diff options
author | Dengke Du <dengke.du@windriver.com> | 2017-01-22 02:12:40 -0500 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2017-01-26 10:44:28 +0000 |
commit | d742290d8497d6d3abecc12462c65cb3cbdf4cb0 (patch) | |
tree | c0f06f19dc7f054da08f79681d35c53827e0ed4f /meta/recipes-connectivity/openssh/openssh_7.4p1.bb | |
parent | 543d0b0d1b44bcf12d433b1a1ae7134ca11c25e5 (diff) | |
download | poky-d742290d8497d6d3abecc12462c65cb3cbdf4cb0.tar.gz |
openssh: upgrade to 7.4p1
1. Drop CVE patch: fix-CVE-2016-8858.patch, because the version 7.4p1 have
been fixed it.
2. Rebase the remaining patchs on the version 7.4p1.
(From OE-Core rev: b648b382046bd94f0cf5fe0aa4b77ab250f126cd)
Signed-off-by: Dengke Du <dengke.du@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-connectivity/openssh/openssh_7.4p1.bb')
-rw-r--r-- | meta/recipes-connectivity/openssh/openssh_7.4p1.bb | 164 |
1 files changed, 164 insertions, 0 deletions
diff --git a/meta/recipes-connectivity/openssh/openssh_7.4p1.bb b/meta/recipes-connectivity/openssh/openssh_7.4p1.bb new file mode 100644 index 0000000000..3b3d667a68 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh_7.4p1.bb | |||
@@ -0,0 +1,164 @@ | |||
1 | SUMMARY = "A suite of security-related network utilities based on \ | ||
2 | the SSH protocol including the ssh client and sshd server" | ||
3 | DESCRIPTION = "Secure rlogin/rsh/rcp/telnet replacement (OpenSSH) \ | ||
4 | Ssh (Secure Shell) is a program for logging into a remote machine \ | ||
5 | and for executing commands on a remote machine." | ||
6 | HOMEPAGE = "http://www.openssh.com/" | ||
7 | SECTION = "console/network" | ||
8 | LICENSE = "BSD" | ||
9 | LIC_FILES_CHKSUM = "file://LICENCE;md5=e326045657e842541d3f35aada442507" | ||
10 | |||
11 | DEPENDS = "zlib openssl" | ||
12 | DEPENDS += "${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'libpam', '', d)}" | ||
13 | |||
14 | SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar.gz \ | ||
15 | file://sshd_config \ | ||
16 | file://ssh_config \ | ||
17 | file://init \ | ||
18 | ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', '', d)} \ | ||
19 | file://sshd.socket \ | ||
20 | file://sshd@.service \ | ||
21 | file://sshdgenkeys.service \ | ||
22 | file://volatiles.99_sshd \ | ||
23 | file://add-test-support-for-busybox.patch \ | ||
24 | file://run-ptest \ | ||
25 | file://openssh-7.1p1-conditional-compile-des-in-cipher.patch \ | ||
26 | file://openssh-7.1p1-conditional-compile-des-in-pkcs11.patch \ | ||
27 | file://fix-potential-signed-overflow-in-pointer-arithmatic.patch \ | ||
28 | " | ||
29 | |||
30 | PAM_SRC_URI = "file://sshd" | ||
31 | |||
32 | SRC_URI[md5sum] = "b2db2a83caf66a208bb78d6d287cdaa3" | ||
33 | SRC_URI[sha256sum] = "1b1fc4a14e2024293181924ed24872e6f2e06293f3e8926a376b8aec481f19d1" | ||
34 | |||
35 | inherit useradd update-rc.d update-alternatives systemd | ||
36 | |||
37 | USERADD_PACKAGES = "${PN}-sshd" | ||
38 | USERADD_PARAM_${PN}-sshd = "--system --no-create-home --home-dir /var/run/sshd --shell /bin/false --user-group sshd" | ||
39 | INITSCRIPT_PACKAGES = "${PN}-sshd" | ||
40 | INITSCRIPT_NAME_${PN}-sshd = "sshd" | ||
41 | INITSCRIPT_PARAMS_${PN}-sshd = "defaults 9" | ||
42 | |||
43 | SYSTEMD_PACKAGES = "${PN}-sshd" | ||
44 | SYSTEMD_SERVICE_${PN}-sshd = "sshd.socket" | ||
45 | |||
46 | inherit autotools-brokensep ptest | ||
47 | |||
48 | # LFS support: | ||
49 | CFLAGS += "-D__FILE_OFFSET_BITS=64" | ||
50 | |||
51 | # login path is hardcoded in sshd | ||
52 | EXTRA_OECONF = "'LOGIN_PROGRAM=${base_bindir}/login' \ | ||
53 | ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '--with-pam', '--without-pam', d)} \ | ||
54 | --without-zlib-version-check \ | ||
55 | --with-privsep-path=/var/run/sshd \ | ||
56 | --sysconfdir=${sysconfdir}/ssh \ | ||
57 | --with-xauth=/usr/bin/xauth \ | ||
58 | --disable-strip \ | ||
59 | " | ||
60 | |||
61 | # Since we do not depend on libbsd, we do not want configure to use it | ||
62 | # just because it finds libutil.h. But, specifying --disable-libutil | ||
63 | # causes compile errors, so... | ||
64 | CACHED_CONFIGUREVARS += "ac_cv_header_bsd_libutil_h=no ac_cv_header_libutil_h=no" | ||
65 | |||
66 | # passwd path is hardcoded in sshd | ||
67 | CACHED_CONFIGUREVARS += "ac_cv_path_PATH_PASSWD_PROG=${bindir}/passwd" | ||
68 | |||
69 | # We don't want to depend on libblockfile | ||
70 | CACHED_CONFIGUREVARS += "ac_cv_header_maillock_h=no" | ||
71 | |||
72 | # This is a workaround for uclibc because including stdio.h | ||
73 | # pulls in pthreads.h and causes conflicts in function prototypes. | ||
74 | # This results in compilation failure, so unless this is fixed, | ||
75 | # disable pam for uclibc. | ||
76 | EXTRA_OECONF_append_libc-uclibc=" --without-pam" | ||
77 | |||
78 | do_configure_prepend () { | ||
79 | export LD="${CC}" | ||
80 | install -m 0644 ${WORKDIR}/sshd_config ${B}/ | ||
81 | install -m 0644 ${WORKDIR}/ssh_config ${B}/ | ||
82 | if [ ! -e acinclude.m4 -a -e aclocal.m4 ]; then | ||
83 | cp aclocal.m4 acinclude.m4 | ||
84 | fi | ||
85 | } | ||
86 | |||
87 | do_compile_ptest() { | ||
88 | # skip regress/unittests/ binaries: this will silently skip | ||
89 | # unittests in run-ptests which is good because they are so slow. | ||
90 | oe_runmake regress/modpipe regress/setuid-allowed regress/netcat | ||
91 | } | ||
92 | |||
93 | do_install_append () { | ||
94 | if [ "${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'pam', '', d)}" = "pam" ]; then | ||
95 | install -D -m 0644 ${WORKDIR}/sshd ${D}${sysconfdir}/pam.d/sshd | ||
96 | sed -i -e 's:#UsePAM no:UsePAM yes:' ${D}${sysconfdir}/ssh/sshd_config | ||
97 | fi | ||
98 | |||
99 | if [ "${@bb.utils.contains('DISTRO_FEATURES', 'x11', 'x11', '', d)}" = "x11" ]; then | ||
100 | sed -i -e 's:#X11Forwarding no:X11Forwarding yes:' ${D}${sysconfdir}/ssh/sshd_config | ||
101 | fi | ||
102 | |||
103 | install -d ${D}${sysconfdir}/init.d | ||
104 | install -m 0755 ${WORKDIR}/init ${D}${sysconfdir}/init.d/sshd | ||
105 | rm -f ${D}${bindir}/slogin ${D}${datadir}/Ssh.bin | ||
106 | rmdir ${D}${localstatedir}/run/sshd ${D}${localstatedir}/run ${D}${localstatedir} | ||
107 | install -d ${D}/${sysconfdir}/default/volatiles | ||
108 | install -m 644 ${WORKDIR}/volatiles.99_sshd ${D}/${sysconfdir}/default/volatiles/99_sshd | ||
