[LEDE-DEV] [PATCH] dropbear: bump to 2018.76
Hauke Mehrtens
hauke at hauke-m.de
Sat Apr 28 06:47:07 PDT 2018
On 04/27/2018 05:58 PM, Koen Vandeputte wrote:
> Config moved from option.h to localoptions.h
> refreshed all patches
>
> deleted upstreamed patches:
> - 010-runtime-maxauthtries.patch
> - 610-skip-default-keys-in-custom-runs.patch
>
> introduced new patch:
> - 610-disable-ec-by-default.patch
>
> This patch adds the EC definitions which are altered by the Makefile when
> (de)selecting EC options.
>
> Tested on both LE (arm) and BE (mips) architectures.
> Tested with all dropbear menuoptions on/off
Please post the size of the binary and the ipkg with and without this patch.
I think it compiles the math library by default with O2 or O3 and not
with Os can you check this too please.
Hauke
>
> Signed-off-by: Koen Vandeputte <koen.vandeputte at ncentric.com>
> ---
> package/network/services/dropbear/Makefile | 28 ++---
> .../patches/010-runtime-maxauthtries.patch | 130 ---------------------
> .../dropbear/patches/100-pubkey_path.patch | 28 +++--
> .../dropbear/patches/110-change_user.patch | 2 +-
> .../dropbear/patches/120-openwrt_options.patch | 94 ++-------------
> .../dropbear/patches/130-ssh_ignore_x_args.patch | 4 +-
> .../patches/150-dbconvert_standalone.patch | 21 ++--
> .../patches/600-allow-blank-root-password.patch | 2 +-
> .../patches/610-disable-ec-by-default.patch | 10 ++
> .../610-skip-default-keys-in-custom-runs.patch | 18 ---
> 10 files changed, 62 insertions(+), 275 deletions(-)
> delete mode 100644 package/network/services/dropbear/patches/010-runtime-maxauthtries.patch
> create mode 100644 package/network/services/dropbear/patches/610-disable-ec-by-default.patch
> delete mode 100644 package/network/services/dropbear/patches/610-skip-default-keys-in-custom-runs.patch
>
> diff --git a/package/network/services/dropbear/Makefile b/package/network/services/dropbear/Makefile
> index 21ac09f72452..e89043531f78 100644
> --- a/package/network/services/dropbear/Makefile
> +++ b/package/network/services/dropbear/Makefile
> @@ -8,14 +8,14 @@
> include $(TOPDIR)/rules.mk
>
> PKG_NAME:=dropbear
> -PKG_VERSION:=2017.75
> -PKG_RELEASE:=5
> +PKG_VERSION:=2018.76
> +PKG_RELEASE:=1
>
> PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
> PKG_SOURCE_URL:= \
> http://matt.ucc.asn.au/dropbear/releases/ \
> https://dropbear.nl/mirror/releases/
> -PKG_HASH:=6cbc1dcb1c9709d226dff669e5604172a18cf5dbf9a201474d5618ae4465098c
> +PKG_HASH:=f2fb9167eca8cf93456a5fc1d4faf709902a3ab70dd44e352f3acbc3ffdaea65
>
> PKG_LICENSE:=MIT
> PKG_LICENSE_FILES:=LICENSE libtomcrypt/LICENSE libtommath/LICENSE
> @@ -57,7 +57,7 @@ endef
>
> define Package/dropbear/conffiles
> /etc/dropbear/dropbear_rsa_host_key
> -/etc/config/dropbear
> +/etc/config/dropbear
> endef
>
> define Package/dropbearconvert
> @@ -89,24 +89,24 @@ define Build/Configure
> $(Build/Configure/Default)
>
> $(SED) 's,^#define DEFAULT_PATH .*$$$$,#define DEFAULT_PATH "$(TARGET_INIT_PATH)",g' \
> - $(PKG_BUILD_DIR)/options.h
> + $(PKG_BUILD_DIR)/default_options.h
>
> awk 'BEGIN { rc = 1 } \
> - /'DROPBEAR_CURVE25519'/ { $$$$0 = "$(if $(CONFIG_DROPBEAR_CURVE25519),,// )#define 'DROPBEAR_CURVE25519'"; rc = 0 } \
> + /'DROPBEAR_CURVE25519'/ { $$$$0 = "$(if $(CONFIG_DROPBEAR_CURVE25519),#define 'DROPBEAR_CURVE25519' 1,#define 'DROPBEAR_CURVE25519' 0)"; rc = 0 } \
> { print } \
> - END { exit(rc) }' $(PKG_BUILD_DIR)/options.h \
> - >$(PKG_BUILD_DIR)/options.h.new && \
> - mv $(PKG_BUILD_DIR)/options.h.new $(PKG_BUILD_DIR)/options.h
> + END { exit(rc) }' $(PKG_BUILD_DIR)/localoptions.h \
> + >$(PKG_BUILD_DIR)/localoptions.h.new && \
> + mv $(PKG_BUILD_DIR)/localoptions.h.new $(PKG_BUILD_DIR)/localoptions.h
>
> - # Enforce that all replacements are made, otherwise options.h has changed
> + # Enforce that all replacements are made, otherwise localoptions.h has changed
> # format and this logic is broken.
