- Fix #1274: automatically trim chroot path from dnscrypt key/cert paths (from

  Manu Bretelle).

git-svn-id: file:///svn/unbound/trunk@4204 be551aaa-1e26-0410-a405-d3ace91eadb9

diff --git a/dnscrypt/dnscrypt.c b/dnscrypt/dnscrypt.c
index 56903e6513f3b0855e5b87e9a32e53a79b721f01..a6eb6f8d43c3bc0442bd33ec7432555d88d8b60d 100644 (file)
--- a/dnscrypt/dnscrypt.c
+++ b/dnscrypt/dnscrypt.c
@@ -266,6 +266,25 @@ dnsc_read_from_file(char *fname, char *buf, size_t count)
        return 0;
 }
 
+/**
+ * Given an absolute path on the original root, returns the absolute path
+ * within the chroot. If chroot is disabled, the path is not modified.
+ * No char * is malloced so there is no need to free this.
+ * \param[in] cfg the configuration.
+ * \param[in] path the path from the original root.
+ * \return the path from inside the chroot.
+ */
+static char *
+dnsc_chroot_path(struct config_file *cfg, char *path)
+{
+       char *nm;
+       nm = path;
+       if(cfg->chrootdir && cfg->chrootdir[0] && strncmp(nm,
+               cfg->chrootdir, strlen(cfg->chrootdir)) == 0)
+               nm += strlen(cfg->chrootdir);
+       return nm;
+}
+
 /**
  * Parse certificates files provided by the configuration and load them into
  * dnsc_env.
@@ -278,6 +297,7 @@ dnsc_parse_certs(struct dnsc_env *env, struct config_file *cfg)
 {
        struct config_strlist *head;
        size_t signed_cert_id;
+       char *nm;
 
        env->signed_certs_count = 0U;
        for (head = cfg->dnscrypt_provider_cert; head; head = head->next) {
@@ -288,8 +308,9 @@ dnsc_parse_certs(struct dnsc_env *env, struct config_file *cfg)
 
        signed_cert_id = 0U;
        for(head = cfg->dnscrypt_provider_cert; head; head = head->next, signed_cert_id++) {
+               nm = dnsc_chroot_path(cfg, head->str);
                if(dnsc_read_from_file(
-                               head->str,
+                               nm,
                                (char *)(env->signed_certs + signed_cert_id),
                                sizeof(struct SignedCert)) != 0) {
                        fatal_exit("dnsc_parse_certs: failed to load %s: %s", head->str, strerror(errno));
@@ -415,6 +436,7 @@ dnsc_parse_keys(struct dnsc_env *env, struct config_file *cfg)
 {
        struct config_strlist *head;
        size_t keypair_id;
+       char *nm;
 
        env->keypairs_count = 0U;
        for (head = cfg->dnscrypt_secret_key; head; head = head->next) {
@@ -426,8 +448,9 @@ dnsc_parse_keys(struct dnsc_env *env, struct config_file *cfg)
        keypair_id = 0U;
        for(head = cfg->dnscrypt_secret_key; head; head = head->next, keypair_id++) {
                char fingerprint[80];
+               nm = dnsc_chroot_path(cfg, head->str);
                if(dnsc_read_from_file(
-                               head->str,
+                               nm,
                                (char *)(env->keypairs[keypair_id].crypt_secretkey),
                                crypto_box_SECRETKEYBYTES) != 0) {
                        fatal_exit("dnsc_parse_keys: failed to load %s: %s", head->str, strerror(errno));

diff --git a/doc/Changelog b/doc/Changelog
index c0da6bc499fea8a39f81b35cebec5418061170d4..7faf7a2fe657fcba8f73879d1935127c7c73f65b 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,7 @@
+1 June 2017: Ralph
+       - Fix #1274: automatically trim chroot path from dnscrypt key/cert paths
+         (from Manu Bretelle).
+
 1 June 2017: Wouter
        - Fix fastopen EPIPE fallthrough to perform connect.