109 | install -m 0755 ${S}/contrib/ssh-copy-id ${D}${bindir} | ||
110 | |||
111 | # Create config files for read-only rootfs | ||
112 | install -d ${D}${sysconfdir}/ssh | ||
113 | install -m 644 ${D}${sysconfdir}/ssh/sshd_config ${D}${sysconfdir}/ssh/sshd_config_readonly | ||
114 | sed -i '/HostKey/d' ${D}${sysconfdir}/ssh/sshd_config_readonly | ||
115 | echo "HostKey /var/run/ssh/ssh_host_rsa_key" >> ${D}${sysconfdir}/ssh/sshd_config_readonly | ||
116 | echo "HostKey /var/run/ssh/ssh_host_dsa_key" >> ${D}${sysconfdir}/ssh/sshd_config_readonly | ||
117 | echo "HostKey /var/run/ssh/ssh_host_ecdsa_key" >> ${D}${sysconfdir}/ssh/sshd_config_readonly | ||
118 | echo "HostKey /var/run/ssh/ssh_host_ed25519_key" >> ${D}${sysconfdir}/ssh/sshd_config_readonly | ||
119 | |||
120 | install -d ${D}${systemd_unitdir}/system | ||
121 | install -c -m 0644 ${WORKDIR}/sshd.socket ${D}${systemd_unitdir}/system | ||
122 | install -c -m 0644 ${WORKDIR}/sshd@.service ${D}${systemd_unitdir}/system | ||
123 | install -c -m 0644 ${WORKDIR}/sshdgenkeys.service ${D}${systemd_unitdir}/system | ||
124 | sed -i -e 's,@BASE_BINDIR@,${base_bindir},g' \ | ||
125 | -e 's,@SBINDIR@,${sbindir},g' \ | ||
126 | -e 's,@BINDIR@,${bindir},g' \ | ||
127 | ${D}${systemd_unitdir}/system/sshd.socket ${D}${systemd_unitdir}/system/*.service | ||
128 | } | ||
129 | |||
130 | do_install_ptest () { | ||
131 | sed -i -e "s|^SFTPSERVER=.*|SFTPSERVER=${libexecdir}/sftp-server|" regress/test-exec.sh | ||
132 | cp -r regress ${D}${PTEST_PATH} | ||
133 | } | ||
134 | |||
135 | ALLOW_EMPTY_${PN} = "1" | ||
136 | |||
137 | PACKAGES =+ "${PN}-keygen ${PN}-scp ${PN}-ssh ${PN}-sshd ${PN}-sftp ${PN}-misc ${PN}-sftp-server" | ||
138 | FILES_${PN}-scp = "${bindir}/scp.${BPN}" | ||
139 | FILES_${PN}-ssh = "${bindir}/ssh.${BPN} ${sysconfdir}/ssh/ssh_config" | ||
140 | FILES_${PN}-sshd = "${sbindir}/sshd ${sysconfdir}/init.d/sshd ${systemd_unitdir}/system" | ||
141 | FILES_${PN}-sshd += "${sysconfdir}/ssh/moduli ${sysconfdir}/ssh/sshd_config ${sysconfdir}/ssh/sshd_config_readonly ${sysconfdir}/default/volatiles/99_sshd ${sysconfdir}/pam.d/sshd" | ||
142 | FILES_${PN}-sftp = "${bindir}/sftp" | ||
143 | FILES_${PN}-sftp-server = "${libexecdir}/sftp-server" | ||
144 | FILES_${PN}-misc = "${bindir}/ssh* ${libexecdir}/ssh*" | ||
145 | FILES_${PN}-keygen = "${bindir}/ssh-keygen" | ||
146 | |||
147 | RDEPENDS_${PN} += "${PN}-scp ${PN}-ssh ${PN}-sshd ${PN}-keygen" | ||
148 | RDEPENDS_${PN}-sshd += "${PN}-keygen ${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'pam-plugin-keyinit pam-plugin-loginuid', '', d)}" | ||
149 | RDEPENDS_${PN}-ptest += "${PN}-sftp ${PN}-misc ${PN}-sftp-server make" | ||
150 | |||
151 | RPROVIDES_${PN}-ssh = "ssh" | ||
152 | RPROVIDES_${PN}-sshd = "sshd" | ||
153 | |||
154 | RCONFLICTS_${PN} = "dropbear" | ||
155 | RCONFLICTS_${PN}-sshd = "dropbear" | ||
156 | RCONFLICTS_${PN}-keygen = "ssh-keygen" | ||
157 | |||
158 | CONFFILES_${PN}-sshd = "${sysconfdir}/ssh/sshd_config" | ||
159 | CONFFILES_${PN}-ssh = "${sysconfdir}/ssh/ssh_config" | ||
160 | |||
161 | ALTERNATIVE_PRIORITY = "90" | ||
162 | ALTERNATIVE_${PN}-scp = "scp" | ||
163 | ALTERNATIVE_${PN}-ssh = "ssh" | ||
164 | |||