Mercurial > dropbear

comparison options.h @ 285:1b9e69c058d2

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
propagate from branch 'au.asn.ucc.matt.ltc.dropbear' (head 20dccfc09627970a312d77fb41dc2970b62689c3) to branch 'au.asn.ucc.matt.dropbear' (head fdf4a7a3b97ae5046139915de7e40399cceb2c01)
author Matt Johnston <matt@ucc.asn.au>
date Wed, 08 Mar 2006 13:23:58 +0000
parents 044bc108b9b3
children b72f98803e46
comparison
equal deleted inserted replaced
281:997e6f7dc01e 285:1b9e69c058d2
1 /* Dropbear SSH
2 * Copyright (c) 2002,2003 Matt Johnston
3 * All rights reserved. See LICENSE for the license. */
4
5 #ifndef _OPTIONS_H_
6 #define _OPTIONS_H_
7
8 /******************************************************************
9 * Define compile-time options below - the "#ifndef DROPBEAR_XXX .... #endif"
10 * parts are to allow for commandline -DDROPBEAR_XXX options etc.
11 ******************************************************************/
12
13 #ifndef DROPBEAR_DEFPORT
14 #define DROPBEAR_DEFPORT "22"
15 #endif
16
17 /* Default hostkey paths - these can be specified on the command line */
18 #ifndef DSS_PRIV_FILENAME
19 #define DSS_PRIV_FILENAME "/etc/dropbear/dropbear_dss_host_key"
20 #endif
21 #ifndef RSA_PRIV_FILENAME
22 #define RSA_PRIV_FILENAME "/etc/dropbear/dropbear_rsa_host_key"
23 #endif
24
25 /* Set NON_INETD_MODE if you require daemon functionality (ie Dropbear listens
26 * on chosen ports and keeps accepting connections. This is the default.
27 *
28 * Set INETD_MODE if you want to be able to run Dropbear with inetd (or
29 * similar), where it will use stdin/stdout for connections, and each process
30 * lasts for a single connection. Dropbear should be invoked with the -i flag
31 * for inetd, and can only accept IPv4 connections.
32 *
33 * Both of these flags can be defined at once, don't compile without at least
34 * one of them. */
35 #define NON_INETD_MODE
36 #define INETD_MODE
37
38 /* Setting this disables the fast exptmod bignum code. It saves ~5kB, but is
39 * perhaps 20% slower for pubkey operations (it is probably worth experimenting
40 * if you want to use this) */
41 /*#define NO_FAST_EXPTMOD*/
42
43 /* Set this if you want to use the DROPBEAR_SMALL_CODE option. This can save
44 several kB in binary size, however will make the symmetrical ciphers (AES, DES
45 etc) slower (perhaps by 50%). Recommended for most small systems. */
46 #define DROPBEAR_SMALL_CODE
47
48 /* Enable X11 Forwarding - server only */
49 #define ENABLE_X11FWD
50
51 /* Enable TCP Fowarding */
52 /* 'Local' is "-L" style (client listening port forwarded via server)
53 * 'Remote' is "-R" style (server listening port forwarded via client) */
54
55 #define ENABLE_CLI_LOCALTCPFWD
56 #define ENABLE_CLI_REMOTETCPFWD
57
58 #define ENABLE_SVR_LOCALTCPFWD
59 #define ENABLE_SVR_REMOTETCPFWD
60
61 /* Enable Authentication Agent Forwarding - server only for now */
62 #define ENABLE_AGENTFWD
63
64 /* Encryption - at least one required.
65 * RFC Draft requires 3DES and recommends AES128 for interoperability.
66 * Including multiple keysize variants the same cipher
67 * (eg AES256 as well as AES128) will result in a minimal size increase.*/
68 #define DROPBEAR_AES128_CBC
69 #define DROPBEAR_3DES_CBC
70 #define DROPBEAR_AES256_CBC
71 #define DROPBEAR_BLOWFISH_CBC
72 #define DROPBEAR_TWOFISH256_CBC
73 #define DROPBEAR_TWOFISH128_CBC
74
75 /* Message Integrity - at least one required.
