diff options
Diffstat (limited to 'meta/recipes-core/dropbear')
14 files changed, 138 insertions, 392 deletions
diff --git a/meta/recipes-core/dropbear/dropbear.inc b/meta/recipes-core/dropbear/dropbear.inc index bda7eb847c..7269888a4e 100644 --- a/meta/recipes-core/dropbear/dropbear.inc +++ b/meta/recipes-core/dropbear/dropbear.inc @@ -7,22 +7,21 @@ SECTION = "console/network" LICENSE = "MIT & BSD-3-Clause & BSD-2-Clause & PD" LIC_FILES_CHKSUM = "file://LICENSE;md5=a5ec40cafba26fc4396d0b550f824e01" -DEPENDS = "zlib" -RPROVIDES_${PN} = "ssh sshd" +DEPENDS = "zlib virtual/crypt" +RPROVIDES_${PN} = "ssh sshd" +RCONFLICTS_${PN} = "openssh-sshd openssh" DEPENDS += "${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'libpam', '', d)}" SRC_URI = "http://matt.ucc.asn.au/dropbear/releases/dropbear-${PV}.tar.bz2 \ file://0001-urandom-xauth-changes-to-options.h.patch \ - file://0003-configure.patch \ - file://0004-fix-2kb-keys.patch \ - file://0007-dropbear-fix-for-x32-abi.patch \ - file://fix-libtomcrypt-libtommath-ordering.patch \ file://init \ file://dropbearkey.service \ file://dropbear@.service \ file://dropbear.socket \ - ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', '', d)} " + file://dropbear.default \ + ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', '', d)} \ + ${@bb.utils.contains('PACKAGECONFIG', 'disable-weak-ciphers', 'file://dropbear-disable-weak-ciphers.patch', '', d)} " PAM_SRC_URI = "file://0005-dropbear-enable-pam.patch \ file://0006-dropbear-configuration-file.patch \ @@ -37,6 +36,8 @@ RDEPENDS_${PN} += "${@bb.utils.contains('DISTRO_FEATURES', 'pam', '${PAM_PLUGINS inherit autotools update-rc.d systemd +CVE_PRODUCT = "dropbear_ssh" + INITSCRIPT_NAME = "dropbear" INITSCRIPT_PARAMS = "defaults 10" @@ -46,12 +47,17 @@ SBINCOMMANDS = "dropbear dropbearkey dropbearconvert" BINCOMMANDS = "dbclient ssh scp" EXTRA_OEMAKE = 'MULTI=1 SCPPROGRESS=1 PROGRAMS="${SBINCOMMANDS} ${BINCOMMANDS}"' -PACKAGECONFIG ?= "" +PACKAGECONFIG ?= "disable-weak-ciphers" PACKAGECONFIG[system-libtom] = "--disable-bundled-libtom,--enable-bundled-libtom,libtommath libtomcrypt" +PACKAGECONFIG[disable-weak-ciphers] = "" EXTRA_OECONF += "\ ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '--enable-pam', '--disable-pam', d)}" +# This option appends to CFLAGS and LDFLAGS from OE +# This is causing [textrel] QA warning +EXTRA_OECONF += "--disable-harden" + do_install() { install -d ${D}${sysconfdir} \ ${D}${sysconfdir}/init.d \ @@ -61,9 +67,16 @@ do_install() { ${D}${sbindir} \ ${D}${localstatedir} + install -m 0644 ${WORKDIR}/dropbear.default ${D}${sysconfdir}/default/dropbear + install -m 0755 dropbearmulti ${D}${sbindir}/ - ln -s ${sbindir}/dropbearmulti ${D}${bindir}/dbclient - + + for i in ${BINCOMMANDS} + do + # ssh and scp symlinks are created by update-alternatives + if [ $i = ssh ] || [ $i = scp ]; then continue; fi + ln -s ${sbindir}/dropbearmulti ${D}${bindir}/$i + done for i in ${SBINCOMMANDS} do ln -s ./dropbearmulti ${D}${sbindir}/$i @@ -74,7 +87,7 @@ do_install() { -e 's,/usr/bin,${bindir},g' \ -e 's,/usr,${prefix},g' ${WORKDIR}/init > ${D}${sysconfdir}/init.d/dropbear chmod 755 ${D}${sysconfdir}/init.d/dropbear - if [ "${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'pam', '', d)}" = "pam" ]; then + if [ "${@bb.utils.filter('DISTRO_FEATURES', 'pam', d)}" ]; then install -d ${D}${sysconfdir}/pam.d install -m 0644 ${WORKDIR}/dropbear ${D}${sysconfdir}/pam.d/ fi @@ -93,7 +106,7 @@ do_install() { inherit update-alternatives ALTERNATIVE_PRIORITY = "20" -ALTERNATIVE_${PN} = "scp ssh" +ALTERNATIVE_${PN} = "${@bb.utils.filter('BINCOMMANDS', 'scp ssh', d)}" ALTERNATIVE_TARGET = "${sbindir}/dropbearmulti" @@ -105,3 +118,5 @@ pkg_postrm_append_${PN} () { rm ${sysconfdir}/dropbear/dropbear_dss_host_key fi } + +FILES_${PN} += "${bindir}" diff --git a/meta/recipes-core/dropbear/dropbear/0001-urandom-xauth-changes-to-options.h.patch b/meta/recipes-core/dropbear/dropbear/0001-urandom-xauth-changes-to-options.h.patch index dc9d5782e8..684641dcbd 100644 --- a/meta/recipes-core/dropbear/dropbear/0001-urandom-xauth-changes-to-options.h.patch +++ b/meta/recipes-core/dropbear/dropbear/0001-urandom-xauth-changes-to-options.h.patch @@ -2,20 +2,20 @@ Subject: [PATCH 1/6] urandom-xauth-changes-to-options.h Upstream-Status: Inappropriate [configuration] --- - options.h | 2 +- + default_options.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -diff --git a/options.h b/options.h -index 7d06322..71a21c2 100644 ---- a/options.h -+++ b/options.h -@@ -247,7 +247,7 @@ much traffic. */ +diff --git a/default_options.h b/default_options.h +index 3b75eb8..1fd8082 100644 +--- a/default_options.h ++++ b/default_options.h +@@ -243,7 +243,7 @@ Homedir is prepended unless path begins with / */ + /* The command to invoke for xauth when using X11 forwarding. * "-q" for quiet */ - #ifndef XAUTH_COMMAND -#define XAUTH_COMMAND "/usr/bin/xauth -q" +#define XAUTH_COMMAND "xauth -q" - #endif + /* if you want to enable running an sftp server (such as the one included with -- diff --git a/meta/recipes-core/dropbear/dropbear/0003-configure.patch b/meta/recipes-core/dropbear/dropbear/0003-configure.patch deleted file mode 100644 index c53ab01ddd..0000000000 --- a/meta/recipes-core/dropbear/dropbear/0003-configure.patch +++ /dev/null @@ -1,42 +0,0 @@ -From c5f5c5054c1b15539dccf866e2c3faba7ed68456 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Eric=20B=C3=A9nard?= <eric@eukrea.com> -Date: Thu, 25 Apr 2013 00:27:25 +0200 -Subject: [PATCH 3/6] configure: add a variable to allow openpty check to be cached - -Upstream-Status: Pending - ---- - configure.ac | 11 ++++++++--- - 1 file changed, 8 insertions(+), 3 deletions(-) - -diff --git a/configure.ac b/configure.ac -index 05461f3..9c16d90 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -166,15 +166,20 @@ AC_ARG_ENABLE(openpty, - AC_MSG_NOTICE(Not using openpty) - else - AC_MSG_NOTICE(Using openpty if available) -- AC_SEARCH_LIBS(openpty, util, [AC_DEFINE(HAVE_OPENPTY,,Have openpty() function)]) -+ AC_SEARCH_LIBS(openpty, util, [dropbear_cv_func_have_openpty=yes]) - fi - ], - [ - AC_MSG_NOTICE(Using openpty if available) -- AC_SEARCH_LIBS(openpty, util, [AC_DEFINE(HAVE_OPENPTY)]) -+ AC_SEARCH_LIBS(openpty, util, [dropbear_cv_func_have_openpty=yes]) - ] - ) -- -+ -+if test "x$dropbear_cv_func_have_openpty" = "xyes"; then -+ AC_DEFINE(HAVE_OPENPTY,,Have openpty() function) -+ no_ptc_check=yes -+ no_ptmx_check=yes -+fi - - AC_ARG_ENABLE(syslog, - [ --disable-syslog Don't include syslog support], --- -1.7.11.7 - diff --git a/meta/recipes-core/dropbear/dropbear/0004-fix-2kb-keys.patch b/meta/recipes-core/dropbear/dropbear/0004-fix-2kb-keys.patch deleted file mode 100644 index 7539d2034f..0000000000 --- a/meta/recipes-core/dropbear/dropbear/0004-fix-2kb-keys.patch +++ /dev/null @@ -1,22 +0,0 @@ -Subject: [PATCH 4/6] fix 2kb keys - -Upstream-Status: Inappropriate [configuration] ---- - kex.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/kex.h b/kex.h -index 72430e9..375c677 100644 ---- a/kex.h -+++ b/kex.h -@@ -67,6 +67,6 @@ struct KEXState { - }; - - --#define MAX_KEXHASHBUF 2000 -+#define MAX_KEXHASHBUF 3000 - - #endif /* _KEX_H_ */ --- -1.7.11.7 - diff --git a/meta/recipes-core/dropbear/dropbear/0005-dropbear-enable-pam.patch b/meta/recipes-core/dropbear/dropbear/0005-dropbear-enable-pam.patch index 539cb12e91..857681520c 100644 --- a/meta/recipes-core/dropbear/dropbear/0005-dropbear-enable-pam.patch +++ b/meta/recipes-core/dropbear/dropbear/0005-dropbear-enable-pam.patch @@ -3,7 +3,7 @@ From: Jussi Kukkonen <jussi.kukkonen@intel.com> Date: Wed, 2 Dec 2015 11:36:02 +0200 Subject: Enable pam -We need modify file option.h besides enabling pam in +We need modify file default_options.h besides enabling pam in configure if we want dropbear to support pam. Upstream-Status: Pending @@ -11,26 +11,32 @@ Upstream-Status: Pending Signed-off-by: Xiaofeng Yan <xiaofeng.yan@windriver.com> Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> --- - options.h | 4 ++-- + default_options.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -diff --git a/options.h b/options.h -index 94261f6..90bfe2f 100644 ---- a/options.h -+++ b/options.h -@@ -208,10 +208,10 @@ If you test it please contact the Dropbear author */ +diff --git a/default_options.h b/default_options.h +index 3b75eb8..8617cd0 100644 +--- a/default_options.h ++++ b/default_options.h +@@ -179,7 +179,7 @@ group1 in Dropbear server too */ - /* This requires crypt() */ - #ifdef HAVE_CRYPT --#define ENABLE_SVR_PASSWORD_AUTH -+/*#define ENABLE_SVR_PASSWORD_AUTH*/ - #endif - /* PAM requires ./configure --enable-pam */ --/*#define ENABLE_SVR_PAM_AUTH */ -+#define ENABLE_SVR_PAM_AUTH - #define ENABLE_SVR_PUBKEY_AUTH + /* Authentication Types - at least one required. + RFC Draft requires pubkey auth, and recommends password */ +-#define DROPBEAR_SVR_PASSWORD_AUTH 1 ++#define DROPBEAR_SVR_PASSWORD_AUTH 0 + + /* Note: PAM auth is quite simple and only works for PAM modules which just do + * a simple "Login: " "Password: " (you can edit the strings in svr-authpam.c). +@@ -187,7 +187,7 @@ group1 in Dropbear server too */ + * but there's an interface via a PAM module. It won't work for more complex + * PAM challenge/response. + * You can't enable both PASSWORD and PAM. */ +-#define DROPBEAR_SVR_PAM_AUTH 0 ++#define DROPBEAR_SVR_PAM_AUTH 1 + + /* ~/.ssh/authorized_keys authentication */ + #define DROPBEAR_SVR_PUBKEY_AUTH 1 - /* Whether to take public key options in -- 2.1.4 diff --git a/meta/recipes-core/dropbear/dropbear/0006-dropbear-configuration-file.patch b/meta/recipes-core/dropbear/dropbear/0006-dropbear-configuration-file.patch index fa4c8d0a67..deed78ffb9 100644 --- a/meta/recipes-core/dropbear/dropbear/0006-dropbear-configuration-file.patch +++ b/meta/recipes-core/dropbear/dropbear/0006-dropbear-configuration-file.patch @@ -1,4 +1,7 @@ -Subject: [PATCH 6/6] dropbear configuration file +From e3a5db1b6d3f6382a15b2266458c26c645a10f18 Mon Sep 17 00:00:00 2001 +From: Mingli Yu <Mingli.Yu@windriver.com> +Date: Thu, 6 Sep 2018 15:54:00 +0800 +Subject: [PATCH] dropbear configuration file dropbear: Change the path ("/etc/pam.d/sshd" as default) to find a pam configuration file \ to "/etc/pam.d/dropbear for dropbear when enabling pam supporting" @@ -7,12 +10,17 @@ Upstream-Status: Inappropriate [configuration] Signed-off-by: Maxin B. John <maxin.john@enea.com> Signed-off-by: Xiaofeng Yan <xiaofeng.yan@windriver.com> +Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com> --- -diff -Naur dropbear-2013.60-orig/svr-authpam.c dropbear-2013.60/svr-authpam.c ---- dropbear-2013.60-orig/svr-authpam.c 2013-10-16 16:34:53.000000000 +0200 -+++ dropbear-2013.60/svr-authpam.c 2013-10-21 17:04:04.969416055 +0200 -@@ -211,7 +211,7 @@ - userData.passwd = password; + svr-authpam.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/svr-authpam.c b/svr-authpam.c +index d201bc9..165ec5c 100644 +--- a/svr-authpam.c ++++ b/svr-authpam.c +@@ -223,7 +223,7 @@ void svr_auth_pam(int valid_user) { + } /* Init pam */ - if ((rc = pam_start("sshd", NULL, &pamConv, &pamHandlep)) != PAM_SUCCESS) { @@ -20,3 +28,6 @@ diff -Naur dropbear-2013.60-orig/svr-authpam.c dropbear-2013.60/svr-authpam.c dropbear_log(LOG_WARNING, "pam_start() failed, rc=%d, %s", rc, pam_strerror(pamHandlep, rc)); goto cleanup; +-- +2.7.4 + diff --git a/meta/recipes-core/dropbear/dropbear/0007-dropbear-fix-for-x32-abi.patch b/meta/recipes-core/dropbear/dropbear/0007-dropbear-fix-for-x32-abi.patch deleted file mode 100644 index 60b302b5cd..0000000000 --- a/meta/recipes-core/dropbear/dropbear/0007-dropbear-fix-for-x32-abi.patch +++ /dev/null @@ -1,140 +0,0 @@ -Upstream-Status: Pending - -The dropbearkey utility built in x32 abi format, when generating ssh -keys, was getting lost in the infinite loop. - -This patch fixes the issue by fixing types of variables and -parameters of functions used in the code, which were getting -undesired size, when compiled with the x32 abi toolchain. - -2013/05/23 -Received this fix from H J Lu. - -Signed-off-by: Nitin A Kamble <nitin.a.kamble@intel.com> - -# HG changeset patch -# User H.J. Lu <hjl.tools@gmail.com> -# Date 1369344079 25200 -# Node ID a10a1c46b857cc8a3923c3bb6d1504aa25b6052f -# Parent e76614145aea67f66e4a4257685c771efba21aa1 -Typdef mp_digit to unsigned long long for MP_64BIT - -When GCC is used with MP_64BIT, we should typedef mp_digit to unsigned -long long instead of unsigned long since for x32, unsigned long is -32-bit and unsigned long long is 64-bit and it is safe to use unsigned -long long for 64-bit integer with GCC. - -diff -r e76614145aea -r a10a1c46b857 libtommath/tommath.h ---- a/libtommath/tommath.h Thu Apr 18 22:57:47 2013 +0800 -+++ b/libtommath/tommath.h Thu May 23 14:21:19 2013 -0700 -@@ -73,7 +73,7 @@ - typedef signed long long long64; - #endif - -- typedef unsigned long mp_digit; -+ typedef unsigned long long mp_digit; - typedef unsigned long mp_word __attribute__ ((mode(TI))); - - #define DIGIT_BIT 60 -# HG changeset patch -# User H.J. Lu <hjl.tools@gmail.com> -# Date 1369344241 25200 -# Node ID c7555a4cb7ded3a88409ba85f4027baa7af5f536 -# Parent a10a1c46b857cc8a3923c3bb6d1504aa25b6052f -Cast to mp_digit when updating *rho - -There is - -int -mp_montgomery_setup (mp_int * n, mp_digit * rho) - -We should cast to mp_digit instead of unsigned long when updating -*rho since mp_digit may be unsigned long long and unsigned long long -may be different from unsigned long, like in x32. - -diff -r a10a1c46b857 -r c7555a4cb7de libtommath/bn_mp_montgomery_setup.c ---- a/libtommath/bn_mp_montgomery_setup.c Thu May 23 14:21:19 2013 -0700 -+++ b/libtommath/bn_mp_montgomery_setup.c Thu May 23 14:24:01 2013 -0700 -@@ -48,7 +48,7 @@ - #endif - - /* rho = -1/m mod b */ -- *rho = (unsigned long)(((mp_word)1 << ((mp_word) DIGIT_BIT)) - x) & MP_MASK; -+ *rho = (mp_digit)(((mp_word)1 << ((mp_word) DIGIT_BIT)) - x) & MP_MASK; - - return MP_OKAY; - } -# HG changeset patch -# User H.J. Lu <hjl.tools@gmail.com> -# Date 1369344541 25200 -# Node ID 7c656e7071a6412688b2f30a529a9afac6c7bf5a -# Parent c7555a4cb7ded3a88409ba85f4027baa7af5f536 -Define LTC_FAST_TYPE to unsigned long long for __x86_64__ - -We should define LTC_FAST_TYPE to unsigned long long instead of unsigned -long if __x86_64__ to support x32 where unsigned long long is 64-bit -and unsigned long is 32-bit. - -diff -r c7555a4cb7de -r 7c656e7071a6 libtomcrypt/src/headers/tomcrypt_cfg.h ---- a/libtomcrypt/src/headers/tomcrypt_cfg.h Thu May 23 14:24:01 2013 -0700 -+++ b/libtomcrypt/src/headers/tomcrypt_cfg.h Thu May 23 14:29:01 2013 -0700 -@@ -74,7 +74,7 @@ - #define ENDIAN_LITTLE - #define ENDIAN_64BITWORD - #define LTC_FAST -- #define LTC_FAST_TYPE unsigned long -+ #define LTC_FAST_TYPE unsigned long long - #endif - - /* detect PPC32 */ -# HG changeset patch -# User H.J. Lu <hjl.tools@gmail.com> -# Date 1369344730 25200 -# Node ID a7d4690158fae4ede2c4e5b56233e83730bf38ee -# Parent 7c656e7071a6412688b2f30a529a9afac6c7bf5a -Use unsigned long long aas unsigned 64-bit integer for x86-64 GCC - -We should use unsigned long long instead of unsigned long as unsigned -64-bit integer for x86-64 GCC to support x32 where unsigned long is -32-bit. - -diff -r 7c656e7071a6 -r a7d4690158fa libtomcrypt/src/headers/tomcrypt_macros.h ---- a/libtomcrypt/src/headers/tomcrypt_macros.h Thu May 23 14:29:01 2013 -0700 -+++ b/libtomcrypt/src/headers/tomcrypt_macros.h Thu May 23 14:32:10 2013 -0700 -@@ -343,7 +343,7 @@ - /* 64-bit Rotates */ - #if !defined(__STRICT_ANSI__) && defined(__GNUC__) && defined(__x86_64__) && !defined(LTC_NO_ASM) - --static inline unsigned long ROL64(unsigned long word, int i) -+static inline unsigned long long ROL64(unsigned long long word, int i) - { - asm("rolq %%cl,%0" - :"=r" (word) -@@ -351,7 +351,7 @@ - return word; - } - --static inline unsigned long ROR64(unsigned long word, int i) -+static inline unsigned long long ROR64(unsigned long long word, int i) - { - asm("rorq %%cl,%0" - :"=r" (word) -@@ -361,7 +361,7 @@ - - #ifndef LTC_NO_ROLC - --static inline unsigned long ROL64c(unsigned long word, const int i) -+static inline unsigned long long ROL64c(unsigned long long word, const int i) - { - asm("rolq %2,%0" - :"=r" (word) -@@ -369,7 +369,7 @@ - return word; - } - --static inline unsigned long ROR64c(unsigned long word, const int i) -+static inline unsigned long long ROR64c(unsigned long long word, const int i) - { - asm("rorq %2,%0" - :"=r" (word) - diff --git a/meta/recipes-core/dropbear/dropbear/dropbear-disable-weak-ciphers.patch b/meta/recipes-core/dropbear/dropbear/dropbear-disable-weak-ciphers.patch new file mode 100644 index 0000000000..e48a34bac0 --- /dev/null +++ b/meta/recipes-core/dropbear/dropbear/dropbear-disable-weak-ciphers.patch @@ -0,0 +1,44 @@ +This feature disables all CBC, SHA1, and diffie-hellman group1 ciphers +in the dropbear ssh server and client since they're considered weak