[ptxdist] [PATCH] dropbear: version bump 2014.65 -> 2015.67

[ptxdist] [PATCH] dropbear: version bump 2014.65 -> 2015.67

[Bruno Thomsen]

The new version contain options to enable/disable cipher modes.
Keeping today's default cipher mode.
In a secure solution one would disable CBC and enable CTR.

Signed-off-by: Bruno Thomsen <bth@kamstrup.com>
---
 rules/dropbear.in   | 15 +++++++++++++++
 rules/dropbear.make | 18 ++++++++++++++++--
 2 files changed, 31 insertions(+), 2 deletions(-)

diff --git a/rules/dropbear.in b/rules/dropbear.in
index fe2ada3..79aad57 100644
--- a/rules/dropbear.in
+++ b/rules/dropbear.in
@@ -203,6 +203,21 @@ config DROPBEAR_TWOFISH256
 	  bijective f function made by four key-dependent
 	  8x8-bit S-boxes.
 
+config DROPBEAR_CBC_CIPHERS
+	bool
+	prompt "CBC mode ciphers"
+	default y
+	help
+	  Enable CBC mode for ciphers. This has security issues though
+	  is the most compatible with older SSH implementations.
+
+config DROPBEAR_CTR_CIPHERS
+	bool
+	prompt "Counter mode ciphers"
+	help
+	  Enable "Counter Mode" for ciphers. This is more secure than normal
+	  CBC mode against certain attacks. This adds around 1kB to binary
+	  size and is recommended for most cases.
 
 comment "Integrity, at least one required --- RFC Draft requires sha1-hmac and recommends sha1-96"
 
diff --git a/rules/dropbear.make b/rules/dropbear.make
index f03d0fc..ab9da5d 100644
--- a/rules/dropbear.make
+++ b/rules/dropbear.make
@@ -18,8 +18,8 @@ PACKAGES-$(PTXCONF_DROPBEAR) += dropbear
 #
 # Paths and names
 #
-DROPBEAR_VERSION	:= 2014.65
-DROPBEAR_MD5		:= 1918604238817385a156840fa2c39490
+DROPBEAR_VERSION	:= 2015.67
+DROPBEAR_MD5		:= e967e320344cd4bfebe321e3ab8514d6
 DROPBEAR		:= dropbear-$(DROPBEAR_VERSION)
 DROPBEAR_SUFFIX		:= tar.bz2
 DROPBEAR_URL		:= http://matt.ucc.asn.au/dropbear/releases/$(DROPBEAR).$(DROPBEAR_SUFFIX)
@@ -163,7 +163,21 @@ else
 	@$(call disable_c, $(DROPBEAR_DIR)/options.h,DROPBEAR_TWOFISH128)
 endif
 
+ifdef PTXCONF_DROPBEAR_CBC_CIPHERS
+	@echo "ptxdist: enabling cbc ciphers"
+	@$(call enable_c, $(DROPBEAR_DIR)/options.h,DROPBEAR_ENABLE_CBC_MODE)
+else
+	@echo "ptxdist: disabling cbc ciphers"
+	@$(call disable_c, $(DROPBEAR_DIR)/options.h,DROPBEAR_ENABLE_CBC_MODE)
+endif
 
+ifdef PTXCONF_DROPBEAR_CTR_CIPHERS
+	@echo "ptxdist: enabling ctr ciphers"
+	@$(call enable_c, $(DROPBEAR_DIR)/options.h,DROPBEAR_ENABLE_CTR_MODE)
+else
+	@echo "ptxdist: disabling ctr ciphers"
+	@$(call disable_c, $(DROPBEAR_DIR)/options.h,DROPBEAR_ENABLE_CTR_MODE)
+endif
 
 ifdef PTXCONF_DROPBEAR_SHA1
 	@echo "ptxdist: enabling sha1"
-- 
1.9.1


-- 
ptxdist mailing list
ptxdist@pengutronix.de

Re: [ptxdist] [PATCH] dropbear: version bump 2014.65 -> 2015.67

[Michael Olbrich]

On Mon, Feb 16, 2015 at 04:47:09PM +0100, Bruno Thomsen wrote:
> The new version contain options to enable/disable cipher modes.
> Keeping today's default cipher mode.
> In a secure solution one would disable CBC and enable CTR.
> 
> Signed-off-by: Bruno Thomsen <bth@kamstrup.com>
> ---
>  rules/dropbear.in   | 15 +++++++++++++++
>  rules/dropbear.make | 18 ++++++++++++++++--
>  2 files changed, 31 insertions(+), 2 deletions(-)
> 
> diff --git a/rules/dropbear.in b/rules/dropbear.in
> index fe2ada3..79aad57 100644
> --- a/rules/dropbear.in
> +++ b/rules/dropbear.in
> @@ -203,6 +203,21 @@ config DROPBEAR_TWOFISH256
>  	  bijective f function made by four key-dependent
>  	  8x8-bit S-boxes.
>  
> +config DROPBEAR_CBC_CIPHERS
> +	bool
> +	prompt "CBC mode ciphers"
> +	default y
> +	help
> +	  Enable CBC mode for ciphers. This has security issues though
> +	  is the most compatible with older SSH implementations.

In that case, shouldn't this be off by default? Those that still need it
can enable it.

Michael

> +
> +config DROPBEAR_CTR_CIPHERS
> +	bool
> +	prompt "Counter mode ciphers"
> +	help
> +	  Enable "Counter Mode" for ciphers. This is more secure than normal
> +	  CBC mode against certain attacks. This adds around 1kB to binary
> +	  size and is recommended for most cases.
>  
>  comment "Integrity, at least one required --- RFC Draft requires sha1-hmac and recommends sha1-96"
>  
> diff --git a/rules/dropbear.make b/rules/dropbear.make
> index f03d0fc..ab9da5d 100644
> --- a/rules/dropbear.make
> +++ b/rules/dropbear.make
> @@ -18,8 +18,8 @@ PACKAGES-$(PTXCONF_DROPBEAR) += dropbear
>  #
>  # Paths and names
>  #
> -DROPBEAR_VERSION	:= 2014.65
> -DROPBEAR_MD5		:= 1918604238817385a156840fa2c39490
> +DROPBEAR_VERSION	:= 2015.67
> +DROPBEAR_MD5		:= e967e320344cd4bfebe321e3ab8514d6
>  DROPBEAR		:= dropbear-$(DROPBEAR_VERSION)
>  DROPBEAR_SUFFIX		:= tar.bz2
>  DROPBEAR_URL		:= http://matt.ucc.asn.au/dropbear/releases/$(DROPBEAR).$(DROPBEAR_SUFFIX)
> @@ -163,7 +163,21 @@ else
>  	@$(call disable_c, $(DROPBEAR_DIR)/options.h,DROPBEAR_TWOFISH128)
>  endif
>  
> +ifdef PTXCONF_DROPBEAR_CBC_CIPHERS
> +	@echo "ptxdist: enabling cbc ciphers"
> +	@$(call enable_c, $(DROPBEAR_DIR)/options.h,DROPBEAR_ENABLE_CBC_MODE)
> +else
> +	@echo "ptxdist: disabling cbc ciphers"
> +	@$(call disable_c, $(DROPBEAR_DIR)/options.h,DROPBEAR_ENABLE_CBC_MODE)
> +endif
>  
> +ifdef PTXCONF_DROPBEAR_CTR_CIPHERS
> +	@echo "ptxdist: enabling ctr ciphers"
> +	@$(call enable_c, $(DROPBEAR_DIR)/options.h,DROPBEAR_ENABLE_CTR_MODE)
> +else
> +	@echo "ptxdist: disabling ctr ciphers"
> +	@$(call disable_c, $(DROPBEAR_DIR)/options.h,DROPBEAR_ENABLE_CTR_MODE)
> +endif
>  
>  ifdef PTXCONF_DROPBEAR_SHA1
>  	@echo "ptxdist: enabling sha1"
> -- 
> 1.9.1
> 
> 
> -- 
> ptxdist mailing list
> ptxdist@pengutronix.de
> 

-- 
Pengutronix e.K.                           |                             |
Industrial Linux Solutions                 | http://www.pengutronix.de/  |
Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

-- 
ptxdist mailing list
ptxdist@pengutronix.de

Re: [ptxdist] [PATCH] dropbear: version bump 2014.65 -> 2015.67

[Bruno Thomsen]

> > +config DROPBEAR_CBC_CIPHERS
> > +	bool
> > +	prompt "CBC mode ciphers"
> > +	default y
> > +	help
> > +	  Enable CBC mode for ciphers. This has security issues though
> > +	  is the most compatible with older SSH implementations.
>
> In that case, shouldn't this be off by default? Those that still need it can enable it.

I was a bit in doubt about ptxdist default policy was to be fairly secure out-of-box or compatible with old software/equipment.
I'm all in for pushing a strong default security configuration :)

Bruno

-- 
ptxdist mailing list
ptxdist@pengutronix.de

[ptxdist] [PATCH] Dropbear: version bump 2014.65 -> 2015.67

[Juergen Borleis]

And additionally clean up the rule file.

Signed-off-by: Juergen Borleis <jbe@pengutronix.de>

diff --git a/patches/dropbear-2015.67/0001-dropbear-disabling-ENABLE_CLI_PUBKEY_AUTH-let-the-bu.patch 
b/patches/dropbear-2015.67/0001-dropbear-disabling-ENABLE_CLI_PUBKEY_AUTH-let-the-bu.patch
new file mode 100644
index 000000000000..6fc655a95945
--- /dev/null
+++ b/patches/dropbear-2015.67/0001-dropbear-disabling-ENABLE_CLI_PUBKEY_AUTH-let-the-bu.patch
@@ -0,0 +1,45 @@
+From: Juergen Borleis <jbe@pengutronix.de>
+Date: Fri, 13 Mar 2015 10:53:46 +0100
+Subject: [PATCH] dropbear: disabling ENABLE_CLI_PUBKEY_AUTH let the build
+ fail
+
+Function multihop_passthrough_args() fails due to missing 'privkeys' member
+in structure 'cli_runopts'. So lets also disable ENABLE_CLI_MULTIHOP for
+this case.
+And even cli_getopts() fails due to missing loadidentityfile() function
+in this case.
+
+Signed-off-by: Juergen Borleis <jbe@pengutronix.de>
+---
+ options.h    |    4 +++-
+ sysoptions.h |    2 +-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/options.h b/options.h
+index 6339b0a4738e..1360b5c6758f 100644
+--- a/options.h
++++ b/options.h
+@@ -218,7 +218,9 @@ much traffic. */
+ 
+ /* A default argument for dbclient -i <privatekey>. 
+    leading "~" is expanded */
+-#define DROPBEAR_DEFAULT_CLI_AUTHKEY "~/.ssh/id_dropbear"
++#ifdef ENABLE_CLI_PUBKEY_AUTH
++# define DROPBEAR_DEFAULT_CLI_AUTHKEY "~/.ssh/id_dropbear"
++#endif
+ 
+ /* This variable can be used to set a password for client
+  * authentication on the commandline. Beware of platforms
+diff --git a/sysoptions.h b/sysoptions.h
+index bec72461d8e4..eeb78cb129a5 100644
+--- a/sysoptions.h
++++ b/sysoptions.h
+@@ -202,7 +202,7 @@
+ #define USING_LISTENERS
+ #endif
+ 
+-#if defined(ENABLE_CLI_NETCAT) && defined(ENABLE_CLI_PROXYCMD)
++#if defined(ENABLE_CLI_NETCAT) && defined(ENABLE_CLI_PROXYCMD) && defined(ENABLE_CLI_PUBKEY_AUTH)
+ #define ENABLE_CLI_MULTIHOP
+ #endif
+ 
diff --git a/patches/dropbear-2015.67/series b/patches/dropbear-2015.67/series
new file mode 100644
index 000000000000..501905e990c5
--- /dev/null
+++ b/patches/dropbear-2015.67/series
@@ -0,0 +1,4 @@
+# generated by git-ptx-patches
+#tag:base --start-number 1
+0001-dropbear-disabling-ENABLE_CLI_PUBKEY_AUTH-let-the-bu.patch
+# 847698d613b5ea08c9504df4ed3f0099  - git-ptx-patches magic
diff --git a/rules/dropbear.make b/rules/dropbear.make
index f03d0fc0df24..2240d556fc8e 100644
--- a/rules/dropbear.make
+++ b/rules/dropbear.make
@@ -18,8 +18,8 @@ PACKAGES-$(PTXCONF_DROPBEAR) += dropbear
 #
 # Paths and names
 #
-DROPBEAR_VERSION	:= 2014.65
-DROPBEAR_MD5		:= 1918604238817385a156840fa2c39490
+DROPBEAR_VERSION	:= 2015.67
+DROPBEAR_MD5		:= e967e320344cd4bfebe321e3ab8514d6
 DROPBEAR		:= dropbear-$(DROPBEAR_VERSION)
 DROPBEAR_SUFFIX		:= tar.bz2
 DROPBEAR_URL		:= http://matt.ucc.asn.au/dropbear/releases/$(DROPBEAR).$(DROPBEAR_SUFFIX)
@@ -33,50 +33,24 @@ DROPBEAR_DIR		:= $(BUILDDIR)/$(DROPBEAR)
 #
 # autoconf
 #
-DROPBEAR_AUTOCONF := \
-	$(CROSS_AUTOCONF_USR)
-
-ifdef PTXCONF_DROPBEAR_ZLIB
-DROPBEAR_AUTOCONF	+= --enable-zlib
-else
-DROPBEAR_AUTOCONF	+= --disable-zlib
-endif
-
-ifdef PTXCONF_DROPBEAR_DIS_OPENPTY
-DROPBEAR_AUTOCONF	+= --disable-openpty
-endif
-
-ifdef PTXCONF_DROPBEAR_DIS_SYSLOG
-DROPBEAR_AUTOCONF	+= --disable-syslog
-endif
-
-ifdef PTXCONF_DROPBEAR_DIS_LASTLOG
-DROPBEAR_AUTOCONF	+= --disable-lastlog
-endif
-
-ifdef PTXCONF_DROPBEAR_DIS_UTMP
-DROPBEAR_AUTOCONF	+= --disable-utmp
-endif
-
-ifdef PTXCONF_DROPBEAR_DIS_UTMPX
-DROPBEAR_AUTOCONF	+= --disable-utmpx
-endif
-
-ifdef PTXCONF_DROPBEAR_DIS_WTMP
-DROPBEAR_AUTOCONF	+= --disable-wtmp
-endif
-
-ifdef PTXCONF_DROPBEAR_DIS_WTMPX
-DROPBEAR_AUTOCONF	+= --disable-wtmpx
-endif
-
-ifdef PTXCONF_DROPBEAR_DIS_PUTUTLINE
-DROPBEAR_AUTOCONF	+= --disable-pututline
-endif
-
-ifdef PTXCONF_DROPBEAR_DIS_PUTUTXLINE
-DROPBEAR_AUTOCONF	+= --disable-pututxline
-endif
+DROPBEAR_CONF_TOOL	:= autoconf
+DROPBEAR_CONF_OPT 	:= \
+	$(CROSS_AUTOCONF_USR) \
+	$(GLOBAL_LARGE_FILE_OPTION) \
+	--$(call ptx/endis, PTXCONF_DROPBEAR_ZLIB)-zlib \
+	--disable-pam \
+	--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_OPENPTY)-openpty \
+	--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_SYSLOG)-syslog \
+	--enable-shadow \
+	--enable-bundled-libtom \
+	--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_LASTLOG)-lastlog \
+	--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_UTMP)-utmp \
+	--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_UTMPX)-utmpx \
+	--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_WTMP)-wtmp \
+	--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_WTMPX)-wtmpx \
+	--disable-loginfunc \
+	--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_PUTUTLINE)-pututline \
+	--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_PUTUTXLINE)-pututxline
 
 $(STATEDIR)/dropbear.prepare:
 	@$(call targetinfo)

-- 
Pengutronix e.K.                              | Juergen Borleis             |
Industrial Linux Solutions                    | http://www.pengutronix.de/  |

-- 
ptxdist mailing list
ptxdist@pengutronix.de