From 3df458e772bf2a341ebdc133f108f98471033f15 Mon Sep 17 00:00:00 2001
From: psimons <>
Date: Jun 11 2025 17:02:18 +0000
Subject: Update vsftpd to version 3.0.5 / rev 92 via SR 1284733
https://build.opensuse.org/request/show/1284733
by user psimons + anag_factory
- Apply "terminate-peers-on-quit.patch" to introduce the new
internal PRIV_SOCK_QUIT command which vsftpd sends to privileged
parent processes to properly shut down the TLS connection in case
we've received QUIT from the session client. This change avoids
misleading error messages in the servers log file. [bsc#1199250]
---
diff --git a/.files b/.files
index 6d48989..92a5a2d 100644
Binary files a/.files and b/.files differ
diff --git a/.rev b/.rev
index 9aea941..bd32984 100644
--- a/.rev
+++ b/.rev
@@ -973,4 +973,16 @@ confusing "failed to try-restart" error message. [bsc#1093179, bsc#101
1268459
+
+ 545b23d0d3865f4e1afb868184e9534f
+ 3.0.5
+
+ anag_factory
+ - Apply "terminate-peers-on-quit.patch" to introduce the new
+ internal PRIV_SOCK_QUIT command which vsftpd sends to privileged
+ parent processes to properly shut down the TLS connection in case
+ we've received QUIT from the session client. This change avoids
+ misleading error messages in the servers log file. [bsc#1199250]
+ 1284733
+
diff --git a/terminate-peers-on-quit.patch b/terminate-peers-on-quit.patch
new file mode 100644
index 0000000..c66bb4f
--- /dev/null
+++ b/terminate-peers-on-quit.patch
@@ -0,0 +1,118 @@
+
+
+Index: vsftpd-3.0.5/postlogin.c
+===================================================================
+--- vsftpd-3.0.5.orig/postlogin.c
++++ vsftpd-3.0.5/postlogin.c
+@@ -184,6 +184,10 @@ process_post_login(struct vsf_session* p
+ }
+ else if (str_equal_text(&p_sess->ftp_cmd_str, "QUIT"))
+ {
++ if (!tunable_one_process_model)
++ {
++ vsf_two_process_quit(p_sess);
++ }
+ vsf_cmdio_write_exit(p_sess, FTP_GOODBYE, "Goodbye.", 0);
+ }
+ else if (str_equal_text(&p_sess->ftp_cmd_str, "PWD") ||
+Index: vsftpd-3.0.5/postprivparent.c
+===================================================================
+--- vsftpd-3.0.5.orig/postprivparent.c
++++ vsftpd-3.0.5/postprivparent.c
+@@ -73,6 +73,10 @@ process_post_login_req(struct vsf_sessio
+ {
+ cmd_process_pasv_accept(p_sess);
+ }
++ else if (cmd == PRIV_SOCK_QUIT)
++ {
++ vsf_sysutil_exit(0);
++ }
+ else
+ {
+ die("bad request in process_post_login_req");
+Index: vsftpd-3.0.5/privsock.h
+===================================================================
+--- vsftpd-3.0.5.orig/privsock.h
++++ vsftpd-3.0.5/privsock.h
+@@ -169,6 +169,7 @@ int priv_sock_get_int(int fd);
+ #define PRIV_SOCK_PASV_ACTIVE 11
+ #define PRIV_SOCK_PASV_LISTEN 12
+ #define PRIV_SOCK_PASV_ACCEPT 13
++#define PRIV_SOCK_QUIT 127
+
+ #define PRIV_SOCK_RESULT_OK 1
+ #define PRIV_SOCK_RESULT_BAD 2
+Index: vsftpd-3.0.5/twoprocess.c
+===================================================================
+--- vsftpd-3.0.5.orig/twoprocess.c
++++ vsftpd-3.0.5/twoprocess.c
+@@ -267,6 +267,12 @@ vsf_two_process_pasv_active(struct vsf_s
+ return priv_sock_get_int(p_sess->child_fd);
+ }
+
++void
++vsf_two_process_quit(struct vsf_session* p_sess)
++{
++ priv_sock_send_cmd(p_sess->child_fd, PRIV_SOCK_QUIT);
++}
++
+ unsigned short
+ vsf_two_process_listen(struct vsf_session* p_sess)
+ {
+Index: vsftpd-3.0.5/twoprocess.h
+===================================================================
+--- vsftpd-3.0.5.orig/twoprocess.h
++++ vsftpd-3.0.5/twoprocess.h
+@@ -51,6 +51,14 @@ void vsf_two_process_pasv_cleanup(struct
+ */
+ int vsf_two_process_pasv_active(struct vsf_session* p_sess);
+
++/* vsf_two_process_quit()
++ * PURPOSE
++ * Terminate privileged side.
