Software /
code /
prosody
Annotate
core/portmanager.lua @ 11590:5aafb832c91b
core.portmanager: Fix race condition in initialization of SNI cert map
Under some circumstances when hosts and modules are loaded in some
certain order, entries end up missing from the SNI map. This manifests
in e.g. `curl https://localhost:5281/` giving an error about
"unrecognized name".
The `service` argument is `nil` when invoked from the "host-activated"
event, leading it to iterating over every service. And then it would not
be fetching e.g. `http_host` from the config, which explains why https
would sometimes not work due to the missing name entry.
Because when `service` is included, this limits the iteration to
matching entries, while also returning the same value as the `name` loop
variable. Because `name == service when service != nil` we can use name
instead in the body of the loop.
author | Kim Alvefur <zash@zash.se> |
---|---|
date | Fri, 28 May 2021 17:09:22 +0200 |
parent | 11536:fb9bd9fa4356 |
child | 11596:f6f1b50cbedf |
rev | line source |
---|---|
4741
0653476ac3a3
portmanager: Explicitly import some libraries
Matthew Wild <mwild1@gmail.com>
parents:
4687
diff
changeset
|
1 local config = require "core.configmanager"; |
4856
3e3e282f20a3
portmanager: Support for per-port SSL certificates
Matthew Wild <mwild1@gmail.com>
parents:
4809
diff
changeset
|
2 local certmanager = require "core.certmanager"; |
4741
0653476ac3a3
portmanager: Explicitly import some libraries
Matthew Wild <mwild1@gmail.com>
parents:
4687
diff
changeset
|
3 local server = require "net.server"; |
5391
0d49a4e9963b
portmanager: use_ipv6 defaults to true if luasocket has ipv6 support
Kim Alvefur <zash@zash.se>
parents:
5319
diff
changeset
|
4 local socket = require "socket"; |
4542
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
5 |
4741
0653476ac3a3
portmanager: Explicitly import some libraries
Matthew Wild <mwild1@gmail.com>
parents:
4687
diff
changeset
|
6 local log = require "util.logger".init("portmanager"); |
4542
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
7 local multitable = require "util.multitable"; |
4741
0653476ac3a3
portmanager: Explicitly import some libraries
Matthew Wild <mwild1@gmail.com>
parents:
4687
diff
changeset
|
8 local set = require "util.set"; |
0653476ac3a3
portmanager: Explicitly import some libraries
Matthew Wild <mwild1@gmail.com>
parents:
4687
diff
changeset
|
9 |
4857
0991a127ac43
portmanager: Remove unused import of 'package'
Matthew Wild <mwild1@gmail.com>
parents:
4856
diff
changeset
|
10 local table = table; |
4744
3be37768720d
portmanager: Fix breakage (import ALL the functions)
Matthew Wild <mwild1@gmail.com>
parents:
4743
diff
changeset
|
11 local setmetatable, rawset, rawget = setmetatable, rawset, rawget; |
10107
1dbabbebb53c
core.portmanager: Remove unused local [luacheck]
Kim Alvefur <zash@zash.se>
parents:
10106
diff
changeset
|
12 local type, tonumber, ipairs = type, tonumber, ipairs; |
9849
70e56f126177
core.portmanager: Collect per-host certificates for SNI
Kim Alvefur <zash@zash.se>
parents:
9848
diff
changeset
|
13 local pairs = pairs; |
4744
3be37768720d
portmanager: Fix breakage (import ALL the functions)
Matthew Wild <mwild1@gmail.com>
parents:
4743
diff
changeset
|
14 |
4741
0653476ac3a3
portmanager: Explicitly import some libraries
Matthew Wild <mwild1@gmail.com>
parents:
4687
diff
changeset
|
15 local prosody = prosody; |
4542
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
16 local fire_event = prosody.events.fire_event; |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
17 |
6779
6236668da30a
core.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents:
6688
diff
changeset
|
18 local _ENV = nil; |
8555
4f0f5b49bb03
vairious: Add annotation when an empty environment is set [luacheck]
Kim Alvefur <zash@zash.se>
parents:
7947
diff
changeset
|
19 -- luacheck: std none |
4742
23c2ece2c8bc
portmanager: Add module() definition
Matthew Wild <mwild1@gmail.com>
parents:
4741
diff
changeset
|
20 |
4542
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
21 --- Config |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
22 |
5392
613959dbd0b2
portmanager: Add use_ipv4 option, default to true.
Kim Alvefur <zash@zash.se>
parents:
5391
diff
changeset
|
23 local default_interfaces = { }; |
613959dbd0b2
portmanager: Add use_ipv4 option, default to true.
Kim Alvefur <zash@zash.se>
parents:
5391
diff
changeset
|
24 local default_local_interfaces = { }; |
613959dbd0b2
portmanager: Add use_ipv4 option, default to true.
Kim Alvefur <zash@zash.se>
parents:
5391
diff
changeset
|
25 if config.get("*", "use_ipv4") ~= false then |
613959dbd0b2
portmanager: Add use_ipv4 option, default to true.
Kim Alvefur <zash@zash.se>
parents:
5391
diff
changeset
|
26 table.insert(default_interfaces, "*"); |
613959dbd0b2
portmanager: Add use_ipv4 option, default to true.
Kim Alvefur <zash@zash.se>
parents:
5391
diff
changeset
|
27 table.insert(default_local_interfaces, "127.0.0.1"); |
613959dbd0b2
portmanager: Add use_ipv4 option, default to true.
Kim Alvefur <zash@zash.se>
parents:
5391
diff
changeset
|
28 end |
5391
0d49a4e9963b
portmanager: use_ipv6 defaults to true if luasocket has ipv6 support
Kim Alvefur <zash@zash.se>
parents:
5319
diff
changeset
|
29 if socket.tcp6 and config.get("*", "use_ipv6") ~= false then |
4542
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
30 table.insert(default_interfaces, "::"); |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
31 table.insert(default_local_interfaces, "::1"); |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
32 end |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
33 |
7421
d6f12056afda
portmanager: Set default read size back to 4K
Kim Alvefur <zash@zash.se>
parents:
7078
diff
changeset
|
34 local default_mode = config.get("*", "network_default_read_size") or 4096; |
6041
a97591d2e1ad
portmanager: Make maximum read size configurable, and default to 4KB
Matthew Wild <mwild1@gmail.com>
parents:
5550
diff
changeset
|
35 |
4542
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
36 --- Private state |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
37 |
4607
7f45b2cb3c03
portmanager: Add unregister_service(), and allow multiple services with the same name (they get queued)
Matthew Wild <mwild1@gmail.com>
parents:
4598
diff
changeset
|
38 -- service_name -> { service_info, ... } |
7f45b2cb3c03
portmanager: Add unregister_service(), and allow multiple services with the same name (they get queued)
Matthew Wild <mwild1@gmail.com>
parents:
4598
diff
changeset
|
39 local services = setmetatable({}, { __index = function (t, k) rawset(t, k, {}); return rawget(t, k); end }); |
4542
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
40 |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
41 -- service_name, interface (string), port (number) |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
42 local active_services = multitable.new(); |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
43 |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
44 --- Private helpers |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
45 |
6663
d3023dd07cb6
portmanager, s2smanager, sessionmanager, stanza_router, storagemanager, usermanager, util.xml: Add luacheck annotations
Matthew Wild <mwild1@gmail.com>
parents:
6549
diff
changeset
|
46 local function error_to_friendly_message(service_name, port, err) --luacheck: ignore 212/service_name |
4542
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
47 local friendly_message = err; |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
48 if err:match(" in use") then |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
49 -- FIXME: Use service_name here |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
50 if port == 5222 or port == 5223 or port == 5269 then |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
51 friendly_message = "check that Prosody or another XMPP server is " |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
52 .."not already running and using this port"; |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
53 elseif port == 80 or port == 81 then |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
54 friendly_message = "check that a HTTP server is not already using " |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
55 .."this port"; |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
56 elseif port == 5280 then |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
57 friendly_message = "check that Prosody or a BOSH connection manager " |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
58 .."is not already running"; |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
59 else |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
60 friendly_message = "this port is in use by another application"; |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
61 end |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
62 elseif err:match("permission") then |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
63 friendly_message = "Prosody does not have sufficient privileges to use this port"; |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
64 end |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
65 return friendly_message; |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
66 end |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
67 |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
68 --- Public API |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
69 |
6779
6236668da30a
core.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents:
6688
diff
changeset
|
70 local function activate(service_name) |
4607
7f45b2cb3c03
portmanager: Add unregister_service(), and allow multiple services with the same name (they get queued)
Matthew Wild <mwild1@gmail.com>
parents:
4598
diff
changeset
|
71 local service_info = services[service_name][1]; |
4542
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
72 if not service_info then |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
73 return nil, "Unknown service: "..service_name; |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
74 end |
5776
bd0ff8ae98a8
Remove all trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents:
5550
diff
changeset
|
75 |
4616
03d9fe1bcdd3
portmanager: Fix pre-0.9 compatibility by taking default_interface and default_port from the listener instead of service table
Matthew Wild <mwild1@gmail.com>
parents:
4615
diff
changeset
|
76 local listener = service_info.listener; |
03d9fe1bcdd3
portmanager: Fix pre-0.9 compatibility by taking default_interface and default_port from the listener instead of service table
Matthew Wild <mwild1@gmail.com>
parents:
4615
diff
changeset
|
77 |
4615
29a9988c1e1b
portmanager: Allow services to specify their config option prefix
Matthew Wild <mwild1@gmail.com>
parents:
4612
diff
changeset
|
78 local config_prefix = (service_info.config_prefix or service_name).."_"; |
29a9988c1e1b
portmanager: Allow services to specify their config option prefix
Matthew Wild <mwild1@gmail.com>
parents:
4612
diff
changeset
|
79 if config_prefix == "_" then |
29a9988c1e1b
portmanager: Allow services to specify their config option prefix
Matthew Wild <mwild1@gmail.com>
parents:
4612
diff
changeset
|
80 config_prefix = ""; |
29a9988c1e1b
portmanager: Allow services to specify their config option prefix
Matthew Wild <mwild1@gmail.com>
parents:
4612
diff
changeset
|
81 end |
4542
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
82 |
4687
bd3a852b949a
portmanager: Fix selecting bind_interfaces from pre-0.9 config options.
Kim Alvefur <zash@zash.se>
parents:
4677
diff
changeset
|
83 local bind_interfaces = config.get("*", config_prefix.."interfaces") |
4615
29a9988c1e1b
portmanager: Allow services to specify their config option prefix
Matthew Wild <mwild1@gmail.com>
parents:
4612
diff
changeset
|
84 or config.get("*", config_prefix.."interface") -- COMPAT w/pre-0.9 |
5087
71a5a6a6c74c
portmanager: Support 'local_interfaces' config option (default for private listeners like components, telnet, etc.) (thanks mva)
Matthew Wild <mwild1@gmail.com>
parents:
5047
diff
changeset
|
85 or (service_info.private and (config.get("*", "local_interfaces") or default_local_interfaces)) |
4542
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
86 or config.get("*", "interfaces") |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
87 or config.get("*", "interface") -- COMPAT w/pre-0.9 |
4616
03d9fe1bcdd3
portmanager: Fix pre-0.9 compatibility by taking default_interface and default_port from the listener instead of service table
Matthew Wild <mwild1@gmail.com>
parents:
4615
diff
changeset
|
88 or listener.default_interface -- COMPAT w/pre0.9 |
4687
bd3a852b949a
portmanager: Fix selecting bind_interfaces from pre-0.9 config options.
Kim Alvefur <zash@zash.se>
parents:
4677
diff
changeset
|
89 or default_interfaces |
bd3a852b949a
portmanager: Fix selecting bind_interfaces from pre-0.9 config options.
Kim Alvefur <zash@zash.se>
parents:
4677
diff
changeset
|
90 bind_interfaces = set.new(type(bind_interfaces)~="table" and {bind_interfaces} or bind_interfaces); |
5776
bd0ff8ae98a8
Remove all trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents:
5550
diff
changeset
|
91 |
5319
d20861bf900b
portmanager: Make sure foo_ports is a table
Kim Alvefur <zash@zash.se>
parents:
5225
diff
changeset
|
92 local bind_ports = config.get("*", config_prefix.."ports") |
4542
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
93 or service_info.default_ports |
4624
3e4715d44561
portmanager: Support 'default_port' in service options
Matthew Wild <mwild1@gmail.com>
parents:
4618
diff
changeset
|
94 or {service_info.default_port |
3e4715d44561
portmanager: Support 'default_port' in service options
Matthew Wild <mwild1@gmail.com>
parents:
4618
diff
changeset
|
95 or listener.default_port -- COMPAT w/pre-0.9 |
5319
d20861bf900b
portmanager: Make sure foo_ports is a table
Kim Alvefur <zash@zash.se>
parents:
5225
diff
changeset
|
96 } |
d20861bf900b
portmanager: Make sure foo_ports is a table
Kim Alvefur <zash@zash.se>
parents:
5225
diff
changeset
|
97 bind_ports = set.new(type(bind_ports) ~= "table" and { bind_ports } or bind_ports ); |
4542
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
98 |
9837
789395f027f1
core.portmanager: Reduce scope of variable
Kim Alvefur <zash@zash.se>
parents:
9836
diff
changeset
|
99 local mode = listener.default_mode or default_mode; |
5549
cce17bcb7c94
portmanager: Include port numbers the service is listening on in the info logs.
Waqas Hussain <waqas20@gmail.com>
parents:
5432
diff
changeset
|
100 local hooked_ports = {}; |
5776
bd0ff8ae98a8
Remove all trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents:
5550
diff
changeset
|
101 |
4542
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
102 for interface in bind_interfaces do |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
103 for port in bind_ports do |
5399
13454b2b86bf
portmanager: Log error and fail to bind when port is invalid (not a number)
Matthew Wild <mwild1@gmail.com>
parents:
5392
diff
changeset
|
104 local port_number = tonumber(port); |
13454b2b86bf
portmanager: Log error and fail to bind when port is invalid (not a number)
Matthew Wild <mwild1@gmail.com>
parents:
5392
diff
changeset
|
105 if not port_number then |
10106
c8fbb7f2fc0d
core.portmanager: Remove tostring call from logging
Kim Alvefur <zash@zash.se>
parents:
9975
diff
changeset
|
106 log("error", "Invalid port number specified for service '%s': %s", service_info.name, port); |
5399
13454b2b86bf
portmanager: Log error and fail to bind when port is invalid (not a number)
Matthew Wild <mwild1@gmail.com>
parents:
5392
diff
changeset
|
107 elseif #active_services:search(nil, interface, port_number) > 0 then |
7947
24170d74b00b
core: Split some very long lines [luacheck]
Kim Alvefur <zash@zash.se>
parents:
7421
diff
changeset
|
108 log("error", "Multiple services configured to listen on the same port ([%s]:%d): %s, %s", interface, port, |
24170d74b00b
core: Split some very long lines [luacheck]
Kim Alvefur <zash@zash.se>
parents:
7421
diff
changeset
|
109 active_services:search(nil, interface, port)[1][1].service.name or "<unnamed>", service_name or "<unnamed>"); |
4542
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
110 else |
9848
b923053e69ba
core.portmanager: Record TLS config for each port
Kim Alvefur <zash@zash.se>
parents:
9837
diff
changeset
|
111 local ssl, cfg, err; |
4856
3e3e282f20a3
portmanager: Support for per-port SSL certificates
Matthew Wild <mwild1@gmail.com>
parents:
4809
diff
changeset
|
112 -- Create SSL context for this service/port |
3e3e282f20a3
portmanager: Support for per-port SSL certificates
Matthew Wild <mwild1@gmail.com>
parents:
4809
diff
changeset
|
113 if service_info.encryption == "ssl" then |
6295
cb12ff49503d
core.portmanager: Simplify and take advantage of new ssl config merging in certmanager
Kim Alvefur <zash@zash.se>
parents:
6054
diff
changeset
|
114 local global_ssl_config = config.get("*", "ssl") or {}; |
cb12ff49503d
core.portmanager: Simplify and take advantage of new ssl config merging in certmanager
Kim Alvefur <zash@zash.se>
parents:
6054
diff
changeset
|
115 local prefix_ssl_config = config.get("*", config_prefix.."ssl") or global_ssl_config; |
9972
240d3f1f7dee
core.portmanager: Log debug message for each kind of TLS context created
Kim Alvefur <zash@zash.se>
parents:
8555
diff
changeset
|
116 log("debug", "Creating context for direct TLS service %s on port %d", service_info.name, port); |
9848
b923053e69ba
core.portmanager: Record TLS config for each port
Kim Alvefur <zash@zash.se>
parents:
9837
diff
changeset
|
117 ssl, err, cfg = certmanager.create_context(service_info.name.." port "..port, "server", |
6295
cb12ff49503d
core.portmanager: Simplify and take advantage of new ssl config merging in certmanager
Kim Alvefur <zash@zash.se>
parents:
6054
diff
changeset
|
118 prefix_ssl_config[interface], |
cb12ff49503d
core.portmanager: Simplify and take advantage of new ssl config merging in certmanager
Kim Alvefur <zash@zash.se>
parents:
6054
diff
changeset
|
119 prefix_ssl_config[port], |
cb12ff49503d
core.portmanager: Simplify and take advantage of new ssl config merging in certmanager
Kim Alvefur <zash@zash.se>
parents:
6054
diff
changeset
|
120 prefix_ssl_config, |
6980
daaa52b3f45f
portmanager: Lower the priority of module-supplied TLS options
Kim Alvefur <zash@zash.se>
parents:
6788
diff
changeset
|
121 service_info.ssl_config or {}, |
6295
cb12ff49503d
core.portmanager: Simplify and take advantage of new ssl config merging in certmanager
Kim Alvefur <zash@zash.se>
parents:
6054
diff
changeset
|
122 global_ssl_config[interface], |
cb12ff49503d
core.portmanager: Simplify and take advantage of new ssl config merging in certmanager
Kim Alvefur <zash@zash.se>
parents:
6054
diff
changeset
|
123 global_ssl_config[port]); |
5009
b27ba2c83dd4
portmanager: Show a friendly error message when initializing SSL fails (thanks MattJ for the entire patch that I fixed one line in)
Kim Alvefur <zash@zash.se>
parents:
4902
diff
changeset
|
124 if not ssl then |
7947
24170d74b00b
core: Split some very long lines [luacheck]
Kim Alvefur <zash@zash.se>
parents:
7421
diff
changeset
|
125 log("error", "Error binding encrypted port for %s: %s", service_info.name, |
24170d74b00b
core: Split some very long lines [luacheck]
Kim Alvefur <zash@zash.se>
parents:
7421
diff
changeset
|
126 error_to_friendly_message(service_name, port_number, err) or "unknown error"); |
5009
b27ba2c83dd4
portmanager: Show a friendly error message when initializing SSL fails (thanks MattJ for the entire patch that I fixed one line in)
Kim Alvefur <zash@zash.se>
parents:
4902
diff
changeset
|
127 end |
4856
3e3e282f20a3
portmanager: Support for per-port SSL certificates
Matthew Wild <mwild1@gmail.com>
parents:
4809
diff
changeset
|
128 end |
5009
b27ba2c83dd4
portmanager: Show a friendly error message when initializing SSL fails (thanks MattJ for the entire patch that I fixed one line in)
Kim Alvefur <zash@zash.se>
parents:
4902
diff
changeset
|
129 if not err then |
b27ba2c83dd4
portmanager: Show a friendly error message when initializing SSL fails (thanks MattJ for the entire patch that I fixed one line in)
Kim Alvefur <zash@zash.se>
parents:
4902
diff
changeset
|
130 -- Start listening on interface+port |
9836
e487197ba8a5
core.portmanager: Use server.listen API
Kim Alvefur <zash@zash.se>
parents:
8555
diff
changeset
|
131 local handler, err = server.listen(interface, port_number, listener, { |
e487197ba8a5
core.portmanager: Use server.listen API
Kim Alvefur <zash@zash.se>
parents:
8555
diff
changeset
|
132 read_size = mode, |
e487197ba8a5
core.portmanager: Use server.listen API
Kim Alvefur <zash@zash.se>
parents:
8555
diff
changeset
|
133 tls_ctx = ssl, |
e487197ba8a5
core.portmanager: Use server.listen API
Kim Alvefur <zash@zash.se>
parents:
8555
diff
changeset
|
134 tls_direct = service_info.encryption == "ssl"; |
9848
b923053e69ba
core.portmanager: Record TLS config for each port
Kim Alvefur <zash@zash.se>
parents:
9837
diff
changeset
|
135 sni_hosts = {}, |
9836
e487197ba8a5
core.portmanager: Use server.listen API
Kim Alvefur <zash@zash.se>
parents:
8555
diff
changeset
|
136 }); |
5009
b27ba2c83dd4
portmanager: Show a friendly error message when initializing SSL fails (thanks MattJ for the entire patch that I fixed one line in)
Kim Alvefur <zash@zash.se>
parents:
4902
diff
changeset
|
137 if not handler then |
7947
24170d74b00b
core: Split some very long lines [luacheck]
Kim Alvefur <zash@zash.se>
parents:
7421
diff
changeset
|
138 log("error", "Failed to open server port %d on %s, %s", port_number, interface, |
24170d74b00b
core: Split some very long lines [luacheck]
Kim Alvefur <zash@zash.se>
parents:
7421
diff
changeset
|
139 error_to_friendly_message(service_name, port_number, err)); |
5009
b27ba2c83dd4
portmanager: Show a friendly error message when initializing SSL fails (thanks MattJ for the entire patch that I fixed one line in)
Kim Alvefur <zash@zash.se>
parents:
4902
diff
changeset
|
140 else |
5550
557583904dc5
portmanager: Also include the interface the service is listening on
Kim Alvefur <zash@zash.se>
parents:
5549
diff
changeset
|
141 table.insert(hooked_ports, "["..interface.."]:"..port_number); |
5399
13454b2b86bf
portmanager: Log error and fail to bind when port is invalid (not a number)
Matthew Wild <mwild1@gmail.com>
parents:
5392
diff
changeset
|
142 log("debug", "Added listening service %s to [%s]:%d", service_name, interface, port_number); |
13454b2b86bf
portmanager: Log error and fail to bind when port is invalid (not a number)
Matthew Wild <mwild1@gmail.com>
parents:
5392
diff
changeset
|
143 active_services:add(service_name, interface, port_number, { |
5009
b27ba2c83dd4
portmanager: Show a friendly error message when initializing SSL fails (thanks MattJ for the entire patch that I fixed one line in)
Kim Alvefur <zash@zash.se>
parents:
4902
diff
changeset
|
144 server = handler; |
b27ba2c83dd4
portmanager: Show a friendly error message when initializing SSL fails (thanks MattJ for the entire patch that I fixed one line in)
Kim Alvefur <zash@zash.se>
parents:
4902
diff
changeset
|
145 service = service_info; |
9848
b923053e69ba
core.portmanager: Record TLS config for each port
Kim Alvefur <zash@zash.se>
parents:
9837
diff
changeset
|
146 tls_cfg = cfg; |
5009
b27ba2c83dd4
portmanager: Show a friendly error message when initializing SSL fails (thanks MattJ for the entire patch that I fixed one line in)
Kim Alvefur <zash@zash.se>
parents:
4902
diff
changeset
|
147 }); |
b27ba2c83dd4
portmanager: Show a friendly error message when initializing SSL fails (thanks MattJ for the entire patch that I fixed one line in)
Kim Alvefur <zash@zash.se>
parents:
4902
diff
changeset
|
148 end |
4542
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
149 end |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
150 end |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
151 end |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
152 end |
7947
24170d74b00b
core: Split some very long lines [luacheck]
Kim Alvefur <zash@zash.se>
parents:
7421
diff
changeset
|
153 log("info", "Activated service '%s' on %s", service_name, |
24170d74b00b
core: Split some very long lines [luacheck]
Kim Alvefur <zash@zash.se>
parents:
7421
diff
changeset
|
154 #hooked_ports == 0 and "no ports" or table.concat(hooked_ports, ", ")); |
4607
7f45b2cb3c03
portmanager: Add unregister_service(), and allow multiple services with the same name (they get queued)
Matthew Wild <mwild1@gmail.com>
parents:
4598
diff
changeset
|
155 return true; |
4542
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
156 end |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
157 |
6788
d64c1f3c7e2e
portmanager: Add forward declarations
Kim Alvefur <zash@zash.se>
parents:
6779
diff
changeset
|
158 local close; -- forward declaration |
d64c1f3c7e2e
portmanager: Add forward declarations
Kim Alvefur <zash@zash.se>
parents:
6779
diff
changeset
|
159 |
6779
6236668da30a
core.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents:
6688
diff
changeset
|
160 local function deactivate(service_name, service_info) |
6686
c5b512cddda0
portmanager: Add luacheck annotations
Matthew Wild <mwild1@gmail.com>
parents:
6663
diff
changeset
|
161 for name, interface, port, n, active_service --luacheck: ignore 213/name 213/n |
4902
a7c799a7a34b
portmanager: Match service against service_info (:iter() doesn't match values)
Matthew Wild <mwild1@gmail.com>
parents:
4897
diff
changeset
|
162 in active_services:iter(service_name or service_info and service_info.name, nil, nil, nil) do |
a7c799a7a34b
portmanager: Match service against service_info (:iter() doesn't match values)
Matthew Wild <mwild1@gmail.com>
parents:
4897
diff
changeset
|
163 if service_info == nil or active_service.service == service_info then |
a7c799a7a34b
portmanager: Match service against service_info (:iter() doesn't match values)
Matthew Wild <mwild1@gmail.com>
parents:
4897
diff
changeset
|
164 close(interface, port); |
a7c799a7a34b
portmanager: Match service against service_info (:iter() doesn't match values)
Matthew Wild <mwild1@gmail.com>
parents:
4897
diff
changeset
|
165 end |
4542
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
166 end |
4897
1a90e5225b22
portmanager: Fix to deactivate services when they are unregistered (metatable:iter() wins)
Matthew Wild <mwild1@gmail.com>
parents:
4861
diff
changeset
|
167 log("info", "Deactivated service '%s'", service_name or service_info.name); |
4542
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
168 end |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
169 |
6779
6236668da30a
core.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents:
6688
diff
changeset
|
170 local function register_service(service_name, service_info) |
4607
7f45b2cb3c03
portmanager: Add unregister_service(), and allow multiple services with the same name (they get queued)
Matthew Wild <mwild1@gmail.com>
parents:
4598
diff
changeset
|
171 table.insert(services[service_name], service_info); |
4542
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
172 |
10641
85f1cbfd364a
portmanager: Don't auto-start network services under prosodyctl
Matthew Wild <mwild1@gmail.com>
parents:
10538
diff
changeset
|
173 if not active_services:get(service_name) and prosody.process_type == "prosody" then |
4607
7f45b2cb3c03
portmanager: Add unregister_service(), and allow multiple services with the same name (they get queued)
Matthew Wild <mwild1@gmail.com>
parents:
4598
diff
changeset
|
174 log("debug", "No active service for %s, activating...", service_name); |
4743
70d68e789d93
portmanager: Rename activate_service() to activate() (to match deactivate())
Matthew Wild <mwild1@gmail.com>
parents:
4742
diff
changeset
|
175 local ok, err = activate(service_name); |
4607
7f45b2cb3c03
portmanager: Add unregister_service(), and allow multiple services with the same name (they get queued)
Matthew Wild <mwild1@gmail.com>
parents:
4598
diff
changeset
|
176 if not ok then |
7f45b2cb3c03
portmanager: Add unregister_service(), and allow multiple services with the same name (they get queued)
Matthew Wild <mwild1@gmail.com>
parents:
4598
diff
changeset
|
177 log("error", "Failed to activate service '%s': %s", service_name, err or "unknown error"); |
7f45b2cb3c03
portmanager: Add unregister_service(), and allow multiple services with the same name (they get queued)
Matthew Wild <mwild1@gmail.com>
parents:
4598
diff
changeset
|
178 end |
4542
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
179 end |
5776
bd0ff8ae98a8
Remove all trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents:
5550
diff
changeset
|
180 |
4542
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
181 fire_event("service-added", { name = service_name, service = service_info }); |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
182 return true; |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
183 end |
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
184 |
6779
6236668da30a
core.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents:
6688
diff
changeset
|
185 local function unregister_service(service_name, service_info) |
4897
1a90e5225b22
portmanager: Fix to deactivate services when they are unregistered (metatable:iter() wins)
Matthew Wild <mwild1@gmail.com>
parents:
4861
diff
changeset
|
186 log("debug", "Unregistering service: %s", service_name); |
4607
7f45b2cb3c03
portmanager: Add unregister_service(), and allow multiple services with the same name (they get queued)
Matthew Wild <mwild1@gmail.com>
parents:
4598
diff
changeset
|
187 local service_info_list = services[service_name]; |
7f45b2cb3c03
portmanager: Add unregister_service(), and allow multiple services with the same name (they get queued)
Matthew Wild <mwild1@gmail.com>
parents:
4598
diff
changeset
|
188 for i, service in ipairs(service_info_list) do |
7f45b2cb3c03
