Subject: [fwtk-users] Re: Bug in ftp-gw.c/sendsaved ?

From: Ted Keller <[email-masked]>
Date: Sat, 1 Dec 2001 15:37:33 -0500 (EST)

So is there a bonified patch for this issue?  The updated looks pretty
easy - however, if you have a patch - would like to see it and post it to
fwtk.org.

ted keller

On Fri, 16 Nov 2001, Michel Bardiaux wrote:

> Symptoms: FTP client (any) comes from behind a Checkpoint Firewall-1,
> goes through TIS FWTK 2.1 ftp-gw (configured incoming), to *any* ftp
> server, whather loval or in the DMZ. Client sends "USER foo", receives
> "331 Password required for ..." then "421 Service not available".
>
> We looked in the FAQs, the FWTK archives, Google, the FWTK patches
> pages, etc... and found about the port-20 problem and patch (which was
> already applied), and about the problem of \r\n in a separate packet
> from the PORT command, which supposed to be fixed in 2.1.
>
> We then added lots of trace printouts in ftp-gw.c and it finally emerged
> that there is one place where the \r\n problem is *not* completely fixed
> because there is one case when ftp-gw tals to the client not using
> sayn() but directly calling net_send(): in sendsaved(). After patching
> sendsaved() the sessions through FW-1 worked.
>
> With the benefit of hindsight, I could find in the archive on reference
> to apparently the same problem and the same solution, but the specifics
> were not given:
>
> =========== From the archive:
>
> At 11:10 AM 9/8/00 -0500, Larry D. Bonham wrote:
> >Rick,
> >
> >Thanks for the response.  We had already had the default port setting at
> >port 20.  We dealt with that problem quite some time ago.
>
> Rats. Never anything easy.
>
>
> >As it turns out I had to do a little slash and burn.  I disabled most of
> >the entire sendsaved() function and sent it directly to flushsaved().  For
> >whatever reason the Checkpoint proxy couldn't (wouldn't) handle the
> >multiline response 331-.
>
> That's probably a side effect of Checkpoint's "patch" to fix their FTP
> vulnerability. That's the only time ftp-gw adds anything to the
> interaction, so your change shouldn't have any effect (authenticated ftp
> users will probably break, though, if you're using authentication.)
>          -Rick
>
> =========== End archive
>
> Now, I unsubscribe from the list during my holidays, I could have missed
> the patch when published. If it is a new one, I will post it here, and
> someone could put in th the patches web page.
>
> BTW: this patch is already known for Gauntlet.
>
> Greetings,
> --
> Michel Bardiaux
> Peaktime Belgium S.A.  Rue Margot, 37  B-1457 Nil St Vincent
> Tel : +32 10 65.44.15  Fax : +32 10 65.44.10
>
> ---
> You are currently subscribed to fwtk-users as: [email-masked]
> To unsubscribe send a blank email to [email-masked]
>

---
You are currently subscribed to fwtk-users as: [email-masked]
To unsubscribe send a blank email to [email-masked]

---

From: Rick Murphy <[email-masked]>
Date: Tue, 04 Dec 2001 06:30:02 -0500

>easy - however, if you have a patch - would like to see it and post it to

I haven't seen a patch and I'm reluctant to just write one - I don't have 
the ability to test any proposed fix.
         -Rick

---