xref: /csrg-svn/libexec/ftpd/ftpd.c (revision 10616)
1 #ifndef lint
2 static char sccsid[] = "@(#)ftpd.c	4.14 (Berkeley) 01/24/83";
3 #endif
4 
5 /*
6  * FTP server.
7  */
8 #include <sys/param.h>
9 #include <sys/stat.h>
10 #include <sys/ioctl.h>
11 #include <sys/socket.h>
12 
13 #include <netinet/in.h>
14 
15 #include <stdio.h>
16 #include <signal.h>
17 #include <wait.h>
18 #include <pwd.h>
19 #include <setjmp.h>
20 #include <netdb.h>
21 #include <errno.h>
22 
23 #include "ftp.h"
24 
25 extern	int errno;
26 extern	char *sys_errlist[];
27 extern	char *crypt();
28 extern	char version[];
29 extern	char *home;		/* pointer to home directory for glob */
30 extern	FILE *popen(), *fopen();
31 extern	int pclose(), fclose();
32 
33 struct	sockaddr_in ctrl_addr;
34 struct	sockaddr_in data_source;
35 struct	sockaddr_in data_dest;
36 struct	sockaddr_in his_addr;
37 
38 struct	hostent *hp;
39 
40 int	data;
41 jmp_buf	errcatch;
42 int	logged_in;
43 struct	passwd *pw;
44 int	debug;
45 int	logging = 1;
46 int	guest;
47 int	type;
48 int	form;
49 int	stru;			/* avoid C keyword */
50 int	mode;
51 int	usedefault = 1;		/* for data transfers */
52 char	hostname[32];
53 char	*remotehost;
54 struct	servent *sp;
55 
56 int	lostconn();
57 int	reapchild();
58 FILE	*getdatasock(), *dataconn();
59 char	*ntoa();
60 
61 main(argc, argv)
62 	int argc;
63 	char *argv[];
64 {
65 	int ctrl, s, options = 0;
66 	char *cp;
67 
68 	sp = getservbyname("ftp", "tcp");
69 	if (sp == 0) {
70 		fprintf(stderr, "ftpd: fpt/tcp: unknown service\n");
71 		exit(1);
72 	}
73 	ctrl_addr.sin_port = sp->s_port;
74 	data_source.sin_port = htons(ntohs(sp->s_port) - 1);
75 	signal(SIGPIPE, lostconn);
76 	debug = 0;
77 	argc--, argv++;
78 	while (argc > 0 && *argv[0] == '-') {
79 		for (cp = &argv[0][1]; *cp; cp++) switch (*cp) {
80 
81 		case 'd':
82 			debug = 1;
83 			options |= SO_DEBUG;
84 			break;
85 
86 		default:
87 			fprintf(stderr, "Unknown flag -%c ignored.\n", cp);
88 			break;
89 		}
90 		argc--, argv++;
91 	}
92 #ifndef DEBUG
93 	if (fork())
94 		exit(0);
95 	for (s = 0; s < 10; s++)
96 		(void) close(s);
97 	(void) open("/dev/null", 0);
98 	(void) dup2(0, 1);
99 	{ int tt = open("/dev/tty", 2);
100 	  if (tt > 0) {
101 		ioctl(tt, TIOCNOTTY, 0);
102 		close(tt);
103 	  }
104 	}
105 #endif
106 	while ((s = socket(AF_INET, SOCK_STREAM, 0, 0)) < 0) {
107 		perror("ftpd: socket");
108 		sleep(5);
109 	}
110 	if (options & SO_DEBUG)
111 		if (setsockopt(s, SOL_SOCKET, SO_DEBUG, 0, 0) < 0)
112 			perror("ftpd: setsockopt (SO_DEBUG)");
113 #ifdef notdef
114 	if (setsockopt(s, SOL_SOCKET, SO_KEEPALIVE, 0, 0) < 0)
115 		perror("ftpd: setsockopt (SO_KEEPALIVE)");
116 #endif
117 	while (bind(s, &ctrl_addr, sizeof (ctrl_addr), 0) < 0) {
118 		perror("ftpd: bind");
119 		sleep(5);
120 	}
121 	sigset(SIGCHLD, reapchild);
122 	listen(s, 10);
123 	for (;;) {
124 		int hisaddrlen = sizeof (his_addr);
125 
126 		ctrl = accept(s, &his_addr, &hisaddrlen, 0);
127 		if (ctrl < 0) {
128 			if (errno == EINTR)
129 				continue;
130 			perror("ftpd: accept");
131 			continue;
132 		}
133 		if (fork() == 0) {
134 			if (logging)
135 				dolog(&his_addr);
136 			close(s);
137 			dup2(ctrl, 0), close(ctrl), dup2(0, 1);
138 			/* do telnet option negotiation here */
139 			/*
140 			 * Set up default state
141 			 */
142 			logged_in = 0;
143 			data = -1;
144 			type = TYPE_A;
145 			form = FORM_N;
146 			stru = STRU_F;
147 			mode = MODE_S;
148 			gethostname(hostname, sizeof (hostname));
149 			reply(220, "%s FTP server (%s) ready.",
150 				hostname, version);
151 			for (;;) {
152 				setjmp(errcatch);
153 				yyparse();
154 			}
155 		}
156 		close(ctrl);
157 	}
158 }
159 
160 reapchild()
161 {
162 	union wait status;
163 
164 	while (wait3(&status, WNOHANG, 0) > 0)
165 		;
166 }
167 
168 lostconn()
169 {
170 
171 	fatal("Connection closed.");
172 }
173 
174 pass(passwd)
175 	char *passwd;
176 {
177 	char *xpasswd, *savestr();
178 	static struct passwd save;
179 
180 	if (logged_in || pw == NULL) {
181 		reply(503, "Login with USER first.");
182 		return;
183 	}
184 	if (!guest) {		/* "ftp" is only account allowed no password */
185 		xpasswd = crypt(passwd, pw->pw_passwd);
186 		if (strcmp(xpasswd, pw->pw_passwd) != 0) {
187 			reply(530, "Login incorrect.");
188 			pw = NULL;
189 			return;
190 		}
191 	}
192 	setegid(pw->pw_gid);
193 	initgroups(pw->pw_name, pw->pw_gid);
194 	if (chdir(pw->pw_dir)) {
195 		reply(550, "User %s: can't change directory to $s.",
196 			pw->pw_name, pw->pw_dir);
197 		goto bad;
198 	}
199 	if (guest && chroot(pw->pw_dir) < 0) {
200 		reply(550, "Can't set guest privileges.");
201 		goto bad;
202 	}
203 	if (!guest)
204 		reply(230, "User %s logged in.", pw->pw_name);
205 	else
206 		reply(230, "Guest login ok, access restrictions apply.");
207 	logged_in = 1;
208 	seteuid(pw->pw_uid);
209 	/*
210 	 * Save everything so globbing doesn't
211 	 * clobber the fields.
212 	 */
213 	save = *pw;
214 	save.pw_name = savestr(pw->pw_name);
215 	save.pw_passwd = savestr(pw->pw_passwd);
216 	save.pw_comment = savestr(pw->pw_comment);
217 	save.pw_gecos = savestr(pw->pw_gecos, &save.pw_gecos);
218 	save.pw_dir = savestr(pw->pw_dir);
219 	save.pw_shell = savestr(pw->pw_shell);
220 	pw = &save;
221 	home = pw->pw_dir;		/* home dir for globbing */
222 	return;
223 bad:
224 	seteuid(0);
225 	pw = NULL;
226 }
227 
228 char *
229 savestr(s)
230 	char *s;
231 {
232 	char *malloc();
233 	char *new = malloc(strlen(s) + 1);
234 
235 	if (new != NULL)
236 		strcpy(new, s);
237 	return(new);
238 }
239 
240 retrieve(cmd, name)
241 	char *cmd, *name;
242 {
243 	FILE *fin, *dout;
244 	struct stat st;
245 	int (*closefunc)();
246 
247 	if (cmd == 0) {
248 #ifdef notdef
249 		/* no remote command execution -- it's a security hole */
250 		if (*name == '!')
251 			fin = popen(name + 1, "r"), closefunc = pclose;
252 		else
253 #endif
254 			fin = fopen(name, "r"), closefunc = fclose;
255 	} else {
256 		char line[BUFSIZ];
257 
258 		sprintf(line, cmd, name), name = line;
259 		fin = popen(line, "r"), closefunc = pclose;
260 	}
261 	if (fin == NULL) {
262 		reply(550, "%s: %s.", name, sys_errlist[errno]);
263 		return;
264 	}
265 	st.st_size = 0;
266 	if (cmd == 0 &&
267 	    (stat(name, &st) < 0 || (st.st_mode&S_IFMT) != S_IFREG)) {
268 		reply(550, "%s: not a plain file.", name);
269 		goto done;
270 	}
271 	dout = dataconn(name, st.st_size, "w");
272 	if (dout == NULL)
273 		goto done;
274 	if (send_data(fin, dout) || ferror(dout))
275 		reply(550, "%s: %s.", name, sys_errlist[errno]);
276 	else
277 		reply(226, "Transfer complete.");
278 	fclose(dout), data = -1;
279 done:
280 	(*closefunc)(fin);
281 }
282 
283 store(name, mode)
284 	char *name, *mode;
285 {
286 	FILE *fout, *din;
287 	int (*closefunc)(), dochown = 0;
288 
289 #ifdef notdef
290 	/* no remote command execution -- it's a security hole */
291 	if (name[0] == '!')
292 		fout = popen(&name[1], "w"), closefunc = pclose;
293 	else
294 #endif
295 	{
296 		struct stat st;
297 
298 		if (stat(name, &st) < 0)
299 			dochown++;
300 		fout = fopen(name, mode), closefunc = fclose;
301 	}
302 	if (fout == NULL) {
303 		reply(550, "%s: %s.", name, sys_errlist[errno]);
304 		return;
305 	}
306 	din = dataconn(name, -1, "r");
307 	if (din == NULL)
308 		goto done;
309 	if (receive_data(din, fout) || ferror(fout))
310 		reply(550, "%s: %s.", name, sys_errlist[errno]);
311 	else
312 		reply(226, "Transfer complete.");
313 	fclose(din), data = -1;
314 done:
315 	if (dochown)
316 		(void) chown(name, pw->pw_uid, -1);
317 	(*closefunc)(fout);
318 }
319 
320 FILE *
321 getdatasock(mode)
322 	char *mode;
323 {
324 	int s;
325 
326 	if (data >= 0)
327 		return (fdopen(data, mode));
328 	s = socket(AF_INET, SOCK_STREAM, 0, 0);
329 	if (s < 0)
330 		return (NULL);
331 	seteuid(0);
332 	if (setsockopt(s, SOL_SOCKET, SO_REUSEADDR, 0, 0) < 0)
333 		goto bad;
334 	if (bind(s, &data_source, sizeof (data_source), 0) < 0)
335 		goto bad;
336 	seteuid(pw->pw_uid);
337 	return (fdopen(s, mode));
338 bad:
339 	seteuid(pw->pw_uid);
340 	close(s);
341 	return (NULL);
342 }
343 
344 FILE *
345 dataconn(name, size, mode)
346 	char *name;
347 	int size;
348 	char *mode;
349 {
350 	char sizebuf[32];
351 	FILE *file;
352 
353 	if (size >= 0)
354 		sprintf(sizebuf, " (%d bytes)", size);
355 	else
356 		(void) strcpy(sizebuf, "");
357 	if (data >= 0) {
358 		reply(125, "Using existing data connection for %s%s.",
359 		    name, sizebuf);
360 		usedefault = 1;
361 		return (fdopen(data, mode));
362 	}
363 	if (usedefault)
364 		data_dest = his_addr;
365 	usedefault = 1;
366 	file = getdatasock(mode);
367 	if (file == NULL) {
368 		reply(425, "Can't create data socket (%s,%d): %s.",
369 		    ntoa(data_source.sin_addr),
370 		    ntohs(data_source.sin_port),
371 		    sys_errlist[errno]);
372 		return (NULL);
373 	}
374 	reply(150, "Opening data connection for %s (%s,%d)%s.",
375 	    name, ntoa(data_dest.sin_addr.s_addr),
376 	    ntohs(data_dest.sin_port), sizebuf);
377 	data = fileno(file);
378 	if (connect(data, &data_dest, sizeof (data_dest), 0) < 0) {
379 		reply(425, "Can't build data connection: %s.",
380 		    sys_errlist[errno]);
381 		(void) fclose(file);
382 		data = -1;
383 		return (NULL);
384 	}
385 	return (file);
386 }
387 
388 /*
389  * Tranfer the contents of "instr" to
390  * "outstr" peer using the appropriate
391  * encapulation of the date subject
392  * to Mode, Structure, and Type.
393  *
394  * NB: Form isn't handled.
395  */
396 send_data(instr, outstr)
397 	FILE *instr, *outstr;
398 {
399 	register int c;
400 	int netfd, filefd, cnt;
401 	char buf[BUFSIZ];
402 
403 	switch (type) {
404 
405 	case TYPE_A:
406 		while ((c = getc(instr)) != EOF) {
407 			if (c == '\n')
408 				putc('\r', outstr);
409 			if (putc(c, outstr) == EOF)
410 				return (1);
411 		}
412 		return (0);
413 
414 	case TYPE_I:
415 	case TYPE_L:
416 		netfd = fileno(outstr);
417 		filefd = fileno(instr);
418 
419 		while ((cnt = read(filefd, buf, sizeof (buf))) > 0)
420 			if (write(netfd, buf, cnt) < 0)
421 				return (1);
422 		return (cnt < 0);
423 	}
424 	reply(504,"Unimplemented TYPE %d in send_data", type);
425 	return (1);
426 }
427 
428 /*
429  * Transfer data from peer to
430  * "outstr" using the appropriate
431  * encapulation of the data subject
432  * to Mode, Structure, and Type.
433  *
434  * N.B.: Form isn't handled.
435  */
436 receive_data(instr, outstr)
437 	FILE *instr, *outstr;
438 {
439 	register int c;
440 	int cr, escape, eof, cnt;
441 	char buf[BUFSIZ];
442 
443 
444 	switch (type) {
445 
446 	case TYPE_I:
447 	case TYPE_L:
448 		while ((cnt = read(fileno(instr), buf, sizeof buf)) > 0)
449 			if (write(fileno(outstr), buf, cnt) < 0)
450 				return (1);
451 		return (cnt < 0);
452 
453 	case TYPE_E:
454 		reply(504, "TYPE E not implemented.");
455 		return (1);
456 
457 	case TYPE_A:
458 		cr = 0;
459 		while ((c = getc(instr)) != EOF) {
460 			if (cr) {
461 				if (c != '\r' && c != '\n')
462 					putc('\r', outstr);
463 				putc(c, outstr);
464 				cr = c == '\r';
465 				continue;
466 			}
467 			if (c == '\r') {
468 				cr = 1;
469 				continue;
470 			}
471 			putc(c, outstr);
472 		}
473 		if (cr)
474 			putc('\r', outstr);
475 		return (0);
476 	}
477 	fatal("Unknown type in receive_data.");
478 	/*NOTREACHED*/
479 }
480 
481 fatal(s)
482 	char *s;
483 {
484 	reply(451, "Error in server: %s\n", s);
485 	reply(221, "Closing connection due to server error.");
486 	exit(0);
487 }
488 
489 reply(n, s, args)
490 	int n;
491 	char *s;
492 {
493 
494 	printf("%d ", n);
495 	_doprnt(s, &args, stdout);
496 	printf("\r\n");
497 	fflush(stdout);
498 	if (debug) {
499 		fprintf(stderr, "<--- %d ", n);
500 		_doprnt(s, &args, stderr);
501 		fprintf(stderr, "\n");
502 		fflush(stderr);
503 	}
504 }
505 
506 lreply(n, s, args)
507 	int n;
508 	char *s;
509 {
510 	printf("%d-", n);
511 	_doprnt(s, &args, stdout);
512 	printf("\r\n");
513 	fflush(stdout);
514 	if (debug) {
515 		fprintf(stderr, "<--- %d-", n);
516 		_doprnt(s, &args, stderr);
517 		fprintf(stderr, "\n");
518 	}
519 }
520 
521 replystr(s)
522 	char *s;
523 {
524 	printf("%s\r\n", s);
525 	fflush(stdout);
526 	if (debug)
527 		fprintf(stderr, "<--- %s\n", s);
528 }
529 
530 ack(s)
531 	char *s;
532 {
533 	reply(200, "%s command okay.", s);
534 }
535 
536 nack(s)
537 	char *s;
538 {
539 	reply(502, "%s command not implemented.", s);
540 }
541 
542 yyerror()
543 {
544 	reply(500, "Command not understood.");
545 }
546 
547 delete(name)
548 	char *name;
549 {
550 	struct stat st;
551 
552 	if (stat(name, &st) < 0) {
553 		reply(550, "%s: %s.", name, sys_errlist[errno]);
554 		return;
555 	}
556 	if ((st.st_mode&S_IFMT) == S_IFDIR) {
557 		if (rmdir(name) < 0) {
558 			reply(550, "%s: %s.", name, sys_errlist[errno]);
559 			return;
560 		}
561 		goto done;
562 	}
563 	if (unlink(name) < 0) {
564 		reply(550, "%s: %s.", name, sys_errlist[errno]);
565 		return;
566 	}
567 done:
568 	ack("DELE");
569 }
570 
571 cwd(path)
572 	char *path;
573 {
574 
575 	if (chdir(path) < 0) {
576 		reply(550, "%s: %s.", path, sys_errlist[errno]);
577 		return;
578 	}
579 	ack("CWD");
580 }
581 
582 makedir(name)
583 	char *name;
584 {
585 	struct stat st;
586 	int dochown = stat(name, &st) < 0;
587 
588 	if (mkdir(name, 0777) < 0) {
589 		reply(550, "%s: %s.", name, sys_errlist[errno]);
590 		return;
591 	}
592 	if (dochown)
593 		(void) chown(name, pw->pw_uid, -1);
594 	ack("MKDIR");
595 }
596 
597 removedir(name)
598 	char *name;
599 {
600 
601 	if (rmdir(name) < 0) {
602 		reply(550, "%s: %s.", name, sys_errlist[errno]);
603 		return;
604 	}
605 	ack("RMDIR");
606 }
607 
608 pwd()
609 {
610 	char path[MAXPATHLEN + 1];
611 	char *p;
612 
613 	if (getwd(path) == NULL) {
614 		reply(451, "%s.", path);
615 		return;
616 	}
617 	reply(251, "\"%s\" is current directory.", path);
618 }
619 
620 char *
621 renamefrom(name)
622 	char *name;
623 {
624 	struct stat st;
625 
626 	if (stat(name, &st) < 0) {
627 		reply(550, "%s: %s.", name, sys_errlist[errno]);
628 		return ((char *)0);
629 	}
630 	reply(350, "File exists, ready for destination name");
631 	return (name);
632 }
633 
634 renamecmd(from, to)
635 	char *from, *to;
636 {
637 
638 	if (rename(from, to) < 0) {
639 		reply(550, "rename: %s.", sys_errlist[errno]);
640 		return;
641 	}
642 	ack("RNTO");
643 }
644 
645 int guest;
646 /*
647  * Test pathname for guest-user safety.
648  */
649 inappropriate_request(name)
650 	char *name;
651 {
652 	int bogus = 0, depth = 0, length = strlen(name);
653 	char *p, *s;
654 
655 	if (!guest)
656 		return (0);
657 	if (name[0] == '/' || name[0] == '|')
658 		bogus = 1;
659 	for (p = name; p < name+length;) {
660 		s = p;				/* start of token */
661 		while ( *p && *p!= '/')
662 			p++;
663 		*p = 0;
664 		if (strcmp(s, "..") == 0)
665 			depth -= 1;		/* backing up */
666 		else if (strcmp(s, ".") == 0)
667 			depth += 0;		/* no change */
668 		else
669 			depth += 1;		/* descending */
670 		if (depth < 0) {
671 			bogus = 1;
672 			break;
673 		}
674 	}
675 	if (bogus)
676 		reply(553, "%s: pathname disallowed guest users", name);
677 	return (bogus);
678 }
679 
680 /*
681  * Convert network-format internet address
682  * to base 256 d.d.d.d representation.
683  */
684 char *
685 ntoa(in)
686 	struct in_addr in;
687 {
688 	static char b[18];
689 	register char *p;
690 
691 	in.s_addr = ntohl(in.s_addr);
692 	p = (char *)&in;
693 #define	UC(b)	(((int)b)&0xff)
694 	sprintf(b, "%d.%d.%d.%d", UC(p[0]), UC(p[1]), UC(p[2]), UC(p[3]));
695 	return (b);
696 }
697 
698 dolog(sin)
699 	struct sockaddr_in *sin;
700 {
701 	struct hostent *hp = gethostbyaddr(&sin->sin_addr,
702 		sizeof (struct in_addr), AF_INET);
703 	char *remotehost;
704 	time_t t;
705 
706 	if (hp)
707 		remotehost = hp->h_name;
708 	else
709 		remotehost = "UNKNOWNHOST";
710 	t = time(0);
711 	fprintf(stderr,"FTP: connection from %s at %s", remotehost, ctime(&t));
712 	fflush(stderr);
713 }
714