portmanager: Add unregister_service(), and allow multiple services with the same name (they get queued)
Matthew Wild <mwild1@gmail.com>
parents:
4598
diff
changeset
|
189 if service == service_info then |
7f45b2cb3c03
portmanager: Add unregister_service(), and allow multiple services with the same name (they get queued)
Matthew Wild <mwild1@gmail.com>
parents:
4598
diff
changeset
|
190 table.remove(service_info_list, i); |
7f45b2cb3c03
portmanager: Add unregister_service(), and allow multiple services with the same name (they get queued)
Matthew Wild <mwild1@gmail.com>
parents:
4598
diff
changeset
|
191 end |
7f45b2cb3c03
portmanager: Add unregister_service(), and allow multiple services with the same name (they get queued)
Matthew Wild <mwild1@gmail.com>
parents:
4598
diff
changeset
|
192 end |
4897
1a90e5225b22
portmanager: Fix to deactivate services when they are unregistered (metatable:iter() wins)
Matthew Wild <mwild1@gmail.com>
parents:
4861
diff
changeset
|
193 deactivate(nil, service_info); |
1a90e5225b22
portmanager: Fix to deactivate services when they are unregistered (metatable:iter() wins)
Matthew Wild <mwild1@gmail.com>
parents:
4861
diff
changeset
|
194 if #service_info_list > 0 then -- Other services registered with this name |
1a90e5225b22
portmanager: Fix to deactivate services when they are unregistered (metatable:iter() wins)
Matthew Wild <mwild1@gmail.com>
parents:
4861
diff
changeset
|
195 activate(service_name); -- Re-activate with the next available one |
4607
7f45b2cb3c03
portmanager: Add unregister_service(), and allow multiple services with the same name (they get queued)
Matthew Wild <mwild1@gmail.com>
parents:
4598
diff
changeset
|
196 end |
4612
8bb93860fe46
portmanager: Fire service-removed on unregister
Matthew Wild <mwild1@gmail.com>
parents:
4609
diff
changeset
|
197 fire_event("service-removed", { name = service_name, service = service_info }); |
4607
7f45b2cb3c03
portmanager: Add unregister_service(), and allow multiple services with the same name (they get queued)
Matthew Wild <mwild1@gmail.com>
parents:
4598
diff
changeset
|
198 end |
7f45b2cb3c03
portmanager: Add unregister_service(), and allow multiple services with the same name (they get queued)
Matthew Wild <mwild1@gmail.com>
parents:
4598
diff
changeset
|
199 |
6788
d64c1f3c7e2e
portmanager: Add forward declarations
Kim Alvefur <zash@zash.se>
parents:
6779
diff
changeset
|
200 local get_service_at -- forward declaration |
d64c1f3c7e2e
portmanager: Add forward declarations
Kim Alvefur <zash@zash.se>
parents:
6779
diff
changeset
|
201 |
4677
05d8b4099cf5
portmanager: Add get_service_at(interface, port) and close(interface, port)
Matthew Wild <mwild1@gmail.com>
parents:
4624
diff
changeset
|
202 function close(interface, port) |
6687
d1ee04683689
portmanager: Rename variable to avoid name conflict [luacheck]
Matthew Wild <mwild1@gmail.com>
parents:
6686
diff
changeset
|
203 local service, service_server = get_service_at(interface, port); |
4677
05d8b4099cf5
portmanager: Add get_service_at(interface, port) and close(interface, port)
Matthew Wild <mwild1@gmail.com>
parents:
4624
diff
changeset
|
204 if not service then |
05d8b4099cf5
portmanager: Add get_service_at(interface, port) and close(interface, port)
Matthew Wild <mwild1@gmail.com>
parents:
4624
diff
changeset
|
205 return false, "port-not-open"; |
05d8b4099cf5
portmanager: Add get_service_at(interface, port) and close(interface, port)
Matthew Wild <mwild1@gmail.com>
parents:
4624
diff
changeset
|
206 end |
6687
d1ee04683689
portmanager: Rename variable to avoid name conflict [luacheck]
Matthew Wild <mwild1@gmail.com>
parents:
6686
diff
changeset
|
207 service_server:close(); |
4677
05d8b4099cf5
portmanager: Add get_service_at(interface, port) and close(interface, port)
Matthew Wild <mwild1@gmail.com>
parents:
4624
diff
changeset
|
208 active_services:remove(service.name, interface, port); |
05d8b4099cf5
portmanager: Add get_service_at(interface, port) and close(interface, port)
Matthew Wild <mwild1@gmail.com>
parents:
4624
diff
changeset
|
209 log("debug", "Removed listening service %s from [%s]:%d", service.name, interface, port); |
05d8b4099cf5
portmanager: Add get_service_at(interface, port) and close(interface, port)
Matthew Wild <mwild1@gmail.com>
parents:
4624
diff
changeset
|
210 return true; |
05d8b4099cf5
portmanager: Add get_service_at(interface, port) and close(interface, port)
Matthew Wild <mwild1@gmail.com>
parents:
4624
diff
changeset
|
211 end |
05d8b4099cf5
portmanager: Add get_service_at(interface, port) and close(interface, port)
Matthew Wild <mwild1@gmail.com>
parents:
4624
diff
changeset
|
212 |
05d8b4099cf5
portmanager: Add get_service_at(interface, port) and close(interface, port)
Matthew Wild <mwild1@gmail.com>
parents:
4624
diff
changeset
|
213 function get_service_at(interface, port) |
05d8b4099cf5
portmanager: Add get_service_at(interface, port) and close(interface, port)
Matthew Wild <mwild1@gmail.com>
parents:
4624
diff
changeset
|
214 local data = active_services:search(nil, interface, port)[1][1]; |
05d8b4099cf5
portmanager: Add get_service_at(interface, port) and close(interface, port)
Matthew Wild <mwild1@gmail.com>
parents:
4624
diff
changeset
|
215 return data.service, data.server; |
05d8b4099cf5
portmanager: Add get_service_at(interface, port) and close(interface, port)
Matthew Wild <mwild1@gmail.com>
parents:
4624
diff
changeset
|
216 end |
05d8b4099cf5
portmanager: Add get_service_at(interface, port) and close(interface, port)
Matthew Wild <mwild1@gmail.com>
parents:
4624
diff
changeset
|
217 |
6779
6236668da30a
core.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents:
6688
diff
changeset
|
218 local function get_service(service_name) |
5225
079e4cb23f89
portmanager: Return first service with the specified name from get_service() (instead of the array of possible services) (thanks xnyhps)
Matthew Wild <mwild1@gmail.com>
parents:
5087
diff
changeset
|
219 return (services[service_name] or {})[1]; |
4597
25d89c7d6aee
portmanager: Add get_service()
Matthew Wild <mwild1@gmail.com>
parents:
4583
diff
changeset
|
220 end |
4542
50aca1e0bfbd
portmanager: One manager to, in the darkness, bind them
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
221 |
6779
6236668da30a
core.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents:
6688
diff
changeset
|
222 local function get_active_services() |
4598
d2bcb959d713
portmanager: Add get_active_services()
Matthew Wild <mwild1@gmail.com>
parents:
4597
diff
changeset
|
223 return active_services; |
d2bcb959d713
portmanager: Add get_active_services()
Matthew Wild <mwild1@gmail.com>
parents:
4597
diff
changeset
|
224 end |
d2bcb959d713
portmanager: Add get_active_services()
Matthew Wild <mwild1@gmail.com>
parents:
4597
diff
changeset
|
225 |
6779
6236668da30a
core.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents:
6688
diff
changeset
|
226 local function get_registered_services() |
4618
1ec8122ddffe
portmanager: Add get_registered_services() to the public API
Matthew Wild <mwild1@gmail.com>
parents:
4617
diff
changeset
|
227 return services; |
1ec8122ddffe
portmanager: Add get_registered_services() to the public API
Matthew Wild <mwild1@gmail.com>
parents:
4617
diff
changeset
|
228 end |
1ec8122ddffe
portmanager: Add get_registered_services() to the public API
Matthew Wild <mwild1@gmail.com>
parents:
4617
diff
changeset
|
229 |
6779
6236668da30a
core.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents:
6688
diff
changeset
|
230 -- Event handlers |
6236668da30a
core.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents:
6688
diff
changeset
|
231 |
9849
70e56f126177
core.portmanager: Collect per-host certificates for SNI
Kim Alvefur <zash@zash.se>
parents:
9848
diff
changeset
|
232 local function add_sni_host(host, service) |
11412
77785c5d6773
core.portmanager: Log SNI hosts, services looked for
Kim Alvefur <zash@zash.se>
parents:
10641
diff
changeset
|
233 log("debug", "Gathering certificates for SNI for host %s, %s service", host, service or "default"); |
9849
70e56f126177
core.portmanager: Collect per-host certificates for SNI
Kim Alvefur <zash@zash.se>
parents:
9848
diff
changeset
|
234 for name, interface, port, n, active_service --luacheck: ignore 213 |
70e56f126177
core.portmanager: Collect per-host certificates for SNI
Kim Alvefur <zash@zash.se>
parents:
9848
diff
changeset
|
235 in active_services:iter(service, nil, nil, nil) do |
70e56f126177
core.portmanager: Collect per-host certificates for SNI
Kim Alvefur <zash@zash.se>
parents:
9848
diff
changeset
|
236 if active_service.server.hosts and active_service.tls_cfg then |
10463
fbeb7a3fc4eb
core.portmanager: Fix TLS context inheritance for SNI hosts (completes SNI support)
Kim Alvefur <zash@zash.se>
parents:
10462
diff
changeset
|
237 local config_prefix = (active_service.config_prefix or name).."_"; |
fbeb7a3fc4eb
core.portmanager: Fix TLS context inheritance for SNI hosts (completes SNI support)
Kim Alvefur <zash@zash.se>
parents:
10462
diff
changeset
|
238 if config_prefix == "_" then config_prefix = ""; end |
fbeb7a3fc4eb
core.portmanager: Fix TLS context inheritance for SNI hosts (completes SNI support)
Kim Alvefur <zash@zash.se>
parents:
10462
diff
changeset
|
239 local prefix_ssl_config = config.get(host, config_prefix.."ssl"); |
11590
5aafb832c91b
core.portmanager: Fix race condition in initialization of SNI cert map
Kim Alvefur <zash@zash.se>
parents:
11536
diff
changeset
|
240 local alternate_host = name and config.get(host, name.."_host"); |
5aafb832c91b
core.portmanager: Fix race condition in initialization of SNI cert map
Kim Alvefur <zash@zash.se>
parents:
11536
diff
changeset
|
241 if not alternate_host and name == "https" then |
11536
fb9bd9fa4356
core.portmanager: Use existing http_host for https SNI mapping
Kim Alvefur <zash@zash.se>
parents:
11535
diff
changeset
|
242 -- TODO should this be some generic thing? e.g. in the service definition |
fb9bd9fa4356
core.portmanager: Use existing http_host for https SNI mapping
Kim Alvefur <zash@zash.se>
parents:
11535
diff
changeset
|
243 alternate_host = config.get(host, "http_host"); |
fb9bd9fa4356
core.portmanager: Use existing http_host for https SNI mapping
Kim Alvefur <zash@zash.se>
parents:
11535
diff
changeset
|
244 end |
11535
180c5951e7e4
core.portmanager: Allow overriding expected SNI name per service
Kim Alvefur <zash@zash.se>
parents:
11412
diff
changeset
|
245 local autocert = certmanager.find_host_cert(alternate_host or host); |
10538
71b82567245c
core.portmanager: Ignore unused return variable [luacheck]
Kim Alvefur <zash@zash.se>
parents:
10468
diff
changeset
|
246 -- luacheck: ignore 211/cfg |
10463
fbeb7a3fc4eb
core.portmanager: Fix TLS context inheritance for SNI hosts (completes SNI support)
Kim Alvefur <zash@zash.se>
parents:
10462
diff
changeset
|
247 local ssl, err, cfg = certmanager.create_context(host, "server", prefix_ssl_config, autocert, active_service.tls_cfg); |
9849
70e56f126177
core.portmanager: Collect per-host certificates for SNI
Kim Alvefur <zash@zash.se>
parents:
9848
diff
changeset
|
248 if ssl then |
11535
180c5951e7e4
core.portmanager: Allow overriding expected SNI name per service
Kim Alvefur <zash@zash.se>
parents:
11412
diff
changeset
|
249 active_service.server.hosts[alternate_host or host] = ssl; |
9849
70e56f126177
core.portmanager: Collect per-host certificates for SNI
Kim Alvefur <zash@zash.se>
parents:
9848
diff
changeset
|
250 else |
10468
7341d2f4749a
core.portmanager: Complete error message for SNI TLS context problems
Kim Alvefur <zash@zash.se>
parents:
10463
diff
changeset
|
251 log("error", "Error creating TLS context for SNI host %s: %s", host, err); |
9849
70e56f126177
core.portmanager: Collect per-host certificates for SNI
Kim Alvefur <zash@zash.se>
parents:
9848
diff
changeset
|
252 end |
70e56f126177
core.portmanager: Collect per-host certificates for SNI
Kim Alvefur <zash@zash.se>
parents:
9848
diff
changeset
|
253 end |
70e56f126177
core.portmanager: Collect per-host certificates for SNI
Kim Alvefur <zash@zash.se>
parents:
9848
diff
changeset
|
254 end |
70e56f126177
core.portmanager: Collect per-host certificates for SNI
Kim Alvefur <zash@zash.se>
parents:
9848
diff
changeset
|
255 end |
6779
6236668da30a
core.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents:
6688
diff
changeset
|
256 prosody.events.add_handler("item-added/net-provider", function (event) |
6236668da30a
core.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents:
6688
diff
changeset
|
257 local item = event.item; |
6236668da30a
core.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents:
6688
diff
changeset
|
258 register_service(item.name, item); |
9849
70e56f126177
core.portmanager: Collect per-host certificates for SNI
Kim Alvefur <zash@zash.se>
parents:
9848
diff
changeset
|
259 for host in pairs(prosody.hosts) do |
70e56f126177
core.portmanager: Collect per-host certificates for SNI
Kim Alvefur <zash@zash.se>
parents:
9848
diff
changeset
|
260 add_sni_host(host, item.name); |
70e56f126177
core.portmanager: Collect per-host certificates for SNI
Kim Alvefur <zash@zash.se>
parents:
9848
diff
changeset
|
261 end |
6779
6236668da30a
core.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents:
6688
diff
changeset
|
262 end); |
6236668da30a
core.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents:
6688
diff
changeset
|
263 prosody.events.add_handler("item-removed/net-provider", function (event) |
6236668da30a
core.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents:
6688
diff
changeset
|
264 local item = event.item; |
6236668da30a
core.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents:
6688
diff
changeset
|
265 unregister_service(item.name, item); |
6236668da30a
core.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents:
6688
diff
changeset
|
266 end); |
6236668da30a
core.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents:
6688
diff
changeset
|
267 |
9849
70e56f126177
core.portmanager: Collect per-host certificates for SNI
Kim Alvefur <zash@zash.se>
parents:
9848
diff
changeset
|
268 prosody.events.add_handler("host-activated", add_sni_host); |
70e56f126177
core.portmanager: Collect per-host certificates for SNI
Kim Alvefur <zash@zash.se>
parents:
9848
diff
changeset
|
269 prosody.events.add_handler("host-deactivated", function (host) |
70e56f126177
core.portmanager: Collect per-host certificates for SNI
Kim Alvefur <zash@zash.se>
parents:
9848
diff
changeset
|
270 for name, interface, port, n, active_service --luacheck: ignore 213 |
70e56f126177
core.portmanager: Collect per-host certificates for SNI
Kim Alvefur <zash@zash.se>
parents:
9848
diff
changeset
|
271 in active_services:iter(nil, nil, nil, nil) do |
70e56f126177
core.portmanager: Collect per-host certificates for SNI
Kim Alvefur <zash@zash.se>
parents:
9848
diff
changeset
|
272 if active_service.tls_cfg then |
70e56f126177
core.portmanager: Collect per-host certificates for SNI
Kim Alvefur <zash@zash.se>
parents:
9848
diff
changeset
|
273 active_service.server.hosts[host] = nil; |
70e56f126177
core.portmanager: Collect per-host certificates for SNI
Kim Alvefur <zash@zash.se>
parents:
9848
diff
changeset
|
274 end |
70e56f126177
core.portmanager: Collect per-host certificates for SNI
Kim Alvefur <zash@zash.se>
parents:
9848
diff
changeset
|
275 end |
70e56f126177
core.portmanager: Collect per-host certificates for SNI
Kim Alvefur <zash@zash.se>
parents:
9848
diff
changeset
|
276 end); |
70e56f126177
core.portmanager: Collect per-host certificates for SNI
Kim Alvefur <zash@zash.se>
parents:
9848
diff
changeset
|
277 |
6779
6236668da30a
core.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents:
6688
diff
changeset
|
278 return { |
6236668da30a
core.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents:
6688
diff
changeset
|
279 activate = activate; |
6236668da30a
core.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents:
6688
diff
changeset
|
280 deactivate = deactivate; |
6236668da30a
core.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents:
6688
diff
changeset
|
281 register_service = register_service; |
6236668da30a
core.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents:
6688
diff
changeset
|
282 unregister_service = unregister_service; |
6236668da30a
core.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents:
6688
diff
changeset
|
283 close = close; |
6236668da30a
core.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents:
6688
diff
changeset
|
284 get_service_at = get_service_at; |
6236668da30a
core.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents:
6688
diff
changeset
|
285 get_service = get_service; |
6236668da30a
core.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents:
6688
diff
changeset
|
286 get_active_services = get_active_services; |
6236668da30a
core.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents:
6688
diff
changeset
|
287 get_registered_services = get_registered_services; |
6236668da30a
core.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents:
6688
diff
changeset
|
288 }; |