mailarchive of the ptxdist mailing list
 help / color / mirror / Atom feed
* [ptxdist] [PATCH] Dropbear: version bump 2014.65 -> 2015.67
@ 2015-03-16 13:29 Juergen Borleis
  0 siblings, 0 replies; 4+ messages in thread
From: Juergen Borleis @ 2015-03-16 13:29 UTC (permalink / raw)
  To: ptxdist

And additionally clean up the rule file.

Signed-off-by: Juergen Borleis <jbe@pengutronix.de>

diff --git a/patches/dropbear-2015.67/0001-dropbear-disabling-ENABLE_CLI_PUBKEY_AUTH-let-the-bu.patch 
b/patches/dropbear-2015.67/0001-dropbear-disabling-ENABLE_CLI_PUBKEY_AUTH-let-the-bu.patch
new file mode 100644
index 000000000000..6fc655a95945
--- /dev/null
+++ b/patches/dropbear-2015.67/0001-dropbear-disabling-ENABLE_CLI_PUBKEY_AUTH-let-the-bu.patch
@@ -0,0 +1,45 @@
+From: Juergen Borleis <jbe@pengutronix.de>
+Date: Fri, 13 Mar 2015 10:53:46 +0100
+Subject: [PATCH] dropbear: disabling ENABLE_CLI_PUBKEY_AUTH let the build
+ fail
+
+Function multihop_passthrough_args() fails due to missing 'privkeys' member
+in structure 'cli_runopts'. So lets also disable ENABLE_CLI_MULTIHOP for
+this case.
+And even cli_getopts() fails due to missing loadidentityfile() function
+in this case.
+
+Signed-off-by: Juergen Borleis <jbe@pengutronix.de>
+---
+ options.h    |    4 +++-
+ sysoptions.h |    2 +-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/options.h b/options.h
+index 6339b0a4738e..1360b5c6758f 100644
+--- a/options.h
++++ b/options.h
+@@ -218,7 +218,9 @@ much traffic. */
+ 
+ /* A default argument for dbclient -i <privatekey>. 
+    leading "~" is expanded */
+-#define DROPBEAR_DEFAULT_CLI_AUTHKEY "~/.ssh/id_dropbear"
++#ifdef ENABLE_CLI_PUBKEY_AUTH
++# define DROPBEAR_DEFAULT_CLI_AUTHKEY "~/.ssh/id_dropbear"
++#endif
+ 
+ /* This variable can be used to set a password for client
+  * authentication on the commandline. Beware of platforms
+diff --git a/sysoptions.h b/sysoptions.h
+index bec72461d8e4..eeb78cb129a5 100644
+--- a/sysoptions.h
++++ b/sysoptions.h
+@@ -202,7 +202,7 @@
+ #define USING_LISTENERS
+ #endif
+ 
+-#if defined(ENABLE_CLI_NETCAT) && defined(ENABLE_CLI_PROXYCMD)
++#if defined(ENABLE_CLI_NETCAT) && defined(ENABLE_CLI_PROXYCMD) && defined(ENABLE_CLI_PUBKEY_AUTH)
+ #define ENABLE_CLI_MULTIHOP
+ #endif
+ 
diff --git a/patches/dropbear-2015.67/series b/patches/dropbear-2015.67/series
new file mode 100644
index 000000000000..501905e990c5
--- /dev/null
+++ b/patches/dropbear-2015.67/series
@@ -0,0 +1,4 @@
+# generated by git-ptx-patches
+#tag:base --start-number 1
+0001-dropbear-disabling-ENABLE_CLI_PUBKEY_AUTH-let-the-bu.patch
