From: Amos Jeffries <squid3@treenet.co.nz>
Date: Wed, 19 Aug 2009 05:26:19 +0000 (+1200)
Subject: Bug 2718: FTP sends EPSV2 on ipv4 connection
X-Git-Tag: SQUID_3_1_0_14~55
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=94898892458628c9f58c6e06a35b316447395587;p=thirdparty%2Fsquid.git

Bug 2718: FTP sends EPSV2 on ipv4 connection

Switch EPSV attempts based on the FTP control/data Channel IP type.
 * EPSV ALL still sent by preference.
 * EPSV 2 only attempted on IPv6 data links
 * EPSV 1 only attempted on IPv4 data links

Also adds better debugging trace of what is being performed.
---

diff --git a/src/ftp.cc b/src/ftp.cc
index 1d932da87c..1f53b53393 100644
--- a/src/ftp.cc
+++ b/src/ftp.cc
@@ -2615,72 +2615,91 @@ ftpSendPassive(FtpStateData * ftpState)
     }
 
     addr = *AI;
-
     addr.FreeAddrInfo(AI);
 
-    /** Otherwise, Open data channel with the same local address as control channel (on a new random port!) */
-    addr.SetPort(0);
-    int fd = comm_open(SOCK_STREAM,
-                       IPPROTO_TCP,
-                       addr,
-                       COMM_NONBLOCKING,
-                       ftpState->entry->url());
-
-    debugs(9, 3, HERE << "Unconnected data socket created on FD " << fd << " to " << addr);
-
-    if (fd < 0) {
-        ftpFail(ftpState);
-        return;
-    }
-
-    ftpState->data.opened(fd, ftpState->dataCloser());
-
     /** \par
       * Send EPSV (ALL,2,1) or PASV on the control channel.
       *
       *  - EPSV ALL  is used if enabled.
-      *  - EPSV 2    is used if ALL is disabled and IPv6 is available.
-      *  - EPSV 1    is used if EPSV 2 (IPv6) fails or is not available.
+      *  - EPSV 2    is used if ALL is disabled and IPv6 is available and ctrl channel is IPv6.
+      *  - EPSV 1    is used if EPSV 2 (IPv6) fails or is not available or ctrl channel is IPv4.
       *  - PASV      is used if EPSV 1 fails.
       */
     switch (ftpState->state) {
-    case SENT_EPSV_1: /* EPSV options exhausted. Try PASV now. */
-        snprintf(cbuf, 1024, "PASV\r\n");
-        ftpState->state = SENT_PASV;
-        break;
+    case SENT_EPSV_ALL: /* EPSV ALL resulted in a bad response. Try ther EPSV methods. */
+        ftpState->flags.epsv_all_sent = true;
+        if (addr.IsIPv6()) {
+            debugs(9, 5, HERE << "FTP Channel is IPv6 (" << addr << ") attempting EPSV 2 after EPSV ALL has failed.");
+            snprintf(cbuf, 1024, "EPSV 2\r\n");
+            ftpState->state = SENT_EPSV_2;
+            break;
+        }
+        // else fall through to skip EPSV 2
 
     case SENT_EPSV_2: /* EPSV IPv6 failed. Try EPSV IPv4 */
-        snprintf(cbuf, 1024, "EPSV 1\r\n");
-        ftpState->state = SENT_EPSV_1;
-        break;
+        if (addr.IsIPv4()) {
+            debugs(9, 5, HERE << "FTP Channel is IPv4 (" << addr << ") attempting EPSV 1 after EPSV ALL has failed.");
+            snprintf(cbuf, 1024, "EPSV 1\r\n");
+            ftpState->state = SENT_EPSV_1;
+            break;
+        }
+        else if (ftpState->flags.epsv_all_sent) {
+            debugs(9, DBG_IMPORTANT, "FTP does not allow PASV method after 'EPSV ALL' has been sent.");
+            ftpFail(ftpState);
+            return;
+        }
+        // else fall through to skip EPSV 1
 
-    case SENT_EPSV_ALL: /* EPSV ALL resulted in a bad response. Try ther EPSV methods. */
-        ftpState->flags.epsv_all_sent = true;
-        snprintf(cbuf, 1024, "EPSV 2\r\n");
-        ftpState->state = SENT_EPSV_2;
+    case SENT_EPSV_1: /* EPSV options exhausted. Try PASV now. */
+        debugs(9, 5, HERE << "FTP Channel (" << addr << ") rejects EPSV connection attempts. Trying PASV instead.");
+        snprintf(cbuf, 1024, "PASV\r\n");
+        ftpState->state = SENT_PASV;
         break;
 
     default:
         if (!Config.Ftp.epsv) {
+            debugs(9, 5, HERE << "EPSV support manually disabled. Sending PASV for FTP Channel (" << addr <<")");
             snprintf(cbuf, 1024, "PASV\r\n");
             ftpState->state = SENT_PASV;
         } else if (Config.Ftp.epsv_all) {
+            debugs(9, 5, HERE << "EPSV ALL manually enabled. Attempting with FTP Channel (" << addr <<")");
             snprintf(cbuf, 1024, "EPSV ALL\r\n");
             ftpState->state = SENT_EPSV_ALL;
             /* block other non-EPSV connections being attempted */
             ftpState->flags.epsv_all_sent = true;
         } else {
 #if USE_IPV6
-            snprintf(cbuf, 1024, "EPSV 2\r\n");
-            ftpState->state = SENT_EPSV_2;
-#else
-            snprintf(cbuf, 1024, "EPSV 1\r\n");
-            ftpState->state = SENT_EPSV_1;
+            if (addr.IsIPv6()) {
+                debugs(9, 5, HERE << "FTP Channel (" << addr << "). Sending default EPSV 2");
+                snprintf(cbuf, 1024, "EPSV 2\r\n");
+                ftpState->state = SENT_EPSV_2;
+            }
 #endif
+            if (addr.IsIPv4()) {
+                debugs(9, 5, HERE << "Channel (" << addr <<"). Sending default EPSV 1");
+                snprintf(cbuf, 1024, "EPSV 1\r\n");
+                ftpState->state = SENT_EPSV_1;
+            }
         }
         break;
     }
 
+    /** Otherwise, Open data channel with the same local address as control channel (on a new random port!) */
+    addr.SetPort(0);
+    int fd = comm_open(SOCK_STREAM,
+                       IPPROTO_TCP,
+                       addr,
+                       COMM_NONBLOCKING,
+                       ftpState->entry->url());
+
+    debugs(9, 3, HERE << "Unconnected data socket created on FD " << fd << " from " << addr);
+
+    if (fd < 0) {
+        ftpFail(ftpState);
+        return;
+    }
+
+    ftpState->data.opened(fd, ftpState->dataCloser());
     ftpState->writeCommand(cbuf);
 
     /*