1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
|
https://bugs.gentoo.org/560418
fix from upstream
From 075d7556964f5a871a73c22ac4b69f5361295099 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tim=20R=C3=BChsen?= <tim.ruehsen@gmx.de>
Date: Tue, 11 Aug 2015 16:48:08 +0200
Subject: [PATCH] Fix IP address exposure in FTP code
* src/ftp.c (getftp): Do not use PORT when PASV fails.
* tests/FTPServer.px: Add pasv_not_supported server flag.
* tests/Makefile.am: Add Test-ftp-pasv-not-supported.px
* tests/Test-ftp-pasv-not-supported.px: New test
Fix IP address exposure when automatically falling back from
passive mode to active mode (using the PORT command). A behavior that
may be used to expose a client's privacy even when using a proxy.
---
NEWS | 2 ++
src/ftp.c | 19 +++++++-----
tests/FTPServer.pm | 8 +++++
tests/Makefile.am | 3 +-
tests/Test-ftp-pasv-not-supported.px | 60 ++++++++++++++++++++++++++++++++++++
5 files changed, 84 insertions(+), 8 deletions(-)
create mode 100755 tests/Test-ftp-pasv-not-supported.px
diff --git a/src/ftp.c b/src/ftp.c
index 68f1a33..9dab99c 100644
--- a/src/ftp.c
+++ b/src/ftp.c
@@ -252,7 +252,6 @@ getftp (struct url *u, wgint passed_expected_bytes, wgint *qtyread,
char *respline, *tms;
const char *user, *passwd, *tmrate;
int cmd = con->cmd;
- bool pasv_mode_open = false;
wgint expected_bytes = 0;
bool got_expected_bytes = false;
bool rest_failed = false;
@@ -883,13 +882,19 @@ Error in server response, closing control connection.\n"));
? CONERROR : CONIMPOSSIBLE);
}
- pasv_mode_open = true; /* Flag to avoid accept port */
if (!opt.server_response)
logputs (LOG_VERBOSE, _("done. "));
- } /* err==FTP_OK */
- }
+ }
+ else
+ return err;
- if (!pasv_mode_open) /* Try to use a port command if PASV failed */
+ /*
+ * We do not want to fall back from PASSIVE mode to ACTIVE mode !
+ * The reason is the PORT command exposes the client's real IP address
+ * to the server. Bad for someone who relies on privacy via a ftp proxy.
+ */
+ }
+ else
{
err = ftp_do_port (csock, &local_sock);
/* FTPRERR, WRITEFAILED, bindport (FTPSYSERR), HOSTERR,
@@ -1148,8 +1153,8 @@ Error in server response, closing control connection.\n"));
}
/* If no transmission was required, then everything is OK. */
- if (!pasv_mode_open) /* we are not using pasive mode so we need
- to accept */
+ if (!opt.ftp_pasv) /* we are not using passive mode so we need
+ to accept */
{
/* Wait for the server to connect to the address we're waiting
at. */
--
2.5.1
|
