FTP passive mode

ratay · Post by *ratay » 2010-08-06, 12:02 UTC

something must changed in FTP passive mode between 7.02a and 7.50a
7.02a worked fine in my environment and from 7.50a (including 7.55a) it is impossible to get file list from ftp server

7.02a:

Code: Select all

----------
Connect to: (06.08.2010 13:28:09)
hostname=ftp_software_ibm_com
username=anonymous
startdir=
ftp_software_ibm_com=170_225_15_40
220-*******************************************************************************
220-*                                                                             *
220-*  IBM's internal systems must only be used for conducting IBM's              *
220-*  business or for purposes authorized by IBM management.                     *
220-*                                                                             *
220-*  Use is subject to audit at any time by IBM management.                     *
220-*                                                                             *
220-*******************************************************************************
220-
220 dhebpanon02_boulder_ibm_com FTP server (Version wu-2.6.2(5) Custom Thu Dec 8 12:55:22 MST 2005) ready.
USER anonymous
331 User name okay, need password.
PASS ***********
230 User logged in, proceed.
SYST
215 UNIX Type: L8
FEAT
500 'FEAT': command not understood.
Connect ok!
PWD
257 "/" is current directory.
Get directory
TYPE A
200 Type set to A.
PASV
227 Entering Passive Mode (172,25,11,131,42,248).
LIST
150 Opening ASCII mode data connection for /bin/ls.
Download
Waiting for server...
226 Closing data connection.
QUIT
221 Service closing control connection. Logged out if appropriate.

750a:

Code: Select all

----------
Connect to: (06.08.2010 13:28:29)
hostname=ftp_software_ibm_com
username=anonymous
startdir=
ftp_software_ibm_com=170_225_15_40
220-*******************************************************************************
220-*                                                                             *
220-*  IBM's internal systems must only be used for conducting IBM's              *
220-*  business or for purposes authorized by IBM management.                     *
220-*                                                                             *
220-*  Use is subject to audit at any time by IBM management.                     *
220-*                                                                             *
220-*******************************************************************************
220-
220 dhebpanon02_boulder_ibm_com FTP server (Version wu-2.6.2(5) Custom Sat May 28 01:48:31 MDT 2005) ready.
USER anonymous
331 User name okay, need password.
PASS ***********
230 User logged in, proceed.
SYST
215 UNIX Type: L8
FEAT
500 'FEAT': command not understood.
CLNT Total Commander (UTF-8)
500 Syntax error, command unrecognized.
OPTS UTF8 ON
500 Syntax error, command unrecognized.
Connect ok!
PWD
257 "/" is current directory.
Get directory
TYPE A
200 Type set to A.
PASV
227 Entering Passive Mode (172,25,11,131,42,250).
Server reports local IP -> Redirect to: 170.225.15.40
Cancel pressed!
PORT 172,25,2,33,9,167
200 PORT command successful.
LIST
150 Opening ASCII mode data connection for /bin/ls.
Download
Cancel pressed!
QUIT
221 Service closing control connection. Logged out if appropriate.

7.55a:

Code: Select all

----------
Connect to: (06.08.2010 13:29:11)
hostname=ftp_software_ibm_com
username=anonymous
startdir=
ftp_software_ibm_com=170_225_15_40
220-*******************************************************************************
220-*                                                                             *
220-*  IBM's internal systems must only be used for conducting IBM's              *
220-*  business or for purposes authorized by IBM management.                     *
220-*                                                                             *
220-*  Use is subject to audit at any time by IBM management.                     *
220-*                                                                             *
220-*******************************************************************************
220-
220 dhebpanon02_boulder_ibm_com FTP server (Version wu-2.6.2(5) Custom Thu Dec 8 12:55:22 MST 2005) ready.
USER anonymous
331 User name okay, need password.
PASS ***********
230 User logged in, proceed.
SYST
215 UNIX Type: L8
FEAT
500 'FEAT': command not understood.
HELP SITE
214-The following SITE commands are recognized (* =>'s unimplemented).
   UMASK           GROUP           INDEX           GROUPS 
   IDLE            GPASS           EXEC            CHECKMETHOD 
   CHMOD           NEWER           ALIAS           CHECKSUM 
   HELP            MINFO           CDPATH 
214 Direct comments to smsinet*us_ibm_com.
CLNT Total Commander (UTF-8)
500 Syntax error, command unrecognized.
OPTS UTF8 ON
500 Syntax error, command unrecognized.
Connect ok!
PWD
257 "/" is current directory.
Get directory
TYPE A
200 Type set to A.
PASV
227 Entering Passive Mode (172,25,11,131,43,1).
Server reports local IP -> Redirect to: 170.225.15.40
LIST
Get directory
PASV
227 Entering Passive Mode (172,25,11,131,43,0).
Server reports local IP -> Redirect to: 170.225.15.40
LIST
Cancel pressed!

Post by *Hacker » 2010-08-06, 13:18 UTC

Hello ratay,
Well, the culprit seems to be here:

Code: Select all

227 Entering Passive Mode (172,25,11,131,42,250).
Server reports local IP -> Redirect to: 170.225.15.40

Though I do not know what exactly this means for your environment. Just a wild shot - you have an IP address in the 172.x.x.x private range and the destination server also has one, but between you there are two NATs and TC (wrongly) assumes that you are on the same private network?

Roman

Sob · Post by *Sob » 2010-08-06, 15:18 UTC

This redirection can be turned off by adding 1024 to SpecialFlags variable in wcx_ftp.ini.

But I don't really get why this is on by default. It seems useful only as a workaround when server is behind NAT and returns internal addresses in PASV responses. But since it's clearly misconfigured, there is no guarantee that this redirection will help. And with the chance of breaking with correctly (although unusually) configured servers, redirection disabled by default seems better to me.

ratay · Post by *ratay » 2010-08-09, 06:11 UTC

Sob wrote:This redirection can be turned off by adding 1024 to SpecialFlags variable in wcx_ftp.ini.

But I don't really get why this is on by default. It seems useful only as a workaround when server is behind NAT and returns internal addresses in PASV responses. But since it's clearly misconfigured, there is no guarantee that this redirection will help. And with the chance of breaking with correctly (although unusually) configured servers, redirection disabled by default seems better to me.

thanks a lot
it's working now