76 * RFC Draft requires sha1 and recommends sha1-96.
77 * sha1-96 may be of use for slow links, as it has a smaller overhead.
78 *
79 * Note: there's no point disabling sha1 to save space, since it's used
80 * for the random number generator and public-key cryptography anyway.
81 * Disabling it here will just stop it from being used as the integrity portion
82 * of the ssh protocol.
83 *
84 * These hashes are also used for public key fingerprints in logs.
85 * If you disable MD5, Dropbear will fall back to SHA1 fingerprints,
86 * which are not the standard form. */
87 #define DROPBEAR_SHA1_HMAC
88 #define DROPBEAR_SHA1_96_HMAC
89 #define DROPBEAR_MD5_HMAC
90
91 /* Hostkey/public key algorithms - at least one required, these are used
92 * for hostkey as well as for verifying signatures with pubkey auth.
93 * Removing either of these won't save very much space.
94 * SSH2 RFC Draft requires dss, recommends rsa */
95 #define DROPBEAR_RSA
96 #define DROPBEAR_DSS
97
98 /* RSA can be vulnerable to timing attacks which use the time required for
99 * signing to guess the private key. Blinding avoids this attack, though makes
100 * signing operations slightly slower. */
101 #define RSA_BLINDING
102
103 /* Define DSS_PROTOK to use PuTTY's method of generating the value k for dss,
104 * rather than just from the random byte source. Undefining this will save you
105 * ~4k in binary size with static uclibc, but your DSS hostkey could be exposed
106 * if the random number source isn't good. In general this isn't required */
107 /* #define DSS_PROTOK */
108
109 /* Whether to do reverse DNS lookups. */
110 #define DO_HOST_LOOKUP
111
112 /* Whether to print the message of the day (MOTD). This doesn't add much code
113 * size */
114 #define DO_MOTD
115
116 /* The MOTD file path */
117 #ifndef MOTD_FILENAME
118 #define MOTD_FILENAME "/etc/motd"
119 #endif
120
121 /* Authentication Types - at least one required.
122 RFC Draft requires pubkey auth, and recommends password */
123
124 /* Note: PAM auth is quite simple, and only works for PAM modules which just do
125 * a simple "Login: " "Password: " (you can edit the strings in svr-authpam.c).
126 * It's useful for systems like OS X where standard password crypts don't work,
127 * but there's an interface via a PAM module - don't bother using it otherwise.
128 * You can't enable both PASSWORD and PAM. */
129
130 #define ENABLE_SVR_PASSWORD_AUTH
131 /*#define ENABLE_SVR_PAM_AUTH*/
132 #define ENABLE_SVR_PUBKEY_AUTH
133
134 #define ENABLE_CLI_PASSWORD_AUTH
135 #define ENABLE_CLI_PUBKEY_AUTH
136 #define ENABLE_CLI_INTERACT_AUTH
137
138 /* Define this (as well as ENABLE_CLI_PASSWORD_AUTH) to allow the use of
139 * a helper program for the ssh client. The helper program should be
140 * specified in the SSH_ASKPASS environment variable, and dbclient
141 * should be run with DISPLAY set and no tty. The program should
142 * return the password on standard output */
143 /*#define ENABLE_CLI_ASKPASS_HELPER*/
144
145 /* Random device to use - define either DROPBEAR_RANDOM_DEV or
146 * DROPBEAR_PRNGD_SOCKET.
147 * DROPBEAR_RANDOM_DEV is recommended on hosts with a good /dev/(u)random,
148 * otherwise use run prngd (or egd if you want), specifying the socket.
149 * The device will be queried for a few dozen bytes of seed a couple of times
150 * per session (or more for very long-lived sessions). */
151
152 /* If you are lacking entropy on the system then using /dev/urandom
153 * will prevent Dropbear from blocking on the device. This could
154 * however significantly reduce the security of your ssh connections
155 * if the PRNG state becomes guessable - make sure you know what you are
156 * doing if you change this. */
157 #define DROPBEAR_RANDOM_DEV "/dev/random"
158
159 /* prngd must be manually set up to produce output */
160 /*#define DROPBEAR_PRNGD_SOCKET "/var/run/dropbear-rng"*/
161
162 /* Specify the number of clients we will allow to be connected but
163 * not yet authenticated. After this limit, connections are rejected */
164 /* The first setting is per-IP, to avoid denial of service */
165 #ifndef MAX_UNAUTH_PER_IP
166 #define MAX_UNAUTH_PER_IP 5
167 #endif
168
169 /* And then a global limit to avoid chewing memory if connections
170 * come from many IPs */
171 #ifndef MAX_UNAUTH_CLIENTS
172 #define MAX_UNAUTH_CLIENTS 30
173 #endif
174
175 /* Maximum number of failed authentication tries (server option) */
176 #ifndef MAX_AUTH_TRIES
177 #define MAX_AUTH_TRIES 10
178 #endif
179
180 /* The file to store the daemon's process ID, for shutdown scripts etc */
181 #ifndef DROPBEAR_PIDFILE
182 #define DROPBEAR_PIDFILE "/var/run/dropbear.pid"
183 #endif
184
185 /* The command to invoke for xauth when using X11 forwarding.
186 * "-q" for quiet */
187 #ifndef XAUTH_COMMAND
188 #define XAUTH_COMMAND "/usr/X11R6/bin/xauth -q"
189 #endif
190
191 /* if you want to enable running an sftp server (such as the one included with
192 * OpenSSH), set the path below. If the path isn't defined, sftp will not
193 * be enabled */
194 #ifndef SFTPSERVER_PATH
195 #define SFTPSERVER_PATH "/usr/libexec/sftp-server"
196 #endif
197
198 /* This is used by the scp binary when used as a client binary. If you're
199 * not using the Dropbear client, you'll need to change it */
200 #define _PATH_SSH_PROGRAM "/usr/bin/dbclient"
201
202 /* Multi-purpose binary configuration has now moved. Look at the top
203 * of the Makefile for instructions, or INSTALL */
204
205 /*******************************************************************
206 * You shouldn't edit below here unless you know you need to.
207 *******************************************************************/
208
209 #ifndef DROPBEAR_VERSION
210 #define DROPBEAR_VERSION "0.47"
211 #endif
212
213 #define LOCAL_IDENT "SSH-2.0-dropbear_" DROPBEAR_VERSION
214 #define PROGNAME "dropbear"
215
216 /* Spec recommends after one hour or 1 gigabyte of data. One hour
217 * is a bit too verbose, so we try 8 hours */
218 #ifndef KEX_REKEY_TIMEOUT
219 #define KEX_REKEY_TIMEOUT (3600 * 8)
220 #endif
221 #ifndef KEX_REKEY_DATA
222 #define KEX_REKEY_DATA (1<<30) /* 2^30 == 1GB, this value must be < INT_MAX */
223 #endif
224 /* Close connections to clients which haven't authorised after AUTH_TIMEOUT */
225 #ifndef AUTH_TIMEOUT
226 #define AUTH_TIMEOUT 300 /* we choose 5 minutes */
227 #endif
228
229 /* Minimum key sizes for DSS and RSA */
230 #ifndef MIN_DSS_KEYLEN
231 #define MIN_DSS_KEYLEN 512
232 #endif
233 #ifndef MIN_RSA_KEYLEN
234 #define MIN_RSA_KEYLEN 512
235 #endif
236
237 #define MAX_BANNER_SIZE 2000 /* this is 25*80 chars, any more is foolish */
238 #define MAX_BANNER_LINES 20 /* How many lines the client will display */
239
240 /* the number of NAME=VALUE pairs to malloc for environ, if we don't have
241 * the clearenv() function */
242 #define ENV_SIZE 100
243
244 #define MAX_CMD_LEN 1024 /* max length of a command */
245 #define MAX_TERM_LEN 200 /* max length of TERM name */
246
247 #define MAX_HOST_LEN 254 /* max hostname len for tcp fwding */
248 #define MAX_IP_LEN 15 /* strlen("255.255.255.255") == 15 */
249
250 #define DROPBEAR_MAX_PORTS 10 /* max number of ports which can be specified,
251 ipv4 and ipv6 don't count twice */
252
253 #define _PATH_TTY "/dev/tty"
254
255 /* Timeouts in seconds */
256 #define SELECT_TIMEOUT 20
257
258 /* success/failure defines */
259 #define DROPBEAR_SUCCESS 0
260 #define DROPBEAR_FAILURE -1
261
262 /* various algorithm identifiers */
263 #define DROPBEAR_KEX_DH_GROUP1 0
264
265 #define DROPBEAR_SIGNKEY_ANY 0
266 #define DROPBEAR_SIGNKEY_RSA 1
267 #define DROPBEAR_SIGNKEY_DSS 2
268 #define DROPBEAR_SIGNKEY_NONE 3
269
270 #define DROPBEAR_COMP_NONE 0
271 #define DROPBEAR_COMP_ZLIB 1
272
273 /* Required for pubkey auth */
274 #if defined(ENABLE_SVR_PUBKEY_AUTH) || defined(DROPBEAR_CLIENT)
275 #define DROPBEAR_SIGNKEY_VERIFY
276 #endif
277
278 /* SHA1 is 20 bytes == 160 bits */
279 #define SHA1_HASH_SIZE 20
280 /* SHA512 is 64 bytes == 512 bits */
281 #define SHA512_HASH_SIZE 64
282 /* MD5 is 16 bytes = 128 bits */
283 #define MD5_HASH_SIZE 16
284
285 /* largest of MD5 and SHA1 */
286 #define MAX_MAC_LEN SHA1_HASH_SIZE
287
288
289 #define MAX_KEY_LEN 32 /* 256 bits for aes256 etc */
290 #define MAX_IV_LEN 20 /* must be same as max blocksize,
291 and >= SHA1_HASH_SIZE */
292 #define MAX_MAC_KEY 20
293
294 #define MAX_NAME_LEN 64 /* maximum length of a protocol name, isn't
295 explicitly specified for all protocols (just
296 for algos) but seems valid */
297
298 #define MAX_PROPOSED_ALGO 20
299
300 /* size/count limits */
301 #define MAX_LISTEN_ADDR 10
302
303 #define MAX_PACKET_LEN 35000
304 #define MIN_PACKET_LEN 16
305 #define MAX_PAYLOAD_LEN 32768
306
307 #define MAX_TRANS_PAYLOAD_LEN 32768
308 #define MAX_TRANS_PACKET_LEN (MAX_TRANS_PAYLOAD_LEN+50)
309
310 #define MAX_TRANS_WINDOW 500000000 /* 500MB is sufficient, stopping overflow */
311 #define MAX_TRANS_WIN_INCR 500000000 /* overflow prevention */
312
313 #define MAX_STRING_LEN 1400 /* ~= MAX_PROPOSED_ALGO * MAX_NAME_LEN, also
314 is the max length for a password etc */
