certigo icon indicating copy to clipboard operation
certigo copied to clipboard

Add support for implicit FTPS

Open liangliangliangtan opened this issue 9 months ago • 1 comments

Problem Scenario

In #https://github.com/square/certigo/issues/120, there is a side note that FTPS can be implicit/explicit. In this Pull Request, implicit FTPS will be supported. In implicit SSL mode, a SSL handshake is initiated on connection. After the completion of a successful SSL handshake, the FTPS server will response with status code 220, which indicates that the server is ready for the new client.

An Implicit FTPS connection example with curl command:

curl -vv -k -u <username: password> ftps://<ip/domain> --cert <your_cert> --key <your_key>

  • Trying xxxx:990...
  • TCP_NODELAY set
  • Connected to xxxx port 990 (#0)
  • successfully set certificate verify locations:
  • CAfile: /etc/ssl/certs/ca-certificates.crt CApath: /etc/ssl/certs
  • TLSv1.3 (OUT), TLS handshake, Client hello (1):
  • TLSv1.3 (IN), TLS handshake, Server hello (2):
  • TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
  • TLSv1.3 (IN), TLS handshake, Request CERT (13):
  • TLSv1.3 (IN), TLS handshake, Certificate (11):
  • TLSv1.3 (IN), TLS handshake, CERT verify (15):
  • TLSv1.3 (IN), TLS handshake, Finished (20):
  • TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
  • TLSv1.3 (OUT), TLS handshake, Certificate (11):
  • TLSv1.3 (OUT), TLS handshake, CERT verify (15):
  • TLSv1.3 (OUT), TLS handshake, Finished (20):
  • SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
  • Server certificate: *xxxx
  • TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
  • TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
  • old SSL session ID is stale, removing < 220 Welcome to FTP service.

Implementation

In CLI part, add a starttls method called "ftps". In ftp.go file, add a indicator in the function and in order to compatible with existing explicit FTP, changes are as follows:

  • Create a struct FTPCtx with both TCP and TLS network connection.
  • Change the input parameter type of readFTP function from *net.TCPConn to interface net.Conn
  • Refactor the code by creating checkServiceReady and authTLS function.

liangliangliangtan avatar Oct 02 '23 18:10 liangliangliangtan