Firewall-1 (at least older versions, they may have fixed this in current
software) requires that the FTP "PORT" command arrive complete in a single
IP packet. The older FWTK ftp-gw sent the PORT command in one write, then
sent the
terminating CR/LF in a second write. While this does not violate the protocol,
it was not what the Firewall-1 FTP code expected. We used to joke about the
fact that the supposed "stateful" firewall couldn't keep state across two
packets :-) I changed the ftp-gw to send the PORT command in a single
write, thus working around the FW-1 bug. (To be fair, there are other firewall
products that have the same bug - even application proxy firewalls, which fact
I found rather surprising..)
-Rick
References:
|
|
