diff --git a/0001-Introduce-TLSv1.1-and-TLSv1.2-options.patch b/0001-Introduce-TLSv1.1-and-TLSv1.2-options.patch deleted file mode 100644 index ab3fc62..0000000 --- a/0001-Introduce-TLSv1.1-and-TLSv1.2-options.patch +++ /dev/null @@ -1,149 +0,0 @@ -From 01bef55a1987700af3d43cdc5f5be88d3843ab85 Mon Sep 17 00:00:00 2001 -From: Martin Sehnoutka -Date: Thu, 17 Nov 2016 13:36:17 +0100 -Subject: [PATCH] Introduce TLSv1.1 and TLSv1.2 options. - -Users can now enable a specific version of TLS protocol. ---- - parseconf.c | 2 ++ - ssl.c | 8 ++++++++ - tunables.c | 9 +++++++-- - tunables.h | 2 ++ - vsftpd.conf.5 | 24 ++++++++++++++++++++---- - 5 files changed, 39 insertions(+), 6 deletions(-) - -Index: vsftpd-3.0.3/parseconf.c -=================================================================== ---- vsftpd-3.0.3.orig/parseconf.c 2020-11-13 09:52:41.369111000 +0000 -+++ vsftpd-3.0.3/parseconf.c 2020-11-13 09:52:48.881045043 +0000 -@@ -85,6 +85,8 @@ parseconf_bool_array[] = - { "ssl_sslv2", &tunable_sslv2 }, - { "ssl_sslv3", &tunable_sslv3 }, - { "ssl_tlsv1", &tunable_tlsv1 }, -+ { "ssl_tlsv1_1", &tunable_tlsv1_1 }, -+ { "ssl_tlsv1_2", &tunable_tlsv1_2 }, - { "tilde_user_enable", &tunable_tilde_user_enable }, - { "force_anon_logins_ssl", &tunable_force_anon_logins_ssl }, - { "force_anon_data_ssl", &tunable_force_anon_data_ssl }, -Index: vsftpd-3.0.3/ssl.c -=================================================================== ---- vsftpd-3.0.3.orig/ssl.c 2020-11-13 09:52:41.369111000 +0000 -+++ vsftpd-3.0.3/ssl.c 2020-11-13 09:52:48.881045043 +0000 -@@ -78,6 +78,14 @@ ssl_init(struct vsf_session* p_sess) - { - options |= SSL_OP_NO_TLSv1; - } -+ if (!tunable_tlsv1_1) -+ { -+ options |= SSL_OP_NO_TLSv1_1; -+ } -+ if (!tunable_tlsv1_2) -+ { -+ options |= SSL_OP_NO_TLSv1_2; -+ } - SSL_CTX_set_options(p_ctx, options); - if (tunable_rsa_cert_file) - { -Index: vsftpd-3.0.3/tunables.c -=================================================================== ---- vsftpd-3.0.3.orig/tunables.c 2020-11-13 09:52:41.369111000 +0000 -+++ vsftpd-3.0.3/tunables.c 2020-11-13 09:56:53.162888596 +0000 -@@ -66,6 +66,8 @@ int tunable_force_local_data_ssl; - int tunable_sslv2; - int tunable_sslv3; - int tunable_tlsv1; -+int tunable_tlsv1_1; -+int tunable_tlsv1_2; - int tunable_tilde_user_enable; - int tunable_force_anon_logins_ssl; - int tunable_force_anon_data_ssl; -@@ -207,7 +209,10 @@ tunables_load_defaults() - tunable_force_local_data_ssl = 1; - tunable_sslv2 = 0; - tunable_sslv3 = 0; -+ /* TLSv1 up to TLSv1.2 is enabled by default */ - tunable_tlsv1 = 1; -+ tunable_tlsv1_1 = 1; -+ tunable_tlsv1_2 = 1; - tunable_tilde_user_enable = 0; - tunable_force_anon_logins_ssl = 0; - tunable_force_anon_data_ssl = 0; -@@ -288,7 +293,8 @@ tunables_load_defaults() - install_str_setting("/usr/share/ssl/certs/vsftpd.pem", - &tunable_rsa_cert_file); - install_str_setting(0, &tunable_dsa_cert_file); -- install_str_setting("ECDHE-RSA-AES256-GCM-SHA384", &tunable_ssl_ciphers); -+ install_str_setting("AES128-SHA:DES-CBC3-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384", -+ &tunable_ssl_ciphers); - install_str_setting(0, &tunable_rsa_private_key_file); - install_str_setting(0, &tunable_dsa_private_key_file); - install_str_setting(0, &tunable_ca_certs_file); -Index: vsftpd-3.0.3/tunables.h -=================================================================== ---- vsftpd-3.0.3.orig/tunables.h 2020-11-13 09:52:41.369111000 +0000 -+++ vsftpd-3.0.3/tunables.h 2020-11-13 09:52:48.881045043 +0000 -@@ -67,6 +67,8 @@ extern int tunable_force_local_data_ssl; - extern int tunable_sslv2; /* Allow SSLv2 */ - extern int tunable_sslv3; /* Allow SSLv3 */ - extern int tunable_tlsv1; /* Allow TLSv1 */ -+extern int tunable_tlsv1_1; /* Allow TLSv1.1 */ -+extern int tunable_tlsv1_2; /* Allow TLSv1.2 */ - extern int tunable_tilde_user_enable; /* Support e.g. ~chris */ - extern int tunable_force_anon_logins_ssl; /* Require anon logins use SSL */ - extern int tunable_force_anon_data_ssl; /* Require anon data uses SSL */ -Index: vsftpd-3.0.3/vsftpd.conf.5 -=================================================================== ---- vsftpd-3.0.3.orig/vsftpd.conf.5 2020-11-13 09:52:41.370110991 +0000 -+++ vsftpd-3.0.3/vsftpd.conf.5 2020-11-13 09:52:48.881045043 +0000 -@@ -486,7 +486,7 @@ Default: YES - Only applies if - .BR ssl_enable - is activated. If enabled, this option will permit SSL v2 protocol connections. --TLS v1 connections are preferred. -+TLS v1.2 connections are preferred. - - Default: NO - .TP -@@ -494,7 +494,7 @@ Default: NO - Only applies if - .BR ssl_enable - is activated. If enabled, this option will permit SSL v3 protocol connections. --TLS v1 connections are preferred. -+TLS v1.2 connections are preferred. - - Default: NO - .TP -@@ -502,7 +502,23 @@ Default: NO - Only applies if - .BR ssl_enable - is activated. If enabled, this option will permit TLS v1 protocol connections. --TLS v1 connections are preferred. -+TLS v1.2 connections are preferred. -+ -+Default: YES -+.TP -+.B ssl_tlsv1_1 -+Only applies if -+.BR ssl_enable -+is activated. If enabled, this option will permit TLS v1.1 protocol connections. -+TLS v1.2 connections are preferred. -+ -+Default: YES -+.TP -+.B ssl_tlsv1_2 -+Only applies if -+.BR ssl_enable -+is activated. If enabled, this option will permit TLS v1.2 protocol connections. -+TLS v1.2 connections are preferred. - - Default: YES - .TP -@@ -1001,7 +1017,7 @@ man page for further details. Note that - security precaution as it prevents malicious remote parties forcing a cipher - which they have found problems with. - --Default: DES-CBC3-SHA -+Default: AES128-SHA:DES-CBC3-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384 - .TP - .B user_config_dir - This powerful option allows the override of any config option specified in diff --git a/seccomp-fixes.patch b/seccomp-fixes.patch index 1bc1225..9062295 100644 --- a/seccomp-fixes.patch +++ b/seccomp-fixes.patch @@ -1,7 +1,7 @@ -Index: vsftpd-3.0.3/seccompsandbox.c +Index: vsftpd-3.0.4/seccompsandbox.c =================================================================== ---- vsftpd-3.0.3.orig/seccompsandbox.c -+++ vsftpd-3.0.3/seccompsandbox.c +--- vsftpd-3.0.4.orig/seccompsandbox.c 2021-06-15 08:06:29.165512830 +0000 ++++ vsftpd-3.0.4/seccompsandbox.c 2021-06-15 08:06:42.778484808 +0000 @@ -18,6 +18,7 @@ #include "utility.h" @@ -10,7 +10,7 @@ Index: vsftpd-3.0.3/seccompsandbox.c #include #include -@@ -60,6 +61,7 @@ +@@ -63,6 +64,7 @@ #define kMaxSyscalls 100 @@ -18,7 +18,7 @@ Index: vsftpd-3.0.3/seccompsandbox.c #ifdef DEBUG_SIGSYS #include -@@ -68,7 +70,10 @@ +@@ -71,7 +73,10 @@ void handle_sigsys(int sig) { @@ -30,15 +30,7 @@ Index: vsftpd-3.0.3/seccompsandbox.c } #endif -@@ -443,6 +448,7 @@ seccomp_sandbox_setup_postlogin(const st - allow_nr(__NR_getcwd); - allow_nr(__NR_chdir); - allow_nr(__NR_getdents); -+ allow_nr(__NR_getdents64); - /* Misc */ - allow_nr(__NR_umask); - -@@ -579,8 +585,8 @@ seccomp_sandbox_lockdown() +@@ -586,8 +591,8 @@ seccomp_sandbox_lockdown() p_filter->code = BPF_LD+BPF_W+BPF_ABS; p_filter->jt = 0; p_filter->jf = 0; diff --git a/vsftpd-2.0.4-lib64.diff b/vsftpd-2.0.4-lib64.diff index c86b0e7..6fb5864 100644 --- a/vsftpd-2.0.4-lib64.diff +++ b/vsftpd-2.0.4-lib64.diff @@ -1,7 +1,7 @@ -Index: vsf_findlibs.sh +Index: vsftpd-3.0.4/vsf_findlibs.sh =================================================================== ---- vsf_findlibs.sh.orig -+++ vsf_findlibs.sh +--- vsftpd-3.0.4.orig/vsf_findlibs.sh 2021-05-18 07:14:35.000000000 +0000 ++++ vsftpd-3.0.4/vsf_findlibs.sh 2021-06-29 09:24:32.833223756 +0000 @@ -14,6 +14,7 @@ fi # crypt library. if find_func pam_start sysdeputil.o; then @@ -18,11 +18,11 @@ Index: vsf_findlibs.sh locate_library /usr/lib/libcrypt.so && echo "-lcrypt"; locate_library /usr/lib64/libcrypt.so && echo "-lcrypt"; locate_library /lib/x86_64-linux-gnu/libcrypt.so && echo "-lcrypt"; -@@ -54,6 +56,7 @@ elif locate_library /lib/libcap.so.2; th - echo "/lib/libcap.so.2"; - else - locate_library /usr/lib/libcap.so && echo "-lcap"; -+ locate_library /usr/lib64/libcap.so && echo "-lcap"; - locate_library /lib/libcap.so && echo "-lcap"; - locate_library /lib64/libcap.so && echo "-lcap"; - fi +@@ -52,6 +54,7 @@ locate_library /usr/lib/libsec.sl && ech + # /usr/bin/ld: cannot find -lcap + # If the libcap-devel package isn't installed. + locate_library /usr/lib/libcap.so && echo "-lcap"; ++locate_library /usr/lib64/libcap.so && echo "-lcap"; + locate_library /lib/libcap.so && echo "-lcap"; + locate_library /lib64/libcap.so && echo "-lcap"; + diff --git a/vsftpd-3.0.3-build-with-openssl-1.1.patch b/vsftpd-3.0.3-build-with-openssl-1.1.patch index bb71436..d1dc8e4 100644 --- a/vsftpd-3.0.3-build-with-openssl-1.1.patch +++ b/vsftpd-3.0.3-build-with-openssl-1.1.patch @@ -1,13 +1,13 @@ -Index: vsftpd-3.0.3/vsf_findlibs.sh +Index: vsftpd-3.0.4/vsf_findlibs.sh =================================================================== ---- vsftpd-3.0.3.orig/vsf_findlibs.sh -+++ vsftpd-3.0.3/vsf_findlibs.sh -@@ -72,7 +72,7 @@ locate_library /usr/shlib/librt.so && ec +--- vsftpd-3.0.4.orig/vsf_findlibs.sh 2021-06-15 07:58:45.004475824 +0000 ++++ vsftpd-3.0.4/vsf_findlibs.sh 2021-06-15 07:59:59.039320940 +0000 +@@ -69,7 +69,7 @@ locate_library /usr/shlib/librt.so && ec locate_library /usr/lib/libsendfile.so && echo "-lsendfile"; # OpenSSL -if find_func SSL_library_init ssl.o; then +if find_func SSL_CTX_new ssl.o; then echo "-lssl -lcrypto"; - fi - + elif find_func SSL_new ssl.o; then + echo "-lssl -lcrypto"; diff --git a/vsftpd.changes b/vsftpd.changes index c8ffd07..ac0656d 100644 --- a/vsftpd.changes +++ b/vsftpd.changes @@ -11,6 +11,8 @@ Tue Jun 15 07:49:13 AM UTC 2021 - Peter Simons - Upstream has a new GPG key (7B89011BCAE1CFEA). +- "0001-Introduce-TLSv1.1-and-TLSv1.2-options.patch" is now obsolete. + ------------------------------------------------------------------- Thu Dec 3 11:20:20 UTC 2020 - Ismail Dönmez diff --git a/vsftpd.spec b/vsftpd.spec index 451521e..e36a414 100644 --- a/vsftpd.spec +++ b/vsftpd.spec @@ -122,7 +122,7 @@ tests. %prep %setup -q -%patch1 +%patch1 -p1 %patch3 -p1 %patch4 %patch5