The current SysV startup script create a directory which is necessary
for dropbear to correctly work.
This creation is not done with systemd.
Instead of both init creating the directory, we add the creation of this
directory to the INSTALL_TARGET_CMDS to make sure it's present.
[Peter: use make syntax for TARGET_DIR as pointed out by Thomas]
Signed-off-by: Maxime Hadjinlian <maxime.hadjinlian@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes a number of issues. From the changelog:
- Avoid getting stuck in a loop writing huge key files, reported by Bruno
Thomsen
- Avoid crash on exit due to cleaned up keys before last packets are sent,
debugged by Ronald Wahl
- Fix a race condition in rekeying where Dropbear would exit if it received a
still-in-flight packet after initiating rekeying. Reported by Oliver Metz.
This is a longstanding bug but is triggered more easily since 2013.57
- Ensure that generated RSA keys are always exactly the length
requested. Previously Dropbear always generated N+16 or N+15 bit keys.
Thanks to Unit 193
- Fix DROPBEAR_CLI_IMMEDIATE_AUTH mode which saves a network round trip if the
first public key succeeds. Still not enabled by default, needs more
compatibility testing with other implementations.
- Fix signal handlers so that errno is saved, thanks to Erik Ahlén for a patch
and Mark Wickham for independently spotting the same problem.
And at the same time get rid of the TIMEVAL_TO_TIMESPEC as dropbear provides a
fallback implementation if not available (and has done so since 2006).
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Bump to version 2013.62 with ECC support.
Switch the initscript to on-demand key generation and add systemd unit
file.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes two security issues:
- The Dropbear server could be made to consume large amounts
of memory because decompressed packet sizes weren't checked.
Depending on the OS and hardware this might be a denial of
service.
- Valid users could be identified due to timing variations.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Switch ECHOs to SEDs to avoid issues with defines changing after
sysoptions.h was included - and it's cleaner.
Enable hmac-sha2-256 and hmac-sha2-512 support for the full featured.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
From the release notes:
Security: Fix use-after-free bug that could be triggered if command="..."
authorized_keys restrictions are used. Could allow arbitrary code
execution or bypass of the command="..." restriction to an authenticated
user.
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Buildroot does not have wtmp or lastlog support by default so allow dropbear
to be configured to stop using them and hence to stop generating system log
error messages.
[Peter: invert to positive options, and disable by default]
Signed-off-by: Will Moore <will.moore@beraninstruments.com>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Thanks to the pkgparentdir and pkgname functions, we can rewrite the
AUTOTARGETS macro in a way that avoids the need for each package to
repeat its name and the directory in which it is present.
[Peter: pkgdir->pkgparentdir]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Changelog @ http://matt.ucc.asn.au/dropbear/CHANGES
Since some build-time defaults have changed that make dropbear somewhat
bigger we introduce a new option to optimize dropbear for size.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
The recent conversion to new-style hooks didn't actually enable the
xauth tweaking. Also rename to FIX_XAUTH as it just tweaks the path,
it doesn't disable anything.
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Add option to disable reverse DNS lookups on client connection, as
connections otherwise stall until DNS times out in configurations without
working reverse DNS.
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Configure misdetects this as no, but the result is not used for anything.
Unfortunately it breaks the build for other packages also checking for
struct sockaddr_storage (like rsync) when using a shared config cache,
so force it to yes.
Reported-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
A C library will have been built by the toolchain makefiles, so there is no
need for packages to explicitly depend on uclibc.
Signed-off-by: Will Newton <will.newton@gmail.com>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
The -D option to install only works portably when the destination is
a file. Specifying the filename avoids the following build error (at
least on some hosts):
"/usr/bin/install: cannot overwrite directory `/tmp/buildroot/
project_build_foobar/uclibc/root/etc/init.d' with non-directory"
Signed-off-by: Marc Gauthier <marc@tensilica.com>
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
they should be configured with --prefix=/usr and we then need to use
make DESTDIR=$(STAGING_DIR) install to get things installed into the
staging directory. The current situation for many packages, which use
--prefix=$(STAGING_DIR) results in the staging_dir paths getting compiled
into the binary itself.
This also adds in a pile of libtool fixups. Between broken pkgconfig,
broken libtool handling, and broken --prefix settings, its a wonder
things have worked as well as they have up till now.
-Erik
