author | Kim Alvefur <zash@zash.se> |
Sun, 09 Mar 2014 13:44:29 +0100 | |
changeset 1336 | ae0558230e3d |
parent 1335 | faf4bd226cad |
child 1337 | c38f163f18b9 |
permissions | -rw-r--r-- |
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
1 |
-- mod_s2s_auth_dane |
1332
08a0241f5d2c
mod_s2s_auth_dane: Add some comments
Kim Alvefur <zash@zash.se>
parents:
1330
diff
changeset
|
2 |
-- Copyright (C) 2013-2014 Kim Alvefur |
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
3 |
-- |
1332
08a0241f5d2c
mod_s2s_auth_dane: Add some comments
Kim Alvefur <zash@zash.se>
parents:
1330
diff
changeset
|
4 |
-- This file is MIT/X11 licensed. |
08a0241f5d2c
mod_s2s_auth_dane: Add some comments
Kim Alvefur <zash@zash.se>
parents:
1330
diff
changeset
|
5 |
-- |
08a0241f5d2c
mod_s2s_auth_dane: Add some comments
Kim Alvefur <zash@zash.se>
parents:
1330
diff
changeset
|
6 |
-- Could be done much cleaner if mod_s2s was using util.async |
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
7 |
|
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
8 |
|
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
9 |
module:set_global(); |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
10 |
|
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
11 |
local dns_lookup = require"net.adns".lookup; |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
12 |
local hashes = require"util.hashes"; |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
13 |
local base64 = require"util.encodings".base64; |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
14 |
|
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
15 |
local s2sout = module:depends"s2s".route_to_new_session.s2sout; |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
16 |
|
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
17 |
local pat = "%-%-%-%-%-BEGIN ([A-Z ]+)%-%-%-%-%-\r?\n".. |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
18 |
"([0-9A-Za-z=+/\r\n]*)\r?\n%-%-%-%-%-END %1%-%-%-%-%-"; |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
19 |
local function pem2der(pem) |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
20 |
local typ, data = pem:match(pat); |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
21 |
if typ and data then |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
22 |
return base64.decode(data), typ; |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
23 |
end |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
24 |
end |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
25 |
|
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
26 |
-- TODO Things to test/handle: |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
27 |
-- Negative or bogus answers |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
28 |
-- No SRV records |
1327
b93f45c42044
mod_s2s_auth_dane: Comment updates
Kim Alvefur <zash@zash.se>
parents:
1325
diff
changeset
|
29 |
-- No encryption offered |
1334
100da6a5525e
mod_s2s_auth_dane: More comment changes
Kim Alvefur <zash@zash.se>
parents:
1333
diff
changeset
|
30 |
-- Different hostname before and after STARTTLS - mod_s2s should complain |
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
31 |
|
1332
08a0241f5d2c
mod_s2s_auth_dane: Add some comments
Kim Alvefur <zash@zash.se>
parents:
1330
diff
changeset
|
32 |
-- This function is called when a new SRV target has been picked |
08a0241f5d2c
mod_s2s_auth_dane: Add some comments
Kim Alvefur <zash@zash.se>
parents:
1330
diff
changeset
|
33 |
-- the original function does A/AAAA resolution before continuing |
08a0241f5d2c
mod_s2s_auth_dane: Add some comments
Kim Alvefur <zash@zash.se>
parents:
1330
diff
changeset
|
34 |
local _try_connect = s2sout.try_connect; |
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
35 |
function s2sout.try_connect(host_session, connect_host, connect_port, err) |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
36 |
local srv_hosts = host_session.srv_hosts; |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
37 |
local srv_choice = host_session.srv_choice; |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
38 |
if srv_hosts and srv_hosts.answer.secure and not srv_hosts[srv_choice].dane then |
1328
446fcda4ec45
mod_s2s_auth_dane: Delay s2sout state machine until we get TLSA reply
Kim Alvefur <zash@zash.se>
parents:
1327
diff
changeset
|
39 |
srv_hosts[srv_choice].dane = dns_lookup(function(answer) |
1262
1e84eebf3f46
mod_s2s_auth_dane: Invalidate trust if there are TLSA records but no matches, or bogus results
Kim Alvefur <zash@zash.se>
parents:
1261
diff
changeset
|
40 |
if answer and ( #answer > 0 or answer.bogus ) then |
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
41 |
srv_hosts[srv_choice].dane = answer; |
1328
446fcda4ec45
mod_s2s_auth_dane: Delay s2sout state machine until we get TLSA reply
Kim Alvefur <zash@zash.se>
parents:
1327
diff
changeset
|
42 |
else |
446fcda4ec45
mod_s2s_auth_dane: Delay s2sout state machine until we get TLSA reply
Kim Alvefur <zash@zash.se>
parents:
1327
diff
changeset
|
43 |
srv_hosts[srv_choice].dane = false; |
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
44 |
end |
1328
446fcda4ec45
mod_s2s_auth_dane: Delay s2sout state machine until we get TLSA reply
Kim Alvefur <zash@zash.se>
parents:
1327
diff
changeset
|
45 |
-- "blocking" until TLSA reply, but no race condition |
446fcda4ec45
mod_s2s_auth_dane: Delay s2sout state machine until we get TLSA reply
Kim Alvefur <zash@zash.se>
parents:
1327
diff
changeset
|
46 |
return _try_connect(host_session, connect_host, connect_port, err); |
1266 | 47 |
end, ("_%d._tcp.%s"):format(connect_port, connect_host), "TLSA"); |
1328
446fcda4ec45
mod_s2s_auth_dane: Delay s2sout state machine until we get TLSA reply
Kim Alvefur <zash@zash.se>
parents:
1327
diff
changeset
|
48 |
return true |
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
49 |
end |
1266 | 50 |
return _try_connect(host_session, connect_host, connect_port, err); |
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
51 |
end |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
52 |
|
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
53 |
module:hook("s2s-check-certificate", function(event) |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
54 |
local session, cert = event.session, event.cert; |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
55 |
local srv_hosts = session.srv_hosts; |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
56 |
local srv_choice = session.srv_choice; |
1333
15912b077370
mod_s2s_auth_dane: Implement experimental method for doing DANE with client certificates on s2sin
Kim Alvefur <zash@zash.se>
parents:
1332
diff
changeset
|
57 |
local choosen = srv_hosts and srv_hosts[srv_choice] or session; |
15912b077370
mod_s2s_auth_dane: Implement experimental method for doing DANE with client certificates on s2sin
Kim Alvefur <zash@zash.se>
parents:
1332
diff
changeset
|
58 |
if choosen.dane then |
1266 | 59 |
local use, select, match, tlsa, certdata, match_found; |
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
60 |
for i, rr in ipairs(choosen.dane) do |
1266 | 61 |
tlsa = rr.tlsa; |
1335
faf4bd226cad
mod_s2s_auth_dane: Improve logging
Kim Alvefur <zash@zash.se>
parents:
1334
diff
changeset
|
62 |
module:log("debug", "TLSA %s %s %s %d bytes of data", tlsa:getUsage(), tlsa:getSelector(), tlsa:getMatchType(), #tlsa.data); |
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
63 |
use, select, match, certdata = tlsa.use, tlsa.select, tlsa.match; |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
64 |
|
1327
b93f45c42044
mod_s2s_auth_dane: Comment updates
Kim Alvefur <zash@zash.se>
parents:
1325
diff
changeset
|
65 |
-- PKIX-EE or DANE-EE |
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
66 |
if use == 1 or use == 3 then |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
67 |
|
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
68 |
if select == 0 then |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
69 |
certdata = pem2der(cert:pem()); |
1329
8d99b9c4cf0c
mod_s2s_auth_dane: Verify that the pubkey method exists when the SPKI selector is used
