prosody-modules: mod_client_certs/mod_client

annotate mod_client_certs/mod_client_certs.lua @ 698:3a3293f37139

mod_client_certs: Fix the checking of valid id_on_xmppAddr fields.

author	Thijs Alkemade <thijsalkemade@gmail.com>
date	Tue, 05 Jun 2012 20:47:02 +0200
parents	c3337f62a538
children	151743149f07

rev	line source
695 f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	1 -- XEP-0257: Client Certificates Management implementation for Prosody
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	2 -- Copyright (C) 2012 Thijs Alkemade
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	3 --
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	4 -- This file is MIT/X11 licensed.
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	5
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	6 local st = require "util.stanza";
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	7 local jid_bare = require "util.jid".bare;
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	8 local xmlns_saslcert = "urn:xmpp:saslcert:0";
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	9 local xmlns_pubkey = "urn:xmpp:tmp:pubkey";
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	10 local dm_load = require "util.datamanager".load;
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	11 local dm_store = require "util.datamanager".store;
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	12 local dm_table = "client_certs";
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	13 local x509 = require "ssl.x509";
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	14 local id_on_xmppAddr = "1.3.6.1.5.5.7.8.5";
698 3a3293f37139 mod_client_certs: Fix the checking of valid id_on_xmppAddr fields. Thijs Alkemade <thijsalkemade@gmail.com> parents: 697 diff changeset	15 local id_ce_subjectAltName = "2.5.29.17";
695 f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	16 local digest_algo = "sha1";
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	17
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	18 local function enable_cert(username, cert, info)
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	19 local certs = dm_load(username, module.host, dm_table) or {};
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	20 local all_certs = dm_load(nil, module.host, dm_table) or {};
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	21
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	22 info.pem = cert:pem();
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	23 local digest = cert:digest(digest_algo);
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	24 info.digest = digest;
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	25 certs[info.id] = info;
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	26 all_certs[digest] = username;
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	27 -- Or, have it be keyed by the entire PEM representation
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	28
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	29 dm_store(username, module.host, dm_table, certs);
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	30 dm_store(nil, module.host, dm_table, all_certs);
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	31 return true
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	32 end
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	33
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	34 local function disable_cert(username, name)
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	35 local certs = dm_load(username, module.host, dm_table) or {};
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	36 local all_certs = dm_load(nil, module.host, dm_table) or {};
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	37
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	38 local info = certs[name];
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	39 local cert;
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	40 if info then
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	41 certs[name] = nil;
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	42 cert = x509.cert_from_pem(info.pem);
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	43 all_certs[cert:digest(digest_algo)] = nil;
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	44 else
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	45 return nil, "item-not-found"
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	46 end
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	47
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	48 dm_store(username, module.host, dm_table, certs);
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	49 dm_store(nil, module.host, dm_table, all_certs);
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	50 return cert; -- So we can compare it with stuff
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	51 end
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	52
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	53 module:hook("iq/self/"..xmlns_saslcert..":items", function(event)
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	54 local origin, stanza = event.origin, event.stanza;
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	55 if stanza.attr.type == "get" then
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	56 module:log("debug", "%s requested items", origin.full_jid);
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	57
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	58 local reply = st.reply(stanza):tag("items", { xmlns = xmlns_saslcert });
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	59 local certs = dm_load(origin.username, module.host, dm_table) or {};
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	60
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	61 for digest,info in pairs(certs) do
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	62 reply:tag("item", { id = info.id })
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	63 :tag("name"):text(info.name):up()
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	64 :tag("keyinfo", { xmlns = xmlns_pubkey }):tag("name"):text(info["key_name"]):up()
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	65 :tag("x509cert"):text(info.x509cert)
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	66 :up();
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	67 end
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	68
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	69 origin.send(reply);
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	70 return true
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	71 end
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	72 end);
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	73
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	74 module:hook("iq/self/"..xmlns_saslcert..":append", function(event)
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	75 local origin, stanza = event.origin, event.stanza;
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	76 if stanza.attr.type == "set" then
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	77
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	78 local append = stanza:get_child("append", xmlns_saslcert);
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	79 local name = append:get_child_text("name", xmlns_saslcert);
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	80 local key_info = append:get_child("keyinfo", xmlns_pubkey);
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	81
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	82 if not key_info or not name then
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	83 origin.send(st.error_reply(stanza, "cancel", "bad-request", "Missing fields.")); -- cancel? not modify?
