Mercurial > prosody-modules

annotate mod_tls_policy/mod_tls_policy.lua @ 3532:85c357b69eec

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_csi_muc_priorities: Reduce importance of group chat messages This helps if you are in more noisy public channels than small private group chats. The short term plan is to give users the ability to set MUC JIDs as either high or low priority and use that. Long term it would be great to be able to automatically classify MUCs as public channels vs private group chats.
author Kim Alvefur <zash@zash.se>
date Mon, 01 Apr 2019 00:15:13 +0200
parents a43ed0d28918
children 1b701f208b1b
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
1600
1e90054c3ac5 mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff changeset
1
1e90054c3ac5 mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff changeset
2 assert(require"ssl.core".info, "Incompatible LuaSec version");
1e90054c3ac5 mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff changeset
3
1e90054c3ac5 mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff changeset
4 local function hook(event_name, typ, policy)
1e90054c3ac5 mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff changeset
5 if not policy then return end
1e90054c3ac5 mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff changeset
6 if policy == "FS" then
1891
a43ed0d28918 mod_tls_policy: Change the FS shortcut to match on ciphers with (EC)DHE (produces nicer stream error)
Kim Alvefur <zash@zash.se>
parents: 1615
diff changeset
7 policy = { cipher = "^E?C?DHE%-" };
1600
1e90054c3ac5 mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff changeset
8 elseif type(policy) == "string" then
1e90054c3ac5 mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff changeset
9 policy = { cipher = policy };
1e90054c3ac5 mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff changeset
10 end
1e90054c3ac5 mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff changeset
11
1e90054c3ac5 mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff changeset
12 module:hook(event_name, function (event)
1e90054c3ac5 mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff changeset
13 local origin = event.origin;
1e90054c3ac5 mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff changeset
14 if origin.encrypted then
1e90054c3ac5 mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff changeset
15 local info = origin.conn:socket():info();
1e90054c3ac5 mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff changeset
16 for key, what in pairs(policy) do
1e90054c3ac5 mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff changeset
17 module:log("debug", "Does info[%q] = %s match %s ?", key, tostring(info[key]), tostring(what));
1601
c5ca63ac0e1b mod_tls_policy: Fix pattern matching
Kim Alvefur <zash@zash.se>
parents: 1600
diff changeset
18 if (type(what) == "number" and what < info[key] ) or (type(what) == "string" and not info[key]:match(what)) then
1615
d0fd8a29b724 mod_tls_policy: Include which part of the cipher that did not match the policy in stream error
Kim Alvefur <zash@zash.se>
parents: 1601
diff changeset
19 origin:close({ condition = "policy-violation", text = ("TLS %s '%s' not acceptable"):format(key, tostring(info[key])) });
1600
1e90054c3ac5 mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff changeset
20 return false;
1e90054c3ac5 mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff changeset
21 end
1e90054c3ac5 mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff changeset
22 module:log("debug", "Seems so");
1e90054c3ac5 mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff changeset
23 end
1e90054c3ac5 mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff changeset
24 module:log("debug", "Policy matches");
1e90054c3ac5 mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff changeset
25 end
1e90054c3ac5 mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff changeset
26 end, 1000);
1e90054c3ac5 mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff changeset
27 end
1e90054c3ac5 mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff changeset
28
1e90054c3ac5 mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff changeset
29 local policy = module:get_option(module.name, {});
1e90054c3ac5 mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff changeset
30
1e90054c3ac5 mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff changeset
31 if type(policy) == "string" then
1e90054c3ac5 mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff changeset
32 policy = { c2s = policy, s2s = policy };
1e90054c3ac5 mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff changeset
33 end
1e90054c3ac5 mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff changeset
34
1e90054c3ac5 mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff changeset
35 hook("stream-features", "c2s", policy.c2s);
1e90054c3ac5 mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff changeset
36 hook("s2s-stream-features", "s2sin", policy.s2sin or policy.s2s);
1e90054c3ac5 mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff changeset
37 hook("stanza/http://etherx.jabber.org/streams:features", "s2sout", policy.s2sout or policy.s2s);