> for OPTION in DROPBEAR_ECDSA DROPBEAR_ECDH; do \
> awk 'BEGIN { rc = 1 } \
> - /'$$$$OPTION'/ { $$$$0 = "$(if $(CONFIG_DROPBEAR_ECC),,// )#define '$$$$OPTION'"; rc = 0 } \
> + /'$$$$OPTION'/ { $$$$0 = "$(if $(CONFIG_DROPBEAR_ECC),#define '$$$$OPTION' 1,#define '$$$$OPTION' 0)"; rc = 0 } \
> { print } \
> - END { exit(rc) }' $(PKG_BUILD_DIR)/options.h \
> - >$(PKG_BUILD_DIR)/options.h.new && \
> - mv $(PKG_BUILD_DIR)/options.h.new $(PKG_BUILD_DIR)/options.h || exit 1; \
> + END { exit(rc) }' $(PKG_BUILD_DIR)/localoptions.h \
> + >$(PKG_BUILD_DIR)/localoptions.h.new && \
> + mv $(PKG_BUILD_DIR)/localoptions.h.new $(PKG_BUILD_DIR)/localoptions.h || exit 1; \
> done
>
> # remove protocol idented software version number
> diff --git a/package/network/services/dropbear/patches/010-runtime-maxauthtries.patch b/package/network/services/dropbear/patches/010-runtime-maxauthtries.patch
> deleted file mode 100644
> index 26db3181f2d8..000000000000
> --- a/package/network/services/dropbear/patches/010-runtime-maxauthtries.patch
> +++ /dev/null
> @@ -1,130 +0,0 @@
> -From 46b22e57d91e33a591d0fba97da52672af4d6ed2 Mon Sep 17 00:00:00 2001
> -From: Kevin Darbyshire-Bryant <kevin at darbyshire-bryant.me.uk>
> -Date: Mon, 29 May 2017 10:25:09 +0100
> -Subject: [PATCH] dropbear server: support -T max auth tries
> -
> -Add support for '-T n' for a run-time specification for maximum number
> -of authentication attempts where 'n' is between 1 and compile time
> -option MAX_AUTH_TRIES.
> -
> -A default number of tries can be specified at compile time using
> -'DEFAULT_AUTH_TRIES' which itself defaults to MAX_AUTH_TRIES for
> -backwards compatibility.
> -
> -Signed-off-by: Kevin Darbyshire-Bryant <kevin at darbyshire-bryant.me.uk>
> ----
> - options.h | 7 +++++++
> - runopts.h | 1 +
> - svr-auth.c | 2 +-
> - svr-runopts.c | 17 +++++++++++++++++
> - 4 files changed, 26 insertions(+), 1 deletion(-)
> -
> -diff --git a/options.h b/options.h
> -index 0c51bb1..4d22704 100644
> ---- a/options.h
> -+++ b/options.h
> -@@ -284,6 +284,13 @@ Homedir is prepended unless path begins with / */
> - #define MAX_AUTH_TRIES 10
> - #endif
> -
> -+/* Default maximum number of failed authentication tries.
> -+ * defaults to MAX_AUTH_TRIES */
> -+
> -+#ifndef DEFAULT_AUTH_TRIES
> -+#define DEFAULT_AUTH_TRIES MAX_AUTH_TRIES
> -+#endif
> -+
> - /* The default file to store the daemon's process ID, for shutdown
> - scripts etc. This can be overridden with the -P flag */
> - #ifndef DROPBEAR_PIDFILE
> -diff --git a/runopts.h b/runopts.h
> -index f7c869d..2f7da63 100644
> ---- a/runopts.h
> -+++ b/runopts.h
> -@@ -96,6 +96,7 @@ typedef struct svr_runopts {
> - int noauthpass;
> - int norootpass;
> - int allowblankpass;
> -+ unsigned int maxauthtries;
> -
> - #ifdef ENABLE_SVR_REMOTETCPFWD
> - int noremotetcp;
> -diff --git a/svr-auth.c b/svr-auth.c
> -index 577ea88..6a7ce0b 100644
> ---- a/svr-auth.c
> -+++ b/svr-auth.c
> -@@ -362,7 +362,7 @@ void send_msg_userauth_failure(int partial, int incrfail) {
> - ses.authstate.failcount++;
> - }
> -
> -- if (ses.authstate.failcount >= MAX_AUTH_TRIES) {
> -+ if (ses.authstate.failcount >= svr_opts.maxauthtries) {
> - char * userstr;
> - /* XXX - send disconnect ? */
> - TRACE(("Max auth tries reached, exiting"))
> -diff --git a/svr-runopts.c b/svr-runopts.c
> -index 8f60059..1e7440f 100644
> ---- a/svr-runopts.c
> -+++ b/svr-runopts.c
> -@@ -73,6 +73,7 @@ static void printhelp(const char * progname) {
> - "-g Disable password logins for root\n"
> - "-B Allow blank password logins\n"
> - #endif
> -+ "-T <1 to %d> Maximum authentication tries (default %d)\n"
> - #ifdef ENABLE_SVR_LOCALTCPFWD
> - "-j Disable local port forwarding\n"
> - #endif
> -@@ -106,6 +107,7 @@ static void printhelp(const char * progname) {
> - #ifdef DROPBEAR_ECDSA
> - ECDSA_PRIV_FILENAME,
> - #endif
> -+ MAX_AUTH_TRIES, DEFAULT_AUTH_TRIES,
> - DROPBEAR_MAX_PORTS, DROPBEAR_DEFPORT, DROPBEAR_PIDFILE,
> - DEFAULT_RECV_WINDOW, DEFAULT_KEEPALIVE, DEFAULT_IDLE_TIMEOUT);
> - }
> -@@ -118,6 +120,7 @@ void svr_getopts(int argc, char ** argv) {
> - char* recv_window_arg = NULL;
> - char* keepalive_arg = NULL;
> - char* idle_timeout_arg = NULL;
> -+ char* maxauthtries_arg = NULL;
> - char* keyfile = NULL;
> - char c;
> -
> -@@ -130,6 +133,7 @@ void svr_getopts(int argc, char ** argv) {
> - svr_opts.noauthpass = 0;
> - svr_opts.norootpass = 0;
> - svr_opts.allowblankpass = 0;
> -+ svr_opts.maxauthtries = DEFAULT_AUTH_TRIES;
> - svr_opts.inetdmode = 0;
> - svr_opts.portcount = 0;
> - svr_opts.hostkey = NULL;
> -@@ -234,6 +238,9 @@ void svr_getopts(int argc, char ** argv) {
> - case 'I':
> - next = &idle_timeout_arg;
> - break;
> -+ case 'T':
> -+ next = &maxauthtries_arg;
> -+ break;
> - #if defined(ENABLE_SVR_PASSWORD_AUTH) || defined(ENABLE_SVR_PAM_AUTH)
> - case 's':
> - svr_opts.noauthpass = 1;
> -@@ -330,6 +337,16 @@ void svr_getopts(int argc, char ** argv) {
> - dropbear_exit("Bad recv window '%s'", recv_window_arg);
> - }
> - }
> -+
> -+ if (maxauthtries_arg) {
> -+ unsigned int val = 0;
> -+ if (m_str_to_uint(maxauthtries_arg, &val) == DROPBEAR_FAILURE ||
> -+ val == 0 || val > MAX_AUTH_TRIES) {
> -+ dropbear_exit("Bad maxauthtries '%s'", maxauthtries_arg);
> -+ }
> -+ svr_opts.maxauthtries = val;
> -+ }
> -+
> -
> - if (keepalive_arg) {
> - unsigned int val;
> ---
> -2.7.4
> -
> diff --git a/package/network/services/dropbear/patches/100-pubkey_path.patch b/package/network/services/dropbear/patches/100-pubkey_path.patch
> index 401c7e1ba564..6672b7633fe7 100644
> --- a/package/network/services/dropbear/patches/100-pubkey_path.patch
> +++ b/package/network/services/dropbear/patches/100-pubkey_path.patch
> @@ -1,6 +1,6 @@
> --- a/svr-authpubkey.c
> +++ b/svr-authpubkey.c
> -@@ -220,14 +220,20 @@ static int checkpubkey(char* algo, unsig
> +@@ -320,14 +320,20 @@ static int checkpubkey(const char* algo,
> goto out;
> }
>
> @@ -29,7 +29,7 @@
>
> /* open the file as the authenticating user. */
> origuid = getuid();
> -@@ -396,26 +402,35 @@ static int checkpubkeyperms() {
> +@@ -404,26 +410,35 @@ static int checkpubkeyperms() {
> goto out;
> }
>
> @@ -42,17 +42,6 @@
> - if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
> - goto out;
> - }
> --
> -- /* check ~/.ssh */
> -- strncat(filename, "/.ssh", 5); /* strlen("/.ssh") == 5 */
> -- if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
> -- goto out;
> -- }
> --
> -- /* now check ~/.ssh/authorized_keys */
> -- strncat(filename, "/authorized_keys", 16);
> -- if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
> -- goto out;
> + if (ses.authstate.pw_uid == 0) {
> + if (checkfileperm("/etc/dropbear") != DROPBEAR_SUCCESS) {
> + goto out;
> @@ -70,13 +59,22 @@
> + if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
> + goto out;
> + }
> -+
> +
> +- /* check ~/.ssh */
> +- strncat(filename, "/.ssh", 5); /* strlen("/.ssh") == 5 */
> +- if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
> +- goto out;
> +- }
> + /* check ~/.ssh */
> + strncat(filename, "/.ssh", 5); /* strlen("/.ssh") == 5 */
> + if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
> + goto out;
> + }
> -+
> +
> +- /* now check ~/.ssh/authorized_keys */
> +- strncat(filename, "/authorized_keys", 16);
> +- if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
> +- goto out;
> + /* now check ~/.ssh/authorized_keys */
> + strncat(filename, "/authorized_keys", 16);
> + if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
> diff --git a/package/network/services/dropbear/patches/110-change_user.patch b/package/network/services/dropbear/patches/110-change_user.patch
> index 4b5c1cb51bb1..5f0c5a99161a 100644
> --- a/package/network/services/dropbear/patches/110-change_user.patch
> +++ b/package/network/services/dropbear/patches/110-change_user.patch
> @@ -1,6 +1,6 @@
> --- a/svr-chansession.c
> +++ b/svr-chansession.c
> -@@ -922,12 +922,12 @@ static void execchild(void *user_data) {
> +@@ -935,12 +935,12 @@ static void execchild(const void *user_d
> /* We can only change uid/gid as root ... */
> if (getuid() == 0) {
>
> diff --git a/package/network/services/dropbear/patches/120-openwrt_options.patch b/package/network/services/dropbear/patches/120-openwrt_options.patch
> index 7f47a7430479..b35c0398fdb3 100644
> --- a/package/network/services/dropbear/patches/120-openwrt_options.patch
> +++ b/package/network/services/dropbear/patches/120-openwrt_options.patch
> @@ -1,82 +1,12 @@
> ---- a/options.h
> -+++ b/options.h
> -@@ -41,7 +41,7 @@
> - * Both of these flags can be defined at once, don't compile without at least
> - * one of them. */
> - #define NON_INETD_MODE
> --#define INETD_MODE
> -+/*#define INETD_MODE*/
> -
> - /* Setting this disables the fast exptmod bignum code. It saves ~5kB, but is
> - * perhaps 20% slower for pubkey operations (it is probably worth experimenting
> -@@ -81,7 +81,7 @@ much traffic. */
> -
> - /* Enable "Netcat mode" option. This will forward standard input/output
> - * to a remote TCP-forwarded connection */
> --#define ENABLE_CLI_NETCAT
> -+/*#define ENABLE_CLI_NETCAT*/
> -
> - /* Whether to support "-c" and "-m" flags to choose ciphers/MACs at runtime */
> - #define ENABLE_USER_ALGO_LIST
> -@@ -91,16 +91,16 @@ much traffic. */
> - * Including multiple keysize variants the same cipher
> - * (eg AES256 as well as AES128) will result in a minimal size increase.*/
> - #define DROPBEAR_AES128
> --#define DROPBEAR_3DES
> -+/*#define DROPBEAR_3DES*/
> - #define DROPBEAR_AES256
> - /* Compiling in Blowfish will add ~6kB to runtime heap memory usage */
> - /*#define DROPBEAR_BLOWFISH*/
> --#define DROPBEAR_TWOFISH256
> --#define DROPBEAR_TWOFISH128
> -+/*#define DROPBEAR_TWOFISH256*/
> -+/*#define DROPBEAR_TWOFISH128*/
> -
> - /* Enable CBC mode for ciphers. This has security issues though
> - * is the most compatible with older SSH implementations */
> --#define DROPBEAR_ENABLE_CBC_MODE
> -+/*#define DROPBEAR_ENABLE_CBC_MODE*/
> -
> - /* Enable "Counter Mode" for ciphers. This is more secure than normal
> - * CBC mode against certain attacks. It is recommended for security
> -@@ -131,10 +131,10 @@ If you test it please contact the Dropbe
> - * If you disable MD5, Dropbear will fall back to SHA1 fingerprints,
> - * which are not the standard form. */
> - #define DROPBEAR_SHA1_HMAC
> --#define DROPBEAR_SHA1_96_HMAC
> -+/*#define DROPBEAR_SHA1_96_HMAC*/
> - #define DROPBEAR_SHA2_256_HMAC
> --#define DROPBEAR_SHA2_512_HMAC
> --#define DROPBEAR_MD5_HMAC
> -+/*#define DROPBEAR_SHA2_512_HMAC*/
> -+/*#define DROPBEAR_MD5_HMAC*/
> -
> - /* You can also disable integrity. Don't bother disabling this if you're
> - * still using a cipher, it's relatively cheap. If you disable this it's dead
> -@@ -146,7 +146,7 @@ If you test it please contact the Dropbe
> - * Removing either of these won't save very much space.
> - * SSH2 RFC Draft requires dss, recommends rsa */
> - #define DROPBEAR_RSA
> --#define DROPBEAR_DSS
> -+/*#define DROPBEAR_DSS*/
> - /* ECDSA is significantly faster than RSA or DSS. Compiling in ECC
> - * code (either ECDSA or ECDH) increases binary size - around 30kB
> - * on x86-64 */
> -@@ -194,7 +194,7 @@ If you test it please contact the Dropbe
> -
> - /* Whether to print the message of the day (MOTD). This doesn't add much code
> - * size */
> --#define DO_MOTD
> -+/*#define DO_MOTD*/
> -
> - /* The MOTD file path */
> - #ifndef MOTD_FILENAME
> -@@ -242,7 +242,7 @@ Homedir is prepended unless path begins
> - * note that it will be provided for all "hidden" client-interactive
> - * style prompts - if you want something more sophisticated, use
> - * SSH_ASKPASS instead. Comment out this var to remove this functionality.*/
> --#define DROPBEAR_PASSWORD_ENV "DROPBEAR_PASSWORD"
> -+/*#define DROPBEAR_PASSWORD_ENV "DROPBEAR_PASSWORD"*/
> -
> - /* Define this (as well as ENABLE_CLI_PASSWORD_AUTH) to allow the use of
> - * a helper program for the ssh client. The helper program should be
> +--- /dev/null
> ++++ b/localoptions.h
> +@@ -0,0 +1,9 @@
> ++/* OpenWrt defined options */
> ++
> ++#define INETD_MODE 0
> ++#define ENABLE_CLI_NETCAT 0
> ++#define DROPBEAR_3DES 0
> ++#define DROPBEAR_ENABLE_CBC_MODE 0
> ++#define DROPBEAR_SHA1_96_HMAC 0
> ++#define DROPBEAR_DSS 0
> ++#define DROPBEAR_USE_PASSWORD_ENV 0
> diff --git a/package/network/services/dropbear/patches/130-ssh_ignore_x_args.patch b/package/network/services/dropbear/patches/130-ssh_ignore_x_args.patch
> index ab09c2f3dc3a..5e736320cc75 100644
> --- a/package/network/services/dropbear/patches/130-ssh_ignore_x_args.patch
> +++ b/package/network/services/dropbear/patches/130-ssh_ignore_x_args.patch
> @@ -1,6 +1,6 @@
> --- a/cli-runopts.c
> +++ b/cli-runopts.c
> -@@ -296,6 +296,8 @@ void cli_getopts(int argc, char ** argv)
> +@@ -299,6 +299,8 @@ void cli_getopts(int argc, char ** argv)
> debug_trace = 1;
> break;
> #endif
> @@ -8,4 +8,4 @@
> + break;
> case 'F':
> case 'e':
> - #ifndef ENABLE_USER_ALGO_LIST
> + #if !DROPBEAR_USER_ALGO_LIST
> diff --git a/package/network/services/dropbear/patches/150-dbconvert_standalone.patch b/package/network/services/dropbear/patches/150-dbconvert_standalone.patch
> index ccc2cb792598..974b440d49f6 100644
> --- a/package/network/services/dropbear/patches/150-dbconvert_standalone.patch
> +++ b/package/network/services/dropbear/patches/150-dbconvert_standalone.patch
> @@ -1,14 +1,11 @@
> ---- a/options.h
> -+++ b/options.h
> -@@ -5,6 +5,11 @@
> - #ifndef DROPBEAR_OPTIONS_H_
> - #define DROPBEAR_OPTIONS_H_
> -
> +--- a/localoptions.h
> ++++ b/localoptions.h
> +@@ -7,3 +7,8 @@
> + #define DROPBEAR_SHA1_96_HMAC 0
> + #define DROPBEAR_DSS 0
> + #define DROPBEAR_USE_PASSWORD_ENV 0
> ++
> +#if !defined(DROPBEAR_CLIENT) && !defined(DROPBEAR_SERVER)
> -+#define DROPBEAR_SERVER
> -+#define DROPBEAR_CLIENT
> ++ #define DROPBEAR_SERVER 1
> ++ #define DROPBEAR_CLIENT 1
> +#endif
> -+
> - /* Define compile-time options below - the "#ifndef DROPBEAR_XXX .... #endif"
> - * parts are to allow for commandline -DDROPBEAR_XXX options etc. */
> -
> diff --git a/package/network/services/dropbear/patches/600-allow-blank-root-password.patch b/package/network/services/dropbear/patches/600-allow-blank-root-password.patch
> index 7c67b086bbac..223c94767a02 100644
> --- a/package/network/services/dropbear/patches/600-allow-blank-root-password.patch
> +++ b/package/network/services/dropbear/patches/600-allow-blank-root-password.patch
> @@ -1,6 +1,6 @@
> --- a/svr-auth.c
> +++ b/svr-auth.c
> -@@ -149,7 +149,7 @@ void recv_msg_userauth_request() {
> +@@ -122,7 +122,7 @@ void recv_msg_userauth_request() {
> AUTH_METHOD_NONE_LEN) == 0) {
> TRACE(("recv_msg_userauth_request: 'none' request"))
> if (valid_user
> diff --git a/package/network/services/dropbear/patches/610-disable-ec-by-default.patch b/package/network/services/dropbear/patches/610-disable-ec-by-default.patch
> new file mode 100644
> index 000000000000..cb9761b73506
> --- /dev/null
> +++ b/package/network/services/dropbear/patches/610-disable-ec-by-default.patch
> @@ -0,0 +1,10 @@
> +--- a/localoptions.h
> ++++ b/localoptions.h
> +@@ -12,3 +12,7 @@
> + #define DROPBEAR_SERVER 1
> + #define DROPBEAR_CLIENT 1
> + #endif
> ++
> ++#define DROPBEAR_CURVE25519 0
> ++#define DROPBEAR_ECDSA 0
> ++#define DROPBEAR_ECDH 0
> diff --git a/package/network/services/dropbear/patches/610-skip-default-keys-in-custom-runs.patch b/package/network/services/dropbear/patches/610-skip-default-keys-in-custom-runs.patch
> deleted file mode 100644
> index a555a9e49856..000000000000
> --- a/package/network/services/dropbear/patches/610-skip-default-keys-in-custom-runs.patch
> +++ /dev/null
> @@ -1,18 +0,0 @@
> ---- a/svr-runopts.c
> -+++ b/svr-runopts.c
> -@@ -505,6 +505,7 @@ void load_all_hostkeys() {
> - m_free(hostkey_file);
> - }
> -
> -+ if (svr_opts.num_hostkey_files <= 0) {
> - #ifdef DROPBEAR_RSA
> - loadhostkey(RSA_PRIV_FILENAME, 0);
> - #endif
> -@@ -516,6 +517,7 @@ void load_all_hostkeys() {
> - #ifdef DROPBEAR_ECDSA
> - loadhostkey(ECDSA_PRIV_FILENAME, 0);
> - #endif
> -+ }
> -
> - #ifdef DROPBEAR_DELAY_HOSTKEY
> - if (svr_opts.delay_hostkey) {
>
More information about the Lede-dev
mailing list