mirrors/prosody
1
0
Fork 0
mirror of https://github.com/bjc/prosody.git synced 2025-04-04 21:57:45 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

mod_s2s_auth_certs: Warn about lack of certificate (Mostly jabberd14 not sending a client certificate)

Browse source
This commit is contained in:
Kim Alvefur 2014-08-29 02:24:49 +02:00
parent f475cd3658
commit a2ce0553f8
1 changed files with 32 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

61
plugins/mod_s2s_auth_certs.lua
View file

@ -7,39 +7,42 @@ local log = module._log;
module:hook("s2s-check-certificate", function(event) module:hook("s2s-check-certificate", function(event)
local session, host, cert = event.session, event.host, event.cert; local session, host, cert = event.session, event.host, event.cert;
local conn = session.conn:socket(); local conn = session.conn:socket();
local log = session.log or log;
if cert then if not cert then
local log = session.log or log; log("warn", "No certificate provided by %s", host or "unknown host");
local chain_valid, errors; return;
if conn.getpeerverification then end
chain_valid, errors = conn:getpeerverification();
elseif conn.getpeerchainvalid then -- COMPAT mw/luasec-hg local chain_valid, errors;
chain_valid, errors = conn:getpeerchainvalid(); if conn.getpeerverification then
errors = (not chain_valid) and { { errors } } or nil; chain_valid, errors = conn:getpeerverification();
else elseif conn.getpeerchainvalid then -- COMPAT mw/luasec-hg
chain_valid, errors = false, { { "Chain verification not supported by this version of LuaSec" } }; chain_valid, errors = conn:getpeerchainvalid();
errors = (not chain_valid) and { { errors } } or nil;
else
chain_valid, errors = false, { { "Chain verification not supported by this version of LuaSec" } };
end
-- Is there any interest in printing out all/the number of errors here?
if not chain_valid then
log("debug", "certificate chain validation result: invalid");
for depth, t in pairs(errors or NULL) do
log("debug", "certificate error(s) at depth %d: %s", depth-1, table.concat(t, ", "))
end end
-- Is there any interest in printing out all/the number of errors here? session.cert_chain_status = "invalid";
if not chain_valid then else
log("debug", "certificate chain validation result: invalid"); log("debug", "certificate chain validation result: valid");
for depth, t in pairs(errors or NULL) do session.cert_chain_status = "valid";
log("debug", "certificate error(s) at depth %d: %s", depth-1, table.concat(t, ", "))
end
session.cert_chain_status = "invalid";
else
log("debug", "certificate chain validation result: valid");
session.cert_chain_status = "valid";
-- We'll go ahead and verify the asserted identity if the -- We'll go ahead and verify the asserted identity if the
-- connecting server specified one. -- connecting server specified one.
if host then if host then
if cert_verify_identity(host, "xmpp-server", cert) then if cert_verify_identity(host, "xmpp-server", cert) then
session.cert_identity_status = "valid" session.cert_identity_status = "valid"
else else
session.cert_identity_status = "invalid" session.cert_identity_status = "invalid"
end
log("debug", "certificate identity validation result: %s", session.cert_identity_status);
end end
log("debug", "certificate identity validation result: %s", session.cert_identity_status);
end end
end end
end, 509); end, 509);