dropbear: Do not build static binary

PATCH New Stefan Sørensen 5 participants 7 messages May 7, 2018 – Aug 27, 2018

Share & tools

Stefan Sørensen

author

2018-05-07 12:28 UTC #0 lore raw

PATCH v2 1/1 dropbear: Do not build static binary

Dropbear 2018.76 now uses the --enable-static option to indicate that a static binary should be built. This will incorrectly pick up the generic buildroot option intended for building static libraries, causing an unwanted static binary build with BR2_SHARED_STATIC_LIBS.

Fix by appending an --disable-static configure flag, overriding the buildroot default.

Signed-off-by Stefan S?rensen <[email protected]>

---
Changes v1->v2:
* Keep the --enable-static when BR2_STATIC_LIBS=y

 package/dropbear/dropbear.mk | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

package/dropbear/dropbear.mk +5 -2

index 1da1a559a3..fc41a84c1f 100644
@@ -27,8 +27,11 @@ DROPBEAR_MAKE = \
 	$(MAKE) MULTI=1 SCPPROGRESS=1 \
 	PROGRAMS="$(DROPBEAR_PROGRAMS)"
 
-ifeq ($(BR2_STATIC_LIBS),y)
-DROPBEAR_CONF_OPTS += --enable-static
+# With BR2_SHARED_STATIC_LIBS=y the generic infrastructure adds a
+# --enable-static flags causing dropbear to be built as a static
+# binary. Adding a --disable-static reverts this
+ifeq ($(BR2_SHARED_STATIC_LIBS),y)
+DROPBEAR_CONF_OPTS += --disable-static
 endif
 
 # Ensure that dropbear doesn't use crypt() when it's not available

Signature · 1 line

2.17.0

Stefan Sørensen

author

2018-05-07 12:28 UTC #1 lore raw

PATCH v2 1/1 dropbear: Disable legacy/insecure options

Dropbear by default enables a number of algorithms that are now considered insecure and should only be used when legacy support is required:
3DES encryption
Blowfish encryption
SHA1-96 message integrity
CBC encryption mode
DSA public keys
Diffie-Hellman Group1 key exchange

So disable them by default, but add a config option for bringing them back. Furthermore the Blowfish legacy algorithm is unconditionally disabled

Signed-off-by Stefan S?rensen <[email protected]>

---
Changes v1->v2:
* Mention that the Blowfish algorithm has been disabled

 package/dropbear/Config.in   | 10 ++++++++++
 package/dropbear/dropbear.mk | 12 +++++++++++-
 2 files changed, 21 insertions(+), 1 deletion(-)

package/dropbear/Config.in +10 -0

index 5d6b83b6d1..62f77bad9d 100644
@@ -56,4 +56,14 @@ config BR2_PACKAGE_DROPBEAR_LASTLOG
 	  Enable logging of dropbear access to lastlog. Notice that
 	  Buildroot does not generate lastlog by default.
 
+config BR2_PACKAGE_DROPBEAR_LEGACY_CRYPTO
+	bool "enable legacy crypto"
+	help
+	  Enable legacy and possibly insecure algorithms:
+	    3DES encryption
+	    SHA1-96 message integrity
+	    CBC encryption mode
+	    DSA public keys
+	    Diffie-Hellman Group1 key exchange
+
 endif

package/dropbear/dropbear.mk +11 -1

index fc41a84c1f..c2d3dedad3 100644
@@ -42,13 +42,23 @@ define DROPBEAR_SVR_PASSWORD_AUTH
 endef
 DROPBEAR_POST_EXTRACT_HOOKS += DROPBEAR_SVR_PASSWORD_AUTH
 
+define DROPBEAR_DISABLE_LEGACY_CRYPTO
+	echo '#define DROPBEAR_3DES 0'                  >> $(@D)/localoptions.h
+	echo '#define DROPBEAR_ENABLE_CBC_MODE 0'       >> $(@D)/localoptions.h
+	echo '#define DROPBEAR_SHA1_96_HMAC 0'          >> $(@D)/localoptions.h
+	echo '#define DROPBEAR_DSS 0'                   >> $(@D)/localoptions.h
+	echo '#define DROPBEAR_DH_GROUP1 0'             >> $(@D)/localoptions.h
+endef
+ifneq ($(BR2_PACKAGE_DROPBEAR_LEGACY_CRYPTO),y)
+DROPBEAR_POST_EXTRACT_HOOKS += DROPBEAR_DISABLE_LEGACY_CRYPTO
+endif
+
 define DROPBEAR_ENABLE_REVERSE_DNS
 	echo '#define DO_HOST_LOOKUP 1'                 >> $(@D)/localoptions.h
 endef
 
 define DROPBEAR_BUILD_FEATURED
 	echo '#define DROPBEAR_SMALL_CODE 0'            >> $(@D)/localoptions.h
-	echo '#define DROPBEAR_BLOWFISH 1'              >> $(@D)/localoptions.h
 	echo '#define DROPBEAR_TWOFISH128 1'            >> $(@D)/localoptions.h
 	echo '#define DROPBEAR_TWOFISH256 1'            >> $(@D)/localoptions.h
 endef

Signature · 1 line

2.17.0

Carlos Santos

2018-07-01 01:12 UTC #2 lore raw

PATCH 1/1 dropbear: Disable legacy/insecure options

Quoted 11 lines · Stefan S?rensen

Dropbear by default enables a number of algorithms that are now considered insecure and should only be used when legacy support is required:
3DES encryption
Blowfish encryption
SHA1-96 message integrity
CBC encryption mode
DSA public keys
Diffie-Hellman Group1 key exchange
So disable them by default, but add a config option for bringing them back. Furthermore the Blowfish legacy algorithm is unconditionally disabled

[...]

