Mercurial > prosody-modules

annotate mod_s2s_auth_dane/mod_s2s_auth_dane.lua @ 1344:47d3c1c8a176

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_s2s_auth_dane: Only invalidate trust if we found any supported DANE records
author Kim Alvefur <zash@zash.se>
date Tue, 11 Mar 2014 21:13:40 +0100
parents 50555c2ccbcd
children 52b419885f0a
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
1258
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
1 -- mod_s2s_auth_dane
1332
08a0241f5d2c mod_s2s_auth_dane: Add some comments
Kim Alvefur <zash@zash.se>
parents: 1330
diff changeset
2 -- Copyright (C) 2013-2014 Kim Alvefur
1258
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
3 --
1332
08a0241f5d2c mod_s2s_auth_dane: Add some comments
Kim Alvefur <zash@zash.se>
parents: 1330
diff changeset
4 -- This file is MIT/X11 licensed.
08a0241f5d2c mod_s2s_auth_dane: Add some comments
Kim Alvefur <zash@zash.se>
parents: 1330
diff changeset
5 --
08a0241f5d2c mod_s2s_auth_dane: Add some comments
Kim Alvefur <zash@zash.se>
parents: 1330
diff changeset
6 -- Could be done much cleaner if mod_s2s was using util.async
1258
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
7
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
8
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
9 module:set_global();
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
10
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
11 local dns_lookup = require"net.adns".lookup;
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
12 local hashes = require"util.hashes";
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
13 local base64 = require"util.encodings".base64;
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
14
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
15 local s2sout = module:depends"s2s".route_to_new_session.s2sout;
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
16
1339
50555c2ccbcd mod_s2s_auth_dane: Improve handling of bogus data
Kim Alvefur <zash@zash.se>
parents: 1338
diff changeset
17 local bogus = {};
50555c2ccbcd mod_s2s_auth_dane: Improve handling of bogus data
Kim Alvefur <zash@zash.se>
parents: 1338
diff changeset
18
1258
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
19 local pat = "%-%-%-%-%-BEGIN ([A-Z ]+)%-%-%-%-%-\r?\n"..
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
20 "([0-9A-Za-z=+/\r\n]*)\r?\n%-%-%-%-%-END %1%-%-%-%-%-";
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
21 local function pem2der(pem)
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
22 local typ, data = pem:match(pat);
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
23 if typ and data then
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
24 return base64.decode(data), typ;
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
25 end
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
26 end
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
27
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
28 -- TODO Things to test/handle:
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
29 -- Negative or bogus answers
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
30 -- No SRV records
1327
b93f45c42044 mod_s2s_auth_dane: Comment updates
Kim Alvefur <zash@zash.se>
parents: 1325
diff changeset
31 -- No encryption offered
1334
100da6a5525e mod_s2s_auth_dane: More comment changes
Kim Alvefur <zash@zash.se>
parents: 1333
diff changeset
32 -- Different hostname before and after STARTTLS - mod_s2s should complain
1258
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
33
1332
08a0241f5d2c mod_s2s_auth_dane: Add some comments
Kim Alvefur <zash@zash.se>
parents: 1330
diff changeset
34 -- This function is called when a new SRV target has been picked
