square / certigo

A utility to examine and validate certificates in a variety of formats
Apache License 2.0
943 stars 70 forks source link

Add support for implicit FTPS #323

Open liangliangliangtan opened 1 year ago

liangliangliangtan commented 1 year ago

Problem Scenario

In #https://github.com/square/certigo/issues/120, there is a side note that FTPS can be implicit/explicit. In this Pull Request, implicit FTPS will be supported. In implicit SSL mode, a SSL handshake is initiated on connection. After the completion of a successful SSL handshake, the FTPS server will response with status code 220, which indicates that the server is ready for the new client.

An Implicit FTPS connection example with curl command:

curl -vv -k -u ftps://<ip/domain> --cert --key

  • Trying xxxx:990...
  • TCP_NODELAY set
  • Connected to xxxx port 990 (#0)
  • successfully set certificate verify locations:
  • CAfile: /etc/ssl/certs/ca-certificates.crt CApath: /etc/ssl/certs
  • TLSv1.3 (OUT), TLS handshake, Client hello (1):
  • TLSv1.3 (IN), TLS handshake, Server hello (2):
  • TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
  • TLSv1.3 (IN), TLS handshake, Request CERT (13):
  • TLSv1.3 (IN), TLS handshake, Certificate (11):
  • TLSv1.3 (IN), TLS handshake, CERT verify (15):
  • TLSv1.3 (IN), TLS handshake, Finished (20):
  • TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
  • TLSv1.3 (OUT), TLS handshake, Certificate (11):
  • TLSv1.3 (OUT), TLS handshake, CERT verify (15):
  • TLSv1.3 (OUT), TLS handshake, Finished (20):
  • SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
  • Server certificate: *xxxx
  • TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
  • TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
  • old SSL session ID is stale, removing < 220 Welcome to FTP service.

Implementation

In CLI part, add a starttls method called "ftps". In ftp.go file, add a indicator in the function and in order to compatible with existing explicit FTP, changes are as follows:

CLAassistant commented 1 year ago

CLA assistant check
All committers have signed the CLA.