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	84 return true
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	85 end
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	86
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	87 local id = key_info:get_child_text("name", xmlns_pubkey);
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	88 local x509cert = key_info:get_child_text("x509cert", xmlns_pubkey);
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	89
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	90 if not id or not x509cert then
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	91 origin.send(st.error_reply(stanza, "cancel", "bad-request", "No certificate found."));
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	92 return true
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	93 end
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	94
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	95 local can_manage = key_info:get_child("no-cert-management", xmlns_saslcert) ~= nil;
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	96 local x509cert = key_info:get_child_text("x509cert");
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	97
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	98 local cert = x509.cert_from_pem(
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	99 "-----BEGIN CERTIFICATE-----\n"
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	100 .. x509cert ..
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	101 "\n-----END CERTIFICATE-----\n");
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	102
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	103
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	104 if not cert then
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	105 origin.send(st.error_reply(stanza, "modify", "not-acceptable", "Could not parse X.509 certificate"));
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	106 return true;
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	107 end
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	108
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	109 -- Check the certificate. Is it not expired? Does it include id-on-xmppAddr?
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	110
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	111 --[[ the method expired doesn't exist in luasec .. yet?
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	112 if cert:expired() then
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	113 module:log("debug", "This certificate is already expired.");
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	114 origin.send(st.error_reply(stanza, "cancel", "bad-request", "This certificate is expired."));
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	115 return true
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	116 end
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	117 --]]
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	118
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	119 if not cert:valid_at(os.time()) then
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	120 module:log("debug", "This certificate is not valid at this moment.");
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	121 end
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	122
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	123 local valid_id_on_xmppAddrs;
698 3a3293f37139 mod_client_certs: Fix the checking of valid id_on_xmppAddr fields. Thijs Alkemade <thijsalkemade@gmail.com> parents: 697 diff changeset	124 local require_id_on_xmppAddr = true;
695 f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	125 if require_id_on_xmppAddr then
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	126 valid_id_on_xmppAddrs = {};
698 3a3293f37139 mod_client_certs: Fix the checking of valid id_on_xmppAddr fields. Thijs Alkemade <thijsalkemade@gmail.com> parents: 697 diff changeset	127 for k,ext in pairs(cert:extensions()) do
3a3293f37139 mod_client_certs: Fix the checking of valid id_on_xmppAddr fields. Thijs Alkemade <thijsalkemade@gmail.com> parents: 697 diff changeset	128 if k == id_ce_subjectAltName then
3a3293f37139 mod_client_certs: Fix the checking of valid id_on_xmppAddr fields. Thijs Alkemade <thijsalkemade@gmail.com> parents: 697 diff changeset	129 for e,extv in pairs(ext) do
3a3293f37139 mod_client_certs: Fix the checking of valid id_on_xmppAddr fields. Thijs Alkemade <thijsalkemade@gmail.com> parents: 697 diff changeset	130 if e == id_on_xmppAddr then
3a3293f37139 mod_client_certs: Fix the checking of valid id_on_xmppAddr fields. Thijs Alkemade <thijsalkemade@gmail.com> parents: 697 diff changeset	131 if jid_bare(extv[1]) == jid_bare(origin.full_jid) then
3a3293f37139 mod_client_certs: Fix the checking of valid id_on_xmppAddr fields. Thijs Alkemade <thijsalkemade@gmail.com> parents: 697 diff changeset	132 module:log("debug", "The certificate contains a id-on-xmppAddr key, and it is valid.");
3a3293f37139 mod_client_certs: Fix the checking of valid id_on_xmppAddr fields. Thijs Alkemade <thijsalkemade@gmail.com> parents: 697 diff changeset	133 valid_id_on_xmppAddrs[#valid_id_on_xmppAddrs+1] = extv[1];
3a3293f37139 mod_client_certs: Fix the checking of valid id_on_xmppAddr fields. Thijs Alkemade <thijsalkemade@gmail.com> parents: 697 diff changeset	134 -- Is there a point in having >1 ids? Reject?!
3a3293f37139 mod_client_certs: Fix the checking of valid id_on_xmppAddr fields. Thijs Alkemade <thijsalkemade@gmail.com> parents: 697 diff changeset	135 else
3a3293f37139 mod_client_certs: Fix the checking of valid id_on_xmppAddr fields. Thijs Alkemade <thijsalkemade@gmail.com> parents: 697 diff changeset	136 module:log("debug", "The certificate contains a id-on-xmppAddr key, but it is for %s.", v.value);
3a3293f37139 mod_client_certs: Fix the checking of valid id_on_xmppAddr fields. Thijs Alkemade <thijsalkemade@gmail.com> parents: 697 diff changeset	137 -- Reject?
