9b977c
From 2629f42d4cfdd04df0544007b03161e3d5d52d54 Mon Sep 17 00:00:00 2001
9b977c
From: Daniel Stenberg <daniel@haxx.se>
9b977c
Date: Tue, 24 Nov 2020 14:56:57 +0100
9b977c
Subject: [PATCH] ftp: CURLOPT_FTP_SKIP_PASV_IP by default
9b977c
9b977c
The command line tool also independently sets --ftp-skip-pasv-ip by
9b977c
default.
9b977c
9b977c
Ten test cases updated to adapt the modified --libcurl output.
9b977c
9b977c
Bug: https://curl.se/docs/CVE-2020-8284.html
9b977c
CVE-2020-8284
9b977c
9b977c
Reported-by: Varnavas Papaioannou
9b977c
9b977c
Upstream-commit: ec9cc725d598ac77de7b6df8afeec292b3c8ad46
9b977c
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
9b977c
---
9b977c
 docs/cmdline-opts/ftp-skip-pasv-ip.d         | 2 ++
9b977c
 docs/libcurl/opts/CURLOPT_FTP_SKIP_PASV_IP.3 | 8 +++++---
9b977c
 lib/url.c                                    | 1 +
9b977c
 src/tool_cfgable.c                           | 1 +
9b977c
 tests/data/test1400                          | 1 +
9b977c
 tests/data/test1401                          | 1 +
9b977c
 tests/data/test1402                          | 1 +
9b977c
 tests/data/test1403                          | 1 +
9b977c
 tests/data/test1404                          | 1 +
9b977c
 tests/data/test1405                          | 1 +
9b977c
 tests/data/test1406                          | 1 +
9b977c
 tests/data/test1407                          | 1 +
9b977c
 tests/data/test1420                          | 1 +
9b977c
 13 files changed, 18 insertions(+), 3 deletions(-)
9b977c
9b977c
diff --git a/docs/cmdline-opts/ftp-skip-pasv-ip.d b/docs/cmdline-opts/ftp-skip-pasv-ip.d
9b977c
index da6ab11..4be8b43 100644
9b977c
--- a/docs/cmdline-opts/ftp-skip-pasv-ip.d
9b977c
+++ b/docs/cmdline-opts/ftp-skip-pasv-ip.d
9b977c
@@ -9,4 +9,6 @@ to curl's PASV command when curl connects the data connection. Instead curl
9b977c
 will re-use the same IP address it already uses for the control
9b977c
 connection.
9b977c
 
9b977c
+Since curl 7.74.0 this option is enabled by default.
9b977c
+
9b977c
 This option has no effect if PORT, EPRT or EPSV is used instead of PASV.
9b977c
diff --git a/docs/libcurl/opts/CURLOPT_FTP_SKIP_PASV_IP.3 b/docs/libcurl/opts/CURLOPT_FTP_SKIP_PASV_IP.3
9b977c
index 4d3026a..4227ed6 100644
9b977c
--- a/docs/libcurl/opts/CURLOPT_FTP_SKIP_PASV_IP.3
9b977c
+++ b/docs/libcurl/opts/CURLOPT_FTP_SKIP_PASV_IP.3
9b977c
@@ -5,7 +5,7 @@
9b977c
 .\" *                            | (__| |_| |  _ <| |___
9b977c
 .\" *                             \___|\___/|_| \_\_____|
9b977c
 .\" *
9b977c
-.\" * Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.
9b977c
+.\" * Copyright (C) 1998 - 2020, Daniel Stenberg, <daniel@haxx.se>, et al.
9b977c
 .\" *
9b977c
 .\" * This software is licensed as described in the file COPYING, which
9b977c
 .\" * you should have received as part of this distribution. The terms
9b977c
@@ -36,11 +36,13 @@ address it already uses for the control connection. But it will use the port
9b977c
 number from the 227-response.
9b977c
 
9b977c
 This option thus allows libcurl to work around broken server installations
9b977c
-that due to NATs, firewalls or incompetence report the wrong IP address back.
9b977c
+that due to NATs, firewalls or incompetence report the wrong IP address
9b977c
+back. Setting the option also reduces the risk for various sorts of client
9b977c
+abuse by malicious servers.
9b977c
 
