Why is Windows 7 firewall preventing PASV FTP connections?

Question

I was trying to get CFtpServer's first example program running on a Windows 7 Pro, x64 system. After much beating around the bush and not believing what I was seeing, I got the problem down to the following simple program:

#include <iostream>
using namespace std;

#include <windows.h>
#include <winsock2.h>
#include <ws2tcpip.h>
#include <stdio.h>


#define die(code) { cerr << "die at " << __FILE__ << " " << __LINE__ << " "; exit(code); }

int main(int argc, char **argv)
{
    short port = 21;

    if (argc == 2) {
        port = atoi(argv[1]);
    }

    WSADATA WSAData;
    if ( WSAStartup( MAKEWORD(2, 2), &WSAData) != 0)
        die(1);

    SOCKET ls = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);//!!! proto 0 in ftpdmin!
    if (ls == INVALID_SOCKET) die(1);

    struct sockaddr_in sin;
    sin.sin_family = AF_INET;
    sin.sin_addr.s_addr = INADDR_ANY;
    sin.sin_port = htons( port );

    if (bind( ls, (struct sockaddr *) &sin, sizeof( struct sockaddr_in ) )
            == SOCKET_ERROR) die(2);

    if (listen( ls, 1 ) == SOCKET_ERROR ) //!!! backlog 1 in ftpdmin!
        die(3);


    // wait for connect, transmit till error
    SOCKET ts;
    for( ;; ) {
        ts = accept( ls, NULL, NULL );
        if (ts == INVALID_SOCKET) die(5);

        // now write some things to that socket.
        int i=0;
        for(;;) {
            char buf[256];
            sprintf(buf, "%d Testing...\r\n",i+224);
            if (send(ts, buf, strlen(buf), 0) < 0) {
                DWORD err = WSAGetLastError();
                cerr << "send failed with " << err << endl;
                break;
            }
            Sleep(1000);
            i = (i+1)%10;
        }

        Sleep(1000);
        closesocket(ts);
    }
}

This program opens the specified socket, listens on it for connections. When it gets a connection, it proceeds to write strings that bear a passing resemblance to the string an FTP server might use to respond to the PASV command. It will keep transmitting strings, once a second, until something goes wrong.

On my system, connecting to this 'server' using the nc.exe command, I see a few strings, then the socket will close (the error printed by the 'server' is 10053).

If I disabled the Windows firewall, I see strings as long as I care to leave the nc command running.

I've seen two different variations, and I don't know what causes the difference: Sometimes it would stop when it transmitted the string '227 ', later it started dying on '229 '. It's giving every appearance of being sensitive to the text being sent.

Answer 1

After 3 days of beating my head on this one, I have an answer: Window KB2754804. It's a bug, known to MS since somewhere in 2011. There is a Hotfix in the referenced Knowledge base article, but it doesn't seem to work for my tests, so I had to take the alternative route of disabling the Stateful FTP firewall.

I finally got to the KB article, from this SO entry.