prosody
d6ba317cbc97
core/certmanager.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Comparison

core/certmanager.lua @ 3670:d6ba317cbc97

certmanager: Add required verify flags for cert verification if LuaSec (probably) supports them
author Matthew Wild <mwild1@gmail.com>
date Sun, 28 Nov 2010 21:09:55 +0000
parent 3609:954b1159f2f3
child 4359:c69cbac4178f
comparison
equal deleted inserted replaced
3669:4b56cd1302d4 3670:d6ba317cbc97
20 module "certmanager" 20 module "certmanager"
21 21
22 -- Global SSL options if not overridden per-host 22 -- Global SSL options if not overridden per-host
23 local default_ssl_config = configmanager.get("*", "core", "ssl"); 23 local default_ssl_config = configmanager.get("*", "core", "ssl");
24 local default_capath = "/etc/ssl/certs"; 24 local default_capath = "/etc/ssl/certs";
25 local default_verify = (ssl and ssl.x509 and { "peer", "client_once", "continue", "ignore_purpose" }) or "none";
26 local default_options = { "no_sslv2" };
25 27
26 function create_context(host, mode, user_ssl_config) 28 function create_context(host, mode, user_ssl_config)
27 user_ssl_config = user_ssl_config or default_ssl_config; 29 user_ssl_config = user_ssl_config or default_ssl_config;
28 30
29 if not ssl then return nil, "LuaSec (required for encryption) was not found"; end 31 if not ssl then return nil, "LuaSec (required for encryption) was not found"; end
35 key = resolve_path(config_path, user_ssl_config.key); 37 key = resolve_path(config_path, user_ssl_config.key);
36 password = user_ssl_config.password; 38 password = user_ssl_config.password;
37 certificate = resolve_path(config_path, user_ssl_config.certificate); 39 certificate = resolve_path(config_path, user_ssl_config.certificate);
38 capath = resolve_path(config_path, user_ssl_config.capath or default_capath); 40 capath = resolve_path(config_path, user_ssl_config.capath or default_capath);
39 cafile = resolve_path(config_path, user_ssl_config.cafile); 41 cafile = resolve_path(config_path, user_ssl_config.cafile);
40 verify = user_ssl_config.verify or "none"; 42 verify = user_ssl_config.verify or default_verify;
41 options = user_ssl_config.options or "no_sslv2"; 43 options = user_ssl_config.options or default_options;
42 ciphers = user_ssl_config.ciphers; 44 ciphers = user_ssl_config.ciphers;
43 depth = user_ssl_config.depth; 45 depth = user_ssl_config.depth;
44 }; 46 };
45 47
46 local ctx, err = ssl_newcontext(ssl_config); 48 local ctx, err = ssl_newcontext(ssl_config);