ftpd: security tightened up:

 PORT is not allowed on !IPv4
 PORT must have IP == peer's IP
 upload is allowed only into regular files

function                                             old     new   delta
ftpd_main                                           1815    2019    +204
handle_upload_common                                 260     306     +46
------------------------------------------------------------------------------
(add/remove: 0/0 grow/shrink: 2/0 up/down: 250/0)             Total: 250 bytes

1 files changed, 107 insertions, 89 deletions

diff --git a/networking/ftpd.c b/networking/ftpd.c
index 37b340e78..22cec83a8 100644
--- a/networking/ftpd.c
+++ b/networking/ftpd.c
@@ -66,9 +66,9 @@
 /* Convert a constant to 3-digit string, packed into uint32_t */
 enum {
 	/* Shift for Nth decimal digit */
-	SHIFT0 = 16 * BB_LITTLE_ENDIAN + 8 * BB_BIG_ENDIAN,
-	SHIFT1 =  8 * BB_LITTLE_ENDIAN + 16 * BB_BIG_ENDIAN,
 	SHIFT2 =  0 * BB_LITTLE_ENDIAN + 24 * BB_BIG_ENDIAN,
+	SHIFT1 =  8 * BB_LITTLE_ENDIAN + 16 * BB_BIG_ENDIAN,
+	SHIFT0 = 16 * BB_LITTLE_ENDIAN + 8 * BB_BIG_ENDIAN,
 };
 #define STRNUM32(s) (uint32_t)(0 \
 	| (('0' + ((s) / 1 % 10)) << SHIFT0) \
@@ -76,47 +76,6 @@ enum {
 	| (('0' + ((s) / 100 % 10)) << SHIFT2) \
 )
 
-enum {
-	OPT_l = (1 << 0),
-	OPT_1 = (1 << 1),
-	OPT_v = (1 << 2),
-	OPT_S = (1 << 3),
-	OPT_w = (1 << 4),
-
-#define mk_const4(a,b,c,d) (((a * 0x100 + b) * 0x100 + c) * 0x100 + d)
-#define mk_const3(a,b,c)    ((a * 0x100 + b) * 0x100 + c)
-	const_ALLO = mk_const4('A', 'L', 'L', 'O'),
-	const_APPE = mk_const4('A', 'P', 'P', 'E'),
-	const_CDUP = mk_const4('C', 'D', 'U', 'P'),
-	const_CWD  = mk_const3('C', 'W', 'D'),
-	const_DELE = mk_const4('D', 'E', 'L', 'E'),
-	const_EPSV = mk_const4('E', 'P', 'S', 'V'),
-	const_HELP = mk_const4('H', 'E', 'L', 'P'),
-	const_LIST = mk_const4('L', 'I', 'S', 'T'),
-	const_MKD  = mk_const3('M', 'K', 'D'),
-	const_MODE = mk_const4('M', 'O', 'D', 'E'),
-	const_NLST = mk_const4('N', 'L', 'S', 'T'),
-	const_NOOP = mk_const4('N', 'O', 'O', 'P'),
-	const_PASS = mk_const4('P', 'A', 'S', 'S'),
-	const_PASV = mk_const4('P', 'A', 'S', 'V'),
-	const_PORT = mk_const4('P', 'O', 'R', 'T'),
-	const_PWD  = mk_const3('P', 'W', 'D'),
-	const_QUIT = mk_const4('Q', 'U', 'I', 'T'),
-	const_REST = mk_const4('R', 'E', 'S', 'T'),
-	const_RETR = mk_const4('R', 'E', 'T', 'R'),
-	const_RMD  = mk_const3('R', 'M', 'D'),
-	const_RNFR = mk_const4('R', 'N', 'F', 'R'),
-	const_RNTO = mk_const4('R', 'N', 'T', 'O'),
-	const_SIZE = mk_const4('S', 'I', 'Z', 'E'),
-	const_STAT = mk_const4('S', 'T', 'A', 'T'),
-	const_STOR = mk_const4('S', 'T', 'O', 'R'),
-	const_STOU = mk_const4('S', 'T', 'O', 'U'),
-	const_STRU = mk_const4('S', 'T', 'R', 'U'),
-	const_SYST = mk_const4('S', 'Y', 'S', 'T'),
-	const_TYPE = mk_const4('T', 'Y', 'P', 'E'),
-	const_USER = mk_const4('U', 'S', 'E', 'R'),
-};
-
 struct globals {
 	char *p_control_line_buf;
 	len_and_sockaddr *local_addr;
@@ -182,21 +141,16 @@ replace_char(char *str, char from, char to)
 	return p - str;
 }
 
+/* NB: status_str is char[4] packed into uint32_t */
 static void
 cmdio_write(uint32_t status_str, const char *str)
 {
-	union {
-		char buf[4];
-		uint32_t v32;
-	} u;
 	char *response;
 	int len;
 
-	u.v32 = status_str;
-
 	/* FTP allegedly uses telnet protocol for command link.
 	 * In telnet, 0xff is an escape char, and needs to be escaped: */
-	response = escape_text(u.buf, str, (0xff << 8) + '\r');
+	response = escape_text((char *) &status_str, str, (0xff << 8) + '\r');
 
 	/* ?! does FTP send embedded LFs as NULs? wow */
 	len = replace_char(response, '\n', '\0');
@@ -444,46 +398,58 @@ handle_epsv(void)
 static void
 handle_port(void)
 {
-	unsigned short port;
-	char *raw, *port_part;
-	len_and_sockaddr *lsa;
+	unsigned port, port_hi;
+	char *raw, *comma;
+	socklen_t peer_ipv4_len;
+	struct sockaddr_in peer_ipv4;
+	struct in_addr port_ipv4_sin_addr;
 
 	port_pasv_cleanup();
 
 	raw = G.ftp_arg;
 
-/* Buglets:
- * xatou16 will accept wrong input,
- * xatou16 will exit instead of generating error to peer
- */
+	/* PORT command format makes sense only over IPv4 */
+	if (!raw || G.local_addr->u.sa.sa_family != AF_INET) {
+ bail:
+		cmdio_write_error(FTP_BADCMD);
+		return;
+	}
 
-	port_part = strrchr(raw, ',');
-	if (port_part == NULL)
+	comma = strrchr(raw, ',');
+	if (comma == NULL)
+		goto bail;
+	*comma = '\0';
+	port = bb_strtou(&comma[1], NULL, 10);
+	if (errno || port > 0xff)
 		goto bail;
-	port = xatou16(&port_part[1]);
-	*port_part = '\0';
 
-	port_part = strrchr(raw, ',');
-	if (port_part == NULL)
+	comma = strrchr(raw, ',');
+	if (comma == NULL)
 		goto bail;
-	port |= xatou16(&port_part[1]) << 8;
-	*port_part = '\0';
+	*comma = '\0';
+	port_hi = bb_strtou(&comma[1], NULL, 10);
+	if (errno || port_hi > 0xff)
+		goto bail;
+	port |= port_hi << 8;
 
 	replace_char(raw, ',', '.');
-	lsa = xdotted2sockaddr(raw, port);
 
-	if (lsa == NULL) {
- bail:
-		cmdio_write_error(FTP_BADCMD);
-		return;
-	}
-
-/* Should we verify that lsa matches getpeername(STDIN)?
- * Otherwise peer can make us open data connections
- * to other hosts (security problem!)
- */
+	/* We are verifying that PORT's IP matches getpeername().
+	 * Otherwise peer can make us open data connections
+	 * to other hosts (security problem!)
+	 * This code would be too simplistic:
+	 * lsa = xdotted2sockaddr(raw, port);
+	 * if (lsa == NULL) goto bail;
+	 */
+	if (!inet_aton(raw, &port_ipv4_sin_addr))
+		goto bail;
+	peer_ipv4_len = sizeof(peer_ipv4);
+	if (getpeername(STDIN_FILENO, &peer_ipv4, &peer_ipv4_len) != 0)
+		goto bail;
+	if (memcmp(&port_ipv4_sin_addr, &peer_ipv4.sin_addr, sizeof(struct in_addr)) != 0)
+		goto bail;
 
-	G.port_addr = lsa;
+	G.port_addr = xdotted2sockaddr(raw, port);
 	cmdio_write_ok(FTP_PORTOK);
 }
 
@@ -612,6 +578,8 @@ handle_dir_common(int opts)
 	if (!(opts & USE_CTRL_CONN) && !port_or_pasv_was_seen())
 		return; /* port_or_pasv_was_seen emitted error response */
 
+	/* -n prevents user/groupname display,
+	 * which can be problematic in chroot */
 	ls_fd = popen_ls((opts & LONG_LISTING) ? "-l" : "-1");
 	ls_fp = fdopen(ls_fd, "r");
 	if (!ls_fp) /* never happens. paranoia */
@@ -749,11 +717,12 @@ handle_rnto(void)
 static void
 handle_upload_common(int is_append, int is_unique)
 {
-	char *tempname = NULL;
+	struct stat statbuf;
+	char *tempname;
 	off_t bytes_transferred;
+	off_t offset;
 	int local_file_fd;
 	int remote_fd;
-	off_t offset;
 
 	offset = G.restart_pos;
 	G.restart_pos = 0;
@@ -761,6 +730,7 @@ handle_upload_common(int is_append, int is_unique)
 	if (!port_or_pasv_was_seen())
 		return; /* port_or_pasv_was_seen emitted error response */
 
+	tempname = NULL;
 	local_file_fd = -1;
 	if (is_unique) {
 		tempname = xstrdup(" FILE: uniq.XXXXXX");
@@ -773,13 +743,17 @@ handle_upload_common(int is_append, int is_unique)
 			flags = O_WRONLY | O_CREAT;
 		local_file_fd = open(G.ftp_arg, flags, 0666);
 	}
-	if (local_file_fd < 0) {
+
+	if (local_file_fd < 0
+	 || fstat(local_file_fd, &statbuf) != 0
+	 || !S_ISREG(statbuf.st_mode)
+	) {
 		cmdio_write_error(FTP_UPLOADFAIL);
+		if (local_file_fd >= 0)
+			goto close_local_and_bail;
 		return;
 	}
 
-/* TODO: paranoia: fstat it, refuse to do anything if it's not a regular file */
-
 	if (offset)
 		xlseek(local_file_fd, offset, SEEK_SET);
 
@@ -787,7 +761,7 @@ handle_upload_common(int is_append, int is_unique)
 	free(tempname);
 
 	if (remote_fd < 0)
-		goto bail;
+		goto close_local_and_bail;
 
 /* TODO: if we'll implement timeout, this will need more clever handling.
  * Perhaps alarm(N) + checking that current position on local_file_fd
@@ -800,7 +774,8 @@ handle_upload_common(int is_append, int is_unique)
 		cmdio_write_error(FTP_BADSENDFILE);
 	else
 		cmdio_write_ok(FTP_TRANSFEROK);
- bail:
+
+ close_local_and_bail:
 	close(local_file_fd);
 }
 
@@ -838,17 +813,18 @@ cmdio_get_cmd_and_arg(void)
 	if (!cmd)
 		exit(0);
 
+	/* Trailing '\n' is already stripped, strip '\r' */
 	len = strlen(cmd) - 1;
-	while (len >= 0 && cmd[len] == '\r') {
+	while ((ssize_t)len >= 0 && cmd[len] == '\r') {
 		cmd[len] = '\0';
 		len--;
 	}
 
 	G.ftp_arg = strchr(cmd, ' ');
-	if (G.ftp_arg != NULL) {
-		*G.ftp_arg = '\0';
-		G.ftp_arg++;
-	}
+	if (G.ftp_arg != NULL)
+		*G.ftp_arg++ = '\0';
+
+	/* Uppercase and pack into uint32_t first word of the command */
 	cmdval = 0;
 	while (*cmd)
 		cmdval = (cmdval << 8) + ((unsigned char)*cmd++ & (unsigned char)~0x20);
@@ -856,6 +832,47 @@ cmdio_get_cmd_and_arg(void)
 	return cmdval;
 }
 
+#define mk_const4(a,b,c,d) (((a * 0x100 + b) * 0x100 + c) * 0x100 + d)
+#define mk_const3(a,b,c)    ((a * 0x100 + b) * 0x100 + c)
+enum {
+	const_ALLO = mk_const4('A', 'L', 'L', 'O'),
+	const_APPE = mk_const4('A', 'P', 'P', 'E'),
+	const_CDUP = mk_const4('C', 'D', 'U', 'P'),
+	const_CWD  = mk_const3('C', 'W', 'D'),
+	const_DELE = mk_const4('D', 'E', 'L', 'E'),
+	const_EPSV = mk_const4('E', 'P', 'S', 'V'),
+	const_HELP = mk_const4('H', 'E', 'L', 'P'),
+	const_LIST = mk_const4('L', 'I', 'S', 'T'),
+	const_MKD  = mk_const3('M', 'K', 'D'),
+	const_MODE = mk_const4('M', 'O', 'D', 'E'),
+	const_NLST = mk_const4('N', 'L', 'S', 'T'),
+	const_NOOP = mk_const4('N', 'O', 'O', 'P'),
+	const_PASS = mk_const4('P', 'A', 'S', 'S'),
+	const_PASV = mk_const4('P', 'A', 'S', 'V'),
+	const_PORT = mk_const4('P', 'O', 'R', 'T'),
+	const_PWD  = mk_const3('P', 'W', 'D'),
+	const_QUIT = mk_const4('Q', 'U', 'I', 'T'),
+	const_REST = mk_const4('R', 'E', 'S', 'T'),
+	const_RETR = mk_const4('R', 'E', 'T', 'R'),
+	const_RMD  = mk_const3('R', 'M', 'D'),
+	const_RNFR = mk_const4('R', 'N', 'F', 'R'),
+	const_RNTO = mk_const4('R', 'N', 'T', 'O'),
+	const_SIZE = mk_const4('S', 'I', 'Z', 'E'),
+	const_STAT = mk_const4('S', 'T', 'A', 'T'),
+	const_STOR = mk_const4('S', 'T', 'O', 'R'),
+	const_STOU = mk_const4('S', 'T', 'O', 'U'),
+	const_STRU = mk_const4('S', 'T', 'R', 'U'),
+	const_SYST = mk_const4('S', 'Y', 'S', 'T'),
+	const_TYPE = mk_const4('T', 'Y', 'P', 'E'),
+	const_USER = mk_const4('U', 'S', 'E', 'R'),
+
+	OPT_l = (1 << 0),
+	OPT_1 = (1 << 1),
+	OPT_v = (1 << 2),
+	OPT_S = (1 << 3),
+	OPT_w = (1 << 4),
+};
+
 int ftpd_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
 int ftpd_main(int argc, char **argv)
 {
@@ -865,6 +882,7 @@ int ftpd_main(int argc, char **argv)
 
 	if (opts & (OPT_l|OPT_1)) {
 		/* Our secret backdoor to ls */
+/* TODO: pass -n too? */
 		xchdir(argv[2]);
 		argv[2] = (char*)"--";
 		return ls_main(argc, argv);