Hello, if I understand the problem right it should easily be possible to find a solution on the net or in the archives. The problem is caused by CP insisting on "\r\n" at the ends of the ftp-header-lines.
You can stop this by transforming #define FTP_ENFORCE_NL into a comment //#define FTP_ENFORCE_NL It should be in base.def. After you have done this you need to install your policy again. --Joerg http://www.firewalls-illustriert.de -----Urspr�ngliche Nachricht----- Von: Crist Clark [mailto:[EMAIL PROTECTED] Gesendet: Dienstag, 10. Juni 2003 19:37 An: [EMAIL PROTECTED] Betreff: [FW-1] More Weird FTP Clients <snip> I've got another FTP client doing weird things that FW-1 doesn't seem to like, but that are strictly speaking, not illeagal. After the SYN--SYN-ACK--ACK handshake and FTP banner go by, the client sends a packet with the following content, "USER ", that is, it sends the characters, U, S, E, R, and a space. At this point the firewall sends a RST back to the client. Now, there are a couple of problems with this. First, TCP is a stream- oriented protocol. You can break up the data stream into as many or as few TCP segments as you want and the end-program will see things just fine. Therefore, sending one packet with say, "USER " And the next one with, "anonymous\r\n" Is in actuallity, totally legit. However, bad assumptions about how much data individual TCP segments contain pop up all of the time in all kinds of firewall proxy software. Nothing new here. The other big problems here are that the firewall is not even rejecting the connection properly. It does RST the client, but (1) it does not RST the server, so the ftpd is left hanging, and (2) it does not log the failure in any way. All of that aside, none of the various hacks and knobs I know about or was able to find googling deal with this kind of client behavior. Has anyone run into this and found a way to make FW-1 play well with such a client? -- Crist J. Clark [EMAIL PROTECTED] Globalstar Communications (408) 933-4387 </snip> ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
