Software `/` code `/` prosody

Annotate

plugins/mod_tls.lua @ 13073:9e5802b45b9e

mod_tokenauth: Only check if expiry of expiring tokens Some tokens, e.g. OAuth2 refresh tokens, might not have their lifetime explicitly bounded here, but rather be bounded by the lifetime of something else, like the OAuth2 client. Open question: Would it be better to enforce a lifetime on all tokens?

author	Kim Alvefur <zash@zash.se>
date	Wed, 12 Apr 2023 10:21:32 +0200
parent	12977:74b9e05af71e
child	13076:f4e33d17eaa8

rev	line source
1523 841d61be198f Remove version number from copyright headers Matthew Wild <mwild1@gmail.com> parents: 1219 diff changeset	1 -- Prosody IM
2923 b7049746bd29 Update copyright headers for 2010 Matthew Wild <mwild1@gmail.com> parents: 2877 diff changeset	2 -- Copyright (C) 2008-2010 Matthew Wild
b7049746bd29 Update copyright headers for 2010 Matthew Wild <mwild1@gmail.com> parents: 2877 diff changeset	3 -- Copyright (C) 2008-2010 Waqas Hussain
5776 bd0ff8ae98a8 Remove all trailing whitespace Florian Zeitz <florob@babelmonkeys.de> parents: 5698 diff changeset	4 --
758 b1885732e979 GPL->MIT! Matthew Wild <mwild1@gmail.com> parents: 705 diff changeset	5 -- This project is MIT/X11 licensed. Please see the
b1885732e979 GPL->MIT! Matthew Wild <mwild1@gmail.com> parents: 705 diff changeset	6 -- COPYING file in the source package for more information.
519 cccd610a0ef9 Insert copyright/license headers Matthew Wild <mwild1@gmail.com> parents: 438 diff changeset	7 --
cccd610a0ef9 Insert copyright/license headers Matthew Wild <mwild1@gmail.com> parents: 438 diff changeset	8
12977 74b9e05af71e plugins: Prefix module imports with prosody namespace Kim Alvefur <zash@zash.se> parents: 12602 diff changeset	9 local create_context = require "prosody.core.certmanager".create_context;
74b9e05af71e plugins: Prefix module imports with prosody namespace Kim Alvefur <zash@zash.se> parents: 12602 diff changeset	10 local rawgetopt = require"prosody.core.configmanager".rawget;
74b9e05af71e plugins: Prefix module imports with prosody namespace Kim Alvefur <zash@zash.se> parents: 12602 diff changeset	11 local st = require "prosody.util.stanza";
99 ba08b8a4eeef Abstract connections with "connection listeners" Matthew Wild <mwild1@gmail.com> parents: 69 diff changeset	12
12330 38b5b05407be various: Require encryption by default for real Kim Alvefur <zash@zash.se> parents: 12211 diff changeset	13 local c2s_require_encryption = module:get_option("c2s_require_encryption", module:get_option("require_encryption", true));
38b5b05407be various: Require encryption by default for real Kim Alvefur <zash@zash.se> parents: 12211 diff changeset	14 local s2s_require_encryption = module:get_option("s2s_require_encryption", true);
2933 e68ff49fa79b Merge 0.6->0.7 Matthew Wild <mwild1@gmail.com> parents: 2925 2932 diff changeset	15 local allow_s2s_tls = module:get_option("s2s_allow_encryption") ~= false;
5988 177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ Kim Alvefur <zash@zash.se> parents: 5987 diff changeset	16 local s2s_secure_auth = module:get_option("s2s_secure_auth");
177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ Kim Alvefur <zash@zash.se> parents: 5987 diff changeset	17
177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ Kim Alvefur <zash@zash.se> parents: 5987 diff changeset	18 if s2s_secure_auth and s2s_require_encryption == false then
177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ Kim Alvefur <zash@zash.se> parents: 5987 diff changeset	19 module:log("warn", "s2s_secure_auth implies s2s_require_encryption, but s2s_require_encryption is set to false");
177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ Kim Alvefur <zash@zash.se> parents: 5987 diff changeset	20 s2s_require_encryption = true;
177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ Kim Alvefur <zash@zash.se> parents: 5987 diff changeset	21 end
1219 f14e08a0ae7f mod_tls: Add <required/> to stream feature when TLS is required Matthew Wild <mwild1@gmail.com> parents: 1213 diff changeset	22
