Mercurial > prosody-modules

view mod_s2s_keysize_policy/mod_s2s_keysize_policy.lua @ 6352:525655adfd3e

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_report_affiliations: Fix traceback a non-user is sending a presence For now we won’t touch their presence instead of emiting this traceback: error Traceback[s2s]: /usr/lib/prosody/core/rostermanager.lua:275: attempt to concatenate a nil value (local 'username') stack traceback: /usr/lib/prosody/core/rostermanager.lua:275: in function 'prosody.core.rostermanager.is_user_subscribed' ...ules/mod_report_affiliations/mod_report_affiliations.lua:116: in field '?' /usr/lib/prosody/util/events.lua:81: in function </usr/lib/prosody/util/events.lua:77> (...tail calls...) /usr/lib/prosody/core/stanza_router.lua:184: in upvalue 'core_post_stanza' /usr/lib/prosody/modules/mod_presence.lua:244: in function </usr/lib/prosody/modules/mod_presence.lua:231> (...tail calls...) /usr/lib/prosody/util/events.lua:81: in function </usr/lib/prosody/util/events.lua:77> (...tail calls...) /usr/lib/prosody/core/stanza_router.lua:188: in upvalue 'core_post_stanza' /usr/lib/prosody/core/stanza_router.lua:128: in upvalue 'core_process_stanza' /usr/lib/prosody/modules/mod_s2s.lua:818: in upvalue 'func' /usr/lib/prosody/util/async.lua:149: in function </usr/lib/prosody/util/async.lua:147>
author Link Mauve <linkmauve@linkmauve.fr>
date Tue, 30 Dec 2025 13:19:43 +0100
parents 27ffa6521d4e
children
line wrap: on
line source

-- mod_s2s_keysize_policy.lua
-- Requires LuaSec with this patch: https://github.com/brunoos/luasec/pull/12

module:set_global();

local datetime_parse = require"util.datetime".parse;
local pat = "^([JFMAONSD][ceupao][glptbvyncr])  ?(%d%d?) (%d%d):(%d%d):(%d%d) (%d%d%d%d) GMT$";
local months = {Jan=1,Feb=2,Mar=3,Apr=4,May=5,Jun=6,Jul=7,Aug=8,Sep=9,Oct=10,Nov=11,Dec=12};
local function parse_x509_datetime(s)
	local month, day, hour, min, sec, year = s:match(pat); month = months[month];
	return datetime_parse(("%04d-%02d-%02dT%02d:%02d:%02dZ"):format(year, month, day, hour, min, sec));
end

local weak_key_cutoff = datetime_parse("2014-01-01T00:00:00Z");

-- From RFC 4492
local weak_key_size = {
	RSA = 2048,
	DSA = 2048,
	DH  = 2048,
	EC  =  233,
}

module:hook("s2s-check-certificate", function(event)
	local host, session, cert = event.host, event.session, event.cert;
	if cert and cert.pubkey then
		local _, key_type, key_size = cert:pubkey();
		if key_size < ( weak_key_size[key_type] or 0 ) then
			local issued = parse_x509_datetime(cert:notbefore());
			if issued > weak_key_cutoff then
				session.log("warn", "%s has a %s-bit %s key issued after 31 December 2013, invalidating trust!", host, key_size, key_type);
				session.cert_chain_status = "invalid";
				session.cert_identity_status = "invalid";
			else
				session.log("warn", "%s has a %s-bit %s key", host, key_size, key_type);
			end
		else
			session.log("info", "%s has a %s-bit %s key", host, key_size, key_type);
		end
	end
end);