[ssh_x509] PKIX-SSH release 17.1.1

[ssh_x509 at roumenpetrov.info]

Hello,

New mostly bug-fix release 17.1.1 is available for download from site.


List with main changes:

(x) Security:

(*) do not allow NUL characters in url-encoded string


(x) Features:

(*) check the user did not change during PAM transaction

(*) use address family compatible IP tunnel on FreeBSD

(*) always shutdown cryptographic library in authentication key utility

(*) log active channels/sessions if client or "session" daemon receive 
"usr1" signal

(*) allows enabling build-in ML-KEM key exchange algorithm at configure time


(x) Bugs:

(*) continue fetch PKCS#11 keys loop if cannot recognise key material

(*) use first obtained value for MaxStartups

(*) during sftp uploads, avoid a condition where a failed write could be 
ignored if a subsequent write succeeded

(*) do not log audit messages with UNKNOWN hostname

(*) wait unprivileged daemon authentication process to exist before to 
close file descriptors

(*) check only major versions to match for OpenSSL >= 3.0


(x) Misc:

(*) get rid of the malfunctioning XMSS key algorithm

(*) fix a number of memory leaks

(*) describe "X509 store" option CAStoreURI

(*) log if PKCS#11 does not support known key type

(*) correct typographical and spelling errors

(*) support logging to file in authentication agent utility and PKCS#11 
helper utility

(*) add GSSAPIStrictAcceptorCheck to output daemon configuration


Regards,
Roumen Petrov