xref: /csrg-svn/libexec/ftpd/ftpd.c (revision 38158)
1 /*
2  * Copyright (c) 1985, 1988 Regents of the University of California.
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms are permitted
6  * provided that the above copyright notice and this paragraph are
7  * duplicated in all such forms and that any documentation,
8  * advertising materials, and other materials related to such
9  * distribution and use acknowledge that the software was developed
10  * by the University of California, Berkeley.  The name of the
11  * University may not be used to endorse or promote products derived
12  * from this software without specific prior written permission.
13  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
14  * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
15  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
16  */
17 
18 #ifndef lint
19 char copyright[] =
20 "@(#) Copyright (c) 1985, 1988 Regents of the University of California.\n\
21  All rights reserved.\n";
22 #endif /* not lint */
23 
24 #ifndef lint
25 static char sccsid[] = "@(#)ftpd.c	5.30	(Berkeley) 05/28/89";
26 #endif /* not lint */
27 
28 /*
29  * FTP server.
30  */
31 #include <sys/param.h>
32 #include <sys/stat.h>
33 #include <sys/ioctl.h>
34 #include <sys/socket.h>
35 #include <sys/file.h>
36 #include <sys/wait.h>
37 #include <sys/dir.h>
38 
39 #include <netinet/in.h>
40 
41 #define	FTP_NAMES
42 #include <arpa/ftp.h>
43 #include <arpa/inet.h>
44 #include <arpa/telnet.h>
45 
46 #include <ctype.h>
47 #include <stdio.h>
48 #include <signal.h>
49 #include <pwd.h>
50 #include <setjmp.h>
51 #include <netdb.h>
52 #include <errno.h>
53 #include <strings.h>
54 #include <syslog.h>
55 #include <varargs.h>
56 #include "pathnames.h"
57 
58 /*
59  * File containing login names
60  * NOT to be used on this machine.
61  * Commonly used to disallow uucp.
62  */
63 extern	int errno;
64 extern	char *sys_errlist[];
65 extern	int sys_nerr;
66 extern	char *crypt();
67 extern	char version[];
68 extern	char *home;		/* pointer to home directory for glob */
69 extern	FILE *ftpd_popen(), *fopen(), *freopen();
70 extern	int  ftpd_pclose(), fclose();
71 extern	char *getline();
72 extern	char cbuf[];
73 extern	off_t restart_point;
74 
75 struct	sockaddr_in ctrl_addr;
76 struct	sockaddr_in data_source;
77 struct	sockaddr_in data_dest;
78 struct	sockaddr_in his_addr;
79 struct	sockaddr_in pasv_addr;
80 
81 int	data;
82 jmp_buf	errcatch, urgcatch;
83 int	logged_in;
84 struct	passwd *pw;
85 int	debug;
86 int	timeout = 900;    /* timeout after 15 minutes of inactivity */
87 int	maxtimeout = 7200;/* don't allow idle time to be set beyond 2 hours */
88 int	logging;
89 int	guest;
90 int	type;
91 int	form;
92 int	stru;			/* avoid C keyword */
93 int	mode;
94 int	usedefault = 1;		/* for data transfers */
95 int	pdata = -1;		/* for passive mode */
96 int	transflag;
97 off_t	file_size;
98 off_t	byte_count;
99 #if !defined(CMASK) || CMASK == 0
100 #undef CMASK
101 #define CMASK 027
102 #endif
103 int	defumask = CMASK;		/* default umask value */
104 char	tmpline[7];
105 char	hostname[MAXHOSTNAMELEN];
106 char	remotehost[MAXHOSTNAMELEN];
107 
108 /*
109  * Timeout intervals for retrying connections
110  * to hosts that don't accept PORT cmds.  This
111  * is a kludge, but given the problems with TCP...
112  */
113 #define	SWAITMAX	90	/* wait at most 90 seconds */
114 #define	SWAITINT	5	/* interval between retries */
115 
116 int	swaitmax = SWAITMAX;
117 int	swaitint = SWAITINT;
118 
119 int	lostconn();
120 int	myoob();
121 FILE	*getdatasock(), *dataconn();
122 
123 #ifdef SETPROCTITLE
124 char	**Argv = NULL;		/* pointer to argument vector */
125 char	*LastArgv = NULL;	/* end of argv */
126 char	proctitle[BUFSIZ];	/* initial part of title */
127 #endif /* SETPROCTITLE */
128 
129 main(argc, argv, envp)
130 	int argc;
131 	char *argv[];
132 	char **envp;
133 {
134 	int addrlen, on = 1;
135 	char *cp;
136 
137 	addrlen = sizeof (his_addr);
138 	if (getpeername(0, (struct sockaddr *)&his_addr, &addrlen) < 0) {
139 		syslog(LOG_ERR, "getpeername (%s): %m",argv[0]);
140 		exit(1);
141 	}
142 	addrlen = sizeof (ctrl_addr);
143 	if (getsockname(0, (struct sockaddr *)&ctrl_addr, &addrlen) < 0) {
144 		syslog(LOG_ERR, "getsockname (%s): %m",argv[0]);
145 		exit(1);
146 	}
147 	data_source.sin_port = htons(ntohs(ctrl_addr.sin_port) - 1);
148 	debug = 0;
149 	openlog("ftpd", LOG_PID, LOG_DAEMON);
150 #ifdef SETPROCTITLE
151 	/*
152 	 *  Save start and extent of argv for setproctitle.
153 	 */
154 	Argv = argv;
155 	while (*envp)
156 		envp++;
157 	LastArgv = envp[-1] + strlen(envp[-1]);
158 #endif /* SETPROCTITLE */
159 
160 	argc--, argv++;
161 	while (argc > 0 && *argv[0] == '-') {
162 		for (cp = &argv[0][1]; *cp; cp++) switch (*cp) {
163 
164 		case 'v':
165 			debug = 1;
166 			break;
167 
168 		case 'd':
169 			debug = 1;
170 			break;
171 
172 		case 'l':
173 			logging = 1;
174 			break;
175 
176 		case 't':
177 			timeout = atoi(++cp);
178 			if (maxtimeout < timeout)
179 				maxtimeout = timeout;
180 			goto nextopt;
181 
182 		case 'T':
183 			maxtimeout = atoi(++cp);
184 			if (timeout > maxtimeout)
185 				timeout = maxtimeout;
186 			goto nextopt;
187 
188 		case 'u':
189 		    {
190 			int val = 0;
191 
192 			while (*++cp && *cp >= '0' && *cp <= '9')
193 				val = val*8 + *cp - '0';
194 			if (*cp)
195 				fprintf(stderr, "ftpd: Bad value for -u\n");
196 			else
197 				defumask = val;
198 			goto nextopt;
199 		    }
200 
201 		default:
202 			fprintf(stderr, "ftpd: Unknown flag -%c ignored.\n",
203 			     *cp);
204 			break;
205 		}
206 nextopt:
207 		argc--, argv++;
208 	}
209 	(void) freopen(_PATH_DEVNULL, "w", stderr);
210 	(void) signal(SIGPIPE, lostconn);
211 	(void) signal(SIGCHLD, SIG_IGN);
212 	if ((int)signal(SIGURG, myoob) < 0)
213 		syslog(LOG_ERR, "signal: %m");
214 
215 	/* Try to handle urgent data inline */
216 #ifdef SO_OOBINLINE
217 	if (setsockopt(0, SOL_SOCKET, SO_OOBINLINE, (char *)&on, sizeof(on)) < 0)
218 		syslog(LOG_ERR, "setsockopt: %m");
219 #endif
220 
221 #ifdef	F_SETOWN
222 	if (fcntl(fileno(stdin), F_SETOWN, getpid()) == -1)
223 		syslog(LOG_ERR, "fcntl F_SETOWN: %m");
224 #endif
225 	dolog(&his_addr);
226 	/*
227 	 * Set up default state
228 	 */
229 	data = -1;
230 	type = TYPE_A;
231 	form = FORM_N;
232 	stru = STRU_F;
233 	mode = MODE_S;
234 	tmpline[0] = '\0';
235 	(void) gethostname(hostname, sizeof (hostname));
236 	reply(220, "%s FTP server (%s) ready.", hostname, version);
237 	(void) setjmp(errcatch);
238 	for (;;)
239 		(void) yyparse();
240 	/* NOTREACHED */
241 }
242 
243 lostconn()
244 {
245 
246 	if (debug)
247 		syslog(LOG_DEBUG, "lost connection");
248 	dologout(-1);
249 }
250 
251 static char ttyline[20];
252 
253 /*
254  * Helper function for sgetpwnam().
255  */
256 char *
257 sgetsave(s)
258 	char *s;
259 {
260 	char *malloc();
261 	char *new = malloc((unsigned) strlen(s) + 1);
262 
263 	if (new == NULL) {
264 		perror_reply(421, "Local resource failure: malloc");
265 		dologout(1);
266 		/* NOTREACHED */
267 	}
268 	(void) strcpy(new, s);
269 	return (new);
270 }
271 
272 /*
273  * Save the result of a getpwnam.  Used for USER command, since
274  * the data returned must not be clobbered by any other command
275  * (e.g., globbing).
276  */
277 struct passwd *
278 sgetpwnam(name)
279 	char *name;
280 {
281 	static struct passwd save;
282 	register struct passwd *p;
283 	char *sgetsave();
284 
285 	if ((p = getpwnam(name)) == NULL)
286 		return (p);
287 	if (save.pw_name) {
288 		free(save.pw_name);
289 		free(save.pw_passwd);
290 		free(save.pw_gecos);
291 		free(save.pw_dir);
292 		free(save.pw_shell);
293 	}
294 	save = *p;
295 	save.pw_name = sgetsave(p->pw_name);
296 	save.pw_passwd = sgetsave(p->pw_passwd);
297 	save.pw_gecos = sgetsave(p->pw_gecos);
298 	save.pw_dir = sgetsave(p->pw_dir);
299 	save.pw_shell = sgetsave(p->pw_shell);
300 	return (&save);
301 }
302 
303 int login_attempts;		/* number of failed login attempts */
304 int askpasswd;			/* had user command, ask for passwd */
305 
306 /*
307  * USER command.
308  * Sets global passwd pointer pw if named account exists
309  * and is acceptable; sets askpasswd if a PASS command is
310  * expected. If logged in previously, need to reset state.
311  * If name is "ftp" or "anonymous" and ftp account exists,
312  * set guest and pw, then just return.
313  * If account doesn't exist, ask for passwd anyway.
314  * Otherwise, check user requesting login privileges.
315  * Disallow anyone who does not have a standard
316  * shell as returned by getusershell().
317  * Disallow anyone mentioned in the file _PATH_FTPUSERS
318  * to allow people such as root and uucp to be avoided.
