prosody-modules
ffd0184cd478
mod_s2s_keysize_policy/mod_s2s_keysize_policy.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody-modules

File

mod_s2s_keysize_policy/mod_s2s_keysize_policy.lua @ 6111:ffd0184cd478

mod_compliance_latest: New module that depends on and therefore loads the latest compliance tester mod. diff --git a/mod_compliance_latest/README.md b/mod_compliance_latest/README.md new file mode 100644 --- /dev/null +++ b/mod_compliance_latest/README.md @@ -0,0 +1,25 @@ +--- +summary: XMPP Compliance Suites self-test +labels: +- Stage-Beta +rockspec: + dependencies: + - mod_compliance_2023 +... + +# Introduction + +This module will always require and load to the lastest compliance tester we have in the community modules. +Currently this is [mod_compliance_2023]. + +# Configuration + +Just load this module as any other module and it will automatically install [mod_compliance_2023] if you use the Prosody plugin installer. +See the linked module for further details. + +# Compatibility + + Prosody-Version Status + --------------- ---------------------- + trunk Works as of 2024-12-22 + 0.12 Works diff --git a/mod_compliance_latest/mod_compliance_latest.lua b/mod_compliance_latest/mod_compliance_latest.lua new file mode 100644 --- /dev/null +++ b/mod_compliance_latest/mod_compliance_latest.lua @@ -0,0 +1,1 @@ +module:depends("compliance_2023");
author Menel <menel@snikket.de>
date Sun, 22 Dec 2024 18:12:42 +0100
parent 2424:27ffa6521d4e
line wrap: on
line source

-- mod_s2s_keysize_policy.lua
-- Requires LuaSec with this patch: https://github.com/brunoos/luasec/pull/12

module:set_global();

local datetime_parse = require"util.datetime".parse;
local pat = "^([JFMAONSD][ceupao][glptbvyncr])  ?(%d%d?) (%d%d):(%d%d):(%d%d) (%d%d%d%d) GMT$";
local months = {Jan=1,Feb=2,Mar=3,Apr=4,May=5,Jun=6,Jul=7,Aug=8,Sep=9,Oct=10,Nov=11,Dec=12};
local function parse_x509_datetime(s)
	local month, day, hour, min, sec, year = s:match(pat); month = months[month];
	return datetime_parse(("%04d-%02d-%02dT%02d:%02d:%02dZ"):format(year, month, day, hour, min, sec));
end

local weak_key_cutoff = datetime_parse("2014-01-01T00:00:00Z");

-- From RFC 4492
local weak_key_size = {
	RSA = 2048,
	DSA = 2048,
	DH  = 2048,
	EC  =  233,
}

module:hook("s2s-check-certificate", function(event)
	local host, session, cert = event.host, event.session, event.cert;
	if cert and cert.pubkey then
		local _, key_type, key_size = cert:pubkey();
		if key_size < ( weak_key_size[key_type] or 0 ) then
			local issued = parse_x509_datetime(cert:notbefore());
			if issued > weak_key_cutoff then
				session.log("warn", "%s has a %s-bit %s key issued after 31 December 2013, invalidating trust!", host, key_size, key_type);
				session.cert_chain_status = "invalid";
				session.cert_identity_status = "invalid";
			else
				session.log("warn", "%s has a %s-bit %s key", host, key_size, key_type);
			end
		else
			session.log("info", "%s has a %s-bit %s key", host, key_size, key_type);
		end
	end
end);