Skip to content

Commit 49a5822

Browse files
FelipeMdeOFelipeMdeO
committed
netutils/dropbear: add Dropbear SSH server port for NuttX
Integrated SSH daemon authenticating against FSUTILS_PASSWD, with an ECDSA P-256 host key and an NSH session over a PTY per connection. Built from the upstream tarball with NuttX crypto and POSIX shims. Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
1 parent 68f9e54 commit 49a5822

40 files changed

Lines changed: 4867 additions & 1 deletion

‎fsutils/passwd/passwd_append.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ int passwd_append(FAR const char *username, FAR const char *password)
6969
{
7070
int errcode = errno;
7171
DEBUGASSERT(errcode > 0);
72-
return errcode;
72+
return -errcode;
7373
}
7474

7575
/* The format of the password file is:

‎netutils/dropbear/.gitignore‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
/dropbear
2+
/*.zip
3+
*.o
4+
.built
5+
.depend
6+
Make.dep

‎netutils/dropbear/CMakeLists.txt‎

Lines changed: 212 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,212 @@
1+
# ##############################################################################
2+
# apps/netutils/dropbear/CMakeLists.txt
3+
#
4+
# SPDX-License-Identifier: Apache-2.0
5+
#
6+
# Licensed to the Apache Software Foundation (ASF) under one or more contributor
7+
# license agreements. See the NOTICE file distributed with this work for
8+
# additional information regarding copyright ownership. The ASF licenses this
9+
# file to you under the Apache License, Version 2.0 (the "License"); you may not
10+
# use this file except in compliance with the License. You may obtain a copy of
11+
# the License at
12+
#
13+
# http://www.apache.org/licenses/LICENSE-2.0
14+
#
15+
# Unless required by applicable law or agreed to in writing, software
16+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
17+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
18+
# License for the specific language governing permissions and limitations under
19+
# the License.
20+
#
21+
# ##############################################################################
22+
23+
if(CONFIG_NETUTILS_DROPBEAR)
24+
25+
set(DROPBEAR_COMMIT "${CONFIG_NETUTILS_DROPBEAR_COMMIT}")
26+
string(REPLACE "\"" "" DROPBEAR_COMMIT "${DROPBEAR_COMMIT}")
27+
28+
set(DROPBEAR_ZIP "${DROPBEAR_COMMIT}.zip")
29+
set(DROPBEAR_URL "https://github.com/mkj/dropbear/archive")
30+
set(DROPBEAR_UNPACKNAME "dropbear")
31+
32+
if(NOT EXISTS "${CMAKE_CURRENT_SOURCE_DIR}/${DROPBEAR_UNPACKNAME}")
33+
if(NOT EXISTS "${CMAKE_CURRENT_SOURCE_DIR}/${DROPBEAR_ZIP}")
34+
message(STATUS "Downloading Dropbear: ${DROPBEAR_URL}/${DROPBEAR_ZIP}")
35+
file(DOWNLOAD "${DROPBEAR_URL}/${DROPBEAR_ZIP}"
36+
"${CMAKE_CURRENT_SOURCE_DIR}/${DROPBEAR_ZIP}")
37+
endif()
38+
message(STATUS "Unpacking Dropbear: ${DROPBEAR_ZIP}")
39+
execute_process(
40+
COMMAND unzip -q -o "${DROPBEAR_ZIP}"
41+
WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}"
42+
RESULT_VARIABLE result)
43+
if(result EQUAL 0)
44+
file(RENAME "${CMAKE_CURRENT_SOURCE_DIR}/dropbear-${DROPBEAR_COMMIT}"
45+
"${CMAKE_CURRENT_SOURCE_DIR}/${DROPBEAR_UNPACKNAME}")
46+
execute_process(
47+
COMMAND
48+
patch -s -N -l -p1 -d "${DROPBEAR_UNPACKNAME}" -i
49+
"${CMAKE_CURRENT_SOURCE_DIR}/patch/0001-use-nuttx-unused-macro.patch"
50+
WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}")
51+
execute_process(
52+
COMMAND
53+
patch -s -N -l -p1 -d "${DROPBEAR_UNPACKNAME}" -i
54+
"${CMAKE_CURRENT_SOURCE_DIR}/patch/0002-use-nuttx-ecdsa-hostkey-sign.patch"
55+
WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}")
56+
execute_process(
57+
COMMAND
58+
patch -s -N -l -p1 -d "${DROPBEAR_UNPACKNAME}" -i
59+
"${CMAKE_CURRENT_SOURCE_DIR}/patch/0003-guard-environ-declaration-for-nuttx.patch"
60+
WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}")
61+
execute_process(
62+
COMMAND
63+
patch -s -N -l -p1 -d "${DROPBEAR_UNPACKNAME}" -i
64+
"${CMAKE_CURRENT_SOURCE_DIR}/patch/0004-fix-nuttx-compile-warnings.patch"
65+
WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}")
66+
execute_process(
67+
COMMAND
68+
patch -s -N -l -p1 -d "${DROPBEAR_UNPACKNAME}" -i
69+
"${CMAKE_CURRENT_SOURCE_DIR}/patch/0005-use-nuttx-sha256-hmac.patch"
70+
WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}")
71+
execute_process(
72+
COMMAND
73+
patch -s -N -l -p1 -d "${DROPBEAR_UNPACKNAME}" -i
74+
"${CMAKE_CURRENT_SOURCE_DIR}/patch/0006-use-nuttx-chachapoly-state.patch"
75+
WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}")
76+
execute_process(
77+
COMMAND
78+
patch -s -N -l -p1 -d "${DROPBEAR_UNPACKNAME}" -i
79+
"${CMAKE_CURRENT_SOURCE_DIR}/patch/0007-use-nuttx-passwd-auth.patch"
80+
WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}")
81+
endif()
82+
endif()
83+
84+
set(PROGNAME "${CONFIG_NETUTILS_DROPBEAR_PROGNAME}")
85+
string(REPLACE "\"" "" PROGNAME "${PROGNAME}")
86+
87+
set(DROPBEAR_SRCS
88+
dropbear_nshsession.c
89+
port/nuttx_auth.c
90+
port/nuttx_compat.c
91+
port/dropbear_chachapoly.c
92+
port/dropbear_crypto.c
93+
port/dropbear_curve25519.c
94+
port/dropbear_ltc_aes.c
95+
port/dropbear_ltc_hmac_sha256.c
96+
port/dropbear_ltc_sha256.c
97+
port/dropbear_utils.c
98+
port/nuttx_hostkey.c
99+
dropbear/src/dbutil.c
100+
dropbear/src/buffer.c
101+
dropbear/src/dbhelpers.c
102+
dropbear/src/bignum.c
103+
dropbear/src/signkey.c
104+
dropbear/src/dbrandom.c
105+
dropbear/src/queue.c
106+
dropbear/src/atomicio.c
107+
dropbear/src/compat.c
108+
dropbear/src/fake-rfc2553.c
109+
dropbear/src/ltc_prng.c
110+
dropbear/src/ecc.c
111+
dropbear/src/ecdsa.c
112+
dropbear/src/crypto_desc.c
113+
dropbear/src/dbmalloc.c
114+
dropbear/src/gensignkey.c
115+
dropbear/src/common-session.c
116+
dropbear/src/packet.c
117+
dropbear/src/common-algo.c
118+
dropbear/src/common-kex.c
119+
dropbear/src/common-channel.c
120+
dropbear/src/common-chansession.c
121+
dropbear/src/termcodes.c
122+
dropbear/src/tcp-accept.c
123+
dropbear/src/listener.c
124+
dropbear/src/process-packet.c
125+
dropbear/src/common-runopts.c
126+
dropbear/src/circbuffer.c
127+
dropbear/src/list.c
128+
dropbear/src/netio.c
129+
dropbear/src/gcm.c
130+
dropbear/src/kex-x25519.c
131+
dropbear/src/svr-kex.c
132+
dropbear/src/svr-auth.c
133+
dropbear/src/svr-authpasswd.c
134+
dropbear/src/svr-session.c
135+
dropbear/src/svr-service.c
136+
dropbear/src/svr-runopts.c
137+
dropbear/src/svr-tcpfwd.c
138+
dropbear/src/svr-authpam.c)
139+
140+
file(GLOB LIBTOMMATH_SRCS CONFIGURE_DEPENDS
