70444 - [RFE] support for FTP servers that cant do passive transfers

Status: VERIFIED DUPLICATE of bug 73427

(Core Graveyard :: Networking: FTP, enhancement)

Description

[Michal 'hramrach' Suchanek]

I'm unable to login when FTP server requies password. Using Mozilla 0.8
on Windows98 and 0.7 on Linux. This may depend on the type of FTP server as all
FTP servers I use probably run on Novell.
To reproduce: 
1) type ftp://[e-mail] as the location an hit enter
2) password dialog appears -> enter your password
Result: mozilla locks and does'n repaint (on Windows). After some time
eventually a dialog appears that login failed or nothing happens and mozilla
happily continues with previous page. Sometimes I get impatient (when waiting
more than ten seconds for the browser to react in any way) and kill the browser.
Expected: other browser windows should be usable while connecting, the listing
of files on the server should appear after a few seconds.

Comment 1

[Boris Zbarsky [:bzbarsky]]

With linux build 2001-02-27-21 I see no freeze (likely due to the recent ftp
networking changes), but I also get no file listing.  The proper home directory
is shown in the url bar and the throbber is throbbing...  hitting Esc or Stop
leaves me with a blank ftp screen.

Comment 2

[Michal 'hramrach' Suchanek]

With 2001-02-28-21 I get the same except the throbber stops as soon as I enter
the password. I don't get an empty page after entering the password. The
previous page is still displayed(but it is blank when I open a separate window
for testing this).

Comment 3

[Herbert Ramoser]

With 0.8.1 (win NT 4.0 SP 5) I get the same problem. After entering the password
the old page is displayed and the throbber is throbbing ...

Comment 4

[Michal 'hramrach' Suchanek]

with 2001-04-24-21 I get "Command not understood" dialog when trying to log in
to a FTP server.

Comment 5

[Michal 'hramrach' Suchanek]

I forgot to mention I tested on Linux.

Comment 6

[Keyser Sose]

Marking NEW based on confirmation.

Comment 7

[Doug Turner (:dougt)]

This works for me.  I tried both a local ftp server which requires an logon, as 
well as an internal server. 

Please try again with today's build and reopen if is bug still present.

Comment 8

[Michal 'hramrach' Suchanek]

The same with 2001-05-01-21 on Linux: Command not understood.
It works with localhost but doesn't work with remote NetWare server..

Comment 9

[Doug Turner (:dougt)]

what ftp server are you trying to connect to?  barbora.ms.mff.cuni.cz does not
have anonymous users so I can really do anything with it.

Comment 10

[Michal 'hramrach' Suchanek]

a) It's about connecting to non-anonymous account. Anonymous access seems to
work well.
b) I can't give you access to that server (barbora). Is there anyone who could
test with another NetWare server (I beleive it's NW5).
c) There probably is some bug in Mozilla's networking (or it's incompatible with
a common bug found on some servers). I checked with another FTP client that the
server is working correctly.

Comment 11

[Michal 'hramrach' Suchanek]

20001-05-06-20 Win
Now I get message "Connection refused" even before I am asked for password.
milada.troja.mff.cuni.cz details (another NW server, I'm currently near enough
to get exact info):
NetWare Version:         Novell NetWare 4.11
OS Revision:             August 22, 1996
FTP Server for NW 3.1x, 4.xx (v1.10), (c) 1994 HellSoft.

Comment 12

[Michal 'hramrach' Suchanek]

With 2001-05-08-20 Win98 it's impossible to get listing of
ftp://wuarchive.wustl.edu while ftp://wuarchive.wustl.edu/ works fine (note the
slash - you have to specify a dir). 
There's a particularly broken server at watsun.cc.columbia.edu. I didn't get the
listing with most clients, but I found a particularly broken client (WinQVT/Net
v3.9)which displayed it. I don't think it's Mozilla's problem when it doesn't
display listings from this server, it just would be a nice feature.

Comment 13

[Michal 'hramrach' Suchanek]

On ftp://simtel.net/ you don't get any listing even with the slash, but
ftp://simtel.net/pub/ works. ftp://wuarchive.wustl.edu seems to work now.

Comment 14

[Doug Turner (:dougt)]

hranrach, please lets not confuse bugs.  I don't think the last problem
regarding loading ftp://simtelnet.net is the same as this. The simtelnet server
is just not sending ANY data on the data connection when we request a LIST of /.

Comment 15

[benc]

If someone does not get control of a server of this type, then we need to do
some kind of trace of this session or perform further isolation.

hramrach, if I give you an account on my ftp proxy server, can you try to
connect via it?

Comment 16

[Michal 'hramrach' Suchanek]

If it wasn't clear enough: OK, could try that but possibly need some additional
info about using ftp proxy account with Mozilla.

Comment 17

[Doug Turner (:dougt)]

reassigning to [e-mail].

Comment 18

[Bradley Baetz (:bbaetz)]

reporter, is this still the case on a current build?

Comment 19

[Michal 'hramrach' Suchanek]

With 0.9.4 the main problem persists: I cant login to our NW4 FTP server. 
It forbids anonymous access.
If I try as anonymous (ftp://barbora.ms.mff.cuni.cz) I get "Login fialed, check
password" in a dialog.
If I try as myself (ftp://[e-mail]) I am prompted for
password, and get "Command not understood" in a dialog.
I should get either Login Failed or directory listing.

Comment 20

[Bradley Baetz (:bbaetz)]

Can you try a recent nightly? (today's won't submit forms, so don't delete your
old browser...) The fix for bug 99233 may have helped - it fixed lots of other
wierd, impossible ftp failures :)

Comment 21

[benc]

we need to figure this out.
Can someone who has ftp access to a server of this type paste in the results of 
ftp via linecommand?

+makingtest - we need to put this on the list of servers to test.

Comment 22

[Michal 'hramrach' Suchanek]

Attachment: My comunication with the NW4 ftp server

Comment 23

[Michal 'hramrach' Suchanek]

I didn't try the new patch but I tried a ftp client capable of communication
debugging. From the output in attachment it is obvious that the server sends
bogus 502 response from which most clients can recover.

Comment 24

[Michal 'hramrach' Suchanek]

Looked at two similar bugs (99233 & 92582). Suggest integrated database of FTP
server bugs (similar to browser bug database in Apache sample config) :-)

Comment 25

[benc]

I'm working on aggregating the ftp bugs into something like the way PAC is
organized. Each type of connectivity problem is a bug, then individual sites
will be linked into them more cleanly, so the bugzilla searches are more readable.

Comment 26

[Michal 'hramrach' Suchanek]

Well, I tried tcpdump and it seems this (NW4) server doesnt support passive mode.
Am I right (output will be attached)?
Is there any possibility that Mozilla will support active(?non-passive or what)
mode in near future?

Comment 27

[Michal 'hramrach' Suchanek]

Attachment: end of tcpdump output

Comment 28

[Matthias Versen [:Matti]]

all "[RFE]Port (Active)" bugs are marked wontfix. (bug 73427)

See http://cr.yp.to/ftp/security.html for security problems with active transfer

Comment 29

[Michal 'hramrach' Suchanek]

Hmm, I know that FTP is unsafe and I considered this server unsafe once I
discovered the only way to get files ot and from there is over FTP. 
But it is the only way and the admin refuses to even upgrade the server to a
newer one (I even doubt that any compatible exists).
So the question is if I can use Mozilla or if I have to switch to another client
which supports this unasfe PORT command. It is over a relatively private network
anyway - the server is located one floor below the client;-)

The solution I would like would be to selectively enable PORT for selected
servers (like cookie servers), warning the user about the security issues.

The reason for this bug to live for so long before the real problem was
discovered is that mozilla doesnt generate very descripticve error messages and
until recently I was not able to see the real communication with the server. 
This issue I reported as bug 119870

Comment 30

[Henrik Gemal]

this should be duped against bug 73427

Comment 31

[Michal 'hramrach' Suchanek]

*** This bug has been marked as a duplicate of 73427 ***

Comment 32

[benc]

VERIFIED:
same problem.
cleared URL b/c it says "connection refused" when I try it. 

Comment 33

[Brant Gurganus]

[RFE] is deprecated in favor of severity: enhancement.  They have the same meaning.