+# 847698d613b5ea08c9504df4ed3f0099  - git-ptx-patches magic
diff --git a/rules/dropbear.make b/rules/dropbear.make
index f03d0fc0df24..2240d556fc8e 100644
--- a/rules/dropbear.make
+++ b/rules/dropbear.make
@@ -18,8 +18,8 @@ PACKAGES-$(PTXCONF_DROPBEAR) += dropbear
 #
 # Paths and names
 #
-DROPBEAR_VERSION	:= 2014.65
-DROPBEAR_MD5		:= 1918604238817385a156840fa2c39490
+DROPBEAR_VERSION	:= 2015.67
+DROPBEAR_MD5		:= e967e320344cd4bfebe321e3ab8514d6
 DROPBEAR		:= dropbear-$(DROPBEAR_VERSION)
 DROPBEAR_SUFFIX		:= tar.bz2
 DROPBEAR_URL		:= http://matt.ucc.asn.au/dropbear/releases/$(DROPBEAR).$(DROPBEAR_SUFFIX)
@@ -33,50 +33,24 @@ DROPBEAR_DIR		:= $(BUILDDIR)/$(DROPBEAR)
 #
 # autoconf
 #
-DROPBEAR_AUTOCONF := \
-	$(CROSS_AUTOCONF_USR)
-
-ifdef PTXCONF_DROPBEAR_ZLIB
-DROPBEAR_AUTOCONF	+= --enable-zlib
-else
-DROPBEAR_AUTOCONF	+= --disable-zlib
-endif
-
-ifdef PTXCONF_DROPBEAR_DIS_OPENPTY
-DROPBEAR_AUTOCONF	+= --disable-openpty
-endif
-
-ifdef PTXCONF_DROPBEAR_DIS_SYSLOG
-DROPBEAR_AUTOCONF	+= --disable-syslog
-endif
-
-ifdef PTXCONF_DROPBEAR_DIS_LASTLOG
-DROPBEAR_AUTOCONF	+= --disable-lastlog
-endif
-
-ifdef PTXCONF_DROPBEAR_DIS_UTMP
-DROPBEAR_AUTOCONF	+= --disable-utmp
-endif
-
-ifdef PTXCONF_DROPBEAR_DIS_UTMPX
-DROPBEAR_AUTOCONF	+= --disable-utmpx
-endif
-
-ifdef PTXCONF_DROPBEAR_DIS_WTMP
-DROPBEAR_AUTOCONF	+= --disable-wtmp
-endif
-
-ifdef PTXCONF_DROPBEAR_DIS_WTMPX
-DROPBEAR_AUTOCONF	+= --disable-wtmpx
-endif
-
-ifdef PTXCONF_DROPBEAR_DIS_PUTUTLINE
-DROPBEAR_AUTOCONF	+= --disable-pututline
-endif
-
-ifdef PTXCONF_DROPBEAR_DIS_PUTUTXLINE
-DROPBEAR_AUTOCONF	+= --disable-pututxline
-endif
+DROPBEAR_CONF_TOOL	:= autoconf
+DROPBEAR_CONF_OPT 	:= \
+	$(CROSS_AUTOCONF_USR) \
+	$(GLOBAL_LARGE_FILE_OPTION) \
+	--$(call ptx/endis, PTXCONF_DROPBEAR_ZLIB)-zlib \
+	--disable-pam \
+	--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_OPENPTY)-openpty \
+	--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_SYSLOG)-syslog \
+	--enable-shadow \
+	--enable-bundled-libtom \
+	--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_LASTLOG)-lastlog \
+	--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_UTMP)-utmp \
+	--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_UTMPX)-utmpx \
+	--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_WTMP)-wtmp \
+	--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_WTMPX)-wtmpx \
+	--disable-loginfunc \
+	--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_PUTUTLINE)-pututline \
+	--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_PUTUTXLINE)-pututxline
 
 $(STATEDIR)/dropbear.prepare:
 	@$(call targetinfo)

-- 
Pengutronix e.K.                              | Juergen Borleis             |
Industrial Linux Solutions                    | http://www.pengutronix.de/  |

-- 
ptxdist mailing list
ptxdist@pengutronix.de

^ permalink raw reply	[flat|nested] 4+ messages in thread
* [ptxdist] [PATCH] dropbear: version bump 2014.65 -> 2015.67
@ 2015-02-16 15:47 Bruno Thomsen
  2015-02-19 14:09 ` Michael Olbrich
  0 siblings, 1 reply; 4+ messages in thread
From: Bruno Thomsen @ 2015-02-16 15:47 UTC (permalink / raw)
  To: ptxdist; +Cc: bth

The new version contain options to enable/disable cipher modes.
Keeping today's default cipher mode.
In a secure solution one would disable CBC and enable CTR.

Signed-off-by: Bruno Thomsen <bth@kamstrup.com>
---
 rules/dropbear.in   | 15 +++++++++++++++
 rules/dropbear.make | 18 ++++++++++++++++--
 2 files changed, 31 insertions(+), 2 deletions(-)

diff --git a/rules/dropbear.in b/rules/dropbear.in
index fe2ada3..79aad57 100644
--- a/rules/dropbear.in
+++ b/rules/dropbear.in
@@ -203,6 +203,21 @@ config DROPBEAR_TWOFISH256
 	  bijective f function made by four key-dependent
 	  8x8-bit S-boxes.
 
+config DROPBEAR_CBC_CIPHERS
+	bool
+	prompt "CBC mode ciphers"
+	default y
+	help
+	  Enable CBC mode for ciphers. This has security issues though
+	  is the most compatible with older SSH implementations.
+
+config DROPBEAR_CTR_CIPHERS
+	bool
+	prompt "Counter mode ciphers"
+	help
+	  Enable "Counter Mode" for ciphers. This is more secure than normal
+	  CBC mode against certain attacks. This adds around 1kB to binary
+	  size and is recommended for most cases.
 
 comment "Integrity, at least one required --- RFC Draft requires sha1-hmac and recommends sha1-96"
 
diff --git a/rules/dropbear.make b/rules/dropbear.make
index f03d0fc..ab9da5d 100644
--- a/rules/dropbear.make
+++ b/rules/dropbear.make
@@ -18,8 +18,8 @@ PACKAGES-$(PTXCONF_DROPBEAR) += dropbear
 #
 # Paths and names
 #
-DROPBEAR_VERSION	:= 2014.65
-DROPBEAR_MD5		:= 1918604238817385a156840fa2c39490
+DROPBEAR_VERSION	:= 2015.67
+DROPBEAR_MD5		:= e967e320344cd4bfebe321e3ab8514d6
 DROPBEAR		:= dropbear-$(DROPBEAR_VERSION)
 DROPBEAR_SUFFIX		:= tar.bz2
 DROPBEAR_URL		:= http://matt.ucc.asn.au/dropbear/releases/$(DROPBEAR).$(DROPBEAR_SUFFIX)
@@ -163,7 +163,21 @@ else
 	@$(call disable_c, $(DROPBEAR_DIR)/options.h,DROPBEAR_TWOFISH128)
 endif
 
+ifdef PTXCONF_DROPBEAR_CBC_CIPHERS
+	@echo "ptxdist: enabling cbc ciphers"
+	@$(call enable_c, $(DROPBEAR_DIR)/options.h,DROPBEAR_ENABLE_CBC_MODE)
+else
+	@echo "ptxdist: disabling cbc ciphers"
+	@$(call disable_c, $(DROPBEAR_DIR)/options.h,DROPBEAR_ENABLE_CBC_MODE)
+endif
 
+ifdef PTXCONF_DROPBEAR_CTR_CIPHERS
+	@echo "ptxdist: enabling ctr ciphers"
+	@$(call enable_c, $(DROPBEAR_DIR)/options.h,DROPBEAR_ENABLE_CTR_MODE)
+else
+	@echo "ptxdist: disabling ctr ciphers"
+	@$(call disable_c, $(DROPBEAR_DIR)/options.h,DROPBEAR_ENABLE_CTR_MODE)
+endif
 
 ifdef PTXCONF_DROPBEAR_SHA1
 	@echo "ptxdist: enabling sha1"
-- 
1.9.1


-- 
ptxdist mailing list
ptxdist@pengutronix.de

^ permalink raw reply	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2015-03-16 13:26 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-03-16 13:29 [ptxdist] [PATCH] Dropbear: version bump 2014.65 -> 2015.67 Juergen Borleis
  -- strict thread matches above, loose matches on Subject: below --
2015-02-16 15:47 [ptxdist] [PATCH] dropbear: " Bruno Thomsen
2015-02-19 14:09 ` Michael Olbrich
2015-02-19 14:48   ` Bruno Thomsen

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox