From 536572383347c9d5543dabdb387b3b1b40657d1e Mon Sep 17 00:00:00 2001 From: Paul Howarth Date: Aug 24 2018 12:58:09 +0000 Subject: Fix for upstream bug 4356, config parsing issue Fix infinite loop possible in mod_sftp's set_sftphostkey() function, by actually iterating properly for the next configuration record http://bugs.proftpd.org/show_bug.cgi?id=4356 https://github.com/proftpd/proftpd/pull/736 --- diff --git a/.rpmlint b/.rpmlint deleted file mode 100644 index a37f5f6..0000000 --- a/.rpmlint +++ /dev/null @@ -1,55 +0,0 @@ -from Config import * - -# Technical terms spelled correctly -addFilter("spelling-error %description -l en_US customizable -> ") -addFilter("spelling-error %description -l en_US passwd -> ") -addFilter("spelling-error %description -l en_US systemd -> ") -addFilter("spelling-error %description -l en_US virtualhost -> ") -addFilter("spelling-error %description -l en_US xinetd -> ") - -# Proftpd allows specification of ciphers; should change proftpd.conf to use system default -addFilter("crypto-policy-non-compliance-openssl /usr/sbin/proftpd SSL_CTX_set_cipher_list") - -# All FTP daemons provide this -addFilter("unversioned-explicit-provides ftpserver") - -# This is the correct place for tmpfiles snippets -addFilter("hardcoded-library-path in %{_prefix}/lib/tmpfiles.d") -addFilter("only-non-binary-in-usr-lib") - -# These modes are intentional -addFilter("non-readable /etc/proftpd.conf 640") -addFilter("non-standard-dir-perm /var/ftp/uploads 331") -addFilter("non-standard-dir-perm /var/log/proftpd 750") - -# /var/run/proftpd maintained by tmpfiles snippet too -# Owning the directories in the package allows the daemon to run immediately after install, with no reboot -addFilter("dir-or-file-in-var-run /var/run/proftpd") -addFilter("non-ghost-in-run /run/proftpd") - -# File should exist but have no default content -addFilter("zero-length /etc/ftpusers") - -# Same manpage as proftpd -addFilter("no-manual-page-for-binary in.proftpd") - -# This is normal for libtool projects -addFilter("hidden-file-or-dir /usr/src/debug/proftpd-.*/\.libs") - -# Upstream does not provide documentation for devel tools/API yet -addFilter("no-documentation") -addFilter("no-manual-page-for-binary prxs") - -# https://github.com/proftpd/proftpd/pull/493 -# https://github.com/proftpd/proftpd/commit/75ed08ffe309b75b78dfcdeb4164d88ced4b0888 -addFilter("incorrect-fsf-address /usr/src/debug/proftpd-.*/modules/mod_geoip.c") -addFilter("incorrect-fsf-address /usr/include/proftpd/ident.h") -addFilter("incorrect-fsf-address /usr/include/proftpd/utf8.h") -addFilter("incorrect-fsf-address /usr/include/proftpd/lastlog.h") - -# https://github.com/Castaglia/proftpd-mod_vroot/pull/14 -# https://github.com/Castaglia/proftpd-mod_vroot/commit/10d341c130f32c9b23e0acb0e3337a9fef7826ea -addFilter("incorrect-fsf-address /usr/src/debug/proftpd-.*/contrib/mod_vroot/mod_vroot.c") -addFilter("incorrect-fsf-address /usr/src/debug/proftpd-.*/contrib/mod_vroot/fsio.c") -addFilter("incorrect-fsf-address /usr/src/debug/proftpd-.*/contrib/mod_vroot/path.c") -addFilter("incorrect-fsf-address /usr/src/debug/proftpd-.*/contrib/mod_vroot/alias.c") diff --git a/fa378a8f.patch b/fa378a8f.patch new file mode 100644 index 0000000..ddfb05e --- /dev/null +++ b/fa378a8f.patch @@ -0,0 +1,31 @@ +From fa378a8f2bc1b24ab93c157495960080aa788299 Mon Sep 17 00:00:00 2001 +From: TJ Saunders +Date: Wed, 8 Aug 2018 11:15:21 -0700 +Subject: [PATCH] Bug#4356: Fix infinite loop by actually iterating properly + for the next configuration record. Oops. + +--- + contrib/mod_sftp/mod_sftp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/contrib/mod_sftp/mod_sftp.c b/contrib/mod_sftp/mod_sftp.c +index b7fdfa541..655b12af1 100644 +--- a/contrib/mod_sftp/mod_sftp.c ++++ b/contrib/mod_sftp/mod_sftp.c +@@ -1,6 +1,6 @@ + /* + * ProFTPD - mod_sftp +- * Copyright (c) 2008-2017 TJ Saunders ++ * Copyright (c) 2008-2018 TJ Saunders + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by +@@ -1211,6 +1211,8 @@ MODRET set_sftphostkey(cmd_rec *cmd) { + insecure_hostkey_perms = TRUE; + break; + } ++ ++ c = find_config_next(c, c->next, CONF_PARAM, "SFTPOptions", FALSE); + } + + if (insecure_hostkey_perms) { diff --git a/proftpd.rpmlintrc b/proftpd.rpmlintrc new file mode 100644 index 0000000..a37f5f6 --- /dev/null +++ b/proftpd.rpmlintrc @@ -0,0 +1,55 @@ +from Config import * + +# Technical terms spelled correctly +addFilter("spelling-error %description -l en_US customizable -> ") +addFilter("spelling-error %description -l en_US passwd -> ") +addFilter("spelling-error %description -l en_US systemd -> ") +addFilter("spelling-error %description -l en_US virtualhost -> ") +addFilter("spelling-error %description -l en_US xinetd -> ") + +# Proftpd allows specification of ciphers; should change proftpd.conf to use system default +addFilter("crypto-policy-non-compliance-openssl /usr/sbin/proftpd SSL_CTX_set_cipher_list") + +# All FTP daemons provide this +addFilter("unversioned-explicit-provides ftpserver") + +# This is the correct place for tmpfiles snippets +addFilter("hardcoded-library-path in %{_prefix}/lib/tmpfiles.d") +addFilter("only-non-binary-in-usr-lib") + +# These modes are intentional +addFilter("non-readable /etc/proftpd.conf 640") +addFilter("non-standard-dir-perm /var/ftp/uploads 331") +addFilter("non-standard-dir-perm /var/log/proftpd 750") + +# /var/run/proftpd maintained by tmpfiles snippet too +# Owning the directories in the package allows the daemon to run immediately after install, with no reboot +addFilter("dir-or-file-in-var-run /var/run/proftpd") +addFilter("non-ghost-in-run /run/proftpd") + +# File should exist but have no default content +addFilter("zero-length /etc/ftpusers") + +# Same manpage as proftpd +addFilter("no-manual-page-for-binary in.proftpd") + +# This is normal for libtool projects +addFilter("hidden-file-or-dir /usr/src/debug/proftpd-.*/\.libs") + +# Upstream does not provide documentation for devel tools/API yet +addFilter("no-documentation") +addFilter("no-manual-page-for-binary prxs") + +# https://github.com/proftpd/proftpd/pull/493 +# https://github.com/proftpd/proftpd/commit/75ed08ffe309b75b78dfcdeb4164d88ced4b0888 +addFilter("incorrect-fsf-address /usr/src/debug/proftpd-.*/modules/mod_geoip.c") +addFilter("incorrect-fsf-address /usr/include/proftpd/ident.h") +addFilter("incorrect-fsf-address /usr/include/proftpd/utf8.h") +addFilter("incorrect-fsf-address /usr/include/proftpd/lastlog.h") + +# https://github.com/Castaglia/proftpd-mod_vroot/pull/14 +# https://github.com/Castaglia/proftpd-mod_vroot/commit/10d341c130f32c9b23e0acb0e3337a9fef7826ea +addFilter("incorrect-fsf-address /usr/src/debug/proftpd-.*/contrib/mod_vroot/mod_vroot.c") +addFilter("incorrect-fsf-address /usr/src/debug/proftpd-.*/contrib/mod_vroot/fsio.c") +addFilter("incorrect-fsf-address /usr/src/debug/proftpd-.*/contrib/mod_vroot/path.c") +addFilter("incorrect-fsf-address /usr/src/debug/proftpd-.*/contrib/mod_vroot/alias.c") diff --git a/proftpd.spec b/proftpd.spec index a740b35..6f02845 100644 --- a/proftpd.spec +++ b/proftpd.spec @@ -52,7 +52,7 @@ %undefine _strict_symbol_defs_build #global prever rc3 -%global rpmrel 16 +%global rpmrel 17 %global mod_vroot_version 0.9.5 Summary: Flexible, stable and highly-configurable FTP server @@ -90,6 +90,7 @@ Patch113: https://github.com/proftpd/proftpd/commit/41ecb7dc.patch Patch114: https://github.com/proftpd/proftpd/commit/ad786eaa.patch Patch115: https://github.com/proftpd/proftpd/commit/a2c02a6b.patch Patch116: proftpd-1.3.6-ENOATTR.patch +Patch117: https://github.com/proftpd/proftpd/commit/fa378a8f.patch BuildRequires: coreutils BuildRequires: gcc @@ -341,6 +342,12 @@ mv contrib/README contrib/README.contrib # Don't assume ENOATTR is defined in test suite %patch116 -p1 +# Fix infinite loop possible in mod_sftp's set_sftphostkey() function, by +# actually iterating properly for the next configuration record +# http://bugs.proftpd.org/show_bug.cgi?id=4356 +# https://github.com/proftpd/proftpd/pull/736 +%patch117 -p1 + # OpenSSL Cipher Profiles introduced in Fedora 21 # Elsewhere, we use the default of DEFAULT:!ADH:!EXPORT:!DES %if (0%{?rhel} && 0%{?rhel} <= 7) || (0%{?fedora} && 0%{?fedora} <= 20) @@ -614,6 +621,12 @@ fi %{_mandir}/man1/ftpwho.1* %changelog +* Fri Aug 24 2018 Paul Howarth - 1.3.6-17 +- Fix infinite loop possible in mod_sftp's set_sftphostkey() function, by + actually iterating properly for the next configuration record + http://bugs.proftpd.org/show_bug.cgi?id=4356 + https://github.com/proftpd/proftpd/pull/736 + * Fri Jul 13 2018 Fedora Release Engineering - 1.3.6-16 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild