mirror of
https://github.com/coolsnowwolf/lede.git
synced 2025-04-16 04:13:31 +00:00
Revert "dropbear: allow build without dbclient"
This reverts commit 5446d77b69.
This commit is contained in:
coolsnowwolf
parent
7bed000e3b
commit
1684c010ef
@ -6,11 +6,11 @@ PKG_RELEASE=1
|
||||
PKG_LICENSE:=GPLv2
|
||||
PKG_LICENSE_FILES:=
|
||||
|
||||
PKG_SOURCE_URL:=https://github.com/openwrt/mt76
|
||||
PKG_SOURCE_URL:=https://github.com/MeIsReallyBa/mt76
|
||||
PKG_SOURCE_PROTO:=git
|
||||
PKG_SOURCE_DATE:=2019-03-27
|
||||
PKG_SOURCE_VERSION:=a11b67348aeb2d3175c5995c747e7fc050c7df60
|
||||
PKG_MIRROR_HASH:=6ea603308fa568c8ab39eddd86d9c8110a10aa93971348f52ceda0e5bd423ec6
|
||||
PKG_SOURCE_DATE:=2019-04-08
|
||||
PKG_SOURCE_VERSION:=879ca1466193153b5ee47e2789645a9b6c4404fc
|
||||
PKG_MIRROR_HASH:=
|
||||
|
||||
PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
|
||||
PKG_BUILD_PARALLEL:=1
|
||||
@ -23,7 +23,8 @@ PKG_CONFIG_DEPENDS += \
|
||||
CONFIG_PACKAGE_kmod-mt76x2-common \
|
||||
CONFIG_PACKAGE_kmod-mt76x2 \
|
||||
CONFIG_PACKAGE_kmod-mt76x2u \
|
||||
CONFIG_PACKAGE_kmod-mt7603
|
||||
CONFIG_PACKAGE_kmod-mt7603 \
|
||||
CONFIG_PACKAGE_kmod-mt7615
|
||||
|
||||
STAMP_CONFIGURED_DEPENDS := $(STAGING_DIR)/usr/include/mac80211-backport/backport/autoconf.h
|
||||
|
||||
@ -129,6 +130,15 @@ define KernelPackage/mt76x2
|
||||
AUTOLOAD:=$(call AutoProbe,mt76x2e)
|
||||
endef
|
||||
|
||||
define KernelPackage/mt7615
|
||||
$(KernelPackage/mt76-default)
|
||||
TITLE:=MediaTek MT7615 wireless driver
|
||||
DEPENDS+=@PCI_SUPPORT +kmod-mt76-core
|
||||
FILES:=\
|
||||
$(PKG_BUILD_DIR)/mt7615/mt7615e.ko
|
||||
AUTOLOAD:=$(call AutoProbe,mt7615e)
|
||||
endef
|
||||
|
||||
define KernelPackage/mt7603
|
||||
$(KernelPackage/mt76-default)
|
||||
TITLE:=MediaTek MT7603 wireless driver
|
||||
@ -178,6 +188,9 @@ endif
|
||||
ifdef CONFIG_PACKAGE_kmod-mt76x2u
|
||||
PKG_MAKE_FLAGS += CONFIG_MT76x2U=m
|
||||
endif
|
||||
ifdef CONFIG_PACKAGE_kmod-mt7615
|
||||
PKG_MAKE_FLAGS += CONFIG_MT7615E=m
|
||||
endif
|
||||
ifdef CONFIG_PACKAGE_kmod-mt7603
|
||||
PKG_MAKE_FLAGS += CONFIG_MT7603E=m
|
||||
endif
|
||||
@ -221,6 +234,12 @@ define KernelPackage/mt76x2u/install
|
||||
ln -sf ../mt7662_rom_patch.bin $(1)/lib/firmware/mediatek/mt7662u_rom_patch.bin
|
||||
endef
|
||||
|
||||
define KernelPackage/mt7615/install
|
||||
$(INSTALL_DIR) $(1)/lib/firmware
|
||||
cp $(PKG_BUILD_DIR)/firmware/mt7615_rom_patch.bin $(PKG_BUILD_DIR)/firmware/mt7615_n9.bin $(PKG_BUILD_DIR)/firmware/mt7615_cr4.bin \
|
||||
$(1)/lib/firmware/
|
||||
endef
|
||||
|
||||
define KernelPackage/mt7603/install
|
||||
$(INSTALL_DIR) $(1)/lib/firmware
|
||||
cp $(if $(CONFIG_TARGET_ramips_mt76x8), \
|
||||
@ -243,5 +262,6 @@ $(eval $(call KernelPackage,mt76x0u))
|
||||
$(eval $(call KernelPackage,mt76x2-common))
|
||||
$(eval $(call KernelPackage,mt76x2u))
|
||||
$(eval $(call KernelPackage,mt76x2))
|
||||
$(eval $(call KernelPackage,mt7615))
|
||||
$(eval $(call KernelPackage,mt7603))
|
||||
$(eval $(call KernelPackage,mt76))
|
||||
$(eval $(call KernelPackage,mt76))
|
||||
@ -8,46 +8,29 @@ config DROPBEAR_CURVE25519
|
||||
This enables the following key exchange algorithm:
|
||||
curve25519-sha256@libssh.org
|
||||
|
||||
Increases binary size by about 8 kB uncompressed (MIPS).
|
||||
Increases binary size by about 13 kB uncompressed (MIPS).
|
||||
|
||||
config DROPBEAR_ECC
|
||||
bool "Elliptic curve cryptography (ECC)"
|
||||
default n
|
||||
help
|
||||
Enables basic support for elliptic curve cryptography (ECC)
|
||||
in key exchange and public key authentication.
|
||||
Enables elliptic curve cryptography (ECC) support in key exchange and public key
|
||||
authentication.
|
||||
|
||||
Key exchange algorithms:
|
||||
ecdh-sha2-nistp256
|
||||
|
||||
Public key algorithms:
|
||||
ecdsa-sha2-nistp256
|
||||
|
||||
Increases binary size by about 24 kB (MIPS).
|
||||
|
||||
If full ECC support is required, also select DROPBEAR_ECC_FULL.
|
||||
|
||||
config DROPBEAR_ECC_FULL
|
||||
bool "Elliptic curve cryptography (ECC), full support"
|
||||
default n
|
||||
depends on DROPBEAR_ECC
|
||||
help
|
||||
Enables full support for elliptic curve cryptography (ECC)
|
||||
in key exchange and public key authentication.
|
||||
|
||||
Key exchange algorithms:
|
||||
ecdh-sha2-nistp256 (*)
|
||||
ecdh-sha2-nistp384
|
||||
ecdh-sha2-nistp521
|
||||
|
||||
Public key algorithms:
|
||||
ecdsa-sha2-nistp256 (*)
|
||||
ecdsa-sha2-nistp256
|
||||
ecdsa-sha2-nistp384
|
||||
ecdsa-sha2-nistp521
|
||||
|
||||
(*) - basic ECC support; provided by DROPBEAR_ECC.
|
||||
Does not generate ECC host keys by default (ECC key exchange will not be used,
|
||||
only ECC public key auth).
|
||||
|
||||
Increases binary size by about 4 kB (MIPS).
|
||||
Increases binary size by about 23 kB (MIPS).
|
||||
|
||||
config DROPBEAR_ZLIB
|
||||
bool "Enable compression"
|
||||
@ -73,8 +56,4 @@ config DROPBEAR_PUTUTLINE
|
||||
help
|
||||
Dropbear will use pututline() to write the utmp structure into the utmp file.
|
||||
|
||||
config DROPBEAR_DBCLIENT
|
||||
bool "Build dropbear with dbclient"
|
||||
default y
|
||||
|
||||
endmenu
|
||||
|
||||
@ -8,14 +8,14 @@
|
||||
include $(TOPDIR)/rules.mk
|
||||
|
||||
PKG_NAME:=dropbear
|
||||
PKG_VERSION:=2019.78
|
||||
PKG_RELEASE:=2
|
||||
PKG_VERSION:=2017.75
|
||||
PKG_RELEASE:=9
|
||||
|
||||
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
|
||||
PKG_SOURCE_URL:= \
|
||||
http://matt.ucc.asn.au/dropbear/releases/ \
|
||||
https://dropbear.nl/mirror/releases/
|
||||
PKG_HASH:=525965971272270995364a0eb01f35180d793182e63dd0b0c3eb0292291644a4
|
||||
PKG_HASH:=6cbc1dcb1c9709d226dff669e5604172a18cf5dbf9a201474d5618ae4465098c
|
||||
|
||||
PKG_LICENSE:=MIT
|
||||
PKG_LICENSE_FILES:=LICENSE libtomcrypt/LICENSE libtommath/LICENSE
|
||||
@ -23,13 +23,11 @@ PKG_CPE_ID:=cpe:/a:matt_johnston:dropbear_ssh_server
|
||||
|
||||
PKG_BUILD_PARALLEL:=1
|
||||
PKG_USE_MIPS16:=0
|
||||
PKG_FIXUP:=autoreconf
|
||||
|
||||
PKG_CONFIG_DEPENDS:= \
|
||||
CONFIG_TARGET_INIT_PATH CONFIG_DROPBEAR_ECC CONFIG_DROPBEAR_ECC_FULL \
|
||||
CONFIG_TARGET_INIT_PATH CONFIG_DROPBEAR_ECC \
|
||||
CONFIG_DROPBEAR_CURVE25519 CONFIG_DROPBEAR_ZLIB \
|
||||
CONFIG_DROPBEAR_UTMP CONFIG_DROPBEAR_PUTUTLINE \
|
||||
CONFIG_DROPBEAR_DBCLIENT
|
||||
CONFIG_DROPBEAR_UTMP CONFIG_DROPBEAR_PUTUTLINE
|
||||
|
||||
include $(INCLUDE_DIR)/package.mk
|
||||
|
||||
@ -62,7 +60,6 @@ define Package/dropbear/description
|
||||
endef
|
||||
|
||||
define Package/dropbear/conffiles
|
||||
$(if $(CONFIG_DROPBEAR_ECC),/etc/dropbear/dropbear_ecdsa_host_key)
|
||||
/etc/dropbear/dropbear_rsa_host_key
|
||||
/etc/config/dropbear
|
||||
endef
|
||||
@ -93,39 +90,33 @@ TARGET_CFLAGS += -DARGTYPE=3 -ffunction-sections -fdata-sections -flto
|
||||
TARGET_LDFLAGS += -Wl,--gc-sections -flto=jobserver
|
||||
|
||||
define Build/Configure
|
||||
: > $(PKG_BUILD_DIR)/localoptions.h
|
||||
|
||||
$(Build/Configure/Default)
|
||||
|
||||
echo '#define DEFAULT_PATH "$(TARGET_INIT_PATH)"' >> \
|
||||
$(PKG_BUILD_DIR)/localoptions.h
|
||||
$(SED) 's,^#define DEFAULT_PATH .*$$$$,#define DEFAULT_PATH "$(TARGET_INIT_PATH)",g' \
|
||||
$(PKG_BUILD_DIR)/options.h
|
||||
|
||||
echo '#define DROPBEAR_CURVE25519 $(if $(CONFIG_DROPBEAR_CURVE25519),1,0)' >> \
|
||||
$(PKG_BUILD_DIR)/localoptions.h
|
||||
awk 'BEGIN { rc = 1 } \
|
||||
/'DROPBEAR_CURVE25519'/ { $$$$0 = "$(if $(CONFIG_DROPBEAR_CURVE25519),,// )#define 'DROPBEAR_CURVE25519'"; rc = 0 } \
|
||||
{ print } \
|
||||
END { exit(rc) }' $(PKG_BUILD_DIR)/options.h \
|
||||
>$(PKG_BUILD_DIR)/options.h.new && \
|
||||
mv $(PKG_BUILD_DIR)/options.h.new $(PKG_BUILD_DIR)/options.h
|
||||
|
||||
# Enforce that all replacements are made, otherwise options.h has changed
|
||||
# format and this logic is broken.
|
||||
for OPTION in DROPBEAR_ECDSA DROPBEAR_ECDH; do \
|
||||
echo "#define $$$$OPTION $(if $(CONFIG_DROPBEAR_ECC),1,0)" >> \
|
||||
$(PKG_BUILD_DIR)/localoptions.h; \
|
||||
awk 'BEGIN { rc = 1 } \
|
||||
/'$$$$OPTION'/ { $$$$0 = "$(if $(CONFIG_DROPBEAR_ECC),,// )#define '$$$$OPTION'"; rc = 0 } \
|
||||
{ print } \
|
||||
END { exit(rc) }' $(PKG_BUILD_DIR)/options.h \
|
||||
>$(PKG_BUILD_DIR)/options.h.new && \
|
||||
mv $(PKG_BUILD_DIR)/options.h.new $(PKG_BUILD_DIR)/options.h || exit 1; \
|
||||
done
|
||||
|
||||
# remove protocol idented software version number
|
||||
$(ESED) 's,^(#define LOCAL_IDENT) .*$$$$,\1 "SSH-2.0-dropbear",g' \
|
||||
$(SED) 's,^#define LOCAL_IDENT .*$$$$,#define LOCAL_IDENT "SSH-2.0-dropbear",g' \
|
||||
$(PKG_BUILD_DIR)/sysoptions.h
|
||||
|
||||
# disable legacy/unsafe methods and unused functionality
|
||||
for OPTION in INETD_MODE DROPBEAR_CLI_NETCAT \
|
||||
DROPBEAR_3DES DROPBEAR_DSS DROPBEAR_ENABLE_CBC_MODE \
|
||||
DROPBEAR_SHA1_96_HMAC DROPBEAR_USE_PASSWORD_ENV; do \
|
||||
echo "#define $$$$OPTION 0" >> \
|
||||
$(PKG_BUILD_DIR)/localoptions.h; \
|
||||
done
|
||||
|
||||
# enable nistp384 and nistp521 only if full ECC support was requested
|
||||
for OPTION in DROPBEAR_ECC_384 DROPBEAR_ECC_521; do \
|
||||
$(ESED) 's,^(#define '$$$$OPTION') .*$$$$,\1 $(if $(CONFIG_DROPBEAR_ECC_FULL),1,0),g' \
|
||||
$(PKG_BUILD_DIR)/sysoptions.h; \
|
||||
done
|
||||
|
||||
# Enforce rebuild of svr-chansession.c
|
||||
rm -f $(PKG_BUILD_DIR)/svr-chansession.o
|
||||
endef
|
||||
@ -133,7 +124,7 @@ endef
|
||||
define Build/Compile
|
||||
+$(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR) \
|
||||
$(TARGET_CONFIGURE_OPTS) \
|
||||
PROGRAMS="dropbear $(if $(CONFIG_DROPBEAR_DBCLIENT),dbclient,) dropbearkey scp" \
|
||||
PROGRAMS="dropbear dbclient dropbearkey scp" \
|
||||
MULTI=1 SCPPROGRESS=1
|
||||
+$(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR) \
|
||||
$(TARGET_CONFIGURE_OPTS) \
|
||||
@ -144,7 +135,7 @@ define Package/dropbear/install
|
||||
$(INSTALL_DIR) $(1)/usr/sbin
|
||||
$(INSTALL_BIN) $(PKG_BUILD_DIR)/dropbearmulti $(1)/usr/sbin/dropbear
|
||||
$(INSTALL_DIR) $(1)/usr/bin
|
||||
$(if $(CONFIG_DROPBEAR_DBCLIENT),$(LN) ../sbin/dropbear $(1)/usr/bin/dbclient,)
|
||||
$(LN) ../sbin/dropbear $(1)/usr/bin/dbclient
|
||||
$(LN) ../sbin/dropbear $(1)/usr/bin/dropbearkey
|
||||
$(INSTALL_DIR) $(1)/etc/config
|
||||
$(INSTALL_CONF) ./files/dropbear.config $(1)/etc/config/dropbear
|
||||
@ -152,7 +143,6 @@ define Package/dropbear/install
|
||||
$(INSTALL_BIN) ./files/dropbear.init $(1)/etc/init.d/dropbear
|
||||
$(INSTALL_DIR) $(1)/usr/lib/opkg/info
|
||||
$(INSTALL_DIR) $(1)/etc/dropbear
|
||||
$(if $(CONFIG_DROPBEAR_ECC),touch $(1)/etc/dropbear/dropbear_ecdsa_host_key)
|
||||
touch $(1)/etc/dropbear/dropbear_rsa_host_key
|
||||
endef
|
||||
|
||||
|
||||
@ -12,91 +12,6 @@ PIDCOUNT=0
|
||||
EXTRA_COMMANDS="killclients"
|
||||
EXTRA_HELP=" killclients Kill ${NAME} processes except servers and yourself"
|
||||
|
||||
_dropbearkey()
|
||||
{
|
||||
/usr/bin/dropbearkey "$@" 0<&- 1>&- 2>&-
|
||||
}
|
||||
|
||||
# $1 - host key file name
|
||||
hk_verify()
|
||||
{
|
||||
[ -f "$1" ] || return 1
|
||||
[ -s "$1" ] || return 2
|
||||
_dropbearkey -y -f "$1" || return 3
|
||||
return 0
|
||||
}
|
||||
|
||||
# $1 - hk_verify() return code
|
||||
hk_errmsg()
|
||||
{
|
||||
case "$1" in
|
||||
0) ;;
|
||||
1) echo "file does not exist" ;;
|
||||
2) echo "file has zero length" ;;
|
||||
3) echo "file is not valid host key or not supported" ;;
|
||||
*) echo "unknown error" ;;
|
||||
esac
|
||||
}
|
||||
|
||||
# $1 - config option
|
||||
# $2 - host key file name
|
||||
hk_config()
|
||||
{
|
||||
local x m
|
||||
hk_verify "$2"; x=$?
