FTP & SSL session reuse

[janpecha]

Description

Hello,

FTP/SSL data connection fails after first data transfer, it results to error "425 Unable to build data connection: Operation not permitted".

The following code:

<?php

$f = ftp_ssl_connect('HOST');
ftp_login($f, 'USER', 'PASSWORD');
ftp_pasv($f, TRUE);
var_dump(ftp_nlist($f, '*'));
var_dump(ftp_nlist($f, '*'));

Resulted in this output:

array(2) {
  [0] =>
  string(4) "dirA"
  [1] =>
  string(9) "fileB.txt"
}
bool(false)

But I expected this output instead:

array(2) {
  [0] =>
  string(4) "dirA"
  [1] =>
  string(9) "fileB.txt"
}
array(2) {
  [0] =>
  string(4) "dirA"
  [1] =>
  string(9) "fileB.txt"
}

If I change code and try upload a file:

<?php
set_error_handler(function ($severity, $message) {
    echo $message;
});

$f = ftp_ssl_connect('HOST');
ftp_login($f, 'USER', 'PASSWORD');
ftp_pasv($f, TRUE);
ftp_fput($f, 'test-upload.txt', fopen(__DIR__ . '/my-file.txt', 'r'), FTP_BINARY);

It prints error 425 Unable to build data connection: Operation not permitted.

Links:

• dfadc5a
• http://proftpd.org/docs/contrib/mod_tls.html
• http://www.proftpd.org/docs/howto/TLS.html (see section "Frequently Asked Questions")

PHP Version

PHP 8.1.8 & all version from PHP 5.6

Operating System

Ubuntu 20.04

[simapple]

Could you list your ftp server's command logs ?

[janpecha]

Sorry, I have no access to ftp server's logs.

[nielsdos]

I received a private reproducer from another person yesterday with the exact same issue.
The issue is related to our session resumption code, I have a local patch that fixes is but I have to double check the correctness.