kpriv/pkgsrc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
pkgsrc/net/vsftpd/Makefile

67 lines
1.8 KiB
Makefile
Raw Normal View History

Mirror locally
2011-12-07 11:24:47 +01:00
# $NetBSD: Makefile,v 1.35 2011/12/07 10:24:47 joerg Exp $
Initial import of vsftpd-0.9.1 vsftpd is an FTP server, or daemon. The "vs" stands for Very Secure. Obviously this is not a guarantee, but a reflection that I have written the entire codebase with security in mind, and carefully designed the program to be resilient to attack. Recent evidence suggests that vsftpd is also extremely fast (and this is before any explicit performance tuning!) In tests against wu-ftpd, vsftpd was always faster, supporting over twice as many users in some tests. Package provided by Jacek Latos <vaneth@krasnik.org> in pkg/13208; minor modifications by me.
2001-06-19 13:32:02 +02:00
#
Update to 2.3.4, based on a patch by Stephan Tesch <s.tesch@science-computing.de> on pkgsrc-users. - Avoid consuming excessive CPU when matching filenames to patterns. Thanks to Maksymilian Arciemowicz <cxib@securityreason.com>. - Some bugfixes from Rapha no apparent security impact. At this point: v2.3.3 released! =============================== - Fix compile. Extreme suckage. At this point: v2.3.4 released! ===============================
2011-09-09 17:13:09 +02:00
DISTNAME= vsftpd-2.3.4
Initial import of vsftpd-0.9.1 vsftpd is an FTP server, or daemon. The "vs" stands for Very Secure. Obviously this is not a guarantee, but a reflection that I have written the entire codebase with security in mind, and carefully designed the program to be resilient to attack. Recent evidence suggests that vsftpd is also extremely fast (and this is before any explicit performance tuning!) In tests against wu-ftpd, vsftpd was always faster, supporting over twice as many users in some tests. Package provided by Jacek Latos <vaneth@krasnik.org> in pkg/13208; minor modifications by me.
2001-06-19 13:32:02 +02:00
CATEGORIES= net
Mirror locally
2011-12-07 11:24:47 +01:00
MASTER_SITES= http://security.appspot.com/downloads/ \
${MASTER_SITE_LOCAL}
Initial import of vsftpd-0.9.1 vsftpd is an FTP server, or daemon. The "vs" stands for Very Secure. Obviously this is not a guarantee, but a reflection that I have written the entire codebase with security in mind, and carefully designed the program to be resilient to attack. Recent evidence suggests that vsftpd is also extremely fast (and this is before any explicit performance tuning!) In tests against wu-ftpd, vsftpd was always faster, supporting over twice as many users in some tests. Package provided by Jacek Latos <vaneth@krasnik.org> in pkg/13208; minor modifications by me.
2001-06-19 13:32:02 +02:00
Point MAINTAINER to pkgsrc-users@NetBSD.org in the case where no developer is officially maintaining the package. The rationale for changing this from "tech-pkg" to "pkgsrc-users" is that it implies that any user can try to maintain the package (by submitting patches to the mailing list). Since the folks most likely to care about the package are the folks that want to use it or are already using it, this would leverage the energy of users who aren't developers.
2006-03-04 22:28:51 +01:00
MAINTAINER= pkgsrc-users@NetBSD.org
Updated to version 1.1.3. Addresses PR pkg/21410 by Jens Liebau. - honour PKG_SYSCONFDIR - rcd script, standalone mode support - tcp wrappers support - install vsftpd:vsftpd user - new HOMEPAGE and MASTER_SITES 1.1.3: ====== - Support for tcp_wrappers. - First stab at Solaris sendfilev() support. - Don't bomb out the listener on SIGHUP if the config became invalid. - End vsf_findlibs.sh with "exit 0;" - thanks Lars Hecking <lhecking@nmrc.ie>! - Integrate with tcp_wrappers - load config based on VSFTPD_LOAD_CONF environment variables. Allows per-IP configurability in standalone mode. - Fix build without tcp_wrappers. - Fix Solaris sendfilev() support - interruption via a signal returns EINTR rather than a partial byte count! - Add to EXAMPLE/ - PER_IP_CONFIG and INTERNET_SITE_NOINETD 1.1.2: ====== - Add per-IP connection limits in standalone mode. - Add logging of refused connect due to global or IP connection limits. - (Many thanks for testing and suggestions from Rob van Nieuwkerk <robn@verdi.et.tudelft.nl> and Adrian Reber <adrian@lisas.de>. - Make connection limit exceeded messages nonblocking. - Don't exit the listener if fork fails. 1.1.1: ====== - Fix port_promiscuous, oops! Thanks to Bjørn-Ove Heimsund <bjornoh@mi.uib.no>. - Fix to support umasks which create executable files. Reported by "Martin, Andreas" <AMartin@hegau-klinikum.de>. - Make the messages more.. professional :( Thanks to Steven G. Taylor <staylor@redhat.com>. - Allow anon users to append to files if they can delete files! Suggestion from Michael Leuchtenburg <michael@slashhome.org>. - Hopefully fix Solaris build (-lresolv) - Replace atoll() with a homebrew - modern FreeBSD, OpenBSD lack it. - Different solution for a umask which creates executable files: file_open_mode. - First attempt at Tru64 build, working with <Sulla17@aol.com>. - A few minor FAQ additions. - Change date format in the log from Sep 09 -> Sep 9. Avoids breaking some broken log parsers. - Make "INSTALL" better and clearer. - Fix passwd_chroot_enable, reported by James Jones <james@richland.edu>. - Finish Tru64 building :-) - Add tunable_no_anon_password as asked for by Stephen Quinney <stephen.quinney@computing-services.oxford.ac.uk>. 1.1.0: ====== - large file (>2Gb) support). - Fix .spec files to use /usr/local/sbin not /usr/sbin, noted by Bill Unruh <unruh@physics.ubc.ca>. - Small doc tweaks and improvements(?) - Add COPYING, the GNU GPL version 2. - Add use_localtime config option to override the use of GMT times. - Add tunable_check_shell (default YES) so people can disable this if they are not using PAM. - AIX 5.1 build support, thanks to Jan-Frode Myklebust <janfrode@parallab.uib.no>. - Add "hide_ids" option to show user/group in directory listings as "ftp". Request from Solar. - Use the seemingly more portable setreuid() and setregid(), poxy HP. - Use status 550 instead of 500 for known but disabled commands. - Rename "dirchange.[ch]" to "banner.[ch]". - Multiline connect banner support via "banner_file" config option. - Minor error message changes. - Add more FAQ entries. - Add patch to specify PASV address - thanks to Mike McLean <mikem@redhat.com>. - Drop the 2.4.0 kernel warning file - Rudimentary standalone listener support - to be expanded in a later release. - If sendfile() returns EINVAL just fall back to normal routines - handles non-pagecache backed files. - Add "port_promiscuous" setting - should help enabling FXP. - Modify anon_root and local_root to change directory _before_ applying the chroot(). - Open all files O_NONBLOCK to avoid pipes blocking on open. - Support wu-ftpd style per-user chroot() via /./ in /etc/passwd HOMEDIR. - Add SIGHUP support to new built in listener. - Per-user config overrides, via "user_config_dir" - woohoo! - Warning fixes, i.e. change "index" to "indexx" thanks to Olaf Kirch <okir@suse.de>. - Make sure the standalone daemon doesn't leak zombies! - Supposedly fix kernel messages about MSG_PEEK race - thanks to advice from Alexey <kuznet@ms2.inr.ac.ru>. - Add global client limit for standalone mode. - Add username that failed when we die with str_getpwnam. - Add a bunch of documentation under EXAMPLES.
2003-05-10 01:31:38 +02:00
HOMEPAGE= http://vsftpd.beasts.org/
Initial import of vsftpd-0.9.1 vsftpd is an FTP server, or daemon. The "vs" stands for Very Secure. Obviously this is not a guarantee, but a reflection that I have written the entire codebase with security in mind, and carefully designed the program to be resilient to attack. Recent evidence suggests that vsftpd is also extremely fast (and this is before any explicit performance tuning!) In tests against wu-ftpd, vsftpd was always faster, supporting over twice as many users in some tests. Package provided by Jacek Latos <vaneth@krasnik.org> in pkg/13208; minor modifications by me.
2001-06-19 13:32:02 +02:00
COMMENT= FTP server that aims to be very secure
Updated net/vsftpd to 2.3.2 Changes since 2.0.7 - Remove .postlogin.c.swp (thanks Kaibin Li <kbli@fortinet.com>)! - findlibs repairs for libcap; builds on my Ubuntu 6.06 again. - Apply patch to fix "error: assignment of read-only member '__in'" build error on broken systems where the WIFEXITED() etc. macros write to their argument. Thanks Ingo Terpelle <it@exanto.de>. - Replace spaces in xferlog with underscores, report from Michael Wittauer <michael.wittauer@sonydadc.com>. - Reload default config values before re-parsing config file on SIGHUP. This makes the values correct in the case a setting was removed from the file. - Do not issue an FTP response for a blank line on the control channel. Fixes issues with some broken NAT devices. ProFTPd does the same, so hopefully nothing will break. Report from Frank Bulk <fbulk@mypremieronline.com>. - Replace usage of broken _syscall() with syscall(). Fixes build errors for those without libcap-devel installed. - Add implicit SSL support with implicit_ssl option. - Remove arbitrary restriction on one process model + SSL. - Set a session ID on the SSL context. - Add the skeleton of a built-in ptrace sandbox. Not yet useful for anything other than catching compile errors. Yes, I'm crazy :P - Use PR_SET_PDEATHSIG all over the place so that when the listener is killed, existing sessions are booted too. - Use SSL_peek; makes SSL pipelining work. Note that I never found any SSL client that need it, but still a nice code clean-up. - Change ASCII download behaviour so \r\n does not become \r\r\n. This mirrors proftpd behaviour instead of wu-ftpd. Thanks Paul Abel <pabel@fexcodcc.com>. - Switch all sighandlers to the synchronous ones. Prevents us having to block and unblock signals all the time. - Add a "use alarm" option to synchronous signal handlers, to ensure the race condition against a blocking call does not result in a permanent non-delivery. - Use SIGTERM for privileged parent process shutdown, so they can still update u/wtmp properly. - Do RAND_load_file from /dev/urandom in the child context because I don't trust the OpenSSL API vs. fork(). Different children do have different RNG state; this is defense in depth. - More thoroughly close the remote ends of the priv_sock, ensuring that child death results in no blocking in the parent. This is a matter of tidyness; the SIGCHLD handler will reliably tear down the parent. - Do the same for the SSL slave / consumer channels. - Fix OpenBSD build. - Move SSL data handling into the SSL slave process. Incurs some extra overhead in terms of context switches and copies, but it enables this next item: - By default, require SSL data connections to exhibit SSL session re-use of the control channel. Unlike the cert thing, this _is_ something we can turn on by default as most clients seem to do reuse. Yay. - Change 522 response for SSL connection fail to note when session reuse is required. (v2.1.0pre1 here) - More work on the inbuilt ptrace()-sandbox support. - Clear the idle alarm when starting data transfer if there is no data alarm. - Fix syslog format; don't embed 2nd copy of date, pid. Thanks to Ren - Lock file before truncating it for upload. Fixes various simultaneous upload corruption issues. - Make sure to give 426 error code on uploads if ABOR was received. - Add cmds_denied option to complement cmds_allowed. - Ignore lines in config file containing only white space. - Require write_enable / anon_upload_enable / etc. to process STOU. - FC10 patch (vsftpd-1.0.1-missingok.patch): tweak to logrotate file. - FC10 patch (vsftpd-1.2.1-nonrootconf.patch): bail if the config file is not owned by the currently running user. - FC10 patch (vsftpd-2.0.1-tcp_wrappers.patch): explicitly call openlog() to avoid syslog() bug where some settings are not initialized. - FC10 patch (vsftpd-2.0.3-daemonize_fds.patch): when backgrounding, replace fd 0,1,2 with /dev/null fd. - FC10 patch (vsftpd-2.0.5-correct_comments.patch): comment tweaks in the sample config file. - FC10 patch (vsftpd-2.0.5-fix_unique.patch): use the default filename given by STOU if it is available. - FC10 patch (vsftpd-2.0.5-pam_end.patch): call pam_end() properly so modules can act on errors if they want. - FC10 patch (vsftpd-2.0.5-pasv_dot.patch): Strict RFC compliance for PASV command; add a trailing period. - FC10 patch (vsftpd-2.0.5-uname_size.patch): allow longer usernames. It's not 1990 any more, so trust PAM etc. to not stack-buffer-overflow. - FC10 patch (vsftpd-2.0.5-underscore_uname.patch): permit username to start with underscore or period. - FC10 patch (vsftpd-2.0.6-listen.patch): default listen to YES. - Fix crash on SIGHUP introduced in 2.1.0pre1. Oops. - FC10 patch (vsftpd-2.0.5-bind_denied.patch): retry PASV bind() on EACCES too, which can happen on SELinux systems. - Default resource limit for child processes: 100MB address space. - Finishing touches to the initial sandbox policy; only permit connect() to the host on the control channel being the nicest touch. (v2.1.0pre2 here) - Fix 64-bit build (oops)! Thanks Martin Nagy <mnagy@redhat.com>. - Fix config of SSL built in; not enabled; two process model. Report from Martin. - Shutdown the command connection in the priv parent's SIGTERM handler; kills of children where the PR_SET_PDEATHSIG cannot due to different user ids. (v2.1.0pre3 here) - Fix build on FC10. - Some FAQ tweaks. - Permit fcntl(F_GETFD) in sandbox policy. Needed for FC10. Not sure where it comes from but it is harmless. (My guess would be glibc-2.9's new support for using O_CLOEXEC more). - Fix build warning on 64-bit. - Fix build on OpenBSD again. (v2.1.0pre4 here) - Bring userlist_deny handling inside the max_login_fail accounting. At this point: v2.1.0 released! =============================== - Apply Tavis' RLIMIT_NOFILE trick in the twoprocess model's initial unprivileged child. - Fix build error due to __NR_utimes. - Ugh. Can't use RLIMIT_NOFILE in the SSL case because the process later receives data transfer fd's via recvmsg(). It's a total shame because doing the SSL handshake under even lower privs would be a real boost. (v2.1.1pre1 here) - Fix some declarations occuring in the middle of a block; broke older more strict compilers. - Handle the case where libcap is now libcap.so.2; fixes build on my new Ubuntu 9.04. - Enhance 522 error message to point to require_ssl_reuse option. - Fix NASTY regression whereby data transfer timeouts would fire incorrectly under SSL transfers. In addition, the transfer rate caps were not working under SSL transfers. Reported by several people. - Use the login delay machinery for userlist-based denials too. Thanks to Tomas Hoger <thoger@redhat.com> for the patch. - Fix another tedious regression whereby absent per-user config files were causing a session fail rather than being gracefully ignored. - Use the somewhat new CLONE_NEWPID / CLONE_NEWIPC to provide more isolation in the vsftpd low-priv processes (CLONE_NEWNET pending). - Use RLIMIT_NPROC to disallow fork()ing etc. in processes that do not need to create new ones. - Add "isolate" config flag to disable the new weird clone() flags if necessary. At this point: v2.1.1 released! =============================== - Fix compile error in sysdeputil.c on some Linux systems. At this point: v2.1.2 released! =============================== - Fix compile on systems with no RLIMIT_NPROC, oops. - Change some unsigned int to socklen_t's to avoid warnings on various platforms, e.g. AIX. - Add some syscall constants to ptracesandbox.c to fix the build on systems with 2.4 kernel headers. - Look for libs in /lib64 and /usr/lib64 too (Fixes Fedora 11 x86_64 compile). - Fix EACCES mapping, thanks Solar Designer <solar@openwall.com>. - Dont emit a bogus "OOPS: " message upon a QUIT, report from Solar Designer <solar@openwall.com>. - Tweak example vsftpd.conf to add commented out chroot_local_user=YES, from Ivan I. Grushin <mcgru@intrice.ru>. - Where available, use CLONE_NEWNET to isolate the untrusted processes so that they can't do arbitrary connect() and instead have to ask the privileged process for sockets. Moderate code disturbance - hope for no breakage :-/ - Disable implicit activation of one_process_model so that an anonymous setup can benefit from the no-network isolation of the unprivileged process (where available). (vsftpd-2.2.0pre1) - Call pam_get_item(PAM_USER) after authentication in case a PAM module remapped the username. Based on a patch from John McNair <john.mcnair@ihg.com>. - Apply a couple of IPv6 fixes from Corinna Schultz <corinna.schultz@gmail.com>, particularly when MS operating systems are talking on link local addresses. - Handle the error case for accepting a PASV connection in the two process model properly. - Pull in a couple of minor tidyup patches from Openwall. - Add "-o" command line option to specify option, e.g. vsftpd -olisten=NO. Also respect ordering with respect config files, e.g. vsftpd -olisten=NO /etc/vsftpd.conf -olocal_enable=NO Inspiration from Solar / Openwall. (vsftpd-2.2.0pre2) - Revert listen to be "NO" by default and also set max_per_ip / max_clients to 2000 / 50 as a default. Thanks to Solar. - Sanity check for admin: check config files are regular files. - Error out if opening the per-user config file gives an error other than ENOENT. Thanks Solar (who is on fire today ;-) (vsftpd-2.2.0pre3) - Apply some typo fixes from Solar. - Error out on read() errors when reading config files. (vsftpd-2.2.0pre4) - Add tunable_isolate_network to parseconf.c, thanks Stefan Pfetzing <dreamind@dreamind.de>. - Don't try and use CLONE_NEWPID etc. if we get EPERM -- may happen even to root if using linux-vserver. Also thanks to Stefan Pfetzing <dreamind@dreamind.de>. - Couple of typo tweaks from Cristi Terpea <cristi.terpea@fortech.ro>. - Change // style comments to /* style. - Fix pointer aliasing issue in new PAM_USER item support, thanks to Solar. At this point: v2.2.0 released! =============================== - Apply patch to set SSL context timeout to maximum, from Tim Kosse <tim.kosse@filezilla-project.org>. Should prevent data connection failures after a long transfer or idle period. - Apply async-safety signal tweaks from Solar. - Fix crash regression with the pasv_address option enabled. - Typo fix and look for libnsl in /lib64, from Robby Workman <rworkman@slackware.com>. - When asking the client to send us a cert, make sure we broadcast some suitable certificates. Fixes compatibility with the z/OS FTP client when tunable_ssl_request_cert=YES. - Rip out the silly "cached time" concept. Simplifies things and fixes incorrect transfer time bug reported by Rajeev V. Pillai. Explicitly pass around the cached current time in seconds in the one place that needs to avoid repeated gettimeofday() calls (directory listing). - Do the login fail delay in the parent process for cases where we checked a username / password. At this point: v2.2.1 released! =============================== - Change "File receive OK." to "Transfer complete." to placate some broken clients. Thanks Holger Kiehl <Holger.Kiehl@dwd.de>. - Fix erroneous "child died" upon FTP client connect, when under load. Awesome thanks to Holger Kiehl <Holger.Kiehl@dwd.de> for running diagnostic tests on his live server. - Boot the session if an overly long line is encountered. (vsftpd-2.2.2pre1) At this point: v2.2.2 released! =============================== - Add extremely simply HTTP support. It's very experimental, ignorant of HTTP protocol and headers, and likely has all sorts of other issues. The use case it might satisfy is if you need to serve simple static unathenticated content with large levels of paranoia. - Fix port_promiscuous breakage. Report from Soeren <soeren84@fastmail.net>. (v2.3.0pre1) - Minor FAQ update. - Use a larger address space limit if using text_userdb_names=YES - Always use CLONE_NEWNET if possible when in HTTP mode. - Change REST + STOR so that it's possible to overwrite part of file without truncating it. (v2.3.0pre2) - Boot the session if we see a USER where encryption was required. May prevent the transmission of plaintext passwords by buggy clients. Idea from Marcin Hlybin <marcin@rootnode.net>. - Fix failure to transmit a large ASCII file over SSL, if it contains \n -> \r\n fixups. At this point: v2.3.0 released! =============================== - Fix silly regression re: log files being overwritten from the start. - Rename a few file-open functions to make it clearer what they do. At this point: v2.3.1 released! =============================== - Argh! Fix version number. At this point: v2.3.2 released! ===============================
2010-11-08 18:10:55 +01:00
LICENSE= gnu-gpl-v2
Initial import of vsftpd-0.9.1 vsftpd is an FTP server, or daemon. The "vs" stands for Very Secure. Obviously this is not a guarantee, but a reflection that I have written the entire codebase with security in mind, and carefully designed the program to be resilient to attack. Recent evidence suggests that vsftpd is also extremely fast (and this is before any explicit performance tuning!) In tests against wu-ftpd, vsftpd was always faster, supporting over twice as many users in some tests. Package provided by Jacek Latos <vaneth@krasnik.org> in pkg/13208; minor modifications by me.
2001-06-19 13:32:02 +02:00
Add DESTDIR support.
2008-06-20 03:09:05 +02:00
PKG_DESTDIR_SUPPORT= user-destdir
Updated to version 1.1.3. Addresses PR pkg/21410 by Jens Liebau. - honour PKG_SYSCONFDIR - rcd script, standalone mode support - tcp wrappers support - install vsftpd:vsftpd user - new HOMEPAGE and MASTER_SITES 1.1.3: ====== - Support for tcp_wrappers. - First stab at Solaris sendfilev() support. - Don't bomb out the listener on SIGHUP if the config became invalid. - End vsf_findlibs.sh with "exit 0;" - thanks Lars Hecking <lhecking@nmrc.ie>! - Integrate with tcp_wrappers - load config based on VSFTPD_LOAD_CONF environment variables. Allows per-IP configurability in standalone mode. - Fix build without tcp_wrappers. - Fix Solaris sendfilev() support - interruption via a signal returns EINTR rather than a partial byte count! - Add to EXAMPLE/ - PER_IP_CONFIG and INTERNET_SITE_NOINETD 1.1.2: ====== - Add per-IP connection limits in standalone mode. - Add logging of refused connect due to global or IP connection limits. - (Many thanks for testing and suggestions from Rob van Nieuwkerk <robn@verdi.et.tudelft.nl> and Adrian Reber <adrian@lisas.de>. - Make connection limit exceeded messages nonblocking. - Don't exit the listener if fork fails. 1.1.1: ====== - Fix port_promiscuous, oops! Thanks to Bjørn-Ove Heimsund <bjornoh@mi.uib.no>. - Fix to support umasks which create executable files. Reported by "Martin, Andreas" <AMartin@hegau-klinikum.de>. - Make the messages more.. professional :( Thanks to Steven G. Taylor <staylor@redhat.com>. - Allow anon users to append to files if they can delete files! Suggestion from Michael Leuchtenburg <michael@slashhome.org>. - Hopefully fix Solaris build (-lresolv) - Replace atoll() with a homebrew - modern FreeBSD, OpenBSD lack it. - Different solution for a umask which creates executable files: file_open_mode. - First attempt at Tru64 build, working with <Sulla17@aol.com>. - A few minor FAQ additions. - Change date format in the log from Sep 09 -> Sep 9. Avoids breaking some broken log parsers. - Make "INSTALL" better and clearer. - Fix passwd_chroot_enable, reported by James Jones <james@richland.edu>. - Finish Tru64 building :-) - Add tunable_no_anon_password as asked for by Stephen Quinney <stephen.quinney@computing-services.oxford.ac.uk>. 1.1.0: ====== - large file (>2Gb) support). - Fix .spec files to use /usr/local/sbin not /usr/sbin, noted by Bill Unruh <unruh@physics.ubc.ca>. - Small doc tweaks and improvements(?) - Add COPYING, the GNU GPL version 2. - Add use_localtime config option to override the use of GMT times. - Add tunable_check_shell (default YES) so people can disable this if they are not using PAM. - AIX 5.1 build support, thanks to Jan-Frode Myklebust <janfrode@parallab.uib.no>. - Add "hide_ids" option to show user/group in directory listings as "ftp". Request from Solar. - Use the seemingly more portable setreuid() and setregid(), poxy HP. - Use status 550 instead of 500 for known but disabled commands. - Rename "dirchange.[ch]" to "banner.[ch]". - Multiline connect banner support via "banner_file" config option. - Minor error message changes. - Add more FAQ entries. - Add patch to specify PASV address - thanks to Mike McLean <mikem@redhat.com>. - Drop the 2.4.0 kernel warning file - Rudimentary standalone listener support - to be expanded in a later release. - If sendfile() returns EINVAL just fall back to normal routines - handles non-pagecache backed files. - Add "port_promiscuous" setting - should help enabling FXP. - Modify anon_root and local_root to change directory _before_ applying the chroot(). - Open all files O_NONBLOCK to avoid pipes blocking on open. - Support wu-ftpd style per-user chroot() via /./ in /etc/passwd HOMEDIR. - Add SIGHUP support to new built in listener. - Per-user config overrides, via "user_config_dir" - woohoo! - Warning fixes, i.e. change "index" to "indexx" thanks to Olaf Kirch <okir@suse.de>. - Make sure the standalone daemon doesn't leak zombies! - Supposedly fix kernel messages about MSG_PEEK race - thanks to advice from Alexey <kuznet@ms2.inr.ac.ru>. - Add global client limit for standalone mode. - Add username that failed when we die with str_getpwnam. - Add a bunch of documentation under EXAMPLES.
2003-05-10 01:31:38 +02:00
PKG_SYSCONFSUBDIR= vsftpd
Update to version 1.2.1. Changes: - Apply NetBSD patch to sysdeputil.c to activate a few features. Thanks to Lubomir Sedlacik <salo@netbsd.org>. - Apply fix for broken clients that terminate commands with \r\r\n. Thanks to Andrey Chernomyrdin <andrey@excom.spb.su>. - AIX send_file support, thanks to Tomas Ogren <stric@ing.umu.se>. - Fix typos in vsftpd.conf.5, thanks to SEKINE Tatsuo <tsekine@sdri.co.jp>. - Simple -F flag support to LIST and NLST. Needed for some broken clients. - Add simple ? wildcard in pattern matching. - Make pasv_min_port and pasv_max_port work if they are the same value. Thanks to Marvin Solomon <solomon@cs.wisc.edu>. - Paranoia: ignore user_config_dir if username has a / in it. - Implement stub ALLO command to keep busybox/ftpput happy. - Implement REIN, ACCT and SMNT stubs. - Implement FEAT along with an OPTS stub. - Implement STAT (no-args version). - Implement STAT (file/dir). - Add very simple access control via hide_file and deny_file. These should NOT be used for securing content as they are very dumb! Filesystem permissions are still the recommended way for securing important content. - Allow unsetting of string values with option= (i.e. blank). - Default virtual users to being chroot()'ed to the guest_user's home directory, if virtual_use_local_privs is not set. - Add support for "user_sub_token", where you can set the home directory of guest_user to "/home/virtual/$USER", and "user_sub_token" to "$USER" to have a root directory auto generated based on username logging in, e.g. fred logs in and gets chroot()'ed in /home/virtual/fred. - Fix bug in str_replace_text if replace token matches at end of string. - Recognize P@SW as PASV; works around an SMC router bug. - Accept an async ABOR sequence if it arrives via non-urgent data. Fixes issue with Cisco routers. Thanks to Eddie Corns <E.Corns@ed.ac.uk>. - Implement simple {,} support in pattern matcher (nested not handled). Handy to use with hide_file and deny_file options. - Fix port range with pasv_min_port and pasv_max_port to use the full range (the upper limit wasn't being used very often!). - Activate SO_REUSEADDR on passive listen sockets - makes servers with restricted port ranges much more useable! - Add secure_email_list_enable, to provide simple anonymous password control. For some cases, it's better than the hassle of virtual users. Idea thanks to Malcolm O'Callaghan, <mjo@stamps.com>. - Add some FAQ entries. - Fix issue with failure to call openlog() before using tcp_wrappers. Part of RH bugzilla #89765. (The more serious part was fixed with v1.2.0).
2004-01-01 05:39:22 +01:00
Use USE_FEATURES=inet6 for requirement of IPv6 support, instead of unusual usage of PKG_OPTIONS.
2011-04-15 10:34:00 +02:00
USE_FEATURES+= inet6
Rename ALL_TARGET to BUILD_TARGET for consistency with other *_TARGETs. Suggested by Roland Illig, ok'd by various.
2004-12-03 16:14:50 +01:00
BUILD_TARGET= vsftpd
Update to version 1.2.1. Changes: - Apply NetBSD patch to sysdeputil.c to activate a few features. Thanks to Lubomir Sedlacik <salo@netbsd.org>. - Apply fix for broken clients that terminate commands with \r\r\n. Thanks to Andrey Chernomyrdin <andrey@excom.spb.su>. - AIX send_file support, thanks to Tomas Ogren <stric@ing.umu.se>. - Fix typos in vsftpd.conf.5, thanks to SEKINE Tatsuo <tsekine@sdri.co.jp>. - Simple -F flag support to LIST and NLST. Needed for some broken clients. - Add simple ? wildcard in pattern matching. - Make pasv_min_port and pasv_max_port work if they are the same value. Thanks to Marvin Solomon <solomon@cs.wisc.edu>. - Paranoia: ignore user_config_dir if username has a / in it. - Implement stub ALLO command to keep busybox/ftpput happy. - Implement REIN, ACCT and SMNT stubs. - Implement FEAT along with an OPTS stub. - Implement STAT (no-args version). - Implement STAT (file/dir). - Add very simple access control via hide_file and deny_file. These should NOT be used for securing content as they are very dumb! Filesystem permissions are still the recommended way for securing important content. - Allow unsetting of string values with option= (i.e. blank). - Default virtual users to being chroot()'ed to the guest_user's home directory, if virtual_use_local_privs is not set. - Add support for "user_sub_token", where you can set the home directory of guest_user to "/home/virtual/$USER", and "user_sub_token" to "$USER" to have a root directory auto generated based on username logging in, e.g. fred logs in and gets chroot()'ed in /home/virtual/fred. - Fix bug in str_replace_text if replace token matches at end of string. - Recognize P@SW as PASV; works around an SMC router bug. - Accept an async ABOR sequence if it arrives via non-urgent data. Fixes issue with Cisco routers. Thanks to Eddie Corns <E.Corns@ed.ac.uk>. - Implement simple {,} support in pattern matcher (nested not handled). Handy to use with hide_file and deny_file options. - Fix port range with pasv_min_port and pasv_max_port to use the full range (the upper limit wasn't being used very often!). - Activate SO_REUSEADDR on passive listen sockets - makes servers with restricted port ranges much more useable! - Add secure_email_list_enable, to provide simple anonymous password control. For some cases, it's better than the hassle of virtual users. Idea thanks to Malcolm O'Callaghan, <mjo@stamps.com>. - Add some FAQ entries. - Fix issue with failure to call openlog() before using tcp_wrappers. Part of RH bugzilla #89765. (The more serious part was fixed with v1.2.0).
2004-01-01 05:39:22 +01:00
RCD_SCRIPTS= vsftpd
Updated to version 1.1.3. Addresses PR pkg/21410 by Jens Liebau. - honour PKG_SYSCONFDIR - rcd script, standalone mode support - tcp wrappers support - install vsftpd:vsftpd user - new HOMEPAGE and MASTER_SITES 1.1.3: ====== - Support for tcp_wrappers. - First stab at Solaris sendfilev() support. - Don't bomb out the listener on SIGHUP if the config became invalid. - End vsf_findlibs.sh with "exit 0;" - thanks Lars Hecking <lhecking@nmrc.ie>! - Integrate with tcp_wrappers - load config based on VSFTPD_LOAD_CONF environment variables. Allows per-IP configurability in standalone mode. - Fix build without tcp_wrappers. - Fix Solaris sendfilev() support - interruption via a signal returns EINTR rather than a partial byte count! - Add to EXAMPLE/ - PER_IP_CONFIG and INTERNET_SITE_NOINETD 1.1.2: ====== - Add per-IP connection limits in standalone mode. - Add logging of refused connect due to global or IP connection limits. - (Many thanks for testing and suggestions from Rob van Nieuwkerk <robn@verdi.et.tudelft.nl> and Adrian Reber <adrian@lisas.de>. - Make connection limit exceeded messages nonblocking. - Don't exit the listener if fork fails. 1.1.1: ====== - Fix port_promiscuous, oops! Thanks to Bjørn-Ove Heimsund <bjornoh@mi.uib.no>. - Fix to support umasks which create executable files. Reported by "Martin, Andreas" <AMartin@hegau-klinikum.de>. - Make the messages more.. professional :( Thanks to Steven G. Taylor <staylor@redhat.com>. - Allow anon users to append to files if they can delete files! Suggestion from Michael Leuchtenburg <michael@slashhome.org>. - Hopefully fix Solaris build (-lresolv) - Replace atoll() with a homebrew - modern FreeBSD, OpenBSD lack it. - Different solution for a umask which creates executable files: file_open_mode. - First attempt at Tru64 build, working with <Sulla17@aol.com>. - A few minor FAQ additions. - Change date format in the log from Sep 09 -> Sep 9. Avoids breaking some broken log parsers. - Make "INSTALL" better and clearer. - Fix passwd_chroot_enable, reported by James Jones <james@richland.edu>. - Finish Tru64 building :-) - Add tunable_no_anon_password as asked for by Stephen Quinney <stephen.quinney@computing-services.oxford.ac.uk>. 1.1.0: ====== - large file (>2Gb) support). - Fix .spec files to use /usr/local/sbin not /usr/sbin, noted by Bill Unruh <unruh@physics.ubc.ca>. - Small doc tweaks and improvements(?) - Add COPYING, the GNU GPL version 2. - Add use_localtime config option to override the use of GMT times. - Add tunable_check_shell (default YES) so people can disable this if they are not using PAM. - AIX 5.1 build support, thanks to Jan-Frode Myklebust <janfrode@parallab.uib.no>. - Add "hide_ids" option to show user/group in directory listings as "ftp". Request from Solar. - Use the seemingly more portable setreuid() and setregid(), poxy HP. - Use status 550 instead of 500 for known but disabled commands. - Rename "dirchange.[ch]" to "banner.[ch]". - Multiline connect banner support via "banner_file" config option. - Minor error message changes. - Add more FAQ entries. - Add patch to specify PASV address - thanks to Mike McLean <mikem@redhat.com>. - Drop the 2.4.0 kernel warning file - Rudimentary standalone listener support - to be expanded in a later release. - If sendfile() returns EINVAL just fall back to normal routines - handles non-pagecache backed files. - Add "port_promiscuous" setting - should help enabling FXP. - Modify anon_root and local_root to change directory _before_ applying the chroot(). - Open all files O_NONBLOCK to avoid pipes blocking on open. - Support wu-ftpd style per-user chroot() via /./ in /etc/passwd HOMEDIR. - Add SIGHUP support to new built in listener. - Per-user config overrides, via "user_config_dir" - woohoo! - Warning fixes, i.e. change "index" to "indexx" thanks to Olaf Kirch <okir@suse.de>. - Make sure the standalone daemon doesn't leak zombies! - Supposedly fix kernel messages about MSG_PEEK race - thanks to advice from Alexey <kuznet@ms2.inr.ac.ru>. - Add global client limit for standalone mode. - Add username that failed when we die with str_getpwnam. - Add a bunch of documentation under EXAMPLES.
2003-05-10 01:31:38 +02:00
Updated net/vsftpd to 2.3.2 Changes since 2.0.7 - Remove .postlogin.c.swp (thanks Kaibin Li <kbli@fortinet.com>)! - findlibs repairs for libcap; builds on my Ubuntu 6.06 again. - Apply patch to fix "error: assignment of read-only member '__in'" build error on broken systems where the WIFEXITED() etc. macros write to their argument. Thanks Ingo Terpelle <it@exanto.de>. - Replace spaces in xferlog with underscores, report from Michael Wittauer <michael.wittauer@sonydadc.com>. - Reload default config values before re-parsing config file on SIGHUP. This makes the values correct in the case a setting was removed from the file. - Do not issue an FTP response for a blank line on the control channel. Fixes issues with some broken NAT devices. ProFTPd does the same, so hopefully nothing will break. Report from Frank Bulk <fbulk@mypremieronline.com>. - Replace usage of broken _syscall() with syscall(). Fixes build errors for those without libcap-devel installed. - Add implicit SSL support with implicit_ssl option. - Remove arbitrary restriction on one process model + SSL. - Set a session ID on the SSL context. - Add the skeleton of a built-in ptrace sandbox. Not yet useful for anything other than catching compile errors. Yes, I'm crazy :P - Use PR_SET_PDEATHSIG all over the place so that when the listener is killed, existing sessions are booted too. - Use SSL_peek; makes SSL pipelining work. Note that I never found any SSL client that need it, but still a nice code clean-up. - Change ASCII download behaviour so \r\n does not become \r\r\n. This mirrors proftpd behaviour instead of wu-ftpd. Thanks Paul Abel <pabel@fexcodcc.com>. - Switch all sighandlers to the synchronous ones. Prevents us having to block and unblock signals all the time. - Add a "use alarm" option to synchronous signal handlers, to ensure the race condition against a blocking call does not result in a permanent non-delivery. - Use SIGTERM for privileged parent process shutdown, so they can still update u/wtmp properly. - Do RAND_load_file from /dev/urandom in the child context because I don't trust the OpenSSL API vs. fork(). Different children do have different RNG state; this is defense in depth. - More thoroughly close the remote ends of the priv_sock, ensuring that child death results in no blocking in the parent. This is a matter of tidyness; the SIGCHLD handler will reliably tear down the parent. - Do the same for the SSL slave / consumer channels. - Fix OpenBSD build. - Move SSL data handling into the SSL slave process. Incurs some extra overhead in terms of context switches and copies, but it enables this next item: - By default, require SSL data connections to exhibit SSL session re-use of the control channel. Unlike the cert thing, this _is_ something we can turn on by default as most clients seem to do reuse. Yay. - Change 522 response for SSL connection fail to note when session reuse is required. (v2.1.0pre1 here) - More work on the inbuilt ptrace()-sandbox support. - Clear the idle alarm when starting data transfer if there is no data alarm. - Fix syslog format; don't embed 2nd copy of date, pid. Thanks to Ren - Lock file before truncating it for upload. Fixes various simultaneous upload corruption issues. - Make sure to give 426 error code on uploads if ABOR was received. - Add cmds_denied option to complement cmds_allowed. - Ignore lines in config file containing only white space. - Require write_enable / anon_upload_enable / etc. to process STOU. - FC10 patch (vsftpd-1.0.1-missingok.patch): tweak to logrotate file. - FC10 patch (vsftpd-1.2.1-nonrootconf.patch): bail if the config file is not owned by the currently running user. - FC10 patch (vsftpd-2.0.1-tcp_wrappers.patch): explicitly call openlog() to avoid syslog() bug where some settings are not initialized. - FC10 patch (vsftpd-2.0.3-daemonize_fds.patch): when backgrounding, replace fd 0,1,2 with /dev/null fd. - FC10 patch (vsftpd-2.0.5-correct_comments.patch): comment tweaks in the sample config file. - FC10 patch (vsftpd-2.0.5-fix_unique.patch): use the default filename given by STOU if it is available. - FC10 patch (vsftpd-2.0.5-pam_end.patch): call pam_end() properly so modules can act on errors if they want. - FC10 patch (vsftpd-2.0.5-pasv_dot.patch): Strict RFC compliance for PASV command; add a trailing period. - FC10 patch (vsftpd-2.0.5-uname_size.patch): allow longer usernames. It's not 1990 any more, so trust PAM etc. to not stack-buffer-overflow. - FC10 patch (vsftpd-2.0.5-underscore_uname.patch): permit username to start with underscore or period. - FC10 patch (vsftpd-2.0.6-listen.patch): default listen to YES. - Fix crash on SIGHUP introduced in 2.1.0pre1. Oops. - FC10 patch (vsftpd-2.0.5-bind_denied.patch): retry PASV bind() on EACCES too, which can happen on SELinux systems. - Default resource limit for child processes: 100MB address space. - Finishing touches to the initial sandbox policy; only permit connect() to the host on the control channel being the nicest touch. (v2.1.0pre2 here) - Fix 64-bit build (oops)! Thanks Martin Nagy <mnagy@redhat.com>. - Fix config of SSL built in; not enabled; two process model. Report from Martin. - Shutdown the command connection in the priv parent's SIGTERM handler; kills of children where the PR_SET_PDEATHSIG cannot due to different user ids. (v2.1.0pre3 here) - Fix build on FC10. - Some FAQ tweaks. - Permit fcntl(F_GETFD) in sandbox policy. Needed for FC10. Not sure where it comes from but it is harmless. (My guess would be glibc-2.9's new support for using O_CLOEXEC more). - Fix build warning on 64-bit. - Fix build on OpenBSD again. (v2.1.0pre4 here) - Bring userlist_deny handling inside the max_login_fail accounting. At this point: v2.1.0 released! =============================== - Apply Tavis' RLIMIT_NOFILE trick in the twoprocess model's initial unprivileged child. - Fix build error due to __NR_utimes. - Ugh. Can't use RLIMIT_NOFILE in the SSL case because the process later receives data transfer fd's via recvmsg(). It's a total shame because doing the SSL handshake under even lower privs would be a real boost. (v2.1.1pre1 here) - Fix some declarations occuring in the middle of a block; broke older more strict compilers. - Handle the case where libcap is now libcap.so.2; fixes build on my new Ubuntu 9.04. - Enhance 522 error message to point to require_ssl_reuse option. - Fix NASTY regression whereby data transfer timeouts would fire incorrectly under SSL transfers. In addition, the transfer rate caps were not working under SSL transfers. Reported by several people. - Use the login delay machinery for userlist-based denials too. Thanks to Tomas Hoger <thoger@redhat.com> for the patch. - Fix another tedious regression whereby absent per-user config files were causing a session fail rather than being gracefully ignored. - Use the somewhat new CLONE_NEWPID / CLONE_NEWIPC to provide more isolation in the vsftpd low-priv processes (CLONE_NEWNET pending). - Use RLIMIT_NPROC to disallow fork()ing etc. in processes that do not need to create new ones. - Add "isolate" config flag to disable the new weird clone() flags if necessary. At this point: v2.1.1 released! =============================== - Fix compile error in sysdeputil.c on some Linux systems. At this point: v2.1.2 released! =============================== - Fix compile on systems with no RLIMIT_NPROC, oops. - Change some unsigned int to socklen_t's to avoid warnings on various platforms, e.g. AIX. - Add some syscall constants to ptracesandbox.c to fix the build on systems with 2.4 kernel headers. - Look for libs in /lib64 and /usr/lib64 too (Fixes Fedora 11 x86_64 compile). - Fix EACCES mapping, thanks Solar Designer <solar@openwall.com>. - Dont emit a bogus "OOPS: " message upon a QUIT, report from Solar Designer <solar@openwall.com>. - Tweak example vsftpd.conf to add commented out chroot_local_user=YES, from Ivan I. Grushin <mcgru@intrice.ru>. - Where available, use CLONE_NEWNET to isolate the untrusted processes so that they can't do arbitrary connect() and instead have to ask the privileged process for sockets. Moderate code disturbance - hope for no breakage :-/ - Disable implicit activation of one_process_model so that an anonymous setup can benefit from the no-network isolation of the unprivileged process (where available). (vsftpd-2.2.0pre1) - Call pam_get_item(PAM_USER) after authentication in case a PAM module remapped the username. Based on a patch from John McNair <john.mcnair@ihg.com>. - Apply a couple of IPv6 fixes from Corinna Schultz <corinna.schultz@gmail.com>, particularly when MS operating systems are talking on link local addresses. - Handle the error case for accepting a PASV connection in the two process model properly. - Pull in a couple of minor tidyup patches from Openwall. - Add "-o" command line option to specify option, e.g. vsftpd -olisten=NO. Also respect ordering with respect config files, e.g. vsftpd -olisten=NO /etc/vsftpd.conf -olocal_enable=NO Inspiration from Solar / Openwall. (vsftpd-2.2.0pre2) - Revert listen to be "NO" by default and also set max_per_ip / max_clients to 2000 / 50 as a default. Thanks to Solar. - Sanity check for admin: check config files are regular files. - Error out if opening the per-user config file gives an error other than ENOENT. Thanks Solar (who is on fire today ;-) (vsftpd-2.2.0pre3) - Apply some typo fixes from Solar. - Error out on read() errors when reading config files. (vsftpd-2.2.0pre4) - Add tunable_isolate_network to parseconf.c, thanks Stefan Pfetzing <dreamind@dreamind.de>. - Don't try and use CLONE_NEWPID etc. if we get EPERM -- may happen even to root if using linux-vserver. Also thanks to Stefan Pfetzing <dreamind@dreamind.de>. - Couple of typo tweaks from Cristi Terpea <cristi.terpea@fortech.ro>. - Change // style comments to /* style. - Fix pointer aliasing issue in new PAM_USER item support, thanks to Solar. At this point: v2.2.0 released! =============================== - Apply patch to set SSL context timeout to maximum, from Tim Kosse <tim.kosse@filezilla-project.org>. Should prevent data connection failures after a long transfer or idle period. - Apply async-safety signal tweaks from Solar. - Fix crash regression with the pasv_address option enabled. - Typo fix and look for libnsl in /lib64, from Robby Workman <rworkman@slackware.com>. - When asking the client to send us a cert, make sure we broadcast some suitable certificates. Fixes compatibility with the z/OS FTP client when tunable_ssl_request_cert=YES. - Rip out the silly "cached time" concept. Simplifies things and fixes incorrect transfer time bug reported by Rajeev V. Pillai. Explicitly pass around the cached current time in seconds in the one place that needs to avoid repeated gettimeofday() calls (directory listing). - Do the login fail delay in the parent process for cases where we checked a username / password. At this point: v2.2.1 released! =============================== - Change "File receive OK." to "Transfer complete." to placate some broken clients. Thanks Holger Kiehl <Holger.Kiehl@dwd.de>. - Fix erroneous "child died" upon FTP client connect, when under load. Awesome thanks to Holger Kiehl <Holger.Kiehl@dwd.de> for running diagnostic tests on his live server. - Boot the session if an overly long line is encountered. (vsftpd-2.2.2pre1) At this point: v2.2.2 released! =============================== - Add extremely simply HTTP support. It's very experimental, ignorant of HTTP protocol and headers, and likely has all sorts of other issues. The use case it might satisfy is if you need to serve simple static unathenticated content with large levels of paranoia. - Fix port_promiscuous breakage. Report from Soeren <soeren84@fastmail.net>. (v2.3.0pre1) - Minor FAQ update. - Use a larger address space limit if using text_userdb_names=YES - Always use CLONE_NEWNET if possible when in HTTP mode. - Change REST + STOR so that it's possible to overwrite part of file without truncating it. (v2.3.0pre2) - Boot the session if we see a USER where encryption was required. May prevent the transmission of plaintext passwords by buggy clients. Idea from Marcin Hlybin <marcin@rootnode.net>. - Fix failure to transmit a large ASCII file over SSL, if it contains \n -> \r\n fixups. At this point: v2.3.0 released! =============================== - Fix silly regression re: log files being overwritten from the start. - Rename a few file-open functions to make it clearer what they do. At this point: v2.3.1 released! =============================== - Argh! Fix version number. At this point: v2.3.2 released! ===============================
2010-11-08 18:10:55 +01:00
BUILD_DEFS+= VARBASE
Updated to version 1.1.3. Addresses PR pkg/21410 by Jens Liebau. - honour PKG_SYSCONFDIR - rcd script, standalone mode support - tcp wrappers support - install vsftpd:vsftpd user - new HOMEPAGE and MASTER_SITES 1.1.3: ====== - Support for tcp_wrappers. - First stab at Solaris sendfilev() support. - Don't bomb out the listener on SIGHUP if the config became invalid. - End vsf_findlibs.sh with "exit 0;" - thanks Lars Hecking <lhecking@nmrc.ie>! - Integrate with tcp_wrappers - load config based on VSFTPD_LOAD_CONF environment variables. Allows per-IP configurability in standalone mode. - Fix build without tcp_wrappers. - Fix Solaris sendfilev() support - interruption via a signal returns EINTR rather than a partial byte count! - Add to EXAMPLE/ - PER_IP_CONFIG and INTERNET_SITE_NOINETD 1.1.2: ====== - Add per-IP connection limits in standalone mode. - Add logging of refused connect due to global or IP connection limits. - (Many thanks for testing and suggestions from Rob van Nieuwkerk <robn@verdi.et.tudelft.nl> and Adrian Reber <adrian@lisas.de>. - Make connection limit exceeded messages nonblocking. - Don't exit the listener if fork fails. 1.1.1: ====== - Fix port_promiscuous, oops! Thanks to Bjørn-Ove Heimsund <bjornoh@mi.uib.no>. - Fix to support umasks which create executable files. Reported by "Martin, Andreas" <AMartin@hegau-klinikum.de>. - Make the messages more.. professional :( Thanks to Steven G. Taylor <staylor@redhat.com>. - Allow anon users to append to files if they can delete files! Suggestion from Michael Leuchtenburg <michael@slashhome.org>. - Hopefully fix Solaris build (-lresolv) - Replace atoll() with a homebrew - modern FreeBSD, OpenBSD lack it. - Different solution for a umask which creates executable files: file_open_mode. - First attempt at Tru64 build, working with <Sulla17@aol.com>. - A few minor FAQ additions. - Change date format in the log from Sep 09 -> Sep 9. Avoids breaking some broken log parsers. - Make "INSTALL" better and clearer. - Fix passwd_chroot_enable, reported by James Jones <james@richland.edu>. - Finish Tru64 building :-) - Add tunable_no_anon_password as asked for by Stephen Quinney <stephen.quinney@computing-services.oxford.ac.uk>. 1.1.0: ====== - large file (>2Gb) support). - Fix .spec files to use /usr/local/sbin not /usr/sbin, noted by Bill Unruh <unruh@physics.ubc.ca>. - Small doc tweaks and improvements(?) - Add COPYING, the GNU GPL version 2. - Add use_localtime config option to override the use of GMT times. - Add tunable_check_shell (default YES) so people can disable this if they are not using PAM. - AIX 5.1 build support, thanks to Jan-Frode Myklebust <janfrode@parallab.uib.no>. - Add "hide_ids" option to show user/group in directory listings as "ftp". Request from Solar. - Use the seemingly more portable setreuid() and setregid(), poxy HP. - Use status 550 instead of 500 for known but disabled commands. - Rename "dirchange.[ch]" to "banner.[ch]". - Multiline connect banner support via "banner_file" config option. - Minor error message changes. - Add more FAQ entries. - Add patch to specify PASV address - thanks to Mike McLean <mikem@redhat.com>. - Drop the 2.4.0 kernel warning file - Rudimentary standalone listener support - to be expanded in a later release. - If sendfile() returns EINVAL just fall back to normal routines - handles non-pagecache backed files. - Add "port_promiscuous" setting - should help enabling FXP. - Modify anon_root and local_root to change directory _before_ applying the chroot(). - Open all files O_NONBLOCK to avoid pipes blocking on open. - Support wu-ftpd style per-user chroot() via /./ in /etc/passwd HOMEDIR. - Add SIGHUP support to new built in listener. - Per-user config overrides, via "user_config_dir" - woohoo! - Warning fixes, i.e. change "index" to "indexx" thanks to Olaf Kirch <okir@suse.de>. - Make sure the standalone daemon doesn't leak zombies! - Supposedly fix kernel messages about MSG_PEEK race - thanks to advice from Alexey <kuznet@ms2.inr.ac.ru>. - Add global client limit for standalone mode. - Add username that failed when we die with str_getpwnam. - Add a bunch of documentation under EXAMPLES.
2003-05-10 01:31:38 +02:00
DOCDIR= ${PREFIX}/share/doc/vsftpd
EGDIR= ${PREFIX}/share/examples/vsftpd
CONF_FILES= ${EGDIR}/vsftpd.conf.default ${PKG_SYSCONFDIR}/vsftpd.conf
* Use += for CFLAGS not = * Use VARBASE
2004-11-11 14:48:43 +01:00
MAKE_DIRS= ${VARBASE}/chroot
OWN_DIRS= ${VARBASE}/chroot/vsftpd
Updated to version 1.1.3. Addresses PR pkg/21410 by Jens Liebau. - honour PKG_SYSCONFDIR - rcd script, standalone mode support - tcp wrappers support - install vsftpd:vsftpd user - new HOMEPAGE and MASTER_SITES 1.1.3: ====== - Support for tcp_wrappers. - First stab at Solaris sendfilev() support. - Don't bomb out the listener on SIGHUP if the config became invalid. - End vsf_findlibs.sh with "exit 0;" - thanks Lars Hecking <lhecking@nmrc.ie>! - Integrate with tcp_wrappers - load config based on VSFTPD_LOAD_CONF environment variables. Allows per-IP configurability in standalone mode. - Fix build without tcp_wrappers. - Fix Solaris sendfilev() support - interruption via a signal returns EINTR rather than a partial byte count! - Add to EXAMPLE/ - PER_IP_CONFIG and INTERNET_SITE_NOINETD 1.1.2: ====== - Add per-IP connection limits in standalone mode. - Add logging of refused connect due to global or IP connection limits. - (Many thanks for testing and suggestions from Rob van Nieuwkerk <robn@verdi.et.tudelft.nl> and Adrian Reber <adrian@lisas.de>. - Make connection limit exceeded messages nonblocking. - Don't exit the listener if fork fails. 1.1.1: ====== - Fix port_promiscuous, oops! Thanks to Bjørn-Ove Heimsund <bjornoh@mi.uib.no>. - Fix to support umasks which create executable files. Reported by "Martin, Andreas" <AMartin@hegau-klinikum.de>. - Make the messages more.. professional :( Thanks to Steven G. Taylor <staylor@redhat.com>. - Allow anon users to append to files if they can delete files! Suggestion from Michael Leuchtenburg <michael@slashhome.org>. - Hopefully fix Solaris build (-lresolv) - Replace atoll() with a homebrew - modern FreeBSD, OpenBSD lack it. - Different solution for a umask which creates executable files: file_open_mode. - First attempt at Tru64 build, working with <Sulla17@aol.com>. - A few minor FAQ additions. - Change date format in the log from Sep 09 -> Sep 9. Avoids breaking some broken log parsers. - Make "INSTALL" better and clearer. - Fix passwd_chroot_enable, reported by James Jones <james@richland.edu>. - Finish Tru64 building :-) - Add tunable_no_anon_password as asked for by Stephen Quinney <stephen.quinney@computing-services.oxford.ac.uk>. 1.1.0: ====== - large file (>2Gb) support). - Fix .spec files to use /usr/local/sbin not /usr/sbin, noted by Bill Unruh <unruh@physics.ubc.ca>. - Small doc tweaks and improvements(?) - Add COPYING, the GNU GPL version 2. - Add use_localtime config option to override the use of GMT times. - Add tunable_check_shell (default YES) so people can disable this if they are not using PAM. - AIX 5.1 build support, thanks to Jan-Frode Myklebust <janfrode@parallab.uib.no>. - Add "hide_ids" option to show user/group in directory listings as "ftp". Request from Solar. - Use the seemingly more portable setreuid() and setregid(), poxy HP. - Use status 550 instead of 500 for known but disabled commands. - Rename "dirchange.[ch]" to "banner.[ch]". - Multiline connect banner support via "banner_file" config option. - Minor error message changes. - Add more FAQ entries. - Add patch to specify PASV address - thanks to Mike McLean <mikem@redhat.com>. - Drop the 2.4.0 kernel warning file - Rudimentary standalone listener support - to be expanded in a later release. - If sendfile() returns EINVAL just fall back to normal routines - handles non-pagecache backed files. - Add "port_promiscuous" setting - should help enabling FXP. - Modify anon_root and local_root to change directory _before_ applying the chroot(). - Open all files O_NONBLOCK to avoid pipes blocking on open. - Support wu-ftpd style per-user chroot() via /./ in /etc/passwd HOMEDIR. - Add SIGHUP support to new built in listener. - Per-user config overrides, via "user_config_dir" - woohoo! - Warning fixes, i.e. change "index" to "indexx" thanks to Olaf Kirch <okir@suse.de>. - Make sure the standalone daemon doesn't leak zombies! - Supposedly fix kernel messages about MSG_PEEK race - thanks to advice from Alexey <kuznet@ms2.inr.ac.ru>. - Add global client limit for standalone mode. - Add username that failed when we die with str_getpwnam. - Add a bunch of documentation under EXAMPLES.
2003-05-10 01:31:38 +02:00
Add DESTDIR support.
2008-06-20 03:09:05 +02:00
INSTALLATION_DIRS= libexec ${PKGMANDIR}/man5 ${PKGMANDIR}/man8 \
${EGDIR} ${DOCDIR}/SECURITY
Set INSTALLATION_DIRS to create some directories used by the do-install target that appears later in the Makefile. Also move inclusion of buildlink3.mk files above target definitions, as per style guidelines.
2005-02-03 00:12:52 +01:00
Use SUBST framework.
2006-01-08 06:07:05 +01:00
SUBST_CLASSES+= paths
SUBST_FILES.paths= vsftpd.8 vsftpd.conf.5 vsftpd.conf
SUBST_SED.paths+= -e 's,@PKG_SYSCONFDIR@,${PKG_SYSCONFDIR},g'
SUBST_STAGE.paths= post-patch
Updated to version 1.1.3. Addresses PR pkg/21410 by Jens Liebau. - honour PKG_SYSCONFDIR - rcd script, standalone mode support - tcp wrappers support - install vsftpd:vsftpd user - new HOMEPAGE and MASTER_SITES 1.1.3: ====== - Support for tcp_wrappers. - First stab at Solaris sendfilev() support. - Don't bomb out the listener on SIGHUP if the config became invalid. - End vsf_findlibs.sh with "exit 0;" - thanks Lars Hecking <lhecking@nmrc.ie>! - Integrate with tcp_wrappers - load config based on VSFTPD_LOAD_CONF environment variables. Allows per-IP configurability in standalone mode. - Fix build without tcp_wrappers. - Fix Solaris sendfilev() support - interruption via a signal returns EINTR rather than a partial byte count! - Add to EXAMPLE/ - PER_IP_CONFIG and INTERNET_SITE_NOINETD 1.1.2: ====== - Add per-IP connection limits in standalone mode. - Add logging of refused connect due to global or IP connection limits. - (Many thanks for testing and suggestions from Rob van Nieuwkerk <robn@verdi.et.tudelft.nl> and Adrian Reber <adrian@lisas.de>. - Make connection limit exceeded messages nonblocking. - Don't exit the listener if fork fails. 1.1.1: ====== - Fix port_promiscuous, oops! Thanks to Bjørn-Ove Heimsund <bjornoh@mi.uib.no>. - Fix to support umasks which create executable files. Reported by "Martin, Andreas" <AMartin@hegau-klinikum.de>. - Make the messages more.. professional :( Thanks to Steven G. Taylor <staylor@redhat.com>. - Allow anon users to append to files if they can delete files! Suggestion from Michael Leuchtenburg <michael@slashhome.org>. - Hopefully fix Solaris build (-lresolv) - Replace atoll() with a homebrew - modern FreeBSD, OpenBSD lack it. - Different solution for a umask which creates executable files: file_open_mode. - First attempt at Tru64 build, working with <Sulla17@aol.com>. - A few minor FAQ additions. - Change date format in the log from Sep 09 -> Sep 9. Avoids breaking some broken log parsers. - Make "INSTALL" better and clearer. - Fix passwd_chroot_enable, reported by James Jones <james@richland.edu>. - Finish Tru64 building :-) - Add tunable_no_anon_password as asked for by Stephen Quinney <stephen.quinney@computing-services.oxford.ac.uk>. 1.1.0: ====== - large file (>2Gb) support). - Fix .spec files to use /usr/local/sbin not /usr/sbin, noted by Bill Unruh <unruh@physics.ubc.ca>. - Small doc tweaks and improvements(?) - Add COPYING, the GNU GPL version 2. - Add use_localtime config option to override the use of GMT times. - Add tunable_check_shell (default YES) so people can disable this if they are not using PAM. - AIX 5.1 build support, thanks to Jan-Frode Myklebust <janfrode@parallab.uib.no>. - Add "hide_ids" option to show user/group in directory listings as "ftp". Request from Solar. - Use the seemingly more portable setreuid() and setregid(), poxy HP. - Use status 550 instead of 500 for known but disabled commands. - Rename "dirchange.[ch]" to "banner.[ch]". - Multiline connect banner support via "banner_file" config option. - Minor error message changes. - Add more FAQ entries. - Add patch to specify PASV address - thanks to Mike McLean <mikem@redhat.com>. - Drop the 2.4.0 kernel warning file - Rudimentary standalone listener support - to be expanded in a later release. - If sendfile() returns EINVAL just fall back to normal routines - handles non-pagecache backed files. - Add "port_promiscuous" setting - should help enabling FXP. - Modify anon_root and local_root to change directory _before_ applying the chroot(). - Open all files O_NONBLOCK to avoid pipes blocking on open. - Support wu-ftpd style per-user chroot() via /./ in /etc/passwd HOMEDIR. - Add SIGHUP support to new built in listener. - Per-user config overrides, via "user_config_dir" - woohoo! - Warning fixes, i.e. change "index" to "indexx" thanks to Olaf Kirch <okir@suse.de>. - Make sure the standalone daemon doesn't leak zombies! - Supposedly fix kernel messages about MSG_PEEK race - thanks to advice from Alexey <kuznet@ms2.inr.ac.ru>. - Add global client limit for standalone mode. - Add username that failed when we die with str_getpwnam. - Add a bunch of documentation under EXAMPLES.
2003-05-10 01:31:38 +02:00
Updated net/vsftpd to 2.3.2 Changes since 2.0.7 - Remove .postlogin.c.swp (thanks Kaibin Li <kbli@fortinet.com>)! - findlibs repairs for libcap; builds on my Ubuntu 6.06 again. - Apply patch to fix "error: assignment of read-only member '__in'" build error on broken systems where the WIFEXITED() etc. macros write to their argument. Thanks Ingo Terpelle <it@exanto.de>. - Replace spaces in xferlog with underscores, report from Michael Wittauer <michael.wittauer@sonydadc.com>. - Reload default config values before re-parsing config file on SIGHUP. This makes the values correct in the case a setting was removed from the file. - Do not issue an FTP response for a blank line on the control channel. Fixes issues with some broken NAT devices. ProFTPd does the same, so hopefully nothing will break. Report from Frank Bulk <fbulk@mypremieronline.com>. - Replace usage of broken _syscall() with syscall(). Fixes build errors for those without libcap-devel installed. - Add implicit SSL support with implicit_ssl option. - Remove arbitrary restriction on one process model + SSL. - Set a session ID on the SSL context. - Add the skeleton of a built-in ptrace sandbox. Not yet useful for anything other than catching compile errors. Yes, I'm crazy :P - Use PR_SET_PDEATHSIG all over the place so that when the listener is killed, existing sessions are booted too. - Use SSL_peek; makes SSL pipelining work. Note that I never found any SSL client that need it, but still a nice code clean-up. - Change ASCII download behaviour so \r\n does not become \r\r\n. This mirrors proftpd behaviour instead of wu-ftpd. Thanks Paul Abel <pabel@fexcodcc.com>. - Switch all sighandlers to the synchronous ones. Prevents us having to block and unblock signals all the time. - Add a "use alarm" option to synchronous signal handlers, to ensure the race condition against a blocking call does not result in a permanent non-delivery. - Use SIGTERM for privileged parent process shutdown, so they can still update u/wtmp properly. - Do RAND_load_file from /dev/urandom in the child context because I don't trust the OpenSSL API vs. fork(). Different children do have different RNG state; this is defense in depth. - More thoroughly close the remote ends of the priv_sock, ensuring that child death results in no blocking in the parent. This is a matter of tidyness; the SIGCHLD handler will reliably tear down the parent. - Do the same for the SSL slave / consumer channels. - Fix OpenBSD build. - Move SSL data handling into the SSL slave process. Incurs some extra overhead in terms of context switches and copies, but it enables this next item: - By default, require SSL data connections to exhibit SSL session re-use of the control channel. Unlike the cert thing, this _is_ something we can turn on by default as most clients seem to do reuse. Yay. - Change 522 response for SSL connection fail to note when session reuse is required. (v2.1.0pre1 here) - More work on the inbuilt ptrace()-sandbox support. - Clear the idle alarm when starting data transfer if there is no data alarm. - Fix syslog format; don't embed 2nd copy of date, pid. Thanks to Ren - Lock file before truncating it for upload. Fixes various simultaneous upload corruption issues. - Make sure to give 426 error code on uploads if ABOR was received. - Add cmds_denied option to complement cmds_allowed. - Ignore lines in config file containing only white space. - Require write_enable / anon_upload_enable / etc. to process STOU. - FC10 patch (vsftpd-1.0.1-missingok.patch): tweak to logrotate file. - FC10 patch (vsftpd-1.2.1-nonrootconf.patch): bail if the config file is not owned by the currently running user. - FC10 patch (vsftpd-2.0.1-tcp_wrappers.patch): explicitly call openlog() to avoid syslog() bug where some settings are not initialized. - FC10 patch (vsftpd-2.0.3-daemonize_fds.patch): when backgrounding, replace fd 0,1,2 with /dev/null fd. - FC10 patch (vsftpd-2.0.5-correct_comments.patch): comment tweaks in the sample config file. - FC10 patch (vsftpd-2.0.5-fix_unique.patch): use the default filename given by STOU if it is available. - FC10 patch (vsftpd-2.0.5-pam_end.patch): call pam_end() properly so modules can act on errors if they want. - FC10 patch (vsftpd-2.0.5-pasv_dot.patch): Strict RFC compliance for PASV command; add a trailing period. - FC10 patch (vsftpd-2.0.5-uname_size.patch): allow longer usernames. It's not 1990 any more, so trust PAM etc. to not stack-buffer-overflow. - FC10 patch (vsftpd-2.0.5-underscore_uname.patch): permit username to start with underscore or period. - FC10 patch (vsftpd-2.0.6-listen.patch): default listen to YES. - Fix crash on SIGHUP introduced in 2.1.0pre1. Oops. - FC10 patch (vsftpd-2.0.5-bind_denied.patch): retry PASV bind() on EACCES too, which can happen on SELinux systems. - Default resource limit for child processes: 100MB address space. - Finishing touches to the initial sandbox policy; only permit connect() to the host on the control channel being the nicest touch. (v2.1.0pre2 here) - Fix 64-bit build (oops)! Thanks Martin Nagy <mnagy@redhat.com>. - Fix config of SSL built in; not enabled; two process model. Report from Martin. - Shutdown the command connection in the priv parent's SIGTERM handler; kills of children where the PR_SET_PDEATHSIG cannot due to different user ids. (v2.1.0pre3 here) - Fix build on FC10. - Some FAQ tweaks. - Permit fcntl(F_GETFD) in sandbox policy. Needed for FC10. Not sure where it comes from but it is harmless. (My guess would be glibc-2.9's new support for using O_CLOEXEC more). - Fix build warning on 64-bit. - Fix build on OpenBSD again. (v2.1.0pre4 here) - Bring userlist_deny handling inside the max_login_fail accounting. At this point: v2.1.0 released! =============================== - Apply Tavis' RLIMIT_NOFILE trick in the twoprocess model's initial unprivileged child. - Fix build error due to __NR_utimes. - Ugh. Can't use RLIMIT_NOFILE in the SSL case because the process later receives data transfer fd's via recvmsg(). It's a total shame because doing the SSL handshake under even lower privs would be a real boost. (v2.1.1pre1 here) - Fix some declarations occuring in the middle of a block; broke older more strict compilers. - Handle the case where libcap is now libcap.so.2; fixes build on my new Ubuntu 9.04. - Enhance 522 error message to point to require_ssl_reuse option. - Fix NASTY regression whereby data transfer timeouts would fire incorrectly under SSL transfers. In addition, the transfer rate caps were not working under SSL transfers. Reported by several people. - Use the login delay machinery for userlist-based denials too. Thanks to Tomas Hoger <thoger@redhat.com> for the patch. - Fix another tedious regression whereby absent per-user config files were causing a session fail rather than being gracefully ignored. - Use the somewhat new CLONE_NEWPID / CLONE_NEWIPC to provide more isolation in the vsftpd low-priv processes (CLONE_NEWNET pending). - Use RLIMIT_NPROC to disallow fork()ing etc. in processes that do not need to create new ones. - Add "isolate" config flag to disable the new weird clone() flags if necessary. At this point: v2.1.1 released! =============================== - Fix compile error in sysdeputil.c on some Linux systems. At this point: v2.1.2 released! =============================== - Fix compile on systems with no RLIMIT_NPROC, oops. - Change some unsigned int to socklen_t's to avoid warnings on various platforms, e.g. AIX. - Add some syscall constants to ptracesandbox.c to fix the build on systems with 2.4 kernel headers. - Look for libs in /lib64 and /usr/lib64 too (Fixes Fedora 11 x86_64 compile). - Fix EACCES mapping, thanks Solar Designer <solar@openwall.com>. - Dont emit a bogus "OOPS: " message upon a QUIT, report from Solar Designer <solar@openwall.com>. - Tweak example vsftpd.conf to add commented out chroot_local_user=YES, from Ivan I. Grushin <mcgru@intrice.ru>. - Where available, use CLONE_NEWNET to isolate the untrusted processes so that they can't do arbitrary connect() and instead have to ask the privileged process for sockets. Moderate code disturbance - hope for no breakage :-/ - Disable implicit activation of one_process_model so that an anonymous setup can benefit from the no-network isolation of the unprivileged process (where available). (vsftpd-2.2.0pre1) - Call pam_get_item(PAM_USER) after authentication in case a PAM module remapped the username. Based on a patch from John McNair <john.mcnair@ihg.com>. - Apply a couple of IPv6 fixes from Corinna Schultz <corinna.schultz@gmail.com>, particularly when MS operating systems are talking on link local addresses. - Handle the error case for accepting a PASV connection in the two process model properly. - Pull in a couple of minor tidyup patches from Openwall. - Add "-o" command line option to specify option, e.g. vsftpd -olisten=NO. Also respect ordering with respect config files, e.g. vsftpd -olisten=NO /etc/vsftpd.conf -olocal_enable=NO Inspiration from Solar / Openwall. (vsftpd-2.2.0pre2) - Revert listen to be "NO" by default and also set max_per_ip / max_clients to 2000 / 50 as a default. Thanks to Solar. - Sanity check for admin: check config files are regular files. - Error out if opening the per-user config file gives an error other than ENOENT. Thanks Solar (who is on fire today ;-) (vsftpd-2.2.0pre3) - Apply some typo fixes from Solar. - Error out on read() errors when reading config files. (vsftpd-2.2.0pre4) - Add tunable_isolate_network to parseconf.c, thanks Stefan Pfetzing <dreamind@dreamind.de>. - Don't try and use CLONE_NEWPID etc. if we get EPERM -- may happen even to root if using linux-vserver. Also thanks to Stefan Pfetzing <dreamind@dreamind.de>. - Couple of typo tweaks from Cristi Terpea <cristi.terpea@fortech.ro>. - Change // style comments to /* style. - Fix pointer aliasing issue in new PAM_USER item support, thanks to Solar. At this point: v2.2.0 released! =============================== - Apply patch to set SSL context timeout to maximum, from Tim Kosse <tim.kosse@filezilla-project.org>. Should prevent data connection failures after a long transfer or idle period. - Apply async-safety signal tweaks from Solar. - Fix crash regression with the pasv_address option enabled. - Typo fix and look for libnsl in /lib64, from Robby Workman <rworkman@slackware.com>. - When asking the client to send us a cert, make sure we broadcast some suitable certificates. Fixes compatibility with the z/OS FTP client when tunable_ssl_request_cert=YES. - Rip out the silly "cached time" concept. Simplifies things and fixes incorrect transfer time bug reported by Rajeev V. Pillai. Explicitly pass around the cached current time in seconds in the one place that needs to avoid repeated gettimeofday() calls (directory listing). - Do the login fail delay in the parent process for cases where we checked a username / password. At this point: v2.2.1 released! =============================== - Change "File receive OK." to "Transfer complete." to placate some broken clients. Thanks Holger Kiehl <Holger.Kiehl@dwd.de>. - Fix erroneous "child died" upon FTP client connect, when under load. Awesome thanks to Holger Kiehl <Holger.Kiehl@dwd.de> for running diagnostic tests on his live server. - Boot the session if an overly long line is encountered. (vsftpd-2.2.2pre1) At this point: v2.2.2 released! =============================== - Add extremely simply HTTP support. It's very experimental, ignorant of HTTP protocol and headers, and likely has all sorts of other issues. The use case it might satisfy is if you need to serve simple static unathenticated content with large levels of paranoia. - Fix port_promiscuous breakage. Report from Soeren <soeren84@fastmail.net>. (v2.3.0pre1) - Minor FAQ update. - Use a larger address space limit if using text_userdb_names=YES - Always use CLONE_NEWNET if possible when in HTTP mode. - Change REST + STOR so that it's possible to overwrite part of file without truncating it. (v2.3.0pre2) - Boot the session if we see a USER where encryption was required. May prevent the transmission of plaintext passwords by buggy clients. Idea from Marcin Hlybin <marcin@rootnode.net>. - Fix failure to transmit a large ASCII file over SSL, if it contains \n -> \r\n fixups. At this point: v2.3.0 released! =============================== - Fix silly regression re: log files being overwritten from the start. - Rename a few file-open functions to make it clearer what they do. At this point: v2.3.1 released! =============================== - Argh! Fix version number. At this point: v2.3.2 released! ===============================
2010-11-08 18:10:55 +01:00
MAKE_ENV+= LIBS=${LIBS:Q}
Improve linkage but not using the crappy shell script from vsftpd, which doesn't work correctly e.g. on Solaris. Make PAM optional, but since the option is on by default, nothing changes. Fix compilation on Solaris based on input from Stefan Pfetzing in PR 33494.
2006-05-16 23:08:50 +02:00
.include "../../mk/bsd.prefs.mk"
Updated net/vsftpd to 2.3.2 Changes since 2.0.7 - Remove .postlogin.c.swp (thanks Kaibin Li <kbli@fortinet.com>)! - findlibs repairs for libcap; builds on my Ubuntu 6.06 again. - Apply patch to fix "error: assignment of read-only member '__in'" build error on broken systems where the WIFEXITED() etc. macros write to their argument. Thanks Ingo Terpelle <it@exanto.de>. - Replace spaces in xferlog with underscores, report from Michael Wittauer <michael.wittauer@sonydadc.com>. - Reload default config values before re-parsing config file on SIGHUP. This makes the values correct in the case a setting was removed from the file. - Do not issue an FTP response for a blank line on the control channel. Fixes issues with some broken NAT devices. ProFTPd does the same, so hopefully nothing will break. Report from Frank Bulk <fbulk@mypremieronline.com>. - Replace usage of broken _syscall() with syscall(). Fixes build errors for those without libcap-devel installed. - Add implicit SSL support with implicit_ssl option. - Remove arbitrary restriction on one process model + SSL. - Set a session ID on the SSL context. - Add the skeleton of a built-in ptrace sandbox. Not yet useful for anything other than catching compile errors. Yes, I'm crazy :P - Use PR_SET_PDEATHSIG all over the place so that when the listener is killed, existing sessions are booted too. - Use SSL_peek; makes SSL pipelining work. Note that I never found any SSL client that need it, but still a nice code clean-up. - Change ASCII download behaviour so \r\n does not become \r\r\n. This mirrors proftpd behaviour instead of wu-ftpd. Thanks Paul Abel <pabel@fexcodcc.com>. - Switch all sighandlers to the synchronous ones. Prevents us having to block and unblock signals all the time. - Add a "use alarm" option to synchronous signal handlers, to ensure the race condition against a blocking call does not result in a permanent non-delivery. - Use SIGTERM for privileged parent process shutdown, so they can still update u/wtmp properly. - Do RAND_load_file from /dev/urandom in the child context because I don't trust the OpenSSL API vs. fork(). Different children do have different RNG state; this is defense in depth. - More thoroughly close the remote ends of the priv_sock, ensuring that child death results in no blocking in the parent. This is a matter of tidyness; the SIGCHLD handler will reliably tear down the parent. - Do the same for the SSL slave / consumer channels. - Fix OpenBSD build. - Move SSL data handling into the SSL slave process. Incurs some extra overhead in terms of context switches and copies, but it enables this next item: - By default, require SSL data connections to exhibit SSL session re-use of the control channel. Unlike the cert thing, this _is_ something we can turn on by default as most clients seem to do reuse. Yay. - Change 522 response for SSL connection fail to note when session reuse is required. (v2.1.0pre1 here) - More work on the inbuilt ptrace()-sandbox support. - Clear the idle alarm when starting data transfer if there is no data alarm. - Fix syslog format; don't embed 2nd copy of date, pid. Thanks to Ren - Lock file before truncating it for upload. Fixes various simultaneous upload corruption issues. - Make sure to give 426 error code on uploads if ABOR was received. - Add cmds_denied option to complement cmds_allowed. - Ignore lines in config file containing only white space. - Require write_enable / anon_upload_enable / etc. to process STOU. - FC10 patch (vsftpd-1.0.1-missingok.patch): tweak to logrotate file. - FC10 patch (vsftpd-1.2.1-nonrootconf.patch): bail if the config file is not owned by the currently running user. - FC10 patch (vsftpd-2.0.1-tcp_wrappers.patch): explicitly call openlog() to avoid syslog() bug where some settings are not initialized. - FC10 patch (vsftpd-2.0.3-daemonize_fds.patch): when backgrounding, replace fd 0,1,2 with /dev/null fd. - FC10 patch (vsftpd-2.0.5-correct_comments.patch): comment tweaks in the sample config file. - FC10 patch (vsftpd-2.0.5-fix_unique.patch): use the default filename given by STOU if it is available. - FC10 patch (vsftpd-2.0.5-pam_end.patch): call pam_end() properly so modules can act on errors if they want. - FC10 patch (vsftpd-2.0.5-pasv_dot.patch): Strict RFC compliance for PASV command; add a trailing period. - FC10 patch (vsftpd-2.0.5-uname_size.patch): allow longer usernames. It's not 1990 any more, so trust PAM etc. to not stack-buffer-overflow. - FC10 patch (vsftpd-2.0.5-underscore_uname.patch): permit username to start with underscore or period. - FC10 patch (vsftpd-2.0.6-listen.patch): default listen to YES. - Fix crash on SIGHUP introduced in 2.1.0pre1. Oops. - FC10 patch (vsftpd-2.0.5-bind_denied.patch): retry PASV bind() on EACCES too, which can happen on SELinux systems. - Default resource limit for child processes: 100MB address space. - Finishing touches to the initial sandbox policy; only permit connect() to the host on the control channel being the nicest touch. (v2.1.0pre2 here) - Fix 64-bit build (oops)! Thanks Martin Nagy <mnagy@redhat.com>. - Fix config of SSL built in; not enabled; two process model. Report from Martin. - Shutdown the command connection in the priv parent's SIGTERM handler; kills of children where the PR_SET_PDEATHSIG cannot due to different user ids. (v2.1.0pre3 