|
||||
case "$x" in
|
||||
0) procd_append_param command -r "$2"
|
||||
;;
|
||||
*) m=$(hk_errmsg "$x")
|
||||
logger -t "${NAME}" -p daemon.warn \
|
||||
"option '$1', value '$2': $m, skipping"
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
# $1 - host key file name
|
||||
hk_config__keyfile()
|
||||
{
|
||||
hk_config 'keyfile' "$1"
|
||||
}
|
||||
|
||||
hk_generate_as_needed()
|
||||
{
|
||||
local kdir kgen ktype tdir kcount tfile
|
||||
kdir='/etc/dropbear'
|
||||
|
||||
kgen=''
|
||||
for ktype in ecdsa rsa; do
|
||||
hk_verify "${kdir}/dropbear_${ktype}_host_key" && continue
|
||||
|
||||
kgen="${kgen} ${ktype}"
|
||||
done
|
||||
|
||||
[ -z "${kgen}" ] && return
|
||||
|
||||
tdir=$(mktemp -d); chmod 0700 "${tdir}"
|
||||
|
||||
kcount=0
|
||||
for ktype in ${kgen}; do
|
||||
tfile="${tdir}/dropbear_${ktype}_host_key"
|
||||
|
||||
if ! _dropbearkey -t ${ktype} -f "${tfile}"; then
|
||||
# unsupported key type
|
||||
rm -f "${tfile}"
|
||||
continue
|
||||
fi
|
||||
|
||||
kcount=$((kcount+1))
|
||||
done
|
||||
|
||||
if [ ${kcount} -ne 0 ]; then
|
||||
mkdir -p "${kdir}"; chmod 0700 "${kdir}"; chown root "${kdir}"
|
||||
mv -f "${tdir}/"* "${kdir}/"
|
||||
fi
|
||||
|
||||
rm -rf "${tdir}"
|
||||
}
|
||||
|
||||
append_ports()
|
||||
{
|
||||
local ipaddrs="$1"
|
||||
@ -114,7 +29,7 @@ append_ports()
|
||||
|
||||
validate_section_dropbear()
|
||||
{
|
||||
uci_load_validate dropbear dropbear "$1" "$2" \
|
||||
uci_validate_section dropbear dropbear "${1}" \
|
||||
'PasswordAuth:bool:1' \
|
||||
'enable:bool:1' \
|
||||
'Interface:string' \
|
||||
@ -122,9 +37,8 @@ validate_section_dropbear()
|
||||
'RootPasswordAuth:bool:1' \
|
||||
'RootLogin:bool:1' \
|
||||
'rsakeyfile:file' \
|
||||
'keyfile:list(file)' \
|
||||
'BannerFile:file' \
|
||||
'Port:port:22' \
|
||||
'Port:list(port):22' \
|
||||
'SSHKeepAlive:uinteger:300' \
|
||||
'IdleTimeout:uinteger:0' \
|
||||
'MaxAuthTries:uinteger:3' \
|
||||
@ -134,9 +48,12 @@ validate_section_dropbear()
|
||||
|
||||
dropbear_instance()
|
||||
{
|
||||
local ipaddrs
|
||||
local PasswordAuth enable Interface GatewayPorts \
|
||||
RootPasswordAuth RootLogin rsakeyfile \
|
||||
BannerFile Port SSHKeepAlive IdleTimeout \
|
||||
MaxAuthTries RecvWindowSize mdns ipaddrs
|
||||
|
||||
[ "$2" = 0 ] || {
|
||||
validate_section_dropbear "${1}" || {
|
||||
echo "validation failed"
|
||||
return 1
|
||||
}
|
||||
@ -160,13 +77,7 @@ dropbear_instance()
|
||||
[ "${GatewayPorts}" -eq 1 ] && procd_append_param command -a
|
||||
[ "${RootPasswordAuth}" -eq 0 ] && procd_append_param command -g
|
||||
[ "${RootLogin}" -eq 0 ] && procd_append_param command -w
|
||||
if [ -n "${rsakeyfile}" ]; then
|
||||
logger -t ${NAME} -p daemon.warn \
|
||||
"option 'rsakeyfile' is considered to be deprecated and" \
|
||||
"will be removed in future releases, use 'keyfile' instead"
|
||||
hk_config 'rsakeyfile' "${rsakeyfile}"
|
||||
fi
|
||||
config_list_foreach "$1" "keyfile" hk_config__keyfile
|
||||
[ -n "${rsakeyfile}" ] && procd_append_param command -r "${rsakeyfile}"
|
||||
[ -n "${BannerFile}" ] && procd_append_param command -b "${BannerFile}"
|
||||
append_ports "${ipaddrs}" "${Port}"
|
||||
[ "${IdleTimeout}" -ne 0 ] && procd_append_param command -I "${IdleTimeout}"
|
||||
@ -179,6 +90,29 @@ dropbear_instance()
|
||||
procd_close_instance
|
||||
}
|
||||
|
||||
keygen()
|
||||
{
|
||||
for keytype in rsa; do
|
||||
# check for keys
|
||||
key=dropbear/dropbear_${keytype}_host_key
|
||||
[ -f /tmp/$key -o -s /etc/$key ] || {
|
||||
# generate missing keys
|
||||
mkdir -p /tmp/dropbear
|
||||
[ -x /usr/bin/dropbearkey ] && {
|
||||
/usr/bin/dropbearkey -t $keytype -f /tmp/$key 2>&- >&- && exec /etc/rc.common "$initscript" start
|
||||
} &
|
||||
exit 0
|
||||
}
|
||||
done
|
||||
|
||||
lock /tmp/.switch2jffs
|
||||
mkdir -p /etc/dropbear
|
||||
mv /tmp/dropbear/dropbear_* /etc/dropbear/
|
||||
lock -u /tmp/.switch2jffs
|
||||
chown root /etc/dropbear
|
||||
chmod 0700 /etc/dropbear
|
||||
}
|
||||
|
||||
load_interfaces()
|
||||
{
|
||||
config_get interface "$1" Interface
|
||||
@ -195,13 +129,13 @@ boot()
|
||||
|
||||
start_service()
|
||||
{
|
||||
hk_generate_as_needed
|
||||
[ -s /etc/dropbear/dropbear_rsa_host_key ] || keygen
|
||||
|
||||
. /lib/functions.sh
|
||||
. /lib/functions/network.sh
|
||||
|
||||
config_load "${NAME}"
|
||||
config_foreach validate_section_dropbear dropbear dropbear_instance
|
||||
config_foreach dropbear_instance dropbear
|
||||
}
|
||||
|
||||
service_triggers()
|
||||
|
||||
@ -0,0 +1,130 @@
|
||||
From 46b22e57d91e33a591d0fba97da52672af4d6ed2 Mon Sep 17 00:00:00 2001
|
||||
From: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
|
||||
Date: Mon, 29 May 2017 10:25:09 +0100
|
||||
Subject: [PATCH] dropbear server: support -T max auth tries
|
||||
|
||||
Add support for '-T n' for a run-time specification for maximum number
|
||||
of authentication attempts where 'n' is between 1 and compile time
|
||||
option MAX_AUTH_TRIES.
|
||||
|
||||
A default number of tries can be specified at compile time using
|
||||
'DEFAULT_AUTH_TRIES' which itself defaults to MAX_AUTH_TRIES for
|
||||
backwards compatibility.
|
||||
|
||||
Signed-off-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
|
||||
---
|
||||
options.h | 7 +++++++
|
||||
runopts.h | 1 +
|
||||
svr-auth.c | 2 +-
|
||||
svr-runopts.c | 17 +++++++++++++++++
|
||||
4 files changed, 26 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/options.h b/options.h
|
||||
index 0c51bb1..4d22704 100644
|
||||
--- a/options.h
|
||||
+++ b/options.h
|
||||
@@ -284,6 +284,13 @@ Homedir is prepended unless path begins with / */
|
||||
#define MAX_AUTH_TRIES 10
|
||||
#endif
|
||||
|
||||
+/* Default maximum number of failed authentication tries.
|
||||
+ * defaults to MAX_AUTH_TRIES */
|
||||
+
|
||||
+#ifndef DEFAULT_AUTH_TRIES
|
||||
+#define DEFAULT_AUTH_TRIES MAX_AUTH_TRIES
|
||||
+#endif
|
||||
+
|
||||
/* The default file to store the daemon's process ID, for shutdown
|
||||
scripts etc. This can be overridden with the -P flag */
|
||||
#ifndef DROPBEAR_PIDFILE
|
||||
diff --git a/runopts.h b/runopts.h
|
||||
index f7c869d..2f7da63 100644
|
||||
--- a/runopts.h
|
||||
+++ b/runopts.h
|
||||
@@ -96,6 +96,7 @@ typedef struct svr_runopts {
|
||||
int noauthpass;
|
||||
int norootpass;
|
||||
int allowblankpass;
|
||||
+ unsigned int maxauthtries;
|
||||
|
||||
#ifdef ENABLE_SVR_REMOTETCPFWD
|
||||
int noremotetcp;
|
||||
diff --git a/svr-auth.c b/svr-auth.c
|
||||
index 577ea88..6a7ce0b 100644
|
||||
--- a/svr-auth.c
|
||||
+++ b/svr-auth.c
|
||||
@@ -362,7 +362,7 @@ void send_msg_userauth_failure(int partial, int incrfail) {
|
||||
ses.authstate.failcount++;
|
||||
}
|
||||
|
||||
- if (ses.authstate.failcount >= MAX_AUTH_TRIES) {
|
||||
+ if (ses.authstate.failcount >= svr_opts.maxauthtries) {
|
||||
char * userstr;
|
||||
/* XXX - send disconnect ? */
|
||||
TRACE(("Max auth tries reached, exiting"))
|
||||
diff --git a/svr-runopts.c b/svr-runopts.c
|
||||
index 8f60059..1e7440f 100644
|
||||
--- a/svr-runopts.c
|
||||
+++ b/svr-runopts.c
|
||||
@@ -73,6 +73,7 @@ static void printhelp(const char * progname) {
|
||||
"-g Disable password logins for root\n"
|
||||
"-B Allow blank password logins\n"
|
||||
#endif
|
||||
+ "-T <1 to %d> Maximum authentication tries (default %d)\n"
|
||||
#ifdef ENABLE_SVR_LOCALTCPFWD
|
||||
"-j Disable local port forwarding\n"
|
||||
#endif
|
||||
@@ -106,6 +107,7 @@ static void printhelp(const char * progname) {
|
||||
#ifdef DROPBEAR_ECDSA
|
||||
ECDSA_PRIV_FILENAME,
|
||||
#endif
|
||||
+ MAX_AUTH_TRIES, DEFAULT_AUTH_TRIES,
|
||||
DROPBEAR_MAX_PORTS, DROPBEAR_DEFPORT, DROPBEAR_PIDFILE,
|
||||
DEFAULT_RECV_WINDOW, DEFAULT_KEEPALIVE, DEFAULT_IDLE_TIMEOUT);
|
||||
}
|
||||
@@ -118,6 +120,7 @@ void svr_getopts(int argc, char ** argv) {
|
||||
char* recv_window_arg = NULL;
|
||||
char* keepalive_arg = NULL;
|
||||
char* idle_timeout_arg = NULL;
|
||||
+ char* maxauthtries_arg = NULL;
|
||||
char* keyfile = NULL;
|
||||
char c;
|
||||
|
||||
@@ -130,6 +133,7 @@ void svr_getopts(int argc, char ** argv) {
|
||||
svr_opts.noauthpass = 0;
|
||||
svr_opts.norootpass = 0;
|
||||
svr_opts.allowblankpass = 0;
|
||||
+ svr_opts.maxauthtries = DEFAULT_AUTH_TRIES;
|
||||
svr_opts.inetdmode = 0;
|
||||
svr_opts.portcount = 0;
|
||||
svr_opts.hostkey = NULL;
|
||||
@@ -234,6 +238,9 @@ void svr_getopts(int argc, char ** argv) {
|
||||
case 'I':
|
||||
next = &idle_timeout_arg;
|
||||
break;
|
||||
+ case 'T':
|
||||
+ next = &maxauthtries_arg;
|
||||
+ break;
|
||||
#if defined(ENABLE_SVR_PASSWORD_AUTH) || defined(ENABLE_SVR_PAM_AUTH)
|
||||
case 's':
|
||||
svr_opts.noauthpass = 1;
|
||||
@@ -330,6 +337,16 @@ void svr_getopts(int argc, char ** argv) {
|
||||
dropbear_exit("Bad recv window '%s'", recv_window_arg);
|
||||
}
|
||||
}
|
||||
+
|
||||
+ if (maxauthtries_arg) {
|
||||
+ unsigned int val = 0;
|
||||
+ if (m_str_to_uint(maxauthtries_arg, &val) == DROPBEAR_FAILURE ||
|
||||
+ val == 0 || val > MAX_AUTH_TRIES) {
|
||||
+ dropbear_exit("Bad maxauthtries '%s'", maxauthtries_arg);
|
||||
+ }
|
||||
+ svr_opts.maxauthtries = val;
|
||||
+ }
|
||||
+
|
||||
|
||||
if (keepalive_arg) {
|
||||
unsigned int val;
|
||||
--
|
||||
2.7.4
|
||||
|
||||
@ -0,0 +1,221 @@
|
||||
From 52adbb34c32d3e2e1bcdb941e20a6f81138b8248 Mon Sep 17 00:00:00 2001
|
||||
From: Matt Johnston <matt@ucc.asn.au>
|
||||
Date: Thu, 23 Aug 2018 23:43:12 +0800
|
||||
Subject: [PATCH 2/2] Wait to fail invalid usernames
|
||||
|
||||
---
|
||||
auth.h | 6 +++---
|
||||
svr-auth.c | 19 +++++--------------
|
||||
svr-authpam.c | 26 ++++++++++++++++++++++----
|
||||
svr-authpasswd.c | 27 ++++++++++++++-------------
|
||||
svr-authpubkey.c | 11 ++++++++++-
|
||||
5 files changed, 54 insertions(+), 35 deletions(-)
|
||||
|
||||
--- a/auth.h
|
||||
+++ b/auth.h
|
||||
@@ -37,9 +37,9 @@ void recv_msg_userauth_request(void);
|
||||
void send_msg_userauth_failure(int partial, int incrfail);
|
||||
void send_msg_userauth_success(void);
|
||||
void send_msg_userauth_banner(buffer *msg);
|
||||
-void svr_auth_password(void);
|
||||
-void svr_auth_pubkey(void);
|
||||
-void svr_auth_pam(void);
|
||||
+void svr_auth_password(int valid_user);
|
||||
+void svr_auth_pubkey(int valid_user);
|
||||
+void svr_auth_pam(int valid_user);
|
||||
|
||||
#ifdef ENABLE_SVR_PUBKEY_OPTIONS
|
||||
int svr_pubkey_allows_agentfwd(void);
|
||||
--- a/svr-auth.c
|
||||
+++ b/svr-auth.c
|
||||
@@ -176,10 +176,8 @@ void recv_msg_userauth_request() {
|
||||
if (methodlen == AUTH_METHOD_PASSWORD_LEN &&
|
||||
strncmp(methodname, AUTH_METHOD_PASSWORD,
|
||||
AUTH_METHOD_PASSWORD_LEN) == 0) {
|
||||
- if (valid_user) {
|
||||
- svr_auth_password();
|
||||
- goto out;
|
||||
- }
|
||||
+ svr_auth_password(valid_user);
|
||||
+ goto out;
|
||||
}
|
||||
}
|
||||
#endif
|
||||
@@ -191,10 +189,8 @@ void recv_msg_userauth_request() {
|
||||
if (methodlen == AUTH_METHOD_PASSWORD_LEN &&
|
||||
strncmp(methodname, AUTH_METHOD_PASSWORD,
|
||||
AUTH_METHOD_PASSWORD_LEN) == 0) {
|
||||
- if (valid_user) {
|
||||
- svr_auth_pam();
|
||||
- goto out;
|
||||
- }
|
||||
+ svr_auth_pam(valid_user);
|
||||
+ goto out;
|
||||
}
|
||||
}
|
||||
#endif
|
||||
@@ -204,12 +200,7 @@ void recv_msg_userauth_request() {
|
||||
if (methodlen == AUTH_METHOD_PUBKEY_LEN &&
|
||||
strncmp(methodname, AUTH_METHOD_PUBKEY,
|
||||
AUTH_METHOD_PUBKEY_LEN) == 0) {
|
||||
- if (valid_user) {
|
||||
- svr_auth_pubkey();
|
||||
- } else {
|
||||
- /* pubkey has no failure delay */
|
||||
- send_msg_userauth_failure(0, 0);
|
||||
- }
|
||||
+ svr_auth_pubkey(valid_user);
|
||||
goto out;
|
||||
}
|
||||
#endif
|
||||
--- a/svr-authpam.c
|
||||
+++ b/svr-authpam.c
|
||||
@@ -178,13 +178,14 @@ pamConvFunc(int num_msg,
|
||||
* Keyboard interactive would be a lot nicer, but since PAM is synchronous, it
|
||||
* gets very messy trying to send the interactive challenges, and read the
|
||||
* interactive responses, over the network. */
|
||||
-void svr_auth_pam() {
|
||||
+void svr_auth_pam(int valid_user) {
|
||||
|
||||
struct UserDataS userData = {NULL, NULL};
|
||||
struct pam_conv pamConv = {
|
||||
pamConvFunc,
|
||||
&userData /* submitted to pamvConvFunc as appdata_ptr */
|
||||
};
|
||||
+ const char* printable_user = NULL;
|
||||
|
||||
pam_handle_t* pamHandlep = NULL;
|
||||
|
||||
@@ -204,12 +205,23 @@ void svr_auth_pam() {
|
||||
|
||||
password = buf_getstring(ses.payload, &passwordlen);
|
||||
|
||||
+ /* We run the PAM conversation regardless of whether the username is valid
|
||||
+ in case the conversation function has an inherent delay.
|
||||
+ Use ses.authstate.username rather than ses.authstate.pw_name.
|
||||
+ After PAM succeeds we then check the valid_user flag too */
|
||||
+
|
||||
/* used to pass data to the PAM conversation function - don't bother with
|
||||
* strdup() etc since these are touched only by our own conversation
|
||||
* function (above) which takes care of it */
|
||||
- userData.user = ses.authstate.pw_name;
|
||||
+ userData.user = ses.authstate.username;
|
||||
userData.passwd = password;
|
||||
|
||||
+ if (ses.authstate.pw_name) {
|
||||
+ printable_user = ses.authstate.pw_name;
|
||||
+ } else {
|
||||
+ printable_user = "<invalid username>";
|
||||
+ }
|
||||
+
|
||||
/* Init pam */
|
||||
if ((rc = pam_start("sshd", NULL, &pamConv, &pamHandlep)) != PAM_SUCCESS) {
|
||||
dropbear_log(LOG_WARNING, "pam_start() failed, rc=%d, %s",
|
||||
@@ -236,7 +248,7 @@ void svr_auth_pam() {
|
||||
rc, pam_strerror(pamHandlep, rc));
|
||||
dropbear_log(LOG_WARNING,
|
||||
"Bad PAM password attempt for '%s' from %s",
|
||||
- ses.authstate.pw_name,
|
||||
+ printable_user,
|
||||
svr_ses.addrstring);
|
||||
send_msg_userauth_failure(0, 1);
|
||||
goto cleanup;
|
||||
@@ -247,12 +259,18 @@ void svr_auth_pam() {
|
||||
rc, pam_strerror(pamHandlep, rc));
|
||||
dropbear_log(LOG_WARNING,
|
||||
"Bad PAM password attempt for '%s' from %s",
|
||||
- ses.authstate.pw_name,
|
||||
+ printable_user,
|
||||
svr_ses.addrstring);
|
||||
send_msg_userauth_failure(0, 1);
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
+ if (!valid_user) {
|
||||
+ /* PAM auth succeeded but the username isn't allowed in for another reason
|
||||
+ (checkusername() failed) */
|
||||
+ send_msg_userauth_failure(0, 1);
|
||||
+ }
|
||||
+
|
||||
/* successful authentication */
|
||||
dropbear_log(LOG_NOTICE, "PAM password auth succeeded for '%s' from %s",
|
||||
ses.authstate.pw_name,
|
||||
--- a/svr-authpasswd.c
|
||||
+++ b/svr-authpasswd.c
|
||||
@@ -48,22 +48,14 @@ static int constant_time_strcmp(const ch
|
||||
|
||||
/* Process a password auth request, sending success or failure messages as
|
||||
* appropriate */
|
||||
-void svr_auth_password() {
|
||||
+void svr_auth_password(int valid_user) {
|
||||
|
||||
char * passwdcrypt = NULL; /* the crypt from /etc/passwd or /etc/shadow */
|
||||
char * testcrypt = NULL; /* crypt generated from the user's password sent */
|
||||
- char * password;
|
||||
+ char * password = NULL;
|
||||
unsigned int passwordlen;
|
||||
-
|
||||
unsigned int changepw;
|
||||
|
||||
- passwdcrypt = ses.authstate.pw_passwd;
|
||||
-
|
||||
-#ifdef DEBUG_HACKCRYPT
|
||||
- /* debugging crypt for non-root testing with shadows */
|
||||
- passwdcrypt = DEBUG_HACKCRYPT;
|
||||
-#endif
|
||||
-
|
||||
/* check if client wants to change password */
|
||||
changepw = buf_getbool(ses.payload);
|
||||
if (changepw) {
|
||||
@@ -73,12 +65,21 @@ void svr_auth_password() {
|
||||
}
|
||||
|
||||
password = buf_getstring(ses.payload, &passwordlen);
|
||||
-
|
||||
- /* the first bytes of passwdcrypt are the salt */
|
||||
- testcrypt = crypt(password, passwdcrypt);
|
||||
+ if (valid_user) {
|
||||
+ /* the first bytes of passwdcrypt are the salt */
|
||||
+ passwdcrypt = ses.authstate.pw_passwd;
|
||||
+ testcrypt = crypt(password, passwdcrypt);
|
||||
+ }
|
||||
m_burn(password, passwordlen);
|
||||
m_free(password);
|
||||
|
||||
+ /* After we have got the payload contents we can exit if the username
|
||||
+ is invalid. Invalid users have already been logged. */
|
||||
+ if (!valid_user) {
|
||||
+ send_msg_userauth_failure(0, 1);
|
||||
+ return;
|
||||
+ }
|
||||
+
|
||||
if (testcrypt == NULL) {
|
||||
/* crypt() with an invalid salt like "!!" */
|
||||
dropbear_log(LOG_WARNING, "User account '%s' is locked",
|
||||
--- a/svr-authpubkey.c
|
||||
+++ b/svr-authpubkey.c
|
||||
@@ -79,7 +79,7 @@ static int checkfileperm(char * filename
|
||||
|
||||
/* process a pubkey auth request, sending success or failure message as
|
||||
* appropriate */
|
||||
-void svr_auth_pubkey() {
|
||||
+void svr_auth_pubkey(int valid_user) {
|
||||
|
||||
unsigned char testkey; /* whether we're just checking if a key is usable */
|
||||
char* algo = NULL; /* pubkey algo */
|
||||
@@ -102,6 +102,15 @@ void svr_auth_pubkey() {
|
||||
keybloblen = buf_getint(ses.payload);
|
||||
keyblob = buf_getptr(ses.payload, keybloblen);
|
||||
|
||||
+ if (!valid_user) {
|
||||
+ /* Return failure once we have read the contents of the packet
|
||||
+ required to validate a public key.
|
||||
+ Avoids blind user enumeration though it isn't possible to prevent
|
||||
+ testing for user existence if the public key is known */
|
||||
+ send_msg_userauth_failure(0, 0);
|
||||
+ goto out;
|
||||
+ }
|
||||
+
|
||||
/* check if the key is valid */
|
||||
if (checkpubkey(algo, algolen, keyblob, keybloblen) == DROPBEAR_FAILURE) {
|
||||
send_msg_userauth_failure(0, 0);
|
||||
@ -1,6 +1,6 @@
|
||||
--- a/svr-authpubkey.c
|
||||
+++ b/svr-authpubkey.c
|
||||
@@ -338,14 +338,19 @@ static int checkpubkey(const char* algo,
|
||||
@@ -229,14 +229,20 @@ static int checkpubkey(char* algo, unsig
|
||||
goto out;
|
||||
}
|
||||
|
||||
@ -25,23 +25,34 @@
|
||||
+ filename = m_malloc(30);
|
||||
+ strncpy(filename, "/etc/dropbear/authorized_keys", 30);
|
||||
+ }
|
||||
+
|
||||
|
||||
#if DROPBEAR_SVR_MULTIUSER
|
||||
/* open the file as the authenticating user. */
|
||||
@@ -426,27 +431,36 @@ static int checkpubkeyperms() {
|
||||
origuid = getuid();
|
||||
@@ -405,26 +411,35 @@ static int checkpubkeyperms() {
|
||||
goto out;
|
||||
}
|
||||
|
||||
- /* allocate max required pathname storage,
|
||||
- * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */
|
||||
- len += 22;
|
||||
- filename = m_malloc(len);
|
||||
- strlcpy(filename, ses.authstate.pw_dir, len);
|
||||
- filename = m_malloc(len + 22);
|
||||
- strncpy(filename, ses.authstate.pw_dir, len+1);
|
||||
-
|
||||
- /* check ~ */
|
||||
- if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
|
||||
- goto out;
|
||||
- }
|
||||
-
|
||||
- /* check ~/.ssh */
|
||||
- strncat(filename, "/.ssh", 5); /* strlen("/.ssh") == 5 */
|
||||
- if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
|
||||
- goto out;
|
||||
- }
|
||||
-
|
||||
- /* now check ~/.ssh/authorized_keys */
|
||||
- strncat(filename, "/authorized_keys", 16);
|
||||
- if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
|
||||
- goto out;
|
||||
+ if (ses.authstate.pw_uid == 0) {
|
||||
+ if (checkfileperm("/etc/dropbear") != DROPBEAR_SUCCESS) {
|
||||
+ goto out;
|
||||
@ -52,32 +63,22 @@
|
||||
+ } else {
|
||||
+ /* allocate max required pathname storage,
|
||||
+ * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */
|
||||
+ len += 22;
|
||||
+ filename = m_malloc(len);
|
||||
+ strlcpy(filename, ses.authstate.pw_dir, len);
|
||||
+ filename = m_malloc(len + 22);
|
||||
+ strncpy(filename, ses.authstate.pw_dir, len+1);
|
||||
+
|
||||
+ /* check ~ */
|
||||
+ if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
|
||||
+ goto out;
|
||||
+ }
|
||||
|
||||
- /* check ~/.ssh */
|
||||
- strlcat(filename, "/.ssh", len);
|
||||
- if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
|
||||
- goto out;
|
||||
- }
|
||||
+
|
||||
+ /* check ~/.ssh */
|
||||
+ strlcat(filename, "/.ssh", len);
|
||||
+ strncat(filename, "/.ssh", 5); /* strlen("/.ssh") == 5 */
|
||||
+ if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
|
||||
+ goto out;
|
||||
+ }
|
||||
|
||||
- /* now check ~/.ssh/authorized_keys */
|
||||
- strlcat(filename, "/authorized_keys", len);
|
||||
- if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
|
||||
- goto out;
|
||||
+
|
||||
+ /* now check ~/.ssh/authorized_keys */
|
||||
+ strlcat(filename, "/authorized_keys", len);
|
||||
+ strncat(filename, "/authorized_keys", 16);
|
||||
+ if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
|
||||
+ goto out;
|
||||
+ }
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
--- a/svr-chansession.c
|
||||
+++ b/svr-chansession.c
|
||||
@@ -953,12 +953,12 @@ static void execchild(const void *user_d
|
||||
@@ -922,12 +922,12 @@ static void execchild(void *user_data) {
|
||||
/* We can only change uid/gid as root ... */
|
||||
if (getuid() == 0) {
|
||||
|
||||
|
||||
@ -0,0 +1,82 @@
|
||||
--- a/options.h
|
||||
+++ b/options.h
|
||||
@@ -41,7 +41,7 @@
|
||||
* Both of these flags can be defined at once, don't compile without at least
|
||||
* one of them. */
|
||||
#define NON_INETD_MODE
|
||||
-#define INETD_MODE
|
||||
+/*#define INETD_MODE*/
|
||||
|
||||
/* Setting this disables the fast exptmod bignum code. It saves ~5kB, but is
|
||||
