| Commit message (Collapse) | Author | Age | Files | Lines |
... | |
|
|
|
|
|
|
|
|
|
|
|
| |
This makes such natural commands as "MKD ~user/newdir" or "STOR ~/newfile"
do what they are supposed to instead of failing miserably with the
"File not found" error.
This involves a bit of code reorganization. Namely, the code doing
glob(3) expansion has been separated to a function; a new function
has been introduced to do tilde expansion; the latter function is
invoked on a pathname before the former one. Thus behaviour mimicing
that of the Bourne shell has been achieved.
|
|
|
|
|
| |
so return reply code 553 to indicate a error from open(2) for consistency,
as long as the code is used in the rest of the STOR/STOU handler.
|
|
|
|
|
|
|
|
|
|
| |
if allowed by their filesystem permissions.
This doesn't break anything since using sendfile(2)
is triggered later by a separate S_ISREG conditional.
PR: bin/20824
MFC after: 1 week
|
|
|
|
|
|
|
| |
distinguish between the cases of an existing file and
a real system error, such as I/O failure, no access etc.
MFC after: 3 days
|
|
|
|
|
|
|
|
| |
host-specific information in FTP server messages (so paranoid
admins can sleep at night :-)
PR: bin/16705
MFC after: 1 week
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
separating its part around chroot(2) from that around initial
chdir(2). This makes the below changes really easy.
Move seteuid(to user's uid) to before calling chdir(2). There are
two goals to achieve by that. First, NFS mounted home directories
with restrictive permissions become accessible (local superuser
can't access them if not mapped to uid 0 on the remote side
explicitly.) Second, all the permissions to the home directory
pathname components become effective; previously a user could be
carried to any local directory despite its permissions since the
chdir(2) was done with euid 0. This reduces possible impact from
FTP server misconfiguration, e.g., assigning a wrong home directory
to a user.
Implement the "/./" feature. Now a guest or user subject to chrooting
may have "/./" in his login directory, which separates his chroot
directory from his home directory inside the chrooted environment.
This works for ftpchroot(5) as well.
PR: bin/17843 bin/23944
|
|
|
|
| |
instead of just using the rest of the line behind the first field.
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
directory can be specified for a user or a group.
Add the manpage ftpchroot(5) since the file's format has grown
complex enough.
PR: bin/45327
Portions submitted by: Hideki SAKAMOTO <sakamoto@hlla.is.tsukuba.ac.jp>
MFC after: 1 week
|
| |
|
|
|
|
|
|
|
|
|
| |
to listen at in daemon mode.
- Use the port by 1 less than the control port as the default
data port instead of always using hard-coded port 20.
Submitted by: roam
MFC after: 1 week
|
|
|
|
|
|
|
|
| |
to a pathname that contains '\r' or '\n'.
Together with the earlier STAT bugfix, this must solve
the problem of such pathnames appearing in the FTP control
stream.
|
|
|
|
|
|
|
|
|
|
|
|
| |
up port 20 for an extended period of time and thus lock out all other
users from establishing PORT data connections. Don't hold on to the
bind() while we loop around waiting to see if we can make our
connection.
Being a DoS, it has security implications, giving it a short MFC
time.
MFC after: 1 day
|
|
|
|
|
|
|
|
|
|
| |
in the output to the "STAT file" request.
This closes one discrepancy with RFC 959 (page 36.)
See also http://www.kb.cert.org/vuls/id/328867
Obtained from: OpenBSD
|
|
|
|
|
| |
with the _PATH_LS macro to be consistent
with the rest of the ftpd(8) source.
|
| |
|
|
|
|
|
|
|
|
|
| |
Properly sort options, spell "file system" correctly, expand contraction.
Catch up to the src/etc/syslog.conf,v 1.23 change: ftpd(8) session logs
are now by default get logged to /var/log/xferlog.
Approved by: re
|
|
|
|
| |
to be non-fatal due to stack alignment roundups.
|
|
|
|
|
|
|
|
|
| |
memory area would arise. Only an addrinfo list from an earlier
call to getaddrinfo() should be freed there because it will be
substituted by the current list referenced by "res".
Reported by: John Long <fbsd1@pruam.com>
MFC after: 5 days
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
MAC labels are set if MAC is enabled and configured for the user
logging in.
Note that lukemftpd is not considered a supported application when
MAC is enabled, as it does not use the standard system interfaces for
managing user contexts; if lukemftpd is used with labeled MAC policies,
it will not properly give up privileges when switching to the user
account.
Approved by: re
Obtained from: TrustedBSD Project
Sponsored by: DARPA, Network Associates Laboratories
|
|
|
|
|
|
|
|
|
|
|
| |
than the LOMAC-specific interfaces for listing MAC labels. This permits
ls to view MAC labels in a manner similar to getfmac, when ls is used
with the -l argument. Next generation LOMAC will use the MAC Framework
so should "just" work with this and other policies. Not the prettiest
code in the world, but then, neither is ls(1).
Obtained from: TrustedBSD Project
Sponsored by: DARPA, Network Associates Laboratories
|
| |
|
| |
|
|
|
|
|
| |
Submitted by: maxim
MFC after: 5 days
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
o Don't free(3) memory occupied by host structures
already in the host list.
o Set hrp->hostinfo to NULL if a host record has to stay in
the host list, but is to be ignored. Selecthost() knows that.
o Reduce the pollution with excessive NULL checks.
o Close a couple of memory leaks.
MFC after: 1 week
|
|
|
|
|
| |
Submitted by: kris
MFC after: 3 days
|
|
|
|
|
| |
Submitted by: maxim
MFC after: 1 week
|
|
|
|
|
|
|
|
|
| |
o check getaddrinfo(3) return value, not result pointer
o getaddrinfo(3) returns int, not pointer
o don't leak memory allocated for hostnames and hostinfo structures
o initialize pointers that will be checked for NULL somewhere
MFC after: 1 week
|
|
|
|
| |
MFC after: 3 days
|
|
|
|
|
|
|
|
| |
o PORT takes six byte values, not five.
o TYPE argument is mandatory.
Submitted by: demon (the 1st part)
MFC after: 3 days
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
o Remove the race between stat(2) & fopen(3) when creating
a unique file.
o Improve bound checking when generating a unique name from
a given pathname.
o Ignore REST marker on APPE. No RFC specifies this case,
but the idea of resuming APPE's implies this.
o By default, deny upload resumes and appends by anonymous users.
Previously these commands were translated to STOU silently,
which led to broken files on server without any notification
to the user.
o Add an option, -m, to allow anonymous users to modify
existing files (e.g., to resume uploads) if filesystem
permissions permit.
Portions obrainded from: OpenBSD
MFC after: 3 weeks
|
|
|
|
|
|
|
|
| |
2) Remove unneeded "if not NULL" props from "pathstring",
which will never be NULL by the lexer design.
Inspired by: OpenBSD
MFC after: 1 week
|
|
|
|
|
|
|
|
| |
glob(3) will return at least one pathname unless
a system error has occured. It's not a "not found"
error otherwise.
MFC after: 3 days
|
|
|
|
|
|
|
|
| |
for NULL. The "pathname" rule may return NULL
on a glob(3) error.
Obtained from: OpenBSD
MFC after: 1 week
|
|
|
|
|
|
|
|
|
| |
Earlier, a decimal number (e.g., 890) could be passed
for mode, leading to dangerous permissions set:
-1, that is, 07777.
Obtained from: OpenBSD
MFC after: 1 week
|
|
|
|
|
|
| |
requests against large files will be denied.
MFC after: 10 days
|
|
|
|
|
|
|
|
| |
This eliminates an opportunity for DoS attack.
Pointed out by: maxim
Inspired by: lukemftpd, OpenBSD
MFC after: 2 weeks
|
|
|
|
|
|
| |
to a successful MKD command.
MFC after: 1 week
|
|
|
|
|
|
|
| |
(as it was intended initially)
and document it in the manpage.
MFC after: 2 weeks
|
|
|
|
|
|
| |
(which has been there at least since 4.4BSD-Lite!)
MFC after: 2 weeks
|
|
|
|
|
|
|
| |
alphabetical order, lower and upper case of the same letter
stick together, lower case first.
MFC after: 2 weeks
|
|
|
|
|
|
|
| |
non-portable constants (in this case, hidden as offsets
to the "?AEIL" string.)
MFC after: 1 week
|
|
|
|
|
|
|
|
|
| |
socket option to avoid exausting the passive port
space by TIME_WAIT'ing connections.
PR: bin/36955
Submitted by: Maxim Konovalov <maxim@FreeBSD.org>
MFC after: 2 weeks
|
|
|
|
|
|
|
|
|
| |
write(2), and getipnodebyaddr(3) calls. Now all the above functions
accept "void *" in that arguments and have prototypes. Thus, the
casts are useless under the normal circumstances (and would be harmful
if the functions had no prototypes.)
MFC after: 2 weeks
|
|
|
|
|
|
|
|
|
| |
o Always check a setsockopt(2) return value
o Use a consistent message format
o Don't abort if the failed setsockopt(2) was actually not vital
o Use LOG_WARNING, not LOG_ERR, in non-fatal cases
MFC after: 1 week
|
|
|
|
| |
MFC after: 1 week
|
|
|
|
|
|
|
|
| |
Double double-quotes in a PWD result
if they appear in the directory pathname.
PR: misc/18365
MFC after: 1 week
|
|
|
|
|
|
|
|
| |
deleting symlinks pointing to directories.
PR: bin/37250
Submitted by: Nino Dehne <TeCeEm@gmx.de>
MFC after: 1 week
|
|
|
|
| |
MFC after: 1 week
|