From owner-freebsd-ports  Mon Jun 19 17:20: 6 2000
Delivered-To: freebsd-ports@freebsd.org
Received: from freefall.freebsd.org (freefall.FreeBSD.ORG [204.216.27.21])
	by hub.freebsd.org (Postfix) with ESMTP id 2BDB337B555
	for <freebsd-ports@FreeBSD.org>; Mon, 19 Jun 2000 17:20:01 -0700 (PDT)
	(envelope-from gnats@FreeBSD.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.9.3/8.9.2) id RAA72823;
	Mon, 19 Jun 2000 17:20:01 -0700 (PDT)
	(envelope-from gnats@FreeBSD.org)
Received: by hub.freebsd.org (Postfix, from userid 32767)
	id 4F1C437B95F; Mon, 19 Jun 2000 17:10:15 -0700 (PDT)
Message-Id: <20000620001015.4F1C437B95F@hub.freebsd.org>
Date: Mon, 19 Jun 2000 17:10:15 -0700 (PDT)
From: isv@false.vmts.ru
To: freebsd-gnats-submit@FreeBSD.org
X-Send-Pr-Version: www-1.0
Subject: ports/19390: non connect virtual hosting support in ftpd daemon
Sender: owner-freebsd-ports@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org


>Number:         19390
>Category:       ports
>Synopsis:       non connect virtual hosting support in ftpd daemon
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    freebsd-ports
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Jun 19 17:20:00 PDT 2000
>Closed-Date:
>Last-Modified:
>Originator:     Sergey Ivanov
>Release:        Release 4.0
>Organization:
VMTS
>Environment:
4.0-RELEASE FreeBSD 4.0-RELEASE #0: Fri Jun 16 11:05:56 VLAST 2000 
>Description:
FreeBSD ftp daemon have bugs in "selecthost" function,
that causes not correct virtual hosting support.
I have detected that in FreeBSD release 4.0.

 selecthost(su)
        union sockunion *su;                                                     
 {                                                                               
...
       while (hrp != NULL) {
                for (hi = hrp->hostinfo; hi != NULL; hi = hi->ai_next)
              {                                                                  
               if (memcmp(su, hi->ai_addr, hi->ai_addrlen) == 0) {
>How-To-Repeat:
Add any vistual host to /etc/ftphosts with necessary rules, described in
man ftpd. and try login to this host as anonymous user. You will be wonder, because we will enter to base host ;)

>Fix:
--- ftpd.orig   Fri Jun 16 21:04:33 2000
+++ ftpd.c      Fri Jun 16 21:04:27 2000
@@ -772,6 +772,7 @@
 selecthost(su) 
        union sockunion *su;
 {
+        int find=0;
        struct ftphost  *hrp; 
        u_int16_t port;
 #ifdef INET6
@@ -792,11 +793,12 @@
        hrp = thishost = firsthost;     /* default */ 
        port = su->su_port;
        su->su_port = 0;
-       while (hrp != NULL) {
+       while (hrp != NULL && !find) {
                for (hi = hrp->hostinfo; hi != NULL; hi = hi->ai_next)
              {
-               if (memcmp(su, hi->ai_addr, hi->ai_addrlen) == 0) {
+               if (memcmp(&su->su_sin, hi->ai_addr, hi->ai_addrlen) == 0) {
                        thishost = hrp;
+                       find=1;
                        break;
                }
 #ifdef INET6
@@ -806,6 +808,7 @@ 
                            &((struct sockaddr_in *)hi->ai_addr)->sin_addr,
                            sizeof(struct in_addr)) == 0)) {
                        thishost = hrp; 
+                       find=1;
                        break;
                }
 #endif 



>Release-Note:
>Audit-Trail:
>Unformatted:
 >>The su union have not compatible format with sockaddr struct.
 >>Therefore we do not find host which necessary
                         thishost = hrp;
                         break;
 >> When break cause we break the "FOR" cycle not the "while"
 >> Actually even if we find necessary hrp structure we do not break
 >> main "WHILE" cycle ;)
 
                 }
  #ifdef INET6                                                                    
                             &((struct sockaddr_in *)hi->ai_addr)->sin_addr,
                             sizeof(struct in_addr)) == 0)) {                     
                         thishost = hrp;                                          
                         break;
 >> Same problem like described above.
 
                 }                                                                
  #endif   
 


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-ports" in the body of the message