Subject: RE: Patch for passive mode

From: Roger Hanke <[email-masked]>
Date: Thu, 7 May 1998 17:45:34 -0400

Andy,
 Here is Pedro's last passive mode patch 
I saw posted to the mailing list. This is the version
he had submitted to the official bug list.
Since then most people have been just making these same
changes below by hand to each new beta version
from what I could tell.
So as far as I knew this was still not in any beta version
including B16.

When you say the new 2.6.0 includes improved virtual
server support, I hope that means you have incorporated
Kent Landfields new virtual support that he had been adding
to each beta version for many of us?
	Thanx,
	Roger Hanke

>-----Original Message-----
>From:	Pedro Melo [SMTP:[email-masked]]
>Sent:	Wednesday, March 26, 1997 7:42 AM
>To:	[email-masked]
>Cc:	rah@lynxhub; [email-masked]
>Subject:	Patch for passive mode in Beta13
>
>Hi!
>
>Some time ago I made a patch for beta12 that allows you to restrict the
>port ranges used by passive mode ftp. 
>
>This is helpfull for people who dont want to open just a part of their port
>space in their firewall.
>
>So far, the pacth is compile time only. You cannot specify in the  config
>file the port range to use. You have to change the values of PASSIVE_BASE
>and PASSIVE_SPAN in the patched ftpd.c and recompile... For ex, if you want
>to open ports 4000 to 5000, use PASSIVE_BASE 4000 and PASSIVE_SPAN 1000
>
>Apply to the ftpd.c in the src directory...
>
>I've been working with this patch for a coupple of month now, no problems.
>
>*** ftpd.c.orig	Fri Mar 21 02:15:09 1997
>--- ftpd.c	Fri Mar 21 02:19:00 1997
>***************
>*** 394,399 ****
>--- 394,401 ----
>      struct sockaddr_in *virtual_ptr;
>  #endif
>  
>+     srandom(getpid());
>+ 
>  #ifdef AUX
>      setcompat(COMPAT_POSIX | COMPAT_BSDSETUGID);
>  #endif
>***************
>*** 3246,3251 ****
>--- 3248,3256 ----
>   * response by Jon Postel in a telephone conversation with Rick Adams on
>25
>   * Jan 89. */
>  
>+ #define PASSIVE_BASE 3000
>+ #define PASSIVE_SPAN 500
>+ 
>  void
>  #ifdef __STDC__
>  passive(void)
>***************
>*** 3253,3259 ****
>  passive()
>  #endif
>  {
>!     int len;
>      register char *p,
>       *a;
>  
>--- 3258,3264 ----
>  passive()
>  #endif
>  {
>!     int len, bind_error;
>      register char *p,
>       *a;
>  
>***************
>*** 3268,3281 ****
>          return;
>      }
>      pasv_addr = ctrl_addr;
>!     pasv_addr.sin_port = 0;
>      delay_signaling(); /* we can't allow any signals while euid==0: kinch
>*/
>      (void) seteuid((uid_t) 0);		/* XXX: not needed if >
>1024 */
>!     if (bind(pdata, (struct sockaddr *) &pasv_addr, sizeof(pasv_addr)) <
>0) {
>!         (void) seteuid((uid_t) pw->pw_uid);
>!         enable_signaling(); /* we can allow signals once again: kinch */
>!         goto pasv_error;
>      }
>      (void) seteuid((uid_t) pw->pw_uid);
>      enable_signaling(); /* we can allow signals once again: kinch */
>      len = sizeof(pasv_addr);
>--- 3273,3293 ----
>          return;
>      }
>      pasv_addr = ctrl_addr;
>! 
>      delay_signaling(); /* we can't allow any signals while euid==0: kinch
>*/
>      (void) seteuid((uid_t) 0);		/* XXX: not needed if >
>1024 */
>!     do {
>!         pasv_addr.sin_port = PASSIVE_BASE + random() % PASSIVE_SPAN;
>!         if (log_commands) syslog(LOG_DEBUG, "PASV trying %d",
>pasv_addr.sin_port);
>!         bind_error = bind(pdata, (struct sockaddr *) &pasv_addr,
>sizeof(pasv_addr));
>!     } while(errno==EADDRINUSE);
>!     if (bind_error < 0) {
>!               (void) seteuid((uid_t) pw->pw_uid);
>!               enable_signaling(); /* we can allow signals once again:
>kinch */
>!               goto pasv_error;
>      }
>+     if (log_commands) syslog(LOG_DEBUG, "PASV got %d",
>pasv_addr.sin_port);
>+ 
>      (void) seteuid((uid_t) pw->pw_uid);
>      enable_signaling(); /* we can allow signals once again: kinch */
>      len = sizeof(pasv_addr);
>--
>************** Pedro Melo ([email-masked]) BOFH ******************
>*   TELENET, Servicos de Telecomunicacoes, SA - Tel +351 1 3139190   *
>* finger [email-masked] or search key servers for PGP key *
>*           It's management's job to support the geniuses,           *
>*                      not to tell them what to do                   *
>**********************************************************************
>
>

---

From: [email-masked] (Andy Church)
Date: Thu, 07 May 1998 19:10:38 EDT

>he had submitted to the official bug list.

     Thanks; this (or something much like it) should appear in version
2.6.1.

>to each beta version for many of us?

     No; however, the virtual FTP support in 2.6.0 accomplishes the same
goals with more flexibility and easier transitions from existing setups.
(In fact, it's just my include-virtual patch for 2.4.2b16.)

  --Andy Church                  | If Bell Atlantic really is the heart
    [email-masked]       | of communication, then it desperately
    www.dragonfire.net/~achurch/ | needs a quadruple bypass.