Software `/` code `/` prosody

Annotate

plugins/mod_tls.lua @ 12032:3db09eb4c43b

util.format: Ensure sanitation of strings passed to wrong format Ie. log("debug", "%d", "\1\2\3") should not result in garbage. Also optimizing for the common case of ASCII string passed to %s and early returns everywhere. Returning nil from a gsub callback keeps the original substring.

author	Kim Alvefur <zash@zash.se>
date	Sat, 11 Dec 2021 13:30:34 +0100
parent	11766:6ad335cd43f9
child	12207:65e252940337

rev	line source
1523 841d61be198f Remove version number from copyright headers Matthew Wild <mwild1@gmail.com> parents: 1219 diff changeset	1 -- Prosody IM
2923 b7049746bd29 Update copyright headers for 2010 Matthew Wild <mwild1@gmail.com> parents: 2877 diff changeset	2 -- Copyright (C) 2008-2010 Matthew Wild
b7049746bd29 Update copyright headers for 2010 Matthew Wild <mwild1@gmail.com> parents: 2877 diff changeset	3 -- Copyright (C) 2008-2010 Waqas Hussain
5776 bd0ff8ae98a8 Remove all trailing whitespace Florian Zeitz <florob@babelmonkeys.de> parents: 5698 diff changeset	4 --
758 b1885732e979 GPL->MIT! Matthew Wild <mwild1@gmail.com> parents: 705 diff changeset	5 -- This project is MIT/X11 licensed. Please see the
b1885732e979 GPL->MIT! Matthew Wild <mwild1@gmail.com> parents: 705 diff changeset	6 -- COPYING file in the source package for more information.
519 cccd610a0ef9 Insert copyright/license headers Matthew Wild <mwild1@gmail.com> parents: 438 diff changeset	7 --
cccd610a0ef9 Insert copyright/license headers Matthew Wild <mwild1@gmail.com> parents: 438 diff changeset	8
3571 675d65036f31 certmanager, hostmanager, mod_tls: Move responsibility for creating per-host SSL contexts to mod_tls, meaning reloading certs is now as trivial as reloading mod_tls Matthew Wild <mwild1@gmail.com> parents: 3397 diff changeset	9 local create_context = require "core.certmanager".create_context;
6832 9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	10 local rawgetopt = require"core.configmanager".rawget;
69 5b664c8fef86 forgot to commit mod_tls, oops :) Matthew Wild <mwild1@gmail.com> parents: diff changeset	11 local st = require "util.stanza";
99 ba08b8a4eeef Abstract connections with "connection listeners" Matthew Wild <mwild1@gmail.com> parents: 69 diff changeset	12
6487 edc63dc72566 mod_legacyauth, mod_saslauth, mod_tls: Pass require_encryption as default option to s2s_require_encryption so the later overrides the former Kim Alvefur <zash@zash.se> parents: 6302 diff changeset	13 local c2s_require_encryption = module:get_option("c2s_require_encryption", module:get_option("require_encryption"));
5987 bd90250ee1ee mod_tls: Rename variables to be less confusing Kim Alvefur <zash@zash.se> parents: 5976 diff changeset	14 local s2s_require_encryption = module:get_option("s2s_require_encryption");
2933 e68ff49fa79b Merge 0.6->0.7 Matthew Wild <mwild1@gmail.com> parents: 2925 2932 diff changeset	15 local allow_s2s_tls = module:get_option("s2s_allow_encryption") ~= false;
5988 177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ Kim Alvefur <zash@zash.se> parents: 5987 diff changeset	16 local s2s_secure_auth = module:get_option("s2s_secure_auth");
177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ Kim Alvefur <zash@zash.se> parents: 5987 diff changeset	17
177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ Kim Alvefur <zash@zash.se> parents: 5987 diff changeset	18 if s2s_secure_auth and s2s_require_encryption == false then
177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ Kim Alvefur <zash@zash.se> parents: 5987 diff changeset	19 module:log("warn", "s2s_secure_auth implies s2s_require_encryption, but s2s_require_encryption is set to false");
177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ Kim Alvefur <zash@zash.se> parents: 5987 diff changeset	20 s2s_require_encryption = true;
177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ Kim Alvefur <zash@zash.se> parents: 5987 diff changeset	21 end
1219 f14e08a0ae7f mod_tls: Add <required/> to stream feature when TLS is required Matthew Wild <mwild1@gmail.com> parents: 1213 diff changeset	22
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	23 local xmlns_starttls = 'urn:ietf:params:xml:ns:xmpp-tls';
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	24 local starttls_attr = { xmlns = xmlns_starttls };
6709 b6eff3ba13de mod_tls: Build <starttls/> as a stanza instead of with string concatenation Kim Alvefur <zash@zash.se> parents: 6526 diff changeset	25 local starttls_initiate= st.stanza("starttls", starttls_attr);
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	26 local starttls_proceed = st.stanza("proceed", starttls_attr);
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	27 local starttls_failure = st.stanza("failure", starttls_attr);
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	28 local c2s_feature = st.stanza("starttls", starttls_attr);
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	29 local s2s_feature = st.stanza("starttls", starttls_attr);
5987 bd90250ee1ee mod_tls: Rename variables to be less confusing Kim Alvefur <zash@zash.se> parents: 5976 diff changeset	30 if c2s_require_encryption then c2s_feature:tag("required"):up(); end
bd90250ee1ee mod_tls: Rename variables to be less confusing Kim Alvefur <zash@zash.se> parents: 5976 diff changeset	31 if s2s_require_encryption then s2s_feature:tag("required"):up(); end
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	32
5370 7838acadb0fa mod_announce, mod_auth_anonymous, mod_c2s, mod_c2s, mod_component, mod_iq, mod_message, mod_presence, mod_tls: Access prosody.{hosts,bare_sessions,full_sessions} instead of the old globals Kim Alvefur <zash@zash.se> parents: 4475 diff changeset	33 local hosts = prosody.hosts;
2872 cdc292d201fc mod_tls: Don't offer TLS on hosts that don't have any certs Matthew Wild <mwild1@gmail.com> parents: 2854 diff changeset	34 local host = hosts[module.host];
cdc292d201fc mod_tls: Don't offer TLS on hosts that don't have any certs Matthew Wild <mwild1@gmail.com> parents: 2854 diff changeset	35
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	36 local ssl_ctx_c2s, ssl_ctx_s2sout, ssl_ctx_s2sin;
6521 29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions Kim Alvefur <zash@zash.se> parents: 6487 diff changeset	37 local ssl_cfg_c2s, ssl_cfg_s2sout, ssl_cfg_s2sin;
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	38 local err_c2s, err_s2sin, err_s2sout;
8131 c8e3a0caa0a9 mod_tls: Rebuild SSL context objects on configuration reload - #701 Kim Alvefur <zash@zash.se> parents: 7959 diff changeset	39
10783 950082c1669e mod_tls: Log when certificates are (re)loaded Kim Alvefur <zash@zash.se> parents: 9971 diff changeset	40 function module.load(reload)
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	41 local NULL = {};
6832 9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	42 local modhost = module.host;
9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	43 local parent = modhost:match("%.(.*)$");
6296 66fb7b7c668d mod_tls: Simplify and use new ssl config merging in certmanager Kim Alvefur <zash@zash.se> parents: 5993 diff changeset	44
6832 9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	45 local parent_ssl = rawgetopt(parent, "ssl") or NULL;
9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	46 local host_ssl = rawgetopt(modhost, "ssl") or parent_ssl;
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	47
6832 9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	48 local global_c2s = rawgetopt("*", "c2s_ssl") or NULL;
9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	49 local parent_c2s = rawgetopt(parent, "c2s_ssl") or NULL;
6919 ab6c57633ce5 mod_tls: Fix ssl option fallback to a "parent" host if current host does not have ssl options set (thanks 70b1) Kim Alvefur <zash@zash.se> parents: 6918 diff changeset	50 local host_c2s = rawgetopt(modhost, "c2s_ssl") or parent_c2s;
6296 66fb7b7c668d mod_tls: Simplify and use new ssl config merging in certmanager Kim Alvefur <zash@zash.se> parents: 5993 diff changeset	51
6832 9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	52 local global_s2s = rawgetopt("*", "s2s_ssl") or NULL;
9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	53 local parent_s2s = rawgetopt(parent, "s2s_ssl") or NULL;
