Based on PR pkg/22680 by Jon Olsson. Changes: - add new build-time options: PURE_FTPD_USE_TLS, PURE_FTPD_USE_VIRTUAL_CHROOT - make the MySQL support actually work - install more documentation 1.0.16a: ======== - Fix typo (sizeof_resolved instead of sizeof resolved) in src/bsd-realpath.c Not a vulnerability because it happens in the good way, but it sometimes used to break uploadscript. 1.0.16: ======= - An obsolete comment in pure-ftpd.conf was fixed : RPMs don't parse /etc/sysconf/pure-ftpd any more. - Recognize the '##' prefix as a shadowed password - make authentication work on Solaris with shadow/NIS. - Add back some random sleep() between authentication failures in addition to the exponential sleep. Zzzzz... sleeping is good in summer... - Upgrade to automake 1.7.5. - The list of options in the pure-ftpd(8) man page was reordered - Thanks to our beloved Claudiu Costin. - SSL/TLS support was added (bits in src/{ftpd.c,ftp_parser.c,tls.c,tls.h, configure.ac}, new doc: README.TLS, new globals: tls_ctx, tls_cnx). New related commands were introduced : AUTH, PBSZ and PROT. - Uploaded files are now removed when realpath() fails and bsd_realpath() was modified to fall back to getcwd()/chdir() if we can't get a descriptor on the current directory because it is not readable. It fixes pure-uploadscript on some platforms like MacOS X. - HAVE_BROKEN_REALPATH is gone. USE_BUILTIN_REALPATH is born. - A typo in the Python configuration file wrapper was fixed : -t was used in place of -y. - MacOS X Panther has a lousy getnameinfo() implementation that doesn't fill the buffer when no DNS entry is found for a host and a numerical result wasn't explicitely asked. As a result, Pure-FTPd didn't even start on Panther (saying "bad IP address") . We now check for EAI_NONAME if available and we retry with NI_NUMERICHOST if this is what getnameinfo() returns. Thanks to Yann Bizeul for his valuable help on this issue. - Implement a working strdup() replacement in puredb for systems lacking it. - Some MAXPATHLEN / MAXPATHLEN + 1 cleanups. Basically when paths are generated by our own functions, we use MAXPATHLEN for the complete zero-terminated string. When a buffer is passed to a libc function, we reserve a MAXPATHLEN + 1 buffer and give a MAXPATHLEN size, just to avoid bad surprises if an off-by-one ever occurs in a getcwd() like function. - Don't use make_scrambled_password() in the MySQL backend because the API changed since MySQL 4.1. - Removed fixed-size constant arrays in src/crypto.c because of MacOS X linker bugs (grrr...) .