xref: /freebsd/libexec/ftpd/ftpd.c (revision a1a4f1a0d87b594d3f17a97dc0127eec1417e6f6)
1 /*
2  * Copyright (c) 1985, 1988, 1990, 1992, 1993, 1994
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. All advertising materials mentioning features or use of this software
14  *    must display the following acknowledgement:
15  *	This product includes software developed by the University of
16  *	California, Berkeley and its contributors.
17  * 4. Neither the name of the University nor the names of its contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  */
33 
34 #if 0
35 #ifndef lint
36 static char copyright[] =
37 "@(#) Copyright (c) 1985, 1988, 1990, 1992, 1993, 1994\n\
38 	The Regents of the University of California.  All rights reserved.\n";
39 #endif /* not lint */
40 #endif
41 
42 #ifndef lint
43 #if 0
44 static char sccsid[] = "@(#)ftpd.c	8.4 (Berkeley) 4/16/94";
45 #endif
46 static const char rcsid[] =
47   "$FreeBSD$";
48 #endif /* not lint */
49 
50 /*
51  * FTP server.
52  */
53 #include <sys/param.h>
54 #include <sys/stat.h>
55 #include <sys/ioctl.h>
56 #include <sys/socket.h>
57 #include <sys/wait.h>
58 #include <sys/mman.h>
59 
60 #include <netinet/in.h>
61 #include <netinet/in_systm.h>
62 #include <netinet/ip.h>
63 #include <netinet/tcp.h>
64 
65 #define	FTP_NAMES
66 #include <arpa/ftp.h>
67 #include <arpa/inet.h>
68 #include <arpa/telnet.h>
69 
70 #include <ctype.h>
71 #include <dirent.h>
72 #include <err.h>
73 #include <errno.h>
74 #include <fcntl.h>
75 #include <glob.h>
76 #include <limits.h>
77 #include <netdb.h>
78 #include <pwd.h>
79 #include <grp.h>
80 #include <setjmp.h>
81 #include <signal.h>
82 #include <stdio.h>
83 #include <stdlib.h>
84 #include <string.h>
85 #include <syslog.h>
86 #include <time.h>
87 #include <unistd.h>
88 #include <libutil.h>
89 #ifdef	LOGIN_CAP
90 #include <login_cap.h>
91 #endif
92 
93 #ifdef	SKEY
94 #include <skey.h>
95 #endif
96 
97 #include "pathnames.h"
98 #include "extern.h"
99 
100 #if __STDC__
101 #include <stdarg.h>
102 #else
103 #include <varargs.h>
104 #endif
105 
106 static char version[] = "Version 6.00LS";
107 #undef main
108 
109 extern	off_t restart_point;
110 extern	char cbuf[];
111 
112 struct	sockaddr_in server_addr;
113 struct	sockaddr_in ctrl_addr;
114 struct	sockaddr_in data_source;
115 struct	sockaddr_in data_dest;
116 struct	sockaddr_in his_addr;
117 struct	sockaddr_in pasv_addr;
118 
119 int	daemon_mode;
120 int	data;
121 jmp_buf	errcatch, urgcatch;
122 int	logged_in;
123 struct	passwd *pw;
124 int	debug;
125 int	timeout = 900;    /* timeout after 15 minutes of inactivity */
126 int	maxtimeout = 7200;/* don't allow idle time to be set beyond 2 hours */
127 int	logging;
128 int	restricted_data_ports = 1;
129 int	paranoid = 1;	  /* be extra careful about security */
130 int	anon_only = 0;    /* Only anonymous ftp allowed */
131 int	guest;
132 int	dochroot;
133 int	stats;
134 int	statfd = -1;
135 int	type;
136 int	form;
137 int	stru;			/* avoid C keyword */
138 int	mode;
139 int	usedefault = 1;		/* for data transfers */
140 int	pdata = -1;		/* for passive mode */
141 sig_atomic_t transflag;
142 off_t	file_size;
143 off_t	byte_count;
144 #if !defined(CMASK) || CMASK == 0
145 #undef CMASK
146 #define CMASK 027
147 #endif
148 int	defumask = CMASK;		/* default umask value */
149 char	tmpline[7];
150 char	*hostname;
151 #ifdef VIRTUAL_HOSTING
152 char	*ftpuser;
153 
154 static struct ftphost {
155 	struct ftphost	*next;
156 	struct in_addr	hostaddr;
157 	char		*hostname;
158 	char		*anonuser;
159 	char		*statfile;
160 	char		*welcome;
161 	char		*loginmsg;
162 } *thishost, *firsthost;
163 
164 #endif
165 char	remotehost[MAXHOSTNAMELEN];
166 char	*ident = NULL;
167 
168 static char ttyline[20];
169 char	*tty = ttyline;		/* for klogin */
170 
171 #ifdef KERBEROS
172 int	 klogin __P((struct passwd *, char *, char *, char *));
173 #endif
174 
175 struct	in_addr bind_address;
176 char	*pid_file = NULL;
177 
178 #if defined(KERBEROS)
179 int	notickets = 1;
180 int	noticketsdontcomplain = 1;
181 char	*krbtkfile_env = NULL;
182 #endif
183 
184 /*
185  * Timeout intervals for retrying connections
186  * to hosts that don't accept PORT cmds.  This
187  * is a kludge, but given the problems with TCP...
188  */
189 #define	SWAITMAX	90	/* wait at most 90 seconds */
190 #define	SWAITINT	5	/* interval between retries */
191 
192 int	swaitmax = SWAITMAX;
193 int	swaitint = SWAITINT;
194 
195 #ifdef SETPROCTITLE
196 #ifdef OLD_SETPROCTITLE
197 char	**Argv = NULL;		/* pointer to argument vector */
198 char	*LastArgv = NULL;	/* end of argv */
199 #endif /* OLD_SETPROCTITLE */
200 char	proctitle[LINE_MAX];	/* initial part of title */
201 #endif /* SETPROCTITLE */
202 
203 #ifdef SKEY
204 int	pwok = 0;
205 char	addr_string[20];	/* XXX */
206 #endif
207 
208 #define LOGCMD(cmd, file) \
209 	if (logging > 1) \
210 	    syslog(LOG_INFO,"%s %s%s", cmd, \
211 		*(file) == '/' ? "" : curdir(), file);
212 #define LOGCMD2(cmd, file1, file2) \
213 	 if (logging > 1) \
214 	    syslog(LOG_INFO,"%s %s%s %s%s", cmd, \
215 		*(file1) == '/' ? "" : curdir(), file1, \
216 		*(file2) == '/' ? "" : curdir(), file2);
217 #define LOGBYTES(cmd, file, cnt) \
218 	if (logging > 1) { \
219 		if (cnt == (off_t)-1) \
220 		    syslog(LOG_INFO,"%s %s%s", cmd, \
221 			*(file) == '/' ? "" : curdir(), file); \
222 		else \
223 		    syslog(LOG_INFO, "%s %s%s = %qd bytes", \
224 			cmd, (*(file) == '/') ? "" : curdir(), file, cnt); \
225 	}
226 
227 #ifdef VIRTUAL_HOSTING
228 static void	 inithosts __P((void));
229 static void	selecthost __P((struct in_addr *));
230 #endif
231 static void	 ack __P((char *));
232 static void	 myoob __P((int));
233 static int	 checkuser __P((char *, char *, int));
234 static FILE	*dataconn __P((char *, off_t, char *));
235 static void	 dolog __P((struct sockaddr_in *));
236 static char	*curdir __P((void));
237 static void	 end_login __P((void));
238 static FILE	*getdatasock __P((char *));
239 static char	*gunique __P((char *));
240 static void	 lostconn __P((int));
241 static int	 receive_data __P((FILE *, FILE *));
242 static void	 send_data __P((FILE *, FILE *, off_t, off_t, int));
243 static struct passwd *
244 		 sgetpwnam __P((char *));
245 static char	*sgetsave __P((char *));
246 static void	 reapchild __P((int));
247 static void      logxfer __P((char *, long, long));
248 
249 static char *
250 curdir()
251 {
252 	static char path[MAXPATHLEN+1+1];	/* path + '/' + '\0' */
253 
254 	if (getcwd(path, sizeof(path)-2) == NULL)
255 		return ("");
256 	if (path[1] != '\0')		/* special case for root dir. */
257 		strcat(path, "/");
258 	/* For guest account, skip / since it's chrooted */
259 	return (guest ? path+1 : path);
260 }
261 
262 int
263 main(argc, argv, envp)
264 	int argc;
265 	char *argv[];
266 	char **envp;
267 {
268 	int addrlen, ch, on = 1, tos;
269 	char *cp, line[LINE_MAX];
270 	FILE *fd;
271 
272 	tzset();		/* in case no timezone database in ~ftp */
273 
274 #ifdef OLD_SETPROCTITLE
275 	/*
276 	 *  Save start and extent of argv for setproctitle.
277 	 */
278 	Argv = argv;
279 	while (*envp)
280 		envp++;
281 	LastArgv = envp[-1] + strlen(envp[-1]);
282 #endif /* OLD_SETPROCTITLE */
283 
284 
285 	bind_address.s_addr = htonl(INADDR_ANY);
286 	while ((ch = getopt(argc, argv, "AdlDSURt:T:u:va:p:")) != -1) {
287 		switch (ch) {
288 		case 'D':
289 			daemon_mode++;
290 			break;
291 
292 		case 'd':
293 			debug++;
294 			break;
295 
296 		case 'l':
297 			logging++;	/* > 1 == extra logging */
298 			break;
299 
300 		case 'R':
301 			paranoid = 0;
302 			break;
303 
304 		case 'S':
305 			stats++;
306 			break;
307 
308 		case 'T':
309 			maxtimeout = atoi(optarg);
310 			if (timeout > maxtimeout)
311 				timeout = maxtimeout;
312 			break;
313 
314 		case 't':
315 			timeout = atoi(optarg);
316 			if (maxtimeout < timeout)
317 				maxtimeout = timeout;
318 			break;
319 
320 		case 'U':
321 			restricted_data_ports = 0;
322 			break;
323 
324 		case 'a':
325 			if (!inet_aton(optarg, &bind_address))
326 				errx(1, "invalid address for -a");
327 			break;
328 
329 		case 'p':
330 			pid_file = optarg;
331 			break;
332 
333 		case 'u':
334 		    {
335 			long val = 0;
336 
337 			val = strtol(optarg, &optarg, 8);
338 			if (*optarg != '\0' || val < 0)
339 				warnx("bad value for -u");
340 			else
341 				defumask = val;
342 			break;
343 		    }
344 		case 'A':
345 			anon_only = 1;
346 			break;
347 
348 		case 'v':
349 			debug = 1;
350 			break;
351 
352 		default:
353 			warnx("unknown flag -%c ignored", optopt);
354 			break;
355 		}
356 	}
357 
358 #ifdef VIRTUAL_HOSTING
359 	inithosts();
360 #endif
361 	(void) freopen(_PATH_DEVNULL, "w", stderr);
362 
363 	/*
364 	 * LOG_NDELAY sets up the logging connection immediately,
365 	 * necessary for anonymous ftp's that chroot and can't do it later.
366 	 */
367 	openlog("ftpd", LOG_PID | LOG_NDELAY, LOG_FTP);
368 
369 	if (daemon_mode) {
370 		int ctl_sock, fd;
371 		struct servent *sv;
372 
373 		/*
374 		 * Detach from parent.
375 		 */
376 		if (daemon(1, 1) < 0) {
377 			syslog(LOG_ERR, "failed to become a daemon");
378 			exit(1);
379 		}
380 		(void) signal(SIGCHLD, reapchild);
381 		/*
382 		 * Get port number for ftp/tcp.
383 		 */
384 		sv = getservbyname("ftp", "tcp");
385 		if (sv == NULL) {
386 			syslog(LOG_ERR, "getservbyname for ftp failed");
387 			exit(1);
388 		}
389 		/*
390 		 * Open a socket, bind it to the FTP port, and start
391 		 * listening.
392 		 */
393 		ctl_sock = socket(AF_INET, SOCK_STREAM, 0);
394 		if (ctl_sock < 0) {
395 			syslog(LOG_ERR, "control socket: %m");
396 			exit(1);
397 		}
398 		if (setsockopt(ctl_sock, SOL_SOCKET, SO_REUSEADDR,
399 		    (char *)&on, sizeof(on)) < 0)
400 			syslog(LOG_ERR, "control setsockopt: %m");;
401 		server_addr.sin_family = AF_INET;
402 		server_addr.sin_addr = bind_address;
403 		server_addr.sin_port = sv->s_port;
404 		if (bind(ctl_sock, (struct sockaddr *)&server_addr, sizeof(server_addr))) {
405 			syslog(LOG_ERR, "control bind: %m");
406 			exit(1);
407 		}
408 		if (listen(ctl_sock, 32) < 0) {
409 			syslog(LOG_ERR, "control listen: %m");
410 			exit(1);
411 		}
412 		/*
413 		 * Atomically write process ID
414 		 */
415 		if (pid_file)
416 		{
417 			int fd;
418 			char buf[20];
419 
420 			fd = open(pid_file, O_CREAT | O_WRONLY | O_TRUNC
421 				| O_NONBLOCK | O_EXLOCK, 0644);
422 			if (fd < 0) {
423 				if (errno == EAGAIN)
424 					errx(1, "%s: file locked", pid_file);
425 				else
426 					err(1, "%s", pid_file);
427 			}
428 			snprintf(buf, sizeof(buf),
429 				"%lu\n", (unsigned long) getpid());
430 			if (write(fd, buf, strlen(buf)) < 0)
431 				err(1, "%s: write", pid_file);
432 			/* Leave the pid file open and locked */
433 		}
434 		/*
435 		 * Loop forever accepting connection requests and forking off
436 		 * children to handle them.
437 		 */
438 		while (1) {
439 			addrlen = sizeof(his_addr);
440 			fd = accept(ctl_sock, (struct sockaddr *)&his_addr, &addrlen);
441 			if (fork() == 0) {
442 				/* child */
443 				(void) dup2(fd, 0);
444 				(void) dup2(fd, 1);
445 				close(ctl_sock);
446 				break;
447 			}
448 			close(fd);
449 		}
450 	} else {
451 		addrlen = sizeof(his_addr);
452 		if (getpeername(0, (struct sockaddr *)&his_addr, &addrlen) < 0) {
453 			syslog(LOG_ERR, "getpeername (%s): %m",argv[0]);
454 			exit(1);
455 		}
456 	}
457 
458 	(void) signal(SIGCHLD, SIG_IGN);
459 	(void) signal(SIGPIPE, lostconn);
460 	if (signal(SIGURG, myoob) == SIG_ERR)
461 		syslog(LOG_ERR, "signal: %m");
462 
463 #ifdef SKEY
464 	strncpy(addr_string, inet_ntoa(his_addr.sin_addr), sizeof(addr_string));
465 #endif
466 	addrlen = sizeof(ctrl_addr);
467 	if (getsockname(0, (struct sockaddr *)&ctrl_addr, &addrlen) < 0) {
468 		syslog(LOG_ERR, "getsockname (%s): %m",argv[0]);
469 		exit(1);
470 	}
471 #ifdef VIRTUAL_HOSTING
472 	/* select our identity from virtual host table */
473 	selecthost(&ctrl_addr.sin_addr);
474 #endif
475 #ifdef IP_TOS
476 	tos = IPTOS_LOWDELAY;
477 	if (setsockopt(0, IPPROTO_IP, IP_TOS, (char *)&tos, sizeof(int)) < 0)
478 		syslog(LOG_WARNING, "setsockopt (IP_TOS): %m");
479 #endif
480 	/*
481 	 * Disable Nagle on the control channel so that we don't have to wait
482 	 * for peer's ACK before issuing our next reply.
483 	 */
484 	if (setsockopt(0, IPPROTO_TCP, TCP_NODELAY, &on, sizeof(on)) < 0)
485 		syslog(LOG_WARNING, "control setsockopt TCP_NODELAY: %m");
486 
487 	data_source.sin_port = htons(ntohs(ctrl_addr.sin_port) - 1);
488 
489 	/* set this here so klogin can use it... */
490 	(void)snprintf(ttyline, sizeof(ttyline), "ftp%d", getpid());
491 
492 	/* Try to handle urgent data inline */
493 #ifdef SO_OOBINLINE
494 	if (setsockopt(0, SOL_SOCKET, SO_OOBINLINE, (char *)&on, sizeof(on)) < 0)
495 		syslog(LOG_ERR, "setsockopt: %m");
496 #endif
497 
498 #ifdef	F_SETOWN
499 	if (fcntl(fileno(stdin), F_SETOWN, getpid()) == -1)
500 		syslog(LOG_ERR, "fcntl F_SETOWN: %m");
501 #endif
502 	dolog(&his_addr);
503 	/*
504 	 * Set up default state
505 	 */
506 	data = -1;
507 	type = TYPE_A;
508 	form = FORM_N;
509 	stru = STRU_F;
510 	mode = MODE_S;
511 	tmpline[0] = '\0';
512 
513 	/* If logins are disabled, print out the message. */
514 	if ((fd = fopen(_PATH_NOLOGIN,"r")) != NULL) {
515 		while (fgets(line, sizeof(line), fd) != NULL) {
516 			if ((cp = strchr(line, '\n')) != NULL)
517 				*cp = '\0';
518 			lreply(530, "%s", line);
519 		}
520 		(void) fflush(stdout);
521 		(void) fclose(fd);
522 		reply(530, "System not available.");
523 		exit(0);
524 	}
525 #ifdef VIRTUAL_HOSTING
526 	if ((fd = fopen(thishost->welcome, "r")) != NULL) {
527 #else
528 	if ((fd = fopen(_PATH_FTPWELCOME, "r")) != NULL) {
529 #endif
530 		while (fgets(line, sizeof(line), fd) != NULL) {
531 			if ((cp = strchr(line, '\n')) != NULL)
532 				*cp = '\0';
533 			lreply(220, "%s", line);
534 		}
535 		(void) fflush(stdout);
536 		(void) fclose(fd);
537 		/* reply(220,) must follow */
538 	}
539 #ifndef VIRTUAL_HOSTING
540 	if ((hostname = malloc(MAXHOSTNAMELEN)) == NULL)
541 		fatal("Ran out of memory.");
542 	(void) gethostname(hostname, MAXHOSTNAMELEN - 1);
543 	hostname[MAXHOSTNAMELEN - 1] = '\0';
544 #endif
545 	reply(220, "%s FTP server (%s) ready.", hostname, version);
546 	(void) setjmp(errcatch);
547 	for (;;)
548 		(void) yyparse();
549 	/* NOTREACHED */
550 }
551 
552 static void
553 lostconn(signo)
554 	int signo;
555 {
556 
557 	if (debug)
558 		syslog(LOG_DEBUG, "lost connection");
559 	dologout(1);
560 }
561 
562 #ifdef VIRTUAL_HOSTING
563 /*
564  * read in virtual host tables (if they exist)
565  */
566 
567 static void
568 inithosts()
569 {
570 	FILE *fp;
571 	char *cp;
572 	struct hostent *hp;
573 	struct ftphost *hrp, *lhrp;
574 	char line[1024];
575 
576 	/*
577 	 * Fill in the default host information
578 	 */
579 	if (gethostname(line, sizeof(line)) < 0)
580 		line[0] = '\0';
581 	if ((hrp = malloc(sizeof(struct ftphost))) == NULL ||
582 	    (hrp->hostname = strdup(line)) == NULL)
583 		fatal("Ran out of memory.");
584 	memset(&hrp->hostaddr, 0, sizeof hrp->hostaddr);
585 	if ((hp = gethostbyname(hrp->hostname)) != NULL)
586 		(void) memcpy(&hrp->hostaddr,
587 			      hp->h_addr_list[0],
588 			      sizeof(hrp->hostaddr));
589 	hrp->statfile = _PATH_FTPDSTATFILE;
590 	hrp->welcome  = _PATH_FTPWELCOME;
591 	hrp->loginmsg = _PATH_FTPLOGINMESG;
592 	hrp->anonuser = "ftp";
593 	hrp->next = NULL;
594 	thishost = firsthost = lhrp = hrp;
595 	if ((fp = fopen(_PATH_FTPHOSTS, "r")) != NULL) {
596 		while (fgets(line, sizeof(line), fp) != NULL) {
597 			int	i;
598 
599 			if ((cp = strchr(line, '\n')) == NULL) {
600 				/* ignore long lines */
601 				while (fgets(line, sizeof(line), fp) != NULL &&
602 					strchr(line, '\n') == NULL)
603 					;
604 				continue;
605 			}
606 			*cp = '\0';
607 			cp = strtok(line, " \t");
608 			/* skip comments and empty lines */
609 			if (cp == NULL || line[0] == '#')
610 				continue;
611 			/* first, try a standard gethostbyname() */
612 			if ((hp = gethostbyname(cp)) == NULL)
613 				continue;
614 			for (hrp = firsthost; hrp != NULL; hrp = hrp->next) {
615 				if (memcmp(&hrp->hostaddr,
616 					   hp->h_addr_list[0],
617 					   sizeof(hrp->hostaddr)) == 0)
618 					break;
619 			}
620 			if (hrp == NULL) {
621 				if ((hrp = malloc(sizeof(struct ftphost))) == NULL)
622 					continue;
623 				/* defaults */
624 				hrp->statfile = _PATH_FTPDSTATFILE;
625 				hrp->welcome  = _PATH_FTPWELCOME;
626 				hrp->loginmsg = _PATH_FTPLOGINMESG;
627 				hrp->anonuser = "ftp";
628 				hrp->next     = NULL;
629 				lhrp->next = hrp;
630 				lhrp = hrp;
631 			}
632 			(void) memcpy(&hrp->hostaddr,
633 				      hp->h_addr_list[0],
634 				      sizeof(hrp->hostaddr));
635 			/*
636 			 * determine hostname to use.
637 			 * force defined name if it is a valid alias
638 			 * otherwise fallback to primary hostname
639 			 */
640 			if ((hp = gethostbyaddr((char*)&hrp->hostaddr,
641 						sizeof(hrp->hostaddr),
642 						AF_INET)) != NULL) {
643 				if (strcmp(cp, hp->h_name) != 0) {
644 					if (hp->h_aliases == NULL)
645 						cp = hp->h_name;
646 					else {
647 						i = 0;
648 						while (hp->h_aliases[i] &&
649 						       strcmp(cp, hp->h_aliases[i]) != 0)
650 							++i;
651 						if (hp->h_aliases[i] == NULL)
652 							cp = hp->h_name;
653 					}
654 				}
655 			}
656 			hrp->hostname = strdup(cp);
657 			/* ok, now we now peel off the rest */
658 			i = 0;
659 			while (i < 4 && (cp = strtok(NULL, " \t")) != NULL) {
660 				if (*cp != '-' && (cp = strdup(cp)) != NULL) {
661 					switch (i) {
662 					case 0:	/* anon user permissions */
663 						hrp->anonuser = cp;
664 						break;
665 					case 1: /* statistics file */
666 						hrp->statfile = cp;
667 						break;
668 					case 2: /* welcome message */
669 						hrp->welcome  = cp;
670 						break;
671 					case 3: /* login message */
672 						hrp->loginmsg = cp;
673 						break;
674 					}
675 				}
676 				++i;
677 			}
678 		}
679 		(void) fclose(fp);
680 	}
681 }
682 
683 static void
684 selecthost(a)
685 	struct in_addr *a;
686 {
687 	struct ftphost	*hrp;
688 
689 	hrp = thishost = firsthost;	/* default */
690 	while (hrp != NULL) {
691 		if (memcmp(a, &hrp->hostaddr, sizeof(hrp->hostaddr)) == 0) {
692 			thishost = hrp;
693 			break;
694 		}
695 		hrp = hrp->next;
696 	}
697 	/* setup static variables as appropriate */
698 	hostname = thishost->hostname;
699 	ftpuser = thishost->anonuser;
700 }
701 #endif
702 
703 /*
704  * Helper function for sgetpwnam().
705  */
706 static char *
707 sgetsave(s)
708 	char *s;
709 {
710 	char *new = malloc((unsigned) strlen(s) + 1);
711 
712 	if (new == NULL) {
713 		perror_reply(421, "Local resource failure: malloc");
714 		dologout(1);
715 		/* NOTREACHED */
716 	}
717 	(void) strcpy(new, s);
718 	return (new);
719 }
720 
721 /*
722  * Save the result of a getpwnam.  Used for USER command, since
723  * the data returned must not be clobbered by any other command
724  * (e.g., globbing).
725  */
726 static struct passwd *
727 sgetpwnam(name)
728 	char *name;
729 {
730 	static struct passwd save;
731 	struct passwd *p;
732 
733 	if ((p = getpwnam(name)) == NULL)
734 		return (p);
735 	if (save.pw_name) {
736 		free(save.pw_name);
737 		free(save.pw_passwd);
738 		free(save.pw_gecos);
739 		free(save.pw_dir);
740 		free(save.pw_shell);
741 	}
742 	save = *p;
743 	save.pw_name = sgetsave(p->pw_name);
744 	save.pw_passwd = sgetsave(p->pw_passwd);
745 	save.pw_gecos = sgetsave(p->pw_gecos);
746 	save.pw_dir = sgetsave(p->pw_dir);
747 	save.pw_shell = sgetsave(p->pw_shell);
748 	return (&save);
749 }
750 
751 static int login_attempts;	/* number of failed login attempts */
752 static int askpasswd;		/* had user command, ask for passwd */
753 static char curname[10];	/* current USER name */
754 
755 /*
756  * USER command.
757  * Sets global passwd pointer pw if named account exists and is acceptable;
758  * sets askpasswd if a PASS command is expected.  If logged in previously,
759  * need to reset state.  If name is "ftp" or "anonymous", the name is not in
760  * _PATH_FTPUSERS, and ftp account exists, set guest and pw, then just return.
761  * If account doesn't exist, ask for passwd anyway.  Otherwise, check user
762  * requesting login privileges.  Disallow anyone who does not have a standard
763  * shell as returned by getusershell().  Disallow anyone mentioned in the file
764  * _PATH_FTPUSERS to allow people such as root and uucp to be avoided.
765  */
766 void
767 user(name)
768 	char *name;
769 {
770 	char *cp, *shell;
771 
772 	if (logged_in) {
773 		if (guest) {
774 			reply(530, "Can't change user from guest login.");
775 			return;
776 		} else if (dochroot) {
777 			reply(530, "Can't change user from chroot user.");
778 			return;
779 		}
780 		end_login();
781 	}
782 
783 	guest = 0;
784 	if (strcmp(name, "ftp") == 0 || strcmp(name, "anonymous") == 0) {
785 		if (checkuser(_PATH_FTPUSERS, "ftp", 0) ||
786 		    checkuser(_PATH_FTPUSERS, "anonymous", 0))
787 			reply(530, "User %s access denied.", name);
788 #ifdef VIRTUAL_HOSTING
789 		else if ((pw = sgetpwnam(thishost->anonuser)) != NULL) {
790 #else
791 		else if ((pw = sgetpwnam("ftp")) != NULL) {
792 #endif
793 			guest = 1;
794 			askpasswd = 1;
795 			reply(331,
796 			"Guest login ok, send your email address as password.");
797 		} else
798 			reply(530, "User %s unknown.", name);
799 		if (!askpasswd && logging)
800 			syslog(LOG_NOTICE,
801 			    "ANONYMOUS FTP LOGIN REFUSED FROM %s", remotehost);
802 		return;
803 	}
804 	if (anon_only != 0) {
805 		reply(530, "Sorry, only anonymous ftp allowed.");
806 		return;
807 	}
808 
809 	if ((pw = sgetpwnam(name))) {
810 		if ((shell = pw->pw_shell) == NULL || *shell == 0)
811 			shell = _PATH_BSHELL;
812 		while ((cp = getusershell()) != NULL)
813 			if (strcmp(cp, shell) == 0)
814 				break;
815 		endusershell();
816 
817 		if (cp == NULL || checkuser(_PATH_FTPUSERS, name, 1)) {
818 			reply(530, "User %s access denied.", name);
819 			if (logging)
820 				syslog(LOG_NOTICE,
821 				    "FTP LOGIN REFUSED FROM %s, %s",
822 				    remotehost, name);
823 			pw = (struct passwd *) NULL;
824 			return;
825 		}
826 	}
827 	if (logging)
828 		strncpy(curname, name, sizeof(curname)-1);
829 #ifdef SKEY
830 	pwok = skeyaccess(name, NULL, remotehost, addr_string);
831 	reply(331, "%s", skey_challenge(name, pw, pwok));
832 #else
833 	reply(331, "Password required for %s.", name);
834 #endif
835 	askpasswd = 1;
836 	/*
837 	 * Delay before reading passwd after first failed
838 	 * attempt to slow down passwd-guessing programs.
839 	 */
840 	if (login_attempts)
841 		sleep((unsigned) login_attempts);
842 }
843 
844 /*
845  * Check if a user is in the file "fname"
846  */
847 static int
848 checkuser(fname, name, pwset)
849 	char *fname;
850 	char *name;
851 	int pwset;
852 {
853 	FILE *fd;
854 	int found = 0;
855 	char *p, line[BUFSIZ];
856 
857 	if ((fd = fopen(fname, "r")) != NULL) {
858 		while (!found && fgets(line, sizeof(line), fd) != NULL)
859 			if ((p = strchr(line, '\n')) != NULL) {
860 				*p = '\0';
861 				if (line[0] == '#')
862 					continue;
863 				/*
864 				 * if first chr is '@', check group membership
865 				 */
866 				if (line[0] == '@') {
867 					int i = 0;
868 					struct group *grp;
869 
870 					if ((grp = getgrnam(line+1)) == NULL)
871 						continue;
872 					/*
873 					 * Check user's default group
874 					 */
875 					if (pwset && grp->gr_gid == pw->pw_gid)
876 						found = 1;
877 					/*
878 					 * Check supplementary groups
879 					 */
880 					while (!found && grp->gr_mem[i])
881 						found = strcmp(name,
882 							grp->gr_mem[i++])
883 							== 0;
884 				}
885 				/*
886 				 * Otherwise, just check for username match
887 				 */
888 				else
889 					found = strcmp(line, name) == 0;
890 			}
891 		(void) fclose(fd);
892 	}
893 	return (found);
894 }
895 
896 /*
897  * Terminate login as previous user, if any, resetting state;
898  * used when USER command is given or login fails.
899  */
900 static void
901 end_login()
902 {
903 
904 	(void) seteuid((uid_t)0);
905 	if (logged_in)
906 		ftpd_logwtmp(ttyline, "", "");
907 	pw = NULL;
908 #ifdef	LOGIN_CAP
909 	setusercontext(NULL, getpwuid(0), (uid_t)0,
910 		       LOGIN_SETPRIORITY|LOGIN_SETRESOURCES|LOGIN_SETUMASK);
911 #endif
912 	logged_in = 0;
913 	guest = 0;
914 	dochroot = 0;
915 }
916 
917 void
918 pass(passwd)
919 	char *passwd;
920 {
921 	int rval;
922 	FILE *fd;
923 #ifdef	LOGIN_CAP
924 	login_cap_t *lc = NULL;
925 #endif
926 
927 	if (logged_in || askpasswd == 0) {
928 		reply(503, "Login with USER first.");
929 		return;
930 	}
931 	askpasswd = 0;
932 	if (!guest) {		/* "ftp" is only account allowed no password */
933 		if (pw == NULL) {
934 			rval = 1;	/* failure below */
935 			goto skip;
936 		}
937 #if defined(KERBEROS)
938 		rval = klogin(pw, "", hostname, passwd);
939 		if (rval == 0)
940 			goto skip;
941 #endif
942 #ifdef SKEY
943 		rval = strcmp(skey_crypt(passwd, pw->pw_passwd, pw, pwok),
944 			      pw->pw_passwd);
945 		pwok = 0;
946 #else
947 		rval = strcmp(crypt(passwd, pw->pw_passwd), pw->pw_passwd);
948 #endif
949 		/* The strcmp does not catch null passwords! */
950 		if (*pw->pw_passwd == '\0' ||
951 		    (pw->pw_expire && time(NULL) >= pw->pw_expire))
952 			rval = 1;	/* failure */
953 skip:
954 		/*
955 		 * If rval == 1, the user failed the authentication check
956 		 * above.  If rval == 0, either Kerberos or local authentication
957 		 * succeeded.
958 		 */
959 		if (rval) {
960 			reply(530, "Login incorrect.");
961 			if (logging)
962 				syslog(LOG_NOTICE,
963 				    "FTP LOGIN FAILED FROM %s, %s",
964 				    remotehost, curname);
965 			pw = NULL;
966 			if (login_attempts++ >= 5) {
967 				syslog(LOG_NOTICE,
968 				    "repeated login failures from %s",
969 				    remotehost);
970 				exit(0);
971 			}
972 			return;
973 		}
974 	}
975 	login_attempts = 0;		/* this time successful */
976 	if (setegid((gid_t)pw->pw_gid) < 0) {
977 		reply(550, "Can't set gid.");
978 		return;
979 	}
980 	/* May be overridden by login.conf */
981 	(void) umask(defumask);
982 #ifdef	LOGIN_CAP
983 	if ((lc = login_getpwclass(pw)) != NULL) {
984 		char	remote_ip[MAXHOSTNAMELEN];
985 
986 		strncpy(remote_ip, inet_ntoa(his_addr.sin_addr),
987 			sizeof(remote_ip) - 1);
988 		remote_ip[sizeof(remote_ip) - 1] = 0;
989 		if (!auth_hostok(lc, remotehost, remote_ip)) {
990 			syslog(LOG_INFO|LOG_AUTH,
991 			    "FTP LOGIN FAILED (HOST) as %s: permission denied.",
992 			    pw->pw_name);
993 			reply(530, "Permission denied.\n");
994 			pw = NULL;
995 			return;
996 		}
997 		if (!auth_timeok(lc, time(NULL))) {
998 			reply(530, "Login not available right now.\n");
999 			pw = NULL;
1000 			return;
1001 		}
1002 	}
1003 	setusercontext(lc, pw, (uid_t)0,
1004 		LOGIN_SETLOGIN|LOGIN_SETGROUP|LOGIN_SETPRIORITY|
1005 		LOGIN_SETRESOURCES|LOGIN_SETUMASK);
1006 #else
1007 	setlogin(pw->pw_name);
1008 	(void) initgroups(pw->pw_name, pw->pw_gid);
1009 #endif
1010 
1011 	/* open wtmp before chroot */
1012 	ftpd_logwtmp(ttyline, pw->pw_name, remotehost);
1013 	logged_in = 1;
1014 
1015 	if (guest && stats && statfd < 0)
1016 #ifdef VIRTUAL_HOSTING
1017 		if ((statfd = open(thishost->statfile, O_WRONLY|O_APPEND)) < 0)
1018 #else
1019 		if ((statfd = open(_PATH_FTPDSTATFILE, O_WRONLY|O_APPEND)) < 0)
1020 #endif
1021 			stats = 0;
1022 
1023 	dochroot =
1024 #ifdef	LOGIN_CAP	/* Allow login.conf configuration as well */
1025 		login_getcapbool(lc, "ftp-chroot", 0) ||
1026 #endif
1027 		checkuser(_PATH_FTPCHROOT, pw->pw_name, 1);
1028 	if (guest) {
1029 		/*
1030 		 * We MUST do a chdir() after the chroot. Otherwise
1031 		 * the old current directory will be accessible as "."
1032 		 * outside the new root!
1033 		 */
1034 		if (chroot(pw->pw_dir) < 0 || chdir("/") < 0) {
1035 			reply(550, "Can't set guest privileges.");
1036 			goto bad;
1037 		}
1038 	} else if (dochroot) {
1039 		if (chroot(pw->pw_dir) < 0 || chdir("/") < 0) {
1040 			reply(550, "Can't change root.");
1041 			goto bad;
1042 		}
1043 	} else if (chdir(pw->pw_dir) < 0) {
1044 		if (chdir("/") < 0) {
1045 			reply(530, "User %s: can't change directory to %s.",
1046 			    pw->pw_name, pw->pw_dir);
1047 			goto bad;
1048 		} else
1049 			lreply(230, "No directory! Logging in with home=/");
1050 	}
1051 	if (seteuid((uid_t)pw->pw_uid) < 0) {
1052 		reply(550, "Can't set uid.");
1053 		goto bad;
1054 	}
1055 
1056 	/*
1057 	 * Display a login message, if it exists.
1058 	 * N.B. reply(230,) must follow the message.
