Re: [ptxdist] [APPLIED] dropbear: Remove host/public key DSS support

[Michael Olbrich <m.olbrich@pengutronix.de>]

Thanks, applied as 3c822e5aa8e5aed64273df8823cd6d5b56954d03.

Michael

[sent from post-receive hook]

On Fri, 26 Nov 2021 15:34:57 +0100, Alexander Dahl <ada@thorsis.com> wrote:
> DSS option was removed already from ptxdist, it is not recommended for
> new keys.  In dropbear however, it was still default enabled, this is
> disabled through localoptions.h now.
> 
> Fixes: 01ac7cc409b5 ("dropbear: Remove deprecated options")
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> Message-Id: <20211105154734.19983-2-ada@thorsis.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/projectroot/etc/init.d/dropbear b/projectroot/etc/init.d/dropbear
> index 1edda1116a93..4d6530bdcc46 100644
> --- a/projectroot/etc/init.d/dropbear
> +++ b/projectroot/etc/init.d/dropbear
> @@ -10,21 +10,17 @@ DROPBEAR_EXTRA_ARGS=
>  # test ! -h /var/service/dropbear || exit 0
>  
>  DROPBEAR_RSAKEY_DEFAULT="@KEYDIR@/dropbear_rsa_host_key"
> -DROPBEAR_DSSKEY_DEFAULT="@KEYDIR@/dropbear_dss_host_key"
>  
>  test -z "$DROPBEAR_BANNER" || \
>    DROPBEAR_EXTRA_ARGS="$DROPBEAR_EXTRA_ARGS -b $DROPBEAR_BANNER"
>  test -n "$DROPBEAR_RSAKEY" || \
>    DROPBEAR_RSAKEY=$DROPBEAR_RSAKEY_DEFAULT
> -test -n "$DROPBEAR_DSSKEY" || \
> -  DROPBEAR_DSSKEY=$DROPBEAR_DSSKEY_DEFAULT
>  test -n "$DROPBEAR_KEYTYPES" || \
> -  DROPBEAR_KEYTYPES="rsa dss"
> +  DROPBEAR_KEYTYPES="rsa"
>  
>  dropbear_start() {
>  
>      KEY_ARGS=""
> -    test -f $DROPBEAR_DSSKEY && KEY_ARGS="$KEY_ARGS -d $DROPBEAR_DSSKEY"
>      test -f $DROPBEAR_RSAKEY && KEY_ARGS="$KEY_ARGS -r $DROPBEAR_RSAKEY"
>  
>      echo -n "starting dropbear..."
> diff --git a/projectroot/etc/rc.once.d/dropbear b/projectroot/etc/rc.once.d/dropbear
> index a126b26db76e..451236097832 100644
> --- a/projectroot/etc/rc.once.d/dropbear
> +++ b/projectroot/etc/rc.once.d/dropbear
> @@ -3,12 +3,9 @@
>  PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
>  
>  DROPBEAR_RSAKEY_DEFAULT="@KEYDIR@/dropbear_rsa_host_key"
> -DROPBEAR_DSSKEY_DEFAULT="@KEYDIR@/dropbear_dss_host_key"
>  
>  test -n "$DROPBEAR_RSAKEY" || \
>    DROPBEAR_RSAKEY=$DROPBEAR_RSAKEY_DEFAULT
> -test -n "$DROPBEAR_DSSKEY" || \
> -  DROPBEAR_DSSKEY=$DROPBEAR_DSSKEY_DEFAULT
>  
>  gen_key() {
>  
> @@ -29,5 +26,3 @@ gen_key() {
>  }
>  
>  [ -e "$DROPBEAR_RSAKEY" ] || gen_key rsa "$DROPBEAR_RSAKEY"
> -[ -e "$DROPBEAR_DSSKEY" ] || gen_key dss "$DROPBEAR_DSSKEY"
> -
> diff --git a/rules/dropbear.in b/rules/dropbear.in
> index 507ee8e7f28e..8ae2d788bd27 100644
> --- a/rules/dropbear.in
> +++ b/rules/dropbear.in
> @@ -260,7 +260,7 @@ config DROPBEAR_SHA512
>  	  SHA-1. SHA-2 consists of a set of four hash functions with digests
>  	  that are 224, 256, 384 or 512 bits.
>  
> -comment "Hostkey/public key algorithms, at least one required --- RSA is recommended, DSS is not recommended for new keys"
> +comment "Hostkey/public key algorithms, at least one required ---"
>  
>  config DROPBEAR_RSA
>  	bool
> @@ -277,7 +277,7 @@ config DROPBEAR_ECDSA
>  	prompt "ecdsa"
>  	help
>  	  ECDSA stands for Elliptic Curve Digital Signature Algorithm.
> -	  ECDSA is significantly faster than RSA or DSS.
> +	  ECDSA is significantly faster than RSA.
>  
>  comment "Key exchange algorithm ---"
>  
> diff --git a/rules/dropbear.make b/rules/dropbear.make
> index 536c9176a5d7..c4577fed2685 100644
> --- a/rules/dropbear.make
> +++ b/rules/dropbear.make
> @@ -198,6 +198,9 @@ else
>  endif
>  
>  # host key / public key
> +	@echo "ptxdist: disabling dss"
> +	@echo "#define DROPBEAR_DSS 0" >> $(DROPBEAR_LOCALOPTIONS)
> +
>  ifdef PTXCONF_DROPBEAR_RSA
>  	@echo "ptxdist: enabling rsa"
>  	@echo "#define DROPBEAR_RSA 1" >> $(DROPBEAR_LOCALOPTIONS)

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de