mailarchive of the ptxdist mailing list
 help / color / mirror / Atom feed
From: Michael Olbrich <mol@pengutronix.de>
To: ptxdist@pengutronix.de
Cc: Alexander Dahl <ada@thorsis.com>
Subject: Re: [ptxdist] [APPLIED] dropbear: version bump 2019.78 -> 2020.79
Date: Fri, 20 Nov 2020 08:56:21 +0100	[thread overview]
Message-ID: <E1kg1HJ-006gEQ-H2@dude03.red.stw.pengutronix.de> (raw)
In-Reply-To: <20201116080552.25031-5-ada@thorsis.com>

Thanks, applied as 80326bc43e71d1b012b33287d64aa4768a28e00d.

Michael

[sent from post-receive hook]

On Fri, 20 Nov 2020 08:56:21 +0100, Alexander Dahl <ada@thorsis.com> wrote:
> Noteworthy changes (not all options accessible through ptxdist menu):
> 
> - added support for ed25519 hostkeys and authorized_keys
> - added support for chacha20-poly1305 authenticated cipher
> - added support for and rsa-sha2 signatures
> - disabled some options by default (kconfig defaults adapted accordingly)
> - blowfish has been removed
> - fix idle detection clashing with keepalives
> - scp fix for CVE-2018-20685 where a server could modify name of output
>   files
> - Call fsync() is called on parent directory when writing key files to
>   ensure they are flushed
> 
> One especially important change:
> 
> > Use getrandom() call on Linux to ensure sufficient entropy has been
> > gathered at startup.  Dropbear now avoids reading from the random
> > source at startup, instead waiting until the first connection. It is
> > possible that some platforms were running without enough entropy
> > previously, those could potentially block at first boot generating
> > host keys.  The dropbear "-R" option is one way to avoid that.
> 
> On older toolchains/kernel headers/kernels without getrandom() support,
> dropbear should behave like before.
> 
> The curve25519 implementation was replaced with the one by TweetNaCl,
> which induced a change in 'LICENSE' summary.  The old implementation was
> licensed BSD-3-Clause and the new is public domain.
> 
> The bundled libtommath changed its license from dual license (public
> domain || WTFPL) to 'Unlicense' which is also a public domain license,
> but with a differently worded license text and an actual SPDX
> identifier.
> 
> The patch stack was dropped, the one patch was integrated upstream.
> 
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> Message-Id: <20201116080552.25031-5-ada@thorsis.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/patches/dropbear-2019.78/0001-configure-Fix-disable-fuzz.patch b/patches/dropbear-2019.78/0001-configure-Fix-disable-fuzz.patch
> deleted file mode 100644
> index 03aec183a8c6..000000000000
> --- a/patches/dropbear-2019.78/0001-configure-Fix-disable-fuzz.patch
> +++ /dev/null
> @@ -1,47 +0,0 @@
> -From: Alexander Dahl <ada@thorsis.com>
> -Date: Wed, 11 Mar 2020 10:50:45 +0100
> -Subject: [PATCH] configure: Fix --disable-fuzz
> -
> -When explicitly passing --disable-fuzz to ./configure fuzz was actually
> -enabled.
> -
> -Signed-off-by: Alexander Dahl <ada@thorsis.com>
> ----
> -
> -Notes:
> -    Sent upstream: https://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2020q1/002202.html
> -
> - configure.ac | 17 ++++++++++++-----
> - 1 file changed, 12 insertions(+), 5 deletions(-)
> -
> -diff --git a/configure.ac b/configure.ac
> -index 7199d7cb2300..104d60cfaf53 100644
> ---- a/configure.ac
> -+++ b/configure.ac
> -@@ -326,14 +326,21 @@ AC_ARG_ENABLE(shadow,
> - AC_ARG_ENABLE(fuzz,
> - 	[  --enable-fuzz           Build fuzzing. Not recommended for deployment.],
> - 	[
> --		AC_DEFINE(DROPBEAR_FUZZ, 1, Fuzzing)
> --		AC_MSG_NOTICE(Enabling fuzzing)
> --		DROPBEAR_FUZZ=1
> --		# libfuzzer needs linking with c++ libraries
> --		AC_PROG_CXX
> -+		if test "x$enableval" = "xyes"; then
> -+            AC_DEFINE(DROPBEAR_FUZZ, 1, Fuzzing)
> -+            AC_MSG_NOTICE(Enabling fuzzing)
> -+            DROPBEAR_FUZZ=1
> -+            # libfuzzer needs linking with c++ libraries
> -+            AC_PROG_CXX
> -+        else
> -+            AC_DEFINE(DROPBEAR_FUZZ, 0, Fuzzing)
> -+            AC_MSG_NOTICE(Disabling fuzzing)
> -+            DROPBEAR_FUZZ=0
> -+        fi
> - 	],
> - 	[
> - 		AC_DEFINE(DROPBEAR_FUZZ, 0, Fuzzing)
> -+		AC_MSG_NOTICE(Disabling fuzzing)
> - 		DROPBEAR_FUZZ=0
> - 	]
> - 
> diff --git a/patches/dropbear-2019.78/autogen.sh b/patches/dropbear-2019.78/autogen.sh
> deleted file mode 120000
> index 9f8a4cb7ddcb..000000000000
> --- a/patches/dropbear-2019.78/autogen.sh
> +++ /dev/null
> @@ -1 +0,0 @@
> -../autogen.sh
> \ No newline at end of file
> diff --git a/patches/dropbear-2019.78/series b/patches/dropbear-2019.78/series
> deleted file mode 100644
> index 3e5a5247e50c..000000000000
> --- a/patches/dropbear-2019.78/series
> +++ /dev/null
> @@ -1,4 +0,0 @@
> -# generated by git-ptx-patches
> -#tag:base --start-number 1
> -0001-configure-Fix-disable-fuzz.patch
> -# c03ca050bdd0c61ac96e5bd22c9d0947  - git-ptx-patches magic
> diff --git a/rules/dropbear.in b/rules/dropbear.in
> index 7f777ae648fd..c0da7e222f2d 100644
> --- a/rules/dropbear.in
> +++ b/rules/dropbear.in
> @@ -116,6 +116,7 @@ comment "features"
>  config DROPBEAR_DIS_X11
>  	bool
>  	prompt "disable X11 Forwarding"
> +	default y
>  	help
>  	  X11 forwarding means passing X11 (graphical interface)
>  	  information over the SSH connection.
> @@ -149,7 +150,6 @@ config DROPBEAR_AES128
>  config DROPBEAR_3DES
>  	bool
>  	prompt "3DES"
> -	default y
>  	help
>  	  DES is an IBM algorithm designed during the 1970s.
>  	  In 1976, NIST has officially adopted it as an encryption
> diff --git a/rules/dropbear.make b/rules/dropbear.make
> index e422eb4d5e1e..a9404592e3af 100644
> --- a/rules/dropbear.make
> +++ b/rules/dropbear.make
> @@ -16,19 +16,19 @@ PACKAGES-$(PTXCONF_DROPBEAR) += dropbear
>  #
>  # Paths and names
>  #
> -DROPBEAR_VERSION	:= 2019.78
> -DROPBEAR_MD5		:= a972c85ed678ad0fdcb7844e1294fb54
> +DROPBEAR_VERSION	:= 2020.79
> +DROPBEAR_MD5		:= 830a7bf6349ac52a39c487d061efb352
>  DROPBEAR		:= dropbear-$(DROPBEAR_VERSION)
>  DROPBEAR_SUFFIX		:= tar.bz2
>  DROPBEAR_URL		:= http://matt.ucc.asn.au/dropbear/releases/$(DROPBEAR).$(DROPBEAR_SUFFIX)
>  DROPBEAR_SOURCE		:= $(SRCDIR)/$(DROPBEAR).$(DROPBEAR_SUFFIX)
>  DROPBEAR_DIR		:= $(BUILDDIR)/$(DROPBEAR)
>  DROPBEAR_LICENSE	:= \
> -	MIT AND BSD-2-Clause AND BSD-3-Clause AND SSH-short AND (public_domain OR WTFPL)
> +	MIT AND BSD-2-Clause AND public_domain AND SSH-short AND (public_domain OR WTFPL) AND Unlicense
>  DROPBEAR_LICENSE_FILES	:= \
> -	file://LICENSE;md5=a5ec40cafba26fc4396d0b550f824e01 \
> +	file://LICENSE;md5=da58928b5d844c6667963cb5a109272d \
>  	file://libtomcrypt/LICENSE;md5=71baacc459522324ef3e2b9e052e8180 \
> -	file://libtommath/LICENSE;md5=f72771f4af5e8c382974750f9f8701ad \
> +	file://libtommath/LICENSE;md5=23e7e0a32e53a2b1d35f5fd9ef053402 \
>  	file://loginrec.c;startline=1;endline=26;md5=0d785ee11fab1cead2c7fee9c35574f1
>  
>  # ----------------------------------------------------------------------------
> @@ -48,6 +48,7 @@ DROPBEAR_CONF_OPT 	:= \
>  	--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_OPENPTY)-openpty \
>  	--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_SYSLOG)-syslog \
>  	--enable-shadow \
> +	--disable-plugin \
>  	--disable-fuzz \
>  	--enable-bundled-libtom \
>  	--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_LASTLOG)-lastlog \

