Rick Adams for Bill Scherlis, the night that MilNet died

SCCS-vsn: libexec/ftpd/ftpd.c 5.19
SCCS-vsn: libexec/ftpd/popen.c 5.3
SCCS-vsn: libexec/ftpd/ftpcmd.y 5.13

diff --git a/usr/src/libexec/ftpd/ftpcmd.y b/usr/src/libexec/ftpd/ftpcmd.y
index ccc966c..f52e29f 100644 (file)
--- a/usr/src/libexec/ftpd/ftpcmd.y
+++ b/usr/src/libexec/ftpd/ftpcmd.y
@@ -14,7 +14,7 @@
  * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
  * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  *
  * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
  * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  *

- *     @(#)ftpcmd.y    5.12 (Berkeley) %G%
+ *     @(#)ftpcmd.y    5.13 (Berkeley) %G%

  */
 
 /*
  */
 
 /*


@@ -25,7 +25,7 @@
 %{
 
 #ifndef lint
 %{
 
 #ifndef lint

-static char sccsid[] = "@(#)ftpcmd.y   5.12 (Berkeley) %G%";
+static char sccsid[] = "@(#)ftpcmd.y   5.13 (Berkeley) %G%";

 #endif /* not lint */
 
 #include <sys/types.h>
 #endif /* not lint */
 
 #include <sys/types.h>


@@ -598,28 +598,27 @@ getline(s, n, iop)
                }
        }
        while (--n > 0 && (c = getc(iop)) != EOF) {
                }
        }
        while (--n > 0 && (c = getc(iop)) != EOF) {

-               c = 0377 & c;
-               while (c == IAC) {
-                       switch (c = 0377 & getc(iop)) {
+               while ((0377&c) == IAC) {
+                       switch (0377&(c = getc(iop))) {

                        case WILL:
                        case WONT:
                        case WILL:
                        case WONT:

-                               c = 0377 & getc(iop);
-                               printf("%c%c%c", IAC, WONT, c);
+                               c = getc(iop);
+                               printf("%c%c%c", IAC, WONT, 0377&c);

                                (void) fflush(stdout);
                                break;
                        case DO:
                        case DONT:
                                (void) fflush(stdout);
                                break;
                        case DO:
                        case DONT:

-                               c = 0377 & getc(iop);
-                               printf("%c%c%c", IAC, DONT, c);
+                               c = getc(iop);
+                               printf("%c%c%c", IAC, DONT, 0377&c);

                                (void) fflush(stdout);
                                break;
                        default:
                                break;
                        }
                                (void) fflush(stdout);
                                break;
                        default:
                                break;
                        }

-                       c = 0377 & getc(iop); /* try next character */
+                       c = getc(iop); /* try next character */

                }
                }

-               *cs++ = c;
-               if (c=='\n')
+               *cs++ = 0377&c;
+               if ((0377&c) == '\n')

                        break;
        }
        if (c == EOF && cs == s)
                        break;
        }
        if (c == EOF && cs == s)


@@ -655,7 +654,7 @@ yylex()
        register char *cp;
        register struct tab *p;
        int n;
        register char *cp;
        register struct tab *p;
        int n;

-       char c;
+       char c, *strpbrk();

 
        for (;;) {
                switch (state) {
 
        for (;;) {
                switch (state) {


@@ -668,14 +667,11 @@ yylex()
                                dologout(0);
                        }
                        (void) alarm(0);
                                dologout(0);
                        }
                        (void) alarm(0);

-                       if (index(cbuf, '\r')) {
-                               cp = index(cbuf, '\r');
-                               cp[0] = '\n'; cp[1] = 0;
+                       if ((cp = index(cbuf, '\r'))) {
+                               *cp++ = '\n'; *cp = '\0';

                        }
                        }

-                       if (index(cbuf, ' '))
-                               cpos = index(cbuf, ' ') - cbuf;
-                       else
-                               cpos = index(cbuf, '\n') - cbuf;
+                       if ((cp = strpbrk(cbuf, " \n")))
+                               cpos = cp - cbuf;

                        if (cpos == 0) {
                                cpos = 4;
                        }
                        if (cpos == 0) {
                                cpos = 4;
                        }


@@ -811,7 +807,7 @@ yylex()
 }
 
 upper(s)
 }
 
 upper(s)

-       char *s;
+       register char *s;

 {
        while (*s != '\0') {
                if (islower(*s))
 {
        while (*s != '\0') {
                if (islower(*s))

diff --git a/usr/src/libexec/ftpd/ftpd.c b/usr/src/libexec/ftpd/ftpd.c
index 779b9d1..df9329c 100644 (file)
--- a/usr/src/libexec/ftpd/ftpd.c
+++ b/usr/src/libexec/ftpd/ftpd.c
@@ -22,7 +22,7 @@ char copyright[] =
 #endif /* not lint */
 
 #ifndef lint
 #endif /* not lint */
 
 #ifndef lint

-static char sccsid[] = "@(#)ftpd.c     5.18 (Berkeley) %G%";
+static char sccsid[] = "@(#)ftpd.c     5.19 (Berkeley) %G%";

 #endif /* not lint */
 
 /*
 #endif /* not lint */
 
 /*


@@ -62,7 +62,7 @@ extern        char *sys_errlist[];
 extern char *crypt();
 extern char version[];
 extern char *home;             /* pointer to home directory for glob */
 extern char *crypt();
 extern char version[];
 extern char *home;             /* pointer to home directory for glob */

-extern FILE *popen(), *fopen(), *freopen();
+extern FILE *ftpd_popen(), *fopen(), *freopen();

 extern int  pclose(), fclose();
 extern char *getline();
 extern char cbuf[];
 extern int  pclose(), fclose();
 extern char *getline();
 extern char cbuf[];


@@ -89,8 +89,8 @@ int   pdata;                  /* for passive mode */
 int    unique;
 int    transflag;
 char   tmpline[7];
 int    unique;
 int    transflag;
 char   tmpline[7];

-char   hostname[32];
-char   remotehost[32];
+char   hostname[MAXHOSTNAMELEN];
+char   remotehost[MAXHOSTNAMELEN];

 
 /*
  * Timeout intervals for retrying connections
 
 /*
  * Timeout intervals for retrying connections


@@ -164,11 +164,11 @@ nextopt:
                syslog(LOG_ERR, "signal: %m");
 
        /* handle urgent data inline */
                syslog(LOG_ERR, "signal: %m");
 
        /* handle urgent data inline */

+       /* Sequent defines this, but it doesn't work */

 #ifdef SO_OOBINLINE
 #ifdef SO_OOBINLINE

-       if (setsockopt(0, SOL_SOCKET, SO_OOBINLINE, (char *)&on, sizeof(on)) < 0) {
+       if (setsockopt(0, SOL_SOCKET, SO_OOBINLINE, (char *)&on, sizeof(on)) < 0)

                syslog(LOG_ERR, "setsockopt: %m");
                syslog(LOG_ERR, "setsockopt: %m");

-       }
-#endif SO_OOBINLINE
+#endif

        pgid = getpid();
        if (ioctl(fileno(stdin), SIOCSPGRP, (char *) &pgid) < 0) {
                syslog(LOG_ERR, "ioctl: %m");
        pgid = getpid();
        if (ioctl(fileno(stdin), SIOCSPGRP, (char *) &pgid) < 0) {
                syslog(LOG_ERR, "ioctl: %m");


@@ -185,8 +185,7 @@ nextopt:
        mode = MODE_S;
        tmpline[0] = '\0';
        (void) gethostname(hostname, sizeof (hostname));
        mode = MODE_S;
        tmpline[0] = '\0';
        (void) gethostname(hostname, sizeof (hostname));

-       reply(220, "%s FTP server (%s) ready.",
-               hostname, version);
+       reply(220, "%s FTP server (%s) ready.", hostname, version);

        for (;;) {
                (void) setjmp(errcatch);
                (void) yyparse();
        for (;;) {
                (void) setjmp(errcatch);
                (void) yyparse();


@@ -218,7 +217,7 @@ sgetsave(s)
 #endif
        
        if (new == NULL) {
 #endif
        
        if (new == NULL) {

-               reply(553, "Local resource failure");
+               reply(553, "Local resource failure: malloc");

                dologout(1);
        }
 #ifndef notdef
                dologout(1);
        }
 #ifndef notdef


@@ -318,7 +317,7 @@ retrieve(cmd, name)
 #ifdef notdef
                /* no remote command execution -- it's a security hole */
                if (*name == '|')
 #ifdef notdef
                /* no remote command execution -- it's a security hole */
                if (*name == '|')

-                       fin = popen(name + 1, "r"), closefunc = pclose;
+                       fin = ftpd_popen(name + 1, "r"), closefunc = pclose;

                else
 #endif
                        fin = fopen(name, "r"), closefunc = fclose;
                else
 #endif
                        fin = fopen(name, "r"), closefunc = fclose;


@@ -326,7 +325,7 @@ retrieve(cmd, name)
                char line[BUFSIZ];
 
                (void) sprintf(line, cmd, name), name = line;
                char line[BUFSIZ];
 
                (void) sprintf(line, cmd, name), name = line;

-               fin = popen(line, "r"), closefunc = pclose;
+               fin = ftpd_popen(line, "r"), closefunc = pclose;

        }
        if (fin == NULL) {
                if (errno != 0)
        }
        if (fin == NULL) {
                if (errno != 0)


@@ -365,7 +364,7 @@ store(name, mode)
 #ifdef notdef
        /* no remote command execution -- it's a security hole */
        if (name[0] == '|')
 #ifdef notdef
        /* no remote command execution -- it's a security hole */
        if (name[0] == '|')

-               fout = popen(&name[1], "w"), closefunc = pclose;
+               fout = ftpd_popen(&name[1], "w"), closefunc = pclose;

        else
 #endif
        {
        else
 #endif
        {


@@ -404,7 +403,7 @@ store(name, mode)
        pdata = -1;
 done:
        if (dochown)
        pdata = -1;
 done:
        if (dochown)

-               (void) chown(local, pw->pw_uid, -1);
+               (void) fchown(fileno(fout), pw->pw_uid, -1);

        (*closefunc)(fout);
 }
 
        (*closefunc)(fout);
 }
 


@@ -721,16 +720,15 @@ cwd(path)
 makedir(name)
        char *name;
 {
 makedir(name)
        char *name;
 {

-       struct stat st;
-       int dochown = stat(name, &st) < 0;
-       
-       if (mkdir(name, 0777) < 0) {
+       uid_t   oldeuid;
+
+       oldeuid = geteuid();
+       seteuid(pw->pw_uid);
+       if (mkdir(name, 0777) < 0)

                reply(550, "%s: %s.", name, sys_errlist[errno]);
                reply(550, "%s: %s.", name, sys_errlist[errno]);

-               return;
-       }
-       if (dochown)
-               (void) chown(name, pw->pw_uid, -1);
-       reply(257, "MKD command successful.");
+       else
+               reply(257, "MKD command successful.");
+       seteuid(oldeuid);

 }
 
 removedir(name)
 }
 
 removedir(name)

diff --git a/usr/src/libexec/ftpd/popen.c b/usr/src/libexec/ftpd/popen.c
index 14d45e8..e0db1d6 100644 (file)
--- a/usr/src/libexec/ftpd/popen.c
+++ b/usr/src/libexec/ftpd/popen.c
@@ -21,7 +21,7 @@
  */
 
 #ifndef lint
  */
 
 #ifndef lint

-static char sccsid[] = "@(#)popen.c    5.2 (Berkeley) %G%";
+static char sccsid[] = "@(#)popen.c    5.3 (Berkeley) %G%";

 #endif /* not lint */
 
 #include <sys/types.h>
 #endif /* not lint */
 
 #include <sys/types.h>


@@ -37,7 +37,7 @@ static uid_t *pids;
 static int fds;
 
 FILE *
 static int fds;
 
 FILE *

-popen(program, type)
+ftpd_popen(program, type)

        char *program, *type;
 {
        register char *cp;
        char *program, *type;
 {
        register char *cp;