diff options
Diffstat (limited to 'plugins/mod_s2s_auth_certs.lua')
| -rw-r--r-- | plugins/mod_s2s_auth_certs.lua | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/plugins/mod_s2s_auth_certs.lua b/plugins/mod_s2s_auth_certs.lua index dd0eb3cb..992ee934 100644 --- a/plugins/mod_s2s_auth_certs.lua +++ b/plugins/mod_s2s_auth_certs.lua @@ -4,6 +4,9 @@ local cert_verify_identity = require "util.x509".verify_identity; local NULL = {}; local log = module._log; +local measure_cert_statuses = module:metric("counter", "checked", "", "Certificate validation results", + { "chain"; "identity" }) + module:hook("s2s-check-certificate", function(event) local session, host, cert = event.session, event.host, event.cert; local conn = session.conn:socket(); @@ -17,9 +20,6 @@ module:hook("s2s-check-certificate", function(event) local chain_valid, errors; if conn.getpeerverification then chain_valid, errors = conn:getpeerverification(); - elseif conn.getpeerchainvalid then -- COMPAT mw/luasec-hg - chain_valid, errors = conn:getpeerchainvalid(); - errors = (not chain_valid) and { { errors } } or nil; else chain_valid, errors = false, { { "Chain verification not supported by this version of LuaSec" } }; end @@ -30,6 +30,7 @@ module:hook("s2s-check-certificate", function(event) log("debug", "certificate error(s) at depth %d: %s", depth-1, table.concat(t, ", ")) end session.cert_chain_status = "invalid"; + session.cert_chain_errors = errors; else log("debug", "certificate chain validation result: valid"); session.cert_chain_status = "valid"; @@ -45,5 +46,6 @@ module:hook("s2s-check-certificate", function(event) log("debug", "certificate identity validation result: %s", session.cert_identity_status); end end + measure_cert_statuses:with_labels(session.cert_chain_status or "unknown", session.cert_identity_status or "unknown"):add(1); end, 509); |