Projects
openEuler:Mainline
vsftpd
Sign Up
Log In
Username
Password
We truncated the diff of some files because they were too big. If you want to see the full diff for every file,
click here
.
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
Expand all
Collapse all
Changes of Revision 2
View file
_service:tar_scm:vsftpd.spec
Changed
@@ -1,8 +1,8 @@ %define generator_dir %{_prefix}/lib/systemd/system-generators Name: vsftpd -Version: 3.0.3 -Release: 33 +Version: 3.0.5 +Release: 1 Summary: It is a secure FTP server for Unix-like systems # OpenSSL link exception License: GPLv2 with exceptions @@ -53,7 +53,6 @@ Patch30: 0030-Fix-logging-into-syslog-when-enabled-in-config.patch Patch31: 0031-Fix-question-mark-wildcard-withing-a-file-name.patch Patch32: 0032-Propagate-errors-from-nfs-with-quota-to-client.patch -Patch33: 0033-Introduce-TLSv1.1-and-TLSv1.2-options.patch Patch34: 0034-Turn-off-seccomp-sandbox-because-it-is-too-strict.patch Patch35: 0035-Modify-DH-enablement-patch-to-build-with-OpenSSL-1.1.patch Patch36: 0036-Redefine-VSFTP_COMMAND_FD-to-1.patch @@ -62,8 +61,6 @@ Patch39: 0039-Improve-documentation-of-ASCII-mode-in-the-man-page.patch Patch40: 0040-Use-system-wide-crypto-policy.patch Patch41: 0041-Document-the-new-default-for-ssl_ciphers-in-the-man-.patch -Patch42: 0042-When-handling-FEAT-command-check-ssl_tlsv1_1-and-ssl.patch -Patch43: 0043-Enable-only-TLSv1.2-by-default.patch Patch44: 0044-Disable-anonymous_enable-in-default-config-file.patch Patch45: 0045-Expand-explanation-of-ascii_-options-behaviour-in-ma.patch Patch46: 0046-vsftpd.conf-Refer-to-the-man-page-regarding-the-asci.patch @@ -89,6 +86,7 @@ Patch68: 0002-Drop-an-unused-global-variable.patch Patch69: 0001-Remove-a-hint-about-the-ftp_home_dir-SELinux-boolean.patch Patch70: fix-str_open.patch +Patch71: vsftpd-3.0.5-enable_wc_logs-replace_unprintable_with_hex.patch Patch9000: bugfix-change-the-default-value-of-tunable_reverse_lookup_e.patch @@ -107,7 +105,7 @@ %autosetup -p1 %build -make CFLAGS="$RPM_OPT_FLAGS -fpie -pipe -Wextra" LINK="-pie -lssl" %{?_smp_mflags} +make CFLAGS="$RPM_OPT_FLAGS -fpie -pipe -Wextra" LINK="-pie -lssl $RPM_LD_FLAGS" %{?_smp_mflags} %install install -d %{buildroot}{%{_unitdir},%{generator_dir},%{_var}/ftp/pub} @@ -155,6 +153,12 @@ %{_mandir}/man8/vsftpd.* %changelog +* Thu Nov 17 2022 zhouyihang <zhouyihang3@h-partners.com> - 3.0.5-1 +- Type:requirement +- ID:NA +- SUG:NA +- DESC:update vsftpd to 3.0.5 + * Tue Jan 26 2021 orange-snn <songnannan2@huawei.com> - 3.0.3-33 - remove Werror in build flags to fix building error.
View file
_service:tar_scm:0021-Introduce-support-for-DHE-based-cipher-suites.patch
Changed
@@ -41,9 +41,9 @@ BIO* p_bio, int oper, const char* p_arg, int argi, long argl, long retval); static int ssl_verify_callback(int verify_ok, X509_STORE_CTX* p_ctx); +static DH *ssl_tmp_dh_callback(SSL *ssl, int is_export, int keylength); - static int ssl_cert_digest( - SSL* p_ssl, struct vsf_session* p_sess, struct mystr* p_str); - static void maybe_log_shutdown_state(struct vsf_session* p_sess); + static int ssl_alpn_callback(SSL* p_ssl, + const unsigned char** p_out, + unsigned char* outlen, @@ -51,6 +54,60 @@ static int ssl_read_common(struct vsf_session* p_sess, static int ssl_inited; static struct mystr debug_str; @@ -147,11 +147,11 @@ + + SSL_CTX_set_tmp_dh_callback(p_ctx, ssl_tmp_dh_callback); + - p_sess->p_ssl_ctx = p_ctx; - ssl_inited = 1; - } + /* Set up ALPN to check for FTP protocol intention of client. */ + SSL_CTX_set_alpn_select_cb(p_ctx, ssl_alpn_callback, p_sess); + /* Set up SNI callback for an optional hostname check. */ @@ -702,6 +781,18 @@ ssl_verify_callback(int verify_ok, X509_STORE_CTX* p_ctx) - return 1; + } } +#define UNUSED(x) ( (void)(x) )
View file
_service:tar_scm:0022-Introduce-support-for-EDDHE-based-cipher-suites.patch
Changed
@@ -75,9 +75,9 @@ +#endif + } + - p_sess->p_ssl_ctx = p_ctx; - ssl_inited = 1; - } + /* Set up ALPN to check for FTP protocol intention of client. */ + SSL_CTX_set_alpn_select_cb(p_ctx, ssl_alpn_callback, p_sess); + /* Set up SNI callback for an optional hostname check. */ diff --git a/tunables.c b/tunables.c index 1ea7227..93f85b1 100644 --- a/tunables.c
View file
_service:tar_scm:0025-Improve-local_max_rate-option.patch
Changed
@@ -62,7 +62,7 @@ +++ b/main.c @@ -40,7 +40,7 @@ main(int argc, const char* argv) /* Control connection */ - 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, /* Data connection */ - -1, 0, -1, 0, 0, 0, 0, + -1, 0, -1, 0, 0, 0, 0, 0,
