Compare commits
No commits in common. 'c9' and 'c8' have entirely different histories.
@ -1 +1 @@
|
||||
SOURCES/vsftpd-3.0.5.tar.gz
|
||||
SOURCES/vsftpd-3.0.3.tar.gz
|
||||
|
||||
@ -1 +1 @@
|
||||
0159531cc9f9fc6dd64cd734e2fd42601e44b5d9 SOURCES/vsftpd-3.0.5.tar.gz
|
||||
d5f5a180dbecd0fbcdc92bf0ba2fc001c962b55a SOURCES/vsftpd-3.0.3.tar.gz
|
||||
|
||||
@ -1,56 +0,0 @@
|
||||
From d0045e35674d64d166d17c3c079ae03e8c2e6361 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Ond=C5=99ej=20Lyson=C4=9Bk?= <olysonek@redhat.com>
|
||||
Date: Thu, 13 Feb 2020 17:29:06 +0100
|
||||
Subject: [PATCH 2/2] Drop an unused global variable
|
||||
|
||||
The global variable `s_timezone` is not used anymore, so we can drop
|
||||
it.
|
||||
---
|
||||
sysutil.c | 17 +++--------------
|
||||
1 file changed, 3 insertions(+), 14 deletions(-)
|
||||
|
||||
diff --git a/sysutil.c b/sysutil.c
|
||||
index 66d4c5e..0ccf551 100644
|
||||
--- a/sysutil.c
|
||||
+++ b/sysutil.c
|
||||
@@ -72,8 +72,6 @@ static struct timeval s_current_time;
|
||||
static int s_current_pid = -1;
|
||||
/* Exit function */
|
||||
static exitfunc_t s_exit_func;
|
||||
-/* Difference in timezone from GMT in seconds */
|
||||
-static long s_timezone;
|
||||
|
||||
/* Our internal signal handling implementation details */
|
||||
static struct vsf_sysutil_sig_details
|
||||
@@ -2661,7 +2659,6 @@ char* vsf_sysutil_get_tz()
|
||||
void
|
||||
vsf_sysutil_tzset(void)
|
||||
{
|
||||
- int retval;
|
||||
char *tz=NULL, tzbuf[sizeof("+HHMM!")];
|
||||
time_t the_time = time(NULL);
|
||||
struct tm* p_tm;
|
||||
@@ -2681,17 +2678,9 @@ vsf_sysutil_tzset(void)
|
||||
{
|
||||
die("localtime");
|
||||
}
|
||||
- retval = strftime(tzbuf, sizeof(tzbuf), "%z", p_tm);
|
||||
- tzbuf[sizeof(tzbuf) - 1] = '\0';
|
||||
- if (retval == 5)
|
||||
- {
|
||||
- s_timezone = ((tzbuf[1] - '0') * 10 + (tzbuf[2] - '0')) * 60 * 60;
|
||||
- s_timezone += ((tzbuf[3] - '0') * 10 + (tzbuf[4] - '0')) * 60;
|
||||
- if (tzbuf[0] == '+')
|
||||
- {
|
||||
- s_timezone *= -1;
|
||||
- }
|
||||
- }
|
||||
+ /* Not sure if the following call to strftime() has any desired side
|
||||
+ effects, so I'm keeping it to be safe. */
|
||||
+ (void) strftime(tzbuf, sizeof(tzbuf), "%z", p_tm);
|
||||
/* Call in to the time subsystem again now that TZ is set, trying to force
|
||||
* caching of the actual zoneinfo for the timezone.
|
||||
*/
|
||||
--
|
||||
2.24.1
|
||||
|
||||
@ -1,7 +1,8 @@
|
||||
From 7957425ef5ab365fc96ea0615f99705581c6dbd8 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Ond=C5=99ej=20Lyson=C4=9Bk?= <olysonek@redhat.com>
|
||||
Date: Mon, 12 Aug 2019 18:15:36 +0200
|
||||
Subject: [PATCH] Repeat pututxline() until it succeeds if it fails with EINTR
|
||||
Subject: [PATCH 3/3] Repeat pututxline() until it succeeds if it fails with
|
||||
EINTR
|
||||
|
||||
Since the pututxline() bug rhbz#1749439 is now fixed in glibc in
|
||||
Fedora and RHEL-8, we can implement a complete solution for the stale
|
||||
@ -0,0 +1,153 @@
|
||||
From 01bef55a1987700af3d43cdc5f5be88d3843ab85 Mon Sep 17 00:00:00 2001
|
||||
From: Martin Sehnoutka <msehnout@redhat.com>
|
||||
Date: Thu, 17 Nov 2016 13:36:17 +0100
|
||||
Subject: [PATCH 33/59] Introduce TLSv1.1 and TLSv1.2 options.
|
||||
|
||||
Users can now enable a specific version of TLS protocol.
