prosody-modules
f853a1a3aa15
mod_auth_ccert/mod_auth_ccert.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody-modules

Comparison

mod_auth_ccert/mod_auth_ccert.lua @ 1062:f853a1a3aa15

mod_auth_ccert: Initial commit of authentication module for using CA-issued client certificates
author Kim Alvefur <zash@zash.se>
date Thu, 13 Jun 2013 21:25:12 +0200
child 1063:b2a4679e7d20
comparison
equal deleted inserted replaced
1061:f4031e7ccec1 1062:f853a1a3aa15
1 -- Copyright (C) 2013 Kim Alvefur
2 --
3 -- This file is MIT/X11 licensed.
4
5 local jid_compare = require "util.jid".compare;
6 local jid_split = require "util.jid".prepped_split;
7 local new_sasl = require "util.sasl".new;
8 local log = module._log;
9 local subject_alternative_name = "2.5.29.17";
10 local id_on_xmppAddr = "1.3.6.1.5.5.7.8.5";
11 local now = os.time;
12
13 function get_sasl_handler(session)
14 return new_sasl(module.host, {
15 external = session.secure and function(authz)
16 if session.secure then
17 -- getpeercertificate() on a TCP connection would be bad, abort!
18 (session.log or log)("error", "How did you manage to select EXTERNAL without TLS?");
19 return nil, false;
20 end
21 local sock = session.conn:socket();
22 local cert = sock:getpeercertificate();
23 if not cert then
24 (session.log or log)("warn", "No certificate provided");
25 return nil, false;
26 end
27
28 if not cert:validat(now()) then
29 (session.log or log)("warn", "Client certificate expired")
30 return nil, "expired";
31 end
32
33 local chain_valid, chain_errors = sock:getpeerverification();
34 if not chain_valid then
35 (session.log or log)("warn", "Invalid client certificate chain");
36 for i, error in ipairs(chain_errors) do
37 (session.log or log)("warn", "%d: %s", i, table.concat(chain_errors, ", "));
38 end
39 return nil, false;
40 end
41
42 local extensions = cert:extensions();
43 local SANs = extensions[subject_alternative_name];
44 local xmppAddrs = SANs and SANs[id_on_xmppAddr];
45
46 if not xmppAddrs then
47 (session.log or log)("warn", "Client certificate contains no xmppAddrs");
48 return nil, false;
49 end
50
51 for i=1,#xmppAddrs do
52 if authz == "" or jid_compare(authz, xmppAddrs[i]) then
53 (session.log or log)("debug", "xmppAddrs[%d] %q matches authz %q", i, xmppAddrs[i], authz)
54 local username, host = jid_split(xmppAddrs[i]);
55 if host == module.host then
56 return username, true
57 end
58 end
59 end
60 end
61 });
62 end
63
64 module:provides "auth";