[ssh_x509] PKIX-SSH release 14.1

[ssh_x509 at roumenpetrov.info]

Hello,

Security release 14.1 is available for immediate download.


(x) Security:

(*) fix use after free memory fault
Compatibility KEX code introduced a double-free in PKIX-SSH 14.0. It is does not impact server side. Client could be impacted but when server is specially crafted.


(x) Features:

(*) control channel inactivity
New daemon option ChannelTimeout automatically closes channels without traffic.

(*) control unused connections
New daemon option UnusedConnectionTimeout allows to terminate connections without open channels.

(*) daemon command line argument -V
Output version information like the client utility.

(*) remove copy/transfer argument -X
Add -X option to remove copy and file transfer programs. Currently sets SFTP parameters are the copy buffer length and the number of inflight requests. Obsoletes sftp argument -B/-R.


(x) Bugs:

(*) properly process client option PermitRemoteOpen
Allow any/none argument only in first position.

(*) default multi-string options
Properly dump multi-string configuration options.

(*) restrict sftp to reasonable values
Do not allow sftp server "limits" extension to set unacceptable buffer sizes and number of open handles.

(*) suggest system known-host file
Avoid NULL print if user known-host files are not used. Note some C-library crash if printf function is called with NULL value for string format.


(x) Misc:

(*) allow writev in secure secure computing mode

(*) optimise read buffers
Use more suitable buffer size for main loops and channel Default sizes could set at build time.

(*) no host-keys warning
Emit warning if no host-keys for host-based authentication can be loaded.

(*) use socketpair in remote copy utility
Synchronise remote copy utility communication to ssh sub-processes with file transfer program.

(*) dump original Host
Add original "Host" line to the output of client configuration test.

(*) import ed25519 code from SUPERCOP
Update to 20221122 release.

(*) unify and extend channel names
Prerequisite for new channel controls.

(*) rewrite some test to use multiplexed session


Regards,
Roumen Petrov