Subject: Feedback requested:FTP ALG for IPv6-to-IPv4 translation

From: Iljitsch van Beijnum <[email-masked]>
Date: Mon, 27 Apr 2009 11:10:48 +0200

Hi all,

In the BEHAVE wg we're working on IPv6-to-IPv4 translation. One  
prominent protocol that has trouble with this is FTP, so we're  
thinking of making an FTP ALG part of this. I wrote a draft on how to  
do this, and I would very much like some feedback. The draft is only 6  
pages.

Thanks,

Iljitsch van Beijnum

Begin forwarded message:

> Filename:	 draft-van-beijnum-behave-ftp64
> Revision:	 01
> Title:		 An FTP Application Layer Gateway for IPv6-to-IPv4 translation
> Creation_date:	 2009-04-27
> WG ID:		 Independent Submission
> Number_of_pages: 6

> Abstract:
> The only FTP mode that works without changes through an IPv6-to-IPv4
> translator is extended passive, introduced in 1998.  However, many
> existing FTP servers don't support this mode, making it impossible to
> support the File Transfer Protocol through an IPv6-to-IPv4 translator
> without an Application Layer Gateway.  This document describes the
> behavior of such an ALG.

http://www.ietf.org/internet-drafts/draft-van-beijnum-behave-ftp64-01.txt

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Mon, 27 Apr 2009 11:10:48 +0200

Hi all,

Thanks,

Iljitsch van Beijnum

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Mon, 27 Apr 2009 11:27:39 +0200

On 27 apr 2009, at 11:10, Iljitsch van Beijnum wrote:

> thinking of making an FTP ALG part of this. I wrote a draft on how  
> to do this, and I would very much like some feedback. The draft is  
> only 6 pages.

One thing that would be good to know is whether ALL IPv6 FTP clients  
do EPSV or if there are also ones that do EPRT or, worse, active FTP  
without issuing EPRT.

---

From: Lars Eggert <[email-masked]>
Date: Mon, 27 Apr 2009 11:12:59 -0400

> do EPSV or if there are also ones that do EPRT or, worse, active FTP

After 10+ years of IPv4 NAT, are there still FTP clients around that  
need ALGs? And if there are, what are the chances they can talk IPv6?

Lars

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Mon, 27 Apr 2009 17:43:14 +0200

> need ALGs? And if there are, what are the chances they can talk IPv6?

Well, unless they hid it really well, the command line FTP client on  
Windows (tested with win7 beta) only supports active FTP. It does  
support IPv6, though.

Passive mode FTP will work through a normal NAT but not through an  
IPv6/IPv4 translator as it still echoes back the server's IP address.  
So without an ALG, you need EPSV, as this is the only type of FTP that  
doesn't explicitly spell out an IP address.

I did some testing, and out of 25 IPv4 FTP servers I tried, 12 worked  
with EPSV and 13 didn't. So if we want to be compatible with more than  
48% of the FTP servers we need to be able to translate EPSV into PASV  
and maybe also EPRT into PORT. And then we still don't have  
compatibility with really old school FTP clients that don't issue EPSV  
or EPRT but simply expect the default case of active FTP towards the  
default port 20. I would certainly hope those are no longer around,  
and certainly not on IPv6 systems.

I'm less concerned about client compatibility as users can relatively  
easily install a different client. But if a server doesn't support  
EPSV IPv6-only users who want to talk to an IPv4-only FTP server  
through a translator are dead in the water without EPSV to PASV  
translation in an ALG.

---

From: Ted Hardie <[email-masked]>
Date: Mon, 27 Apr 2009 09:46:01 -0700

>through a translator are dead in the water without EPSV to PASV 

Your end statement ("dead in the water") sounds true, but the one
preceding it is somewhat questionable.  The ability to install and use
a new client is a real concern.  Perhaps s/relatively easily/at least possibly
in some environments/ ?

				regards,
					Ted

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Mon, 27 Apr 2009 21:09:40 +0200

> a new client is a real concern.  Perhaps s/relatively easily/at  

Well, that text isn't in the draft so I don't think we have to  
carefully craft it... The point is that if it's your box or your  
company's box that insists on a mode of FTP that doesn't work through  
the NAT, there are ways to work around that, either by getting a new  
client, or through some sort of gateway. Obviously in some  
environments users may not be able to do that themselves but  
hopefully, if an organization uses IPv6 behind a NAT64 and they need  
FTP they're smart enough to make that work and not insist on broken  
clients only.

On the other hand, getting ftp.dell.com, ftp.sun.com or  
ftp.lexmark.com to upgrade their servers (or, more likely, their  
firewalls) is probably not realistic.

In the current draft, EPSV to PASV translation is SHOULD (I guess it  
could be MUST but nobody is forcing anyone to implement an FTP ALG in  
the first place), so all clients that use EPSV will work, as all FTP  
servers that I tested work with PASV. EPRT to PORT is MAY. So that  
could leave people depending on the Microsoft command line FTP client  
or similar in the cold.

Anyone in favor of making EPRT to PORT SHOULD or MUST as well?