From 61e83f9c29f873c89c725b9deae479b8f6b2401a Mon Sep 17 00:00:00 2001
From: Jo-Philipp Wich <jow@openwrt.org>
Date: Thu, 10 Oct 2013 14:42:05 +0000
Subject: [PATCH] dropbear: update to 2013.59 (released 4 october 2013)
- drop mirror www.mirrors.wiretapped.net (not working anymore)
- drop patch 300-ipv6_addr_port_split.patch, included upstream
- refresh patches
- various upstream changes: http://matt.ucc.asn.au/dropbear/CHANGES
Signed-off-by: Catalin Patulea <cat@vv.carleton.ca>
SVN-Revision: 38356
---
package/network/services/dropbear/Makefile | 9 ++++----
.../dropbear/patches/110-change_user.patch | 2 +-
.../patches/120-openwrt_options.patch | 21 +++++++------------
.../patches/130-ssh_ignore_o_and_x_args.patch | 6 +++---
.../dropbear/patches/140-disable_assert.patch | 5 +++--
.../dropbear/patches/200-lcrypt_bsdfix.patch | 4 ++--
.../patches/300-ipv6_addr_port_split.patch | 11 ----------
.../patches/500-set-default-path.patch | 2 +-
8 files changed, 22 insertions(+), 38 deletions(-)
delete mode 100644 package/network/services/dropbear/patches/300-ipv6_addr_port_split.patch
diff --git a/package/network/services/dropbear/Makefile b/package/network/services/dropbear/Makefile
index b7708b1d05..f025c4dd2c 100644
--- a/package/network/services/dropbear/Makefile
+++ b/package/network/services/dropbear/Makefile
@@ -8,14 +8,13 @@
include $(TOPDIR)/rules.mk
PKG_NAME:=dropbear
-PKG_VERSION:=2012.55
-PKG_RELEASE:=2
+PKG_VERSION:=2013.59
+PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
PKG_SOURCE_URL:= \
- http://matt.ucc.asn.au/dropbear/releases/ \
- http://www.mirrors.wiretapped.net/security/cryptography/apps/ssh/dropbear/
-PKG_MD5SUM:=8c784baec3054cdb1bb4bfa792c87812
+ http://matt.ucc.asn.au/dropbear/releases/
+PKG_MD5SUM:=6c1e6c2c297f4034488ffc95e8b7e6e9
PKG_LICENSE:=MIT
PKG_LICENSE_FILES:=LICENSE libtomcrypt/LICENSE libtommath/LICENSE
diff --git a/package/network/services/dropbear/patches/110-change_user.patch b/package/network/services/dropbear/patches/110-change_user.patch
index a354edad23..48228ead96 100644
--- a/package/network/services/dropbear/patches/110-change_user.patch
+++ b/package/network/services/dropbear/patches/110-change_user.patch
@@ -1,6 +1,6 @@
--- a/svr-chansession.c
+++ b/svr-chansession.c
-@@ -891,12 +891,12 @@ static void execchild(void *user_data) {
+@@ -889,12 +889,12 @@ static void execchild(void *user_data) {
/* We can only change uid/gid as root ... */
if (getuid() == 0) {
diff --git a/package/network/services/dropbear/patches/120-openwrt_options.patch b/package/network/services/dropbear/patches/120-openwrt_options.patch
index 977f6312fb..9300a27429 100644
--- a/package/network/services/dropbear/patches/120-openwrt_options.patch
+++ b/package/network/services/dropbear/patches/120-openwrt_options.patch
@@ -25,9 +25,9 @@
-#define ENABLE_CLI_NETCAT
+/*#define ENABLE_CLI_NETCAT*/
- /* Encryption - at least one required.
- * Protocol RFC requires 3DES and recommends AES128 for interoperability.
-@@ -89,8 +89,8 @@ much traffic. */
+ /* Whether to support "-c" and "-m" flags to choose ciphers/MACs at runtime */
+ #define ENABLE_USER_ALGO_LIST
+@@ -92,8 +92,8 @@ much traffic. */
#define DROPBEAR_AES256
/* Compiling in Blowfish will add ~6kB to runtime heap memory usage */
/*#define DROPBEAR_BLOWFISH*/
@@ -38,21 +38,16 @@
/* Enable "Counter Mode" for ciphers. This is more secure than normal
* CBC mode against certain attacks. This adds around 1kB to binary
-@@ -110,7 +110,7 @@ much traffic. */
+@@ -119,7 +119,7 @@ much traffic. */
* If you disable MD5, Dropbear will fall back to SHA1 fingerprints,
* which are not the standard form. */
#define DROPBEAR_SHA1_HMAC
-#define DROPBEAR_SHA1_96_HMAC
+/*#define DROPBEAR_SHA1_96_HMAC*/
+ /*#define DROPBEAR_SHA2_256_HMAC*/
+ /*#define DROPBEAR_SHA2_512_HMAC*/
#define DROPBEAR_MD5_HMAC
-
- /* Hostkey/public key algorithms - at least one required, these are used
-@@ -144,11 +144,11 @@ much traffic. */
- #endif
-
- /* Whether to do reverse DNS lookups. */
--#define DO_HOST_LOOKUP
-+/*#define DO_HOST_LOOKUP*/
+@@ -157,7 +157,7 @@ much traffic. */
/* Whether to print the message of the day (MOTD). This doesn't add much code
* size */
@@ -61,7 +56,7 @@
/* The MOTD file path */
#ifndef MOTD_FILENAME
-@@ -192,7 +192,7 @@ much traffic. */
+@@ -195,7 +195,7 @@ much traffic. */
* note that it will be provided for all "hidden" client-interactive
* style prompts - if you want something more sophisticated, use
* SSH_ASKPASS instead. Comment out this var to remove this functionality.*/
diff --git a/package/network/services/dropbear/patches/130-ssh_ignore_o_and_x_args.patch b/package/network/services/dropbear/patches/130-ssh_ignore_o_and_x_args.patch
index 93647a99e5..6de652b4e2 100644
--- a/package/network/services/dropbear/patches/130-ssh_ignore_o_and_x_args.patch
+++ b/package/network/services/dropbear/patches/130-ssh_ignore_o_and_x_args.patch
@@ -1,6 +1,6 @@
--- a/cli-runopts.c
+++ b/cli-runopts.c
-@@ -287,6 +287,10 @@ void cli_getopts(int argc, char ** argv)
+@@ -309,6 +309,10 @@ void cli_getopts(int argc, char ** argv)
debug_trace = 1;
break;
#endif
@@ -10,8 +10,8 @@
+ break;
case 'F':
case 'e':
- case 'c':
-@@ -298,7 +302,6 @@ void cli_getopts(int argc, char ** argv)
+ #ifndef ENABLE_USER_ALGO_LIST
+@@ -322,7 +326,6 @@ void cli_getopts(int argc, char ** argv)
#ifndef ENABLE_CLI_LOCALTCPFWD
case 'L':
#endif
diff --git a/package/network/services/dropbear/patches/140-disable_assert.patch b/package/network/services/dropbear/patches/140-disable_assert.patch
index e00184a8fb..edc7547dd0 100644
--- a/package/network/services/dropbear/patches/140-disable_assert.patch
+++ b/package/network/services/dropbear/patches/140-disable_assert.patch
@@ -1,6 +1,6 @@
--- a/dbutil.h
+++ b/dbutil.h
-@@ -93,6 +93,10 @@ int m_str_to_uint(const char* str, unsig
+@@ -92,7 +92,11 @@ int m_str_to_uint(const char* str, unsig
#define DEF_MP_INT(X) mp_int X = {0, 0, 0, NULL}
/* Dropbear assertion */
@@ -11,4 +11,5 @@
+
+#define dropbear_assert(X) do { if (DROPBEAR_ASSERT_ENABLED && !(X)) { fail_assert(#X, __FILE__, __LINE__); } } while (0)
- #endif /* _DBUTIL_H_ */
+ /* Returns 0 if a and b have the same contents */
+ int constant_time_memcmp(const void* a, const void *b, size_t n);
diff --git a/package/network/services/dropbear/patches/200-lcrypt_bsdfix.patch b/package/network/services/dropbear/patches/200-lcrypt_bsdfix.patch
index 57eb9670dc..a5697e25f7 100644
--- a/package/network/services/dropbear/patches/200-lcrypt_bsdfix.patch
+++ b/package/network/services/dropbear/patches/200-lcrypt_bsdfix.patch
@@ -9,7 +9,7 @@
dbclientobjs=$(COMMONOBJS) $(CLISVROBJS) $(CLIOBJS)
dropbearkeyobjs=$(COMMONOBJS) $(KEYOBJS)
dropbearconvertobjs=$(COMMONOBJS) $(CONVERTOBJS)
-@@ -77,7 +77,7 @@ STRIP=@STRIP@
+@@ -78,7 +78,7 @@ STRIP=@STRIP@
INSTALL=@INSTALL@
CPPFLAGS=@CPPFLAGS@
CFLAGS+=-I. -I$(srcdir) $(CPPFLAGS) @CFLAGS@
@@ -18,7 +18,7 @@
LDFLAGS=@LDFLAGS@
EXEEXT=@EXEEXT@
-@@ -169,7 +169,7 @@ scp: $(SCPOBJS) $(HEADERS) Makefile
+@@ -168,7 +168,7 @@ scp: $(SCPOBJS) $(HEADERS) Makefile
# multi-binary compilation.
MULTIOBJS=
ifeq ($(MULTI),1)
diff --git a/package/network/services/dropbear/patches/300-ipv6_addr_port_split.patch b/package/network/services/dropbear/patches/300-ipv6_addr_port_split.patch
deleted file mode 100644
index 7da435ab15..0000000000
--- a/package/network/services/dropbear/patches/300-ipv6_addr_port_split.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/svr-runopts.c
-+++ b/svr-runopts.c
-@@ -325,7 +325,7 @@ static void addportandaddress(char* spec
- myspec = m_strdup(spec);
-
- /* search for ':', that separates address and port */
-- svr_opts.ports[svr_opts.portcount] = strchr(myspec, ':');
-+ svr_opts.ports[svr_opts.portcount] = strrchr(myspec, ':');
-
- if (svr_opts.ports[svr_opts.portcount] == NULL) {
- /* no ':' -> the whole string specifies just a port */
diff --git a/package/network/services/dropbear/patches/500-set-default-path.patch b/package/network/services/dropbear/patches/500-set-default-path.patch
index 0bd3ffcc38..702ad6c398 100644
--- a/package/network/services/dropbear/patches/500-set-default-path.patch
+++ b/package/network/services/dropbear/patches/500-set-default-path.patch
@@ -1,6 +1,6 @@
--- a/options.h
+++ b/options.h
-@@ -297,7 +297,7 @@ be overridden at runtime with -I. 0 disa
+@@ -301,7 +301,7 @@ be overridden at runtime with -I. 0 disa
#define DEFAULT_IDLE_TIMEOUT 0
/* The default path. This will often get replaced by the shell */
--
GitLab