Subject: Re: IETF IPv6 platform configuration

From: Ken Raeburn <[email-masked]>
Date: Wed, 5 Jul 2006 09:55:14 -0400

On Jun 11, 2006, at 20:00, IETF Secretariat wrote:
> All,
> As you’re all aware, on 06/06/06 NSS successfully launched IPv6  
> services for
> IETF Web, Mail, and FTP.

Has anyone had FTP work for them when not in "passive" mode since  
this configuration change was made?

My site's got a clunky old ftp-based mirror script in use which at  
first glance doesn't seem to know anything about passive mode, and it  
hasn't fetched any new RFCs since a month ago.  Running ftp directly  
(over ipv4, from a couple of machines, one of which has no ipv6  
configuration and no recent software changes) doesn't work either,  
commands like LIST get back "failed to establish connection"  
immediately.

I'm probably going to throw away the mirror script anyway and switch  
to rsync, but I'm still curious to know whether this is some weird  
problem with our configuration (maybe a surprise related to the ipv6  
changes?), or an intentional (but unannounced?) or unintentional  
configuration change in ftp support at the server side....

Ken

---

From: Bill Fenner <[email-masked]>
Date: Thu, 6 Jul 2006 10:45:52 -0400

My recent experiences with ftp.ietf.org:

EPSV doesn't work - it gives a port which it then isn't listening on
(or, more likely since we get no response at all, a firewall blocks
connections to):

ftp> ls
---> EPSV
229 Entering Extended Passive Mode (|||42065|)
ftp: connect for data channel: Operation timed out

[simultaneously in another window]
compost% telnet ftp.ietf.org 42065
Trying 156.154.16.149...
telnet: connect to address 156.154.16.149: Operation timed out

EPRT for IPv4 doesn't work - it returns an error "Bad EPRT protocol."

---> EPRT |1|192.20.225.40|56318|
500 Bad EPRT protocol.

Apparently, the FTP server doesn't want to allow EPRT with IPv4.
("1" is IPv4).  It's not using the 522 "I don't support that protocol"
error code, but is also saying that it doesn't support that
protocol.

PORT doesn't work - it returns an immediate error "Failed to establish
connection".

---> PORT 192,20,225,40,219,254
200 PORT command successful. Consider using PASV.
---> LIST
425 Failed to establish connection.

tcpdump shows that it didn't send any packets trying to establish
a connection to 192.20.225.40 and the 425 error comes too
quickly to have tried.

It looks like 3 out of 4 data channel establishment mechanisms
are broken with this FTP server software and configuration for
IPv4.  I didn't test with IPv6.

  Bill

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 06 Jul 2006 14:42:39 -0400

> IPv4.  I didn't test with IPv6.

I did, inadvertently.  PASV worked, as did at least one of PORT and EPSV. 
I didn't try EPRT.  My guess is that there's some _thing_ in the IPv4 path 
that is breaking things because it doesn't like PORT and doesn't support 
the extended modes, either because it's too old or too broken.

This is one of the reasons for both the layered network model and the 
end-to-end principle -- avoiding the need for devices in the middle of the 
network to understand application protocols not only makes it easier to 
deploy new applications, but also reduces the chances that some device you 
have no control over will break the applications you already have.

-- Jeffrey T. Hutzelman (N3NHS) <[email-masked]>
   Sr. Research Systems Programmer
   School of Computer Science - Research Computing Facility
   Carnegie Mellon University - Pittsburgh, PA

---

From: Bill Fenner <[email-masked]>
Date: Thu, 6 Jul 2006 14:44:32 -0400

Just for completeness, I configured 6to4 to get IPv6 working.
Both EPSV and EPRT work with IPv6.

ftp> ls
---> EPSV
229 Entering Extended Passive Mode (|||10283|)
---> LIST
150 Here comes the directory listing.
drwxrwxr-x  265 6060     48           8192 May 05 15:12 concluded-wg-ietf-mail-archive
..

and

ftp> ls
---> EPRT |2|2002:c014:e128::1|56420|
200 EPRT command successful. Consider using EPSV.
---> LIST
150 Here comes the directory listing.
drwxrwxr-x  265 6060     48           8192 May 05 15:12 concluded-wg-ietf-mail-archive
..

  Bill