FTP/SSL upload and download no longer work with .NET 10

[HeinziAT]

Description

The following repro code works corrently when compiled with TargetFramework net9.0, but fails with an exception when compiled with TargetFramework net10.0.

Reproduction Steps

This repro example requires an FTP server with "explicit mode" SSL. Uploading without SSL works fine even with .NET 10.

using System;
using System.Net;
using System.Text;

// Replace with an FTPS server that you have access to.
string url = "ftp://user:password@server.example/a.txt";

FtpWebRequest request = (FtpWebRequest)WebRequest.Create(url);
request.Method = WebRequestMethods.Ftp.UploadFile;
request.EnableSsl = true;

byte[] data = Encoding.UTF8.GetBytes("Lorem ipsum");

using (var stream = request.GetRequestStream())
{
    stream.Write(data, 0, data.Length);
}

using (FtpWebResponse response = (FtpWebResponse)request.GetResponse())
{
    Console.WriteLine((int)response.StatusCode);
}

Expected behavior

The program uploads the file and prints "226" (a success status code). This is what happens when compiled with net9.0.

Actual behavior

This exception occurs at the closing brace of the first using block (when the request stream is disposed):

Unhandled exception. System.Net.WebException: The underlying connection was closed: The server committed a protocol violation
   at System.Net.FtpWebRequest.SyncRequestCallback(Object obj)
   at System.Net.CommandStream.Abort(Exception e)
   at System.Net.CommandStream.CheckContinuePipeline()
   at System.Net.FtpDataStream.System.Net.ICloseEx.CloseEx(CloseExState closeState)
   at System.Net.FtpDataStream.Dispose(Boolean disposing)
   at System.IO.Stream.Close()
   at Program.<Main>$(String[] args) in C:\[redacted]\Program.cs:line 17
   at Program.<Main>$(String[] args) in C:\[redacted]\Program.cs:line 6

Regression?

This works in .net 9, but not in .net 10.

Known Workarounds

Disable SSL.

(To state the obvious, in case inexperienced developers happen to read this: Don't do this, this will send your password in plain text over the Internet.)

Configuration

• Client: Windows 11
• Server: ProFTPD

Other information

I am aware that FtpWebRequest should not be used for new development. This, however, is a minimal example based on a legacy application breaking during the .net 9->10 upgrade.

Edit: Download is also broken, see the discussion below for a repro example.

[wfurt]

What is "explicit mode" @HeinziAT. Is that the configuration assuming TLS resume e.g. same session key? And is there public server we can test with?

[HeinziAT]

@wfurt There are two versions of SSL for FTP. FtpWebRequest only supports "explicit mode".

Unfortunately, I don't know any FTP servers that allows public write access (which makes sense, given the legal trouble you can easily run into if you allow "the public" to store and download arbitrary files). I used the FTP server of my web hosting provider to test this.

[wfurt]

I'm wondering if this is dup of #27916. There was never programatic way how to do the resumption and it could just work by luck. But I guess it would be interesting to know why 10 changed. If anything I would expect to resume more.

And does it happen with download as well? I would expect the TLS and data channel to be the same.
And what is yourTLSRenegotiate setting?

Lastly, it may be interesting to try it with TLS 1.2.

[HeinziAT]

@wfurt

Download

Download is also broken, just differently. This is my repro code:

[...same as above...]
request.Method = WebRequestMethods.Ftp.DownloadFile;
using (FtpWebResponse response = (FtpWebResponse)request.GetResponse())
{
    using (var reader = new StreamReader(response.GetResponseStream(), Encoding.UTF8))
    {
        string content = reader.ReadToEnd();
        Console.WriteLine(content);
    }
}

.NET 9 output the correct contents.
.NET 10 varies randomly between

• outputting garbage instead of the file contents and
• throwing an ObjectDisposedException (reader.ReadToEnd).

This is good, because finding a public FTP/SSL server to test downloading is probably easier than finding one that allows uploads.

TLS version

I tried to force TLS 1.2 and 1.3 by explicitly setting ServicePointManager.SecurityProtocol, but it did not make a difference. My server does not seem to support TLS 1.1 (auth fails).

Other questions

TLSRenegotiate: What is this option and how do I check its value?
Duplicate: I read though #27916, but, unfortunately, I'm not familiar enough with the details of the SSL protocol to be of any help here.

[wfurt]

http://www.proftpd.org/docs/howto/TLS.html Using TLSRenegotiate none like the example looks reasonable to me.

The observed behavior is also unpleasant - my guess is that the data channel fails (same way as upload) but the error is not handled properly as probably rare.

[HeinziAT]

@wfurt Re TLSRenegotiate: Thanks. Unfortunately, that's nothing I can change - I currently use the FTP server provided by an external web hosting provider for my tests.

I could set up and configure an FTP server on my personal Debian server, if that helps. But, I guess, if the .NET team want to fix this, they'll want to install their own FTP server anyways, rather than rely on the private infrastructure of some random github discussion participant for official Microsoft development work/regression tests. ;-)

[wfurt]

If you can try it would be great. We may need to do that but the priority is low IMHO at this moment. You can improve the chances by doing some of the digging.

[HeinziAT]

@wfurt
OK. I set up a test FTP server (ProFTPD 1.3.8) with TLS 1.2 and did some tests.

• .net 9: everthing works
• .net 10, ProFTPD default configuration: same problems as described above (protocol violation during upload, rubbish or ObjectDispoedException during download).
• .net 10 with TLSRenegotiate none: same problems as described above
• .net 10 with TLSOptions NoSessionReuseRequired: same problems as described above

Again, I'm not an SSL expert, but this looks like a new issue to me.

Is there anything else you want me to test?
If you want, I can send you the FTP user credentials via onetimesecret or some similar service.