Commit Graph

46 Commits

Author SHA1 Message Date
lukem c31e16f75e Add two new ftpd.conf(5) directives:
- 'denyquick'; deny a connection so tagged by ftpusers(5) after the USER
  command instead of the PASS command. whilst this might provide some
  info leakage of accounts names if you have some `real' or `chroot'
  users enabled and not others, it does prevent accidental entering of
  such passwords if you have all such users denied. This option is
  strongly recommended on anonymous-only servers.
  Functionality requested by Rob Windsor in [bin/12602]
- 'private'; don't display class related information in the output of STAT.
  For paranoid admins.
2001-12-04 13:54:12 +00:00
lukem 3a491eda3c - enable case insensitive fnmatch(3)ing for hostname globs in ftpusers(5)
- enable WARNS=2
2001-12-01 10:25:29 +00:00
lukem 53c91d8f76 a few changes from Mike Heffner <mheffner@vt.edu> in private email:
- totally clear a glob buffer before use, because FreeBSD depends on
  some of the other fields being cleared (other than just gl_offs)
- in strend(), ensure that the source string isn't too large
- remove unnecessarily complicated sizing of proctitle, since snprintf()
  will truncate it anyway
2001-09-19 00:50:52 +00:00
lukem afa0abb87f s/tise/tize/ in docco, add "advertize" as synonym for "advertise" 2001-06-26 19:30:44 +00:00
kristerw 1571b4e91f Initialize a pointer needed when expanding the %C "display file escape
sequence".
2001-05-25 23:40:25 +00:00
lukem 7e903ba2b0 crank copyrights of files changed this year
remove superfluous byte_count update in send_file_list
crank version
2001-04-25 01:46:25 +00:00
christos 55dd4165ca don't leak globbed memory. 2001-03-18 22:42:22 +00:00
christos 62f543d92e Use GLOB_LIMIT. Also fix a bug where gl_offs was not initialized and could
contain trash.
2001-03-16 20:42:12 +00:00
lukem b687712e95 don't support t(erabyte) as a suffix in strsuftoll() #ifdef NO_LONG_LONG 2001-03-16 20:35:35 +00:00
lukem 5015048190 Features:
* Add ftpd.conf(5) directive `advertise'; change the address that is
  advertised to the client for PASV transfers. this may be useful in
  certain firewall/NAT environments.

  Feature requested in [bin/9606] by Scott Presnell.

* Add -X option; syslog wu-ftpd style xferlog messages, prefixed with
  `xferlog: '.  An example line from syslog (wrapped):
	Dec 16 18:50:24 odysseus ftpd[571]: xferlog: Sat Dec 16 18:50:24 2000
	2 localhost 3747328 /pub/WLW2K601.EXE b _ o a lukem@ FTP 0 * c

  These messages can be converted to a wu-ftpd style xferlog file
  suitable for parsing with third-party tools with something like:
	grep 'xferlog: ' /var/log/xferlog | \
	    sed -e 's/^.*xferlog: //' >wuxferlog

  The format is the same as the wu-ftpd xferlog entries (with the leading
  syslog stuff), but different from the wu-ftpd syslogged xferlog entries
  because the latter is not as easy to convert into the standard xferlog
  file format.

  The choice to only syslog the xferlog messages rather than append to
  a /var/log/xferlog file was made because the latter doesn't work to
  well in the situation where the logfile is rotated and compressed and
  a long-running ftpd still has a file-descriptor to the now nonexistant
  xferlog file, and the log message will then get lost.

  Feature requested in [bin/11651] by Hubert Feyrer.


Fixes:

* In ftpd(8), clarify the -a and -c options.

* More clarifications in ftpd.conf(5).

* Ensure that all ftpd.conf commands set a parameter back to sane defaults
  if an argument of `none' or bad settings are given.

* Support the `chroot' directive for `REAL' users too (for consistency).

* For `GUEST' users, store the supplied password in pw->pw_passwd for use
  later in the xferlog.

* If show_chdir_messages() is given a code of -1, flush the cache of
  visited directories.  Invoke show_chdir_messages(-1) in end_login().

* Only syslog session stats if logging is requested.

* Rename logcmd() -> logxfer(), and dolog() -> logremotehost().

* Use cprintf() instead of fprintf() where appropriate.

* Minor KNF, and make a couple of functions static that were declared static.
2000-12-18 02:32:50 +00:00
lukem 999fd3d617 - new ftpd.conf directives:
maxfilesize	set the maximum size of uploaded files
	sanenames	if set, only permit uploaded filenames that contain
			characters from the set "-+,._A-Za-z0-9" and that
			don't start with `.'

