[BACK]Return to Makefile CVS log [TXT][DIR] Up to [cvs.NetBSD.org] / pkgsrc / security / openssh

File: [cvs.NetBSD.org] / pkgsrc / security / openssh / Makefile (download)

Revision 1.171.2.1, Fri Nov 10 11:50:25 2006 UTC (17 years, 4 months ago) by salo
Branch: pkgsrc-2006Q3
Changes since 1.171: +14 -6 lines

Pullup ticket 1909 - requested by taca
security update for openssh

Revisions pulled up:
- pkgsrc/security/openssh/Makefile		1.172, 1.173, 1.174
- pkgsrc/security/openssh/distinfo		1.55, 1.56, 1.57
- pkgsrc/security/openssh/hacks.mk		1.2
- pkgsrc/security/openssh/options.mk		1.9, 1.10
- pkgsrc/security/openssh/patches/patch-aa	1.42, 1.43
- pkgsrc/security/openssh/patches/patch-ab	1.24, 1.25
- pkgsrc/security/openssh/patches/patch-ac	1.16
- pkgsrc/security/openssh/patches/patch-ad	1.12
- pkgsrc/security/openssh/patches/patch-ae	1.12
- pkgsrc/security/openssh/patches/patch-af	1.10
- pkgsrc/security/openssh/patches/patch-ag	1.9
- pkgsrc/security/openssh/patches/patch-ah	1.24
- pkgsrc/security/openssh/patches/patch-ai	1.10
- pkgsrc/security/openssh/patches/patch-aj	1.7
- pkgsrc/security/openssh/patches/patch-ak	1.8
- pkgsrc/security/openssh/patches/patch-al	1.7
- pkgsrc/security/openssh/patches/patch-am	1.7
- pkgsrc/security/openssh/patches/patch-an	1.8
- pkgsrc/security/openssh/patches/patch-ao	1.9
- pkgsrc/security/openssh/patches/patch-ap	1.8
- pkgsrc/security/openssh/patches/patch-aq	1.6
- pkgsrc/security/openssh/patches/patch-ar	1.7
- pkgsrc/security/openssh/patches/patch-as	1.5
- pkgsrc/security/openssh/patches/patch-at	removed
- pkgsrc/security/openssh/patches/patch-au	1.3
- pkgsrc/security/openssh/patches/patch-av	1.5
- pkgsrc/security/openssh/patches/patch-aw	1.2
- pkgsrc/security/openssh/patches/patch-ax	removed
- pkgsrc/security/openssh/patches/patch-ay	removed
- pkgsrc/security/openssh/patches/patch-az	removed

   Module Name:		pkgsrc
   Committed By:	taca
   Date:		Tue Oct 31 03:31:20 UTC 2006

   Modified Files:
   	pkgsrc/security/openssh: Makefile distinfo hacks.mk options.mk
   	pkgsrc/security/openssh/patches: patch-aa patch-ab patch-ac patch-ad
   	    patch-ae patch-af patch-ag patch-ah patch-ai patch-aj patch-ak
   	    patch-al patch-am patch-an patch-ao patch-ap patch-aq patch-ar
   	    patch-as patch-au patch-av patch-aw
   Removed Files:
   	pkgsrc/security/openssh/patches: patch-at patch-ax patch-ay patch-az

   Log Message:
   Update openssh package to 4.4.1 (openssh-4.4p1).

   - A few pkglint warning clean up.
   - Major changes are here.  For complete changes,
     see http://www.openssh.com/txt/release-4.4.

   Changes since OpenSSH 4.3:
   ============================

   Security bugs resolved in this release:

    * Fix a pre-authentication denial of service found by Tavis Ormandy,
      that would cause sshd(8) to spin until the login grace time
      expired.

    * Fix an unsafe signal hander reported by Mark Dowd. The signal
      handler was vulnerable to a race condition that could be exploited
      to perform a pre-authentication denial of service. On portable
      OpenSSH, this vulnerability could theoretically lead to
      pre-authentication remote code execution if GSSAPI authentication
      is enabled, but the likelihood of successful exploitation appears
      remote.

    * On portable OpenSSH, fix a GSSAPI authentication abort that could
      be used to determine the validity of usernames on some platforms.

   This release includes the following new functionality and fixes:

    * Implemented conditional configuration in sshd_config(5) using the
      "Match" directive. This allows some configuration options to be
      selectively overridden if specific criteria (based on user, group,
      hostname and/or address) are met. So far a useful subset of post-
      authentication options are supported and more are expected to be
      added in future releases.

    * Add support for Diffie-Hellman group exchange key agreement with a
      final hash of SHA256.

    * Added a "ForceCommand" directive to sshd_config(5). Similar to the
      command="..." option accepted in ~/.ssh/authorized_keys, this forces
      the execution of the specified command regardless of what the user
      requested. This is very useful in conjunction with the new "Match"
      option.

    * Add a "PermitOpen" directive to sshd_config(5). This mirrors the
      permitopen="..." authorized_keys option, allowing fine-grained
      control over the port-forwardings that a user is allowed to
      establish.

    * Add optional logging of transactions to sftp-server(8).

    * ssh(1) will now record port numbers for hosts stored in
      ~/.ssh/authorized_keys when a non-standard port has been requested.

    * Add an "ExitOnForwardFailure" option to cause ssh(1) to exit (with
      a non-zero exit code) when requested port forwardings could not be
      established.

    * Extend sshd_config(5) "SubSystem" declarations to allow the
      specification of command-line arguments.

    * Replacement of all integer overflow susceptible invocations of
      malloc(3) and realloc(3) with overflow-checking equivalents.

    * Many manpage fixes and improvements

    * New portable OpenSSH-specific features:

      - Add optional support for SELinux, controlled using the
        --with-selinux configure option (experimental)

      - Add optional support for Solaris process contracts, enabled
        using the --with-solaris-contracts configure option (experimental)
        This option will also include SMF metadata in Solaris packages
        built using the "make package" target

      - Add optional support for OpenSSL hardware accelerators (engines),
        enabled using the --with-ssl-engine configure option.
---
   Module Name:		pkgsrc
   Committed By:	taca
   Date:		Tue Nov  7 07:08:26 UTC 2006

   Modified Files:
   	pkgsrc/security/openssh: Makefile distinfo options.mk

   Log Message:
   Update hpn-patch to hpn12v13 since old one has gone.

   Bump PKGREVISION.
---
   Module Name:		pkgsrc
   Committed By:	taca
   Date:		Wed Nov  8 01:49:22 UTC 2006

   Modified Files:
   	pkgsrc/security/openssh: Makefile distinfo
   	pkgsrc/security/openssh/patches: patch-aa patch-ab

   Log Message:
   Update openssh package to 4.5.1 (openssh-4.5p1).

   Changes:

   Security bugs resolved in this release:

    * Fix a bug in the sshd privilege separation monitor that weakened its
      verification of successful authentication. This bug is not known to
      be exploitable in the absence of additional vulnerabilities.

   This release includes the following non-security fixes:

    * Several compilation fixes for portable OpenSSH

    * Fixes to Solaris SMF/process contract support (bugzilla #1255)

# $NetBSD: Makefile,v 1.171.2.1 2006/11/10 11:50:25 salo Exp $

DISTNAME=		openssh-4.5p1
PKGNAME=		openssh-4.5.1
SVR4_PKGNAME=		ossh
CATEGORIES=		security
MASTER_SITES=		ftp://ftp.openssh.com/pub/OpenBSD/OpenSSH/portable/ \
			ftp://ftp7.usa.openbsd.org/pub/os/OpenBSD/OpenSSH/portable/ \
			ftp://ftp.stealth.net/pub/mirrors/ftp.openssh.com/pub/OpenBSD/OpenSSH/portable/ \
			http://public.planetmirror.com.au/pub/OpenBSD/OpenSSH/portable/ \
			ftp://gd.tuwien.ac.at/opsys/OpenBSD/OpenSSH/portable/ \
			ftp://ftp.openssh.com/pub/OpenBSD/OpenSSH/portable/old/
# Don't delete the last entry -- it's there if the pkgsrc version is not
# up-to-date and the mirrors already removed the old distfile.

MAINTAINER=		pkgsrc-users@NetBSD.org
HOMEPAGE=		http://www.openssh.com/
COMMENT=		Open Source Secure shell client and server (remote login program)

CONFLICTS=		sftp-[0-9]*
CONFLICTS+=		ssh-[0-9]* ssh6-[0-9]*
CONFLICTS+=		ssh2-[0-9]* ssh2-nox11-[0-9]*
CONFLICTS+=		openssh+gssapi-[0-9]*
CONFLICTS+=		lsh>2.0

USE_TOOLS+=		perl

CRYPTO=			yes

# retain the following line, for IPv6-ready pkgsrc webpage
BUILD_DEFS+=		USE_INET6

BUILD_DEFS+=		OPENSSH_CHROOT OPENSSH_GROUP OPENSSH_USER
BUILD_DEFS+=		VARBASE

INSTALL_TARGET=		install-nokeys
PLIST_SRC=		# empty

.include "options.mk"

.if ${OPSYS} == "Interix"

# OpenSSH on Interix has some important caveats
MESSAGE_SRC=		${.CURDIR}/MESSAGE.Interix
BUILDLINK_PASSTHRU_DIRS+= /usr/local/include/bind /usr/local/lib/bind
CONFIGURE_ENV+=		ac_cv_func_openpty=no
CONFIGURE_ENV+=		ac_cv_type_struct_timespec=yes
CPPFLAGS+=		-I/usr/local/include/bind
LDFLAGS+=		-L/usr/local/lib/bind
LIBS+=			-lbind -ldb -lcrypt

.else # not Interix

PKG_GROUPS=             ${OPENSSH_GROUP}
PKG_USERS=		${OPENSSH_USER}:${OPENSSH_GROUP}

PKG_GECOS.${OPENSSH_USER}=	sshd privsep pseudo-user
PKG_HOME.${OPENSSH_USER}=	${OPENSSH_CHROOT}

.endif

SSH_PID_DIR=		${VARBASE}/run	# default directory for PID files

PKG_SYSCONFSUBDIR=	ssh

GNU_CONFIGURE=		yes
CONFIGURE_ARGS+=	--with-mantype=man
CONFIGURE_ARGS+=	--sysconfdir=${PKG_SYSCONFDIR:Q}
CONFIGURE_ARGS+=	--with-pid-dir=${SSH_PID_DIR:Q}
CONFIGURE_ARGS+=	--with-ssl-dir=${SSLBASE:Q}
CONFIGURE_ARGS+=	--with-tcp-wrappers=${BUILDLINK_PREFIX.tcp_wrappers}

.if ${OPSYS} != "Interix"
CONFIGURE_ARGS+=	--with-privsep-path=${OPENSSH_CHROOT:Q}
CONFIGURE_ARGS+=	--with-privsep-user=${OPENSSH_USER:Q}
.endif

# pkgsrc already enforces a "secure" version of zlib via dependencies,
# so skip this bogus version check.
CONFIGURE_ARGS+=	--without-zlib-version-check

# the openssh configure script finds and uses ${LD} if defined and
# defaults to ${CC} if not. we override LD here, since running the
# linker directly results in undefined symbols for obvious reasons.
#
CONFIGURE_ENV+=		LD=${CC:Q}

# Enable S/Key support on NetBSD, Darwin, and Solaris.
.if (${OPSYS} == "NetBSD") || (${OPSYS} == "Darwin") || (${OPSYS} == "SunOS")
.  include "../../security/skey/buildlink3.mk"
CONFIGURE_ARGS+=	--with-skey=${BUILDLINK_PREFIX.skey}
.else
CONFIGURE_ARGS+=	--without-skey
.endif

.if (${OPSYS} == "NetBSD") && exists(/usr/include/utmpx.h)
# if we have utmpx et al do not try to use login()
CONFIGURE_ARGS+=	--disable-libutil
.endif
.if (${OPSYS} == "SunOS") && (${OS_VERSION} == "5.8" || ${OS_VERSION} == "5.9")
CONFIGURE_ARGS+=	--disable-utmp --disable-wtmp
.endif
.if ${OPSYS} == "Linux"
CONFIGURE_ARGS+=	--enable-md5-password
.endif

# The ssh-askpass program is in ${X11BASE}/bin or ${X11PREFIX}/bin depending
# on if it's part of the X11 distribution, or if it's installed from pkgsrc
# (security/ssh-askpass).
#
.if exists(${X11BASE}/bin/ssh-askpass)
ASKPASS_PROGRAM=	${X11BASE}/bin/ssh-askpass
.else
ASKPASS_PROGRAM=	${X11PREFIX}/bin/ssh-askpass
.endif
CONFIGURE_ENV+=		ASKPASS_PROGRAM=${ASKPASS_PROGRAM:Q}
MAKE_ENV+=		ASKPASS_PROGRAM=${ASKPASS_PROGRAM:Q}

# do the same for xauth
.if exists(${X11BASE}/bin/xauth)
CONFIGURE_ARGS+=	--with-xauth=${X11BASE}/bin/xauth
.else
CONFIGURE_ARGS+=	--with-xauth=${X11PREFIX}/bin/xauth
.endif

CONFS=			ssh_config sshd_config moduli

.if exists(/dev/urandom)
.  if ${OPSYS} == "NetBSD"
MESSAGE_SRC+=		${.CURDIR}/MESSAGE.urandom
.  endif
.else
CONFIGURE_ARGS+=	--without-random
CONFS+=			ssh_prng_cmds
PLIST_SRC+=		${.CURDIR}/PLIST.prng
.endif

EGDIR=			${PREFIX}/share/examples/${PKGBASE}
CONF_FILES=		# empty
.for f in ${CONFS}
CONF_FILES+=		${EGDIR}/${f} ${PKG_SYSCONFDIR}/${f}
.endfor
OWN_DIRS=		${OPENSSH_CHROOT}
RCD_SCRIPTS=		sshd

PLIST_SRC+=		${.CURDIR}/PLIST
FILES_SUBST+=		SSH_PID_DIR=${SSH_PID_DIR:Q}

SUBST_CLASSES+=		patch
SUBST_STAGE.patch=	pre-configure
SUBST_FILES.patch=	session.c
SUBST_SED.patch=	-e '/channel_input_port_forward_request/s/0/ROOTUID/'
SUBST_MESSAGE.patch=	More patch a file.

.include "../../devel/zlib/buildlink3.mk"
.include "../../security/openssl/buildlink3.mk"
.include "../../security/tcp_wrappers/buildlink3.mk"

post-install:
	${INSTALL_DATA_DIR} ${EGDIR}
	cd ${WRKSRC}; for file in ${CONFS}; do				\
		${INSTALL_DATA} $${file}.out ${EGDIR}/$${file};		\
	done
.if !empty(PKG_OPTIONS:Mpam) && ${OPSYS} == "Linux"
	${INSTALL_DATA} ${WRKSRC}/contrib/sshd.pam.generic ${EGDIR}/sshd.pam
.endif

.include "../../mk/bsd.pkg.mk"