#!/bin/sh
set -e

. /usr/share/debconf/confmodule
db_version 2.0

action="$1"

umask 022


# The path to /usr/sbin/sshd is intentionally *not* prefixed by $DPKG_ROOT
# because when dpkg is called with --force-script-chrootless then this is in
# situations where we cannot execute binaries of the system which dpkg is
# told to install packages in and thus it cannot do a chroot() call. Instead,
# we use tools installed outside of the chroot and tell those tools to
# operate on the chroot at the location given by $DPKG_ROOT.
get_config_option() {
	option="$1"
	sshd_path=/usr/sbin/sshd

	[ -f "$DPKG_ROOT/etc/ssh/sshd_config" ] || return

	# begin-remove-after: released:forky
	if [ -e /usr/sbin/sshd.session-split ]; then
		sshd_path=/usr/sbin/sshd.session-split
	fi
	# end-remove-after
	"$sshd_path" -f "$DPKG_ROOT/etc/ssh/sshd_config" -G | sed -n "s/^$option //Ip"
}


create_key() {
	msg="$1"
	shift
	hostkeys="$1"
	shift
	file="$1"
	shift

	if echo "$hostkeys" | grep -x "$file" >/dev/null && \
	   [ ! -f "$DPKG_ROOT$file" ] ; then
		printf %s "$msg"
		ssh-keygen -q -f "$DPKG_ROOT$file" -N '' "$@"
		echo
		if command -v restorecon >/dev/null 2>&1; then
			restorecon "$DPKG_ROOT$file" "$DPKG_ROOT$file.pub"
		fi
		ssh-keygen -l -f "$DPKG_ROOT$file.pub"
	fi
}


create_keys() {
	hostkeys="$(get_config_option HostKey)"

	create_key "Creating SSH2 RSA key; this may take some time ..." \
		"$hostkeys" /etc/ssh/ssh_host_rsa_key -t rsa
	create_key "Creating SSH2 ECDSA key; this may take some time ..." \
		"$hostkeys" /etc/ssh/ssh_host_ecdsa_key -t ecdsa
	create_key "Creating SSH2 ED25519 key; this may take some time ..." \
		"$hostkeys" /etc/ssh/ssh_host_ed25519_key -t ed25519
}


new_config=

cleanup() {
	if [ "$new_config" ]; then
		rm -f "$new_config"
	fi
}


create_sshdconfig() {
	# XXX cjwatson 2016-12-24: This debconf template is very confusingly
	# named; its description is "Disable SSH password authentication for
	# root?", so true -> prohibit-password (the upstream default),
	# false -> yes.
	db_get openssh-server/permit-root-login
	permit_root_login="$RET"
	db_get openssh-server/password-authentication
	password_authentication="$RET"

	trap cleanup EXIT
	new_config="$(mktemp)"
	cp -aZ "$DPKG_ROOT/usr/share/openssh/sshd_config" "$new_config"
	if [ "$permit_root_login" != true ]; then
		sed -i 's/^#*PermitRootLogin .*/PermitRootLogin yes/' \
			"$new_config"
	fi
	if [ "$password_authentication" != true ]; then
		sed -i 's/^#PasswordAuthentication .*/PasswordAuthentication no/' \
			"$new_config"
	fi
	mkdir -pZ "$DPKG_ROOT/etc/ssh"
	ucf --three-way --debconf-ok \
		--sum-file "$DPKG_ROOT/usr/share/openssh/sshd_config.md5sum" \
		"$new_config" /etc/ssh/sshd_config
	ucfr openssh-server /etc/ssh/sshd_config
}

if [ "$action" = configure ]; then
	create_sshdconfig
	create_keys
	# begin-remove-after: released:forky
	if [ -e "$DPKG_ROOT/usr/sbin/sshd.session-split" ]; then
		# We're ready to restart the listener process so that it
		# executes sshd-session rather than sshd for new
		# connections, so we can remove this diversion now.  This
		# starts a brief window where new connections will fail
		# (ending when the service is restarted), but at least it's
		# all contained within this postinst.
		#
		# See openssh-server.preinst for why we use this odd package
		# name.
		echo "Finishing upgrade from pre-9.8 monolithic sshd ..."
		dpkg-divert --package openssh-client --remove --no-rename \
			--divert /usr/sbin/sshd.session-split /usr/sbin/sshd
		mv -f "$DPKG_ROOT/usr/sbin/sshd.session-split" "$DPKG_ROOT/usr/sbin/sshd"
	fi
	# end-remove-after
fi

# Automatically added by dh_installsysusers/14.3
if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ] || [ "$1" = "abort-deconfigure" ] || [ "$1" = "abort-remove" ] ; then
   systemd-sysusers ${DPKG_ROOT:+--root="$DPKG_ROOT"} openssh-server.conf
fi
# End automatically added section
# Automatically added by dh_installtmpfiles/14.3
if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ] || [ "$1" = "abort-deconfigure" ] || [ "$1" = "abort-remove" ] ; then
	systemd-tmpfiles ${DPKG_ROOT:+--root="$DPKG_ROOT"} --create openssh-server.conf
fi
# End automatically added section
# Automatically added by dh_runit/2.16.7
# Unlike postrm, I can be sure, that runit-helper is present on
# postinst.
if [ -z "${DPKG_ROOT:-}" ] && [ -x /usr/lib/runit-helper/runit-helper ]; then
    NAME='ssh' ENABLE='yes' ONUPGRADE='restart' /usr/lib/runit-helper/runit-helper postinst "$@"
fi
# End automatically added section
# Automatically added by dh_installinit/14.3
if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ] || [ "$1" = "abort-deconfigure" ] || [ "$1" = "abort-remove" ] ; then
	if [ -x "$DPKG_ROOT/etc/init.d/ssh" ]; then
		update-rc.d ssh defaults >/dev/null
		if [ -n "$2" ]; then
			_dh_action=restart
		else
			_dh_action=start
		fi
		if [ -z "$DPKG_ROOT" ]; then
			invoke-rc.d --skip-systemd-native ssh $_dh_action || exit 1
		fi
	fi
fi
# End automatically added section
# Automatically added by dh_installsystemd/14.3
if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ] || [ "$1" = "abort-deconfigure" ] || [ "$1" = "abort-remove" ] ; then
	# The following line should be removed in trixie or trixie+1
	deb-systemd-helper unmask 'ssh.service' >/dev/null || true

	# was-enabled defaults to true, so new installations run enable.
	if deb-systemd-helper --quiet was-enabled 'ssh.service'; then
		# Enables the unit on first installation, creates new
		# symlinks on upgrades if the unit file has changed.
		deb-systemd-helper enable 'ssh.service' >/dev/null || true
	else
		# Update the statefile to add new symlinks (if any), which need to be
		# cleaned up on purge. Also remove old symlinks.
		deb-systemd-helper update-state 'ssh.service' >/dev/null || true
	fi
fi
# End automatically added section
# Automatically added by dh_installsystemd/14.3
if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ] || [ "$1" = "abort-deconfigure" ] || [ "$1" = "abort-remove" ] ; then
	if [ -z "$DPKG_ROOT" ] && [ -d /run/systemd/system ]; then
		systemctl --system daemon-reload >/dev/null || true
		if [ -n "$2" ]; then
			_dh_action=restart
		else
			_dh_action=start
		fi
		deb-systemd-invoke $_dh_action 'ssh.service' >/dev/null || true
	fi
fi
# End automatically added section
# Automatically added by dh_installsystemd/14.3
if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ] || [ "$1" = "abort-deconfigure" ] || [ "$1" = "abort-remove" ] ; then
	if deb-systemd-helper debian-installed 'ssh.socket'; then
		# The following line should be removed in trixie or trixie+1
		deb-systemd-helper unmask 'ssh.socket' >/dev/null || true

		if deb-systemd-helper --quiet was-enabled 'ssh.socket'; then
			# Create new symlinks, if any.
			deb-systemd-helper enable 'ssh.socket' >/dev/null || true
		fi
	fi

	# Update the statefile to add new symlinks (if any), which need to be cleaned
	# up on purge. Also remove old symlinks.
	deb-systemd-helper update-state 'ssh.socket' >/dev/null || true
fi
# End automatically added section
# Automatically added by dh_installsystemd/14.3
if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ] || [ "$1" = "abort-deconfigure" ] || [ "$1" = "abort-remove" ] ; then
	if [ -z "$DPKG_ROOT" ] && [ -d /run/systemd/system ]; then
		systemctl --system daemon-reload >/dev/null || true
		if [ -n "$2" ]; then
			_dh_action=restart
		else
			_dh_action=start
		fi
		deb-systemd-invoke $_dh_action 'ssh.socket' >/dev/null || true
	fi
fi
# End automatically added section
# Automatically added by dh_installsystemd/14.3
if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ] || [ "$1" = "abort-deconfigure" ] || [ "$1" = "abort-remove" ] ; then
	# The following line should be removed in trixie or trixie+1
	deb-systemd-helper unmask 'sshd-keygen.service' >/dev/null || true

	# was-enabled defaults to true, so new installations run enable.
	if deb-systemd-helper --quiet was-enabled 'sshd-keygen.service'; then
		# Enables the unit on first installation, creates new
		# symlinks on upgrades if the unit file has changed.
		deb-systemd-helper enable 'sshd-keygen.service' >/dev/null || true
	else
		# Update the statefile to add new symlinks (if any), which need to be
		# cleaned up on purge. Also remove old symlinks.
		deb-systemd-helper update-state 'sshd-keygen.service' >/dev/null || true
	fi
fi
# End automatically added section
# Automatically added by dh_installsystemd/14.3
if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ] || [ "$1" = "abort-deconfigure" ] || [ "$1" = "abort-remove" ] ; then
	if [ -z "$DPKG_ROOT" ] && [ -d /run/systemd/system ]; then
		systemctl --system daemon-reload >/dev/null || true
		if [ -n "$2" ]; then
			_dh_action=restart
		else
			_dh_action=start
		fi
		deb-systemd-invoke $_dh_action 'sshd-keygen.service' >/dev/null || true
	fi
fi
# End automatically added section


db_stop

exit 0