summaryrefslogtreecommitdiffstats
path: root/package/dropbear/dropbear.mk
Commit message (Collapse)AuthorAgeFilesLines
* package/dropbear: Add separate configuration option for dropbear serverJoel Stanley2019-03-051-1/+8
| | | | | | | | | | | | | | | Currently, the dropbear package installs both client and server components. This means that when we only want the client binaries, we also get the server, which is run from init. Even though it's a multi-call binary (the client and server exist in the same executable), we can define which parts are compiled-in. We'd also like to selectively install the links and init scripts. This change introduces a separate configuration for the dropbear server. Signed-off-by: Jeremy Kerr <jk@ozlabs.org> Signed-off-by: Joel Stanley <joel@jms.id.au>
* package/dropbear: use BR2_SYSTEM_DEFAULT_PATH as default PATHMarkus Mayer2018-12-311-0/+6
| | | | | | | | | | | | We use the configuration option $(BR2_SYSTEM_DEFAULT_PATH) to set the default PATH in dropbear sessions. $(BR2_SYSTEM_DEFAULT_PATH) is a Kconfig string. So it is already quoted, which is exactly what we want. Signed-off-by: Markus Mayer <mmayer@broadcom.com> Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* dropbear: Disable legacy/insecure optionsStefan Sørensen2018-07-041-1/+11
| | | | | | | | | | | | | | | | | | | Dropbear by default enables a number of algorithms that are now considered insecure and should only be used when legacy support is required: 3DES encryption Blowfish encryption SHA1-96 message integrity CBC encryption mode DSA public keys Diffie-Hellman Group1 key exchange So disable them by default, but add a config option for bringing them back. Furthermore the Blowfish legacy algorithm is unconditionally disabled Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com> Reviewed-by: Baruch Siach <baruch@tkos.co.il> Reviewed-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* dropbear: enable PAM authentication if linux-pam is selectedCarlos Santos2018-06-301-0/+14
| | | | | | | | | | - Disable password file authentication, since it's not possible to have both at once. - Install a /etc/pam.d/sshd file, based on the one installed by openssh. Signed-off-by: Carlos Santos <casantos@datacom.com.br> Reviewed-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* dropbear: Do not build static binaryStefan Sørensen2018-05-081-2/+5
| | | | | | | | | | | | | | Dropbear 2018.76 now uses the --enable-static option to indicate that a static binary should be built. This will incorrectly pick up the generic buildroot option intended for building static libraries, causing an unwanted static binary build with BR2_SHARED_STATIC_LIBS. Fix by appending an --disable-static configure flag, overriding the buildroot default. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com> Reviewed-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* dropbear: unbundle libtomath & libtomcryptFrancois Perrad2018-04-281-2/+3
| | | | | | | DROPBEAR_SMALL_CODE could be only honored with bundled libtomcrypt Signed-off-by: Francois Perrad <francois.perrad@gadz.org> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* dropbear: fix build with non-SSP capable toolchainThomas Petazzoni2018-04-281-0/+5
| | | | | | | | | | | | | | | | By default, Dropbear's configure script enables hardening flags. Unfortunately, the check for SSP only uses AC_COMPILE_IFELSE(), and therefore doesn't properly test for the availability of libssp, visible only at link time. In addition, Buildroot passes its own hardening flags, depending on various global options. So, we simply disable hardening flags in Dropbear. This fixes a build failure with non-SSP capable toolchains happening since the bump to 2018.76. Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* dropbear: bump to version 2018.76Francois Perrad2018-04-281-17/+14
| | | | | | | | | | with this new version: - "configure --enable-static" should now be used instead of "make STATIC=1" - any customised options should be put in localoptions.h Signed-off-by: Francois Perrad <francois.perrad@gadz.org> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* dropbear: use https URLsDanilo Bargen2018-02-131-1/+1
| | | | | | | | | While a hash check is being done, it's still better to use a download URL with HTTPS. Signed-off-by: Danilo Bargen <mail@dbrgn.ch> Reviewed-by: Adrian Perez de Castro <aperez@igalia.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* dropbear: security bump to version 2017.75Peter Korsgaard2017-05-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | Fixes: - CVE-2017-9078: A double-free in the server could be triggered by an authenticated user if dropbear is running with -a (Allow connections to forwarded ports from any host) This could potentially allow arbitrary code execution as root by an authenticated user. Affects versions 2013.56 to 2016.74. Thanks to Mark Shepard for reporting the crash. - CVE-2017-9079: Dropbear parsed authorized_keys as root, even if it were a symlink. The fix is to switch to user permissions when opening authorized_keys. A user could symlink their ~/.ssh/authorized_keys to a root-owned file they couldn't normally read. If they managed to get that file to contain valid authorized_keys with command= options it might be possible to read other contents of that file. This information disclosure is to an already authenticated user. Thanks to Jann Horn of Google Project Zero for reporting this. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* boot, package: use SPDX short identifier for BSD-2cRahul Bedarkar2017-04-011-1/+1
| | | | | | | | | | | We want to use SPDX identifier for license string as much as possible. SPDX short identifier for BSD-2c is BSD-2-Clause. This change is done using following command. find . -name "*.mk" | xargs sed -ri '/LICENSE( )?[\+:]?=/s/BSD-2c/BSD-2-Clause/g' Signed-off-by: Rahul Bedarkar <rahulbedarkar89@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* dropbear: bump version to 2016.74Alexander Dahl2016-07-231-1/+1
| | | | | | | | | According to https://matt.ucc.asn.au/dropbear/CHANGES there were some severe security issues fixed. Signed-off-by: Alexander Dahl <post@lespocky.de> Acked-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* dropbear: bump to version 2016.73Alexander Dahl2016-03-201-1/+1
| | | | | | | | some new runtime options, minor fixes, and fixes for issues found by various code analyze and lintian tools. Signed-off-by: Alexander Dahl <post@lespocky.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* dropbear: security bump to 2016.72Peter Korsgaard2016-03-101-1/+1
| | | | | | | | | 2016.72 - 9 March 2016 - Validate X11 forwarding input. Could allow bypass of authorized_keys command= restrictions, found by github.com/tintinweb. Thanks to Damien Miller for a patch. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* dropbear: bump to version 2015.71Gustavo Zacarias2015-12-031-1/+1
| | | | | Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* dropbear: bump version to 2015.70Peter Korsgaard2015-11-261-1/+1
| | | | | | Bugfix release, fixes password auth support detection. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* dropbear: bump to version 2015.69Gustavo Zacarias2015-11-251-1/+1
| | | | | | | Fixes a port-forwarding regression in 2015.68 Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* dropbear: bump to 2015.68Luca Ceresoli2015-10-151-1/+1
| | | | | | | Signed-off-by: Luca Ceresoli <luca@lucaceresoli.net> Reviewed-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Tested-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/dropbear: fix when readlink is from busyboxYann E. MORIN2015-08-241-1/+1
| | | | | | | | | | | | | | | | | | Busybox "readlink -f" does not canonicalise paths when the target is missing, while coreutils do. Fix that by: - making an absolute symlink - dropping "-f" when calling readlink Fixes #8276. Reported-by: Jason Tang <tang@jtang.org> Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Cc: Paul Cercueil <paul@crapouillou.net> Cc: Alexandre Belloni <alexandre.belloni@free-electrons.com> Tested-by: Jason Tang <tang@jtang.org> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/dropbear: fix generating keys on RO file systemsYann E. MORIN2015-07-141-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | dropbear generates its keys at the first connection, and wants to save them in /etc/dropbear (not configurable). Currently, our /etc/dropbear is a directory. When the filesystem is read-only, dropbear can't save its keys, so refuses all connections. Fix that with: - at build time, create /etc/dropbear as a symlink to /var/run/dropbear - at runtime, if the filesystem is RW (we can rm /etc/dropbear), we replace the symlink with an actual directory; otherwise, when the filesystem is RO (we can't rm /etc/dropbear), we create /var/run/dropbear so the symlink points to an existing directory Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Cc: Arnout Vandecappelle <arnout@mind.be> Cc: Maxime Hadjinlian <maxime.hadjinlian@gmail.com> Acked-by: "Maxime Hadjinlian" <maxime.hadjinlian@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* dropbear: move systemd service file to /usr/libMike Williams2015-03-201-2/+2
| | | | | Signed-off-by: Mike Williams <mike@mikebwilliams.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/dropbear: install dropbear.service to correct dirMaxim Mikityanskiy2015-02-231-2/+2
