diff --git a/meta/recipes-connectivity/openssh/openssh/0001-regress-banner.sh-log-input-and-output-files-on-erro.patch b/meta/recipes-connectivity/openssh/openssh/0001-regress-banner.sh-log-input-and-output-files-on-erro.patch index 8763f30f4b..f424288e37 100644 --- a/meta/recipes-connectivity/openssh/openssh/0001-regress-banner.sh-log-input-and-output-files-on-erro.patch +++ b/meta/recipes-connectivity/openssh/openssh/0001-regress-banner.sh-log-input-and-output-files-on-erro.patch @@ -1,4 +1,4 @@ -From f5a4dacc987ca548fc86577c2dba121c86da3c34 Mon Sep 17 00:00:00 2001 +From 5cc897fe2effe549e1e280c2f606bce8b532b61e Mon Sep 17 00:00:00 2001 From: Mikko Rapeli Date: Mon, 11 Sep 2023 09:55:21 +0100 Subject: [PATCH] regress/banner.sh: log input and output files on error @@ -37,12 +37,13 @@ See: https://bugzilla.yoctoproject.org/show_bug.cgi?id=15178 Upstream-Status: Denied [https://github.com/openssh/openssh-portable/pull/437] Signed-off-by: Mikko Rapeli +Signed-off-by: Jose Quaresma --- regress/banner.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/regress/banner.sh b/regress/banner.sh -index a84feb5a..de84957a 100644 +index a84feb5..de84957 100644 --- a/regress/banner.sh +++ b/regress/banner.sh @@ -32,7 +32,9 @@ for s in 0 10 100 1000 10000 100000 ; do @@ -56,6 +57,3 @@ index a84feb5a..de84957a 100644 done trace "test suppress banner (-q)" --- -2.34.1 - diff --git a/meta/recipes-connectivity/openssh/openssh/0001-regress-test-exec-use-the-absolute-path-in-the-SSH-e.patch b/meta/recipes-connectivity/openssh/openssh/0001-regress-test-exec-use-the-absolute-path-in-the-SSH-e.patch new file mode 100644 index 0000000000..589e9f93d8 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/0001-regress-test-exec-use-the-absolute-path-in-the-SSH-e.patch @@ -0,0 +1,34 @@ +From fb762172fb678fe29327b667f8fe7380962a4540 Mon Sep 17 00:00:00 2001 +From: Jose Quaresma +Date: Mon, 15 Jul 2024 18:43:08 +0100 +Subject: [PATCH] regress/test-exec: use the absolute path in the SSH env + +The SSHAGENT_BIN was changed in [1] to SSH_BIN but +the last one don't use the absolute path and consequently +the function increase_datafile_size can loops forever. + +[1] https://github.com/openssh/openssh-portable/commit/a68f80f2511f0e0c5cef737a8284cc2dfabad818 + +Upstream-Status: Pending + +Signed-off-by: Jose Quaresma +--- + regress/test-exec.sh | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/regress/test-exec.sh b/regress/test-exec.sh +index 7afc280..175f554 100644 +--- a/regress/test-exec.sh ++++ b/regress/test-exec.sh +@@ -175,6 +175,11 @@ if [ "x$TEST_SSH_OPENSSL" != "x" ]; then + fi + + # Path to sshd must be absolute for rexec ++case "$SSH" in ++/*) ;; ++*) SSH=`which $SSH` ;; ++esac ++ + case "$SSHD" in + /*) ;; + *) SSHD=`which $SSHD` ;; diff --git a/meta/recipes-connectivity/openssh/openssh/0001-systemd-Add-optional-support-for-systemd-sd_notify.patch b/meta/recipes-connectivity/openssh/openssh/0001-systemd-Add-optional-support-for-systemd-sd_notify.patch index f079d936a4..b6a100450e 100644 --- a/meta/recipes-connectivity/openssh/openssh/0001-systemd-Add-optional-support-for-systemd-sd_notify.patch +++ b/meta/recipes-connectivity/openssh/openssh/0001-systemd-Add-optional-support-for-systemd-sd_notify.patch @@ -1,4 +1,4 @@ -From b02ef7621758f06eb686ef4f620636dbad086eda Mon Sep 17 00:00:00 2001 +From 6a25ee9627cd91de9d9c66630548e91378875b05 Mon Sep 17 00:00:00 2001 From: Matt Jolly Date: Thu, 2 Feb 2023 21:05:40 +1100 Subject: [PATCH] systemd: Add optional support for