SHA256
1
0
forked from pool/pure-ftpd
pure-ftpd/pure-ftpd-1.0.50-default_tcp_sedrcv_buffer_size.patch

115 lines
3.0 KiB
Diff
Raw Normal View History

Accepting request 947558 from home:1Antoine1:branches:network - Update to version 1.0.50: * Support for MD5, SHA1 and MySQL PASSWORD() function were removed for password hashing. You should now use scrypt, argon2 or the system crypt(3) function. * Soft fail if a USER command is received without TLS and the server is configured to enforce TLS. Previously, the session was immediately closed, but that was too brutal for some clients. * Allow connections from the class E network range -- apparently required in some cases when using Linux containers. * Large file listings used to require way more stack allocations than necessary, possibly reaching hard-coded limits and causing a forced session close. This has been fixed. (boo#1160111, CVE-2019-20176) * The SPSV command has been removed. * Under some circunstances, the server would not start when configured with directory aliases. This has been fixed. * PostgreSQL: hard-coded global configuration strings were not escaped. This has been fixed. * A warning is now printed when a transfer happens in ASCII mode, as this is rarely intentional. * Compilation with --without-ascii is now possible again. * Configuration options for features that have been disabled at compile-time are not parsed any more. * When virtual quotas were configured, files were removed after an upload if the size quota was exceeded, but not during the upload. This has been fixed. (boo#1190205, CVE-2021-40524) * A configuration file can now include other files with the `Include` directive. * Fix an out-of-bound read (boo#1164805, CVE-2020-9365). * Fix a potential uninitialized pointer vulnerability (boo#1165134, CVE-2020-9274). OBS-URL: https://build.opensuse.org/request/show/947558 OBS-URL: https://build.opensuse.org/package/show/network/pure-ftpd?expand=0&rev=85
2022-01-24 09:45:36 +01:00
diff -up configure.orig configure
--- configure.orig 2022-01-19 20:48:45.387511953 +0100
+++ configure 2022-01-19 20:59:28.559523809 +0100
@@ -15016,108 +15016,13 @@ else
printf "%s\n" "no" >&6; }
fi
Accepting request 947558 from home:1Antoine1:branches:network - Update to version 1.0.50: * Support for MD5, SHA1 and MySQL PASSWORD() function were removed for password hashing. You should now use scrypt, argon2 or the system crypt(3) function. * Soft fail if a USER command is received without TLS and the server is configured to enforce TLS. Previously, the session was immediately closed, but that was too brutal for some clients. * Allow connections from the class E network range -- apparently required in some cases when using Linux containers. * Large file listings used to require way more stack allocations than necessary, possibly reaching hard-coded limits and causing a forced session close. This has been fixed. (boo#1160111, CVE-2019-20176) * The SPSV command has been removed. * Under some circunstances, the server would not start when configured with directory aliases. This has been fixed. * PostgreSQL: hard-coded global configuration strings were not escaped. This has been fixed. * A warning is now printed when a transfer happens in ASCII mode, as this is rarely intentional. * Compilation with --without-ascii is now possible again. * Configuration options for features that have been disabled at compile-time are not parsed any more. * When virtual quotas were configured, files were removed after an upload if the size quota was exceeded, but not during the upload. This has been fixed. (boo#1190205, CVE-2021-40524) * A configuration file can now include other files with the `Include` directive. * Fix an out-of-bound read (boo#1164805, CVE-2020-9365). * Fix a potential uninitialized pointer vulnerability (boo#1165134, CVE-2020-9274). OBS-URL: https://build.opensuse.org/request/show/947558 OBS-URL: https://build.opensuse.org/package/show/network/pure-ftpd?expand=0&rev=85
2022-01-24 09:45:36 +01:00
-{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking default TCP send buffer size" >&5
-printf %s "checking default TCP send buffer size... " >&6; }
-if test "$cross_compiling" = yes
-then :
- CONF_TCP_SO_SNDBUF=65536
Accepting request 947558 from home:1Antoine1:branches:network - Update to version 1.0.50: * Support for MD5, SHA1 and MySQL PASSWORD() function were removed for password hashing. You should now use scrypt, argon2 or the system crypt(3) function. * Soft fail if a USER command is received without TLS and the server is configured to enforce TLS. Previously, the session was immediately closed, but that was too brutal for some clients. * Allow connections from the class E network range -- apparently required in some cases when using Linux containers. * Large file listings used to require way more stack allocations than necessary, possibly reaching hard-coded limits and causing a forced session close. This has been fixed. (boo#1160111, CVE-2019-20176) * The SPSV command has been removed. * Under some circunstances, the server would not start when configured with directory aliases. This has been fixed. * PostgreSQL: hard-coded global configuration strings were not escaped. This has been fixed. * A warning is now printed when a transfer happens in ASCII mode, as this is rarely intentional. * Compilation with --without-ascii is now possible again. * Configuration options for features that have been disabled at compile-time are not parsed any more. * When virtual quotas were configured, files were removed after an upload if the size quota was exceeded, but not during the upload. This has been fixed. (boo#1190205, CVE-2021-40524) * A configuration file can now include other files with the `Include` directive. * Fix an out-of-bound read (boo#1164805, CVE-2020-9365). * Fix a potential uninitialized pointer vulnerability (boo#1165134, CVE-2020-9274). OBS-URL: https://build.opensuse.org/request/show/947558 OBS-URL: https://build.opensuse.org/package/show/network/pure-ftpd?expand=0&rev=85
2022-01-24 09:45:36 +01:00
-else $as_nop
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
-
-#include <stdio.h>
-#ifdef STDC_HEADERS
-# include <stdlib.h>
-# include <stddef.h>
-#else
-# if HAVE_STDLIB_H
-# include <stdlib.h>
-# endif
-#endif
-#ifdef HAVE_UNISTD_H
-# include <unistd.h>
-#endif
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <netinet/in.h>
-int main(void)
-{
- int fd,val=0,len=sizeof(int);
- if ((fd = socket(PF_INET, SOCK_STREAM, 0)) < 0) return 1;
- if (getsockopt(fd, SOL_SOCKET, SO_SNDBUF, &val, &len) < 0) return 1;
- if (val <= 0) return 1;
- fprintf (fopen("conftestval", "w"), "%d\n", val);
- return 0;
-}
-
-_ACEOF
Accepting request 947558 from home:1Antoine1:branches:network - Update to version 1.0.50: * Support for MD5, SHA1 and MySQL PASSWORD() function were removed for password hashing. You should now use scrypt, argon2 or the system crypt(3) function. * Soft fail if a USER command is received without TLS and the server is configured to enforce TLS. Previously, the session was immediately closed, but that was too brutal for some clients. * Allow connections from the class E network range -- apparently required in some cases when using Linux containers. * Large file listings used to require way more stack allocations than necessary, possibly reaching hard-coded limits and causing a forced session close. This has been fixed. (boo#1160111, CVE-2019-20176) * The SPSV command has been removed. * Under some circunstances, the server would not start when configured with directory aliases. This has been fixed. * PostgreSQL: hard-coded global configuration strings were not escaped. This has been fixed. * A warning is now printed when a transfer happens in ASCII mode, as this is rarely intentional. * Compilation with --without-ascii is now possible again. * Configuration options for features that have been disabled at compile-time are not parsed any more. * When virtual quotas were configured, files were removed after an upload if the size quota was exceeded, but not during the upload. This has been fixed. (boo#1190205, CVE-2021-40524) * A configuration file can now include other files with the `Include` directive. * Fix an out-of-bound read (boo#1164805, CVE-2020-9365). * Fix a potential uninitialized pointer vulnerability (boo#1165134, CVE-2020-9274). OBS-URL: https://build.opensuse.org/request/show/947558 OBS-URL: https://build.opensuse.org/package/show/network/pure-ftpd?expand=0&rev=85
2022-01-24 09:45:36 +01:00
-if ac_fn_c_try_run "$LINENO"
-then :
- CONF_TCP_SO_SNDBUF=`cat conftestval`
Accepting request 947558 from home:1Antoine1:branches:network - Update to version 1.0.50: * Support for MD5, SHA1 and MySQL PASSWORD() function were removed for password hashing. You should now use scrypt, argon2 or the system crypt(3) function. * Soft fail if a USER command is received without TLS and the server is configured to enforce TLS. Previously, the session was immediately closed, but that was too brutal for some clients. * Allow connections from the class E network range -- apparently required in some cases when using Linux containers. * Large file listings used to require way more stack allocations than necessary, possibly reaching hard-coded limits and causing a forced session close. This has been fixed. (boo#1160111, CVE-2019-20176) * The SPSV command has been removed. * Under some circunstances, the server would not start when configured with directory aliases. This has been fixed. * PostgreSQL: hard-coded global configuration strings were not escaped. This has been fixed. * A warning is now printed when a transfer happens in ASCII mode, as this is rarely intentional. * Compilation with --without-ascii is now possible again. * Configuration options for features that have been disabled at compile-time are not parsed any more. * When virtual quotas were configured, files were removed after an upload if the size quota was exceeded, but not during the upload. This has been fixed. (boo#1190205, CVE-2021-40524) * A configuration file can now include other files with the `Include` directive. * Fix an out-of-bound read (boo#1164805, CVE-2020-9365). * Fix a potential uninitialized pointer vulnerability (boo#1165134, CVE-2020-9274). OBS-URL: https://build.opensuse.org/request/show/947558 OBS-URL: https://build.opensuse.org/package/show/network/pure-ftpd?expand=0&rev=85
2022-01-24 09:45:36 +01:00
-else $as_nop
- CONF_TCP_SO_SNDBUF=65536
-fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
- conftest.$ac_objext conftest.beam conftest.$ac_ext
-fi
-
Accepting request 947558 from home:1Antoine1:branches:network - Update to version 1.0.50: * Support for MD5, SHA1 and MySQL PASSWORD() function were removed for password hashing. You should now use scrypt, argon2 or the system crypt(3) function. * Soft fail if a USER command is received without TLS and the server is configured to enforce TLS. Previously, the session was immediately closed, but that was too brutal for some clients. * Allow connections from the class E network range -- apparently required in some cases when using Linux containers. * Large file listings used to require way more stack allocations than necessary, possibly reaching hard-coded limits and causing a forced session close. This has been fixed. (boo#1160111, CVE-2019-20176) * The SPSV command has been removed. * Under some circunstances, the server would not start when configured with directory aliases. This has been fixed. * PostgreSQL: hard-coded global configuration strings were not escaped. This has been fixed. * A warning is now printed when a transfer happens in ASCII mode, as this is rarely intentional. * Compilation with --without-ascii is now possible again. * Configuration options for features that have been disabled at compile-time are not parsed any more. * When virtual quotas were configured, files were removed after an upload if the size quota was exceeded, but not during the upload. This has been fixed. (boo#1190205, CVE-2021-40524) * A configuration file can now include other files with the `Include` directive. * Fix an out-of-bound read (boo#1164805, CVE-2020-9365). * Fix a potential uninitialized pointer vulnerability (boo#1165134, CVE-2020-9274). OBS-URL: https://build.opensuse.org/request/show/947558 OBS-URL: https://build.opensuse.org/package/show/network/pure-ftpd?expand=0&rev=85
2022-01-24 09:45:36 +01:00
-{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $CONF_TCP_SO_SNDBUF" >&5
-printf "%s\n" "$CONF_TCP_SO_SNDBUF" >&6; }
-
Accepting request 947558 from home:1Antoine1:branches:network - Update to version 1.0.50: * Support for MD5, SHA1 and MySQL PASSWORD() function were removed for password hashing. You should now use scrypt, argon2 or the system crypt(3) function. * Soft fail if a USER command is received without TLS and the server is configured to enforce TLS. Previously, the session was immediately closed, but that was too brutal for some clients. * Allow connections from the class E network range -- apparently required in some cases when using Linux containers. * Large file listings used to require way more stack allocations than necessary, possibly reaching hard-coded limits and causing a forced session close. This has been fixed. (boo#1160111, CVE-2019-20176) * The SPSV command has been removed. * Under some circunstances, the server would not start when configured with directory aliases. This has been fixed. * PostgreSQL: hard-coded global configuration strings were not escaped. This has been fixed. * A warning is now printed when a transfer happens in ASCII mode, as this is rarely intentional. * Compilation with --without-ascii is now possible again. * Configuration options for features that have been disabled at compile-time are not parsed any more. * When virtual quotas were configured, files were removed after an upload if the size quota was exceeded, but not during the upload. This has been fixed. (boo#1190205, CVE-2021-40524) * A configuration file can now include other files with the `Include` directive. * Fix an out-of-bound read (boo#1164805, CVE-2020-9365). * Fix a potential uninitialized pointer vulnerability (boo#1165134, CVE-2020-9274). OBS-URL: https://build.opensuse.org/request/show/947558 OBS-URL: https://build.opensuse.org/package/show/network/pure-ftpd?expand=0&rev=85
2022-01-24 09:45:36 +01:00
-printf "%s\n" "#define CONF_TCP_SO_SNDBUF $CONF_TCP_SO_SNDBUF" >>confdefs.h
+printf "%s\n" "#define CONF_TCP_SO_SNDBUF 65536" >>confdefs.h
-{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking default TCP receive buffer size" >&5
-printf %s "checking default TCP receive buffer size... " >&6; }
-if test "$cross_compiling" = yes
-then :
- CONF_TCP_SO_RCVBUF=65536
Accepting request 947558 from home:1Antoine1:branches:network - Update to version 1.0.50: * Support for MD5, SHA1 and MySQL PASSWORD() function were removed for password hashing. You should now use scrypt, argon2 or the system crypt(3) function. * Soft fail if a USER command is received without TLS and the server is configured to enforce TLS. Previously, the session was immediately closed, but that was too brutal for some clients. * Allow connections from the class E network range -- apparently required in some cases when using Linux containers. * Large file listings used to require way more stack allocations than necessary, possibly reaching hard-coded limits and causing a forced session close. This has been fixed. (boo#1160111, CVE-2019-20176) * The SPSV command has been removed. * Under some circunstances, the server would not start when configured with directory aliases. This has been fixed. * PostgreSQL: hard-coded global configuration strings were not escaped. This has been fixed. * A warning is now printed when a transfer happens in ASCII mode, as this is rarely intentional. * Compilation with --without-ascii is now possible again. * Configuration options for features that have been disabled at compile-time are not parsed any more. * When virtual quotas were configured, files were removed after an upload if the size quota was exceeded, but not during the upload. This has been fixed. (boo#1190205, CVE-2021-40524) * A configuration file can now include other files with the `Include` directive. * Fix an out-of-bound read (boo#1164805, CVE-2020-9365). * Fix a potential uninitialized pointer vulnerability (boo#1165134, CVE-2020-9274). OBS-URL: https://build.opensuse.org/request/show/947558 OBS-URL: https://build.opensuse.org/package/show/network/pure-ftpd?expand=0&rev=85
2022-01-24 09:45:36 +01:00
-else $as_nop
- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h. */
-
-#include <stdio.h>
-#ifdef STDC_HEADERS
-# include <stdlib.h>
-# include <stddef.h>
-#else
-# if HAVE_STDLIB_H
-# include <stdlib.h>
-# endif
-#endif
-#ifdef HAVE_UNISTD_H
-# include <unistd.h>
-#endif
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <netinet/in.h>
-int main(void)
-{
- int fd,val=0,len=sizeof(int);
- if ((fd = socket(PF_INET, SOCK_STREAM, 0)) < 0) return 1;
- if (getsockopt(fd, SOL_SOCKET, SO_RCVBUF, &val, &len) < 0) return 1;
- if (val <= 0) return 1;
- fprintf (fopen("conftestval", "w"), "%d\n", val);
- return 0;
-}
-
-_ACEOF
Accepting request 947558 from home:1Antoine1:branches:network - Update to version 1.0.50: * Support for MD5, SHA1 and MySQL PASSWORD() function were removed for password hashing. You should now use scrypt, argon2 or the system crypt(3) function. * Soft fail if a USER command is received without TLS and the server is configured to enforce TLS. Previously, the session was immediately closed, but that was too brutal for some clients. * Allow connections from the class E network range -- apparently required in some cases when using Linux containers. * Large file listings used to require way more stack allocations than necessary, possibly reaching hard-coded limits and causing a forced session close. This has been fixed. (boo#1160111, CVE-2019-20176) * The SPSV command has been removed. * Under some circunstances, the server would not start when configured with directory aliases. This has been fixed. * PostgreSQL: hard-coded global configuration strings were not escaped. This has been fixed. * A warning is now printed when a transfer happens in ASCII mode, as this is rarely intentional. * Compilation with --without-ascii is now possible again. * Configuration options for features that have been disabled at compile-time are not parsed any more. * When virtual quotas were configured, files were removed after an upload if the size quota was exceeded, but not during the upload. This has been fixed. (boo#1190205, CVE-2021-40524) * A configuration file can now include other files with the `Include` directive. * Fix an out-of-bound read (boo#1164805, CVE-2020-9365). * Fix a potential uninitialized pointer vulnerability (boo#1165134, CVE-2020-9274). OBS-URL: https://build.opensuse.org/request/show/947558 OBS-URL: https://build.opensuse.org/package/show/network/pure-ftpd?expand=0&rev=85
