From 6b286a46821fa230258f1da82d0e013cfe3bf685 Mon Sep 17 00:00:00 2001
From: Darren Tucker <dtucker@zip.com.au>
Date: Wed, 7 Oct 2009 08:46:21 +1100
Subject:    - djm@cvs.openbsd.org 2009/08/27 17:43:00      [sftp-server.8]    
  allow setting an explicit umask on the commandline to override whatever     
 default the user has. bz#1229; ok dtucker@ deraadt@ markus@

---
 sftp-server.8 | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

(limited to 'sftp-server.8')

diff --git a/sftp-server.8 b/sftp-server.8
index 372b0770e..0f7963e27 100644
--- a/sftp-server.8
+++ b/sftp-server.8
@@ -1,4 +1,4 @@
-.\" $OpenBSD: sftp-server.8,v 1.15 2009/03/26 08:38:39 sobrado Exp $
+.\" $OpenBSD: sftp-server.8,v 1.16 2009/08/27 17:43:00 djm Exp $
 .\"
 .\" Copyright (c) 2000 Markus Friedl.  All rights reserved.
 .\"
@@ -22,7 +22,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: March 26 2009 $
+.Dd $Mdocdate: August 27 2009 $
 .Dt SFTP-SERVER 8
 .Os
 .Sh NAME
@@ -32,6 +32,7 @@
 .Nm sftp-server
 .Op Fl f Ar log_facility
 .Op Fl l Ar log_level
+.Op Fl u Ar umask
 .Sh DESCRIPTION
 .Nm
 is a program that speaks the server side of SFTP protocol
@@ -71,6 +72,11 @@ performs on behalf of the client.
 DEBUG and DEBUG1 are equivalent.
 DEBUG2 and DEBUG3 each specify higher levels of debugging output.
 The default is ERROR.
+.It Fl u Ar umask
+Sets an explicit
+.Xr umask 2
+to be applied to newly-created files and directories, instead of the
+user's default mask.
 .El
 .Pp
 For logging to work,
-- 
cgit v1.2.3


From 7bee06ab3b84c9f141666cc47abb349067551ef6 Mon Sep 17 00:00:00 2001
From: Darren Tucker <dtucker@zip.com.au>
Date: Wed, 7 Oct 2009 08:47:47 +1100
Subject:    - djm@cvs.openbsd.org 2009/08/31 21:01:29      [sftp-server.8]    
  document -e and -h; prodded by jmc@

---
 ChangeLog     |  3 +++
 sftp-server.8 | 13 +++++++++++--
 2 files changed, 14 insertions(+), 2 deletions(-)

(limited to 'sftp-server.8')

diff --git a/ChangeLog b/ChangeLog
index a57890ebd..5fbca0934 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -70,6 +70,9 @@
    - djm@cvs.openbsd.org 2009/08/31 20:56:02
      [sftp-server.c]
      check correct variable for error message, spotted by martynas@
+   - djm@cvs.openbsd.org 2009/08/31 21:01:29
+     [sftp-server.8]
+     document -e and -h; prodded by jmc@
 
 20091002
  - (djm) [Makefile.in] Mention readconf.o in ssh-keysign's make deps.
diff --git a/sftp-server.8 b/sftp-server.8
index 0f7963e27..ee73c345b 100644
--- a/sftp-server.8
+++ b/sftp-server.8
@@ -1,4 +1,4 @@
-.\" $OpenBSD: sftp-server.8,v 1.16 2009/08/27 17:43:00 djm Exp $
+.\" $OpenBSD: sftp-server.8,v 1.17 2009/08/31 21:01:29 djm Exp $
 .\"
 .\" Copyright (c) 2000 Markus Friedl.  All rights reserved.
 .\"
@@ -22,7 +22,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: August 27 2009 $
+.Dd $Mdocdate: August 31 2009 $
 .Dt SFTP-SERVER 8
 .Os
 .Sh NAME
@@ -30,6 +30,7 @@
 .Nd SFTP server subsystem
 .Sh SYNOPSIS
 .Nm sftp-server
+.Op Fl eh
 .Op Fl f Ar log_facility
 .Op Fl l Ar log_level
 .Op Fl u Ar umask
@@ -55,12 +56,20 @@ for more information.
 .Pp
 Valid options are:
 .Bl -tag -width Ds
+.It Fl e
+Causes
+.Nm
+to print logging information to stderr instead of syslog for debugging.
 .It Fl f Ar log_facility
 Specifies the facility code that is used when logging messages from
 .Nm .
 The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2,
 LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
 The default is AUTH.
+.It Fl h
+Displays
+.Nm
+usage information.
 .It Fl l Ar log_level
 Specifies which messages will be logged by
 .Nm .
-- 
cgit v1.2.3


From db7bf82544800c21a471a89781466bbf4ac08731 Mon Sep 17 00:00:00 2001
From: Darren Tucker <dtucker@zip.com.au>
Date: Sat, 9 Jan 2010 22:24:33 +1100
Subject:    - djm@cvs.openbsd.org 2010/01/09 00:20:26      [sftp-server.c
 sftp-server.8]      add a 'read-only' mode to sftp-server(8) that disables
 open in write mode      and all other fs-modifying protocol methods. bz#430
 ok dtucker@

---
 ChangeLog     |   5 +++
 sftp-server.8 |  12 +++++--
 sftp-server.c | 103 +++++++++++++++++++++++++++++++++++++++++-----------------
 3 files changed, 88 insertions(+), 32 deletions(-)

(limited to 'sftp-server.8')

diff --git a/ChangeLog b/ChangeLog
index 31f205f6a..647d71def 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -5,6 +5,11 @@
  - (dtucker) [roaming_client.c] Wrap inttypes.h in an ifdef.
  - (dtucker) [loginrec.c] Use the SUSv3 specified name for the user name
    when using utmpx.  Patch from Ed Schouten.
+ - (dtucker) OpenBSD CVS Sync
+   - djm@cvs.openbsd.org 2010/01/09 00:20:26
+     [sftp-server.c sftp-server.8]
+     add a 'read-only' mode to sftp-server(8) that disables open in write mode
+     and all other fs-modifying protocol methods. bz#430 ok dtucker@
 
 20091208
  - (dtucker) OpenBSD CVS Sync
diff --git a/sftp-server.8 b/sftp-server.8
index ee73c345b..84036922c 100644
--- a/sftp-server.8
+++ b/sftp-server.8
@@ -1,4 +1,4 @@
-.\" $OpenBSD: sftp-server.8,v 1.17 2009/08/31 21:01:29 djm Exp $
+.\" $OpenBSD: sftp-server.8,v 1.18 2010/01/09 00:20:26 djm Exp $
 .\"
 .\" Copyright (c) 2000 Markus Friedl.  All rights reserved.
 .\"
@@ -22,7 +22,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: August 31 2009 $
+.Dd $Mdocdate: January 9 2010 $
 .Dt SFTP-SERVER 8
 .Os
 .Sh NAME
@@ -30,7 +30,7 @@
 .Nd SFTP server subsystem
 .Sh SYNOPSIS
 .Nm sftp-server
-.Op Fl eh
+.Op Fl ehR
 .Op Fl f Ar log_facility
 .Op Fl l Ar log_level
 .Op Fl u Ar umask
@@ -81,6 +81,12 @@ performs on behalf of the client.
 DEBUG and DEBUG1 are equivalent.
 DEBUG2 and DEBUG3 each specify higher levels of debugging output.
 The default is ERROR.
+.It Fl R
+Places this instance of
+.Nm
+into a read-only mode.
+Attempts to open files for writing, as well as other operations that change
+the state of the filesystem will be denied.
 .It Fl u Ar umask
 Sets an explicit
 .Xr umask 2
diff --git a/sftp-server.c b/sftp-server.c
index cf4e273f8..ab9391cfd 100644
--- a/sftp-server.c
+++ b/sftp-server.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sftp-server.c,v 1.89 2010/01/04 02:25:15 djm Exp $ */
+/* $OpenBSD: sftp-server.c,v 1.90 2010/01/09 00:20:26 djm Exp $ */
 /*
  * Copyright (c) 2000-2004 Markus Friedl.  All rights reserved.
  *
@@ -70,6 +70,9 @@ Buffer oqueue;
 /* Version of client */
 int version;
 
