Thanks, applied as 80326bc43e71d1b012b33287d64aa4768a28e00d. Michael
[sent from post-receive hook] On Fri, 20 Nov 2020 08:56:21 +0100, Alexander Dahl <a...@thorsis.com> wrote: > Noteworthy changes (not all options accessible through ptxdist menu): > > - added support for ed25519 hostkeys and authorized_keys > - added support for chacha20-poly1305 authenticated cipher > - added support for and rsa-sha2 signatures > - disabled some options by default (kconfig defaults adapted accordingly) > - blowfish has been removed > - fix idle detection clashing with keepalives > - scp fix for CVE-2018-20685 where a server could modify name of output > files > - Call fsync() is called on parent directory when writing key files to > ensure they are flushed > > One especially important change: > > > Use getrandom() call on Linux to ensure sufficient entropy has been > > gathered at startup. Dropbear now avoids reading from the random > > source at startup, instead waiting until the first connection. It is > > possible that some platforms were running without enough entropy > > previously, those could potentially block at first boot generating > > host keys. The dropbear "-R" option is one way to avoid that. > > On older toolchains/kernel headers/kernels without getrandom() support, > dropbear should behave like before. > > The curve25519 implementation was replaced with the one by TweetNaCl, > which induced a change in 'LICENSE' summary. The old implementation was > licensed BSD-3-Clause and the new is public domain. > > The bundled libtommath changed its license from dual license (public > domain || WTFPL) to 'Unlicense' which is also a public domain license, > but with a differently worded license text and an actual SPDX > identifier. > > The patch stack was dropped, the one patch was integrated upstream. > > Signed-off-by: Alexander Dahl <a...@thorsis.com> > Message-Id: <20201116080552.25031-5-...@thorsis.com> > Signed-off-by: Michael Olbrich <m.olbr...@pengutronix.de> > > diff --git a/patches/dropbear-2019.78/0001-configure-Fix-disable-fuzz.patch > b/patches/dropbear-2019.78/0001-configure-Fix-disable-fuzz.patch > deleted file mode 100644 > index 03aec183a8c6..000000000000 > --- a/patches/dropbear-2019.78/0001-configure-Fix-disable-fuzz.patch > +++ /dev/null > @@ -1,47 +0,0 @@ > -From: Alexander Dahl <a...@thorsis.com> > -Date: Wed, 11 Mar 2020 10:50:45 +0100 > -Subject: [PATCH] configure: Fix --disable-fuzz > - > -When explicitly passing --disable-fuzz to ./configure fuzz was actually > -enabled. > - > -Signed-off-by: Alexander Dahl <a...@thorsis.com> > ---- > - > -Notes: > - Sent upstream: > https://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2020q1/002202.html > - > - configure.ac | 17 ++++++++++++----- > - 1 file changed, 12 insertions(+), 5 deletions(-) > - > -diff --git a/configure.ac b/configure.ac > -index 7199d7cb2300..104d60cfaf53 100644 > ---- a/configure.ac > -+++ b/configure.ac > -@@ -326,14 +326,21 @@ AC_ARG_ENABLE(shadow, > - AC_ARG_ENABLE(fuzz, > - [ --enable-fuzz Build fuzzing. Not recommended for > deployment.], > - [ > -- AC_DEFINE(DROPBEAR_FUZZ, 1, Fuzzing) > -- AC_MSG_NOTICE(Enabling fuzzing) > -- DROPBEAR_FUZZ=1 > -- # libfuzzer needs linking with c++ libraries > -- AC_PROG_CXX > -+ if test "x$enableval" = "xyes"; then > -+ AC_DEFINE(DROPBEAR_FUZZ, 1, Fuzzing) > -+ AC_MSG_NOTICE(Enabling fuzzing) > -+ DROPBEAR_FUZZ=1 > -+ # libfuzzer needs linking with c++ libraries > -+ AC_PROG_CXX > -+ else > -+ AC_DEFINE(DROPBEAR_FUZZ, 0, Fuzzing) > -+ AC_MSG_NOTICE(Disabling fuzzing) > -+ DROPBEAR_FUZZ=0 > -+ fi > - ], > - [ > - AC_DEFINE(DROPBEAR_FUZZ, 0, Fuzzing) > -+ AC_MSG_NOTICE(Disabling fuzzing) > - DROPBEAR_FUZZ=0 > - ] > - > diff --git a/patches/dropbear-2019.78/autogen.sh > b/patches/dropbear-2019.78/autogen.sh > deleted file mode 120000 > index 9f8a4cb7ddcb..000000000000 > --- a/patches/dropbear-2019.78/autogen.sh > +++ /dev/null > @@ -1 +0,0 @@ > -../autogen.sh > \ No newline at end of file > diff --git a/patches/dropbear-2019.78/series b/patches/dropbear-2019.78/series > deleted file mode 100644 > index 3e5a5247e50c..000000000000 > --- a/patches/dropbear-2019.78/series > +++ /dev/null > @@ -1,4 +0,0 @@ > -# generated by git-ptx-patches > -#tag:base --start-number 1 > -0001-configure-Fix-disable-fuzz.patch > -# c03ca050bdd0c61ac96e5bd22c9d0947 - git-ptx-patches magic > diff --git a/rules/dropbear.in b/rules/dropbear.in > index 7f777ae648fd..c0da7e222f2d 100644 > --- a/rules/dropbear.in > +++ b/rules/dropbear.in > @@ -116,6 +116,7 @@ comment "features" > config DROPBEAR_DIS_X11 > bool > prompt "disable X11 Forwarding" > + default y > help > X11 forwarding means passing X11 (graphical interface) > information over the SSH connection. > @@ -149,7 +150,6 @@ config DROPBEAR_AES128 > config DROPBEAR_3DES > bool > prompt "3DES" > - default y > help > DES is an IBM algorithm designed during the 1970s. > In 1976, NIST has officially adopted it as an encryption > diff --git a/rules/dropbear.make b/rules/dropbear.make > index e422eb4d5e1e..a9404592e3af 100644 > --- a/rules/dropbear.make > +++ b/rules/dropbear.make > @@ -16,19 +16,19 @@ PACKAGES-$(PTXCONF_DROPBEAR) += dropbear > # > # Paths and names > # > -DROPBEAR_VERSION := 2019.78 > -DROPBEAR_MD5 := a972c85ed678ad0fdcb7844e1294fb54 > +DROPBEAR_VERSION := 2020.79 > +DROPBEAR_MD5 := 830a7bf6349ac52a39c487d061efb352 > DROPBEAR := dropbear-$(DROPBEAR_VERSION) > DROPBEAR_SUFFIX := tar.bz2 > DROPBEAR_URL := > http://matt.ucc.asn.au/dropbear/releases/$(DROPBEAR).$(DROPBEAR_SUFFIX) > DROPBEAR_SOURCE := $(SRCDIR)/$(DROPBEAR).$(DROPBEAR_SUFFIX) > DROPBEAR_DIR := $(BUILDDIR)/$(DROPBEAR) > DROPBEAR_LICENSE := \ > - MIT AND BSD-2-Clause AND BSD-3-Clause AND SSH-short AND (public_domain > OR WTFPL) > + MIT AND BSD-2-Clause AND public_domain AND SSH-short AND (public_domain > OR WTFPL) AND Unlicense > DROPBEAR_LICENSE_FILES := \ > - file://LICENSE;md5=a5ec40cafba26fc4396d0b550f824e01 \ > + file://LICENSE;md5=da58928b5d844c6667963cb5a109272d \ > file://libtomcrypt/LICENSE;md5=71baacc459522324ef3e2b9e052e8180 \ > - file://libtommath/LICENSE;md5=f72771f4af5e8c382974750f9f8701ad \ > + file://libtommath/LICENSE;md5=23e7e0a32e53a2b1d35f5fd9ef053402 \ > > file://loginrec.c;startline=1;endline=26;md5=0d785ee11fab1cead2c7fee9c35574f1 > > # > ---------------------------------------------------------------------------- > @@ -48,6 +48,7 @@ DROPBEAR_CONF_OPT := \ > --$(call ptx/disen, PTXCONF_DROPBEAR_DIS_OPENPTY)-openpty \ > --$(call ptx/disen, PTXCONF_DROPBEAR_DIS_SYSLOG)-syslog \ > --enable-shadow \ > + --disable-plugin \ > --disable-fuzz \ > --enable-bundled-libtom \ > --$(call ptx/disen, PTXCONF_DROPBEAR_DIS_LASTLOG)-lastlog \ _______________________________________________ ptxdist mailing list ptxdist@pengutronix.de To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-requ...@pengutronix.de