319  */
320 user(name)
321 	char *name;
322 {
323 	register char *cp;
324 	FILE *fd;
325 	char *shell;
326 	char line[BUFSIZ], *getusershell();
327 
328 	if (logged_in) {
329 		if (guest) {
330 			reply(530, "Can't change user from guest login.");
331 			return;
332 		}
333 		end_login();
334 	}
335 
336 	guest = 0;
337 	if (strcmp(name, "ftp") == 0 || strcmp(name, "anonymous") == 0) {
338 		if ((pw = sgetpwnam("ftp")) != NULL) {
339 			guest = 1;
340 			askpasswd = 1;
341 			reply(331, "Guest login ok, send ident as password.");
342 		} else
343 			reply(530, "User %s unknown.", name);
344 		return;
345 	}
346 	if (pw = sgetpwnam(name)) {
347 		if ((shell = pw->pw_shell) == NULL || *shell == 0)
348 			shell = _PATH_BSHELL;
349 		while ((cp = getusershell()) != NULL)
350 			if (strcmp(cp, shell) == 0)
351 				break;
352 		endusershell();
353 		if (cp == NULL) {
354 			reply(530, "User %s access denied.", name);
355 			if (logging)
356 				syslog(LOG_NOTICE,
357 				    "FTP LOGIN REFUSED FROM %s, %s",
358 				    remotehost, name);
359 			pw = (struct passwd *) NULL;
360 			return;
361 		}
362 		if ((fd = fopen(_PATH_FTPUSERS, "r")) != NULL) {
363 		    while (fgets(line, sizeof (line), fd) != NULL) {
364 			if ((cp = index(line, '\n')) != NULL)
365 				*cp = '\0';
366 			if (strcmp(line, name) == 0) {
367 				reply(530, "User %s access denied.", name);
368 				if (logging)
369 					syslog(LOG_NOTICE,
370 					    "FTP LOGIN REFUSED FROM %s, %s",
371 					    remotehost, name);
372 				pw = (struct passwd *) NULL;
373 				(void) fclose(fd);
374 				return;
375 			}
376 		    }
377 		    (void) fclose(fd);
378 		}
379 	}
380 	reply(331, "Password required for %s.", name);
381 	askpasswd = 1;
382 	/*
383 	 * Delay before reading passwd after first failed
384 	 * attempt to slow down passwd-guessing programs.
385 	 */
386 	if (login_attempts)
387 		sleep((unsigned) login_attempts);
388 }
389 
390 /*
391  * Terminate login as previous user, if any, resetting state;
392  * used when USER command is given or login fails.
393  */
394 end_login()
395 {
396 
397 	(void) seteuid((uid_t)0);
398 	if (logged_in)
399 		logwtmp(ttyline, "", "");
400 	pw = NULL;
401 	logged_in = 0;
402 	guest = 0;
403 }
404 
405 pass(passwd)
406 	char *passwd;
407 {
408 	char *xpasswd, *salt;
409 
410 	if (logged_in || askpasswd == 0) {
411 		reply(503, "Login with USER first.");
412 		return;
413 	}
414 	askpasswd = 0;
415 	if (!guest) {		/* "ftp" is only account allowed no password */
416 		if (pw == NULL)
417 			salt = "xx";
418 		else
419 			salt = pw->pw_passwd;
420 		xpasswd = crypt(passwd, salt);
421 		/* The strcmp does not catch null passwords! */
422 		if (pw == NULL || *pw->pw_passwd == '\0' ||
423 		    strcmp(xpasswd, pw->pw_passwd)) {
424 			reply(530, "Login incorrect.");
425 			pw = NULL;
426 			if (login_attempts++ >= 5) {
427 				syslog(LOG_NOTICE,
428 				    "repeated login failures from %s",
429 				    remotehost);
430 				exit(0);
431 			}
432 			return;
433 		}
434 	}
435 	login_attempts = 0;		/* this time successful */
436 	(void) setegid((gid_t)pw->pw_gid);
437 	(void) initgroups(pw->pw_name, pw->pw_gid);
438 
439 	/* open wtmp before chroot */
440 	(void)sprintf(ttyline, "ftp%d", getpid());
441 	logwtmp(ttyline, pw->pw_name, remotehost);
442 	logged_in = 1;
443 
444 	if (guest) {
445 		/*
446 		 * We MUST do a chdir() after the chroot. Otherwise
447 		 * the old current directory will be accessible as "."
448 		 * outside the new root!
449 		 */
450 		if (chroot(pw->pw_dir) < 0 || chdir("/") < 0) {
451 			reply(550, "Can't set guest privileges.");
452 			goto bad;
453 		}
454 	} else if (chdir(pw->pw_dir) < 0) {
455 		if (chdir("/") < 0) {
456 			reply(530, "User %s: can't change directory to %s.",
457 			    pw->pw_name, pw->pw_dir);
458 			goto bad;
459 		} else
460 			lreply(230, "No directory! Logging in with home=/");
461 	}
462 	if (seteuid((uid_t)pw->pw_uid) < 0) {
463 		reply(550, "Can't set uid.");
464 		goto bad;
465 	}
466 	if (guest) {
467 		reply(230, "Guest login ok, access restrictions apply.");
468 #ifdef SETPROCTITLE
469 		sprintf(proctitle, "%s: anonymous/%.*s", remotehost,
470 		    sizeof(proctitle) - sizeof(remotehost) -
471 		    sizeof(": anonymous/"), passwd);
472 		setproctitle(proctitle);
473 #endif /* SETPROCTITLE */
474 		if (logging)
475 			syslog(LOG_INFO, "ANONYMOUS FTP LOGIN FROM %s, %s",
476 			    remotehost, passwd);
477 	} else {
478 		reply(230, "User %s logged in.", pw->pw_name);
479 #ifdef SETPROCTITLE
480 		sprintf(proctitle, "%s: %s", remotehost, pw->pw_name);
481 		setproctitle(proctitle);
482 #endif /* SETPROCTITLE */
483 		if (logging)
484 			syslog(LOG_INFO, "FTP LOGIN FROM %s, %s",
485 			    remotehost, pw->pw_name);
486 	}
487 	home = pw->pw_dir;		/* home dir for globbing */
488 	(void) umask(defumask);
489 	return;
490 bad:
491 	/* Forget all about it... */
492 	end_login();
493 }
494 
495 retrieve(cmd, name)
496 	char *cmd, *name;
497 {
498 	FILE *fin, *dout;
499 	struct stat st;
500 	int (*closefunc)();
501 
502 	if (cmd == 0) {
503 		fin = fopen(name, "r"), closefunc = fclose;
504 		st.st_size = 0;
505 	} else {
506 		char line[BUFSIZ];
507 
508 		(void) sprintf(line, cmd, name), name = line;
509 		fin = ftpd_popen(line, "r"), closefunc = ftpd_pclose;
510 		st.st_size = -1;
511 		st.st_blksize = BUFSIZ;
512 	}
513 	if (fin == NULL) {
514 		if (errno != 0)
