FT_FTPΒΆ

FTP (File Transfer Protocol) protocol filter.

Category:

Protocol filter

Supported flags

FF_READ_ONLY_IN

FF_READ_ONLY_OUT

FF_SSL_TLS

FF_SSL_SELF_SIGNED_CERTIFICATE

Object types

OT_FTP_COMMAND - FTP command from client to server

OT_FTP_RESPONSE - server response to FTP command

OT_FTP_DATA_OUTGOING - read-only outgoing data (full stream)

OT_FTP_DATA_INCOMING - read-only incoming data (full stream)

OT_FTP_DATA_PART_OUTGOING - outgoing data packet

OT_FTP_DATA_PART_INCOMING - incoming data packet

Indicates object parts:

no

  • Allows filtering FTP commands, responses and transmitted data.

  • Filters active and passive mode data channels.

  • Decodes SSL protected command and data channels.

  • Supports packet level filtering of data channel.

  • Supports IPv6 extensions.

The filter starts indicating FTP commands and responses after the initial client-server handshake classified according to the FTP specification. The objects of types OT_FTP_COMMAND and OT_FTP_RESPONSE contain one stream with a raw FTP command or response.

For transmitting large data buffers, FTP uses secondary data connections. In active mode, it is an incoming connection from the server to the client, established after a PORT or EPRT command with the specified local address as a parameter. In passive mode, the FTP client sends a PASV or EPSV command to the server and establishes an outgoing connection to the address specified in the server response. After transmitting the full data object, the data connection closes, and the server sends a response to the client explaining the results.

Warning

The filtering of all inbound connections must be enabled for filtering FTP data connections in active mode!

ProtocolFilters automatically associates data connections with the FTP control connection and adds an FT_FTP_DATA filter for a data connection:

  • The FTP client sends a PORT, EPRT, PASV or EPSV command to the server to negotiate the data connection direction and addresses.

  • ProtocolFilters indicates the tcpConnected event for an incoming or outgoing data connection. It is possible to add the FT_PROXY and FT_SSL preprocessors in the event handler.

  • ProtocolFilters searches for a control FTP connection by real local or remote address (the real address can be different when the FTP client uses a SOCKS or HTTPS proxy).

  • If an appropriate FTP control connection is found, ProtocolFilters deletes all protocol filters from the chain (preprocessors are not deleted) and adds an FT_FTP_DATA filter instead. The FT_SSL filter is also added if necessary when the FF_SSL_TLS flag is specified for the control connection. FT_FTP_DATA is added with the same FF_* flags as for the control connection. I.e. if a control connection is filtered in read-only mode, the corresponding data connection is filtered in read-only mode too.

The FT_FTP_DATA filter indicates the transmitted data using OT_FTP_DATA_* objects. Each OT_FTP_DATA_* object contains two streams:

  • Content stream (index 0) contains a data buffer.

  • Control channel metadata stream (index 1) contains a string formatted as a list of <name>: <value> strings, delimited with \r\n sequences.

The metadata stream is informational, i.e. ProtocolFilters ignores it when the client application posts an OT_FTP_DATA_* object to the destination. It contains the FTP command with parameters that describes the content stream, the control connection identifier and transmission parameters.

The field names of metadata header:

SESSIONID

ENDPOINT_ID of the FTP control connection. This field is always added.

COMMAND

FTP command sent via the control channel immediately after opening the data connection, e.g. STOR or RETR with a file name. This field is always added.

REST

Optional field, contains a parameter of the REST command specified by the FTP client (see RFC 959 for details).

TYPE

Optional field, contains a parameter of the TYPE command specified by the FTP client (see RFC 959 for details).

The optional fields are added when the FTP client sends the appropriate commands via the control connection.

The current version blocks the STRU command and MODE (B|Z), i.e. it allows only the default stream transfer mode for FTP data. The FTP client receives an error response when it tries to select an unsupported mode.

By default, the FT_FTP_DATA filter indicates packets transmitted via the data connection as OT_FTP_DATA_PART_* objects containing a single packet in the content stream. The filtering application can change the packet contents and post it back to the destination.

When the FF_READ_ONLY_(IN|OUT) flag is specified for the control connection, the FT_FTP_DATA filter buffers the packets and indicates the full transmitted content as an OT_FTP_DATA_(INCOMING|OUTGOING) object.

The data connection closes after transmitting the full content. The FTP client can also abort the data transfer and close the data connection before transmission completes. It is possible to monitor the control connection for the ABORT command and bad response codes to make sure that the content was transmitted in full.

References: