Enhances dropbear with a new feature "disable-weak-ciphers", on by default.
This feature disables all CBC, SHA1, and diffie-hellman group1 ciphers in
the dropbear ssh server and client.
Disable this feature if you need to connect to the ssh server from older
clients. Additional customization can be done with local_options.h as usual.
Tested: On dropbear_2019.78.
Upstream-Status: Inappropriate [configuration]
(From OE-Core rev: b11521ce1b1d1f8b4dddf830b41f5ea809730d22)
Signed-off-by: Joseph Reynolds <joseph.reynolds1@ibm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
- update dropbear to version 2019.77
- drop obsolete patch
(From OE-Core rev: c0f2e6f74119538a33095c27a8d9e92084741672)
Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
- localoptions.h is automatically searched in build directory
(From OE-Core rev: 40fe89027e1b9ed63c65ff026bc6cce5de1b814a)
Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
configure tests crypt() existence with:
dnl We test for crypt() specially. On Linux (and others?) it resides in libcrypt
dnl but we don't want link all binaries to -lcrypt, just dropbear server.
dnl OS X doesn't need -lcrypt
AC_CHECK_FUNC(crypt, found_crypt_func=here)
AC_CHECK_LIB(crypt, crypt,
[
CRYPTLIB="-lcrypt"
found_crypt_func=here
])
AC_SUBST(CRYPTLIB)
if test "t$found_crypt_func" = there; then
AC_DEFINE(HAVE_CRYPT, 1, [crypt() function])
fi
but that silently fails with glibc-2.28 and a bit later do_compile fails with;
http://errors.yoctoproject.org/Errors/Details/185895/
../dropbear-2018.76/sysoptions.h:237:3: error: #error "DROPBEAR_SVR_PASSWORD_AUTH requires `crypt()'."
#error "DROPBEAR_SVR_PASSWORD_AUTH requires `crypt()'."
^~~~~
Add dependency on virtual/crypt so that do_configure detects it correctly.
(From OE-Core rev: d04703aef55e01c59329fc54660724e053f3f66c)
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
root login is disabled by default for openssh and we can
enable it through IMAGE_FEATURES 'debug-tweaks' or
'allow-empty-password', so change to the same default
behavior for dropbear.
(From OE-Core rev: d3e69fa2fef83015658aa5fa1442bab5a8c3edaa)
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The origins of the patch date back to early 2005 (prior to the start
of git history in oe-core) to fix a hardcoded limit on the maximum
size of remote host keys:
http://familiar.handhelds.narkive.com/b1VGg2bI/problem-w-dropbear-ssh
The hardcoded limit was fixed upstream in dropbear 0.47:
736f370dce
The patch has therefore been obsolete since then. It went unnoticed
until now as the patch has continued to apply - it modifies a value
which is not used.
(From OE-Core rev: 17072ffc1e765edd45bc1174378fb666185e5643)
Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
- update dropbear to version 2018.76
- refresh and drop obsolete patches
- add option to use localoptions.h header file
- do not use harden stuff, which leads to QA warning
(From OE-Core rev: ec050b666ec3684918fd9dc564d2dce9a8d6a8ef)
Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Dropbear will use system versions of libtommath and libtomcrypt if
available. To make builds deterministic, add a PACKAGECONFIG option
to choose system libs or force use of the bundled versions.
Note that currently there are no libtommath or libtomcrypt recipes
in oe-core, so default to using the bundled versions.
(From OE-Core rev: b7c2edd2d6ded287d8b34dd047ae84d3fd69d4c6)
Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
To prevent build failures when using system libtom libraries and
linking with --as-needed, LIBTOM_LIBS should be in the order
-ltomcrypt -ltommath, not the other way around, ie libs should be
prepended to LIBTOM_LIBS as they are found, not appended.
Note that LIBTOM_LIBS is not used when linking with the bundled
libtom libs.
(From OE-Core rev: 62e96283fe77469e24e8df86c6c037c92009b00a)
Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Openssh now installs the sftp-server binary as /usr/libexec/sftp-server,
whereas the dropbear recipe assumes a different path.
Dropbear uses the correct path by default, so it's no longer necessary
to override SFTPSERVER_PATH via CFLAGS.
This fixes SFTP access to systems using dropbear as the SSH server.
(From OE-Core rev: df798bca330583103b2301678236cc841cc861dd)
Signed-off-by: Dominic Sacré <dominic.sacre@gmx.de>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The CFLAGS and LD tweaks in dropbear.inc date back to 2005/2006 and
whatever issue they worked around back then seems to have been fixed
in the latest versions of dropbear.
(From OE-Core rev: 4b17606fbca63a17cafbc285e3efe48c4c54a266)
Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
LICENSE checksum has changed because the copyright year was changed
from 2014 to 2015 in it:
19e1afbd1c
(From OE-Core rev: 30e791e9bb2e28119e74c22af742957fc470b2de)
Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Upgrade to upstream 2014.66; incorporates several minor bugfix
releases.
* LIC_FILES_CHKSUM changed because the copyright year changed; there was
no change to the license text itself.
(From OE-Core rev: 78f388e81cad5dfb6aea52da68f9b4523c88c5ad)
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
If pam distro feature enabled, dropbear will need below pam rpms
to work:
* libpam-runtime
* pam-plugin-deny
* pam-plugin-permit
* pam-plugin-unix
Just add the runtime dependencies explicitly.
(From OE-Core rev: dfbeb663e99f3280d055ec04454353f2082ced03)
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The base_contains is kept as a compatibility method and we ought to
not use it in OE-Core so we can remove it from base metadata in
future.
(From OE-Core rev: d83b16dbf0862be387f84228710cb165c6d2b03b)
Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Drop 0002-static_build_fix.patch since an equivalent fix has been merged
upstream.
(From OE-Core rev: d5ff33a328a90abb6aae7c02bf119b53afdae5b7)
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This patch mainly comes from meta-systemd with a few modifications.
The purpose is to get rid of the LSB init scripts in systemd images.
[YOCTO #4420]
(From OE-Core rev: 5d90c5ebdb899b2951c97a94ff57867c1e491c15)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
LIC_FILES_CHKSUM has changed with the introduction of a BSD-3-Clause
algorithm (curve25519-donna); this has prompted a re-evaluation of the
LICENSE value which should now reflect the licenses declared in the
upstream documentation. Thanks to Beth Flanagan for helping with this.
(From OE-Core rev: 232e8b96988ffa6e5107917fbf41222d26e4e90b)
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Using the contains function results in more optimal sstate checksums
resulting in better cache reuse as we as more consistent code.
(From OE-Core rev: 9c93526756e7cbbff027c88eb972f877bcb1f057)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
update to latest version 2013.60
Update 0006-dropbear-configuration-file.patch for 2013.60
(From OE-Core rev: 76e8b841d19789fe54ef650d6e8b42950fd27ceb)
Signed-off-by: Maxin B. John <maxin.john@enea.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The default value of SFTPSERVER_PATH is "/usr/libexec/sftp-server" defined in
dropbear-2013.58/option.h, but after commit 406bd38b423[bitbake.conf: change
libexecdir to ${libdir}/${BPN}], sftp-server is provided by openssh package,
and is installed into ${libdir}/openssh, so we pass it explicitly.
(From OE-Core rev: 5f6deb044226885912214532cebb1d871f03c53a)
Signed-off-by: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit fixes runtime hang of 'dropbearkey' utility, built for a x32
target abi system. The hang was observed while generating ssh keys, with
this command:
dropbearkey -t dss -f private
The issue is fixed by changing the code, where 'long' in x86_64 mode is
assumed as 64bit quantity. With the x32 abi, the processor is in x86_64
mode, but the 'long' is a 32bit quantity. Hence the fix uses 'long long'
instead of 'long' to define/access 64bit data variables.
Fixes bug:
[YOCTO #4496]
(From OE-Core rev: 8f5bc47729edb8cb051d81e9ff1680cb8d2eca25)
Signed-off-by: Nitin A Kamble <nitin.a.kamble@intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
- patches updated
- nopw-option.patch dropped as the option is integrated since 2013.56
- compile tested for ARMv5 target
(From OE-Core rev: ce92c707f26aff8f02021c757056af4ecddb315d)
Signed-off-by: Eric Bénard <eric@eukrea.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Dropbear does not start when the host key is empty and it is possible
that a device is switched off before the host key is generated. This
is possible because the dropbearkey code doesn't create a temporary
file first. Detect truncated keys and then remove them which will lead
to the re-generation. This way the dropbear process will always start.
