防止sql注入-使用Ubuntu架设ftp服务器-[网络编程]socket创建流程

当前位置: 建站>运营/SEO

本页文章导读:

▪防止sql注入 1：对于字符串可以用addslashes（）这个函数; 2：对于数字可以使用运算符乘法，例如$num = $num * 1; 作者：ll3527 发表于2013-4-19 16:04:41 原文链接阅读：54 评论：0 查看评论 ......

▪使用Ubuntu架设ftp服务器架设环境： Ubuntu版本：12.04.2 首先，参考Ubuntu10.04架设FTP Server的文档。然后，执行如下操作： 1. 安装vsftpd root@tdtc010-Vostr.........

▪[网络编程]socket创建流程今天分析下socket的创建流程关于用户态socket如何通过系统调用进入内核态到sys_socke，这里就不再分析，直接看内核态socket入口 SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol) { &nbs.........

[1]防止sql注入

来源: 互联网发布时间: 2013-10-27

1：对于字符串可以用addslashes（）这个函数;

2：对于数字可以使用运算符乘法，例如$num = $num * 1;

作者：ll3527 发表于2013-4-19 16:04:41 原文链接

阅读：54 评论：0 查看评论

[2]使用Ubuntu架设ftp服务器

来源: 互联网发布时间: 2013-10-27

架设环境：

Ubuntu版本：12.04.2

首先，参考Ubuntu10.04架设FTP Server的文档。

然后，执行如下操作：

1. 安装vsftpd

root@tdtc010-Vostro-270:~# apt-get install vsftpd

2. 允许上传

local_enable=YES
write_enable=YES

3. 允许匿名上传

non_upload_enable=YES

至此vsftpd安装完毕。

我们在windows客户端使用FileZilla工具，当前版本为3.6.0.2。

执行“快速连接”

提示错误信息：553 Could not create file

说明我们没有ftp服务器目录权限，新建一个目录即可。

root@tdtc010-Vostro-270:/srv/ftp# mkdir upload_xp

赋予权限

root@tdtc010-Vostro-270:/srv/ftp# chown ftp:root /srv/ftp/upload_xp

再次，在FileZilla执行上传，显示成功：

状态:	已连接
状态:	开始上传 D:\360Downloads\perl-5.16.3.tar.gz
命令:	CWD /upload_xp
响应:	250 Directory successfully changed.
命令:	TYPE I
响应:	200 Switching to Binary mode.
命令:	PASV
响应:	227 Entering Passive Mode (192,168,1,101,232,175).
命令:	STOR perl-5.16.3.tar.gz
响应:	150 Ok to send data.
响应:	226 Transfer complete.
状态:	文件传输成功，传输了 16,930,885 字节 (用时58 秒)

全文完。

注意：此配置只适合于局域网/企业网。

-----------------------------------------------------哈尔滨泰达天成公司---------------------------------

附：

1. 终端操作过程（仅供参考）

tdtc010@tdtc010-Vostro-270:~$ su - root
Password: 
root@tdtc010-Vostro-270:~# apt-get install vsftpd
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following NEW packages will be installed:
  vsftpd
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 124 kB of archives.
After this operation, 342 kB of additional disk space will be used.
Get:1 http://cn.archive.ubuntu.com/ubuntu/ precise/main vsftpd amd64 2.3.5-1ubuntu2 [124 kB]
Fetched 124 kB in 0s (153 kB/s)
Preconfiguring packages ...
Selecting previously unselected package vsftpd.
(Reading database ... 168616 files and directories currently installed.)
Unpacking vsftpd (from .../vsftpd_2.3.5-1ubuntu2_amd64.deb) ...
Processing triggers for man-db ...
Processing triggers for ureadahead ...
ureadahead will be reprofiled on next reboot
Setting up vsftpd (2.3.5-1ubuntu2) ...
vsftpd start/running, process 2519
root@tdtc010-Vostro-270:~# cd /srv/ftp
root@tdtc010-Vostro-270:/srv/ftp# ls
root@tdtc010-Vostro-270:/srv/ftp# /etc/init.d/vsftpd restart
Rather than invoking init scripts through /etc/init.d, use the service(8)
utility, e.g. service vsftpd restart

Since the script you are attempting to invoke has been converted to an
Upstart job, you may also use the stop(8) and then start(8) utilities,
e.g. stop vsftpd ; start vsftpd. The restart(8) utility is also available.
vsftpd stop/waiting
vsftpd start/running, process 2566
root@tdtc010-Vostro-270:/srv/ftp# gedit /etc/vsftpd.conf

(gedit:2574): GLib-GIO-WARNING **: Missing callback called fullpath = /root/.local/share/recently-used.xbel

root@tdtc010-Vostro-270:/srv/ftp# /etc/init.d/vsftpd restart
Rather than invoking init scripts through /etc/init.d, use the service(8)
utility, e.g. service vsftpd restart

Since the script you are attempting to invoke has been converted to an
Upstart job, you may also use the stop(8) and then start(8) utilities,
e.g. stop vsftpd ; start vsftpd. The restart(8) utility is also available.
vsftpd stop/waiting
vsftpd start/running, process 2631
root@tdtc010-Vostro-270:/srv/ftp# gedit /etc/vsftpd.conf
root@tdtc010-Vostro-270:/srv/ftp# /etc/init.d/vsftpd restart
Rather than invoking init scripts through /etc/init.d, use the service(8)
utility, e.g. service vsftpd restart

Since the script you are attempting to invoke has been converted to an
Upstart job, you may also use the stop(8) and then start(8) utilities,
e.g. stop vsftpd ; start vsftpd. The restart(8) utility is also available.
vsftpd stop/waiting
vsftpd start/running, process 2657
root@tdtc010-Vostro-270:/srv/ftp# ls
root@tdtc010-Vostro-270:/srv/ftp# mkdir upload_xp
root@tdtc010-Vostro-270:/srv/ftp# ls
upload_xp
root@tdtc010-Vostro-270:/srv/ftp# chown ftp:root /srv/ftp/upload_xp
root@tdtc010-Vostro-270:/srv/ftp#

2. 配置文件(/etc/vsftpd.conf)：

# Example config file /etc/vsftpd.conf
#
# The default compiled in settings are fairly paranoid. This sample file
# loosens things up a bit, to make the ftp daemon more usable.
# Please see vsftpd.conf.5 for all compiled in defaults.
#
# READ THIS: This example file is NOT an exhaustive list of vsftpd options.
# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
# capabilities.
#
#
# Run standalone?  vsftpd can run either from an inetd or as a standalone
# daemon started from an initscript.
listen=YES
#
# Run standalone with IPv6?
# Like the listen parameter, except vsftpd will listen on an IPv6 socket
# instead of an IPv4 one. This parameter and the listen parameter are mutually
# exclusive.
#listen_ipv6=YES
#
# Allow anonymous FTP? (Beware - allowed by default if you comment this out).
anonymous_enable=YES
#
# Uncomment this to allow local users to log in.
local_enable=YES
#
# Uncomment this to enable any form of FTP write command.
write_enable=YES
#
# Default umask for local users is 077. You may wish to change this to 022,
# if your users expect that (022 is used by most other ftpd's)
#local_umask=022
#
# Uncomment this to allow the anonymous FTP user to upload files. This only
# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
anon_upload_enable=YES
#
# Uncomment this if you want the anonymous FTP user to be able to create
# new directories.
#anon_mkdir_write_enable=YES
#
# Activate directory messages - messages given to remote users when they
# go into a certain directory.
dirmessage_enable=YES
#
# If enabled, vsftpd will display directory listings with the time
# in  your  local  time  zone.  The default is to display GMT. The
# times returned by the MDTM FTP command are also affected by this
# option.
use_localtime=YES
#
# Activate logging of uploads/downloads.
xferlog_enable=YES
#
# Make sure PORT transfer connections originate from port 20 (ftp-data).
connect_from_port_20=YES
#
# If you want, you can arrange for uploaded anonymous files to be owned by
# a different user. Note! Using "root" for uploaded files is not
# recommended!
#chown_uploads=YES
#chown_username=whoever
#
# You may override where the log file goes if you like. The default is shown
# below.
#xferlog_file=/var/log/vsftpd.log
#
# If you want, you can have your log file in standard ftpd xferlog format.
# Note that the default log file location is /var/log/xferlog in this case.
#xferlog_std_format=YES
#
# You may change the default value for timing out an idle session.
#idle_session_timeout=600
#
# You may change the default value for timing out a data connection.
#data_connection_timeout=120
#
# It is recommended that you define on your system a unique user which the
# ftp server can use as a totally isolated and unprivileged user.
#nopriv_user=ftpsecure
#
# Enable this and the server will recognise asynchronous ABOR requests. Not
# recommended for security (the code is non-trivial). Not enabling it,
# however, may confuse older FTP clients.
#async_abor_enable=YES
#
# By default the server will pretend to allow ASCII mode but in fact ignore
# the request. Turn on the below options to have the server actually do ASCII
# mangling on files when in ASCII mode.
# Beware that on some FTP servers, ASCII support allows a denial of service
# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
# predicted this attack and has always been safe, reporting the size of the
# raw file.
# ASCII mangling is a horrible feature of the protocol.
#ascii_upload_enable=YES
#ascii_download_enable=YES
#
# You may fully customise the login banner string:
#ftpd_banner=Welcome to blah FTP service.
#
# You may specify a file of disallowed anonymous e-mail addresses. Apparently
# useful for combatting certain DoS attacks.
#deny_email_enable=YES
# (default follows)
#banned_email_file=/etc/vsftpd.banned_emails
#
# You may restrict local users to their home directories.  See the FAQ for
# the possible risks in this before using chroot_local_user or
# chroot_list_enable below.
#chroot_local_user=YES
#
# You may specify an explicit list of local users to chroot() to their home
# directory. If chroot_local_user is YES, then this list becomes a list of
# users to NOT chroot().
# (Warning! chroot'ing can be very dangerous. If using chroot, make sure that
# the user does not have write access to the top level directory within the
# chroot)
#chroot_local_user=YES
#chroot_list_enable=YES
# (default follows)
#chroot_list_file=/etc/vsftpd.chroot_list
#
# You may activate the "-R" option to the builtin ls

[3][网络编程]socket创建流程

来源: 互联网发布时间: 2013-10-27

今天分析下socket的创建流程

关于用户态socket如何通过系统调用进入内核态到sys_socke，这里就不再分析，直接看内核态socket入口

SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
{
     int retval;
     struct socket *sock;
     int flags;

     /* Check the SOCK_* constants for consistency. */
     BUILD_BUG_ON(SOCK_CLOEXEC != O_CLOEXEC);
     BUILD_BUG_ON((SOCK_MAX | SOCK_TYPE_MASK) != SOCK_TYPE_MASK);
     BUILD_BUG_ON(SOCK_CLOEXEC & SOCK_TYPE_MASK);
     BUILD_BUG_ON(SOCK_NONBLOCK & SOCK_TYPE_MASK);

     flags = type & ~SOCK_TYPE_MASK;
     if (flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK))
          return -EINVAL;
     type &= SOCK_TYPE_MASK;

     if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
          flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;               以上为一系列参数的检查和配置

     retval = sock_create(family, type, protocol, &sock); sock创建
     if (retval < 0)
          goto out;

     retval = sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK)); 与文件系统关联
     if (retval < 0)
          goto out_release;

out:
     /* It may be already another descriptor 8) Not kernel problem. */
     return retval;

out_release:
     sock_release(sock);
     return retval;
} int sock_create(int family, int type, int protocol, struct socket **res)
{
     return __sock_create(current->nsproxy->net_ns, family, type, protocol, res, 0);
}

static int __sock_create(struct net *net, int family, int type, int protocol,
struct socket **res, int kern)

->sock = sock_alloc();

->pf = rcu_dereference(net_families[family]); 取得协议族操作表

->err = pf->create(net, sock, protocol); 调用协议族操作创建函数
static struct socket *sock_alloc(void)
{
     struct inode *inode;
     struct socket *sock;

     inode = new_inode(sock_mnt->mnt_sb); 在网络文件系统中创建inode结构
     if (!inode)
          return NULL;

     sock = SOCKET_I(inode); 从inode结构得到socket结构

     kmemcheck_annotate_bitfield(sock, type);     进行初始化工作
     inode->i_mode = S_IFSOCK | S_IRWXUGO;
     inode->i_uid = current_fsuid();
     inode->i_gid = current_fsgid();

     percpu_add(sockets_in_use, 1);
     return sock;
}

->pf = rcu_dereference(net_families[family]); 取得协议族操作表

net_families数组内容是通过sock_register注册的

int sock_register(const struct net_proto_family *ops)
{
     int err;

     if (ops->family >= NPROTO) {
          printk(KERN_CRIT "protocol %d >= NPROTO(%d)\n", ops->family,
                 NPROTO);
          return -ENOBUFS;
     }

     spin_lock(&net_family_lock);
     if (net_families[ops->family])
          err = -EEXIST;
     else {
          net_families[ops->family] = ops;
          err = 0;
     }
     spin_unlock(&net_family_lock);

     printk(KERN_INFO "NET: Registered protocol family %d\n", ops->family);
     return err;
}

我们如果调用socket(PF_INET,SOCK_STREAM,0);

在inet_init()中

(void)sock_register(&inet_family_ops); 将PF_INET协议族的函数操作列表进行注册

static struct net_proto_family inet_family_ops = {
     .family = PF_INET,
     .create = inet_create,
     .owner     = THIS_MODULE,
};

我们看下inet_create函数

static int inet_create(struct net *net, struct socket *sock, int protocol)
{
     struct sock *sk;
     struct inet_protosw *answer;
     struct inet_sock *inet;
     struct proto *answer_prot;
     unsigned char answer_flags;
     char answer_no_check;
     int try_loading_module = 0;
     int err;

     if (unlikely(!inet_ehash_secret))   加密项处理
          if (sock->type != SOCK_RAW && sock->type != SOCK_DGRAM)
               build_ehash_secret();

     sock->state = SS_UNCONNECTED;     将socket的状态设为未连接状态

     /* Look for the requested type/protocol pair. */
lookup_protocol:
     err = -ESOCKTNOSUPPORT;
     rcu_read_lock();
     list_for_each_entry_rcu(answer, &inetsw[sock->type], list) {

查看内核是否注册了协议处理

inetsw的结构由void inet_register_protosw(struct inet_protosw *p)函数进行了注册

而inet_init()中

for (q = inetsw_array; q < &inetsw_array[INETSW_ARRAY_LEN]; ++q)

inet_register_protosw(q);

追根溯源

static struct inet_protosw inetsw_array[] =