author | Kim Alvefur <zash@zash.se> |
Thu, 24 Apr 2014 18:33:13 +0200 | |
changeset 1391 | b183e78aee91 |
parent 1390 | 1fcd280c226b |
child 1392 | d99c10fc4d19 |
permissions | -rw-r--r-- |
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
1 |
-- mod_s2s_auth_dane |
1332
08a0241f5d2c
mod_s2s_auth_dane: Add some comments
Kim Alvefur <zash@zash.se>
parents:
1330
diff
changeset
|
2 |
-- Copyright (C) 2013-2014 Kim Alvefur |
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
3 |
-- |
1332
08a0241f5d2c
mod_s2s_auth_dane: Add some comments
Kim Alvefur <zash@zash.se>
parents:
1330
diff
changeset
|
4 |
-- This file is MIT/X11 licensed. |
08a0241f5d2c
mod_s2s_auth_dane: Add some comments
Kim Alvefur <zash@zash.se>
parents:
1330
diff
changeset
|
5 |
-- |
1370
e3fe6c749bc3
mod_s2s_auth_dane: Merge functionality from mod_s2s_auth_dnssec_srv
Kim Alvefur <zash@zash.se>
parents:
1368
diff
changeset
|
6 |
-- Implements DANE and Secure Delegation using DNS SRV as described in |
e3fe6c749bc3
mod_s2s_auth_dane: Merge functionality from mod_s2s_auth_dnssec_srv
Kim Alvefur <zash@zash.se>
parents:
1368
diff
changeset
|
7 |
-- http://tools.ietf.org/html/draft-miller-xmpp-dnssec-prooftype |
1349
350e903b14ff
mod_s2s_auth_dane: Comments and TODOs
Kim Alvefur <zash@zash.se>
parents:
1348
diff
changeset
|
8 |
-- |
350e903b14ff
mod_s2s_auth_dane: Comments and TODOs
Kim Alvefur <zash@zash.se>
parents:
1348
diff
changeset
|
9 |
-- Known issues: |
1332
08a0241f5d2c
mod_s2s_auth_dane: Add some comments
Kim Alvefur <zash@zash.se>
parents:
1330
diff
changeset
|
10 |
-- Could be done much cleaner if mod_s2s was using util.async |
1349
350e903b14ff
mod_s2s_auth_dane: Comments and TODOs
Kim Alvefur <zash@zash.se>
parents:
1348
diff
changeset
|
11 |
-- |
350e903b14ff
mod_s2s_auth_dane: Comments and TODOs
Kim Alvefur <zash@zash.se>
parents:
1348
diff
changeset
|
12 |
-- TODO Things to test/handle: |
350e903b14ff
mod_s2s_auth_dane: Comments and TODOs
Kim Alvefur <zash@zash.se>
parents:
1348
diff
changeset
|
13 |
-- Negative or bogus answers |
350e903b14ff
mod_s2s_auth_dane: Comments and TODOs
Kim Alvefur <zash@zash.se>
parents:
1348
diff
changeset
|
14 |
-- No encryption offered |
350e903b14ff
mod_s2s_auth_dane: Comments and TODOs
Kim Alvefur <zash@zash.se>
parents:
1348
diff
changeset
|
15 |
-- Different hostname before and after STARTTLS - mod_s2s should complain |
350e903b14ff
mod_s2s_auth_dane: Comments and TODOs
Kim Alvefur <zash@zash.se>
parents:
1348
diff
changeset
|
16 |
-- Interaction with Dialback |
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
17 |
|
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
18 |
module:set_global(); |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
19 |
|
1348
6191613959dc
mod_s2s_auth_dane: Make supported DANE usages configurable, default to DANE-EE
Kim Alvefur <zash@zash.se>
parents:
1347
diff
changeset
|
20 |
local type = type; |
1351
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
21 |
local t_insert = table.insert; |
1348
6191613959dc
mod_s2s_auth_dane: Make supported DANE usages configurable, default to DANE-EE
Kim Alvefur <zash@zash.se>
parents:
1347
diff
changeset
|
22 |
local set = require"util.set"; |
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
23 |
local dns_lookup = require"net.adns".lookup; |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
24 |
local hashes = require"util.hashes"; |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
25 |
local base64 = require"util.encodings".base64; |
1347
52b419885f0a
mod_s2s_auth_dane: Simplify, but diverge from DANE-SRV draft. Will now look for _xmpp-server.example.com IN TLSA for both directions
Kim Alvefur <zash@zash.se>
parents:
1344
diff
changeset
|
26 |
local idna_to_ascii = require "util.encodings".idna.to_ascii; |
1370
e3fe6c749bc3
mod_s2s_auth_dane: Merge functionality from mod_s2s_auth_dnssec_srv
Kim Alvefur <zash@zash.se>
parents:
1368
diff
changeset
|
27 |
local idna_to_unicode = require"util.encodings".idna.to_unicode; |
e3fe6c749bc3
mod_s2s_auth_dane: Merge functionality from mod_s2s_auth_dnssec_srv
Kim Alvefur <zash@zash.se>
parents:
1368
diff
changeset
|
28 |
local nameprep = require"util.encodings".stringprep.nameprep; |
e3fe6c749bc3
mod_s2s_auth_dane: Merge functionality from mod_s2s_auth_dnssec_srv
Kim Alvefur <zash@zash.se>
parents:
1368
diff
changeset
|
29 |
local cert_verify_identity = require "util.x509".verify_identity; |
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
30 |
|
1358
497e1df4b7ee
mod_s2s_auth_dane: Abort module loading if luaunbound is unavailable
Kim Alvefur <zash@zash.se>
parents:
1356
diff
changeset
|
31 |
if not dns_lookup.types or not dns_lookup.types.TLSA then |
497e1df4b7ee
mod_s2s_auth_dane: Abort module loading if luaunbound is unavailable
Kim Alvefur <zash@zash.se>
parents:
1356
diff
changeset
|
32 |
module:log("error", "No TLSA support available, DANE will not be supported"); |
497e1df4b7ee
mod_s2s_auth_dane: Abort module loading if luaunbound is unavailable
Kim Alvefur <zash@zash.se>
parents:
1356
diff
changeset
|
33 |
return |
497e1df4b7ee
mod_s2s_auth_dane: Abort module loading if luaunbound is unavailable
Kim Alvefur <zash@zash.se>
parents:
1356
diff
changeset
|
34 |
end |
497e1df4b7ee
mod_s2s_auth_dane: Abort module loading if luaunbound is unavailable
Kim Alvefur <zash@zash.se>
parents:
1356
diff
changeset
|
35 |
|
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
36 |
local s2sout = module:depends"s2s".route_to_new_session.s2sout; |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
37 |
|
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
38 |
local pat = "%-%-%-%-%-BEGIN ([A-Z ]+)%-%-%-%-%-\r?\n".. |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
39 |
"([0-9A-Za-z=+/\r\n]*)\r?\n%-%-%-%-%-END %1%-%-%-%-%-"; |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
40 |
local function pem2der(pem) |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
41 |
local typ, data = pem:match(pat); |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
42 |
if typ and data then |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
43 |
return base64.decode(data), typ; |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
44 |
end |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
45 |
end |
1348
6191613959dc
mod_s2s_auth_dane: Make supported DANE usages configurable, default to DANE-EE
Kim Alvefur <zash@zash.se>
parents:
1347
diff
changeset
|
46 |
local use_map = { ["DANE-EE"] = 3; ["DANE-TA"] = 2; ["PKIX-EE"] = 1; ["PKIX-CA"] = 0 } |
6191613959dc
mod_s2s_auth_dane: Make supported DANE usages configurable, default to DANE-EE
Kim Alvefur <zash@zash.se>
parents:
1347
diff
changeset
|
47 |
|
6191613959dc
mod_s2s_auth_dane: Make supported DANE usages configurable, default to DANE-EE
Kim Alvefur <zash@zash.se>
parents:
1347
diff
changeset
|
48 |
local implemented_uses = set.new { "DANE-EE", "PKIX-EE" }; |
6191613959dc
mod_s2s_auth_dane: Make supported DANE usages configurable, default to DANE-EE
Kim Alvefur <zash@zash.se>
parents:
1347
diff
changeset
|
49 |
local configured_uses = module:get_option_set("dane_uses", { "DANE-EE" }); |
6191613959dc
mod_s2s_auth_dane: Make supported DANE usages configurable, default to DANE-EE
Kim Alvefur <zash@zash.se>
parents:
1347
diff
changeset
|
50 |
local enabled_uses = set.intersection(implemented_uses, configured_uses) / function(use) return use_map[use] end; |
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
51 |
|
1351
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
52 |
local function dane_lookup(host_session, cb, a,b,c,e) |
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
53 |
if host_session.dane ~= nil then return end |
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
54 |
if host_session.direction == "incoming" then |
1362
920ac9a8480b
mod_s2s_auth_dane: Fix tb when no hostname sent by remote
Kim Alvefur <zash@zash.se>
parents:
1359
diff
changeset
|
55 |
local name = host_session.from_host and idna_to_ascii(host_session.from_host); |
1351
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
56 |
if not name then return end |
1356
a74ba847195a
mod_s2s_auth_dane: Drop support for domains without SRV for now
Kim Alvefur <zash@zash.se>
parents:
1355
diff
changeset
|
57 |
host_session.dane = dns_lookup(function (answer) |
1354
93158d5758f3
mod_s2s_auth_dane: Skip TLSA lookups if SRV is insecure
Kim Alvefur <zash@zash.se>
parents:
1353
diff
changeset
|
58 |
if not answer.secure then |
93158d5758f3
mod_s2s_auth_dane: Skip TLSA lookups if SRV is insecure
Kim Alvefur <zash@zash.se>
parents:
1353
diff
changeset
|
59 |
if cb then return cb(a,b,c,e); end |
93158d5758f3
mod_s2s_auth_dane: Skip TLSA lookups if SRV is insecure
Kim Alvefur <zash@zash.se>
parents:
1353
diff
changeset
|
60 |
return; |
93158d5758f3
mod_s2s_auth_dane: Skip TLSA lookups if SRV is insecure
Kim Alvefur <zash@zash.se>
parents:
1353
diff
changeset
|
61 |
end |
1356
a74ba847195a
mod_s2s_auth_dane: Drop support for domains without SRV for now
Kim Alvefur <zash@zash.se>
parents:
1355
diff
changeset
|
62 |
local n = #answer |
a74ba847195a
mod_s2s_auth_dane: Drop support for domains without SRV for now
Kim Alvefur <zash@zash.se>
parents:
1355
diff
changeset
|
63 |
if n == 0 then if cb then return cb(a,b,c,e); end return end |
a74ba847195a
mod_s2s_auth_dane: Drop support for domains without SRV for now
Kim Alvefur <zash@zash.se>
parents:
1355
diff
changeset
|
64 |
if n == 1 and answer[1].srv.target == '.' then return end |
1351
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
65 |
local srv_hosts = { answer = answer }; |
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
66 |
local dane = {}; |
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
67 |
host_session.dane = dane; |
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
68 |
host_session.srv_hosts = srv_hosts; |
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
69 |
for _, record in ipairs(answer) do |
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
70 |
t_insert(srv_hosts, record.srv); |
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
71 |
dns_lookup(function(dane_answer) |
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
72 |
n = n - 1; |
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
73 |
if dane_answer.bogus then |
1390
1fcd280c226b
mod_s2s_auth_dane: Remove non-working bogus handling
Kim Alvefur <zash@zash.se>
parents:
1389
diff
changeset
|
74 |
-- How to handle this? |
1351
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
75 |
elseif dane_answer.secure then |
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
76 |
for _, record in ipairs(dane_answer) do |
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
77 |
t_insert(dane, record); |
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
78 |
end |
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
79 |
end |
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
80 |
if n == 0 and cb then return cb(a,b,c,e); end |
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
81 |
end, ("_%d._tcp.%s."):format(record.srv.port, record.srv.target), "TLSA"); |
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
82 |
end |
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
83 |
end, "_xmpp-server._tcp."..name..".", "SRV"); |
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
84 |
return true; |
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
85 |
elseif host_session.direction == "outgoing" then |
1359
74769c0c79f8
mod_s2s_auth_dane: Verify that the SRV is secure
Kim Alvefur <zash@zash.se>
parents:
1358
diff
changeset
|
86 |
local srv_hosts = host_session.srv_hosts; |
74769c0c79f8
mod_s2s_auth_dane: Verify that the SRV is secure
Kim Alvefur <zash@zash.se>
parents:
1358
diff
changeset
|
87 |
if not ( srv_hosts and srv_hosts.answer and srv_hosts.answer.secure ) then return end |
74769c0c79f8
mod_s2s_auth_dane: Verify that the SRV is secure
Kim Alvefur <zash@zash.se>
parents:
1358
diff
changeset
|
88 |
local srv_choice = srv_hosts[host_session.srv_choice]; |
1351
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
89 |
host_session.dane = dns_lookup(function(answer) |
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
90 |
if answer and (answer.secure and #answer > 0) or answer.bogus then |
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
91 |
srv_choice.dane = answer; |
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
92 |
else |
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
93 |
srv_choice.dane = false; |
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
94 |
end |
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
95 |
host_session.dane = srv_choice.dane; |
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
96 |
if cb then return cb(a,b,c,e); end |
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
97 |
end, ("_%d._tcp.%s."):format(srv_choice.port, srv_choice.target), "TLSA"); |
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
98 |
return true; |
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
99 |
end |
1347
52b419885f0a
mod_s2s_auth_dane: Simplify, but diverge from DANE-SRV draft. Will now look for _xmpp-server.example.com IN TLSA for both directions
Kim Alvefur <zash@zash.se>
parents:
1344
diff
changeset
|
100 |
end |
52b419885f0a
mod_s2s_auth_dane: Simplify, but diverge from DANE-SRV draft. Will now look for _xmpp-server.example.com IN TLSA for both directions
Kim Alvefur <zash@zash.se>
parents:
1344
diff
changeset
|
101 |
|
1351
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
102 |
