Bring the dropbear init script into sync with the systemd service
file (dropbearkey.service supports RSA host keys only) and with
recent versions of openssh which deprecate DSA host keys.
https://www.gentoo.org/support/news-items/2015-08-13-openssh-weak-keys.html
(From OE-Core rev: 6bd7341a38a8bb5387ea81dbccfed327370569f3)
Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Dropbear will use system versions of libtommath and libtomcrypt if
available. To make builds deterministic, add a PACKAGECONFIG option
to choose system libs or force use of the bundled versions.
Note that currently there are no libtommath or libtomcrypt recipes
in oe-core, so default to using the bundled versions.
(From OE-Core rev: b7c2edd2d6ded287d8b34dd047ae84d3fd69d4c6)
Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
To prevent build failures when using system libtom libraries and
linking with --as-needed, LIBTOM_LIBS should be in the order
-ltomcrypt -ltommath, not the other way around, ie libs should be
prepended to LIBTOM_LIBS as they are found, not appended.
Note that LIBTOM_LIBS is not used when linking with the bundled
libtom libs.
(From OE-Core rev: 62e96283fe77469e24e8df86c6c037c92009b00a)
Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This patch adds DROPBEAR_RSAKEY_ARGS and DROPBEAR_DSSKEY_ARGS optional
parameters to /etc/default/dropbear. The contents are simply passed to
the 'dropbearkey' program when generating a host key.
The default keysize for RSA is currently 2048 bits. It takes a CortexA9
running at 700MHz between 4 and 10 seconds to calculate a keypair. The
board boots Linux in about a second, but you have to wait for several
seconds because of the keypair generation. This patch allows one to put
the line DROPBEAR_RSAKEY_ARGS="-s 1024" into /etc/default/dropbear, and
have a host key generated in about 0.2 seconds on the same CPU. This is
particulary useful for read-only rootfs systems which generate a key on
each boot.
(From OE-Core rev: c0efbcb47ab37c2d9c298fcd40ecaadd3ca050a7)
Signed-off-by: Mike Looijmans <mike.looijmans@topic.nl>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016.73 -> 2016.74
(From OE-Core rev: 1513e77d3f7ea9910d6ac8aab7a2f38dd6c7cd24)
Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Enforce the correct tag names across all of oe-core for consistency.
(From OE-Core rev: 606a43dc38a00cc243f933722db657aea4129f8e)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Openssh now installs the sftp-server binary as /usr/libexec/sftp-server,
whereas the dropbear recipe assumes a different path.
Dropbear uses the correct path by default, so it's no longer necessary
to override SFTPSERVER_PATH via CFLAGS.
This fixes SFTP access to systems using dropbear as the SSH server.
(From OE-Core rev: df798bca330583103b2301678236cc841cc861dd)
Signed-off-by: Dominic Sacré <dominic.sacre@gmx.de>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Backport a patch to fix out-of-tree build.
(From OE-Core rev: b1613c946d1d6e5d7f5964e4d24f1d3146dfe39e)
Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The CFLAGS and LD tweaks in dropbear.inc date back to 2005/2006 and
whatever issue they worked around back then seems to have been fixed
in the latest versions of dropbear.
(From OE-Core rev: 4b17606fbca63a17cafbc285e3efe48c4c54a266)
Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015.71 - 3 December 2015
- Fix "bad buf_incrpos" when data is transferred, broke in 2015.69
- Fix crash on exit when -p address:port is used, broke in 2015.68
- Fix building with only ENABLE_CLI_REMOTETCPFWD given, patch from Konstantin Tokarev
- Fix bad configure script test which didn't work with dash shell, patch from Juergen Daubert,
broke in 2015.70
- Fix server race condition that could cause sessions to hang on exit,
https://github.com/robotframework/SSHLibrary/issues/128
(From OE-Core rev: d0658e0e9efcf2c995e92a61af0e5300ebcdce82)
Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Tweak a pam patch to make it apply on current source.
