diff options
author | Colin Watson <cjwatson@debian.org> | 2014-10-07 13:22:41 +0100 |
---|---|---|
committer | Colin Watson <cjwatson@debian.org> | 2014-10-07 14:26:47 +0100 |
commit | b25d6dd3b6b5a2cb93723586c56d6fa0277ea56a (patch) | |
tree | 4d1529682d4c22a5a7382b1f7d71334c0434f959 /configure.ac | |
parent | 1c1b6fa17982eb622e2c4e8f4a279f2113f57413 (diff) |
Restore TCP wrappers support
Support for TCP wrappers was dropped in OpenSSH 6.7. See this message
and thread:
https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-April/032497.html
It is true that this reduces preauth attack surface in sshd. On the
other hand, this support seems to be quite widely used, and abruptly
dropping it (from the perspective of users who don't read
openssh-unix-dev) could easily cause more serious problems in practice.
It's not entirely clear what the right long-term answer for Debian is,
but it at least probably doesn't involve dropping this feature shortly
before a freeze.
Forwarded: not-needed
Last-Update: 2014-10-07
Patch-Name: restore-tcp-wrappers.patch
Diffstat (limited to 'configure.ac')
-rw-r--r-- | configure.ac | 57 |
1 files changed, 57 insertions, 0 deletions
diff --git a/configure.ac b/configure.ac index 90e81e160..7f160f131 100644 --- a/configure.ac +++ b/configure.ac | |||
@@ -1404,6 +1404,62 @@ AC_ARG_WITH([skey], | |||
1404 | ] | 1404 | ] |
1405 | ) | 1405 | ) |
1406 | 1406 | ||
1407 | # Check whether user wants TCP wrappers support | ||
1408 | TCPW_MSG="no" | ||
1409 | AC_ARG_WITH([tcp-wrappers], | ||
1410 | [ --with-tcp-wrappers[[=PATH]] Enable tcpwrappers support (optionally in PATH)], | ||
1411 | [ | ||
1412 | if test "x$withval" != "xno" ; then | ||
1413 | saved_LIBS="$LIBS" | ||
1414 | saved_LDFLAGS="$LDFLAGS" | ||
1415 | saved_CPPFLAGS="$CPPFLAGS" | ||
1416 | if test -n "${withval}" && \ | ||
1417 | test "x${withval}" != "xyes"; then | ||
1418 | if test -d "${withval}/lib"; then | ||
1419 | if test -n "${need_dash_r}"; then | ||
1420 | LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}" | ||
1421 | else | ||
1422 | LDFLAGS="-L${withval}/lib ${LDFLAGS}" | ||
1423 | fi | ||
1424 | else | ||
1425 | if test -n "${need_dash_r}"; then | ||
1426 | LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}" | ||
1427 | else | ||
1428 | LDFLAGS="-L${withval} ${LDFLAGS}" | ||
1429 | fi | ||
1430 | fi | ||
1431 | if test -d "${withval}/include"; then | ||
1432 | CPPFLAGS="-I${withval}/include ${CPPFLAGS}" | ||
1433 | else | ||
1434 | CPPFLAGS="-I${withval} ${CPPFLAGS}" | ||
1435 | fi | ||
1436 | fi | ||
1437 | LIBS="-lwrap $LIBS" | ||
1438 | AC_MSG_CHECKING([for libwrap]) | ||
1439 | AC_LINK_IFELSE([AC_LANG_PROGRAM([[ | ||
1440 | #include <sys/types.h> | ||
1441 | #include <sys/socket.h> | ||
1442 | #include <netinet/in.h> | ||
1443 | #include <tcpd.h> | ||
1444 | int deny_severity = 0, allow_severity = 0; | ||
1445 | ]], [[ | ||
1446 | hosts_access(0); | ||
1447 | ]])], [ | ||
1448 | AC_MSG_RESULT([yes]) | ||
1449 | AC_DEFINE([LIBWRAP], [1], | ||
1450 | [Define if you want | ||
1451 | TCP Wrappers support]) | ||
1452 | SSHDLIBS="$SSHDLIBS -lwrap" | ||
1453 | TCPW_MSG="yes" | ||
1454 | ], [ | ||
1455 | AC_MSG_ERROR([*** libwrap missing]) | ||
1456 | |||
1457 | ]) | ||
1458 | LIBS="$saved_LIBS" | ||
1459 | fi | ||
1460 | ] | ||
1461 | ) | ||
1462 | |||
1407 | # Check whether user wants to use ldns | 1463 | # Check whether user wants to use ldns |
1408 | LDNS_MSG="no" | 1464 | LDNS_MSG="no" |
1409 | AC_ARG_WITH(ldns, | 1465 | AC_ARG_WITH(ldns, |
@@ -4853,6 +4909,7 @@ echo " KerberosV support: $KRB5_MSG" | |||
4853 | echo " SELinux support: $SELINUX_MSG" | 4909 | echo " SELinux support: $SELINUX_MSG" |
4854 | echo " Smartcard support: $SCARD_MSG" | 4910 | echo " Smartcard support: $SCARD_MSG" |
4855 | echo " S/KEY support: $SKEY_MSG" | 4911 | echo " S/KEY support: $SKEY_MSG" |
4912 | echo " TCP Wrappers support: $TCPW_MSG" | ||
4856 | echo " MD5 password support: $MD5_MSG" | 4913 | echo " MD5 password support: $MD5_MSG" |
4857 | echo " libedit support: $LIBEDIT_MSG" | 4914 | echo " libedit support: $LIBEDIT_MSG" |
4858 | echo " Solaris process contract support: $SPC_MSG" | 4915 | echo " Solaris process contract support: $SPC_MSG" |