315
316 /* For a 4096 bit DSS key, empirically determined */
317 #define MAX_PUBKEY_SIZE 1700
318 /* For a 4096 bit DSS key, empirically determined */
319 #define MAX_PRIVKEY_SIZE 1700
320
321 /* The maximum size of the bignum portion of the kexhash buffer */
322 /* Sect. 8 of the transport draft, K_S + e + f + K */
323 #define KEXHASHBUF_MAX_INTS (1700 + 130 + 130 + 130)
324
325 #define DROPBEAR_MAX_SOCKS 2 /* IPv4, IPv6 are all we'll get for now. Revisit
326 in a few years time.... */
327
328 #define DROPBEAR_MAX_CLI_PASS 1024
329
330 #define DROPBEAR_MAX_CLI_INTERACT_PROMPTS 80 /* The number of prompts we'll
331 accept for keyb-interactive
332 auth */
333
334 #if defined(DROPBEAR_AES256_CBC) || defined(DROPBEAR_AES128_CBC)
335 #define DROPBEAR_AES_CBC
336 #endif
337
338 #if defined(DROPBEAR_TWOFISH256_CBC) || defined(DROPBEAR_TWOFISH128_CBC)
339 #define DROPBEAR_TWOFISH_CBC
340 #endif
341
342 #ifndef ENABLE_X11FWD
343 #define DISABLE_X11FWD
344 #endif
345
346 #ifndef ENABLE_AGENTFWD
347 #define DISABLE_AGENTFWD
348 #endif
349
350 #if defined(ENABLE_CLI_REMOTETCPFWD) || defined(ENABLE_CLI_LOCALTCPFWD)
351 #define ENABLE_CLI_ANYTCPFWD
352 #endif
353
354 #if defined(ENABLE_CLI_LOCALTCPFWD) || defined(ENABLE_SVR_REMOTETCPFWD)
355 #define DROPBEAR_TCP_ACCEPT
356 #endif
357
358 #if defined(ENABLE_CLI_REMOTETCPFWD) || defined(ENABLE_CLI_LOCALTCPFWD) || \
359 defined(ENABLE_SVR_REMOTETCPFWD) || defined(ENABLE_SVR_LOCALTCPFWD) || \
360 defined(ENABLE_AGENTFWD) || defined(ENABLE_X11FWD)
361 #define USING_LISTENERS
362 #endif
363
364 #if defined(DROPBEAR_CLIENT) || defined(ENABLE_SVR_PUBKEY_AUTH)
365 #define DROPBEAR_KEY_LINES /* ie we're using authorized_keys or known_hosts */
366 #endif
367
368 #if defined(ENABLE_SVR_PASSWORD_AUTH) && defined(ENABLE_SVR_PAM_AUTH)
369 #error "You can't turn on PASSWORD and PAM auth both at once. Fix it in options.h"
370 #endif
371
372 #if defined(DROPBEAR_RANDOM_DEV) && defined(DROPBEAR_PRNGD_SOCKET)
373 #error "You can't turn on DROPBEAR_PRNGD_SOCKET and DROPBEAR_RANDOM_DEV at once"
374 #endif
375
376 #if !defined(DROPBEAR_RANDOM_DEV) && !defined(DROPBEAR_PRNGD_SOCKET)
377 #error "You must choose one of DROPBEAR_PRNGD_SOCKET or DROPBEAR_RANDOM_DEV in options.h"
378 #endif
379
380 /* We use dropbear_client and dropbear_server as shortcuts to avoid redundant
381 * code, if we're just compiling as client or server */
382 #if defined(DROPBEAR_SERVER) && defined(DROPBEAR_CLIENT)
383
384 #define IS_DROPBEAR_SERVER (ses.isserver == 1)
385 #define IS_DROPBEAR_CLIENT (ses.isserver == 0)
386
387 #elif defined(DROPBEAR_SERVER)
388
389 #define IS_DROPBEAR_SERVER 1
390 #define IS_DROPBEAR_CLIENT 0
391
392 #elif defined(DROPBEAR_CLIENT)
393
394 #define IS_DROPBEAR_SERVER 0
395 #define IS_DROPBEAR_CLIENT 1
396
397 #else
398 #error You must compiled with either DROPBEAR_CLIENT or DROPBEAR_SERVER selected
399 #endif
400
401 #endif /* _OPTIONS_H_ */