Mercurial > dropbear
changeset 1499:2d450c1056e3
options: Complete the transition to numeric toggles (`#if')
For the sake of review, this commit alters only the code; the affiliated
comments within the source files also need to be updated, but doing so
now would obscure the operational changes that have been made here.
* All on/off options have been switched to the numeric `#if' variant;
that is the only way to make this `default_options.h.in' thing work
in a reasonable manner.
* There is now some very minor compile-time checking of the user's
choice of options.
* NO_FAST_EXPTMOD doesn't seem to be used, so it has been removed.
* ENABLE_USER_ALGO_LIST was supposed to be renamed DROPBEAR_USER_ALGO_LIST,
and this commit completes that work.
* DROPBEAR_FUZZ seems to be a relatively new, as-yet undocumented option,
which was added by the following commit:
commit 6e0b539e9ca0b5628c6c5a3d118ad6a2e79e8039
Author: Matt Johnston <[email protected]>
Date: Tue May 23 22:29:21 2017 +0800
split out checkpubkey_line() separately
It has now been added to `sysoptions.h' and defined as `0' by default.
* The configuration option `DROPBEAR_PASSWORD_ENV' is no longer listed in
`default_options.h.in'; it is no longer meant to be set by the user, and
is instead left to be defined in `sysoptions.h' (where it was already being
defined) as merely the name of the environment variable in question:
DROPBEAR_PASSWORD
To enable or disable use of that environment variable, the user must now
toggle `DROPBEAR_USE_DROPBEAR_PASSWORD'.
* The sFTP support is now toggled by setting `DROPBEAR_SFTPSERVER', and the
path of the sFTP server program is set independently through the usual
SFTPSERVER_PATH.
| author | Michael Witten <mfwitten@gmail.com> |
|---|---|
| date | Thu, 20 Jul 2017 19:38:26 +0000 |
| parents | bf9c06b8dad9 |
| children | 35f38af1238b 73aa542e76fe |
| files | Makefile.in cli-auth.c cli-runopts.c dbrandom.c dbutil.c dbutil.h default_options.h.in keyimport.c libtomcrypt/src/headers/tomcrypt_custom.h netio.c runopts.h signkey.c svr-authpubkeyoptions.c svr-chansession.c svr-main.c svr-runopts.c svr-tcpfwd.c sysoptions.h |
| diffstat | 18 files changed, 101 insertions(+), 55 deletions(-) [+] |
line wrap: on
line diff
--- a/Makefile.in Wed Feb 14 23:09:40 2018 +0800 +++ b/Makefile.in Thu Jul 20 19:38:26 2017 +0000 @@ -20,7 +20,7 @@ ifeq (@BUNDLED_LIBTOM@, 1) LIBTOM_DEPS=$(STATIC_LTC) $(STATIC_LTM) CFLAGS+=-I$(srcdir)/libtomcrypt/src/headers/ -LIBTOM_LIBS=$(STATIC_LTC) $(STATIC_LTM) +LIBTOM_LIBS=$(STATIC_LTC) $(STATIC_LTM) endif ifneq ($(wildcard localoptions.h),)
