xref: /csrg-svn/libexec/ftpd/ftpd.c (revision 10423)
1 #ifndef lint
2 static char sccsid[] = "@(#)ftpd.c	4.10 (Berkeley) 01/19/83";
3 #endif
4 
5 /*
6  * FTP server.
7  */
8 #include <sys/param.h>
9 #include <sys/stat.h>
10 #include <sys/ioctl.h>
11 #include <sys/socket.h>
12 
13 #include <netinet/in.h>
14 
15 #include <stdio.h>
16 #include <signal.h>
17 #include <wait.h>
18 #include <pwd.h>
19 #include <setjmp.h>
20 #include <netdb.h>
21 #include <errno.h>
22 
23 #include "ftp.h"
24 
25 extern	int errno;
26 extern	char *sys_errlist[];
27 extern	char *crypt();
28 extern	char version[];
29 extern	char *home;		/* pointer to home directory for glob */
30 extern	FILE *popen(), *fopen();
31 extern	int pclose(), fclose();
32 
33 struct	sockaddr_in ctrl_addr;
34 struct	sockaddr_in data_source;
35 struct	sockaddr_in data_dest;
36 struct	sockaddr_in his_addr;
37 
38 struct	hostent *hp;
39 
40 int	data;
41 jmp_buf	errcatch;
42 int	logged_in;
43 struct	passwd *pw;
44 int	debug;
45 int	logging = 1;
46 int	guest;
47 int	type;
48 int	form;
49 int	stru;			/* avoid C keyword */
50 int	mode;
51 int	usedefault = 1;		/* for data transfers */
52 char	hostname[32];
53 char	*remotehost;
54 struct	servent *sp;
55 
56 int	lostconn();
57 int	reapchild();
58 FILE	*getdatasock(), *dataconn();
59 char	*ntoa();
60 
61 main(argc, argv)
62 	int argc;
63 	char *argv[];
64 {
65 	int ctrl, s, options = 0;
66 	char *cp;
67 
68 	sp = getservbyname("ftp", "tcp");
69 	if (sp == 0) {
70 		fprintf(stderr, "ftpd: fpt/tcp: unknown service\n");
71 		exit(1);
72 	}
73 	ctrl_addr.sin_port = sp->s_port;
74 	data_source.sin_port = htons(ntohs(sp->s_port) - 1);
75 	signal(SIGPIPE, lostconn);
76 	debug = 0;
77 	argc--, argv++;
78 	while (argc > 0 && *argv[0] == '-') {
79 		for (cp = &argv[0][1]; *cp; cp++) switch (*cp) {
80 
81 		case 'd':
82 			debug = 1;
83 			options |= SO_DEBUG;
84 			break;
85 
86 		default:
87 			fprintf(stderr, "Unknown flag -%c ignored.\n", cp);
88 			break;
89 		}
90 		argc--, argv++;
91 	}
92 #ifndef DEBUG
93 	if (fork())
94 		exit(0);
95 	for (s = 0; s < 10; s++)
96 		(void) close(s);
97 	(void) open("/dev/null", 0);
98 	(void) dup2(0, 1);
99 	{ int tt = open("/dev/tty", 2);
100 	  if (tt > 0) {
101 		ioctl(tt, TIOCNOTTY, 0);
102 		close(tt);
103 	  }
104 	}
105 #endif
106 	while ((s = socket(AF_INET, SOCK_STREAM, 0, 0)) < 0) {
107 		perror("ftpd: socket");
108 		sleep(5);
109 	}
110 	if (options & SO_DEBUG)
111 		if (setsockopt(s, SOL_SOCKET, SO_DEBUG, 0, 0) < 0)
112 			perror("ftpd: setsockopt (SO_DEBUG)");
113 #ifdef notdef
114 	if (setsockopt(s, SOL_SOCKET, SO_KEEPALIVE, 0, 0) < 0)
115 		perror("ftpd: setsockopt (SO_KEEPALIVE)");
116 #endif
117 	while (bind(s, &ctrl_addr, sizeof (ctrl_addr), 0) < 0) {
118 		perror("ftpd: bind");
119 		sleep(5);
120 	}
121 	signal(SIGCHLD, reapchild);
122 	listen(s, 10);
123 	for (;;) {
124 		int hisaddrlen = sizeof (his_addr);
125 
126 		ctrl = accept(s, &his_addr, &hisaddrlen, 0);
127 		if (ctrl < 0) {
128 			if (errno == EINTR)
129 				continue;
130 			perror("ftpd: accept");
131 			continue;
132 		}
133 		if (fork() == 0) {
134 			if (logging)
135 				dolog(&his_addr);
136 			close(s);
137 			dup2(ctrl, 0), close(ctrl), dup2(0, 1);
138 			/* do telnet option negotiation here */
139 			/*
140 			 * Set up default state
141 			 */
142 			logged_in = 0;
143 			data = -1;
144 			type = TYPE_A;
145 			form = FORM_N;
146 			stru = STRU_F;
147 			mode = MODE_S;
148 			gethostname(hostname, sizeof (hostname));
149 			reply(220, "%s FTP server (%s) ready.",
150 				hostname, version);
151 			for (;;) {
152 				setjmp(errcatch);
153 				yyparse();
154 			}
155 		}
156 		close(ctrl);
157 	}
158 }
159 
160 reapchild()
161 {
162 	union wait status;
163 
164 	while (wait3(&status, WNOHANG, 0) > 0)
165 		;
166 }
167 
168 lostconn()
169 {
170 
171 	fatal("Connection closed.");
172 }
173 
174 pass(passwd)
175 	char *passwd;
176 {
177 	char *xpasswd, *savestr();
178 	static struct passwd save;
179 
180 	if (logged_in || pw == NULL) {
181 		reply(503, "Login with USER first.");
182 		return;
183 	}
184 	if (!guest) {		/* "ftp" is only account allowed no password */
185 		xpasswd = crypt(passwd, pw->pw_passwd);
186 		if (strcmp(xpasswd, pw->pw_passwd) != 0) {
187 			reply(530, "Login incorrect.");
188 			pw = NULL;
189 			return;
190 		}
191 	}
192 	setegid(pw->pw_gid);
193 	initgroups(pw->pw_name, pw->pw_gid);
194 	if (chdir(pw->pw_dir)) {
195 		reply(550, "User %s: can't change directory to $s.",
196 			pw->pw_name, pw->pw_dir);
197 		goto bad;
198 	}
199 	if (guest && chroot(pw->pw_dir) < 0) {
200 		reply(550, "Can't set guest privileges.");
201 		goto bad;
202 	}
203 	if (!guest)
204 		reply(230, "User %s logged in.", pw->pw_name);
205 	else
206 		reply(230, "Guest login ok, access restrictions apply.");
207 	logged_in = 1;
208 	seteuid(pw->pw_uid);
209 	/*
210 	 * Save everything so globbing doesn't
211 	 * clobber the fields.
212 	 */
213 	save = *pw;
214 	save.pw_name = savestr(pw->pw_name);
215 	save.pw_passwd = savestr(pw->pw_passwd);
216 	save.pw_comment = savestr(pw->pw_comment);
217 	save.pw_gecos = savestr(pw->pw_gecos, &save.pw_gecos);
218 	save.pw_dir = savestr(pw->pw_dir);
219 	save.pw_shell = savestr(pw->pw_shell);
220 	pw = &save;
221 	home = pw->pw_dir;		/* home dir for globbing */
222 	return;
223 bad:
224 	seteuid(0);
225 	pw = NULL;
226 }
227 
228 char *
229 savestr(s)
230 	char *s;
231 {
232 	char *malloc();
233 	char *new = malloc(strlen(s) + 1);
234 
235 	if (new != NULL)
236 		strcpy(new, s);
237 	return(new);
238 }
239 
240 retrieve(cmd, name)
241 	char *cmd, *name;
242 {
243 	FILE *fin, *dout;
244 	struct stat st;
245 	int (*closefunc)();
246 
247 	if (cmd == 0) {
248 #ifdef notdef
249 		/* no remote command execution -- it's a security hole */
250 		if (*name == '!')
251 			fin = popen(name + 1, "r"), closefunc = pclose;
252 		else
253 #endif
254 			fin = fopen(name, "r"), closefunc = fclose;
255 	} else {
256 		char line[BUFSIZ];
257 
258 		sprintf(line, cmd, name), name = line;
259 		fin = popen(line, "r"), closefunc = pclose;
260 	}
261 	if (fin == NULL) {
262 		reply(550, "%s: %s.", name, sys_errlist[errno]);
263 		return;
264 	}
265 	st.st_size = 0;
266 	if (cmd == 0 &&
267 	    (stat(name, &st) < 0 || (st.st_mode&S_IFMT) != S_IFREG)) {
268 		reply(550, "%s: not a plain file.", name);
269 		goto done;
270 	}
271 	dout = dataconn(name, st.st_size, "w");
272 	if (dout == NULL)
273 		goto done;
274 	if (send_data(fin, dout) || ferror(dout))
275 		reply(550, "%s: %s.", name, sys_errlist[errno]);
276 	else
277 		reply(226, "Transfer complete.");
278 	fclose(dout), data = -1;
279 done:
280 	(*closefunc)(fin);
281 }
282 
283 store(name, mode)
284 	char *name, *mode;
285 {
286 	FILE *fout, *din;
287 	int (*closefunc)(), dochown = 0;
288 
289 #ifdef notdef
290 	/* no remote command execution -- it's a security hole */
291 	if (name[0] == '!')
292 		fout = popen(&name[1], "w"), closefunc = pclose;
293 	else
294 #endif
295 	{
296 		struct stat st;
297 
298 		if (stat(name, &st) < 0)
299 			dochown++;
300 		fout = fopen(name, mode), closefunc = fclose;
301 	}
302 	if (fout == NULL) {
303 		reply(550, "%s: %s.", name, sys_errlist[errno]);
304 		return;
305 	}
306 	din = dataconn(name, -1, "r");
307 	if (din == NULL)
308 		goto done;
309 	if (receive_data(din, fout) || ferror(fout))
310 		reply(550, "%s: %s.", name, sys_errlist[errno]);
311 	else
312 		reply(226, "Transfer complete.");
313 	fclose(din), data = -1;
314 done:
315 	if (dochown)
316 		(void) chown(name, pw->pw_uid, -1);
317 	(*closefunc)(fout);
318 }
319 
320 FILE *
321 getdatasock(mode)
322 	char *mode;
323 {
324 	int retrytime, s;
325 
326 	if (data >= 0)
327 		return (fdopen(data, mode));
328 	retrytime = 1;
329 	while ((s = socket(AF_INET, SOCK_STREAM, 0, 0)) < 0) {
330 		if (retrytime < 5) {
331 			sleep(retrytime);
332 			retrytime <<= 1;
333 			continue;
334 		}
335 		return (NULL);
336 	}
337 	retrytime = 1;
338 	seteuid(0);
339 	while (bind(s, &data_source, sizeof (data_source), 0) < 0) {
340 		if (retrytime < 5) {
341 			sleep(retrytime);
342 			retrytime <<= 1;
343 			continue;
344 		}
345 		seteuid(pw->pw_uid);
346 		close(s);
347 		return (NULL);
348 	}
349 	seteuid(pw->pw_uid);
350 	return (fdopen(s, mode));
351 }
352 
353 FILE *
354 dataconn(name, size, mode)
355 	char *name;
356 	int size;
357 	char *mode;
358 {
359 	char sizebuf[32];
360 	FILE *file;
361 
362 	if (size >= 0)
363 		sprintf(sizebuf, " (%d bytes)", size);
364 	else
365 		(void) strcpy(sizebuf, "");
366 	if (data >= 0) {
367 		reply(125, "Using existing data connection for %s%s.",
368 		    name, sizebuf);
369 		usedefault = 1;
370 		return (fdopen(data, mode));
371 	}
372 	/*
373 	 * If no PORT command was specified,
374 	 * use the default address.
375 	 */
376 	if (usedefault) {
377 		data_dest = his_addr;
378 		data_dest.sin_port = htons(ntohs(sp->s_port) - 1);
379 	}
380 	usedefault = 1;
381 	reply(150, "Opening data connection for %s (%s,%d)%s.",
382 	    name, ntoa(data_dest.sin_addr.s_addr),
383 	    ntohs(data_dest.sin_port), sizebuf);
384 	file = getdatasock(mode);
385 	if (file == NULL) {
386 		reply(425, "Can't create data socket (%s,%d): %s.",
387 		    ntoa(data_source.sin_addr),
388 		    ntohs(data_source.sin_port),
389 		    sys_errlist[errno]);
390 		return (NULL);
391 	}
392 	data = fileno(file);
393 	if (connect(data, &data_dest, sizeof (data_dest), 0) < 0) {
394 		reply(425, "Can't build data connection: %s.",
395 		    sys_errlist[errno]);
396 		(void) fclose(file);
397 		data = -1;
398 		return (NULL);
399 	}
400 	return (file);
401 }
402 
403 /*
404  * Tranfer the contents of "instr" to
405  * "outstr" peer using the appropriate
406  * encapulation of the date subject
407  * to Mode, Structure, and Type.
408  *
409  * NB: Form isn't handled.
410  */
411 send_data(instr, outstr)
412 	FILE *instr, *outstr;
413 {
414 	register int c;
415 	int netfd, filefd, cnt;
416 	char buf[BUFSIZ];
417 
418 	switch (type) {
419 
420 	case TYPE_A:
421 		while ((c = getc(instr)) != EOF) {
422 			if (c == '\n')
423 				putc('\r', outstr);
424 			if (putc(c, outstr) == EOF)
425 				return (1);
426 		}
427 		return (0);
428 
429 	case TYPE_I:
430 	case TYPE_L:
431 		netfd = fileno(outstr);
432 		filefd = fileno(instr);
433 
434 		while ((cnt = read(filefd, buf, sizeof (buf))) > 0)
435 			if (write(netfd, buf, cnt) < 0)
436 				return (1);
437 		return (cnt < 0);
438 	}
439 	reply(504,"Unimplemented TYPE %d in send_data", type);
440 	return (1);
441 }
442 
443 /*
444  * Transfer data from peer to
445  * "outstr" using the appropriate
446  * encapulation of the data subject
447  * to Mode, Structure, and Type.
448  *
449  * N.B.: Form isn't handled.
450  */
451 receive_data(instr, outstr)
452 	FILE *instr, *outstr;
453 {
454 	register int c;
455 	int cr, escape, eof;
456 	int netfd, filefd, cnt;
457 	char buf[BUFSIZ];
458 
459 
460 	switch (type) {
461 
462 	case TYPE_I:
463 	case TYPE_L:
464 		netfd = fileno(instr);
465 		netfd = fileno(outstr);
466 		while ((cnt = read(netfd, buf, sizeof buf)) > 0)
467 			if (write(filefd, buf, cnt) < 0)
468 				return (1);
469 		return (cnt < 0);
470 
471 	case TYPE_E:
472 		reply(504, "TYPE E not implemented.");
473 		return (1);
474 
475 	case TYPE_A:
476 		cr = 0;
477 		while ((c = getc(instr)) != EOF) {
478 			if (cr) {
479 				if (c != '\r' && c != '\n')
480 					putc('\r', outstr);
481 				putc(c, outstr);
482 				cr = c == '\r';
483 				continue;
484 			}
485 			if (c == '\r') {
486 				cr = 1;
487 				continue;
488 			}
489 			putc(c, outstr);
490 		}
491 		if (cr)
492 			putc('\r', outstr);
493 		return (0);
494 	}
495 	fatal("Unknown type in receive_data.");
496 	/*NOTREACHED*/
497 }
498 
499 fatal(s)
500 	char *s;
501 {
502 	reply(451, "Error in server: %s\n", s);
503 	reply(221, "Closing connection due to server error.");
504 	exit(0);
505 }
506 
507 reply(n, s, args)
508 	int n;
509 	char *s;
510 {
511 
512 	printf("%d ", n);
513 	_doprnt(s, &args, stdout);
514 	printf("\r\n");
515 	fflush(stdout);
516 	if (debug) {
517 		fprintf(stderr, "<--- %d ", n);
518 		_doprnt(s, &args, stderr);
519 		fprintf(stderr, "\n");
520 		fflush(stderr);
521 	}
522 }
523 
524 lreply(n, s, args)
525 	int n;
526 	char *s;
527 {
528 	printf("%d-", n);
529 	_doprnt(s, &args, stdout);
530 	printf("\r\n");
531 	fflush(stdout);
532 	if (debug) {
533 		fprintf(stderr, "<--- %d-", n);
534 		_doprnt(s, &args, stderr);
535 		fprintf(stderr, "\n");
536 	}
537 }
538 
539 replystr(s)
540 	char *s;
541 {
542 	printf("%s\r\n", s);
543 	fflush(stdout);
544 	if (debug)
545 		fprintf(stderr, "<--- %s\n", s);
546 }
547 
548 ack(s)
549 	char *s;
550 {
551 	reply(200, "%s command okay.", s);
552 }
553 
554 nack(s)
555 	char *s;
556 {
557 	reply(502, "%s command not implemented.", s);
558 }
559 
560 yyerror()
561 {
562 	reply(500, "Command not understood.");
563 }
564 
565 delete(name)
566 	char *name;
567 {
568 	struct stat st;
569 
570 	if (stat(name, &st) < 0) {
571 		reply(550, "%s: %s.", name, sys_errlist[errno]);
572 		return;
573 	}
574 	if ((st.st_mode&S_IFMT) == S_IFDIR) {
575 		if (rmdir(name) < 0) {
576 			reply(550, "%s: %s.", name, sys_errlist[errno]);
577 			return;
578 		}
579 		goto done;
580 	}
581 	if (unlink(name) < 0) {
582 		reply(550, "%s: %s.", name, sys_errlist[errno]);
583 		return;
584 	}
585 done:
586 	ack("DELE");
587 }
588 
589 cwd(path)
590 	char *path;
591 {
592 
593 	if (chdir(path) < 0) {
594 		reply(550, "%s: %s.", path, sys_errlist[errno]);
595 		return;
596 	}
597 	ack("CWD");
598 }
599 
600 makedir(name)
601 	char *name;
602 {
603 	struct stat st;
604 	int dochown = stat(name, &st) < 0;
605 
606 	if (mkdir(name, 0777) < 0) {
607 		reply(550, "%s: %s.", name, sys_errlist[errno]);
608 		return;
609 	}
610 	if (dochown)
611 		(void) chown(name, pw->pw_uid, -1);
612 	ack("MKDIR");
613 }
614 
615 removedir(name)
616 	char *name;
617 {
618 
619 	if (rmdir(name) < 0) {
620 		reply(550, "%s: %s.", name, sys_errlist[errno]);
621 		return;
622 	}
623 	ack("RMDIR");
624 }
625 
626 pwd()
627 {
628 	char path[MAXPATHLEN + 1];
629 	char *p;
630 
631 	if (getwd(path) == NULL) {
632 		reply(451, "%s.", path);
633 		return;
634 	}
635 	reply(251, "\"%s\" is current directory.", path);
636 }
637 
638 char *
639 renamefrom(name)
640 	char *name;
641 {
642 	struct stat st;
643 
644 	if (stat(name, &st) < 0) {
645 		reply(550, "%s: %s.", name, sys_errlist[errno]);
646 		return ((char *)0);
647 	}
648 	reply(350, "File exists, ready for destination name");
649 	return (name);
650 }
651 
652 renamecmd(from, to)
653 	char *from, *to;
654 {
655 
656 	if (rename(from, to) < 0) {
657 		reply(550, "rename: %s.", sys_errlist[errno]);
658 		return;
659 	}
660 	ack("RNTO");
661 }
662 
663 int guest;
664 /*
665  * Test pathname for guest-user safety.
666  */
667 inappropriate_request(name)
668 	char *name;
669 {
670 	int bogus = 0, depth = 0, length = strlen(name);
671 	char *p, *s;
672 
673 	if (!guest)
674 		return (0);
675 	if (name[0] == '/' || name[0] == '|')
676 		bogus = 1;
677 	for (p = name; p < name+length;) {
678 		s = p;				/* start of token */
679 		while ( *p && *p!= '/')
680 			p++;
681 		*p = 0;
682 		if (strcmp(s, "..") == 0)
683 			depth -= 1;		/* backing up */
684 		else if (strcmp(s, ".") == 0)
685 			depth += 0;		/* no change */
686 		else
687 			depth += 1;		/* descending */
688 		if (depth < 0) {
689 			bogus = 1;
690 			break;
691 		}
692 	}
693 	if (bogus)
694 		reply(553, "%s: pathname disallowed guest users", name);
695 	return (bogus);
696 }
697 
698 /*
699  * Convert network-format internet address
700  * to base 256 d.d.d.d representation.
701  */
702 char *
703 ntoa(in)
704 	struct in_addr in;
705 {
706 	static char b[18];
707 	register char *p;
708 
709 	in.s_addr = ntohl(in.s_addr);
710 	p = (char *)&in;
711 #define	UC(b)	(((int)b)&0xff)
712 	sprintf(b, "%d.%d.%d.%d", UC(p[0]), UC(p[1]), UC(p[2]), UC(p[3]));
713 	return (b);
714 }
715 
716 dolog(sin)
717 	struct sockaddr_in *sin;
718 {
719 	struct hostent *hp = gethostbyaddr(&sin->sin_addr,
720 		sizeof (struct in_addr), AF_INET);
721 	char *remotehost;
722 	time_t t;
723 
724 	if (hp)
725 		remotehost = hp->h_name;
726 	else
727 		remotehost = "UNKNOWNHOST";
728 	t = time(0);
729 	fprintf(stderr,"FTP: connection from %s at %s", remotehost, ctime(&t));
730 	fflush(stderr);
731 }
732