Software `/` code `/` prosody

Annotate

util/sslconfig.lua @ 12181:783056b4e448 0.11 0.11.12

util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.

author	Jonas Schäfer <jonas@wielicki.name>
date	Mon, 10 Jan 2022 18:23:54 +0100
parent	9584:2860f8dabf35
child	10920:c171b4c59bd1

rev	line source
7004 ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	1 -- util to easily merge multiple sets of LuaSec context options
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	2
6777 5de6b93d0190 util.: Remove use of module() function, make all module functions local and return them in a table at the end Kim Alvefur <zash@zash.se>* parents: 6671 diff changeset	3 local type = type;
5de6b93d0190 util.: Remove use of module() function, make all module functions local and return them in a table at the end Kim Alvefur <zash@zash.se>* parents: 6671 diff changeset	4 local pairs = pairs;
5de6b93d0190 util.: Remove use of module() function, make all module functions local and return them in a table at the end Kim Alvefur <zash@zash.se>* parents: 6671 diff changeset	5 local rawset = rawset;
5de6b93d0190 util.: Remove use of module() function, make all module functions local and return them in a table at the end Kim Alvefur <zash@zash.se>* parents: 6671 diff changeset	6 local t_concat = table.concat;
5de6b93d0190 util.: Remove use of module() function, make all module functions local and return them in a table at the end Kim Alvefur <zash@zash.se>* parents: 6671 diff changeset	7 local t_insert = table.insert;
5de6b93d0190 util.: Remove use of module() function, make all module functions local and return them in a table at the end Kim Alvefur <zash@zash.se>* parents: 6671 diff changeset	8 local setmetatable = setmetatable;
5de6b93d0190 util.: Remove use of module() function, make all module functions local and return them in a table at the end Kim Alvefur <zash@zash.se>* parents: 6671 diff changeset	9
5de6b93d0190 util.: Remove use of module() function, make all module functions local and return them in a table at the end Kim Alvefur <zash@zash.se>* parents: 6671 diff changeset	10 local _ENV = nil;
8555 4f0f5b49bb03 vairious: Add annotation when an empty environment is set [luacheck] Kim Alvefur <zash@zash.se> parents: 8278 diff changeset	11 -- luacheck: std none
6292 751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	12
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	13 local handlers = { };
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	14 local finalisers = { };
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	15 local id = function (v) return v end
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	16
7004 ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	17 -- All "handlers" behave like extended rawset(table, key, value) with extra
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	18 -- processing usually merging the new value with the old in some reasonable
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	19 -- way
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	20 -- If a field does not have a defined handler then a new value simply
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	21 -- replaces the old.
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	22
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	23
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	24 -- Convert either a list or a set into a special type of set where each
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	25 -- item is either positive or negative in order for a later set of options
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	26 -- to be able to remove options from this set by filtering out the negative ones
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	27 function handlers.options(config, field, new)
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	28 local options = config[field] or { };
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	29 if type(new) ~= "table" then new = { new } end
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	30 for key, value in pairs(new) do
6671 2d5e2ed44c22 util.sslconfig: Rename variable to avoid name clash [luacheck] Matthew Wild <mwild1@gmail.com> parents: 6292 diff changeset	31 if value == true or value == false then
7004 ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	32 options[key] = value;
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	33 else -- list item
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	34 options[value] = true;
6292 751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	35 end
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	36 end
7004 ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	37 config[field] = options;
6292 751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	38 end
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	39
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	40 handlers.verifyext = handlers.options;
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	41
7004 ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	42 -- finalisers take something produced by handlers and return what luasec
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	43 -- expects it to be
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	44
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	45 -- Produce a list of "positive" options from the set
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	46 function finalisers.options(options)
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	47 local output = {};
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	48 for opt, enable in pairs(options) do
6292 751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	49 if enable then
7004 ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	50 output[#output+1] = opt;
6292 751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	51 end
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	52 end
7004 ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	53 return output;
6292 751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	54 end
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	55
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	56 finalisers.verifyext = finalisers.options;
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	57
7004 ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	58 -- We allow ciphers to be a list
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	59
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	60 function finalisers.ciphers(cipherlist)
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	61 if type(cipherlist) == "table" then
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	62 return t_concat(cipherlist, ":");
6292 751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	63 end
7004 ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	64 return cipherlist;
6292 751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	65 end
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	66
8278 a349299038ff util.sslconfig: Treat 'curveslist', added in LuaSec 0.7, as a colon-separated list, like ciphers (see #879, #943, #951) Kim Alvefur <zash@zash.se> parents: 7867 diff changeset	67 -- Curve list too
a349299038ff util.sslconfig: Treat 'curveslist', added in LuaSec 0.7, as a colon-separated list, like ciphers (see #879, #943, #951) Kim Alvefur <zash@zash.se> parents: 7867 diff changeset	68 finalisers.curveslist = finalisers.ciphers;
a349299038ff util.sslconfig: Treat 'curveslist', added in LuaSec 0.7, as a colon-separated list, like ciphers (see #879, #943, #951) Kim Alvefur <zash@zash.se> parents: 7867 diff changeset	69
7004 ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	70 -- protocol = "x" should enable only that protocol
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	71 -- protocol = "x+" should enable x and later versions
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	72
9584 2860f8dabf35 util.sslconfig: Recognise TLS 1.3 as a protocol version Kim Alvefur <zash@zash.se> parents: 8555 diff changeset	73 local protocols = { "sslv2", "sslv3", "tlsv1", "tlsv1_1", "tlsv1_2", "tlsv1_3" };
6292 751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	74 for i = 1, #protocols do protocols[protocols[i] .. "+"] = i - 1; end
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	75
7004 ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	76 -- this interacts with ssl.options as well to add no_x
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	77 local function protocol(config)
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	78 local min_protocol = protocols[config.protocol];
6292 751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	79 if min_protocol then
7004 ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	80 config.protocol = "sslv23";
6292 751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	81 for i = 1, min_protocol do
7004 ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	82 t_insert(config.options, "no_"..protocols[i]);
6292 751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	83 end
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	84 end
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	85 end
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	86
7004 ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	87 -- Merge options from 'new' config into 'config'
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	88 local function apply(config, new)
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	89 if type(new) == "table" then
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	90 for field, value in pairs(new) do
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	91 (handlers[field] or rawset)(config, field, value);
6292 751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	92 end
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	93 end
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	94 end
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	95
7004 ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	96 -- Finalize the config into the form LuaSec expects
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	97 local function final(config)
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	98 local output = { };
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	99 for field, value in pairs(config) do
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	100 output[field] = (finalisers[field] or id)(value);
6292 751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	101 end
7004 ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	102 -- Need to handle protocols last because it adds to the options list
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	103 protocol(output);
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments Kim Alvefur <zash@zash.se> parents: 6777 diff changeset	104 return output;
6292 751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	105 end
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	106
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	107 local sslopts_mt = {
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	108 __index = {
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	109 apply = apply;
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	110 final = final;
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	111 };
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	112 };
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	113
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	114 local function new()
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	115 return setmetatable({options={}}, sslopts_mt);
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	116 end
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	117
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	118 return {
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	119 apply = apply;
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	120 final = final;
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	121 new = new;
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs Kim Alvefur <zash@zash.se> parents: diff changeset	122 };

prosody

783056b4e448

util/sslconfig.lua

Software / code / prosody

Annotate

util/sslconfig.lua @ 12181:783056b4e448 0.11 0.11.12

Software `/` code `/` prosody