zftpd v1.5.0

zftpd v1.5.0 is a major release focused on a completely redesigned Web UI, production-ready Linux support, improved PS4/PS5 integration, faster transfers, safer FTP/HTTP behavior, and cleaner cross-platform release packaging.

Since v1.4.0: 81 files changed · 175,164 insertions · 33,041 deletions

---

Support the project❤️

If you enjoy using zftpd and want to support its development, consider making a donation.
Your support helps keep the project active, improve compatibility, and fund future development.
link: https://seregonwar.com/donations

Highlights

• Fully redesigned embedded Web UI
• New port 2120 as the default
• Production-ready Linux support with native epoll
• Updated PS4/PS5 kernel and system integration
• PS5 firmware 13.xx support
• New games management features
• Built-in ZIP extraction and optional archive support
• Faster transfers with zero-copy sendfile, larger buffers, and improved retry handling
• Safer FTP behavior, including PORT bounce-attack prevention
• Cleaner platform-specific CI/CD release assets

---

Web UI: Complete Redesign

The embedded web file explorer has been rebuilt from the ground up with a modern, responsive interface.

What changed

• New dark responsive layout with CSS variables
• Mobile-first breakpoints, hamburger menu, and touch-friendly interactions
• Breadcrumb navigation and improved directory listings
• File icons, metadata, sorting, and inline preview
• Multi-select file operations: copy, move, rename, delete
• Recursive directory operations with progress indicators
• Context menus for common actions
• Collapsible transfer tray for live FTP transfer monitoring
• Settings panel with server configuration and validation

Download manager

The Web UI now includes a full download manager:

• Add/remove downloads
• Queue management
• Progress bar with speed and ETA
• Pause/resume individual downloads
• Background processing with persistent state

---

Linux Support: Production Ready

zftpd now builds and runs cleanly on Linux with GCC and zero warnings under:

-Wall -Wextra -Werror

Native epoll event loop

Linux now uses a dedicated epoll backend:

• epoll_create1
• epoll_ctl
• epoll_wait
• EPOLLRDHUP support for proper EOF parity with kqueue

HTTP, FTP data connections, and async I/O now use epoll on Linux. kqueue remains available on BSD, macOS, PS4, and PS5.

Hardened Linux build

The codebase is now clean with _FORTIFY_SOURCE=2 and hardened glibc checks.

Fixed warning classes include:

• -Wformat-truncation
• -Wunused-result
• -Wsign-conversion
• -Wstrict-overflow
• -Wstringop-truncation
• -Wformat
• -Wunused-variable
• -Wstring-compare

---

PS4 / PS5 Kernel & System Improvements

This release includes major reliability improvements for console-specific networking and system integration.

Safer net filter hooks

• Added external sysent hook detection
• Detects sysent[SYS_CONNECT].sy_call before patching
• Safely aborts hook installation when an external hook is detected
• Prevents conflicts with other homebrew or system-level hooks

Kernel and firmware updates

• Fixed JMP patch offsets that could cause SIGILL crashes
• Added sleep-safety checks for syscall hooks
• Updated PS5 kernel offsets across multiple firmware revisions
• Added PS5 firmware support up to 13.xx
• Improved pager address detection and symbol resolution
• Improved PS5 IP binding by listening on 0.0.0.0

Console defaults

• FTP default port changed to 2120 on PS4/PS5 to avoid conflicts with system services
• Hook blob pipeline automated for PS5 payload injection workflows

---

New Features

Games management

The Web UI now includes full lifecycle management for installed PS4/PS5 titles:

• View installed games
• Display title ID, name, version, size, and install path
• Launch games directly from the Web UI
• Repair installed application visibility
• Browse games in a PS4 XMB-styled grid view
• Improved launch and fan-control error handling

MLST / MLSD improvements

FTP directory listings now have stronger RFC 3659 support.

Supported facts include:

• type
• size
• modify
• unix.mode

FEAT now advertises MLST fact types, and new helpers improve MLST/MLSD formatting and path conversion.

Archive extraction

Archive support has been expanded:

• Built-in ZIP extraction via vendored miniz
• No external dependency required for ZIP files
• Optional libarchive support for .7z, .rar, .tar, and .gz
• exFAT/fpkg and PS4 PKG unpacking with metadata extraction

URL downloads

Added a background URL download manager with:

• Start/status/pause/cancel endpoints
• Progress tracking
• URL scheme validation
• Filename sanitization

Resilient server behavior

The server can now recover from fatal accept() errors by recreating and rebinding the listener socket.

This helps zftpd survive temporary network failures without requiring a manual restart.

Safer FTP PORT handling

FTP PORT commands now validate the provided IP address against the control connection remote IP, preventing RFC 2577 bounce attacks.

---

Performance

This release includes several transfer and I/O improvements.

Zero-copy transfers

sendfile is now used across supported filesystems and platforms:

• Linux: sendfile64
• macOS: sendfile
• FreeBSD / PS4 / PS5: sendfile

This enables kernel-to-NIC transfer paths and avoids unnecessary userspace copying.

Faster HTTP and FTP I/O

• Page-cache-friendly mmap pipeline for file serving
• Bounded EAGAIN retry loop for PS5 sendfile() backpressure
• Larger TCP send buffers on PS4/PS5
• Optimized file chunk sizes to reduce syscall overhead
• HTTP upload buffer increased to 256 KB
• TCP_NODELAY enabled on HTTP connections

FTP STOR improvements

• Added double-buffered writer pipeline
• Overlaps network recv() and disk write()
• Added mutex-guarded O_CREAT on PS4/PS5 to reduce PFS journal contention
• Added page-cache eviction with posix_fadvise(POSIX_FADV_DONTNEED) where supported

---

Fixes

• Fixed corrupted ZIP extraction on large archives
• Improved bounded path diagnostics
• Reworked HTTP directory listings with streaming JSON and chunked transfer encoding
• Removed the previous 512 KB in-memory directory listing limit
• Added support for very large directories without out-of-memory failures
• Added post-delete verification before reporting successful deletion
• Added explicit recursive directory delete behavior with ?recursive=1
• Return 409 Conflict for non-empty directories without recursive delete enabled
• Added directory size scan budget: 200 ms timeout and 10,000 entry limit
• Fixed PAL curl source termination
• Vendored miniz for ZIP extraction
• Fixed README contributor acknowledgement formatting

---

Testing

New and improved tests include:

• test_mlst_ascii.c

  • MLST reply formatting
  • ASCII STOR behavior
  • RFC 3659 fact output
  • Special-character filename handling

• test_http_confinement.c

  • HTTP API path traversal prevention
  • Endpoint confinement validation

---

CI/CD and Release Packaging

Release packaging is now platform-aware.

Platform	Release format
PS4 / PS5	.elf and .bin assets uploaded directly
macOS	.app bundle packaged as .tar.gz
Linux	Standard .tar.gz package with BUILD_INFO.txt

Additional CI/CD changes:

• Console SDKs are now built in CI for release artifacts
• PS4/PS5 assets are no longer wrapped in .tar.gz
• Asset names now include the release version
• Removed Linux zhttp variant from the release matrix

Example asset name:

zftpd-ps5-v1.5.0.elf

---

Code Quality

This release also includes a large cleanup pass across the codebase:

• Safer bounded path formatting
• Explicit NUL termination after strncpy
• _FORTIFY_SOURCE=2 compatibility
• Clean builds across strict warning sets
• Removed external sJson-main.zip dependency
• Improved portability and diagnostics across platforms

---

Download stats

Full Changelog

v1.4.0...v1.5.0