0049-Add-new-filename-generation-algorithm-for-STOU-comma.patch

From 1203b943b369651d96d057f8190f14f015e6ff0b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Lyson=C4=9Bk?= <olysonek@redhat.com>
Date: Tue, 6 Feb 2018 13:30:44 +0100
Subject: [PATCH 49/59] Add new filename generation algorithm for STOU command

A new configuration option 'better_stou' can be used to enable
a better algorithm for generating unique filenames.

Resolves: rhbz#1479237
---
 parseconf.c   |   1 +
 postlogin.c   | 176 +++++++++++++++++++++++++++++++++++++++++++++++++---------
 sysutil.c     |   3 +
 sysutil.h     |   3 +-
 tunables.c    |   2 +
 tunables.h    |   3 +
 vsftpd.conf.5 |   5 ++
 7 files changed, 166 insertions(+), 27 deletions(-)

diff --git a/parseconf.c b/parseconf.c
index 33a1349..47b54f1 100644
--- a/parseconf.c
+++ b/parseconf.c
@@ -111,6 +111,7 @@ parseconf_bool_array[] =
   { "http_enable", &tunable_http_enable },
   { "seccomp_sandbox", &tunable_seccomp_sandbox },
   { "allow_writeable_chroot", &tunable_allow_writeable_chroot },
+  { "better_stou", &tunable_better_stou },
   { 0, 0 }
 };
 
diff --git a/postlogin.c b/postlogin.c
index 8363c9c..7c749ef 100644
--- a/postlogin.c
+++ b/postlogin.c
@@ -29,6 +29,7 @@
 #include "opts.h"
 
 #include <errno.h>
+#include <stdio.h>
 
 /* Private local functions */
 static void handle_pwd(struct vsf_session* p_sess);
@@ -1028,6 +1029,114 @@ handle_stor(struct vsf_session* p_sess)
   handle_upload_common(p_sess, 0, 0);
 }
 
