aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAnthony G. Basile <blueness@gentoo.org>2018-06-28 16:08:07 -0400
committerAnthony G. Basile <blueness@gentoo.org>2018-06-28 16:08:07 -0400
commit60461ca1385809bacf6a114a7f1ecfe22f6da47f (patch)
treea4868c4fa94263576f17611be13e0061336ab343 /net-misc
parentnet-misc/openssh: fix typo (diff)
downloadmusl-60461ca1385809bacf6a114a7f1ecfe22f6da47f.tar.gz
musl-60461ca1385809bacf6a114a7f1ecfe22f6da47f.tar.bz2
musl-60461ca1385809bacf6a114a7f1ecfe22f6da47f.zip
net-misc/openssh: fix is now in the tree
Diffstat (limited to 'net-misc')
-rw-r--r--net-misc/openssh/Manifest5
-rw-r--r--net-misc/openssh/files/openssh-6.7_p1-openssl-ignore-status.patch17
-rw-r--r--net-misc/openssh/files/openssh-7.5_p1-disable-conch-interop-tests.patch20
-rw-r--r--net-misc/openssh/files/openssh-7.7_p1-GSSAPI-dns.patch351
-rw-r--r--net-misc/openssh/files/sshd-r1.confd33
-rw-r--r--net-misc/openssh/files/sshd.pam_include.24
-rw-r--r--net-misc/openssh/files/sshd.rc6.589
-rw-r--r--net-misc/openssh/files/sshd.service11
-rw-r--r--net-misc/openssh/files/sshd.socket10
-rw-r--r--net-misc/openssh/files/sshd_at.service8
-rw-r--r--net-misc/openssh/metadata.xml39
-rw-r--r--net-misc/openssh/openssh-7.7_p1-r5.ebuild437
-rw-r--r--net-misc/openssh/openssh-7.7_p1-r6.ebuild460
13 files changed, 0 insertions, 1484 deletions
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
deleted file mode 100644
index e720a87..0000000
--- a/net-misc/openssh/Manifest
+++ /dev/null
@@ -1,5 +0,0 @@
-DIST openssh-7.7p1-hpnssh14v15-gentoo2.patch.xz 22060 BLAKE2B 9ee654f689d4b90bd0fe4f71d57b4a8d9d957012be3a23ff2baa6c45ae99e2f1e4daf5de24479a6a3eb761ee6847deb3c6c3021d4cbabc9089f605d8d7270efc SHA512 856d28ac89c14d01c40c7d7e93cfaebd74b091188b5b469550eb62aa5445177aec1a5f47c1e2f7173013712e98e5f9f5e46bbb3dbd4ec7c5ee8256ef45cda0f8
-DIST openssh-7.7p1-patches-1.1.tar.xz 16476 BLAKE2B fca2885a9e29faec40700ece37a995ba83e40bd2a6875129a5327770d8ee43663a7c063de33b4653994ed7332adb03730f613c047550d874190b95c66e2e9efa SHA512 aa5e33ce4bb4be16abf27ac1bade1dc85c51d82002be546402e0b8b0685de3ec7029f0f56bf1295ec346eb3960a6bed7cfc882722e57957a19a732f3174b3039
-DIST openssh-7.7p1-sctp-1.1.patch.xz 7548 BLAKE2B 3b960c2377351955007005de560c2a3e8d0d059a0435e5beda14c63e444dad8b4357edaccd1cfe446c6268514f152b2bcfa7fa3612f1ae1324a31fecb0e85ac5 SHA512 093605865262a2b972db8c92990a49ed6178ed4567fb2626518c826c8472553d9be99a9e6052a6f5e545d81867b4118e9fd8a2c0c26a2739f1720b0f13282cba
-DIST openssh-7.7p1-x509-11.3.1.patch.xz 362672 BLAKE2B 55b8b0ef00dc4d962a0db1115406b7b1e84110870c74198e9e4cb081b2ffde8daca67cb281c69d73b4c5cbffde361429d62634be194b57e888a0b434a0f42a37 SHA512 f84744f6d2e5a15017bce37bfa65ebb47dbafeac07ea9aab46bdc780b4062ff70687512d9d512cab81e3b9c701adb6ce17c5474f35cb4b49f57db2e2d45ac9ac
-DIST openssh-7.7p1.tar.gz 1536900 BLAKE2B 7aee360f2cea5bfa3f8426fcbd66fde2568f05f9c8e623326b60f03b7c5f8abf223e178aa1d5958015b51627565bf5b1ace35b57f309638c908f5a7bf5500d21 SHA512 597252cb48209a0cb98ca1928a67e8d63e4275252f25bc37269204c108f034baade6ba0634e32ae63422fddd280f73096a6b31ad2f2e7a848dde75ca30e14261
diff --git a/net-misc/openssh/files/openssh-6.7_p1-openssl-ignore-status.patch b/net-misc/openssh/files/openssh-6.7_p1-openssl-ignore-status.patch
deleted file mode 100644
index fa33af3..0000000
--- a/net-misc/openssh/files/openssh-6.7_p1-openssl-ignore-status.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-the last nibble of the openssl version represents the status. that is,
-whether it is a beta or release. when it comes to version checks in
-openssh, this component does not matter, so ignore it.
-
-https://bugzilla.mindrot.org/show_bug.cgi?id=2212
-
---- a/openbsd-compat/openssl-compat.c
-+++ b/openbsd-compat/openssl-compat.c
-@@ -58,7 +58,7 @@ ssh_compatible_openssl(long headerver, long libver)
- * For versions >= 1.0.0, major,minor,status must match and library
- * fix version must be equal to or newer than the header.
- */
-- mask = 0xfff0000fL; /* major,minor,status */
-+ mask = 0xfff00000L; /* major,minor,status */
- hfix = (headerver & 0x000ff000) >> 12;
- lfix = (libver & 0x000ff000) >> 12;
- if ( (headerver & mask) == (libver & mask) && lfix >= hfix)
diff --git a/net-misc/openssh/files/openssh-7.5_p1-disable-conch-interop-tests.patch b/net-misc/openssh/files/openssh-7.5_p1-disable-conch-interop-tests.patch
deleted file mode 100644
index a5647ce..0000000
--- a/net-misc/openssh/files/openssh-7.5_p1-disable-conch-interop-tests.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-Disable conch interop tests which are failing when called
-via portage for yet unknown reason and because using conch
-seems to be flaky (test is failing when using Python2 but
-passing when using Python3).
-
-Bug: https://bugs.gentoo.org/605446
-
---- a/regress/conch-ciphers.sh
-+++ b/regress/conch-ciphers.sh
-@@ -3,6 +3,10 @@
-
- tid="conch ciphers"
-
-+# https://bugs.gentoo.org/605446
-+echo "conch interop tests skipped due to Gentoo bug #605446"
-+exit 0
-+
- if test "x$REGRESS_INTEROP_CONCH" != "xyes" ; then
- echo "conch interop tests not enabled"
- exit 0
diff --git a/net-misc/openssh/files/openssh-7.7_p1-GSSAPI-dns.patch b/net-misc/openssh/files/openssh-7.7_p1-GSSAPI-dns.patch
deleted file mode 100644
index 2840652..0000000
--- a/net-misc/openssh/files/openssh-7.7_p1-GSSAPI-dns.patch
+++ /dev/null
@@ -1,351 +0,0 @@
-https://bugs.gentoo.org/165444
-https://bugzilla.mindrot.org/show_bug.cgi?id=1008
-
---- a/auth.c
-+++ b/auth.c
-@@ -728,120 +728,6 @@ fakepw(void)
- return (&fake);
- }
-
--/*
-- * Returns the remote DNS hostname as a string. The returned string must not
-- * be freed. NB. this will usually trigger a DNS query the first time it is
-- * called.
-- * This function does additional checks on the hostname to mitigate some
-- * attacks on legacy rhosts-style authentication.
-- * XXX is RhostsRSAAuthentication vulnerable to these?
-- * XXX Can we remove these checks? (or if not, remove RhostsRSAAuthentication?)
-- */
--
--static char *
--remote_hostname(struct ssh *ssh)
--{
-- struct sockaddr_storage from;
-- socklen_t fromlen;
-- struct addrinfo hints, *ai, *aitop;
-- char name[NI_MAXHOST], ntop2[NI_MAXHOST];
-- const char *ntop = ssh_remote_ipaddr(ssh);
--
-- /* Get IP address of client. */
-- fromlen = sizeof(from);
-- memset(&from, 0, sizeof(from));
-- if (getpeername(ssh_packet_get_connection_in(ssh),
-- (struct sockaddr *)&from, &fromlen) < 0) {
-- debug("getpeername failed: %.100s", strerror(errno));
-- return strdup(ntop);
-- }
--
-- ipv64_normalise_mapped(&from, &fromlen);
-- if (from.ss_family == AF_INET6)
-- fromlen = sizeof(struct sockaddr_in6);
--
-- debug3("Trying to reverse map address %.100s.", ntop);
-- /* Map the IP address to a host name. */
-- if (getnameinfo((struct sockaddr *)&from, fromlen, name, sizeof(name),
-- NULL, 0, NI_NAMEREQD) != 0) {
-- /* Host name not found. Use ip address. */
-- return strdup(ntop);
-- }
--
-- /*
-- * if reverse lookup result looks like a numeric hostname,
-- * someone is trying to trick us by PTR record like following:
-- * 1.1.1.10.in-addr.arpa. IN PTR 2.3.4.5
-- */
-- memset(&hints, 0, sizeof(hints));
-- hints.ai_socktype = SOCK_DGRAM; /*dummy*/
-- hints.ai_flags = AI_NUMERICHOST;
-- if (getaddrinfo(name, NULL, &hints, &ai) == 0) {
-- logit("Nasty PTR record \"%s\" is set up for %s, ignoring",
-- name, ntop);
-- freeaddrinfo(ai);
-- return strdup(ntop);
-- }
--
-- /* Names are stored in lowercase. */
-- lowercase(name);
--
-- /*
-- * Map it back to an IP address and check that the given
-- * address actually is an address of this host. This is
-- * necessary because anyone with access to a name server can
-- * define arbitrary names for an IP address. Mapping from
-- * name to IP address can be trusted better (but can still be
-- * fooled if the intruder has access to the name server of
-- * the domain).
-- */
-- memset(&hints, 0, sizeof(hints));
-- hints.ai_family = from.ss_family;
-- hints.ai_socktype = SOCK_STREAM;
-- if (getaddrinfo(name, NULL, &hints, &aitop) != 0) {
-- logit("reverse mapping checking getaddrinfo for %.700s "
-- "[%s] failed.", name, ntop);
-- return strdup(ntop);
-- }
-- /* Look for the address from the list of addresses. */
-- for (ai = aitop; ai; ai = ai->ai_next) {
-- if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop2,
-- sizeof(ntop2), NULL, 0, NI_NUMERICHOST) == 0 &&
-- (strcmp(ntop, ntop2) == 0))
-- break;
-- }
-- freeaddrinfo(aitop);
-- /* If we reached the end of the list, the address was not there. */
-- if (ai == NULL) {
-- /* Address not found for the host name. */
-- logit("Address %.100s maps to %.600s, but this does not "
-- "map back to the address.", ntop, name);
-- return strdup(ntop);
-- }
-- return strdup(name);
--}
--
--/*
-- * Return the canonical name of the host in the other side of the current
-- * connection. The host name is cached, so it is efficient to call this
-- * several times.
-- */
--
--const char *
--auth_get_canonical_hostname(struct ssh *ssh, int use_dns)
--{
-- static char *dnsname;
--
-- if (!use_dns)
-- return ssh_remote_ipaddr(ssh);
-- else if (dnsname != NULL)
-- return dnsname;
-- else {
-- dnsname = remote_hostname(ssh);
-- return dnsname;
-- }
--}
--
- /*
- * Runs command in a subprocess wuth a minimal environment.
- * Returns pid on success, 0 on failure.
---- a/canohost.c
-+++ b/canohost.c
-@@ -202,3 +202,117 @@ get_local_port(int sock)
- {
- return get_sock_port(sock, 1);
- }
-+
-+/*
-+ * Returns the remote DNS hostname as a string. The returned string must not
-+ * be freed. NB. this will usually trigger a DNS query the first time it is
-+ * called.
-+ * This function does additional checks on the hostname to mitigate some
-+ * attacks on legacy rhosts-style authentication.
-+ * XXX is RhostsRSAAuthentication vulnerable to these?
-+ * XXX Can we remove these checks? (or if not, remove RhostsRSAAuthentication?)
-+ */
-+
-+static char *
-+remote_hostname(struct ssh *ssh)
-+{
-+ struct sockaddr_storage from;
-+ socklen_t fromlen;
-+ struct addrinfo hints, *ai, *aitop;
-+ char name[NI_MAXHOST], ntop2[NI_MAXHOST];
-+ const char *ntop = ssh_remote_ipaddr(ssh);
-+
-+ /* Get IP address of client. */
-+ fromlen = sizeof(from);
-+ memset(&from, 0, sizeof(from));
-+ if (getpeername(ssh_packet_get_connection_in(ssh),
-+ (struct sockaddr *)&from, &fromlen) < 0) {
-+ debug("getpeername failed: %.100s", strerror(errno));
-+ return strdup(ntop);
-+ }
-+
-+ ipv64_normalise_mapped(&from, &fromlen);
-+ if (from.ss_family == AF_INET6)
-+ fromlen = sizeof(struct sockaddr_in6);
-+
-+ debug3("Trying to reverse map address %.100s.", ntop);
-+ /* Map the IP address to a host name. */
-+ if (getnameinfo((struct sockaddr *)&from, fromlen, name, sizeof(name),
-+ NULL, 0, NI_NAMEREQD) != 0) {
-+ /* Host name not found. Use ip address. */
-+ return strdup(ntop);
-+ }
-+
-+ /*
-+ * if reverse lookup result looks like a numeric hostname,
-+ * someone is trying to trick us by PTR record like following:
-+ * 1.1.1.10.in-addr.arpa. IN PTR 2.3.4.5
-+ */
-+ memset(&hints, 0, sizeof(hints));
-+ hints.ai_socktype = SOCK_DGRAM; /*dummy*/
-+ hints.ai_flags = AI_NUMERICHOST;
-+ if (getaddrinfo(name, NULL, &hints, &ai) == 0) {
-+ logit("Nasty PTR record \"%s\" is set up for %s, ignoring",
-+ name, ntop);
-+ freeaddrinfo(ai);
-+ return strdup(ntop);
-+ }
-+
-+ /* Names are stored in lowercase. */
-+ lowercase(name);
-+
-+ /*
-+ * Map it back to an IP address and check that the given
-+ * address actually is an address of this host. This is
-+ * necessary because anyone with access to a name server can
-+ * define arbitrary names for an IP address. Mapping from
-+ * name to IP address can be trusted better (but can still be
-+ * fooled if the intruder has access to the name server of
-+ * the domain).
-+ */
-+ memset(&hints, 0, sizeof(hints));
-+ hints.ai_family = from.ss_family;
-+ hints.ai_socktype = SOCK_STREAM;
-+ if (getaddrinfo(name, NULL, &hints, &aitop) != 0) {
-+ logit("reverse mapping checking getaddrinfo for %.700s "
-+ "[%s] failed.", name, ntop);
-+ return strdup(ntop);
-+ }
-+ /* Look for the address from the list of addresses. */
-+ for (ai = aitop; ai; ai = ai->ai_next) {
-+ if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop2,
-+ sizeof(ntop2), NULL, 0, NI_NUMERICHOST) == 0 &&
-+ (strcmp(ntop, ntop2) == 0))
-+ break;
-+ }
-+ freeaddrinfo(aitop);
-+ /* If we reached the end of the list, the address was not there. */
-+ if (ai == NULL) {
-+ /* Address not found for the host name. */
-+ logit("Address %.100s maps to %.600s, but this does not "
-+ "map back to the address.", ntop, name);
-+ return strdup(ntop);
-+ }
-+ return strdup(name);
-+}
-+
-+/*
-+ * Return the canonical name of the host in the other side of the current
-+ * connection. The host name is cached, so it is efficient to call this
-+ * several times.
-+ */
-+
-+const char *
-+auth_get_canonical_hostname(struct ssh *ssh, int use_dns)
-+{
-+ static char *dnsname;
-+
-+ if (!use_dns)
-+ return ssh_remote_ipaddr(ssh);
-+ else if (dnsname != NULL)
-+ return dnsname;
-+ else {
-+ dnsname = remote_hostname(ssh);
-+ return dnsname;
-+ }
-+}
---- a/readconf.c
-+++ b/readconf.c
-@@ -160,6 +160,7 @@ typedef enum {
- oClearAllForwardings, oNoHostAuthenticationForLocalhost,
- oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
- oAddressFamily, oGssAuthentication, oGssDelegateCreds,
-+ oGssTrustDns,
- oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
- oSendEnv, oControlPath, oControlMaster, oControlPersist,
- oHashKnownHosts,
-@@ -200,9 +201,11 @@ static struct {
- #if defined(GSSAPI)
- { "gssapiauthentication", oGssAuthentication },
- { "gssapidelegatecredentials", oGssDelegateCreds },
-+ { "gssapitrustdns", oGssTrustDns },
- # else
- { "gssapiauthentication", oUnsupported },
- { "gssapidelegatecredentials", oUnsupported },
-+ { "gssapitrustdns", oUnsupported },
- #endif
- #ifdef ENABLE_PKCS11
- { "smartcarddevice", oPKCS11Provider },
-@@ -954,6 +957,10 @@ parse_time:
- intptr = &options->gss_deleg_creds;
- goto parse_flag;
-
-+ case oGssTrustDns:
-+ intptr = &options->gss_trust_dns;
-+ goto parse_flag;
-+
- case oBatchMode:
- intptr = &options->batch_mode;
- goto parse_flag;
-@@ -1766,6 +1773,7 @@ initialize_options(Options * options)
- options->challenge_response_authentication = -1;
- options->gss_authentication = -1;
- options->gss_deleg_creds = -1;
-+ options->gss_trust_dns = -1;
- options->password_authentication = -1;
- options->kbd_interactive_authentication = -1;
- options->kbd_interactive_devices = NULL;
-@@ -1908,6 +1916,8 @@ fill_default_options(Options * options)
- options->gss_authentication = 0;
- if (options->gss_deleg_creds == -1)
- options->gss_deleg_creds = 0;
-+ if (options->gss_trust_dns == -1)
-+ options->gss_trust_dns = 0;
- if (options->password_authentication == -1)
- options->password_authentication = 1;
- if (options->kbd_interactive_authentication == -1)
---- a/readconf.h
-+++ b/readconf.h
-@@ -43,6 +43,7 @@ typedef struct {
- /* Try S/Key or TIS, authentication. */
- int gss_authentication; /* Try GSS authentication */
- int gss_deleg_creds; /* Delegate GSS credentials */
-+ int gss_trust_dns; /* Trust DNS for GSS canonicalization */
- int password_authentication; /* Try password
- * authentication. */
- int kbd_interactive_authentication; /* Try keyboard-interactive auth. */
---- a/ssh_config.5
-+++ b/ssh_config.5
-@@ -731,6 +731,16 @@ The default is
- Forward (delegate) credentials to the server.
- The default is
- .Cm no .
-+Note that this option applies to protocol version 2 connections using GSSAPI.
-+.It Cm GSSAPITrustDns
-+Set to
-+.Dq yes to indicate that the DNS is trusted to securely canonicalize
-+the name of the host being connected to. If
-+.Dq no, the hostname entered on the
-+command line will be passed untouched to the GSSAPI library.
-+The default is
-+.Dq no .
-+This option only applies to protocol version 2 connections using GSSAPI.
- .It Cm HashKnownHosts
- Indicates that
- .Xr ssh 1
---- a/sshconnect2.c
-+++ b/sshconnect2.c
-@@ -643,6 +643,13 @@ userauth_gssapi(Authctxt *authctxt)
- static u_int mech = 0;
- OM_uint32 min;
- int ok = 0;
-+ const char *gss_host;
-+
-+ if (options.gss_trust_dns) {
-+ extern const char *auth_get_canonical_hostname(struct ssh *ssh, int use_dns);
-+ gss_host = auth_get_canonical_hostname(active_state, 1);
-+ } else
-+ gss_host = authctxt->host;
-
- /* Try one GSSAPI method at a time, rather than sending them all at
- * once. */
-@@ -655,7 +662,7 @@ userauth_gssapi(Authctxt *authctxt)
- /* My DER encoding requires length<128 */
- if (gss_supported->elements[mech].length < 128 &&
- ssh_gssapi_check_mechanism(&gssctxt,
-- &gss_supported->elements[mech], authctxt->host)) {
-+ &gss_supported->elements[mech], gss_host)) {
- ok = 1; /* Mechanism works */
- } else {
- mech++;
---
diff --git a/net-misc/openssh/files/sshd-r1.confd b/net-misc/openssh/files/sshd-r1.confd
deleted file mode 100644
index cf43037..0000000
--- a/net-misc/openssh/files/sshd-r1.confd
+++ /dev/null
@@ -1,33 +0,0 @@
-# /etc/conf.d/sshd: config file for /etc/init.d/sshd
-
-# Where is your sshd_config file stored?
-
-SSHD_CONFDIR="${RC_PREFIX%/}/etc/ssh"
-
-
-# Any random options you want to pass to sshd.
-# See the sshd(8) manpage for more info.
-
-SSHD_OPTS=""
-
-
-# Wait one second (length chosen arbitrarily) to see if sshd actually
-# creates a PID file, or if it crashes for some reason like not being
-# able to bind to the address in ListenAddress.
-
-#SSHD_SSD_OPTS="--wait 1000"
-
-
-# Pid file to use (needs to be absolute path).
-
-#SSHD_PIDFILE="${RC_PREFIX%/}/run/sshd.pid"
-
-
-# Path to the sshd binary (needs to be absolute path).
-
-#SSHD_BINARY="${RC_PREFIX%/}/usr/sbin/sshd"
-
-
-# Path to the ssh-keygen binary (needs to be absolute path).
-
-#SSHD_KEYGEN_BINARY="${RC_PREFIX%/}/usr/bin/ssh-keygen"
diff --git a/net-misc/openssh/files/sshd.pam_include.2 b/net-misc/openssh/files/sshd.pam_include.2
deleted file mode 100644
index b801aaa..0000000
--- a/net-misc/openssh/files/sshd.pam_include.2
+++ /dev/null
@@ -1,4 +0,0 @@
-auth include system-remote-login
-account include system-remote-login
-password include system-remote-login
-session include system-remote-login
diff --git a/net-misc/openssh/files/sshd.rc6.5 b/net-misc/openssh/files/sshd.rc6.5
deleted file mode 100644
index 044cbe7..0000000
--- a/net-misc/openssh/files/sshd.rc6.5
+++ /dev/null
@@ -1,89 +0,0 @@
-#!/sbin/openrc-run
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-extra_commands="checkconfig"
-extra_started_commands="reload"
-
-: ${SSHD_CONFDIR:=${RC_PREFIX%/}/etc/ssh}
-: ${SSHD_CONFIG:=${SSHD_CONFDIR}/sshd_config}
-: ${SSHD_PIDFILE:=${RC_PREFIX%/}/run/${SVCNAME}.pid}
-: ${SSHD_BINARY:=${RC_PREFIX%/}/usr/sbin/sshd}
-: ${SSHD_KEYGEN_BINARY:=${RC_PREFIX%/}/usr/bin/ssh-keygen}
-
-command="${SSHD_BINARY}"
-pidfile="${SSHD_PIDFILE}"
-command_args="${SSHD_OPTS} -o PidFile=${pidfile} -f ${SSHD_CONFIG}"
-
-# Wait one second (length chosen arbitrarily) to see if sshd actually
-# creates a PID file, or if it crashes for some reason like not being
-# able to bind to the address in ListenAddress (bug 617596).
-: ${SSHD_SSD_OPTS:=--wait 1000}
-start_stop_daemon_args="${SSHD_SSD_OPTS}"
-
-depend() {
- # Entropy can be used by ssh-keygen, among other things, but
- # is not strictly required (bug 470020).
