开源软件构建与测试

_service:tar_scm:vsftpd.spec Changed

@@ -1,8 +1,8 @@
 %define generator_dir %{_prefix}/lib/systemd/system-generators
 
 Name:          vsftpd
-Version:       3.0.3
-Release:       33
+Version:       3.0.5
+Release:       1
 Summary:       It is a secure FTP server for Unix-like systems
 # OpenSSL link exception
 License:       GPLv2 with exceptions
@@ -53,7 +53,6 @@
 Patch30:       0030-Fix-logging-into-syslog-when-enabled-in-config.patch
 Patch31:       0031-Fix-question-mark-wildcard-withing-a-file-name.patch
 Patch32:       0032-Propagate-errors-from-nfs-with-quota-to-client.patch
-Patch33:       0033-Introduce-TLSv1.1-and-TLSv1.2-options.patch
 Patch34:       0034-Turn-off-seccomp-sandbox-because-it-is-too-strict.patch
 Patch35:       0035-Modify-DH-enablement-patch-to-build-with-OpenSSL-1.1.patch
 Patch36:       0036-Redefine-VSFTP_COMMAND_FD-to-1.patch
@@ -62,8 +61,6 @@
 Patch39:       0039-Improve-documentation-of-ASCII-mode-in-the-man-page.patch
 Patch40:       0040-Use-system-wide-crypto-policy.patch
 Patch41:       0041-Document-the-new-default-for-ssl_ciphers-in-the-man-.patch
-Patch42:       0042-When-handling-FEAT-command-check-ssl_tlsv1_1-and-ssl.patch
-Patch43:       0043-Enable-only-TLSv1.2-by-default.patch
 Patch44:       0044-Disable-anonymous_enable-in-default-config-file.patch
 Patch45:       0045-Expand-explanation-of-ascii_-options-behaviour-in-ma.patch
 Patch46:       0046-vsftpd.conf-Refer-to-the-man-page-regarding-the-asci.patch
@@ -89,6 +86,7 @@
 Patch68:       0002-Drop-an-unused-global-variable.patch
 Patch69:       0001-Remove-a-hint-about-the-ftp_home_dir-SELinux-boolean.patch
 Patch70:       fix-str_open.patch
+Patch71:       vsftpd-3.0.5-enable_wc_logs-replace_unprintable_with_hex.patch
 
 Patch9000:     bugfix-change-the-default-value-of-tunable_reverse_lookup_e.patch
 
@@ -107,7 +105,7 @@
 %autosetup -p1
 
 %build
-make CFLAGS="$RPM_OPT_FLAGS -fpie -pipe -Wextra" LINK="-pie -lssl" %{?_smp_mflags}
+make CFLAGS="$RPM_OPT_FLAGS -fpie -pipe -Wextra" LINK="-pie -lssl $RPM_LD_FLAGS" %{?_smp_mflags}
 
 %install
 install -d %{buildroot}{%{_unitdir},%{generator_dir},%{_var}/ftp/pub}
@@ -155,6 +153,12 @@
 %{_mandir}/man8/vsftpd.*
 
 %changelog
+* Thu Nov 17 2022 zhouyihang <zhouyihang3@h-partners.com> - 3.0.5-1
+- Type:requirement
+- ID:NA
+- SUG:NA
+- DESC:update vsftpd to 3.0.5
+
 * Tue Jan 26 2021 orange-snn <songnannan2@huawei.com> - 3.0.3-33
 - remove Werror in build flags to fix building error.

_service:tar_scm:0021-Introduce-support-for-DHE-based-cipher-suites.patch Changed

@@ -41,9 +41,9 @@
    BIO* p_bio, int oper, const char* p_arg, int argi, long argl, long retval);
  static int ssl_verify_callback(int verify_ok, X509_STORE_CTX* p_ctx);
 +static DH *ssl_tmp_dh_callback(SSL *ssl, int is_export, int keylength);
- static int ssl_cert_digest(
-   SSL* p_ssl, struct vsf_session* p_sess, struct mystr* p_str);
- static void maybe_log_shutdown_state(struct vsf_session* p_sess);
+ static int ssl_alpn_callback(SSL* p_ssl,
+                              const unsigned char** p_out,
+                              unsigned char* outlen,
 @@ -51,6 +54,60 @@ static int ssl_read_common(struct vsf_session* p_sess,
  static int ssl_inited;
  static struct mystr debug_str;
@@ -147,11 +147,11 @@
 +    
 +    SSL_CTX_set_tmp_dh_callback(p_ctx, ssl_tmp_dh_callback);
 +
-     p_sess->p_ssl_ctx = p_ctx;
-     ssl_inited = 1;
-   }
+     /* Set up ALPN to check for FTP protocol intention of client. */
+     SSL_CTX_set_alpn_select_cb(p_ctx, ssl_alpn_callback, p_sess);
+     /* Set up SNI callback for an optional hostname check. */
 @@ -702,6 +781,18 @@ ssl_verify_callback(int verify_ok, X509_STORE_CTX* p_ctx)
-   return 1;
+   }
  }
  
 +#define UNUSED(x) ( (void)(x) )

_service:tar_scm:0022-Introduce-support-for-EDDHE-based-cipher-suites.patch Changed

_service:tar_scm:0025-Improve-local_max_rate-option.patch Changed

_service:tar_scm:0033-Introduce-TLSv1.1-and-TLSv1.2-options.patch Deleted

@@ -1,153 +0,0 @@
-From 01bef55a1987700af3d43cdc5f5be88d3843ab85 Mon Sep 17 00:00:00 2001
-From: Martin Sehnoutka <msehnout@redhat.com>
-Date: Thu, 17 Nov 2016 13:36:17 +0100
-Subject: PATCH 33/59 Introduce TLSv1.1 and TLSv1.2 options.
-
-Users can now enable a specific version of TLS protocol.
----
- parseconf.c   |  2 ++
- ssl.c         |  8 ++++++++
- tunables.c    |  9 +++++++--
- tunables.h    |  2 ++
- vsftpd.conf.5 | 24 ++++++++++++++++++++----
- 5 files changed, 39 insertions(+), 6 deletions(-)
-
-diff --git a/parseconf.c b/parseconf.c
-index a2c715b..33a1349 100644
---- a/parseconf.c
-+++ b/parseconf.c
-@@ -85,6 +85,8 @@ parseconf_bool_array =
-   { "ssl_sslv2", &tunable_sslv2 },
-   { "ssl_sslv3", &tunable_sslv3 },
-   { "ssl_tlsv1", &tunable_tlsv1 },
-+  { "ssl_tlsv1_1", &tunable_tlsv1_1 },
-+  { "ssl_tlsv1_2", &tunable_tlsv1_2 },
-   { "tilde_user_enable", &tunable_tilde_user_enable },
-   { "force_anon_logins_ssl", &tunable_force_anon_logins_ssl },
-   { "force_anon_data_ssl", &tunable_force_anon_data_ssl },
-diff --git a/ssl.c b/ssl.c
-index 96bf8ad..ba8a613 100644
---- a/ssl.c
-+++ b/ssl.c
-@@ -135,6 +135,14 @@ ssl_init(struct vsf_session* p_sess)
-     {
-       options |= SSL_OP_NO_TLSv1;
-     }
-+    if (!tunable_tlsv1_1)
-+    {
-+      options |= SSL_OP_NO_TLSv1_1;
-+    }
-+    if (!tunable_tlsv1_2)
-+    {
-+      options |= SSL_OP_NO_TLSv1_2;
-+    }
-     SSL_CTX_set_options(p_ctx, options);
-     if (tunable_rsa_cert_file)
-     {
-diff --git a/tunables.c b/tunables.c
-index 93f85b1..78f2bcd 100644
---- a/tunables.c
-+++ b/tunables.c
-@@ -66,6 +66,8 @@ int tunable_force_local_data_ssl;
- int tunable_sslv2;
- int tunable_sslv3;
- int tunable_tlsv1;
-+int tunable_tlsv1_1;
-+int tunable_tlsv1_2;
- int tunable_tilde_user_enable;
- int tunable_force_anon_logins_ssl;
- int tunable_force_anon_data_ssl;
-@@ -209,7 +211,10 @@ tunables_load_defaults()
-   tunable_force_local_data_ssl = 1;
-   tunable_sslv2 = 0;
-   tunable_sslv3 = 0;
-+  /* TLSv1 up to TLSv1.2 is enabled by default */
-   tunable_tlsv1 = 1;
-+  tunable_tlsv1_1 = 1;
-+  tunable_tlsv1_2 = 1;
-   tunable_tilde_user_enable = 0;
-   tunable_force_anon_logins_ssl = 0;
-   tunable_force_anon_data_ssl = 0;
-@@ -292,8 +297,8 @@ tunables_load_defaults()
-   install_str_setting(0, &tunable_dsa_cert_file);
-   install_str_setting(0, &tunable_dh_param_file);
-   install_str_setting(0, &tunable_ecdh_param_file);
--  install_str_setting("AES128-SHA:DES-CBC3-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA",
--                      &tunable_ssl_ciphers);
-+  install_str_setting("AES128-SHA:DES-CBC3-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384",
-+          &tunable_ssl_ciphers);
-   install_str_setting(0, &tunable_rsa_private_key_file);
-   install_str_setting(0, &tunable_dsa_private_key_file);
-   install_str_setting(0, &tunable_ca_certs_file);
-diff --git a/tunables.h b/tunables.h
-index 3e2d40c..a466427 100644
---- a/tunables.h
-+++ b/tunables.h
-@@ -67,6 +67,8 @@ extern int tunable_force_local_data_ssl;      /* Require local data uses SSL */
- extern int tunable_sslv2;                     /* Allow SSLv2 */
- extern int tunable_sslv3;                     /* Allow SSLv3 */
- extern int tunable_tlsv1;                     /* Allow TLSv1 */
-+extern int tunable_tlsv1_1;                   /* Allow TLSv1.1 */
-+extern int tunable_tlsv1_2;                   /* Allow TLSv1.2 */
- extern int tunable_tilde_user_enable;         /* Support e.g. ~chris */
- extern int tunable_force_anon_logins_ssl;     /* Require anon logins use SSL */
- extern int tunable_force_anon_data_ssl;       /* Require anon data uses SSL */
-diff --git a/vsftpd.conf.5 b/vsftpd.conf.5
-index cf1ae34..a3d569e 100644
---- a/vsftpd.conf.5
-+++ b/vsftpd.conf.5
-@@ -506,7 +506,7 @@ Default: YES
- Only applies if
- .BR ssl_enable
- is activated. If enabled, this option will permit SSL v2 protocol connections.
--TLS v1 connections are preferred.
-+TLS v1.2 connections are preferred.
- 
- Default: NO
- .TP
-@@ -514,7 +514,7 @@ Default: NO
- Only applies if
- .BR ssl_enable
- is activated. If enabled, this option will permit SSL v3 protocol connections.
--TLS v1 connections are preferred.
-+TLS v1.2 connections are preferred.
- 
- Default: NO
- .TP
-@@ -522,7 +522,23 @@ Default: NO
- Only applies if
- .BR ssl_enable
- is activated. If enabled, this option will permit TLS v1 protocol connections.
--TLS v1 connections are preferred.
-+TLS v1.2 connections are preferred.
-+
-+Default: YES
-+.TP
-+.B ssl_tlsv1_1
-+Only applies if
-+.BR ssl_enable
-+is activated. If enabled, this option will permit TLS v1.1 protocol connections.
-+TLS v1.2 connections are preferred.
-+
-+Default: YES
-+.TP
-+.B ssl_tlsv1_2
-+Only applies if
-+.BR ssl_enable
-+is activated. If enabled, this option will permit TLS v1.2 protocol connections.
-+TLS v1.2 connections are preferred.
- 
- Default: YES
- .TP
-@@ -1044,7 +1060,7 @@ man page for further details. Note that restricting ciphers can be a useful
- security precaution as it prevents malicious remote parties forcing a cipher
- which they have found problems with.
- 
--Default: DES-CBC3-SHA
-+Default: AES128-SHA:DES-CBC3-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384
- .TP
- .B user_config_dir
- This powerful option allows the override of any config option specified in
--- 
-2.14.4
-

_service:tar_scm:0040-Use-system-wide-crypto-policy.patch Changed

_service:tar_scm:0041-Document-the-new-default-for-ssl_ciphers-in-the-man-.patch Changed

_service:tar_scm:0042-When-handling-FEAT-command-check-ssl_tlsv1_1-and-ssl.patch Deleted

_service:tar_scm:0043-Enable-only-TLSv1.2-by-default.patch Deleted

@@ -1,53 +0,0 @@
-From 75c942c77aa575143c5b75637e64a925ad12641a Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ond=C5=99ej=20Lyson=C4=9Bk?= <olysonek@redhat.com>
-Date: Thu, 21 Dec 2017 16:38:40 +0100
-Subject: PATCH 43/59 Enable only TLSv1.2 by default
-
-Disable TLSv1 and TLSv1.1 - enable only TLSv1.2 by default.
----
- tunables.c    | 6 +++---
- vsftpd.conf.5 | 4 ++--
- 2 files changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/tunables.c b/tunables.c
-index 354251c..9680528 100644
---- a/tunables.c
-+++ b/tunables.c
-@@ -211,9 +211,9 @@ tunables_load_defaults()
-   tunable_force_local_data_ssl = 1;
-   tunable_sslv2 = 0;
-   tunable_sslv3 = 0;
--  /* TLSv1 up to TLSv1.2 is enabled by default */
--  tunable_tlsv1 = 1;
--  tunable_tlsv1_1 = 1;
-+  tunable_tlsv1 = 0;
-+  tunable_tlsv1_1 = 0;
-+  /* Only TLSv1.2 is enabled by default */
-   tunable_tlsv1_2 = 1;
-   tunable_tilde_user_enable = 0;
-   tunable_force_anon_logins_ssl = 0;
-diff --git a/vsftpd.conf.5 b/vsftpd.conf.5
-index 2a7662e..df14027 100644
---- a/vsftpd.conf.5
-+++ b/vsftpd.conf.5
-@@ -539,7 +539,7 @@ Only applies if
- is activated. If enabled, this option will permit TLS v1 protocol connections.
- TLS v1.2 connections are preferred.
- 
--Default: YES
-+Default: NO
- .TP
- .B ssl_tlsv1_1
- Only applies if
-@@ -547,7 +547,7 @@ Only applies if
- is activated. If enabled, this option will permit TLS v1.1 protocol connections.
- TLS v1.2 connections are preferred.
- 
--Default: YES
-+Default: NO
- .TP
- .B ssl_tlsv1_2
- Only applies if
--- 
-2.14.4
-

_service:tar_scm:fix-str_open.patch Changed

_service:tar_scm:vsftpd-3.0.5-enable_wc_logs-replace_unprintable_with_hex.patch Added

@@ -0,0 +1,215 @@
+diff --git a/logging.c b/logging.c
+index 9e86808..613ff4b 100644
+--- a/logging.c
++++ b/logging.c
+@@ -171,7 +171,14 @@ vsf_log_do_log_to_file(int fd, struct mystr* p_str)
+       return;
+     }
+   }
+-  str_replace_unprintable(p_str, '?');
++  if (tunable_wc_logs_enable)
++  {
++    str_replace_unprintable_with_hex_wc(p_str);
++  }
++  else
++  {
++    str_replace_unprintable_with_hex(p_str);
++  }
+   str_append_char(p_str, '\n');
+   /* Ignore write failure; maybe the disk filled etc. */
+   (void) str_write_loop(p_str, fd);
+diff --git a/parseconf.c b/parseconf.c
+index 3cfe7da..3729818 100644
+--- a/parseconf.c
++++ b/parseconf.c
+@@ -113,6 +113,7 @@ parseconf_bool_array =
+   { "allow_writeable_chroot", &tunable_allow_writeable_chroot },
+   { "better_stou", &tunable_better_stou },
+   { "log_die", &tunable_log_die },
++  { "wc_logs_enable", &tunable_wc_logs_enable },
+   { 0, 0 }
+ };
+ 
+diff --git a/str.c b/str.c
+index 82b8ae4..c03e7d8 100644
+--- a/str.c
++++ b/str.c
+@@ -20,6 +20,11 @@
+ #include "utility.h"
+ #include "sysutil.h"
+ 
++#include <stdio.h>
++#include <string.h>
++#include <wchar.h>
++#include <wctype.h>
++
+ /* File local functions */
+ static void str_split_text_common(struct mystr* p_src, struct mystr* p_rhs,
+                                   const char* p_text, int is_reverse);
+@@ -723,6 +728,102 @@ str_replace_unprintable(struct mystr* p_str, char new_char)
+   }
+ }
+ 
++void
++str_replace_unprintable_with_hex(struct mystr* p_str)
++{
++  unsigned int ups_size = sizeof(unsigned int) * (p_str->len);
++  if (ups_size < p_str->len)
++  {
++    str_replace_unprintable(p_str, '?');
++    str_append_text(p_str, ": BUG: string is too long");
++    bug(p_str->p_buf);
++  }
++  unsigned int* ups = vsf_sysutil_malloc(ups_size);
++  unsigned int up_count = 0;
++  for (unsigned int i=0; i < p_str->len; i++)
++  {
++    if (!vsf_sysutil_isprint(p_str->p_bufi))
++    {
++      upsup_count++ = i;
++    }
++  }
++  str_replace_positions_with_hex(p_str, ups, up_count);
++  vsf_sysutil_free(ups);
++}
++
++void str_replace_unprintable_with_hex_wc(struct mystr* p_str)
++{
++  unsigned int ups_size = sizeof(unsigned int) * (p_str->len);
++  if (ups_size < p_str->len)
++  {
++    str_replace_unprintable(p_str, '?');
++    str_append_text(p_str, ": BUG: string is too long");
++    bug(p_str->p_buf);
++  }
++  unsigned int* ups = vsf_sysutil_malloc(ups_size);
++  unsigned int up_count = 0;
++
++  size_t current = 0;
++  wchar_t pwc;
++  mbstate_t ps;
++  memset(&ps, 0, sizeof(ps));
++  ssize_t len = 0;
++  while ((len = mbrtowc(&pwc, p_str->p_buf, p_str->len - current, &ps)) > 0)
++  {
++    if (!iswprint(pwc))
++    {
++      for (int i = 0; i < len; i++)
++      {
++        upsup_count++ = current++;
++      }
++    }
++    else
++    {
++      current += len;
++    }
++  }
++  if (len < 0)
++  {
++    while (current < p_str->len)
++    {
++      upsup_count++ = current++;
++    }
++  }
++  str_replace_positions_with_hex(p_str, ups, up_count);
++  vsf_sysutil_free(ups);
++}
++
++void
++str_replace_positions_with_hex(struct mystr* p_str, const unsigned int* poss, const unsigned int pos_count)
++{
++  if (pos_count == 0)
++    return;
++
++  struct mystr tmp_str = INIT_MYSTR;
++  str_reserve(&tmp_str, p_str->len + 3 * pos_count);
++  unsigned int current = 0;
++
++  for (unsigned int i=0; i < pos_count; i++)
++  {
++    unsigned int pos = possi;
++
++    if (current < pos)
++      private_str_append_memchunk(&tmp_str, p_str->p_buf + current, pos - current);
++
++    char hex_buf5;
++    memset(hex_buf, 0, sizeof(hex_buf));
++    sprintf(hex_buf, "\\x%02X", (unsigned char) p_str->p_bufpos);
++    str_append_text(&tmp_str, hex_buf);
++    current = pos + 1;
++  }
++
++  if (current < p_str->len)
++    private_str_append_memchunk(&tmp_str, p_str->p_buf + current, p_str->len - current);
++
++  str_copy(p_str, &tmp_str);
++  str_free(&tmp_str);
++}
++
+ void
+ str_basename (struct mystr* d_str, const struct mystr* path)
+ {
+diff --git a/str.h b/str.h
+index 44270da..95a83b5 100644
+--- a/str.h
++++ b/str.h
+@@ -98,6 +98,10 @@ int str_contains_space(const struct mystr* p_str);
+ int str_all_space(const struct mystr* p_str);
+ int str_contains_unprintable(const struct mystr* p_str);
+ void str_replace_unprintable(struct mystr* p_str, char new_char);
++void str_replace_unprintable_with_hex(struct mystr* p_str);
++void str_replace_unprintable_with_hex_wc(struct mystr* p_str);
++void str_replace_positions_with_hex(struct mystr* p_str, const unsigned int* poss,
++                                    const unsigned int pos_count);
+ int str_atoi(const struct mystr* p_str);
+ filesize_t str_a_to_filesize_t(const struct mystr* p_str);
+ unsigned int str_octal_to_uint(const struct mystr* p_str);
+diff --git a/tunables.c b/tunables.c
+index a7ce9c8..c96c1ac 100644
+--- a/tunables.c
++++ b/tunables.c
+@@ -94,6 +94,7 @@ int tunable_seccomp_sandbox;
+ int tunable_allow_writeable_chroot;
+ int tunable_better_stou;
+ int tunable_log_die;
++int tunable_wc_logs_enable;
+ 
+ unsigned int tunable_accept_timeout;
+ unsigned int tunable_connect_timeout;
+@@ -244,6 +245,7 @@ tunables_load_defaults()
+   tunable_allow_writeable_chroot = 0;
+   tunable_better_stou = 0;
+   tunable_log_die = 0;
++  tunable_wc_logs_enable = 0;
+ 
+   tunable_accept_timeout = 60;
+   tunable_connect_timeout = 60;
+diff --git a/tunables.h b/tunables.h
+index 029d645..8d50150 100644
+--- a/tunables.h
++++ b/tunables.h
+@@ -98,6 +98,7 @@ extern int tunable_better_stou;               /* Use better file name generation
+ 					       */
+ extern int tunable_log_die;                   /* Log calls to die(), die2()
+                                                * and bug() */
++extern int tunable_wc_logs_enable;            /* Allow non ASCII characters in logs */
+ 
+ /* Integer/numeric defines */
+ extern unsigned int tunable_accept_timeout;
+diff --git a/vsftpd.conf.5 b/vsftpd.conf.5
+index ce3fba3..815773f 100644
+--- a/vsftpd.conf.5
++++ b/vsftpd.conf.5
+@@ -735,6 +735,12 @@ If enabled, use CLONE_NEWPID and CLONE_NEWIPC to isolate processes to their
+ ipc and pid namespaces. So separated processes can not interact with each other.
+ 
+ Default: YES
++.TP
++.B wc_logs_enable
++If enabled, logs will be treated as wide-character strings and not just
++ASCII strings when filtering out non-printable characters.
++
++Default: NO
+ 
+ .SH NUMERIC OPTIONS
+ Below is a list of numeric options. A numeric option must be set to a non

_service Changed

_service:tar_scm:vsftpd-3.0.3.tar.gz/Changelog -> _service:tar_scm:vsftpd-3.0.5.tar.gz/Changelog Changed

_service:tar_scm:vsftpd-3.0.3.tar.gz/README -> _service:tar_scm:vsftpd-3.0.5.tar.gz/README Changed

_service:tar_scm:vsftpd-3.0.3.tar.gz/main.c -> _service:tar_scm:vsftpd-3.0.5.tar.gz/main.c Changed

_service:tar_scm:vsftpd-3.0.3.tar.gz/parseconf.c -> _service:tar_scm:vsftpd-3.0.5.tar.gz/parseconf.c Changed

_service:tar_scm:vsftpd-3.0.3.tar.gz/prelogin.c -> _service:tar_scm:vsftpd-3.0.5.tar.gz/prelogin.c Changed

_service:tar_scm:vsftpd-3.0.3.tar.gz/seccompsandbox.c -> _service:tar_scm:vsftpd-3.0.5.tar.gz/seccompsandbox.c Changed

@@ -45,6 +45,15 @@
 #ifndef __NR_openat
   #define __NR_openat 257
 #endif
+#ifndef __NR_newfstatat
+  #define __NR_newfstatat 262
+#endif
+#ifndef __NR_pselect6
+  #define __NR_pselect6 270
+#endif
+#ifndef __NR_getrandom
+  #define __NR_getrandom 318
+#endif
 
 #ifndef O_LARGEFILE
   #define O_LARGEFILE 00100000
@@ -267,6 +276,7 @@
                        3, IPPROTO_TCP);
   allow_nr(__NR_bind);
   allow_nr(__NR_select);
+  allow_nr(__NR_pselect6);
   if (tunable_port_enable)
   {
     allow_nr(__NR_connect);
@@ -350,6 +360,8 @@
     /* For file locking. */
     allow_nr_1_arg_match(__NR_fcntl, 2, F_SETLKW);
     allow_nr_1_arg_match(__NR_fcntl, 2, F_SETLK);
+    /* Newer kernel / glibc hit this. */
+    allow_nr(__NR_getrandom);
   }
   if (tunable_ssl_enable)
   {
@@ -396,6 +408,7 @@
   allow_nr_2_arg_match(__NR_setsockopt, 2, SOL_SOCKET, 3, SO_LINGER);
   allow_nr_2_arg_match(__NR_setsockopt, 2, IPPROTO_IP, 3, IP_TOS);
   allow_nr(__NR_fstat);
+  allow_nr(__NR_newfstatat);
   allow_nr(__NR_lseek);
   /* Since we use chroot() to restrict filesystem access, we can just blanket
    * allow open().
@@ -409,8 +422,10 @@
   allow_nr(__NR_getcwd);
   allow_nr(__NR_chdir);
   allow_nr(__NR_getdents);
+  allow_nr(__NR_getdents64);
   /* Misc */
   allow_nr(__NR_umask);
+  reject_nr(__NR_sysinfo, EPERM);
 
   /* Config-dependent items follow. */
   if (tunable_use_sendfile)

_service:tar_scm:vsftpd-3.0.3.tar.gz/session.h -> _service:tar_scm:vsftpd-3.0.5.tar.gz/session.h Changed

_service:tar_scm:vsftpd-3.0.3.tar.gz/ssl.c -> _service:tar_scm:vsftpd-3.0.5.tar.gz/ssl.c Changed

@@ -38,6 +38,13 @@
 static long bio_callback(
   BIO* p_bio, int oper, const char* p_arg, int argi, long argl, long retval);
 static int ssl_verify_callback(int verify_ok, X509_STORE_CTX* p_ctx);
+static int ssl_alpn_callback(SSL* p_ssl,
+                             const unsigned char** p_out,
+                             unsigned char* outlen,
+                             const unsigned char* p_in,
+                             unsigned int inlen,
+                             void* p_arg);
+static long ssl_sni_callback(SSL* p_ssl, int* p_al, void* p_arg);
 static int ssl_cert_digest(
   SSL* p_ssl, struct vsf_session* p_sess, struct mystr* p_str);
 static void maybe_log_shutdown_state(struct vsf_session* p_sess);
@@ -78,6 +85,18 @@
     {
       options |= SSL_OP_NO_TLSv1;
     }
+    if (!tunable_tlsv1_1)
+    {
+      options |= SSL_OP_NO_TLSv1_1;
+    }
+    if (!tunable_tlsv1_2)
+    {
+      options |= SSL_OP_NO_TLSv1_2;
+    }
+    if (!tunable_tlsv1_3)
+    {
+      options |= SSL_OP_NO_TLSv1_3;
+    }
     SSL_CTX_set_options(p_ctx, options);
     if (tunable_rsa_cert_file)
     {
@@ -165,6 +184,12 @@
       /* Ensure cached session doesn't expire */
       SSL_CTX_set_timeout(p_ctx, INT_MAX);
     }
+    /* Set up ALPN to check for FTP protocol intention of client. */
+    SSL_CTX_set_alpn_select_cb(p_ctx, ssl_alpn_callback, p_sess);
+    /* Set up SNI callback for an optional hostname check. */
+    SSL_CTX_set_tlsext_servername_callback(p_ctx, ssl_sni_callback);
+    SSL_CTX_set_tlsext_servername_arg(p_ctx, p_sess);
+
     p_sess->p_ssl_ctx = p_ctx;
     ssl_inited = 1;
   }
@@ -702,6 +727,133 @@
   return 1;
 }
 
+static int
+ssl_alpn_callback(SSL* p_ssl,
+                  const unsigned char** p_out,
+                  unsigned char* outlen,
+                  const unsigned char* p_in,
+                  unsigned int inlen,
+                  void* p_arg) {
+  unsigned int i;
+  struct vsf_session* p_sess = (struct vsf_session*) p_arg;
+  int is_ok = 0;
+
+  (void) p_ssl;
+
+  /* Initialize just in case. */
+  *p_out = p_in;
+  *outlen = 0;
+
+  for (i = 0; i < inlen; ++i) {
+    unsigned int left = (inlen - i);
+    if (left < 4) {
+      continue;
+    }
+    if (p_ini == 3 && p_ini + 1 == 'f' && p_ini + 2 == 't' &&
+        p_ini + 3 == 'p')
+    {
+      is_ok = 1;
+      *p_out = &p_ini + 1;
+      *outlen = 3;
+      break;
+    }
+  }
+  
+  if (!is_ok)
+  {
+    str_alloc_text(&debug_str, "ALPN rejection");
+    vsf_log_line(p_sess, kVSFLogEntryDebug, &debug_str);
+  }
+  if (!is_ok || tunable_debug_ssl)
+  {
+    str_alloc_text(&debug_str, "ALPN data: ");
+    for (i = 0; i < inlen; ++i) {
+      str_append_char(&debug_str, p_ini);
+    }
+    vsf_log_line(p_sess, kVSFLogEntryDebug, &debug_str);
+  }
+
+  if (is_ok)
+  {
+    return SSL_TLSEXT_ERR_OK;
+  }
+  else
+  {
+    return SSL_TLSEXT_ERR_ALERT_FATAL;
+  }
+}
+
+static long
+ssl_sni_callback(SSL* p_ssl, int* p_al, void* p_arg)
+{
+  static struct mystr s_sni_expected_hostname;
+  static struct mystr s_sni_received_hostname;
+
+  int servername_type;
+  const char* p_sni_servername;
+  struct vsf_session* p_sess = (struct vsf_session*) p_arg;
+  int is_ok = 0;
+
+  (void) p_ssl;
+  (void) p_arg;
+
+  if (tunable_ssl_sni_hostname)
+  {
+    str_alloc_text(&s_sni_expected_hostname, tunable_ssl_sni_hostname);
+  }
+
+  /* The OpenSSL documentation says it is pre-initialized like this, but set
+   * it just in case.
+   */
+  *p_al = SSL_AD_UNRECOGNIZED_NAME;
+
+  servername_type = SSL_get_servername_type(p_ssl);
+  p_sni_servername = SSL_get_servername(p_ssl, TLSEXT_NAMETYPE_host_name);
+  if (p_sni_servername != NULL) {
+    str_alloc_text(&s_sni_received_hostname, p_sni_servername);
+  }
+
+  if (str_isempty(&s_sni_expected_hostname))
+  {
+    is_ok = 1;
+  }
+  else if (servername_type != TLSEXT_NAMETYPE_host_name)
+  {
+    /* Fail. */
+    str_alloc_text(&debug_str, "SNI bad type: ");
+    str_append_ulong(&debug_str, servername_type);
+    vsf_log_line(p_sess, kVSFLogEntryDebug, &debug_str);
+  }
+  else
+  {
+    if (!str_strcmp(&s_sni_expected_hostname, &s_sni_received_hostname))
+    {
+      is_ok = 1;
+    }
+    else
+    {
+      str_alloc_text(&debug_str, "SNI rejection");
+      vsf_log_line(p_sess, kVSFLogEntryDebug, &debug_str);
+    }
+  }
+
+  if (!is_ok || tunable_debug_ssl)
+  {
+    str_alloc_text(&debug_str, "SNI hostname: ");
+    str_append_str(&debug_str, &s_sni_received_hostname);
+    vsf_log_line(p_sess, kVSFLogEntryDebug, &debug_str);
+  }
+
+  if (is_ok)
+  {
+    return SSL_TLSEXT_ERR_OK;
+  }
+  else
+  {
+    return SSL_TLSEXT_ERR_ALERT_FATAL;
+  }
+}
+
 void
 ssl_add_entropy(struct vsf_session* p_sess)
 {

_service:tar_scm:vsftpd-3.0.3.tar.gz/sysstr.c -> _service:tar_scm:vsftpd-3.0.5.tar.gz/sysstr.c Changed

_service:tar_scm:vsftpd-3.0.3.tar.gz/sysutil.h -> _service:tar_scm:vsftpd-3.0.5.tar.gz/sysutil.h Changed

_service:tar_scm:vsftpd-3.0.3.tar.gz/tunables.c -> _service:tar_scm:vsftpd-3.0.5.tar.gz/tunables.c Changed

@@ -66,6 +66,9 @@
 int tunable_sslv2;
 int tunable_sslv3;
 int tunable_tlsv1;
+int tunable_tlsv1_1;
+int tunable_tlsv1_2;
+int tunable_tlsv1_3;
 int tunable_tilde_user_enable;
 int tunable_force_anon_logins_ssl;
 int tunable_force_anon_data_ssl;
@@ -142,6 +145,7 @@
 const char* tunable_rsa_private_key_file;
 const char* tunable_dsa_private_key_file;
 const char* tunable_ca_certs_file;
+const char* tunable_ssl_sni_hostname;
 
 static void install_str_setting(const char* p_value, const char** p_storage);
 
