From 58d5ec1c1e98326577fa902f6c9c568639b18d12 Mon Sep 17 00:00:00 2001 From: V3n3RiX Date: Fri, 22 Mar 2024 01:00:40 +0000 Subject: gentoo auto-resync : 22:03:2024 - 01:00:40 --- net-misc/Manifest.gz | Bin 54953 -> 54954 bytes net-misc/openssh-contrib/Manifest | 7 + ..._NORESERVE-in-sandbox-seccomp-filter-maps.patch | 44 ++ .../openssh-contrib/openssh-contrib-9.7_p1.ebuild | 499 +++++++++++++++++++++ net-misc/passt/Manifest | 2 +- net-misc/passt/passt-2024.03.20.ebuild | 2 +- 6 files changed, 552 insertions(+), 2 deletions(-) create mode 100644 net-misc/openssh-contrib/files/openssh-9.4_p1-Allow-MAP_NORESERVE-in-sandbox-seccomp-filter-maps.patch create mode 100644 net-misc/openssh-contrib/openssh-contrib-9.7_p1.ebuild (limited to 'net-misc') diff --git a/net-misc/Manifest.gz b/net-misc/Manifest.gz index fa0fb6791ba1..44a1f015d144 100644 Binary files a/net-misc/Manifest.gz and b/net-misc/Manifest.gz differ diff --git a/net-misc/openssh-contrib/Manifest b/net-misc/openssh-contrib/Manifest index 860a45c478e9..dff54258eb83 100644 --- a/net-misc/openssh-contrib/Manifest +++ b/net-misc/openssh-contrib/Manifest @@ -7,6 +7,7 @@ AUX openssh-8.7_p1-GSSAPI-dns.patch 11576 BLAKE2B 84aa0128ddeccf67e14c20f9d2acb6 AUX openssh-8.9_p1-allow-ppoll_time64.patch 396 BLAKE2B b5bb202f79699d9037f12155044328f89ee0573efa43da7cdf8511555e706b6bf66cae069ac95cca900779c6ce293eedec48450f786fd033375e9be17bfb2872 SHA512 9b88024e6a898fc85205fbc038274a3271f787276962150965ab8f599fa355ee73cb48e7e12e3f090034293f9dca94a1ce41dfce2aaeb140693545ff3bc391f0 AUX openssh-9.0_p1-X509-uninitialized-delay.patch 321 BLAKE2B 19bff0fc7ecdc6350f8e6bd30f36f30b455c65b7455fe8b1d481d8fa7cdfa7cc76719931857fe2c9730b05ae8fe3e7e05c538e743e055d6594dd2fc7c3f250ee SHA512 57798621a51a60abf6985391ec73dcafdb46de75c93579e23b786aa095d8eea29ebd9ab5987b951a136b15e60896332c9717c82b42e1c22b345444aedf17a9f5 AUX openssh-9.3_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch 514 BLAKE2B d0dadfc57736cd4d2b04e46f5c0f6d5a1db1cfc7ee70d32afaa0f65269b82e66a72c46d33c9cbf7237f541a0485b25669cd2f4b34393e3a3ef0c9b4334092fe5 SHA512 f8badde54501340bde275951bc1cf653919bec02c760bf771308f10697b9ad2a483e30ae74ad124a737341f5c64657ab193a4d7fdf2baf24029b9447099da04b +AUX openssh-9.4_p1-Allow-MAP_NORESERVE-in-sandbox-seccomp-filter-maps.patch 1647 BLAKE2B 9d55e9060e6eae041176bef27acc58d6026c8fb68c65c71c11c1acbe4e6840a63fba3dbc113a8981da66901717c1f3b4f2211a2cb322d3d4e5eba8c86f4e269c SHA512 d8fc604795d8bb4228ccbfe5714d5503bb1e0d63818d2fac65d533530d01fe4ce4fac0743b8b415f646322fec859b699fa7365beba8a42bd880d737b7c6bd7df AUX openssh-9.6_p1-hpn-version.patch 552 BLAKE2B 4fccbb5239b9e856b01c796216ef73aaeeee0676cafc9274d225047b0196d26601073d06c8bb443361cdf89229fb052b6760273facec3e505d2bf80135f15235 SHA512 46dc0cf3bf94237d582f1c363723f22e0bbf6c435f649776766690d2595f07012e2e65a3e73f1c18dbe564885e690ce1449c3e6bf63778fe4220b4c897928f9c AUX sshd-r1.confd 774 BLAKE2B df3f3f28cb4d35b49851399b52408c42e242ae3168ff3fc79add211903567da370cfe86a267932ca9cf13c3afbc38a8f1b53e753a31670ee61bf8ba8747832f8 SHA512 3a69752592126024319a95f1c1747af508fd639c86eca472106c5d6c23d5eeaa441ca74740d4b1aafaa0db759d38879e3c1cee742b08d6166ebc58cddac1e2fe AUX sshd-r1.initd 2675 BLAKE2B 47e87cec2d15b90aae362ce0c8e8ba08dada9ebc244e28be1fe67d24deb00675d3d9b8fef40def8a9224a3e2d15ab717574a3d837e099133c1cf013079588b55 SHA512 257d6437162b76c4a3a648ecc5d4739ca7eaa60b192fde91422c6c05d0de6adfa9635adc24d57dc3da6beb92b1b354ffe8fddad3db453efb610195d5509a4e27 @@ -28,6 +29,12 @@ DIST openssh-9.6_p1-hpn-15.2-glue.patch.xz 5028 BLAKE2B 74970dc9f244eea2e35270c9 DIST openssh-9.6p1+x509-14.4.2.diff.gz 1243845 BLAKE2B 19ed0e174d06f4722b0f244e2c41098422fec88372d77e7c64bed2c00f4d4842b8f517d3f49958febd7a640f0582497fcaf64774fd0a04fbdc8c06b7f0ce5311 SHA512 247a088bbe7fe2bced0ec6e7f3d1fc34c3b81ce43ade9312a769c4495c7adf60d8a9ad2afb25e52fdea2f60888330de05375fbe24cd5b86a2f173e160ddb7bb8 DIST openssh-9.6p1.tar.gz 1857862 BLAKE2B dd7f6747fe89f7b386be4faaf7fc43398a9bf439e45608ae61c2126cf8743c64ef7b5af45c75e9007b0bda525f8809261ca0f2fc47ce60177ba769a5324719dd SHA512 0ebf81e39914c3a90d7777a001ec7376a94b37e6024baf3e972c58f0982b7ddef942315f5e01d56c00ff95603b4a20ee561ab918ecc55511df007ac138160509 DIST openssh-9.6p1.tar.gz.asc 833 BLAKE2B 9363d02f85457aa90069020827306a2f49d8406e32f5ee1d231844648dd2ffa02fa9b7325b8677a11e46a0ba0d9ffc86d9c989435d691a02f5354a956c49f9f9 SHA512 aec5a5bd6ce480a8e5b5879dc55f8186aec90fe61f085aa92ad7d07f324574aa781be09c83b7443a32848d091fd44fb12c1842d49cee77afc351e550ffcc096d +DIST openssh-9.7_p1-X509-glue-15.0.patch.xz 1532 BLAKE2B ff2c5ca97607da84345342bec31435304780503d4f066bf181407c85981d8e73b622ca1107b303d0cf7bc61a262f6e8f38d5372a60d8389b8caf671cfa55b94b SHA512 48ec8e54e6e670ee2d2783fb38befd4101869cc7fc1a4e7b72058034a716170da62cae7e94a48acb575a1cec2604d5c02da629fbe482b7dbc5e28cf4d7ef7c01 +DIST openssh-9.7_p1-hpn-15.2-X509-15.0-glue.patch.xz 5472 BLAKE2B 6ebbc663aaaa54d3af3c204f0c2f11d8b3d4e5c842b38b82263d21659cebcceaaa6502c04bb5e06c4200b9aef9d267b61e33f94001efe30f8e57760d43df5292 SHA512 e90ceda65ccfc80c4dec580b6e64f3bd889443d6e7d627dc4fca4900776621d33f3da0856998a63560f195b1ed98e47c4401e40d6840518ee1ccb8ea150f21fe +DIST openssh-9.7p1+x509-15.0.diff.gz 1239003 BLAKE2B 98f6a6d531a9afb70d6f34dcd6609115e017d4b1738a0683dbabf66aba02382cf727db4fb07fd2a62534aa87318982e9d1c41991fdbf7cc3e6593d376ad08208 SHA512 c141bddd73fb78a8f0c92bbed6900bab6617768fc124c10ec4ea70491e1b545bbd962fa35ee5efd134a9851a1b807a5b8bae8e46585cf87a60e0311b49de3226 +DIST openssh-9.7p1.tar.gz 1848766 BLAKE2B 520859fcbdf678808fc8515b64585ab9a90a8055fa869df6fbba3083cb7f73ddb81ed9ea981e131520736a8aed838f85ae68ca63406a410df61039913c5cb48b SHA512 0cafc17d22851605a4a5495a1d82c2b3fbbe6643760aad226dbf2a25b5f49d4375c3172833706ea3cb6c05d5d02a40feb9a7e790eae5c4570dd344a43e94ca55 +DIST openssh-9.7p1.tar.gz.asc 833 BLAKE2B a95e952be48bd55a07d0a95a49dc06c326816c67b8b5d40bd3f64c28aa43122253817b8a088e7a3b8a190375ea39f9fc3400b22d035561f9643c1d32b5caef27 SHA512 e028978e4266de9ad513626b13d70249e4166923fc15f38751178e2b3522ff6ebb9a7ca7dc32d1bb42d42fb92adf9903dba1b734bec083010ed7323aadad8baf EBUILD openssh-contrib-9.5_p1.ebuild 17863 BLAKE2B 812d2a7f5adbf44f002532c491e3832946b9c79fb639bea59dce09333cc3bb3c277564c34b4d015b8a7ed6c39cd1f84183e9fac976ebf4a631dea053cc81d3c2 SHA512 25ba6ff44cd06a8188e92c8dd7f6c9985f2dd55bd6f9999849f0ece7068602b184cf3a472cd8b8028abfac726818bfdd55cb9c63768937fa65b8a400fcde57a0 EBUILD openssh-contrib-9.6_p1.ebuild 17817 BLAKE2B 46035746ddbc1d8648f8bebd820bc05546945bb648c451c144caf3a794f8e07e0660223f63c7a7042956201aa895de1192642db1400275fa724fdbbde5d04daf SHA512 d27da5969af231b409acd38b49c60a81316524db41cc8725b7f80c7d8c9c636c498427f1853575c17af2e71f1684614d4d1158bc87bbdecaed9da05b44222003 +EBUILD openssh-contrib-9.7_p1.ebuild 17560 BLAKE2B 78db7245e3ad7f413798adbbebdcb4c4a9a9a99eb312d24208ec973fe13752c912c5ed126c3ebb0976b7f5ba2fc9f84dc69a10c4c344ea268d63eaaba702b934 SHA512 4afa22734e6b1667ffff1f45fc609efce3b3df2ad936765efc4616661d4f4b26f9d7a5ea87eddd04d76bc636655aba146556eb204463e6fc8ee9cdcdc632438a MISC metadata.xml 2975 BLAKE2B 068d52ba2e5de0b696e7fe995e4c2a041206a59258f24704ca3a72fe1d85323c2aad7899f055b48a4045d6303491822c59f2b86b85fc428a26f8259ea583796a SHA512 83fef701188c00af53382b5099fc2ebf83c903c3edefc3d2cf6deb0a667c0d0d9531c18728eef9b5b703903d31fbdb55a68e5b76890ea090bc1d79fef3ae6b89 diff --git a/net-misc/openssh-contrib/files/openssh-9.4_p1-Allow-MAP_NORESERVE-in-sandbox-seccomp-filter-maps.patch b/net-misc/openssh-contrib/files/openssh-9.4_p1-Allow-MAP_NORESERVE-in-sandbox-seccomp-filter-maps.patch new file mode 100644 index 000000000000..379a3981d7ea --- /dev/null +++ b/net-misc/openssh-contrib/files/openssh-9.4_p1-Allow-MAP_NORESERVE-in-sandbox-seccomp-filter-maps.patch @@ -0,0 +1,44 @@ +From 45b491ce13fcf7dbc0b3bd6df986c9cf59190721 Mon Sep 17 00:00:00 2001 +From: Jordan R Abrahams-Whitehead +Date: Tue, 12 Dec 2023 22:54:02 +0000 +Subject: [PATCH] Allow MAP_NORESERVE in sandbox seccomp filter maps + +While debugging Scudo on ChromeOS, we found that the no reserve mode +immediately crashed `sshd`. We tracked it down to the +sandbox-seccomp-filter. + +Being able to mmap with MAP_NORESERVE is useful (if not necessary) for +some overcommitting allocators. + +During mmap calls, the flag MAP_NORESERVE is used by some allocators +such as LLVM's Scudo for layout optimisation. This causes the sandbox +seccomp filter for the client subprocess to die with some Scudo +configurations. + +Upstream patch submission: +https://lists.mindrot.org/pipermail/openssh-unix-dev/2023-December/041095.html +--- + sandbox-seccomp-filter.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c +index 23b40b643..a49c5ca99 100644 +--- a/sandbox-seccomp-filter.c ++++ b/sandbox-seccomp-filter.c +@@ -190,9 +190,11 @@ + + #if defined(__NR_mmap) || defined(__NR_mmap2) + # ifdef MAP_FIXED_NOREPLACE +-# define SC_MMAP_FLAGS MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED|MAP_FIXED_NOREPLACE ++# define SC_MMAP_FLAGS MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED \ ++ |MAP_NORESERVE|MAP_FIXED_NOREPLACE + # else +-# define SC_MMAP_FLAGS MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED ++# define SC_MMAP_FLAGS MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED \ ++ |MAP_NORESERVE + # endif /* MAP_FIXED_NOREPLACE */ + /* Use this for both __NR_mmap and __NR_mmap2 variants */ + # define SC_MMAP(_nr) \ +-- +2.43.0.472.g3155946c3a-goog + diff --git a/net-misc/openssh-contrib/openssh-contrib-9.7_p1.ebuild b/net-misc/openssh-contrib/openssh-contrib-9.7_p1.ebuild new file mode 100644 index 000000000000..5173b0254cbb --- /dev/null +++ b/net-misc/openssh-contrib/openssh-contrib-9.7_p1.ebuild @@ -0,0 +1,499 @@ +# Copyright 1999-2024 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +inherit user-info flag-o-matic autotools pam systemd toolchain-funcs verify-sig + +# Make it more portable between straight releases +# and _p? releases. +MY_P=${P/-contrib/} +PARCH=${MY_P/_} + +# PV to USE for HPN patches +#HPN_PV="${PV^^}" +HPN_PV="8.5_P1" + +HPN_VER="15.2" +HPN_PATCHES=( + openssh-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff + openssh-${HPN_PV/./_}-hpn-PeakTput-${HPN_VER}.diff +) +HPN_GLUE_PATCH="openssh-9.6_p1-hpn-${HPN_VER}-glue.patch" +HPN_PATCH_DIR="HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}" + +X509_VER="15.0" +X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz" +X509_PATCH="${X509_PATCH/p2/p1}" +X509_GLUE_PATCH="openssh-${PV}-X509-glue-${X509_VER}.patch" +#X509_HPN_GLUE_PATCH="${MY_P}-hpn-${HPN_VER}-X509-${X509_VER}-glue.patch" +X509_HPN_GLUE_PATCH="${MY_P}-hpn-${HPN_VER}-X509-${X509_VER%.1}-glue.patch" + +DESCRIPTION="Port of OpenBSD's free SSH release with HPN/X509 patches" +HOMEPAGE="https://www.openssh.com/" +SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz + ${HPN_VER:+hpn? ( + $(printf "mirror://sourceforge/project/hpnssh/Patches/${HPN_PATCH_DIR}/%s\n" "${HPN_PATCHES[@]}") + https://dev.gentoo.org/~chutzpah/dist/openssh/${HPN_GLUE_PATCH}.xz + )} + ${X509_VER:+X509? ( + https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} + https://dev.gentoo.org/~chutzpah/dist/openssh/${X509_GLUE_PATCH}.xz + ${HPN_VER:+hpn? ( https://dev.gentoo.org/~chutzpah/dist/openssh/${X509_HPN_GLUE_PATCH}.xz )} + )} + verify-sig? ( mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz.asc ) +" +VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssh.org.asc +S="${WORKDIR}/${PARCH}" + +LICENSE="BSD GPL-2" +SLOT="0" +KEYWORDS="~amd64" +# Probably want to drop ssl defaulting to on in a future version. +IUSE="abi_mips_n32 audit debug hpn kerberos ldns libedit livecd pam +pie security-key selinux +ssl static test X X509 xmss" + +RESTRICT="!test? ( test )" + +REQUIRED_USE=" + hpn? ( ssl ) + ldns? ( ssl ) + pie? ( !static ) + static? ( !kerberos !pam ) + X509? ( ssl !xmss ) + xmss? ( ssl ) + test? ( ssl ) +" + +# tests currently fail with XMSS +REQUIRED_USE+="test? ( !xmss )" + +LIB_DEPEND=" + audit? ( sys-process/audit[static-libs(+)] ) + ldns? ( + net-libs/ldns[static-libs(+)] + net-libs/ldns[ecdsa(+),ssl(+)] + ) + libedit? ( dev-libs/libedit:=[static-libs(+)] ) + security-key? ( >=dev-libs/libfido2-1.5.0:=[static-libs(+)] ) + selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] ) + ssl? ( >=dev-libs/openssl-1.1.1l-r1:0=[static-libs(+)] ) + virtual/libcrypt:=[static-libs(+)] + >=sys-libs/zlib-1.2.3:=[static-libs(+)] +" +RDEPEND=" + !net-misc/openssh + acct-group/sshd + acct-user/sshd + !static? ( ${LIB_DEPEND//\[static-libs(+)]} ) + pam? ( sys-libs/pam ) + kerberos? ( virtual/krb5 ) +" +DEPEND="${RDEPEND} + virtual/os-headers + kernel_linux? ( !prefix-guest? ( >=sys-kernel/linux-headers-5.1 ) ) + static? ( ${LIB_DEPEND} ) +" +RDEPEND="${RDEPEND} + pam? ( >=sys-auth/pambase-20081028 ) + !prefix? ( sys-apps/shadow ) + X? ( x11-apps/xauth ) +" +# Weird dep construct for newer gcc-config for bug #872416 +BDEPEND=" + dev-build/autoconf + virtual/pkgconfig + || ( + >=sys-devel/gcc-config-2.6 + >=sys-devel/clang-toolchain-symlinks-16-r1:* + >=sys-devel/clang-toolchain-symlinks-15-r1:15 + ) + verify-sig? ( sec-keys/openpgp-keys-openssh ) +" + +PATCHES=( + "${FILESDIR}/openssh-9.3_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch" + "${FILESDIR}/openssh-9.4_p1-Allow-MAP_NORESERVE-in-sandbox-seccomp-filter-maps.patch" +) + +pkg_pretend() { + # this sucks, but i'd rather have people unable to `emerge -u openssh` + # than not be able to log in to their server any more + local missing=() + check_feature() { use "${1}" && [[ -z ${!2} ]] && missing+=( "${1}" ); } + check_feature hpn HPN_VER + check_feature X509 X509_PATCH + if [[ ${#missing[@]} -ne 0 ]] ; then + eerror "Sorry, but this version does not yet support features" + eerror "that you requested: ${missing[*]}" + eerror "Please mask ${PF} for now and check back later:" + eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask" + die "Missing requested third party patch." + fi + + # Make sure people who are using tcp wrappers are notified of its removal. #531156 + if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then + ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like" + ewarn "you're trying to use it. Update your ${EROOT}/etc/hosts.{allow,deny} please." + fi +} + +src_unpack() { + default + + # We don't have signatures for HPN, X509, so we have to write this ourselves + use verify-sig && verify-sig_verify_detached "${DISTDIR}"/${PARCH}.tar.gz{,.asc} +} + +src_prepare() { + sed -i \ + -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \ + pathnames.h || die + + # don't break .ssh/authorized_keys2 for fun + sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die + + eapply -- "${PATCHES[@]}" + + [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches + + local PATCHSET_VERSION_MACROS=() + + if use X509 ; then + pushd "${WORKDIR}" &>/dev/null || die + eapply "${WORKDIR}/${X509_GLUE_PATCH}" + popd &>/dev/null || die + + eapply "${WORKDIR}"/${X509_PATCH%.*} + eapply "${FILESDIR}/openssh-9.0_p1-X509-uninitialized-delay.patch" + + # We need to patch package version or any X.509 sshd will reject our ssh client + # with "userauth_pubkey: could not parse key: string is too large [preauth]" + # error + einfo "Patching package version for X.509 patch set ..." + sed -i \ + -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \ + "${S}"/configure.ac || die "Failed to patch package version for X.509 patch" + + einfo "Patching version.h to expose X.509 patch set ..." + sed -i \ + -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \ + "${S}"/version.h || die "Failed to sed-in X.509 patch version" + PATCHSET_VERSION_MACROS+=( 'SSH_X509' ) + fi + + if use hpn ; then + local hpn_patchdir="${T}/openssh-${PV}-hpn${HPN_VER}" + mkdir "${hpn_patchdir}" || die + cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}" || die + pushd "${hpn_patchdir}" &>/dev/null || die + eapply "${WORKDIR}/${HPN_GLUE_PATCH}" + use X509 && eapply "${WORKDIR}/${X509_HPN_GLUE_PATCH}" + popd &>/dev/null || die + + eapply "${hpn_patchdir}" + + use X509 || eapply "${FILESDIR}/openssh-9.6_p1-hpn-version.patch" + + einfo "Patching Makefile.in for HPN patch set ..." + sed -i \ + -e "/^LIBS=/ s/\$/ -lpthread/" \ + "${S}"/Makefile.in || die "Failed to patch Makefile.in" + + einfo "Patching version.h to expose HPN patch set ..." + sed -i \ + -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER//./v}\"" \ + "${S}"/version.h || die "Failed to sed-in HPN patch version" + PATCHSET_VERSION_MACROS+=( 'SSH_HPN' ) + + if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then + # Before re-enabling, check https://bugs.gentoo.org/354113#c6 + # and be sure to have tested it. + einfo "Disabling known non-working MT AES cipher per default ..." + + cat > "${T}"/disable_mtaes.conf <<- EOF + + # HPN's Multi-Threaded AES CTR cipher is currently known to be broken + # and therefore disabled per default. + DisableMTAES yes + EOF + sed -i \ + -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \ + "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config" + + sed -i \ + -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \ + "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config" + fi + fi + + if use X509 || use hpn ; then + einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..." + sed -i \ + -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \ + "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)" + + einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..." + sed -i \ + -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \ + "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)" + + einfo "Patching version.h to add our patch sets to SSH_RELEASE ..." + sed -i \ + -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \ + "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)" + fi + + eapply_user #473004 + + # These tests are currently incompatible with PORTAGE_TMPDIR/sandbox + sed -e '/\t\tpercent \\/ d' \ + -i regress/Makefile || die + + tc-export PKG_CONFIG + local sed_args=( + -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):" + # Disable fortify flags ... our gcc does this for us + -e 's:-D_FORTIFY_SOURCE=2::' + ) + + # _XOPEN_SOURCE causes header conflicts on Solaris + [[ ${CHOST} == *-solaris* ]] && sed_args+=( + -e 's/-D_XOPEN_SOURCE//' + ) + sed -i "${sed_args[@]}" configure{.ac,} || die + + eautoreconf +} + +src_configure() { + addwrite /dev/ptmx + + use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG + use static && append-ldflags -static + use xmss && append-cflags -DWITH_XMSS + + if [[ ${CHOST} == *-solaris* ]] ; then + # Solaris' glob.h doesn't have things like GLOB_TILDE, configure + # doesn't check for this, so force the replacement to be put in + # place + append-cppflags -DBROKEN_GLOB + fi + + # use replacement, RPF_ECHO_ON doesn't exist here + [[ ${CHOST} == *-darwin* ]] && export ac_cv_func_readpassphrase=no + + local myconf=( + --with-ldflags="${LDFLAGS}" + --disable-strip + --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run + --sysconfdir="${EPREFIX}"/etc/ssh + --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc + --datadir="${EPREFIX}"/usr/share/openssh + --with-privsep-path="${EPREFIX}"/var/empty + --with-privsep-user=sshd + --with-hardening + $(use_with audit audit linux) + $(use_with kerberos kerberos5 "${EPREFIX}"/usr) + $(use_with ldns) + $(use_with libedit) + $(use_with pam) + $(use_with pie) + $(use_with selinux) + $(usex X509 '' "$(use_with security-key security-key-builtin)") + $(use_with ssl openssl) + $(use_with ssl ssl-engine) + ) + + if use elibc_musl; then + # musl defines bogus values for UTMP_FILE and WTMP_FILE + # https://bugs.gentoo.org/753230 + myconf+=( --disable-utmp --disable-wtmp ) + fi + + # Workaround for Clang 15 miscompilation with -fzero-call-used-regs=all + # bug #869839 (https://github.com/llvm/llvm-project/issues/57692) + tc-is-clang && myconf+=( --without-hardening ) + + econf "${myconf[@]}" +} + +src_test() { + local tests=( compat-tests ) + local shell=$(egetshell "${UID}") + if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then + ewarn "Running the full OpenSSH testsuite requires a usable shell for the 'portage'" + ewarn "user, so we will run a subset only." + tests+=( interop-tests ) + else + tests+=( tests ) + fi + + local -x SUDO= SSH_SK_PROVIDER= TEST_SSH_UNSAFE_PERMISSIONS=1 REGRESS_INTEROP_PUTTY=1 + mkdir -p "${HOME}"/.ssh || die + emake -j1 "${tests[@]}" > "${ED}"/etc/ssh/ssh_config || die + Include "${EPREFIX}/etc/ssh/ssh_config.d/*.conf" + EOF + cat <<-EOF >> "${ED}"/etc/ssh/sshd_config || die + Include "${EPREFIX}/etc/ssh/sshd_config.d/*.conf" + EOF + + cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo.conf || die + # Send locale environment variables (bug #367017) + SendEnv ${locale_vars[*]} + + # Send COLORTERM to match TERM (bug #658540) + SendEnv COLORTERM + EOF + + cat <<-EOF >> "${ED}"/etc/ssh/ssh_config.d/9999999gentoo-security.conf || die + RevokedHostKeys "${EPREFIX}/etc/ssh/ssh_revoked_hosts" + EOF + + cat <<-EOF >> "${ED}"/etc/ssh/ssh_revoked_hosts || die + # https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/ + ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ== + EOF + + cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo.conf || die + # Allow client to pass locale environment variables (bug #367017) + AcceptEnv ${locale_vars[*]} + + # Allow client to pass COLORTERM to match TERM (bug #658540) + AcceptEnv COLORTERM + EOF + + if use pam ; then + cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo-pam.conf || die + UsePAM yes + # This interferes with PAM. + PasswordAuthentication no + # PAM can do its own handling of MOTD. + PrintMotd no + PrintLastLog no + EOF + fi + + if use livecd ; then + cat <<-EOF >> "${ED}"/etc/ssh/sshd_config.d/9999999gentoo-livecd.conf || die + # Allow root login with password on livecds. + PermitRootLogin Yes + EOF + fi +} + +src_install() { + emake install-nokeys DESTDIR="${D}" + fperms 600 /etc/ssh/sshd_config + dobin contrib/ssh-copy-id + newinitd "${FILESDIR}"/sshd-r1.initd sshd + newconfd "${FILESDIR}"/sshd-r1.confd sshd + + if use pam; then + newpamd "${FILESDIR}"/sshd.pam_include.2 sshd + fi + + tweak_ssh_configs + + doman contrib/ssh-copy-id.1 + dodoc CREDITS OVERVIEW README* TODO sshd_config + use hpn && dodoc HPN-README + use X509 || dodoc ChangeLog + + diropts -m 0700 + dodir /etc/skel/.ssh + rmdir "${ED}"/var/empty || die + + systemd_dounit "${FILESDIR}"/sshd.socket + systemd_newunit "${FILESDIR}"/sshd.service.1 sshd.service + systemd_newunit "${FILESDIR}"/sshd_at.service.1 'sshd@.service' +} + +pkg_preinst() { + if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]"; then + show_ssl_warning=1 + fi +} + +pkg_postinst() { + local old_ver + for old_ver in ${REPLACING_VERSIONS}; do + if ver_test "${old_ver}" -lt "5.8_p1"; then + elog "Starting with openssh-5.8p1, the server will default to a newer key" + elog "algorithm (ECDSA). You are encouraged to manually update your stored" + elog "keys list as servers update theirs. See ssh-keyscan(1) for more info." + fi + if ver_test "${old_ver}" -lt "7.0_p1"; then + elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream." + elog "Make sure to update any configs that you might have. Note that xinetd might" + elog "be an alternative for you as it supports USE=tcpd." + fi + if ver_test "${old_ver}" -lt "7.1_p1"; then #557388 #555518 + elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their" + elog "weak sizes. If you rely on these key types, you can re-enable the key types by" + elog "adding to your sshd_config or ~/.ssh/config files:" + elog " PubkeyAcceptedKeyTypes=+ssh-dss" + elog "You should however generate new keys using rsa or ed25519." + + elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'" + elog "to 'prohibit-password'. That means password auth for root users no longer works" + elog "out of the box. If you need this, please update your sshd_config explicitly." + fi + if ver_test "${old_ver}" -lt "7.6_p1"; then + elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely." + elog "Furthermore, rsa keys with less than 1024 bits will be refused." + fi + if ver_test "${old_ver}" -lt "7.7_p1"; then + elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality." + elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option" + elog "if you need to authenticate against LDAP." + elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details." + fi + if ver_test "${old_ver}" -lt "8.2_p1"; then + ewarn "After upgrading to openssh-8.2p1 please restart sshd, otherwise you" + ewarn "will not be able to establish new sessions. Restarting sshd over a ssh" + ewarn "connection is generally safe." + fi + if ver_test "${old_ver}" -lt "9.2_p1-r1" && systemd_is_booted; then + ewarn "From openssh-9.2_p1-r1 the supplied systemd unit file defaults to" + ewarn "'Restart=on-failure', which causes the service to automatically restart if it" + ewarn "terminates with an unclean exit code or signal. This feature is useful for most users," + ewarn "but it can increase the vulnerability of the system in the event of a future exploit." + ewarn "If you have a web-facing setup or are concerned about security, it is recommended to" + ewarn "set 'Restart=no' in your sshd unit file." + fi + done + + if [[ -n ${show_ssl_warning} ]]; then + elog "Be aware that by disabling openssl support in openssh, the server and clients" + elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys" + elog "and update all clients/servers that utilize them." + fi + + if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then + elog "" + elog "HPN's multi-threaded AES CTR cipher is currently known to be broken" + elog "and therefore disabled at runtime per default." + elog "Make sure your sshd_config is up to date and contains" + elog "" + elog " DisableMTAES yes" + elog "" + elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher." + elog "" + fi +} diff --git a/net-misc/passt/Manifest b/net-misc/passt/Manifest index af08b106df14..617e10697a0c 100644 --- a/net-misc/passt/Manifest +++ b/net-misc/passt/Manifest @@ -4,6 +4,6 @@ DIST passt-2023.12.30.tar.xz 188596 BLAKE2B 75712a7cb7a00fea20427979153090d938b8 DIST passt-2024.03.20.tar.xz 195332 BLAKE2B 1bed740ddd235f300a4233fb2024f155758809589f1fdd2174ab99a8a93dd16044ab41814b215d12eb1e557966a73a3754bbff2b9acd752b45b385edd88ba3c7 SHA512 3701820e539545771d0f867fe0b8977cb5967e7501413f717fed08d2d2c141f17d86ed7238177b4fb4cf4cfc01c6c9d07e3c218c34b48e0a5a1f2b2ce8a5b903 EBUILD passt-2023.12.04.ebuild 707 BLAKE2B fe3b6c4c697e725c51b3cefec18e7501055c3abb0d2cb74d8b5983a73a6803ff2a5fafa2502b54725e4225072a5fa2dc6e0043524c89c6019d5380df79314aeb SHA512 0845a4d1dda79af28f08b2735297cd8fc515460df24fa9cf8d5d8653ffa3c20379e3ab5167b895fcd35b7f2068531aebe7c2e51fe9b86a65aa526f9a2cbf3306 EBUILD passt-2023.12.30.ebuild 714 BLAKE2B afabcac34eb836f21812deeb1946d657a9bb7ed3e87868a2d50641ca8a21f43f869397f6ffe8736f66f96bf890f19f3c59f8f4c43956abfc9a0f8d17fa278b17 SHA512 e75a6066c5d13053047843c2bb0be917941d97305a53138e68dd6b5f758be01a623ca66c4d7dee37e14fc8fab212248d131cc1ccec049a506bc4ca0f679f2ec7 -EBUILD passt-2024.03.20.ebuild 835 BLAKE2B 9ebedc9984187b66967d1061ee9d0017763e7dc873f705705da3baaf35859c173caf5aa88216d208de37fa17697945828e930a82c2cd3411d7ad27820489f521 SHA512 47c610d1df6e94f658265c5c20a31d0b2c0b8df8b6a2229cb9e00910c87c372410ddd36c0a9da584c8b2dc4d6984bac468951d9cd04609d6c7763e19e582cd3c +EBUILD passt-2024.03.20.ebuild 842 BLAKE2B bdfd388a62cee3b064e5bdfd3f3960ff19fd505365469b3e5cc0d0148139b8dfb02020af67fda5be6e313faf1294a96ad6df106b8bf8b2fa01ee234285179bf7 SHA512 0c3f1480d9a325fba24471cd97a0030047d9f78261e93fc33429d6a56cb593f27828de96ddf5fd3cce547f0cfb95d5af8d5eae5331f9b29d9b565ac38ce94b27 EBUILD passt-9999.ebuild 835 BLAKE2B 9ebedc9984187b66967d1061ee9d0017763e7dc873f705705da3baaf35859c173caf5aa88216d208de37fa17697945828e930a82c2cd3411d7ad27820489f521 SHA512 47c610d1df6e94f658265c5c20a31d0b2c0b8df8b6a2229cb9e00910c87c372410ddd36c0a9da584c8b2dc4d6984bac468951d9cd04609d6c7763e19e582cd3c MISC metadata.xml 1299 BLAKE2B 8ec4a845b7f02959ec065e10e9603cc3ae91195b72dc3f759cfd16f7588b833596efcade19a11c464b2d534e9c57b6051236b8f54c19a9fc794d7dfb97e4fe69 SHA512 8a0eb2aa96b1e543898e1171f469cbed4188eae71f4bff63b864713b2ce08a2fbab6e9bce05d26d398942865c9f10ec4199504021297a7eeb43bb61f676c1dcd diff --git a/net-misc/passt/passt-2024.03.20.ebuild b/net-misc/passt/passt-2024.03.20.ebuild index 267622576406..ed54ff64b6be 100644 --- a/net-misc/passt/passt-2024.03.20.ebuild +++ b/net-misc/passt/passt-2024.03.20.ebuild @@ -16,7 +16,7 @@ if [[ ${PV} == 9999* ]]; then else SRC_URI="https://passt.top/passt/snapshot/passt-${RELEASE_COMMIT}.tar.xz -> ${P}.tar.xz" S="${WORKDIR}/${PN}-${RELEASE_COMMIT}" - KEYWORDS="~amd64 ~riscv" + KEYWORDS="~amd64 ~arm64 ~riscv" fi LICENSE="BSD GPL-2+" -- cgit v1.2.3