(From OE-Core rev: 9116a9346556837328a42059bd8af02ea17d081b)
Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
LICENSE checksum has changed because the copyright year was changed
from 2014 to 2015 in it:
19e1afbd1c
(From OE-Core rev: 30e791e9bb2e28119e74c22af742957fc470b2de)
Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 6733f760f7a581e30b783e41c62d1534d0f480d5)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Upgrade to upstream 2014.66; incorporates several minor bugfix
releases.
* LIC_FILES_CHKSUM changed because the copyright year changed; there was
no change to the license text itself.
(From OE-Core rev: 78f388e81cad5dfb6aea52da68f9b4523c88c5ad)
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
If pam distro feature enabled, dropbear will need below pam rpms
to work:
* libpam-runtime
* pam-plugin-deny
* pam-plugin-permit
* pam-plugin-unix
Just add the runtime dependencies explicitly.
(From OE-Core rev: dfbeb663e99f3280d055ec04454353f2082ced03)
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Add a brief subject mentioning what the patch is for
* Add Upstream-Status
(From OE-Core rev: ce01282b24c6715c85f8dfac6df3e750e77a50b8)
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The base_contains is kept as a compatibility method and we ought to
not use it in OE-Core so we can remove it from base metadata in
future.
(From OE-Core rev: d83b16dbf0862be387f84228710cb165c6d2b03b)
Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Drop 0002-static_build_fix.patch since an equivalent fix has been merged
upstream.
(From OE-Core rev: d5ff33a328a90abb6aae7c02bf119b53afdae5b7)
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This patch mainly comes from meta-systemd with a few modifications.
The purpose is to get rid of the LSB init scripts in systemd images.
[YOCTO #4420]
(From OE-Core rev: 5d90c5ebdb899b2951c97a94ff57867c1e491c15)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Patch application failed on the autobuilder for pam, this refresh of the
patch should resolve the build failure.
(From OE-Core rev: c4c5ec52effc2ff97ac17270c1aa7884c808f5a9)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
LIC_FILES_CHKSUM has changed with the introduction of a BSD-3-Clause
algorithm (curve25519-donna); this has prompted a re-evaluation of the
LICENSE value which should now reflect the licenses declared in the
upstream documentation. Thanks to Beth Flanagan for helping with this.
(From OE-Core rev: 232e8b96988ffa6e5107917fbf41222d26e4e90b)
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Using the contains function results in more optimal sstate checksums
resulting in better cache reuse as we as more consistent code.
(From OE-Core rev: 9c93526756e7cbbff027c88eb972f877bcb1f057)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
update to latest version 2013.60
Update 0006-dropbear-configuration-file.patch for 2013.60
(From OE-Core rev: 76e8b841d19789fe54ef650d6e8b42950fd27ceb)
Signed-off-by: Maxin B. John <maxin.john@enea.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The default value of SFTPSERVER_PATH is "/usr/libexec/sftp-server" defined in
dropbear-2013.58/option.h, but after commit 406bd38b423[bitbake.conf: change
libexecdir to ${libdir}/${BPN}], sftp-server is provided by openssh package,
and is installed into ${libdir}/openssh, so we pass it explicitly.
(From OE-Core rev: 5f6deb044226885912214532cebb1d871f03c53a)
Signed-off-by: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit fixes runtime hang of 'dropbearkey' utility, built for a x32
target abi system. The hang was observed while generating ssh keys, with
this command:
dropbearkey -t dss -f private
The issue is fixed by changing the code, where 'long' in x86_64 mode is
assumed as 64bit quantity. With the x32 abi, the processor is in x86_64
mode, but the 'long' is a 32bit quantity. Hence the fix uses 'long long'
instead of 'long' to define/access 64bit data variables.
Fixes bug:
[YOCTO #4496]
(From OE-Core rev: 8f5bc47729edb8cb051d81e9ff1680cb8d2eca25)
Signed-off-by: Nitin A Kamble <nitin.a.kamble@intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
- patches updated
- nopw-option.patch dropped as the option is integrated since 2013.56
- compile tested for ARMv5 target
(From OE-Core rev: ce92c707f26aff8f02021c757056af4ecddb315d)
Signed-off-by: Eric Bénard <eric@eukrea.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Blank password option patch has now been accepted upstream.
