[Git][debian-proftpd-team/proftpd][master] 2 commits: [skip-ci] Add patch 05_disable_inet_connect_ipv6_test.diff
Hilmar Preuße (@hilmar)
gitlab at salsa.debian.org
Sun Nov 1 17:44:10 GMT 2026
Hilmar Preuße pushed to branch master at Debian ProFTPD Team / proftpd
Commits:
c2c9bc1f by Hilmar Preuße at 2026-11-01T14:12:10+01:00
[skip-ci] Add patch 05_disable_inet_connect_ipv6_test.diff
- - - - -
5eda48f8 by Hilmar Preuße at 2026-11-01T18:42:44+01:00
issue #2374 / Debian #1152788 / CVE-2026-119364
- - - - -
4 changed files:
- debian/changelog
- + debian/patches/05_disable_inet_connect_ipv6_test.diff
- + debian/patches/ab5c8cd35f85b75e90019a32674a1f1062268bec.diff
- debian/patches/series
Changes:
=====================================
debian/changelog
=====================================
@@ -1,3 +1,10 @@
+proftpd-dfsg (1.3.9e~dfsg-3) UNRELEASED; urgency=medium
+
+ * Apply patch to disable inet_connect_ipv6_test (fails on s390x).
+ * Apply patch to fix issue #2374 / CVE-2026-119364 (Closes: #1152788).
+
+ -- Hilmar Preuße <hille42 at debian.org> Sun, 01 Nov 2026 11:18:21 +0100
+
proftpd-dfsg (1.3.9e~dfsg-2) unstable; urgency=medium
* Remove obsolete patches.
=====================================
debian/patches/05_disable_inet_connect_ipv6_test.diff
=====================================
@@ -0,0 +1,15 @@
+Description: Disable inet_connect_ipv6_test test, fails on s390x.
+Author: Hilmar Preuße <hille42 at debian.org>
+Forwarded: not needed
+
+--- proftpd.orig/tests/api/inet.c
++++ proftpd/tests/api/inet.c
+@@ -1428,7 +1428,7 @@
+ tcase_add_test(testcase, inet_set_socket_opts2_test);
+ tcase_add_test(testcase, inet_listen_test);
+ /* tcase_add_test(testcase, inet_connect_ipv4_test); */
+- tcase_add_test(testcase, inet_connect_ipv6_test);
++ /* tcase_add_test(testcase, inet_connect_ipv6_test); */
+ tcase_add_test(testcase, inet_connect_nowait_test);
+ tcase_add_test(testcase, inet_accept_test);
+ tcase_add_test(testcase, inet_accept_nowait_test);
=====================================
debian/patches/ab5c8cd35f85b75e90019a32674a1f1062268bec.diff
=====================================
@@ -0,0 +1,117 @@
+From ab5c8cd35f85b75e90019a32674a1f1062268bec Mon Sep 17 00:00:00 2001
+From: TJ Saunders <tj at castaglia.org>
+Date: Sat, 17 Oct 2026 13:12:56 -0700
+Subject: [PATCH] Issue #2374: Resolve the destination path in order to handle
+ any potential symlinks, and use the resolved path for <Limit> checks.
+
+---
+ contrib/mod_copy.c | 51 +++++++++++++++++++++++++++++++++++-----------
+ 1 file changed, 39 insertions(+), 12 deletions(-)
+
+diff --git a/contrib/mod_copy.c b/contrib/mod_copy.c
+index a87a4363ac..4f98b42751 100644
+--- a/contrib/mod_copy.c
++++ b/contrib/mod_copy.c
+@@ -617,7 +617,29 @@ MODRET copy_copy(cmd_rec *cmd) {
+ return PR_ERROR(cmd);
+ }
+
+- to = dir_canonical_vpath(cmd->tmp_pool, decoded_path);
++ pr_fs_clear_cache2(decoded_path);
++ to = dir_realpath(cmd->tmp_pool, decoded_path);
++ if (to == NULL) {
++ /* Try using dir_best_path(), as xfer_pre_stor() does. */
++ to = dir_best_path(cmd->tmp_pool, decoded_path);
++ }
++
++ cmd_name = cmd->argv[0];
++ pr_cmd_set_name(cmd, "SITE_COPY");
++ if (!dir_check(cmd->tmp_pool, cmd, G_READ, from, NULL)) {
++ int xerrno = EPERM;
++
++ pr_cmd_set_name(cmd, cmd_name);
++ pr_log_debug(DEBUG8, "%s %s %s denied by <Limit> configuration",
++ (char *) cmd->argv[0], (char *) cmd->argv[1], from);
++ pr_response_add_err(R_550, "%s: %s", (char *) cmd->argv[2],
++ strerror(xerrno));
++
++ pr_cmd_set_errno(cmd, xerrno);
++ errno = xerrno;
++ return PR_ERROR(cmd);
++ }
++ pr_cmd_set_name(cmd, cmd_name);
+
+ cmd_name = cmd->argv[0];
+ pr_cmd_set_name(cmd, "SITE_COPY");
+@@ -625,8 +647,8 @@ MODRET copy_copy(cmd_rec *cmd) {
+ int xerrno = EPERM;
+
+ pr_cmd_set_name(cmd, cmd_name);
+- pr_log_debug(DEBUG8, "%s denied by <Limit> configuration",
+- (char *) cmd->argv[0]);
++ pr_log_debug(DEBUG8, "%s %s %s denied by <Limit> configuration",
++ (char *) cmd->argv[0], (char *) cmd->argv[1], to);
+ pr_response_add_err(R_550, "%s: %s", (char *) cmd->argv[3],
+ strerror(xerrno));
+
+@@ -783,7 +805,7 @@ MODRET copy_cpfr(cmd_rec *cmd) {
+
+ MODRET copy_cpto(cmd_rec *cmd) {
+ register unsigned int i;
+- const char *from, *to = "";
++ const char *from, *to = "", *resolved_to;
+ char *cmd_name;
+ unsigned char *authenticated = NULL;
+
+@@ -841,16 +863,21 @@ MODRET copy_cpto(cmd_rec *cmd) {
+ to = pstrcat(cmd->tmp_pool, to, *to ? " " : "", decoded_path, NULL);
+ }
+
+- to = dir_canonical_vpath(cmd->tmp_pool, to);
++ pr_fs_clear_cache2(to);
++ resolved_to = dir_realpath(cmd->tmp_pool, to);
++ if (resolved_to == NULL) {
++ /* Try using dir_best_path(), as xfer_pre_stor() does. */
++ resolved_to = dir_best_path(cmd->tmp_pool, to);
++ }
+
+ cmd_name = cmd->argv[0];
+ pr_cmd_set_name(cmd, "SITE_CPTO");
+- if (!dir_check(cmd->tmp_pool, cmd, G_WRITE, to, NULL)) {
++ if (!dir_check(cmd->tmp_pool, cmd, G_WRITE, resolved_to, NULL)) {
+ int xerrno = EPERM;
+
+ pr_cmd_set_name(cmd, cmd_name);
+- pr_log_debug(DEBUG8, "%s denied by <Limit> configuration",
+- (char *) cmd->argv[0]);
++ pr_log_debug(DEBUG8, "%s %s %s denied by <Limit> configuration",
++ (char *) cmd->argv[0], (char *) cmd->argv[1], to);
+ pr_response_add_err(R_550, "%s: %s", to, strerror(xerrno));
+
+ pr_cmd_set_errno(cmd, xerrno);
+@@ -859,12 +886,12 @@ MODRET copy_cpto(cmd_rec *cmd) {
+ }
+ pr_cmd_set_name(cmd, cmd_name);
+
+- if (copy_paths(cmd->tmp_pool, from, to) < 0) {
++ if (copy_paths(cmd->tmp_pool, from, resolved_to) < 0) {
+ int xerrno = errno;
+ const char *err_code = R_550;
+
+ pr_log_debug(DEBUG7, MOD_COPY_VERSION
+- ": error copying '%s' to '%s': %s", from, to, strerror(xerrno));
++ ": error copying '%s' to '%s': %s", from, resolved_to, strerror(xerrno));
+
+ /* Check errno for EDQOUT (or the most appropriate alternative).
+ * (I hate the fact that FTP has a special response code just for
+@@ -889,8 +916,8 @@ MODRET copy_cpto(cmd_rec *cmd) {
+ break;
+ }
+
+- pr_response_add_err(err_code, "%s: %s", (char *) cmd->argv[1],
+- strerror(xerrno));
++ pr_response_add_err(err_code, "%s %s: %s", (char *) cmd->argv[0],
++ (char *) cmd->argv[1], strerror(xerrno));
+
+ pr_cmd_set_errno(cmd, xerrno);
+ errno = xerrno;
=====================================
debian/patches/series
=====================================
@@ -10,7 +10,9 @@ odbc
# The following two patches conflict.
#04_disable_base_netaddr_get_addr_test.diff
04_disable_base_netaddr_get_addr_test2.diff
+05_disable_inet_connect_ipv6_test.diff
#ca9a7469ced3a7baf8ab9cc97f7c6b4c5ee3de75.diff
933abc9ae115ffc59e4b2a98495ec267bf341d23.diff
0f91a0f088312da4862d1f882cdf998e78fa3795.diff
c4515f5bd4236a803213c9df926e4094c4b003f2.diff
+ab5c8cd35f85b75e90019a32674a1f1062268bec.diff
View it on GitLab: https://salsa.debian.org/debian-proftpd-team/proftpd/-/compare/31e43547307ebf6239dd402782ef81c866d761db...5eda48f87840b67cbf50c13973f2f8560929face
--
View it on GitLab: https://salsa.debian.org/debian-proftpd-team/proftpd/-/compare/31e43547307ebf6239dd402782ef81c866d761db...5eda48f87840b67cbf50c13973f2f8560929face
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
More information about the Pkg-proftpd-maintainers
mailing list