Subject: Re: Beating out Anti-'Idle Timeout' clients

From: Kevin Pearsall <[email-masked]>
Date: Wed, 04 Feb 1998 16:34:27 -0800

You might want to set your idle timeout really low!

Maybe 15..30 seconds?  ;)

-Kevin P.

At 01:35 PM 2/4/98 -0600, you wrote:
>Is there any way to prevent somebody from using a client like CuteFTP
>2.0 to tie up a connection. CuteFTP sends a NOOP at a given interval to
>keep the connection alive. I've seen people idle for days on end. Is
>there anyway to prevent them from doing so?
>
>Kevin Rice
>SPSS, Inc.
>
>

---------------------------------------------------------------------
  ______   ___  ______   ____)\_____________________________________
 / ___ /__/  /_/ ___ /__/  /__/__   __/  \__/ _ /_  ____/ _ /_      )
 \_____  /______/____  /___\___//__/ /__\__ \____/__   /_____/_/___/
       )/            )/                    )/      \__(
---------------------------------------------------------------------
          Kevin Pearsall - Technical Support Representative
Elektroson Inc - manufacturers of Gear, the Standard in CD-R Software
        2105 South Bascom Ave., Suite #160, Campbell CA 95008
           phone[1.408.371.4800] - support[1.408.371.4995]
            fax[1.408.371.4895] - web[www.elektroson.com]
     email[[email-masked]] - email[[email-masked]]
---------------------------------------------------------------------
We now have time-locked trial versions of our software!! You can find
 them at ftp://ftp.elektroson.com/pub/demos/. GEAR, GEAR Audio, GEAR
         Replicator, and WebGrabber are currently available.
--- <eof> -----------------------------------------------------------

---

From: Philip Gwyn <[email-masked]>
Date: Wed, 04 Feb 1998 21:15:19 -0500

>You might want to set your idle timeout really low!
A non-answer if there ever was one -:)

>>Is there any way to prevent somebody from using a client like 
>>CuteFTP 2.0 to tie up a connection. CuteFTP sends a NOOP at a 
>>given interval to keep the connection alive. I've seen people 
>>idle for days on end. Is there anyway to prevent them from doing 
>>so?

I find this anoying as well.  Some possiblities :
1- Add an absolut maximum connection time 
2- Ignore NOOP (src/ftpcmd.y)
3- Prevent NOOP from reseting the timeout counter (see patch)

About the patch: this is a quick hack on beta-15.  I've only done a quick
check to see if it works.  It might cause problems because the alarm(0)
call is done later.  I don't know the effect it will have on other function
(ie: SIGALRM might arrive while we're in strchr() or upper()).  Also, my C
is rusty.  strncasecmp will return 0 if the two match, right?

--- ftpcmd.y.orig       Wed Feb  4 20:18:41 1998
+++ ftpcmd.y    Wed Feb  4 20:27:41 1998
@@ -1157,7 +1157,6 @@
                 reply(221, "You could at least say goodbye.");
                 dologout(0);
             }
-            (void) alarm(0);
             if ((cp = strchr(cbuf, '\r'))) {
                 *cp++ = '\n';
                 *cp = '\0';
@@ -1169,6 +1168,8 @@
             c = cbuf[cpos];
             cbuf[cpos] = '\0';
             upper(cbuf);
+           if (strncasecmp(cbuf, "NOOP", 4)!=0) /* prevent NOOP from
reseting*/
+               (void) alarm(0);                 /* timeout */
             p = lookup(cmdtab, cbuf);
             cbuf[cpos] = c;
             if (strncasecmp(cbuf, "PASS", 4) != 0 &&