[OE-core][PATCH] dropbear: Enable x11 forwarding

[OE-core][PATCH] dropbear: Enable x11 forwarding

[Daniel Gomez]

Enable X11 forwarding whenever X11 is part of the DISTRO_FEATURES.

Add backport patch to fix X11 forwarding in the current 2022.82
version.

Signed-off-by: Daniel Gomez <daniel@qtec.com>
---
 meta/recipes-core/dropbear/dropbear.inc       |  5 ++-
 ...d-failure-use-DROPBEAR_PRIO_LOWDELAY.patch | 27 ++++++++++++++++
 ...efault_options-Enable-x11-forwarding.patch | 32 +++++++++++++++++++
 3 files changed, 63 insertions(+), 1 deletion(-)
 create mode 100644 meta/recipes-core/dropbear/dropbear/0007-Fix-X11-build-failure-use-DROPBEAR_PRIO_LOWDELAY.patch
 create mode 100644 meta/recipes-core/dropbear/dropbear/0008-default_options-Enable-x11-forwarding.patch

diff --git a/meta/recipes-core/dropbear/dropbear.inc b/meta/recipes-core/dropbear/dropbear.inc
index e170587d08..7ee808db61 100644
--- a/meta/recipes-core/dropbear/dropbear.inc
+++ b/meta/recipes-core/dropbear/dropbear.inc
@@ -22,7 +22,10 @@ SRC_URI = "http://matt.ucc.asn.au/dropbear/releases/dropbear-${PV}.tar.bz2 \
            file://dropbear.socket \
            file://dropbear.default \
            ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', '', d)} \
-           ${@bb.utils.contains('PACKAGECONFIG', 'disable-weak-ciphers', 'file://dropbear-disable-weak-ciphers.patch', '', d)} "
+           ${@bb.utils.contains('PACKAGECONFIG', 'disable-weak-ciphers', 'file://dropbear-disable-weak-ciphers.patch', '', d)} \
+           ${@bb.utils.contains('DISTRO_FEATURES', 'x11', ' \
+                file://0007-Fix-X11-build-failure-use-DROPBEAR_PRIO_LOWDELAY.patch \
+                file://0008-default_options-Enable-x11-forwarding.patch', '', d)}"

 PAM_SRC_URI = "file://0005-dropbear-enable-pam.patch \
                file://0006-dropbear-configuration-file.patch \
diff --git a/meta/recipes-core/dropbear/dropbear/0007-Fix-X11-build-failure-use-DROPBEAR_PRIO_LOWDELAY.patch b/meta/recipes-core/dropbear/dropbear/0007-Fix-X11-build-failure-use-DROPBEAR_PRIO_LOWDELAY.patch
new file mode 100644
index 0000000000..994bbdd42a
--- /dev/null
+++ b/meta/recipes-core/dropbear/dropbear/0007-Fix-X11-build-failure-use-DROPBEAR_PRIO_LOWDELAY.patch
@@ -0,0 +1,27 @@
+From 0292aacdf0aa57d03f2a3ab7e53cf650e6f29389 Mon Sep 17 00:00:00 2001
+From: Matt Johnston <matt@ucc.asn.au>
+Date: Sat, 23 Apr 2022 22:33:31 +0800
+Subject: [PATCH] Fix X11 build failure, use DROPBEAR_PRIO_LOWDELAY
+
+Upstream-Status: Backport
+
+---
+ svr-x11fwd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/svr-x11fwd.c b/svr-x11fwd.c
+index 353cb12..5d9e6a9 100644
+--- a/svr-x11fwd.c
++++ b/svr-x11fwd.c
+@@ -206,7 +206,7 @@ void x11cleanup(struct ChanSess *chansess) {
+ }
+
+ static int x11_inithandler(struct Channel *channel) {
+-	channel->prio = DROPBEAR_CHANNEL_PRIO_INTERACTIVE;
++	channel->prio = DROPBEAR_PRIO_LOWDELAY;
+ 	return 0;
+ }
+
+--
+2.35.1
+
diff --git a/meta/recipes-core/dropbear/dropbear/0008-default_options-Enable-x11-forwarding.patch b/meta/recipes-core/dropbear/dropbear/0008-default_options-Enable-x11-forwarding.patch
new file mode 100644
index 0000000000..b604c0e850
--- /dev/null
+++ b/meta/recipes-core/dropbear/dropbear/0008-default_options-Enable-x11-forwarding.patch
@@ -0,0 +1,32 @@
+From bbdd4e27431df123e9f39c5fea6d1a90e90a4385 Mon Sep 17 00:00:00 2001
+From: Daniel Gomez <daniel@qtec.com>
+Date: Wed, 20 Jul 2022 18:07:51 +0200
+Subject: [PATCH] default_options: Enable x11 forwarding
+
+Activate dropbear X11 forwarding feature.
+
+Disabled by default at rev: a27e8b053e520117b20993b8e51103c5bd22da8c
+
+Upstream-Status: Inappropriate [configuration]
+
+Signed-off-by: Daniel Gomez <daniel@qtec.com>
+---
+ default_options.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/default_options.h b/default_options.h
+index 1a6a911..cd637a1 100644
+--- a/default_options.h
++++ b/default_options.h
+@@ -60,7 +60,7 @@ IMPORTANT: Some options will require "make clean" after changes */
+ #define DROPBEAR_SMALL_CODE 1
+
+ /* Enable X11 Forwarding - server only */
+-#define DROPBEAR_X11FWD 0
++#define DROPBEAR_X11FWD 1
+
+ /* Enable TCP Fowarding */
+ /* 'Local' is "-L" style (client listening port forwarded via server)
+--
+2.35.1
+
--
2.35.1

