mirror of
https://github.com/apache/nuttx-apps.git
synced 2026-08-01 20:29:00 +00:00
355d090d83
Replace the bundled libtomcrypt chacha20-poly1305 implementation with an adapter that drives the NuttX crypto device: the SSH construction maps onto CRYPTO_CHACHA20_DJB (the original 64-bit counter/nonce ChaCha20 parameterization used by chacha20-poly1305@openssh.com) for the packet length and payload streams, and onto CRYPTO_POLY1305 for the authentication tag (plain MACs are driven in two steps through /dev/crypto: COP_FLAG_UPDATE feeds the data, a final call retrieves the tag). Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
157 lines
4.9 KiB
Text
157 lines
4.9 KiB
Text
#
|
|
# For a description of the syntax of this configuration file,
|
|
# see the file kconfig-language.txt in the NuttX tools repository.
|
|
#
|
|
|
|
menuconfig NETUTILS_DROPBEAR
|
|
tristate "Dropbear SSH server"
|
|
default n
|
|
depends on NET && NET_TCP
|
|
depends on !DISABLE_PSEUDOFS_OPERATIONS
|
|
depends on !DISABLE_PTHREAD
|
|
depends on SCHED_WAITPID
|
|
depends on SCHED_HAVE_PARENT
|
|
depends on SCHED_CHILD_STATUS
|
|
depends on NSH_LIBRARY
|
|
depends on FSUTILS_PASSWD
|
|
depends on PSEUDOTERM
|
|
depends on SERIAL
|
|
depends on DEV_URANDOM
|
|
depends on LIBC_NETDB
|
|
depends on LIBC_GAISTRERROR
|
|
depends on CRYPTO
|
|
depends on CRYPTO_RANDOM_POOL
|
|
depends on ALLOW_BSD_COMPONENTS
|
|
depends on CRYPTO_CRYPTODEV
|
|
depends on CRYPTO_CRYPTODEV_SOFTWARE_CRYPTO
|
|
---help---
|
|
Enable a minimal Dropbear SSH server port for NuttX. This initial
|
|
port is based on the ESP-IDF MCU test port and provides a single
|
|
foreground SSH server process with SSH sessions backed by NSH.
|
|
|
|
The port computes the hmac-sha2-256 packet MAC through the NuttX
|
|
crypto device (/dev/crypto, CRYPTO_SHA2_256_HMAC) instead of the
|
|
bundled libtomcrypt implementation, which is dropped from the
|
|
build. The SHA-256 hash descriptor itself stays in the
|
|
application: Dropbear's key derivation clones partially-updated
|
|
hash states (hashkeys() in common-kex.c), which cannot be
|
|
represented by a kernel crypto session.
|
|
|
|
The port also implements the chacha20-poly1305@openssh.com cipher
|
|
through the NuttX crypto device (/dev/crypto), using the
|
|
CRYPTO_CHACHA20_DJB and CRYPTO_POLY1305 algorithms instead of
|
|
the bundled libtomcrypt implementation, which is dropped from
|
|
the build.
|
|
|
|
if NETUTILS_DROPBEAR
|
|
|
|
config NETUTILS_DROPBEAR_STACKSIZE
|
|
int "Dropbear main stack size"
|
|
default 65536
|
|
---help---
|
|
Stack size for the Dropbear server built-in.
|
|
This is architecture-specific, so adjust it according to your setup.
|
|
|
|
config NETUTILS_DROPBEAR_PRIORITY
|
|
int "Dropbear main priority"
|
|
default 100
|
|
|
|
config NETUTILS_DROPBEAR_SHELL_PRIORITY
|
|
int "Dropbear NSH session priority"
|
|
default 100
|
|
|
|
config NETUTILS_DROPBEAR_PROGNAME
|
|
string "Dropbear program name"
|
|
default "dropbear"
|
|
---help---
|
|
This is the name of the program that will be used when the NSH ELF
|
|
program is installed.
|
|
|
|
config NETUTILS_DROPBEAR_LISTEN_RETRIES
|
|
int "Dropbear listen retries"
|
|
default 0
|
|
---help---
|
|
Number of times to retry listen setup when no listen socket could
|
|
be opened. Zero means to retry forever.
|
|
|
|
config NETUTILS_DROPBEAR_LISTEN_RETRY_MAX
|
|
int "Dropbear maximum listen retry interval"
|
|
default 120
|
|
range 1 3600
|
|
---help---
|
|
Maximum number of seconds to wait between listen setup retries.
|
|
The retry delay starts at one second and doubles until it reaches
|
|
this value.
|
|
|
|
config NETUTILS_DROPBEAR_SHELL_STACKSIZE
|
|
int "Dropbear NSH session task stack size"
|
|
default 8192
|
|
|
|
config NETUTILS_DROPBEAR_SCP
|
|
bool "Enable scp remote copy helper"
|
|
default y
|
|
depends on PIPES
|
|
---help---
|
|
Build Dropbear's scp program and allow SSH exec requests so a host
|
|
scp client can copy files to and from NuttX using the legacy scp
|
|
protocol. This does not build a full SSH client for initiating scp
|
|
transfers from the target.
|
|
|
|
config NETUTILS_DROPBEAR_SCP_STACKSIZE
|
|
int "Dropbear scp stack size"
|
|
default 32768
|
|
depends on NETUTILS_DROPBEAR_SCP
|
|
|
|
config NETUTILS_DROPBEAR_SCP_PRIORITY
|
|
int "Dropbear scp priority"
|
|
default 100
|
|
depends on NETUTILS_DROPBEAR_SCP
|
|
|
|
config NETUTILS_DROPBEAR_PORT
|
|
int "Dropbear listen port"
|
|
default 2222
|
|
|
|
config NETUTILS_DROPBEAR_HOSTKEY_PATH
|
|
string "Dropbear ECDSA P-256 host key path"
|
|
default "/etc/dropbear/dropbear_ecdsa_host_key"
|
|
---help---
|
|
Path to the persistent ECDSA P-256 host key used by the Dropbear
|
|
server. The file is stored in Dropbear's native host key format.
|
|
|
|
config NETUTILS_DROPBEAR_GENERATE_HOSTKEY
|
|
bool "Generate host key if missing"
|
|
default y
|
|
---help---
|
|
Pass -R so Dropbear generates an ECDSA P-256 host key on demand and
|
|
persists it at NETUTILS_DROPBEAR_HOSTKEY_PATH when it does not exist.
|
|
Product builds can disable this and provision the host key
|
|
externally (loaded with -r).
|
|
|
|
config NETUTILS_DROPBEAR_COMPRESSION
|
|
bool "Enable SSH compression (zlib)"
|
|
default n
|
|
depends on LIB_ZLIB
|
|
---help---
|
|
Enable zlib compression for SSH sessions. Requires the zlib
|
|
library (LIB_ZLIB). When disabled, Dropbear is built with
|
|
DISABLE_ZLIB and negotiates no compression.
|
|
|
|
WARNING: each session allocates a zlib deflate state of about
|
|
256 KiB (DROPBEAR_ZLIB_WINDOW_BITS=15, DROPBEAR_ZLIB_MEM_LEVEL=8),
|
|
and the state is allocated even for the delayed zlib@openssh.com
|
|
method, right after key exchange.
|
|
|
|
config NETUTILS_DROPBEAR_SYSLOG
|
|
bool "Log via syslog"
|
|
default n
|
|
---help---
|
|
Route Dropbear log messages through syslog(). When disabled,
|
|
Dropbear is built with DISABLE_SYSLOG.
|
|
|
|
config NETUTILS_DROPBEAR_COMMIT
|
|
string "Dropbear upstream commit"
|
|
default "54ef47adf8c99b422be6a8f694f2866e62f88b9e"
|
|
---help---
|
|
Upstream Dropbear (mkj/dropbear) commit to download and build.
|
|
|
|
endif
|