rpm/vsftpd
SHA256
1
0
Fork 0
forked from pool/vsftpd
Code Pull Requests Activity

refresh patches for the new version

Browse Source 
OBS-URL: https://build.opensuse.org/package/show/network/vsftpd?expand=0&rev=150
This commit is contained in:
Peter Simons 2021-06-29 11:17:01 +00:00 committed by Git OBS Bridge
parent a55fbc4786
commit 0ca37ce5e5
6 changed files with 26 additions and 181 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

149
0001-Introduce-TLSv1.1-and-TLSv1.2-options.patch
View File

@ -1,149 +0,0 @@
From 01bef55a1987700af3d43cdc5f5be88d3843ab85 Mon Sep 17 00:00:00 2001
From: Martin Sehnoutka <msehnout@redhat.com>
Date: Thu, 17 Nov 2016 13:36:17 +0100
Subject: [PATCH] Introduce TLSv1.1 and TLSv1.2 options.
Users can now enable a specific version of TLS protocol.
---
parseconf.c | 2 ++
ssl.c | 8 ++++++++
tunables.c | 9 +++++++--
tunables.h | 2 ++
vsftpd.conf.5 | 24 ++++++++++++++++++++----
5 files changed, 39 insertions(+), 6 deletions(-)
Index: vsftpd-3.0.3/parseconf.c
===================================================================
--- vsftpd-3.0.3.orig/parseconf.c 2020-11-13 09:52:41.369111000 +0000
+++ vsftpd-3.0.3/parseconf.c 2020-11-13 09:52:48.881045043 +0000
@@ -85,6 +85,8 @@ parseconf_bool_array[] =
{ "ssl_sslv2", &tunable_sslv2 },
{ "ssl_sslv3", &tunable_sslv3 },
{ "ssl_tlsv1", &tunable_tlsv1 },
+ { "ssl_tlsv1_1", &tunable_tlsv1_1 },
+ { "ssl_tlsv1_2", &tunable_tlsv1_2 },
{ "tilde_user_enable", &tunable_tilde_user_enable },
{ "force_anon_logins_ssl", &tunable_force_anon_logins_ssl },
{ "force_anon_data_ssl", &tunable_force_anon_data_ssl },
Index: vsftpd-3.0.3/ssl.c
===================================================================
--- vsftpd-3.0.3.orig/ssl.c 2020-11-13 09:52:41.369111000 +0000
+++ vsftpd-3.0.3/ssl.c 2020-11-13 09:52:48.881045043 +0000
@@ -78,6 +78,14 @@ ssl_init(struct vsf_session* p_sess)
{
options |= SSL_OP_NO_TLSv1;
}
+ if (!tunable_tlsv1_1)
+ {
+ options |= SSL_OP_NO_TLSv1_1;
+ }
+ if (!tunable_tlsv1_2)
+ {
+ options |= SSL_OP_NO_TLSv1_2;
+ }
SSL_CTX_set_options(p_ctx, options);
if (tunable_rsa_cert_file)
{
Index: vsftpd-3.0.3/tunables.c
===================================================================
--- vsftpd-3.0.3.orig/tunables.c 2020-11-13 09:52:41.369111000 +0000
+++ vsftpd-3.0.3/tunables.c 2020-11-13 09:56:53.162888596 +0000
@@ -66,6 +66,8 @@ int tunable_force_local_data_ssl;
int tunable_sslv2;
int tunable_sslv3;
int tunable_tlsv1;
+int tunable_tlsv1_1;
+int tunable_tlsv1_2;
int tunable_tilde_user_enable;
int tunable_force_anon_logins_ssl;
int tunable_force_anon_data_ssl;
@@ -207,7 +209,10 @@ tunables_load_defaults()
tunable_force_local_data_ssl = 1;
tunable_sslv2 = 0;
tunable_sslv3 = 0;
+ /* TLSv1 up to TLSv1.2 is enabled by default */
tunable_tlsv1 = 1;
+ tunable_tlsv1_1 = 1;
+ tunable_tlsv1_2 = 1;
tunable_tilde_user_enable = 0;
tunable_force_anon_logins_ssl = 0;
tunable_force_anon_data_ssl = 0;
@@ -288,7 +293,8 @@ tunables_load_defaults()
install_str_setting("/usr/share/ssl/certs/vsftpd.pem",
&tunable_rsa_cert_file);
install_str_setting(0, &tunable_dsa_cert_file);
- install_str_setting("ECDHE-RSA-AES256-GCM-SHA384", &tunable_ssl_ciphers);
+ install_str_setting("AES128-SHA:DES-CBC3-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384",
+ &tunable_ssl_ciphers);
install_str_setting(0, &tunable_rsa_private_key_file);
install_str_setting(0, &tunable_dsa_private_key_file);
install_str_setting(0, &tunable_ca_certs_file);
Index: vsftpd-3.0.3/tunables.h
===================================================================
--- vsftpd-3.0.3.orig/tunables.h 2020-11-13 09:52:41.369111000 +0000
+++ vsftpd-3.0.3/tunables.h 2020-11-13 09:52:48.881045043 +0000
@@ -67,6 +67,8 @@ extern int tunable_force_local_data_ssl;
extern int tunable_sslv2; /* Allow SSLv2 */
extern int tunable_sslv3; /* Allow SSLv3 */
extern int tunable_tlsv1; /* Allow TLSv1 */
+extern int tunable_tlsv1_1; /* Allow TLSv1.1 */
+extern int tunable_tlsv1_2; /* Allow TLSv1.2 */
extern int tunable_tilde_user_enable; /* Support e.g. ~chris */
extern int tunable_force_anon_logins_ssl; /* Require anon logins use SSL */
extern int tunable_force_anon_data_ssl; /* Require anon data uses SSL */
Index: vsftpd-3.0.3/vsftpd.conf.5
===================================================================
--- vsftpd-3.0.3.orig/vsftpd.conf.5 2020-11-13 09:52:41.370110991 +0000
+++ vsftpd-3.0.3/vsftpd.conf.5 2020-11-13 09:52:48.881045043 +0000
@@ -486,7 +486,7 @@ Default: YES
Only applies if
.BR ssl_enable
is activated. If enabled, this option will permit SSL v2 protocol connections.
-TLS v1 connections are preferred.
+TLS v1.2 connections are preferred.
Default: NO
.TP
@@ -494,7 +494,7 @@ Default: NO
Only applies if
.BR ssl_enable
is activated. If enabled, this option will permit SSL v3 protocol connections.
-TLS v1 connections are preferred.
+TLS v1.2 connections are preferred.
Default: NO
.TP
@@ -502,7 +502,23 @@ Default: NO
Only applies if
.BR ssl_enable
is activated. If enabled, this option will permit TLS v1 protocol connections.
-TLS v1 connections are preferred.
+TLS v1.2 connections are preferred.
+
+Default: YES
+.TP
+.B ssl_tlsv1_1
+Only applies if
+.BR ssl_enable
+is activated. If enabled, this option will permit TLS v1.1 protocol connections.
+TLS v1.2 connections are preferred.
+
+Default: YES
+.TP
+.B ssl_tlsv1_2
+Only applies if
+.BR ssl_enable
+is activated. If enabled, this option will permit TLS v1.2 protocol connections.
+TLS v1.2 connections are preferred.
Default: YES
.TP
@@ -1001,7 +1017,7 @@ man page for further details. Note that
security precaution as it prevents malicious remote parties forcing a cipher
which they have found problems with.
-Default: DES-CBC3-SHA
+Default: AES128-SHA:DES-CBC3-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384
.TP
.B user_config_dir
This powerful option allows the override of any config option specified in

20
seccomp-fixes.patch
View File

@ -1,7 +1,7 @@
Index: vsftpd-3.0.3/seccompsandbox.c
Index: vsftpd-3.0.4/seccompsandbox.c
===================================================================
--- vsftpd-3.0.3.orig/seccompsandbox.c
+++ vsftpd-3.0.3/seccompsandbox.c
--- vsftpd-3.0.4.orig/seccompsandbox.c 2021-06-15 08:06:29.165512830 +0000
+++ vsftpd-3.0.4/seccompsandbox.c 2021-06-15 08:06:42.778484808 +0000
@@ -18,6 +18,7 @@
#include "utility.h"
@ -10,7 +10,7 @@ Index: vsftpd-3.0.3/seccompsandbox.c
#include <netinet/in.h>
#include <netinet/tcp.h>
@@ -60,6 +61,7 @@
@@ -63,6 +64,7 @@
#define kMaxSyscalls 100
@ -18,7 +18,7 @@ Index: vsftpd-3.0.3/seccompsandbox.c
#ifdef DEBUG_SIGSYS
#include <signal.h>
@@ -68,7 +70,10 @@
@@ -71,7 +73,10 @@
void
handle_sigsys(int sig)
{
@ -30,15 +30,7 @@ Index: vsftpd-3.0.3/seccompsandbox.c
}
#endif
@@ -443,6 +448,7 @@ seccomp_sandbox_setup_postlogin(const st
allow_nr(__NR_getcwd);
allow_nr(__NR_chdir);
allow_nr(__NR_getdents);
+ allow_nr(__NR_getdents64);
/* Misc */
allow_nr(__NR_umask);
@@ -579,8 +585,8 @@ seccomp_sandbox_lockdown()
@@ -586,8 +591,8 @@ seccomp_sandbox_lockdown()
p_filter->code = BPF_LD+BPF_W+BPF_ABS;
p_filter->jt = 0;
p_filter->jf = 0;

22
vsftpd-2.0.4-lib64.diff
View File

@ -1,7 +1,7 @@
Index: vsf_findlibs.sh
Index: vsftpd-3.0.4/vsf_findlibs.sh
===================================================================
--- vsf_findlibs.sh.orig
+++ vsf_findlibs.sh
--- vsftpd-3.0.4.orig/vsf_findlibs.sh 2021-05-18 07:14:35.000000000 +0000
+++ vsftpd-3.0.4/vsf_findlibs.sh 2021-06-29 09:24:32.833223756 +0000
@@ -14,6 +14,7 @@ fi
# crypt library.
if find_func pam_start sysdeputil.o; then
@ -18,11 +18,11 @@ Index: vsf_findlibs.sh
locate_library /usr/lib/libcrypt.so && echo "-lcrypt";
locate_library /usr/lib64/libcrypt.so && echo "-lcrypt";
locate_library /lib/x86_64-linux-gnu/libcrypt.so && echo "-lcrypt";
@@ -54,6 +56,7 @@ elif locate_library /lib/libcap.so.2; th
echo "/lib/libcap.so.2";
else
locate_library /usr/lib/libcap.so && echo "-lcap";
+ locate_library /usr/lib64/libcap.so && echo "-lcap";
locate_library /lib/libcap.so && echo "-lcap";
locate_library /lib64/libcap.so && echo "-lcap";
fi
@@ -52,6 +54,7 @@ locate_library /usr/lib/libsec.sl && ech
# /usr/bin/ld: cannot find -lcap
# If the libcap-devel package isn't installed.
locate_library /usr/lib/libcap.so && echo "-lcap";
+locate_library /usr/lib64/libcap.so && echo "-lcap";
locate_library /lib/libcap.so && echo "-lcap";
locate_library /lib64/libcap.so && echo "-lcap";

12
vsftpd-3.0.3-build-with-openssl-1.1.patch
View File

@ -1,13 +1,13 @@
Index: vsftpd-3.0.3/vsf_findlibs.sh
Index: vsftpd-3.0.4/vsf_findlibs.sh
===================================================================
--- vsftpd-3.0.3.orig/vsf_findlibs.sh
+++ vsftpd-3.0.3/vsf_findlibs.sh
@@ -72,7 +72,7 @@ locate_library /usr/shlib/librt.so && ec
--- vsftpd-3.0.4.orig/vsf_findlibs.sh 2021-06-15 07:58:45.004475824 +0000
+++ vsftpd-3.0.4/vsf_findlibs.sh 2021-06-15 07:59:59.039320940 +0000
@@ -69,7 +69,7 @@ locate_library /usr/shlib/librt.so && ec
locate_library /usr/lib/libsendfile.so && echo "-lsendfile";
# OpenSSL
-if find_func SSL_library_init ssl.o; then
+if find_func SSL_CTX_new ssl.o; then
echo "-lssl -lcrypto";
fi
elif find_func SSL_new ssl.o; then
echo "-lssl -lcrypto";

2
vsftpd.changes
View File

@ -11,6 +11,8 @@ Tue Jun 15 07:49:13 AM UTC 2021 - Peter Simons <psimons@suse.com>
- Upstream has a new GPG key (7B89011BCAE1CFEA).
- "0001-Introduce-TLSv1.1-and-TLSv1.2-options.patch" is now obsolete.
-------------------------------------------------------------------
Thu Dec 3 11:20:20 UTC 2020 - Ismail Dönmez <idonmez@suse.com>

2
vsftpd.spec
View File

@ -122,7 +122,7 @@ tests.
%prep
%setup -q
%patch1
%patch1 -p1
%patch3 -p1
%patch4
%patch5