mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-02-20 08:29:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

dropbear: update 2019.78 -> 2020.79

Browse Source 
Refresh dropbear-disable-weak-ciphers.patch as some weak items
have been dropped upstream.

License-Update: curve25519 changed to public domain
(From OE-Core rev: 1620a815f6fbe20e5b570ed254187856bb37c184)

Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Alexander Kanavin
2020-06-26 09:18:19 +02:00
committed by Richard Purdie
parent 51b4061048
commit 658cde8788
4 changed files with 19 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
meta/recipes-core/dropbear/dropbear.inc
View File

@@ -5,7 +5,7 @@ SECTION = "console/network"
# some files are from other projects and have others license terms:
# public domain, OpenSSH 3.5p1, OpenSSH3.6.1p2, PuTTY
LICENSE = "MIT & BSD-3-Clause & BSD-2-Clause & PD"
LIC_FILES_CHKSUM = "file://LICENSE;md5=a5ec40cafba26fc4396d0b550f824e01"
LIC_FILES_CHKSUM = "file://LICENSE;md5=da58928b5d844c6667963cb5a109272d"
DEPENDS = "zlib virtual/crypt"
RPROVIDES_${PN} = "ssh sshd"

39
meta/recipes-core/dropbear/dropbear/dropbear-disable-weak-ciphers.patch
View File

@@ -1,33 +1,24 @@
This feature disables all CBC, SHA1, and diffie-hellman group1 ciphers
From c347ece05a7fdbf50d76cb136b9ed45caed333f6 Mon Sep 17 00:00:00 2001
From: Joseph Reynolds <joseph.reynolds1@ibm.com>
Date: Thu, 20 Jun 2019 16:29:15 -0500
Subject: [PATCH] dropbear: new feature: disable-weak-ciphers
This feature disables all CBC, SHA1, and diffie-hellman group1 ciphers
in the dropbear ssh server and client since they're considered weak ciphers
and we want to support the stong algorithms.
Upstream-Status: Inappropriate [configuration]
Signed-off-by: Joseph Reynolds <joseph.reynolds1@ibm.com>
Index: dropbear-2019.78/default_options.h
===================================================================
--- dropbear-2019.78.orig/default_options.h
+++ dropbear-2019.78/default_options.h
@@ -91,7 +91,7 @@ IMPORTANT: Some options will require "ma
/* Enable CBC mode for ciphers. This has security issues though
* is the most compatible with older SSH implementations */
-#define DROPBEAR_ENABLE_CBC_MODE 1
+#define DROPBEAR_ENABLE_CBC_MODE 0
/* Enable "Counter Mode" for ciphers. This is more secure than
* CBC mode against certain attacks. It is recommended for security
@@ -101,7 +101,7 @@ IMPORTANT: Some options will require "ma
/* Message integrity. sha2-256 is recommended as a default,
sha1 for compatibility */
#define DROPBEAR_SHA1_HMAC 1
-#define DROPBEAR_SHA1_96_HMAC 1
+#define DROPBEAR_SHA1_96_HMAC 0
#define DROPBEAR_SHA2_256_HMAC 1
/* Hostkey/public key algorithms - at least one required, these are used
@@ -149,12 +149,12 @@ IMPORTANT: Some options will require "ma
---
default_options.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/default_options.h b/default_options.h
index 1aa2297..7ff1394 100644
--- a/default_options.h
+++ b/default_options.h
@@ -163,12 +163,12 @@ IMPORTANT: Some options will require "make clean" after changes */
* Small systems should generally include either curve25519 or ecdh for performance.
* curve25519 is less widely supported but is faster
*/

4
meta/recipes-core/dropbear/dropbear_2019.78.bb
View File

@@ -1,4 +0,0 @@
require dropbear.inc
SRC_URI[md5sum] = "a972c85ed678ad0fdcb7844e1294fb54"
SRC_URI[sha256sum] = "525965971272270995364a0eb01f35180d793182e63dd0b0c3eb0292291644a4"

3
meta/recipes-core/dropbear/dropbear_2020.79.bb Normal file
View File

@@ -0,0 +1,3 @@
require dropbear.inc
SRC_URI[sha256sum] = "084f00546b1610a3422a0773e2c04cbe1a220d984209e033b548b49f379cc441"