| Age | Commit message (Collapse) | Author | |
|---|---|---|---|
| 2014-08-25 | Delete secret or secret-derived data with explicit_bzero. | Doug Hogan | |
| concept ok deraadt@ diff looks ok tedu@ | |||
| 2014-03-24 | remove tcpwrappers support. ok deraadt | Ted Unangst | |
| 2014-03-17 | args! fix argstr. from LEVAI Daniel. | Stuart Henderson | |
| 2014-03-17 | tweak previous; | Jason McIntyre | |
| 2014-03-17 | typo, spotted by okan@ | Stuart Henderson | |
| 2014-03-17 | Add an option to disallow ftp access to accounts with uid below a certain | Stuart Henderson | |
| number (idea borrowed from pure-ftpd). Enabled by default with minimum uid 1000 to prevent access to admin accounts. tweak/OK millert@, OK deraadt@, gsoares@ and aja@ like it too. | |||
| 2014-02-08 | Fix REST (restart transfer) for offsets large than 2GB. OK okan@ | Todd C. Miller | |
| 2014-01-08 | If the file size is zero, there's nothing to transmit so avoid spamming | Jeremie Courreges-Anglas | |
| syslog with mmap failures. Noticed by and ok henning@, "looks right" deraadt@ | |||
| 2013-11-27 | unsigned char for ctype | Theo de Raadt | |
| ok okan kettenis | |||
| 2013-11-12 | repair the last prototype by bringing in monitor.h | Theo de Raadt | |
| 2013-08-22 | Correct format string mismatches turned up by -Wformat=2 | Philip Guenther | |
| suggestions and ok millert@ | |||
| 2013-07-26 | Make sure tmpline[] is always NUL terminated, to avoid possible | Philip Guenther | |
| read-beyond-end in get_line(). Analysis and patch by Maxime Villard (rustyBSD (at) gmx.fr) ok millert@ deraadt@ | |||
| 2012-12-04 | remove some unnecessary sys/param.h inclusions | Theo de Raadt | |
| 2012-09-27 | last stage of rfc changes, using consistent Rs/Re blocks, and moving the | Jason McIntyre | |
| references into a STANDARDS section; | |||
| 2012-08-04 | MDTM and SIZE have been in RFC 3659 for over five years. Also, mention both | Pascal Stumpf | |
| RFCs in "SEE ALSO". ok jmc@ | |||
| 2012-04-04 | Return an error much earlier if recvmsg fails | Theo de Raadt | |
| 2012-03-04 | In preparation for getline and getdelim additions to libc, rename getline() | Federico G. Schwindt | |
| occurrences to get_line(). Based on a diff from Jan Klemkow <j-dot-klemkow-at-wemelug-dot-de> to tech. | |||
| 2011-12-15 | s,/var/run/wtmp,/var/log/wtmp and add it to FILES. | Antoine Jacoutot | |
| from Steffen Daode Nurpmeso with a tweak from jmc@ ok jmc@ | |||
| 2011-12-14 | Add a new '-W' option to prevent saving login records to /var/run/wtmp. | Antoine Jacoutot | |
| This can become pretty handy on busy anonymous servers to avoid filling up /var with unused wtmp records. Note that 'U' and 'W' are mutually exclusive. ok sthen@ millert@ | |||
| 2011-02-09 | Set SO_KEEPALIVE on sockets. OK miod@. Also tested by landry@ | Todd C. Miller | |
| "Makes sense" markus@ and "i don't see a reason not to" henning@ | |||
| 2010-08-30 | Add missing network service name from /var/log/ftpd entries. | lum | |
| ok and suggestion from jmc@ ok tobias@ | |||
| 2010-08-27 | In revision 1.14 of ftpd.c the ident variable was removed from its only ↵ | lum | |
| meaningful usage when a snprintf call was removed, rendering ident useless. Time to remove remaining code. ok tobias@ | |||
| 2010-08-01 | Properly reset states when a login phase is interrupted by another one. | Tobias Stoeckmann | |
| Prevents ftpd from letting regular users logging in during anonymous-only mode (-A). ok millert, ray | |||
| 2010-07-30 | Don't set "success" flags before error checks. | Ray Lai | |
| Add check for login_getclass() failure, pointed out by tobias. OK tobias | |||
| 2010-06-18 | Prevent a segmentation fault on ftpd_popen error (memory, file descriptor, | Tobias Stoeckmann | |
| pipe ...) during status command. ok millert | |||
| 2010-06-13 | Adjust FTP reply codes (in error conditions) to conform to RFC 959. | Tobias Stoeckmann | |
| ok millert, schwarze | |||
| 2010-03-08 | Check that gl_pathc is bigger than zero before derefencing gl_pathv. While | Mark Kettenis | |
| this shouldn't happen since we specifiy GLOB_NOMAGIC, it doesn't hurt to be paranoid, even if we fix the bug in glob(3) that causes gl_pathc to be zero even if we specify GLOB_NOMAGIC. ok deraadt@ | |||
| 2009-10-28 | rcsid[] and sccsid[] and copyright[] are essentially unmaintained (and | Theo de Raadt | |
| unmaintainable). these days, people use source. these id's do not provide any benefit, and do hurt the small install media (the 33,000 line diff is essentially mechanical) ok with the idea millert, ok dms | |||
| 2009-06-04 | ...and now try again with a commit from the right tree. doh! | Stuart Henderson | |
| ftp uses its own ugly "sockunion" to hold addresses, but with CMD_BIND the monitor treats it as if it were a sockaddr. this is fine for v4 but fails for v6, so active connections break. problem reported and diff tested by Maurice Janssen. looks sensible to deraadt@. | |||
| 2009-06-04 | ftp uses its own ugly "sockunion" to hold addresses, but with CMD_BIND | Stuart Henderson | |
| the monitor treats it as if it were a sockaddr. this is fine for v4 but fails for v6, so active connections break. problem reported and diff tested by Maurice Janssen. looks sensible to deraadt@. | |||
| 2009-04-20 | When receiving a new connection, log the remote IP number | Ingo Schwarze | |
| in addition to the remote hostname. Feature requested by Mark Bucciarelli mkbucc at gmail dot com on misc@. "seems OK" millert@ | |||
| 2008-09-30 | Always say "User %s access denied", in all cases, to avoid some stupid | Theo de Raadt | |
| spinny things which parse those messages. Do not close the connection as requested by Josh Grosse, since a 530 is not supposed to do that. ok millert | |||
| 2008-09-13 | Fix minor bug in the previous commit, which could hang the | Moritz Jodeit | |
| current session, when the last character of an overly long line was a newline character. Additionally reply with 500 "Command too long" for commands, which are too large. Issue found and proposed fix by Luke Mewburn <lukem@NetBSD.org>. ok millert@ | |||
| 2008-09-12 | Don't split large commands into multiple commands on a 512-byte | Moritz Jodeit | |
| boundary but just fail on them. This prevents CSRF-like attacks, when a web browser is used to access an ftp server. Reported by Maksymilian Arciemowicz <cxib@securityreason.com>. ok millert@ martynas@ | |||
| 2008-06-30 | Include file order must be "monitor.h" before "extern.h" otherwise enum | Anders Magnusson | |
| auth_ret is referenced before it is declared, which is not allowed by C99. Ok krw@, millert@, gilles@ | |||
| 2008-04-13 | Use arc4random_buf() when requesting more than a single word of output | Damien Miller | |
| Use arc4random_uniform() when the desired random number upper bound is not a power of two ok deraadt@ millert@ | |||
| 2008-03-24 | msg_controllen has to be CMSG_SPACE so that the kernel can account for | Theo de Raadt | |
| each cmsg_len (ie. msg_controllen = sum of CMSG_ALIGN(cmsg_len). This works now that kernel fd passing has been fixed to accept a bit of sloppiness because of this ABI repair. lots of discussion with kettenis | |||
| 2008-03-15 | Repair the simple cases for msg_controllen where it should just be | Theo de Raadt | |
| CMSG_SIZE(sizeof(int)), not sizeof(buffer) which may be larger because of alignment; ok kettenis hshoexer | |||
| 2008-03-13 | Correct CMSG_SPACE and CMSG_LEN usage everywhere in the tree. Due to | Theo de Raadt | |
| an extensive discussion with otto, kettenis, millert, and hshoexer | |||
| 2007-09-02 | use calloc() to avoid malloc(n * m) overflows; checked by djm canacar jsg | Theo de Raadt | |
| 2007-07-31 | From Gilles Chehade: | Ray Lai | |
| - Use strtonum instead of atoi. - Improve strtol error checking. - Change strchr calls to strcspn and eliminating some unused variables as a result. OK moritz | |||
| 2007-07-27 | Fix potential memory leak, when snprintf(3) returns an empty buffer. | Moritz Jodeit | |
| OK ray@ | |||
| 2007-06-21 | Adjust spacing, combine malloc + strlcpy + strlcat into a single | Ray Lai | |
| asprintf call. OK moritz | |||
| 2007-06-19 | Make sure perror_reply() is only called when errno is set. When | Ray Lai | |
| changing perror_reply() -> reply(), increase error message detail for ftp client. Move free() statement to prevent errno clobbering. OK moritz | |||
| 2007-05-31 | convert to new .Dd format; | Jason McIntyre | |
| 2007-04-05 | Remove lint comment, which does not apply anymore. | Moritz Jodeit | |
| 2007-03-26 | Do not log when the slave gets killed because of read() | Moritz Jodeit | |
| returning 0. This is normal behavior and should not spam the logs. Noticed by henning@ OK henning@ millert@ | |||
| 2007-03-22 | Do not advertise version in the ftp banner, because there is no reason to. | Chad Loder | |
| OK mbalmer@, xsa@, henning@, idea prompted by deraadt | |||
| 2007-03-01 | - use proper log facility and priority in the slave sig handlers | Otto Moerbeek | |
| - if the monitor decides to kill the slave, log that ok millert@ moritz@ | |||
| 2006-12-21 | 'tranfer' -> 'transfer' in comments. | Kenneth R Westerback | |
 |
index : src | |
| OpenBSD base system |
| summaryrefslogtreecommitdiff |