Выпущен пакет dropbear_2015.68-r7.0.9

Пакет dropbear обновлен с версии 2014.66 до версии 2015.68. В пакете сделаны следующие изменения:

2015.68 - Saturday 8 August 2015:

  • Reduce local data copying for improved efficiency. Measured 30% increase in throughput for connections to localhost
  • Forwarded TCP ports connect asynchronously and try all available addresses (IPv4, IPv6, round robin DNS)
  • Fix all compile warnings, many patches from Gaël Portay Note that configure with -Werror may not be successful on some platforms (OS X) and some configuration options may still result in unused variable warnings.
  • Use TCP Fast Open on Linux if available. Saves a round trip at connection to hosts that have previously been connected. Needs a recent Linux kernel and possibly "sysctl -w net.ipv4.tcp_fastopen=3" Client side is disabled by default pending further compatibility testing with networks and systems.
  • Increase maximum command length to 9000 bytes
  • Free memory before exiting, patch from Thorsten Horstmann. Useful for Dropbear ports to embedded systems and for checking memory leaks with valgrind. Only partially implemented for dbclient. This is disabled by default, enable with DROPBEAR_CLEANUP in sysoptions.h
  • DROPBEAR_DEFAULT_CLI_AUTHKEY setting now always prepends home directory unless there is a leading slash (~ isn't treated specially)
  • Fix small ECC memory leaks
  • Tighten validation of Diffie-Hellman parameters, from Florent Daigniere of Matta Consulting. Odds of bad values are around 2-512 -- improbable.
  • Twofish-ctr cipher is supported though disabled by default
  • Fix pre-authentication timeout when waiting for client SSH-2.0 banner, thanks to CL Ouyang
  • Fix null pointer crash with restrictions in authorized_keys without a command, patch from Guilhem Moulin
  • Ensure authentication timeout is handled while reading the initial banner, thanks to CL Ouyang for finding it.
  • Fix null pointer crash when handling bad ECC keys. Found by afl-fuzz

2015.67 - Wednesday 28 January 2015:

  • Call fsync() after generating private keys to ensure they aren't lost if a reboot occurs. Thanks to Peter Korsgaard
  • Disable non-delayed zlib compression by default on the server. Can be enabled if required for old clients with DROPBEAR_SERVER_DELAY_ZLIB
  • Default client key path ~/.ssh/id_dropbear
  • Prefer stronger algorithms by default, from Fedor Brunner. AES256 over 3DES Diffie-hellman group14 over group1
  • Add option to disable CBC ciphers.
  • Disable twofish in default options.h
  • Enable sha2 HMAC algorithms by default, the code was already required for ECC key exchange. sha1 is the first preference still for performance.
  • Fix installing dropbear.8 in a separate build directory, from Like Ma
  • Allow configure to succeed if libtomcrypt/libtommath are missing, from Elan Ruusamäe
  • Don't crash if ssh-agent provides an unknown type of key. From Catalin Patulea
  • Minor bug fixes, a few issues found by Coverity scan

Comments

No comments.