git: bb5c77e9d281 - main - OpenSSH: Update to 10.4p1
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Thu, 09 Jul 2026 17:18:07 UTC
The branch main has been updated by emaste:
URL: https://cgit.FreeBSD.org/src/commit/?id=bb5c77e9d281d6def6835d48249898764bc6a5fe
commit bb5c77e9d281d6def6835d48249898764bc6a5fe
Merge: 3defe8195684 3838aee84536
Author: Ed Maste <emaste@FreeBSD.org>
AuthorDate: 2026-07-09 17:17:11 +0000
Commit: Ed Maste <emaste@FreeBSD.org>
CommitDate: 2026-07-09 17:17:11 +0000
OpenSSH: Update to 10.4p1
Full release notes are available at
https://www.openssh.com/txt/release-10.4
Selected highlights from the release notes:
Potentially-incompatible changes
--------------------------------
* sshd(8): configuration dump mode ("sshd -G") now writes directives
in mixed case (e.g. "PubkeyAuthentication") whereas previously it
emitted only lower-case names.
* ssh(1), sshd(8): make the transport protocol stricter by
disconnecting if the peer sends non-KEX messages during a post-
authentication key re-exchange. Previously a malicious peer could
continue sending non-key exchange messages without penalty. These
would be buffered, causing memory to be wasted up until the
connection terminated or the server/client hit a memory limit.
Implementations that do not restrict messages sent during key
exchange as per RFC4253 section 7.1 may be disconnected.
Reported by Marko Jevtic.
Changes since OpenSSH 10.3
==========================
This release contains a number of security fixes as well as general
bugfixes and a couple of new features.
Security
========
* sftp(1): when downloading files on the command-line using
"sftp host:/path .", a malicious server could cause the file to
be downloaded to an unexpected location. This issue was identified
by the Swival Security Scanner.
* scp(1): when copying files between two remote destinations, do
not allow a malicious server to write files to the parent
directory of the intended target directory. This issue was
identified by the Swival Security Scanner.
* sshd(8): DisableForwarding=yes didn't override PermitTunnel=yes
as it was documented to do. Note that PermitTunnel is not enabled
by default. Reported independently by Huzaifa Sidhpurwala of
Redhat and Marko Jevtic.
* sshd(8): avoid a potential pre-authentication denial of service
when GSSAPIAuthentication was enabled (this feature is off by
default). This was not mitigated by MaxAuthTries, but would be
penalised by PerSourcePenalties. This was reported by Manfred
Kaiser of the milCERT AT (Austrian Ministry of Defence).
* sshd(8): fix a number of cases where the minimum authentication
delay was not being enforced. Reported by the Orange Cyberdefense
Vulnerability Team.
* ssh(1): fix a possible client-side use-after-free if the server
changes its host key during a key reexchange. This was reported by
Zhenpeng (Leo) Lin of Depthfirst.
New features
------------
* All: add experimental support for a composite post-quantum
signature scheme that combines ML-DSA 44 and Ed25519 as specified
in draft-miller-sshm-mldsa44-ed25519-composite-sigs.
This scheme is not enabled by default. To use it, you'll need
to add it to HostKeyAlgorithms, PubkeyAcceptedAlgorithms, etc.
Keys may be generated using "ssh-keygen -t mldsa44-ed25519".
Bugfixes
--------
* sshd(8): avoid sending observably different messages for valid vs
invalid users in GSSAPIAuthentication (disabled by default).
* ssh(1), sshd(8): fix several bugs that incorrectly
classified bulk traffic as interactive. bz3972, bz3958
* ssh-keygen(1), ssh-add(1): skip unsupported key types when
downloading resident keys from a FIDO token. Previously, downloads
would abort when one was encountered. GHPR657
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58083
crypto/openssh/.depend | 4 +-
crypto/openssh/.git_allowed_signers.asc | 26 +-
crypto/openssh/.github/ci-status.md | 12 +-
crypto/openssh/.github/configs | 7 +-
crypto/openssh/.github/install_dropbear.sh | 35 +
crypto/openssh/.github/install_libcrypto.sh | 2 +-
crypto/openssh/.github/pin_actions.sh | 35 +
crypto/openssh/.github/run_test.sh | 24 +-
crypto/openssh/.github/setup_ci.sh | 167 +-
crypto/openssh/.github/workflows/c-cpp.yml | 42 +-
crypto/openssh/.github/workflows/cifuzz.yml | 6 +-
crypto/openssh/.github/workflows/selfhosted.yml | 10 +-
crypto/openssh/.github/workflows/upstream.yml | 20 +-
crypto/openssh/.github/workflows/vm.yml | 155 +-
crypto/openssh/.skipped-commit-ids | 2 +
crypto/openssh/ChangeLog | 14820 +++++-----
crypto/openssh/Makefile.in | 42 +
crypto/openssh/PROTOCOL.agent | 4 +-
crypto/openssh/README | 2 +-
crypto/openssh/README.privsep | 184 +-
crypto/openssh/auth.h | 3 +-
crypto/openssh/auth2-chall.c | 6 +-
crypto/openssh/auth2-gss.c | 62 +-
crypto/openssh/auth2.c | 12 +-
crypto/openssh/authfd.c | 8 +-
crypto/openssh/authfile.c | 9 +-
crypto/openssh/chacha.c | 6 +-
crypto/openssh/channels.c | 17 +-
crypto/openssh/channels.h | 5 +-
crypto/openssh/cipher.c | 44 +-
crypto/openssh/cipher.h | 4 +-
crypto/openssh/clientloop.c | 26 +-
crypto/openssh/config.h | 13 +-
crypto/openssh/configure.ac | 39 +-
crypto/openssh/contrib/redhat/openssh.spec | 2 +-
crypto/openssh/contrib/suse/openssh.spec | 2 +-
crypto/openssh/crypto_api.h | 127 +-
crypto/openssh/defines.h | 16 +-
crypto/openssh/ed25519-openssl.c | 38 +-
crypto/openssh/ed25519.c | 36 +-
crypto/openssh/ed25519.sh | 74 +-
crypto/openssh/kex.c | 9 +-
crypto/openssh/kex.h | 3 +-
crypto/openssh/kexmlkem768x25519.c | 100 +-
crypto/openssh/libcrux-mlkem-mldsa.c | 430 +
crypto/openssh/libcrux_internal.h | 27332 +++++++++++++++++++
crypto/openssh/libcrux_mlkem768_sha3.h | 11752 --------
crypto/openssh/mac.c | 8 +-
crypto/openssh/match.c | 137 +-
crypto/openssh/misc.c | 8 +-
crypto/openssh/mlkem768.sh | 219 -
crypto/openssh/mlkem_mldsa.sh | 341 +
crypto/openssh/moduli | 1124 +-
crypto/openssh/monitor.c | 58 +-
crypto/openssh/monitor_wrap.c | 84 +-
crypto/openssh/monitor_wrap.h | 6 +-
crypto/openssh/openbsd-compat/bsd-cygwin_util.c | 6 +-
crypto/openssh/openbsd-compat/bsd-misc.c | 2 +-
crypto/openssh/openbsd-compat/fake-rfc2553.c | 3 +-
crypto/openssh/openbsd-compat/fmt_scaled.c | 39 +-
.../openssh/openbsd-compat/getrrsetbyname-ldns.c | 3 +-
crypto/openssh/openbsd-compat/getrrsetbyname.c | 23 +-
crypto/openssh/openbsd-compat/vis.c | 2 +
crypto/openssh/packet.c | 35 +-
crypto/openssh/pathnames.h | 4 +-
crypto/openssh/readconf.c | 6 +-
crypto/openssh/regress/Makefile | 3 +
crypto/openssh/regress/addrmatch.sh | 4 +-
crypto/openssh/regress/agent.sh | 21 +-
crypto/openssh/regress/cert-hostkey.sh | 15 +-
crypto/openssh/regress/cert-userkey.sh | 16 +-
crypto/openssh/regress/cfgmatch.sh | 4 +-
crypto/openssh/regress/dropbear-kex.sh | 10 +-
crypto/openssh/regress/dropbear-server.sh | 202 +-
crypto/openssh/regress/hostkey-agent.sh | 8 +-
crypto/openssh/regress/kbdint.sh | 4 +-
crypto/openssh/regress/keyscan.sh | 6 +-
crypto/openssh/regress/keytype.sh | 8 +-
crypto/openssh/regress/knownhosts-command.sh | 5 +-
.../ssh-verify-attestation.c | 4 +-
crypto/openssh/regress/sshsig.sh | 8 +-
crypto/openssh/regress/test-exec.sh | 8 +
crypto/openssh/regress/unittests/Makefile | 4 +-
crypto/openssh/regress/unittests/Makefile.inc | 3 +-
crypto/openssh/regress/unittests/authopt/Makefile | 4 +-
crypto/openssh/regress/unittests/crypto/Makefile | 26 +
.../regress/unittests/crypto/test_ed25519.c | 99 +
.../openssh/regress/unittests/crypto/test_mldsa.c | 140 +
.../regress/unittests/crypto/test_mldsa_eddsa.c | 197 +
.../openssh/regress/unittests/crypto/test_mlkem.c | 164 +
.../draft-ietf-lamps-pq-composite-sigs.json | 8 +
.../unittests/crypto/testdata/nistkats-44.json | 802 +
crypto/openssh/regress/unittests/crypto/tests.c | 123 +
crypto/openssh/regress/unittests/hostkeys/Makefile | 4 +-
crypto/openssh/regress/unittests/kex/Makefile | 3 +-
crypto/openssh/regress/unittests/match/tests.c | 202 +-
crypto/openssh/regress/unittests/servconf/Makefile | 26 +
crypto/openssh/regress/unittests/servconf/tests.c | 364 +
crypto/openssh/regress/unittests/sshkey/Makefile | 4 +-
.../openssh/regress/unittests/sshkey/mktestdata.sh | 22 +-
.../openssh/regress/unittests/sshkey/test_file.c | 67 +-
.../openssh/regress/unittests/sshkey/test_fuzz.c | 58 +-
.../openssh/regress/unittests/sshkey/test_sshkey.c | 111 +-
.../unittests/sshkey/testdata/mldsa44_ed25519_1 | 58 +
.../sshkey/testdata/mldsa44_ed25519_1-cert.fp | 1 +
.../sshkey/testdata/mldsa44_ed25519_1-cert.pub | 1 +
.../unittests/sshkey/testdata/mldsa44_ed25519_1.fp | 1 +
