Merge pull request srvrco#783 from timkimber/fix-ftps-ftpes-tests

Add FTP_PORT
MRigal · Nov 1, 2022 · 48606be · 48606be
2 parents 0abbf94 + dc13594
commit 48606be
Show file tree

Hide file tree

Showing 6 changed files with 344 additions and 14 deletions.
diff --git a/getssl b/getssl
@@ -319,6 +319,7 @@ DUAL_RSA_ECDSA="false"
 FTP_OPTIONS=""
 FTPS_OPTIONS=""
 FTP_ARGS=""
+FTP_PORT=""
 FULL_CHAIN_INCLUDE_ROOT="false"
 GETSSL_IGNORE_CP_PRESERVE="false"
 HTTP_TOKEN_CHECK_WAIT=0
@@ -1013,15 +1014,15 @@ copy_file_to_location() { # copies a file, using scp, sftp or ftp if required.
  ftpfile=$(basename "$ftplocn")
  fromdir=$(dirname "$from")
  fromfile=$(basename "$from")
- debug "ftp user=$ftpuser - pass=$ftppass - host=$ftphost dir=$ftpdirn file=$ftpfile"
+ debug "ftp user=$ftpuser - pass=$ftppass - host=$ftphost port=$FTP_PORT dir=$ftpdirn file=$ftpfile"
  debug "from dir=$fromdir file=$fromfile"
  if [ -n "$FTP_OPTIONS" ]; then
  # Use eval to expand any variables in FTP_OPTIONS
  FTP_OPTIONS=$(eval echo "$FTP_OPTIONS")
  debug "FTP_OPTIONS=$FTP_OPTIONS"
  fi
  $FTP_COMMAND <<- _EOF
- open $ftphost
+ open $ftphost $FTP_PORT
  user $ftpuser $ftppass
  $FTP_OPTIONS
  cd $ftpdirn
@@ -1038,10 +1039,11 @@ copy_file_to_location() { # copies a file, using scp, sftp or ftp if required.
  ftpfile=$(basename "$ftplocn")
  fromdir=$(dirname "$from")
  fromfile=$(basename "$from")
- debug "sftp $SFTP_OPTS user=$ftpuser - pass=$ftppass - host=$ftphost dir=$ftpdirn file=$ftpfile"
+ if [ -n "$FTP_PORT" ]; then SFTP_PORT="-P $FTP_PORT"; else SFTP_PORT=""; fi
+ debug "sftp $SFTP_OPTS user=$ftpuser - pass=$ftppass - host=$ftphost port=$FTP_PORT dir=$ftpdirn file=$ftpfile"
  debug "from dir=$fromdir file=$fromfile"
  # shellcheck disable=SC2086
- sshpass -p "$ftppass" sftp $SFTP_OPTS "$ftpuser@$ftphost" <<- _EOF
+ sshpass -p "$ftppass" sftp $SFTP_OPTS $SFTP_PORT "$ftpuser@$ftphost" <<- _EOF
  cd $ftpdirn
  lcd $fromdir
  put ./$fromfile
@@ -1063,7 +1065,8 @@ copy_file_to_location() { # copies a file, using scp, sftp or ftp if required.
  # shellcheck disable=SC2086
  curl ${_NOMETER} -u "${davsuser}:${davspass}" -T "${fromdir}/${fromfile}" "https://${davshost}:${davsport}${davsdirn}${davsfile}"
  elif [[ "${to:0:6}" == "ftpes:" ]] || [[ "${to:0:5}" == "ftps:" ]] ; then
- debug "using ftp to copy the file from $from"
+ # FTPES (FTP over explicit TLS/SSL, port 21) and FTPS (FTP over implicit TLS/SSL, port 990).
+ debug "using ${to:0:5} to copy the file from $from"
  ftpuser=$(echo "$to"| awk -F: '{print $2}')
  ftppass=$(echo "$to"| awk -F: '{print $3}')
  ftphost=$(echo "$to"| awk -F: '{print $4}')
@@ -1072,14 +1075,25 @@ copy_file_to_location() { # copies a file, using scp, sftp or ftp if required.
  ftpfile=$(basename "$ftplocn")
  fromdir=$(dirname "$from")
  fromfile=$(basename "$from")
- debug "ftp user=$ftpuser - pass=$ftppass - host=$ftphost dir=$ftpdirn file=$ftpfile"
+
+ SFTP_PORT="";
+ if [ -n "$FTP_PORT" ]; then SFTP_PORT=":${FTP_PORT}"; fi
+ debug "${to:0:5} user=$ftpuser - pass=$ftppass - host=$ftphost port=$FTP_PORT dir=$ftpdirn file=$ftpfile"
  debug "from dir=$fromdir file=$fromfile"
  if [[ "${to:0:5}" == "ftps:" ]] ; then
+ # if no FTP_PORT is specified, then use default
+ if [ -z "$FTP_PORT" ]; then
+ SFTP_PORT=":990"
+ fi
  # shellcheck disable=SC2086
- curl ${_NOMETER} $FTPS_OPTIONS --ftp-ssl --ftp-ssl-reqd -u "${ftpuser}:${ftppass}" -T "${fromdir}/${fromfile}" "ftp:https://${ftphost}${ftpdirn}:990/"
+ debug curl ${_NOMETER} $FTPS_OPTIONS --ftp-ssl --ftp-ssl-reqd -u "${ftpuser}:${ftppass}" -T "${fromdir}/${fromfile}" "ftps:https://${ftphost}${SFTP_PORT}/${ftpdirn}/"
+ # shellcheck disable=SC2086
+ curl ${_NOMETER} $FTPS_OPTIONS --ftp-ssl --ftp-ssl-reqd -u "${ftpuser}:${ftppass}" -T "${fromdir}/${fromfile}" "ftps:https://${ftphost}${SFTP_PORT}/${ftpdirn}/"
  else
  # shellcheck disable=SC2086
- curl ${_NOMETER} $FTPS_OPTIONS --ftp-ssl --ftp-ssl-reqd -u "${ftpuser}:${ftppass}" -T "${fromdir}/${fromfile}" "ftp:https://${ftphost}${ftpdirn}/"
+ debug curl ${_NOMETER} $FTPS_OPTIONS --ftp-ssl --ftp-ssl-reqd -u "${ftpuser}:${ftppass}" -T "${fromdir}/${fromfile}" "ftp:https://${ftphost}${SFTP_PORT}/${ftpdirn}/"
+ # shellcheck disable=SC2086
+ curl ${_NOMETER} $FTPS_OPTIONS --ftp-ssl --ftp-ssl-reqd -u "${ftpuser}:${ftppass}" -T "${fromdir}/${fromfile}" "ftp:https://${ftphost}${SFTP_PORT}/${ftpdirn}/"
  fi
  else
  if ! mkdir -p "$(dirname "$to")" ; then

diff --git a/test/34-ftp-passive.bats b/test/34-ftp-passive.bats
@@ -10,18 +10,19 @@ setup() {
  [ ! -f $BATS_RUN_TMPDIR/failed.skip ] || skip "skipping tests after first failure"
  export CURL_CA_BUNDLE=/root/pebble-ca-bundle.crt
  if [ -n "${VSFTPD_CONF}" ]; then
- cp $VSFTPD_CONF ${VSFTPD_CONF}.getssl
+ if [ ! -f "${VSFTPD_CONF}.getssl" ]; then
+ cp $VSFTPD_CONF ${VSFTPD_CONF}.getssl
+ else
+ cp ${VSFTPD_CONF}.getssl $VSFTPD_CONF
+ fi
 
  # enable passive and disable active mode
  # https://www.pixelstech.net/article/1364817664-FTP-active-mode-and-passive-mode
  cat <<- _FTP >> $VSFTPD_CONF
 pasv_enable=YES
 pasv_max_port=10100
 pasv_min_port=10090
-connect_from_port_20=NO
 _FTP
-
- ${CODE_DIR}/test/restart-ftpd start
  fi
 }
 
@@ -44,6 +45,8 @@ teardown() {
  mkdir -p /var/www/html/.well-known/acme-challenge
  fi
 
+ ${CODE_DIR}/test/restart-ftpd start
+
  NEW_FTP="false"
  if [[ "$(ftp -? 2>&1 | head -1 | cut -c-6)" == "usage:" ]]; then
  NEW_FTP="true"
@@ -57,8 +60,11 @@ teardown() {
  setup_environment
  init_getssl
 
+ # The DOMAIN_PEM_LOCATION creates a *signed* certificate for the ftps/ftpes tests
  cat <<- EOF > ${INSTALL_DIR}/.getssl/${GETSSL_CMD_HOST}/getssl_test_specific.cfg
 ACL="ftp:ftpuser:ftpuser:${GETSSL_CMD_HOST}:/var/www/html/.well-known/acme-challenge"
+DOMAIN_PEM_LOCATION=/etc/vsftpd.pem
+CA_CERT_LOCATION=/etc/cacert.pem
 EOF
  if [[ "$FTP_PASSIVE_DEFAULT" == "false" ]]; then
  if [[ "$NEW_FTP" == "true" ]]; then
@@ -98,6 +104,8 @@ EOF4
  mkdir -p /var/www/html/.well-known/acme-challenge
  fi
 
+ ${CODE_DIR}/test/restart-ftpd start
+
  NEW_FTP="false"
  if [[ "$(ftp -? 2>&1 | head -1 | cut -c-6)" == "usage:" ]]; then
  NEW_FTP="true"
@@ -144,3 +152,128 @@ EOF3
  fi
  check_output_for_errors
 }
+
+
+@test "Use ftpes (explicit ssl, port 21) to create challenge file" {
+ if [ -n "$STAGING" ]; then
+ skip "Using staging server, skipping internal test"
+ fi
+
+ if [[ ! -f /etc/vsftpd.pem ]]; then
+ echo "FAILED: This test requires the previous test to succeed"
+ exit 1
+ fi
+
+ if [[ ! -d /var/www/html/.well-known/acme-challenge ]]; then
+ mkdir -p /var/www/html/.well-known/acme-challenge
+ fi
+
+ # Restart vsftpd with ssl enabled
+ cat <<- _FTP >> $VSFTPD_CONF
+connect_from_port_20=NO
+ssl_enable=YES
+allow_anon_ssl=NO
+force_local_data_ssl=NO
+force_local_logins_ssl=NO
+ssl_tlsv1=YES
+ssl_sslv2=NO
+ssl_sslv3=NO
+require_ssl_reuse=NO
+ssl_ciphers=HIGH
+rsa_cert_file=/etc/vsftpd.pem
+rsa_private_key_file=/etc/vsftpd.pem
+_FTP
+ ${CODE_DIR}/test/restart-ftpd start
+
+ # Always change ownership and permissions in case previous tests created the directories as root
+ chgrp -R www-data /var/www/html/.well-known
+ chmod -R g+w /var/www/html/.well-known
+
+ CONFIG_FILE="getssl-http01.cfg"
+ setup_environment
+ init_getssl
+
+ # Verbose output is needed so the test assertion passes
+ # On Ubuntu 14 and 18 curl errors with "unable to get issuer certificate" so disable cert check using "-k"
+ if [[ "$GETSSL_OS" == "ubuntu14" || "$GETSSL_OS" == "ubuntu18" ]]; then
+ cat <<- EOF > ${INSTALL_DIR}/.getssl/${GETSSL_CMD_HOST}/getssl_test_specific.cfg
+ ACL="ftpes:ftpuser:ftpuser:${GETSSL_CMD_HOST}:/var/www/html/.well-known/acme-challenge"
+ FTPS_OPTIONS="--cacert /etc/cacert.pem -v -k"
+EOF
+ else
+ cat <<- EOF > ${INSTALL_DIR}/.getssl/${GETSSL_CMD_HOST}/getssl_test_specific.cfg
+ACL="ftpes:ftpuser:ftpuser:${GETSSL_CMD_HOST}:/var/www/html/.well-known/acme-challenge"
+FTPS_OPTIONS="--cacert /etc/cacert.pem -v"
+EOF
+ fi
+
+ create_certificate
+ assert_success
+ # assert_line --partial "SSL connection using TLSv1.3"
+ assert_line --partial "200 PROT now Private"
+
+ check_output_for_errors
+}
+
+
+@test "Use ftps (implicit ssl, port 990) to create challenge file" {
+ if [ -n "$STAGING" ]; then
+ skip "Using staging server, skipping internal test"
+ fi
+
+ if [[ ! -f /etc/vsftpd.pem ]]; then
+ echo "FAILED: This test requires the previous test to succeed"
+ exit 1
+ fi
+
+ # Restart vsftpd listening on port 990
+ cat <<- _FTP >> $VSFTPD_CONF
+implicit_ssl=YES
+listen_port=990
+connect_from_port_20=NO
+ssl_enable=YES
+allow_anon_ssl=NO
+force_local_data_ssl=NO
+force_local_logins_ssl=NO
+ssl_tlsv1=YES
+ssl_sslv2=NO
+ssl_sslv3=NO
+require_ssl_reuse=NO
+ssl_ciphers=HIGH
+rsa_cert_file=/etc/vsftpd.pem
+rsa_private_key_file=/etc/vsftpd.pem
+_FTP
+ ${CODE_DIR}/test/restart-ftpd start
+
+ if [[ ! -d /var/www/html/.well-known/acme-challenge ]]; then
+ mkdir -p /var/www/html/.well-known/acme-challenge
+ fi
+
+ # Always change ownership and permissions in case previous tests created the directories as root
+ chgrp -R www-data /var/www/html/.well-known
+ chmod -R g+w /var/www/html/.well-known
+
+ CONFIG_FILE="getssl-http01.cfg"
+ setup_environment
+ init_getssl
+
+ # Verbose output is needed so the test assertion passes
+ # On Ubuntu 14 and 18 curl errors with "unable to get issuer certificate" so disable cert check using "-k"
+ # as I don't have time to fix
+ if [[ "$GETSSL_OS" == "ubuntu14" || "$GETSSL_OS" == "ubuntu18" ]]; then
+ cat <<- EOF > ${INSTALL_DIR}/.getssl/${GETSSL_CMD_HOST}/getssl_test_specific.cfg
+ACL="ftps:ftpuser:ftpuser:${GETSSL_CMD_HOST}:/var/www/html/.well-known/acme-challenge"
+FTPS_OPTIONS="--cacert /etc/cacert.pem -v -k"
+EOF
+ else
+ cat <<- EOF > ${INSTALL_DIR}/.getssl/${GETSSL_CMD_HOST}/getssl_test_specific.cfg
+ACL="ftps:ftpuser:ftpuser:${GETSSL_CMD_HOST}:/var/www/html/.well-known/acme-challenge"
+FTPS_OPTIONS="--cacert /etc/cacert.pem -v"
+EOF
+ fi
+
+ create_certificate
+ assert_success
+ assert_line --partial "200 PROT now Private"
+ check_output_for_errors
+}