptions *options)
  {
-+	/* needed for hpn socket tests */
-+	int sock;
-+	int socksize;
-+	int socksizelen = sizeof(int);
-+
++	int sock, socksize, socksizelen = sizeof(int);
+ 	int i;
+ 
  	/* Portable-specific options */
- 	if (options->use_pam == -1)
- 		options->use_pam = 0;
-@@ -302,6 +310,41 @@
+@@ -321,6 +325,41 @@ fill_default_server_options(ServerOption
  	}
  	if (options->permit_tun == -1)
  		options->permit_tun = SSH_TUNMODE_NO;
@@ -461,7 +455,7 @@ diff -ru openssh-6.7p1.orig/servconf.c openssh-6.7p1/servconf.c
  	if (options->ip_qos_interactive == -1)
  		options->ip_qos_interactive = IPTOS_LOWDELAY;
  	if (options->ip_qos_bulk == -1)
-@@ -357,6 +400,7 @@
+@@ -396,6 +435,7 @@ typedef enum {
  	sUsePrivilegeSeparation, sAllowAgentForwarding,
  	sHostCertificate,
  	sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile,
@@ -469,7 +463,7 @@ diff -ru openssh-6.7p1.orig/servconf.c openssh-6.7p1/servconf.c
  	sKexAlgorithms, sIPQoS, sVersionAddendum,
  	sAuthorizedKeysCommand, sAuthorizedKeysCommandUser,
  	sAuthenticationMethods, sHostKeyAgent, sPermitUserRC,
-@@ -483,6 +527,9 @@
+@@ -524,6 +564,9 @@ static struct {
  	{ "revokedkeys", sRevokedKeys, SSHCFG_ALL },
  	{ "trustedusercakeys", sTrustedUserCAKeys, SSHCFG_ALL },
  	{ "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL },
@@ -479,7 +473,7 @@ diff -ru openssh-6.7p1.orig/servconf.c openssh-6.7p1/servconf.c
  	{ "kexalgorithms", sKexAlgorithms, SSHCFG_GLOBAL },
  	{ "ipqos", sIPQoS, SSHCFG_ALL },
  	{ "authorizedkeyscommand", sAuthorizedKeysCommand, SSHCFG_ALL },
-@@ -518,6 +565,7 @@
+@@ -560,6 +603,7 @@ parse_token(const char *cp, const char *
  
  	for (i = 0; keywords[i].name; i++)
  		if (strcasecmp(cp, keywords[i].name) == 0) {
@@ -487,7 +481,7 @@ diff -ru openssh-6.7p1.orig/servconf.c openssh-6.7p1/servconf.c
  			*flags = keywords[i].flags;
  			return keywords[i].opcode;
  		}
-@@ -1060,6 +1108,19 @@
+@@ -1104,6 +1148,19 @@ process_server_config_line(ServerOptions
  			*intptr = value;
  		break;
  
@@ -507,10 +501,10 @@ diff -ru openssh-6.7p1.orig/servconf.c openssh-6.7p1/servconf.c
  	case sIgnoreUserKnownHosts:
  		intptr = &options->ignore_user_known_hosts;
  		goto parse_flag;
-diff -ru openssh-6.7p1.orig/servconf.h openssh-6.7p1/servconf.h
---- openssh-6.7p1.orig/servconf.h	2014-07-18 07:11:26.000000000 -0300
-+++ openssh-6.7p1/servconf.h	2014-11-21 09:42:27.605287806 -0200
-@@ -166,6 +166,9 @@
+diff -ruNp openssh-6.8p1.orig/servconf.h openssh-6.8p1/servconf.h
+--- openssh-6.8p1.orig/servconf.h	2015-03-17 07:49:20.000000000 -0200
++++ openssh-6.8p1/servconf.h	2015-03-19 10:13:33.500257721 -0200
+@@ -168,6 +168,9 @@ typedef struct {
  	char   *adm_forced_command;
  
  	int	use_pam;		/* Enable auth via PAM */
@@ -520,10 +514,10 @@ diff -ru openssh-6.7p1.orig/servconf.h openssh-6.7p1/servconf.h
  
  	int	permit_tun;
  
