From 9d90ef9e836a4e5206e4958396f0c03d2de33b60 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ond=C5=99ej=20Lyson=C4=9Bk?= Date: Thu, 13 Feb 2020 17:38:33 +0100 Subject: [PATCH 01/40] Fix timestamp handling in MDTM Resolves: rhbz#1567855 --- 0001-Fix-timestamp-handling-in-MDTM.patch | 151 ++++++++++++++++++++++ 0002-Drop-an-unused-global-variable.patch | 56 ++++++++ vsftpd.spec | 8 +- 3 files changed, 214 insertions(+), 1 deletion(-) create mode 100644 0001-Fix-timestamp-handling-in-MDTM.patch create mode 100644 0002-Drop-an-unused-global-variable.patch diff --git a/0001-Fix-timestamp-handling-in-MDTM.patch b/0001-Fix-timestamp-handling-in-MDTM.patch new file mode 100644 index 0000000..3975bf3 --- /dev/null +++ b/0001-Fix-timestamp-handling-in-MDTM.patch @@ -0,0 +1,151 @@ +From 6a4dc470e569df38b8a7ea09ee6aace3c73b7353 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ond=C5=99ej=20Lyson=C4=9Bk?= +Date: Wed, 28 Mar 2018 09:06:34 +0200 +Subject: [PATCH 1/2] Fix timestamp handling in MDTM + +There were two problems with the timestamp handling with MDTM: + +1. In vsf_sysutil_parse_time(), the `the_time.tm_isdst` attribute was + always set to 0, regardless of whether DST (daylight saving time) + is active on the given date or not. + + This made glibc shift the timestamp when DST was in fact active on + the given date, in an attempt to correct the discrepancy between + the given timestamp and the `tm_isdst` attribute. The shifting + produced incorrect results however. + + We fix this by setting `tm_isdst` to -1 to let glibc decide if DST + is active or not at the time of the timestamp. glibc won't touch + the timestamp then. + +2. vsftpd used to record the offset from UTC of the current timezone + in the global variable `s_timezone`. This variable was then + subtracted from the variable `the_time` in vsf_sysutil_setmodtime() + when the config option use_localtime=NO was set. This was done to + compensate for the fact that mktime(), used in + vsf_sysutil_parse_time(), expects a timestamp expressed as local + time, whereas vsftpd is dealing with universal time. + + However, this did not work in the case when the offset stored in + `s_timezone` did not match the timezone of the timestamp given to + mktime() - this happens when DST is active at the current time, but + DST is not active at the time of the timestamp, or vice versa. + + We fix this by subtracting the real timezone offset directly in + vsf_sysutil_parse_time(). + + Note that the `tm_gmtoff` attribute, used in this fix, is a + BSD/glic extension. However, using `tm_gmtoff` seems like the + simplest solution and we need to make this work only with glibc + anyway. + +The fix was tested in the following way. We checked that the timestamp +given to the MDTM command when setting modification time exactly +matches the timestamp received as response from MDTM when reading back +the modification time. Additionally, we checked that the modification +time was set correctly on the given file on disk. + +These two checks were performed under various conditions - all the +combinations of DST/non-DST system time, DST/non-DST modification +time, use_localtime=YES/NO. + +Note that (I think) this will still not work if the rules for when DST +is active change. For example, if DST is ever completely cancelled in +the Europe/Prague timezone, and vsftpd is dealing with a timestamp +from a time when DST was active, it will produce incorrect results. I +think we would need the full zone file to fix this, but the zone file +is hard to provide when we're chroot-ed. + +Resolves: rhbz#1567855 +--- + postlogin.c | 5 +++-- + sysutil.c | 17 ++++++++++------- + sysutil.h | 4 ++-- + 3 files changed, 15 insertions(+), 11 deletions(-) + +diff --git a/postlogin.c b/postlogin.c +index 7c749ef..8a3d9d2 100644 +--- a/postlogin.c ++++ b/postlogin.c +@@ -1788,7 +1788,8 @@ handle_mdtm(struct vsf_session* p_sess) + if (do_write != 0) + { + str_split_char(&p_sess->ftp_arg_str, &s_filename_str, ' '); +- modtime = vsf_sysutil_parse_time(str_getbuf(&p_sess->ftp_arg_str)); ++ modtime = vsf_sysutil_parse_time( ++ str_getbuf(&p_sess->ftp_arg_str), tunable_use_localtime); + str_copy(&p_sess->ftp_arg_str, &s_filename_str); + } + resolve_tilde(&p_sess->ftp_arg_str, p_sess); +@@ -1809,7 +1810,7 @@ handle_mdtm(struct vsf_session* p_sess) + else + { + retval = vsf_sysutil_setmodtime( +- str_getbuf(&p_sess->ftp_arg_str), modtime, tunable_use_localtime); ++ str_getbuf(&p_sess->ftp_arg_str), modtime); + if (retval != 0) + { + vsf_cmdio_write(p_sess, FTP_FILEFAIL, +diff --git a/sysutil.c b/sysutil.c +index e847650..66d4c5e 100644 +--- a/sysutil.c ++++ b/sysutil.c +@@ -2819,11 +2819,13 @@ vsf_sysutil_syslog(const char* p_text, int severe) + } + + long +-vsf_sysutil_parse_time(const char* p_text) ++vsf_sysutil_parse_time(const char* p_text, int is_localtime) + { ++ long res; + struct tm the_time; + unsigned int len = vsf_sysutil_strlen(p_text); + vsf_sysutil_memclr(&the_time, sizeof(the_time)); ++ the_time.tm_isdst = -1; + if (len >= 8) + { + char yr[5]; +@@ -2848,17 +2850,18 @@ vsf_sysutil_parse_time(const char* p_text) + the_time.tm_min = vsf_sysutil_atoi(mins); + the_time.tm_sec = vsf_sysutil_atoi(sec); + } +- return mktime(&the_time); ++ res = mktime(&the_time); ++ if (!is_localtime) ++ { ++ res += the_time.tm_gmtoff; ++ } ++ return res; + } + + int +-vsf_sysutil_setmodtime(const char* p_file, long the_time, int is_localtime) ++vsf_sysutil_setmodtime(const char* p_file, long the_time) + { + struct utimbuf new_times; +- if (!is_localtime) +- { +- the_time -= s_timezone; +- } + vsf_sysutil_memclr(&new_times, sizeof(new_times)); + new_times.actime = the_time; + new_times.modtime = the_time; +diff --git a/sysutil.h b/sysutil.h +index 7a59f13..b90f6ca 100644 +--- a/sysutil.h ++++ b/sysutil.h +@@ -349,9 +349,9 @@ void vsf_sysutil_chroot(const char* p_root_path); + */ + long vsf_sysutil_get_time_sec(void); + long vsf_sysutil_get_time_usec(void); +-long vsf_sysutil_parse_time(const char* p_text); ++long vsf_sysutil_parse_time(const char* p_text, int is_localtime); + void vsf_sysutil_sleep(double seconds); +-int vsf_sysutil_setmodtime(const char* p_file, long the_time, int is_localtime); ++int vsf_sysutil_setmodtime(const char* p_file, long the_time); + + /* Limits */ + void vsf_sysutil_set_address_space_limit(unsigned long bytes); +-- +2.24.1 + diff --git a/0002-Drop-an-unused-global-variable.patch b/0002-Drop-an-unused-global-variable.patch new file mode 100644 index 0000000..53af589 --- /dev/null +++ b/0002-Drop-an-unused-global-variable.patch @@ -0,0 +1,56 @@ +From d0045e35674d64d166d17c3c079ae03e8c2e6361 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ond=C5=99ej=20Lyson=C4=9Bk?= +Date: Thu, 13 Feb 2020 17:29:06 +0100 +Subject: [PATCH 2/2] Drop an unused global variable + +The global variable `s_timezone` is not used anymore, so we can drop +it. +--- + sysutil.c | 17 +++-------------- + 1 file changed, 3 insertions(+), 14 deletions(-) + +diff --git a/sysutil.c b/sysutil.c +index 66d4c5e..0ccf551 100644 +--- a/sysutil.c ++++ b/sysutil.c +@@ -72,8 +72,6 @@ static struct timeval s_current_time; + static int s_current_pid = -1; + /* Exit function */ + static exitfunc_t s_exit_func; +-/* Difference in timezone from GMT in seconds */ +-static long s_timezone; + + /* Our internal signal handling implementation details */ + static struct vsf_sysutil_sig_details +@@ -2661,7 +2659,6 @@ char* vsf_sysutil_get_tz() + void + vsf_sysutil_tzset(void) + { +- int retval; + char *tz=NULL, tzbuf[sizeof("+HHMM!")]; + time_t the_time = time(NULL); + struct tm* p_tm; +@@ -2681,17 +2678,9 @@ vsf_sysutil_tzset(void) + { + die("localtime"); + } +- retval = strftime(tzbuf, sizeof(tzbuf), "%z", p_tm); +- tzbuf[sizeof(tzbuf) - 1] = '\0'; +- if (retval == 5) +- { +- s_timezone = ((tzbuf[1] - '0') * 10 + (tzbuf[2] - '0')) * 60 * 60; +- s_timezone += ((tzbuf[3] - '0') * 10 + (tzbuf[4] - '0')) * 60; +- if (tzbuf[0] == '+') +- { +- s_timezone *= -1; +- } +- } ++ /* Not sure if the following call to strftime() has any desired side ++ effects, so I'm keeping it to be safe. */ ++ (void) strftime(tzbuf, sizeof(tzbuf), "%z", p_tm); + /* Call in to the time subsystem again now that TZ is set, trying to force + * caching of the actual zoneinfo for the timezone. + */ +-- +2.24.1 + diff --git a/vsftpd.spec b/vsftpd.spec index 644221c..f81c2f8 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -2,7 +2,7 @@ Name: vsftpd Version: 3.0.3 -Release: 36%{?dist} +Release: 37%{?dist} Summary: Very Secure Ftp Daemon # OpenSSL link exception @@ -93,6 +93,8 @@ Patch63: 0001-Set-s_uwtmp_inserted-only-after-record-insertion-rem.patch Patch64: 0002-Repeat-pututxline-if-it-fails-with-EINTR.patch Patch65: 0001-Repeat-pututxline-until-it-succeeds-if-it-fails-with.patch Patch66: 0001-Fix-assignment-of-an-enumerator-of-a-different-type.patch +Patch67: 0001-Fix-timestamp-handling-in-MDTM.patch +Patch68: 0002-Drop-an-unused-global-variable.patch %description vsftpd is a Very Secure FTP daemon. It was written completely from @@ -161,6 +163,10 @@ mkdir -p $RPM_BUILD_ROOT/%{_var}/ftp/pub %{_var}/ftp %changelog +* Thu Feb 13 2020 Ondřej Lysoněk - 3.0.3-37 +- Fix timestamp handling in MDTM +- Resolves: rhbz#1567855 + * Fri Feb 07 2020 Ondřej Lysoněk - 3.0.3-36 - Fix build with gcc 10 - Resolves: rhbz#1800239 From d37bca598d7a7925579b9dcfcd9c221f42d0a936 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ond=C5=99ej=20Lyson=C4=9Bk?= Date: Tue, 17 Mar 2020 13:02:58 +0100 Subject: [PATCH 02/40] Remove a hint about the ftp_home_dir SELinux boolean from the config file Resolves: rhbz#1623424 --- ...out-the-ftp_home_dir-SELinux-boolean.patch | 25 +++++++++++++++++++ vsftpd.spec | 7 +++++- 2 files changed, 31 insertions(+), 1 deletion(-) create mode 100644 0001-Remove-a-hint-about-the-ftp_home_dir-SELinux-boolean.patch diff --git a/0001-Remove-a-hint-about-the-ftp_home_dir-SELinux-boolean.patch b/0001-Remove-a-hint-about-the-ftp_home_dir-SELinux-boolean.patch new file mode 100644 index 0000000..88640ac --- /dev/null +++ b/0001-Remove-a-hint-about-the-ftp_home_dir-SELinux-boolean.patch @@ -0,0 +1,25 @@ +From ab797dcffc855b05c9e7c8db4e5be2fc7510831b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ond=C5=99ej=20Lyson=C4=9Bk?= +Date: Tue, 17 Mar 2020 12:57:36 +0100 +Subject: [PATCH] Remove a hint about the ftp_home_dir SELinux boolean + +The boolean has been removed from SELinux. +--- + vsftpd.conf | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/vsftpd.conf b/vsftpd.conf +index 6b8eebb..ea20a72 100644 +--- a/vsftpd.conf ++++ b/vsftpd.conf +@@ -12,7 +12,6 @@ + anonymous_enable=NO + # + # Uncomment this to allow local users to log in. +-# When SELinux is enforcing check for SE bool ftp_home_dir + local_enable=YES + # + # Uncomment this to enable any form of FTP write command. +-- +2.25.1 + diff --git a/vsftpd.spec b/vsftpd.spec index f81c2f8..b878bdb 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -2,7 +2,7 @@ Name: vsftpd Version: 3.0.3 -Release: 37%{?dist} +Release: 38%{?dist} Summary: Very Secure Ftp Daemon # OpenSSL link exception @@ -95,6 +95,7 @@ Patch65: 0001-Repeat-pututxline-until-it-succeeds-if-it-fails-with.patch Patch66: 0001-Fix-assignment-of-an-enumerator-of-a-different-type.patch Patch67: 0001-Fix-timestamp-handling-in-MDTM.patch Patch68: 0002-Drop-an-unused-global-variable.patch +Patch69: 0001-Remove-a-hint-about-the-ftp_home_dir-SELinux-boolean.patch %description vsftpd is a Very Secure FTP daemon. It was written completely from @@ -163,6 +164,10 @@ mkdir -p $RPM_BUILD_ROOT/%{_var}/ftp/pub %{_var}/ftp %changelog +* Tue Mar 17 2020 Ondřej Lysoněk - 3.0.3-38 +- Removed a hint about the ftp_home_dir SELinux boolean from the config file +- Resolves: rhbz#1623424 + * Thu Feb 13 2020 Ondřej Lysoněk - 3.0.3-37 - Fix timestamp handling in MDTM - Resolves: rhbz#1567855 From 2526a74ac732414d31a20591f7b3e3e94a970363 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 29 Jul 2020 13:54:09 +0000 Subject: [PATCH 03/40] - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- vsftpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/vsftpd.spec b/vsftpd.spec index b878bdb..d605550 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -2,7 +2,7 @@ Name: vsftpd Version: 3.0.3 -Release: 38%{?dist} +Release: 39%{?dist} Summary: Very Secure Ftp Daemon # OpenSSL link exception @@ -164,6 +164,9 @@ mkdir -p $RPM_BUILD_ROOT/%{_var}/ftp/pub %{_var}/ftp %changelog +* Wed Jul 29 2020 Fedora Release Engineering - 3.0.3-39 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + * Tue Mar 17 2020 Ondřej Lysoněk - 3.0.3-38 - Removed a hint about the ftp_home_dir SELinux boolean from the config file - Resolves: rhbz#1623424 From a745964126c155fa6083c67a3ebc7588f476c3d9 Mon Sep 17 00:00:00 2001 From: Artem Egorenkov Date: Tue, 3 Nov 2020 17:45:54 +0100 Subject: [PATCH 04/40] Unit files fixed "After=network-online.target" --- vsftpd.service | 2 +- vsftpd.spec | 5 ++++- vsftpd.target | 2 +- vsftpd@.service | 2 +- 4 files changed, 7 insertions(+), 4 deletions(-) diff --git a/vsftpd.service b/vsftpd.service index 8ebae44..4a41b72 100644 --- a/vsftpd.service +++ b/vsftpd.service @@ -1,6 +1,6 @@ [Unit] Description=Vsftpd ftp daemon -After=network.target +After=network-online.target [Service] Type=forking diff --git a/vsftpd.spec b/vsftpd.spec index d605550..b0556d4 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -2,7 +2,7 @@ Name: vsftpd Version: 3.0.3 -Release: 39%{?dist} +Release: 40%{?dist} Summary: Very Secure Ftp Daemon # OpenSSL link exception @@ -164,6 +164,9 @@ mkdir -p $RPM_BUILD_ROOT/%{_var}/ftp/pub %{_var}/ftp %changelog +* Mon Nov 02 2020 Artem Egorenkov - 3.0.3-40 +- Unit files fixed "After=network-online.target" + * Wed Jul 29 2020 Fedora Release Engineering - 3.0.3-39 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild diff --git a/vsftpd.target b/vsftpd.target index 3f0a942..3828bf8 100644 --- a/vsftpd.target +++ b/vsftpd.target @@ -1,6 +1,6 @@ [Unit] Description=FTP daemon -After=network.target +After=network-online.target [Install] WantedBy=multi-user.target diff --git a/vsftpd@.service b/vsftpd@.service index f3a7a16..b063f8f 100644 --- a/vsftpd@.service +++ b/vsftpd@.service @@ -1,6 +1,6 @@ [Unit] Description=Vsftpd ftp daemon -After=network.target +After=network-online.target PartOf=vsftpd.target [Service] From a93b3655b0694e1c45b216da31583778be348253 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timm=20B=C3=A4der?= Date: Tue, 17 Nov 2020 10:16:57 +0100 Subject: [PATCH 05/40] Fix str_open() in a different way The original patch tried to fix it by not assigning anything to open_mode. That only works if the compiler is able to deduce that bug() will abort the process however (or just not warn about the uninitialized use of open_mode). clang does warn about open_mode being used uninitialized in this function. Solve this by rewriting the function to simply only consider one case, the mode == kVSFSysStrOpenReadOnly one. Otherwise, don't call vsf_sysutil_open_file() and just return -1 after calling bug(). --- ...of-an-enumerator-of-a-different-type.patch | 33 ------------------- fix-str_open.patch | 28 ++++++++++++++++ vsftpd.spec | 2 +- 3 files changed, 29 insertions(+), 34 deletions(-) delete mode 100644 0001-Fix-assignment-of-an-enumerator-of-a-different-type.patch create mode 100644 fix-str_open.patch diff --git a/0001-Fix-assignment-of-an-enumerator-of-a-different-type.patch b/0001-Fix-assignment-of-an-enumerator-of-a-different-type.patch deleted file mode 100644 index e20404a..0000000 --- a/0001-Fix-assignment-of-an-enumerator-of-a-different-type.patch +++ /dev/null @@ -1,33 +0,0 @@ -From 8882c5f7788fc2ea7cae824a7fa09b82782fc81e Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Ond=C5=99ej=20Lyson=C4=9Bk?= -Date: Fri, 7 Feb 2020 11:51:46 +0100 -Subject: [PATCH] Fix assignment of an enumerator of a different type - -The kVSFSysStrOpenUnknown enumerator is not part of the -EVSFSysUtilOpenMode enum. The assignment causes a build failure with -gcc 10. - -The open_mode variable need not be initialized, because the switch -statement either sets the variable or causes us to exit. - -Resolves: rhbz#1800239 ---- - sysstr.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/sysstr.c b/sysstr.c -index d86cdf1..ff2671b 100644 ---- a/sysstr.c -+++ b/sysstr.c -@@ -74,7 +74,7 @@ str_chdir(const struct mystr* p_str) - int - str_open(const struct mystr* p_str, const enum EVSFSysStrOpenMode mode) - { -- enum EVSFSysUtilOpenMode open_mode = kVSFSysStrOpenUnknown; -+ enum EVSFSysUtilOpenMode open_mode; - switch (mode) - { - case kVSFSysStrOpenReadOnly: --- -2.24.1 - diff --git a/fix-str_open.patch b/fix-str_open.patch new file mode 100644 index 0000000..eef52ec --- /dev/null +++ b/fix-str_open.patch @@ -0,0 +1,28 @@ +diff -ruN vsftpd-3.0.3.orig/sysstr.c vsftpd-3.0.3/sysstr.c +--- vsftpd-3.0.3.orig/sysstr.c 2020-11-17 09:47:03.872923383 +0100 ++++ vsftpd-3.0.3/sysstr.c 2020-11-17 09:48:41.219754145 +0100 +@@ -74,19 +74,11 @@ + int + str_open(const struct mystr* p_str, const enum EVSFSysStrOpenMode mode) + { +- enum EVSFSysUtilOpenMode open_mode = kVSFSysStrOpenUnknown; +- switch (mode) +- { +- case kVSFSysStrOpenReadOnly: +- open_mode = kVSFSysUtilOpenReadOnly; +- break; +- case kVSFSysStrOpenUnknown: +- /* Fall through */ +- default: +- bug("unknown mode value in str_open"); +- break; +- } +- return vsf_sysutil_open_file(str_getbuf(p_str), open_mode); ++ if (mode == kVSFSysStrOpenReadOnly) ++ return vsf_sysutil_open_file(str_getbuf(p_str), kVSFSysUtilOpenReadOnly); ++ ++ bug("unknown mode value in str_open"); ++ return -1; + } + + int diff --git a/vsftpd.spec b/vsftpd.spec index b0556d4..9bb18a5 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -92,10 +92,10 @@ Patch62: 0002-Prevent-recursion-in-bug.patch Patch63: 0001-Set-s_uwtmp_inserted-only-after-record-insertion-rem.patch Patch64: 0002-Repeat-pututxline-if-it-fails-with-EINTR.patch Patch65: 0001-Repeat-pututxline-until-it-succeeds-if-it-fails-with.patch -Patch66: 0001-Fix-assignment-of-an-enumerator-of-a-different-type.patch Patch67: 0001-Fix-timestamp-handling-in-MDTM.patch Patch68: 0002-Drop-an-unused-global-variable.patch Patch69: 0001-Remove-a-hint-about-the-ftp_home_dir-SELinux-boolean.patch +Patch70: fix-str_open.patch %description vsftpd is a Very Secure FTP daemon. It was written completely from From 9c2c73019c8236c5e6643ca5d846bb5ebe24867d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timm=20B=C3=A4der?= Date: Tue, 17 Nov 2020 10:19:59 +0100 Subject: [PATCH 06/40] spec: Pass $RPM_LD_FLAGS to LINK --- vsftpd.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/vsftpd.spec b/vsftpd.spec index 9bb18a5..b79ccff 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -111,7 +111,7 @@ cp %{SOURCE1} . %else %make_build CFLAGS="$RPM_OPT_FLAGS -fpie -pipe -Wextra -Werror" \ %endif - LINK="-pie -lssl" %{?_smp_mflags} + LINK="-pie -lssl $RPM_LD_FLAGS" %{?_smp_mflags} %install mkdir -p $RPM_BUILD_ROOT%{_sbindir} From eac39c3fbaa53849920beb57ea7c9b5b1810ecbb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Timm=20B=C3=A4der?= Date: Fri, 27 Nov 2020 16:13:07 +0100 Subject: [PATCH 07/40] Update changelog --- vsftpd.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/vsftpd.spec b/vsftpd.spec index b79ccff..c5bc898 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -164,6 +164,10 @@ mkdir -p $RPM_BUILD_ROOT/%{_var}/ftp/pub %{_var}/ftp %changelog +* Wed Nov 27 2020 Timm Bäder - 3.0.3-41 +- Fix str_open() so it doesn't warn when compiled with clang +- Pass $RPM_LD_FLAGS when linking + * Mon Nov 02 2020 Artem Egorenkov - 3.0.3-40 - Unit files fixed "After=network-online.target" From ed85881b79c0d9edd57f3eb857161e7c7af68105 Mon Sep 17 00:00:00 2001 From: Artem Egorenkov Date: Mon, 30 Nov 2020 14:48:45 +0100 Subject: [PATCH 08/40] - Release bumped - Changelog date fixed --- vsftpd.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/vsftpd.spec b/vsftpd.spec index c5bc898..5c42478 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -2,7 +2,7 @@ Name: vsftpd Version: 3.0.3 -Release: 40%{?dist} +Release: 41%{?dist} Summary: Very Secure Ftp Daemon # OpenSSL link exception @@ -164,7 +164,7 @@ mkdir -p $RPM_BUILD_ROOT/%{_var}/ftp/pub %{_var}/ftp %changelog -* Wed Nov 27 2020 Timm Bäder - 3.0.3-41 +* Fri Nov 27 2020 Timm Bäder - 3.0.3-41 - Fix str_open() so it doesn't warn when compiled with clang - Pass $RPM_LD_FLAGS when linking From 2b0cc8cb30e916ca0ea159107dcd2275155a4ac1 Mon Sep 17 00:00:00 2001 From: Tom Stellard Date: Sat, 9 Jan 2021 00:47:59 +0000 Subject: [PATCH 09/40] Add BuildRequires: make https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot --- vsftpd.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/vsftpd.spec b/vsftpd.spec index 5c42478..6933a11 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -19,6 +19,7 @@ Source8: vsftpd@.service Source9: vsftpd.target Source10: vsftpd-generator +BuildRequires: make BuildRequires: pam-devel BuildRequires: libcap-devel BuildRequires: openssl-devel From ba82eb63b783c0f54d46ad9114b7be94f1dbc4b7 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 27 Jan 2021 23:15:33 +0000 Subject: [PATCH 10/40] - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- vsftpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/vsftpd.spec b/vsftpd.spec index 6933a11..7d1fc6f 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -2,7 +2,7 @@ Name: vsftpd Version: 3.0.3 -Release: 41%{?dist} +Release: 42%{?dist} Summary: Very Secure Ftp Daemon # OpenSSL link exception @@ -165,6 +165,9 @@ mkdir -p $RPM_BUILD_ROOT/%{_var}/ftp/pub %{_var}/ftp %changelog +* Wed Jan 27 2021 Fedora Release Engineering - 3.0.3-42 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + * Fri Nov 27 2020 Timm Bäder - 3.0.3-41 - Fix str_open() so it doesn't warn when compiled with clang - Pass $RPM_LD_FLAGS when linking From 87915b320db3de54f10142f32a4471532c9672ba Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 2 Mar 2021 16:12:03 +0100 Subject: [PATCH 11/40] Rebuilt for updated systemd-rpm-macros See https://pagure.io/fesco/issue/2583. --- vsftpd.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/vsftpd.spec b/vsftpd.spec index 7d1fc6f..5d3b9ea 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -2,7 +2,7 @@ Name: vsftpd Version: 3.0.3 -Release: 42%{?dist} +Release: 43%{?dist} Summary: Very Secure Ftp Daemon # OpenSSL link exception @@ -165,6 +165,10 @@ mkdir -p $RPM_BUILD_ROOT/%{_var}/ftp/pub %{_var}/ftp %changelog +* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 3.0.3-43 +- Rebuilt for updated systemd-rpm-macros + See https://pagure.io/fesco/issue/2583. + * Wed Jan 27 2021 Fedora Release Engineering - 3.0.3-42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild From d48775fd3a55a4468c43a9558bfcb2ba52a4cca5 Mon Sep 17 00:00:00 2001 From: Artem Egorenkov Date: Thu, 8 Apr 2021 15:11:14 +0200 Subject: [PATCH 12/40] Enable wide-character support in logs --- ...wc_logs-replace_unprintable_with_hex.patch | 215 ++++++++++++++++++ vsftpd.spec | 8 +- 2 files changed, 222 insertions(+), 1 deletion(-) create mode 100644 vsftpd-3.0.3-enable_wc_logs-replace_unprintable_with_hex.patch diff --git a/vsftpd-3.0.3-enable_wc_logs-replace_unprintable_with_hex.patch b/vsftpd-3.0.3-enable_wc_logs-replace_unprintable_with_hex.patch new file mode 100644 index 0000000..38de8f3 --- /dev/null +++ b/vsftpd-3.0.3-enable_wc_logs-replace_unprintable_with_hex.patch @@ -0,0 +1,215 @@ +diff --git a/logging.c b/logging.c +index 9e86808..613ff4b 100644 +--- a/logging.c ++++ b/logging.c +@@ -171,7 +171,14 @@ vsf_log_do_log_to_file(int fd, struct mystr* p_str) + return; + } + } +- str_replace_unprintable(p_str, '?'); ++ if (tunable_wc_logs_enable) ++ { ++ str_replace_unprintable_with_hex_wc(p_str); ++ } ++ else ++ { ++ str_replace_unprintable_with_hex(p_str); ++ } + str_append_char(p_str, '\n'); + /* Ignore write failure; maybe the disk filled etc. */ + (void) str_write_loop(p_str, fd); +diff --git a/parseconf.c b/parseconf.c +index 3cfe7da..3729818 100644 +--- a/parseconf.c ++++ b/parseconf.c +@@ -113,6 +113,7 @@ parseconf_bool_array[] = + { "allow_writeable_chroot", &tunable_allow_writeable_chroot }, + { "better_stou", &tunable_better_stou }, + { "log_die", &tunable_log_die }, ++ { "wc_logs_enable", &tunable_wc_logs_enable }, + { 0, 0 } + }; + +diff --git a/str.c b/str.c +index 82b8ae4..a4e81d6 100644 +--- a/str.c ++++ b/str.c +@@ -20,6 +20,11 @@ + #include "utility.h" + #include "sysutil.h" + ++#include ++#include ++#include ++#include ++ + /* File local functions */ + static void str_split_text_common(struct mystr* p_src, struct mystr* p_rhs, + const char* p_text, int is_reverse); +@@ -723,6 +728,102 @@ str_replace_unprintable(struct mystr* p_str, char new_char) + } + } + ++void ++str_replace_unprintable_with_hex(struct mystr* p_str) ++{ ++ unsigned int ups_size = sizeof(unsigned int) * (p_str->len); ++ if (ups_size < p_str->len) ++ { ++ str_replace_unprintable(p_str, '?'); ++ str_append_text(p_str, ": BUG: string is too long"); ++ bug(p_str->p_buf); ++ } ++ unsigned int* ups = vsf_sysutil_malloc(ups_size); ++ unsigned int up_count = 0; ++ for (unsigned int i=0; i < p_str->len; i++) ++ { ++ if (!vsf_sysutil_isprint(p_str->p_buf[i])) ++ { ++ ups[up_count++] = i; ++ } ++ } ++ str_replace_positions_with_hex(p_str, ups, up_count); ++ vsf_sysutil_free(ups); ++} ++ ++void str_replace_unprintable_with_hex_wc(struct mystr* p_str) ++{ ++ unsigned int ups_size = sizeof(unsigned int) * (p_str->len); ++ if (ups_size < p_str->len) ++ { ++ str_replace_unprintable(p_str, '?'); ++ str_append_text(p_str, ": BUG: string is too long"); ++ bug(p_str->p_buf); ++ } ++ unsigned int* ups = vsf_sysutil_malloc(ups_size); ++ unsigned int up_count = 0; ++ ++ size_t current = 0; ++ wchar_t pwc; ++ mbstate_t ps; ++ memset(&ps, 0, sizeof(ps)); ++ ssize_t len = 0; ++ while ((len = mbrtowc(&pwc, p_str->p_buf, p_str->len - current, &ps)) > 0) ++ { ++ if (!iswprint(pwc)) ++ { ++ for (unsigned int i = 0; i < len; i++) ++ { ++ ups[up_count++] = current++; ++ } ++ } ++ else ++ { ++ current += len; ++ } ++ } ++ if (len < 0) ++ { ++ while (current < p_str->len) ++ { ++ ups[up_count++] = current++; ++ } ++ } ++ str_replace_positions_with_hex(p_str, ups, up_count); ++ vsf_sysutil_free(ups); ++} ++ ++void ++str_replace_positions_with_hex(struct mystr* p_str, const unsigned int* poss, const unsigned int pos_count) ++{ ++ if (pos_count == 0) ++ return; ++ ++ struct mystr tmp_str = INIT_MYSTR; ++ str_reserve(&tmp_str, p_str->len + 3 * pos_count); ++ unsigned int current = 0; ++ ++ for (unsigned int i=0; i < pos_count; i++) ++ { ++ unsigned int pos = poss[i]; ++ ++ if (current < pos) ++ private_str_append_memchunk(&tmp_str, p_str->p_buf + current, pos - current); ++ ++ char hex_buf[5]; ++ memset(hex_buf, 0, sizeof(hex_buf)); ++ sprintf(hex_buf, "\\x%02X", (unsigned char) p_str->p_buf[pos]); ++ str_append_text(&tmp_str, hex_buf); ++ current = pos + 1; ++ } ++ ++ if (current < p_str->len) ++ private_str_append_memchunk(&tmp_str, p_str->p_buf + current, p_str->len - current); ++ ++ str_copy(p_str, &tmp_str); ++ str_free(&tmp_str); ++} ++ + void + str_basename (struct mystr* d_str, const struct mystr* path) + { +diff --git a/str.h b/str.h +index 44270da..95a83b5 100644 +--- a/str.h ++++ b/str.h +@@ -98,6 +98,10 @@ int str_contains_space(const struct mystr* p_str); + int str_all_space(const struct mystr* p_str); + int str_contains_unprintable(const struct mystr* p_str); + void str_replace_unprintable(struct mystr* p_str, char new_char); ++void str_replace_unprintable_with_hex(struct mystr* p_str); ++void str_replace_unprintable_with_hex_wc(struct mystr* p_str); ++void str_replace_positions_with_hex(struct mystr* p_str, const unsigned int* poss, ++ const unsigned int pos_count); + int str_atoi(const struct mystr* p_str); + filesize_t str_a_to_filesize_t(const struct mystr* p_str); + unsigned int str_octal_to_uint(const struct mystr* p_str); +diff --git a/tunables.c b/tunables.c +index a7ce9c8..c96c1ac 100644 +--- a/tunables.c ++++ b/tunables.c +@@ -94,6 +94,7 @@ int tunable_seccomp_sandbox; + int tunable_allow_writeable_chroot; + int tunable_better_stou; + int tunable_log_die; ++int tunable_wc_logs_enable; + + unsigned int tunable_accept_timeout; + unsigned int tunable_connect_timeout; +@@ -244,6 +245,7 @@ tunables_load_defaults() + tunable_allow_writeable_chroot = 0; + tunable_better_stou = 0; + tunable_log_die = 0; ++ tunable_wc_logs_enable = 0; + + tunable_accept_timeout = 60; + tunable_connect_timeout = 60; +diff --git a/tunables.h b/tunables.h +index 029d645..8d50150 100644 +--- a/tunables.h ++++ b/tunables.h +@@ -98,6 +98,7 @@ extern int tunable_better_stou; /* Use better file name generation + */ + extern int tunable_log_die; /* Log calls to die(), die2() + * and bug() */ ++extern int tunable_wc_logs_enable; /* Allow non ASCII characters in logs */ + + /* Integer/numeric defines */ + extern unsigned int tunable_accept_timeout; +diff --git a/vsftpd.conf.5 b/vsftpd.conf.5 +index ce3fba3..815773f 100644 +--- a/vsftpd.conf.5 ++++ b/vsftpd.conf.5 +@@ -735,6 +735,12 @@ If enabled, use CLONE_NEWPID and CLONE_NEWIPC to isolate processes to their + ipc and pid namespaces. So separated processes can not interact with each other. + + Default: YES ++.TP ++.B wc_logs_enable ++If enabled, logs will be treated as wide-character strings and not just ++ASCII strings when filtering out non-printable characters. ++ ++Default: NO + + .SH NUMERIC OPTIONS + Below is a list of numeric options. A numeric option must be set to a non diff --git a/vsftpd.spec b/vsftpd.spec index 5d3b9ea..63f6a74 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -2,7 +2,7 @@ Name: vsftpd Version: 3.0.3 -Release: 43%{?dist} +Release: 44%{?dist} Summary: Very Secure Ftp Daemon # OpenSSL link exception @@ -97,6 +97,8 @@ Patch67: 0001-Fix-timestamp-handling-in-MDTM.patch Patch68: 0002-Drop-an-unused-global-variable.patch Patch69: 0001-Remove-a-hint-about-the-ftp_home_dir-SELinux-boolean.patch Patch70: fix-str_open.patch +# upstream commits 56402c0, 8b82e73 +Patch71: vsftpd-3.0.3-enable_wc_logs-replace_unprintable_with_hex.patch %description vsftpd is a Very Secure FTP daemon. It was written completely from @@ -165,6 +167,10 @@ mkdir -p $RPM_BUILD_ROOT/%{_var}/ftp/pub %{_var}/ftp %changelog +* Wed Apr 8 2021 Artem Egorenkov - 3.0.3-44 +- Enable support for wide-character strings in logs +- Replace unprintables with HEX code, not question marks + * Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 3.0.3-43 - Rebuilt for updated systemd-rpm-macros See https://pagure.io/fesco/issue/2583. From 52a06d89792b58c4dbb8e783d293c328323fa375 Mon Sep 17 00:00:00 2001 From: Artem Egorenkov Date: Thu, 8 Apr 2021 16:22:32 +0200 Subject: [PATCH 13/40] failed build fixed --- ...pd-3.0.3-enable_wc_logs-replace_unprintable_with_hex.patch | 4 ++-- vsftpd.spec | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/vsftpd-3.0.3-enable_wc_logs-replace_unprintable_with_hex.patch b/vsftpd-3.0.3-enable_wc_logs-replace_unprintable_with_hex.patch index 38de8f3..914aebd 100644 --- a/vsftpd-3.0.3-enable_wc_logs-replace_unprintable_with_hex.patch +++ b/vsftpd-3.0.3-enable_wc_logs-replace_unprintable_with_hex.patch @@ -31,7 +31,7 @@ index 3cfe7da..3729818 100644 }; diff --git a/str.c b/str.c -index 82b8ae4..a4e81d6 100644 +index 82b8ae4..c03e7d8 100644 --- a/str.c +++ b/str.c @@ -20,6 +20,11 @@ @@ -94,7 +94,7 @@ index 82b8ae4..a4e81d6 100644 + { + if (!iswprint(pwc)) + { -+ for (unsigned int i = 0; i < len; i++) ++ for (int i = 0; i < len; i++) + { + ups[up_count++] = current++; + } diff --git a/vsftpd.spec b/vsftpd.spec index 63f6a74..69923a1 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -167,7 +167,7 @@ mkdir -p $RPM_BUILD_ROOT/%{_var}/ftp/pub %{_var}/ftp %changelog -* Wed Apr 8 2021 Artem Egorenkov - 3.0.3-44 +* Thu Apr 8 2021 Artem Egorenkov - 3.0.3-44 - Enable support for wide-character strings in logs - Replace unprintables with HEX code, not question marks From 18928bb25ec3e20e013fb55206d10251a59a60bc Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 23 Jul 2021 20:41:02 +0000 Subject: [PATCH 14/40] - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- vsftpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/vsftpd.spec b/vsftpd.spec index 69923a1..d340249 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -2,7 +2,7 @@ Name: vsftpd Version: 3.0.3 -Release: 44%{?dist} +Release: 45%{?dist} Summary: Very Secure Ftp Daemon # OpenSSL link exception @@ -167,6 +167,9 @@ mkdir -p $RPM_BUILD_ROOT/%{_var}/ftp/pub %{_var}/ftp %changelog +* Fri Jul 23 2021 Fedora Release Engineering - 3.0.3-45 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + * Thu Apr 8 2021 Artem Egorenkov - 3.0.3-44 - Enable support for wide-character strings in logs - Replace unprintables with HEX code, not question marks From 6e276bfedb9bc01bfd4964f4c518a60cdedb608d Mon Sep 17 00:00:00 2001 From: Sahana Prasad Date: Tue, 14 Sep 2021 19:17:40 +0200 Subject: [PATCH 15/40] Rebuilt with OpenSSL 3.0.0 --- vsftpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/vsftpd.spec b/vsftpd.spec index d340249..8fe341f 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -2,7 +2,7 @@ Name: vsftpd Version: 3.0.3 -Release: 45%{?dist} +Release: 46%{?dist} Summary: Very Secure Ftp Daemon # OpenSSL link exception @@ -167,6 +167,9 @@ mkdir -p $RPM_BUILD_ROOT/%{_var}/ftp/pub %{_var}/ftp %changelog +* Tue Sep 14 2021 Sahana Prasad - 3.0.3-46 +- Rebuilt with OpenSSL 3.0.0 + * Fri Jul 23 2021 Fedora Release Engineering - 3.0.3-45 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild From 1fd680f423c46b8718ee2dd43e31b8c7e325d976 Mon Sep 17 00:00:00 2001 From: Ondrej Mejzlik Date: Wed, 22 Sep 2021 18:00:52 +0200 Subject: [PATCH 16/40] Adding fmf plan --- .fmf/version | 1 + plans/ci.fmf | 6 ++++++ 2 files changed, 7 insertions(+) create mode 100644 .fmf/version create mode 100644 plans/ci.fmf diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/plans/ci.fmf b/plans/ci.fmf new file mode 100644 index 0000000..3eeb9e9 --- /dev/null +++ b/plans/ci.fmf @@ -0,0 +1,6 @@ +summary: Test plan that runs all tests from tests repo. +discover: + how: fmf + url: https://src.fedoraproject.org/tests/vsftpd.git +execute: + how: tmt From ebaec574529e0220ee94569780d0bd6ca3ae7721 Mon Sep 17 00:00:00 2001 From: Artem Egorenkov Date: Wed, 13 Oct 2021 14:25:25 +0200 Subject: [PATCH 17/40] Temporary pass -Wno-deprecated-declarations to gcc to ignore deprecated warnings to be able to build against OpenSSL-3.0 Resolves: rhbz#1962603 --- vsftpd.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/vsftpd.spec b/vsftpd.spec index 8fe341f..1b8fdfe 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -109,10 +109,13 @@ scratch. cp %{SOURCE1} . %build +# temporary ignore deprecated warnings to be able to build against OpenSSL 3.0 +%define ignore_deprecated -Wno-deprecated-declarations + %ifarch s390x sparcv9 sparc64 -%make_build CFLAGS="$RPM_OPT_FLAGS -fPIE -pipe -Wextra -Werror" \ +%make_build CFLAGS="$RPM_OPT_FLAGS -fPIE -pipe -Wextra -Werror %ignore_deprecated" \ %else -%make_build CFLAGS="$RPM_OPT_FLAGS -fpie -pipe -Wextra -Werror" \ +%make_build CFLAGS="$RPM_OPT_FLAGS -fpie -pipe -Wextra -Werror %ignore_deprecated" \ %endif LINK="-pie -lssl $RPM_LD_FLAGS" %{?_smp_mflags} From eb81361da08585e78208800030f5955b399f951c Mon Sep 17 00:00:00 2001 From: Artem Egorenkov Date: Wed, 13 Oct 2021 14:49:10 +0200 Subject: [PATCH 18/40] release bump --- vsftpd.spec | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/vsftpd.spec b/vsftpd.spec index 1b8fdfe..15c23a2 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -2,7 +2,7 @@ Name: vsftpd Version: 3.0.3 -Release: 46%{?dist} +Release: 47%{?dist} Summary: Very Secure Ftp Daemon # OpenSSL link exception @@ -170,6 +170,11 @@ mkdir -p $RPM_BUILD_ROOT/%{_var}/ftp/pub %{_var}/ftp %changelog +* Wed Oct 13 2021 Artem Egorenkov - 3.0.3-47 +- Temporary pass -Wno-deprecated-declarations to gcc to ignore + deprecated warnings to be able to build against OpenSSL-3.0 +- Resolves: rhbz#1962603 + * Tue Sep 14 2021 Sahana Prasad - 3.0.3-46 - Rebuilt with OpenSSL 3.0.0 From 28071690cee23a4500a70958bca509d535298dff Mon Sep 17 00:00:00 2001 From: Artem Egorenkov Date: Wed, 13 Oct 2021 16:52:15 +0200 Subject: [PATCH 19/40] ALPACA fix backported from upstram 3.0.5 version Related: rhbz#1975648 --- vsftpd-3.0.3-ALPACA.patch | 225 ++++++++++++++++++++++++++++++++++++++ vsftpd.spec | 7 +- 2 files changed, 231 insertions(+), 1 deletion(-) create mode 100644 vsftpd-3.0.3-ALPACA.patch diff --git a/vsftpd-3.0.3-ALPACA.patch b/vsftpd-3.0.3-ALPACA.patch new file mode 100644 index 0000000..336a1de --- /dev/null +++ b/vsftpd-3.0.3-ALPACA.patch @@ -0,0 +1,225 @@ +diff --git a/parseconf.c b/parseconf.c +index 3729818..ee1b8b4 100644 +--- a/parseconf.c ++++ b/parseconf.c +@@ -188,6 +188,7 @@ parseconf_str_array[] = + { "rsa_private_key_file", &tunable_rsa_private_key_file }, + { "dsa_private_key_file", &tunable_dsa_private_key_file }, + { "ca_certs_file", &tunable_ca_certs_file }, ++ { "ssl_sni_hostname", &tunable_ssl_sni_hostname }, + { "cmds_denied", &tunable_cmds_denied }, + { 0, 0 } + }; +diff --git a/ssl.c b/ssl.c +index 09ec96a..b622347 100644 +--- a/ssl.c ++++ b/ssl.c +@@ -41,6 +41,13 @@ static long bio_callback( + BIO* p_bio, int oper, const char* p_arg, int argi, long argl, long retval); + static int ssl_verify_callback(int verify_ok, X509_STORE_CTX* p_ctx); + static DH *ssl_tmp_dh_callback(SSL *ssl, int is_export, int keylength); ++static int ssl_alpn_callback(SSL* p_ssl, ++ const unsigned char** p_out, ++ unsigned char* outlen, ++ const unsigned char* p_in, ++ unsigned int inlen, ++ void* p_arg); ++static long ssl_sni_callback(SSL* p_ssl, int* p_al, void* p_arg); + static int ssl_cert_digest( + SSL* p_ssl, struct vsf_session* p_sess, struct mystr* p_str); + static void maybe_log_shutdown_state(struct vsf_session* p_sess); +@@ -285,6 +292,11 @@ ssl_init(struct vsf_session* p_sess) + SSL_CTX_set_timeout(p_ctx, INT_MAX); + } + ++ /* Set up ALPN to check for FTP protocol intention of client. */ ++ SSL_CTX_set_alpn_select_cb(p_ctx, ssl_alpn_callback, p_sess); ++ /* Set up SNI callback for an optional hostname check. */ ++ SSL_CTX_set_tlsext_servername_callback(p_ctx, ssl_sni_callback); ++ SSL_CTX_set_tlsext_servername_arg(p_ctx, p_sess); + SSL_CTX_set_tmp_dh_callback(p_ctx, ssl_tmp_dh_callback); + + if (tunable_ecdh_param_file) +@@ -871,6 +883,133 @@ ssl_tmp_dh_callback(SSL *ssl, int is_export, int keylength) + return DH_get_dh(keylength); + } + ++static int ++ssl_alpn_callback(SSL* p_ssl, ++ const unsigned char** p_out, ++ unsigned char* outlen, ++ const unsigned char* p_in, ++ unsigned int inlen, ++ void* p_arg) { ++ unsigned int i; ++ struct vsf_session* p_sess = (struct vsf_session*) p_arg; ++ int is_ok = 0; ++ ++ (void) p_ssl; ++ ++ /* Initialize just in case. */ ++ *p_out = p_in; ++ *outlen = 0; ++ ++ for (i = 0; i < inlen; ++i) { ++ unsigned int left = (inlen - i); ++ if (left < 4) { ++ continue; ++ } ++ if (p_in[i] == 3 && p_in[i + 1] == 'f' && p_in[i + 2] == 't' && ++ p_in[i + 3] == 'p') ++ { ++ is_ok = 1; ++ *p_out = &p_in[i + 1]; ++ *outlen = 3; ++ break; ++ } ++ } ++ ++ if (!is_ok) ++ { ++ str_alloc_text(&debug_str, "ALPN rejection"); ++ vsf_log_line(p_sess, kVSFLogEntryDebug, &debug_str); ++ } ++ if (!is_ok || tunable_debug_ssl) ++ { ++ str_alloc_text(&debug_str, "ALPN data: "); ++ for (i = 0; i < inlen; ++i) { ++ str_append_char(&debug_str, p_in[i]); ++ } ++ vsf_log_line(p_sess, kVSFLogEntryDebug, &debug_str); ++ } ++ ++ if (is_ok) ++ { ++ return SSL_TLSEXT_ERR_OK; ++ } ++ else ++ { ++ return SSL_TLSEXT_ERR_ALERT_FATAL; ++ } ++} ++ ++static long ++ssl_sni_callback(SSL* p_ssl, int* p_al, void* p_arg) ++{ ++ static struct mystr s_sni_expected_hostname; ++ static struct mystr s_sni_received_hostname; ++ ++ int servername_type; ++ const char* p_sni_servername; ++ struct vsf_session* p_sess = (struct vsf_session*) p_arg; ++ int is_ok = 0; ++ ++ (void) p_ssl; ++ (void) p_arg; ++ ++ if (tunable_ssl_sni_hostname) ++ { ++ str_alloc_text(&s_sni_expected_hostname, tunable_ssl_sni_hostname); ++ } ++ ++ /* The OpenSSL documentation says it is pre-initialized like this, but set ++ * it just in case. ++ */ ++ *p_al = SSL_AD_UNRECOGNIZED_NAME; ++ ++ servername_type = SSL_get_servername_type(p_ssl); ++ p_sni_servername = SSL_get_servername(p_ssl, TLSEXT_NAMETYPE_host_name); ++ if (p_sni_servername != NULL) { ++ str_alloc_text(&s_sni_received_hostname, p_sni_servername); ++ } ++ ++ if (str_isempty(&s_sni_expected_hostname)) ++ { ++ is_ok = 1; ++ } ++ else if (servername_type != TLSEXT_NAMETYPE_host_name) ++ { ++ /* Fail. */ ++ str_alloc_text(&debug_str, "SNI bad type: "); ++ str_append_ulong(&debug_str, servername_type); ++ vsf_log_line(p_sess, kVSFLogEntryDebug, &debug_str); ++ } ++ else ++ { ++ if (!str_strcmp(&s_sni_expected_hostname, &s_sni_received_hostname)) ++ { ++ is_ok = 1; ++ } ++ else ++ { ++ str_alloc_text(&debug_str, "SNI rejection"); ++ vsf_log_line(p_sess, kVSFLogEntryDebug, &debug_str); ++ } ++ } ++ ++ if (!is_ok || tunable_debug_ssl) ++ { ++ str_alloc_text(&debug_str, "SNI hostname: "); ++ str_append_str(&debug_str, &s_sni_received_hostname); ++ vsf_log_line(p_sess, kVSFLogEntryDebug, &debug_str); ++ } ++ ++ if (is_ok) ++ { ++ return SSL_TLSEXT_ERR_OK; ++ } ++ else ++ { ++ return SSL_TLSEXT_ERR_ALERT_FATAL; ++ } ++} ++ + void + ssl_add_entropy(struct vsf_session* p_sess) + { +diff --git a/tunables.c b/tunables.c +index c96c1ac..d8dfcde 100644 +--- a/tunables.c ++++ b/tunables.c +@@ -152,6 +152,7 @@ const char* tunable_ssl_ciphers; + const char* tunable_rsa_private_key_file; + const char* tunable_dsa_private_key_file; + const char* tunable_ca_certs_file; ++const char* tunable_ssl_sni_hostname; + + static void install_str_setting(const char* p_value, const char** p_storage); + +@@ -309,6 +310,7 @@ tunables_load_defaults() + install_str_setting(0, &tunable_rsa_private_key_file); + install_str_setting(0, &tunable_dsa_private_key_file); + install_str_setting(0, &tunable_ca_certs_file); ++ install_str_setting(0, &tunable_ssl_sni_hostname); + } + + void +diff --git a/tunables.h b/tunables.h +index 8d50150..de6cab0 100644 +--- a/tunables.h ++++ b/tunables.h +@@ -157,6 +157,7 @@ extern const char* tunable_ssl_ciphers; + extern const char* tunable_rsa_private_key_file; + extern const char* tunable_dsa_private_key_file; + extern const char* tunable_ca_certs_file; ++extern const char* tunable_ssl_sni_hostname; + extern const char* tunable_cmds_denied; + + #endif /* VSF_TUNABLES_H */ +diff --git a/vsftpd.conf.5 b/vsftpd.conf.5 +index 815773f..7006287 100644 +--- a/vsftpd.conf.5 ++++ b/vsftpd.conf.5 +@@ -1128,6 +1128,12 @@ for further details. + + Default: PROFILE=SYSTEM + .TP ++.B ssl_sni_hostname ++If set, SSL connections will be rejected unless the SNI hostname in the ++incoming handshakes matches this value. ++ ++Default: (none) ++.TP + .B user_config_dir + This powerful option allows the override of any config option specified in + the manual page, on a per-user basis. Usage is simple, and is best illustrated diff --git a/vsftpd.spec b/vsftpd.spec index 15c23a2..be7f17f 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -2,7 +2,7 @@ Name: vsftpd Version: 3.0.3 -Release: 47%{?dist} +Release: 48%{?dist} Summary: Very Secure Ftp Daemon # OpenSSL link exception @@ -99,6 +99,7 @@ Patch69: 0001-Remove-a-hint-about-the-ftp_home_dir-SELinux-boolean.patch Patch70: fix-str_open.patch # upstream commits 56402c0, 8b82e73 Patch71: vsftpd-3.0.3-enable_wc_logs-replace_unprintable_with_hex.patch +Patch72: vsftpd-3.0.3-ALPACA.patch %description vsftpd is a Very Secure FTP daemon. It was written completely from @@ -170,6 +171,10 @@ mkdir -p $RPM_BUILD_ROOT/%{_var}/ftp/pub %{_var}/ftp %changelog +* Wed Oct 13 2021 Artem Egorenkov - 3.0.3-48 +- ALPACA fix backported from upstram 3.0.5 version +- Resolves: rhbz#1975648 + * Wed Oct 13 2021 Artem Egorenkov - 3.0.3-47 - Temporary pass -Wno-deprecated-declarations to gcc to ignore deprecated warnings to be able to build against OpenSSL-3.0 From 70e712403f9e6f92511307f81280db76d840e5db Mon Sep 17 00:00:00 2001 From: Artem Egorenkov Date: Wed, 27 Oct 2021 14:51:18 +0200 Subject: [PATCH 20/40] - add option to disable TLSv1.3 - Resolves: rhbz#2017705 --- vsftpd-3.0.3-option_to_disable_TLSv1_3.patch | 96 ++++++++++++++++++++ vsftpd.spec | 7 +- 2 files changed, 102 insertions(+), 1 deletion(-) create mode 100644 vsftpd-3.0.3-option_to_disable_TLSv1_3.patch diff --git a/vsftpd-3.0.3-option_to_disable_TLSv1_3.patch b/vsftpd-3.0.3-option_to_disable_TLSv1_3.patch new file mode 100644 index 0000000..b215273 --- /dev/null +++ b/vsftpd-3.0.3-option_to_disable_TLSv1_3.patch @@ -0,0 +1,96 @@ +diff --git a/features.c b/features.c +index d024366..3a60b88 100644 +--- a/features.c ++++ b/features.c +@@ -22,7 +22,7 @@ handle_feat(struct vsf_session* p_sess) + { + vsf_cmdio_write_raw(p_sess, " AUTH SSL\r\n"); + } +- if (tunable_tlsv1 || tunable_tlsv1_1 || tunable_tlsv1_2) ++ if (tunable_tlsv1 || tunable_tlsv1_1 || tunable_tlsv1_2 || tunable_tlsv1_3) + { + vsf_cmdio_write_raw(p_sess, " AUTH TLS\r\n"); + } +diff --git a/parseconf.c b/parseconf.c +index ee1b8b4..5188088 100644 +--- a/parseconf.c ++++ b/parseconf.c +@@ -87,6 +87,7 @@ parseconf_bool_array[] = + { "ssl_tlsv1", &tunable_tlsv1 }, + { "ssl_tlsv1_1", &tunable_tlsv1_1 }, + { "ssl_tlsv1_2", &tunable_tlsv1_2 }, ++ { "ssl_tlsv1_3", &tunable_tlsv1_3 }, + { "tilde_user_enable", &tunable_tilde_user_enable }, + { "force_anon_logins_ssl", &tunable_force_anon_logins_ssl }, + { "force_anon_data_ssl", &tunable_force_anon_data_ssl }, +diff --git a/ssl.c b/ssl.c +index b622347..3af67ad 100644 +--- a/ssl.c ++++ b/ssl.c +@@ -185,6 +185,10 @@ ssl_init(struct vsf_session* p_sess) + { + options |= SSL_OP_NO_TLSv1_2; + } ++ if (!tunable_tlsv1_3) ++ { ++ options |= SSL_OP_NO_TLSv1_3; ++ } + SSL_CTX_set_options(p_ctx, options); + if (tunable_rsa_cert_file) + { +diff --git a/tunables.c b/tunables.c +index d8dfcde..dc001ac 100644 +--- a/tunables.c ++++ b/tunables.c +@@ -68,6 +68,7 @@ int tunable_sslv3; + int tunable_tlsv1; + int tunable_tlsv1_1; + int tunable_tlsv1_2; ++int tunable_tlsv1_3; + int tunable_tilde_user_enable; + int tunable_force_anon_logins_ssl; + int tunable_force_anon_data_ssl; +@@ -218,8 +219,9 @@ tunables_load_defaults() + tunable_sslv3 = 0; + tunable_tlsv1 = 0; + tunable_tlsv1_1 = 0; +- /* Only TLSv1.2 is enabled by default */ ++ /* Only TLSv1.2 and TLSv1.3 are enabled by default */ + tunable_tlsv1_2 = 1; ++ tunable_tlsv1_3 = 1; + tunable_tilde_user_enable = 0; + tunable_force_anon_logins_ssl = 0; + tunable_force_anon_data_ssl = 0; +diff --git a/tunables.h b/tunables.h +index de6cab0..ff0eebc 100644 +--- a/tunables.h ++++ b/tunables.h +@@ -69,6 +69,7 @@ extern int tunable_sslv3; /* Allow SSLv3 */ + extern int tunable_tlsv1; /* Allow TLSv1 */ + extern int tunable_tlsv1_1; /* Allow TLSv1.1 */ + extern int tunable_tlsv1_2; /* Allow TLSv1.2 */ ++extern int tunable_tlsv1_3; /* Allow TLSv1.3 */ + extern int tunable_tilde_user_enable; /* Support e.g. ~chris */ + extern int tunable_force_anon_logins_ssl; /* Require anon logins use SSL */ + extern int tunable_force_anon_data_ssl; /* Require anon data uses SSL */ +diff --git a/vsftpd.conf.5 b/vsftpd.conf.5 +index 7006287..d181e50 100644 +--- a/vsftpd.conf.5 ++++ b/vsftpd.conf.5 +@@ -587,7 +587,15 @@ Default: NO + Only applies if + .BR ssl_enable + is activated. If enabled, this option will permit TLS v1.2 protocol connections. +-TLS v1.2 connections are preferred. ++TLS v1.2 and TLS v1.3 connections are preferred. ++ ++Default: YES ++.TP ++.B ssl_tlsv1_3 ++Only applies if ++.BR ssl_enable ++is activated. If enabled, this option will permit TLS v1.3 protocol connections. ++TLS v1.2 and TLS v1.3 connections are preferred. + + Default: YES + .TP diff --git a/vsftpd.spec b/vsftpd.spec index be7f17f..b34672d 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -2,7 +2,7 @@ Name: vsftpd Version: 3.0.3 -Release: 48%{?dist} +Release: 49%{?dist} Summary: Very Secure Ftp Daemon # OpenSSL link exception @@ -100,6 +100,7 @@ Patch70: fix-str_open.patch # upstream commits 56402c0, 8b82e73 Patch71: vsftpd-3.0.3-enable_wc_logs-replace_unprintable_with_hex.patch Patch72: vsftpd-3.0.3-ALPACA.patch +Patch73: vsftpd-3.0.3-option_to_disable_TLSv1_3.patch %description vsftpd is a Very Secure FTP daemon. It was written completely from @@ -171,6 +172,10 @@ mkdir -p $RPM_BUILD_ROOT/%{_var}/ftp/pub %{_var}/ftp %changelog +* Wed Oct 27 2021 Artem Egorenkov - 3.0.3-49 +- add option to disable TLSv1.3 +- Resolves: rhbz#2017705 + * Wed Oct 13 2021 Artem Egorenkov - 3.0.3-48 - ALPACA fix backported from upstram 3.0.5 version - Resolves: rhbz#1975648 From 729620f9a2db253803f2974ace4115781d7401fe Mon Sep 17 00:00:00 2001 From: Ondrej Mejzlik Date: Wed, 15 Dec 2021 11:48:23 +0100 Subject: [PATCH 21/40] adding gating yaml --- gating.yaml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 gating.yaml diff --git a/gating.yaml b/gating.yaml new file mode 100644 index 0000000..ce1b655 --- /dev/null +++ b/gating.yaml @@ -0,0 +1,16 @@ +--- !Policy +product_versions: + - fedora-* +decision_contexts: [bodhi_update_push_testing] +subject_type: koji_build +rules: + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} + +#gating rawhide +--- !Policy +product_versions: + - fedora-* +decision_contexts: [bodhi_update_push_stable] +subject_type: koji_build +rules: + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} From 44f20150044d239c8dbd150be6d8046f592aebb6 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 22 Jan 2022 04:11:34 +0000 Subject: [PATCH 22/40] - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- vsftpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/vsftpd.spec b/vsftpd.spec index b34672d..61b890b 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -2,7 +2,7 @@ Name: vsftpd Version: 3.0.3 -Release: 49%{?dist} +Release: 50%{?dist} Summary: Very Secure Ftp Daemon # OpenSSL link exception @@ -172,6 +172,9 @@ mkdir -p $RPM_BUILD_ROOT/%{_var}/ftp/pub %{_var}/ftp %changelog +* Sat Jan 22 2022 Fedora Release Engineering - 3.0.3-50 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + * Wed Oct 27 2021 Artem Egorenkov - 3.0.3-49 - add option to disable TLSv1.3 - Resolves: rhbz#2017705 From b7d0384436ee83513ec4e1444ac559b10efedfeb Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 23 Jul 2022 12:07:25 +0000 Subject: [PATCH 23/40] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- vsftpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/vsftpd.spec b/vsftpd.spec index 61b890b..ab63318 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -2,7 +2,7 @@ Name: vsftpd Version: 3.0.3 -Release: 50%{?dist} +Release: 51%{?dist} Summary: Very Secure Ftp Daemon # OpenSSL link exception @@ -172,6 +172,9 @@ mkdir -p $RPM_BUILD_ROOT/%{_var}/ftp/pub %{_var}/ftp %changelog +* Sat Jul 23 2022 Fedora Release Engineering - 3.0.3-51 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Sat Jan 22 2022 Fedora Release Engineering - 3.0.3-50 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild From 63f4fa04b225188aed90f98db682c86858d2cbdc Mon Sep 17 00:00:00 2001 From: Richard Lescak Date: Fri, 29 Jul 2022 20:10:46 +0200 Subject: [PATCH 24/40] rebase to version 3.0.5 --- .gitignore | 1 + ...-support-for-DHE-based-cipher-suites.patch | 26 +++++++++---------- ...upport-for-EDDHE-based-cipher-suites.patch | 10 +++---- 0025-Improve-local_max_rate-option.patch | 4 +-- 0040-Use-system-wide-crypto-policy.patch | 6 ++--- ...-default-for-ssl_ciphers-in-the-man-.patch | 6 ++--- fix-str_open.patch | 7 +++-- sources | 2 +- ...wc_logs-replace_unprintable_with_hex.patch | 0 vsftpd.spec | 17 ++++++------ 10 files changed, 40 insertions(+), 39 deletions(-) rename vsftpd-3.0.3-enable_wc_logs-replace_unprintable_with_hex.patch => vsftpd-3.0.5-enable_wc_logs-replace_unprintable_with_hex.patch (100%) diff --git a/.gitignore b/.gitignore index 811254b..d4e96bd 100644 --- a/.gitignore +++ b/.gitignore @@ -6,3 +6,4 @@ vsftpd-2.3.2.tar.gz /vsftpd-3.0.1.tar.gz /vsftpd-3.0.2.tar.gz /vsftpd-3.0.3.tar.gz +/vsftpd-3.0.5.tar.gz diff --git a/0021-Introduce-support-for-DHE-based-cipher-suites.patch b/0021-Introduce-support-for-DHE-based-cipher-suites.patch index 1abe1e4..cfa23bb 100644 --- a/0021-Introduce-support-for-DHE-based-cipher-suites.patch +++ b/0021-Introduce-support-for-DHE-based-cipher-suites.patch @@ -36,14 +36,14 @@ index c362983..22b69b3 100644 #include #include -@@ -38,6 +40,7 @@ static void setup_bio_callbacks(); +@@ -38,6 +40,7 @@ + static char* get_ssl_error(); + static SSL* get_ssl(struct vsf_session* p_sess, int fd); + static int ssl_session_init(struct vsf_session* p_sess); ++static DH *ssl_tmp_dh_callback(SSL *ssl, int is_export, int keylength); + static void setup_bio_callbacks(); static long bio_callback( BIO* p_bio, int oper, const char* p_arg, int argi, long argl, long retval); - static int ssl_verify_callback(int verify_ok, X509_STORE_CTX* p_ctx); -+static DH *ssl_tmp_dh_callback(SSL *ssl, int is_export, int keylength); - static int ssl_cert_digest( - SSL* p_ssl, struct vsf_session* p_sess, struct mystr* p_str); - static void maybe_log_shutdown_state(struct vsf_session* p_sess); @@ -51,6 +54,60 @@ static int ssl_read_common(struct vsf_session* p_sess, static int ssl_inited; static struct mystr debug_str; @@ -140,18 +140,18 @@ index c362983..22b69b3 100644 if (tunable_ssl_ciphers && SSL_CTX_set_cipher_list(p_ctx, tunable_ssl_ciphers) != 1) { -@@ -165,6 +241,9 @@ ssl_init(struct vsf_session* p_sess) +@@ -184,6 +260,9 @@ /* Ensure cached session doesn't expire */ SSL_CTX_set_timeout(p_ctx, INT_MAX); } -+ ++ + SSL_CTX_set_tmp_dh_callback(p_ctx, ssl_tmp_dh_callback); + - p_sess->p_ssl_ctx = p_ctx; - ssl_inited = 1; + /* Set up ALPN to check for FTP protocol intention of client. */ + SSL_CTX_set_alpn_select_cb(p_ctx, ssl_alpn_callback, p_sess); + /* Set up SNI callback for an optional hostname check. */ +@@ -854,6 +933,18 @@ ssl_verify_callback(int verify_ok, X509_STORE_CTX* p_ctx) } -@@ -702,6 +781,18 @@ ssl_verify_callback(int verify_ok, X509_STORE_CTX* p_ctx) - return 1; } +#define UNUSED(x) ( (void)(x) ) @@ -162,7 +162,7 @@ index c362983..22b69b3 100644 + // strict compiler bypassing + UNUSED(ssl); + UNUSED(is_export); -+ ++ + return DH_get_dh(keylength); +} + diff --git a/0022-Introduce-support-for-EDDHE-based-cipher-suites.patch b/0022-Introduce-support-for-EDDHE-based-cipher-suites.patch index 1428b86..9cb56cd 100644 --- a/0022-Introduce-support-for-EDDHE-based-cipher-suites.patch +++ b/0022-Introduce-support-for-EDDHE-based-cipher-suites.patch @@ -36,8 +36,8 @@ index 22b69b3..96bf8ad 100644 if (!tunable_sslv2) { options |= SSL_OP_NO_SSLv2; -@@ -244,6 +244,41 @@ ssl_init(struct vsf_session* p_sess) - +@@ -244,6 +244,41 @@ + SSL_CTX_set_tmp_dh_callback(p_ctx, ssl_tmp_dh_callback); + if (tunable_ecdh_param_file) @@ -75,9 +75,9 @@ index 22b69b3..96bf8ad 100644 +#endif + } + - p_sess->p_ssl_ctx = p_ctx; - ssl_inited = 1; - } + /* Set up ALPN to check for FTP protocol intention of client. */ + SSL_CTX_set_alpn_select_cb(p_ctx, ssl_alpn_callback, p_sess); + /* Set up SNI callback for an optional hostname check. */ diff --git a/tunables.c b/tunables.c index 1ea7227..93f85b1 100644 --- a/tunables.c diff --git a/0025-Improve-local_max_rate-option.patch b/0025-Improve-local_max_rate-option.patch index e78f825..2c74c7a 100644 --- a/0025-Improve-local_max_rate-option.patch +++ b/0025-Improve-local_max_rate-option.patch @@ -60,9 +60,9 @@ diff --git a/main.c b/main.c index eaba265..f1e2f69 100644 --- a/main.c +++ b/main.c -@@ -40,7 +40,7 @@ main(int argc, const char* argv[]) +@@ -40,7 +40,7 @@ /* Control connection */ - 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, /* Data connection */ - -1, 0, -1, 0, 0, 0, 0, + -1, 0, -1, 0, 0, 0, 0, 0, diff --git a/0040-Use-system-wide-crypto-policy.patch b/0040-Use-system-wide-crypto-policy.patch index f59ba2b..940a5b2 100644 --- a/0040-Use-system-wide-crypto-policy.patch +++ b/0040-Use-system-wide-crypto-policy.patch @@ -3,7 +3,7 @@ From: Martin Sehnoutka Date: Tue, 29 Aug 2017 10:32:16 +0200 Subject: [PATCH 40/59] Use system wide crypto policy -Resolves: rhbz#1483970 +Resolves: rhbz# --- tunables.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) @@ -16,8 +16,8 @@ index 5440c00..354251c 100644 install_str_setting(0, &tunable_dsa_cert_file); install_str_setting(0, &tunable_dh_param_file); install_str_setting(0, &tunable_ecdh_param_file); -- install_str_setting("AES128-SHA:DES-CBC3-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384", -- &tunable_ssl_ciphers); +- install_str_setting("AES128-SHA:DES-CBC3-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA", +- &tunable_ssl_ciphers); + install_str_setting("PROFILE=SYSTEM", &tunable_ssl_ciphers); install_str_setting(0, &tunable_rsa_private_key_file); install_str_setting(0, &tunable_dsa_private_key_file); diff --git a/0041-Document-the-new-default-for-ssl_ciphers-in-the-man-.patch b/0041-Document-the-new-default-for-ssl_ciphers-in-the-man-.patch index 8b26c7b..93e2ce8 100644 --- a/0041-Document-the-new-default-for-ssl_ciphers-in-the-man-.patch +++ b/0041-Document-the-new-default-for-ssl_ciphers-in-the-man-.patch @@ -17,15 +17,15 @@ index 3ca55e4..2a7662e 100644 security precaution as it prevents malicious remote parties forcing a cipher which they have found problems with. --Default: AES128-SHA:DES-CBC3-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384 +-Default: DES-CBC3-SHA +By default, the system-wide crypto policy is used. See +.BR update-crypto-policies(8) +for further details. + +Default: PROFILE=SYSTEM .TP - .B user_config_dir - This powerful option allows the override of any config option specified in + .B ssl_sni_hostname + If set, SSL connections will be rejected unless the SNI hostname in the -- 2.14.4 diff --git a/fix-str_open.patch b/fix-str_open.patch index eef52ec..e5d5bd9 100644 --- a/fix-str_open.patch +++ b/fix-str_open.patch @@ -1,11 +1,10 @@ -diff -ruN vsftpd-3.0.3.orig/sysstr.c vsftpd-3.0.3/sysstr.c ---- vsftpd-3.0.3.orig/sysstr.c 2020-11-17 09:47:03.872923383 +0100 -+++ vsftpd-3.0.3/sysstr.c 2020-11-17 09:48:41.219754145 +0100 +--- sysstr-orig.c 2022-07-27 09:44:52.606408000 +0200 ++++ sysstr.c 2022-07-27 09:54:24.043081352 +0200 @@ -74,19 +74,11 @@ int str_open(const struct mystr* p_str, const enum EVSFSysStrOpenMode mode) { -- enum EVSFSysUtilOpenMode open_mode = kVSFSysStrOpenUnknown; +- enum EVSFSysUtilOpenMode open_mode = kVSFSysUtilOpenUnknown; - switch (mode) - { - case kVSFSysStrOpenReadOnly: diff --git a/sources b/sources index 73f8cf5..e0f928f 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (vsftpd-3.0.3.tar.gz) = 5a4410a88e72ecf6f60a60a89771bcec300c9f63c2ea83b219bdf65fd9749b9853f9579f7257205b55659aefcd5dab243eba878dbbd4f0ff8532dd6e60884df7 +SHA512 (vsftpd-3.0.5.tar.gz) = 9e9f9bde8c460fbc6b1d29ca531327fb2e40e336358f1cc19e1da205ef81b553719a148ad4613ceead25499d1ac3f03301a0ecd3776e5c228acccb7f9461a7ee diff --git a/vsftpd-3.0.3-enable_wc_logs-replace_unprintable_with_hex.patch b/vsftpd-3.0.5-enable_wc_logs-replace_unprintable_with_hex.patch similarity index 100% rename from vsftpd-3.0.3-enable_wc_logs-replace_unprintable_with_hex.patch rename to vsftpd-3.0.5-enable_wc_logs-replace_unprintable_with_hex.patch diff --git a/vsftpd.spec b/vsftpd.spec index ab63318..18f9361 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -1,8 +1,8 @@ %global _generatorsdir %{_prefix}/lib/systemd/system-generators Name: vsftpd -Version: 3.0.3 -Release: 51%{?dist} +Version: 3.0.5 +Release: 1%{?dist} Summary: Very Secure Ftp Daemon # OpenSSL link exception @@ -61,7 +61,7 @@ Patch29: 0029-Fix-segfault-in-config-file-parser.patch Patch30: 0030-Fix-logging-into-syslog-when-enabled-in-config.patch Patch31: 0031-Fix-question-mark-wildcard-withing-a-file-name.patch Patch32: 0032-Propagate-errors-from-nfs-with-quota-to-client.patch -Patch33: 0033-Introduce-TLSv1.1-and-TLSv1.2-options.patch +#Patch33: 0033-Introduce-TLSv1.1-and-TLSv1.2-options.patch Patch34: 0034-Turn-off-seccomp-sandbox-because-it-is-too-strict.patch Patch35: 0035-Modify-DH-enablement-patch-to-build-with-OpenSSL-1.1.patch Patch36: 0036-Redefine-VSFTP_COMMAND_FD-to-1.patch @@ -70,8 +70,8 @@ Patch38: 0038-Document-allow_writeable_chroot-in-the-man-page.patch Patch39: 0039-Improve-documentation-of-ASCII-mode-in-the-man-page.patch Patch40: 0040-Use-system-wide-crypto-policy.patch Patch41: 0041-Document-the-new-default-for-ssl_ciphers-in-the-man-.patch -Patch42: 0042-When-handling-FEAT-command-check-ssl_tlsv1_1-and-ssl.patch -Patch43: 0043-Enable-only-TLSv1.2-by-default.patch +#Patch42: 0042-When-handling-FEAT-command-check-ssl_tlsv1_1-and-ssl.patch +#Patch43: 0043-Enable-only-TLSv1.2-by-default.patch Patch44: 0044-Disable-anonymous_enable-in-default-config-file.patch Patch45: 0045-Expand-explanation-of-ascii_-options-behaviour-in-ma.patch Patch46: 0046-vsftpd.conf-Refer-to-the-man-page-regarding-the-asci.patch @@ -97,10 +97,8 @@ Patch67: 0001-Fix-timestamp-handling-in-MDTM.patch Patch68: 0002-Drop-an-unused-global-variable.patch Patch69: 0001-Remove-a-hint-about-the-ftp_home_dir-SELinux-boolean.patch Patch70: fix-str_open.patch +Patch71: vsftpd-3.0.5-enable_wc_logs-replace_unprintable_with_hex.patch # upstream commits 56402c0, 8b82e73 -Patch71: vsftpd-3.0.3-enable_wc_logs-replace_unprintable_with_hex.patch -Patch72: vsftpd-3.0.3-ALPACA.patch -Patch73: vsftpd-3.0.3-option_to_disable_TLSv1_3.patch %description vsftpd is a Very Secure FTP daemon. It was written completely from @@ -172,6 +170,9 @@ mkdir -p $RPM_BUILD_ROOT/%{_var}/ftp/pub %{_var}/ftp %changelog +* Thu Jul 28 2022 Richard Lescak 3.0.5-1 +- rebase to version 3.0.5 + * Sat Jul 23 2022 Fedora Release Engineering - 3.0.3-51 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild From 8ce1361c8ca80c4fe35b4c99094d21bfd57c5efa Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 21 Jan 2023 06:31:03 +0000 Subject: [PATCH 25/40] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- vsftpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/vsftpd.spec b/vsftpd.spec index 18f9361..7efc847 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -2,7 +2,7 @@ Name: vsftpd Version: 3.0.5 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Very Secure Ftp Daemon # OpenSSL link exception @@ -170,6 +170,9 @@ mkdir -p $RPM_BUILD_ROOT/%{_var}/ftp/pub %{_var}/ftp %changelog +* Sat Jan 21 2023 Fedora Release Engineering - 3.0.5-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Thu Jul 28 2022 Richard Lescak 3.0.5-1 - rebase to version 3.0.5 From 57c94df2dcebe0b75f65519fac394b377237234c Mon Sep 17 00:00:00 2001 From: Richard Lescak Date: Fri, 17 Feb 2023 16:32:19 +0100 Subject: [PATCH 26/40] make vsftpd compatible with Openssl 3.0+ replace old network functions --- ...-support-for-DHE-based-cipher-suites.patch | 112 +++----------- ...upport-for-EDDHE-based-cipher-suites.patch | 28 ++-- ...ment-patch-to-build-with-OpenSSL-1.1.patch | 74 ---------- ...replace-deprecated-openssl-functions.patch | 70 +++++++++ ...5-replace-old-network-addr-functions.patch | 139 ++++++++++++++++++ vsftpd.spec | 16 +- 6 files changed, 252 insertions(+), 187 deletions(-) delete mode 100644 0035-Modify-DH-enablement-patch-to-build-with-OpenSSL-1.1.patch create mode 100644 vsftpd-3.0.5-replace-deprecated-openssl-functions.patch create mode 100644 vsftpd-3.0.5-replace-old-network-addr-functions.patch diff --git a/0021-Introduce-support-for-DHE-based-cipher-suites.patch b/0021-Introduce-support-for-DHE-based-cipher-suites.patch index cfa23bb..bbf99a8 100644 --- a/0021-Introduce-support-for-DHE-based-cipher-suites.patch +++ b/0021-Introduce-support-for-DHE-based-cipher-suites.patch @@ -31,81 +31,36 @@ index c362983..22b69b3 100644 #include #include #include -+#include +#include ++#include #include #include -@@ -38,6 +40,7 @@ - static char* get_ssl_error(); - static SSL* get_ssl(struct vsf_session* p_sess, int fd); - static int ssl_session_init(struct vsf_session* p_sess); -+static DH *ssl_tmp_dh_callback(SSL *ssl, int is_export, int keylength); - static void setup_bio_callbacks(); - static long bio_callback( - BIO* p_bio, int oper, const char* p_arg, int argi, long argl, long retval); -@@ -51,6 +54,60 @@ static int ssl_read_common(struct vsf_session* p_sess, +@@ -58,6 +60,23 @@ static int ssl_inited; static struct mystr debug_str; ++EVP_PKEY * ++DH_get_dh() ++{ ++ OSSL_PARAM dh_params[2]; ++ EVP_PKEY *dh_key = NULL; ++ EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new_from_name(NULL, "DH", NULL); + -+// Grab prime number from OpenSSL; -+// (get_rfc*) for all available primes. -+// wraps selection of comparable algorithm strength -+#if !defined(match_dh_bits) -+ #define match_dh_bits(keylen) \ -+ keylen >= 8191 ? 8192 : \ -+ keylen >= 6143 ? 6144 : \ -+ keylen >= 4095 ? 4096 : \ -+ keylen >= 3071 ? 3072 : \ -+ keylen >= 2047 ? 2048 : \ -+ keylen >= 1535 ? 1536 : \ -+ keylen >= 1023 ? 1024 : 768 -+#endif ++ dh_params[0] = OSSL_PARAM_construct_utf8_string("group", "ffdhe2048", 0); ++ dh_params[1] = OSSL_PARAM_construct_end(); + -+#if !defined(DH_get_prime) -+ BIGNUM * -+ DH_get_prime(int bits) -+ { -+ switch (bits) { -+ case 768: return get_rfc2409_prime_768(NULL); -+ case 1024: return get_rfc2409_prime_1024(NULL); -+ case 1536: return get_rfc3526_prime_1536(NULL); -+ case 2048: return get_rfc3526_prime_2048(NULL); -+ case 3072: return get_rfc3526_prime_3072(NULL); -+ case 4096: return get_rfc3526_prime_4096(NULL); -+ case 6144: return get_rfc3526_prime_6144(NULL); -+ case 8192: return get_rfc3526_prime_8192(NULL); -+ // shouldn't happen when used match_dh_bits; strict compiler -+ default: return NULL; -+ } ++ if (EVP_PKEY_keygen_init(pctx) <= 0 || EVP_PKEY_CTX_set_params(pctx, dh_params) <= 0) ++ return NULL; ++ EVP_PKEY_generate(pctx, &dh_key); ++ EVP_PKEY_CTX_free(pctx); ++ return dh_key; +} -+#endif -+ -+#if !defined(DH_get_dh) -+ // Grab DH parameters -+ DH * -+ DH_get_dh(int size) -+ { -+ DH *dh = DH_new(); -+ if (!dh) { -+ return NULL; -+ } -+ dh->p = DH_get_prime(match_dh_bits(size)); -+ BN_dec2bn(&dh->g, "2"); -+ if (!dh->p || !dh->g) -+ { -+ DH_free(dh); -+ return NULL; -+ } -+ return dh; -+ } -+#endif + void ssl_init(struct vsf_session* p_sess) { -@@ -65,7 +122,7 @@ ssl_init(struct vsf_session* p_sess) +@@ -72,7 +89,7 @@ { die("SSL: could not allocate SSL context"); } @@ -114,61 +69,42 @@ index c362983..22b69b3 100644 if (!tunable_sslv2) { options |= SSL_OP_NO_SSLv2; -@@ -111,6 +168,25 @@ ssl_init(struct vsf_session* p_sess) +@@ -130,6 +147,25 @@ die("SSL: cannot load DSA private key"); } } + if (tunable_dh_param_file) + { + BIO *bio; -+ DH *dhparams = NULL; ++ EVP_PKEY *dh_params = NULL; + if ((bio = BIO_new_file(tunable_dh_param_file, "r")) == NULL) + { + die("SSL: cannot load custom DH params"); + } + else + { -+ dhparams = PEM_read_bio_DHparams(bio, NULL, NULL, NULL); ++ dh_params = PEM_read_bio_Parameters(bio, NULL); + BIO_free(bio); + -+ if (!SSL_CTX_set_tmp_dh(p_ctx, dhparams)) -+ { ++ if (!SSL_CTX_set0_tmp_dh_pkey(p_ctx, dh_params)) ++ { + die("SSL: setting custom DH params failed"); -+ } ++ } + } + } if (tunable_ssl_ciphers && SSL_CTX_set_cipher_list(p_ctx, tunable_ssl_ciphers) != 1) { -@@ -184,6 +260,9 @@ +@@ -184,6 +226,9 @@ /* Ensure cached session doesn't expire */ SSL_CTX_set_timeout(p_ctx, INT_MAX); } + -+ SSL_CTX_set_tmp_dh_callback(p_ctx, ssl_tmp_dh_callback); ++ SSL_CTX_set0_tmp_dh_pkey(p_ctx, DH_get_dh()); + /* Set up ALPN to check for FTP protocol intention of client. */ SSL_CTX_set_alpn_select_cb(p_ctx, ssl_alpn_callback, p_sess); /* Set up SNI callback for an optional hostname check. */ -@@ -854,6 +933,18 @@ ssl_verify_callback(int verify_ok, X509_STORE_CTX* p_ctx) - } - } - -+#define UNUSED(x) ( (void)(x) ) -+ -+static DH * -+ssl_tmp_dh_callback(SSL *ssl, int is_export, int keylength) -+{ -+ // strict compiler bypassing -+ UNUSED(ssl); -+ UNUSED(is_export); -+ -+ return DH_get_dh(keylength); -+} -+ - void - ssl_add_entropy(struct vsf_session* p_sess) - { diff --git a/tunables.c b/tunables.c index c737465..1ea7227 100644 --- a/tunables.c diff --git a/0022-Introduce-support-for-EDDHE-based-cipher-suites.patch b/0022-Introduce-support-for-EDDHE-based-cipher-suites.patch index 9cb56cd..0a09a2c 100644 --- a/0022-Introduce-support-for-EDDHE-based-cipher-suites.patch +++ b/0022-Introduce-support-for-EDDHE-based-cipher-suites.patch @@ -36,45 +36,37 @@ index 22b69b3..96bf8ad 100644 if (!tunable_sslv2) { options |= SSL_OP_NO_SSLv2; -@@ -244,6 +244,41 @@ +@@ -244,6 +244,33 @@ - SSL_CTX_set_tmp_dh_callback(p_ctx, ssl_tmp_dh_callback); + SSL_CTX_set0_tmp_dh_pkey(p_ctx, DH_get_dh()); + if (tunable_ecdh_param_file) + { + BIO *bio; -+ int nid; -+ EC_GROUP *ecparams = NULL; -+ EC_KEY *eckey; ++ EVP_PKEY *ec_params = NULL; + + if ((bio = BIO_new_file(tunable_ecdh_param_file, "r")) == NULL) + die("SSL: cannot load custom ec params"); + else + { -+ ecparams = PEM_read_bio_ECPKParameters(bio, NULL, NULL, NULL); ++ ec_params = PEM_read_bio_Parameters(bio, NULL); + BIO_free(bio); + -+ if (ecparams && (nid = EC_GROUP_get_curve_name(ecparams)) && -+ (eckey = EC_KEY_new_by_curve_name(nid))) ++ if (ec_params != NULL) + { -+ if (!SSL_CTX_set_tmp_ecdh(p_ctx, eckey)) ++ if (!SSL_CTX_set1_groups_list(p_ctx, ec_params)) + die("SSL: setting custom EC params failed"); -+ } -+ else ++ } ++ else + { + die("SSL: getting ec group or key failed"); -+ } ++ } + } + } + else + { -+#if defined(SSL_CTX_set_ecdh_auto) -+ SSL_CTX_set_ecdh_auto(p_ctx, 1); -+#else -+ SSL_CTX_set_tmp_ecdh(p_ctx, EC_KEY_new_by_curve_name(NID_X9_62_prime256v1)); -+#endif ++ SSL_CTX_set1_groups_list(p_ctx, "P-256"); + } -+ /* Set up ALPN to check for FTP protocol intention of client. */ SSL_CTX_set_alpn_select_cb(p_ctx, ssl_alpn_callback, p_sess); /* Set up SNI callback for an optional hostname check. */ diff --git a/0035-Modify-DH-enablement-patch-to-build-with-OpenSSL-1.1.patch b/0035-Modify-DH-enablement-patch-to-build-with-OpenSSL-1.1.patch deleted file mode 100644 index 1cebc18..0000000 --- a/0035-Modify-DH-enablement-patch-to-build-with-OpenSSL-1.1.patch +++ /dev/null @@ -1,74 +0,0 @@ -From 6c8dd87f311e411bcb1c72c1c780497881a5621c Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Ond=C5=99ej=20Lyson=C4=9Bk?= -Date: Mon, 4 Sep 2017 11:32:03 +0200 -Subject: [PATCH 35/59] Modify DH enablement patch to build with OpenSSL 1.1 - ---- - ssl.c | 41 ++++++++++++++++++++++++++++++++++++++--- - 1 file changed, 38 insertions(+), 3 deletions(-) - -diff --git a/ssl.c b/ssl.c -index ba8a613..09ec96a 100644 ---- a/ssl.c -+++ b/ssl.c -@@ -88,19 +88,54 @@ static struct mystr debug_str; - } - #endif - -+#if OPENSSL_VERSION_NUMBER < 0x10100000L -+int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g) -+{ -+ /* If the fields p and g in d are NULL, the corresponding input -+ * parameters MUST be non-NULL. q may remain NULL. -+ */ -+ if ((dh->p == NULL && p == NULL) -+ || (dh->g == NULL && g == NULL)) -+ return 0; -+ -+ if (p != NULL) { -+ BN_free(dh->p); -+ dh->p = p; -+ } -+ if (q != NULL) { -+ BN_free(dh->q); -+ dh->q = q; -+ } -+ if (g != NULL) { -+ BN_free(dh->g); -+ dh->g = g; -+ } -+ -+ if (q != NULL) { -+ dh->length = BN_num_bits(q); -+ } -+ -+ return 1; -+} -+#endif -+ - #if !defined(DH_get_dh) - // Grab DH parameters - DH * - DH_get_dh(int size) - { -+ BIGNUM *g = NULL; -+ BIGNUM *p = NULL; - DH *dh = DH_new(); - if (!dh) { - return NULL; - } -- dh->p = DH_get_prime(match_dh_bits(size)); -- BN_dec2bn(&dh->g, "2"); -- if (!dh->p || !dh->g) -+ p = DH_get_prime(match_dh_bits(size)); -+ BN_dec2bn(&g, "2"); -+ if (!p || !g || !DH_set0_pqg(dh, p, NULL, g)) - { -+ BN_free(g); -+ BN_free(p); - DH_free(dh); - return NULL; - } --- -2.14.4 - diff --git a/vsftpd-3.0.5-replace-deprecated-openssl-functions.patch b/vsftpd-3.0.5-replace-deprecated-openssl-functions.patch new file mode 100644 index 0000000..c6f8f7d --- /dev/null +++ b/vsftpd-3.0.5-replace-deprecated-openssl-functions.patch @@ -0,0 +1,70 @@ +diff --git a/ssl.c b/ssl.c +--- ssl.c ++++ ssl.c +@@ -28,17 +28,17 @@ + #include + #include + #include + #include + #include + #include + #include + + static char* get_ssl_error(); + static SSL* get_ssl(struct vsf_session* p_sess, int fd); + static int ssl_session_init(struct vsf_session* p_sess); + static void setup_bio_callbacks(); + static long bio_callback( +- BIO* p_bio, int oper, const char* p_arg, int argi, long argl, long retval); ++ BIO* p_bio, int oper, const char* p_arg, size_t len, int argi, long argl, int ret, size_t *processed); + static int ssl_verify_callback(int verify_ok, X509_STORE_CTX* p_ctx); + static int ssl_alpn_callback(SSL* p_ssl, + const unsigned char** p_out, +@@ -88,7 +88,7 @@ + long options; + int verify_option = 0; + SSL_library_init(); +- p_ctx = SSL_CTX_new(SSLv23_server_method()); ++ p_ctx = SSL_CTX_new_ex(NULL, NULL, SSLv23_server_method()); + if (p_ctx == NULL) + { + die("SSL: could not allocate SSL context"); +@@ -180,13 +180,10 @@ + die("SSL: RNG is not seeded"); + } + { +- EC_KEY* key = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1); +- if (key == NULL) ++ if (!SSL_CTX_set1_groups_list(p_ctx, "P-256")) + { + die("SSL: failed to get curve p256"); + } +- SSL_CTX_set_tmp_ecdh(p_ctx, key); +- EC_KEY_free(key); + } + if (tunable_ssl_request_cert) + { +@@ -692,17 +689,19 @@ + static void setup_bio_callbacks(SSL* p_ssl) + { + BIO* p_bio = SSL_get_rbio(p_ssl); +- BIO_set_callback(p_bio, bio_callback); ++ BIO_set_callback_ex(p_bio, bio_callback); + p_bio = SSL_get_wbio(p_ssl); +- BIO_set_callback(p_bio, bio_callback); ++ BIO_set_callback_ex(p_bio, bio_callback); + } + + static long + bio_callback( +- BIO* p_bio, int oper, const char* p_arg, int argi, long argl, long ret) ++ BIO* p_bio, int oper, const char* p_arg, size_t len, int argi, long argl, int ret, size_t *processed) + { + int retval = 0; + int fd = 0; ++ (void) len; ++ (void) processed; + (void) p_arg; + (void) argi; + (void) argl; + diff --git a/vsftpd-3.0.5-replace-old-network-addr-functions.patch b/vsftpd-3.0.5-replace-old-network-addr-functions.patch new file mode 100644 index 0000000..89e6257 --- /dev/null +++ b/vsftpd-3.0.5-replace-old-network-addr-functions.patch @@ -0,0 +1,139 @@ +diff -urN vsftpd-3.0.5-orig/postlogin.c vsftpd-3.0.5/postlogin.c +--- vsftpd-3.0.5-orig/postlogin.c 2015-07-22 21:03:22.000000000 +0200 ++++ vsftpd-3.0.5/postlogin.c 2023-02-13 16:34:05.244467476 +0100 +@@ -27,4 +27,6 @@ + #include "ssl.h" + #include "vsftpver.h" ++#include ++#include + #include "opts.h" + +@@ -628,9 +629,10 @@ + else + { + const void* p_v4addr = vsf_sysutil_sockaddr_ipv6_v4(s_p_sockaddr); ++ static char result[INET_ADDRSTRLEN]; + if (p_v4addr) + { +- str_append_text(&s_pasv_res_str, vsf_sysutil_inet_ntoa(p_v4addr)); ++ str_append_text(&s_pasv_res_str, inet_ntop(AF_INET, p_v4addr, result, INET_ADDRSTRLEN)); + } + else + { +diff -urN vsftpd-3.0.5-orig/sysutil.c vsftpd-3.0.5/sysutil.c +--- vsftpd-3.0.5-orig/sysutil.c 2012-09-16 09:07:38.000000000 +0200 ++++ vsftpd-3.0.5/sysutil.c 2023-02-13 16:08:58.557153109 +0100 +@@ -2205,20 +2205,13 @@ + const struct sockaddr* p_sockaddr = &p_sockptr->u.u_sockaddr; + if (p_sockaddr->sa_family == AF_INET) + { +- return inet_ntoa(p_sockptr->u.u_sockaddr_in.sin_addr); ++ static char result[INET_ADDRSTRLEN]; ++ return inet_ntop(AF_INET, &p_sockptr->u.u_sockaddr_in.sin_addr, result, INET_ADDRSTRLEN); + } + else if (p_sockaddr->sa_family == AF_INET6) + { +- static char inaddr_buf[64]; +- const char* p_ret = inet_ntop(AF_INET6, +- &p_sockptr->u.u_sockaddr_in6.sin6_addr, +- inaddr_buf, sizeof(inaddr_buf)); +- inaddr_buf[sizeof(inaddr_buf) - 1] = '\0'; +- if (p_ret == NULL) +- { +- inaddr_buf[0] = '\0'; +- } +- return inaddr_buf; ++ static char result[INET6_ADDRSTRLEN]; ++ return inet_ntop(AF_INET6, &p_sockptr->u.u_sockaddr_in6.sin6_addr, result, INET6_ADDRSTRLEN); + } + else + { +@@ -2227,12 +2220,6 @@ + } + } + +-const char* +-vsf_sysutil_inet_ntoa(const void* p_raw_addr) +-{ +- return inet_ntoa(*((struct in_addr*)p_raw_addr)); +-} +- + int + vsf_sysutil_inet_aton(const char* p_text, struct vsf_sysutil_sockaddr* p_addr) + { +@@ -2241,7 +2228,7 @@ + { + bug("bad family"); + } +- if (inet_aton(p_text, &sin_addr)) ++ if (inet_pton(AF_INET, p_text, &sin_addr)) + { + vsf_sysutil_memcpy(&p_addr->u.u_sockaddr_in.sin_addr, + &sin_addr, sizeof(p_addr->u.u_sockaddr_in.sin_addr)); +@@ -2257,37 +2244,46 @@ + vsf_sysutil_dns_resolve(struct vsf_sysutil_sockaddr** p_sockptr, + const char* p_name) + { +- struct hostent* hent = gethostbyname(p_name); +- if (hent == NULL) ++ struct addrinfo *result; ++ struct addrinfo hints; ++ int ret; ++ ++ memset(&hints, 0, sizeof(struct addrinfo)); ++ hints.ai_family = AF_UNSPEC; ++ ++ if ((ret = getaddrinfo(p_name, NULL, &hints, &result)) != 0) + { ++ fprintf(stderr, "getaddrinfo: %s\n", gai_strerror(ret)); + die2("cannot resolve host:", p_name); + } + vsf_sysutil_sockaddr_clear(p_sockptr); +- if (hent->h_addrtype == AF_INET) ++ if (result->ai_family == AF_INET) + { +- unsigned int len = hent->h_length; ++ unsigned int len = result->ai_addrlen; + if (len > sizeof((*p_sockptr)->u.u_sockaddr_in.sin_addr)) + { + len = sizeof((*p_sockptr)->u.u_sockaddr_in.sin_addr); + } + vsf_sysutil_sockaddr_alloc_ipv4(p_sockptr); + vsf_sysutil_memcpy(&(*p_sockptr)->u.u_sockaddr_in.sin_addr, +- hent->h_addr_list[0], len); ++ &result->ai_addrlen, len); + } +- else if (hent->h_addrtype == AF_INET6) ++ else if (result->ai_family == AF_INET6) + { +- unsigned int len = hent->h_length; ++ unsigned int len = result->ai_addrlen; + if (len > sizeof((*p_sockptr)->u.u_sockaddr_in6.sin6_addr)) + { + len = sizeof((*p_sockptr)->u.u_sockaddr_in6.sin6_addr); + } + vsf_sysutil_sockaddr_alloc_ipv6(p_sockptr); + vsf_sysutil_memcpy(&(*p_sockptr)->u.u_sockaddr_in6.sin6_addr, +- hent->h_addr_list[0], len); ++ &result->ai_addrlen, len); + } + else + { +- die("gethostbyname(): neither IPv4 nor IPv6"); ++ freeaddrinfo(result); ++ die("getaddrinfo(): neither IPv4 nor IPv6"); + } ++ freeaddrinfo(result); + } + +diff -urN vsftpd-3.0.5-orig/sysutil.h vsftpd-3.0.5/sysutil.h +--- vsftpd-3.0.5-orig/sysutil.h 2021-05-18 08:50:21.000000000 +0200 ++++ vsftpd-3.0.5/sysutil.h 2023-02-13 15:59:22.088331075 +0100 +@@ -277,7 +277,6 @@ + + const char* vsf_sysutil_inet_ntop( + const struct vsf_sysutil_sockaddr* p_sockptr); +-const char* vsf_sysutil_inet_ntoa(const void* p_raw_addr); + int vsf_sysutil_inet_aton( + const char* p_text, struct vsf_sysutil_sockaddr* p_addr); + diff --git a/vsftpd.spec b/vsftpd.spec index 7efc847..72ce764 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -2,7 +2,7 @@ Name: vsftpd Version: 3.0.5 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Very Secure Ftp Daemon # OpenSSL link exception @@ -63,7 +63,6 @@ Patch31: 0031-Fix-question-mark-wildcard-withing-a-file-name.patch Patch32: 0032-Propagate-errors-from-nfs-with-quota-to-client.patch #Patch33: 0033-Introduce-TLSv1.1-and-TLSv1.2-options.patch Patch34: 0034-Turn-off-seccomp-sandbox-because-it-is-too-strict.patch -Patch35: 0035-Modify-DH-enablement-patch-to-build-with-OpenSSL-1.1.patch Patch36: 0036-Redefine-VSFTP_COMMAND_FD-to-1.patch Patch37: 0037-Document-the-relationship-of-text_userdb_names-and-c.patch Patch38: 0038-Document-allow_writeable_chroot-in-the-man-page.patch @@ -98,7 +97,8 @@ Patch68: 0002-Drop-an-unused-global-variable.patch Patch69: 0001-Remove-a-hint-about-the-ftp_home_dir-SELinux-boolean.patch Patch70: fix-str_open.patch Patch71: vsftpd-3.0.5-enable_wc_logs-replace_unprintable_with_hex.patch -# upstream commits 56402c0, 8b82e73 +Patch72: vsftpd-3.0.5-replace-old-network-addr-functions.patch +Patch73: vsftpd-3.0.5-replace-deprecated-openssl-functions.patch %description vsftpd is a Very Secure FTP daemon. It was written completely from @@ -109,13 +109,11 @@ scratch. cp %{SOURCE1} . %build -# temporary ignore deprecated warnings to be able to build against OpenSSL 3.0 -%define ignore_deprecated -Wno-deprecated-declarations %ifarch s390x sparcv9 sparc64 -%make_build CFLAGS="$RPM_OPT_FLAGS -fPIE -pipe -Wextra -Werror %ignore_deprecated" \ +%make_build CFLAGS="$RPM_OPT_FLAGS -fPIE -pipe -Wextra -Werror" \ %else -%make_build CFLAGS="$RPM_OPT_FLAGS -fpie -pipe -Wextra -Werror %ignore_deprecated" \ +%make_build CFLAGS="$RPM_OPT_FLAGS -fpie -pipe -Wextra -Werror" \ %endif LINK="-pie -lssl $RPM_LD_FLAGS" %{?_smp_mflags} @@ -170,6 +168,10 @@ mkdir -p $RPM_BUILD_ROOT/%{_var}/ftp/pub %{_var}/ftp %changelog +* Fri Feb 17 2023 Richard Lescak - 3.0.5-3 +- make vsftpd compatible with Openssl 3.0+ +- replace old network functions + * Sat Jan 21 2023 Fedora Release Engineering - 3.0.5-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild From 9f310a0dd2a73294b1f1bcc81c3c245d2549c225 Mon Sep 17 00:00:00 2001 From: Ondrej Mejzlik Date: Tue, 18 Apr 2023 12:45:29 +0200 Subject: [PATCH 27/40] Adding fmf plans and gating --- ci.fmf | 1 + gating.yaml | 23 +++++++++++++++++------ plans/ci.fmf | 6 ------ plans/public.fmf | 6 ++++++ plans/tier1-internal.fmf | 12 ++++++++++++ 5 files changed, 36 insertions(+), 12 deletions(-) create mode 100644 ci.fmf delete mode 100644 plans/ci.fmf create mode 100644 plans/public.fmf create mode 100644 plans/tier1-internal.fmf diff --git a/ci.fmf b/ci.fmf new file mode 100644 index 0000000..c5aa0e0 --- /dev/null +++ b/ci.fmf @@ -0,0 +1 @@ +resultsdb-testcase: separate diff --git a/gating.yaml b/gating.yaml index ce1b655..de5c323 100644 --- a/gating.yaml +++ b/gating.yaml @@ -1,16 +1,27 @@ --- !Policy product_versions: - fedora-* -decision_contexts: [bodhi_update_push_testing] +decision_context: bodhi_update_push_testing subject_type: koji_build rules: - - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} - -#gating rawhide + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/public.functional} + +#Rawhide --- !Policy product_versions: - fedora-* -decision_contexts: [bodhi_update_push_stable] +decision_context: bodhi_update_push_stable subject_type: koji_build rules: - - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/public.functional} + +#gating rhel +--- !Policy +product_versions: + - rhel-* +decision_context: osci_compose_gate +rules: + - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional} + - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tedude.validation} + - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/tier1-internal.functional} + - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/public.functional} diff --git a/plans/ci.fmf b/plans/ci.fmf deleted file mode 100644 index 3eeb9e9..0000000 --- a/plans/ci.fmf +++ /dev/null @@ -1,6 +0,0 @@ -summary: Test plan that runs all tests from tests repo. -discover: - how: fmf - url: https://src.fedoraproject.org/tests/vsftpd.git -execute: - how: tmt diff --git a/plans/public.fmf b/plans/public.fmf new file mode 100644 index 0000000..95682f5 --- /dev/null +++ b/plans/public.fmf @@ -0,0 +1,6 @@ +summary: Test plan with all Fedora tests +discover: + how: fmf + url: https://src.fedoraproject.org/tests/vsftpd.git +execute: + how: tmt diff --git a/plans/tier1-internal.fmf b/plans/tier1-internal.fmf new file mode 100644 index 0000000..d1dd032 --- /dev/null +++ b/plans/tier1-internal.fmf @@ -0,0 +1,12 @@ +summary: CI plan, picks internal Tier1 tests, runs in beakerlib. +discover: + - name: rhel + how: fmf + filter: 'tier: 1' + url: git://pkgs.devel.redhat.com/tests/vsftpd +execute: + how: tmt +adjust: + enabled: false + when: distro == centos-stream, fedora + because: They don't have access to internal repos. From 17a18d5fda02aca5d33e681a51fb3c4ba4bbd33a Mon Sep 17 00:00:00 2001 From: Richard Lescak Date: Fri, 5 May 2023 14:50:38 +0200 Subject: [PATCH 28/40] add option for TLSv1.3 ciphersuites SPDX migration --- ...-support-for-DHE-based-cipher-suites.patch | 4 +- ...-add-option-for-tlsv1.3-ciphersuites.patch | 79 +++++++++++++++++++ ...replace-deprecated-openssl-functions.patch | 2 +- vsftpd-3.0.5-use-old-tlsv-options.patch | 15 ++++ vsftpd.spec | 10 ++- 5 files changed, 106 insertions(+), 4 deletions(-) create mode 100644 vsftpd-3.0.5-add-option-for-tlsv1.3-ciphersuites.patch create mode 100644 vsftpd-3.0.5-use-old-tlsv-options.patch diff --git a/0021-Introduce-support-for-DHE-based-cipher-suites.patch b/0021-Introduce-support-for-DHE-based-cipher-suites.patch index bbf99a8..3460c2a 100644 --- a/0021-Introduce-support-for-DHE-based-cipher-suites.patch +++ b/0021-Introduce-support-for-DHE-based-cipher-suites.patch @@ -69,7 +69,7 @@ index c362983..22b69b3 100644 if (!tunable_sslv2) { options |= SSL_OP_NO_SSLv2; -@@ -130,6 +147,25 @@ +@@ -149,8 +166,27 @@ die("SSL: cannot load DSA private key"); } } @@ -95,6 +95,8 @@ index c362983..22b69b3 100644 if (tunable_ssl_ciphers && SSL_CTX_set_cipher_list(p_ctx, tunable_ssl_ciphers) != 1) { + die("SSL: could not set cipher list"); + } @@ -184,6 +226,9 @@ /* Ensure cached session doesn't expire */ SSL_CTX_set_timeout(p_ctx, INT_MAX); diff --git a/vsftpd-3.0.5-add-option-for-tlsv1.3-ciphersuites.patch b/vsftpd-3.0.5-add-option-for-tlsv1.3-ciphersuites.patch new file mode 100644 index 0000000..1f1925e --- /dev/null +++ b/vsftpd-3.0.5-add-option-for-tlsv1.3-ciphersuites.patch @@ -0,0 +1,79 @@ +diff -urN a/parseconf.c b/parseconf.c +--- a/parseconf.c 2021-05-29 23:39:19.000000000 +0200 ++++ b/parseconf.c 2023-03-03 10:22:38.256439634 +0100 +@@ -185,6 +185,7 @@ + { "dsa_cert_file", &tunable_dsa_cert_file }, + { "dh_param_file", &tunable_dh_param_file }, + { "ecdh_param_file", &tunable_ecdh_param_file }, ++ { "ssl_ciphersuites", &tunable_ssl_ciphersuites }, + { "ssl_ciphers", &tunable_ssl_ciphers }, + { "rsa_private_key_file", &tunable_rsa_private_key_file }, + { "dsa_private_key_file", &tunable_dsa_private_key_file }, +diff -urN a/ssl.c b/ssl.c +--- a/ssl.c 2021-08-02 08:24:35.000000000 +0200 ++++ b/ssl.c 2023-03-03 10:28:05.989757655 +0100 +@@ -135,6 +135,11 @@ + { + die("SSL: could not set cipher list"); + } ++ if (tunable_ssl_ciphersuites && ++ SSL_CTX_set_ciphersuites(p_ctx, tunable_ssl_ciphersuites) != 1) ++ { ++ die("SSL: could not set ciphersuites"); ++ } + if (RAND_status() != 1) + { + die("SSL: RNG is not seeded"); +diff -urN a/tunables.c b/tunables.c +--- a/tunables.c 2021-05-29 23:39:00.000000000 +0200 ++++ b/tunables.c 2023-03-03 10:13:30.566868026 +0100 +@@ -154,6 +154,7 @@ + const char* tunable_dsa_cert_file; + const char* tunable_dh_param_file; + const char* tunable_ecdh_param_file; + const char* tunable_ssl_ciphers; ++const char* tunable_ssl_ciphersuites; + const char* tunable_rsa_private_key_file; + const char* tunable_dsa_private_key_file; +@@ -293,6 +293,7 @@ + install_str_setting(0, &tunable_dh_param_file); + install_str_setting(0, &tunable_ecdh_param_file); + install_str_setting("PROFILE=SYSTEM", &tunable_ssl_ciphers); ++ install_str_setting("TLS_AES_256_GCM_SHA384", &tunable_ssl_ciphersuites); + install_str_setting(0, &tunable_rsa_private_key_file); + install_str_setting(0, &tunable_dsa_private_key_file); + install_str_setting(0, &tunable_ca_certs_file); +diff -urN a/tunables.h b/tunables.h +--- a/tunables.h ++++ b/tunables.h +@@ -144,6 +144,7 @@ + extern const char* tunable_dsa_cert_file; + extern const char* tunable_dh_param_file; + extern const char* tunable_ecdh_param_file; + extern const char* tunable_ssl_ciphers; ++extern const char* tunable_ssl_ciphersuites; + extern const char* tunable_rsa_private_key_file; + extern const char* tunable_dsa_private_key_file; +--- a/vsftpd.conf.5 ++++ b/vsftpd.conf.5 +@@ -1009,6 +1009,20 @@ + + Default: PROFILE=SYSTEM + .TP ++.B ssl_ciphersuites ++This option can be used to select which SSL cipher suites vsftpd will allow for ++encrypted SSL connections with TLSv1.3. See the ++.BR ciphers ++man page for further details. Note that restricting ciphers can be a useful ++security precaution as it prevents malicious remote parties forcing a cipher ++which they have found problems with. ++ ++By default, the system-wide crypto policy is used. See ++.BR update-crypto-policies(8) ++for further details. ++ ++Default: TLS_AES_256_GCM_SHA384 ++.TP + .B ssl_sni_hostname + If set, SSL connections will be rejected unless the SNI hostname in the + incoming handshakes matches this value. diff --git a/vsftpd-3.0.5-replace-deprecated-openssl-functions.patch b/vsftpd-3.0.5-replace-deprecated-openssl-functions.patch index c6f8f7d..8e3792b 100644 --- a/vsftpd-3.0.5-replace-deprecated-openssl-functions.patch +++ b/vsftpd-3.0.5-replace-deprecated-openssl-functions.patch @@ -25,7 +25,7 @@ diff --git a/ssl.c b/ssl.c int verify_option = 0; SSL_library_init(); - p_ctx = SSL_CTX_new(SSLv23_server_method()); -+ p_ctx = SSL_CTX_new_ex(NULL, NULL, SSLv23_server_method()); ++ p_ctx = SSL_CTX_new_ex(NULL, NULL, TLS_server_method()); if (p_ctx == NULL) { die("SSL: could not allocate SSL context"); diff --git a/vsftpd-3.0.5-use-old-tlsv-options.patch b/vsftpd-3.0.5-use-old-tlsv-options.patch new file mode 100644 index 0000000..7c37ce9 --- /dev/null +++ b/vsftpd-3.0.5-use-old-tlsv-options.patch @@ -0,0 +1,15 @@ +--- parseconf-orig.c 2022-10-25 15:17:18.990701984 +0200 ++++ parseconf.c 2022-10-25 15:12:44.213480000 +0200 +@@ -85,9 +85,9 @@ + { "ssl_sslv2", &tunable_sslv2 }, + { "ssl_sslv3", &tunable_sslv3 }, + { "ssl_tlsv1", &tunable_tlsv1 }, +- { "ssl_tlsv11", &tunable_tlsv1_1 }, +- { "ssl_tlsv12", &tunable_tlsv1_2 }, +- { "ssl_tlsv13", &tunable_tlsv1_3 }, ++ { "ssl_tlsv1_1", &tunable_tlsv1_1 }, ++ { "ssl_tlsv1_2", &tunable_tlsv1_2 }, ++ { "ssl_tlsv1_3", &tunable_tlsv1_3 }, + { "tilde_user_enable", &tunable_tilde_user_enable }, + { "force_anon_logins_ssl", &tunable_force_anon_logins_ssl }, + { "force_anon_data_ssl", &tunable_force_anon_data_ssl }, diff --git a/vsftpd.spec b/vsftpd.spec index 72ce764..3df6d73 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -2,11 +2,11 @@ Name: vsftpd Version: 3.0.5 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Very Secure Ftp Daemon # OpenSSL link exception -License: GPLv2 with exceptions +License: GPL-2.0-only WITH vsftpd-openssl-exception URL: https://security.appspot.com/vsftpd.html Source0: https://security.appspot.com/downloads/%{name}-%{version}.tar.gz Source1: vsftpd.xinetd @@ -99,6 +99,8 @@ Patch70: fix-str_open.patch Patch71: vsftpd-3.0.5-enable_wc_logs-replace_unprintable_with_hex.patch Patch72: vsftpd-3.0.5-replace-old-network-addr-functions.patch Patch73: vsftpd-3.0.5-replace-deprecated-openssl-functions.patch +Patch74: vsftpd-3.0.5-add-option-for-tlsv1.3-ciphersuites.patch +Patch75: vsftpd-3.0.5-use-old-tlsv-options.patch %description vsftpd is a Very Secure FTP daemon. It was written completely from @@ -168,6 +170,10 @@ mkdir -p $RPM_BUILD_ROOT/%{_var}/ftp/pub %{_var}/ftp %changelog +* Thu May 04 2023 Richard Lescak - 3.0.5-4 +- add option for TLSv1.3 ciphersuites +- SPDX migration + * Fri Feb 17 2023 Richard Lescak - 3.0.5-3 - make vsftpd compatible with Openssl 3.0+ - replace old network functions From e4f583e81fda55cd092b506fc61b02874ec24e15 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 22 Jul 2023 17:53:13 +0000 Subject: [PATCH 29/40] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- vsftpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/vsftpd.spec b/vsftpd.spec index 3df6d73..e76e3b7 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -2,7 +2,7 @@ Name: vsftpd Version: 3.0.5 -Release: 4%{?dist} +Release: 5%{?dist} Summary: Very Secure Ftp Daemon # OpenSSL link exception @@ -170,6 +170,9 @@ mkdir -p $RPM_BUILD_ROOT/%{_var}/ftp/pub %{_var}/ftp %changelog +* Sat Jul 22 2023 Fedora Release Engineering - 3.0.5-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Thu May 04 2023 Richard Lescak - 3.0.5-4 - add option for TLSv1.3 ciphersuites - SPDX migration From bbcf7c122fa17ea053fb8967d03a555ebd64bb0c Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 27 Jan 2024 08:14:07 +0000 Subject: [PATCH 30/40] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- vsftpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/vsftpd.spec b/vsftpd.spec index e76e3b7..a05c3f7 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -2,7 +2,7 @@ Name: vsftpd Version: 3.0.5 -Release: 5%{?dist} +Release: 6%{?dist} Summary: Very Secure Ftp Daemon # OpenSSL link exception @@ -170,6 +170,9 @@ mkdir -p $RPM_BUILD_ROOT/%{_var}/ftp/pub %{_var}/ftp %changelog +* Sat Jan 27 2024 Fedora Release Engineering - 3.0.5-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Sat Jul 22 2023 Fedora Release Engineering - 3.0.5-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild From 4b2c95303c888c07d7ebbd069e4f2fac597da46b Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 20 Jul 2024 09:02:01 +0000 Subject: [PATCH 31/40] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- vsftpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/vsftpd.spec b/vsftpd.spec index a05c3f7..397535d 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -2,7 +2,7 @@ Name: vsftpd Version: 3.0.5 -Release: 6%{?dist} +Release: 7%{?dist} Summary: Very Secure Ftp Daemon # OpenSSL link exception @@ -170,6 +170,9 @@ mkdir -p $RPM_BUILD_ROOT/%{_var}/ftp/pub %{_var}/ftp %changelog +* Sat Jul 20 2024 Fedora Release Engineering - 3.0.5-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Sat Jan 27 2024 Fedora Release Engineering - 3.0.5-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From dff0329ff427009514de510649f81d7d600f85e4 Mon Sep 17 00:00:00 2001 From: Tomas Korbar Date: Mon, 19 Aug 2024 14:09:20 +0200 Subject: [PATCH 32/40] Fix FEAT command to list AUTH TLS when TLSv1.3 is enabled --- ...ntroduce-TLSv1.1-and-TLSv1.2-options.patch | 153 ------------------ ...AT-command-check-ssl_tlsv1_1-and-ssl.patch | 2 +- 0043-Enable-only-TLSv1.2-by-default.patch | 53 ------ vsftpd.spec | 9 +- 4 files changed, 6 insertions(+), 211 deletions(-) delete mode 100644 0033-Introduce-TLSv1.1-and-TLSv1.2-options.patch delete mode 100644 0043-Enable-only-TLSv1.2-by-default.patch diff --git a/0033-Introduce-TLSv1.1-and-TLSv1.2-options.patch b/0033-Introduce-TLSv1.1-and-TLSv1.2-options.patch deleted file mode 100644 index 8d6228e..0000000 --- a/0033-Introduce-TLSv1.1-and-TLSv1.2-options.patch +++ /dev/null @@ -1,153 +0,0 @@ -From 01bef55a1987700af3d43cdc5f5be88d3843ab85 Mon Sep 17 00:00:00 2001 -From: Martin Sehnoutka -Date: Thu, 17 Nov 2016 13:36:17 +0100 -Subject: [PATCH 33/59] Introduce TLSv1.1 and TLSv1.2 options. - -Users can now enable a specific version of TLS protocol. ---- - parseconf.c | 2 ++ - ssl.c | 8 ++++++++ - tunables.c | 9 +++++++-- - tunables.h | 2 ++ - vsftpd.conf.5 | 24 ++++++++++++++++++++---- - 5 files changed, 39 insertions(+), 6 deletions(-) - -diff --git a/parseconf.c b/parseconf.c -index a2c715b..33a1349 100644 ---- a/parseconf.c -+++ b/parseconf.c -@@ -85,6 +85,8 @@ parseconf_bool_array[] = - { "ssl_sslv2", &tunable_sslv2 }, - { "ssl_sslv3", &tunable_sslv3 }, - { "ssl_tlsv1", &tunable_tlsv1 }, -+ { "ssl_tlsv1_1", &tunable_tlsv1_1 }, -+ { "ssl_tlsv1_2", &tunable_tlsv1_2 }, - { "tilde_user_enable", &tunable_tilde_user_enable }, - { "force_anon_logins_ssl", &tunable_force_anon_logins_ssl }, - { "force_anon_data_ssl", &tunable_force_anon_data_ssl }, -diff --git a/ssl.c b/ssl.c -index 96bf8ad..ba8a613 100644 ---- a/ssl.c -+++ b/ssl.c -@@ -135,6 +135,14 @@ ssl_init(struct vsf_session* p_sess) - { - options |= SSL_OP_NO_TLSv1; - } -+ if (!tunable_tlsv1_1) -+ { -+ options |= SSL_OP_NO_TLSv1_1; -+ } -+ if (!tunable_tlsv1_2) -+ { -+ options |= SSL_OP_NO_TLSv1_2; -+ } - SSL_CTX_set_options(p_ctx, options); - if (tunable_rsa_cert_file) - { -diff --git a/tunables.c b/tunables.c -index 93f85b1..78f2bcd 100644 ---- a/tunables.c -+++ b/tunables.c -@@ -66,6 +66,8 @@ int tunable_force_local_data_ssl; - int tunable_sslv2; - int tunable_sslv3; - int tunable_tlsv1; -+int tunable_tlsv1_1; -+int tunable_tlsv1_2; - int tunable_tilde_user_enable; - int tunable_force_anon_logins_ssl; - int tunable_force_anon_data_ssl; -@@ -209,7 +211,10 @@ tunables_load_defaults() - tunable_force_local_data_ssl = 1; - tunable_sslv2 = 0; - tunable_sslv3 = 0; -+ /* TLSv1 up to TLSv1.2 is enabled by default */ - tunable_tlsv1 = 1; -+ tunable_tlsv1_1 = 1; -+ tunable_tlsv1_2 = 1; - tunable_tilde_user_enable = 0; - tunable_force_anon_logins_ssl = 0; - tunable_force_anon_data_ssl = 0; -@@ -292,8 +297,8 @@ tunables_load_defaults() - install_str_setting(0, &tunable_dsa_cert_file); - install_str_setting(0, &tunable_dh_param_file); - install_str_setting(0, &tunable_ecdh_param_file); -- install_str_setting("AES128-SHA:DES-CBC3-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA", -- &tunable_ssl_ciphers); -+ install_str_setting("AES128-SHA:DES-CBC3-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384", -+ &tunable_ssl_ciphers); - install_str_setting(0, &tunable_rsa_private_key_file); - install_str_setting(0, &tunable_dsa_private_key_file); - install_str_setting(0, &tunable_ca_certs_file); -diff --git a/tunables.h b/tunables.h -index 3e2d40c..a466427 100644 ---- a/tunables.h -+++ b/tunables.h -@@ -67,6 +67,8 @@ extern int tunable_force_local_data_ssl; /* Require local data uses SSL */ - extern int tunable_sslv2; /* Allow SSLv2 */ - extern int tunable_sslv3; /* Allow SSLv3 */ - extern int tunable_tlsv1; /* Allow TLSv1 */ -+extern int tunable_tlsv1_1; /* Allow TLSv1.1 */ -+extern int tunable_tlsv1_2; /* Allow TLSv1.2 */ - extern int tunable_tilde_user_enable; /* Support e.g. ~chris */ - extern int tunable_force_anon_logins_ssl; /* Require anon logins use SSL */ - extern int tunable_force_anon_data_ssl; /* Require anon data uses SSL */ -diff --git a/vsftpd.conf.5 b/vsftpd.conf.5 -index cf1ae34..a3d569e 100644 ---- a/vsftpd.conf.5 -+++ b/vsftpd.conf.5 -@@ -506,7 +506,7 @@ Default: YES - Only applies if - .BR ssl_enable - is activated. If enabled, this option will permit SSL v2 protocol connections. --TLS v1 connections are preferred. -+TLS v1.2 connections are preferred. - - Default: NO - .TP -@@ -514,7 +514,7 @@ Default: NO - Only applies if - .BR ssl_enable - is activated. If enabled, this option will permit SSL v3 protocol connections. --TLS v1 connections are preferred. -+TLS v1.2 connections are preferred. - - Default: NO - .TP -@@ -522,7 +522,23 @@ Default: NO - Only applies if - .BR ssl_enable - is activated. If enabled, this option will permit TLS v1 protocol connections. --TLS v1 connections are preferred. -+TLS v1.2 connections are preferred. -+ -+Default: YES -+.TP -+.B ssl_tlsv1_1 -+Only applies if -+.BR ssl_enable -+is activated. If enabled, this option will permit TLS v1.1 protocol connections. -+TLS v1.2 connections are preferred. -+ -+Default: YES -+.TP -+.B ssl_tlsv1_2 -+Only applies if -+.BR ssl_enable -+is activated. If enabled, this option will permit TLS v1.2 protocol connections. -+TLS v1.2 connections are preferred. - - Default: YES - .TP -@@ -1044,7 +1060,7 @@ man page for further details. Note that restricting ciphers can be a useful - security precaution as it prevents malicious remote parties forcing a cipher - which they have found problems with. - --Default: DES-CBC3-SHA -+Default: AES128-SHA:DES-CBC3-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384 - .TP - .B user_config_dir - This powerful option allows the override of any config option specified in --- -2.14.4 - diff --git a/0042-When-handling-FEAT-command-check-ssl_tlsv1_1-and-ssl.patch b/0042-When-handling-FEAT-command-check-ssl_tlsv1_1-and-ssl.patch index 250a44c..1e14813 100644 --- a/0042-When-handling-FEAT-command-check-ssl_tlsv1_1-and-ssl.patch +++ b/0042-When-handling-FEAT-command-check-ssl_tlsv1_1-and-ssl.patch @@ -23,7 +23,7 @@ index 1212980..d024366 100644 vsf_cmdio_write_raw(p_sess, " AUTH SSL\r\n"); } - if (tunable_tlsv1) -+ if (tunable_tlsv1 || tunable_tlsv1_1 || tunable_tlsv1_2) ++ if (tunable_tlsv1 || tunable_tlsv1_1 || tunable_tlsv1_2 || tunable_tlsv1_3) { vsf_cmdio_write_raw(p_sess, " AUTH TLS\r\n"); } diff --git a/0043-Enable-only-TLSv1.2-by-default.patch b/0043-Enable-only-TLSv1.2-by-default.patch deleted file mode 100644 index eb157f8..0000000 --- a/0043-Enable-only-TLSv1.2-by-default.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 75c942c77aa575143c5b75637e64a925ad12641a Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Ond=C5=99ej=20Lyson=C4=9Bk?= -Date: Thu, 21 Dec 2017 16:38:40 +0100 -Subject: [PATCH 43/59] Enable only TLSv1.2 by default - -Disable TLSv1 and TLSv1.1 - enable only TLSv1.2 by default. ---- - tunables.c | 6 +++--- - vsftpd.conf.5 | 4 ++-- - 2 files changed, 5 insertions(+), 5 deletions(-) - -diff --git a/tunables.c b/tunables.c -index 354251c..9680528 100644 ---- a/tunables.c -+++ b/tunables.c -@@ -211,9 +211,9 @@ tunables_load_defaults() - tunable_force_local_data_ssl = 1; - tunable_sslv2 = 0; - tunable_sslv3 = 0; -- /* TLSv1 up to TLSv1.2 is enabled by default */ -- tunable_tlsv1 = 1; -- tunable_tlsv1_1 = 1; -+ tunable_tlsv1 = 0; -+ tunable_tlsv1_1 = 0; -+ /* Only TLSv1.2 is enabled by default */ - tunable_tlsv1_2 = 1; - tunable_tilde_user_enable = 0; - tunable_force_anon_logins_ssl = 0; -diff --git a/vsftpd.conf.5 b/vsftpd.conf.5 -index 2a7662e..df14027 100644 ---- a/vsftpd.conf.5 -+++ b/vsftpd.conf.5 -@@ -539,7 +539,7 @@ Only applies if - is activated. If enabled, this option will permit TLS v1 protocol connections. - TLS v1.2 connections are preferred. - --Default: YES -+Default: NO - .TP - .B ssl_tlsv1_1 - Only applies if -@@ -547,7 +547,7 @@ Only applies if - is activated. If enabled, this option will permit TLS v1.1 protocol connections. - TLS v1.2 connections are preferred. - --Default: YES -+Default: NO - .TP - .B ssl_tlsv1_2 - Only applies if --- -2.14.4 - diff --git a/vsftpd.spec b/vsftpd.spec index 397535d..668b321 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -2,7 +2,7 @@ Name: vsftpd Version: 3.0.5 -Release: 7%{?dist} +Release: 8%{?dist} Summary: Very Secure Ftp Daemon # OpenSSL link exception @@ -61,7 +61,6 @@ Patch29: 0029-Fix-segfault-in-config-file-parser.patch Patch30: 0030-Fix-logging-into-syslog-when-enabled-in-config.patch Patch31: 0031-Fix-question-mark-wildcard-withing-a-file-name.patch Patch32: 0032-Propagate-errors-from-nfs-with-quota-to-client.patch -#Patch33: 0033-Introduce-TLSv1.1-and-TLSv1.2-options.patch Patch34: 0034-Turn-off-seccomp-sandbox-because-it-is-too-strict.patch Patch36: 0036-Redefine-VSFTP_COMMAND_FD-to-1.patch Patch37: 0037-Document-the-relationship-of-text_userdb_names-and-c.patch @@ -69,8 +68,7 @@ Patch38: 0038-Document-allow_writeable_chroot-in-the-man-page.patch Patch39: 0039-Improve-documentation-of-ASCII-mode-in-the-man-page.patch Patch40: 0040-Use-system-wide-crypto-policy.patch Patch41: 0041-Document-the-new-default-for-ssl_ciphers-in-the-man-.patch -#Patch42: 0042-When-handling-FEAT-command-check-ssl_tlsv1_1-and-ssl.patch -#Patch43: 0043-Enable-only-TLSv1.2-by-default.patch +Patch42: 0042-When-handling-FEAT-command-check-ssl_tlsv1_1-and-ssl.patch Patch44: 0044-Disable-anonymous_enable-in-default-config-file.patch Patch45: 0045-Expand-explanation-of-ascii_-options-behaviour-in-ma.patch Patch46: 0046-vsftpd.conf-Refer-to-the-man-page-regarding-the-asci.patch @@ -170,6 +168,9 @@ mkdir -p $RPM_BUILD_ROOT/%{_var}/ftp/pub %{_var}/ftp %changelog +* Mon Aug 19 2024 Tomas Korbar - 3.0.5-8 +- Fix FEAT command to list AUTH TLS when TLSv1.3 is enabled + * Sat Jul 20 2024 Fedora Release Engineering - 3.0.5-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From 3c842e7696eeb3786e7f97d365a66928b0f5dc0a Mon Sep 17 00:00:00 2001 From: Ondrej Mejzlik Date: Mon, 14 Oct 2024 10:28:43 +0200 Subject: [PATCH 33/40] Update plans and gating --- gating.yaml | 13 +++++------ plans.fmf | 47 ++++++++++++++++++++++++++++++++++++++++ plans/public.fmf | 6 ----- plans/tier1-internal.fmf | 12 ---------- 4 files changed, 53 insertions(+), 25 deletions(-) create mode 100644 plans.fmf delete mode 100644 plans/public.fmf delete mode 100644 plans/tier1-internal.fmf diff --git a/gating.yaml b/gating.yaml index de5c323..9b2646f 100644 --- a/gating.yaml +++ b/gating.yaml @@ -4,8 +4,8 @@ product_versions: decision_context: bodhi_update_push_testing subject_type: koji_build rules: - - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/public.functional} - + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional} + #Rawhide --- !Policy product_versions: @@ -13,15 +13,14 @@ product_versions: decision_context: bodhi_update_push_stable subject_type: koji_build rules: - - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/public.functional} - + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional} + #gating rhel --- !Policy product_versions: - rhel-* decision_context: osci_compose_gate rules: - - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional} - - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tedude.validation} + - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/tier1-public.functional} - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/tier1-internal.functional} - - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/public.functional} + diff --git a/plans.fmf b/plans.fmf new file mode 100644 index 0000000..a2a8046 --- /dev/null +++ b/plans.fmf @@ -0,0 +1,47 @@ +/tier1-internal: + plan: + import: + url: https://src.fedoraproject.org/tests/vsftpd.git + name: /plans/tier1/internal + adjust: + enabled: false + when: distro == centos-stream, fedora + because: They don't have access to internal repos. + +/tier1-public: + plan: + import: + url: https://src.fedoraproject.org/tests/vsftpd.git + name: /plans/tier1/public + +/tier2-tier3-internal: + plan: + import: + url: https://src.fedoraproject.org/tests/vsftpd.git + name: /plans/tier2-tier3/internal + adjust: + enabled: false + when: distro == centos-stream, fedora + because: They don't have access to internal repos. + +/tier2-tier3-public: + plan: + import: + url: https://src.fedoraproject.org/tests/vsftpd.git + name: /plans/tier2-tier3/public + +/others-internal: + plan: + import: + url: https://src.fedoraproject.org/tests/vsftpd.git + name: /plans/others/internal + adjust: + enabled: false + when: distro == centos-stream, fedora + because: They don't have access to internal repos. + +/others-public: + plan: + import: + url: https://src.fedoraproject.org/tests/vsftpd.git + name: /plans/others/public diff --git a/plans/public.fmf b/plans/public.fmf deleted file mode 100644 index 95682f5..0000000 --- a/plans/public.fmf +++ /dev/null @@ -1,6 +0,0 @@ -summary: Test plan with all Fedora tests -discover: - how: fmf - url: https://src.fedoraproject.org/tests/vsftpd.git -execute: - how: tmt diff --git a/plans/tier1-internal.fmf b/plans/tier1-internal.fmf deleted file mode 100644 index d1dd032..0000000 --- a/plans/tier1-internal.fmf +++ /dev/null @@ -1,12 +0,0 @@ -summary: CI plan, picks internal Tier1 tests, runs in beakerlib. -discover: - - name: rhel - how: fmf - filter: 'tier: 1' - url: git://pkgs.devel.redhat.com/tests/vsftpd -execute: - how: tmt -adjust: - enabled: false - when: distro == centos-stream, fedora - because: They don't have access to internal repos. From 3c9948ba72339fa187099c3f5cfe1208d380b99c Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 19 Jan 2025 14:38:47 +0000 Subject: [PATCH 34/40] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- vsftpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/vsftpd.spec b/vsftpd.spec index 668b321..8147c6c 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -2,7 +2,7 @@ Name: vsftpd Version: 3.0.5 -Release: 8%{?dist} +Release: 9%{?dist} Summary: Very Secure Ftp Daemon # OpenSSL link exception @@ -168,6 +168,9 @@ mkdir -p $RPM_BUILD_ROOT/%{_var}/ftp/pub %{_var}/ftp %changelog +* Sun Jan 19 2025 Fedora Release Engineering - 3.0.5-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Mon Aug 19 2024 Tomas Korbar - 3.0.5-8 - Fix FEAT command to list AUTH TLS when TLSv1.3 is enabled From c31087744900967ff4d572706a296bf6c8c4a68e Mon Sep 17 00:00:00 2001 From: Stepan Broz Date: Fri, 24 Jan 2025 12:47:37 +0100 Subject: [PATCH 35/40] Correct the definition of setup_bio_callbacks() in ssl.c. --- ...nition-of-setup_bio_callbacks-in-ssl.patch | 25 +++++++++++++++++++ vsftpd.spec | 6 ++++- 2 files changed, 30 insertions(+), 1 deletion(-) create mode 100644 0076-Correct-the-definition-of-setup_bio_callbacks-in-ssl.patch diff --git a/0076-Correct-the-definition-of-setup_bio_callbacks-in-ssl.patch b/0076-Correct-the-definition-of-setup_bio_callbacks-in-ssl.patch new file mode 100644 index 0000000..4fb8420 --- /dev/null +++ b/0076-Correct-the-definition-of-setup_bio_callbacks-in-ssl.patch @@ -0,0 +1,25 @@ +From f3a745be207831ebd07add16e66ac2b43a743dc1 Mon Sep 17 00:00:00 2001 +From: rpm-build +Date: Fri, 24 Jan 2025 11:42:39 +0100 +Subject: [PATCH] Correct the definition of setup_bio_callbacks() in ssl.c + +--- + ssl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/ssl.c b/ssl.c +index e518097..02ed489 100644 +--- a/ssl.c ++++ b/ssl.c +@@ -36,7 +36,7 @@ + static char* get_ssl_error(); + static SSL* get_ssl(struct vsf_session* p_sess, int fd); + static int ssl_session_init(struct vsf_session* p_sess); +-static void setup_bio_callbacks(); ++static void setup_bio_callbacks(SSL* p_ssl); + static long bio_callback( + BIO* p_bio, int oper, const char* p_arg, size_t len, int argi, long argl, int ret, size_t *processed); + static int ssl_verify_callback(int verify_ok, X509_STORE_CTX* p_ctx); +-- +2.48.1 + diff --git a/vsftpd.spec b/vsftpd.spec index 8147c6c..c60435d 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -2,7 +2,7 @@ Name: vsftpd Version: 3.0.5 -Release: 9%{?dist} +Release: 10%{?dist} Summary: Very Secure Ftp Daemon # OpenSSL link exception @@ -99,6 +99,7 @@ Patch72: vsftpd-3.0.5-replace-old-network-addr-functions.patch Patch73: vsftpd-3.0.5-replace-deprecated-openssl-functions.patch Patch74: vsftpd-3.0.5-add-option-for-tlsv1.3-ciphersuites.patch Patch75: vsftpd-3.0.5-use-old-tlsv-options.patch +Patch76: 0076-Correct-the-definition-of-setup_bio_callbacks-in-ssl.patch %description vsftpd is a Very Secure FTP daemon. It was written completely from @@ -168,6 +169,9 @@ mkdir -p $RPM_BUILD_ROOT/%{_var}/ftp/pub %{_var}/ftp %changelog +* Fri Jan 24 2025 Stepan Broz - 3.0.5-10 +- Correct the definition of setup_bio_callbacks() in ssl.c + * Sun Jan 19 2025 Fedora Release Engineering - 3.0.5-9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From be372735b51e078f9eefc212382bd8a6ae477edb Mon Sep 17 00:00:00 2001 From: Tomas Korbar Date: Tue, 15 Apr 2025 13:26:28 +0200 Subject: [PATCH 36/40] Move executable to bindir --- vsftpd.spec | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/vsftpd.spec b/vsftpd.spec index c60435d..74e6b37 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -2,7 +2,7 @@ Name: vsftpd Version: 3.0.5 -Release: 10%{?dist} +Release: 11%{?dist} Summary: Very Secure Ftp Daemon # OpenSSL link exception @@ -119,13 +119,13 @@ cp %{SOURCE1} . LINK="-pie -lssl $RPM_LD_FLAGS" %{?_smp_mflags} %install -mkdir -p $RPM_BUILD_ROOT%{_sbindir} +mkdir -p $RPM_BUILD_ROOT%{_bindir} mkdir -p $RPM_BUILD_ROOT%{_sysconfdir} mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/{vsftpd,pam.d,logrotate.d} mkdir -p $RPM_BUILD_ROOT%{_mandir}/man{5,8} mkdir -p $RPM_BUILD_ROOT%{_unitdir} mkdir -p $RPM_BUILD_ROOT%{_generatorsdir} -install -m 755 vsftpd $RPM_BUILD_ROOT%{_sbindir}/vsftpd +install -m 755 vsftpd $RPM_BUILD_ROOT%{_bindir}/vsftpd install -m 600 vsftpd.conf $RPM_BUILD_ROOT%{_sysconfdir}/vsftpd/vsftpd.conf install -m 644 vsftpd.conf.5 $RPM_BUILD_ROOT/%{_mandir}/man5/ install -m 644 vsftpd.8 $RPM_BUILD_ROOT/%{_mandir}/man8/ @@ -154,7 +154,7 @@ mkdir -p $RPM_BUILD_ROOT/%{_var}/ftp/pub %files %{_unitdir}/* %{_generatorsdir}/* -%{_sbindir}/vsftpd +%{_bindir}/vsftpd %dir %{_sysconfdir}/vsftpd %{_sysconfdir}/vsftpd/vsftpd_conf_migrate.sh %config(noreplace) %{_sysconfdir}/vsftpd/ftpusers @@ -169,6 +169,9 @@ mkdir -p $RPM_BUILD_ROOT/%{_var}/ftp/pub %{_var}/ftp %changelog +* Tue Apr 15 2025 Tomas Korbar - 3.0.5-11 +- Move executable to bindir + * Fri Jan 24 2025 Stepan Broz - 3.0.5-10 - Correct the definition of setup_bio_callbacks() in ssl.c From 09634b741a0eea01a67484408ed979d159bc269f Mon Sep 17 00:00:00 2001 From: Ondrej Mejzlik Date: Wed, 18 Jun 2025 20:46:58 +0200 Subject: [PATCH 37/40] Testing moves to RH gitlab centos-stream space --- plans.fmf | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/plans.fmf b/plans.fmf index a2a8046..900f2e5 100644 --- a/plans.fmf +++ b/plans.fmf @@ -1,7 +1,7 @@ /tier1-internal: plan: import: - url: https://src.fedoraproject.org/tests/vsftpd.git + url: https://gitlab.com/redhat/centos-stream/tests/vsftpd.git name: /plans/tier1/internal adjust: enabled: false @@ -11,13 +11,13 @@ /tier1-public: plan: import: - url: https://src.fedoraproject.org/tests/vsftpd.git + url: https://gitlab.com/redhat/centos-stream/tests/vsftpd.git name: /plans/tier1/public /tier2-tier3-internal: plan: import: - url: https://src.fedoraproject.org/tests/vsftpd.git + url: https://gitlab.com/redhat/centos-stream/tests/vsftpd.git name: /plans/tier2-tier3/internal adjust: enabled: false @@ -27,13 +27,13 @@ /tier2-tier3-public: plan: import: - url: https://src.fedoraproject.org/tests/vsftpd.git + url: https://gitlab.com/redhat/centos-stream/tests/vsftpd.git name: /plans/tier2-tier3/public /others-internal: plan: import: - url: https://src.fedoraproject.org/tests/vsftpd.git + url: https://gitlab.com/redhat/centos-stream/tests/vsftpd.git name: /plans/others/internal adjust: enabled: false @@ -43,5 +43,5 @@ /others-public: plan: import: - url: https://src.fedoraproject.org/tests/vsftpd.git + url: https://gitlab.com/redhat/centos-stream/tests/vsftpd.git name: /plans/others/public From 42db2f076b51cb83a54a5b422fe6ea8e5672250f Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 20:14:23 +0000 Subject: [PATCH 38/40] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- vsftpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/vsftpd.spec b/vsftpd.spec index 74e6b37..dbea734 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -2,7 +2,7 @@ Name: vsftpd Version: 3.0.5 -Release: 11%{?dist} +Release: 12%{?dist} Summary: Very Secure Ftp Daemon # OpenSSL link exception @@ -169,6 +169,9 @@ mkdir -p $RPM_BUILD_ROOT/%{_var}/ftp/pub %{_var}/ftp %changelog +* Fri Jul 25 2025 Fedora Release Engineering - 3.0.5-12 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Tue Apr 15 2025 Tomas Korbar - 3.0.5-11 - Move executable to bindir From 67e7d68dac924c323dd54546cc35435d9828d810 Mon Sep 17 00:00:00 2001 From: Fedor Vorobev Date: Wed, 17 Dec 2025 14:11:37 +0100 Subject: [PATCH 39/40] Add a tmpfiles.d config. (image mode support) --- vsftpd-tmpfiles.conf | 2 ++ vsftpd.spec | 8 +++++++- 2 files changed, 9 insertions(+), 1 deletion(-) create mode 100644 vsftpd-tmpfiles.conf diff --git a/vsftpd-tmpfiles.conf b/vsftpd-tmpfiles.conf new file mode 100644 index 0000000..f1a385c --- /dev/null +++ b/vsftpd-tmpfiles.conf @@ -0,0 +1,2 @@ +d /var/ftp 0755 root root - +d /var/ftp/pub 0755 root root - diff --git a/vsftpd.spec b/vsftpd.spec index dbea734..d06c02d 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -2,7 +2,7 @@ Name: vsftpd Version: 3.0.5 -Release: 12%{?dist} +Release: 13%{?dist} Summary: Very Secure Ftp Daemon # OpenSSL link exception @@ -18,6 +18,7 @@ Source7: vsftpd.service Source8: vsftpd@.service Source9: vsftpd.target Source10: vsftpd-generator +Source11: vsftpd-tmpfiles.conf BuildRequires: make BuildRequires: pam-devel @@ -138,6 +139,7 @@ install -m 644 %{SOURCE7} $RPM_BUILD_ROOT%{_unitdir} install -m 644 %{SOURCE8} $RPM_BUILD_ROOT%{_unitdir} install -m 644 %{SOURCE9} $RPM_BUILD_ROOT%{_unitdir} install -m 755 %{SOURCE10} $RPM_BUILD_ROOT%{_generatorsdir} +install -Dpm 644 %{SOURCE11} $RPM_BUILD_ROOT%{_tmpfilesdir}/vsftpd.conf mkdir -p $RPM_BUILD_ROOT/%{_var}/ftp/pub @@ -167,8 +169,12 @@ mkdir -p $RPM_BUILD_ROOT/%{_var}/ftp/pub %{_mandir}/man5/vsftpd.conf.* %{_mandir}/man8/vsftpd.* %{_var}/ftp +%{_tmpfilesdir}/vsftpd.conf %changelog +* Thu Dec 18 2025 Fedor Vorobev - 3.0.5-13 +- Add a tmpfiles.d config. (image mode support) + * Fri Jul 25 2025 Fedora Release Engineering - 3.0.5-12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From 2ed5ba6e77f1c3e365fb4b0028945f762c456131 Mon Sep 17 00:00:00 2001 From: Tomas Korbar Date: Wed, 14 Jan 2026 15:58:44 +0100 Subject: [PATCH 40/40] Resolve CVE-2025-14242 --- ...dd-support-for-square-brackets-in-ls.patch | 19 +++++++------------ vsftpd.spec | 5 ++++- 2 files changed, 11 insertions(+), 13 deletions(-) diff --git a/0014-Add-support-for-square-brackets-in-ls.patch b/0014-Add-support-for-square-brackets-in-ls.patch index 27f5374..5035675 100644 --- a/0014-Add-support-for-square-brackets-in-ls.patch +++ b/0014-Add-support-for-square-brackets-in-ls.patch @@ -1,14 +1,11 @@ -From ba0520650ae7f9f63e48ba9fb3a94297aebe2d0c Mon Sep 17 00:00:00 2001 -From: Martin Sehnoutka -Date: Wed, 7 Sep 2016 14:22:21 +0200 -Subject: [PATCH 14/59] Add support for square brackets in ls. +commit de556b2643b5da622f501b435740c651b9f82554 +Author: Tomas Korbar +Date: Mon Dec 15 02:00:00 2025 +0200 ---- - ls.c | 222 +++++++++++++++++++++++++++++++++++++++++++++---------------------- - 1 file changed, 150 insertions(+), 72 deletions(-) + Add support for square brackets in ls. diff --git a/ls.c b/ls.c -index 616b2d9..b840136 100644 +index 616b2d9..ab69af9 100644 --- a/ls.c +++ b/ls.c @@ -246,7 +246,7 @@ vsf_filename_passes_filter(const struct mystr* p_filename_str, @@ -191,7 +188,7 @@ index 616b2d9..b840136 100644 - if (vsf_filename_passes_filter(&name_remain_str, &new_filter_str, - iters)) + unsigned int cur_pos; -+ char stch, ench; ++ unsigned char stch, ench; + const char *p_brace; + + str_split_char(&filter_remain_str, &temp_str, ']'); @@ -216,7 +213,7 @@ index 616b2d9..b840136 100644 + cur_pos++; + } + // expand char[s] -+ for (;stch <= ench && !str_isempty(&brace_list_str); stch++) ++ for (;stch <= ench && !str_isempty(&brace_list_str) && stch != 0; stch++) + { + str_empty(&new_filter_str); + if (!matched) @@ -272,6 +269,4 @@ index 616b2d9..b840136 100644 } /* Any incoming string left means no match unless we ended on the correct * type of wildcard. --- -2.14.4 diff --git a/vsftpd.spec b/vsftpd.spec index d06c02d..d8e0a58 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -2,7 +2,7 @@ Name: vsftpd Version: 3.0.5 -Release: 13%{?dist} +Release: 14%{?dist} Summary: Very Secure Ftp Daemon # OpenSSL link exception @@ -172,6 +172,9 @@ mkdir -p $RPM_BUILD_ROOT/%{_var}/ftp/pub %{_tmpfilesdir}/vsftpd.conf %changelog +* Wed Jan 14 2026 Tomas Korbar - 3.0.5-14 +- Resolve CVE-2025-14242 + * Thu Dec 18 2025 Fedor Vorobev - 3.0.5-13 - Add a tmpfiles.d config. (image mode support)