prosody
0.11.11
plugins/mod_tls.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Annotate

plugins/mod_tls.lua @ 12089:76b4e3f12b53 0.11 0.11.11

mod_pep: Wipe pubsub service on user deletion Data is already wiped from storage, but this ensures everything is properly unsubscribed, possibly with notifications etc. Clears recipient cache as well, since it is no longer relevant.
author Kim Alvefur <zash@zash.se>
date Thu, 04 Nov 2021 01:00:06 +0100
parent 10783:950082c1669e
child 10784:0b0fe73199d2
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
1523
841d61be198f Remove version number from copyright headers
Matthew Wild <mwild1@gmail.com>
parents: 1219
diff changeset
1 -- Prosody IM
2923
b7049746bd29 Update copyright headers for 2010
Matthew Wild <mwild1@gmail.com>
parents: 2877
diff changeset
2 -- Copyright (C) 2008-2010 Matthew Wild
b7049746bd29 Update copyright headers for 2010
Matthew Wild <mwild1@gmail.com>
parents: 2877
diff changeset
3 -- Copyright (C) 2008-2010 Waqas Hussain
5776
bd0ff8ae98a8 Remove all trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 5698
diff changeset
4 --
758
b1885732e979 GPL->MIT!
Matthew Wild <mwild1@gmail.com>
parents: 705
diff changeset
5 -- This project is MIT/X11 licensed. Please see the
b1885732e979 GPL->MIT!
Matthew Wild <mwild1@gmail.com>
parents: 705
diff changeset
6 -- COPYING file in the source package for more information.
519
cccd610a0ef9 Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents: 438
diff changeset
7 --
cccd610a0ef9 Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents: 438
diff changeset
8
3571
675d65036f31 certmanager, hostmanager, mod_tls: Move responsibility for creating per-host SSL contexts to mod_tls, meaning reloading certs is now as trivial as reloading mod_tls
Matthew Wild <mwild1@gmail.com>
parents: 3397
diff changeset
9 local create_context = require "core.certmanager".create_context;
6832
9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511)
Kim Alvefur <zash@zash.se>
parents: 6710
diff changeset
10 local rawgetopt = require"core.configmanager".rawget;
69
5b664c8fef86 forgot to commit mod_tls, oops :)
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
11 local st = require "util.stanza";
99
ba08b8a4eeef Abstract connections with "connection listeners"
Matthew Wild <mwild1@gmail.com>
parents: 69
diff changeset
12
6487
edc63dc72566 mod_legacyauth, mod_saslauth, mod_tls: Pass require_encryption as default option to s2s_require_encryption so the later overrides the former
Kim Alvefur <zash@zash.se>
parents: 6302
diff changeset
13 local c2s_require_encryption = module:get_option("c2s_require_encryption", module:get_option("require_encryption"));
5987
bd90250ee1ee mod_tls: Rename variables to be less confusing
Kim Alvefur <zash@zash.se>
parents: 5976
diff changeset
14 local s2s_require_encryption = module:get_option("s2s_require_encryption");
2933
e68ff49fa79b Merge 0.6->0.7
Matthew Wild <mwild1@gmail.com>
parents: 2925 2932
diff changeset
15 local allow_s2s_tls = module:get_option("s2s_allow_encryption") ~= false;
5988
177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ
Kim Alvefur <zash@zash.se>
parents: 5987
diff changeset
16 local s2s_secure_auth = module:get_option("s2s_secure_auth");
177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ
Kim Alvefur <zash@zash.se>
parents: 5987
diff changeset
17
177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ
Kim Alvefur <zash@zash.se>
parents: 5987
diff changeset
18 if s2s_secure_auth and s2s_require_encryption == false then
177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ
Kim Alvefur <zash@zash.se>
parents: 5987
diff changeset
19 module:log("warn", "s2s_secure_auth implies s2s_require_encryption, but s2s_require_encryption is set to false");
177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ
Kim Alvefur <zash@zash.se>
parents: 5987
diff changeset
20 s2s_require_encryption = true;
177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ
Kim Alvefur <zash@zash.se>
parents: 5987
diff changeset
21 end
1219
f14e08a0ae7f mod_tls: Add <required/> to stream feature when TLS is required
Matthew Wild <mwild1@gmail.com>
parents: 1213
diff changeset
22
2605
ade70495fe7f mod_tls: Cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2604
diff changeset
23 local xmlns_starttls = 'urn:ietf:params:xml:ns:xmpp-tls';
ade70495fe7f mod_tls: Cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2604
diff changeset
24 local starttls_attr = { xmlns = xmlns_starttls };
6709
b6eff3ba13de mod_tls: Build <starttls/> as a stanza instead of with string concatenation
Kim Alvefur <zash@zash.se>
parents: 6526
diff changeset
25 local starttls_initiate= st.stanza("starttls", starttls_attr);
2605
ade70495fe7f mod_tls: Cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2604
diff changeset
26 local starttls_proceed = st.stanza("proceed", starttls_attr);
ade70495fe7f mod_tls: Cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2604
diff changeset
27 local starttls_failure = st.stanza("failure", starttls_attr);
ade70495fe7f mod_tls: Cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2604
diff changeset
28 local c2s_feature = st.stanza("starttls", starttls_attr);
ade70495fe7f mod_tls: Cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2604
diff changeset
29 local s2s_feature = st.stanza("starttls", starttls_attr);
5987
bd90250ee1ee mod_tls: Rename variables to be less confusing
Kim Alvefur <zash@zash.se>
parents: 5976
diff changeset
30 if c2s_require_encryption then c2s_feature:tag("required"):up(); end
bd90250ee1ee mod_tls: Rename variables to be less confusing
Kim Alvefur <zash@zash.se>
parents: 5976
diff changeset
31 if s2s_require_encryption then s2s_feature:tag("required"):up(); end
2605
ade70495fe7f mod_tls: Cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2604
diff changeset
32
5370
7838acadb0fa mod_announce, mod_auth_anonymous, mod_c2s, mod_c2s, mod_component, mod_iq, mod_message, mod_presence, mod_tls: Access prosody.{hosts,bare_sessions,full_sessions} instead of the old globals
Kim Alvefur <zash@zash.se>
parents: 4475
diff changeset
33 local hosts = prosody.hosts;
2872
cdc292d201fc mod_tls: Don't offer TLS on hosts that don't have any certs
Matthew Wild <mwild1@gmail.com>
parents: 2854
diff changeset
34 local host = hosts[module.host];
cdc292d201fc mod_tls: Don't offer TLS on hosts that don't have any certs
Matthew Wild <mwild1@gmail.com>
parents: 2854
diff changeset
35
5685
f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections
Kim Alvefur <zash@zash.se>
parents: 5378
diff changeset
36 local ssl_ctx_c2s, ssl_ctx_s2sout, ssl_ctx_s2sin;
6521
29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions
Kim Alvefur <zash@zash.se>
parents: 6487
diff changeset
37 local ssl_cfg_c2s, ssl_cfg_s2sout, ssl_cfg_s2sin;
8131
c8e3a0caa0a9 mod_tls: Rebuild SSL context objects on configuration reload - #701
Kim Alvefur <zash@zash.se>
parents: 7959
diff changeset
38
10783
950082c1669e mod_tls: Log when certificates are (re)loaded
Kim Alvefur <zash@zash.se>
parents: 9971
diff changeset
39 function module.load(reload)
6526
873538f0b18c certmanager, mod_tls: Return final ssl config as third return value (fix for c6caaa440e74, portmanager assumes non-falsy second return value is an error) (thanks deoren)
Kim Alvefur <zash@zash.se>
parents: 6521
diff changeset
40 local NULL, err = {};
6832
9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511)
Kim Alvefur <zash@zash.se>
parents: 6710
diff changeset
41 local modhost = module.host;
9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511)
Kim Alvefur <zash@zash.se>
parents: 6710
diff changeset
42 local parent = modhost:match("%.(.*)$");
6296
66fb7b7c668d mod_tls: Simplify and use new ssl config merging in certmanager
Kim Alvefur <zash@zash.se>
parents: 5993
diff changeset
43
6832
9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511)
Kim Alvefur <zash@zash.se>
parents: 6710
diff changeset
44 local parent_ssl = rawgetopt(parent, "ssl") or NULL;
9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511)
Kim Alvefur <zash@zash.se>
parents: 6710
diff changeset
45 local host_ssl = rawgetopt(modhost, "ssl") or parent_ssl;
5685
f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections
Kim Alvefur <zash@zash.se>
parents: 5378
diff changeset
46
6832
9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511)
Kim Alvefur <zash@zash.se>
parents: 6710
diff changeset
47 local global_c2s = rawgetopt("*", "c2s_ssl") or NULL;
9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511)
Kim Alvefur <zash@zash.se>
parents: 6710
diff changeset
48 local parent_c2s = rawgetopt(parent, "c2s_ssl") or NULL;
6919
ab6c57633ce5 mod_tls: Fix ssl option fallback to a "parent" host if current host does not have ssl options set (thanks 70b1)
Kim Alvefur <zash@zash.se>
parents: 6918
diff changeset
49 local host_c2s = rawgetopt(modhost, "c2s_ssl") or parent_c2s;
6296
66fb7b7c668d mod_tls: Simplify and use new ssl config merging in certmanager
Kim Alvefur <zash@zash.se>
parents: 5993
diff changeset
50
6832
9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511)
Kim Alvefur <zash@zash.se>
parents: 6710
diff changeset
51 local global_s2s = rawgetopt("*", "s2s_ssl") or NULL;
9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511)
Kim Alvefur <zash@zash.se>
parents: 6710
diff changeset
52 local parent_s2s = rawgetopt(parent, "s2s_ssl") or NULL;
6919
ab6c57633ce5 mod_tls: Fix ssl option fallback to a "parent" host if current host does not have ssl options set (thanks 70b1)
Kim Alvefur <zash@zash.se>
parents: 6918
diff changeset
53 local host_s2s = rawgetopt(modhost, "s2s_ssl") or parent_s2s;
6296
66fb7b7c668d mod_tls: Simplify and use new ssl config merging in certmanager
Kim Alvefur <zash@zash.se>
parents: 5993
diff changeset
54
9971
5b048ccd106f mod_tls: Log debug message for each kind of TLS context created
Kim Alvefur <zash@zash.se>
parents: 8131
diff changeset
55 module:log("debug", "Creating context for c2s");
6526
873538f0b18c certmanager, mod_tls: Return final ssl config as third return value (fix for c6caaa440e74, portmanager assumes non-falsy second return value is an error) (thanks deoren)
Kim Alvefur <zash@zash.se>
parents: 6521
diff changeset
56 ssl_ctx_c2s, err, ssl_cfg_c2s = create_context(host.host, "server", host_c2s, host_ssl, global_c2s); -- for incoming client connections
873538f0b18c certmanager, mod_tls: Return final ssl config as third return value (fix for c6caaa440e74, portmanager assumes non-falsy second return value is an error) (thanks deoren)
Kim Alvefur <zash@zash.se>
parents: 6521
diff changeset
57 if not ssl_ctx_c2s then module:log("error", "Error creating context for c2s: %s", err); end
5685
f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections
Kim Alvefur <zash@zash.se>
parents: 5378
diff changeset
58
9971
5b048ccd106f mod_tls: Log debug message for each kind of TLS context created
Kim Alvefur <zash@zash.se>
parents: 8131
diff changeset
59 module:log("debug", "Creating context for s2sout");
6526
873538f0b18c certmanager, mod_tls: Return final ssl config as third return value (fix for c6caaa440e74, portmanager assumes non-falsy second return value is an error) (thanks deoren)
Kim Alvefur <zash@zash.se>
parents: 6521
diff changeset
60 ssl_ctx_s2sout, err, ssl_cfg_s2sout = create_context(host.host, "client", host_s2s, host_ssl, global_s2s); -- for outgoing server connections
873538f0b18c certmanager, mod_tls: Return final ssl config as third return value (fix for c6caaa440e74, portmanager assumes non-falsy second return value is an error) (thanks deoren)
Kim Alvefur <zash@zash.se>
parents: 6521
diff changeset
61 if not ssl_ctx_s2sout then module:log("error", "Error creating contexts for s2sout: %s", err); end
6521
29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions
Kim Alvefur <zash@zash.se>
parents: 6487
diff changeset
62
9971
5b048ccd106f mod_tls: Log debug message for each kind of TLS context created
Kim Alvefur <zash@zash.se>
parents: 8131
diff changeset
63 module:log("debug", "Creating context for s2sin");
6526
873538f0b18c certmanager, mod_tls: Return final ssl config as third return value (fix for c6caaa440e74, portmanager assumes non-falsy second return value is an error) (thanks deoren)
Kim Alvefur <zash@zash.se>
parents: 6521
diff changeset
64 ssl_ctx_s2sin, err, ssl_cfg_s2sin = create_context(host.host, "server", host_s2s, host_ssl, global_s2s); -- for incoming server connections
873538f0b18c certmanager, mod_tls: Return final ssl config as third return value (fix for c6caaa440e74, portmanager assumes non-falsy second return value is an error) (thanks deoren)
Kim Alvefur <zash@zash.se>
parents: 6521
diff changeset
65 if not ssl_ctx_s2sin then module:log("error", "Error creating contexts for s2sin: %s", err); end
10783
950082c1669e mod_tls: Log when certificates are (re)loaded
Kim Alvefur <zash@zash.se>
parents: 9971
diff changeset
66
950082c1669e mod_tls: Log when certificates are (re)loaded
Kim Alvefur <zash@zash.se>
parents: 9971
diff changeset
67 if reload then
950082c1669e mod_tls: Log when certificates are (re)loaded
Kim Alvefur <zash@zash.se>
parents: 9971
diff changeset
68 module:log("info", "Certificates reloaded");
950082c1669e mod_tls: Log when certificates are (re)loaded
Kim Alvefur <zash@zash.se>
parents: 9971
diff changeset
69 else
950082c1669e mod_tls: Log when certificates are (re)loaded
Kim Alvefur <zash@zash.se>
parents: 9971
diff changeset
70 module:log("info", "Certificates loaded");
950082c1669e mod_tls: Log when certificates are (re)loaded
Kim Alvefur <zash@zash.se>
parents: 9971
diff changeset
71 end
5685
f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections
Kim Alvefur <zash@zash.se>
parents: 5378
diff changeset
72 end
f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections
Kim Alvefur <zash@zash.se>
parents: 5378
diff changeset
73
8131
c8e3a0caa0a9 mod_tls: Rebuild SSL context objects on configuration reload - #701
Kim Alvefur <zash@zash.se>
parents: 7959
diff changeset
74 module:hook_global("config-reloaded", module.load);
c8e3a0caa0a9 mod_tls: Rebuild SSL context objects on configuration reload - #701
Kim Alvefur <zash@zash.se>
parents: 7959
diff changeset
75
2625
03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection
Matthew Wild <mwild1@gmail.com>
parents: 2623
diff changeset
76 local function can_do_tls(session)
7869
eb5fba4c8074 mod_tls: Check that connection has starttls method first to prevent offering starttls over tls (thanks Remko and Tobias)
Kim Alvefur <zash@zash.se>
parents: 7864
diff changeset
77 if not session.conn.starttls then
7913
64daa21450f9 mod_tls: Suppress debug message if already using encryption
Kim Alvefur <zash@zash.se>
parents: 7898
diff changeset
78 if not session.secure then
64daa21450f9 mod_tls: Suppress debug message if already using encryption
Kim Alvefur <zash@zash.se>
parents: 7898
diff changeset
79 session.log("debug", "Underlying connection does not support STARTTLS");
64daa21450f9 mod_tls: Suppress debug message if already using encryption
Kim Alvefur <zash@zash.se>
parents: 7898
diff changeset
80 end
7869
eb5fba4c8074 mod_tls: Check that connection has starttls method first to prevent offering starttls over tls (thanks Remko and Tobias)
Kim Alvefur <zash@zash.se>
parents: 7864
diff changeset
81 return false;
eb5fba4c8074 mod_tls: Check that connection has starttls method first to prevent offering starttls over tls (thanks Remko and Tobias)
Kim Alvefur <zash@zash.se>
parents: 7864
diff changeset
82 elseif session.ssl_ctx ~= nil then
7864
7ece186a44d3 mod_tls: Return session.ssl_ctx if not nil, like when doing the full session type check
Kim Alvefur <zash@zash.se>
parents: 7863
diff changeset
83 return session.ssl_ctx;
5685
f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections
Kim Alvefur <zash@zash.se>
parents: 5378
diff changeset
84 end
2625
03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection
Matthew Wild <mwild1@gmail.com>
parents: 2623
diff changeset
85 if session.type == "c2s_unauthed" then
5685
f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections
Kim Alvefur <zash@zash.se>
parents: 5378
diff changeset
86 session.ssl_ctx = ssl_ctx_c2s;
6521
29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions
Kim Alvefur <zash@zash.se>
parents: 6487
diff changeset
87 session.ssl_cfg = ssl_cfg_c2s;
2933
e68ff49fa79b Merge 0.6->0.7
Matthew Wild <mwild1@gmail.com>
parents: 2925 2932
diff changeset
88 elseif session.type == "s2sin_unauthed" and allow_s2s_tls then
5685
f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections
Kim Alvefur <zash@zash.se>
parents: 5378
diff changeset
89 session.ssl_ctx = ssl_ctx_s2sin;
6521
29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions
Kim Alvefur <zash@zash.se>
parents: 6487
diff changeset
90 session.ssl_cfg = ssl_cfg_s2sin;
2933
e68ff49fa79b Merge 0.6->0.7
Matthew Wild <mwild1@gmail.com>
parents: 2925 2932
diff changeset
91 elseif session.direction == "outgoing" and allow_s2s_tls then
5685
f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections
Kim Alvefur <zash@zash.se>
parents: 5378
diff changeset
92 session.ssl_ctx = ssl_ctx_s2sout;
6521
29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions
Kim Alvefur <zash@zash.se>
parents: 6487
diff changeset
93 session.ssl_cfg = ssl_cfg_s2sout;
5685
f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections
Kim Alvefur <zash@zash.se>
parents: 5378
diff changeset
94 else
7898
d8029b2e0f43 mod_tls: Log reasons for not being able to do TLS
Kim Alvefur <zash@zash.se>
parents: 7869
diff changeset
95 session.log("debug", "Unknown session type, don't know which TLS context to use");
5685
f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections
Kim Alvefur <zash@zash.se>
parents: 5378
diff changeset
96 return false;
2625
03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection
Matthew Wild <mwild1@gmail.com>
parents: 2623
diff changeset
97 end
7863
a634fe3c21f2 mod_tls: Add debug logging for when TLS should be doable but no ssl context was set
Kim Alvefur <zash@zash.se>
parents: 7834
diff changeset
98 if not session.ssl_ctx then
a634fe3c21f2 mod_tls: Add debug logging for when TLS should be doable but no ssl context was set
Kim Alvefur <zash@zash.se>
parents: 7834
diff changeset
99 session.log("debug", "Should be able to do TLS but no context available");
a634fe3c21f2 mod_tls: Add debug logging for when TLS should be doable but no ssl context was set
Kim Alvefur <zash@zash.se>
parents: 7834
diff changeset
100 return false;
a634fe3c21f2 mod_tls: Add debug logging for when TLS should be doable but no ssl context was set
Kim Alvefur <zash@zash.se>
parents: 7834
diff changeset
101 end
5685
f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections
Kim Alvefur <zash@zash.se>
parents: 5378
diff changeset
102 return session.ssl_ctx;
2932
d2816fb6c7ea mod_tls: Add s2s_allow_encryption option which, when set to false, disabled TLS for s2s
Matthew Wild <mwild1@gmail.com>
parents: 2923
diff changeset
103 end
d2816fb6c7ea mod_tls: Add s2s_allow_encryption option which, when set to false, disabled TLS for s2s
Matthew Wild <mwild1@gmail.com>
parents: 2923
diff changeset
104
2605
ade70495fe7f mod_tls: Cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2604
diff changeset
105 -- Hook <starttls/>
2600
1e6f3002e04f mod_tls: Inlined some code.
Waqas Hussain <waqas20@gmail.com>
parents: 2596
diff changeset
106 module:hook("stanza/urn:ietf:params:xml:ns:xmpp-tls:starttls", function(event)
1e6f3002e04f mod_tls: Inlined some code.
Waqas Hussain <waqas20@gmail.com>
parents: 2596
diff changeset
107 local origin = event.origin;
2625
03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection
Matthew Wild <mwild1@gmail.com>
parents: 2623
diff changeset
108 if can_do_tls(origin) then
2605
ade70495fe7f mod_tls: Cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2604
diff changeset
109 (origin.sends2s or origin.send)(starttls_proceed);
2600
1e6f3002e04f mod_tls: Inlined some code.
Waqas Hussain <waqas20@gmail.com>
parents: 2596
diff changeset
110 origin:reset_stream();
5685
f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections
Kim Alvefur <zash@zash.se>
parents: 5378
diff changeset
111 origin.conn:starttls(origin.ssl_ctx);
4157
1b5a8e071a80 mod_tls: Drop 'TLS negotiation started for ...' to debug level from info
Matthew Wild <mwild1@gmail.com>
parents: 3583
diff changeset
112 origin.log("debug", "TLS negotiation started for %s...", origin.type);
2600
1e6f3002e04f mod_tls: Inlined some code.
Waqas Hussain <waqas20@gmail.com>
parents: 2596
diff changeset
113 origin.secure = false;
2595
015934e20f03 mod_tls: Switched to new events API.
Waqas Hussain <waqas20@gmail.com>
parents: 2594
diff changeset
114 else
015934e20f03 mod_tls: Switched to new events API.
Waqas Hussain <waqas20@gmail.com>
parents: 2594
diff changeset
115 origin.log("warn", "Attempt to start TLS, but TLS is not available on this %s connection", origin.type);
2605
ade70495fe7f mod_tls: Cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2604
diff changeset
116 (origin.sends2s or origin.send)(starttls_failure);
2601
e64c6a4aa50b mod_tls: Respond with proper error when TLS cannot be negotiated.
Waqas Hussain <waqas20@gmail.com>
parents: 2600
diff changeset
117 origin:close();
2595
015934e20f03 mod_tls: Switched to new events API.
Waqas Hussain <waqas20@gmail.com>
parents: 2594
diff changeset
118 end
015934e20f03 mod_tls: Switched to new events API.
Waqas Hussain <waqas20@gmail.com>
parents: 2594
diff changeset
119 return true;
015934e20f03 mod_tls: Switched to new events API.
Waqas Hussain <waqas20@gmail.com>
parents: 2594
diff changeset
120 end);
2932
d2816fb6c7ea mod_tls: Add s2s_allow_encryption option which, when set to false, disabled TLS for s2s
Matthew Wild <mwild1@gmail.com>
parents: 2923
diff changeset
121
2605
ade70495fe7f mod_tls: Cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2604
diff changeset
122 -- Advertize stream feature
2607
35a5d1c5ea28 mod_tls: Hook stream-features event using new events API.
Waqas Hussain <waqas20@gmail.com>
parents: 2605
diff changeset
123 module:hook("stream-features", function(event)
35a5d1c5ea28 mod_tls: Hook stream-features event using new events API.
Waqas Hussain <waqas20@gmail.com>
parents: 2605
diff changeset
124 local origin, features = event.origin, event.features;
2625
03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection
Matthew Wild <mwild1@gmail.com>
parents: 2623
diff changeset
125 if can_do_tls(origin) then
2605
ade70495fe7f mod_tls: Cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2604
diff changeset
126 features:add_child(c2s_feature);
ade70495fe7f mod_tls: Cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2604
diff changeset
127 end
ade70495fe7f mod_tls: Cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2604
diff changeset
128 end);
ade70495fe7f mod_tls: Cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2604
diff changeset
129 module:hook("s2s-stream-features", function(event)
2613
afa20941e098 s2smanager, mod_compression, mod_tls: Changed event.session to event.origin for s2s-stream-features event for consistency.
Waqas Hussain <waqas20@gmail.com>
parents: 2607
diff changeset
130 local origin, features = event.origin, event.features;
2625
03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection
Matthew Wild <mwild1@gmail.com>
parents: 2623
diff changeset
131 if can_do_tls(origin) then
2605
ade70495fe7f mod_tls: Cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2604
diff changeset
132 features:add_child(s2s_feature);
ade70495fe7f mod_tls: Cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2604
diff changeset
133 end
ade70495fe7f mod_tls: Cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2604
diff changeset
134 end);
1875
334383faf77b mod_tls: Advertise and handle TLS for s2s connections
Matthew Wild <mwild1@gmail.com>
parents: 1675
diff changeset
135
334383faf77b mod_tls: Advertise and handle TLS for s2s connections
Matthew Wild <mwild1@gmail.com>
parents: 1675
diff changeset
136 -- For s2sout connections, start TLS if we can
7959
3941d609ff85 mod_tls: Switch to hook_tag from hook_stanza which was renamed in 2087d42f1e77
Kim Alvefur <zash@zash.se>
parents: 7913
diff changeset
137 module:hook_tag("http://etherx.jabber.org/streams", "features", function (session, stanza)
2605
ade70495fe7f mod_tls: Cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2604
diff changeset
138 module:log("debug", "Received features element");
6302
76699a0ae4c4 mod_lastactivity, mod_legacyauth, mod_presence, mod_saslauth, mod_tls: Use the newer stanza:get_child APIs and optimize away some table lookups
Kim Alvefur <zash@zash.se>
parents: 6296
diff changeset
139 if can_do_tls(session) and stanza:get_child("starttls", xmlns_starttls) then
4475
7341cc5c8da9 mod_tls: Fix log statement (thanks Zash)
Matthew Wild <mwild1@gmail.com>
parents: 4244
diff changeset
140 module:log("debug", "%s is offering TLS, taking up the offer...", session.to_host);
6709
b6eff3ba13de mod_tls: Build <starttls/> as a stanza instead of with string concatenation
Kim Alvefur <zash@zash.se>
parents: 6526
diff changeset
141 session.sends2s(starttls_initiate);
2605
ade70495fe7f mod_tls: Cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2604
diff changeset
142 return true;
ade70495fe7f mod_tls: Cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2604
diff changeset
143 end
ade70495fe7f mod_tls: Cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2604
diff changeset
144 end, 500);
1875
334383faf77b mod_tls: Advertise and handle TLS for s2s connections
Matthew Wild <mwild1@gmail.com>
parents: 1675
diff changeset
145
7959
3941d609ff85 mod_tls: Switch to hook_tag from hook_stanza which was renamed in 2087d42f1e77
Kim Alvefur <zash@zash.se>
parents: 7913
diff changeset
146 module:hook_tag(xmlns_starttls, "proceed", function (session, stanza) -- luacheck: ignore 212/stanza
7834
a2081d28bd22 mod_tls: Verify that TLS is available before proceeding
Kim Alvefur <zash@zash.se>
parents: 7833
diff changeset
147 if session.type == "s2sout_unauthed" and can_do_tls(session) then
7833
94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections
Kim Alvefur <zash@zash.se>
parents: 7712
diff changeset
148 module:log("debug", "Proceeding with TLS on s2sout...");
94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections
Kim Alvefur <zash@zash.se>
parents: 7712
diff changeset
149 session:reset_stream();
94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections
Kim Alvefur <zash@zash.se>
parents: 7712
diff changeset
150 session.conn:starttls(session.ssl_ctx);
94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections
Kim Alvefur <zash@zash.se>
parents: 7712
diff changeset
151 session.secure = false;
94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections
Kim Alvefur <zash@zash.se>
parents: 7712
diff changeset
152 return true;
94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections
Kim Alvefur <zash@zash.se>
parents: 7712
diff changeset
153 end
2605
ade70495fe7f mod_tls: Cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 2604
diff changeset
154 end);