Forum Discussion

Josh_Hildebran1's avatar
Josh_Hildebran1
Icon for Nimbostratus rankNimbostratus
Aug 15, 2008

FTP welcome message for redirecting

I'd like to create an iRule that I can put on a VIP that doesn't have any pool associated with it. The VIP will be listening on port 21 for FTP.

 

 

I'd like an iRule that accepts the FTP client's commands and passes back some text for the welcome or connection message that says, in short, "This FTP site is down, call some number to find out why". Then it can close the FTP connection nicely, if possible.

 

 

Is this easy, or difficult? I don't want to rewrite an FTP server, if you know what I mean.
application delivery
dev
devops
iRules
  • James_Quinby_46's avatar
    James_Quinby_46
    Historic F5 Account
    Aug 15, 2008
    'Easy' or 'difficult' are going to be relative terms, of course - have a look at this irule that implements "Hunt the Wumpus" via FTP. If all you want to do is send across custom banner text, you can probably pare this down quite a bit and reuse chunks of it.

     

     

    http://devcentral.f5.com/wiki/default.aspx/iRules/HuntTheWumpus.html

     

     

  • James_Quinby_46's avatar
    James_Quinby_46
    Historic F5 Account
    Aug 18, 2008
    Just for fun, I whipped this together. It's pretty much the bare essentials: 

       
   when CLIENT_ACCEPTED {   
      TCP::respond "220 XYZ Inc. FTP Server\r\n"   
      TCP::respond "211 This FTP server is currently out of service. Please try again later.\r\n"   
      TCP::close   
   }

    Applied to a VS, it yields the following responses. 

        
    Microsoft Windows XP [Version 5.1.2600]    
    (C) Copyright 1985-2001 Microsoft Corp.    
        
    C:\Documents and Settings\>ftp 10.2.2.54    
    Connected to 10.2.2.54.    
    220 XYZ Inc. FTP Server    
    This FTP server is currently out of service. Please try again later.    
    Connection closed by remote host.    
        
    C:\Documents and Settings\>

    It's close, anyway. Other FTP clients seem to want to authenticate before failing. I expect this is because the LTM is attempting to proxy the FTP traffic to an FTP server in the background. As there isn't one, it sort of just croaks. This is with the Linux FTP client on the LTM itself: 

       
    ftp 10.2.2.54    
    Connected to 10.2.2.54 (10.2.2.54).    
    220 XYZ Inc. FTP Server    
    Name (10.2.2.54:root): asdf    
    This FTP server is currently out of service. Please try again later.    
    Login failed.    
    No control connection for command: Broken pipe    
    ftp>

    There are probably more elegant ways to do this. I took a look at the FTP RFC to see if I should be prepending status codes to the banner text, for example. The differing client behavior is a little puzzling as well.