| | | | | | | | The place for package-provided systemd units is /lib/systemd/system. /etc/systemd/system is for custom units. Reviewed-by: Samuel Martin <s.martin49@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* dropbear: add extra build customization optionsFloris Bos2015-02-071-5/+12
| | | | | | | | v2: only offer option to disable building SSH client. do not offer options to disable password authentication and TCP forwarding. Signed-off-by: Floris Bos <bos@je-eigen-domein.nl> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* dropbear: bump to version 2015.67Gustavo Zacarias2015-01-281-4/+4
| | | | | | | Switch sed options around since defaults have changed. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package: indentation cleanupJerzy Grzegorek2014-12-301-2/+3
| | | | | Signed-off-by: Jerzy Grzegorek <jerzy.grzegorek@trzebnica.net> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package: cleanup whitespace of assignmentsJerzy Grzegorek2014-12-181-1/+1
| | | | | Signed-off-by: Jerzy Grzegorek <jerzy.grzegorek@trzebnica.net> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* Rename BR2_PREFER_STATIC_LIB to BR2_STATIC_LIBSThomas Petazzoni2014-12-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | Since a while, the semantic of BR2_PREFER_STATIC_LIB has been changed from "prefer static libraries when possible" to "use only static libraries". The former semantic didn't make much sense, since the user had absolutely no control/idea of which package would use static libraries, and which packages would not. Therefore, for quite some time, we have been starting to enforce that BR2_PREFER_STATIC_LIB should really build everything with static libraries. As a consequence, this patch renames BR2_PREFER_STATIC_LIB to BR2_STATIC_LIBS, and adjust the Config.in option accordingly. This also helps preparing the addition of other options to select shared, shared+static or just static. Note that we have verified that this commit can be reproduced by simply doing a global rename of BR2_PREFER_STATIC_LIB to BR2_STATIC_LIBS plus adding BR2_PREFER_STATIC_LIB to Config.in.legacy. Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
* dropbear: bump to version 2014.66Gustavo Zacarias2014-10-231-1/+1
| | | | | | | And add hash file. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* packages: rename FOO_CONF_OPT into FOO_CONF_OPTSThomas De Schampheleire2014-10-041-3/+3
| | | | | | | | | | | | To be consistent with the recent change of FOO_MAKE_OPT into FOO_MAKE_OPTS, make the same change for FOO_CONF_OPT. Sed command used: find * -type f | xargs sed -i 's#_CONF_OPT\>#&S#g' Signed-off-by: Thomas De Schampheleire <thomas.de.schampheleire@gmail.com> Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* dropbear: bump to version 2014.65Gustavo Zacarias2014-08-081-1/+1
| | | | | | | Fixes some regressions introduced by 2014.64 Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* dropbear: bump to version 2014.64Gustavo Zacarias2014-07-271-1/+1
| | | | | Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* dropbear: fix missing directory with systemdMaxime Hadjinlian2014-05-281-0/+1
| | | | | | | | | | | | | The current SysV startup script create a directory which is necessary for dropbear to correctly work. This creation is not done with systemd. Instead of both init creating the directory, we add the creation of this directory to the INSTALL_TARGET_CMDS to make sure it's present. [Peter: use make syntax for TARGET_DIR as pointed out by Thomas] Signed-off-by: Maxime Hadjinlian <maxime.hadjinlian@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* dropbear: bump versionPeter Korsgaard2014-02-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | Fixes a number of issues. From the changelog: - Avoid getting stuck in a loop writing huge key files, reported by Bruno Thomsen - Avoid crash on exit due to cleaned up keys before last packets are sent, debugged by Ronald Wahl - Fix a race condition in rekeying where Dropbear would exit if it received a still-in-flight packet after initiating rekeying. Reported by Oliver Metz. This is a longstanding bug but is triggered more easily since 2013.57 - Ensure that generated RSA keys are always exactly the length requested. Previously Dropbear always generated N+16 or N+15 bit keys. Thanks to Unit 193 - Fix DROPBEAR_CLI_IMMEDIATE_AUTH mode which saves a network round trip if the first public key succeeds. Still not enabled by default, needs more compatibility testing with other implementations. - Fix signal handlers so that errno is saved, thanks to Erik Ahlén for a patch and Mark Wickham for independently spotting the same problem. And at the same time get rid of the TIMEVAL_TO_TIMESPEC as dropbear provides a fallback implementation if not available (and has done so since 2006). Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* dropbear: bump to version 2013.62Gustavo Zacarias2013-12-041-5/+13
