ftp: CURLOPT_FTP_SKIP_PASV_IP by default

The command line tool also independently sets --ftp-skip-pasv-ip by
default.

Ten test cases updated to adapt the modified --libcurl output.

Bug: https://curl.se/docs/CVE-2020-8284.html
CVE-2020-8284

Reported-by: Varnavas Papaioannou

diff --git a/docs/cmdline-opts/ftp-skip-pasv-ip.d b/docs/cmdline-opts/ftp-skip-pasv-ip.d
index d6fd4589b1e96801cc8a805b4048eae2844b7e43..bcf4e7e62f2e86cc0a4c069857c0d94f1c2ebc5b 100644 (file)
--- a/docs/cmdline-opts/ftp-skip-pasv-ip.d
+++ b/docs/cmdline-opts/ftp-skip-pasv-ip.d
@@ -10,4 +10,6 @@ to curl's PASV command when curl connects the data connection. Instead curl
 will re-use the same IP address it already uses for the control
 connection.
 
+Since curl 7.74.0 this option is enabled by default.
+
 This option has no effect if PORT, EPRT or EPSV is used instead of PASV.

diff --git a/docs/libcurl/opts/CURLOPT_FTP_SKIP_PASV_IP.3 b/docs/libcurl/opts/CURLOPT_FTP_SKIP_PASV_IP.3
index d6217d0d8cac096bd01e764a752cf431f628d35c..fa87ddce7692a3d61df652784fda94292936ef3f 100644 (file)
--- a/docs/libcurl/opts/CURLOPT_FTP_SKIP_PASV_IP.3
+++ b/docs/libcurl/opts/CURLOPT_FTP_SKIP_PASV_IP.3
@@ -5,7 +5,7 @@
 .\" *                            | (__| |_| |  _ <| |___
 .\" *                             \___|\___/|_| \_\_____|
 .\" *
-.\" * Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.
+.\" * Copyright (C) 1998 - 2020, Daniel Stenberg, <daniel@haxx.se>, et al.
 .\" *
 .\" * This software is licensed as described in the file COPYING, which
 .\" * you should have received as part of this distribution. The terms
@@ -35,11 +35,13 @@ address it already uses for the control connection. But it will use the port
 number from the 227-response.
 
 This option thus allows libcurl to work around broken server installations
-that due to NATs, firewalls or incompetence report the wrong IP address back.
+that due to NATs, firewalls or incompetence report the wrong IP address
+back. Setting the option also reduces the risk for various sorts of client
+abuse by malicious servers.
 
 This option has no effect if PORT, EPRT or EPSV is used instead of PASV.
 .SH DEFAULT
-0
+1 since 7.74.0, was 0 before then.
 .SH PROTOCOLS
 FTP
 .SH EXAMPLE

diff --git a/lib/url.c b/lib/url.c
index f8b2a0030de982e589d2eb445715743576d1649b..2b0ba87ba87576f0859122f444c0f3ac5cf8ffa9 100644 (file)
--- a/lib/url.c
+++ b/lib/url.c
@@ -497,6 +497,7 @@ CURLcode Curl_init_userdefined(struct Curl_easy *data)
   set->ftp_use_eprt = TRUE;   /* FTP defaults to EPRT operations */
   set->ftp_use_pret = FALSE;  /* mainly useful for drftpd servers */
   set->ftp_filemethod = FTPFILE_MULTICWD;
+  set->ftp_skip_ip = TRUE;    /* skip PASV IP by default */
 #endif
   set->dns_cache_timeout = 60; /* Timeout every 60 seconds by default */
 

diff --git a/src/tool_cfgable.c b/src/tool_cfgable.c
index c52d8e1c6bb52875e8b58fda976c3056cd740bbf..4c06d3557b730058f315c5696db838697c95f94c 100644 (file)
--- a/src/tool_cfgable.c
+++ b/src/tool_cfgable.c
@@ -44,6 +44,7 @@ void config_init(struct OperationConfig *config)
   config->tcp_nodelay = TRUE; /* enabled by default */
   config->happy_eyeballs_timeout_ms = CURL_HET_DEFAULT;
   config->http09_allowed = FALSE;
+  config->ftp_skip_ip = TRUE;
 }
 
 static void free_config_fields(struct OperationConfig *config)

diff --git a/tests/data/test1400 b/tests/data/test1400
index 812ad0b88d9e641b0efe3241d69b690fb01e9506..b7060eca58eca19c0e9edd157abb2c1e551d1038 100644 (file)
--- a/tests/data/test1400
+++ b/tests/data/test1400
@@ -73,6 +73,7 @@ int main(int argc, char *argv[])
   curl_easy_setopt(hnd, CURLOPT_USERAGENT, "stripped");
   curl_easy_setopt(hnd, CURLOPT_MAXREDIRS, 50L);
   curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
   curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
 
   /* Here is a list of options the curl code used that cannot get generated

diff --git a/tests/data/test1401 b/tests/data/test1401
index f93b3d637de577f3648d0ab6d837a24809ea0fc1..a2629683affa024a38db7b9e66cdabe5baedaa45 100644 (file)
--- a/tests/data/test1401
+++ b/tests/data/test1401
@@ -87,6 +87,7 @@ int main(int argc, char *argv[])
   curl_easy_setopt(hnd, CURLOPT_MAXREDIRS, 50L);
   curl_easy_setopt(hnd, CURLOPT_COOKIE, "chocolate=chip");
   curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
   curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
   curl_easy_setopt(hnd, CURLOPT_PROTOCOLS, (long)CURLPROTO_FILE |
                                            (long)CURLPROTO_FTP |

diff --git a/tests/data/test1402 b/tests/data/test1402
index 7593c516da1d6394e68b623ba042d712ae3c8a3e..1bd55cb4e3b0cf206462ce6b99cf41e807012b03 100644 (file)
--- a/tests/data/test1402
+++ b/tests/data/test1402
@@ -78,6 +78,7 @@ int main(int argc, char *argv[])
   curl_easy_setopt(hnd, CURLOPT_USERAGENT, "stripped");
   curl_easy_setopt(hnd, CURLOPT_MAXREDIRS, 50L);
   curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
   curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
 
   /* Here is a list of options the curl code used that cannot get generated

diff --git a/tests/data/test1403 b/tests/data/test1403
index ecb4dd3dcabe5a1e37ddbd3a8c96e88c46683769..a7c9fcca322a3f129bb0a6bbc750a3af7a6a4710 100644 (file)
--- a/tests/data/test1403
+++ b/tests/data/test1403
@@ -73,6 +73,7 @@ int main(int argc, char *argv[])
   curl_easy_setopt(hnd, CURLOPT_USERAGENT, "stripped");
   curl_easy_setopt(hnd, CURLOPT_MAXREDIRS, 50L);
   curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
   curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
 
   /* Here is a list of options the curl code used that cannot get generated

diff --git a/tests/data/test1404 b/tests/data/test1404
index 97622b63948d29a873920eab44d89391508148e2..1d8e8cf77795df76f64a935b1e3d289161b3895e 100644 (file)
--- a/tests/data/test1404
+++ b/tests/data/test1404
@@ -147,6 +147,7 @@ int main(int argc, char *argv[])
   curl_easy_setopt(hnd, CURLOPT_USERAGENT, "stripped");
   curl_easy_setopt(hnd, CURLOPT_MAXREDIRS, 50L);
   curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
   curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
 
   /* Here is a list of options the curl code used that cannot get generated

diff --git a/tests/data/test1405 b/tests/data/test1405
index 2bac79eda7440ffcd57494540746e4005f2d7b79..b4087704f7b88183ea38511681277579bebe7665 100644 (file)
--- a/tests/data/test1405
+++ b/tests/data/test1405
@@ -89,6 +89,7 @@ int main(int argc, char *argv[])
   curl_easy_setopt(hnd, CURLOPT_POSTQUOTE, slist2);
   curl_easy_setopt(hnd, CURLOPT_PREQUOTE, slist3);
   curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
   curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
 
   /* Here is a list of options the curl code used that cannot get generated

diff --git a/tests/data/test1406 b/tests/data/test1406
index 51a166adff20692ea6aec5d437f09f452c8a5464..38f68d11ee1a147d73f27ebbd9371871dc13876e 100644 (file)
--- a/tests/data/test1406
+++ b/tests/data/test1406
@@ -79,6 +79,7 @@ int main(int argc, char *argv[])
   curl_easy_setopt(hnd, CURLOPT_URL, "smtp://%HOSTIP:%SMTPPORT/1406");
   curl_easy_setopt(hnd, CURLOPT_UPLOAD, 1L);
   curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
   curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
   curl_easy_setopt(hnd, CURLOPT_MAIL_FROM, "sender@example.com");
   curl_easy_setopt(hnd, CURLOPT_MAIL_RCPT, slist1);

diff --git a/tests/data/test1407 b/tests/data/test1407
index f6879008fb25bd5a2e0a1c3c4ec75ac845499ce8..a7e13ba7585f80510600128d86bb7590294c7e5a 100644 (file)
--- a/tests/data/test1407
+++ b/tests/data/test1407
@@ -62,6 +62,7 @@ int main(int argc, char *argv[])
   curl_easy_setopt(hnd, CURLOPT_DIRLISTONLY, 1L);
   curl_easy_setopt(hnd, CURLOPT_USERPWD, "user:secret");
   curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
   curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
 
   /* Here is a list of options the curl code used that cannot get generated

diff --git a/tests/data/test1420 b/tests/data/test1420
index 057ecc4773a5b0dd9b28469fa197f508876338fd..4b8d7bbf4187395aa025ec1dac1d13de31c62314 100644 (file)
--- a/tests/data/test1420
+++ b/tests/data/test1420
@@ -67,6 +67,7 @@ int main(int argc, char *argv[])
   curl_easy_setopt(hnd, CURLOPT_URL, "imap://%HOSTIP:%IMAPPORT/1420/;MAILINDEX=1");
   curl_easy_setopt(hnd, CURLOPT_USERPWD, "user:secret");
   curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
+  curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
   curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
 
   /* Here is a list of options the curl code used that cannot get generated

diff --git a/tests/data/test1465 b/tests/data/test1465
index 7d40318394d065c690136fb728f679165f3b535e..4da25dc9271ebb71ac0c1f942c4da7135d1ced28 100644 (file)
Binary files a/tests/data/test1465 and b/tests/data/test1465 differ