mirror of
https://github.com/openwrt/openwrt.git
synced 2024-12-25 00:11:13 +00:00
f527436364
The only HMACs currently available use MD5 and SHA1, both of which have known
weaknesses. We already compile in the SHA256 code since we use Curve25519
by default, so there's no significant size penalty to enabling this.
Signed-off-by: Joseph C. Sible <josephcsible@users.noreply.github.com>
(cherry picked from commit 0bf85ef048)
81 lines
3.1 KiB
Diff
81 lines
3.1 KiB
Diff
--- a/options.h
|
|
+++ b/options.h
|
|
@@ -41,7 +41,7 @@
|
|
* Both of these flags can be defined at once, don't compile without at least
|
|
* one of them. */
|
|
#define NON_INETD_MODE
|
|
-#define INETD_MODE
|
|
+/*#define INETD_MODE*/
|
|
|
|
/* Setting this disables the fast exptmod bignum code. It saves ~5kB, but is
|
|
* perhaps 20% slower for pubkey operations (it is probably worth experimenting
|
|
@@ -81,7 +81,7 @@ much traffic. */
|
|
|
|
/* Enable "Netcat mode" option. This will forward standard input/output
|
|
* to a remote TCP-forwarded connection */
|
|
-#define ENABLE_CLI_NETCAT
|
|
+/*#define ENABLE_CLI_NETCAT*/
|
|
|
|
/* Whether to support "-c" and "-m" flags to choose ciphers/MACs at runtime */
|
|
#define ENABLE_USER_ALGO_LIST
|
|
@@ -91,16 +91,16 @@ much traffic. */
|
|
* Including multiple keysize variants the same cipher
|
|
* (eg AES256 as well as AES128) will result in a minimal size increase.*/
|
|
#define DROPBEAR_AES128
|
|
-#define DROPBEAR_3DES
|
|
+/*#define DROPBEAR_3DES*/
|
|
#define DROPBEAR_AES256
|
|
/* Compiling in Blowfish will add ~6kB to runtime heap memory usage */
|
|
/*#define DROPBEAR_BLOWFISH*/
|
|
-#define DROPBEAR_TWOFISH256
|
|
-#define DROPBEAR_TWOFISH128
|
|
+/*#define DROPBEAR_TWOFISH256*/
|
|
+/*#define DROPBEAR_TWOFISH128*/
|
|
|
|
/* Enable CBC mode for ciphers. This has security issues though
|
|
* is the most compatible with older SSH implementations */
|
|
-#define DROPBEAR_ENABLE_CBC_MODE
|
|
+/*#define DROPBEAR_ENABLE_CBC_MODE*/
|
|
|
|
/* Enable "Counter Mode" for ciphers. This is more secure than normal
|
|
* CBC mode against certain attacks. It is recommended for security
|
|
@@ -131,9 +131,9 @@ If you test it please contact the Dropbe
|
|
* If you disable MD5, Dropbear will fall back to SHA1 fingerprints,
|
|
* which are not the standard form. */
|
|
#define DROPBEAR_SHA1_HMAC
|
|
-#define DROPBEAR_SHA1_96_HMAC
|
|
+/*#define DROPBEAR_SHA1_96_HMAC*/
|
|
#define DROPBEAR_SHA2_256_HMAC
|
|
-#define DROPBEAR_SHA2_512_HMAC
|
|
+/*#define DROPBEAR_SHA2_512_HMAC*/
|
|
#define DROPBEAR_MD5_HMAC
|
|
|
|
/* You can also disable integrity. Don't bother disabling this if you're
|
|
@@ -146,7 +146,7 @@ If you test it please contact the Dropbe
|
|
* Removing either of these won't save very much space.
|
|
* SSH2 RFC Draft requires dss, recommends rsa */
|
|
#define DROPBEAR_RSA
|
|
-#define DROPBEAR_DSS
|
|
+/*#define DROPBEAR_DSS*/
|
|
/* ECDSA is significantly faster than RSA or DSS. Compiling in ECC
|
|
* code (either ECDSA or ECDH) increases binary size - around 30kB
|
|
* on x86-64 */
|
|
@@ -194,7 +194,7 @@ If you test it please contact the Dropbe
|
|
|
|
/* Whether to print the message of the day (MOTD). This doesn't add much code
|
|
* size */
|
|
-#define DO_MOTD
|
|
+/*#define DO_MOTD*/
|
|
|
|
/* The MOTD file path */
|
|
#ifndef MOTD_FILENAME
|
|
@@ -242,7 +242,7 @@ Homedir is prepended unless path begins
|
|
* note that it will be provided for all "hidden" client-interactive
|
|
* style prompts - if you want something more sophisticated, use
|
|
* SSH_ASKPASS instead. Comment out this var to remove this functionality.*/
|
|
-#define DROPBEAR_PASSWORD_ENV "DROPBEAR_PASSWORD"
|
|
+/*#define DROPBEAR_PASSWORD_ENV "DROPBEAR_PASSWORD"*/
|
|
|
|
/* Define this (as well as ENABLE_CLI_PASSWORD_AUTH) to allow the use of
|
|
* a helper program for the ssh client. The helper program should be
|