- use logger dns entropy
- if [ "${rc_need+set}" = "set" ] ; then
- : # Do nothing, the user has explicitly set rc_need
- else
- local x warn_addr
- for x in $(awk '/^ListenAddress/{ print $2 }' "$SSHD_CONFIG" 2>/dev/null) ; do
- case "${x}" in
- 0.0.0.0|0.0.0.0:*) ;;
- ::|\[::\]*) ;;
- *) warn_addr="${warn_addr} ${x}" ;;
- esac
- done
- if [ -n "${warn_addr}" ] ; then
- need net
- ewarn "You are binding an interface in ListenAddress statement in your sshd_config!"
- ewarn "You must add rc_need=\"net.FOO\" to your ${RC_PREFIX%/}/etc/conf.d/sshd"
- ewarn "where FOO is the interface(s) providing the following address(es):"
- ewarn "${warn_addr}"
- fi
- fi
-}
-
-checkconfig() {
- checkpath --directory "${RC_PREFIX%/}/var/empty"
-
- if [ ! -e "${SSHD_CONFIG}" ] ; then
- eerror "You need an ${SSHD_CONFIG} file to run sshd"
- eerror "There is a sample file in /usr/share/doc/openssh"
- return 1
- fi
-
- ${SSHD_KEYGEN_BINARY} -A || return 2
-
- "${command}" -t ${command_args} || return 3
-}
-
-start_pre() {
- # If this isn't a restart, make sure that the user's config isn't
- # busted before we try to start the daemon (this will produce
- # better error messages than if we just try to start it blindly).
- #
- # If, on the other hand, this *is* a restart, then the stop_pre
- # action will have ensured that the config is usable and we don't
- # need to do that again.
- if [ "${RC_CMD}" != "restart" ] ; then
- checkconfig || return $?
- fi
-}
-
-stop_pre() {
- # If this is a restart, check to make sure the user's config
- # isn't busted before we stop the running daemon.
- if [ "${RC_CMD}" = "restart" ] ; then
- checkconfig || return $?
- fi
-}
-
-reload() {
- checkconfig || return $?
- ebegin "Reloading ${SVCNAME}"
- start-stop-daemon --signal HUP --pidfile "${pidfile}"
- eend $?
-}
diff --git a/net-misc/openssh/files/sshd.service b/net-misc/openssh/files/sshd.service
deleted file mode 100644
index b5e96b3..0000000
--- a/net-misc/openssh/files/sshd.service
+++ /dev/null
@@ -1,11 +0,0 @@
-[Unit]
-Description=OpenSSH server daemon
-After=syslog.target network.target auditd.service
-
-[Service]
-ExecStartPre=/usr/bin/ssh-keygen -A
-ExecStart=/usr/sbin/sshd -D -e
-ExecReload=/bin/kill -HUP $MAINPID
-
-[Install]
-WantedBy=multi-user.target
diff --git a/net-misc/openssh/files/sshd.socket b/net-misc/openssh/files/sshd.socket
deleted file mode 100644
index 94b9533..0000000
--- a/net-misc/openssh/files/sshd.socket
+++ /dev/null
@@ -1,10 +0,0 @@
-[Unit]
-Description=OpenSSH Server Socket
-Conflicts=sshd.service
-
-[Socket]
-ListenStream=22
-Accept=yes
-
-[Install]
-WantedBy=sockets.target
diff --git a/net-misc/openssh/files/sshd_at.service b/net-misc/openssh/files/sshd_at.service
deleted file mode 100644
index 2645ad0..0000000
--- a/net-misc/openssh/files/sshd_at.service
+++ /dev/null
@@ -1,8 +0,0 @@
-[Unit]
-Description=OpenSSH per-connection server daemon
-After=syslog.target auditd.service
-
-[Service]
-ExecStart=-/usr/sbin/sshd -i -e
-StandardInput=socket
-StandardError=syslog
diff --git a/net-misc/openssh/metadata.xml b/net-misc/openssh/metadata.xml
deleted file mode 100644
index 03b12f0..0000000
--- a/net-misc/openssh/metadata.xml
+++ /dev/null
@@ -1,39 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
-<pkgmetadata>
- <maintainer type="project">
- <email>base-system@gentoo.org</email>
- <name>Gentoo Base System</name>
- </maintainer>
- <maintainer type="person">
- <email>robbat2@gentoo.org</email>
- <description>LPK issues. Only assign if it's a direct LPK issue. Do not directly assign for anything else.</description>
- </maintainer>
- <longdescription>
-OpenSSH is a FREE version of the SSH protocol suite of network connectivity tools that
-increasing numbers of people on the Internet are coming to rely on. Many users of telnet,
-rlogin, ftp, and other such programs might not realize that their password is transmitted
-across the Internet unencrypted, but it is. OpenSSH encrypts all traffic (including passwords)
-to effectively eliminate eavesdropping, connection hijacking, and other network-level attacks.
-Additionally, OpenSSH provides a myriad of secure tunneling capabilities, as well as a variety
-of authentication methods.
-
-The OpenSSH suite includes the ssh program which replaces rlogin and telnet, scp which
-replaces rcp, and sftp which replaces ftp. Also included is sshd which is the server side of
-the package, and the other basic utilities like ssh-add, ssh-agent, ssh-keysign, ssh-keyscan,
-ssh-keygen and sftp-server. OpenSSH supports SSH protocol versions 1.3, 1.5, and 2.0.
-</longdescription>
- <use>
- <flag name="bindist">Disable EC/RC5 algorithms in OpenSSL for patent reasons.</flag>
- <flag name="hpn">Enable high performance ssh</flag>
- <flag name="ldap">Add support for storing SSH public keys in LDAP</flag>
- <flag name="ldns">Use LDNS for DNSSEC/SSHFP validation.</flag>
- <flag name="livecd">Enable root password logins for live-cd environment.</flag>
- <flag name="ssl">Enable additional crypto algorithms via OpenSSL</flag>
- <flag name="X509">Adds support for X.509 certificate authentication</flag>
- </use>
- <upstream>
- <remote-id type="cpe">cpe:/a:openssh:openssh</remote-id>
- <remote-id type="sourceforge">hpnssh</remote-id>
- </upstream>
-</pkgmetadata>
diff --git a/net-misc/openssh/openssh-7.7_p1-r5.ebuild b/net-misc/openssh/openssh-7.7_p1-r5.ebuild
deleted file mode 100644
index 2425ed8..0000000
--- a/net-misc/openssh/openssh-7.7_p1-r5.ebuild
+++ /dev/null
@@ -1,437 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit user flag-o-matic multilib autotools pam systemd versionator
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-HPN_VER="14v15-gentoo2" HPN_PATCH="${PARCH}-hpnssh${HPN_VER}.patch.xz"
-SCTP_VER="1.1" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
-X509_VER="11.3.1" X509_PATCH="${PARCH}-x509-${X509_VER}.patch.xz"
-
-# Disable LDAP support until someone will rewrite the patch,
-# upstream removed auth_parse_options() via commit 7c856857607112a3dfe6414696bf4c7ab7fb0cb3
-#LDAP_VER="0.3.14" LDAP_PATCH="${PN}-lpk-7.7p1-${LDAP_VER}.patch.xz"
-
-PATCH_SET="openssh-7.7p1-patches-1.1"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- https://dev.gentoo.org/~whissi/dist/${PN}/${PATCH_SET}.tar.xz
- ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~whissi/dist/openssh/${SCTP_PATCH} )}
- ${HPN_PATCH:+hpn? ( https://dev.gentoo.org/~whissi/dist/openssh/${HPN_PATCH} )}
- ${LDAP_PATCH:+ldap? ( https://dev.gentoo.org/~whissi/dist/openssh/${LDAP_PATCH} )}
- ${X509_PATCH:+X509? ( https://dev.gentoo.org/~whissi/dist/openssh/${X509_PATCH} )}
- "
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="amd64 arm ~mips ppc x86"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
-REQUIRED_USE="ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- X509? ( !ldap !sctp ssl )
- test? ( ssl )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
- bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
- ssl? (
- !libressl? (
- >=dev-libs/openssl-1.0.1:0=[bindist=]
- dev-libs/openssl:0=[static-libs(+)]
- )
- libressl? ( dev-libs/libressl:0=[static-libs(+)] )
- )
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
-RDEPEND="
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( virtual/pam )
- kerberos? ( virtual/krb5 )
- ldap? ( net-nds/openldap )"
-DEPEND="${RDEPEND}
- static? ( ${LIB_DEPEND} )
- virtual/pkgconfig
- virtual/os-headers
- sys-devel/autoconf"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
- X? ( x11-apps/xauth )"
-
-S="${WORKDIR}/${PARCH}"
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use hpn && maybe_fail hpn HPN_PATCH)
- $(use ldap && maybe_fail ldap LDAP_PATCH)
- $(use sctp && maybe_fail sctp SCTP_PATCH)
- $(use X509 && maybe_fail X509 X509_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT%/}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
- fi
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX%/}/usr/bin/xauth:" \
- pathnames.h || die
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- eapply "${FILESDIR}"/${PN}-7.7_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
-
- local PATCHSET_VERSION_MACROS=()
-
- if use X509 ; then
- eapply "${WORKDIR}"/${X509_PATCH%.*}
-
- # We need to patch package version or any X.509 sshd will reject our ssh client
- # with "userauth_pubkey: could not parse key: string is too large [preauth]"
- # error
- einfo "Patching package version for X.509 patch set ..."
- sed -i \
- -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
- "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
-
- einfo "Patching version.h to expose X.509 patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in X.509 patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
-
- einfo "Disabling broken X.509 agent test ..."
- sed -i \
- -e "/^ agent$/d" \
- "${S}"/tests/CA/config || die "Failed to disable broken X.509 agent test"
-
- # The following patches don't apply on top of X509 patch
- rm "${WORKDIR}"/patch/2002_all_openssh-7.7p1_upstream_bug2840.patch || die
- rm "${WORKDIR}"/patch/2009_all_openssh-7.7p1_make-shell-tests-portable.patch || die
- rm "${WORKDIR}"/patch/2016_all_openssh-7.7p1_implement-EMFILE-mitigation-for-ssh-agent.patch || die
- rm "${WORKDIR}"/patch/2025_all_openssh-7.7p1_prefer-argv0-to-ssh-when-re-executing-ssh-for-proxyjump.patch || die
- else
- rm "${WORKDIR}"/patch/2016_all_openssh-7.7p1-X509_implement-EMFILE-mitigation-for-ssh-agent.patch || die
- rm "${WORKDIR}"/patch/2025_all_openssh-7.7p1-X509_prefer-argv0-to-ssh-when-re-executing-ssh-for-proxyjump.patch || die
- fi
-
- if use ldap ; then
- eapply "${WORKDIR}"/${LDAP_PATCH%.*}
-
- einfo "Patching version.h to expose LDAP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_LDAP \"-ldap-${LDAP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in LDAP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_LDAP' )
- fi
-
- if use sctp ; then
- eapply "${WORKDIR}"/${SCTP_PATCH%.*}
-
- einfo "Patching version.h to expose SCTP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in SCTP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
-
- einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
- sed -i \
- -e "/\t\tcfgparse \\\/d" \
- "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
- fi
-
- if use hpn ; then
- eapply "${WORKDIR}"/${HPN_PATCH%.*}
-
- einfo "Patching Makefile.in for HPN patch set ..."
- sed -i \
- -e "/^LIBS=/ s/\$/ -lpthread/" \
- "${S}"/Makefile.in || die "Failed to patch Makefile.in"
-
- einfo "Patching version.h to expose HPN patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in HPN patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
-
- if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- einfo "Disabling known non-working MT AES cipher per default ..."
-
- cat > "${T}"/disable_mtaes.conf <<- EOF
-
- # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
- # and therefore disabled per default.
- DisableMTAES yes
- EOF
- sed -i \
- -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
- "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
-
- sed -i \
- -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
- "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
- fi
- fi
-
- if use X509 || use hpn ; then
- einfo "Patching packet.c for X509 and/or HPN patch set ..."
- sed -i \
- -e "s/const struct sshcipher/struct sshcipher/" \
- "${S}"/packet.c || die "Failed to patch ssh_packet_set_connection() (packet.c)"
- fi
-
- if use X509 || use sctp || use ldap || use hpn ; then
- einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
-
- einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
-
- einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
- sed -i \
- -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
- "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
- fi
-
- sed -i \
- -e "/#UseLogin no/d" \
- "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
-
- eapply "${WORKDIR}"/patch/*.patch
-
- eapply_user #473004
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX%/}"/etc/ssh
- --libexecdir="${EPREFIX%/}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX%/}"/usr/share/openssh
- --with-privsep-path="${EPREFIX%/}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX%/}"/usr)
- # We apply the ldap and sctp patch conditionally, so can't pass --without-{ldap,sctp}
- # unconditionally else we get unknown flag warnings.
- $(use ldap && use_with ldap)
- $(use sctp && use_with sctp)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(use_with skey)
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- )
-
- if [[ $(tc-arch) == x86 ]]; then
- myconf+=( --without-stackprotect)
- fi
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_test() {
- local t skipped=() failed=() passed=()
- local tests=( interop-tests compat-tests )
-
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped+=( tests )
- else
- tests+=( tests )
- fi
-
- # It will also attempt to write to the homedir .ssh.
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in "${tests[@]}" ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" HOME="${sshhome}" \
- emake -k -j1 ${t} </dev/null \
- && passed+=( "${t}" ) \
- || failed+=( "${t}" )
- done
-
- einfo "Passed tests: ${passed[*]}"
- [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
- [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd.rc6.5 sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED%/}"/etc/ssh/sshd_config || die
- fi
-
- # Gentoo tweaks to default config files
- cat <<-EOF >> "${ED%/}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables #367017
- AcceptEnv LANG LC_*
- EOF
- cat <<-EOF >> "${ED%/}"/etc/ssh/ssh_config
-
- # Send locale environment variables #367017
- SendEnv LANG LC_*
- EOF
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED%/}"/etc/ssh/sshd_config || die
- fi
-
- if use ldap && [[ -n ${LDAP_PATCH} ]] ; then
- insinto /etc/openldap/schema/
- newins openssh-lpk_openldap.schema openssh-lpk.schema
- fi
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use hpn && dodoc HPN-README
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- keepdir /var/empty
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-pkg_preinst() {
- enewgroup sshd 22
- enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-
- if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- elog ""
- elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
- elog "and therefore disabled at runtime per default."
- elog "Make sure your sshd_config is up to date and contains"
- elog ""
- elog " DisableMTAES yes"
- elog ""
- elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
- elog ""
- fi
-}
diff --git a/net-misc/openssh/openssh-7.7_p1-r6.ebuild b/net-misc/openssh/openssh-7.7_p1-r6.ebuild
deleted file mode 100644
index 9eeea10..0000000
--- a/net-misc/openssh/openssh-7.7_p1-r6.ebuild
+++ /dev/null
@@ -1,460 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit user flag-o-matic multilib autotools pam systemd versionator
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-HPN_VER="14v15-gentoo2" HPN_PATCH="${PARCH}-hpnssh${HPN_VER}.patch.xz"
-SCTP_VER="1.1" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
-X509_VER="11.3.1" X509_PATCH="${PARCH}-x509-${X509_VER}.patch.xz"
-
-# Disable LDAP support until someone will rewrite the patch,
-# upstream removed auth_parse_options() via commit 7c856857607112a3dfe6414696bf4c7ab7fb0cb3
-#LDAP_VER="0.3.14" LDAP_PATCH="${PN}-lpk-7.7p1-${LDAP_VER}.patch.xz"
-
-PATCH_SET="openssh-7.7p1-patches-1.1"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="https://www.openssh.com/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- https://dev.gentoo.org/~whissi/dist/${PN}/${PATCH_SET}.tar.xz
- ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~whissi/dist/openssh/${SCTP_PATCH} )}
- ${HPN_PATCH:+hpn? ( https://dev.gentoo.org/~whissi/dist/openssh/${HPN_PATCH} )}
- ${LDAP_PATCH:+ldap? ( https://dev.gentoo.org/~whissi/dist/openssh/${LDAP_PATCH} )}
- ${X509_PATCH:+X509? ( https://dev.gentoo.org/~whissi/dist/openssh/${X509_PATCH} )}
- "
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="amd64 arm ~mips ppc x86"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509"
-REQUIRED_USE="ldns? ( ssl )
- pie? ( !static )
- static? ( !kerberos !pam )
- X509? ( !ldap !sctp ssl )
- test? ( ssl )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
- bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
- ssl? (
- !libressl? (
- >=dev-libs/openssl-1.0.1:0=[bindist=]
- dev-libs/openssl:0=[static-libs(+)]
- )
- libressl? ( dev-libs/libressl:0=[static-libs(+)] )
- )
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
-RDEPEND="
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( virtual/pam )
- kerberos? ( virtual/krb5 )
- ldap? ( net-nds/openldap )"
-DEPEND="${RDEPEND}
- static? ( ${LIB_DEPEND} )
- virtual/pkgconfig
- virtual/os-headers
- sys-devel/autoconf"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
- X? ( x11-apps/xauth )"
-
-S="${WORKDIR}/${PARCH}"
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use hpn && maybe_fail hpn HPN_PATCH)
- $(use ldap && maybe_fail ldap LDAP_PATCH)
- $(use sctp && maybe_fail sctp SCTP_PATCH)
- $(use X509 && maybe_fail X509 X509_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT%/}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
- fi
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX%/}/usr/bin/xauth:" \
- pathnames.h || die
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- eapply "${FILESDIR}"/${PN}-7.7_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
-
- local PATCHSET_VERSION_MACROS=()
-
- if use X509 ; then
- eapply "${WORKDIR}"/${X509_PATCH%.*}
-
- # We need to patch package version or any X.509 sshd will reject our ssh client
- # with "userauth_pubkey: could not parse key: string is too large [preauth]"
- # error
- einfo "Patching package version for X.509 patch set ..."
- sed -i \
- -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
- "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
-
- einfo "Patching version.h to expose X.509 patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in X.509 patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
-
- einfo "Disabling broken X.509 agent test ..."
- sed -i \
- -e "/^ agent$/d" \
- "${S}"/tests/CA/config || die "Failed to disable broken X.509 agent test"
-
- # The following patches don't apply on top of X509 patch
- rm "${WORKDIR}"/patch/2002_all_openssh-7.7p1_upstream_bug2840.patch || die
- rm "${WORKDIR}"/patch/2009_all_openssh-7.7p1_make-shell-tests-portable.patch || die
- rm "${WORKDIR}"/patch/2016_all_openssh-7.7p1_implement-EMFILE-mitigation-for-ssh-agent.patch || die
- rm "${WORKDIR}"/patch/2025_all_openssh-7.7p1_prefer-argv0-to-ssh-when-re-executing-ssh-for-proxyjump.patch || die
- else
- rm "${WORKDIR}"/patch/2016_all_openssh-7.7p1-X509_implement-EMFILE-mitigation-for-ssh-agent.patch || die
- rm "${WORKDIR}"/patch/2025_all_openssh-7.7p1-X509_prefer-argv0-to-ssh-when-re-executing-ssh-for-proxyjump.patch || die
- fi
-
- if use ldap ; then
- eapply "${WORKDIR}"/${LDAP_PATCH%.*}
-
- einfo "Patching version.h to expose LDAP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE.*/a #define SSH_LDAP \"-ldap-${LDAP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in LDAP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_LDAP' )
- fi
-
- if use sctp ; then
- eapply "${WORKDIR}"/${SCTP_PATCH%.*}
-
- einfo "Patching version.h to expose SCTP patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in SCTP patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
-
- einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
- sed -i \
- -e "/\t\tcfgparse \\\/d" \
- "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
- fi
-
- if use hpn ; then
- eapply "${WORKDIR}"/${HPN_PATCH%.*}
-
- einfo "Patching Makefile.in for HPN patch set ..."
- sed -i \
- -e "/^LIBS=/ s/\$/ -lpthread/" \
- "${S}"/Makefile.in || die "Failed to patch Makefile.in"
-
- einfo "Patching version.h to expose HPN patch set ..."
- sed -i \
- -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER}\"" \
- "${S}"/version.h || die "Failed to sed-in HPN patch version"
- PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
-
- if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- einfo "Disabling known non-working MT AES cipher per default ..."
-
- cat > "${T}"/disable_mtaes.conf <<- EOF
-
- # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
- # and therefore disabled per default.
- DisableMTAES yes
- EOF
- sed -i \
- -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
- "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
-
- sed -i \
- -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
- "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
- fi
- fi
-
- if use X509 || use hpn ; then
- einfo "Patching packet.c for X509 and/or HPN patch set ..."
- sed -i \
- -e "s/const struct sshcipher/struct sshcipher/" \
- "${S}"/packet.c || die "Failed to patch ssh_packet_set_connection() (packet.c)"
- fi
-
- if use X509 || use sctp || use ldap || use hpn ; then
- einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
-
- einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
- sed -i \
- -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
- "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
-
- einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
- sed -i \
- -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
- "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
- fi
-
- sed -i \
- -e "/#UseLogin no/d" \
- "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
-
- eapply "${WORKDIR}"/patch/*.patch
-
- eapply_user #473004
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
-
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX%/}"/etc/ssh
- --libexecdir="${EPREFIX%/}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX%/}"/usr/share/openssh
- --with-privsep-path="${EPREFIX%/}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX%/}"/usr)
- # We apply the ldap and sctp patch conditionally, so can't pass --without-{ldap,sctp}
- # unconditionally else we get unknown flag warnings.
- $(use ldap && use_with ldap)
- $(use sctp && use_with sctp)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use_with selinux)
- $(use_with skey)
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- )
-
- # stackprotect is broken on musl x86
- use elibc_musl && use x86 && myconf+=( --without-stackprotect )
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_test() {
- local t skipped=() failed=() passed=()
- local tests=( interop-tests compat-tests )
-
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped+=( tests )
- else
- tests+=( tests )
- fi
-
- # It will also attempt to write to the homedir .ssh.
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in "${tests[@]}" ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" HOME="${sshhome}" \
- emake -k -j1 ${t} </dev/null \
- && passed+=( "${t}" ) \
- || failed+=( "${t}" )
- done
-
- einfo "Passed tests: ${passed[*]}"
- [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
- [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-# Gentoo tweaks to default config files.
-tweak_ssh_configs() {
- local locale_vars=(
- # These are language variables that POSIX defines.
- # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
- LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
-
- # These are the GNU extensions.
- # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
- LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
- )
-
- # First the server config.
- cat <<-EOF >> "${ED%/}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables. #367017
- AcceptEnv ${locale_vars[*]}
-
- # Allow client to pass COLORTERM to match TERM. #658540
- AcceptEnv COLORTERM
- EOF
-
- # Then the client config.
- cat <<-EOF >> "${ED%/}"/etc/ssh/ssh_config
-
- # Send locale environment variables. #367017
- SendEnv ${locale_vars[*]}
-
- # Send COLORTERM to match TERM. #658540
- SendEnv COLORTERM
- EOF
-
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED%/}"/etc/ssh/sshd_config || die
- fi
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED%/}"/etc/ssh/sshd_config || die
- fi
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd.rc6.5 sshd
- newconfd "${FILESDIR}"/sshd-r1.confd sshd
-
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
-
- tweak_ssh_configs
-
- if use ldap && [[ -n ${LDAP_PATCH} ]] ; then
- insinto /etc/openldap/schema/
- newins openssh-lpk_openldap.schema openssh-lpk.schema
- fi
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use hpn && dodoc HPN-README
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- keepdir /var/empty
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-pkg_preinst() {
- enewgroup sshd 22
- enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
- elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
- elog "Furthermore, rsa keys with less than 1024 bits will be refused."
- fi
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-
- if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
- elog ""
- elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
- elog "and therefore disabled at runtime per default."
- elog "Make sure your sshd_config is up to date and contains"
- elog ""
- elog " DisableMTAES yes"
- elog ""
- elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
- elog ""
- fi
-}