aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorKim Alvefur <zash@zash.se>2024-01-11 07:53:06 +0100
committerKim Alvefur <zash@zash.se>2024-01-11 07:53:06 +0100
commit2dba3989e764de68b04181bd9c32fabb518d583d (patch)
treeac05f541cc485988e0c2fbaebc7e9e3cc002b905
parentcb66977bd4d4a250d952d63f80546843216d678b (diff)
downloadprosody-2dba3989e764de68b04181bd9c32fabb518d583d.tar.gz
prosody-2dba3989e764de68b04181bd9c32fabb518d583d.zip
mod_s2s_auth_dane_in: Simplify result processing
Fewer loops
-rw-r--r--plugins/mod_s2s_auth_dane_in.lua44
1 files changed, 26 insertions, 18 deletions
diff --git a/plugins/mod_s2s_auth_dane_in.lua b/plugins/mod_s2s_auth_dane_in.lua
index 777fa582..26df0de9 100644
--- a/plugins/mod_s2s_auth_dane_in.lua
+++ b/plugins/mod_s2s_auth_dane_in.lua
@@ -24,6 +24,20 @@ local function ensure_secure(r)
return r;
end
+local function flatten(a)
+ local seen = {};
+ local ret = {};
+ for _, rrset in ipairs(a) do
+ for _, rr in ipairs(rrset) do
+ if not seen[tostring(rr)] then
+ table.insert(ret, rr);
+ seen[tostring(rr)] = true;
+ end
+ end
+ end
+ return ret;
+end
+
local lazy_tlsa_mt = {
__index = function(t, i)
if i == 1 then
@@ -73,36 +87,30 @@ module:hook("s2s-check-certificate", function(event)
if rr.srv.target == "." then return {}; end
table.insert(tlsas, resolver:lookup_promise(("_%d._tcp.%s"):format(rr.srv.port, rr.srv.target), "TLSA"):next(ensure_secure));
end
- return promise.all(tlsas);
+ return promise.all(tlsas):next(flatten);
end
local ret = async.wait_for(promise.all({
resolver:lookup_promise("_xmpps-server._tcp." .. dns_domain, "SRV"):next(ensure_secure):next(fetch_tlsa);
resolver:lookup_promise("_xmpp-server._tcp." .. dns_domain, "SRV"):next(ensure_secure):next(fetch_tlsa);
- }));
+ }):next(flatten));
if not ret then
return
end
local found_supported = false;
- for _, by_proto in ipairs(ret) do
- for _, by_srv in ipairs(by_proto) do
- for _, by_target in ipairs(by_srv) do
- for _, rr in ipairs(by_target) do
- if rr.tlsa.use == 3 and by_select_match[rr.tlsa.select] and rr.tlsa.match <= 2 then
- found_supported = true;
- if rr.tlsa.data == by_select_match[rr.tlsa.select][rr.tlsa.match] then
- module:log("debug", "%s matches", rr)
- session.cert_chain_status = "valid";
- session.cert_identity_status = "valid";
- return true;
- end
- else
- log("debug", "Unsupported DANE TLSA record: %s", rr);
- end
- end
+ for _, rr in ipairs(ret) do
+ if rr.tlsa.use == 3 and by_select_match[rr.tlsa.select] and rr.tlsa.match <= 2 then
+ found_supported = true;
+ if rr.tlsa.data == by_select_match[rr.tlsa.select][rr.tlsa.match] then
+ module:log("debug", "%s matches", rr)
+ session.cert_chain_status = "valid";
+ session.cert_identity_status = "valid";
+ return true;
end
+ else
+ log("debug", "Unsupported DANE TLSA record: %s", rr);
end
end