* perhaps 20% slower for pubkey operations (it is probably worth experimenting
|
||||
@@ -81,7 +81,7 @@ much traffic. */
|
||||
|
||||
/* Enable "Netcat mode" option. This will forward standard input/output
|
||||
* to a remote TCP-forwarded connection */
|
||||
-#define ENABLE_CLI_NETCAT
|
||||
+/*#define ENABLE_CLI_NETCAT*/
|
||||
|
||||
/* Whether to support "-c" and "-m" flags to choose ciphers/MACs at runtime */
|
||||
#define ENABLE_USER_ALGO_LIST
|
||||
@@ -91,16 +91,16 @@ much traffic. */
|
||||
* Including multiple keysize variants the same cipher
|
||||
* (eg AES256 as well as AES128) will result in a minimal size increase.*/
|
||||
#define DROPBEAR_AES128
|
||||
-#define DROPBEAR_3DES
|
||||
+/*#define DROPBEAR_3DES*/
|
||||
#define DROPBEAR_AES256
|
||||
/* Compiling in Blowfish will add ~6kB to runtime heap memory usage */
|
||||
/*#define DROPBEAR_BLOWFISH*/
|
||||
-#define DROPBEAR_TWOFISH256
|
||||
-#define DROPBEAR_TWOFISH128
|
||||
+/*#define DROPBEAR_TWOFISH256*/
|
||||
+/*#define DROPBEAR_TWOFISH128*/
|
||||
|
||||
/* Enable CBC mode for ciphers. This has security issues though
|
||||
* is the most compatible with older SSH implementations */
|
||||
-#define DROPBEAR_ENABLE_CBC_MODE
|
||||
+/*#define DROPBEAR_ENABLE_CBC_MODE*/
|
||||
|
||||
/* Enable "Counter Mode" for ciphers. This is more secure than normal
|
||||
* CBC mode against certain attacks. It is recommended for security
|
||||
@@ -131,10 +131,10 @@ If you test it please contact the Dropbe
|
||||
* If you disable MD5, Dropbear will fall back to SHA1 fingerprints,
|
||||
* which are not the standard form. */
|
||||
#define DROPBEAR_SHA1_HMAC
|
||||
-#define DROPBEAR_SHA1_96_HMAC
|
||||
+/*#define DROPBEAR_SHA1_96_HMAC*/
|
||||
#define DROPBEAR_SHA2_256_HMAC
|
||||
-#define DROPBEAR_SHA2_512_HMAC
|
||||
-#define DROPBEAR_MD5_HMAC
|
||||
+/*#define DROPBEAR_SHA2_512_HMAC*/
|
||||
+/*#define DROPBEAR_MD5_HMAC*/
|
||||
|
||||
/* You can also disable integrity. Don't bother disabling this if you're
|
||||
* still using a cipher, it's relatively cheap. If you disable this it's dead
|
||||
@@ -146,7 +146,7 @@ If you test it please contact the Dropbe
|
||||
* Removing either of these won't save very much space.
|
||||
* SSH2 RFC Draft requires dss, recommends rsa */
|
||||
#define DROPBEAR_RSA
|
||||
-#define DROPBEAR_DSS
|
||||
+/*#define DROPBEAR_DSS*/
|
||||
/* ECDSA is significantly faster than RSA or DSS. Compiling in ECC
|
||||
* code (either ECDSA or ECDH) increases binary size - around 30kB
|
||||
* on x86-64 */
|
||||
@@ -194,7 +194,7 @@ If you test it please contact the Dropbe
|
||||
|
||||
/* Whether to print the message of the day (MOTD). This doesn't add much code
|
||||
* size */
|
||||
-#define DO_MOTD
|
||||
+/*#define DO_MOTD*/
|
||||
|
||||
/* The MOTD file path */
|
||||
#ifndef MOTD_FILENAME
|
||||
@@ -242,7 +242,7 @@ Homedir is prepended unless path begins
|
||||
* note that it will be provided for all "hidden" client-interactive
|
||||
* style prompts - if you want something more sophisticated, use
|
||||
* SSH_ASKPASS instead. Comment out this var to remove this functionality.*/
|
||||
-#define DROPBEAR_PASSWORD_ENV "DROPBEAR_PASSWORD"
|
||||
+/*#define DROPBEAR_PASSWORD_ENV "DROPBEAR_PASSWORD"*/
|
||||
|
||||
/* Define this (as well as ENABLE_CLI_PASSWORD_AUTH) to allow the use of
|
||||
* a helper program for the ssh client. The helper program should be
|
||||
@ -1,6 +1,6 @@
|
||||
--- a/cli-runopts.c
|
||||
+++ b/cli-runopts.c
|
||||
@@ -299,6 +299,8 @@ void cli_getopts(int argc, char ** argv)
|
||||
@@ -296,6 +296,8 @@ void cli_getopts(int argc, char ** argv)
|
||||
debug_trace = 1;
|
||||
break;
|
||||
#endif
|
||||
@ -8,4 +8,4 @@
|
||||
+ break;
|
||||
case 'F':
|
||||
case 'e':
|
||||
#if !DROPBEAR_USER_ALGO_LIST
|
||||
#ifndef ENABLE_USER_ALGO_LIST
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
--- a/dbutil.h
|
||||
+++ b/dbutil.h
|
||||
@@ -75,7 +75,11 @@ int m_str_to_uint(const char* str, unsig
|
||||
@@ -78,7 +78,11 @@ int m_str_to_uint(const char* str, unsig
|
||||
#define DEF_MP_INT(X) mp_int X = {0, 0, 0, NULL}
|
||||
|
||||
/* Dropbear assertion */
|
||||
|
||||
@ -0,0 +1,14 @@
|
||||
--- a/options.h
|
||||
+++ b/options.h
|
||||
@@ -5,6 +5,11 @@
|
||||
#ifndef DROPBEAR_OPTIONS_H_
|
||||
#define DROPBEAR_OPTIONS_H_
|
||||
|
||||
+#if !defined(DROPBEAR_CLIENT) && !defined(DROPBEAR_SERVER)
|
||||
+#define DROPBEAR_SERVER
|
||||
+#define DROPBEAR_CLIENT
|
||||
+#endif
|
||||
+
|
||||
/* Define compile-time options below - the "#ifndef DROPBEAR_XXX .... #endif"
|
||||
* parts are to allow for commandline -DDROPBEAR_XXX options etc. */
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
--- a/Makefile.in
|
||||
+++ b/Makefile.in
|
||||
@@ -189,17 +189,17 @@ dropbearkey: $(dropbearkeyobjs)
|
||||
@@ -163,17 +163,17 @@ dropbearkey: $(dropbearkeyobjs)
|
||||
dropbearconvert: $(dropbearconvertobjs)
|
||||
|
||||
dropbear: $(HEADERS) $(LIBTOM_DEPS) Makefile
|
||||
@ -12,8 +12,8 @@
|
||||
+ +$(CC) $(LDFLAGS) -o $@$(EXEEXT) $($@objs) $(LIBTOM_LIBS) $(LIBS)
|
||||
|
||||
dropbearkey dropbearconvert: $(HEADERS) $(LIBTOM_DEPS) Makefile
|
||||
- $(CC) $(LDFLAGS) -o $@$(EXEEXT) $($@objs) $(LIBTOM_LIBS) $(LIBS)
|
||||
+ +$(CC) $(LDFLAGS) -o $@$(EXEEXT) $($@objs) $(LIBTOM_LIBS) $(LIBS)
|
||||
- $(CC) $(LDFLAGS) -o $@$(EXEEXT) $($@objs) $(LIBTOM_LIBS)
|
||||
+ +$(CC) $(LDFLAGS) -o $@$(EXEEXT) $($@objs) $(LIBTOM_LIBS)
|
||||
|
||||
# scp doesn't use the libs so is special.
|
||||
scp: $(SCPOBJS) $(HEADERS) Makefile
|
||||
@ -22,7 +22,7 @@
|
||||
|
||||
|
||||
# multi-binary compilation.
|
||||
@@ -210,7 +210,7 @@ ifeq ($(MULTI),1)
|
||||
@@ -184,7 +184,7 @@ ifeq ($(MULTI),1)
|
||||
endif
|
||||
|
||||
dropbearmulti$(EXEEXT): $(HEADERS) $(MULTIOBJS) $(LIBTOM_DEPS) Makefile
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
--- a/svr-auth.c
|
||||
+++ b/svr-auth.c
|
||||
@@ -125,7 +125,7 @@ void recv_msg_userauth_request() {
|
||||
@@ -149,7 +149,7 @@ void recv_msg_userauth_request() {
|
||||
AUTH_METHOD_NONE_LEN) == 0) {
|
||||
TRACE(("recv_msg_userauth_request: 'none' request"))
|
||||
if (valid_user
|
||||
|
||||
@ -0,0 +1,18 @@
|
||||
--- a/svr-runopts.c
|
||||
+++ b/svr-runopts.c
|
||||
@@ -505,6 +505,7 @@ void load_all_hostkeys() {
|
||||
m_free(hostkey_file);
|
||||
}
|
||||
|
||||
+ if (svr_opts.num_hostkey_files <= 0) {
|
||||
#ifdef DROPBEAR_RSA
|
||||
loadhostkey(RSA_PRIV_FILENAME, 0);
|
||||
#endif
|
||||
@@ -516,6 +517,7 @@ void load_all_hostkeys() {
|
||||
#ifdef DROPBEAR_ECDSA
|
||||
loadhostkey(ECDSA_PRIV_FILENAME, 0);
|
||||
#endif
|
||||
+ }
|
||||
|
||||
#ifdef DROPBEAR_DELAY_HOSTKEY
|
||||
if (svr_opts.delay_hostkey) {
|
||||
@ -1,56 +0,0 @@
|
||||
--- a/configure.ac
|
||||
+++ b/configure.ac
|
||||
@@ -70,53 +70,6 @@ AC_ARG_ENABLE(harden,
|
||||
|
||||
if test "$hardenbuild" -eq 1; then
|
||||
AC_MSG_NOTICE(Checking for available hardened build flags:)
|
||||
- # relocation flags don't make sense for static builds
|
||||
- if test "$STATIC" -ne 1; then
|
||||
- # pie
|
||||
- DB_TRYADDCFLAGS([-fPIE])
|
||||
-
|
||||
- OLDLDFLAGS="$LDFLAGS"
|
||||
- TESTFLAGS="-Wl,-pie"
|
||||
- LDFLAGS="$LDFLAGS $TESTFLAGS"
|
||||
- AC_LINK_IFELSE([AC_LANG_PROGRAM([])],
|
||||
- [AC_MSG_NOTICE([Setting $TESTFLAGS])],
|
||||
- [
|
||||
- LDFLAGS="$OLDLDFLAGS"
|
||||
- TESTFLAGS="-pie"
|
||||
- LDFLAGS="$LDFLAGS $TESTFLAGS"
|
||||
- AC_LINK_IFELSE([AC_LANG_PROGRAM([])],
|
||||
- [AC_MSG_NOTICE([Setting $TESTFLAGS])],
|
||||
- [AC_MSG_NOTICE([Not setting $TESTFLAGS]); LDFLAGS="$OLDLDFLAGS" ]
|
||||
- )
|
||||
- ]
|
||||
- )
|
||||
- # readonly elf relocation sections (relro)
|
||||
- OLDLDFLAGS="$LDFLAGS"
|
||||
- TESTFLAGS="-Wl,-z,now -Wl,-z,relro"
|
||||
- LDFLAGS="$LDFLAGS $TESTFLAGS"
|
||||
- AC_LINK_IFELSE([AC_LANG_PROGRAM([])],
|
||||
- [AC_MSG_NOTICE([Setting $TESTFLAGS])],
|
||||
- [AC_MSG_NOTICE([Not setting $TESTFLAGS]); LDFLAGS="$OLDLDFLAGS" ]
|
||||
- )
|
||||
- fi # non-static
|
||||
- # stack protector. -strong is good but only in gcc 4.9 or later
|
||||
- OLDCFLAGS="$CFLAGS"
|
||||
- TESTFLAGS="-fstack-protector-strong"
|
||||
- CFLAGS="$CFLAGS $TESTFLAGS"
|
||||
- AC_COMPILE_IFELSE([AC_LANG_PROGRAM([])],
|
||||
- [AC_MSG_NOTICE([Setting $TESTFLAGS])],
|
||||
- [
|
||||
- CFLAGS="$OLDCFLAGS"
|
||||
- TESTFLAGS="-fstack-protector --param=ssp-buffer-size=4"
|
||||
- CFLAGS="$CFLAGS $TESTFLAGS"
|
||||
- AC_COMPILE_IFELSE([AC_LANG_PROGRAM([])],
|
||||
- [AC_MSG_NOTICE([Setting $TESTFLAGS])],
|
||||
- [AC_MSG_NOTICE([Not setting $TESTFLAGS]); CFLAGS="$OLDCFLAGS" ]
|
||||
- )
|
||||
- ]
|
||||
- )
|
||||
- # FORTIFY_SOURCE
|
||||
- DB_TRYADDCFLAGS([-D_FORTIFY_SOURCE=2])
|
||||
|
||||
# Spectre v2 mitigations
|
||||
DB_TRYADDCFLAGS([-mfunction-return=thunk])
|
||||
@ -1,48 +0,0 @@
|
||||
--- a/libtomcrypt/makefile_include.mk
|
||||
+++ b/libtomcrypt/makefile_include.mk
|
||||
@@ -75,6 +75,13 @@ endif
|
||||
|
||||
LTC_CFLAGS += -Wno-type-limits
|
||||
|
||||
+ifdef OPENWRT_BUILD
|
||||
+ ifeq (-Os,$(filter -Os,$(CFLAGS)))
|
||||
+ LTC_CFLAGS += -DLTC_SMALL_CODE
|
||||
+ endif
|
||||
+else
|
||||
+ ### ! OPENWRT_BUILD
|
||||
+
|
||||
ifdef LTC_DEBUG
|
||||
$(info Debug build)
|
||||
# compile for DEBUGGING (required for ccmalloc checking!!!)
|
||||
@@ -102,6 +109,9 @@ endif
|
||||
endif # COMPILE_SMALL
|
||||
endif # COMPILE_DEBUG
|
||||
|
||||
+ ### ! OPENWRT_BUILD
|
||||
+endif
|
||||
+
|
||||
|
||||
ifneq ($(findstring clang,$(CC)),)
|
||||
LTC_CFLAGS += -Wno-typedef-redefinition -Wno-tautological-compare -Wno-builtin-requires-header -Wno-missing-field-initializers
|
||||
--- a/libtommath/makefile_include.mk
|
||||
+++ b/libtommath/makefile_include.mk
|
||||
@@ -37,6 +37,9 @@ CFLAGS += -Wsystem-headers -Wdeclaration
|
||||
CFLAGS += -Wstrict-prototypes -Wpointer-arith
|
||||
endif
|
||||
|
||||
+ifndef OPENWRT_BUILD
|
||||
+ ### ! OPENWRT_BUILD
|
||||
+
|
||||
ifdef COMPILE_DEBUG
|
||||
#debug
|
||||
CFLAGS += -g3
|
||||
@@ -58,6 +61,9 @@ endif
|
||||
endif # COMPILE_SIZE
|
||||
endif # COMPILE_DEBUG
|
||||
|
||||
+ ### ! OPENWRT_BUILD
|
||||
+endif
|
||||
+
|
||||
ifneq ($(findstring clang,$(CC)),)
|
||||
CFLAGS += -Wno-typedef-redefinition -Wno-tautological-compare -Wno-builtin-requires-header
|
||||
endif
|
||||
Loading…
Reference in New Issue
Block a user