Subject: [fwtk-users] Bug in ftp-gw.c/sendsaved ?

From: Michel Bardiaux <[email-masked]>
Date: Fri, 16 Nov 2001 15:59:24 +0100

Symptoms: FTP client (any) comes from behind a Checkpoint Firewall-1,
goes through TIS FWTK 2.1 ftp-gw (configured incoming), to *any* ftp
server, whather loval or in the DMZ. Client sends "USER foo", receives
"331 Password required for ..." then "421 Service not available".

We looked in the FAQs, the FWTK archives, Google, the FWTK patches
pages, etc... and found about the port-20 problem and patch (which was
already applied), and about the problem of \r\n in a separate packet
from the PORT command, which supposed to be fixed in 2.1.

We then added lots of trace printouts in ftp-gw.c and it finally emerged
that there is one place where the \r\n problem is *not* completely fixed
because there is one case when ftp-gw tals to the client not using
sayn() but directly calling net_send(): in sendsaved(). After patching
sendsaved() the sessions through FW-1 worked.

With the benefit of hindsight, I could find in the archive on reference
to apparently the same problem and the same solution, but the specifics
were not given:

=========== From the archive:

At 11:10 AM 9/8/00 -0500, Larry D. Bonham wrote:
>Rick,
>
>Thanks for the response.  We had already had the default port setting at
>port 20.  We dealt with that problem quite some time ago.

Rats. Never anything easy.

>As it turns out I had to do a little slash and burn.  I disabled most of
>the entire sendsaved() function and sent it directly to flushsaved().  For
>whatever reason the Checkpoint proxy couldn't (wouldn't) handle the
>multiline response 331-.

That's probably a side effect of Checkpoint's "patch" to fix their FTP
vulnerability. That's the only time ftp-gw adds anything to the
interaction, so your change shouldn't have any effect (authenticated ftp
users will probably break, though, if you're using authentication.)
         -Rick

=========== End archive

Now, I unsubscribe from the list during my holidays, I could have missed
the patch when published. If it is a new one, I will post it here, and
someone could put in th the patches web page.

BTW: this patch is already known for Gauntlet.

Greetings,
-- 
Michel Bardiaux
Peaktime Belgium S.A.  Rue Margot, 37  B-1457 Nil St Vincent
Tel : +32 10 65.44.15  Fax : +32 10 65.44.10

---
You are currently subscribed to fwtk-users as: [email-masked]
To unsubscribe send a blank email to [email-masked]