- new/changed command line options:
	-e emailaddr	define email address for %E (see below)
	-P dataport	use dataport as the dataport (instead of ctrlport-1)
	-q		use pid files to count users	[default]
	-Q		don't use pid files to count users
	-u		write entries to utmp
	-U		don't write entries to utmp	[default]
	-w		write entries to wtmp		[default]
	-W		don't write entries to wtmp

	  NOTE:	-U used to mean `write utmp entries'. Its meaning has changed
		so that it's orthogonal with -q/-Q and -w/-W. This isn't
		considered a major problem, because using -U isn't going to
		enable something you don't want, but will disable something
		you did want (which is safer).

- new display file escape sequences:
	%E	email address
	%s	literal `s' if the previous %M or %N wasn't ``1''.
	%S	literal `S' if the previous %M or %N wasn't ``1''.

- expand the description of building ~ftp/incoming to cover the
  appropriate ftpd.conf(5) directives (which are defaults, but it pays
  to explicitly explain them)

- replace strsuftoi() with strsuftoll(), which returns a long long if
  supported, otherwise a long

- rework the way that check_modify and check_upload are done in the yacc
  parser; they're merged into a common check_write() function which is
  called explicitly

- merge all ftpclass `flag variables' into a single bitfield-based flag element

- move various common bits of parse_conf() into a couple of macros

- clean up some comments
2000-11-16 13:15:13 +00:00
lukem f62aa6c8ac changes to improve portability:
* replace union sockunion {} with struct sockinet {}, and modify the code
  accordingly. this is possibly more portable, as it doesn't rely upon
  the structure alignment within the union for our own stuff.  uses local
  su_len unless HAVE_SOCKADDR_SA_LEN is defined (set ifdef BSD4_4)
  (XXX: haven't tested the ipv6 stuff)
* always use getaddrinfo() and getnameinfo() instead of maintaining two code
  paths. (lukemftpd will provide replacements for these on older systems)
* use lockf() instead of open(.., O_EXLOCK) to lock the pid file
* minor KNF
* clean up long long support: create helper #defines and use as appropriate:
        #define		NO_LONG_LONG	! NO_LONG_LONG
        -------		------------	--------------
        LLF		"%ld"		"%lld"
        LLFP(x)		"%" x "ld"	"%" x "lld"
        LLT		long		long long
        ULLF		"%lu"		"%llu"
        ULLFP(x)	"%" x "lu"	"%" x "llu"
        ULLT		unsigned long	unsigned long long
        STRTOLL(x,y,z)	strtol(x,y,z)	strtoll(x,y,z)
2000-11-15 02:32:30 +00:00
lukem d85f3bb159 * make checkportcmd the default. this breaks third-party proxy ftp but
prevents the ftp bounce attack, and we should be secure out of the
  box, not require users to tweak obscure stuff.
* allow the version string reported to clients to be changed with '-V vers'.
  if vers is empty or `-', don't report a version.
* if -r is given, permanently drop root privs
* if not a REAL user (i.e, GUEST or CHROOT), and ftpd is running on a port
  > IPPORT_RESERVED+1, permanently drop root privs
* don't bother reverting to root privs to logout of wtmp/utmp; since the
  file descriptor is already open this isn't necessary.
* fix the binding of the port for the PORT/LPRT/EPRT connection to be the
  ctrl_addr.su_port-1, not hardcoded to `20' (this was broken in the ipv6
  merge). if root privs have been dropped, and this would be a port <
  IPPORT_RESERVED, use a random port instead (which isn't RFC959 compliant
  but it doesn't appear that many clients care).
* prevent login of a new user if privs have been dropped and already logged
  in as a REAL user (existing check already stops GUEST & CHROOT users).
* move the port check stuff into a separate port_check() function, and use
  for PORT, LPRT, and EPRT checks. inspired by freebsd
* minor KNF
* minor man page cleanup
2000-07-23 14:40:48 +00:00
lukem e3a2c5cc44 * add two new ftpd.conf(5) directives:
chroot	specify dir to chroot to for GUEST and CHROOT users, to
		override -a anondir or the user's homedir.
	homedir	specify dir to change to upon login; also used for ~ expansion
		and $HOME for subprocesses)
  both of these can take % escapes: %u (username), %d (homedir), %c (class).
* fix NLST to take a pathname not a STRING, so that ~ expansion works
* modify CWD to use the homedir parsed from curclass.homedir
* implement format_path(dst, src), to parse src expanding % escapes (see above)
  into dst.
* rename format_file() to display_file()
2000-07-17 02:30:52 +00:00
sommerfeld eac5778e83 More -Wformat cleanups. 2000-07-09 02:24:30 +00:00
lukem 73f082e2ea various fixes suggested by Robert Elz:
* implement closedataconn() and use appropriately (including in mlsd())
* only put leading space in front of MLST output (not MLSD output)
* MLSD: only output pdir and cdir entries when the type fact is requested.
* change error code for giving MLSD a non-directory from 550 to 501
* remove MLSx Type fact support for UNIX.* for now; it's not standardised yet.
* do a check_login when MLSD and MLST are given no args
* detect & complain about null facts in OPTS MLST
* cache getgroups() at login instead of calling each time in fact_perm()

other mods:
* implement cprintf(); as per fprintf() but increments total_bytes{,_out}
* implement CPUTC(); as per putc() but increments total_bytes{,_out}
* implement base64_encode()
* fact_unique() display base64 encoding of dev_t and ino_t rather than
  hex output; should scale if size of those changes
* change reply() so that a negative code acts as the initial line in a reply,
  code == 0 prefixes the line with 4 spaces, and code > 0 works as before.
  deprecate lreply(code, ) and lreply(0, ) in favour of reply(-code, ) and
  reply(0, ) respectively.
* use cprintf() and CPUTC() appropriately (often instead of printf(),
  lreply(-2, ) or lreply(-1, ).
  now we actually account for the data sent by MLST and MLSD.
* remove DEBUG support for sending MLSD output to control connection instead
  of data connection (my ftp client now supports MLSD :-)
2000-06-19 15:15:03 +00:00
lukem dcc88422ad convert to ANSI C as per style guide 2000-05-20 02:20:18 +00:00
lukem ab88a15086 suppress verbose messages from CWD and post-login if the first
character of the anonymous password is `-'.
2000-01-13 00:04:31 +00:00
lukem c8493e9499 * add ftpd.conf directive `portrange class min max', which allows specification
of the port range used by passive connections. based on work in [bin/9158]
  from Takahiro Kambe <taca@sky.yamashina.kyoto.jp>
* change the way global variables are defined and extern-ed to be more
  consistent.
2000-01-12 22:39:27 +00:00
lukem 559037c273 fix problem where ftpd.conf lines would match everything if there was
no template defined. noted by Vebjorn Ljosa <ljosa@initio.no>
2000-01-10 08:03:50 +00:00
lukem 7e80378800 * new ftpd.conf directive:
template class [refclass]
  following directives for refclass will apply to class as well.
  this makes setting up a `template' class with many default settings
  easy, whilst allowing for class-specific overrides
* prevent crash when the optional limitfile wasn't given to limit
* document count_users()
* document default setting of limit in ftpd.conf(5)
* crank version
2000-01-09 10:08:45 +00:00
lukem 16e886121d features:
* add connection limits (`limit' keyword in ftpd.conf)
* move initialisation of curclass from parse_conf() to new function
  init_curclass()
* implement count_users(), which determines the number of users in a given
  class. a file - /var/run/ftpd.pids-<class> - is used to store a list
  of pids in use (effectively an array of pid_t's), and its size is reduced
  as necessary.
* new % modifiers in format_file:
	%c	class
	%M	maximum connection count
	%N	current connection count
* always end_login()s, even for refused connections

bugs fixed:
* remove \n from %T output
* fix some inconsistencies in the man pages
* ensure that both `ftp' *and* `anonymous' are allowed in ftpusers.
  (this was accidently broken in a recent commit to be ``or'' not ``and'')
* use MAXPATHLEN not MAXPATHLEN+1
* crank copyright date on modified files
* crank version
2000-01-08 11:09:56 +00:00
lukem 21d03121d3 * change format of /etc/ftpusers lines from
userglob [allow|deny]
  to
	userglob[@host] [allow|deny  [classname]]
  where class is a userdefined classname.
  - if host is given it may either be a CIDR address (e.g, `1.2.3.0/24') or a
    hostglob (e.g, `*.foo.com'), and the remote host is matched against that.
  - if classname is given, use that to match entries in ftpd.conf (defaults
    to `guest' for `anonymous'/`ftp' logins, `chroot' for users found in
    /etc/ftpchroot, and `real' for everyone else.

* implement new /etc/ftpd.conf directives:
    classtype classname type	set type of classname to GUEST, CHROOT, or REAL
    motd classname file		file to use instead of /etc/motd
    rateget classname rate	set rateget throttle to rate
    rateput classname rate	set rateput throttle to rate
    upload classname		allow/deny uploads (STOU, STOR, APPE). if
				denied, also acts as `modify deny'.

* implement new `SITE' commands:
    RATEGET	as per /etc/ftpd.conf rateget, but cannot exceed that
    RATEPUT	as per /etc/ftpd.conf rateput, but cannot exceed that

* implement format_file(), which outputs a file to the user, parsing %
  escapes. use to print /etc/ftpwelcome, /etc/motd, and the `display' file.

* implement strsuftoi() (from ftp(1)), which parses a number and
  optional suffix (for use with rateget, etc)

* don't bother seteuid(0) ; bind(...) ; seteuid(pw->pw_uid), since
  we don't need reserved ports (at wasn't getting them anyway).

* update & reorder copyrights

* use strlcpy() as appropriate
1999-12-12 14:05:54 +00:00
lukem 397e2cfc53 * change ftpd_popen() to take char *argv[] instead of char *cmd.
the string tokenisation must be performed by the caller (which is
  generally easy because it's almost always a static command).
* change do_conversion() to return a char *argv[] instead of char *cmd.
  tokenisation of the command is done internally.
* change retrieve() to take char *argv[] instead of char *cmd.
  (to take advantage of the above changes).  fixes [bin/8173]
* use fparseln() instead of fgetln()
* store conversions in listed order (rather than reverse order)
* use stringlists instead of handrolling code to manage an argv.
1999-12-07 05:30:53 +00:00
lukem d51504eeb3 check return val of sl_init() and sl_add() 1999-11-28 04:38:41 +00:00
christos cee9ac24ad more kerberos5 fixes 1999-08-25 20:07:33 +00:00
lukem 4b2b2847cc * fix a problem in retrieve() where arguments to commands weren't working
(this was broken in the last commit). problem noticed by simonb@
* don't display the stderr output of the internal ls.
* modify usage of lreply so that generally only one `XXX-' code per
  `block' is displayed; the rest of the lines have four spaces instead.
  i find this easier to read.
* fix a couple places where byte accounting wasn't correct
1999-05-18 08:14:17 +00:00
lukem 25cf35a4f3 features/fixes:
* implement xferstats. full stats are displayed for `STAT', and a
  summary is displayed upon exit (and syslogged).  inspired by wu-ftpd.
* wrap data xfers in {send,receive}_data with alarm() timeouts. this
  should remove the majority of the `hanging ftpd' problems that
  people were still seeing.  inspired by wu-ftpd.
* link with ../../bin/ls, so that bin/ls is not required under a
  chroot()ed area for `LIST' to work.  based on [bin/4497] from
  "Soren S.  Jorvang" <soren@t.dk>
* migrate code from util.c into ftpd.c, so that it doesn't conflict
  with ls' util.c.
* remove man page comment about ~ftp/bin/ls being necessary.
* bump version to 7.2.0.
* syslog xfer time with xfer stats.
* if appropriate, syslog error message with command.

internal code stuff:
* change arguments of various functions from `char *' to `const char *'.
* define PLURAL(x) macro, which returns `' if x == 1, `s' otherwise.
  use macro appropriately
* lreply(): a code of -1 means ``send line as is''. a code of 0
  means ``send line with 4 space prefix''. don't print a space after
  the `-' for any other code.
* logcmd(): add `const struct timeval *elapsed' and `const char *error'
  for more flexible error reporting
1999-05-17 15:14:53 +00:00
explorer b2f939ac51 Make this build with KERBEROS5 defined. 1999-02-24 16:45:13 +00:00
lukem 00007d07d6 * actually commit the changes which add support for recognising RFC 2228
commands (even if we don't do anything with them)
* in logcmd(), syslog why realpath() failed (if it did).
1999-02-05 21:40:49 +00:00
lukem c984c19121 * replace LOG(CMD|BYTES) macros with logcmd(), which is a cleaner
solution with less code replication. use realpath() in logcmd() so
  that all logged filenames are sane.
* support `REST STREAM' in `FEAT' reply (from draft-ietf-ftpext-mlst-05)
* in 'HELP', suffix unimplemented commands with `-' instead of `*'; the
  former is easier to differentiate from `+'.
* deprecate curdir() now that logcmd() doesn't use it.
* ensure all filename buffers are at least MAXPATHLEN+1 in size.
* move jmp_buf errcatch out of extern.h, removing need to #include <setjmp.h>
  in every file.
1998-12-28 04:54:00 +00:00
lukem 0e5bdd5185 * complete fix for `multiple replies returned for single parse error'
problem; move `hasyyerrored' state flag out of yylex() so that
  check_{login,modify} can also set it.
* check result of check_login for PORT command
* set initial timeout before the "setjmp(); for(;;) yyparse()",
  otherwise an invalid command after login incorrectly sets the timeout
  to 5 minutes (rather than what was set in ftpd.conf)
* replace (char *)0 with NULL
* move yyerror() from ftpd.c to ftpcmd.y
* remove need for -Dunix, by using the version string from ftpd.c
  (instead of `BSD-199506')
* move all extern-ed vars into extern.h
1998-09-06 10:39:40 +00:00
tv e3ab20461f Add the ability to disable passive connects in ftpd.conf (breaks RFC1123,
STD3, but needed in some firewall environments).
1998-06-30 20:18:52 +00:00
mouse 7ccec6ac9f Show/log the strerror(errno) string when getcwd fails 1998-06-03 13:21:42 +00:00
hubertf dde092b47d Fix some problems with failed getcwd commands, reported in PR bin/5531
by Saitoh Masanobu <msaitoh@spa.is.uec.ac.jp>.
1998-06-03 09:21:45 +00:00
kleink 223dbe1123 Need <time.h> for time(), localtime() and ctime() prototypes. 1998-04-01 14:31:59 +00:00
lukem b181ccb476 log debug stuff using LOG_DEBUG not LOG_INFO 1997-11-16 12:04:21 +00:00
lukem 83955f6abd * change checkportcmd syntax to `checkportcmd class [off]' (as per `modify')
* display current setting of checkportcmd in STAT
* ensure that curclass.checkportcmd is initialised to 0
* document default setting of checkportcmd in ftpd(8)
* cleanup code a bit, putting code for "checkportcmd" in alphabetical order
1997-11-11 12:42:24 +00:00
mrg 8e2c08b183 add a "checkportcmd <class>" option that stops ftp bounce attacks. 1997-11-11 05:48:03 +00:00
mycroft 3ff72472fe Use S_IS*(), not S_IF*. 1997-10-19 18:15:23 +00:00
lukem 550665a814 implement '-c confdir', which allows the specification of an alternate
directory to look for the various configuration files, overriding /etc.
From Matthias Scheler <tron@lyssa.owl.de> in [bin/4133]
1997-09-23 13:56:39 +00:00
lukem 0bba8ce38d * don't depend upon buffer returned by fgetln() to remain. fix mainly
from Tatoku Ogaito <tacha@tera.fukui-med.ac.jp> in [bin/3967]
* fgetln() doesn't \0 terminate its string. look for the \n and replace
  it with \0 (if no \n, ignore the line - it's most likely corrupt)
* more intensive checks on strdup() returns (not a current mem leak,
  but depended upon code elsewhere to cleanup - not good)
* cleanup some syslog error messages
1997-08-14 02:06:15 +00:00
jtc a158249541 Fix files using old TNF copyright notice 1997-07-31 00:08:03 +00:00
christos c22375d4d3 missed some warnings. 1997-06-22 22:33:12 +00:00
christos 2424c4f970 - Pass gcc -Wall
- Fix incorrect const poisoning
- Fix ftpd_popen to dynamically allocate strings to avoid buffer overruns.
1997-06-18 19:05:46 +00:00
lukem 31547ec641 * implement /etc/ftpd.conf, which adds support for the following features,
controllable on a per class (which is one of: real, chroot, guest,
  all or none) basis:
    * on-the-fly execution of a command to build the file (a ``conversion''),
      providing support for "get dirname.tar" and the like.
    * displaying the contents of a file when a directory is entered
      for the first time.
    * maximum value for timeout (replaces -T).
    * control usage of CHMOD, DELE, MKD, RMD, UMASK; replacing -DINSECURE_GUEST.
    * notifying the user of the existance of a files matching a glob
      pattern when a directory is entered for the first time.
    * default value for timeout (replaces -t).
    * default umask (replaces -DGUEST_CMASK and -u).
  The conversion, display, and notify functionality was based on code by
  Simon Burge <simonb@telstra.com.au>.
* clean up and re-order parts of the man page into subsections.
* STAT displays the settings defined for the class of the current user.
* bump version from 6.00 to 7.00, because of ftpd.conf.
* deprecate -DGUEST_CMASK and -DINSECURE_GUEST in the Makefile, and
  -t, -T and -u, as ftpd.conf allows finer control of these.
* add "nostderr" argument to ftpd_popen(), because you don't want the
  stderr stream mixing with the stdout stream during a conversion,
  as this can corrupt the stream.
1997-06-14 08:43:26 +00:00