local _try_connect = s2sout.try_connect; |
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
103 |
function s2sout.try_connect(host_session, connect_host, connect_port, err) |
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
104 |
if not err and dane_lookup(host_session, _try_connect, host_session, connect_host, connect_port, err) then |
1347
52b419885f0a
mod_s2s_auth_dane: Simplify, but diverge from DANE-SRV draft. Will now look for _xmpp-server.example.com IN TLSA for both directions
Kim Alvefur <zash@zash.se>
parents:
1344
diff
changeset
|
105 |
return true; |
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
106 |
end |
1351
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
107 |
return _try_connect(host_session, connect_host, connect_port, err); |
1347
52b419885f0a
mod_s2s_auth_dane: Simplify, but diverge from DANE-SRV draft. Will now look for _xmpp-server.example.com IN TLSA for both directions
Kim Alvefur <zash@zash.se>
parents:
1344
diff
changeset
|
108 |
end |
52b419885f0a
mod_s2s_auth_dane: Simplify, but diverge from DANE-SRV draft. Will now look for _xmpp-server.example.com IN TLSA for both directions
Kim Alvefur <zash@zash.se>
parents:
1344
diff
changeset
|
109 |
|
52b419885f0a
mod_s2s_auth_dane: Simplify, but diverge from DANE-SRV draft. Will now look for _xmpp-server.example.com IN TLSA for both directions
Kim Alvefur <zash@zash.se>
parents:
1344
diff
changeset
|
110 |
function module.add_host(module) |
52b419885f0a
mod_s2s_auth_dane: Simplify, but diverge from DANE-SRV draft. Will now look for _xmpp-server.example.com IN TLSA for both directions
Kim Alvefur <zash@zash.se>
parents:
1344
diff
changeset
|
111 |
module:hook("s2s-stream-features", function(event) |
1351
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
112 |
-- dane_lookup(origin, origin.from_host); |
1367
103d685e2153
mod_s2s_auth_dane: Pause s2sin while doing SRV and TLSA lookups, fixes race condition (Can haz util.async plz)
Kim Alvefur <zash@zash.se>
parents:
1362
diff
changeset
|
113 |
local host_session = event.origin; |
1391
b183e78aee91
mod_s2s_auth_dane: Skip dns queries for already authenticated s2sin connections
Kim Alvefur <zash@zash.se>
parents:
1390
diff
changeset
|
114 |
if host_session.type == "s2sin" then return end -- Already authenticated |
1367
103d685e2153
mod_s2s_auth_dane: Pause s2sin while doing SRV and TLSA lookups, fixes race condition (Can haz util.async plz)
Kim Alvefur <zash@zash.se>
parents:
1362
diff
changeset
|
115 |
host_session.log("debug", "Pausing connection until DANE lookup is completed"); |
103d685e2153
mod_s2s_auth_dane: Pause s2sin while doing SRV and TLSA lookups, fixes race condition (Can haz util.async plz)
Kim Alvefur <zash@zash.se>
parents:
1362
diff
changeset
|
116 |
host_session.conn:pause() |
103d685e2153
mod_s2s_auth_dane: Pause s2sin while doing SRV and TLSA lookups, fixes race condition (Can haz util.async plz)
Kim Alvefur <zash@zash.se>
parents:
1362
diff
changeset
|
117 |
local function resume() |
1383
465e5d79551b
mod_s2s_auth_dane: Improve debug message and log it on the session
Kim Alvefur <zash@zash.se>
parents:
1370
diff
changeset
|
118 |
host_session.log("debug", "DANE lookup completed, resuming connection"); |
1367
103d685e2153
mod_s2s_auth_dane: Pause s2sin while doing SRV and TLSA lookups, fixes race condition (Can haz util.async plz)
Kim Alvefur <zash@zash.se>
parents:
1362
diff
changeset
|
119 |
host_session.conn:resume() |
103d685e2153
mod_s2s_auth_dane: Pause s2sin while doing SRV and TLSA lookups, fixes race condition (Can haz util.async plz)
Kim Alvefur <zash@zash.se>
parents:
1362
diff
changeset
|
120 |
end |
103d685e2153
mod_s2s_auth_dane: Pause s2sin while doing SRV and TLSA lookups, fixes race condition (Can haz util.async plz)
Kim Alvefur <zash@zash.se>
parents:
1362
diff
changeset
|
121 |
if not dane_lookup(host_session, resume) then |
103d685e2153
mod_s2s_auth_dane: Pause s2sin while doing SRV and TLSA lookups, fixes race condition (Can haz util.async plz)
Kim Alvefur <zash@zash.se>
parents:
1362
diff
changeset
|
122 |
resume(); |
103d685e2153
mod_s2s_auth_dane: Pause s2sin while doing SRV and TLSA lookups, fixes race condition (Can haz util.async plz)
Kim Alvefur <zash@zash.se>
parents:
1362
diff
changeset
|
123 |
end |
103d685e2153
mod_s2s_auth_dane: Pause s2sin while doing SRV and TLSA lookups, fixes race condition (Can haz util.async plz)
Kim Alvefur <zash@zash.se>
parents:
1362
diff
changeset
|
124 |
end, 10); |
1347
52b419885f0a
mod_s2s_auth_dane: Simplify, but diverge from DANE-SRV draft. Will now look for _xmpp-server.example.com IN TLSA for both directions
Kim Alvefur <zash@zash.se>
parents:
1344
diff
changeset
|
125 |
|
52b419885f0a
mod_s2s_auth_dane: Simplify, but diverge from DANE-SRV draft. Will now look for _xmpp-server.example.com IN TLSA for both directions
Kim Alvefur <zash@zash.se>
parents:
1344
diff
changeset
|
126 |
module:hook("s2s-authenticated", function(event) |
52b419885f0a
mod_s2s_auth_dane: Simplify, but diverge from DANE-SRV draft. Will now look for _xmpp-server.example.com IN TLSA for both directions
Kim Alvefur <zash@zash.se>
parents:
1344
diff
changeset
|
127 |
local session = event.session; |
52b419885f0a
mod_s2s_auth_dane: Simplify, but diverge from DANE-SRV draft. Will now look for _xmpp-server.example.com IN TLSA for both directions
Kim Alvefur <zash@zash.se>
parents:
1344
diff
changeset
|
128 |
if session.dane and not session.secure then |
52b419885f0a
mod_s2s_auth_dane: Simplify, but diverge from DANE-SRV draft. Will now look for _xmpp-server.example.com IN TLSA for both directions
Kim Alvefur <zash@zash.se>
parents:
1344
diff
changeset
|
129 |
-- TLSA record but no TLS, not ok. |
52b419885f0a
mod_s2s_auth_dane: Simplify, but diverge from DANE-SRV draft. Will now look for _xmpp-server.example.com IN TLSA for both directions
Kim Alvefur <zash@zash.se>
parents:
1344
diff
changeset
|
130 |
-- TODO Optional? |
52b419885f0a
mod_s2s_auth_dane: Simplify, but diverge from DANE-SRV draft. Will now look for _xmpp-server.example.com IN TLSA for both directions
Kim Alvefur <zash@zash.se>
parents:
1344
diff
changeset
|
131 |
-- Bogus replies should trigger this path |
52b419885f0a
mod_s2s_auth_dane: Simplify, but diverge from DANE-SRV draft. Will now look for _xmpp-server.example.com IN TLSA for both directions
Kim Alvefur <zash@zash.se>
parents:
1344
diff
changeset
|
132 |
-- How does this interact with Dialback? |
52b419885f0a
mod_s2s_auth_dane: Simplify, but diverge from DANE-SRV draft. Will now look for _xmpp-server.example.com IN TLSA for both directions
Kim Alvefur <zash@zash.se>
parents:
1344
diff
changeset
|
133 |
session:close({ |
52b419885f0a
mod_s2s_auth_dane: Simplify, but diverge from DANE-SRV draft. Will now look for _xmpp-server.example.com IN TLSA for both directions
Kim Alvefur <zash@zash.se>
parents:
1344
diff
changeset
|
134 |
condition = "policy-violation", |
52b419885f0a
mod_s2s_auth_dane: Simplify, but diverge from DANE-SRV draft. Will now look for _xmpp-server.example.com IN TLSA for both directions
Kim Alvefur <zash@zash.se>
parents:
1344
diff
changeset
|
135 |
text = "Encrypted server-to-server communication is required but was not " |
52b419885f0a
mod_s2s_auth_dane: Simplify, but diverge from DANE-SRV draft. Will now look for _xmpp-server.example.com IN TLSA for both directions
Kim Alvefur <zash@zash.se>
parents:
1344
diff
changeset
|
136 |
..((session.direction == "outgoing" and "offered") or "used") |
52b419885f0a
mod_s2s_auth_dane: Simplify, but diverge from DANE-SRV draft. Will now look for _xmpp-server.example.com IN TLSA for both directions
Kim Alvefur <zash@zash.se>
parents:
1344
diff
changeset
|
137 |
}); |
52b419885f0a
mod_s2s_auth_dane: Simplify, but diverge from DANE-SRV draft. Will now look for _xmpp-server.example.com IN TLSA for both directions
Kim Alvefur <zash@zash.se>
parents:
1344
diff
changeset
|
138 |
return false; |
52b419885f0a
mod_s2s_auth_dane: Simplify, but diverge from DANE-SRV draft. Will now look for _xmpp-server.example.com IN TLSA for both directions
Kim Alvefur <zash@zash.se>
parents:
1344
diff
changeset
|
139 |
end |
52b419885f0a
mod_s2s_auth_dane: Simplify, but diverge from DANE-SRV draft. Will now look for _xmpp-server.example.com IN TLSA for both directions
Kim Alvefur <zash@zash.se>
parents:
1344
diff
changeset
|
140 |
end); |
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
141 |
end |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
142 |
|
1389
6bd9681d54b7
mod_s2s_auth_dane: Break out DANE check into a function
Kim Alvefur <zash@zash.se>
parents:
1383
diff
changeset
|
143 |
local function one_dane_check(tlsa, cert) |
6bd9681d54b7
mod_s2s_auth_dane: Break out DANE check into a function
Kim Alvefur <zash@zash.se>
parents:
1383
diff
changeset
|
144 |
local select, match, certdata = tlsa.select, tlsa.match; |
6bd9681d54b7
mod_s2s_auth_dane: Break out DANE check into a function
Kim Alvefur <zash@zash.se>
parents:
1383
diff
changeset
|
145 |
|
6bd9681d54b7
mod_s2s_auth_dane: Break out DANE check into a function
Kim Alvefur <zash@zash.se>
parents:
1383
diff
changeset
|
146 |
if select == 0 then |
6bd9681d54b7
mod_s2s_auth_dane: Break out DANE check into a function
Kim Alvefur <zash@zash.se>
parents:
1383
diff
changeset
|
147 |
certdata = pem2der(cert:pem()); |
6bd9681d54b7
mod_s2s_auth_dane: Break out DANE check into a function
Kim Alvefur <zash@zash.se>
parents:
1383
diff
changeset
|
148 |
elseif select == 1 and cert.pubkey then |
6bd9681d54b7
mod_s2s_auth_dane: Break out DANE check into a function
Kim Alvefur <zash@zash.se>
parents:
1383
diff
changeset
|
149 |
certdata = pem2der(cert:pubkey()); |
6bd9681d54b7
mod_s2s_auth_dane: Break out DANE check into a function
Kim Alvefur <zash@zash.se>
parents:
1383
diff
changeset
|
150 |
else |
6bd9681d54b7
mod_s2s_auth_dane: Break out DANE check into a function
Kim Alvefur <zash@zash.se>
parents:
1383
diff
changeset
|
151 |
module:log("warn", "DANE selector %s is unsupported", tlsa:getSelector() or select); |
6bd9681d54b7
mod_s2s_auth_dane: Break out DANE check into a function
Kim Alvefur <zash@zash.se>
parents:
1383
diff
changeset
|
152 |
return; |
6bd9681d54b7
mod_s2s_auth_dane: Break out DANE check into a function
Kim Alvefur <zash@zash.se>
parents:
1383
diff
changeset
|
153 |
end |
6bd9681d54b7
mod_s2s_auth_dane: Break out DANE check into a function
Kim Alvefur <zash@zash.se>
parents:
1383
diff
changeset
|
154 |
|
6bd9681d54b7
mod_s2s_auth_dane: Break out DANE check into a function
Kim Alvefur <zash@zash.se>
parents:
1383
diff
changeset
|
155 |
if match == 1 then |
6bd9681d54b7
mod_s2s_auth_dane: Break out DANE check into a function
Kim Alvefur <zash@zash.se>
parents:
1383
diff
changeset
|
156 |
certdata = hashes.sha256(certdata); |
6bd9681d54b7
mod_s2s_auth_dane: Break out DANE check into a function
Kim Alvefur <zash@zash.se>
parents:
1383
diff
changeset
|
157 |
elseif match == 2 then |
6bd9681d54b7
mod_s2s_auth_dane: Break out DANE check into a function
Kim Alvefur <zash@zash.se>
parents:
1383
diff
changeset
|
158 |
certdata = hashes.sha512(certdata); |
6bd9681d54b7
mod_s2s_auth_dane: Break out DANE check into a function
Kim Alvefur <zash@zash.se>
parents:
1383
diff
changeset
|
159 |
elseif match ~= 0 then |
6bd9681d54b7
mod_s2s_auth_dane: Break out DANE check into a function
Kim Alvefur <zash@zash.se>
parents:
1383
diff
changeset
|
160 |
module:log("warn", "DANE match rule %s is unsupported", tlsa:getMatchType() or match); |
6bd9681d54b7
mod_s2s_auth_dane: Break out DANE check into a function
Kim Alvefur <zash@zash.se>
parents:
1383
diff
changeset
|
161 |
return; |
6bd9681d54b7
mod_s2s_auth_dane: Break out DANE check into a function
Kim Alvefur <zash@zash.se>
parents:
1383
diff
changeset
|
162 |
end |
6bd9681d54b7
mod_s2s_auth_dane: Break out DANE check into a function
Kim Alvefur <zash@zash.se>
parents:
1383
diff
changeset
|
163 |
|
6bd9681d54b7
mod_s2s_auth_dane: Break out DANE check into a function
Kim Alvefur <zash@zash.se>
parents:
1383
diff
changeset
|
164 |
return certdata == tlsa.data; |
6bd9681d54b7
mod_s2s_auth_dane: Break out DANE check into a function
Kim Alvefur <zash@zash.se>
parents:
1383
diff
changeset
|
165 |
end |
6bd9681d54b7
mod_s2s_auth_dane: Break out DANE check into a function
Kim Alvefur <zash@zash.se>
parents:
1383
diff
changeset
|
166 |
|
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
167 |
module:hook("s2s-check-certificate", function(event) |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
168 |
local session, cert = event.session, event.cert; |
1347
52b419885f0a
mod_s2s_auth_dane: Simplify, but diverge from DANE-SRV draft. Will now look for _xmpp-server.example.com IN TLSA for both directions
Kim Alvefur <zash@zash.se>
parents:
1344
diff
changeset
|
169 |
local dane = session.dane; |
52b419885f0a
mod_s2s_auth_dane: Simplify, but diverge from DANE-SRV draft. Will now look for _xmpp-server.example.com IN TLSA for both directions
Kim Alvefur <zash@zash.se>
parents:
1344
diff
changeset
|
170 |
if type(dane) == "table" then |
1389
6bd9681d54b7
mod_s2s_auth_dane: Break out DANE check into a function
Kim Alvefur <zash@zash.se>
parents:
1383
diff
changeset
|
171 |
local use, tlsa, match_found, supported_found, is_match; |
1347
52b419885f0a
mod_s2s_auth_dane: Simplify, but diverge from DANE-SRV draft. Will now look for _xmpp-server.example.com IN TLSA for both directions
Kim Alvefur <zash@zash.se>
parents:
1344
diff
changeset
|
172 |
for i = 1, #dane do |
52b419885f0a
mod_s2s_auth_dane: Simplify, but diverge from DANE-SRV draft. Will now look for _xmpp-server.example.com IN TLSA for both directions
