qi-hardware/openwrt-xburst
1
0
Fork 0
mirror of git://projects.qi-hardware.com/openwrt-xburst.git synced 2024-11-29 07:19:42 +02:00
Code

add dropbear pubkey auth patch from #582

Browse Source 
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@3916 3c298f89-4303-0410-b956-a3cf2f4a3e73
This commit is contained in:
nbd 2006-06-09 00:29:26 +00:00
parent bc71ae3b04
commit 7c641537b0
1 changed files with 31 additions and 75 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

106
openwrt/package/dropbear/patches/100-pubkey_path.patch
View File

@ -1,89 +1,45 @@
diff -urN dropbear.old/svr-authpubkey.c dropbear.dev/svr-authpubkey.c --- dropbear.old/svr-authpubkey.c.orig 2006-06-03 14:54:43.000000000 +0000
--- dropbear.old/svr-authpubkey.c 2005-12-09 06:42:33.000000000 +0100 +++ dropbear.dev/svr-authpubkey.c 2006-06-03 15:03:19.000000000 +0000
+++ dropbear.dev/svr-authpubkey.c 2005-12-12 01:35:32.139358750 +0100 @@ -176,6 +176,8 @@
@@ -155,7 +155,6 @@
unsigned char* keyblob, unsigned int keybloblen) {
FILE * authfile = NULL;
- char * filename = NULL;
int ret = DROPBEAR_FAILURE;
buffer * line = NULL;
unsigned int len, pos;
@@ -176,17 +175,8 @@
goto out; goto out;
} }
- /* we don't need to check pw and pw_dir for validity, since + if (ses.authstate.pw->pw_uid != 0) {
- * its been done in checkpubkeyperms. */ +
- len = strlen(ses.authstate.pw->pw_dir); /* we don't need to check pw and pw_dir for validity, since
- /* allocate max required pathname storage, * its been done in checkpubkeyperms. */
- * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */ len = strlen(ses.authstate.pw->pw_dir);
- filename = m_malloc(len + 22); @@ -187,6 +189,9 @@
- snprintf(filename, len + 22, "%s/.ssh/authorized_keys",
- ses.authstate.pw->pw_dir);
-
/* open the file */ /* open the file */
- authfile = fopen(filename, "r"); authfile = fopen(filename, "r");
+ authfile = fopen("/etc/dropbear/authorized_keys", "r"); + } else {
+ authfile = fopen("/etc/dropbear/authorized_keys","r");
+ }
if (authfile == NULL) { if (authfile == NULL) {
goto out; goto out;
} }
@@ -247,7 +237,6 @@ @@ -274,6 +279,8 @@
if (line) {
buf_free(line);
}
- m_free(filename);
TRACE(("leave checkpubkey: ret=%d", ret))
return ret;
}
@@ -255,12 +244,11 @@
/* Returns DROPBEAR_SUCCESS if file permissions for pubkeys are ok,
* DROPBEAR_FAILURE otherwise.
- * Checks that the user's homedir, ~/.ssh, and
- * ~/.ssh/authorized_keys are all owned by either root or the user, and are
+ * Checks that /etc/dropbear and /etc/dropbear/authorized_keys
+ * are all owned by either root or the user, and are
* g-w, o-w */
static int checkpubkeyperms() {
- char* filename = NULL;
int ret = DROPBEAR_FAILURE;
unsigned int len;
@@ -274,25 +262,11 @@
goto out; goto out;
} }
- /* allocate max required pathname storage, + if (ses.authstate.pw->pw_uid != 0) {
- * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */ +
- filename = m_malloc(len + 22); /* allocate max required pathname storage,
- strncpy(filename, ses.authstate.pw->pw_dir, len+1); * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */
- filename = m_malloc(len + 22);
- /* check ~ */ @@ -295,6 +302,14 @@
- if (checkfileperm(filename) != DROPBEAR_SUCCESS) { if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
- goto out;
- }
-
- /* check ~/.ssh */
- strncat(filename, "/.ssh", 5); /* strlen("/.ssh") == 5 */
- if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
+ if (checkfileperm("/etc/dropbear") != DROPBEAR_SUCCESS) {
goto out; goto out;
} }
+ } else {
+ if (checkfileperm("/etc/dropbear") != DROPBEAR_SUCCESS) {
+ goto out;
+ }
+ if (checkfileperm("/etc/dropbear/authorized_keys") != DROPBEAR_SUCCESS) {
+ goto out;
+ }
+ }
- /* now check ~/.ssh/authorized_keys */ /* file looks ok, return success */
- strncat(filename, "/authorized_keys", 16);
- if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
+ if (checkfileperm("/etc/dropbear/authorized_keys") != DROPBEAR_SUCCESS) {
goto out;
}
@@ -300,7 +274,6 @@
ret = DROPBEAR_SUCCESS; ret = DROPBEAR_SUCCESS;
out:
- m_free(filename);
TRACE(("leave checkpubkeyperms"))
return ret;