From c527fd1f14c27855a37f2e8ac5346ce8d940ced2 Mon Sep 17 00:00:00 2001 From: Tudor Florea Date: Thu, 16 Oct 2014 03:05:19 +0200 Subject: initial commit for Enea Linux 4.0-140929 Migrated from the internal git server on the daisy-enea-point-release branch Signed-off-by: Tudor Florea --- .../files/add-test-support-for-busybox.patch | 61 +++++++++ meta/recipes-connectivity/openssh/files/run-ptest | 7 + meta/recipes-connectivity/openssh/openssh/init | 113 ++++++++++++++++ .../openssh/openssh/nostrip.patch | 20 +++ .../openssh/openssh/openssh-CVE-2011-4327.patch | 29 ++++ .../openssh/openssh/ssh_config | 46 +++++++ meta/recipes-connectivity/openssh/openssh/sshd | 10 ++ .../openssh/openssh/sshd.socket | 10 ++ .../openssh/openssh/sshd@.service | 10 ++ .../openssh/openssh/sshd_config | 119 +++++++++++++++++ .../openssh/openssh/sshdgenkeys.service | 10 ++ .../openssh/openssh/volatiles.99_sshd | 1 + meta/recipes-connectivity/openssh/openssh_6.5p1.bb | 147 +++++++++++++++++++++ 13 files changed, 583 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/files/add-test-support-for-busybox.patch create mode 100755 meta/recipes-connectivity/openssh/files/run-ptest create mode 100644 meta/recipes-connectivity/openssh/openssh/init create mode 100644 meta/recipes-connectivity/openssh/openssh/nostrip.patch create mode 100644 meta/recipes-connectivity/openssh/openssh/openssh-CVE-2011-4327.patch create mode 100644 meta/recipes-connectivity/openssh/openssh/ssh_config create mode 100644 meta/recipes-connectivity/openssh/openssh/sshd create mode 100644 meta/recipes-connectivity/openssh/openssh/sshd.socket create mode 100644 meta/recipes-connectivity/openssh/openssh/sshd@.service create mode 100644 meta/recipes-connectivity/openssh/openssh/sshd_config create mode 100644 meta/recipes-connectivity/openssh/openssh/sshdgenkeys.service create mode 100644 meta/recipes-connectivity/openssh/openssh/volatiles.99_sshd create mode 100644 meta/recipes-connectivity/openssh/openssh_6.5p1.bb (limited to 'meta/recipes-connectivity/openssh') diff --git a/meta/recipes-connectivity/openssh/files/add-test-support-for-busybox.patch b/meta/recipes-connectivity/openssh/files/add-test-support-for-busybox.patch new file mode 100644 index 0000000000..5913597dfd --- /dev/null +++ b/meta/recipes-connectivity/openssh/files/add-test-support-for-busybox.patch @@ -0,0 +1,61 @@ +Adjust test cases to work with busybox. + +- Replace dd parameter "obs" with "bs". +- Replace "head -" with "head -n ". + +Signed-off-by: Björn Stenberg +Upstream-status: Pending + +--- a/regress/cipher-speed.sh 2012-06-30 07:08:53.000000000 +0200 ++++ b/regress/cipher-speed.sh 2013-02-15 11:30:20.670022055 +0100 +@@ -26,7 +26,7 @@ + echon "$c/$m:\t" + ( ${SSH} -o 'compression no' \ + -F $OBJ/ssh_proxy -2 -m $m -c $c somehost \ +- exec sh -c \'"dd of=/dev/null obs=32k"\' \ ++ exec sh -c \'"dd of=/dev/null bs=32k"\' \ + < ${DATA} ) 2>&1 | getbytes + + if [ $? -ne 0 ]; then +@@ -42,7 +42,7 @@ + echon "$c:\t" + ( ${SSH} -o 'compression no' \ + -F $OBJ/ssh_proxy -1 -c $c somehost \ +- exec sh -c \'"dd of=/dev/null obs=32k"\' \ ++ exec sh -c \'"dd of=/dev/null bs=32k"\' \ + < ${DATA} ) 2>&1 | getbytes + if [ $? -ne 0 ]; then + fail "ssh -1 failed with cipher $c" +--- a/regress/transfer.sh 2003-09-04 06:54:40.000000000 +0200 ++++ b/regress/transfer.sh 2013-02-15 11:25:34.666411185 +0100 +@@ -18,7 +18,7 @@ + for s in 10 100 1k 32k 64k 128k 256k; do + trace "proto $p dd-size ${s}" + rm -f ${COPY} +- dd if=$DATA obs=${s} 2> /dev/null | \ ++ dd if=$DATA bs=${s} 2> /dev/null | \ + ${SSH} -q -$p -F $OBJ/ssh_proxy somehost "cat > ${COPY}" + if [ $? -ne 0 ]; then + fail "ssh cat $DATA failed" +--- a/regress/yes-head.sh 2005-11-28 06:41:03.000000000 +0100 ++++ b/regress/yes-head.sh 2013-02-15 11:55:11.413715068 +0100 +@@ -4,7 +4,7 @@ + tid="yes pipe head" + + for p in 1 2; do +- lines=`${SSH} -$p -F $OBJ/ssh_proxy thishost 'sh -c "while true;do echo yes;done | _POSIX2_VERSION=199209 head -2000"' | (sleep 3 ; wc -l)` ++ lines=`${SSH} -$p -F $OBJ/ssh_proxy thishost 'sh -c "while true;do echo yes;done | _POSIX2_VERSION=199209 head -n 2000"' | (sleep 3 ; wc -l)` + if [ $? -ne 0 ]; then + fail "yes|head test failed" + lines = 0; +--- a/regress/key-options.sh 2008-07-04 09:08:58.000000000 +0200 ++++ b/regress/key-options.sh 2013-02-15 12:06:05.109486098 +0100 +@@ -54,7 +54,7 @@ + fi + + sed 's/.*/from="'"$f"'" &/' $origkeys >$authkeys +- from=`head -1 $authkeys | cut -f1 -d ' '` ++ from=`head -n 1 $authkeys | cut -f1 -d ' '` + verbose "key option proto $p $from" + r=`${SSH} -$p -q -F $OBJ/ssh_proxy somehost 'echo true'` + if [ "$r" = "true" ]; then diff --git a/meta/recipes-connectivity/openssh/files/run-ptest b/meta/recipes-connectivity/openssh/files/run-ptest new file mode 100755 index 0000000000..3e725cf282 --- /dev/null +++ b/meta/recipes-connectivity/openssh/files/run-ptest @@ -0,0 +1,7 @@ +#!/bin/sh + +export TEST_SHELL=sh + +cd regress +make -k .OBJDIR=`pwd` .CURDIR=`pwd` tests \ + | sed -e 's/^skipped/SKIP: /g' -e 's/^ok /PASS: /g' -e 's/^failed/FAIL: /g' diff --git a/meta/recipes-connectivity/openssh/openssh/init b/meta/recipes-connectivity/openssh/openssh/init new file mode 100644 index 0000000000..37c8e7b907 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/init @@ -0,0 +1,113 @@ +#! /bin/sh +set -e + +# source function library +. /etc/init.d/functions + +# /etc/init.d/ssh: start and stop the OpenBSD "secure shell" daemon + +test -x /usr/sbin/sshd || exit 0 +( /usr/sbin/sshd -\? 2>&1 | grep -q OpenSSH ) 2>/dev/null || exit 0 + +# /etc/default/ssh may set SYSCONFDIR and SSHD_OPTS +if test -f /etc/default/ssh; then + . /etc/default/ssh +fi + +[ -z "$SYSCONFDIR" ] && SYSCONFDIR=/etc/ssh +mkdir -p $SYSCONFDIR + +HOST_KEY_RSA=$SYSCONFDIR/ssh_host_rsa_key +HOST_KEY_DSA=$SYSCONFDIR/ssh_host_dsa_key +HOST_KEY_ECDSA=$SYSCONFDIR/ssh_host_ecdsa_key +HOST_KEY_ED25519=$SYSCONFDIR/ssh_host_ed25519_key + +check_for_no_start() { + # forget it if we're trying to start, and /etc/ssh/sshd_not_to_be_run exists + if [ -e $SYSCONFDIR/sshd_not_to_be_run ]; then + echo "OpenBSD Secure Shell server not in use ($SYSCONFDIR/sshd_not_to_be_run)" + exit 0 + fi +} + +check_privsep_dir() { + # Create the PrivSep empty dir if necessary + if [ ! -d /var/run/sshd ]; then + mkdir /var/run/sshd + chmod 0755 /var/run/sshd + fi +} + +check_config() { + /usr/sbin/sshd -t || exit 1 +} + +check_keys() { + # create keys if necessary + if [ ! -f $HOST_KEY_RSA ]; then + echo " generating ssh RSA key..." + ssh-keygen -q -f $HOST_KEY_RSA -N '' -t rsa + fi + if [ ! -f $HOST_KEY_ECDSA ]; then + echo " generating ssh ECDSA key..." + ssh-keygen -q -f $HOST_KEY_ECDSA -N '' -t ecdsa + fi + if [ ! -f $HOST_KEY_DSA ]; then + echo " generating ssh DSA key..." + ssh-keygen -q -f $HOST_KEY_DSA -N '' -t dsa + fi + if [ ! -f $HOST_KEY_ED25519 ]; then + echo " generating ssh ED25519 key..." + ssh-keygen -q -f $HOST_KEY_ED25519 -N '' -t ed25519 + fi +} + +export PATH="${PATH:+$PATH:}/usr/sbin:/sbin" + +case "$1" in + start) + check_for_no_start + echo "Starting OpenBSD Secure Shell server: sshd" + check_keys + check_privsep_dir + start-stop-daemon -S -x /usr/sbin/sshd -- $SSHD_OPTS + echo "done." + ;; + stop) + echo -n "Stopping OpenBSD Secure Shell server: sshd" + start-stop-daemon -K -x /usr/sbin/sshd + echo "." + ;; + + reload|force-reload) + check_for_no_start + check_keys + check_config + echo -n "Reloading OpenBSD Secure Shell server's configuration" + start-stop-daemon -K -s 1 -x /usr/sbin/sshd + echo "." + ;; + + restart) + check_keys + check_config + echo -n "Restarting OpenBSD Secure Shell server: sshd" + start-stop-daemon -K --oknodo -x /usr/sbin/sshd + check_for_no_start + check_privsep_dir + sleep 2 + start-stop-daemon -S -x /usr/sbin/sshd -- $SSHD_OPTS + echo "." + ;; + + status) + status /usr/sbin/sshd + exit $? + ;; + + *) + echo "Usage: /etc/init.d/ssh {start|stop|status|reload|force-reload|restart}" + exit 1 +esac + +exit 0 diff --git a/meta/recipes-connectivity/openssh/openssh/nostrip.patch b/meta/recipes-connectivity/openssh/openssh/nostrip.patch new file mode 100644 index 0000000000..33111f5494 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/nostrip.patch @@ -0,0 +1,20 @@ +Disable stripping binaries during make install. + +Upstream-Status: Inappropriate [configuration] + +Build system specific. + +Signed-off-by: Scott Garman + +diff -ur openssh-5.6p1.orig/Makefile.in openssh-5.6p1/Makefile.in +--- openssh-5.6p1.orig/Makefile.in 2010-05-11 23:51:39.000000000 -0700 ++++ openssh-5.6p1/Makefile.in 2010-08-30 16:49:54.000000000 -0700 +@@ -29,7 +29,7 @@ + RAND_HELPER=$(libexecdir)/ssh-rand-helper + PRIVSEP_PATH=@PRIVSEP_PATH@ + SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@ +-STRIP_OPT=@STRIP_OPT@ ++STRIP_OPT= + + PATHS= -DSSHDIR=\"$(sysconfdir)\" \ + -D_PATH_SSH_PROGRAM=\"$(SSH_PROGRAM)\" \ diff --git a/meta/recipes-connectivity/openssh/openssh/openssh-CVE-2011-4327.patch b/meta/recipes-connectivity/openssh/openssh/openssh-CVE-2011-4327.patch new file mode 100644 index 0000000000..30c11cf432 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/openssh-CVE-2011-4327.patch @@ -0,0 +1,29 @@ +openssh-CVE-2011-4327 + +A security flaw was found in the way ssh-keysign, +a ssh helper program for host based authentication, +attempted to retrieve enough entropy information on configurations that +lacked a built-in entropy pool in OpenSSL (a ssh-rand-helper program would +be executed to retrieve the entropy from the system environment). +A local attacker could use this flaw to obtain unauthorized access to host keys +via ptrace(2) process trace attached to the 'ssh-rand-helper' program. + +https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4327 +http://www.openssh.com/txt/portable-keysign-rand-helper.adv + +Upstream-Status: Pending + +Signed-off-by: Li Wang +--- a/ssh-keysign.c ++++ b/ssh-keysign.c +@@ -170,6 +170,10 @@ + key_fd[i++] = open(_PATH_HOST_DSA_KEY_FILE, O_RDONLY); + key_fd[i++] = open(_PATH_HOST_ECDSA_KEY_FILE, O_RDONLY); + key_fd[i++] = open(_PATH_HOST_RSA_KEY_FILE, O_RDONLY); ++ if (fcntl(key_fd[0], F_SETFD, FD_CLOEXEC) != 0 || ++ fcntl(key_fd[1], F_SETFD, FD_CLOEXEC) != 0 || ++ fcntl(key_fd[2], F_SETFD, FD_CLOEXEC) != 0) ++ fatal("fcntl failed"); + + original_real_uid = getuid(); /* XXX readconf.c needs this */ + if ((pw = getpwuid(original_real_uid)) == NULL) diff --git a/meta/recipes-connectivity/openssh/openssh/ssh_config b/meta/recipes-connectivity/openssh/openssh/ssh_config new file mode 100644 index 0000000000..4a4a649ba8 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/ssh_config @@ -0,0 +1,46 @@ +# $OpenBSD: ssh_config,v 1.25 2009/02/17 01:28:32 djm Exp $ + +# This is the ssh client system-wide configuration file. See +# ssh_config(5) for more information. This file provides defaults for +# users, and the values can be changed in per-user configuration files +# or on the command line. + +# Configuration data is parsed as follows: +# 1. command line options +# 2. user-specific file +# 3. system-wide file +# Any configuration value is only changed the first time it is set. +# Thus, host-specific definitions should be at the beginning of the +# configuration file, and defaults at the end. + +# Site-wide defaults for some commonly used options. For a comprehensive +# list of available options, their meanings and defaults, please see the +# ssh_config(5) man page. + +Host * + ForwardAgent yes + ForwardX11 yes +# RhostsRSAAuthentication no +# RSAAuthentication yes +# PasswordAuthentication yes +# HostbasedAuthentication no +# GSSAPIAuthentication no +# GSSAPIDelegateCredentials no +# BatchMode no +# CheckHostIP yes +# AddressFamily any +# ConnectTimeout 0 +# StrictHostKeyChecking ask +# IdentityFile ~/.ssh/identity +# IdentityFile ~/.ssh/id_rsa +# IdentityFile ~/.ssh/id_dsa +# Port 22 +# Protocol 2,1 +# Cipher 3des +# Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc +# MACs hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160 +# EscapeChar ~ +# Tunnel no +# TunnelDevice any:any +# PermitLocalCommand no +# VisualHostKey no diff --git a/meta/recipes-connectivity/openssh/openssh/sshd b/meta/recipes-connectivity/openssh/openssh/sshd new file mode 100644 index 0000000000..4882e58b48 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/sshd @@ -0,0 +1,10 @@ +#%PAM-1.0 + +auth include common-auth +account required pam_nologin.so +account include common-account +password include common-password +session optional pam_keyinit.so force revoke +session include common-session +session required pam_loginuid.so + diff --git a/meta/recipes-connectivity/openssh/openssh/sshd.socket b/meta/recipes-connectivity/openssh/openssh/sshd.socket new file mode 100644 index 0000000000..12c39b26b5 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/sshd.socket @@ -0,0 +1,10 @@ +[Unit] +Conflicts=sshd.service + +[Socket] +ExecStartPre=@BASE_BINDIR@/mkdir -p /var/run/sshd +ListenStream=22 +Accept=yes + +[Install] +WantedBy=sockets.target diff --git a/meta/recipes-connectivity/openssh/openssh/sshd@.service b/meta/recipes-connectivity/openssh/openssh/sshd@.service new file mode 100644 index 0000000000..4eda6592f5 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/sshd@.service @@ -0,0 +1,10 @@ +[Unit] +Description=OpenSSH Per-Connection Daemon +Wants=sshdgenkeys.service +After=sshdgenkeys.service + +[Service] +ExecStart=-@SBINDIR@/sshd -i +ExecReload=@BASE_BINDIR@/kill -HUP $MAINPID +StandardInput=socket +StandardError=syslog diff --git a/meta/recipes-connectivity/openssh/openssh/sshd_config b/meta/recipes-connectivity/openssh/openssh/sshd_config new file mode 100644 index 0000000000..4f9b626fbd --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/sshd_config @@ -0,0 +1,119 @@ +# $OpenBSD: sshd_config,v 1.80 2008/07/02 02:24:18 djm Exp $ + +# This is the sshd server system-wide configuration file. See +# sshd_config(5) for more information. + +# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin + +# The strategy used for options in the default sshd_config shipped with +# OpenSSH is to specify options with their default value where +# possible, but leave them commented. Uncommented options change a +# default value. + +#Port 22 +#AddressFamily any +#ListenAddress 0.0.0.0 +#ListenAddress :: + +# Disable legacy (protocol version 1) support in the server for new +# installations. In future the default will change to require explicit +# activation of protocol 1 +Protocol 2 + +# HostKey for protocol version 1 +#HostKey /etc/ssh/ssh_host_key +# HostKeys for protocol version 2 +#HostKey /etc/ssh/ssh_host_rsa_key +#HostKey /etc/ssh/ssh_host_dsa_key + +# Lifetime and size of ephemeral version 1 server key +#KeyRegenerationInterval 1h +#ServerKeyBits 1024 + +# Logging +# obsoletes QuietMode and FascistLogging +#SyslogFacility AUTH +#LogLevel INFO + +# Authentication: + +#LoginGraceTime 2m +#PermitRootLogin yes +#StrictModes yes +#MaxAuthTries 6 +#MaxSessions 10 + +#RSAAuthentication yes +#PubkeyAuthentication yes +#AuthorizedKeysFile .ssh/authorized_keys + +# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts +#RhostsRSAAuthentication no +# similar for protocol version 2 +#HostbasedAuthentication no +# Change to yes if you don't trust ~/.ssh/known_hosts for +# RhostsRSAAuthentication and HostbasedAuthentication +#IgnoreUserKnownHosts no +# Don't read the user's ~/.rhosts and ~/.shosts files +#IgnoreRhosts yes + +# To disable tunneled clear text passwords, change to no here! +#PasswordAuthentication yes +#PermitEmptyPasswords no + +# Change to no to disable s/key passwords +#ChallengeResponseAuthentication yes + +# Kerberos options +#KerberosAuthentication no +#KerberosOrLocalPasswd yes +#KerberosTicketCleanup yes +#KerberosGetAFSToken no + +# GSSAPI options +#GSSAPIAuthentication no +#GSSAPICleanupCredentials yes + +# Set this to 'yes' to enable PAM authentication, account processing, +# and session processing. If this is enabled, PAM authentication will +# be allowed through the ChallengeResponseAuthentication and +# PasswordAuthentication. Depending on your PAM configuration, +# PAM authentication via ChallengeResponseAuthentication may bypass +# the setting of "PermitRootLogin without-password". +# If you just want the PAM account and session checks to run without +# PAM authentication, then enable this but set PasswordAuthentication +# and ChallengeResponseAuthentication to 'no'. +#UsePAM no + +#AllowAgentForwarding yes +#AllowTcpForwarding yes +#GatewayPorts no +#X11Forwarding no +#X11DisplayOffset 10 +#X11UseLocalhost yes +#PrintMotd yes +#PrintLastLog yes +#TCPKeepAlive yes +#UseLogin no +UsePrivilegeSeparation yes +#PermitUserEnvironment no +Compression no +ClientAliveInterval 15 +ClientAliveCountMax 4 +#UseDNS yes +#PidFile /var/run/sshd.pid +#MaxStartups 10 +#PermitTunnel no +#ChrootDirectory none + +# no default banner path +#Banner none + +# override default of no subsystems +Subsystem sftp /usr/libexec/sftp-server + +# Example of overriding settings on a per-user basis +#Match User anoncvs +# X11Forwarding no +# AllowTcpForwarding no +# ForceCommand cvs server diff --git a/meta/recipes-connectivity/openssh/openssh/sshdgenkeys.service b/meta/recipes-connectivity/openssh/openssh/sshdgenkeys.service new file mode 100644 index 0000000000..c21d70baf0 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/sshdgenkeys.service @@ -0,0 +1,10 @@ +[Unit] +Description=OpenSSH Key Generation +ConditionPathExists=|!/etc/ssh/ssh_host_rsa_key +ConditionPathExists=|!/etc/ssh/ssh_host_dsa_key +ConditionPathExists=|!/etc/ssh/ssh_host_ecdsa_key + +[Service] +ExecStart=@BINDIR@/ssh-keygen -A +Type=oneshot +RemainAfterExit=yes diff --git a/meta/recipes-connectivity/openssh/openssh/volatiles.99_sshd b/meta/recipes-connectivity/openssh/openssh/volatiles.99_sshd new file mode 100644 index 0000000000..122320a719 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/volatiles.99_sshd @@ -0,0 +1 @@ +d root root 0755 /var/run/sshd none diff --git a/meta/recipes-connectivity/openssh/openssh_6.5p1.bb b/meta/recipes-connectivity/openssh/openssh_6.5p1.bb new file mode 100644 index 0000000000..a1a2503843 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh_6.5p1.bb @@ -0,0 +1,147 @@ +SUMMARY = "Secure rlogin/rsh/rcp/telnet replacement" +DESCRIPTION = "Secure rlogin/rsh/rcp/telnet replacement (OpenSSH) \ +Ssh (Secure Shell) is a program for logging into a remote machine \ +and for executing commands on a remote machine." +HOMEPAGE = "http://openssh.org" +SECTION = "console/network" +LICENSE = "BSD" +LIC_FILES_CHKSUM = "file://LICENCE;md5=e326045657e842541d3f35aada442507" + + +DEPENDS = "zlib openssl" +DEPENDS += "${@base_contains('DISTRO_FEATURES', 'pam', 'libpam', '', d)}" + +RPROVIDES_${PN}-ssh = "ssh" +RPROVIDES_${PN}-sshd = "sshd" + +RCONFLICTS_${PN} = "dropbear" +RCONFLICTS_${PN}-sshd = "dropbear" +RCONFLICTS_${PN}-keygen = "ssh-keygen" + +SRC_URI = "ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar.gz \ + file://nostrip.patch \ + file://sshd_config \ + file://ssh_config \ + file://init \ + file://openssh-CVE-2011-4327.patch \ + file://add-test-support-for-busybox.patch \ + file://run-ptest \ + ${@base_contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', '', d)} \ + file://sshd.socket \ + file://sshd@.service \ + file://sshdgenkeys.service \ + file://volatiles.99_sshd " + +PAM_SRC_URI = "file://sshd" + +SRC_URI[md5sum] = "a084e7272b8cbd25afe0f5dce4802fef" +SRC_URI[sha256sum] = "a1195ed55db945252d5a1730d4a2a2a5c1c9a6aa01ef2e5af750a962623d9027" + +inherit useradd update-rc.d update-alternatives systemd ptest + +USERADD_PACKAGES = "${PN}-sshd" +USERADD_PARAM_${PN}-sshd = "--system --no-create-home --home-dir /var/run/sshd --shell /bin/false --user-group sshd" +INITSCRIPT_PACKAGES = "${PN}-sshd" +INITSCRIPT_NAME_${PN}-sshd = "sshd" +INITSCRIPT_PARAMS_${PN}-sshd = "defaults 9" + +SYSTEMD_PACKAGES = "${PN}-sshd" +SYSTEMD_SERVICE_${PN}-sshd = "sshd.socket" + +PACKAGECONFIG ??= "tcp-wrappers" +PACKAGECONFIG[tcp-wrappers] = "--with-tcp-wrappers,,tcp-wrappers" + +inherit autotools-brokensep + +# LFS support: +CFLAGS += "-D__FILE_OFFSET_BITS=64" +export LD = "${CC}" + +EXTRA_OECONF = "${@base_contains('DISTRO_FEATURES', 'pam', '--with-pam', '--without-pam', d)} \ + --without-zlib-version-check \ + --with-privsep-path=/var/run/sshd \ + --sysconfdir=${sysconfdir}/ssh \ + --with-xauth=/usr/bin/xauth" + +# Since we do not depend on libbsd, we do not want configure to use it +# just because it finds libutil.h. But, specifying --disable-libutil +# causes compile errors, so... +# +CACHED_CONFIGUREVARS += "ac_cv_header_bsd_libutil_h=no ac_cv_header_libutil_h=no" + +# This is a workaround for uclibc because including stdio.h +# pulls in pthreads.h and causes conflicts in function prototypes. +# This results in compilation failure, so unless this is fixed, +# disable pam for uclibc. +EXTRA_OECONF_append_libc-uclibc=" --without-pam" + +do_configure_prepend () { + if [ ! -e acinclude.m4 -a -e aclocal.m4 ]; then + cp aclocal.m4 acinclude.m4 + fi +} + +do_compile_append () { + install -m 0644 ${WORKDIR}/sshd_config ${S}/ + install -m 0644 ${WORKDIR}/ssh_config ${S}/ +} + +do_install_append () { + if [ "${@base_contains('DISTRO_FEATURES', 'pam', 'pam', '', d)}" = "pam" ]; then + install -D -m 0755 ${WORKDIR}/sshd ${D}${sysconfdir}/pam.d/sshd + sed -i -e 's:#UsePAM no:UsePAM yes:' ${WORKDIR}/sshd_config ${D}${sysconfdir}/ssh/sshd_config + fi + + install -d ${D}${sysconfdir}/init.d + install -m 0755 ${WORKDIR}/init ${D}${sysconfdir}/init.d/sshd + rm -f ${D}${bindir}/slogin ${D}${datadir}/Ssh.bin + rmdir ${D}${localstatedir}/run/sshd ${D}${localstatedir}/run ${D}${localstatedir} + install -d ${D}/${sysconfdir}/default/volatiles + install -m 644 ${WORKDIR}/volatiles.99_sshd ${D}/${sysconfdir}/default/volatiles/99_sshd + + # Create config files for read-only rootfs + install -d ${D}${sysconfdir}/ssh + install -m 644 ${D}${sysconfdir}/ssh/sshd_config ${D}${sysconfdir}/ssh/sshd_config_readonly + sed -i '/HostKey/d' ${D}${sysconfdir}/ssh/sshd_config_readonly + echo "HostKey /var/run/ssh/ssh_host_rsa_key" >> ${D}${sysconfdir}/ssh/sshd_config_readonly + echo "HostKey /var/run/ssh/ssh_host_dsa_key" >> ${D}${sysconfdir}/ssh/sshd_config_readonly + echo "HostKey /var/run/ssh/ssh_host_ecdsa_key" >> ${D}${sysconfdir}/ssh/sshd_config_readonly + + install -d ${D}${systemd_unitdir}/system + install -c -m 0644 ${WORKDIR}/sshd.socket ${D}${systemd_unitdir}/system + install -c -m 0644 ${WORKDIR}/sshd@.service ${D}${systemd_unitdir}/system + install -c -m 0644 ${WORKDIR}/sshdgenkeys.service ${D}${systemd_unitdir}/system + sed -i -e 's,@BASE_BINDIR@,${base_bindir},g' \ + -e 's,@SBINDIR@,${sbindir},g' \ + -e 's,@BINDIR@,${bindir},g' \ + ${D}${systemd_unitdir}/system/sshd.socket ${D}${systemd_unitdir}/system/*.service +} + +do_install_ptest () { + sed -i -e "s|^SFTPSERVER=.*|SFTPSERVER=${libdir}/${PN}/sftp-server|" regress/test-exec.sh + cp -r regress ${D}${PTEST_PATH} +} + +ALLOW_EMPTY_${PN} = "1" + +PACKAGES =+ "${PN}-keygen ${PN}-scp ${PN}-ssh ${PN}-sshd ${PN}-sftp ${PN}-misc ${PN}-sftp-server" +FILES_${PN}-scp = "${bindir}/scp.${BPN}" +FILES_${PN}-ssh = "${bindir}/ssh.${BPN} ${sysconfdir}/ssh/ssh_config" +FILES_${PN}-sshd = "${sbindir}/sshd ${sysconfdir}/init.d/sshd ${systemd_unitdir}/system" +FILES_${PN}-sshd += "${sysconfdir}/ssh/moduli ${sysconfdir}/ssh/sshd_config ${sysconfdir}/ssh/sshd_config_readonly ${sysconfdir}/default/volatiles/99_sshd ${sysconfdir}/pam.d/sshd" +FILES_${PN}-sftp = "${bindir}/sftp" +FILES_${PN}-sftp-server = "${libexecdir}/sftp-server" +FILES_${PN}-misc = "${bindir}/ssh* ${libexecdir}/ssh*" +FILES_${PN}-keygen = "${bindir}/ssh-keygen" + +RDEPENDS_${PN} += "${PN}-scp ${PN}-ssh ${PN}-sshd ${PN}-keygen" +RDEPENDS_${PN}-sshd += "${PN}-keygen ${@base_contains('DISTRO_FEATURES', 'pam', 'pam-plugin-keyinit pam-plugin-loginuid', '', d)}" +RDEPENDS_${PN}-ptest += "${PN}-sftp ${PN}-misc ${PN}-sftp-server make" + +CONFFILES_${PN}-sshd = "${sysconfdir}/ssh/sshd_config" +CONFFILES_${PN}-ssh = "${sysconfdir}/ssh/ssh_config" + +ALTERNATIVE_PRIORITY = "90" +ALTERNATIVE_${PN}-scp = "scp" +ALTERNATIVE_${PN}-ssh = "ssh" + -- cgit v1.2.3-54-g00ecf