netutils/dropbear: back chacha20-poly1305 with NuttX /dev/crypto

netutils/dropbear/CMakeLists.txt

@@ -135,6 +135,11 @@ if(CONFIG_NETUTILS_DROPBEAR)
   file(GLOB_RECURSE LIBTOMCRYPT_SRCS CONFIGURE_DEPENDS
        "${CMAKE_CURRENT_SOURCE_DIR}/dropbear/libtomcrypt/src/*.c")
   list(FILTER LIBTOMCRYPT_SRCS EXCLUDE REGEX ".*/prngs/sober128tab\\.c$")
+
+  # Replace the bundled chacha20-poly1305 with the /dev/crypto adapter.
+  list(REMOVE_ITEM DROPBEAR_SRCS dropbear/src/chachapoly.c)
+  list(APPEND DROPBEAR_SRCS port/dropbear_chachapoly.c)
+
   list(APPEND DROPBEAR_SRCS ${LIBTOMCRYPT_SRCS})
 
   if(CONFIG_NETUTILS_DROPBEAR_SCP)
@@ -225,6 +230,15 @@ if(CONFIG_NETUTILS_DROPBEAR)
   set_source_files_properties(${LIBTOMCRYPT_SRCS} PROPERTIES COMPILE_DEFINITIONS
                                                              LTC_SOURCE=1)
 
+  # The NuttX crypto backend pulled in by /dev/crypto also exports ecc_make_key.
+  # Dropbear only uses libtomcrypt's ecc_make_key_ex, so rename the unused plain
+  # wrapper to avoid a multiple definition.  Append so the LTC_SOURCE define set
+  # above is preserved.
+  set_property(
+    SOURCE dropbear/libtomcrypt/src/pk/ecc/ecc_make_key.c
+    APPEND
+    PROPERTY COMPILE_DEFINITIONS ecc_make_key=dropbear_ltc_ecc_make_key)
+
   target_compile_options(${PROGNAME} PRIVATE -Wno-pointer-sign -Wno-format)
 
   if(CONFIG_NETUTILS_DROPBEAR_SCP)

netutils/dropbear/Kconfig

@@ -17,13 +17,21 @@ menuconfig NETUTILS_DROPBEAR
 	depends on DEV_URANDOM
 	depends on LIBC_NETDB
 	depends on LIBC_GAISTRERROR
-	select CRYPTO
+	depends on ALLOW_BSD_COMPONENTS
+	depends on CRYPTO_CRYPTODEV
+	depends on CRYPTO_CRYPTODEV_SOFTWARE_CRYPTO
 	select CRYPTO_RANDOM_POOL
 	---help---
 		Enable a minimal Dropbear SSH server port for NuttX.  This initial
 		port is based on the ESP-IDF MCU test port and provides a single
 		foreground SSH server process with SSH sessions backed by NSH.
 
+		The port implements the chacha20-poly1305@openssh.com cipher
+		through the NuttX crypto device (/dev/crypto), using the
+		CRYPTO_CHACHA20_DJB and CRYPTO_POLY1305 algorithms instead of
+		the bundled libtomcrypt implementation, which is dropped from
+		the build.
+
 if NETUTILS_DROPBEAR
 
 config NETUTILS_DROPBEAR_STACKSIZE

netutils/dropbear/Makefile

@@ -119,6 +119,11 @@ CSRCS += \
 TOMMATH_SRCS = $(shell if [ -d "$(DROPBEAR_UNPACKNAME)/libtommath" ]; then find "$(DROPBEAR_UNPACKNAME)/libtommath" -name "*.c"; fi)
 TOMCRYPT_SRCS = $(shell if [ -d "$(DROPBEAR_UNPACKNAME)/libtomcrypt/src" ]; then find "$(DROPBEAR_UNPACKNAME)/libtomcrypt/src" -name "*.c" ! -name "sober128tab.c"; fi)
 
+# Replace the bundled chacha20-poly1305 with the /dev/crypto adapter.
+
+CSRCS := $(filter-out dropbear/src/chachapoly.c,$(CSRCS))
+CSRCS += port/dropbear_chachapoly.c
+
 CSRCS += $(TOMMATH_SRCS)
 CSRCS += $(TOMCRYPT_SRCS)
 
@@ -130,6 +135,11 @@ endif
 # Match the ESP-IDF port behavior: LTC_SOURCE is only for libtomcrypt sources.
 $(foreach src,$(TOMCRYPT_SRCS),$(eval $(src)_CFLAGS += ${DEFINE_PREFIX}LTC_SOURCE=1))
 
+# The NuttX crypto backend pulled in by /dev/crypto also exports
+# ecc_make_key.  Dropbear only uses libtomcrypt's ecc_make_key_ex, so rename
+# the unused plain wrapper to avoid a link-time multiple definition.
+dropbear/libtomcrypt/src/pk/ecc/ecc_make_key.c_CFLAGS += ${DEFINE_PREFIX}ecc_make_key=dropbear_ltc_ecc_make_key
+
 MAINSRC = dropbear_main.c
 
 ifneq ($(CONFIG_NETUTILS_DROPBEAR_SCP),)