Hello,

if I understand the problem right it should easily be possible to find a
solution on the net or in the archives. The problem is caused by CP
insisting on "\r\n" at the ends of the ftp-header-lines.

You can stop this by transforming
#define FTP_ENFORCE_NL
into a comment
//#define FTP_ENFORCE_NL

It should be in base.def. After you have done this you need to install your
policy again.

--Joerg
http://www.firewalls-illustriert.de


-----Urspr�ngliche Nachricht-----
Von: Crist Clark [mailto:[EMAIL PROTECTED]
Gesendet: Dienstag, 10. Juni 2003 19:37
An: [EMAIL PROTECTED]
Betreff: [FW-1] More Weird FTP Clients

<snip>

I've got another FTP client doing weird things that FW-1 doesn't
seem to like, but that are strictly speaking, not illeagal.

After the SYN--SYN-ACK--ACK handshake and FTP banner go by, the client
sends a packet with the following content, "USER ", that is, it sends
the characters, U, S, E, R, and a space. At this point the firewall
sends a RST back to the client.

Now, there are a couple of problems with this. First, TCP is a stream-
oriented protocol. You can break up the data stream into as many or
as few TCP segments as you want and the end-program will see things
just fine. Therefore, sending one packet with say,

  "USER "

And the next one with,

  "anonymous\r\n"

Is in actuallity, totally legit. However, bad assumptions about how
much data individual TCP segments contain pop up all of the time in
all kinds of firewall proxy software. Nothing new here.

The other big problems here are that the firewall is not even rejecting
the connection properly. It does RST the client, but (1) it does not RST
the server, so the ftpd is left hanging, and (2) it does not log the
failure in any way.

All of that aside, none of the various hacks and knobs I know about or
was able to find googling deal with this kind of client behavior. Has
anyone run into this and found a way to make FW-1 play well with such
a client?
--
Crist J. Clark                               [EMAIL PROTECTED]
Globalstar Communications                                (408) 933-4387

</snip>

=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [EMAIL PROTECTED]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[EMAIL PROTECTED]
=================================================

Reply via email to