Skip to content

Commit 43ecb0b

Browse files
jedisct1jedisct1
committed
Add pure-certd
1 parent 506b3d1 commit 43ecb0b

18 files changed

+672
-3
lines changed

‎.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ puredb/src/example_write
2929
puredb/src/regression
3030
src/ptracetest
3131
src/pure-authd
32+
src/pure-certd
3233
src/pure-ftpd
3334
src/pure-ftpwho
3435
src/pure-mrtginfo

‎configure.ac

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1462,7 +1462,7 @@ gui/Makefile m4/Makefile pure-ftpd.conf puredb/Makefile
14621462
puredb/src/Makefile
14631463
man/pure-ftpd.8 man/pure-ftpwho.8 man/pure-mrtginfo.8 man/pure-uploadscript.8
14641464
man/pure-statsdecode.8 man/pure-quotacheck.8 man/pure-pw.8 man/pure-pwconvert.8
1465-
man/pure-authd.8)
1465+
man/pure-authd.8 man/pure-certd.8)
14661466

14671467
AC_OUTPUT
14681468

‎man/Makefile.am

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,8 @@ man_MANS = \
77
pure-quotacheck.8 \
88
pure-pw.8 \
99
pure-pwconvert.8 \
10-
pure-authd.8
10+
pure-authd.8 \
11+
pure-certd.8
1112

1213
CLEANFILES = \
1314
pure-ftpd.8 \
@@ -18,4 +19,5 @@ CLEANFILES = \
1819
pure-quotacheck.8 \
1920
pure-pw.8 \
2021
pure-pwconvert.8 \
21-
pure-authd.8
22+
pure-authd.8 \
23+
pure-certd.8

‎man/pure-authd.8.in

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,7 @@ Frank DENIS <j at pureftpd dot org>
138138
.BR "pure-pw(8)"
139139
.BR "pure-quotacheck(8)"
140140
.BR "pure-authd(8)"
141+
.BR "pure-certd(8)"
141142

142143
.BR "RFC 959",
143144
.BR "RFC 2389",

‎man/pure-certd.8.in

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
.TH "pure-certd" "8" "@VERSION@" "Frank Denis" "Pure-FTPd"
2+
.SH "NAME"
3+
.LP
4+
pure\-certd \- TLS certificate agent for Pure\-FTPd.
5+
.SH "SYNTAX"
6+
.LP
7+
pure\-certd [\fI\-p\fP <\fI/path/to/pidfile\fP>] [\fI\-u\fP uid] [\fI\-g\fP gid] [\fI\-B\fP] <\fI\-s\fP /path/to/socket> \fI\-r\fP /program/to/run
8+
9+
.SH "DESCRIPTION"
10+
.LP
11+
pure\-certd is a daemon that forks an authentication program, waits for a certificate path as a reply, and returns it to an application server.
12+
.LP
13+
pure\-certd listens to a local Unix socket. A new connection to that socket should send pure\-authd the following structure:
14+
.IP
15+
sni_name:xxx
16+
end
17+
.LP
18+
These content is passed to the authentication program, as an environment variable:
19+
.IP
20+
CERTD_SNI_NAME
21+
.LP
22+
The authentication program should take appropriate actions to select a TLS certificate, and reply to the standard output with the following format:
23+
.IP
24+
action:strict
25+
cert_path:/path/to/cert.pem
26+
end
27+
.TP
28+
\fBaction:\fRxxx
29+
If action is "deny", a certificate for that name was not found and access is denied.
30+
If xxx is "default", the default certificate will be used.
31+
If xxx is "strict", the certificate whose path is indicated in "cert_path" will be used. If absent or invalid, access will be denied.
32+
If xxx is "fallback", the certificate whose path is indicated in "cert_path" will be used. If absent or invalid, the default certificate will be used instead.
33+
.TP
34+
\fBuid:\fRxxx
35+
The system uid to be assigned to that user. Must be > 0.
36+
.TP
37+
\fBgid:\fRxxx
38+
The primary system gid. Must be > 0.
39+
.TP
40+
\fBdir:\fRxxx
41+
The absolute path to the home directory. Can contain /./ for a chroot jail.
42+
.LP
43+
\fIOnly one authentication program is forked at a time. It must return quickly.\fR
44+
.SH "OPTIONS"
45+
.TP
46+
\fB\-u\fR <\fIuid\fP>
47+
Have the daemon run with that uid.
48+
.TP
49+
\fB\-g\fR <\fIgid\fP>
50+
Have the daemon run with that gid.
51+
.TP
52+
\fB\-B\fR
53+
Fork in background (daemonization).
54+
.TP
55+
\fB\-s\fR <\fI/path/to/socket\fP>
56+
Set the full path to the local Unix socket.
57+
.TP
58+
\fB\-r\fR <\fI/path/to/program\fP>
59+
Set the full path to the authentication program.
60+
.TP
61+
\fB\-h\fR
62+
Output help information and exit.
63+
.SH "EXAMPLES"
64+
.LP
65+
To run this program the standard way type:
66+
.LP
67+
pure\-certd \-s @LOCALSTATEDIR@/run/certd.sock \-r /usr/bin/my\-cert\-program &
68+
.LP
69+
pure\-ftpd \-lextauth:@LOCALSTATEDIR@/run/certd.sock &
70+
.TP
71+
/usr/bin/my\-cert\-program can be as simple as:
72+
#! /bin/sh
73+
74+
echo 'action:strict'
75+
76+
echo 'cert_path:/etc/ssl/private/pure-ftpd/cert.pen'
77+
78+
echo 'end'
79+
.SH "AUTHORS"
80+
.LP
81+
Frank DENIS <j at pureftpd dot org>
82+
.SH "SEE ALSO"
83+
.BR "ftp(1)" ,
84+
.BR "pure-ftpd(8)"
85+
.BR "pure-ftpwho(8)"
86+
.BR "pure-mrtginfo(8)"
87+
.BR "pure-uploadscript(8)"
88+
.BR "pure-statsdecode(8)"
89+
.BR "pure-pw(8)"
90+
.BR "pure-quotacheck(8)"
91+
.BR "pure-authd(8)"

‎man/pure-ftpd.8.in

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1020,6 +1020,7 @@ Contributors:
10201020
.BR "pure-pw(8)"
10211021
.BR "pure-quotacheck(8)"
10221022
.BR "pure-authd(8)"
1023+
.BR "pure-certd(8)"
10231024

10241025
.BR "RFC 959" ,
10251026
.BR "RFC 2228",

‎man/pure-ftpwho.8.in

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,7 @@ Frank DENIS <j at pureftpd dot org>
7979
.BR "pure-pw(8)"
8080
.BR "pure-quotacheck(8)"
8181
.BR "pure-authd(8)"
82+
.BR "pure-certd(8)"
8283

8384
.BR "RFC 959" ,
8485
.BR "RFC 2389",

‎man/pure-mrtginfo.8.in

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,7 @@ warranty, or liability of any kind.
7373
.BR "pure-pw(8)"
7474
.BR "pure-quotacheck(8)"
7575
.BR "pure-authd(8)"
76+
.BR "pure-certd(8)"
7677

7778
.BR "RFC 959" ,
7879
.BR "RFC 2228",

‎man/pure-pw.8.in

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,7 @@ Frank DENIS <j at pureftpd dot org>
7878
.BR "pure-pw(8)"
7979
.BR "pure-quotacheck(8)"
8080
.BR "pure-authd(8)"
81+
.BR "pure-certd(8)"
8182

8283
.BR "RFC 959" ,
8384
.BR "RFC 2228",

‎man/pure-pwconvert.8.in

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ Frank Denis <j at pureftpd dot org>
3131
.BR "pure-pw(8)"
3232
.BR "pure-quotacheck(8)"
3333
.BR "pure-authd(8)"
34+
.BR "pure-certd(8)"
3435

3536
.BR "RFC 959" ,
3637
.BR "RFC 2228",

‎man/pure-quotacheck.8.in

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,7 @@ pure\-quotacheck never scans the same inode/device pair twice.
6161
.BR "pure-pw(8)"
6262
.BR "pure-quotacheck(8)"
6363
.BR "pure-authd(8)"
64+
.BR "pure-certd(8)"
6465

6566
.BR "RFC 959",
6667
.BR "RFC 2228",

‎man/pure-statsdecode.8.in

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ Frank DENIS <j at pureftpd dot org>
4242
.BR "pure-pw(8)"
4343
.BR "pure-quotacheck(8)"
4444
.BR "pure-authd(8)"
45+
.BR "pure-certd(8)"
4546

4647
.BR "RFC 959" ,
4748
.BR "RFC 2228",

‎man/pure-uploadscript.8.in

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,7 @@ Frank DENIS <j at pureftpd dot org>
9494
.BR "pure-pw(8)"
9595
.BR "pure-quotacheck(8)"
9696
.BR "pure-authd(8)"
97+
.BR "pure-certd(8)"
9798

9899
.BR "RFC 959" ,
99100
.BR "RFC 2228",

‎src/Makefile.am

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ noinst_LIBRARIES = libpureftpd.a
22

33
sbin_PROGRAMS = \
44
pure-authd \
5+
pure-certd \
56
pure-ftpd \
67
pure-ftpwho \
78
pure-mrtginfo \
@@ -127,6 +128,7 @@ libpureftpd_a_SOURCES = \
127128
simpleconf.c \
128129
syslognames.h \
129130
tls.h \
131+
tls_extcert.h \
130132
tls.c \
131133
upload-pipe.c \
132134
upload-pipe.h \
@@ -249,5 +251,18 @@ pure_authd_SOURCES = \
249251
safe_rw.c \
250252
safe_rw.h
251253

254+
pure_certd_SOURCES = \
255+
bsd-getopt_long.c \
256+
bsd-getopt_long.h \
257+
fakesnprintf.h \
258+
fakesnprintf.c \
259+
ftpd.h \
260+
mysnprintf.c \
261+
mysnprintf.h \
262+
pure-certd.c \
263+
pure-certd_p.h \
264+
safe_rw.c \
265+
safe_rw.h
266+
252267
ptracetest_SOURCES = \
253268
ptracetest.c

‎src/ftpd.h

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -460,6 +460,14 @@ extern int opt_a, opt_C, opt_d, opt_F, opt_l, opt_R;
460460
# endif
461461
#endif
462462

463+
#ifndef CERTD_PID_FILE
464+
# ifdef NON_ROOT_FTP
465+
# define CERTD_PID_FILE CONFDIR "/pure-certd.pid"
466+
# else
467+
# define CERTD_PID_FILE STATEDIR "/run/pure-certd.pid"
468+
# endif
469+
#endif
470+
463471
#ifndef NON_ROOT_FTP
464472
# ifdef IMPLICIT_TLS
465473
# define DEFAULT_FTP_PORT_S "990"

0 commit comments

Comments
 (0)