systemd `sd_notify` @@ -6,19 +6,20 @@ Subject: [PATCH] systemd: Add optional support for systemd `sd_notify` This is a rebase of Dennis Lamm's patch based on Jakub Jelen's original patch -Upstream-Status: Submitted [https://github.com/openssh/openssh-portable/pull/375/commits/be187435911cde6cc3cef6982a508261074f1e56] +Upstream-Status: Denied [https://github.com/openssh/openssh-portable/pull/375/commits/be187435911cde6cc3cef6982a508261074f1e56] Signed-off-by: Xiangyu Chen +Signed-off-by: Jose Quaresma --- configure.ac | 24 ++++++++++++++++++++++++ sshd.c | 13 +++++++++++++ 2 files changed, 37 insertions(+) diff --git a/configure.ac b/configure.ac -index 82e8bb7..d1145d3 100644 +index 5a865f8..501d81b 100644 --- a/configure.ac +++ b/configure.ac -@@ -4870,6 +4870,29 @@ AC_SUBST([GSSLIBS]) +@@ -4886,6 +4886,29 @@ AC_SUBST([GSSLIBS]) AC_SUBST([K5LIBS]) AC_SUBST([CHANNELLIBS]) @@ -48,7 +49,7 @@ index 82e8bb7..d1145d3 100644 # Looking for programs, paths and files PRIVSEP_PATH=/var/empty -@@ -5688,6 +5711,7 @@ echo " libldns support: $LDNS_MSG" +@@ -5704,6 +5727,7 @@ echo " libldns support: $LDNS_MSG" echo " Solaris process contract support: $SPC_MSG" echo " Solaris project support: $SP_MSG" echo " Solaris privilege support: $SPP_MSG" @@ -57,10 +58,10 @@ index 82e8bb7..d1145d3 100644 echo " Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG" echo " BSD Auth support: $BSD_AUTH_MSG" diff --git a/sshd.c b/sshd.c -index b4f2b97..6820a41 100644 +index ed54fc6..da396bf 100644 --- a/sshd.c +++ b/sshd.c -@@ -88,6 +88,10 @@ +@@ -69,6 +69,10 @@ #include #endif @@ -70,8 +71,8 @@ index b4f2b97..6820a41 100644 + #include "xmalloc.h" #include "ssh.h" - #include "ssh2.h" -@@ -308,6 +312,10 @@ static void + #include "sshpty.h" +@@ -484,6 +488,10 @@ static void sighup_restart(void) { logit("Received SIGHUP; restarting."); @@ -82,7 +83,7 @@ index b4f2b97..6820a41 100644 if (options.pid_file != NULL) unlink(options.pid_file); platform_pre_restart(); -@@ -2093,6 +2101,11 @@ main(int ac, char **av) +@@ -1734,6 +1742,11 @@ main(int ac, char **av) } } @@ -93,4 +94,4 @@ index b4f2b97..6820a41 100644 + /* Accept a connection and return in a forked child */ server_accept_loop(&sock_in, &sock_out, - &newsock, config_s); + &newsock, config_s, log_stderr); diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2024-6387.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2024-6387.patch deleted file mode 100644 index 3e7c707100..0000000000 --- a/meta/recipes-connectivity/openssh/openssh/CVE-2024-6387.patch +++ /dev/null @@ -1,27 +0,0 @@ -Description: fix signal handler race condition -Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/2070497 - -CVE: CVE-2024-6387 - -Upstream-Status: Backport -https://git.launchpad.net/ubuntu/+source/openssh/commit/?h=applied/ubuntu/jammy-devel&id=b059bcfa928df4ff2d103ae2e8f4e3136ee03efc - -Signed-off-by: Jose Quaresma - ---- a/log.c -+++ b/log.c -@@ -452,12 +452,14 @@ void - sshsigdie(const char *file, const char *func, int line, int showfunc, - LogLevel level, const char *suffix, const char *fmt, ...) - { -+#if 0 - va_list args; - - va_start(args, fmt); - sshlogv(file, func, line, showfunc, SYSLOG_LEVEL_FATAL, - suffix, fmt, args); - va_end(args); -+#endif - _exit(1); - } - diff --git a/meta/recipes-connectivity/openssh/openssh/fix-potential-signed-overflow-in-pointer-arithmatic.patch b/meta/recipes-connectivity/openssh/openssh/fix-potential-signed-overflow-in-pointer-arithmatic.patch index 20036da931..2c73196eb8 100644 --- a/meta/recipes-connectivity/openssh/openssh/fix-potential-signed-overflow-in-pointer-arithmatic.patch +++ b/meta/recipes-connectivity/openssh/openssh/fix-potential-signed-overflow-in-pointer-arithmatic.patch @@ -1,4 +1,4 @@ -From 3328e98bcbf2930cd7eea3e6c92ad5dcbdf4794f Mon Sep 17 00:00:00 2001 +From 90bbf404520e90f74dfb6c8eb6fd7cfd3a0eb68f Mon Sep 17 00:00:00 2001 From: Yuanjie Huang Date: Wed, 24 Aug 2016 03:15:43 +0000 Subject: [PATCH] Fix potential signed overflow in pointer arithmatic @@ -14,6 +14,7 @@ Signed-off-by: Yuanjie Huang Complete the fix Signed-off-by: Hongxu Jia +Signed-off-by: Jose Quaresma --- openbsd-compat/strlcat.c | 10 +++++++--- openbsd-compat/strlcpy.c | 8 ++++++-- @@ -106,6 +107,3 @@ index 7ad3573..7040f1f 100644 + return (size_t)((uintptr_t)cp - (uintptr_t)str); } #endif --- -2.17.1 - diff --git a/meta/recipes-connectivity/openssh/openssh/run-ptest b/meta/recipes-connectivity/openssh/openssh/run-ptest index b2244d725a..c9100f9f37 100755 --- a/meta/recipes-connectivity/openssh/openssh/run-ptest +++ b/meta/recipes-connectivity/openssh/openssh/run-ptest @@ -1,5 +1,6 @@ #!/bin/sh +export TEST_SSH_SSH=ssh export TEST_SHELL=sh export SKIP_UNIT=1 diff --git a/meta/recipes-connectivity/openssh/openssh_9.7p1.bb b/meta/recipes-connectivity/openssh/openssh_9.8p1.bb similarity index 94% rename from meta/recipes-connectivity/openssh/openssh_9.7p1.bb rename to meta/recipes-connectivity/openssh/openssh_9.8p1.bb index 4a08c0bd66..9d97f0ddb4 100644 --- a/meta/recipes-connectivity/openssh/openssh_9.7p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_9.8p1.bb @@ -26,9 +26,9 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar file://sshd_check_keys \ file://0001-regress-banner.sh-log-input-and-output-files-on-erro.patch \ file://0001-systemd-Add-optional-support-for-systemd-sd_notify.patch \ - file://CVE-2024-6387.patch \ + file://0001-regress-test-exec-use-the-absolute-path-in-the-SSH-e.patch \ " -SRC_URI[sha256sum] = "490426f766d82a2763fcacd8d83ea3d70798750c7bd2aff2e57dc5660f773ffd" +SRC_URI[sha256sum] = "dd8bd002a379b5d499dfb050dd1fa9af8029e80461f4bb6c523c49973f5a39f3" CVE_STATUS[CVE-2007-2768] = "not-applicable-config: This CVE is specific to OpenSSH with the pam opie which we don't build/use here." @@ -84,6 +84,9 @@ EXTRA_OECONF = "'LOGIN_PROGRAM=${base_bindir}/login' \ # musl doesn't implement wtmp/utmp and logwtmp EXTRA_OECONF:append:libc-musl = " --disable-wtmp --disable-lastlog" +# https://valkyrie.yoctoproject.org/#/builders/3/builds/68 +# port-linux.c:369:25: error: passing argument 2 of 'connect' from incompatible pointer type [-Wincompatible-pointer-types] +CFLAGS:append:libc-musl = " -Wno-error=incompatible-pointer-types" # Work around ICE on mips/mips64 starting in 9.6p1 EXTRA_OECONF:append:mips = " --without-hardening" @@ -198,7 +201,7 @@ ALLOW_EMPTY:${PN} = "1" PACKAGES =+ "${PN}-keygen ${PN}-scp ${PN}-ssh ${PN}-sshd ${PN}-sftp ${PN}-misc ${PN}-sftp-server" FILES:${PN}-scp = "${bindir}/scp.${BPN}" FILES:${PN}-ssh = "${bindir}/ssh.${BPN} ${sysconfdir}/ssh/ssh_config" -FILES:${PN}-sshd = "${sbindir}/sshd ${sysconfdir}/init.d/sshd ${systemd_system_unitdir}" +FILES:${PN}-sshd = "${sbindir}/sshd ${libexecdir}/sshd-session ${sysconfdir}/init.d/sshd ${systemd_system_unitdir}" FILES:${PN}-sshd += "${sysconfdir}/ssh/moduli ${sysconfdir}/ssh/sshd_config ${sysconfdir}/ssh/sshd_config_readonly ${sysconfdir}/default/volatiles/99_sshd ${sysconfdir}/pam.d/sshd" FILES:${PN}-sshd += "${libexecdir}/${BPN}/sshd_check_keys" FILES:${PN}-sftp = "${bindir}/sftp"