3a3293f37139 mod_client_certs: Fix the checking of valid id_on_xmppAddr fields. Thijs Alkemade <thijsalkemade@gmail.com> parents: 697 diff changeset	138 end
3a3293f37139 mod_client_certs: Fix the checking of valid id_on_xmppAddr fields. Thijs Alkemade <thijsalkemade@gmail.com> parents: 697 diff changeset	139 end
695 f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	140 end
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	141 end
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	142 end
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	143
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	144 if #valid_id_on_xmppAddrs == 0 then
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	145 origin.send(st.error_reply(stanza, "cancel", "bad-request", "This certificate is has no valid id-on-xmppAddr field."));
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	146 return true -- REJECT?!
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	147 end
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	148 end
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	149
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	150 enable_cert(origin.username, cert, {
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	151 id = id,
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	152 name = name,
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	153 x509cert = x509cert,
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	154 no_cert_management = can_manage,
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	155 jids = valid_id_on_xmppAddrs,
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	156 });
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	157
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	158 module:log("debug", "%s added certificate named %s", origin.full_jid, name);
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	159
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	160 origin.send(st.reply(stanza));
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	161
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	162 return true
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	163 end
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	164 end);
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	165
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	166
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	167 local function handle_disable(event)
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	168 local origin, stanza = event.origin, event.stanza;
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	169 if stanza.attr.type == "set" then
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	170 local disable = stanza.tags[1];
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	171 module:log("debug", "%s disabled a certificate", origin.full_jid);
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	172
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	173 local item = disable:get_child("item");
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	174 local name = item and item.attr.id;
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	175
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	176 if not name then
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	177 origin.send(st.error_reply(stanza, "cancel", "bad-request", "No key specified."));
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	178 return true
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	179 end
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	180
698 3a3293f37139 mod_client_certs: Fix the checking of valid id_on_xmppAddr fields. Thijs Alkemade <thijsalkemade@gmail.com> parents: 697 diff changeset	181 local disabled_cert = disable_cert(origin.username, name);
697 c3337f62a538 mod_client_certs: Disconnect every session that was using that cert when revoking a client certificate. Thijs Alkemade <thijsalkemade@gmail.com> parents: 695 diff changeset	182
698 3a3293f37139 mod_client_certs: Fix the checking of valid id_on_xmppAddr fields. Thijs Alkemade <thijsalkemade@gmail.com> parents: 697 diff changeset	183 if disabled_cert and disable.name == "revoke" then
697 c3337f62a538 mod_client_certs: Disconnect every session that was using that cert when revoking a client certificate. Thijs Alkemade <thijsalkemade@gmail.com> parents: 695 diff changeset	184 module:log("debug", "%s revoked a certificate! Disconnecting all clients that used it", origin.full_jid);
c3337f62a538 mod_client_certs: Disconnect every session that was using that cert when revoking a client certificate. Thijs Alkemade <thijsalkemade@gmail.com> parents: 695 diff changeset	185 local sessions = hosts[module.host].sessions[origin.username].sessions;
698 3a3293f37139 mod_client_certs: Fix the checking of valid id_on_xmppAddr fields. Thijs Alkemade <thijsalkemade@gmail.com> parents: 697 diff changeset	186 local disabled_cert_pem = disabled_cert:pem();
695 f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	187
697 c3337f62a538 mod_client_certs: Disconnect every session that was using that cert when revoking a client certificate. Thijs Alkemade <thijsalkemade@gmail.com> parents: 695 diff changeset	188 for _, session in pairs(sessions) do
c3337f62a538 mod_client_certs: Disconnect every session that was using that cert when revoking a client certificate. Thijs Alkemade <thijsalkemade@gmail.com> parents: 695 diff changeset	189 local cert = session.external_auth_cert;
c3337f62a538 mod_client_certs: Disconnect every session that was using that cert when revoking a client certificate. Thijs Alkemade <thijsalkemade@gmail.com> parents: 695 diff changeset	190
698 3a3293f37139 mod_client_certs: Fix the checking of valid id_on_xmppAddr fields. Thijs Alkemade <thijsalkemade@gmail.com> parents: 697 diff changeset	191 if cert and cert == disabled_cert_pem then
697 c3337f62a538 mod_client_certs: Disconnect every session that was using that cert when revoking a client certificate. Thijs Alkemade <thijsalkemade@gmail.com> parents: 695 diff changeset	192 module:log("debug", "Found a session that should be closed: %s", tostring(session));
c3337f62a538 mod_client_certs: Disconnect every session that was using that cert when revoking a client certificate. Thijs Alkemade <thijsalkemade@gmail.com> parents: 695 diff changeset	193 session:close{ condition = "not-authorized", text = "This client side certificate has been revoked."};
c3337f62a538 mod_client_certs: Disconnect every session that was using that cert when revoking a client certificate. Thijs Alkemade <thijsalkemade@gmail.com> parents: 695 diff changeset	194 end
c3337f62a538 mod_client_certs: Disconnect every session that was using that cert when revoking a client certificate. Thijs Alkemade <thijsalkemade@gmail.com> parents: 695 diff changeset	195 end
c3337f62a538 mod_client_certs: Disconnect every session that was using that cert when revoking a client certificate. Thijs Alkemade <thijsalkemade@gmail.com> parents: 695 diff changeset	196 end
695 f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	197 origin.send(st.reply(stanza));
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	198
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	199 return true
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	200 end
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	201 end
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	202
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	203 module:hook("iq/self/"..xmlns_saslcert..":disable", handle_disable);
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	204 module:hook("iq/self/"..xmlns_saslcert..":revoke", handle_disable);
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	205
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	206 -- Here comes the SASL EXTERNAL stuff
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	207
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	208 local now = os.time;
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	209 module:hook("stream-features", function(event)
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	210 local session, features = event.origin, event.features;
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	211 if session.secure and session.type == "c2s_unauthed" then
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	212 local cert = session.conn:socket():getpeercertificate();
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	213 if not cert then
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	214 module:log("error", "No Client Certificate");
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	215 return
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	216 end
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	217 module:log("info", "Client Certificate: %s", cert:digest(digest_algo));
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	218 local all_certs = dm_load(nil, module.host, dm_table) or {};
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	219 local digest = cert:digest(digest_algo);
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	220 local username = all_certs[digest];
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	221 if not cert:valid_at(now()) then
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	222 module:log("debug", "Client has an expired certificate", cert:digest(digest_algo));
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	223 return
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	224 end
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	225 if username then
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	226 local certs = dm_load(username, module.host, dm_table) or {};
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	227 local pem = cert:pem();
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	228 for name,info in pairs(certs) do
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	229 if info.digest == digest and info.pem == pem then
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	230 session.external_auth_cert, session.external_auth_user = pem, username;
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	231 module:log("debug", "Stream features:\n%s", tostring(features));
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	232 local mechs = features:get_child("mechanisms", "urn:ietf:params:xml:ns:xmpp-sasl");
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	233 if mechs then
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	234 mechs:tag("mechanism"):text("EXTERNAL");
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	235 end
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	236 end
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	237 end
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	238 end
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	239 end
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	240 end, -1);
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	241
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	242 local sm_make_authenticated = require "core.sessionmanager".make_authenticated;
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	243
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	244 module:hook("stanza/urn:ietf:params:xml:ns:xmpp-sasl:auth", function(event)
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	245 local session, stanza = event.origin, event.stanza;
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	246 if session.type == "c2s_unauthed" and event.stanza.attr.mechanism == "EXTERNAL" then
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	247 if session.secure then
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	248 local cert = session.conn:socket():getpeercertificate();
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	249 if cert:pem() == session.external_auth_cert then
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	250 sm_make_authenticated(session, session.external_auth_user);
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	251 module:fire_event("authentication-success", { session = session });
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	252 session.external_auth, session.external_auth_user = nil, nil;
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	253 session.send(st.stanza("success", { xmlns="urn:ietf:params:xml:ns:xmpp-sasl"}));
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	254 session:reset_stream();
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	255 else
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	256 module:fire_event("authentication-failure", { session = session, condition = "not-authorized" });
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	257 session.send(st.stanza("failure", { xmlns="urn:ietf:params:xml:ns:xmpp-sasl"}):tag"not-authorized");
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	258 end
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	259 else
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	260 session.send(st.stanza("failure", { xmlns="urn:ietf:params:xml:ns:xmpp-sasl"}):tag"encryption-required");
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	261 end
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	262 return true;
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	263 end
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	264 end, 1);
f6be46f15b74 mod_client_certs: Checking in the latest version I have with Zash's changes. Thijs Alkemade <thijsalkemade@gmail.com> parents: diff changeset	265

Mercurial > prosody-modules

annotate mod_client_certs/mod_client_certs.lua @ 698:3a3293f37139