Path: utzoo!utgpu!utstat!jarvis.csri.toronto.edu!mailrus!tut.cis.ohio-state.edu!ucbvax!ulysses!smb
From: smb@ulysses.homer.nj.att.com (Steven M. Bellovin)
Newsgroups: comp.protocols.tcp-ip
Subject: Re: (none)
Message-ID: <12338@ulysses.homer.nj.att.com>
Date: 30 Oct 89 22:26:46 GMT
References: <8910290319.AA16276@ucbvax.Berkeley.EDU> <7752@ditmela.oz>
Organization: AT&T Bell Laboratories, Murray Hill
Lines: 41

The FTP protocol does not need to be enhanced.  However, Berkeley's
implementation needs to be fixed up a bit.

The basic functionality is provided by the STOU command.  That means
``store unique''; the FTP server picks a name, and tells you about it.
There is, in principle, no reason why an operating system can't have
an ``append-only'' directory; using it, FTP would not let you remove
a file, and the use of STOU would guarantee uniqueness.  You avoid
people overwriting files in it by not letting them list the directory;
that way, they'll have no knowledge of the filenames present.
Remember that these can be arbitrarily weird; there's no reason
why the ftp server can't run random dictionary words through makekey
or some such.

Sending to a user, then, could be as simple as:

	ftp dest-host
	cd incoming-directory
	stou >xxx
	quit
	mail user@dest-host <xxx

Note, incidentally, that Berkeley has implemented STOU incorrectly, at
least as of the versions of ftpd I have here (a post-worm version, a
new one from, I think, Rick Adams, plus SunOS 4.0.3) require that the
STOU command have an operand.  This contradicts RFC 959.  There is a
second error, more understandable; the host requirements RFC corrects
an error in 959 about how the unique file name should be announced.
The RFC says on the 250 message; that is corrected to either the
126 message or the 150 message.  (Of course, Berkeley is using 226,
but I suppose we can forgive that.)

Still, despite these deficiencies, you can approximate the proper
server on UNIX systems.  Create a mode 733 directory under ~ftp.  Folks
who have broken FTP commands (i.e., ones that generate operands on the
STOU command) can issue the local subcommand ``sunique'' to condition
their clients to send STOU instead of STOR, and send files to their
hearts' content.  Clever administrators will fix the reply message for
the 150 message to have a conforming file name, and will accept valid
STOU commands as well as broken ones.  The latter will force ftpd to
generate real unique file names, too.