diff options
| -rw-r--r-- | plugins/mod_admin_telnet.lua | 2 | ||||
| -rw-r--r-- | plugins/mod_s2s/mod_s2s.lua | 5 | ||||
| -rw-r--r-- | util-src/hashes.c | 2 |
3 files changed, 5 insertions, 4 deletions
diff --git a/plugins/mod_admin_telnet.lua b/plugins/mod_admin_telnet.lua index 6fc378bb..18ae4fe0 100644 --- a/plugins/mod_admin_telnet.lua +++ b/plugins/mod_admin_telnet.lua @@ -670,7 +670,7 @@ end -- I think there's going to be more confusion among operators if we -- break from that. local function print_errors(print, errors) - for depth, t in ipairs(errors) do + for depth, t in pairs(errors) do print( (" %d: %s"):format( depth-1, diff --git a/plugins/mod_s2s/mod_s2s.lua b/plugins/mod_s2s/mod_s2s.lua index b6614d2f..c628dc47 100644 --- a/plugins/mod_s2s/mod_s2s.lua +++ b/plugins/mod_s2s/mod_s2s.lua @@ -246,7 +246,7 @@ local function check_cert_status(session) -- Is there any interest in printing out all/the number of errors here? if not chain_valid then (session.log or log)("debug", "certificate chain validation result: invalid"); - for depth, t in ipairs(errors or NULL) do + for depth, t in pairs(errors or NULL) do (session.log or log)("debug", "certificate error(s) at depth %d: %s", depth-1, table.concat(t, ", ")) end session.cert_chain_status = "invalid"; @@ -262,6 +262,7 @@ local function check_cert_status(session) else session.cert_identity_status = "invalid" end + (session.log or log)("debug", "certificate identity validation result: %s", session.cert_identity_status); end end end @@ -658,7 +659,7 @@ function check_auth_policy(event) must_secure = false; end - if must_secure and not session.cert_identity_status then + if must_secure and (session.cert_chain_status ~= "valid" or session.cert_identity_status ~= "valid") then module:log("warn", "Forbidding insecure connection to/from %s", host); if session.direction == "incoming" then session:close({ condition = "not-authorized", text = "Your server's certificate is invalid, expired, or not trusted by "..session.to_host }); diff --git a/util-src/hashes.c b/util-src/hashes.c index 39737ae0..ad25c1a7 100644 --- a/util-src/hashes.c +++ b/util-src/hashes.c @@ -85,7 +85,7 @@ static void hmac(struct hash_desc *desc, const char *key, size_t key_len, if (key_len > 64) { desc->Init(desc->ctx); desc->Update(desc->ctx, key, key_len); - desc->Final(desc->ctx, hashedKey); + desc->Final(hashedKey, desc->ctx); key = (const char*)hashedKey; key_len = desc->digestLength; } |