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	23 local xmlns_starttls = 'urn:ietf:params:xml:ns:xmpp-tls';
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	24 local starttls_attr = { xmlns = xmlns_starttls };
6709 b6eff3ba13de mod_tls: Build <starttls/> as a stanza instead of with string concatenation Kim Alvefur <zash@zash.se> parents: 6526 diff changeset	25 local starttls_initiate= st.stanza("starttls", starttls_attr);
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	26 local starttls_proceed = st.stanza("proceed", starttls_attr);
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	27 local starttls_failure = st.stanza("failure", starttls_attr);
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	28 local c2s_feature = st.stanza("starttls", starttls_attr);
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	29 local s2s_feature = st.stanza("starttls", starttls_attr);
5987 bd90250ee1ee mod_tls: Rename variables to be less confusing Kim Alvefur <zash@zash.se> parents: 5976 diff changeset	30 if c2s_require_encryption then c2s_feature:tag("required"):up(); end
bd90250ee1ee mod_tls: Rename variables to be less confusing Kim Alvefur <zash@zash.se> parents: 5976 diff changeset	31 if s2s_require_encryption then s2s_feature:tag("required"):up(); end
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	32
5370 7838acadb0fa mod_announce, mod_auth_anonymous, mod_c2s, mod_c2s, mod_component, mod_iq, mod_message, mod_presence, mod_tls: Access prosody.{hosts,bare_sessions,full_sessions} instead of the old globals Kim Alvefur <zash@zash.se> parents: 4475 diff changeset	33 local hosts = prosody.hosts;
2872 cdc292d201fc mod_tls: Don't offer TLS on hosts that don't have any certs Matthew Wild <mwild1@gmail.com> parents: 2854 diff changeset	34 local host = hosts[module.host];
cdc292d201fc mod_tls: Don't offer TLS on hosts that don't have any certs Matthew Wild <mwild1@gmail.com> parents: 2854 diff changeset	35
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	36 local ssl_ctx_c2s, ssl_ctx_s2sout, ssl_ctx_s2sin;
6521 29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions Kim Alvefur <zash@zash.se> parents: 6487 diff changeset	37 local ssl_cfg_c2s, ssl_cfg_s2sout, ssl_cfg_s2sin;
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	38 local err_c2s, err_s2sin, err_s2sout;
8131 c8e3a0caa0a9 mod_tls: Rebuild SSL context objects on configuration reload - #701 Kim Alvefur <zash@zash.se> parents: 7959 diff changeset	39
10783 950082c1669e mod_tls: Log when certificates are (re)loaded Kim Alvefur <zash@zash.se> parents: 9971 diff changeset	40 function module.load(reload)
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	41 local NULL = {};
6832 9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	42 local modhost = module.host;
9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	43 local parent = modhost:match("%.(.*)$");
6296 66fb7b7c668d mod_tls: Simplify and use new ssl config merging in certmanager Kim Alvefur <zash@zash.se> parents: 5993 diff changeset	44
6832 9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	45 local parent_ssl = rawgetopt(parent, "ssl") or NULL;
9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	46 local host_ssl = rawgetopt(modhost, "ssl") or parent_ssl;
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	47
6832 9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	48 local global_c2s = rawgetopt("*", "c2s_ssl") or NULL;
9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	49 local parent_c2s = rawgetopt(parent, "c2s_ssl") or NULL;
6919 ab6c57633ce5 mod_tls: Fix ssl option fallback to a "parent" host if current host does not have ssl options set (thanks 70b1) Kim Alvefur <zash@zash.se> parents: 6918 diff changeset	50 local host_c2s = rawgetopt(modhost, "c2s_ssl") or parent_c2s;
6296 66fb7b7c668d mod_tls: Simplify and use new ssl config merging in certmanager Kim Alvefur <zash@zash.se> parents: 5993 diff changeset	51
6832 9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	52 local global_s2s = rawgetopt("*", "s2s_ssl") or NULL;
9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	53 local parent_s2s = rawgetopt(parent, "s2s_ssl") or NULL;
6919 ab6c57633ce5 mod_tls: Fix ssl option fallback to a "parent" host if current host does not have ssl options set (thanks 70b1) Kim Alvefur <zash@zash.se> parents: 6918 diff changeset	54 local host_s2s = rawgetopt(modhost, "s2s_ssl") or parent_s2s;
6296 66fb7b7c668d mod_tls: Simplify and use new ssl config merging in certmanager Kim Alvefur <zash@zash.se> parents: 5993 diff changeset	55
9971 5b048ccd106f mod_tls: Log debug message for each kind of TLS context created Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	56 module:log("debug", "Creating context for c2s");
9854 115b5e32d960 mod_tls: Restore querying for certificates on s2s Kim Alvefur <zash@zash.se> parents: 9740 diff changeset	57 local request_client_certs = { verify = { "peer", "client_once", }; };
12211 5c2ae28f536e mod_tls: Set ALPN on outgoing connections Kim Alvefur <zash@zash.se> parents: 12207 diff changeset	58 local xmpp_alpn = { alpn = "xmpp-server" };
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	59
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	60 ssl_ctx_c2s, err_c2s, ssl_cfg_c2s = create_context(host.host, "server", host_c2s, host_ssl, global_c2s); -- for incoming client connections
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	61 if not ssl_ctx_c2s then module:log("error", "Error creating context for c2s: %s", err_c2s); end
6521 29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions Kim Alvefur <zash@zash.se> parents: 6487 diff changeset	62
11530 a90389e7296c mod_tls: Fix order of debug messages and tls context creation Kim Alvefur <zash@zash.se> parents: 11519 diff changeset	63 module:log("debug", "Creating context for s2sout");
9854 115b5e32d960 mod_tls: Restore querying for certificates on s2s Kim Alvefur <zash@zash.se> parents: 9740 diff changeset	64 -- for outgoing server connections
12211 5c2ae28f536e mod_tls: Set ALPN on outgoing connections Kim Alvefur <zash@zash.se> parents: 12207 diff changeset	65 ssl_ctx_s2sout, err_s2sout, ssl_cfg_s2sout = create_context(host.host, "client", host_s2s, host_ssl, global_s2s, request_client_certs, xmpp_alpn);
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	66 if not ssl_ctx_s2sout then module:log("error", "Error creating contexts for s2sout: %s", err_s2sout); end
6521 29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions Kim Alvefur <zash@zash.se> parents: 6487 diff changeset	67
11530 a90389e7296c mod_tls: Fix order of debug messages and tls context creation Kim Alvefur <zash@zash.se> parents: 11519 diff changeset	68 module:log("debug", "Creating context for s2sin");
9854 115b5e32d960 mod_tls: Restore querying for certificates on s2s Kim Alvefur <zash@zash.se> parents: 9740 diff changeset	69 -- for incoming server connections
115b5e32d960 mod_tls: Restore querying for certificates on s2s Kim Alvefur <zash@zash.se> parents: 9740 diff changeset	70 ssl_ctx_s2sin, err_s2sin, ssl_cfg_s2sin = create_context(host.host, "server", host_s2s, host_ssl, global_s2s, request_client_certs);
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	71 if not ssl_ctx_s2sin then module:log("error", "Error creating contexts for s2sin: %s", err_s2sin); end
10783 950082c1669e mod_tls: Log when certificates are (re)loaded Kim Alvefur <zash@zash.se> parents: 9971 diff changeset	72
950082c1669e mod_tls: Log when certificates are (re)loaded Kim Alvefur <zash@zash.se> parents: 9971 diff changeset	73 if reload then
950082c1669e mod_tls: Log when certificates are (re)loaded Kim Alvefur <zash@zash.se> parents: 9971 diff changeset	74 module:log("info", "Certificates reloaded");
950082c1669e mod_tls: Log when certificates are (re)loaded Kim Alvefur <zash@zash.se> parents: 9971 diff changeset	75 else
950082c1669e mod_tls: Log when certificates are (re)loaded Kim Alvefur <zash@zash.se> parents: 9971 diff changeset	76 module:log("info", "Certificates loaded");
950082c1669e mod_tls: Log when certificates are (re)loaded Kim Alvefur <zash@zash.se> parents: 9971 diff changeset	77 end
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	78 end
f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	79
8131 c8e3a0caa0a9 mod_tls: Rebuild SSL context objects on configuration reload - #701 Kim Alvefur <zash@zash.se> parents: 7959 diff changeset	80 module:hook_global("config-reloaded", module.load);
c8e3a0caa0a9 mod_tls: Rebuild SSL context objects on configuration reload - #701 Kim Alvefur <zash@zash.se> parents: 7959 diff changeset	81
2625 03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection Matthew Wild <mwild1@gmail.com> parents: 2623 diff changeset	82 local function can_do_tls(session)
12482 b193f8a2737e mod_tls: Do not offer TLS if the connection is considered secure Jonas Schäfer <jonas@wielicki.name> parents: 12330 diff changeset	83 if session.secure then
b193f8a2737e mod_tls: Do not offer TLS if the connection is considered secure Jonas Schäfer <jonas@wielicki.name> parents: 12330 diff changeset	84 return false;
b193f8a2737e mod_tls: Do not offer TLS if the connection is considered secure Jonas Schäfer <jonas@wielicki.name> parents: 12330 diff changeset	85 end
12207 65e252940337 mod_s2s: Retrieve TLS context for outgoing Direct TLS connections from mod_tls Kim Alvefur <zash@zash.se> parents: 11766 diff changeset	86 if session.conn and not session.conn.starttls then
7913 64daa21450f9 mod_tls: Suppress debug message if already using encryption Kim Alvefur <zash@zash.se> parents: 7898 diff changeset	87 if not session.secure then
64daa21450f9 mod_tls: Suppress debug message if already using encryption Kim Alvefur <zash@zash.se> parents: 7898 diff changeset	88 session.log("debug", "Underlying connection does not support STARTTLS");
64daa21450f9 mod_tls: Suppress debug message if already using encryption Kim Alvefur <zash@zash.se> parents: 7898 diff changeset	89 end
7869 eb5fba4c8074 mod_tls: Check that connection has starttls method first to prevent offering starttls over tls (thanks Remko and Tobias) Kim Alvefur <zash@zash.se> parents: 7864 diff changeset	90 return false;
eb5fba4c8074 mod_tls: Check that connection has starttls method first to prevent offering starttls over tls (thanks Remko and Tobias) Kim Alvefur <zash@zash.se> parents: 7864 diff changeset	91 elseif session.ssl_ctx ~= nil then
7864 7ece186a44d3 mod_tls: Return session.ssl_ctx if not nil, like when doing the full session type check Kim Alvefur <zash@zash.se> parents: 7863 diff changeset	92 return session.ssl_ctx;
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	93 end
2625 03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection Matthew Wild <mwild1@gmail.com> parents: 2623 diff changeset	94 if session.type == "c2s_unauthed" then
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	95 if not ssl_ctx_c2s and c2s_require_encryption then
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	96 session.log("error", "No TLS context available for c2s. Earlier error was: %s", err_c2s);
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	97 end
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	98 session.ssl_ctx = ssl_ctx_c2s;
6521 29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions Kim Alvefur <zash@zash.se> parents: 6487 diff changeset	99 session.ssl_cfg = ssl_cfg_c2s;
2933 e68ff49fa79b Merge 0.6->0.7 Matthew Wild <mwild1@gmail.com> parents: 2925 2932 diff changeset	100 elseif session.type == "s2sin_unauthed" and allow_s2s_tls then
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	101 if not ssl_ctx_s2sin and s2s_require_encryption then
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	102 session.log("error", "No TLS context available for s2sin. Earlier error was: %s", err_s2sin);
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	103 end
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	104 session.ssl_ctx = ssl_ctx_s2sin;
6521 29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions Kim Alvefur <zash@zash.se> parents: 6487 diff changeset	105 session.ssl_cfg = ssl_cfg_s2sin;
2933 e68ff49fa79b Merge 0.6->0.7 Matthew Wild <mwild1@gmail.com> parents: 2925 2932 diff changeset	106 elseif session.direction == "outgoing" and allow_s2s_tls then
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	107 if not ssl_ctx_s2sout and s2s_require_encryption then
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	108 session.log("error", "No TLS context available for s2sout. Earlier error was: %s", err_s2sout);
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	109 end
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	110 session.ssl_ctx = ssl_ctx_s2sout;
6521 29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions Kim Alvefur <zash@zash.se> parents: 6487 diff changeset	111 session.ssl_cfg = ssl_cfg_s2sout;
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	112 else
7898 d8029b2e0f43 mod_tls: Log reasons for not being able to do TLS Kim Alvefur <zash@zash.se> parents: 7869 diff changeset	113 session.log("debug", "Unknown session type, don't know which TLS context to use");
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	114 return false;
2625 03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection Matthew Wild <mwild1@gmail.com> parents: 2623 diff changeset	115 end
7863 a634fe3c21f2 mod_tls: Add debug logging for when TLS should be doable but no ssl context was set Kim Alvefur <zash@zash.se> parents: 7834 diff changeset	116 if not session.ssl_ctx then
a634fe3c21f2 mod_tls: Add debug logging for when TLS should be doable but no ssl context was set Kim Alvefur <zash@zash.se> parents: 7834 diff changeset	117 session.log("debug", "Should be able to do TLS but no context available");
a634fe3c21f2 mod_tls: Add debug logging for when TLS should be doable but no ssl context was set Kim Alvefur <zash@zash.se> parents: 7834 diff changeset	118 return false;
a634fe3c21f2 mod_tls: Add debug logging for when TLS should be doable but no ssl context was set Kim Alvefur <zash@zash.se> parents: 7834 diff changeset	119 end
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	120 return session.ssl_ctx;
2932 d2816fb6c7ea mod_tls: Add s2s_allow_encryption option which, when set to false, disabled TLS for s2s Matthew Wild <mwild1@gmail.com> parents: 2923 diff changeset	121 end
d2816fb6c7ea mod_tls: Add s2s_allow_encryption option which, when set to false, disabled TLS for s2s Matthew Wild <mwild1@gmail.com> parents: 2923 diff changeset	122
12207 65e252940337 mod_s2s: Retrieve TLS context for outgoing Direct TLS connections from mod_tls Kim Alvefur <zash@zash.se> parents: 11766 diff changeset	123 module:hook("s2sout-created", function (event)
65e252940337 mod_s2s: Retrieve TLS context for outgoing Direct TLS connections from mod_tls Kim Alvefur <zash@zash.se> parents: 11766 diff changeset	124 -- Initialize TLS context for outgoing connections
65e252940337 mod_s2s: Retrieve TLS context for outgoing Direct TLS connections from mod_tls Kim Alvefur <zash@zash.se> parents: 11766 diff changeset	125 can_do_tls(event.session);
65e252940337 mod_s2s: Retrieve TLS context for outgoing Direct TLS connections from mod_tls Kim Alvefur <zash@zash.se> parents: 11766 diff changeset	126 end);
65e252940337 mod_s2s: Retrieve TLS context for outgoing Direct TLS connections from mod_tls Kim Alvefur <zash@zash.se> parents: 11766 diff changeset	127
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	128 -- Hook <starttls/>
2600 1e6f3002e04f mod_tls: Inlined some code. Waqas Hussain <waqas20@gmail.com> parents: 2596 diff changeset	129 module:hook("stanza/urn:ietf:params:xml:ns:xmpp-tls:starttls", function(event)
1e6f3002e04f mod_tls: Inlined some code. Waqas Hussain <waqas20@gmail.com> parents: 2596 diff changeset	130 local origin = event.origin;
12602 9184fe3d489a mod_tls: Record STARTTLS state so it can be shown in Shell Kim Alvefur <zash@zash.se> parents: 12484 diff changeset	131 origin.starttls = "requested";
2625 03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection Matthew Wild <mwild1@gmail.com> parents: 2623 diff changeset	132 if can_do_tls(origin) then
12483 988a3a7e1f35 mod_tls: tell network backend to stop reading while preparing TLS Jonas Schäfer <jonas@wielicki.name> parents: 12482 diff changeset	133 if origin.conn.block_reads then
