prosody
7e9ebdc75ce4
plugins/mod_s2s_auth_certs.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Comparison

plugins/mod_s2s_auth_certs.lua @ 12480:7e9ebdc75ce4

net: isolate LuaSec-specifics For this, various accessor functions are now provided directly on the sockets, which reach down into the LuaSec implementation to obtain the information. While this may seem of little gain at first, it hides the implementation detail of the LuaSec+LuaSocket combination that the actual socket and the TLS layer are separate objects. The net gain here is that an alternative implementation does not have to emulate that specific implementation detail and "only" has to expose LuaSec-compatible data structures on the new functions.
author Jonas Schäfer <jonas@wielicki.name>
date Wed, 27 Apr 2022 17:44:14 +0200
parent 11835:a405884c62f4
child 12808:12bd40b8e105
comparison
equal deleted inserted replaced
12478:82270a6b1234 12480:7e9ebdc75ce4
7 local measure_cert_statuses = module:metric("counter", "checked", "", "Certificate validation results", 7 local measure_cert_statuses = module:metric("counter", "checked", "", "Certificate validation results",
8 { "chain"; "identity" }) 8 { "chain"; "identity" })
9 9
10 module:hook("s2s-check-certificate", function(event) 10 module:hook("s2s-check-certificate", function(event)
11 local session, host, cert = event.session, event.host, event.cert; 11 local session, host, cert = event.session, event.host, event.cert;
12 local conn = session.conn:socket(); 12 local conn = session.conn;
13 local log = session.log or log; 13 local log = session.log or log;
14 14
15 if not cert then 15 if not cert then
16 log("warn", "No certificate provided by %s", host or "unknown host"); 16 log("warn", "No certificate provided by %s", host or "unknown host");
17 return; 17 return;
18 end 18 end
19 19
20 local chain_valid, errors; 20 local chain_valid, errors;
21 if conn.getpeerverification then 21 if conn.ssl_peerverification then
22 chain_valid, errors = conn:getpeerverification(); 22 chain_valid, errors = conn:ssl_peerverification();
23 else 23 else
24 chain_valid, errors = false, { { "Chain verification not supported by this version of LuaSec" } }; 24 chain_valid, errors = false, { { "Chain verification not supported by this version of LuaSec" } };
25 end 25 end
26 -- Is there any interest in printing out all/the number of errors here? 26 -- Is there any interest in printing out all/the number of errors here?
27 if not chain_valid then 27 if not chain_valid then