From mboxrd@z Thu Jan 1 00:00:00 1970 Return-path: Received: from mail.thorsis.com ([92.198.35.195]) by metis.ext.pengutronix.de with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kaaOO-0003WC-5X for ptxdist@pengutronix.de; Thu, 05 Nov 2020 09:13:12 +0100 Received: from localhost (localhost [127.0.0.1]) by mail.thorsis.com (Postfix) with ESMTP id 564433612 for ; Thu, 5 Nov 2020 09:13:11 +0100 (CET) Received: from mail.thorsis.com ([127.0.0.1]) by localhost (mail.thorsis.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9cwMzWbXFDrU for ; Thu, 5 Nov 2020 09:13:11 +0100 (CET) Received: from adahl by ada.ifak-system.com with local (Exim 4.92) (envelope-from ) id 1kaaOE-0001m3-Dg for ptxdist@pengutronix.de; Thu, 05 Nov 2020 09:13:02 +0100 From: Alexander Dahl Date: Thu, 5 Nov 2020 09:13:01 +0100 Message-Id: <20201105081302.6770-4-ada@thorsis.com> In-Reply-To: <20201105081302.6770-1-ada@thorsis.com> References: <20201105081302.6770-1-ada@thorsis.com> Subject: [ptxdist] [PATCH 3/4] dropbear: version bump 2019.78 -> 2020.79 List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ptxdist-bounces@pengutronix.de Sender: "ptxdist" To: ptxdist@pengutronix.de Noteworthy changes (not all options accessible through ptxdist menu): - added support for ed25519 hostkeys and authorized_keys - added support for chacha20-poly1305 authenticated cipher - added support for and rsa-sha2 signatures - disabled some options by default (kconfig defaults adapted accordingly) - fix idle detection clashing with keepalives - scp fix for CVE-2018-20685 where a server could modify name of output files - Call fsync() is called on parent directory when writing key files to ensure they are flushed One especially important change: > Use getrandom() call on Linux to ensure sufficient entropy has been > gathered at startup. Dropbear now avoids reading from the random > source at startup, instead waiting until the first connection. It is > possible that some platforms were running without enough entropy > previously, those could potentially block at first boot generating > host keys. The dropbear "-R" option is one way to avoid that. On older toolchains/kernel headers/kernels without getrandom() support, dropbear should behave like before. The curve25519 implementation was replaced with the one by TweetNaCl, which induced a change in 'LICENSE' summary. The old implementation was licensed BSD-3-Clause and the new is public domain. The bundled libtommath changed its license from dual license (public domain || WTFPL) to 'Unlicense' which is also a public domain license, but with a differently worded license text and an actual SPDX identifier. Signed-off-by: Alexander Dahl --- rules/dropbear.in | 2 +- rules/dropbear.make | 11 ++++++----- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/rules/dropbear.in b/rules/dropbear.in index d01f2c73e..dbe1a34bc 100644 --- a/rules/dropbear.in +++ b/rules/dropbear.in @@ -116,6 +116,7 @@ comment "features" config DROPBEAR_DIS_X11 bool prompt "disable X11 Forwarding" + default y help X11 forwarding means passing X11 (graphical interface) information over the SSH connection. @@ -149,7 +150,6 @@ config DROPBEAR_AES128 config DROPBEAR_3DES bool prompt "3DES" - default y help DES is an IBM algorithm designed during the 1970s. In 1976, NIST has officially adopted it as an encryption diff --git a/rules/dropbear.make b/rules/dropbear.make index 4f55fac48..1907bc0ae 100644 --- a/rules/dropbear.make +++ b/rules/dropbear.make @@ -16,19 +16,19 @@ PACKAGES-$(PTXCONF_DROPBEAR) += dropbear # # Paths and names # -DROPBEAR_VERSION := 2019.78 -DROPBEAR_MD5 := a972c85ed678ad0fdcb7844e1294fb54 +DROPBEAR_VERSION := 2020.79 +DROPBEAR_MD5 := 830a7bf6349ac52a39c487d061efb352 DROPBEAR := dropbear-$(DROPBEAR_VERSION) DROPBEAR_SUFFIX := tar.bz2 DROPBEAR_URL := http://matt.ucc.asn.au/dropbear/releases/$(DROPBEAR).$(DROPBEAR_SUFFIX) DROPBEAR_SOURCE := $(SRCDIR)/$(DROPBEAR).$(DROPBEAR_SUFFIX) DROPBEAR_DIR := $(BUILDDIR)/$(DROPBEAR) DROPBEAR_LICENSE := \ - MIT AND BSD-2-Clause AND BSD-3-Clause AND SSH-short AND (public_domain OR WTFPL) + MIT AND BSD-2-Clause AND public_domain AND SSH-short AND (public_domain OR WTFPL) AND Unlicense DROPBEAR_LICENSE_FILES := \ - file://LICENSE;md5=a5ec40cafba26fc4396d0b550f824e01 \ + file://LICENSE;md5=da58928b5d844c6667963cb5a109272d \ file://libtomcrypt/LICENSE;md5=71baacc459522324ef3e2b9e052e8180 \ - file://libtommath/LICENSE;md5=f72771f4af5e8c382974750f9f8701ad \ + file://libtommath/LICENSE;md5=23e7e0a32e53a2b1d35f5fd9ef053402 \ file://loginrec.c;startline=1;endline=26;md5=0d785ee11fab1cead2c7fee9c35574f1 # ---------------------------------------------------------------------------- @@ -48,6 +48,7 @@ DROPBEAR_CONF_OPT := \ --$(call ptx/disen, PTXCONF_DROPBEAR_DIS_OPENPTY)-openpty \ --$(call ptx/disen, PTXCONF_DROPBEAR_DIS_SYSLOG)-syslog \ --enable-shadow \ + --disable-plugin \ --disable-fuzz \ --enable-bundled-libtom \ --$(call ptx/disen, PTXCONF_DROPBEAR_DIS_LASTLOG)-lastlog \ -- 2.27.0 _______________________________________________ ptxdist mailing list ptxdist@pengutronix.de To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de