* New upstream release (closes: #395507, #397961, #420035). Important

  changes not previously backported to 4.3p2:
  - 4.4/4.4p1 (http://www.openssh.org/txt/release-4.4):
    + On portable OpenSSH, fix a GSSAPI authentication abort that could be
      used to determine the validity of usernames on some platforms.
    + Implemented conditional configuration in sshd_config(5) using the
      "Match" directive. This allows some configuration options to be
      selectively overridden if specific criteria (based on user, group,
      hostname and/or address) are met. So far a useful subset of
      post-authentication options are supported and more are expected to
      be added in future releases.
    + Add support for Diffie-Hellman group exchange key agreement with a
      final hash of SHA256.
    + Added a "ForceCommand" directive to sshd_config(5). Similar to the
      command="..." option accepted in ~/.ssh/authorized_keys, this forces
      the execution of the specified command regardless of what the user
      requested. This is very useful in conjunction with the new "Match"
      option.
    + Add a "PermitOpen" directive to sshd_config(5). This mirrors the
      permitopen="..." authorized_keys option, allowing fine-grained
      control over the port-forwardings that a user is allowed to
      establish.
    + Add optional logging of transactions to sftp-server(8).
    + ssh(1) will now record port numbers for hosts stored in
      ~/.ssh/known_hosts when a non-standard port has been requested
      (closes: #50612).
    + Add an "ExitOnForwardFailure" option to cause ssh(1) to exit (with a
      non-zero exit code) when requested port forwardings could not be
      established.
    + Extend sshd_config(5) "SubSystem" declarations to allow the
      specification of command-line arguments.
    + Replacement of all integer overflow susceptible invocations of
      malloc(3) and realloc(3) with overflow-checking equivalents.
    + Many manpage fixes and improvements.
    + Add optional support for OpenSSL hardware accelerators (engines),
      enabled using the --with-ssl-engine configure option.
    + Tokens in configuration files may be double-quoted in order to
      contain spaces (closes: #319639).
    + Move a debug() call out of a SIGCHLD handler, fixing a hang when the
      session exits very quickly (closes: #307890).
    + Fix some incorrect buffer allocation calculations (closes: #410599).
    + ssh-add doesn't ask for a passphrase if key file permissions are too
      liberal (closes: #103677).
    + Likewise, ssh doesn't ask either (closes: #99675).
  - 4.6/4.6p1 (http://www.openssh.org/txt/release-4.6):
    + sshd now allows the enabling and disabling of authentication methods
      on a per user, group, host and network basis via the Match directive
      in sshd_config.
    + Fixed an inconsistent check for a terminal when displaying scp
      progress meter (closes: #257524).
    + Fix "hang on exit" when background processes are running at the time
      of exit on a ttyful/login session (closes: #88337).
* Update to current GSSAPI patch from
  http://www.sxw.org.uk/computing/patches/openssh-4.6p1-gsskex-20070312.patch;
  install ChangeLog.gssapi.

1 files changed, 158 insertions, 40 deletions

diff --git a/buildpkg.sh.in b/buildpkg.sh.in
index cb9eb3048..8a96b9050 100644
--- a/buildpkg.sh.in
+++ b/buildpkg.sh.in
@@ -24,6 +24,7 @@ PKGNAME=OpenSSH
 # revisions within the same version (REV=a)
 #REV=
 SYSVINIT_NAME=opensshd
+AWK=${AWK:="nawk"}
 MAKE=${MAKE:="make"}
 SSHDUID=67      # Default privsep uid
 SSHDGID=67      # Default privsep gid
@@ -35,7 +36,7 @@ SSHDGID=67	# Default privsep gid
 SYSVINITSTART=S98
 SYSVINITSTOPT=K30
 # We will source these if they exist
-POST_MAKE_INSTALL_FIXES=./pkg_post_make_install_fixes.sh
+POST_MAKE_INSTALL_FIXES=./pkg-post-make-install-fixes.sh
 POST_PROTOTYPE_EDITS=./pkg-post-prototype-edit.sh
 # We'll be one level deeper looking for these
 PKG_PREINSTALL_LOCAL=../pkg-preinstall.local
@@ -46,6 +47,8 @@ PKG_REQUEST_LOCAL=../pkg-request.local
 # end of sourced files
 #
 OPENSSHD=opensshd.init
+OPENSSH_MANIFEST=openssh.xml
+OPENSSH_FMRI=svc:/site/${SYSVINIT_NAME}:default
 
