Mercurial > prosody-modules
annotate mod_tls_policy/mod_tls_policy.lua @ 4974:807007913f67
mod_log_json: Prefer native Lua table.pack over Prosody util.table one
Prosody is removing support for Lua 5.1, which was the reason for
util.table.pack to exist in the first place, since Lua 5.2+ provides
table.pack. In prosody rev 5eaf77114fdb everything was switched over to
use table.pack, opening the door for removing util.table.pack at some
point. This change here is to prepare for that future eventuality.
author | Kim Alvefur <zash@zash.se> |
---|---|
date | Mon, 11 Jul 2022 20:08:41 +0200 |
parents | 1b701f208b1b |
children |
rev | line source |
---|---|
1600
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
1 |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
2 assert(require"ssl.core".info, "Incompatible LuaSec version"); |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
3 |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
4 local function hook(event_name, typ, policy) |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
5 if not policy then return end |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
6 if policy == "FS" then |
1891
a43ed0d28918
mod_tls_policy: Change the FS shortcut to match on ciphers with (EC)DHE (produces nicer stream error)
Kim Alvefur <zash@zash.se>
parents:
1615
diff
changeset
|
7 policy = { cipher = "^E?C?DHE%-" }; |
1600
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
8 elseif type(policy) == "string" then |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
9 policy = { cipher = policy }; |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
10 end |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
11 |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
12 module:hook(event_name, function (event) |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
13 local origin = event.origin; |
4674
1b701f208b1b
mod_tls_policy: Switch method of checking for TLS-encrypted connection
Kim Alvefur <zash@zash.se>
parents:
1891
diff
changeset
|
14 if origin.conn and origin.conn:ssl() then |
1600
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
15 local info = origin.conn:socket():info(); |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
16 for key, what in pairs(policy) do |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
17 module:log("debug", "Does info[%q] = %s match %s ?", key, tostring(info[key]), tostring(what)); |
1601
c5ca63ac0e1b
mod_tls_policy: Fix pattern matching
Kim Alvefur <zash@zash.se>
parents:
1600
diff
changeset
|
18 if (type(what) == "number" and what < info[key] ) or (type(what) == "string" and not info[key]:match(what)) then |
1615
d0fd8a29b724
mod_tls_policy: Include which part of the cipher that did not match the policy in stream error
Kim Alvefur <zash@zash.se>
parents:
1601
diff
changeset
|
19 origin:close({ condition = "policy-violation", text = ("TLS %s '%s' not acceptable"):format(key, tostring(info[key])) }); |
1600
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
20 return false; |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
21 end |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
22 module:log("debug", "Seems so"); |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
23 end |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
24 module:log("debug", "Policy matches"); |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
25 end |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
26 end, 1000); |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
27 end |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
28 |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
29 local policy = module:get_option(module.name, {}); |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
30 |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
31 if type(policy) == "string" then |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
32 policy = { c2s = policy, s2s = policy }; |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
33 end |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
34 |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
35 hook("stream-features", "c2s", policy.c2s); |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
36 hook("s2s-stream-features", "s2sin", policy.s2sin or policy.s2s); |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
37 hook("stanza/http://etherx.jabber.org/streams:features", "s2sout", policy.s2sout or policy.s2s); |