|
||||
---
|
||||
parseconf.c | 2 ++
|
||||
ssl.c | 8 ++++++++
|
||||
tunables.c | 9 +++++++--
|
||||
tunables.h | 2 ++
|
||||
vsftpd.conf.5 | 24 ++++++++++++++++++++----
|
||||
5 files changed, 39 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/parseconf.c b/parseconf.c
|
||||
index a2c715b..33a1349 100644
|
||||
--- a/parseconf.c
|
||||
+++ b/parseconf.c
|
||||
@@ -85,6 +85,8 @@ parseconf_bool_array[] =
|
||||
{ "ssl_sslv2", &tunable_sslv2 },
|
||||
{ "ssl_sslv3", &tunable_sslv3 },
|
||||
{ "ssl_tlsv1", &tunable_tlsv1 },
|
||||
+ { "ssl_tlsv1_1", &tunable_tlsv1_1 },
|
||||
+ { "ssl_tlsv1_2", &tunable_tlsv1_2 },
|
||||
{ "tilde_user_enable", &tunable_tilde_user_enable },
|
||||
{ "force_anon_logins_ssl", &tunable_force_anon_logins_ssl },
|
||||
{ "force_anon_data_ssl", &tunable_force_anon_data_ssl },
|
||||
diff --git a/ssl.c b/ssl.c
|
||||
index 96bf8ad..ba8a613 100644
|
||||
--- a/ssl.c
|
||||
+++ b/ssl.c
|
||||
@@ -135,6 +135,14 @@ ssl_init(struct vsf_session* p_sess)
|
||||
{
|
||||
options |= SSL_OP_NO_TLSv1;
|
||||
}
|
||||
+ if (!tunable_tlsv1_1)
|
||||
+ {
|
||||
+ options |= SSL_OP_NO_TLSv1_1;
|
||||
+ }
|
||||
+ if (!tunable_tlsv1_2)
|
||||
+ {
|
||||
+ options |= SSL_OP_NO_TLSv1_2;
|
||||
+ }
|
||||
SSL_CTX_set_options(p_ctx, options);
|
||||
if (tunable_rsa_cert_file)
|
||||
{
|
||||
diff --git a/tunables.c b/tunables.c
|
||||
index 93f85b1..78f2bcd 100644
|
||||
--- a/tunables.c
|
||||
+++ b/tunables.c
|
||||
@@ -66,6 +66,8 @@ int tunable_force_local_data_ssl;
|
||||
int tunable_sslv2;
|
||||
int tunable_sslv3;
|
||||
int tunable_tlsv1;
|
||||
+int tunable_tlsv1_1;
|
||||
+int tunable_tlsv1_2;
|
||||
int tunable_tilde_user_enable;
|
||||
int tunable_force_anon_logins_ssl;
|
||||
int tunable_force_anon_data_ssl;
|
||||
@@ -209,7 +211,10 @@ tunables_load_defaults()
|
||||
tunable_force_local_data_ssl = 1;
|
||||
tunable_sslv2 = 0;
|
||||
tunable_sslv3 = 0;
|
||||
+ /* TLSv1 up to TLSv1.2 is enabled by default */
|
||||
tunable_tlsv1 = 1;
|
||||
+ tunable_tlsv1_1 = 1;
|
||||
+ tunable_tlsv1_2 = 1;
|
||||
tunable_tilde_user_enable = 0;
|
||||
tunable_force_anon_logins_ssl = 0;
|
||||
tunable_force_anon_data_ssl = 0;
|
||||
@@ -292,8 +297,8 @@ tunables_load_defaults()
|
||||
install_str_setting(0, &tunable_dsa_cert_file);
|
||||
install_str_setting(0, &tunable_dh_param_file);
|
||||
install_str_setting(0, &tunable_ecdh_param_file);
|
||||
- install_str_setting("AES128-SHA:DES-CBC3-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA",
|
||||
- &tunable_ssl_ciphers);
|
||||
+ install_str_setting("AES128-SHA:DES-CBC3-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384",
|
||||
+ &tunable_ssl_ciphers);
|
||||
install_str_setting(0, &tunable_rsa_private_key_file);
|
||||
install_str_setting(0, &tunable_dsa_private_key_file);
|
||||
install_str_setting(0, &tunable_ca_certs_file);
|
||||
diff --git a/tunables.h b/tunables.h
|
||||
index 3e2d40c..a466427 100644
|
||||
--- a/tunables.h
|
||||
+++ b/tunables.h
|
||||
@@ -67,6 +67,8 @@ extern int tunable_force_local_data_ssl; /* Require local data uses SSL */
|
||||
extern int tunable_sslv2; /* Allow SSLv2 */
|
||||
extern int tunable_sslv3; /* Allow SSLv3 */
|
||||
extern int tunable_tlsv1; /* Allow TLSv1 */
|
||||
+extern int tunable_tlsv1_1; /* Allow TLSv1.1 */
|
||||
+extern int tunable_tlsv1_2; /* Allow TLSv1.2 */
|
||||
extern int tunable_tilde_user_enable; /* Support e.g. ~chris */
|
||||
extern int tunable_force_anon_logins_ssl; /* Require anon logins use SSL */
|
||||
extern int tunable_force_anon_data_ssl; /* Require anon data uses SSL */
|
||||
diff --git a/vsftpd.conf.5 b/vsftpd.conf.5
|
||||
index cf1ae34..a3d569e 100644
|
||||
--- a/vsftpd.conf.5
|
||||
+++ b/vsftpd.conf.5
|
||||
@@ -506,7 +506,7 @@ Default: YES
|
||||
Only applies if
|
||||
.BR ssl_enable
|
||||
is activated. If enabled, this option will permit SSL v2 protocol connections.
|
||||
-TLS v1 connections are preferred.
|
||||
+TLS v1.2 connections are preferred.
|
||||
|
||||
Default: NO
|
||||
.TP
|
||||
@@ -514,7 +514,7 @@ Default: NO
|
||||
Only applies if
|
||||
.BR ssl_enable
|
||||
is activated. If enabled, this option will permit SSL v3 protocol connections.
|
||||
-TLS v1 connections are preferred.
|
||||
+TLS v1.2 connections are preferred.
|
||||
|
||||
Default: NO
|
||||
.TP
|
||||
@@ -522,7 +522,23 @@ Default: NO
|
||||
Only applies if
|
||||
.BR ssl_enable
|
||||
is activated. If enabled, this option will permit TLS v1 protocol connections.
|
||||
-TLS v1 connections are preferred.
|
||||
+TLS v1.2 connections are preferred.
|
||||
+
|
||||
+Default: YES
|
||||
+.TP
|
||||
+.B ssl_tlsv1_1
|
||||
+Only applies if
|
||||
+.BR ssl_enable
|
||||
+is activated. If enabled, this option will permit TLS v1.1 protocol connections.
|
||||
+TLS v1.2 connections are preferred.
|
||||
+
|
||||
+Default: YES
|
||||
+.TP
|
||||
+.B ssl_tlsv1_2
|
||||
+Only applies if
|
||||
+.BR ssl_enable
|
||||
+is activated. If enabled, this option will permit TLS v1.2 protocol connections.
|
||||
+TLS v1.2 connections are preferred.
|
||||
|
||||
Default: YES
|
||||
.TP
|
||||
@@ -1044,7 +1060,7 @@ man page for further details. Note that restricting ciphers can be a useful
|
||||
security precaution as it prevents malicious remote parties forcing a cipher
|
||||
which they have found problems with.
|
||||
|
||||
-Default: DES-CBC3-SHA
|
||||
+Default: AES128-SHA:DES-CBC3-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384
|
||||
.TP
|
||||
.B user_config_dir
|
||||
This powerful option allows the override of any config option specified in
|
||||
--
|
||||
2.14.4
|
||||
|
||||
@ -0,0 +1,74 @@
|
||||
From 6c8dd87f311e411bcb1c72c1c780497881a5621c Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Ond=C5=99ej=20Lyson=C4=9Bk?= <olysonek@redhat.com>
|
||||
Date: Mon, 4 Sep 2017 11:32:03 +0200
|
||||
Subject: [PATCH 35/59] Modify DH enablement patch to build with OpenSSL 1.1
|
||||
|
||||
---
|
||||
ssl.c | 41 ++++++++++++++++++++++++++++++++++++++---
|
||||
1 file changed, 38 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/ssl.c b/ssl.c
|
||||
index ba8a613..09ec96a 100644
|
||||
--- a/ssl.c
|
||||
+++ b/ssl.c
|
||||
@@ -88,19 +88,54 @@ static struct mystr debug_str;
|
||||
}
|
||||
#endif
|
||||
|
||||
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
|
||||
+int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g)
|
||||
+{
|
||||
+ /* If the fields p and g in d are NULL, the corresponding input
|
||||
+ * parameters MUST be non-NULL. q may remain NULL.
|
||||
+ */
|
||||
+ if ((dh->p == NULL && p == NULL)
|
||||
+ || (dh->g == NULL && g == NULL))
|
||||
+ return 0;
|
||||
+
|
||||
+ if (p != NULL) {
|
||||
+ BN_free(dh->p);
|
||||
+ dh->p = p;
|
||||
+ }
|
||||
+ if (q != NULL) {
|
||||
+ BN_free(dh->q);
|
||||
+ dh->q = q;
|
||||
+ }
|
||||
+ if (g != NULL) {
|
||||
+ BN_free(dh->g);
|
||||
+ dh->g = g;
|
||||
+ }
|
||||
+
|
||||
+ if (q != NULL) {
|
||||
+ dh->length = BN_num_bits(q);
|
||||
+ }
|
||||
+
|
||||
+ return 1;
|
||||
+}
|
||||
+#endif
|
||||
+
|
||||
#if !defined(DH_get_dh)
|
||||
// Grab DH parameters
|
||||
DH *
|
||||
DH_get_dh(int size)
|
||||
{
|
||||
+ BIGNUM *g = NULL;
|
||||
+ BIGNUM *p = NULL;
|
||||
DH *dh = DH_new();
|
||||
if (!dh) {
|
||||
return NULL;
|
||||
}
|
||||
- dh->p = DH_get_prime(match_dh_bits(size));
|
||||
- BN_dec2bn(&dh->g, "2");
|
||||
- if (!dh->p || !dh->g)
|
||||
+ p = DH_get_prime(match_dh_bits(size));
|
||||
+ BN_dec2bn(&g, "2");
|
||||
+ if (!p || !g || !DH_set0_pqg(dh, p, NULL, g))
|
||||
{
|
||||
+ BN_free(g);
|
||||
+ BN_free(p);
|
||||
DH_free(dh);
|
||||
return NULL;
|
||||
}
|
||||
--
|
||||
2.14.4
|
||||
|
||||
@ -0,0 +1,32 @@
|
||||
From 1c280a0b04e58ec63ce9ab5eb8d0ffe5ebbae115 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Ond=C5=99ej=20Lyson=C4=9Bk?= <olysonek@redhat.com>
|
||||
Date: Thu, 21 Dec 2017 14:29:25 +0100
|
||||
Subject: [PATCH 42/59] When handling FEAT command, check ssl_tlsv1_1 and
|
||||
ssl_tlsv1_2
|
||||
|
||||
Send 'AUTH SSL' in reply to the FEAT command when the ssl_tlsv1_1
|
||||
or ssl_tlsv1_2 configuration option is enabled.
|
||||
|
||||
The patch was written by Martin Sehnoutka.
|
||||
|
||||
Resolves: rhbz#1432054
|
||||
---
|
||||
features.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/features.c b/features.c
|
||||
index 1212980..d024366 100644
|
||||
--- a/features.c
|
||||
+++ b/features.c
|
||||
@@ -22,7 +22,7 @@ handle_feat(struct vsf_session* p_sess)
|
||||
{
|
||||
vsf_cmdio_write_raw(p_sess, " AUTH SSL\r\n");
|
||||
}
|
||||
- if (tunable_tlsv1)
|
||||
+ if (tunable_tlsv1 || tunable_tlsv1_1 || tunable_tlsv1_2)
|
||||
{
|
||||
vsf_cmdio_write_raw(p_sess, " AUTH TLS\r\n");
|
||||
}
|
||||
--
|
||||
2.14.4
|
||||
|
||||
@ -0,0 +1,53 @@
|
||||
From 75c942c77aa575143c5b75637e64a925ad12641a Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Ond=C5=99ej=20Lyson=C4=9Bk?= <olysonek@redhat.com>
|
||||
Date: Thu, 21 Dec 2017 16:38:40 +0100
|
||||
Subject: [PATCH 43/59] Enable only TLSv1.2 by default
|
||||
|
||||
Disable TLSv1 and TLSv1.1 - enable only TLSv1.2 by default.
|
||||
---
|
||||
tunables.c | 6 +++---
|
||||
vsftpd.conf.5 | 4 ++--
|
||||
2 files changed, 5 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/tunables.c b/tunables.c
|
||||
index 354251c..9680528 100644
|
||||
--- a/tunables.c
|
||||
+++ b/tunables.c
|
||||
@@ -211,9 +211,9 @@ tunables_load_defaults()
|
||||
tunable_force_local_data_ssl = 1;
|
||||
tunable_sslv2 = 0;
|
||||
tunable_sslv3 = 0;
|
||||
- /* TLSv1 up to TLSv1.2 is enabled by default */
|
||||
- tunable_tlsv1 = 1;
|
||||
- tunable_tlsv1_1 = 1;
|
||||
+ tunable_tlsv1 = 0;
|
||||
+ tunable_tlsv1_1 = 0;
|
||||
+ /* Only TLSv1.2 is enabled by default */
|
||||
tunable_tlsv1_2 = 1;
|
||||
tunable_tilde_user_enable = 0;
|
||||
tunable_force_anon_logins_ssl = 0;
|
||||
diff --git a/vsftpd.conf.5 b/vsftpd.conf.5
|
||||
index 2a7662e..df14027 100644
|
||||
--- a/vsftpd.conf.5
|
||||
+++ b/vsftpd.conf.5
|
||||
@@ -539,7 +539,7 @@ Only applies if
|
||||
is activated. If enabled, this option will permit TLS v1 protocol connections.
|
||||
TLS v1.2 connections are preferred.
|
||||
|
||||
-Default: YES
|
||||
+Default: NO
|
||||
.TP
|
||||
.B ssl_tlsv1_1
|
||||
Only applies if
|
||||
@@ -547,7 +547,7 @@ Only applies if
|
||||
is activated. If enabled, this option will permit TLS v1.1 protocol connections.
|
||||
TLS v1.2 connections are preferred.
