iptables ip_conntrack_ftp + proftpd TLS: PORT command not understood

That's true ... proftpd has been configured to encrypt auth+data so the PORT command is sent in cleartext way.

I you read
question Using mod_tls, FTP sessions through my firewall now no longer work. What's going on? at http://www.castaglia.org/proftpd/doc/contrib/ProFTPD-mini-HOWTO-TLS.html

proftpd developers suggest to do this to fix this problem... but it do not work.

please help

Filippo Zeus ha scritto:

Did you verify, by using for example tcpdump, that th client is actually using CCC, sending commands in clear text?

thanks for your help at first !

yes. and i've tested tons of clients (ftp-ssl, filezilla, hated M$-IE). unfortunatly tcpdump has confirmed my prefeeling.
Also, reading at proftpd log i can see that encrypted channel is switched off after PASS command and stay on only for the data channel.

I'm not shure, cause i'm not a developer, but i think that ftp_conntrak module open a port *ONLY* if it read first the USER command, then the PASS command, then PASV/PORT commands
not simply if a (cleartext) PORT command came from the ftp client.

Please send a tcpdump.

Considering ftp-control port is text based i've dumped with -A switch. I hope it's ok

********** TCPDUMP LOG STARTS HERE **********
[zeus@augustus ~] % sudo tcpdump -A -i ppp0 -n
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ppp0, link-type PPP (PPP), capture size 96 bytes
03:05:57.045277 IP 151.80.2.63.55194 > ***HIDDEN_IP***.21: S 834183062:834183062(0) win 8192 <mss 1460,nop,wscale 3,nop,nop,timestamp 538543633 0,sackOK,eol> 2....1......... ................
...........
03:05:58.008113 IP 151.80.2.63.55194 > ***HIDDEN_IP***.21: S 834183062:834183062(0) win 8192 <mss 1460,nop,wscale 3,nop,nop,timestamp 538543642 0,sackOK,eol> 2....1......... ................
...........
03:05:58.289943 IP ***HIDDEN_IP***.21 > 151.80.2.63.55194: S 3283700948:3283700948(0) ack 834183063 win 5840 <mss 1420,nop,nop,sackOK,nop,wscale 7> 2.P.?......L.1.......................
03:05:58.290033 IP 151.80.2.63.55194 > ***HIDDEN_IP***.21: . ack 1 win 1024
2....1.....L.P....Y..+
03:05:59.103851 IP ***HIDDEN_IP***.21 > 151.80.2.63.55194: S 3283700948:3283700948(0) ack 834183063 win 5840 <mss 1420,nop,nop,sackOK,nop,wscale 7> 2.P.?......L.1.......................
03:05:59.103934 IP 151.80.2.63.55194 > ***HIDDEN_IP***.21: . ack 1 win 1024
2....1.....L.P....Y..+
03:05:59.149005 IP ***HIDDEN_IP***.21 > 151.80.2.63.55194: P 1:71(70) ack 1 win 46
2.P.?......L.1...P....`..220 FTP Server ready. Please use FTP-TLS or login wi
03:05:59.149078 IP 151.80.2.63.55194 > ***HIDDEN_IP***.21: . ack 71 win 1024
2....1.....M.P.......+
03:05:59.149759 IP 151.80.2.63.55194 > ***HIDDEN_IP***.21: P 1:11(10) ack 71 win 1024
2....1.....M.P.......AUTH TLS

03:05:59.700919 IP ***HIDDEN_IP***.21 > 151.80.2.63.55194: . ack 11 win 46 2.P.?......M.1...P.......
03:05:59.700939 IP ***HIDDEN_IP***.21 > 151.80.2.63.55194: P 71:96(25) ack 11 win 46 2.P.?......M.1...P...O...234 AUTH TLS successful

03:05:59.701036 IP 151.80.2.63.55194 > ***HIDDEN_IP***.21: . ack 96 win 1024
2....1.....M4P.......+
03:05:59.706276 IP 151.80.2.63.55194 > ***HIDDEN_IP***.21: P 11:95(84) ack 96 win 1024
2....1.....M4P...L.......O...K..H;^w.i} ..\*.+....'b..]...5`.O....$.3.E.9
03:06:00.416441 IP ***HIDDEN_IP***.21 > 151.80.2.63.55194: P 1516:1666(150) ack 95 win 46 2.P.?......R.1...P....[...)E..5O......tsp.+).)..W[H..u.)IP..&....XZr...~.<...
03:06:00.416535 IP 151.80.2.63.55194 > ***HIDDEN_IP***.21: . ack 96 win 1024 <nop,nop,sack 1 {1516:1666}>
2....1.....M4...........
..R...SV
03:06:00.435501 IP ***HIDDEN_IP***.21 > 151.80.2.63.55194: . 96:1516(1420) ack 95 win 46 2.P.?......M41...P...........J...F..H;^x2...qYQP..H:=...H%I=3..X....
.......
03:06:00.435594 IP 151.80.2.63.55194 > ***HIDDEN_IP***.21: . ack 1666 win 1024
2....1.....SVP....z..+
03:06:00.506622 IP 151.80.2.63.55194 > ***HIDDEN_IP***.21: P 95:234(139) ack 1666 win 1024 2....1.....SVP..................8......(......k.8.v.....~W.y...!Ot.......
03:06:01.200890 IP ***HIDDEN_IP***.21 > 151.80.2.63.55194: . ack 234 win 54
2.P.?......SV1...P..6....
03:06:01.200956 IP 151.80.2.63.55194 > ***HIDDEN_IP***.21: P 234:437(203) ack 1666 win 1024 X?..A...M'........$..M.S.........../..X........
03:06:01.882933 IP ***HIDDEN_IP***.21 > 151.80.2.63.55194: . ack 437 win 63
2.P.?......SV1..KP..?....
03:06:01.882941 IP ***HIDDEN_IP***.21 > 151.80.2.63.55194: P 1666:1725(59) ack 437 win 63 2.P.?......SV1..KP..?..............0....9.../!L.]..z^..5&VEL....D..^-...S...-
03:06:01.883016 IP 151.80.2.63.55194 > ***HIDDEN_IP***.21: . ack 1725 win 1024
2....1..K..S.P.......+
03:06:01.903140 IP 151.80.2.63.55194 > ***HIDDEN_IP***.21: P 437:650(213) ack 1725 win 1024 ...&q..p0.......$]..........M.}..{..^`v..o....H.1..
03:06:02.666951 IP ***HIDDEN_IP***.21 > 151.80.2.63.55194: P 1725:1794(69) ack 650 win 71
2.P.?......S.1.. P..Gz.......@)C.#.B1....9....6.=u..6......&..4<...,F..#.y..*
03:06:02.667022 IP 151.80.2.63.55194 > ***HIDDEN_IP***.21: . ack 1794 win 1024
2....1.. ..S.P.......+
03:06:02.681297 IP 151.80.2.63.55194 > ***HIDDEN_IP***.21: P 650:719(69) ack 1794 win 1024
2....1.. ..S.P....`[email protected]././......s.. D..k#......X..V.F......Phv,..
03:06:03.288189 IP ***HIDDEN_IP***.21 > 151.80.2.63.55194: P 1794:1975(181) ack 719 win 71 2.P.?......S.1..eP..G..........,.........;......c7m.~r.._#..OFw.P.`d@F..%...f
03:06:03.288267 IP 151.80.2.63.55194 > ***HIDDEN_IP***.21: . ack 1975 win 1024
2....1..e..T.P.......+
03:06:03.292196 IP 151.80.2.63.55194 > ***HIDDEN_IP***.21: P 719:900(181) ack 1975 win 1024
2....1..e..T.P...W>.........>..
[email protected].'...c".... B........l.T.....
03:06:04.047064 IP ***HIDDEN_IP***.21 > 151.80.2.63.55194: P 1975:2028(53) ack 900 win 80 2.P.?......T.1...P..P........0.7D...y..9iC..p%f...kM;.rg|n).l)I.&..-.!4.OH...
03:06:04.047141 IP 151.80.2.63.55194 > ***HIDDEN_IP***.21: . ack 2028 win 1024
2....1.....T.P.......+
03:06:04.051879 IP 151.80.2.63.55194 > ***HIDDEN_IP***.21: P 900:953(53) ack 2028 win 1024
&....1.....T.P...........0.a.......rR..Y....}..:....7O.E.k.< .'.m/..
