prosody
82705ec87253
util/sslconfig.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Annotate

util/sslconfig.lua @ 10390:82705ec87253 0.11

util.startup: Ensure prosody.paths are absolute (see #1430) Normally these paths are injected into the installed 'prosody' executable as absolute paths, but it is possible to override at least the config path via environment variable or command line argument. This makes sure a path relative to pwd stays relative to that instead of the data directory.
author Kim Alvefur <zash@zash.se>
date Mon, 04 Nov 2019 00:29:49 +0100
parent 9584:2860f8dabf35
child 10920:c171b4c59bd1
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
7004
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
1 -- util to easily merge multiple sets of LuaSec context options
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
2
6777
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6671
diff changeset
3 local type = type;
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6671
diff changeset
4 local pairs = pairs;
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6671
diff changeset
5 local rawset = rawset;
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6671
diff changeset
6 local t_concat = table.concat;
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6671
diff changeset
7 local t_insert = table.insert;
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6671
diff changeset
8 local setmetatable = setmetatable;
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6671
diff changeset
9
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 6671
diff changeset
10 local _ENV = nil;
8555
4f0f5b49bb03 vairious: Add annotation when an empty environment is set [luacheck]
Kim Alvefur <zash@zash.se>
parents: 8278
diff changeset
11 -- luacheck: std none
6292
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
12
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
13 local handlers = { };
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
14 local finalisers = { };
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
15 local id = function (v) return v end
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
16
7004
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
17 -- All "handlers" behave like extended rawset(table, key, value) with extra
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
18 -- processing usually merging the new value with the old in some reasonable
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
19 -- way
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
20 -- If a field does not have a defined handler then a new value simply
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
21 -- replaces the old.
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
22
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
23
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
24 -- Convert either a list or a set into a special type of set where each
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
25 -- item is either positive or negative in order for a later set of options
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
26 -- to be able to remove options from this set by filtering out the negative ones
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
27 function handlers.options(config, field, new)
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
28 local options = config[field] or { };
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
29 if type(new) ~= "table" then new = { new } end
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
30 for key, value in pairs(new) do
6671
2d5e2ed44c22 util.sslconfig: Rename variable to avoid name clash [luacheck]
Matthew Wild <mwild1@gmail.com>
parents: 6292
diff changeset
31 if value == true or value == false then
7004
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
32 options[key] = value;
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
33 else -- list item
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
34 options[value] = true;
6292
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
35 end
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
36 end
7004
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
37 config[field] = options;
6292
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
38 end
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
39
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
40 handlers.verifyext = handlers.options;
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
41
7004
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
42 -- finalisers take something produced by handlers and return what luasec
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
43 -- expects it to be
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
44
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
45 -- Produce a list of "positive" options from the set
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
46 function finalisers.options(options)
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
47 local output = {};
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
48 for opt, enable in pairs(options) do
6292
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
49 if enable then
7004
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
50 output[#output+1] = opt;
6292
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
51 end
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
52 end
7004
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
53 return output;
6292
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
54 end
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
55
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
56 finalisers.verifyext = finalisers.options;
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
57
7004
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
58 -- We allow ciphers to be a list
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
59
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
60 function finalisers.ciphers(cipherlist)
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
61 if type(cipherlist) == "table" then
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
62 return t_concat(cipherlist, ":");
6292
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
63 end
7004
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
64 return cipherlist;
6292
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
65 end
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
66
8278
a349299038ff util.sslconfig: Treat 'curveslist', added in LuaSec 0.7, as a colon-separated list, like ciphers (see #879, #943, #951)
Kim Alvefur <zash@zash.se>
parents: 7867
diff changeset
67 -- Curve list too
a349299038ff util.sslconfig: Treat 'curveslist', added in LuaSec 0.7, as a colon-separated list, like ciphers (see #879, #943, #951)
Kim Alvefur <zash@zash.se>
parents: 7867
diff changeset
68 finalisers.curveslist = finalisers.ciphers;
a349299038ff util.sslconfig: Treat 'curveslist', added in LuaSec 0.7, as a colon-separated list, like ciphers (see #879, #943, #951)
Kim Alvefur <zash@zash.se>
parents: 7867
diff changeset
69
7004
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
70 -- protocol = "x" should enable only that protocol
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
71 -- protocol = "x+" should enable x and later versions
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
72
9584
2860f8dabf35 util.sslconfig: Recognise TLS 1.3 as a protocol version
Kim Alvefur <zash@zash.se>
parents: 8555
diff changeset
73 local protocols = { "sslv2", "sslv3", "tlsv1", "tlsv1_1", "tlsv1_2", "tlsv1_3" };
6292
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
74 for i = 1, #protocols do protocols[protocols[i] .. "+"] = i - 1; end
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
75
7004
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
76 -- this interacts with ssl.options as well to add no_x
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
77 local function protocol(config)
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
78 local min_protocol = protocols[config.protocol];
6292
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
79 if min_protocol then
7004
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
80 config.protocol = "sslv23";
6292
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
81 for i = 1, min_protocol do
7004
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
82 t_insert(config.options, "no_"..protocols[i]);
6292
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
83 end
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
84 end
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
85 end
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
86
7004
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
87 -- Merge options from 'new' config into 'config'
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
88 local function apply(config, new)
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
89 if type(new) == "table" then
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
90 for field, value in pairs(new) do
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
91 (handlers[field] or rawset)(config, field, value);
6292
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
92 end
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
93 end
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
94 end
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
95
7004
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
96 -- Finalize the config into the form LuaSec expects
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
97 local function final(config)
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
98 local output = { };
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
99 for field, value in pairs(config) do
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
100 output[field] = (finalisers[field] or id)(value);
6292
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
101 end
7004
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
102 -- Need to handle protocols last because it adds to the options list
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
103 protocol(output);
ddb03cc4ce04 util.sslconfig: More descriptive variable names and also comments
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
104 return output;
6292
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
105 end
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
106
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
107 local sslopts_mt = {
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
108 __index = {
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
109 apply = apply;
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
110 final = final;
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
111 };
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
112 };
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
113
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
114 local function new()
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
115 return setmetatable({options={}}, sslopts_mt);
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
116 end
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
117
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
118 return {
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
119 apply = apply;
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
120 final = final;
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
121 new = new;
751618071e89 util.sslconfig: Add lib to deal with LuaSec SSL context configs
Kim Alvefur <zash@zash.se>
parents:
diff changeset
122 };