dropbear: update to 2022.83, remove custom patch. Use /root/.authorized_keys now

4 files changed, 6 insertions, 157 deletions

diff --git a/package/dropbear/Makefile b/package/dropbear/Makefile
index 93ec5e548..8f12d4cf4 100644
--- a/package/dropbear/Makefile
+++ b/package/dropbear/Makefile
@@ -4,9 +4,9 @@
 include $(ADK_TOPDIR)/rules.mk
 
 PKG_NAME:=		dropbear
-PKG_VERSION:=		2020.81
-PKG_RELEASE:=		4
-PKG_HASH:=		48235d10b37775dbda59341ac0c4b239b82ad6318c31568b985730c788aac53b
+PKG_VERSION:=		2022.83
+PKG_RELEASE:=		1
+PKG_HASH:=		bc5a121ffbc94b5171ad5ebe01be42746d50aa797c9549a4639894a16749443b
 PKG_DESCR:=		ssh server/client designed for embedded systems
 PKG_SECTION:=		net/security
 PKG_URL:=		http://matt.ucc.asn.au/dropbear/
@@ -39,6 +39,7 @@ CONFIGURE_ARGS+=	--disable-pam \
 			--disable-wtmpx \
 			--disable-loginfunc \
 			--disable-pututxline \
+			--disable-harden \
 			--disable-zlib
 ifeq (${ADK_PACKAGE_DROPBEAR_WITH_UTMP},)
 CONFIGURE_ARGS+=	--disable-utmp --disable-pututline
@@ -75,9 +76,9 @@ do-install:
 		$(IDIR_DBCONVERT)/usr/bin/dropbearconvert
 	# ssh pubkey
 	test -z $(ADK_RUNTIME_SSH_PUBKEY) || ( \
-		$(INSTALL_DIR) $(IDIR_DROPBEAR)/etc/dropbear; \
+		$(INSTALL_DIR) $(IDIR_DROPBEAR)/root; \
 		echo $(ADK_RUNTIME_SSH_PUBKEY) \
-		>$(IDIR_DROPBEAR)/etc/dropbear/authorized_keys; \
+		>$(IDIR_DROPBEAR)/root/.authorized_keys; \
         )
 
 include ${ADK_TOPDIR}/mk/pkg-bottom.mk
diff --git a/package/dropbear/files/dropbear.init b/package/dropbear/files/dropbear.init
index 15bb561df..3e464e34b 100644
--- a/package/dropbear/files/dropbear.init
+++ b/package/dropbear/files/dropbear.init
@@ -24,14 +24,6 @@ start)
 		test $rv = 0 || exit 1
 		test -f /etc/dropbear/dropbear_rsa_host_key || exit 1
 	fi
-	if test ! -f /etc/dropbear/dropbear_dss_host_key; then
-		# take it easy here, since above already catched the worst cases
-		if test -x /usr/bin/dropbearkey; then
-			echo "dropbear: generating SSH private key (DSS)"
-			/usr/bin/dropbearkey -f /etc/dropbear/dropbear_dss_host_key -t dss
-			echo "dropbear: key generation exited with code $?"
-		fi
-	fi
 	if test ! -f /etc/dropbear/dropbear_ecdsa_host_key; then
 		# take it easy here, since above already catched the worst cases
 		if test -x /usr/bin/dropbearkey; then
diff --git a/package/dropbear/patches/patch-Makefile_in b/package/dropbear/patches/patch-Makefile_in
deleted file mode 100644
index b0b77949a..000000000
--- a/package/dropbear/patches/patch-Makefile_in
+++ /dev/null
@@ -1,35 +0,0 @@
---- dropbear-2020.81.orig/Makefile.in	2020-10-29 14:35:50.000000000 +0100
-+++ dropbear-2020.81/Makefile.in	2020-11-04 03:02:49.901343218 +0100
-@@ -106,10 +106,10 @@ AR=@AR@
- RANLIB=@RANLIB@
- STRIP=@STRIP@
- INSTALL=@INSTALL@
--CPPFLAGS=@CPPFLAGS@
--CFLAGS+=-I. -I$(srcdir) $(CPPFLAGS) @CFLAGS@
--LIBS+=@LIBS@
--LDFLAGS=@LDFLAGS@
-+CPPFLAGS=@CPPFLAGS@ -I. -I$(srcdir)
-+LIBS+=@LIBS@ @CRYPTLIB@
-+LDFLAGS+=@LDFLAGS@
-+
- 
- EXEEXT=@EXEEXT@
- 
-@@ -198,7 +198,7 @@ dropbearkey: $(dropbearkeyobjs)
- dropbearconvert: $(dropbearconvertobjs)
- 
- dropbear: $(HEADERS) $(LIBTOM_DEPS) Makefile
--	$(CC) $(LDFLAGS) -o $@$(EXEEXT) $($@objs) $(LIBTOM_LIBS) $(LIBS) @CRYPTLIB@ $(PLUGIN_LIBS)
-+	$(CC) $(LDFLAGS) -o $@$(EXEEXT) $($@objs) $(LIBTOM_LIBS) $(LIBS) $(PLUGIN_LIBS)
- 
- dbclient: $(HEADERS) $(LIBTOM_DEPS) Makefile
- 	$(CC) $(LDFLAGS) -o $@$(EXEEXT) $($@objs) $(LIBTOM_LIBS) $(LIBS)
-@@ -219,7 +219,7 @@ ifeq ($(MULTI),1)
- endif
- 
- dropbearmulti$(EXEEXT): $(HEADERS) $(MULTIOBJS) $(LIBTOM_DEPS) Makefile
--	$(CC) $(LDFLAGS) -o $@ $(MULTIOBJS) $(LIBTOM_LIBS) $(LIBS) @CRYPTLIB@
-+	$(CC) $(LDFLAGS) -o $@ $(MULTIOBJS) $(LIBTOM_LIBS) $(LIBS)
- 
- multibinary: dropbearmulti$(EXEEXT)
- 
diff --git a/package/dropbear/patches/patch-svr-authpubkey_c b/package/dropbear/patches/patch-svr-authpubkey_c
deleted file mode 100644
index f3df0c58f..000000000
--- a/package/dropbear/patches/patch-svr-authpubkey_c
+++ /dev/null
@@ -1,109 +0,0 @@
---- dropbear-2020.81.orig/svr-authpubkey.c	2020-10-29 14:35:50.000000000 +0100
-+++ dropbear-2020.81/svr-authpubkey.c	2020-11-04 03:14:22.641017199 +0100
-@@ -386,26 +386,32 @@ static int checkpubkey(const char* keyal
- 		goto out;
- 	}
- 
--	/* we don't need to check pw and pw_dir for validity, since
--	 * its been done in checkpubkeyperms. */
--	len = strlen(ses.authstate.pw_dir);
--	/* allocate max required pathname storage,
--	 * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */
--	filename = m_malloc(len + 22);
--	snprintf(filename, len + 22, "%s/.ssh/authorized_keys", 
--				ses.authstate.pw_dir);
-+	/* special case for root authorized_keys in /etc/dropbear/authorized_keys */
-+	if (ses.authstate.pw_uid != 0) {
-+		/* we don't need to check pw and pw_dir for validity, since
-+		 * its been done in checkpubkeyperms. */
-+		len = strlen(ses.authstate.pw_dir);
-+		/* allocate max required pathname storage,
-+		 * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */
-+		filename = m_malloc(len + 22);
-+		snprintf(filename, len + 22, "%s/.ssh/authorized_keys", 
-+					ses.authstate.pw_dir);
- 
--#if DROPBEAR_SVR_MULTIUSER
--	/* open the file as the authenticating user. */
--	origuid = getuid();
--	origgid = getgid();
--	if ((setegid(ses.authstate.pw_gid)) < 0 ||
--		(seteuid(ses.authstate.pw_uid)) < 0) {
--		dropbear_exit("Failed to set euid");
--	}
--#endif
-+		/* open the file as the authenticating user. */
-+		origuid = getuid();
-+		origgid = getgid();
-+		if ((setegid(ses.authstate.pw_gid)) < 0 ||
-+			(seteuid(ses.authstate.pw_uid)) < 0) {
-+			dropbear_exit("Failed to set euid");
-+		}
- 
--	authfile = fopen(filename, "r");
-+		authfile = fopen(filename, "r");
-+
-+	} else {
-+		origuid = getuid();
-+		origgid = getgid();
-+		authfile = fopen("/etc/dropbear/authorized_keys","r");
-+	}
- 
- #if DROPBEAR_SVR_MULTIUSER
- 	if ((seteuid(origuid)) < 0 ||
-@@ -474,27 +480,37 @@ static int checkpubkeyperms() {
- 		goto out;
- 	}
- 
--	/* allocate max required pathname storage,
--	 * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */
--	len += 22;
--	filename = m_malloc(len);
--	strlcpy(filename, ses.authstate.pw_dir, len);
-+	if (ses.authstate.pw_uid != 0) {
-+		/* allocate max required pathname storage,
-+		 * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */
-+		filename = m_malloc(len + 22);
-+		strncpy(filename, ses.authstate.pw_dir, len+1);
-+ 
-+		/* check ~ */
-+		if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
-+			goto out;
-+		}
- 
--	/* check ~ */
--	if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
--		goto out;
--	}
-+		/* check ~/.ssh */
-+		strncat(filename, "/.ssh", 5); /* strlen("/.ssh") == 5 */
-+		if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
-+			goto out;
-+		}
- 
--	/* check ~/.ssh */
--	strlcat(filename, "/.ssh", len);
--	if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
--		goto out;
--	}
-+		/* now check ~/.ssh/authorized_keys */
-+		strncat(filename, "/authorized_keys", 16);
-+		if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
-+			goto out;
-+		}
- 
--	/* now check ~/.ssh/authorized_keys */
--	strlcat(filename, "/authorized_keys", len);
--	if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
--		goto out;
-+	} else {
-+
-+		if (checkfileperm("/etc/dropbear") != DROPBEAR_SUCCESS) {
-+			goto out;
-+		}
-+		if (checkfileperm("/etc/dropbear/authorized_keys") != DROPBEAR_SUCCESS) {
-+			goto out;
-+		}
- 	}
- 
- 	/* file looks ok, return success */