988a3a7e1f35 mod_tls: tell network backend to stop reading while preparing TLS Jonas Schäfer <jonas@wielicki.name> parents: 12482 diff changeset	134 -- we need to ensure that no data is read anymore, otherwise we could end up in a situation where
988a3a7e1f35 mod_tls: tell network backend to stop reading while preparing TLS Jonas Schäfer <jonas@wielicki.name> parents: 12482 diff changeset	135 -- <proceed/> is sent and the socket receives the TLS handshake (and passes the data to lua) before
988a3a7e1f35 mod_tls: tell network backend to stop reading while preparing TLS Jonas Schäfer <jonas@wielicki.name> parents: 12482 diff changeset	136 -- it is asked to initiate TLS
988a3a7e1f35 mod_tls: tell network backend to stop reading while preparing TLS Jonas Schäfer <jonas@wielicki.name> parents: 12482 diff changeset	137 -- (not with the classical single-threaded server backends)
988a3a7e1f35 mod_tls: tell network backend to stop reading while preparing TLS Jonas Schäfer <jonas@wielicki.name> parents: 12482 diff changeset	138 origin.conn:block_reads()
988a3a7e1f35 mod_tls: tell network backend to stop reading while preparing TLS Jonas Schäfer <jonas@wielicki.name> parents: 12482 diff changeset	139 end
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	140 (origin.sends2s or origin.send)(starttls_proceed);
11519 df4bd3af4099 mod_tls: Bail out if session got destroyed while sending <proceed/> Kim Alvefur <zash@zash.se> parents: 11341 diff changeset	141 if origin.destroyed then return end
2600 1e6f3002e04f mod_tls: Inlined some code. Waqas Hussain <waqas20@gmail.com> parents: 2596 diff changeset	142 origin:reset_stream();
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	143 origin.conn:starttls(origin.ssl_ctx);
4157 1b5a8e071a80 mod_tls: Drop 'TLS negotiation started for ...' to debug level from info Matthew Wild <mwild1@gmail.com> parents: 3583 diff changeset	144 origin.log("debug", "TLS negotiation started for %s...", origin.type);
2600 1e6f3002e04f mod_tls: Inlined some code. Waqas Hussain <waqas20@gmail.com> parents: 2596 diff changeset	145 origin.secure = false;
2595 015934e20f03 mod_tls: Switched to new events API. Waqas Hussain <waqas20@gmail.com> parents: 2594 diff changeset	146 else
015934e20f03 mod_tls: Switched to new events API. Waqas Hussain <waqas20@gmail.com> parents: 2594 diff changeset	147 origin.log("warn", "Attempt to start TLS, but TLS is not available on this %s connection", origin.type);
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	148 (origin.sends2s or origin.send)(starttls_failure);
2601 e64c6a4aa50b mod_tls: Respond with proper error when TLS cannot be negotiated. Waqas Hussain <waqas20@gmail.com> parents: 2600 diff changeset	149 origin:close();
2595 015934e20f03 mod_tls: Switched to new events API. Waqas Hussain <waqas20@gmail.com> parents: 2594 diff changeset	150 end
015934e20f03 mod_tls: Switched to new events API. Waqas Hussain <waqas20@gmail.com> parents: 2594 diff changeset	151 return true;
015934e20f03 mod_tls: Switched to new events API. Waqas Hussain <waqas20@gmail.com> parents: 2594 diff changeset	152 end);
2932 d2816fb6c7ea mod_tls: Add s2s_allow_encryption option which, when set to false, disabled TLS for s2s Matthew Wild <mwild1@gmail.com> parents: 2923 diff changeset	153
11727 f3aee8a825cc Fix various spelling errors (thanks codespell) Kim Alvefur <zash@zash.se> parents: 11580 diff changeset	154 -- Advertise stream feature
2607 35a5d1c5ea28 mod_tls: Hook stream-features event using new events API. Waqas Hussain <waqas20@gmail.com> parents: 2605 diff changeset	155 module:hook("stream-features", function(event)
35a5d1c5ea28 mod_tls: Hook stream-features event using new events API. Waqas Hussain <waqas20@gmail.com> parents: 2605 diff changeset	156 local origin, features = event.origin, event.features;
2625 03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection Matthew Wild <mwild1@gmail.com> parents: 2623 diff changeset	157 if can_do_tls(origin) then
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	158 features:add_child(c2s_feature);
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	159 end
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	160 end);
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	161 module:hook("s2s-stream-features", function(event)
2613 afa20941e098 s2smanager, mod_compression, mod_tls: Changed event.session to event.origin for s2s-stream-features event for consistency. Waqas Hussain <waqas20@gmail.com> parents: 2607 diff changeset	162 local origin, features = event.origin, event.features;
2625 03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection Matthew Wild <mwild1@gmail.com> parents: 2623 diff changeset	163 if can_do_tls(origin) then
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	164 features:add_child(s2s_feature);
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	165 end
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	166 end);
1875 334383faf77b mod_tls: Advertise and handle TLS for s2s connections Matthew Wild <mwild1@gmail.com> parents: 1675 diff changeset	167
334383faf77b mod_tls: Advertise and handle TLS for s2s connections Matthew Wild <mwild1@gmail.com> parents: 1675 diff changeset	168 -- For s2sout connections, start TLS if we can
7959 3941d609ff85 mod_tls: Switch to hook_tag from hook_stanza which was renamed in 2087d42f1e77 Kim Alvefur <zash@zash.se> parents: 7913 diff changeset	169 module:hook_tag("http://etherx.jabber.org/streams", "features", function (session, stanza)
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	170 module:log("debug", "Received features element");
11340 a7109eb45e30 mod_tls: Attempt STARTTLS even if not advertised as per RFC 7590 Kim Alvefur <zash@zash.se> parents: 10784 diff changeset	171 if can_do_tls(session) then
a7109eb45e30 mod_tls: Attempt STARTTLS even if not advertised as per RFC 7590 Kim Alvefur <zash@zash.se> parents: 10784 diff changeset	172 if stanza:get_child("starttls", xmlns_starttls) then
a7109eb45e30 mod_tls: Attempt STARTTLS even if not advertised as per RFC 7590 Kim Alvefur <zash@zash.se> parents: 10784 diff changeset	173 module:log("debug", "%s is offering TLS, taking up the offer...", session.to_host);
11341 c567e5e2b77a mod_tls: Ignore lack of STARTTLS offer only when s2s_require_encryption set Kim Alvefur <zash@zash.se> parents: 11340 diff changeset	174 elseif s2s_require_encryption then
c567e5e2b77a mod_tls: Ignore lack of STARTTLS offer only when s2s_require_encryption set Kim Alvefur <zash@zash.se> parents: 11340 diff changeset	175 module:log("debug", "%s is not offering TLS, trying anyways!", session.to_host);
11340 a7109eb45e30 mod_tls: Attempt STARTTLS even if not advertised as per RFC 7590 Kim Alvefur <zash@zash.se> parents: 10784 diff changeset	176 else
11341 c567e5e2b77a mod_tls: Ignore lack of STARTTLS offer only when s2s_require_encryption set Kim Alvefur <zash@zash.se> parents: 11340 diff changeset	177 module:log("debug", "%s is not offering TLS", session.to_host);
c567e5e2b77a mod_tls: Ignore lack of STARTTLS offer only when s2s_require_encryption set Kim Alvefur <zash@zash.se> parents: 11340 diff changeset	178 return;
11340 a7109eb45e30 mod_tls: Attempt STARTTLS even if not advertised as per RFC 7590 Kim Alvefur <zash@zash.se> parents: 10784 diff changeset	179 end
12602 9184fe3d489a mod_tls: Record STARTTLS state so it can be shown in Shell Kim Alvefur <zash@zash.se> parents: 12484 diff changeset	180 session.starttls = "initiated";
6709 b6eff3ba13de mod_tls: Build <starttls/> as a stanza instead of with string concatenation Kim Alvefur <zash@zash.se> parents: 6526 diff changeset	181 session.sends2s(starttls_initiate);
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	182 return true;
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	183 end
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	184 end, 500);
1875 334383faf77b mod_tls: Advertise and handle TLS for s2s connections Matthew Wild <mwild1@gmail.com> parents: 1675 diff changeset	185
