[NET-719] FTPS timing issues behind WAF (F5) firewall

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 3.9.0
• Component/s: FTP
• Flags: Patch
• Assignee: Unassigned
• Reporter: Stefan Kuhr
• Created: 14/Mar/23 11:28
• Updated: 23/Jun/23 04:15

Description

A working data exchange setup stopped working, after the server (vsftpd / RedHat) was moved behind a WAF (F5) web application firewall. The client uses PASV mode and the operation resulted in a socket timeout on the client side, as soon as the data channel came into play (LIST/RETR/STOR).

A FileZilla client does not exhibit this problem. By looking at the protocol exchanges and laying them down in timing diagrams the problem seems to be, that the WAF expects the client to fully establish the data-channel, after the data-command is send over the control-channel. The current FTPS client on the other hand expects the server reply directly after the command is sent.

A pull request will be provided.