Bug 1701063

Description of problem:
Since kernel 4.7.? nf_conntrack helpers are no longer loaded automatically[1] due to security concerns[2].
The impact of this is that protocols like FTP (defaulting to passive mode) no longer work out of the box when allowing the ftp service through firewalld. 

This issue is also documented in a closed Fedora bug[3].

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1. Install and enable vsftpd
2. firewall-cmd --zone=public --add-service=ftp
3. Attempt downloading a file

Actual results:
# lftp -c "debug; open -u anonymous,student serverb.lab.example.com; cd pub; get testfile"
---- Resolving host address...
---- 1 address found: 172.25.250.11
---- Connecting to serverb.lab.example.com (172.25.250.11) port 21
<--- 220 (vsFTPd 3.0.3)
---> FEAT
<--- 211-Features:
<---  EPRT
<---  EPSV
<---  MDTM
<---  PASV
<---  REST STREAM
<---  SIZE
<---  TVFS
<---  UTF8
<--- 211 End
---> AUTH TLS
<--- 530 Please login with USER and PASS.
---> OPTS UTF8 ON
<--- 200 Always in UTF8 mode.
---> USER anonymous
<--- 331 Please specify the password.
---> PASS student
<--- 230 Login successful.
---> PWD
<--- 257 "/" is the current directory
---- CWD path to be sent is `/pub'
---> CWD /pub
<--- 250 Directory successfully changed.
---> TYPE I
<--- 200 Switching to Binary mode.
---> SIZE testfile
<--- 213 0
---> MDTM testfile
<--- 213 20190417002835
---> PORT 172,25,250,12,197,87
<--- 200 PORT command successful. Consider using PASV.
---> RETR testfile
<--- 425 Failed to establish connection.
---- Closing data socket
---> SIZE testfile                       
<--- 213 0
---> PORT 172,25,250,12,229,39
<--- 200 PORT command successful. Consider using PASV.
---> RETR testfile
<--- 425 Failed to establish connection.
---- Closing data socket
^Cestfile' at 0 [Delaying before retry]


Expected results:
# lftp -c "debug; open -u anonymous,student serverb.lab.example.com; cd pub; get testfile"
---- Resolving host address...
---- 1 address found: 172.25.250.11
---- Connecting to serverb.lab.example.com (172.25.250.11) port 21
<--- 220 (vsFTPd 3.0.3)
---> FEAT
<--- 211-Features:
<---  EPRT
<---  EPSV
<---  MDTM
<---  PASV
<---  REST STREAM
<---  SIZE
<---  TVFS
<---  UTF8
<--- 211 End
---> AUTH TLS
<--- 530 Please login with USER and PASS.
---> OPTS UTF8 ON
<--- 200 Always in UTF8 mode.
---> USER anonymous
<--- 331 Please specify the password.
---> PASS student
<--- 230 Login successful.
---> PWD
<--- 257 "/" is the current directory
---- CWD path to be sent is `/pub'
---> CWD /pub
<--- 250 Directory successfully changed.
---> TYPE I
<--- 200 Switching to Binary mode.
---> SIZE testfile
<--- 213 0
---> MDTM testfile
<--- 213 20190417002835
---> PASV
<--- 227 Entering Passive Mode (172,25,250,11,197,59).
---- Connecting data socket to (172.25.250.11) port 50491
---- Data connection established
---> RETR testfile
<--- 150 Opening BINARY mode data connection for testfile (0 bytes).
---- saw file size in response
---- Got EOF on data connection
---- Closing data socket
<--- 226 Transfer complete.
---> QUIT
<--- 221 Goodbye.
---- Closing control socket


Additional info:

I believe the simplest fix is a documentation update suggesting that users specify the port range for passive connections in /etc/vsftpd/vsftpd.conf, and allow that range through the firewall also:

pasv_enable=Yes
pasv_min_port=21000
pasv_max_port=21020

firewall-cmd --zone=public --add-port=21000-21020/tcp
firewall-cmd --permanent --zone=public --add-port=21000-21020/tcp

However there will be other protocols where this has a similar impact.

An alternative is to document the secure use of helpers as per [2], possibly with firewall-cmd examples for impacted protocols.


[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3bb398d925ec73e42b778cf823c8f4aecae359ea
[2] https://home.regit.org/netfilter-en/secure-use-of-helpers/
[3] https://bugzilla.redhat.com/show_bug.cgi?id=1380168