notes.xml

<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE chapter SYSTEM "chapter.dtd">

<chapter>
  <header>
    <copyright>
      <year>2004</year><year>2023</year>
      <holder>Ericsson AB. All Rights Reserved.</holder>
    </copyright>
    <legalnotice>
      Licensed under the Apache License, Version 2.0 (the "License");
      you may not use this file except in compliance with the License.
      You may obtain a copy of the License at
 
          http://www.apache.org/licenses/LICENSE-2.0

      Unless required by applicable law or agreed to in writing, software
      distributed under the License is distributed on an "AS IS" BASIS,
      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
      See the License for the specific language governing permissions and
      limitations under the License.

    </legalnotice>

    <title>SSH Release Notes</title>
    <prepared></prepared>
    <docno></docno>
    <date></date>
    <rev>%VSN%</rev>
    <file>notes.xml</file>
  </header>

<section><title>Ssh 5.1.1</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    With this change (being response to CVE-2023-48795), ssh
	    can negotiate "strict KEX" OpenSSH extension with peers
	    supporting it; also 'chacha20-poly1305@openssh.com'
	    algorithm becomes a less preferred cipher.</p>
          <p>
	    If strict KEX availability cannot be ensured on both
	    connection sides, affected encryption modes(CHACHA and
	    CBC) can be disabled with standard ssh configuration.
	    This will provide protection against vulnerability, but
	    at a cost of affecting interoperability. See <seeguide
	    marker="configure_algos">Configuring algorithms in
	    SSH</seeguide>.</p>
          <p>
	    *** POTENTIAL INCOMPATIBILITY ***</p>
          <p>
	    Own Id: OTP-18897</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 5.1</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Replaced unintentional Erlang Public License 1.1 headers
	    in some files with the intended Apache License 2.0
	    header.</p>
          <p>
	    Own Id: OTP-18815 Aux Id: PR-7780 </p>
        </item>
        <item>
          <p>
	    Avoid outputting ansi escape sequences to dumb ssh
	    clients.</p>
          <p>
	    Own Id: OTP-18861 Aux Id: PR-7627 </p>
        </item>
        <item>
          <p>
	    With this change, connection handler does not execute
	    socket operations until it becomes socket owner.
	    Previously errors could occur if connection handler tried
	    to work with socket whose owner exited.</p>
          <p>
	    Own Id: OTP-18869 Aux Id: PR-7849,GH-7571 </p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    With this change, reverse search works with ssh shell and
	    non dumb terminals.</p>
          <p>
	    Own Id: OTP-18730 Aux Id: PR-7499 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 5.0.1</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Added multiline editing support to ssh clients connected
	    through OTP ssh daemon.</p>
          <p>
	    Own Id: OTP-18653 Aux Id: PR-7242 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 5.0</title>

    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    The ssh_cli has been updated to work with the changes
	    introduced in the new Erlang shell implementation.</p>
          <p>
	    Own Id: OTP-18231 Aux Id: OTP-17932 PR-6144 </p>
        </item>
        <item>
          <p>
	    Typing <c>Ctrl+L</c> in a shell now clears the screen and
	    redraws the current line instead of only redrawing the
	    current line. To only redraw the current line, you must
	    now type <c>Alt+L</c>. This brings the behaviour of
	    <c>Ctrl+L</c> closer to how bash and other shells work.</p>
          <p>
	    *** POTENTIAL INCOMPATIBILITY ***</p>
          <p>
	    Own Id: OTP-18285 Aux Id: PR-6262 </p>
        </item>
        <item>
          <p>
	    Deprecates <c>dbg:stop_clear/0</c> because it is simply a
	    function alias to <c>dbg:stop/0</c></p>
          <p>
	    Own Id: OTP-18478 Aux Id: GH-6903 </p>
        </item>
        <item>
	    <p> The implementation has been fixed to use
	    <c>proc_lib:init_fail/2,3</c> where appropriate, instead
	    of <c>proc_lib:init_ack/1,2</c>. </p>
          <p>
	    *** POTENTIAL INCOMPATIBILITY ***</p>
          <p>
	    Own Id: OTP-18490 Aux Id: OTP-18471, GH-6339, PR-6843 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.15.3</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    With this change, PKCS8 formatted private key file is
	    properly decoded and SSH daemon with such key can be
	    started.</p>
          <p>
	    Own Id: OTP-18446 Aux Id: GH-6475 </p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    Replace size/1 with either tuple_size/1 or byte_size/1</p>
          <p>
	    The <c>size/1</c> BIF is not optimized by the JIT, and
	    its use can result in worse types for Dialyzer.</p>
          <p>
	    When one knows that the value being tested must be a
	    tuple, <c>tuple_size/1</c> should always be preferred.</p>
          <p>
	    When one knows that the value being tested must be a
	    binary, <c>byte_size/1</c> should be preferred. However,
	    <c>byte_size/1</c> also accepts a bitstring (rounding up
	    size to a whole number of bytes), so one must make sure
	    that the call to <c>byte_size/</c> is preceded by a call
	    to <c>is_binary/1</c> to ensure that bitstrings are
	    rejected. Note that the compiler removes redundant calls
	    to <c>is_binary/1</c>, so if one is not sure whether
	    previous code had made sure that the argument is a
	    binary, it does not harm to add an <c>is_binary/1</c>
	    test immediately before the call to <c>byte_size/1</c>.</p>
          <p>
	    Own Id: OTP-18432 Aux Id:
	    GH-6672,PR-6793,PR-6784,PR-6787,PR-6785,PR-6682,PR-6800,PR-6797,PR-6798,PR-6799,PR-6796,PR-6813,PR-6671,PR-6673,PR-6684,PR-6694,GH-6677,PR-6696,PR-6670,PR-6674 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.15.2</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    With this change, ssh application does not crash when
	    formatting some of info reports for unsuccessful
	    connections.</p>
          <p>
	    Own Id: OTP-18386 Aux Id: PR-6611 </p>
        </item>
        <item>
          <p>
	    With this change, ssh does not log extensively long
	    messages.</p>
          <p>
	    Own Id: OTP-18417 Aux Id: DAFH-1349,ERIERL-888,IA18357 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.15.1</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    graceful shutdown of ssh_conection_handler when
	    connection is closed by peer</p>
          <p>
	    Own Id: OTP-18326 Aux Id: ERIERL-865 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.15</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Handling rare race condition at channel close.</p>
          <p>
	    Own Id: OTP-18220 Aux Id: ERIERL-666, ERIERL-661 </p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    New ssh option <c>no_auth_needed</c> to skip the ssh
	    authentication. Use with caution!</p>
          <p>
	    Own Id: OTP-18134 Aux Id: GH-6021 </p>
        </item>
        <item>
          <p>
	    This change fixes dialyzer warnings generated for
	    inets/httpd examples (includes needed adjustment of spec
	    for ssh_sftp module).</p>
          <p>
	    Own Id: OTP-18178 Aux Id: ERIERL-833, ERIERL-834,
	    ERIERL-835 </p>
        </item>
        <item>
          <p>
	    The new function <c>ssh:daemon_replace_options/2</c>
	    makes it possible to change the <c>Options</c> in a
	    running SSH server.</p>
          <p>
	    Established connections are not affected, only those
	    created after the call to this new function.</p>
          <p>
	    Own Id: OTP-18196</p>
        </item>
        <item>
          <p>
	    Add a timeout as option <c>max_initial_idle_time</c>. It
	    closes a connection that does not allocate a channel
	    within the timeout time.</p>
          <p>
	    For more information about timeouts, see the <seeguide
	    marker="hardening#timeouts">Timeouts section </seeguide>
	    in the User's Guide <seeguide
	    marker="hardening">Hardening</seeguide> chapter.</p>
          <p>
	    Own Id: OTP-18207 Aux Id: PR-6231 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.14.1</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Binaries can be limited in logs with the parameter
	    <c>max_log_item_len</c>. The default value is 500 bytes.</p>
          <p>
	    Own Id: OTP-18094</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.14</title>

    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    The representation of Edward curves (ed25519 and ed448)
	    inside ssh had a temporary representation (ed_pri and
	    ed_pub).</p>
          <p>
	    That is now changed to the public_key form. See the
	    manual for more information.</p>
          <p>
	    *** POTENTIAL INCOMPATIBILITY ***</p>
          <p>
	    Own Id: OTP-17920</p>
        </item>
        <item>
          <p>
	    Former internal function
	    <c>ssh_file:extract_public_key/1</c> documented publicly.</p>
          <p>
	    Internally it was previously in ssh_transport.</p>
          <p>
	    Own Id: OTP-18079 Aux Id: GH-5767 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.13.2.3</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    With this change, error logging related crashes in
	    ssh_connection_handler module are fixed.</p>
          <p>
	    Own Id: OTP-18620 Aux Id: OTP-18386,PR-6611 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.13.2.2</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    With this change, ssh application does not crash when
	    formatting some of info reports for unsuccessful
	    connections.</p>
          <p>
	    Own Id: OTP-18386 Aux Id: PR-6611 </p>
        </item>
        <item>
          <p>
	    With this change, ssh does not log extensively long
	    messages.</p>
          <p>
	    Own Id: OTP-18417 Aux Id: DAFH-1349,ERIERL-888,IA18357 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.13.2.1</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Binaries can be limited in logs with the parameter
	    <c>max_log_item_len</c>. The default value is 500 bytes.</p>
          <p>
	    Own Id: OTP-18094</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.13.2</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Fix makefile dependency bugs.</p>
          <p>
	    Own Id: OTP-17847 Aux Id: PR-5574 GH-5548 </p>
        </item>
        <item>
          <p>
	    Fixed faulty OpenSSH decoding of Ed25519/Ed448 keys in
	    the OpenSSH format <c>openssh_key_v1</c>.</p>
          <p>
	    Own Id: OTP-17868 Aux Id: PR-5520 </p>
        </item>
        <item>
          <p>
	    Correction of ssh_file typing, specially for the
	    experimental openssh-key-v1 encoding.</p>
          <p>
	    Own Id: OTP-17912 Aux Id: GH-5680 </p>
        </item>
        <item>
          <p>
	    Improper tag for private ED keys when encoding with
	    ssh:encode/2.</p>
          <p>
	    The tuple had <c>ed_priv</c> as first element, but should
	    have had <c>ed_pri</c>. This is now corrected.</p>
          <p>
	    *** POTENTIAL INCOMPATIBILITY ***</p>
          <p>
	    Own Id: OTP-17928 Aux Id: PR-5679 </p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    Add support for Ed25519/Ed448 SSH host keys in the RFC
	    4716 format ("<c>-----BEGIN EC PRIVATE KEY-----</c>")
	    generated by for example openssl or via Erlang functions
	    (i.e. <c>public_key:generate_key({namedCurve,
	    ed25519})</c>).</p>
          <p>
	    Ed25519 SSH host keys generated by <c>ssh-keygen</c> was,
	    and are still, supported.</p>
          <p>
	    Own Id: OTP-17857 Aux Id: PR-5532 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.13.1</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    The ssh sever <c>parallel_login</c> option was missing in
	    OTP-24</p>
          <p>
	    Own Id: OTP-17850 Aux Id: ERIERL-764 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.13</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    The value of the <c>connect_timeout</c> option is now
	    used as default value for the negotiation timeout.</p>
          <p>
	    Own Id: OTP-17707 Aux Id: ERIERL-706 </p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    Add better error handling in connect/2,3,4. Detect
	    incorrect arguments and return an informative error tuple
	    instead of throwing a function_clause or similar.</p>
          <p>
	    Own Id: OTP-17515 Aux Id: ERIERL-648 </p>
        </item>
        <item>
          <p>
	    Make ssh algorithm selection better handle dynamic
	    changes changes in crypto fips mode.</p>
          <p>
	    Own Id: OTP-17795</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.12.5</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Fixed a race condition in the acceptor loop: if a client
	    disconnected immediately after the tcp connect, the
	    server could cease handling connection on that
	    address:port.</p>
          <p>
	    Own Id: OTP-17764 Aux Id: ERIERL-726 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.12.4</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Fixed that a slow start (&gt;30s) of a client subsystem
	    could cause a log entry with the password.</p>
          <p>
	    Own Id: OTP-17390 Aux Id: ERIERL-648 </p>
        </item>
        <item>
          <p>
	    Fixed an error when running as an sftp server and a
	    client requests a directory contents listing. </p>
          <p>
	    The fix is to handle the error code <c>{error,
	    eacces}</c> as <c>{error, enoent}</c> in the
	    <c>ssh_sftpd:get_attrs/5</c> internal function; that is,
	    just skip it.</p>
          <p>
	    Own Id: OTP-17586 Aux Id: GH-5014 </p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    The "Key exchange failed" Info Report is now more
	    informative.</p>
          <p>
	    Own Id: OTP-17450 Aux Id: ERIERL-655 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.12.3</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Filter out sensitive data (passwords etc) from progress
	    reports and supervisor reports.</p>
          <p>
	    Own Id: OTP-17468 Aux Id: ERIERL-656 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.12.2</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Avoid an extra blank line in the ssh known_hosts file</p>
          <p>
	    Own Id: OTP-17427</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.12.1</title>

    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    Add missing <c>known_hosts</c> and <c>authorized_keys</c>
	    file types to <c>ssh_file:decode/2</c> and
	    <c>ssh_file:encode/2</c>.</p>
          <p>
	    Own Id: OTP-17397</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.12</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
	    <p>Missing runtime dependencies has been added to this
	    application.</p>
          <p>
	    Own Id: OTP-17243 Aux Id: PR-4557 </p>
        </item>
        <item>
          <p>
	    The send window handling is changed to not initialize a
	    too large window on some occasions.</p>
          <p>
	    Own Id: OTP-17353</p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    Removed usage of <c>erlang:is_port/1</c> from the SSH
	    implementation.</p>
          <p>
	    Own Id: OTP-16750</p>
        </item>
        <item>
          <p>
	    Internal connection setup refactoring.</p>
          <p>
	    Own Id: OTP-17051</p>
        </item>
        <item>
          <p>
	    Refactor SSH fsm into a (hopefully) more comprehensible
	    set of gen_statem callback-files.</p>
          <p>
	    Own Id: OTP-17140</p>
        </item>
        <item>
          <p>
	    The RSA SHA1 sign/verify variants are disabled by
	    default. That is, ssh-rsa is disabled by default as well
	    as the SHA1 sign/verify with RSA keys from id_rsa and
	    ssh_host_rsa_key. All SHA2 sign/verify are enabled by
	    default.</p>
          <p>
	    The reason is that SHA1 is now considered easy to break.</p>
          <p>
	    To enable RSA with SHA1, for example for a very old and
	    unsafe peer, see <seeguide
	    marker="configure_algos#example-9">Example 9</seeguide>
	    in the User's Guide chapter <seeguide
	    marker="configure_algos">Configuring algorithms in
	    SSH</seeguide>.</p>
          <p>
	    *** POTENTIAL INCOMPATIBILITY ***</p>
          <p>
	    Own Id: OTP-17259 Aux Id: OTP-16511, ERIERL-619 </p>
        </item>
        <item>
          <p>
	    Adapt ssh supervisors to the new 'significant' and
	    'auto_shutdown' flags in supervisor.</p>
          <p>
	    Own Id: OTP-17322 Aux Id: PR-4638, EEP-56, OTP-17334 </p>
        </item>
        <item>
          <p>
	    The functions public_key:ssh_encode/2,
	    public_key:ssh_decode/2,
	    public_key:ssh_hostkey_fingerprint/1 and
	    public_key:ssh_hostkey_fingerprint/2 are deprecated.</p>
          <p>
	    Replacement functions are available in SSH, see the
	    <seeguide
	    marker="system/general_info:deprecations#otp-24">Deprecations</seeguide>
	    chapter in the Erlang/OTP documentation.</p>
          <p>
	    Own Id: OTP-17352</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.11.1.6</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Binaries can be limited in logs with the parameter
	    <c>max_log_item_len</c>. The default value is 500 bytes.</p>
          <p>
	    Own Id: OTP-18094</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.11.1.5</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Fixed problem with blocked server after multiple
	    restarts. Applies to daemons with options
	    <c>{parallel_login,true}</c> and also <c>{max_sessions,
	    int()&gt;0}</c>.</p>
          <p>
	    Own Id: OTP-17835 Aux Id: ERIERL-721 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.11.1.4</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    The value of the <c>connect_timeout</c> option is now
	    used as default value for the negotiation timeout.</p>
          <p>
	    Own Id: OTP-17707 Aux Id: ERIERL-706 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.11.1.3</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Filter out sensitive data (passwords etc) from progress
	    reports and supervisor reports.</p>
          <p>
	    Own Id: OTP-17468 Aux Id: ERIERL-656 </p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    The "Key exchange failed" Info Report is now more
	    informative.</p>
          <p>
	    Own Id: OTP-17450 Aux Id: ERIERL-655 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.11.1.2</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Avoid an extra blank line in the ssh known_hosts file</p>
          <p>
	    Own Id: OTP-17427</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.11.1.1</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Fixed that a slow start (>30s) of a client subsystem
	    could cause a log entry with the password.</p>
          <p>
	    Own Id: OTP-17390 Aux Id: ERIERL-648 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.11.1</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    The idle_time timer was not cancelled when a channel was
	    opened within the timeout time on an empty connection
	    that have had channels previously.</p>
          <p>
	    Own Id: OTP-17279</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.11</title>