Re: [OE-core][PATCH] dropbear: Enable x11 forwarding

[Ross Burton]

> On 20 Jul 2022, at 20:44, Daniel Gomez via lists.openembedded.org <daniel=qtec.com@lists.openembedded.org> wrote:
> +           ${@bb.utils.contains('DISTRO_FEATURES', 'x11', ' \
> +                file://0007-Fix-X11-build-failure-use-DROPBEAR_PRIO_LOWDELAY.patch \

This patch should be always applied, as it doesn’t cause any breakage when applied if not used.  Patches which are conditional tend to cause breakage when they’re not always applied.

> +                file://0008-default_options-Enable-x11-forwarding.patch', '', d)}”

This should be a PACKAGECONFIG instead of a forced on/off based on DISTRO_FEATURES.

Upstreaming a configure option to expose this as —enable-x-forwarding would be great, but for now you can easily sed this file as needed based on the value of PACKAGECONFIG.

Ross

Re: [OE-core][PATCH] dropbear: Enable x11 forwarding

[Daniel Gomez]

On Thu, 21 Jul 2022 at 11:13, Ross Burton <Ross.Burton@arm.com> wrote:
>
>
> > On 20 Jul 2022, at 20:44, Daniel Gomez via lists.openembedded.org <daniel=qtec.com@lists.openembedded.org> wrote:
> > +           ${@bb.utils.contains('DISTRO_FEATURES', 'x11', ' \
> > +                file://0007-Fix-X11-build-failure-use-DROPBEAR_PRIO_LOWDELAY.patch \
>
> This patch should be always applied, as it doesn’t cause any breakage when applied if not used.  Patches which are conditional tend to cause breakage when they’re not always applied.
>
> > +                file://0008-default_options-Enable-x11-forwarding.patch', '', d)}”
>
> This should be a PACKAGECONFIG instead of a forced on/off based on DISTRO_FEATURES.
>
> Upstreaming a configure option to expose this as —enable-x-forwarding would be great, but for now you can easily sed this file as needed based on the value of PACKAGECONFIG.

