[pure-ftpd] [Resend] SPSV command and missing extended_master_secret extenstion in ServerHello

Hi,

there doesn't seem to be an archive of this list so I might ask
duplicates here. Sorry in advance if that's the case. Also, I've sent
this email to the list a month ago and never showed up in my inbox, so
if that mail already appeared and this is (yet another) duplicate, please
excuse that as well.

The simple question (I suppose) first: What is the SPSV-command shown in the
feature list of a pureftp-server? I only know
https://www.ietf.org/archive/id/draft-rosenau-ftp-single-port-05.txt
and the behavior of pureftp is clearly not conforming to this "standard".
It's essentially EPSV and just returning the port number.

Another more serious issue is the fact that when doing a TLS-handshake,
pureftp's ServerHello lacks the Extension extended_master_secret as
defined in https://tools.ietf.org/html/rfc7627

This prevents Java based FTP-clients that use the JVM's JSSE from
creating secured data connections unless you globally switch off
the check for this extension (which is - as far as I understand it -
an important security feature to prevent MITM-attacks).

Is it possible to support this extension? If not, it might be good
to add some comment in the documentation that Java based FTP-clients
won't work with pureftp until they set the System Property
-Djdk.tls.allowUnsafeServerCertChange=true
that will globally turn off that security feature in that particular
Java application affecting all other TLS-based communication that
might take place (SMTPS, IMAPS, you name it).


Thanks and best regards,

Lothar Kimmeringer