141+
"${CMAKE_CURRENT_SOURCE_DIR}/dropbear/libtommath/*.c")
142+
list(APPEND DROPBEAR_SRCS ${LIBTOMMATH_SRCS})
143+
144+
file(GLOB_RECURSE LIBTOMCRYPT_SRCS CONFIGURE_DEPENDS
145+
"${CMAKE_CURRENT_SOURCE_DIR}/dropbear/libtomcrypt/src/*.c")
146+
list(FILTER LIBTOMCRYPT_SRCS EXCLUDE REGEX ".*/pk/ecc/ecc_make_key\\.c$")
147+
list(FILTER LIBTOMCRYPT_SRCS EXCLUDE REGEX ".*/pk/ecc/ecc_encrypt_key\\.c$")
148+
list(FILTER LIBTOMCRYPT_SRCS EXCLUDE REGEX ".*/pk/ecc/ecc_decrypt_key\\.c$")
149+
list(FILTER LIBTOMCRYPT_SRCS EXCLUDE REGEX ".*/pk/ecc/ecc_shared_secret\\.c$")
150+
list(FILTER LIBTOMCRYPT_SRCS EXCLUDE REGEX ".*/pk/ecc/ecc_sign_hash\\.c$")
151+
list(FILTER LIBTOMCRYPT_SRCS EXCLUDE REGEX ".*/pk/ecc/ecc_verify_hash\\.c$")
152+
list(FILTER LIBTOMCRYPT_SRCS EXCLUDE REGEX ".*/pk/ecc/ecc_test\\.c$")
153+
list(FILTER LIBTOMCRYPT_SRCS EXCLUDE REGEX ".*/ciphers/aes/aes\\.c$")
154+
list(FILTER LIBTOMCRYPT_SRCS EXCLUDE REGEX ".*/ciphers/aes/aes_tab\\.c$")
155+
list(FILTER LIBTOMCRYPT_SRCS EXCLUDE REGEX ".*/mac/hmac/hmac_done\\.c$")
156+
list(FILTER LIBTOMCRYPT_SRCS EXCLUDE REGEX ".*/mac/hmac/hmac_init\\.c$")
157+
list(FILTER LIBTOMCRYPT_SRCS EXCLUDE REGEX ".*/mac/hmac/hmac_process\\.c$")
158+
list(FILTER LIBTOMCRYPT_SRCS EXCLUDE REGEX ".*/mac/poly1305/.*\\.c$")
159+
list(FILTER LIBTOMCRYPT_SRCS EXCLUDE REGEX ".*/encauth/chachapoly/.*\\.c$")
160+
list(FILTER LIBTOMCRYPT_SRCS EXCLUDE REGEX ".*/prngs/chacha20\\.c$")
161+
list(FILTER LIBTOMCRYPT_SRCS EXCLUDE REGEX ".*/stream/chacha/.*\\.c$")
162+
list(FILTER LIBTOMCRYPT_SRCS EXCLUDE REGEX ".*/hashes/sha2/sha256\\.c$")
163+
list(APPEND DROPBEAR_SRCS ${LIBTOMCRYPT_SRCS})
164+
165+
nuttx_add_application(
166+
NAME
167+
${PROGNAME}
168+
SRCS
169+
${DROPBEAR_SRCS}
170+
dropbear_main.c
171+
STACKSIZE
172+
${CONFIG_NETUTILS_DROPBEAR_STACKSIZE}
173+
PRIORITY
174+
${CONFIG_NETUTILS_DROPBEAR_PRIORITY}
175+
DEPENDS
176+
${DROPBEAR_UNPACKNAME})
177+
178+
target_include_directories(
179+
${PROGNAME}
180+
PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}
181+
${CMAKE_CURRENT_SOURCE_DIR}/port
182+
${CMAKE_CURRENT_SOURCE_DIR}/dropbear
183+
${CMAKE_CURRENT_SOURCE_DIR}/dropbear/src
184+
${CMAKE_CURRENT_SOURCE_DIR}/dropbear/libtomcrypt/src/headers
185+
${CMAKE_CURRENT_SOURCE_DIR}/dropbear/libtommath
186+
${CMAKE_CURRENT_SOURCE_DIR}/../../nshlib)
187+
188+
if(CONFIG_NETUTILS_DROPBEAR_COMPRESSION)
189+
target_include_directories(
190+
${PROGNAME} PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/../../system/zlib/zlib)
191+
endif()
192+
193+
target_compile_definitions(
194+
${PROGNAME}
195+
PRIVATE LOCALOPTIONS_H_EXISTS=1 DROPBEAR_NUTTX=1
196+
DROPBEAR_NUTTX_CHACHAPOLY=1 DROPBEAR_NUTTX_HMAC_SHA256=1
197+
DROPBEAR_NUTTX_PASSWD=1 DROPBEAR_NUTTX_SHA256=1)
198+
199+
set_source_files_properties(
200+
dropbear_nshsession.c
201+
PROPERTIES COMPILE_DEFINITIONS
202+
"Channel=dropbear_channel;ChanType=dropbear_chantype")
203+
204+
# LTC_SOURCE must be set only for libtomcrypt sources.
205+
set_source_files_properties(${LIBTOMCRYPT_SRCS} PROPERTIES COMPILE_DEFINITIONS
206+
LTC_SOURCE=1)
207+
208+
target_compile_options(${PROGNAME} PRIVATE -Wno-pointer-sign -Wno-format)
209+
210+
target_sources(apps PRIVATE ${DROPBEAR_SRCS})
211+
212+
endif()

‎netutils/dropbear/Kconfig‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
#
2+
# For a description of the syntax of this configuration file,
3+
# see the file kconfig-language.txt in the NuttX tools repository.
4+
#
5+
6+
menuconfig NETUTILS_DROPBEAR
7+
tristate "Dropbear SSH server"
8+
default n
9+
depends on NET && NET_TCP
10+
depends on !DISABLE_PSEUDOFS_OPERATIONS
11+
depends on !DISABLE_PTHREAD
12+
depends on SCHED_WAITPID
13+
depends on NSH_LIBRARY
14+
depends on FSUTILS_PASSWD
15+
depends on PSEUDOTERM
16+
depends on SERIAL
17+
depends on ARCH_HAVE_RNG
18+
depends on DEV_RANDOM
19+
depends on DEV_URANDOM
20+
depends on LIBC_NETDB
21+
depends on LIBC_GAISTRERROR
22+
select CRYPTO
23+
select CRYPTO_RANDOM_POOL
24+
---help---
25+
Enable a minimal Dropbear SSH server port for NuttX. This initial
26+
port is based on the ESP-IDF MCU test port and provides a single
27+
foreground SSH server process with SSH sessions backed by NSH.
28+
29+
if NETUTILS_DROPBEAR
30+
31+
config NETUTILS_DROPBEAR_STACKSIZE
32+
int "Dropbear main stack size"
33+
default 65536
34+
---help---
35+
Stack size for the Dropbear server built-in.
36+
This is architecture-specific, so adjust it according to your setup.
37+
38+
config NETUTILS_DROPBEAR_PRIORITY
39+
int "Dropbear main priority"
40+
default 100
41+
42+
config NETUTILS_DROPBEAR_SHELL_PRIORITY
43+
int "Dropbear NSH session priority"
44+
default 100
45+
46+
config NETUTILS_DROPBEAR_PROGNAME
47+
string "Dropbear program name"
48+
default "dropbear"
49+
---help---
50+
This is the name of the program that will be used when the NSH ELF
51+
program is installed.
52+
53+
config NETUTILS_DROPBEAR_LISTEN_RETRIES
54+
int "Dropbear listen retries"
55+
default 0
56+
---help---
57+
Number of times to retry listen setup when no listen socket could
58+
be opened. Zero means to retry forever.
59+
60+
config NETUTILS_DROPBEAR_LISTEN_RETRY_MAX
61+
int "Dropbear maximum listen retry interval"
62+
default 120
63+
range 1 3600
64+
---help---
65+
Maximum number of seconds to wait between listen setup retries.
66+
The retry delay starts at one second and doubles until it reaches
67+
this value.
68+
69+
config NETUTILS_DROPBEAR_SHELL_STACKSIZE
70+
int "Dropbear NSH session task stack size"
71+
default 8192
72+
73+
config NETUTILS_DROPBEAR_PORT
74+
int "Dropbear listen port"
75+
default 2222
76+
77+
config NETUTILS_DROPBEAR_HOSTKEY_PATH
78+
string "Dropbear ECDSA P-256 host key path"
79+
default "/etc/dropbear/dropbear_ecdsa_host_key"
80+
---help---
81+
Path to the persistent ECDSA P-256 host key used by the Dropbear
82+
server. The file stores the private scalar and public point in a
83+