Kim Alvefur <zash@zash.se>
parents:
1328
diff
changeset
|
70 |
elseif select == 1 and cert.pubkey then |
1334
100da6a5525e
mod_s2s_auth_dane: More comment changes
Kim Alvefur <zash@zash.se>
parents:
1333
diff
changeset
|
71 |
certdata = pem2der(cert:pubkey()); -- Not supported in stock LuaSec |
1261
6a37bd22c8df
mod_s2s_auth_dane: Warn about unsupported DANE params
Kim Alvefur <zash@zash.se>
parents:
1258
diff
changeset
|
72 |
else |
1335
faf4bd226cad
mod_s2s_auth_dane: Improve logging
Kim Alvefur <zash@zash.se>
parents:
1334
diff
changeset
|
73 |
module:log("warn", "DANE selector %s is unsupported", tlsa:getSelector() or select); |
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
74 |
end |
1327
b93f45c42044
mod_s2s_auth_dane: Comment updates
Kim Alvefur <zash@zash.se>
parents:
1325
diff
changeset
|
75 |
|
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
76 |
if match == 1 then |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
77 |
certdata = hashes.sha256(certdata); |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
78 |
elseif match == 2 then |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
79 |
certdata = hashes.sha512(certdata); |
1261
6a37bd22c8df
mod_s2s_auth_dane: Warn about unsupported DANE params
Kim Alvefur <zash@zash.se>
parents:
1258
diff
changeset
|
80 |
elseif match ~= 0 then |
1335
faf4bd226cad
mod_s2s_auth_dane: Improve logging
Kim Alvefur <zash@zash.se>
parents:
1334
diff
changeset
|
81 |
module:log("warn", "DANE match rule %s is unsupported", tlsa:getMatchType() or match); |
1266 | 82 |
certdata = nil; |
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
83 |
end |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
84 |
|
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
85 |
-- Should we check if the cert subject matches? |
1261
6a37bd22c8df
mod_s2s_auth_dane: Warn about unsupported DANE params
Kim Alvefur <zash@zash.se>
parents:
1258
diff
changeset
|
86 |
if certdata and certdata == tlsa.data then |
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
87 |
(session.log or module._log)("info", "DANE validation successful"); |
1266 | 88 |
session.cert_identity_status = "valid"; |
1327
b93f45c42044
mod_s2s_auth_dane: Comment updates
Kim Alvefur <zash@zash.se>
parents:
1325
diff
changeset
|
89 |
if use == 3 then -- DANE-EE, chain status equals DNSSEC chain status |
1266 | 90 |
session.cert_chain_status = "valid"; |
1327
b93f45c42044
mod_s2s_auth_dane: Comment updates
Kim Alvefur <zash@zash.se>
parents:
1325
diff
changeset
|
91 |
-- for usage 1, PKIX-EE, the chain has to be valid already |
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
92 |
end |
1266 | 93 |
match_found = true; |
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
94 |
break; |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
95 |
end |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
96 |
else |
1335
faf4bd226cad
mod_s2s_auth_dane: Improve logging
Kim Alvefur <zash@zash.se>
parents:
1334
diff
changeset
|
97 |
module:log("warn", "DANE usage %s is unsupported", tlsa:getUsage() or use); |
1334
100da6a5525e
mod_s2s_auth_dane: More comment changes
Kim Alvefur <zash@zash.se>
parents:
1333
diff
changeset
|
98 |
-- PKIX-TA checks needs to loop over the chain and stuff |
100da6a5525e
mod_s2s_auth_dane: More comment changes
Kim Alvefur <zash@zash.se>
parents:
1333
diff
changeset
|
99 |
-- LuaSec does not expose anything for validating a random chain, so DANE-TA is not possible atm |
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
100 |
end |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
101 |
end |
1262
1e84eebf3f46
mod_s2s_auth_dane: Invalidate trust if there are TLSA records but no matches, or bogus results
Kim Alvefur <zash@zash.se>
parents:
1261
diff
changeset
|
102 |
if not match_found then |
1332
08a0241f5d2c
mod_s2s_auth_dane: Add some comments
Kim Alvefur <zash@zash.se>
parents:
1330
diff
changeset
|
103 |
-- No TLSA matched or response was bogus |
1265
020165014e56
mod_s2s_auth_dane: Fix wording on validation failure