2022-01-24 09:45:36 +01:00
-if ac_fn_c_try_run "$LINENO"
-then :
- CONF_TCP_SO_RCVBUF=`cat conftestval`
Accepting request 947558 from home:1Antoine1:branches:network - Update to version 1.0.50: * Support for MD5, SHA1 and MySQL PASSWORD() function were removed for password hashing. You should now use scrypt, argon2 or the system crypt(3) function. * Soft fail if a USER command is received without TLS and the server is configured to enforce TLS. Previously, the session was immediately closed, but that was too brutal for some clients. * Allow connections from the class E network range -- apparently required in some cases when using Linux containers. * Large file listings used to require way more stack allocations than necessary, possibly reaching hard-coded limits and causing a forced session close. This has been fixed. (boo#1160111, CVE-2019-20176) * The SPSV command has been removed. * Under some circunstances, the server would not start when configured with directory aliases. This has been fixed. * PostgreSQL: hard-coded global configuration strings were not escaped. This has been fixed. * A warning is now printed when a transfer happens in ASCII mode, as this is rarely intentional. * Compilation with --without-ascii is now possible again. * Configuration options for features that have been disabled at compile-time are not parsed any more. * When virtual quotas were configured, files were removed after an upload if the size quota was exceeded, but not during the upload. This has been fixed. (boo#1190205, CVE-2021-40524) * A configuration file can now include other files with the `Include` directive. * Fix an out-of-bound read (boo#1164805, CVE-2020-9365). * Fix a potential uninitialized pointer vulnerability (boo#1165134, CVE-2020-9274). OBS-URL: https://build.opensuse.org/request/show/947558 OBS-URL: https://build.opensuse.org/package/show/network/pure-ftpd?expand=0&rev=85
2022-01-24 09:45:36 +01:00
-else $as_nop
- CONF_TCP_SO_RCVBUF=65536
-fi
-rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
- conftest.$ac_objext conftest.beam conftest.$ac_ext
-fi
-
Accepting request 947558 from home:1Antoine1:branches:network - Update to version 1.0.50: * Support for MD5, SHA1 and MySQL PASSWORD() function were removed for password hashing. You should now use scrypt, argon2 or the system crypt(3) function. * Soft fail if a USER command is received without TLS and the server is configured to enforce TLS. Previously, the session was immediately closed, but that was too brutal for some clients. * Allow connections from the class E network range -- apparently required in some cases when using Linux containers. * Large file listings used to require way more stack allocations than necessary, possibly reaching hard-coded limits and causing a forced session close. This has been fixed. (boo#1160111, CVE-2019-20176) * The SPSV command has been removed. * Under some circunstances, the server would not start when configured with directory aliases. This has been fixed. * PostgreSQL: hard-coded global configuration strings were not escaped. This has been fixed. * A warning is now printed when a transfer happens in ASCII mode, as this is rarely intentional. * Compilation with --without-ascii is now possible again. * Configuration options for features that have been disabled at compile-time are not parsed any more. * When virtual quotas were configured, files were removed after an upload if the size quota was exceeded, but not during the upload. This has been fixed. (boo#1190205, CVE-2021-40524) * A configuration file can now include other files with the `Include` directive. * Fix an out-of-bound read (boo#1164805, CVE-2020-9365). * Fix a potential uninitialized pointer vulnerability (boo#1165134, CVE-2020-9274). OBS-URL: https://build.opensuse.org/request/show/947558 OBS-URL: https://build.opensuse.org/package/show/network/pure-ftpd?expand=0&rev=85
2022-01-24 09:45:36 +01:00
-{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $CONF_TCP_SO_RCVBUF" >&5
-printf "%s\n" "$CONF_TCP_SO_RCVBUF" >&6; }
-printf "%s\n" "#define CONF_TCP_SO_RCVBUF $CONF_TCP_SO_RCVBUF" >>confdefs.h
+printf "%s\n" "#define CONF_TCP_SO_RCVBUF 65536" >>confdefs.h