diff options
author | Kim Alvefur <zash@zash.se> | 2019-11-23 23:12:01 +0100 |
---|---|---|
committer | Kim Alvefur <zash@zash.se> | 2019-11-23 23:12:01 +0100 |
commit | 72f1544f6d7301d1313c333f1147b27e242063df (patch) | |
tree | 1a5b57117c8c88f05ebb8b67a0d2848988b7620c /util/x509.lua | |
parent | 7ac5e467baa7ebc557ed3a07bdca7dc9ade0c1db (diff) | |
parent | dfa2bdffc083faa597509d7f35125c41f6ffbc9d (diff) | |
download | prosody-72f1544f6d7301d1313c333f1147b27e242063df.tar.gz prosody-72f1544f6d7301d1313c333f1147b27e242063df.zip |
Merge 0.11->trunk
Diffstat (limited to 'util/x509.lua')
-rw-r--r-- | util/x509.lua | 58 |
1 files changed, 58 insertions, 0 deletions
diff --git a/util/x509.lua b/util/x509.lua index 15cc4d3c..fe6e4b79 100644 --- a/util/x509.lua +++ b/util/x509.lua @@ -20,9 +20,12 @@ local nameprep = require "util.encodings".stringprep.nameprep; local idna_to_ascii = require "util.encodings".idna.to_ascii; +local idna_to_unicode = require "util.encodings".idna.to_unicode; local base64 = require "util.encodings".base64; local log = require "util.logger".init("x509"); +local mt = require "util.multitable"; local s_format = string.format; +local ipairs = ipairs; local _ENV = nil; -- luacheck: std none @@ -216,6 +219,60 @@ local function verify_identity(host, service, cert) return false end +-- TODO Support other SANs +local function get_identities(cert) --> map of names to sets of services + if cert.setencode then + cert:setencode("utf8"); + end + + local names = mt.new(); + + local ext = cert:extensions(); + local sans = ext[oid_subjectaltname]; + if sans then + if sans["dNSName"] then -- Valid for any service + for _, name in ipairs(sans["dNSName"]) do + name = idna_to_unicode(nameprep(name)); + if name then + names:set(name, "*", true); + end + end + end + if sans[oid_xmppaddr] then + for _, name in ipairs(sans[oid_xmppaddr]) do + name = nameprep(name); + if name then + names:set(name, "xmpp-client", true); + names:set(name, "xmpp-server", true); + end + end + end + if sans[oid_dnssrv] then + for _, srvname in ipairs(sans[oid_dnssrv]) do + local srv, name = srvname:match("^_([^.]+)%.(.*)"); + if srv then + name = nameprep(name); + if name then + names:set(name, srv, true); + end + end + end + end + end + + local subject = cert:subject(); + for i = 1, #subject do + local dn = subject[i]; + if dn.oid == oid_commonname then + local name = nameprep(dn.value); + if name and idna_to_ascii(name) then + names:set("*", name, true); + end + end + end + return names.data; +end + local pat = "%-%-%-%-%-BEGIN ([A-Z ]+)%-%-%-%-%-\r?\n".. "([0-9A-Za-z+/=\r\n]*)\r?\n%-%-%-%-%-END %1%-%-%-%-%-"; @@ -237,6 +294,7 @@ end return { verify_identity = verify_identity; + get_identities = get_identities; pem2der = pem2der; der2pem = der2pem; }; |