Kim Alvefur <zash@zash.se>
parents:
1262
diff
changeset
|
104 |
(session.log or module._log)("warn", "DANE validation failed"); |
1262
1e84eebf3f46
mod_s2s_auth_dane: Invalidate trust if there are TLSA records but no matches, or bogus results
Kim Alvefur <zash@zash.se>
parents:
1261
diff
changeset
|
105 |
session.cert_identity_status = "invalid"; |
1e84eebf3f46
mod_s2s_auth_dane: Invalidate trust if there are TLSA records but no matches, or bogus results
Kim Alvefur <zash@zash.se>
parents:
1261
diff
changeset
|
106 |
session.cert_chain_status = "invalid"; |
1e84eebf3f46
mod_s2s_auth_dane: Invalidate trust if there are TLSA records but no matches, or bogus results
Kim Alvefur <zash@zash.se>
parents:
1261
diff
changeset
|
107 |
end |
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
108 |
end |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
109 |
end); |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
110 |
|
1330
bb6f3312ab46
mod_s2s_auth_dane: Don't allow unencrypted connections if TLSA exists
Kim Alvefur <zash@zash.se>
parents:
1329
diff
changeset
|
111 |
function module.add_host(module) |
bb6f3312ab46
mod_s2s_auth_dane: Don't allow unencrypted connections if TLSA exists
Kim Alvefur <zash@zash.se>
parents:
1329
diff
changeset
|
112 |
module:hook("s2s-authenticated", function(event) |
bb6f3312ab46
mod_s2s_auth_dane: Don't allow unencrypted connections if TLSA exists
Kim Alvefur <zash@zash.se>
parents:
1329
diff
changeset
|
113 |
local session = event.session; |
bb6f3312ab46
mod_s2s_auth_dane: Don't allow unencrypted connections if TLSA exists
Kim Alvefur <zash@zash.se>
parents:
1329
diff
changeset
|
114 |
local srv_hosts = session.srv_hosts; |
bb6f3312ab46
mod_s2s_auth_dane: Don't allow unencrypted connections if TLSA exists
Kim Alvefur <zash@zash.se>
parents:
1329
diff
changeset
|
115 |
local srv_choice = session.srv_choice; |
1333
15912b077370
mod_s2s_auth_dane: Implement experimental method for doing DANE with client certificates on s2sin
Kim Alvefur <zash@zash.se>
parents:
1332
diff
changeset
|
116 |
if (session.dane or srv_hosts and srv_hosts[srv_choice].dane) and not session.secure then |
1330
bb6f3312ab46
mod_s2s_auth_dane: Don't allow unencrypted connections if TLSA exists
Kim Alvefur <zash@zash.se>
parents:
1329
diff
changeset
|
117 |
-- TLSA record but no TLS, not ok. |
1332
08a0241f5d2c
mod_s2s_auth_dane: Add some comments
Kim Alvefur <zash@zash.se>
parents:
1330
diff
changeset
|
118 |
-- TODO Optional? |
1334
100da6a5525e
mod_s2s_auth_dane: More comment changes
Kim Alvefur <zash@zash.se>
parents:
1333
diff
changeset
|
119 |
-- Bogus replies will trigger this path |
1330
bb6f3312ab46
mod_s2s_auth_dane: Don't allow unencrypted connections if TLSA exists
Kim Alvefur <zash@zash.se>
parents:
1329
diff
changeset
|
120 |
session:close({ |
bb6f3312ab46
mod_s2s_auth_dane: Don't allow unencrypted connections if TLSA exists
Kim Alvefur <zash@zash.se>
parents:
1329
diff
changeset
|
121 |
condition = "policy-violation", |
bb6f3312ab46
mod_s2s_auth_dane: Don't allow unencrypted connections if TLSA exists
Kim Alvefur <zash@zash.se>
parents:
1329
diff
changeset
|
122 |
text = "Encrypted server-to-server communication is required but was not " |
bb6f3312ab46
mod_s2s_auth_dane: Don't allow unencrypted connections if TLSA exists
Kim Alvefur <zash@zash.se>
parents:
1329
diff
changeset
|
123 |
..((session.direction == "outgoing" and "offered") or "used") |
bb6f3312ab46
mod_s2s_auth_dane: Don't allow unencrypted connections if TLSA exists
Kim Alvefur <zash@zash.se>
parents:
1329
diff
changeset
|
124 |
}); |
bb6f3312ab46
mod_s2s_auth_dane: Don't allow unencrypted connections if TLSA exists
Kim Alvefur <zash@zash.se>
parents:
1329
diff
changeset
|
125 |
return false; |
bb6f3312ab46
mod_s2s_auth_dane: Don't allow unencrypted connections if TLSA exists
Kim Alvefur <zash@zash.se>
parents:
1329
diff
changeset
|
126 |
end |
bb6f3312ab46
mod_s2s_auth_dane: Don't allow unencrypted connections if TLSA exists
Kim Alvefur <zash@zash.se>
parents:
1329
diff
changeset
|
127 |
end); |
1333
15912b077370
mod_s2s_auth_dane: Implement experimental method for doing DANE with client certificates on s2sin
Kim Alvefur <zash@zash.se>
parents:
1332
diff
changeset
|
128 |
|
15912b077370
mod_s2s_auth_dane: Implement experimental method for doing DANE with client certificates on s2sin
Kim Alvefur <zash@zash.se>
parents:
1332
diff
changeset
|
129 |
-- DANE for s2sin |
15912b077370
mod_s2s_auth_dane: Implement experimental method for doing DANE with client certificates on s2sin
Kim Alvefur <zash@zash.se>
parents:
1332
diff
changeset
|
130 |
-- Looks for TLSA at the same QNAME as the SRV record |
1336
ae0558230e3d
mod_s2s_auth_dane: Do DANE lookups on outgoing stream features
Kim Alvefur <zash@zash.se>
parents:
1335
diff
changeset
|
131 |
module:hook("s2s-stream-features", function(event) |
1333
15912b077370
mod_s2s_auth_dane: Implement experimental method for doing DANE with client certificates on s2sin
Kim Alvefur <zash@zash.se>
parents:
1332
diff
changeset
|
132 |
local origin = event.origin; |
1336
ae0558230e3d
mod_s2s_auth_dane: Do DANE lookups on outgoing stream features
Kim Alvefur <zash@zash.se>
parents:
1335
diff
changeset
|
133 |
if not origin.from_host or origin.dane == nil then return end |
1333
15912b077370
mod_s2s_auth_dane: Implement experimental method for doing DANE with client certificates on s2sin
Kim Alvefur <zash@zash.se>
parents:
1332
diff
changeset
|
134 |
|
15912b077370
mod_s2s_auth_dane: Implement experimental method for doing DANE with client certificates on s2sin
Kim Alvefur <zash@zash.se>
parents:
1332
diff
changeset
|
135 |
origin.dane = dns_lookup(function(answer) |
15912b077370
mod_s2s_auth_dane: Implement experimental method for doing DANE with client certificates on s2sin
Kim Alvefur <zash@zash.se>
parents:
1332
diff
changeset
|
136 |
if answer and ( #answer > 0 or answer.bogus ) then |
15912b077370
mod_s2s_auth_dane: Implement experimental method for doing DANE with client certificates on s2sin
Kim Alvefur <zash@zash.se>
parents:
1332
diff
changeset
|
137 |
origin.dane = answer; |
15912b077370
mod_s2s_auth_dane: Implement experimental method for doing DANE with client certificates on s2sin
Kim Alvefur <zash@zash.se>
parents:
1332
diff
changeset
|
138 |
else |
15912b077370
mod_s2s_auth_dane: Implement experimental method for doing DANE with client certificates on s2sin
Kim Alvefur <zash@zash.se>
parents:
1332
diff
changeset
|
139 |
origin.dane = false; |
15912b077370
mod_s2s_auth_dane: Implement experimental method for doing DANE with client certificates on s2sin
Kim Alvefur <zash@zash.se>
parents:
1332
diff
changeset
|
140 |
end |
15912b077370
mod_s2s_auth_dane: Implement experimental method for doing DANE with client certificates on s2sin
Kim Alvefur <zash@zash.se>
parents:
1332
diff
changeset
|
141 |
-- "blocking" until TLSA reply, but no race condition |
15912b077370
mod_s2s_auth_dane: Implement experimental method for doing DANE with client certificates on s2sin
Kim Alvefur <zash@zash.se>
parents:
1332
diff
changeset
|
142 |
end, ("_xmpp-server._tcp.%s"):format(origin.from_host), "TLSA"); |
15912b077370
mod_s2s_auth_dane: Implement experimental method for doing DANE with client certificates on s2sin
Kim Alvefur <zash@zash.se>
parents:
1332
diff
changeset
|
143 |
end, 1); |
1330
bb6f3312ab46
mod_s2s_auth_dane: Don't allow unencrypted connections if TLSA exists
Kim Alvefur <zash@zash.se>
parents:
1329
diff
changeset
|
144 |
end |
bb6f3312ab46
mod_s2s_auth_dane: Don't allow unencrypted connections if TLSA exists
Kim Alvefur <zash@zash.se>
parents:
1329
diff
changeset
|
145 |
|
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
146 |
function module.unload() |
1332
08a0241f5d2c
mod_s2s_auth_dane: Add some comments
Kim Alvefur <zash@zash.se>
parents:
1330
diff
changeset
|
147 |
-- Restore the original try_connect function |
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
148 |
s2sout.try_connect = _try_connect; |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
149 |
end |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
150 |