From patchwork Fri Jul 17 15:35:19 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Rui Salvaterra X-Patchwork-Id: 1331283 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.openwrt.org (client-ip=2001:8b0:10b:1231::1; helo=merlin.infradead.org; envelope-from=openwrt-devel-bounces+incoming=patchwork.ozlabs.org@lists.openwrt.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; secure) header.d=lists.infradead.org header.i=@lists.infradead.org header.a=rsa-sha256 header.s=merlin.20170209 header.b=gmkObCVQ; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20161025 header.b=sXEWMjZ1; dkim-atps=neutral Received: from merlin.infradead.org (merlin.infradead.org [IPv6:2001:8b0:10b:1231::1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 4B7Zxx4h6Vz9sQt for ; Sat, 18 Jul 2020 01:37:41 +1000 (AEST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=merlin.20170209; h=Sender:Content-Transfer-Encoding: Content-Type:Cc:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:MIME-Version:Message-Id:Date:Subject:To:From: Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender :Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Owner; bh=r7cI4o7imfrjgXprjEO32/SkADK5yr1rzCaVHGnaLnI=; b=gmkObCVQ77xbTEJgMXeMZK6M4L 3BoNeKQ14V4JBwTaRRP1ycDpTko90+6w8nS+jZeJ7x6ssd+xtbbPpjsmx5R1z/gVqAr17aASrTENN +VhJHhPQyGfKW5SSOD/Np7Ev73a5RpSglQUJjcWUe8CI8VU6uY+vkTMCN/WQs7CAcWtitSJ9bWRzW CHXuO56VviSbKLADce9AYLsENbh/vs4LMz6/DuSpa3wyWfS4MDZxSQeIWNBuDalglbM1tdOBdhPbK zjD5ZTrMI+DF3HHeDtU1qttj7rnfl3xpVKZ0CuajA/I2ar6LA1OBRlR/gIctUuNwhu03nt3HPx2h5 lSWTlcjg==; Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1jwSP2-0003Jg-Iv; Fri, 17 Jul 2020 15:36:00 +0000 Received: from mail-qt1-x842.google.com ([2607:f8b0:4864:20::842]) by merlin.infradead.org with esmtps (Exim 4.92.3 #3 (Red Hat Linux)) id 1jwSP0-0003Io-1w for openwrt-devel@lists.openwrt.org; Fri, 17 Jul 2020 15:35:58 +0000 Received: by mail-qt1-x842.google.com with SMTP id x62so7915973qtd.3 for ; Fri, 17 Jul 2020 08:35:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=ndA9uiYfwjn3vAEfptL5wYXF3iKDYHBRiUmKJrqDqa0=; b=sXEWMjZ1iFH2KAzResjT2EtlNMoQ/xVI8s1SPas2Ufh6/GCFJ627Yp6ZNBRZKIz0/E TTHpSWOehmR1a7AnA4vALRKMMvhtECS7nIKAy8njQY4WwTDrL0Ov508AKTuC5sUObdZS hWTGgYeo6dIyYD1tdfiVzlcX+sTeWROH4HDJasvEAXXlf517sZ3oM+t9H4dgPxL9w2+s jafWC4qKP6aZib+a7qdW1T45Ougf9IdpW2Rn4XyLxeREWcCnb1wHOJ3eknTTkxUVHj69 DjAzbNR8aZDtNajh3lOa7/XEXQ209iKHRUDHKbnUkW+CVbQrou5M6R6qVe5azPz31I4l X1nA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=ndA9uiYfwjn3vAEfptL5wYXF3iKDYHBRiUmKJrqDqa0=; b=unNUAtvv144CAv+E35FdScxYiaaSsFvjE1+UeTuZKEivYCfY2W4vnwbKSnTJtEr4m1 9Rd3J4Q4z81/bMrj/Hxe0eA3koxyGbxA+a96dXoyAHaoqKt9f4Wt2SUShba4uJiEERy4 xdE4MsNJhxuyEFSs/HqoY/RRQHGtIrPUSS+5pFhNvn1JZurqjRAjfh3hT3tM2RkcCHFz SEHRk/hdtBv2lWoB87C8nYfBANP1venafmsj1+5CezYWTJRT07g/o7VWwakV4K/DqMYG zzy8QrpxUFyweB0p97fQ4rfHbMMfYyR1GrxrgL42zdbr2PvWSN3DTlyyska/5BMs1eDg 04dg== X-Gm-Message-State: AOAM530iMj2qHqYOY7bTBEpEqTV1vc8z9oMqhoOSx3T/4RJkGu00MkYq tK94uB7aItnh1ydLHbx3IvtpxlA= X-Google-Smtp-Source: ABdhPJz3SkULJwxL9BSAyZ9xpS+gTuoRejPzY1PJrk/D101ajy1zo4DoZh/8zfMlB1g5lntoyp+JsQ== X-Received: by 2002:ac8:1baf:: with SMTP id z44mr11368030qtj.129.1595000155771; Fri, 17 Jul 2020 08:35:55 -0700 (PDT) Received: from presler.lan (a109-49-8-134.cpe.netcabo.pt. [109.49.8.134]) by smtp.gmail.com with ESMTPSA id t57sm11294482qtc.91.2020.07.17.08.35.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Jul 2020 08:35:54 -0700 (PDT) From: Rui Salvaterra To: openwrt-devel@lists.openwrt.org Subject: [PATCH v2] dropbear: allow disabling the RSA public key algorithm Date: Fri, 17 Jul 2020 16:35:19 +0100 Message-Id: <20200717153518.219502-1-rsalvaterra@gmail.com> X-Mailer: git-send-email 2.27.0 MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20200717_113558_129932_5DB2BC52 X-CRM114-Status: GOOD ( 10.82 ) X-Spam-Score: -0.2 (/) X-Spam-Report: SpamAssassin version 3.4.4 on merlin.infradead.org summary: Content analysis details: (-0.2 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 SPF_PASS SPF: sender matches SPF record 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider [rsalvaterra[at]gmail.com] -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no trust [2607:f8b0:4864:20:0:0:0:842 listed in] [list.dnswl.org] 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature X-BeenThere: openwrt-devel@lists.openwrt.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: OpenWrt Development List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Rui Salvaterra Sender: "openwrt-devel" Errors-To: openwrt-devel-bounces+incoming=patchwork.ozlabs.org@lists.openwrt.org This allows the user to disable the RSA algorithm in Dropbear, if not required. (RSA is still enabled by default, of course, due to its ubiquity.) Size comparison of the dropbear executable (cortex-a9+neon): RSA + Ed25519: 182804 bytes RSA only: 170496 bytes Ed25519 only: 166356 bytes Signed-off-by: Rui Salvaterra --- package/network/services/dropbear/Config.in | 7 +++++++ package/network/services/dropbear/Makefile | 9 ++++++--- ...0-signkey-fix-use-of-rsa-sha2-256-pubkeys.patch | 14 +++++++++----- 3 files changed, 22 insertions(+), 8 deletions(-) diff --git a/package/network/services/dropbear/Config.in b/package/network/services/dropbear/Config.in index 3de4189e08..0ac84ee206 100644 --- a/package/network/services/dropbear/Config.in +++ b/package/network/services/dropbear/Config.in @@ -1,6 +1,13 @@ menu "Configuration" depends on PACKAGE_dropbear +config DROPBEAR_RSA + bool "RSA support" + default y + help + The ubiquitous RSA public key algorithm. + Keep enabled, unless you're 100 % sure you don't need it! + config DROPBEAR_CURVE25519 bool "Curve25519 support" default y diff --git a/package/network/services/dropbear/Makefile b/package/network/services/dropbear/Makefile index 0a9b5c0a99..742dc403ad 100644 --- a/package/network/services/dropbear/Makefile +++ b/package/network/services/dropbear/Makefile @@ -28,7 +28,7 @@ PKG_FIXUP:=autoreconf PKG_CONFIG_DEPENDS:= \ CONFIG_TARGET_INIT_PATH CONFIG_DROPBEAR_ECC CONFIG_DROPBEAR_ECC_FULL \ - CONFIG_DROPBEAR_CURVE25519 CONFIG_DROPBEAR_ZLIB \ + CONFIG_DROPBEAR_RSA CONFIG_DROPBEAR_CURVE25519 CONFIG_DROPBEAR_ZLIB \ CONFIG_DROPBEAR_ED25519 CONFIG_DROPBEAR_CHACHA20POLY1305 \ CONFIG_DROPBEAR_UTMP CONFIG_DROPBEAR_PUTUTLINE \ CONFIG_DROPBEAR_DBCLIENT @@ -64,9 +64,9 @@ define Package/dropbear/description endef define Package/dropbear/conffiles +$(if $(CONFIG_DROPBEAR_RSA),/etc/dropbear/dropbear_rsa_host_key) $(if $(CONFIG_DROPBEAR_ED25519),/etc/dropbear/dropbear_ed25519_host_key) $(if $(CONFIG_DROPBEAR_ECC),/etc/dropbear/dropbear_ecdsa_host_key) -/etc/dropbear/dropbear_rsa_host_key /etc/config/dropbear endef @@ -104,6 +104,9 @@ define Build/Configure echo '#define DEFAULT_PATH "$(TARGET_INIT_PATH)"' >> \ $(PKG_BUILD_DIR)/localoptions.h + echo '#define DROPBEAR_RSA $(if $(CONFIG_DROPBEAR_RSA),1,0)' >> \ + $(PKG_BUILD_DIR)/localoptions.h + echo '#define DROPBEAR_CURVE25519 $(if $(CONFIG_DROPBEAR_CURVE25519),1,0)' >> \ $(PKG_BUILD_DIR)/localoptions.h @@ -169,7 +172,7 @@ define Package/dropbear/install $(INSTALL_DATA) ./files/dropbear.failsafe $(1)/lib/preinit/99_10_failsafe_dropbear $(if $(CONFIG_DROPBEAR_ED25519),touch $(1)/etc/dropbear/dropbear_ed25519_host_key) $(if $(CONFIG_DROPBEAR_ECC),touch $(1)/etc/dropbear/dropbear_ecdsa_host_key) - touch $(1)/etc/dropbear/dropbear_rsa_host_key + $(if $(CONFIG_DROPBEAR_RSA),touch $(1)/etc/dropbear/dropbear_rsa_host_key endef define Package/dropbearconvert/install diff --git a/package/network/services/dropbear/patches/910-signkey-fix-use-of-rsa-sha2-256-pubkeys.patch b/package/network/services/dropbear/patches/910-signkey-fix-use-of-rsa-sha2-256-pubkeys.patch index afa0ebb310..b2846ea87b 100644 --- a/package/network/services/dropbear/patches/910-signkey-fix-use-of-rsa-sha2-256-pubkeys.patch +++ b/package/network/services/dropbear/patches/910-signkey-fix-use-of-rsa-sha2-256-pubkeys.patch @@ -19,22 +19,26 @@ Signed-off-by: Petr Štetiar signkey.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) -diff --git a/signkey.c b/signkey.c -index 92fe6a242cd0..d16ab174d83a 100644 --- a/signkey.c +++ b/signkey.c -@@ -657,8 +657,12 @@ int buf_verify(buffer * buf, sign_key *key, enum signature_type expect_sigtype, +@@ -657,9 +657,19 @@ int buf_verify(buffer * buf, sign_key *k sigtype = signature_type_from_name(type_name, type_name_len); m_free(type_name); -- if (expect_sigtype != sigtype) { -- dropbear_exit("Non-matching signing type"); ++#if DROPBEAR_RSA + if (sigtype == DROPBEAR_SIGNATURE_NONE) { + dropbear_exit("No signature type"); + } + + if ((expect_sigtype != DROPBEAR_SIGNATURE_RSA_SHA256) && (expect_sigtype != sigtype)) { ++ dropbear_exit("Non-matching signing type"); ++ } ++#else + if (expect_sigtype != sigtype) { +- dropbear_exit("Non-matching signing type"); + dropbear_exit("Non-matching signing type"); } ++#endif keytype = signkey_type_from_signature(sigtype); + #if DROPBEAR_DSS