util.openssl: Separate extension sections into one for self-signed certs and one...

[prosody.git] / util / openssl.lua

diff --git a/util/openssl.lua b/util/openssl.lua
index 8fdb9b4abf6c41d9c4550f38a4649f1d201db9ba..39fe99d6abf3013112259fda1e876e8ed894ee1c 100644 (file)
--- a/util/openssl.lua
+++ b/util/openssl.lua
@@ -18,24 +18,29 @@ function config.new()
        return setmetatable({
                req = {
                        distinguished_name = "distinguished_name",
-                       req_extensions = "v3_extensions",
-                       x509_extensions = "v3_extensions",
+                       req_extensions = "certrequest",
+                       x509_extensions = "selfsigned",
                        prompt = "no",
                },
                distinguished_name = {
-                       commonName = "example.com",
                        countryName = "GB",
+                       -- stateOrProvinceName = "",
                        localityName = "The Internet",
                        organizationName = "Your Organisation",
                        organizationalUnitName = "XMPP Department",
+                       commonName = "example.com",
                        emailAddress = "xmpp@example.com",
                },
-               v3_extensions = {
+               certrequest = {
                        basicConstraints = "CA:FALSE",
                        keyUsage = "digitalSignature,keyEncipherment",
                        extendedKeyUsage = "serverAuth,clientAuth",
                        subjectAltName = "@subject_alternative_name",
                },
+               selfsigned = {
+                       basicConstraints = "CA:TRUE",
+                       subjectAltName = "@subject_alternative_name",
+               },
                subject_alternative_name = {
                        DNS = {},
                        otherName = {},
@@ -43,6 +48,17 @@ function config.new()
        }, ssl_config_mt);
 end
 
+local DN_order = {
+       "countryName";
+       "stateOrProvinceName";
+       "localityName";
+       "streetAddress";
+       "organizationName";
+       "organizationalUnitName";
+       "commonName";
+       "emailAddress";
+}
+_M._DN_order = DN_order;
 function ssl_config:serialize()
        local s = "";
        for k, t in pairs(self) do
@@ -53,6 +69,14 @@ function ssl_config:serialize()
                                        s = s .. s_format("%s.%d = %s\n", san, i -1, n[i]);
                                end
                        end
+               elseif k == "distinguished_name" then
+                       for i=1,#DN_order do
+                               local k = DN_order[i]
+                               local v = t[k];
+                               if v then
+                                       s = s .. ("%s = %s\n"):format(k, v);
+                               end
+                       end
                else
                        for k, v in pairs(t) do
                                s = s .. ("%s = %s\n"):format(k, v);
@@ -72,15 +96,11 @@ local function ia5string(s)
        return s_format("IA5STRING:%s", s);
 end
 
-local util = {};
 _M.util = {
        utf8string = utf8string,
        ia5string = ia5string,
 };
 
-local function xmppAddr(t, host)
-end
-
 function ssl_config:add_dNSName(host)
        t_insert(self.subject_alternative_name.DNS, idna_to_ascii(host));
 end
@@ -95,22 +115,22 @@ function ssl_config:add_xmppAddr(host)
                s_format("%s;%s", oid_xmppaddr, utf8string(host)));
 end
 
-function ssl_config:from_prosody(hosts, config, certhosts, raw)
+function ssl_config:from_prosody(hosts, config, certhosts)
        -- TODO Decide if this should go elsewhere
        local found_matching_hosts = false;
        for i = 1,#certhosts do
                local certhost = certhosts[i];
-               for name, host in pairs(hosts) do
+               for name in pairs(hosts) do
                        if name == certhost or name:sub(-1-#certhost) == "."..certhost then
                                found_matching_hosts = true;
                                self:add_dNSName(name);
-                               --print(name .. "#component_module: " .. (config.get(name, "core", "component_module") or "nil"));
-                               if config.get(name, "core", "component_module") == nil then
+                               --print(name .. "#component_module: " .. (config.get(name, "component_module") or "nil"));
+                               if config.get(name, "component_module") == nil then
                                        self:add_sRVName(name, "xmpp-client");
                                end
-                               --print(name .. "#anonymous_login: " .. tostring(config.get(name, "core", "anonymous_login")));
-                               if not (config.get(name, "core", "anonymous_login") or
-                                               config.get(name, "core", "authentication") == "anonymous") then
+                               --print(name .. "#anonymous_login: " .. tostring(config.get(name, "anonymous_login")));
+                               if not (config.get(name, "anonymous_login") or
+                                               config.get(name, "authentication") == "anonymous") then
                                        self:add_sRVName(name, "xmpp-server");
                                end
                                self:add_xmppAddr(name);
@@ -137,7 +157,7 @@ do -- Lua to shell calls.
                                end
                        end
                end
-               for k,v in ipairs(o) do
+               for _,v in ipairs(o) do
                        t_insert(r, ("'%s'"):format(shell_escape(tostring(v))));
                end
                return t_concat(r, " ");
@@ -145,7 +165,7 @@ do -- Lua to shell calls.
 
        local os_execute = os.execute;
        setmetatable(_M, {
-               __index=function(self,f)
+               __index=function(_,f)
                        return function(opts)
                                return 0 == os_execute(serialize(f, type(opts) == "table" and opts or {}));
                        end;