mirrors/prosody
1
0
Fork 0
mirror of https://github.com/bjc/prosody.git synced 2025-04-05 22:27:38 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

mod_s2s: Improve robustness of outgoing s2s certificate verification

Browse source 
This change ensures we have positively verified the certificates of the server
we are connecting to before marking the session as authenticated. It protects
against situations where the verify-or-close stage of the connection was
interrupted (e.g. due to an uncaught error).

Thanks to Zash for discovery and testing.
This commit is contained in:
Matthew Wild 2022-04-25 15:07:49 +01:00
parent 89934124b8
commit f86d1517ce
1 changed files with 11 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

11
plugins/mod_s2s.lua
View file

@ -349,6 +349,15 @@ function make_authenticated(event)
}, nil, "Could not establish encrypted connection to remote server");
end
end
if session.type == "s2sout_unauthed" and not session.authenticated_remote and secure_auth and not insecure_domains[host] then
session:close({
condition = "policy-violation";
text = "Failed to verify certificate (internal error)";
});
return;
end
if hosts[host] then
session:close({ condition = "undefined-condition", text = "Attempt to authenticate as a host we serve" });
end
@ -531,6 +540,8 @@ function stream_callbacks._streamopened(session, attr)
if session.secure and not session.cert_chain_status then
if check_cert_status(session) == false then
return;
else
session.authenticated_remote = true;
end
end