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de

  reply	other threads:[~2020-11-20  7:56 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-11-16  8:05 [ptxdist] [PATCH v3 0/5] dropbear: version bump 2019.78 -> 2020.81 Alexander Dahl
2020-11-16  8:05 ` [ptxdist] [PATCH v3 1/5] dropbear: Consider licenses of bundled libs Alexander Dahl
2020-11-20  7:56   ` [ptxdist] [APPLIED] " Michael Olbrich
2020-11-16  8:05 ` [ptxdist] [PATCH v3 2/5] dropbear: Remove deprecated options Alexander Dahl
2020-11-20  7:56   ` [ptxdist] [APPLIED] " Michael Olbrich
2020-11-16  8:05 ` [ptxdist] [PATCH v3 3/5] dropbear: Revise comments Alexander Dahl
2020-11-20  7:56   ` [ptxdist] [APPLIED] " Michael Olbrich
2020-11-16  8:05 ` [ptxdist] [PATCH v3 4/5] dropbear: version bump 2019.78 -> 2020.79 Alexander Dahl
2020-11-20  7:56   ` Michael Olbrich [this message]
2020-11-16  8:05 ` [ptxdist] [PATCH v3 5/5] dropbear: version bump 2020.79 -> 2020.81 Alexander Dahl
2020-11-20  7:56   ` [ptxdist] [APPLIED] " Michael Olbrich

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=E1kg1HJ-006gEQ-H2@dude03.red.stw.pengutronix.de \
    --to=mol@pengutronix.de \
    --cc=ada@thorsis.com \
    --cc=ptxdist@pengutronix.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox