Thanks, applied as e8f526c3a8d126139da25384d68542ce4895480c. Michael
[sent from post-receive hook] On Fri, 29 Jul 2022 08:23:36 +0200, Alexander Dahl <[email protected]> wrote: > We have multiple groups where it is required to select at least one (and > optionally more) option. On some groups selecting no option would fail > at buildtime, on other dropbear would build and run, but necessary user > interactions (like log in) would not be possible at runtime, e.g. > because no message integrity hmac method was built in. > > These warnings still allow not selecting any option, but should give a > stronger hint than before, that this would be a bad idea. > > Suggested-by: Ahmad Fatoum <[email protected]> > Signed-off-by: Alexander Dahl <[email protected]> > Message-Id: <[email protected]> > Signed-off-by: Michael Olbrich <[email protected]> > > diff --git a/rules/dropbear.in b/rules/dropbear.in > index a64b2306a64a..a3059c60502d 100644 > --- a/rules/dropbear.in > +++ b/rules/dropbear.in > @@ -180,6 +180,9 @@ config DROPBEAR_CHACHA20POLY1305 > instructions, having the same key size. > Recommended. > > +comment "WARNING: No encryption method selected!" > + depends on !DROPBEAR_AES128 && !DROPBEAR_3DES && !DROPBEAR_AES256 && > !DROPBEAR_CHACHA20POLY1305 > + > config DROPBEAR_CBC_CIPHERS > bool > prompt "CBC mode ciphers (legacy)" > @@ -248,6 +251,9 @@ config DROPBEAR_SHA512 > SHA-1. SHA-2 consists of a set of four hash functions with digests > that are 224, 256, 384 or 512 bits. > > +comment "WARNING: No Message Integrity method selected!" > + depends on !DROPBEAR_SHA1 && !DROPBEAR_SHA1_96 && !DROPBEAR_SHA256 && > !DROPBEAR_SHA512 > + > comment "Hostkey/public key algorithms, at least one required ---" > > config DROPBEAR_RSA > @@ -279,6 +285,9 @@ config DROPBEAR_ED25519 > Public keys are 256 bits long and signatures are 512 bits > long. > > +comment "WARNING: No Hostkey/public key algorithm selected!" > + depends on !DROPBEAR_RSA && !DROPBEAR_ECDSA && !DROPBEAR_ED25519 > + > comment "Key exchange algorithm, at least one required ---" > > config DROPBEAR_DH_GROUP14_SHA256 > @@ -336,6 +345,9 @@ config DROPBEAR_DH_GROUP1 > versions < 0.53. > Client only! > > +comment "WARNING: No key exchange algorithm selected!" > + depends on !DROPBEAR_DH_GROUP14_SHA256 && !DROPBEAR_DH_GROUP14_SHA1 && > !DROPBEAR_DH_GROUP16 && !DROPBEAR_ECDH && !DROPBEAR_CURVE25519 && > !DROPBEAR_DH_GROUP1 > + > comment "Authentication types, at least one required --- RFC Draft requires > pubkey auth" > > config DROPBEAR_PASSWD > @@ -352,6 +364,9 @@ config DROPBEAR_PUBKEY > help > Use public key authentication > > +comment "WARNING: No authentication type selected!" > + depends on !DROPBEAR_PASSWD && !DROPBEAR_PUBKEY > + > comment "installation options ---" > > config DROPBEAR_DROPBEAR
