c# - 可以使用 FileZilla 或 WinSCP 连接到 FTP，但不能使用 FtpWebRequest 或 FluentFTP

Question

我试图在我的代码中通过 SSL 打开一个 FTP 连接。我可以使用 WinSCP 的 FileZilla 连接并列出目录。但是当使用 FtpWebClient 通过 .NET 代码列出目录时，我得到错误

(425) Can't open data connection

由于我可以在同一台计算机上使用 FileZilla 进行连接，因此我不确定如何解决此问题。
这是我的代码

public void FtpStuff()
{
   string url = "ftp://my.server.com";

   FtpWebRequest request = (FtpWebRequest)WebRequest.Create(url);
   request.Credentials = new NetworkCredential("myname", "password");
   request.EnableSsl = true;
   request.Method = WebRequestMethods.Ftp.ListDirectory;
   FtpWebResponse response = (FtpWebResponse)request.GetResponse();
   StreamReader streamReader = new StreamReader(response.GetResponseStream());

   // This is the line that throws the exception
   string line = streamReader.ReadLine();
}

我也试过 FluentFTP。这是我的代码。我得到了异常(exception)

Unable to build data connection: Operation not permitted.

public void FtpStuff()
{
   FtpClient client = new FtpClient();
   client.Host = "my.server.com";
   client.Credentials = new NetworkCredential("myname", "password");
   client.EncryptionMode = FtpEncryptionMode.Explicit;
   client.Connect();

   // This line gives me an exception.
   var files = client.GetListing();
}

这是来自 FluentFTP 的日志记录信息。我更改了真实的用户名和IP，但其余数据(包括端口)是真实数据。我的 FTP 服务提供商指定我必须连接端口 21。问题似乎发生在 EPSV 之后。发出命令并在新端口上建立连接。

# Connect()
The thread 0x5514 has exited with code 0 (0x0).
The thread 0xc80 has exited with code 0 (0x0).
The thread 0x89d4 has exited with code 0 (0x0).
Status:   Connecting to 123.123.123.123:21
Response: 220 FTP Server Ready
Command:  AUTH TLS
Response: 234 AUTH TLS successful
Status:   FTPS Authentication Successful
Status:   Time to activate encryption: 0h 0m 0s.  Total Seconds: 0.1339995.
Command:  USER me@mysite.com
The thread 0x6ddc has exited with code 0 (0x0).
Response: 331 Password required for me@mysite.com
Status:   Testing connectivity using Socket.Poll()...
Command:  PASS ***
Response: 230-***************************************************************************
Response: NOTICE TO USERS
Response: This computer system is private property. It is for authorized use only.
Response: Users (authorized or unauthorized) have no explicit or implicit
Response: expectation of privacy.
Response: 
Response: Any or all uses of this system and all files on this system may be
Response: intercepted, monitored, recorded, copied, audited and inspected by
Response: using this system, the user consents to such interception, monitoring,
Response: recording, copying, auditing, inspection, and disclosure at the
Response: discretion of such personnel or officials.  Unauthorized or improper use
Response: of this system may result in civil and criminal penalties and
Response: administrative or disciplinary action, as appropriate. By continuing to
Response: use this system you indicate your awareness of and consent to these terms
Response: and conditions of use. LOG OFF IMMEDIATELY if you do not agree to the
Response: conditions stated in this warning.
Response: ****************************************************************************
Response: 230 User me@mysite.com logged in
Command:  PBSZ 0
Response: 200 PBSZ 0 successful
Command:  PROT P
Response: 200 Protection set to Private
Command:  FEAT
Response: 211-Features:
Response: AUTH TLS
Response: CCC
Response: CLNT
Response: EPRT
Response: EPSV
Response: HOST
Response: MDTM
Response: MFF modify;UNIX.group;UNIX.mode;
Response: MFMT
Response: MLST modify*;perm*;size*;type*;unique*;UNIX.group*;UNIX.groupname*;UNIX.mode*;UNIX.owner*;UNIX.ownername*;
Response: PBSZ
Response: PROT
Response: REST STREAM
Response: SIZE
Response: SSCN
Response: TVFS
Response: 211 End
Status:   Text encoding: System.Text.ASCIIEncoding
Command:  SYST
Response: 215 UNIX Type: L8

# GetListing(null, Auto)

# GetWorkingDirectory()
Command:  PWD
Response: 257 "/" is the current directory
Command:  TYPE I
Response: 200 Type set to I

# OpenPassiveDataStream(AutoPassive, "MLSD /", 0)
Command:  EPSV
Response: 229 Entering Extended Passive Mode (|||50304|)
Status:   Connecting to 123.123.123.123:50304
Command:  MLSD /
Response: 150 Opening BINARY mode data connection for MLSD
Status:   FTPS Authentication Successful
Status:   Time to activate encryption: 0h 0m 0s.  Total Seconds: 0.1210002.
+---------------------------------------+
-----------------------------------------
Status:   Disposing FtpSocketStream...

# CloseDataStream()
Response: 425 Unable to build data connection: Operation not permitted
Status:   Disposing FtpSocketStream...
Exception thrown: 'FluentFTP.FtpCommandException' in FluentFTP.dll

这是我的 FileZilla 日志。

Status: Resolving address of mysite.com
Status: Connecting to 123.123.123.123:21...
Status: Connection established, waiting for welcome message...
Response:   220 FTP Server Ready
Command:    AUTH TLS
Response:   234 AUTH TLS successful
Status: Initializing TLS...
Status: Verifying certificate...
Status: TLS connection established.
Command:    USER me@mysite.com
Response:   331 Password required for me@mysite.com
Command:    PASS ************
Response:   230-***************************************************************************
Response:                                NOTICE TO USERS
Response:    This computer system is private property. It is for authorized use only.
Response:    Users (authorized or unauthorized) have no explicit or implicit
Response:    expectation of privacy.
Response:    
Response:    Any or all uses of this system and all files on this system may be
Response:    intercepted, monitored, recorded, copied, audited and inspected by
Response:    using this system, the user consents to such interception, monitoring,
Response:    recording, copying, auditing, inspection, and disclosure at the
Response:    discretion of such personnel or officials.  Unauthorized or improper use
Response:    of this system may result in civil and criminal penalties and
Response:    administrative or disciplinary action, as appropriate. By continuing to
Response:    use this system you indicate your awareness of and consent to these terms
Response:    and conditions of use. LOG OFF IMMEDIATELY if you do not agree to the
Response:    conditions stated in this warning.
Response:    ****************************************************************************
Response:   230 User me@mysite.com logged in
Command:    SYST
Response:   215 UNIX Type: L8
Command:    FEAT
Response:   211-Features:
Response:    AUTH TLS
Response:    CCC
Response:    CLNT
Response:    EPRT
Response:    EPSV
Response:    HOST
Response:    MDTM
Response:    MFF modify;UNIX.group;UNIX.mode;
Response:    MFMT
Response:    MLST modify*;perm*;size*;type*;unique*;UNIX.group*;UNIX.groupname*;UNIX.mode*;UNIX.owner*;UNIX.ownername*;
Response:    PBSZ
Response:    PROT
Response:    REST STREAM
Response:    SIZE
Response:    SSCN
Response:    TVFS
Response:   211 End
Status: Server does not support non-ASCII characters.
Command:    PBSZ 0
Response:   200 PBSZ 0 successful
Command:    PROT P
Response:   200 Protection set to Private
Status: Logged in
Status: Retrieving directory listing...
Command:    PWD
Response:   257 "/" is the current directory
Command:    TYPE I
Response:   200 Type set to I
Command:    PASV
Response:   227 Entering Passive Mode (123,123,123,123,197,68).
Command:    MLSD
Response:   150 Opening BINARY mode data connection for MLSD
Response:   226 Transfer complete
Status: Directory listing of "/" successful

我也可以使用 WinSCP 进行连接。正如评论中所建议的，我确实在打开数据连接时检查了是否重用了 TLS/SSL session ID。似乎是这样。

227 Entering Passive Mode (???)
MLSD
Connecting to ??? ...
Connection pending
Data connection opened
Trying reuse main TLS session ID
Session ID reused
150 Opening data channel for directory listing of "/"

Answer 1

.NET 框架不支持 TLS/SSL session 重用。如果您的服务器需要它(它看起来是什么，现在很常见，什么对安全有好处)，您不能使用 FtpWebRequest也不是 FluentFTP。两者都使用 TLS/SSL 的 .NET 实现。
您将不得不使用使用自己的 TLS/SSL 实现的 FTP 库。
你可以使用我的WinSCP .NET assembly .尽管与 FluentFTP 不同，它不是原生 .NET 库，它依赖于外部二进制文件。但这就是使它起作用的原因。
一些引用资料:

https://github.com/robinrodricks/FluentFTP/issues/347

https://github.com/dotnet/runtime/issues/27916

"Authentication failed because the remote party has closed the transport stream" when transferring to/from FTP server over TLS/SSL using FluentFTP

Upload file to implicit FTPS server in C# with TLS session reuse

Suddenly getting "150 Opening Data channel for file download from server" after the FTP downloads was working for years – 根据这篇文章和其他地方的其他引用资料，.NET Framework 较早支持 TLS/SSL session 重用，但一些更新破坏了它。在 .NET Core 中，它从未工作过(另请参阅上面的 dotnet GitHub 链接)。