6919 ab6c57633ce5 mod_tls: Fix ssl option fallback to a "parent" host if current host does not have ssl options set (thanks 70b1) Kim Alvefur <zash@zash.se> parents: 6918 diff changeset	54 local host_s2s = rawgetopt(modhost, "s2s_ssl") or parent_s2s;
6296 66fb7b7c668d mod_tls: Simplify and use new ssl config merging in certmanager Kim Alvefur <zash@zash.se> parents: 5993 diff changeset	55
9971 5b048ccd106f mod_tls: Log debug message for each kind of TLS context created Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	56 module:log("debug", "Creating context for c2s");
9854 115b5e32d960 mod_tls: Restore querying for certificates on s2s Kim Alvefur <zash@zash.se> parents: 9740 diff changeset	57 local request_client_certs = { verify = { "peer", "client_once", }; };
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	58
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	59 ssl_ctx_c2s, err_c2s, ssl_cfg_c2s = create_context(host.host, "server", host_c2s, host_ssl, global_c2s); -- for incoming client connections
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	60 if not ssl_ctx_c2s then module:log("error", "Error creating context for c2s: %s", err_c2s); end
6521 29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions Kim Alvefur <zash@zash.se> parents: 6487 diff changeset	61
11530 a90389e7296c mod_tls: Fix order of debug messages and tls context creation Kim Alvefur <zash@zash.se> parents: 11519 diff changeset	62 module:log("debug", "Creating context for s2sout");
9854 115b5e32d960 mod_tls: Restore querying for certificates on s2s Kim Alvefur <zash@zash.se> parents: 9740 diff changeset	63 -- for outgoing server connections
115b5e32d960 mod_tls: Restore querying for certificates on s2s Kim Alvefur <zash@zash.se> parents: 9740 diff changeset	64 ssl_ctx_s2sout, err_s2sout, ssl_cfg_s2sout = create_context(host.host, "client", host_s2s, host_ssl, global_s2s, request_client_certs);
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	65 if not ssl_ctx_s2sout then module:log("error", "Error creating contexts for s2sout: %s", err_s2sout); end
6521 29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions Kim Alvefur <zash@zash.se> parents: 6487 diff changeset	66
11530 a90389e7296c mod_tls: Fix order of debug messages and tls context creation Kim Alvefur <zash@zash.se> parents: 11519 diff changeset	67 module:log("debug", "Creating context for s2sin");
9854 115b5e32d960 mod_tls: Restore querying for certificates on s2s Kim Alvefur <zash@zash.se> parents: 9740 diff changeset	68 -- for incoming server connections
115b5e32d960 mod_tls: Restore querying for certificates on s2s Kim Alvefur <zash@zash.se> parents: 9740 diff changeset	69 ssl_ctx_s2sin, err_s2sin, ssl_cfg_s2sin = create_context(host.host, "server", host_s2s, host_ssl, global_s2s, request_client_certs);
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	70 if not ssl_ctx_s2sin then module:log("error", "Error creating contexts for s2sin: %s", err_s2sin); end
10783 950082c1669e mod_tls: Log when certificates are (re)loaded Kim Alvefur <zash@zash.se> parents: 9971 diff changeset	71
950082c1669e mod_tls: Log when certificates are (re)loaded Kim Alvefur <zash@zash.se> parents: 9971 diff changeset	72 if reload then
950082c1669e mod_tls: Log when certificates are (re)loaded Kim Alvefur <zash@zash.se> parents: 9971 diff changeset	73 module:log("info", "Certificates reloaded");
950082c1669e mod_tls: Log when certificates are (re)loaded Kim Alvefur <zash@zash.se> parents: 9971 diff changeset	74 else
950082c1669e mod_tls: Log when certificates are (re)loaded Kim Alvefur <zash@zash.se> parents: 9971 diff changeset	75 module:log("info", "Certificates loaded");
950082c1669e mod_tls: Log when certificates are (re)loaded Kim Alvefur <zash@zash.se> parents: 9971 diff changeset	76 end
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	77 end
f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	78
8131 c8e3a0caa0a9 mod_tls: Rebuild SSL context objects on configuration reload - #701 Kim Alvefur <zash@zash.se> parents: 7959 diff changeset	79 module:hook_global("config-reloaded", module.load);