Thanks Ross for the review. I'll send a v2 with the changes and look
into the upstream option.
>
> Ross

Re: [OE-core][PATCH] dropbear: Enable x11 forwarding

[Matt Johnston]

On Thu, 2022-07-21 at 09:12 +0000, Ross Burton wrote:
> > On 20 Jul 2022, at 20:44, Daniel Gomez via lists.openembedded.org
> > <daniel=qtec.com@lists.openembedded.org> wrote:
> > +               
> > file://0008-default_options-Enable-x11-forwarding.patch', '', d)}”
> 
> This should be a PACKAGECONFIG instead of a forced on/off based on
> DISTRO_FEATURES.
> 
> Upstreaming a configure option to expose this as —enable-x-forwarding would
> be great, but for now you can easily sed this file as needed based on the
> value of PACKAGECONFIG.

The upstream method for Dropbear configuration is #define entries in a
localoptions.h file.  default_options.h should be left untouched.  Adding it
to CFLAGS for configure would also work, as 

./configure CFLAGS="-Os -Wall -DDROPBEAR_X11FWD=1"

Cheers,
Matt
(Dropbear upstream)

Re: [OE-core][PATCH] dropbear: Enable x11 forwarding

[Ross Burton]

On 25 Jul 2022, at 04:11, Matt Johnston <matt@codeconstruct.com.au> wrote:
> The upstream method for Dropbear configuration is #define entries in a
> localoptions.h file.  default_options.h should be left untouched.  Adding it
> to CFLAGS for configure would also work, as 
> 
> ./configure CFLAGS="-Os -Wall -DDROPBEAR_X11FWD=1”

Perfect, thanks Matt!

Ross

[OE-core][PATCH] dropbear: Add enable-x11-forwarding PACKAGECONFIG option

[Daniel Gomez]

Add the option to enable X11 forwarding in dropbear with a new
PACKAGECONFIG option ('enable-x11-forwarding'). Method uses CFLAGS to
configure it.

Add backport patch to fix X11 forwarding in the current 2022.82
version.

Signed-off-by: Daniel Gomez <daniel@qtec.com>
---
 ...d-failure-use-DROPBEAR_PRIO_LOWDELAY.patch | 27 +++++++++++++++++++
 .../recipes-core/dropbear/dropbear_2022.82.bb |  7 ++++-
 2 files changed, 33 insertions(+), 1 deletion(-)
 create mode 100644 meta/recipes-core/dropbear/dropbear/0007-Fix-X11-build-failure-use-DROPBEAR_PRIO_LOWDELAY.patch

diff --git a/meta/recipes-core/dropbear/dropbear/0007-Fix-X11-build-failure-use-DROPBEAR_PRIO_LOWDELAY.patch b/meta/recipes-core/dropbear/dropbear/0007-Fix-X11-build-failure-use-DROPBEAR_PRIO_LOWDELAY.patch
new file mode 100644
index 0000000000..994bbdd42a
--- /dev/null
+++ b/meta/recipes-core/dropbear/dropbear/0007-Fix-X11-build-failure-use-DROPBEAR_PRIO_LOWDELAY.patch
@@ -0,0 +1,27 @@
+From 0292aacdf0aa57d03f2a3ab7e53cf650e6f29389 Mon Sep 17 00:00:00 2001
+From: Matt Johnston <matt@ucc.asn.au>
+Date: Sat, 23 Apr 2022 22:33:31 +0800
+Subject: [PATCH] Fix X11 build failure, use DROPBEAR_PRIO_LOWDELAY
+
+Upstream-Status: Backport
+
+---
+ svr-x11fwd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/svr-x11fwd.c b/svr-x11fwd.c
+index 353cb12..5d9e6a9 100644
+--- a/svr-x11fwd.c
++++ b/svr-x11fwd.c
+@@ -206,7 +206,7 @@ void x11cleanup(struct ChanSess *chansess) {
+ }
+
+ static int x11_inithandler(struct Channel *channel) {
+-	channel->prio = DROPBEAR_CHANNEL_PRIO_INTERACTIVE;
++	channel->prio = DROPBEAR_PRIO_LOWDELAY;
+ 	return 0;
+ }
+
+--
+2.35.1
+
diff --git a/meta/recipes-core/dropbear/dropbear_2022.82.bb b/meta/recipes-core/dropbear/dropbear_2022.82.bb
index 2de243b889..dfb4e21a2c 100644
--- a/meta/recipes-core/dropbear/dropbear_2022.82.bb
+++ b/meta/recipes-core/dropbear/dropbear_2022.82.bb
@@ -22,7 +22,8 @@ SRC_URI = "http://matt.ucc.asn.au/dropbear/releases/dropbear-${PV}.tar.bz2 \
            file://dropbear.socket \
            file://dropbear.default \
            ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', '', d)} \
-           ${@bb.utils.contains('PACKAGECONFIG', 'disable-weak-ciphers', 'file://dropbear-disable-weak-ciphers.patch', '', d)} "
+           ${@bb.utils.contains('PACKAGECONFIG', 'disable-weak-ciphers', 'file://dropbear-disable-weak-ciphers.patch', '', d)} \
+           file://0007-Fix-X11-build-failure-use-DROPBEAR_PRIO_LOWDELAY.patch"

