[Buildroot] [PATCH] package/dropbear: provide config option to turn off SHA1 for RSA

From: Markus Mayer via buildroot <buildroot@buildroot.org>
To: Buildroot Mailing List <buildroot@buildroot.org>
Cc: Markus Mayer <mmayer@broadcom.com>
Subject: [Buildroot] [PATCH] package/dropbear: provide config option to turn off SHA1 for RSA
Date: Fri, 16 Aug 2024 17:00:26 -0700	[thread overview]
Message-ID: <20240817000027.654079-1-mmayer@broadcom.com> (raw)

Since SHA1 hashing is considered insecure, users may wish to disable
support for it. This will reduce compatibility with older systems but
provide a more secure setup.

SHA1 support for RSA is slated to be removed from dropbear at some
point. This new option also gives users the ability to disable support
early and evaluate what consequences this upcoming change might bring.

Signed-off-by: Markus Mayer <mmayer@broadcom.com>
---
 package/dropbear/Config.in   | 6 ++++++
 package/dropbear/dropbear.mk | 7 +++++++
 2 files changed, 13 insertions(+)

diff --git a/package/dropbear/Config.in b/package/dropbear/Config.in
index 207c1f561700..099f61535aa2 100644
--- a/package/dropbear/Config.in
+++ b/package/dropbear/Config.in
@@ -67,6 +67,12 @@ config BR2_PACKAGE_DROPBEAR_LEGACY_CRYPTO
 	    DSA public keys
 	    Diffie-Hellman Group1 key exchange
 
+config BR2_PACKAGE_DROPBEAR_DISABLE_RSA_SHA1
+	bool "disable SHA1 hashing for RSA"
+	help
+	  SHA1 is no longer considered secure. Users may want to disable
+	  it. However, this may preclude older clients from connecting.
+
 config BR2_PACKAGE_DROPBEAR_LOCALOPTIONS_FILE
 	string "path to custom localoptions.h definitions file"
 	help
diff --git a/package/dropbear/dropbear.mk b/package/dropbear/dropbear.mk
index 9423d891c8d3..56a0b9d910b4 100644
--- a/package/dropbear/dropbear.mk
+++ b/package/dropbear/dropbear.mk
@@ -77,6 +77,13 @@ endef
 DROPBEAR_POST_EXTRACT_HOOKS += DROPBEAR_ENABLE_LEGACY_CRYPTO
 endif
 
+ifeq ($(BR2_PACKAGE_DROPBEAR_DISABLE_RSA_SHA1),y)
+define DROPBEAR_DISABLE_RSA_SHA1
+	echo '#define DROPBEAR_RSA_SHA1 0'              >> $(@D)/localoptions.h
+endef
+DROPBEAR_POST_EXTRACT_HOOKS += DROPBEAR_DISABLE_RSA_SHA1
+endif
+
 ifeq ($(BR2_PACKAGE_DROPBEAR_DISABLE_REVERSEDNS),)
 define DROPBEAR_ENABLE_REVERSE_DNS
 	echo '#define DO_HOST_LOOKUP 1'                 >> $(@D)/localoptions.h
-- 
2.46.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
