author | Matthew Wild <mwild1@gmail.com> |
Tue, 12 Mar 2024 14:27:43 +0000 | |
changeset 5869 | bfc35ae9edcb |
parent 4678 | 1b701f208b1b |
permissions | -rwxr-xr-x |
1604
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
1 |
|
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
2 |
assert(require"ssl.core".info, "Incompatible LuaSec version"); |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
3 |
|
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
4 |
local function hook(event_name, typ, policy) |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
5 |
if not policy then return end |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
6 |
if policy == "FS" then |
1895
a43ed0d28918
mod_tls_policy: Change the FS shortcut to match on ciphers with (EC)DHE (produces nicer stream error)
Kim Alvefur <zash@zash.se>
parents:
1619
diff
changeset
|
7 |
policy = { cipher = "^E?C?DHE%-" }; |
1604
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
8 |
elseif type(policy) == "string" then |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
9 |
policy = { cipher = policy }; |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
10 |
end |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
11 |
|
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
12 |
module:hook(event_name, function (event) |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
13 |
local origin = event.origin; |
4678
1b701f208b1b
mod_tls_policy: Switch method of checking for TLS-encrypted connection
Kim Alvefur <zash@zash.se>
parents:
1895
diff
changeset
|
14 |
if origin.conn and origin.conn:ssl() then |
1604
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
15 |
local info = origin.conn:socket():info(); |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
16 |
for key, what in pairs(policy) do |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
17 |
module:log("debug", "Does info[%q] = %s match %s ?", key, tostring(info[key]), tostring(what)); |
1605
c5ca63ac0e1b
mod_tls_policy: Fix pattern matching
Kim Alvefur <zash@zash.se>
parents:
1604
diff
changeset
|
18 |
if (type(what) == "number" and what < info[key] ) or (type(what) == "string" and not info[key]:match(what)) then |
1619
d0fd8a29b724
mod_tls_policy: Include which part of the cipher that did not match the policy in stream error
Kim Alvefur <zash@zash.se>
parents:
1605
diff
changeset
|
19 |
origin:close({ condition = "policy-violation", text = ("TLS %s '%s' not acceptable"):format(key, tostring(info[key])) }); |
1604
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
20 |
return false; |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
21 |
end |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
22 |
module:log("debug", "Seems so"); |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
23 |
end |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
24 |
module:log("debug", "Policy matches"); |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
25 |
end |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
26 |
end, 1000); |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
27 |
end |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
28 |
|
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
29 |
local policy = module:get_option(module.name, {}); |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
30 |
|
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
31 |
if type(policy) == "string" then |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
32 |
policy = { c2s = policy, s2s = policy }; |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
33 |
end |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
34 |
|
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
35 |
hook("stream-features", "c2s", policy.c2s); |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
36 |
hook("s2s-stream-features", "s2sin", policy.s2sin or policy.s2s); |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
37 |
hook("stanza/http://etherx.jabber.org/streams:features", "s2sout", policy.s2sout or policy.s2s); |