--- a/mod_s2s_auth_dnssec_srv/mod_s2s_auth_dnssec_srv.lua Mon Mar 24 13:04:24 2014 +0100
+++ /dev/null Thu Jan 01 00:00:00 1970 +0000
@@ -1,57 +0,0 @@
--- Copyright (C) 2013 Kim Alvefur
--- This file is MIT/X11 licensed.
---
--- Implements Secure Delegation using DNS SRV as described in
--- http://tools.ietf.org/html/draft-miller-xmpp-dnssec-prooftype
---
--- Dependecies:
--- Prosody above hg:43059357b2f0
--- DNSSEC-validating DNS resolver
--- https://github.com/Zash/luaunbound
--- libunbound binding using LuaJIT FFI
-
-module:set_global();
-
-local nameprep = require"util.encodings".stringprep.nameprep;
-local to_unicode = require"util.encodings".idna.to_unicode;
-local to_ascii = require "util.encodings".idna.to_ascii;
-local cert_verify_identity = require "util.x509".verify_identity;
-local dns_lookup = require"net.adns".lookup;
-local t_insert = table.insert;
-
-module:hook("s2s-check-certificate", function(event)
- local session, cert = event.session, event.cert;
-
- if session.cert_chain_status == "valid" and session.cert_identity_status ~= "valid"
- and session.srv_hosts.answer and session.srv_hosts.answer.secure then
- local srv_hosts, srv_choice, srv_target = session.srv_hosts, session.srv_choice;
- for i = srv_choice or 1, srv_choice or #srv_hosts do
- srv_target = nameprep(to_unicode(session.srv_hosts[i].target:gsub("%.?$","")));
- (session.log or module._log)("debug", "Comparing certificate with Secure SRV target %s", srv_target);
- if srv_target and cert_verify_identity(srv_target, "xmpp-server", cert) then
- (session.log or module._log)("info", "Certificate matches Secure SRV target %s", srv_target);
- session.cert_identity_status = "valid";
- return;
- end
- end
- end
-end);
-
-function module.add_host(module)
- module:hook("s2s-stream-features", function(event)
- local host_session = event.origin;
- local name = host_session.from_host and to_ascii(host_session.from_host);
- if not name then return end
- dns_lookup(function (answer)
- if host_session.dane ~= nil then return end
- if not answer.secure or #answer == 1
- and answer[1].srv.target == "." then return end
- local srv_hosts = { answer = answer };
- for _, record in ipairs(answer) do
- t_insert(srv_hosts, record.srv);
- end
- host_session.srv_hosts = srv_hosts;
- end, "_xmpp-server._tcp."..name..".", "SRV");
- end);
-end
-