proxy_ftp : your opinion ? EPSV / PASV and firewalls

[Peter Van Biesen <pe...@vlafo.be>]

Hello,

Our firewall  between the proxy and the internet is configured very 
restrictive, so only known ports are allowed in either direction. This 
poses a problem with the EPSV/PASV implementation of the ftp proxy; 
servers that are able to run in EPSV or PASV mode make the proxy produce 
a "bad gateway" error ( Firewall / NAT ? ). I've temporarly enabled the 
bypass code but I was thinking of writing a more permanent patch.

Therefor, please your opinion: there are two ways to implement this :

1) add a directive to specify if EPSV and/or PASV should be used
2) alter the code to continue with PORT where it now throws a bad 
gateway error

The second option is the easiest for the administrator, but generates 
more processing overhead ( arbitrary ports will always be blocked, but 
the proxy will continue trying for every request ). The first options 
produces less overhead, but requires intervention by the administrator ( 
adaptation of docs, ... ).

Thanx !

Peter.

Re: proxy_ftp : your opinion ? EPSV / PASV and firewalls

[Peter Van Biesen <pe...@vlafo.be>]

Hi,

I've made the patch and tested it with our firewall configuration. When 
EPSV failes because of the firewall, the proxy continues with PASV and 
so on ... Errors are now warnings. The problem download now produces a 
warning on EPSV but continues with PASV, which succeeds ...

[Tue Mar 25 14:47:31 2003] [warn] (239)Connection refused: proxy: FTP: 
EPSV attempt to connect to 129.33.28.113:6073 failed - Firewall/NAT? 
Trying PASV ...

patch in attachment.

Regards,

Peter.


Peter Van Biesen wrote:

> Graham Leggett wrote:
>
>> Peter Van Biesen wrote:
>> The logic is try EPSV, if that fails, try PASV, if that fails, try PORT.
>>
>>> 2) alter the code to continue with PORT where it now throws a bad 
>>> gateway error
>>
>>
>>
>> To be honest I think you are probably looking at the broken firewall 
>> implementation. Try set up the firewall so that it does PASV properly. 
>
>
> Out firewall allows PASV, connecting manually to a remote server in 
> passive mode works fine, but with the current implementation of 
> proxy_ftp this wouldn't help either. If the remote server is able to 
> use EPSV, PASV is never tried, even when the firewall blocks the 
> dataconnection, it just gives a 'bad gateway' error, or am I reading 
> the source wrong ? I've pasted some relevant code from the source at 
> the bottom.
>
>> Regards,
>> Graham
>
>
> I'll make a patch which jumps to PASV when the dataconnection fails ( 
> time permitting ;-) ) ...
>
> Peter.
>

Re: proxy_ftp : your opinion ? EPSV / PASV and firewalls

[Peter Van Biesen <pe...@vlafo.be>]

Graham Leggett wrote:

> Peter Van Biesen wrote:
> The logic is try EPSV, if that fails, try PASV, if that fails, try PORT.
>
>> 2) alter the code to continue with PORT where it now throws a bad 
>> gateway error
>
>
> To be honest I think you are probably looking at the broken firewall 
> implementation. Try set up the firewall so that it does PASV properly. 

Out firewall allows PASV, connecting manually to a remote server in 
passive mode works fine, but with the current implementation of 
proxy_ftp this wouldn't help either. If the remote server is able to use 
EPSV, PASV is never tried, even when the firewall blocks the 
dataconnection, it just gives a 'bad gateway' error, or am I reading the 
source wrong ? I've pasted some relevant code from the source at the bottom.

> Regards,
> Graham

I'll make a patch which jumps to PASV when the dataconnection fails ( 
time permitting ;-) ) ...

Peter.

/*
* IV: Make Data Connection? -------------------------
*
* Try EPSV, if that fails... try PASV, if that fails... try PORT.
*/

/* set up data connection - EPSV */
{
rc = proxy_ftp_command("EPSV" CRLF,
r, origin, bb, &ftpmessage);

ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server,
"proxy: FTP: EPSV contacting remote host on port %d",
data_port);

/* opening a socket is possible ... */
if ((rv = apr_socket_create(&data_sock, connect_addr->family, 
SOCK_STREAM, r->pool)) != APR_SUCCESS) {
ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r,
"proxy: FTP: error creating EPSV socket");
return HTTP_INTERNAL_SERVER_ERROR;
}

/* but now, connection gets blocked by the firewall */
rv = apr_connect(data_sock, epsv_addr);
if (rv != APR_SUCCESS) {
/* should jump to PASV, but just gives a 'bad gateway' instead ... */
ap_log_error(APLOG_MARK, APLOG_ERR, rv, r->server,
"proxy: FTP: EPSV attempt to connect to %pI failed - Firewall/NAT?", 
epsv_addr);
return ap_proxyerror(r, HTTP_BAD_GATEWAY, apr_psprintf(r->pool,
"EPSV attempt to connect to %pI failed - firewall/NAT?", epsv_addr));
}
else {
connect = 1;
}
}
else {
/* and try the regular way */
apr_socket_close(data_sock);
}
}
}

Re: proxy_ftp : your opinion ? EPSV / PASV and firewalls

[Graham Leggett <mi...@sharp.fm>]

Peter Van Biesen wrote:

> Our firewall  between the proxy and the internet is configured very 
> restrictive, so only known ports are allowed in either direction. This 
> poses a problem with the EPSV/PASV implementation of the ftp proxy; 
> servers that are able to run in EPSV or PASV mode make the proxy produce 
> a "bad gateway" error ( Firewall / NAT ? ). I've temporarly enabled the 
> bypass code but I was thinking of writing a more permanent patch.
> 
> Therefor, please your opinion: there are two ways to implement this :
> 
> 1) add a directive to specify if EPSV and/or PASV should be used

EPSV and PASV are always used.

The logic is try EPSV, if that fails, try PASV, if that fails, try PORT.

> 2) alter the code to continue with PORT where it now throws a bad 
> gateway error

To be honest I think you are probably looking at the broken firewall 
implementation. Try set up the firewall so that it does PASV properly.

Regards,
Graham
-- 
-----------------------------------------
minfrin@sharp.fm		"There's a moon
					over Bourbon Street
						tonight..."