Kim Alvefur <zash@zash.se>
parents:
1344
diff
changeset
|
173 |
tlsa = dane[i].tlsa; |
1335
faf4bd226cad
mod_s2s_auth_dane: Improve logging
Kim Alvefur <zash@zash.se>
parents:
1334
diff
changeset
|
174 |
module:log("debug", "TLSA %s %s %s %d bytes of data", tlsa:getUsage(), tlsa:getSelector(), tlsa:getMatchType(), #tlsa.data); |
1389
6bd9681d54b7
mod_s2s_auth_dane: Break out DANE check into a function
Kim Alvefur <zash@zash.se>
parents:
1383
diff
changeset
|
175 |
use = tlsa.use; |
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
176 |
|
1348
6191613959dc
mod_s2s_auth_dane: Make supported DANE usages configurable, default to DANE-EE
Kim Alvefur <zash@zash.se>
parents:
1347
diff
changeset
|
177 |
if enabled_uses:contains(use) then |
6191613959dc
mod_s2s_auth_dane: Make supported DANE usages configurable, default to DANE-EE
Kim Alvefur <zash@zash.se>
parents:
1347
diff
changeset
|
178 |
-- PKIX-EE or DANE-EE |
6191613959dc
mod_s2s_auth_dane: Make supported DANE usages configurable, default to DANE-EE
Kim Alvefur <zash@zash.se>
parents:
1347
diff
changeset
|
179 |
if use == 1 or use == 3 then |
1389
6bd9681d54b7
mod_s2s_auth_dane: Break out DANE check into a function
Kim Alvefur <zash@zash.se>
parents:
1383
diff
changeset
|
180 |
-- Should we check if the cert subject matches? |
6bd9681d54b7
mod_s2s_auth_dane: Break out DANE check into a function
Kim Alvefur <zash@zash.se>
parents:
1383
diff
changeset
|
181 |
is_match = one_dane_check(tlsa, cert); |
6bd9681d54b7
mod_s2s_auth_dane: Break out DANE check into a function
Kim Alvefur <zash@zash.se>
parents:
1383
diff
changeset
|
182 |
if is_match ~= nil then |
6bd9681d54b7
mod_s2s_auth_dane: Break out DANE check into a function
Kim Alvefur <zash@zash.se>
parents:
1383
diff
changeset
|
183 |
supported_found = true; |
1348
6191613959dc
mod_s2s_auth_dane: Make supported DANE usages configurable, default to DANE-EE
Kim Alvefur <zash@zash.se>
parents:
1347
diff
changeset
|
184 |
end |
1389
6bd9681d54b7
mod_s2s_auth_dane: Break out DANE check into a function
Kim Alvefur <zash@zash.se>
parents:
1383
diff
changeset
|
185 |
if is_match then |
1348
6191613959dc
mod_s2s_auth_dane: Make supported DANE usages configurable, default to DANE-EE
Kim Alvefur <zash@zash.se>
parents:
1347
diff
changeset
|
186 |
(session.log or module._log)("info", "DANE validation successful"); |
6191613959dc
mod_s2s_auth_dane: Make supported DANE usages configurable, default to DANE-EE
Kim Alvefur <zash@zash.se>
parents:
1347
diff
changeset
|
187 |
session.cert_identity_status = "valid"; |
6191613959dc
mod_s2s_auth_dane: Make supported DANE usages configurable, default to DANE-EE
Kim Alvefur <zash@zash.se>
parents:
1347
diff
changeset
|
188 |
if use == 3 then -- DANE-EE, chain status equals DNSSEC chain status |
6191613959dc
mod_s2s_auth_dane: Make supported DANE usages configurable, default to DANE-EE
Kim Alvefur <zash@zash.se>
parents:
1347
diff
changeset
|
189 |
session.cert_chain_status = "valid"; |
6191613959dc
mod_s2s_auth_dane: Make supported DANE usages configurable, default to DANE-EE
Kim Alvefur <zash@zash.se>
parents:
1347
diff
changeset
|
190 |
-- for usage 1, PKIX-EE, the chain has to be valid already |
6191613959dc
mod_s2s_auth_dane: Make supported DANE usages configurable, default to DANE-EE
Kim Alvefur <zash@zash.se>
parents:
1347
diff
changeset
|
191 |
end |
6191613959dc
mod_s2s_auth_dane: Make supported DANE usages configurable, default to DANE-EE
Kim Alvefur <zash@zash.se>
parents:
1347
diff
changeset
|
192 |
match_found = true; |
6191613959dc
mod_s2s_auth_dane: Make supported DANE usages configurable, default to DANE-EE
Kim Alvefur <zash@zash.se>
parents:
1347
diff
changeset
|
193 |
break; |
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
194 |
end |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
195 |
end |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
196 |
end |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
197 |
end |
1347
52b419885f0a
mod_s2s_auth_dane: Simplify, but diverge from DANE-SRV draft. Will now look for _xmpp-server.example.com IN TLSA for both directions
Kim Alvefur <zash@zash.se>
parents:
1344
diff
changeset
|
198 |
if supported_found and not match_found or dane.bogus then |
1332
08a0241f5d2c
mod_s2s_auth_dane: Add some comments
Kim Alvefur <zash@zash.se>
parents:
1330
diff
changeset
|
199 |
-- No TLSA matched or response was bogus |
1265
020165014e56
mod_s2s_auth_dane: Fix wording on validation failure
Kim Alvefur <zash@zash.se>
parents:
1262
