Skip to content

Conversation

@drakkan
Copy link
Collaborator

@drakkan drakkan commented Jul 3, 2020

send StatusFileStatusOK only if transfer.Open() returns no error.
If an error happen send a 425 error code.

This patch fixes the following use case:

  1. start the ftpserver as non root user
  2. start an active connection
  3. request file list

if the server is not started as root and ActiveTransferPortNon20 is not set then the server cannot bind to port 20.

Before the patch this response is sent anyway:

c.writeMessage(StatusFileStatusOK, "Using transfer connection")

and the client hangs forever.

After this patch the ftp client receive this error:

ftp> ls
200 PORT command successful
425 Unable to open transfer: could not establish active connection due: dial tcp :20->127.0.0.1:37811: bind: permission denied

tested using ftp CLI on Linux

drakkan added 2 commits July 3, 2020 11:36
send StatusFileStatusOK only if transfer.Open() returns no error.
If an error happen send a 425 error code.

This patch fixes the following use case:

1) start the ftpserver as non root user
2) start an active connection
3) request file list

if the server is not started as root and ActiveTransferPortNon20 is not
set then the server cannot bind to port 20.

Before the patch this response is sent anyway:

c.writeMessage(StatusFileStatusOK, "Using transfer connection")

and the client hangs forever.

After this patch the ftp client receive this error:

ftp> ls
200 PORT command successful
425 Unable to open transfer: could not establish active connection due: dial tcp :20->127.0.0.1:37811: bind: permission denied

tested using ftp CLI on Linux
if TransferOpen fails we already sent an error to the client, even
before my previous commit.

In handle dirs we don't send an error if TransferOpen fails, in handle
files we could send an error instead, so check the error type.
@probot-auto-merge probot-auto-merge bot merged commit 765ba4c into fclairamb:master Jul 12, 2020
@drakkan drakkan deleted the opentrans branch February 15, 2021 20:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants