Subj : src/sbbs3/ftpsrvr.c
To   : Git commit to main/sbbs/master
From : Rob Swindell (on Windows)
Date : Thu Apr 13 2023 18:45:54

https://gitlab.synchro.net/main/sbbs/-/commit/3e2c3176de6108c697d25a69
Modified Files:
	src/sbbs3/ftpsrvr.c
Log Message:
Fix false "SUSPECTED BOUNCE ATTACK ATTEMPT" for IPv6 FTP-data connectionsThis bug only impacted non-passive FTP connections. Using an FTP clientwith active (not passive) data connections over an IPv6 connection wouldfalse-trigger the "bounce attack" detection and the FTP server responded with"504 Bad port number" and logged a hack attempt in data/hack.log.The issue was that we were comparing the socket address structure (whichcontains other fields besides the address itself) between the control andproposed-data connections. While this logic worked okay for IPv4,it did not for IPv6 (the 2 structs contained some non-address differences).Rather than modify the socket address structures to match where needed, I'mjust comparing the string representation of the addresses, since that'swhat we really care about anyway.Thank to "mark i" of Truck Stop BBS for alerting me to this issue
--- SBBSecho 3.20-Linux
 * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

.