From 0ca70a3a118524d4d543d9cb346e7ab4e4e2d9b6 Mon Sep 17 00:00:00 2001 From: Mike Frysinger Date: Sun, 22 Mar 2015 19:48:36 +0000 Subject: [PATCH] Fix ssh-keygen -A behavior when USE=-ssh1 #544078 by Thomas D. Update hpn patchset to pass tests and work under seccomp sandbox. Package-Manager: portage-2.2.18/cvs/Linux x86_64 Manifest-Sign-Key: 0xD2E96200 --- net-misc/openssh/ChangeLog | 9 +- net-misc/openssh/Manifest | 31 +- .../openssh-6.8_p1-ssh-keygen-no-ssh1.patch | 17 + net-misc/openssh/openssh-6.8_p1-r2.ebuild | 324 ++++++++++++++++++ 4 files changed, 366 insertions(+), 15 deletions(-) create mode 100644 net-misc/openssh/files/openssh-6.8_p1-ssh-keygen-no-ssh1.patch create mode 100644 net-misc/openssh/openssh-6.8_p1-r2.ebuild diff --git a/net-misc/openssh/ChangeLog b/net-misc/openssh/ChangeLog index 0f1c3391d404..1a3b039d2acd 100644 --- a/net-misc/openssh/ChangeLog +++ b/net-misc/openssh/ChangeLog @@ -1,6 +1,13 @@ # ChangeLog for net-misc/openssh # Copyright 1999-2015 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/net-misc/openssh/ChangeLog,v 1.551 2015/03/22 06:54:07 vapier Exp $ +# $Header: /var/cvsroot/gentoo-x86/net-misc/openssh/ChangeLog,v 1.552 2015/03/22 19:48:09 vapier Exp $ + +*openssh-6.8_p1-r2 (22 Mar 2015) + + 22 Mar 2015; Mike Frysinger + +files/openssh-6.8_p1-ssh-keygen-no-ssh1.patch, +openssh-6.8_p1-r2.ebuild: + Fix ssh-keygen -A behavior when USE=-ssh1 #544078 by Thomas D. Update hpn + patchset to pass tests and work under seccomp sandbox. 22 Mar 2015; Mike Frysinger openssh-6.8_p1-r1.ebuild: Also note hosts.allow in the error message #531156#20 by Arfrever Frehtes diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest index dadc1abea9fe..d2b7aeadcaaf 100644 --- a/net-misc/openssh/Manifest +++ b/net-misc/openssh/Manifest @@ -11,6 +11,7 @@ AUX openssh-6.7_p1-sshd-gssapi-multihomed.patch 5489 SHA256 d2a1735b523709a4b4ce AUX openssh-6.7_p1-x509-glue.patch 1633 SHA256 58031e90e0bf220028934ab590af6ccfc45722629b2416df13d84f10c9b94478 SHA512 364ca0280be5cc83d1dedf7727323fd5fc0093c6dbcf9cc8ccaa30ee754b866584be28da1166953f03faf8745d6364e33fad7daad9be9a29681a8674eb9d292b WHIRLPOOL b79a6cff897be78793bbf2ca03154103aa1380647b8c53e104155fd68122568a8e7dea23996213b192e4269f980b1035d3ca395dbd2c318fd81a45f44d110c31 AUX openssh-6.7_p1-xmalloc-include.patch 390 SHA256 ea43a6a211d8cae4a078b748736f43d4a9d11804ace65886dec826b878dec28e SHA512 b51d9149418217828bdc53c234e248f8be1703b480ccf808814d37cd2589bccdbecff0046d2f2d0e4626420d0d4c2e02d25a9cc07ae31b365cd0b848ccc02035 WHIRLPOOL 04b298eb481fef585b055eb3d706cca55ad6efed6168246f0031e5f614085ae5e70cbb77717047d6c70d7d13a6846657e4a0089d4b8cdf5d9d05652ee22f7209 AUX openssh-6.8_p1-sctp-x509-glue.patch 2937 SHA256 fe79e3e828f8599e7bad787c6e35bce5f6781a0875c56b250f0d7fde83e2f841 SHA512 776a4eab916ff64d255fb19dca26f0cb1cebb0a5d0c2dbcb40ecbf97b122fb20123532897fb962b27fae375c059ef0dc00c771bf47b67bd092a5ebb3f2252216 WHIRLPOOL c8126624b4be260f8fe40a4a9d7142b6f77ee15504e2d280c6429360ebbf53103974746d5746fe4b27edec6246f01afa1d921d1b5a2d46ae808e4bb41afbb181 +AUX openssh-6.8_p1-ssh-keygen-no-ssh1.patch 491 SHA256 18ee3bf3bc2216e92c825a9c8eb4b415eff9a29f5fb5e4824b43202d744ef637 SHA512 4b94d839bf9e9ea3881b9a7c8f18983eb64fe462a612efefabc89a1262895bde4cfecc51a24c242d46a923a6a601efda5c19679f8d8bb2b82202fdd2d5d42124 WHIRLPOOL 64981a70c33a9f1a754918730a711c44e4c17d66de4cad8223d5665f602bdb728cb4b83a6bba6c2a81c64156e4e13f9ea5bdd6e21ef069ba98031860b08e42f3 AUX openssh-6.8_p1-sshd-gssapi-multihomed.patch 5464 SHA256 5f3506f0d45c22de85cf170c7dfeff134a144ec94f9fc1c57c5b3b797ee82756 SHA512 7bfbf720af2728abb55f73b67609967f34da27fea9a9dd6e0293e486a03d7d1167f506623771792d782707bfe58b46c69675bb3c5ad83332b7a50ee748176fbc WHIRLPOOL 81432c4ba7e34d216d73f63945f3c8d52d9113c07fb1f7c3dd5b39ac96223d38d2321a6d6de21b58b29767576c2a779a5703fa2e5727cd3fe4981581e822155d AUX openssh-6.8_p1-ssl-engine-configure.patch 883 SHA256 c25d219d8baea01bde40dce34378d4f185b83968debded0b2d4e2035f6467530 SHA512 ce8c3362af9dd9d95174b8248b0e9c08463e6fa18d3e83bf01687756c2df77607674a95acd2930ee85994aa186b5229d93e32662e13caae0b45980fddc00e65e WHIRLPOOL d7f285e3317ddd797222a4d584da385a14fa5c7316b8002faa1005ae5129cb580abc9a70189470c0ff5feb0368de4b0b171596d1aa3705556037084c8eff3d34 AUX sshd.confd 396 SHA256 29c6d57ac3ec6018cadc6ba6cd9b90c9ed46e20049b970fdcc68ee2481a2ee41 SHA512 b9ae816af54a55e134a9307e376f05367b815f1b3fd545c2a2c312d18aedcf907f413e8bad8db980cdd9aad4011a72a79e1e94594f69500939a9cb46287f2f81 WHIRLPOOL 69f43e6192e009a4663d130f7e40ee8b13c6eb9cc7d960b5e0e22f5d477649c88806a9d219efef211f4346582c2bb51e40d230a8191e5953dbe08bfff976ae53 @@ -28,6 +29,7 @@ DIST openssh-6.8_p1-x509-glue.patch.xz 141312 SHA256 2060c896e1f8c241052bb272466 DIST openssh-6.8p1+x509-8.3.diff.gz 347942 SHA256 34dbefcce8509d3c876be3e7d8966455c7c3589a6872bdfb1f8ce3d133f4d304 SHA512 74a83e9716731a6b4b0d957c49ba86a4124e208e31f61efb332ebc19b02e8b384afbd3f52409b34ae721183a7863be135c5d4fe4d21c9473ef828bc30688fdac WHIRLPOOL 19570e07381dc9fd31dbe4bf3e6fefd0bc0f9cfbb1777b3900a943dac8cb41560a6216475659defa7d9d05882902fe7f575038cdb23e7587a8515465b24fc9f9 DIST openssh-6.8p1-hpnssh14v5.tar.xz 24660 SHA256 dea2c5cdfd08d09f832a88aaf9d8285e57a67bbc68e6652ca3e0bf8b0213d99e SHA512 0b77e5d7d13ac7e2392d52e18240e5a0233d0a452d6cb7d1a0bf7ea7b640df5edc64cfcbe8c4fcb7c011b0eaa6a7aa3d6585292be753387af369d726345b7f5c WHIRLPOOL 2385c4f8ce5b9a2359991b9ca38362ec19482d3c904b10ceeb77c5044c88edabc2470db2ed156931d1c3ab6f93872809bef66a6848e9b39969f7c59d144c31ba DIST openssh-6.8p1-r1-hpnssh14v5.tar.xz 24648 