|
||||
|
||||
-Default: YES
|
||||
+Default: NO
|
||||
.TP
|
||||
.B ssl_tlsv1_2
|
||||
Only applies if
|
||||
--
|
||||
2.14.4
|
||||
|
||||
@ -1,27 +0,0 @@
|
||||
--- sysstr-orig.c 2022-07-27 09:44:52.606408000 +0200
|
||||
+++ sysstr.c 2022-07-27 09:54:24.043081352 +0200
|
||||
@@ -74,19 +74,11 @@
|
||||
int
|
||||
str_open(const struct mystr* p_str, const enum EVSFSysStrOpenMode mode)
|
||||
{
|
||||
- enum EVSFSysUtilOpenMode open_mode = kVSFSysUtilOpenUnknown;
|
||||
- switch (mode)
|
||||
- {
|
||||
- case kVSFSysStrOpenReadOnly:
|
||||
- open_mode = kVSFSysUtilOpenReadOnly;
|
||||
- break;
|
||||
- case kVSFSysStrOpenUnknown:
|
||||
- /* Fall through */
|
||||
- default:
|
||||
- bug("unknown mode value in str_open");
|
||||
- break;
|
||||
- }
|
||||
- return vsf_sysutil_open_file(str_getbuf(p_str), open_mode);
|
||||
+ if (mode == kVSFSysStrOpenReadOnly)
|
||||
+ return vsf_sysutil_open_file(str_getbuf(p_str), kVSFSysUtilOpenReadOnly);
|
||||
+
|
||||
+ bug("unknown mode value in str_open");
|
||||
+ return -1;
|
||||
}
|
||||
|
||||
int
|
||||
@ -0,0 +1,132 @@
|
||||
diff --git a/features.c b/features.c
|
||||
index d024366..3a60b88 100644
|
||||
--- a/features.c
|
||||
+++ b/features.c
|
||||
@@ -22,7 +22,7 @@ handle_feat(struct vsf_session* p_sess)
|
||||
{
|
||||
vsf_cmdio_write_raw(p_sess, " AUTH SSL\r\n");
|
||||
}
|
||||
- if (tunable_tlsv1 || tunable_tlsv1_1 || tunable_tlsv1_2)
|
||||
+ if (tunable_tlsv1 || tunable_tlsv1_1 || tunable_tlsv1_2 || tunable_tlsv1_3)
|
||||
{
|
||||
vsf_cmdio_write_raw(p_sess, " AUTH TLS\r\n");
|
||||
}
|
||||
diff --git a/parseconf.c b/parseconf.c
|
||||
index 3729818..2c5ffe6 100644
|
||||
--- a/parseconf.c
|
||||
+++ b/parseconf.c
|
||||
@@ -87,6 +87,7 @@ parseconf_bool_array[] =
|
||||
{ "ssl_tlsv1", &tunable_tlsv1 },
|
||||
{ "ssl_tlsv1_1", &tunable_tlsv1_1 },
|
||||
{ "ssl_tlsv1_2", &tunable_tlsv1_2 },
|
||||
+ { "ssl_tlsv1_3", &tunable_tlsv1_3 },
|
||||
{ "tilde_user_enable", &tunable_tilde_user_enable },
|
||||
{ "force_anon_logins_ssl", &tunable_force_anon_logins_ssl },
|
||||
{ "force_anon_data_ssl", &tunable_force_anon_data_ssl },
|
||||
diff --git a/ssl.c b/ssl.c
|
||||
index 09ec96a..5d9c595 100644
|
||||
--- a/ssl.c
|
||||
+++ b/ssl.c
|
||||
@@ -178,6 +178,10 @@ ssl_init(struct vsf_session* p_sess)
|
||||
{
|
||||
options |= SSL_OP_NO_TLSv1_2;
|
||||
}
|
||||
+ if (!tunable_tlsv1_3)
|
||||
+ {
|
||||
+ options |= SSL_OP_NO_TLSv1_3;
|
||||
+ }
|
||||
SSL_CTX_set_options(p_ctx, options);
|
||||
if (tunable_rsa_cert_file)
|
||||
{
|
||||
diff --git a/tunables.c b/tunables.c
|
||||
index c96c1ac..e6fbb9d 100644
|
||||
--- a/tunables.c
|
||||
+++ b/tunables.c
|
||||
@@ -68,6 +68,7 @@ int tunable_sslv3;
|
||||
int tunable_tlsv1;
|
||||
int tunable_tlsv1_1;
|
||||
int tunable_tlsv1_2;
|
||||
+int tunable_tlsv1_3;
|
||||
int tunable_tilde_user_enable;
|
||||
int tunable_force_anon_logins_ssl;
|
||||
int tunable_force_anon_data_ssl;
|
||||
@@ -217,8 +218,9 @@ tunables_load_defaults()
|
||||
tunable_sslv3 = 0;
|
||||
tunable_tlsv1 = 0;
|
||||
tunable_tlsv1_1 = 0;
|
||||
- /* Only TLSv1.2 is enabled by default */
|
||||
+ /* Only TLSv1.2 and TLSv1.3 are enabled by default */
|
||||
tunable_tlsv1_2 = 1;
|
||||
+ tunable_tlsv1_3 = 1;
|
||||
tunable_tilde_user_enable = 0;
|
||||
tunable_force_anon_logins_ssl = 0;
|
||||
tunable_force_anon_data_ssl = 0;
|
||||
diff --git a/tunables.h b/tunables.h
|
||||
index 8d50150..6e1d301 100644
|
||||
--- a/tunables.h
|
||||
+++ b/tunables.h
|
||||
@@ -69,6 +69,7 @@ extern int tunable_sslv3; /* Allow SSLv3 */
|
||||
extern int tunable_tlsv1; /* Allow TLSv1 */
|
||||
extern int tunable_tlsv1_1; /* Allow TLSv1.1 */
|
||||
extern int tunable_tlsv1_2; /* Allow TLSv1.2 */
|
||||
+extern int tunable_tlsv1_3; /* Allow TLSv1.3 */
|
||||
extern int tunable_tilde_user_enable; /* Support e.g. ~chris */
|
||||
extern int tunable_force_anon_logins_ssl; /* Require anon logins use SSL */
|
||||
extern int tunable_force_anon_data_ssl; /* Require anon data uses SSL */
|
||||
diff --git a/vsftpd.conf.5 b/vsftpd.conf.5
|
||||
index 815773f..c37a536 100644
|
||||
--- a/vsftpd.conf.5
|
||||
+++ b/vsftpd.conf.5
|
||||
@@ -555,7 +555,7 @@ Default: YES
|
||||
Only applies if
|
||||
.BR ssl_enable
|
||||
is activated. If enabled, this option will permit SSL v2 protocol connections.
|
||||
-TLS v1.2 connections are preferred.
|
||||
+TLS v1.2 and TLS v1.3 connections are preferred.
|
||||
|
||||
Default: NO
|
||||
.TP
|
||||
@@ -563,7 +563,7 @@ Default: NO
|
||||
Only applies if
|
||||
.BR ssl_enable
|
||||
is activated. If enabled, this option will permit SSL v3 protocol connections.
|
||||
-TLS v1.2 connections are preferred.
|
||||
+TLS v1.2 and TLS v1.3 connections are preferred.
|
||||
|
||||
Default: NO
|
||||
.TP
|
||||
@@ -571,7 +571,7 @@ Default: NO
|
||||
Only applies if
|
||||
.BR ssl_enable
|
||||
is activated. If enabled, this option will permit TLS v1 protocol connections.
|
||||
-TLS v1.2 connections are preferred.
|
||||
+TLS v1.2 and TLS v1.3 connections are preferred.
|
||||
|
||||
Default: NO
|
||||
.TP
|
||||
@@ -579,7 +579,7 @@ Default: NO
|
||||
Only applies if
|
||||
.BR ssl_enable
|
||||
is activated. If enabled, this option will permit TLS v1.1 protocol connections.
|
||||
-TLS v1.2 connections are preferred.
|
||||
+TLS v1.2 and TLS v1.3 connections are preferred.
|
||||
|
||||
Default: NO
|
||||
.TP
|
||||
@@ -587,7 +587,15 @@ Default: NO
|
||||
Only applies if
|
||||
.BR ssl_enable
|
||||
is activated. If enabled, this option will permit TLS v1.2 protocol connections.
|
||||
-TLS v1.2 connections are preferred.
|
||||
+TLS v1.2 and TLS v1.3 connections are preferred.
|
||||
+
|
||||
+Default: YES
|
||||
+.TP
|
||||
+.B ssl_tlsv1_3
|
||||
+Only applies if
|
||||
+.BR ssl_enable
|
||||
+is activated. If enabled, this option will permit TLS v1.3 protocol connections.
|
||||
+TLS v1.2 and TLS v1.3 connections are preferred.
|
||||
|
||||
Default: YES
|
||||
.TP
|
||||
@ -1,70 +0,0 @@
|
||||
diff --git a/ssl.c b/ssl.c
|
||||
--- ssl.c
|
||||
+++ ssl.c
|
||||
@@ -28,17 +28,17 @@
|
||||
#include <openssl/err.h>
|
||||
#include <openssl/rand.h>
|
||||
#include <openssl/bio.h>
|
||||
#include <openssl/bn.h>
|
||||
#include <openssl/param_build.h>
|
||||
#include <errno.h>
|
||||
#include <limits.h>
|
||||
|
||||
static char* get_ssl_error();
|
||||
static SSL* get_ssl(struct vsf_session* p_sess, int fd);
|
||||
static int ssl_session_init(struct vsf_session* p_sess);
|
||||
static void setup_bio_callbacks();
|
||||
static long bio_callback(
|
||||
- BIO* p_bio, int oper, const char* p_arg, int argi, long argl, long retval);
|
||||
+ BIO* p_bio, int oper, const char* p_arg, size_t len, int argi, long argl, int ret, size_t *processed);
|
||||
static int ssl_verify_callback(int verify_ok, X509_STORE_CTX* p_ctx);
|
||||
static int ssl_alpn_callback(SSL* p_ssl,
|
||||
const unsigned char** p_out,
|
||||
@@ -88,7 +88,7 @@
|
||||
long options;
|
||||
int verify_option = 0;
|
||||
SSL_library_init();
|
||||
- p_ctx = SSL_CTX_new(SSLv23_server_method());
|
||||
+ p_ctx = SSL_CTX_new_ex(NULL, NULL, TLS_server_method());
|
||||
if (p_ctx == NULL)
|
||||
{
|
||||
die("SSL: could not allocate SSL context");
|
||||
@@ -180,13 +180,10 @@
|
||||
die("SSL: RNG is not seeded");
|
||||
}
|
||||
{
|
||||
- EC_KEY* key = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
|
||||
- if (key == NULL)
|
||||
+ if (!SSL_CTX_set1_groups_list(p_ctx, "P-256"))
|
||||
{
|
||||
die("SSL: failed to get curve p256");
|
||||
}
|
||||
- SSL_CTX_set_tmp_ecdh(p_ctx, key);
|
||||
- EC_KEY_free(key);
|
||||
}
|
||||
if (tunable_ssl_request_cert)
|
||||
{
|
