libexec/ftpd/ftpcmd.y

   1 /*-
   2  * SPDX-License-Identifier: BSD-3-Clause
   3  *
   4  * Copyright (c) 1985, 1988, 1993, 1994
   5  *      The Regents of the University of California.  All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  * 3. Neither the name of the University nor the names of its contributors
  16  *    may be used to endorse or promote products derived from this software
  17  *    without specific prior written permission.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  29  * SUCH DAMAGE.
  30  *
  31  *      @(#)ftpcmd.y    8.3 (Berkeley) 4/6/94
  32  */
  33
  34 /*
  35  * Grammar for FTP commands.
  36  * See RFC 959.
  37  */
  38
  39 %{
  40
  41 #ifndef lint
  42 #if 0
  43 static char sccsid[] = "@(#)ftpcmd.y    8.3 (Berkeley) 4/6/94";
  44 #endif
  45 #endif /* not lint */
  46
  47 #include <sys/cdefs.h>
  48 __FBSDID("$FreeBSD$");
  49
  50 #include <sys/param.h>
  51 #include <sys/socket.h>
  52 #include <sys/stat.h>
  53
  54 #include <netinet/in.h>
  55 #include <arpa/ftp.h>
  56
  57 #include <ctype.h>
  58 #include <errno.h>
  59 #include <glob.h>
  60 #include <libutil.h>
  61 #include <limits.h>
  62 #include <md5.h>
  63 #include <netdb.h>
  64 #include <pwd.h>
  65 #include <signal.h>
  66 #include <stdint.h>
  67 #include <stdio.h>
  68 #include <stdlib.h>
  69 #include <string.h>
  70 #include <syslog.h>
  71 #include <time.h>
  72 #include <unistd.h>
  73
  74 #include "extern.h"
  75 #include "pathnames.h"
  76
  77 off_t   restart_point;
  78
  79 static  int cmd_type;
  80 static  int cmd_form;
  81 static  int cmd_bytesz;
  82 static  int state;
  83 char    cbuf[512];
  84 char    *fromname = NULL;
  85
  86 %}
  87
  88 %union {
  89         struct {
  90                 off_t   o;
  91                 int     i;
  92         } u;
  93         char   *s;
  94 }
  95
  96 %token
  97         A       B       C       E       F       I
  98         L       N       P       R       S       T
  99         ALL
 100
 101         SP      CRLF    COMMA
 102
 103         USER    PASS    ACCT    REIN    QUIT    PORT
 104         PASV    TYPE    STRU    MODE    RETR    STOR
 105         APPE    MLFL    MAIL    MSND    MSOM    MSAM
 106         MRSQ    MRCP    ALLO    REST    RNFR    RNTO
 107         ABOR    DELE    CWD     LIST    NLST    SITE
 108         STAT    HELP    NOOP    MKD     RMD     PWD
 109         CDUP    STOU    SMNT    SYST    SIZE    MDTM
 110         LPRT    LPSV    EPRT    EPSV    FEAT
 111
 112         UMASK   IDLE    CHMOD   MDFIVE
 113
 114         LEXERR  NOTIMPL
 115
 116 %token  <s> STRING
 117 %token  <u> NUMBER
 118
 119 %type   <u.i> check_login octal_number byte_size
 120 %type   <u.i> check_login_ro check_login_epsv
 121 %type   <u.i> struct_code mode_code type_code form_code
 122 %type   <s> pathstring pathname password username
 123 %type   <s> ALL NOTIMPL
 124
 125 %start  cmd_list
 126
 127 %%
 128
 129 cmd_list
 130         : /* empty */
 131         | cmd_list cmd
 132                 {
 133                         if (fromname)
 134                                 free(fromname);
 135                         fromname = NULL;
 136                         restart_point = 0;
 137                 }
 138         | cmd_list rcmd
 139         ;
 140
 141 cmd
 142         : USER SP username CRLF
 143                 {
 144                         user($3);
 145                         free($3);
 146                 }
 147         | PASS SP password CRLF
 148                 {
 149                         pass($3);
 150                         free($3);
 151                 }
 152         | PASS CRLF
 153                 {
 154                         pass("");
 155                 }
 156         | PORT check_login SP host_port CRLF
 157                 {
 158                         if (epsvall) {
 159                                 reply(501, "No PORT allowed after EPSV ALL.");
 160                                 goto port_done;
 161                         }
 162                         if (!$2)
 163                                 goto port_done;
 164                         if (port_check("PORT") == 1)
 165                                 goto port_done;
 166 #ifdef INET6
 167                         if ((his_addr.su_family != AF_INET6 ||
 168                              !IN6_IS_ADDR_V4MAPPED(&his_addr.su_sin6.sin6_addr))) {
 169                                 /* shoud never happen */
 170                                 usedefault = 1;
 171                                 reply(500, "Invalid address rejected.");
 172                                 goto port_done;
 173                         }
 174                         port_check_v6("pcmd");
 175 #endif
 176                 port_done:
 177                         ;
 178                 }
 179         | LPRT check_login SP host_long_port CRLF
 180                 {
 181                         if (epsvall) {
 182                                 reply(501, "No LPRT allowed after EPSV ALL.");
 183                                 goto lprt_done;
 184                         }
 185                         if (!$2)
 186                                 goto lprt_done;
 187                         if (port_check("LPRT") == 1)
 188                                 goto lprt_done;
 189 #ifdef INET6
 190                         if (his_addr.su_family != AF_INET6) {
 191                                 usedefault = 1;
 192                                 reply(500, "Invalid address rejected.");
 193                                 goto lprt_done;
 194                         }
 195                         if (port_check_v6("LPRT") == 1)
 196                                 goto lprt_done;
 197 #endif
 198                 lprt_done:
 199                         ;
 200                 }
 201         | EPRT check_login SP STRING CRLF
 202                 {
 203                         char delim;
 204                         char *tmp = NULL;
 205                         char *p, *q;
 206                         char *result[3];
 207                         struct addrinfo hints;
 208                         struct addrinfo *res;
 209                         int i;
 210
 211                         if (epsvall) {
 212                                 reply(501, "No EPRT allowed after EPSV ALL.");
 213                                 goto eprt_done;
 214                         }
 215                         if (!$2)
 216                                 goto eprt_done;
 217
 218                         memset(&data_dest, 0, sizeof(data_dest));
 219                         tmp = strdup($4);
 220                         if (ftpdebug)
 221                                 syslog(LOG_DEBUG, "%s", tmp);
 222                         if (!tmp) {
 223                                 fatalerror("not enough core");
 224                                 /*NOTREACHED*/
 225                         }
 226                         p = tmp;
 227                         delim = p[0];
 228                         p++;
 229                         memset(result, 0, sizeof(result));
 230                         for (i = 0; i < 3; i++) {
 231                                 q = strchr(p, delim);
 232                                 if (!q || *q != delim) {
 233                 parsefail:
 234                                         reply(500,
 235                                                 "Invalid argument, rejected.");
 236                                         if (tmp)
 237                                                 free(tmp);
 238                                         usedefault = 1;
 239                                         goto eprt_done;
 240                                 }
 241                                 *q++ = '\0';
 242                                 result[i] = p;
 243                                 if (ftpdebug)
 244                                         syslog(LOG_DEBUG, "%d: %s", i, p);
 245                                 p = q;
 246                         }
 247
 248                         /* some more sanity check */
 249                         p = result[0];
 250                         while (*p) {
 251                                 if (!isdigit(*p))
 252                                         goto parsefail;
 253                                 p++;
 254                         }
 255                         p = result[2];
 256                         while (*p) {
 257                                 if (!isdigit(*p))
 258                                         goto parsefail;
 259                                 p++;
 260                         }
 261
 262                         /* grab address */
 263                         memset(&hints, 0, sizeof(hints));
 264                         if (atoi(result[0]) == 1)
 265                                 hints.ai_family = PF_INET;
 266 #ifdef INET6
 267                         else if (atoi(result[0]) == 2)
 268                                 hints.ai_family = PF_INET6;
 269 #endif
 270                         else
 271                                 hints.ai_family = PF_UNSPEC;    /*XXX*/
 272                         hints.ai_socktype = SOCK_STREAM;
 273                         i = getaddrinfo(result[1], result[2], &hints, &res);
 274                         if (i)
 275                                 goto parsefail;
 276                         memcpy(&data_dest, res->ai_addr, res->ai_addrlen);
 277 #ifdef INET6
 278                         if (his_addr.su_family == AF_INET6
 279                             && data_dest.su_family == AF_INET6) {
 280                                 /* XXX more sanity checks! */
 281                                 data_dest.su_sin6.sin6_scope_id =
 282                                         his_addr.su_sin6.sin6_scope_id;
 283                         }
 284 #endif
 285                         free(tmp);
 286                         tmp = NULL;
 287
 288                         if (port_check("EPRT") == 1)
 289                                 goto eprt_done;
 290 #ifdef INET6
 291                         if (his_addr.su_family != AF_INET6) {
 292                                 usedefault = 1;
 293                                 reply(500, "Invalid address rejected.");
 294                                 goto eprt_done;
 295                         }
 296                         if (port_check_v6("EPRT") == 1)
 297                                 goto eprt_done;
 298 #endif
 299                 eprt_done:
 300                         free($4);
 301                 }
 302         | PASV check_login CRLF
 303                 {
 304                         if (epsvall)
 305                                 reply(501, "No PASV allowed after EPSV ALL.");
 306                         else if ($2)
 307                                 passive();
 308                 }
 309         | LPSV check_login CRLF
 310                 {
 311                         if (epsvall)
 312                                 reply(501, "No LPSV allowed after EPSV ALL.");
 313                         else if ($2)
 314                                 long_passive("LPSV", PF_UNSPEC);
 315                 }
 316         | EPSV check_login_epsv SP NUMBER CRLF
 317                 {
 318                         if ($2) {
 319                                 int pf;
 320                                 switch ($4.i) {
 321                                 case 1:
 322                                         pf = PF_INET;
 323                                         break;
 324 #ifdef INET6
 325                                 case 2:
 326                                         pf = PF_INET6;
 327                                         break;
 328 #endif
 329                                 default:
 330                                         pf = -1;        /*junk value*/
 331                                         break;
 332                                 }
 333                                 long_passive("EPSV", pf);
 334                         }
 335                 }
 336         | EPSV check_login_epsv SP ALL CRLF
 337                 {
 338                         if ($2) {
 339                                 reply(200, "EPSV ALL command successful.");
 340                                 epsvall++;
 341                         }
 342                 }
 343         | EPSV check_login_epsv CRLF
 344                 {
 345                         if ($2)
 346                                 long_passive("EPSV", PF_UNSPEC);
 347                 }
 348         | TYPE check_login SP type_code CRLF
 349                 {
 350                         if ($2) {
 351                                 switch (cmd_type) {
 352
 353                                 case TYPE_A:
 354                                         if (cmd_form == FORM_N) {
 355                                                 reply(200, "Type set to A.");
 356                                                 type = cmd_type;
 357                                                 form = cmd_form;
 358                                         } else
 359                                                 reply(504, "Form must be N.");
 360                                         break;
 361
 362                                 case TYPE_E:
 363                                         reply(504, "Type E not implemented.");
 364                                         break;
 365
 366                                 case TYPE_I:
 367                                         reply(200, "Type set to I.");
 368                                         type = cmd_type;
 369                                         break;
 370
 371                                 case TYPE_L:
 372 #if CHAR_BIT == 8
 373                                         if (cmd_bytesz == 8) {
 374                                                 reply(200,
 375                                                     "Type set to L (byte size 8).");
 376                                                 type = cmd_type;
 377                                         } else
 378                                                 reply(504, "Byte size must be 8.");
 379 #else /* CHAR_BIT == 8 */
 380                                         UNIMPLEMENTED for CHAR_BIT != 8
 381 #endif /* CHAR_BIT == 8 */
 382                                 }
 383                         }
 384                 }
 385         | STRU check_login SP struct_code CRLF
 386                 {
 387                         if ($2) {
 388                                 switch ($4) {
 389
 390                                 case STRU_F:
 391                                         reply(200, "STRU F accepted.");
 392                                         break;
 393
 394                                 default:
 395                                         reply(504, "Unimplemented STRU type.");
 396                                 }
 397                         }
 398                 }
 399         | MODE check_login SP mode_code CRLF
 400                 {
 401                         if ($2) {
 402                                 switch ($4) {
 403
 404                                 case MODE_S:
 405                                         reply(200, "MODE S accepted.");
 406                                         break;
 407
 408                                 default:
 409                                         reply(502, "Unimplemented MODE type.");
 410                                 }
 411                         }
 412                 }
 413         | ALLO check_login SP NUMBER CRLF
 414                 {
 415                         if ($2) {
 416                                 reply(202, "ALLO command ignored.");
 417                         }
 418                 }
 419         | ALLO check_login SP NUMBER SP R SP NUMBER CRLF
 420                 {
 421                         if ($2) {
 422                                 reply(202, "ALLO command ignored.");
 423                         }
 424                 }
 425         | RETR check_login SP pathname CRLF
 426                 {
 427                         if (noretr || (guest && noguestretr))
 428                                 reply(500, "RETR command disabled.");
 429                         else if ($2 && $4 != NULL)
 430                                 retrieve(NULL, $4);
 431
 432                         if ($4 != NULL)
 433                                 free($4);
 434                 }
 435         | STOR check_login_ro SP pathname CRLF
 436                 {
 437                         if ($2 && $4 != NULL)
 438                                 store($4, "w", 0);
 439                         if ($4 != NULL)
 440                                 free($4);
 441                 }
 442         | APPE check_login_ro SP pathname CRLF
 443                 {
 444                         if ($2 && $4 != NULL)
 445                                 store($4, "a", 0);
 446                         if ($4 != NULL)
 447                                 free($4);
 448                 }
 449         | NLST check_login CRLF
 450                 {
 451                         if ($2)
 452                                 send_file_list(".");
 453                 }
 454         | NLST check_login SP pathstring CRLF
 455                 {
 456                         if ($2)
 457                                 send_file_list($4);
 458                         free($4);
 459                 }
 460         | LIST check_login CRLF
 461                 {
 462                         if ($2)
 463                                 retrieve(_PATH_LS " -lgA", "");
 464                 }
 465         | LIST check_login SP pathstring CRLF
 466                 {
 467                         if ($2)
 468                                 retrieve(_PATH_LS " -lgA %s", $4);
 469                         free($4);
 470                 }
 471         | STAT check_login SP pathname CRLF
 472                 {
 473                         if ($2 && $4 != NULL)
 474                                 statfilecmd($4);
 475                         if ($4 != NULL)
 476                                 free($4);
 477                 }
 478         | STAT check_login CRLF
 479                 {
 480                         if ($2) {
 481                                 statcmd();
 482                         }
 483                 }
 484         | DELE check_login_ro SP pathname CRLF
 485                 {
 486                         if ($2 && $4 != NULL)
 487                                 delete($4);
 488                         if ($4 != NULL)
 489                                 free($4);
 490                 }
 491         | RNTO check_login_ro SP pathname CRLF
 492                 {
 493                         if ($2 && $4 != NULL) {
 494                                 if (fromname) {
 495                                         renamecmd(fromname, $4);
 496                                         free(fromname);
 497                                         fromname = NULL;
 498                                 } else {
 499                                         reply(503, "Bad sequence of commands.");
 500                                 }
 501                         }
 502                         if ($4 != NULL)
 503                                 free($4);
 504                 }
 505         | ABOR check_login CRLF
 506                 {
 507                         if ($2)
 508                                 reply(225, "ABOR command successful.");
 509                 }
 510         | CWD check_login CRLF
 511                 {
 512                         if ($2) {
 513                                 cwd(homedir);
 514                         }
 515                 }
 516         | CWD check_login SP pathname CRLF
 517                 {
 518                         if ($2 && $4 != NULL)
 519                                 cwd($4);
 520                         if ($4 != NULL)
 521                                 free($4);
 522                 }
 523         | HELP CRLF
 524                 {
 525                         help(cmdtab, NULL);
 526                 }
 527         | HELP SP STRING CRLF
 528                 {
 529                         char *cp = $3;
 530
 531                         if (strncasecmp(cp, "SITE", 4) == 0) {
 532                                 cp = $3 + 4;
 533                                 if (*cp == ' ')
 534                                         cp++;
 535                                 if (*cp)
 536                                         help(sitetab, cp);
 537                                 else
 538                                         help(sitetab, NULL);
 539                         } else
 540                                 help(cmdtab, $3);
 541                         free($3);
 542                 }
 543         | NOOP CRLF
 544                 {
 545                         reply(200, "NOOP command successful.");
 546                 }
 547         | MKD check_login_ro SP pathname CRLF
 548                 {
 549                         if ($2 && $4 != NULL)
 550                                 makedir($4);
 551                         if ($4 != NULL)
 552                                 free($4);
 553                 }
 554         | RMD check_login_ro SP pathname CRLF
 555                 {
 556                         if ($2 && $4 != NULL)
 557                                 removedir($4);
 558                         if ($4 != NULL)
 559                                 free($4);
 560                 }
 561         | PWD check_login CRLF
 562                 {
 563                         if ($2)
 564                                 pwd();
 565                 }
 566         | CDUP check_login CRLF
 567                 {
 568                         if ($2)
 569                                 cwd("..");
 570                 }
 571         | SITE SP HELP CRLF
 572                 {
 573                         help(sitetab, NULL);
 574                 }
 575         | SITE SP HELP SP STRING CRLF
 576                 {
 577                         help(sitetab, $5);
 578                         free($5);
 579                 }
 580         | SITE SP MDFIVE check_login SP pathname CRLF
 581                 {
 582                         char p[64], *q;
 583
 584                         if ($4 && $6) {
 585                                 q = MD5File($6, p);
 586                                 if (q != NULL)
 587                                         reply(200, "MD5(%s) = %s", $6, p);
 588                                 else
 589                                         perror_reply(550, $6);
 590                         }
 591                         if ($6)
 592                                 free($6);
 593                 }
 594         | SITE SP UMASK check_login CRLF
 595                 {
 596                         int oldmask;
 597
 598                         if ($4) {
 599                                 oldmask = umask(0);
 600                                 (void) umask(oldmask);
 601                                 reply(200, "Current UMASK is %03o.", oldmask);
 602                         }
 603                 }
 604         | SITE SP UMASK check_login SP octal_number CRLF
 605                 {
 606                         int oldmask;
 607
 608                         if ($4) {
 609                                 if (($6 == -1) || ($6 > 0777)) {
 610                                         reply(501, "Bad UMASK value.");
 611                                 } else {
 612                                         oldmask = umask($6);
 613                                         reply(200,
 614                                             "UMASK set to %03o (was %03o).",
 615                                             $6, oldmask);
 616                                 }
 617                         }
 618                 }
 619         | SITE SP CHMOD check_login_ro SP octal_number SP pathname CRLF
 620                 {
 621                         if ($4 && ($8 != NULL)) {
 622                                 if (($6 == -1 ) || ($6 > 0777))
 623                                         reply(501, "Bad mode value.");
 624                                 else if (chmod($8, $6) < 0)
 625                                         perror_reply(550, $8);
 626                                 else
 627                                         reply(200, "CHMOD command successful.");
 628                         }
 629                         if ($8 != NULL)
 630                                 free($8);
 631                 }
 632         | SITE SP check_login IDLE CRLF
 633                 {
 634                         if ($3)
 635                                 reply(200,
 636                                     "Current IDLE time limit is %d seconds; max %d.",
 637                                     timeout, maxtimeout);
 638                 }
 639         | SITE SP check_login IDLE SP NUMBER CRLF
 640                 {
 641                         if ($3) {
 642                                 if ($6.i < 30 || $6.i > maxtimeout) {
 643                                         reply(501,
 644                                             "Maximum IDLE time must be between 30 and %d seconds.",
 645                                             maxtimeout);
 646                                 } else {
 647                                         timeout = $6.i;
 648                                         (void) alarm(timeout);
 649                                         reply(200,
 650                                             "Maximum IDLE time set to %d seconds.",
 651                                             timeout);
 652                                 }
 653                         }
 654                 }
 655         | STOU check_login_ro SP pathname CRLF
 656                 {
 657                         if ($2 && $4 != NULL)
 658                                 store($4, "w", 1);
 659                         if ($4 != NULL)
 660                                 free($4);
 661                 }
 662         | FEAT CRLF
 663                 {
 664                         lreply(211, "Extensions supported:");
 665 #if 0
 666                         /* XXX these two keywords are non-standard */
 667                         printf(" EPRT\r\n");
 668                         if (!noepsv)
 669                                 printf(" EPSV\r\n");
 670 #endif
 671                         printf(" MDTM\r\n");
 672                         printf(" REST STREAM\r\n");
 673                         printf(" SIZE\r\n");
 674                         if (assumeutf8) {
 675                                 /* TVFS requires UTF8, see RFC 3659 */
 676                                 printf(" TVFS\r\n");
 677                                 printf(" UTF8\r\n");
 678                         }
 679                         reply(211, "End.");
 680                 }
 681         | SYST check_login CRLF
 682                 {
 683                         if ($2) {
 684                                 if (hostinfo)
 685 #ifdef BSD
 686                                         reply(215, "UNIX Type: L%d Version: BSD-%d",
 687                                               CHAR_BIT, BSD);
 688 #else /* BSD */
 689                                         reply(215, "UNIX Type: L%d", CHAR_BIT);
 690 #endif /* BSD */
 691                                 else
 692                                         reply(215, "UNKNOWN Type: L%d", CHAR_BIT);
 693                         }
 694                 }
 695
 696                 /*
 697                  * SIZE is not in RFC959, but Postel has blessed it and
 698                  * it will be in the updated RFC.
 699                  *
 700                  * Return size of file in a format suitable for
 701                  * using with RESTART (we just count bytes).
 702                  */
 703         | SIZE check_login SP pathname CRLF
 704                 {
 705                         if ($2 && $4 != NULL)
 706                                 sizecmd($4);
 707                         if ($4 != NULL)
 708                                 free($4);
 709                 }
 710
 711                 /*
 712                  * MDTM is not in RFC959, but Postel has blessed it and
 713                  * it will be in the updated RFC.
 714                  *
 715                  * Return modification time of file as an ISO 3307
 716                  * style time. E.g. YYYYMMDDHHMMSS or YYYYMMDDHHMMSS.xxx
 717                  * where xxx is the fractional second (of any precision,
 718                  * not necessarily 3 digits)
 719                  */
 720         | MDTM check_login SP pathname CRLF
 721                 {
 722                         if ($2 && $4 != NULL) {
 723                                 struct stat stbuf;
 724                                 if (stat($4, &stbuf) < 0)
 725                                         perror_reply(550, $4);
 726                                 else if (!S_ISREG(stbuf.st_mode)) {
 727                                         reply(550, "%s: not a plain file.", $4);
 728                                 } else {
 729                                         struct tm *t;
 730                                         t = gmtime(&stbuf.st_mtime);
 731                                         reply(213,
 732                                             "%04d%02d%02d%02d%02d%02d",
 733                                             1900 + t->tm_year,
 734                                             t->tm_mon+1, t->tm_mday,
 735                                             t->tm_hour, t->tm_min, t->tm_sec);
 736                                 }
 737                         }
 738                         if ($4 != NULL)
 739                                 free($4);
 740                 }
 741         | QUIT CRLF
 742                 {
 743                         reply(221, "Goodbye.");
 744                         dologout(0);
 745                 }
 746         | NOTIMPL
 747                 {
 748                         nack($1);
 749                 }
 750         | error
 751                 {
 752                         yyclearin;              /* discard lookahead data */
 753                         yyerrok;                /* clear error condition */
 754                         state = CMD;            /* reset lexer state */
 755                 }
 756         ;
 757 rcmd
 758         : RNFR check_login_ro SP pathname CRLF
 759                 {
 760                         restart_point = 0;
 761                         if ($2 && $4) {
 762                                 if (fromname)
 763                                         free(fromname);
 764                                 fromname = NULL;
 765                                 if (renamefrom($4))
 766                                         fromname = $4;
 767                                 else
 768                                         free($4);
 769                         } else if ($4) {
 770                                 free($4);
 771                         }
 772                 }
 773         | REST check_login SP NUMBER CRLF
 774                 {
 775                         if ($2) {
 776                                 if (fromname)
 777                                         free(fromname);
 778                                 fromname = NULL;
 779                                 restart_point = $4.o;
 780                                 reply(350, "Restarting at %jd. %s",
 781                                     (intmax_t)restart_point,
 782                                     "Send STORE or RETRIEVE to initiate transfer.");
 783                         }
 784                 }
 785         ;
 786
 787 username
 788         : STRING
 789         ;
 790
 791 password
 792         : /* empty */
 793                 {
 794                         $$ = (char *)calloc(1, sizeof(char));
 795                 }
 796         | STRING
 797         ;
 798
 799 byte_size
 800         : NUMBER
 801                 {
 802                         $$ = $1.i;
 803                 }
 804         ;
 805
 806 host_port
 807         : NUMBER COMMA NUMBER COMMA NUMBER COMMA NUMBER COMMA
 808                 NUMBER COMMA NUMBER
 809                 {
 810                         char *a, *p;
 811
 812                         data_dest.su_len = sizeof(struct sockaddr_in);
 813                         data_dest.su_family = AF_INET;
 814                         p = (char *)&data_dest.su_sin.sin_port;
 815                         p[0] = $9.i; p[1] = $11.i;
 816                         a = (char *)&data_dest.su_sin.sin_addr;
 817                         a[0] = $1.i; a[1] = $3.i; a[2] = $5.i; a[3] = $7.i;
 818                 }
 819         ;
 820
 821 host_long_port
 822         : NUMBER COMMA NUMBER COMMA NUMBER COMMA NUMBER COMMA
 823                 NUMBER COMMA NUMBER COMMA NUMBER COMMA NUMBER COMMA
 824                 NUMBER COMMA NUMBER COMMA NUMBER COMMA NUMBER COMMA
 825                 NUMBER COMMA NUMBER COMMA NUMBER COMMA NUMBER COMMA
 826                 NUMBER COMMA NUMBER COMMA NUMBER COMMA NUMBER COMMA
 827                 NUMBER
 828                 {
 829                         char *a, *p;
 830
 831                         memset(&data_dest, 0, sizeof(data_dest));
 832                         data_dest.su_len = sizeof(struct sockaddr_in6);
 833                         data_dest.su_family = AF_INET6;
 834                         p = (char *)&data_dest.su_port;
 835                         p[0] = $39.i; p[1] = $41.i;
 836                         a = (char *)&data_dest.su_sin6.sin6_addr;
 837                         a[0] = $5.i; a[1] = $7.i; a[2] = $9.i; a[3] = $11.i;
 838                         a[4] = $13.i; a[5] = $15.i; a[6] = $17.i; a[7] = $19.i;
 839                         a[8] = $21.i; a[9] = $23.i; a[10] = $25.i; a[11] = $27.i;
 840                         a[12] = $29.i; a[13] = $31.i; a[14] = $33.i; a[15] = $35.i;
 841                         if (his_addr.su_family == AF_INET6) {
 842                                 /* XXX more sanity checks! */
 843                                 data_dest.su_sin6.sin6_scope_id =
 844                                         his_addr.su_sin6.sin6_scope_id;
 845                         }
 846                         if ($1.i != 6 || $3.i != 16 || $37.i != 2)
 847                                 memset(&data_dest, 0, sizeof(data_dest));
 848                 }
 849         | NUMBER COMMA NUMBER COMMA NUMBER COMMA NUMBER COMMA
 850                 NUMBER COMMA NUMBER COMMA NUMBER COMMA NUMBER COMMA
 851                 NUMBER
 852                 {
 853                         char *a, *p;
 854
 855                         memset(&data_dest, 0, sizeof(data_dest));
 856                         data_dest.su_sin.sin_len = sizeof(struct sockaddr_in);
 857                         data_dest.su_family = AF_INET;
 858                         p = (char *)&data_dest.su_port;
 859                         p[0] = $15.i; p[1] = $17.i;
 860                         a = (char *)&data_dest.su_sin.sin_addr;
 861                         a[0] =  $5.i; a[1] = $7.i; a[2] = $9.i; a[3] = $11.i;
 862                         if ($1.i != 4 || $3.i != 4 || $13.i != 2)
 863                                 memset(&data_dest, 0, sizeof(data_dest));
 864                 }
 865         ;
 866
 867 form_code
 868         : N
 869                 {
 870                         $$ = FORM_N;
 871                 }
 872         | T
 873                 {
 874                         $$ = FORM_T;
 875                 }
 876         | C
 877                 {
 878                         $$ = FORM_C;
 879                 }
 880         ;
 881
 882 type_code
 883         : A
 884                 {
 885                         cmd_type = TYPE_A;
 886                         cmd_form = FORM_N;
 887                 }
 888         | A SP form_code
 889                 {
 890                         cmd_type = TYPE_A;
 891                         cmd_form = $3;
 892                 }
 893         | E
 894                 {
 895                         cmd_type = TYPE_E;
 896                         cmd_form = FORM_N;
 897                 }
 898         | E SP form_code
 899                 {
 900                         cmd_type = TYPE_E;
 901                         cmd_form = $3;
 902                 }
 903         | I
 904                 {
 905                         cmd_type = TYPE_I;
 906                 }
 907         | L
 908                 {
 909                         cmd_type = TYPE_L;
 910                         cmd_bytesz = CHAR_BIT;
 911                 }
 912         | L SP byte_size
 913                 {
 914                         cmd_type = TYPE_L;
 915                         cmd_bytesz = $3;
 916                 }
 917                 /* this is for a bug in the BBN ftp */
 918         | L byte_size
 919                 {
 920                         cmd_type = TYPE_L;
 921                         cmd_bytesz = $2;
 922                 }
 923         ;
 924
 925 struct_code
 926         : F
 927                 {
 928                         $$ = STRU_F;
 929                 }
 930         | R
 931                 {
 932                         $$ = STRU_R;
 933                 }
 934         | P
 935                 {
 936                         $$ = STRU_P;
 937                 }
 938         ;
 939
 940 mode_code
 941         : S
 942                 {
 943                         $$ = MODE_S;
 944                 }
 945         | B
 946                 {
 947                         $$ = MODE_B;
 948                 }
 949         | C
 950                 {
 951                         $$ = MODE_C;
 952                 }
 953         ;
 954
 955 pathname
 956         : pathstring
 957                 {
 958                         if (logged_in && $1) {
 959                                 char *p;
 960
 961                                 /*
 962                                  * Expand ~user manually since glob(3)
 963                                  * will return the unexpanded pathname
 964                                  * if the corresponding file/directory
 965                                  * doesn't exist yet.  Using sole glob(3)
 966                                  * would break natural commands like
 967                                  * MKD ~user/newdir
 968                                  * or
 969                                  * RNTO ~/newfile
 970                                  */
 971                                 if ((p = exptilde($1)) != NULL) {
 972                                         $$ = expglob(p);
 973                                         free(p);
 974                                 } else
 975                                         $$ = NULL;
 976                                 free($1);
 977                         } else
 978                                 $$ = $1;
 979                 }
 980         ;
 981
 982 pathstring
 983         : STRING
 984         ;
 985
 986 octal_number
 987         : NUMBER
 988                 {
 989                         int ret, dec, multby, digit;
 990
 991                         /*
 992                          * Convert a number that was read as decimal number
 993                          * to what it would be if it had been read as octal.
 994                          */
 995                         dec = $1.i;
 996                         multby = 1;
 997                         ret = 0;
 998                         while (dec) {
 999                                 digit = dec%10;
1000                                 if (digit > 7) {
1001                                         ret = -1;
1002                                         break;
1003                                 }
1004                                 ret += digit * multby;
1005                                 multby *= 8;
1006                                 dec /= 10;
1007                         }
1008                         $$ = ret;
1009                 }
1010         ;
1011
1012
1013 check_login
1014         : /* empty */
1015                 {
1016                 $$ = check_login1();
1017                 }
1018         ;
1019
1020 check_login_epsv
1021         : /* empty */
1022                 {
1023                 if (noepsv) {
1024                         reply(500, "EPSV command disabled.");
1025                         $$ = 0;
1026                 }
1027                 else
1028                         $$ = check_login1();
1029                 }
1030         ;
1031
1032 check_login_ro
1033         : /* empty */
1034                 {
1035                 if (readonly) {
1036                         reply(550, "Permission denied.");
1037                         $$ = 0;
1038                 }
1039                 else
1040                         $$ = check_login1();
1041                 }
1042         ;
1043
1044 %%
1045
1046 #define CMD     0       /* beginning of command */
1047 #define ARGS    1       /* expect miscellaneous arguments */
1048 #define STR1    2       /* expect SP followed by STRING */
1049 #define STR2    3       /* expect STRING */
1050 #define OSTR    4       /* optional SP then STRING */
1051 #define ZSTR1   5       /* optional SP then optional STRING */
1052 #define ZSTR2   6       /* optional STRING after SP */
1053 #define SITECMD 7       /* SITE command */
1054 #define NSTR    8       /* Number followed by a string */
1055
1056 #define MAXGLOBARGS     1000
1057
1058 #define MAXASIZE        10240   /* Deny ASCII SIZE on files larger than that */
1059
1060 struct tab {
1061         char    *name;
1062         short   token;
1063         short   state;
1064         short   implemented;    /* 1 if command is implemented */
1065         char    *help;
1066 };
1067
1068 struct tab cmdtab[] = {         /* In order defined in RFC 765 */
1069         { "USER", USER, STR1, 1,        "<sp> username" },
1070         { "PASS", PASS, ZSTR1, 1,       "[<sp> [password]]" },
1071         { "ACCT", ACCT, STR1, 0,        "(specify account)" },
1072         { "SMNT", SMNT, ARGS, 0,        "(structure mount)" },
1073         { "REIN", REIN, ARGS, 0,        "(reinitialize server state)" },
1074         { "QUIT", QUIT, ARGS, 1,        "(terminate service)", },
1075         { "PORT", PORT, ARGS, 1,        "<sp> b0, b1, b2, b3, b4, b5" },
1076         { "LPRT", LPRT, ARGS, 1,        "<sp> af, hal, h1, h2, h3,..., pal, p1, p2..." },
1077         { "EPRT", EPRT, STR1, 1,        "<sp> |af|addr|port|" },
1078         { "PASV", PASV, ARGS, 1,        "(set server in passive mode)" },
1079         { "LPSV", LPSV, ARGS, 1,        "(set server in passive mode)" },
1080         { "EPSV", EPSV, ARGS, 1,        "[<sp> af|ALL]" },
1081         { "TYPE", TYPE, ARGS, 1,        "<sp> { A | E | I | L }" },
1082         { "STRU", STRU, ARGS, 1,        "(specify file structure)" },
1083         { "MODE", MODE, ARGS, 1,        "(specify transfer mode)" },
1084         { "RETR", RETR, STR1, 1,        "<sp> file-name" },
1085         { "STOR", STOR, STR1, 1,        "<sp> file-name" },
1086         { "APPE", APPE, STR1, 1,        "<sp> file-name" },
1087         { "MLFL", MLFL, OSTR, 0,        "(mail file)" },
1088         { "MAIL", MAIL, OSTR, 0,        "(mail to user)" },
1089         { "MSND", MSND, OSTR, 0,        "(mail send to terminal)" },
1090         { "MSOM", MSOM, OSTR, 0,        "(mail send to terminal or mailbox)" },
1091         { "MSAM", MSAM, OSTR, 0,        "(mail send to terminal and mailbox)" },
1092         { "MRSQ", MRSQ, OSTR, 0,        "(mail recipient scheme question)" },
1093         { "MRCP", MRCP, STR1, 0,        "(mail recipient)" },
1094         { "ALLO", ALLO, ARGS, 1,        "allocate storage (vacuously)" },
1095         { "REST", REST, ARGS, 1,        "<sp> offset (restart command)" },
1096         { "RNFR", RNFR, STR1, 1,        "<sp> file-name" },
1097         { "RNTO", RNTO, STR1, 1,        "<sp> file-name" },
1098         { "ABOR", ABOR, ARGS, 1,        "(abort operation)" },
1099         { "DELE", DELE, STR1, 1,        "<sp> file-name" },
1100         { "CWD",  CWD,  OSTR, 1,        "[ <sp> directory-name ]" },
1101         { "XCWD", CWD,  OSTR, 1,        "[ <sp> directory-name ]" },
1102         { "LIST", LIST, OSTR, 1,        "[ <sp> path-name ]" },
1103         { "NLST", NLST, OSTR, 1,        "[ <sp> path-name ]" },
1104         { "SITE", SITE, SITECMD, 1,     "site-cmd [ <sp> arguments ]" },
1105         { "SYST", SYST, ARGS, 1,        "(get type of operating system)" },
1106         { "FEAT", FEAT, ARGS, 1,        "(get extended features)" },
1107         { "STAT", STAT, OSTR, 1,        "[ <sp> path-name ]" },
1108         { "HELP", HELP, OSTR, 1,        "[ <sp> <string> ]" },
1109         { "NOOP", NOOP, ARGS, 1,        "" },
1110         { "MKD",  MKD,  STR1, 1,        "<sp> path-name" },
1111         { "XMKD", MKD,  STR1, 1,        "<sp> path-name" },
1112         { "RMD",  RMD,  STR1, 1,        "<sp> path-name" },
1113         { "XRMD", RMD,  STR1, 1,        "<sp> path-name" },
1114         { "PWD",  PWD,  ARGS, 1,        "(return current directory)" },
1115         { "XPWD", PWD,  ARGS, 1,        "(return current directory)" },
1116         { "CDUP", CDUP, ARGS, 1,        "(change to parent directory)" },
1117         { "XCUP", CDUP, ARGS, 1,        "(change to parent directory)" },
1118         { "STOU", STOU, STR1, 1,        "<sp> file-name" },
1119         { "SIZE", SIZE, OSTR, 1,        "<sp> path-name" },
1120         { "MDTM", MDTM, OSTR, 1,        "<sp> path-name" },
1121         { NULL,   0,    0,    0,        0 }
1122 };
1123
1124 struct tab sitetab[] = {
1125         { "MD5", MDFIVE, STR1, 1,       "[ <sp> file-name ]" },
1126         { "UMASK", UMASK, ARGS, 1,      "[ <sp> umask ]" },
1127         { "IDLE", IDLE, ARGS, 1,        "[ <sp> maximum-idle-time ]" },
1128         { "CHMOD", CHMOD, NSTR, 1,      "<sp> mode <sp> file-name" },
1129         { "HELP", HELP, OSTR, 1,        "[ <sp> <string> ]" },
1130         { NULL,   0,    0,    0,        0 }
1131 };
1132
1133 static char     *copy(char *);
1134 static char     *expglob(char *);
1135 static char     *exptilde(char *);
1136 static void      help(struct tab *, char *);
1137 static struct tab *
1138                  lookup(struct tab *, char *);
1139 static int       port_check(const char *);
1140 #ifdef INET6
1141 static int       port_check_v6(const char *);
1142 #endif
1143 static void      sizecmd(char *);
1144 static void      toolong(int);
1145 #ifdef INET6
1146 static void      v4map_data_dest(void);
1147 #endif
1148 static int       yylex(void);
1149
1150 static struct tab *
1151 lookup(struct tab *p, char *cmd)
1152 {
1153
1154         for (; p->name != NULL; p++)
1155                 if (strcmp(cmd, p->name) == 0)
1156                         return (p);
1157         return (0);
1158 }
1159
1160 #include <arpa/telnet.h>
1161
1162 /*
1163  * get_line - a hacked up version of fgets to ignore TELNET escape codes.
1164  */
1165 int
1166 get_line(char *s, int n, FILE *iop)
1167 {
1168         int c;
1169         register char *cs;
1170         sigset_t sset, osset;
1171
1172         cs = s;
1173 /* tmpline may contain saved command from urgent mode interruption */
1174         for (c = 0; tmpline[c] != '\0' && --n > 0; ++c) {
1175                 *cs++ = tmpline[c];
1176                 if (tmpline[c] == '\n') {
1177                         *cs++ = '\0';
1178                         if (ftpdebug)
1179                                 syslog(LOG_DEBUG, "command: %s", s);
1180                         tmpline[0] = '\0';
1181                         return(0);
1182                 }
1183                 if (c == 0)
1184                         tmpline[0] = '\0';
1185         }
1186         /* SIGURG would interrupt stdio if not blocked during the read loop */
1187         sigemptyset(&sset);
1188         sigaddset(&sset, SIGURG);
1189         sigprocmask(SIG_BLOCK, &sset, &osset);
1190         while ((c = getc(iop)) != EOF) {
1191                 c &= 0377;
1192                 if (c == IAC) {
1193                         if ((c = getc(iop)) == EOF)
1194                                 goto got_eof;
1195                         c &= 0377;
1196                         switch (c) {
1197                         case WILL:
1198                         case WONT:
1199                                 if ((c = getc(iop)) == EOF)
1200                                         goto got_eof;
1201                                 printf("%c%c%c", IAC, DONT, 0377&c);
1202                                 (void) fflush(stdout);
1203                                 continue;
1204                         case DO:
1205                         case DONT:
1206                                 if ((c = getc(iop)) == EOF)
1207                                         goto got_eof;
1208                                 printf("%c%c%c", IAC, WONT, 0377&c);
1209                                 (void) fflush(stdout);
1210                                 continue;
1211                         case IAC:
1212                                 break;
1213                         default:
1214                                 continue;       /* ignore command */
1215                         }
1216                 }
1217                 *cs++ = c;
1218                 if (--n <= 0) {
1219                         /*
1220                          * If command doesn't fit into buffer, discard the
1221                          * rest of the command and indicate truncation.
1222                          * This prevents the command to be split up into
1223                          * multiple commands.
1224                          */
1225                         while (c != '\n' && (c = getc(iop)) != EOF)
1226                                 ;
1227                         return (-2);
1228                 }
1229                 if (c == '\n')
1230                         break;
1231         }
1232 got_eof:
1233         sigprocmask(SIG_SETMASK, &osset, NULL);
1234         if (c == EOF && cs == s)
1235                 return (-1);
1236         *cs++ = '\0';
1237         if (ftpdebug) {
1238                 if (!guest && strncasecmp("pass ", s, 5) == 0) {
1239                         /* Don't syslog passwords */
1240                         syslog(LOG_DEBUG, "command: %.5s ???", s);
1241                 } else {
1242                         register char *cp;
1243                         register int len;
1244
1245                         /* Don't syslog trailing CR-LF */
1246                         len = strlen(s);
1247                         cp = s + len - 1;
1248                         while (cp >= s && (*cp == '\n' || *cp == '\r')) {
1249                                 --cp;
1250                                 --len;
1251                         }
1252                         syslog(LOG_DEBUG, "command: %.*s", len, s);
1253                 }
1254         }
1255         return (0);
1256 }
1257
1258 static void
1259 toolong(int signo)
1260 {
1261
1262         reply(421,
1263             "Timeout (%d seconds): closing control connection.", timeout);
1264         if (logging)
1265                 syslog(LOG_INFO, "User %s timed out after %d seconds",
1266                     (pw ? pw -> pw_name : "unknown"), timeout);
1267         dologout(1);
1268 }
1269
1270 static int
1271 yylex(void)
1272 {
1273         static int cpos;
1274         char *cp, *cp2;
1275         struct tab *p;
1276         int n;
1277         char c;
1278
1279         for (;;) {
1280                 switch (state) {
1281
1282                 case CMD:
1283                         (void) signal(SIGALRM, toolong);
1284                         (void) alarm(timeout);
1285                         n = get_line(cbuf, sizeof(cbuf)-1, stdin);
1286                         if (n == -1) {
1287                                 reply(221, "You could at least say goodbye.");
1288                                 dologout(0);
1289                         } else if (n == -2) {
1290                                 reply(500, "Command too long.");
1291                                 (void) alarm(0);
1292                                 continue;
1293                         }
1294                         (void) alarm(0);
1295 #ifdef SETPROCTITLE
1296                         if (strncasecmp(cbuf, "PASS", 4) != 0)
1297                                 setproctitle("%s: %s", proctitle, cbuf);
1298 #endif /* SETPROCTITLE */
1299                         if ((cp = strchr(cbuf, '\r'))) {
1300                                 *cp++ = '\n';
1301                                 *cp = '\0';
1302                         }
1303                         if ((cp = strpbrk(cbuf, " \n")))
1304                                 cpos = cp - cbuf;
1305                         if (cpos == 0)
1306                                 cpos = 4;
1307                         c = cbuf[cpos];
1308                         cbuf[cpos] = '\0';
1309                         upper(cbuf);
1310                         p = lookup(cmdtab, cbuf);
1311                         cbuf[cpos] = c;
1312                         if (p != 0) {
1313                                 yylval.s = p->name;
1314                                 if (!p->implemented)
1315                                         return (NOTIMPL); /* state remains CMD */
1316                                 state = p->state;
1317                                 return (p->token);
1318                         }
1319                         break;
1320
1321                 case SITECMD:
1322                         if (cbuf[cpos] == ' ') {
1323                                 cpos++;
1324                                 return (SP);
1325                         }
1326                         cp = &cbuf[cpos];
1327                         if ((cp2 = strpbrk(cp, " \n")))
1328                                 cpos = cp2 - cbuf;
1329                         c = cbuf[cpos];
1330                         cbuf[cpos] = '\0';
1331                         upper(cp);
1332                         p = lookup(sitetab, cp);
1333                         cbuf[cpos] = c;
1334                         if (guest == 0 && p != 0) {
1335                                 yylval.s = p->name;
1336                                 if (!p->implemented) {
1337                                         state = CMD;
1338                                         return (NOTIMPL);
1339                                 }
1340                                 state = p->state;
1341                                 return (p->token);
1342                         }
1343                         state = CMD;
1344                         break;
1345
1346                 case ZSTR1:
1347                 case OSTR:
1348                         if (cbuf[cpos] == '\n') {
1349                                 state = CMD;
1350                                 return (CRLF);
1351                         }
1352                         /* FALLTHROUGH */
1353
1354                 case STR1:
1355                 dostr1:
1356                         if (cbuf[cpos] == ' ') {
1357                                 cpos++;
1358                                 state = state == OSTR ? STR2 : state+1;
1359                                 return (SP);
1360                         }
1361                         break;
1362
1363                 case ZSTR2:
1364                         if (cbuf[cpos] == '\n') {
1365                                 state = CMD;
1366                                 return (CRLF);
1367                         }
1368                         /* FALLTHROUGH */
1369
1370                 case STR2:
1371                         cp = &cbuf[cpos];
1372                         n = strlen(cp);
1373                         cpos += n - 1;
1374                         /*
1375                          * Make sure the string is nonempty and \n terminated.
1376                          */
1377                         if (n > 1 && cbuf[cpos] == '\n') {
1378                                 cbuf[cpos] = '\0';
1379                                 yylval.s = copy(cp);
1380                                 cbuf[cpos] = '\n';
1381                                 state = ARGS;
1382                                 return (STRING);
1383                         }
1384                         break;
1385
1386                 case NSTR:
1387                         if (cbuf[cpos] == ' ') {
1388                                 cpos++;
1389                                 return (SP);
1390                         }
1391                         if (isdigit(cbuf[cpos])) {
1392                                 cp = &cbuf[cpos];
1393                                 while (isdigit(cbuf[++cpos]))
1394                                         ;
1395                                 c = cbuf[cpos];
1396                                 cbuf[cpos] = '\0';
1397                                 yylval.u.i = atoi(cp);
1398                                 cbuf[cpos] = c;
1399                                 state = STR1;
1400                                 return (NUMBER);
1401                         }
1402                         state = STR1;
1403                         goto dostr1;
1404
1405                 case ARGS:
1406                         if (isdigit(cbuf[cpos])) {
1407                                 cp = &cbuf[cpos];
1408                                 while (isdigit(cbuf[++cpos]))
1409                                         ;
1410                                 c = cbuf[cpos];
1411                                 cbuf[cpos] = '\0';
1412                                 yylval.u.i = atoi(cp);
1413                                 yylval.u.o = strtoull(cp, NULL, 10);
1414                                 cbuf[cpos] = c;
1415                                 return (NUMBER);
1416                         }
1417                         if (strncasecmp(&cbuf[cpos], "ALL", 3) == 0
1418                          && !isalnum(cbuf[cpos + 3])) {
1419                                 cpos += 3;
1420                                 return ALL;
1421                         }
1422                         switch (cbuf[cpos++]) {
1423
1424                         case '\n':
1425                                 state = CMD;
1426                                 return (CRLF);
1427
1428                         case ' ':
1429                                 return (SP);
1430
1431                         case ',':
1432                                 return (COMMA);
1433
1434                         case 'A':
1435                         case 'a':
1436                                 return (A);
1437
1438                         case 'B':
1439                         case 'b':
1440                                 return (B);
1441
1442                         case 'C':
1443                         case 'c':
1444                                 return (C);
1445
1446                         case 'E':
1447                         case 'e':
1448                                 return (E);
1449
1450                         case 'F':
1451                         case 'f':
1452                                 return (F);
1453
1454                         case 'I':
1455                         case 'i':
1456                                 return (I);
1457
1458                         case 'L':
1459                         case 'l':
1460                                 return (L);
1461
1462                         case 'N':
1463                         case 'n':
1464                                 return (N);
1465
1466                         case 'P':
1467                         case 'p':
1468                                 return (P);
1469
1470                         case 'R':
1471                         case 'r':
1472                                 return (R);
1473
1474                         case 'S':
1475                         case 's':
1476                                 return (S);
1477
1478                         case 'T':
1479                         case 't':
1480                                 return (T);
1481
1482                         }
1483                         break;
1484
1485                 default:
1486                         fatalerror("Unknown state in scanner.");
1487                 }
1488                 state = CMD;
1489                 return (LEXERR);
1490         }
1491 }
1492
1493 void
1494 upper(char *s)
1495 {
1496         while (*s != '\0') {
1497                 if (islower(*s))
1498                         *s = toupper(*s);
1499                 s++;
1500         }
1501 }
1502
1503 static char *
1504 copy(char *s)
1505 {
1506         char *p;
1507
1508         p = malloc(strlen(s) + 1);
1509         if (p == NULL)
1510                 fatalerror("Ran out of memory.");
1511         (void) strcpy(p, s);
1512         return (p);
1513 }
1514
1515 static void
1516 help(struct tab *ctab, char *s)
1517 {
1518         struct tab *c;
1519         int width, NCMDS;
1520         char *type;
1521
1522         if (ctab == sitetab)
1523                 type = "SITE ";
1524         else
1525                 type = "";
1526         width = 0, NCMDS = 0;
1527         for (c = ctab; c->name != NULL; c++) {
1528                 int len = strlen(c->name);
1529
1530                 if (len > width)
1531                         width = len;
1532                 NCMDS++;
1533         }
1534         width = (width + 8) &~ 7;
1535         if (s == 0) {
1536                 int i, j, w;
1537                 int columns, lines;
1538
1539                 lreply(214, "The following %scommands are recognized %s.",
1540                     type, "(* =>'s unimplemented)");
1541                 columns = 76 / width;
1542                 if (columns == 0)
1543                         columns = 1;
1544                 lines = (NCMDS + columns - 1) / columns;
1545                 for (i = 0; i < lines; i++) {
1546                         printf("   ");
1547                         for (j = 0; j < columns; j++) {
1548                                 c = ctab + j * lines + i;
1549                                 printf("%s%c", c->name,
1550                                         c->implemented ? ' ' : '*');
1551                                 if (c + lines >= &ctab[NCMDS])
1552                                         break;
1553                                 w = strlen(c->name) + 1;
1554                                 while (w < width) {
1555                                         putchar(' ');
1556                                         w++;
1557                                 }
1558                         }
1559                         printf("\r\n");
1560                 }
1561                 (void) fflush(stdout);
1562                 if (hostinfo)
1563                         reply(214, "Direct comments to ftp-bugs@%s.", hostname);
1564                 else
1565                         reply(214, "End.");
1566                 return;
1567         }
1568         upper(s);
1569         c = lookup(ctab, s);
1570         if (c == NULL) {
1571                 reply(502, "Unknown command %s.", s);
1572                 return;
1573         }
1574         if (c->implemented)
1575                 reply(214, "Syntax: %s%s %s", type, c->name, c->help);
1576         else
1577                 reply(214, "%s%-*s\t%s; unimplemented.", type, width,
1578                     c->name, c->help);
1579 }
1580
1581 static void
1582 sizecmd(char *filename)
1583 {
1584         switch (type) {
1585         case TYPE_L:
1586         case TYPE_I: {
1587                 struct stat stbuf;
1588                 if (stat(filename, &stbuf) < 0)
1589                         perror_reply(550, filename);
1590                 else if (!S_ISREG(stbuf.st_mode))
1591                         reply(550, "%s: not a plain file.", filename);
1592                 else
1593                         reply(213, "%jd", (intmax_t)stbuf.st_size);
1594                 break; }
1595         case TYPE_A: {
1596                 FILE *fin;
1597                 int c;
1598                 off_t count;
1599                 struct stat stbuf;
1600                 fin = fopen(filename, "r");
1601                 if (fin == NULL) {
