From: Alexander Dahl <post@lespocky.de>
To: ptxdist@pengutronix.de
Subject: Re: [ptxdist] [PATCH 3/4] dropbear: version bump 2019.78 -> 2020.79
Date: Fri, 6 Nov 2020 00:05:11 +0100 [thread overview]
Message-ID: <20201105230510.cbd2x2oiu2fwllid@falbala.internal.home.lespocky.de> (raw)
In-Reply-To: <20201105081302.6770-4-ada@thorsis.com>
[-- Attachment #1.1: Type: text/plain, Size: 4994 bytes --]
Hei hei,
On Thu, Nov 05, 2020 at 09:13:01AM +0100, Alexander Dahl wrote:
> Noteworthy changes (not all options accessible through ptxdist menu):
>
> - added support for ed25519 hostkeys and authorized_keys
> - added support for chacha20-poly1305 authenticated cipher
> - added support for and rsa-sha2 signatures
> - disabled some options by default (kconfig defaults adapted accordingly)
> - fix idle detection clashing with keepalives
> - scp fix for CVE-2018-20685 where a server could modify name of output
> files
> - Call fsync() is called on parent directory when writing key files to
> ensure they are flushed
>
> One especially important change:
>
> > Use getrandom() call on Linux to ensure sufficient entropy has been
> > gathered at startup. Dropbear now avoids reading from the random
> > source at startup, instead waiting until the first connection. It is
> > possible that some platforms were running without enough entropy
> > previously, those could potentially block at first boot generating
> > host keys. The dropbear "-R" option is one way to avoid that.
>
> On older toolchains/kernel headers/kernels without getrandom() support,
> dropbear should behave like before.
>
> The curve25519 implementation was replaced with the one by TweetNaCl,
> which induced a change in 'LICENSE' summary. The old implementation was
> licensed BSD-3-Clause and the new is public domain.
>
> The bundled libtommath changed its license from dual license (public
> domain || WTFPL) to 'Unlicense' which is also a public domain license,
> but with a differently worded license text and an actual SPDX
> identifier.
>
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> ---
> rules/dropbear.in | 2 +-
> rules/dropbear.make | 11 ++++++-----
> 2 files changed, 7 insertions(+), 6 deletions(-)
When reworking this patch today in the morning I forgot to remove the
2019.78 patch series. The one patch in there had gone upstream with
2020.79 and can be dropped.
I'll send a v2 tomorrow.
A
>
> diff --git a/rules/dropbear.in b/rules/dropbear.in
> index d01f2c73e..dbe1a34bc 100644
> --- a/rules/dropbear.in
> +++ b/rules/dropbear.in
> @@ -116,6 +116,7 @@ comment "features"
> config DROPBEAR_DIS_X11
> bool
> prompt "disable X11 Forwarding"
> + default y
> help
> X11 forwarding means passing X11 (graphical interface)
> information over the SSH connection.
> @@ -149,7 +150,6 @@ config DROPBEAR_AES128
> config DROPBEAR_3DES
> bool
> prompt "3DES"
> - default y
> help
> DES is an IBM algorithm designed during the 1970s.
> In 1976, NIST has officially adopted it as an encryption
> diff --git a/rules/dropbear.make b/rules/dropbear.make
> index 4f55fac48..1907bc0ae 100644
> --- a/rules/dropbear.make
> +++ b/rules/dropbear.make
> @@ -16,19 +16,19 @@ PACKAGES-$(PTXCONF_DROPBEAR) += dropbear
> #
> # Paths and names
> #
> -DROPBEAR_VERSION := 2019.78
> -DROPBEAR_MD5 := a972c85ed678ad0fdcb7844e1294fb54
> +DROPBEAR_VERSION := 2020.79
> +DROPBEAR_MD5 := 830a7bf6349ac52a39c487d061efb352
> DROPBEAR := dropbear-$(DROPBEAR_VERSION)
> DROPBEAR_SUFFIX := tar.bz2
> DROPBEAR_URL := http://matt.ucc.asn.au/dropbear/releases/$(DROPBEAR).$(DROPBEAR_SUFFIX)
> DROPBEAR_SOURCE := $(SRCDIR)/$(DROPBEAR).$(DROPBEAR_SUFFIX)
> DROPBEAR_DIR := $(BUILDDIR)/$(DROPBEAR)
> DROPBEAR_LICENSE := \
> - MIT AND BSD-2-Clause AND BSD-3-Clause AND SSH-short AND (public_domain OR WTFPL)
> + MIT AND BSD-2-Clause AND public_domain AND SSH-short AND (public_domain OR WTFPL) AND Unlicense
> DROPBEAR_LICENSE_FILES := \
> - file://LICENSE;md5=a5ec40cafba26fc4396d0b550f824e01 \
> + file://LICENSE;md5=da58928b5d844c6667963cb5a109272d \
> file://libtomcrypt/LICENSE;md5=71baacc459522324ef3e2b9e052e8180 \
> - file://libtommath/LICENSE;md5=f72771f4af5e8c382974750f9f8701ad \
> + file://libtommath/LICENSE;md5=23e7e0a32e53a2b1d35f5fd9ef053402 \
> file://loginrec.c;startline=1;endline=26;md5=0d785ee11fab1cead2c7fee9c35574f1
>
> # ----------------------------------------------------------------------------
> @@ -48,6 +48,7 @@ DROPBEAR_CONF_OPT := \
> --$(call ptx/disen, PTXCONF_DROPBEAR_DIS_OPENPTY)-openpty \
> --$(call ptx/disen, PTXCONF_DROPBEAR_DIS_SYSLOG)-syslog \
> --enable-shadow \
> + --disable-plugin \
> --disable-fuzz \
> --enable-bundled-libtom \
> --$(call ptx/disen, PTXCONF_DROPBEAR_DIS_LASTLOG)-lastlog \
> --
> 2.27.0
>
>
> _______________________________________________
> ptxdist mailing list
> ptxdist@pengutronix.de
> To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de
--
/"\ ASCII RIBBON | »With the first link, the chain is forged. The first
\ / CAMPAIGN | speech censured, the first thought forbidden, the
X AGAINST | first freedom denied, chains us all irrevocably.«
/ \ HTML MAIL | (Jean-Luc Picard, quoting Judge Aaron Satie)
[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
[-- Attachment #2: Type: text/plain, Size: 181 bytes --]
_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de
next prev parent reply other threads:[~2020-11-05 23:05 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-05 8:12 [ptxdist] [PATCH 0/4] dropbear: version bump 2019.78 -> 2020.81 Alexander Dahl
2020-11-05 8:12 ` [ptxdist] [PATCH 1/4] dropbear: Consider licenses of bundled libs Alexander Dahl
2020-11-05 8:13 ` [ptxdist] [PATCH 2/4] dropbear: Revise comments Alexander Dahl
2020-11-05 8:13 ` [ptxdist] [PATCH 3/4] dropbear: version bump 2019.78 -> 2020.79 Alexander Dahl
2020-11-05 23:05 ` Alexander Dahl [this message]
2020-11-05 8:13 ` [ptxdist] [PATCH 4/4] dropbear: version bump 2020.79 -> 2020.81 Alexander Dahl
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201105230510.cbd2x2oiu2fwllid@falbala.internal.home.lespocky.de \
--to=post@lespocky.de \
--cc=ptxdist@pengutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox