Merge tag 'OTP-20.0' into sverker/20/binary_to_atom-utf8-crash/ERL-474/OTP-14590

8 files changed, 674 insertions, 52 deletions

diff --git a/lib/ssh/doc/src/introduction.xml b/lib/ssh/doc/src/introduction.xml
index ca84528f3d..b7a73e2597 100644
--- a/lib/ssh/doc/src/introduction.xml
+++ b/lib/ssh/doc/src/introduction.xml
@@ -195,8 +195,6 @@
       Transport Layer Protocol</item>
       <item><url href="http://www.ietf.org/rfc/rfc4254.txt">RFC 4254</url> -
       Connection Protocol</item>
-      <item><url href="http://www.ietf.org/rfc/rfc4255.txt">RFC 4255</url> -
-      Key Fingerprints</item>
       <item><url href="http://www.ietf.org/rfc/rfc4344.txt">RFC 4344</url> -
       Transport Layer Encryption Modes</item>
       <item><url href="http://www.ietf.org/rfc/rfc4716.txt">RFC 4716</url> -
diff --git a/lib/ssh/doc/src/notes.xml b/lib/ssh/doc/src/notes.xml
index fd15c334a3..f93753f1d2 100644
--- a/lib/ssh/doc/src/notes.xml
+++ b/lib/ssh/doc/src/notes.xml
@@ -4,7 +4,7 @@
 <chapter>
   <header>
     <copyright>
-      <year>2004</year><year>2016</year>
+      <year>2004</year><year>2017</year>
       <holder>Ericsson AB. All Rights Reserved.</holder>
     </copyright>
     <legalnotice>
@@ -30,6 +30,468 @@
     <file>notes.xml</file>
   </header>
 
+<section><title>Ssh 4.5</title>
+
+    <section><title>Improvements and New Features</title>
+      <list>
+        <item>
+          <p>
+	    The internal handling of SSH options is re-written.</p>
+          <p>
+	    Previously there were no checks if a client option was
+	    given to a daemon or vice versa. This is corrected now.
+	    If your code has e.g. a client-only option in a call to
+	    start a daemon, the call will fail.</p>
+          <p>
+	    *** POTENTIAL INCOMPATIBILITY ***</p>
+          <p>
+	    Own Id: OTP-12872</p>
+        </item>
+        <item>
+          <p>
+	    Modernization of key exchange algorithms. See
+	    draft-ietf-curdle-ssh-kex-sha2 for a discussion.</p>
+          <p>
+	    Removed an outdated weak algorithm and added stronger
+	    replacements to keep interoperability with other modern
+	    ssh clients and servers. The default ordering of the
+	    algorithms is also adjusted.</p>
+          <p>
+	    Retired: The nowadays unsecure key-exchange
+	    <c>diffie-hellman-group1-sha1</c> is not enabled by
+	    default, but can be enabled with the option
+	    <c>preferred-algorithms</c>.</p>
+          <p>
+	    Added: The new stronger key-exchange
+	    <c>diffie-hellman-group16-sha512</c>,
+	    <c>diffie-hellman-group18-sha512</c> and
+	    <c>diffie-hellman-group14-sha256</c> are added and
+	    enabled by default.</p>
+          <p>
+	    The questionable [RFC 6194] sha1-based algorithms
+	    <c>diffie-hellman-group-exchange-sha1</c> and
+	    <c>diffie-hellman-group14-sha1</c> are however still kept
+	    enabled by default for compatibility with ancient clients
+	    and servers that lack modern key-exchange alternatives.
+	    When the draft-ietf-curdle-ssh-kex-sha2 becomes an rfc,
+	    those sha1-based algorithms and
+	    <c>diffie-hellman-group1-sha1</c> will be deprecated by
+	    IETF. They might then be removed from the default list in
+	    Erlang/OTP.</p>
+          <p>
+	    *** POTENTIAL INCOMPATIBILITY ***</p>
+          <p>
+	    Own Id: OTP-14110</p>
+        </item>
+        <item>
+          <p>
+	    Modernized internal representation of sftp by use of
+	    maps.</p>
+          <p>
+	    Own Id: OTP-14117</p>
+        </item>
+        <item>
+          <p>
+	    The Extension Negotiation Mechanism and the extension
+	    <c>server-sig-algs</c> in
+	    draft-ietf-curdle-ssh-ext-info-05 are implemented.</p>
+          <p>
+	    The related draft-ietf-curdle-rsa-sha2-05 is implemented
+	    and introduces the signature algorithms
+	    <c>rsa-sha2-256</c> and <c>rsa-sha2-512</c>.</p>
+          <p>
+	    Own Id: OTP-14193</p>
+        </item>
+        <item>
+          <p>
+	    The 'timeout' and 'connect_timeout' handling in
+	    ssh_sftp:start_channel documentation is clarified.</p>
+          <p>
+	    Own Id: OTP-14216</p>
+        </item>
+        <item>
+          <p>
+	    The functions <c>ssh:connect</c>, <c>ssh:shell</c> and
+	    <c>ssh:start_channel</c> now accept an IP-tuple as Host
+	    destination argument.</p>
+          <p>
+	    Own Id: OTP-14243</p>
+        </item>
+        <item>
+          <p>
+	    The function <c>ssh:daemon_info/1</c> now returns Host
+	    and Profile as well as the Port info in the property
+	    list.</p>
+          <p>
+	    Own Id: OTP-14259</p>
+        </item>
+        <item>
+          <p>
+	    Removed the option <c>public_key_alg</c> which was
+	    deprecated in 18.2. Use <c>pref_public_key_algs</c>
+	    instead.</p>
+          <p>
+	    *** POTENTIAL INCOMPATIBILITY ***</p>
+          <p>
+	    Own Id: OTP-14263</p>
+        </item>
+        <item>
+          <p>
+	    The SSH application is refactored regarding daemon
+	    starting. The resolution of contradicting <c>Host</c>
+	    argument and <c>ip</c> option were not described. There
+	    were also strange corner cases when the <c>'any'</c>
+	    value was used in <c>Host</c> argument or <c>ip</c>
+	    option. This is (hopefully) resolved now, but it may
+	    cause incompatibilities for code using both <c>Host</c>
+	    and the <c>ip</c> option. The value 'loopback' has been
+	    added for a correct way of naming those addresses.</p>
+          <p>
+	    *** POTENTIAL INCOMPATIBILITY ***</p>
+          <p>
+	    Own Id: OTP-14264</p>
+        </item>
+        <item>
+          <p>
+	    The supervisor code is refactored. The naming of
+	    listening IP-Port-Profile triples are slightly changed to
+	    improve consistency in strange corner cases as resolved
+	    by OTP-14264</p>
+          <p>
+	    Own Id: OTP-14267 Aux Id: OTP-14266 </p>
+        </item>
+        <item>
+          <p>
+	    The <c>idle_time</c> option can now be used in daemons.</p>
+          <p>
+	    Own Id: OTP-14312</p>
+        </item>
+        <item>
+          <p>
+	    Added test cases for IETF-CURDLE Extension Negotiation
+	    (ext-info)</p>
+          <p>
+	    Own Id: OTP-14361</p>
+        </item>
+        <item>
+          <p>
+	    Testcases for IETF-CURDLE extension
+	    <c>server-sig-algs</c> including <c>rsa-sha2-*</c></p>
+          <p>
+	    Own Id: OTP-14362 Aux Id: OTP-14361 </p>
+        </item>
+        <item>
+          <p>
+	    The option <c>auth_methods</c> can now also be used in
+	    clients to select which authentication options that are
+	    used and in which order.</p>
+          <p>
+	    Own Id: OTP-14399</p>
+        </item>
+        <item>
+          <p>
+	    Checks that a ECDSA public key (<c>ecdsa-sha2-nistp*</c>)
+	    stored in a file has the correct size.</p>
+          <p>
+	    Own Id: OTP-14410</p>
+        </item>
+      </list>
+    </section>
+
+</section>
+
+<section><title>Ssh 4.4.2</title>
+
+    <section><title>Fixed Bugs and Malfunctions</title>
+      <list>
+        <item>
+          <p>
+	    ssh:daemon_info/1 crashed if the listening IP was not
+	    'any'</p>
+          <p>
+	    Own Id: OTP-14298 Aux Id: seq13294 </p>
+        </item>
+      </list>
+    </section>
+
+</section>
+
+<section><title>Ssh 4.4.1</title>
+
+    <section><title>Fixed Bugs and Malfunctions</title>
+      <list>
+        <item>
+          <p>
+	    Fix bug when opening connections. If the tcp setup
+	    failed, that would in some cases not result in an error
+	    return value.</p>
+          <p>
+	    Own Id: OTP-14108</p>
+        </item>
+        <item>
+          <p>
+	    Reduce information leakage in case of decryption errors.</p>
+          <p>
+	    Own Id: OTP-14109</p>
+        </item>
+        <item>
+          <p>
+	    The key exchange algorithm
+	    diffie-hellman-group-exchange-sha* has a server-option
+	    <c>{dh_gex_limits,{Min,Max}}</c>. There was a hostkey
+	    signature validation error on the client side if the
+	    option was used and the <c>Min</c> or the <c>Max</c>
+	    differed from the corresponding values obtained from the
+	    client.</p>
+          <p>
+	    This bug is now corrected.</p>
+          <p>
+	    Own Id: OTP-14166</p>
+        </item>
+        <item>
+          <p>
+	    The sftpd server now correctly uses <c>root_dir</c> and
+	    <c>cwd</c> when resolving file paths if both are
+	    provided. The <c>cwd</c> handling is also corrected.</p>
+          <p>
+	    Thanks to kape1395!</p>
+          <p>
+	    Own Id: OTP-14225 Aux Id: PR-1331, PR-1335 </p>
+        </item>
+        <item>
+          <p>
+	    Ssh_cli used a function that does not handle non-utf8
+	    unicode correctly.</p>
+          <p>
+	    Own Id: OTP-14230 Aux Id: ERL-364 </p>
+        </item>
+      </list>
+    </section>
+
+
+    <section><title>Improvements and New Features</title>
+      <list>
+        <item>
+          <p>
+	    The implementation of the key exchange algorithms
+	    diffie-hellman-group-exchange-sha* are optimized, up to a
+	    factor of 11 for the slowest ( = biggest and safest)
+	    group size.</p>
+          <p>
+	    Own Id: OTP-14169 Aux Id: seq-13261 </p>
+        </item>
+        <item>
+          <p>
+	    The ssh host key fingerprint generation now also takes a
+	    list of algorithms and returns a list of corresponding
+	    fingerprints. See
+	    <c>public_key:ssh_hostkey_fingerprint/2</c> and the
+	    option <c>silently_accept_hosts</c> in
+	    <c>ssh:connect</c>.</p>
+          <p>
+	    Own Id: OTP-14223</p>
+        </item>
+      </list>
+    </section>
+
+</section>
+
+<section><title>Ssh 4.4</title>
+
+    <section><title>Fixed Bugs and Malfunctions</title>
+      <list>
+        <item>
+          <p>
+	    A file read with an sftp client could loose data if the
+	    packet_size is set to larger than 64k. This is corrected
+	    now in such a way that the packet_size is silently
+	    lowered if there is a risk for data loss.</p>
+          <p>
+	    Own Id: OTP-13857 Aux Id: ERL-238, OTP-13858 </p>
+        </item>
+        <item>
+          <p>
+	    When user defined SSH shell REPL process exits with
+	    reason normal, the SSH channel callback module should
+	    report successful exit status to the SSH client. This
+	    provides simple way for SSH clients to check for
+	    successful completion of executed commands. (Thanks to
+	    isvilen)</p>
+          <p>
+	    Own Id: OTP-13905 Aux Id: PR-1173 </p>
+        </item>
+      </list>
+    </section>
+
+
+    <section><title>Improvements and New Features</title>
+      <list>
+        <item>
+          <p>
+	    Extended the option <c>silently_accept_hosts</c> for
+	    <c>ssh:connect</c> to make it possible for the client to
+	    check the SSH host key fingerprint string. Se the
+	    reference manual for SSH.</p>
+          <p>
+	    Own Id: OTP-13887 Aux Id: OTP-13888 </p>
+        </item>
+      </list>
+    </section>
+
+</section>
+
+<section><title>Ssh 4.3.6</title>
+
+    <section><title>Fixed Bugs and Malfunctions</title>
+      <list>
+        <item>
+          <p>
+	    Re-negotiation problems with OpenSSH client solved.</p>
+          <p>
+	    Own Id: OTP-13972</p>
+        </item>
+      </list>
+    </section>
+
+</section>
+
+<section><title>Ssh 4.3.5</title>
+
+    <section><title>Fixed Bugs and Malfunctions</title>
+      <list>
+        <item>
+          <p>
+	    If a client illegaly sends an info-line and then
+	    immediatly closes the TCP-connection, a badmatch
+	    exception was raised.</p>
+          <p>
+	    Own Id: OTP-13966</p>
+        </item>
+      </list>
+    </section>
+
+</section>
+
+<section><title>Ssh 4.3.4</title>
+
+    <section><title>Fixed Bugs and Malfunctions</title>
+      <list>
+        <item>
+          <p>
+	    Intermittent ssh ERROR REPORT mentioning
+	    nonblocking_sender</p>
+          <p>
+	    Own Id: OTP-13953 Aux Id: seq13199 </p>
+        </item>
+      </list>
+    </section>
+
+</section>
+
+<section><title>Ssh 4.3.3</title>
+
+    <section><title>Fixed Bugs and Malfunctions</title>
+      <list>
+        <item>
+          <p>
+	    Handle all possible exit values that should be
+	    interpreted as {error, closed}. Failing to do so could
+	    lead to unexpected crashes for users of the ssh
+	    application.</p>
+          <p>
+	    Own Id: OTP-13932 Aux Id: seq13189 </p>
+        </item>
+      </list>
+    </section>
+
+</section>
+
+<section><title>Ssh 4.3.2</title>
+
+    <section><title>Fixed Bugs and Malfunctions</title>
+      <list>
+        <item>
+          <p>
+	    Upgrade of an established client connection could crash
+	    because the ssh client supervisors children had wrong
+	    type. This is fixed now.</p>
+          <p>
+	    Own Id: OTP-13782 Aux Id: seq13158 </p>
+        </item>
+        <item>
+          <p>
+	    Partly checks the public key early in public key
+	    authorization</p>
+          <p>
+	    Own Id: OTP-13847 Aux Id:
+	    defensics-ssh3.1.0-190243,205277,219318 </p>
+        </item>
+        <item>
+          <p>
+	    Corrected handling of SHA for ECDSA (Elliptic curve
+	    public keys)</p>
+          <p>
+	    Own Id: OTP-13850 Aux Id: defensics-ssh3.1.0-214168 </p>
+        </item>
+        <item>
+          <p>
+	    Problems found by test suites as well as by
+	    Codenomicon/Defensics fixed: - reduce max random padding
+	    to 15 bytes (Codenomicon/Defensics) - inclomplete pdu
+	    handling (Codenomicon/Defensics) - badmatch in test suite
+	    - non-blocking send fixes deadlock in
+	    ssh_connection_SUITE:interrupted_send</p>
+          <p>
+	    Own Id: OTP-13854</p>
+        </item>
+        <item>
+          <p>
+	    Caller is now notified when a tcp close is received.</p>
+          <p>
+	    Own Id: OTP-13859 Aux Id: seq13177 </p>
+        </item>
+      </list>
+    </section>
+
+
+    <section><title>Improvements and New Features</title>
+      <list>
+        <item>
+          <p>
+	    Use application:ensure_all_started/2 instead of
+	    hard-coding deps</p>
+          <p>
+	    Own Id: OTP-13843 Aux Id: PR-1147 </p>
+        </item>
+      </list>
+    </section>
+
+</section>
+
+<section><title>Ssh 4.3.1</title>
+
+    <section><title>Fixed Bugs and Malfunctions</title>
+      <list>
+        <item>
+          <p>
+	    SSH client does not any longer retry a bad password given
+	    as option to ssh:connect et al.</p>
+          <p>
+	    Own Id: OTP-13674 Aux Id: TR-HU92273 </p>
+        </item>
+        <item>
+          <p>
+	    Removed possible hanging risk for a certain timing
+	    sequence when communicating client and server executes on
+	    the same node.</p>
+          <p>
+	    Own Id: OTP-13715</p>
+        </item>
+      </list>
+    </section>
+
+</section>
+
 <section><title>Ssh 4.3</title>
 
     <section><title>Improvements and New Features</title>
@@ -108,6 +570,22 @@
 
 </section>
 
+<section><title>Ssh 4.2.2.1</title>
+
+    <section><title>Fixed Bugs and Malfunctions</title>
+      <list>
+        <item>
+          <p>
+	    SSH client does not any longer retry a bad password given
+	    as option to ssh:connect et al.</p>
+          <p>
+	    Own Id: OTP-13674 Aux Id: TR-HU92273 </p>
+        </item>
+      </list>
+    </section>
+
+</section>
+
 <section><title>Ssh 4.2.2</title>
 
     <section><title>Fixed Bugs and Malfunctions</title>
diff --git a/lib/ssh/doc/src/ssh.xml b/lib/ssh/doc/src/ssh.xml
index e6c54d27bf..ea7e975ef5 100644
--- a/lib/ssh/doc/src/ssh.xml
+++ b/lib/ssh/doc/src/ssh.xml
@@ -4,7 +4,7 @@
 <erlref>
   <header>
     <copyright>
-      <year>2004</year><year>2015</year>
+      <year>2004</year><year>2017</year>
       <holder>Ericsson AB. All Rights Reserved.</holder>
     </copyright>
     <legalnotice>
@@ -153,7 +153,7 @@
 	  <item>
 	  <p>IP version to use.</p>
 	  </item>
-          <tag><c><![CDATA[{user_dir, string()}]]></c></tag>
+          <tag><marker id="opt_user_dir"></marker><c><![CDATA[{user_dir, string()}]]></c></tag>
 	  <item>
 	    <p>Sets the user directory, that is, the directory containing
 	    <c>ssh</c> configuration files for the user, such as
@@ -175,12 +175,48 @@
 	    supplied with this option.
 	    </p>
 	  </item>
-          <tag><c><![CDATA[{silently_accept_hosts, boolean()}]]></c></tag>
+          <tag>
+            <c><![CDATA[{silently_accept_hosts, boolean()}]]></c> <br/>
+            <c><![CDATA[{silently_accept_hosts, CallbackFun}]]></c> <br/>
+            <c><![CDATA[{silently_accept_hosts, {HashAlgoSpec, CallbackFun} }]]></c> <br/>
+            <br/>
+	    <c><![CDATA[HashAlgoSpec = crypto:digest_type() | [ crypto:digest_type() ] ]]></c><br/>
+	    <c><![CDATA[CallbackFun = fun(PeerName, FingerPrint) -> boolean()]]></c><br/>
+	    <c><![CDATA[PeerName = string()]]></c><br/>
+	    <c><![CDATA[FingerPrint = string() | [ string() ] ]]></c>
+	  </tag>
 	  <item>
-	    <p>When <c>true</c>, hosts are added to the
-	    file <c><![CDATA[known_hosts]]></c> without asking the user.
-	    Defaults to <c>false</c>.
-	    </p>
+            <p>This option guides the <c>connect</c> function how to act when the connected server presents a Host 
+            Key that the client has not seen before. The default is to ask the user with a question on stdio of whether to
+            accept or reject the new Host Key.
+            See also the option <seealso marker="#opt_user_dir"><c>user_dir</c></seealso>
+            for the path to the file <c>known_hosts</c> where previously accepted Host Keys are recorded.
+            </p>
+            <p>The option can be given in three different forms as seen above:</p>
+	    <list>
+	      <item>The value is a <c>boolean()</c>.  The value <c>true</c> will make the client accept any unknown
+              Host Key without any user interaction.  The value <c>false</c> keeps the default behaviour of asking the
+              the user on stdio.
+              </item>
+              <item>A <c>CallbackFun</c> will be called and the boolean return value <c>true</c> will make the client
+              accept the Host Key. A return value of <c>false</c> will make the client to reject the Host Key and therefore
+              also the connection will be closed. The arguments to the fun are:
+              <list type="bulleted">
+	        <item><c>PeerName</c> - a string with the name or address of the remote host.</item>
+                <item><c>FingerPrint</c> - the fingerprint of the Host Key as 
+                <seealso marker="public_key:public_key#ssh_hostkey_fingerprint-1">public_key:ssh_hostkey_fingerprint/1</seealso>
+                calculates it.
+                </item>
+              </list>
+              </item>
+              <item>A tuple <c>{HashAlgoSpec, CallbackFun}</c>. The <c>HashAlgoSpec</c> specifies which hash algorithm
+                shall be used to calculate the fingerprint used in the call of the <c>CallbackFun</c>. The <c>HashALgoSpec</c>
+                is either an atom or a list of atoms as the first argument in
+                <seealso marker="public_key:public_key#ssh_hostkey_fingerprint-2">public_key:ssh_hostkey_fingerprint/2</seealso>.
+                If it is a list of hash algorithm names, the <c>FingerPrint</c> argument in the <c>CallbackFun</c> will be 
+                a list of fingerprints in the same order as the corresponding name in the <c>HashAlgoSpec</c> list.
+              </item>
+            </list>
 	  </item>
 	  <tag><c><![CDATA[{user_interaction, boolean()}]]></c></tag>
 	  <item>
@@ -190,7 +226,7 @@
 	    supplying a password. Defaults to <c>true</c>.
 	    Even if user interaction is allowed it can be
 	    suppressed by other options, such as <c>silently_accept_hosts</c>
-	    and <c>password</c>. However, those optins are not always desirable
+	    and <c>password</c>. However, those options are not always desirable
 	    to use from a security point of view.</p>
 	  </item>
 
@@ -207,28 +243,15 @@
 	    <p><c>Peer</c> is in the format of <c>{Host,Port}</c>.</p>
 	  </item>
 
-	  <tag><c><![CDATA[{public_key_alg, 'ssh-rsa' | 'ssh-dss'}]]></c></tag>
-	  <item>
-	    <note>
-	      <p>This option will be removed in OTP 20, but is kept for compatibility. It is ignored if
-	      the preferred <c>pref_public_key_algs</c> option is used.</p>
-	    </note>
-            <p>Sets the preferred public key algorithm to use for user
-	    authentication. If the preferred algorithm fails,
-	    the other algorithm is tried. If <c>{public_key_alg, 'ssh-rsa'}</c> is set, it is translated
-	    to <c>{pref_public_key_algs, ['ssh-rsa','ssh-dss']}</c>.  If it is 
-	    <c>{public_key_alg, 'ssh-dss'}</c>, it is translated
-	    to <c>{pref_public_key_algs, ['ssh-dss','ssh-rsa']}</c>.
-	    </p>
-	  </item>
-
 	  <tag><c><![CDATA[{pref_public_key_algs, list()}]]></c></tag>
 	  <item>
             <p>List of user (client) public key algorithms to try to use.</p>
-	    <p>The default value is 
-	    <c><![CDATA[['ssh-rsa','ssh-dss','ecdsa-sha2-nistp256','ecdsa-sha2-nistp384','ecdsa-sha2-nistp521'] ]]></c>
+	    <p>The default value is the <c>public_key</c> entry in 
+	    <seealso marker="#default_algorithms/0">ssh:default_algorithms/0</seealso>.
+	    </p>
+	    <p>If there is no public key of a specified type available, the corresponding entry is ignored.
+	    Note that the available set is dependent on the underlying cryptolib and current user's public keys.
 	    </p>
-	    <p>If there is no public key of a specified type available, the corresponding entry is ignored.</p>
 	  </item>
 
 	  <tag><c><![CDATA[{preferred_algorithms, algs_list()}]]></c></tag>
@@ -272,6 +295,15 @@
 	    connection. For <c>gen_tcp</c> the time is in milli-seconds and the default value is
 	    <c>infinity</c>.</p>
 	  </item>
+
+	  <tag><c><![CDATA[{auth_methods, string()}]]></c></tag>
+	  <item>
+	    <p>Comma-separated string that determines which
+	    authentication methods that the client shall support and
+	    in which order they are tried. Defaults to
+	    <c><![CDATA["publickey,keyboard-interactive,password"]]></c></p>
+          </item>
+
 	  <tag><c><![CDATA[{user, string()}]]></c></tag>
           <item>
 	    <p>Provides a username. If this option is not given, <c>ssh</c>
@@ -279,6 +311,7 @@
 	    <c><![CDATA[USER]]></c> on UNIX,
 	    <c><![CDATA[USERNAME]]></c> on Windows).</p>
           </item>
+
 	  <tag><c><![CDATA[{password, string()}]]></c></tag>
           <item>
 	    <p>Provides a password for password authentication.
@@ -286,6 +319,30 @@
 	    password, if the password authentication method is
 	    attempted.</p>
           </item>
+
+	  <!--tag><c><![CDATA[{send_ext_info, boolean()}]]></c></tag>
+          <item>
+	    <p>Send a list of extensions to the server if the server has asked for it.  See 
+	    <url href="https://tools.ietf.org/html/draft-ietf-curdle-ssh-ext-info">Draft-ietf-curdle-ssh-ext-info (work in progress)</url> for details.
+	    </p>
+	    <p>Currently the client do not react on any extensions.
+	    </p>
+	    <p>Default value is <c>true</c>.
+	    </p>
+          </item-->
+
+	  <tag><c><![CDATA[{recv_ext_info, boolean()}]]></c></tag>
+          <item>
+	    <p>Tell the server that the client accepts extension negotiation.  See 
+	    <url href="https://tools.ietf.org/html/draft-ietf-curdle-ssh-ext-info">Draft-ietf-curdle-ssh-ext-info (work in progress)</url> for details.
+	    </p>
+	    <p>Currently implemented extension is <c>server-sig-algs</c> which is the list of the server's preferred
+	    user's public key algorithms.
+	    </p>
+	    <p>Default value is <c>true</c>.
+	    </p>
+          </item>
+
 	  <tag><c><![CDATA[{key_cb, key_cb()}]]></c></tag>
 	  <item>
 	    <p>Module implementing the behaviour <seealso
@@ -295,6 +352,7 @@
 	    module via the options passed to it under the key 'key_cb_private'.
 	    </p>
 	  </item>
+
 	  <tag><c><![CDATA[{quiet_mode, atom() = boolean()}]]></c></tag>
 	  <item>
 	    <p>If <c>true</c>, the client does not print anything on authorization.</p>
@@ -358,7 +416,7 @@
       on the given port.</fsummary>
       <type>
         <v>Port = integer()</v>
-	<v>HostAddress = ip_address() | any</v>
+	<v>HostAddress = ip_address() | any | loopback</v>
 	<v>Options = [{Option, Value}]</v>
         <v>Option = atom()</v>
 	<v>Value = term()</v>
@@ -369,6 +427,26 @@
         <p>Starts a server listening for SSH connections on the given
         port. If the <c>Port</c> is 0, a random free port is selected. See
 	<seealso marker="#daemon_info/1">daemon_info/1</seealso> about how to find the selected port number.</p>
+
+	<p>Please note that by historical reasons both the <c>HostAddress</c> argument and the inet socket option
+	<c>ip</c> set the listening address. This is a source of possible inconsistent settings.</p>
+
+	<p>The rules for handling the two address passing options are:</p>
+	<list>
+	  <item>if <c>HostAddress</c> is an IP-address, that IP-address is the listening address.
+	  An 'ip'-option will be discarded if present.</item>
+
+	  <item>if <c>HostAddress</c> is <c>loopback</c>, the listening address
+	  is <c>loopback</c> and an loopback address will be choosen by the underlying layers.
+	  An 'ip'-option will be discarded if present.</item>
+
+	  <item>if <c>HostAddress</c> is <c>any</c> and no 'ip'-option is present, the listening address is
+	  <c>any</c> and the socket will listen to all addresses</item>
+
+	  <item>if <c>HostAddress</c> is <c>any</c> and an 'ip'-option is present, the listening address is
+	  set to the value of the 'ip'-option</item>
+	</list>
+
 	<p>Options:</p>
         <taglist>
 	  <tag><c><![CDATA[{inet, inet | inet6}]]></c></tag>
@@ -425,6 +503,7 @@
 	    authentication methods that the server is to support and
 	    in what order they are tried. Defaults to
 	    <c><![CDATA["publickey,keyboard-interactive,password"]]></c></p>
+	    <p>Note that the client is free to use any order and to exclude methods.</p>
           </item>
 
 	  <tag><c><![CDATA[{auth_method_kb_interactive_data, PromptTexts}]]></c>
@@ -629,6 +708,27 @@
 	    </p>
 	  </item>
 
+	  <tag><c><![CDATA[{send_ext_info, boolean()}]]></c></tag>
+          <item>
+	    <p>Send a list of extensions to the client if the client has asked for it. See 
+	    <url href="https://tools.ietf.org/html/draft-ietf-curdle-ssh-ext-info">Draft-ietf-curdle-ssh-ext-info (work in progress)</url> for details.
+	    </p>
+	    <p>Currently implemented extension is sending <c>server-sig-algs</c> which is the list of the server's preferred
+	    user's public key algorithms.
+	    </p>
+	    <p>Default value is <c>true</c>.
+	    </p>
+          </item>
+
+	  <!--tag><c><![CDATA[{recv_ext_info, boolean()}]]></c></tag>
+          <item>
+	    <p>Tell the client that the server accepts extension negotiation.  See 
+	    <url href="https://tools.ietf.org/html/draft-ietf-curdle-ssh-ext-info">Draft-ietf-curdle-ssh-ext-info (work in progress)</url> for details.
+	    </p>
+	    <p>Default value is <c>true</c>.
+	    </p>
+          </item-->
+
 	  <tag><c><![CDATA[{key_cb, key_cb()}]]></c></tag>
 	  <item>
 	    <p>Module implementing the behaviour <seealso
@@ -678,6 +778,12 @@
 	    <p><c>Peer</c> is in the format of <c>{Host,Port}</c>.</p>
 	  </item>
 
+	  <tag><c><![CDATA[{idle_time, integer()}]]></c></tag>
+	  <item>
+	  <p>Sets a time-out on a connection when no channels are active.
+	  Defaults to <c>infinity</c>.</p>
+	  </item>
+
 	  <tag><c><![CDATA[{ssh_msg_debug_fun, fun(ConnectionRef::ssh_connection_ref(), AlwaysDisplay::boolean(), Msg::binary(), LanguageTag::binary()) -> _}]]></c></tag>
 	  <item>
 	    <p>Provide a fun to implement your own logging of the SSH message SSH_MSG_DEBUG. The last three parameters are from the message, see RFC4253, section 11.3. The <c>ConnectionRef</c> is the reference to the connection on which the message arrived. The return value from the fun is not checked.</p>
@@ -690,9 +796,10 @@
     </func>
 
     <func>
-      <name>daemon_info(Daemon) -> {ok, [{port,Port}]} | {error,Error}</name>
+      <name>daemon_info(Daemon) -> {ok, [DaemonInfo]} | {error,Error}</name>
       <fsummary>Get info about a daemon</fsummary>
       <type>
+	<v>DaemonInfo = {port,Port::pos_integer()} | {listen_address, any|ip_address()} | {profile,atom()}</v>
         <v>Port = integer()</v>
 	<v>Error = bad_daemon_ref</v>
       </type>
@@ -756,7 +863,7 @@
         <p>Utility function that starts the applications <c>crypto</c>, <c>public_key</c>,
 	and <c>ssh</c>. Default type is <c>temporary</c>.
 	For more information, see the <seealso marker="kernel:application">application(3)</seealso>
-	manual page in <c>kernel</c>.</p>
+	manual page in Kernel.</p>
       </desc>
     </func>
 
@@ -769,7 +876,7 @@
       <desc>
         <p>Stops the <c>ssh</c> application.
 	For more information, see the <seealso marker="kernel:application">application(3)</seealso>
-	manual page in <c>kernel</c>.</p>
+	manual page in Kernel.</p>
       </desc>
     </func>
     
diff --git a/lib/ssh/doc/src/ssh_app.xml b/lib/ssh/doc/src/ssh_app.xml
index f6ce44c015..33ec7aaee0 100644
--- a/lib/ssh/doc/src/ssh_app.xml
+++ b/lib/ssh/doc/src/ssh_app.xml
@@ -4,7 +4,7 @@
 <appref>
   <header>
     <copyright>
-      <year>2012</year><year>2015</year>
+      <year>2012</year><year>2017</year>
       <holder>Ericsson AB. All Rights Reserved.</holder>
     </copyright>
     <legalnotice>
@@ -109,7 +109,7 @@
   </section>
  <section>
     <title>Host Keys</title>
-    <p>RSA and DSA host keys are supported and are
+    <p>RSA, DSA and ECDSA host keys are supported and are
        expected to be found in files named <c>ssh_host_rsa_key</c>,
        <c>ssh_host_dsa_key</c> and <c>ssh_host_ecdsa_key</c>.
        </p>
@@ -146,7 +146,10 @@
 	  <item>diffie-hellman-group-exchange-sha1</item>
 	  <item>diffie-hellman-group-exchange-sha256</item>
 	  <item>diffie-hellman-group14-sha1</item>
-	  <item>diffie-hellman-group1-sha1</item>
+	  <item>diffie-hellman-group14-sha256</item>
+	  <item>diffie-hellman-group16-sha512</item>
+	  <item>diffie-hellman-group18-sha512</item>
+	  <item>(diffie-hellman-group1-sha1, retired: can be enabled with the <c>preferred_algorithms</c> option)</item>
 	</list>
       </item>
 
@@ -158,6 +161,8 @@
 	  <item>ecdsa-sha2-nistp521</item>
 	  <item>ssh-rsa</item>
 	  <item>ssh-dss</item>
+	  <item>rsa-sha2-256</item>
+	  <item>rsa-sha2-512</item>
 	</list>
       </item>
 
@@ -173,21 +178,23 @@
       <tag>Encryption algorithms (ciphers)</tag>
       <item>
 	<list type="bulleted">
-	  <item>[email protected] (AEAD_AES_128_GCM)</item>
-          <item>[email protected] (AEAD_AES_256_GCM)</item>
+          <item>[email protected]</item>
+          <item>[email protected]</item>
 	  <item>aes128-ctr</item>
 	  <item>aes192-ctr</item>
 	  <item>aes256-ctr</item>
 	  <item>aes128-cbc</item>
 	  <item>3des-cbc</item>
+	  <item>(AEAD_AES_128_GCM, not enabled per default)</item>
+          <item>(AEAD_AES_256_GCM, not enabled per default)</item>
 	</list>
+	<p>See the text at the description of <seealso marker="#rfc5647_note">the rfc 5647 further down</seealso>
+	for more information regarding AEAD_AES_*_GCM.
+	</p>
 	<p>Following the internet de-facto standard, the cipher and mac algorithm AEAD_AES_128_GCM is selected when the 
 	cipher [email protected] is negotiated. The cipher and mac algorithm AEAD_AES_256_GCM is selected when the
 	cipher [email protected] is negotiated.
 	</p>
-	<p>See the text at the description of <seealso marker="#rfc5647_note">the rfc 5647 further down</seealso>
-	for more information.
-	</p>
       </item>
 	
       <tag>Compression algorithms</tag>
@@ -203,7 +210,7 @@
   <section>
     <title>Unicode support</title>
     <p>Unicode filenames are supported if the emulator and the underlaying OS support it. See section DESCRIPTION in the
-      <seealso marker="kernel:file">file</seealso> manual page in <c>kernel</c> for information about this subject.
+      <seealso marker="kernel:file">file</seealso> manual page in Kernel for information about this subject.
     </p>
     <p>The shell and the cli both support unicode.
     </p>
@@ -232,7 +239,11 @@
       </item>
 
       <item><url href="https://tools.ietf.org/html/rfc4253">RFC 4253</url>, The Secure Shell (SSH) Transport Layer Protocol.
-       <p></p>
+      <p>Except</p>
+      <list type="bulleted">
+	<item>8.1.  diffie-hellman-group1-sha1. Disabled by default, can be enabled with the <c>preferred_algorithms</c> option.</item>
+      </list>
+      <p/>
       </item>
 
       <item><url href="https://tools.ietf.org/html/rfc4254">RFC 4254</url>, The Secure Shell (SSH) Connection Protocol.
@@ -306,6 +317,30 @@
       <p>Comment: Defines hmac-sha2-256 and hmac-sha2-512
       </p>
       </item>
+
+      <item><url href="https://tools.ietf.org/html/draft-ietf-curdle-ssh-kex-sha2">Draft-ietf-curdle-ssh-kex-sha2 (work in progress)</url>, Key Exchange (KEX) Method Updates and Recommendations for Secure Shell (SSH).
+      <p>Deviations:</p>
+      <list type="bulleted">
+	<item>The <c>diffie-hellman-group1-sha1</c> is not enabled by default, but is still supported and can be enabled
+	with the option <c>preferred-algorithms</c></item>
+	<item>The questionable sha1-based algorithms <c>diffie-hellman-group-exchange-sha1</c> and
+	<c>diffie-hellman-group14-sha1</c> are still enabled by default for compatibility with ancient clients and servers.
+	They can be disabled with the option <c>preferred-algorithms</c></item>
+      </list>
+      <p/>
+      </item>
+
+      <item><url href="https://tools.ietf.org/html/draft-ietf-curdle-rsa-sha2">Draft-ietf-curdle-rsa-sha2 (work in progress)</url>, Use of RSA Keys with SHA-2 256 and 512 in Secure Shell (SSH).
+      </item>
+      
+      <item><url href="https://tools.ietf.org/html/draft-ietf-curdle-ssh-ext-info">Draft-ietf-curdle-ssh-ext-info (work in progress)</url>, Extension Negotiation in Secure Shell (SSH).
+      <p>Implemented are:</p>
+      <list type="bulleted">
+	<item>The Extension Negotiation Mechanism</item>
+	<item>The extension <c>server-sig-algs</c></item>
+      </list>
+      <p/>
+      </item>
       
     </list>
 
diff --git a/lib/ssh/doc/src/ssh_channel.xml b/lib/ssh/doc/src/ssh_channel.xml
index 907b0b3bec..7b598494f7 100644
--- a/lib/ssh/doc/src/ssh_channel.xml
+++ b/lib/ssh/doc/src/ssh_channel.xml
@@ -139,7 +139,7 @@
 	enters the <c>ssh_channel</c> process receive loop and become an
 	<c>ssh_channel process</c>. The process must have been started using
 	one of the start functions in <c>proc_lib</c>, see the <seealso
-	marker="stdlib:proc_lib">proc_lib(3)</seealso> manual page in <c>stdlib</c>.
+	marker="stdlib:proc_lib">proc_lib(3)</seealso> manual page in STDLIB.
 	The user is responsible for any initialization of the process
 	and must call <seealso marker = "#init-1">ssh_channel:init/1</seealso>.
 	</p>
diff --git a/lib/ssh/doc/src/ssh_protocol.xml b/lib/ssh/doc/src/ssh_protocol.xml
index 7288266cf7..a0032ab449 100644
--- a/lib/ssh/doc/src/ssh_protocol.xml
+++ b/lib/ssh/doc/src/ssh_protocol.xml
@@ -4,7 +4,7 @@
 <chapter>
   <header>
     <copyright>
-      <year>2013</year><year>2013</year>
+      <year>2013</year><year>2016</year>
       <holder>Ericsson AB. All Rights Reserved.</holder>
     </copyright>
     <legalnotice>
@@ -138,8 +138,6 @@
       Transport Layer Protocol.</item>
       <item><url href="http://www.ietf.org/rfc/rfc4254.txt">RFC 4254</url> -
       Connection Protocol.</item>
-      <item><url href="http://www.ietf.org/rfc/rfc4255.txt">RFC 4255</url> -
-      Key Fingerprints.</item>
       <item><url href="http://www.ietf.org/rfc/rfc4344.txt">RFC 4344</url> -
       Transport Layer Encryption Modes.</item>
       <item><url href="http://www.ietf.org/rfc/rfc4716.txt">RFC 4716</url> -
diff --git a/lib/ssh/doc/src/ssh_sftp.xml b/lib/ssh/doc/src/ssh_sftp.xml
index eb6f43d417..ed7fbf9cf3 100644
--- a/lib/ssh/doc/src/ssh_sftp.xml
+++ b/lib/ssh/doc/src/ssh_sftp.xml
@@ -4,7 +4,7 @@
 <erlref>
   <header>
     <copyright>
-      <year>2005</year><year>2016</year>
+      <year>2005</year><year>2017</year>
       <holder>Ericsson AB. All Rights Reserved.</holder>
     </copyright>
     <legalnotice>
@@ -558,8 +558,14 @@
 	<taglist>
           <tag><c><![CDATA[{timeout, timeout()}]]></c></tag>
 	  <item>
-	    <p>The time-out is passed to the <c>ssh_channel</c> start function,
-	    and defaults to <c>infinity</c>.</p>
+	    <p>There are two ways to set a timeout for the underlying ssh connection:</p>
+	    <list>
+	      <item>If the connection timeout option <c>connect_timeout</c> is set, that value
+	      is used also for the negotiation timeout and this option (<c>timeout</c>) is ignored.</item>
+	      <item>Otherwise, this option (<c>timeout</c>) is used as the negotiation timeout
+	      only and there is no connection timeout set</item>
+	    </list>
+	    <p>The value defaults to <c>infinity</c>.</p>
 	  </item>
 	  <tag>
 	    <c><![CDATA[{sftp_vsn, integer()}]]></c>
diff --git a/lib/ssh/doc/src/using_ssh.xml b/lib/ssh/doc/src/using_ssh.xml
index 0861c641c7..ab307624e6 100644
--- a/lib/ssh/doc/src/using_ssh.xml
+++ b/lib/ssh/doc/src/using_ssh.xml
@@ -5,7 +5,7 @@
   <header>
     <copyright>
       <year>2012</year>
-      <year>2016</year>
+      <year>2017</year>
       <holder>Ericsson AB. All Rights Reserved.</holder>
     </copyright>
     <legalnotice>
@@ -305,7 +305,7 @@ ok = erl_tar:close(HandleRead),
 
     <code type="erl" >
 -module(ssh_echo_server).
--behaviour(ssh_subsystem).
+-behaviour(ssh_daemon_channel).
 -record(state, {
 	  n,
 	  id,