1059 	 */
1060 #ifdef VIRTUAL_HOSTING
1061 	if ((fd = fopen(thishost->loginmsg, "r")) != NULL) {
1062 #else
1063 	if ((fd = fopen(_PATH_FTPLOGINMESG, "r")) != NULL) {
1064 #endif
1065 		char *cp, line[LINE_MAX];
1066 
1067 		while (fgets(line, sizeof(line), fd) != NULL) {
1068 			if ((cp = strchr(line, '\n')) != NULL)
1069 				*cp = '\0';
1070 			lreply(230, "%s", line);
1071 		}
1072 		(void) fflush(stdout);
1073 		(void) fclose(fd);
1074 	}
1075 	if (guest) {
1076 		if (ident != NULL)
1077 			free(ident);
1078 		ident = strdup(passwd);
1079 		if (ident == NULL)
1080 			fatal("Ran out of memory.");
1081 
1082 		reply(230, "Guest login ok, access restrictions apply.");
1083 #ifdef SETPROCTITLE
1084 #ifdef VIRTUAL_HOSTING
1085 		if (thishost != firsthost)
1086 			snprintf(proctitle, sizeof(proctitle),
1087 				 "%s: anonymous(%s)/%.*s", remotehost, hostname,
1088 				 sizeof(proctitle) - sizeof(remotehost) -
1089 				 sizeof(": anonymous/"), passwd);
1090 		else
1091 #endif
1092 			snprintf(proctitle, sizeof(proctitle),
1093 				 "%s: anonymous/%.*s", remotehost,
1094 				 sizeof(proctitle) - sizeof(remotehost) -
1095 				 sizeof(": anonymous/"), passwd);
1096 		setproctitle("%s", proctitle);
1097 #endif /* SETPROCTITLE */
1098 		if (logging)
1099 			syslog(LOG_INFO, "ANONYMOUS FTP LOGIN FROM %s, %s",
1100 			    remotehost, passwd);
1101 	} else {
1102 	    if (dochroot)
1103 		reply(230, "User %s logged in, access restrictions apply.",
1104 			pw->pw_name);
1105 	    else
1106 		reply(230, "User %s logged in.", pw->pw_name);
1107 
1108 #ifdef SETPROCTITLE
1109 		snprintf(proctitle, sizeof(proctitle),
1110 			 "%s: %s", remotehost, pw->pw_name);
1111 		setproctitle("%s", proctitle);
1112 #endif /* SETPROCTITLE */
1113 		if (logging)
1114 			syslog(LOG_INFO, "FTP LOGIN FROM %s as %s",
1115 			    remotehost, pw->pw_name);
1116 	}
1117 #ifdef	LOGIN_CAP
1118 	login_close(lc);
1119 #endif
1120 	return;
1121 bad:
1122 	/* Forget all about it... */
1123 #ifdef	LOGIN_CAP
1124 	login_close(lc);
1125 #endif
1126 	end_login();
1127 }
1128 
1129 void
1130 retrieve(cmd, name)
1131 	char *cmd, *name;
1132 {
1133 	FILE *fin, *dout;
1134 	struct stat st;
1135 	int (*closefunc) __P((FILE *));
1136 	time_t start;
1137 
1138 	if (cmd == 0) {
1139 		fin = fopen(name, "r"), closefunc = fclose;
1140 		st.st_size = 0;
1141 	} else {
1142 		char line[BUFSIZ];
1143 
1144 		(void) snprintf(line, sizeof(line), cmd, name), name = line;
1145 		fin = ftpd_popen(line, "r"), closefunc = ftpd_pclose;
1146 		st.st_size = -1;
1147 		st.st_blksize = BUFSIZ;
1148 	}
1149 	if (fin == NULL) {
1150 		if (errno != 0) {
1151 			perror_reply(550, name);
1152 			if (cmd == 0) {
1153 				LOGCMD("get", name);
1154 			}
1155 		}
1156 		return;
1157 	}
1158 	byte_count = -1;
1159 	if (cmd == 0 && (fstat(fileno(fin), &st) < 0 || !S_ISREG(st.st_mode))) {
1160 		reply(550, "%s: not a plain file.", name);
1161 		goto done;
1162 	}
1163 	if (restart_point) {
1164 		if (type == TYPE_A) {
1165 			off_t i, n;
1166 			int c;
1167 
1168 			n = restart_point;
1169 			i = 0;
1170 			while (i++ < n) {
1171 				if ((c=getc(fin)) == EOF) {
1172 					perror_reply(550, name);
1173 					goto done;
1174 				}
1175 				if (c == '\n')
1176 					i++;
1177 			}
1178 		} else if (lseek(fileno(fin), restart_point, L_SET) < 0) {
1179 			perror_reply(550, name);
1180 			goto done;
1181 		}
1182 	}
1183 	dout = dataconn(name, st.st_size, "w");
1184 	if (dout == NULL)
1185 		goto done;
1186 	time(&start);
1187 	send_data(fin, dout, st.st_blksize, st.st_size,
1188 		  restart_point == 0 && cmd == 0 && S_ISREG(st.st_mode));
1189 	if (cmd == 0 && guest && stats)
1190 		logxfer(name, st.st_size, start);
1191 	(void) fclose(dout);
1192 	data = -1;
1193 	pdata = -1;
1194 done:
1195 	if (cmd == 0)
1196 		LOGBYTES("get", name, byte_count);
1197 	(*closefunc)(fin);
1198 }
1199 
1200 void
1201 store(name, mode, unique)
1202 	char *name, *mode;
1203 	int unique;
1204 {
1205 	FILE *fout, *din;
1206 	struct stat st;
1207 	int (*closefunc) __P((FILE *));
1208 
1209 	if ((unique || guest) && stat(name, &st) == 0 &&
1210 	    (name = gunique(name)) == NULL) {
1211 		LOGCMD(*mode == 'w' ? "put" : "append", name);
1212 		return;
1213 	}
1214 
1215 	if (restart_point)
1216 		mode = "r+";
1217 	fout = fopen(name, mode);
1218 	closefunc = fclose;
1219 	if (fout == NULL) {
1220 		perror_reply(553, name);
1221 		LOGCMD(*mode == 'w' ? "put" : "append", name);
1222 		return;
1223 	}
1224 	byte_count = -1;
1225 	if (restart_point) {
1226 		if (type == TYPE_A) {
1227 			off_t i, n;
1228 			int c;
1229 
1230 			n = restart_point;
1231 			i = 0;
1232 			while (i++ < n) {
1233 				if ((c=getc(fout)) == EOF) {
1234 					perror_reply(550, name);
1235 					goto done;
1236 				}
1237 				if (c == '\n')
1238 					i++;
1239 			}
1240 			/*
1241 			 * We must do this seek to "current" position
1242 			 * because we are changing from reading to
1243 			 * writing.
1244 			 */
1245 			if (fseek(fout, 0L, L_INCR) < 0) {
1246 				perror_reply(550, name);
1247 				goto done;
1248 			}
1249 		} else if (lseek(fileno(fout), restart_point, L_SET) < 0) {
1250 			perror_reply(550, name);
1251 			goto done;
1252 		}
1253 	}
1254 	din = dataconn(name, (off_t)-1, "r");
1255 	if (din == NULL)
1256 		goto done;
1257 	if (receive_data(din, fout) == 0) {
1258 		if (unique)
1259 			reply(226, "Transfer complete (unique file name:%s).",
1260 			    name);
1261 		else
1262 			reply(226, "Transfer complete.");
1263 	}
1264 	(void) fclose(din);
1265 	data = -1;
1266 	pdata = -1;
1267 done:
1268 	LOGBYTES(*mode == 'w' ? "put" : "append", name, byte_count);
1269 	(*closefunc)(fout);
1270 }
1271 
1272 static FILE *
1273 getdatasock(mode)
1274 	char *mode;
1275 {
1276 	int on = 1, s, t, tries;
1277 
1278 	if (data >= 0)
1279 		return (fdopen(data, mode));
1280 	(void) seteuid((uid_t)0);
1281 	s = socket(AF_INET, SOCK_STREAM, 0);
1282 	if (s < 0)
1283 		goto bad;
1284 	if (setsockopt(s, SOL_SOCKET, SO_REUSEADDR,
1285 	    (char *) &on, sizeof(on)) < 0)
1286 		goto bad;
1287 	/* anchor socket to avoid multi-homing problems */
1288 	data_source.sin_len = sizeof(struct sockaddr_in);
1289 	data_source.sin_family = AF_INET;
1290 	data_source.sin_addr = ctrl_addr.sin_addr;
1291 	for (tries = 1; ; tries++) {
1292 		if (bind(s, (struct sockaddr *)&data_source,
1293 		    sizeof(data_source)) >= 0)
1294 			break;
1295 		if (errno != EADDRINUSE || tries > 10)
1296 			goto bad;
1297 		sleep(tries);
1298 	}
1299 	(void) seteuid((uid_t)pw->pw_uid);
1300 #ifdef IP_TOS
1301 	on = IPTOS_THROUGHPUT;
1302 	if (setsockopt(s, IPPROTO_IP, IP_TOS, (char *)&on, sizeof(int)) < 0)
1303 		syslog(LOG_WARNING, "setsockopt (IP_TOS): %m");
1304 #endif
1305 #ifdef TCP_NOPUSH
1306 	/*
1307 	 * Turn off push flag to keep sender TCP from sending short packets
1308 	 * at the boundaries of each write().  Should probably do a SO_SNDBUF
1309 	 * to set the send buffer size as well, but that may not be desirable
1310 	 * in heavy-load situations.
1311 	 */
1312 	on = 1;
1313 	if (setsockopt(s, IPPROTO_TCP, TCP_NOPUSH, (char *)&on, sizeof on) < 0)
1314 		syslog(LOG_WARNING, "setsockopt (TCP_NOPUSH): %m");
1315 #endif
1316 #ifdef SO_SNDBUF
1317 	on = 65536;
1318 	if (setsockopt(s, SOL_SOCKET, SO_SNDBUF, (char *)&on, sizeof on) < 0)
1319 		syslog(LOG_WARNING, "setsockopt (SO_SNDBUF): %m");
1320 #endif
1321 
1322 	return (fdopen(s, mode));
1323 bad:
1324 	/* Return the real value of errno (close may change it) */
1325 	t = errno;
1326 	(void) seteuid((uid_t)pw->pw_uid);
1327 	(void) close(s);
1328 	errno = t;
1329 	return (NULL);
1330 }
1331 
1332 static FILE *
1333 dataconn(name, size, mode)
1334 	char *name;
1335 	off_t size;
1336 	char *mode;
1337 {
1338 	char sizebuf[32];
1339 	FILE *file;
1340 	int retry = 0, tos;
1341 
1342 	file_size = size;
1343 	byte_count = 0;
1344 	if (size != (off_t) -1)
1345 		(void) snprintf(sizebuf, sizeof(sizebuf), " (%qd bytes)", size);
1346 	else
1347 		*sizebuf = '\0';
1348 	if (pdata >= 0) {
1349 		struct sockaddr_in from;
1350 		int s, fromlen = sizeof(from);
1351 		struct timeval timeout;
1352 		fd_set set;
1353 
1354 		FD_ZERO(&set);
1355 		FD_SET(pdata, &set);
1356 
1357 		timeout.tv_usec = 0;
1358 		timeout.tv_sec = 120;
1359 
1360 		if (select(pdata+1, &set, (fd_set *) 0, (fd_set *) 0, &timeout) == 0 ||
1361 		    (s = accept(pdata, (struct sockaddr *) &from, &fromlen)) < 0) {
1362 			reply(425, "Can't open data connection.");
1363 			(void) close(pdata);
1364 			pdata = -1;
1365 			return (NULL);
1366 		}
1367 		(void) close(pdata);
1368 		pdata = s;
1369 #ifdef IP_TOS
1370 		tos = IPTOS_THROUGHPUT;
1371 		(void) setsockopt(s, IPPROTO_IP, IP_TOS, (char *)&tos,
1372 		    sizeof(int));
1373 #endif
1374 		reply(150, "Opening %s mode data connection for '%s'%s.",
1375 		     type == TYPE_A ? "ASCII" : "BINARY", name, sizebuf);
1376 		return (fdopen(pdata, mode));
1377 	}
1378 	if (data >= 0) {
1379 		reply(125, "Using existing data connection for '%s'%s.",
1380 		    name, sizebuf);
1381 		usedefault = 1;
1382 		return (fdopen(data, mode));
1383 	}
1384 	if (usedefault)
1385 		data_dest = his_addr;
1386 	usedefault = 1;
1387 	file = getdatasock(mode);
1388 	if (file == NULL) {
1389 		reply(425, "Can't create data socket (%s,%d): %s.",
1390 		    inet_ntoa(data_source.sin_addr),
1391 		    ntohs(data_source.sin_port), strerror(errno));
1392 		return (NULL);
1393 	}
1394 	data = fileno(file);
1395 	while (connect(data, (struct sockaddr *)&data_dest,
1396 	    sizeof(data_dest)) < 0) {
1397 		if (errno == EADDRINUSE && retry < swaitmax) {
1398 			sleep((unsigned) swaitint);
1399 			retry += swaitint;
1400 			continue;
1401 		}
1402 		perror_reply(425, "Can't build data connection");
1403 		(void) fclose(file);
1404 		data = -1;
1405 		return (NULL);
1406 	}
1407 	reply(150, "Opening %s mode data connection for '%s'%s.",
1408 	     type == TYPE_A ? "ASCII" : "BINARY", name, sizebuf);
1409 	return (file);
1410 }
1411 
1412 /*
1413  * Tranfer the contents of "instr" to "outstr" peer using the appropriate
1414  * encapsulation of the data subject to Mode, Structure, and Type.
1415  *
1416  * NB: Form isn't handled.
1417  */
1418 static void
1419 send_data(instr, outstr, blksize, filesize, isreg)
1420 	FILE *instr, *outstr;
1421 	off_t blksize;
1422 	off_t filesize;
1423 	int isreg;
1424 {
1425 	int c, cnt, filefd, netfd;
1426 	char *buf, *bp;
1427 	size_t len;
1428 
1429 	transflag++;
1430 	if (setjmp(urgcatch)) {
1431 		transflag = 0;
1432 		return;
1433 	}
1434 	switch (type) {
1435 
1436 	case TYPE_A:
1437 		while ((c = getc(instr)) != EOF) {
1438 			byte_count++;
1439 			if (c == '\n') {
1440 				if (ferror(outstr))
1441 					goto data_err;
1442 				(void) putc('\r', outstr);
1443 			}
1444 			(void) putc(c, outstr);
1445 		}
1446 		fflush(outstr);
1447 		transflag = 0;
1448 		if (ferror(instr))
1449 			goto file_err;
1450 		if (ferror(outstr))
1451 			goto data_err;
1452 		reply(226, "Transfer complete.");
1453 		return;
1454 
1455 	case TYPE_I:
1456 	case TYPE_L:
1457 		/*
1458 		 * isreg is only set if we are not doing restart and we
1459 		 * are sending a regular file
1460 		 */
1461 		netfd = fileno(outstr);
1462 		filefd = fileno(instr);
1463 
1464 		if (isreg && filesize < (off_t)16 * 1024 * 1024) {
1465 			buf = mmap(0, filesize, PROT_READ, MAP_SHARED, filefd,
1466 				   (off_t)0);
1467 			if (buf == MAP_FAILED) {
1468 				syslog(LOG_WARNING, "mmap(%lu): %m",
1469 				       (unsigned long)filesize);
1470 				goto oldway;
1471 			}
1472 			bp = buf;
1473 			len = filesize;
1474 			do {
1475 				cnt = write(netfd, bp, len);
1476 				len -= cnt;
1477 				bp += cnt;
1478 				if (cnt > 0) byte_count += cnt;
1479 			} while(cnt > 0 && len > 0);
1480 
1481 			transflag = 0;
1482 			munmap(buf, (size_t)filesize);
1483 			if (cnt < 0)
1484 				goto data_err;
1485 			reply(226, "Transfer complete.");
1486 			return;
1487 		}
1488 
1489 oldway:
1490 		if ((buf = malloc((u_int)blksize)) == NULL) {
1491 			transflag = 0;
1492 			perror_reply(451, "Local resource failure: malloc");
1493 			return;
1494 		}
1495 
1496 		while ((cnt = read(filefd, buf, (u_int)blksize)) > 0 &&
1497 		    write(netfd, buf, cnt) == cnt)
1498 			byte_count += cnt;
1499 		transflag = 0;
1500 		(void)free(buf);
1501 		if (cnt != 0) {
1502 			if (cnt < 0)
1503 				goto file_err;
1504 			goto data_err;
1505 		}
1506 		reply(226, "Transfer complete.");
1507 		return;
1508 	default:
1509 		transflag = 0;
1510 		reply(550, "Unimplemented TYPE %d in send_data", type);
1511 		return;
1512 	}
1513 
1514 data_err:
1515 	transflag = 0;
1516 	perror_reply(426, "Data connection");
1517 	return;
1518 
1519 file_err:
1520 	transflag = 0;
1521 	perror_reply(551, "Error on input file");
1522 }
1523 
1524 /*
1525  * Transfer data from peer to "outstr" using the appropriate encapulation of
1526  * the data subject to Mode, Structure, and Type.
1527  *
1528  * N.B.: Form isn't handled.
1529  */
1530 static int
1531 receive_data(instr, outstr)
1532 	FILE *instr, *outstr;
1533 {
1534 	int c;
1535 	int cnt, bare_lfs;
1536 	char buf[BUFSIZ];
1537 
1538 	transflag++;
1539 	if (setjmp(urgcatch)) {
1540 		transflag = 0;
1541 		return (-1);
1542 	}
1543 
1544 	bare_lfs = 0;
1545 
1546 	switch (type) {
1547 
1548 	case TYPE_I:
1549 	case TYPE_L:
1550 		while ((cnt = read(fileno(instr), buf, sizeof(buf))) > 0) {
1551 			if (write(fileno(outstr), buf, cnt) != cnt)
1552 				goto file_err;
1553 			byte_count += cnt;
1554 		}
1555 		if (cnt < 0)
1556 			goto data_err;
1557 		transflag = 0;
1558 		return (0);
1559 
1560 	case TYPE_E:
1561 		reply(553, "TYPE E not implemented.");
1562 		transflag = 0;
1563 		return (-1);
1564 
1565 	case TYPE_A:
1566 		while ((c = getc(instr)) != EOF) {
1567 			byte_count++;
1568 			if (c == '\n')
1569 				bare_lfs++;
1570 			while (c == '\r') {
1571 				if (ferror(outstr))
1572 					goto data_err;
1573 				if ((c = getc(instr)) != '\n') {
1574 					(void) putc ('\r', outstr);
1575 					if (c == '\0' || c == EOF)
1576 						goto contin2;
1577 				}
1578 			}
1579 			(void) putc(c, outstr);
1580 	contin2:	;
1581 		}
1582 		fflush(outstr);
1583 		if (ferror(instr))
1584 			goto data_err;
1585 		if (ferror(outstr))
1586 			goto file_err;
1587 		transflag = 0;
1588 		if (bare_lfs) {
1589 			lreply(226,
1590 		"WARNING! %d bare linefeeds received in ASCII mode",
1591 			    bare_lfs);
1592 		(void)printf("   File may not have transferred correctly.\r\n");
1593 		}
1594 		return (0);
1595 	default:
1596 		reply(550, "Unimplemented TYPE %d in receive_data", type);
1597 		transflag = 0;
1598 		return (-1);
1599 	}
1600 
1601 data_err:
1602 	transflag = 0;
1603 	perror_reply(426, "Data Connection");
1604 	return (-1);
1605 
1606 file_err:
1607 	transflag = 0;
1608 	perror_reply(452, "Error writing file");
1609 	return (-1);
1610 }
1611 
1612 void
1613 statfilecmd(filename)
1614 	char *filename;
1615 {
1616 	FILE *fin;
1617 	int c;
1618 	char line[LINE_MAX];
1619 
1620 	(void)snprintf(line, sizeof(line), _PATH_LS " -lgA %s", filename);
1621 	fin = ftpd_popen(line, "r");
1622 	lreply(211, "status of %s:", filename);
1623 	while ((c = getc(fin)) != EOF) {
1624 		if (c == '\n') {
1625 			if (ferror(stdout)){
1626 				perror_reply(421, "control connection");
1627 				(void) ftpd_pclose(fin);
1628 				dologout(1);
1629 				/* NOTREACHED */
1630 			}
1631 			if (ferror(fin)) {
1632 				perror_reply(551, filename);
1633 				(void) ftpd_pclose(fin);
1634 				return;
1635 			}
1636 			(void) putc('\r', stdout);
1637 		}
1638 		(void) putc(c, stdout);
1639 	}
1640 	(void) ftpd_pclose(fin);
1641 	reply(211, "End of Status");
1642 }
1643 
1644 void
1645 statcmd()
1646 {
1647 	struct sockaddr_in *sin;
1648 	u_char *a, *p;
1649 
1650 	lreply(211, "%s FTP server status:", hostname, version);
1651 	printf("     %s\r\n", version);
1652 	printf("     Connected to %s", remotehost);
1653 	if (!isdigit(remotehost[0]))
1654 		printf(" (%s)", inet_ntoa(his_addr.sin_addr));
1655 	printf("\r\n");
1656 	if (logged_in) {
1657 		if (guest)
1658 			printf("     Logged in anonymously\r\n");
1659 		else
1660 			printf("     Logged in as %s\r\n", pw->pw_name);
1661 	} else if (askpasswd)
1662 		printf("     Waiting for password\r\n");
1663 	else
1664 		printf("     Waiting for user name\r\n");
1665 	printf("     TYPE: %s", typenames[type]);
1666 	if (type == TYPE_A || type == TYPE_E)
1667 		printf(", FORM: %s", formnames[form]);
1668 	if (type == TYPE_L)
1669 #if NBBY == 8
1670 		printf(" %d", NBBY);
1671 #else
1672 		printf(" %d", bytesize);	/* need definition! */
1673 #endif
1674 	printf("; STRUcture: %s; transfer MODE: %s\r\n",
1675 	    strunames[stru], modenames[mode]);
1676 	if (data != -1)
1677 		printf("     Data connection open\r\n");
1678 	else if (pdata != -1) {
1679 		printf("     in Passive mode");
1680 		sin = &pasv_addr;
1681 		goto printaddr;
1682 	} else if (usedefault == 0) {
1683 		printf("     PORT");
1684 		sin = &data_dest;
1685 printaddr:
1686 		a = (u_char *) &sin->sin_addr;
1687 		p = (u_char *) &sin->sin_port;
1688 #define UC(b) (((int) b) & 0xff)
1689 		printf(" (%d,%d,%d,%d,%d,%d)\r\n", UC(a[0]),
1690 			UC(a[1]), UC(a[2]), UC(a[3]), UC(p[0]), UC(p[1]));
1691 #undef UC
1692 	} else
1693 		printf("     No data connection\r\n");
1694 	reply(211, "End of status");
1695 }
1696 
1697 void
1698 fatal(s)
1699 	char *s;
1700 {
1701 
1702 	reply(451, "Error in server: %s\n", s);
1703 	reply(221, "Closing connection due to server error.");
1704 	dologout(0);
1705 	/* NOTREACHED */
1706 }
1707 
1708 void
1709 #if __STDC__
1710 reply(int n, const char *fmt, ...)
1711 #else
1712 reply(n, fmt, va_alist)
1713 	int n;
1714 	char *fmt;
1715         va_dcl
1716 #endif
1717 {
1718 	va_list ap;
1719 #if __STDC__
1720 	va_start(ap, fmt);
1721 #else
1722 	va_start(ap);
1723 #endif
1724 	(void)printf("%d ", n);
1725 	(void)vprintf(fmt, ap);
1726 	(void)printf("\r\n");
1727 	(void)fflush(stdout);
1728 	if (debug) {
1729 		syslog(LOG_DEBUG, "<--- %d ", n);
1730 		vsyslog(LOG_DEBUG, fmt, ap);
1731 	}
1732 }
1733 
1734 void
1735 #if __STDC__
1736 lreply(int n, const char *fmt, ...)
1737 #else
1738 lreply(n, fmt, va_alist)
1739 	int n;
1740 	char *fmt;
1741         va_dcl
1742 #endif
1743 {
1744 	va_list ap;
1745 #if __STDC__
1746 	va_start(ap, fmt);
1747 #else
1748 	va_start(ap);
1749 #endif
1750 	(void)printf("%d- ", n);
1751 	(void)vprintf(fmt, ap);
1752 	(void)printf("\r\n");
1753 	(void)fflush(stdout);
1754 	if (debug) {
1755 		syslog(LOG_DEBUG, "<--- %d- ", n);
1756 		vsyslog(LOG_DEBUG, fmt, ap);
1757 	}
1758 }
1759 
1760 static void
1761 ack(s)
1762 	char *s;
1763 {
1764 
1765 	reply(250, "%s command successful.", s);
1766 }
1767 
1768 void
1769 nack(s)
1770 	char *s;
1771 {
1772 
1773 	reply(502, "%s command not implemented.", s);
1774 }
1775 
1776 /* ARGSUSED */
1777 void
1778 yyerror(s)
1779 	char *s;
1780 {
1781 	char *cp;
1782 
1783 	if ((cp = strchr(cbuf,'\n')))
1784 		*cp = '\0';
1785 	reply(500, "'%s': command not understood.", cbuf);
1786 }
1787 
1788 void
1789 delete(name)
1790 	char *name;
1791 {
1792 	struct stat st;
1793 
1794 	LOGCMD("delete", name);
1795 	if (stat(name, &st) < 0) {
1796 		perror_reply(550, name);
1797 		return;
1798 	}
1799 	if ((st.st_mode&S_IFMT) == S_IFDIR) {
1800 		if (rmdir(name) < 0) {
1801 			perror_reply(550, name);
1802 			return;
1803 		}
1804 		goto done;
1805 	}
1806 	if (unlink(name) < 0) {
1807 		perror_reply(550, name);
1808 		return;
1809 	}
1810 done:
1811 	ack("DELE");
1812 }
1813 
1814 void
1815 cwd(path)
1816 	char *path;
1817 {
1818 
1819 	if (chdir(path) < 0)
1820 		perror_reply(550, path);
1821 	else
1822 		ack("CWD");
1823 }
1824 
1825 void
1826 makedir(name)
1827 	char *name;
1828 {
1829 
1830 	LOGCMD("mkdir", name);
1831 	if (mkdir(name, 0777) < 0)
1832 		perror_reply(550, name);
1833 	else
1834 		reply(257, "MKD command successful.");
1835 }
1836 
1837 void
1838 removedir(name)
1839 	char *name;
1840 {
1841 
1842 	LOGCMD("rmdir", name);
1843 	if (rmdir(name) < 0)
1844 		perror_reply(550, name);
1845 	else
1846 		ack("RMD");
1847 }
1848 
1849 void
1850 pwd()
1851 {
1852 	char path[MAXPATHLEN + 1];
1853 
1854 	if (getwd(path) == (char *)NULL)
1855 		reply(550, "%s.", path);
1856 	else
1857 		reply(257, "\"%s\" is current directory.", path);
1858 }
1859 
1860 char *
1861 renamefrom(name)
1862 	char *name;
1863 {
1864 	struct stat st;
1865 
1866 	if (stat(name, &st) < 0) {
1867 		perror_reply(550, name);
1868 		return ((char *)0);
1869 	}
1870 	reply(350, "File exists, ready for destination name");
1871 	return (name);
1872 }
1873 
1874 void
1875 renamecmd(from, to)
1876 	char *from, *to;
1877 {
1878 	struct stat st;
1879 
1880 	LOGCMD2("rename", from, to);
1881 
1882 	if (guest && (stat(to, &st) == 0)) {
1883 		reply(550, "%s: permission denied", to);
1884 		return;
1885 	}
1886 
1887 	if (rename(from, to) < 0)
1888 		perror_reply(550, "rename");
1889 	else
1890 		ack("RNTO");
1891 }
1892 
1893 static void
1894 dolog(sin)
1895 	struct sockaddr_in *sin;
1896 {
1897 	realhostname(remotehost, sizeof(remotehost) - 1, &sin->sin_addr);
1898 
1899 #ifdef SETPROCTITLE
1900 #ifdef VIRTUAL_HOSTING
1901 	if (thishost != firsthost)
1902 		snprintf(proctitle, sizeof(proctitle), "%s: connected (to %s)",
1903 			 remotehost, hostname);
1904 	else
1905 #endif
1906 		snprintf(proctitle, sizeof(proctitle), "%s: connected",
1907 			 remotehost);
1908 	setproctitle("%s", proctitle);
1909 #endif /* SETPROCTITLE */
1910 
1911 	if (logging) {
1912 #ifdef VIRTUAL_HOSTING
1913 		if (thishost != firsthost)
1914 			syslog(LOG_INFO, "connection from %s (to %s)",
1915 			       remotehost, hostname);
1916 		else
1917 #endif
1918 			syslog(LOG_INFO, "connection from %s (%s)", remotehost,
1919 				inet_ntoa(sin->sin_addr));
1920 	}
1921 }
1922 
1923 /*
1924  * Record logout in wtmp file
1925  * and exit with supplied status.
1926  */
1927 void
1928 dologout(status)
1929 	int status;
1930 {
1931 	/*
1932 	 * Prevent reception of SIGURG from resulting in a resumption
1933 	 * back to the main program loop.
1934 	 */
1935 	transflag = 0;
1936 
1937 	if (logged_in) {
1938 		(void) seteuid((uid_t)0);
1939 		ftpd_logwtmp(ttyline, "", "");
1940 #if defined(KERBEROS)
1941 		if (!notickets && krbtkfile_env)
1942 			unlink(krbtkfile_env);
1943 #endif
1944 	}
1945 	/* beware of flushing buffers after a SIGPIPE */
1946 	_exit(status);
1947 }
1948 
1949 static void
1950 myoob(signo)
1951 	int signo;
1952 {
1953 	char *cp;
1954 
1955 	/* only process if transfer occurring */
1956 	if (!transflag)
1957 		return;
1958 	cp = tmpline;
1959 	if (getline(cp, 7, stdin) == NULL) {
1960 		reply(221, "You could at least say goodbye.");
1961 		dologout(0);
1962 	}
1963 	upper(cp);
1964 	if (strcmp(cp, "ABOR\r\n") == 0) {
1965 		tmpline[0] = '\0';
1966 		reply(426, "Transfer aborted. Data connection closed.");
1967 		reply(226, "Abort successful");
1968 		longjmp(urgcatch, 1);
1969 	}
1970 	if (strcmp(cp, "STAT\r\n") == 0) {
1971 		if (file_size != (off_t) -1)
1972 			reply(213, "Status: %qd of %qd bytes transferred",
1973 			    byte_count, file_size);
1974 		else
1975 			reply(213, "Status: %qd bytes transferred", byte_count);
1976 	}
1977 }
1978 
1979 /*
1980  * Note: a response of 425 is not mentioned as a possible response to
1981  *	the PASV command in RFC959. However, it has been blessed as
1982  *	a legitimate response by Jon Postel in a telephone conversation
1983  *	with Rick Adams on 25 Jan 89.
