From bd170409998f293bc35db5569a4f3cfc432f9c2f Mon Sep 17 00:00:00 2001 From: Kim Alvefur Date: Fri, 25 Jul 2014 20:41:54 +0200 Subject: mod_s2s_auth_certs: Split PKIX based certificate checking from mod_s2s into new plugin --- plugins/mod_s2s_auth_certs.lua | 45 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 plugins/mod_s2s_auth_certs.lua (limited to 'plugins/mod_s2s_auth_certs.lua') diff --git a/plugins/mod_s2s_auth_certs.lua b/plugins/mod_s2s_auth_certs.lua new file mode 100644 index 00000000..be81f51b --- /dev/null +++ b/plugins/mod_s2s_auth_certs.lua @@ -0,0 +1,45 @@ +module:set_global(); + +local cert_verify_identity = require "util.x509".verify_identity; +local NULL = {}; +local log = module._log; + +module:hook("s2s-check-certificate", function(event) + local session, host, cert = event.session, event.host, event.cert; + local conn = session.conn:socket(); + + if cert then + local chain_valid, errors; + if conn.getpeerverification then + chain_valid, errors = conn:getpeerverification(); + elseif conn.getpeerchainvalid then -- COMPAT mw/luasec-hg + chain_valid, errors = conn:getpeerchainvalid(); + errors = (not chain_valid) and { { errors } } or nil; + else + chain_valid, errors = false, { { "Chain verification not supported by this version of LuaSec" } }; + end + -- Is there any interest in printing out all/the number of errors here? + if not chain_valid then + (session.log or log)("debug", "certificate chain validation result: invalid"); + for depth, t in pairs(errors or NULL) do + (session.log or log)("debug", "certificate error(s) at depth %d: %s", depth-1, table.concat(t, ", ")) + end + session.cert_chain_status = "invalid"; + else + (session.log or log)("debug", "certificate chain validation result: valid"); + session.cert_chain_status = "valid"; + + -- We'll go ahead and verify the asserted identity if the + -- connecting server specified one. + if host then + if cert_verify_identity(host, "xmpp-server", cert) then + session.cert_identity_status = "valid" + else + session.cert_identity_status = "invalid" + end + (session.log or log)("debug", "certificate identity validation result: %s", session.cert_identity_status); + end + end + end +end, 509); + -- cgit v1.2.3 From a960fa32aced10e5c55a68286eef89d78a3748e9 Mon Sep 17 00:00:00 2001 From: Kim Alvefur Date: Fri, 25 Jul 2014 21:03:16 +0200 Subject: mod_s2s_auth_certs: Pick a logging function once and stick with it --- plugins/mod_s2s_auth_certs.lua | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) (limited to 'plugins/mod_s2s_auth_certs.lua') diff --git a/plugins/mod_s2s_auth_certs.lua b/plugins/mod_s2s_auth_certs.lua index be81f51b..efc81130 100644 --- a/plugins/mod_s2s_auth_certs.lua +++ b/plugins/mod_s2s_auth_certs.lua @@ -9,6 +9,7 @@ module:hook("s2s-check-certificate", function(event) local conn = session.conn:socket(); if cert then + local log = session.log or log; local chain_valid, errors; if conn.getpeerverification then chain_valid, errors = conn:getpeerverification(); @@ -20,13 +21,13 @@ module:hook("s2s-check-certificate", function(event) end -- Is there any interest in printing out all/the number of errors here? if not chain_valid then - (session.log or log)("debug", "certificate chain validation result: invalid"); + log("debug", "certificate chain validation result: invalid"); for depth, t in pairs(errors or NULL) do - (session.log or log)("debug", "certificate error(s) at depth %d: %s", depth-1, table.concat(t, ", ")) + log("debug", "certificate error(s) at depth %d: %s", depth-1, table.concat(t, ", ")) end session.cert_chain_status = "invalid"; else - (session.log or log)("debug", "certificate chain validation result: valid"); + log("debug", "certificate chain validation result: valid"); session.cert_chain_status = "valid"; -- We'll go ahead and verify the asserted identity if the @@ -37,7 +38,7 @@ module:hook("s2s-check-certificate", function(event) else session.cert_identity_status = "invalid" end - (session.log or log)("debug", "certificate identity validation result: %s", session.cert_identity_status); + log("debug", "certificate identity validation result: %s", session.cert_identity_status); end end end -- cgit v1.2.3