03:06:04.781092 IP ***HIDDEN_IP***.21 > 151.80.2.63.55194: P 2028:2097(69) ack 953 win 80
[email protected]_U=.g........
.......^..c.|..9..
03:06:04.781176 IP 151.80.2.63.55194 > ***HIDDEN_IP***.21: . ack 2097 win 1024
2....1..O..U.P....q..+
03:06:04.793662 IP 151.80.2.63.55194 > ***HIDDEN_IP***.21: P 953:1054(101) ack 2097 win 1024
...!E...:
2....1..O..U.P..............8_B.|2...$.>....W&.#.8.D..J.o.8..Z,.......+
03:06:05.417095 IP ***HIDDEN_IP***.21 > 151.80.2.63.55194: P 2097:2166(69) ack 1054 win 80
2.P.?......U.1...P..P\ [email protected].....]..K....=\...v3..;Z0K....A=u.....3MRg.M
03:06:05.417171 IP 151.80.2.63.55194 > ***HIDDEN_IP***.21: . ack 2166 win 1024
2....1.....UJP.......
03:06:05.422336 IP 151.80.2.63.55194 > ***HIDDEN_IP***.21: P 1054:1267(213) ack 2166 win 1024 2....1.....UJP....k............if6.J=.wyJ.....nIp....4cS.]....^2.x..*.D.I
03:06:06.211021 IP ***HIDDEN_IP***.21 > 151.80.2.63.55194: P 2166:2219(53) ack 1267 win 88 2.P.?......UJ1...P..X........0mr...1......w....5..aD.k....H..A.I..5~...eHk#|:
03:06:06.211102 IP 151.80.2.63.55194 > ***HIDDEN_IP***.21: . ack 2219 win 1024
2....1.....U.P.......+
03:06:06.215691 IP 151.80.2.63.55194 > ***HIDDEN_IP***.21: P 1267:1480(213) ack 2219 win 1024 2....1.....U.P..............Y[,.s....d.)...h....]..W[W%...C4U.#... .}.c.A
03:06:06.985733 IP ***HIDDEN_IP***.21 > 151.80.2.63.55194: P 2219:2304(85) ack 1480 win 96 2.P.?......U.1..^P.........PH...5/.u.....!....8.z..V/{.qx..;..._.v...b.\.N"
03:06:06.985773 IP 151.80.2.63.55194 > ***HIDDEN_IP***.21: . ack 2304 win 1024
2....1..^..U.P.......+
03:06:06.990020 IP 151.80.2.63.55195 > ***HIDDEN_IP***.42770: S 2291999512:2291999512(0) win 8192 <mss 1460,nop,wscale 3,nop,nop,timestamp 538543732 0,sackOK,eol> 2......#....... .R!.............
..t........
03:06:06.990156 IP 151.80.2.63.55194 > ***HIDDEN_IP***.21: P 1480:1533(53) ack 2304 win 1024
2....1..^..U.P.....?M+ ......0..|c.%....RM.f.ja.*....s.....}..^]....l*m=eE+.Q
03:06:07.703988 IP ***HIDDEN_IP***.21 > 151.80.2.63.55194: . ack 1533 win 96
2.P.?......U.1...P..`....
03:06:07.921114 IP 151.80.2.63.55195 > ***HIDDEN_IP***.42770: S 2291999512:2291999512(0) win 8192 <mss 1460,nop,wscale 3,nop,nop,timestamp 538543741 0,sackOK,eol> 2......#....... .R..............
..}........
03:06:08.922451 IP 151.80.2.63.55195 > ***HIDDEN_IP***.42770: S 2291999512:2291999512(0) win 8192 <mss 1460,nop,wscale 3,nop,nop,timestamp 538543751 0,sackOK,eol> 2......#....... .R..............
...........
03:06:09.923976 IP 151.80.2.63.55195 > ***HIDDEN_IP***.42770: S 2291999512:2291999512(0) win 8192 <mss 1460,sackOK,eol>
...!E..0<^@.@.
2......#.....p. .E...........
03:06:10.925518 IP 151.80.2.63.55195 > ***HIDDEN_IP***.42770: S 2291999512:2291999512(0) win 8192 <mss 1460,sackOK,eol>
2......#.....p. .E...........
03:06:11.926834 IP 151.80.2.63.55195 > ***HIDDEN_IP***.42770: S 2291999512:2291999512(0) win 8192 <mss 1460,sackOK,eol>
2......#.....p. .E...........
^C
52 packets captured
53 packets received by filter
0 packets dropped by kernel
[zeus@augustus ~] %
********** TCPDUMP LOG ENDS HERE **********

Its a bit hard to read, but this looks like your client also encrypts the control connection, which explains why FTP conntrack doesn't work.

tcpdump -Xs0 is preferred; unless the encryption is temporarily dropped using the CCC command to make the PASV/PORT commands in plaintext, the stream is not analyzable.

Filippo Zeus ha scritto:

[cut]

It seems to me that the whole traffic is encrypted: there's no PASV and no LIST in the hard-to-read tcpdump you sent (hiding ip is useless, since you already sent the protfpd.conf with the true ServerName...)

It sets up an expectation once it sees PORT/EPRT/PASV/EPSV, regardless of USER/PASS.

It does *NOT* recognize the TLS commands SSCN/CPSV, which is probably the problem, if you claim that the control connection is clear-text.

Ah never mind, SSL using SSCN/CPSV seems obsolete since long.

Jan Engelhardt ha scritto:

Aren't these extensions used only in FXP?

i do not know, but I'm using filezilla client.
here are logs.
I Hope this helps

Stato:    Risoluzione dell'indirizzo IP in corso per ftp.lifesaver.it
Trace:    ControlSocket.cpp(979): CRealControlSocket::ContinueConnect(0x1650c678) m_pEngine=0x154cbd30   caller=0x8f7c28
Stato:    Connessione a ***HIDDEN_IP***:21 in corso...
Stato:    Connessione stabilita, in attesa del messaggio di benvenuto...
Trace:    CFtpControlSocket::OnReceive()
Risposta:    220 FTP Server ready. Please use FTP-TLS or login will be rejected.
Trace:    CFtpControlSocket::SendNextCommand()
Comando:    AUTH TLS
Trace:    CFtpControlSocket::OnReceive()
Risposta:    234 AUTH TLS successful
Stato:    Inizializzazione TLS in corso...
Trace:    CTlsSocket::Handshake()
Trace:    CFtpControlSocket::SendNextCommand()
Comando:    USER ftp_temp
Trace:    CTlsSocket::Handshake()
Trace:    CTlsSocket::Handshake()
Trace:    CTlsSocket::Handshake()
Trace:    CTlsSocket::Handshake()
Trace:    CTlsSocket::Handshake()
Trace:    CTlsSocket::Handshake()
Trace:    CTlsSocket::Handshake()
Trace:    CTlsSocket::Handshake()
Trace:    CTlsSocket::Handshake()
Trace:    CTlsSocket::Handshake()
Trace:    CTlsSocket::Handshake()
Trace:    CTlsSocket::Handshake()
Trace:    Handshake successful
Trace:    Cipher: AES-128-CBC, MAC: SHA1
Stato:    Verifica del certificato in corso (checking cert.)...
Stato:    Connessione TLS/SSL established.
Trace:    CFtpControlSocket::OnReceive()
Trace:    CFtpControlSocket::OnReceive()
Trace:    CFtpControlSocket::OnReceive()
Trace:    CFtpControlSocket::OnReceive()
Risposta:    331 Password required for ftp_temp
Trace:    CFtpControlSocket::SendNextCommand()
Comando:    PASS **********
Trace:    CFtpControlSocket::OnReceive()
Trace:    CFtpControlSocket::OnReceive()
Trace:    CFtpControlSocket::OnReceive()
Risposta:    230 Welcome !
Trace:    CFtpControlSocket::SendNextCommand()
Comando:    PBSZ 0
Trace:    CFtpControlSocket::OnReceive()
Trace:    CFtpControlSocket::OnReceive()
Trace:    CFtpControlSocket::OnReceive()
Risposta:    200 PBSZ 0 successful
Trace:    CFtpControlSocket::SendNextCommand()
Comando:    PROT P
Trace:    CFtpControlSocket::OnReceive()
Trace:    CFtpControlSocket::OnReceive()
Trace:    CFtpControlSocket::OnReceive()
Risposta:    200 Protection set to Private
Stato:    Connesso (connected)
Trace:    CFtpControlSocket::ResetOperation(0)
Trace:    CControlSocket::ResetOperation(0)
Stato:    Lettura elenco cartelle... (Reading folders list)
Trace:    CFtpControlSocket::SendNextCommand()
Trace:    CFtpControlSocket::ChangeDirSend()
Comando:    PWD
Trace:    CFtpControlSocket::OnReceive()
Trace:    CFtpControlSocket::OnReceive()
Trace:    CFtpControlSocket::OnReceive()
Risposta:    257 "/" is the current directory
Trace:    CFtpControlSocket::ResetOperation(0)
Trace:    CControlSocket::ResetOperation(0)
Trace:    CFtpControlSocket::ParseSubcommandResult(0)
Trace:    CFtpControlSocket::ListSubcommandResult()
Trace:    CFtpControlSocket::SendNextCommand()
Trace:    CFtpControlSocket::TransferSend()
Comando:    TYPE I
Trace:    CFtpControlSocket::OnReceive()
Trace:    CFtpControlSocket::OnReceive()
Trace:    CFtpControlSocket::OnReceive()
Risposta:    200 Type set to I
Trace:    CFtpControlSocket::TransferParseResponse()
Trace:    CFtpControlSocket::SendNextCommand()
Trace:    CFtpControlSocket::TransferSend()
Comando:    PASV
Trace:    CFtpControlSocket::OnReceive()
Trace:    CFtpControlSocket::OnReceive()
Trace:    CFtpControlSocket::OnReceive()
Risposta:    227 Entering Passive Mode (77,43,13,50,167,18).
Trace:    CFtpControlSocket::TransferParseResponse()
Trace:    CFtpControlSocket::SendNextCommand()
Trace:    CFtpControlSocket::TransferSend()
Comando:    LIST
Trace:    CFtpControlSocket::OnReceive()
Errore:    Tempo scaduto per la connessione
Trace:    CFtpControlSocket::ResetOperation(2114)
Trace:    CControlSocket::ResetOperation(2114)
Trace:    CFtpControlSocket::ResetOperation(2114)
Trace:    CControlSocket::ResetOperation(2114)
Errore:    Non è stato possibile leggere il contenuto della cartella (can't read folder content)

whiplash ha scritto: