mirror of
https://github.com/curl/curl.git
synced 2024-12-27 06:59:43 +08:00
ec9cc725d5
The command line tool also independently sets --ftp-skip-pasv-ip by default. Ten test cases updated to adapt the modified --libcurl output. Bug: https://curl.se/docs/CVE-2020-8284.html CVE-2020-8284 Reported-by: Varnavas Papaioannou
145 lines
3.5 KiB
Plaintext
145 lines
3.5 KiB
Plaintext
<testcase>
|
|
# Derived from test227
|
|
<info>
|
|
<keywords>
|
|
FTP
|
|
post-quote
|
|
pre-quote
|
|
--libcurl
|
|
</keywords>
|
|
</info>
|
|
# Server-side
|
|
<reply>
|
|
<data>
|
|
data
|
|
to
|
|
see
|
|
that FTP
|
|
works
|
|
so does it?
|
|
</data>
|
|
<servercmd>
|
|
REPLY EPSV 500 no such command
|
|
REPLY FAIL 500 this might not be a failure!
|
|
</servercmd>
|
|
</reply>
|
|
|
|
# Client-side
|
|
<client>
|
|
<server>
|
|
ftp
|
|
</server>
|
|
<name>
|
|
--libcurl for FTP with quote ops
|
|
</name>
|
|
<setenv>
|
|
SSL_CERT_FILE=
|
|
</setenv>
|
|
<command>
|
|
ftp://%HOSTIP:%FTPPORT/1405 -Q "NOOP 1" -Q "+NOOP 2" -Q "-NOOP 3" -Q "*FAIL" -Q "+*FAIL HARD" --libcurl log/test1405.c
|
|
</command>
|
|
</client>
|
|
|
|
# Verify data after the test has been "shot"
|
|
<verify>
|
|
<protocol>
|
|
USER anonymous
|
|
PASS ftp@example.com
|
|
PWD
|
|
NOOP 1
|
|
FAIL
|
|
EPSV
|
|
PASV
|
|
TYPE I
|
|
NOOP 2
|
|
FAIL HARD
|
|
SIZE 1405
|
|
RETR 1405
|
|
NOOP 3
|
|
QUIT
|
|
</protocol>
|
|
<file name="log/test1405.c" mode="text">
|
|
/********* Sample code generated by the curl command line tool **********
|
|
* All curl_easy_setopt() options are documented at:
|
|
* https://curl.se/libcurl/c/curl_easy_setopt.html
|
|
************************************************************************/
|
|
#include <curl/curl.h>
|
|
|
|
int main(int argc, char *argv[])
|
|
{
|
|
CURLcode ret;
|
|
CURL *hnd;
|
|
struct curl_slist *slist1;
|
|
struct curl_slist *slist2;
|
|
struct curl_slist *slist3;
|
|
|
|
slist1 = NULL;
|
|
slist1 = curl_slist_append(slist1, "NOOP 1");
|
|
slist1 = curl_slist_append(slist1, "*FAIL");
|
|
slist2 = NULL;
|
|
slist2 = curl_slist_append(slist2, "NOOP 3");
|
|
slist3 = NULL;
|
|
slist3 = curl_slist_append(slist3, "NOOP 2");
|
|
slist3 = curl_slist_append(slist3, "*FAIL HARD");
|
|
|
|
hnd = curl_easy_init();
|
|
curl_easy_setopt(hnd, CURLOPT_BUFFERSIZE, 102400L);
|
|
curl_easy_setopt(hnd, CURLOPT_URL, "ftp://%HOSTIP:%FTPPORT/1405");
|
|
curl_easy_setopt(hnd, CURLOPT_QUOTE, slist1);
|
|
curl_easy_setopt(hnd, CURLOPT_POSTQUOTE, slist2);
|
|
curl_easy_setopt(hnd, CURLOPT_PREQUOTE, slist3);
|
|
curl_easy_setopt(hnd, CURLOPT_VERBOSE, 1L);
|
|
curl_easy_setopt(hnd, CURLOPT_FTP_SKIP_PASV_IP, 1L);
|
|
curl_easy_setopt(hnd, CURLOPT_TCP_KEEPALIVE, 1L);
|
|
|
|
/* Here is a list of options the curl code used that cannot get generated
|
|
as source easily. You may select to either not use them or implement
|
|
them yourself.
|
|
|
|
CURLOPT_WRITEDATA set to a objectpointer
|
|
CURLOPT_WRITEFUNCTION set to a functionpointer
|
|
CURLOPT_READDATA set to a objectpointer
|
|
CURLOPT_READFUNCTION set to a functionpointer
|
|
CURLOPT_SEEKDATA set to a objectpointer
|
|
CURLOPT_SEEKFUNCTION set to a functionpointer
|
|
CURLOPT_ERRORBUFFER set to a objectpointer
|
|
CURLOPT_STDERR set to a objectpointer
|
|
CURLOPT_DEBUGFUNCTION set to a functionpointer
|
|
CURLOPT_DEBUGDATA set to a objectpointer
|
|
CURLOPT_HEADERFUNCTION set to a functionpointer
|
|
CURLOPT_HEADERDATA set to a objectpointer
|
|
|
|
*/
|
|
|
|
ret = curl_easy_perform(hnd);
|
|
|
|
curl_easy_cleanup(hnd);
|
|
hnd = NULL;
|
|
curl_slist_free_all(slist1);
|
|
slist1 = NULL;
|
|
curl_slist_free_all(slist2);
|
|
slist2 = NULL;
|
|
curl_slist_free_all(slist3);
|
|
slist3 = NULL;
|
|
|
|
return (int)ret;
|
|
}
|
|
/**** End of sample code ****/
|
|
</file>
|
|
<stripfile>
|
|
# CURLOPT_USERAGENT and CURLOPT_MAXREDIRS requires HTTP protocol
|
|
# CURLOPT_INTERLEAVEDATA requires RTSP (HTTP) protocol
|
|
# support, IOW depends on configuration - just ignore these.
|
|
$_ = '' if /CURLOPT_USERAGENT/
|
|
$_ = '' if /CURLOPT_MAXREDIRS/
|
|
# CURLOPT_SSL_VERIFYPEER, SSH_KNOWNHOSTS and HTTP_VERSION vary with
|
|
# configurations - just ignore them
|
|
$_ = '' if /CURLOPT_SSL_VERIFYPEER/
|
|
$_ = '' if /CURLOPT_SSH_KNOWNHOSTS/
|
|
$_ = '' if /CURLOPT_HTTP_VERSION/
|
|
$_ = '' if /CURLOPT_HTTP09_ALLOWED/
|
|
$_ = '' if /CURLOPT_INTERLEAVEDATA/
|
|
</stripfile>
|
|
</verify>
|
|
</testcase>
|