hak5
/
openwrt-owl
mirror of https://github.com/hak5/openwrt-owl.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

add dropbear pubkey auth patch from #582 

SVN-Revision: 3916
owl
Felix Fietkau 2006-06-09 00:29:26 +00:00
parent 3faa3eef9d
commit f83eb8146e
1 changed files with 31 additions and 75 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

106
openwrt/package/dropbear/patches/100-pubkey_path.patch
View File

@ -1,89 +1,45 @@
diff -urN dropbear.old/svr-authpubkey.c dropbear.dev/svr-authpubkey.c
--- dropbear.old/svr-authpubkey.c 2005-12-09 06:42:33.000000000 +0100
+++ dropbear.dev/svr-authpubkey.c 2005-12-12 01:35:32.139358750 +0100
@@ -155,7 +155,6 @@
unsigned char* keyblob, unsigned int keybloblen) {
FILE * authfile = NULL;
- char * filename = NULL;
int ret = DROPBEAR_FAILURE;
buffer * line = NULL;
unsigned int len, pos;
@@ -176,17 +175,8 @@
--- dropbear.old/svr-authpubkey.c.orig 2006-06-03 14:54:43.000000000 +0000
+++ dropbear.dev/svr-authpubkey.c 2006-06-03 15:03:19.000000000 +0000
@@ -176,6 +176,8 @@
goto out;
}
- /* we don't need to check pw and pw_dir for validity, since
- * its been done in checkpubkeyperms. */
- len = strlen(ses.authstate.pw->pw_dir);
- /* allocate max required pathname storage,
- * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */
- filename = m_malloc(len + 22);
- snprintf(filename, len + 22, "%s/.ssh/authorized_keys",
- ses.authstate.pw->pw_dir);
-
+ if (ses.authstate.pw->pw_uid != 0) {
+
/* we don't need to check pw and pw_dir for validity, since
* its been done in checkpubkeyperms. */
len = strlen(ses.authstate.pw->pw_dir);
@@ -187,6 +189,9 @@
/* open the file */
- authfile = fopen(filename, "r");
+ authfile = fopen("/etc/dropbear/authorized_keys", "r");
authfile = fopen(filename, "r");
+ } else {
+ authfile = fopen("/etc/dropbear/authorized_keys","r");
+ }
if (authfile == NULL) {
goto out;
}
@@ -247,7 +237,6 @@
if (line) {
buf_free(line);
}
- m_free(filename);
TRACE(("leave checkpubkey: ret=%d", ret))
return ret;
}
@@ -255,12 +244,11 @@
/* Returns DROPBEAR_SUCCESS if file permissions for pubkeys are ok,
* DROPBEAR_FAILURE otherwise.
- * Checks that the user's homedir, ~/.ssh, and
- * ~/.ssh/authorized_keys are all owned by either root or the user, and are
+ * Checks that /etc/dropbear and /etc/dropbear/authorized_keys
+ * are all owned by either root or the user, and are
* g-w, o-w */
static int checkpubkeyperms() {
- char* filename = NULL;
int ret = DROPBEAR_FAILURE;
unsigned int len;
@@ -274,25 +262,11 @@
@@ -274,6 +279,8 @@
goto out;
}
- /* allocate max required pathname storage,
- * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */
- filename = m_malloc(len + 22);
- strncpy(filename, ses.authstate.pw->pw_dir, len+1);
-
- /* check ~ */
- if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
- goto out;
- }
-
- /* check ~/.ssh */
- strncat(filename, "/.ssh", 5); /* strlen("/.ssh") == 5 */
- if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
+ if (ses.authstate.pw->pw_uid != 0) {
+
/* allocate max required pathname storage,
* = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */
filename = m_malloc(len + 22);
@@ -295,6 +302,14 @@
if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
goto out;
}
+ } else {
+ if (checkfileperm("/etc/dropbear") != DROPBEAR_SUCCESS) {
goto out;
}
- /* now check ~/.ssh/authorized_keys */
- strncat(filename, "/authorized_keys", 16);
- if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
+ goto out;
+ }
+ if (checkfileperm("/etc/dropbear/authorized_keys") != DROPBEAR_SUCCESS) {
goto out;
}
+ goto out;
+ }
+ }
@@ -300,7 +274,6 @@
/* file looks ok, return success */
ret = DROPBEAR_SUCCESS;
out:
- m_free(filename);
TRACE(("leave checkpubkeyperms"))
return ret;