dropbear: split U2F/FIDO support

[openwrt/staging/robimarko.git] / package / network / services / dropbear / Makefile

diff --git a/package/network/services/dropbear/Makefile b/package/network/services/dropbear/Makefile
index 1859aab7f48cdf42b7f2c81314589ce70e25c258..c00f64006e3cfba77c0cf59f9c1536ff4e3e66ae 100644 (file)
--- a/package/network/services/dropbear/Makefile
+++ b/package/network/services/dropbear/Makefile
@@ -31,9 +31,11 @@ PKG_CONFIG_DEPENDS:= \
        CONFIG_TARGET_INIT_PATH CONFIG_DROPBEAR_ECC CONFIG_DROPBEAR_ECC_FULL \
        CONFIG_DROPBEAR_CURVE25519 CONFIG_DROPBEAR_ZLIB \
        CONFIG_DROPBEAR_ED25519 CONFIG_DROPBEAR_CHACHA20POLY1305 \
+       CONFIG_DROPBEAR_U2F CONFIG_DROPBEAR_ECDSA_SK CONFIG_DROPBEAR_ED25519_SK \
        CONFIG_DROPBEAR_UTMP CONFIG_DROPBEAR_PUTUTLINE \
        CONFIG_DROPBEAR_DBCLIENT CONFIG_DROPBEAR_SCP CONFIG_DROPBEAR_ASKPASS \
-       CONFIG_DROPBEAR_DBCLIENT_AGENTFORWARD CONFIG_DROPBEAR_AGENTFORWARD
+       CONFIG_DROPBEAR_DBCLIENT_AGENTFORWARD CONFIG_DROPBEAR_AGENTFORWARD \
+       CONFIG_DROPBEAR_MODERN_ONLY
 
 include $(INCLUDE_DIR)/package.mk
 
@@ -104,18 +106,26 @@ CONFIGURE_ARGS += \
 #
 ##############################################################################
 
+# adjust allowed shell list (if getusershell(3) is missing):
+# - COMPAT_USER_SHELLS
 # remove protocol idented software version number:
 # - LOCAL_IDENT
 # disable legacy/unsafe methods and unused functionality:
 # - DROPBEAR_CLI_NETCAT
 # - DROPBEAR_DSS
 # - DO_MOTD
+# - DROPBEAR_DH_GROUP14_SHA1
+# - DROPBEAR_SHA1_HMAC
 DB_OPT_COMMON = \
        !!LOCAL_IDENT,"SSH-2.0-dropbear" \
+       COMPAT_USER_SHELLS,"/bin/ash","/bin/sh" \
        DEFAULT_PATH,"$(TARGET_INIT_PATH)" \
+       DEFAULT_ROOT_PATH,"$(TARGET_INIT_PATH)" \
        DROPBEAR_DSS,0 \
        DROPBEAR_CLI_NETCAT,0 \
        DO_MOTD,0 \
+       DROPBEAR_DH_GROUP14_SHA1,0 \
+       DROPBEAR_SHA1_HMAC,0 \
 
 
 ##############################################################################
@@ -133,13 +143,19 @@ DB_OPT_CONFIG = \
        DROPBEAR_CURVE25519,CONFIG_DROPBEAR_CURVE25519,1,0 \
        DROPBEAR_CHACHA20POLY1305,CONFIG_DROPBEAR_CHACHA20POLY1305,1,0 \
        DROPBEAR_ED25519,CONFIG_DROPBEAR_ED25519,1,0 \
-       DROPBEAR_SK_ED25519,CONFIG_DROPBEAR_ED25519,1,0 \
        DROPBEAR_ECDSA,CONFIG_DROPBEAR_ECC,1,0 \
-       DROPBEAR_SK_ECDSA,CONFIG_DROPBEAR_ECC,1,0 \
        DROPBEAR_ECDH,CONFIG_DROPBEAR_ECC,1,0 \
+       DROPBEAR_SK_KEYS,CONFIG_DROPBEAR_U2F,1,0 \
+       DROPBEAR_SK_ECDSA,CONFIG_DROPBEAR_ECDSA_SK,1,0 \
+       DROPBEAR_SK_ED25519,CONFIG_DROPBEAR_ED25519_SK,1,0 \
        DROPBEAR_CLI_ASKPASS_HELPER,CONFIG_DROPBEAR_ASKPASS,1,0 \
        DROPBEAR_CLI_AGENTFWD,CONFIG_DROPBEAR_DBCLIENT_AGENTFORWARD,1,0 \
        DROPBEAR_SVR_AGENTFWD,CONFIG_DROPBEAR_AGENTFORWARD,1,0 \
+       DROPBEAR_AES128,CONFIG_DROPBEAR_MODERN_ONLY,0,1 \
+       DROPBEAR_AES256,CONFIG_DROPBEAR_MODERN_ONLY,0,1 \
+       DROPBEAR_ENABLE_CTR_MODE,CONFIG_DROPBEAR_MODERN_ONLY,0,1 \
+       DROPBEAR_RSA,CONFIG_DROPBEAR_MODERN_ONLY,0,1 \
+       DROPBEAR_RSA_SHA1,CONFIG_DROPBEAR_MODERN_ONLY,0,1 \
 
 
 TARGET_CFLAGS += -DARGTYPE=3
@@ -165,6 +181,11 @@ define Build/Configure/dropbear_headers
        ))
 endef
 
+define Build/Configure/dropbear_objects
+       grep -ERZl -e '($(subst $(space),|,$(strip $(sort $(patsubst !!%,%,$(foreach s,$(DB_OPT_COMMON) $(DB_OPT_CONFIG),$(word 1,$(subst $(comma),$(space),$(s)))))))))' \
+       $(PKG_BUILD_DIR)/ | sed -zE 's/^(.+)\.[^.]+$$$$/\1.o/' | sort -uV | xargs -0 -r rm -fv || :
+endef
+
 define Build/Configure
        rm -f $(PKG_BUILD_DIR)/localoptions.h
        $(Build/Configure/Default)
@@ -172,8 +193,8 @@ define Build/Configure
        : > $(PKG_BUILD_DIR)/localoptions.h
        $(Build/Configure/dropbear_headers)
 
-       # Enforce rebuild of svr-chansession.c
-       rm -f $(PKG_BUILD_DIR)/svr-chansession.o
+       # Enforce rebuild of files depending on configured options
+       $(Build/Configure/dropbear_objects)
 
        # Rebuild them on config change
        +$(MAKE) -C $(PKG_BUILD_DIR)/libtomcrypt clean