--- a/cli-auth.c Wed Feb 14 23:09:40 2018 +0800 +++ b/cli-auth.c Thu Jul 20 19:38:26 2017 +0000 @@ -60,9 +60,11 @@ */ if (ses.keys->trans.algo_comp != DROPBEAR_COMP_ZLIB_DELAY) { ses.authstate.authtypes = AUTH_TYPE_PUBKEY; +#if DROPBEAR_USE_DROPBEAR_PASSWORD if (getenv(DROPBEAR_PASSWORD_ENV)) { ses.authstate.authtypes |= AUTH_TYPE_PASSWORD | AUTH_TYPE_INTERACT; } +#endif if (cli_auth_try() == DROPBEAR_SUCCESS) { TRACE(("skipped initial none auth query")) /* Note that there will be two auth responses in-flight */ @@ -335,7 +337,7 @@ { char* password = NULL; -#ifdef DROPBEAR_PASSWORD_ENV +#if DROPBEAR_USE_DROPBEAR_PASSWORD /* Password provided in an environment var */ password = getenv(DROPBEAR_PASSWORD_ENV); if (password)
--- a/cli-runopts.c Wed Feb 14 23:09:40 2018 +0800 +++ b/cli-runopts.c Thu Jul 20 19:38:26 2017 +0000 @@ -306,10 +306,10 @@ case 'm': #endif case 'D': -#ifndef DROPBEAR_CLI_REMOTETCPFWD +#if !DROPBEAR_CLI_REMOTETCPFWD case 'R': #endif -#ifndef DROPBEAR_CLI_LOCALTCPFWD +#if !DROPBEAR_CLI_LOCALTCPFWD case 'L': #endif case 'V':
--- a/dbrandom.c Wed Feb 14 23:09:40 2018 +0800 +++ b/dbrandom.c Thu Jul 20 19:38:26 2017 +0000 @@ -59,7 +59,7 @@ unsigned int readcount; int ret = DROPBEAR_FAILURE; -#ifdef DROPBEAR_PRNGD_SOCKET +#if DROPBEAR_USE_PRNGD if (prngd) { readfd = connect_unix(filename); @@ -107,7 +107,7 @@ wantread = MIN(sizeof(readbuf), len-readcount); } -#ifdef DROPBEAR_PRNGD_SOCKET +#if DROPBEAR_USE_PRNGD if (prngd) { char egdcmd[2]; @@ -157,7 +157,7 @@ static void write_urandom() { -#ifndef DROPBEAR_PRNGD_SOCKET +#if !DROPBEAR_USE_PRNGD /* This is opportunistic, don't worry about failure */ unsigned char buf[INIT_SEED_SIZE]; FILE *f = fopen(DROPBEAR_URANDOM_DEV, "w"); @@ -185,7 +185,7 @@ /* existing state */ sha1_process(&hs, (void*)hashpool, sizeof(hashpool)); -#ifdef DROPBEAR_PRNGD_SOCKET +#if DROPBEAR_USE_PRNGD if (process_file(&hs, DROPBEAR_PRNGD_SOCKET, INIT_SEED_SIZE, 1) != DROPBEAR_SUCCESS) { dropbear_exit("Failure reading random device %s",
--- a/dbutil.c Wed Feb 14 23:09:40 2018 +0800 +++ b/dbutil.c Thu Jul 20 19:38:26 2017 +0000 @@ -214,7 +214,7 @@ #endif /* DEBUG_TRACE */ /* Connect to a given unix socket. The socket is blocking */ -#ifdef ENABLE_CONNECT_UNIX +#if ENABLE_CONNECT_UNIX int connect_unix(const char* path) { struct sockaddr_un addr; int fd = -1;
--- a/dbutil.h Wed Feb 14 23:09:40 2018 +0800 +++ b/dbutil.h Thu Jul 20 19:38:26 2017 +0000 @@ -59,7 +59,7 @@ int spawn_command(void(*exec_fn)(const void *user_data), const void *exec_data, int *writefd, int *readfd, int *errfd, pid_t *pid); void run_shell_command(const char* cmd, unsigned int maxfd, char* usershell); -#ifdef ENABLE_CONNECT_UNIX +#if ENABLE_CONNECT_UNIX int connect_unix(const char* addr); #endif int buf_readfile(buffer* buf, const char* filename);
--- a/default_options.h.in Wed Feb 14 23:09:40 2018 +0800 +++ b/default_options.h.in Thu Jul 20 19:38:26 2017 +0000 @@ -36,10 +36,9 @@ #define NON_INETD_MODE 1 #define INETD_MODE 1 -/* Setting this disables the fast exptmod bignum code. It saves ~5kB, but is - * perhaps 20% slower for pubkey operations (it is probably worth experimenting - * if you want to use this) */ -/*#define NO_FAST_EXPTMOD*/ +#if !(NON_INETD_MODE || INETD_MODE) + #error "NON_INETD_MODE or INETD_MODE (or both) must be enabled." +#endif /* Set this if you want to use the DROPBEAR_SMALL_CODE option. This can save several kB in binary size however will make the symmetrical ciphers and hashes @@ -77,7 +76,7 @@ #define DROPBEAR_CLI_NETCAT 1 /* Whether to support "-c" and "-m" flags to choose ciphers/MACs at runtime */ -#define ENABLE_USER_ALGO_LIST 1 +#define DROPBEAR_USER_ALGO_LIST 1 /* Encryption - at least one required. * Protocol RFC requires 3DES and recommends AES128 for interoperability. @@ -86,10 +85,15 @@ #define DROPBEAR_AES128 1 #define DROPBEAR_3DES 1 #define DROPBEAR_AES256 1 -/* Compiling in Blowfish will add ~6kB to runtime heap memory usage */ -/*#define DROPBEAR_BLOWFISH*/ #define DROPBEAR_TWOFISH256 1 #define DROPBEAR_TWOFISH128 1 +/* Compiling in Blowfish will add ~6kB to runtime heap memory usage */ +#define DROPBEAR_BLOWFISH 0 + +#if !(DROPBEAR_AES128 || DROPBEAR_3DES || DROPBEAR_AES256 || DROPBEAR_BLOWFISH \ + || DROPBEAR_TWOFISH256 || DROPBEAR_TWOFISH128) + #error "At least one encryption algorithm must be enabled; 3DES and AES128 are recommended." +#endif /* Enable CBC mode for ciphers. This has security issues though * is the most compatible with older SSH implementations */ @@ -129,6 +133,10 @@ * on x86-64 */ #define DROPBEAR_ECDSA 1 +#if !(DROPBEAR_RSA || DROPBEAR_DSS || DROPBEAR_ECDSA) + #error "At least one hostkey or public-key algorithm must be enabled; RSA is recommended." +#endif + /* RSA must be >=1024 */ #define DROPBEAR_DEFAULT_RSA_SIZE 2048 /* DSS is always 1024 */ @@ -193,15 +201,38 @@ * PAM challenge/response. * You can't enable both PASSWORD and PAM. */ +/* PAM requires ./configure --enable-pam */ +#if defined(HAVE_LIBPAM) && !DROPBEAR_SVR_PASSWORD_AUTH + #define DROPBEAR_SVR_PAM_AUTH 1 +#else + #define DROPBEAR_SVR_PAM_AUTH 0 +#endif + /* This requires crypt() */ -#ifdef HAVE_CRYPT -#define DROPBEAR_SVR_PASSWORD_AUTH 1 +#if defined(HAVE_CRYPT) && !DROPBEAR_SVR_PAM_AUTH + #define DROPBEAR_SVR_PASSWORD_AUTH 1 #else -#define DROPBEAR_SVR_PASSWORD_AUTH 0 + #define DROPBEAR_SVR_PASSWORD_AUTH 0 +#endif + +#define DROPBEAR_SVR_PUBKEY_AUTH 1 + +#if !(DROPBEAR_SVR_PASSWORD_AUTH || DROPBEAR_SVR_PAM_AUTH || DROPBEAR_SVR_PUBKEY_AUTH) + #error "At least one server authentication type must be enabled; PUBKEY and PASSWORD are recommended." #endif -/* PAM requires ./configure --enable-pam */ -#define DROPBEAR_SVR_PAM_AUTH 0 -#define DROPBEAR_SVR_PUBKEY_AUTH 1 + +#if DROPBEAR_SVR_PASSWORD_AUTH && !HAVE_CRYPT + #error "DROPBEAR_SVR_PASSWORD_AUTH requires `crypt()'." +#endif + +#if DROPBEAR_SVR_PAM_AUTH + #if DISABLE_PAM + #error "DROPBEAR_SVR_PAM_AUTH requires 'configure --enable-pam' to succeed." + #endif + #if DROPBEAR_SVR_PASSWORD_AUTH + #error "DROPBEAR_SVR_PASSWORD_AUTH cannot be enabled at the same time as DROPBEAR_SVR_PAM_AUTH." + #endif +#endif /* Whether to take public key options in * authorized_keys file into account */ @@ -209,11 +240,18 @@ /* This requires getpass. */ #ifdef HAVE_GETPASS -#define DROPBEAR_CLI_PASSWORD_AUTH 1 -#define DROPBEAR_CLI_INTERACT_AUTH 1 + #define DROPBEAR_CLI_PASSWORD_AUTH 1 + #define DROPBEAR_CLI_INTERACT_AUTH 1 +#else + #define DROPBEAR_CLI_PASSWORD_AUTH 0 + #define DROPBEAR_CLI_INTERACT_AUTH 0 #endif #define DROPBEAR_CLI_PUBKEY_AUTH 1 +#if !(DROPBEAR_CLI_PASSWORD_AUTH || DROPBEAR_CLI_PUBKEY_AUTH) + #error "At least one client authentication type must be enabled; PUBKEY and PASSWORD are recommended." +#endif + /* A default argument for dbclient -i <privatekey>. Homedir is prepended unless path begins with / */ #define DROPBEAR_DEFAULT_CLI_AUTHKEY ".ssh/id_dropbear" @@ -224,7 +262,7 @@ * note that it will be provided for all "hidden" client-interactive * style prompts - if you want something more sophisticated, use * SSH_ASKPASS instead. Comment out this var to remove this functionality.*/ -#define DROPBEAR_PASSWORD_ENV "DROPBEAR_PASSWORD" +#define DROPBEAR_USE_DROPBEAR_PASSWORD 1 /* Define this (as well as DROPBEAR_CLI_PASSWORD_AUTH) to allow the use of * a helper program for the ssh client. The helper program should be @@ -233,6 +271,10 @@ * return the password on standard output */ #define DROPBEAR_CLI_ASKPASS_HELPER 0 +#if DROPBEAR_CLI_ASKPASS_HELPER + #define DROPBEAR_CLI_PASSWORD_AUTH 1 +#endif + /* Save a network roundtrip by sendng a real auth request immediately after * sending a query for the available methods. It is at the expense of < 100 * bytes of extra network traffic. This is not yet enabled by default since it @@ -245,8 +287,8 @@ #define DROPBEAR_URANDOM_DEV "/dev/urandom" /* Set this to use PRNGD or EGD instead of /dev/urandom or /dev/random */ -/*#define DROPBEAR_PRNGD_SOCKET "/var/run/dropbear-rng"*/ - +#define DROPBEAR_USE_PRNGD 0 +#define DROPBEAR_PRNGD_SOCKET "/var/run/dropbear-rng" /* Specify the number of clients we will allow to be connected but * not yet authenticated. After this limit, connections are rejected */ @@ -269,6 +311,8 @@ * "-q" for quiet */ #define XAUTH_COMMAND "/usr/bin/xauth -q" +#define DROPBEAR_SFTPSERVER 1 + /* if you want to enable running an sftp server (such as the one included with * OpenSSH), set the path below. If the path isn't defined, sftp will not * be enabled */
--- a/keyimport.c Wed Feb 14 23:09:40 2018 +0800 +++ b/keyimport.c Thu Jul 20 19:38:26 2017 +0000 @@ -870,7 +870,7 @@ */ numbers[0].start = zero; numbers[0].bytes = 1; zero[0] = '\0'; - #ifdef DROPBEAR_RSA + #if DROPBEAR_RSA if (key->type == DROPBEAR_SIGNKEY_RSA) { if (key->rsakey->p == NULL || key->rsakey->q == NULL) { @@ -966,7 +966,7 @@ } #endif /* DROPBEAR_RSA */ - #ifdef DROPBEAR_DSS + #if DROPBEAR_DSS if (key->type == DROPBEAR_SIGNKEY_DSS) { /* p */
--- a/libtomcrypt/src/headers/tomcrypt_custom.h Wed Feb 14 23:09:40 2018 +0800 +++ b/libtomcrypt/src/headers/tomcrypt_custom.h Thu Jul 20 19:38:26 2017 +0000 @@ -68,8 +68,8 @@ #define LTC_NO_MODES #define LTC_NO_HASHES #define LTC_NO_MACS - #define LTC_NO_PRNGS - #define LTC_NO_PK + #define LTC_NO_PRNGS + #define LTC_NO_PK #define LTC_NO_PKCS #define LTC_NO_MISC #endif /* LTC_NOTHING */
--- a/netio.c Wed Feb 14 23:09:40 2018 +0800 +++ b/netio.c Thu Jul 20 19:38:26 2017 +0000 @@ -613,7 +613,7 @@ int flags = NI_NUMERICSERV | NI_NUMERICHOST; -#ifndef DO_HOST_LOOKUP +#if !DO_HOST_LOOKUP host_lookup = 0; #endif
--- a/runopts.h Wed Feb 14 23:09:40 2018 +0800 +++ b/runopts.h Thu Jul 20 19:38:26 2017 +0000 @@ -86,7 +86,7 @@ int ipv6; */ -#ifdef DO_MOTD +#if DO_MOTD /* whether to print the MOTD */ int domotd; #endif
--- a/signkey.c Wed Feb 14 23:09:40 2018 +0800 +++ b/signkey.c Thu Jul 20 19:38:26 2017 +0000 @@ -78,13 +78,13 @@ #if DROPBEAR_ECDSA /* Some of the ECDSA key sizes are defined even if they're not compiled in */ if (0 -#ifndef DROPBEAR_ECC_256 +#if !DROPBEAR_ECC_256 || i == DROPBEAR_SIGNKEY_ECDSA_NISTP256 #endif -#ifndef DROPBEAR_ECC_384 +#if !DROPBEAR_ECC_384 || i == DROPBEAR_SIGNKEY_ECDSA_NISTP384 #endif -#ifndef DROPBEAR_ECC_521 +#if !DROPBEAR_ECC_521 || i == DROPBEAR_SIGNKEY_ECDSA_NISTP521 #endif ) {
--- a/svr-authpubkeyoptions.c Wed Feb 14 23:09:40 2018 +0800 +++ b/svr-authpubkeyoptions.c Thu Jul 20 19:38:26 2017 +0000 @@ -100,7 +100,7 @@ chansess->original_command = m_strdup(""); } chansess->cmd = m_strdup(ses.authstate.pubkey_options->forced_command); -#ifdef LOG_COMMANDS +#if LOG_COMMANDS dropbear_log(LOG_INFO, "Command forced to '%s'", chansess->original_command); #endif }
--- a/svr-chansession.c Wed Feb 14 23:09:40 2018 +0800 +++ b/svr-chansession.c Thu Jul 20 19:38:26 2017 +0000 @@ -663,7 +663,7 @@ } } if (issubsys) { -#ifdef SFTPSERVER_PATH +#if DROPBEAR_SFTPSERVER if ((cmdlen == 4) && strncmp(chansess->cmd, "sftp", 4) == 0) { m_free(chansess->cmd); chansess->cmd = m_strdup(SFTPSERVER_PATH); @@ -687,7 +687,7 @@ } -#ifdef LOG_COMMANDS +#if LOG_COMMANDS if (chansess->cmd) { dropbear_log(LOG_INFO, "User %s executing '%s'", ses.authstate.pw_name, chansess->cmd); @@ -774,7 +774,7 @@ pid_t pid; struct logininfo *li = NULL; -#ifdef DO_MOTD +#if DO_MOTD buffer * motdbuf = NULL; int len; struct stat sb; @@ -826,7 +826,7 @@ login_login(li); login_free_entry(li); -#ifdef DO_MOTD +#if DO_MOTD if (svr_opts.domotd && !chansess->cmd) { /* don't show the motd if ~/.hushlogin exists */