    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    The long name field in SSH_FXP_NAME responses to display
	    file information in sftp version 3 now contains the
	    expanded format defined in the sftp draft. It is similar
	    to what is returned by "ls -l" on Unix systems.</p>
          <p>
	    Own Id: OTP-17197 Aux Id: PR- 3049 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.10.8</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Don't timeout slow connection setups and tear-downs. A
	    rare crash risk for the controller is also removed.</p>
          <p>
	    Own Id: OTP-17173 Aux Id: ERIERL-581 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.10.7</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    The SSH daemon erroneously replaced LF with CRLF also
	    when there was no pty requested from the server.</p>
          <p>
	    Own Id: OTP-17108 Aux Id: ERL-1442 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.10.6</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Fixed problems in the ssh cli/shell handling. Most
	    important are:</p>
          <p>
	    1) the ssh:shell function did sometimes cause the input
	    to be echoed twice,</p>
          <p>
	    2) the ssh:shell function didn't transfer the LANG and
	    LC_ALL shell variables to the connected server which
	    sometimes made Unicode handling erroneous,</p>
          <p>
	    3) Unicode was not always transferred correctly to and
	    from the peer.</p>
          <p>
	    Own Id: OTP-16799</p>
        </item>
        <item>
          <p>
	    The SSH protocol message SSH_MSG_DISCONNECT was sometimes
	    sent instead of SSH_MSG_CHANNEL_FAILURE</p>
          <p>
	    Own Id: OTP-16900</p>
        </item>
        <item>
          <p>
	    The ssh_cli module now always sends the exit-status to
	    connected clients so they can use that to check for
	    successful command execution.</p>
          <p>
	    Own Id: OTP-16908 Aux Id: PR-2753 </p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    A new option <seeerl
	    marker="ssh:ssh#option-pk_check_user"><c>pk_check_user</c></seeerl>
	    enables checking of the client's user name in the server
	    when doing public key authentication.</p>
          <p>
	    Own Id: OTP-16889</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.10.5</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    An ssh-client can take an accepted socket from a
	    listening socket and do an ssh:connect/2 on it.</p>
          <p>
	    Multiple clients on sockets accepted from the same
	    listening socket had stopped working. This is corrected
	    now.</p>
          <p>
	    Own Id: OTP-17021 Aux Id: ERIERL-567 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.10.4.1</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Filter out sensitive data (passwords etc) from progress
	    reports and supervisor reports.</p>
          <p>
	    Own Id: OTP-17468 Aux Id: ERIERL-656 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.10.4</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    The inet option raw was not passed on from the ssh option
	    list to inet.</p>
          <p>
	    Own Id: OTP-17016 Aux Id: ERIERL-562 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.10.3</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    A supervisor sub-tree could be left if the connection
	    handler process is brutally killed. This will make the
	    max_sessions checking option to count the existing
	    sessions erroneously and could finally block further
	    sessions.</p>
          <p>
	    Own Id: OTP-17006 Aux Id: ERIERL-556 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.10.2</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Fix decoder bug.</p>
          <p>
	    Own Id: OTP-16904</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.10.1</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Fixed a bug when a message to ssh-agent was divided into
	    separate packets.</p>
          <p>
	    Own Id: OTP-16761 Aux Id: PR-2679 </p>
        </item>
        <item>
          <p>
	    Fix a bug that could crash the cli server if a too large
	    cli-window was requested from the client.</p>
          <p>
	    Own Id: OTP-16791 Aux Id: ERIERL-520 </p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    Increased test coverage.</p>
          <p>
	    Own Id: OTP-14106</p>
        </item>
        <item>
          <p>
	    A chapter about <seeguide
	    marker="ssh:hardening">hardening the OTP SSH</seeguide>
	    is added to the User's Guide.</p>
          <p>
	    Own Id: OTP-16411</p>
        </item>
        <item>
          <p>
	    The internal Diffie-Hellman high level API for key
	    generation was slow in old and by OpenSSL now unsupported
	    cryptolib versions (1.0.1 and earlier).</p>
          <p>
	    If such a cryptolib is used anyhow, the low-level API is
	    used internally in the crypto application.</p>
          <p>
	    Own Id: OTP-16774</p>
        </item>
        <item>
          <p>
	    A new timeout is defined for daemons: <seetype
	    marker="ssh:ssh#hello_timeout_daemon_option">hello_timeout</seetype>.</p>
          <p>
	    The timeout is supposed to be used as a simple <seeguide
	    marker="ssh:hardening#resilience-to-dos-attacks">DoS
	    attack protection</seeguide>. It closes an incoming
	    TCP-connection if no valid first SSH message is received
	    from the client within the timeout limit after the TCP
	    initial connection setup.</p>
          <p>
	    The initial value is 30s by compatibility reasons, but
	    could be lowered if needed, for example in the code or in
	    a <seeguide marker="ssh:configurations">config
	    file</seeguide>.</p>
          <p>
	    Own Id: OTP-16803</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.10</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Fix error in ssh_sftpd typespec.</p>
          <p>
	    Own Id: OTP-16363</p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    The plug-in file ssh_file.erl, that is responsible for
	    default file handling, is re-factored, optimized and
	    re-written.</p>
          <p>
	    Own Id: OTP-11688 Aux Id: OTP-12699 </p>
        </item>
        <item>
          <p>
	    OpenSSH 6.5 introduced a new file representation of keys
	    called <url
	    href="https://cvsweb.openbsd.org/src/usr.bin/ssh/PROTOCOL.key?annotate=1.1">openssh-key-v1</url>.</p>
          <p>
	    OTP/SSH had an experimental implementation of this
	    format. That implementation is now improved and supported
	    with the exception of handling encrypted keys.</p>
          <p>
	    Own Id: OTP-15434</p>
        </item>
        <item>
          <p>
	    TCP/IP port forwarding, a.k.a tunneling a.k.a
	    tcp-forward/direct-tcp is implemented. In the OpenSSH
	    client, this corresponds to the options -L and -R.</p>
          <p>
	    The client or server listens to a specified socket, and
	    when something connects to it with TCP/IP, that
	    connection is forwarded in an encrypted tunnel to the
	    peer. The peer then connects to a predefined IP/port pair
	    and then acts as a proxy.</p>
          <p>
	    See the manual, <seemfa
	    marker="ssh:ssh#tcpip_tunnel_to_server/6"><c>ssh:tcpip_tunnel_to_server/6</c></seemfa>
	    and <seemfa
	    marker="ssh:ssh#tcpip_tunnel_from_server/6"><c>ssh:tcpip_tunnel_from_server/6</c></seemfa>.</p>
          <p>
	    The functionality is disabled per default but can be
	    enabled when starting a daemon.</p>
          <p>
	    Own Id: OTP-15998 Aux Id: PR-2376, PR-2368 </p>
        </item>
        <item>
          <p>
	    The client-side of the supervisor tree (under sshc_sup)
	    was previously not complete; the channel handling
	    processes were handled with links but had no supervisors.</p>
          <p>
	    This is now corrected with a client-side supervisor tree
	    under <c>sshc_sup</c>, similar to the server-side
	    supervisor tree under <c>sshd_sup</c>.</p>
          <p>
	    Own Id: OTP-16026 Aux Id: PR-2368, (OTP-15998) </p>
        </item>
        <item>
          <p>
	    The extension <url
	    href="https://cvsweb.openbsd.org/src/usr.bin/ssh/PROTOCOL?annotate=HEAD">posix-rename@openssh.com</url>
	    is added to the <seemfa
	    marker="ssh:ssh_sftp#rename/3">ssh/sftp rename</seemfa>
	    operation.</p>
          <p>
	    Own Id: OTP-16289 Aux Id: PR-2448 </p>
        </item>
        <item>
          <p>
	    Calls of deprecated functions in the <seeguide
	    marker="crypto:new_api#the-old-api">Old Crypto
	    API</seeguide> are replaced by calls of their <seeguide
	    marker="crypto:new_api#the-new-api">substitutions</seeguide>.</p>
          <p>
	    Own Id: OTP-16346</p>
        </item>
        <item>
          <p>
	    The default known_hosts file handling is improved to
	    include ports.</p>
          <p>
	    The handling of the contents in that file is updated to
	    support the <url
	    href="https://man.openbsd.org/sshd#SSH_KNOWN_HOSTS_FILE_FORMAT">full
	    syntax</url>, with exception of 1) the wildcard '?', 2)
	    wildcards in canonical names and 3) the option
	    '@cert-authority'</p>
          <p>
	    Own Id: OTP-16506</p>
        </item>
        <item>
          <p>
	    The MAC (Message Authorization Code) algorithms</p>
	    <list> <item>hmac-sha1-etm@openssh.com</item>
	    <item>hmac-sha2-256-etm@openssh.com</item>
	    <item>hmac-sha2-512-etm@openssh.com</item> </list> <p>are
	    implemented.</p>
          <p>
	    Own Id: OTP-16508</p>
        </item>
        <item>
          <p>
	    The key-exchange algorithms
	    <c>'diffie-hellman-group14-sha1'</c> and
	    <c>'diffie-hellman-group-exchange-sha1'</c> are disabled
	    per default. The reason is that SHA1 now is considered
	    insecure.</p>
          <p>
	    They can be enabled if needed, see <seeapp
	    marker="ssh:SSH_app#algorithms">SSH (App)</seeapp>.</p>
          <p>
	    *** POTENTIAL INCOMPATIBILITY ***</p>
          <p>
	    Own Id: OTP-16509</p>
        </item>
        <item>
          <p>
	    The public key algorithm <c>'ssh-dss'</c> is disabled per
	    default. The reason is that it is now considered as
	    insecure.</p>
          <p>
	    It can be enabled if needed, see <seeapp
	    marker="ssh:SSH_app#algorithms">SSH (App)</seeapp>.</p>
          <p>
	    *** POTENTIAL INCOMPATIBILITY ***</p>
          <p>
	    Own Id: OTP-16510</p>
        </item>
        <item>
          <p>
	    The public key <c>'ssh-rsa'</c> is now considered as
	    insecure because of its usage of SHA1.</p>
          <p>
	    It is therefore deprecated and will no longer be enabled
	    per default in OTP-24.0.</p>
          <p>
	    *** POTENTIAL INCOMPATIBILITY ***</p>
          <p>
	    Own Id: OTP-16511</p>
        </item>
        <item>
          <p>
	    An option <seetype
	    marker="ssh:ssh_file#optimize_key_lookup">optimize
	    (optimize_key_lookup)</seetype> is introduced for the
	    file interface ssh_file.erl</p>
          <p>
	    The option enables the user to select between the default
	    handling which is fast but memory consuming vs memory
	    efficient but not as fast. The effect might be observable
	    only for large files.</p>
          <p>
	    See the manual for <seemfa
	    marker="ssh:ssh_file#is_host_key/5">ssh_file:is_host_key/5</seemfa>
	    and <seemfa
	    marker="ssh:ssh_file#is_auth_key/3">ssh_file:is_auth_key/3</seemfa>.</p>
          <p>
	    Own Id: OTP-16512</p>
        </item>
        <item>
          <p>
	    The ssh agent is now implemented in the ssh_agent key
	    callback module. </p>
          <p>
	    Enable with the the option <c> {key_cb, {ssh_agent,
	    []}}</c> in for example ssh:connect/3.</p>
          <p>
	    See the <seeerl marker="ssh:ssh_agent">ssh_agent
	    manual</seeerl> for details.</p>
          <p>
	    Own Id: OTP-16513</p>
        </item>
        <item>
          <p>
	    Algorithm configuration could now be done in a .config
	    file.</p>
          <p>
	    This is useful for example to enable an algorithm that is
	    disabled by default. It could now be enabled in an
	    .config-file without changing the code,</p>
          <p>
	    See the SSH User's Guide chapter <seeguide
	    marker="ssh:configurations">"Configuration in
	    SSH"</seeguide>.</p>
          <p>
	    Own Id: OTP-16540</p>
        </item>
        <item>
          <p>
	    Documented which gen_tcp socket options can't be used in
	    calls to ssh:connect and ssh:daemon.</p>
          <p>
	    Own Id: OTP-16589</p>
        </item>
        <item>
          <p>
	    Added <seetype
	    marker="ssh:ssh#kb_int_fun_4">kb_int_fun_4()</seetype> to
	    the <seetype
	    marker="ssh:ssh#authentication_daemon_options">authentication_daemon_options()</seetype>
	    to enable generating dynamic keyboard-interactive prompts
	    from the user's state returned from the authentication
	    fun <seetype
	    marker="ssh:ssh#pwdfun_4">pwdfun_4()</seetype>.</p>
          <p>
	    Own Id: OTP-16622 Aux Id: PR-2604 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.9.1.4</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    The value of the <c>connect_timeout</c> option is now
	    used as default value for the negotiation timeout.</p>
          <p>
	    Own Id: OTP-17707 Aux Id: ERIERL-706 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.9.1.3</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    The idle_time timer was not cancelled when a channel was
	    opened within the timeout time on an empty connection
	    that have had channels previously.</p>
          <p>
	    Own Id: OTP-17279</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.9.1.2</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Fix decoder bug.</p>
          <p>
	    Own Id: OTP-16904</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.9.1.1</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Fix a bug that could crash the cli server if a too large
	    cli-window was requested from the client.</p>
          <p>
	    Own Id: OTP-16791 Aux Id: ERIERL-520 </p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    A new timeout is defined for daemons:
	    <c>hello_timeout</c>.</p>
          <p>
	    It closes an incoming TCP-connection if no valid 1st
	    message is received from the client within the timeout
	    limit.</p>
          <p>
	    Own Id: OTP-16803</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.9.1</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Potential hazard between re-keying decision and socket
	    close.</p>
          <p>
	    Own Id: OTP-16462 Aux Id: ERIERL-464 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.9</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Unicode problems for ssh_sftp:write fixed.</p>
          <p>
	    Own Id: OTP-16377</p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    Changes to the internal api of the experimental ssh_dbg
	    tool.</p>
          <p>
	    Own Id: OTP-16353</p>
        </item>
        <item>
          <p>
	    The new functions <seemfa
	    marker="ssh:ssh#set_sock_opts/2">ssh:set_sock_opts/2</seemfa>
	    and <seemfa
	    marker="ssh:ssh#get_sock_opts/2">ssh:get_sock_opts/2</seemfa>
	    sets and reads option values for the underlying TCP
	    stream.</p>
          <p>
	    Own Id: OTP-16485</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.8.2</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Fixed that <c>ssh_connection:send</c> could allocate a
	    large amount of memory if given an iolist() as input
	    data.</p>
          <p>
	    Own Id: OTP-16373</p>
        </item>
        <item>
          <p>
	    Safe atom conversions.</p>
          <p>
	    Own Id: OTP-16375</p>
        </item>
        <item>
          <p>
	    Constant time comparisons added.</p>
          <p>
	    Own Id: OTP-16376</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.8.1</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    The ssh cli (e.g shell) server behaved strangely when
	    characters were inserted in a string such that the last
	    characters tried to wrap the line.</p>
          <p>
	    Own Id: OTP-14849 Aux Id: ERL-545 </p>
        </item>
        <item>
          <p>
	    If an OTP SSH server was serving an "exec" request and
	    the executed code used Erlang <c>standard_io</c> for
	    input/output, the I/O was erroneously handled by the
	    *server's* group leader, so the I/O turned up in the the
	    server's Erlang shell (if any). The user at the client
	    side did therefore not see that I/O.</p>
          <p>
	    This is corrected now, so the client - for example the
	    ssh OS shell command - handles the I/O. The user could
	    send input to the server side exec handling code by
	    writing on the terminal, and server side output from for
	    example io:format is presented on the terminal - not only
	    the functional result.</p>
          <p>
	    NOTE 1: Servers executing exec requests with the old,
	    undocumented ways of specifying the custom exec handler
	    is not changed. Changed are only the two cases where the
	    server's 'exec' option either:<br/> 1) is not specified
	    (i.e. using the default shell) or, <br/> 2) it has the
	    <c>{direct, fun(...) -&gt; ... end}</c> value format.</p>
          <p>
	    NOTE 2: Previously an end-of-line marker was appended on
	    the result and error reports at the client side. They are
	    removed now and the error reports are slightly enhanced.</p>
          <p>
	    TECHNICAL DETAILS: The server's device
	    <c>standard_input</c> receives data events from the exec
	    request's channel, and the device <c>standard_output</c>
	    is sending its data by data events to the client on that
	    channel. The result is that <c>standard_io</c> is now
	    performed by the client's group leader.</p>
          <p>
	    Own Id: OTP-15417 Aux Id: OTP-16108 </p>
        </item>
        <item>
          <p>
	    The functions ssh:shell/1,2,3 left the connection open
	    when they returned. That leakage is fixed now.</p>
          <p>
	    Own Id: OTP-16047</p>
        </item>
        <item>
          <p>
	    Corrected that an Erlang SSH server could return the
	    status code 4294967295 instead of 255 on some errors of
	    an exec request.</p>
          <p>
	    Own Id: OTP-16123</p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    Internal simplification of ssh_sftp/ssh_xfer</p>
          <p>
	    Own Id: OTP-15972</p>
        </item>
        <item>
          <p>
	    The documentation of <seeguide
	    marker="ssh:using_ssh#one-time-execution">One-Time
	    Execution</seeguide> in the User's Guide is updated with
	    more examples.</p>
          <p>
	    Own Id: OTP-16108 Aux Id: OTP-15417 </p>
        </item>
        <item>
          <p>
	    The new value <c>'disabled'</c> is introduced in the SSH
	    daemon options 'exec' and 'shell'. Previously they lacked
	    a clear way of disabling them.</p>
          <p>
	    Own Id: OTP-16113</p>
        </item>
        <item>
          <p>
	    The old algorithms 'aes192_cbc', 'aes256_cbc' and
	    'hmac-sha1-96' are added for compatibility with older
	    peers.</p>
          <p>
	    The mac 'hmac-sha1-96' is nowadays not recommended and
	    must therefore be explicitly enabled. Use for example the
	    Option value <c>{modify_algorithms, [{append,
	    [{mac,['hmac-sha1-96']}]}]}</c></p>
          <p>
	    Own Id: OTP-16170</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.8</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Fixed wrong type definition for the daemon option
	    <c>subsystems</c>.</p>
          <p>
	    Own Id: OTP-15820</p>
        </item>
        <item>
          <p>
	    Fixed a possible SSH logging crash if there was a problem
	    in an early stage of session setup.</p>
          <p>
	    Own Id: OTP-15962 Aux Id: ERL-990 </p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    The documentation for the modules ssh_connection,
	    ssh_sftp and ssh_sftpd are now generated from the
	    -spec:s.</p>
          <p>
	    Own Id: OTP-15395</p>
        </item>
        <item>
          <p>
	    Internal cleanup including removal of the internal file
	    <c>ssh_userauth.hrl</c>.</p>
          <p>
	    Own Id: OTP-15876 Aux Id: PR-2255, PR-2256 </p>
        </item>
        <item>
          <p>
	    Removed unused definitions in <c>ssh.hrl</c>.</p>
          <p>
	    Own Id: OTP-15929 Aux Id: PR-2297 </p>
        </item>
        <item>
          <p>
	    Removed unused fields in the internal
	    <c>#connection{}</c> record.</p>
          <p>
	    Own Id: OTP-15984</p>
        </item>
        <item>
          <p>
	    To get information of a <c>connection_ref()</c> from for
	    example <c>ssh:connect/3</c>, there was previously one
	    function available namely <c>ssh:connection_info/2</c>.
	    This ticket adds <c>ssh:connection_info/1</c> which
	    returns all information.</p>
          <p>
	    For daemons (servers) started with for example
	    <c>ssh:daemon/2</c> the function <c>ssh:daemon_info/1</c>
	    returning all information was available. This ticket adds
	    <c>ssh:daemon_info/2</c> which returns only the
	    information specified in the second argument.</p>
          <p>
	    The info of connections and of daemons now also includes
	    the item '<c>options</c>'. Only those options that does
	    not have their default values are returned.</p>
          <p>
	    For a connection also the items '<c>algorithms</c>' and
	    '<c>channels</c>' are added.</p>
          <p>
	    Own Id: OTP-16040</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.7.7</title>

