» Content »pkg://gatling_0.12cvs20120114.orig.tar.bz2:105486
/ info downloads
gatling now also speaks FTP, and it is enabled per default.
Disable it with -F.
Working around itojun's disabled IPv4-mapped IPv6 addresses is even
worse for FTP than it is for HTTP. I'm not going to waste my time on
this for now. Please ask itojun himself to prove how "easy" or even
"trivial" it is to do this, as he always claims it is.
Like HTTP will bind to port 80 if running as root, or 8000 otherwise,
FTP will bind to port 21 and 2121. To specify the FTP port, use
-f -p [port]. Example:
gatling -p 81 -f -p 2100
would run a HTTP server on port 81 and an FTP server on port 2100. For
now, HTTP and FTP will always bind to the same IP number.
a) No TELNET sequences.
These are _really_ obsolete, a pain in the ass to implement, and
have even been used as means to avoid intrusion detection systems
due to the obscurity.
b) The path checking deliberately _allows_ to leave the file system,
as long as you follow a symbolic link in the process. That means,
if you symlink out of the FTP file system (and the destination is in
the chroot jail), gatling will allow FTP (and HTTP!) users to
follow the symlink. However, following a directory symlink and
appending "/../" will not follow the .. directory entry from the
target directory of the symlink, as an attacker may hope.
The idea is to make it easy to create an FTP Server by putting a
few symlinks to directories you want to export in an empty
directory and starting gatling there.
c) Like for HTTP, gatling will do virtual hosting, i.e. if the client
connected to IP 10.1.1.23 on port 21, gatling will look for the
exported data in the directory "10.1.1.23:21".
d) gatling will not let users download files that are not world
readable, even if the permissions would normally allow the gatling
process to read the files. This is to prevent accidental
publication of sensitive files.
e) gatling accepts uploads per anonymous FTP, but only to directories
that are world writable. Since there normally are no world
writable directories, this should not pose much of a threat to
anyone. Please note that the files are created with mode 600,
which means gatling will not let others download uploaded files, so
it cannot be exploited as warez dump.
You can disable uploads altogether with -U, or you can allow
anonymous downloaders to download just uploaded files with -a.
f) gatling's directory listings will always claim files are owned by
root. The local accounts on FTP sites are ignored by software and
not normally useful to outsiders anyway, but revealing them may
expose more of your organisation to FTP users than you want.