All of lore.kernel.org
 help / color / mirror / Atom feed
From: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
To: buildroot@busybox.net
Subject: [Buildroot] [PATCH 4/5] dropbear: add option to disable CBC mode ciphers
Date: Wed,  4 Jul 2018 09:07:38 +0200	[thread overview]
Message-ID: <20180704070739.7259-5-thomas.de_schampheleire@nokia.com> (raw)
In-Reply-To: <20180704070739.7259-1-thomas.de_schampheleire@nokia.com>

CBC mode ciphers are considered insecure. Add an option to disable it.

Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
---
 package/dropbear/Config.in   | 7 +++++++
 package/dropbear/dropbear.mk | 8 ++++++++
 2 files changed, 15 insertions(+)

diff --git a/package/dropbear/Config.in b/package/dropbear/Config.in
index 5d6b83b6d1..d92420ac81 100644
--- a/package/dropbear/Config.in
+++ b/package/dropbear/Config.in
@@ -35,6 +35,13 @@ config BR2_PACKAGE_DROPBEAR_DISABLE_REVERSEDNS
 	  on systems without working DNS, as connections otherwise
 	  stall until DNS times out.
 
+config BR2_PACKAGE_DROPBEAR_DISABLE_CBC
+	bool "disable CBC mode ciphers"
+	help
+	  Cipher Block Chaining (CBC) may allow an attacker to recover
+	  plaintext messages from the ciphertext. For higher security, it is
+	  recommended to disable it (and thus enable this option).
+
 config BR2_PACKAGE_DROPBEAR_SMALL
 	bool "optimize for size"
 	default y
diff --git a/package/dropbear/dropbear.mk b/package/dropbear/dropbear.mk
index bb902bc7ce..dc233aab53 100644
--- a/package/dropbear/dropbear.mk
+++ b/package/dropbear/dropbear.mk
@@ -71,6 +71,10 @@ define DROPBEAR_DISABLE_STANDALONE
 	echo '#define NON_INETD_MODE 0'                 >> $(@D)/localoptions.h
 endef
 
+define DROPBEAR_DISABLE_CBC_CIPHERS
+	echo '#define DROPBEAR_ENABLE_CBC_MODE 0'       >> $(@D)/localoptions.h
+endef
+
 define DROPBEAR_INSTALL_INIT_SYSTEMD
 	$(INSTALL) -D -m 644 package/dropbear/dropbear.service \
 		$(TARGET_DIR)/usr/lib/systemd/system/dropbear.service
@@ -92,6 +96,10 @@ ifeq ($(BR2_PACKAGE_DROPBEAR_DISABLE_REVERSEDNS),)
 DROPBEAR_POST_EXTRACT_HOOKS += DROPBEAR_ENABLE_REVERSE_DNS
 endif
 
+ifeq ($(BR2_PACKAGE_DROPBEAR_DISABLE_CBC),y)
+DROPBEAR_POST_EXTRACT_HOOKS += DROPBEAR_DISABLE_CBC_CIPHERS
+endif
+
 ifeq ($(BR2_PACKAGE_DROPBEAR_SMALL),y)
 DROPBEAR_CONF_OPTS += --disable-zlib --enable-bundled-libtom
 else
-- 
2.16.4

  parent reply	other threads:[~2018-07-04  7:07 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-07-04  7:07 [Buildroot] [PATCH 0/5] misc. patches from Nokia Thomas De Schampheleire
2018-07-04  7:07 ` [Buildroot] [PATCH 1/5] linux: automatically set CONFIG_PERF_EVENTS when perf is enabled Thomas De Schampheleire
2018-07-04 19:52   ` Thomas Petazzoni
2018-07-04  7:07 ` [Buildroot] [PATCH 2/5] pigz: new package Thomas De Schampheleire
2018-07-04  9:51   ` Thomas Petazzoni
2018-07-04 20:30   ` Thomas Petazzoni
2018-07-05  8:00     ` Thomas De Schampheleire
2018-07-04  7:07 ` [Buildroot] [PATCH 3/5] host zstd: additionally build binary and make selectable Thomas De Schampheleire
2018-07-04 20:00   ` Thomas Petazzoni
2018-07-04  7:07 ` Thomas De Schampheleire [this message]
2018-07-04  7:30   ` [Buildroot] [PATCH 4/5] dropbear: add option to disable CBC mode ciphers Baruch Siach
2018-07-04  8:47     ` Thomas De Schampheleire
2018-07-04 19:44   ` Thomas Petazzoni
2018-07-04  7:07 ` [Buildroot] [PATCH 5/5] dropbear: add option to disable weak HMAC algorithms Thomas De Schampheleire

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180704070739.7259-5-thomas.de_schampheleire@nokia.com \
    --to=thomas.de_schampheleire@nokia.com \
    --cc=buildroot@busybox.net \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.