diff options
Diffstat (limited to 'poky/meta/recipes-core/dropbear')
5 files changed, 20 insertions, 29 deletions
diff --git a/poky/meta/recipes-core/dropbear/dropbear.inc b/poky/meta/recipes-core/dropbear/dropbear.inc index 7269888a4..080ee26b2 100644 --- a/poky/meta/recipes-core/dropbear/dropbear.inc +++ b/poky/meta/recipes-core/dropbear/dropbear.inc @@ -5,7 +5,7 @@ SECTION = "console/network" # some files are from other projects and have others license terms: # public domain, OpenSSH 3.5p1, OpenSSH3.6.1p2, PuTTY LICENSE = "MIT & BSD-3-Clause & BSD-2-Clause & PD" -LIC_FILES_CHKSUM = "file://LICENSE;md5=a5ec40cafba26fc4396d0b550f824e01" +LIC_FILES_CHKSUM = "file://LICENSE;md5=25cf44512b7bc8966a48b6b1a9b7605f" DEPENDS = "zlib virtual/crypt" RPROVIDES_${PN} = "ssh sshd" diff --git a/poky/meta/recipes-core/dropbear/dropbear/dropbear-disable-weak-ciphers.patch b/poky/meta/recipes-core/dropbear/dropbear/dropbear-disable-weak-ciphers.patch index e48a34bac..b54581f17 100644 --- a/poky/meta/recipes-core/dropbear/dropbear/dropbear-disable-weak-ciphers.patch +++ b/poky/meta/recipes-core/dropbear/dropbear/dropbear-disable-weak-ciphers.patch @@ -1,33 +1,24 @@ -This feature disables all CBC, SHA1, and diffie-hellman group1 ciphers +From c347ece05a7fdbf50d76cb136b9ed45caed333f6 Mon Sep 17 00:00:00 2001 +From: Joseph Reynolds <joseph.reynolds1@ibm.com> +Date: Thu, 20 Jun 2019 16:29:15 -0500 +Subject: [PATCH] dropbear: new feature: disable-weak-ciphers + +This feature disables all CBC, SHA1, and diffie-hellman group1 ciphers in the dropbear ssh server and client since they're considered weak ciphers and we want to support the stong algorithms. Upstream-Status: Inappropriate [configuration] Signed-off-by: Joseph Reynolds <joseph.reynolds1@ibm.com> -Index: dropbear-2019.78/default_options.h -=================================================================== ---- dropbear-2019.78.orig/default_options.h -+++ dropbear-2019.78/default_options.h -@@ -91,7 +91,7 @@ IMPORTANT: Some options will require "ma - - /* Enable CBC mode for ciphers. This has security issues though - * is the most compatible with older SSH implementations */ --#define DROPBEAR_ENABLE_CBC_MODE 1 -+#define DROPBEAR_ENABLE_CBC_MODE 0 - - /* Enable "Counter Mode" for ciphers. This is more secure than - * CBC mode against certain attacks. It is recommended for security -@@ -101,7 +101,7 @@ IMPORTANT: Some options will require "ma - /* Message integrity. sha2-256 is recommended as a default, - sha1 for compatibility */ - #define DROPBEAR_SHA1_HMAC 1 --#define DROPBEAR_SHA1_96_HMAC 1 -+#define DROPBEAR_SHA1_96_HMAC 0 - #define DROPBEAR_SHA2_256_HMAC 1 - - /* Hostkey/public key algorithms - at least one required, these are used -@@ -149,12 +149,12 @@ IMPORTANT: Some options will require "ma +--- + default_options.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/default_options.h b/default_options.h +index 1aa2297..7ff1394 100644 +--- a/default_options.h ++++ b/default_options.h +@@ -163,12 +163,12 @@ IMPORTANT: Some options will require "make clean" after changes */ * Small systems should generally include either curve25519 or ecdh for performance. * curve25519 is less widely supported but is faster */ diff --git a/poky/meta/recipes-core/dropbear/dropbear/dropbearkey.service b/poky/meta/recipes-core/dropbear/dropbear/dropbearkey.service index c49053d57..71a12a611 100644 --- a/poky/meta/recipes-core/dropbear/dropbear/dropbearkey.service +++ b/poky/meta/recipes-core/dropbear/dropbear/dropbearkey.service @@ -11,3 +11,4 @@ Type=oneshot ExecStart=@BASE_BINDIR@/mkdir -p ${DROPBEAR_RSAKEY_DIR} ExecStart=@SBINDIR@/dropbearkey -t rsa -f ${DROPBEAR_RSAKEY_DIR}/dropbear_rsa_host_key RemainAfterExit=yes +Nice=10 diff --git a/poky/meta/recipes-core/dropbear/dropbear_2019.78.bb b/poky/meta/recipes-core/dropbear/dropbear_2019.78.bb deleted file mode 100644 index d2cd8161b..000000000 --- a/poky/meta/recipes-core/dropbear/dropbear_2019.78.bb +++ /dev/null @@ -1,4 +0,0 @@ -require dropbear.inc - -SRC_URI[md5sum] = "a972c85ed678ad0fdcb7844e1294fb54" -SRC_URI[sha256sum] = "525965971272270995364a0eb01f35180d793182e63dd0b0c3eb0292291644a4" diff --git a/poky/meta/recipes-core/dropbear/dropbear_2020.80.bb b/poky/meta/recipes-core/dropbear/dropbear_2020.80.bb new file mode 100644 index 000000000..088c71cb9 --- /dev/null +++ b/poky/meta/recipes-core/dropbear/dropbear_2020.80.bb @@ -0,0 +1,3 @@ +require dropbear.inc + +SRC_URI[sha256sum] = "d927941b91f2da150b2033f1a88b6a47999bf0afb1493a73e9216cffdb5d7949" |