c8e3a0caa0a9 mod_tls: Rebuild SSL context objects on configuration reload - #701 Kim Alvefur <zash@zash.se> parents: 7959 diff changeset	80
2625 03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection Matthew Wild <mwild1@gmail.com> parents: 2623 diff changeset	81 local function can_do_tls(session)
7869 eb5fba4c8074 mod_tls: Check that connection has starttls method first to prevent offering starttls over tls (thanks Remko and Tobias) Kim Alvefur <zash@zash.se> parents: 7864 diff changeset	82 if not session.conn.starttls then
7913 64daa21450f9 mod_tls: Suppress debug message if already using encryption Kim Alvefur <zash@zash.se> parents: 7898 diff changeset	83 if not session.secure then
64daa21450f9 mod_tls: Suppress debug message if already using encryption Kim Alvefur <zash@zash.se> parents: 7898 diff changeset	84 session.log("debug", "Underlying connection does not support STARTTLS");
64daa21450f9 mod_tls: Suppress debug message if already using encryption Kim Alvefur <zash@zash.se> parents: 7898 diff changeset	85 end
7869 eb5fba4c8074 mod_tls: Check that connection has starttls method first to prevent offering starttls over tls (thanks Remko and Tobias) Kim Alvefur <zash@zash.se> parents: 7864 diff changeset	86 return false;
eb5fba4c8074 mod_tls: Check that connection has starttls method first to prevent offering starttls over tls (thanks Remko and Tobias) Kim Alvefur <zash@zash.se> parents: 7864 diff changeset	87 elseif session.ssl_ctx ~= nil then
7864 7ece186a44d3 mod_tls: Return session.ssl_ctx if not nil, like when doing the full session type check Kim Alvefur <zash@zash.se> parents: 7863 diff changeset	88 return session.ssl_ctx;
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	89 end
2625 03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection Matthew Wild <mwild1@gmail.com> parents: 2623 diff changeset	90 if session.type == "c2s_unauthed" then
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	91 if not ssl_ctx_c2s and c2s_require_encryption then
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	92 session.log("error", "No TLS context available for c2s. Earlier error was: %s", err_c2s);
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	93 end
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	94 session.ssl_ctx = ssl_ctx_c2s;
6521 29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions Kim Alvefur <zash@zash.se> parents: 6487 diff changeset	95 session.ssl_cfg = ssl_cfg_c2s;
2933 e68ff49fa79b Merge 0.6->0.7 Matthew Wild <mwild1@gmail.com> parents: 2925 2932 diff changeset	96 elseif session.type == "s2sin_unauthed" and allow_s2s_tls then
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	97 if not ssl_ctx_s2sin and s2s_require_encryption then
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	98 session.log("error", "No TLS context available for s2sin. Earlier error was: %s", err_s2sin);
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	99 end
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	100 session.ssl_ctx = ssl_ctx_s2sin;
6521 29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions Kim Alvefur <zash@zash.se> parents: 6487 diff changeset	101 session.ssl_cfg = ssl_cfg_s2sin;
2933 e68ff49fa79b Merge 0.6->0.7 Matthew Wild <mwild1@gmail.com> parents: 2925 2932 diff changeset	102 elseif session.direction == "outgoing" and allow_s2s_tls then
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	103 if not ssl_ctx_s2sout and s2s_require_encryption then
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	104 session.log("error", "No TLS context available for s2sout. Earlier error was: %s", err_s2sout);
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	105 end
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	106 session.ssl_ctx = ssl_ctx_s2sout;
6521 29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions Kim Alvefur <zash@zash.se> parents: 6487 diff changeset	107 session.ssl_cfg = ssl_cfg_s2sout;
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	108 else
7898 d8029b2e0f43 mod_tls: Log reasons for not being able to do TLS Kim Alvefur <zash@zash.se> parents: 7869 diff changeset	109 session.log("debug", "Unknown session type, don't know which TLS context to use");
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	110 return false;
2625 03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection Matthew Wild <mwild1@gmail.com> parents: 2623 diff changeset	111 end
7863 a634fe3c21f2 mod_tls: Add debug logging for when TLS should be doable but no ssl context was set Kim Alvefur <zash@zash.se> parents: 7834 diff changeset	112 if not session.ssl_ctx then
a634fe3c21f2 mod_tls: Add debug logging for when TLS should be doable but no ssl context was set Kim Alvefur <zash@zash.se> parents: 7834 diff changeset	113 session.log("debug", "Should be able to do TLS but no context available");
a634fe3c21f2 mod_tls: Add debug logging for when TLS should be doable but no ssl context was set Kim Alvefur <zash@zash.se> parents: 7834 diff changeset	114 return false;
a634fe3c21f2 mod_tls: Add debug logging for when TLS should be doable but no ssl context was set Kim Alvefur <zash@zash.se> parents: 7834 diff changeset	115 end
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	116 return session.ssl_ctx;
2932 d2816fb6c7ea mod_tls: Add s2s_allow_encryption option which, when set to false, disabled TLS for s2s Matthew Wild <mwild1@gmail.com> parents: 2923 diff changeset	117 end
d2816fb6c7ea mod_tls: Add s2s_allow_encryption option which, when set to false, disabled TLS for s2s Matthew Wild <mwild1@gmail.com> parents: 2923 diff changeset	118
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	119 -- Hook <starttls/>
2600 1e6f3002e04f mod_tls: Inlined some code. Waqas Hussain <waqas20@gmail.com> parents: 2596 diff changeset	120 module:hook("stanza/urn:ietf:params:xml:ns:xmpp-tls:starttls", function(event)
1e6f3002e04f mod_tls: Inlined some code. Waqas Hussain <waqas20@gmail.com> parents: 2596 diff changeset	121 local origin = event.origin;
2625 03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection Matthew Wild <mwild1@gmail.com> parents: 2623 diff changeset	122 if can_do_tls(origin) then
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	123 (origin.sends2s or origin.send)(starttls_proceed);
11519 df4bd3af4099 mod_tls: Bail out if session got destroyed while sending <proceed/> Kim Alvefur <zash@zash.se> parents: 11341 diff changeset	124 if origin.destroyed then return end
2600 1e6f3002e04f mod_tls: Inlined some code. Waqas Hussain <waqas20@gmail.com> parents: 2596 diff changeset	125 origin:reset_stream();
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	126 origin.conn:starttls(origin.ssl_ctx);
4157 1b5a8e071a80 mod_tls: Drop 'TLS negotiation started for ...' to debug level from info Matthew Wild <mwild1@gmail.com> parents: 3583 diff changeset	127 origin.log("debug", "TLS negotiation started for %s...", origin.type);
2600 1e6f3002e04f mod_tls: Inlined some code. Waqas Hussain <waqas20@gmail.com> parents: 2596 diff changeset	128 origin.secure = false;
2595 015934e20f03 mod_tls: Switched to new events API. Waqas Hussain <waqas20@gmail.com> parents: 2594 diff changeset	129 else
015934e20f03 mod_tls: Switched to new events API. Waqas Hussain <waqas20@gmail.com> parents: 2594 diff changeset	130 origin.log("warn", "Attempt to start TLS, but TLS is not available on this %s connection", origin.type);
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	131 (origin.sends2s or origin.send)(starttls_failure);
2601 e64c6a4aa50b mod_tls: Respond with proper error when TLS cannot be negotiated. Waqas Hussain <waqas20@gmail.com> parents: 2600 diff changeset	132 origin:close();
2595 015934e20f03 mod_tls: Switched to new events API. Waqas Hussain <waqas20@gmail.com> parents: 2594 diff changeset	133 end
015934e20f03 mod_tls: Switched to new events API. Waqas Hussain <waqas20@gmail.com> parents: 2594 diff changeset	134 return true;
015934e20f03 mod_tls: Switched to new events API. Waqas Hussain <waqas20@gmail.com> parents: 2594 diff changeset	135 end);
2932 d2816fb6c7ea mod_tls: Add s2s_allow_encryption option which, when set to false, disabled TLS for s2s Matthew Wild <mwild1@gmail.com> parents: 2923 diff changeset	136
11727 f3aee8a825cc Fix various spelling errors (thanks codespell) Kim Alvefur <zash@zash.se> parents: 11580 diff changeset	137 -- Advertise stream feature
2607 35a5d1c5ea28 mod_tls: Hook stream-features event using new events API. Waqas Hussain <waqas20@gmail.com> parents: 2605 diff changeset	138 module:hook("stream-features", function(event)
35a5d1c5ea28 mod_tls: Hook stream-features event using new events API. Waqas Hussain <waqas20@gmail.com> parents: 2605 diff changeset	139 local origin, features = event.origin, event.features;
2625 03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection Matthew Wild <mwild1@gmail.com> parents: 2623 diff changeset	140 if can_do_tls(origin) then
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	141 features:add_child(c2s_feature);
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	142 end
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	143 end);
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	144 module:hook("s2s-stream-features", function(event)
2613 afa20941e098 s2smanager, mod_compression, mod_tls: Changed event.session to event.origin for s2s-stream-features event for consistency. Waqas Hussain <waqas20@gmail.com> parents: 2607 diff changeset	145 local origin, features = event.origin, event.features;
2625 03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection Matthew Wild <mwild1@gmail.com> parents: 2623 diff changeset	146 if can_do_tls(origin) then
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	147 features:add_child(s2s_feature);
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	148 end
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	149 end);
1875 334383faf77b mod_tls: Advertise and handle TLS for s2s connections Matthew Wild <mwild1@gmail.com> parents: 1675 diff changeset	150
334383faf77b mod_tls: Advertise and handle TLS for s2s connections Matthew Wild <mwild1@gmail.com> parents: 1675 diff changeset	151 -- For s2sout connections, start TLS if we can
7959 3941d609ff85 mod_tls: Switch to hook_tag from hook_stanza which was renamed in 2087d42f1e77 Kim Alvefur <zash@zash.se> parents: 7913 diff changeset	152 module:hook_tag("http://etherx.jabber.org/streams", "features", function (session, stanza)
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	153 module:log("debug", "Received features element");
11340 a7109eb45e30 mod_tls: Attempt STARTTLS even if not advertised as per RFC 7590 Kim Alvefur <zash@zash.se> parents: 10784 diff changeset	154 if can_do_tls(session) then
a7109eb45e30 mod_tls: Attempt STARTTLS even if not advertised as per RFC 7590 Kim Alvefur <zash@zash.se> parents: 10784 diff changeset	155 if stanza:get_child("starttls", xmlns_starttls) then
a7109eb45e30 mod_tls: Attempt STARTTLS even if not advertised as per RFC 7590 Kim Alvefur <zash@zash.se> parents: 10784 diff changeset	156 module:log("debug", "%s is offering TLS, taking up the offer...", session.to_host);
11341 c567e5e2b77a mod_tls: Ignore lack of STARTTLS offer only when s2s_require_encryption set Kim Alvefur <zash@zash.se> parents: 11340 diff changeset	157 elseif s2s_require_encryption then
c567e5e2b77a mod_tls: Ignore lack of STARTTLS offer only when s2s_require_encryption set Kim Alvefur <zash@zash.se> parents: 11340 diff changeset	158 module:log("debug", "%s is not offering TLS, trying anyways!", session.to_host);
11340 a7109eb45e30 mod_tls: Attempt STARTTLS even if not advertised as per RFC 7590 Kim Alvefur <zash@zash.se> parents: 10784 diff changeset	159 else
11341 c567e5e2b77a mod_tls: Ignore lack of STARTTLS offer only when s2s_require_encryption set Kim Alvefur <zash@zash.se> parents: 11340 diff changeset	160 module:log("debug", "%s is not offering TLS", session.to_host);
c567e5e2b77a mod_tls: Ignore lack of STARTTLS offer only when s2s_require_encryption set Kim Alvefur <zash@zash.se> parents: 11340 diff changeset	161 return;
11340 a7109eb45e30 mod_tls: Attempt STARTTLS even if not advertised as per RFC 7590 Kim Alvefur <zash@zash.se> parents: 10784 diff changeset	162 end
6709 b6eff3ba13de mod_tls: Build <starttls/> as a stanza instead of with string concatenation Kim Alvefur <zash@zash.se> parents: 6526 diff changeset	163 session.sends2s(starttls_initiate);
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	164 return true;
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	165 end
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	166 end, 500);
1875 334383faf77b mod_tls: Advertise and handle TLS for s2s connections Matthew Wild <mwild1@gmail.com> parents: 1675 diff changeset	167
11766 6ad335cd43f9 mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections Kim Alvefur <zash@zash.se> parents: 11727 diff changeset	168 module:hook("s2sout-authenticate-legacy", function(event)
6ad335cd43f9 mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections Kim Alvefur <zash@zash.se> parents: 11727 diff changeset	169 local session = event.origin;
6ad335cd43f9 mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections Kim Alvefur <zash@zash.se> parents: 11727 diff changeset	170 if s2s_require_encryption and can_do_tls(session) then
6ad335cd43f9 mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections Kim Alvefur <zash@zash.se> parents: 11727 diff changeset	171 session.sends2s(starttls_initiate);
6ad335cd43f9 mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections Kim Alvefur <zash@zash.se> parents: 11727 diff changeset	172 return true;
6ad335cd43f9 mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections Kim Alvefur <zash@zash.se> parents: 11727 diff changeset	173 end
6ad335cd43f9 mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections Kim Alvefur <zash@zash.se> parents: 11727 diff changeset	174 end, 200);
6ad335cd43f9 mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections Kim Alvefur <zash@zash.se> parents: 11727 diff changeset	175
7959 3941d609ff85 mod_tls: Switch to hook_tag from hook_stanza which was renamed in 2087d42f1e77 Kim Alvefur <zash@zash.se> parents: 7913 diff changeset	176 module:hook_tag(xmlns_starttls, "proceed", function (session, stanza) -- luacheck: ignore 212/stanza
7834 a2081d28bd22 mod_tls: Verify that TLS is available before proceeding Kim Alvefur <zash@zash.se> parents: 7833 diff changeset	177 if session.type == "s2sout_unauthed" and can_do_tls(session) then
7833 94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections Kim Alvefur <zash@zash.se> parents: 7712 diff changeset	178 module:log("debug", "Proceeding with TLS on s2sout...");
94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections Kim Alvefur <zash@zash.se> parents: 7712 diff changeset	179 session:reset_stream();
94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections Kim Alvefur <zash@zash.se> parents: 7712 diff changeset	180 session.conn:starttls(session.ssl_ctx);
94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections Kim Alvefur <zash@zash.se> parents: 7712 diff changeset	181 session.secure = false;
94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections Kim Alvefur <zash@zash.se> parents: 7712 diff changeset	182 return true;
94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections Kim Alvefur <zash@zash.se> parents: 7712 diff changeset	183 end
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	184 end);
11580 9ad5ec65132d mod_tls: Add "support" for <failure> by closing gracefully Kim Alvefur <zash@zash.se> parents: 11530 diff changeset	185
9ad5ec65132d mod_tls: Add "support" for <failure> by closing gracefully Kim Alvefur <zash@zash.se> parents: 11530 diff changeset	186 module:hook_tag(xmlns_starttls, "failure", function (session, stanza) -- luacheck: ignore 212/stanza
9ad5ec65132d mod_tls: Add "support" for <failure> by closing gracefully Kim Alvefur <zash@zash.se> parents: 11530 diff changeset	187 module:log("warn", "TLS negotiation with %s failed.", session.to_host);
9ad5ec65132d mod_tls: Add "support" for <failure> by closing gracefully Kim Alvefur <zash@zash.se> parents: 11530 diff changeset	188 session:close(nil, "TLS negotiation failed");
9ad5ec65132d mod_tls: Add "support" for <failure> by closing gracefully Kim Alvefur <zash@zash.se> parents: 11530 diff changeset	189 return false;
9ad5ec65132d mod_tls: Add "support" for <failure> by closing gracefully Kim Alvefur <zash@zash.se> parents: 11530 diff changeset	190 end);

prosody

3db09eb4c43b

plugins/mod_tls.lua

Software / code / prosody

Annotate

plugins/mod_tls.lua @ 12032:3db09eb4c43b

Software `/` code `/` prosody