Listing stopped working

[skyflyer]

First of all, thank you for a great library.

We're using FluentFTP to connect to an ftp server with TLS and a week or so ago that functionality broke with an error: Failed to get the EPSV port from: Entering Extended Passive Mode (|||46474)

While investigating the cause, I "fixed" this cause by explicitly setting the connection to use encrypted mode (client.Config.EncryptionMode = FtpEncryptionMode.Implicit;). The end result was that no files were listed even though they are present on the server. After turning on debug logging (attached below) I figured that might be due to issues with SSL resumes (issues #1738, #311).

I tried using GnuTlsStream, but that fails with System.DllNotFoundException: Unable to load shared library 'libdl.so.2' or one of its dependencies. (developing on a Mac).

End result: the program does not work on macOS (returns an empty listing on a macOS) but works when run with a docker image mcr.microsoft.com/dotnet/sdk:8.0 on the same machine.

Program code:

        using var client = new FtpClient(host, username, password);
        client.Config.LogToConsole = true;
        client.Config.EncryptionMode = FtpEncryptionMode.Implicit;
        client.Connect();
        Console.WriteLine("Connected. Is secure: {0}", client.IsConnected && client.IsEncrypted);
        var results = client.GetListing();
        Console.WriteLine("Retrieved {0} items", results.Length);
        foreach (var item in results) {
            Console.WriteLine("Found item: {0}", item.FullName);
        }

The log files (below) show that when the same program is ran in a docker container, the listing works; if the program is ran on macOS, the listing does not work and goes into retries. They're both using the same .NET SslStream as far as I can tell.

Any ideas?

Outputs for macOS and linux

macOS output

❯ dotnet run

# Connect(False)
Status:   FluentFTP 53.0.2.0(.NET 8.0) FtpClient
Status:   Connecting(sync) FtpClient.FtpSocketStream(control) IP #1 = ***:990
Status:   FTPS authentication successful, lib = .NET SslStream, cipher suite = Tls12 (Aes256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, DiffieHellman, 0) [590ms]
Status:   Waiting for a response
Response: 220 *** FTP site: Authorised logins only: IP address is recordered [739649.48d]
Command:  USER ***
Status:   Waiting for response to: USER ***
Response: 331 Password required for username [275ms]
Command:  PASS ***
Status:   Waiting for response to: PASS ***
Response: 230 Logged on [275ms]
Command:  PBSZ 0
Status:   Waiting for response to: PBSZ 0
Response: 200 PBSZ=0 [275ms]
Command:  PROT P
Status:   Waiting for response to: PROT P
Response: 200 Protection level set to P [275ms]
Command:  FEAT
Status:   Waiting for response to: FEAT
Response: 211-Features:
Response: MDTM
Response: REST STREAM
Response: SIZE
Response: MLST type*;size*;modify*;
Response: MLSD
Response: AUTH SSL
Response: AUTH TLS
Response: PROT
Response: PBSZ
Response: UTF8
Response: CLNT
Response: MFMT
Response: EPSV
Response: EPRT
Response: 211 End [276ms]
Status:   Text encoding: System.Text.UTF8Encoding+UTF8EncodingSealed
Command:  OPTS UTF8 ON
Status:   Waiting for response to: OPTS UTF8 ON
Response: 202 UTF8 mode is always enabled. No need to send this command. [276ms]
Command:  SYST
Status:   Waiting for response to: SYST
Response: 215 UNIX emulated by FileZilla [275ms]
Status:   Active ServerHandler is: None
Status:   Listing parser set to: Machine
Command:  PWD
Status:   Waiting for response to: PWD
Response: 257 "/" is current directory. [276ms]
Connected. Is secure: True

# GetListing(null, Auto)
Command:  TYPE I
Status:   Waiting for response to: TYPE I
Response: 200 Type set to I [275ms]

# OpenDataStream("MLSD /", 0)

# OpenPassiveDataStream(AutoPassive, "MLSD /", 0)
Command:  EPSV
Status:   Waiting for response to: EPSV
Response: 229 Entering Extended Passive Mode (|||46937|) [275ms]
Status:   Connecting(sync) FtpClient.FtpSocketStream(data) IP #1 = ***:46937
Command:  MLSD /
Status:   Waiting for response to: MLSD /
Response: 150 Opening data channel for directory listing of "/" [276ms]
Warning:  Retry GetListing once more due to unexpected EOF

# OpenDataStream("MLSD /", 0)

# OpenPassiveDataStream(AutoPassive, "MLSD /", 0)
Status:   Control connection has stale data(134) - prior to Execute("EPSV...")
Status:   The stale data was (length = 105): 
Stale:    450 TLS session of data connection has not resumed or the session does not match the control connection
Warning:  Reconnect needed due to stale data present on control connection (SslSessionLength: 27)
Status:   Disposing(sync) FtpClient.FtpSocketStream(control)
Status:   Command stashed: EPSV

# Connect(True)
Warning:  Reconnect (Count: 1)
Status:   FluentFTP 53.0.2.0(.NET 8.0) FtpClient
Status:   Connecting(sync) FtpClient.FtpSocketStream(control) IP #1 = ***:990
Status:   FTPS authentication successful, lib = .NET SslStream, cipher suite = Tls12 (Aes256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, DiffieHellman, 0) [575ms]
Status:   Waiting for a response
Response: 220 *** FTP site: Authorised logins only: IP address is recordered [1.707s]
Command:  USER ***
Status:   Waiting for response to: USER ***
Response: 331 Password required for username [277ms]
Command:  PASS ***
Status:   Waiting for response to: PASS ***
Response: 230 Logged on [277ms]
Command:  PBSZ 0
Status:   Waiting for response to: PBSZ 0
Response: 200 PBSZ=0 [277ms]
Command:  PROT P
Status:   Waiting for response to: PROT P
Response: 200 Protection level set to P [277ms]
Status:   Text encoding: System.Text.UTF8Encoding+UTF8EncodingSealed
Command:  OPTS UTF8 ON
Status:   Waiting for response to: OPTS UTF8 ON
Response: 202 UTF8 mode is always enabled. No need to send this command. [277ms]
Command:  SYST
Status:   Waiting for response to: SYST
Response: 215 UNIX emulated by FileZilla [277ms]
Status:   Active ServerHandler is: None
Status:   Listing parser set to: Machine
Command:  TYPE I
Status:   Waiting for response to: TYPE I
Response: 200 Type set to I [277ms]

# SetWorkingDirectory("/")
Command:  CWD /
Status:   Waiting for response to: CWD /
Response: 250 CWD successful. "/" is current directory. [277ms]

Status:   Executing stashed command

Command:  EPSV
Status:   Waiting for response to: EPSV
Response: 229 Entering Extended Passive Mode (|||46713|) [277ms]
Status:   Connecting(sync) FtpClient.FtpSocketStream(data) IP #1 = ***:46713
Command:  MLSD /
Status:   Waiting for response to: MLSD /
Response: 150 Opening data channel for directory listing of "/" [277ms]
Retrieved 0 items

# Dispose()
Status:   Disposing(sync) FtpClient

# Disconnect()
Status:   Control connection has stale data(134) - prior to Execute("QUIT...")
Status:   The stale data was (length = 105): 
Stale:    450 TLS session of data connection has not resumed or the session does not match the control connection
Warning:  Reconnect needed due to stale data present on control connection (SslSessionLength: 11)
Status:   Disposing(sync) FtpClient.FtpSocketStream(control) (redundant)
Status:   Not reconnecting for a QUIT command
Status:   Disposing(sync) FtpClient.FtpSocketStream(control) (redundant)

Linux (docker) output

# Connect(False)
Status:   FluentFTP 53.0.2.0(.NET 8.0) FtpClient
Status:   Connecting(sync) FtpClient.FtpSocketStream(control) IP #1 = ***:990
Status:   FTPS authentication successful, lib = .NET SslStream, cipher suite = Tls12 (Aes256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, DiffieHellman, 0) [662ms]
Status:   Waiting for a response
Response: 220 *** FTP site: Authorised logins only: IP address is recordered [739649.483d]
Command:  USER ***
Status:   Waiting for response to: USER ***
Response: 331 Password required for username [276ms]
Command:  PASS ***
Status:   Waiting for response to: PASS ***
Response: 230 Logged on [276ms]
Command:  PBSZ 0
Status:   Waiting for response to: PBSZ 0
Response: 200 PBSZ=0 [276ms]
Command:  PROT P
Status:   Waiting for response to: PROT P
Response: 200 Protection level set to P [276ms]
Command:  FEAT
Status:   Waiting for response to: FEAT
Response: 211-Features:
Response: MDTM
Response: REST STREAM
Response: SIZE
Response: MLST type*;size*;modify*;
Response: MLSD
Response: AUTH SSL
Response: AUTH TLS
Response: PROT
Response: PBSZ
Response: UTF8
Response: CLNT
Response: MFMT
Response: EPSV
Response: EPRT
Response: 211 End [279ms]
Status:   Text encoding: System.Text.UTF8Encoding+UTF8EncodingSealed
Command:  OPTS UTF8 ON
Status:   Waiting for response to: OPTS UTF8 ON
Response: 202 UTF8 mode is always enabled. No need to send this command. [277ms]
Command:  SYST
Status:   Waiting for response to: SYST
Response: 215 UNIX emulated by FileZilla [277ms]
Status:   Active ServerHandler is: None
Status:   Listing parser set to: Machine
Command:  PWD
Status:   Waiting for response to: PWD
Response: 257 "/" is current directory. [277ms]
Connected. Is secure: True

# GetListing(null, Auto)
Command:  TYPE I
Status:   Waiting for response to: TYPE I
Response: 200 Type set to I [277ms]

# OpenDataStream("MLSD /", 0)

# OpenPassiveDataStream(AutoPassive, "MLSD /", 0)
Command:  EPSV
Status:   Waiting for response to: EPSV
Response: 229 Entering Extended Passive Mode (|||46435|) [276ms]
Status:   Connecting(sync) FtpClient.FtpSocketStream(data) IP #1 = ***:46435
Command:  MLSD /
Status:   Waiting for response to: MLSD /
Response: 150 Opening data channel for directory listing of "/" [276ms]
Status:   FTPS authentication successful, lib = .NET SslStream, cipher suite = Tls12 (Aes256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, DiffieHellman, 0) [284ms]
+---------------------------------------+
Listing:  type=file;modify=20260112080105;size=5592; Delivered_20260112.csv
Listing:  type=file;modify=20260113080138;size=12570; Delivered_20260113.csv
Listing:  type=file;modify=20260114080055;size=2112; Delivered_20260114.csv
Listing:  type=file;modify=20260115080126;size=5486; Delivered_20260115.csv
Listing:  type=file;modify=20260116080205;size=6072; Delivered_20260116.csv
Listing:  type=file;modify=20260118080112;size=107; Delivered_20260118.csv
Listing:  type=file;modify=20260119080135;size=3067; Delivered_20260119.csv
Listing:  type=file;modify=20260120080226;size=8266; Delivered_20260120.csv
Listing:  type=file;modify=20260121080146;size=4674; Delivered_20260121.csv
Listing:  type=file;modify=20260122080049;size=4630; Delivered_20260122.csv
Listing:  type=file;modify=20260123080142;size=3716; Delivered_20260123.csv
Listing:  type=file;modify=20260127080026;size=4711; Delivered_20260127.csv
Listing:  type=file;modify=20260128080124;size=4826; Delivered_20260128.csv
Listing:  type=file;modify=20260129080105;size=5015; Delivered_20260129.csv
Listing:  type=file;modify=20260130080110;size=9973; Delivered_20260130.csv
Listing:  type=file;modify=20260131080144;size=294; Delivered_20260131.csv
Listing:  type=file;modify=20260202080100;size=2536; Delivered_20260202.csv
Listing:  type=file;modify=20260203080108;size=2890; Delivered_20260203.csv
-----------------------------------------
Status:   Disposing(sync) FtpClient.FtpSocketStream(data)

# CloseDataStream()
Status:   Waiting for response to: MLSD /
Response: 226 Successfully transferred "/" [848ms]
Status:   Disposing(sync) FtpClient.FtpSocketStream(data) (redundant)
Retrieved 18 items
Found item: /Delivered_20260112.csv
Found item: /Delivered_20260113.csv
Found item: /Delivered_20260114.csv
Found item: /Delivered_20260115.csv
Found item: /Delivered_20260116.csv
Found item: /Delivered_20260118.csv
Found item: /Delivered_20260119.csv
Found item: /Delivered_20260120.csv
Found item: /Delivered_20260121.csv
Found item: /Delivered_20260122.csv
Found item: /Delivered_20260123.csv
Found item: /Delivered_20260127.csv
Found item: /Delivered_20260128.csv
Found item: /Delivered_20260129.csv
Found item: /Delivered_20260130.csv
Found item: /Delivered_20260131.csv
Found item: /Delivered_20260202.csv
Found item: /Delivered_20260203.csv

# Dispose()
Status:   Disposing(sync) FtpClient

# Disconnect()
Command:  QUIT
Status:   Waiting for response to: QUIT
Response: 221 Goodbye [276ms]
Status:   Disposing(sync) FtpClient.FtpSocketStream(control)

[FanDjango]

I figured that might be due to issues with SSL resumes

Definitly, yes.

They changed something on the server, to be strict with session resume (even under TLS1.2, which does support a basic type of session resumption).

macOS:

lib = .NET SslStream, cipher suite = Tls12
450 TLS session of data connection has not resumed or the session does not match the control connection

linux:

lib = .NET SslStream, cipher suite = Tls12

But you can be sure that the docker SslStream lib is not the same as the macOS one (in terms of binary/code/version). Considering your source where you obtained the docker image, it is probably more up to date then the macOS SslStream (even if both call themselves .NET 8.0 - only deity itself knows what update level they are at.

I tried using GnuTlsStream, but that fails with System.DllNotFoundException: Unable to load shared library 'libdl.so.2' or one of its dependencies. (developing on a Mac).

Good idea. This would be a chance to get this working on MacOS, with your help.

[skyflyer]

But you can be sure that the docker SslStream lib is not the same as the macOS one

So you think that's the issue why it is not working on macOS?

Good idea. This would be a chance to get this working on MacOS, with your help.

Sure, let me know how I can help.

[FanDjango]

Unable to load shared library 'libdl.so.2'

I've been waiting for someone on macOS, who could find out the full name of libdl on that platform.

Could you search the lib path(s) on your machine to find out? The suffix will probably not be .so.2.

[FanDjango]

In case you cannot find it, then

this here

needs to be looked at and I will modify the code of FluentFTP.GnuTls, it then needs to be tested.

[skyflyer]

Is GnuTLS present?

First of, I checked if GnuTLS is installed on my system (it is). I then tested it with a simple C program to load it ran it:

....
DYLD_PRINT_LIBRARIES=1 ./gnutls_test
dyld[23236]: <6848A902-121D-37F1-8A81-ADB1AB5BC6E7> /opt/homebrew/Cellar/gnutls/3.8.9/lib/libgnutls.30.dylib
...
GnuTLS version: 3.8.9
GnuTLS library loaded and initialized successfully!

libdl

Not sure why libdl is required though? But I searched through the usual candidates and found nothing. I checked the referenced SO post and compiled the program. The result is:

Got handle 0x338b4d3e8 from dlopen() for libc.dylib

So I then changed the test program from the SO post to load the libgnutls.dylib library and ran it with homebrew's library path:

DYLD_LIBRARY_PATH=/opt/homebrew/Cellar/gnutls/3.8.9/lib/:$DYLD_LIBRARY_PATH ./dl
Got handle 0x7f0cfcd0 from dlopen() for libgnutls.dylib

N.B.: the program can't load libgnutls if I don't specify where to look for it.

For what it's worth, otool output:

otool -L gnutls_test
gnutls_test:
	/opt/homebrew/opt/gnutls/lib/libgnutls.30.dylib (compatibility version 71.0.0, current version 71.3.0)
	/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1356.0.0)

[FanDjango]

Thanks for this information. I am currently (re-)coding the function loader to take advantage of this. Please stand by.

[skyflyer]

Just some random throughts:

I've never packaged a nuget that contained native cross-platform libraries. Looking at skiasharp, I can see they're bundling libSkiaSharp.dylib in the nuget package and I can't see any GnuTLS packages in the FluentFtp.Gnutls nuget bundle.

If a requirement is to have GnuTls installed beforehand (e.g. with homebrew), than the nuget package should(?) use a custom import resolver and add a search path to /opt/homebrew/opt/gnutls/lib?

Some related resources:

• Please provide guidance on how to use DllImportResolver with dlopen on Linux (xref #11901) dotnet/runtime#93911
• https://www.reddit.com/r/dotnet/comments/185u7wo/publish_portable_net_8_app_how_to_access_the/
• https://github.com/LibUsbDotNet/LibUsbDotNet/blob/master/src/LibUsbDotNet/LibUsbDotNet.csproj (an example of bundling native libs)
• Any plans to support NativeLibrary in dotnet standard? dotnet/standard#1764

I'm not sure what the most idiomatic way to solve this is, but I'm leaning towards the approach that would bundle the x-plat libs in the nuget and resolve from there...

[FanDjango]

I can't see any GnuTLS packages in the FluentFtp.Gnutls nuget bundle.

For UNIX flavors, we rely on a previous GnuTls installation done by the user himself, normally GnuTls is even present without any user action. So we don't pack it into NuGet.

For Windows, we package the needed .dlls into NuGet, as we cannot support users who make mistakes building these by themselves, as the toolchain is complicated.

I've never packaged a nuget that contained native cross-platform libraries

Smile. I had a lot of fun doing that (for Windows). It is a pain in the neck.

---

Ok. If you pick up my new branch here, you can try and see what happens.

Sample config:

				client.Config.CustomStream = typeof(GnuTlsStream);
				client.Config.CustomStreamConfig = new GnuConfig() {
					LoadLibraryDllNamePrefix = "D:\\temp\\",
					LogLevel = 0,
					LogMessages = GnuMessage.All,
				};

Use LoadLibraryDllNamePrefix to specify the path that precedes libgnutls.30.dylib as you said it won't be found otherwise.

Use higher LogLevels for more information.

[FanDjango]

BTW, custom import resolver, yes I know. But: This functionality is only available in .NET Core 3.1 and .NET 5+.

[FanDjango]

Should help this guy too, but he disappeared #1632

[skyflyer]

Sorry for a late response, it's been a ... full day. It is now past 23h already.... time sure flies. Anyway, back on topic:

Summary

• it works 👍
• I suppose Path.Join would be better than string concatenation when using LoadLibraryDllNamePrefix ❓
• I guess the build error on linux is not problematic for development?

Anyhow, the whole client initialization that is working:

        using var client = new AsyncFtpClient(config.Host, config.Username, config.Password);
        client.Config.EncryptionMode = FtpEncryptionMode.Explicit;
        client.Config.SslProtocols = System.Security.Authentication.SslProtocols.Tls13;
        client.Config.CustomStream = typeof(GnuTlsStream);
        client.Config.ValidateAnyCertificate = true;
        var gnuConfig = new GnuConfig();
        if (RuntimeInformation.IsOSPlatform(OSPlatform.OSX)) {
            gnuConfig.LoadLibraryDllNamePrefix = "/opt/homebrew/lib/";
        }
        client.Config.CustomStreamConfig = gnuConfig;

Details

DYLD_LIBRARY_PATH="/opt/homebrew/lib:$DYLD_LIBRARY_PATH" dotnet run works. I did need to add certificate validation handler because it failed (without GnuTls, it is not needed).

        client.ValidateCertificate += (control, e) => {
            e.Accept = true;
        };

    // or
    client.Config.ValidateAnyCertificate = true;

I also ran it with path set in code:

        client.Config.CustomStreamConfig = new GnuConfig() {
            LoadLibraryDllNamePrefix = "/opt/homebrew/lib/",
            LogLevel = 0,
            LogMessages = GnuMessage.All,
        };

I found out, that if I use /opt/homebrew/lib (without trailing slash), it does not work. Maybe Path.Join would be more appropriate here?

I tested TLS 1.2 and 1.3 and both work.

I also tested in a linux container (.net 8 sdk) and could not compile it:

/usr/share/dotnet/sdk/8.0.417/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.TargetFrameworkInference.targets(166,5): error NETSDK1045: The current .NET SDK does not support targeting .NET 9.0.  Either target .NET 8.0 or lower, or use a version of the .NET SDK that supports .NET 9.0. Download the .NET SDK from https://aka.ms/dotnet/download [/app/FluentFTP.GnuTLS/FluentFTP.GnuTLS/FluentFTP.GnuTLS.csproj::TargetFramework=net9.0]

So I changed the TargetFrameworks to TargetFramework and it ran fine (without specifying the LoadLibraryDllNamePrefix).

Another related discussion: https://github.com/orgs/Homebrew/discussions/1737

It still "feels" weird to have to specify the library path, but I guess that's it :)