+/* Based on __gen_tempname() from glibc - thanks, glibc! Relicensed
+ * from LGPL2.1+ to GPL2.
+ */
+static int
+create_unique_file(struct vsf_session* p_sess, struct mystr* p_outstr,
+                   const struct mystr* p_base_str,
+                   int (*access_checker)(const struct mystr*))
+{
+  struct mystr s_result = INIT_MYSTR;
+  const int suffix_len = 6;
+  unsigned int count;
+  static unsigned long long int value;
+  unsigned long long int random_time_bits;
+  int fd = -1;
+  /* These are the characters used in temporary file names.  */
+  struct mystr s_letters = INIT_MYSTR;
+  unsigned int s_letters_len;
+  int base_len;
+
+  str_alloc_text(&s_letters,
+      "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789");
+  s_letters_len = str_getlen(&s_letters);
+
+  /* A lower bound on the number of temporary files to attempt to
+     generate.  The maximum total number of temporary file names that
+     can exist for a given template is 62**6.  It should never be
+     necessary to try all of these combinations.  Instead if a reasonable
+     number of names is tried (we define reasonable as 62**3) fail to
+     give the system administrator the chance to remove the problems.  */
+#define ATTEMPTS_MIN (62 * 62 * 62)
+
+  /* The number of times to attempt to generate a temporary file. */
+#if ATTEMPTS_MIN < TMP_MAX
+  unsigned int attempts = TMP_MAX;
+#else
+  unsigned int attempts = ATTEMPTS_MIN;
+#endif
+#undef ATTEMPTS_MIN
+
+  {
+    long sec = vsf_sysutil_get_time_sec();
+    long usec = vsf_sysutil_get_time_usec();
+    random_time_bits = ((unsigned long long int) usec << 16) ^ sec;
+    value += random_time_bits ^ vsf_sysutil_getpid();
+  }
+
+  if (str_isempty(p_base_str))
+  {
+    const char *base = "STOU.";
+    base_len = vsf_sysutil_strlen(base);
+    str_reserve(&s_result, base_len + suffix_len);
+    str_alloc_text(&s_result, base);
+  }
+  else
+  {
+    str_reserve(&s_result, str_getlen(p_base_str) + suffix_len + 1);
+    str_copy(&s_result, p_base_str);
+    str_append_char(&s_result, '.');
+    base_len = str_getlen(&s_result);
+  }
+
+  for (count = 0; count < attempts; value += 7777, ++count)
+  {
+    unsigned long long v = value;
+    str_trunc(&s_result, base_len);
+    for (int i = 0; i < suffix_len; ++i)
+    {
+      char c;
+      c = str_get_char_at(&s_letters, v % s_letters_len);
+      v /= s_letters_len;
+      str_append_char(&s_result, c);
+    }
+    if (!access_checker(&s_result))
+    {
+      /* If we generate a filename which is not allowed, we fail immediatelly,
+       * without trying any other possibilities. This is to prevent attackers
+       * from keeping us busy.
+       */
+      vsf_cmdio_write(p_sess, FTP_NOPERM, "Permission denied.");
+      break;
+    }
+    fd = str_create_exclusive(&s_result);
+    if (vsf_sysutil_retval_is_error(fd))
+    {
+      if (kVSFSysUtilErrEXIST == vsf_sysutil_get_error())
+      {
+        continue;
+      }
+      else
+      {
+        vsf_cmdio_write(p_sess, FTP_UPLOADFAIL, "Could not create file.");
+        break;
+      }
+    }
+    else
+    {
+      break;
+    }
+  }
+  if (!vsf_sysutil_retval_is_error(fd))
+  {
+    str_copy(p_outstr, &s_result);
+  }
+  str_free(&s_letters);
+  str_free(&s_result);
+  return fd;
+}
+
 static void
 handle_upload_common(struct vsf_session* p_sess, int is_append, int is_unique)
 {
@@ -1049,41 +1158,56 @@ handle_upload_common(struct vsf_session* p_sess, int is_append, int is_unique)
     return;
   }
   resolve_tilde(&p_sess->ftp_arg_str, p_sess);
-  p_filename = &p_sess->ftp_arg_str;
-  if (is_unique)
-  {
-    get_unique_filename(&s_filename, p_filename);
-    p_filename = &s_filename;
-  }
   vsf_log_start_entry(p_sess, kVSFLogEntryUpload);
   str_copy(&p_sess->log_str, &p_sess->ftp_arg_str);
   prepend_path_to_filename(&p_sess->log_str);
-  if (!vsf_access_check_file(p_filename))
-  {
-    vsf_cmdio_write(p_sess, FTP_NOPERM, "Permission denied.");
-    return;
-  }
-  /* NOTE - actual file permissions will be governed by the tunable umask */
-  /* XXX - do we care about race between create and chown() of anonymous
-   * upload?
-   */
-  if (is_unique || (p_sess->is_anonymous && !tunable_anon_other_write_enable))
+  p_filename = &p_sess->ftp_arg_str;
+  if (is_unique && tunable_better_stou)
   {
-    new_file_fd = str_create_exclusive(p_filename);
+    new_file_fd = create_unique_file(p_sess, &s_filename, p_filename,
+                                     vsf_access_check_file);
+    if (vsf_sysutil_retval_is_error(new_file_fd))
+    {
+      return;
+    }
+    p_filename = &s_filename;
   }
   else
   {
-    /* For non-anonymous, allow open() to overwrite or append existing files */
-    new_file_fd = str_create(p_filename);
-    if (!is_append && offset == 0)
+    if (is_unique)
     {
-      do_truncate = 1;
+      get_unique_filename(&s_filename, p_filename);
+      p_filename = &s_filename;
+    }
+    if (!vsf_access_check_file(p_filename))
+    {
+      vsf_cmdio_write(p_sess, FTP_NOPERM, "Permission denied.");
+      return;
+    }
+    /* NOTE - actual file permissions will be governed by the tunable umask */
+    /* XXX - do we care about race between create and chown() of anonymous
+     * upload?
+     */
+    if (is_unique || (p_sess->is_anonymous && !tunable_anon_other_write_enable))
+    {
+      new_file_fd = str_create_exclusive(p_filename);
+    }
+    else
+    {
+      /* For non-anonymous, allow open() to overwrite or append existing
+       * files
+       */
+      new_file_fd = str_create(p_filename);
+      if (!is_append && offset == 0)
+      {
+        do_truncate = 1;
+      }
+    }
+    if (vsf_sysutil_retval_is_error(new_file_fd))
+    {
+      vsf_cmdio_write(p_sess, FTP_UPLOADFAIL, "Could not create file.");
+      return;
     }
-  }
-  if (vsf_sysutil_retval_is_error(new_file_fd))
-  {
-    vsf_cmdio_write(p_sess, FTP_UPLOADFAIL, "Could not create file.");
-    return;
   }
   created = 1;
   vsf_sysutil_fstat(new_file_fd, &s_p_statbuf);
diff --git a/sysutil.c b/sysutil.c
index 1c0422e..e847650 100644
--- a/sysutil.c
+++ b/sysutil.c
@@ -1666,6 +1666,9 @@ vsf_sysutil_get_error(void)
     case EAGAIN:
       retval = kVSFSysUtilErrAGAIN;
       break;
+    case EEXIST:
+      retval = kVSFSysUtilErrEXIST;
+      break;
     default:
       break;
   }
diff --git a/sysutil.h b/sysutil.h
index be727f5..7a59f13 100644
--- a/sysutil.h
+++ b/sysutil.h
@@ -19,7 +19,8 @@ enum EVSFSysUtilError
   kVSFSysUtilErrOPNOTSUPP,
   kVSFSysUtilErrACCES,
   kVSFSysUtilErrNOENT,
-  kVSFSysUtilErrAGAIN
+  kVSFSysUtilErrAGAIN,
+  kVSFSysUtilErrEXIST
 };
 enum EVSFSysUtilError vsf_sysutil_get_error(void);
 
diff --git a/tunables.c b/tunables.c
index 9680528..5ec2bdc 100644
--- a/tunables.c
+++ b/tunables.c
@@ -92,6 +92,7 @@ int tunable_ftp_enable;
 int tunable_http_enable;
 int tunable_seccomp_sandbox;
 int tunable_allow_writeable_chroot;
+int tunable_better_stou;
 
 unsigned int tunable_accept_timeout;
 unsigned int tunable_connect_timeout;
@@ -239,6 +240,7 @@ tunables_load_defaults()
   tunable_http_enable = 0;
   tunable_seccomp_sandbox = 0;
   tunable_allow_writeable_chroot = 0;
+  tunable_better_stou = 0;
 
   tunable_accept_timeout = 60;
   tunable_connect_timeout = 60;
diff --git a/tunables.h b/tunables.h
index a466427..85ea1a8 100644
--- a/tunables.h
+++ b/tunables.h
@@ -93,6 +93,9 @@ extern int tunable_ftp_enable;                /* Allow FTP protocol */
 extern int tunable_http_enable;               /* Allow HTTP protocol */
 extern int tunable_seccomp_sandbox;           /* seccomp filter sandbox */
 extern int tunable_allow_writeable_chroot;    /* Allow misconfiguration */
+extern int tunable_better_stou;               /* Use better file name generation
+                                               * algorithm for the STOU command
+					       */
 
 /* Integer/numeric defines */
 extern unsigned int tunable_accept_timeout;
diff --git a/vsftpd.conf.5 b/vsftpd.conf.5
index 43b0435..6911a73 100644
--- a/vsftpd.conf.5
+++ b/vsftpd.conf.5
@@ -65,6 +65,11 @@ creates an 'etc' directory in the new root directory, they could potentially
 trick the C library into loading a user-created configuration file from the
 /etc/ directory.
 
+Default: NO
+.TP
+.B better_stou
+Use better file name generation algorithm for the STOU command.
+
 Default: NO
 .TP
 .B anon_mkdir_write_enable
-- 
2.14.4