++ * PARAMETERS
++ * p_sess - the current session object
++ */
++void vsf_two_process_quit(struct vsf_session* p_sess);
++
+ /* vsf_two_process_listen()
+ * PURPOSE
+ * Start listening for an incoming connection on the passive socket in the
+Index: vsftpd-3.0.5/ftpcmdio.c
+===================================================================
+--- vsftpd-3.0.5.orig/ftpcmdio.c
++++ vsftpd-3.0.5/ftpcmdio.c
+@@ -19,6 +19,7 @@
+ #include "logging.h"
+ #include "session.h"
+ #include "readwrite.h"
++#include "privsock.h"
+
+ /* Internal functions */
+ static int control_getline(struct mystr* p_str, struct vsf_session* p_sess);
+@@ -87,6 +88,10 @@ vsf_cmdio_write_exit(struct vsf_session*
+ vsf_sysutil_shutdown_read_failok(VSFTP_COMMAND_FD);
+ vsf_cmdio_write(p_sess, status, p_text);
+ vsf_sysutil_shutdown_failok(VSFTP_COMMAND_FD);
++ if (p_sess->data_use_ssl && p_sess->ssl_slave_active)
++ {
++ priv_sock_send_cmd(p_sess->ssl_consumer_fd, PRIV_SOCK_QUIT);
++ }
+ vsf_sysutil_exit(exit_val);
+ }
+
+Index: vsftpd-3.0.5/sslslave.c
+===================================================================
+--- vsftpd-3.0.5.orig/sslslave.c
++++ vsftpd-3.0.5/sslslave.c
+@@ -43,6 +43,10 @@ ssl_slave(struct vsf_session* p_sess)
+ priv_sock_send_str(p_sess->ssl_slave_fd, &p_sess->ftp_cmd_str);
+ }
+ }
++ else if (cmd == PRIV_SOCK_QUIT)
++ {
++ vsf_sysutil_exit(0);
++ }
+ else if (cmd == PRIV_SOCK_WRITE_USER_RESP)
+ {
+ priv_sock_get_str(p_sess->ssl_slave_fd, &p_sess->ftp_cmd_str);
diff --git a/vsftpd.changes b/vsftpd.changes
index a569907..d135077 100644
--- a/vsftpd.changes
+++ b/vsftpd.changes
@@ -1,4 +1,13 @@
-------------------------------------------------------------------
+Wed Jun 11 09:05:12 UTC 2025 - Peter Simons
+
+- Apply "terminate-peers-on-quit.patch" to introduce the new
+ internal PRIV_SOCK_QUIT command which vsftpd sends to privileged
+ parent processes to properly shut down the TLS connection in case
+ we've received QUIT from the session client. This change avoids
+ misleading error messages in the servers log file. [bsc#1199250]
+
+-------------------------------------------------------------------
Tue Apr 8 09:45:09 UTC 2025 - Friedrich Haubensak
- add -std=gnu17 to CFLAGS to fix gcc15 compile time error
diff --git a/vsftpd.spec b/vsftpd.spec
index 96bb067..24bd859 100644
--- a/vsftpd.spec
+++ b/vsftpd.spec
@@ -1,7 +1,7 @@
#
# spec file for package vsftpd
#
-# Copyright (c) 2023 SUSE LLC
+# Copyright (c) 2025 SUSE LLC
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@@ -101,6 +101,7 @@ Patch45: disable-tls13-to-support-older-openssl-versions.patch
Patch46: 0001-Fix-default-value-of-strict_ssl_read_eof-in-man-page.patch
#PATCH-FIX-OPENSUSE bsc#1211301 Enable crypto-policies support
Patch47: vsftpd-use-system-wide-crypto-policy.patch
+Patch48: terminate-peers-on-quit.patch
BuildRequires: libcap-devel
%if 0%{?suse_version} == 1315
BuildRequires: libopenssl-1_1-devel >= 1.1.1
@@ -189,6 +190,7 @@ tests.
%endif
%patch -P 46 -p1
%patch -P 47 -p1
+%patch -P 48 -p1
%build
%define seccomp_opts -D_GNU_SOURCE -DUSE_SECCOMP