Fwd: [dane] DANE XMPP s2s implementation

Also relevant here.


-------- Original Message --------
Subject: [dane] DANE XMPP s2s implementation
Date: Mon, 10 Mar 2014 15:50:17 +0100
From: Kim Alvefur <[email protected]>
To: DANE WG <[email protected]>

Hi,

Everyone back (and recovered) from IETF89?  Much interesting, such
people, very discussions, wow.

So I have an experimental DANE implementation for server-to-server
connections in the Prosody XMPP server.

It's currently only doing DANE-EE and PKIX-EE.  The TA variants are
trickier, especially DANE-TA, so I have left them out for now.  LuaSec,
the OpenSSL to Lua binding we use, doesn't currently expose anything for
validating some random chain.

It also includes an attempt at doing something for authenticating the
client certificate on incoming connections, by looking for a TLSA record
at the same name as for SRV, eg _xmpp-server._tcp.example.com.  Comments
about this would be appreciated.

Info: http://code.google.com/p/prosody-modules/wiki/mod_s2s_auth_dane
Code:
http://code.google.com/p/prosody-modules/source/browse/mod_s2s_auth_dane/mod_s2s_auth_dane.lua

--
Regards,
Kim "Zash" Alvefur

_______________________________________________
xmpp mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/xmpp

_______________________________________________
dane mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/dane

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQIcBAEBCAAGBQJTHdFsAAoJEK3tmne2etMp6rcP/ie24jKG86zUaH3FAmi6L3Pg
oRnYHxa92n3rxi05rMAxoyVMvllMKWMNFI55TUxoiKov2sOX6TKpGquW4TxGm6Xc
o0wmcrJ338qVchppN+DidjSAOYMjAiHc7MqhH3ipLRptaGub/IJrE1EZGNF4ZbRN
QBTB/yttKHcK2KKj7/dEydoKkJX8GWCt7TV6DrV1cwAAlYKIB3cVoT+cryR96ysX
XX74wklaRyKcLEnAiEC/6vZjEpIb6G+3jF0ckyohNAYV2QUsPAJaX/W2ZK0Qb6jW
SUk82lfnMnWA14VzpB3mmpJb4VBcneCgaBh8FHdbtcYU2hrDeZcy0kROng+rCOkE
cD/KDPJQMB0gFi8dXswe6DDqeVM/Dy7bm853+orybCYr8UztsEV1ekpbIzgcWmPi
GFQO0ukaj19YEYFb65xv71BBlXYLNHz3iEtS9+KtpjGYsFUdHKKYBQ/Rftzo3Y2Z
6XVioyB43peGMneRC7b7UbQIePbzg9Rjmt5U+GMW+rek+9mevECCq0UWdGfIJbgh
cB/yDpSow5b5FwfDkkdyiBDcusohyRLETydWZyYKLEEB3LyZY4lt3GXFVH6PdEgI
V/dxeLNvXxGizYJMHFQA1xLfMZprJorWKZyb5h6OzL7D9pwN5c0cFuKarcdcZDhB
svNCWqRFmhSVlVThoRd9
=oWlp
-----END PGP SIGNATURE-----