1 /* 2 * Copyright (c) 1985, 1988, 1990, 1992, 1993, 1994 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. All advertising materials mentioning features or use of this software 14 * must display the following acknowledgement: 15 * This product includes software developed by the University of 16 * California, Berkeley and its contributors. 17 * 4. Neither the name of the University nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 #define FTP_NAMES 35 #include "ftpd_locl.h" 36 #ifdef KRB5 37 #include <krb5.h> 38 #endif 39 #include "getarg.h" 40 41 RCSID("$Id$"); 42 43 static char version[] = "Version 6.00"; 44 45 extern off_t restart_point; 46 extern char cbuf[]; 47 48 struct sockaddr_storage ctrl_addr_ss; 49 struct sockaddr *ctrl_addr = (struct sockaddr *)&ctrl_addr_ss; 50 51 struct sockaddr_storage data_source_ss; 52 struct sockaddr *data_source = (struct sockaddr *)&data_source_ss; 53 54 struct sockaddr_storage data_dest_ss; 55 struct sockaddr *data_dest = (struct sockaddr *)&data_dest_ss; 56 57 struct sockaddr_storage his_addr_ss; 58 struct sockaddr *his_addr = (struct sockaddr *)&his_addr_ss; 59 60 struct sockaddr_storage pasv_addr_ss; 61 struct sockaddr *pasv_addr = (struct sockaddr *)&pasv_addr_ss; 62 63 int data; 64 int logged_in; 65 struct passwd *pw; 66 int debug = 0; 67 int ftpd_timeout = 900; /* timeout after 15 minutes of inactivity */ 68 int maxtimeout = 7200;/* don't allow idle time to be set beyond 2 hours */ 69 int restricted_data_ports = 1; 70 int logging; 71 int guest; 72 int dochroot; 73 int type; 74 int form; 75 int stru; /* avoid C keyword */ 76 int mode; 77 int usedefault = 1; /* for data transfers */ 78 int pdata = -1; /* for passive mode */ 79 int allow_insecure_oob = 1; 80 static int transflag; 81 static int urgflag; 82 off_t file_size; 83 off_t byte_count; 84 #if !defined(CMASK) || CMASK == 0 85 #undef CMASK 86 #define CMASK 027 87 #endif 88 int defumask = CMASK; /* default umask value */ 89 int guest_umask = 0777; /* Paranoia for anonymous users */ 90 char tmpline[10240]; 91 char hostname[MaxHostNameLen]; 92 char remotehost[MaxHostNameLen]; 93 static char ttyline[20]; 94 int paranoid = 1; 95 96 #define AUTH_PLAIN (1 << 0) /* allow sending passwords */ 97 #define AUTH_OTP (1 << 1) /* passwords are one-time */ 98 #define AUTH_FTP (1 << 2) /* allow anonymous login */ 99 100 static int auth_level = 0; /* Only allow kerberos login by default */ 101 102 /* 103 * Timeout intervals for retrying connections 104 * to hosts that don't accept PORT cmds. This 105 * is a kludge, but given the problems with TCP... 106 */ 107 #define SWAITMAX 90 /* wait at most 90 seconds */ 108 #define SWAITINT 5 /* interval between retries */ 109 110 int swaitmax = SWAITMAX; 111 int swaitint = SWAITINT; 112 113 #ifdef HAVE_SETPROCTITLE 114 char proctitle[BUFSIZ]; /* initial part of title */ 115 #endif /* HAVE_SETPROCTITLE */ 116 117 #define LOGCMD(cmd, file) \ 118 if (logging > 1) \ 119 syslog(LOG_INFO,"%s %s%s", cmd, \ 120 *(file) == '/' ? "" : curdir(), file); 121 #define LOGCMD2(cmd, file1, file2) \ 122 if (logging > 1) \ 123 syslog(LOG_INFO,"%s %s%s %s%s", cmd, \ 124 *(file1) == '/' ? "" : curdir(), file1, \ 125 *(file2) == '/' ? "" : curdir(), file2); 126 #define LOGBYTES(cmd, file, cnt) \ 127 if (logging > 1) { \ 128 if (cnt == (off_t)-1) \ 129 syslog(LOG_INFO,"%s %s%s", cmd, \ 130 *(file) == '/' ? "" : curdir(), file); \ 131 else \ 132 syslog(LOG_INFO, "%s %s%s = %ld bytes", \ 133 cmd, (*(file) == '/') ? "" : curdir(), file, (long)cnt); \ 134 } 135 136 static void ack (char *); 137 static void myoob (int); 138 static int handleoobcmd(void); 139 static int checkuser (char *, char *); 140 static int checkaccess (char *); 141 static FILE *dataconn (const char *, off_t, const char *); 142 static void dolog (struct sockaddr *, int); 143 static void end_login (void); 144 static FILE *getdatasock (const char *, int); 145 static char *gunique (char *); 146 static RETSIGTYPE lostconn (int); 147 static int receive_data (FILE *, FILE *); 148 static void send_data (FILE *, FILE *); 149 static struct passwd * sgetpwnam (char *); 150 151 static char * curdir(void)152 curdir(void) 153 { 154 static char path[MaxPathLen+1]; /* path + '/' + '\0' */ 155 156 if (getcwd(path, sizeof(path)-1) == NULL) 157 return (""); 158 if (path[1] != '\0') /* special case for root dir. */ 159 strlcat(path, "/", sizeof(path)); 160 /* For guest account, skip / since it's chrooted */ 161 return (guest ? path+1 : path); 162 } 163 164 #ifndef LINE_MAX 165 #define LINE_MAX 1024 166 #endif 167 168 static int parse_auth_level(char * str)169 parse_auth_level(char *str) 170 { 171 char *p; 172 int ret = 0; 173 char *foo = NULL; 174 175 for(p = strtok_r(str, ",", &foo); 176 p; 177 p = strtok_r(NULL, ",", &foo)) { 178 if(strcmp(p, "user") == 0) 179 ; 180 #ifdef OTP 181 else if(strcmp(p, "otp") == 0) 182 ret |= AUTH_PLAIN|AUTH_OTP; 183 #endif 184 else if(strcmp(p, "ftp") == 0 || 185 strcmp(p, "safe") == 0) 186 ret |= AUTH_FTP; 187 else if(strcmp(p, "plain") == 0) 188 ret |= AUTH_PLAIN; 189 else if(strcmp(p, "none") == 0) 190 ret |= AUTH_PLAIN|AUTH_FTP; 191 else 192 warnx("bad value for -a: `%s'", p); 193 } 194 return ret; 195 } 196 197 /* 198 * Print usage and die. 199 */ 200 201 static int interactive_flag; 202 static char *guest_umask_string; 203 static char *port_string; 204 static char *umask_string; 205 static char *auth_string; 206 207 int use_builtin_ls = -1; 208 209 static int help_flag; 210 static int version_flag; 211 212 static const char *good_chars = "+-=_,."; 213 214 struct getargs args[] = { 215 { NULL, 'a', arg_string, &auth_string, "required authentication" }, 216 { NULL, 'i', arg_flag, &interactive_flag, "don't assume stdin is a socket" }, 217 { NULL, 'p', arg_string, &port_string, "what port to listen to" }, 218 { NULL, 'g', arg_string, &guest_umask_string, "umask for guest logins" }, 219 { NULL, 'l', arg_counter, &logging, "log more stuff", "" }, 220 { NULL, 't', arg_integer, &ftpd_timeout, "initial timeout" }, 221 { NULL, 'T', arg_integer, &maxtimeout, "max timeout" }, 222 { NULL, 'u', arg_string, &umask_string, "umask for user logins" }, 223 { NULL, 'U', arg_negative_flag, &restricted_data_ports, "don't use high data ports" }, 224 { NULL, 'd', arg_flag, &debug, "enable debugging" }, 225 { NULL, 'v', arg_flag, &debug, "enable debugging" }, 226 { "builtin-ls", 'B', arg_flag, &use_builtin_ls, "use built-in ls to list files" }, 227 { "good-chars", 0, arg_string, &good_chars, "allowed anonymous upload filename chars" }, 228 { "insecure-oob", 'I', arg_negative_flag, &allow_insecure_oob, "don't allow insecure OOB ABOR/STAT" }, 229 #ifdef KRB5 230 { "gss-bindings", 0, arg_flag, &ftp_do_gss_bindings, "Require GSS-API bindings", NULL}, 231 #endif 232 { "version", 0, arg_flag, &version_flag }, 233 { "help", 'h', arg_flag, &help_flag } 234 }; 235 236 static int num_args = sizeof(args) / sizeof(args[0]); 237 238 static void usage(int code)239 usage (int code) 240 { 241 arg_printusage(args, num_args, NULL, ""); 242 exit (code); 243 } 244 245 /* output contents of a file */ 246 static int show_file(const char * file,int code)247 show_file(const char *file, int code) 248 { 249 FILE *f; 250 char buf[128]; 251 252 f = fopen(file, "r"); 253 if(f == NULL) 254 return -1; 255 while(fgets(buf, sizeof(buf), f)){ 256 buf[strcspn(buf, "\r\n")] = '\0'; 257 lreply(code, "%s", buf); 258 } 259 fclose(f); 260 return 0; 261 } 262 263 int main(int argc,char ** argv)264 main(int argc, char **argv) 265 { 266 socklen_t his_addr_len, ctrl_addr_len; 267 int on = 1; 268 int port; 269 struct servent *sp; 270 271 int optind = 0; 272 273 setprogname (argv[0]); 274 275 if(getarg(args, num_args, argc, argv, &optind)) 276 usage(1); 277 278 if(help_flag) 279 usage(0); 280 281 if(version_flag) { 282 print_version(NULL); 283 exit(0); 284 } 285 286 if(auth_string) 287 auth_level = parse_auth_level(auth_string); 288 { 289 char *p; 290 long val = 0; 291 292 if(guest_umask_string) { 293 val = strtol(guest_umask_string, &p, 8); 294 if (*p != '\0' || val < 0) 295 warnx("bad value for -g"); 296 else 297 guest_umask = val; 298 } 299 if(umask_string) { 300 val = strtol(umask_string, &p, 8); 301 if (*p != '\0' || val < 0) 302 warnx("bad value for -u"); 303 else 304 defumask = val; 305 } 306 } 307 sp = getservbyname("ftp", "tcp"); 308 if(sp) 309 port = sp->s_port; 310 else 311 port = htons(21); 312 if(port_string) { 313 sp = getservbyname(port_string, "tcp"); 314 if(sp) 315 port = sp->s_port; 316 else 317 if(isdigit((unsigned char)port_string[0])) 318 port = htons(atoi(port_string)); 319 else 320 warnx("bad value for -p"); 321 } 322 323 if (maxtimeout < ftpd_timeout) 324 maxtimeout = ftpd_timeout; 325 326 #if 0 327 if (ftpd_timeout > maxtimeout) 328 ftpd_timeout = maxtimeout; 329 #endif 330 331 if(interactive_flag) 332 mini_inetd(port, NULL); 333 334 /* 335 * LOG_NDELAY sets up the logging connection immediately, 336 * necessary for anonymous ftp's that chroot and can't do it later. 337 */ 338 openlog("ftpd", LOG_PID | LOG_NDELAY, LOG_FTP); 339 his_addr_len = sizeof(his_addr_ss); 340 if (getpeername(STDIN_FILENO, his_addr, &his_addr_len) < 0) { 341 syslog(LOG_ERR, "getpeername (%s): %m",argv[0]); 342 exit(1); 343 } 344 ctrl_addr_len = sizeof(ctrl_addr_ss); 345 if (getsockname(STDIN_FILENO, ctrl_addr, &ctrl_addr_len) < 0) { 346 syslog(LOG_ERR, "getsockname (%s): %m",argv[0]); 347 exit(1); 348 } 349 #if defined(IP_TOS) 350 if (ctrl_addr->sa_family == AF_INET) 351 socket_set_tos(STDIN_FILENO, IP_TOS); 352 #endif 353 data_source->sa_family = ctrl_addr->sa_family; 354 socket_set_port (data_source, 355 htons(ntohs(socket_get_port(ctrl_addr)) - 1)); 356 357 /* set this here so it can be put in wtmp */ 358 snprintf(ttyline, sizeof(ttyline), "ftp%u", (unsigned)getpid()); 359 360 361 /* freopen(_PATH_DEVNULL, "w", stderr); */ 362 signal(SIGPIPE, lostconn); 363 signal(SIGCHLD, SIG_IGN); 364 #ifdef SIGURG 365 if (signal(SIGURG, myoob) == SIG_ERR) 366 syslog(LOG_ERR, "signal: %m"); 367 #endif 368 369 /* Try to handle urgent data inline */ 370 #if defined(SO_OOBINLINE) && defined(HAVE_SETSOCKOPT) 371 if (setsockopt(0, SOL_SOCKET, SO_OOBINLINE, (void *)&on, 372 sizeof(on)) < 0) 373 syslog(LOG_ERR, "setsockopt: %m"); 374 #endif 375 376 #ifdef F_SETOWN 377 if (fcntl(fileno(stdin), F_SETOWN, getpid()) == -1) 378 syslog(LOG_ERR, "fcntl F_SETOWN: %m"); 379 #endif 380 dolog(his_addr, his_addr_len); 381 /* 382 * Set up default state 383 */ 384 data = -1; 385 type = TYPE_A; 386 form = FORM_N; 387 stru = STRU_F; 388 mode = MODE_S; 389 tmpline[0] = '\0'; 390 391 /* If logins are disabled, print out the message. */ 392 if(show_file(_PATH_NOLOGIN, 530) == 0) { 393 reply(530, "System not available."); 394 exit(0); 395 } 396 show_file(_PATH_FTPWELCOME, 220); 397 /* reply(220,) must follow */ 398 gethostname(hostname, sizeof(hostname)); 399 400 reply(220, "%s FTP server (%s" 401 #ifdef KRB5 402 "+%s" 403 #endif 404 ") ready.", hostname, version 405 #ifdef KRB5 406 ,heimdal_version 407 #endif 408 ); 409 410 for (;;) 411 yyparse(); 412 /* NOTREACHED */ 413 } 414 415 static RETSIGTYPE lostconn(int signo)416 lostconn(int signo) 417 { 418 419 if (debug) 420 syslog(LOG_DEBUG, "lost connection"); 421 dologout(-1); 422 } 423 424 /* 425 * Helper function for sgetpwnam(). 426 */ 427 static char * sgetsave(char * s)428 sgetsave(char *s) 429 { 430 char *new = strdup(s); 431 432 if (new == NULL) { 433 perror_reply(421, "Local resource failure: malloc"); 434 dologout(1); 435 /* NOTREACHED */ 436 } 437 return new; 438 } 439 440 /* 441 * Save the result of a getpwnam. Used for USER command, since 442 * the data returned must not be clobbered by any other command 443 * (e.g., globbing). 444 */ 445 static struct passwd * sgetpwnam(char * name)446 sgetpwnam(char *name) 447 { 448 static struct passwd save; 449 struct passwd *p; 450 451 if ((p = k_getpwnam(name)) == NULL) 452 return (p); 453 if (save.pw_name) { 454 free(save.pw_name); 455 free(save.pw_passwd); 456 free(save.pw_gecos); 457 free(save.pw_dir); 458 free(save.pw_shell); 459 } 460 save = *p; 461 save.pw_name = sgetsave(p->pw_name); 462 save.pw_passwd = sgetsave(p->pw_passwd); 463 save.pw_gecos = sgetsave(p->pw_gecos); 464 save.pw_dir = sgetsave(p->pw_dir); 465 save.pw_shell = sgetsave(p->pw_shell); 466 return (&save); 467 } 468 469 static int login_attempts; /* number of failed login attempts */ 470 static int askpasswd; /* had user command, ask for passwd */ 471 static char curname[10]; /* current USER name */ 472 #ifdef OTP 473 OtpContext otp_ctx; 474 #endif 475 476 /* 477 * USER command. 478 * Sets global passwd pointer pw if named account exists and is acceptable; 479 * sets askpasswd if a PASS command is expected. If logged in previously, 480 * need to reset state. If name is "ftp" or "anonymous", the name is not in 481 * _PATH_FTPUSERS, and ftp account exists, set guest and pw, then just return. 482 * If account doesn't exist, ask for passwd anyway. Otherwise, check user 483 * requesting login privileges. Disallow anyone who does not have a standard 484 * shell as returned by getusershell(). Disallow anyone mentioned in the file 485 * _PATH_FTPUSERS to allow people such as root and uucp to be avoided. 486 */ 487 void user(char * name)488 user(char *name) 489 { 490 char *cp, *shell; 491 492 if(auth_level == 0 && !sec_complete){ 493 reply(530, "No login allowed without authorization."); 494 return; 495 } 496 497 if (logged_in) { 498 if (guest) { 499 reply(530, "Can't change user from guest login."); 500 return; 501 } else if (dochroot) { 502 reply(530, "Can't change user from chroot user."); 503 return; 504 } 505 end_login(); 506 } 507 508 guest = 0; 509 if (strcmp(name, "ftp") == 0 || strcmp(name, "anonymous") == 0) { 510 if ((auth_level & AUTH_FTP) == 0 || 511 checkaccess("ftp") || 512 checkaccess("anonymous")) 513 reply(530, "User %s access denied.", name); 514 else if ((pw = sgetpwnam("ftp")) != NULL) { 515 guest = 1; 516 defumask = guest_umask; /* paranoia for incoming */ 517 askpasswd = 1; 518 reply(331, "Guest login ok, type your name as password."); 519 } else 520 reply(530, "User %s unknown.", name); 521 if (!askpasswd && logging) { 522 char data_addr[256]; 523 524 if (inet_ntop (his_addr->sa_family, 525 socket_get_address(his_addr), 526 data_addr, sizeof(data_addr)) == NULL) 527 strlcpy (data_addr, "unknown address", 528 sizeof(data_addr)); 529 530 syslog(LOG_NOTICE, 531 "ANONYMOUS FTP LOGIN REFUSED FROM %s(%s)", 532 remotehost, data_addr); 533 } 534 return; 535 } 536 if((auth_level & AUTH_PLAIN) == 0 && !sec_complete){ 537 reply(530, "Only authorized and anonymous login allowed."); 538 return; 539 } 540 if ((pw = sgetpwnam(name))) { 541 if ((shell = pw->pw_shell) == NULL || *shell == 0) 542 shell = _PATH_BSHELL; 543 while ((cp = getusershell()) != NULL) 544 if (strcmp(cp, shell) == 0) 545 break; 546 endusershell(); 547 548 if (cp == NULL || checkaccess(name)) { 549 reply(530, "User %s access denied.", name); 550 if (logging) { 551 char data_addr[256]; 552 553 if (inet_ntop (his_addr->sa_family, 554 socket_get_address(his_addr), 555 data_addr, 556 sizeof(data_addr)) == NULL) 557 strlcpy (data_addr, 558 "unknown address", 559 sizeof(data_addr)); 560 561 syslog(LOG_NOTICE, 562 "FTP LOGIN REFUSED FROM %s(%s), %s", 563 remotehost, 564 data_addr, 565 name); 566 } 567 pw = (struct passwd *) NULL; 568 return; 569 } 570 } 571 if (logging) 572 strlcpy(curname, name, sizeof(curname)); 573 if(sec_complete) { 574 if(sec_userok(name) == 0) { 575 do_login(232, name); 576 sec_session(name); 577 } else 578 reply(530, "User %s access denied.", name); 579 } else { 580 #ifdef OTP 581 char ss[256]; 582 583 if (otp_challenge(&otp_ctx, name, ss, sizeof(ss)) == 0) { 584 reply(331, "Password %s for %s required.", 585 ss, name); 586 askpasswd = 1; 587 } else 588 #endif 589 if ((auth_level & AUTH_OTP) == 0) { 590 reply(331, "Password required for %s.", name); 591 askpasswd = 1; 592 } else { 593 #ifdef OTP 594 char *s; 595 596 if ((s = otp_error (&otp_ctx)) != NULL) 597 lreply(530, "OTP: %s", s); 598 #endif 599 reply(530, 600 "Only authorized, anonymous" 601 #ifdef OTP 602 " and OTP " 603 #endif 604 "login allowed."); 605 } 606 607 } 608 /* 609 * Delay before reading passwd after first failed 610 * attempt to slow down passwd-guessing programs. 611 */ 612 if (login_attempts) 613 sleep(login_attempts); 614 } 615 616 /* 617 * Check if a user is in the file "fname" 618 */ 619 static int checkuser(char * fname,char * name)620 checkuser(char *fname, char *name) 621 { 622 FILE *fd; 623 int found = 0; 624 char *p, line[BUFSIZ]; 625 626 if ((fd = fopen(fname, "r")) != NULL) { 627 while (fgets(line, sizeof(line), fd) != NULL) 628 if ((p = strchr(line, '\n')) != NULL) { 629 *p = '\0'; 630 if (line[0] == '#') 631 continue; 632 if (strcmp(line, name) == 0) { 633 found = 1; 634 break; 635 } 636 } 637 fclose(fd); 638 } 639 return (found); 640 } 641 642 643 /* 644 * Determine whether a user has access, based on information in 645 * _PATH_FTPUSERS. The users are listed one per line, with `allow' 646 * or `deny' after the username. If anything other than `allow', or 647 * just nothing, is given after the username, `deny' is assumed. 648 * 649 * If the user is not found in the file, but the pseudo-user `*' is, 650 * the permission is taken from that line. 651 * 652 * This preserves the old semantics where if a user was listed in the 653 * file he was denied, otherwise he was allowed. 654 * 655 * Return 1 if the user is denied, or 0 if he is allowed. */ 656 657 static int match(const char * pattern,const char * string)658 match(const char *pattern, const char *string) 659 { 660 return fnmatch(pattern, string, FNM_NOESCAPE); 661 } 662 663 static int checkaccess(char * name)664 checkaccess(char *name) 665 { 666 #define ALLOWED 0 667 #define NOT_ALLOWED 1 668 FILE *fd; 669 int allowed = ALLOWED; 670 char *user, *perm, line[BUFSIZ]; 671 char *foo; 672 673 fd = fopen(_PATH_FTPUSERS, "r"); 674 675 if(fd == NULL) 676 return allowed; 677 678 while (fgets(line, sizeof(line), fd) != NULL) { 679 foo = NULL; 680 user = strtok_r(line, " \t\n", &foo); 681 if (user == NULL || user[0] == '#') 682 continue; 683 perm = strtok_r(NULL, " \t\n", &foo); 684 if (match(user, name) == 0){ 685 if(perm && strcmp(perm, "allow") == 0) 686 allowed = ALLOWED; 687 else 688 allowed = NOT_ALLOWED; 689 break; 690 } 691 } 692 fclose(fd); 693 return allowed; 694 } 695 #undef ALLOWED 696 #undef NOT_ALLOWED 697 698 do_login(int code,char * passwd)699 int do_login(int code, char *passwd) 700 { 701 login_attempts = 0; /* this time successful */ 702 if (setegid((gid_t)pw->pw_gid) < 0) { 703 reply(550, "Can't set gid."); 704 return -1; 705 } 706 initgroups(pw->pw_name, pw->pw_gid); 707 #if defined(KRB5) 708 if(k_hasafs()) 709 k_setpag(); 710 #endif 711 712 /* open wtmp before chroot */ 713 ftpd_logwtmp(ttyline, pw->pw_name, remotehost); 714 logged_in = 1; 715 716 dochroot = checkuser(_PATH_FTPCHROOT, pw->pw_name); 717 if (guest) { 718 /* 719 * We MUST do a chdir() after the chroot. Otherwise 720 * the old current directory will be accessible as "." 721 * outside the new root! 722 */ 723 if (chroot(pw->pw_dir) < 0 || chdir("/") < 0) { 724 reply(550, "Can't set guest privileges."); 725 return -1; 726 } 727 } else if (dochroot) { 728 if (chroot(pw->pw_dir) < 0 || chdir("/") < 0) { 729 reply(550, "Can't change root."); 730 return -1; 731 } 732 } else if (chdir(pw->pw_dir) < 0) { 733 if (chdir("/") < 0) { 734 reply(530, "User %s: can't change directory to %s.", 735 pw->pw_name, pw->pw_dir); 736 return -1; 737 } else 738 lreply(code, "No directory! Logging in with home=/"); 739 } 740 if (seteuid((uid_t)pw->pw_uid) < 0) { 741 reply(550, "Can't set uid."); 742 return -1; 743 } 744 745 if(use_builtin_ls == -1) { 746 struct stat st; 747 /* if /bin/ls exist and is a regular file, use it, otherwise 748 use built-in ls */ 749 if(stat("/bin/ls", &st) == 0 && 750 S_ISREG(st.st_mode)) 751 use_builtin_ls = 0; 752 else 753 use_builtin_ls = 1; 754 } 755 756 /* 757 * Display a login message, if it exists. 758 * N.B. reply(code,) must follow the message. 759 */ 760 show_file(_PATH_FTPLOGINMESG, code); 761 if(show_file(_PATH_ISSUE_NET, code) != 0) 762 show_file(_PATH_ISSUE, code); 763 if (guest) { 764 reply(code, "Guest login ok, access restrictions apply."); 765 #ifdef HAVE_SETPROCTITLE 766 snprintf (proctitle, sizeof(proctitle), 767 "%s: anonymous/%s", 768 remotehost, 769 passwd); 770 setproctitle("%s", proctitle); 771 #endif /* HAVE_SETPROCTITLE */ 772 if (logging) { 773 char data_addr[256]; 774 775 if (inet_ntop (his_addr->sa_family, 776 socket_get_address(his_addr), 777 data_addr, sizeof(data_addr)) == NULL) 778 strlcpy (data_addr, "unknown address", 779 sizeof(data_addr)); 780 781 syslog(LOG_INFO, "ANONYMOUS FTP LOGIN FROM %s(%s), %s", 782 remotehost, 783 data_addr, 784 passwd); 785 } 786 } else { 787 reply(code, "User %s logged in.", pw->pw_name); 788 #ifdef HAVE_SETPROCTITLE 789 snprintf(proctitle, sizeof(proctitle), "%s: %s", remotehost, pw->pw_name); 790 setproctitle("%s", proctitle); 791 #endif /* HAVE_SETPROCTITLE */ 792 if (logging) { 793 char data_addr[256]; 794 795 if (inet_ntop (his_addr->sa_family, 796 socket_get_address(his_addr), 797 data_addr, sizeof(data_addr)) == NULL) 798 strlcpy (data_addr, "unknown address", 799 sizeof(data_addr)); 800 801 syslog(LOG_INFO, "FTP LOGIN FROM %s(%s) as %s", 802 remotehost, 803 data_addr, 804 pw->pw_name); 805 } 806 } 807 umask(defumask); 808 return 0; 809 } 810 811 /* 812 * Terminate login as previous user, if any, resetting state; 813 * used when USER command is given or login fails. 814 */ 815 static void end_login(void)816 end_login(void) 817 { 818 819 if (seteuid((uid_t)0) < 0) 820 fatal("Failed to seteuid"); 821 if (logged_in) 822 ftpd_logwtmp(ttyline, "", ""); 823 pw = NULL; 824 logged_in = 0; 825 guest = 0; 826 dochroot = 0; 827 } 828 829 #ifdef KRB5 830 static int krb5_verify(struct passwd * pwd,char * passwd)831 krb5_verify(struct passwd *pwd, char *passwd) 832 { 833 krb5_context context; 834 krb5_ccache id; 835 krb5_principal princ; 836 krb5_error_code ret; 837 838 ret = krb5_init_context(&context); 839 if(ret) 840 return ret; 841 842 ret = krb5_parse_name(context, pwd->pw_name, &princ); 843 if(ret){ 844 krb5_free_context(context); 845 return ret; 846 } 847 ret = krb5_cc_new_unique(context, "MEMORY", NULL, &id); 848 if(ret){ 849 krb5_free_principal(context, princ); 850 krb5_free_context(context); 851 return ret; 852 } 853 ret = krb5_verify_user(context, 854 princ, 855 id, 856 passwd, 857 1, 858 NULL); 859 krb5_free_principal(context, princ); 860 if (k_hasafs()) { 861 krb5_afslog_uid_home(context, id,NULL, NULL,pwd->pw_uid, pwd->pw_dir); 862 } 863 krb5_cc_destroy(context, id); 864 krb5_free_context (context); 865 if(ret) 866 return ret; 867 return 0; 868 } 869 #endif /* KRB5 */ 870 871 void pass(char * passwd)872 pass(char *passwd) 873 { 874 int rval; 875 876 /* some clients insists on sending a password */ 877 if (logged_in && askpasswd == 0){ 878 reply(230, "Password not necessary"); 879 return; 880 } 881 882 if (logged_in || askpasswd == 0) { 883 reply(503, "Login with USER first."); 884 return; 885 } 886 askpasswd = 0; 887 rval = 1; 888 if (!guest) { /* "ftp" is only account allowed no password */ 889 if (pw == NULL) 890 rval = 1; /* failure below */ 891 #ifdef OTP 892 else if (otp_verify_user (&otp_ctx, passwd) == 0) { 893 rval = 0; 894 } 895 #endif 896 else if((auth_level & AUTH_OTP) == 0) { 897 #ifdef KRB5 898 rval = krb5_verify(pw, passwd); 899 #endif 900 if (rval) 901 rval = unix_verify_user(pw->pw_name, passwd); 902 } else { 903 #ifdef OTP 904 char *s; 905 if ((s = otp_error(&otp_ctx)) != NULL) 906 lreply(530, "OTP: %s", s); 907 #endif 908 } 909 memset (passwd, 0, strlen(passwd)); 910 911 /* 912 * If rval == 1, the user failed the authentication 913 * check above. If rval == 0, either Kerberos or 914 * local authentication succeeded. 915 */ 916 if (rval) { 917 char data_addr[256]; 918 919 if (inet_ntop (his_addr->sa_family, 920 socket_get_address(his_addr), 921 data_addr, sizeof(data_addr)) == NULL) 922 strlcpy (data_addr, "unknown address", 923 sizeof(data_addr)); 924 925 reply(530, "Login incorrect."); 926 if (logging) 927 syslog(LOG_NOTICE, 928 "FTP LOGIN FAILED FROM %s(%s), %s", 929 remotehost, 930 data_addr, 931 curname); 932 pw = NULL; 933 if (login_attempts++ >= 5) { 934 syslog(LOG_NOTICE, 935 "repeated login failures from %s(%s)", 936 remotehost, 937 data_addr); 938 exit(0); 939 } 940 return; 941 } 942 } 943 if(!do_login(230, passwd)) 944 return; 945 946 /* Forget all about it... */ 947 end_login(); 948 } 949 950 void retrieve(const char * cmd,char * name)951 retrieve(const char *cmd, char *name) 952 { 953 FILE *fin = NULL, *dout; 954 struct stat st; 955 int (*closefunc) (FILE *); 956 char line[BUFSIZ]; 957 958 959 if (cmd == 0) { 960 fin = fopen(name, "r"); 961 closefunc = fclose; 962 st.st_size = 0; 963 if(fin == NULL){ 964 int save_errno = errno; 965 struct cmds { 966 const char *ext; 967 const char *cmd; 968 const char *rev_cmd; 969 } cmds[] = { 970 {".tar", "/bin/gtar cPf - %s", NULL}, 971 {".tar.gz", "/bin/gtar zcPf - %s", NULL}, 972 {".tar.Z", "/bin/gtar ZcPf - %s", NULL}, 973 {".gz", "/bin/gzip -c -- %s", "/bin/gzip -c -d -- %s"}, 974 {".Z", "/bin/compress -c -- %s", "/bin/uncompress -c -- %s"}, 975 {NULL, NULL} 976 }; 977 struct cmds *p; 978 for(p = cmds; p->ext; p++){ 979 char *tail = name + strlen(name) - strlen(p->ext); 980 char c = *tail; 981 982 if(strcmp(tail, p->ext) == 0 && 983 (*tail = 0) == 0 && 984 access(name, R_OK) == 0){ 985 snprintf (line, sizeof(line), p->cmd, name); 986 *tail = c; 987 break; 988 } 989 *tail = c; 990 if (p->rev_cmd != NULL) { 991 char *ext; 992 int ret; 993 994 ret = asprintf(&ext, "%s%s", name, p->ext); 995 if (ret != -1) { 996 if (access(ext, R_OK) == 0) { 997 snprintf (line, sizeof(line), 998 p->rev_cmd, ext); 999 free(ext); 1000 break; 1001 } 1002 free(ext); 1003 } 1004 } 1005 1006 } 1007 if(p->ext){ 1008 fin = ftpd_popen(line, "r", 0, 0); 1009 closefunc = ftpd_pclose; 1010 st.st_size = -1; 1011 cmd = line; 1012 } else 1013 errno = save_errno; 1014 } 1015 } else { 1016 snprintf(line, sizeof(line), cmd, name); 1017 name = line; 1018 fin = ftpd_popen(line, "r", 1, 0); 1019 closefunc = ftpd_pclose; 1020 st.st_size = -1; 1021 } 1022 if (fin == NULL) { 1023 if (errno != 0) { 1024 perror_reply(550, name); 1025 if (cmd == 0) { 1026 LOGCMD("get", name); 1027 } 1028 } 1029 return; 1030 } 1031 byte_count = -1; 1032 if (cmd == 0){ 1033 if(fstat(fileno(fin), &st) < 0 || !S_ISREG(st.st_mode)) { 1034 reply(550, "%s: not a plain file.", name); 1035 goto done; 1036 } 1037 } 1038 if (restart_point) { 1039 if (type == TYPE_A) { 1040 off_t i, n; 1041 int c; 1042 1043 n = restart_point; 1044 i = 0; 1045 while (i++ < n) { 1046 if ((c=getc(fin)) == EOF) { 1047 perror_reply(550, name); 1048 goto done; 1049 } 1050 if (c == '\n') 1051 i++; 1052 } 1053 } else if (lseek(fileno(fin), restart_point, SEEK_SET) < 0) { 1054 perror_reply(550, name); 1055 goto done; 1056 } 1057 } 1058 dout = dataconn(name, st.st_size, "w"); 1059 if (dout == NULL) 1060 goto done; 1061 set_buffer_size(fileno(dout), 0); 1062 send_data(fin, dout); 1063 fclose(dout); 1064 data = -1; 1065 pdata = -1; 1066 done: 1067 if (cmd == 0) 1068 LOGBYTES("get", name, byte_count); 1069 (*closefunc)(fin); 1070 } 1071 1072 /* filename sanity check */ 1073 1074 int filename_check(char * filename)1075 filename_check(char *filename) 1076 { 1077 char *p; 1078 1079 p = strrchr(filename, '/'); 1080 if(p) 1081 filename = p + 1; 1082 1083 p = filename; 1084 1085 if(isalnum((unsigned char)*p)){ 1086 p++; 1087 while(*p && (isalnum((unsigned char)*p) || strchr(good_chars, (unsigned char)*p))) 1088 p++; 1089 if(*p == '\0') 1090 return 0; 1091 } 1092 lreply(553, "\"%s\" is not an acceptable filename.", filename); 1093 lreply(553, "The filename must start with an alphanumeric " 1094 "character and must only"); 1095 reply(553, "consist of alphanumeric characters or any of the following: %s", 1096 good_chars); 1097 return 1; 1098 } 1099 1100 void do_store(char * name,char * mode,int unique)1101 do_store(char *name, char *mode, int unique) 1102 { 1103 FILE *fout, *din; 1104 struct stat st; 1105 int (*closefunc) (FILE *); 1106 1107 if(guest && filename_check(name)) 1108 return; 1109 if (unique) { 1110 char *uname; 1111 if (stat(name, &st) == 0) { 1112 if ((uname = gunique(name)) == NULL) 1113 return; 1114 name = uname; 1115 } 1116 LOGCMD(*mode == 'w' ? "put" : "append", name); 1117 } 1118 1119 if (restart_point) 1120 mode = "r+"; 1121 fout = fopen(name, mode); 1122 closefunc = fclose; 1123 if (fout == NULL) { 1124 perror_reply(553, name); 1125 LOGCMD(*mode == 'w' ? "put" : "append", name); 1126 return; 1127 } 1128 byte_count = -1; 1129 if (restart_point) { 1130 if (type == TYPE_A) { 1131 off_t i, n; 1132 int c; 1133 1134 n = restart_point; 1135 i = 0; 1136 while (i++ < n) { 1137 if ((c=getc(fout)) == EOF) { 1138 perror_reply(550, name); 1139 goto done; 1140 } 1141 if (c == '\n') 1142 i++; 1143 } 1144 /* 1145 * We must do this seek to "current" position 1146 * because we are changing from reading to 1147 * writing. 1148 */ 1149 if (fseek(fout, 0L, SEEK_CUR) < 0) { 1150 perror_reply(550, name); 1151 goto done; 1152 } 1153 } else if (lseek(fileno(fout), restart_point, SEEK_SET) < 0) { 1154 perror_reply(550, name); 1155 goto done; 1156 } 1157 } 1158 din = dataconn(name, (off_t)-1, "r"); 1159 if (din == NULL) 1160 goto done; 1161 set_buffer_size(fileno(din), 1); 1162 if (receive_data(din, fout) == 0) { 1163 if((*closefunc)(fout) < 0) 1164 perror_reply(552, name); 1165 else { 1166 if (unique) 1167 reply(226, "Transfer complete (unique file name:%s).", 1168 name); 1169 else 1170 reply(226, "Transfer complete."); 1171 } 1172 } else 1173 (*closefunc)(fout); 1174 fclose(din); 1175 data = -1; 1176 pdata = -1; 1177 done: 1178 LOGBYTES(*mode == 'w' ? "put" : "append", name, byte_count); 1179 } 1180 1181 static FILE * getdatasock(const char * mode,int domain)1182 getdatasock(const char *mode, int domain) 1183 { 1184 int s, t, tries; 1185 1186 if (data >= 0) 1187 return (fdopen(data, mode)); 1188 if (seteuid(0) < 0) 1189 fatal("Failed to seteuid"); 1190 s = socket(domain, SOCK_STREAM, 0); 1191 if (s < 0) 1192 goto bad; 1193 socket_set_reuseaddr (s, 1); 1194 /* anchor socket to avoid multi-homing problems */ 1195 socket_set_address_and_port (data_source, 1196 socket_get_address (ctrl_addr), 1197 socket_get_port (data_source)); 1198 1199 for (tries = 1; ; tries++) { 1200 if (bind(s, data_source, 1201 socket_sockaddr_size (data_source)) >= 0) 1202 break; 1203 if (errno != EADDRINUSE || tries > 10) 1204 goto bad; 1205 sleep(tries); 1206 } 1207 if (seteuid(pw->pw_uid) < 0) 1208 fatal("Failed to seteuid"); 1209 #ifdef IPTOS_THROUGHPUT 1210 socket_set_tos (s, IPTOS_THROUGHPUT); 1211 #endif 1212 return (fdopen(s, mode)); 1213 bad: 1214 /* Return the real value of errno (close may change it) */ 1215 t = errno; 1216 if (seteuid((uid_t)pw->pw_uid) < 0) 1217 fatal("Failed to seteuid"); 1218 close(s); 1219 errno = t; 1220 return (NULL); 1221 } 1222 1223 static int accept_with_timeout(int socket,struct sockaddr * address,socklen_t * address_len,struct timeval * timeout)1224 accept_with_timeout(int socket, 1225 struct sockaddr *address, 1226 socklen_t *address_len, 1227 struct timeval *timeout) 1228 { 1229 int ret; 1230 fd_set rfd; 1231 FD_ZERO(&rfd); 1232 FD_SET(socket, &rfd); 1233 ret = select(socket + 1, &rfd, NULL, NULL, timeout); 1234 if(ret < 0) 1235 return ret; 1236 if(ret == 0) { 1237 errno = ETIMEDOUT; 1238 return -1; 1239 } 1240 return accept(socket, address, address_len); 1241 } 1242 1243 static FILE * dataconn(const char * name,off_t size,const char * mode)1244 dataconn(const char *name, off_t size, const char *mode) 1245 { 1246 char sizebuf[32]; 1247 FILE *file; 1248 int domain, retry = 0; 1249 1250 file_size = size; 1251 byte_count = 0; 1252 if (size >= 0) 1253 snprintf(sizebuf, sizeof(sizebuf), " (%ld bytes)", (long)size); 1254 else 1255 *sizebuf = '\0'; 1256 if (pdata >= 0) { 1257 struct sockaddr_storage from_ss; 1258 struct sockaddr *from = (struct sockaddr *)&from_ss; 1259 struct timeval timeout; 1260 int s; 1261 socklen_t fromlen = sizeof(from_ss); 1262 1263 timeout.tv_sec = 15; 1264 timeout.tv_usec = 0; 1265 s = accept_with_timeout(pdata, from, &fromlen, &timeout); 1266 if (s < 0) { 1267 reply(425, "Can't open data connection."); 1268 close(pdata); 1269 pdata = -1; 1270 return (NULL); 1271 } 1272 close(pdata); 1273 pdata = s; 1274 #if defined(IPTOS_THROUGHPUT) 1275 if (from->sa_family == AF_INET) 1276 socket_set_tos(s, IPTOS_THROUGHPUT); 1277 #endif 1278 reply(150, "Opening %s mode data connection for '%s'%s.", 1279 type == TYPE_A ? "ASCII" : "BINARY", name, sizebuf); 1280 return (fdopen(pdata, mode)); 1281 } 1282 if (data >= 0) { 1283 reply(125, "Using existing data connection for '%s'%s.", 1284 name, sizebuf); 1285 usedefault = 1; 1286 return (fdopen(data, mode)); 1287 } 1288 if (usedefault) 1289 data_dest = his_addr; 1290 usedefault = 1; 1291 /* 1292 * Default to using the same socket type as the ctrl address, 1293 * unless we know the type of the data address. 1294 */ 1295 domain = data_dest->sa_family; 1296 if (domain == PF_UNSPEC) 1297 domain = ctrl_addr->sa_family; 1298 1299 file = getdatasock(mode, domain); 1300 if (file == NULL) { 1301 char data_addr[256]; 1302 1303 if (inet_ntop (data_source->sa_family, 1304 socket_get_address(data_source), 1305 data_addr, sizeof(data_addr)) == NULL) 1306 strlcpy (data_addr, "unknown address", 1307 sizeof(data_addr)); 1308 1309 reply(425, "Can't create data socket (%s,%d): %s.", 1310 data_addr, 1311 socket_get_port (data_source), 1312 strerror(errno)); 1313 return (NULL); 1314 } 1315 data = fileno(file); 1316 while (connect(data, data_dest, 1317 socket_sockaddr_size(data_dest)) < 0) { 1318 if (errno == EADDRINUSE && retry < swaitmax) { 1319 sleep(swaitint); 1320 retry += swaitint; 1321 continue; 1322 } 1323 perror_reply(425, "Can't build data connection"); 1324 fclose(file); 1325 data = -1; 1326 return (NULL); 1327 } 1328 reply(150, "Opening %s mode data connection for '%s'%s.", 1329 type == TYPE_A ? "ASCII" : "BINARY", name, sizebuf); 1330 return (file); 1331 } 1332 1333 /* 1334 * Tranfer the contents of "instr" to "outstr" peer using the appropriate 1335 * encapsulation of the data subject * to Mode, Structure, and Type. 1336 * 1337 * NB: Form isn't handled. 1338 */ 1339 static void send_data(FILE * instr,FILE * outstr)1340 send_data(FILE *instr, FILE *outstr) 1341 { 1342 int c, cnt, filefd, netfd; 1343 static char *buf; 1344 static size_t bufsize; 1345 1346 transflag = 1; 1347 switch (type) { 1348 1349 case TYPE_A: 1350 while ((c = getc(instr)) != EOF) { 1351 if (urgflag && handleoobcmd()) 1352 return; 1353 byte_count++; 1354 if(c == '\n') 1355 sec_putc('\r', outstr); 1356 sec_putc(c, outstr); 1357 } 1358 sec_fflush(outstr); 1359 transflag = 0; 1360 urgflag = 0; 1361 if (ferror(instr)) 1362 goto file_err; 1363 if (ferror(outstr)) 1364 goto data_err; 1365 reply(226, "Transfer complete."); 1366 return; 1367 1368 case TYPE_I: 1369 case TYPE_L: 1370 #if 0 /* XXX handle urg flag */ 1371 #if defined(HAVE_MMAP) && !defined(NO_MMAP) 1372 #ifndef MAP_FAILED 1373 #define MAP_FAILED (-1) 1374 #endif 1375 { 1376 struct stat st; 1377 char *chunk; 1378 int in = fileno(instr); 1379 if(fstat(in, &st) == 0 && S_ISREG(st.st_mode) 1380 && st.st_size > 0) { 1381 /* 1382 * mmap zero bytes has potential of loosing, don't do it. 1383 */ 1384 chunk = mmap(0, st.st_size, PROT_READ, 1385 MAP_SHARED, in, 0); 1386 if((void *)chunk != (void *)MAP_FAILED) { 1387 cnt = st.st_size - restart_point; 1388 sec_write(fileno(outstr), chunk + restart_point, cnt); 1389 if (munmap(chunk, st.st_size) < 0) 1390 warn ("munmap"); 1391 sec_fflush(outstr); 1392 byte_count = cnt; 1393 transflag = 0; 1394 urgflag = 0; 1395 } 1396 } 1397 } 1398 #endif 1399 #endif 1400 if(transflag) { 1401 struct stat st; 1402 1403 netfd = fileno(outstr); 1404 filefd = fileno(instr); 1405 buf = alloc_buffer (buf, &bufsize, 1406 fstat(filefd, &st) >= 0 ? &st : NULL); 1407 if (buf == NULL) { 1408 transflag = 0; 1409 urgflag = 0; 1410 perror_reply(451, "Local resource failure: malloc"); 1411 return; 1412 } 1413 while ((cnt = read(filefd, buf, bufsize)) > 0 && 1414 sec_write(netfd, buf, cnt) == cnt) { 1415 byte_count += cnt; 1416 if (urgflag && handleoobcmd()) 1417 return; 1418 } 1419 sec_fflush(outstr); /* to end an encrypted stream */ 1420 transflag = 0; 1421 urgflag = 0; 1422 if (cnt != 0) { 1423 if (cnt < 0) 1424 goto file_err; 1425 goto data_err; 1426 } 1427 } 1428 reply(226, "Transfer complete."); 1429 return; 1430 default: 1431 transflag = 0; 1432 urgflag = 0; 1433 reply(550, "Unimplemented TYPE %d in send_data", type); 1434 return; 1435 } 1436 1437 data_err: 1438 transflag = 0; 1439 urgflag = 0; 1440 perror_reply(426, "Data connection"); 1441 return; 1442 1443 file_err: 1444 transflag = 0; 1445 urgflag = 0; 1446 perror_reply(551, "Error on input file"); 1447 } 1448 1449 /* 1450 * Transfer data from peer to "outstr" using the appropriate encapulation of 1451 * the data subject to Mode, Structure, and Type. 1452 * 1453 * N.B.: Form isn't handled. 1454 */ 1455 static int receive_data(FILE * instr,FILE * outstr)1456 receive_data(FILE *instr, FILE *outstr) 1457 { 1458 int cnt, bare_lfs = 0; 1459 static char *buf; 1460 static size_t bufsize; 1461 struct stat st; 1462 1463 transflag = 1; 1464 1465 buf = alloc_buffer (buf, &bufsize, 1466 fstat(fileno(outstr), &st) >= 0 ? &st : NULL); 1467 if (buf == NULL) { 1468 transflag = 0; 1469 urgflag = 0; 1470 perror_reply(451, "Local resource failure: malloc"); 1471 return -1; 1472 } 1473 1474 switch (type) { 1475 1476 case TYPE_I: 1477 case TYPE_L: 1478 while ((cnt = sec_read(fileno(instr), buf, bufsize)) > 0) { 1479 if (write(fileno(outstr), buf, cnt) != cnt) 1480 goto file_err; 1481 byte_count += cnt; 1482 if (urgflag && handleoobcmd()) 1483 return (-1); 1484 } 1485 if (cnt < 0) 1486 goto data_err; 1487 transflag = 0; 1488 urgflag = 0; 1489 return (0); 1490 1491 case TYPE_E: 1492 reply(553, "TYPE E not implemented."); 1493 transflag = 0; 1494 urgflag = 0; 1495 return (-1); 1496 1497 case TYPE_A: 1498 { 1499 char *p, *q; 1500 int cr_flag = 0; 1501 while ((cnt = sec_read(fileno(instr), 1502 buf + cr_flag, 1503 bufsize - cr_flag)) > 0){ 1504 if (urgflag && handleoobcmd()) 1505 return (-1); 1506 byte_count += cnt; 1507 cnt += cr_flag; 1508 cr_flag = 0; 1509 for(p = buf, q = buf; p < buf + cnt;) { 1510 if(*p == '\n') 1511 bare_lfs++; 1512 if(*p == '\r') { 1513 if(p == buf + cnt - 1){ 1514 cr_flag = 1; 1515 p++; 1516 continue; 1517 }else if(p[1] == '\n'){ 1518 *q++ = '\n'; 1519 p += 2; 1520 continue; 1521 } 1522 } 1523 *q++ = *p++; 1524 } 1525 fwrite(buf, q - buf, 1, outstr); 1526 if(cr_flag) 1527 buf[0] = '\r'; 1528 } 1529 if(cr_flag) 1530 putc('\r', outstr); 1531 fflush(outstr); 1532 if (ferror(instr)) 1533 goto data_err; 1534 if (ferror(outstr)) 1535 goto file_err; 1536 transflag = 0; 1537 urgflag = 0; 1538 if (bare_lfs) { 1539 lreply(226, "WARNING! %d bare linefeeds received in ASCII mode\r\n" 1540 " File may not have transferred correctly.\r\n", 1541 bare_lfs); 1542 } 1543 return (0); 1544 } 1545 default: 1546 reply(550, "Unimplemented TYPE %d in receive_data", type); 1547 transflag = 0; 1548 urgflag = 0; 1549 return (-1); 1550 } 1551 1552 data_err: 1553 transflag = 0; 1554 urgflag = 0; 1555 perror_reply(426, "Data Connection"); 1556 return (-1); 1557 1558 file_err: 1559 transflag = 0; 1560 urgflag = 0; 1561 perror_reply(452, "Error writing file"); 1562 return (-1); 1563 } 1564 1565 void statfilecmd(char * filename)1566 statfilecmd(char *filename) 1567 { 1568 FILE *fin; 1569 int c; 1570 char line[LINE_MAX]; 1571 1572 snprintf(line, sizeof(line), "/bin/ls -la -- %s", filename); 1573 fin = ftpd_popen(line, "r", 1, 0); 1574 lreply(211, "status of %s:", filename); 1575 while ((c = getc(fin)) != EOF) { 1576 if (c == '\n') { 1577 if (ferror(stdout)){ 1578 perror_reply(421, "control connection"); 1579 ftpd_pclose(fin); 1580 dologout(1); 1581 /* NOTREACHED */ 1582 } 1583 if (ferror(fin)) { 1584 perror_reply(551, filename); 1585 ftpd_pclose(fin); 1586 return; 1587 } 1588 putc('\r', stdout); 1589 } 1590 putc(c, stdout); 1591 } 1592 ftpd_pclose(fin); 1593 reply(211, "End of Status"); 1594 } 1595 1596 void statcmd(void)1597 statcmd(void) 1598 { 1599 #if 0 1600 struct sockaddr_in *sin; 1601 u_char *a, *p; 1602 1603 lreply(211, "%s FTP server (%s) status:", hostname, version); 1604 printf(" %s\r\n", version); 1605 printf(" Connected to %s", remotehost); 1606 if (!isdigit((unsigned char)remotehost[0])) 1607 printf(" (%s)", inet_ntoa(his_addr.sin_addr)); 1608 printf("\r\n"); 1609 if (logged_in) { 1610 if (guest) 1611 printf(" Logged in anonymously\r\n"); 1612 else 1613 printf(" Logged in as %s\r\n", pw->pw_name); 1614 } else if (askpasswd) 1615 printf(" Waiting for password\r\n"); 1616 else 1617 printf(" Waiting for user name\r\n"); 1618 printf(" TYPE: %s", typenames[type]); 1619 if (type == TYPE_A || type == TYPE_E) 1620 printf(", FORM: %s", formnames[form]); 1621 if (type == TYPE_L) 1622 #if NBBY == 8 1623 printf(" %d", NBBY); 1624 #else 1625 printf(" %d", bytesize); /* need definition! */ 1626 #endif 1627 printf("; STRUcture: %s; transfer MODE: %s\r\n", 1628 strunames[stru], modenames[mode]); 1629 if (data != -1) 1630 printf(" Data connection open\r\n"); 1631 else if (pdata != -1) { 1632 printf(" in Passive mode"); 1633 sin = &pasv_addr; 1634 goto printaddr; 1635 } else if (usedefault == 0) { 1636 printf(" PORT"); 1637 sin = &data_dest; 1638 printaddr: 1639 a = (u_char *) &sin->sin_addr; 1640 p = (u_char *) &sin->sin_port; 1641 #define UC(b) (((int) b) & 0xff) 1642 printf(" (%d,%d,%d,%d,%d,%d)\r\n", UC(a[0]), 1643 UC(a[1]), UC(a[2]), UC(a[3]), UC(p[0]), UC(p[1])); 1644 #undef UC 1645 } else 1646 printf(" No data connection\r\n"); 1647 #endif 1648 reply(211, "End of status"); 1649 } 1650 1651 void fatal(char * s)1652 fatal(char *s) 1653 { 1654 1655 reply(451, "Error in server: %s\n", s); 1656 reply(221, "Closing connection due to server error."); 1657 dologout(0); 1658 /* NOTREACHED */ 1659 } 1660 1661 static void 1662 int_reply(int, char *, const char *, va_list) 1663 #ifdef __GNUC__ 1664 __attribute__ ((format (printf, 3, 0))) 1665 #endif 1666 ; 1667 1668 static void int_reply(int n,char * c,const char * fmt,va_list ap)1669 int_reply(int n, char *c, const char *fmt, va_list ap) 1670 { 1671 char buf[10240]; 1672 char *p; 1673 p=buf; 1674 if(n){ 1675 snprintf(p, sizeof(buf), "%d%s", n, c); 1676 p+=strlen(p); 1677 } 1678 vsnprintf(p, sizeof(buf) - strlen(p), fmt, ap); 1679 p+=strlen(p); 1680 snprintf(p, sizeof(buf) - strlen(p), "\r\n"); 1681 p+=strlen(p); 1682 sec_fprintf(stdout, "%s", buf); 1683 fflush(stdout); 1684 if (debug) 1685 syslog(LOG_DEBUG, "<--- %s- ", buf); 1686 } 1687 1688 void reply(int n,const char * fmt,...)1689 reply(int n, const char *fmt, ...) 1690 { 1691 va_list ap; 1692 va_start(ap, fmt); 1693 int_reply(n, " ", fmt, ap); 1694 delete_ftp_command(); 1695 va_end(ap); 1696 } 1697 1698 void lreply(int n,const char * fmt,...)1699 lreply(int n, const char *fmt, ...) 1700 { 1701 va_list ap; 1702 va_start(ap, fmt); 1703 int_reply(n, "-", fmt, ap); 1704 va_end(ap); 1705 } 1706 1707 void nreply(const char * fmt,...)1708 nreply(const char *fmt, ...) 