🔥 Sync 2026-06-19 21:14:10

gecoosac/Makefile

@@ -2,7 +2,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=gecoosac
 PKG_VERSION:=2.2.20251015
-PKG_RELEASE:=9
+PKG_RELEASE:=10
 
 ifeq ($(ARCH),aarch64)
   PKG_ARCH:=ac_linux_arm64

gecoosac/files/etc/init.d/gecoosac

@@ -53,11 +53,41 @@ strip_trailing_slashes() {
 	printf '%s\n' "$path"
 }
 
+normalize_path() {
+	local path="$1"
+	local old_ifs part normalized parent
+
+	is_abs_path "$path" || return 1
+	normalized="/"
+	old_ifs="$IFS"
+	IFS=/
+	set -- $path
+	IFS="$old_ifs"
+
+	for part in "$@"; do
+		case "$part" in
+			""|.) ;;
+			..)
+				if [ "$normalized" != "/" ]; then
+					parent="${normalized%/*}"
+					[ -n "$parent" ] || parent="/"
+					normalized="$parent"
+				fi
+			;;
+			*) normalized="${normalized%/}/$part" ;;
+		esac
+	done
+
+	printf '%s\n' "$normalized"
+}
+
 is_safe_upload_dir() {
 	local path
 
-	is_abs_path "$1" || return 1
-	path="$(strip_trailing_slashes "$1")"
+	path="$(normalize_path "$1")" || return 1
+	case "$path" in
+		/etc/gecoosac|/etc/gecoosac/*) return 1 ;;
+	esac
 
 	case "$path" in
 		*/gecoosac/upload) return 0 ;;
@@ -66,6 +96,47 @@ is_safe_upload_dir() {
 	return 1
 }
 
+is_path_in_dir() {
+	local path root
+
+	path="$(normalize_path "$1")" || return 1
+	root="$(normalize_path "$2")" || return 1
+
+	[ "$root" != "/" ] || return 1
+	[ "$path" = "$root" ] && return 0
+	[ "${path#"$root"/}" != "$path" ]
+}
+
+is_safe_db_dir() {
+	local path upload_root
+
+	path="$(normalize_path "$1")" || return 1
+	upload_root="$(normalize_path "${2:-$DEFAULT_UPLOAD_DIR}")" || return 1
+
+	case "$path" in
+		/etc/gecoosac|/etc/gecoosac/*|/tmp/gecoosac|/tmp/gecoosac/*|/var/lib/gecoosac|/var/lib/gecoosac/*) ;;
+		*) return 1 ;;
+	esac
+	is_path_in_dir "$path" "$upload_root" && return 1
+
+	return 0
+}
+
+is_safe_pid_dir() {
+	local path upload_root
+
+	path="$(normalize_path "$1")" || return 1
+	upload_root="$(normalize_path "${2:-$DEFAULT_UPLOAD_DIR}")" || return 1
+
+	case "$path" in
+		/var/run|/var/run/*|/tmp/gecoosac|/tmp/gecoosac/*) ;;
+		*) return 1 ;;
+	esac
+	is_path_in_dir "$path" "$upload_root" && return 1
+
+	return 0
+}
+
 is_port() {
 	case "$1" in
 		""|*[!0-9]*) return 1 ;;
@@ -139,6 +210,18 @@ cert_matches_san() {
 	return 0
 }
 
+cert_matches_key() {
+	local cert_file="$1"
+	local key_file="$2"
+	local cert_pub key_pub
+
+	[ -s "$cert_file" ] && [ -s "$key_file" ] || return 1
+	cert_pub="$(openssl x509 -in "$cert_file" -noout -pubkey 2>/dev/null)" || return 1
+	key_pub="$(openssl pkey -in "$key_file" -pubout 2>/dev/null)" || return 1
+
+	[ -n "$cert_pub" ] && [ "$cert_pub" = "$key_pub" ]
+}
+
 generate_default_cert() {
 	local cert_host cert_ip cert_cn cert_san tmp_crt tmp_key
 
@@ -155,7 +238,7 @@ generate_default_cert() {
 	cert_ip="$(uci -q get network.lan.ipaddr)"
 	is_ipv4 "$cert_ip" || cert_ip=""
 
-	if [ -s "$DEFAULT_KEY_FILE" ] && cert_matches_san "$DEFAULT_CRT_FILE" "$cert_host" "$cert_ip"; then
+	if [ -s "$DEFAULT_KEY_FILE" ] && cert_matches_san "$DEFAULT_CRT_FILE" "$cert_host" "$cert_ip" && cert_matches_key "$DEFAULT_CRT_FILE" "$DEFAULT_KEY_FILE"; then
 		return 0
 	fi
 
@@ -184,7 +267,7 @@ generate_default_cert() {
 		-addext "extendedKeyUsage=serverAuth" \
 		-addext "subjectAltName=$cert_san"
 
-	if [ -s "$tmp_crt" ] && [ -s "$tmp_key" ] && cert_matches_san "$tmp_crt" "$cert_host" "$cert_ip"; then
+	if [ -s "$tmp_crt" ] && [ -s "$tmp_key" ] && cert_matches_san "$tmp_crt" "$cert_host" "$cert_ip" && cert_matches_key "$tmp_crt" "$tmp_key"; then
 		mv "$tmp_key" "$DEFAULT_KEY_FILE"
 		mv "$tmp_crt" "$DEFAULT_CRT_FILE"
 		chmod 600 "$DEFAULT_KEY_FILE"
@@ -199,14 +282,22 @@ generate_default_cert() {
 
 normalize_conf() {
 	if is_safe_upload_dir "$upload_dir"; then
-		upload_dir="$(strip_trailing_slashes "$upload_dir")/"
+		upload_dir="$(normalize_path "$upload_dir")/"
 	else
 		upload_dir="$DEFAULT_UPLOAD_DIR"
 	fi
-	is_abs_path "$db_dir" || db_dir="$DEFAULT_DB_DIR"
+	if is_safe_db_dir "$db_dir" "$upload_dir"; then
+		db_dir="$(normalize_path "$db_dir")/"
+	else
+		db_dir="$DEFAULT_DB_DIR"
+	fi
 	is_abs_path "$crt_file" || crt_file="$DEFAULT_CRT_FILE"
 	is_abs_path "$key_file" || key_file="$DEFAULT_KEY_FILE"
-	is_abs_path "$piddir" && [ "$piddir" != "/" ] || piddir="$DEFAULT_PID_DIR"
+	if is_safe_pid_dir "$piddir" "$upload_dir"; then
+		piddir="$(normalize_path "$piddir")/"
+	else
+		piddir="$DEFAULT_PID_DIR"
+	fi
 	is_port "$port" || port="60650"
 	is_port "$m_port" || m_port="8080"
 
@@ -223,7 +314,10 @@ normalize_conf() {
 }
 
 ensure_dirs() {
-	mkdir -p "$upload_dir" "$db_dir" "$piddir" /etc/gecoosac/tls
+	if ! mkdir -p "$upload_dir" "$db_dir" "$piddir" /etc/gecoosac/tls; then
+		logger -t gecoosac "failed to create runtime directories"
+		return 1
+	fi
 }
 
 start_service() {
@@ -236,7 +330,12 @@ start_service() {
 		return 1
 	fi
 
-	ensure_dirs
+	if [ "$isonlyoneprot" = "0" ] && [ "$port" = "$m_port" ]; then
+		logger -t gecoosac "interface port and management port must be different"
+		return 1
+	fi
+
+	ensure_dirs || return 1
 
 	if [ "$isonlyoneprot" = "0" ] && [ "$https" = "1" ]; then
 		if [ "$crt_file" = "$DEFAULT_CRT_FILE" ] && [ "$key_file" = "$DEFAULT_KEY_FILE" ]; then
@@ -247,6 +346,11 @@ start_service() {
 			logger -t gecoosac "HTTPS is enabled but certificate or key file is missing"
 			return 1
 		fi
+
+		if ! cert_matches_key "$crt_file" "$key_file"; then
+			logger -t gecoosac "HTTPS certificate and key do not match"
+			return 1
+		fi
 	fi
 
 	procd_open_instance gecoosac

gecoosac/files/etc/uci-defaults/gecoosac

@@ -1,9 +1,11 @@
 #!/bin/sh
 
 changed=0
+DEFAULT_DB_DIR=/etc/gecoosac/
 DEFAULT_UPLOAD_DIR=/tmp/gecoosac/upload/
 DEFAULT_CRT_FILE=/etc/gecoosac/tls/gecoosac.crt
 DEFAULT_KEY_FILE=/etc/gecoosac/tls/gecoosac.key
+DEFAULT_PID_DIR=/var/run/
 OLD_CRT_FILE=/etc/gecoosac/tls/1.crt
 OLD_KEY_FILE=/etc/gecoosac/tls/1.key
 
@@ -32,6 +34,34 @@ strip_trailing_slashes() {
 	printf '%s\n' "$path"
 }
 
+normalize_path() {
+	local path="$1"
+	local old_ifs part normalized parent
+
+	is_abs_path "$path" || return 1
+	normalized="/"
+	old_ifs="$IFS"
+	IFS=/
+	set -- $path
+	IFS="$old_ifs"
+
+	for part in "$@"; do
+		case "$part" in
+			""|.) ;;
+			..)
+				if [ "$normalized" != "/" ]; then
+					parent="${normalized%/*}"
+					[ -n "$parent" ] || parent="/"
+					normalized="$parent"
+				fi
+			;;
+			*) normalized="${normalized%/}/$part" ;;
+		esac
+	done
+
+	printf '%s\n' "$normalized"
+}
+
 is_abs_path() {
 	case "$1" in
 		/*) return 0 ;;
@@ -42,8 +72,10 @@ is_abs_path() {
 is_safe_upload_dir() {
 	local path
 
-	is_abs_path "$1" || return 1
-	path="$(strip_trailing_slashes "$1")"
+	path="$(normalize_path "$1")" || return 1
+	case "$path" in
+		/etc/gecoosac|/etc/gecoosac/*) return 1 ;;
+	esac
 
 	case "$path" in
 		*/gecoosac/upload) return 0 ;;
@@ -52,6 +84,47 @@ is_safe_upload_dir() {
 	return 1
 }
 
+is_path_in_dir() {
+	local path root
+
+	path="$(normalize_path "$1")" || return 1
+	root="$(normalize_path "$2")" || return 1
+
+	[ "$root" != "/" ] || return 1
+	[ "$path" = "$root" ] && return 0
+	[ "${path#"$root"/}" != "$path" ]
+}
+
+is_safe_db_dir() {
+	local path upload_root
+
+	path="$(normalize_path "$1")" || return 1
+	upload_root="$(normalize_path "${2:-$DEFAULT_UPLOAD_DIR}")" || return 1
+
+	case "$path" in
+		/etc/gecoosac|/etc/gecoosac/*|/tmp/gecoosac|/tmp/gecoosac/*|/var/lib/gecoosac|/var/lib/gecoosac/*) ;;
+		*) return 1 ;;
+	esac
+	is_path_in_dir "$path" "$upload_root" && return 1
+
+	return 0
+}
+
+is_safe_pid_dir() {
+	local path upload_root
+
+	path="$(normalize_path "$1")" || return 1
+	upload_root="$(normalize_path "${2:-$DEFAULT_UPLOAD_DIR}")" || return 1
+
+	case "$path" in
+		/var/run|/var/run/*|/tmp/gecoosac|/tmp/gecoosac/*) ;;
+		*) return 1 ;;
+	esac
+	is_path_in_dir "$path" "$upload_root" && return 1
+
+	return 0
+}
+
 normalize_upload_dir() {
 	local upload_dir normalized
 
@@ -59,7 +132,7 @@ normalize_upload_dir() {
 	[ -n "$upload_dir" ] || return 0
 
 	if is_safe_upload_dir "$upload_dir"; then
-		normalized="$(strip_trailing_slashes "$upload_dir")/"
+		normalized="$(normalize_path "$upload_dir")/"
 	else
 		normalized="$DEFAULT_UPLOAD_DIR"
 	fi
@@ -69,6 +142,28 @@ normalize_upload_dir() {
 	changed=1
 }
 
+normalize_dir_option() {
+	local option="$1"
+	local default="$2"
+	local validator="$3"
+	local value normalized upload_dir
+
+	value="$(uci -q get "gecoosac.config.${option}")"
+	[ -n "$value" ] || return 0
+	upload_dir="$(uci -q get gecoosac.config.upload_dir)"
+	[ -n "$upload_dir" ] || upload_dir="$DEFAULT_UPLOAD_DIR"
+
+	if "$validator" "$value" "$upload_dir"; then
+		normalized="$(normalize_path "$value")/"
+	else
+		normalized="$default"
+	fi
+
+	[ "$value" = "$normalized" ] && return 0
+	uci -q set "gecoosac.config.${option}=${normalized}"
+	changed=1
+}
+
 migrate_legacy_cert_paths() {
 	local crt_file key_file
 	local migrate
@@ -95,6 +190,8 @@ migrate_legacy_cert_paths() {
 ensure_section
 migrate_legacy_cert_paths
 normalize_upload_dir
+normalize_dir_option db_dir "$DEFAULT_DB_DIR" is_safe_db_dir
+normalize_dir_option piddir "$DEFAULT_PID_DIR" is_safe_pid_dir
 set_default enabled 0
 set_default port 60650
 set_default isonlyoneprot 1
@@ -103,8 +200,8 @@ set_default https 0
 set_default crt_file "$DEFAULT_CRT_FILE"
 set_default key_file "$DEFAULT_KEY_FILE"
 set_default upload_dir "$DEFAULT_UPLOAD_DIR"
-set_default db_dir /etc/gecoosac/
-set_default piddir /var/run/
+set_default db_dir "$DEFAULT_DB_DIR"
+set_default piddir "$DEFAULT_PID_DIR"
 set_default lang zh
 set_default debug 0
 # Preserve the previous package behavior for upgraded configs that never had showtip.