dropbear: use new extra_command wrapper

[openwrt/openwrt.git] / package / network / services / dropbear / Makefile

diff --git a/package/network/services/dropbear/Makefile b/package/network/services/dropbear/Makefile
index 95852baf77f7a2436049d73d2395b04d37237bce..1ecca2feb18b45b4765ecae52b05e74db6db10fb 100644 (file)
--- a/package/network/services/dropbear/Makefile
+++ b/package/network/services/dropbear/Makefile
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2006-2016 OpenWrt.org
+# Copyright (C) 2006-2020 OpenWrt.org
 #
 # This is free software, licensed under the GNU General Public License v2.
 # See /LICENSE for more information.
@@ -8,22 +8,31 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=dropbear
-PKG_VERSION:=2017.75
+PKG_VERSION:=2020.80
 PKG_RELEASE:=4
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:= \
        http://matt.ucc.asn.au/dropbear/releases/ \
        https://dropbear.nl/mirror/releases/
-PKG_HASH:=6cbc1dcb1c9709d226dff669e5604172a18cf5dbf9a201474d5618ae4465098c
+PKG_HASH:=d927941b91f2da150b2033f1a88b6a47999bf0afb1493a73e9216cffdb5d7949
 
 PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=LICENSE libtomcrypt/LICENSE libtommath/LICENSE
+PKG_CPE_ID:=cpe:/a:matt_johnston:dropbear_ssh_server
 
 PKG_BUILD_PARALLEL:=1
+PKG_ASLR_PIE_REGULAR:=1
 PKG_USE_MIPS16:=0
+PKG_FIXUP:=autoreconf
+PKG_FLAGS:=nonshared
 
-PKG_CONFIG_DEPENDS:=CONFIG_TARGET_INIT_PATH CONFIG_DROPBEAR_ECC CONFIG_DROPBEAR_CURVE25519
+PKG_CONFIG_DEPENDS:= \
+       CONFIG_TARGET_INIT_PATH CONFIG_DROPBEAR_ECC CONFIG_DROPBEAR_ECC_FULL \
+       CONFIG_DROPBEAR_CURVE25519 CONFIG_DROPBEAR_ZLIB \
+       CONFIG_DROPBEAR_ED25519 CONFIG_DROPBEAR_CHACHA20POLY1305 \
+       CONFIG_DROPBEAR_UTMP CONFIG_DROPBEAR_PUTUTLINE \
+       CONFIG_DROPBEAR_DBCLIENT CONFIG_DROPBEAR_SCP
 
 include $(INCLUDE_DIR)/package.mk
 
@@ -44,6 +53,13 @@ define Package/dropbear
   SECTION:=net
   CATEGORY:=Base system
   TITLE:=Small SSH2 client/server
+  DEPENDS:= +DROPBEAR_ZLIB:zlib
+  ALTERNATIVES:=
+  $(if $(CONFIG_DROPBEAR_SCP),ALTERNATIVES+= \
+         100:/usr/bin/scp:/usr/sbin/dropbear,)
+  $(if $(CONFIG_DROPBEAR_DBCLIENT),ALTERNATIVES+= \
+         100:/usr/bin/ssh:/usr/sbin/dropbear,)
+
 endef
 
 define Package/dropbear/description
@@ -51,8 +67,10 @@ define Package/dropbear/description
 endef
 
 define Package/dropbear/conffiles
+$(if $(CONFIG_DROPBEAR_ED25519),/etc/dropbear/dropbear_ed25519_host_key)
+$(if $(CONFIG_DROPBEAR_ECC),/etc/dropbear/dropbear_ecdsa_host_key)
 /etc/dropbear/dropbear_rsa_host_key
-/etc/config/dropbear 
+/etc/config/dropbear
 endef
 
 define Package/dropbearconvert
@@ -60,6 +78,7 @@ define Package/dropbearconvert
   SECTION:=utils
   CATEGORY:=Utilities
   TITLE:=Utility for converting SSH keys
+  DEPENDS:= +DROPBEAR_ZLIB:zlib
 endef
 
 CONFIGURE_ARGS += \
@@ -74,48 +93,63 @@ CONFIGURE_ARGS += \
        --disable-loginfunc \
        $(if $(CONFIG_DROPBEAR_PUTUTLINE),,--disable-pututline) \
        --disable-pututxline \
-       --disable-zlib \
+       $(if $(CONFIG_DROPBEAR_ZLIB),,--disable-zlib) \
        --enable-bundled-libtom
 
-TARGET_CFLAGS += -DARGTYPE=3 -ffunction-sections -fdata-sections
-TARGET_LDFLAGS += -Wl,--gc-sections
+TARGET_CFLAGS += -DARGTYPE=3 -ffunction-sections -fdata-sections -flto
+TARGET_LDFLAGS += -Wl,--gc-sections -flto=jobserver
 
 define Build/Configure
+       : > $(PKG_BUILD_DIR)/localoptions.h
+
        $(Build/Configure/Default)
 
-       $(SED) 's,^#define DEFAULT_PATH .*$$$$,#define DEFAULT_PATH "$(TARGET_INIT_PATH)",g' \
-               $(PKG_BUILD_DIR)/options.h
+       echo '#define DEFAULT_PATH "$(TARGET_INIT_PATH)"' >> \
+               $(PKG_BUILD_DIR)/localoptions.h
 
-       awk 'BEGIN { rc = 1 } \
-            /'DROPBEAR_CURVE25519'/ { $$$$0 = "$(if $(CONFIG_DROPBEAR_CURVE25519),,// )#define 'DROPBEAR_CURVE25519'"; rc = 0 } \
-            { print } \
-            END { exit(rc) }' $(PKG_BUILD_DIR)/options.h \
-            >$(PKG_BUILD_DIR)/options.h.new && \
-       mv $(PKG_BUILD_DIR)/options.h.new $(PKG_BUILD_DIR)/options.h
+       echo '#define DROPBEAR_CURVE25519 $(if $(CONFIG_DROPBEAR_CURVE25519),1,0)' >> \
+               $(PKG_BUILD_DIR)/localoptions.h
 
-       # Enforce that all replacements are made, otherwise options.h has changed
-       # format and this logic is broken.
        for OPTION in DROPBEAR_ECDSA DROPBEAR_ECDH; do \
-         awk 'BEGIN { rc = 1 } \
-              /'$$$$OPTION'/ { $$$$0 = "$(if $(CONFIG_DROPBEAR_ECC),,// )#define '$$$$OPTION'"; rc = 0 } \
-              { print } \
-              END { exit(rc) }' $(PKG_BUILD_DIR)/options.h \
-              >$(PKG_BUILD_DIR)/options.h.new && \
-         mv $(PKG_BUILD_DIR)/options.h.new $(PKG_BUILD_DIR)/options.h || exit 1; \
+               echo "#define $$$$OPTION $(if $(CONFIG_DROPBEAR_ECC),1,0)" >> \
+                       $(PKG_BUILD_DIR)/localoptions.h; \
        done
 
+       echo '#define DROPBEAR_ED25519 $(if $(CONFIG_DROPBEAR_ED25519),1,0)' >> \
+               $(PKG_BUILD_DIR)/localoptions.h
+
+       echo '#define DROPBEAR_CHACHA20POLY1305 $(if $(CONFIG_DROPBEAR_CHACHA20POLY1305),1,0)' >> \
+               $(PKG_BUILD_DIR)/localoptions.h
+
        # remove protocol idented software version number
-       $(SED) 's,^#define LOCAL_IDENT .*$$$$,#define LOCAL_IDENT "SSH-2.0-dropbear",g' \
+       $(ESED) 's,^(#define LOCAL_IDENT) .*$$$$,\1 "SSH-2.0-dropbear",g' \
                $(PKG_BUILD_DIR)/sysoptions.h
 
+       # disable legacy/unsafe methods and unused functionality
+       for OPTION in INETD_MODE DROPBEAR_CLI_NETCAT \
+       DROPBEAR_DSS DROPBEAR_USE_PASSWORD_ENV DO_MOTD ; do \
+               echo "#define $$$$OPTION 0" >> \
+                       $(PKG_BUILD_DIR)/localoptions.h; \
+       done
+
+       # enable nistp384 and nistp521 only if full ECC support was requested
+       for OPTION in DROPBEAR_ECC_384 DROPBEAR_ECC_521; do \
+               $(ESED) 's,^(#define '$$$$OPTION') .*$$$$,\1 $(if $(CONFIG_DROPBEAR_ECC_FULL),1,0),g' \
+               $(PKG_BUILD_DIR)/sysoptions.h; \
+       done
+
        # Enforce rebuild of svr-chansession.c
        rm -f $(PKG_BUILD_DIR)/svr-chansession.o
+
+       # Rebuild them on config change
+       +$(MAKE) -C $(PKG_BUILD_DIR)/libtomcrypt clean
+       +$(MAKE) -C $(PKG_BUILD_DIR)/libtommath clean
 endef
 
 define Build/Compile
        +$(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR) \
                $(TARGET_CONFIGURE_OPTS) \
-               PROGRAMS="dropbear dbclient dropbearkey scp" \
+               PROGRAMS="dropbear $(if $(CONFIG_DROPBEAR_DBCLIENT),dbclient,) dropbearkey $(if $(CONFIG_DROPBEAR_SCP),scp,)" \
                MULTI=1 SCPPROGRESS=1
        +$(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR) \
                $(TARGET_CONFIGURE_OPTS) \
@@ -126,16 +160,18 @@ define Package/dropbear/install
        $(INSTALL_DIR) $(1)/usr/sbin
        $(INSTALL_BIN) $(PKG_BUILD_DIR)/dropbearmulti $(1)/usr/sbin/dropbear
        $(INSTALL_DIR) $(1)/usr/bin
-       $(LN) ../sbin/dropbear $(1)/bin/scp
-       $(LN) ../sbin/dropbear $(1)/bin/ssh
-       $(LN) ../sbin/dropbear $(1)/usr/bin/dbclient
+       $(if $(CONFIG_DROPBEAR_DBCLIENT),$(LN) ../sbin/dropbear $(1)/usr/bin/dbclient,)
        $(LN) ../sbin/dropbear $(1)/usr/bin/dropbearkey
        $(INSTALL_DIR) $(1)/etc/config
-       $(INSTALL_DATA) ./files/dropbear.config $(1)/etc/config/dropbear
+       $(INSTALL_CONF) ./files/dropbear.config $(1)/etc/config/dropbear
        $(INSTALL_DIR) $(1)/etc/init.d
        $(INSTALL_BIN) ./files/dropbear.init $(1)/etc/init.d/dropbear
        $(INSTALL_DIR) $(1)/usr/lib/opkg/info
        $(INSTALL_DIR) $(1)/etc/dropbear
+       $(INSTALL_DIR) $(1)/lib/preinit
+       $(INSTALL_DATA) ./files/dropbear.failsafe $(1)/lib/preinit/99_10_failsafe_dropbear
+       $(if $(CONFIG_DROPBEAR_ED25519),touch $(1)/etc/dropbear/dropbear_ed25519_host_key)
+       $(if $(CONFIG_DROPBEAR_ECC),touch $(1)/etc/dropbear/dropbear_ecdsa_host_key)
        touch $(1)/etc/dropbear/dropbear_rsa_host_key
 endef