-diff -ru openssh-6.7p1.orig/serverloop.c openssh-6.7p1/serverloop.c
---- openssh-6.7p1.orig/serverloop.c	2014-08-19 04:14:17.000000000 -0300
-+++ openssh-6.7p1/serverloop.c	2014-11-21 09:42:27.605287806 -0200
-@@ -1047,8 +1047,12 @@
+diff -ruNp openssh-6.8p1.orig/serverloop.c openssh-6.8p1/serverloop.c
+--- openssh-6.8p1.orig/serverloop.c	2015-03-17 07:49:20.000000000 -0200
++++ openssh-6.8p1/serverloop.c	2015-03-19 10:13:33.500257721 -0200
+@@ -1051,8 +1051,12 @@ server_request_tun(void)
  	sock = tun_open(tun, mode);
  	if (sock < 0)
  		goto done;
@@ -536,7 +530,7 @@ diff -ru openssh-6.7p1.orig/serverloop.c openssh-6.7p1/serverloop.c
  	c->datagram = 1;
  #if defined(SSH_TUN_FILTER)
  	if (mode == SSH_TUNMODE_POINTOPOINT)
-@@ -1084,6 +1088,8 @@
+@@ -1088,6 +1092,8 @@ server_request_session(void)
  	c = channel_new("session", SSH_CHANNEL_LARVAL,
  	    -1, -1, -1, /*window size*/0, CHAN_SES_PACKET_DEFAULT,
  	    0, "server-session", 1);
@@ -545,10 +539,10 @@ diff -ru openssh-6.7p1.orig/serverloop.c openssh-6.7p1/serverloop.c
  	if (session_open(the_authctxt, c->self) != 1) {
  		debug("session open failed, free channel %d", c->self);
  		channel_free(c);
-diff -ru openssh-6.7p1.orig/session.c openssh-6.7p1/session.c
---- openssh-6.7p1.orig/session.c	2014-07-18 07:11:26.000000000 -0300
-+++ openssh-6.7p1/session.c	2014-11-21 09:42:27.605287806 -0200
-@@ -219,6 +219,7 @@
+diff -ruNp openssh-6.8p1.orig/session.c openssh-6.8p1/session.c
+--- openssh-6.8p1.orig/session.c	2015-03-17 07:49:20.000000000 -0200
++++ openssh-6.8p1/session.c	2015-03-19 10:13:33.500257721 -0200
+@@ -220,6 +220,7 @@ auth_input_request_forwarding(struct pas
  		goto authsock_err;
  
  	/* Allocate a channel for the authentication agent socket. */
@@ -556,7 +550,7 @@ diff -ru openssh-6.7p1.orig/session.c openssh-6.7p1/session.c
  	nc = channel_new("auth socket",
  	    SSH_CHANNEL_AUTH_SOCKET, sock, sock, -1,
  	    CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
-@@ -2328,10 +2329,16 @@
+@@ -2329,10 +2330,16 @@ session_set_fds(Session *s, int fdin, in
  	 */
  	if (s->chanid == -1)
  		fatal("no channel for session %d", s->self);
@@ -573,10 +567,10 @@ diff -ru openssh-6.7p1.orig/session.c openssh-6.7p1/session.c
  }
  
  /*
-diff -ru openssh-6.7p1.orig/sftp.1 openssh-6.7p1/sftp.1
---- openssh-6.7p1.orig/sftp.1	2014-05-15 06:47:37.000000000 -0300
-+++ openssh-6.7p1/sftp.1	2014-11-21 09:42:27.605287806 -0200
-@@ -261,7 +261,8 @@
+diff -ruNp openssh-6.8p1.orig/sftp.1 openssh-6.8p1/sftp.1
+--- openssh-6.8p1.orig/sftp.1	2015-03-17 07:49:20.000000000 -0200
++++ openssh-6.8p1/sftp.1	2015-03-19 10:13:33.500257721 -0200
+@@ -263,7 +263,8 @@ diagnostic messages from
  Specify how many requests may be outstanding at any one time.
  Increasing this may slightly improve file transfer speed
  but will increase memory usage.
@@ -586,10 +580,10 @@ diff -ru openssh-6.7p1.orig/sftp.1 openssh-6.7p1/sftp.1
  .It Fl r
  Recursively copy entire directories when uploading and downloading.
  Note that
-diff -ru openssh-6.7p1.orig/sftp.c openssh-6.7p1/sftp.c
---- openssh-6.7p1.orig/sftp.c	2014-07-09 06:07:06.000000000 -0300
-+++ openssh-6.7p1/sftp.c	2014-11-21 09:42:27.605287806 -0200
-@@ -68,7 +68,7 @@
+diff -ruNp openssh-6.8p1.orig/sftp.c openssh-6.8p1/sftp.c
+--- openssh-6.8p1.orig/sftp.c	2015-03-19 09:58:59.000000000 -0200
++++ openssh-6.8p1/sftp.c	2015-03-19 10:13:33.500257721 -0200
+@@ -71,7 +71,7 @@ typedef void EditLine;
  #include "sftp-client.h"
  
  #define DEFAULT_COPY_BUFLEN	32768	/* Size of buffer for up/download */
@@ -598,10 +592,10 @@ diff -ru openssh-6.7p1.orig/sftp.c openssh-6.7p1/sftp.c
  
  /* File to read commands from */
  FILE* infile;
-diff -ru openssh-6.7p1.orig/ssh.c openssh-6.7p1/ssh.c
---- openssh-6.7p1.orig/ssh.c	2014-07-18 08:04:11.000000000 -0300
-+++ openssh-6.7p1/ssh.c	2014-11-21 09:42:27.608621140 -0200
-@@ -1682,6 +1682,9 @@
+diff -ruNp openssh-6.8p1.orig/ssh.c openssh-6.8p1/ssh.c
+--- openssh-6.8p1.orig/ssh.c	2015-03-17 07:49:20.000000000 -0200
++++ openssh-6.8p1/ssh.c	2015-03-19 10:13:33.503591053 -0200
+@@ -1811,6 +1811,9 @@ ssh_session2_open(void)
  {
  	Channel *c;
  	int window, packetmax, in, out, err;
@@ -611,7 +605,7 @@ diff -ru openssh-6.7p1.orig/ssh.c openssh-6.7p1/ssh.c
  
  	if (stdin_null_flag) {
  		in = open(_PATH_DEVNULL, O_RDONLY);
-@@ -1702,9 +1705,74 @@
+@@ -1831,9 +1834,74 @@ ssh_session2_open(void)
  	if (!isatty(err))
  		set_nonblock(err);
  
@@ -687,7 +681,7 @@ diff -ru openssh-6.7p1.orig/ssh.c openssh-6.7p1/ssh.c
  		window >>= 1;
  		packetmax >>= 1;
  	}
-@@ -1713,6 +1781,10 @@
+@@ -1842,6 +1910,10 @@ ssh_session2_open(void)
  	    window, packetmax, CHAN_EXTENDED_WRITE,
  	    "client-session", /*nonblock*/0);
  
@@ -698,10 +692,10 @@ diff -ru openssh-6.7p1.orig/ssh.c openssh-6.7p1/ssh.c
  	debug3("ssh_session2_open: channel_new: %d", c->self);
  
  	channel_send_open(c->self);
-diff -ru openssh-6.7p1.orig/sshconnect.c openssh-6.7p1/sshconnect.c
---- openssh-6.7p1.orig/sshconnect.c	2014-07-18 07:11:26.000000000 -0300
-+++ openssh-6.7p1/sshconnect.c	2014-11-21 09:42:27.608621140 -0200
-@@ -264,6 +264,31 @@
+diff -ruNp openssh-6.8p1.orig/sshconnect.c openssh-6.8p1/sshconnect.c
+--- openssh-6.8p1.orig/sshconnect.c	2015-03-17 07:49:20.000000000 -0200
++++ openssh-6.8p1/sshconnect.c	2015-03-19 10:13:33.503591053 -0200
+@@ -267,6 +267,31 @@ ssh_kill_proxy_command(void)
  }
  
  /*
@@ -733,7 +727,7 @@ diff -ru openssh-6.7p1.orig/sshconnect.c openssh-6.7p1/sshconnect.c
   * Creates a (possibly privileged) socket for use as the ssh connection.
   */
  static int
-@@ -279,6 +304,9 @@
+@@ -282,6 +307,9 @@ ssh_create_socket(int privileged, struct
  	}
  	fcntl(sock, F_SETFD, FD_CLOEXEC);
  
@@ -743,7 +737,7 @@ diff -ru openssh-6.7p1.orig/sshconnect.c openssh-6.7p1/sshconnect.c
  	/* Bind the socket to an alternative local IP address */
  	if (options.bind_address == NULL && !privileged)
  		return sock;
-@@ -521,10 +549,10 @@
+@@ -524,10 +552,10 @@ send_client_banner(int connection_out, i
  	/* Send our own protocol version identification. */
  	if (compat20) {
  		xasprintf(&client_version_string, "SSH-%d.%d-%.100s\r\n",
@@ -756,10 +750,10 @@ diff -ru openssh-6.7p1.orig/sshconnect.c openssh-6.7p1/sshconnect.c
  	}
  	if (roaming_atomicio(vwrite, connection_out, client_version_string,
  	    strlen(client_version_string)) != strlen(client_version_string))
-diff -ru openssh-6.7p1.orig/sshd.c openssh-6.7p1/sshd.c
---- openssh-6.7p1.orig/sshd.c	2014-08-26 21:11:55.000000000 -0300
-+++ openssh-6.7p1/sshd.c	2014-11-21 09:42:27.608621140 -0200
-@@ -432,7 +432,7 @@
+diff -ruNp openssh-6.8p1.orig/sshd.c openssh-6.8p1/sshd.c
+--- openssh-6.8p1.orig/sshd.c	2015-03-17 07:49:20.000000000 -0200
++++ openssh-6.8p1/sshd.c	2015-03-19 10:13:33.503591053 -0200
+@@ -431,7 +431,7 @@ sshd_exchange_identification(int sock_in
  	}
  
  	xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s%s",
@@ -768,7 +762,7 @@ diff -ru openssh-6.7p1.orig/sshd.c openssh-6.7p1/sshd.c
  	    *options.version_addendum == '\0' ? "" : " ",
  	    options.version_addendum, newline);
  
-@@ -1092,6 +1092,8 @@
+@@ -1149,6 +1149,8 @@ server_listen(void)
  	int ret, listen_sock, on = 1;
  	struct addrinfo *ai;
  	char ntop[NI_MAXHOST], strport[NI_MAXSERV];
@@ -777,7 +771,7 @@ diff -ru openssh-6.7p1.orig/sshd.c openssh-6.7p1/sshd.c
  
  	for (ai = options.listen_addrs; ai; ai = ai->ai_next) {
  		if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
-@@ -1132,6 +1134,11 @@
+@@ -1189,6 +1191,11 @@ server_listen(void)
  
  		debug("Bind to port %s on %s.", strport, ntop);
  
@@ -789,7 +783,7 @@ diff -ru openssh-6.7p1.orig/sshd.c openssh-6.7p1/sshd.c
  		/* Bind the socket to the desired port. */
  		if (bind(listen_sock, ai->ai_addr, ai->ai_addrlen) < 0) {
  			error("Bind to port %s on %s failed: %.200s.",
-@@ -2060,6 +2067,9 @@
+@@ -2132,6 +2139,9 @@ main(int ac, char **av)
  	    remote_ip, remote_port,
  	    get_local_ipaddr(sock_in), get_local_port());
  
@@ -799,10 +793,10 @@ diff -ru openssh-6.7p1.orig/sshd.c openssh-6.7p1/sshd.c
  	/*
  	 * We don't want to listen forever unless the other side
  	 * successfully authenticates itself.  So we set up an alarm which is
-diff -ru openssh-6.7p1.orig/sshd_config openssh-6.7p1/sshd_config
---- openssh-6.7p1.orig/sshd_config	2014-01-12 10:20:47.000000000 -0200
-+++ openssh-6.7p1/sshd_config	2014-11-21 09:42:27.608621140 -0200
-@@ -125,6 +125,17 @@
+diff -ruNp openssh-6.8p1.orig/sshd_config openssh-6.8p1/sshd_config
+--- openssh-6.8p1.orig/sshd_config	2015-03-17 07:49:20.000000000 -0200
++++ openssh-6.8p1/sshd_config	2015-03-19 10:13:33.503591053 -0200
+@@ -125,6 +125,17 @@ UsePrivilegeSeparation sandbox		# Defaul
  # override default of no subsystems
  Subsystem	sftp	/usr/libexec/sftp-server
  
@@ -820,11 +814,11 @@ diff -ru openssh-6.7p1.orig/sshd_config openssh-6.7p1/sshd_config
  # Example of overriding settings on a per-user basis
  #Match User anoncvs
  #	X11Forwarding no
-diff -ru openssh-6.7p1.orig/version.h openssh-6.7p1/version.h
---- openssh-6.7p1.orig/version.h	2014-04-20 06:25:31.000000000 -0300
-+++ openssh-6.7p1/version.h	2014-11-21 09:42:27.608621140 -0200
+diff -ruNp openssh-6.8p1.orig/version.h openssh-6.8p1/version.h
+--- openssh-6.8p1.orig/version.h	2015-03-17 07:49:20.000000000 -0200
++++ openssh-6.8p1/version.h	2015-03-19 10:13:33.503591053 -0200
 @@ -3,4 +3,5 @@
- #define SSH_VERSION	"OpenSSH_6.7"
+ #define SSH_VERSION	"OpenSSH_6.8"
  
  #define SSH_PORTABLE	"p1"
 -#define SSH_RELEASE	SSH_VERSION SSH_PORTABLE