SHA256 87ab38507c7e4f1855c127f276c7c20e58bcd539dd303a37843d3d24ff72df7e SHA512 5883787b09330ae154f385bbc6bda8c6dbc727df7e9a96ddf4cb4a5162c932937bce8e3aa2b555ff4854df80b738c2ea1cdc4c170a10f9ed6252520edb070edb WHIRLPOOL e508fbfbb148fbd311927c4a88d388d1d15a1ee99e5445df0c774fd23acf7c87962682eab03a0bef6bd12c9d7149b047cbb145e60e6e947bd577e88110b47d52 +DIST openssh-6.8p1-r2-hpnssh14v5.tar.xz 25264 SHA256 1106514e4a77bcb2fc625cd4ddde550269f24491f2a552b59ddcc0b071a172f4 SHA512 07294e39ef465f34df920dfa92e0e1319d3cc28f428d73d5ce9bbeb39b06aa8828c88d183c2dcff9d1db6855d656185b708bf44019792836b28e9b391bb4833c WHIRLPOOL 1f2aaf944d147106c540fa3d902324dee828b1e0e6c13af10f76eb4e249999a72c969ae7233b1c8a5b530fea417159585940fea91a0af02887d6c96207a086f8 DIST openssh-6.8p1.tar.gz 1475953 SHA256 3ff64ce73ee124480b5bf767b9830d7d3c03bbcb6abe716b78f0192c37ce160e SHA512 7c4457e4525a56cdabb1164ffaf6bed1c094294ae7d06dd3484dcffcd87738fcffe7019b6cae0032c254b0389832644522d5a9f2603b50637ffeb9999b5fcede WHIRLPOOL 3ac9cc4fe0b11ca66c0220618d0ef0c5925e5605d4d3d55c9579b708c478cf8613b7575fe213aba57054d97d3290baac4eba26b7a630d22477ec947f22327a5a DIST openssh-lpk-6.7p1-0.3.14.patch.xz 16920 SHA256 0203e6e44e41d58ec46d1611d7efc985134e662bbee51632c29f43ae809003f0 SHA512 344ccde4a04aeb1500400f779e64b2d8a5ad2970de3c4c343ca9605758e22d3812ef5453cd3221b18ad74a9762583c62417879107e4e1dda1398a6a65bcd04b2 WHIRLPOOL 5b6beeb743d04deea70c8b471a328b5f056fd4651e1370c7882e5d12f54fa2170486dcd6f97aa8c58e80af9a2d4012e2dfbcf53185317976d309783ca8d6cf73 DIST openssh-lpk-6.8p1-0.3.14.patch.xz 16940 SHA256 d5f048dc7e9d3fca085c152fc31306f1d8fa793e524c538295915b075ec085b0 SHA512 2470b6b46f8c7ac985f82d14b788a3eb81a468a1d5013cb7f89257d9dd78b6037e24bf54ac57b757db8ed1df24332d659cf918c11ea73592fd24a69c25a54081 WHIRLPOOL b041ee9e0efdf370686f11df4131ab5e5ffb2f11cc66c386a8223bf563c5b78ab9443f06e4adc2e506e440cdec9dc5b20f5972cd8d691d786d2f903bb49b947b @@ -35,23 +37,24 @@ EBUILD openssh-6.7_p1-r3.ebuild 10078 SHA256 1a58e95c28b5b938f2f15b3fec5688dc950 EBUILD openssh-6.7_p1-r4.ebuild 10138 SHA256 e4f6c4e80485352cc75e62c0212670a0d7f4a19bcf1eed9972bbeaff8b7a2743 SHA512 fdcd7759a85412bdf05be5003d20289a862f13f945e1972e56a36602df426641ef3497399e06ff0da9a51cf2bd54831b6208ac399d42d3ce3e3b1493ffa7655c WHIRLPOOL ae24dbcc182627c356961f4ce290cb1b489e29fa13beaf27212bd4847a36f02af53a8508320cf2a76be88741297ac7533faf53c1d3b15d70299cff536ae8502f EBUILD openssh-6.7_p1.ebuild 10067 SHA256 970be3a06c0293262f6c59d068d290cc71935fe91f4295b1352b6c41c46c3bf7 SHA512 f2b689767c8da075f16e9e5d9fe258e22fb4019034539883d63632c1543d3141787883ec7013f87c23d709a554b4f994c4c2f41b1829e5301b55f7a5da3fbf46 WHIRLPOOL 8d70fd99a1f3307b801999a9c80be4bcc603cbc151170160d78a2fa8a50ceb701657cbb0b0eb9ccfe1287bff9299dcffb36f884b860a5ca88ac4a9936b21a574 