    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    SSH uses the new crypto API.</p>
          <p>
	    Own Id: OTP-15673</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.7.6.6</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    The idle_time timer was not cancelled when a channel was
	    opened within the timeout time on an empty connection
	    that have had channels previously.</p>
          <p>
	    Own Id: OTP-17279</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.7.6.5</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Fix decoder bug.</p>
          <p>
	    Own Id: OTP-16904</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.7.6.4</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Potential hazard between re-keying decision and socket
	    close.</p>
          <p>
	    Own Id: OTP-16462 Aux Id: ERIERL-464 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.7.6.3</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Fixed that <c>ssh_connection:send</c> could allocate a
	    large amount of memory if given an iolist() as input
	    data.</p>
          <p>
	    Own Id: OTP-16373</p>
        </item>
        <item>
          <p>
	    Safe atom conversions.</p>
          <p>
	    Own Id: OTP-16375</p>
        </item>
        <item>
          <p>
	    Constant time comparisons added.</p>
          <p>
	    Own Id: OTP-16376</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.7.6.2</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    The ssh cli (e.g shell) server behaved strangely when
	    characters were inserted in a string so that the last
	    characters tried to wrap the line.</p>
          <p>
	    Own Id: OTP-14849 Aux Id: ERL-545 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.7.6.1</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Fixed a possible SSH logging crash if there was a problem
	    in an early stage of session setup.</p>
          <p>
	    Own Id: OTP-15962 Aux Id: ERL-990 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.7.6</title>

    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    When an SSH server receives the very first message on a
	    new TCP connection, and that message is not the expected
	    one, the 64 first bytes of the received message are now
	    dumped in the INFO REPORT that reports the Protocol
	    Error.</p>
          <p>
	    This facilitates the debugging of who sends the bad
	    message or of detecting a possible port scanning.</p>
          <p>
	    Own Id: OTP-15772</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.7.5</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    The callback <c>ssh_channel:init/1</c> was missing in
	    OTP-21</p>
          <p>
	    Own Id: OTP-15762</p>
        </item>
        <item>
          <p>
	    If a client was connected to an server on an already open
	    socket, the callback <c>fun(PeerName,FingerPrint)</c> in
	    the <c>accept_callback</c> option passed the local name
	    in the argument PeerName instead of the remote name.</p>
          <p>
	    Own Id: OTP-15763</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.7.4</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    SSH sftp daemon now accepts an SSH_FXP_STAT message
	    encoded according to the wrong sftp version. Some clients
	    sends such messages.</p>
          <p>
	    Own Id: OTP-15498 Aux Id: ERL-822, PR-2077 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.7.3</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Fixed port leakage if a ssh:daemon call failed.</p>
          <p>
	    Own Id: OTP-15397 Aux Id: ERL-801 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.7.2</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Incompatibility with newer OpenSSH fixed. Previously
	    versions 7.8 and later could cause Erlang SSH to exit.</p>
          <p>
	    Own Id: OTP-15413</p>
        </item>
        <item>
          <p>
	    The '<c>exec</c>' option for ssh daemons had wrong format
	    in the documentation.</p>
          <p>
	    Own Id: OTP-15416</p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    Added public key methods ssh-ed25519 and ssh-ed448.</p>
          <p>
	    Requires OpenSSL 1.1.1 or higher as cryptolib under the
	    OTP application <c>crypto</c>.</p>
          <p>
	    Own Id: OTP-15094 Aux Id: OTP-15419 </p>
        </item>
        <item>
          <p>
	    The SSH property tests are now adapted to the PropEr
	    testing tool.</p>
          <p>
	    Own Id: OTP-15312</p>
        </item>
        <item>
          <p>
	    The term "user" was not documented in the SSH app. A new
	    chapter with terminology is added to the User's Manual
	    where the term "user" is defined.</p>
          <p>
	    A reference manual page about the module <c>ssh_file</c>
	    is also added. This is the default callback module for
	    user's keys, host keys etc.</p>
          <p>
	    Own Id: OTP-15314</p>
        </item>
        <item>
          <p>
	    Host and user key checking is made more robust.</p>
          <p>
	    Own Id: OTP-15424</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.7.1</title>

    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    Extended the undocumented <c>ssh_dbg</c> debug module
	    with an api for a circular trace buffer. This makes it
	    easy to record the last low-level events before an error
	    is detected. It is intended for solving difficult errors.</p>
          <p>
	    Own Id: OTP-15020</p>
        </item>
        <item>
          <p>
	    The key exchange methods
	    <c>'curve25519-sha256@libssh.org'</c>,
	    <c>'curve25519-sha256'</c> and <c>'curve448-sha512'</c>
	    are implemented. The last two are defined in
	    https://tools.ietf.org/html/draft-ietf-curdle-ssh-curves</p>
          <p>
	    They all depends on that OpenSSL 1.1.1 or higher is used
	    as cryptolib.</p>
          <p>
	    Own Id: OTP-15133 Aux Id: OTP-15240 </p>
        </item>
        <item>
          <p>
	    The cipher '<c>chacha20-poly1305@openssh.com</c>' is now
	    supported if OpenSSL 1.1.1 or higher is used as
	    cryptolib.</p>
          <p>
	    Own Id: OTP-15209 Aux Id: OTP-15164 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.7</title>
    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    If the daemon port listener is restarted, it could
	    potentially fail with <c>eaddrinuse</c> if the timing is
	    unlucky. It will now retry and exponentially back off the
	    listener restart a few times before failing.</p>
          <p>
	    Own Id: OTP-14955</p>
        </item>
        <item>
          <p>
	    A channel callback module always got the module name as
	    reason in a call to terminate. Now it will get the proper
	    Reason, usually 'normal'.</p>
          <p>
	    Own Id: OTP-15084</p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    The option <c>exec</c> has new option values defined to
	    make it much more easy to implement an own <c>exec</c>
	    server.</p>
          <p>
	    An option called <c>exec</c> for daemons implementing the
	    handling of 'exec' requests has existed a long time but
	    has been undocumented. The old undocumented value - as
	    well as its behavior - is kept for compatibility EXCEPT
	    that error messages are changed and are sent as
	    "stderror" text.</p>
          <p>
	    *** POTENTIAL INCOMPATIBILITY ***</p>
          <p>
	    Own Id: OTP-14851</p>
        </item>
        <item>
          <p>
	    Updated ssh_connection:shell/2 documentation.</p>
          <p>
	    Own Id: OTP-14880</p>
        </item>
        <item>
          <p>
	    The experimental <c>ssh_dbg</c> module is completely
	    re-written. Its purpose is to make tracing and debugging
	    easier on deployed systems.</p>
          <p>
	    Own Id: OTP-14896</p>
        </item>
        <item>
          <p>
	    The SSH supervisor structure has been slightly changed.
	    This makes stopping the ssh application considerably
	    faster if there are open connections. This is important
	    in for example restarts.</p>
          <p>
	    Own Id: OTP-14988</p>
        </item>
        <item>
          <p>
	    The type specifications in SSH are completely reworked and
	    the following types are renamed:</p>
          <p>
	    <c>ssh:ssh_connection_ref()</c> is changed to
	    <c>ssh:connection_ref()</c>, </p>
          <p>
	    <c>ssh:ssh_daemon_ref()</c> is changed to
	    <c>ssh:daemon_ref()</c>,</p>
          <p>
	    <c>ssh:ssh_channel_id()</c> is changed to
	    <c>ssh:channel_id()</c>.</p>
          <p>
	    *** POTENTIAL INCOMPATIBILITY ***</p>
          <p>
	    Own Id: OTP-15002 Aux Id: OTP-15030 </p>
        </item>
        <item>
          <p>
	    The internal timer handling in SSH is now based on the
	    gen_statem timers.</p>
          <p>
	    Own Id: OTP-15019</p>
        </item>
        <item>
          <p>
	    Removed the undocumented and unused modules
	    <c>ssh_client_key.erl</c> and <c>ssh_server_key.erl</c>.</p>
          <p>
	    Own Id: OTP-15028</p>
        </item>
        <item>
          <p>
	    The Reference Manual pages are partly updated.</p>
          <p>
	    The ssh page is now generated from specs and types, is
	    restructured and is partly rephrased.</p>
          <p>
	    The ssh_channel, ssh_connection, ssh_client_key_api,
	    ssh_server_key_api and ssh_sftp pages are updated with
	    links, correct type names and some minor changes.</p>
          <p>
	    Own Id: OTP-15030 Aux Id: OTP-15002 </p>
        </item>
        <item>
          <p>
	    The behaviors <c>ssh_channel</c> and
	    <c>ssh_daemon_channel</c> are renamed to
	    <c>ssh_client_channel</c> and <c>ssh_server_channel</c>
	    respectively.</p>
          <p>
	    The old modules are kept for compatibility but should
	    preferably be replaced when updating callback modules
	    referring them.</p>
          <p>
	    Own Id: OTP-15041</p>
        </item>
        <item>
          <p>
	    New test suite for channels.</p>
          <p>
	    Own Id: OTP-15051</p>
        </item>
        <item>
          <p>
	    The <c>rekey_limit</c> option could now set the max time
	    as well as the previously max data amount.</p>
          <p>
	    Own Id: OTP-15069 Aux Id: ERL-617 </p>
        </item>
        <item>
          <p>
	    Changed process exit supervision from links to monitors.</p>
          <p>
	    Own Id: OTP-15082</p>
        </item>
        <item>
          <p>
	    Better handling of misbehaving channel callback modules.</p>
          <p>
	    Own Id: OTP-15083</p>
        </item>
        <item>
          <p>
	    A new moduli file is generated. This file is used for the
	    recommended <c>diffie-hellman-group-exchange-sha256</c>
	    key exchange algorithm in SSH.</p>
          <p>
	    Own Id: OTP-15113</p>
        </item>
      </list>
    </section>
</section>

<section><title>Ssh 4.6.9.7</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Fixed possible hanging in <c>ssh_sftp:stop_channel/1</c>.</p>
          <p>
	    Own Id: OTP-16507 Aux Id: ERIERL-470 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.6.9.6</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Fixed that <c>ssh_connection:send</c> could allocate a
	    large amount of memory if given an iolist() as input
	    data.</p>
          <p>
	    Own Id: OTP-16373</p>
        </item>
        <item>
          <p>
	    Safe atom conversions.</p>
          <p>
	    Own Id: OTP-16375</p>
        </item>
        <item>
          <p>
	    Constant time comparisons added.</p>
          <p>
	    Own Id: OTP-16376</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.6.9.5</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    The ssh cli (e.g shell) server behaved strangely when
	    characters were inserted in a string so that the last
	    characters tried to wrap the line.</p>
          <p>
	    Own Id: OTP-14849 Aux Id: ERL-545 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.6.9.4</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    If a client was connected to an server on an already open
	    socket, the callback <c>fun(PeerName,FingerPrint)</c> in
	    the <c>accept_callback</c> option passed the local name
	    in the argument PeerName instead of the remote name.</p>
          <p>
	    Own Id: OTP-15763</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.6.9.3</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Fixed port leakage if a ssh:daemon call failed.</p>
          <p>
	    Own Id: OTP-15397 Aux Id: ERL-801 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.6.9.2</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Incompatibility with newer OpenSSH fixed. Previously
	    versions 7.8 and later could cause Erlang SSH to exit.</p>
          <p>
	    Own Id: OTP-15413</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.6.9.1</title>
    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    SFTP clients reported the error reason <c>""</c> if a
	    non-OTP sftp server was killed during a long file
	    transmission.</p>
          <p>
	    Now the signal name (for example <c>"KILL"</c>) will be
	    the error reason if the server's reason is empty.</p>
          <p>
	    The documentation also lacked type information about this
	    class of errors.</p>
          <p>
	    Own Id: OTP-15148 Aux Id: ERIERL-194 </p>
        </item>
        <item>
          <p>
	    Fix ssh_sftp decode error for sftp protocol version 4</p>
          <p>
	    Own Id: OTP-15149 Aux Id: ERIERL-199 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.6.9</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Host key hash erroneously calculated for clients
	    following draft-00 of RFC 4419, for example PuTTY</p>
          <p>
	    Own Id: OTP-15064</p>
        </item>
        <item>
          <p>
	    Renegotiation could fail in some states</p>
          <p>
	    Own Id: OTP-15066</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.6.8</title>
    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    An ssh_sftp server (running version 6) could fail if it
	    is told to remove a file which in fact is a directory.</p>
          <p>
	    Own Id: OTP-15004</p>
        </item>
        <item>
          <p>
	    Fix rare spurious shutdowns of ssh servers when receiving
	    <c>{'EXIT',_,normal}</c> messages.</p>
          <p>
	    Own Id: OTP-15018</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.6.7</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Fix bad spec in ssh.hrl: <c>double_algs()</c>.</p>
          <p>
	    Own Id: OTP-14990</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.6.6</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Remove a blocking risk when a channel is closed and an
	    operation is tried on that channel after at least a
	    second's time gap.</p>
          <p>
	    Own Id: OTP-14939</p>
        </item>
      </list>
    </section>
    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    Added ssh_compat_SUITE.</p>
          <p>
	    This suite contains a number of interoperability tests
	    mainly with OpenSSH. The tests start docker containers
	    with different OpenSSH and OpenSSL/LibreSSLcryptolib
	    versions and performs a number of tests of supported
	    algorithms.</p>
          <p>
	    All login methods and all user's public key types are
	    tested both for the client and the server.</p>
          <p>
	    All algorithms for kex, cipher, host key, mac and
	    compressions are tested with a number of exec and sftp
	    tests, both for the client and the server.</p>
          <p>
	    Own Id: OTP-14194 Aux Id: OTP-12487 </p>
        </item>
        <item>
          <p>
	    Default exec is disabled when a user-defined shell is
	    enabled.</p>
          <p>
	    Own Id: OTP-14881</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.6.5</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Adjusted supervisor timeouts</p>
          <p>
	    Own Id: OTP-14907</p>
        </item>
        <item>
          <p>
	    Remove ERROR messages for slow process exits</p>
          <p>
	    Own Id: OTP-14930</p>
        </item>
      </list>
    </section>

