7f364029b8
Joshua Rogers
2026-09-18
Subject
ftp: require TLS on the data connection for implicit FTPS
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
lib/ftp.c+13 -3
| @@ -3168,6 +3168,15 @@ static CURLcode ftp_wait_resp(struct Curl_easy *data, | |
| return result; | |
| } | |
| + | /* an implicit TLS scheme implies TLS on both connections */ |
| + | static unsigned char ftp_use_ssl(struct connectdata *conn, |
| + | struct ftp_conn *ftpc) |
| + | { |
| + | if(!ftpc->use_ssl && (conn->scheme->flags & PROTOPT_SSL)) |
| + | return CURLUSESSL_ALL; |
| + | return ftpc->use_ssl; |
| + | } |
| + | |
| static CURLcode ftp_pp_statemachine(struct Curl_easy *data, | |
| struct connectdata *conn) | |
| { | |
| @@ -3254,7 +3263,7 @@ static CURLcode ftp_pp_statemachine(struct Curl_easy *data, | |
| case FTP_PBSZ: | |
| result = | |
| Curl_pp_sendf(data, &ftpc->pp, "PROT %c", | |
| - | ftpc->use_ssl == CURLUSESSL_CONTROL ? 'C' : 'P'); |
| + | ftp_use_ssl(conn, ftpc) == CURLUSESSL_CONTROL ? 'C' : 'P'); |
| if(!result) | |
| ftp_state(data, ftpc, FTP_PROT); | |
| break; | |
| @@ -3262,10 +3271,11 @@ static CURLcode ftp_pp_statemachine(struct Curl_easy *data, | |
| case FTP_PROT: | |
| if(ftpcode / 100 == 2) | |
| /* We have enabled SSL for the data connection! */ | |
| - | conn->bits.ftp_use_data_ssl = (ftpc->use_ssl != CURLUSESSL_CONTROL); |
| + | conn->bits.ftp_use_data_ssl = |
| + | (ftp_use_ssl(conn, ftpc) != CURLUSESSL_CONTROL); |
| /* FTP servers typically responds with 500 if they decide to reject | |
| our 'P' request */ | |
| - | else if(ftpc->use_ssl > CURLUSESSL_CONTROL) |
| + | else if(ftp_use_ssl(conn, ftpc) > CURLUSESSL_CONTROL) |
| /* we failed and bails out */ | |
| return CURLE_USE_SSL_FAILED; | |
tests/data/Makefile.am+1 -0
| @@ -1734,6 +1734,7 @@ TESTCASES = \ | |
| test1725 \ | |
| test1740 \ | |
| test1741 \ | |
| + | test1790 \ |
| test1791 \ | |
| test1800 \ | |
| test1801 \ | |
tests/data/test1790+48 -0
| @@ -0,0 +1,48 @@ | |
| + | <?xml version="1.0" encoding="US-ASCII"?> |
| + | <testcase> |
| + | <info> |
| + | <keywords> |
| + | FTP |
| + | FTPS |
| + | PASV |
| + | LIST |
| + | </keywords> |
| + | </info> |
| + | |
| + | # Server-side |
| + | <reply> |
| + | <servercmd> |
| + | REPLY "PROT P" 534 Policy denies SSL |
| + | </servercmd> |
| + | </reply> |
| + | |
| + | # Client-side |
| + | <client> |
| + | <features> |
| + | SSL |
| + | </features> |
| + | <server> |
| + | ftps |
| + | </server> |
| + | <name> |
| + | FTPS with rejected PROT P |
| + | </name> |
| + | <command> |
| + | --insecure ftps://%HOSTIP:%FTPSPORT/ |
| + | </command> |
| + | </client> |
| + | |
| + | # Verify data after the test has been "shot" |
| + | <verify> |
| + | # 64 == CURLE_USE_SSL_FAILED |
| + | <errorcode> |
| + | 64 |
| + | </errorcode> |
| + | <protocol crlf="yes"> |
| + | USER anonymous |
| + | PASS [email protected] |
| + | PBSZ 0 |
| + | PROT P |
| + | </protocol> |
| + | </verify> |
| + | </testcase> |