dropbear: bump to 2020.79

- drop patches (applied upstream):
  * 010-backport-change-address-logging.patch
  * 020-backport-ed25519-support.patch
  * 021-backport-chacha20-poly1305-support.patch
- backport patches:
  * 010-backport-disable-toom-and-karatsuba.patch:
    reduce dropbear binary size (about ~8Kb).
- refresh patches.
- don't bother anymore with following config options
  because they are disabled in upstream too:
  * DROPBEAR_3DES
  * DROPBEAR_ENABLE_CBC_MODE
  * DROPBEAR_SHA1_96_HMAC
- explicitly disable DO_MOTD as it was before commit a1099ed:
  upstream has (accidentally) switched it to 0 in release 2019.77,
  but reverted back in release 2020.79.

Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
master
Konstantin Demin 4 years ago committed by Hans Dedecker
parent 340de1d154
commit 29e170dbaa

@ -8,14 +8,14 @@
include $(TOPDIR)/rules.mk
PKG_NAME:=dropbear
PKG_VERSION:=2019.78
PKG_RELEASE:=5
PKG_VERSION:=2020.79
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
PKG_SOURCE_URL:= \
http://matt.ucc.asn.au/dropbear/releases/ \
https://dropbear.nl/mirror/releases/
PKG_HASH:=525965971272270995364a0eb01f35180d793182e63dd0b0c3eb0292291644a4
PKG_HASH:=084f00546b1610a3422a0773e2c04cbe1a220d984209e033b548b49f379cc441
PKG_LICENSE:=MIT
PKG_LICENSE_FILES:=LICENSE libtomcrypt/LICENSE libtommath/LICENSE
@ -124,8 +124,7 @@ define Build/Configure
# disable legacy/unsafe methods and unused functionality
for OPTION in INETD_MODE DROPBEAR_CLI_NETCAT \
DROPBEAR_3DES DROPBEAR_DSS DROPBEAR_ENABLE_CBC_MODE \
DROPBEAR_SHA1_96_HMAC DROPBEAR_USE_PASSWORD_ENV; do \
DROPBEAR_DSS DROPBEAR_USE_PASSWORD_ENV DO_MOTD ; do \
echo "#define $$$$OPTION 0" >> \
$(PKG_BUILD_DIR)/localoptions.h; \
done

@ -1,119 +0,0 @@
From c153b3612b7c9f24a0f5af43618a646545ed6e22 Mon Sep 17 00:00:00 2001
From: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
Date: Mon, 30 Sep 2019 12:42:13 +0100
Subject: [PATCH] Improve address logging on early exit messages
Change 'Early exit' and 'Exit before auth' messages to include the IP
address & port as part of the message.
This allows log scanning utilities such as 'fail2ban' to obtain the
offending IP address as part of the failure event instead of extracting
the PID from the message and then scanning the log again for match
'child connection from' messages
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
---
svr-auth.c | 18 +++++++-----------
svr-session.c | 20 ++++++++++++++------
2 files changed, 21 insertions(+), 17 deletions(-)
--- a/svr-auth.c
+++ b/svr-auth.c
@@ -241,8 +241,7 @@ static int checkusername(const char *use
}
if (strlen(username) != userlen) {
- dropbear_exit("Attempted username with a null byte from %s",
- svr_ses.addrstring);
+ dropbear_exit("Attempted username with a null byte");
}
if (ses.authstate.username == NULL) {
@@ -252,8 +251,7 @@ static int checkusername(const char *use
} else {
/* check username hasn't changed */
if (strcmp(username, ses.authstate.username) != 0) {
- dropbear_exit("Client trying multiple usernames from %s",
- svr_ses.addrstring);
+ dropbear_exit("Client trying multiple usernames");
}
}
@@ -268,8 +266,7 @@ static int checkusername(const char *use
if (!ses.authstate.pw_name) {
TRACE(("leave checkusername: user '%s' doesn't exist", username))
dropbear_log(LOG_WARNING,
- "Login attempt for nonexistent user from %s",
- svr_ses.addrstring);
+ "Login attempt for nonexistent user");
ses.authstate.checkusername_failed = 1;
return DROPBEAR_FAILURE;
}
@@ -279,9 +276,8 @@ static int checkusername(const char *use
if (!(DROPBEAR_SVR_MULTIUSER && uid == 0) && uid != ses.authstate.pw_uid) {
TRACE(("running as nonroot, only server uid is allowed"))
dropbear_log(LOG_WARNING,
- "Login attempt with wrong user %s from %s",
- ses.authstate.pw_name,
- svr_ses.addrstring);
+ "Login attempt with wrong user %s",
+ ses.authstate.pw_name);
ses.authstate.checkusername_failed = 1;
return DROPBEAR_FAILURE;
}
@@ -440,8 +436,8 @@ void send_msg_userauth_failure(int parti
} else {
userstr = ses.authstate.pw_name;
}
- dropbear_exit("Max auth tries reached - user '%s' from %s",
- userstr, svr_ses.addrstring);
+ dropbear_exit("Max auth tries reached - user '%s'",
+ userstr);
}
TRACE(("leave send_msg_userauth_failure"))
--- a/svr-session.c
+++ b/svr-session.c
@@ -149,28 +149,36 @@ void svr_session(int sock, int childpipe
void svr_dropbear_exit(int exitcode, const char* format, va_list param) {
char exitmsg[150];
char fullmsg[300];
+ char fromaddr[60];
int i;
/* Render the formatted exit message */
vsnprintf(exitmsg, sizeof(exitmsg), format, param);
+ /* svr_ses.addrstring may not be set for some early exits, or for
+ the listener process */
+ fromaddr[0] = '\0';
+ if (svr_ses.addrstring) {
+ snprintf(fromaddr, sizeof(fromaddr), " from <%s>", svr_ses.addrstring);
+ }
+
/* Add the prefix depending on session/auth state */
if (!ses.init_done) {
/* before session init */
- snprintf(fullmsg, sizeof(fullmsg), "Early exit: %s", exitmsg);
+ snprintf(fullmsg, sizeof(fullmsg), "Early exit%s: %s", fromaddr, exitmsg);
} else if (ses.authstate.authdone) {
/* user has authenticated */
snprintf(fullmsg, sizeof(fullmsg),
- "Exit (%s): %s",
- ses.authstate.pw_name, exitmsg);
+ "Exit (%s)%s: %s",
+ ses.authstate.pw_name, fromaddr, exitmsg);
} else if (ses.authstate.pw_name) {
/* we have a potential user */
snprintf(fullmsg, sizeof(fullmsg),
- "Exit before auth (user '%s', %u fails): %s",
- ses.authstate.pw_name, ses.authstate.failcount, exitmsg);
+ "Exit before auth%s: (user '%s', %u fails): %s",
+ fromaddr, ses.authstate.pw_name, ses.authstate.failcount, exitmsg);
} else {
/* before userauth */
- snprintf(fullmsg, sizeof(fullmsg), "Exit before auth: %s", exitmsg);
+ snprintf(fullmsg, sizeof(fullmsg), "Exit before auth%s: %s", fromaddr, exitmsg);
}
dropbear_log(LOG_INFO, "%s", fullmsg);

@ -0,0 +1,17 @@
From: Matt Johnston <matt@ucc.asn.au>
Date: Thu, 18 Jun 2020 19:12:07 +0800
Subject: Disable toom and karatsuba for new libtommath
--- a/libtommath/tommath_class.h
+++ b/libtommath/tommath_class.h
@@ -1312,6 +1312,10 @@
#undef BN_MP_KARATSUBA_SQR_C
#undef BN_MP_TOOM_MUL_C
#undef BN_MP_TOOM_SQR_C
+#undef BN_S_MP_KARATSUBA_MUL_C
+#undef BN_S_MP_KARATSUBA_SQR_C
+#undef BN_S_MP_TOOM_MUL_C
+#undef BN_S_MP_TOOM_SQR_C
#include "dbmalloc.h"
#define MP_MALLOC m_malloc

@ -1,693 +0,0 @@
From 3cdf9ec918b37c17e12b33e4c244944d1ee836ca Mon Sep 17 00:00:00 2001
From: Vladislav Grishenko <themiron@mail.ru>
Date: Mon, 6 Apr 2020 23:28:09 +0500
Subject: [PATCH] Add Chacha20-Poly1305 authenticated encryption
* Add general AEAD approach.
* Add chacha20-poly1305@openssh.com algo using LibTomCrypt chacha and
poly1305 routines.
Chacha20-Poly1305 is generally faster than AES256 on CPU w/o dedicated
AES instructions, having the same key size.
Compiling in will add ~5,5kB to binary size on x86-64.
---
Makefile.in | 2 +-
algo.h | 8 ++
chachapoly.c | 148 ++++++++++++++++++++
chachapoly.h | 44 ++++++
common-algo.c | 11 +-
common-kex.c | 44 ++++--
default_options.h | 6 +
libtomcrypt/src/headers/tomcrypt_dropbear.h | 4 +
packet.c | 145 +++++++++++++------
session.h | 4 +
sysoptions.h | 8 +-
11 files changed, 368 insertions(+), 56 deletions(-)
create mode 100644 chachapoly.c
create mode 100644 chachapoly.h
diff --git a/Makefile.in b/Makefile.in
index aaf7b3b..3437cb2 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -53,7 +53,7 @@ CLIOBJS=cli-main.o cli-auth.o cli-authpasswd.o cli-kex.o \
CLISVROBJS=common-session.o packet.o common-algo.o common-kex.o \
common-channel.o common-chansession.o termcodes.o loginrec.o \
tcp-accept.o listener.o process-packet.o dh_groups.o \
- common-runopts.o circbuffer.o list.o netio.o
+ common-runopts.o circbuffer.o list.o netio.o chachapoly.o
KEYOBJS=dropbearkey.o
diff --git a/algo.h b/algo.h
index b12fb94..efd0d73 100644
--- a/algo.h
+++ b/algo.h
@@ -72,6 +72,14 @@ struct dropbear_cipher_mode {
unsigned long len, void *cipher_state);
int (*decrypt)(const unsigned char *ct, unsigned char *pt,
unsigned long len, void *cipher_state);
+ int (*aead_crypt)(unsigned int seq,
+ const unsigned char *in, unsigned char *out,
+ unsigned long len, unsigned long taglen,
+ void *cipher_state, int direction);
+ int (*aead_getlength)(unsigned int seq,
+ const unsigned char *in, unsigned int *outlen,
+ unsigned long len, void *cipher_state);
+ const struct dropbear_hash *aead_mac;
};
struct dropbear_hash {
diff --git a/chachapoly.c b/chachapoly.c
new file mode 100644
index 0000000..8fb06c5
--- /dev/null
+++ b/chachapoly.c
@@ -0,0 +1,148 @@
+/*
+ * Dropbear SSH
+ *
+ * Copyright (c) 2002,2003 Matt Johnston
+ * Copyright (c) 2020 by Vladislav Grishenko
+ * All rights reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE. */
+
+#include "includes.h"
+#include "algo.h"
+#include "dbutil.h"
+#include "chachapoly.h"
+
+#if DROPBEAR_CHACHA20POLY1305
+
+#define CHACHA20_KEY_LEN 32
+#define CHACHA20_BLOCKSIZE 8
+#define POLY1305_KEY_LEN 32
+#define POLY1305_TAG_LEN 16
+
+static const struct ltc_cipher_descriptor dummy = {.name = NULL};
+
+static const struct dropbear_hash dropbear_chachapoly_mac =
+ {NULL, POLY1305_KEY_LEN, POLY1305_TAG_LEN};
+
+const struct dropbear_cipher dropbear_chachapoly =
+ {&dummy, CHACHA20_KEY_LEN*2, CHACHA20_BLOCKSIZE};
+
+static int dropbear_chachapoly_start(int UNUSED(cipher), const unsigned char* UNUSED(IV),
+ const unsigned char *key, int keylen,
+ int UNUSED(num_rounds), dropbear_chachapoly_state *state) {
+ int err;
+
+ TRACE2(("enter dropbear_chachapoly_start"))
+
+ if (keylen != CHACHA20_KEY_LEN*2) {
+ return CRYPT_ERROR;
+ }
+
+ if ((err = chacha_setup(&state->chacha, key,
+ CHACHA20_KEY_LEN, 20)) != CRYPT_OK) {
+ return err;
+ }
+
+ if ((err = chacha_setup(&state->header, key + CHACHA20_KEY_LEN,
+ CHACHA20_KEY_LEN, 20) != CRYPT_OK)) {
+ return err;
+ }
+
+ TRACE2(("leave dropbear_chachapoly_start"))
+ return CRYPT_OK;
+}
+
+static int dropbear_chachapoly_crypt(unsigned int seq,
+ const unsigned char *in, unsigned char *out,
+ unsigned long len, unsigned long taglen,
+ dropbear_chachapoly_state *state, int direction) {
+ poly1305_state poly;
+ unsigned char seqbuf[8], key[POLY1305_KEY_LEN], tag[POLY1305_TAG_LEN];
+ int err;
+
+ TRACE2(("enter dropbear_chachapoly_crypt"))
+
+ if (len < 4 || taglen != POLY1305_TAG_LEN) {
+ return CRYPT_ERROR;
+ }
+
+ STORE64H((uint64_t)seq, seqbuf);
+ chacha_ivctr64(&state->chacha, seqbuf, sizeof(seqbuf), 0);
+ if ((err = chacha_keystream(&state->chacha, key, sizeof(key))) != CRYPT_OK) {
+ return err;
+ }
+
+ poly1305_init(&poly, key, sizeof(key));
+ if (direction == LTC_DECRYPT) {
+ poly1305_process(&poly, in, len);
+ poly1305_done(&poly, tag, &taglen);
+ if (constant_time_memcmp(in + len, tag, taglen) != 0) {
+ return CRYPT_ERROR;
+ }
+ }
+
+ chacha_ivctr64(&state->header, seqbuf, sizeof(seqbuf), 0);
+ if ((err = chacha_crypt(&state->header, in, 4, out)) != CRYPT_OK) {
+ return err;
+ }
+
+ chacha_ivctr64(&state->chacha, seqbuf, sizeof(seqbuf), 1);
+ if ((err = chacha_crypt(&state->chacha, in + 4, len - 4, out + 4)) != CRYPT_OK) {
+ return err;
+ }
+
+ if (direction == LTC_ENCRYPT) {
+ poly1305_process(&poly, out, len);
+ poly1305_done(&poly, out + len, &taglen);
+ }
+
+ TRACE2(("leave dropbear_chachapoly_crypt"))
+ return CRYPT_OK;
+}
+
+static int dropbear_chachapoly_getlength(unsigned int seq,
+ const unsigned char *in, unsigned int *outlen,
+ unsigned long len, dropbear_chachapoly_state *state) {
+ unsigned char seqbuf[8], buf[4];
+ int err;
+
+ TRACE2(("enter dropbear_chachapoly_getlength"))
+
+ if (len < sizeof(buf)) {
+ return CRYPT_ERROR;
+ }
+
+ STORE64H((uint64_t)seq, seqbuf);
+ chacha_ivctr64(&state->header, seqbuf, sizeof(seqbuf), 0);
+ if ((err = chacha_crypt(&state->header, in, sizeof(buf), buf)) != CRYPT_OK) {
+ return err;
+ }
+
+ LOAD32H(*outlen, buf);
+
+ TRACE2(("leave dropbear_chachapoly_getlength"))
+ return CRYPT_OK;
+}
+
+const struct dropbear_cipher_mode dropbear_mode_chachapoly =
+ {(void *)dropbear_chachapoly_start, NULL, NULL,
+ (void *)dropbear_chachapoly_crypt,
+ (void *)dropbear_chachapoly_getlength, &dropbear_chachapoly_mac};
+
+#endif /* DROPBEAR_CHACHA20POLY1305 */
diff --git a/chachapoly.h b/chachapoly.h
new file mode 100644
index 0000000..5a7c5b2
--- /dev/null
+++ b/chachapoly.h
@@ -0,0 +1,44 @@
+/*
+ * Dropbear SSH
+ *
+ * Copyright (c) 2002,2003 Matt Johnston
+ * Copyright (c) 2020 by Vladislav Grishenko
+ * All rights reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE. */
+
+#ifndef DROPBEAR_DROPBEAR_CHACHAPOLY_H_
+#define DROPBEAR_DROPBEAR_CHACHAPOLY_H_
+
+#include "includes.h"
+#include "algo.h"
+
+#if DROPBEAR_CHACHA20POLY1305
+
+typedef struct {
+ chacha_state chacha;
+ chacha_state header;
+} dropbear_chachapoly_state;
+
+extern const struct dropbear_cipher dropbear_chachapoly;
+extern const struct dropbear_cipher_mode dropbear_mode_chachapoly;
+
+#endif /* DROPBEAR_CHACHA20POLY1305 */
+
+#endif /* DROPBEAR_DROPBEAR_CHACHAPOLY_H_ */
diff --git a/common-algo.c b/common-algo.c
index 558aad2..1436456 100644
--- a/common-algo.c
+++ b/common-algo.c
@@ -30,6 +30,7 @@
#include "dh_groups.h"
#include "ltc_prng.h"
#include "ecc.h"
+#include "chachapoly.h"
/* This file (algo.c) organises the ciphers which can be used, and is used to
* decide which ciphers/hashes/compression/signing to use during key exchange*/
@@ -86,11 +87,11 @@ const struct dropbear_cipher dropbear_nocipher =
* about the symmetric_CBC vs symmetric_CTR cipher_state pointer */
#if DROPBEAR_ENABLE_CBC_MODE
const struct dropbear_cipher_mode dropbear_mode_cbc =
- {(void*)cbc_start, (void*)cbc_encrypt, (void*)cbc_decrypt};
+ {(void*)cbc_start, (void*)cbc_encrypt, (void*)cbc_decrypt, NULL, NULL, NULL};
#endif /* DROPBEAR_ENABLE_CBC_MODE */
const struct dropbear_cipher_mode dropbear_mode_none =
- {void_start, void_cipher, void_cipher};
+ {void_start, void_cipher, void_cipher, NULL, NULL, NULL};
#if DROPBEAR_ENABLE_CTR_MODE
/* a wrapper to make ctr_start and cbc_start look the same */
@@ -101,7 +102,7 @@ static int dropbear_big_endian_ctr_start(int cipher,
return ctr_start(cipher, IV, key, keylen, num_rounds, CTR_COUNTER_BIG_ENDIAN, ctr);
}
const struct dropbear_cipher_mode dropbear_mode_ctr =
- {(void*)dropbear_big_endian_ctr_start, (void*)ctr_encrypt, (void*)ctr_decrypt};
+ {(void*)dropbear_big_endian_ctr_start, (void*)ctr_encrypt, (void*)ctr_decrypt, NULL, NULL, NULL};
#endif /* DROPBEAR_ENABLE_CTR_MODE */
/* Mapping of ssh hashes to libtomcrypt hashes, including keysize etc.
@@ -137,6 +138,10 @@ const struct dropbear_hash dropbear_nohash =
* that is also supported by the server will get used. */
algo_type sshciphers[] = {
+#if DROPBEAR_CHACHA20POLY1305
+ {"chacha20-poly1305@openssh.com", 0, &dropbear_chachapoly, 1, &dropbear_mode_chachapoly},
+#endif
+
#if DROPBEAR_ENABLE_CTR_MODE
#if DROPBEAR_AES128
{"aes128-ctr", 0, &dropbear_aes128, 1, &dropbear_mode_ctr},
diff --git a/common-kex.c b/common-kex.c
index 16b7e27..5e2923f 100644
--- a/common-kex.c
+++ b/common-kex.c
@@ -329,9 +329,12 @@ static void gen_new_keys() {
hashkeys(S2C_key, sizeof(S2C_key), &hs, 'D');
if (ses.newkeys->recv.algo_crypt->cipherdesc != NULL) {
- int recv_cipher = find_cipher(ses.newkeys->recv.algo_crypt->cipherdesc->name);
- if (recv_cipher < 0)
- dropbear_exit("Crypto error");
+ int recv_cipher = -1;
+ if (ses.newkeys->recv.algo_crypt->cipherdesc->name != NULL) {
+ recv_cipher = find_cipher(ses.newkeys->recv.algo_crypt->cipherdesc->name);
+ if (recv_cipher < 0)
+ dropbear_exit("Crypto error");
+ }
if (ses.newkeys->recv.crypt_mode->start(recv_cipher,
recv_IV, recv_key,
ses.newkeys->recv.algo_crypt->keysize, 0,
@@ -341,9 +344,12 @@ static void gen_new_keys() {
}
if (ses.newkeys->trans.algo_crypt->cipherdesc != NULL) {
- int trans_cipher = find_cipher(ses.newkeys->trans.algo_crypt->cipherdesc->name);
- if (trans_cipher < 0)
- dropbear_exit("Crypto error");
+ int trans_cipher = -1;
+ if (ses.newkeys->trans.algo_crypt->cipherdesc->name != NULL) {
+ trans_cipher = find_cipher(ses.newkeys->trans.algo_crypt->cipherdesc->name);
+ if (trans_cipher < 0)
+ dropbear_exit("Crypto error");
+ }
if (ses.newkeys->trans.crypt_mode->start(trans_cipher,
trans_IV, trans_key,
ses.newkeys->trans.algo_crypt->keysize, 0,
@@ -868,19 +874,29 @@ static void read_kex_algos() {
/* mac_algorithms_client_to_server */
c2s_hash_algo = buf_match_algo(ses.payload, sshhashes, NULL, NULL);
+#if DROPBEAR_AEAD_MODE
+ if (((struct dropbear_cipher_mode*)c2s_cipher_algo->mode)->aead_crypt != NULL) {
+ c2s_hash_algo = NULL;
+ } else
+#endif
if (c2s_hash_algo == NULL) {
erralgo = "mac c->s";
goto error;
}
- TRACE(("hash c2s is %s", c2s_hash_algo->name))
+ TRACE(("hash c2s is %s", c2s_hash_algo ? c2s_hash_algo->name : "<implicit>"))
/* mac_algorithms_server_to_client */
s2c_hash_algo = buf_match_algo(ses.payload, sshhashes, NULL, NULL);
+#if DROPBEAR_AEAD_MODE
+ if (((struct dropbear_cipher_mode*)s2c_cipher_algo->mode)->aead_crypt != NULL) {
+ s2c_hash_algo = NULL;
+ } else
+#endif
if (s2c_hash_algo == NULL) {
erralgo = "mac s->c";
goto error;
}
- TRACE(("hash s2c is %s", s2c_hash_algo->name))
+ TRACE(("hash s2c is %s", s2c_hash_algo ? s2c_hash_algo->name : "<implicit>"))
/* compression_algorithms_client_to_server */
c2s_comp_algo = buf_match_algo(ses.payload, ses.compress_algos, NULL, NULL);
@@ -925,8 +941,14 @@ static void read_kex_algos() {
ses.newkeys->trans.crypt_mode =
(struct dropbear_cipher_mode*)c2s_cipher_algo->mode;
ses.newkeys->recv.algo_mac =
+#if DROPBEAR_AEAD_MODE
+ s2c_hash_algo == NULL ? ses.newkeys->recv.crypt_mode->aead_mac :
+#endif
(struct dropbear_hash*)s2c_hash_algo->data;
ses.newkeys->trans.algo_mac =
+#if DROPBEAR_AEAD_MODE
+ c2s_hash_algo == NULL ? ses.newkeys->trans.crypt_mode->aead_mac :
+#endif
(struct dropbear_hash*)c2s_hash_algo->data;
ses.newkeys->recv.algo_comp = s2c_comp_algo->val;
ses.newkeys->trans.algo_comp = c2s_comp_algo->val;
@@ -941,8 +963,14 @@ static void read_kex_algos() {
ses.newkeys->trans.crypt_mode =
(struct dropbear_cipher_mode*)s2c_cipher_algo->mode;
ses.newkeys->recv.algo_mac =
+#if DROPBEAR_AEAD_MODE
+ c2s_hash_algo == NULL ? ses.newkeys->recv.crypt_mode->aead_mac :
+#endif
(struct dropbear_hash*)c2s_hash_algo->data;
ses.newkeys->trans.algo_mac =
+#if DROPBEAR_AEAD_MODE
+ s2c_hash_algo == NULL ? ses.newkeys->trans.crypt_mode->aead_mac :
+#endif
(struct dropbear_hash*)s2c_hash_algo->data;
ses.newkeys->recv.algo_comp = c2s_comp_algo->val;
ses.newkeys->trans.algo_comp = s2c_comp_algo->val;
diff --git a/default_options.h b/default_options.h
index bafbb07..1a2ab10 100644
--- a/default_options.h
+++ b/default_options.h
@@ -99,6 +99,12 @@ IMPORTANT: Some options will require "make clean" after changes */
* and forwards compatibility */
#define DROPBEAR_ENABLE_CTR_MODE 1
+/* Enable Chacha20-Poly1305 authenticated encryption mode. This is
+ * generally faster than AES256 on CPU w/o dedicated AES instructions,
+ * having the same key size.
+ * Compiling in will add ~5,5kB to binary size on x86-64 */
+#define DROPBEAR_CHACHA20POLY1305 1
+
/* Message integrity. sha2-256 is recommended as a default,
sha1 for compatibility */
#define DROPBEAR_SHA1_HMAC 1
diff --git a/libtomcrypt/src/headers/tomcrypt_dropbear.h b/libtomcrypt/src/headers/tomcrypt_dropbear.h
index b0ce45b..59960e5 100644
--- a/libtomcrypt/src/headers/tomcrypt_dropbear.h
+++ b/libtomcrypt/src/headers/tomcrypt_dropbear.h
@@ -35,6 +35,10 @@
#define LTC_CTR_MODE
#endif
+#if DROPBEAR_CHACHA20POLY1305
+#define LTC_CHACHA
+#define LTC_POLY1305
+#endif
#if DROPBEAR_SHA512
#define LTC_SHA512
diff --git a/packet.c b/packet.c
index 9fda0d6..0454726 100644
--- a/packet.c
+++ b/packet.c
@@ -215,7 +215,7 @@ static int read_packet_init() {
unsigned int maxlen;
int slen;
- unsigned int len;
+ unsigned int len, plen;
unsigned int blocksize;
unsigned int macsize;
@@ -254,21 +254,35 @@ static int read_packet_init() {
/* now we have the first block, need to get packet length, so we decrypt
* the first block (only need first 4 bytes) */
buf_setpos(ses.readbuf, 0);
- if (ses.keys->recv.crypt_mode->decrypt(buf_getptr(ses.readbuf, blocksize),
- buf_getwriteptr(ses.readbuf, blocksize),
- blocksize,
- &ses.keys->recv.cipher_state) != CRYPT_OK) {
- dropbear_exit("Error decrypting");
+#if DROPBEAR_AEAD_MODE
+ if (ses.keys->recv.crypt_mode->aead_crypt) {
+ if (ses.keys->recv.crypt_mode->aead_getlength(ses.recvseq,
+ buf_getptr(ses.readbuf, blocksize), &plen,
+ blocksize,
+ &ses.keys->recv.cipher_state) != CRYPT_OK) {
+ dropbear_exit("Error decrypting");
+ }
+ len = plen + 4 + macsize;
+ } else
+#endif
+ {
+ if (ses.keys->recv.crypt_mode->decrypt(buf_getptr(ses.readbuf, blocksize),
+ buf_getwriteptr(ses.readbuf, blocksize),
+ blocksize,
+ &ses.keys->recv.cipher_state) != CRYPT_OK) {
+ dropbear_exit("Error decrypting");
+ }
+ plen = buf_getint(ses.readbuf) + 4;
+ len = plen + macsize;
}
- len = buf_getint(ses.readbuf) + 4 + macsize;
TRACE2(("packet size is %u, block %u mac %u", len, blocksize, macsize))
/* check packet length */
if ((len > RECV_MAX_PACKET_LEN) ||
- (len < MIN_PACKET_LEN + macsize) ||
- ((len - macsize) % blocksize != 0)) {
+ (plen < blocksize) ||
+ (plen % blocksize != 0)) {
dropbear_exit("Integrity error (bad packet size %u)", len);
}
@@ -294,23 +308,42 @@ void decrypt_packet() {
ses.kexstate.datarecv += ses.readbuf->len;
- /* we've already decrypted the first blocksize in read_packet_init */
- buf_setpos(ses.readbuf, blocksize);
-
- /* decrypt it in-place */
- len = ses.readbuf->len - macsize - ses.readbuf->pos;
- if (ses.keys->recv.crypt_mode->decrypt(
- buf_getptr(ses.readbuf, len),
- buf_getwriteptr(ses.readbuf, len),
- len,
- &ses.keys->recv.cipher_state) != CRYPT_OK) {
- dropbear_exit("Error decrypting");
- }
- buf_incrpos(ses.readbuf, len);
+#if DROPBEAR_AEAD_MODE
+ if (ses.keys->recv.crypt_mode->aead_crypt) {
+ /* first blocksize is not decrypted yet */
+ buf_setpos(ses.readbuf, 0);
+
+ /* decrypt it in-place */
+ len = ses.readbuf->len - macsize - ses.readbuf->pos;
+ if (ses.keys->recv.crypt_mode->aead_crypt(ses.recvseq,
+ buf_getptr(ses.readbuf, len + macsize),
+ buf_getwriteptr(ses.readbuf, len),
+ len, macsize,
+ &ses.keys->recv.cipher_state, LTC_DECRYPT) != CRYPT_OK) {
+ dropbear_exit("Error decrypting");
+ }
+ buf_incrpos(ses.readbuf, len);
+ } else
+#endif
+ {
+ /* we've already decrypted the first blocksize in read_packet_init */
+ buf_setpos(ses.readbuf, blocksize);
+
+ /* decrypt it in-place */
+ len = ses.readbuf->len - macsize - ses.readbuf->pos;
+ if (ses.keys->recv.crypt_mode->decrypt(
+ buf_getptr(ses.readbuf, len),
+ buf_getwriteptr(ses.readbuf, len),
+ len,
+ &ses.keys->recv.cipher_state) != CRYPT_OK) {
+ dropbear_exit("Error decrypting");
+ }
+ buf_incrpos(ses.readbuf, len);
- /* check the hmac */
- if (checkmac() != DROPBEAR_SUCCESS) {
- dropbear_exit("Integrity error");
+ /* check the hmac */
+ if (checkmac() != DROPBEAR_SUCCESS) {
+ dropbear_exit("Integrity error");
+ }
}
/* get padding length */
@@ -557,9 +590,16 @@ void encrypt_packet() {
buf_setpos(ses.writepayload, 0);
buf_setlen(ses.writepayload, 0);
- /* length of padding - packet length must be a multiple of blocksize,
- * with a minimum of 4 bytes of padding */
- padlen = blocksize - (writebuf->len) % blocksize;
+ /* length of padding - packet length excluding the packetlength uint32
+ * field in aead mode must be a multiple of blocksize, with a minimum of
+ * 4 bytes of padding */
+ len = writebuf->len;
+#if DROPBEAR_AEAD_MODE
+ if (ses.keys->trans.crypt_mode->aead_crypt) {
+ len -= 4;
+ }
+#endif
+ padlen = blocksize - len % blocksize;
if (padlen < 4) {
padlen += blocksize;
}
@@ -579,23 +619,42 @@ void encrypt_packet() {
buf_incrlen(writebuf, padlen);
genrandom(buf_getptr(writebuf, padlen), padlen);
- make_mac(ses.transseq, &ses.keys->trans, writebuf, writebuf->len, mac_bytes);
+#if DROPBEAR_AEAD_MODE
+ if (ses.keys->trans.crypt_mode->aead_crypt) {
+ /* do the actual encryption, in-place */
+ buf_setpos(writebuf, 0);
+ /* encrypt it in-place*/
+ len = writebuf->len;
+ buf_incrlen(writebuf, mac_size);
+ if (ses.keys->trans.crypt_mode->aead_crypt(ses.transseq,
+ buf_getptr(writebuf, len),
+ buf_getwriteptr(writebuf, len + mac_size),
+ len, mac_size,
+ &ses.keys->trans.cipher_state, LTC_ENCRYPT) != CRYPT_OK) {
+ dropbear_exit("Error encrypting");
+ }
+ buf_incrpos(writebuf, len + mac_size);
+ } else
+#endif
+ {
+ make_mac(ses.transseq, &ses.keys->trans, writebuf, writebuf->len, mac_bytes);
+
+ /* do the actual encryption, in-place */
+ buf_setpos(writebuf, 0);
+ /* encrypt it in-place*/
+ len = writebuf->len;
+ if (ses.keys->trans.crypt_mode->encrypt(
+ buf_getptr(writebuf, len),
+ buf_getwriteptr(writebuf, len),
+ len,
+ &ses.keys->trans.cipher_state) != CRYPT_OK) {
+ dropbear_exit("Error encrypting");
+ }
+ buf_incrpos(writebuf, len);
- /* do the actual encryption, in-place */
- buf_setpos(writebuf, 0);
- /* encrypt it in-place*/
- len = writebuf->len;
- if (ses.keys->trans.crypt_mode->encrypt(
- buf_getptr(writebuf, len),
- buf_getwriteptr(writebuf, len),
- len,
- &ses.keys->trans.cipher_state) != CRYPT_OK) {
- dropbear_exit("Error encrypting");
+ /* stick the MAC on it */
+ buf_putbytes(writebuf, mac_bytes, mac_size);
}
- buf_incrpos(writebuf, len);
-
- /* stick the MAC on it */
- buf_putbytes(writebuf, mac_bytes, mac_size);
/* Update counts */
ses.kexstate.datatrans += writebuf->len;
diff --git a/session.h b/session.h
index e436882..a8f8914 100644
--- a/session.h
+++ b/session.h
@@ -41,6 +41,7 @@
#include "chansession.h"
#include "dbutil.h"
#include "netio.h"
+#include "chachapoly.h"
void common_session_init(int sock_in, int sock_out);
void session_loop(void(*loophandler)(void)) ATTRIB_NORETURN;
@@ -80,6 +81,9 @@ struct key_context_directional {
symmetric_CBC cbc;
#if DROPBEAR_ENABLE_CTR_MODE
symmetric_CTR ctr;
+#endif
+#if DROPBEAR_CHACHA20POLY1305
+ dropbear_chachapoly_state chachapoly;
#endif
} cipher_state;
unsigned char mackey[MAX_MAC_LEN];
diff --git a/sysoptions.h b/sysoptions.h
index 2c27caf..2432779 100644
--- a/sysoptions.h
+++ b/sysoptions.h
@@ -92,7 +92,11 @@
#define MD5_HASH_SIZE 16
#define MAX_HASH_SIZE 64 /* sha512 */
+#if DROPBEAR_CHACHA20POLY1305
+#define MAX_KEY_LEN 64 /* 2 x 256 bits for chacha20 */
+#else
#define MAX_KEY_LEN 32 /* 256 bits for aes256 etc */
+#endif
#define MAX_IV_LEN 20 /* must be same as max blocksize, */
#if DROPBEAR_SHA2_512_HMAC
@@ -207,6 +211,8 @@ If you test it please contact the Dropbear author */
#define DROPBEAR_TWOFISH ((DROPBEAR_TWOFISH256) || (DROPBEAR_TWOFISH128))
+#define DROPBEAR_AEAD_MODE ((DROPBEAR_CHACHA20POLY1305))
+
#define DROPBEAR_CLI_ANYTCPFWD ((DROPBEAR_CLI_REMOTETCPFWD) || (DROPBEAR_CLI_LOCALTCPFWD))
#define DROPBEAR_TCP_ACCEPT ((DROPBEAR_CLI_LOCALTCPFWD) || (DROPBEAR_SVR_REMOTETCPFWD))
@@ -249,7 +255,7 @@ If you test it please contact the Dropbear author */
#endif
#if !(DROPBEAR_AES128 || DROPBEAR_3DES || DROPBEAR_AES256 || DROPBEAR_BLOWFISH \
- || DROPBEAR_TWOFISH256 || DROPBEAR_TWOFISH128)
+ || DROPBEAR_TWOFISH256 || DROPBEAR_TWOFISH128 || DROPBEAR_CHACHA20POLY1305)
#error "At least one encryption algorithm must be enabled. AES128 is recommended."
#endif
--
2.17.1

@ -1,6 +1,6 @@
--- a/svr-authpubkey.c
+++ b/svr-authpubkey.c
@@ -338,14 +338,19 @@ static int checkpubkey(const char* algo,
@@ -386,14 +386,19 @@ static int checkpubkey(const char* keyal
goto out;
}
@ -28,7 +28,7 @@
#if DROPBEAR_SVR_MULTIUSER
/* open the file as the authenticating user. */
@@ -426,27 +431,36 @@ static int checkpubkeyperms() {
@@ -474,27 +479,36 @@ static int checkpubkeyperms() {
goto out;
}

@ -1,6 +1,6 @@
--- a/svr-chansession.c
+++ b/svr-chansession.c
@@ -953,12 +953,12 @@ static void execchild(const void *user_d
@@ -950,12 +950,12 @@ static void execchild(const void *user_d
/* We can only change uid/gid as root ... */
if (getuid() == 0) {

@ -1,11 +1,11 @@
--- a/Makefile.in
+++ b/Makefile.in
@@ -189,17 +189,17 @@ dropbearkey: $(dropbearkeyobjs)
@@ -199,17 +199,17 @@ dropbearkey: $(dropbearkeyobjs)
dropbearconvert: $(dropbearconvertobjs)
dropbear: $(HEADERS) $(LIBTOM_DEPS) Makefile
- $(CC) $(LDFLAGS) -o $@$(EXEEXT) $($@objs) $(LIBTOM_LIBS) $(LIBS) @CRYPTLIB@
+ +$(CC) $(LDFLAGS) -o $@$(EXEEXT) $($@objs) $(LIBTOM_LIBS) $(LIBS) @CRYPTLIB@
- $(CC) $(LDFLAGS) -o $@$(EXEEXT) $($@objs) $(LIBTOM_LIBS) $(LIBS) @CRYPTLIB@ $(PLUGIN_LIBS)
+ +$(CC) $(LDFLAGS) -o $@$(EXEEXT) $($@objs) $(LIBTOM_LIBS) $(LIBS) @CRYPTLIB@ $(PLUGIN_LIBS)
dbclient: $(HEADERS) $(LIBTOM_DEPS) Makefile
- $(CC) $(LDFLAGS) -o $@$(EXEEXT) $($@objs) $(LIBTOM_LIBS) $(LIBS)
@ -22,7 +22,7 @@
# multi-binary compilation.
@@ -210,7 +210,7 @@ ifeq ($(MULTI),1)
@@ -220,7 +220,7 @@ ifeq ($(MULTI),1)
endif
dropbearmulti$(EXEEXT): $(HEADERS) $(MULTIOBJS) $(LIBTOM_DEPS) Makefile

@ -1,6 +1,6 @@
--- a/libtomcrypt/makefile_include.mk
+++ b/libtomcrypt/makefile_include.mk
@@ -75,6 +75,13 @@ endif
@@ -94,6 +94,13 @@ endif
LTC_CFLAGS += -Wno-type-limits
@ -14,7 +14,7 @@
ifdef LTC_DEBUG
$(info Debug build)
# compile for DEBUGGING (required for ccmalloc checking!!!)
@@ -102,6 +109,9 @@ endif
@@ -121,6 +128,9 @@ endif
endif # COMPILE_SMALL
endif # COMPILE_DEBUG
@ -26,8 +26,8 @@
LTC_CFLAGS += -Wno-typedef-redefinition -Wno-tautological-compare -Wno-builtin-requires-header -Wno-missing-field-initializers
--- a/libtommath/makefile_include.mk
+++ b/libtommath/makefile_include.mk
@@ -37,6 +37,9 @@ CFLAGS += -Wsystem-headers -Wdeclaration
CFLAGS += -Wstrict-prototypes -Wpointer-arith
@@ -70,6 +70,9 @@ else
LTM_CFLAGS += -Wsystem-headers
endif
+ifndef OPENWRT_BUILD
@ -35,14 +35,14 @@
+
ifdef COMPILE_DEBUG
#debug
CFLAGS += -g3
@@ -58,6 +61,9 @@ endif
LTM_CFLAGS += -g3
@@ -90,6 +93,9 @@ endif
endif # COMPILE_SIZE
endif # COMPILE_DEBUG
+ ### ! OPENWRT_BUILD
+endif
+
ifneq ($(findstring clang,$(CC)),)
CFLAGS += -Wno-typedef-redefinition -Wno-tautological-compare -Wno-builtin-requires-header
LTM_CFLAGS += -Wno-typedef-redefinition -Wno-tautological-compare -Wno-builtin-requires-header
endif

Loading…
Cancel
Save