From: Philip Craig <philipc@snapgear.com>
To: Frank Bulk <frnkblk@iname.com>
Cc: netfilter-devel@vger.kernel.org
Subject: Re: conntrack ftp fails to handle PORT (and PASV?) command when split over multiple TCP packets
Date: Tue, 18 Nov 2008 10:30:01 +1000 [thread overview]
Message-ID: <49220C89.4040801@snapgear.com> (raw)
In-Reply-To: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAACjGmKcXUZtSrl15MejBLj+AQAAAAA=@iname.com>
Frank Bulk wrote:
> Can anyone confirm that iptables still behaves this way, and if so, code a
> fix so that no matter how many packets a PORT or PASV command are split over
> (in other words, no matter how small the client's MTU) that iptables ACKs
> each packet received on the LAN side and the ALG properly reassembles the
> command and sends it out the WAN interface?
iptables is a packet filter, not an ALG. You could add more state to the
helper, but it would be hard to get right, and I don't think it is worth
the effort. Try using a userspace ftp proxy instead. (eg I've used frox
with no problems.)
next prev parent reply other threads:[~2008-11-18 0:30 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-11-15 21:13 conntrack ftp fails to handle PORT (and PASV?) command when split over multiple TCP packets Frank Bulk
2008-11-17 11:08 ` Jozsef Kadlecsik
2008-11-18 0:30 ` Philip Craig [this message]
2008-11-18 2:36 ` Frank Bulk
2008-11-18 3:32 ` Philip Craig
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=49220C89.4040801@snapgear.com \
--to=philipc@snapgear.com \
--cc=frnkblk@iname.com \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.