You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@ant.apache.org by bu...@apache.org on 2024/03/13 16:42:26 UTC
[Bug 68773] New: not able to use FTPS (FTP via SSL) with encrypted data connection
https://bz.apache.org/bugzilla/show_bug.cgi?id=68773
Bug ID: 68773
Summary: not able to use FTPS (FTP via SSL) with encrypted data
connection
Product: Ant
Version: 1.10.14
Hardware: All
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: Optional Tasks
Assignee: notifications@ant.apache.org
Reporter: rosenauer@gmx.net
Target Milestone: ---
When we try to download files via FTPS from our z/OS Communications Server we
get the following error in the Server Log:
SR3502 reply: --> 425-Server requires protected data connection.
SR4696 usingUTF8: entered
SR3465 reply: entered
SR3502 reply: --> 425 Unable to open data connection.
With unencrypted FTP, everything is working fine.
We use this maven call for ant:
<plugin>
<artifactId>maven-antrun-plugin</artifactId>
<version>3.1.0</version>
<executions>
<execution>
<phase>process-sources</phase>
<goals>
<goal>run</goal>
</goals>
<configuration>
<target>
<ant
antfile="../src/main/scripts/build.xml" target="download-all" />
</target>
</configuration>
</execution>
</executions>
<dependencies>
<dependency>
<groupId>org.apache.ant</groupId>
<artifactId>ant-commons-net</artifactId>
<version>1.10.14</version>
</dependency>
<dependency>
<groupId>commons-net</groupId>
<artifactId>commons-net</artifactId>
<version>3.10.0</version>
</dependency>
<dependency>
<groupId>org.apache.ant</groupId>
<artifactId>ant</artifactId>
<version>1.10.14</version>
</dependency>
</dependencies>
</plugin>
And use this ant task:
<ftp server="mymainframe.mycompany"
useFtps="true"
userid="${userid}"
password="${password}"
passive="yes"
verbose="yes"
binary="no"
remotedir="${remotedir}"
action="get"
initialSiteCommand="site sbd=(IBM-1141,ISO8859-1)">
<fileset dir = "." includes="${fileset}" />
</ftp>
We think, that "PROT P" is not set, but we neither didn't find any ant option
to set this, nor does it work as initial site command. We think that it is
either missing in the implementation, or if it can be set, an example should be
added to the documentation.
We tcpdump'ed the connection, the control channel is encrypted but as soon as
the data channel should be used for the transfer, everything stops.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 68773] not able to use FTPS (FTP via SSL) with encrypted data connection
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68773
--- Comment #5 from Jaikiran Pai <ja...@apache.org> ---
I hadn't noticed the nightly build was running into an error. Please try build
number 220 which has completed now and published the artifacts.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 68773] not able to use FTPS (FTP via SSL) with encrypted data connection
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68773
--- Comment #2 from Florian Rosenauer <ro...@gmx.net> ---
Hello Jaikiran, thank you very much for the support and the change! I tested
the version from
https://ci-builds.apache.org/job/Ant/job/Ant_Nightly/215/artifact/ with the
additional useSecureDataChannel="true" and we made some progress now. The new
error message we get is this one:
build.xml:26: The following error occurred while executing this line:
build.xml:69: failed to enable secure data channel: javax.net.ssl.SSLException:
503 Must first issue PBSZ
at org.apache.commons.net.ftp.FTPSClient.execPROT(FTPSClient.java:534)
at
org.apache.tools.ant.taskdefs.optional.net.FTP.execute(FTP.java:2593)
at org.apache.tools.ant.UnknownElement.execute(UnknownElement.java:299)
at jdk.internal.reflect.GeneratedMethodAccessor4.invoke(Unknown Source)
at
java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:566)
at
org.apache.tools.ant.dispatch.DispatchUtils.execute(DispatchUtils.java:99)
at org.apache.tools.ant.Task.perform(Task.java:350)
at org.apache.tools.ant.Target.execute(Target.java:449)
at org.apache.tools.ant.Target.performTasks(Target.java:470)
at org.apache.tools.ant.Project.executeSortedTargets(Project.java:1401)
at
org.apache.tools.ant.helper.SingleCheckExecutor.executeTargets(SingleCheckExecutor.java:36)
at org.apache.tools.ant.Project.executeTargets(Project.java:1264)
at org.apache.tools.ant.taskdefs.Ant.execute(Ant.java:437)
at org.apache.tools.ant.UnknownElement.execute(UnknownElement.java:299)
at
java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at
java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:566)
at
org.apache.tools.ant.dispatch.DispatchUtils.execute(DispatchUtils.java:99)
at org.apache.tools.ant.Task.perform(Task.java:350)
at org.apache.tools.ant.Target.execute(Target.java:449)
at org.apache.tools.ant.Target.performTasks(Target.java:470)
at org.apache.tools.ant.Project.executeSortedTargets(Project.java:1401)
at org.apache.tools.ant.Project.executeTarget(Project.java:1374)
at
org.apache.tools.ant.helper.DefaultExecutor.executeTargets(DefaultExecutor.java:41)
at org.apache.tools.ant.Project.executeTargets(Project.java:1264)
at org.apache.tools.ant.Main.runBuild(Main.java:818)
at org.apache.tools.ant.Main.startAnt(Main.java:223)
at org.apache.tools.ant.launch.Launcher.run(Launcher.java:284)
at org.apache.tools.ant.launch.Launcher.main(Launcher.java:101)
Environment: ant-commons-net-1.10.14.jar commons-net-3.10.0.jar
apache-ant-1.10.15alpha-bin.tar.gz
OpenJDK 64-Bit Server VM (Red_Hat-11.0.21.0.9-1.el7_9) (build 11.0.21+9-LTS,
mixed mode, sharing)
As far as I found in rfc2228, and as I understand it, a PBSZ command must be
issued before a PROT command. However, all pages I found via Google note, that
for FTPS/FTPviaTLS it should be "PBSZ=0". Could you add this for testing to the
code? Imho if it works, in case of a PROT command then always PBSZ=0 should be
issued before.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 68773] not able to use FTPS (FTP via SSL) with encrypted data connection
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68773
--- Comment #3 from Jaikiran Pai <ja...@apache.org> ---
Hello Florian, I read up a bit about the PBSZ command and I think you are right
that we should issue a PBSZ=0 before issuing the PROT command. The command with
PBSZ=0 value itself is apparently redundant since the encryption buffer sizes
are all handled in TLS layer (due to the subsequent PROT command) and not at
application layer, but we still have to issue it since it's mandated by
RFC-2228.
I've pushed a commit which does that when the task is configured with
useSecureDataChannel="true". Please go ahead and try Ant nightly build 218 or
higher and let us know how it goes. I plan to release the next version of Ant
in the coming days, so it would be good if we hear back on the results of this
change before that.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 68773] not able to use FTPS (FTP via SSL) with encrypted data connection
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68773
--- Comment #1 from Jaikiran Pai <ja...@apache.org> ---
Hello Florian, it appears that you have sufficiently narrowed this down to
what's causing the issue. From what you state (and based on my very superficial
knowledge of FTPS), it appears like for the data channel to be secured, the
client has to issue a "PROT P" command which implies PRIVATE data channel and
enables encryption.
Right now, the FTPS task doesn't issue that command. I have committed a
experimental change in our Ant master branch which now introduces a
"useSecureDataChannel" attribute on the "ftp" task. This attribute can be
(optionally) set to "true" (only) when "useFtps" is set to "true". Internally,
when this attribute is true and useFtps is also true, then the task, in this
experimental change will now issue a "PROT P" command. The other way to do it
probably would be to expose a "execPROT" attribute which takes either of "C",
"E", "S", "P" values. I haven't fully thought whether that would be more
convenient.
In any case, I don't have a way to test this change. Would you be willing to
test this either by building Ant master branch and using that Ant version or by
using our nightly unreleased build from
https://ci-builds.apache.org/job/Ant/job/Ant_Nightly/lastCompletedBuild/artifact/
(job number 215 and higher should have this change).
In that experimental build, you would have to additionally set
useSecureDataChannel="true" attribute in your ftp task usage. Can you give that
a try and see if it works. If it does, then I can decide how we want to expose
this as an attribute, plus update the manual for that task.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 68773] not able to use FTPS (FTP via SSL) with encrypted data connection
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68773
--- Comment #6 from Florian Rosenauer <ro...@gmx.net> ---
Thank you, I tested and it looks fine now!
case 1: old non SSL - working
useFtps="false"
useSecureDataChannel="false"
case 2: new FTPS - working
useFtps="true"
useSecureDataChannel="true"
case 3: FTPS but without data channel encryption
useFtps="true"
useSecureDataChannel="false"
Result: no download as expected:
[ftp] getting files
[ftp] 0 files retrieved
I also compared the downloaded binary files from case 1 and case 2 and they are
identical.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 68773] not able to use FTPS (FTP via SSL) with encrypted data connection
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68773
Florian Rosenauer <ro...@gmx.net> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |rosenauer@gmx.net
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 68773] not able to use FTPS (FTP via SSL) with encrypted data connection
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68773
Jaikiran Pai <ja...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Target Milestone|--- |1.10.15
Resolution|--- |FIXED
--- Comment #7 from Jaikiran Pai <ja...@apache.org> ---
Thank you Florian for running these tests. It gives me confidence in these
changes.
This change will be available in the upcoming release.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 68773] not able to use FTPS (FTP via SSL) with encrypted data connection
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68773
--- Comment #4 from Florian Rosenauer <ro...@gmx.net> ---
Hello Jaikiran,
thanks for the changes, yeah that PBSZ is a bit strange here :)
I can test it soon but unfortunately I cannot see artifacts in the failed
builds #217-#219 in https://ci-builds.apache.org/job/Ant/job/Ant_Nightly/ or do
I miss something? I am using the Jenkins without login as I do not have an
account.
--
You are receiving this mail because:
You are the assignee for the bug.