Mercurial > prosody-modules

annotate mod_s2s_auth_dnssec_srv/mod_s2s_auth_dnssec_srv.lua @ 1368:5724008bbdb1

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_s2s_auth_dane: Fix typo in debug statement
author Kim Alvefur <zash@zash.se>
date Thu, 20 Mar 2014 15:55:37 +0100
parents 478b3288192f
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
1008
2b2d4b1de638 mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff changeset
1 -- Copyright (C) 2013 Kim Alvefur
2b2d4b1de638 mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff changeset
2 -- This file is MIT/X11 licensed.
2b2d4b1de638 mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff changeset
3 --
1343
7dbde05b48a9 all the things: Remove trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 1130
diff changeset
4 -- Implements Secure Delegation using DNS SRV as described in
1008
2b2d4b1de638 mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff changeset
5 -- http://tools.ietf.org/html/draft-miller-xmpp-dnssec-prooftype
2b2d4b1de638 mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff changeset
6 --
2b2d4b1de638 mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff changeset
7 -- Dependecies:
2b2d4b1de638 mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff changeset
8 -- Prosody above hg:43059357b2f0
2b2d4b1de638 mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff changeset
9 -- DNSSEC-validating DNS resolver
2b2d4b1de638 mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff changeset
10 -- https://github.com/Zash/luaunbound
2b2d4b1de638 mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff changeset
11 -- libunbound binding using LuaJIT FFI
2b2d4b1de638 mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff changeset
12
2b2d4b1de638 mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff changeset
13 module:set_global();
2b2d4b1de638 mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff changeset
14
2b2d4b1de638 mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff changeset
15 local nameprep = require"util.encodings".stringprep.nameprep;
2b2d4b1de638 mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff changeset
16 local to_unicode = require"util.encodings".idna.to_unicode;
1360
6ee395396333 mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
17 local to_ascii = require "util.encodings".idna.to_ascii;
1008
2b2d4b1de638 mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff changeset
18 local cert_verify_identity = require "util.x509".verify_identity;
1360
6ee395396333 mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
19 local dns_lookup = require"net.adns".lookup;
6ee395396333 mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
20 local t_insert = table.insert;
1008
2b2d4b1de638 mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff changeset
21
2b2d4b1de638 mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff changeset
22 module:hook("s2s-check-certificate", function(event)
2b2d4b1de638 mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff changeset
23 local session, cert = event.session, event.cert;
2b2d4b1de638 mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff changeset
24
1130
29dcdea3c2be mod_s2s_auth_dnssec_srv: Ignore certificates with invalid chains.
Kim Alvefur <zash@zash.se>
parents: 1008
diff changeset
25 if session.cert_chain_status == "valid" and session.cert_identity_status ~= "valid"
1360
6ee395396333 mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
26 and session.srv_hosts.answer and session.srv_hosts.answer.secure then
6ee395396333 mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
27 local srv_hosts, srv_choice, srv_target = session.srv_hosts, session.srv_choice;
6ee395396333 mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
28 for i = srv_choice or 1, srv_choice or #srv_hosts do
6ee395396333 mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
29 srv_target = nameprep(to_unicode(session.srv_hosts[i].target:gsub("%.?$","")));
6ee395396333 mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
30 (session.log or module._log)("debug", "Comparing certificate with Secure SRV target %s", srv_target);
6ee395396333 mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
31 if srv_target and cert_verify_identity(srv_target, "xmpp-server", cert) then
6ee395396333 mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
32 (session.log or module._log)("info", "Certificate matches Secure SRV target %s", srv_target);
6ee395396333 mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
33 session.cert_identity_status = "valid";
6ee395396333 mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
34 return;
6ee395396333 mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
35 end
1008
2b2d4b1de638 mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff changeset
36 end
2b2d4b1de638 mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff changeset
37 end
2b2d4b1de638 mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
Kim Alvefur <zash@zash.se>
parents:
diff changeset
38 end);
1360
6ee395396333 mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
39
6ee395396333 mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
40 function module.add_host(module)
6ee395396333 mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
41 module:hook("s2s-stream-features", function(event)
6ee395396333 mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
42 local host_session = event.origin;
1363
478b3288192f mod_s2s_auth_dnssec_srv: Fix tb when no hostname sent by remote
Kim Alvefur <zash@zash.se>
parents: 1361
diff changeset
43 local name = host_session.from_host and to_ascii(host_session.from_host);
1360
6ee395396333 mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
44 if not name then return end
6ee395396333 mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
45 dns_lookup(function (answer)
1361
b9213ddb860f mod_s2s_auth_dnssec_srv: Don't break DANE
Kim Alvefur <zash@zash.se>
parents: 1360
diff changeset
46 if host_session.dane ~= nil then return end
1360
6ee395396333 mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
47 if not answer.secure or #answer == 1
6ee395396333 mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
48 and answer[1].srv.target == "." then return end
6ee395396333 mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
49 local srv_hosts = { answer = answer };
6ee395396333 mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
50 for _, record in ipairs(answer) do
6ee395396333 mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
51 t_insert(srv_hosts, record.srv);
6ee395396333 mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
52 end
6ee395396333 mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
53 host_session.srv_hosts = srv_hosts;
6ee395396333 mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
54 end, "_xmpp-server._tcp."..name..".", "SRV");
6ee395396333 mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
55 end);
6ee395396333 mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
56 end
6ee395396333 mod_s2s_auth_dnssec_srv: Do something useful for incoming connection
Kim Alvefur <zash@zash.se>
parents: 1343
diff changeset
57