Uploaded image for project: 'FtpServer'
  1. FtpServer
  2. FTPSERVER-323

Add a new configuration option for enabling/disabling IP check when accepting passive data connections

    XMLWordPrintableJSON

Details

    • New Feature
    • Status: Resolved
    • Major
    • Resolution: Fixed
    • 1.0.2
    • 1.1.0
    • Core
    • None

    Description

      In the current version it is possible for a hacker to connect to any passive port that is currently waiting for a connection and read/write data off that connection. We should implement a check in place to make sure the IP address of the remote host is same as the one we are expecting, if not, close the data connection right way. After closing the data connection we can do one of the following:

      1. Wait for incoming connection again so the original client can connect
      2. just quit and send a reply back to the client that the data connection is closed. We need to figure out what reply we want to send in this case.

      What do you guys think we should do?

      Attachments

        1. FTPSERVER-323.patch
          12 kB
          Sai Pullabhotla

        Activity

          People

            Unassigned Unassigned
            psai Sai Pullabhotla
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: