flushwait update fix for FTP/SSL
Paul V Ford-Hutchinson <[email protected]> Thu, 29 Apr 2004 13:18:36 +0100
| Newsgroups | gmane.network.ftp.wuftpd.devel |
|---|---|
| Message-ID | <OFD2CF2C75.8400347E-ON80256E85.00414D31-80256E85.0043798E@uk.ibm.com> |
This is a multipart message in MIME format.
--=_alternative 0043739080256E85_=
Content-Type: text/plain; charset="US-ASCII"
Please apply this patch to the current (29th April 2004) snapshot for
ftpd.c
The earlier changes made to socket_flush_wait() cause the FTP/SSL code to
break.
flushwait is not desirable for the TLS record layer protocol.
can somebody (Wyllys?) check that the same fix isn't needed for the GSS
stuff?
--- ftpd.c Mon Apr 26 18:03:47 2004
+++ ftpd.c_updated Thu Apr 29 13:11:04 2004
@@ -633,6 +633,9 @@
int set;
int fd = fileno(file);
struct aclmember *entry;
+#if defined(USE_TLS)
+ static int flushwait_if_unprotected = TRUE;
+#endif /* USE_TLS */
if (first_time) {
entry = NULL;
@@ -655,7 +658,27 @@
}
}
first_time = FALSE;
+#if defined(USE_TLS)
+ flushwait_if_unprotected = flushwait;
+#endif /* USE_TLS */
}
+#if defined(USE_TLS)
+ /*
+ * don't do this flushing stuff on an SSL socket - it just won't work
+ * (currently - this routine is only caled on DATA connections)
+ * Need to check on a per connection basis, as the PROT command
+ * can change the protection of the data connection dynamically
+ */
+ if((SEC_DATA_MECHANISM_TLS == get_data_prot_mechanism()) &&
+ ('P' == get_data_prot_level()))
+ {
+ flushwait = FALSE;
+ }
+ else
+ {
+ flushwait = flushwait_if_unprotected;
+ }
+#endif /* USE_TLS */
if (flushwait) {
if (draconian_FILE != NULL)
shutdown(fd, 1);
Cheers,
Paul
--
Paul Ford-Hutchinson : eCommerce application security :
[email protected]
MPT-6, IBM , PO Box 31, Birmingham Rd, Warwick, CV34 5JL +44 (0)1926
462005
http://www.ford-hutchinson.com/~fh-1-pfh/ftps-ext.html
--=_alternative 0043739080256E85_=
Content-Type: text/html; charset="US-ASCII"
<br><font size=2 face="sans-serif">Please apply this patch to the current
(29th April 2004) snapshot for ftpd.c</font>
<br>
<br><font size=2 face="sans-serif">The earlier changes made to socket_flush_wait()
cause the FTP/SSL code to break.</font>
<br>
<br><font size=2 face="sans-serif">flushwait is not desirable for the TLS
record layer protocol. </font>
<br>
<br><font size=2 face="sans-serif">can somebody (Wyllys?) check that the
same fix isn't needed for the GSS stuff?</font>
<br>
<br>
<br><font size=2 face="Courier New">--- ftpd.c Mon
Apr 26 18:03:47 2004</font>
<br><font size=2 face="Courier New">+++ ftpd.c_updated
Thu Apr 29 13:11:04 2004</font>
<br><font size=2 face="Courier New">@@ -633,6 +633,9 @@</font>
<br><font size=2 face="Courier New"> int set;</font>
<br><font size=2 face="Courier New"> int fd = fileno(file);</font>
<br><font size=2 face="Courier New"> struct aclmember
*entry;</font>
<br><font size=2 face="Courier New">+#if defined(USE_TLS)</font>
<br><font size=2 face="Courier New">+ static int flushwait_if_unprotected
= TRUE;</font>
<br><font size=2 face="Courier New">+#endif /* USE_TLS */</font>
<br><font size=2 face="Courier New"> </font>
<br><font size=2 face="Courier New"> if (first_time)
{</font>
<br><font size=2 face="Courier New"> entry
= NULL;</font>
<br><font size=2 face="Courier New">@@ -655,7 +658,27 @@</font>
<br><font size=2 face="Courier New">
}</font>
<br><font size=2 face="Courier New"> }</font>
<br><font size=2 face="Courier New"> first_time
= FALSE;</font>
<br><font size=2 face="Courier New">+#if defined(USE_TLS)</font>
<br><font size=2 face="Courier New">+ flushwait_if_unprotected
= flushwait;</font>
<br><font size=2 face="Courier New">+#endif /* USE_TLS */</font>
<br><font size=2 face="Courier New"> }</font>
<br><font size=2 face="Courier New">+#if defined(USE_TLS)</font>
<br><font size=2 face="Courier New">+ /*</font>
<br><font size=2 face="Courier New">+ * don't do this flushing
stuff on an SSL socket - it just won't work</font>
<br><font size=2 face="Courier New">+ * (currently - this
routine is only caled on DATA connections)</font>
<br><font size=2 face="Courier New">+ * Need to check on
a per connection basis, as the PROT command </font>
<br><font size=2 face="Courier New">+ * can change the protection
of the data connection dynamically</font>
<br><font size=2 face="Courier New">+ */</font>
<br><font size=2 face="Courier New">+ if((SEC_DATA_MECHANISM_TLS
== get_data_prot_mechanism()) &&</font>
<br><font size=2 face="Courier New">+ ('P' == get_data_prot_level()))</font>
<br><font size=2 face="Courier New">+ {</font>
<br><font size=2 face="Courier New">+ flushwait =
FALSE;</font>
<br><font size=2 face="Courier New">+ }</font>
<br><font size=2 face="Courier New">+ else</font>
<br><font size=2 face="Courier New">+ {</font>
<br><font size=2 face="Courier New">+ flushwait =
flushwait_if_unprotected;</font>
<br><font size=2 face="Courier New">+ }</font>
<br><font size=2 face="Courier New">+#endif /* USE_TLS */</font>
<br><font size=2 face="Courier New"> if (flushwait)
{</font>
<br><font size=2 face="Courier New"> if
(draconian_FILE != NULL)</font>
<br><font size=2 face="Courier New">
shutdown(fd, 1);</font>
<br>
<br><font size=2 face="sans-serif">Cheers,</font>
<br><font size=2 face="sans-serif">Paul</font>
<br><font size=2 face="sans-serif"><br>
--<br>
Paul Ford-Hutchinson : eCommerce application security : [email protected]<br>
MPT-6, IBM , PO Box 31, Birmingham Rd, Warwick, CV34 5JL +44 (0)1926 462005<br>
http://www.ford-hutchinson.com/~fh-1-pfh/ftps-ext.html<br>
</font>
--=_alternative 0043739080256E85_=--