Subject: onnet ftp client problem with beroftpd 1.3.3

From: Don Badrak <[email-masked]>
Date: Tue, 2 Mar 1999 18:41:56 -0500 (EST)

Due to the CERT advisories about the ftp exploits, I decided to upgrade
from wu-ftpd 2.4.2-b18 to BeroFTPD 1.3.3 (mostly for the ease of
configuration with autoconf).

I have been using it for quite a while, and I'm please with it.  However,
not that actual users are using it (those who faint at the sight of a
command line), I've run into some weirdness.

[hopefully I won't get blasted for discussing a derivative work from
wu-ftpd]

First time through I built it with the --enable-internal-ls and
--enable-paranoid.  This caused *me* problems with NcFTP, which no longer
would do filename completion or multiple recursive gets (mget -R).

I tracked that down to NcFTP sending a LIST -d command.  After
recompiling to not use the internal ls (nor paranoid, due to the need to
do chmod, nor identd, becuase it's not really useful anyway and slowed
down connections through our firewall), NcFTP worked fine (as it did under
wu-ftpd 2.4.2b18).

However, we use the FTP software OnNet FTP graphical client for a large
portion of our users.  Some use WS_FTP, and some use the Exceed client
(both these work fine).

OnNet uses "LIST -lL".  I've been able to track down as far in the
BeroFTPD code that it is assuming whatever is after the space is a file,
and it tries to do a stat() of it (I was watching the system while this
happened and saw stat("-lL") .. file not found).

This problem is present regardless of operating system.  I've seen
it under Solaris 2.5.1 and IRIX 6.5.

Has anyone else run into this yet?

Don
-- 
Don Badrak <[email-masked]>              301.457.8263 work
Telecommunications Office		     301.457.4438 fax
U.S. Bureau of the Census
Suitland MD, USA

---

From: Bernhard Rosenkraenzer <[email-masked]>
Date: Wed, 3 Mar 1999 19:56:03 +0100 (CET)

On Tue, 2 Mar 1999, Don Badrak wrote:

> I tracked that down to NcFTP sending a LIST -d command.

True - LIST -d and -p are currently not implemented in the internal ls;
this will change some time soon.

> BeroFTPD code that it is assuming whatever is after the space is a file,

Not quite.
If you're using the internal ls,
LIST something
results in a call to ls(something,0), where "filenames" beginning with a
"-" are recognized. Currently, the options -l, -a and -R are supported,
all other options (such as -L) are silently ignored.
This shouldn't hurt anything (OnNet probably can't determine the size of
symlinks if -L is ignored, but that's all).

If you aren't using the internal ls, BeroFTPD calls the external ls
command, passing the "filename" (including options) as options, which is
exactly the same thing base wu-ftpd does.
Did you make any changes to the external ls command in the directory
structure?

Where can I download OnNet to run some tests myself? (I hope it runs in
wine - I don't have windoze.)

LLaP
bero

-- 
Windows 98 supports real multitasking - it can boot and crash simultaneously.
***
Anyone sending unwanted advertising e-mail to this address will be charged
$25 for network traffic and computing time. By extracting my address from
this message or its header, you agree to these terms.

---

From: Don Badrak <[email-masked]>
Date: Wed, 3 Mar 1999 15:54:30 -0500 (EST)

Bernhard,

> this will change some time soon.

I guess I could just make the -d work and be done with it and use
the internal ls.

> Did you make any changes to the external ls command in the directory

Nope, same stuff, no changes.  Both the /bin/ls (solaris, irix) and GNU
ls handle the -lL just fine.  While watching output from par
(irix equivalent of truss), I saw this:

20474mS                 : END-read(0, "LIST -lL\r\n", 4096) = 10
20474mS                 : alarm(0) = 899
20474mS                 : time() = 920407755
20474mS                 : getpid() = 562696, ppid=220
20474mS                 : write(3, "<30>Mar  2 20:49:15 ftpd[56269", 42) = 42
20474mS                 : time() = 920407755
20474mS                 : getuid() = 0, euid=5000
20474mS                 : setreuid(-1, 0) OK
20474mS                 : open(".", O_RDONLY, 02001624260) = 8
20474mS                 : setreuid(-1, 5000) OK
20474mS                 : setreuid(-1, 0) OK
20474mS                 : lstat("-lL", 0x7fff01d8) errno = 2 (No such file or directory)

I don't know if this has anything to do with it.

Shoot.  I thought I described what the result was when using external-ls with
OnNet's client.  You see the home directory name.  You see all the folders under
that directory, but no filenames (all blank).  The filename box (top box is
directories, bottom is filenames) is also all blank, even though there are plenty
of files there.

I'm thinking that the server may be sending the data back to the client with some
extraneous info and the client doesn't like it.

> wine - I don't have windoze.)

Ooh, I don't know.  We have it on some PCs here.  You might be able to get
an evaulation from http://www.netmanage.com/products/onnethost/.  However,
I don't know if it will run under wine.
 
Don
---

---

From: Don Badrak <[email-masked]>
Date: Wed, 3 Mar 1999 16:26:05 -0500 (EST)

Bernhard,

(replying to my own post.  I love that :-).

First, thanks for releasing a new version to handle the problem I ran into
with a specific client so quickly.  I now have a nice little "commercial
support" gem to shove at the bozos here who don't like open source ;-)

> > Did you make any changes to the external ls command in the directory

[ chop ]

> extraneous info and the client doesn't like it.

I did more digging.  What it was doing was sending the "/bin/ls -lgA", but
the client was expecting output from "/bin/ls -lA".  Or at least expecting
a username in front of the group.  This would explain why the directories
were all blank.  It used field 9, and there were only 8 fields.

It was doing this because the SVR4 macro was not defined.  So I defined it
in CFLAGS when I ran configure.  I've attached a small patch to ftpd.c to allow
the SGI to get picked up for the "/bin/ls -lA".

Also, to get the proper parameters for ps (in src/ftpcount.c), I had to also
define OLD_PS.  You may want to consider putting these checks into autoconf
if you find an SGI.

Again, thanks a ton for the quick response.

--- src/ftpd.c.orig     Wed Mar  3 16:01:59 1999
+++ src/ftpd.c  Wed Mar  3 16:08:51 1999
@@ -1147,7 +1147,7 @@
           }
     } else {
 #if defined(SVR4) || defined(ISC) || defined(sinix)
-#if defined(AIX) || defined(SOLARIS2)
+#if defined(AIX) || defined(SOLARIS2) || defined(__sgi)
           strcpy(ls_long,"/bin/ls -lA");
 #else
           strcpy(ls_long,"/bin/ls -la");

Don
---