[gnome-continuous-yocto/gnomeostree-3.28-rocko: 6232/8267] openssh: allow to override OpenSSL HostKeys when read-only-rootfs

[Emmanuele Bassi <ebassi src gnome org>]

commit 00e83cb02954b61ecfa9f30f6779ec323b95197c
Author: André Draszik <adraszik tycoint com>
Date:   Fri Jun 9 14:38:14 2017 +0100

    openssh: allow to override OpenSSL HostKeys when read-only-rootfs
    
    With these changes it is possible to have a .bbappend that
    - sets SYSCONFDIR to some persistent storage
    - modifies SYSCONFDIR/sshd_config to use ssh host keys from
      the (writable) sysconfdir
    
    (From OE-Core rev: 106b59d9f96f70d133fa1421091ad280d27a5b6a)
    
    Signed-off-by: André Draszik <adraszik tycoint com>
    Reviewed-by: Stephane Ayotte <sayotte tycoint com>
    Signed-off-by: Ross Burton <ross burton intel com>
    Signed-off-by: Richard Purdie <richard purdie linuxfoundation org>

 meta/classes/rootfs-postcommands.bbclass       |    4 +-
 meta/recipes-connectivity/openssh/openssh/init |   46 +++++++++++++++++++++--
 2 files changed, 44 insertions(+), 6 deletions(-)
---
diff --git a/meta/classes/rootfs-postcommands.bbclass b/meta/classes/rootfs-postcommands.bbclass
index 1d66a42..78f7c55 100644
--- a/meta/classes/rootfs-postcommands.bbclass
+++ b/meta/classes/rootfs-postcommands.bbclass
@@ -93,10 +93,10 @@ read_only_rootfs_hook () {
        # and the keys under /var/run/ssh.
        if [ -d ${IMAGE_ROOTFS}/etc/ssh ]; then
                if [ -e ${IMAGE_ROOTFS}/etc/ssh/ssh_host_rsa_key ]; then
-                       echo "SYSCONFDIR=/etc/ssh" >> ${IMAGE_ROOTFS}/etc/default/ssh
+                       echo "SYSCONFDIR=\${SYSCONFDIR:-/etc/ssh}" >> ${IMAGE_ROOTFS}/etc/default/ssh
                        echo "SSHD_OPTS=" >> ${IMAGE_ROOTFS}/etc/default/ssh
                else
-                       echo "SYSCONFDIR=/var/run/ssh" >> ${IMAGE_ROOTFS}/etc/default/ssh
+                       echo "SYSCONFDIR=\${SYSCONFDIR:-/var/run/ssh}" >> ${IMAGE_ROOTFS}/etc/default/ssh
                        echo "SSHD_OPTS='-f /etc/ssh/sshd_config_readonly'" >> ${IMAGE_ROOTFS}/etc/default/ssh
                fi
        fi
diff --git a/meta/recipes-connectivity/openssh/openssh/init b/meta/recipes-connectivity/openssh/openssh/init
index 1f63725..386628a 100644
--- a/meta/recipes-connectivity/openssh/openssh/init
+++ b/meta/recipes-connectivity/openssh/openssh/init
@@ -19,10 +19,24 @@ fi
 [ -z "$SYSCONFDIR" ] && SYSCONFDIR=/etc/ssh
 mkdir -p $SYSCONFDIR
 
-HOST_KEY_RSA=$SYSCONFDIR/ssh_host_rsa_key
-HOST_KEY_DSA=$SYSCONFDIR/ssh_host_dsa_key
-HOST_KEY_ECDSA=$SYSCONFDIR/ssh_host_ecdsa_key
-HOST_KEY_ED25519=$SYSCONFDIR/ssh_host_ed25519_key
+parse_sshd_opts() {
+    set -- ${SSHD_OPTS} --
+    sshd_config=/etc/ssh/sshd_config
+    while true ; do
+        case "$1" in
+        -f*) if [ "$1" = "-f" ] ; then
+                 sshd_config="$2"
+                 shift
+             else
+                 sshd_config="${1#-f}"
+             fi
+             shift
+             ;;
+        --) shift; break;;
+        *) shift;;
+        esac
+    done
+}
 
 check_for_no_start() {
     # forget it if we're trying to start, and /etc/ssh/sshd_not_to_be_run exists
@@ -45,21 +59,45 @@ check_config() {
 }
 
 check_keys() {
+       # parse location of keys
+       local HOST_KEY_RSA
+       local HOST_KEY_DSA
+       local HOST_KEY_ECDSA
+       local HOST_KEY_ED25519
+
+       parse_sshd_opts
+       HOST_KEY_RSA=$(grep ^HostKey "${sshd_config}" | grep _rsa_ | tail -1 | awk ' { print $2 } ')
+       [ -z "${HOST_KEY_RSA}" ] && HOST_KEY_RSA=$(grep HostKey "${sshd_config}" | grep _rsa_ | tail -1 | awk 
' { print $2 } ')
+       [ -z "${HOST_KEY_RSA}" ] && HOST_KEY_RSA=$SYSCONFDIR/ssh_host_rsa_key
+       HOST_KEY_DSA=$(grep ^HostKey "${sshd_config}" | grep _dsa_ | tail -1 | awk ' { print $2 } ')
+       [ -z "${HOST_KEY_DSA}" ] && HOST_KEY_DSA=$(grep HostKey "${sshd_config}" | grep _dsa_ | tail -1 | awk 
' { print $2 } ')
+       [ -z "${HOST_KEY_DSA}" ] && HOST_KEY_DSA=$SYSCONFDIR/ssh_host_dsa_key
+       HOST_KEY_ECDSA=$(grep ^HostKey "${sshd_config}" | grep _ecdsa_ | tail -1 | awk ' { print $2 } ')
+       [ -z "${HOST_KEY_ECDSA}" ] && HOST_KEY_ECDSA=$(grep HostKey "${sshd_config}" | grep _ecdsa_ | tail -1 
| awk ' { print $2 } ')
+       [ -z "${HOST_KEY_ECDSA}" ] && HOST_KEY_ECDSA=$SYSCONFDIR/ssh_host_ecdsa_key
+       HOST_KEY_ED25519=$(grep ^HostKey "${sshd_config}" | grep _ed25519_ | tail -1 | awk ' { print $2 } ')
+       [ -z "${HOST_KEY_ED25519}" ] && HOST_KEY_ED25519=$(grep HostKey "${sshd_config}" | grep _ed25519_ | 
tail -1 | awk ' { print $2 } ')
+       [ -z "${HOST_KEY_ED25519}" ] && HOST_KEY_ED25519=$SYSCONFDIR/ssh_host_ed25519_key
+
        # create keys if necessary
        if [ ! -f $HOST_KEY_RSA ]; then
                echo "  generating ssh RSA key..."
+               mkdir -p $(dirname $HOST_KEY_RSA)
                ssh-keygen -q -f $HOST_KEY_RSA -N '' -t rsa
        fi
        if [ ! -f $HOST_KEY_ECDSA ]; then
                echo "  generating ssh ECDSA key..."
+               mkdir -p $(dirname $HOST_KEY_ECDSA)
                ssh-keygen -q -f $HOST_KEY_ECDSA -N '' -t ecdsa
        fi
        if [ ! -f $HOST_KEY_DSA ]; then
                echo "  generating ssh DSA key..."
+               mkdir -p $(dirname $HOST_KEY_DSA)
                ssh-keygen -q -f $HOST_KEY_DSA -N '' -t dsa
        fi
        if [ ! -f $HOST_KEY_ED25519 ]; then
                echo "  generating ssh ED25519 key..."
+               mkdir -p $(dirname $HOST_KEY_ED25519)
                ssh-keygen -q -f $HOST_KEY_ED25519 -N '' -t ed25519
        fi
 }