(From OE-Core rev: 16b57e352f5844f301cc6c7ea4f87bf750c11d67)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Instead of using IMAGE_FEATURES to control something within a recipe,
allow this to be set at runtime, avoiding the need to rebuild dropbear
when we want to change this option.
First half of the fix for [YOCTO #2578].
(From OE-Core rev: 313039590171456b652fa7a2f5823c9b7060b20f)
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Re-running the debug_patch task would cause the build to fail. This patch
moves the extra patch handling directly into SRC_URI and removes the need
for the separate task, allowing safe re-execution of each task.
[YOCTO #2194]
(From OE-Core rev: 1d6156e37ef0f36cf5ce8eeaaf23560215c86833)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: f1710d09e447b0f71a55b4ef24673c6388a045ad)
Signed-off-by: Mei Lei <lei.mei@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
dropbear will check "/etc/pam.d/sshd" which comes from package "openssh" \
When enabling pam supporting. But if we only install dropbear \
package without package "openssh", then "dropbear" will not \
find a configuration file.
The changes are as follow for fixing this bug:
- Change the path to find configuration file (/etc/pam.d/sshd --> /etc/pam.d/dropbear)
- Add a configuration file "/etc/pam.d/dropbear"
(From OE-Core rev: 48dcb8fc7b669b27160dde33079f40551853702b)
Signed-off-by: Xiaofeng Yan <xiaofeng.yan@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
I make a patch and some changes in dropbear.inc for supporting pam.
- Enable pam in configure
- Modify file option.h to open pam supporting
(From OE-Core rev: e8f19e8616fb1b0c2d977fb63eaa64f504fb774b)
Signed-off-by: Xiaofeng Yan <xiaofeng.yan@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The long term solution is to remove the IMAGE_FEATURE check since images are not allowed to influence recipe compile options.
(From OE-Core rev: 1c24f36e982e680871bf7a05ac6e820314e19c7c)
Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Nothing in the system actually uses the PROVIDES field for these
recipes, its usually the runtime packages that are used. We can
therefore remove the PROVIDES and hence quieten the associated
warnings from bitbake.
If these recipes do really need the PROVIDES, they would be better
as virtuals and adding that to MULTI_PROVIDER_WHITELIST.
(From OE-Core rev: 84f3ae92ab4345cc99b47e021ff960857f803d45)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
We need to avoid applying a patch in configure, because a rebuild could
trigger this, without triggering do_patch.
(From OE-Core rev: 16fbdaa24fd4add37c1e873505f55bcef5695a94)
Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The new bash logging class provides bbnote, bbwarn, bbfatal, and bbdebug
replacements (as well as bbplain and bberror) for the oe* equivalents. Use the
new bb* API in preparation to delete the oe* logging API.
This patch was automatically generated by a sed script. The result has been
visually inspected and used to build core-image-sato for qemux86.
(From OE-Core rev: a1f09fce5caba389d0484b169f0cde85d64514fa)
Signed-off-by: Darren Hart <dvhart@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
A number of the recipes did not properly label their pre and post
actions, causing the actions to occur in all split packages. This
was corrected by defaulting to _${PN} in most cases.
Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
[BUGID #281]
Evaluate and update each package in recipes-core to ensure they have a
consistent summary and description.
Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
Having one monolithic packages directory makes it hard to find things
and is generally overwhelming. This commit splits it into several
logical sections roughly based on function, recipes.txt gives more
information about the classifications used.
The opportunity is also used to switch from "packages" to "recipes"
as used in OpenEmbedded as the term "packages" can be confusing to
people and has many different meanings.
Not all recipes have been classified yet, this is just a first pass
at separating things out. Some packages are moved to meta-extras as
they're no longer actively used or maintained.
Signed-off-by: Richard Purdie <rpurdie@linux.intel.com>
