Mercurial > prosody-modules

comparison mod_s2s_auth_dnssec_srv/mod_s2s_auth_dnssec_srv.lua @ 1008:2b2d4b1de638

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_s2s_auth_dnssec_srv: Implements Secure Delegation using DNS SRV
author Kim Alvefur <zash@zash.se>
date Thu, 09 May 2013 13:36:53 +0200
parents
children 29dcdea3c2be
comparison
equal deleted inserted replaced
1007:ba220790a59c 1008:2b2d4b1de638
1 -- Copyright (C) 2013 Kim Alvefur
2 -- This file is MIT/X11 licensed.
3 --
4 -- Implements Secure Delegation using DNS SRV as described in
5 -- http://tools.ietf.org/html/draft-miller-xmpp-dnssec-prooftype
6 --
7 -- Dependecies:
8 -- Prosody above hg:43059357b2f0
9 -- DNSSEC-validating DNS resolver
10 -- https://github.com/Zash/luaunbound
11 -- libunbound binding using LuaJIT FFI
12
13 module:set_global();
14
15 local nameprep = require"util.encodings".stringprep.nameprep;
16 local to_unicode = require"util.encodings".idna.to_unicode;
17 local cert_verify_identity = require "util.x509".verify_identity;
18
19 module:hook("s2s-check-certificate", function(event)
20 local session, cert = event.session, event.cert;
21
22 if session.cert_identity_status ~= "valid" and session.srv_choice
23 and session.srv_hosts.answer and session.srv_hosts.answer.secure then
24 local srv_target = nameprep(to_unicode(session.srv_hosts[session.srv_choice].target:gsub("%.?$","")));
25 (session.log or module._log)("debug", "Comparing certificate with Secure SRV target %s", srv_target);
26 if srv_target and cert_verify_identity(srv_target, "xmpp-server", cert) then
27 (session.log or module._log)("info", "Certificate matches Secure SRV target %s", srv_target);
28 session.cert_identity_status = "valid";
29 end
30 end
31 end);