here) - Fix build on FC10. - Some FAQ tweaks. - Permit fcntl(F_GETFD) in sandbox policy. Needed for FC10. Not sure where it comes from but it is harmless. (My guess would be glibc-2.9's new support for using O_CLOEXEC more). - Fix build warning on 64-bit. - Fix build on OpenBSD again. (v2.1.0pre4 here) - Bring userlist_deny handling inside the max_login_fail accounting. At this point: v2.1.0 released! =============================== - Apply Tavis' RLIMIT_NOFILE trick in the twoprocess model's initial unprivileged child. - Fix build error due to __NR_utimes. - Ugh. Can't use RLIMIT_NOFILE in the SSL case because the process later receives data transfer fd's via recvmsg(). It's a total shame because doing the SSL handshake under even lower privs would be a real boost. (v2.1.1pre1 here) - Fix some declarations occuring in the middle of a block; broke older more strict compilers. - Handle the case where libcap is now libcap.so.2; fixes build on my new Ubuntu 9.04. - Enhance 522 error message to point to require_ssl_reuse option. - Fix NASTY regression whereby data transfer timeouts would fire incorrectly under SSL transfers. In addition, the transfer rate caps were not working under SSL transfers. Reported by several people. - Use the login delay machinery for userlist-based denials too. Thanks to Tomas Hoger <thoger@redhat.com> for the patch. - Fix another tedious regression whereby absent per-user config files were causing a session fail rather than being gracefully ignored. - Use the somewhat new CLONE_NEWPID / CLONE_NEWIPC to provide more isolation in the vsftpd low-priv processes (CLONE_NEWNET pending). - Use RLIMIT_NPROC to disallow fork()ing etc. in processes that do not need to create new ones. - Add "isolate" config flag to disable the new weird clone() flags if necessary. At this point: v2.1.1 released! =============================== - Fix compile error in sysdeputil.c on some Linux systems. At this point: v2.1.2 released! =============================== - Fix compile on systems with no RLIMIT_NPROC, oops. - Change some unsigned int to socklen_t's to avoid warnings on various platforms, e.g. AIX. - Add some syscall constants to ptracesandbox.c to fix the build on systems with 2.4 kernel headers. - Look for libs in /lib64 and /usr/lib64 too (Fixes Fedora 11 x86_64 compile). - Fix EACCES mapping, thanks Solar Designer <solar@openwall.com>. - Dont emit a bogus "OOPS: " message upon a QUIT, report from Solar Designer <solar@openwall.com>. - Tweak example vsftpd.conf to add commented out chroot_local_user=YES, from Ivan I. Grushin <mcgru@intrice.ru>. - Where available, use CLONE_NEWNET to isolate the untrusted processes so that they can't do arbitrary connect() and instead have to ask the privileged process for sockets. Moderate code disturbance - hope for no breakage :-/ - Disable implicit activation of one_process_model so that an anonymous setup can benefit from the no-network isolation of the unprivileged process (where available). (vsftpd-2.2.0pre1) - Call pam_get_item(PAM_USER) after authentication in case a PAM module remapped the username. Based on a patch from John McNair <john.mcnair@ihg.com>. - Apply a couple of IPv6 fixes from Corinna Schultz <corinna.schultz@gmail.com>, particularly when MS operating systems are talking on link local addresses. - Handle the error case for accepting a PASV connection in the two process model properly. - Pull in a couple of minor tidyup patches from Openwall. - Add "-o" command line option to specify option, e.g. vsftpd -olisten=NO. Also respect ordering with respect config files, e.g. vsftpd -olisten=NO /etc/vsftpd.conf -olocal_enable=NO Inspiration from Solar / Openwall. (vsftpd-2.2.0pre2) - Revert listen to be "NO" by default and also set max_per_ip / max_clients to 2000 / 50 as a default. Thanks to Solar. - Sanity check for admin: check config files are regular files. - Error out if opening the per-user config file gives an error other than ENOENT. Thanks Solar (who is on fire today ;-) (vsftpd-2.2.0pre3) - Apply some typo fixes from Solar. - Error out on read() errors when reading config files. (vsftpd-2.2.0pre4) - Add tunable_isolate_network to parseconf.c, thanks Stefan Pfetzing <dreamind@dreamind.de>. - Don't try and use CLONE_NEWPID etc. if we get EPERM -- may happen even to root if using linux-vserver. Also thanks to Stefan Pfetzing <dreamind@dreamind.de>. - Couple of typo tweaks from Cristi Terpea <cristi.terpea@fortech.ro>. - Change // style comments to /* style. - Fix pointer aliasing issue in new PAM_USER item support, thanks to Solar. At this point: v2.2.0 released! =============================== - Apply patch to set SSL context timeout to maximum, from Tim Kosse <tim.kosse@filezilla-project.org>. Should prevent data connection failures after a long transfer or idle period. - Apply async-safety signal tweaks from Solar. - Fix crash regression with the pasv_address option enabled. - Typo fix and look for libnsl in /lib64, from Robby Workman <rworkman@slackware.com>. - When asking the client to send us a cert, make sure we broadcast some suitable certificates. Fixes compatibility with the z/OS FTP client when tunable_ssl_request_cert=YES. - Rip out the silly "cached time" concept. Simplifies things and fixes incorrect transfer time bug reported by Rajeev V. Pillai. Explicitly pass around the cached current time in seconds in the one place that needs to avoid repeated gettimeofday() calls (directory listing). - Do the login fail delay in the parent process for cases where we checked a username / password. At this point: v2.2.1 released! =============================== - Change "File receive OK." to "Transfer complete." to placate some broken clients. Thanks Holger Kiehl <Holger.Kiehl@dwd.de>. - Fix erroneous "child died" upon FTP client connect, when under load. Awesome thanks to Holger Kiehl <Holger.Kiehl@dwd.de> for running diagnostic tests on his live server. - Boot the session if an overly long line is encountered. (vsftpd-2.2.2pre1) At this point: v2.2.2 released! =============================== - Add extremely simply HTTP support. It's very experimental, ignorant of HTTP protocol and headers, and likely has all sorts of other issues. The use case it might satisfy is if you need to serve simple static unathenticated content with large levels of paranoia. - Fix port_promiscuous breakage. Report from Soeren <soeren84@fastmail.net>. (v2.3.0pre1) - Minor FAQ update. - Use a larger address space limit if using text_userdb_names=YES - Always use CLONE_NEWNET if possible when in HTTP mode. - Change REST + STOR so that it's possible to overwrite part of file without truncating it. (v2.3.0pre2) - Boot the session if we see a USER where encryption was required. May prevent the transmission of plaintext passwords by buggy clients. Idea from Marcin Hlybin <marcin@rootnode.net>. - Fix failure to transmit a large ASCII file over SSL, if it contains \n -> \r\n fixups. At this point: v2.3.0 released! =============================== - Fix silly regression re: log files being overwritten from the start. - Rename a few file-open functions to make it clearer what they do. At this point: v2.3.1 released! =============================== - Argh! Fix version number. At this point: v2.3.2 released! ===============================
2010-11-08 18:10:55 +01:00
VSFTPD_USER?= vsftpd
VSFTPD_GROUP?= vsftpd
PKG_GROUPS= ${VSFTPD_GROUP}
PKG_USERS= ${VSFTPD_USER}:${VSFTPD_GROUP}
PKG_GROUPS_VARS+= VSFTPD_GROUP
PKG_USERS_VARS+= VSFTPD_USER
CFLAGS must be modified after including bsd.prefs.mk. XXX pkglint should detect this
2009-08-13 22:20:24 +02:00
CFLAGS+= -DPKG_SYSCONFDIR="\"${PKG_SYSCONFDIR}\""
Add -lresolv to LIBS.SunOS. From Mehul Sanghvi in PR pkg/38585.
2009-11-15 09:03:19 +01:00
LIBS.SunOS= -lsocket -lnsl -lrt -lsendfile -lresolv
Improve linkage but not using the crappy shell script from vsftpd, which doesn't work correctly e.g. on Solaris. Make PAM optional, but since the option is on by default, nothing changes. Fix compilation on Solaris based on input from Stefan Pfetzing in PR 33494.
2006-05-16 23:08:50 +02:00
Update to 2.0.4, based on 2.0.1 update from Ove Soerensen in PR 26811. Add ssl (default off) and tcpwrappers (default on) options. Changes: - Improve logging (log deletes, renames, chmods, etc. as requested by users). - Add no_log_lock to work around Solaris / Veritas locking hangs. - Add EPRT, EPSV, PASV and TVFS to FEAT response. - Implement use of MDTM to set timestamps. - Recognize FEAT prior to login. - Add OpenSSL (AUTH TLS / SSL) support for encrypted control and data connections! Hurrah. - Increase max size of .message files to 4000 characters, thanks to Eric Pancer for the report. - Add easy builddefs.h ability to disable PAM builds even when PAM is installed. - Report vsftpd version in STAT output. - Add REFS file. - Change parent<->child socket comms from DGRAM to STREAM for increased reliability. The main benefit is should the parent be killed (or crash out) then the child won't block on a read() that will never return. - Make str_reserve reserve space for the trailing zero as well, so we don't cause a reallocation if we exactly fill the buffer. - Optimize the sending of strings over the parent<->child comms links. - Improve the build system so tcp_wrappers, PAM and OpenSSL can be forcibly compiled out. - Fix vsftpd.conf.5 typos, thanks to Dmitry V. Levin - If trans_chunk_size is between 1 and 4096, use 4096 rather than ignoring totally. Thanks to Brad - Lose Makefile.sun and README.solaris special cases. - Add SSL / TLS info to SECURITY texts. - Add README.ssl - Add documentation for new SSL options to vsftpd.conf.5. - Add support for CWD ~ (and in general support ~ at start of any filename). Also support stuff like ~chris/pics, if tilde_user_enable=YES is set. Note that all of this is for very very broken clients :-( - Fix compile warnings. - Update INSTALL with (recent) OS X as a working platform. At this point: v2.0.0 released! =============================== - Add -lcrypto for the SSL build; needed for some systems! Thanks to Nelson Chang - Oops; fix session bale out if an empty length password is given. - Fix build on Fedora Core 2 (-lcap cannot seem to find /lib/libcap.so). - Fix vsftpd.conf.5 man page error in "ssl_sslv3", thanks to Etienne Chevillard - Clarify licensing: I allow linking of my GPL software with the OpenSSL libraries. Thanks to Jonas Bofjall - Add COPYRIGHT. - Fix build on OpenBSD, FreeBSD, probably NetBSD too (they aren't SuSv2 compliant; timezone should be a variable not a function). - Fix build where PAM build is enabled but PAM headers are missing. - Fix build on RHEL3 (remove errant include from twoprocess.c). At this point: v2.0.1 released! =============================== - Fix FAQ typo, thanks to Jose Santiago Oyervides Gonzalez - Emit data transfer status messages (success / failure) after flushing and waiting for the full data transfer to reach the client. This should help work around buggy FTP clients such as FlashFXP, which is known to truncate files incorrectly. (v2.0.2pre1) - Make str_empty actually allocate an empty string. - Change the ASCII receive code to ONLY rip out \r if it is just before a \n; someone finally complained about this. (v2.0.2pre2) - Enable AIX Large File Support #define from Tomas gren - Add a couple of FAQ entries. - Fix time delta code areas to cope with negative deltas, which will occur if the clock is adjusted backwards. Thanks to Andrew Anderson for a great report. - Fix "errno" checks to be robust in multiple places; previously, calls to failing library calls could be made inbetween the original library call and the "errno" reads. Thanks to Andrew Anderson for a great report. - Make bandwidth limiter work with SSL data connections. (v2.0.2pre3) - Note that the SSL / bandwidth limiter bug fixed a much more serious bug: SSL data connection dropouts after data_connection_timeout seconds. - Typo fixes. At this point: v2.0.2 released! (need to get the SSL dropout fix out) ===================================================================== - Document what regex expressions are supported in the man page. - New settings rsa_private_key_file and dsa_private_key_file to allow separate files for the certificates and private keys. - Initial, simple fix for timed out processes not exiting when SSL is in use. Better fix (which reports timeout to client properly) to follow. - Add which setsockopt option failed to die("setsockopt") calls. - Fix when running on recent OpenBSDs - OpenBSD change broke vsftpd. Lower linger timeout from INT_MAX to 32767 (SHORT_MAX). Reported by Ewoud van der Vliet and Ed Vazquez (v2.0.3pre1) - Fix error with IPv4 connections to IPv6 listeners and PORT type data connections when connect_from_port_20 is set. RedHat bugzilla 134541. Reported by Joe Orton, Radek Vokal and Andreas Kupfer - Remove vsf_sysutil_sockaddr_same_family (unused). - Support protocol 1 (IPv4) in EPRT. - Add ssl.c to AUDIT. - Allow config file to use "ssl_ciphers=" to use default OpenSSL cipher list. - Allow "EPSV 1" to mean IPv4 EPSV. - Report dummy IP but correct port with IPv6 / PASV. - Handle SSL_WANT_READ and SSL_WANT_WRITE retries in SSL_read and SSL_write; fixes SSL upload failures when data timeouts are in use with some clients. Specifically, I used the test case FileZilla 2.2.12a on Windows XP. Reported by Lee Lawrence (using CuteFTP and BackupEdge) and Christian DELAIR (using lftp, FileZilla and SmartFTP). Thanks to these two people for valuable help. (v2.0.3pre2) - Implicitly disable connect_from_port_20 and chown_uploads when a non-root user is using run_as_launching_user. - Add force_anon_logins_ssl and force_anon_data_ssl for a fully SSL secure anonymous-only solution (useful when you don't have root access and a range of acceptable anonymous passwords as credentials). - Use SSL BIO callbacks to fix data connection timeout checks; the checks weren't all occurring promply. At this point: v2.0.3 released! (need to get about three imporant fixes out) ============================================================================ - Add explicit "This FTP server does not allow anonymous logins" message. - Add paranoid checks to sysutil.c for large values / lengths. - Fix incorrect comment about ASCII and SIZE in the vsftpd.conf example. - Load per-IP config files earlier; allows more settings to be tuned on a per-IP level. Suggested by Reber Tobias - Fix MDTM on non-existant files. Reported by Ken A - {} regex fix so that {*} correctly matches everything. Reported by Tom Van de Wiele - Add "mdtm_write" option to disable MDTM being able to set file timestamps. - Fix HPUX build, thanks to Kevin Vajk - Add optional file locking support via lock_upload_files (default on). - Apply LDFLAGS patch from Mads Martin Joergensen - Add pasv_addr_resolve option to allow pasv_address to get DNS resolved once at startup. - Apply patch to fix timezone issues (caused by chroot() interacting badly with newer glibc versions). Thanks to Dmitry V. Levin and Mads Martin Joergensen At this point: v2.0.4 released! ===============================
2006-01-13 19:12:46 +01:00
.include "options.mk"
Updated to version 1.1.3. Addresses PR pkg/21410 by Jens Liebau. - honour PKG_SYSCONFDIR - rcd script, standalone mode support - tcp wrappers support - install vsftpd:vsftpd user - new HOMEPAGE and MASTER_SITES 1.1.3: ====== - Support for tcp_wrappers. - First stab at Solaris sendfilev() support. - Don't bomb out the listener on SIGHUP if the config became invalid. - End vsf_findlibs.sh with "exit 0;" - thanks Lars Hecking <lhecking@nmrc.ie>! - Integrate with tcp_wrappers - load config based on VSFTPD_LOAD_CONF environment variables. Allows per-IP configurability in standalone mode. - Fix build without tcp_wrappers. - Fix Solaris sendfilev() support - interruption via a signal returns EINTR rather than a partial byte count! - Add to EXAMPLE/ - PER_IP_CONFIG and INTERNET_SITE_NOINETD 1.1.2: ====== - Add per-IP connection limits in standalone mode. - Add logging of refused connect due to global or IP connection limits. - (Many thanks for testing and suggestions from Rob van Nieuwkerk <robn@verdi.et.tudelft.nl> and Adrian Reber <adrian@lisas.de>. - Make connection limit exceeded messages nonblocking. - Don't exit the listener if fork fails. 1.1.1: ====== - Fix port_promiscuous, oops! Thanks to Bjørn-Ove Heimsund <bjornoh@mi.uib.no>. - Fix to support umasks which create executable files. Reported by "Martin, Andreas" <AMartin@hegau-klinikum.de>. - Make the messages more.. professional :( Thanks to Steven G. Taylor <staylor@redhat.com>. - Allow anon users to append to files if they can delete files! Suggestion from Michael Leuchtenburg <michael@slashhome.org>. - Hopefully fix Solaris build (-lresolv) - Replace atoll() with a homebrew - modern FreeBSD, OpenBSD lack it. - Different solution for a umask which creates executable files: file_open_mode. - First attempt at Tru64 build, working with <Sulla17@aol.com>. - A few minor FAQ additions. - Change date format in the log from Sep 09 -> Sep 9. Avoids breaking some broken log parsers. - Make "INSTALL" better and clearer. - Fix passwd_chroot_enable, reported by James Jones <james@richland.edu>. - Finish Tru64 building :-) - Add tunable_no_anon_password as asked for by Stephen Quinney <stephen.quinney@computing-services.oxford.ac.uk>. 1.1.0: ====== - large file (>2Gb) support). - Fix .spec files to use /usr/local/sbin not /usr/sbin, noted by Bill Unruh <unruh@physics.ubc.ca>. - Small doc tweaks and improvements(?) - Add COPYING, the GNU GPL version 2. - Add use_localtime config option to override the use of GMT times. - Add tunable_check_shell (default YES) so people can disable this if they are not using PAM. - AIX 5.1 build support, thanks to Jan-Frode Myklebust <janfrode@parallab.uib.no>. - Add "hide_ids" option to show user/group in directory listings as "ftp". Request from Solar. - Use the seemingly more portable setreuid() and setregid(), poxy HP. - Use status 550 instead of 500 for known but disabled commands. - Rename "dirchange.[ch]" to "banner.[ch]". - Multiline connect banner support via "banner_file" config option. - Minor error message changes. - Add more FAQ entries. - Add patch to specify PASV address - thanks to Mike McLean <mikem@redhat.com>. - Drop the 2.4.0 kernel warning file - Rudimentary standalone listener support - to be expanded in a later release. - If sendfile() returns EINVAL just fall back to normal routines - handles non-pagecache backed files. - Add "port_promiscuous" setting - should help enabling FXP. - Modify anon_root and local_root to change directory _before_ applying the chroot(). - Open all files O_NONBLOCK to avoid pipes blocking on open. - Support wu-ftpd style per-user chroot() via /./ in /etc/passwd HOMEDIR. - Add SIGHUP support to new built in listener. - Per-user config overrides, via "user_config_dir" - woohoo! - Warning fixes, i.e. change "index" to "indexx" thanks to Olaf Kirch <okir@suse.de>. - Make sure the standalone daemon doesn't leak zombies! - Supposedly fix kernel messages about MSG_PEEK race - thanks to advice from Alexey <kuznet@ms2.inr.ac.ru>. - Add global client limit for standalone mode. - Add username that failed when we die with str_getpwnam. - Add a bunch of documentation under EXAMPLES.
2003-05-10 01:31:38 +02:00
do-install:
Add DESTDIR support.
2008-06-20 03:09:05 +02:00
${INSTALL_PROGRAM} ${WRKSRC}/vsftpd ${DESTDIR}${PREFIX}/libexec
${INSTALL_MAN} ${WRKSRC}/vsftpd.8 ${DESTDIR}${PREFIX}/${PKGMANDIR}/man8
${INSTALL_MAN} ${WRKSRC}/vsftpd.conf.5 ${DESTDIR}${PREFIX}/${PKGMANDIR}/man5
${INSTALL_DATA} ${WRKSRC}/vsftpd.conf ${DESTDIR}${EGDIR}/vsftpd.conf.default
Update to 2.0.4, based on 2.0.1 update from Ove Soerensen in PR 26811. Add ssl (default off) and tcpwrappers (default on) options. Changes: - Improve logging (log deletes, renames, chmods, etc. as requested by users). - Add no_log_lock to work around Solaris / Veritas locking hangs. - Add EPRT, EPSV, PASV and TVFS to FEAT response. - Implement use of MDTM to set timestamps. - Recognize FEAT prior to login. - Add OpenSSL (AUTH TLS / SSL) support for encrypted control and data connections! Hurrah. - Increase max size of .message files to 4000 characters, thanks to Eric Pancer for the report. - Add easy builddefs.h ability to disable PAM builds even when PAM is installed. - Report vsftpd version in STAT output. - Add REFS file. - Change parent<->child socket comms from DGRAM to STREAM for increased reliability. The main benefit is should the parent be killed (or crash out) then the child won't block on a read() that will never return. - Make str_reserve reserve space for the trailing zero as well, so we don't cause a reallocation if we exactly fill the buffer. - Optimize the sending of strings over the parent<->child comms links. - Improve the build system so tcp_wrappers, PAM and OpenSSL can be forcibly compiled out. - Fix vsftpd.conf.5 typos, thanks to Dmitry V. Levin - If trans_chunk_size is between 1 and 4096, use 4096 rather than ignoring totally. Thanks to Brad - Lose Makefile.sun and README.solaris special cases. - Add SSL / TLS info to SECURITY texts. - Add README.ssl - Add documentation for new SSL options to vsftpd.conf.5. - Add support for CWD ~ (and in general support ~ at start of any filename). Also support stuff like ~chris/pics, if tilde_user_enable=YES is set. Note that all of this is for very very broken clients :-( - Fix compile warnings. - Update INSTALL with (recent) OS X as a working platform. At this point: v2.0.0 released! =============================== - Add -lcrypto for the SSL build; needed for some systems! Thanks to Nelson Chang - Oops; fix session bale out if an empty length password is given. - Fix build on Fedora Core 2 (-lcap cannot seem to find /lib/libcap.so). - Fix vsftpd.conf.5 man page error in "ssl_sslv3", thanks to Etienne Chevillard - Clarify licensing: I allow linking of my GPL software with the OpenSSL libraries. Thanks to Jonas Bofjall - Add COPYRIGHT. - Fix build on OpenBSD, FreeBSD, probably NetBSD too (they aren't SuSv2 compliant; timezone should be a variable not a function). - Fix build where PAM build is enabled but PAM headers are missing. - Fix build on RHEL3 (remove errant include from twoprocess.c). At this point: v2.0.1 released! =============================== - Fix FAQ typo, thanks to Jose Santiago Oyervides Gonzalez - Emit data transfer status messages (success / failure) after flushing and waiting for the full data transfer to reach the client. This should help work around buggy FTP clients such as FlashFXP, which is known to truncate files incorrectly. (v2.0.2pre1) - Make str_empty actually allocate an empty string. - Change the ASCII receive code to ONLY rip out \r if it is just before a \n; someone finally complained about this. (v2.0.2pre2) - Enable AIX Large File Support #define from Tomas gren - Add a couple of FAQ entries. - Fix time delta code areas to cope with negative deltas, which will occur if the clock is adjusted backwards. Thanks to Andrew Anderson for a great report. - Fix "errno" checks to be robust in multiple places; previously, calls to failing library calls could be made inbetween the original library call and the "errno" reads. Thanks to Andrew Anderson for a great report. - Make bandwidth limiter work with SSL data connections. (v2.0.2pre3) - Note that the SSL / bandwidth limiter bug fixed a much more serious bug: SSL data connection dropouts after data_connection_timeout seconds. - Typo fixes. At this point: v2.0.2 released! (need to get the SSL dropout fix out) ===================================================================== - Document what regex expressions are supported in the man page. - New settings rsa_private_key_file and dsa_private_key_file to allow separate files for the certificates and private keys. - Initial, simple fix for timed out processes not exiting when SSL is in use. Better fix (which reports timeout to client properly) to follow. - Add which setsockopt option failed to die("setsockopt") calls. - Fix when running on recent OpenBSDs - OpenBSD change broke vsftpd. Lower linger timeout from INT_MAX to 32767 (SHORT_MAX). Reported by Ewoud van der Vliet and Ed Vazquez (v2.0.3pre1) - Fix error with IPv4 connections to IPv6 listeners and PORT type data connections when connect_from_port_20 is set. RedHat bugzilla 134541. Reported by Joe Orton, Radek Vokal and Andreas Kupfer - Remove vsf_sysutil_sockaddr_same_family (unused). - Support protocol 1 (IPv4) in EPRT. - Add ssl.c to AUDIT. - Allow config file to use "ssl_ciphers=" to use default OpenSSL cipher list. - Allow "EPSV 1" to mean IPv4 EPSV. - Report dummy IP but correct port with IPv6 / PASV. - Handle SSL_WANT_READ and SSL_WANT_WRITE retries in SSL_read and SSL_write; fixes SSL upload failures when data timeouts are in use with some clients. Specifically, I used the test case FileZilla 2.2.12a on Windows XP. Reported by Lee Lawrence (using CuteFTP and BackupEdge) and Christian DELAIR (using lftp, FileZilla and SmartFTP). Thanks to these two people for valuable help. (v2.0.3pre2) - Implicitly disable connect_from_port_20 and chown_uploads when a non-root user is using run_as_launching_user. - Add force_anon_logins_ssl and force_anon_data_ssl for a fully SSL secure anonymous-only solution (useful when you don't have root access and a range of acceptable anonymous passwords as credentials). - Use SSL BIO callbacks to fix data connection timeout checks; the checks weren't all occurring promply. At this point: v2.0.3 released! (need to get about three imporant fixes out) ============================================================================ - Add explicit "This FTP server does not allow anonymous logins" message. - Add paranoid checks to sysutil.c for large values / lengths. - Fix incorrect comment about ASCII and SIZE in the vsftpd.conf example. - Load per-IP config files earlier; allows more settings to be tuned on a per-IP level. Suggested by Reber Tobias - Fix MDTM on non-existant files. Reported by Ken A - {} regex fix so that {*} correctly matches everything. Reported by Tom Van de Wiele - Add "mdtm_write" option to disable MDTM being able to set file timestamps. - Fix HPUX build, thanks to Kevin Vajk - Add optional file locking support via lock_upload_files (default on). - Apply LDFLAGS patch from Mads Martin Joergensen - Add pasv_addr_resolve option to allow pasv_address to get DNS resolved once at startup. - Apply patch to fix timezone issues (caused by chroot() interacting badly with newer glibc versions). Thanks to Dmitry V. Levin and Mads Martin Joergensen At this point: v2.0.4 released! ===============================
2006-01-13 19:12:46 +01:00
cd ${WRKSRC} && ${INSTALL_DATA} FAQ INSTALL README README.ssl \
Add DESTDIR support.
2008-06-20 03:09:05 +02:00
TUNING ${DESTDIR}${DOCDIR}
${INSTALL_DATA} ${WRKSRC}/SECURITY/* ${DESTDIR}${DOCDIR}/SECURITY
Initial import of vsftpd-0.9.1 vsftpd is an FTP server, or daemon. The "vs" stands for Very Secure. Obviously this is not a guarantee, but a reflection that I have written the entire codebase with security in mind, and carefully designed the program to be resilient to attack. Recent evidence suggests that vsftpd is also extremely fast (and this is before any explicit performance tuning!) In tests against wu-ftpd, vsftpd was always faster, supporting over twice as many users in some tests. Package provided by Jacek Latos <vaneth@krasnik.org> in pkg/13208; minor modifications by me.
2001-06-19 13:32:02 +02:00
.include "../../mk/bsd.pkg.mk"
Reference in a new issue Copy permalink