||||
@@ -692,17 +689,19 @@
|
||||
static void setup_bio_callbacks(SSL* p_ssl)
|
||||
{
|
||||
BIO* p_bio = SSL_get_rbio(p_ssl);
|
||||
- BIO_set_callback(p_bio, bio_callback);
|
||||
+ BIO_set_callback_ex(p_bio, bio_callback);
|
||||
p_bio = SSL_get_wbio(p_ssl);
|
||||
- BIO_set_callback(p_bio, bio_callback);
|
||||
+ BIO_set_callback_ex(p_bio, bio_callback);
|
||||
}
|
||||
|
||||
static long
|
||||
bio_callback(
|
||||
- BIO* p_bio, int oper, const char* p_arg, int argi, long argl, long ret)
|
||||
+ BIO* p_bio, int oper, const char* p_arg, size_t len, int argi, long argl, int ret, size_t *processed)
|
||||
{
|
||||
int retval = 0;
|
||||
int fd = 0;
|
||||
+ (void) len;
|
||||
+ (void) processed;
|
||||
(void) p_arg;
|
||||
(void) argi;
|
||||
(void) argl;
|
||||
|
||||
@ -1,139 +0,0 @@
|
||||
diff -urN vsftpd-3.0.5-orig/postlogin.c vsftpd-3.0.5/postlogin.c
|
||||
--- vsftpd-3.0.5-orig/postlogin.c 2015-07-22 21:03:22.000000000 +0200
|
||||
+++ vsftpd-3.0.5/postlogin.c 2023-02-13 16:34:05.244467476 +0100
|
||||
@@ -27,4 +27,6 @@
|
||||
#include "ssl.h"
|
||||
#include "vsftpver.h"
|
||||
+#include <netdb.h>
|
||||
+#include <arpa/inet.h>
|
||||
#include "opts.h"
|
||||
|
||||
@@ -628,9 +629,10 @@
|
||||
else
|
||||
{
|
||||
const void* p_v4addr = vsf_sysutil_sockaddr_ipv6_v4(s_p_sockaddr);
|
||||
+ static char result[INET_ADDRSTRLEN];
|
||||
if (p_v4addr)
|
||||
{
|
||||
- str_append_text(&s_pasv_res_str, vsf_sysutil_inet_ntoa(p_v4addr));
|
||||
+ str_append_text(&s_pasv_res_str, inet_ntop(AF_INET, p_v4addr, result, INET_ADDRSTRLEN));
|
||||
}
|
||||
else
|
||||
{
|
||||
diff -urN vsftpd-3.0.5-orig/sysutil.c vsftpd-3.0.5/sysutil.c
|
||||
--- vsftpd-3.0.5-orig/sysutil.c 2012-09-16 09:07:38.000000000 +0200
|
||||
+++ vsftpd-3.0.5/sysutil.c 2023-02-13 16:08:58.557153109 +0100
|
||||
@@ -2205,20 +2205,13 @@
|
||||
const struct sockaddr* p_sockaddr = &p_sockptr->u.u_sockaddr;
|
||||
if (p_sockaddr->sa_family == AF_INET)
|
||||
{
|
||||
- return inet_ntoa(p_sockptr->u.u_sockaddr_in.sin_addr);
|
||||
+ static char result[INET_ADDRSTRLEN];
|
||||
+ return inet_ntop(AF_INET, &p_sockptr->u.u_sockaddr_in.sin_addr, result, INET_ADDRSTRLEN);
|
||||
}
|
||||
else if (p_sockaddr->sa_family == AF_INET6)
|
||||
{
|
||||
- static char inaddr_buf[64];
|
||||
- const char* p_ret = inet_ntop(AF_INET6,
|
||||
- &p_sockptr->u.u_sockaddr_in6.sin6_addr,
|
||||
- inaddr_buf, sizeof(inaddr_buf));
|
||||
- inaddr_buf[sizeof(inaddr_buf) - 1] = '\0';
|
||||
- if (p_ret == NULL)
|
||||
- {
|
||||
- inaddr_buf[0] = '\0';
|
||||
- }
|
||||
- return inaddr_buf;
|
||||
+ static char result[INET6_ADDRSTRLEN];
|
||||
+ return inet_ntop(AF_INET6, &p_sockptr->u.u_sockaddr_in6.sin6_addr, result, INET6_ADDRSTRLEN);
|
||||
}
|
||||
else
|
||||
{
|
||||
@@ -2227,12 +2220,6 @@
|
||||
}
|
||||
}
|
||||
|
||||
-const char*
|
||||
-vsf_sysutil_inet_ntoa(const void* p_raw_addr)
|
||||
-{
|
||||
- return inet_ntoa(*((struct in_addr*)p_raw_addr));
|
||||
-}
|
||||
-
|
||||
int
|
||||
vsf_sysutil_inet_aton(const char* p_text, struct vsf_sysutil_sockaddr* p_addr)
|
||||
{
|
||||
@@ -2241,7 +2228,7 @@
|
||||
{
|
||||
bug("bad family");
|
||||
}
|
||||
- if (inet_aton(p_text, &sin_addr))
|
||||
+ if (inet_pton(AF_INET, p_text, &sin_addr))
|
||||
{
|
||||
vsf_sysutil_memcpy(&p_addr->u.u_sockaddr_in.sin_addr,
|
||||
&sin_addr, sizeof(p_addr->u.u_sockaddr_in.sin_addr));
|
||||
@@ -2257,37 +2244,46 @@
|
||||
vsf_sysutil_dns_resolve(struct vsf_sysutil_sockaddr** p_sockptr,
|
||||
const char* p_name)
|
||||
{
|
||||
- struct hostent* hent = gethostbyname(p_name);
|
||||
- if (hent == NULL)
|
||||
+ struct addrinfo *result;
|
||||
+ struct addrinfo hints;
|
||||
+ int ret;
|
||||
+
|
||||
+ memset(&hints, 0, sizeof(struct addrinfo));
|
||||
+ hints.ai_family = AF_UNSPEC;
|
||||
+
|
||||
+ if ((ret = getaddrinfo(p_name, NULL, &hints, &result)) != 0)
|
||||
{
|
||||
+ fprintf(stderr, "getaddrinfo: %s\n", gai_strerror(ret));
|
||||
die2("cannot resolve host:", p_name);
|
||||
}
|
||||
vsf_sysutil_sockaddr_clear(p_sockptr);
|
||||
- if (hent->h_addrtype == AF_INET)
|
||||
+ if (result->ai_family == AF_INET)
|
||||
{
|
||||
- unsigned int len = hent->h_length;
|
||||
+ unsigned int len = result->ai_addrlen;
|
||||
if (len > sizeof((*p_sockptr)->u.u_sockaddr_in.sin_addr))
|
||||
{
|
||||
len = sizeof((*p_sockptr)->u.u_sockaddr_in.sin_addr);
|
||||
}
|
||||
vsf_sysutil_sockaddr_alloc_ipv4(p_sockptr);
|
||||
vsf_sysutil_memcpy(&(*p_sockptr)->u.u_sockaddr_in.sin_addr,
|
||||
- hent->h_addr_list[0], len);
|
||||
+ &result->ai_addrlen, len);
|
||||
}
|
||||
- else if (hent->h_addrtype == AF_INET6)
|
||||
+ else if (result->ai_family == AF_INET6)
|
||||
{
|
||||
- unsigned int len = hent->h_length;
|
||||
+ unsigned int len = result->ai_addrlen;
|
||||
if (len > sizeof((*p_sockptr)->u.u_sockaddr_in6.sin6_addr))
|
||||
{
|
||||
len = sizeof((*p_sockptr)->u.u_sockaddr_in6.sin6_addr);
|
||||
}
|
||||
vsf_sysutil_sockaddr_alloc_ipv6(p_sockptr);
|
||||
vsf_sysutil_memcpy(&(*p_sockptr)->u.u_sockaddr_in6.sin6_addr,
|
||||
- hent->h_addr_list[0], len);
|
||||
+ &result->ai_addrlen, len);
|
||||
}
|
||||
else
|
||||
{
|
||||
- die("gethostbyname(): neither IPv4 nor IPv6");
|
||||
+ freeaddrinfo(result);
|
||||
+ die("getaddrinfo(): neither IPv4 nor IPv6");
|
||||
}
|
||||
+ freeaddrinfo(result);
|
||||
}
|
||||
|
||||
diff -urN vsftpd-3.0.5-orig/sysutil.h vsftpd-3.0.5/sysutil.h
|
||||
--- vsftpd-3.0.5-orig/sysutil.h 2021-05-18 08:50:21.000000000 +0200
|
||||
+++ vsftpd-3.0.5/sysutil.h 2023-02-13 15:59:22.088331075 +0100
|
||||
@@ -277,7 +277,6 @@
|
||||
|
||||
const char* vsf_sysutil_inet_ntop(
|
||||
const struct vsf_sysutil_sockaddr* p_sockptr);
|
||||
-const char* vsf_sysutil_inet_ntoa(const void* p_raw_addr);
|
||||
int vsf_sysutil_inet_aton(
|
||||
const char* p_text, struct vsf_sysutil_sockaddr* p_addr);
|
||||
|
||||
@ -1,15 +0,0 @@
|
||||
--- parseconf-orig.c 2022-10-25 15:17:18.990701984 +0200
|
||||
+++ parseconf.c 2022-10-25 15:12:44.213480000 +0200
|
||||
@@ -85,9 +85,9 @@
|
||||
{ "ssl_sslv2", &tunable_sslv2 },
|
||||
{ "ssl_sslv3", &tunable_sslv3 },
|
||||
{ "ssl_tlsv1", &tunable_tlsv1 },
|
||||
- { "ssl_tlsv11", &tunable_tlsv1_1 },
|
||||
- { "ssl_tlsv12", &tunable_tlsv1_2 },
|
||||
- { "ssl_tlsv13", &tunable_tlsv1_3 },
|
||||
+ { "ssl_tlsv1_1", &tunable_tlsv1_1 },
|
||||
+ { "ssl_tlsv1_2", &tunable_tlsv1_2 },
|
||||
+ { "ssl_tlsv1_3", &tunable_tlsv1_3 },
|
||||
{ "tilde_user_enable", &tunable_tilde_user_enable },
|
||||
{ "force_anon_logins_ssl", &tunable_force_anon_logins_ssl },
|
||||
{ "force_anon_data_ssl", &tunable_force_anon_data_ssl },
|
||||
Loading…
Reference in new issue