FTPS Passive Mode

[xenog 0]

I have a customer whose FTP Server is not correctly configured. They will not change it, which is very frustrating. When my FTPS Client issues the PASV command, the server responds with its local IP address and a port number. It should of course respond with the public IP, if the FTP Server was configured correctly. The TSslFtpClient tries to connect to the local IP that is sent by the server, but obviously fails, as the local IP is hidden behind a NAT router. I noticed that the FileZilla Client gets round this problem by trying the local IP and when it fails it then tries the public IP that it originally connected to.

 

Command:    PASV
Response:    227 Entering Passive Mode (192,168,0,173,113,168).
Status:    Server sent passive reply with unroutable address. Using server address instead.

 

My Delphi skills are awful (I code in C++ Builder), so I can't attempt to replicate what FileZilla does. I have made two small changes to my copy of OverbyteIcsFtpCli.pas. I apologise for the poor code, but can anyone tell me if this is OK to do to or if there is a better way.

 

This code is added to DoGetAsync and DoPutAppendAsync

 

if (FDnsResult <> TargetIP) and (FDnsResult.Length > 0) then
  DataSocketGetInit(IntToStr(TargetPort), FDnsResult)
else
  DataSocketGetInit(IntToStr(TargetPort), TargetIP);

 

The original code was just

DataSocketGetInit(IntToStr(TargetPort), TargetIP);

 

Thanks,

Richard

 

 

[Angus Robertson 577]

You are probably using an old version of ICS, similar functionality was added a couple of years ago in V8.63, provided you set ftpFixPasvLanIP in Options.

 

Angus

 

[Remy Lebeau 1436]

2 hours ago, xenog said:

I noticed that the FileZilla Client gets round this problem by trying the local IP and when it fails it then tries the public IP that it originally connected to.

Indy's TIdFTP component has a similar option.  Except that, rather than attempt the reply IP first then fallback to the connected IP, it has a PassiveUseControlHost property to control whether it should just ignore the reply IP altogether and use the connected IP only.  Not quite the same thing.  I'm thinking now that I should add FileZilla's behavior to TIdFTP if PassiveUseControlHost is false.

Edited August 5, 2021 by Remy Lebeau

[xenog 0]

Thanks Angus. I tried to upgrade today, but getting C++ Builder to install the latest ICS is proving difficult. Builder seems to want the lib, obj and hpp files and is being really awkward. Not your fault at all, as the Delphi version installs super easily.

 

I did notice that you added your ftpFixPasvLanIP fix to DoGetAsync, but you haven't added it to DoPutAppendAsync. Does this mean that the PASV problem will still exist when sending a file to a server?

 

Thanks for all you do to keep this amazing software in such good shape.

Richard

[Fr0sT.Brutal 900]

Hmm, I had to add main host override for passive mode to my mod of inet suite for different reason - when connection is secure, TLS session is reused only if host addresses are the same. But connection establishes with hostname and passive mode responds with IP - obviously no match.

Edited August 6, 2021 by Fr0sT.Brutal

[Angus Robertson 577]

Quote

I did notice that you added your ftpFixPasvLanIP fix to DoGetAsync, but you haven't added it to DoPutAppendAsync.

Woops, will be fixed early next week.

 

Angus

 

[FPiette 385]

11 hours ago, xenog said:

but getting C++ Builder to install the latest ICS is proving difficult.

We always wanted someone giving feedback with C++ builder so that installation goes as smooth as with Delphi. Should not be to difficult because ICS is source code only.

[xenog 0]

1 hour ago, FPiette said:

We always wanted someone giving feedback with C++ builder so that installation goes as smooth as with Delphi. Should not be to difficult because ICS is source code only.

Hi François, I have both the Delphi and C++ personalities installed and it is clear that Embarcadero have problems with C++ Builder. If I install the Delphi ICS, it builds and installs with no problems. If I then try and use these components in a C++ project, I get compile errors as C++ Builder can't find the lib and hpp files and then I get linker errors as it can't find the obj files. This is entirely an Embarcadero problem, as your code works perfectly. If I try to install ICS with the C++ Builder packages, I don't get the hpp files or obj files, even if I change the project properties to output all Builder files.  Some of these problems could be down to my lack of understanding of how C++ Builders with packages.

 

I'll try again next week and see if I can find a way to get Builder to be happy. Failing that, I may install the Delphi ICS, so that I have the components on the palette, and then add the ICS PAS files to each of my C++ builder projects, so that it can make the hpp and obj files. It's shame that Embarcadero can't allow a Delphi component to work seamlessly in a C++ project. I did try installing ICS from Getit, but that only works for Delphi projects.

 

Thanks for the beautiful components. They are a joy to use.

 

Richard

[FPiette 385]

2 hours ago, xenog said:

I'll try again next week and see if I can find a way to get Builder to be happy.

Would be nice if you can write a short document explaining step by step what has to be done so that even C++ Builder newbies can install ICS easilly. This document would be added to the readme file.

 

[Angus Robertson 577]

The ftpFixPasvLanIP fix is finally in SVN, sorry for the delay. 

 

Angus