View file
_service:tar_scm:0033-Introduce-TLSv1.1-and-TLSv1.2-options.patch
Deleted
@@ -1,153 +0,0 @@ -From 01bef55a1987700af3d43cdc5f5be88d3843ab85 Mon Sep 17 00:00:00 2001 -From: Martin Sehnoutka <msehnout@redhat.com> -Date: Thu, 17 Nov 2016 13:36:17 +0100 -Subject: PATCH 33/59 Introduce TLSv1.1 and TLSv1.2 options. - -Users can now enable a specific version of TLS protocol. ---- - parseconf.c | 2 ++ - ssl.c | 8 ++++++++ - tunables.c | 9 +++++++-- - tunables.h | 2 ++ - vsftpd.conf.5 | 24 ++++++++++++++++++++---- - 5 files changed, 39 insertions(+), 6 deletions(-) - -diff --git a/parseconf.c b/parseconf.c -index a2c715b..33a1349 100644 ---- a/parseconf.c -+++ b/parseconf.c -@@ -85,6 +85,8 @@ parseconf_bool_array = - { "ssl_sslv2", &tunable_sslv2 }, - { "ssl_sslv3", &tunable_sslv3 }, - { "ssl_tlsv1", &tunable_tlsv1 }, -+ { "ssl_tlsv1_1", &tunable_tlsv1_1 }, -+ { "ssl_tlsv1_2", &tunable_tlsv1_2 }, - { "tilde_user_enable", &tunable_tilde_user_enable }, - { "force_anon_logins_ssl", &tunable_force_anon_logins_ssl }, - { "force_anon_data_ssl", &tunable_force_anon_data_ssl }, -diff --git a/ssl.c b/ssl.c -index 96bf8ad..ba8a613 100644 ---- a/ssl.c -+++ b/ssl.c -@@ -135,6 +135,14 @@ ssl_init(struct vsf_session* p_sess) - { - options |= SSL_OP_NO_TLSv1; - } -+ if (!tunable_tlsv1_1) -+ { -+ options |= SSL_OP_NO_TLSv1_1; -+ } -+ if (!tunable_tlsv1_2) -+ { -+ options |= SSL_OP_NO_TLSv1_2; -+ } - SSL_CTX_set_options(p_ctx, options); - if (tunable_rsa_cert_file) - { -diff --git a/tunables.c b/tunables.c -index 93f85b1..78f2bcd 100644 ---- a/tunables.c -+++ b/tunables.c -@@ -66,6 +66,8 @@ int tunable_force_local_data_ssl; - int tunable_sslv2; - int tunable_sslv3; - int tunable_tlsv1; -+int tunable_tlsv1_1; -+int tunable_tlsv1_2; - int tunable_tilde_user_enable; - int tunable_force_anon_logins_ssl; - int tunable_force_anon_data_ssl; -@@ -209,7 +211,10 @@ tunables_load_defaults() - tunable_force_local_data_ssl = 1; - tunable_sslv2 = 0; - tunable_sslv3 = 0; -+ /* TLSv1 up to TLSv1.2 is enabled by default */ - tunable_tlsv1 = 1; -+ tunable_tlsv1_1 = 1; -+ tunable_tlsv1_2 = 1; - tunable_tilde_user_enable = 0; - tunable_force_anon_logins_ssl = 0; - tunable_force_anon_data_ssl = 0; -@@ -292,8 +297,8 @@ tunables_load_defaults() - install_str_setting(0, &tunable_dsa_cert_file); - install_str_setting(0, &tunable_dh_param_file); - install_str_setting(0, &tunable_ecdh_param_file); -- install_str_setting("AES128-SHA:DES-CBC3-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA", -- &tunable_ssl_ciphers); -+ install_str_setting("AES128-SHA:DES-CBC3-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384", -+ &tunable_ssl_ciphers); - install_str_setting(0, &tunable_rsa_private_key_file); - install_str_setting(0, &tunable_dsa_private_key_file); - install_str_setting(0, &tunable_ca_certs_file); -diff --git a/tunables.h b/tunables.h -index 3e2d40c..a466427 100644 ---- a/tunables.h -+++ b/tunables.h -@@ -67,6 +67,8 @@ extern int tunable_force_local_data_ssl; /* Require local data uses SSL */ - extern int tunable_sslv2; /* Allow SSLv2 */ - extern int tunable_sslv3; /* Allow SSLv3 */ - extern int tunable_tlsv1; /* Allow TLSv1 */ -+extern int tunable_tlsv1_1; /* Allow TLSv1.1 */ -+extern int tunable_tlsv1_2; /* Allow TLSv1.2 */ - extern int tunable_tilde_user_enable; /* Support e.g. ~chris */ - extern int tunable_force_anon_logins_ssl; /* Require anon logins use SSL */ - extern int tunable_force_anon_data_ssl; /* Require anon data uses SSL */ -diff --git a/vsftpd.conf.5 b/vsftpd.conf.5 -index cf1ae34..a3d569e 100644 ---- a/vsftpd.conf.5 -+++ b/vsftpd.conf.5 -@@ -506,7 +506,7 @@ Default: YES - Only applies if - .BR ssl_enable - is activated. If enabled, this option will permit SSL v2 protocol connections. --TLS v1 connections are preferred. -+TLS v1.2 connections are preferred. - - Default: NO - .TP -@@ -514,7 +514,7 @@ Default: NO - Only applies if - .BR ssl_enable - is activated. If enabled, this option will permit SSL v3 protocol connections. --TLS v1 connections are preferred. -+TLS v1.2 connections are preferred. - - Default: NO - .TP -@@ -522,7 +522,23 @@ Default: NO - Only applies if - .BR ssl_enable - is activated. If enabled, this option will permit TLS v1 protocol connections. --TLS v1 connections are preferred. -+TLS v1.2 connections are preferred. -+ -+Default: YES -+.TP -+.B ssl_tlsv1_1 -+Only applies if -+.BR ssl_enable -+is activated. If enabled, this option will permit TLS v1.1 protocol connections. -+TLS v1.2 connections are preferred. -+ -+Default: YES -+.TP -+.B ssl_tlsv1_2 -+Only applies if -+.BR ssl_enable -+is activated. If enabled, this option will permit TLS v1.2 protocol connections. -+TLS v1.2 connections are preferred. - - Default: YES - .TP -@@ -1044,7 +1060,7 @@ man page for further details. Note that restricting ciphers can be a useful - security precaution as it prevents malicious remote parties forcing a cipher - which they have found problems with. - --Default: DES-CBC3-SHA -+Default: AES128-SHA:DES-CBC3-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384 - .TP - .B user_config_dir - This powerful option allows the override of any config option specified in --- -2.14.4 -
View file
_service:tar_scm:0040-Use-system-wide-crypto-policy.patch
Changed
@@ -16,8 +16,8 @@ install_str_setting(0, &tunable_dsa_cert_file); install_str_setting(0, &tunable_dh_param_file); install_str_setting(0, &tunable_ecdh_param_file); -- install_str_setting("AES128-SHA:DES-CBC3-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384", -- &tunable_ssl_ciphers); +- install_str_setting("AES128-SHA:DES-CBC3-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA", +- &tunable_ssl_ciphers); + install_str_setting("PROFILE=SYSTEM", &tunable_ssl_ciphers); install_str_setting(0, &tunable_rsa_private_key_file); install_str_setting(0, &tunable_dsa_private_key_file);
View file
_service:tar_scm:0041-Document-the-new-default-for-ssl_ciphers-in-the-man-.patch
Changed
@@ -17,15 +17,15 @@ security precaution as it prevents malicious remote parties forcing a cipher which they have found problems with. --Default: AES128-SHA:DES-CBC3-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384 +-Default: DES-CBC3-SHA +By default, the system-wide crypto policy is used. See +.BR update-crypto-policies(8) +for further details. + +Default: PROFILE=SYSTEM .TP - .B user_config_dir - This powerful option allows the override of any config option specified in + .B ssl_sni_hostname + If set, SSL connections will be rejected unless the SNI hostname in the -- 2.14.4
View file
_service:tar_scm:0042-When-handling-FEAT-command-check-ssl_tlsv1_1-and-ssl.patch
Deleted
@@ -1,32 +0,0 @@ -From 1c280a0b04e58ec63ce9ab5eb8d0ffe5ebbae115 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Ond=C5=99ej=20Lyson=C4=9Bk?= <olysonek@redhat.com> -Date: Thu, 21 Dec 2017 14:29:25 +0100 -Subject: PATCH 42/59 When handling FEAT command, check ssl_tlsv1_1 and - ssl_tlsv1_2 - -Send 'AUTH SSL' in reply to the FEAT command when the ssl_tlsv1_1 -or ssl_tlsv1_2 configuration option is enabled. - -The patch was written by Martin Sehnoutka. - -Resolves: rhbz#1432054 ---- - features.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/features.c b/features.c -index 1212980..d024366 100644 ---- a/features.c -+++ b/features.c -@@ -22,7 +22,7 @@ handle_feat(struct vsf_session* p_sess) - { - vsf_cmdio_write_raw(p_sess, " AUTH SSL\r\n"); - } -- if (tunable_tlsv1) -+ if (tunable_tlsv1 || tunable_tlsv1_1 || tunable_tlsv1_2) - { - vsf_cmdio_write_raw(p_sess, " AUTH TLS\r\n"); - } --- -2.14.4 -
View file
_service:tar_scm:0043-Enable-only-TLSv1.2-by-default.patch
Deleted
@@ -1,53 +0,0 @@ -From 75c942c77aa575143c5b75637e64a925ad12641a Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Ond=C5=99ej=20Lyson=C4=9Bk?= <olysonek@redhat.com> -Date: Thu, 21 Dec 2017 16:38:40 +0100 -Subject: PATCH 43/59 Enable only TLSv1.2 by default - -Disable TLSv1 and TLSv1.1 - enable only TLSv1.2 by default. ---- - tunables.c | 6 +++--- - vsftpd.conf.5 | 4 ++-- - 2 files changed, 5 insertions(+), 5 deletions(-) - -diff --git a/tunables.c b/tunables.c -index 354251c..9680528 100644 ---- a/tunables.c -+++ b/tunables.c -@@ -211,9 +211,9 @@ tunables_load_defaults() - tunable_force_local_data_ssl = 1; - tunable_sslv2 = 0; - tunable_sslv3 = 0; -- /* TLSv1 up to TLSv1.2 is enabled by default */ -- tunable_tlsv1 = 1; -- tunable_tlsv1_1 = 1; -+ tunable_tlsv1 = 0; -+ tunable_tlsv1_1 = 0; -+ /* Only TLSv1.2 is enabled by default */ - tunable_tlsv1_2 = 1; - tunable_tilde_user_enable = 0; - tunable_force_anon_logins_ssl = 0; -diff --git a/vsftpd.conf.5 b/vsftpd.conf.5 -index 2a7662e..df14027 100644 ---- a/vsftpd.conf.5 -+++ b/vsftpd.conf.5 -@@ -539,7 +539,7 @@ Only applies if - is activated. If enabled, this option will permit TLS v1 protocol connections. - TLS v1.2 connections are preferred. - --Default: YES -+Default: NO - .TP - .B ssl_tlsv1_1 - Only applies if -@@ -547,7 +547,7 @@ Only applies if - is activated. If enabled, this option will permit TLS v1.1 protocol connections. - TLS v1.2 connections are preferred. - --Default: YES -+Default: NO - .TP - .B ssl_tlsv1_2 - Only applies if --- -2.14.4 -
View file
_service:tar_scm:fix-str_open.patch
Changed
@@ -5,7 +5,7 @@ int str_open(const struct mystr* p_str, const enum EVSFSysStrOpenMode mode) { -- enum EVSFSysUtilOpenMode open_mode = kVSFSysStrOpenUnknown; +- enum EVSFSysUtilOpenMode open_mode = kVSFSysUtilOpenUnknown; - switch (mode) - { - case kVSFSysStrOpenReadOnly:
View file
_service:tar_scm:vsftpd-3.0.5-enable_wc_logs-replace_unprintable_with_hex.patch
Added
@@ -0,0 +1,215 @@ +diff --git a/logging.c b/logging.c +index 9e86808..613ff4b 100644 +--- a/logging.c ++++ b/logging.c +@@ -171,7 +171,14 @@ vsf_log_do_log_to_file(int fd, struct mystr* p_str) + return; + } + } +- str_replace_unprintable(p_str, '?'); ++ if (tunable_wc_logs_enable) ++ { ++ str_replace_unprintable_with_hex_wc(p_str); ++ } ++ else ++ { ++ str_replace_unprintable_with_hex(p_str); ++ } + str_append_char(p_str, '\n'); + /* Ignore write failure; maybe the disk filled etc. */ + (void) str_write_loop(p_str, fd); +diff --git a/parseconf.c b/parseconf.c +index 3cfe7da..3729818 100644 +--- a/parseconf.c ++++ b/parseconf.c +@@ -113,6 +113,7 @@ parseconf_bool_array = + { "allow_writeable_chroot", &tunable_allow_writeable_chroot }, + { "better_stou", &tunable_better_stou }, + { "log_die", &tunable_log_die }, ++ { "wc_logs_enable", &tunable_wc_logs_enable }, + { 0, 0 } + }; + +diff --git a/str.c b/str.c +index 82b8ae4..c03e7d8 100644 +--- a/str.c ++++ b/str.c +@@ -20,6 +20,11 @@ + #include "utility.h" + #include "sysutil.h" + ++#include <stdio.h> ++#include <string.h> ++#include <wchar.h> ++#include <wctype.h> ++ + /* File local functions */ + static void str_split_text_common(struct mystr* p_src, struct mystr* p_rhs, + const char* p_text, int is_reverse); +@@ -723,6 +728,102 @@ str_replace_unprintable(struct mystr* p_str, char new_char) + } + } + ++void ++str_replace_unprintable_with_hex(struct mystr* p_str) ++{ ++ unsigned int ups_size = sizeof(unsigned int) * (p_str->len); ++ if (ups_size < p_str->len) ++ { ++ str_replace_unprintable(p_str, '?'); ++ str_append_text(p_str, ": BUG: string is too long"); ++ bug(p_str->p_buf); ++ } ++ unsigned int* ups = vsf_sysutil_malloc(ups_size); ++ unsigned int up_count = 0; ++ for (unsigned int i=0; i < p_str->len; i++) ++ { ++ if (!vsf_sysutil_isprint(p_str->p_bufi)) ++ { ++ upsup_count++ = i; ++ } ++ } ++ str_replace_positions_with_hex(p_str, ups, up_count); ++ vsf_sysutil_free(ups); ++} ++ ++void str_replace_unprintable_with_hex_wc(struct mystr* p_str) ++{ ++ unsigned int ups_size = sizeof(unsigned int) * (p_str->len); ++ if (ups_size < p_str->len) ++ { ++ str_replace_unprintable(p_str, '?'); ++ str_append_text(p_str, ": BUG: string is too long"); ++ bug(p_str->p_buf); ++ } ++ unsigned int* ups = vsf_sysutil_malloc(ups_size); ++ unsigned int up_count = 0; ++ ++ size_t current = 0; ++ wchar_t pwc; ++ mbstate_t ps; ++ memset(&ps, 0, sizeof(ps)); ++ ssize_t len = 0; ++ while ((len = mbrtowc(&pwc, p_str->p_buf, p_str->len - current, &ps)) > 0) ++ { ++ if (!iswprint(pwc)) ++ { ++ for (int i = 0; i < len; i++) ++ { ++ upsup_count++ = current++; ++ } ++ } ++ else ++ { ++ current += len; ++ } ++ } ++ if (len < 0) ++ { ++ while (current < p_str->len) ++ { ++ upsup_count++ = current++; ++ } ++ } ++ str_replace_positions_with_hex(p_str, ups, up_count); ++ vsf_sysutil_free(ups); ++} ++ ++void ++str_replace_positions_with_hex(struct mystr* p_str, const unsigned int* poss, const unsigned int pos_count) ++{ ++ if (pos_count == 0) ++ return; ++ ++ struct mystr tmp_str = INIT_MYSTR; ++ str_reserve(&tmp_str, p_str->len + 3 * pos_count); ++ unsigned int current = 0; ++ ++ for (unsigned int i=0; i < pos_count; i++) ++ { ++ unsigned int pos = possi; ++ ++ if (current < pos) ++ private_str_append_memchunk(&tmp_str, p_str->p_buf + current, pos - current); ++ ++ char hex_buf5; ++ memset(hex_buf, 0, sizeof(hex_buf)); ++ sprintf(hex_buf, "\\x%02X", (unsigned char) p_str->p_bufpos); ++ str_append_text(&tmp_str, hex_buf); ++ current = pos + 1; ++ } ++ ++ if (current < p_str->len) ++ private_str_append_memchunk(&tmp_str, p_str->p_buf + current, p_str->len - current); ++ ++ str_copy(p_str, &tmp_str); ++ str_free(&tmp_str); ++} ++ + void + str_basename (struct mystr* d_str, const struct mystr* path) + { +diff --git a/str.h b/str.h +index 44270da..95a83b5 100644 +--- a/str.h ++++ b/str.h +@@ -98,6 +98,10 @@ int str_contains_space(const struct mystr* p_str); + int str_all_space(const struct mystr* p_str); + int str_contains_unprintable(const struct mystr* p_str); + void str_replace_unprintable(struct mystr* p_str, char new_char); ++void str_replace_unprintable_with_hex(struct mystr* p_str); ++void str_replace_unprintable_with_hex_wc(struct mystr* p_str); ++void str_replace_positions_with_hex(struct mystr* p_str, const unsigned int* poss, ++ const unsigned int pos_count); + int str_atoi(const struct mystr* p_str); + filesize_t str_a_to_filesize_t(const struct mystr* p_str); + unsigned int str_octal_to_uint(const struct mystr* p_str); +diff --git a/tunables.c b/tunables.c +index a7ce9c8..c96c1ac 100644 +--- a/tunables.c ++++ b/tunables.c +@@ -94,6 +94,7 @@ int tunable_seccomp_sandbox; + int tunable_allow_writeable_chroot; + int tunable_better_stou; + int tunable_log_die; ++int tunable_wc_logs_enable; + + unsigned int tunable_accept_timeout; + unsigned int tunable_connect_timeout; +@@ -244,6 +245,7 @@ tunables_load_defaults() + tunable_allow_writeable_chroot = 0; + tunable_better_stou = 0; + tunable_log_die = 0; ++ tunable_wc_logs_enable = 0; + + tunable_accept_timeout = 60; + tunable_connect_timeout = 60; +diff --git a/tunables.h b/tunables.h +index 029d645..8d50150 100644 +--- a/tunables.h ++++ b/tunables.h +@@ -98,6 +98,7 @@ extern int tunable_better_stou; /* Use better file name generation + */ + extern int tunable_log_die; /* Log calls to die(), die2() + * and bug() */ ++extern int tunable_wc_logs_enable; /* Allow non ASCII characters in logs */ + + /* Integer/numeric defines */ + extern unsigned int tunable_accept_timeout; +diff --git a/vsftpd.conf.5 b/vsftpd.conf.5
View file
_service
Changed
@@ -2,7 +2,7 @@ <service name="tar_scm"> <param name="scm">git</param> <param name="url">git@gitee.com:src-openeuler/vsftpd.git</param> - <param name="revision">94e065cc856cf95ef83e410dc34acc6eecdea6c2</param> + <param name="revision">master</param> <param name="exclude">*</param> <param name="extract">*</param> </service>
View file
_service:tar_scm:vsftpd-3.0.3.tar.gz/Changelog -> _service:tar_scm:vsftpd-3.0.5.tar.gz/Changelog
Changed
@@ -1375,3 +1375,22 @@ At this point: v3.0.3 released! =============================== + +- Fix build on Fedora 33 (one warning, one incorrect libcap used). +- Fix SSL build (terrible grep for symbol in vsf_findlibs.sh)! +- Fix runtime SIGSYS crashes on Fedora 33 (seccomp sandbox policy tweaks). +- Reject HTTP verbs pre-login. +- Disable TLS prior to v1.2 by default. +- Close the control connection after 10 unknown commands pre-login. +- Reject any TLS ALPN advertisement that's not 'ftp'. +- Add ssl_sni_hostname option to require a match on incoming SNI hostname. + +At this point: v3.0.4 released! +=============================== + +- Fix ALPN callback to correctly select the 'ftp' string if present. Works +with FileZilla-3.55.0. +- Fix a couple of seccomp policy issues with Fedora 34. + +At this point: v3.0.5 released! +===============================
View file
_service:tar_scm:vsftpd-3.0.3.tar.gz/README -> _service:tar_scm:vsftpd-3.0.5.tar.gz/README
Changed
@@ -1,4 +1,4 @@ -This is vsftpd, version 3.0.3 +This is vsftpd, version 3.0.5 Author: Chris Evans Contact: scarybeasts@gmail.com Website: http://vsftpd.beasts.org/
View file
_service:tar_scm:vsftpd-3.0.3.tar.gz/main.c -> _service:tar_scm:vsftpd-3.0.5.tar.gz/main.c
Changed
@@ -38,7 +38,7 @@ struct vsf_session the_session = { /* Control connection */ - 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, /* Data connection */ -1, 0, -1, 0, 0, 0, 0, /* Login */
View file
_service:tar_scm:vsftpd-3.0.3.tar.gz/parseconf.c -> _service:tar_scm:vsftpd-3.0.5.tar.gz/parseconf.c
Changed
@@ -85,6 +85,9 @@ { "ssl_sslv2", &tunable_sslv2 }, { "ssl_sslv3", &tunable_sslv3 }, { "ssl_tlsv1", &tunable_tlsv1 }, + { "ssl_tlsv11", &tunable_tlsv1_1 }, + { "ssl_tlsv12", &tunable_tlsv1_2 }, + { "ssl_tlsv13", &tunable_tlsv1_3 }, { "tilde_user_enable", &tunable_tilde_user_enable }, { "force_anon_logins_ssl", &tunable_force_anon_logins_ssl }, { "force_anon_data_ssl", &tunable_force_anon_data_ssl }, @@ -178,6 +181,7 @@ { "rsa_private_key_file", &tunable_rsa_private_key_file }, { "dsa_private_key_file", &tunable_dsa_private_key_file }, { "ca_certs_file", &tunable_ca_certs_file }, + { "ssl_sni_hostname", &tunable_ssl_sni_hostname }, { "cmds_denied", &tunable_cmds_denied }, { 0, 0 } };
View file
_service:tar_scm:vsftpd-3.0.3.tar.gz/prelogin.c -> _service:tar_scm:vsftpd-3.0.5.tar.gz/prelogin.c
Changed
@@ -164,8 +164,21 @@ { /* Deliberately ignore to avoid NAT device bugs, as per ProFTPd. */ } + else if (str_equal_text(&p_sess->ftp_cmd_str, "GET") || + str_equal_text(&p_sess->ftp_cmd_str, "POST") || + str_equal_text(&p_sess->ftp_cmd_str, "HEAD") || + str_equal_text(&p_sess->ftp_cmd_str, "OPTIONS") || + str_equal_text(&p_sess->ftp_cmd_str, "CONNECT")) + { + vsf_cmdio_write_exit(p_sess, FTP_BADCMD, + "HTTP protocol commands not allowed.", 1); + } else { + p_sess->prelogin_errors++; + if (p_sess->prelogin_errors > 10) { + vsf_cmdio_write_exit(p_sess, FTP_BADCMD, "Too many errors.", 1); + } vsf_cmdio_write(p_sess, FTP_LOGINERR, "Please login with USER and PASS."); }
View file
_service:tar_scm:vsftpd-3.0.3.tar.gz/seccompsandbox.c -> _service:tar_scm:vsftpd-3.0.5.tar.gz/seccompsandbox.c
Changed
@@ -45,6 +45,15 @@ #ifndef __NR_openat #define __NR_openat 257 #endif +#ifndef __NR_newfstatat + #define __NR_newfstatat 262 +#endif +#ifndef __NR_pselect6 + #define __NR_pselect6 270 +#endif +#ifndef __NR_getrandom + #define __NR_getrandom 318 +#endif #ifndef O_LARGEFILE #define O_LARGEFILE 00100000 @@ -267,6 +276,7 @@ 3, IPPROTO_TCP); allow_nr(__NR_bind); allow_nr(__NR_select); + allow_nr(__NR_pselect6); if (tunable_port_enable) { allow_nr(__NR_connect); @@ -350,6 +360,8 @@ /* For file locking. */ allow_nr_1_arg_match(__NR_fcntl, 2, F_SETLKW); allow_nr_1_arg_match(__NR_fcntl, 2, F_SETLK); + /* Newer kernel / glibc hit this. */ + allow_nr(__NR_getrandom); } if (tunable_ssl_enable) { @@ -396,6 +408,7 @@ allow_nr_2_arg_match(__NR_setsockopt, 2, SOL_SOCKET, 3, SO_LINGER); allow_nr_2_arg_match(__NR_setsockopt, 2, IPPROTO_IP, 3, IP_TOS); allow_nr(__NR_fstat); + allow_nr(__NR_newfstatat); allow_nr(__NR_lseek); /* Since we use chroot() to restrict filesystem access, we can just blanket * allow open(). @@ -409,8 +422,10 @@ allow_nr(__NR_getcwd); allow_nr(__NR_chdir); allow_nr(__NR_getdents); + allow_nr(__NR_getdents64); /* Misc */ allow_nr(__NR_umask); + reject_nr(__NR_sysinfo, EPERM); /* Config-dependent items follow. */ if (tunable_use_sendfile)
View file
_service:tar_scm:vsftpd-3.0.3.tar.gz/session.h -> _service:tar_scm:vsftpd-3.0.5.tar.gz/session.h
Changed
@@ -23,6 +23,7 @@ char* p_control_line_buf; int idle_timeout; int data_timeout; + int prelogin_errors; /* Details of the data connection */ int pasv_listen_fd;
View file
_service:tar_scm:vsftpd-3.0.3.tar.gz/ssl.c -> _service:tar_scm:vsftpd-3.0.5.tar.gz/ssl.c
Changed
@@ -38,6 +38,13 @@ static long bio_callback( BIO* p_bio, int oper, const char* p_arg, int argi, long argl, long retval); static int ssl_verify_callback(int verify_ok, X509_STORE_CTX* p_ctx); +static int ssl_alpn_callback(SSL* p_ssl, + const unsigned char** p_out, + unsigned char* outlen, + const unsigned char* p_in, + unsigned int inlen, + void* p_arg); +static long ssl_sni_callback(SSL* p_ssl, int* p_al, void* p_arg); static int ssl_cert_digest( SSL* p_ssl, struct vsf_session* p_sess, struct mystr* p_str); static void maybe_log_shutdown_state(struct vsf_session* p_sess); @@ -78,6 +85,18 @@ { options |= SSL_OP_NO_TLSv1; } + if (!tunable_tlsv1_1) + { + options |= SSL_OP_NO_TLSv1_1; + } + if (!tunable_tlsv1_2) + { + options |= SSL_OP_NO_TLSv1_2; + } + if (!tunable_tlsv1_3) + { + options |= SSL_OP_NO_TLSv1_3; + } SSL_CTX_set_options(p_ctx, options); if (tunable_rsa_cert_file) { @@ -165,6 +184,12 @@ /* Ensure cached session doesn't expire */ SSL_CTX_set_timeout(p_ctx, INT_MAX); } + /* Set up ALPN to check for FTP protocol intention of client. */ + SSL_CTX_set_alpn_select_cb(p_ctx, ssl_alpn_callback, p_sess); + /* Set up SNI callback for an optional hostname check. */ + SSL_CTX_set_tlsext_servername_callback(p_ctx, ssl_sni_callback); + SSL_CTX_set_tlsext_servername_arg(p_ctx, p_sess); + p_sess->p_ssl_ctx = p_ctx; ssl_inited = 1; } @@ -702,6 +727,133 @@ return 1; } +static int +ssl_alpn_callback(SSL* p_ssl, + const unsigned char** p_out, + unsigned char* outlen, + const unsigned char* p_in, + unsigned int inlen, + void* p_arg) { + unsigned int i; + struct vsf_session* p_sess = (struct vsf_session*) p_arg; + int is_ok = 0; + + (void) p_ssl; + + /* Initialize just in case. */ + *p_out = p_in; + *outlen = 0; + + for (i = 0; i < inlen; ++i) { + unsigned int left = (inlen - i); + if (left < 4) { + continue; + } + if (p_ini == 3 && p_ini + 1 == 'f' && p_ini + 2 == 't' && + p_ini + 3 == 'p') + { + is_ok = 1; + *p_out = &p_ini + 1; + *outlen = 3; + break; + } + } + + if (!is_ok) + { + str_alloc_text(&debug_str, "ALPN rejection"); + vsf_log_line(p_sess, kVSFLogEntryDebug, &debug_str); + } + if (!is_ok || tunable_debug_ssl) + { + str_alloc_text(&debug_str, "ALPN data: "); + for (i = 0; i < inlen; ++i) { + str_append_char(&debug_str, p_ini); + } + vsf_log_line(p_sess, kVSFLogEntryDebug, &debug_str); + } + + if (is_ok) + { + return SSL_TLSEXT_ERR_OK; + } + else + { + return SSL_TLSEXT_ERR_ALERT_FATAL; + } +} + +static long +ssl_sni_callback(SSL* p_ssl, int* p_al, void* p_arg) +{ + static struct mystr s_sni_expected_hostname; + static struct mystr s_sni_received_hostname; + + int servername_type; + const char* p_sni_servername; + struct vsf_session* p_sess = (struct vsf_session*) p_arg; + int is_ok = 0; + + (void) p_ssl; + (void) p_arg; + + if (tunable_ssl_sni_hostname) + { + str_alloc_text(&s_sni_expected_hostname, tunable_ssl_sni_hostname); + } + + /* The OpenSSL documentation says it is pre-initialized like this, but set + * it just in case. + */ + *p_al = SSL_AD_UNRECOGNIZED_NAME; + + servername_type = SSL_get_servername_type(p_ssl); + p_sni_servername = SSL_get_servername(p_ssl, TLSEXT_NAMETYPE_host_name); + if (p_sni_servername != NULL) { + str_alloc_text(&s_sni_received_hostname, p_sni_servername); + } + + if (str_isempty(&s_sni_expected_hostname)) + { + is_ok = 1; + } + else if (servername_type != TLSEXT_NAMETYPE_host_name) + { + /* Fail. */ + str_alloc_text(&debug_str, "SNI bad type: "); + str_append_ulong(&debug_str, servername_type); + vsf_log_line(p_sess, kVSFLogEntryDebug, &debug_str); + } + else + { + if (!str_strcmp(&s_sni_expected_hostname, &s_sni_received_hostname)) + { + is_ok = 1; + } + else + { + str_alloc_text(&debug_str, "SNI rejection"); + vsf_log_line(p_sess, kVSFLogEntryDebug, &debug_str); + } + } + + if (!is_ok || tunable_debug_ssl) + { + str_alloc_text(&debug_str, "SNI hostname: "); + str_append_str(&debug_str, &s_sni_received_hostname); + vsf_log_line(p_sess, kVSFLogEntryDebug, &debug_str); + } + + if (is_ok) + { + return SSL_TLSEXT_ERR_OK; + } + else + { + return SSL_TLSEXT_ERR_ALERT_FATAL; + } +} + void ssl_add_entropy(struct vsf_session* p_sess) {
View file
_service:tar_scm:vsftpd-3.0.3.tar.gz/sysstr.c -> _service:tar_scm:vsftpd-3.0.5.tar.gz/sysstr.c
Changed
@@ -74,7 +74,7 @@ int str_open(const struct mystr* p_str, const enum EVSFSysStrOpenMode mode) { - enum EVSFSysUtilOpenMode open_mode = kVSFSysStrOpenUnknown; + enum EVSFSysUtilOpenMode open_mode = kVSFSysUtilOpenUnknown; switch (mode) { case kVSFSysStrOpenReadOnly:
View file
_service:tar_scm:vsftpd-3.0.3.tar.gz/sysutil.h -> _service:tar_scm:vsftpd-3.0.5.tar.gz/sysutil.h
Changed
@@ -75,7 +75,8 @@ /* File create/open/close etc. */ enum EVSFSysUtilOpenMode { - kVSFSysUtilOpenReadOnly = 1, + kVSFSysUtilOpenUnknown = 0, + kVSFSysUtilOpenReadOnly, kVSFSysUtilOpenWriteOnly, kVSFSysUtilOpenReadWrite };
View file
_service:tar_scm:vsftpd-3.0.3.tar.gz/tunables.c -> _service:tar_scm:vsftpd-3.0.5.tar.gz/tunables.c
Changed
@@ -66,6 +66,9 @@ int tunable_sslv2; int tunable_sslv3; int tunable_tlsv1; +int tunable_tlsv1_1; +int tunable_tlsv1_2; +int tunable_tlsv1_3; int tunable_tilde_user_enable; int tunable_force_anon_logins_ssl; int tunable_force_anon_data_ssl; @@ -142,6 +145,7 @@ const char* tunable_rsa_private_key_file; const char* tunable_dsa_private_key_file; const char* tunable_ca_certs_file; +const char* tunable_ssl_sni_hostname; static void install_str_setting(const char* p_value, const char** p_storage); @@ -205,7 +209,10 @@ tunable_force_local_data_ssl = 1; tunable_sslv2 = 0; tunable_sslv3 = 0; - tunable_tlsv1 = 1; + tunable_tlsv1 = 0; + tunable_tlsv1_1 = 0; + tunable_tlsv1_2 = 1; + tunable_tlsv1_3 = 1; tunable_tilde_user_enable = 0; tunable_force_anon_logins_ssl = 0; tunable_force_anon_data_ssl = 0; @@ -288,6 +295,7 @@ install_str_setting(0, &tunable_rsa_private_key_file); install_str_setting(0, &tunable_dsa_private_key_file); install_str_setting(0, &tunable_ca_certs_file); + install_str_setting(0, &tunable_ssl_sni_hostname); } void
View file
_service:tar_scm:vsftpd-3.0.3.tar.gz/tunables.h -> _service:tar_scm:vsftpd-3.0.5.tar.gz/tunables.h
Changed
@@ -66,7 +66,10 @@ extern int tunable_force_local_data_ssl; /* Require local data uses SSL */ extern int tunable_sslv2; /* Allow SSLv2 */ extern int tunable_sslv3; /* Allow SSLv3 */ -extern int tunable_tlsv1; /* Allow TLSv1 */ +extern int tunable_tlsv1; /* Allow TLSv1.0 */ +extern int tunable_tlsv1_1; /* Allow TLSv1.1 */ +extern int tunable_tlsv1_2; /* Allow TLSv1.2 */ +extern int tunable_tlsv1_3; /* Allow TLSv1.3 */ extern int tunable_tilde_user_enable; /* Support e.g. ~chris */ extern int tunable_force_anon_logins_ssl; /* Require anon logins use SSL */ extern int tunable_force_anon_data_ssl; /* Require anon data uses SSL */ @@ -144,6 +147,7 @@ extern const char* tunable_rsa_private_key_file; extern const char* tunable_dsa_private_key_file; extern const char* tunable_ca_certs_file; +extern const char* tunable_ssl_sni_hostname; extern const char* tunable_cmds_denied; #endif /* VSF_TUNABLES_H */
View file
_service:tar_scm:vsftpd-3.0.3.tar.gz/vsf_findlibs.sh -> _service:tar_scm:vsftpd-3.0.5.tar.gz/vsf_findlibs.sh
Changed
@@ -48,15 +48,12 @@ locate_library /usr/lib/libsec.sl && echo "-lsec"; # Look for libcap (capabilities) -if locate_library /lib/libcap.so.1; then - echo "/lib/libcap.so.1"; -elif locate_library /lib/libcap.so.2; then - echo "/lib/libcap.so.2"; -else - locate_library /usr/lib/libcap.so && echo "-lcap"; - locate_library /lib/libcap.so && echo "-lcap"; - locate_library /lib64/libcap.so && echo "-lcap"; -fi +# Note that link may fail with: +# /usr/bin/ld: cannot find -lcap +# If the libcap-devel package isn't installed. +locate_library /usr/lib/libcap.so && echo "-lcap"; +locate_library /lib/libcap.so && echo "-lcap"; +locate_library /lib64/libcap.so && echo "-lcap"; # Solaris needs this for nanosleep().. locate_library /lib/libposix4.so && echo "-lposix4"; @@ -71,6 +68,8 @@ # OpenSSL if find_func SSL_library_init ssl.o; then echo "-lssl -lcrypto"; +elif find_func SSL_new ssl.o; then + echo "-lssl -lcrypto"; fi exit 0;
View file
_service:tar_scm:vsftpd-3.0.3.tar.gz/vsftpd.conf.5 -> _service:tar_scm:vsftpd-3.0.5.tar.gz/vsftpd.conf.5
Changed
@@ -479,7 +479,7 @@ Only applies if .BR ssl_enable is activated. If enabled, this option will permit SSL v2 protocol connections. -TLS v1 connections are preferred. +TLS v1.2+ connections are preferred. Default: NO .TP @@ -487,15 +487,39 @@ Only applies if .BR ssl_enable is activated. If enabled, this option will permit SSL v3 protocol connections. -TLS v1 connections are preferred. +TLS v1.2+ connections are preferred. Default: NO .TP .B ssl_tlsv1 Only applies if .BR ssl_enable -is activated. If enabled, this option will permit TLS v1 protocol connections. -TLS v1 connections are preferred. +is activated. If enabled, this option will permit TLS v1.0 protocol connections. +TLS v1.2+ connections are preferred. + +Default: NO +.TP +.B ssl_tlsv1_1 +Only applies if +.BR ssl_enable +is activated. If enabled, this option will permit TLS v1.1 protocol connections. +TLS v1.2+ connections are preferred. + +Default: NO +.TP +.B ssl_tlsv1_2 +Only applies if +.BR ssl_enable +is activated. If enabled, this option will permit TLS v1.2 protocol connections. +TLS v1.2+ connections are preferred. + +Default: YES +.TP +.B ssl_tlsv1_3 +Only applies if +.BR ssl_enable +is activated. If enabled, this option will permit TLS v1.3 protocol connections. +TLS v1.2+ connections are preferred. Default: YES .TP @@ -981,6 +1005,12 @@ Default: DES-CBC3-SHA .TP +.B ssl_sni_hostname +If set, SSL connections will be rejected unless the SNI hostname in the +incoming handshakes matches this value. + +Default: (none) +.TP .B user_config_dir This powerful option allows the override of any config option specified in the manual page, on a per-user basis. Usage is simple, and is best illustrated
View file
_service:tar_scm:vsftpd-3.0.3.tar.gz/vsftpver.h -> _service:tar_scm:vsftpd-3.0.5.tar.gz/vsftpver.h
Changed
@@ -1,7 +1,7 @@ #ifndef VSF_VERSION_H #define VSF_VERSION_H -#define VSF_VERSION "3.0.3" +#define VSF_VERSION "3.0.5" #endif /* VSF_VERSION_H */
View file
_service:tar_scm:vsftpd.service
Changed
@@ -1,6 +1,6 @@ Unit Description=Vsftpd ftp daemon -After=network.target +After=network-online.target Service Type=forking
View file
_service:tar_scm:vsftpd.target
Changed
@@ -1,6 +1,6 @@ Unit Description=FTP daemon -After=network.target +After=network-online.target Install WantedBy=multi-user.target
View file
_service:tar_scm:vsftpd@.service
Changed
@@ -1,6 +1,6 @@ Unit Description=Vsftpd ftp daemon -After=network.target +After=network-online.target PartOf=vsftpd.target Service
Locations
Projects
Search
Status Monitor
Help
Open Build Service
OBS Manuals
API Documentation
OBS Portal
Reporting a Bug
Contact
Mailing List
Forums
Chat (IRC)
Twitter
Open Build Service (OBS)
is an
openSUSE project
.
浙ICP备2022010568号-2