diff options
author | Alexander Dahl <ada@thorsis.com> | 2020-11-16 09:05:51 +0100 |
---|---|---|
committer | Michael Olbrich <m.olbrich@pengutronix.de> | 2020-11-16 12:44:56 +0100 |
commit | 80326bc43e71d1b012b33287d64aa4768a28e00d (patch) | |
tree | b72dc10cd310d60e1b235340c1ba0c7678bb12a0 | |
parent | 55129e58359e94cecae7c158d63cbf9d0a44ea6f (diff) | |
download | ptxdist-80326bc43e71d1b012b33287d64aa4768a28e00d.tar.gz ptxdist-80326bc43e71d1b012b33287d64aa4768a28e00d.tar.xz |
dropbear: version bump 2019.78 -> 2020.79
Noteworthy changes (not all options accessible through ptxdist menu):
- added support for ed25519 hostkeys and authorized_keys
- added support for chacha20-poly1305 authenticated cipher
- added support for and rsa-sha2 signatures
- disabled some options by default (kconfig defaults adapted accordingly)
- blowfish has been removed
- fix idle detection clashing with keepalives
- scp fix for CVE-2018-20685 where a server could modify name of output
files
- Call fsync() is called on parent directory when writing key files to
ensure they are flushed
One especially important change:
> Use getrandom() call on Linux to ensure sufficient entropy has been
> gathered at startup. Dropbear now avoids reading from the random
> source at startup, instead waiting until the first connection. It is
> possible that some platforms were running without enough entropy
> previously, those could potentially block at first boot generating
> host keys. The dropbear "-R" option is one way to avoid that.
On older toolchains/kernel headers/kernels without getrandom() support,
dropbear should behave like before.
The curve25519 implementation was replaced with the one by TweetNaCl,
which induced a change in 'LICENSE' summary. The old implementation was
licensed BSD-3-Clause and the new is public domain.
The bundled libtommath changed its license from dual license (public
domain || WTFPL) to 'Unlicense' which is also a public domain license,
but with a differently worded license text and an actual SPDX
identifier.
The patch stack was dropped, the one patch was integrated upstream.
Signed-off-by: Alexander Dahl <ada@thorsis.com>
Message-Id: <20201116080552.25031-5-ada@thorsis.com>
Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
-rw-r--r-- | patches/dropbear-2019.78/0001-configure-Fix-disable-fuzz.patch | 47 | ||||
l--------- | patches/dropbear-2019.78/autogen.sh | 1 | ||||
-rw-r--r-- | patches/dropbear-2019.78/series | 4 | ||||
-rw-r--r-- | rules/dropbear.in | 2 | ||||
-rw-r--r-- | rules/dropbear.make | 11 |
5 files changed, 7 insertions, 58 deletions
diff --git a/patches/dropbear-2019.78/0001-configure-Fix-disable-fuzz.patch b/patches/dropbear-2019.78/0001-configure-Fix-disable-fuzz.patch deleted file mode 100644 index 03aec183a..000000000 --- a/patches/dropbear-2019.78/0001-configure-Fix-disable-fuzz.patch +++ /dev/null @@ -1,47 +0,0 @@ -From: Alexander Dahl <ada@thorsis.com> -Date: Wed, 11 Mar 2020 10:50:45 +0100 -Subject: [PATCH] configure: Fix --disable-fuzz - -When explicitly passing --disable-fuzz to ./configure fuzz was actually -enabled. - -Signed-off-by: Alexander Dahl <ada@thorsis.com> ---- - -Notes: - Sent upstream: https://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2020q1/002202.html - - configure.ac | 17 ++++++++++++----- - 1 file changed, 12 insertions(+), 5 deletions(-) - -diff --git a/configure.ac b/configure.ac -index 7199d7cb2300..104d60cfaf53 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -326,14 +326,21 @@ AC_ARG_ENABLE(shadow, - AC_ARG_ENABLE(fuzz, - [ --enable-fuzz Build fuzzing. Not recommended for deployment.], - [ -- AC_DEFINE(DROPBEAR_FUZZ, 1, Fuzzing) -- AC_MSG_NOTICE(Enabling fuzzing) -- DROPBEAR_FUZZ=1 -- # libfuzzer needs linking with c++ libraries -- AC_PROG_CXX -+ if test "x$enableval" = "xyes"; then -+ AC_DEFINE(DROPBEAR_FUZZ, 1, Fuzzing) -+ AC_MSG_NOTICE(Enabling fuzzing) -+ DROPBEAR_FUZZ=1 -+ # libfuzzer needs linking with c++ libraries -+ AC_PROG_CXX -+ else -+ AC_DEFINE(DROPBEAR_FUZZ, 0, Fuzzing) -+ AC_MSG_NOTICE(Disabling fuzzing) -+ DROPBEAR_FUZZ=0 -+ fi - ], - [ - AC_DEFINE(DROPBEAR_FUZZ, 0, Fuzzing) -+ AC_MSG_NOTICE(Disabling fuzzing) - DROPBEAR_FUZZ=0 - ] - diff --git a/patches/dropbear-2019.78/autogen.sh b/patches/dropbear-2019.78/autogen.sh deleted file mode 120000 index 9f8a4cb7d..000000000 --- a/patches/dropbear-2019.78/autogen.sh +++ /dev/null @@ -1 +0,0 @@ -../autogen.sh
\ No newline at end of file diff --git a/patches/dropbear-2019.78/series b/patches/dropbear-2019.78/series deleted file mode 100644 index 3e5a5247e..000000000 --- a/patches/dropbear-2019.78/series +++ /dev/null @@ -1,4 +0,0 @@ -# generated by git-ptx-patches -#tag:base --start-number 1 -0001-configure-Fix-disable-fuzz.patch -# c03ca050bdd0c61ac96e5bd22c9d0947 - git-ptx-patches magic diff --git a/rules/dropbear.in b/rules/dropbear.in index 7f777ae64..c0da7e222 100644 --- a/rules/dropbear.in +++ b/rules/dropbear.in @@ -116,6 +116,7 @@ comment "features" config DROPBEAR_DIS_X11 bool prompt "disable X11 Forwarding" + default y help X11 forwarding means passing X11 (graphical interface) information over the SSH connection. @@ -149,7 +150,6 @@ config DROPBEAR_AES128 config DROPBEAR_3DES bool prompt "3DES" - default y help DES is an IBM algorithm designed during the 1970s. In 1976, NIST has officially adopted it as an encryption diff --git a/rules/dropbear.make b/rules/dropbear.make index e422eb4d5..a9404592e 100644 --- a/rules/dropbear.make +++ b/rules/dropbear.make @@ -16,19 +16,19 @@ PACKAGES-$(PTXCONF_DROPBEAR) += dropbear # # Paths and names # -DROPBEAR_VERSION := 2019.78 -DROPBEAR_MD5 := a972c85ed678ad0fdcb7844e1294fb54 +DROPBEAR_VERSION := 2020.79 +DROPBEAR_MD5 := 830a7bf6349ac52a39c487d061efb352 DROPBEAR := dropbear-$(DROPBEAR_VERSION) DROPBEAR_SUFFIX := tar.bz2 DROPBEAR_URL := http://matt.ucc.asn.au/dropbear/releases/$(DROPBEAR).$(DROPBEAR_SUFFIX) DROPBEAR_SOURCE := $(SRCDIR)/$(DROPBEAR).$(DROPBEAR_SUFFIX) DROPBEAR_DIR := $(BUILDDIR)/$(DROPBEAR) DROPBEAR_LICENSE := \ - MIT AND BSD-2-Clause AND BSD-3-Clause AND SSH-short AND (public_domain OR WTFPL) + MIT AND BSD-2-Clause AND public_domain AND SSH-short AND (public_domain OR WTFPL) AND Unlicense DROPBEAR_LICENSE_FILES := \ - file://LICENSE;md5=a5ec40cafba26fc4396d0b550f824e01 \ + file://LICENSE;md5=da58928b5d844c6667963cb5a109272d \ file://libtomcrypt/LICENSE;md5=71baacc459522324ef3e2b9e052e8180 \ - file://libtommath/LICENSE;md5=f72771f4af5e8c382974750f9f8701ad \ + file://libtommath/LICENSE;md5=23e7e0a32e53a2b1d35f5fd9ef053402 \ file://loginrec.c;startline=1;endline=26;md5=0d785ee11fab1cead2c7fee9c35574f1 # ---------------------------------------------------------------------------- @@ -48,6 +48,7 @@ DROPBEAR_CONF_OPT := \ --$(call ptx/disen, PTXCONF_DROPBEAR_DIS_OPENPTY)-openpty \ --$(call ptx/disen, PTXCONF_DROPBEAR_DIS_SYSLOG)-syslog \ --enable-shadow \ + --disable-plugin \ --disable-fuzz \ --enable-bundled-libtom \ --$(call ptx/disen, PTXCONF_DROPBEAR_DIS_LASTLOG)-lastlog \ |