diff
changeset
|
200 |
(session.log or module._log)("warn", "DANE validation failed"); |
1262
1e84eebf3f46
mod_s2s_auth_dane: Invalidate trust if there are TLSA records but no matches, or bogus results
Kim Alvefur <zash@zash.se>
parents:
1261
diff
changeset
|
201 |
session.cert_identity_status = "invalid"; |
1e84eebf3f46
mod_s2s_auth_dane: Invalidate trust if there are TLSA records but no matches, or bogus results
Kim Alvefur <zash@zash.se>
parents:
1261
diff
changeset
|
202 |
session.cert_chain_status = "invalid"; |
1e84eebf3f46
mod_s2s_auth_dane: Invalidate trust if there are TLSA records but no matches, or bogus results
Kim Alvefur <zash@zash.se>
parents:
1261
diff
changeset
|
203 |
end |
1370
e3fe6c749bc3
mod_s2s_auth_dane: Merge functionality from mod_s2s_auth_dnssec_srv
Kim Alvefur <zash@zash.se>
parents:
1368
diff
changeset
|
204 |
else |
e3fe6c749bc3
mod_s2s_auth_dane: Merge functionality from mod_s2s_auth_dnssec_srv
Kim Alvefur <zash@zash.se>
parents:
1368
diff
changeset
|
205 |
if session.cert_chain_status == "valid" and session.cert_identity_status ~= "valid" |
e3fe6c749bc3
mod_s2s_auth_dane: Merge functionality from mod_s2s_auth_dnssec_srv
Kim Alvefur <zash@zash.se>
parents:
1368
diff
changeset
|
206 |
and session.srv_hosts.answer and session.srv_hosts.answer.secure then |
e3fe6c749bc3
mod_s2s_auth_dane: Merge functionality from mod_s2s_auth_dnssec_srv
Kim Alvefur <zash@zash.se>
parents:
1368
diff
changeset
|
207 |
local srv_hosts, srv_choice, srv_target = session.srv_hosts, session.srv_choice; |
e3fe6c749bc3
mod_s2s_auth_dane: Merge functionality from mod_s2s_auth_dnssec_srv
Kim Alvefur <zash@zash.se>
parents:
1368
diff
changeset
|
208 |
for i = srv_choice or 1, srv_choice or #srv_hosts do |
e3fe6c749bc3
mod_s2s_auth_dane: Merge functionality from mod_s2s_auth_dnssec_srv
Kim Alvefur <zash@zash.se>
parents:
1368
diff
changeset
|
209 |
srv_target = nameprep(idna_to_unicode(session.srv_hosts[i].target:gsub("%.?$",""))); |
e3fe6c749bc3
mod_s2s_auth_dane: Merge functionality from mod_s2s_auth_dnssec_srv
Kim Alvefur <zash@zash.se>
parents:
1368
diff
changeset
|
210 |
(session.log or module._log)("debug", "Comparing certificate with Secure SRV target %s", srv_target); |
e3fe6c749bc3
mod_s2s_auth_dane: Merge functionality from mod_s2s_auth_dnssec_srv
Kim Alvefur <zash@zash.se>
parents:
1368
diff
changeset
|
211 |
if srv_target and cert_verify_identity(srv_target, "xmpp-server", cert) then |
e3fe6c749bc3
mod_s2s_auth_dane: Merge functionality from mod_s2s_auth_dnssec_srv
Kim Alvefur <zash@zash.se>
parents:
1368
diff
changeset
|
212 |
(session.log or module._log)("info", "Certificate matches Secure SRV target %s", srv_target); |
e3fe6c749bc3
mod_s2s_auth_dane: Merge functionality from mod_s2s_auth_dnssec_srv
Kim Alvefur <zash@zash.se>
parents:
1368
diff
changeset
|
213 |
session.cert_identity_status = "valid"; |
e3fe6c749bc3
mod_s2s_auth_dane: Merge functionality from mod_s2s_auth_dnssec_srv
Kim Alvefur <zash@zash.se>
parents:
1368
diff
changeset
|
214 |
return; |
e3fe6c749bc3
mod_s2s_auth_dane: Merge functionality from mod_s2s_auth_dnssec_srv
Kim Alvefur <zash@zash.se>
parents:
1368
diff
changeset
|
215 |
end |
e3fe6c749bc3
mod_s2s_auth_dane: Merge functionality from mod_s2s_auth_dnssec_srv
Kim Alvefur <zash@zash.se>
parents:
1368
diff
changeset
|
216 |
end |
e3fe6c749bc3
mod_s2s_auth_dane: Merge functionality from mod_s2s_auth_dnssec_srv
Kim Alvefur <zash@zash.se>
parents:
1368
diff
changeset
|
217 |
end |
1258
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
218 |
end |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
219 |
end); |
fc82d8eded7d
mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
220 |
|
1347
52b419885f0a
mod_s2s_auth_dane: Simplify, but diverge from DANE-SRV draft. Will now look for _xmpp-server.example.com IN TLSA for both directions
Kim Alvefur <zash@zash.se>
parents:
1344
diff
changeset
|
221 |
function module.unload() |
1351
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
222 |
-- Restore the original try_connect function |
a052740bbf48
mod_s2s_auth_dane: Back to _port._tcp.srvtarget.example.net
Kim Alvefur <zash@zash.se>
parents:
1350
diff
changeset
|
223 |
s2sout.try_connect = _try_connect; |
1330
bb6f3312ab46
mod_s2s_auth_dane: Don't allow unencrypted connections if TLSA exists
Kim Alvefur <zash@zash.se>
parents:
1329
diff
changeset
|
224 |
end |
bb6f3312ab46
mod_s2s_auth_dane: Don't allow unencrypted connections if TLSA exists
Kim Alvefur <zash@zash.se>
parents:
1329
diff
changeset
|
225 |