Couldn't establish an encrypted FTP data connection with FTP(S)ClientSession

[zussel]

I've tried to establish a FTP connection (implicit and explicit, with valid and invalid certificate) to a vsftpd server within a docker container (based on this container: https://hub.docker.com/r/loicmathieu/vsftpd) with POCO FTP(S)ClientSession.

See my code example for an implicit FTP connection expecting a self signed certificate below:

#include <Poco/Net/AcceptCertificateHandler.h>
#include <Poco/Net/FTPClientSession.h>
#include <Poco/Net/SSLManager.h>

#include <iostream>

try {

    Poco::Net::initializeSSL();
    Poco::Net::SSLManager::InvalidCertificateHandlerPtr ptrHandler( new Poco::Net::AcceptCertificateHandler( true) );

    const Poco::Net::Context::Ptr context = new Poco::Net::Context(
        Poco::Net::Context::CLIENT_USE, "", "", "",
        Poco::Net::Context::VERIFY_RELAXED, 9, false,
        "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH" );

    Poco::Net::SSLManager::instance().initializeClient( nullptr, ptrHandler, context );

    auto address = Poco::Net::SocketAddress( "<hostname>:990" );
    auto socket = Poco::Net::SecureStreamSocket( address, "<hostname>", context );
    auto ftps = std::make_unique<Poco::Net::FTPClientSession>( socket, true );
    ftps->login( "<user>", "<password>" );

    std::cout << ftps->welcomeMessage() << std::endl;

    std::cout << "current dir: " << ftps->getWorkingDirectory() << "\n";

   // Here the exception is thrown.
    auto& stream = ftps->beginList("/");
    std::vector<std::string> entries;
    std::string entry;
    while ( std::getline( stream, entry ) ) {
        entries.push_back( entry );
    }

    ftps->endList();
} catch ( const Poco::Exception& e )     {
    std::cout << e.message() << std::endl;
}

I always receive an error as soon as a data channel is about to becreated: NLST command failed: 522 Data connections must be encrypted. In the example the line where FTPCLientSession::beginList() is called.

I'm using:

• Windows 10 Professional
• MSVC v143 – VS 2022 C++ x64/x86-Buildtools
• POCO 1.12.4
• OpenSSL 3.0.7

Thanks for your support.

[micheleselea]

I always use FTPS (explicit) connection without problem in my code since years.
You have to use
Poco::Net::FTPSClientSession

[micheleselea]

For example

bool bReadWelcomeMessage = true;
bool bTryUseFTPS = true;
Poco::Net::Context::Ptr pContext = Poco::Net::SSLManager::instance().defaultClientContext();
Poco::Net::StreamSocket ftpSocket;
Poco::Net::SocketAddress sa(sHost, iPort);
ftpSocket.connect(sa, spanConnectionTimeout);
ftpSocket.setReuseAddress(true);
ftpSocket.setNoDelay(true);
Poco::Net::FTPSClientSession cFtp(ftpSocket, bReadWelcomeMessage, bTryUseFTPS, pContext);

[zussel]

Sorry for the late reply. Meanwhile I managed to upgrade to POCO version 1.13.2, because I thought with solved issue #4103 my problem would also be solved. But, alas, it isn't.

Trying to connect explicitly to FTP server as you stated it still gives me error Certificate validation error: Unacceptable certificate from <hostname>: application verification failure
Also when connecting implicitly I still receive error NLST command failed: 522 Data connections must be encrypted

In both cases the ftp client session object tells on isSecure() false.

Did you check what isSecure() tells you for your session? Is it possible that the ftp server has an invalid configuration for ftp (btw. connection with an ftp client app to the ftp server works as expected).

Any suggestions?