From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Wed, 08 Jul 2026 13:47:51 +0200 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1whQkp-001YZC-2a for lore@lore.pengutronix.de; Wed, 08 Jul 2026 13:47:51 +0200 Received: from [127.0.0.1] (helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1whQkp-0002Ne-G7; Wed, 08 Jul 2026 13:47:51 +0200 Received: from mx1.white.stw.pengutronix.de ([185.203.200.13]) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1whQkZ-0002NW-5J for ptxdist@pengutronix.de; Wed, 08 Jul 2026 13:47:35 +0200 Received: from mail.thorsis.com (mail.thorsis.com [217.92.40.78]) by mx1.white.stw.pengutronix.de (Postfix) with ESMTPS id A79B7202749 for ; Wed, 08 Jul 2026 13:47:34 +0200 (CEST) Authentication-Results: mx1.white.stw.pengutronix.de; dkim=pass header.d=thorsis.com header.s=dkim header.b=qeTuQqb0; spf=pass (mx1.white.stw.pengutronix.de: domain of ada@thorsis.com designates 217.92.40.78 as permitted sender) smtp.mailfrom=ada@thorsis.com; dmarc=pass (policy=quarantine) header.from=thorsis.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 594731481299 for ; Wed, 8 Jul 2026 13:47:37 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=thorsis.com; s=dkim; t=1783511257; h=from:subject:date:message-id:to:mime-version: content-transfer-encoding; bh=AylA/tj4KP0gCw5fBWReA9eo2gWzi3Mtjt4PxENCesA=; b=qeTuQqb0yP7wl/ca9bsSn5FCPMy5/AOYAbDbr+rVf1kV7xIEidV6du/gIPbBv3h4JuAFR3 cYLwq/pt6Vc6G/o+pTju7ZUvncYogCg8W40HLQ7LFQWh0n//sMqfzDGQIRJLDwXA9FiKs9 mA7vM3zR4W5s58ZOE+hOvwugJaO4V2pGlSuqtjH1KUV7Aue9ekSlawyHgjGmwJEtQtMTY3 sXRHLE0bPycwXeopwPq0l+GvqtrvPR0PUbip1m97jtHCps77s4RKls0RBmnjSl0EoLhAUW 7aFDcTNkvZaku8X1mNoSzH3g+UsgWbNoQ2dcfuOXOW42OfnX9roGBzSzNrmYeA== To: ptxdist@pengutronix.de Date: Wed, 8 Jul 2026 13:47:33 +0200 Message-ID: <20260708114733.3505462-1-ada@thorsis.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Last-TLS-Session-Version: TLSv1.3 X-Spamd-Result: default: False [-2.50 / 15.00]; BAYES_HAM(-3.00)[100.00%]; MID_CONTAINS_FROM(1.00)[]; R_MISSING_CHARSET(0.50)[]; DMARC_POLICY_ALLOW(-0.50)[thorsis.com,quarantine]; R_SPF_ALLOW(-0.20)[+mx]; R_DKIM_ALLOW(-0.20)[thorsis.com:s=dkim]; MIME_GOOD(-0.10)[text/plain]; RCVD_VIA_SMTP_AUTH(0.00)[]; RCPT_COUNT_ONE(0.00)[1]; RCVD_COUNT_ONE(0.00)[1]; ASN(0.00)[asn:3320, ipnet:217.80.0.0/12, country:DE]; MIME_TRACE(0.00)[0:+]; DKIM_TRACE(0.00)[thorsis.com:+]; NEURAL_HAM(-0.00)[-1.000]; RECEIVED_HELO_LOCALHOST(0.00)[]; FROM_EQ_ENVFROM(0.00)[]; FROM_HAS_DN(0.00)[]; ARC_NA(0.00)[]; TO_DN_NONE(0.00)[]; PREVIOUSLY_DELIVERED(0.00)[ptxdist@pengutronix.de]; TO_MATCH_ENVRCPT_ALL(0.00)[]; RCVD_TLS_ALL(0.00)[] X-Rspamd-Action: no action X-Rspamd-Server: mx1 X-Rspamd-Queue-Id: A79B7202749 X-Stat-Signature: u4r548t4fffm7zoo7mexgm5xoueekadp X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on metis.whiteo.stw.pengutronix.de X-Spam-Level: X-Spam-Status: No, score=-3.0 required=5.0 tests=AWL,BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,SPF_HELO_NONE autolearn=ham autolearn_force=no version=3.4.2 Subject: [ptxdist] [PATCH] dropbear: version bump 2026.91 -> 2026.92 X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Alexander Dahl via ptxdist Reply-To: ptxdist@pengutronix.de Cc: Alexander Dahl Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false Two security fixes. Adding a patch for a build issue. Noteworthy compatibility/configuration changes from the changelog: - >> server auth plugins have been deprecated, the configure option has been renamed to --enable-plugin-deprecated. Planned to be removed in future. - >> Two factor auth "-t" has been deprecated, it now requires a configuration option DEPRECATED_TWO_FACTOR. Planned to be removed in future. - Security: server: Don't allow -B (accept blank password) with -t (two factor auth). If run with -t and -B a user configured with a blank password would be allowed to log in without pubkey auth. https://github.com/mkj/dropbear/commit/23ec78285639edf068d86bb96f91cba755039740 Reported by nvidia - Security: server: Fix parsing of long authorized_keys lines. The remainder of a long line would be handled as the start of a new line. In the case where external programs add semi-trusted public keys to authorized_keys, a crafted key might bypass restrictions such as "command=". https://github.com/mkj/dropbear/commit/8d8e1930b866eb44135ae393a793cbeb03b6b9d6 Reported by nvidia - >> authorized_keys is now limited to 300 lines. - >> all programs and scp: Disallow following symlinks when writing output files. This could prevent symlink attacks. Writing keys to an untrusted directory is not recommended regardless. Signed-off-by: Alexander Dahl --- ...nfigure-Fix-deprecated-plugin-option.patch | 109 ++++++++++++++++++ patches/dropbear-2026.92/series | 4 + rules/dropbear.make | 6 +- 3 files changed, 116 insertions(+), 3 deletions(-) create mode 100644 patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch create mode 100644 patches/dropbear-2026.92/series diff --git a/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch b/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch new file mode 100644 index 000000000..d12d292d2 --- /dev/null +++ b/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch @@ -0,0 +1,109 @@ +From: Alexander Dahl +Date: Wed, 8 Jul 2026 13:02:37 +0200 +Subject: [PATCH] configure: Fix (deprecated) plugin option + +Actually two issues here. + +On one hand there was the incomplete rename from --enable-plugin to +--enable-plugin-deprecated triggering new warnings with +dropbear-2026.92. Technically new options where ignored while the old +--enable-plugin and --disable-plugin where still considered. + +On the other hand the previous option was broken from the beginning, +because when passing --enable-plugin or --disable-plugin explicitly the +option was not evaluated correctly. + +Link: https://www.gnu.org/software/autoconf/manual/autoconf-2.71/html_node/Package-Options.html +Fixes: 8c6aaf8d361e ("External Public-Key Authentication API (#72)") +Fixes: #298 +Fixes: e3e7b28c33ac ("Make -t two factor and plugins deprecated") +Signed-off-by: Alexander Dahl +Upstream-Status: Submitted [https://github.com/mkj/dropbear/pull/462] +--- + configure | 23 +++++++++++++++++------ + configure.ac | 15 +++++++++++---- + 2 files changed, 28 insertions(+), 10 deletions(-) + +diff --git a/configure b/configure +index b8e90be06083..9b7b9b56f6f4 100755 +--- a/configure ++++ b/configure +@@ -736,7 +736,7 @@ enable_pam + enable_openpty + enable_syslog + enable_shadow +-enable_plugin ++enable_plugin_deprecated + enable_fuzz + enable_bundled_libtom + enable_lastlog +@@ -5838,22 +5838,33 @@ fi + + + # Plugin support will be removed soon. Open a github issue if you're using it. +-# Check whether --enable-plugin was given. +-if test ${enable_plugin+y} ++# Check whether --enable-plugin-deprecated was given. ++if test ${enable_plugin_deprecated+y} + then : +- enableval=$enable_plugin; ++ enableval=$enable_plugin_deprecated; ++ if test "x$enableval" = "xyes"; then + + printf "%s\n" "#define DROPBEAR_PLUGIN 1" >>confdefs.h + +- { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Enabling support for External Public Key Authentication" >&5 ++ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Enabling support for External Public Key Authentication" >&5 + printf "%s\n" "$as_me: Enabling support for External Public Key Authentication" >&6;} +- DROPBEAR_PLUGIN=1 ++ DROPBEAR_PLUGIN=1 ++ else ++ ++printf "%s\n" "#define DROPBEAR_PLUGIN 0" >>confdefs.h ++ ++ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Disabling support for External Public Key Authentication" >&5 ++printf "%s\n" "$as_me: Disabling support for External Public Key Authentication" >&6;} ++ DROPBEAR_PLUGIN=0 ++ fi + + else $as_nop + + + printf "%s\n" "#define DROPBEAR_PLUGIN 0" >>confdefs.h + ++ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Disabling support for External Public Key Authentication" >&5 ++printf "%s\n" "$as_me: Disabling support for External Public Key Authentication" >&6;} + DROPBEAR_PLUGIN=0 + + +diff --git a/configure.ac b/configure.ac +index 25a13ee78e88..6dfeacf1f57f 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -345,15 +345,22 @@ AC_ARG_ENABLE(shadow, + ) + + # Plugin support will be removed soon. Open a github issue if you're using it. +-AC_ARG_ENABLE(plugin, ++AC_ARG_ENABLE(plugin-deprecated, + [AS_HELP_STRING([--enable-plugin-deprecated], [Enable support for External Public Key Authentication plug-in])], + [ +- AC_DEFINE(DROPBEAR_PLUGIN, 1, External Public Key Authentication) +- AC_MSG_NOTICE(Enabling support for External Public Key Authentication) +- DROPBEAR_PLUGIN=1 ++ if test "x$enableval" = "xyes"; then ++ AC_DEFINE(DROPBEAR_PLUGIN, 1, External Public Key Authentication) ++ AC_MSG_NOTICE(Enabling support for External Public Key Authentication) ++ DROPBEAR_PLUGIN=1 ++ else ++ AC_DEFINE(DROPBEAR_PLUGIN, 0, External Public Key Authentication) ++ AC_MSG_NOTICE(Disabling support for External Public Key Authentication) ++ DROPBEAR_PLUGIN=0 ++ fi + ], + [ + AC_DEFINE(DROPBEAR_PLUGIN, 0, External Public Key Authentication) ++ AC_MSG_NOTICE(Disabling support for External Public Key Authentication) + DROPBEAR_PLUGIN=0 + ] + diff --git a/patches/dropbear-2026.92/series b/patches/dropbear-2026.92/series new file mode 100644 index 000000000..b8f33b5c2 --- /dev/null +++ b/patches/dropbear-2026.92/series @@ -0,0 +1,4 @@ +# generated by git-ptx-patches +#tag:base --start-number 1 +0001-configure-Fix-deprecated-plugin-option.patch +# 5e7edc37cce39b1dd92d69f9a2cf364c - git-ptx-patches magic diff --git a/rules/dropbear.make b/rules/dropbear.make index bc93b0047..3dded0d5b 100644 --- a/rules/dropbear.make +++ b/rules/dropbear.make @@ -16,8 +16,8 @@ PACKAGES-$(PTXCONF_DROPBEAR) += dropbear # # Paths and names # -DROPBEAR_VERSION := 2026.91 -DROPBEAR_SHA256 := defa924475abf6bc1e74abc00173e46bfdc804bd47caafa14f5a4ef0cc76da34 +DROPBEAR_VERSION := 2026.92 +DROPBEAR_SHA256 := 91dcb5234de8dea68dd82c55411c9fc986b457ab58372a780ee8a870419c2f7e DROPBEAR := dropbear-$(DROPBEAR_VERSION) DROPBEAR_SUFFIX := tar.bz2 DROPBEAR_URL := \ @@ -52,7 +52,7 @@ DROPBEAR_CONF_OPT := \ --$(call ptx/disen, PTXCONF_DROPBEAR_DIS_OPENPTY)-openpty \ --$(call ptx/disen, PTXCONF_DROPBEAR_DIS_SYSLOG)-syslog \ --enable-shadow \ - --disable-plugin \ + --disable-plugin-deprecated \ --disable-fuzz \ --enable-bundled-libtom \ --$(call ptx/disen, PTXCONF_DROPBEAR_DIS_LASTLOG)-lastlog \ base-commit: ad8c2c3283df6fc624b7dfeb83a0449e2f4b92ed -- 2.47.3