Commit Graph

222 Commits

Author SHA1 Message Date
Christian Brueffer
5efaea4cc6 Remove the 3rd clause ("advertising clause") of the BSD license as
permitted by the University of Berkeley on July 22, 1999.

Reviewed by:	imp
MFC after:	1 week
2014-02-17 22:27:32 +00:00
Christian Brueffer
03d34ccc39 In sgetpwnam(), save and free pw_class like all other char members
of struct passwd.  This fixes spurious "login_getclass: unknown class"
errors.

PR:		186439
Submitted by:	UEMURA Tetsuya <t_uemura at macome.co.jp>
MFC after:	1 week
2014-02-14 12:01:52 +00:00
Colin Percival
3e65b9c6e6 Fix a problem whereby a corrupt DNS record can cause named to crash. [11:06]
Add an API for alerting internal libc routines to the presence of
"unsafe" paths post-chroot, and use it in ftpd. [11:07]

Fix a buffer overflow in telnetd. [11:08]

Make pam_ssh ignore unpassphrased keys unless the "nullok" option is
specified. [11:09]

Add sanity checking of service names in pam_start. [11:10]

Approved by:    so (cperciva)
Approved by:    re (bz)
Security:       FreeBSD-SA-11:06.bind
Security:       FreeBSD-SA-11:07.chroot
Security:       FreeBSD-SA-11:08.telnetd
Security:       FreeBSD-SA-11:09.pam_ssh
Security:       FreeBSD-SA-11:10.pam
2011-12-23 15:00:37 +00:00
Edward Tomasz Napierala
e81b1c7129 Add LOGIN_SETCPUMASK and LOGIN_SETLOGINCLASS to the setusercontext(3)
calls in ftpd(8).
2011-06-22 19:14:49 +00:00
Ed Maste
62f390ecd9 Make format string a string literal. (Discovered by clang.)
MFC After: 1 week
2011-01-04 00:39:56 +00:00
Ed Maste
763e8c9623 Handle failure from ftpd_popen in statfilecmd().
Reviewed by:	attilio
MFC after:	1 week
2011-01-04 00:11:09 +00:00
Christian S.J. Peron
cefb678553 expand checkuser() to support the propagation of error codes back to
the caller.  Currently, checkuser() does not differentiate between the
failure to open the file and the absence of a user in the file.  Check
to see if there was an error opening the file.  If there are any errors,
terminate the connection.  Currently, the only exception to this rule
is ENOENT, since there is nothing that says the /etc/ftpuser
and /etc/ftpchroot has to exist.

MFC after:	3 weeks
2011-01-03 21:28:12 +00:00
Ed Schouten
9f37b1a2b4 Really disable wtmp logging when chrooting.
Also perform a small cleanup to ftpd_logwtmp(). Just use a NULL
parameter for the username to indicate a logout, instead of an empty
string.

Reported by:	Alexey Shuvaev <shuvaev physik uni-wuerzburg de>
2010-01-18 23:28:25 +00:00
Ed Schouten
80643af02b Port ftpd to utmpx.
Unfortunately I have to partially wreck its functionality, though. ftpd
used to keep a file descriptor to the wtmp, which allowed it to work
from within a chroot. The current utmpx implementation doesn't offer a
way to do this. Maybe we can address this in the future, if it turns out
to be a real issue.
2010-01-13 18:28:41 +00:00
David E. O'Brien
ec85f7fa39 Move variable externs into extern.h so they are checked against the definitions. 2009-04-07 20:34:34 +00:00
Colin Percival
f0b40b1c97 Prevent cross-site forgery attacks on ftpd(8) due to splitting
long commands into multiple requests. [08:12]

Avoid calling uninitialized function pointers in protocol switch
code. [08:13]

Merry Christmas everybody...

Approved by:	so (cperciva)
Approved by:	re (kensmith)
Security:	FreeBSD-SA-08:12.ftpd, FreeBSD-SA-08:13.protosw
2008-12-23 01:23:09 +00:00
Yaroslav Tykhiy
2ea4228214 Add support for RFC 2389 (FEAT) and RFC 2640 (UTF8) to ftpd(8).
The support for RFC 2640 (UTF8) is optional and rudimentary.
The server just advertises its capability to handle UTF-8 file
names and relies on its own 8-bit cleanness, as well as on
the backward compatibility of UTF-8 with ASCII.  So uploaded
files will have UTF-8 names, but the initial server contents
should be prepared in UTF-8 by hand, no on-the-fly conversion
of file names will be done.

PR:		bin/111714
Submitted by:	Zhang Weiwu <see email in the PR>
MFC after:	1 week
2007-04-18 22:43:39 +00:00
Yaroslav Tykhiy
32072720cb Let automatic TCP send buffer sizing do its job for ftpd(8): stop
setting the SO_SNDBUF socket option.  Using a hard-coded value for
it was a poor idea anyway in the face of diverse network conditions.
2007-02-09 17:18:39 +00:00
Hajimu UMEMOTO
2c9fd5f29e - Reduce needless DNS query by lookup only appropriate address
family. [1]
- Specify appropriate hints to getaddrinfo(3). [1]
- Obtain address family from peername in inet mode.

Submitted by:	Rostislav Krasny <rosti.bsd__at__gmail.com> [1]
Tested by:	yar, Rostislav Krasny <rosti.bsd__at__gmail.com>
MFC after:	1 week
2006-03-01 16:13:17 +00:00
Yaroslav Tykhiy
a599a64a9f In the daemon code, check for and report possible errors
from accept(2) and fork(2).  Also close all unneeded fds
in the child process, namely listening sockets for all
address families and the fd initially obtained from accept(2).
(The main ftpd code operates on stdin/stdout anyway as it
has been designed for running from inetd.)

MFC after:	5 days
2006-01-21 13:06:37 +00:00
Yaroslav Tykhiy
8eb0508fe1 The daemon's child shouldn't go on with the for loop
over ctl_sock's -- it is solely the parent daemon's
job.  So just break out of the loop in the child.

MFC after:	5 days
2006-01-21 12:34:28 +00:00
Yaroslav Tykhiy
125b96351a Use pidfile(3) provided by libutil to manage the deamon's pid file.
By default, create a pid file at the standard location, /var/run/ftpd.pid,
in accord with the expected behavior of a stock system daemon.

MFC after:	5 days
2006-01-21 12:21:41 +00:00
Yaroslav Tykhiy
f9036ce6dc Add some consistency checks to the signal-related code.
MFC:	along with rev. 1.202
2005-02-16 11:35:51 +00:00
Yaroslav Tykhiy
91ae77792e A call to maskurg() makes sense only when a transfer is under way,
the function will emit an annoying log message otherwise.

Reported by:	kris
MFC:		along with rev. 1.202
2005-02-16 11:22:20 +00:00
Stefan Farfeleder
78e3eed071 Fix most cases where the address of an int is passed to a function expecting a
socklen_t * argument.
2005-02-14 17:42:58 +00:00
Yaroslav Tykhiy
220223fdf4 Respect the `logging' flag.
Pointed out by:	Nick Leuta
MFC after:	3 days
2005-01-19 10:49:40 +00:00
Yaroslav Tykhiy
4cd51076c5 Improve handling SIGURG and OOB commands on the control channel.
The major change is to process STAT sent as an OOB command w/o
breaking the current data transfer.  As a side effect, this gives
better error checking in the code performing data transfers.

A lesser, but in no way cosmetic, change is using the flag `recvurg'
in the only signal-safe way that has been blessed by SUSv3.  The
other flag, `transflag,' becomes private to the SIGURG machinery,
serves debugging purposes only, and may be dropped in the future.

The `byte_count' global variable is now accounting bytes actually
transferred over the network.  This can give status messages looking
strange, like "X of Y bytes transferred," where X > Y, but that has
more sense than trying to compensate for combinations of data formats
on the server and client when transferring ASCII type data.  BTW,
getting the size of a file in advance is unreliable for a number of
reasons in the first place.  See question 18.8 of the Infrequently
Asked Questions in comp.lang.c for details.

PR:		bin/52072
Tested by:	Nick Leuta (earlier versions), a stress-testing tool (final)
MFC after:	1 month
2005-01-19 10:33:20 +00:00
Yaroslav Tykhiy
1850cfa1c5 Replace err(3) calls when in daemon mode by syslog(3), too.
A daemon has no stderr to send its complains to.

Pointed out by:	Nick Leuta
MFC after:	1 week
2005-01-10 12:19:11 +00:00
Yaroslav Tykhiy
bcd2618483 Do a small style(9) fix before I'm hacking the code itself. 2004-12-16 07:27:28 +00:00
Yaroslav Tykhiy
8efc8b18e5 free(3) is void already. 2004-12-16 07:17:56 +00:00
Yaroslav Tykhiy
6c98f40194 Never emit a message to stderr: use syslog instead.
When in inetd mode, this prevents bogus messages from
appearing on the control channel.  When running as a
daemon, we shouldn't write to the terminal we used to
have at all.

PR:		bin/74823
MFC after:	1 week
2004-12-12 17:30:28 +00:00
Yaroslav Tykhiy
ebd83647a4 When looking for a virtual host to handle the connection,
stop the search on the first match for efficiency.

Submitted by:	Nick Leuta
2004-11-22 11:10:04 +00:00
Yaroslav Tykhiy
4cbc4ad644 Calling pam_chauthtok() isn't really needed since
an FTP user has no chance to change password anyway.

Submitted by:	Nick Leuta
2004-11-22 11:02:42 +00:00
Yaroslav Tykhiy
e897216f45 Don't log the chroot dir on every command since it's constant for a session.
Log it once at the beginning of the session instead.  OTOH, log wd each
time for the sake of better auditing and consistent log format.

Proposed by:	Nick Leuta <skynick -at- mail.sc.ru>
2004-11-22 10:48:29 +00:00
Yaroslav Tykhiy
7cdd3cb70b Always log remote IP.
PR:		bin/59773
2004-11-22 10:27:16 +00:00
Yaroslav Tykhiy
04683b2c35 Treat host name buffers consistently. 2004-11-22 10:16:43 +00:00
Yaroslav Tykhiy
215a9f9de5 Make chrootdir global and use it in log messages
regarding restricted users.

MFC after:	2 weeks
2004-11-18 14:15:32 +00:00
Yaroslav Tykhiy
2b7eb1c076 Nitpicking on style(9) and whitespace.
Tested with:	md5(1)
2004-11-18 13:55:15 +00:00
Yaroslav Tykhiy
0c4b401f76 Use __FBSDID. 2004-11-18 13:46:29 +00:00
Yaroslav Tykhiy
405e2987ca Don't say, "file: permission denied," if the operation
is disabled entirely.
2004-11-18 11:50:01 +00:00
Yaroslav Tykhiy
02c9749295 Use uniform punctuation, capitalization, and language style
in server messages wherever this doesn't contradict to a particular
message format.
2004-11-18 11:45:13 +00:00
Yaroslav Tykhiy
eb5b2bb3ae Apply __printflike() to the appendf() prototype so the compiler
can detect format errors.
2004-11-18 11:32:35 +00:00
Yaroslav Tykhiy
82c03024c2 Fix perror_reply() vs. reply() usage. 2004-11-18 11:27:31 +00:00
Yaroslav Tykhiy
4a3e5acd8d '\n' needs not to appear in reply() strings. 2004-11-18 11:07:00 +00:00
Yaroslav Tykhiy
6b2dee6ba1 Log pathname arguments to ftp commands as the user specified them;
add the working directory pathname to the log message if any of
such arguments isn't absolute.  This has advantage over the old
way of logging that an admin can see what users are actually trying
to do, and where.  The old code was also not too robust when it
came to a chrooted session and an absolute pathname.

Pointed out by: Nick Leuta
MFC after:      2 weeks
2004-11-18 10:02:28 +00:00
Yaroslav Tykhiy
ac4f2391be Use S_ISDIR() macro instead of a hand-rolled test. 2004-11-18 09:26:58 +00:00
Yaroslav Tykhiy
75933089af getcwd() won't leave a error string in the buffer, unlike getwd(). 2004-11-18 00:14:09 +00:00
Yaroslav Tykhiy
de9b6c0343 Use POSIX functions instead of legacy ones:
getwd() -> getcwd()
	wait3() -> waitpid()
2004-11-17 22:43:46 +00:00
Yaroslav Tykhiy
7e295315e6 Kill more unneeded casts found.
Noticed by:	Nick Leuta <skynick -at- mail.sc.ru> (some of them)
2004-11-17 11:52:41 +00:00
Yaroslav Tykhiy
3b48b87700 Don't invent ways of capitalization orthogonal to the English grammar. 2004-11-15 12:47:44 +00:00
Yaroslav Tykhiy
41c57b487e RFC 959 states that the following codes should be used
for status replies on file system objects:

 212 Directory status.
 213 File status.

Reported by:	Oleg Koreshkov <okor -at- zone.salut.ru>
MFC after:	1 week
2004-11-15 12:41:56 +00:00
Yaroslav Tykhiy
6e4b0a55f7 Using off_t to pass a block size is obvious overkill.
The size_t type is better suited for that, particularly because
the "blksize" argument is to be passed to malloc() and read().
On 64-bit archs it's more to a style issue, but the good style
of coding in C is also important.
2004-11-13 13:42:43 +00:00
Yaroslav Tykhiy
e3765043a8 Kill ancient casts to integral types left from the K&R era.
They're unneeded and sometimes erroneous now.
2004-11-13 13:15:47 +00:00
Yaroslav Tykhiy
8c1c21f2ef Fix logxfer() by using realpath(3) instead of playing with getwd(3).
Previously logxfer() used to record bogus pathnames to the log
in some cases, namely, when cwd was / or "name" was absolute.

Noticed by:	Nick Leuta
MFC after:	2 weeks
2004-11-03 06:52:40 +00:00
Yaroslav Tykhiy
bb4641e28b Replace the last occurence of (long long) and %qd with
(intmax_t) and %jd, which is the right way to printf
an off_t in the presence of <stdint.h>.

Submitted by:	Nick Leuta
2004-11-02 18:48:44 +00:00