Explicit TLS mode is implemented.

Partal implementation of RFC 4217 for controll and data connections

Author: notorca

cmd.go

@@ -40,7 +40,7 @@ var (
 		"ENC":  commandEnc{},
 		"EPRT": commandEprt{},
 		"EPSV": commandEpsv{},
-		//"FEAT": commandFeat{},
+		"FEAT": commandFeat{},
 		"LIST": commandList{},
 		"NLST": commandNlst{},
 		"MDTM": commandMdtm{},
@@ -175,6 +175,9 @@ func init() {
 }
 
 func (cmd commandFeat) Execute(conn *Conn, param string) {
+	if conn.tlsConfig != nil {
+		featCmds += " AUTH TLS\n PBSZ\n PROT\n"
+	}
 	conn.writeMessage(211, fmt.Sprintf(feats, featCmds))
 }
 
@@ -314,7 +317,7 @@ func (cmd commandEpsv) Execute(conn *Conn, param string) {
 		return
 	}
 
-	socket, err := newPassiveSocket(addr.String()[:lastIdx], conn.logger)
+	socket, err := newPassiveSocket(addr.String()[:lastIdx], conn.logger, conn.tlsConfig)
 	if err != nil {
 		log.Error(err)
 		conn.writeMessage(425, "Data connection failed")
@@ -595,7 +598,7 @@ func (cmd commandPasv) Execute(conn *Conn, param string) {
 		conn.writeMessage(425, "Data connection failed")
 		return
 	}
-	socket, err := newPassiveSocket(parts[0], conn.logger)
+	socket, err := newPassiveSocket(parts[0], conn.logger, conn.tlsConfig)
 	if err != nil {
 		conn.writeMessage(425, "Data connection failed")
 		return
@@ -853,7 +856,16 @@ func (cmd commandAuth) RequireAuth() bool {
 }
 
 func (cmd commandAuth) Execute(conn *Conn, param string) {
-	conn.writeMessage(550, "Action not taken")
+	log.Println(param, conn)
+	if param == "TLS" && conn.tlsConfig != nil {
+		conn.writeMessage(234, "AUTH command OK")
+		err := conn.upgradeToTls()
+		if err != nil {
+			conn.logger.Printf("Error upgrading conection to TLS %v", err)
+		}
+	} else {
+		conn.writeMessage(550, "Action not taken")
+	}
 }
 
 type commandCcc struct{}
@@ -925,7 +937,11 @@ func (cmd commandPbsz) RequireAuth() bool {
 }
 
 func (cmd commandPbsz) Execute(conn *Conn, param string) {
-	conn.writeMessage(550, "Action not taken")
+	if conn.tls && param == "0" {
+		conn.writeMessage(200, "OK")
+	} else {
+		conn.writeMessage(550, "Action not taken")
+	}
 }
 
 type commandProt struct{}
@@ -943,7 +959,13 @@ func (cmd commandProt) RequireAuth() bool {
 }
 
 func (cmd commandProt) Execute(conn *Conn, param string) {
-	conn.writeMessage(550, "Action not taken")
+	if conn.tls && param == "P" {
+		conn.writeMessage(200, "OK")
+	} else if conn.tls {
+		conn.writeMessage(536, "Only P level is supported")
+	} else {
+		conn.writeMessage(550, "Action not taken")
+	}
 }
 
 type commandConf struct{}

conn.go

@@ -4,6 +4,7 @@ import (
 	"bufio"
 	"crypto/rand"
 	"crypto/sha256"
+	"crypto/tls"
 	"encoding/hex"
 	"fmt"
 	"io"
@@ -26,6 +27,7 @@ type Conn struct {
 	auth          Auth
 	logger        *Logger
 	server        *Server
+	tlsConfig     *tls.Config
 	sessionId     string
 	namePrefix    string
 	reqUser       string
@@ -34,6 +36,7 @@ type Conn struct {
 	lastFilePos   int64
 	appendData    bool
 	closed        bool
+	tls           bool
 }
 
 func (conn *Conn) LoginUser() string {
@@ -97,6 +100,19 @@ func (conn *Conn) Close() {
 	}
 }
 
+func (Conn *Conn) upgradeToTls() error {
+	Conn.logger.Print("Upgrading connectiion to TLS")
+	tlsConn := tls.Server(Conn.conn, Conn.tlsConfig)
+	err := tlsConn.Handshake()
+	if err == nil {
+		Conn.conn = tlsConn
+		Conn.controlReader = bufio.NewReader(tlsConn)
+		Conn.controlWriter = bufio.NewWriter(tlsConn)
+		Conn.tls = true
+	}
+	return err
+}
+
 // receiveLine accepts a single line FTP command and co-ordinates an
 // appropriate response.
 func (Conn *Conn) receiveLine(line string) {

server.go

@@ -40,6 +40,9 @@ type ServerOpts struct {
 	// if tls used, key file is required
 	KeyFile string
 
+	// If ture TLS is used in RFC4217 mode
+	ExplicitFTPS bool
+
 	WelcomeMessage string
 }
 
@@ -54,6 +57,7 @@ type Server struct {
 	driverFactory DriverFactory
 	logger        *Logger
 	listener      net.Listener
+	tlsConfig     *tls.Config
 }
 
 // serverOptsWithDefaults copies an ServerOpts struct into a new struct,
@@ -93,6 +97,7 @@ func serverOptsWithDefaults(opts *ServerOpts) *ServerOpts {
 	newOpts.TLS = opts.TLS
 	newOpts.KeyFile = opts.KeyFile
 	newOpts.CertFile = opts.CertFile
+	newOpts.ExplicitFTPS = opts.ExplicitFTPS
 
 	return &newOpts
 }
@@ -129,17 +134,18 @@ func NewServer(opts *ServerOpts) *Server {
 // an active net.TCPConn. The TCP connection should already be open before
 // it is handed to this functions. driver is an instance of FTPDriver that
 // will handle all auth and persistence details.
-func (server *Server) newConn(tcpConn net.Conn, driver Driver, auth Auth) *Conn {
+func (server *Server) newConn(tcpConn net.Conn, driver Driver) *Conn {
 	c := new(Conn)
 	c.namePrefix = "/"
 	c.conn = tcpConn
 	c.controlReader = bufio.NewReader(tcpConn)
 	c.controlWriter = bufio.NewWriter(tcpConn)
 	c.driver = driver
-	c.auth = auth
+	c.auth = server.Auth
 	c.server = server
 	c.sessionId = newSessionId()
 	c.logger = newLogger(c.sessionId)
+	c.tlsConfig = server.tlsConfig
 	driver.Init(c)
 	return c
 }
@@ -172,13 +178,16 @@ func (Server *Server) ListenAndServe() error {
 	var err error
 
 	if Server.ServerOpts.TLS {
-		var config *tls.Config
-		config, err = simpleTLSConfig(Server.CertFile, Server.KeyFile)
+		Server.tlsConfig, err = simpleTLSConfig(Server.CertFile, Server.KeyFile)
 		if err != nil {
 			return err
 		}
 
-		listener, err = tls.Listen("tcp", Server.listenTo, config)
+		if Server.ServerOpts.ExplicitFTPS {
+			listener, err = net.Listen("tcp", Server.listenTo)
+		} else {
+			listener, err = tls.Listen("tcp", Server.listenTo, Server.tlsConfig)
+		}
 	} else {
 		listener, err = net.Listen("tcp", Server.listenTo)
 	}
@@ -200,7 +209,7 @@ func (Server *Server) ListenAndServe() error {
 			Server.logger.Printf("Error creating driver, aborting client connection: %v", err)
 			tcpConn.Close()
 		} else {
-			ftpConn := Server.newConn(tcpConn, driver, Server.Auth)
+			ftpConn := Server.newConn(tcpConn, driver)
 			go ftpConn.Serve()
 		}
 	}

socket.go

@@ -1,6 +1,7 @@
 package server
 
 import (
+	"crypto/tls"
 	"errors"
 	"net"
 	"strconv"
@@ -74,16 +75,17 @@ func (socket *ftpActiveSocket) Close() error {
 }
 
 type ftpPassiveSocket struct {
-	conn    *net.TCPConn
-	port    int
-	host    string
-	ingress chan []byte
-	egress  chan []byte
-	logger  *Logger
-	wg      sync.WaitGroup
+	conn       net.Conn
+	port       int
+	host       string
+	ingress    chan []byte
+	egress     chan []byte
+	logger     *Logger
+	wg         sync.WaitGroup
+	tlsConfing *tls.Config
 }
 
-func newPassiveSocket(host string, logger *Logger) (DataSocket, error) {
+func newPassiveSocket(host string, logger *Logger, tlsConfing *tls.Config) (DataSocket, error) {
 	socket := new(ftpPassiveSocket)
 	socket.ingress = make(chan []byte)
 	socket.egress = make(chan []byte)
@@ -131,11 +133,14 @@ func (socket *ftpPassiveSocket) GoListenAndServe() (err error) {
 		socket.logger.Print(err)
 		return
 	}
-	listener, err := net.ListenTCP("tcp", laddr)
+
+	var listener net.Listener
+	listener, err = net.ListenTCP("tcp", laddr)
 	if err != nil {
 		socket.logger.Print(err)
 		return
 	}
+
 	add := listener.Addr()
 	parts := strings.Split(add.String(), ":")
 	port, err := strconv.Atoi(parts[len(parts)-1])
@@ -146,14 +151,19 @@ func (socket *ftpPassiveSocket) GoListenAndServe() (err error) {
 
 	socket.port = port
 	socket.wg.Add(1)
+
+	if socket.tlsConfing != nil {
+		listener = tls.NewListener(listener, socket.tlsConfing)
+	}
+
 	go func() {
-		tcpConn, err := listener.AcceptTCP()
+		conn, err := listener.Accept()
 		socket.wg.Done()
 		if err != nil {
 			socket.logger.Print(err)
 			return
 		}
-		socket.conn = tcpConn
+		socket.conn = conn
 	}()
 	return nil
 }