Subject: Re: [ftpext] [Uri-review] draft-yevstifeyev-ftp-uri-scheme-01 posted

From: Gordon Spoelhof <[email-masked]>
Date: Wed, 1 Jun 2011 09:35:16 -0700

Granted I am behind on my RFCs, but I section 4.1.1 of RFC 959 specifies an authorization method consisting of USER, PASS, and ACCT where ACCT is the account under which
a user accesses the system.  SOME systems required this "back in the day", and use of ACCT was optional.

Question 1: for backward compatibility, where does ACCT fit into the scheme?
Question 2: (not really that applicable), but as "experimental" what efforts for secure ftp and sftp uris are in the works, and if so, can the schemes share some syntactic similarity?

________________________________________
From: [email-masked] [[email-masked]] On Behalf Of Mykyta Yevstifeyev [[email-masked]]
Sent: Friday, May 27, 2011 4:31 AM
To: [email-masked]; [email-masked]
Cc: Anthony Bryan; Tony Hansen
Subject: [Uri-review] draft-yevstifeyev-ftp-uri-scheme-01 posted

Hi all,

I've just posted draft-yevstifeyev-ftp-uri-scheme-01; please find it here:

http://tools.ietf.org/html/draft-yevstifeyev-ftp-uri-scheme-01

The new revision tries to address comments from Daniel as well as from John.  It also incorporates various editorial improvements.  The diffs can be found here: http://tools.ietf.org/rfcdiff?url2=draft-yevstifeyev-ftp-uri-scheme-01.  Please, if you have any comments and suggestions, feel free to express them.

Considering the necessity of wide community involvement, I'd like to ask to adopt this draft as the ftpext2 WG item.  I am copying this message to WG chairs to let them know and decide if it is OK.

All the best,
Mykyta Yevstifeyev

A new version of I-D, draft-yevstifeyev-ftp-uri-scheme-01.txt has been successfully submitted by Mykyta Yevstifeyev and posted to the IETF repository.

Filename:        draft-yevstifeyev-ftp-uri-scheme
Revision:        01
Title:           The &#39;ftp&#39; URI Scheme
Creation date:   2011-05-27
WG ID:           Individual Submission
Number of pages: 12

This email and any attached files are confidential and intended solely for the intended recipient(s). If you are not the named recipient you should not read, distribute, copy or alter this email. Any views or opinions expressed in this email are those of the author and do not represent those of the company. Warning: Although precautions have been taken to make sure no viruses are present in this email, the company cannot accept responsibility for any loss or damage that arise from the use of this email or attachments.

---

From: Daniel Stenberg <[email-masked]>
Date: Wed, 1 Jun 2011 19:33:06 +0200 (CEST)

On Wed, 1 Jun 2011, Gordon Spoelhof wrote:

> Granted I am behind on my RFCs, but I section 4.1.1 of RFC 959 specifies an 
> authorization method consisting of USER, PASS, and ACCT where ACCT is the 
> account under which a user accesses the system.  SOME systems required this 
> "back in the day", and use of ACCT was optional.
>

For backward compatibility with RFC1738 there is no particular attention to 
ACCT and yes that is a sort of an oversight methinks.

> Question 2: (not really that applicable), but as "experimental" what efforts 
> for secure ftp and sftp uris are in the works, and if so, can the schemes 
> share some syntactic similarity?

As it seems the work is to "refresh" RFC1738 there's of course no room for 
these... But I'll offer my 2 cents on them anyway:

"secure ftp" is RFC4217 (Securing FTP with TLS) I presume. I think it could 
have pretty much identical spec as plain FTP. With some TLS-specific bits 
added somewhere perhaps.

SFTP is not even a properly specified protocol as it never got passed a series 
of Internet-Drafts, and lots of implementations are stuck on implementing some 
of the older drafts. The URI spec work for SCP, SFTP and SSH only reached 
http://tools.ietf.org/html/draft-ietf-secsh-scp-sftp-ssh-uri-04. It differs a 
bit from the FTP one.

There are implementations supporting FTP, FTP-SSL and SFTP based on this.

-- 

  / daniel.haxx.se

---

From: Mykyta Yevstifeyev <[email-masked]>
Date: Thu, 02 Jun 2011 09:52:35 +0300

01.06.2011 20:33, Daniel Stenberg wrote:
>> Granted I am behind on my RFCs, but I section 4.1.1 of RFC 959 
>> specifies an authorization method consisting of USER, PASS, and ACCT 
>> where ACCT is the account under which a user accesses the system.  
>> SOME systems required this "back in the day", and use of ACCT was 
>> optional.
>>
> For backward compatibility with RFC1738 there is no particular 
> attention to ACCT and yes that is a sort of an oversight methinks.
I agree with Daniel, the ACCT command isn't going to be used with 'ftp' 
URI scheme; so I'll add the following text in Section 2.2.1:

>     The 'ftp' URI scheme does not provide the way to denote account
>     information used with ACCT (account) FTP command; thus, if the server
>     requests account information upon sending pasword via returning 332
>     reply or it is required for other action (which is indicated by
>     receiving either 332 or 532 reply), account information SHALL be
>     requested from the user and sent to the server.
Is it OK?
>
>> Question 2: (not really that applicable), but as "experimental" what 
>> efforts for secure ftp and sftp uris are in the works, and if so, can 
>> the schemes share some syntactic similarity?
>
> As it seems the work is to "refresh" RFC1738 there's of course no room 
> for these...
Concur.
> But I'll offer my 2 cents on them anyway:
>
> "secure ftp" is RFC4217 (Securing FTP with TLS) I presume. I think it 
> could have pretty much identical spec as plain FTP. With some 
> TLS-specific bits added somewhere perhaps.
I agree with this as well.  The 'ftps' scheme will certainly have the 
same syntax, but specifying it in the current document isn't 
appropriate, as Daniel explained above.
>
> SFTP is not even a properly specified protocol as it never got passed 
> a series of Internet-Drafts, and lots of implementations are stuck on 
> implementing some of the older drafts. The URI spec work for SCP, SFTP 
> and SSH only reached 
> http://tools.ietf.org/html/draft-ietf-secsh-scp-sftp-ssh-uri-04. It 
> differs a bit from the FTP one.
Yes, Secure Shell WG was working on SFTP, but was concluded before the 
work was completed.  I see the draft 
(http://tools.ietf.org/html/draft-ietf-secsh-filexfer-12) intended to 
become SFTP specification, but it wasn't even brought to IESG attention 
(as far as I see at 
https://datatracker.ietf.org/doc/draft-ietf-secsh-filexfer/history/).  
Rather the same situation is with draft-ietf-secsh-scp-sftp-ssh-uri; so 
let's first wait for SFTP specification before defining the URI scheme 
for it.

Mykyta Yevstifeyev

---

From: Mykyta Yevstifeyev <[email-masked]>
Date: Thu, 09 Jun 2011 13:14:05 +0300

Hello,

I've been working on this document to consider comments from Daniel.  
I'm ready to publish -02; however I'd like we achieved consensus with 
regard to the following issue.

RFC 1738 clearly mentions:

>     Within a name or CWD component, the characters "/" and ";" are
>     reserved and must be encoded.
In my draft, -01 there is:

>       ftp-path      =/ [ ( [ cwd-part ] [ name ] ) ] [ typecode-part ]
>       cwd-part      =  *( "/" cwd )
>       cwd           = segment
>       name          = segment-nz
>       typecode-part =<specified inSection 2.1  <http://tools.ietf.org/html/draft-yevstifeyev-ftp-uri-scheme-01#section-2.1>>
>
>     where the<segment>  and<segment-nz>  rules are defined inRFC 3986  <http://tools.ietf.org/html/rfc3986>
>     [RFC3986  <http://tools.ietf.org/html/rfc3986>],Appendix A  <http://tools.ietf.org/html/draft-yevstifeyev-ftp-uri-scheme-01#appendix-A>.  The ";" character, even allowed byRFC 3986  <http://tools.ietf.org/html/rfc3986>
>     is the aforementioned productions, SHALL be escaped by percent
>     encoding.
However, since ABNF is normative, restriction of ";" should also be 
reflected there.  I've been thinking of:

> ftp-path       = [ [ cwd-part ] [ "/" name ] ] [ typecode-part ]
> cwd-part       =  *( "/" cwd )
> cwd            = ftp-segment
> name           = ftp-segment-nz
> ftp-segment    = *ftp-pchar
> ftp-segment-nz = 1*ftp-pchar
> ftp-pchar      = unreserved / pct-encoded / ftp-sub-delims
>                / ":" / "@"
> ftp-sub-delims = "!" / "$" / "&" / "'" / "(" / ")"
>                / "*" / "+" / "," / "="
>                ;RFC 3986 <sub-delims> excluding ";"
> typecode-part  = ";typecode=" typecode
> typecode       = "a" / "i" / "d"
Therefore I'd like to ask which ABNF is acceptable?

Also, I haven't seen comments to Section 2.2.4, added per John's 
comment.  Is it also acceptable?

Mykyta Yevstifeyev

27.05.2011 11:31, Mykyta Yevstifeyev wrote:
> The new revision tries to address comments from Daniel as well as from 
> John.  It also incorporates various editorial improvements.  The diffs 
> can be found here: 
> http://tools.ietf.org/rfcdiff?url2=draft-yevstifeyev-ftp-uri-scheme-01.  
> Please, if you have any comments and suggestions, feel free to express 
> them.
>
> Considering the necessity of wide community involvement, I'd like to 
> ask to adopt this draft as the ftpext2 WG item.  I am copying this 
> message to WG chairs to let them know and decide if it is OK.
>
> All the best,
> Mykyta Yevstifeyev
>
>> Title:		 The&#39;ftp&#39; URI Scheme

---

From: Anthony Bryan <[email-masked]>
Date: Thu, 9 Jun 2011 18:38:37 -0400

On Fri, May 27, 2011 at 4:31 AM, Mykyta Yevstifeyev <[email-masked]> wrote:
> Considering the necessity of wide community involvement, I'd like to ask to
> adopt this draft as the ftpext2 WG item.  I am copying this message to WG
> chairs to let them know and decide if it is OK.

after talking to our AD, this would require a re-charter of the
FTPEXT2 WG to adopt it, as it is not an extension to FTP.
there doesn't seem to be enough support to make this happen.

-- 
(( Anthony Bryan ... Metalink [ http://www.metalinker.org ]
  )) Easier, More Reliable, Self Healing Downloads