mirrors/prosody
1
0
Fork 0
mirror of https://github.com/bjc/prosody.git synced 2025-04-03 21:27:38 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

mod_s2s_auth_certs: Validate certificates against secure SRV targets

Browse source 
Secure delegation or "Mini-DANE"

As with the existing DANE support, only usable in one direction, client
certificate authentication will fail if this is relied on.
This commit is contained in:
Kim Alvefur 2022-12-22 00:13:37 +01:00
parent d257416abe
commit 85ff75c53f
1 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
plugins/mod_s2s_auth_certs.lua
View file

@ -12,6 +12,8 @@ module:hook("s2s-check-certificate", function(event)
local conn = session.conn;
local log = session.log or log;
local secure_hostname = conn.extra and conn.extra.secure_hostname;
if not cert then
log("warn", "No certificate provided by %s", host or "unknown host");
return;
@ -45,6 +47,14 @@ module:hook("s2s-check-certificate", function(event)
end
log("debug", "certificate identity validation result: %s", session.cert_identity_status);
end
-- Check for DNSSEC-signed SRV hostname
if secure_hostname and session.cert_identity_status ~= "valid" then
if cert_verify_identity(secure_hostname, "xmpp-server", cert) then
module:log("info", "Secure SRV name delegation %q -> %q", secure_hostname, host);
session.cert_identity_status = "valid"
end
end
end
measure_cert_statuses:with_labels(session.cert_chain_status or "unknown", session.cert_identity_status or "unknown"):add(1);
end, 509);