Software / code / prosody
Changeset
11414:5a71f14ab77c
net.connect: Add DANE support
Disabled DANE by default, since it needs extra steps to be useful. The
built-in DNS stub resolver does not support DNSSEC so having DANE
enabled by default only leads to an extra wasted DNS request.
| author | Kim Alvefur <zash@zash.se> |
|---|---|
| date | Tue, 02 Mar 2021 22:41:59 +0100 |
| parents | 11413:9fb23779c863 |
| children | 11415:a38f9e09ca31 |
| files | CHANGES net/resolvers/basic.lua |
| diffstat | 2 files changed, 27 insertions(+), 1 deletions(-) [+] |
line wrap: on
line diff
--- a/CHANGES Sun Sep 29 16:53:56 2019 +0200 +++ b/CHANGES Tue Mar 02 22:41:59 2021 +0100 @@ -17,6 +17,7 @@ - `daemonize` option deprecated - SASL DIGEST-MD5 removed - Switch to libunbound for DNS queries +- DANE Support - mod_external_services (XEP-0215) - util.error for encapsulating errors - MUC: support for XEP-0421 occupant identifiers
--- a/net/resolvers/basic.lua Sun Sep 29 16:53:56 2019 +0200 +++ b/net/resolvers/basic.lua Tue Mar 02 22:41:59 2021 +0100 @@ -28,12 +28,23 @@ return; end + local secure = true; + local tlsa = {}; local targets = {}; - local n = 2; + local n = 3; local function ready() n = n - 1; if n > 0 then return; end self.targets = targets; + if self.extra and self.extra.use_dane then + if secure then + self.extra.tlsa = tlsa; + self.extra.dane_hostname = self.hostname; + else + self.extra.tlsa = nil; + self.extra.dane_hostname = nil; + end + end self:next(cb); end @@ -43,6 +54,7 @@ if not self.extra or self.extra.use_ipv4 ~= false then dns_resolver:lookup(function (answer) if answer then + secure = secure and answer.secure; for _, record in ipairs(answer) do table.insert(targets, { self.conn_type.."4", record.a, self.port, self.extra }); end @@ -56,12 +68,25 @@ if not self.extra or self.extra.use_ipv6 ~= false then dns_resolver:lookup(function (answer) if answer then + secure = secure and answer.secure; for _, record in ipairs(answer) do table.insert(targets, { self.conn_type.."6", record.aaaa, self.port, self.extra }); end end ready(); end, self.hostname, "AAAA", "IN"); + end + + if self.extra and self.extra.use_dane == true then + dns_resolver:lookup(function (answer) + if answer then + secure = secure and answer.secure; + for _, record in ipairs(answer) do + table.insert(tlsa, record.tlsa); + end + end + ready(); + end, ("_%d._tcp.%s"):format(self.port, self.hostname), "TLSA", "IN"); else ready(); end
