Commit 2c22fece authored by Daniel Stenberg's avatar Daniel Stenberg
Browse files

fixes from Gisle Vanem to try 'AUTH SSL' before 'AUTH TLS', edited by me

parent 41688a16

lib/ftp.c

+31 −20
Original line number Diff line number Diff line
@@ -405,6 +405,10 @@ CURLcode Curl_GetFTPResponse(ssize_t *nreadp, /* return number of bytes read */ 
  return result;

}



static char *ftpauth[]= {

  "SSL", "TLS", NULL

};



/*

 * Curl_ftp_connect() should do everything that is to be considered a part of

 * the connection phase.
@@ -417,7 +421,7 @@ CURLcode Curl_ftp_connect(struct connectdata *conn) 
  char *buf = data->state.buffer; /* this is our buffer */

  struct FTP *ftp;

  CURLcode result;

  int ftpcode;

  int ftpcode, try;



  ftp = (struct FTP *)malloc(sizeof(struct FTP));

  if(!ftp)
@@ -453,7 +457,6 @@ CURLcode Curl_ftp_connect(struct connectdata *conn) 
      return result;

  }





  /* The first thing we do is wait for the "220*" line: */

  result = Curl_GetFTPResponse(&nread, conn, &ftpcode);

  if(result)
@@ -483,10 +486,14 @@ CURLcode Curl_ftp_connect(struct connectdata *conn) 
#endif



  if(data->set.ftp_ssl && !conn->ssl[FIRSTSOCKET].use) {

    /* we don't have a ssl connection, try a FTPS connection now */

    FTPSENDF(conn, "AUTH TLS", NULL);

    /* we don't have a SSL/TLS connection, try a FTPS connection now */



    for (try = 0; ftpauth[try]; try++) {



      FTPSENDF(conn, "AUTH %s", ftpauth[try]);



      result = Curl_GetFTPResponse(&nread, conn, &ftpcode);



      if(result)

        return result;
@@ -494,15 +501,17 @@ CURLcode Curl_ftp_connect(struct connectdata *conn) 
       *

       * If the server is willing to accept the named security mechanism, and

       * does not require any security data, it must respond with reply code

     * 234.

       * 234/334.

       */



    if(234 == ftpcode) {

      if((ftpcode == 234) || (ftpcode == 334)) {

        result = Curl_SSLConnect(conn, FIRSTSOCKET);

        if(result)

          return result;

        conn->protocol |= PROT_FTPS;

        conn->ssl[SECONDARYSOCKET].use = FALSE; /* clear-text data */

        break;

      }

    }

  }
@@ -549,6 +558,7 @@ CURLcode Curl_ftp_connect(struct connectdata *conn) 
    /* 230 User ... logged in.

       (the user logged in without password) */

    infof(data, "We have successfully logged in\n");

    if (conn->ssl[FIRSTSOCKET].use) {

#ifdef KRB4

	/* we are logged in (with Kerberos)

	 * now set the requested protection level
@@ -565,6 +575,7 @@ CURLcode Curl_ftp_connect(struct connectdata *conn) 
        return result;

    }

#endif

  }

  }

  else {

    failf(data, "Odd return code after USER");
@@ -1759,7 +1770,7 @@ CURLcode Curl_ftp_nextconnect(struct connectdata *conn) 
    if(conn->ssl[SECONDARYSOCKET].use) {

      /* since we only have a plaintext TCP connection here, we must now

	 do the TLS stuff */

      infof(data, "Doing the SSL/TSL handshake on the data stream\n");

      infof(data, "Doing the SSL/TLS handshake on the data stream\n");

      result = Curl_SSLConnect(conn, SECONDARYSOCKET);

      if(result)

	return result;
@@ -2024,7 +2035,7 @@ CURLcode Curl_ftp_nextconnect(struct connectdata *conn) 
      if(conn->ssl[SECONDARYSOCKET].use) {

	/* since we only have a plaintext TCP connection here, we must now

	   do the TLS stuff */

	infof(data, "Doing the SSL/TSL handshake on the data stream\n");

	infof(data, "Doing the SSL/TLS handshake on the data stream\n");

	result = Curl_SSLConnect(conn, SECONDARYSOCKET);

	if(result)

	  return result;
@@ -2220,7 +2231,7 @@ CURLcode ftp_perform(struct connectdata *conn, 
  else {

    /* We have chosen (this is default) to use the PASV command */

    result = ftp_use_pasv(conn, connected);

    if(!result && *connected)

    if(CURLE_OK == result && *connected)

      infof(data, "Connected the data stream with PASV!\n");

  }