Difuse/difos
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

dropbear: refactor configuration

Browse source 
This allows to fine-tune dropbear build options.

This change is heavily based on similar work done by Marius Dinu earlier
so I'd like to say many thanks to original author.

Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
This commit is contained in:
Konstantin Demin 2025-07-08 19:12:26 +03:00 committed by Paul Spooren
parent bbe4d6ddb2
commit d8ff2d8cba
3 changed files with 1202 additions and 195 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1254
package/network/services/dropbear/Config.in
View file

File diff suppressed because it is too large Load diff

141
package/network/services/dropbear/Makefile
View file

@ -28,14 +28,19 @@ PKG_FIXUP:=autoreconf
PKG_FLAGS:=nonshared PKG_FLAGS:=nonshared
PKG_CONFIG_DEPENDS:= \ PKG_CONFIG_DEPENDS:= \
CONFIG_TARGET_INIT_PATH CONFIG_DROPBEAR_ECC CONFIG_DROPBEAR_ECC_FULL \ CONFIG_DROPBEAR_STATIC_BUILD CONFIG_DROPBEAR_LEGACY_COMPAT CONFIG_DROPBEAR_SMALL_CODE CONFIG_DROPBEAR_DEBUG_TRACE CONFIG_DROPBEAR_LOG_COMMANDS CONFIG_DROPBEAR_INETD_MODE \
CONFIG_DROPBEAR_CURVE25519 CONFIG_DROPBEAR_ZLIB \ CONFIG_DROPBEAR_DO_HOST_LOOKUP CONFIG_DROPBEAR_SVR_PUBKEY_OPTIONS CONFIG_DROPBEAR_LASTLOG CONFIG_DROPBEAR_LASTLOG_PATH CONFIG_DROPBEAR_WTMP CONFIG_DROPBEAR_WTMP_PATH CONFIG_DROPBEAR_UTMP CONFIG_DROPBEAR_UTMP_PATH CONFIG_DROPBEAR_PUTUTLINE CONFIG_DROPBEAR_LOGINFUNC \
CONFIG_DROPBEAR_ED25519 CONFIG_DROPBEAR_CHACHA20POLY1305 \ CONFIG_DROPBEAR_REEXEC CONFIG_DROPBEAR_ZLIB CONFIG_DROPBEAR_DELAY_HOSTKEY CONFIG_DROPBEAR_SVR_AGENTFWD CONFIG_DROPBEAR_SVR_REMOTETCPFWD CONFIG_DROPBEAR_SVR_LOCALTCPFWD CONFIG_DROPBEAR_SVR_LOCALSTREAMFWD CONFIG_DROPBEAR_X11FWD CONFIG_DROPBEAR_SCP CONFIG_DROPBEAR_SFTPSERVER \
CONFIG_DROPBEAR_U2F CONFIG_DROPBEAR_ECDSA_SK CONFIG_DROPBEAR_ED25519_SK \ CONFIG_DROPBEAR_DBCLIENT CONFIG_DROPBEAR_USER_ALGO_LIST CONFIG_DROPBEAR_USE_SSH_CONFIG CONFIG_DROPBEAR_CLI_IMMEDIATE_AUTH CONFIG_DROPBEAR_USE_PASSWORD_ENV CONFIG_DROPBEAR_CLI_ASKPASS_HELPER CONFIG_DROPBEAR_CLI_AGENTFWD CONFIG_DROPBEAR_CLI_LOCALTCPFWD CONFIG_DROPBEAR_CLI_REMOTETCPFWD CONFIG_DROPBEAR_CLI_PROXYCMD CONFIG_DROPBEAR_CLI_NETCAT CONFIG_DROPBEAR_CLI_MULTIHOP \
CONFIG_DROPBEAR_UTMP CONFIG_DROPBEAR_PUTUTLINE \ CONFIG_DROPBEAR_KEX_REKEY_TIMEOUT CONFIG_DROPBEAR_KEX_REKEY_DATA CONFIG_DROPBEAR_AUTH_TIMEOUT CONFIG_DROPBEAR_MAX_AUTH_TRIES CONFIG_DROPBEAR_UNAUTH_CLOSE_DELAY CONFIG_DROPBEAR_MAX_UNAUTH_PER_IP CONFIG_DROPBEAR_MAX_UNAUTH_CLIENTS CONFIG_DROPBEAR_DEFAULT_RECV_WINDOW CONFIG_DROPBEAR_DEFAULT_KEEPALIVE CONFIG_DROPBEAR_DEFAULT_KEEPALIVE_LIMIT CONFIG_DROPBEAR_DEFAULT_IDLE_TIMEOUT \
CONFIG_DROPBEAR_DBCLIENT CONFIG_DROPBEAR_SCP CONFIG_DROPBEAR_ASKPASS \ CONFIG_DROPBEAR_3DES CONFIG_DROPBEAR_AES128 CONFIG_DROPBEAR_AES256 CONFIG_DROPBEAR_CHACHA20POLY1305 \
CONFIG_DROPBEAR_DBCLIENT_AGENTFORWARD CONFIG_DROPBEAR_AGENTFORWARD \ CONFIG_DROPBEAR_ENABLE_CTR_MODE CONFIG_DROPBEAR_ENABLE_CBC_MODE CONFIG_DROPBEAR_ENABLE_GCM_MODE \
CONFIG_DROPBEAR_MODERN_ONLY CONFIG_DROPBEAR_SHA1_96_HMAC CONFIG_DROPBEAR_SHA1_HMAC CONFIG_DROPBEAR_SHA2_256_HMAC CONFIG_DROPBEAR_SHA2_512_HMAC \
CONFIG_DROPBEAR_DSS CONFIG_DROPBEAR_RSA_SHA1 CONFIG_DROPBEAR_RSA CONFIG_DROPBEAR_DEFAULT_RSA_SIZE CONFIG_DROPBEAR_ECDSA CONFIG_DROPBEAR_ED25519 \
CONFIG_DROPBEAR_DH_GROUP1 CONFIG_DROPBEAR_DH_GROUP1_CLIENTONLY CONFIG_DROPBEAR_DH_GROUP14_SHA1 CONFIG_DROPBEAR_DH_GROUP14_SHA256 CONFIG_DROPBEAR_DH_GROUP16 CONFIG_DROPBEAR_ECDH CONFIG_DROPBEAR_CURVE25519 CONFIG_DROPBEAR_MLKEM768 CONFIG_DROPBEAR_SNTRUP761 \
CONFIG_DROPBEAR_ECC_256 CONFIG_DROPBEAR_ECC_384 CONFIG_DROPBEAR_ECC_521 \
CONFIG_DROPBEAR_SK_KEYS CONFIG_DROPBEAR_SK_ECDSA CONFIG_DROPBEAR_SK_ED25519 \
include $(INCLUDE_DIR)/package.mk include $(INCLUDE_DIR)/package.mk
@ -56,6 +61,7 @@ define Package/dropbear
SECTION:=net SECTION:=net
CATEGORY:=Base system CATEGORY:=Base system
TITLE:=Small SSH2 client/server TITLE:=Small SSH2 client/server
MENU:=1
DEPENDS:= +DROPBEAR_ZLIB:zlib DEPENDS:= +DROPBEAR_ZLIB:zlib
ALTERNATIVES:=100:/usr/bin/ssh-keygen:/usr/sbin/dropbear ALTERNATIVES:=100:/usr/bin/ssh-keygen:/usr/sbin/dropbear
$(if $(CONFIG_DROPBEAR_SCP),ALTERNATIVES+= \ $(if $(CONFIG_DROPBEAR_SCP),ALTERNATIVES+= \
@ -87,16 +93,15 @@ endef
CONFIGURE_ARGS += \ CONFIGURE_ARGS += \
--disable-pam \ --disable-pam \
--enable-openpty \
--enable-syslog \
--disable-lastlog \
--disable-utmpx \
$(if $(CONFIG_DROPBEAR_UTMP),,--disable-utmp) \
--disable-wtmp \
--disable-wtmpx \
--disable-loginfunc \
$(if $(CONFIG_DROPBEAR_PUTUTLINE),,--disable-pututline) \
--disable-pututxline \ --disable-pututxline \
--disable-utmpx \
--disable-wtmpx \
$(if $(CONFIG_DROPBEAR_LASTLOG),,--disable-lastlog) \
$(if $(CONFIG_DROPBEAR_LOGINFUNC),,--disable-loginfunc) \
$(if $(CONFIG_DROPBEAR_PUTUTLINE),,--disable-pututline) \
$(if $(CONFIG_DROPBEAR_STATIC_BUILD),--enable-static,--disable-static) \
$(if $(CONFIG_DROPBEAR_UTMP),,--disable-utmp) \
$(if $(CONFIG_DROPBEAR_WTMP),,--disable-wtmp) \
$(if $(CONFIG_DROPBEAR_ZLIB),,--disable-zlib) \ $(if $(CONFIG_DROPBEAR_ZLIB),,--disable-zlib) \
--enable-bundled-libtom --enable-bundled-libtom
@ -109,24 +114,33 @@ CONFIGURE_ARGS += \
# adjust allowed shell list (if getusershell(3) is missing): # adjust allowed shell list (if getusershell(3) is missing):
# - COMPAT_USER_SHELLS # - COMPAT_USER_SHELLS
# remove protocol idented software version number: # remove version number from protocol ident:
# - LOCAL_IDENT # - IDENT_VERSION_PART
# disable legacy/unsafe methods and unused functionality: # disable unused functionality:
# - DROPBEAR_CLI_NETCAT
# - DROPBEAR_DSS
# - DO_MOTD # - DO_MOTD
# - DROPBEAR_DH_GROUP14_SHA1
# - DROPBEAR_SHA1_HMAC
DB_OPT_COMMON = \ DB_OPT_COMMON = \
!!LOCAL_IDENT,"SSH-2.0-dropbear" \ IDENT_VERSION_PART,"" \
COMPAT_USER_SHELLS,"/bin/ash","/bin/sh" \ COMPAT_USER_SHELLS,"/bin/ash","/bin/sh" \
DEFAULT_PATH,"$(TARGET_INIT_PATH)" \ DEFAULT_PATH,"$(TARGET_INIT_PATH)" \
DEFAULT_ROOT_PATH,"$(TARGET_INIT_PATH)" \ DEFAULT_ROOT_PATH,"$(TARGET_INIT_PATH)" \
DROPBEAR_DSS,0 \
DROPBEAR_CLI_NETCAT,0 \
DO_MOTD,0 \ DO_MOTD,0 \
DROPBEAR_DH_GROUP14_SHA1,0 \ AUTH_TIMEOUT,$(CONFIG_DROPBEAR_AUTH_TIMEOUT) \
DROPBEAR_SHA1_HMAC,0 \ DEBUG_TRACE,$(CONFIG_DROPBEAR_DEBUG_TRACE) \
DEFAULT_IDLE_TIMEOUT,$(CONFIG_DROPBEAR_DEFAULT_IDLE_TIMEOUT) \
DEFAULT_KEEPALIVE_LIMIT,$(CONFIG_DROPBEAR_DEFAULT_KEEPALIVE_LIMIT) \
DEFAULT_KEEPALIVE,$(CONFIG_DROPBEAR_DEFAULT_KEEPALIVE) \
DEFAULT_RECV_WINDOW,$(CONFIG_DROPBEAR_DEFAULT_RECV_WINDOW) \
KEX_REKEY_DATA,$(CONFIG_DROPBEAR_KEX_REKEY_DATA) \
KEX_REKEY_TIMEOUT,$(CONFIG_DROPBEAR_KEX_REKEY_TIMEOUT) \
MAX_AUTH_TRIES,$(CONFIG_DROPBEAR_MAX_AUTH_TRIES) \
MAX_UNAUTH_CLIENTS,$(CONFIG_DROPBEAR_MAX_UNAUTH_CLIENTS) \
MAX_UNAUTH_PER_IP,$(CONFIG_DROPBEAR_MAX_UNAUTH_PER_IP) \
UNAUTH_CLOSE_DELAY,$(CONFIG_DROPBEAR_UNAUTH_CLOSE_DELAY) \
$(if $(CONFIG_DROPBEAR_RSA),DROPBEAR_DEFAULT_RSA_SIZE$(comma)$(CONFIG_DROPBEAR_DEFAULT_RSA_SIZE)) \
$(if $(CONFIG_DROPBEAR_LASTLOG),LASTLOG_FILE$(comma)$(CONFIG_DROPBEAR_LASTLOG_FILE)) \
$(if $(CONFIG_DROPBEAR_UTMP),UTMP_FILE$(comma)$(CONFIG_DROPBEAR_UTMP_FILE)) \
$(if $(CONFIG_DROPBEAR_WTMP),WTMP_FILE$(comma)$(CONFIG_DROPBEAR_WTMP_FILE)) \
############################################################################## ##############################################################################
@ -139,24 +153,61 @@ DB_OPT_COMMON = \
############################################################################## ##############################################################################
DB_OPT_CONFIG = \ DB_OPT_CONFIG = \
!!DROPBEAR_ECC_384,CONFIG_DROPBEAR_ECC_FULL,1,0 \ !!DROPBEAR_CLI_MULTIHOP,CONFIG_DROPBEAR_CLI_MULTIHOP,1,0 \
!!DROPBEAR_ECC_521,CONFIG_DROPBEAR_ECC_FULL,1,0 \ !!DROPBEAR_ECC_256,CONFIG_DROPBEAR_ECC_256,1,0 \
DROPBEAR_CURVE25519,CONFIG_DROPBEAR_CURVE25519,1,0 \ !!DROPBEAR_ECC_384,CONFIG_DROPBEAR_ECC_384,1,0 \
!!DROPBEAR_ECC_521,CONFIG_DROPBEAR_ECC_521,1,0 \
DO_HOST_LOOKUP,CONFIG_DROPBEAR_DO_HOST_LOOKUP,1,0 \
DROPBEAR_3DES,CONFIG_DROPBEAR_3DES,1,0 \
DROPBEAR_AES128,CONFIG_DROPBEAR_AES128,1,0 \
DROPBEAR_AES256,CONFIG_DROPBEAR_AES256,1,0 \
DROPBEAR_CHACHA20POLY1305,CONFIG_DROPBEAR_CHACHA20POLY1305,1,0 \ DROPBEAR_CHACHA20POLY1305,CONFIG_DROPBEAR_CHACHA20POLY1305,1,0 \
DROPBEAR_CLI_AGENTFWD,CONFIG_DROPBEAR_CLI_AGENTFWD,1,0 \
DROPBEAR_CLI_ASKPASS_HELPER,CONFIG_DROPBEAR_CLI_ASKPASS_HELPER,1,0 \
DROPBEAR_CLI_IMMEDIATE_AUTH,CONFIG_DROPBEAR_CLI_IMMEDIATE_AUTH,1,0 \
DROPBEAR_CLI_LOCALTCPFWD,CONFIG_DROPBEAR_CLI_LOCALTCPFWD,1,0 \
DROPBEAR_CLI_NETCAT,CONFIG_DROPBEAR_CLI_NETCAT,1,0 \
DROPBEAR_CLI_PROXYCMD,CONFIG_DROPBEAR_CLI_PROXYCMD,1,0 \
DROPBEAR_CLI_REMOTETCPFWD,CONFIG_DROPBEAR_CLI_REMOTETCPFWD,1,0 \
DROPBEAR_CURVE25519,CONFIG_DROPBEAR_CURVE25519,1,0 \
DROPBEAR_DELAY_HOSTKEY,CONFIG_DROPBEAR_DELAY_HOSTKEY,1,0 \
DROPBEAR_DH_GROUP1,CONFIG_DROPBEAR_DH_GROUP1,1,0 \
DROPBEAR_DH_GROUP1_CLIENTONLY,CONFIG_DROPBEAR_DH_GROUP1_CLIENTONLY,1,0 \
DROPBEAR_DH_GROUP14_SHA1,CONFIG_DROPBEAR_DH_GROUP14_SHA1,1,0 \
DROPBEAR_DH_GROUP14_SHA256,CONFIG_DROPBEAR_DH_GROUP14_SHA256,1,0 \
DROPBEAR_DH_GROUP16,CONFIG_DROPBEAR_DH_GROUP16,1,0 \
DROPBEAR_DSS,CONFIG_DROPBEAR_DSS,1,0 \
DROPBEAR_ECDH,CONFIG_DROPBEAR_ECDH,1,0 \
DROPBEAR_ECDSA,CONFIG_DROPBEAR_ECDSA,1,0 \
DROPBEAR_ED25519,CONFIG_DROPBEAR_ED25519,1,0 \ DROPBEAR_ED25519,CONFIG_DROPBEAR_ED25519,1,0 \
DROPBEAR_ECDSA,CONFIG_DROPBEAR_ECC,1,0 \ DROPBEAR_ENABLE_CBC_MODE,CONFIG_DROPBEAR_ENABLE_CBC_MODE,1,0 \
DROPBEAR_ECDH,CONFIG_DROPBEAR_ECC,1,0 \ DROPBEAR_ENABLE_CTR_MODE,CONFIG_DROPBEAR_ENABLE_CTR_MODE,1,0 \
DROPBEAR_SK_KEYS,CONFIG_DROPBEAR_U2F,1,0 \ DROPBEAR_ENABLE_GCM_MODE,CONFIG_DROPBEAR_ENABLE_GCM_MODE,1,0 \