EBUILD openssh-6.8_p1-r1.ebuild 10083 SHA256 f8de47466df155d5c5932d091adc3bcd8108e10d7bbe470c809b716e2d1a3323 SHA512 237d3694bb07b57b4c5162f4667fc86a86a61a6b8063fb792e1dc6a340e8e5908072b8b3654fa7a470908b7048cb2297ac7a6a5bdf7c02b1b1981b0f0893df29 WHIRLPOOL e0c6e618afdbd912d246eca218b956214040f96bad0c86a758c148140a38d6c97201b1d274d680387e93a0e418e775420d3265d1fff74286a865b001d2430d1e +EBUILD openssh-6.8_p1-r2.ebuild 10151 SHA256 2c79ade53b17842e192faef35f84be335a669c07bdf83af65d5839f08b7b2932 SHA512 b8289235f172ef4d802d921b6dd7f79487be46d5a25bfd3868810076a24b089f1449c7b519e0720e53e45bc0a9a2164567c3c7052161e7513fe5c88fa92e7a79 WHIRLPOOL bc5d9eb1962a201b47c08f79838cbb0a5647f2a4eea8c677ec43424f232df1f72ad74596bee1f1ba7fc008f022f9b3080dbb625d6233f70a05c6868361088dd7 EBUILD openssh-6.8_p1.ebuild 10045 SHA256 13378c09cc4ceec7cd1b8c12ad925db87c9d37910edb679eb2404527226ee18d SHA512 daa5ba19f6fbc0ac7104c8c7822b22745736bf864999ade1e205d1b7184e0fd67f997c4635ab2335eafdf2d2917cf677764080d3004b24935f4189fce338010f WHIRLPOOL b8d40e35bf44bf26296c8d87e3b293b31f767920afb288a10deff8a9ceeb1c130b4da2697d7ce970091d0810c5d1e3839640e2ebee2f0d63b8ca5b0f430c0c0c -MISC ChangeLog 91859 SHA256 dd78f851ee5abb1a5ad501d6b5d7df314bd31894a38aaed2e098e64f6ee9bb16 SHA512 aafe806490d3ce28606618a0ce584c13a136de2e3150fb48a920b01ad977ea5a973c7733d126d9af74dcfa54a4331f9ccdd4fae2f1e86f53cb48098db0d0e2b5 WHIRLPOOL 998d67bd247cb565164751272cb02383443537b11aca56af0892273921393dc366d980ba31a17f2c0a6a541eae7aa6ded6d34c77e8d3cdbfb168df6af1b804e9 +MISC ChangeLog 92155 SHA256 06875d695cbbcb15f9daa33bf631c4d68b9c138758216ec43d702a405a919777 SHA512 e8ae9ec541e8c8b2efd8bd8a9e4d734c87cf7c40c5c0b6f2409a6b72ff60b098b76ba65d76946cb66830c6ccaf2dfca2886a3a733cb669ee07b9fb695a1f88c2 WHIRLPOOL 8d6c6ecf77bb6ae201bf6a936c73fe6f6fb75f42a3d43f711ea9c6a4637b2c4fb31b2c85fc908df3272234aef1a11795c7a90b7af5fa91da060f75c3500f9de8 MISC metadata.xml 2049 SHA256 db7830f81086b967b8212af7c318bf27d22ac7db58b1a4d9c80cc86453ff03ab SHA512 3641e38203376c78fddc11b9d5861bdb629a1f9faf2768be5dc35f62ef3d37636a2f9f990e3ade1de2cec45d33a5fcdf7bb0dcd5f4376d40753fe29b354da42e WHIRLPOOL 6a7497491a150ede87bf20f5da5ed9003d545c9c376db7b78a6c1db66b1b90213f5f97d9211fb8b1ab204c1814c1a90d7be77a2d83cc045cf0762b4d2708c56a -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 -iQIcBAEBCAAGBQJVDmcSAAoJEPGu1DbS6WIAlXoP/2VOjkPdTyt2oBsx51bHLdwS -kRXJH6KdlGa1nLjS/s1kwx8MVLRIUNvHI/uR4wzzs5BYHr7Urgmx2ejYfrxgJzOc -rUS1naUC55cZNqEanmctIXu5bp7IPPl95SUgkBFI0EK2UbSPiTdh81MZ/IIAxnCy -fj8VbtSJCtVHSvAw2US2m8VGxJRfta/VCf9iRkekjbG6/UfaLzdTz8cuXNQ99VHy -ZWNLJ2dE3bBSo7huNKNFyK1MiA/HpHL1l+BKvDsOceqCompk8a06gA08NXxd8cES -k8bF/lUbTug3PAuFZpUWwBT7EWtu17ue1/2eHAKlf2Y9LbA1tmYd6ITQDCGLoorV -jQz6LiauBEb2NsZk4yJEYKPe9vtcYe7QgMv3OHJjsJPdtZHfniLD8r6gU2i2X+nC -+5zQBt431WFelfm+hxG+eOmRyjJRle2p9MfegnlaA58plyLIdxO0jxB20cXmfhBf -ehB0JfuJchAPttKcR8igBw2VGjN+TuWLWc/6Rns9fQu7ntoMBFlLr7nIWc5Siu95 -0fWZo6s5hBgQaev8F9v3Td1XaXu0iRwDGzdWgv1FJfGd4FXavoqZzSw2nOQLj9UA -Q/imiZvwa2gIBe1zd4PS2MCNjJnh0m04OEwsWBWxAx8eLpwR0IEiOKLomxL4FIEV -xgj/Mi/bjeV/bOJN3H8T -=S3wT +iQIcBAEBCAAGBQJVD1SrAAoJEPGu1DbS6WIAcpsP/j4vT7sE43XJHB7SNi1aKg1D +VMJPPKsClXIBjonQQxjnkcmd8AYPB2kqSDyJCo4G0tlgt3UXkNVPWv0xIobkpL9D +4i5fi6Rv4cdvHuIIXghhCjVUX4lz0/xoFsuyiE1AGFTZOgg0cUQhEmWywJJVqGB3 +SAAOYZZhwOznG8uxkU3zBcoiL8WLDbiemn8QGLUQDGwyL0vqg1aFyeSSw9U2FPhf +rmmR0aW4tu17MYwRNEhdIs0RMCl9mzX4SDD9+xlDT/aJbzYaz7R3ilY/GXylOoPJ +OqS+ELnRw1GUQHswBtNfH/tDkDIHfVP5WdxBzWZYAI5J6iZ8v8azm/KhJp9ypiHs +luxFDvaP0chkoZXwezEYl0zbcJkvGTH1TnEucEh8EcQ14mJ/sDTxgoaIKNj63VGN +5IGcoNg4J8h2Gbby/4fhIj34I+93h+NUdrolGZyCpv+kY8UqCmXkpeIlVMEZtLz6 ++ke3SDpJu5AGoMe8SYX7+ZTUR2SCQvQ5Uqw8p1J8IEtWRCyCeRaRB5potnwFcm8q +Ijv5dOjd9cUjxjVixAOGk16hEPGJ60H1daFHmpCHQ0ys22aOESiTst4h3CfiKI3T +a/A+AQ7yaOVGI5kOADKQn8g0EIHiDo1Ndqbt0PngJYKUXw0kPQFO5/6IZHXd0Cqb +rAcwZUvORncKLfU8BQos +=rTNm -----END PGP SIGNATURE----- diff --git a/net-misc/openssh/files/openssh-6.8_p1-ssh-keygen-no-ssh1.patch b/net-misc/openssh/files/openssh-6.8_p1-ssh-keygen-no-ssh1.patch new file mode 100644 index 000000000000..8b70818e444a --- /dev/null +++ b/net-misc/openssh/files/openssh-6.8_p1-ssh-keygen-no-ssh1.patch @@ -0,0 +1,17 @@ +https://bugs.gentoo.org/544078 +https://bugzilla.mindrot.org/show_bug.cgi?id=2369 + +do not try to generate rsa1 keys when ssh1 support is disabled + +--- a/ssh-keygen.c ++++ b/ssh-keygen.c +@@ -948,7 +948,9 @@ do_gen_all_hostkeys(struct passwd *pw) + char *key_type_display; + char *path; + } key_types[] = { ++#ifdef WITH_SSH1 + { "rsa1", "RSA1", _PATH_HOST_KEY_FILE }, ++#endif + { "rsa", "RSA" ,_PATH_HOST_RSA_KEY_FILE }, + { "dsa", "DSA", _PATH_HOST_DSA_KEY_FILE }, + #ifdef OPENSSL_HAS_ECC diff --git a/net-misc/openssh/openssh-6.8_p1-r2.ebuild b/net-misc/openssh/openssh-6.8_p1-r2.ebuild new file mode 100644 index 000000000000..5844520f6f5a --- /dev/null +++ b/net-misc/openssh/openssh-6.8_p1-r2.ebuild @@ -0,0 +1,324 @@ +# Copyright 1999-2015 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/net-misc/openssh/openssh-6.8_p1-r2.ebuild,v 1.1 2015/03/22 19:48:09 vapier Exp $ + +EAPI="4" +inherit eutils user flag-o-matic multilib autotools pam systemd versionator + +# Make it more portable between straight releases +# and _p? releases. +PARCH=${P/_} + +HPN_PATCH="${PN}-6.8p1-r2-hpnssh14v5.tar.xz" +LDAP_PATCH="${PN}-lpk-6.8p1-0.3.14.patch.xz" +X509_VER="8.3" X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz" + +DESCRIPTION="Port of OpenBSD's free SSH release" +HOMEPAGE="http://www.openssh.org/" +SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz + mirror://gentoo/${P}-sctp.patch.xz + ${HPN_PATCH:+hpn? ( + mirror://gentoo/${HPN_PATCH} + http://dev.gentoo.org/~vapier/dist/${HPN_PATCH} + mirror://sourceforge/hpnssh/${HPN_PATCH} + )} + ${LDAP_PATCH:+ldap? ( mirror://gentoo/${LDAP_PATCH} )} + ${X509_PATCH:+X509? ( + http://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} + mirror://gentoo/${P}-x509-glue.patch.xz + )} + " + +LICENSE="BSD GPL-2" +SLOT="0" +KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux" +# Probably want to drop ssh1/ssl defaulting to on in a future version. +IUSE="bindist ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit pam +pie sctp selinux skey +ssh1 +ssl static X X509" +REQUIRED_USE="pie? ( !static ) + ssh1? ( ssl ) + static? ( !kerberos !pam ) + X509? ( !ldap ssl )" + +LIB_DEPEND="sctp? ( net-misc/lksctp-tools[static-libs(+)] ) + selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] ) + skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] ) + libedit? ( dev-libs/libedit[static-libs(+)] ) + ssl? ( + >=dev-libs/openssl-0.9.6d:0[bindist=] + dev-libs/openssl[static-libs(+)] + ) + >=sys-libs/zlib-1.2.3[static-libs(+)]" +RDEPEND=" + !static? ( + ${LIB_DEPEND//\[static-libs(+)]} + ldns? ( + !bindist? ( net-libs/ldns[ecdsa,ssl] ) + bindist? ( net-libs/ldns[-ecdsa,ssl] ) + ) + ) + pam? ( virtual/pam ) + kerberos? ( virtual/krb5 ) + ldap? ( net-nds/openldap )" +DEPEND="${RDEPEND} + static? ( + ${LIB_DEPEND} + ldns? ( + !bindist? ( net-libs/ldns[ecdsa,ssl,static-libs(+)] ) + bindist? ( net-libs/ldns[-ecdsa,ssl,static-libs(+)] ) + ) + ) + virtual/pkgconfig + virtual/os-headers + sys-devel/autoconf" +RDEPEND="${RDEPEND} + pam? ( >=sys-auth/pambase-20081028 ) + userland_GNU? ( virtual/shadow ) + X? ( x11-apps/xauth )" + +S=${WORKDIR}/${PARCH} + +pkg_setup() { + # this sucks, but i'd rather have people unable to `emerge -u openssh` + # than not be able to log in to their server any more + maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; } + local fail=" + $(use X509 && maybe_fail X509 X509_PATCH) + $(use ldap && maybe_fail ldap LDAP_PATCH) + $(use hpn && maybe_fail hpn HPN_PATCH) + " + fail=$(echo ${fail}) + if [[ -n ${fail} ]] ; then + eerror "Sorry, but this version does not yet support features" + eerror "that you requested: ${fail}" + eerror "Please mask ${PF} for now and check back later:" + eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask" + die "booooo" + fi + + # Make sure people who are using tcp wrappers are notified of its removal. #531156 + if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then + eerror "Sorry, but openssh no longer supports tcp-wrappers, and it seems like" + eerror "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please." + die "USE=tcpd no longer works" + fi +} + +save_version() { + # version.h patch conflict avoidence + mv version.h version.h.