oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

On systems with IP_PORTRANGE, have ftpd use `high-numbered'

Browse Source 
ports by default.  Add a -U option to get the old behavior.


git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@10583 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Jacques A. Vidrine
2001-08-28 19:02:16 +00:00
parent c14ed9002f
commit c77bd77f26
4 changed files with 43 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
appl/ftp/ftpd/ftpd.8
View File

@@ -42,7 +42,7 @@
.Sh SYNOPSIS
.Nm
.Op Fl a Ar authmode
.Op Fl dilv
.Op Fl dilvU
.Op Fl g Ar umask
.Op Fl p Ar port
.Op Fl T Ar maxtimeout
@@ -128,6 +128,14 @@ The inactivity timeout period is set to
seconds (the default is 15 minutes).
.It Fl u
Set the initial umask to something else than the default 027.
.It Fl U
In previous versions of
.Nm ftpd ,
when a passive mode client requested a data connection to the server, the
server would use data ports in the range 1024..4999. Now, by default,
if the system supports the IP_PORTRANGE socket option, the server will
use data ports in the range 49152..65535. Specifying this option will
revert to the old behavior.
.It Fl v
Verbose mode.
.It Xo

6
appl/ftp/ftpd/ftpd.c
View File

@@ -68,6 +68,7 @@ struct passwd *pw;
int debug = 0;
int ftpd_timeout = 900; /* timeout after 15 minutes of inactivity */
int maxtimeout = 7200;/* don't allow idle time to be set beyond 2 hours */
int restricted_data_ports = 1;
int logging;
int guest;
int dochroot;
@@ -217,6 +218,7 @@ struct getargs args[] = {
{ NULL, 't', arg_integer, &ftpd_timeout, "initial timeout" },
{ NULL, 'T', arg_integer, &maxtimeout, "max timeout" },
{ NULL, 'u', arg_string, &umask_string, "umask for user logins" },
{ NULL, 'U', arg_negative_flag, &restricted_data_ports, "don't use high data ports" },
{ NULL, 'd', arg_flag, &debug, "enable debugging" },
{ NULL, 'v', arg_flag, &debug, "enable debugging" },
{ "builtin-ls", 'B', arg_flag, &use_builtin_ls, "use built-in ls to list files" },
@@ -1951,6 +1953,8 @@ pasv(void)
socket_set_address_and_port (pasv_addr,
socket_get_address (ctrl_addr),
0);
socket_set_portrange(pdata, restricted_data_ports,
pasv_addr->sa_family);
seteuid(0);
if (bind(pdata, pasv_addr, socket_sockaddr_size (pasv_addr)) < 0) {
seteuid(pw->pw_uid);
@@ -1993,6 +1997,8 @@ epsv(char *proto)
socket_set_address_and_port (pasv_addr,
socket_get_address (ctrl_addr),
0);
socket_set_portrange(pdata, restricted_data_ports,
pasv_addr->sa_family);
seteuid(0);
if (bind(pdata, pasv_addr, socket_sockaddr_size (pasv_addr)) < 0) {
seteuid(pw->pw_uid);

3
lib/roken/roken-common.h
View File

@@ -301,6 +301,9 @@ socket_get_port (const struct sockaddr *sa);
void
socket_set_port (struct sockaddr *sa, int port);
void
socket_set_portrange (int sock, int restrict, int af);
void
socket_set_debug (int sock);

25
lib/roken/socket.c
View File

@@ -221,6 +221,31 @@ socket_set_port (struct sockaddr *sa, int port)
}
}
/*
* Set the range of ports to use when binding with port = 0.
*/
void
socket_set_portrange (int sock, int restrict, int af)
{
#if defined(IP_PORTRANGE)
if (af == AF_INET) {
int on = restrict ? IP_PORTRANGE_HIGH : IP_PORTRANGE_DEFAULT;
if (setsockopt (sock, IPPROTO_IP, IP_PORTRANGE, &on,
sizeof(on)) < 0)
warn ("setsockopt IP_PORTRANGE (ignored)");
}
#endif
#if defined(IPV6_PORTRANGE)
if (af == AF_INET6) {
int on = restrict ? IPV6_PORTRANGE_HIGH :
IPV6_PORTRANGE_DEFAULT;
if (setsockopt (sock, IPPROTO_IPV6, IPV6_PORTRANGE, &on,
sizeof(on)) < 0)
warn ("setsockopt IPV6_PORTRANGE (ignored)");
}
#endif
}
/*
* Enable debug on `sock'.
*/