Ticket #299: 301-fix-filechecking.patch

src/openvpn/options.c

@@ -2609 +2609 @@
   return (errcode != 0 ? true : false);
 }
 
+/* Filecheck if file might be relative to chroot dir */
+static bool
+check_file_access_chroot(const int type, const char *file, const int mode, const char *opt, const char *chrootpath)
+{
+  if (chrootpath)
+    {
+      char fullpath [strlen(file) + strlen(chrootpath) +2];
+      sprintf(fullpath, "%s/%s", chrootpath,file);
+      return check_file_access(type, fullpath, mode, opt);
+    }
+  else
+    return check_file_access(type, file, mode, opt);
+}
+
 /*
  * Verifies that the path in the "command" that comes after certain script options (e.g., --up) is a
  * valid file with appropriate permissions.
@@ -2733 +2747 @@
                              R_OK|W_OK|X_OK, "--tls-export-cert");
 #endif /* ENABLE_SSL */
 #if P2MP_SERVER
-  errs |= check_file_access (CHKACC_FILE, options->client_config_dir,
-                             R_OK|X_OK, "--client-config-dir");
+  errs |= check_file_access_chroot (CHKACC_FILE, options->client_config_dir,
+                             R_OK|X_OK, "--client-config-dir", options->chroot_dir);
   errs |= check_file_access (CHKACC_FILE, options->tmp_dir,
                              R_OK|W_OK|X_OK, "Temporary directory (--tmp-dir)");