# HG changeset patch
# User Kim Alvefur <zash@zash.se>
# Date 1666486145 -7200
# Node ID 288ddca376395c4bc95027564be09e50ca0cd66f
# Parent  cf8a6710c91cbdeb62200603df76529434511a1a
mod_saslauth: Get correct 'tls-server-end-point' with new LuaSec API

MattJ contributed new APIs for retrieving the actually used certificate
and chain to LuaSec, which are not in a release at the time of this
commit.

diff -r cf8a6710c91c -r 288ddca37639 plugins/mod_saslauth.lua
--- a/plugins/mod_saslauth.lua	Wed Sep 07 11:29:00 2022 +0100
+++ b/plugins/mod_saslauth.lua	Sun Oct 23 02:49:05 2022 +0200
@@ -264,20 +264,22 @@
 	local cert_hash = self.userdata["tls-server-end-point"];
 	if cert_hash then return hex.from(cert_hash); end
 
-	-- Hash function selection, see RFC 5929 §4.1
-	local certfile = self.userdata["tls-server-end-point-cert"];
-	if not certfile then return end
-	local f = io.open(certfile);
-	if not f then return end
-	local hash = hashes.sha256;
+	local conn = self.userdata["tls-server-end-point-conn"];
+	local cert = conn.getlocalcertificate and conn:getlocalcertificate();
 
-	-- FIXME TOCTOU
-	-- We don't know that this is the right cert, it could have been replaced on
-	-- disk since we started. Best would be if we could extract the cert used
-	-- from the SSL context.
-	local certdata = f:read("*");
-	local cert = ssl.loadcertificate(certdata);
+	if not cert then
+		-- We don't know that this is the right cert, it could have been replaced on
+		-- disk since we started.
+		local certfile = self.userdata["tls-server-end-point-cert"];
+		if not certfile then return end
+		local f = io.open(certfile);
+		if not f then return end
+		local certdata = f:read("*");
+		cert = ssl.loadcertificate(certdata);
+	end
 
+	-- Hash function selection, see RFC 5929 §4.1
+	local hash = hashes.sha256;
 	if cert.getsignaturename then
 		local sigalg = cert:getsignaturename():lower():match("sha%d+");
 		if sigalg and sigalg ~= "sha1" and hashes[sigalg] then
@@ -337,6 +339,7 @@
 					["tls-unique"] = origin.conn;
 					["tls-exporter"] = origin.conn;
 					["tls-server-end-point-cert"] = certfile;
+					["tls-server-end-point-conn"] = origin.conn;
 					["tls-server-end-point"] = tls_server_end_point_hash;
 				};
 			else