[Pkg-crosswire-devel] Bug#539794: Bug#539794: libsword8: please use passive FTP for module manager / bookshelf updater

[Jonathan Marsden]

Mark Hedges wrote:

> It might be a good idea to send the PASV command in the ftp
> connection to refresh the index and install text modules from
> crosswire.org.

As far as I know, this already happens (well, EPSV rather than PASV, but 
the same principle).

QUESTION:

Mark, are you using installmgr (included in the libsword8 package) or 
bibletime to do this updating?  Your report is unfortunately somewhat 
imprecise about exactly how you are trying to install SWORD modules.

TESTING AND TEST REULTS:

I just tested this here, and using

   installmgr -sc

in a newly-created user account, I get a generated config file 
~/.sword/InstallMgr/InstallMgr.conf file that begins with

   [General]
   PassiveFTP=true

and the debug info displayed by installmgr includes:

   CURLFTPTransport: => Send header: EPSV
   CURLFTPTransport: TEXT: Connect data stream passively
   CURLFTPTransport: <= Recv header: 229 Entering Extended Passive Mode 
(|||16020|)

That looks like passive mode being requested and enabled, to me.

The PC I used for these tests sits behind a hardware firewall device 
that does NAT, and does not have a large number of open ports waiting 
for incoming active FTP connections from anywhere.

As a further check, I also ran tcpdump while running the installmgr -sc 
command, to capture the network traffic concerned to a file, and the 
resulting .cap file shows only TCP connections starting from my local 
machine -- that is, passive FTP being used.  I then repeated this kind 
of testing for the two commands

   installmgr -r CrossWire           # Get list of modules
   installmgr -ri CrossWire NETfree  # Install a module

The results were similar.  Passive FTP was used each time, the EPSV 
command was sent and accepted in each test session.  I can attach the 
.cap files, if anyone thinks they would be useful.

CONCLUSION:

At least in my testing, libsword8 (installmgr) already uses passive FTP 
when doing repository master list syncs, obtaining lists of modules, and 
installing modules.

ANALYSIS:

Perhaps this feature request should be directed at BibleTime, if 
BibleTime is not using passive FTP, and cannot be configured to use it? 
  However, it looks to me that BibleTime also does in fact try to use 
Passive mode, the code at src/frontend/bookshelfmanager/btinstallmgr.cpp 
includes:

   BtInstallMgr::BtInstallMgr()
         : InstallMgr(instbackend::configPath().toLatin1(), this),
         m_firstCallOfPreStatus(true)
   { //use this class also as status reporter
         qDebug("BtInstallMgr::BtInstallMgr");
         this->setFTPPassive(true);
   }

Until it is clear which package this bug is really being filed against, 
I don't plan to retest using BibleTime to do these operations with 
tcpdump capturing the traffic... but once we know it is in fact 
BibleTime, I can do that and report my results.

NEXT STEPS:

(1) Please provide specific details on how to reproduce this issue.

(2) Please include exactly how you are syncing your master repository 
list, obtaining the list of modules, and installing one sample module.

(3) Please state specifically which of these three different operations 
you believe are not currently using passive mode FTP.

(4) If your module installation process uses BibleTime, please also 
check (and state) whether you have configured BibleTime to use Passive 
FTP, if you want (or need) it do to that and you believe it does not 
already do so by default.

Thanks,

Jonathan