11 files changed, 133 insertions, 5 deletions

diff --git a/configure.ac b/configure.ac
index 128889a28..eec2b727c 100644
--- a/configure.ac
+++ b/configure.ac
@@ -4213,6 +4213,29 @@ AC_ARG_WITH([kerberos5],
 AC_SUBST([GSSLIBS])
 AC_SUBST([K5LIBS])
 
+# Check whether user wants systemd support
+SYSTEMD_MSG="no"
+AC_ARG_WITH(systemd,
+        [  --with-systemd          Enable systemd support],
+        [ if test "x$withval" != "xno" ; then
+                AC_PATH_TOOL([PKGCONFIG], [pkg-config], [no])
+                if test "$PKGCONFIG" != "no"; then
+                        AC_MSG_CHECKING([for libsystemd])
+                        if $PKGCONFIG --exists libsystemd; then
+                                SYSTEMD_CFLAGS=`$PKGCONFIG --cflags libsystemd`
+                                SYSTEMD_LIBS=`$PKGCONFIG --libs libsystemd`
+                                CPPFLAGS="$CPPFLAGS $SYSTEMD_CFLAGS"
+                                SSHDLIBS="$SSHDLIBS $SYSTEMD_LIBS"
+                                AC_MSG_RESULT([yes])
+                                AC_DEFINE(HAVE_SYSTEMD, 1, [Define if you want systemd support.])
+                                SYSTEMD_MSG="yes"
+                        else
+                                AC_MSG_RESULT([no])
+                        fi
+                fi
+        fi ]
+)
+
 # Looking for programs, paths and files
 
 PRIVSEP_PATH=/var/empty
@@ -5014,6 +5037,7 @@ echo "              MD5 password support: $MD5_MSG"
 echo "                   libedit support: $LIBEDIT_MSG"
 echo "  Solaris process contract support: $SPC_MSG"
 echo "           Solaris project support: $SP_MSG"
+echo "                   systemd support: $SYSTEMD_MSG"
 echo "       IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
 echo "           Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
 echo "                  BSD Auth support: $BSD_AUTH_MSG"
diff --git a/debian/.git-dpm b/debian/.git-dpm
index a5ea18e89..b74a96d43 100644
--- a/debian/.git-dpm
+++ b/debian/.git-dpm
@@ -1,6 +1,6 @@
 # see git-dpm(1) from git-dpm package
-ed5dcc5819cd53636938bd5c30b8c5acdd1615e1
-ed5dcc5819cd53636938bd5c30b8c5acdd1615e1
+480b475c69faf9cfa748cc445e36201bc7a81b80
+480b475c69faf9cfa748cc445e36201bc7a81b80
 651211fd4a199b299540c00c54a46e27fadb04be
 651211fd4a199b299540c00c54a46e27fadb04be
 openssh_7.1p1.orig.tar.gz
diff --git a/debian/changelog b/debian/changelog
index ff9eb099d..faa138ce0 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+openssh (1:7.1p1-5) UNRELEASED; urgency=medium
+
+  [ Michael Biebl ]
+  * Add systemd readiness notification support (closes: #778913).
+
+ -- Colin Watson <cjwatson@debian.org>  Mon, 21 Dec 2015 16:10:53 +0000
+
 openssh (1:7.1p1-4) unstable; urgency=medium
 
   * Backport upstream patch to unbreak connections with peers that set
diff --git a/debian/control b/debian/control
index 8ecb3d44a..fc705b3d8 100644
--- a/debian/control
+++ b/debian/control
@@ -2,7 +2,7 @@ Source: openssh
 Section: net
 Priority: standard
 Maintainer: Debian OpenSSH Maintainers <debian-ssh@lists.debian.org>
-Build-Depends: libwrap0-dev | libwrap-dev, zlib1g-dev (>= 1:1.2.3), libssl-dev (>= 0.9.8g), libpam0g-dev | libpam-dev, libgtk2.0-dev, libedit-dev, debhelper (>= 9~), dh-exec, libselinux1-dev [linux-any], libkrb5-dev | heimdal-dev, dpkg-dev (>= 1.16.1~), dh-autoreconf, autotools-dev, dh-systemd (>= 1.4), libaudit-dev [linux-any]
+Build-Depends: libwrap0-dev | libwrap-dev, zlib1g-dev (>= 1:1.2.3), libssl-dev (>= 0.9.8g), libpam0g-dev | libpam-dev, libgtk2.0-dev, libedit-dev, debhelper (>= 9~), dh-exec, libselinux1-dev [linux-any], libkrb5-dev | heimdal-dev, dpkg-dev (>= 1.16.1~), dh-autoreconf, autotools-dev, dh-systemd (>= 1.4), libaudit-dev [linux-any], libsystemd-dev [linux-any]
 XS-Testsuite: autopkgtest
 Standards-Version: 3.9.6
 Uploaders: Colin Watson <cjwatson@debian.org>, Matthew Vernon <matthew@debian.org>
diff --git a/debian/patches/backport-fix-first-kex-follows.patch b/debian/patches/backport-fix-first-kex-follows.patch
index 0333adad1..07c86b948 100644
--- a/debian/patches/backport-fix-first-kex-follows.patch
+++ b/debian/patches/backport-fix-first-kex-follows.patch
@@ -1,4 +1,4 @@
-From ed5dcc5819cd53636938bd5c30b8c5acdd1615e1 Mon Sep 17 00:00:00 2001
+From 480b475c69faf9cfa748cc445e36201bc7a81b80 Mon Sep 17 00:00:00 2001
 From: Damien Miller <djm@mindrot.org>
 Date: Tue, 15 Dec 2015 15:25:04 +0000
 Subject: upstream commit
diff --git a/debian/patches/debian-config.patch b/debian/patches/debian-config.patch
index cfa6ef6b7..6bd50eaad 100644
--- a/debian/patches/debian-config.patch
+++ b/debian/patches/debian-config.patch
@@ -1,4 +1,4 @@
-From 9351b179c72f18dc1b1d5bb84b2a7dab5e0af3fc Mon Sep 17 00:00:00 2001
+From a466a627b806905df9c7583af7edcf39e9481201 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:18 +0000
 Subject: Various Debian-specific configuration changes
diff --git a/debian/patches/series b/debian/patches/series
index 340077745..f7eb1cc8b 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -24,5 +24,6 @@ ssh-agent-setgid.patch
 no-openssl-version-status.patch
 gnome-ssh-askpass2-icon.patch
 sigstop.patch
+systemd-readiness.patch
 debian-config.patch
 backport-fix-first-kex-follows.patch
diff --git a/debian/patches/systemd-readiness.patch b/debian/patches/systemd-readiness.patch
new file mode 100644
index 000000000..bbe3b2cd5
--- /dev/null
+++ b/debian/patches/systemd-readiness.patch
@@ -0,0 +1,84 @@
+From 818791ef8edf087481bd49eb32335c8d7e1953d6 Mon Sep 17 00:00:00 2001
+From: Michael Biebl <biebl@debian.org>
+Date: Mon, 21 Dec 2015 16:08:47 +0000
+Subject: Add systemd readiness notification support
+
+Bug-Debian: https://bugs.debian.org/778913
+Forwarded: no
+Last-Update: 2015-12-21
+
+Patch-Name: systemd-readiness.patch
+---
+ configure.ac | 24 ++++++++++++++++++++++++
+ sshd.c       |  9 +++++++++
+ 2 files changed, 33 insertions(+)
+
+diff --git a/configure.ac b/configure.ac
+index 128889a..eec2b72 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -4213,6 +4213,29 @@ AC_ARG_WITH([kerberos5],
+ AC_SUBST([GSSLIBS])
+ AC_SUBST([K5LIBS])
+ 
++# Check whether user wants systemd support
++SYSTEMD_MSG="no"
++AC_ARG_WITH(systemd,
++       [  --with-systemd          Enable systemd support],
++       [ if test "x$withval" != "xno" ; then
++               AC_PATH_TOOL([PKGCONFIG], [pkg-config], [no])
++               if test "$PKGCONFIG" != "no"; then
++                       AC_MSG_CHECKING([for libsystemd])
++                       if $PKGCONFIG --exists libsystemd; then
++                               SYSTEMD_CFLAGS=`$PKGCONFIG --cflags libsystemd`
++                               SYSTEMD_LIBS=`$PKGCONFIG --libs libsystemd`
++                               CPPFLAGS="$CPPFLAGS $SYSTEMD_CFLAGS"
++                               SSHDLIBS="$SSHDLIBS $SYSTEMD_LIBS"
++                               AC_MSG_RESULT([yes])
++                               AC_DEFINE(HAVE_SYSTEMD, 1, [Define if you want systemd support.])
++                               SYSTEMD_MSG="yes"
++                       else
++                               AC_MSG_RESULT([no])
++                       fi
++               fi
++       fi ]
++)
++
+ # Looking for programs, paths and files
+ 
+ PRIVSEP_PATH=/var/empty
+@@ -5014,6 +5037,7 @@ echo "              MD5 password support: $MD5_MSG"
+ echo "                   libedit support: $LIBEDIT_MSG"
+ echo "  Solaris process contract support: $SPC_MSG"
+ echo "           Solaris project support: $SP_MSG"
++echo "                   systemd support: $SYSTEMD_MSG"
+ echo "       IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
+ echo "           Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
+ echo "                  BSD Auth support: $BSD_AUTH_MSG"
+diff --git a/sshd.c b/sshd.c
+index 7e72b9b..4d28dc0 100644
+--- a/sshd.c
++++ b/sshd.c
+@@ -85,6 +85,10 @@
+ #include <prot.h>
+ #endif
+ 
++#ifdef HAVE_SYSTEMD
++#include <systemd/sd-daemon.h>
++#endif
++
+ #include "xmalloc.h"
+ #include "ssh.h"
+ #include "ssh1.h"
+@@ -2011,6 +2015,11 @@ main(int ac, char **av)
+        /* ignore SIGPIPE */
+        signal(SIGPIPE, SIG_IGN);
+ 
++#ifdef HAVE_SYSTEMD
++       /* Signal systemd that we are ready to accept connections */
++       sd_notify(0, "READY=1");
++#endif
++
+        /* Get a connection, either from inetd or a listening TCP socket */
+        if (inetd_flag) {
+                server_accept_inetd(&sock_in, &sock_out);
diff --git a/debian/rules b/debian/rules
index e67053cdd..01937b39e 100755
--- a/debian/rules
+++ b/debian/rules
@@ -92,6 +92,7 @@ confflags += --with-ssl-engine
 ifeq ($(DEB_HOST_ARCH_OS),linux)
 confflags += --with-selinux
 confflags += --with-audit=linux
+confflags += --with-systemd
 endif
 
 # The deb build wants xauth; the udeb build doesn't.
diff --git a/debian/systemd/ssh.service b/debian/systemd/ssh.service
index ff28d39c1..3df8c6426 100644
--- a/debian/systemd/ssh.service
+++ b/debian/systemd/ssh.service
@@ -9,6 +9,8 @@ ExecStart=/usr/sbin/sshd -D $SSHD_OPTS
 ExecReload=/bin/kill -HUP $MAINPID
 KillMode=process
 Restart=on-failure
+RestartPreventExitStatus=255
+Type=notify
 
 [Install]
 WantedBy=multi-user.target
diff --git a/sshd.c b/sshd.c
index 7e72b9b84..4d28dc0aa 100644
--- a/sshd.c
+++ b/sshd.c
@@ -85,6 +85,10 @@
 #include <prot.h>
 #endif
 
+#ifdef HAVE_SYSTEMD
+#include <systemd/sd-daemon.h>
+#endif
+
 #include "xmalloc.h"
 #include "ssh.h"
 #include "ssh1.h"
@@ -2011,6 +2015,11 @@ main(int ac, char **av)
         /* ignore SIGPIPE */
         signal(SIGPIPE, SIG_IGN);
 
+#ifdef HAVE_SYSTEMD
+        /* Signal systemd that we are ready to accept connections */
+        sd_notify(0, "READY=1");
+#endif
+
         /* Get a connection, either from inetd or a listening TCP socket */
         if (inetd_flag) {
                 server_accept_inetd(&sock_in, &sock_out);