1709 { 1710 va_list ap; 1711 va_start(ap, fmt); 1712 int_reply(0, NULL, fmt, ap); 1713 va_end(ap); 1714 } 1715 1716 static void ack(char * s)1717 ack(char *s) 1718 { 1719 1720 reply(250, "%s command successful.", s); 1721 } 1722 1723 void nack(char * s)1724 nack(char *s) 1725 { 1726 1727 reply(502, "%s command not implemented.", s); 1728 } 1729 1730 void do_delete(char * name)1731 do_delete(char *name) 1732 { 1733 struct stat st; 1734 1735 LOGCMD("delete", name); 1736 if (stat(name, &st) < 0) { 1737 perror_reply(550, name); 1738 return; 1739 } 1740 if (S_ISDIR(st.st_mode)) { 1741 if (rmdir(name) < 0) { 1742 perror_reply(550, name); 1743 return; 1744 } 1745 goto done; 1746 } 1747 if (unlink(name) < 0) { 1748 perror_reply(550, name); 1749 return; 1750 } 1751 done: 1752 ack("DELE"); 1753 } 1754 1755 void cwd(const char * path)1756 cwd(const char *path) 1757 { 1758 1759 if (chdir(path) < 0) 1760 perror_reply(550, path); 1761 else 1762 ack("CWD"); 1763 } 1764 1765 void makedir(char * name)1766 makedir(char *name) 1767 { 1768 1769 LOGCMD("mkdir", name); 1770 if(guest && filename_check(name)) 1771 return; 1772 if (mkdir(name, 0777) < 0) 1773 perror_reply(550, name); 1774 else{ 1775 if(guest) 1776 chmod(name, 0700); /* guest has umask 777 */ 1777 reply(257, "MKD command successful."); 1778 } 1779 } 1780 1781 void removedir(char * name)1782 removedir(char *name) 1783 { 1784 1785 LOGCMD("rmdir", name); 1786 if (rmdir(name) < 0) 1787 perror_reply(550, name); 1788 else 1789 ack("RMD"); 1790 } 1791 1792 void pwd(void)1793 pwd(void) 1794 { 1795 char path[MaxPathLen]; 1796 char *ret; 1797 1798 /* SunOS has a broken getcwd that does popen(pwd) (!!!), this 1799 * failes miserably when running chroot 1800 */ 1801 ret = getcwd(path, sizeof(path)); 1802 if (ret == NULL) 1803 reply(550, "%s.", strerror(errno)); 1804 else 1805 reply(257, "\"%s\" is current directory.", path); 1806 } 1807 1808 char * renamefrom(char * name)1809 renamefrom(char *name) 1810 { 1811 struct stat st; 1812 1813 if (stat(name, &st) < 0) { 1814 perror_reply(550, name); 1815 return NULL; 1816 } 1817 reply(350, "File exists, ready for destination name"); 1818 return (name); 1819 } 1820 1821 void renamecmd(char * from,char * to)1822 renamecmd(char *from, char *to) 1823 { 1824 1825 LOGCMD2("rename", from, to); 1826 if(guest && filename_check(to)) 1827 return; 1828 if (rename(from, to) < 0) 1829 perror_reply(550, "rename"); 1830 else 1831 ack("RNTO"); 1832 } 1833 1834 static void dolog(struct sockaddr * sa,int len)1835 dolog(struct sockaddr *sa, int len) 1836 { 1837 getnameinfo_verified (sa, len, remotehost, sizeof(remotehost), 1838 NULL, 0, 0); 1839 #ifdef HAVE_SETPROCTITLE 1840 snprintf(proctitle, sizeof(proctitle), "%s: connected", remotehost); 1841 setproctitle("%s", proctitle); 1842 #endif /* HAVE_SETPROCTITLE */ 1843 1844 if (logging) { 1845 char data_addr[256]; 1846 1847 if (inet_ntop (his_addr->sa_family, 1848 socket_get_address(his_addr), 1849 data_addr, sizeof(data_addr)) == NULL) 1850 strlcpy (data_addr, "unknown address", 1851 sizeof(data_addr)); 1852 1853 1854 syslog(LOG_INFO, "connection from %s(%s)", 1855 remotehost, 1856 data_addr); 1857 } 1858 } 1859 1860 /* 1861 * Record logout in wtmp file 1862 * and exit with supplied status. 1863 */ 1864 void dologout(int status)1865 dologout(int status) 1866 { 1867 transflag = 0; 1868 urgflag = 0; 1869 if (logged_in) { 1870 #if KRB5 1871 cond_kdestroy(); 1872 #endif 1873 seteuid((uid_t)0); /* No need to check, we call exit() below */ 1874 ftpd_logwtmp(ttyline, "", ""); 1875 } 1876 /* beware of flushing buffers after a SIGPIPE */ 1877 #ifdef XXX 1878 exit(status); 1879 #else 1880 _exit(status); 1881 #endif 1882 } 1883 abor(void)1884 void abor(void) 1885 { 1886 if (!transflag) 1887 return; 1888 reply(426, "Transfer aborted. Data connection closed."); 1889 reply(226, "Abort successful"); 1890 transflag = 0; 1891 } 1892 1893 static void myoob(int signo)1894 myoob(int signo) 1895 { 1896 urgflag = 1; 1897 } 1898 1899 static char * mec_space(char * p)1900 mec_space(char *p) 1901 { 1902 while(isspace(*(unsigned char *)p)) 1903 p++; 1904 return p; 1905 } 1906 1907 static int handleoobcmd(void)1908 handleoobcmd(void) 1909 { 1910 char *cp; 1911 1912 /* only process if transfer occurring */ 1913 if (!transflag) 1914 return 0; 1915 1916 urgflag = 0; 1917 1918 cp = tmpline; 1919 if (ftpd_getline(cp, sizeof(tmpline)) == NULL) { 1920 reply(221, "You could at least say goodbye."); 1921 dologout(0); 1922 } 1923 1924 if (strncasecmp("MIC", cp, 3) == 0) { 1925 mec(mec_space(cp + 3), prot_safe); 1926 } else if (strncasecmp("CONF", cp, 4) == 0) { 1927 mec(mec_space(cp + 4), prot_confidential); 1928 } else if (strncasecmp("ENC", cp, 3) == 0) { 1929 mec(mec_space(cp + 3), prot_private); 1930 } else if (!allow_insecure_oob) { 1931 reply(533, "Command protection level denied " 1932 "for paranoid reasons."); 1933 goto out; 1934 } 1935 1936 if (secure_command()) 1937 cp = ftp_command; 1938 1939 if (strcasecmp(cp, "ABOR\r\n") == 0) { 1940 abor(); 1941 } else if (strcasecmp(cp, "STAT\r\n") == 0) { 1942 if (file_size != (off_t) -1) 1943 reply(213, "Status: %ld of %ld bytes transferred", 1944 (long)byte_count, 1945 (long)file_size); 1946 else 1947 reply(213, "Status: %ld bytes transferred", 1948 (long)byte_count); 1949 } 1950 out: 1951 return (transflag == 0); 1952 } 1953 1954 /* 1955 * Note: a response of 425 is not mentioned as a possible response to 1956 * the PASV command in RFC959. However, it has been blessed as 1957 * a legitimate response by Jon Postel in a telephone conversation 1958 * with Rick Adams on 25 Jan 89. 1959 */ 1960 void pasv(void)1961 pasv(void) 1962 { 1963 socklen_t len; 1964 char *p, *a; 1965 struct sockaddr_in *sin; 1966 1967 if (ctrl_addr->sa_family != AF_INET) { 1968 reply(425, 1969 "You cannot do PASV with something that's not IPv4"); 1970 return; 1971 } 1972 1973 if(pdata != -1) 1974 close(pdata); 1975 1976 pdata = socket(ctrl_addr->sa_family, SOCK_STREAM, 0); 1977 if (pdata < 0) { 1978 perror_reply(425, "Can't open passive connection"); 1979 return; 1980 } 1981 pasv_addr->sa_family = ctrl_addr->sa_family; 1982 socket_set_address_and_port (pasv_addr, 1983 socket_get_address (ctrl_addr), 1984 0); 1985 socket_set_portrange(pdata, restricted_data_ports, 1986 pasv_addr->sa_family); 1987 if (seteuid(0) < 0) 1988 fatal("Failed to seteuid"); 1989 if (bind(pdata, pasv_addr, socket_sockaddr_size (pasv_addr)) < 0) { 1990 if (seteuid(pw->pw_uid) < 0) 1991 fatal("Failed to seteuid"); 1992 goto pasv_error; 1993 } 1994 if (seteuid(pw->pw_uid) < 0) 1995 fatal("Failed to seteuid"); 1996 len = sizeof(pasv_addr_ss); 1997 if (getsockname(pdata, pasv_addr, &len) < 0) 1998 goto pasv_error; 1999 if (listen(pdata, 1) < 0) 2000 goto pasv_error; 2001 sin = (struct sockaddr_in *)pasv_addr; 2002 a = (char *) &sin->sin_addr; 2003 p = (char *) &sin->sin_port; 2004 2005 #define UC(b) (((int) b) & 0xff) 2006 2007 reply(227, "Entering Passive Mode (%d,%d,%d,%d,%d,%d)", UC(a[0]), 2008 UC(a[1]), UC(a[2]), UC(a[3]), UC(p[0]), UC(p[1])); 2009 return; 2010 2011 pasv_error: 2012 close(pdata); 2013 pdata = -1; 2014 perror_reply(425, "Can't open passive connection"); 2015 return; 2016 } 2017 2018 void epsv(char * proto)2019 epsv(char *proto) 2020 { 2021 socklen_t len; 2022 2023 pdata = socket(ctrl_addr->sa_family, SOCK_STREAM, 0); 2024 if (pdata < 0) { 2025 perror_reply(425, "Can't open passive connection"); 2026 return; 2027 } 2028 pasv_addr->sa_family = ctrl_addr->sa_family; 2029 socket_set_address_and_port (pasv_addr, 2030 socket_get_address (ctrl_addr), 2031 0); 2032 socket_set_portrange(pdata, restricted_data_ports, 2033 pasv_addr->sa_family); 2034 if (seteuid(0) < 0) 2035 fatal("Failed to seteuid"); 2036 if (bind(pdata, pasv_addr, socket_sockaddr_size (pasv_addr)) < 0) { 2037 if (seteuid(pw->pw_uid)) 2038 fatal("Failed to seteuid"); 2039 goto pasv_error; 2040 } 2041 if (seteuid(pw->pw_uid) < 0) 2042 fatal("Failed to seteuid"); 2043 len = sizeof(pasv_addr_ss); 2044 if (getsockname(pdata, pasv_addr, &len) < 0) 2045 goto pasv_error; 2046 if (listen(pdata, 1) < 0) 2047 goto pasv_error; 2048 2049 reply(229, "Entering Extended Passive Mode (|||%d|)", 2050 ntohs(socket_get_port (pasv_addr))); 2051 return; 2052 2053 pasv_error: 2054 close(pdata); 2055 pdata = -1; 2056 perror_reply(425, "Can't open passive connection"); 2057 return; 2058 } 2059 2060 void eprt(char * str)2061 eprt(char *str) 2062 { 2063 char *end; 2064 char sep; 2065 int af; 2066 int ret; 2067 int port; 2068 2069 usedefault = 0; 2070 if (pdata >= 0) { 2071 close(pdata); 2072 pdata = -1; 2073 } 2074 2075 sep = *str++; 2076 if (sep == '\0') { 2077 reply(500, "Bad syntax in EPRT"); 2078 return; 2079 } 2080 af = strtol (str, &end, 0); 2081 if (af == 0 || *end != sep) { 2082 reply(500, "Bad syntax in EPRT"); 2083 return; 2084 } 2085 str = end + 1; 2086 switch (af) { 2087 #ifdef HAVE_IPV6 2088 case 2 : 2089 data_dest->sa_family = AF_INET6; 2090 break; 2091 #endif 2092 case 1 : 2093 data_dest->sa_family = AF_INET; 2094 break; 2095 default : 2096 reply(522, "Network protocol %d not supported, use (1" 2097 #ifdef HAVE_IPV6 2098 ",2" 2099 #endif 2100 ")", af); 2101 return; 2102 } 2103 end = strchr (str, sep); 2104 if (end == NULL) { 2105 reply(500, "Bad syntax in EPRT"); 2106 return; 2107 } 2108 *end = '\0'; 2109 ret = inet_pton (data_dest->sa_family, str, 2110 socket_get_address (data_dest)); 2111 2112 if (ret != 1) { 2113 reply(500, "Bad address syntax in EPRT"); 2114 return; 2115 } 2116 str = end + 1; 2117 port = strtol (str, &end, 0); 2118 if (port == 0 || *end != sep) { 2119 reply(500, "Bad port syntax in EPRT"); 2120 return; 2121 } 2122 if (port < IPPORT_RESERVED) { 2123 reply(500, "Bad port in invalid range in EPRT"); 2124 return; 2125 } 2126 socket_set_port (data_dest, htons(port)); 2127 2128 if (paranoid && 2129 (data_dest->sa_family != his_addr->sa_family || 2130 memcmp(socket_get_address(data_dest), socket_get_address(his_addr), socket_sockaddr_size(data_dest)) != 0)) 2131 { 2132 reply(500, "Bad address in EPRT"); 2133 } 2134 reply(200, "EPRT command successful."); 2135 } 2136 2137 /* 2138 * Generate unique name for file with basename "local". 2139 * The file named "local" is already known to exist. 2140 * Generates failure reply on error. 2141 */ 2142 static char * gunique(char * local)2143 gunique(char *local) 2144 { 2145 static char new[MaxPathLen]; 2146 struct stat st; 2147 int count; 2148 char *cp; 2149 2150 cp = strrchr(local, '/'); 2151 if (cp) 2152 *cp = '\0'; 2153 if (stat(cp ? local : ".", &st) < 0) { 2154 perror_reply(553, cp ? local : "."); 2155 return NULL; 2156 } 2157 if (cp) 2158 *cp = '/'; 2159 for (count = 1; count < 100; count++) { 2160 snprintf (new, sizeof(new), "%s.%d", local, count); 2161 if (stat(new, &st) < 0) 2162 return (new); 2163 } 2164 reply(452, "Unique file name cannot be created."); 2165 return (NULL); 2166 } 2167 2168 /* 2169 * Format and send reply containing system error number. 2170 */ 2171 void perror_reply(int code,const char * string)2172 perror_reply(int code, const char *string) 2173 { 2174 reply(code, "%s: %s.", string, strerror(errno)); 2175 } 2176 2177 static char *onefile[] = { 2178 "", 2179 0 2180 }; 2181 2182 void list_file(char * file)2183 list_file(char *file) 2184 { 2185 if(use_builtin_ls) { 2186 FILE *dout; 2187 dout = dataconn(file, -1, "w"); 2188 if (dout == NULL) 2189 return; 2190 set_buffer_size(fileno(dout), 0); 2191 if(builtin_ls(dout, file) == 0) 2192 reply(226, "Transfer complete."); 2193 else 2194 reply(451, "Requested action aborted. Local error in processing."); 2195 fclose(dout); 2196 data = -1; 2197 pdata = -1; 2198 } else { 2199 #ifdef HAVE_LS_A 2200 const char *cmd = "/bin/ls -lA %s"; 2201 #else 2202 const char *cmd = "/bin/ls -la %s"; 2203 #endif 2204 retrieve(cmd, file); 2205 } 2206 } 2207 2208 void send_file_list(char * whichf)2209 send_file_list(char *whichf) 2210 { 2211 struct stat st; 2212 DIR *dirp = NULL; 2213 struct dirent *dir; 2214 FILE *dout = NULL; 2215 char **dirlist, *dirname; 2216 int simple = 0; 2217 int freeglob = 0; 2218 glob_t gl; 2219 char buf[MaxPathLen]; 2220 2221 if (strpbrk(whichf, "~{[*?") != NULL) { 2222 int flags = GLOB_BRACE|GLOB_NOCHECK|GLOB_QUOTE|GLOB_TILDE| 2223 #ifdef GLOB_MAXPATH 2224 GLOB_MAXPATH 2225 #else 2226 GLOB_LIMIT 2227 #endif 2228 ; 2229 2230 memset(&gl, 0, sizeof(gl)); 2231 freeglob = 1; 2232 if (glob(whichf, flags, 0, &gl)) { 2233 reply(550, "not found"); 2234 goto out; 2235 } else if (gl.gl_pathc == 0) { 2236 errno = ENOENT; 2237 perror_reply(550, whichf); 2238 goto out; 2239 } 2240 dirlist = gl.gl_pathv; 2241 } else { 2242 onefile[0] = whichf; 2243 dirlist = onefile; 2244 simple = 1; 2245 } 2246 2247 while ((dirname = *dirlist++)) { 2248 2249 if (urgflag && handleoobcmd()) 2250 goto out; 2251 2252 if (stat(dirname, &st) < 0) { 2253 /* 2254 * If user typed "ls -l", etc, and the client 2255 * used NLST, do what the user meant. 2256 */ 2257 if (dirname[0] == '-' && *dirlist == NULL && 2258 transflag == 0) { 2259 list_file(dirname); 2260 goto out; 2261 } 2262 perror_reply(550, whichf); 2263 goto out; 2264 } 2265 2266 if (S_ISREG(st.st_mode)) { 2267 if (dout == NULL) { 2268 dout = dataconn("file list", (off_t)-1, "w"); 2269 if (dout == NULL) 2270 goto out; 2271 transflag = 1; 2272 } 2273 snprintf(buf, sizeof(buf), "%s%s\n", dirname, 2274 type == TYPE_A ? "\r" : ""); 2275 sec_write(fileno(dout), buf, strlen(buf)); 2276 byte_count += strlen(dirname) + 1; 2277 continue; 2278 } else if (!S_ISDIR(st.st_mode)) 2279 continue; 2280 2281 if ((dirp = opendir(dirname)) == NULL) 2282 continue; 2283 2284 while ((dir = readdir(dirp)) != NULL) { 2285 char nbuf[MaxPathLen]; 2286 2287 if (urgflag && handleoobcmd()) 2288 goto out; 2289 2290 if (!strcmp(dir->d_name, ".")) 2291 continue; 2292 if (!strcmp(dir->d_name, "..")) 2293 continue; 2294 2295 snprintf(nbuf, sizeof(nbuf), "%s/%s", dirname, dir->d_name); 2296 2297 /* 2298 * We have to do a stat to insure it's 2299 * not a directory or special file. 2300 */ 2301 if (simple || (stat(nbuf, &st) == 0 && 2302 S_ISREG(st.st_mode))) { 2303 if (dout == NULL) { 2304 dout = dataconn("file list", (off_t)-1, "w"); 2305 if (dout == NULL) 2306 goto out; 2307 transflag = 1; 2308 } 2309 if(strncmp(nbuf, "./", 2) == 0) 2310 snprintf(buf, sizeof(buf), "%s%s\n", nbuf +2, 2311 type == TYPE_A ? "\r" : ""); 2312 else 2313 snprintf(buf, sizeof(buf), "%s%s\n", nbuf, 2314 type == TYPE_A ? "\r" : ""); 2315 sec_write(fileno(dout), buf, strlen(buf)); 2316 byte_count += strlen(nbuf) + 1; 2317 } 2318 } 2319 closedir(dirp); 2320 } 2321 if (dout == NULL) 2322 reply(550, "No files found."); 2323 else if (ferror(dout) != 0) 2324 perror_reply(550, "Data connection"); 2325 else 2326 reply(226, "Transfer complete."); 2327 2328 out: 2329 transflag = 0; 2330 if (dout != NULL){ 2331 sec_write(fileno(dout), buf, 0); /* XXX flush */ 2332 2333 fclose(dout); 2334 } 2335 data = -1; 2336 pdata = -1; 2337 if (freeglob) 2338 globfree(&gl); 2339 } 2340 2341 2342 int find(char * pattern)2343 find(char *pattern) 2344 { 2345 char line[1024]; 2346 FILE *f; 2347 2348 snprintf(line, sizeof(line), 2349 "/bin/locate -d %s -- %s", 2350 ftp_rooted("/etc/locatedb"), 2351 pattern); 2352 f = ftpd_popen(line, "r", 1, 1); 2353 if(f == NULL){ 2354 perror_reply(550, "/bin/locate"); 2355 return 1; 2356 } 2357 lreply(200, "Output from find."); 2358 while(fgets(line, sizeof(line), f)){ 2359 if(line[strlen(line)-1] == '\n') 2360 line[strlen(line)-1] = 0; 2361 nreply("%s", line); 2362 } 2363 reply(200, "Done"); 2364 ftpd_pclose(f); 2365 return 0; 2366 } 2367 2368