summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--package/dropbear/patches/100-pubkey_path.patch108
1 files changed, 32 insertions, 76 deletions
diff --git a/package/dropbear/patches/100-pubkey_path.patch b/package/dropbear/patches/100-pubkey_path.patch
index 4adda38b2..cbe525bcc 100644
--- a/package/dropbear/patches/100-pubkey_path.patch
+++ b/package/dropbear/patches/100-pubkey_path.patch
@@ -1,89 +1,45 @@
-diff -urN dropbear.old/svr-authpubkey.c dropbear.dev/svr-authpubkey.c
---- dropbear.old/svr-authpubkey.c 2005-12-09 06:42:33.000000000 +0100
-+++ dropbear.dev/svr-authpubkey.c 2005-12-12 01:35:32.139358750 +0100
-@@ -155,7 +155,6 @@
- unsigned char* keyblob, unsigned int keybloblen) {
-
- FILE * authfile = NULL;
-- char * filename = NULL;
- int ret = DROPBEAR_FAILURE;
- buffer * line = NULL;
- unsigned int len, pos;
-@@ -176,17 +175,8 @@
+--- dropbear.old/svr-authpubkey.c.orig 2006-06-03 14:54:43.000000000 +0000
++++ dropbear.dev/svr-authpubkey.c 2006-06-03 15:03:19.000000000 +0000
+@@ -176,6 +176,8 @@
goto out;
}
-- /* we don't need to check pw and pw_dir for validity, since
-- * its been done in checkpubkeyperms. */
-- len = strlen(ses.authstate.pw->pw_dir);
-- /* allocate max required pathname storage,
-- * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */
-- filename = m_malloc(len + 22);
-- snprintf(filename, len + 22, "%s/.ssh/authorized_keys",
-- ses.authstate.pw->pw_dir);
--
++ if (ses.authstate.pw->pw_uid != 0) {
++
+ /* we don't need to check pw and pw_dir for validity, since
+ * its been done in checkpubkeyperms. */
+ len = strlen(ses.authstate.pw->pw_dir);
+@@ -187,6 +189,9 @@
+
/* open the file */
-- authfile = fopen(filename, "r");
-+ authfile = fopen("/etc/dropbear/authorized_keys", "r");
+ authfile = fopen(filename, "r");
++ } else {
++ authfile = fopen("/etc/dropbear/authorized_keys","r");
++ }
if (authfile == NULL) {
goto out;
}
-@@ -247,7 +237,6 @@
- if (line) {
- buf_free(line);
- }
-- m_free(filename);
- TRACE(("leave checkpubkey: ret=%d", ret))
- return ret;
- }
-@@ -255,12 +244,11 @@
-
- /* Returns DROPBEAR_SUCCESS if file permissions for pubkeys are ok,
- * DROPBEAR_FAILURE otherwise.
-- * Checks that the user's homedir, ~/.ssh, and
-- * ~/.ssh/authorized_keys are all owned by either root or the user, and are
-+ * Checks that /etc/dropbear and /etc/dropbear/authorized_keys
-+ * are all owned by either root or the user, and are
- * g-w, o-w */
- static int checkpubkeyperms() {
-
-- char* filename = NULL;
- int ret = DROPBEAR_FAILURE;
- unsigned int len;
-
-@@ -274,25 +262,11 @@
+@@ -274,6 +279,8 @@
goto out;
}
-- /* allocate max required pathname storage,
-- * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */
-- filename = m_malloc(len + 22);
-- strncpy(filename, ses.authstate.pw->pw_dir, len+1);
--
-- /* check ~ */
-- if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
-- goto out;
-- }
--
-- /* check ~/.ssh */
-- strncat(filename, "/.ssh", 5); /* strlen("/.ssh") == 5 */
-- if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
-+ if (checkfileperm("/etc/dropbear") != DROPBEAR_SUCCESS) {
++ if (ses.authstate.pw->pw_uid != 0) {
++
+ /* allocate max required pathname storage,
+ * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */
+ filename = m_malloc(len + 22);
+@@ -295,6 +302,14 @@
+ if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
goto out;
}
-
-- /* now check ~/.ssh/authorized_keys */
-- strncat(filename, "/authorized_keys", 16);
-- if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
-+ if (checkfileperm("/etc/dropbear/authorized_keys") != DROPBEAR_SUCCESS) {
- goto out;
- }
-
-@@ -300,7 +274,6 @@
++ } else {
++ if (checkfileperm("/etc/dropbear") != DROPBEAR_SUCCESS) {
++ goto out;
++ }
++ if (checkfileperm("/etc/dropbear/authorized_keys") != DROPBEAR_SUCCESS) {
++ goto out;
++ }
++ }
+
+ /* file looks ok, return success */
ret = DROPBEAR_SUCCESS;
-
- out:
-- m_free(filename);
-
- TRACE(("leave checkpubkeyperms"))
- return ret;