@@ -205,7 +209,10 @@
   tunable_force_local_data_ssl = 1;
   tunable_sslv2 = 0;
   tunable_sslv3 = 0;
-  tunable_tlsv1 = 1;
+  tunable_tlsv1 = 0;
+  tunable_tlsv1_1 = 0;
+  tunable_tlsv1_2 = 1;
+  tunable_tlsv1_3 = 1;
   tunable_tilde_user_enable = 0;
   tunable_force_anon_logins_ssl = 0;
   tunable_force_anon_data_ssl = 0;
@@ -288,6 +295,7 @@
   install_str_setting(0, &tunable_rsa_private_key_file);
   install_str_setting(0, &tunable_dsa_private_key_file);
   install_str_setting(0, &tunable_ca_certs_file);
+  install_str_setting(0, &tunable_ssl_sni_hostname);
 }
 
 void

_service:tar_scm:vsftpd-3.0.3.tar.gz/tunables.h -> _service:tar_scm:vsftpd-3.0.5.tar.gz/tunables.h Changed

@@ -66,7 +66,10 @@
 extern int tunable_force_local_data_ssl;      /* Require local data uses SSL */
 extern int tunable_sslv2;                     /* Allow SSLv2 */
 extern int tunable_sslv3;                     /* Allow SSLv3 */
-extern int tunable_tlsv1;                     /* Allow TLSv1 */
+extern int tunable_tlsv1;                     /* Allow TLSv1.0 */
+extern int tunable_tlsv1_1;                   /* Allow TLSv1.1 */
+extern int tunable_tlsv1_2;                   /* Allow TLSv1.2 */
+extern int tunable_tlsv1_3;                   /* Allow TLSv1.3 */
 extern int tunable_tilde_user_enable;         /* Support e.g. ~chris */
 extern int tunable_force_anon_logins_ssl;     /* Require anon logins use SSL */
 extern int tunable_force_anon_data_ssl;       /* Require anon data uses SSL */
@@ -144,6 +147,7 @@
 extern const char* tunable_rsa_private_key_file;
 extern const char* tunable_dsa_private_key_file;
 extern const char* tunable_ca_certs_file;
+extern const char* tunable_ssl_sni_hostname;
 extern const char* tunable_cmds_denied;
 
 #endif /* VSF_TUNABLES_H */

_service:tar_scm:vsftpd-3.0.3.tar.gz/vsf_findlibs.sh -> _service:tar_scm:vsftpd-3.0.5.tar.gz/vsf_findlibs.sh Changed

_service:tar_scm:vsftpd-3.0.3.tar.gz/vsftpd.conf.5 -> _service:tar_scm:vsftpd-3.0.5.tar.gz/vsftpd.conf.5 Changed

@@ -479,7 +479,7 @@
 Only applies if
 .BR ssl_enable
 is activated. If enabled, this option will permit SSL v2 protocol connections.
-TLS v1 connections are preferred.
+TLS v1.2+ connections are preferred.
 
 Default: NO
 .TP
@@ -487,15 +487,39 @@
 Only applies if
 .BR ssl_enable
 is activated. If enabled, this option will permit SSL v3 protocol connections.
-TLS v1 connections are preferred.
+TLS v1.2+ connections are preferred.
 
 Default: NO
 .TP
 .B ssl_tlsv1
 Only applies if
 .BR ssl_enable
-is activated. If enabled, this option will permit TLS v1 protocol connections.
-TLS v1 connections are preferred.
+is activated. If enabled, this option will permit TLS v1.0 protocol connections.
+TLS v1.2+ connections are preferred.
+
+Default: NO
+.TP
+.B ssl_tlsv1_1
+Only applies if
+.BR ssl_enable
+is activated. If enabled, this option will permit TLS v1.1 protocol connections.
+TLS v1.2+ connections are preferred.
+
+Default: NO
+.TP
+.B ssl_tlsv1_2
+Only applies if
+.BR ssl_enable
+is activated. If enabled, this option will permit TLS v1.2 protocol connections.
+TLS v1.2+ connections are preferred.
+
+Default: YES
+.TP
+.B ssl_tlsv1_3
+Only applies if
+.BR ssl_enable
+is activated. If enabled, this option will permit TLS v1.3 protocol connections.
+TLS v1.2+ connections are preferred.
 
 Default: YES
 .TP
@@ -981,6 +1005,12 @@
 
 Default: DES-CBC3-SHA
 .TP
+.B ssl_sni_hostname
+If set, SSL connections will be rejected unless the SNI hostname in the
+incoming handshakes matches this value.
+
+Default: (none)
+.TP
 .B user_config_dir
 This powerful option allows the override of any config option specified in
 the manual page, on a per-user basis. Usage is simple, and is best illustrated

_service:tar_scm:vsftpd-3.0.3.tar.gz/vsftpver.h -> _service:tar_scm:vsftpd-3.0.5.tar.gz/vsftpver.h Changed

_service:tar_scm:vsftpd.service Changed

_service:tar_scm:vsftpd.target Changed

_service:tar_scm:vsftpd@.service Changed

Changes of Revision 2