 SRC_URI[sha256sum] = "3a038d2bbc02bf28bbdd20c012091f741a3ec5cbe460691811d714876aad75d1"

@@ -53,10 +54,14 @@ EXTRA_OEMAKE = 'MULTI=1 SCPPROGRESS=1 PROGRAMS="${SBINCOMMANDS} ${BINCOMMANDS}"'
 PACKAGECONFIG ?= "disable-weak-ciphers"
 PACKAGECONFIG[system-libtom] = "--disable-bundled-libtom,--enable-bundled-libtom,libtommath libtomcrypt"
 PACKAGECONFIG[disable-weak-ciphers] = ""
+PACKAGECONFIG[enable-x11-forwarding] = ""

 EXTRA_OECONF += "\
  ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '--enable-pam', '--disable-pam', d)}"

+CFLAGS += "\
+ ${@bb.utils.contains('PACKAGECONFIG', 'enable-x11-forwarding', '-DDROPBEAR_X11FWD=1', '', d)}"
+
 # This option appends to CFLAGS and LDFLAGS from OE
 # This is causing [textrel] QA warning
 EXTRA_OECONF += "--disable-harden"
--
2.35.1

Re: [OE-core][PATCH] dropbear: Add enable-x11-forwarding PACKAGECONFIG option

[Ross Burton]

On 27 Sep 2022, at 11:29, Daniel Gomez via lists.openembedded.org <daniel=qtec.com@lists.openembedded.org> wrote:
> diff --git a/meta/recipes-core/dropbear/dropbear/0007-Fix-X11-build-failure-use-DROPBEAR_PRIO_LOWDELAY.patch b/meta/recipes-core/dropbear/dropbear/0007-Fix-X11-build-failure-use-DROPBEAR_PRIO_LOWDELAY.patch
> new file mode 100644
> index 0000000000..994bbdd42a
> --- /dev/null
> +++ b/meta/recipes-core/dropbear/dropbear/0007-Fix-X11-build-failure-use-DROPBEAR_PRIO_LOWDELAY.patch
> @@ -0,0 +1,27 @@
> +From 0292aacdf0aa57d03f2a3ab7e53cf650e6f29389 Mon Sep 17 00:00:00 2001
> +From: Matt Johnston <matt@ucc.asn.au>
> +Date: Sat, 23 Apr 2022 22:33:31 +0800
> +Subject: [PATCH] Fix X11 build failure, use DROPBEAR_PRIO_LOWDELAY
> +
> +Upstream-Status: Backport

This patch also needs your S-o-b.

Thanks,
Ross

Re: [OE-core][PATCH] dropbear: Add enable-x11-forwarding PACKAGECONFIG option

[Daniel Gomez]

On Tue, 27 Sept 2022 at 12:32, Ross Burton <Ross.Burton@arm.com> wrote:
>
> On 27 Sep 2022, at 11:29, Daniel Gomez via lists.openembedded.org <daniel=qtec.com@lists.openembedded.org> wrote:
> > diff --git a/meta/recipes-core/dropbear/dropbear/0007-Fix-X11-build-failure-use-DROPBEAR_PRIO_LOWDELAY.patch b/meta/recipes-core/dropbear/dropbear/0007-Fix-X11-build-failure-use-DROPBEAR_PRIO_LOWDELAY.patch
> > new file mode 100644
> > index 0000000000..994bbdd42a
> > --- /dev/null
> > +++ b/meta/recipes-core/dropbear/dropbear/0007-Fix-X11-build-failure-use-DROPBEAR_PRIO_LOWDELAY.patch
> > @@ -0,0 +1,27 @@
> > +From 0292aacdf0aa57d03f2a3ab7e53cf650e6f29389 Mon Sep 17 00:00:00 2001
> > +From: Matt Johnston <matt@ucc.asn.au>
> > +Date: Sat, 23 Apr 2022 22:33:31 +0800
> > +Subject: [PATCH] Fix X11 build failure, use DROPBEAR_PRIO_LOWDELAY
> > +
> > +Upstream-Status: Backport
>
> This patch also needs your S-o-b.

Okay, thanks. I will then send a v2 with that. Although this should
have been the v2 already. Sorry for that.

Here the previous patch thread:
https://lore.kernel.org/all/20220720194416.89631-1-daniel@qtec.com/
>
> Thanks,
> Ross
>

Re: [OE-core][PATCH] dropbear: Enable x11 forwarding

[Daniel Gomez]

On Mon, 25 Jul 2022 at 10:49, Ross Burton <Ross.Burton@arm.com> wrote:
>
> On 25 Jul 2022, at 04:11, Matt Johnston <matt@codeconstruct.com.au> wrote:
> > The upstream method for Dropbear configuration is #define entries in a
> > localoptions.h file.  default_options.h should be left untouched.  Adding it
> > to CFLAGS for configure would also work, as
> >
> > ./configure CFLAGS="-Os -Wall -DDROPBEAR_X11FWD=1”
>
> Perfect, thanks Matt!

I've just sent a new version [1] using CFLAGS but I think I should
have used localoptions.h instead
as that will match the upstream configuration method. What do you
think? Shall I change to localoptions.h instead?
I think that should be a more elegant solution.

[1] https://lore.kernel.org/all/20220927102904.722281-1-daniel@qtec.com/
>
> Ross
>

[OE-core][PATCH v3] dropbear: Add enable-x11-forwarding PACKAGECONFIG option

[Daniel Gomez]

Add the option to enable X11 forwarding in dropbear with a new
PACKAGECONFIG option ('enable-x11-forwarding'). Method uses
localoption.h file for dropbear feature selection.

Add backport patch to fix X11 forwarding in the current 2022.82
version.

Signed-off-by: Daniel Gomez <daniel@qtec.com>
---
v3
- Add S-o-b in the backport patch.
- Replace CFLAGS with localoptions.h as method to configure and enable
dropbear features.

v2:
- Drop patch default_options patch and use CFLAGS to enable dropbear
features.

Previous versions:
v2: https://lore.kernel.org/all/20220927102904.722281-1-daniel@qtec.com/
v1: https://lore.kernel.org/all/20220720194416.89631-1-daniel@qtec.com/

 ...d-failure-use-DROPBEAR_PRIO_LOWDELAY.patch | 28 +++++++++++++++++++
 .../recipes-core/dropbear/dropbear_2022.82.bb | 11 +++++++-
 2 files changed, 38 insertions(+), 1 deletion(-)
 create mode 100644 meta/recipes-core/dropbear/dropbear/0007-Fix-X11-build-failure-use-DROPBEAR_PRIO_LOWDELAY.patch

diff --git a/meta/recipes-core/dropbear/dropbear/0007-Fix-X11-build-failure-use-DROPBEAR_PRIO_LOWDELAY.patch b/meta/recipes-core/dropbear/dropbear/0007-Fix-X11-build-failure-use-DROPBEAR_PRIO_LOWDELAY.patch
new file mode 100644
index 0000000000..a26c1a851a
--- /dev/null
+++ b/meta/recipes-core/dropbear/dropbear/0007-Fix-X11-build-failure-use-DROPBEAR_PRIO_LOWDELAY.patch
@@ -0,0 +1,28 @@
+From 64292091fe3e8ea7c9bfe74af730b2ff5428bf10 Mon Sep 17 00:00:00 2001
+From: Matt Johnston <matt@ucc.asn.au>
+Date: Sat, 23 Apr 2022 22:33:31 +0800
+Subject: [PATCH] Fix X11 build failure, use DROPBEAR_PRIO_LOWDELAY
+
+Upstream-Status: Backport
+
+Signed-off-by: Daniel Gomez <daniel@qtec.com>
+---
+ svr-x11fwd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/svr-x11fwd.c b/svr-x11fwd.c
+index 353cb12..5d9e6a9 100644
+--- a/svr-x11fwd.c
++++ b/svr-x11fwd.c
+@@ -206,7 +206,7 @@ void x11cleanup(struct ChanSess *chansess) {
+ }
+
+ static int x11_inithandler(struct Channel *channel) {
+-	channel->prio = DROPBEAR_CHANNEL_PRIO_INTERACTIVE;
++	channel->prio = DROPBEAR_PRIO_LOWDELAY;
+ 	return 0;
+ }
+
+--
+2.35.1
+
diff --git a/meta/recipes-core/dropbear/dropbear_2022.82.bb b/meta/recipes-core/dropbear/dropbear_2022.82.bb
index 2de243b889..41c14ff2f1 100644
--- a/meta/recipes-core/dropbear/dropbear_2022.82.bb
+++ b/meta/recipes-core/dropbear/dropbear_2022.82.bb
@@ -22,7 +22,8 @@ SRC_URI = "http://matt.ucc.asn.au/dropbear/releases/dropbear-${PV}.tar.bz2 \
            file://dropbear.socket \
            file://dropbear.default \
            ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', '', d)} \
-           ${@bb.utils.contains('PACKAGECONFIG', 'disable-weak-ciphers', 'file://dropbear-disable-weak-ciphers.patch', '', d)} "
+           ${@bb.utils.contains('PACKAGECONFIG', 'disable-weak-ciphers', 'file://dropbear-disable-weak-ciphers.patch', '', d)} \
+           file://0007-Fix-X11-build-failure-use-DROPBEAR_PRIO_LOWDELAY.patch"

 SRC_URI[sha256sum] = "3a038d2bbc02bf28bbdd20c012091f741a3ec5cbe460691811d714876aad75d1"

@@ -53,6 +54,7 @@ EXTRA_OEMAKE = 'MULTI=1 SCPPROGRESS=1 PROGRAMS="${SBINCOMMANDS} ${BINCOMMANDS}"'
 PACKAGECONFIG ?= "disable-weak-ciphers"
 PACKAGECONFIG[system-libtom] = "--disable-bundled-libtom,--enable-bundled-libtom,libtommath libtomcrypt"
 PACKAGECONFIG[disable-weak-ciphers] = ""
+PACKAGECONFIG[enable-x11-forwarding] = ""

 EXTRA_OECONF += "\
  ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '--enable-pam', '--disable-pam', d)}"
@@ -64,6 +66,13 @@ EXTRA_OECONF += "--disable-harden"
 # musl does not implement wtmp/logwtmp APIs
 EXTRA_OECONF:append:libc-musl = " --disable-wtmp --disable-lastlog"

+do_configure:append() {
+	echo "/* Dropbear features */" > ${B}/localoptions.h
+	if ${@bb.utils.contains('PACKAGECONFIG', 'enable-x11-forwarding', 'true', 'false', d)}; then
+		echo "#define DROPBEAR_X11FWD 1" >> ${B}/localoptions.h
+	fi
+}
+
 do_install() {
 	install -d ${D}${sysconfdir} \
 		${D}${sysconfdir}/init.d \
--
2.35.1