11766 6ad335cd43f9 mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections Kim Alvefur <zash@zash.se> parents: 11727 diff changeset	186 module:hook("s2sout-authenticate-legacy", function(event)
6ad335cd43f9 mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections Kim Alvefur <zash@zash.se> parents: 11727 diff changeset	187 local session = event.origin;
6ad335cd43f9 mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections Kim Alvefur <zash@zash.se> parents: 11727 diff changeset	188 if s2s_require_encryption and can_do_tls(session) then
6ad335cd43f9 mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections Kim Alvefur <zash@zash.se> parents: 11727 diff changeset	189 session.sends2s(starttls_initiate);
6ad335cd43f9 mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections Kim Alvefur <zash@zash.se> parents: 11727 diff changeset	190 return true;
6ad335cd43f9 mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections Kim Alvefur <zash@zash.se> parents: 11727 diff changeset	191 end
6ad335cd43f9 mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections Kim Alvefur <zash@zash.se> parents: 11727 diff changeset	192 end, 200);
6ad335cd43f9 mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections Kim Alvefur <zash@zash.se> parents: 11727 diff changeset	193
7959 3941d609ff85 mod_tls: Switch to hook_tag from hook_stanza which was renamed in 2087d42f1e77 Kim Alvefur <zash@zash.se> parents: 7913 diff changeset	194 module:hook_tag(xmlns_starttls, "proceed", function (session, stanza) -- luacheck: ignore 212/stanza
7834 a2081d28bd22 mod_tls: Verify that TLS is available before proceeding Kim Alvefur <zash@zash.se> parents: 7833 diff changeset	195 if session.type == "s2sout_unauthed" and can_do_tls(session) then
7833 94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections Kim Alvefur <zash@zash.se> parents: 7712 diff changeset	196 module:log("debug", "Proceeding with TLS on s2sout...");
94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections Kim Alvefur <zash@zash.se> parents: 7712 diff changeset	197 session:reset_stream();
12602 9184fe3d489a mod_tls: Record STARTTLS state so it can be shown in Shell Kim Alvefur <zash@zash.se> parents: 12484 diff changeset	198 session.starttls = "proceeding"
12484 fb65b5a033b2 mod_tls: pass target hostname to starttls Jonas Schäfer <jonas@wielicki.name> parents: 12483 diff changeset	199 session.conn:starttls(session.ssl_ctx, session.to_host);
7833 94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections Kim Alvefur <zash@zash.se> parents: 7712 diff changeset	200 session.secure = false;
94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections Kim Alvefur <zash@zash.se> parents: 7712 diff changeset	201 return true;
94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections Kim Alvefur <zash@zash.se> parents: 7712 diff changeset	202 end
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	203 end);
11580 9ad5ec65132d mod_tls: Add "support" for <failure> by closing gracefully Kim Alvefur <zash@zash.se> parents: 11530 diff changeset	204
9ad5ec65132d mod_tls: Add "support" for <failure> by closing gracefully Kim Alvefur <zash@zash.se> parents: 11530 diff changeset	205 module:hook_tag(xmlns_starttls, "failure", function (session, stanza) -- luacheck: ignore 212/stanza
9ad5ec65132d mod_tls: Add "support" for <failure> by closing gracefully Kim Alvefur <zash@zash.se> parents: 11530 diff changeset	206 module:log("warn", "TLS negotiation with %s failed.", session.to_host);
9ad5ec65132d mod_tls: Add "support" for <failure> by closing gracefully Kim Alvefur <zash@zash.se> parents: 11530 diff changeset	207 session:close(nil, "TLS negotiation failed");
9ad5ec65132d mod_tls: Add "support" for <failure> by closing gracefully Kim Alvefur <zash@zash.se> parents: 11530 diff changeset	208 return false;
9ad5ec65132d mod_tls: Add "support" for <failure> by closing gracefully Kim Alvefur <zash@zash.se> parents: 11530 diff changeset	209 end);

prosody

9e5802b45b9e

plugins/mod_tls.lua

Software / code / prosody

Annotate

plugins/mod_tls.lua @ 13073:9e5802b45b9e

Software `/` code `/` prosody