meta-google: Fold gbmc-sslh into gbmc-ncsi-config
Logically these packages belong together and don't make much sense
without each other. Combine them to reduce package complexity for users.
Change-Id: I3d3998f8d10cacbd01f6d883b0033a3260ff60df
Signed-off-by: William A. Kennington III <wak@google.com>
diff --git a/meta-google/recipes-google/ncsi/files/gbmc-ncsi-sslh.service b/meta-google/recipes-google/ncsi/files/gbmc-ncsi-sslh.service
new file mode 100644
index 0000000..b6bc04a
--- /dev/null
+++ b/meta-google/recipes-google/ncsi/files/gbmc-ncsi-sslh.service
@@ -0,0 +1,20 @@
+[Unit]
+Description=SSL/SSH multiplexer
+Requires=sslh.socket
+
+[Service]
+ExecStart=/usr/sbin/sslh -n -f --ssh [::1]:22 --http [::1]:80 --tls [::1]:443
+KillMode=process
+#Hardening
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectControlGroups=true
+MountFlags=private
+NoNewPrivileges=true
+PrivateDevices=true
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+MemoryDenyWriteExecute=true
+DynamicUser=true
diff --git a/meta-google/recipes-google/ncsi/files/gbmc-ncsi-sslh.socket.in b/meta-google/recipes-google/ncsi/files/gbmc-ncsi-sslh.socket.in
new file mode 100644
index 0000000..9e5f594
--- /dev/null
+++ b/meta-google/recipes-google/ncsi/files/gbmc-ncsi-sslh.socket.in
@@ -0,0 +1,9 @@
+[Unit]
+Before=sslh.service
+
+[Socket]
+BindToDevice=@NCSI_IF@
+ListenStream=3967
+
+[Install]
+WantedBy=sockets.target
diff --git a/meta-google/recipes-google/ncsi/gbmc-ncsi-config.bb b/meta-google/recipes-google/ncsi/gbmc-ncsi-config.bb
index 67388b2..41d6976 100644
--- a/meta-google/recipes-google/ncsi/gbmc-ncsi-config.bb
+++ b/meta-google/recipes-google/ncsi/gbmc-ncsi-config.bb
@@ -5,18 +5,29 @@
inherit systemd
-SRC_URI += "file://50-gbmc-ncsi.rules.in"
+SRC_URI += " \
+ file://50-gbmc-ncsi.rules.in \
+ file://gbmc-ncsi-sslh.socket.in \
+ file://gbmc-ncsi-sslh.service \
+ "
S = "${WORKDIR}"
-RDEPENDS_${PN} += "ncsid"
-RDEPENDS_${PN} += "nftables-systemd"
-RDEPENDS_${PN} += "gbmc-sslh"
+RDEPENDS_${PN} += " \
+ ncsid \
+ nftables-systemd \
+ sslh \
+ "
FILES_${PN} += "${systemd_unitdir}"
RPROVIDES_${PN} += "ncsid-config"
+SYSTEMD_SERVICE_${PN} += " \
+ gbmc-ncsi-sslh.service \
+ gbmc-ncsi-sslh.socket \
+ "
+
do_install_append() {
if_name='${GBMC_NCSI_IF_NAME}'
test -z "$if_name" && if_name='${NCSID_IF_NAME}'
@@ -49,4 +60,8 @@
wantdir=${D}${systemd_system_unitdir}/multi-user.target.wants
install -d -m0755 "$wantdir"
ln -sv ../ncsid@.service "$wantdir"/ncsid@$if_name.service
+
+ install -m 0644 ${WORKDIR}/gbmc-ncsi-sslh.service ${D}${systemd_system_unitdir}
+ sed "s,@NCSI_IF@,$if_name," ${WORKDIR}/gbmc-ncsi-sslh.socket.in \
+ >${D}${systemd_system_unitdir}/gbmc-ncsi-sslh.socket
}