openssh: update from 7.7p1 to 7.8p1
PATCH 1/1 openssh: update from 7.7p1 to 7.8p1
Drop the disable-ciphers patch since it has been integrated:
cec33896 Omit 3des-cbc if OpenSSL built without DES.
Signed-off-by Randy MacLeod <[email protected]>
---
...ciphers-not-supported-by-OpenSSL-DES.patch | 39 -------------------
.../{openssh_7.7p1.bb => openssh_7.8p1.bb} | 5 +--
2 files changed, 2 insertions(+), 42 deletions(-)
delete mode 100644 meta/recipes-connectivity/openssh/openssh/disable-ciphers-not-supported-by-OpenSSL-DES.patch
rename meta/recipes-connectivity/openssh/{openssh_7.7p1.bb => openssh_7.8p1.bb} (96%)meta/recipes-connectivity/openssh/openssh/disable-ciphers-not-supported-by-OpenSSL-DES.patch deleted +0 -39
@@ -1,39 +0,0 @@ -From 265eaab8b39d8d8721224a48eefed5bf1696d353 Mon Sep 17 00:00:00 2001 -From: Hongxu Jia <[email protected]> -Date: Wed, 18 Apr 2018 21:58:32 +0800 -Subject: [PATCH] disable ciphers not supported by OpenSSL DES - -While compiling openssl with option `no-des', it caused the openssh -build failure -... -cipher.c:85:41: error: 'EVP_des_ede3_cbc' undeclared here (not in a function); -... - -OpenSSL configured that way defines OPENSSL_NO_DES to disable des - -Suggested by dtucker@ - -Upstream-Status: Submitted [[email protected]] - -Signed-off-by: Hongxu Jia <[email protected]> ---- - cipher.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/cipher.c b/cipher.c -index c3cd5dc..86558e1 100644 ---- a/cipher.c -+++ b/cipher.c -@@ -82,7 +82,9 @@ struct sshcipher { - - static const struct sshcipher ciphers[] = { - #ifdef WITH_OPENSSL -+#ifndef OPENSSL_NO_DES - { "3des-cbc", 8, 24, 0, 0, CFLAG_CBC, EVP_des_ede3_cbc }, -+#endif - { "aes128-cbc", 16, 16, 0, 0, CFLAG_CBC, EVP_aes_128_cbc }, - { "aes192-cbc", 16, 24, 0, 0, CFLAG_CBC, EVP_aes_192_cbc }, - { "aes256-cbc", 16, 32, 0, 0, CFLAG_CBC, EVP_aes_256_cbc }, --- -2.7.4 -
meta/recipes-connectivity/openssh/openssh_7.8p1.bb renamed from meta/recipes-connectivity/openssh/openssh_7.7p1.bb +2 -3
@@ -25,13 +25,12 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar file://fix-potential-signed-overflow-in-pointer-arithmatic.patch \ file://sshd_check_keys \ file://add-test-support-for-busybox.patch \ - file://disable-ciphers-not-supported-by-OpenSSL-DES.patch \ " PAM_SRC_URI = "file://sshd" -SRC_URI[md5sum] = "68ba883aff6958297432e5877e9a0fe2" -SRC_URI[sha256sum] = "d73be7e684e99efcd024be15a30bffcbe41b012b2f7b3c9084aed621775e6b8f" +SRC_URI[md5sum] = "ce1d090fa6239fd38eb989d5e983b074" +SRC_URI[sha256sum] = "1a484bb15152c183bb2514e112aa30dd34138c3cfb032eee5490a66c507144ca" inherit useradd update-rc.d update-alternatives systemd
Signature · 1 line
2.17.1
Quoted 4 lines · Randy MacLeod
Drop the disable-ciphers patch since it has been integrated:
cec33896Omit 3des-cbc if OpenSSL built without DES.Signed-off-by Randy MacLeod <[email protected]>
Builds and works both with and without Alex's patch series:
[OE-core] [RFC PATCH 0/6] openssl 1.1.1 update
but I had not noticed:
DEPENDS = "zlib openssl10"
so I'll fix that and re-test if openssl 1.1.1 is accepted.
../Randy
Quoted 76 lines
--- ...ciphers-not-supported-by-OpenSSL-DES.patch | 39 ------------------- .../{openssh_7.7p1.bb => openssh_7.8p1.bb} | 5 +-- 2 files changed, 2 insertions(+), 42 deletions(-)delete mode 100644
meta/recipes-connectivity/openssh/openssh/disable-ciphers-not-supported-by-OpenSSL-DES.patchrename meta/recipes-connectivity/openssh/{openssh_7.7p1.bb => openssh_7.8p1.bb} (96%)meta/recipes-connectivity/openssh/openssh/disable-ciphers-not-supported-by-OpenSSL-DES.patch deleted +0
-39@@ -1,39 +0,0 @@ -From 265eaab8b39d8d8721224a48eefed5bf1696d353 Mon Sep 17 00:00:00 2001 -From: Hongxu Jia <[email protected]> -Date: Wed, 18 Apr 2018 21:58:32 +0800 -Subject: [PATCH] disable ciphers not supported by OpenSSL DES - -While compiling openssl with option `no-des', it caused the openssh -build failure -... -cipher.c:85:41: error: 'EVP_des_ede3_cbc' undeclared here (not in a function); -... - -OpenSSL configured that way defines OPENSSL_NO_DES to disable des - -Suggested by dtucker@ - -Upstream-Status: Submitted [[email protected]] - -Signed-off-by: Hongxu Jia <[email protected]> ---- - cipher.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/cipher.c b/cipher.c -index c3cd5dc..86558e1 100644 ---- a/cipher.c -+++ b/cipher.c -@@ -82,7 +82,9 @@ struct sshcipher { - - static const struct sshcipher ciphers[] = { - #ifdef WITH_OPENSSL -+#ifndef OPENSSL_NO_DES - { "3des-cbc", 8, 24, 0, 0, CFLAG_CBC, EVP_des_ede3_cbc }, -+#endif - { "aes128-cbc", 16, 16, 0, 0, CFLAG_CBC, EVP_aes_128_cbc }, - { "aes192-cbc", 16, 24, 0, 0, CFLAG_CBC, EVP_aes_192_cbc }, - { "aes256-cbc", 16, 32, 0, 0, CFLAG_CBC, EVP_aes_256_cbc }, --- -2.7.4 -meta/recipes-connectivity/openssh/openssh_7.8p1.bb renamed from meta/recipes-connectivity/openssh/openssh_7.7p1.bb +2
-3@@ -25,13 +25,12 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar file://fix-potential-signed-overflow-in-pointer-arithmatic.patch \ file://sshd_check_keys \ file://add-test-support-for-busybox.patch \ - file://disable-ciphers-not-supported-by-OpenSSL-DES.patch \ " PAM_SRC_URI = "file://sshd" -SRC_URI[md5sum] = "68ba883aff6958297432e5877e9a0fe2" -SRC_URI[sha256sum] = "d73be7e684e99efcd024be15a30bffcbe41b012b2f7b3c9084aed621775e6b8f" +SRC_URI[md5sum] = "ce1d090fa6239fd38eb989d5e983b074" +SRC_URI[sha256sum] = "1a484bb15152c183bb2514e112aa30dd34138c3cfb032eee5490a66c507144ca" inherit useradd update-rc.d update-alternatives systemd
Signature · 2 lines
# Randy MacLeod # Wind River Linux
Quoted 6 lines · Randy MacLeod
Builds and works both with and without Alex's patch series:
[OE-core] [RFC PATCH 0/6] openssl 1.1.1 updatebut I had not noticed:
DEPENDS = "zlib openssl10"
Alex's patch series already fixed that:
-DEPENDS = "zlib openssl10"
+DEPENDS = "zlib libressl"
so I don't need to do any additional tests.
libressl+openssh queries below for the curious.
../Randy
root@qemux86-64:~# rpm -qa | grep libressl libressl-2.8.0-r0.core2_64
root@qemux86-64:~# rpm -qa | grep openssh openssh-sshd-7.8p1-r0.core2_64 openssh-keygen-7.8p1-r0.core2_64 openssh-ssh-7.8p1-r0.core2_64 openssh-scp-7.8p1-r0.core2_64 openssh-7.8p1-r0.core2_64 packagegroup-core-ssh-openssh-1.0-r1.noarch
root@qemux86-64:~# rpm -qa | grep openssl openssl-conf-1.1.1+pre9-r0.core2_64 openssl-1.1.1+pre9-r0.core2_64
root@qemux86-64:~# rpm -ql libressl | grep so /usr/lib/libcrypto.so.43 /usr/lib/libcrypto.so.43.1.0 /usr/lib/libssl.so.45 /usr/lib/libssl.so.45.1.0 /usr/lib/libtls.so.17 /usr/lib/libtls.so.17.1.0
root@qemux86-64:~# ldd /usr/sbin/sshd
linux-vdso.so.1 (0x00007ffd797f7000)
libcrypto.so.43 => /usr/lib/libcrypto.so.43 (0x00007fcd91630000)
libutil.so.1 => /lib/libutil.so.1 (0x00007fcd9162b000)
libz.so.1 => /lib/libz.so.1 (0x00007fcd91611000)
libcrypt.so.1 => /usr/lib/libcrypt.so.1 (0x00007fcd915e6000)
libc.so.6 => /lib/libc.so.6 (0x00007fcd9142c000)
libpthread.so.0 => /lib/libpthread.so.0 (0x00007fcd9140b000)
/lib/ld-linux-x86-64.so.2 (0x00007fcd918c8000)root@qemux86-64:~# ldd /usr/bin/ssh.openssh | grep crypto
libcrypto.so.43 => /usr/lib/libcrypto.so.43 (0x00007f7ea43bc000)Quoted 2 lines
so I'll fix that and re-test if openssl 1.1.1 is accepted.
Signature · 2 lines
# Randy MacLeod # Wind River Linux