1602                         perror_reply(550, filename);
1603                         return;
1604                 }
1605                 if (fstat(fileno(fin), &stbuf) < 0) {
1606                         perror_reply(550, filename);
1607                         (void) fclose(fin);
1608                         return;
1609                 } else if (!S_ISREG(stbuf.st_mode)) {
1610                         reply(550, "%s: not a plain file.", filename);
1611                         (void) fclose(fin);
1612                         return;
1613                 } else if (stbuf.st_size > MAXASIZE) {
1614                         reply(550, "%s: too large for type A SIZE.", filename);
1615                         (void) fclose(fin);
1616                         return;
1617                 }
1618
1619                 count = 0;
1620                 while((c=getc(fin)) != EOF) {
1621                         if (c == '\n')  /* will get expanded to \r\n */
1622                                 count++;
1623                         count++;
1624                 }
1625                 (void) fclose(fin);
1626
1627                 reply(213, "%jd", (intmax_t)count);
1628                 break; }
1629         default:
1630                 reply(504, "SIZE not implemented for type %s.",
1631                            typenames[type]);
1632         }
1633 }
1634
1635 /* Return 1, if port check is done. Return 0, if not yet. */
1636 static int
1637 port_check(const char *pcmd)
1638 {
1639         if (his_addr.su_family == AF_INET) {
1640                 if (data_dest.su_family != AF_INET) {
1641                         usedefault = 1;
1642                         reply(500, "Invalid address rejected.");
1643                         return 1;
1644                 }
1645                 if (paranoid &&
1646                     ((ntohs(data_dest.su_port) < IPPORT_RESERVED) ||
1647                      memcmp(&data_dest.su_sin.sin_addr,
1648                             &his_addr.su_sin.sin_addr,
1649                             sizeof(data_dest.su_sin.sin_addr)))) {
1650                         usedefault = 1;
1651                         reply(500, "Illegal PORT range rejected.");
1652                 } else {
1653                         usedefault = 0;
1654                         if (pdata >= 0) {
1655                                 (void) close(pdata);
1656                                 pdata = -1;
1657                         }
1658                         reply(200, "%s command successful.", pcmd);
1659                 }
1660                 return 1;
1661         }
1662         return 0;
1663 }
1664
1665 static int
1666 check_login1(void)
1667 {
1668         if (logged_in)
1669                 return 1;
1670         else {
1671                 reply(530, "Please login with USER and PASS.");
1672                 return 0;
1673         }
1674 }
1675
1676 /*
1677  * Replace leading "~user" in a pathname by the user's login directory.
1678  * Returned string will be in a freshly malloced buffer unless it's NULL.
1679  */
1680 static char *
1681 exptilde(char *s)
1682 {
1683         char *p, *q;
1684         char *path, *user;
1685         struct passwd *ppw;
1686
1687         if ((p = strdup(s)) == NULL)
1688                 return (NULL);
1689         if (*p != '~')
1690                 return (p);
1691
1692         user = p + 1;   /* skip tilde */
1693         if ((path = strchr(p, '/')) != NULL)
1694                 *(path++) = '\0'; /* separate ~user from the rest of path */
1695         if (*user == '\0') /* no user specified, use the current user */
1696                 user = pw->pw_name;
1697         /* read passwd even for the current user since we may be chrooted */
1698         if ((ppw = getpwnam(user)) != NULL) {
1699                 /* user found, substitute login directory for ~user */
1700                 if (path)
1701                         asprintf(&q, "%s/%s", ppw->pw_dir, path);
1702                 else
1703                         q = strdup(ppw->pw_dir);
1704                 free(p);
1705                 p = q;
1706         } else {
1707                 /* user not found, undo the damage */
1708                 if (path)
1709                         path[-1] = '/';
1710         }
1711         return (p);
1712 }
1713
1714 /*
1715  * Expand glob(3) patterns possibly present in a pathname.
1716  * Avoid expanding to a pathname including '\r' or '\n' in order to
1717  * not disrupt the FTP protocol.
1718  * The expansion found must be unique.
1719  * Return the result as a malloced string, or NULL if an error occurred.
1720  *
1721  * Problem: this production is used for all pathname
1722  * processing, but only gives a 550 error reply.
1723  * This is a valid reply in some cases but not in others.
1724  */
1725 static char *
1726 expglob(char *s)
1727 {
1728         char *p, **pp, *rval;
1729         int flags = GLOB_BRACE | GLOB_NOCHECK;
1730         int n;
1731         glob_t gl;
1732
1733         memset(&gl, 0, sizeof(gl));
1734         flags |= GLOB_LIMIT;
1735         gl.gl_matchc = MAXGLOBARGS;
1736         if (glob(s, flags, NULL, &gl) == 0 && gl.gl_pathc != 0) {
1737                 for (pp = gl.gl_pathv, p = NULL, n = 0; *pp; pp++)
1738                         if (*(*pp + strcspn(*pp, "\r\n")) == '\0') {
1739                                 p = *pp;
1740                                 n++;
1741                         }
1742                 if (n == 0)
1743                         rval = strdup(s);
1744                 else if (n == 1)
1745                         rval = strdup(p);
1746                 else {
1747                         reply(550, "Wildcard is ambiguous.");
1748                         rval = NULL;
1749                 }
1750         } else {
1751                 reply(550, "Wildcard expansion error.");
1752                 rval = NULL;
1753         }
1754         globfree(&gl);
1755         return (rval);
1756 }
1757
1758 #ifdef INET6
1759 /* Return 1, if port check is done. Return 0, if not yet. */
1760 static int
1761 port_check_v6(const char *pcmd)
1762 {
1763         if (his_addr.su_family == AF_INET6) {
1764                 if (IN6_IS_ADDR_V4MAPPED(&his_addr.su_sin6.sin6_addr))
1765                         /* Convert data_dest into v4 mapped sockaddr.*/
1766                         v4map_data_dest();
1767                 if (data_dest.su_family != AF_INET6) {
1768                         usedefault = 1;
1769                         reply(500, "Invalid address rejected.");
1770                         return 1;
1771                 }
1772                 if (paranoid &&
1773                     ((ntohs(data_dest.su_port) < IPPORT_RESERVED) ||
1774                      memcmp(&data_dest.su_sin6.sin6_addr,
1775                             &his_addr.su_sin6.sin6_addr,
1776                             sizeof(data_dest.su_sin6.sin6_addr)))) {
1777                         usedefault = 1;
1778                         reply(500, "Illegal PORT range rejected.");
1779                 } else {
1780                         usedefault = 0;
1781                         if (pdata >= 0) {
1782                                 (void) close(pdata);
1783                                 pdata = -1;
1784                         }
1785                         reply(200, "%s command successful.", pcmd);
1786                 }
1787                 return 1;
1788         }
1789         return 0;
1790 }
1791
1792 static void
1793 v4map_data_dest(void)
1794 {
1795         struct in_addr savedaddr;
1796         int savedport;
1797
1798         if (data_dest.su_family != AF_INET) {
1799                 usedefault = 1;
1800                 reply(500, "Invalid address rejected.");
1801                 return;
1802         }
1803
1804         savedaddr = data_dest.su_sin.sin_addr;
1805         savedport = data_dest.su_port;
1806
1807         memset(&data_dest, 0, sizeof(data_dest));
1808         data_dest.su_sin6.sin6_len = sizeof(struct sockaddr_in6);
1809         data_dest.su_sin6.sin6_family = AF_INET6;
1810         data_dest.su_sin6.sin6_port = savedport;
1811         memset((caddr_t)&data_dest.su_sin6.sin6_addr.s6_addr[10], 0xff, 2);
1812         memcpy((caddr_t)&data_dest.su_sin6.sin6_addr.s6_addr[12],
1813                (caddr_t)&savedaddr, sizeof(savedaddr));
1814 }
1815 #endif