From b11521ce1b1d1f8b4dddf830b41f5ea809730d22 Mon Sep 17 00:00:00 2001 From: Joseph Reynolds Date: Thu, 20 Jun 2019 16:29:15 -0500 Subject: dropbear: new feature: disable-weak-ciphers Enhances dropbear with a new feature "disable-weak-ciphers", on by default. This feature disables all CBC, SHA1, and diffie-hellman group1 ciphers in the dropbear ssh server and client. Disable this feature if you need to connect to the ssh server from older clients. Additional customization can be done with local_options.h as usual. Tested: On dropbear_2019.78. Upstream-Status: Inappropriate [configuration] Signed-off-by: Joseph Reynolds Signed-off-by: Richard Purdie --- meta/recipes-core/dropbear/dropbear.inc | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'meta/recipes-core/dropbear/dropbear.inc') diff --git a/meta/recipes-core/dropbear/dropbear.inc b/meta/recipes-core/dropbear/dropbear.inc index b74d186cd4..dcbda741c3 100644 --- a/meta/recipes-core/dropbear/dropbear.inc +++ b/meta/recipes-core/dropbear/dropbear.inc @@ -20,7 +20,8 @@ SRC_URI = "http://matt.ucc.asn.au/dropbear/releases/dropbear-${PV}.tar.bz2 \ file://dropbear@.service \ file://dropbear.socket \ file://dropbear.default \ - ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', '', d)} " + ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', '', d)} \ + ${@bb.utils.contains('PACKAGECONFIG', 'disable-weak-ciphers', 'file://dropbear-disable-weak-ciphers.patch', '', d)} " PAM_SRC_URI = "file://0005-dropbear-enable-pam.patch \ file://0006-dropbear-configuration-file.patch \ @@ -46,8 +47,9 @@ SBINCOMMANDS = "dropbear dropbearkey dropbearconvert" BINCOMMANDS = "dbclient ssh scp" EXTRA_OEMAKE = 'MULTI=1 SCPPROGRESS=1 PROGRAMS="${SBINCOMMANDS} ${BINCOMMANDS}"' -PACKAGECONFIG ?= "" +PACKAGECONFIG ?= "disable-weak-ciphers" PACKAGECONFIG[system-libtom] = "--disable-bundled-libtom,--enable-bundled-libtom,libtommath libtomcrypt" +PACKAGECONFIG[disable-weak-ciphers] = "" EXTRA_OECONF += "\ ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '--enable-pam', '--disable-pam', d)}" -- cgit 1.2.3-korg