Mercurial > prosody-modules

view mod_s2s_keysize_policy/mod_s2s_keysize_policy.lua @ 5418:f2c7bb3af600

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_http_oauth2: Add role selector to consent page List includes all roles available to the user, if more than one. Defaults to either the first role in the scope string or the users primary role. Earlier draft listed all roles, but having options that can't be selected is bad UX and the entire list of all roles on the server could be long, and perhaps even sensitive. Allows e.g. picking a role with fewer permissions than what might otherwise have been selected. UX wise, doing this with more checkboxes or possibly radio buttons would have been confusion and/or looked messier. Fixes the previous situation where unselecting a role would default to the primary role, which could be more permissions than requested.
author Kim Alvefur <zash@zash.se>
date Fri, 05 May 2023 01:23:13 +0200
parents 27ffa6521d4e
children
line wrap: on
line source

-- mod_s2s_keysize_policy.lua
-- Requires LuaSec with this patch: https://github.com/brunoos/luasec/pull/12

module:set_global();

local datetime_parse = require"util.datetime".parse;
local pat = "^([JFMAONSD][ceupao][glptbvyncr])  ?(%d%d?) (%d%d):(%d%d):(%d%d) (%d%d%d%d) GMT$";
local months = {Jan=1,Feb=2,Mar=3,Apr=4,May=5,Jun=6,Jul=7,Aug=8,Sep=9,Oct=10,Nov=11,Dec=12};
local function parse_x509_datetime(s)
	local month, day, hour, min, sec, year = s:match(pat); month = months[month];
	return datetime_parse(("%04d-%02d-%02dT%02d:%02d:%02dZ"):format(year, month, day, hour, min, sec));
end

local weak_key_cutoff = datetime_parse("2014-01-01T00:00:00Z");

-- From RFC 4492
local weak_key_size = {
	RSA = 2048,
	DSA = 2048,
	DH  = 2048,
	EC  =  233,
}

module:hook("s2s-check-certificate", function(event)
	local host, session, cert = event.host, event.session, event.cert;
	if cert and cert.pubkey then
		local _, key_type, key_size = cert:pubkey();
		if key_size < ( weak_key_size[key_type] or 0 ) then
			local issued = parse_x509_datetime(cert:notbefore());
			if issued > weak_key_cutoff then
				session.log("warn", "%s has a %s-bit %s key issued after 31 December 2013, invalidating trust!", host, key_size, key_type);
				session.cert_chain_status = "invalid";
				session.cert_identity_status = "invalid";
			else
				session.log("warn", "%s has a %s-bit %s key", host, key_size, key_type);
			end
		else
			session.log("info", "%s has a %s-bit %s key", host, key_size, key_type);
		end
	end
end);