mirrors/prosody
1
0
Fork 0
mirror of https://github.com/bjc/prosody.git synced 2025-04-04 13:47:41 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

util.sslconfig: Support DH parameters as literal string

Browse source 
Simplifies shipping well-known DH parameters in the config
This commit is contained in:
Kim Alvefur 2024-07-12 15:21:08 +02:00
parent b9cfebff24
commit dd657746b4
2 changed files with 16 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

5
net/tls_luasec.lua
View file

@ -54,7 +54,10 @@ local function new_context(cfg, builder)
-- LuaSec expects dhparam to be a callback that takes two arguments. -- LuaSec expects dhparam to be a callback that takes two arguments.
-- We ignore those because it is mostly used for having a separate -- We ignore those because it is mostly used for having a separate
-- set of params for EXPORT ciphers, which we don't have by default. -- set of params for EXPORT ciphers, which we don't have by default.
if type(cfg.dhparam) == "string" then if type(cfg.dhparam) == "string" and cfg.dhparam:sub(1, 10) == "-----BEGIN" then
local dhparam = cfg.dhparam;
cfg.dhparam = function() return dhparam; end
elseif type(cfg.dhparam) == "string" then
local f, err = io_open(cfg.dhparam); local f, err = io_open(cfg.dhparam);
if not f then return nil, "Could not open DH parameters: "..err end if not f then return nil, "Could not open DH parameters: "..err end
local dhparam = f:read("*a"); local dhparam = f:read("*a");

14
util/sslconfig.lua
View file

@ -84,8 +84,18 @@ end
finalisers.certificate = finalisers.key; finalisers.certificate = finalisers.key;
finalisers.cafile = finalisers.key; finalisers.cafile = finalisers.key;
finalisers.capath = finalisers.key; finalisers.capath = finalisers.key;
-- XXX: copied from core/certmanager.lua, but this seems odd, because it would remove a dhparam function from the config
finalisers.dhparam = finalisers.key; function finalisers.dhparam(value, config)
if type(value) == "string" then
if value:sub(1, 10) == "-----BEGIN" then
-- literal value
return value;
else
-- assume a filename
return resolve_path(config._basedir, value);
end
end
end
-- protocol = "x" should enable only that protocol -- protocol = "x" should enable only that protocol
-- protocol = "x+" should enable x and later versions -- protocol = "x+" should enable x and later versions