    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    Add option <c>save_accepted_host</c> to
	    <c>ssh:connection</c>. This option, if set to false,
	    inhibits saving host keys to e.g the file
	    <c>known_hosts</c>.</p>
          <p>
	    Own Id: OTP-14935</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.6.4</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Fix problem with OpenSSH 7.2 (and later) clients that has
	    used sha1 instead of sha2 for rsa-sha-256/512 user's
	    public keys.</p>
          <p>
	    Own Id: OTP-14827 Aux Id: ERL-531 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.6.3</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Passphrase option for ecdsa public keys was missing.</p>
          <p>
	    Own Id: OTP-14602</p>
        </item>
      </list>
    </section>

    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    The host and user public key handling is hardened so that
	    a faulty plugin can't deliver a key of wrong type.</p>
          <p>
	    Better checks in the server of the available hostkey's
	    types at start and at each accept.</p>
          <p>
	    Better checks in the client of the available user public
	    key types at connect.</p>
          <p>
	    Own Id: OTP-14676 Aux Id: ERIERL-52, OTP-14570 </p>
        </item>
        <item>
          <p>
	    SSH can now fetch the host key from the private keys
	    stored in an Engine. See the crypto application for
	    details about Engines.</p>
          <p>
	    Own Id: OTP-14757</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.6.2</title>
    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Trailing white space was removed at end of the
	    hello-string. This caused interoperability problems with
	    some other ssh-implementations (e.g OpenSSH 7.3p1 on
	    Solaris 11)</p>
          <p>
	    Own Id: OTP-14763 Aux Id: ERIERL-74 </p>
        </item>
        <item>
          <p>
	    Fixes that tcp connections that was immediately closed
	    (SYN, SYNACK, ACK, RST) by a client could be left in a
	    zombie state.</p>
          <p>
	    Own Id: OTP-14778 Aux Id: ERIERL-104 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.6.1</title>
    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Fixed broken printout</p>
          <p>
	    Own Id: OTP-14645</p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    Disable aes_gcm ciphers if peer is OpenSSH 6.2 which is
	    known to have trouble with them in some cases.</p>
          <p>
	    Own Id: OTP-14638</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.6</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Enables the <c>ssh_io module</c> to also accept binary
	    values when reading standard_io instead of getting stuck
	    in the receive clause.</p>
          <p>
	    Own Id: OTP-14506 Aux Id: PR1503 </p>
        </item>
        <item>
          <p>
	    Previously, the file owner access permission in response
	    to ssh_sftp:read_file_info/2 function was always
	    <c>read_write</c>. With this fix, the actual value of
	    file owner access permission is added to the returning
	    record. That value is calculated from file mode value.</p>
          <p>
	    Own Id: OTP-14550 Aux Id: PR1533 </p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    A new option <c>modify_algorithms</c> is implemented. It
	    enables specifying changes on the default algorithms
	    list. See the reference manual and the SSH User's Guide
	    chapter "Configuring algorithms in SSH".</p>
          <p>
	    Own Id: OTP-14568</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.5.1</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    All unknown options are sent to the transport handler
	    regardless of type.</p>
          <p>
	    Own Id: OTP-14541 Aux Id: EIRERL-63 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.5</title>

    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    The internal handling of SSH options is re-written.</p>
          <p>
	    Previously there were no checks if a client option was
	    given to a daemon or vice versa. This is corrected now.
	    If your code has e.g. a client-only option in a call to
	    start a daemon, the call will fail.</p>
          <p>
	    *** POTENTIAL INCOMPATIBILITY ***</p>
          <p>
	    Own Id: OTP-12872</p>
        </item>
        <item>
          <p>
	    Modernization of key exchange algorithms. See
	    draft-ietf-curdle-ssh-kex-sha2 for a discussion.</p>
          <p>
	    Removed an outdated weak algorithm and added stronger
	    replacements to keep interoperability with other modern
	    ssh clients and servers. The default ordering of the
	    algorithms is also adjusted.</p>
          <p>
	    Retired: The nowadays unsecure key-exchange
	    <c>diffie-hellman-group1-sha1</c> is not enabled by
	    default, but can be enabled with the option
	    <c>preferred-algorithms</c>.</p>
          <p>
	    Added: The new stronger key-exchange
	    <c>diffie-hellman-group16-sha512</c>,
	    <c>diffie-hellman-group18-sha512</c> and
	    <c>diffie-hellman-group14-sha256</c> are added and
	    enabled by default.</p>
          <p>
	    The questionable [RFC 6194] sha1-based algorithms
	    <c>diffie-hellman-group-exchange-sha1</c> and
	    <c>diffie-hellman-group14-sha1</c> are however still kept
	    enabled by default for compatibility with ancient clients
	    and servers that lack modern key-exchange alternatives.
	    When the draft-ietf-curdle-ssh-kex-sha2 becomes an rfc,
	    those sha1-based algorithms and
	    <c>diffie-hellman-group1-sha1</c> will be deprecated by
	    IETF. They might then be removed from the default list in
	    Erlang/OTP.</p>
          <p>
	    *** POTENTIAL INCOMPATIBILITY ***</p>
          <p>
	    Own Id: OTP-14110</p>
        </item>
        <item>
          <p>
	    Modernized internal representation of sftp by use of
	    maps.</p>
          <p>
	    Own Id: OTP-14117</p>
        </item>
        <item>
          <p>
	    The Extension Negotiation Mechanism and the extension
	    <c>server-sig-algs</c> in
	    draft-ietf-curdle-ssh-ext-info-05 are implemented.</p>
          <p>
	    The related draft-ietf-curdle-rsa-sha2-05 is implemented
	    and introduces the signature algorithms
	    <c>rsa-sha2-256</c> and <c>rsa-sha2-512</c>.</p>
          <p>
	    Own Id: OTP-14193</p>
        </item>
        <item>
          <p>
	    The 'timeout' and 'connect_timeout' handling in
	    ssh_sftp:start_channel documentation is clarified.</p>
          <p>
	    Own Id: OTP-14216</p>
        </item>
        <item>
          <p>
	    The functions <c>ssh:connect</c>, <c>ssh:shell</c> and
	    <c>ssh:start_channel</c> now accept an IP-tuple as Host
	    destination argument.</p>
          <p>
	    Own Id: OTP-14243</p>
        </item>
        <item>
          <p>
	    The function <c>ssh:daemon_info/1</c> now returns Host
	    and Profile as well as the Port info in the property
	    list.</p>
          <p>
	    Own Id: OTP-14259</p>
        </item>
        <item>
          <p>
	    Removed the option <c>public_key_alg</c> which was
	    deprecated in 18.2. Use <c>pref_public_key_algs</c>
	    instead.</p>
          <p>
	    *** POTENTIAL INCOMPATIBILITY ***</p>
          <p>
	    Own Id: OTP-14263</p>
        </item>
        <item>
          <p>
	    The SSH application is refactored regarding daemon
	    starting. The resolution of contradicting <c>Host</c>
	    argument and <c>ip</c> option were not described. There
	    were also strange corner cases when the <c>'any'</c>
	    value was used in <c>Host</c> argument or <c>ip</c>
	    option. This is (hopefully) resolved now, but it may
	    cause incompatibilities for code using both <c>Host</c>
	    and the <c>ip</c> option. The value 'loopback' has been
	    added for a correct way of naming those addresses.</p>
          <p>
	    *** POTENTIAL INCOMPATIBILITY ***</p>
          <p>
	    Own Id: OTP-14264</p>
        </item>
        <item>
          <p>
	    The supervisor code is refactored. The naming of
	    listening IP-Port-Profile triples are slightly changed to
	    improve consistency in strange corner cases as resolved
	    by OTP-14264</p>
          <p>
	    Own Id: OTP-14267 Aux Id: OTP-14266 </p>
        </item>
        <item>
          <p>
	    The <c>idle_time</c> option can now be used in daemons.</p>
          <p>
	    Own Id: OTP-14312</p>
        </item>
        <item>
          <p>
	    Added test cases for IETF-CURDLE Extension Negotiation
	    (ext-info)</p>
          <p>
	    Own Id: OTP-14361</p>
        </item>
        <item>
          <p>
	    Testcases for IETF-CURDLE extension
	    <c>server-sig-algs</c> including <c>rsa-sha2-*</c></p>
          <p>
	    Own Id: OTP-14362 Aux Id: OTP-14361 </p>
        </item>
        <item>
          <p>
	    The option <c>auth_methods</c> can now also be used in
	    clients to select which authentication options that are
	    used and in which order.</p>
          <p>
	    Own Id: OTP-14399</p>
        </item>
        <item>
          <p>
	    Checks that a ECDSA public key (<c>ecdsa-sha2-nistp*</c>)
	    stored in a file has the correct size.</p>
          <p>
	    Own Id: OTP-14410</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.4.2.4</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Fix rare spurious shutdowns of ssh servers when receiving
	    <c>{'EXIT',_,normal}</c> messages.</p>
          <p>
	    Own Id: OTP-15018</p>
        </item>
        <item>
          <p>
	    Host key hash erroneously calculated for clients
	    following draft-00 of RFC 4419, for example PuTTY</p>
          <p>
	    Own Id: OTP-15064</p>
        </item>
        <item>
          <p>
	    Renegotiation could fail in some states</p>
          <p>
	    Own Id: OTP-15066</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.4.2.3</title>
    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    An ssh_sftp server (running version 6) could fail if it
	    is told to remove a file which in fact is a directory.</p>
          <p>
	    Own Id: OTP-15004</p>
        </item>
      </list>
    </section>
</section>

<section><title>Ssh 4.4.2.2</title>
    <section><title>Improvements and New Features</title>
    <list>
        <item>
          <p>
	    Default exec is disabled when a user-defined shell is
	    enabled.</p>
          <p>
	    Own Id: OTP-14881</p>
        </item>
      </list>
    </section>
</section>


<section><title>Ssh 4.4.2.1</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Trailing white space was removed at end of the
	    hello-string. This caused interoperability problems with
	    some other ssh-implementations (e.g OpenSSH 7.3p1 on
	    Solaris 11)</p>
          <p>
	    Own Id: OTP-14763 Aux Id: ERIERL-74 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.4.2</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    ssh:daemon_info/1 crashed if the listening IP was not
	    'any'</p>
          <p>
	    Own Id: OTP-14298 Aux Id: seq13294 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.4.1</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Fix bug when opening connections. If the tcp setup
	    failed, that would in some cases not result in an error
	    return value.</p>
          <p>
	    Own Id: OTP-14108</p>
        </item>
        <item>
          <p>
	    Reduce information leakage in case of decryption errors.</p>
          <p>
	    Own Id: OTP-14109</p>
        </item>
        <item>
          <p>
	    The key exchange algorithm
	    diffie-hellman-group-exchange-sha* has a server-option
	    <c>{dh_gex_limits,{Min,Max}}</c>. There was a hostkey
	    signature validation error on the client side if the
	    option was used and the <c>Min</c> or the <c>Max</c>
	    differed from the corresponding values obtained from the
	    client.</p>
          <p>
	    This bug is now corrected.</p>
          <p>
	    Own Id: OTP-14166</p>
        </item>
        <item>
          <p>
	    The sftpd server now correctly uses <c>root_dir</c> and
	    <c>cwd</c> when resolving file paths if both are
	    provided. The <c>cwd</c> handling is also corrected.</p>
          <p>
	    Thanks to kape1395!</p>
          <p>
	    Own Id: OTP-14225 Aux Id: PR-1331, PR-1335 </p>
        </item>
        <item>
          <p>
	    Ssh_cli used a function that does not handle non-utf8
	    unicode correctly.</p>
          <p>
	    Own Id: OTP-14230 Aux Id: ERL-364 </p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    The implementation of the key exchange algorithms
	    diffie-hellman-group-exchange-sha* are optimized, up to a
	    factor of 11 for the slowest ( = biggest and safest)
	    group size.</p>
          <p>
	    Own Id: OTP-14169 Aux Id: seq-13261 </p>
        </item>
        <item>
          <p>
	    The ssh host key fingerprint generation now also takes a
	    list of algorithms and returns a list of corresponding
	    fingerprints. See
	    <c>public_key:ssh_hostkey_fingerprint/2</c> and the
	    option <c>silently_accept_hosts</c> in
	    <c>ssh:connect</c>.</p>
          <p>
	    Own Id: OTP-14223</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.4</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    A file read with an sftp client could loose data if the
	    packet_size is set to larger than 64k. This is corrected
	    now in such a way that the packet_size is silently
	    lowered if there is a risk for data loss.</p>
          <p>
	    Own Id: OTP-13857 Aux Id: ERL-238, OTP-13858 </p>
        </item>
        <item>
          <p>
	    When user defined SSH shell REPL process exits with
	    reason normal, the SSH channel callback module should
	    report successful exit status to the SSH client. This
	    provides simple way for SSH clients to check for
	    successful completion of executed commands. (Thanks to
	    isvilen)</p>
          <p>
	    Own Id: OTP-13905 Aux Id: PR-1173 </p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    Extended the option <c>silently_accept_hosts</c> for
	    <c>ssh:connect</c> to make it possible for the client to
	    check the SSH host key fingerprint string. Se the
	    reference manual for SSH.</p>
          <p>
	    Own Id: OTP-13887 Aux Id: OTP-13888 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.3.6</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Re-negotiation problems with OpenSSH client solved.</p>
          <p>
	    Own Id: OTP-13972</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.3.5</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    If a client illegaly sends an info-line and then
	    immediately closes the TCP-connection, a badmatch
	    exception was raised.</p>
          <p>
	    Own Id: OTP-13966</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.3.4</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Intermittent ssh ERROR REPORT mentioning
	    nonblocking_sender</p>
          <p>
	    Own Id: OTP-13953 Aux Id: seq13199 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.3.3</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Handle all possible exit values that should be
	    interpreted as {error, closed}. Failing to do so could
	    lead to unexpected crashes for users of the ssh
	    application.</p>
          <p>
	    Own Id: OTP-13932 Aux Id: seq13189 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.3.2</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Upgrade of an established client connection could crash
	    because the ssh client supervisors children had wrong
	    type. This is fixed now.</p>
          <p>
	    Own Id: OTP-13782 Aux Id: seq13158 </p>
        </item>
        <item>
          <p>
	    Partly checks the public key early in public key
	    authorization</p>
          <p>
	    Own Id: OTP-13847 Aux Id:
	    defensics-ssh3.1.0-190243,205277,219318 </p>
        </item>
        <item>
          <p>
	    Corrected handling of SHA for ECDSA (Elliptic curve
	    public keys)</p>
          <p>
	    Own Id: OTP-13850 Aux Id: defensics-ssh3.1.0-214168 </p>
        </item>
        <item>
          <p>
	    Problems found by test suites as well as by
	    Codenomicon/Defensics fixed: - reduce max random padding
	    to 15 bytes (Codenomicon/Defensics) - inclomplete pdu
	    handling (Codenomicon/Defensics) - badmatch in test suite
	    - non-blocking send fixes deadlock in
	    ssh_connection_SUITE:interrupted_send</p>
          <p>
	    Own Id: OTP-13854</p>
        </item>
        <item>
          <p>
	    Caller is now notified when a tcp close is received.</p>
          <p>
	    Own Id: OTP-13859 Aux Id: seq13177 </p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    Use application:ensure_all_started/2 instead of
	    hard-coding deps</p>
          <p>
	    Own Id: OTP-13843 Aux Id: PR-1147 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.3.1</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    SSH client does not any longer retry a bad password given
	    as option to ssh:connect et al.</p>
          <p>
	    Own Id: OTP-13674 Aux Id: TR-HU92273 </p>
        </item>
        <item>
          <p>
	    Removed possible hanging risk for a certain timing
	    sequence when communicating client and server executes on
	    the same node.</p>
          <p>
	    Own Id: OTP-13715</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.3</title>