$1 + cp -f version.h.pristine version.h +} + +src_prepare() { + sed -i \ + -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \ + pathnames.h || die + # keep this as we need it to avoid the conflict between LPK and HPN changing + # this file. + cp version.h version.h.pristine + + # don't break .ssh/authorized_keys2 for fun + sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die + + epatch "${FILESDIR}"/${PN}-6.8_p1-sshd-gssapi-multihomed.patch #378361 + if use X509 ; then + pushd .. >/dev/null + epatch "${WORKDIR}"/${P}-x509-glue.patch + epatch "${FILESDIR}"/${P}-sctp-x509-glue.patch + popd >/dev/null + epatch "${WORKDIR}"/${X509_PATCH%.*} + epatch "${FILESDIR}"/${PN}-6.3_p1-x509-hpn14v2-glue.patch + save_version X509 + fi + if use ldap ; then + epatch "${WORKDIR}"/${LDAP_PATCH%.*} + save_version LPK + fi + epatch "${FILESDIR}"/${PN}-4.7_p1-GSSAPI-dns.patch #165444 integrated into gsskex + epatch "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch + epatch "${FILESDIR}"/${PN}-6.8_p1-ssh-keygen-no-ssh1.patch #544078 + # The X509 patchset fixes this independently. + use X509 || epatch "${FILESDIR}"/${PN}-6.8_p1-ssl-engine-configure.patch + epatch "${WORKDIR}"/${P}-sctp.patch + if use hpn ; then + epatch "${WORKDIR}"/${HPN_PATCH%.*.*}/* + save_version HPN + fi + + tc-export PKG_CONFIG + local sed_args=( + -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):" + # Disable PATH reset, trust what portage gives us #254615 + -e 's:^PATH=/:#PATH=/:' + # Disable fortify flags ... our gcc does this for us + -e 's:-D_FORTIFY_SOURCE=2::' + ) + # The -ftrapv flag ICEs on hppa #505182 + use hppa && sed_args+=( + -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:' + -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d' + ) + sed -i "${sed_args[@]}" configure{.ac,} || die + + epatch_user #473004 + + # Now we can build a sane merged version.h + ( + sed '/^#define SSH_RELEASE/d' version.h.* | sort -u + macros=() + for p in HPN LPK X509 ; do [ -e version.h.${p} ] && macros+=( SSH_${p} ) ; done + printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros}" + ) > version.h + + eautoreconf +} + +src_configure() { + addwrite /dev/ptmx + addpredict /etc/skey/skeykeys # skey configure code triggers this + + use static && append-ldflags -static + + local myconf=( + --with-ldflags="${LDFLAGS}" + --disable-strip + --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run + --sysconfdir="${EPREFIX}"/etc/ssh + --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc + --datadir="${EPREFIX}"/usr/share/openssh + --with-privsep-path="${EPREFIX}"/var/empty + --with-privsep-user=sshd + $(use_with kerberos kerberos5 "${EPREFIX}"/usr) + # We apply the ldap patch conditionally, so can't pass --without-ldap + # unconditionally else we get unknown flag warnings. + $(use ldap && use_with ldap) + $(use_with ldns) + $(use_with libedit) + $(use_with pam) + $(use_with pie) + $(use_with sctp) + $(use_with selinux) + $(use_with skey) + $(use_with ssh1) + # The X509 patch deletes this option entirely. + $(use X509 || use_with ssl openssl) + $(use_with ssl md5-passwords) + $(use_with ssl ssl-engine) + ) + + # Special settings for Gentoo/FreeBSD 9.0 or later (see bug #391011) + if use elibc_FreeBSD && version_is_at_least 9.0 "$(uname -r|sed 's/\(.\..\).*/\1/')" ; then + myconf+=( --disable-utmp --disable-wtmp --disable-wtmpx ) + append-ldflags -lutil + fi + + econf "${myconf[@]}" +} + +src_install() { + emake install-nokeys DESTDIR="${D}" + fperms 600 /etc/ssh/sshd_config + dobin contrib/ssh-copy-id + newinitd "${FILESDIR}"/sshd.rc6.4 sshd + newconfd "${FILESDIR}"/sshd.confd sshd + keepdir /var/empty + + newpamd "${FILESDIR}"/sshd.pam_include.2 sshd + if use pam ; then + sed -i \ + -e "/^#UsePAM /s:.*:UsePAM yes:" \ + -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \ + -e "/^#PrintMotd /s:.*:PrintMotd no:" \ + -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \ + "${ED}"/etc/ssh/sshd_config || die + fi + + # Gentoo tweaks to default config files + cat <<-EOF >> "${ED}"/etc/ssh/sshd_config + + # Allow client to pass locale environment variables #367017 + AcceptEnv LANG LC_* + EOF + cat <<-EOF >> "${ED}"/etc/ssh/ssh_config + + # Send locale environment variables #367017 + SendEnv LANG LC_* + EOF + + # This instruction is from the HPN webpage, + # Used for the server logging functionality + if [[ -n ${HPN_PATCH} ]] && use hpn ; then + keepdir /var/empty/dev + fi + + if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then + insinto /etc/openldap/schema/ + newins openssh-lpk_openldap.schema openssh-lpk.schema + fi + + doman contrib/ssh-copy-id.1 + dodoc ChangeLog CREDITS OVERVIEW README* TODO sshd_config + + diropts -m 0700 + dodir /etc/skel/.ssh + + systemd_dounit "${FILESDIR}"/sshd.{service,socket} + systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service' +} + +src_test() { + local t tests skipped failed passed shell + tests="interop-tests compat-tests" + skipped="" + shell=$(egetshell ${UID}) + if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then + elog "Running the full OpenSSH testsuite" + elog "requires a usable shell for the 'portage'" + elog "user, so we will run a subset only." + skipped="${skipped} tests" + else + tests="${tests} tests" + fi + # It will also attempt to write to the homedir .ssh + local sshhome=${T}/homedir + mkdir -p "${sshhome}"/.ssh + for t in ${tests} ; do + # Some tests read from stdin ... + HOMEDIR="${sshhome}" \ + emake -k -j1 ${t}