dropbear: new feature: disable-weak-ciphers

PATCH In review Joseph Reynolds 3 participants 4 messages Jul 15, 2019 – Jul 16, 2019

Share & tools

Joseph Reynolds

author

2019-07-15 20:39 UTC #0 lore raw

PATCH 1/1 dropbear: new feature: disable-weak-ciphers

Enhances dropbear with a new feature "disable-weak-ciphers", on by default. This feature disables all CBC, SHA1, and diffie-hellman group1 ciphers in the dropbear ssh server and client.

Disable this feature if you need to connect to the ssh server from older clients. Additional customization can be done with local_options.h as usual.

Tested: On dropbear_2019.78.

Upstream-Status: Inappropriate [configuration]

Signed-off-by Joseph Reynolds <[email protected]>

Signed-off-by Richard Purdie <[email protected]>

---
 meta/recipes-core/dropbear/dropbear.inc            |  6 ++-
 .../dropbear/dropbear-disable-weak-ciphers.patch   | 44 ++++++++++++++++++++++
 2 files changed, 48 insertions(+), 2 deletions(-)
 create mode 100644 meta/recipes-core/dropbear/dropbear/dropbear-disable-weak-ciphers.patch

meta/recipes-core/dropbear/dropbear.inc +4 -2

index 2537603..b090377 100644
@@ -19,7 +19,8 @@ SRC_URI = "http://matt.ucc.asn.au/dropbear/releases/dropbear-${PV}.tar.bz2 \
            file://[email protected] \
            file://dropbear.socket \
            file://dropbear.default \
-           ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', '', d)} "
+           ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', '', d)} \
+           ${@bb.utils.contains('PACKAGECONFIG', 'disable-weak-ciphers', 'file://dropbear-disable-weak-ciphers.patch', '', d)} "
 
 PAM_SRC_URI = "file://0005-dropbear-enable-pam.patch \
                file://0006-dropbear-configuration-file.patch \

@@ -45,8 +46,9 @@ SBINCOMMANDS = "dropbear dropbearkey dropbearconvert"
 BINCOMMANDS = "dbclient ssh scp"
 EXTRA_OEMAKE = 'MULTI=1 SCPPROGRESS=1 PROGRAMS="${SBINCOMMANDS} ${BINCOMMANDS}"'
 
-PACKAGECONFIG ?= ""
+PACKAGECONFIG ?= "disable-weak-ciphers"
 PACKAGECONFIG[system-libtom] = "--disable-bundled-libtom,--enable-bundled-libtom,libtommath libtomcrypt"
+PACKAGECONFIG[disable-weak-ciphers] = ""
 
 EXTRA_OECONF += "\
  ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '--enable-pam', '--disable-pam', d)}"

meta/recipes-core/dropbear/dropbear/dropbear-disable-weak-ciphers.patch new file +44 -0

44 lines not on this page · raw message

Signature · 1 line

1.8.3.1

Adrian Bunk

2019-07-15 20:58 UTC #1 lore raw

Quoted 7 lines · Joseph Reynolds

Enhances dropbear with a new feature "disable-weak-ciphers", on by default. This feature disables all CBC, SHA1, and diffie-hellman group1 ciphers in the dropbear ssh server and client.
Disable this feature if you need to connect to the ssh server from older clients. Additional customization can be done with local_options.h as usual.
...

Changing the default behaviour in a stable series does not sound appropriate to me.

cu
Adrian

Signature · 4 lines

       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed

Joseph Reynolds

author

2019-07-15 21:08 UTC #2 lore raw

Quoted 10 lines · Adrian Bunk

Quoted 7 lines · Joseph Reynolds
Enhances dropbear with a new feature "disable-weak-ciphers", on by default. This feature disables all CBC, SHA1, and diffie-hellman group1 ciphers in the dropbear ssh server and client.
Disable this feature if you need to connect to the ssh server from older clients. Additional customization can be done with local_options.h as usual.
...
Changing the default behaviour in a stable series does not sound appropriate to me.

Although this patch is for security, it is a config change and not a fix. I understand if you don't want to add it to a release branch, and I am am okay with that. I just want to know one way or the other. If this is the answer, we'll put the patch into our downstream project (github.com/openbmc/openbmc branch=warrior) ... waiting for more opinions ....

Thanks!
- Joseph

Quoted 4 lines

cu
Adrian

[email protected]

2019-07-16 13:15 UTC #3 lore raw

Quoted 16 lines · Joseph Reynolds

Quoted 7 lines · Adrian Bunk
Quoted 6 lines · Joseph Reynolds
Enhances dropbear with a new feature "disable-weak-ciphers", on by default.
This feature disables all CBC, SHA1, and diffie-hellman group1 ciphers in
the dropbear ssh server and client.
Quoted 7 lines
Quoted 5 lines
Disable this feature if you need to connect to the ssh server from older
clients. Additional customization can be done with local_options.h as usual.
...
Changing the default behaviour in a stable series does not sound appropriate to me.

Quoted 7 lines

Although this patch is for security, it is a config change and not a fix. I understand if you don't want to add it to a release branch, and I am am okay with that. I just want to know one way or the other.
If this is the answer, we'll put the patch into our downstream project (github.com/openbmc/openbmc branch=warrior) ... waiting for more opinions ....

Whilst I understand the rationale behind this, our policy for stable branches is clear, we shouldn't change behaviour there unless its for a significant security issue. This is more prevention rather than a known large issue.

So unless I hear strong support for adding it, I think we probably just move forward with it in master.

The patch is here if anyone does want it.

(Armin as the stable branch maintainer does also have a say in this, I'm not sure what his opinion is).

Cheers,

Richard