.../sshkey/testdata/mldsa44_ed25519_1.fp.bb | 1 +
.../sshkey/testdata/mldsa44_ed25519_1.pub | 1 +
.../unittests/sshkey/testdata/mldsa44_ed25519_1_pw | 59 +
.../unittests/sshkey/testdata/mldsa44_ed25519_2 | 58 +
.../unittests/sshkey/testdata/mldsa44_ed25519_2.fp | 1 +
.../sshkey/testdata/mldsa44_ed25519_2.fp.bb | 1 +
.../sshkey/testdata/mldsa44_ed25519_2.pub | 1 +
crypto/openssh/regress/unittests/sshkey/tests.c | 2 +-
crypto/openssh/regress/unittests/sshsig/Makefile | 4 +-
.../openssh/regress/unittests/sshsig/mktestdata.sh | 9 +-
.../unittests/sshsig/testdata/mldsa44-ed25519 | 58 +
.../unittests/sshsig/testdata/mldsa44-ed25519.pub | 1 +
.../unittests/sshsig/testdata/mldsa44-ed25519.sig | 78 +
crypto/openssh/regress/unittests/sshsig/tests.c | 9 +-
.../regress/unittests/test_helper/test_helper.c | 18 +-
.../regress/unittests/test_helper/test_helper.h | 4 +-
crypto/openssh/sandbox-seccomp-filter.c | 17 +-
crypto/openssh/scp.c | 8 +-
crypto/openssh/servconf.c | 1995 +-
crypto/openssh/servconf.h | 483 +-
crypto/openssh/serverloop.c | 4 +-
crypto/openssh/session.c | 70 +-
crypto/openssh/sftp-client.c | 16 +-
crypto/openssh/sftp-server.8 | 15 +-
crypto/openssh/sftp-server.c | 43 +-
crypto/openssh/sftp.c | 40 +-
crypto/openssh/sk-usbhid.c | 31 +-
crypto/openssh/ssh-add.c | 33 +-
crypto/openssh/ssh-agent.1 | 8 +-
crypto/openssh/ssh-agent.c | 42 +-
crypto/openssh/ssh-keygen.1 | 16 +-
crypto/openssh/ssh-keygen.c | 12 +-
crypto/openssh/ssh-keyscan.1 | 13 +-
crypto/openssh/ssh-keyscan.c | 15 +-
crypto/openssh/ssh-keysign.c | 3 +-
crypto/openssh/ssh-mldsa-eddsa.c | 506 +
crypto/openssh/ssh.1 | 9 +-
crypto/openssh/ssh.c | 32 +-
crypto/openssh/ssh_config.5 | 96 +-
crypto/openssh/ssh_namespace.h | 64 +-
crypto/openssh/sshbuf-io.c | 7 +-
crypto/openssh/sshbuf.h | 3 +-
crypto/openssh/sshconnect.c | 50 +-
crypto/openssh/sshconnect.h | 9 +-
crypto/openssh/sshconnect2.c | 25 +-
crypto/openssh/sshd-auth.c | 60 +-
crypto/openssh/sshd-session.c | 3 +-
crypto/openssh/sshd.c | 6 +-
crypto/openssh/sshd_config | 2 +-
crypto/openssh/sshd_config.5 | 14 +-
crypto/openssh/ssherr-libcrypto.c | 4 +-
crypto/openssh/ssherr.c | 4 +-
crypto/openssh/ssherr.h | 4 +-
crypto/openssh/sshkey.c | 22 +-
crypto/openssh/sshkey.h | 7 +-
crypto/openssh/version.h | 6 +-
secure/lib/libssh/Makefile | 1 +
164 files changed, 43368 insertions(+), 21435 deletions(-)
diff --cc crypto/openssh/.github/install_dropbear.sh
index 000000000000,ed91c52f7cdb..ed91c52f7cdb
mode 000000,100755..100755
--- a/crypto/openssh/.github/install_dropbear.sh
+++ b/crypto/openssh/.github/install_dropbear.sh
diff --cc crypto/openssh/.github/pin_actions.sh
index 000000000000,8b64e823827e..8b64e823827e
mode 000000,100755..100755
--- a/crypto/openssh/.github/pin_actions.sh
+++ b/crypto/openssh/.github/pin_actions.sh
diff --cc crypto/openssh/config.h
index b922734d01b3,000000000000..80f0b4055c10
mode 100644,000000..100644
--- a/crypto/openssh/config.h
+++ b/crypto/openssh/config.h
@@@ -1,2121 -1,0 +1,2128 @@@
+/* config.h. Generated from config.h.in by configure. */
+/* config.h.in. Generated from configure.ac by autoheader. */
+
+/* Define if building universal (internal helper macro) */
+/* #undef AC_APPLE_UNIVERSAL_BUILD */
+
+/* Define if you have a getaddrinfo that fails for the all-zeros IPv6 address
+ */
+/* #undef AIX_GETNAMEINFO_HACK */
+
+/* Define if your AIX loginfailed() function takes 4 arguments (AIX >= 5.2) */
+/* #undef AIX_LOGINFAILED_4ARG */
+
+/* System only supports IPv4 audit records */
+/* #undef AU_IPv4 */
+
+/* Define if your resolver libs need this for getrrsetbyname */
+/* #undef BIND_8_COMPAT */
+
+/* The system has incomplete BSM API */
+/* #undef BROKEN_BSM_API */
+
+/* broken in chroots on older kernels */
+/* #undef BROKEN_CLOSEFROM */
+
+/* Define if cmsg_type is not passed correctly */
+/* #undef BROKEN_CMSG_TYPE */
+
+/* getaddrinfo is broken (if present) */
+/* #undef BROKEN_GETADDRINFO */
+
+/* getgroups(0,NULL) will return -1 */
+/* #undef BROKEN_GETGROUPS */
+
+/* getline is not what we expect */
+/* #undef BROKEN_GETLINE */
+
+/* Do not use system glob */
+#define BROKEN_GLOB 1
+
+/* Define if you system's inet_ntoa is busted (e.g. Irix gcc issue) */
+/* #undef BROKEN_INET_NTOA */
+
+/* Define if your struct dirent expects you to allocate extra space for d_name
+ */
+/* #undef BROKEN_ONE_BYTE_DIRENT_D_NAME */
+
+/* System poll(2) implementation is broken */
+/* #undef BROKEN_POLL */
+
+/* Can't do comparisons on readv */
+/* #undef BROKEN_READV_COMPARISON */
+
+/* NetBSD read function is sometimes redirected, breaking atomicio comparisons
+ against it */
+/* #undef BROKEN_READ_COMPARISON */
+
+/* Needed for NeXT */
+/* #undef BROKEN_SAVED_UIDS */
+
+/* Define if your setregid() is broken */
+/* #undef BROKEN_SETREGID */
+
+/* Define if your setresgid() is broken */
+/* #undef BROKEN_SETRESGID */
+
+/* Define if your setresuid() is broken */
+/* #undef BROKEN_SETRESUID */
+
+/* Define if your setreuid() is broken */
+/* #undef BROKEN_SETREUID */
+
+/* LynxOS has broken setvbuf() implementation */
+/* #undef BROKEN_SETVBUF */
+
+/* QNX shadow support is broken */
+/* #undef BROKEN_SHADOW_EXPIRE */
+
+/* Define if your snprintf is busted */
+/* #undef BROKEN_SNPRINTF */
+
+/* strndup broken, see APAR IY61211 */
+/* #undef BROKEN_STRNDUP */
+
+/* strnlen broken, see APAR IY62551 */
+/* #undef BROKEN_STRNLEN */
+
+/* strnvis detected broken */
+#define BROKEN_STRNVIS 1
+
+/* tcgetattr with ICANON may hang */
+/* #undef BROKEN_TCGETATTR_ICANON */
+
+/* updwtmpx is broken (if present) */
+/* #undef BROKEN_UPDWTMPX */
+
+/* Define if you have BSD auth support */
+/* #undef BSD_AUTH */
+
+/* Define if you want to specify the path to your lastlog file */
+/* #undef CONF_LASTLOG_FILE */
+
+/* Define if you want to specify the path to your utmp file */
+/* #undef CONF_UTMP_FILE */
+
+/* Define if you want to specify the path to your wtmpx file */
+/* #undef CONF_WTMPX_FILE */
+
+/* Define if you want to specify the path to your wtmp file */
+/* #undef CONF_WTMP_FILE */
+
+/* Need to call setpgrp as root */
+/* #undef DISABLE_FD_PASSING */
+
+/* Define if you don't want to use lastlog */
+/* #undef DISABLE_LASTLOG */
+
+/* Define if you don't want to use your system's login() call */
+/* #undef DISABLE_LOGIN */
+
+/* Define if you don't want to use pututline() etc. to write [uw]tmp */
+/* #undef DISABLE_PUTUTLINE */
+
+/* Define if you don't want to use pututxline() etc. to write [uw]tmpx */
+/* #undef DISABLE_PUTUTXLINE */
+
+/* Define if you want to disable shadow passwords */
+/* #undef DISABLE_SHADOW */
+
+/* Define if you don't want to use utmp */
+#define DISABLE_UTMP 1
+
+/* Define if you don't want to use utmpx */
+/* #undef DISABLE_UTMPX */
+
+/* Define if you don't want to use wtmp */
+#define DISABLE_WTMP 1
+
+/* Define if you don't want to use wtmpx */
+#define DISABLE_WTMPX 1
+
+/* Enable for PKCS#11 support */
+#define ENABLE_PKCS11 /**/
+
+/* Enable for U2F/FIDO support */
+#define ENABLE_SK /**/
+
+/* Enable for built-in U2F/FIDO support */
+/* #undef ENABLE_SK_INTERNAL */
+
+/* define if fflush(NULL) does not work */
+/* #undef FFLUSH_NULL_BUG */
+
+/* File names may not contain backslash characters */
+/* #undef FILESYSTEM_NO_BACKSLASH */
+
+/* fsid_t has member val */
+/* #undef FSID_HAS_VAL */
+
+/* fsid_t has member __val */
+/* #undef FSID_HAS___VAL */
+
+/* getpgrp takes one arg */
+#define GETPGRP_VOID 1
+
+/* Conflicting defs for getspnam */
+/* #undef GETSPNAM_CONFLICTING_DEFS */
+
+/* Define if your system glob() function has the GLOB_ALTDIRFUNC extension */
+#define GLOB_HAS_ALTDIRFUNC 1
+
+/* Define if your system glob() function has gl_matchc options in glob_t */
+#define GLOB_HAS_GL_MATCHC 1
+
+/* Define if your system glob() function has gl_statv options in glob_t */
+/* #undef GLOB_HAS_GL_STATV */
+
+/* Define this if you want GSSAPI support in the version 2 protocol */
+/* #undef GSSAPI */
+
+/* Define if you want to use shadow password expire field */
+/* #undef HAS_SHADOW_EXPIRE */
+
+/* Define if your system uses access rights style file descriptor passing */
+/* #undef HAVE_ACCRIGHTS_IN_MSGHDR */
+
+/* Define if you have ut_addr in utmp.h */
+/* #undef HAVE_ADDR_IN_UTMP */
+
+/* Define if you have ut_addr in utmpx.h */
+/* #undef HAVE_ADDR_IN_UTMPX */
+
+/* Define if you have ut_addr_v6 in utmp.h */
+/* #undef HAVE_ADDR_V6_IN_UTMP */
+
+/* Define if you have ut_addr_v6 in utmpx.h */
+/* #undef HAVE_ADDR_V6_IN_UTMPX */
+
+/* Define to 1 if you have the 'arc4random' function. */
+#define HAVE_ARC4RANDOM 1
+
+/* Define to 1 if you have the 'arc4random_buf' function. */
+#define HAVE_ARC4RANDOM_BUF 1
+
+/* Define to 1 if you have the 'arc4random_stir' function. */
+/* #undef HAVE_ARC4RANDOM_STIR */
+
+/* Define to 1 if you have the 'arc4random_uniform' function. */
+#define HAVE_ARC4RANDOM_UNIFORM 1
+
+/* Define to 1 if you have the 'asprintf' function. */
+#define HAVE_ASPRINTF 1
+
+/* OpenBSD's gcc has bounded */
+/* #undef HAVE_ATTRIBUTE__BOUNDED__ */
+
+/* Have attribute nonnull */
+#define HAVE_ATTRIBUTE__NONNULL__ 1
+
+/* compiler supports nonstring attribute */
+#define HAVE_ATTRIBUTE__NONSTRING__ 1
+
+/* OpenBSD's gcc has sentinel */
+/* #undef HAVE_ATTRIBUTE__SENTINEL__ */
+
+/* Define to 1 if you have the 'aug_get_machine' function. */
+/* #undef HAVE_AUG_GET_MACHINE */
+
+/* Define to 1 if you have the 'auth_hostok' function. */
+#define HAVE_AUTH_HOSTOK 1
+
+/* Define to 1 if you have the 'auth_timeok' function. */
+#define HAVE_AUTH_TIMEOK 1
+
+/* Define to 1 if you have the 'b64_ntop' function. */
+/* #undef HAVE_B64_NTOP */
+
+/* Define to 1 if you have the 'b64_pton' function. */
+/* #undef HAVE_B64_PTON */
+
+/* Define if you have the basename function. */
+#define HAVE_BASENAME 1
+
+/* Define to 1 if you have the 'bcopy' function. */
+#define HAVE_BCOPY 1
+
+/* Define to 1 if you have the 'bcrypt_pbkdf' function. */
+/* #undef HAVE_BCRYPT_PBKDF */
+
+/* Define to 1 if you have the 'bindresvport_sa' function. */
+#define HAVE_BINDRESVPORT_SA 1
+
+/* Define to 1 if you have the 'blf_enc' function. */
+/* #undef HAVE_BLF_ENC */
+
+/* Define to 1 if you have the <blf.h> header file. */
+/* #undef HAVE_BLF_H */
+
+/* Define to 1 if you have the 'Blowfish_expand0state' function. */
+/* #undef HAVE_BLOWFISH_EXPAND0STATE */
+
+/* Define to 1 if you have the 'Blowfish_expandstate' function. */
+/* #undef HAVE_BLOWFISH_EXPANDSTATE */
+
+/* Define to 1 if you have the 'Blowfish_initstate' function. */
+/* #undef HAVE_BLOWFISH_INITSTATE */
+
+/* Define to 1 if you have the 'Blowfish_stream2word' function. */
+/* #undef HAVE_BLOWFISH_STREAM2WORD */
+
+/* Define to 1 if you have the 'BN_is_prime_ex' function. */
+#define HAVE_BN_IS_PRIME_EX 1
+
+/* Define to 1 if you have the <bsd/libutil.h> header file. */
+/* #undef HAVE_BSD_LIBUTIL_H */
+
+/* Define to 1 if you have the <bsm/audit.h> header file. */
+/* #undef HAVE_BSM_AUDIT_H */
+
+/* Define to 1 if you have the <bstring.h> header file. */
+/* #undef HAVE_BSTRING_H */
+
+/* Define to 1 if you have the 'bzero' function. */
+#define HAVE_BZERO 1
+
+/* calloc(0, x) returns NULL */
+#define HAVE_CALLOC 1
+
+/* Define if you have caph_cache_tzdata */
+#define HAVE_CAPH_CACHE_TZDATA 1
+
+/* Define to 1 if you have the <capsicum_helpers.h> header file. */
+#define HAVE_CAPSICUM_HELPERS_H 1
+
+/* Define to 1 if you have the 'cap_rights_limit' function. */
+#define HAVE_CAP_RIGHTS_LIMIT 1
+
+/* Define to 1 if you have the 'clock' function. */
+#define HAVE_CLOCK 1
+
+/* Have clock_gettime */
+#define HAVE_CLOCK_GETTIME 1
+
+/* define if you have clock_t data type */
+#define HAVE_CLOCK_T 1
+
+/* Define to 1 if you have the 'closefrom' function. */
+#define HAVE_CLOSEFROM 1
+
+/* Define to 1 if you have the 'close_range' function. */
+#define HAVE_CLOSE_RANGE 1
+
+/* Define if gai_strerror() returns const char * */
+#define HAVE_CONST_GAI_STRERROR_PROTO 1
+
+/* Define if your system uses ancillary data style file descriptor passing */
+#define HAVE_CONTROL_IN_MSGHDR 1
+
+/* Define to 1 if you have the 'crypt' function. */
+#define HAVE_CRYPT 1
+
+/* Define to 1 if you have the <crypto/sha2.h> header file. */
+/* #undef HAVE_CRYPTO_SHA2_H */
+
+/* Define to 1 if you have the <crypt.h> header file. */
+/* #undef HAVE_CRYPT_H */
+
+/* Define if you are on Cygwin */
+/* #undef HAVE_CYGWIN */
+
+/* Define if your libraries define daemon() */
+#define HAVE_DAEMON 1
+
+/* Define to 1 if you have the declaration of 'AI_NUMERICSERV', and to 0 if
+ you don't. */
+#define HAVE_DECL_AI_NUMERICSERV 1
+
+/* Define to 1 if you have the declaration of 'authenticate', and to 0 if you
+ don't. */
+/* #undef HAVE_DECL_AUTHENTICATE */
+
+/* Define to 1 if you have the declaration of 'bzero', and to 0 if you don't.
