Mercurial > prosody-modules
changeset 1943:7e04ca0aa757
mod_s2s_auth_dane: Support servers without SRV records by falling back to port 5269 and the bare hostname for TLSA lookups
| author | Kim Alvefur <zash@zash.se> |
|---|---|
| date | Thu, 05 Nov 2015 14:10:11 +0100 |
| parents | ff95d983940c |
| children | 1950fa6aa0c0 |
| files | mod_s2s_auth_dane/mod_s2s_auth_dane.lua |
| diffstat | 1 files changed, 8 insertions(+), 7 deletions(-) [+] |
line wrap: on
line diff
--- a/mod_s2s_auth_dane/mod_s2s_auth_dane.lua Sun Nov 01 18:12:49 2015 +0100 +++ b/mod_s2s_auth_dane/mod_s2s_auth_dane.lua Thu Nov 05 14:10:11 2015 +0100 @@ -98,12 +98,12 @@ local n = answer.n or #answer; if n == 0 then - -- No SRV records, we could proceed with the domainname and - -- default port but that will currently not work properly since - -- mod_s2s doesn't keep the answer around for that - return cb(host_session); - end - if n == 1 and answer[1].srv.target == '.' then + -- No SRV records, synthesize fallback host and port + -- this may behave oddly for connections in the other direction if + -- mod_s2s doesn't keep the answer around + answer[1] = { srv = { target = name, port = 5269 } }; + n = 1; + elseif n == 1 and answer[1].srv.target == '.' then return cb(host_session); -- No service ... This shouldn't happen? end local srv_hosts = { answer = answer }; @@ -162,9 +162,10 @@ local srv_hosts = host_session.srv_hosts; if not ( srv_hosts and srv_hosts.answer and srv_hosts.answer.secure ) then return; -- No secure SRV records, fall back to non-DANE mode + -- Empty response were not kept by older mod_s2s/s2sout end -- Do TLSA lookup for currently selected SRV record - local srv_choice = srv_hosts[host_session.srv_choice]; + local srv_choice = srv_hosts[host_session.srv_choice or 0] or { target = idna_to_ascii(host_session.to_host), port = 5269 }; host_session.dane = dns_lookup(function(answer) if answer and ((answer.secure and #answer > 0) or answer.bogus) then srv_choice.dane = answer;