{bp-3561} netutils/dropbear: initial Dropbear SSH server port for NuttX - #3692
Open
jerpelea wants to merge 12 commits into
Open
{bp-3561} netutils/dropbear: initial Dropbear SSH server port for NuttX#3692jerpelea wants to merge 12 commits into
jerpelea wants to merge 12 commits into
Conversation
Integrated SSH daemon authenticating against FSUTILS_PASSWD, with an ECDSA P-256 host key and an NSH session over a PTY per connection. Built from the upstream Dropbear tarball (pinned commit) and patched for NuttX, using Dropbear's bundled libtomcrypt for all crypto. setsid() (apache/nuttx#19184) and link() now come from NuttX, not local stubs. Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
Add SCP support do the dropbear server. Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
Code Clean up - Remove unnecessary code. Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
Rename base64_encode, base64_decode, and ecc_make_key in bundled libtomcrypt to avoid duplicate symbol link errors when dropbear is built alongside netutils/codecs and NuttX crypto (e.g. sim:dropbear). Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Dropbear gathers its entropy from /dev/urandom (libtomcrypt's rng_get_bytes tries /dev/urandom before /dev/random), so requiring ARCH_HAVE_RNG and DEV_RANDOM shuts the port out of targets without a hardware TRNG -- including the simulator, where a dropbear configuration silently loses NETUTILS_DROPBEAR at configure time. Keep only the DEV_URANDOM requirement. Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
The per-session NSH task is reaped with waitpid() in
dropbear_nshsession.c. Without CONFIG_SCHED_CHILD_STATUS the kernel does
not retain the child exit status, so waitpid() returns ECHILD right after
authentication and the interactive session never starts
("NSH session wait failed: Unknown error 10").
Depend on SCHED_HAVE_PARENT and SCHED_CHILD_STATUS (following the project's
depends-on-over-select convention) so the requirement is explicit; boards
enabling Dropbear must set these in their defconfig.
Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
NuttX master now requires CONFIG_BOARD_ETC_ROMFS_PASSWD_PASSWORD for sim/login builds. The nuttx-apps workflow mirrors nuttx CI but never exported NUTTX_ROMFS_PASSWD_PASSWORD, so Linux sim-02 and macOS sim jobs failed inside the Docker build container. Set the documented test credential at the job and step level and export it explicitly before cibuild.sh runs. Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Migrate passwd encrypt/verify to PBKDF2 modular crypt format using kernel cryptodev (CRYPTO_PBKDF2_HMAC_SHA256 via /dev/crypto). Add passwd_pbkdf2 wrapper, base64url helpers, complexity validation, and pbkdf2_test for RFC 6070 vector coverage. FSUTILS_PASSWD selects CRYPTO, ALLOW_BSD_COMPONENTS, and CRYPTO_CRYPTODEV so existing sim defconfigs keep building. Change NSH_LOGIN_USERNAME default to root and remove fixed-login password defaults. BREAKING CHANGE: TEA-encoded /etc/passwd entries no longer verify. Regenerate each entry after upgrading. Pair with the nuttx host mkpasswd changes in apache/nuttx#19209. Boards must enable the appropriate software or hardware crypto backend for PBKDF2 at runtime. When CONFIG_NSH_LOGIN_FIXED=y, set CONFIG_NSH_LOGIN_PASSWORD in the board defconfig or menuconfig; there is no default password. Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Report password policy failures clearly from useradd and passwd when a password does not meet complexity requirements. Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
NUTTX_ROMFS_PASSWD_PASSWORD lacked a special character, so nuttx's promptpasswd.sh rejects it and headless CI builds fail at etctmp.c when sim/login is built. Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Replace the bundled libtomcrypt HMAC modules with an adapter that computes the hmac-sha2-256 packet MAC through the NuttX crypto device using CRYPTO_SHA2_256_HMAC sessions. Require CRYPTO, CRYPTO_RANDOM_POOL, CRYPTO_CRYPTODEV and CRYPTO_CRYPTODEV_SOFTWARE_CRYPTO explicitly instead of selecting crypto support. Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
Replace the bundled libtomcrypt chacha20-poly1305 implementation with an adapter that drives the NuttX crypto device: the SSH construction maps onto CRYPTO_CHACHA20_DJB (the original 64-bit counter/nonce ChaCha20 parameterization used by chacha20-poly1305@openssh.com) for the packet length and payload streams, and onto CRYPTO_POLY1305 for the authentication tag (plain MACs are driven in two steps through /dev/crypto: COP_FLAG_UPDATE feeds the data, a final call retrieves the tag). Signed-off-by: Felipe Moura <moura.fmo@gmail.com>
jerpelea
requested review from
acassis,
cederom,
linguini1,
lupyuen and
xiaoxiang781216
August 3, 2026 14:20
cederom
approved these changes
Aug 3, 2026
xiaoxiang781216
approved these changes
Aug 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR is the first step of the Dropbear port to Apache NuttX.
At this stage, the port still uses Dropbear’s internal cryptographic library. Only the password-checking routines have been adapted to use native NuttX mechanisms.
As a second step, this application will be improved to use the cryptographic libraries provided by NuttX instead of Dropbear’s own crypto implementation.
With this application, a user can establish SSH connections to the hardware, allowing remote access to the system.
The documentation is already added to the mainline: PR#19190
Also, the defconfig to you be able test is available in the following commit: apache/nuttx#19062
This PR is a "reboot" of #3532. The first try added step 1 and 2 in the same PR adding a long discussion, so I drop the old PR and opened a clean PR here, ready to review.
Includes:
#3586
#3627
#3631
#3640
#3648
#3649
#3557
#3664
Impact
RELEASE
Testing
CI