Add new parameter -M for max. duration

[sch-m]

Some technical guidelines (e.g., TR-03148) and cybersecurity baselines
require a hard maximum connection duration / session timeout for remote
connections. Therefore, a parameter is hereby introduced that can be
used to configure the maximum connection duration. The default value is
0 (disabled).

[sch-m]

@mkj I don't understand why the check fails here and max_duration_secs seems to be set to 1, even though the default value is actually 0. Make check runs without any problems for me.

[mkj]

@mkj I don't understand why the check fails here and max_duration_secs seems to be set to 1, even though the default value is actually 0. Make check runs without any problems for me.

I guess github runners are slower than local systems so it might take longer than a second? max_duration_secs set to 1 looks like a real problem though?

[sch-m]

max_duration_secs set to 1 looks like a real problem though?

But I can't see any errors in my changes. DEFAULT_MAX_DURATION = 0. So how can opts.max_duration_secs = 1 be? The -M option isn't set anywhere in the tests.

[mkj]

Aah, it'll be because that CI option flips any 0 options to 1, it'll need an exclusion. Don't worry about it, I'll fix it up. Sorry for the noise there.

dropbear/.github/workflows/build.yml

Lines 229 to 240 in 75f699b

	- name: nondefault
	if: ${{ matrix.nondefault }}
	run: |
	# Turn on anything that's off by default. Rough but seems sufficient
	grep ' 0$' src/default_options.h | sed 's/0$/1/' >> localoptions.h
	# PAM clashes with password
	echo "#define DROPBEAR_SVR_PASSWORD_AUTH 0" >> localoptions.h
	# 1 second timeout is too short
	sed -i "s/DEFAULT_IDLE_TIMEOUT 1/DEFAULT_IDLE_TIMEOUT 99/" localoptions.h
	# DROPBEAR_SVR_DROP_PRIVS is on by default, turn it off
	echo "#define DROPBEAR_SVR_DROP_PRIVS 0" >> localoptions.h
	echo "#define DROPBEAR_SVR_LOCALSTREAMFWD 0" >> localoptions.h

[sch-m]

Aah, it'll be because that CI option flips any 0 options to 1, it'll need an exclusion. Don't worry about it, I'll fix it up. Sorry for the noise there.

Thank you for the clarification.

[mkj]

Thanks, this is merged. While testing I noticed an existing bug in the timeout handling, now fixed. #418

[sch-m]

Thank you very much.