Linux Netfilter discussions
 help / color / mirror / Atom feed
From: Pascal Hambourg <pascal@plouf.fr.eu.org>
To: Tomek L <tl-netfilter@gazeta.pl>
Cc: netfilter@vger.kernel.org
Subject: Re: FTP connection tracking doesn't work with nftables
Date: Sun, 17 May 2015 22:59:58 +0200	[thread overview]
Message-ID: <5559014E.7070803@plouf.fr.eu.org> (raw)
In-Reply-To: <CANfWn6XQfrmDkYLiBOS8qQLLvngpC0iu5FAUQf-Hz=pE7uAcZA@mail.gmail.com>

Tomek L a écrit :
> I agree on source port issue, but I don't think that in case of TLS
> there is nothing that can be done with FTP helper. Still we can assume
> that just after TLS AUTH negotiation, client will connect on high port
> with new connection to server. Now we are in situation, where if TLS
> is used, high ports on server side must be open all the time.

IMO, it is not much better to open all passive ports to any host which
has established a connection to port 21 regardless of whether a
PASV/EPSV command was acknowledged by the server.

  reply	other threads:[~2015-05-17 20:59 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-05-13 21:03 FTP connection tracking doesn't work with nftables Tomek L
2015-05-16 11:47 ` Tomek L
     [not found]   ` <CAJO99Tm9G3H+jMibWBj2pkAgg1SdFTVS_pqEQ6P=COMqe7Ppcg@mail.gmail.com>
2015-05-16 15:34     ` Tomek L
     [not found]       ` <CAJO99Tko6zWC8hH64vGJ6cXXNg3rfLQBo+DL-XuF=b8j82OtOA@mail.gmail.com>
2015-05-17  5:48         ` Tomek L
2015-05-17 13:32       ` Pascal Hambourg
2015-05-17 16:53         ` Tomek L
2015-05-17 20:59           ` Pascal Hambourg [this message]
2015-05-18  5:58             ` Tomek L

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=5559014E.7070803@plouf.fr.eu.org \
    --to=pascal@plouf.fr.eu.org \
    --cc=netfilter@vger.kernel.org \
    --cc=tl-netfilter@gazeta.pl \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox