buglwIP - A Lightweight TCP/IP stack - Bugs: bug #66210, TFTP server sends data from...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #66210: TFTP server sends data from control port

Submitter:  Michiel van Leeuwen <michielvl>
Submitted:  Fri 13 Sep 2024 06:27:05 AM UTC
   
 
Category:  apps Severity:  3 - Normal
Item Group:  Faulty Behaviour Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Planned Release:  None
lwIP version:  2.2.0

Fri 13 Sep 2024 08:19:25 AM UTC, comment #2: 

Agreed. But not all clients agree. In my case, I want to use it from an Android app using commons-net. And they do an explicit check:

https://github.com/apache/commons-net/blob/9e11c5d24e52b14e202eccc69e9657389b6748ea/src/main/java/org/apache/commons/net/tftp/TFTPClient.java#L155

Michiel van Leeuwen <michielvl>
Fri 13 Sep 2024 07:22:44 AM UTC, comment #1: 

The host is free to choose the original TID with port 69 as its response. The current FTP implementation is not violating RFC 783
The RFC mentions "The TID's  chosen  for  a  connection SHOULD be randomly chosen", not MUST.
I do agree that choosing a port different than 69 is a better implementation so I would suggest to change "Faulty Behaviour" to "Improvement"

Eric Koldeweij <eric_koldeweij>
Fri 13 Sep 2024 06:27:05 AM UTC, original submission:  

The TFTP server sends data back from port 69, the control port. But it should pick a random port to send replies from. Quote from https://datatracker.ietf.org/doc/html/rfc783.html:

A requesting host chooses its source
TID as described above, and sends its initial request to the  known  TID
69  decimal  (105  octal)  on  the  serving  host.   The response to the
request, under normal operation, uses a TID chosen by the server as  its
source  TID and the TID chosen for the previous message by the requestor
as its destination TID.  The two chosen TID's  are  then  used  for  the
remainder  of  the  transfer.


Michiel van Leeuwen <michielvl>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by eric_koldeweij (Posted a comment)
  • -email is unavailable- added by michielvl (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    No changes have been made to this item

    Back to the top

    Powered by Savane 3.15-e6e5.
    Corresponding source code