Mercurial > prosody-modules
annotate mod_tls_policy/mod_tls_policy.lua @ 5668:ecfd7aece33b
mod_measure_modules: Report module statuses via OpenMetrics
Someone in the chat asked about a health check endpoint, which reminded
me of mod_http_status, which provides access to module statuses with
full details. After that, this idea came about, which seems natural.
As noted in the README, it could be used to monitor that critical
modules are in fact loaded correctly.
As more modules use the status API, the more useful this module and
mod_http_status becomes.
author | Kim Alvefur <zash@zash.se> |
---|---|
date | Fri, 06 Oct 2023 18:34:39 +0200 |
parents | 1b701f208b1b |
children |
rev | line source |
---|---|
1600
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
1 |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
2 assert(require"ssl.core".info, "Incompatible LuaSec version"); |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
3 |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
4 local function hook(event_name, typ, policy) |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
5 if not policy then return end |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
6 if policy == "FS" then |
1891
a43ed0d28918
mod_tls_policy: Change the FS shortcut to match on ciphers with (EC)DHE (produces nicer stream error)
Kim Alvefur <zash@zash.se>
parents:
1615
diff
changeset
|
7 policy = { cipher = "^E?C?DHE%-" }; |
1600
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
8 elseif type(policy) == "string" then |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
9 policy = { cipher = policy }; |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
10 end |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
11 |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
12 module:hook(event_name, function (event) |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
13 local origin = event.origin; |
4674
1b701f208b1b
mod_tls_policy: Switch method of checking for TLS-encrypted connection
Kim Alvefur <zash@zash.se>
parents:
1891
diff
changeset
|
14 if origin.conn and origin.conn:ssl() then |
1600
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
15 local info = origin.conn:socket():info(); |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
16 for key, what in pairs(policy) do |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
17 module:log("debug", "Does info[%q] = %s match %s ?", key, tostring(info[key]), tostring(what)); |
1601
c5ca63ac0e1b
mod_tls_policy: Fix pattern matching
Kim Alvefur <zash@zash.se>
parents:
1600
diff
changeset
|
18 if (type(what) == "number" and what < info[key] ) or (type(what) == "string" and not info[key]:match(what)) then |
1615
d0fd8a29b724
mod_tls_policy: Include which part of the cipher that did not match the policy in stream error
Kim Alvefur <zash@zash.se>
parents:
1601
diff
changeset
|
19 origin:close({ condition = "policy-violation", text = ("TLS %s '%s' not acceptable"):format(key, tostring(info[key])) }); |
1600
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
20 return false; |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
21 end |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
22 module:log("debug", "Seems so"); |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
23 end |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
24 module:log("debug", "Policy matches"); |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
25 end |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
26 end, 1000); |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
27 end |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
28 |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
29 local policy = module:get_option(module.name, {}); |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
30 |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
31 if type(policy) == "string" then |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
32 policy = { c2s = policy, s2s = policy }; |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
33 end |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
34 |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
35 hook("stream-features", "c2s", policy.c2s); |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
36 hook("s2s-stream-features", "s2sin", policy.s2sin or policy.s2s); |
1e90054c3ac5
mod_tls_policy: New module to enforce per-host TLS parameter policies
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
37 hook("stanza/http://etherx.jabber.org/streams:features", "s2sout", policy.s2sout or policy.s2s); |