08a0241f5d2c mod_s2s_auth_dane: Add some comments
Kim Alvefur <zash@zash.se>
parents: 1330
diff changeset
35 -- the original function does A/AAAA resolution before continuing
08a0241f5d2c mod_s2s_auth_dane: Add some comments
Kim Alvefur <zash@zash.se>
parents: 1330
diff changeset
36 local _try_connect = s2sout.try_connect;
1258
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
37 function s2sout.try_connect(host_session, connect_host, connect_port, err)
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
38 local srv_hosts = host_session.srv_hosts;
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
39 local srv_choice = host_session.srv_choice;
1338
eca8c480891e mod_s2s_auth_dane: Only do TLSA lookup if it hasn't been attempted already
Kim Alvefur <zash@zash.se>
parents: 1337
diff changeset
40 if srv_hosts and srv_hosts.answer.secure and srv_hosts[srv_choice].dane == nil then
1328
446fcda4ec45 mod_s2s_auth_dane: Delay s2sout state machine until we get TLSA reply
Kim Alvefur <zash@zash.se>
parents: 1327
diff changeset
41 srv_hosts[srv_choice].dane = dns_lookup(function(answer)
1339
50555c2ccbcd mod_s2s_auth_dane: Improve handling of bogus data
Kim Alvefur <zash@zash.se>
parents: 1338
diff changeset
42 if answer and #answer > 0 and answer.secure then
1258
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
43 srv_hosts[srv_choice].dane = answer;
1339
50555c2ccbcd mod_s2s_auth_dane: Improve handling of bogus data
Kim Alvefur <zash@zash.se>
parents: 1338
diff changeset
44 elseif answer.bogus then
50555c2ccbcd mod_s2s_auth_dane: Improve handling of bogus data
Kim Alvefur <zash@zash.se>
parents: 1338
diff changeset
45 srv_hosts[srv_choice].dane = bogus;
1328
446fcda4ec45 mod_s2s_auth_dane: Delay s2sout state machine until we get TLSA reply
Kim Alvefur <zash@zash.se>
parents: 1327
diff changeset
46 else
446fcda4ec45 mod_s2s_auth_dane: Delay s2sout state machine until we get TLSA reply
Kim Alvefur <zash@zash.se>
parents: 1327
diff changeset
47 srv_hosts[srv_choice].dane = false;
1258
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
48 end
1328
446fcda4ec45 mod_s2s_auth_dane: Delay s2sout state machine until we get TLSA reply
Kim Alvefur <zash@zash.se>
parents: 1327
diff changeset
49 -- "blocking" until TLSA reply, but no race condition
446fcda4ec45 mod_s2s_auth_dane: Delay s2sout state machine until we get TLSA reply
Kim Alvefur <zash@zash.se>
parents: 1327
diff changeset
50 return _try_connect(host_session, connect_host, connect_port, err);
1266
51e7a4bbd70b mod_s2s_auth_dane: Style fixes
Kim Alvefur <zash@zash.se>
parents: 1265
diff changeset
51 end, ("_%d._tcp.%s"):format(connect_port, connect_host), "TLSA");
1328
446fcda4ec45 mod_s2s_auth_dane: Delay s2sout state machine until we get TLSA reply
Kim Alvefur <zash@zash.se>
parents: 1327
diff changeset
52 return true
1258
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
53 end
1266
51e7a4bbd70b mod_s2s_auth_dane: Style fixes
Kim Alvefur <zash@zash.se>
parents: 1265
diff changeset
54 return _try_connect(host_session, connect_host, connect_port, err);
1258
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
55 end
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
56
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
57 module:hook("s2s-check-certificate", function(event)
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
58 local session, cert = event.session, event.cert;
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
59 local srv_hosts = session.srv_hosts;
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
60 local srv_choice = session.srv_choice;
1333
15912b077370 mod_s2s_auth_dane: Implement experimental method for doing DANE with client certificates on s2sin
Kim Alvefur <zash@zash.se>
parents: 1332
diff changeset
61 local choosen = srv_hosts and srv_hosts[srv_choice] or session;
15912b077370 mod_s2s_auth_dane: Implement experimental method for doing DANE with client certificates on s2sin
Kim Alvefur <zash@zash.se>
parents: 1332
diff changeset
62 if choosen.dane then
1344
47d3c1c8a176 mod_s2s_auth_dane: Only invalidate trust if we found any supported DANE records
Kim Alvefur <zash@zash.se>
parents: 1339
diff changeset
63 local use, select, match, tlsa, certdata, match_found, supported_found;
1258
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
64 for i, rr in ipairs(choosen.dane) do
1266
51e7a4bbd70b mod_s2s_auth_dane: Style fixes
Kim Alvefur <zash@zash.se>
parents: 1265
diff changeset
65 tlsa = rr.tlsa;
1335
faf4bd226cad mod_s2s_auth_dane: Improve logging
Kim Alvefur <zash@zash.se>
parents: 1334
diff changeset
66 module:log("debug", "TLSA %s %s %s %d bytes of data", tlsa:getUsage(), tlsa:getSelector(), tlsa:getMatchType(), #tlsa.data);
1258
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
67 use, select, match, certdata = tlsa.use, tlsa.select, tlsa.match;
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
68
1327
b93f45c42044 mod_s2s_auth_dane: Comment updates
Kim Alvefur <zash@zash.se>
parents: 1325
diff changeset
69 -- PKIX-EE or DANE-EE
1258
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
70 if use == 1 or use == 3 then
1344
47d3c1c8a176 mod_s2s_auth_dane: Only invalidate trust if we found any supported DANE records
Kim Alvefur <zash@zash.se>
parents: 1339
diff changeset
71 supported_found = true
1258
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
72
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
73 if select == 0 then
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
74 certdata = pem2der(cert:pem());
1329
8d99b9c4cf0c mod_s2s_auth_dane: Verify that the pubkey method exists when the SPKI selector is used
Kim Alvefur <zash@zash.se>
parents: 1328
diff changeset
75 elseif select == 1 and cert.pubkey then
1334
100da6a5525e mod_s2s_auth_dane: More comment changes
Kim Alvefur <zash@zash.se>
parents: 1333
diff changeset
76 certdata = pem2der(cert:pubkey()); -- Not supported in stock LuaSec
1261
6a37bd22c8df mod_s2s_auth_dane: Warn about unsupported DANE params
Kim Alvefur <zash@zash.se>
parents: 1258
diff changeset
77 else
1335
faf4bd226cad mod_s2s_auth_dane: Improve logging
Kim Alvefur <zash@zash.se>
parents: 1334
diff changeset
78 module:log("warn", "DANE selector %s is unsupported", tlsa:getSelector() or select);
1258
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
79 end
1327
b93f45c42044 mod_s2s_auth_dane: Comment updates
Kim Alvefur <zash@zash.se>
parents: 1325
diff changeset
80
1258
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
81 if match == 1 then
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
82 certdata = hashes.sha256(certdata);
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
83 elseif match == 2 then
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
84 certdata = hashes.sha512(certdata);
1261
6a37bd22c8df mod_s2s_auth_dane: Warn about unsupported DANE params
Kim Alvefur <zash@zash.se>
parents: 1258
diff changeset
85 elseif match ~= 0 then
1335
faf4bd226cad mod_s2s_auth_dane: Improve logging
Kim Alvefur <zash@zash.se>
parents: 1334
diff changeset
86 module:log("warn", "DANE match rule %s is unsupported", tlsa:getMatchType() or match);
1266
51e7a4bbd70b mod_s2s_auth_dane: Style fixes
Kim Alvefur <zash@zash.se>
parents: 1265
diff changeset
87 certdata = nil;
1258
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
88 end
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
89
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
90 -- Should we check if the cert subject matches?
