Changeset

3220:0e78523f8c20

mod_watchuntrusted: Add option to ignore domains
author Michel Le Bihan <michel@lebihan.pl>
date Wed, 08 Aug 2018 15:58:50 +0200
parents 3219:58d61459cdb1
children 3221:b98c7c33550e
files mod_watchuntrusted/README.markdown mod_watchuntrusted/mod_watchuntrusted.lua
diffstat 2 files changed, 12 insertions(+), 3 deletions(-) [+]
line wrap: on
line diff
--- a/mod_watchuntrusted/README.markdown	Wed Aug 08 15:20:52 2018 +0200
+++ b/mod_watchuntrusted/README.markdown	Wed Aug 08 15:58:50 2018 +0200
@@ -32,6 +32,7 @@
   untrusted\_fail\_watchers       All admins                                                                                                      The users to send the message to
   untrusted\_fail\_notification   "Establishing a secure connection from \$from\_host to \$to\_host failed. Certificate hash: \$sha1. \$errors"   The message to send, \$from\_host, \$to\_host, \$sha1 and \$errors are replaced
   untrusted\_message\_type        `"chat"`                                                                                                        Which kind of message to send. `"normal"` or `"headline"` are other sensible options
+  untrusted\_ignore\_domains      Empty                                                                                                           The domains that this module should not warn about
 
 Compatibility
 =============
--- a/mod_watchuntrusted/mod_watchuntrusted.lua	Wed Aug 08 15:20:52 2018 +0200
+++ b/mod_watchuntrusted/mod_watchuntrusted.lua	Wed Aug 08 15:58:50 2018 +0200
@@ -4,6 +4,8 @@
 local secure_domains, insecure_domains =
 	module:get_option_set("s2s_secure_domains", {})._items, module:get_option_set("s2s_insecure_domains", {})._items;
 
+local ignore_domains = module:get_option_set("untrusted_ignore_domains", {})._items;
+
 local untrusted_fail_watchers = module:get_option_set("untrusted_fail_watchers", module:get_option("admins", {})) / jid_prep;
 local untrusted_fail_notification = module:get_option("untrusted_fail_notification", "Establishing a secure connection from $from_host to $to_host failed. Certificate hash: $sha256. $errors");
 
@@ -22,15 +24,21 @@
     if not (local_host == module:get_host()) then return end
 
     module:log("debug", "Checking certificate...");
+    local certificate_is_valid = false;
+
+    if session.cert_chain_status == "valid" and session.cert_identity_status == "valid" then
+        certificate_is_valid = true;
+    end
+
     local must_secure = secure_auth;
 
     if not must_secure and secure_domains[host] then
-            must_secure = true;
+        must_secure = true;
     elseif must_secure and insecure_domains[host] then
-            must_secure = false;
+        must_secure = false;
     end
 
-    if must_secure and (session.cert_chain_status ~= "valid" or session.cert_identity_status ~= "valid") and not notified_about_already[host] then
+    if must_secure and not certificate_is_valid and not notified_about_already[host] and not ignore_domains[host] then
 		notified_about_already[host] = os.time();
 		local _, errors = conn:getpeerverification();
 		local error_message = "";