Mercurial > dropbear
changeset 21:d7cc5b484a2e
- Port restriction code back in
- Remove bad strerror() logging
| author | Matt Johnston <matt@ucc.asn.au> |
|---|---|
| date | Tue, 22 Jun 2004 10:47:16 +0000 |
| parents | db2c8e6fb284 |
| children | c1e5d9195402 |
| files | common-session.c session.h svr-auth.c svr-session.c tcpfwd-remote.c |
| diffstat | 5 files changed, 11 insertions(+), 11 deletions(-) [+] |
line wrap: on
line diff
--- a/common-session.c Thu Jun 03 18:08:34 2004 +0000 +++ b/common-session.c Tue Jun 22 10:47:16 2004 +0000 @@ -108,6 +108,8 @@ ses.chantypes = NULL; + ses.allowprivport = 0; + TRACE(("leave session_init")); }
--- a/session.h Thu Jun 03 18:08:34 2004 +0000 +++ b/session.h Tue Jun 22 10:47:16 2004 +0000 @@ -138,10 +138,13 @@ /* TCP forwarding - where manage listeners */ -#ifndef DISABLE_REMOTETCPFWD +#ifdef USING_LISTENERS struct Listener ** listeners; unsigned int listensize; + /* Whether to allow binding to privileged ports (<1024). This doesn't + * really belong here, but nowhere else fits nicely */ #endif + int allowprivport; };
--- a/svr-auth.c Thu Jun 03 18:08:34 2004 +0000 +++ b/svr-auth.c Tue Jun 22 10:47:16 2004 +0000 @@ -341,6 +341,10 @@ svr_ses.authstate.authdone = 1; + if (svr_ses.authstate.pw->pw_uid == 0) { + ses.allowprivport = 1; + } + /* Remove from the list of pre-auth sockets. Should be m_close(), since if * we fail, we might end up leaking connection slots, and disallow new * logins - a nasty situation. */
--- a/svr-session.c Thu Jun 03 18:08:34 2004 +0000 +++ b/svr-session.c Tue Jun 22 10:47:16 2004 +0000 @@ -183,12 +183,6 @@ "exit before auth: %s", format); } - if (errno != 0) { - /* XXX - is this valid? */ - snprintf(fmtbuf, sizeof(fmtbuf), "%s [%d %s]", fmtbuf, - errno, strerror(errno)); - } - _dropbear_log(LOG_INFO, fmtbuf, param); /* must be after we've done with username etc */
--- a/tcpfwd-remote.c Thu Jun 03 18:08:34 2004 +0000 +++ b/tcpfwd-remote.c Tue Jun 22 10:47:16 2004 +0000 @@ -208,13 +208,10 @@ goto out; } - /* XXX matt - server change - if (ses.authstate.pw->pw_uid != 0 - && port < IPPORT_RESERVED) { + if (!ses.allowprivport && port < IPPORT_RESERVED) { TRACE(("can't assign port < 1024 for non-root")); goto out; } - */ ret = listen_tcpfwd(bindaddr, port);