2.6.11 corrupting FTP session

2.6.11 corrupting FTP session

[Michel Pereira]

[-- Attachment #1: Type: text/plain, Size: 505 bytes --]

   Hi, after a upgrade to 2.6.11 I'm experiencing a corruption on the commands
send from the user and to the user like this:
   "500 'R'" Command understood.

Thank you
--
Michel Pereira
michel.pereira@eurorscg.com
+55 11 5105 0570
+55 11 5105 0569
www.eurorscg4d.com.br
Euro RSCG 4D

Unix Sex: unzip;strip;touch;finger;mount;fsck;more;yes;umount;sleep






----------------------------------------------------------------
Conectcor - velocidade com qualidade
www.conectcor.com.br

[-- Attachment #2: FtpWithOutNat.bz2 --]
[-- Type: application/octet-stream, Size: 459805 bytes --]

[-- Attachment #3: FtpWithOutNat.bz2.md5 --]
[-- Type: application/octet-stream, Size: 52 bytes --]

9b1235586ea3c03dae53101bae724ac6  FtpWithOutNat.bz2

Re: 2.6.11 corrupting FTP session

[Patrick McHardy]

Michel Pereira wrote:
>    Hi, after a upgrade to 2.6.11 I'm experiencing a corruption on the commands
> send from the user and to the user like this:
>    "500 'R'" Command understood.

What is your setup (NAT rules, network topology between client and
server)?

Regards
Patrick

Re: 2.6.11 corrupting FTP session

[Michel Pereira]

Quoting Patrick McHardy <kaber@trash.net>:
> What is your setup (NAT rules, network topology between client and
> server)?

   Firewall (a) -> Server on DMZ. (NAT of internal network connections)
   Firewall (b) -> Internal Network (without NAT of connections)

   b - iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
   b - iptables -A FORWARD -s myip -d 0/0 -m state --state NEW -j ACCEPT

   a - iptables -t nat -A PREROUTING -p TCP -s 0/0 -d 200.162.38.71 --dport 21
-j DNAT --to IPonDMZ

Thank you
--
Michel Pereira
michel.pereira@eurorscg.com
+55 11 5105 0570
+55 11 5105 0569
www.eurorscg4d.com.br
Euro RSCG 4D

Unix Sex: unzip;strip;touch;finger;mount;fsck;more;yes;umount;sleep


----------------------------------------------------------------
Conectcor - velocidade com qualidade
www.conectcor.com.br

Re: 2.6.11 corrupting FTP session

[Harald Welte]

[-- Attachment #1: Type: text/plain, Size: 1196 bytes --]

On Sun, Mar 20, 2005 at 02:58:23PM -0300, Michel Pereira wrote:
> Quoting Patrick McHardy <kaber@trash.net>:
> > What is your setup (NAT rules, network topology between client and
> > server)?
> 
>    Firewall (a) -> Server on DMZ. (NAT of internal network connections)
>    Firewall (b) -> Internal Network (without NAT of connections)
> 
>    b - iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
>    b - iptables -A FORWARD -s myip -d 0/0 -m state --state NEW -j ACCEPT
> 
>    a - iptables -t nat -A PREROUTING -p TCP -s 0/0 -d 200.162.38.71 --dport 21
> -j DNAT --to IPonDMZ

this sounds pretty straight forward, still i can't reproduce the problem
at all. which ftp server and client are you using?

I suppose both firewalls have loaded ip_conntrack_ftp, and 'b' has
ip_nat_ftp ?

-- 
- Harald Welte <laforge@netfilter.org>                 http://netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: 2.6.11 corrupting FTP session

[Milos Wimmer]

On Fri, 1 Apr 2005, Harald Welte wrote:

> this sounds pretty straight forward, still i can't reproduce the problem
> at all. which ftp server and client are you using?

  I have same problem (see Bug #308).

  I'm using command line ftp client on Linux machines and command line ftp 
client on Windows XP.
And any of ftp serveres which I tried (e.g. 
ftp://ftp.zcu.cz/pub/doc/rfc/, 
ftp://ftp.netfilter.org/pub/patch-o-matic-ng/snapshot/,
ftp.cesnet.cz,  ...)

I'm using Linux firewalls with shorewall package on many sites and I 
found this problem on any of them.


For simplification - I build test configuration with 1 firewall box and 1
client box on my office now. Firewall has 2 interfaces - one to Internet,
second to local network - client. Client box is connected to firewall with
crosswired twisted pair cable.
Client uses no iptables and when it is connected to Internet, it transfers
all files via active ftp session without problems.

On the firewall I use vanilla Shorewall (2.x.x) configuration with
"loc    net     ACCEPT"  global policy, no any other specialities.

When I'm running kernel 2.4.x and 2.6.0-2.6.10 kernel on the firewall,
active ftp session on the client works fine. When I'm running 2.6.11,
2.6.11.x and 2.6.12-rc1 kernel on the firewall box, active ftp session
with "mget *" command fails after 6 transfered files.
Passive ftp session works fine on any kernel.

I used vanilla kernel without patches (I could send you my kernel config 
file).

        Milos Wimmer

Re: 2.6.11 corrupting FTP session

[Phil Oester]

On Sat, Apr 02, 2005 at 09:31:13PM +0200, Milos Wimmer wrote:
>  I have same problem (see Bug #308).
> 
> When I'm running kernel 2.4.x and 2.6.0-2.6.10 kernel on the firewall,
> active ftp session on the client works fine. When I'm running 2.6.11,
> 2.6.11.x and 2.6.12-rc1 kernel on the firewall box, active ftp session
> with "mget *" command fails after 6 transfered files.
> Passive ftp session works fine on any kernel.

I'll post a patch for this shortly -- I've tracked it down to a TCP
sequence adjustment problem.

Phil

Re: 2.6.11 corrupting FTP session

[Patrick McHardy]

Harald Welte wrote:
> this sounds pretty straight forward, still i can't reproduce the problem
> at all. which ftp server and client are you using?

Me neither. I could trigger it totally unreliable, but couldn't figure
out what the problem is. My guess so far is that it is somehow related
to retransmissions.

Regards
Patrick

Re: 2.6.11 corrupting FTP session

[Phil Oester]

On Sun, Apr 03, 2005 at 05:58:17PM +0200, Patrick McHardy wrote:
> Harald Welte wrote:
> >this sounds pretty straight forward, still i can't reproduce the problem
> >at all. which ftp server and client are you using?
> 
> Me neither. I could trigger it totally unreliable, but couldn't figure
> out what the problem is. My guess so far is that it is somehow related
> to retransmissions.

It is caused by TCP sequence adjustment problems -- see my email with subject
'[PATCH] Fix NAT TCP sequence adjustment'

Phil

Re: 2.6.11 corrupting FTP session

[Patrick McHardy]

Phil Oester wrote:
> It is caused by TCP sequence adjustment problems -- see my email with subject
> '[PATCH] Fix NAT TCP sequence adjustment'

Great. I'll get to that later tonight.

Regards
Patrick