From 331f2d40e1cc454511cc5955ab4f1222a0e19357 Mon Sep 17 00:00:00 2001 From: Kim Alvefur Date: Thu, 11 Jan 2024 07:54:11 +0100 Subject: mod_s2s_auth_dane_in: Try single TLSA lookup per draft-ietf-dance-client-auth Moves some complexity from the implementation into DNS operations. --- doc/doap.xml | 1 + plugins/mod_s2s_auth_dane_in.lua | 15 +++++++++++---- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/doc/doap.xml b/doc/doap.xml index 79ef9d68..c5501be2 100644 --- a/doc/doap.xml +++ b/doc/doap.xml @@ -67,6 +67,7 @@ + diff --git a/plugins/mod_s2s_auth_dane_in.lua b/plugins/mod_s2s_auth_dane_in.lua index 26df0de9..9167e8a9 100644 --- a/plugins/mod_s2s_auth_dane_in.lua +++ b/plugins/mod_s2s_auth_dane_in.lua @@ -24,6 +24,11 @@ local function ensure_secure(r) return r; end +local function ensure_nonempty(r) + assert(r[1], "empty"); + return r; +end + local function flatten(a) local seen = {}; local ret = {}; @@ -90,10 +95,12 @@ module:hook("s2s-check-certificate", function(event) return promise.all(tlsas):next(flatten); end - local ret = async.wait_for(promise.all({ - resolver:lookup_promise("_xmpps-server._tcp." .. dns_domain, "SRV"):next(ensure_secure):next(fetch_tlsa); - resolver:lookup_promise("_xmpp-server._tcp." .. dns_domain, "SRV"):next(ensure_secure):next(fetch_tlsa); - }):next(flatten)); + local ret = async.wait_for(resolver:lookup_promise("_xmpp-server." .. dns_domain, "TLSA"):next(ensure_secure):next(ensure_nonempty):catch(function() + return promise.all({ + resolver:lookup_promise("_xmpps-server._tcp." .. dns_domain, "SRV"):next(ensure_secure):next(fetch_tlsa); + resolver:lookup_promise("_xmpp-server._tcp." .. dns_domain, "SRV"):next(ensure_secure):next(fetch_tlsa); + }):next(flatten); + end)); if not ret then return -- cgit v1.2.3