🌴 Sync 2026-03-05 23:51:42

vsftpd/Makefile

@@ -0,0 +1,111 @@
+#
+# Copyright (C) 2006-2015 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=vsftpd
+PKG_VERSION:=3.0.5
+PKG_RELEASE:=1
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=https://security.appspot.com/downloads/
+PKG_HASH:=skip
+
+PKG_MAINTAINER:=Cezary Jackiewicz <cezary@eko.one.pl>
+PKG_LICENSE:=GPLv2
+PKG_CPE_ID:=cpe:/a:vsftpd_project:vsftpd
+
+PKG_BUILD_FLAGS:=gc-sections lto
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/vsftpd/Default
+  SUBMENU:=File Transfer
+  SECTION:=net
+  CATEGORY:=Network
+  TITLE:=Fast and secure FTP server
+  URL:=https://security.appspot.com/vsftpd.html
+  DEPENDS:=+libuci
+endef
+
+
+define Package/vsftpd
+$(call Package/vsftpd/Default)
+  VARIANT:=notls
+  TITLE+= (no TLS)
+endef
+
+define Package/vsftpd-tls
+$(call Package/vsftpd/Default)
+  VARIANT:=tls
+  TITLE+= (TLS)
+  DEPENDS+=+libopenssl
+endef
+
+define Package/vsftpd/conffiles
+/etc/vsftpd.conf
+/etc/vsftpd
+/etc/config/vsftpd
+endef
+
+Package/vsftpd-tls/conffiles=$(Package/vsftpd/conffiles)
+
+ifneq ($(CONFIG_USE_MUSL),)
+  NLSSTRING:=-lcrypt
+  TARGET_CFLAGS += -D_LARGEFILE64_SOURCE
+else ifneq ($(CONFIG_USE_GLIBC),)
+  NLSSTRING:=-lcrypt
+else
+  NLSSTRING:=-lcrypt -lnsl
+endif
+
+TARGET_CFLAGS += -D_GNU_SOURCE -include fcntl.h
+TARGET_LDFLAGS += -Wl,--as-needed,--no-undefined,--no-allow-shlib-undefined
+
+ifeq ($(BUILD_VARIANT),notls)
+ define Build/Compile
+	$(SED) 's/-lcrypt -lnsl/$(NLSSTRING)/' $(PKG_BUILD_DIR)/Makefile
+	$(MAKE) -C $(PKG_BUILD_DIR) \
+		CC="$(TARGET_CC)" \
+		CFLAGS="$(TARGET_CFLAGS) $(TARGET_CPPFLAGS)" \
+		LDFLAGS="$(TARGET_LDFLAGS)" \
+		vsftpd
+ endef
+endif
+
+ifeq ($(BUILD_VARIANT),tls)
+ define Build/Compile
+	$(SED) 's/#undef VSF_BUILD_SSL/#define VSF_BUILD_SSL/' $(PKG_BUILD_DIR)/builddefs.h
+	$(SED) 's/-lcrypt -lnsl/-lcrypt -lnsl -lssl -lcrypto/' $(PKG_BUILD_DIR)/Makefile
+	$(SED) 's/-lcrypt -lnsl/$(NLSSTRING)/' $(PKG_BUILD_DIR)/Makefile
+	$(MAKE) -C $(PKG_BUILD_DIR) \
+		CC="$(TARGET_CC)" \
+		CFLAGS="$(TARGET_CFLAGS) $(TARGET_CPPFLAGS)" \
+		LDFLAGS="$(TARGET_LDFLAGS)" \
+		vsftpd
+ endef
+endif
+
+define Package/vsftpd/install
+	$(INSTALL_DIR) $(1)/usr/sbin
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/$(PKG_NAME) $(1)/usr/sbin/
+	$(INSTALL_BIN) ./files/$(PKG_NAME)_wrapper $(1)/usr/sbin/
+	$(INSTALL_BIN) ./files/$(PKG_NAME)_prepare $(1)/usr/sbin/
+	#$(INSTALL_DIR) $(1)/etc
+	#$(INSTALL_CONF) ./files/$(PKG_NAME).conf $(1)/etc/$(PKG_NAME).conf
+	$(INSTALL_DIR) $(1)/etc/init.d
+	#$(INSTALL_BIN) ./files/$(PKG_NAME).init $(1)/etc/init.d/$(PKG_NAME)
+	$(INSTALL_BIN) ./files/$(PKG_NAME)-uci.init $(1)/etc/init.d/$(PKG_NAME)
+	$(INSTALL_DIR) $(1)/etc/config
+	$(INSTALL_CONF) ./files/$(PKG_NAME).uci $(1)/etc/config/$(PKG_NAME)
+	$(INSTALL_DIR) $(1)/etc/vsftpd
+endef
+
+Package/vsftpd-tls/install=$(Package/vsftpd/install)
+
+$(eval $(call BuildPackage,vsftpd))
+$(eval $(call BuildPackage,vsftpd-tls))

vsftpd/files/vsftpd-uci.init

@@ -0,0 +1,14 @@
+#!/bin/sh /etc/rc.common
+# Copyright (C) 2006-2011 OpenWrt.org
+
+START=50
+
+start() {
+	/usr/sbin/vsftpd_prepare
+	service_start /usr/sbin/vsftpd_wrapper ipv4
+	service_start /usr/sbin/vsftpd_wrapper ipv6
+}
+
+stop() {
+	service_stop /usr/sbin/vsftpd
+}

vsftpd/files/vsftpd.conf

@@ -0,0 +1,30 @@
+background=YES
+listen=YES
+anonymous_enable=NO
+local_enable=YES
+write_enable=YES
+local_umask=022
+check_shell=NO
+#dirmessage_enable=YES
+#ftpd_banner=Welcome to blah FTP service.
+session_support=NO
+#syslog_enable=YES
+#userlist_enable=YES
+#userlist_deny=NO
+#userlist_file=/etc/vsftpd/vsftpd.users
+#xferlog_enable=YES
+#xferlog_file=/var/log/vsftpd.log
+#xferlog_std_format=YES
+###
+### TLS/SSL options
+### example key generation: openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/vsftpd/vsftpd_privkey.pem -out /etc/vsftpd/vsftpd_cert.pem -subj /C="DE"/ST="Saxony"/L="Leipzig"/CN="OpenWrt"
+#ssl_enable=YES
+#allow_anon_ssl=NO
+#force_local_data_ssl=NO
+#force_local_logins_ssl=NO
+#ssl_tlsv1=YES
+#ssl_sslv2=NO
+#ssl_sslv3=NO
+#rsa_cert_file=/etc/vsftpd/vsftpd_cert.pem
+#rsa_private_key_file=/etc/vsftpd/vsftpd_privkey.pem
+

vsftpd/files/vsftpd.init

@@ -0,0 +1,166 @@
+#!/bin/sh /etc/rc.common
+# Copyright (C) 2006-2011 OpenWrt.org
+
+START=50
+USE_PROCD=1
+BIN="/usr/sbin/vsftpd"
+
+. /lib/functions.sh
+
+PORT=21
+OUTPUT_CONF="/var/etc/vsftpd.conf"
+readonly DEFAULT_SECURE_CHROOT="/var/run/vsftpd"
+readonly TEMP_OUTPUT_CONF="/var/etc/vsftpd.conf.tmp"
+
+write_conf() {
+	local key="$1"
+	local value="$2"
+
+	if [ -n "$key" ] && [ -n "$value" ]; then
+		echo "$key=$value" >> "$TEMP_OUTPUT_CONF"
+	fi
+}
+
+write_conf_bool() {
+	local key="$1"
+	local value="$2"
+
+	if  [ "$value" = "1" ]; then
+		write_conf "$key" "YES"
+	else
+		write_conf "$key" "NO"
+	fi
+}
+
+validate_vsftpd_section() {
+	uci_load_validate vsftpd global "$1" "$2" \
+		'listen:bool:1' \
+		'listen_ipv6:bool:0' \
+		'listen_port:port' \
+		'anonymous_enable:bool:0' \
+		'anon_root:directory' \
+		'local_enable:bool:1' \
+		'local_root:directory' \
+		'write_enable:bool:1' \
+		'local_umask:uinteger:022' \
+		'check_shell:bool:0' \
+		'dirmessage_enable:bool:1' \
+		'secure_chroot_dir:directory' \
+		'ftpd_banner:string' \
+		'session_support:bool:0' \
+		'syslog_enable:bool' \
+		'userlist_enable:bool' \
+		'userlist_deny:bool' \
+		'userlist_file:file' \
+		'xferlog_enable:bool' \
+		'xferlog_file:file' \
+		'xferlog_std_format:bool' \
+		'ssl_enable:bool' \
+		'allow_anon_ssl:bool' \
+		'force_local_data_ssl:bool' \
+		'force_local_logins_ssl:bool' \
+		'ssl_tlsv1:bool' \
+		'ssl_sslv2:bool' \
+		'ssl_sslv3:bool' \
+		'rsa_cert_file:file' \
+		'rsa_private_key_file:file'
+}
+
+setup_vsftpd() {
+	local section="$1"
+	local validation_result="$2"
+
+	if [ "$validation_result" != "0" ]; then
+		echo "Validation failed for section: $section"
+		return 1
+	fi
+
+	# Clean up
+	rm -rf "$TEMP_OUTPUT_CONF"  # Clear temporary file
+	touch "$TEMP_OUTPUT_CONF"
+
+	# always run in foreground
+	write_conf_bool "background" "0"
+
+	[ -n "$listen" ] && write_conf_bool "listen" "$listen"
+	[ -n "$listen_ipv6" ] && write_conf_bool "listen_ipv6" "$listen_ipv6"
+	[ -n "$anonymous_enable" ] && write_conf_bool "anonymous_enable" "$anonymous_enable"
+	[ -n "$local_enable" ] && write_conf_bool "local_enable" "$local_enable"
+	[ -n "$write_enable" ] && write_conf_bool "write_enable" "$write_enable"
+	[ -n "$check_shell" ] && write_conf_bool "check_shell" "$check_shell"
+	[ -n "$dirmessage_enable" ] && write_conf_bool "dirmessage_enable" "$dirmessage_enable"
+	[ -n "$session_support" ] && write_conf_bool "session_support" "$session_support"
+	[ -n "$syslog_enable" ] && write_conf_bool "syslog_enable" "$syslog_enable"
+	[ -n "$userlist_enable" ] && write_conf_bool "userlist_enable" "$userlist_enable"
+	[ -n "$userlist_deny" ] && write_conf_bool "userlist_deny" "$userlist_deny"
+	[ -n "$xferlog_enable" ] && write_conf_bool "xferlog_enable" "$xferlog_enable"
+	[ -n "$xferlog_std_format" ] && write_conf_bool "xferlog_std_format" "$xferlog_std_format"
+	[ -n "$ssl_enable" ] && write_conf_bool "ssl_enable" "$ssl_enable"
+	[ -n "$allow_anon_ssl" ] && write_conf_bool "allow_anon_ssl" "$allow_anon_ssl"
+	[ -n "$force_local_data_ssl" ] && write_conf_bool "force_local_data_ssl" "$force_local_data_ssl"
+	[ -n "$force_local_logins_ssl" ] && write_conf_bool "force_local_logins_ssl" "$force_local_logins_ssl"
+	[ -n "$ssl_tlsv1" ] && write_conf_bool "ssl_tlsv1" "$ssl_tlsv1"
+	[ -n "$ssl_sslv2" ] && write_conf_bool "ssl_sslv2" "$ssl_sslv2"
+	[ -n "$ssl_sslv3" ] && write_conf_bool "ssl_sslv3" "$ssl_sslv3"
+
+	[ -n "$anon_root" ] && write_conf "anon_root" "$anon_root"
+	[ -n "$ftpd_banner" ] && write_conf "ftpd_banner" "$ftpd_banner"
+	[ -n "$listen_port" ] && { write_conf "listen_port" "$listen_port"; PORT="$listen_port"; }
+	[ -n "$local_umask" ] && write_conf "local_umask" "$local_umask"
+	[ -n "$local_root" ] && write_conf "local_root" "$local_root"
+	[ -n "$rsa_cert_file" ] && write_conf "rsa_cert_file" "$rsa_cert_file"
+	[ -n "$rsa_private_key_file" ] && write_conf "rsa_private_key_file" "$rsa_private_key_file"
+	[ -n "$userlist_file" ] && write_conf "userlist_file" "$userlist_file"
+	[ -n "$xferlog_file" ] && write_conf "xferlog_file" "$xferlog_file"
+
+	if [ -n "$secure_chroot_dir" ] && [ "$secure_chroot_dir" != "$DEFAULT_SECURE_CHROOT" ]; then
+		# remove the DEFAULT_SECURE_CHROOT directory
+		# it is not needed now
+		rm -rf "$DEFAULT_SECURE_CHROOT"
+		write_conf "secure_chroot_dir" "$secure_chroot_dir"
+	fi
+
+	# move temporary file to the main configuration file
+	mv "$TEMP_OUTPUT_CONF" "$OUTPUT_CONF"
+}
+
+start_service() {
+	local disabled mdns conf_file
+
+	# Load UCI configuration for vsftpd
+	config_load vsftpd
+
+	# if disabled, just return
+	config_get_bool disabled global disabled 0
+	if [ "${disabled}" -eq 1 ]; then
+		return
+	fi
+
+	# clean and create the default chroot directory
+	rm -rf "$DEFAULT_SECURE_CHROOT"
+	mkdir -m 0755 -p "$DEFAULT_SECURE_CHROOT"
+	chown root:root "$DEFAULT_SECURE_CHROOT"
+
+	config_get conf_file global conf_file ""
+	if [ -n "$conf_file" ]; then 
+		# use user defined conf file instead of UCI
+		OUTPUT_CONF="$conf_file"
+	else
+		# Process the global configuration
+		config_foreach validate_vsftpd_section global setup_vsftpd
+	fi
+
+	procd_open_instance "vsftpd"
+
+	config_get_bool mdns global mdns 0
+	[ "${mdns}" -eq 1 ] && procd_add_mdns "ftp" "tcp" "$PORT" "daemon=vsftpd"
+
+	procd_set_param command "$BIN" "$OUTPUT_CONF"
+	procd_set_param respawn
+	procd_close_instance
+}
+
+service_triggers() {
+	procd_add_reload_trigger "vsftpd"
+	procd_add_validation validate_vsftpd_section
+}

vsftpd/files/vsftpd.uci

@@ -0,0 +1,50 @@
+
+config listen 'listen'
+	option enable4 '1'
+	option ipv4 '0.0.0.0'
+	option enable6 '0'
+	option ipv6 '::1'
+	option port '21'
+	option dataport '20'
+
+config local 'local'
+	option enabled '1'
+
+config global 'global'
+	option write '1'
+	option download '1'
+	option dotfile '0'
+	option umask '022'
+	option dirlist '1'
+	option dirmsgfile '.message'
+
+config connection 'connection'
+	option portmode '1'
+	option pasvmode '1'
+	option ascii 'both'
+	option idletimeout '1800'
+	option conntimeout '120'
+	option dataconntimeout '120'
+	option maxclient '0'
+	option maxperip '0'
+	option maxrate '0'
+	option maxretry '3'
+
+config anonymous 'anonymous'
+	option enabled '0'
+	option username 'ftp'
+	option root '/home/ftp'
+	option umask '022'
+	option writemkdir '0'
+	option upload '0'
+	option others '0'
+	option maxrate '0'
+
+config log 'log'
+	option syslog '0'
+	option xreflog '1'
+	option file '/var/log/vsftpd.log'
+
+config vuser 'vuser'
+	option enabled '0'
+	option username 'ftp'

vsftpd/files/vsftpd_prepare

@@ -0,0 +1,258 @@
+#!/bin/sh
+# Copyright (C) 2005-2016 Weijie Gao <hackpascal@gmail.com>
+
+. $IPKG_INSTROOT/lib/functions.sh
+
+output_field()
+{
+	local UCI_SECTION=$1
+	local KEY=$2
+	local INIFIELD=$3
+	local DEFVALUE=$4
+	local value
+
+	if [ -z "$INIFIELD" ]; then INIFIELD=$KEY; fi
+
+	config_get value "$UCI_SECTION" "$KEY"
+	if [ -z "$value" ]; then value=$DEFVALUE; fi
+
+	echo "$INIFIELD=$value" >> $CONF
+}
+
+output_bool()
+{
+	local UCI_SECTION=$1
+	local KEY=$2
+	local INIFIELD=$3
+	local DEFVALUE=$4
+	local value
+
+	if [ -z "$INIFIELD" ]; then INIFIELD=$KEY; fi
+
+	config_get value "$UCI_SECTION" "$KEY"
+	if [ -z "$value" ]; then value=$DEFVALUE; fi
+	if [ x"$value" != x0 ] && [ x"$value" != x1 ]; then value=0; fi
+
+	if [ "$value" == 0 ]; then
+		value=NO
+	else
+		value=YES
+	fi
+
+	echo "$INIFIELD=$value" >> $CONF
+}
+
+output_const()
+{
+	local INIFIELD=$1
+	local value=$2
+
+	echo "$INIFIELD=$value" >> $CONF
+}
+
+get_value()
+{
+	local UCI_SECTION=$1
+	local KEY=$2
+	local value
+
+	config_get value "$UCI_SECTION" "$KEY"
+
+	echo $value
+}
+
+vusers_iterate()
+{
+	local config=$1
+	local name
+	local password
+	local owner
+	local home
+	local _umask
+	local maxrate
+	local write_enable
+	local upload_enable
+	local mkdir_enable
+	local others_enable
+
+	config_get name "$config" username
+	config_get password "$config" password
+	config_get home "$config" home
+	config_get _umask "$config" "umask"
+	config_get maxrate "$config" maxrate
+	config_get write_enable "$config" writemkdir
+	config_get upload_enable "$config" upload
+	config_get others_enable "$config" others
+
+	config_get owner "vuser" username
+
+	rm -f $VUSER_CONF_DIR/$name
+	touch $VUSER_CONF_DIR/$name
+
+	if [ -z $home ]; then home=$CHROOT_DIR; fi
+
+	echo "local_root=$home" >> $VUSER_CONF_DIR/$name
+
+	if [ x$write_enable = x1 ]; then write_enable=YES; else write_enable=NO; fi
+	if [ x$upload_enable = x1 ]; then upload_enable=YES; else upload_enable=NO; fi
+	if [ x$others_enable = x1 ]; then others_enable=YES; else others_enable=NO; fi
+	if [ -z $_umask ]; then _umask=022; fi
+	if [ -z $maxrate ]; then maxrate=0; fi
+
+	echo "anon_world_readable_only=NO" >> $VUSER_CONF_DIR/$name
+	echo "anon_mkdir_write_enable=$write_enable" >> $VUSER_CONF_DIR/$name
+	echo "write_enable=$write_enable" >> $VUSER_CONF_DIR/$name
+	echo "anon_upload_enable=$upload_enable" >> $VUSER_CONF_DIR/$name
+	echo "anon_other_write_enable=$others_enable" >> $VUSER_CONF_DIR/$name
+	echo "anon_umask=$_umask" >> $VUSER_CONF_DIR/$name
+	echo "anon_max_rate=$maxrate" >> $VUSER_CONF_DIR/$name
+
+	if ! [ -d "$home" ]; then
+		mkdir -p $home
+		chown $owner:$owner $home
+		chmod -R a+w $home
+	fi
+}
+
+VAR=/var/run/vsftpd
+CONF=$VAR/vsftpd.conf
+VUSER_DB=$VAR/vusers
+VUSER_CONF_DIR=$VAR/users
+CHROOT_DIR=$VAR/empty
+
+rm -f $CONF
+rm -rf $VUSER_CONF_DIR $CHROOT_DIR
+
+mkdir -m 0755 -p $VAR
+mkdir -p $VUSER_CONF_DIR
+mkdir -p $CHROOT_DIR
+
+config_load vsftpd
+
+# listen
+output_const "background" YES
+output_field listen port "listen_port" 21
+output_field listen dataport "ftp_data_port" 20
+output_field listen pasv_min_port "pasv_min_port" 50000
+output_field listen pasv_max_port "pasv_max_port" 51000
+
+# global
+output_bool global 'write' "write_enable" 1
+output_bool global download "download_enable" 1
+output_bool global dirlist "dirlist_enable" 1
+output_bool global lsrecurse "ls_recurse_enable"
+output_bool global dotfile "force_dot_files"
+output_field global 'umask' "local_umask" 022
+
+ftpd_banner=`get_value global banner`
+if ! [ -z $ftpd_banner ]; then
+	output_const "ftpd_banner" $ftpd_banner
+fi
+
+output_bool global dirmessage "dirmessage_enable"
+output_field global dirmsgfile "message_file" ".message"
+
+# connection
+output_bool connection portmode "port_enable" 1
+output_bool connection pasvmode "pasv_enable" 1
+
+ascii_download_enable=NO
+ascii_upload_enable=NO
+case `get_value connection ascii` in
+download)
+	ascii_download_enable=YES
+;;
+upload)
+	ascii_upload_enable=YES
+;;
+both)
+	ascii_download_enable=YES
+	ascii_upload_enable=YES
+esac
+output_const "ascii_download_enable" $ascii_download_enable
+output_const "ascii_upload_enable" $ascii_upload_enable
+
+output_field connection idletimeout "idle_session_timeout" 1800
+output_field connection conntimeout "connect_timeout" 120
+output_field connection dataconntimeout "data_connection_timeout" 120
+output_field connection maxclient "max_clients" 0
+output_field connection maxperip "max_per_ip" 0
+output_field connection maxrate "local_max_rate" 0
+
+max_login_fails=`get_value connection maxretry`
+if [ -z $max_login_fails ] || [ $max_login_fails -lt 1 ]; then max_login_fails=3; fi
+output_const "max_login_fails" $max_login_fails
+
+# anonymous
+ftp_username=`get_value anonymous ftp_username`
+if [ -z $ftp_username ]; then ftp_username="ftp"; fi
+output_const "ftp_username" $ftp_username
+
+mkdir -m 0755 -p /home/$ftp_username
+chown $ftp_username:$ftp_username /home/$ftp_username
+
+output_const "anon_world_readable_only" NO
+
+anon_enable=`get_value anonymous enabled`
+if [ x$anon_enable = x1 ]; then
+	anon_root=`get_value anonymous root`
+	if [ -z $anon_root ]; then anon_root="/home/ftp"; fi
+
+	output_const "anonymous_enable" YES
+	output_const "no_anon_password" YES
+	output_const "anon_root" $anon_root
+	output_field anonymous 'umask' "anon_umask" 022
+	output_field anonymous maxrate "anon_max_rate" 0
+	output_bool anonymous writemkdir "anon_mkdir_write_enable" 0
+	output_bool anonymous upload "anon_upload_enable" 0
+	output_bool anonymous others "anon_other_write_enable" 0
+
+	mkdir -p $anon_root
+	chown -R $ftp_username:$ftp_username $anon_root
+else
+	output_const "anonymous_enable" NO
+fi
+
+# log
+output_bool log syslog "syslog_enable" 0
+output_bool log xreflog "xferlog_enable" 0
+output_field log 'file' "vsftpd_log_file" 0
+
+# users
+vuser_enabled=0
+if [ x`get_value vuser enabled` = x1 ]; then
+	vuser_enabled=1
+
+	output_const "guest_enable" YES
+	output_field vuser username "guest_username" ftp
+
+	output_const "uci_config_name" vsftpd
+	output_const "user_config_dir" "/var/run/vsftpd/users"
+
+	config_foreach vusers_iterate user
+fi
+
+# local user
+output_const "allow_writeable_chroot" YES
+output_const "secure_chroot_dir" $CHROOT_DIR
+
+local_root=$(get_value 'local' root)
+if ! [ -z $local_root ]; then
+	output_const "local_root" $local_root
+fi
+
+local_enable=`get_value 'local' enabled`
+if [ x$local_enable = x1 ]; then
+	output_const "local_enable" YES
+else
+	if [ $vuser_enabled = 1 ]; then
+		output_const "local_enable" YES
+	else
+		output_const "local_enable" NO
+	fi
+fi
+
+output_const "seccomp_sandbox" NO
+output_const "use_localtime" YES
+output_const "check_shell" NO
+exit 0

vsftpd/files/vsftpd_wrapper

@@ -0,0 +1,49 @@
+#!/bin/sh
+# Copyright (C) 2005-2016 Weijie Gao <hackpascal@gmail.com>
+
+. $IPKG_INSTROOT/lib/functions.sh
+
+VAR=/var/run/vsftpd
+CONF=$VAR/vsftpd.conf
+listen_addr=
+enabled=
+param=""
+listen4=
+listen6=
+protocol=$1
+
+config_load vsftpd
+
+if ! [ -f $CONF ]; then
+	echo "/usr/bin/vsftpd_prepare must be executed before this script"
+	exit 1
+fi
+
+case $protocol in
+ipv6)
+	config_get enabled listen enable6
+
+	if [ x$enabled != x1 ]; then exit 0; fi
+
+	config_get listen_addr listen ipv6
+	param="6"
+	listen4="-olisten=NO"
+	listen6="-olisten_ipv6=YES"
+
+	if [ -z $listen_addr ]; then listen_addr="::"; fi
+;;
+*)
+	config_get enabled listen enable4
+
+	if [ x$enabled != x1 ]; then exit 0; fi
+
+	config_get listen_addr listen ipv4
+	listen4="-olisten=YES"
+	listen6="-olisten_ipv6=NO"
+
+	if [ -z $listen_addr ]; then listen_addr="0.0.0.0"; fi
+esac
+
+exec /usr/sbin/vsftpd "-olisten_address${param}=${listen_addr}" ${listen4} ${listen6} $CONF
+
+exit 1

vsftpd/patches/001-destdir.patch

@@ -0,0 +1,47 @@
+--- a/Makefile
++++ b/Makefile
+@@ -22,6 +22,8 @@ OBJS	=	main.o utility.o prelogin.o ftpcm
+     seccompsandbox.o
+ 
+ 
++DESTDIR =
++
+ .c.o:
+ 	$(CC) -c $*.c $(CFLAGS) $(IFLAGS)
+ 
+@@ -29,21 +31,20 @@ vsftpd: $(OBJS)
+ 	$(CC) -o vsftpd $(OBJS) $(LINK) $(LDFLAGS) $(LIBS)
+ 
+ install:
+-	if [ -x /usr/local/sbin ]; then \
+-		$(INSTALL) -m 755 vsftpd /usr/local/sbin/vsftpd; \
+-	else \
+-		$(INSTALL) -m 755 vsftpd /usr/sbin/vsftpd; fi
+-	if [ -x /usr/local/man ]; then \
+-		$(INSTALL) -m 644 vsftpd.8 /usr/local/man/man8/vsftpd.8; \
+-		$(INSTALL) -m 644 vsftpd.conf.5 /usr/local/man/man5/vsftpd.conf.5; \
+-	elif [ -x /usr/share/man ]; then \
+-		$(INSTALL) -m 644 vsftpd.8 /usr/share/man/man8/vsftpd.8; \
+-		$(INSTALL) -m 644 vsftpd.conf.5 /usr/share/man/man5/vsftpd.conf.5; \
+-	else \
+-		$(INSTALL) -m 644 vsftpd.8 /usr/man/man8/vsftpd.8; \
+-		$(INSTALL) -m 644 vsftpd.conf.5 /usr/man/man5/vsftpd.conf.5; fi
+-	if [ -x /etc/xinetd.d ]; then \
+-		$(INSTALL) -m 644 xinetd.d/vsftpd /etc/xinetd.d/vsftpd; fi
++	mkdir -p $(DESTDIR)/usr/sbin
++	$(INSTALL) -m 755 vsftpd $(DESTDIR)/usr/sbin/
++	mkdir -p $(DESTDIR)/usr/share/man/man8
++	$(INSTALL) -m 644 vsftpd.8 $(DESTDIR)/usr/share/man/man8/
++	mkdir -p $(DESTDIR)/usr/share/man/man5
++	$(INSTALL) -m 644 vsftpd.conf.5 $(DESTDIR)/usr/share/man/man5/
++	mkdir -p $(DESTDIR)/etc/xinetd.d
++	$(INSTALL) -m 644 xinetd.d/vsftpd $(DESTDIR)/etc/xinetd.d/
++
++uninstall:
++	rm -f $(DESTDIR)/usr/sbin/vsftpd
++	rm -f $(DESTDIR)/usr/share/man/man8/vsftpd.8
++	rm -f $(DESTDIR)/usr/share/man/man5/vsftpd.conf.5
++	rm -f $(DESTDIR)/etc/xinetd.d/vsftpd
+ 
+ clean:
+ 	rm -f *.o *.swp vsftpd

vsftpd/patches/002-find_libs.patch

@@ -0,0 +1,13 @@
+--- a/Makefile
++++ b/Makefile
+@@ -8,8 +8,8 @@ CFLAGS	=	-O2 -fPIE -fstack-protector --p
+ 	-D_FORTIFY_SOURCE=2 \
+ 	#-pedantic -Wconversion
+ 
+-LIBS	=	`./vsf_findlibs.sh`
+-LINK	=	-Wl,-s
++LIBS	=	-lcrypt -lnsl -luci
++LINK	=
+ LDFLAGS	=	-fPIE -pie -Wl,-z,relro -Wl,-z,now
+ 
+ OBJS	=	main.o utility.o prelogin.o ftpcmdio.o postlogin.o privsock.o \

vsftpd/patches/003-chroot.patch

@@ -0,0 +1,11 @@
+--- a/tunables.c
++++ b/tunables.c
+@@ -261,7 +261,7 @@ tunables_load_defaults()
+   /* -rw------- */
+   tunable_chown_upload_mode = 0600;
+ 
+-  install_str_setting("/usr/share/empty", &tunable_secure_chroot_dir);
++  install_str_setting("/var/run/vsftpd", &tunable_secure_chroot_dir);
+   install_str_setting("ftp", &tunable_ftp_username);
+   install_str_setting("root", &tunable_chown_username);
+   install_str_setting("/var/log/xferlog", &tunable_xferlog_file);

vsftpd/patches/004-disable-capabilities.patch

@@ -0,0 +1,12 @@
+--- a/sysdeputil.c
++++ b/sysdeputil.c
+@@ -165,6 +165,9 @@
+ #endif
+ /* END config */
+ 
++#undef VSF_SYSDEP_HAVE_CAPABILITIES
++#undef VSF_SYSDEP_HAVE_LIBCAP
++
+ /* PAM support - we include our own dummy version if the system lacks this */
+ #include <security/pam_appl.h>
+ 

vsftpd/patches/005-disable-pam.patch

@@ -0,0 +1,11 @@
+--- a/builddefs.h
++++ b/builddefs.h
+@@ -2,7 +2,7 @@
+ #define VSF_BUILDDEFS_H
+ 
+ #undef VSF_BUILD_TCPWRAPPERS
+-#define VSF_BUILD_PAM
++#undef VSF_BUILD_PAM
+ #undef VSF_BUILD_SSL
+ 
+ #endif /* VSF_BUILDDEFS_H */

vsftpd/patches/006-musl-compatibility.patch

@@ -0,0 +1,13 @@
+--- a/sysdeputil.c
++++ b/sysdeputil.c
+@@ -58,7 +58,9 @@
+ #define VSF_SYSDEP_HAVE_SHADOW
+ #define VSF_SYSDEP_HAVE_USERSHELL
+ #define VSF_SYSDEP_HAVE_LIBCAP
+-#define VSF_SYSDEP_HAVE_UTMPX
++#if defined(__GLIBC__) || defined(__UCLIBC__)
++  #define VSF_SYSDEP_HAVE_UTMPX
++#endif
+ 
+ #define __USE_GNU
+ #include <utmpx.h>

vsftpd/patches/007-CVE-2015-1419.patch

@@ -0,0 +1,98 @@
+Description: CVE-2015-1419: config option deny_file is not handled correctly
+Author: Marcus Meissner <meissner@suse.com>
+Origin: https://bugzilla.novell.com/show_bug.cgi?id=CVE-2015-1419
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776922
+Last-Update: 2015-02-24
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/ls.c
++++ b/ls.c
+@@ -7,6 +7,7 @@
+  * Would you believe, code to handle directory listing.
+  */
+ 
++#include <stdlib.h>
+ #include "ls.h"
+ #include "access.h"
+ #include "defs.h"
+@@ -243,11 +244,42 @@ vsf_filename_passes_filter(const struct
+   struct mystr temp_str = INIT_MYSTR;
+   struct mystr brace_list_str = INIT_MYSTR;
+   struct mystr new_filter_str = INIT_MYSTR;
++  struct mystr normalize_filename_str = INIT_MYSTR;
++  const char *normname;
++  const char *path;
+   int ret = 0;
+   char last_token = 0;
+   int must_match_at_current_pos = 1;
++
+   str_copy(&filter_remain_str, p_filter_str);
+-  str_copy(&name_remain_str, p_filename_str);
++
++  /* normalize filepath */
++  path = str_strdup(p_filename_str);
++  normname = realpath(path, NULL);
++  if (normname == NULL)
++     goto out;
++  str_alloc_text(&normalize_filename_str, normname);
++
++  if (!str_isempty (&filter_remain_str) && !str_isempty(&normalize_filename_str)) {
++    if (str_get_char_at(p_filter_str, 0) == '/') {
++      if (str_get_char_at(&normalize_filename_str, 0) != '/') {
++        str_getcwd (&name_remain_str);
++
++        if (str_getlen(&name_remain_str) > 1) /* cwd != root dir */
++          str_append_char (&name_remain_str, '/');
++
++        str_append_str (&name_remain_str, &normalize_filename_str);
++      }
++      else
++       str_copy (&name_remain_str, &normalize_filename_str);
++    } else {
++      if (str_get_char_at(p_filter_str, 0) != '{')
++        str_basename (&name_remain_str, &normalize_filename_str);
++      else
++        str_copy (&name_remain_str, &normalize_filename_str);
++    }
++  } else
++    str_copy(&name_remain_str, &normalize_filename_str);
+ 
+   while (!str_isempty(&filter_remain_str) && *iters < VSFTP_MATCHITERS_MAX)
+   {
+@@ -360,6 +392,9 @@ vsf_filename_passes_filter(const struct
+     ret = 0;
+   }
+ out:
++  free(normname);
++  free(path);
++  str_free(&normalize_filename_str);
+   str_free(&filter_remain_str);
+   str_free(&name_remain_str);
+   str_free(&temp_str);
+--- a/str.c
++++ b/str.c
+@@ -711,3 +711,14 @@ str_replace_unprintable(struct mystr* p_
+   }
+ }
+ 
++void
++str_basename (struct mystr* d_str, const struct mystr* path)
++{
++  static struct mystr tmp;
++
++  str_copy (&tmp, path);
++  str_split_char_reverse(&tmp, d_str, '/');
++
++  if (str_isempty(d_str))
++   str_copy (d_str, path);
++}
+--- a/str.h
++++ b/str.h
+@@ -100,6 +100,7 @@ void str_replace_unprintable(struct myst
+ int str_atoi(const struct mystr* p_str);
+ filesize_t str_a_to_filesize_t(const struct mystr* p_str);
+ unsigned int str_octal_to_uint(const struct mystr* p_str);
++void str_basename (struct mystr* d_str, const struct mystr* path);
+ 
+ /* PURPOSE: Extract a line of text (delimited by \n or EOF) from a string
+  * buffer, starting at character position 'p_pos'. The extracted line will

vsftpd/patches/010-openssl-deprecated.patch

@@ -0,0 +1,61 @@
+From 0ea55455703eb69d7617968424e4bede59f39b83 Mon Sep 17 00:00:00 2001
+From: Rosen Penev <rosenp@gmail.com>
+Date: Fri, 23 Nov 2018 18:03:32 -0800
+Subject: [PATCH] ssl: Fix compile without Deprecated APIs and no ECC support
+
+Signed-off-by: Rosen Penev <rosenp@gmail.com>
+---
+ ssl.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/ssl.c
++++ b/ssl.c
+@@ -28,6 +28,9 @@
+ #include <openssl/err.h>
+ #include <openssl/rand.h>
+ #include <openssl/bio.h>
++#ifndef OPENSSL_NO_EC
++#include <openssl/ec.h>
++#endif
+ #include <errno.h>
+ #include <limits.h>
+ 
+@@ -66,8 +69,12 @@ ssl_init(struct vsf_session* p_sess)
+     SSL_CTX* p_ctx;
+     long options;
+     int verify_option = 0;
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+     SSL_library_init();
+     p_ctx = SSL_CTX_new(SSLv23_server_method());
++#else
++    p_ctx = SSL_CTX_new(TLS_server_method());
++#endif
+     if (p_ctx == NULL)
+     {
+       die("SSL: could not allocate SSL context");
+@@ -139,6 +146,7 @@ ssl_init(struct vsf_session* p_sess)
+     {
+       die("SSL: RNG is not seeded");
+     }
++#ifndef OPENSSL_NO_EC
+     {
+       EC_KEY* key = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
+       if (key == NULL)
+@@ -148,6 +156,7 @@ ssl_init(struct vsf_session* p_sess)
+       SSL_CTX_set_tmp_ecdh(p_ctx, key);
+       EC_KEY_free(key);
+     }
++#endif
+     if (tunable_ssl_request_cert)
+     {
+       verify_option |= SSL_VERIFY_PEER;
+@@ -685,7 +694,9 @@ ssl_cert_digest(SSL* p_ssl, struct vsf_s
+ static char*
+ get_ssl_error()
+ {
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+   SSL_load_error_strings();
++#endif
+   return ERR_error_string(ERR_get_error(), NULL);
+ }
+ 

vsftpd/patches/100-add-uci-auth-support.patch

@@ -0,0 +1,127 @@
+--- a/parseconf.c
++++ b/parseconf.c
+@@ -182,6 +182,7 @@ parseconf_str_array[] =
+   { "dsa_private_key_file", &tunable_dsa_private_key_file },
+   { "ca_certs_file", &tunable_ca_certs_file },
+   { "ssl_sni_hostname", &tunable_ssl_sni_hostname },
++  { "uci_config_name", &tunable_uci_config_name },
+   { "cmds_denied", &tunable_cmds_denied },
+   { 0, 0 }
+ };
+--- a/sysdeputil.c
++++ b/sysdeputil.c
+@@ -180,6 +180,8 @@
+ #include <pwd.h>
+ #include <unistd.h>
+ #include <crypt.h>
++/* Include uci headers */
++#include <uci.h>
+ #endif
+ 
+ /* Prefer libcap based capabilities over raw syscall capabilities */
+@@ -242,14 +244,24 @@ void vsf_insert_uwtmp(const struct mystr
+ void vsf_remove_uwtmp(void);
+ 
+ #ifndef VSF_SYSDEP_HAVE_PAM
++static int
++vsf_sysdep_check_auth_uci(struct mystr* p_user_str,
++                      const struct mystr* p_pass_str);
++
+ int
+ vsf_sysdep_check_auth(struct mystr* p_user_str,
+                       const struct mystr* p_pass_str,
+                       const struct mystr* p_remote_host)
+ {
+   const char* p_crypted;
+-  const struct passwd* p_pwd = getpwnam(str_getbuf(p_user_str));
++  const struct passwd* p_pwd;
+   (void) p_remote_host;
++
++  /* Try UCI first */
++  if (vsf_sysdep_check_auth_uci(p_user_str, p_pass_str))
++    return 1;
++
++  p_pwd = getpwnam(str_getbuf(p_user_str));
+   if (p_pwd == NULL)
+   {
+     return 0;
+@@ -305,6 +317,51 @@ vsf_sysdep_check_auth(struct mystr* p_us
+   return 0;
+ }
+ 
++static int
++vsf_sysdep_check_auth_uci(struct mystr* p_user_str,
++                      const struct mystr* p_pass_str)
++{
++  struct uci_context *uctx;
++  struct uci_package *pkg = NULL;
++  struct uci_element *e = NULL;
++  struct uci_section *s;
++  const char *user, *passwd;
++  int ret = 0;
++
++  if (!tunable_uci_config_name)
++    return 0;
++
++  uctx = uci_alloc_context();
++  if (!uctx)
++    return 0;
++
++  if (uci_load(uctx, tunable_uci_config_name, &pkg) != UCI_OK)
++    goto cleanup;
++
++  uci_foreach_element(&pkg->sections, e)
++  {
++    s = uci_to_section(e);
++    if (!(user = uci_lookup_option_string(uctx, s, "username")))
++      continue;
++    if (vsf_sysutil_strcmp(user, str_getbuf(p_user_str)))
++      continue;
++    if (!(passwd = uci_lookup_option_string(uctx, s, "password")))
++      continue;
++    if (!vsf_sysutil_strcmp(passwd, str_getbuf(p_pass_str)))
++    {
++      ret = 1;
++      break;
++    }
++  }
++
++cleanup:
++  if (pkg)
++    uci_unload(uctx, pkg);
++  uci_free_context(uctx);
++
++  return ret;
++}
++
+ #else /* VSF_SYSDEP_HAVE_PAM */
+ 
+ #if (defined(__sun) || defined(__hpux)) && \
+--- a/tunables.c
++++ b/tunables.c
+@@ -146,6 +146,7 @@ const char* tunable_rsa_private_key_file
+ const char* tunable_dsa_private_key_file;
+ const char* tunable_ca_certs_file;
+ const char* tunable_ssl_sni_hostname;
++const char* tunable_uci_config_name;
+ 
+ static void install_str_setting(const char* p_value, const char** p_storage);
+ 
+@@ -296,6 +297,7 @@ tunables_load_defaults()
+   install_str_setting(0, &tunable_dsa_private_key_file);
+   install_str_setting(0, &tunable_ca_certs_file);
+   install_str_setting(0, &tunable_ssl_sni_hostname);
++  install_str_setting(0, &tunable_uci_config_name);
+ }
+ 
+ void
+--- a/tunables.h
++++ b/tunables.h
+@@ -148,6 +148,7 @@ extern const char* tunable_rsa_private_k
+ extern const char* tunable_dsa_private_key_file;
+ extern const char* tunable_ca_certs_file;
+ extern const char* tunable_ssl_sni_hostname;
++extern const char* tunable_uci_config_name;
+ extern const char* tunable_cmds_denied;
+ 
+ #endif /* VSF_TUNABLES_H */

vsftpd/patches/101-enable-chroot-on-writable-dir.patch

@@ -0,0 +1,19 @@
+--- a/secutil.c
++++ b/secutil.c
+@@ -129,16 +129,5 @@ vsf_secutil_change_credentials(const str
+   {
+     vsf_sysutil_set_no_procs();
+   }
+-  /* Misconfiguration check: don't ever chroot() to a directory writable by
+-   * the current user.
+-   */
+-  if ((options & VSF_SECUTIL_OPTION_CHROOT) &&
+-      !(options & VSF_SECUTIL_OPTION_ALLOW_WRITEABLE_ROOT))
+-  {
+-    if (vsf_sysutil_write_access("/"))
+-    {
+-      die("vsftpd: refusing to run with writable root inside chroot()");
+-    }
+-  }
+ }
+ 

vsftpd/patches/102-keep-local-user-rights.patch

@@ -0,0 +1,11 @@
+--- a/twoprocess.c
++++ b/twoprocess.c
+@@ -426,7 +426,7 @@ common_do_login(struct vsf_session* p_se
+      */
+     vsf_set_die_if_parent_dies();
+     priv_sock_set_child_context(p_sess);
+-    if (tunable_guest_enable && !anon)
++    if (tunable_guest_enable && !anon && !str_getpwnam(p_user_str))
+     {
+       p_sess->is_guest = 1;
+       /* Remap to the guest user */