From sh162551@sac.sfbay.sun.com Tue Nov 18 23:47:15 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAJ7lEQn002273 for ; Tue, 18 Nov 2008 23:47:15 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id mAJ7kug3020274; Wed, 19 Nov 2008 15:47:13 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAK0080NLMOI300@brm-avmta-1.central.sun.com>; Wed, 19 Nov 2008 00:47:12 -0700 (MST) Received: from dm-sfbay-02.sfbay.sun.com ([129.146.11.31]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAK002HFLMNI260@brm-avmta-1.central.sun.com>; Wed, 19 Nov 2008 00:47:11 -0700 (MST) Received: from sac.sfbay.sun.com (new-sac.SFBay.Sun.COM [129.146.175.65]) by dm-sfbay-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id mAJ7lAAh027843; Tue, 18 Nov 2008 23:47:10 -0800 (PST) Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAJ7l98W002267; Tue, 18 Nov 2008 23:47:09 -0800 (PST) Received: (from sh162551@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id mAJ7l9BW002262; Tue, 18 Nov 2008 23:47:09 -0800 (PST) Date: Tue, 18 Nov 2008 23:47:09 -0800 (PST) From: Shi-Ying Irene Huang Subject: Gftp for OpenSolaris [LSARC/2008/721 FastTrack timeout 11/25/2008] To: LSARC-ext@sun.com Cc: alfred.peng@sun.com Message-id: <200811190747.mAJ7l9BW002262@sac.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 6260 Template Version: @(#)sac_nextcase %I% %G% SMI This information is Copyright 2008 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: Gftp for OpenSolaris 1.2. Name of Document Author/Supplier: Author: Alfred Peng 1.3 Date of This Document: 18 November, 2008 4. Technical Description 1. Introduction 1.1. Project/Component Working Name: gFTP: multithreaded file transfer client. 1.2. Name of Document Author/Supplier: Alfred Peng 1.3. Date of This Document: 11/04/08 1.3.1. Date this project was conceived: 12/14/1997 1.4. Name of Major Document Customer(s)/Consumer(s): 1.4.1. The PAC or CPT you expect to review your project: Solaris PAC 1.4.2. The ARC(s) you expect to review your project: LSARC 1.4.3. The Director/VP who is "Sponsoring" this project: robert.odea@sun.com 1.4.4. The name of your business unit: New Solaris Group, Desktop 1.5. Email Aliases: 1.5.1. Responsible Manager: leo.binchy@sun.com 1.5.2. Responsible Engineer: alfred.peng@sun.com 1.5.3. Marketing Manager: glynn.foster@sun.com 1.5.4. Interest List: desktop-discuss@opensolaris.org 4. Technical Description: 4.1. Details: gFTP is a multithreaded file transfer client for *NIX based machines. It has the following features: * Supports the FTP, FTPS (control connection only), HTTP, HTTPS, SSH and FSP protocols. * FTP and HTTP proxy server support. * Supports FXP file transfers which is a subset of FTP protocol. * Bookmarks menu to quickly connect to remote sites. * Internationalized to 41 languages. * Double-paned layout to show the local and remote filesystems. * Transfer pane to show the real-time status of each queued or active file transfer. * Log pane to display the text commands and responses between gFTP and the remote server. 4.2. Bug/RFE Number(s): None. 4.3. In Scope: See above. 4.4. Out of Scope: See above. 4.5. Interfaces: Exported Interface -------------------------------------------------------------------- Interface Name Classification Comment -------------------------------------------------------------------- SUNWgftp Uncommitted Package name /usr/bin/gftp Volatile gFTP launch script /usr/bin/gftp-gtk Volatile gFTP GUI /usr/bin/gftp-text Volatile gFTP CLI $HOME/.gftp Project Private Profile /usr/share/gftp Project Private Directory /usr/share/doc/SUNWgftp Project Private Copyright directory /usr/share/applications/gftp.desktop Volatile UI spec Imported Interface -------------------------------------------------------------------- Interface Classification ARC case Comment -------------------------------------------------------------------- GNOME Platform Committed LSARC/2008/207 GTK+ library Libraries GNOME 2.22 SSH Committed PSARC/2001/212 Secure Shell OpenSSL Volatile PSARC/2006/019 OpenSSL library 4.6. Doc Impact: New manpage, gftp.1. 4.7. Admin/Config Impact: None. 4.8. HA Impact: None. 4.9. I18N/L10N Impact: The JDS team and the G11N are working together to evaluate and provide I18N/L10N support. 4.10. Packaging & Delivery: Adds new package, SUNWgftp 4.11. Security Impact: gFTP uses OpenSSL library to encrypt the control and data channels for file transfer over HTTPS, and to encrypt the contol channel for FTPS. It creates socket BIO to handle SSL connections transparently. A handshake will be performed to verify server's certificate after the connection is established. The certificate verification will be with mode SSL_VERIFY_PEER and depth 9. It doesn't use the SSLv2 protocol and the list of available ciphers will be set to "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH". To support SSH protocol, gFTP uses ssh/sftp commands to build up connection with the server. The authentication information will be sent over the SSH connection. All the following requests and responses will go back and forth through this connection for secure file transfer. gFTP uses socket to transfer file by FTP and HTTP protocol. The password will be encoded with standard base64 for HTTP authentication. As for FTP authentication, the password will be sent in plain text through socket. gFTP includes a feature that allows user to save passwords. The password will be saved in the gFTP profile directory. This will create a potential security vulnerabilty because gFTP only has very primary encryption/decryption to make the stored passwords unreadable. Each character is separated in two nibbles. Then each nibble is stored under the form 01xxxx01. The resulted string is prefixed by a '$'. e.12. Dependencies: The following versions of the imported interfaces are required: GNOME 2.22 Upwards OpenSSL, SSH 5. Reference Documents: [1] gFTP homepage: http://www.gftp.org [2] Related ARC cases: LSARC 2008/207: GNOME 2.22 PSARC/2006/019: OpenSSL upgrade to 0.9.8a PSARC/2001/212: Secure Shell 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: Desktop 6.5. ARC review type: FastTrack 6.6. ARC Exposure: open From Irene.Huang@sun.com Tue Nov 18 23:50:10 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAJ7oAeL002359 for ; Tue, 18 Nov 2008 23:50:10 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAJ7o7rd027297 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Tue, 18 Nov 2008 23:50:10 -0800 (PST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAK00M1DLRKBQ00@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.Com); Tue, 18 Nov 2008 23:50:08 -0800 (PST) Received: from sineb-mail-2.sun.com ([192.18.19.7]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAK00EGGLRJ3ZE0@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.Com); Tue, 18 Nov 2008 23:50:08 -0800 (PST) Received: from fe-apac-05.sun.com (fe-apac-05.sun.com [192.18.19.176] (may be forged)) by sineb-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id mAJ7o6W6002267 for ; Wed, 19 Nov 2008 07:50:06 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0KAK00M01LPKUB00@mail-apac.sun.com> (original mail from Irene.Huang@Sun.COM) for LSARC-ext@Sun.Com (ORCPT LSARC-ext@Sun.Com); Wed, 19 Nov 2008 15:50:06 +0800 (SGT) Received: from [129.158.219.179] by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0KAK00177LRHGRG3@mail-apac.sun.com>; Wed, 19 Nov 2008 15:50:06 +0800 (SGT) Date: Wed, 19 Nov 2008 15:50:01 +0800 From: Irene Huang Subject: Re: Gftp for OpenSolaris [LSARC/2008/721 FastTrack timeout 11/25/2008] In-reply-to: <200811190747.mAJ7l9BW002262@sac.sfbay.sun.com> Sender: Irene.Huang@sun.com To: Shi-Ying Irene Huang Cc: LSARC-ext@sun.com, alfred.peng@sun.com Message-id: <4923C529.1000603@sun.com> MIME-version: 1.0 Content-type: multipart/mixed; boundary="Boundary_(ID_U++6qOwLgK3pXgblmkHuiw)" X-PMX-Version: 5.4.1.325704 References: <200811190747.mAJ7l9BW002262@sac.sfbay.sun.com> User-Agent: Thunderbird 2.0.0.17 (Windows/20080914) Status: RO Content-Length: 9991 This is a multi-part message in MIME format. --Boundary_(ID_U++6qOwLgK3pXgblmkHuiw) Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT Package map for the project is attached. --Irene Shi-Ying Irene Huang wrote: > Template Version: @(#)sac_nextcase %I% %G% SMI > This information is Copyright 2008 Sun Microsystems > 1. Introduction > 1.1. Project/Component Working Name: > Gftp for OpenSolaris > 1.2. Name of Document Author/Supplier: > Author: Alfred Peng > 1.3 Date of This Document: > 18 November, 2008 > 4. Technical Description > 1. Introduction > 1.1. Project/Component Working Name: > > gFTP: multithreaded file transfer client. > > 1.2. Name of Document Author/Supplier: > > Alfred Peng > > 1.3. Date of This Document: > > 11/04/08 > > 1.3.1. Date this project was conceived: > > 12/14/1997 > > 1.4. Name of Major Document Customer(s)/Consumer(s): > > 1.4.1. The PAC or CPT you expect to review your project: > > Solaris PAC > > 1.4.2. The ARC(s) you expect to review your project: > > LSARC > > 1.4.3. The Director/VP who is "Sponsoring" this project: > > robert.odea@sun.com > > 1.4.4. The name of your business unit: > > New Solaris Group, Desktop > > 1.5. Email Aliases: > > 1.5.1. Responsible Manager: > > leo.binchy@sun.com > > 1.5.2. Responsible Engineer: > > alfred.peng@sun.com > > 1.5.3. Marketing Manager: > > glynn.foster@sun.com > > 1.5.4. Interest List: > > desktop-discuss@opensolaris.org > > 4. Technical Description: > 4.1. Details: > gFTP is a multithreaded file transfer client for *NIX based machines. > It has the following features: > > * Supports the FTP, FTPS (control connection only), HTTP, HTTPS, SSH > and FSP protocols. > * FTP and HTTP proxy server support. > * Supports FXP file transfers which is a subset of FTP protocol. > * Bookmarks menu to quickly connect to remote sites. > * Internationalized to 41 languages. > * Double-paned layout to show the local and remote filesystems. > * Transfer pane to show the real-time status of each queued or active > file transfer. > * Log pane to display the text commands and responses between gFTP > and the remote server. > > 4.2. Bug/RFE Number(s): > > None. > > 4.3. In Scope: > > See above. > > 4.4. Out of Scope: > > See above. > > 4.5. Interfaces: > > Exported Interface > -------------------------------------------------------------------- > Interface Name Classification Comment > -------------------------------------------------------------------- > SUNWgftp Uncommitted Package name > /usr/bin/gftp Volatile gFTP launch script > /usr/bin/gftp-gtk Volatile gFTP GUI > /usr/bin/gftp-text Volatile gFTP CLI > $HOME/.gftp Project Private Profile > /usr/share/gftp Project Private Directory > /usr/share/doc/SUNWgftp Project Private Copyright directory > /usr/share/applications/gftp.desktop Volatile UI spec > > > Imported Interface > -------------------------------------------------------------------- > Interface Classification ARC case Comment > -------------------------------------------------------------------- > GNOME Platform Committed LSARC/2008/207 GTK+ library > Libraries GNOME 2.22 > SSH Committed PSARC/2001/212 Secure Shell > OpenSSL Volatile PSARC/2006/019 OpenSSL library > > 4.6. Doc Impact: > > New manpage, gftp.1. > > 4.7. Admin/Config Impact: > > None. > > 4.8. HA Impact: > > None. > > 4.9. I18N/L10N Impact: > > The JDS team and the G11N are working together to evaluate and > provide I18N/L10N support. > > 4.10. Packaging & Delivery: > > Adds new package, SUNWgftp > > 4.11. Security Impact: > > gFTP uses OpenSSL library to encrypt the control and data channels > for file transfer over HTTPS, and to encrypt the contol channel for > FTPS. It creates socket BIO to handle SSL connections transparently. > A handshake will be performed to verify server's certificate after > the connection is established. The certificate verification will be > with mode SSL_VERIFY_PEER and depth 9. It doesn't use the SSLv2 > protocol and the list of available ciphers will be set to > "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH". > > To support SSH protocol, gFTP uses ssh/sftp commands to build up > connection with the server. The authentication information will be > sent over the SSH connection. All the following requests and responses > will go back and forth through this connection for secure file transfer. > > gFTP uses socket to transfer file by FTP and HTTP protocol. The > password will be encoded with standard base64 for HTTP authentication. > As for FTP authentication, the password will be sent in plain text > through socket. > > gFTP includes a feature that allows user to save passwords. The > password will be saved in the gFTP profile directory. This will > create a potential security vulnerabilty because gFTP only has very > primary encryption/decryption to make the stored passwords unreadable. > Each character is separated in two nibbles. Then each nibble is stored > under the form 01xxxx01. The resulted string is prefixed by a '$'. > > e.12. Dependencies: > > The following versions of the imported interfaces are required: > > GNOME 2.22 Upwards > OpenSSL, SSH > > 5. Reference Documents: > > [1] gFTP homepage: > http://www.gftp.org > > [2] Related ARC cases: > LSARC 2008/207: GNOME 2.22 > PSARC/2006/019: OpenSSL upgrade to 0.9.8a > PSARC/2001/212: Secure Shell > > > 6. Resources and Schedule > 6.4. Steering Committee requested information > 6.4.1. Consolidation C-team Name: > Desktop > 6.5. ARC review type: FastTrack > 6.6. ARC Exposure: open > > --Boundary_(ID_U++6qOwLgK3pXgblmkHuiw) Content-type: text/plain; name=pkgmap Content-transfer-encoding: 7BIT Content-disposition: inline; filename=pkgmap : 1 8012 1 d none bin 0755 root bin 1 f none bin/gftp 0755 root bin 333 27969 1226565941 1 f none bin/gftp-gtk 0755 root bin 2124616 33816 1226565941 1 f none bin/gftp-text 0755 root bin 1214360 33902 1226565941 1 i copyright 1019 20623 1226565941 1 i depend 201 16850 1226565941 1 i pkginfo 531 41786 1226565942 1 d none share 0755 root sys 1 d none share/applications 0755 root other 1 f none share/applications/gftp.desktop 0644 root bin 266 24254 1226565940 1 d none share/doc 0755 root other 1 d none share/doc/SUNWgftp 0755 root bin 1 f none share/doc/SUNWgftp/COPYING 0444 root bin 18003 30095 1028576805 1 f none share/doc/SUNWgftp/ChangeLog 0444 root bin 133660 22119 1107532170 1 f none share/doc/SUNWgftp/INSTALL 0444 root bin 9240 25239 1107531781 1 f none share/doc/SUNWgftp/README 0444 root bin 14939 63603 1107532214 1 d none share/gftp 0755 root other 1 f none share/gftp/COPYING 0644 root bin 18003 30095 1226565940 1 f none share/gftp/bookmarks 0644 root bin 6133 37635 1226565940 1 f none share/gftp/connect.xpm 0644 root bin 1417 61205 1226565940 1 f none share/gftp/deb.xpm 0644 root bin 4875 50820 1226565940 1 f none share/gftp/diff.xpm 0644 root bin 1308 61956 1226565940 1 f none share/gftp/dir.xpm 0644 root bin 750 35507 1226565940 1 f none share/gftp/doc.xpm 0644 root bin 1215 60091 1226565940 1 f none share/gftp/dotdot.xpm 0644 root bin 492 19892 1226565940 1 f none share/gftp/down.xpm 0644 root bin 424 18952 1226565940 1 f none share/gftp/exe.xpm 0644 root bin 867 39682 1226565940 1 f none share/gftp/gftp-logo.xpm 0644 root bin 199331 13018 1226565940 1 f none share/gftp/gftp-mini-logo.xpm 0644 root bin 6264 53814 1226565940 1 f none share/gftp/gftp.xpm 0644 root bin 13188 13171 1226565940 1 f none share/gftp/gftprc 0644 root bin 8778 61500 1226565940 1 f none share/gftp/img.xpm 0644 root bin 1555 12311 1226565940 1 f none share/gftp/left.xpm 0644 root bin 318 15590 1226565940 1 f none share/gftp/linkdir.xpm 0644 root bin 769 37631 1226565940 1 f none share/gftp/linkfile.xpm 0644 root bin 980 46443 1226565940 1 f none share/gftp/man.xpm 0644 root bin 2130 33137 1226565940 1 f none share/gftp/open_dir.xpm 0644 root bin 885 42054 1226565940 1 f none share/gftp/right.xpm 0644 root bin 319 15705 1226565940 1 f none share/gftp/rpm.xpm 0644 root bin 1105 52624 1226565940 1 f none share/gftp/sound.xpm 0644 root bin 627 27230 1226565940 1 f none share/gftp/stop.xpm 0644 root bin 6385 54529 1226565940 1 f none share/gftp/tar.xpm 0644 root bin 1315 63947 1226565940 1 f none share/gftp/txt.xpm 0644 root bin 1120 52785 1226565940 1 f none share/gftp/up.xpm 0644 root bin 422 18741 1226565940 1 f none share/gftp/world.xpm 0644 root bin 702 32178 1226565940 1 d none share/man 0755 root bin 1 d none share/man/man1 0755 root bin 1 f none share/man/man1/gftp.1 0644 root bin 2301 6751 1226565940 1 d none share/pixmaps 0755 root other 1 f none share/pixmaps/gftp.png 0644 root bin 2810 23533 1226565940 --Boundary_(ID_U++6qOwLgK3pXgblmkHuiw)-- From John.Fischer@sun.com Thu Nov 20 09:07:28 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAKH7RnE014894 for ; Thu, 20 Nov 2008 09:07:27 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id mAKH7OYJ001931 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Fri, 21 Nov 2008 01:07:26 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAN00G2568EYR00@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.Com); Thu, 20 Nov 2008 09:07:26 -0800 (PST) Received: from brmea-mail-2.sun.com ([192.18.98.43]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAN00EXE68D1CE0@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.Com); Thu, 20 Nov 2008 09:07:25 -0800 (PST) Received: from fe-amer-10.sun.com ([192.18.109.80]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id mAKH7P5V009583 for ; Thu, 20 Nov 2008 17:07:25 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0KAN00L014NQGN00@mail-amer.sun.com> (original mail from John.Fischer@Sun.COM) for LSARC-ext@Sun.Com (ORCPT LSARC-ext@Sun.Com); Thu, 20 Nov 2008 10:07:25 -0700 (MST) Received: from 129.145.154.66 ([129.145.154.66]) by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0KAN003GP67X0I80@mail-amer.sun.com>; Thu, 20 Nov 2008 10:07:10 -0700 (MST) Date: Thu, 20 Nov 2008 09:07:09 -0800 From: John Fischer Subject: Re: Gftp for OpenSolaris [LSARC/2008/721 FastTrack timeout 11/25/2008] In-reply-to: <200811190747.mAJ7l9BW002262@sac.sfbay.sun.com> Sender: John.Fischer@sun.com To: Shi-Ying Irene Huang Cc: LSARC-ext@sun.com, Alfred.Peng@sun.com Reply-to: John.Fischer@sun.com Message-id: <1227200829.51667.100.camel@sr1-umpk-16> MIME-version: 1.0 X-Mailer: Ximian Evolution 1.4.6.301 Content-type: text/plain; charset=ASCII Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200811190747.mAJ7l9BW002262@sac.sfbay.sun.com> Status: RO Content-Length: 6926 Alfred, It would be real nice to have the .gftp configuration file in .gnome or some other directory instead of $HOME. When will the "Desktop base directory spec" be an approved Free Desktop specification? Thanks, John On Tue, 2008-11-18 at 23:47, Shi-Ying Irene Huang wrote: > Template Version: @(#)sac_nextcase %I% %G% SMI > This information is Copyright 2008 Sun Microsystems > 1. Introduction > 1.1. Project/Component Working Name: > Gftp for OpenSolaris > 1.2. Name of Document Author/Supplier: > Author: Alfred Peng > 1.3 Date of This Document: > 18 November, 2008 > 4. Technical Description > 1. Introduction > 1.1. Project/Component Working Name: > > gFTP: multithreaded file transfer client. > > 1.2. Name of Document Author/Supplier: > > Alfred Peng > > 1.3. Date of This Document: > > 11/04/08 > > 1.3.1. Date this project was conceived: > > 12/14/1997 > > 1.4. Name of Major Document Customer(s)/Consumer(s): > > 1.4.1. The PAC or CPT you expect to review your project: > > Solaris PAC > > 1.4.2. The ARC(s) you expect to review your project: > > LSARC > > 1.4.3. The Director/VP who is "Sponsoring" this project: > > robert.odea@sun.com > > 1.4.4. The name of your business unit: > > New Solaris Group, Desktop > > 1.5. Email Aliases: > > 1.5.1. Responsible Manager: > > leo.binchy@sun.com > > 1.5.2. Responsible Engineer: > > alfred.peng@sun.com > > 1.5.3. Marketing Manager: > > glynn.foster@sun.com > > 1.5.4. Interest List: > > desktop-discuss@opensolaris.org > > 4. Technical Description: > 4.1. Details: > gFTP is a multithreaded file transfer client for *NIX based machines. > It has the following features: > > * Supports the FTP, FTPS (control connection only), HTTP, HTTPS, SSH > and FSP protocols. > * FTP and HTTP proxy server support. > * Supports FXP file transfers which is a subset of FTP protocol. > * Bookmarks menu to quickly connect to remote sites. > * Internationalized to 41 languages. > * Double-paned layout to show the local and remote filesystems. > * Transfer pane to show the real-time status of each queued or active > file transfer. > * Log pane to display the text commands and responses between gFTP > and the remote server. > > 4.2. Bug/RFE Number(s): > > None. > > 4.3. In Scope: > > See above. > > 4.4. Out of Scope: > > See above. > > 4.5. Interfaces: > > Exported Interface > -------------------------------------------------------------------- > Interface Name Classification Comment > -------------------------------------------------------------------- > SUNWgftp Uncommitted Package name > /usr/bin/gftp Volatile gFTP launch script > /usr/bin/gftp-gtk Volatile gFTP GUI > /usr/bin/gftp-text Volatile gFTP CLI > $HOME/.gftp Project Private Profile > /usr/share/gftp Project Private Directory > /usr/share/doc/SUNWgftp Project Private Copyright directory > /usr/share/applications/gftp.desktop Volatile UI spec > > > Imported Interface > -------------------------------------------------------------------- > Interface Classification ARC case Comment > -------------------------------------------------------------------- > GNOME Platform Committed LSARC/2008/207 GTK+ library > Libraries GNOME 2.22 > SSH Committed PSARC/2001/212 Secure Shell > OpenSSL Volatile PSARC/2006/019 OpenSSL library > > 4.6. Doc Impact: > > New manpage, gftp.1. > > 4.7. Admin/Config Impact: > > None. > > 4.8. HA Impact: > > None. > > 4.9. I18N/L10N Impact: > > The JDS team and the G11N are working together to evaluate and > provide I18N/L10N support. > > 4.10. Packaging & Delivery: > > Adds new package, SUNWgftp > > 4.11. Security Impact: > > gFTP uses OpenSSL library to encrypt the control and data channels > for file transfer over HTTPS, and to encrypt the contol channel for > FTPS. It creates socket BIO to handle SSL connections transparently. > A handshake will be performed to verify server's certificate after > the connection is established. The certificate verification will be > with mode SSL_VERIFY_PEER and depth 9. It doesn't use the SSLv2 > protocol and the list of available ciphers will be set to > "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH". > > To support SSH protocol, gFTP uses ssh/sftp commands to build up > connection with the server. The authentication information will be > sent over the SSH connection. All the following requests and responses > will go back and forth through this connection for secure file transfer. > > gFTP uses socket to transfer file by FTP and HTTP protocol. The > password will be encoded with standard base64 for HTTP authentication. > As for FTP authentication, the password will be sent in plain text > through socket. > > gFTP includes a feature that allows user to save passwords. The > password will be saved in the gFTP profile directory. This will > create a potential security vulnerabilty because gFTP only has very > primary encryption/decryption to make the stored passwords unreadable. > Each character is separated in two nibbles. Then each nibble is stored > under the form 01xxxx01. The resulted string is prefixed by a '$'. > > e.12. Dependencies: > > The following versions of the imported interfaces are required: > > GNOME 2.22 Upwards > OpenSSL, SSH > > 5. Reference Documents: > > [1] gFTP homepage: > http://www.gftp.org > > [2] Related ARC cases: > LSARC 2008/207: GNOME 2.22 > PSARC/2006/019: OpenSSL upgrade to 0.9.8a > PSARC/2001/212: Secure Shell > > > 6. Resources and Schedule > 6.4. Steering Committee requested information > 6.4.1. Consolidation C-team Name: > Desktop > 6.5. ARC review type: FastTrack > 6.6. ARC Exposure: open > From Alfred.Peng@Sun.COM Thu Nov 20 23:36:21 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAL7aK1P008497 for ; Thu, 20 Nov 2008 23:36:21 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id mAL7aIfx016200 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Fri, 21 Nov 2008 15:36:19 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAO00J07AGI5N00@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 21 Nov 2008 00:36:18 -0700 (MST) Received: from sineb-mail-1.sun.com ([192.18.19.6]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAO00FDQAGF4020@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 21 Nov 2008 00:36:17 -0700 (MST) Received: from fe-apac-05.sun.com (fe-apac-05.sun.com [192.18.19.176] (may be forged)) by sineb-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id mAL7aF7u009842 for ; Fri, 21 Nov 2008 07:36:15 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0KAO00I01ABWQG00@mail-apac.sun.com> (original mail from Alfred.Peng@Sun.COM) for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 21 Nov 2008 15:36:15 +0800 (SGT) Received: from [192.168.1.71] ([116.15.123.143]) by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0KAO001FEAGEGNO0@mail-apac.sun.com>; Fri, 21 Nov 2008 15:36:14 +0800 (SGT) Date: Fri, 21 Nov 2008 15:36:38 +0800 From: Alfred Peng Subject: Re: Gftp for OpenSolaris [LSARC/2008/721 FastTrack timeout 11/25/2008] In-reply-to: <1227200829.51667.100.camel@sr1-umpk-16> Sender: Alfred.Peng@Sun.COM To: John.Fischer@Sun.COM Cc: Shi-Ying Irene Huang , LSARC-ext@Sun.COM Message-id: <49266506.3030008@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200811190747.mAJ7l9BW002262@sac.sfbay.sun.com> <1227200829.51667.100.camel@sr1-umpk-16> User-Agent: Thunderbird 2.0.0.17 (X11/20081023) Status: RO Content-Length: 7276 Hi John, The profile will be moved to $HOME/.gnome2/.gftp as GNOME community hosts the source repository/bug tracking for gFTP. Best Regards, -Alfred John Fischer wrote: > Alfred, > > It would be real nice to have the .gftp configuration file > in .gnome or some other directory instead of $HOME. When > will the "Desktop base directory spec" be an approved Free > Desktop specification? > > Thanks, > > John > > On Tue, 2008-11-18 at 23:47, Shi-Ying Irene Huang wrote: > >> Template Version: @(#)sac_nextcase %I% %G% SMI >> This information is Copyright 2008 Sun Microsystems >> 1. Introduction >> 1.1. Project/Component Working Name: >> Gftp for OpenSolaris >> 1.2. Name of Document Author/Supplier: >> Author: Alfred Peng >> 1.3 Date of This Document: >> 18 November, 2008 >> 4. Technical Description >> 1. Introduction >> 1.1. Project/Component Working Name: >> >> gFTP: multithreaded file transfer client. >> >> 1.2. Name of Document Author/Supplier: >> >> Alfred Peng >> >> 1.3. Date of This Document: >> >> 11/04/08 >> >> 1.3.1. Date this project was conceived: >> >> 12/14/1997 >> >> 1.4. Name of Major Document Customer(s)/Consumer(s): >> >> 1.4.1. The PAC or CPT you expect to review your project: >> >> Solaris PAC >> >> 1.4.2. The ARC(s) you expect to review your project: >> >> LSARC >> >> 1.4.3. The Director/VP who is "Sponsoring" this project: >> >> robert.odea@sun.com >> >> 1.4.4. The name of your business unit: >> >> New Solaris Group, Desktop >> >> 1.5. Email Aliases: >> >> 1.5.1. Responsible Manager: >> >> leo.binchy@sun.com >> >> 1.5.2. Responsible Engineer: >> >> alfred.peng@sun.com >> >> 1.5.3. Marketing Manager: >> >> glynn.foster@sun.com >> >> 1.5.4. Interest List: >> >> desktop-discuss@opensolaris.org >> >> 4. Technical Description: >> 4.1. Details: >> gFTP is a multithreaded file transfer client for *NIX based machines. >> It has the following features: >> >> * Supports the FTP, FTPS (control connection only), HTTP, HTTPS, SSH >> and FSP protocols. >> * FTP and HTTP proxy server support. >> * Supports FXP file transfers which is a subset of FTP protocol. >> * Bookmarks menu to quickly connect to remote sites. >> * Internationalized to 41 languages. >> * Double-paned layout to show the local and remote filesystems. >> * Transfer pane to show the real-time status of each queued or active >> file transfer. >> * Log pane to display the text commands and responses between gFTP >> and the remote server. >> >> 4.2. Bug/RFE Number(s): >> >> None. >> >> 4.3. In Scope: >> >> See above. >> >> 4.4. Out of Scope: >> >> See above. >> >> 4.5. Interfaces: >> >> Exported Interface >> -------------------------------------------------------------------- >> Interface Name Classification Comment >> -------------------------------------------------------------------- >> SUNWgftp Uncommitted Package name >> /usr/bin/gftp Volatile gFTP launch script >> /usr/bin/gftp-gtk Volatile gFTP GUI >> /usr/bin/gftp-text Volatile gFTP CLI >> $HOME/.gftp Project Private Profile >> /usr/share/gftp Project Private Directory >> /usr/share/doc/SUNWgftp Project Private Copyright directory >> /usr/share/applications/gftp.desktop Volatile UI spec >> >> >> Imported Interface >> -------------------------------------------------------------------- >> Interface Classification ARC case Comment >> -------------------------------------------------------------------- >> GNOME Platform Committed LSARC/2008/207 GTK+ library >> Libraries GNOME 2.22 >> SSH Committed PSARC/2001/212 Secure Shell >> OpenSSL Volatile PSARC/2006/019 OpenSSL library >> >> 4.6. Doc Impact: >> >> New manpage, gftp.1. >> >> 4.7. Admin/Config Impact: >> >> None. >> >> 4.8. HA Impact: >> >> None. >> >> 4.9. I18N/L10N Impact: >> >> The JDS team and the G11N are working together to evaluate and >> provide I18N/L10N support. >> >> 4.10. Packaging & Delivery: >> >> Adds new package, SUNWgftp >> >> 4.11. Security Impact: >> >> gFTP uses OpenSSL library to encrypt the control and data channels >> for file transfer over HTTPS, and to encrypt the contol channel for >> FTPS. It creates socket BIO to handle SSL connections transparently. >> A handshake will be performed to verify server's certificate after >> the connection is established. The certificate verification will be >> with mode SSL_VERIFY_PEER and depth 9. It doesn't use the SSLv2 >> protocol and the list of available ciphers will be set to >> "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH". >> >> To support SSH protocol, gFTP uses ssh/sftp commands to build up >> connection with the server. The authentication information will be >> sent over the SSH connection. All the following requests and responses >> will go back and forth through this connection for secure file transfer. >> >> gFTP uses socket to transfer file by FTP and HTTP protocol. The >> password will be encoded with standard base64 for HTTP authentication. >> As for FTP authentication, the password will be sent in plain text >> through socket. >> >> gFTP includes a feature that allows user to save passwords. The >> password will be saved in the gFTP profile directory. This will >> create a potential security vulnerabilty because gFTP only has very >> primary encryption/decryption to make the stored passwords unreadable. >> Each character is separated in two nibbles. Then each nibble is stored >> under the form 01xxxx01. The resulted string is prefixed by a '$'. >> >> e.12. Dependencies: >> >> The following versions of the imported interfaces are required: >> >> GNOME 2.22 Upwards >> OpenSSL, SSH >> >> 5. Reference Documents: >> >> [1] gFTP homepage: >> http://www.gftp.org >> >> [2] Related ARC cases: >> LSARC 2008/207: GNOME 2.22 >> PSARC/2006/019: OpenSSL upgrade to 0.9.8a >> PSARC/2001/212: Secure Shell >> >> >> 6. Resources and Schedule >> 6.4. Steering Committee requested information >> 6.4.1. Consolidation C-team Name: >> Desktop >> 6.5. ARC review type: FastTrack >> 6.6. ARC Exposure: open >> >> > > From Alfred.Peng@sun.com Thu Nov 20 23:48:04 2008 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAL7m3lw008704 for ; Thu, 20 Nov 2008 23:48:03 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAL7m3A2011251 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Thu, 20 Nov 2008 23:48:03 -0800 (PST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAO00K09B02NG00@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 21 Nov 2008 00:48:02 -0700 (MST) Received: from sineb-mail-1.sun.com ([192.18.19.6]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAO00FL7B003Z20@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 21 Nov 2008 00:48:01 -0700 (MST) Received: from fe-apac-06.sun.com (fe-apac-06.sun.com [192.18.19.177] (may be forged)) by sineb-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id mAL7lxQx010799 for ; Fri, 21 Nov 2008 07:47:59 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0KAO00901ATDJ000@mail-apac.sun.com> (original mail from Alfred.Peng@Sun.COM) for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Fri, 21 Nov 2008 15:47:59 +0800 (SGT) Received: from [192.168.1.71] ([116.15.123.143]) by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0KAO00MQ5AZOW5NG@mail-apac.sun.com>; Fri, 21 Nov 2008 15:47:58 +0800 (SGT) Date: Fri, 21 Nov 2008 15:47:51 +0800 From: Alfred Peng Subject: Re: Gftp for OpenSolaris [LSARC/2008/721 FastTrack timeout 11/25/2008] In-reply-to: <49266506.3030008@sun.com> Sender: Alfred.Peng@sun.com To: Alfred Peng Cc: John.Fischer@sun.com, Shi-Ying Irene Huang , LSARC-ext@sun.com Message-id: <492667A7.9020004@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200811190747.mAJ7l9BW002262@sac.sfbay.sun.com> <1227200829.51667.100.camel@sr1-umpk-16> <49266506.3030008@sun.com> User-Agent: Thunderbird 2.0.0.17 (X11/20081023) Status: RO Content-Length: 7756 Alfred Peng wrote: > Hi John, > > The profile will be moved to $HOME/.gnome2/.gftp as GNOME community > hosts the source repository/bug tracking for gFTP. Sorry for the typo. Should be $HOME/.gnome2/gftp Thanks, -Alfred > > Best Regards, > -Alfred > > John Fischer wrote: >> Alfred, >> >> It would be real nice to have the .gftp configuration file in .gnome >> or some other directory instead of $HOME. When >> will the "Desktop base directory spec" be an approved Free >> Desktop specification? >> Thanks, >> >> John >> >> On Tue, 2008-11-18 at 23:47, Shi-Ying Irene Huang wrote: >> >>> Template Version: @(#)sac_nextcase %I% %G% SMI >>> This information is Copyright 2008 Sun Microsystems >>> 1. Introduction >>> 1.1. Project/Component Working Name: >>> Gftp for OpenSolaris >>> 1.2. Name of Document Author/Supplier: >>> Author: Alfred Peng >>> 1.3 Date of This Document: >>> 18 November, 2008 >>> 4. Technical Description >>> 1. Introduction >>> 1.1. Project/Component Working Name: >>> >>> gFTP: multithreaded file transfer client. >>> >>> 1.2. Name of Document Author/Supplier: >>> >>> Alfred Peng >>> >>> 1.3. Date of This Document: >>> >>> 11/04/08 >>> >>> 1.3.1. Date this project was conceived: >>> >>> 12/14/1997 >>> >>> 1.4. Name of Major Document Customer(s)/Consumer(s): >>> >>> 1.4.1. The PAC or CPT you expect to review your project: >>> >>> Solaris PAC >>> >>> 1.4.2. The ARC(s) you expect to review your project: >>> >>> LSARC >>> >>> 1.4.3. The Director/VP who is "Sponsoring" this project: >>> >>> robert.odea@sun.com >>> >>> 1.4.4. The name of your business unit: >>> >>> New Solaris Group, Desktop >>> >>> 1.5. Email Aliases: >>> >>> 1.5.1. Responsible Manager: >>> >>> leo.binchy@sun.com >>> >>> 1.5.2. Responsible Engineer: >>> >>> alfred.peng@sun.com >>> >>> 1.5.3. Marketing Manager: >>> >>> glynn.foster@sun.com >>> >>> 1.5.4. Interest List: >>> >>> desktop-discuss@opensolaris.org >>> >>> 4. Technical Description: >>> 4.1. Details: >>> gFTP is a multithreaded file transfer client for *NIX based >>> machines. >>> It has the following features: >>> >>> * Supports the FTP, FTPS (control connection only), HTTP, >>> HTTPS, SSH >>> and FSP protocols. >>> * FTP and HTTP proxy server support. >>> * Supports FXP file transfers which is a subset of FTP >>> protocol. >>> * Bookmarks menu to quickly connect to remote sites. >>> * Internationalized to 41 languages. >>> * Double-paned layout to show the local and remote filesystems. >>> * Transfer pane to show the real-time status of each queued >>> or active >>> file transfer. >>> * Log pane to display the text commands and responses >>> between gFTP >>> and the remote server. >>> >>> 4.2. Bug/RFE Number(s): >>> >>> None. >>> >>> 4.3. In Scope: >>> >>> See above. >>> >>> 4.4. Out of Scope: >>> >>> See above. >>> 4.5. Interfaces: >>> >>> Exported Interface >>> >>> -------------------------------------------------------------------- >>> Interface Name Classification >>> Comment >>> >>> -------------------------------------------------------------------- >>> SUNWgftp Uncommitted >>> Package name >>> /usr/bin/gftp Volatile >>> gFTP launch script >>> /usr/bin/gftp-gtk Volatile >>> gFTP GUI >>> /usr/bin/gftp-text Volatile >>> gFTP CLI >>> $HOME/.gftp Project Private >>> Profile >>> /usr/share/gftp Project Private >>> Directory >>> /usr/share/doc/SUNWgftp Project Private >>> Copyright directory >>> /usr/share/applications/gftp.desktop Volatile UI >>> spec >>> >>> >>> Imported Interface >>> >>> -------------------------------------------------------------------- >>> Interface Classification ARC case Comment >>> >>> -------------------------------------------------------------------- >>> GNOME Platform Committed LSARC/2008/207 GTK+ >>> library >>> Libraries GNOME 2.22 >>> SSH Committed PSARC/2001/212 >>> Secure Shell >>> OpenSSL Volatile PSARC/2006/019 >>> OpenSSL library >>> >>> 4.6. Doc Impact: >>> >>> New manpage, gftp.1. >>> 4.7. Admin/Config Impact: >>> >>> None. >>> 4.8. HA Impact: >>> >>> None. >>> 4.9. I18N/L10N Impact: >>> >>> The JDS team and the G11N are working together to evaluate and >>> provide I18N/L10N support. >>> 4.10. Packaging & Delivery: >>> >>> Adds new package, SUNWgftp >>> 4.11. Security Impact: >>> >>> gFTP uses OpenSSL library to encrypt the control and data >>> channels >>> for file transfer over HTTPS, and to encrypt the contol >>> channel for >>> FTPS. It creates socket BIO to handle SSL connections >>> transparently. >>> A handshake will be performed to verify server's certificate >>> after >>> the connection is established. The certificate verification >>> will be >>> with mode SSL_VERIFY_PEER and depth 9. It doesn't use the SSLv2 >>> protocol and the list of available ciphers will be set to >>> "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH". >>> >>> To support SSH protocol, gFTP uses ssh/sftp commands to >>> build up >>> connection with the server. The authentication information >>> will be >>> sent over the SSH connection. All the following requests and >>> responses >>> will go back and forth through this connection for secure >>> file transfer. >>> >>> gFTP uses socket to transfer file by FTP and HTTP protocol. The >>> password will be encoded with standard base64 for HTTP >>> authentication. >>> As for FTP authentication, the password will be sent in >>> plain text >>> through socket. >>> >>> gFTP includes a feature that allows user to save passwords. The >>> password will be saved in the gFTP profile directory. This will >>> create a potential security vulnerabilty because gFTP only >>> has very >>> primary encryption/decryption to make the stored passwords >>> unreadable. >>> Each character is separated in two nibbles. Then each nibble >>> is stored >>> under the form 01xxxx01. The resulted string is prefixed by >>> a '$'. >>> >>> e.12. Dependencies: >>> >>> The following versions of the imported interfaces are required: >>> >>> GNOME 2.22 Upwards >>> OpenSSL, SSH >>> >>> 5. Reference Documents: >>> >>> [1] gFTP homepage: >>> http://www.gftp.org >>> >>> [2] Related ARC cases: >>> LSARC 2008/207: GNOME 2.22 >>> PSARC/2006/019: OpenSSL upgrade to 0.9.8a >>> PSARC/2001/212: Secure Shell >>> >>> >>> 6. Resources and Schedule >>> 6.4. Steering Committee requested information >>> 6.4.1. Consolidation C-team Name: >>> Desktop >>> 6.5. ARC review type: FastTrack >>> 6.6. ARC Exposure: open >>> >>> >> >> > > From Irene.Huang@sun.com Sun Nov 23 20:37:31 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAO4bVGb010486 for ; Sun, 23 Nov 2008 20:37:31 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAO4bTXe006067 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Sun, 23 Nov 2008 20:37:31 -0800 (PST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAT00C01M6H2Q00@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.COM); Sun, 23 Nov 2008 21:37:29 -0700 (MST) Received: from sineb-mail-1.sun.com ([192.18.19.6]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAT00AO9M6GV8B0@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.COM); Sun, 23 Nov 2008 21:37:29 -0700 (MST) Received: from fe-apac-06.sun.com (fe-apac-06.sun.com [192.18.19.177] (may be forged)) by sineb-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id mAO4bRVI011198 for ; Mon, 24 Nov 2008 04:37:27 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0KAT00101LZNXH00@mail-apac.sun.com> (original mail from Irene.Huang@Sun.COM) for LSARC-ext@Sun.COM (ORCPT LSARC-ext@Sun.COM); Mon, 24 Nov 2008 12:37:27 +0800 (SGT) Received: from [129.158.217.225] by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0KAT00MURM6EVZZX@mail-apac.sun.com>; Mon, 24 Nov 2008 12:37:27 +0800 (SGT) Date: Mon, 24 Nov 2008 12:37:21 +0800 From: Irene Huang Subject: Re: Gftp for OpenSolaris [LSARC/2008/721 FastTrack timeout 11/25/2008] In-reply-to: <49266506.3030008@sun.com> Sender: Irene.Huang@sun.com To: Alfred Peng Cc: John.Fischer@sun.com, Shi-Ying Irene Huang , LSARC-ext@sun.com Message-id: <492A2F81.3000104@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200811190747.mAJ7l9BW002262@sac.sfbay.sun.com> <1227200829.51667.100.camel@sr1-umpk-16> <49266506.3030008@sun.com> User-Agent: Thunderbird 2.0.0.18 (Windows/20081105) Status: RO Content-Length: 7798 This case is due time out on 11/25, any further comments, please send an email before then. Thanks --Irene Alfred Peng wrote: > Hi John, > > The profile will be moved to $HOME/.gnome2/.gftp as GNOME community > hosts the source repository/bug tracking for gFTP. > > Best Regards, > -Alfred > > John Fischer wrote: >> Alfred, >> >> It would be real nice to have the .gftp configuration file in .gnome >> or some other directory instead of $HOME. When >> will the "Desktop base directory spec" be an approved Free >> Desktop specification? >> Thanks, >> >> John >> >> On Tue, 2008-11-18 at 23:47, Shi-Ying Irene Huang wrote: >> >>> Template Version: @(#)sac_nextcase %I% %G% SMI >>> This information is Copyright 2008 Sun Microsystems >>> 1. Introduction >>> 1.1. Project/Component Working Name: >>> Gftp for OpenSolaris >>> 1.2. Name of Document Author/Supplier: >>> Author: Alfred Peng >>> 1.3 Date of This Document: >>> 18 November, 2008 >>> 4. Technical Description >>> 1. Introduction >>> 1.1. Project/Component Working Name: >>> >>> gFTP: multithreaded file transfer client. >>> >>> 1.2. Name of Document Author/Supplier: >>> >>> Alfred Peng >>> >>> 1.3. Date of This Document: >>> >>> 11/04/08 >>> >>> 1.3.1. Date this project was conceived: >>> >>> 12/14/1997 >>> >>> 1.4. Name of Major Document Customer(s)/Consumer(s): >>> >>> 1.4.1. The PAC or CPT you expect to review your project: >>> >>> Solaris PAC >>> >>> 1.4.2. The ARC(s) you expect to review your project: >>> >>> LSARC >>> >>> 1.4.3. The Director/VP who is "Sponsoring" this project: >>> >>> robert.odea@sun.com >>> >>> 1.4.4. The name of your business unit: >>> >>> New Solaris Group, Desktop >>> >>> 1.5. Email Aliases: >>> >>> 1.5.1. Responsible Manager: >>> >>> leo.binchy@sun.com >>> >>> 1.5.2. Responsible Engineer: >>> >>> alfred.peng@sun.com >>> >>> 1.5.3. Marketing Manager: >>> >>> glynn.foster@sun.com >>> >>> 1.5.4. Interest List: >>> >>> desktop-discuss@opensolaris.org >>> >>> 4. Technical Description: >>> 4.1. Details: >>> gFTP is a multithreaded file transfer client for *NIX based >>> machines. >>> It has the following features: >>> >>> * Supports the FTP, FTPS (control connection only), HTTP, >>> HTTPS, SSH >>> and FSP protocols. >>> * FTP and HTTP proxy server support. >>> * Supports FXP file transfers which is a subset of FTP >>> protocol. >>> * Bookmarks menu to quickly connect to remote sites. >>> * Internationalized to 41 languages. >>> * Double-paned layout to show the local and remote filesystems. >>> * Transfer pane to show the real-time status of each queued >>> or active >>> file transfer. >>> * Log pane to display the text commands and responses >>> between gFTP >>> and the remote server. >>> >>> 4.2. Bug/RFE Number(s): >>> >>> None. >>> >>> 4.3. In Scope: >>> >>> See above. >>> >>> 4.4. Out of Scope: >>> >>> See above. >>> 4.5. Interfaces: >>> >>> Exported Interface >>> >>> -------------------------------------------------------------------- >>> Interface Name Classification >>> Comment >>> >>> -------------------------------------------------------------------- >>> SUNWgftp Uncommitted >>> Package name >>> /usr/bin/gftp Volatile >>> gFTP launch script >>> /usr/bin/gftp-gtk Volatile >>> gFTP GUI >>> /usr/bin/gftp-text Volatile >>> gFTP CLI >>> $HOME/.gftp Project Private >>> Profile >>> /usr/share/gftp Project Private >>> Directory >>> /usr/share/doc/SUNWgftp Project Private >>> Copyright directory >>> /usr/share/applications/gftp.desktop Volatile UI >>> spec >>> >>> >>> Imported Interface >>> >>> -------------------------------------------------------------------- >>> Interface Classification ARC case Comment >>> >>> -------------------------------------------------------------------- >>> GNOME Platform Committed LSARC/2008/207 GTK+ >>> library >>> Libraries GNOME 2.22 >>> SSH Committed PSARC/2001/212 >>> Secure Shell >>> OpenSSL Volatile PSARC/2006/019 >>> OpenSSL library >>> >>> 4.6. Doc Impact: >>> >>> New manpage, gftp.1. >>> 4.7. Admin/Config Impact: >>> >>> None. >>> 4.8. HA Impact: >>> >>> None. >>> 4.9. I18N/L10N Impact: >>> >>> The JDS team and the G11N are working together to evaluate and >>> provide I18N/L10N support. >>> 4.10. Packaging & Delivery: >>> >>> Adds new package, SUNWgftp >>> 4.11. Security Impact: >>> >>> gFTP uses OpenSSL library to encrypt the control and data >>> channels >>> for file transfer over HTTPS, and to encrypt the contol >>> channel for >>> FTPS. It creates socket BIO to handle SSL connections >>> transparently. >>> A handshake will be performed to verify server's certificate >>> after >>> the connection is established. The certificate verification >>> will be >>> with mode SSL_VERIFY_PEER and depth 9. It doesn't use the SSLv2 >>> protocol and the list of available ciphers will be set to >>> "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH". >>> >>> To support SSH protocol, gFTP uses ssh/sftp commands to >>> build up >>> connection with the server. The authentication information >>> will be >>> sent over the SSH connection. All the following requests and >>> responses >>> will go back and forth through this connection for secure >>> file transfer. >>> >>> gFTP uses socket to transfer file by FTP and HTTP protocol. The >>> password will be encoded with standard base64 for HTTP >>> authentication. >>> As for FTP authentication, the password will be sent in >>> plain text >>> through socket. >>> >>> gFTP includes a feature that allows user to save passwords. The >>> password will be saved in the gFTP profile directory. This will >>> create a potential security vulnerabilty because gFTP only >>> has very >>> primary encryption/decryption to make the stored passwords >>> unreadable. >>> Each character is separated in two nibbles. Then each nibble >>> is stored >>> under the form 01xxxx01. The resulted string is prefixed by >>> a '$'. >>> >>> e.12. Dependencies: >>> >>> The following versions of the imported interfaces are required: >>> >>> GNOME 2.22 Upwards >>> OpenSSL, SSH >>> >>> 5. Reference Documents: >>> >>> [1] gFTP homepage: >>> http://www.gftp.org >>> >>> [2] Related ARC cases: >>> LSARC 2008/207: GNOME 2.22 >>> PSARC/2006/019: OpenSSL upgrade to 0.9.8a >>> PSARC/2001/212: Secure Shell >>> >>> >>> 6. Resources and Schedule >>> 6.4. Steering Committee requested information >>> 6.4.1. Consolidation C-team Name: >>> Desktop >>> 6.5. ARC review type: FastTrack >>> 6.6. ARC Exposure: open >>> >>> >> >> > From Irene.Huang@sun.com Mon Nov 24 19:53:43 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id mAP3rhil005062 for ; Mon, 24 Nov 2008 19:53:43 -0800 (PST) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id mAP3rgba011890 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Mon, 24 Nov 2008 19:53:43 -0800 (PST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KAV00103ETINO00@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.COM); Mon, 24 Nov 2008 19:53:42 -0800 (PST) Received: from sineb-mail-1.sun.com ([192.18.19.6]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KAV00NHGETG1520@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.COM); Mon, 24 Nov 2008 19:53:41 -0800 (PST) Received: from fe-apac-05.sun.com (fe-apac-05.sun.com [192.18.19.176] (may be forged)) by sineb-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id mAP3rdoZ011209 for ; Tue, 25 Nov 2008 03:53:39 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0KAV00901EN97X00@mail-apac.sun.com> (original mail from Irene.Huang@Sun.COM) for LSARC-ext@Sun.COM (ORCPT LSARC-ext@Sun.COM); Tue, 25 Nov 2008 11:53:39 +0800 (SGT) Received: from [129.158.217.225] by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0KAV001KUETDGN97@mail-apac.sun.com>; Tue, 25 Nov 2008 11:53:39 +0800 (SGT) Date: Tue, 25 Nov 2008 11:53:33 +0800 From: Irene Huang Subject: Re: Gftp for OpenSolaris [LSARC/2008/721 FastTrack timeout 11/25/2008] In-reply-to: <492A2F81.3000104@sun.com> Sender: Irene.Huang@sun.com To: Irene Huang Cc: Alfred Peng , John.Fischer@sun.com, Shi-Ying Irene Huang , LSARC-ext@sun.com Message-id: <492B76BD.3030306@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200811190747.mAJ7l9BW002262@sac.sfbay.sun.com> <1227200829.51667.100.camel@sr1-umpk-16> <49266506.3030008@sun.com> <492A2F81.3000104@sun.com> User-Agent: Thunderbird 2.0.0.18 (Windows/20081105) Status: RO Content-Length: 8145 Closed as approved. Thanks --Irene Irene Huang wrote: > This case is due time out on 11/25, any further comments, please send > an email before then. > > Thanks > > --Irene > Alfred Peng wrote: >> Hi John, >> >> The profile will be moved to $HOME/.gnome2/.gftp as GNOME community >> hosts the source repository/bug tracking for gFTP. >> >> Best Regards, >> -Alfred >> >> John Fischer wrote: >>> Alfred, >>> >>> It would be real nice to have the .gftp configuration file in .gnome >>> or some other directory instead of $HOME. When >>> will the "Desktop base directory spec" be an approved Free >>> Desktop specification? Thanks, >>> >>> John >>> >>> On Tue, 2008-11-18 at 23:47, Shi-Ying Irene Huang wrote: >>> >>>> Template Version: @(#)sac_nextcase %I% %G% SMI >>>> This information is Copyright 2008 Sun Microsystems >>>> 1. Introduction >>>> 1.1. Project/Component Working Name: >>>> Gftp for OpenSolaris >>>> 1.2. Name of Document Author/Supplier: >>>> Author: Alfred Peng >>>> 1.3 Date of This Document: >>>> 18 November, 2008 >>>> 4. Technical Description >>>> 1. Introduction >>>> 1.1. Project/Component Working Name: >>>> >>>> gFTP: multithreaded file transfer client. >>>> >>>> 1.2. Name of Document Author/Supplier: >>>> >>>> Alfred Peng >>>> >>>> 1.3. Date of This Document: >>>> >>>> 11/04/08 >>>> >>>> 1.3.1. Date this project was conceived: >>>> >>>> 12/14/1997 >>>> >>>> 1.4. Name of Major Document Customer(s)/Consumer(s): >>>> >>>> 1.4.1. The PAC or CPT you expect to review your project: >>>> >>>> Solaris PAC >>>> >>>> 1.4.2. The ARC(s) you expect to review your project: >>>> >>>> LSARC >>>> >>>> 1.4.3. The Director/VP who is "Sponsoring" this project: >>>> >>>> robert.odea@sun.com >>>> >>>> 1.4.4. The name of your business unit: >>>> >>>> New Solaris Group, Desktop >>>> >>>> 1.5. Email Aliases: >>>> >>>> 1.5.1. Responsible Manager: >>>> >>>> leo.binchy@sun.com >>>> >>>> 1.5.2. Responsible Engineer: >>>> >>>> alfred.peng@sun.com >>>> >>>> 1.5.3. Marketing Manager: >>>> >>>> glynn.foster@sun.com >>>> >>>> 1.5.4. Interest List: >>>> >>>> desktop-discuss@opensolaris.org >>>> >>>> 4. Technical Description: >>>> 4.1. Details: >>>> gFTP is a multithreaded file transfer client for *NIX based >>>> machines. >>>> It has the following features: >>>> >>>> * Supports the FTP, FTPS (control connection only), HTTP, >>>> HTTPS, SSH >>>> and FSP protocols. >>>> * FTP and HTTP proxy server support. >>>> * Supports FXP file transfers which is a subset of FTP >>>> protocol. >>>> * Bookmarks menu to quickly connect to remote sites. >>>> * Internationalized to 41 languages. >>>> * Double-paned layout to show the local and remote >>>> filesystems. >>>> * Transfer pane to show the real-time status of each queued >>>> or active >>>> file transfer. >>>> * Log pane to display the text commands and responses >>>> between gFTP >>>> and the remote server. >>>> >>>> 4.2. Bug/RFE Number(s): >>>> >>>> None. >>>> >>>> 4.3. In Scope: >>>> >>>> See above. >>>> >>>> 4.4. Out of Scope: >>>> >>>> See above. >>>> 4.5. Interfaces: >>>> >>>> Exported Interface >>>> >>>> -------------------------------------------------------------------- >>>> Interface Name Classification >>>> Comment >>>> >>>> -------------------------------------------------------------------- >>>> SUNWgftp Uncommitted >>>> Package name >>>> /usr/bin/gftp Volatile >>>> gFTP launch script >>>> /usr/bin/gftp-gtk Volatile >>>> gFTP GUI >>>> /usr/bin/gftp-text Volatile >>>> gFTP CLI >>>> $HOME/.gftp Project Private >>>> Profile >>>> /usr/share/gftp Project Private >>>> Directory >>>> /usr/share/doc/SUNWgftp Project Private >>>> Copyright directory >>>> /usr/share/applications/gftp.desktop Volatile >>>> UI spec >>>> >>>> >>>> Imported Interface >>>> >>>> -------------------------------------------------------------------- >>>> Interface Classification ARC case Comment >>>> >>>> -------------------------------------------------------------------- >>>> GNOME Platform Committed LSARC/2008/207 GTK+ >>>> library >>>> Libraries GNOME 2.22 >>>> SSH Committed PSARC/2001/212 >>>> Secure Shell >>>> OpenSSL Volatile PSARC/2006/019 >>>> OpenSSL library >>>> >>>> 4.6. Doc Impact: >>>> >>>> New manpage, gftp.1. >>>> 4.7. Admin/Config Impact: >>>> >>>> None. >>>> 4.8. HA Impact: >>>> >>>> None. >>>> 4.9. I18N/L10N Impact: >>>> >>>> The JDS team and the G11N are working together to evaluate and >>>> provide I18N/L10N support. >>>> 4.10. Packaging & Delivery: >>>> >>>> Adds new package, SUNWgftp >>>> 4.11. Security Impact: >>>> >>>> gFTP uses OpenSSL library to encrypt the control and data >>>> channels >>>> for file transfer over HTTPS, and to encrypt the contol >>>> channel for >>>> FTPS. It creates socket BIO to handle SSL connections >>>> transparently. >>>> A handshake will be performed to verify server's >>>> certificate after >>>> the connection is established. The certificate verification >>>> will be >>>> with mode SSL_VERIFY_PEER and depth 9. It doesn't use the >>>> SSLv2 >>>> protocol and the list of available ciphers will be set to >>>> "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH". >>>> >>>> To support SSH protocol, gFTP uses ssh/sftp commands to >>>> build up >>>> connection with the server. The authentication information >>>> will be >>>> sent over the SSH connection. All the following requests >>>> and responses >>>> will go back and forth through this connection for secure >>>> file transfer. >>>> >>>> gFTP uses socket to transfer file by FTP and HTTP protocol. >>>> The >>>> password will be encoded with standard base64 for HTTP >>>> authentication. >>>> As for FTP authentication, the password will be sent in >>>> plain text >>>> through socket. >>>> >>>> gFTP includes a feature that allows user to save passwords. >>>> The >>>> password will be saved in the gFTP profile directory. This >>>> will >>>> create a potential security vulnerabilty because gFTP only >>>> has very >>>> primary encryption/decryption to make the stored passwords >>>> unreadable. >>>> Each character is separated in two nibbles. Then each >>>> nibble is stored >>>> under the form 01xxxx01. The resulted string is prefixed by >>>> a '$'. >>>> >>>> e.12. Dependencies: >>>> >>>> The following versions of the imported interfaces are >>>> required: >>>> >>>> GNOME 2.22 Upwards >>>> OpenSSL, SSH >>>> >>>> 5. Reference Documents: >>>> >>>> [1] gFTP homepage: >>>> http://www.gftp.org >>>> >>>> [2] Related ARC cases: >>>> LSARC 2008/207: GNOME 2.22 >>>> PSARC/2006/019: OpenSSL upgrade to 0.9.8a >>>> PSARC/2001/212: Secure Shell >>>> >>>> >>>> 6. Resources and Schedule >>>> 6.4. Steering Committee requested information >>>> 6.4.1. Consolidation C-team Name: >>>> Desktop >>>> 6.5. ARC review type: FastTrack >>>> 6.6. ARC Exposure: open >>>> >>>> >>> >>> >> >