Mercurial > dropbear
changeset 1861:2b3a8026a6ce
Add re-exec for server
This allows ASLR to re-randomize the address
space for every connection, preventing some
vulnerabilities from being exploitable by
repeated probing.
Overhead (memory and time) is yet to be confirmed.
At present this is only enabled on Linux. Other BSD platforms
with fexecve() would probably also work though have not been tested.
| author | Matt Johnston <matt@ucc.asn.au> |
|---|---|
| date | Sun, 30 Jan 2022 10:14:56 +0800 |
| parents | 5001e9c5641f |
| children | 6f265a35159a |
| files | config.h.in configure configure.ac default_options.h includes.h runopts.h svr-chansession.c svr-main.c svr-runopts.c sysoptions.h test/parent_dropbear_map.py test/requirements.txt test/test_aslr.py |
| diffstat | 13 files changed, 192 insertions(+), 37 deletions(-) [+] |
line wrap: on
line diff
--- a/config.h.in Thu Jan 27 15:09:29 2022 +0800 +++ b/config.h.in Sun Jan 30 10:14:56 2022 +0800 @@ -93,6 +93,9 @@ /* Define to 1 if you have the `explicit_bzero' function. */ #undef HAVE_EXPLICIT_BZERO +/* Define to 1 if you have the `fexecve' function. */ +#undef HAVE_FEXECVE + /* Define to 1 if you have the `fork' function. */ #undef HAVE_FORK @@ -318,6 +321,9 @@ /* Define to 1 if `ut_type' is a member of `struct utmp'. */ #undef HAVE_STRUCT_UTMP_UT_TYPE +/* Define to 1 if you have the <sys/prctl.h> header file. */ +#undef HAVE_SYS_PRCTL_H + /* Define to 1 if you have the <sys/random.h> header file. */ #undef HAVE_SYS_RANDOM_H
--- a/configure Thu Jan 27 15:09:29 2022 +0800 +++ b/configure Sun Jan 30 10:14:56 2022 +0800 @@ -5608,7 +5608,7 @@ pty.h libutil.h libgen.h inttypes.h stropts.h utmp.h \ utmpx.h lastlog.h paths.h util.h netdb.h security/pam_appl.h \ pam/pam_appl.h netinet/in_systm.h sys/uio.h linux/pkt_sched.h \ - sys/random.h + sys/random.h sys/prctl.h do : as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh` ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default" @@ -7352,7 +7352,7 @@ fi done -for ac_func in freeaddrinfo getnameinfo fork writev getgrouplist +for ac_func in freeaddrinfo getnameinfo fork writev getgrouplist fexecve do : as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh` ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
--- a/configure.ac Thu Jan 27 15:09:29 2022 +0800 +++ b/configure.ac Sun Jan 30 10:14:56 2022 +0800 @@ -386,7 +386,7 @@ pty.h libutil.h libgen.h inttypes.h stropts.h utmp.h \ utmpx.h lastlog.h paths.h util.h netdb.h security/pam_appl.h \ pam/pam_appl.h netinet/in_systm.h sys/uio.h linux/pkt_sched.h \ - sys/random.h]) + sys/random.h sys/prctl.h]) # Checks for typedefs, structures, and compiler characteristics. AC_C_CONST @@ -841,7 +841,7 @@ AC_FUNC_SELECT_ARGTYPES AC_CHECK_FUNCS([getpass getspnam getusershell putenv]) AC_CHECK_FUNCS([clearenv strlcpy strlcat daemon basename _getpty getaddrinfo ]) -AC_CHECK_FUNCS([freeaddrinfo getnameinfo fork writev getgrouplist]) +AC_CHECK_FUNCS([freeaddrinfo getnameinfo fork writev getgrouplist fexecve]) AC_SEARCH_LIBS(basename, gen, AC_DEFINE(HAVE_BASENAME))
--- a/default_options.h Thu Jan 27 15:09:29 2022 +0800 +++ b/default_options.h Sun Jan 30 10:14:56 2022 +0800 @@ -37,7 +37,14 @@ #define NON_INETD_MODE 1 #define INETD_MODE 1 -/* Include verbose debug output, enabled with -v at runtime. +/* By default Dropbear will re-execute itself for each incoming connection so + that memory layout may be re-randomised (ASLR) - exploiting