6e10fc74fd
- Security: Fix double-free in server TCP listener cleanup A double-free in the server could be triggered by an authenticated user if dropbear is running with -a (Allow connections to forwarded ports from any host) This could potentially allow arbitrary code execution as root by an authenticated user. Affects versions 2013.56 to 2016.74. Thanks to Mark Shepard for reporting the crash. CVE-2017-9078 https://secure.ucc.asn.au/hg/dropbear/rev/c8114a48837c - Security: Fix information disclosure with ~/.ssh/authorized_keys symlink. Dropbear parsed authorized_keys as root, even if it were a symlink. The fix is to switch to user permissions when opening authorized_keys A user could symlink their ~/.ssh/authorized_keys to a root-owned file they couldn't normally read. If they managed to get that file to contain valid authorized_keys with command= options it might be possible to read other contents of that file. This information disclosure is to an already authenticated user. Thanks to Jann Horn of Google Project Zero for reporting this. CVE-2017-9079 https://secure.ucc.asn.au/hg/dropbear/rev/0d889b068123 Refresh patches, rework 100-pubkey_path.patch to work with new authorized_keys validation. Signed-off-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
148 lines
4.3 KiB
Makefile
148 lines
4.3 KiB
Makefile
#
|
|
# Copyright (C) 2006-2016 OpenWrt.org
|
|
#
|
|
# This is free software, licensed under the GNU General Public License v2.
|
|
# See /LICENSE for more information.
|
|
#
|
|
|
|
include $(TOPDIR)/rules.mk
|
|
|
|
PKG_NAME:=dropbear
|
|
PKG_VERSION:=2017.75
|
|
PKG_RELEASE:=1
|
|
|
|
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
|
|
PKG_SOURCE_URL:= \
|
|
http://matt.ucc.asn.au/dropbear/releases/ \
|
|
https://dropbear.nl/mirror/releases/
|
|
PKG_HASH:=6cbc1dcb1c9709d226dff669e5604172a18cf5dbf9a201474d5618ae4465098c
|
|
|
|
PKG_LICENSE:=MIT
|
|
PKG_LICENSE_FILES:=LICENSE libtomcrypt/LICENSE libtommath/LICENSE
|
|
|
|
PKG_BUILD_PARALLEL:=1
|
|
PKG_USE_MIPS16:=0
|
|
|
|
PKG_CONFIG_DEPENDS:=CONFIG_TARGET_INIT_PATH CONFIG_DROPBEAR_ECC CONFIG_DROPBEAR_CURVE25519
|
|
|
|
include $(INCLUDE_DIR)/package.mk
|
|
|
|
ifneq ($(DUMP),1)
|
|
STAMP_CONFIGURED:=$(strip $(STAMP_CONFIGURED))_$(shell echo $(CONFIG_TARGET_INIT_PATH) | mkhash md5)
|
|
endif
|
|
|
|
define Package/dropbear/Default
|
|
URL:=http://matt.ucc.asn.au/dropbear/
|
|
endef
|
|
|
|
define Package/dropbear/config
|
|
source "$(SOURCE)/Config.in"
|
|
endef
|
|
|
|
define Package/dropbear
|
|
$(call Package/dropbear/Default)
|
|
SECTION:=net
|
|
CATEGORY:=Base system
|
|
TITLE:=Small SSH2 client/server
|
|
endef
|
|
|
|
define Package/dropbear/description
|
|
A small SSH2 server/client designed for small memory environments.
|
|
endef
|
|
|
|
define Package/dropbear/conffiles
|
|
/etc/dropbear/dropbear_rsa_host_key
|
|
/etc/config/dropbear
|
|
endef
|
|
|
|
define Package/dropbearconvert
|
|
$(call Package/dropbear/Default)
|
|
SECTION:=utils
|
|
CATEGORY:=Utilities
|
|
TITLE:=Utility for converting SSH keys
|
|
endef
|
|
|
|
CONFIGURE_ARGS += \
|
|
--disable-pam \
|
|
--enable-openpty \
|
|
--enable-syslog \
|
|
--disable-lastlog \
|
|
--disable-utmpx \
|
|
$(if $(CONFIG_DROPBEAR_UTMP),,--disable-utmp) \
|
|
--disable-wtmp \
|
|
--disable-wtmpx \
|
|
--disable-loginfunc \
|
|
$(if $(CONFIG_DROPBEAR_PUTUTLINE),,--disable-pututline) \
|
|
--disable-pututxline \
|
|
--disable-zlib \
|
|
--enable-bundled-libtom
|
|
|
|
TARGET_CFLAGS += -DARGTYPE=3 -ffunction-sections -fdata-sections
|
|
TARGET_LDFLAGS += -Wl,--gc-sections
|
|
|
|
define Build/Configure
|
|
$(Build/Configure/Default)
|
|
|
|
$(SED) 's,^#define DEFAULT_PATH .*$$$$,#define DEFAULT_PATH "$(TARGET_INIT_PATH)",g' \
|
|
$(PKG_BUILD_DIR)/options.h
|
|
|
|
awk 'BEGIN { rc = 1 } \
|
|
/'DROPBEAR_CURVE25519'/ { $$$$0 = "$(if $(CONFIG_DROPBEAR_CURVE25519),,// )#define 'DROPBEAR_CURVE25519'"; rc = 0 } \
|
|
{ print } \
|
|
END { exit(rc) }' $(PKG_BUILD_DIR)/options.h \
|
|
>$(PKG_BUILD_DIR)/options.h.new && \
|
|
mv $(PKG_BUILD_DIR)/options.h.new $(PKG_BUILD_DIR)/options.h
|
|
|
|
# Enforce that all replacements are made, otherwise options.h has changed
|
|
# format and this logic is broken.
|
|
for OPTION in DROPBEAR_ECDSA DROPBEAR_ECDH; do \
|
|
awk 'BEGIN { rc = 1 } \
|
|
/'$$$$OPTION'/ { $$$$0 = "$(if $(CONFIG_DROPBEAR_ECC),,// )#define '$$$$OPTION'"; rc = 0 } \
|
|
{ print } \
|
|
END { exit(rc) }' $(PKG_BUILD_DIR)/options.h \
|
|
>$(PKG_BUILD_DIR)/options.h.new && \
|
|
mv $(PKG_BUILD_DIR)/options.h.new $(PKG_BUILD_DIR)/options.h || exit 1; \
|
|
done
|
|
|
|
# remove protocol idented software version number
|
|
$(SED) 's,^#define LOCAL_IDENT .*$$$$,#define LOCAL_IDENT "SSH-2.0-dropbear",g' \
|
|
$(PKG_BUILD_DIR)/sysoptions.h
|
|
|
|
# Enforce rebuild of svr-chansession.c
|
|
rm -f $(PKG_BUILD_DIR)/svr-chansession.o
|
|
endef
|
|
|
|
define Build/Compile
|
|
+$(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR) \
|
|
$(TARGET_CONFIGURE_OPTS) \
|
|
PROGRAMS="dropbear dbclient dropbearkey scp" \
|
|
MULTI=1 SCPPROGRESS=1
|
|
+$(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR) \
|
|
$(TARGET_CONFIGURE_OPTS) \
|
|
PROGRAMS="dropbearconvert"
|
|
endef
|
|
|
|
define Package/dropbear/install
|
|
$(INSTALL_DIR) $(1)/usr/sbin
|
|
$(INSTALL_BIN) $(PKG_BUILD_DIR)/dropbearmulti $(1)/usr/sbin/dropbear
|
|
$(INSTALL_DIR) $(1)/usr/bin
|
|
$(LN) ../sbin/dropbear $(1)/usr/bin/scp
|
|
$(LN) ../sbin/dropbear $(1)/usr/bin/ssh
|
|
$(LN) ../sbin/dropbear $(1)/usr/bin/dbclient
|
|
$(LN) ../sbin/dropbear $(1)/usr/bin/dropbearkey
|
|
$(INSTALL_DIR) $(1)/etc/config
|
|
$(INSTALL_DATA) ./files/dropbear.config $(1)/etc/config/dropbear
|
|
$(INSTALL_DIR) $(1)/etc/init.d
|
|
$(INSTALL_BIN) ./files/dropbear.init $(1)/etc/init.d/dropbear
|
|
$(INSTALL_DIR) $(1)/usr/lib/opkg/info
|
|
$(INSTALL_DIR) $(1)/etc/dropbear
|
|
touch $(1)/etc/dropbear/dropbear_rsa_host_key
|
|
endef
|
|
|
|
define Package/dropbearconvert/install
|
|
$(INSTALL_DIR) $(1)/usr/bin
|
|
$(INSTALL_BIN) $(PKG_BUILD_DIR)/dropbearconvert $(1)/usr/bin/dropbearconvert
|
|
endef
|
|
|
|
$(eval $(call BuildPackage,dropbear))
|
|
$(eval $(call BuildPackage,dropbearconvert))
|