[PATCH] meta-test: Disable sshd socket activation for CI purpose

[PATCH] meta-test: Disable sshd socket activation for CI purpose

[Uladzimir Bely]

Openssh-server package in Debian comes with socket activation enabled.
This means that every command executed over ssh by CI scripts starts
new sshd instance on target.

Sometimes, this makes CI fail: another SSH "ping" or command may fail
even if all the previous "pings" were OK.

SSH "ping" with debug, when qemu machine is starting:

```
while true; do
  ssh -o ConnectTimeout=5 -p 47457 <options> ci@localhost /bin/true;
  echo $?;
  sleep 1;
done
```

Output:

```
Connection timed out during banner exchange
Connection to 127.0.0.1 port 47457 timed out
255
Connection timed out during banner exchange
Connection to 127.0.0.1 port 47457 timed out
255
0
0
0
kex_exchange_identification: Connection closed by remote host
Connection closed by 127.0.0.1 port 47457
255
0
0
0
```

Disabling socket activation by setting corresponding system-preset
fixes the issue.

Signed-off-by: Uladzimir Bely <ubely@ilbers.de>
---
 .../isar-ci-ssh-setup/files/99-disable-ssh-socket.preset      | 4 ++++
 .../recipes-ci/isar-ci-ssh-setup/isar-ci-ssh-setup_0.1.bb     | 4 ++++
 2 files changed, 8 insertions(+)
 create mode 100644 meta-test/recipes-ci/isar-ci-ssh-setup/files/99-disable-ssh-socket.preset

diff --git a/meta-test/recipes-ci/isar-ci-ssh-setup/files/99-disable-ssh-socket.preset b/meta-test/recipes-ci/isar-ci-ssh-setup/files/99-disable-ssh-socket.preset
new file mode 100644
index 00000000..aced69e1
--- /dev/null
+++ b/meta-test/recipes-ci/isar-ci-ssh-setup/files/99-disable-ssh-socket.preset
@@ -0,0 +1,4 @@
+# This software is a part of ISAR.
+# Copyright (C) 2023 ilbers GmbH
+
+disable ssh.socket
diff --git a/meta-test/recipes-ci/isar-ci-ssh-setup/isar-ci-ssh-setup_0.1.bb b/meta-test/recipes-ci/isar-ci-ssh-setup/isar-ci-ssh-setup_0.1.bb
index 74fecf92..4693f647 100644
--- a/meta-test/recipes-ci/isar-ci-ssh-setup/isar-ci-ssh-setup_0.1.bb
+++ b/meta-test/recipes-ci/isar-ci-ssh-setup/isar-ci-ssh-setup_0.1.bb
@@ -5,6 +5,7 @@ MAINTAINER = "Uladzimir Bely <uladzimir.bely@ilbers.de>"
 
 SRC_URI = " \
     file://postinst \
+    file://99-disable-ssh-socket.preset \
 "
 
 DEPENDS += "sshd-regen-keys"
@@ -19,4 +20,7 @@ do_install() {
 
     # Manage all interfaces (including ethernet) by NetworkManager
     install -D -m 644 /dev/null ${D}/etc/NetworkManager/conf.d/10-globally-managed-devices.conf
+
+    # Disable socket activation for ssh server
+    install -D -m 644 ${WORKDIR}/99-disable-ssh-socket.preset ${D}/lib/systemd/system-preset/99-disable-ssh-socket.preset
 }
-- 
2.20.1

Re: [PATCH] meta-test: Disable sshd socket activation for CI purpose

[Bezdeka, Florian]

On Wed, 2023-07-05 at 06:48 +0200, Uladzimir Bely wrote:
> +
> +    # Disable socket activation for ssh server
> +    install -D -m 644 ${WORKDIR}/99-disable-ssh-socket.preset ${D}/lib/systemd/system-preset/99-disable-ssh-socket.preset


Two questions:

a) Why ${D}/lib, I would have used ${D}/usr/lib, but

b) Isn't that something "device" specific or a
"customization"?Shouldn't go it to /etc/systemd instead?

Florian

Re: [PATCH] meta-test: Disable sshd socket activation for CI purpose

[Uladzimir Bely]

On Wed, 2023-07-05 at 09:13 +0000, Bezdeka, Florian wrote:
> On Wed, 2023-07-05 at 06:48 +0200, Uladzimir Bely wrote:
> > +
> > +    # Disable socket activation for ssh server
> > +    install -D -m 644 ${WORKDIR}/99-disable-ssh-socket.preset
> > ${D}/lib/systemd/system-preset/99-disable-ssh-socket.preset
> 
> 
> Two questions:
> 
> a) Why ${D}/lib, I would have used ${D}/usr/lib, but
> 

When look at openssh-server package file list (e.g.
https://packages.debian.org/ru/sid/armhf/openssh-server/filelist ) we
can see it installs .service and .socket files to /lib/systemd. I find
it reasonable to install .preset file to the similar location.

> b) Isn't that something "device" specific or a
> "customization"?Shouldn't go it to /etc/systemd instead?
> 

It may be placed to /etc/systemd. But in this case I'm not sure that
preset would be removed together with "isar-ci-ssh-setup" package, if
user wants to do it.

I'm not sure if this is really something device-specific, but at least
we quite often observed this on qemu targets in CI.

> Florian

Re: [PATCH] meta-test: Disable sshd socket activation for CI purpose

[Uladzimir Bely]

On Wed, 2023-07-05 at 06:48 +0200, Uladzimir Bely wrote:
> Openssh-server package in Debian comes with socket activation
> enabled.
> This means that every command executed over ssh by CI scripts starts
> new sshd instance on target.
> 
> Sometimes, this makes CI fail: another SSH "ping" or command may fail
> even if all the previous "pings" were OK.
> 
> SSH "ping" with debug, when qemu machine is starting:
> 
> ```
> while true; do
>   ssh -o ConnectTimeout=5 -p 47457 <options> ci@localhost /bin/true;
>   echo $?;
>   sleep 1;
> done
> ```
> 
> Output:
> 
> ```
> Connection timed out during banner exchange
> Connection to 127.0.0.1 port 47457 timed out
> 255
> Connection timed out during banner exchange
> Connection to 127.0.0.1 port 47457 timed out
> 255
> 0
> 0
> 0
> kex_exchange_identification: Connection closed by remote host
> Connection closed by 127.0.0.1 port 47457
> 255
> 0
> 0
> 0
> ```
> 
> Disabling socket activation by setting corresponding system-preset
> fixes the issue.
> 
> Signed-off-by: Uladzimir Bely <ubely@ilbers.de>
> ---
>  .../isar-ci-ssh-setup/files/99-disable-ssh-socket.preset      | 4
> ++++
>  .../recipes-ci/isar-ci-ssh-setup/isar-ci-ssh-setup_0.1.bb     | 4
> ++++
>  2 files changed, 8 insertions(+)
>  create mode 100644 meta-test/recipes-ci/isar-ci-ssh-setup/files/99-
> disable-ssh-socket.preset
> 
> diff --git a/meta-test/recipes-ci/isar-ci-ssh-setup/files/99-disable-
> ssh-socket.preset b/meta-test/recipes-ci/isar-ci-ssh-setup/files/99-
> disable-ssh-socket.preset
> new file mode 100644
> index 00000000..aced69e1
> --- /dev/null
> +++ b/meta-test/recipes-ci/isar-ci-ssh-setup/files/99-disable-ssh-
> socket.preset
> @@ -0,0 +1,4 @@
> +# This software is a part of ISAR.
> +# Copyright (C) 2023 ilbers GmbH
> +
> +disable ssh.socket
> diff --git a/meta-test/recipes-ci/isar-ci-ssh-setup/isar-ci-ssh-
> setup_0.1.bb b/meta-test/recipes-ci/isar-ci-ssh-setup/isar-ci-ssh-
> setup_0.1.bb
> index 74fecf92..4693f647 100644
> --- a/meta-test/recipes-ci/isar-ci-ssh-setup/isar-ci-ssh-setup_0.1.bb
> +++ b/meta-test/recipes-ci/isar-ci-ssh-setup/isar-ci-ssh-setup_0.1.bb
> @@ -5,6 +5,7 @@ MAINTAINER = "Uladzimir Bely
> <uladzimir.bely@ilbers.de>"
>  
>  SRC_URI = " \
>      file://postinst \
> +    file://99-disable-ssh-socket.preset \
>  "
>  
>  DEPENDS += "sshd-regen-keys"
> @@ -19,4 +20,7 @@ do_install() {
>  
>      # Manage all interfaces (including ethernet) by NetworkManager
>      install -D -m 644 /dev/null ${D}/etc/NetworkManager/conf.d/10-
> globally-managed-devices.conf
> +
> +    # Disable socket activation for ssh server
> +    install -D -m 644 ${WORKDIR}/99-disable-ssh-socket.preset
> ${D}/lib/systemd/system-preset/99-disable-ssh-socket.preset
>  }
> -- 
> 2.20.1
> 

Applied to next.