dropbear: update to 2013.59 (released 4 october 2013)

- drop mirror www.mirrors.wiretapped.net (not working anymore)
- drop patch 300-ipv6_addr_port_split.patch, included upstream
- refresh patches
- various upstream changes: http://matt.ucc.asn.au/dropbear/CHANGES

Signed-off-by: Catalin Patulea <cat@vv.carleton.ca>

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@38356 3c298f89-4303-0410-b956-a3cf2f4a3e73

package/network/services/dropbear/Makefile

@@ -8,14 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=dropbear
-PKG_VERSION:=2012.55
+PKG_VERSION:=2013.59
-PKG_RELEASE:=2
+PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:= \
-	http://matt.ucc.asn.au/dropbear/releases/ \
+	http://matt.ucc.asn.au/dropbear/releases/
-	http://www.mirrors.wiretapped.net/security/cryptography/apps/ssh/dropbear/
+PKG_MD5SUM:=6c1e6c2c297f4034488ffc95e8b7e6e9
-PKG_MD5SUM:=8c784baec3054cdb1bb4bfa792c87812
 
 PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=LICENSE libtomcrypt/LICENSE libtommath/LICENSE

package/network/services/dropbear/patches/110-change_user.patch

@@ -1,6 +1,6 @@
 --- a/svr-chansession.c
 +++ b/svr-chansession.c
-@@ -891,12 +891,12 @@ static void execchild(void *user_data) {
+@@ -889,12 +889,12 @@ static void execchild(void *user_data) {
  	/* We can only change uid/gid as root ... */
  	if (getuid() == 0) {
  

package/network/services/dropbear/patches/120-openwrt_options.patch

@@ -25,9 +25,9 @@
 -#define ENABLE_CLI_NETCAT
 +/*#define ENABLE_CLI_NETCAT*/
  
- /* Encryption - at least one required.
+ /* Whether to support "-c" and "-m" flags to choose ciphers/MACs at runtime */
-  * Protocol RFC requires 3DES and recommends AES128 for interoperability.
+ #define ENABLE_USER_ALGO_LIST
-@@ -89,8 +89,8 @@ much traffic. */
+@@ -92,8 +92,8 @@ much traffic. */
  #define DROPBEAR_AES256
  /* Compiling in Blowfish will add ~6kB to runtime heap memory usage */
  /*#define DROPBEAR_BLOWFISH*/
@@ -38,21 +38,16 @@
  
  /* Enable "Counter Mode" for ciphers. This is more secure than normal
   * CBC mode against certain attacks. This adds around 1kB to binary 
-@@ -110,7 +110,7 @@ much traffic. */
+@@ -119,7 +119,7 @@ much traffic. */
   * If you disable MD5, Dropbear will fall back to SHA1 fingerprints,
   * which are not the standard form. */
  #define DROPBEAR_SHA1_HMAC
 -#define DROPBEAR_SHA1_96_HMAC
 +/*#define DROPBEAR_SHA1_96_HMAC*/
+ /*#define DROPBEAR_SHA2_256_HMAC*/
+ /*#define DROPBEAR_SHA2_512_HMAC*/
  #define DROPBEAR_MD5_HMAC
- 
+@@ -157,7 +157,7 @@ much traffic. */
- /* Hostkey/public key algorithms - at least one required, these are used
-@@ -144,11 +144,11 @@ much traffic. */
- #endif
- 
- /* Whether to do reverse DNS lookups. */
--#define DO_HOST_LOOKUP
-+/*#define DO_HOST_LOOKUP*/
  
  /* Whether to print the message of the day (MOTD). This doesn't add much code
   * size */
@@ -61,7 +56,7 @@
  
  /* The MOTD file path */
  #ifndef MOTD_FILENAME
-@@ -192,7 +192,7 @@ much traffic. */
+@@ -195,7 +195,7 @@ much traffic. */
   * note that it will be provided for all "hidden" client-interactive
   * style prompts - if you want something more sophisticated, use 
   * SSH_ASKPASS instead. Comment out this var to remove this functionality.*/

package/network/services/dropbear/patches/130-ssh_ignore_o_and_x_args.patch

@@ -1,6 +1,6 @@
 --- a/cli-runopts.c
 +++ b/cli-runopts.c
-@@ -287,6 +287,10 @@ void cli_getopts(int argc, char ** argv)
+@@ -309,6 +309,10 @@ void cli_getopts(int argc, char ** argv)
  					debug_trace = 1;
  					break;
  #endif
@@ -10,8 +10,8 @@
 +					break;
  				case 'F':
  				case 'e':
- 				case 'c':
+ #ifndef ENABLE_USER_ALGO_LIST
-@@ -298,7 +302,6 @@ void cli_getopts(int argc, char ** argv)
+@@ -322,7 +326,6 @@ void cli_getopts(int argc, char ** argv)
  #ifndef ENABLE_CLI_LOCALTCPFWD
  				case 'L':
  #endif

package/network/services/dropbear/patches/140-disable_assert.patch

@@ -1,6 +1,6 @@
 --- a/dbutil.h
 +++ b/dbutil.h
-@@ -93,6 +93,10 @@ int m_str_to_uint(const char* str, unsig
+@@ -92,7 +92,11 @@ int m_str_to_uint(const char* str, unsig
  #define DEF_MP_INT(X) mp_int X = {0, 0, 0, NULL}
  
  /* Dropbear assertion */
@@ -11,4 +11,5 @@
 +
 +#define dropbear_assert(X) do { if (DROPBEAR_ASSERT_ENABLED && !(X)) { fail_assert(#X, __FILE__, __LINE__); } } while (0)
  
- #endif /* _DBUTIL_H_ */
+ /* Returns 0 if a and b have the same contents */
+ int constant_time_memcmp(const void* a, const void *b, size_t n);

package/network/services/dropbear/patches/200-lcrypt_bsdfix.patch

@@ -9,7 +9,7 @@
  dbclientobjs=$(COMMONOBJS) $(CLISVROBJS) $(CLIOBJS)
  dropbearkeyobjs=$(COMMONOBJS) $(KEYOBJS)
  dropbearconvertobjs=$(COMMONOBJS) $(CONVERTOBJS)
-@@ -77,7 +77,7 @@ STRIP=@STRIP@
+@@ -78,7 +78,7 @@ STRIP=@STRIP@
  INSTALL=@INSTALL@
  CPPFLAGS=@CPPFLAGS@
  CFLAGS+=-I. -I$(srcdir) $(CPPFLAGS) @CFLAGS@
@@ -18,7 +18,7 @@
  LDFLAGS=@LDFLAGS@
  
  EXEEXT=@EXEEXT@
-@@ -169,7 +169,7 @@ scp: $(SCPOBJS)  $(HEADERS) Makefile
+@@ -168,7 +168,7 @@ scp: $(SCPOBJS)  $(HEADERS) Makefile
  # multi-binary compilation.
  MULTIOBJS=
  ifeq ($(MULTI),1)

package/network/services/dropbear/patches/300-ipv6_addr_port_split.patch

@@ -1,11 +0,0 @@
---- a/svr-runopts.c
-+++ b/svr-runopts.c
-@@ -325,7 +325,7 @@ static void addportandaddress(char* spec
- 		myspec = m_strdup(spec);
- 
- 		/* search for ':', that separates address and port */
--		svr_opts.ports[svr_opts.portcount] = strchr(myspec, ':');
-+		svr_opts.ports[svr_opts.portcount] = strrchr(myspec, ':');
- 
- 		if (svr_opts.ports[svr_opts.portcount] == NULL) {
- 			/* no ':' -> the whole string specifies just a port */

package/network/services/dropbear/patches/500-set-default-path.patch

@@ -1,6 +1,6 @@
 --- a/options.h
 +++ b/options.h
-@@ -297,7 +297,7 @@ be overridden at runtime with -I. 0 disa
+@@ -301,7 +301,7 @@ be overridden at runtime with -I. 0 disa
  #define DEFAULT_IDLE_TIMEOUT 0
  
  /* The default path. This will often get replaced by the shell */