author | Kim Alvefur <zash@zash.se> |
Sat, 05 Apr 2014 13:40:13 +0200 | |
changeset 1380 | 703041357f89 |
parent 1325 | b21236b6b8d8 |
child 1381 | 11b6170a50f7 |
permissions | -rw-r--r-- |
1380
703041357f89
mod_s2s_auth_fingerprint: Allways pin fingerprints
Kim Alvefur <zash@zash.se>
parents:
1325
diff
changeset
|
1 |
-- Copyright (C) 2013-2014 Kim Alvefur |
938
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
2 |
-- This file is MIT/X11 licensed. |
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
3 |
|
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
4 |
module:set_global(); |
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
5 |
|
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
6 |
local digest_algo = module:get_option_string(module:get_name().."_digest", "sha1"); |
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
7 |
|
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
8 |
local fingerprints = {}; |
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
9 |
|
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
10 |
local function hashprep(h) |
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
11 |
return tostring(h):lower():gsub(":",""); |
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
12 |
end |
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
13 |
|
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
14 |
for host, set in pairs(module:get_option("s2s_trusted_fingerprints", {})) do |
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
15 |
local host_set = {} |
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
16 |
if type(set) == "table" then -- list of fingerprints |
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
17 |
for i=1,#set do |
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
18 |
host_set[hashprep(set[i])] = true; |
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
19 |
end |
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
20 |
else -- assume single fingerprint |
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
21 |
host_set[hashprep(set)] = true; |
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
22 |
end |
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
23 |
fingerprints[host] = host_set; |
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
24 |
end |
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
25 |
|
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
26 |
module:hook("s2s-check-certificate", function(event) |
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
27 |
local session, host, cert = event.session, event.host, event.cert; |
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
28 |
|
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
29 |
local host_fingerprints = fingerprints[host]; |
1131
e7b69d12fbfb
mod_s2s_auth_fingerprint: Add a cert-pinning mode
Kim Alvefur <zash@zash.se>
parents:
939
diff
changeset
|
30 |
if host_fingerprints then |
e7b69d12fbfb
mod_s2s_auth_fingerprint: Add a cert-pinning mode
Kim Alvefur <zash@zash.se>
parents:
939
diff
changeset
|
31 |
local digest = cert and cert:digest(digest_algo); |
938
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
32 |
if host_fingerprints[digest] then |
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
33 |
session.cert_chain_status = "valid"; |
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
34 |
session.cert_identity_status = "valid"; |
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
35 |
return true; |
1380
703041357f89
mod_s2s_auth_fingerprint: Allways pin fingerprints
Kim Alvefur <zash@zash.se>
parents:
1325
diff
changeset
|
36 |
else |
1131
e7b69d12fbfb
mod_s2s_auth_fingerprint: Add a cert-pinning mode
Kim Alvefur <zash@zash.se>
parents:
939
diff
changeset
|
37 |
session.cert_chain_status = "invalid"; |
e7b69d12fbfb
mod_s2s_auth_fingerprint: Add a cert-pinning mode
Kim Alvefur <zash@zash.se>
parents:
939
diff
changeset
|
38 |
session.cert_identity_status = "invalid"; |
938
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
39 |
end |
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
40 |
end |
d0e71a3bd2c4
mod_s2s_auth_fingerprint: New module for authenticating s2s connections based on preconfigured fingerprints.
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
41 |
end); |