| | | | | | | | | Bump to version 2013.62 with ECC support. Switch the initscript to on-demand key generation and add systemd unit file. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* dropbear: bump to version 2013.60Gustavo Zacarias2013-10-221-1/+1
| | | | | Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* dropbear: bump versionPeter Korsgaard2013-10-041-1/+1
| | | | | | | | | | | | | Fixes two security issues: - The Dropbear server could be made to consume large amounts of memory because decompressed packet sizes weren't checked. Depending on the OS and hardware this might be a denial of service. - Valid users could be identified due to timing variations. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* Normalize separator size to 80Alexandre Belloni2013-06-061-2/+2
| | | | | Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
* dropbear: disable standalone mode for nommuGustavo Zacarias2013-05-071-9/+13
| | | | | | | | | dropbear for nommu targets must disable the standalone (non-inetd) mode since the platform lacks fork(), fixes: http://autobuild.buildroot.net/results/ecbdfab10f54bec75c112bbf005bba9ae2b18dc8/ Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
* dropbear: bump to version 2013.58Gustavo Zacarias2013-04-221-1/+1
| | | | | Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
* dropbear: bump to version 2013.57Gustavo Zacarias2013-04-171-1/+1
| | | | | Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
* dropbear: bump to version 2013.56Gustavo Zacarias2013-03-241-5/+8
| | | | | | | | | Switch ECHOs to SEDs to avoid issues with defines changing after sysoptions.h was included - and it's cleaner. Enable hmac-sha2-256 and hmac-sha2-512 support for the full featured. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
* dropbear: add license infoArnout Vandecappelle (Essensium/Mind)2012-11-141-0/+3
| | | | | Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
* all packages: rename XXXTARGETS to xxx-packageArnout Vandecappelle (Essensium/Mind)2012-07-171-1/+1
| | | | | | | | | | | | | Also remove the redundant $(call ...). This is a purely mechanical change, performed with find package linux toolchain boot -name \*.mk | \ xargs sed -i -e 's/$(eval $(call GENTARGETS))/$(eval $(generic-package))/' \ -e 's/$(eval $(call AUTOTARGETS))/$(eval $(autotools-package))/' \ -e 's/$(eval $(call CMAKETARGETS))/$(eval $(cmake-package))/' Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* dropbear: bump version, fixes CVE-2012-0920Peter Korsgaard2012-02-241-1/+1
| | | | | | | | | | | From the release notes: Security: Fix use-after-free bug that could be triggered if command="..." authorized_keys restrictions are used. Could allow arbitrary code execution or bypass of the command="..." restriction to an authenticated user. Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
* dropbear: bump to version 2011.54Gustavo Zacarias2011-11-111-2/+1
| | | | | Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
* dropbear: add options to disable wtmp / lastlog loggingWill Moore2011-10-261-0/+8
| | | | | | | | | | Buildroot does not have wtmp or lastlog support by default so allow dropbear to be configured to stop using them and hence to stop generating system log error messages. [Peter: invert to positive options, and disable by default] Signed-off-by: Will Moore <will.moore@beraninstruments.com> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
* package: remove useless arguments from AUTOTARGETSThomas Petazzoni2011-09-291-1/+1
| | | | | | | | | | Thanks to the pkgparentdir and pkgname functions, we can rewrite the AUTOTARGETS macro in a way that avoids the need for each package to repeat its name and the directory in which it is present. [Peter: pkgdir->pkgparentdir] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
* dropbear: disable zlib support when built with small optionAlexander Clouter2011-05-161-1/+2
| | | | | | | Closes #3733 Signed-off-by: Alexander Clouter <alex@digriz.org.uk> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
* dropbear: link statically if BR2_PREFER_STATIC_LIBPeter Korsgaard2011-05-131-0/+4
| | | | Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
* dropbear: remove shared config.cache workaroundPeter Korsgaard2011-05-121-5/+0
| | | | | | Now that the shared config.cache handling has been removed. Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
OpenPOWER on IntegriCloud