changeset 21:d7cc5b484a2e

- Port restriction code back in - Remove bad strerror() logging
author Matt Johnston <matt@ucc.asn.au>
date Tue, 22 Jun 2004 10:47:16 +0000
parents db2c8e6fb284
children c1e5d9195402
files common-session.c session.h svr-auth.c svr-session.c tcpfwd-remote.c
diffstat 5 files changed, 11 insertions(+), 11 deletions(-) [+]
line wrap: on
line diff
--- a/common-session.c	Thu Jun 03 18:08:34 2004 +0000
+++ b/common-session.c	Tue Jun 22 10:47:16 2004 +0000
@@ -108,6 +108,8 @@
 
 	ses.chantypes = NULL;
 
+	ses.allowprivport = 0;
+
 
 	TRACE(("leave session_init"));
 }
--- a/session.h	Thu Jun 03 18:08:34 2004 +0000
+++ b/session.h	Tue Jun 22 10:47:16 2004 +0000
@@ -138,10 +138,13 @@
 
 	
 	/* TCP forwarding - where manage listeners */
-#ifndef DISABLE_REMOTETCPFWD
+#ifdef USING_LISTENERS
 	struct Listener ** listeners;
 	unsigned int listensize;
+	/* Whether to allow binding to privileged ports (<1024). This doesn't
+	 * really belong here, but nowhere else fits nicely */
 #endif
+	int allowprivport;
 
 };
 
--- a/svr-auth.c	Thu Jun 03 18:08:34 2004 +0000
+++ b/svr-auth.c	Tue Jun 22 10:47:16 2004 +0000
@@ -341,6 +341,10 @@
 
 	svr_ses.authstate.authdone = 1;
 
+	if (svr_ses.authstate.pw->pw_uid == 0) {
+		ses.allowprivport = 1;
+	}
+
 	/* Remove from the list of pre-auth sockets. Should be m_close(), since if
 	 * we fail, we might end up leaking connection slots, and disallow new
 	 * logins - a nasty situation. */							
--- a/svr-session.c	Thu Jun 03 18:08:34 2004 +0000
+++ b/svr-session.c	Tue Jun 22 10:47:16 2004 +0000
@@ -183,12 +183,6 @@
 				"exit before auth: %s", format);
 	}
 
-	if (errno != 0) {
-		/* XXX - is this valid? */
-		snprintf(fmtbuf, sizeof(fmtbuf), "%s [%d %s]", fmtbuf, 
-				errno, strerror(errno));
-	}
-
 	_dropbear_log(LOG_INFO, fmtbuf, param);
 
 	/* must be after we've done with username etc */
--- a/tcpfwd-remote.c	Thu Jun 03 18:08:34 2004 +0000
+++ b/tcpfwd-remote.c	Tue Jun 22 10:47:16 2004 +0000
@@ -208,13 +208,10 @@
 		goto out;
 	}
 
-	/* XXX matt - server change
-	if (ses.authstate.pw->pw_uid != 0
-			&& port < IPPORT_RESERVED) {
+	if (!ses.allowprivport && port < IPPORT_RESERVED) {
 		TRACE(("can't assign port < 1024 for non-root"));
 		goto out;
 	}
-	*/
 
 	ret = listen_tcpfwd(bindaddr, port);