DROPBEAR_SK_ECDSA,CONFIG_DROPBEAR_ECDSA_SK,1,0 \ DROPBEAR_MLKEM768,CONFIG_DROPBEAR_MLKEM768,1,0 \
DROPBEAR_SK_ED25519,CONFIG_DROPBEAR_ED25519_SK,1,0 \ DROPBEAR_REEXEC,CONFIG_DROPBEAR_REEXEC,1,0 \
DROPBEAR_CLI_ASKPASS_HELPER,CONFIG_DROPBEAR_ASKPASS,1,0 \ DROPBEAR_RSA_SHA1,CONFIG_DROPBEAR_RSA_SHA1,1,0 \
DROPBEAR_CLI_AGENTFWD,CONFIG_DROPBEAR_DBCLIENT_AGENTFORWARD,1,0 \ DROPBEAR_RSA,CONFIG_DROPBEAR_RSA,1,0 \
DROPBEAR_SVR_AGENTFWD,CONFIG_DROPBEAR_AGENTFORWARD,1,0 \ DROPBEAR_SFTPSERVER,CONFIG_DROPBEAR_SFTPSERVER,1,0 \
DROPBEAR_AES128,CONFIG_DROPBEAR_MODERN_ONLY,0,1 \ DROPBEAR_SHA1_96_HMAC,CONFIG_DROPBEAR_SHA1_96_HMAC,1,0 \
DROPBEAR_AES256,CONFIG_DROPBEAR_MODERN_ONLY,0,1 \ DROPBEAR_SHA1_HMAC,CONFIG_DROPBEAR_SHA1_HMAC,1,0 \
DROPBEAR_ENABLE_CTR_MODE,CONFIG_DROPBEAR_MODERN_ONLY,0,1 \ DROPBEAR_SHA2_256_HMAC,CONFIG_DROPBEAR_SHA2_256_HMAC,1,0 \
DROPBEAR_RSA,CONFIG_DROPBEAR_MODERN_ONLY,0,1 \ DROPBEAR_SHA2_512_HMAC,CONFIG_DROPBEAR_SHA2_512_HMAC,1,0 \
DROPBEAR_RSA_SHA1,CONFIG_DROPBEAR_MODERN_ONLY,0,1 \ DROPBEAR_SK_ECDSA,CONFIG_DROPBEAR_SK_ECDSA,1,0 \
DROPBEAR_SK_ED25519,CONFIG_DROPBEAR_SK_ED25519,1,0 \
DROPBEAR_SK_KEYS,CONFIG_DROPBEAR_SK_KEYS,1,0 \
DROPBEAR_SMALL_CODE,CONFIG_DROPBEAR_SMALL_CODE,1,0 \
DROPBEAR_SNTRUP761,CONFIG_DROPBEAR_SNTRUP761,1,0 \
DROPBEAR_SVR_AGENTFWD,CONFIG_DROPBEAR_SVR_AGENTFWD,1,0 \
DROPBEAR_SVR_LOCALSTREAMFWD,CONFIG_DROPBEAR_SVR_LOCALSTREAMFWD,1,0 \
DROPBEAR_SVR_LOCALTCPFWD,CONFIG_DROPBEAR_SVR_LOCALTCPFWD,1,0 \
DROPBEAR_SVR_PUBKEY_OPTIONS,CONFIG_DROPBEAR_SVR_PUBKEY_OPTIONS,1,0 \
DROPBEAR_SVR_REMOTETCPFWD,CONFIG_DROPBEAR_SVR_REMOTETCPFWD,1,0 \
DROPBEAR_USE_PASSWORD_ENV,CONFIG_DROPBEAR_USE_PASSWORD_ENV,1,0 \
DROPBEAR_USE_SSH_CONFIG,CONFIG_DROPBEAR_USE_SSH_CONFIG,1,0 \
DROPBEAR_USER_ALGO_LIST,CONFIG_DROPBEAR_USER_ALGO_LIST,1,0 \
DROPBEAR_X11FWD,CONFIG_DROPBEAR_X11FWD,1,0 \
INETD_MODE,CONFIG_DROPBEAR_INETD_MODE,1,0 \
LOG_COMMANDS,CONFIG_DROPBEAR_LOG_COMMANDS,1,0 \
TARGET_CFLAGS += -DARGTYPE=3 TARGET_CFLAGS += -DARGTYPE=3

2
package/network/services/dropbear/files/dropbear.init
View file

@ -177,7 +177,7 @@ validate_section_dropbear()
'SSHKeepAlive:uinteger:300' \ 'SSHKeepAlive:uinteger:300' \
'IdleTimeout:uinteger:0' \ 'IdleTimeout:uinteger:0' \
'MaxAuthTries:uinteger:3' \ 'MaxAuthTries:uinteger:3' \
'RecvWindowSize:uinteger:262144' \ 'RecvWindowSize:uinteger:0' \
'mdns:bool:1' 'mdns:bool:1'
} }