9b977c
 This option has no effect if PORT, EPRT or EPSV is used instead of PASV.
9b977c
 .SH DEFAULT
9b977c
-0
9b977c
+1 since 7.74.0, was 0 before then.
9b977c
 .SH PROTOCOLS
9b977c
 FTP
9b977c
 .SH EXAMPLE
9b977c
diff --git a/lib/url.c b/lib/url.c
9b977c
index e77f391..b18db25 100644
9b977c
--- a/lib/url.c
9b977c
+++ b/lib/url.c
9b977c
@@ -434,6 +434,7 @@ CURLcode Curl_init_userdefined(struct Curl_easy *data)
9b977c
   set->ftp_use_eprt = TRUE;   /* FTP defaults to EPRT operations */
9b977c
   set->ftp_use_pret = FALSE;  /* mainly useful for drftpd servers */
9b977c
   set->ftp_filemethod = FTPFILE_MULTICWD;
9b977c
+  set->ftp_skip_ip = TRUE;    /* skip PASV IP by default */
9b977c
 
9b977c
   set->dns_cache_timeout = 60; /* Timeout every 60 seconds by default */
9b977c
 
9b977c
diff --git a/src/tool_cfgable.c b/src/tool_cfgable.c
9b977c
index 81e16c1..110191e 100644
9b977c
--- a/src/tool_cfgable.c
9b977c
+++ b/src/tool_cfgable.c
9b977c
@@ -43,6 +43,7 @@ void config_init(struct OperationConfig* config)
9b977c
   config->proto_default = NULL;
9b977c
   config->tcp_nodelay = TRUE; /* enabled by default */
9b977c
   config->happy_eyeballs_timeout_ms = CURL_HET_DEFAULT;
9b977c
+  config->ftp_skip_ip = TRUE;
9b977c
 }
9b977c
 
9b977c
 static void free_config_fields(struct OperationConfig *config)
9b977c
diff --git a/tests/data/test1400 b/tests/data/test1400
9b977c
index 10faef3..9d18a30 100644
9b977c
--- a/tests/data/test1400
9b977c
+++ b/tests/data/test1400
9b977c
@@ -73,6 +73,7 @@ int main(int argc, char *argv[])
9b977c
   curl_easy_setopt(hnd, CURLOPT_USERAGENT, "stripped");
9b977c
   curl_easy_setopt(hnd, CURLOPT_MAXREDIRS, 50L);
9b977c
   curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
9b977c
+  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
9b977c
   curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
9b977c
 
9b977c
   /* Here is a list of options the curl code used that cannot get generated
9b977c
diff --git a/tests/data/test1401 b/tests/data/test1401
9b977c
index f330931..99cb0cb 100644
9b977c
--- a/tests/data/test1401
9b977c
+++ b/tests/data/test1401
9b977c
@@ -89,6 +89,7 @@ int main(int argc, char *argv[])
9b977c
   curl_easy_setopt(hnd, CURLOPT_MAXREDIRS, 50L);
9b977c
   curl_easy_setopt(hnd, CURLOPT_COOKIE, "chocolate=chip");
9b977c
   curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
9b977c
+  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
9b977c
   curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
9b977c
   curl_easy_setopt(hnd, CURLOPT_PROTOCOLS, (long)CURLPROTO_FILE |
9b977c
                                            (long)CURLPROTO_FTP |
9b977c
diff --git a/tests/data/test1402 b/tests/data/test1402
9b977c
index 9a94283..ef55bd6 100644
9b977c
--- a/tests/data/test1402
9b977c
+++ b/tests/data/test1402
9b977c
@@ -80,6 +80,7 @@ int main(int argc, char *argv[])
9b977c
   curl_easy_setopt(hnd, CURLOPT_USERAGENT, "stripped");
9b977c
   curl_easy_setopt(hnd, CURLOPT_MAXREDIRS, 50L);
9b977c
   curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
9b977c
+  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
9b977c
   curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
9b977c
 
9b977c
   /* Here is a list of options the curl code used that cannot get generated
9b977c
diff --git a/tests/data/test1403 b/tests/data/test1403
9b977c
index 79cdf49..78932c2 100644
9b977c
--- a/tests/data/test1403
9b977c
+++ b/tests/data/test1403
9b977c
@@ -75,6 +75,7 @@ int main(int argc, char *argv[])
9b977c
   curl_easy_setopt(hnd, CURLOPT_USERAGENT, "stripped");
9b977c
   curl_easy_setopt(hnd, CURLOPT_MAXREDIRS, 50L);
9b977c
   curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
9b977c
+  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
9b977c
   curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
9b977c
 
9b977c
   /* Here is a list of options the curl code used that cannot get generated
9b977c
diff --git a/tests/data/test1404 b/tests/data/test1404
9b977c
index 9c6f2e7..8ea5e04 100644
9b977c
--- a/tests/data/test1404
9b977c
+++ b/tests/data/test1404
9b977c
@@ -144,6 +144,7 @@ int main(int argc, char *argv[])
9b977c
   curl_easy_setopt(hnd, CURLOPT_USERAGENT, "stripped");
9b977c
   curl_easy_setopt(hnd, CURLOPT_MAXREDIRS, 50L);
9b977c
   curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
9b977c
+  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
9b977c
   curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
9b977c
 
9b977c
   /* Here is a list of options the curl code used that cannot get generated
9b977c
diff --git a/tests/data/test1405 b/tests/data/test1405
9b977c
index 73769ee..5a83b6e 100644
9b977c
--- a/tests/data/test1405
9b977c
+++ b/tests/data/test1405
9b977c
@@ -89,6 +89,7 @@ int main(int argc, char *argv[])
9b977c
   curl_easy_setopt(hnd, CURLOPT_POSTQUOTE, slist2);
9b977c
   curl_easy_setopt(hnd, CURLOPT_PREQUOTE, slist3);
9b977c
   curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
9b977c
+  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
9b977c
   curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
9b977c
 
9b977c
   /* Here is a list of options the curl code used that cannot get generated
9b977c
diff --git a/tests/data/test1406 b/tests/data/test1406
9b977c
index 796dd22..c941e00 100644
9b977c
--- a/tests/data/test1406
9b977c
+++ b/tests/data/test1406
9b977c
@@ -80,6 +80,7 @@ int main(int argc, char *argv[])
9b977c
   curl_easy_setopt(hnd, CURLOPT_URL, "smtp://%HOSTIP:%SMTPPORT/1406");
9b977c
   curl_easy_setopt(hnd, CURLOPT_UPLOAD, 1L);
9b977c
   curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
9b977c
+  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
9b977c
   curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
9b977c
   curl_easy_setopt(hnd, CURLOPT_MAIL_FROM, "sender@example.com");
9b977c
   curl_easy_setopt(hnd, CURLOPT_MAIL_RCPT, slist1);
9b977c
diff --git a/tests/data/test1407 b/tests/data/test1407
9b977c
index 9800eee..ddba7b7 100644
9b977c
--- a/tests/data/test1407
9b977c
+++ b/tests/data/test1407
9b977c
@@ -62,6 +62,7 @@ int main(int argc, char *argv[])
9b977c
   curl_easy_setopt(hnd, CURLOPT_DIRLISTONLY, 1L);
9b977c
   curl_easy_setopt(hnd, CURLOPT_USERPWD, "user:secret");
9b977c
   curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
9b977c
+  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
9b977c
   curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
9b977c
 
9b977c
   /* Here is a list of options the curl code used that cannot get generated
9b977c
diff --git a/tests/data/test1420 b/tests/data/test1420
9b977c
index a5e1c52..72fb353 100644
9b977c
--- a/tests/data/test1420
9b977c
+++ b/tests/data/test1420
9b977c
@@ -67,6 +67,7 @@ int main(int argc, char *argv[])
9b977c
   curl_easy_setopt(hnd, CURLOPT_URL, "imap://%HOSTIP:%IMAPPORT/1420/;UID=1");
9b977c
   curl_easy_setopt(hnd, CURLOPT_USERPWD, "user:secret");
9b977c
   curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
9b977c
+  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
9b977c
   curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
9b977c
 
9b977c
   /* Here is a list of options the curl code used that cannot get generated
9b977c
-- 
9b977c
2.26.2
9b977c