Software / code / prosody
Annotate
plugins/mod_tls.lua @ 4344:a24ee48ec30d
modulemanager: Add module:hook_global(name, handler, priority) to hook global (server-wide) events
| author | Matthew Wild <mwild1@gmail.com> |
|---|---|
| date | Sun, 14 Aug 2011 13:56:13 -0400 |
| parent | 4244:19c9bf88ec89 |
| child | 4475:7341cc5c8da9 |
| rev | line source |
|---|---|
|
1523
841d61be198f
Remove version number from copyright headers
Matthew Wild <mwild1@gmail.com>
parents:
1219
diff
changeset
|
1 -- Prosody IM |
|
2923
b7049746bd29
Update copyright headers for 2010
Matthew Wild <mwild1@gmail.com>
parents:
2877
diff
changeset
|
2 -- Copyright (C) 2008-2010 Matthew Wild |
|
b7049746bd29
Update copyright headers for 2010
Matthew Wild <mwild1@gmail.com>
parents:
2877
diff
changeset
|
3 -- Copyright (C) 2008-2010 Waqas Hussain |
|
519
cccd610a0ef9
Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents:
438
diff
changeset
|
4 -- |
| 758 | 5 -- This project is MIT/X11 licensed. Please see the |
| 6 -- COPYING file in the source package for more information. | |
|
519
cccd610a0ef9
Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents:
438
diff
changeset
|
7 -- |
|
cccd610a0ef9
Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents:
438
diff
changeset
|
8 |
|
3583
ef86ba720f00
mod_tls: Let hosts without an 'ssl' option inherit it from their parent hosts.
Waqas Hussain <waqas20@gmail.com>
parents:
3574
diff
changeset
|
9 local config = require "core.configmanager"; |
|
3571
675d65036f31
certmanager, hostmanager, mod_tls: Move responsibility for creating per-host SSL contexts to mod_tls, meaning reloading certs is now as trivial as reloading mod_tls
Matthew Wild <mwild1@gmail.com>
parents:
3397
diff
changeset
|
10 local create_context = require "core.certmanager".create_context; |
|
69
5b664c8fef86
forgot to commit mod_tls, oops :)
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
11 local st = require "util.stanza"; |
|
99
ba08b8a4eeef
Abstract connections with "connection listeners"
Matthew Wild <mwild1@gmail.com>
parents:
69
diff
changeset
|
12 |
|
1912
126401a7159f
require_encryption deprecated, use c2s_require_encryption instead
Matthew Wild <mwild1@gmail.com>
parents:
1911
diff
changeset
|
13 local secure_auth_only = module:get_option("c2s_require_encryption") or module:get_option("require_encryption"); |
|
1913
da49a59dff7c
mod_tls: require_s2s_encryption -> s2s_require_encryption
Matthew Wild <mwild1@gmail.com>
parents:
1912
diff
changeset
|
14 local secure_s2s_only = module:get_option("s2s_require_encryption"); |
| 2933 | 15 local allow_s2s_tls = module:get_option("s2s_allow_encryption") ~= false; |
|
1219
f14e08a0ae7f
mod_tls: Add <required/> to stream feature when TLS is required
Matthew Wild <mwild1@gmail.com>
parents:
1213
diff
changeset
|
16 |
| 2605 | 17 local xmlns_starttls = 'urn:ietf:params:xml:ns:xmpp-tls'; |
| 18 local starttls_attr = { xmlns = xmlns_starttls }; | |
| 19 local starttls_proceed = st.stanza("proceed", starttls_attr); | |
| 20 local starttls_failure = st.stanza("failure", starttls_attr); | |
| 21 local c2s_feature = st.stanza("starttls", starttls_attr); | |
| 22 local s2s_feature = st.stanza("starttls", starttls_attr); | |
| 23 if secure_auth_only then c2s_feature:tag("required"):up(); end | |
| 24 if secure_s2s_only then s2s_feature:tag("required"):up(); end | |
| 25 | |
|
2542
0a78847b38e2
mod_tls: Update for new server SSL syntax
Matthew Wild <mwild1@gmail.com>
parents:
2108
diff
changeset
|
26 local global_ssl_ctx = prosody.global_ssl_ctx; |
|
1219
f14e08a0ae7f
mod_tls: Add <required/> to stream feature when TLS is required
Matthew Wild <mwild1@gmail.com>
parents:
1213
diff
changeset
|
27 |
|
2872
cdc292d201fc
mod_tls: Don't offer TLS on hosts that don't have any certs
Matthew Wild <mwild1@gmail.com>
parents:
2854
diff
changeset
|
28 local host = hosts[module.host]; |
|
cdc292d201fc
mod_tls: Don't offer TLS on hosts that don't have any certs
Matthew Wild <mwild1@gmail.com>
parents:
2854
diff
changeset
|
29 |
|
2625
03287c06d986
mod_tls: Refactor to simplify detection of whether we can do TLS on a connection
Matthew Wild <mwild1@gmail.com>
parents:
2623
diff
changeset
|
30 local function can_do_tls(session) |
|
03287c06d986
mod_tls: Refactor to simplify detection of whether we can do TLS on a connection
Matthew Wild <mwild1@gmail.com>
parents:
2623
diff
changeset
|
31 if session.type == "c2s_unauthed" then |
|
2636
d2805ad5b736
mod_tls: Ban TLS after auth, not before.
Waqas Hussain <waqas20@gmail.com>
parents:
2635
diff
changeset
|
32 return session.conn.starttls and host.ssl_ctx_in; |
| 2933 | 33 elseif session.type == "s2sin_unauthed" and allow_s2s_tls then |
|
2636
d2805ad5b736
mod_tls: Ban TLS after auth, not before.
Waqas Hussain <waqas20@gmail.com>
parents:
2635
diff
changeset
|
34 return session.conn.starttls and host.ssl_ctx_in; |
| 2933 | 35 elseif session.direction == "outgoing" and allow_s2s_tls then |
|
2654
07a6f5f9d4be
mod_tls: Only negotiate TLS on outgoing s2s connections if we have an SSL context (thanks Flo...)
Matthew Wild <mwild1@gmail.com>
parents:
2636
diff
changeset
|
36 return session.conn.starttls and host.ssl_ctx; |
|
2625
03287c06d986
mod_tls: Refactor to simplify detection of whether we can do TLS on a connection
Matthew Wild <mwild1@gmail.com>
parents:
2623
diff
changeset
|
37 end |
|
03287c06d986
mod_tls: Refactor to simplify detection of whether we can do TLS on a connection
Matthew Wild <mwild1@gmail.com>
parents:
2623
diff
changeset
|
38 return false; |
|
2932
d2816fb6c7ea
mod_tls: Add s2s_allow_encryption option which, when set to false, disabled TLS for s2s
Matthew Wild <mwild1@gmail.com>
parents:
2923
diff
changeset
|
39 end |
|
d2816fb6c7ea
mod_tls: Add s2s_allow_encryption option which, when set to false, disabled TLS for s2s
Matthew Wild <mwild1@gmail.com>
parents:
2923
diff
changeset
|
40 |
| 2605 | 41 -- Hook <starttls/> |
|
2600
1e6f3002e04f
mod_tls: Inlined some code.
Waqas Hussain <waqas20@gmail.com>
parents:
2596
diff
changeset
|
42 module:hook("stanza/urn:ietf:params:xml:ns:xmpp-tls:starttls", function(event) |
|
1e6f3002e04f
mod_tls: Inlined some code.
Waqas Hussain <waqas20@gmail.com>
parents:
2596
diff
changeset
|
43 local origin = event.origin; |
|
2625
03287c06d986
mod_tls: Refactor to simplify detection of whether we can do TLS on a connection
Matthew Wild <mwild1@gmail.com>
parents:
2623
diff
changeset
|
44 if can_do_tls(origin) then |
| 2605 | 45 (origin.sends2s or origin.send)(starttls_proceed); |
|
2600
1e6f3002e04f
mod_tls: Inlined some code.
Waqas Hussain <waqas20@gmail.com>
parents:
2596
diff
changeset
|
46 origin:reset_stream(); |
|
1e6f3002e04f
mod_tls: Inlined some code.
Waqas Hussain <waqas20@gmail.com>
parents:
2596
diff
changeset
|
47 local host = origin.to_host or origin.host; |
|
2596
187cd90860cb
mod_tls: Merged duplicate code.
Waqas Hussain <waqas20@gmail.com>
parents:
2595
diff
changeset
|
48 local ssl_ctx = host and hosts[host].ssl_ctx_in or global_ssl_ctx; |
|
2600
1e6f3002e04f
mod_tls: Inlined some code.
Waqas Hussain <waqas20@gmail.com>
parents:
2596
diff
changeset
|
49 origin.conn:starttls(ssl_ctx); |
|
4188
a395540f25e3
mod_tls: Drop 'TLS negotiation started for ...' to debug level from info
Matthew Wild <mwild1@gmail.com>
parents:
3583
diff
changeset
|
50 origin.log("debug", "TLS negotiation started for %s...", origin.type); |
|
2600
1e6f3002e04f
mod_tls: Inlined some code.
