dropbear: don't use IMAGE_FEATURES

PATCH In review Martin Jansa 4 participants 7 messages Jan 7, 2013

Share & tools

Martin Jansa

author

2013-01-07 11:32 UTC #0 lore raw

PATCH 1/1 dropbear: don't use IMAGE_FEATURES

* IMAGE_FEATURES are image specific, but dropbear recipe isn't
* if you have debug-tweaks in EXTRA_IMAGE_FEATURES or added to IMAGE_FEATURES in distro config, then it will set DISTRO_TYPE to debug as expected, but if you add debug-tweaks only in your-own-debug-image, then dropbear never sees debug-tweaks and your-own-debug-image won't allow empty password login.
* best way would be to patch dropbear to enable empty password by runtime config or argument and enable it in ROOTFS_POSTPROCESS_COMMAND like openssh_allow_empty_password does, see
http://permalink.gmane.org/gmane.network.ssh.dropbear/845

Signed-off-by Martin Jansa <[email protected]>

---
 meta/recipes-core/dropbear/dropbear.inc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

meta/recipes-core/dropbear/dropbear.inc +2 -2

index aa313df..2c170c6 100644
@@ -2,7 +2,7 @@ DESCRIPTION = "Dropbear is a lightweight SSH and SCP implementation"
 HOMEPAGE = "http://matt.ucc.asn.au/dropbear/dropbear.html"
 SECTION = "console/network"
 
-INC_PR = "r0"
+INC_PR = "r1"
 
 # some files are from other projects and have others license terms:
 #   public domain, OpenSSH 3.5p1, OpenSSH3.6.1p2, PuTTY

@@ -40,7 +40,7 @@ EXTRA_OEMAKE = 'MULTI=1 SCPPROGRESS=1 PROGRAMS="${SBINCOMMANDS} ${BINCOMMANDS}"'
 EXTRA_OECONF += "\
  ${@base_contains('DISTRO_FEATURES', 'pam', '--enable-pam', '--disable-pam', d)}"
 
-DISTRO_TYPE ?= "${@base_contains("IMAGE_FEATURES", "debug-tweaks", "debug", "",d)}"
+DISTRO_TYPE ?= "debug"
 
 do_install() {
 	install -d ${D}${sysconfdir} \

Signature · 1 line

1.8.1

Otavio Salvador

2013-01-07 11:37 UTC #1 lore raw

Quoted 11 lines · Martin Jansa

* IMAGE_FEATURES are image specific, but dropbear recipe isn't
* if you have debug-tweaks in EXTRA_IMAGE_FEATURES or added to IMAGE_FEATURES in distro config, then it will set DISTRO_TYPE to debug as expected, but if you add debug-tweaks only in your-own-debug-image, then dropbear never sees debug-tweaks and your-own-debug-image won't allow empty password login.
* best way would be to patch dropbear to enable empty password by runtime config or argument and enable it in ROOTFS_POSTPROCESS_COMMAND like openssh_allow_empty_password does, see
http://permalink.gmane.org/gmane.network.ssh.dropbear/845

Quoted 1 line

Signed-off-by Martin Jansa <[email protected]>

I just fail to see why to keep using DISTRO_TYPE in dropbear in this case. You could just always include the patch.

Do you have any specific reason?

--
Otavio Salvador O.S. Systems
E-mail: [email protected] http://www.ossystems.com.br
Mobile: +55 53 9981-7854 http://projetos.ossystems.com.br

Richard Purdie

2013-01-07 11:51 UTC #2 lore raw

In reply to Martin Jansa

Quoted 30 lines · Martin Jansa

* IMAGE_FEATURES are image specific, but dropbear recipe isn't
* if you have debug-tweaks in EXTRA_IMAGE_FEATURES or added to IMAGE_FEATURES in distro config, then it will set DISTRO_TYPE to debug as expected, but if you add debug-tweaks only in your-own-debug-image, then dropbear never sees debug-tweaks and your-own-debug-image won't allow empty password login.
* best way would be to patch dropbear to enable empty password by runtime config or argument and enable it in ROOTFS_POSTPROCESS_COMMAND like openssh_allow_empty_password does, see
http://permalink.gmane.org/gmane.network.ssh.dropbear/845
Signed-off-by Martin Jansa <[email protected]>
---
 meta/recipes-core/dropbear/dropbear.inc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
meta/recipes-core/dropbear/dropbear.inc +1 -1
index aa313df..2c170c6 100644
@@ -2,7 +2,7 @@ DESCRIPTION = "Dropbear is a lightweight SSH and SCP implementation"
 HOMEPAGE = "http://matt.ucc.asn.au/dropbear/dropbear.html"
 SECTION = "console/network"
 
-INC_PR = "r0"
+INC_PR = "r1"
 
 # some files are from other projects and have others license terms:
 #   public domain, OpenSSH 3.5p1, OpenSSH3.6.1p2, PuTTY

meta/recipes-core/dropbear/dropbear.inc EXTRA_OEMAKE = 'MULTI=1 SCPPROGRESS=1 PROGRAMS="${SBINCOMMANDS} ${BINCOMMANDS}"' · line 46

Quoted 8 lines

meta/recipes-core/dropbear/dropbear.inc +1 -1

@@ -40,7 +40,7 @@ EXTRA_OEMAKE = 'MULTI=1 SCPPROGRESS=1 PROGRAMS="${SBINCOMMANDS} ${BINCOMMANDS}"'
 EXTRA_OECONF += "\
  ${@base_contains('DISTRO_FEATURES', 'pam', '--enable-pam', '--disable-pam', d)}"
 
-DISTRO_TYPE ?= "${@base_contains("IMAGE_FEATURES", "debug-tweaks", "debug", "",d)}"
+DISTRO_TYPE ?= "debug"
 
 do_install() {
 	install -d ${D}${sysconfdir} \

How about we ditch DISTRO_TYPE entirely and check for "debug-tweaks" in DISTRO_FEATURES? This would bring it more into line with the other places we do things like this.

FWIW I agree this should ideally be runtime configured and we should really add an enhancement request to the bugzilla for that (or patches welcome).

Cheers,

Richard

Martin Jansa

author

2013-01-07 12:19 UTC #3 lore raw

Quoted 37 lines · Richard Purdie

Quoted 36 lines · Martin Jansa
* IMAGE_FEATURES are image specific, but dropbear recipe isn't
* if you have debug-tweaks in EXTRA_IMAGE_FEATURES or added to IMAGE_FEATURES in distro config, then it will set DISTRO_TYPE to debug as expected, but if you add debug-tweaks only in your-own-debug-image, then dropbear never sees debug-tweaks and your-own-debug-image won't allow empty password login.
* best way would be to patch dropbear to enable empty password by runtime config or argument and enable it in ROOTFS_POSTPROCESS_COMMAND like openssh_allow_empty_password does, see
http://permalink.gmane.org/gmane.network.ssh.dropbear/845
Signed-off-by Martin Jansa <[email protected]>
---
 meta/recipes-core/dropbear/dropbear.inc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
meta/recipes-core/dropbear/dropbear.inc +2 -2
index aa313df..2c170c6 100644
@@ -2,7 +2,7 @@ DESCRIPTION = "Dropbear is a lightweight SSH and SCP implementation"
 HOMEPAGE = "http://matt.ucc.asn.au/dropbear/dropbear.html"
 SECTION = "console/network"
 
-INC_PR = "r0"
+INC_PR = "r1"
 
 # some files are from other projects and have others license terms:
 #   public domain, OpenSSH 3.5p1, OpenSSH3.6.1p2, PuTTY
@@ -40,7 +40,7 @@ EXTRA_OEMAKE = 'MULTI=1 SCPPROGRESS=1 PROGRAMS="${SBINCOMMANDS} ${BINCOMMANDS}"'
 EXTRA_OECONF += "\
  ${@base_contains('DISTRO_FEATURES', 'pam', '--enable-pam', '--disable-pam', d)}"
 
-DISTRO_TYPE ?= "${@base_contains("IMAGE_FEATURES", "debug-tweaks", "debug", "",d)}"
+DISTRO_TYPE ?= "debug"
 

Quoted 6 lines

meta/recipes-core/dropbear/dropbear.inc EXTRA_OEMAKE = 'MULTI=1 SCPPROGRESS=1 PROGRAMS="${SBINCOMMANDS} ${BINCOMMANDS}"' · line 46
Quoted 2 lines
meta/recipes-core/dropbear/dropbear.inc +0 -0
 do_install() {
 	install -d ${D}${sysconfdir} \
How about we ditch DISTRO_TYPE entirely and check for "debug-tweaks" in DISTRO_FEATURES? This would bring it more into line with the other places we do things like this.

Fine with me, I don't use dropbear, but I've spent some time to debug why drobear sometimes doesn't work as expected and shared this change just to make it more deterministic.

I'm fine with debug-tweaks DISTRO_FEATURES but afaik it's first use and can be confusing with IMAGE_FEATURES with the same name, that's why I've kept DISTRO_TYPE which was used at least in OE-classic days.

Cheers,

Quoted 3 lines

FWIW I agree this should ideally be runtime configured and we should really add an enhancement request to the bugzilla for that (or patches welcome).

Signature · 1 line

Martin 'JaMa' Jansa     jabber: [email protected]

Paul Eggleton

2013-01-07 20:27 UTC #4 lore raw

In reply to Richard Purdie

Quoted 53 lines · On Monday 07 January 2013 11:36:13 Richard Purdie wrote:

Quoted 39 lines · Martin Jansa
* IMAGE_FEATURES are image specific, but dropbear recipe isn't
* if you have debug-tweaks in EXTRA_IMAGE_FEATURES or added to
IMAGE_FEATURES in distro config, then it will set DISTRO_TYPE to debug as expected, but if you add debug-tweaks only in your-own-debug-image, then dropbear never sees debug-tweaks and your-own-debug-image won't allow empty password login.
* best way would be to patch dropbear to enable empty password by
runtime config or argument and enable it in ROOTFS_POSTPROCESS_COMMAND like openssh_allow_empty_password does, see
http://permalink.gmane.org/gmane.network.ssh.dropbear/845
Signed-off-by Martin Jansa <[email protected]>
---
 meta/recipes-core/dropbear/dropbear.inc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
(quoted diff) +0 -0
b/meta/recipes-core/dropbear/dropbear.inc index aa313df..2c170c6 100644
meta/recipes-core/dropbear/dropbear.inc +0 -0
@@ -2,7 +2,7 @@ DESCRIPTION = "Dropbear is a lightweight SSH and SCP
implementation">
HOMEPAGE = "http://matt.ucc.asn.au/dropbear/dropbear.html" SECTION = "console/network"
meta/recipes-core/dropbear/dropbear.inc +1 -1
-INC_PR = "r0"
+INC_PR = "r1"
 
 # some files are from other projects and have others license terms:
 #   public domain, OpenSSH 3.5p1, OpenSSH3.6.1p2, PuTTY
@@ -40,7 +40,7 @@ EXTRA_OEMAKE = 'MULTI=1 SCPPROGRESS=1
PROGRAMS="${SBINCOMMANDS} ${BINCOMMANDS}"'>
EXTRA_OECONF += "\
Quoted 8 lines
${@base_contains('DISTRO_FEATURES', 'pam', '--enable-pam', '--disable-pam', d)}">
-DISTRO_TYPE ?= "${@base_contains("IMAGE_FEATURES", "debug-tweaks", "debug", "",d)}" +DISTRO_TYPE ?= "debug"
do_install() {
install -d ${D}${sysconfdir} \
How about we ditch DISTRO_TYPE entirely and check for "debug-tweaks" in DISTRO_FEATURES? This would bring it more into line with the other places we do things like this.

Quoted 3 lines

FWIW I agree this should ideally be runtime configured and we should really add an enhancement request to the bugzilla for that (or patches welcome).

There's already a request open:

https://bugzilla.yoctoproject.org/show_bug.cgi?id=2578

I'd suggest leaving the current behaviour (poor as it may be) until that bug is fixed.

Cheers,
Paul

Signature · 2 lines

Paul Eggleton
Intel Open Source Technology Centre

Martin Jansa

author

2013-01-07 20:47 UTC #5 lore raw

Quoted 58 lines · Paul Eggleton

Quoted 53 lines · On Monday 07 January 2013 11:36:13 Richard Purdie wrote:
Quoted 39 lines · Martin Jansa
* IMAGE_FEATURES are image specific, but dropbear recipe isn't
* if you have debug-tweaks in EXTRA_IMAGE_FEATURES or added to
IMAGE_FEATURES in distro config, then it will set DISTRO_TYPE to debug as expected, but if you add debug-tweaks only in your-own-debug-image, then dropbear never sees debug-tweaks and your-own-debug-image won't allow empty password login.
* best way would be to patch dropbear to enable empty password by
runtime config or argument and enable it in ROOTFS_POSTPROCESS_COMMAND like openssh_allow_empty_password does, see
http://permalink.gmane.org/gmane.network.ssh.dropbear/845
Signed-off-by Martin Jansa <[email protected]>
---
 meta/recipes-core/dropbear/dropbear.inc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
(quoted diff) +0 -0
b/meta/recipes-core/dropbear/dropbear.inc index aa313df..2c170c6 100644
meta/recipes-core/dropbear/dropbear.inc +0 -0
@@ -2,7 +2,7 @@ DESCRIPTION = "Dropbear is a lightweight SSH and SCP
implementation">
HOMEPAGE = "http://matt.ucc.asn.au/dropbear/dropbear.html" SECTION = "console/network"
meta/recipes-core/dropbear/dropbear.inc +1 -1
-INC_PR = "r0"
+INC_PR = "r1"
 
 # some files are from other projects and have others license terms:
 #   public domain, OpenSSH 3.5p1, OpenSSH3.6.1p2, PuTTY
@@ -40,7 +40,7 @@ EXTRA_OEMAKE = 'MULTI=1 SCPPROGRESS=1
PROGRAMS="${SBINCOMMANDS} ${BINCOMMANDS}"'>
EXTRA_OECONF += "\
Quoted 8 lines
${@base_contains('DISTRO_FEATURES', 'pam', '--enable-pam', '--disable-pam', d)}">
-DISTRO_TYPE ?= "${@base_contains("IMAGE_FEATURES", "debug-tweaks", "debug", "",d)}" +DISTRO_TYPE ?= "debug"
do_install() {
install -d ${D}${sysconfdir} \
How about we ditch DISTRO_TYPE entirely and check for "debug-tweaks" in DISTRO_FEATURES? This would bring it more into line with the other places we do things like this.
Quoted 3 lines
FWIW I agree this should ideally be runtime configured and we should really add an enhancement request to the bugzilla for that (or patches welcome).

Quoted 6 lines

There's already a request open:
https://bugzilla.yoctoproject.org/show_bug.cgi?id=2578
I'd suggest leaving the current behaviour (poor as it may be) until that bug is fixed.

Building with OEBasic won't rebuild dropbear to suit IMAGE_FEATURES of currently build image and even with OEBasicHash I don't know which dropbear version will be used if I build 2 different images:
bitbake foo-image foo-debug-image

So changing it one way or another is IMHO improvement of current situation until that bug is fixed properly.

Cheers,

Signature · 1 line

Martin 'JaMa' Jansa     jabber: [email protected]

Richard Purdie

2013-01-07 21:01 UTC #6 lore raw

Quoted 66 lines · Martin Jansa

Quoted 58 lines · Paul Eggleton
Quoted 53 lines · On Monday 07 January 2013 11:36:13 Richard Purdie wrote:
Quoted 39 lines · Martin Jansa
* IMAGE_FEATURES are image specific, but dropbear recipe isn't
* if you have debug-tweaks in EXTRA_IMAGE_FEATURES or added to
IMAGE_FEATURES in distro config, then it will set DISTRO_TYPE to debug as expected, but if you add debug-tweaks only in your-own-debug-image, then dropbear never sees debug-tweaks and your-own-debug-image won't allow empty password login.
* best way would be to patch dropbear to enable empty password by
runtime config or argument and enable it in ROOTFS_POSTPROCESS_COMMAND like openssh_allow_empty_password does, see
http://permalink.gmane.org/gmane.network.ssh.dropbear/845
Signed-off-by Martin Jansa <[email protected]>
---
 meta/recipes-core/dropbear/dropbear.inc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
(quoted diff) +0 -0
b/meta/recipes-core/dropbear/dropbear.inc index aa313df..2c170c6 100644
meta/recipes-core/dropbear/dropbear.inc +0 -0
@@ -2,7 +2,7 @@ DESCRIPTION = "Dropbear is a lightweight SSH and SCP
implementation">
HOMEPAGE = "http://matt.ucc.asn.au/dropbear/dropbear.html" SECTION = "console/network"
meta/recipes-core/dropbear/dropbear.inc +1 -1
-INC_PR = "r0"
+INC_PR = "r1"
 
 # some files are from other projects and have others license terms:
 #   public domain, OpenSSH 3.5p1, OpenSSH3.6.1p2, PuTTY
@@ -40,7 +40,7 @@ EXTRA_OEMAKE = 'MULTI=1 SCPPROGRESS=1
PROGRAMS="${SBINCOMMANDS} ${BINCOMMANDS}"'>
EXTRA_OECONF += "\
Quoted 8 lines
${@base_contains('DISTRO_FEATURES', 'pam', '--enable-pam', '--disable-pam', d)}">
-DISTRO_TYPE ?= "${@base_contains("IMAGE_FEATURES", "debug-tweaks", "debug", "",d)}" +DISTRO_TYPE ?= "debug"
do_install() {
install -d ${D}${sysconfdir} \
How about we ditch DISTRO_TYPE entirely and check for "debug-tweaks" in DISTRO_FEATURES? This would bring it more into line with the other places we do things like this.
Quoted 3 lines
FWIW I agree this should ideally be runtime configured and we should really add an enhancement request to the bugzilla for that (or patches welcome).
Quoted 6 lines
There's already a request open:
https://bugzilla.yoctoproject.org/show_bug.cgi?id=2578
I'd suggest leaving the current behaviour (poor as it may be) until that bug is fixed.

Quoted 7 lines

Building with OEBasic won't rebuild dropbear to suit IMAGE_FEATURES of currently build image and even with OEBasicHash I don't know which dropbear version will be used if I build 2 different images:
bitbake foo-image foo-debug-image
So changing it one way or another is IMHO improvement of current situation until that bug is fixed properly.

Having looked into it more, the current situation is a complete mess and for something security sensitive like this, it *needs* to behave better. I just raised the priority of the task (medium+).

Cheers,

Richard