Mercurial > prosody-hg

annotate plugins/mod_s2s_auth_dane_in.lua @ 14167:f149652cb5ff 13.0

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_cloud_notify: Use correct stanza id when clearing table entries (mem leak) The memory leak fix in 041c7ff18f76 was insufficient, as the wrong stanza id was used to clear the table entries.
author Matthew Wild <mwild1@gmail.com>
date Tue, 19 May 2026 19:26:42 +0100
parents 4ed802e45af6
children b5eeb6730721
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
13297
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
1 module:set_global();
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
2
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
3 local dns = require "prosody.net.adns";
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
4 local async = require "prosody.util.async";
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
5 local encodings = require "prosody.util.encodings";
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
6 local hashes = require "prosody.util.hashes";
14105
4ed802e45af6 mod_s2s_auth_dane_in: Don't attempt DANCE with IP addresses (fixes #1988)
Kim Alvefur <zash@zash.se>
parents: 13923
diff changeset
7 local inet_pton = require "prosody.util.net".pton;
13297
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
8 local promise = require "prosody.util.promise";
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
9 local x509 = require "prosody.util.x509";
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
10
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
11 local idna_to_ascii = encodings.idna.to_ascii;
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
12 local sha256 = hashes.sha256;
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
13 local sha512 = hashes.sha512;
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
14
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
15 local use_dane = module:get_option_boolean("use_dane", nil);
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
16 if use_dane == nil then
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
17 module:log("warn", "DANE support incomplete, add use_dane = true in the global section to support outgoing s2s connections");
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
18 elseif use_dane == false then
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
19 module:log("debug", "DANE support disabled with use_dane = false, disabling.")
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
20 return
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
21 end
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
22
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
23 local function ensure_secure(r)
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
24 assert(r.secure, "insecure");
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
25 return r;
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
26 end
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
27
13417
b1e2dd6e735b mod_s2s_auth_dane_in: Try single TLSA lookup per draft-ietf-dance-client-auth
Kim Alvefur <zash@zash.se>
parents: 13416
diff changeset
28 local function ensure_nonempty(r)
b1e2dd6e735b mod_s2s_auth_dane_in: Try single TLSA lookup per draft-ietf-dance-client-auth
Kim Alvefur <zash@zash.se>
parents: 13416
diff changeset
29 assert(r[1], "empty");
b1e2dd6e735b mod_s2s_auth_dane_in: Try single TLSA lookup per draft-ietf-dance-client-auth
Kim Alvefur <zash@zash.se>
parents: 13416
diff changeset
30 return r;
b1e2dd6e735b mod_s2s_auth_dane_in: Try single TLSA lookup per draft-ietf-dance-client-auth
Kim Alvefur <zash@zash.se>
parents: 13416
diff changeset
31 end
b1e2dd6e735b mod_s2s_auth_dane_in: Try single TLSA lookup per draft-ietf-dance-client-auth
Kim Alvefur <zash@zash.se>
parents: 13416
diff changeset
32
13416
d8e885db9851 mod_s2s_auth_dane_in: Simplify result processing
Kim Alvefur <zash@zash.se>
parents: 13322
diff changeset
33 local function flatten(a)
d8e885db9851 mod_s2s_auth_dane_in: Simplify result processing
Kim Alvefur <zash@zash.se>
parents: 13322
diff changeset
34 local seen = {};
d8e885db9851 mod_s2s_auth_dane_in: Simplify result processing
Kim Alvefur <zash@zash.se>
parents: 13322
diff changeset
35 local ret = {};
d8e885db9851 mod_s2s_auth_dane_in: Simplify result processing
Kim Alvefur <zash@zash.se>
parents: 13322
diff changeset
36 for _, rrset in ipairs(a) do
d8e885db9851 mod_s2s_auth_dane_in: Simplify result processing
Kim Alvefur <zash@zash.se>
parents: 13322
diff changeset
37 for _, rr in ipairs(rrset) do
d8e885db9851 mod_s2s_auth_dane_in: Simplify result processing
Kim Alvefur <zash@zash.se>
parents: 13322
diff changeset
38 if not seen[tostring(rr)] then
d8e885db9851 mod_s2s_auth_dane_in: Simplify result processing
Kim Alvefur <zash@zash.se>
parents: 13322
diff changeset
39 table.insert(ret, rr);
d8e885db9851 mod_s2s_auth_dane_in: Simplify result processing
Kim Alvefur <zash@zash.se>
parents: 13322
diff changeset
40 seen[tostring(rr)] = true;
d8e885db9851 mod_s2s_auth_dane_in: Simplify result processing
Kim Alvefur <zash@zash.se>
parents: 13322
diff changeset
41 end
d8e885db9851 mod_s2s_auth_dane_in: Simplify result processing
Kim Alvefur <zash@zash.se>
parents: 13322
diff changeset
42 end
d8e885db9851 mod_s2s_auth_dane_in: Simplify result processing
Kim Alvefur <zash@zash.se>
parents: 13322
diff changeset
43 end
d8e885db9851 mod_s2s_auth_dane_in: Simplify result processing
Kim Alvefur <zash@zash.se>
parents: 13322
diff changeset
44 return ret;
d8e885db9851 mod_s2s_auth_dane_in: Simplify result processing
Kim Alvefur <zash@zash.se>
parents: 13322
diff changeset
45 end
d8e885db9851 mod_s2s_auth_dane_in: Simplify result processing
Kim Alvefur <zash@zash.se>
parents: 13322
diff changeset
46
13297
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
47 local lazy_tlsa_mt = {
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
48 __index = function(t, i)
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
49 if i == 1 then
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
50 local h = sha256(t[0]);
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
51 t[1] = h;
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
52 return h;
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
53 elseif i == 2 then
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
54 local h = sha512(t[0]);
13923
e6087c733899 mod_s2s_auth_dane_in: Fix caching SHA2-512 hash
Kim Alvefur <zash@zash.se>
parents: 13417
diff changeset
55 t[2] = h;
13297
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
56 return h;
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
57 end
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
58 end;
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
59 }
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
60 local function lazy_hash(t)
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
61 return setmetatable(t, lazy_tlsa_mt);
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
62 end
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
63
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
64 module:hook("s2s-check-certificate", function(event)
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
65 local session, host, cert = event.session, event.host, event.cert;
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
66 local log = session.log or module._log;
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
67
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
68 if not host or not cert or session.direction ~= "incoming" then
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
69 return
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
70 end
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
71
14105
4ed802e45af6 mod_s2s_auth_dane_in: Don't attempt DANCE with IP addresses (fixes #1988)
Kim Alvefur <zash@zash.se>
parents: 13923
diff changeset
72 if inet_pton(host) or host:sub(1,1) == '[' then
4ed802e45af6 mod_s2s_auth_dane_in: Don't attempt DANCE with IP addresses (fixes #1988)
Kim Alvefur <zash@zash.se>
parents: 13923
diff changeset
73 -- No DANCEing with IP literals
4ed802e45af6 mod_s2s_auth_dane_in: Don't attempt DANCE with IP addresses (fixes #1988)
Kim Alvefur <zash@zash.se>
parents: 13923
diff changeset
74 return
4ed802e45af6 mod_s2s_auth_dane_in: Don't attempt DANCE with IP addresses (fixes #1988)
Kim Alvefur <zash@zash.se>
parents: 13923
diff changeset
75 end
4ed802e45af6 mod_s2s_auth_dane_in: Don't attempt DANCE with IP addresses (fixes #1988)
Kim Alvefur <zash@zash.se>
parents: 13923
diff changeset
76
13297
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
77 local by_select_match = {
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
78 [0] = lazy_hash {
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
79 -- cert
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
80 [0] = x509.pem2der(cert:pem());
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
81
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
82 };
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
83 }
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
84 if cert.pubkey then
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
85 by_select_match[1] = lazy_hash {
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
86 -- spki
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
87 [0] = x509.pem2der(cert:pubkey());
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
88 };
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
89 end
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
90
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
91 local resolver = dns.resolver();
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
92
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
93 local dns_domain = idna_to_ascii(host);
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
94
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
95 local function fetch_tlsa(res)
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
96 local tlsas = {};
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
97 for _, rr in ipairs(res) do
13322
28211ed70b4c mod_s2s_auth_dane_in: Bail out on explicit service denial
Kim Alvefur <zash@zash.se>
parents: 13297
diff changeset
98 if rr.srv.target == "." then return {}; end
13297
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
99 table.insert(tlsas, resolver:lookup_promise(("_%d._tcp.%s"):format(rr.srv.port, rr.srv.target), "TLSA"):next(ensure_secure));
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
100 end
13416
d8e885db9851 mod_s2s_auth_dane_in: Simplify result processing
Kim Alvefur <zash@zash.se>
parents: 13322
diff changeset
101 return promise.all(tlsas):next(flatten);
13297
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
102 end
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
103
13417
b1e2dd6e735b mod_s2s_auth_dane_in: Try single TLSA lookup per draft-ietf-dance-client-auth
Kim Alvefur <zash@zash.se>
parents: 13416
diff changeset
104 local ret = async.wait_for(resolver:lookup_promise("_xmpp-server." .. dns_domain, "TLSA"):next(ensure_secure):next(ensure_nonempty):catch(function()
b1e2dd6e735b mod_s2s_auth_dane_in: Try single TLSA lookup per draft-ietf-dance-client-auth
Kim Alvefur <zash@zash.se>
parents: 13416
diff changeset
105 return promise.all({
b1e2dd6e735b mod_s2s_auth_dane_in: Try single TLSA lookup per draft-ietf-dance-client-auth
Kim Alvefur <zash@zash.se>
parents: 13416
diff changeset
106 resolver:lookup_promise("_xmpps-server._tcp." .. dns_domain, "SRV"):next(ensure_secure):next(fetch_tlsa);
b1e2dd6e735b mod_s2s_auth_dane_in: Try single TLSA lookup per draft-ietf-dance-client-auth
Kim Alvefur <zash@zash.se>
parents: 13416
diff changeset
107 resolver:lookup_promise("_xmpp-server._tcp." .. dns_domain, "SRV"):next(ensure_secure):next(fetch_tlsa);
b1e2dd6e735b mod_s2s_auth_dane_in: Try single TLSA lookup per draft-ietf-dance-client-auth
Kim Alvefur <zash@zash.se>
parents: 13416
diff changeset
108 }):next(flatten);
b1e2dd6e735b mod_s2s_auth_dane_in: Try single TLSA lookup per draft-ietf-dance-client-auth
Kim Alvefur <zash@zash.se>
parents: 13416
diff changeset
109 end));
13297
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
110
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
111 if not ret then
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
112 return
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
113 end
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
114
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
115 local found_supported = false;
13416
d8e885db9851 mod_s2s_auth_dane_in: Simplify result processing
Kim Alvefur <zash@zash.se>
parents: 13322
diff changeset
116 for _, rr in ipairs(ret) do
d8e885db9851 mod_s2s_auth_dane_in: Simplify result processing
Kim Alvefur <zash@zash.se>
parents: 13322
diff changeset
117 if rr.tlsa.use == 3 and by_select_match[rr.tlsa.select] and rr.tlsa.match <= 2 then
d8e885db9851 mod_s2s_auth_dane_in: Simplify result processing
Kim Alvefur <zash@zash.se>
parents: 13322
diff changeset
118 found_supported = true;
d8e885db9851 mod_s2s_auth_dane_in: Simplify result processing
Kim Alvefur <zash@zash.se>
parents: 13322
diff changeset
119 if rr.tlsa.data == by_select_match[rr.tlsa.select][rr.tlsa.match] then
d8e885db9851 mod_s2s_auth_dane_in: Simplify result processing
Kim Alvefur <zash@zash.se>
parents: 13322
diff changeset
120 module:log("debug", "%s matches", rr)
d8e885db9851 mod_s2s_auth_dane_in: Simplify result processing
Kim Alvefur <zash@zash.se>
parents: 13322
diff changeset
121 session.cert_chain_status = "valid";
d8e885db9851 mod_s2s_auth_dane_in: Simplify result processing
Kim Alvefur <zash@zash.se>
parents: 13322
diff changeset
122 session.cert_identity_status = "valid";
d8e885db9851 mod_s2s_auth_dane_in: Simplify result processing
Kim Alvefur <zash@zash.se>
parents: 13322
diff changeset
123 return true;
13297
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
124 end
13416
d8e885db9851 mod_s2s_auth_dane_in: Simplify result processing
Kim Alvefur <zash@zash.se>
parents: 13322
diff changeset
125 else
d8e885db9851 mod_s2s_auth_dane_in: Simplify result processing
Kim Alvefur <zash@zash.se>
parents: 13322
diff changeset
126 log("debug", "Unsupported DANE TLSA record: %s", rr);
13297
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
127 end
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
128 end
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
129
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
130 if found_supported then
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
131 session.cert_chain_status = "invalid";
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
132 session.cert_identity_status = nil;
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
133 return true;
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
134 end
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
135
7264c4d16072 mod_s2s_auth_dane_in: DANE support for s2sin
Kim Alvefur <zash@zash.se>
parents:
diff changeset
136 end, 800);