From mboxrd@z Thu Jan 1 00:00:00 1970 Return-path: Received: from mail.thorsis.com ([92.198.35.195]) by metis.ext.pengutronix.de with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1keZWX-0001c5-Js for ptxdist@pengutronix.de; Mon, 16 Nov 2020 09:06:06 +0100 Received: from localhost (localhost [127.0.0.1]) by mail.thorsis.com (Postfix) with ESMTP id C0631495A for ; Mon, 16 Nov 2020 09:06:04 +0100 (CET) Received: from mail.thorsis.com ([127.0.0.1]) by localhost (mail.thorsis.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kLPRfgRrc_SV for ; Mon, 16 Nov 2020 09:06:04 +0100 (CET) Received: from adahl by ada.ifak-system.com with local (Exim 4.92) (envelope-from ) id 1keZWK-0006Wb-J5 for ptxdist@pengutronix.de; Mon, 16 Nov 2020 09:05:52 +0100 From: Alexander Dahl Date: Mon, 16 Nov 2020 09:05:50 +0100 Message-Id: <20201116080552.25031-4-ada@thorsis.com> In-Reply-To: <20201116080552.25031-1-ada@thorsis.com> References: <20201116080552.25031-1-ada@thorsis.com> Subject: [ptxdist] [PATCH v3 3/5] dropbear: Revise comments List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ptxdist-bounces@pengutronix.de Sender: "ptxdist" To: ptxdist@pengutronix.de Add more section markers and update recommendations based on upstream's 'default_options.h' file. Signed-off-by: Alexander Dahl --- Notes: v3: - Adapt to new patch 2/5 removing some options rules/dropbear.in | 8 +++++--- rules/dropbear.make | 18 +++++++++++------- 2 files changed, 16 insertions(+), 10 deletions(-) diff --git a/rules/dropbear.in b/rules/dropbear.in index d23f9b17f..7f777ae64 100644 --- a/rules/dropbear.in +++ b/rules/dropbear.in @@ -208,7 +208,7 @@ config DROPBEAR_CTR_CIPHERS CBC mode against certain attacks. This adds around 1kB to binary size and is recommended for most cases. -comment "Integrity, at least one required --- RFC Draft requires sha1-hmac and recommends sha1-96" +comment "Integrity, at least one required --- sha2-256 is recommended as a default, sha1 for compatibility" config DROPBEAR_SHA1 bool @@ -260,7 +260,7 @@ config DROPBEAR_SHA512 SHA-1. SHA-2 consists of a set of four hash functions with digests that are 224, 256, 384 or 512 bits. -comment "Hostkey/public key algorithms, at least one required --- SSH2 RFC Draft requires dss, recommends rsa" +comment "Hostkey/public key algorithms, at least one required --- RSA is recommended, DSS is not recommended for new keys" config DROPBEAR_RSA bool @@ -279,6 +279,8 @@ config DROPBEAR_ECDSA ECDSA stands for Elliptic Curve Digital Signature Algorithm. ECDSA is significantly faster than RSA or DSS. +comment "Key exchange algorithm ---" + config DROPBEAR_ECDH bool prompt "ecdh" @@ -348,7 +350,7 @@ config DROPBEAR_SCP comment "OpenSSH scp is selected!" depends on OPENSSH_SCP -comment "runtime options ---" +comment "runtime options ---" config DROPBEAR_STARTSCRIPT bool diff --git a/rules/dropbear.make b/rules/dropbear.make index 9403afd00..e422eb4d5 100644 --- a/rules/dropbear.make +++ b/rules/dropbear.make @@ -67,6 +67,7 @@ $(STATEDIR)/dropbear.prepare: @echo "/* localoptions.h created by ptxdist */" > $(DROPBEAR_LOCALOPTIONS) +# features ifdef PTXCONF_DROPBEAR_DIS_X11 @echo "ptxdist: disabling x11 forwarding" @echo "#define DROPBEAR_X11FWD 0" >> $(DROPBEAR_LOCALOPTIONS) @@ -76,13 +77,13 @@ else endif ifdef PTXCONF_DROPBEAR_DIS_TCP - @echo "ptxdist: disabling tcp" + @echo "ptxdist: disabling tcp forwarding" @echo "#define DROPBEAR_CLI_LOCALTCPFWD 0" >> $(DROPBEAR_LOCALOPTIONS) @echo "#define DROPBEAR_CLI_REMOTETCPFWD 0" >> $(DROPBEAR_LOCALOPTIONS) @echo "#define DROPBEAR_SVR_LOCALTCPFWD 0" >> $(DROPBEAR_LOCALOPTIONS) @echo "#define DROPBEAR_SVR_REMOTETCPFWD 0" >> $(DROPBEAR_LOCALOPTIONS) else - @echo "ptxdist: enabling tcp" + @echo "ptxdist: enabling tcp forwarding" @echo "#define DROPBEAR_CLI_LOCALTCPFWD 1" >> $(DROPBEAR_LOCALOPTIONS) @echo "#define DROPBEAR_CLI_REMOTETCPFWD 1" >> $(DROPBEAR_LOCALOPTIONS) @echo "#define DROPBEAR_SVR_LOCALTCPFWD 1" >> $(DROPBEAR_LOCALOPTIONS) @@ -90,16 +91,16 @@ else endif ifdef PTXCONF_DROPBEAR_DIS_AGENT - @echo "ptxdist: disabling agent" + @echo "ptxdist: disabling auth agent forwarding" @echo "#define DROPBEAR_SVR_AGENTFWD 0" >> $(DROPBEAR_LOCALOPTIONS) @echo "#define DROPBEAR_CLI_AGENTFWD 0" >> $(DROPBEAR_LOCALOPTIONS) else - @echo "ptxdist: enabling agent" + @echo "ptxdist: enabling auth agent forwarding" @echo "#define DROPBEAR_SVR_AGENTFWD 1" >> $(DROPBEAR_LOCALOPTIONS) @echo "#define DROPBEAR_CLI_AGENTFWD 1" >> $(DROPBEAR_LOCALOPTIONS) endif - +# encryption ifdef PTXCONF_DROPBEAR_AES128 @echo "ptxdist: enabling aes128" @echo "#define DROPBEAR_AES128 1" >> $(DROPBEAR_LOCALOPTIONS) @@ -140,6 +141,7 @@ else @echo "#define DROPBEAR_TWOFISH128 0" >> $(DROPBEAR_LOCALOPTIONS) endif +# ciphers ifdef PTXCONF_DROPBEAR_CBC_CIPHERS @echo "ptxdist: enabling cbc ciphers" @echo "#define DROPBEAR_ENABLE_CBC_MODE 1" >> $(DROPBEAR_LOCALOPTIONS) @@ -157,6 +159,7 @@ else @echo "#define DROPBEAR_ENABLE_CTR_MODE 0" >> $(DROPBEAR_LOCALOPTIONS) endif +# integrity ifdef PTXCONF_DROPBEAR_SHA1 @echo "ptxdist: enabling sha1" @echo "#define DROPBEAR_SHA1_HMAC 1" >> $(DROPBEAR_LOCALOPTIONS) @@ -193,7 +196,7 @@ else @echo "#define DROPBEAR_SHA2_512_HMAC 0" >> $(DROPBEAR_LOCALOPTIONS) endif - +# host key / public key ifdef PTXCONF_DROPBEAR_RSA @echo "ptxdist: enabling rsa" @echo "#define DROPBEAR_RSA 1" >> $(DROPBEAR_LOCALOPTIONS) @@ -210,6 +213,7 @@ else @echo "#define DROPBEAR_ECDSA 0" >> $(DROPBEAR_LOCALOPTIONS) endif +# key exchange algorithm ifdef PTXCONF_DROPBEAR_ECDH @echo "ptxdist: enabling ecdh" @echo "#define DROPBEAR_ECDH 1" >> $(DROPBEAR_LOCALOPTIONS) @@ -226,7 +230,7 @@ else @echo "#define DROPBEAR_CURVE25519 0" >> $(DROPBEAR_LOCALOPTIONS) endif - +# authentication types ifdef PTXCONF_DROPBEAR_PASSWD @echo "ptxdist: enabling passwd" @echo "#define DROPBEAR_SVR_PASSWORD_AUTH 1" >> $(DROPBEAR_LOCALOPTIONS) -- 2.27.0 _______________________________________________ ptxdist mailing list ptxdist@pengutronix.de To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de