diff options
Diffstat (limited to 'poky/meta/recipes-connectivity/openssh')
| -rw-r--r-- | poky/meta/recipes-connectivity/openssh/openssh/0001-upstream-fix-integer-overflow-in-XMSS-private-key-pa.patch | 40 | ||||
| -rwxr-xr-x | poky/meta/recipes-connectivity/openssh/openssh/run-ptest | 1 | ||||
| -rw-r--r-- | poky/meta/recipes-connectivity/openssh/openssh/sshd.socket | 1 | ||||
| -rw-r--r-- | poky/meta/recipes-connectivity/openssh/openssh/sshd@.service | 2 | ||||
| -rw-r--r-- | poky/meta/recipes-connectivity/openssh/openssh_8.2p1.bb (renamed from poky/meta/recipes-connectivity/openssh/openssh_8.0p1.bb) | 15 |
5 files changed, 12 insertions, 47 deletions
diff --git a/poky/meta/recipes-connectivity/openssh/openssh/0001-upstream-fix-integer-overflow-in-XMSS-private-key-pa.patch b/poky/meta/recipes-connectivity/openssh/openssh/0001-upstream-fix-integer-overflow-in-XMSS-private-key-pa.patch deleted file mode 100644 index 3265be3485..0000000000 --- a/poky/meta/recipes-connectivity/openssh/openssh/0001-upstream-fix-integer-overflow-in-XMSS-private-key-pa.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 2014fad3d28090b59d2f8a0971166c06e5fa6da6 Mon Sep 17 00:00:00 2001 -From: Hongxu Jia <hongxu.jia@windriver.com> -Date: Fri, 18 Oct 2019 14:56:58 +0800 -Subject: [PATCH] upstream: fix integer overflow in XMSS private key parsing. - -Reported by Adam Zabrocki via SecuriTeam's SSH program. - -Note that this code is experimental and not compiled by default. - -ok markus@ - -OpenBSD-Commit-ID: cd0361896d15e8a1bac495ac583ff065ffca2be1 - -Signed-off-by: "djm@openbsd.org" <djm@openbsd.org> - -Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/a546b17bbaeb12beac4c9aeed56f74a42b18a93a] -CVE: CVE-2019-16905 - -Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> ---- - sshkey-xmss.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/sshkey-xmss.c b/sshkey-xmss.c -index aaae702..c57681a 100644 ---- a/sshkey-xmss.c -+++ b/sshkey-xmss.c -@@ -977,7 +977,8 @@ sshkey_xmss_decrypt_state(const struct sshkey *k, struct sshbuf *encoded, - goto out; - } - /* check that an appropriate amount of auth data is present */ -- if (sshbuf_len(encoded) < encrypted_len + authlen) { -+ if (sshbuf_len(encoded) < authlen || -+ sshbuf_len(encoded) - authlen < encrypted_len) { - r = SSH_ERR_INVALID_FORMAT; - goto out; - } --- -2.7.4 - diff --git a/poky/meta/recipes-connectivity/openssh/openssh/run-ptest b/poky/meta/recipes-connectivity/openssh/openssh/run-ptest index daf62cca5b..ae03e929b2 100755 --- a/poky/meta/recipes-connectivity/openssh/openssh/run-ptest +++ b/poky/meta/recipes-connectivity/openssh/openssh/run-ptest @@ -1,6 +1,7 @@ #!/bin/sh export TEST_SHELL=sh +export SKIP_UNIT=1 cd regress sed -i "/\t\tagent-ptrace /d" Makefile diff --git a/poky/meta/recipes-connectivity/openssh/openssh/sshd.socket b/poky/meta/recipes-connectivity/openssh/openssh/sshd.socket index 12c39b26b5..8d76d62309 100644 --- a/poky/meta/recipes-connectivity/openssh/openssh/sshd.socket +++ b/poky/meta/recipes-connectivity/openssh/openssh/sshd.socket @@ -1,5 +1,6 @@ [Unit] Conflicts=sshd.service +Wants=sshdgenkeys.service [Socket] ExecStartPre=@BASE_BINDIR@/mkdir -p /var/run/sshd diff --git a/poky/meta/recipes-connectivity/openssh/openssh/sshd@.service b/poky/meta/recipes-connectivity/openssh/openssh/sshd@.service index 9d83dfb2bb..422450c7a1 100644 --- a/poky/meta/recipes-connectivity/openssh/openssh/sshd@.service +++ b/poky/meta/recipes-connectivity/openssh/openssh/sshd@.service @@ -1,13 +1,11 @@ [Unit] Description=OpenSSH Per-Connection Daemon -Wants=sshdgenkeys.service After=sshdgenkeys.service [Service] Environment="SSHD_OPTS=" EnvironmentFile=-/etc/default/ssh ExecStart=-@SBINDIR@/sshd -i $SSHD_OPTS -ExecReload=@BASE_BINDIR@/kill -HUP $MAINPID StandardInput=socket StandardError=syslog KillMode=process diff --git a/poky/meta/recipes-connectivity/openssh/openssh_8.0p1.bb b/poky/meta/recipes-connectivity/openssh/openssh_8.2p1.bb index 2ffbc9a95f..d879efc201 100644 --- a/poky/meta/recipes-connectivity/openssh/openssh_8.0p1.bb +++ b/poky/meta/recipes-connectivity/openssh/openssh_8.2p1.bb @@ -6,7 +6,7 @@ and for executing commands on a remote machine." HOMEPAGE = "http://www.openssh.com/" SECTION = "console/network" LICENSE = "BSD & ISC & MIT" -LIC_FILES_CHKSUM = "file://LICENCE;md5=429658c6612f3a9b1293782366ab29d8" +LIC_FILES_CHKSUM = "file://LICENCE;md5=18d9e5a8b3dd1790d73502f50426d4d3" DEPENDS = "zlib openssl virtual/crypt" DEPENDS += "${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'libpam', '', d)}" @@ -24,14 +24,13 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar file://fix-potential-signed-overflow-in-pointer-arithmatic.patch \ file://sshd_check_keys \ file://add-test-support-for-busybox.patch \ - file://0001-upstream-fix-integer-overflow-in-XMSS-private-key-pa.patch \ " -SRC_URI[md5sum] = "bf050f002fe510e1daecd39044e1122d" -SRC_URI[sha256sum] = "bd943879e69498e8031eb6b7f44d08cdc37d59a7ab689aa0b437320c3481fd68" +SRC_URI[md5sum] = "3076e6413e8dbe56d33848c1054ac091" +SRC_URI[sha256sum] = "43925151e6cf6cee1450190c0e9af4dc36b41c12737619edff8bcebdff64e671" PAM_SRC_URI = "file://sshd" -inherit useradd update-rc.d update-alternatives systemd +inherit manpages useradd update-rc.d update-alternatives systemd USERADD_PACKAGES = "${PN}-sshd" USERADD_PARAM_${PN}-sshd = "--system --no-create-home --home-dir /var/run/sshd --shell /bin/false --user-group sshd" @@ -44,6 +43,12 @@ SYSTEMD_SERVICE_${PN}-sshd = "sshd.socket" inherit autotools-brokensep ptest +PACKAGECONFIG ??= "" +PACKAGECONFIG[kerberos] = "--with-kerberos5,--without-kerberos5,krb5" +PACKAGECONFIG[ldns] = "--with-ldns,--without-ldns,ldns" +PACKAGECONFIG[libedit] = "--with-libedit,--without-libedit,libedit" +PACKAGECONFIG[manpages] = "--with-mantype=man,--with-mantype=cat" + EXTRA_AUTORECONF += "--exclude=aclocal" # login path is hardcoded in sshd |