340 lines
12 KiB
Diff
Executable File
340 lines
12 KiB
Diff
Executable File
diff -Naur dropbear-2012.55-orig/cli-runopts.c dropbear-2012.55/cli-runopts.c
|
||
--- dropbear-2012.55-orig/cli-runopts.c 2014-01-13 10:21:20.762118749 +0800
|
||
+++ dropbear-2012.55/cli-runopts.c 2012-02-23 21:47:05.000000000 +0800
|
||
@@ -287,10 +287,6 @@
|
||
debug_trace = 1;
|
||
break;
|
||
#endif
|
||
- case 'o':
|
||
- next = &dummy;
|
||
- case 'x':
|
||
- break;
|
||
case 'F':
|
||
case 'e':
|
||
case 'c':
|
||
@@ -302,6 +298,7 @@
|
||
#ifndef ENABLE_CLI_LOCALTCPFWD
|
||
case 'L':
|
||
#endif
|
||
+ case 'o':
|
||
case 'b':
|
||
next = &dummy;
|
||
default:
|
||
diff -Naur dropbear-2012.55-orig/dbutil.h dropbear-2012.55/dbutil.h
|
||
--- dropbear-2012.55-orig/dbutil.h 2014-01-13 10:21:28.274118742 +0800
|
||
+++ dropbear-2012.55/dbutil.h 2012-02-23 21:47:05.000000000 +0800
|
||
@@ -93,10 +93,6 @@
|
||
#define DEF_MP_INT(X) mp_int X = {0, 0, 0, NULL}
|
||
|
||
/* Dropbear assertion */
|
||
-#ifndef DROPBEAR_ASSERT_ENABLED
|
||
-#define DROPBEAR_ASSERT_ENABLED 0
|
||
-#endif
|
||
-
|
||
-#define dropbear_assert(X) do { if (DROPBEAR_ASSERT_ENABLED && !(X)) { fail_assert(#X, __FILE__, __LINE__); } } while (0)
|
||
+#define dropbear_assert(X) do { if (!(X)) { fail_assert(#X, __FILE__, __LINE__); } } while (0)
|
||
|
||
#endif /* _DBUTIL_H_ */
|
||
diff -Naur dropbear-2012.55-orig/dropbear_rsa_host_key.ZyXEL dropbear-2012.55/dropbear_rsa_host_key.ZyXEL
|
||
--- dropbear-2012.55-orig/dropbear_rsa_host_key.ZyXEL 1970-01-01 08:00:00.000000000 +0800
|
||
+++ dropbear-2012.55/dropbear_rsa_host_key.ZyXEL 2014-01-13 11:00:44.306076814 +0800
|
||
@@ -0,0 +1,5 @@
|
||
+ ssh-rsa # Õ٠÷º:û$30›ˆ`vúW„kLOòÃ2²É’´ÈꬫÔÞ ßÜ{+áì ³Õ†‰b-uƒwàÀú<˜ëxðfzo§«�Sq Ó7o[|Y>p.¼-‘ƒ�ð‡Ñ£Ì,ÄÜBåqý BD¯¹TV®ÆzOfò`UÌ{ UTês°—<âµ½µå®ÚÊ·Ÿè0.&œîÆ<Ó¦¾lBÜ; 4]‘häÉ5nîx\´pÌIªŒ[å"ðýSú¶´`ÿ a`Û¿Ê
|
||
&xí2ëçoQ#轿ñ¨iiN‚DQ×õé¾GLŸPlùZ
|
||
H†± ÙÓÑï‹’ÃC7A™OxùM t
|
||
ü7 ÷aØÊ‚0TnšŒ˜\Ÿ§ö:qGh^Ëû½†µ�sVL¢‹r5¥BÝNÁ÷`K®m› i"‰2rSÝÉ«Ýü+µ³ùRŽ8—›+kX›‰oc¥�[2ä5þ‰7èùEë4RÑD^Ô#Á‰\Ì3ê]K
|
||
+|"š+@à ,û`{/òVœ …˜BëÊØTáT�| twOæZG(
|
||
+"üUß-nuóÔÃ{izXJ·0×h<ß®ÖäÁA�K’rè¨Ò0ŒÔN3UgžÏž%g mR�„#\
|
||
+2x®QR¸§ºY¸ EZa²Ç({^6е“.¢qèdsn§£YP=�ìgÊ•¸èz�#q§ � õ9SK½. œ·Êä�¿š_SˆG¡ú®Š ¾–¬&örìRê ò²Fóûk‚Úcn„¿
|
||
:E9S~·P&;^¾>b#Ü`pP}¿–;ö¡µ HÚïZHe"™ %ªÛÁ;uµ"äím")x‰‘Åòkvµ³¼³þmîô¬]÷_ã‹M
|
||
ùÏ � ß?[±a!'p
|
||
+*±Ûë´_¤Õÿ‘Ì$ÉÆìLRFé$× »(â!3ëýÝCª ß{™£FYïù;ý€FÀ«@°hœ+&çÊ&Ú•’ŸaˆeJ¹§[…ÝnG•aßM†ÀD»ÆWt&¢¯à&ú°¿Ôðú[Ž ¡‡†Ý ¦a 6(5#
|
||
\ No newline at end of file
|
||
diff -Naur dropbear-2012.55-orig/Makefile.in dropbear-2012.55/Makefile.in
|
||
--- dropbear-2012.55-orig/Makefile.in 2014-01-13 10:21:50.634117214 +0800
|
||
+++ dropbear-2012.55/Makefile.in 2014-01-13 10:53:36.918082863 +0800
|
||
@@ -10,7 +10,8 @@
|
||
# Hopefully that seems intuitive.
|
||
|
||
ifndef PROGRAMS
|
||
- PROGRAMS=dropbear dbclient dropbearkey dropbearconvert
|
||
+# PROGRAMS=dropbear dbclient dropbearkey dropbearconvert
|
||
+ PROGRAMS=dropbear
|
||
endif
|
||
|
||
LTC=libtomcrypt/libtomcrypt.a
|
||
@@ -56,7 +57,7 @@
|
||
loginrec.h atomicio.h x11fwd.h agentfwd.h tcpfwd.h compat.h \
|
||
listener.h fake-rfc2553.h
|
||
|
||
-dropbearobjs=$(COMMONOBJS) $(CLISVROBJS) $(SVROBJS)
|
||
+dropbearobjs=$(COMMONOBJS) $(CLISVROBJS) $(SVROBJS) @CRYPTLIB@
|
||
dbclientobjs=$(COMMONOBJS) $(CLISVROBJS) $(CLIOBJS)
|
||
dropbearkeyobjs=$(COMMONOBJS) $(KEYOBJS)
|
||
dropbearconvertobjs=$(COMMONOBJS) $(CONVERTOBJS)
|
||
@@ -77,7 +78,7 @@
|
||
INSTALL=@INSTALL@
|
||
CPPFLAGS=@CPPFLAGS@
|
||
CFLAGS+=-I. -I$(srcdir) $(CPPFLAGS) @CFLAGS@
|
||
-LIBS+=@CRYPTLIB@ @LIBS@
|
||
+LIBS+=@LIBS@
|
||
LDFLAGS=@LDFLAGS@
|
||
|
||
EXEEXT=@EXEEXT@
|
||
@@ -145,6 +146,9 @@
|
||
-chown root $(DESTDIR)$(sbindir)/dropbear$(EXEEXT)
|
||
-chgrp 0 $(DESTDIR)$(sbindir)/dropbear$(EXEEXT)
|
||
|
||
+ $(INSTALL) -d -m 755 $(INSTALL_DIR)/etc/mycert
|
||
+ $(INSTALL) dropbear_rsa_host_key.ZyXEL $(INSTALL_DIR)/etc/mycert/ssh.rsa
|
||
+
|
||
inst_%: $*
|
||
$(INSTALL) -d -m 755 $(DESTDIR)$(bindir)
|
||
$(INSTALL) -m 755 $*$(EXEEXT) $(DESTDIR)$(bindir)
