Mercurial > prosody-hg
comparison util/prosodyctl/check.lua @ 13302:30b7cd40ee14
util.prosodyctl.check: Print DANE TLSA records for certificates
Not the prosodyctl check dane I wanted to make but a start.
| author | Kim Alvefur <zash@zash.se> |
|---|---|
| date | Fri, 03 Nov 2023 23:08:07 +0100 |
| parents | 84d83f4a190f |
| children | a27a329e93ca |
comparison
equal
deleted
inserted
replaced
| 13301:84d83f4a190f | 13302:30b7cd40ee14 |
|---|---|
| 1113 end | 1113 end |
| 1114 function checks.certs() | 1114 function checks.certs() |
| 1115 local cert_ok; | 1115 local cert_ok; |
| 1116 print"Checking certificates..." | 1116 print"Checking certificates..." |
| 1117 local x509_verify_identity = require"prosody.util.x509".verify_identity; | 1117 local x509_verify_identity = require"prosody.util.x509".verify_identity; |
| 1118 local use_dane = configmanager.get("*", "use_dane"); | |
| 1119 local pem2der = require"prosody.util.x509".pem2der; | |
| 1120 local sha256 = require"prosody.util.hashes".sha256; | |
| 1118 local create_context = require "prosody.core.certmanager".create_context; | 1121 local create_context = require "prosody.core.certmanager".create_context; |
| 1119 local ssl = dependencies.softreq"ssl"; | 1122 local ssl = dependencies.softreq"ssl"; |
| 1120 -- local datetime_parse = require"util.datetime".parse_x509; | 1123 -- local datetime_parse = require"util.datetime".parse_x509; |
| 1121 local load_cert = ssl and ssl.loadcertificate; | 1124 local load_cert = ssl and ssl.loadcertificate; |
| 1122 -- or ssl.cert_from_pem | 1125 -- or ssl.cert_from_pem |
| 1178 or api(host):get_option_string("authentication", "internal_hashed") == "anonymous")) | 1181 or api(host):get_option_string("authentication", "internal_hashed") == "anonymous")) |
| 1179 and not x509_verify_identity(host, "_xmpp-server", cert) then | 1182 and not x509_verify_identity(host, "_xmpp-server", cert) then |
| 1180 print(" Not valid for server-to-server connections to "..host..".") | 1183 print(" Not valid for server-to-server connections to "..host..".") |
| 1181 cert_ok = false | 1184 cert_ok = false |
| 1182 end | 1185 end |
| 1186 if use_dane then | |
| 1187 if cert.pubkey then | |
| 1188 print(" DANE: TLSA 3 1 1 "..sha256(pem2der(cert:pubkey()), true)) | |
| 1189 elseif cert.pem then | |
| 1190 print(" DANE: TLSA 3 0 1 "..sha256(pem2der(cert:pem()), true)) | |
| 1191 end | |
| 1192 end | |
| 1183 end | 1193 end |
| 1184 end | 1194 end |
| 1185 end | 1195 end |
| 1186 end | 1196 end |
| 1187 if cert_ok == false then | 1197 if cert_ok == false then |