From 8db7cdc71321f4a367338df87a7e90629e741ff9 Mon Sep 17 00:00:00 2001 From: Kim Alvefur Date: Wed, 1 Jun 2022 15:06:59 +0200 Subject: mod_saslauth: Implement RFC 9266 'tls-exporter' channel binding (#1760) Brings back SCRAM-SHA-*-PLUS from its hiatus brought on by the earlier channel binding method being undefined for TLS 1.3, and the increasing deployment of TLS 1.3. See 1bfd238e05ad and #1542 Requires future version of LuaSec, once support for this key material export method is merged. See https://github.com/brunoos/luasec/pull/187 --- net/server_epoll.lua | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'net') diff --git a/net/server_epoll.lua b/net/server_epoll.lua index a546e1e3..b269bd9c 100644 --- a/net/server_epoll.lua +++ b/net/server_epoll.lua @@ -649,6 +649,14 @@ function interface:ssl_peerfinished() return sock:getpeerfinished(); end +function interface:ssl_exportkeyingmaterial(label, len, context) + local sock = self.conn; + if sock.exportkeyingmaterial then + return sock:exportkeyingmaterial(label, len, context); + end +end + + function interface:starttls(tls_ctx) if tls_ctx then self.tls_ctx = tls_ctx; end self.starttls = false; -- cgit v1.2.3