GSTP

Good Secure Transfer Protocol

News

2003-02-19 - Gestapo 0.5 released

Version 0.5 of Gestapo is released to the public, this release includes win32 binaries of QSTP. Get it from our SourceForge page here.

Contents

• What is GSTP?
• Features
• Why not FTP/HTTP/other?
• Implementation
• Download
• BitKeeper
• Contact

What is GSTP?

Good Secure Transfer Protocol is a binary file transfer protocol that focuses on security and anonymousity. It tries to do right, where FTP does wrong, especially when it comes to firewall and user/password security.

Features

• Encryption The connection between the GSTP client and server uses the TLS/SSL protocol, which means that it is encrypted. This does not add any significant bandwidth overhead, but does impose a CPU hit on the involved hosts. The encryption can be lowered or turned off (using a NULL crypto) after the user has logged in, which decreases the CPU usage.
• Single TCP connection Only one TCP connection is established between the client and server. With this connection you can asynchronously upload and download any number of files, while simultaneously listing directories or using any of the other GSTP commands. This has a number of advantages, including low latency for directory listings, file upload/downloads and CPU usage on the server.
• Virtual hosts The GSTP protocol has full support for virtual hosts. The client establishes which virtual host he wants to login to with the hello command, similar to the Host: request in the HTTP/1.1 protocol.
• ChecksumsThe checksum command makes the server calculate the checksum on a remote file. The client can use this to verify if a download was successful without file corruption, or to see if a local file is identical to a remote file (similar to unix diff(1))
• Locating files The locate command works similar to the unix find(1) or locate(1) command, and is very useful when a user wants to search the server for a specific file.
• Check filesystem usage The avail command can be used to check how much free space is available in a certain directory. This will let the client know whether a upload will fit.
• Feature compabilities The capabilities command describes what features are implemented and enabled on the server.

Why not FTP/HTTP or any other file transfer protocol?

Simply, they suck.

FTP: The guy who invented this protocol is probably dead, becouse this is how old this protocol and design is. FTP is not friendly with NAT and firewall, it is high latency (even listing directories needs to open a new connection) and NOT secure! (yes I know that ftp-ssl is availble, but HOW many uses that REALLY?).
Not to mention the numerous exploits found in the ftp server implementations. Not all of these are FTP's fault, but some of them are due to the horribly inconsistent and vague FTP protocol.

HTTP: HTTP is NOT a file transfer protocol, you can't really upload files in a nice way, and it is not designed for listing catalogs or login and more. It is really no use to compare GSTP with HTTP. Plus the guys that developed HTTP/1.1 has a very little feeling for SMALL protocol, a more bloated RFC you really have to look for.

SCP / SFTP: The openssh / ssh implementation allows secure transfers, but come on, this is not meant for file transfers either.

Implementation

Read our "rfc" gstp.txt. If you want to develop your own implementation of GSTP, you've got the whole protocol documented in the above specification. It's easy to learn yet has all the features you need in a file transfer protocol. There is also a reference implementation called Gestapo, and a QT GUI client called QSTP that you can look at.

The Gestapo distribution has a library that makes creation of your own implementation even more easy.

Download

Download our releases at our sourceforge page, http://sourceforge.net/projects/gstp.

For you who is running Debian GNU/Linux (unstable) you can add this to your sources.list:
deb ftp://solitude.tobi.nu unstable main.

Bitkeeper

For more bleeding egde you can use bitkeeper to access our development version, do
bk clone bk://debian.as:5555/gstp gstp

Contact

Main programmers are Tobias Rundström and Alexander Haväng.