--- a/svr-main.c Wed Feb 14 23:09:40 2018 +0800 +++ b/svr-main.c Thu Jul 20 19:38:26 2017 +0000 @@ -35,10 +35,10 @@ static void sigchld_handler(int dummy); static void sigsegv_handler(int); static void sigintterm_handler(int fish); -#ifdef INETD_MODE +#if INETD_MODE static void main_inetd(void); #endif -#ifdef NON_INETD_MODE +#if NON_INETD_MODE static void main_noinetd(void); #endif static void commonsetup(void); @@ -58,7 +58,7 @@ /* get commandline options */ svr_getopts(argc, argv); -#ifdef INETD_MODE +#if INETD_MODE /* service program mode */ if (svr_opts.inetdmode) { main_inetd(); @@ -66,7 +66,7 @@ } #endif -#ifdef NON_INETD_MODE +#if NON_INETD_MODE main_noinetd(); /* notreached */ #endif @@ -76,7 +76,7 @@ } #endif -#ifdef INETD_MODE +#if INETD_MODE static void main_inetd() { char *host, *port = NULL; @@ -103,7 +103,7 @@ } #endif /* INETD_MODE */ -#ifdef NON_INETD_MODE +#if NON_INETD_MODE static void main_noinetd() { fd_set fds; unsigned int i, j;
--- a/svr-runopts.c Wed Feb 14 23:09:40 2018 +0800 +++ b/svr-runopts.c Thu Jul 20 19:38:26 2017 +0000 @@ -64,7 +64,7 @@ #else "-E Log to stderr rather than syslog\n" #endif -#ifdef DO_MOTD +#if DO_MOTD "-m Don't display the motd on login\n" #endif "-w Disallow root logins\n" @@ -88,7 +88,7 @@ " (default port is %s if none specified)\n" "-P PidFile Create pid file PidFile\n" " (default %s)\n" -#ifdef INETD_MODE +#if INETD_MODE "-i Start for inetd\n" #endif "-W <receive_window_buffer> (default %d, larger may be faster, max 1MB)\n" @@ -156,7 +156,7 @@ opts.ipv4 = 1; opts.ipv6 = 1; */ -#ifdef DO_MOTD +#if DO_MOTD svr_opts.domotd = 1; #endif #ifndef DISABLE_SYSLOG @@ -210,7 +210,7 @@ opts.listen_fwd_all = 1; break; #endif -#ifdef INETD_MODE +#if INETD_MODE case 'i': svr_opts.inetdmode = 1; break; @@ -221,7 +221,7 @@ case 'P': next = &svr_opts.pidfile; break; -#ifdef DO_MOTD +#if DO_MOTD /* motd is displayed by default, -m turns it off */ case 'm': svr_opts.domotd = 0;
--- a/svr-tcpfwd.c Wed Feb 14 23:09:40 2018 +0800 +++ b/svr-tcpfwd.c Thu Jul 20 19:38:26 2017 +0000 @@ -35,7 +35,7 @@ #include "auth.h" #include "netio.h" -#ifndef DROPBEAR_SVR_REMOTETCPFWD +#if !DROPBEAR_SVR_REMOTETCPFWD /* This is better than SSH_MSG_UNIMPLEMENTED */ void recv_msg_global_request_remotetcp() {
--- a/sysoptions.h Wed Feb 14 23:09:40 2018 +0800 +++ b/sysoptions.h Thu Jul 20 19:38:26 2017 +0000 @@ -192,7 +192,7 @@ #define DROPBEAR_CLI_MULTIHOP ((DROPBEAR_CLI_NETCAT) && (DROPBEAR_CLI_PROXYCMD)) -#define ENABLE_CONNECT_UNIX ((DROPBEAR_CLI_AGENTFWD) || (DROPBEAR_PRNGD_SOCKET)) +#define ENABLE_CONNECT_UNIX ((DROPBEAR_CLI_AGENTFWD) || (DROPBEAR_USE_PRNGD)) /* if we're using authorized_keys or known_hosts */ #define DROPBEAR_KEY_LINES ((DROPBEAR_CLIENT) || (DROPBEAR_SVR_PUBKEY_AUTH))