(From OE-Core rev: cfcd31e1ccee27fd46c830c01541c77298a13af4)
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Old init script killed all dropbear processes when doing stop/restart
including open SSH sessions which is very annoying.
(From OE-Core rev: 97aa5ac2df7593e343d82f5e64a422bb951eacf9)
Signed-off-by: Roman I Khimov <khimov@altell.ru>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Dropbear does not start when the host key is empty and it is possible
that a device is switched off before the host key is generated. This
is possible because the dropbearkey code doesn't create a temporary
file first. Detect truncated keys and then remove them which will lead
to the re-generation. This way the dropbear process will always start.
(From OE-Core rev: 16b57e352f5844f301cc6c7ea4f87bf750c11d67)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Instead of using IMAGE_FEATURES to control something within a recipe,
allow this to be set at runtime, avoiding the need to rebuild dropbear
when we want to change this option.
First half of the fix for [YOCTO #2578].
(From OE-Core rev: 313039590171456b652fa7a2f5823c9b7060b20f)
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Re-running the debug_patch task would cause the build to fail. This patch
moves the extra patch handling directly into SRC_URI and removes the need
for the separate task, allowing safe re-execution of each task.
[YOCTO #2194]
(From OE-Core rev: 1d6156e37ef0f36cf5ce8eeaaf23560215c86833)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This new version added ALLOW_BLANK_PASSWORD option. So change the allow-nopw.patch content to enable this function.
(From OE-Core rev: e876096fcbb42039d568a7acbc506e4099e9a443)
Signed-off-by: Mei Lei <lei.mei@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: f1710d09e447b0f71a55b4ef24673c6388a045ad)
Signed-off-by: Mei Lei <lei.mei@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
dropbear will check "/etc/pam.d/sshd" which comes from package "openssh" \
When enabling pam supporting. But if we only install dropbear \
package without package "openssh", then "dropbear" will not \
find a configuration file.
The changes are as follow for fixing this bug:
- Change the path to find configuration file (/etc/pam.d/sshd --> /etc/pam.d/dropbear)
- Add a configuration file "/etc/pam.d/dropbear"
(From OE-Core rev: 48dcb8fc7b669b27160dde33079f40551853702b)
Signed-off-by: Xiaofeng Yan <xiaofeng.yan@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
I make a patch and some changes in dropbear.inc for supporting pam.
- Enable pam in configure
- Modify file option.h to open pam supporting
(From OE-Core rev: e8f19e8616fb1b0c2d977fb63eaa64f504fb774b)
Signed-off-by: Xiaofeng Yan <xiaofeng.yan@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The long term solution is to remove the IMAGE_FEATURE check since images are not allowed to influence recipe compile options.
(From OE-Core rev: 1c24f36e982e680871bf7a05ac6e820314e19c7c)
Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Nothing in the system actually uses the PROVIDES field for these
recipes, its usually the runtime packages that are used. We can
therefore remove the PROVIDES and hence quieten the associated
warnings from bitbake.
If these recipes do really need the PROVIDES, they would be better
as virtuals and adding that to MULTI_PROVIDER_WHITELIST.
(From OE-Core rev: 84f3ae92ab4345cc99b47e021ff960857f803d45)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
We need to avoid applying a patch in configure, because a rebuild could
trigger this, without triggering do_patch.
(From OE-Core rev: 16fbdaa24fd4add37c1e873505f55bcef5695a94)
Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Andre McCurdy
Peter Kjellerstedt
Mike Looijmans
Maxin B. John
Ross Burton
Dominic Sacré
Jussi Kukkonen
Alexander Kanavin
Robert Yang
Paul Eggleton
Wenzong Fan
Matthieu Crapet
Otavio Salvador
Chen Qi
Richard Purdie
Maxin B. John
Roy Li
Nitin A Kamble
Eric Bénard
Roman I Khimov
Martin Jansa
Holger Hans Peter Freyther
Mark Hatle
Steffen Sledz
Shane Wang
Saul Wold
Mei Lei
Koen Kooi
Xiaofeng Yan
Qing He