25
1
mirror of https://github.com/processone/ejabberd.git synced 2024-10-05 14:51:05 +02:00

* src/ejabberd_config.erl: Support for per host certificates

* src/ejabberd_c2s.erl: Likewise
* src/ejabberd_s2s_out.erl: Likewise
* src/ejabberd.cfg.example: Updated

* src/ejabberd_s2s_in.erl: Fixed id-on-xmppAddr processing

SVN Revision: 432
This commit is contained in:
Alexey Shchepin 2005-11-05 21:15:53 +00:00
parent eb1b33c5a4
commit 719cd49e59
6 changed files with 86 additions and 24 deletions

View File

@ -1,3 +1,12 @@
2005-11-05 Alexey Shchepin <alexey@sevcom.net>
* src/ejabberd_config.erl: Support for per host certificates
* src/ejabberd_c2s.erl: Likewise
* src/ejabberd_s2s_out.erl: Likewise
* src/ejabberd.cfg.example: Updated
* src/ejabberd_s2s_in.erl: Fixed id-on-xmppAddr processing
2005-11-03 Alexey Shchepin <alexey@sevcom.net>
* src/mod_disco.erl: Fixed extra_domains option processing

View File

@ -119,6 +119,8 @@
% Use STARTTLS+Dialback for S2S connections
{s2s_use_starttls, true}.
{s2s_certfile, "./ssl.pem"}.
%{domain_certfile, "example.org", "./example_org.pem"}.
%{domain_certfile, "example.com", "./example_com.pem"}.
% If SRV lookup fails, then port 5269 is used to communicate with remote server
{outgoing_s2s_port, 5269}.

View File

@ -473,7 +473,16 @@ wait_for_feature_request({xmlstreamelement, El}, StateData) ->
TLSEnabled == false,
SockMod == gen_tcp ->
Socket = StateData#state.socket,
TLSOpts = StateData#state.tls_options,
TLSOpts = case ejabberd_config:get_local_option(
{domain_certfile, StateData#state.server}) of
undefined ->
StateData#state.tls_options;
CertFile ->
[{certfile, CertFile} |
lists:keydelete(
certfile, 1, StateData#state.tls_options)]
end,
io:format("O: ~p~n", [TLSOpts]),
{ok, TLSSocket} = tls:tcp_to_tls(Socket, TLSOpts),
ejabberd_receiver:starttls(StateData#state.receiver, TLSSocket),
send_element(StateData,

View File

@ -110,8 +110,10 @@ process_term(Term, State) ->
add_option(outgoing_s2s_port, Port, State);
{s2s_use_starttls, Port} ->
add_option(s2s_use_starttls, Port, State);
{s2s_certfile, Port} ->
add_option(s2s_certfile, Port, State);
{s2s_certfile, CertFile} ->
add_option(s2s_certfile, CertFile, State);
{domain_certfile, Domain, CertFile} ->
add_option({domain_certfile, Domain}, CertFile, State);
{Opt, Val} ->
lists:foldl(fun(Host, S) -> process_host_term(Term, Host, S) end,
State, State#state.hosts)

View File

@ -31,6 +31,7 @@
-include("jlib.hrl").
%-include_lib("ssl/pkix/SSL-PKIX.hrl").
-include_lib("ssl/pkix/PKIX1Explicit88.hrl").
-include_lib("ssl/pkix/PKIX1Implicit88.hrl").
-include("tls/XmppAddr.hrl").
-define(DICT, dict).
@ -542,6 +543,8 @@ is_key_packet(_) ->
get_cert_domains(Cert) ->
{rdnSequence, Subject} =
(Cert#'Certificate'.tbsCertificate)#'TBSCertificate'.subject,
Extensions =
(Cert#'Certificate'.tbsCertificate)#'TBSCertificate'.extensions,
lists:flatmap(
fun(#'AttributeTypeAndValue'{type = ?'id-at-commonName',
value = Val}) ->
@ -555,11 +558,13 @@ get_cert_domains(Cert) ->
end,
if
D /= error ->
case jlib:nameprep(D) of
error ->
[];
LD ->
[LD]
case jlib:string_to_jid(D) of
#jid{luser = "",
lserver = LD,
lresource = ""} ->
[LD];
_ ->
[]
end;
true ->
[]
@ -567,23 +572,48 @@ get_cert_domains(Cert) ->
_ ->
[]
end;
(#'AttributeTypeAndValue'{type = ?'id-on-xmppAddr',
value = Val}) ->
case 'XmppAddr':decode(
'XmppAddr', Val) of
{ok, D} when is_binary(D) ->
case jlib:nameprep(binary_to_list(D)) of
error ->
[];
LD ->
[LD]
end;
_ ->
[]
end;
(_) ->
[]
end, lists:flatten(Subject)).
end, lists:flatten(Subject)) ++
lists:flatmap(
fun(#'Extension'{extnID = ?'id-ce-subjectAltName',
extnValue = Val}) ->
BVal = if
is_list(Val) -> list_to_binary(Val);
is_binary(Val) -> Val;
true -> Val
end,
case 'PKIX1Implicit88':decode('SubjectAltName', BVal) of
{ok, SANs} ->
lists:flatmap(
fun({otherName,
#'AnotherName'{'type-id' = ?'id-on-xmppAddr',
value = XmppAddr
}}) ->
case 'XmppAddr':decode(
'XmppAddr', XmppAddr) of
{ok, D} when is_binary(D) ->
case jlib:string_to_jid(
binary_to_list(D)) of
#jid{luser = "",
lserver = LD,
lresource = ""} ->
[LD];
_ ->
[]
end;
_ ->
[]
end;
(_) ->
[]
end, SANs);
_ ->
[]
end;
(_) ->
[]
end, Extensions).

View File

@ -438,7 +438,17 @@ wait_for_starttls_proceed({xmlstreamelement, El}, StateData) ->
?INFO_MSG("starttls: ~p", [{StateData#state.myname,
StateData#state.server}]),
Socket = StateData#state.socket,
TLSOpts = StateData#state.tls_options,
TLSOpts = case ejabberd_config:get_local_option(
{domain_certfile,
StateData#state.server}) of
undefined ->
StateData#state.tls_options;
CertFile ->
[{certfile, CertFile} |
lists:keydelete(
certfile, 1,
StateData#state.tls_options)]
end,
{ok, TLSSocket} = tls:tcp_to_tls(Socket, TLSOpts),
ejabberd_receiver:starttls(
StateData#state.receiver, TLSSocket),