Waqas Hussain <waqas20@gmail.com>
parents:
2596
diff
changeset
|
51 origin.secure = false; |
|
2595
015934e20f03
mod_tls: Switched to new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
2594
diff
changeset
|
52 else |
|
015934e20f03
mod_tls: Switched to new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
2594
diff
changeset
|
53 origin.log("warn", "Attempt to start TLS, but TLS is not available on this %s connection", origin.type); |
| 2605 | 54 (origin.sends2s or origin.send)(starttls_failure); |
|
2601
e64c6a4aa50b
mod_tls: Respond with proper error when TLS cannot be negotiated.
Waqas Hussain <waqas20@gmail.com>
parents:
2600
diff
changeset
|
55 origin:close(); |
|
2595
015934e20f03
mod_tls: Switched to new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
2594
diff
changeset
|
56 end |
|
015934e20f03
mod_tls: Switched to new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
2594
diff
changeset
|
57 return true; |
|
015934e20f03
mod_tls: Switched to new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
2594
diff
changeset
|
58 end); |
|
2932
d2816fb6c7ea
mod_tls: Add s2s_allow_encryption option which, when set to false, disabled TLS for s2s
Matthew Wild <mwild1@gmail.com>
parents:
2923
diff
changeset
|
59 |
| 2605 | 60 -- Advertize stream feature |
|
2607
35a5d1c5ea28
mod_tls: Hook stream-features event using new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
2605
diff
changeset
|
61 module:hook("stream-features", function(event) |
|
35a5d1c5ea28
mod_tls: Hook stream-features event using new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
2605
diff
changeset
|
62 local origin, features = event.origin, event.features; |
|
2625
03287c06d986
mod_tls: Refactor to simplify detection of whether we can do TLS on a connection
Matthew Wild <mwild1@gmail.com>
parents:
2623
diff
changeset
|
63 if can_do_tls(origin) then |
| 2605 | 64 features:add_child(c2s_feature); |
| 65 end | |
| 66 end); | |
| 67 module:hook("s2s-stream-features", function(event) | |
|
2613
afa20941e098
s2smanager, mod_compression, mod_tls: Changed event.session to event.origin for s2s-stream-features event for consistency.
Waqas Hussain <waqas20@gmail.com>
parents:
2607
diff
changeset
|
68 local origin, features = event.origin, event.features; |
|
2625
03287c06d986
mod_tls: Refactor to simplify detection of whether we can do TLS on a connection
Matthew Wild <mwild1@gmail.com>
parents:
2623
diff
changeset
|
69 if can_do_tls(origin) then |
| 2605 | 70 features:add_child(s2s_feature); |
| 71 end | |
| 72 end); | |
|
1875
334383faf77b
mod_tls: Advertise and handle TLS for s2s connections
Matthew Wild <mwild1@gmail.com>
parents:
1675
diff
changeset
|
73 |
|
334383faf77b
mod_tls: Advertise and handle TLS for s2s connections
Matthew Wild <mwild1@gmail.com>
parents:
1675
diff
changeset
|
74 -- For s2sout connections, start TLS if we can |
| 2605 | 75 module:hook_stanza("http://etherx.jabber.org/streams", "features", function (session, stanza) |
| 76 module:log("debug", "Received features element"); | |
|
2654
07a6f5f9d4be
mod_tls: Only negotiate TLS on outgoing s2s connections if we have an SSL context (thanks Flo...)
Matthew Wild <mwild1@gmail.com>
parents:
2636
diff
changeset
|
77 if can_do_tls(session) and stanza:child_with_ns(xmlns_starttls) then |
| 2605 | 78 module:log("%s is offering TLS, taking up the offer...", session.to_host); |
| 79 session.sends2s("<starttls xmlns='"..xmlns_starttls.."'/>"); | |
| 80 return true; | |
| 81 end | |
| 82 end, 500); | |
|
1875
334383faf77b
mod_tls: Advertise and handle TLS for s2s connections
Matthew Wild <mwild1@gmail.com>
parents:
1675
diff
changeset
|
83 |
| 2605 | 84 module:hook_stanza(xmlns_starttls, "proceed", function (session, stanza) |
| 85 module:log("debug", "Proceeding with TLS on s2sout..."); | |
| 86 session:reset_stream(); | |
| 87 local ssl_ctx = session.from_host and hosts[session.from_host].ssl_ctx or global_ssl_ctx; | |
|
3397
f376f0bd1d1f
mod_tls: Remove extraneous flag to starttls() for s2sout connecections
Matthew Wild <mwild1@gmail.com>
parents:
2933
diff
changeset
|
88 session.conn:starttls(ssl_ctx); |
| 2605 | 89 session.secure = false; |
| 90 return true; | |
| 91 end); | |
|
3571
675d65036f31
certmanager, hostmanager, mod_tls: Move responsibility for creating per-host SSL contexts to mod_tls, meaning reloading certs is now as trivial as reloading mod_tls
Matthew Wild <mwild1@gmail.com>
parents:
3397
diff
changeset
|
92 |
|
675d65036f31
certmanager, hostmanager, mod_tls: Move responsibility for creating per-host SSL contexts to mod_tls, meaning reloading certs is now as trivial as reloading mod_tls
Matthew Wild <mwild1@gmail.com>
parents:
3397
diff
changeset
|
93 function module.load() |
|
4244
19c9bf88ec89
mod_tls: Fix for components to more reliably inherit SSL settings from their parenthost (thanks Link Mauve)
Matthew Wild <mwild1@gmail.com>
parents:
4188
diff
changeset
|
94 local ssl_config = config.rawget(module.host, "core", "ssl"); |
|
19c9bf88ec89
mod_tls: Fix for components to more reliably inherit SSL settings from their parenthost (thanks Link Mauve)
Matthew Wild <mwild1@gmail.com>
parents:
4188
diff
changeset
|
95 if not ssl_config then |
|
19c9bf88ec89
mod_tls: Fix for components to more reliably inherit SSL settings from their parenthost (thanks Link Mauve)
Matthew Wild <mwild1@gmail.com>
parents:
4188
diff
changeset
|
96 local base_host = module.host:match("%.(.*)"); |
|
3583
ef86ba720f00
mod_tls: Let hosts without an 'ssl' option inherit it from their parent hosts.
Waqas Hussain <waqas20@gmail.com>
parents:
3574
diff
changeset
|
97 ssl_config = config.get(base_host, "core", "ssl"); |
|
ef86ba720f00
mod_tls: Let hosts without an 'ssl' option inherit it from their parent hosts.
Waqas Hussain <waqas20@gmail.com>
parents:
3574
diff
changeset
|
98 end |
|
3574
1e088ec07d33
mod_tls: Pass the hostname rather than host session to certmanager.create_context() (thanks darkrain)
Matthew Wild <mwild1@gmail.com>
parents:
3571
diff
changeset
|
99 host.ssl_ctx = create_context(host.host, "client", ssl_config); -- for outgoing connections |
|
1e088ec07d33
mod_tls: Pass the hostname rather than host session to certmanager.create_context() (thanks darkrain)
Matthew Wild <mwild1@gmail.com>
parents:
3571
diff
changeset
|
100 host.ssl_ctx_in = create_context(host.host, "server", ssl_config); -- for incoming connections |
|
3571
675d65036f31
certmanager, hostmanager, mod_tls: Move responsibility for creating per-host SSL contexts to mod_tls, meaning reloading certs is now as trivial as reloading mod_tls
Matthew Wild <mwild1@gmail.com>
parents:
3397
diff
changeset
|
101 end |
|
675d65036f31
certmanager, hostmanager, mod_tls: Move responsibility for creating per-host SSL contexts to mod_tls, meaning reloading certs is now as trivial as reloading mod_tls
Matthew Wild <mwild1@gmail.com>
parents:
3397
diff
changeset
|
102 |
|
675d65036f31
certmanager, hostmanager, mod_tls: Move responsibility for creating per-host SSL contexts to mod_tls, meaning reloading certs is now as trivial as reloading mod_tls
Matthew Wild <mwild1@gmail.com>
parents:
3397
diff
changeset
|
103 function module.unload() |
|
675d65036f31
certmanager, hostmanager, mod_tls: Move responsibility for creating per-host SSL contexts to mod_tls, meaning reloading certs is now as trivial as reloading mod_tls
Matthew Wild <mwild1@gmail.com>
parents:
3397
diff
changeset
|
104 host.ssl_ctx = nil; |
|
675d65036f31
certmanager, hostmanager, mod_tls: Move responsibility for creating per-host SSL contexts to mod_tls, meaning reloading certs is now as trivial as reloading mod_tls
Matthew Wild <mwild1@gmail.com>
parents:
3397
diff
changeset
|
105 host.ssl_ctx_in = nil; |
|
675d65036f31
certmanager, hostmanager, mod_tls: Move responsibility for creating per-host SSL contexts to mod_tls, meaning reloading certs is now as trivial as reloading mod_tls
Matthew Wild <mwild1@gmail.com>
parents:
3397
diff
changeset
|
106 end |
