Mercurial > dropbear
view dbclient.1 @ 1672:3a97f14c0235
Add Chacha20-Poly1305, AES128-GCM and AES256-GCM support (#93)
* Add Chacha20-Poly1305 authenticated encryption
* Add general AEAD approach.
* Add [email protected] algo using LibTomCrypt chacha and
poly1305 routines.
Chacha20-Poly1305 is generally faster than AES256 on CPU w/o dedicated
AES instructions, having the same key size.
Compiling in will add ~5,5kB to binary size on x86-64.
function old new delta
chacha_crypt - 1397 +1397
_poly1305_block - 608 +608
poly1305_done - 595 +595
dropbear_chachapoly_crypt - 457 +457
.rodata 26976 27392 +416
poly1305_process - 290 +290
poly1305_init - 221 +221
chacha_setup - 218 +218
encrypt_packet 1068 1270 +202
dropbear_chachapoly_getlength - 147 +147
decrypt_packet 756 897 +141
chacha_ivctr64 - 137 +137
read_packet 543 637 +94
dropbear_chachapoly_start - 94 +94
read_kex_algos 792 880 +88
chacha_keystream - 69 +69
dropbear_mode_chachapoly - 48 +48
sshciphers 280 320 +40
dropbear_mode_none 24 48 +24
dropbear_mode_ctr 24 48 +24
dropbear_mode_cbc 24 48 +24
dropbear_chachapoly_mac - 24 +24
dropbear_chachapoly - 24 +24
gen_new_keys 848 854 +6
------------------------------------------------------------------------------
(add/remove: 14/0 grow/shrink: 10/0 up/down: 5388/0) Total: 5388 bytes
* Add AES128-GCM and AES256-GCM authenticated encryption
* Add general AES-GCM mode.
* Add [email protected] and [email protected] algo using
LibTomCrypt gcm routines.
AES-GCM is combination of AES CTR mode and GHASH, slower than AES-CTR on
CPU w/o dedicated AES/GHASH instructions therefore disabled by default.
Compiling in will add ~6kB to binary size on x86-64.
function old new delta
gcm_process - 1060 +1060
.rodata 26976 27808 +832
gcm_gf_mult - 820 +820
gcm_add_aad - 660 +660
gcm_shift_table - 512 +512
gcm_done - 471 +471
gcm_add_iv - 384 +384
gcm_init - 347 +347
dropbear_gcm_crypt - 309 +309
encrypt_packet 1068 1270 +202
decrypt_packet 756 897 +141
gcm_reset - 118 +118
read_packet 543 637 +94
read_kex_algos 792 880 +88
sshciphers 280 360 +80
gcm_mult_h - 80 +80
dropbear_gcm_start - 62 +62
dropbear_mode_gcm - 48 +48
dropbear_mode_none 24 48 +24
dropbear_mode_ctr 24 48 +24
dropbear_mode_cbc 24 48 +24
dropbear_ghash - 24 +24
dropbear_gcm_getlength - 24 +24
gen_new_keys 848 854 +6
------------------------------------------------------------------------------
(add/remove: 14/0 grow/shrink: 10/0 up/down: 6434/0) Total: 6434 bytes
author | Vladislav Grishenko <themiron@users.noreply.github.com> |
---|---|
date | Mon, 25 May 2020 20:50:25 +0500 |
parents | 33b872649eb7 |
children | 94323a20e572 |
line wrap: on
line source
.TH dbclient 1 .SH NAME dbclient \- lightweight SSH client .SH SYNOPSIS .B dbclient [\fIflag arguments\fR] [\-p .I port\fR] [\-i .I id\fR] [\-L .I l\fR:\fIh\fR:\fIp\fR] [\-R .I l\fR:\fIh\fR:\fIp\fR] [\-l .IR user ] .I host .RI [ \fImore\ flags\fR ] .RI [ command ] .B dbclient [\fIargs\fR] [\fIuser1\fR]@\fIhost1\fR[^\fIport1\fR],[\fIuser2\fR]@\fIhost2\fR[^\fIport2\fR],... .SH DESCRIPTION .B dbclient is a small SSH client .SH OPTIONS .TP .TP .B command A command to run on the remote host. This will normally be run by the remote host using the user's shell. The command begins at the first hyphen argument after the host argument. If no command is specified an interactive terminal will be opened (see -t and -T). .TP .B \-p \fIport Connect to .I port on the remote host. Alternatively a port can be specified as hostname^port. Default is 22. .TP .B \-i \fIidfile Identity file. Read the identity key from file .I idfile (multiple allowed). This file is created with dropbearkey(1) or converted from OpenSSH with dropbearconvert(1). The default path ~/.ssh/id_dropbear is used .TP .B \-L\fR [\fIlistenaddress\fR]:\fIlistenport\fR:\fIhost\fR:\fIport\fR Local port forwarding. Forward the port .I listenport on the local host through the SSH connection to port .I port on the host .IR host . .TP .B \-R\fR [\fIlistenaddress\fR]:\fIlistenport\fR:\fIhost\fR:\fIport\fR Remote port forwarding. Forward the port .I listenport on the remote host through the SSH connection to port .I port on the host .IR host . .TP .B \-l \fIuser Username. Login as .I user on the remote host. .TP .B \-t Allocate a PTY. This is the default when no command is given, it gives a full interactive remote session. The main effect is that keystrokes are sent remotely immediately as opposed to local line-based editing. .TP .B \-T Don't allocate a PTY. This is the default a command is given. See -t. .TP .B \-N Don't request a remote shell or run any commands. Any command arguments are ignored. .TP .B \-f Fork into the background after authentication. A command argument (or -N) is required. This is useful when using password authentication. .TP .B \-g Allow non-local hosts to connect to forwarded ports. Applies to -L and -R forwarded ports, though remote connections to -R forwarded ports may be limited by the ssh server. .TP .B \-y Always accept hostkeys if they are unknown. If a hostkey mismatch occurs the connection will abort as normal. If specified a second time no host key checking is performed at all, this is usually undesirable. .TP .B \-A Forward agent connections to the remote host. dbclient will use any OpenSSH-style agent program if available ($SSH_AUTH_SOCK will be set) for public key authentication. Forwarding is only enabled if -A is specified. .TP .B \-W \fIwindowsize Specify the per-channel receive window buffer size. Increasing this may improve network performance at the expense of memory use. Use -h to see the default buffer size. .TP .B \-K \fItimeout_seconds Ensure that traffic is transmitted at a certain interval in seconds. This is useful for working around firewalls or routers that drop connections after a certain period of inactivity. The trade-off is that a session may be closed if there is a temporary lapse of network connectivity. A setting if 0 disables keepalives. If no response is received for 3 consecutive keepalives the connection will be closed. .TP .B \-I \fIidle_timeout Disconnect the session if no traffic is transmitted or received for \fIidle_timeout\fR seconds. .TP .\" TODO: how to avoid a line break between these two -J arguments? .B \-J \fIproxy_command .TP .B \-J \fI&fd .br Use the standard input/output of the program \fIproxy_command\fR rather than using a normal TCP connection. A hostname should be still be provided, as this is used for comparing saved hostkeys. This command will be executed as "exec proxy_command ..." with the default shell. The second form &fd will make dbclient use the numeric file descriptor as a socket. This can be used for more complex tunnelling scenarios. Example usage with socat is socat EXEC:'dbclient -J &38 ev',fdin=38,fdout=38 TCP4:host.example.com:22 .TP .B \-B \fIendhost:endport "Netcat-alike" mode, where Dropbear will connect to the given host, then create a forwarded connection to \fIendhost\fR. This will then be presented as dbclient's standard input/output. .TP .B \-c \fIcipherlist Specify a comma separated list of ciphers to enable. Use \fI-c help\fR to list possibilities. .TP .B \-m \fIMAClist Specify a comma separated list of authentication MACs to enable. Use \fI-m help\fR to list possibilities. .TP .B \-o \fIoption Can be used to give options in the format used by OpenSSH config file. This is useful for specifying options for which there is no separate command-line flag. For full details of the options listed below, and their possible values, see ssh_config(5). The following options have currently been implemented: .RS .TP .B ExitOnForwardFailure Specifies whether dbclient should terminate the connection if it cannot set up all requested local and remote port forwardings. The argument must be “yes” or “no”. The default is “no”. .TP .B UseSyslog Send dbclient log messages to syslog in addition to stderr. .RE .TP .B \-s The specified command will be requested as a subsystem, used for sftp. Dropbear doesn't implement sftp itself but the OpenSSH sftp client can be used eg \fIsftp -S dbclient user@host\fR .TP .B \-b \fI[address][:port] Bind to a specific local address when connecting to the remote host. This can be used to choose from multiple outgoing interfaces. Either address or port (or both) can be given. .TP .B \-V Print the version .SH MULTI-HOP Dropbear will also allow multiple "hops" to be specified, separated by commas. In this case a connection will be made to the first host, then a TCP forwarded connection will be made through that to the second host, and so on. Hosts other than the final destination will not see anything other than the encrypted SSH stream. A port for a host can be specified with a caret (eg matt@martello^44 ). This syntax can also be used with scp or rsync (specifying dbclient as the ssh/rsh command). A file can be "bounced" through multiple SSH hops, eg scp -S dbclient matt@martello,root@wrt,canyons:/tmp/dump . Note that hostnames are resolved by the prior hop (so "canyons" would be resolved by the host "wrt") in the example above, the same way as other -L TCP forwarded hosts are. Host keys are checked locally based on the given hostname. .SH ESCAPE CHARACTERS Typing a newline followed by the key sequence \fI~.\fR (tilde, dot) will terminate a connection. The sequence \fI~^Z\fR (tilde, ctrl-z) will background the connection. This behaviour only applies when a PTY is used. .SH ENVIRONMENT .TP .B DROPBEAR_PASSWORD A password to use for remote authentication can be specified in the environment variable DROPBEAR_PASSWORD. Care should be taken that the password is not exposed to other users on a multi-user system, or stored in accessible files. .TP .B SSH_ASKPASS dbclient can use an external program to request a password from a user. SSH_ASKPASS should be set to the path of a program that will return a password on standard output. This program will only be used if either DISPLAY is set and standard input is not a TTY, or the environment variable SSH_ASKPASS_ALWAYS is set. .SH NOTES If compiled with zlib support and if the server supports it, dbclient will always use compression. .SH AUTHOR Matt Johnston ([email protected]). .br Mihnea Stoenescu wrote initial Dropbear client support .br Gerrit Pape ([email protected]) wrote this manual page. .SH SEE ALSO dropbear(8), dropbearkey(1) .P https://matt.ucc.asn.au/dropbear/dropbear.html