dropbear: disable MD5 HMAC and switch to sha1 fingerprints

[openwrt/openwrt.git] / package / network / services / dropbear / Makefile

diff --git a/package/network/services/dropbear/Makefile b/package/network/services/dropbear/Makefile
index d805f00cd3aabb02045d176d16e9afe951d75910..21ac09f72452e6093a2149d31df307c1d8dbe87c 100644 (file)
--- a/package/network/services/dropbear/Makefile
+++ b/package/network/services/dropbear/Makefile
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2006-2012 OpenWrt.org
+# Copyright (C) 2006-2016 OpenWrt.org
 #
 # This is free software, licensed under the GNU General Public License v2.
 # See /LICENSE for more information.
@@ -8,25 +8,33 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=dropbear
-PKG_VERSION:=2014.65
-PKG_RELEASE:=2
+PKG_VERSION:=2017.75
+PKG_RELEASE:=5
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:= \
        http://matt.ucc.asn.au/dropbear/releases/ \
        https://dropbear.nl/mirror/releases/
-PKG_MD5SUM:=1918604238817385a156840fa2c39490
+PKG_HASH:=6cbc1dcb1c9709d226dff669e5604172a18cf5dbf9a201474d5618ae4465098c
 
 PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=LICENSE libtomcrypt/LICENSE libtommath/LICENSE
+PKG_CPE_ID:=cpe:/a:matt_johnston:dropbear_ssh_server
 
 PKG_BUILD_PARALLEL:=1
 PKG_USE_MIPS16:=0
 
-PKG_CONFIG_DEPENDS:=CONFIG_DROPBEAR_ECC
+PKG_CONFIG_DEPENDS:= \
+       CONFIG_TARGET_INIT_PATH CONFIG_DROPBEAR_ECC \
+       CONFIG_DROPBEAR_CURVE25519 CONFIG_DROPBEAR_ZLIB \
+       CONFIG_DROPBEAR_UTMP CONFIG_DROPBEAR_PUTUTLINE
 
 include $(INCLUDE_DIR)/package.mk
 
+ifneq ($(DUMP),1)
+  STAMP_CONFIGURED:=$(strip $(STAMP_CONFIGURED))_$(shell echo $(CONFIG_TARGET_INIT_PATH) | mkhash md5)
+endif
+
 define Package/dropbear/Default
   URL:=http://matt.ucc.asn.au/dropbear/
 endef
@@ -40,6 +48,7 @@ define Package/dropbear
   SECTION:=net
   CATEGORY:=Base system
   TITLE:=Small SSH2 client/server
+  DEPENDS:= +DROPBEAR_ZLIB:zlib
 endef
 
 define Package/dropbear/description
@@ -48,7 +57,6 @@ endef
 
 define Package/dropbear/conffiles
 /etc/dropbear/dropbear_rsa_host_key
-/etc/dropbear/dropbear_dss_host_key 
 /etc/config/dropbear 
 endef
 
@@ -63,16 +71,15 @@ CONFIGURE_ARGS += \
        --disable-pam \
        --enable-openpty \
        --enable-syslog \
-       $(if $(CONFIG_SHADOW_PASSWORDS),,--disable-shadow) \
        --disable-lastlog \
-       --disable-utmp \
        --disable-utmpx \
+       $(if $(CONFIG_DROPBEAR_UTMP),,--disable-utmp) \
        --disable-wtmp \
        --disable-wtmpx \
        --disable-loginfunc \
-       --disable-pututline \
+       $(if $(CONFIG_DROPBEAR_PUTUTLINE),,--disable-pututline) \
        --disable-pututxline \
-       --disable-zlib \
+       $(if $(CONFIG_DROPBEAR_ZLIB),,--disable-zlib) \
        --enable-bundled-libtom
 
 TARGET_CFLAGS += -DARGTYPE=3 -ffunction-sections -fdata-sections
@@ -81,9 +88,19 @@ TARGET_LDFLAGS += -Wl,--gc-sections
 define Build/Configure
        $(Build/Configure/Default)
 
+       $(SED) 's,^#define DEFAULT_PATH .*$$$$,#define DEFAULT_PATH "$(TARGET_INIT_PATH)",g' \
+               $(PKG_BUILD_DIR)/options.h
+
+       awk 'BEGIN { rc = 1 } \
+            /'DROPBEAR_CURVE25519'/ { $$$$0 = "$(if $(CONFIG_DROPBEAR_CURVE25519),,// )#define 'DROPBEAR_CURVE25519'"; rc = 0 } \
+            { print } \
+            END { exit(rc) }' $(PKG_BUILD_DIR)/options.h \
+            >$(PKG_BUILD_DIR)/options.h.new && \
+       mv $(PKG_BUILD_DIR)/options.h.new $(PKG_BUILD_DIR)/options.h
+
        # Enforce that all replacements are made, otherwise options.h has changed
        # format and this logic is broken.
-       for OPTION in DROPBEAR_ECDSA DROPBEAR_ECDH DROPBEAR_CURVE25519; do \
+       for OPTION in DROPBEAR_ECDSA DROPBEAR_ECDH; do \
          awk 'BEGIN { rc = 1 } \
               /'$$$$OPTION'/ { $$$$0 = "$(if $(CONFIG_DROPBEAR_ECC),,// )#define '$$$$OPTION'"; rc = 0 } \
               { print } \
@@ -91,6 +108,13 @@ define Build/Configure
               >$(PKG_BUILD_DIR)/options.h.new && \
          mv $(PKG_BUILD_DIR)/options.h.new $(PKG_BUILD_DIR)/options.h || exit 1; \
        done
+
+       # remove protocol idented software version number
+       $(SED) 's,^#define LOCAL_IDENT .*$$$$,#define LOCAL_IDENT "SSH-2.0-dropbear",g' \
+               $(PKG_BUILD_DIR)/sysoptions.h
+
+       # Enforce rebuild of svr-chansession.c
+       rm -f $(PKG_BUILD_DIR)/svr-chansession.o
 endef
 
 define Build/Compile
@@ -107,10 +131,10 @@ define Package/dropbear/install
        $(INSTALL_DIR) $(1)/usr/sbin
        $(INSTALL_BIN) $(PKG_BUILD_DIR)/dropbearmulti $(1)/usr/sbin/dropbear
        $(INSTALL_DIR) $(1)/usr/bin
-       ln -sf ../sbin/dropbear $(1)/usr/bin/scp
-       ln -sf ../sbin/dropbear $(1)/usr/bin/ssh
-       ln -sf ../sbin/dropbear $(1)/usr/bin/dbclient
-       ln -sf ../sbin/dropbear $(1)/usr/bin/dropbearkey
+       $(LN) ../sbin/dropbear $(1)/usr/bin/scp
+       $(LN) ../sbin/dropbear $(1)/usr/bin/ssh
+       $(LN) ../sbin/dropbear $(1)/usr/bin/dbclient
+       $(LN) ../sbin/dropbear $(1)/usr/bin/dropbearkey
        $(INSTALL_DIR) $(1)/etc/config
        $(INSTALL_DATA) ./files/dropbear.config $(1)/etc/config/dropbear
        $(INSTALL_DIR) $(1)/etc/init.d
@@ -118,7 +142,6 @@ define Package/dropbear/install
        $(INSTALL_DIR) $(1)/usr/lib/opkg/info
        $(INSTALL_DIR) $(1)/etc/dropbear
        touch $(1)/etc/dropbear/dropbear_rsa_host_key
-       touch $(1)/etc/dropbear/dropbear_dss_host_key
 endef
 
 define Package/dropbearconvert/install