ciphers +and we want to support the stong algorithms. + +Upstream-Status: Inappropriate [configuration] +Signed-off-by: Joseph Reynolds <joseph.reynolds1@ibm.com> + +Index: dropbear-2019.78/default_options.h +=================================================================== +--- dropbear-2019.78.orig/default_options.h ++++ dropbear-2019.78/default_options.h +@@ -91,7 +91,7 @@ IMPORTANT: Some options will require "ma + + /* Enable CBC mode for ciphers. This has security issues though + * is the most compatible with older SSH implementations */ +-#define DROPBEAR_ENABLE_CBC_MODE 1 ++#define DROPBEAR_ENABLE_CBC_MODE 0 + + /* Enable "Counter Mode" for ciphers. This is more secure than + * CBC mode against certain attacks. It is recommended for security +@@ -101,7 +101,7 @@ IMPORTANT: Some options will require "ma + /* Message integrity. sha2-256 is recommended as a default, + sha1 for compatibility */ + #define DROPBEAR_SHA1_HMAC 1 +-#define DROPBEAR_SHA1_96_HMAC 1 ++#define DROPBEAR_SHA1_96_HMAC 0 + #define DROPBEAR_SHA2_256_HMAC 1 + + /* Hostkey/public key algorithms - at least one required, these are used +@@ -149,12 +149,12 @@ IMPORTANT: Some options will require "ma + * Small systems should generally include either curve25519 or ecdh for performance. + * curve25519 is less widely supported but is faster + */ +-#define DROPBEAR_DH_GROUP14_SHA1 1 ++#define DROPBEAR_DH_GROUP14_SHA1 0 + #define DROPBEAR_DH_GROUP14_SHA256 1 + #define DROPBEAR_DH_GROUP16 0 + #define DROPBEAR_CURVE25519 1 + #define DROPBEAR_ECDH 1 +-#define DROPBEAR_DH_GROUP1 1 ++#define DROPBEAR_DH_GROUP1 0 + + /* When group1 is enabled it will only be allowed by Dropbear client + not as a server, due to concerns over its strength. Set to 0 to allow diff --git a/meta/recipes-core/dropbear/dropbear/dropbear.default b/meta/recipes-core/dropbear/dropbear/dropbear.default new file mode 100644 index 0000000000..522453a86c --- /dev/null +++ b/meta/recipes-core/dropbear/dropbear/dropbear.default @@ -0,0 +1,2 @@ +# Disallow root logins by default +DROPBEAR_EXTRA_ARGS="-w" diff --git a/meta/recipes-core/dropbear/dropbear/fix-libtomcrypt-libtommath-ordering.patch b/meta/recipes-core/dropbear/dropbear/fix-libtomcrypt-libtommath-ordering.patch deleted file mode 100644 index de930f29d1..0000000000 --- a/meta/recipes-core/dropbear/dropbear/fix-libtomcrypt-libtommath-ordering.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 2fd8d2aedad0c50cdf1e43edd2387874b720ad4c Mon Sep 17 00:00:00 2001 -From: Andre McCurdy <armccurdy@gmail.com> -Date: Fri, 16 Sep 2016 12:18:23 -0700 -Subject: [PATCH] fix libtomcrypt/libtommath ordering - -To prevent build failures when using system libtom libraries and -linking with --as-needed, LIBTOM_LIBS should be in the order --ltomcrypt -ltommath, not the other way around, ie libs should be -prepended to LIBTOM_LIBS as they are found, not appended. - -Note that LIBTOM_LIBS is not used when linking with the bundled -libtom libs. - -Upstream-Status: Pending - -Signed-off-by: Andre McCurdy <armccurdy@gmail.com> ---- - configure.ac | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/configure.ac b/configure.ac -index b6abe4c..85bb8bc 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -390,16 +390,16 @@ AC_ARG_ENABLE(bundled-libtom, - AC_MSG_NOTICE(Forcing bundled libtom*) - else - BUNDLED_LIBTOM=0 -- AC_CHECK_LIB(tommath, mp_exptmod, LIBTOM_LIBS="$LIBTOM_LIBS -ltommath", -+ AC_CHECK_LIB(tommath, mp_exptmod, LIBTOM_LIBS="-ltommath $LIBTOM_LIBS", - [AC_MSG_ERROR([Missing system libtommath and --disable-bundled-libtom was specified])] ) -- AC_CHECK_LIB(tomcrypt, register_cipher, LIBTOM_LIBS="$LIBTOM_LIBS -ltomcrypt", -+ AC_CHECK_LIB(tomcrypt, register_cipher, LIBTOM_LIBS="-ltomcrypt $LIBTOM_LIBS", - [AC_MSG_ERROR([Missing system libtomcrypt and --disable-bundled-libtom was specified])] ) - fi - ], - [ - BUNDLED_LIBTOM=0 -- AC_CHECK_LIB(tommath, mp_exptmod, LIBTOM_LIBS="$LIBTOM_LIBS -ltommath", BUNDLED_LIBTOM=1) -- AC_CHECK_LIB(tomcrypt, register_cipher, LIBTOM_LIBS="$LIBTOM_LIBS -ltomcrypt", BUNDLED_LIBTOM=1) -+ AC_CHECK_LIB(tommath, mp_exptmod, LIBTOM_LIBS="-ltommath $LIBTOM_LIBS", BUNDLED_LIBTOM=1) -+ AC_CHECK_LIB(tomcrypt, register_cipher, LIBTOM_LIBS="-ltomcrypt $LIBTOM_LIBS", BUNDLED_LIBTOM=1) - ] - ) - --- -1.9.1 - diff --git a/meta/recipes-core/dropbear/dropbear/init b/meta/recipes-core/dropbear/dropbear/init index 434bd6b971..ffab7a2362 100755 --- a/meta/recipes-core/dropbear/dropbear/init +++ b/meta/recipes-core/dropbear/dropbear/init @@ -17,8 +17,11 @@ NAME=dropbear DESC="Dropbear SSH server" PIDFILE=/var/run/dropbear.pid +# These values may be replaced by those from /etc/default/dropbear +DROPBEAR_RSAKEY_DIR="/etc/dropbear" DROPBEAR_PORT=22 DROPBEAR_EXTRA_ARGS= +DROPBEAR_RSAKEY_ARGS= NO_START=0 set -e @@ -28,61 +31,27 @@ test "$NO_START" = "0" || exit 0 test -x "$DAEMON" || exit 0 test ! -h /var/service/dropbear || exit 0 -readonly_rootfs=0 -for flag in `awk '{ if ($2 == "/") { split($4,FLAGS,",") } }; END { for (f in FLAGS) print FLAGS[f] }' </proc/mounts`; do - case $flag in - ro) - readonly_rootfs=1 - ;; - esac -done - -if [ $readonly_rootfs = "1" ]; then - mkdir -p /var/lib/dropbear - DROPBEAR_RSAKEY_DEFAULT="/var/lib/dropbear/dropbear_rsa_host_key" - DROPBEAR_DSSKEY_DEFAULT="/var/lib/dropbear/dropbear_dss_host_key" -else - DROPBEAR_RSAKEY_DEFAULT="/etc/dropbear/dropbear_rsa_host_key" - DROPBEAR_DSSKEY_DEFAULT="/etc/dropbear/dropbear_dss_host_key" -fi - test -z "$DROPBEAR_BANNER" || \ DROPBEAR_EXTRA_ARGS="$DROPBEAR_EXTRA_ARGS -b $DROPBEAR_BANNER" test -n "$DROPBEAR_RSAKEY" || \ - DROPBEAR_RSAKEY=$DROPBEAR_RSAKEY_DEFAULT -test -n "$DROPBEAR_DSSKEY" || \ - DROPBEAR_DSSKEY=$DROPBEAR_DSSKEY_DEFAULT -test -n "$DROPBEAR_KEYTYPES" || \ - DROPBEAR_KEYTYPES="rsa" + DROPBEAR_RSAKEY="${DROPBEAR_RSAKEY_DIR}/dropbear_rsa_host_key" gen_keys() { -for t in $DROPBEAR_KEYTYPES; do - case $t in - rsa) - if [ -f "$DROPBEAR_RSAKEY" -a ! -s "$DROPBEAR_RSAKEY" ]; then - rm $DROPBEAR_RSAKEY || true - fi - test -f $DROPBEAR_RSAKEY || dropbearkey -t rsa -f $DROPBEAR_RSAKEY $DROPBEAR_RSAKEY_ARGS - ;; - dsa) - if [ -f "$DROPBEAR_DSSKEY" -a ! -s "$DROPBEAR_DSSKEY" ]; then - rm $DROPBEAR_DSSKEY || true - fi - test -f $DROPBEAR_DSSKEY || dropbearkey -t dss -f $DROPBEAR_DSSKEY $DROPBEAR_DSSKEY_ARGS - ;; - esac -done + if [ -f "$DROPBEAR_RSAKEY" -a ! -s "$DROPBEAR_RSAKEY" ]; then + rm $DROPBEAR_RSAKEY || true + fi + if [ ! -f "$DROPBEAR_RSAKEY" ]; then + mkdir -p ${DROPBEAR_RSAKEY%/*} + dropbearkey -t rsa -f $DROPBEAR_RSAKEY $DROPBEAR_RSAKEY_ARGS + fi } case "$1" in start) echo -n "Starting $DESC: " gen_keys - KEY_ARGS="" - test -f $DROPBEAR_DSSKEY && KEY_ARGS="$KEY_ARGS -d $DROPBEAR_DSSKEY" - test -f $DROPBEAR_RSAKEY && KEY_ARGS="$KEY_ARGS -r $DROPBEAR_RSAKEY" start-stop-daemon -S -p $PIDFILE \ - -x "$DAEMON" -- $KEY_ARGS \ + -x "$DAEMON" -- -r $DROPBEAR_RSAKEY \ -p "$DROPBEAR_PORT" $DROPBEAR_EXTRA_ARGS echo "$NAME." ;; @@ -95,11 +64,8 @@ case "$1" in echo -n "Restarting $DESC: " start-stop-daemon -K -x "$DAEMON" -p $PIDFILE sleep 1 - KEY_ARGS="" - test -f $DROPBEAR_DSSKEY && KEY_ARGS="$KEY_ARGS -d $DROPBEAR_DSSKEY" - test -f $DROPBEAR_RSAKEY && KEY_ARGS="$KEY_ARGS -r $DROPBEAR_RSAKEY" start-stop-daemon -S -p $PIDFILE \ - -x "$DAEMON" -- $KEY_ARGS \ + -x "$DAEMON" -- -r $DROPBEAR_RSAKEY \ -p "$DROPBEAR_PORT" $DROPBEAR_EXTRA_ARGS echo "$NAME." ;; diff --git a/meta/recipes-core/dropbear/dropbear/support-out-of-tree-builds.patch b/meta/recipes-core/dropbear/dropbear/support-out-of-tree-builds.patch deleted file mode 100644 index df6efb4534..0000000000 --- a/meta/recipes-core/dropbear/dropbear/support-out-of-tree-builds.patch +++ /dev/null @@ -1,43 +0,0 @@ -From: =?UTF-8?q?Henrik=20Nordstr=C3=B6m?= <henrik@knc.nu> -Date: Wed, 11 May 2016 12:35:06 +0200 -Subject: [PATCH] Support out-of-tree builds usign bundled libtom - -When building out-of-tree we need both source and generated -folders in include paths to find both distributed and generated -headers. - - - -Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> -Upstream-Status: Backport ---- - libtomcrypt/Makefile.in | 2 +- - libtommath/Makefile.in | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/libtomcrypt/Makefile.in b/libtomcrypt/Makefile.in -index 3056ef0..7970700 100644 ---- a/libtomcrypt/Makefile.in -+++ b/libtomcrypt/Makefile.in -@@ -19,7 +19,7 @@ srcdir=@srcdir@ - - # Compilation flags. Note the += does not write over the user's CFLAGS! - # The rest of the flags come from the parent Dropbear makefile --CFLAGS += -c -I$(srcdir)/src/headers/ -I$(srcdir)/../ -DLTC_SOURCE -I$(srcdir)/../libtommath/ -+CFLAGS += -c -Isrc/headers/ -I$(srcdir)/src/headers/ -I../ -I$(srcdir)/../ -DLTC_SOURCE -I../libtommath/ -I$(srcdir)/../libtommath/ - - # additional warnings (newer GCC 3.4 and higher) - ifdef GCC_34 -diff --git a/libtommath/Makefile.in b/libtommath/Makefile.in -index 06aba68..019c50b 100644 ---- a/libtommath/Makefile.in -+++ b/libtommath/Makefile.in -@@ -9,7 +9,7 @@ VPATH=@srcdir@ - srcdir=@srcdir@ - - # So that libtommath can include Dropbear headers for options and m_burn() --CFLAGS += -I$(srcdir)/../libtomcrypt/src/headers/ -I$(srcdir)/../ -+CFLAGS += -I. -I$(srcdir) -I../libtomcrypt/src/headers/ -I$(srcdir)/../libtomcrypt/src/headers/ -I../ -I$(srcdir)/../ - - ifndef IGNORE_SPEED - diff --git a/meta/recipes-core/dropbear/dropbear_2016.74.bb b/meta/recipes-core/dropbear/dropbear_2016.74.bb deleted file mode 100644 index a7020978a1..0000000000 --- a/meta/recipes-core/dropbear/dropbear_2016.74.bb +++ /dev/null @@ -1,7 +0,0 @@ -require dropbear.inc - -SRC_URI += "file://support-out-of-tree-builds.patch" - -SRC_URI[md5sum] = "9ad0172731e0f16623937804643b5bd8" -SRC_URI[sha256sum] = "2720ea54ed009af812701bcc290a2a601d5c107d12993e5d92c0f5f81f718891" - diff --git a/meta/recipes-core/dropbear/dropbear_2019.78.bb b/meta/recipes-core/dropbear/dropbear_2019.78.bb new file mode 100644 index 0000000000..d2cd8161bf --- /dev/null +++ b/meta/recipes-core/dropbear/dropbear_2019.78.bb @@ -0,0 +1,4 @@ +require dropbear.inc + +SRC_URI[md5sum] = "a972c85ed678ad0fdcb7844e1294fb54" +SRC_URI[sha256sum] = "525965971272270995364a0eb01f35180d793182e63dd0b0c3eb0292291644a4" |