1984  */
1985 void
1986 passive()
1987 {
1988 	int len;
1989 	char *p, *a;
1990 
1991 	if (pdata >= 0)		/* close old port if one set */
1992 		close(pdata);
1993 
1994 	pdata = socket(AF_INET, SOCK_STREAM, 0);
1995 	if (pdata < 0) {
1996 		perror_reply(425, "Can't open passive connection");
1997 		return;
1998 	}
1999 
2000 	(void) seteuid((uid_t)0);
2001 
2002 #ifdef IP_PORTRANGE
2003 	{
2004 	    int on = restricted_data_ports ? IP_PORTRANGE_HIGH
2005 					   : IP_PORTRANGE_DEFAULT;
2006 
2007 	    if (setsockopt(pdata, IPPROTO_IP, IP_PORTRANGE,
2008 			    (char *)&on, sizeof(on)) < 0)
2009 		    goto pasv_error;
2010 	}
2011 #endif
2012 
2013 	pasv_addr = ctrl_addr;
2014 	pasv_addr.sin_port = 0;
2015 	if (bind(pdata, (struct sockaddr *)&pasv_addr,
2016 		 sizeof(pasv_addr)) < 0)
2017 		goto pasv_error;
2018 
2019 	(void) seteuid((uid_t)pw->pw_uid);
2020 
2021 	len = sizeof(pasv_addr);
2022 	if (getsockname(pdata, (struct sockaddr *) &pasv_addr, &len) < 0)
2023 		goto pasv_error;
2024 	if (listen(pdata, 1) < 0)
2025 		goto pasv_error;
2026 	a = (char *) &pasv_addr.sin_addr;
2027 	p = (char *) &pasv_addr.sin_port;
2028 
2029 #define UC(b) (((int) b) & 0xff)
2030 
2031 	reply(227, "Entering Passive Mode (%d,%d,%d,%d,%d,%d)", UC(a[0]),
2032 		UC(a[1]), UC(a[2]), UC(a[3]), UC(p[0]), UC(p[1]));
2033 	return;
2034 
2035 pasv_error:
2036 	(void) seteuid((uid_t)pw->pw_uid);
2037 	(void) close(pdata);
2038 	pdata = -1;
2039 	perror_reply(425, "Can't open passive connection");
2040 	return;
2041 }
2042 
2043 /*
2044  * Generate unique name for file with basename "local".
2045  * The file named "local" is already known to exist.
2046  * Generates failure reply on error.
2047  */
2048 static char *
2049 gunique(local)
2050 	char *local;
2051 {
2052 	static char new[MAXPATHLEN];
2053 	struct stat st;
2054 	int count;
2055 	char *cp;
2056 
2057 	cp = strrchr(local, '/');
2058 	if (cp)
2059 		*cp = '\0';
2060 	if (stat(cp ? local : ".", &st) < 0) {
2061 		perror_reply(553, cp ? local : ".");
2062 		return ((char *) 0);
2063 	}
2064 	if (cp)
2065 		*cp = '/';
2066 	/* -4 is for the .nn<null> we put on the end below */
2067 	(void) snprintf(new, sizeof(new) - 4, "%s", local);
2068 	cp = new + strlen(new);
2069 	*cp++ = '.';
2070 	for (count = 1; count < 100; count++) {
2071 		(void)sprintf(cp, "%d", count);
2072 		if (stat(new, &st) < 0)
2073 			return (new);
2074 	}
2075 	reply(452, "Unique file name cannot be created.");
2076 	return (NULL);
2077 }
2078 
2079 /*
2080  * Format and send reply containing system error number.
2081  */
2082 void
2083 perror_reply(code, string)
2084 	int code;
2085 	char *string;
2086 {
2087 
2088 	reply(code, "%s: %s.", string, strerror(errno));
2089 }
2090 
2091 static char *onefile[] = {
2092 	"",
2093 	0
2094 };
2095 
2096 void
2097 send_file_list(whichf)
2098 	char *whichf;
2099 {
2100 	struct stat st;
2101 	DIR *dirp = NULL;
2102 	struct dirent *dir;
2103 	FILE *dout = NULL;
2104 	char **dirlist, *dirname;
2105 	int simple = 0;
2106 	int freeglob = 0;
2107 	glob_t gl;
2108 
2109 	if (strpbrk(whichf, "~{[*?") != NULL) {
2110 		int flags = GLOB_BRACE|GLOB_NOCHECK|GLOB_QUOTE|GLOB_TILDE;
2111 
2112 		memset(&gl, 0, sizeof(gl));
2113 		freeglob = 1;
2114 		if (glob(whichf, flags, 0, &gl)) {
2115 			reply(550, "not found");
2116 			goto out;
2117 		} else if (gl.gl_pathc == 0) {
2118 			errno = ENOENT;
2119 			perror_reply(550, whichf);
2120 			goto out;
2121 		}
2122 		dirlist = gl.gl_pathv;
2123 	} else {
2124 		onefile[0] = whichf;
2125 		dirlist = onefile;
2126 		simple = 1;
2127 	}
2128 
2129 	if (setjmp(urgcatch)) {
2130 		transflag = 0;
2131 		goto out;
2132 	}
2133 	while ((dirname = *dirlist++)) {
2134 		if (stat(dirname, &st) < 0) {
2135 			/*
2136 			 * If user typed "ls -l", etc, and the client
2137 			 * used NLST, do what the user meant.
2138 			 */
2139 			if (dirname[0] == '-' && *dirlist == NULL &&
2140 			    transflag == 0) {
2141 				retrieve(_PATH_LS " %s", dirname);
2142 				goto out;
2143 			}
2144 			perror_reply(550, whichf);
2145 			if (dout != NULL) {
2146 				(void) fclose(dout);
2147 				transflag = 0;
2148 				data = -1;
2149 				pdata = -1;
2150 			}
2151 			goto out;
2152 		}
2153 
2154 		if (S_ISREG(st.st_mode)) {
2155 			if (dout == NULL) {
2156 				dout = dataconn("file list", (off_t)-1, "w");
2157 				if (dout == NULL)
2158 					goto out;
2159 				transflag++;
2160 			}
2161 			fprintf(dout, "%s%s\n", dirname,
2162 				type == TYPE_A ? "\r" : "");
2163 			byte_count += strlen(dirname) + 1;
2164 			continue;
2165 		} else if (!S_ISDIR(st.st_mode))
2166 			continue;
2167 
2168 		if ((dirp = opendir(dirname)) == NULL)
2169 			continue;
2170 
2171 		while ((dir = readdir(dirp)) != NULL) {
2172 			char nbuf[MAXPATHLEN];
2173 
2174 			if (dir->d_name[0] == '.' && dir->d_namlen == 1)
2175 				continue;
2176 			if (dir->d_name[0] == '.' && dir->d_name[1] == '.' &&
2177 			    dir->d_namlen == 2)
2178 				continue;
2179 
2180 			snprintf(nbuf, sizeof(nbuf),
2181 				"%s/%s", dirname, dir->d_name);
2182 
2183 			/*
2184 			 * We have to do a stat to insure it's
2185 			 * not a directory or special file.
2186 			 */
2187 			if (simple || (stat(nbuf, &st) == 0 &&
2188 			    S_ISREG(st.st_mode))) {
2189 				if (dout == NULL) {
2190 					dout = dataconn("file list", (off_t)-1,
2191 						"w");
2192 					if (dout == NULL)
2193 						goto out;
2194 					transflag++;
2195 				}
2196 				if (nbuf[0] == '.' && nbuf[1] == '/')
2197 					fprintf(dout, "%s%s\n", &nbuf[2],
2198 						type == TYPE_A ? "\r" : "");
2199 				else
2200 					fprintf(dout, "%s%s\n", nbuf,
2201 						type == TYPE_A ? "\r" : "");
2202 				byte_count += strlen(nbuf) + 1;
2203 			}
2204 		}
2205 		(void) closedir(dirp);
2206 	}
2207 
2208 	if (dout == NULL)
2209 		reply(550, "No files found.");
2210 	else if (ferror(dout) != 0)
2211 		perror_reply(550, "Data connection");
2212 	else
2213 		reply(226, "Transfer complete.");
2214 
2215 	transflag = 0;
2216 	if (dout != NULL)
2217 		(void) fclose(dout);
2218 	data = -1;
2219 	pdata = -1;
2220 out:
2221 	if (freeglob) {
2222 		freeglob = 0;
2223 		globfree(&gl);
2224 	}
2225 }
2226 
2227 void
2228 reapchild(signo)
2229 	int signo;
2230 {
2231 	while (wait3(NULL, WNOHANG, NULL) > 0);
2232 }
2233 
2234 #ifdef OLD_SETPROCTITLE
2235 /*
2236  * Clobber argv so ps will show what we're doing.  (Stolen from sendmail.)
2237  * Warning, since this is usually started from inetd.conf, it often doesn't
2238  * have much of an environment or arglist to overwrite.
2239  */
2240 void
2241 #if __STDC__
2242 setproctitle(const char *fmt, ...)
2243 #else
2244 setproctitle(fmt, va_alist)
2245 	char *fmt;
2246         va_dcl
2247 #endif
2248 {
2249 	int i;
2250 	va_list ap;
2251 	char *p, *bp, ch;
2252 	char buf[LINE_MAX];
2253 
2254 #if __STDC__
2255 	va_start(ap, fmt);
2256 #else
2257 	va_start(ap);
2258 #endif
2259 	(void)vsnprintf(buf, sizeof(buf), fmt, ap);
2260 
2261 	/* make ps print our process name */
2262 	p = Argv[0];
2263 	*p++ = '-';
2264 
2265 	i = strlen(buf);
2266 	if (i > LastArgv - p - 2) {
2267 		i = LastArgv - p - 2;
2268 		buf[i] = '\0';
2269 	}
2270 	bp = buf;
2271 	while (ch = *bp++)
2272 		if (ch != '\n' && ch != '\r')
2273 			*p++ = ch;
2274 	while (p < LastArgv)
2275 		*p++ = ' ';
2276 }
2277 #endif /* OLD_SETPROCTITLE */
2278 
2279 static void
2280 logxfer(name, size, start)
2281 	char *name;
2282 	long size;
2283 	long start;
2284 {
2285 	char buf[1024];
2286 	char path[MAXPATHLEN + 1];
2287 	time_t now;
2288 
2289 	if (statfd >= 0 && getwd(path) != NULL) {
2290 		time(&now);
2291 		snprintf(buf, sizeof(buf), "%.20s!%s!%s!%s/%s!%ld!%ld\n",
2292 			ctime(&now)+4, ident, remotehost,
2293 			path, name, size, now - start + (now == start));
2294 		write(statfd, buf, strlen(buf));
2295 	}
2296 }
2297