Mercurial > dropbear
comparison CHANGES @ 1546:bb8eaa26bc93 fuzz
merge from main
author | Matt Johnston <matt@ucc.asn.au> |
---|---|
date | Mon, 26 Feb 2018 22:44:48 +0800 |
parents | d35cf9a5e0b5 |
children | e46f7f1da56a |
comparison
equal
deleted
inserted
replaced
1530:63fa53d3b6c7 | 1546:bb8eaa26bc93 |
---|---|
1 Upcoming... | |
2 | |
3 - IMPORTANT: | |
4 Custom configuration is now specified in local_options.h rather than options.h | |
5 Available options and defaults can be seen in default_options.h | |
6 | |
7 To migrate your configuration, compare your customised options.h against the | |
8 upstream options.h from your relevant version. Any customised options should | |
9 be put in localoptions.h | |
10 | |
11 - "configure --enable-static" should now be used instead of "make STATIC=1" | |
12 | |
13 - Add group14-256 and group16 key exchange options | |
14 | |
15 - Set hardened build flags by default if supported by the compiler. | |
16 -Wl,-pie | |
17 -Wl,-z,now -Wl,-z,relro | |
18 -fstack-protector-strong | |
19 -D_FORTIFY_SOURCE=2 | |
20 # spectre v2 mitigation | |
21 -mfunction-return=thunk | |
22 -mindirect-branch=thunk | |
23 | |
24 These can be disabled with configure --disable-harden if needed | |
25 Spectre patch from Loganaden Velvindron | |
26 | |
27 - Add runtime -T max_auth_tries option from Kevin Darbyshire-Bryant | |
28 | |
29 - Add 'dbclient -J &fd' to allow dbclient to connect over an existing socket. | |
30 See dbclient manpage for a socat example. Patch from Harald Becker | |
31 | |
32 - Add "-c forced_command" option. Patch from Jeremy Kerr | |
33 | |
34 - Support server-chosen TCP forwarding ports, patch from houseofkodai | |
35 | |
36 - Allow choosing outgoing address for dbclient with -b [bind_address][:bind_port] | |
37 Patch from houseofkodai | |
38 | |
39 - Update bundled libtomcrypt to 1.18.1, libtommath to 1.0.1 | |
40 | |
41 - Minimum RSA key length has been increased to 1024 bits | |
42 | |
43 - Set PAM_RHOST which is needed by modules such as pam_abl | |
44 | |
45 - Improvements to DSS public key validation, found by OSS-Fuzz. | |
46 | |
47 - Don't exit when an authorized_keys file has malformed entries. Found by OSS-Fuzz | |
48 | |
49 - Fix null-pointer crash with malformed ECDSA or DSS keys. Found by OSS-Fuzz | |
50 | |
51 - Numerous code cleanups and small issues fixed by Francois Perrad | |
52 | |
53 - Test for pkt_sched.h rather than SO_PRIORITY which was problematic with some musl | |
54 platforms. Reported by Oliver Schneider and Andrew Bainbridge | |
55 | |
56 - Fix some platform portability problems, from Ben Gardner | |
57 | |
58 - Add EXEEXT filename suffix for building dropbearmulti, from William Foster | |
59 | |
60 - Support --enable-<option> properly for configure, from Stefan Hauser | |
61 | |
62 - configure have_openpty result can be cached, from Eric BĂ©nard | |
63 | |
64 - handle platforms that return close() < -1 on failure, from Marco Wenzel | |
65 | |
66 - Build and configuration cleanups from Michael Witten | |
67 | |
68 - Fix libtomcrypt/libtommath linking order, from Andre McCurdy | |
69 | |
70 - Fix old Linux platforms that have SYS_clock_gettime but not CLOCK_MONOTONIC | |
71 | |
72 - Update curve25519-donna implementation to current version | |
73 | |
1 2017.75 - 18 May 2017 | 74 2017.75 - 18 May 2017 |
2 | 75 |
3 - Security: Fix double-free in server TCP listener cleanup | 76 - Security: Fix double-free in server TCP listener cleanup |
4 A double-free in the server could be triggered by an authenticated user if | 77 A double-free in the server could be triggered by an authenticated user if |
5 dropbear is running with -a (Allow connections to forwarded ports from any host) | 78 dropbear is running with -a (Allow connections to forwarded ports from any host) |