1261
6a37bd22c8df mod_s2s_auth_dane: Warn about unsupported DANE params
Kim Alvefur <zash@zash.se>
parents: 1258
diff changeset
91 if certdata and certdata == tlsa.data then
1258
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
92 (session.log or module._log)("info", "DANE validation successful");
1266
51e7a4bbd70b mod_s2s_auth_dane: Style fixes
Kim Alvefur <zash@zash.se>
parents: 1265
diff changeset
93 session.cert_identity_status = "valid";
1327
b93f45c42044 mod_s2s_auth_dane: Comment updates
Kim Alvefur <zash@zash.se>
parents: 1325
diff changeset
94 if use == 3 then -- DANE-EE, chain status equals DNSSEC chain status
1266
51e7a4bbd70b mod_s2s_auth_dane: Style fixes
Kim Alvefur <zash@zash.se>
parents: 1265
diff changeset
95 session.cert_chain_status = "valid";
1327
b93f45c42044 mod_s2s_auth_dane: Comment updates
Kim Alvefur <zash@zash.se>
parents: 1325
diff changeset
96 -- for usage 1, PKIX-EE, the chain has to be valid already
1258
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
97 end
1266
51e7a4bbd70b mod_s2s_auth_dane: Style fixes
Kim Alvefur <zash@zash.se>
parents: 1265
diff changeset
98 match_found = true;
1258
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
99 break;
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
100 end
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
101 else
1335
faf4bd226cad mod_s2s_auth_dane: Improve logging
Kim Alvefur <zash@zash.se>
parents: 1334
diff changeset
102 module:log("warn", "DANE usage %s is unsupported", tlsa:getUsage() or use);
1334
100da6a5525e mod_s2s_auth_dane: More comment changes
Kim Alvefur <zash@zash.se>
parents: 1333
diff changeset
103 -- PKIX-TA checks needs to loop over the chain and stuff
100da6a5525e mod_s2s_auth_dane: More comment changes
Kim Alvefur <zash@zash.se>
parents: 1333
diff changeset
104 -- LuaSec does not expose anything for validating a random chain, so DANE-TA is not possible atm
1258
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
105 end
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
106 end
1344
47d3c1c8a176 mod_s2s_auth_dane: Only invalidate trust if we found any supported DANE records
Kim Alvefur <zash@zash.se>
parents: 1339
diff changeset
107 if supported_found and not match_found then
1332
08a0241f5d2c mod_s2s_auth_dane: Add some comments
Kim Alvefur <zash@zash.se>
parents: 1330
diff changeset
108 -- No TLSA matched or response was bogus
1265
020165014e56 mod_s2s_auth_dane: Fix wording on validation failure
Kim Alvefur <zash@zash.se>
parents: 1262
diff changeset
109 (session.log or module._log)("warn", "DANE validation failed");
1262
1e84eebf3f46 mod_s2s_auth_dane: Invalidate trust if there are TLSA records but no matches, or bogus results
Kim Alvefur <zash@zash.se>
parents: 1261
diff changeset
110 session.cert_identity_status = "invalid";
1e84eebf3f46 mod_s2s_auth_dane: Invalidate trust if there are TLSA records but no matches, or bogus results
Kim Alvefur <zash@zash.se>
parents: 1261
diff changeset
111 session.cert_chain_status = "invalid";
1e84eebf3f46 mod_s2s_auth_dane: Invalidate trust if there are TLSA records but no matches, or bogus results
Kim Alvefur <zash@zash.se>
parents: 1261
diff changeset
112 end
1258
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
113 end
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
114 end);
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
115
1330
bb6f3312ab46 mod_s2s_auth_dane: Don't allow unencrypted connections if TLSA exists
Kim Alvefur <zash@zash.se>
parents: 1329
diff changeset
116 function module.add_host(module)
bb6f3312ab46 mod_s2s_auth_dane: Don't allow unencrypted connections if TLSA exists
Kim Alvefur <zash@zash.se>
parents: 1329
diff changeset
117 module:hook("s2s-authenticated", function(event)
bb6f3312ab46 mod_s2s_auth_dane: Don't allow unencrypted connections if TLSA exists
Kim Alvefur <zash@zash.se>
parents: 1329
diff changeset
118 local session = event.session;
bb6f3312ab46 mod_s2s_auth_dane: Don't allow unencrypted connections if TLSA exists
Kim Alvefur <zash@zash.se>
parents: 1329
diff changeset
119 local srv_hosts = session.srv_hosts;
bb6f3312ab46 mod_s2s_auth_dane: Don't allow unencrypted connections if TLSA exists
Kim Alvefur <zash@zash.se>
parents: 1329
diff changeset
120 local srv_choice = session.srv_choice;
1333
15912b077370 mod_s2s_auth_dane: Implement experimental method for doing DANE with client certificates on s2sin
Kim Alvefur <zash@zash.se>
parents: 1332
diff changeset
121 if (session.dane or srv_hosts and srv_hosts[srv_choice].dane) and not session.secure then
1330
bb6f3312ab46 mod_s2s_auth_dane: Don't allow unencrypted connections if TLSA exists
Kim Alvefur <zash@zash.se>
parents: 1329
diff changeset
122 -- TLSA record but no TLS, not ok.
1332
08a0241f5d2c mod_s2s_auth_dane: Add some comments
Kim Alvefur <zash@zash.se>
parents: 1330
diff changeset
123 -- TODO Optional?
1334
100da6a5525e mod_s2s_auth_dane: More comment changes
Kim Alvefur <zash@zash.se>
parents: 1333
diff changeset
124 -- Bogus replies will trigger this path
1330
bb6f3312ab46 mod_s2s_auth_dane: Don't allow unencrypted connections if TLSA exists
Kim Alvefur <zash@zash.se>
parents: 1329
diff changeset
125 session:close({
bb6f3312ab46 mod_s2s_auth_dane: Don't allow unencrypted connections if TLSA exists
Kim Alvefur <zash@zash.se>
parents: 1329
diff changeset
126 condition = "policy-violation",
bb6f3312ab46 mod_s2s_auth_dane: Don't allow unencrypted connections if TLSA exists
Kim Alvefur <zash@zash.se>
parents: 1329
diff changeset
127 text = "Encrypted server-to-server communication is required but was not "
bb6f3312ab46 mod_s2s_auth_dane: Don't allow unencrypted connections if TLSA exists
Kim Alvefur <zash@zash.se>
parents: 1329
diff changeset
128 ..((session.direction == "outgoing" and "offered") or "used")
bb6f3312ab46 mod_s2s_auth_dane: Don't allow unencrypted connections if TLSA exists
Kim Alvefur <zash@zash.se>
parents: 1329
diff changeset
129 });
bb6f3312ab46 mod_s2s_auth_dane: Don't allow unencrypted connections if TLSA exists
Kim Alvefur <zash@zash.se>
parents: 1329
diff changeset
130 return false;
bb6f3312ab46 mod_s2s_auth_dane: Don't allow unencrypted connections if TLSA exists
Kim Alvefur <zash@zash.se>
parents: 1329
diff changeset
131 end
bb6f3312ab46 mod_s2s_auth_dane: Don't allow unencrypted connections if TLSA exists
Kim Alvefur <zash@zash.se>
parents: 1329
diff changeset
132 end);
1333
15912b077370 mod_s2s_auth_dane: Implement experimental method for doing DANE with client certificates on s2sin
Kim Alvefur <zash@zash.se>
parents: 1332
diff changeset
133
15912b077370 mod_s2s_auth_dane: Implement experimental method for doing DANE with client certificates on s2sin
Kim Alvefur <zash@zash.se>
parents: 1332
diff changeset
134 -- DANE for s2sin
15912b077370 mod_s2s_auth_dane: Implement experimental method for doing DANE with client certificates on s2sin
Kim Alvefur <zash@zash.se>
parents: 1332
diff changeset
135 -- Looks for TLSA at the same QNAME as the SRV record
1338
eca8c480891e mod_s2s_auth_dane: Only do TLSA lookup if it hasn't been attempted already
Kim Alvefur <zash@zash.se>
parents: 1337
diff changeset
136 -- FIXME This has a race condition
1336
ae0558230e3d mod_s2s_auth_dane: Do DANE lookups on outgoing stream features
Kim Alvefur <zash@zash.se>
parents: 1335
diff changeset
137 module:hook("s2s-stream-features", function(event)
1333
15912b077370 mod_s2s_auth_dane: Implement experimental method for doing DANE with client certificates on s2sin
Kim Alvefur <zash@zash.se>
parents: 1332
diff changeset
138 local origin = event.origin;
1337
c38f163f18b9 mod_s2s_auth_dane: Fix inverted nil check
Kim Alvefur <zash@zash.se>
parents: 1336
diff changeset
139 if not origin.from_host or origin.dane ~= nil then return end
1333
15912b077370 mod_s2s_auth_dane: Implement experimental method for doing DANE with client certificates on s2sin
Kim Alvefur <zash@zash.se>
parents: 1332
diff changeset
140
15912b077370 mod_s2s_auth_dane: Implement experimental method for doing DANE with client certificates on s2sin
Kim Alvefur <zash@zash.se>
parents: 1332
diff changeset
141 origin.dane = dns_lookup(function(answer)
1339
50555c2ccbcd mod_s2s_auth_dane: Improve handling of bogus data
Kim Alvefur <zash@zash.se>
parents: 1338
diff changeset
142 if answer and #answer > 0 and answer.secure then
50555c2ccbcd mod_s2s_auth_dane: Improve handling of bogus data
Kim Alvefur <zash@zash.se>
parents: 1338
diff changeset
143 srv_hosts[srv_choice].dane = answer;
50555c2ccbcd mod_s2s_auth_dane: Improve handling of bogus data
Kim Alvefur <zash@zash.se>
parents: 1338
diff changeset
144 elseif answer.bogus then
50555c2ccbcd mod_s2s_auth_dane: Improve handling of bogus data
Kim Alvefur <zash@zash.se>
parents: 1338
diff changeset
145 srv_hosts[srv_choice].dane = bogus;
1333
15912b077370 mod_s2s_auth_dane: Implement experimental method for doing DANE with client certificates on s2sin
Kim Alvefur <zash@zash.se>
parents: 1332
diff changeset
146 else
15912b077370 mod_s2s_auth_dane: Implement experimental method for doing DANE with client certificates on s2sin
Kim Alvefur <zash@zash.se>
parents: 1332
diff changeset
147 origin.dane = false;
15912b077370 mod_s2s_auth_dane: Implement experimental method for doing DANE with client certificates on s2sin
Kim Alvefur <zash@zash.se>
parents: 1332
diff changeset
148 end
1338
eca8c480891e mod_s2s_auth_dane: Only do TLSA lookup if it hasn't been attempted already
Kim Alvefur <zash@zash.se>
parents: 1337
diff changeset
149 end, ("_xmpp-server._tcp.%s."):format(origin.from_host), "TLSA");
1333
15912b077370 mod_s2s_auth_dane: Implement experimental method for doing DANE with client certificates on s2sin
Kim Alvefur <zash@zash.se>
parents: 1332
diff changeset
150 end, 1);
1330
bb6f3312ab46 mod_s2s_auth_dane: Don't allow unencrypted connections if TLSA exists
Kim Alvefur <zash@zash.se>
parents: 1329
diff changeset
151 end
bb6f3312ab46 mod_s2s_auth_dane: Don't allow unencrypted connections if TLSA exists
Kim Alvefur <zash@zash.se>
parents: 1329
diff changeset
152
1258
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
153 function module.unload()
1332
08a0241f5d2c mod_s2s_auth_dane: Add some comments
Kim Alvefur <zash@zash.se>
parents: 1330
diff changeset
154 -- Restore the original try_connect function
1258
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
155 s2sout.try_connect = _try_connect;
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
156 end
fc82d8eded7d mod_s2s_auth_dane: Experimental DANE implementation
Kim Alvefur <zash@zash.se>
parents:
diff changeset
157