 PATH_GROUPADD_PROG=@PATH_GROUPADD_PROG@
 PATH_USERADD_PROG=@PATH_USERADD_PROG@
@@ -60,6 +63,10 @@ SYSTEM_DIR="/etc	\
 /etc/rc1.d              \
 /etc/rc2.d              \
 /etc/opt                \
+/lib                    \
+/lib/svc                \
+/lib/svc/method         \
+/lib/svc/method/site    \
 /opt                    \
 /opt/bin                \
 /usr                    \
@@ -82,6 +89,9 @@ SYSTEM_DIR="/etc	\
 /var                    \
 /var/opt                \
 /var/run                \
+/var/svc                \
+/var/svc/manifest       \
+/var/svc/manifest/site  \
 /var/tmp                \
 /tmp"
 
@@ -119,6 +129,12 @@ do
         eval $confvar=`grep "^$confvar=" Makefile | cut -d = -f 2`
 done
 
+## Are we using Solaris' SMF?
+DO_SMF=0
+if egrep "^#define USE_SOLARIS_PROCESS_CONTRACTS" config.h > /dev/null 2>&1
+then
+        DO_SMF=1
+fi
 
 ## Collect value of privsep user
 for confvar in SSH_PRIVSEP_USER
@@ -139,15 +155,22 @@ ARCH=`uname -m`
 DEF_MSG="\n"
 OS_VER=`uname -v`
 SCRIPT_SHELL=/sbin/sh
+UNAME_R=`uname -r`
 UNAME_S=`uname -s`
 case ${UNAME_S} in
         SunOS)  UNAME_S=Solaris
+                OS_VER=${UNAME_R}
                 ARCH=`uname -p`
                 RCS_D=yes
                 DEF_MSG="(default: n)"
                 ;;
-        SCO_SV) UNAME_S=OpenServer
+        SCO_SV) case ${UNAME_R} in
+                        3.2)    UNAME_S=OpenServer5
                 OS_VER=`uname -X | grep Release | sed -e 's/^Rel.*3.2v//'`
+                                ;;
+                        5)      UNAME_S=OpenServer6
+                                ;;
+                esac
                 SCRIPT_SHELL=/bin/sh
                 RC1_D=no
                 DEF_MSG="(default: n)"
@@ -168,10 +191,26 @@ then
 fi
 
 ## Setup our run level stuff while we are at it.
-mkdir -p $FAKE_ROOT${TEST_DIR}/etc/init.d
+if [ $DO_SMF -eq 1 ]
+then
+        # For Solaris' SMF, /lib/svc/method/site is the preferred place
+        # for start/stop scripts that aren't supplied with the OS, and
+        # similarly /var/svc/manifest/site for manifests.
+        mkdir -p $FAKE_ROOT${TEST_DIR}/lib/svc/method/site
+        mkdir -p $FAKE_ROOT${TEST_DIR}/var/svc/manifest/site
+
+        cp ${OPENSSHD} $FAKE_ROOT${TEST_DIR}/lib/svc/method/site/${SYSVINIT_NAME}
+        chmod 744 $FAKE_ROOT${TEST_DIR}/lib/svc/method/site/${SYSVINIT_NAME}
+
+        cat ${OPENSSH_MANIFEST} | sed "s|__SYSVINIT_NAME__|${SYSVINIT_NAME}|" \
+            > $FAKE_ROOT${TEST_DIR}/var/svc/manifest/site/${SYSVINIT_NAME}.xml
+        chmod 644 $FAKE_ROOT${TEST_DIR}/var/svc/manifest/site/${SYSVINIT_NAME}.xml
+else
+        mkdir -p $FAKE_ROOT${TEST_DIR}/etc/init.d
 
-cp ${OPENSSHD} $FAKE_ROOT${TEST_DIR}/etc/init.d/${SYSVINIT_NAME}
-chmod 744 $FAKE_ROOT${TEST_DIR}/etc/init.d/${SYSVINIT_NAME}
+        cp ${OPENSSHD} $FAKE_ROOT${TEST_DIR}/etc/init.d/${SYSVINIT_NAME}
+        chmod 744 $FAKE_ROOT${TEST_DIR}/etc/init.d/${SYSVINIT_NAME}
+fi
 
 [ "${PERMIT_ROOT_LOGIN}" = no ]  &&  \
         perl -p -i -e "s/#PermitRootLogin yes/PermitRootLogin no/" \
@@ -221,15 +260,22 @@ touch depend
 
 ## Build space file
 echo "Building space file..."
-cat > space << _EOF
-# extra space required by start/stop links added by installf in postinstall
+if [ $DO_SMF -eq 1 ]
+then
+        # XXX Is this necessary?  If not, remove space line from mk-proto.awk.
+        touch space
+else
+        cat > space << _EOF
+# extra space required by start/stop links added by installf 
+# in postinstall
 $TEST_DIR/etc/rc0.d/${SYSVINITSTOPT}${SYSVINIT_NAME} 0 1
 $TEST_DIR/etc/rc2.d/${SYSVINITSTART}${SYSVINIT_NAME} 0 1
 _EOF
-[ "$RC1_D" = no ]  ||  \
-echo "$TEST_DIR/etc/rc1.d/${SYSVINITSTOPT}${SYSVINIT_NAME} 0 1" >> space
-[ "$RCS_D" = yes ]  &&  \
-echo "$TEST_DIR/etc/rcS.d/${SYSVINITSTOPT}${SYSVINIT_NAME} 0 1" >> space
+        [ "$RC1_D" = no ]  ||  \
+        echo "$TEST_DIR/etc/rc1.d/${SYSVINITSTOPT}${SYSVINIT_NAME} 0 1" >> space
+        [ "$RCS_D" = yes ]  &&  \
+        echo "$TEST_DIR/etc/rcS.d/${SYSVINITSTOPT}${SYSVINIT_NAME} 0 1" >> space
+fi
 
 ## Build preinstall file
 echo "Building preinstall file..."
@@ -243,7 +289,16 @@ _EOF
 
 cat >> preinstall << _EOF
 #
-[ "\${PRE_INS_STOP}" = "yes" ]  &&  ${TEST_DIR}/etc/init.d/${SYSVINIT_NAME} stop
+if [ "\${PRE_INS_STOP}" = "yes" ]
+then
+        if [ $DO_SMF -eq 1 ] 
+        then
+                svcadm disable $OPENSSH_FMRI
+        else
+                ${TEST_DIR}/etc/init.d/${SYSVINIT_NAME} stop
+        fi
+fi
+
 exit 0
 _EOF
 
@@ -265,28 +320,40 @@ cat > postinstall << _EOF
 }
 
 # make rc?.d dirs only if we are doing a test install
-[ -n "${TEST_DIR}" ]  &&  {
+[ -n "${TEST_DIR}" ]  &&  [ $DO_SMF -ne 1 ] && {
         [ "$RCS_D" = yes ]  &&  mkdir -p ${TEST_DIR}/etc/rcS.d
         mkdir -p ${TEST_DIR}/etc/rc0.d
         [ "$RC1_D" = no ]  ||  mkdir -p ${TEST_DIR}/etc/rc1.d
         mkdir -p ${TEST_DIR}/etc/rc2.d
 }
 
-if [ "\${USE_SYM_LINKS}" = yes ]
+if [ $DO_SMF -eq 1 ]
 then
-        [ "$RCS_D" = yes ]  &&  \
-installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rcS.d/${SYSVINITSTOPT}${SYSVINIT_NAME}=../init.d/${SYSVINIT_NAME} s
-        installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rc0.d/${SYSVINITSTOPT}${SYSVINIT_NAME}=../init.d/${SYSVINIT_NAME} s
-        [ "$RC1_D" = no ]  ||  \
-        installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rc1.d/${SYSVINITSTOPT}${SYSVINIT_NAME}=../init.d/${SYSVINIT_NAME} s
-        installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rc2.d/${SYSVINITSTART}${SYSVINIT_NAME}=../init.d/${SYSVINIT_NAME} s
+        # Delete the existing service, if it exists, then import the 
+        # new one.
+        if svcs $OPENSSH_FMRI > /dev/null 2>&1
+        then
+                svccfg delete -f $OPENSSH_FMRI
+        fi
+        # NOTE, The manifest disables sshd by default.
+        svccfg import ${TEST_DIR}/var/svc/manifest/site/${SYSVINIT_NAME}.xml
 else
-        [ "$RCS_D" = yes ]  &&  \
-installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rcS.d/${SYSVINITSTOPT}${SYSVINIT_NAME}=\${PKG_INSTALL_ROOT}$TEST_DIR/etc/init.d/${SYSVINIT_NAME} l
-        installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rc0.d/${SYSVINITSTOPT}${SYSVINIT_NAME}=\${PKG_INSTALL_ROOT}$TEST_DIR/etc/init.d/${SYSVINIT_NAME} l
-        [ "$RC1_D" = no ]  ||  \
-        installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rc1.d/${SYSVINITSTOPT}${SYSVINIT_NAME}=\${PKG_INSTALL_ROOT}$TEST_DIR/etc/init.d/${SYSVINIT_NAME} l
-        installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rc2.d/${SYSVINITSTART}${SYSVINIT_NAME}=\${PKG_INSTALL_ROOT}$TEST_DIR/etc/init.d/${SYSVINIT_NAME} l
+        if [ "\${USE_SYM_LINKS}" = yes ]
+        then
+                [ "$RCS_D" = yes ]  &&  \
+        installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rcS.d/${SYSVINITSTOPT}${SYSVINIT_NAME}=../init.d/${SYSVINIT_NAME} s
+                installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rc0.d/${SYSVINITSTOPT}${SYSVINIT_NAME}=../init.d/${SYSVINIT_NAME} s
+                [ "$RC1_D" = no ]  ||  \
+                installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rc1.d/${SYSVINITSTOPT}${SYSVINIT_NAME}=../init.d/${SYSVINIT_NAME} s
+                installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rc2.d/${SYSVINITSTART}${SYSVINIT_NAME}=../init.d/${SYSVINIT_NAME} s
+        else
+                [ "$RCS_D" = yes ]  &&  \
+        installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rcS.d/${SYSVINITSTOPT}${SYSVINIT_NAME}=\${PKG_INSTALL_ROOT}$TEST_DIR/etc/init.d/${SYSVINIT_NAME} l
+                installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rc0.d/${SYSVINITSTOPT}${SYSVINIT_NAME}=\${PKG_INSTALL_ROOT}$TEST_DIR/etc/init.d/${SYSVINIT_NAME} l
+                [ "$RC1_D" = no ]  ||  \
+                installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rc1.d/${SYSVINITSTOPT}${SYSVINIT_NAME}=\${PKG_INSTALL_ROOT}$TEST_DIR/etc/init.d/${SYSVINIT_NAME} l
+                installf ${PKGNAME} \${PKG_INSTALL_ROOT}$TEST_DIR/etc/rc2.d/${SYSVINITSTART}${SYSVINIT_NAME}=\${PKG_INSTALL_ROOT}$TEST_DIR/etc/init.d/${SYSVINIT_NAME} l
+        fi
 fi
 
 # If piddir doesn't exist we add it. (Ie. --with-pid-dir=/var/opt/ssh)
@@ -311,14 +378,7 @@ then
         chroot=echo
 fi
 
-if egrep '^[ \t]*UsePrivilegeSeparation[ \t]+no' \${PKG_INSTALL_ROOT}/$sysconfdir/sshd_config >/dev/null
-then
-        echo "UsePrivilegeSeparation disabled in config, not creating PrivSep user"
-        echo "or group."
-else
-        echo "UsePrivilegeSeparation enabled in config (or defaulting to on)."
-
-        # user required?
+        echo "PrivilegeSeparation user always required."
         if cut -f1 -d: \${PKG_INSTALL_ROOT}/etc/passwd | egrep '^'$SSH_PRIVSEP_USER'\$' >/dev/null
         then
                 echo "PrivSep user $SSH_PRIVSEP_USER already exists."
@@ -363,9 +423,16 @@ else
                 \$chroot ${PATH_USERADD_PROG} -c 'SSHD PrivSep User' -s /bin/false -g $SSH_PRIVSEP_USER \$sshduid $SSH_PRIVSEP_USER
                 \$chroot ${PATH_PASSWD_PROG} -l $SSH_PRIVSEP_USER
         }
-fi
 
-[ "\${POST_INS_START}" = "yes" ]  &&  ${TEST_DIR}/etc/init.d/${SYSVINIT_NAME} start
+if [ "\${POST_INS_START}" = "yes" ]
+then
+        if [ $DO_SMF -eq 1 ]
+        then
+                svcadm enable $OPENSSH_FMRI
+        else
+                ${TEST_DIR}/etc/init.d/${SYSVINIT_NAME} start
+        fi
+fi
 exit 0
 _EOF
 
@@ -374,7 +441,12 @@ echo "Building preremove file..."
 cat > preremove << _EOF
 #! ${SCRIPT_SHELL}
 #
-${TEST_DIR}/etc/init.d/${SYSVINIT_NAME} stop
+if [ $DO_SMF -eq 1 ] 
+then
+        svcadm disable $OPENSSH_FMRI
+else
+        ${TEST_DIR}/etc/init.d/${SYSVINIT_NAME} stop
+fi
 _EOF
 
 # local preremove changes here
@@ -389,6 +461,13 @@ echo "Building postremove file..."
 cat > postremove << _EOF
 #! ${SCRIPT_SHELL}
 #
+if [ $DO_SMF -eq 1 ]
+then
+        if svcs $OPENSSH_FMRI > /dev/null 2>&1
+        then
+                svccfg delete -f $OPENSSH_FMRI
+        fi
+fi
 _EOF
 
 # local postremove changes here
@@ -408,7 +487,7 @@ _EOF
 [ -x /usr/bin/ckyorn ]  ||  cat >> request << _EOF
 
 ckyorn() {
-# for some strange reason OpenServer has no ckyorn
+# for some strange reason OpenServer5 has no ckyorn
 # We build a striped down version here
 
 DEFAULT=n
@@ -454,7 +533,45 @@ done
 
 _EOF
 
-cat >> request << _EOF
+if [ $DO_SMF -eq 1 ]
+then
+        # This could get hairy, as the running sshd may not be under SMF.
+        # We'll assume an earlier version of OpenSSH started via SMF.
+        cat >> request << _EOF
+PRE_INS_STOP=no
+POST_INS_START=no
+# determine if should restart the daemon
+if [ -s ${piddir}/sshd.pid  ] && \
+    /usr/bin/svcs -H $OPENSSH_FMRI 2>&1 | egrep "^online" > /dev/null 2>&1
+then
+        ans=\`ckyorn -d n \
+-p "Should the running sshd daemon be restarted? ${DEF_MSG}"\` || exit \$?
+        case \$ans in
+                [y,Y]*) PRE_INS_STOP=yes
+                        POST_INS_START=yes
+                        ;;
+        esac
+
+else
+
+# determine if we should start sshd
+        ans=\`ckyorn -d n \
+-p "Start the sshd daemon after installing this package? ${DEF_MSG}"\` || exit \$?
+        case \$ans in
+                [y,Y]*) POST_INS_START=yes ;;
+        esac
+fi
+
+# make parameters available to installation service,
+# and so to any other packaging scripts
+cat >\$1 <<!
+PRE_INS_STOP='\$PRE_INS_STOP'
+POST_INS_START='\$POST_INS_START'
+!
+
+_EOF
+else
+        cat >> request << _EOF
 USE_SYM_LINKS=no
 PRE_INS_STOP=no
 POST_INS_START=no
@@ -495,6 +612,7 @@ POST_INS_START='\$POST_INS_START'
 !
 
 _EOF
+fi
 
 # local request changes here
 [ -s "${PKG_REQUEST_LOCAL}" ]  &&  . ${PKG_REQUEST_LOCAL}
@@ -526,7 +644,7 @@ cat >mk-proto.awk << _EOF
 _EOF
 
 find . | egrep -v "prototype|pkginfo|mk-proto.awk" | sort | \
-        pkgproto $PROTO_ARGS | nawk -f mk-proto.awk > prototype
+        pkgproto $PROTO_ARGS | ${AWK} -f mk-proto.awk > prototype
 
 # /usr/local is a symlink on some systems
 [ "${USR_LOCAL_IS_SYMLINK}" = yes ]  &&  {