NuttX-specific text format:
84+
nuttx-ecdsa-p256-v1:d_hex:x_hex:y_hex
85+
86+
config NETUTILS_DROPBEAR_GENERATE_HOSTKEY
87+
bool "Generate host key if missing"
88+
default y
89+
---help---
90+
Generate an ECDSA P-256 host key with NuttX crypto on first boot
91+
when NETUTILS_DROPBEAR_HOSTKEY_PATH does not exist. Product builds
92+
can disable this and provision the host key externally.
93+
94+
config NETUTILS_DROPBEAR_COMPRESSION
95+
bool "Enable SSH compression (zlib)"
96+
default n
97+
depends on LIB_ZLIB
98+
---help---
99+
Enable zlib compression for SSH sessions. Requires the zlib
100+
library (LIB_ZLIB). When disabled, Dropbear is built with
101+
DISABLE_ZLIB and negotiates no compression.
102+
103+
WARNING: each session allocates a zlib deflate state of about
104+
256 KiB (DROPBEAR_ZLIB_WINDOW_BITS=15, DROPBEAR_ZLIB_MEM_LEVEL=8),
105+
and the state is allocated even for the delayed zlib@openssh.com
106+
method, right after key exchange.
107+
108+
config NETUTILS_DROPBEAR_SYSLOG
109+
bool "Log via syslog"
110+
default n
111+
---help---
112+
Route Dropbear log messages through syslog(). When disabled,
113+
Dropbear is built with DISABLE_SYSLOG.
114+
115+
config NETUTILS_DROPBEAR_COMMIT
116+
string "Dropbear upstream commit"
117+
default "75f699bfe2c234418056776c4d9f651a07a76de6"
118+
---help---
119+
Upstream Dropbear revision used by the ESP-IDF validation repo.
120+
121+
endif

‎netutils/dropbear/Make.defs‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
############################################################################
2+
# apps/netutils/dropbear/Make.defs
3+
#
4+
# SPDX-License-Identifier: Apache-2.0
5+
#
6+
# Licensed to the Apache Software Foundation (ASF) under one or more
7+
# contributor license agreements. See the NOTICE file distributed with
8+
# this work for additional information regarding copyright ownership. The
9+
# ASF licenses this file to you under the Apache License, Version 2.0 (the
10+
# "License"); you may not use this file except in compliance with the
11+
# License. You may obtain a copy of the License at
12+
#
13+
# http://www.apache.org/licenses/LICENSE-2.0
14+
#
15+
# Unless required by applicable law or agreed to in writing, software
16+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
17+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
18+
# License for the specific language governing permissions and limitations
19+
# under the License.
20+
#
21+
############################################################################
22+
23+
ifneq ($(CONFIG_NETUTILS_DROPBEAR),)
24+
CONFIGURED_APPS += $(APPDIR)/netutils/dropbear
25+
endif

0 commit comments

Comments
 (0)