515 			perror_reply(550, name);
516 		return;
517 	}
518 	if (cmd == 0 &&
519 	    (fstat(fileno(fin), &st) < 0 || (st.st_mode&S_IFMT) != S_IFREG)) {
520 		reply(550, "%s: not a plain file.", name);
521 		goto done;
522 	}
523 	if (restart_point) {
524 		if (type == TYPE_A) {
525 			register int i, n, c;
526 
527 			n = restart_point;
528 			i = 0;
529 			while (i++ < n) {
530 				if ((c=getc(fin)) == EOF) {
531 					perror_reply(550, name);
532 					goto done;
533 				}
534 				if (c == '\n')
535 					i++;
536 			}
537 		} else if (lseek(fileno(fin), restart_point, L_SET) < 0) {
538 			perror_reply(550, name);
539 			goto done;
540 		}
541 	}
542 	dout = dataconn(name, st.st_size, "w");
543 	if (dout == NULL)
544 		goto done;
545 	send_data(fin, dout, st.st_blksize);
546 	(void) fclose(dout);
547 	data = -1;
548 	pdata = -1;
549 done:
550 	(*closefunc)(fin);
551 }
552 
553 store(name, mode, unique)
554 	char *name, *mode;
555 	int unique;
556 {
557 	FILE *fout, *din;
558 	struct stat st;
559 	int (*closefunc)();
560 	char *gunique();
561 
562 	if (unique && stat(name, &st) == 0 &&
563 	    (name = gunique(name)) == NULL)
564 		return;
565 
566 	if (restart_point)
567 		mode = "r+w";
568 	fout = fopen(name, mode);
569 	closefunc = fclose;
570 	if (fout == NULL) {
571 		perror_reply(553, name);
572 		return;
573 	}
574 	if (restart_point) {
575 		if (type == TYPE_A) {
576 			register int i, n, c;
577 
578 			n = restart_point;
579 			i = 0;
580 			while (i++ < n) {
581 				if ((c=getc(fout)) == EOF) {
582 					perror_reply(550, name);
583 					goto done;
584 				}
585 				if (c == '\n')
586 					i++;
587 			}
588 			/*
589 			 * We must do this seek to "current" position
590 			 * because we are changing from reading to
591 			 * writing.
592 			 */
593 			if (fseek(fout, 0L, L_INCR) < 0) {
594 				perror_reply(550, name);
595 				goto done;
596 			}
597 		} else if (lseek(fileno(fout), restart_point, L_SET) < 0) {
598 			perror_reply(550, name);
599 			goto done;
600 		}
601 	}
602 	din = dataconn(name, (off_t)-1, "r");
603 	if (din == NULL)
604 		goto done;
605 	if (receive_data(din, fout) == 0) {
606 		if (unique)
607 			reply(226, "Transfer complete (unique file name:%s).",
608 			    name);
609 		else
610 			reply(226, "Transfer complete.");
611 	}
612 	(void) fclose(din);
613 	data = -1;
614 	pdata = -1;
615 done:
616 	(*closefunc)(fout);
617 }
618 
619 FILE *
620 getdatasock(mode)
621 	char *mode;
622 {
623 	int s, on = 1, tries;
624 
625 	if (data >= 0)
626 		return (fdopen(data, mode));
627 	s = socket(AF_INET, SOCK_STREAM, 0);
628 	if (s < 0)
629 		return (NULL);
630 	(void) seteuid((uid_t)0);
631 	if (setsockopt(s, SOL_SOCKET, SO_REUSEADDR,
632 	    (char *) &on, sizeof (on)) < 0)
633 		goto bad;
634 	/* anchor socket to avoid multi-homing problems */
635 	data_source.sin_family = AF_INET;
636 	data_source.sin_addr = ctrl_addr.sin_addr;
637 	for (tries = 1; ; tries++) {
638 		if (bind(s, (struct sockaddr *)&data_source,
639 		    sizeof (data_source)) >= 0)
640 			break;
641 		if (errno != EADDRINUSE || tries > 10)
642 			goto bad;
643 		sleep(tries);
644 	}
645 	(void) seteuid((uid_t)pw->pw_uid);
646 	return (fdopen(s, mode));
647 bad:
648 	(void) seteuid((uid_t)pw->pw_uid);
649 	(void) close(s);
650 	return (NULL);
651 }
652 
653 FILE *
654 dataconn(name, size, mode)
655 	char *name;
656 	off_t size;
657 	char *mode;
658 {
659 	char sizebuf[32];
660 	FILE *file;
661 	int retry = 0;
662 
663 	file_size = size;
664 	byte_count = 0;
665 	if (size != (off_t) -1)
666 		(void) sprintf (sizebuf, " (%ld bytes)", size);
667 	else
668 		(void) strcpy(sizebuf, "");
669 	if (pdata >= 0) {
670 		struct sockaddr_in from;
671 		int s, fromlen = sizeof(from);
672 
673 		s = accept(pdata, (struct sockaddr *)&from, &fromlen);
674 		if (s < 0) {
675 			reply(425, "Can't open data connection.");
676 			(void) close(pdata);
677 			pdata = -1;
678 			return(NULL);
679 		}
680 		(void) close(pdata);
681 		pdata = s;
682 		reply(150, "Opening %s mode data connection for %s%s.",
683 		     type == TYPE_A ? "ASCII" : "BINARY", name, sizebuf);
684 		return(fdopen(pdata, mode));
685 	}
686 	if (data >= 0) {
687 		reply(125, "Using existing data connection for %s%s.",
688 		    name, sizebuf);
689 		usedefault = 1;
690 		return (fdopen(data, mode));
691 	}
692 	if (usedefault)
693 		data_dest = his_addr;
694 	usedefault = 1;
695 	file = getdatasock(mode);
696 	if (file == NULL) {
697 		reply(425, "Can't create data socket (%s,%d): %s.",
698 		    inet_ntoa(data_source.sin_addr),
699 		    ntohs(data_source.sin_port),
700 		    errno < sys_nerr ? sys_errlist[errno] : "unknown error");
701 		return (NULL);
702 	}
703 	data = fileno(file);
704 	while (connect(data, (struct sockaddr *)&data_dest,
705 	    sizeof (data_dest)) < 0) {
706 		if (errno == EADDRINUSE && retry < swaitmax) {
707 			sleep((unsigned) swaitint);
708 			retry += swaitint;
709 			continue;
710 		}
711 		perror_reply(425, "Can't build data connection");
712 		(void) fclose(file);
713 		data = -1;
714 		return (NULL);
715 	}
716 	reply(150, "Opening %s mode data connection for %s%s.",
717 	     type == TYPE_A ? "ASCII" : "BINARY", name, sizebuf);
718 	return (file);
719 }
720 
721 /*
722  * Tranfer the contents of "instr" to
723  * "outstr" peer using the appropriate
724  * encapsulation of the data subject
725  * to Mode, Structure, and Type.
