Subject: Ftp-WG: PROXY mode

From: "Paul V Ford-Hutchinson" <[email-masked]>
Date: Tue, 26 Jun 2001 05:57:53 -0500

I assume, by 'proxy mode' you are referring to the PASV mechanism.

How does it work ?

Normally, FTP gets the server to connect to the client to initiate the 
data connection.  In passive mode, the connection goes the other way.

NORMAL
=========

client gets socket() and bind()s (and gets port number from O/S)
C>S2 PORT 10,1,1,1,5,5
S2>C 200 text
C>S2 STOR filename
server2 gets socket
S2>C 150 text
server2 connect()s to client address/port (from PORT command)
data flows and connection is close()d
S2>C 226 text

PASSIVE
========

C>S1 PASV
server1 gets socket() and bind()s to port (and gets port number from O/S)
S1>C 227 (10,1,1,2,5,6)
client gets socket()
C>S1 RETR file
client connects to server1
S1>C 150 text
data flows and conection is close()d
S1>C 226 text

So, for server->server file xfer we combine the two
==========================================

C>S1 PASV
server1 gets socket() and bind()s to port (and gets port number from O/S)
S1>C 227 (10,1,1,2,5,6)
client forwards to Server 2
C>S2 PORT 10,1,1,2,5,6
S2>C 200 text
C>S2 STOR filename
server2 gets socket
S2>C 150 text
C>S1 RETR filename
server2 connect()s to server1 address/port (from PORT command)
S1>C 150 text
data flows and connection is close()d
S1>C 226 text
S2>C 226 text

Server support
=============

- PASV is very important fro Firewall Friendly ftp (RFC 1579) and should 
be implemented in servers for this purpose if for no other reason
- PASV for allowing Server-Server file transfer is defined in RFC 959
- PASV must be supported according to RFC 1123

Client Support
============

- A client's support for RFC 1579 is pretty sensible (but some major ones 
do not)
- A client's support for Server-Server file xfer is pretty much QOI issue. 
 (again, many don't)
- I have no idea how much the server-server stuff is actually used.

Other 
=====

The server-server part of the passive mechanism can be used in a security 
attack (see draft-ietf-ftpext-sec-consider-02.txt) - "Bounce Attack".  It 
may be perfectly acceptable for a server to refuse PASV connections to a 
host that is not the owner of the control connection, in which case the 
server-server stuff may be irrelevant.

My personal guess is that a client's ablility to do server-server is a 
pretty powerful tool that is understood by a few people who will fight for 
it forever.  But in practice it is little used and can cause problems. 

Please also note that pretty much all ftp security extensions (RFC 2228, 
draft-murray-auth-ftp-ssl-07.txt, etc ...) forbid server-server file 
transfer.  This is for practical rather than pure security reasons.

Cheers,
Paul

--
Paul Ford-Hutchinson :  eCommerce application security : 
[email-masked]
MPT-6, IBM , PO Box 31, Birmingham Rd, Warwick, CV34 5JL +44 (0)1926 
462005

Please respond to FTPEXT Working Group <[email-masked]> 
To:     [email-masked]
cc: 
Subject:        Ftp-WG: PROXY mode

One thing I would like to understand about PROXY mode is:
   is it often implemented?
   is it often used?
   How is proxy mode used?  I realize it allows a client to send files
   directly from server to server, but how do folks exploit this
   capability?

Any insights you can provide are very welcome!   Thanks!