[ptxdist] [PATCH v3 4/5] dropbear: version bump 2019.78 -> 2020.79

[Alexander Dahl <ada@thorsis.com>]

Noteworthy changes (not all options accessible through ptxdist menu):

- added support for ed25519 hostkeys and authorized_keys
- added support for chacha20-poly1305 authenticated cipher
- added support for and rsa-sha2 signatures
- disabled some options by default (kconfig defaults adapted accordingly)
- blowfish has been removed
- fix idle detection clashing with keepalives
- scp fix for CVE-2018-20685 where a server could modify name of output
  files
- Call fsync() is called on parent directory when writing key files to
  ensure they are flushed

One especially important change:

> Use getrandom() call on Linux to ensure sufficient entropy has been
> gathered at startup.  Dropbear now avoids reading from the random
> source at startup, instead waiting until the first connection. It is
> possible that some platforms were running without enough entropy
> previously, those could potentially block at first boot generating
> host keys.  The dropbear "-R" option is one way to avoid that.

On older toolchains/kernel headers/kernels without getrandom() support,
dropbear should behave like before.

The curve25519 implementation was replaced with the one by TweetNaCl,
which induced a change in 'LICENSE' summary.  The old implementation was
licensed BSD-3-Clause and the new is public domain.

The bundled libtommath changed its license from dual license (public
domain || WTFPL) to 'Unlicense' which is also a public domain license,
but with a differently worded license text and an actual SPDX
identifier.

The patch stack was dropped, the one patch was integrated upstream.

Signed-off-by: Alexander Dahl <ada@thorsis.com>
---

Notes:
    v3:
    - Reworded commit message
    
    v2:
    - Remove patch stack

 .../0001-configure-Fix-disable-fuzz.patch     | 47 -------------------
 patches/dropbear-2019.78/autogen.sh           |  1 -
 patches/dropbear-2019.78/series               |  4 --
 rules/dropbear.in                             |  2 +-
 rules/dropbear.make                           | 11 +++--
 5 files changed, 7 insertions(+), 58 deletions(-)
 delete mode 100644 patches/dropbear-2019.78/0001-configure-Fix-disable-fuzz.patch
 delete mode 120000 patches/dropbear-2019.78/autogen.sh
 delete mode 100644 patches/dropbear-2019.78/series

diff --git a/patches/dropbear-2019.78/0001-configure-Fix-disable-fuzz.patch b/patches/dropbear-2019.78/0001-configure-Fix-disable-fuzz.patch
deleted file mode 100644
index 03aec183a..000000000
--- a/patches/dropbear-2019.78/0001-configure-Fix-disable-fuzz.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From: Alexander Dahl <ada@thorsis.com>
-Date: Wed, 11 Mar 2020 10:50:45 +0100
-Subject: [PATCH] configure: Fix --disable-fuzz
-
-When explicitly passing --disable-fuzz to ./configure fuzz was actually
-enabled.
-
-Signed-off-by: Alexander Dahl <ada@thorsis.com>
----
-
-Notes:
-    Sent upstream: https://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2020q1/002202.html
-
- configure.ac | 17 ++++++++++++-----
- 1 file changed, 12 insertions(+), 5 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index 7199d7cb2300..104d60cfaf53 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -326,14 +326,21 @@ AC_ARG_ENABLE(shadow,
- AC_ARG_ENABLE(fuzz,
- 	[  --enable-fuzz           Build fuzzing. Not recommended for deployment.],
- 	[
--		AC_DEFINE(DROPBEAR_FUZZ, 1, Fuzzing)
--		AC_MSG_NOTICE(Enabling fuzzing)
--		DROPBEAR_FUZZ=1
--		# libfuzzer needs linking with c++ libraries
--		AC_PROG_CXX
-+		if test "x$enableval" = "xyes"; then
-+            AC_DEFINE(DROPBEAR_FUZZ, 1, Fuzzing)
-+            AC_MSG_NOTICE(Enabling fuzzing)
-+            DROPBEAR_FUZZ=1
-+            # libfuzzer needs linking with c++ libraries
-+            AC_PROG_CXX
-+        else
-+            AC_DEFINE(DROPBEAR_FUZZ, 0, Fuzzing)
-+            AC_MSG_NOTICE(Disabling fuzzing)
-+            DROPBEAR_FUZZ=0
-+        fi
- 	],
- 	[
- 		AC_DEFINE(DROPBEAR_FUZZ, 0, Fuzzing)
-+		AC_MSG_NOTICE(Disabling fuzzing)
- 		DROPBEAR_FUZZ=0
- 	]
- 
diff --git a/patches/dropbear-2019.78/autogen.sh b/patches/dropbear-2019.78/autogen.sh
deleted file mode 120000
index 9f8a4cb7d..000000000
--- a/patches/dropbear-2019.78/autogen.sh
+++ /dev/null
@@ -1 +0,0 @@
-../autogen.sh
\ No newline at end of file
diff --git a/patches/dropbear-2019.78/series b/patches/dropbear-2019.78/series
deleted file mode 100644
index 3e5a5247e..000000000
--- a/patches/dropbear-2019.78/series
+++ /dev/null
@@ -1,4 +0,0 @@
-# generated by git-ptx-patches
-#tag:base --start-number 1
-0001-configure-Fix-disable-fuzz.patch
-# c03ca050bdd0c61ac96e5bd22c9d0947  - git-ptx-patches magic
diff --git a/rules/dropbear.in b/rules/dropbear.in
index 7f777ae64..c0da7e222 100644
--- a/rules/dropbear.in
+++ b/rules/dropbear.in
@@ -116,6 +116,7 @@ comment "features"
 config DROPBEAR_DIS_X11
 	bool
 	prompt "disable X11 Forwarding"
+	default y
 	help
 	  X11 forwarding means passing X11 (graphical interface)
 	  information over the SSH connection.
@@ -149,7 +150,6 @@ config DROPBEAR_AES128
 config DROPBEAR_3DES
 	bool
 	prompt "3DES"
-	default y
 	help
 	  DES is an IBM algorithm designed during the 1970s.
 	  In 1976, NIST has officially adopted it as an encryption
diff --git a/rules/dropbear.make b/rules/dropbear.make
index e422eb4d5..a9404592e 100644
--- a/rules/dropbear.make
+++ b/rules/dropbear.make
@@ -16,19 +16,19 @@ PACKAGES-$(PTXCONF_DROPBEAR) += dropbear
 #
 # Paths and names
 #
-DROPBEAR_VERSION	:= 2019.78
-DROPBEAR_MD5		:= a972c85ed678ad0fdcb7844e1294fb54
+DROPBEAR_VERSION	:= 2020.79
+DROPBEAR_MD5		:= 830a7bf6349ac52a39c487d061efb352
 DROPBEAR		:= dropbear-$(DROPBEAR_VERSION)
 DROPBEAR_SUFFIX		:= tar.bz2
 DROPBEAR_URL		:= http://matt.ucc.asn.au/dropbear/releases/$(DROPBEAR).$(DROPBEAR_SUFFIX)
 DROPBEAR_SOURCE		:= $(SRCDIR)/$(DROPBEAR).$(DROPBEAR_SUFFIX)
 DROPBEAR_DIR		:= $(BUILDDIR)/$(DROPBEAR)
 DROPBEAR_LICENSE	:= \
-	MIT AND BSD-2-Clause AND BSD-3-Clause AND SSH-short AND (public_domain OR WTFPL)
+	MIT AND BSD-2-Clause AND public_domain AND SSH-short AND (public_domain OR WTFPL) AND Unlicense
 DROPBEAR_LICENSE_FILES	:= \
-	file://LICENSE;md5=a5ec40cafba26fc4396d0b550f824e01 \
+	file://LICENSE;md5=da58928b5d844c6667963cb5a109272d \
 	file://libtomcrypt/LICENSE;md5=71baacc459522324ef3e2b9e052e8180 \
-	file://libtommath/LICENSE;md5=f72771f4af5e8c382974750f9f8701ad \
+	file://libtommath/LICENSE;md5=23e7e0a32e53a2b1d35f5fd9ef053402 \
 	file://loginrec.c;startline=1;endline=26;md5=0d785ee11fab1cead2c7fee9c35574f1
 
 # ----------------------------------------------------------------------------
@@ -48,6 +48,7 @@ DROPBEAR_CONF_OPT 	:= \
 	--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_OPENPTY)-openpty \
 	--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_SYSLOG)-syslog \
 	--enable-shadow \
+	--disable-plugin \
 	--disable-fuzz \
 	--enable-bundled-libtom \
 	--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_LASTLOG)-lastlog \
-- 
2.27.0


_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de