ftpd: add tls version, cipher and KEX to login log

Fixes #2124

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>

Author: drakkan

internal/ftpd/internal_test.go

@@ -699,16 +699,26 @@ func TestDriverMethodsNotImplemented(t *testing.T) {
 
 func TestExtraData(t *testing.T) {
 	mockCC := mockFTPClientContext{}
-	_, ok := mockCC.Extra().(bool)
+	_, ok := mockCC.Extra().(*tlsState)
 	require.False(t, ok)
-	mockCC.SetExtra(false)
-	val, ok := mockCC.Extra().(bool)
+	mockCC.SetExtra(&tlsState{
+		LoginWithMutualTLS: false,
+		Version:            tls.VersionName(tls.VersionTLS13),
+		Cipher:             tls.CipherSuiteName(tls.TLS_AES_128_GCM_SHA256),
+		KEX:                tls.X25519MLKEM768.String(),
+	})
+	state, ok := mockCC.Extra().(*tlsState)
 	require.True(t, ok)
-	require.False(t, val)
-	mockCC.SetExtra(true)
-	val, ok = mockCC.Extra().(bool)
+	require.False(t, state.LoginWithMutualTLS)
+	require.Equal(t, tls.VersionName(tls.VersionTLS13), state.Version)
+	require.Equal(t, tls.CipherSuiteName(tls.TLS_AES_128_GCM_SHA256), state.Cipher)
+	require.Equal(t, tls.X25519MLKEM768.String(), state.KEX)
+	mockCC.SetExtra(&tlsState{
+		LoginWithMutualTLS: true,
+	})
+	state, ok = mockCC.Extra().(*tlsState)
 	require.True(t, ok)
-	require.True(t, val)
+	require.True(t, state.LoginWithMutualTLS)
 }
 
 func TestResolvePathErrors(t *testing.T) {

internal/ftpd/server.go

@@ -36,6 +36,15 @@ import (
 	"github.com/drakkan/sftpgo/v2/internal/version"
 )
 
+// tlsState tracks TLS connection state for a client
+type tlsState struct {
+	// LoginWithMutualTLS indicates whether the user logged in using TLS certificate authentication
+	LoginWithMutualTLS bool
+	Version            string
+	Cipher             string
+	KEX                string
+}
+
 // Server implements the ftpserverlib MainDriver interface
 type Server struct {
 	ID           int
@@ -178,7 +187,8 @@ func (s *Server) ClientDisconnected(cc ftpserver.ClientContext) {
 // AuthUser authenticates the user and selects an handling driver
 func (s *Server) AuthUser(cc ftpserver.ClientContext, username, password string) (ftpserver.ClientDriver, error) {
 	loginMethod := dataprovider.LoginMethodPassword
-	if verified, ok := cc.Extra().(bool); ok && verified {
+	tlsState, ok := cc.Extra().(*tlsState)
+	if ok && tlsState != nil && tlsState.LoginWithMutualTLS {
 		loginMethod = dataprovider.LoginMethodTLSCertificateAndPwd
 	}
 	ipAddr := util.GetIPFromRemoteAddress(cc.RemoteAddr().String())
@@ -230,40 +240,52 @@ func (s *Server) WrapPassiveListener(listener net.Listener) (net.Listener, error
 
 // VerifyConnection checks whether a user should be authenticated using a client certificate without prompting for a password
 func (s *Server) VerifyConnection(cc ftpserver.ClientContext, user string, tlsConn *tls.Conn) (ftpserver.ClientDriver, error) {
+	if tlsConn == nil {
+		return nil, nil
+	}
+	state := tlsConn.ConnectionState()
+	cc.SetExtra(&tlsState{
+		LoginWithMutualTLS: false,
+		Cipher:             tls.CipherSuiteName(state.CipherSuite),
+		Version:            tls.VersionName(state.Version),
+		KEX:                state.CurveID.String(),
+	})
 	if !s.binding.isMutualTLSEnabled() {
 		return nil, nil
 	}
-	cc.SetExtra(false)
-	if tlsConn != nil {
-		state := tlsConn.ConnectionState()
-		if len(state.PeerCertificates) > 0 {
-			ipAddr := util.GetIPFromRemoteAddress(cc.RemoteAddr().String())
-			dbUser, err := dataprovider.CheckUserBeforeTLSAuth(user, ipAddr, common.ProtocolFTP, state.PeerCertificates[0])
+
+	if len(state.PeerCertificates) > 0 {
+		ipAddr := util.GetIPFromRemoteAddress(cc.RemoteAddr().String())
+		dbUser, err := dataprovider.CheckUserBeforeTLSAuth(user, ipAddr, common.ProtocolFTP, state.PeerCertificates[0])
+		if err != nil {
+			dbUser.Username = user
+			updateLoginMetrics(&dbUser, ipAddr, dataprovider.LoginMethodTLSCertificate, err, nil)
+			return nil, dataprovider.ErrInvalidCredentials
+		}
+		if dbUser.IsTLSVerificationEnabled() {
+			dbUser, err = dataprovider.CheckUserAndTLSCert(user, ipAddr, common.ProtocolFTP, state.PeerCertificates[0])
 			if err != nil {
-				dbUser.Username = user
-				updateLoginMetrics(&dbUser, ipAddr, dataprovider.LoginMethodTLSCertificate, err, nil)
-				return nil, dataprovider.ErrInvalidCredentials
+				return nil, err
 			}
-			if dbUser.IsTLSVerificationEnabled() {
-				dbUser, err = dataprovider.CheckUserAndTLSCert(user, ipAddr, common.ProtocolFTP, state.PeerCertificates[0])
-				if err != nil {
-					return nil, err
-				}
 
-				cc.SetExtra(true)
+			cc.SetExtra(&tlsState{
+				LoginWithMutualTLS: true,
+				Cipher:             tls.CipherSuiteName(state.CipherSuite),
+				Version:            tls.VersionName(state.Version),
+				KEX:                state.CurveID.String(),
+			})
 
-				if dbUser.IsLoginMethodAllowed(dataprovider.LoginMethodTLSCertificate, common.ProtocolFTP) {
-					connection, err := s.validateUser(dbUser, cc, dataprovider.LoginMethodTLSCertificate)
+			if dbUser.IsLoginMethodAllowed(dataprovider.LoginMethodTLSCertificate, common.ProtocolFTP) {
+				connection, err := s.validateUser(dbUser, cc, dataprovider.LoginMethodTLSCertificate)
 
-					defer updateLoginMetrics(&dbUser, ipAddr, dataprovider.LoginMethodTLSCertificate, err, connection)
+				defer updateLoginMetrics(&dbUser, ipAddr, dataprovider.LoginMethodTLSCertificate, err, connection)
 
-					if err != nil {
-						return nil, err
-					}
-					setStartDirectory(dbUser.Filters.StartDirectory, cc)
-					dataprovider.UpdateLastLogin(&dbUser)
-					return connection, nil
+				if err != nil {
+					return nil, err
 				}
+				setStartDirectory(dbUser.Filters.StartDirectory, cc)
+				dataprovider.UpdateLastLogin(&dbUser)
+				return connection, nil
 			}
 		}
 	}
@@ -411,8 +433,12 @@ func setStartDirectory(startDirectory string, cc ftpserver.ClientContext) {
 func updateLoginMetrics(user *dataprovider.User, ip, loginMethod string, err error, c *Connection) {
 	metric.AddLoginAttempt(loginMethod)
 	if err == nil {
+		info := ""
+		if tlsState, ok := c.clientContext.Extra().(*tlsState); ok && tlsState != nil {
+			info = fmt.Sprintf("%s - %s - %s", tlsState.Version, tlsState.Cipher, tlsState.KEX)
+		}
 		logger.LoginLog(user.Username, ip, loginMethod, common.ProtocolFTP, c.ID, c.GetClientVersion(),
-			c.clientContext.HasTLSForControl(), "")
+			c.clientContext.HasTLSForControl(), info)
 		plugin.Handler.NotifyLogEvent(notifier.LogEventTypeLoginOK, common.ProtocolFTP, user.Username, ip, "", nil)
 		common.DelayLogin(nil)
 	} else if err != common.ErrInternalFailure {