From 1a4b7ee28bf7413af6513fb45ad0d0736048f866 Mon Sep 17 00:00:00 2001 From: Brad Bishop Date: Sun, 16 Dec 2018 17:11:34 -0800 Subject: reset upstream subtrees to yocto 2.6 Reset the following subtrees on thud HEAD: poky: 87e3a9739d meta-openembedded: 6094ae18c8 meta-security: 31dc4e7532 meta-raspberrypi: a48743dc36 meta-xilinx: c42016e2e6 Also re-apply backports that didn't make it into thud: poky: 17726d0 systemd-systemctl-native: handle Install wildcards meta-openembedded: 4321a5d libtinyxml2: update to 7.0.1 042f0a3 libcereal: Add native and nativesdk classes e23284f libcereal: Allow empty package 030e8d4 rsyslog: curl-less build with fmhttp PACKAGECONFIG 179a1b9 gtest: update to 1.8.1 Squashed OpenBMC subtree compatibility updates: meta-aspeed: Brad Bishop (1): aspeed: add yocto 2.6 compatibility meta-ibm: Brad Bishop (1): ibm: prepare for yocto 2.6 meta-ingrasys: Brad Bishop (1): ingrasys: set layer compatibility to yocto 2.6 meta-openpower: Brad Bishop (1): openpower: set layer compatibility to yocto 2.6 meta-phosphor: Brad Bishop (3): phosphor: set layer compatibility to thud phosphor: libgpg-error: drop patches phosphor: react to fitimage artifact rename Ed Tanous (4): Dropbear: upgrade options for latest upgrade yocto2.6: update openssl options busybox: remove upstream watchdog patch systemd: Rebase CONFIG_CGROUP_BPF patch Change-Id: I7b1fe71cca880d0372a82d94b5fd785323e3a9e7 Signed-off-by: Brad Bishop --- ...ropbear-default-host-keys-if-a-key-is-not.patch | 42 ---------- ...d-c-command-option-to-force-a-specific-co.patch | 91 ---------------------- .../recipes-core/dropbear/dropbear/localoptions.h | 6 ++ .../recipes-core/dropbear/dropbear_%.bbappend | 3 +- .../dropbear/dropbear_2017.75.bbappend | 4 - 5 files changed, 7 insertions(+), 139 deletions(-) delete mode 100644 meta-phosphor/recipes-core/dropbear/dropbear/0001-Only-load-dropbear-default-host-keys-if-a-key-is-not.patch delete mode 100644 meta-phosphor/recipes-core/dropbear/dropbear/0001-dropbear-Add-c-command-option-to-force-a-specific-co.patch create mode 100644 meta-phosphor/recipes-core/dropbear/dropbear/localoptions.h delete mode 100644 meta-phosphor/recipes-core/dropbear/dropbear_2017.75.bbappend (limited to 'meta-phosphor/recipes-core/dropbear') diff --git a/meta-phosphor/recipes-core/dropbear/dropbear/0001-Only-load-dropbear-default-host-keys-if-a-key-is-not.patch b/meta-phosphor/recipes-core/dropbear/dropbear/0001-Only-load-dropbear-default-host-keys-if-a-key-is-not.patch deleted file mode 100644 index e32baec83..000000000 --- a/meta-phosphor/recipes-core/dropbear/dropbear/0001-Only-load-dropbear-default-host-keys-if-a-key-is-not.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 95eff1ca0beea55259c2cdc7f1bb9f930bf57bc8 Mon Sep 17 00:00:00 2001 -From: CamVan Nguyen -Date: Tue, 13 Feb 2018 15:37:47 -0600 -Subject: [PATCH 1/1] Only load dropbear default host keys if a key is not - specified - ---- - svr-runopts.c | 10 +++++++--- - 1 file changed, 7 insertions(+), 3 deletions(-) - -diff --git a/svr-runopts.c b/svr-runopts.c -index 8f60059..c5c2148 100644 ---- a/svr-runopts.c -+++ b/svr-runopts.c -@@ -488,17 +488,21 @@ void load_all_hostkeys() { - m_free(hostkey_file); - } - -+ /* Only load default host keys if a host key is not specified by the -+ * user */ -+ if (0 == svr_opts.num_hostkey_files) { - #ifdef DROPBEAR_RSA -- loadhostkey(RSA_PRIV_FILENAME, 0); -+ loadhostkey(RSA_PRIV_FILENAME, 0); - #endif - - #ifdef DROPBEAR_DSS -- loadhostkey(DSS_PRIV_FILENAME, 0); -+ loadhostkey(DSS_PRIV_FILENAME, 0); - #endif - - #ifdef DROPBEAR_ECDSA -- loadhostkey(ECDSA_PRIV_FILENAME, 0); -+ loadhostkey(ECDSA_PRIV_FILENAME, 0); - #endif -+ } - - #ifdef DROPBEAR_DELAY_HOSTKEY - if (svr_opts.delay_hostkey) { --- -1.8.2.2 - diff --git a/meta-phosphor/recipes-core/dropbear/dropbear/0001-dropbear-Add-c-command-option-to-force-a-specific-co.patch b/meta-phosphor/recipes-core/dropbear/dropbear/0001-dropbear-Add-c-command-option-to-force-a-specific-co.patch deleted file mode 100644 index 88d0ac0bb..000000000 --- a/meta-phosphor/recipes-core/dropbear/dropbear/0001-dropbear-Add-c-command-option-to-force-a-specific-co.patch +++ /dev/null @@ -1,91 +0,0 @@ -From b4e094381ec846f4387dc6a3c210c2205a8db58a Mon Sep 17 00:00:00 2001 -From: Jeremy Kerr -Date: Tue, 12 Apr 2016 11:11:40 +0800 -Subject: [PATCH] dropbear: Add -c option to force a specific command - -This change adds a -c option to dropbear, to force the session to use a -specific command, in a similar fashion to OpenSSH's ForceCommand -configuration option. - -This is useful to provide a simple fixed service over ssh, without -requiring an authorized key file for the per-key forced_command option. - -This setting takes precedence over the channel session's provided -command, and the per-key forced_command setting. - -Signed-off-by: Jeremy Kerr ---- - runopts.h | 2 ++ - svr-chansession.c | 12 ++++++++++-- - svr-runopts.c | 5 +++++ - 3 files changed, 17 insertions(+), 2 deletions(-) - -diff --git a/runopts.h b/runopts.h -index f7c869d..ffb573e 100644 ---- a/runopts.h -+++ b/runopts.h -@@ -114,6 +114,8 @@ typedef struct svr_runopts { - buffer * banner; - char * pidfile; - -+ char * command; -+ - } svr_runopts; - - extern svr_runopts svr_opts; -diff --git a/svr-chansession.c b/svr-chansession.c -index bfaf7f6..d6c9330 100644 ---- a/svr-chansession.c -+++ b/svr-chansession.c -@@ -671,8 +671,16 @@ static int sessioncommand(struct Channel *channel, struct ChanSess *chansess, - } - } - -- /* take public key option 'command' into account */ -- svr_pubkey_set_forced_command(chansess); -+ -+ /* take global command into account */ -+ if (svr_opts.command) { -+ chansess->original_command = chansess->cmd ? : m_strdup(""); -+ chansess->cmd = m_strdup(svr_opts.command); -+ } else { -+ /* take public key option 'command' into account */ -+ svr_pubkey_set_forced_command(chansess); -+ } -+ - - #ifdef LOG_COMMANDS - if (chansess->cmd) { -diff --git a/svr-runopts.c b/svr-runopts.c -index 8f60059..f845300 100644 ---- a/svr-runopts.c -+++ b/svr-runopts.c -@@ -79,6 +79,7 @@ static void printhelp(const char * progname) { - #ifdef ENABLE_SVR_REMOTETCPFWD - "-k Disable remote port forwarding\n" - "-a Allow connections to forwarded ports from any host\n" -+ "-c command Force executed command\n" - #endif - "-p [address:]port\n" - " Listen on specified tcp port (and optionally address),\n" -@@ -125,6 +126,7 @@ void svr_getopts(int argc, char ** argv) { - /* see printhelp() for options */ - svr_opts.bannerfile = NULL; - svr_opts.banner = NULL; -+ svr_opts.command = NULL; - svr_opts.forkbg = 1; - svr_opts.norootlogin = 0; - svr_opts.noauthpass = 0; -@@ -177,6 +179,9 @@ void svr_getopts(int argc, char ** argv) { - case 'b': - next = &svr_opts.bannerfile; - break; -+ case 'c': -+ next = &svr_opts.command; -+ break; - case 'd': - case 'r': - next = &keyfile; --- -2.5.0 - diff --git a/meta-phosphor/recipes-core/dropbear/dropbear/localoptions.h b/meta-phosphor/recipes-core/dropbear/dropbear/localoptions.h new file mode 100644 index 000000000..8aec3b3a7 --- /dev/null +++ b/meta-phosphor/recipes-core/dropbear/dropbear/localoptions.h @@ -0,0 +1,6 @@ +// Disable CBC ciphers for modern security. +#define DROPBEAR_ENABLE_CBC_MODE 0 + +#define DROPBEAR_SHA1_96_HMAC 0 +#define DROPBEAR_SHA2_256_HMAC 1 +#define DROPBEAR_SHA2_512_HMAC 1 diff --git a/meta-phosphor/recipes-core/dropbear/dropbear_%.bbappend b/meta-phosphor/recipes-core/dropbear/dropbear_%.bbappend index 80714977b..cab454af2 100644 --- a/meta-phosphor/recipes-core/dropbear/dropbear_%.bbappend +++ b/meta-phosphor/recipes-core/dropbear/dropbear_%.bbappend @@ -3,5 +3,4 @@ # to yocto 2.5 or later which will pull in the latest dropbear code. FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:" SRC_URI += "file://dropbearkey.service \ - file://0001-dropbear-Add-c-command-option-to-force-a-specific-co.patch \ - file://0001-Only-load-dropbear-default-host-keys-if-a-key-is-not.patch" + file://localoptions.h" diff --git a/meta-phosphor/recipes-core/dropbear/dropbear_2017.75.bbappend b/meta-phosphor/recipes-core/dropbear/dropbear_2017.75.bbappend deleted file mode 100644 index 0bcdf6f93..000000000 --- a/meta-phosphor/recipes-core/dropbear/dropbear_2017.75.bbappend +++ /dev/null @@ -1,4 +0,0 @@ -# TODO: Dropbear 2018.76 controls options in a different way. See -# https://github.com/openbmc/openbmc/issues/3186 -FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:" -SRC_URI += "file://options.patch" -- cgit v1.2.3