|
||
@@ -169,7 +173,7 @@
|
||
# multi-binary compilation.
|
||
MULTIOBJS=
|
||
ifeq ($(MULTI),1)
|
||
- MULTIOBJS=dbmulti.o $(sort $(foreach prog, $(PROGRAMS), $($(prog)objs)))
|
||
+ MULTIOBJS=dbmulti.o $(sort $(foreach prog, $(PROGRAMS), $($(prog)objs))) @CRYPTLIB@
|
||
CFLAGS+=$(addprefix -DDBMULTI_, $(PROGRAMS)) -DDROPBEAR_MULTI
|
||
endif
|
||
|
||
diff -Naur dropbear-2012.55-orig/options.h dropbear-2012.55/options.h
|
||
--- dropbear-2012.55-orig/options.h 2014-01-13 10:22:19.610117073 +0800
|
||
+++ dropbear-2012.55/options.h 2014-01-13 10:38:54.842099304 +0800
|
||
@@ -5,11 +5,6 @@
|
||
#ifndef _OPTIONS_H_
|
||
#define _OPTIONS_H_
|
||
|
||
-#if !defined(DROPBEAR_CLIENT) && !defined(DROPBEAR_SERVER)
|
||
-#define DROPBEAR_SERVER
|
||
-#define DROPBEAR_CLIENT
|
||
-#endif
|
||
-
|
||
/******************************************************************
|
||
* Define compile-time options below - the "#ifndef DROPBEAR_XXX .... #endif"
|
||
* parts are to allow for commandline -DDROPBEAR_XXX options etc.
|
||
@@ -29,7 +24,7 @@
|
||
#define DSS_PRIV_FILENAME "/etc/dropbear/dropbear_dss_host_key"
|
||
#endif
|
||
#ifndef RSA_PRIV_FILENAME
|
||
-#define RSA_PRIV_FILENAME "/etc/dropbear/dropbear_rsa_host_key"
|
||
+#define RSA_PRIV_FILENAME "/etc/mycert/ssh.rsa"
|
||
#endif
|
||
|
||
/* Set NON_INETD_MODE if you require daemon functionality (ie Dropbear listens
|
||
@@ -43,7 +38,7 @@
|
||
* Both of these flags can be defined at once, don't compile without at least
|
||
* one of them. */
|
||
#define NON_INETD_MODE
|
||
-/*#define INETD_MODE*/
|
||
+#define INETD_MODE
|
||
|
||
/* Setting this disables the fast exptmod bignum code. It saves ~5kB, but is
|
||
* perhaps 20% slower for pubkey operations (it is probably worth experimenting
|
||
@@ -54,7 +49,7 @@
|
||
several kB in binary size however will make the symmetrical ciphers and hashes
|
||
slower, perhaps by 50%. Recommended for small systems that aren't doing
|
||
much traffic. */
|
||
-#define DROPBEAR_SMALL_CODE
|
||
+/*#define DROPBEAR_SMALL_CODE*/
|
||
|
||
/* Enable X11 Forwarding - server only */
|
||
#define ENABLE_X11FWD
|
||
@@ -83,7 +78,7 @@
|
||
|
||
/* Enable "Netcat mode" option. This will forward standard input/output
|
||
* to a remote TCP-forwarded connection */
|
||
-/*#define ENABLE_CLI_NETCAT*/
|
||
+#define ENABLE_CLI_NETCAT
|
||
|
||
/* Encryption - at least one required.
|
||
* Protocol RFC requires 3DES and recommends AES128 for interoperability.
|
||
@@ -94,8 +89,8 @@
|
||
#define DROPBEAR_AES256
|
||
/* Compiling in Blowfish will add ~6kB to runtime heap memory usage */
|
||
/*#define DROPBEAR_BLOWFISH*/
|
||
-/*#define DROPBEAR_TWOFISH256
|
||
-#define DROPBEAR_TWOFISH128*/
|
||
+#define DROPBEAR_TWOFISH256
|
||
+#define DROPBEAR_TWOFISH128
|
||
|
||
/* Enable "Counter Mode" for ciphers. This is more secure than normal
|
||
* CBC mode against certain attacks. This adds around 1kB to binary
|
||
@@ -115,7 +110,7 @@
|
||
* If you disable MD5, Dropbear will fall back to SHA1 fingerprints,
|
||
* which are not the standard form. */
|
||
#define DROPBEAR_SHA1_HMAC
|
||
-/*#define DROPBEAR_SHA1_96_HMAC*/
|
||
+#define DROPBEAR_SHA1_96_HMAC
|
||
#define DROPBEAR_MD5_HMAC
|
||
|
||
/* Hostkey/public key algorithms - at least one required, these are used
|
||
@@ -149,11 +144,11 @@
|
||
#endif
|
||
|
||
/* Whether to do reverse DNS lookups. */
|
||
-/*#define DO_HOST_LOOKUP*/
|
||
+#define DO_HOST_LOOKUP
|
||
|
||
/* Whether to print the message of the day (MOTD). This doesn't add much code
|
||
* size */
|
||
-/*#define DO_MOTD*/
|
||
+#define DO_MOTD
|
||
|
||
/* The MOTD file path */
|
||
#ifndef MOTD_FILENAME
|
||
@@ -197,7 +192,7 @@
|
||
* note that it will be provided for all "hidden" client-interactive
|
||
* style prompts - if you want something more sophisticated, use
|
||
* SSH_ASKPASS instead. Comment out this var to remove this functionality.*/
|
||
-/*#define DROPBEAR_PASSWORD_ENV "DROPBEAR_PASSWORD"*/
|
||
+#define DROPBEAR_PASSWORD_ENV "DROPBEAR_PASSWORD"
|
||
|
||
/* Define this (as well as ENABLE_CLI_PASSWORD_AUTH) to allow the use of
|
||
* a helper program for the ssh client. The helper program should be
|
||
@@ -297,7 +292,7 @@
|
||
#define DEFAULT_IDLE_TIMEOUT 0
|
||
|
||
/* The default path. This will often get replaced by the shell */
|
||
-#define DEFAULT_PATH "/bin:/sbin:/usr/bin:/usr/sbin"
|
||
+#define DEFAULT_PATH "/usr/bin:/bin"
|
||
|
||
/* Some other defines (that mostly should be left alone) are defined
|
||
* in sysoptions.h */
|
||
diff -Naur dropbear-2012.55-orig/svr-authpubkey.c dropbear-2012.55/svr-authpubkey.c
|
||
--- dropbear-2012.55-orig/svr-authpubkey.c 2014-01-13 10:21:01.538118357 +0800
|
||
+++ dropbear-2012.55/svr-authpubkey.c 2012-02-23 21:47:06.000000000 +0800
|
||
@@ -209,21 +209,17 @@
|
||
goto out;
|
||
}
|
||
|
||
- if (ses.authstate.pw_uid != 0) {
|
||
- /* we don't need to check pw and pw_dir for validity, since
|
||
- * its been done in checkpubkeyperms. */
|
||
- len = strlen(ses.authstate.pw_dir);
|
||
- /* allocate max required pathname storage,
|
||
- * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */
|
||
- filename = m_malloc(len + 22);
|
||
- snprintf(filename, len + 22, "%s/.ssh/authorized_keys",
|
||
- ses.authstate.pw_dir);
|
||
-
|
||
- /* open the file */
|
||
- authfile = fopen(filename, "r");
|
||
- } else {
|
||
- authfile = fopen("/etc/dropbear/authorized_keys","r");
|
||
- }
|
||
+ /* we don't need to check pw and pw_dir for validity, since
|
||
+ * its been done in checkpubkeyperms. */
|
||
+ len = strlen(ses.authstate.pw_dir);
|
||
+ /* allocate max required pathname storage,
|
||
+ * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */
|
||
+ filename = m_malloc(len + 22);
|
||
+ snprintf(filename, len + 22, "%s/.ssh/authorized_keys",
|
||
+ ses.authstate.pw_dir);
|
||
+
|
||
+ /* open the file */
|
||
+ authfile = fopen(filename, "r");
|
||
if (authfile == NULL) {
|
||
goto out;
|
||
}
|
||
@@ -376,35 +372,26 @@
|
||
goto out;
|
||
}
|
||
|
||
- if (ses.authstate.pw_uid == 0) {
|
||
- if (checkfileperm("/etc/dropbear") != DROPBEAR_SUCCESS) {
|
||
- goto out;
|
||
- }
|
||
- if (checkfileperm("/etc/dropbear/authorized_keys") != DROPBEAR_SUCCESS) {
|
||
- goto out;
|
||
- }
|
||
- } else {
|
||
- /* allocate max required pathname storage,
|
||
- * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */
|
||
- filename = m_malloc(len + 22);
|
||
- strncpy(filename, ses.authstate.pw_dir, len+1);
|
||
-
|
||
- /* check ~ */
|
||
- if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
|
||
- goto out;
|
||
- }
|
||
-
|
||
- /* check ~/.ssh */
|
||
- strncat(filename, "/.ssh", 5); /* strlen("/.ssh") == 5 */
|
||
- if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
|
||
- goto out;
|
||
- }
|
||
-
|
||
- /* now check ~/.ssh/authorized_keys */
|
||
- strncat(filename, "/authorized_keys", 16);
|
||
- if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
|
||
- goto out;
|
||
- }
|
||
+ /* allocate max required pathname storage,
|
||
+ * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */
|
||
+ filename = m_malloc(len + 22);
|
||
+ strncpy(filename, ses.authstate.pw_dir, len+1);
|
||
+
|
||
+ /* check ~ */
|
||
+ if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
|
||
+ goto out;
|
||
+ }
|
||
+
|
||
+ /* check ~/.ssh */
|
||
+ strncat(filename, "/.ssh", 5); /* strlen("/.ssh") == 5 */
|
||
+ if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
|
||
+ goto out;
|
||
+ }
|
||
+
|
||
+ /* now check ~/.ssh/authorized_keys */
|
||
+ strncat(filename, "/authorized_keys", 16);
|
||
+ if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
|
||
+ goto out;
|
||
}
|
||
|
||
/* file looks ok, return success */
|
||
diff -Naur dropbear-2012.55-orig/svr-chansession.c dropbear-2012.55/svr-chansession.c
|
||
--- dropbear-2012.55-orig/svr-chansession.c 2014-01-13 10:21:10.234119965 +0800
|
||
+++ dropbear-2012.55/svr-chansession.c 2012-02-23 21:47:06.000000000 +0800
|
||
@@ -891,12 +891,12 @@
|
||
/* We can only change uid/gid as root ... */
|
||
if (getuid() == 0) {
|
||
|
||
- if ((ses.authstate.pw_gid != 0) && ((setgid(ses.authstate.pw_gid) < 0) ||
|
||
+ if ((setgid(ses.authstate.pw_gid) < 0) ||
|
||
(initgroups(ses.authstate.pw_name,
|
||
- ses.authstate.pw_gid) < 0))) {
|
||
+ ses.authstate.pw_gid) < 0)) {
|
||
dropbear_exit("Error changing user group");
|
||
}
|
||
- if ((ses.authstate.pw_uid != 0) && (setuid(ses.authstate.pw_uid) < 0)) {
|
||
+ if (setuid(ses.authstate.pw_uid) < 0) {
|
||
dropbear_exit("Error changing user");
|
||
}
|
||
} else {
|
||
diff -Naur dropbear-2012.55-orig/svr-runopts.c dropbear-2012.55/svr-runopts.c
|
||
--- dropbear-2012.55-orig/svr-runopts.c 2014-01-13 10:22:01.914118433 +0800
|
||
+++ dropbear-2012.55/svr-runopts.c 2012-02-23 21:47:06.000000000 +0800
|
||
@@ -325,7 +325,7 @@
|
||
myspec = m_strdup(spec);
|
||
|
||
/* search for ':', that separates address and port */
|
||
- svr_opts.ports[svr_opts.portcount] = strrchr(myspec, ':');
|
||
+ svr_opts.ports[svr_opts.portcount] = strchr(myspec, ':');
|
||
|
||
if (svr_opts.ports[svr_opts.portcount] == NULL) {
|
||
/* no ':' -> the whole string specifies just a port */
|
||
diff -Naur dropbear-2012.55-orig/sysoptions.h dropbear-2012.55/sysoptions.h
|
||
--- dropbear-2012.55-orig/sysoptions.h 2012-02-23 21:47:06.000000000 +0800
|
||
+++ dropbear-2012.55/sysoptions.h 2014-01-13 10:39:28.162098432 +0800
|
||
@@ -25,10 +25,10 @@
|
||
|
||
/* Minimum key sizes for DSS and RSA */
|
||
#ifndef MIN_DSS_KEYLEN
|
||
-#define MIN_DSS_KEYLEN 512
|
||
+#define MIN_DSS_KEYLEN 1024
|
||
#endif
|
||
#ifndef MIN_RSA_KEYLEN
|
||
-#define MIN_RSA_KEYLEN 512
|
||
+#define MIN_RSA_KEYLEN 2048
|
||
#endif
|
||
|
||
#define MAX_BANNER_SIZE 2000 /* this is 25*80 chars, any more is foolish */
|