Subject: [VR9] More enhancements and bug fixes for beta-18

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 15 Oct 1998 07:42:29 -0400 (EDT)

The VR9 patch set for WU-FTPD 2.4.2 (beta-18) is now available.

This set adds additional features requested over the years by the user
community and includes a number of bug fixes for both the base (beta-18)
release and earlier VR patch sets.

These are available as both patches and pre-patched tarballs at my ftp
site:

  ftp://ftp.vr.net/pub/wu-ftpd/

If you take just the patch files, please remember: they are cumulative.
you cannot apply fixes from one set without earlier sets already having
been applied.  The first set for BETA-18 is VR3; VR1 and VR2 were for
BETA-17 only.

Several pre-compiled binaries for VR9 are also available.  These include:

  Solaris/SunOS/Sparc
  -------------
  sunos41x-ftpbin.tar.gz  (FTP support executables, ls etc.)
  FTP242b18.wu-ftpd.2.4.2-beta18-VR9.SPARC.ULTRASparc.2.5.1.2.5.pkg.tar.Z
  FTP242b18.wu-ftpd.2.4.2-beta18-VR9.SPARC.ULTRASparc.2.5.1.2.5.pkg.tar.gz
  wu-ftpd-2.4.2-beta-18-vr9-SunOS-4.1.3_U1.tar.gz
  wu-ftpd-2.4.2-beta-18-vr9-SunOS-5.6.tar.gz

  SGI/IRIX
  --------
  irix62-ftpbin.tar.gz  (FTP support executables, ls etc.)
  wu-ftpd-2.4.2-beta-18-vr9.irix62.bin.tar.gz

  IBM/AIX
  -------
  wu-ftpd-2.4.2-beta-18-vr9-AIX.3.2.5.tar.gz

  Intel/BSDI
  ----------
  wu-ftpd-2.4.2-beta-18-vr9-BSDI-2.1.tar.gz
  wu-ftpd-2.4.2-beta-18-vr9-BSDI-3.1.tar.gz

  Intel/Linux
  -----------
  wu-ftpd-2.4.2-beta-18-vr9.linux.i386.tar.gz

Thanks to all those who helped with debugging and built the pre-compiled
binaries.

This is a list of fixes to BETA 18 with VR8 applied from [email-masked]
---------------------------------------------------------------------------
realpath() needs root permissions to prevent errors under certain security
models.  Noted by [email-masked] running VR7.

xferlog does not indicate success or failure.  From a request on the
mailing list from [email-masked] on July 2, 1997.  Patch from
[email-masked] submitted privately on September 27, 1998.

Allow access control commands to use address/netmask or CIDR.  This closes
Stan's TODO item 20.  Patch submitted privately from [email-masked]
on September 15, 1998.  Also corrected a hostname matching bug reported by
[email-masked] on August 18, 1995.  The change also includes
[email-masked] request of December 10, 1996, to allow host names
instead of IP numbers and a request from October 13, 1997, by
[email-masked]. to reduce the number of DNS lookups needed for
virtual host support.

[email-masked] reported on October 2, 1998, his changes for DEC Unix
with C2 security were incorrect.  He has confirmed these changes on OSF1
V3.2 41 alpha.

Support regular expressions in noretrieve.  From a patch submitted to the
mailing list by [email-masked] on Apr 22, 1997.

Add 'allow-retrieve' to allow retrieval of files which would be denied by
earlier 'noretrieve' clauses.  From a request sent to the mailing list by
[email-masked] on Oct 7, 1997.

[email-masked] reported on October 5, 1998, the extensions
for 'absolute' or 'relative' pathname comparison in earlier VR patches
were not case-insensitive.  They should have been.

Ayamura Kikuchi <[email-masked]> submmitted the following patch on
September 28, 1998.  It adds support for OPIE (One-time Passwords In
Everything).  You will need OPIE libraries installed to use this.  OPIE is
available from ftp://ftp.inner.net/pub/opie/opie-2.32.tar.gz This feature
was originally submitted by [email-masked] on March 21, 1997, for
use with SunOS 4.1 with C2 security.  Other features of that patch have
not been included.

Support globbing/wildcards throughout ftpaccess file for file and
directory comparisons.

[email-masked] spotted another discrepancy between the ANSI
and K&R funciton definitions.

[email-masked] reports errors on AIX with malloc.
[email-masked] confirms a problem in send_data().  This patch is
experimental against VR8 to attempt to correct the problem.  I'm working
on the supposition that the problem is data alignment; the 'blksize' is
off_t and malloc() wants a size_t.  I've added a conversion step which
should eliminate the problem.

Added regular expression matching to deny-mail.

Noted a number of places where strcmp was used but strcasecmp would be
more appropriate.  This makes the ftpaccess file easier to maintain since
small typographical errors won't matter so much any more.

[email-masked] reports dead code left laying arround from
debugging VR8.  Deleted it.

Changed my mind.  Regular expressions don't work well unless there's some
way to tell they're there.  Backed out all regular expression matching for
file/path names in the ftpaccess file.  This issue will be re-evaluated in
a later VR patch set.  Globbing still works everywhere it's reasonable to
use it.

Cleaned up a few large, confusing 'if' statements in the code.

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Patrick Feisthammel <[email-masked]>
Date: Fri, 23 Oct 1998 14:23:43 +0200 (MEST)

-----BEGIN PGP SIGNED MESSAGE-----

Hi!

I just tried to update to VR9 because of the file globbing/wildcards.

But I could not manage wu-ftpd to match my upload-entries in ftpaccess.
Further investigation showed me, that they work up to VR5, but stop
working in VR6 (and do not work in VR8 and VR9)

My upload entry under investigation looks like:

upload /var/ftp_cug/aaa  /pub/qqq yes  user1  group1 0660 dirs

The /var directory is realy a link to /part1/var (do not know if
important)

I want to use wildcards to set the permission in subdirectories too,
but need VR8 for that. But VR8 does not recognize my upload
statements...

Any help appreciated. (I build under linux without any additional or
changed compile optiones)

Cheers,
Patrick
 
- ---
Only digitaly signed mails are authentic.        See http://www.pgpi.com/
Marwin Consulting, Technoparkstr. 1, CH-8005 Zuerich  Tel: +41 1 445 3666
Patrick Feisthammel ([email-masked])          Fax: +41 1 445 3663

---

From: Gregory A Lundberg <[email-masked]>
Date: Fri, 23 Oct 1998 08:29:58 -0400 (EDT)

> The /var directory is realy a link to /part1/var (do not know if

It is.  If it's a symlink.  The VR patches use realpath() extensively.  So
if /var is a symlink you need to change to use the target.

--

---

From: Patrick Feisthammel <[email-masked]>
Date: Fri, 23 Oct 1998 18:11:19 +0200 (MEST)

-----BEGIN PGP SIGNED MESSAGE-----

Hi!

> if /var is a symlink you need to change to use the target.

Thanks for your tip. But it did not help. I changed the homedir in the
passwd file for that user:

  user1:x:4444:333:bla:/part1/var/ftp_cug/aaa/./pub:/bin/false

and in the ftpaccess file:

  upload /part1/var/ftp_cug/aaa /pub/qqq/* yes user1 group1 0660 dirs

it does not help.

Even a 

  upload /part1/var/ftp_cug/aaa  * no

does no effect with VR9, but does with VR5 ...

Any other suggestions?

Cheers, Patrick
 
- ---

---

From: Gregory A Lundberg <[email-masked]>
Date: Fri, 23 Oct 1998 15:47:37 -0400 (EDT)

>   upload /part1/var/ftp_cug/aaa /pub/qqq/* yes user1 group1 0660 dirs

upload /part1/var/ftp_cug/aaa/pub /pub/qqq/* yes user1 group1 0600 dirs

--

---

From: Patrick Feisthammel <[email-masked]>
Date: Sat, 24 Oct 1998 11:30:03 +0200 (MEST)

-----BEGIN PGP SIGNED MESSAGE-----

Hi Gregory!

> upload /part1/var/ftp_cug/aaa/pub /pub/qqq/* yes user1 group1 0600 dirs

Thanks a lot! That was the fault. I summarize the points:

1. It has to be the _real_ path (/part1/var and not /var, if /var is a
symlink). Thanks Gregory! 

2. Also by Greogry: You have to include the 'home directory reltive to
the root directory' too. So if you have chroot_path/./pub you need
chroot_path/pub in the ftpaccess file.

3. Wildcards are not intuitive for me: 
  upload /ftp/aaa/pub /pub/qqq/* yes user1 group1 0600 dirs 0770
  sets the permissions for all files in subdirctories of qqq. 
  Files and directories in qqq are _not_ covered by this rule.

  upload /ftp/aaa/pub /pub/qqq   yes user1 group1 0660 dirs 0770
  this covers the files and directories in the qqq directory. 
  But not the files/directories in subdirectories in qqq.
 
  So to protect everything in a directory and below, you need two entries
  in ftpaccess.

I suggest the following modification for later (correlating to above
points):

1. call realpath() for the ftpaccess pathes too. This way one can
use symlinks. This is important if you want to modify the physical
locations without modifying the config files.

2. The 'home direcotry relative to the root directory' should be
independent from the ftpaccess settings. Changing the default starting
point after login has IMHO nothing to do with the access rights...

3. Clarify the doc. 

Cheers,
Patrick
- ---