[Buildroot] [PATCH] dropbear: Fix host key loading with 521 bit ecdsa keys

[Buildroot] [PATCH] dropbear: Fix host key loading with 521 bit ecdsa keys

[Stefan Sørensen]

Dropbear 2018.76 changed the default ecdsa host key size form 521 to 256
bits, but this breaks systems with an existing 521 bit key, blocking ssh
logins.

Apply the upstream fix from https://secure.ucc.asn.au/hg/dropbear/rev/0dc3103a5900 :

  Only advertise a single server ecdsa key when -R (generate as required) is
  specified. Fixes -R now that default ecdsa key size has changed.

Signed-off-by: Stefan S?rensen <stefan.sorensen@spectralink.com>
---
 package/dropbear/dropbear.hash | 3 +++
 package/dropbear/dropbear.mk   | 1 +
 2 files changed, 4 insertions(+)

diff --git a/package/dropbear/dropbear.hash b/package/dropbear/dropbear.hash
index ef2011d907..ba42d6bd0c 100644
--- a/package/dropbear/dropbear.hash
+++ b/package/dropbear/dropbear.hash
@@ -1,2 +1,5 @@
 # From https://matt.ucc.asn.au/dropbear/releases/SHA256SUM.asc
 sha256 f2fb9167eca8cf93456a5fc1d4faf709902a3ab70dd44e352f3acbc3ffdaea65 dropbear-2018.76.tar.bz2
+
+# Locally calculated
+sha256 d4a63567465f2bae9fd5e575e022587f832647fb41b023513ac880c4eb647fdd 0dc3103a5900
diff --git a/package/dropbear/dropbear.mk b/package/dropbear/dropbear.mk
index 1da1a559a3..6bfc05fb2b 100644
--- a/package/dropbear/dropbear.mk
+++ b/package/dropbear/dropbear.mk
@@ -7,6 +7,7 @@
 DROPBEAR_VERSION = 2018.76
 DROPBEAR_SITE = https://matt.ucc.asn.au/dropbear/releases
 DROPBEAR_SOURCE = dropbear-$(DROPBEAR_VERSION).tar.bz2
+DROPBEAR_PATCH = https://secure.ucc.asn.au/hg/dropbear/raw-rev/0dc3103a5900
 DROPBEAR_LICENSE = MIT, BSD-2-Clause-like, BSD-2-Clause
 DROPBEAR_LICENSE_FILES = LICENSE
 DROPBEAR_TARGET_BINS = dropbearkey dropbearconvert scp
-- 
2.17.0

[Buildroot] [PATCH] dropbear: Do not build static binary

[Stefan Sørensen]

Dropbear 2018.76 now uses the --enable-static option to indicate that a static
binary should be built. This will incorrectly pick up the generic buildroot
option intended for building static libraries, causing an unwanted static
binary build with BR2_STATIC_LIBS/BR2_SHARED_STATIC_LIBS.

Fix by appending an --disable-static configure flag, overriding the buildroot
default.
---
 package/dropbear/dropbear.mk | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/package/dropbear/dropbear.mk b/package/dropbear/dropbear.mk
index 6bfc05fb2b..f47f97d036 100644
--- a/package/dropbear/dropbear.mk
+++ b/package/dropbear/dropbear.mk
@@ -28,9 +28,10 @@ DROPBEAR_MAKE = \
 	$(MAKE) MULTI=1 SCPPROGRESS=1 \
 	PROGRAMS="$(DROPBEAR_PROGRAMS)"
 
-ifeq ($(BR2_STATIC_LIBS),y)
-DROPBEAR_CONF_OPTS += --enable-static
-endif
+# The generic --enable-static flags is only intended for use when building
+# libraries, but dropbear will be built as a static executeable with this
+# flag, so we overide it here
+DROPBEAR_CONF_OPTS += --disable-static
 
 # Ensure that dropbear doesn't use crypt() when it's not available
 define DROPBEAR_SVR_PASSWORD_AUTH
-- 
2.17.0

[Buildroot] [PATCH v2] dropbear: Disable legacy/insecure options

[Stefan Sørensen]

Dropbear by default enables a number of algorithms that are now considered
insecure and should only be used when legacy support is required:
   3DES encryption
   Blowfish encryption
   SHA1-96 message integrity
   CBC encryption mode
   DSA public keys
   Diffie-Hellman Group1 key exchange

So disable them by default, but add a config option for bringing them back.

Signed-off-by: Stefan S?rensen <stefan.sorensen@spectralink.com>
---
Changes in v2:
 - Update for 2018.76
 - Use single option for legacy/insecure algorithms

 package/dropbear/Config.in   | 10 ++++++++++
 package/dropbear/dropbear.mk | 12 +++++++++++-
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/package/dropbear/Config.in b/package/dropbear/Config.in
index 5d6b83b6d1..8c121d0d72 100644
--- a/package/dropbear/Config.in
+++ b/package/dropbear/Config.in
@@ -56,4 +56,14 @@ config BR2_PACKAGE_DROPBEAR_LASTLOG
 	  Enable logging of dropbear access to lastlog. Notice that
 	  Buildroot does not generate lastlog by default.
 
+config BR2_PACKAGE_DROPBEAR_LEGACY_CRYPTO
+	bool "enable legacy crypto"
+	help
+	  Enable legacy and possbibly insecure algorithms:
+	    3DES encryption
+	    SHA1-96 message integrity
+	    CBC encryption mode
+	    DSA public keys
+	    Diffie-Hellman Group1 key exchange
+
 endif
diff --git a/package/dropbear/dropbear.mk b/package/dropbear/dropbear.mk
index f47f97d036..de29d16e74 100644
--- a/package/dropbear/dropbear.mk
+++ b/package/dropbear/dropbear.mk
@@ -41,13 +41,23 @@ define DROPBEAR_SVR_PASSWORD_AUTH
 endef
 DROPBEAR_POST_EXTRACT_HOOKS += DROPBEAR_SVR_PASSWORD_AUTH
 
+define DROPBEAR_DISABLE_LEGACY_CRYPTO
+	echo '#define DROPBEAR_3DES 0'                  >> $(@D)/localoptions.h
+	echo '#define DROPBEAR_ENABLE_CBC_MODE 0'       >> $(@D)/localoptions.h
+	echo '#define DROPBEAR_SHA1_96_HMAC 0'          >> $(@D)/localoptions.h
+	echo '#define DROPBEAR_DSS 0'                   >> $(@D)/localoptions.h
+	echo '#define DROPBEAR_DH_GROUP1 0'             >> $(@D)/localoptions.h
+endef
+ifneq ($(BR2_PACKAGE_DROPBEAR_LEGACY_CRYPTO),y)
+DROPBEAR_POST_EXTRACT_HOOKS += DROPBEAR_DISABLE_LEGACY_CRYPTO
+endif
+
 define DROPBEAR_ENABLE_REVERSE_DNS
 	echo '#define DO_HOST_LOOKUP 1'                 >> $(@D)/localoptions.h
 endef
 
 define DROPBEAR_BUILD_FEATURED
 	echo '#define DROPBEAR_SMALL_CODE 0'            >> $(@D)/localoptions.h
-	echo '#define DROPBEAR_BLOWFISH 1'              >> $(@D)/localoptions.h
 	echo '#define DROPBEAR_TWOFISH128 1'            >> $(@D)/localoptions.h
 	echo '#define DROPBEAR_TWOFISH256 1'            >> $(@D)/localoptions.h
 endef
-- 
2.17.0

[Buildroot] [PATCH] dropbear: Do not build static binary

[Baruch Siach]

Hi Stefan,

On Thu, May 03, 2018 at 01:47:00PM +0200, Stefan S?rensen wrote:
> Dropbear 2018.76 now uses the --enable-static option to indicate that a static
> binary should be built. This will incorrectly pick up the generic buildroot
> option intended for building static libraries, causing an unwanted static
> binary build with BR2_STATIC_LIBS/BR2_SHARED_STATIC_LIBS.
> 
> Fix by appending an --disable-static configure flag, overriding the buildroot
> default.

Your sign-off is missing here.

> ---
>  package/dropbear/dropbear.mk | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/package/dropbear/dropbear.mk b/package/dropbear/dropbear.mk
> index 6bfc05fb2b..f47f97d036 100644
> --- a/package/dropbear/dropbear.mk
> +++ b/package/dropbear/dropbear.mk
> @@ -28,9 +28,10 @@ DROPBEAR_MAKE = \
>  	$(MAKE) MULTI=1 SCPPROGRESS=1 \
>  	PROGRAMS="$(DROPBEAR_PROGRAMS)"
>  
> -ifeq ($(BR2_STATIC_LIBS),y)
> -DROPBEAR_CONF_OPTS += --enable-static
> -endif
> +# The generic --enable-static flags is only intended for use when building
> +# libraries, but dropbear will be built as a static executeable with this
> +# flag, so we overide it here
> +DROPBEAR_CONF_OPTS += --disable-static

You add --disable-static unconditionally, but we do want to build statically 
when BR2_STATIC_LIBS=y. So maybe add --disable-static only for 
BR2_SHARED_STATIC_LIBS=y to counter the effect of --enable-static that 
Buildroot adds automatically. Would that work for you?

>  # Ensure that dropbear doesn't use crypt() when it's not available
>  define DROPBEAR_SVR_PASSWORD_AUTH

baruch

-- 
     http://baruch.siach.name/blog/                  ~. .~   Tk Open Systems
=}------------------------------------------------ooO--U--Ooo------------{=
   - baruch at tkos.co.il - tel: +972.52.368.4656, http://www.tkos.co.il -

[Buildroot] [PATCH v2] dropbear: Disable legacy/insecure options

[Peter Korsgaard]

>>>>> "Stefan" == Stefan S?rensen <stefan.sorensen@spectralink.com> writes:

 > Dropbear by default enables a number of algorithms that are now considered
 > insecure and should only be used when legacy support is required:
 >    3DES encryption
 >    Blowfish encryption
 >    SHA1-96 message integrity
 >    CBC encryption mode
 >    DSA public keys
 >    Diffie-Hellman Group1 key exchange

 > So disable them by default, but add a config option for bringing them back.

 > Signed-off-by: Stefan S?rensen <stefan.sorensen@spectralink.com>
 > ---
 > Changes in v2:
 >  - Update for 2018.76
 >  - Use single option for legacy/insecure algorithms

 >  package/dropbear/Config.in   | 10 ++++++++++
 >  package/dropbear/dropbear.mk | 12 +++++++++++-
 >  2 files changed, 21 insertions(+), 1 deletion(-)

 > diff --git a/package/dropbear/Config.in b/package/dropbear/Config.in
 > index 5d6b83b6d1..8c121d0d72 100644
 > --- a/package/dropbear/Config.in
 > +++ b/package/dropbear/Config.in
 > @@ -56,4 +56,14 @@ config BR2_PACKAGE_DROPBEAR_LASTLOG
 >  	  Enable logging of dropbear access to lastlog. Notice that
 >  	  Buildroot does not generate lastlog by default.
 
 > +config BR2_PACKAGE_DROPBEAR_LEGACY_CRYPTO
 > +	bool "enable legacy crypto"
 > +	help
 > +	  Enable legacy and possbibly insecure algorithms:

s/possbibly/possibly/

> +	    3DES encryption
 > +	    SHA1-96 message integrity
 > +	    CBC encryption mode
 > +	    DSA public keys
 > +	    Diffie-Hellman Group1 key exchange
 > +
 >  endif
 > diff --git a/package/dropbear/dropbear.mk b/package/dropbear/dropbear.mk
 > index f47f97d036..de29d16e74 100644
 > --- a/package/dropbear/dropbear.mk
 > +++ b/package/dropbear/dropbear.mk
 > @@ -41,13 +41,23 @@ define DROPBEAR_SVR_PASSWORD_AUTH
 >  endef
 >  DROPBEAR_POST_EXTRACT_HOOKS += DROPBEAR_SVR_PASSWORD_AUTH
 
 > +define DROPBEAR_DISABLE_LEGACY_CRYPTO
 > +	echo '#define DROPBEAR_3DES 0'                  >> $(@D)/localoptions.h
 > +	echo '#define DROPBEAR_ENABLE_CBC_MODE 0'       >> $(@D)/localoptions.h
 > +	echo '#define DROPBEAR_SHA1_96_HMAC 0'          >> $(@D)/localoptions.h
 > +	echo '#define DROPBEAR_DSS 0'                   >> $(@D)/localoptions.h
 > +	echo '#define DROPBEAR_DH_GROUP1 0'             >> $(@D)/localoptions.h
 > +endef
 > +ifneq ($(BR2_PACKAGE_DROPBEAR_LEGACY_CRYPTO),y)
 > +DROPBEAR_POST_EXTRACT_HOOKS += DROPBEAR_DISABLE_LEGACY_CRYPTO
 > +endif
 > +
 >  define DROPBEAR_ENABLE_REVERSE_DNS
 >  	echo '#define DO_HOST_LOOKUP 1'                 >> $(@D)/localoptions.h
 >  endef
 
 >  define DROPBEAR_BUILD_FEATURED
 >  	echo '#define DROPBEAR_SMALL_CODE 0'            >> $(@D)/localoptions.h
 > -	echo '#define DROPBEAR_BLOWFISH 1'              >> $(@D)/localoptions.h

This is not mentioned in the commit description. If this is also
considered a legacy algorithm then I guess it is OK to drop it
unconditioanlly, but it should be mentioned.

-- 
Bye, Peter Korsgaard

[Buildroot] [PATCH] dropbear: Do not build static binary

[Sørensen, Stefan]

On Thu, 2018-05-03 at 21:08 +0300, Baruch Siach wrote:
> > -ifeq ($(BR2_STATIC_LIBS),y)
> > -DROPBEAR_CONF_OPTS += --enable-static
> > -endif
> > +# The generic --enable-static flags is only intended for use when
> > building
> > +# libraries, but dropbear will be built as a static executeable
> > with this
> > +# flag, so we overide it here
> > +DROPBEAR_CONF_OPTS += --disable-static
> 
> You add --disable-static unconditionally, but we do want to build
> statically 
> when BR2_STATIC_LIBS=y. So maybe add --disable-static only for 
> BR2_SHARED_STATIC_LIBS=y to counter the effect of --enable-static
> that Buildroot adds automatically. Would that work for you?

The --disable-static causes dropbear to do nothing, i.e. just do a
normal link, so that will also work with BR2_STATIC_LIBS=y.

Stefan

[Buildroot] [PATCH] dropbear: Fix host key loading with 521 bit ecdsa keys

[Peter Korsgaard]

>>>>> "Stefan" == Stefan S?rensen <stefan.sorensen@spectralink.com> writes:

 > Dropbear 2018.76 changed the default ecdsa host key size form 521 to 256
 > bits, but this breaks systems with an existing 521 bit key, blocking ssh
 > logins.

 > Apply the upstream fix from https://secure.ucc.asn.au/hg/dropbear/rev/0dc3103a5900 :

 >   Only advertise a single server ecdsa key when -R (generate as required) is
 >   specified. Fixes -R now that default ecdsa key size has changed.

 > Signed-off-by: Stefan S?rensen <stefan.sorensen@spectralink.com>
> ---
 >  package/dropbear/dropbear.hash | 3 +++
 >  package/dropbear/dropbear.mk   | 1 +
 >  2 files changed, 4 insertions(+)

 > diff --git a/package/dropbear/dropbear.hash b/package/dropbear/dropbear.hash
 > index ef2011d907..ba42d6bd0c 100644
 > --- a/package/dropbear/dropbear.hash
 > +++ b/package/dropbear/dropbear.hash
 > @@ -1,2 +1,5 @@
 >  # From https://matt.ucc.asn.au/dropbear/releases/SHA256SUM.asc
 >  sha256 f2fb9167eca8cf93456a5fc1d4faf709902a3ab70dd44e352f3acbc3ffdaea65 dropbear-2018.76.tar.bz2
 > +
 > +# Locally calculated
 > +sha256 d4a63567465f2bae9fd5e575e022587f832647fb41b023513ac880c4eb647fdd 0dc3103a5900

Ehh, how did you test this?

>>> dropbear 2018.76 Patching
PATH=/home/peko/source/buildroot/output/host/bin:$PATH support/scripts/apply-patches.sh  /home/peko/source/buildroot/output/build/dropbear-2018.76 /var/lib/downloads/dropbear 0dc3103a5900
Unsupported file type for /var/lib/downloads/dropbear/0dc3103a5900, skipping

So I've added the patch in Buildroot instead and committed, thanks.

-- 
Bye, Peter Korsgaard

[Buildroot] [PATCH] dropbear: Do not build static binary

[Baruch Siach]

Hi S?rensen,

On Fri, May 04, 2018 at 06:27:02AM +0000, S?rensen, Stefan wrote:
> On Thu, 2018-05-03 at 21:08 +0300, Baruch Siach wrote:
> > > -ifeq ($(BR2_STATIC_LIBS),y)
> > > -DROPBEAR_CONF_OPTS += --enable-static
> > > -endif
> > > +# The generic --enable-static flags is only intended for use when
> > > building
> > > +# libraries, but dropbear will be built as a static executeable
> > > with this
> > > +# flag, so we overide it here
> > > +DROPBEAR_CONF_OPTS += --disable-static
> > 
> > You add --disable-static unconditionally, but we do want to build
> > statically 
> > when BR2_STATIC_LIBS=y. So maybe add --disable-static only for 
> > BR2_SHARED_STATIC_LIBS=y to counter the effect of --enable-static
> > that Buildroot adds automatically. Would that work for you?
> 
> The --disable-static causes dropbear to do nothing, i.e. just do a
> normal link, so that will also work with BR2_STATIC_LIBS=y.

So if --disable-static is a NOP why do we need it at all?

As far as I can see, the only effect of --enable-static is to add -static to 
dropbear binaries link command line via LDFLAGS. This is the expected 
behaviour for BR2_STATIC_LIBS=y. Since BR2_STATIC_LIBS=y is sometimes used 
with external toolchains that provide both shared and static libraries, the 
-static link option is required to produce static binaries. Your patch seems 
to break this use case.

What is this patch meant to fix?

baruch

-- 
     http://baruch.siach.name/blog/                  ~. .~   Tk Open Systems
=}------------------------------------------------ooO--U--Ooo------------{=
   - baruch at tkos.co.il - tel: +972.52.368.4656, http://www.tkos.co.il -

[Buildroot] [PATCH] dropbear: Fix host key loading with 521 bit ecdsa keys

[Peter Korsgaard]

>>>>> "Stefan" == Stefan S?rensen <stefan.sorensen@spectralink.com> writes:

 > Dropbear 2018.76 changed the default ecdsa host key size form 521 to 256
 > bits, but this breaks systems with an existing 521 bit key, blocking ssh
 > logins.

 > Apply the upstream fix from https://secure.ucc.asn.au/hg/dropbear/rev/0dc3103a5900 :

 >   Only advertise a single server ecdsa key when -R (generate as required) is
 >   specified. Fixes -R now that default ecdsa key size has changed.

 > Signed-off-by: Stefan S?rensen <stefan.sorensen@spectralink.com>

Committed to 2018.02.x, thanks.

-- 
Bye, Peter Korsgaard