+ */
+#define HAVE_DECL_BZERO 1
+
+/* Define to 1 if you have the declaration of 'ftruncate', and to 0 if you
+ don't. */
+#define HAVE_DECL_FTRUNCATE 1
+
+/* Define to 1 if you have the declaration of 'getentropy', and to 0 if you
+ don't. */
+#define HAVE_DECL_GETENTROPY 1
+
+/* Define to 1 if you have the declaration of 'getpeereid', and to 0 if you
+ don't. */
+#define HAVE_DECL_GETPEEREID 1
+
+/* Define to 1 if you have the declaration of 'GLOB_NOMATCH', and to 0 if you
+ don't. */
+#define HAVE_DECL_GLOB_NOMATCH 1
+
+/* Define to 1 if you have the declaration of 'GSS_C_NT_HOSTBASED_SERVICE',
+ and to 0 if you don't. */
+/* #undef HAVE_DECL_GSS_C_NT_HOSTBASED_SERVICE */
+
+/* Define to 1 if you have the declaration of 'howmany', and to 0 if you
+ don't. */
+#define HAVE_DECL_HOWMANY 1
+
++/* Define to 1 if you have the declaration of 'htobe32', and to 0 if you
++ don't. */
++#define HAVE_DECL_HTOBE32 1
++
+/* Define to 1 if you have the declaration of 'htole64', and to 0 if you
+ don't. */
+#define HAVE_DECL_HTOLE64 1
+
+/* Define to 1 if you have the declaration of 'h_errno', and to 0 if you
+ don't. */
+#define HAVE_DECL_H_ERRNO 1
+
+/* Define to 1 if you have the declaration of 'INFINITY', and to 0 if you
+ don't. */
+#define HAVE_DECL_INFINITY 1
+
+/* Define to 1 if you have the declaration of 'le32toh', and to 0 if you
+ don't. */
+#define HAVE_DECL_LE32TOH 1
+
+/* Define to 1 if you have the declaration of 'le64toh', and to 0 if you
+ don't. */
+#define HAVE_DECL_LE64TOH 1
+
+/* Define to 1 if you have the declaration of 'loginfailed', and to 0 if you
+ don't. */
+/* #undef HAVE_DECL_LOGINFAILED */
+
+/* Define to 1 if you have the declaration of 'loginrestrictions', and to 0 if
+ you don't. */
+/* #undef HAVE_DECL_LOGINRESTRICTIONS */
+
+/* Define to 1 if you have the declaration of 'loginsuccess', and to 0 if you
+ don't. */
+/* #undef HAVE_DECL_LOGINSUCCESS */
+
+/* Define to 1 if you have the declaration of 'MAXSYMLINKS', and to 0 if you
+ don't. */
+#define HAVE_DECL_MAXSYMLINKS 1
+
+/* Define to 1 if you have the declaration of 'memmem', and to 0 if you don't.
+ */
+#define HAVE_DECL_MEMMEM 1
+
+/* Define to 1 if you have the declaration of 'NFDBITS', and to 0 if you
+ don't. */
+#define HAVE_DECL_NFDBITS 1
+
+/* Define to 1 if you have the declaration of 'offsetof', and to 0 if you
+ don't. */
+#define HAVE_DECL_OFFSETOF 1
+
+/* Define to 1 if you have the declaration of 'O_NONBLOCK', and to 0 if you
+ don't. */
+#define HAVE_DECL_O_NONBLOCK 1
+
+/* Define to 1 if you have the declaration of 'passwdexpired', and to 0 if you
+ don't. */
+/* #undef HAVE_DECL_PASSWDEXPIRED */
+
+/* Define to 1 if you have the declaration of 'readv', and to 0 if you don't.
+ */
+#define HAVE_DECL_READV 1
+
+/* Define to 1 if you have the declaration of 'setauthdb', and to 0 if you
+ don't. */
+/* #undef HAVE_DECL_SETAUTHDB */
+
+/* Define to 1 if you have the declaration of 'SHUT_RD', and to 0 if you
+ don't. */
+#define HAVE_DECL_SHUT_RD 1
+
+/* Define to 1 if you have the declaration of 'UINT32_MAX', and to 0 if you
+ don't. */
+#define HAVE_DECL_UINT32_MAX 1
+
+/* Define to 1 if you have the declaration of 'writev', and to 0 if you don't.
