TLS-P and TLS-C are no longer supported due to typo in refactoring

[gomonp]

We upgraded our FTP server to the latest version and found that out client can't use TLS-P any more.

This commit introduced critical bug.

Originally posted by @gomonp in 3f2f833

[gomonp]

Looks like link to my comment does not work, here is explanation.

Place of the issue - core/src/main/java/org/apache/ftpserver/command/impl/AUTH.java - constant VALID_AUTH_TYPES
https://github.com/apache/mina-ftpserver/blob/3f2f833a64d64fba508eb7f39519896723a16484/core/src/main/java/org/apache/ftpserver/command/impl/AUTH.java

Was:

private static final List<String> VALID_AUTH_TYPES = Arrays.asList("SSL", "TLS", "TLS-C", "TLS-P");

Now:

// put constant values instead of references, for clarity
private static final List<String> VALID_AUTH_TYPES = Arrays.asList("SSL", "TLS", "TLS_C", "TLS_P");

because constants has underscores instead of dashes.

So, for valid client auth type TLS-P following code block fails with 502 Command is not supported.

if (VALID_AUTH_TYPES.contains(authType)) {
    if (authType.equals(TLS_C_TYPE)) {
        authType = TLS_TYPE;
    } else if (authType.equals(TLS_P_TYPE)) {
        authType = SSL_TYPE;
    }

    try {
        LocalizedFtpReply reply = LocalizedFtpReply.translate(session, request, context, 234,
            "AUTH." + authType, null);
        secureSession(session, authType, reply);

        session.write(reply);
    } catch (FtpException ex) {
        throw ex;
    } catch (Exception ex) {
        LOG.warn("AUTH.execute()", ex);
        throw new FtpException("AUTH.execute()", ex);
    }
} else {
    session.write(LocalizedFtpReply.translate(session, request, context,
        FtpReply.REPLY_502_COMMAND_NOT_IMPLEMENTED, AUTH_COMMAND, null));
}

[elecharny]

Ah, damn it!

Let me fix that.

[elecharny]

Ok, pushed in the 1.2.X branch.

Thanks a lot for the analysis and pointing out precisely the problem. That also means we don't have a correct test coverage...

[gomonp]

Thanks a lot for such a quick fix!)
We already downgraded to previous version, but looking forward to upgrade again.
Do you have any draft ETA for the next version release - month/year/more?

[elecharny]

The thing is that there is currently an issue with MINA 2.2.4 which is being addressed atm, but that tales way longer than expected. And FtpServer 1.2.1 is built with this dependency.

So as soon a we get a MINA 2.2.5 out, I can cut a FTPServer release.

I have no time frame for that, and I'm currently pretty busy, so it won't be day, or weeks...