author | Kim Alvefur <zash@zash.se> |
Wed, 19 Mar 2014 19:51:57 +0100 | |
changeset 1363 | 478b3288192f |
parent 1361 | b9213ddb860f |
permissions | -rw-r--r-- |
1008
2b2d4b1de638
mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
1 |
-- Copyright (C) 2013 Kim Alvefur |
2b2d4b1de638
mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
2 |
-- This file is MIT/X11 licensed. |
2b2d4b1de638
mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
3 |
-- |
1343
7dbde05b48a9
all the things: Remove trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents:
1130
diff
changeset
|
4 |
-- Implements Secure Delegation using DNS SRV as described in |
1008
2b2d4b1de638
mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
5 |
-- http://tools.ietf.org/html/draft-miller-xmpp-dnssec-prooftype |
2b2d4b1de638
mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
6 |
-- |
2b2d4b1de638
mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
7 |
-- Dependecies: |
2b2d4b1de638
mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
8 |
-- Prosody above hg:43059357b2f0 |
2b2d4b1de638
mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
9 |
-- DNSSEC-validating DNS resolver |
2b2d4b1de638
mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
10 |
-- https://github.com/Zash/luaunbound |
2b2d4b1de638
mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
11 |
-- libunbound binding using LuaJIT FFI |
2b2d4b1de638
mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
12 |
|
2b2d4b1de638
mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
13 |
module:set_global(); |
2b2d4b1de638
mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
14 |
|
2b2d4b1de638
mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
15 |
local nameprep = require"util.encodings".stringprep.nameprep; |
2b2d4b1de638
mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
16 |
local to_unicode = require"util.encodings".idna.to_unicode; |
1360
6ee395396333
mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents:
1343
diff
changeset
|
17 |
local to_ascii = require "util.encodings".idna.to_ascii; |
1008
2b2d4b1de638
mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
18 |
local cert_verify_identity = require "util.x509".verify_identity; |
1360
6ee395396333
mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents:
1343
diff
changeset
|
19 |
local dns_lookup = require"net.adns".lookup; |
6ee395396333
mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents:
1343
diff
changeset
|
20 |
local t_insert = table.insert; |
1008
2b2d4b1de638
mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
21 |
|
2b2d4b1de638
mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
22 |
module:hook("s2s-check-certificate", function(event) |
2b2d4b1de638
mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
23 |
local session, cert = event.session, event.cert; |
2b2d4b1de638
mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
24 |
|
1130
29dcdea3c2be
mod_s2s_auth_dnssec_srv: Ignore certificates with invalid chains.
Kim Alvefur <zash@zash.se>
parents:
1008
diff
changeset
|
25 |
if session.cert_chain_status == "valid" and session.cert_identity_status ~= "valid" |
1360
6ee395396333
mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents:
1343
diff
changeset
|
26 |
and session.srv_hosts.answer and session.srv_hosts.answer.secure then |
6ee395396333
mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents:
1343
diff
changeset
|
27 |
local srv_hosts, srv_choice, srv_target = session.srv_hosts, session.srv_choice; |
6ee395396333
mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents:
1343
diff
changeset
|
28 |
for i = srv_choice or 1, srv_choice or #srv_hosts do |
6ee395396333
mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents:
1343
diff
changeset
|
29 |
srv_target = nameprep(to_unicode(session.srv_hosts[i].target:gsub("%.?$",""))); |
6ee395396333
mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents:
1343
diff
changeset
|
30 |
(session.log or module._log)("debug", "Comparing certificate with Secure SRV target %s", srv_target); |
6ee395396333
mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents:
1343
diff
changeset
|
31 |
if srv_target and cert_verify_identity(srv_target, "xmpp-server", cert) then |
6ee395396333
mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents:
1343
diff
changeset
|
32 |
(session.log or module._log)("info", "Certificate matches Secure SRV target %s", srv_target); |
6ee395396333
mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents:
1343
diff
changeset
|
33 |
session.cert_identity_status = "valid"; |
6ee395396333
mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents:
1343
diff
changeset
|
34 |
return; |
6ee395396333
mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents:
1343
diff
changeset
|
35 |
end |
1008
2b2d4b1de638
mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
36 |
end |
2b2d4b1de638
mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
37 |
end |
2b2d4b1de638
mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
38 |
end); |
1360
6ee395396333
mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents:
1343
diff
changeset
|
39 |
|
6ee395396333
mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents:
1343
diff
changeset
|
40 |
function module.add_host(module) |
6ee395396333
mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents:
1343
diff
changeset
|
41 |
module:hook("s2s-stream-features", function(event) |
6ee395396333
mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents:
1343
diff
changeset
|
42 |
local host_session = event.origin; |
1363
478b3288192f
mod_s2s_auth_dnssec_srv: Fix tb when no hostname sent by remote
Kim Alvefur <zash@zash.se>
parents:
1361
diff
changeset
|
43 |
local name = host_session.from_host and to_ascii(host_session.from_host); |
1360
6ee395396333
mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents:
1343
diff
changeset
|
44 |
if not name then return end |
6ee395396333
mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents:
1343
diff
changeset
|
45 |
dns_lookup(function (answer) |
1361
b9213ddb860f
mod_s2s_auth_dnssec_srv: Don't break DANE
Kim Alvefur <zash@zash.se>
parents:
1360
diff
changeset
|
46 |
if host_session.dane ~= nil then return end |
1360
6ee395396333
mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents:
1343
diff
changeset
|
47 |
if not answer.secure or #answer == 1 |
6ee395396333
mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents:
1343
diff
changeset
|
48 |
and answer[1].srv.target == "." then return end |
6ee395396333
mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents:
1343
diff
changeset
|
49 |
local srv_hosts = { answer = answer }; |
6ee395396333
mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents:
1343
diff
changeset
|
50 |
for _, record in ipairs(answer) do |
6ee395396333
mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents:
1343
diff
changeset
|
51 |
t_insert(srv_hosts, record.srv); |
6ee395396333
mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents:
1343
diff
changeset
|
52 |
end |
6ee395396333
mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents:
1343
diff
changeset
|
53 |
host_session.srv_hosts = srv_hosts; |
6ee395396333
mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents:
1343
diff
changeset
|
54 |
end, "_xmpp-server._tcp."..name..".", "SRV"); |
6ee395396333
mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents:
1343
diff
changeset
|
55 |
end); |
6ee395396333
mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents:
1343
diff
changeset
|
56 |
end |
6ee395396333
mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents:
1343
diff
changeset
|
57 |