Mercurial > prosody-modules
changeset 2204:affccf479f89
mod_s2s_auth_samecert: Authenticate incoming s2s connection if certificate matches that of an established outgoing s2s connection
| author | Kim Alvefur <zash@zash.se> |
|---|---|
| date | Thu, 09 Jun 2016 11:46:45 +0200 |
| parents | 2dcc3079572c |
| children | 98354fbea63c |
| files | mod_s2s_auth_samecert/mod_s2s_auth_samecert.lua |
| diffstat | 1 files changed, 15 insertions(+), 0 deletions(-) [+] |
line wrap: on
line diff
--- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/mod_s2s_auth_samecert/mod_s2s_auth_samecert.lua Thu Jun 09 11:46:45 2016 +0200 @@ -0,0 +1,15 @@ +module:set_global() + +local hosts = prosody.hosts; + +module:hook("s2s-check-certificate", function(event) + local session, cert = event.session, event.cert; + if session.direction ~= "incoming" then return end + + local outgoing = hosts[session.to_host].s2sout[session.from_host]; + if outgoing and outgoing.type == "s2sout" and outgoing.secure and outgoing.conn:socket():getpeercertificate():pem() == cert:pem() then + session.cert_identity_status = outgoing.cert_identity_status; + session.cert_chain_status = outgoing.cert_chain_status; + return true; + end +end, 1000);