+ */
+#define HAVE_DECL_WRITEV 1
+
+/* Define to 1 if you have the declaration of '_getlong', and to 0 if you
+ don't. */
+#define HAVE_DECL__GETLONG 0
+
+/* Define to 1 if you have the declaration of '_getshort', and to 0 if you
+ don't. */
+#define HAVE_DECL__GETSHORT 0
+
+/* Define to 1 if you have the declaration of '__builtin_inff', and to 0 if
+ you don't. */
+/* #undef HAVE_DECL___BUILTIN_INFF */
+
+/* Define to 1 if you have the 'DES_crypt' function. */
+#define HAVE_DES_CRYPT 1
+
+/* Define if you have /dev/ptmx */
+/* #undef HAVE_DEV_PTMX */
+
+/* Define if you have /dev/ptc */
+/* #undef HAVE_DEV_PTS_AND_PTC */
+
+/* Define to 1 if you have the <dirent.h> header file. */
+#define HAVE_DIRENT_H 1
+
+/* Define to 1 if you have the 'dirfd' function. */
+#define HAVE_DIRFD 1
+
+/* Define to 1 if you have the 'dirname' function. */
+#define HAVE_DIRNAME 1
+
+/* Define to 1 if you have the 'dlopen' function. */
+#define HAVE_DLOPEN 1
+
+/* Define to 1 if you have the 'EC_KEY_METHOD_new' function. */
+#define HAVE_EC_KEY_METHOD_NEW 1
+
+/* Define to 1 if you have the 'EC_POINT_get_affine_coordinates' function. */
+#define HAVE_EC_POINT_GET_AFFINE_COORDINATES 1
+
+/* Define to 1 if you have the 'EC_POINT_get_affine_coordinates_GFp' function.
+ */
+#define HAVE_EC_POINT_GET_AFFINE_COORDINATES_GFP 1
+
+/* Define to 1 if you have the 'EC_POINT_set_affine_coordinates' function. */
+#define HAVE_EC_POINT_SET_AFFINE_COORDINATES 1
+
+/* Define to 1 if you have the 'EC_POINT_set_affine_coordinates_GFp' function.
+ */
+#define HAVE_EC_POINT_SET_AFFINE_COORDINATES_GFP 1
+
+/* Define to 1 if you have the <elf.h> header file. */
+#define HAVE_ELF_H 1
+
+/* Define to 1 if you have the 'endgrent' function. */
+#define HAVE_ENDGRENT 1
+
+/* Define to 1 if you have the <endian.h> header file. */
+#define HAVE_ENDIAN_H 1
+
+/* Define to 1 if you have the 'endutent' function. */
+/* #undef HAVE_ENDUTENT */
+
+/* Define to 1 if you have the 'endutxent' function. */
+#define HAVE_ENDUTXENT 1
+
+/* Define to 1 if you have the 'err' function. */
+#define HAVE_ERR 1
+
+/* Define to 1 if you have the 'errx' function. */
+#define HAVE_ERRX 1
+
+/* Define to 1 if you have the <err.h> header file. */
+#define HAVE_ERR_H 1
+
+/* Define if your system has /etc/default/login */
+/* #undef HAVE_ETC_DEFAULT_LOGIN */
+
+/* Define to 1 if you have the 'EVP_chacha20' function. */
+#define HAVE_EVP_CHACHA20 1
+
+/* Define to 1 if you have the 'EVP_CIPHER_CTX_get_iv' function. */
+/* #undef HAVE_EVP_CIPHER_CTX_GET_IV */
+
+/* Define to 1 if you have the 'EVP_CIPHER_CTX_get_updated_iv' function. */
+#define HAVE_EVP_CIPHER_CTX_GET_UPDATED_IV 1
+
+/* Define to 1 if you have the 'EVP_CIPHER_CTX_iv' function. */
+#define HAVE_EVP_CIPHER_CTX_IV 1
+
+/* Define to 1 if you have the 'EVP_CIPHER_CTX_iv_noconst' function. */
+#define HAVE_EVP_CIPHER_CTX_IV_NOCONST 1
+
+/* Define to 1 if you have the 'EVP_CIPHER_CTX_set_iv' function. */
+/* #undef HAVE_EVP_CIPHER_CTX_SET_IV */
+
+/* Define to 1 if you have the 'EVP_DigestFinal_ex' function. */
+#define HAVE_EVP_DIGESTFINAL_EX 1
+
+/* Define to 1 if you have the 'EVP_DigestInit_ex' function. */
+#define HAVE_EVP_DIGESTINIT_EX 1
+
+/* Define to 1 if you have the 'EVP_DigestSign' function. */
+#define HAVE_EVP_DIGESTSIGN 1
+
+/* Define to 1 if you have the 'EVP_DigestVerify' function. */
+#define HAVE_EVP_DIGESTVERIFY 1
+
+/* Define to 1 if you have the 'EVP_MD_CTX_cleanup' function. */
+/* #undef HAVE_EVP_MD_CTX_CLEANUP */
+
+/* Define to 1 if you have the 'EVP_MD_CTX_copy_ex' function. */
+#define HAVE_EVP_MD_CTX_COPY_EX 1
+
+/* Define to 1 if you have the 'EVP_MD_CTX_init' function. */
+/* #undef HAVE_EVP_MD_CTX_INIT */
+
+/* Define to 1 if you have the 'EVP_PKEY_get_raw_private_key' function. */
+#define HAVE_EVP_PKEY_GET_RAW_PRIVATE_KEY 1
+
+/* Define to 1 if you have the 'EVP_PKEY_get_raw_public_key' function. */
+#define HAVE_EVP_PKEY_GET_RAW_PUBLIC_KEY 1
+
+/* Define to 1 if you have the 'EVP_sha256' function. */
+#define HAVE_EVP_SHA256 1
+
+/* Define to 1 if you have the 'EVP_sha384' function. */
+#define HAVE_EVP_SHA384 1
+
+/* Define to 1 if you have the 'EVP_sha512' function. */
+#define HAVE_EVP_SHA512 1
+
+/* Define if you have ut_exit in utmp.h */
+/* #undef HAVE_EXIT_IN_UTMP */
+
+/* Define to 1 if you have the 'explicit_bzero' function. */
+#define HAVE_EXPLICIT_BZERO 1
+
+/* Define to 1 if you have the 'explicit_memset' function. */
+/* #undef HAVE_EXPLICIT_MEMSET */
+
+/* Define to 1 if you have the 'fchmod' function. */
+#define HAVE_FCHMOD 1
+
+/* Define to 1 if you have the 'fchmodat' function. */
+#define HAVE_FCHMODAT 1
+
+/* Define to 1 if you have the 'fchown' function. */
+#define HAVE_FCHOWN 1
+
+/* Define to 1 if you have the 'fchownat' function. */
+#define HAVE_FCHOWNAT 1
+
+/* Use F_CLOSEM fcntl for closefrom */
+/* #undef HAVE_FCNTL_CLOSEM */
+
+/* Define to 1 if you have the <fcntl.h> header file. */
+#define HAVE_FCNTL_H 1
+
+/* Define to 1 if the system has the type 'fd_mask'. */
+#define HAVE_FD_MASK 1
+
+/* Define to 1 if you have the <features.h> header file. */
+/* #undef HAVE_FEATURES_H */
+
+/* Define to 1 if you have the 'fido_assert_set_clientdata' function. */
+/* #undef HAVE_FIDO_ASSERT_SET_CLIENTDATA */
+
+/* Define to 1 if you have the 'fido_cred_prot' function. */
+/* #undef HAVE_FIDO_CRED_PROT */
+
+/* Define to 1 if you have the 'fido_cred_set_clientdata' function. */
+/* #undef HAVE_FIDO_CRED_SET_CLIENTDATA */
+
+/* Define to 1 if you have the 'fido_cred_set_prot' function. */
+/* #undef HAVE_FIDO_CRED_SET_PROT */
+
+/* Define to 1 if you have the 'fido_dev_get_touch_begin' function. */
+/* #undef HAVE_FIDO_DEV_GET_TOUCH_BEGIN */
+
+/* Define to 1 if you have the 'fido_dev_get_touch_status' function. */
+/* #undef HAVE_FIDO_DEV_GET_TOUCH_STATUS */
+
+/* Define to 1 if you have the 'fido_dev_is_winhello' function. */
+/* #undef HAVE_FIDO_DEV_IS_WINHELLO */
+
+/* Define to 1 if you have the 'fido_dev_supports_cred_prot' function. */
+/* #undef HAVE_FIDO_DEV_SUPPORTS_CRED_PROT */
+
+/* Define to 1 if you have the <floatingpoint.h> header file. */
+#define HAVE_FLOATINGPOINT_H 1
+
+/* Define to 1 if you have the 'flock' function. */
+#define HAVE_FLOCK 1
+
+/* Define to 1 if you have the 'fmt_scaled' function. */
+/* #undef HAVE_FMT_SCALED */
+
+/* Define to 1 if you have the 'fnmatch' function. */
+#define HAVE_FNMATCH 1
+
+/* Define to 1 if you have the <fnmatch.h> header file. */
+#define HAVE_FNMATCH_H 1
+
+/* Define to 1 if you have the 'freeaddrinfo' function. */
+#define HAVE_FREEADDRINFO 1
+
+/* Define to 1 if you have the 'freezero' function. */
+/* #undef HAVE_FREEZERO */
+
+/* Define to 1 if the system has the type 'fsblkcnt_t'. */
+#define HAVE_FSBLKCNT_T 1
+
+/* Define to 1 if the system has the type 'fsfilcnt_t'. */
+#define HAVE_FSFILCNT_T 1
+
+/* Define to 1 if you have the 'fstatat' function. */
+#define HAVE_FSTATAT 1
+
+/* Define to 1 if you have the 'fstatfs' function. */
+#define HAVE_FSTATFS 1
+
+/* Define to 1 if you have the 'fstatvfs' function. */
+#define HAVE_FSTATVFS 1
+
+/* Define to 1 if you have the 'futimes' function. */
+#define HAVE_FUTIMES 1
+
+/* Define to 1 if you have the 'gai_strerror' function. */
+#define HAVE_GAI_STRERROR 1
+
+/* Define to 1 if you have the 'getaddrinfo' function. */
+#define HAVE_GETADDRINFO 1
+
+/* Define to 1 if you have the 'getaudit' function. */
+/* #undef HAVE_GETAUDIT */
+
+/* Define to 1 if you have the 'getaudit_addr' function. */
+/* #undef HAVE_GETAUDIT_ADDR */
+
+/* Define to 1 if you have the 'getcwd' function. */
+#define HAVE_GETCWD 1
+
+/* Define to 1 if you have the 'getentropy' function. */
+#define HAVE_GETENTROPY 1
+
+/* Define to 1 if you have the 'getgrouplist' function. */
+#define HAVE_GETGROUPLIST 1
+
+/* Define to 1 if you have the 'getgrset' function. */
+/* #undef HAVE_GETGRSET */
+
+/* Define to 1 if you have the 'getlastlogxbyname' function. */
+/* #undef HAVE_GETLASTLOGXBYNAME */
+
+/* Define to 1 if you have the 'getline' function. */
+#define HAVE_GETLINE 1
*** 14376 LINES SKIPPED ***