Subject: [BEHAVE] NAT64 FTP ALG draft

From: Iljitsch van Beijnum <[email-masked]>
Date: Mon, 6 Apr 2009 18:34:30 +0200

Hi all,

I wrote a short draft (just over 3 pages excluding boilerplate and  
references) about how an FTP ALG for a NAT64 translator should behave.

I tested 25 FTP servers, with the following results:

- 12 would do EPSV over IPv4
- 8 responded with a 50x error to the EPSV command
- 5 had significant delays and some even a control channel reset after  
EPSV
- only 2 indicate they support EPSV in answer to a FEAT command
- none of the servers had problems with PASV

Conclusion: assuming the clients issue EPSV, we can simply translate  
this to PASV, which doesn't require setting up any mappings in the  
NAT64. However, I don't know how IPv6 FTP clients behave. If anyone  
has any info on IPv6 FTP clients that don't support EPSV or try EPRT  
first, please let me know. Even better: if someone can log EPSV vs  
EPRT on a busy IPv6 FTP server, that would really help a lot.

So EPSV->PASV is a MUST if we want users to be able to talk to more  
than 48% of FTP servers. Additionally, it's not too troublesome to  
support EPRT->PORT translation. This requires setting up a mapping in  
the NAT64 based on what happens in the control channel. This is  
specified as a MAY in the draft, leaving the door open for limited  
compatibility with server-to-server FTP.

If we want to be really fancy we could support EPRT->PASV mapping, but  
this requires a good deal more trickery, such as the NAT64 setting up  
sessions to both the server and the client and then connecting those  
sessions. This means that the NAT64 must be able to translate sequence  
numbers because the client and server will each choose a sequence  
number that doesn't match the one previously chosen by the NAT64. I  
didn't specify this part.

Please let me know what you think.

Iljitsch

Begin forwarded message:

> From: [email-masked]
> Date: 6 april 2009 18:00:01 GMT+02:00
> To: [email-masked]
> Subject: I-D Action:draft-van-beijnum-behave-ftp64-00.txt
> Reply-To: [email-masked]
>
> A New Internet-Draft is available from the on-line Internet-Drafts  
> directories.
>
> 	Title           : FTP Application Layer Gateway for NAT64
> 	Author(s)       : I. van Beijnum
> 	Filename        : draft-van-beijnum-behave-ftp64-00.txt
> 	Pages           : 6
> 	Date            : 2009-04-06
>
> The only FTP mode that works without changes through an IPv6-to-IPv4
> translator is extended passive, introduced in 1998.  However, many
> existing FTP servers don't support this mode, making it impossible to
> support the File Transfer Protocol through an IPv6-to-IPv4 translator
> without an Application Layer Gateway.  This document describes the
> behavior of such an ALG.
>
> A URL for this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-van-beijnum-behave-ftp64-00.txt

---

From: Kentaro Ebisawa <[email-masked]>
Date: Wed, 08 Apr 2009 18:08:08 +0900

Hi Iljitsch,

Looks like I found a typo.

> 1.  Introduction
> 
>    [RFC0959] specifies two modes of operation for FTP: active mode, in
>    which the server connects back to the client on port 20 or a client-
>    provided port number, and active mode, where the server opens a port

should be : provided port number, and passive mode, where the server opens a port

Other part looks good to me.
(especially the way you suggest handling PASV/EPSV)

Thanks,
-- 
Kentaro Ebisawa <[email-masked]>

On Mon, 6 Apr 2009 18:34:30 +0200
Iljitsch van Beijnum <[email-masked]> wrote:

> _______________________________________________
> Behave mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/behave