726  *
727  * NB: Form isn't handled.
728  */
729 send_data(instr, outstr, blksize)
730 	FILE *instr, *outstr;
731 	off_t blksize;
732 {
733 	register int c, cnt;
734 	register char *buf;
735 	int netfd, filefd;
736 
737 	transflag++;
738 	if (setjmp(urgcatch)) {
739 		transflag = 0;
740 		return;
741 	}
742 	switch (type) {
743 
744 	case TYPE_A:
745 		while ((c = getc(instr)) != EOF) {
746 			byte_count++;
747 			if (c == '\n') {
748 				if (ferror(outstr))
749 					goto data_err;
750 				(void) putc('\r', outstr);
751 			}
752 			(void) putc(c, outstr);
753 		}
754 		fflush(outstr);
755 		transflag = 0;
756 		if (ferror(instr))
757 			goto file_err;
758 		if (ferror(outstr))
759 			goto data_err;
760 		reply(226, "Transfer complete.");
761 		return;
762 
763 	case TYPE_I:
764 	case TYPE_L:
765 		if ((buf = malloc((u_int)blksize)) == NULL) {
766 			transflag = 0;
767 			perror_reply(451, "Local resource failure: malloc");
768 			return;
769 		}
770 		netfd = fileno(outstr);
771 		filefd = fileno(instr);
772 		while ((cnt = read(filefd, buf, (u_int)blksize)) > 0 &&
773 		    write(netfd, buf, cnt) == cnt)
774 			byte_count += cnt;
775 		transflag = 0;
776 		(void)free(buf);
777 		if (cnt != 0) {
778 			if (cnt < 0)
779 				goto file_err;
780 			goto data_err;
781 		}
782 		reply(226, "Transfer complete.");
783 		return;
784 	default:
785 		transflag = 0;
786 		reply(550, "Unimplemented TYPE %d in send_data", type);
787 		return;
788 	}
789 
790 data_err:
791 	transflag = 0;
792 	perror_reply(426, "Data connection");
793 	return;
794 
795 file_err:
796 	transflag = 0;
797 	perror_reply(551, "Error on input file");
798 }
799 
800 /*
801  * Transfer data from peer to
802  * "outstr" using the appropriate
803  * encapulation of the data subject
804  * to Mode, Structure, and Type.
805  *
806  * N.B.: Form isn't handled.
807  */
808 receive_data(instr, outstr)
809 	FILE *instr, *outstr;
810 {
811 	register int c;
812 	int cnt, bare_lfs = 0;
813 	char buf[BUFSIZ];
814 
815 	transflag++;
816 	if (setjmp(urgcatch)) {
817 		transflag = 0;
818 		return (-1);
819 	}
820 	switch (type) {
821 
822 	case TYPE_I:
823 	case TYPE_L:
824 		while ((cnt = read(fileno(instr), buf, sizeof buf)) > 0) {
825 			if (write(fileno(outstr), buf, cnt) != cnt)
826 				goto file_err;
827 			byte_count += cnt;
828 		}
829 		if (cnt < 0)
830 			goto data_err;
831 		transflag = 0;
832 		return (0);
833 
834 	case TYPE_E:
835 		reply(553, "TYPE E not implemented.");
836 		transflag = 0;
837 		return (-1);
838 
839 	case TYPE_A:
840 		while ((c = getc(instr)) != EOF) {
841 			byte_count++;
842 			if (c == '\n')
843 				bare_lfs++;
844 			while (c == '\r') {
845 				if (ferror(outstr))
846 					goto data_err;
847 				if ((c = getc(instr)) != '\n') {
848 					(void) putc ('\r', outstr);
849 					if (c == '\0' || c == EOF)
850 						goto contin2;
851 				}
852 			}
853 			(void) putc(c, outstr);
854 	contin2:	;
855 		}
856 		fflush(outstr);
857 		if (ferror(instr))
858 			goto data_err;
859 		if (ferror(outstr))
860 			goto file_err;
861 		transflag = 0;
862 		if (bare_lfs) {
863 			lreply(230, "WARNING! %d bare linefeeds received in ASCII mode", bare_lfs);
864 			printf("   File may not have transferred correctly.\r\n");
865 		}
866 		return (0);
867 	default:
868 		reply(550, "Unimplemented TYPE %d in receive_data", type);
869 		transflag = 0;
870 		return (-1);
871 	}
872 
873 data_err:
874 	transflag = 0;
875 	perror_reply(426, "Data Connection");
876 	return (-1);
877 
878 file_err:
879 	transflag = 0;
880 	perror_reply(452, "Error writing file");
881 	return (-1);
882 }
883 
884 statfilecmd(filename)
885 	char *filename;
886 {
887 	char line[BUFSIZ];
888 	FILE *fin;
889 	int c;
890 
891 	(void) sprintf(line, "/bin/ls -lgA %s", filename);
892 	fin = ftpd_popen(line, "r");
893 	lreply(211, "status of %s:", filename);
894 	while ((c = getc(fin)) != EOF) {
895 		if (c == '\n') {
896 			if (ferror(stdout)){
897 				perror_reply(421, "control connection");
898 				(void) ftpd_pclose(fin);
899 				dologout(1);
900 				/* NOTREACHED */
901 			}
902 			if (ferror(fin)) {
903 				perror_reply(551, filename);
904 				(void) ftpd_pclose(fin);
905 				return;
906 			}
907 			(void) putc('\r', stdout);
908 		}
909 		(void) putc(c, stdout);
910 	}
911 	(void) ftpd_pclose(fin);
912 	reply(211, "End of Status");
913 }
914 
915 statcmd()
916 {
917 	struct sockaddr_in *sin;
918 	u_char *a, *p;
919 
920 	lreply(211, "%s FTP server status:", hostname, version);
921 	printf("     %s\r\n", version);
922 	printf("     Connected to %s", remotehost);
923 	if (!isdigit(remotehost[0]))
924 		printf(" (%s)", inet_ntoa(his_addr.sin_addr));
925 	printf("\r\n");
926 	if (logged_in) {
927 		if (guest)
928 			printf("     Logged in anonymously\r\n");
929 		else
930 			printf("     Logged in as %s\r\n", pw->pw_name);
931 	} else if (askpasswd)
932 		printf("     Waiting for password\r\n");
933 	else
934 		printf("     Waiting for user name\r\n");
935 	printf("     TYPE: %s", typenames[type]);
936 	if (type == TYPE_A || type == TYPE_E)
937 		printf(", FORM: %s", formnames[form]);
938 	if (type == TYPE_L)
939 #if NBBY == 8
940 		printf(" %d", NBBY);
941 #else
942 		printf(" %d", bytesize);	/* need definition! */
943 #endif
944 	printf("; STRUcture: %s; transfer MODE: %s\r\n",
945 	    strunames[stru], modenames[mode]);
946 	if (data != -1)
947 		printf("     Data connection open\r\n");
948 	else if (pdata != -1) {
949 		printf("     in Passive mode");
950 		sin = &pasv_addr;
951 		goto printaddr;
952 	} else if (usedefault == 0) {
953 		printf("     PORT");
954 		sin = &data_dest;
955 printaddr:
956 		a = (u_char *) &sin->sin_addr;
957 		p = (u_char *) &sin->sin_port;
958 #define UC(b) (((int) b) & 0xff)
959 		printf(" (%d,%d,%d,%d,%d,%d)\r\n", UC(a[0]),
960 			UC(a[1]), UC(a[2]), UC(a[3]), UC(p[0]), UC(p[1]));
961 #undef UC
962 	} else
963 		printf("     No data connection\r\n");
964 	reply(211, "End of status");
965 }
966 
967 fatal(s)
968 	char *s;
969 {
970 	reply(451, "Error in server: %s\n", s);
971 	reply(221, "Closing connection due to server error.");
972 	dologout(0);
973 	/* NOTREACHED */
974 }
975 
976 /* VARARGS2 */
977 reply(n, fmt, p0, p1, p2, p3, p4, p5)
978 	int n;
979 	char *fmt;
980 {
981 	printf("%d ", n);
982 	printf(fmt, p0, p1, p2, p3, p4, p5);
983 	printf("\r\n");
984 	(void)fflush(stdout);
985 	if (debug) {
986 		syslog(LOG_DEBUG, "<--- %d ", n);
987 		syslog(LOG_DEBUG, fmt, p0, p1, p2, p3, p4, p5);
988 }
989 }
990 
991 /* VARARGS2 */
992 lreply(n, fmt, p0, p1, p2, p3, p4, p5)
993 	int n;
994 	char *fmt;
995 {
996 	printf("%d- ", n);
997 	printf(fmt, p0, p1, p2, p3, p4, p5);
998 	printf("\r\n");
999 	(void)fflush(stdout);
1000 	if (debug) {
1001 		syslog(LOG_DEBUG, "<--- %d- ", n);
1002 		syslog(LOG_DEBUG, fmt, p0, p1, p2, p3, p4, p5);
1003 	}
1004 }
1005 
1006 ack(s)
1007 	char *s;
1008 {
1009 	reply(250, "%s command successful.", s);
1010 }
1011 
1012 nack(s)
1013 	char *s;
1014 {
1015 	reply(502, "%s command not implemented.", s);
1016 }
1017 
1018 /* ARGSUSED */
1019 yyerror(s)
1020 	char *s;
1021 {
1022 	char *cp;
1023 
1024 	if (cp = index(cbuf,'\n'))
1025 		*cp = '\0';
1026 	reply(500, "'%s': command not understood.", cbuf);
1027 }
1028 
1029 delete(name)
1030 	char *name;
1031 {
1032 	struct stat st;
1033 
1034 	if (stat(name, &st) < 0) {
1035 		perror_reply(550, name);
1036 		return;
1037 	}
1038 	if ((st.st_mode&S_IFMT) == S_IFDIR) {
1039 		if (rmdir(name) < 0) {
1040 			perror_reply(550, name);
1041 			return;
1042 		}
1043 		goto done;
1044 	}
1045 	if (unlink(name) < 0) {
1046 		perror_reply(550, name);
1047 		return;
1048 	}
1049 done:
1050 	ack("DELE");
1051 }
1052 
1053 cwd(path)
1054 	char *path;
1055 {
1056 	if (chdir(path) < 0)
1057 		perror_reply(550, path);
1058 	else
1059 		ack("CWD");
1060 }
1061 
1062 makedir(name)
1063 	char *name;
1064 {
1065 	if (mkdir(name, 0777) < 0)
1066 		perror_reply(550, name);
1067 	else
1068 		reply(257, "MKD command successful.");
1069 }
1070 
1071 removedir(name)
1072 	char *name;
1073 {
1074 	if (rmdir(name) < 0)
1075 		perror_reply(550, name);
1076 	else
1077 		ack("RMD");
1078 }
1079 
1080 pwd()
1081 {
1082 	char path[MAXPATHLEN + 1];
1083 	extern char *getwd();
1084 
1085 	if (getwd(path) == (char *)NULL)
1086 		reply(550, "%s.", path);
1087 	else
1088 		reply(257, "\"%s\" is current directory.", path);
1089 }
1090 
1091 char *
1092 renamefrom(name)
1093 	char *name;
1094 {
1095 	struct stat st;
1096 
1097 	if (stat(name, &st) < 0) {
1098 		perror_reply(550, name);
1099 		return ((char *)0);
1100 	}
1101 	reply(350, "File exists, ready for destination name");
1102 	return (name);
1103 }
1104 
1105 renamecmd(from, to)
1106 	char *from, *to;
1107 {
1108 	if (rename(from, to) < 0)
1109 		perror_reply(550, "rename");
1110 	else
1111 		ack("RNTO");
1112 }
1113 
1114 dolog(sin)
1115 	struct sockaddr_in *sin;
1116 {
1117 	struct hostent *hp = gethostbyaddr((char *)&sin->sin_addr,
1118 		sizeof (struct in_addr), AF_INET);
1119 	time_t t, time();
1120 	extern char *ctime();
1121 
1122 	if (hp)
1123 		(void) strncpy(remotehost, hp->h_name, sizeof (remotehost));
1124 	else
1125 		(void) strncpy(remotehost, inet_ntoa(sin->sin_addr),
1126 		    sizeof (remotehost));
1127 #ifdef SETPROCTITLE
1128 	sprintf(proctitle, "%s: connected", remotehost);
1129 	setproctitle(proctitle);
1130 #endif /* SETPROCTITLE */
1131 
1132 	if (logging) {
1133 		t = time((time_t *) 0);
1134 		syslog(LOG_INFO, "connection from %s at %s",
1135 		    remotehost, ctime(&t));
1136 	}
1137 }
1138 
1139 /*
1140  * Record logout in wtmp file
1141  * and exit with supplied status.
1142  */
1143 dologout(status)
1144 	int status;
1145 {
1146 	if (logged_in) {
1147 		(void) seteuid((uid_t)0);
1148 		logwtmp(ttyline, "", "");
1149 	}
1150 	/* beware of flushing buffers after a SIGPIPE */
1151 	_exit(status);
1152 }
1153 
1154 myoob()
1155 {
1156 	char *cp;
1157 
1158 	/* only process if transfer occurring */
1159 	if (!transflag)
1160 		return;
1161 	cp = tmpline;
1162 	if (getline(cp, 7, stdin) == NULL) {
1163 		reply(221, "You could at least say goodbye.");
1164 		dologout(0);
1165 	}
1166 	upper(cp);
1167 	if (strcmp(cp, "ABOR\r\n") == 0) {
1168 		tmpline[0] = '\0';
1169 		reply(426, "Transfer aborted. Data connection closed.");
1170 		reply(226, "Abort successful");
1171 		longjmp(urgcatch, 1);
1172 	}
1173 	if (strcmp(cp, "STAT\r\n") == 0) {
1174 		if (file_size != (off_t) -1)
1175 			reply(213, "Status: %lu of %lu bytes transferred",
1176 			    byte_count, file_size);
1177 		else
1178 			reply(213, "Status: %lu bytes transferred", byte_count);
1179 	}
1180 }
1181 
1182 /*
1183  * Note: a response of 425 is not mentioned as a possible response to
1184  * 	the PASV command in RFC959. However, it has been blessed as
1185  * 	a legitimate response by Jon Postel in a telephone conversation
1186  *	with Rick Adams on 25 Jan 89.
1187  */
1188 passive()
1189 {
1190 	int len;
1191 	register char *p, *a;
1192 
1193 	pdata = socket(AF_INET, SOCK_STREAM, 0);
1194 	if (pdata < 0) {
1195 		perror_reply(425, "Can't open passive connection");
1196 		return;
1197 	}
1198 	pasv_addr = ctrl_addr;
1199 	pasv_addr.sin_port = 0;
1200 	(void) seteuid((uid_t)0);
1201 	if (bind(pdata, (struct sockaddr *)&pasv_addr, sizeof(pasv_addr)) < 0) {
1202 		(void) seteuid((uid_t)pw->pw_uid);
1203 		goto pasv_error;
1204 	}
1205 	(void) seteuid((uid_t)pw->pw_uid);
1206 	len = sizeof(pasv_addr);
1207 	if (getsockname(pdata, (struct sockaddr *) &pasv_addr, &len) < 0)
1208 		goto pasv_error;
1209 	if (listen(pdata, 1) < 0)
1210 		goto pasv_error;
1211 	a = (char *) &pasv_addr.sin_addr;
1212 	p = (char *) &pasv_addr.sin_port;
1213 
1214 #define UC(b) (((int) b) & 0xff)
1215 
1216 	reply(227, "Entering Passive Mode (%d,%d,%d,%d,%d,%d)", UC(a[0]),
1217 		UC(a[1]), UC(a[2]), UC(a[3]), UC(p[0]), UC(p[1]));
1218 	return;
1219 
1220 pasv_error:
1221 	(void) close(pdata);
1222 	pdata = -1;
1223 	perror_reply(425, "Can't open passive connection");
1224 	return;
1225 }
1226 
1227 /*
1228  * Generate unique name for file with basename "local".
1229  * The file named "local" is already known to exist.
1230  * Generates failure reply on error.
1231  */
1232 char *
1233 gunique(local)
1234 	char *local;
1235 {
1236 	static char new[MAXPATHLEN];
1237 	struct stat st;
1238 	char *cp = rindex(local, '/');
1239 	int count = 0;
1240 
1241 	if (cp)
1242 		*cp = '\0';
1243 	if (stat(cp ? local : ".", &st) < 0) {
1244 		perror_reply(553, cp ? local : ".");
1245 		return((char *) 0);
1246 	}
1247 	if (cp)
1248 		*cp = '/';
1249 	(void) strcpy(new, local);
1250 	cp = new + strlen(new);
1251 	*cp++ = '.';
1252 	for (count = 1; count < 100; count++) {
1253 		(void) sprintf(cp, "%d", count);
1254 		if (stat(new, &st) < 0)
1255 			return(new);
1256 	}
1257 	reply(452, "Unique file name cannot be created.");
1258 	return((char *) 0);
1259 }
1260 
1261 /*
1262  * Format and send reply containing system error number.
1263  */
1264 perror_reply(code, string)
1265 	int code;
1266 	char *string;
1267 {
1268 	if (errno < sys_nerr)
1269 		reply(code, "%s: %s.", string, sys_errlist[errno]);
1270 	else
1271 		reply(code, "%s: unknown error %d.", string, errno);
1272 }
1273 
1274 static char *onefile[] = {
1275 	"",
1276 	0
1277 };
1278 
1279 send_file_list(whichfiles)
1280 	char *whichfiles;
1281 {
1282 	struct stat st;
1283 	DIR *dirp = NULL;
1284 	struct direct *dir;
1285 	FILE *dout = NULL;
1286 	register char **dirlist, *dirname;
1287 	int simple = 0;
1288 	char *strpbrk();
1289 
1290 	if (strpbrk(whichfiles, "~{[*?") != NULL) {
1291 		extern char **glob(), *globerr;
1292 
1293 		globerr = NULL;
1294 		dirlist = glob(whichfiles);
1295 		if (globerr != NULL) {
1296 			reply(550, globerr);
1297 			return;
1298 		} else if (dirlist == NULL) {
1299 			errno = ENOENT;
1300 			perror_reply(550, whichfiles);
1301 			return;
1302 		}
1303 	} else {
1304 		onefile[0] = whichfiles;
1305 		dirlist = onefile;
1306 		simple = 1;
1307 	}
1308 
1309 	if (setjmp(urgcatch)) {
1310 		transflag = 0;
1311 		return;
1312 	}
1313 	while (dirname = *dirlist++) {
1314 		if (stat(dirname, &st) < 0) {
1315 			/*
1316 			 * If user typed "ls -l", etc, and the client
1317 			 * used NLST, do what the user meant.
1318 			 */
1319 			if (dirname[0] == '-' && *dirlist == NULL &&
1320 			    transflag == 0) {
1321 				retrieve("/bin/ls %s", dirname);
1322 				return;
1323 			}
1324 			perror_reply(550, whichfiles);
1325 			if (dout != NULL) {
1326 				(void) fclose(dout);
1327 				transflag = 0;
1328 				data = -1;
1329 				pdata = -1;
1330 			}
1331 			return;
1332 		}
1333 
1334 		if ((st.st_mode&S_IFMT) == S_IFREG) {
1335 			if (dout == NULL) {
1336 				dout = dataconn("file list", (off_t)-1, "w");
1337 				if (dout == NULL)
1338 					return;
1339 				transflag++;
1340 			}
1341 			fprintf(dout, "%s%s\n", dirname,
1342 				type == TYPE_A ? "\r" : "");
1343 			byte_count += strlen(dirname) + 1;
1344 			continue;
1345 		} else if ((st.st_mode&S_IFMT) != S_IFDIR)
1346 			continue;
1347 
1348 		if ((dirp = opendir(dirname)) == NULL)
1349 			continue;
1350 
1351 		while ((dir = readdir(dirp)) != NULL) {
1352 			char nbuf[MAXPATHLEN];
1353 
1354 			if (dir->d_name[0] == '.' && dir->d_namlen == 1)
1355 				continue;
1356 			if (dir->d_name[0] == '.' && dir->d_name[1] == '.' &&
1357 			    dir->d_namlen == 2)
1358 				continue;
1359 
1360 			sprintf(nbuf, "%s/%s", dirname, dir->d_name);
1361 
1362 			/*
1363 			 * We have to do a stat to insure it's
1364 			 * not a directory or special file.
1365 			 */
1366 			if (simple || (stat(nbuf, &st) == 0 &&
1367 			    (st.st_mode&S_IFMT) == S_IFREG)) {
1368 				if (dout == NULL) {
1369 					dout = dataconn("file list", (off_t)-1,
1370 						"w");
1371 					if (dout == NULL)
1372 						return;
1373 					transflag++;
1374 				}
1375 				if (nbuf[0] == '.' && nbuf[1] == '/')
1376 					fprintf(dout, "%s%s\n", &nbuf[2],
1377 						type == TYPE_A ? "\r" : "");
1378 				else
1379 					fprintf(dout, "%s%s\n", nbuf,
1380 						type == TYPE_A ? "\r" : "");
1381 				byte_count += strlen(nbuf) + 1;
1382 			}
1383 		}
1384 		(void) closedir(dirp);
1385 	}
1386 
1387 	if (dout == NULL)
1388 		reply(550, "No files found.");
1389 	else if (ferror(dout) != 0)
1390 		perror_reply(550, "Data connection");
1391 	else
1392 		reply(226, "Transfer complete.");
1393 
1394 	transflag = 0;
1395 	if (dout != NULL)
1396 		(void) fclose(dout);
1397 	data = -1;
1398 	pdata = -1;
1399 }
1400 
1401 #ifdef SETPROCTITLE
1402 /*
1403  * clobber argv so ps will show what we're doing.
1404  * (stolen from sendmail)
1405  * warning, since this is usually started from inetd.conf, it
1406  * often doesn't have much of an environment or arglist to overwrite.
1407  */
1408 
1409 /*VARARGS1*/
1410 setproctitle(fmt, a, b, c)
1411 char *fmt;
1412 {
1413 	register char *p, *bp, ch;
1414 	register int i;
1415 	char buf[BUFSIZ];
1416 
1417 	(void) sprintf(buf, fmt, a, b, c);
1418 
1419 	/* make ps print our process name */
1420 	p = Argv[0];
1421 	*p++ = '-';
1422 
1423 	i = strlen(buf);
1424 	if (i > LastArgv - p - 2) {
1425 		i = LastArgv - p - 2;
1426 		buf[i] = '\0';
1427 	}
1428 	bp = buf;
1429 	while (ch = *bp++)
1430 		if (ch != '\n' && ch != '\r')
1431 			*p++ = ch;
1432 	while (p < LastArgv)
1433 		*p++ = ' ';
1434 }
1435 #endif /* SETPROCTITLE */
1436