Looks good but after commit 037b8616257067282e375edca9af19418a0e7a4a it needs to be rebased.

--
Carlos Santos
DATACOM P&D

Baruch Siach

2018-07-03 04:25 UTC #3 lore raw

PATCH v2 1/1 dropbear: Disable legacy/insecure options

In reply to Stefan Sørensen

Hi Stefan,

Quoted 9 lines · Stefan S?rensen

Dropbear by default enables a number of algorithms that are now considered insecure and should only be used when legacy support is required:
3DES encryption
Blowfish encryption
SHA1-96 message integrity
CBC encryption mode
DSA public keys
Diffie-Hellman Group1 key exchange

Quoted 4 lines

So disable them by default, but add a config option for bringing them back. Furthermore the Blowfish legacy algorithm is unconditionally disabled
Signed-off-by Stefan S?rensen <[email protected]>

Reviewed-by Baruch Siach <[email protected]>

baruch

Signature · 3 lines

     http://baruch.siach.name/blog/                  ~. .~   Tk Open Systems
=}------------------------------------------------ooO--U--Ooo------------{=
   - baruch at tkos.co.il - tel: +972.52.368.4656, http://www.tkos.co.il -

Baruch Siach

2018-05-07 17:53 UTC #4 lore raw

PATCH v2 1/1 dropbear: Do not build static binary

In reply to Stefan Sørensen

Hi Stefan,

Quoted 9 lines · Stefan S?rensen

Dropbear 2018.76 now uses the --enable-static option to indicate that a static binary should be built. This will incorrectly pick up the generic buildroot option intended for building static libraries, causing an unwanted static binary build with BR2_SHARED_STATIC_LIBS.
Fix by appending an --disable-static configure flag, overriding the buildroot default.
Signed-off-by Stefan S?rensen <[email protected]>

Reviewed-by Baruch Siach <[email protected]>

baruch

Quoted 25 lines

---
Changes v1->v2:
* Keep the --enable-static when BR2_STATIC_LIBS=y

 package/dropbear/dropbear.mk | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

package/dropbear/dropbear.mk +5 -2

index 1da1a559a3..fc41a84c1f 100644
@@ -27,8 +27,11 @@ DROPBEAR_MAKE = \
 	$(MAKE) MULTI=1 SCPPROGRESS=1 \
 	PROGRAMS="$(DROPBEAR_PROGRAMS)"
 
-ifeq ($(BR2_STATIC_LIBS),y)
-DROPBEAR_CONF_OPTS += --enable-static
+# With BR2_SHARED_STATIC_LIBS=y the generic infrastructure adds a
+# --enable-static flags causing dropbear to be built as a static
+# binary. Adding a --disable-static reverts this
+ifeq ($(BR2_SHARED_STATIC_LIBS),y)
+DROPBEAR_CONF_OPTS += --disable-static
 endif
 
 # Ensure that dropbear doesn't use crypt() when it's not available

Signature · 3 lines

     http://baruch.siach.name/blog/                  ~. .~   Tk Open Systems
=}------------------------------------------------ooO--U--Ooo------------{=
   - baruch at tkos.co.il - tel: +972.52.368.4656, http://www.tkos.co.il -

Thomas Petazzoni

Applied

2018-05-08 13:09 UTC #5 lore raw

PATCH v2 1/1 dropbear: Do not build static binary

In reply to Stefan Sørensen

Hello,

Quoted 5 lines · Stefan S?rensen

Dropbear 2018.76 now uses the --enable-static option to indicate that a static binary should be built. This will incorrectly pick up the generic buildroot option intended for building static libraries, causing an unwanted static binary build with BR2_SHARED_STATIC_LIBS.

Quoted 7 lines

Fix by appending an --disable-static configure flag, overriding the buildroot default.
Signed-off-by Stefan S?rensen <[email protected]>
---
Changes v1->v2:
* Keep the --enable-static when BR2_STATIC_LIBS=y

Applied to master, thanks.

Thomas

Signature · 3 lines

Thomas Petazzoni, CTO, Bootlin (formerly Free Electrons)
Embedded Linux and Kernel engineering
https://bootlin.com

Peter Korsgaard

2018-08-27 09:36 UTC #6 lore raw

PATCH v2 1/1 dropbear: Do not build static binary

In reply to Stefan Sørensen

Quoted 7 lines

Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Stefan" == Stefan S?rensen <[email protected]> writes:
Dropbear 2018.76 now uses the --enable-static option to indicate that a static binary should be built. This will incorrectly pick up the generic buildroot option intended for building static libraries, causing an unwanted static binary build with BR2_SHARED_STATIC_LIBS.

Quoted 7 lines

Fix by appending an --disable-static configure flag, overriding the buildroot default.
Signed-off-by Stefan S?rensen <[email protected]>
---
Changes v1->v2:
* Keep the --enable-static when BR2_STATIC_LIBS=y

Committed to 2018.02.x, thanks.

Signature · 1 line

Bye, Peter Korsgaard