    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    A socket created and connected by gen_tcp could now be
	    used as input to ssh:connect, ssh:shell,
	    ssh_sftp:start_channel and ssh:daemon.</p>
          <p>
	    Own Id: OTP-12860</p>
        </item>
        <item>
          <p>
	    Some time optimization mainly in message encoding.</p>
          <p>
	    Own Id: OTP-13131</p>
        </item>
        <item>
          <p>
	    Optimized the sftp client time by setting new packet and
	    window sizes.</p>
          <p>
	    Own Id: OTP-13175</p>
        </item>
        <item>
          <p>
	    The <c>ssh_connection_handler</c> module in SSH is
	    changed and now uses the new behaviour <c>gen_statem</c>. </p>
          <p>
	    The module can be used as an example of a
	    <c>gen_statem</c> callback module but with a warning:
	    This commit of ssh is just a straightforward port from
	    gen_fsm to gen_statem with some code cleaning. Since the
	    state machine and the state callbacks are almost
	    unchanged the ssh module does not demonstrate the full
	    potential of the new behaviour.</p>
          <p>
	    The "new" state machine uses compound states. The ssh
	    server and client state machines are quite similar but
	    differences exist. With <c>gen_fsm</c> there were flags
	    in the user data which in fact implemented "substates".
	    Now with <c>gen_statem</c> those are made explicit in the
	    state names, eg. the state <c>userauth</c> and the binary
	    <c>role</c>-flag becomes the two state names
	    <c>{userauth, server}</c> and <c>{userauth, client}</c>.</p>
          <p>
	    Own Id: OTP-13267</p>
        </item>
        <item>
          <p>
	    The <c>{error, Reason}</c> tuples returned from
	    <c>ssh_sftp</c> api functions are described.</p>
          <p>
	    Own Id: OTP-13347 Aux Id: ERL-86 </p>
        </item>
        <item>
          <p>
	    Added -spec in ssh</p>
          <p>
	    Own Id: OTP-13479</p>
        </item>
        <item>
          <p>
	    It is now possible to call <c>ssh:daemon/{1,2,3}</c> with
	    <c>Port=0</c>. This makes the daemon select a free
	    listening tcp port before opening it. To find this port
	    number after the call, use the new function
	    <c>ssh:daemon_info/1</c>. See the reference manual for
	    details.</p>
          <p>
	    Own Id: OTP-13527</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.2.2.6</title>
    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Fix rare spurious shutdowns of ssh servers when receiving
	    <c>{'EXIT',_,normal}</c> messages.</p>
          <p>
	    Own Id: OTP-15018</p>
        </item>
      </list>
    </section>
</section>


<section><title>Ssh 4.2.2.5</title>
    <section><title>Improvements and New Features</title>
    <list>
        <item>
          <p>
	    Default exec is disabled when a user-defined shell is
	    enabled.</p>
          <p>
	    Own Id: OTP-14881</p>
        </item>
      </list>
    </section>
</section>


<section><title>Ssh 4.2.2.4</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Trailing white space was removed at end of the
	    hello-string. This caused interoperability problems with
	    some other ssh-implementations (e.g OpenSSH 7.3p1 on
	    Solaris 11)</p>
          <p>
	    Own Id: OTP-14763 Aux Id: ERIERL-74 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.2.2.3</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    The key exchange algorithm
	    diffie-hellman-group-exchange-sha* has a server-option
	    <c>{dh_gex_limits,{Min,Max}}</c>. There was a hostkey
	    signature validation error on the client side if the
	    option was used and the <c>Min</c> or the <c>Max</c>
	    differed from the corresponding values obtained from the
	    client.</p>
          <p>
	    This bug is now corrected.</p>
          <p>
	    Own Id: OTP-14166</p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    Key exchange algorithms
	    diffie-hellman-group-exchange-sha* optimized, up to a
	    factor of 11 for the slowest ( = biggest and safest) one.</p>
          <p>
	    Own Id: OTP-14169 Aux Id: seq-13261 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.2.2.2</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Upgrade of an established client connection could crash
	    because the ssh client supervisors children had wrong
	    type. This is fixed now.</p>
          <p>
	    Own Id: OTP-13782 Aux Id: seq13158 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.2.2.1</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    SSH client does not any longer retry a bad password given
	    as option to ssh:connect et al.</p>
          <p>
	    Own Id: OTP-13674 Aux Id: TR-HU92273 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.2.2</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Documentation correction of <c>ssh_sftp:position/4</c></p>
          <p>
	    Thanks to Rabbe Fogelholm.</p>
          <p>
	    Own Id: OTP-13305 Aux Id: ERL-87 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.2.1</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    The authentication method 'keyboard-interactive' failed
	    in the Erlang client when the server after successful
	    authentication continued by asking for zero more
	    passwords.</p>
          <p>
	    Own Id: OTP-13225</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.2</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Better error handling in ssh_file. There was some rare
	    errors when a NFS-mounted file was opened by ssh_file and
	    then remotely deleted during reading. That caused an
	    endless loop. </p>
          <p>
	    That bug is now fixed.</p>
          <p>
	    Own Id: OTP-12699 Aux Id: OTP-11688 </p>
        </item>
        <item>
          <p>
	    Fixed a bug in the compression algorithm
	    zlib@openssh.com.</p>
          <p>
	    Own Id: OTP-12759</p>
        </item>
        <item>
          <p>
	    It is now possible to start more than one daemon with a
	    file descriptor given in option fd. Each daemon must of
	    course have a unique file descriptor.</p>
          <p>
	    Own Id: OTP-12966 Aux Id: seq12945 </p>
        </item>
        <item>
          <p>
	    Fixed a bug that caused the option <c>dh_gex_limit</c> to
	    be ignored.</p>
          <p>
	    Own Id: OTP-13029</p>
        </item>
        <item>
          <p>
	    A problem is fixed with the <c>ssh:connect</c> option
	    <c>pref_public_key_algs</c> specifying user keys.</p>
          <p>
	    Own Id: OTP-13158</p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    Document updates in the ssh reference manual: app doc
	    file and ssh_connection.</p>
          <p>
	    Own Id: OTP-12003</p>
        </item>
        <item>
          <p>
	    The authorization phase is made stateful to prevent ssh
	    acting on messages sent in wrong order.</p>
          <p>
	    Own Id: OTP-12787</p>
        </item>
        <item>
          <p>
	    Testcases for bad message lengths and for bad subfield
	    lengths added.</p>
          <p>
	    Own Id: OTP-12792 Aux Id: Codenomicon #5214, 6166 </p>
        </item>
        <item>
          <p>
	    The 'ecdsa-sha2-nistp256', 'ecdsa-sha2-nistp384' and
	    'ecdsa-sha2-nistp521' signature algorithms for ssh are
	    implemented. See RFC 5656.</p>
          <p>
	    Own Id: OTP-12936</p>
        </item>
        <item>
          <p>
	    The crypto algorithms 'aes192-ctr' and 'aes256-ctr' are
	    implemented. See RFC 4344.</p>
          <p>
	    Own Id: OTP-12939</p>
        </item>
        <item>
          <p>
	    The ciphers and macs AEAD_AES_128_GCM and
	    AEAD_AES_256_GCM are implemented but not enabled per
	    default. See the SSH App Reference Manual and RFC5647 for
	    details.</p>
          <p>
	    The ciphers aes128-gcm@openssh.com and
	    aes256-gcm@openssh.com are also implemented and available
	    in the default configuration.</p>
          <p>
	    Own Id: OTP-13018</p>
        </item>
        <item>
          <p>
	    The ssh:daemon option dh_gex_groups is extended to read a
	    user provided ssh moduli file with generator-modulus
	    pairs. The file is in openssh format.</p>
          <p>
	    Own Id: OTP-13052 Aux Id: OTP-13054 </p>
        </item>
        <item>
          <p>
	    There is now a file (public_key/priv/moduli) which lists
	    size-generator-modulus triples. The purpose is to give
	    servers the possibility to select the crypto primes
	    randomly among a list of pregenerated triples. This
	    reduces the risk for some attacks on diffie-hellman
	    negotiation.</p>
          <p>
	    See the reference manual for public_key:dh_gex_group/4
	    where the handling of this is described.</p>
          <p>
	    The ssh server (ssh:daemon) uses this.</p>
          <p>
	    Own Id: OTP-13054 Aux Id: OTP-13052 </p>
        </item>
        <item>
          <p>
	    The ssh:daemon option pwdfun now also takes a fun/4. This
	    enables the user to 1) check userid-password in another
	    way than the builtin algorithm, 2) implement rate
	    limiting per user or source IP or IP+Port, and 3)
	    implement blocking of missbehaving peers.</p>
          <p>
	    The old fun/2 still works as previously.</p>
          <p>
	    Own Id: OTP-13055 Aux Id: OTP-13053 </p>
        </item>
        <item>
          <p>
	    There is now a new option to make the server limit the
	    size range of moduli available for the diffie-hellman
	    group exchange negotiation. See option <c>
	    {dh_gex_limits,{Min,Max}}</c> in ssh:daemon/3.</p>
          <p>
	    Own Id: OTP-13066</p>
        </item>
        <item>
          <p>
	    Ecdh key exchange now validates compressed and
	    uncompressed keys as defined in rfc5656</p>
          <p>
	    Own Id: OTP-13067</p>
        </item>
        <item>
          <p>
	    Search order for the .ssh directory are changed so
	    <c>$HOME</c> is tried before
	    <c>init:get_argument(home)</c>.</p>
          <p>
	    Own Id: OTP-13109</p>
        </item>
        <item>
          <p>
	    The sftp receive window handling is optimized so it will
	    not update the remote end too often. This makes "sftp
	    mget" considerable faster.</p>
          <p>
	    Own Id: OTP-13130</p>
        </item>
        <item>
          <p>
	    The option <c>key_cb</c> is extended to take an optional
	    list that is passed to the callback module as an option.
	    With this it is possible to have different keys depending
	    on which host that is connected. Another possibility is
	    to write a callback module that fetches keys etc from a
	    database.</p>
          <p>
	    Thanks to Vipin Nair.</p>
          <p>
	    Own Id: OTP-13156</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.1.3</title>

    <section><title>Known Bugs and Problems</title>
      <list>
        <item>
          <p>
	    SSH_MSG_KEX_DH_GEX_REQUEST_OLD implemented to make PuTTY
	    work with erl server.</p>
          <p>
	    Own Id: OTP-13140</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.1.2</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Add a 1024 group to the list of key group-exchange groups</p>
          <p>
	    Own Id: OTP-13046</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.1.1</title>

    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    A new option <c>max_channels</c> limits the number of
	    channels with active server-side subsystems that are
	    accepted.</p>
          <p>
	    Own Id: OTP-13036</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.1</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Send an understandable disconnect message when the key
	    exchange phase can't find a common algorithm. There are
	    also some test cases added.</p>
          <p>
	    Own Id: OTP-11531</p>
        </item>
        <item>
          <p>
	    The third parameter in <c>ssh_sftp:write_file</c> is now
	    accepting iolists again. Unicode handling adjusted.</p>
          <p>
	    Own Id: OTP-12853 Aux Id: seq12891 </p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    First part of ssh test suite re-organization and
	    extension.</p>
          <p>
	    Own Id: OTP-12230</p>
        </item>
        <item>
          <p>
	    The key exchange algorithms 'ecdh-sha2-nistp256',
	    'ecdh-sha2-nistp384' and 'ecdh-sha2-nistp521' are
	    implemented. See RFC 5656.</p>
          <p>
	    This raises the security level considerably.</p>
          <p>
	    Own Id: OTP-12622 Aux Id: OTP-12671, OTP-12672 </p>
        </item>
        <item>
          <p>
	    The key exchange algorithm 'diffie-hellman-group14-sha1'
	    is implemented. See RFC 4253.</p>
          <p>
	    This raises the security level.</p>
          <p>
	    Own Id: OTP-12671 Aux Id: OTP-12672, OTP-12622 </p>
        </item>
        <item>
          <p>
	    The key exchange algorithms
	    'diffie-hellman-group-exchange-sha1' and
	    'diffie-hellman-group-exchange-sha256' are implemented.
	    See RFC 4419.</p>
          <p>
	    This raises the security level.</p>
          <p>
	    Own Id: OTP-12672 Aux Id: OTP-12671, OTP-12622 </p>
        </item>
        <item>
          <p>
	    Adding random length extra padding as recommended in RFC
	    4253 section 6.</p>
          <p>
	    Own Id: OTP-12831</p>
        </item>
        <item>
          <p>
	    New test library for low-level protocol testing. There is
	    also a test suite using it for some preliminary tests.
	    The intention is to build on that for more testing of
	    individual ssh messages. See
	    <c>lib/ssh/test/ssh_trpt_test_lib.erl</c> and
	    <c>ssh_protocol_SUITE.erl</c> in the same directory.</p>
          <p>
	    Own Id: OTP-12858</p>
        </item>
        <item>
          <p>
	    Increased default values for
	    diffie-hellman-group-exchange-sha* to Min = 1024, N =
	    6144, Max = 8192.</p>
          <p>
	    Added 6144 and 8192 bit default gex groups.</p>
          <p>
	    Own Id: OTP-12937</p>
        </item>
        <item>
          <p>
	    The mac algorithm 'hmac-sha2-512' is implemented. See RFC
	    6668.</p>
          <p>
	    Own Id: OTP-12938</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 4.0</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Ssh crashed if a message was sent on a channel with
	    packet_size = 0.</p>
          <p>
	    A new option for ssh:daemon is also introduced:
	    <c>minimal_remote_max_packet_size</c>. This option sets
	    the least max packet size declaration that the daemon
	    will accept from a client. The default value is 0 to
	    maintain compatibility with OpenSSH and the rfc:s.</p>
          <p>
	    Own Id: OTP-12645 Aux Id: seq12816 </p>
        </item>
        <item>
          <p>
	    Included test of the 'e' and 'f' parameters in
	    diffie-hellman key exchange as specified in rfc 4253
	    section 8.</p>
          <p>
	    Own Id: OTP-12649</p>
        </item>
        <item>
          <p>
	    Fixes the bug that once the <c>rekey_limit</c> bytes (by
	    default, 1GB) had been transmitted the connection was
	    rekeyed every minute, not after the next transferred
	    'rekey_limit' chunk.</p>
          <p>
	    Thanks to Simon Cornish for the report and the fix!</p>
          <p>
	    Own Id: OTP-12692</p>
        </item>
        <item>
          <p>
	    Fixes a bug that causes an SFTP connection to always fail
	    when {timeout, Timeout} option is used with
	    ssh_sftp:start_channel.</p>
          <p>
	    Thanks to Simon Cornish</p>
          <p>
	    Own Id: OTP-12708</p>
        </item>
        <item>
          <p>
	    Fix various ssh key exchange problems.</p>
          <p>
	    Thanks to Simon Cornish</p>
          <p>
	    Own Id: OTP-12760 Aux Id: <url
	    href="https://github.com/erlang/otp/pull/715">pull req
	    715</url> </p>
        </item>
        <item>
          <p>
	    The options <c>system_dir</c> and <c>user_dir</c> assumes
	    that the value is a path to a directory which is
	    readable. This is now checked early, so <c>ssh:daemon</c>
	    and <c>ssh:connect</c> will fail with an error message
	    immediately.</p>
          <p>
	    Own Id: OTP-12788</p>
        </item>
        <item>
          <p>
	    A daemon now checks that a client doesn't try to
	    authorize with methods not in the option auth_methods.</p>
          <p>
	    Own Id: OTP-12790</p>
        </item>
        <item>
          <p>
	    Disconnectfun now should trigger on all disconnects.</p>
          <p>
	    Own Id: OTP-12811</p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    Better usage of binary matching in ssh_auth.erl and
	    ssh_message.erl</p>
          <p>
	    Own Id: OTP-11697</p>
        </item>
        <item>
          <p>
	    A new option 'preferred_algorithms' is available for
	    <c>ssh:daemon</c> and <c>ssh:connect</c>.</p>
          <p>
	    This option defines the algorithms presented to the peer
	    in the algorithm negotiation phase of the ssh protocol. </p>
          <p>
	    The default list can be obtained from the new function
	    <c>ssh:default_algorithms/0</c>.</p>
          <p>
	    *** INCOMPATIBILITY with removed undocumented options
	    'role' and 'compression' ***</p>
          <p>
	    Own Id: OTP-12029</p>
        </item>
        <item>
          <p>
	    The internal group to user_drv protocol has been changed
	    to be synchronous in order to guarantee that output sent
	    to a process implementing the user_drv protocol is
	    printed before replying. This protocol is used by the
	    standard_output device and the ssh application when
	    acting as a client. </p>
          <p>
	    This change changes the previous unlimited buffer when
	    printing to standard_io and other devices that end up in
	    user_drv to 1KB.</p>
          <p>
	    *** POTENTIAL INCOMPATIBILITY ***</p>
          <p>
	    Own Id: OTP-12240</p>
        </item>
        <item>
          <p>
	    If ssh_connection:subsystem/4 fails we do not want to
	    crash but rather terminate gracefully.</p>
          <p>
	    Own Id: OTP-12648 Aux Id: seq12834 </p>
        </item>
        <item>
          <p>
	    New option <c>id_string</c> for <c>ssh:daemon</c> and
	    <c>ssh:connect</c> for limiting banner grabbing attempts.</p>
          <p>
	    The possible values are: <c>{id_string,string()}</c> and
	    <c>{id_string,random}</c>. The latter will make ssh
	    generate a random nonsense id-string for each new
	    connection.</p>
          <p>
	    Own Id: OTP-12659</p>
        </item>
        <item>
          <p>
	    To enable the ssh daemon to run in a virtualized
	    environment, where there can be more that one server that
	    has the same ip-address and port, we add a new option
	    profile.</p>
          <p>
	    Own Id: OTP-12675</p>
        </item>
        <item>
          <p>
	    Upgrade test suite added.</p>
          <p>
	    Own Id: OTP-12676</p>
        </item>
        <item>
          <p>
	    A new option for handling the SSH_MSG_DEBUG message's
	    printouts. A fun could be given in the options that will
	    be called whenever the SSH_MSG_DEBUG message arrives.
	    This enables the user to format the printout or just
	    discard it.</p>
          <p>
	    Own Id: OTP-12738 Aux Id: seq12860 </p>
        </item>
        <item>
          <p>
	    Testcase improvements and corrections:</p>
          <p>
	    * Add testcases for the <c>disconnectfun</c> option on
	    both server and client sides</p>
          <p>
	    * Timeout testcases adjusted for slow machines where they
	    sometimes failed</p>
          <p>
	    Own Id: OTP-12786</p>
        </item>
        <item>
          <p>
	    The option <c>disconnectfun</c> can now be used both on
	    the client and server side.</p>
          <p>
	    Own Id: OTP-12789</p>
        </item>
        <item>
          <p>
	    A new option unknown_msgfun/2 for ssh:connect and
	    ssh:daemon for handling unknown messages. With the option
	    it is possible to intercept before an INFO log message is
	    generated.</p>
          <p>
	    One usage is to filter out messages that are not wanted
	    in the error logger as info reports. An example of such a
	    message is the 'etimedout' tcp error message that will be
	    received if a connection has keep_alive and the peer is
	    restarted.</p>
          <p>
	    Own Id: OTP-12813 Aux Id: seq12881 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 3.2.4</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Gracefully terminate if sockets is unexpectedly closed.</p>
          <p>
	    Own Id: OTP-12782</p>
        </item>
        <item>
          <p>
	    Made Codenomicon Defensics test suite pass:</p> <list>
	    <item>limit number of algorithms in kexinit
	    message</item> <item>check 'e' and 'f' parameters in
	    kexdh</item> <item>implement 'keyboard-interactive' user
	    authentication on server side</item> <item> return plain
	    text message to bad version exchange message</item>
	    </list>
          <p>
	    Own Id: OTP-12784</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 3.2.3</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    A new option for handling the SSH_MSG_DEBUG message's
	    printouts. A fun could be given in the options that will
	    be called whenever the SSH_MSG_DEBUG message arrives.
	    This enables the user to format the printout or just
	    discard it.</p>
          <p>
	    Own Id: OTP-12738 Aux Id: seq12860 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 3.2.2</title>

    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    New option <c>id_string</c> for <c>ssh:daemon</c> and
	    <c>ssh:connect</c> for limiting banner grabbing attempts.</p>
          <p>
	    The possible values are: <c>{id_string,string()}</c> and
	    <c>{id_string,random}</c>. The latter will make ssh
	    generate a random nonsense id-string for each new
	    connection.</p>
          <p>
	    Own Id: OTP-12659</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 3.2.1</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Ssh crashed if a message was sent on a channel with
	    packet_size = 0.</p>
          <p>
	    A new option for ssh:daemon is also introduced:
	    <c>minimal_remote_max_packet_size</c>. This option sets
	    the least max packet size declaration that the daemon
	    will accept from a client. The default value is 0 to
	    maintain compatibility with OpenSSH and the rfc:s.</p>
          <p>
	    Own Id: OTP-12645 Aux Id: seq12816 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 3.2</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    If a channel is closed by the peer while using a function
	    with call semantics in ssh_connection.erl return {error,
	    closed}. Document that the functions can return {error,
	    timeout | closed} and not only ssh_request_status()</p>
          <p>
	    Own Id: OTP-12004</p>
        </item>
        <item>
          <p>
	    Bug that causes ssh:connect to return
	    <c>{error,int()}</c> instead of <c>{error,timeout}</c>
	    when ssh handshake takes too long time.</p>
          <p>
	    Own Id: OTP-12369</p>
        </item>
        <item>
          <p>
	    Documentation corrections. (Thanks to Rabbe Fogelholm)</p>
          <p>
	    Own Id: OTP-12399</p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    Example of ssh_connection:exec added.</p>
          <p>
	    Own Id: OTP-12558</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 3.1</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Make sure the clean rule for ssh, ssl, eunit and otp_mibs
	    actually removes generated files.</p>
          <p>
	    Own Id: OTP-12200</p>
        </item>
        <item>
          <p>
	    Improved Property Tests (Thanks to Thomas, John and
	    Tobias at QuviQ)</p>
          <p>
	    Own Id: OTP-12256</p>
        </item>
        <item>
          <p>
	    Correct typo of renegotiate that could cause rekeying to
	    fail</p>
          <p>
	    Own Id: OTP-12277 Aux Id: seq12736 </p>
        </item>
        <item>
          <p>
	    The {timeout, Timeout} option passed to
	    ssh_sftp:start_channel was not applied to the early
	    phases of the SSH protocol. This patch passes the Timeout
	    through to ssh:connect. In case the timeout occurs during
	    these phases, {error, timeout} is returned. (Thanks to
	    Simon Cornish)</p>
          <p>
	    Own Id: OTP-12306</p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    Added API functions ptty_alloc/3 and ptty_alloc/4, to
	    allocate a pseudo tty.</p>
          <p>
	    Own Id: OTP-11542 Aux Id: seq12493, OTP-11631 </p>
        </item>
        <item>
          <p>
	    Supports tar file creation on other media than file
	    systems mounted on the local machine.</p>
          <p>
	    The <c>erl_tar</c> api is extended with
	    <c>erl_tar:init/3</c> that enables usage of user provided
	    media storage routines. A ssh-specific set of such
	    routines is hidden in the new function
	    <c>ssh_sftp:open_tar/3</c> to simplify creating a tar
	    archive on a remote ssh server.</p>
          <p>
	    A chunked file reading option is added to
	    <c>erl_tar:add/3,4</c> to save memory on e.g small
	    embedded systems. The size of the slices read from a file
	    in that case can be specified.</p>
          <p>
	    Own Id: OTP-12180 Aux Id: seq12715 </p>
        </item>
        <item>
          <p>
	    Always send SSH_DISCONNECT protocol messages when peer
	    sends corrupt messages.</p>
          <p>
	    Own Id: OTP-12185</p>
        </item>
        <item>
          <p>
	    Hooks for funs that can change binaries sent to remote
	    sites from erl_tar for renote tar file creation are
	    added. See <c>ssh_sftp:open_tar/3,4</c> for details. The
	    hooks could also be used to read remote tar files that
	    need transformation before file extraction.</p>
          <p>
	    Those hooks are intended for encryption and decryption of
	    tar files. Effort is put into memory, disk and network
	    resource economy.</p>
          <p>
	    Own Id: OTP-12312 Aux Id: OTP-12180 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 3.0.8</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Fixes of login blocking after port scanning.</p>
          <p>
	    Own Id: OTP-12247 Aux Id: seq12726 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 3.0.7</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Add option sftp_vsn to SFTP</p>
          <p>
	    Own Id: OTP-12227</p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    Fix option user_interaction to work as expected. When
	    password authentication is implemented with ssh
	    keyboard-interactive method and the password is already
	    supplied, so that we do not need to query user, then
	    connections should succeed even though user_interaction
	    option is set to false.</p>
          <p>
	    Own Id: OTP-11329 Aux Id: seq12420, seq12335 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 3.0.6</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Gracefully handle bad data from the client when expecting
	    ssh version exchange.</p>
          <p>
	    Own Id: OTP-12157 Aux Id: seq12706 </p>
        </item>
        <item>
          <p>
	    When restarting an ssh daemon, that was stopped with
	    ssh:stop_listner/ [1,2] new options given shall replace
	    old ones.</p>
          <p>
	    Own Id: OTP-12168 Aux Id: seq12711 </p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    ssh now has a format_status function to avoid printing
	    sensitive information in error loggs.</p>
          <p>
	    Own Id: OTP-12030</p>
        </item>
      </list>
    </section>


    <section><title>Known Bugs and Problems</title>
      <list>
        <item>
          <p>
	    The option <c>parallel_login</c> didn't work with the
	    value <c>true</c>. All logins were serial.</p>
          <p>
	    Own Id: OTP-12194</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 3.0.5</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    When starting an ssh-daemon giving the option
	    {parallel_login, true}, the timeout for authentication
	    negotiation ({negotiation_timeout, integer()}) was never
	    removed.</p>
          <p>
	    This caused the session to always be terminated after the
	    timeout if parallel_login was set.</p>
          <p>
	    Own Id: OTP-12057 Aux Id: seq12663 </p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    Warning: this is experimental and may disappear or change
	    without previous warning.</p>
          <p>
	    Experimental support for running Quickcheck and PropEr
	    tests from common_test suites is added to common_test.
	    See the reference manual for the new module
	    <c>ct_property_testing</c>.</p>
          <p>
	    Experimental property tests are added under
	    <c>lib/{inet,ssh}/test/property_test</c>. They can be run
	    directly or from the commont_test suites
	    <c>inet/ftp_property_test_SUITE.erl</c> and
	    <c>ssh/test/ssh_property_test_SUITE.erl</c>.</p>
          <p>
	    See the code in the <c>test</c> directories and the man
	    page for details.</p>
          <p>
	    (Thanks to Tuncer Ayaz for a patch adding Triq)</p>
          <p>
	    Own Id: OTP-12119</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 3.0.4</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    When starting an ssh-daemon giving the option
	    {parallel_login, true}, the timeout for authentication
	    negotiation ({negotiation_timeout, integer()}) was never
	    removed.</p>
          <p>
	    This caused the session to always be terminated after the
	    timeout if parallel_login was set.</p>
          <p>
	    Own Id: OTP-12057 Aux Id: seq12663 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 3.0.3</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Removed mail address from error reports and corrected
	    spelling error (Stacktace -&gt; stacktrace)</p>
          <p>
	    Own Id: OTP-11883 Aux Id: seq12586 </p>
        </item>
        <item>
          <p>
	    Decode/encode fixes in SSH_MSG_IGNORE and
	    SSH_MSG_UNIMPLEMENTED.</p>
          <p>
	    Own Id: OTP-11983</p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    Accepts that some older OpenSSH clients sends incorrect
	    disconnect messages.</p>
          <p>
	    Own Id: OTP-11972</p>
        </item>
        <item>
          <p>
	    Handle inet and inet6 option correctly</p>
          <p>
	    Own Id: OTP-11976</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 3.0.2</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Fixed timeout bug in ssh:connect.</p>
          <p>
	    Own Id: OTP-11908</p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    Option <c>max_sessions</c> added to
	    <c>ssh:daemon/{2,3}</c>. This option, if set, limits the
	    number of simultaneous connections accepted by the
	    daemon.</p>
          <p>
	    Own Id: OTP-11885</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 3.0.1</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Fixes the problem that ssh_cli in some cases could delay
	    the prompt if a tty was not requested by the client.</p>
          <p>
	    Own Id: OTP-10732</p>
        </item>
        <item>
          <p>
	    The variable NewCol is now correctly calculated allowing
	    for tab-completion of function calls even when preceded
	    with blank space (Thanks to Alexander Demidenko)</p>
          <p>
	    Own Id: OTP-11566</p>
        </item>
        <item>
          <p>
	    Fix incorrect dialyzer spec and types, also enhance
	    documentation. </p>
          <p>
	    Thanks to Ayaz Tuncer.</p>
          <p>
	    Own Id: OTP-11627</p>
        </item>
        <item>
          <p>
	    Fixed a bug when ssh:exec executes a linux command on a
	    linux ssh daemon. If the result is sent back from
	    standard error, the length information was not stripped
	    off correctly.</p>
          <p>
	    Own Id: OTP-11667</p>
        </item>
        <item>
          <p>
	    Fixed a bug with the ssh file 'known_hosts' which made
	    the file grow with many equal entries.</p>
          <p>
	    Own Id: OTP-11671</p>
        </item>
        <item>
          <p>
	    Some local implementations of removing the last element
	    from a list are replaced by <c>lists:droplast/1</c>. Note
	    that this requires at least <c>stdlib-2.0</c>, which is
	    the stdlib version delivered in OTP 17.0. (Thanks to Hans
	    Svensson)</p>
          <p>
	    Own Id: OTP-11678</p>
        </item>
        <item>
          <p>
	    Bug fix for <c>ssh:daemon/2,3</c> so that the failfun is
	    called when it should.</p>
          <p>
	    Own Id: OTP-11680</p>
        </item>
        <item>
          <p>
	    Fixed bug which crashed ssh when SSH_MSG_KEX_DH_GEX_GROUP
	    is received. This could cause a vm-crash for eheap_alloc
	    during garbage collect.</p>
          <p>
	    Own Id: OTP-11696 Aux Id: 12547, 12532 </p>
        </item>
        <item>
          <p>
	    Fixes a bug that breaks keyboard-interactive
	    authentication. Thanks to Simon Cornish for reporting and
	    suggesting a fix.</p>
          <p>
	    Own Id: OTP-11698</p>
        </item>
        <item>
          <p>
	    dialyzer specs are now correct for <c>ssh:start/0</c>,
	    <c>ssh:start/1</c>, <c>ssh:stop/0</c> and
	    <c>ssh_connection_handler:open_channel/5</c>. (Thanks to
	    Johannes Weißl )</p>
          <p>
	    Own Id: OTP-11705</p>
        </item>
        <item>
          <p>
	    Application upgrade (appup) files are corrected for the
	    following applications: </p>
          <p>
	    <c>asn1, common_test, compiler, crypto, debugger,
	    dialyzer, edoc, eldap, erl_docgen, et, eunit, gs, hipe,
	    inets, observer, odbc, os_mon, otp_mibs, parsetools,
	    percept, public_key, reltool, runtime_tools, ssh,
	    syntax_tools, test_server, tools, typer, webtool, wx,
	    xmerl</c></p>
          <p>
	    A new test utility for testing appup files is added to
	    test_server. This is now used by most applications in
	    OTP.</p>
          <p>
	    (Thanks to Tobias Schlager)</p>
          <p>
	    Own Id: OTP-11744</p>
        </item>
        <item>
          <p>
	    Fixed dialyzer warning for <c>ssh_connection:send</c>.</p>
          <p>
	    Own Id: OTP-11821</p>
        </item>
        <item>
          <p>
	    <c>ssh:daemon/2,3</c> : Added options
	    <c>negotiation_timeout</c> and <c>parallel_login</c> to
	    tune the authentication behaviour.</p>
          <p>
	    Own Id: OTP-11823</p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    Ssh now fully supports unicode filenames, filecontents,
	    shell and cli. Please note that the underlying os and
	    emulator must also give support for unicode. You may want
	    to start the emulator with "<c>erl +fnu</c>" on Linux.</p>
          <p>
	    Own Id: OTP-10953</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 3.0</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    The ssh cli is now faster at close and before new prompt.</p>
          <p>
	    Own Id: OTP-11339 Aux Id: seq12423 </p>
        </item>
        <item>
          <p>
	    Ssh process structure was redesigned to better map to
	    what is truly parallel this has solved a lot of strange
	    timing issues that sometimes would occur, for instance a
	    process leak could happen when a lot of connections where
	    taken up and down in parallel in a short period of time.
	    Also backwards compatible clauses to "original" but never
	    supported features has been removed.</p>
          <p>
	    Impact: Increases flow efficiency</p>
          <p>
	    *** POTENTIAL INCOMPATIBILITY ***</p>
          <p>
	    Own Id: OTP-11363</p>
        </item>
        <item>
          <p>
	    Fix various typos in erts, kernel and ssh. Thanks to
	    Martin Hässler.</p>
          <p>
	    Own Id: OTP-11414</p>
        </item>
        <item>
          <p>
	    Correct private_key type documentation in
	    ssh_server_key_api. Thanks to Tristan Sloughter.</p>
          <p>
	    Own Id: OTP-11449</p>
        </item>
        <item>
          <p>
	    The functions in ssh_no_io.erl did not mimic the
	    functions in ssh_io.erl correctly, the arity was
	    incorrect for some functions which caused ssh to fail in
	    the wrong way.</p>
          <p>
	    Own Id: OTP-11490</p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    Add option to disallow CLI</p>
          <p>
	    Own Id: OTP-10976</p>
        </item>
        <item>
          <p>
	    Add sockname and user to ssh:connection_info/2</p>
          <p>
	    Own Id: OTP-11296</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 2.1.8</title>

    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    Do not chmod ~/.ssh unnecessarily.</p>
          <p>
	    Own Id: OTP-11189</p>
        </item>
        <item>
          <p>
	    Make ssh_cli.erl handle CTRL+C. Thanks to Stefan
	    Zegenhagen.</p>
          <p>
	    Own Id: OTP-11199</p>
        </item>
        <item>
          <p>
	    Clarified timeout options in documentation.</p>
          <p>
	    Own Id: OTP-11249</p>
        </item>
        <item>
          <p>
	    Add openssh_zlib compression type to ssh_transport.
	    Thanks to Louis-Philippe Gauthier.</p>
          <p>
	    Own Id: OTP-11256</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 2.1.7</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    ssh:daemon will get fed with an argument even if it is
	    not a valid expression.</p>
          <p>
	    Own Id: OTP-10975</p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    Properly ignore everything in lib/ssh/doc/html/. Thanks
	    to Anthony Ramine.</p>
          <p>
	    Own Id: OTP-10983</p>
        </item>
        <item>
          <p>
	    Integrate elliptic curve contribution from Andreas
	    Schultz </p>
          <p>
	    In order to be able to support elliptic curve cipher
	    suites in SSL/TLS, additions to handle elliptic curve
	    infrastructure has been added to public_key and crypto.</p>
          <p>
	    This also has resulted in a rewrite of the crypto API to
	    gain consistency and remove unnecessary overhead. All OTP
	    applications using crypto has been updated to use the new
	    API.</p>
          <p>
	    Impact: Elliptic curve cryptography (ECC) offers
	    equivalent security with smaller key sizes than other
	    public key algorithms. Smaller key sizes result in
	    savings for power, memory, bandwidth, and computational
	    cost that make ECC especially attractive for constrained
	    environments.</p>
          <p>
	    Own Id: OTP-11009</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 2.1.6</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Fixed timing rekeying bug.</p>
          <p>
	    Own Id: OTP-10940</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 2.1.5</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Bug in rekeying for daemon fixed.</p>
          <p>
	    Own Id: OTP-10911</p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    Enhanced error message and added test for ssh clients
	    trying to start non existing subsystems.</p>
          <p>
	    Own Id: OTP-10714</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 2.1.4</title>

    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    Better quality on the error messages for when key
	    exchange failed.</p>
          <p>
	    Own Id: OTP-10553 Aux Id: seq12152 </p>
        </item>
        <item>
          <p>
	    Fix link to documentation for ssh:connect/3,4. Thanks to
	    Martin Hässler.</p>
          <p>
	    Own Id: OTP-10862</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 2.1.3</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    It is now possible to send an empty binary using
	    ssh_connection:send/3, this corner case previously caused
	    ssh_connection:send to hang.</p>
          <p>
	    Own Id: OTP-9478 Aux Id: kunagi-226 [137] </p>
        </item>
        <item>
          <p>
	    Fix typo in keyboard-interactive string. Thanks to Daniel
	    Goertzen</p>
          <p>
	    Own Id: OTP-10456</p>
        </item>
        <item>
          <p>
	    ssh_connectino:send/3 will not return until all data has
	    been sent. Previously it could return too early,
	    resulting in things such premature close of the
	    connection. Also improved error handling of closed SSH
	    channels.</p>
          <p>
	    Own Id: OTP-10467</p>
        </item>
        <item>
	    <p>Fixed ssh_cli.erl crashes because #state.buf is yet
	    'undefined'.</p> <p>Fixed Client terminateing connections
	    due to channel_request message response is sent to the
	    wrong id.</p> <p>Affected SSH clients: - all clients
	    based on SSH-2.0-TrileadSSH2Java_213 (problem #1) - SSH
	    Term Pro (problem #2)</p> <p>Thanks to Stefan Zegenhagen
	    </p>
          <p>
	    Own Id: OTP-10475</p>
        </item>
        <item>
          <p>
	    Fixed various syntax errors in SSH appup file</p>
          <p>
	    Own Id: OTP-10657</p>
        </item>
      </list>
    </section>
    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    SSH_FX_FILE_IS_A_DIRECTORY message for sftp implemented</p>
          <p>
	    Own Id: OTP-6406 Aux Id: kunagi-218 [129] </p>
        </item>
        <item>
          <p>
	    SSH Rekeying fixed</p>
          <p>
	    Own Id: OTP-7785 Aux Id: kunagi-220 [131] </p>
        </item>
        <item>
          <p>
	    Added User Guide for the SSH application</p>
          <p>
	    Own Id: OTP-7786 Aux Id: kunagi-221 [132] </p>
        </item>
        <item>
          <p>
	    Documentation regarding failfun, connectfun and
	    disconnectfun provided</p>
          <p>
	    Own Id: OTP-7792 Aux Id: kunagi-222 [133] </p>
        </item>
        <item>
          <p>
	    SSH connection timer implementation</p>
          <p>
	    New option, {idle_time, integer()}, sets a timeout on
	    connection when no channels are active, defaults to
	    infinity</p>
          <p>
	    Own Id: OTP-10514 Aux Id: seq12020 </p>
        </item>
        <item>
	    <p> Some examples overflowing the width of PDF pages have
	    been corrected. </p>
          <p>
	    Own Id: OTP-10665</p>
        </item>
        <item>
          <p>
	    Fixed internal error on when client and server cannot
	    agree o which authmethod to use.</p>
          <p>
	    Own Id: OTP-10731 Aux Id: seq12237 </p>
        </item>
      </list>
    </section>

</section>
<section><title>Ssh 2.1.2.1</title>
<section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    Removed error report in ssh_connection_handler triggered
	    by badmatch failure.</p>
          <p>
	    Own Id: OTP-11188</p>
        </item>
      </list>
    </section>

</section>
<section><title>Ssh 2.1.2</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    SSH quiet mode</p>
          <p>
	    A new option to ssh:connect/3,4, quiet_mode. If true, the
	    client will not print out anything on authorization.</p>
          <p>
	    Own Id: OTP-10429 Aux Id: kunagi-273 [184] </p>
        </item>
        <item>
          <p>
	    Restrict which key algorithms to use</p>
          <p>
	    A new option to ssh:connect/3,4 is introduced,
	    public_key_algs, where you can restrict which key
	    algorithms to use and in which order to try them.</p>
          <p>
	    Own Id: OTP-10498 Aux Id: kunagi-289 [200] </p>
        </item>
        <item>
          <p>
	    Confidentiality of client password</p>
          <p>
	    Unsets clients password after authentication.</p>
          <p>
	    Own Id: OTP-10511 Aux Id: kunagi-292 [203] </p>
        </item>
        <item>
          <p>
	    Fixed user interaction for SSH</p>
          <p>
	    It's now available to accept hosts and input password</p>
          <p>
	    Own Id: OTP-10513 Aux Id: kunagi-293 [204] </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 2.1.1</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    Ssh now only sends one channel close message under all
	    circumstances, before it would sometimes incorrectly send
	    two.</p>
          <p>
	    Own Id: OTP-10060</p>
        </item>
        <item>
          <p>
	    The options check mistreated the ip_v6_disable-option,
	    and did not handle some, at the moment, undocumented
	    options correctly.</p>
          <p>
	    Own Id: OTP-10061</p>
        </item>
        <item>
          <p>
	    The channel id in a channel failure message, sent to the
	    peer, is now in all cases the remote channel id</p>
          <p>
	    Own Id: OTP-10062</p>
        </item>
        <item>
          <p>
	    Improved handling of multiple closes to avoid occasional
	    crashes when a channel is closed more than once.</p>
          <p>
	    Own Id: OTP-10112</p>
        </item>
        <item>
          <p>
	    Fix lib/src/test/ssh_basic_SUITE.erl to fix IPv6 option
	    typos</p>
          <p>
	    Fixed incorrect option "ipv6_disable" to "ipv6_disabled"
	    as documented in the ssh manual.</p>
          <p>
	    Own Id: OTP-10219</p>
        </item>
        <item>
          <p>
	    SSH: Make "auth_methods" server option re-usable</p>
          <p>
	    The 'auth_methods' option is used by the server side of
	    the SSH code to tell a connecting SSH client about the
	    authentication methods that are supported by the server.
	    The code still extracts and handles the 'auth_methods'
	    option from Opts in appropriate places, but the Opts
	    checking code in ssh.erl didn't allow that option to be
	    specified.</p>
          <p>
	    Own Id: OTP-10224</p>
        </item>
        <item>
          <p>
	    Use the correct channel id when adjusting the channel
	    window</p>
          <p>
	    Own Id: OTP-10232</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 2.1</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    All keys in authorized_keys are considered, wrongly only
	    the first one was before.</p>
          <p>
	    Own Id: OTP-7235</p>
        </item>
        <item>
          <p>
	    ssh daemon now properly handles ras host keys, in
	    previous versions only dsa host keys sufficed to set up a
	    connection.</p>
          <p>
	    Own Id: OTP-7677</p>
        </item>
        <item>
          <p>
	    ssh:shell/3 and ssh:connect/3 does not hang anymore if
	    connection negotiation fails</p>
          <p>
	    Own Id: OTP-8111</p>
        </item>
        <item>
          <p>
	    Improve check so that we will not try to read ssh packet
	    length indicator if not sure we have enough data.</p>
          <p>
	    Own Id: OTP-8380</p>
        </item>
        <item>
          <p>
	    Do not try to use user interaction when it is disabled.</p>
          <p>
	    Own Id: OTP-9466 Aux Id: seq11886 </p>
        </item>
        <item>
          <p>
	    Improved error handling of internal errors i the ssh
	    connection handling process</p>
          <p>
	    Own Id: OTP-9905</p>
        </item>
        <item>
          <p>
	    sftp daemon generates file handles correct</p>
          <p>
	    Own Id: OTP-9948</p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
	    Document supported algorithms</p>
          <p>
	    Own Id: OTP-8109</p>
        </item>
        <item>
          <p>
	    Graceful handling of premature close from an sftp client.</p>
          <p>
	    Own Id: OTP-9391 Aux Id: seq11838 </p>
        </item>
        <item>
          <p>
	    Changed ssh implementation to use the public_key
	    application for all public key handling. This is also a
	    first step for enabling a callback API for supplying
	    public keys and handling keys protected with password
	    phrases. </p>
          <p>
	    Additionally the test suites where improved so that they
	    do not copy the users keys to test server directories as
	    this is a security liability. Also ipv6 and file access
	    issues found in the process has been fixed.</p>
          <p>
	    This change also solves OTP-7677 and OTP-7235</p>
          <p>
	    This changes also involves some updates to public_keys
	    ssh-functions.</p>
          <p>
	    Own Id: OTP-9911</p>
        </item>
        <item>
          <p>
	    Added options for the ssh client to support user keys
	    files that are password protected.</p>
          <p>
	    Own Id: OTP-10036 Aux Id: OTP-6400, Seq10595 </p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 2.0.9</title>

    <section><title>Improvements and New Features</title>
      <list>
        <item>
	    <p>Erlang/OTP can now be built using parallel make if you
	    limit the number of jobs, for instance using '<c>make
	    -j6</c>' or '<c>make -j10</c>'. '<c>make -j</c>' does not
	    work at the moment because of some missing
	    dependencies.</p>
          <p>
	    Own Id: OTP-9451</p>
        </item>
        <item>
          <p>
	    Ssh behaviours now use the new directive "-callback".
	    Parameters will be further specified in a later version
	    of ssh.</p>
          <p>
	    Own Id: OTP-9796</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 2.0.8</title>
    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
            Calling ssh_sftp:stop_channel/1 resulted in that the trap_exit flag was
            set to true for the invoking process.</p>
          <p>
            Own Id: OTP-9386 Aux Id: seq11865</p>
        </item>
      </list>
    </section>
</section>

<section><title>Ssh 2.0.7</title>
    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
            An unexpected message would crash the ssh_connection_handler and close
            the connection. Now an error message is generated instead.</p>
          <p>
            Own Id: OTP-9273</p>
        </item>
      </list>
    </section>
</section>

<section><title>Ssh 2.0.6</title>
    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
            A memory leak has been fixed. I.e. per terminated connection the size of
            a pid and the length of a user name string was not cleared.</p>
          <p>
            Own Id: OTP-9232</p>
        </item>
      </list>
    </section>
</section>

<section><title>Ssh 2.0.5</title>
    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
            Strengthened random number generation. (Thanks to Geoff Cant)</p>
          <p>
            Own Id: OTP-9225</p>
        </item>
      </list>
    </section>
</section>

<section><title>Ssh 2.0.4</title>
    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>In some cases SSH returned {error, normal} when a channel was terminated
             unexpectedly. This has now been changed to {error, channel_closed}.</p>
          <p>
            *** POTENTIAL INCOMPATIBILITY ***</p>
          <p>
            Own Id: OTP-8987 Aux Id: seq11748</p>
        </item>
        <item>
          <p>
            SSH did not handle the error reason enetunreach
            when trying to open a IPv6 connection.</p>
          <p>
            Own Id: OTP-9031</p>
        </item>
      </list>
    </section>
    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
            It is now possible to use SSH to sign and verify binary data.</p>
          <p>
            Own Id: OTP-8986</p>
        </item>
        <item>
          <p>
            SSH now ensures that the .ssh directory exists before trying
            to access files located in that directory.</p>
          <p>
            Own Id: OTP-9010</p>
        </item>
      </list>
    </section>
</section>

<section><title>Ssh 2.0.3</title>
    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
            The fix regarding OTP-8849 was not included in the
            previous version as stated.</p>
          <p>
            Own Id: OTP-8918</p>
        </item>
      </list>
    </section>
</section>

<section><title>Ssh 2.0.2</title>
    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
            The ssh_system_sup did not catch noproc and shutdown
            messages.</p>
          <p>
            Own Id: OTP-8863</p>
        </item>
        <item>
          <p>
            In some cases a crash report was generated when a
            connection was closing down. This was caused by a race
            condition between two processes.</p>
          <p>
            Own Id: OTP-8881 Aux Id: seq11656, seq11648 </p>
        </item>
      </list>
    </section>
    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
            SSH no longer use deprecated public_key functions.</p>
          <p>
            Own Id: OTP-8849</p>
        </item>
      </list>
    </section>
 </section>
 <section><title>Ssh 2.0.1</title>
    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
	    SSH in some cases terminated channels with reason normal
	    when it should have been shutdown.</p>
          <p>
	    Own Id: OTP-8714</p>
        </item>
        <item>
          <p>
	    SSH in some cases generated a crash report when a channel
	    was closed in a normal way.</p>
          <p>
	    Own Id: OTP-8735 Aux Id: seq11615 </p>
        </item>
        <item>
          <p>
	    The processes ssh_subsystem_sup and one ssh_channel_sup
	    was not terminated when a connection was closed.</p>
          <p>
	    Own Id: OTP-8807</p>
        </item>
      </list>
    </section>

</section>

<section><title>Ssh 2.0</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>The function ssh:connect/4 was not exported.</p>
          <p>Own Id: OTP-8550 Aux Id:</p>
        </item>
        <item>
          <p>Aligned error message with used version (SSH_FX_FAILURE vs
             SSH_FX_NOT_A_DIRECTORY, the latter introduced in version 6).</p>
          <p>
            *** POTENTIAL INCOMPATIBILITY ***</p>
          <p>Own Id: OTP-8644 Aux Id: seq11574</p>
        </item>
        <item>
          <p>Resolved race condition when another connection is started
             before a channel is opened in the first connection.</p>
          <p>Own Id: OTP-8645 Aux Id: seq11577</p>
        </item>
      </list>
    </section>

    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>The configuration parameter ip_v6_disabled is now available,
             which makes it possible for the user to alter the IP version
             SSH shall use.</p>
          <p>
            *** POTENTIAL INCOMPATIBILITY ***</p>
          <p>Own Id: OTP-8535 Aux Id:</p>
        </item>
        <item>
          <p>The ssh_connection:send operation now accepts infinity as timeout.</p>
          <p>Own Id: OTP-8534 Aux Id:</p>
        </item>
        <item>
          <p>The connection handler now include stack traces when a channel 
             message is not handled correctly.</p>
          <p>Own Id: OTP-8524 Aux Id:</p>
        </item>
        <item>
          <p>Removed deprecated modules (ssh_ssh, ssh_sshd and ssh_cm) and
             functions (ssh_sftp:connect and ssh_sftp:stop).</p>
          <p>
            *** POTENTIAL INCOMPATIBILITY ***</p>
          <p>Own Id: OTP-8596 Aux Id:</p>
        </item>
      </list>
    </section>

 </section>

 <section><title>Ssh 1.1.8</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
            In some cases SSH ceased to collect more data from the transport layer.</p>
          <p>
            Own Id: OTP-8401 Aux Id: seq11479</p>
        </item>
      </list>
    </section>

    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>Old release notes removed.</p>
          <p>Own Id: OTP-8356 Aux Id:</p>
        </item>
      </list>
    </section>

 </section>

 <section><title>Ssh 1.1.7</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
            Now clear all processes when a connection is terminated.</p>
          <p>
            Own Id: OTP-8121 Aux Id:</p>
        </item>
        <item>
          <p>
            In some rare cases the connection handler could enter an infinite loop.</p>
          <p>
            Own Id: OTP-8277 Aux Id: seq11428</p>
        </item>
        <item>
          <p>
            If an SFTP server did not respond with EOF, the function 
            ssh_sftp:list_dir/2/3 would enter an infinite loop.</p>
          <p>
            Own Id: OTP-8278 Aux Id: seq11450</p>
        </item>
      </list>
    </section>

    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
            The documentation is now built with open source tools (xsltproc and fop) 
            that exists on most platforms. One visible change is that the frames are removed.</p>
          <p>
            Own Id: OTP-8201 Aux Id:</p>
        </item>
      </list>
    </section>

 </section>

 <section><title>Ssh 1.1.6</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
            ssh_sftp:start_channel did not handle all possible return 
            values from ssh_channel:start correctly.
          </p>
          <p>
            Own Id: OTP-8176 Aux Id: </p>
        </item>
        <item>
          <p>
            SFTPD did not handle rename command (version 4) correctly.
          </p>
          <p>
            Own Id: OTP-8175 Aux Id: seq11373</p>
        </item>
        <item>
          <p>
            If a connection manager already had been terminated it could cause a channel
            to generate a crash report when it was about to stop.
          </p>
          <p>
            Own Id: OTP-8174 Aux Id: seq11377</p>
        </item>
        <item>
          <p>
            Requests could result in badarg or badmatch EXIT messages in the connection 
            manager if the channel no longer existed.</p>
          <p>
            Own Id: OTP-8173 Aux Id: seq11379</p>
        </item>
        <item>
          <p>
            ssh_transport:unpack/3 could cause a badarg error.</p>
          <p>
            Own Id: OTP-8162 Aux Id:</p>
        </item>
      </list>
    </section>

    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
            The encryption algorithm aes128-cbc is now supported.
            Requires that crypto-1.6.1 is available.</p>
          <p>
            Own Id: OTP-8110 Aux Id:</p>
        </item>
      </list>
    </section>

 </section>


 <section><title>Ssh 1.1.5</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
            ssh_sftp:start_channel/3 did not handle timeout correctly.</p>
          <p>
            Own Id: OTP-8159 Aux Id: seq11386</p>
        </item>
        <item>
          <p>
            If a progress message was not received after invoking ssh:connect/3
            the call could hang for ever. A timeout option has also been added.</p>
          <p>
            Own Id: OTP-8160 Aux Id: seq11386</p>
        </item>
        <item>
          <p>
            A comma has been missing in the ssh.appup file since SSH-1.0.2.</p>
          <p>
            Own Id: OTP-8161 Aux Id:</p>
        </item>
      </list>
    </section>

 </section>

 <section><title>Ssh 1.1.4</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
            SSH sometimes caused a crash report at disconnect.</p>
          <p>
            Own Id: OTP-8071 Aux Id: seq11319</p>
        </item>
      </list>
    </section>

 </section>

 <section><title>Ssh 1.1.3</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
            The operation ssh_sftp:stop_channel/1 returned an 
            exception if the connection already had been closed.</p>
          <p>
            Own Id: OTP-7996 Aux Id: seq11281</p>
        </item>
        <item>
          <p>
            SSH did not handle if supervisor:start_child/2 returned 
            {error, already_present}.</p>
          <p>
            Own Id: OTP-8034 Aux Id: seq11307</p>
        </item>
        <item>
          <p>
            SSH no longer cause supervisor reports when a connection is 
            terminated in a controlled manner.</p>
          <p>
            Own Id: OTP-8035 Aux Id: seq11308</p>
        </item>
      </list>
    </section>

 </section>

 <section><title>Ssh 1.1.2</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
            Ssh confused local and remote channel id's, which in some
            cases resulted in that messages were discarded.</p>
          <p>
            Own Id: OTP-7914 Aux Id: seq11234</p>
        </item>
        <item>
          <p>
            Ssh could not handle echo values other than 0 and 1.</p>
          <p>
            Own Id: OTP-7917 Aux Id: seq11238</p>
        </item>
        <item>
          <p>
            A crash occurred if a non-valid channel reference was received.</p>
          <p>
            Own Id: OTP-7918 Aux Id: seq11238</p>
        </item>
        <item>
          <p>
            Sftpd connections was not closed after receiving eof from a client.</p>
          <p>
            Own Id: OTP-7921 Aux Id: seq11222</p>
        </item>
        <item>
          <p>
            It was not possible to start a SFTP subsystem on certain platforms, 
            i.e. those who do not support symbolic links.</p>
          <p>
            Own Id: OTP-7930 Aux Id: </p>
        </item>
        <item>
          <p>
            In some cases the message {ssh_cm, ssh_connection_ref(), {closed, ssh_channel_id()}}
            was not passed to the registered callback module.</p>
          <p>
            Own Id: OTP-7957 Aux Id: </p>
        </item>
      </list>
    </section>

    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
            By using the sftpd option {max_files, Integer}, the message
            size for READDIR commands can be reduced.</p>
          <p>
            Own Id: OTP-7919 Aux Id: seq11230</p>
        </item>
      </list>
    </section>

 </section>

 <section><title>Ssh 1.1.1</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
            The erlang ssh server has presented itself incorrectly,
            using the special version ssh-1.99, although it never has
            supported versions below 2.0. Since ssh-1.1 client
            versions below 2.0 are correctly rejected instead of
            letting the server crash later on. Alas the problem with
            the presentation string was not discovered until after
            ssh.1.1 was released. Now the server will present itself
            as ssh-2.0.</p>
          <p>
            Own Id: OTP-7795</p>
        </item>
        <item>
          <p>
            An internal function call used an incorrect parameter, which
            caused problem when the old listen API was used. This was
            introduced in Ssh-1.1.</p>
          <p>
            Own Id: OTP-7920 Aux Id: seq11211</p>
        </item>
      </list>
    </section>

    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
            Ssh timeouts will now behave as expected i.e. defaults to
            infinity only the user of the ssh application can know of
            a reasonable timeout value for their application.</p>
          <p>
            *** POTENTIAL INCOMPATIBILITY ***</p>
          <p>
            Own Id: OTP-7807</p>
        </item>
        <item>
          <p>
            The implementation of timeouts added as a patch in
            ssh-1.0.1 was slightly changed and is now documented.</p>
          <p>
            Own Id: OTP-7808</p>
        </item>
        <item>
          <p>
            To honor the multiplexing of channels over one ssh
            connection concept ssh_sftp:connect/ [1,2,3] is
            deprecated and replaced by ssh_sftp:start_channel/[1,2,3]
            and ssh_sftp:stop/1 is deprecated and replaced by
            ssh_sftp:stop_channel/1 and to stop the ssh connection
            ssh:close/ 1 should be called.</p>
          <p>
            Own Id: OTP-7809</p>
        </item>
        <item>
          <p>
            Added the message {ssh_channel_up, ChannelId,
            ConnectionManager} that shall be handled by the channel
            callback handle_msg/2. This makes the function
            handle_msg/2 a mandatory function for ssh channels
            implementations which it was not in ssh-1.1.</p>
          <p>
            *** POTENTIAL INCOMPATIBILITY ***</p>
          <p>
            Own Id: OTP-7828</p>
        </item>
      </list>
    </section>

 </section>

  <section><title>Ssh 1.1</title>
  
  <section><title>Fixed Bugs and Malfunctions</title>
  <list>
    <item>
      <p>
	A flaw in the implementation of the supervision tree
	caused the ssh daemon to close the connections to all
	currently logged in users if one user logged out. Another
	problem related to the supervision tree caused the closing
	down of clients to leak processes i.e. all processes was
      not shutdown correctly.</p>
      <p>
      Own Id: OTP-7676</p>
    </item>
    <item>
      <p>
	Tabs could cause ssh_cli to print things in a surprising
      way.</p>
      <p>
      Own Id: OTP-7683 Aux Id: seq11102 </p>
    </item>
    <item>
      <p>
	[sftp, sftpd] - Added patch to make sftp timestamps more
	correct, in the long run it would be nice to have better
	support in file to be able to make it always behave
	correctly now it will be correct 99 % of time instead of
      almost never correct, at least on unix-based platforms.</p>
      <p>
      Own Id: OTP-7685 Aux Id: seq11082 </p>
    </item>
    <item>
      <p>
	[sftpd] - Added patch to further improve handling of
      symbolic links in the sftp-server.</p>
      <p>
      Own Id: OTP-7766 Aux Id: seq11101 </p>
    </item>
    <item>
      <p>
	Ssh incorrectly sent the local id instead of the remote
	id of a channel to the peer. For simpler cases these ids
	often happen to have the same value. One case when they
	do not is when the client sends an exec command two times
	in a raw on the same ssh connection (different channels
	of course as the channel will be closed when the exec
      command has been evaluated) .</p>
      <p>
      Own Id: OTP-7767</p>
    </item>
    <item>
      <p>
	Packet data could be lost under high load due to the fact
	that buffered data was sometimes wrongly discarded before
      it had been sent.</p>
      <p>
      Own Id: OTP-7768</p>
    </item>
    <item>
      <p>
	Improved ipv6-handling as some assumptions about inet
      functions where incorrect.</p>
      <p>
      Own Id: OTP-7770</p>
    </item>
  </list>
  </section>

  
  <section><title>Improvements and New Features</title>
  <list>
    <item>
      <p>
      Added new API function ssh:connection_info/2.</p>
      <p>
      Own Id: OTP-7456</p>
    </item>
    <item>
      <p>
	Now starts ssh channel processes later avoiding
      synchronization problems between processes.</p>
      <p>
      Own Id: OTP-7516</p>
    </item>
    <item>
      <p>
	Ssh now rejects old versions of the ssh protocol for
	security reasons. (Even if they where not correctly
	rejected before the connection would probably have failed
      anyway due to other reasons.)</p>
      <p>
      Own Id: OTP-7645 Aux Id: seq11094 </p>
    </item>
    <item>
      <p>
	New API module ssh_channel has been added. This is a
	behaviour to facilitate the implementation of ssh clients
	and plug in subsystems to the ssh daemon. Note that this
	slightly changes the options to the API function
	ssh:daemon/[1,2,3] deprecating all no longer documented
	options. Note that the new API enforces the "logical way"
	of using the old API i.e. making the subsystem process
	part of the ssh applications supervisor tree, so missuses
      of the old API are not compatible with the new API.</p>
      <p>
      *** POTENTIAL INCOMPATIBILITY ***</p>
      <p>
      Own Id: OTP-7769</p>
    </item>
  </list>
  </section>

  <section><title>Known Bugs and Problems</title>
  <list>
    <item>
      <p>
	Public keys protected by a password are currently not
      handled by the erlang ssh application.</p>
      <p>
      Own Id: OTP-6400 Aux Id: 10595 </p>
    </item>
  </list>
  </section>
  
  </section>
    
    <section><title>Ssh 1.0.2</title>
    
    <section><title>Fixed Bugs and Malfunctions</title>
    <list>
      <item>
	<p>
	  [sftpd] - Listing of symbolic link directories should now
	  work as expected.</p>
	  <p>
	  Own Id: OTP-7141 Aux Id: seq10856 </p>
        </item>
    </list>
    </section>
    
    </section>
    
   <section><title>Ssh 1.0.1</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
            [sftp] - When listing a directory with more than 100
            files only the first 100 where listed. This has now been
            fixed.</p>
          <p>
            Own Id: OTP-7318 Aux Id: seq10953 </p>
        </item>
        <item>
          <p>
            When restarting an ssh-system the expected return value
            from ssh_system_sup:restart_acceptor/2 was incorrect,
            this is no longer the case.</p>
          <p>
            Own Id: OTP-7564 Aux Id: seq11055 </p>
        </item>
        <item>
          <p>
            A few minor bugs where fixed in ssh_userreg.erl and
            ssh_connection_manager and a a ssh_cli option was added
            to restore backwards compatibility with the old ssh_cm -
            API.</p>
          <p>
            Own Id: OTP-7565</p>
        </item>
        <item>
          <p>
            Fixed bug in ipv6 support and added option to disable
            ipv6 as a workaround for badly configured computers.</p>
          <p>
            Own Id: OTP-7566</p>
        </item>
      </list>
    </section>

    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
            [sftp] - Option added to set timeout value in sftp.</p>
          <p>
            Own Id: OTP-7305 Aux Id: seq10945 </p>
        </item>
      </list>
    </section>

   </section>

  <section><title>Ssh 1.0</title>

    <section><title>Fixed Bugs and Malfunctions</title>
      <list>
        <item>
          <p>
            Removed some special handling of prompts that made ssh
            behave differently than openssh.</p>
          <p>
            Own Id: OTP-7485 Aux Id: seq11025 </p>
        </item>
        <item>
          <p>
            Bug in encoding of pty opts has been fixed.</p>
          <p>
            Own Id: OTP-7504</p>
        </item>
      </list>
    </section>


    <section><title>Improvements and New Features</title>
      <list>
        <item>
          <p>
            The architecture of the ssh processes has been
            reconstructed to fit in a supervision tree as to become a
            real OTP application and benefit from this when starting
            and stopping.</p>
          <p>
            Own Id: OTP-7356 Aux Id: seq10899 </p>
        </item>
        <item>
          <p>
            Support for pty option echo off added. Requires kernel
            from R12B-4.</p>
          <p>
            *** POTENTIAL INCOMPATIBILITY ***</p>
          <p>
            Own Id: OTP-7502 Aux Id: seq10959 </p>
        </item>
        <item>
          <p>
            The ssh API has been enhanced a lot of old API functions
            has become deprecated.</p>
          <p>
            Own Id: OTP-7503</p>
        </item>
      </list>
    </section>

  </section>
</chapter>