我尝试用apache-commons-net-3.7.2(隐式tls,客户端证书+登录/密码的双因素身份验证)连接ftp服务器。
我可以对自己进行身份验证,进入被动模式,但是客户端无法成功地连接到服务器以便通过数据套接字获取数据。
我可以在同一台计算机上用winscp(相同的设置)连接自己。我已激活winscp日志以查看协议详细信息,并使用相同的选项调整了源代码。我可以用一个 ProtocolCommandListener
. 我知道需要被动模式,因为winscp发出 PASV
命令。
我可以看到winscp连接到端口62564上的数据套接字(我已经用替换了ftp ip地址)
2021-01-06 10:25:35.575 227 Entering Passive Mode (192,168,4,122,244,100).
2021-01-06 10:25:35.575 Server sent passive reply with unroutable address 192.168.4.122, using host address instead.
2021-01-06 10:25:35.575 MLSD
2021-01-06 10:25:35.575 Connexion à 83.XXX.XXX.XXX:62564...
2021-01-06 10:25:35.604 150 Transferring directory
我还可以看到服务器发送的 PASV
命令不包括要连接的端口。
public class TestApi {
public static void _parseExtendedPassiveModeReply(String reply)
{
reply = reply.substring(reply.indexOf('(') + 1,
reply.indexOf(')')).trim();
char delim1, delim2, delim3, delim4;
delim1 = reply.charAt(0);
delim2 = reply.charAt(1);
delim3 = reply.charAt(2);
delim4 = reply.charAt(reply.length()-1);
if (!(delim1 == delim2) || !(delim2 == delim3)
|| !(delim3 == delim4)) {
System.out.println("Could not parse extended passive host information.\nServer Reply: " + reply);
}
int port;
try
{
port = Integer.parseInt(reply.substring(3, reply.length()-1));
}
catch (NumberFormatException e)
{
System.out.println("Could not parse extended passive host information.\nServer Reply: " + reply);
}
}
public static void main(String[] args) throws SocketException, IOException, GeneralSecurityException {
String hostname = args[0];
int port = Integer.parseInt(args[1]);
String login = args[2];
String pwd = args[3];
FTPSClient client = new FTPSClient("TLS",true);
File clientCertStore = new File("myJCEKS keystore");
KeyManager keyManager = KeyManagerUtils.createClientKeyManager("JCEKS",clientCertStore,"","myalias","");
client.setKeyManager(keyManager);
client.connect(hostname, port);
int reply = client.getReplyCode();
if (!FTPReply.isPositiveCompletion(reply)) {
client.disconnect();
System.err.println("FTP server refused connection.");
System.exit(1);
} else {
if (client.login(login, pwd)) {
client.addProtocolCommandListener(new PrintCommandListener(new PrintWriter(System.err), true));
client.sendCommand("OPTS","UTF8 ON");
client.sendCommand("PBSZ","0");
client.sendCommand("PROT","P");
int retour = client.pasv();
System.out.println(retour);
_parseExtendedPassiveModeReply(client.getReplyString());
System.out.println(client.printWorkingDirectory());
reply = client.getReplyCode();
System.out.println(reply);
System.out.println(client.listHelp());
//it freezes here, after sending MLDS command
//same thing using regular api for listing files (WinSCP use MLSD while regular api uses LIST)
client.sendCommand("MLSD");
//and so on
System.out.println("LOGOUT");
client.logout();
} else {
System.out.println("echec login");
}
}
}
}
我假设api不知道必须在哪个端口上发送数据请求,并使用一个不正常的默认值。我不知道winscp是如何成功计算62564端口号的。
OPTS UTF8 ON
200 Command OPTS succeed
PBSZ 0
200 PBSZ=0
PROT P
200 PRIVATE data channel protection level set
PASV
227 Entering Passive Mode (192,168,4,122,245,74).
227
PWD
Could not parse extended passive host information.
Server Reply: 192,168,4,122,245,74
Could not parse extended passive host information.
Server Reply: 192,168,4,122,245,74
257 "/" is current directory
/
257
HELP
214-The following commands are implemented
ABOR ACCT ALLO* APPE CDUP CWD DELE FEAT+ HELP
HOST+ LANG+ LIST MDTM+ MLST+ MKD MODE NLST NOOP
OPTS+ PASS PASV PORT PWD QUIT REIN REST RETR
RMD RNFR RNTO SITE SIZE SMNT STAT STOR STOU
STRU* SYST TYPE USER XCUP XCRC XCWD XMD5 XMKD
XPWD XRMD XSIGN XSHA1 XSHA256 XSHA512 XQUOTA
214 Help complete
214-The following commands are implemented
ABOR ACCT ALLO* APPE CDUP CWD DELE FEAT+ HELP
HOST+ LANG+ LIST MDTM+ MLST+ MKD MODE NLST NOOP
OPTS+ PASS PASV PORT PWD QUIT REIN REST RETR
RMD RNFR RNTO SITE SIZE SMNT STAT STOR STOU
STRU* SYST TYPE USER XCUP XCRC XCWD XMD5 XMKD
XPWD XRMD XSIGN XSHA1 XSHA256 XSHA512 XQUOTA
214 Help complete
MLSD
在api文档、源代码、ftp rfc中搜索了几个小时之后,我不知道该怎么做。
1条答案
按热度按时间qgzx9mmu1#
你的假设是错误的。您没有设置端口。服务器会告诉您要连接到哪个端口。
对于winscp:
2021-01-06 10:25:35.575 227进入被动模式(192168,4122244100)。
...
2021-01-06 10:25:35.575连接à 83..。:62564...
其中62564=(244<<8)+100
见rfc 959,第4.1.2节。传输参数命令,第28页。
对
PASV
响应失败,因为您使用了错误的代码。这个_parseExtendedPassiveModeReply
是为EPSV
. 为了PASV
,使用_parsePassiveModeReply
. 在这里,您还将看到上述公式的实现: