FTP via Tor

[Gisle Vanem]

I'm experimenting with using curl via Tor and I'm
a bit confused. Obviously curl doesn't know it's WAN-side
address when going via Tor; attempting that, gives a:
501 PORT address does not match originator.

from the FTP-server. So I need to use "active mode" with
'--ftp-skip-pasv-ip'. Is that correct?

So trying with a command like:
curl ftp://<host> -v --ftp-skip-pasv-ip --socks5-hostname localhost:9050

results in:
...
* SOCKS5 communication to <host>:21
* SOCKS5 request granted.
* Connected to localhost (127.0.0.1) port 9050 (#0)
...
* Connect data stream passively
< 227 Entering Passive Mode (46,30,211,164,233,239).
* Skip 46.30.211.164 for data connection, re-use <host> instead
* Hostname localhost was found in DNS cache
* Trying ::1...
* Connecting to <host> (::1) port 9050
...
* connect to ::1 port 9050 failed: Connection refused
* Failed to connect to localhost port 9050: Connection refused

Why is curl attempting to connect to '::1' when it used IPv4 initially?
The "Skip 46.30.211.164" is IMHO a big hint it should be IPv4 only.
Hence my confusion.

So just adding a '-4', it works!
curl ftp://<host> -4v --ftp-skip-pasv-ip --disable-epsv --disable-eprt --socks5-hostname

(giving me a file-listing).

BTW, the page at:
https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/FTP

mentions 'torsocks' which seems unavailable for Windows.
Any other options?

[Daniel Stenberg]

Post by Gisle Vanem
I'm experimenting with using curl via Tor and I'm
a bit confused. Obviously curl doesn't know it's WAN-side
501 PORT address does not match originator.

I figured maybe the second connection through Tor would end up coming over
another exit and then the FTP server doesn't like that...

Post by Gisle Vanem
from the FTP-server. So I need to use "active mode" with
'--ftp-skip-pasv-ip'. Is that correct?

That will make curl ignore the IP the server tells it to use and instead
connect to the original IP again, yes. I suppose that makes Tor use the some
route again since it targets the same IP?

Post by Gisle Vanem
curl ftp://<host> -v --ftp-skip-pasv-ip --socks5-hostname localhost:9050
* Connected to localhost (127.0.0.1) port 9050 (#0)
Why is curl attempting to connect to '::1' when it used IPv4 initially?
The "Skip 46.30.211.164" is IMHO a big hint it should be IPv4 only.

It's a bug. It's a actually two bugs, because not only should the second
connection be limited to the same IP family of the original connection but the
second connection should also try the other addresses it got and not only try
a single one. The second one is mentioned in KNOWN_BUGS:
https://curl.haxx.se/docs/knownbugs.html#Passive_transfer_tries_only_one

[Gisle Vanem]

I figured maybe the second connection through Tor would end up coming over another exit and then the FTP server doesn't
like that...

Something like that. And I read somewhere, that Tor changes
exits every 10 minutes.

Post by Gisle Vanem
Why is curl attempting to connect to '::1' when it used IPv4 initially?
The "Skip 46.30.211.164" is IMHO a big hint it should be IPv4 only.

It's a bug. It's a actually two bugs, because not only should the second connection be limited to the same IP family of
the original connection but the second connection should also try the other addresses it got and not only try a single
one. The second one is mentioned in KNOWN_BUGS: https://curl.haxx.se/docs/knownbugs.html#Passive_transfer_tries_only_one

Thanks for that info.

[Daniel Stenberg]

Post by Gisle Vanem

Post by Daniel Stenberg
It's a bug. It's a actually two bugs, because not only should the second
connection be limited to the same IP family of the original connection but
the second connection should also try the other addresses it got and not
https://curl.haxx.se/docs/knownbugs.html#Passive_transfer_tries_only_one

Thanks for that info.

I now also added the first bug you mentioned to that document:

https://curl.haxx.se/docs/knownbugs.html#Stick_to_same_family_over_SOCKS