# HG changeset patch # User Matt Johnston # Date 1423576063 -28800 # Node ID 37c510c2ac7c337596131503c267cf1debb58d2d # Parent 0aa1feb8addaef534ba63d3a94c36827bffa38d8# Parent a1e79ffa58622691f860ea796ec8fe51b7a272be merge diff -r 0aa1feb8adda -r 37c510c2ac7c .hgsigs --- a/.hgsigs Wed Jan 28 22:49:55 2015 +0800 +++ b/.hgsigs Tue Feb 10 21:47:43 2015 +0800 @@ -13,3 +13,4 @@ 96584b934d04ebab443f603e78d38fe692d36313 0 iEYEABECAAYFAlPVFrQACgkQjPn4sExkf7xr6ACglRiLE21vRrS1rJ809o2yMADIKtwAn1f5SyZUngSde8eE55JxCMwtMC5m caac692b366c153cea0e9cd59aa2d79a7d843d4e 0 iEYEABECAAYFAlPk1mcACgkQjPn4sExkf7wLpgCeOqMYqpkf4lYUuyrn9VYThNpc7PkAn3JOSNgIqkKUcmSy6FstrI8jwJzq 2d421bc0545d1be6d59a4ebfe61606d94b124b0c 0 iEYEABECAAYFAlRJDCQACgkQjPn4sExkf7xUYACcCwVJkYWXJn5x/D5A+qMupy778lEAn0rg1oNiq96YU/4jOPsS5IMItihu +1d2d81b1b7c1b100e9c369e40b9fa5b2d491eea9 0 iEYEABECAAYFAlTKOKUACgkQjPn4sExkf7xWMACfYFozyHiRk5GaocTa5z6Ws1uyB4kAoLubxoxcnM3E7AA9mHAzc3OB5M0Y diff -r 0aa1feb8adda -r 37c510c2ac7c .hgtags --- a/.hgtags Wed Jan 28 22:49:55 2015 +0800 +++ b/.hgtags Tue Feb 10 21:47:43 2015 +0800 @@ -46,3 +46,4 @@ 0d2d39957c029adb7f4327d37fe6b4900f0736d9 DROPBEAR_2014.64 e9579816f20ea85affc6135e87f8477992808948 DROPBEAR_2014.65 735511a4c761141416ad0e6728989d2dafa55bc2 DROPBEAR_2014.66 +cbd674d63cd4f3781464a8d4056a5506c8ae926f DROPBEAR_2015.67 diff -r 0aa1feb8adda -r 37c510c2ac7c common-algo.c --- a/common-algo.c Wed Jan 28 22:49:55 2015 +0800 +++ b/common-algo.c Tue Feb 10 21:47:43 2015 +0800 @@ -144,6 +144,12 @@ #ifdef DROPBEAR_AES256 {"aes256-ctr", 0, &dropbear_aes256, 1, &dropbear_mode_ctr}, #endif +#ifdef DROPBEAR_TWOFISH256 + {"twofish256-ctr", 0, &dropbear_twofish256, 1, &dropbear_mode_ctr}, +#endif +#ifdef DROPBEAR_TWOFISH128 + {"twofish128-ctr", 0, &dropbear_twofish128, 1, &dropbear_mode_ctr}, +#endif #endif /* DROPBEAR_ENABLE_CTR_MODE */ #ifdef DROPBEAR_ENABLE_CBC_MODE diff -r 0aa1feb8adda -r 37c510c2ac7c common-kex.c --- a/common-kex.c Wed Jan 28 22:49:55 2015 +0800 +++ b/common-kex.c Tue Feb 10 21:47:43 2015 +0800 @@ -629,16 +629,20 @@ void kexdh_comb_key(struct kex_dh_param *param, mp_int *dh_pub_them, sign_key *hostkey) { - mp_int dh_p; + DEF_MP_INT(dh_p); + DEF_MP_INT(dh_p_min1); mp_int *dh_e = NULL, *dh_f = NULL; - /* read the prime and generator*/ - m_mp_init(&dh_p); + m_mp_init_multi(&dh_p, &dh_p_min1, NULL); load_dh_p(&dh_p); - /* Check that dh_pub_them (dh_e or dh_f) is in the range [1, p-1] */ - if (mp_cmp(dh_pub_them, &dh_p) != MP_LT - || mp_cmp_d(dh_pub_them, 0) != MP_GT) { + if (mp_sub_d(&dh_p, 1, &dh_p_min1) != MP_OKAY) { + dropbear_exit("Diffie-Hellman error"); + } + + /* Check that dh_pub_them (dh_e or dh_f) is in the range [2, p-2] */ + if (mp_cmp(dh_pub_them, &dh_p_min1) != MP_LT + || mp_cmp_d(dh_pub_them, 1) != MP_GT) { dropbear_exit("Diffie-Hellman error"); } @@ -649,7 +653,7 @@ } /* clear no longer needed vars */ - mp_clear_multi(&dh_p, NULL); + mp_clear_multi(&dh_p, &dh_p_min1, NULL); /* From here on, the code needs to work with the _same_ vars on each side, * not vice-versaing for client/server */ diff -r 0aa1feb8adda -r 37c510c2ac7c dbrandom.c --- a/dbrandom.c Wed Jan 28 22:49:55 2015 +0800 +++ b/dbrandom.c Tue Feb 10 21:47:43 2015 +0800 @@ -306,7 +306,7 @@ /* keep regenerating until we get one satisfying * 0 < rand < max */ - } while (mp_cmp(rand, max) != MP_LT); + } while (!(mp_cmp(rand, max) == MP_LT && mp_cmp_d(rand, 0) == MP_GT)); m_burn(randbuf, len); m_free(randbuf); } diff -r 0aa1feb8adda -r 37c510c2ac7c debian/changelog --- a/debian/changelog Wed Jan 28 22:49:55 2015 +0800 +++ b/debian/changelog Tue Feb 10 21:47:43 2015 +0800 @@ -1,3 +1,9 @@ +dropbear (2015.67-0.1) unstable; urgency=low + + * New upstream release. + + -- Matt Johnston Wed, 28 Jan 2015 22:53:59 +0800 + dropbear (2014.66-0.1) unstable; urgency=low * New upstream release. diff -r 0aa1feb8adda -r 37c510c2ac7c debug.h --- a/debug.h Wed Jan 28 22:49:55 2015 +0800 +++ b/debug.h Tue Feb 10 21:47:43 2015 +0800 @@ -39,7 +39,7 @@ * Caution: Don't use this in an unfriendly environment (ie unfirewalled), * since the printing may not sanitise strings etc. This will add a reasonable * amount to your executable size. */ -/* #define DEBUG_TRACE */ +#define DEBUG_TRACE /* All functions writing to the cleartext payload buffer call * CHECKCLEARTOWRITE() before writing. This is only really useful if you're diff -r 0aa1feb8adda -r 37c510c2ac7c options.h --- a/options.h Wed Jan 28 22:49:55 2015 +0800 +++ b/options.h Tue Feb 10 21:47:43 2015 +0800 @@ -95,8 +95,8 @@ #define DROPBEAR_AES256 /* Compiling in Blowfish will add ~6kB to runtime heap memory usage */ /*#define DROPBEAR_BLOWFISH*/ -/*#define DROPBEAR_TWOFISH256*/ -/*#define DROPBEAR_TWOFISH128*/ +#define DROPBEAR_TWOFISH256 +#define DROPBEAR_TWOFISH128 /* Enable CBC mode for ciphers. This has security issues though * is the most compatible with older SSH implementations */ diff -r 0aa1feb8adda -r 37c510c2ac7c release.sh --- a/release.sh Wed Jan 28 22:49:55 2015 +0800 +++ b/release.sh Tue Feb 10 21:47:43 2015 +0800 @@ -7,7 +7,7 @@ fi if ! head -n1 debian/changelog | grep -q $VERSION ; then - echo "CHANGES needs updating" + echo "debian/changelog needs updating" exit 1 fi @@ -36,5 +36,5 @@ (cd $RELDIR/.. && tar cjf $ARCHIVE `basename "$RELDIR"`) || exit 2 ls -l $ARCHIVE -openssl sha1 $ARCHIVE +openssl sha -sha256 $ARCHIVE echo "Done to $ARCHIVE" diff -r 0aa1feb8adda -r 37c510c2ac7c sysoptions.h --- a/sysoptions.h Wed Jan 28 22:49:55 2015 +0800 +++ b/sysoptions.h Tue Feb 10 21:47:43 2015 +0800 @@ -4,7 +4,7 @@ *******************************************************************/ #ifndef DROPBEAR_VERSION -#define DROPBEAR_VERSION "2014.66" +#define DROPBEAR_VERSION "2015.67" #endif #define LOCAL_IDENT "SSH-2.0-dropbear_" DROPBEAR_VERSION