+/* Disable writes */
+int readonly;
+
 /* portable attributes, etc. */
 
 typedef struct Stat Stat;
@@ -553,16 +556,21 @@ process_open(void)
 	mode = (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ? a->perm : 0666;
 	logit("open \"%s\" flags %s mode 0%o",
 	    name, string_from_portable(pflags), mode);
-	fd = open(name, flags, mode);
-	if (fd < 0) {
-		status = errno_to_portable(errno);
-	} else {
-		handle = handle_new(HANDLE_FILE, name, fd, NULL);
-		if (handle < 0) {
-			close(fd);
+	if (readonly &&
+	    ((flags & O_ACCMODE) == O_WRONLY || (flags & O_ACCMODE) == O_RDWR))
+		status = SSH2_FX_PERMISSION_DENIED;
+	else {
+		fd = open(name, flags, mode);
+		if (fd < 0) {
+			status = errno_to_portable(errno);
 		} else {
-			send_handle(id, handle);
-			status = SSH2_FX_OK;
+			handle = handle_new(HANDLE_FILE, name, fd, NULL);
+			if (handle < 0) {
+				close(fd);
+			} else {
+				send_handle(id, handle);
+				status = SSH2_FX_OK;
+			}
 		}
 	}
 	if (status != SSH2_FX_OK)
@@ -632,7 +640,7 @@ process_write(void)
 	u_int32_t id;
 	u_int64_t off;
 	u_int len;
-	int handle, fd, ret, status = SSH2_FX_FAILURE;
+	int handle, fd, ret, status;
 	char *data;
 
 	id = get_int();
@@ -643,7 +651,12 @@ process_write(void)
 	debug("request %u: write \"%s\" (handle %d) off %llu len %d",
 	    id, handle_to_name(handle), handle, (unsigned long long)off, len);
 	fd = handle_to_fd(handle);
-	if (fd >= 0) {
+	
+	if (fd < 0)
+		status = SSH2_FX_FAILURE;
+	else if (readonly)
+		status = SSH2_FX_PERMISSION_DENIED;
+	else {
 		if (lseek(fd, off, SEEK_SET) < 0) {
 			status = errno_to_portable(errno);
 			error("process_write: seek failed");
@@ -658,6 +671,7 @@ process_write(void)
 				handle_update_write(handle, ret);
 			} else {
 				debug2("nothing at all written");
+				status = SSH2_FX_FAILURE;
 			}
 		}
 	}
@@ -754,6 +768,10 @@ process_setstat(void)
 	name = get_string(NULL);
 	a = get_attrib();
 	debug("request %u: setstat name \"%s\"", id, name);
+	if (readonly) {
+		status = SSH2_FX_PERMISSION_DENIED;
+		a->flags = 0;
+	}
 	if (a->flags & SSH2_FILEXFER_ATTR_SIZE) {
 		logit("set \"%s\" size %llu",
 		    name, (unsigned long long)a->size);
@@ -802,9 +820,11 @@ process_fsetstat(void)
 	a = get_attrib();
 	debug("request %u: fsetstat handle %d", id, handle);
 	fd = handle_to_fd(handle);
-	if (fd < 0) {
+	if (fd < 0)
 		status = SSH2_FX_FAILURE;
-	} else {
+	else if (readonly)
+		status = SSH2_FX_PERMISSION_DENIED;
+	else {
 		char *name = handle_to_name(handle);
 
 		if (a->flags & SSH2_FILEXFER_ATTR_SIZE) {
@@ -952,8 +972,12 @@ process_remove(void)
 	name = get_string(NULL);
 	debug3("request %u: remove", id);
 	logit("remove name \"%s\"", name);
-	ret = unlink(name);
-	status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
+	if (readonly)
+		status = SSH2_FX_PERMISSION_DENIED;
+	else {
+		ret = unlink(name);
+		status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
+	}
 	send_status(id, status);
 	xfree(name);
 }
@@ -973,8 +997,12 @@ process_mkdir(void)
 	    a->perm & 07777 : 0777;
 	debug3("request %u: mkdir", id);
 	logit("mkdir name \"%s\" mode 0%o", name, mode);
-	ret = mkdir(name, mode);
-	status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
+	if (readonly)
+		status = SSH2_FX_PERMISSION_DENIED;
+	else {
+		ret = mkdir(name, mode);
+		status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
+	}
 	send_status(id, status);
 	xfree(name);
 }
@@ -990,8 +1018,12 @@ process_rmdir(void)
 	name = get_string(NULL);
 	debug3("request %u: rmdir", id);
 	logit("rmdir name \"%s\"", name);
-	ret = rmdir(name);
-	status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
+	if (readonly)
+		status = SSH2_FX_PERMISSION_DENIED;
+	else {
+		ret = rmdir(name);
+		status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
+	}
 	send_status(id, status);
 	xfree(name);
 }
@@ -1036,7 +1068,9 @@ process_rename(void)
 	debug3("request %u: rename", id);
 	logit("rename old \"%s\" new \"%s\"", oldpath, newpath);
 	status = SSH2_FX_FAILURE;
-	if (lstat(oldpath, &sb) == -1)
+	if (readonly)
+		status = SSH2_FX_PERMISSION_DENIED;
+	else if (lstat(oldpath, &sb) == -1)
 		status = errno_to_portable(errno);
 	else if (S_ISREG(sb.st_mode)) {
 		/* Race-free rename of regular files */
@@ -1120,8 +1154,12 @@ process_symlink(void)
 	debug3("request %u: symlink", id);
 	logit("symlink old \"%s\" new \"%s\"", oldpath, newpath);
 	/* this will fail if 'newpath' exists */
-	ret = symlink(oldpath, newpath);
-	status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
+	if (readonly)
+		status = SSH2_FX_PERMISSION_DENIED;
+	else {
+		ret = symlink(oldpath, newpath);
+		status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
+	}
 	send_status(id, status);
 	xfree(oldpath);
 	xfree(newpath);
@@ -1131,15 +1169,19 @@ static void
 process_extended_posix_rename(u_int32_t id)
 {
 	char *oldpath, *newpath;
+	int ret, status;
 
 	oldpath = get_string(NULL);
 	newpath = get_string(NULL);
 	debug3("request %u: posix-rename", id);
 	logit("posix-rename old \"%s\" new \"%s\"", oldpath, newpath);
-	if (rename(oldpath, newpath) == -1)
-		send_status(id, errno_to_portable(errno));
-	else
-		send_status(id, SSH2_FX_OK);
+	if (readonly)
+		status = SSH2_FX_PERMISSION_DENIED;
+	else {
+		ret = rename(oldpath, newpath);
+		status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
+	}
+	send_status(id, status);
 	xfree(oldpath);
 	xfree(newpath);
 }
@@ -1322,7 +1364,7 @@ sftp_server_usage(void)
 	extern char *__progname;
 
 	fprintf(stderr,
-	    "usage: %s [-eh] [-f log_facility] [-l log_level] [-u umask]\n",
+	    "usage: %s [-ehR] [-f log_facility] [-l log_level] [-u umask]\n",
 	    __progname);
 	exit(1);
 }
@@ -1344,8 +1386,11 @@ sftp_server_main(int argc, char **argv, struct passwd *user_pw)
 	__progname = ssh_get_progname(argv[0]);
 	log_init(__progname, log_level, log_facility, log_stderr);
 
-	while (!skipargs && (ch = getopt(argc, argv, "f:l:u:che")) != -1) {
+	while (!skipargs && (ch = getopt(argc, argv, "f:l:u:cehR")) != -1) {
 		switch (ch) {
+		case 'R':
+			readonly = 1;
+			break;
 		case 'c':
 			/*
 			 * Ignore all arguments if we are invoked as a
-- 
cgit v1.2.3


From 838891fe85308399c4f350f8174013987b6a2f85 Mon Sep 17 00:00:00 2001
From: Darren Tucker <dtucker@zip.com.au>
Date: Sat, 9 Jan 2010 22:25:46 +1100
Subject:    - jmc@cvs.openbsd.org 2010/01/09 03:36:00      [sftp-server.8]    
  bad place to forget a comma...

---
 ChangeLog     | 3 +++
 sftp-server.8 | 4 ++--
 2 files changed, 5 insertions(+), 2 deletions(-)

(limited to 'sftp-server.8')

diff --git a/ChangeLog b/ChangeLog
index b3260c7fe..3b7fb6456 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -13,6 +13,9 @@
    - djm@cvs.openbsd.org 2010/01/09 00:57:10
      [PROTOCOL]
      tweak language
+   - jmc@cvs.openbsd.org 2010/01/09 03:36:00
+     [sftp-server.8]
+     bad place to forget a comma...
 
 20091208
  - (dtucker) OpenBSD CVS Sync
diff --git a/sftp-server.8 b/sftp-server.8
index 84036922c..bb19c15e1 100644
--- a/sftp-server.8
+++ b/sftp-server.8
@@ -1,4 +1,4 @@
-.\" $OpenBSD: sftp-server.8,v 1.18 2010/01/09 00:20:26 djm Exp $
+.\" $OpenBSD: sftp-server.8,v 1.19 2010/01/09 03:36:00 jmc Exp $
 .\"
 .\" Copyright (c) 2000 Markus Friedl.  All rights reserved.
 .\"
@@ -86,7 +86,7 @@ Places this instance of
 .Nm
 into a read-only mode.
 Attempts to open files for writing, as well as other operations that change
-the state of the filesystem will be denied.
+the state of the filesystem, will be denied.
 .It Fl u Ar umask
 Sets an explicit
 .Xr umask 2
-- 
cgit v1.2.3