From f86d1517ce1c6ad3eeebcfb9f57d3689f6f9e943 Mon Sep 17 00:00:00 2001 From: Matthew Wild Date: Mon, 25 Apr 2022 15:07:49 +0100 Subject: mod_s2s: Improve robustness of outgoing s2s certificate verification This change ensures we have positively verified the certificates of the server we are connecting to before marking the session as authenticated. It protects against situations where the verify-or-close stage of the connection was interrupted (e.g. due to an uncaught error). Thanks to Zash for discovery and testing. --- plugins/mod_s2s.lua | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/plugins/mod_s2s.lua b/plugins/mod_s2s.lua index 3ad0f521..e810c6cd 100644 --- a/plugins/mod_s2s.lua +++ b/plugins/mod_s2s.lua @@ -349,6 +349,15 @@ function make_authenticated(event) }, nil, "Could not establish encrypted connection to remote server"); end end + + if session.type == "s2sout_unauthed" and not session.authenticated_remote and secure_auth and not insecure_domains[host] then + session:close({ + condition = "policy-violation"; + text = "Failed to verify certificate (internal error)"; + }); + return; + end + if hosts[host] then session:close({ condition = "undefined-condition", text = "Attempt to authenticate as a host we serve" }); end @@ -531,6 +540,8 @@ function stream_callbacks._streamopened(session, attr) if session.secure and not session.cert_chain_status then if check_cert_status(session) == false then return; + else + session.authenticated_remote = true; end end -- cgit v1.2.3 From 0eef6dde1e3193ec86f949acc114e91c36c5f365 Mon Sep 17 00:00:00 2001 From: Matthew Wild Date: Mon, 25 Apr 2022 15:09:41 +0100 Subject: util.argparse: Return final 'arg' table with positional arguments for convenience This is the same as the input table (which is mutated during processing), but if that table was created on the fly, such as by packing `...` it's convenient if it also gets returned from the parse function. --- util/argparse.lua | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/util/argparse.lua b/util/argparse.lua index c08a857c..6d227b5b 100644 --- a/util/argparse.lua +++ b/util/argparse.lua @@ -5,7 +5,7 @@ local function parse(arg, config) local parsed_opts = {}; if #arg == 0 then - return parsed_opts; + return parsed_opts, arg; end while true do local raw_param = arg[1]; @@ -47,7 +47,7 @@ local function parse(arg, config) end parsed_opts[param_k] = param_v; end - return parsed_opts; + return parsed_opts, arg; end return { -- cgit v1.2.3