Software `/` code `/` prosody

Annotate

plugins/mod_tls.lua @ 12482:b193f8a2737e

mod_tls: Do not offer TLS if the connection is considered secure This may be necessary if the session.conn object is not exchanged by the network backend when establishing TLS. In that case, the starttls method will always exist and thus that is not a good indicator for offering TLS. However, the secure bit already tells us that TLS has been established or is not to be established on the connection, so we use that instead.

author	Jonas Schäfer <jonas@wielicki.name>
date	Fri, 17 Sep 2021 21:18:30 +0200
parent	12330:38b5b05407be
child	12483:988a3a7e1f35

rev	line source
1523 841d61be198f Remove version number from copyright headers Matthew Wild <mwild1@gmail.com> parents: 1219 diff changeset	1 -- Prosody IM
2923 b7049746bd29 Update copyright headers for 2010 Matthew Wild <mwild1@gmail.com> parents: 2877 diff changeset	2 -- Copyright (C) 2008-2010 Matthew Wild
b7049746bd29 Update copyright headers for 2010 Matthew Wild <mwild1@gmail.com> parents: 2877 diff changeset	3 -- Copyright (C) 2008-2010 Waqas Hussain
5776 bd0ff8ae98a8 Remove all trailing whitespace Florian Zeitz <florob@babelmonkeys.de> parents: 5698 diff changeset	4 --
758 b1885732e979 GPL->MIT! Matthew Wild <mwild1@gmail.com> parents: 705 diff changeset	5 -- This project is MIT/X11 licensed. Please see the
b1885732e979 GPL->MIT! Matthew Wild <mwild1@gmail.com> parents: 705 diff changeset	6 -- COPYING file in the source package for more information.
519 cccd610a0ef9 Insert copyright/license headers Matthew Wild <mwild1@gmail.com> parents: 438 diff changeset	7 --
cccd610a0ef9 Insert copyright/license headers Matthew Wild <mwild1@gmail.com> parents: 438 diff changeset	8
3571 675d65036f31 certmanager, hostmanager, mod_tls: Move responsibility for creating per-host SSL contexts to mod_tls, meaning reloading certs is now as trivial as reloading mod_tls Matthew Wild <mwild1@gmail.com> parents: 3397 diff changeset	9 local create_context = require "core.certmanager".create_context;
6832 9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	10 local rawgetopt = require"core.configmanager".rawget;
69 5b664c8fef86 forgot to commit mod_tls, oops :) Matthew Wild <mwild1@gmail.com> parents: diff changeset	11 local st = require "util.stanza";
99 ba08b8a4eeef Abstract connections with "connection listeners" Matthew Wild <mwild1@gmail.com> parents: 69 diff changeset	12
12330 38b5b05407be various: Require encryption by default for real Kim Alvefur <zash@zash.se> parents: 12211 diff changeset	13 local c2s_require_encryption = module:get_option("c2s_require_encryption", module:get_option("require_encryption", true));
38b5b05407be various: Require encryption by default for real Kim Alvefur <zash@zash.se> parents: 12211 diff changeset	14 local s2s_require_encryption = module:get_option("s2s_require_encryption", true);
2933 e68ff49fa79b Merge 0.6->0.7 Matthew Wild <mwild1@gmail.com> parents: 2925 2932 diff changeset	15 local allow_s2s_tls = module:get_option("s2s_allow_encryption") ~= false;
5988 177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ Kim Alvefur <zash@zash.se> parents: 5987 diff changeset	16 local s2s_secure_auth = module:get_option("s2s_secure_auth");
177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ Kim Alvefur <zash@zash.se> parents: 5987 diff changeset	17
177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ Kim Alvefur <zash@zash.se> parents: 5987 diff changeset	18 if s2s_secure_auth and s2s_require_encryption == false then
177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ Kim Alvefur <zash@zash.se> parents: 5987 diff changeset	19 module:log("warn", "s2s_secure_auth implies s2s_require_encryption, but s2s_require_encryption is set to false");
177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ Kim Alvefur <zash@zash.se> parents: 5987 diff changeset	20 s2s_require_encryption = true;
177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ Kim Alvefur <zash@zash.se> parents: 5987 diff changeset	21 end
1219 f14e08a0ae7f mod_tls: Add <required/> to stream feature when TLS is required Matthew Wild <mwild1@gmail.com> parents: 1213 diff changeset	22
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	23 local xmlns_starttls = 'urn:ietf:params:xml:ns:xmpp-tls';
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	24 local starttls_attr = { xmlns = xmlns_starttls };
6709 b6eff3ba13de mod_tls: Build <starttls/> as a stanza instead of with string concatenation Kim Alvefur <zash@zash.se> parents: 6526 diff changeset	25 local starttls_initiate= st.stanza("starttls", starttls_attr);
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	26 local starttls_proceed = st.stanza("proceed", starttls_attr);
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	27 local starttls_failure = st.stanza("failure", starttls_attr);
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	28 local c2s_feature = st.stanza("starttls", starttls_attr);
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	29 local s2s_feature = st.stanza("starttls", starttls_attr);
5987 bd90250ee1ee mod_tls: Rename variables to be less confusing Kim Alvefur <zash@zash.se> parents: 5976 diff changeset	30 if c2s_require_encryption then c2s_feature:tag("required"):up(); end
bd90250ee1ee mod_tls: Rename variables to be less confusing Kim Alvefur <zash@zash.se> parents: 5976 diff changeset	31 if s2s_require_encryption then s2s_feature:tag("required"):up(); end
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	32
5370 7838acadb0fa mod_announce, mod_auth_anonymous, mod_c2s, mod_c2s, mod_component, mod_iq, mod_message, mod_presence, mod_tls: Access prosody.{hosts,bare_sessions,full_sessions} instead of the old globals Kim Alvefur <zash@zash.se> parents: 4475 diff changeset	33 local hosts = prosody.hosts;
2872 cdc292d201fc mod_tls: Don't offer TLS on hosts that don't have any certs Matthew Wild <mwild1@gmail.com> parents: 2854 diff changeset	34 local host = hosts[module.host];
cdc292d201fc mod_tls: Don't offer TLS on hosts that don't have any certs Matthew Wild <mwild1@gmail.com> parents: 2854 diff changeset	35
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	36 local ssl_ctx_c2s, ssl_ctx_s2sout, ssl_ctx_s2sin;
6521 29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions Kim Alvefur <zash@zash.se> parents: 6487 diff changeset	37 local ssl_cfg_c2s, ssl_cfg_s2sout, ssl_cfg_s2sin;
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	38 local err_c2s, err_s2sin, err_s2sout;
8131 c8e3a0caa0a9 mod_tls: Rebuild SSL context objects on configuration reload - #701 Kim Alvefur <zash@zash.se> parents: 7959 diff changeset	39
10783 950082c1669e mod_tls: Log when certificates are (re)loaded Kim Alvefur <zash@zash.se> parents: 9971 diff changeset	40 function module.load(reload)
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	41 local NULL = {};
6832 9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	42 local modhost = module.host;
9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	43 local parent = modhost:match("%.(.*)$");
6296 66fb7b7c668d mod_tls: Simplify and use new ssl config merging in certmanager Kim Alvefur <zash@zash.se> parents: 5993 diff changeset	44
6832 9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	45 local parent_ssl = rawgetopt(parent, "ssl") or NULL;
9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	46 local host_ssl = rawgetopt(modhost, "ssl") or parent_ssl;
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	47
6832 9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	48 local global_c2s = rawgetopt("*", "c2s_ssl") or NULL;
9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	49 local parent_c2s = rawgetopt(parent, "c2s_ssl") or NULL;
6919 ab6c57633ce5 mod_tls: Fix ssl option fallback to a "parent" host if current host does not have ssl options set (thanks 70b1) Kim Alvefur <zash@zash.se> parents: 6918 diff changeset	50 local host_c2s = rawgetopt(modhost, "c2s_ssl") or parent_c2s;
6296 66fb7b7c668d mod_tls: Simplify and use new ssl config merging in certmanager Kim Alvefur <zash@zash.se> parents: 5993 diff changeset	51
6832 9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	52 local global_s2s = rawgetopt("*", "s2s_ssl") or NULL;
9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	53 local parent_s2s = rawgetopt(parent, "s2s_ssl") or NULL;
6919 ab6c57633ce5 mod_tls: Fix ssl option fallback to a "parent" host if current host does not have ssl options set (thanks 70b1) Kim Alvefur <zash@zash.se> parents: 6918 diff changeset	54 local host_s2s = rawgetopt(modhost, "s2s_ssl") or parent_s2s;
6296 66fb7b7c668d mod_tls: Simplify and use new ssl config merging in certmanager Kim Alvefur <zash@zash.se> parents: 5993 diff changeset	55
9971 5b048ccd106f mod_tls: Log debug message for each kind of TLS context created Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	56 module:log("debug", "Creating context for c2s");
9854 115b5e32d960 mod_tls: Restore querying for certificates on s2s Kim Alvefur <zash@zash.se> parents: 9740 diff changeset	57 local request_client_certs = { verify = { "peer", "client_once", }; };
12211 5c2ae28f536e mod_tls: Set ALPN on outgoing connections Kim Alvefur <zash@zash.se> parents: 12207 diff changeset	58 local xmpp_alpn = { alpn = "xmpp-server" };
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	59
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	60 ssl_ctx_c2s, err_c2s, ssl_cfg_c2s = create_context(host.host, "server", host_c2s, host_ssl, global_c2s); -- for incoming client connections
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	61 if not ssl_ctx_c2s then module:log("error", "Error creating context for c2s: %s", err_c2s); end
6521 29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions Kim Alvefur <zash@zash.se> parents: 6487 diff changeset	62
11530 a90389e7296c mod_tls: Fix order of debug messages and tls context creation Kim Alvefur <zash@zash.se> parents: 11519 diff changeset	63 module:log("debug", "Creating context for s2sout");
9854 115b5e32d960 mod_tls: Restore querying for certificates on s2s Kim Alvefur <zash@zash.se> parents: 9740 diff changeset	64 -- for outgoing server connections
12211 5c2ae28f536e mod_tls: Set ALPN on outgoing connections Kim Alvefur <zash@zash.se> parents: 12207 diff changeset	65 ssl_ctx_s2sout, err_s2sout, ssl_cfg_s2sout = create_context(host.host, "client", host_s2s, host_ssl, global_s2s, request_client_certs, xmpp_alpn);
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	66 if not ssl_ctx_s2sout then module:log("error", "Error creating contexts for s2sout: %s", err_s2sout); end
6521 29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions Kim Alvefur <zash@zash.se> parents: 6487 diff changeset	67
11530 a90389e7296c mod_tls: Fix order of debug messages and tls context creation Kim Alvefur <zash@zash.se> parents: 11519 diff changeset	68 module:log("debug", "Creating context for s2sin");
9854 115b5e32d960 mod_tls: Restore querying for certificates on s2s Kim Alvefur <zash@zash.se> parents: 9740 diff changeset	69 -- for incoming server connections
115b5e32d960 mod_tls: Restore querying for certificates on s2s Kim Alvefur <zash@zash.se> parents: 9740 diff changeset	70 ssl_ctx_s2sin, err_s2sin, ssl_cfg_s2sin = create_context(host.host, "server", host_s2s, host_ssl, global_s2s, request_client_certs);
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	71 if not ssl_ctx_s2sin then module:log("error", "Error creating contexts for s2sin: %s", err_s2sin); end
10783 950082c1669e mod_tls: Log when certificates are (re)loaded Kim Alvefur <zash@zash.se> parents: 9971 diff changeset	72
950082c1669e mod_tls: Log when certificates are (re)loaded Kim Alvefur <zash@zash.se> parents: 9971 diff changeset	73 if reload then
950082c1669e mod_tls: Log when certificates are (re)loaded Kim Alvefur <zash@zash.se> parents: 9971 diff changeset	74 module:log("info", "Certificates reloaded");
950082c1669e mod_tls: Log when certificates are (re)loaded Kim Alvefur <zash@zash.se> parents: 9971 diff changeset	75 else
950082c1669e mod_tls: Log when certificates are (re)loaded Kim Alvefur <zash@zash.se> parents: 9971 diff changeset	76 module:log("info", "Certificates loaded");
950082c1669e mod_tls: Log when certificates are (re)loaded Kim Alvefur <zash@zash.se> parents: 9971 diff changeset	77 end
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	78 end
f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	79
8131 c8e3a0caa0a9 mod_tls: Rebuild SSL context objects on configuration reload - #701 Kim Alvefur <zash@zash.se> parents: 7959 diff changeset	80 module:hook_global("config-reloaded", module.load);
c8e3a0caa0a9 mod_tls: Rebuild SSL context objects on configuration reload - #701 Kim Alvefur <zash@zash.se> parents: 7959 diff changeset	81
2625 03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection Matthew Wild <mwild1@gmail.com> parents: 2623 diff changeset	82 local function can_do_tls(session)
12482 b193f8a2737e mod_tls: Do not offer TLS if the connection is considered secure Jonas Schäfer <jonas@wielicki.name> parents: 12330 diff changeset	83 if session.secure then
b193f8a2737e mod_tls: Do not offer TLS if the connection is considered secure Jonas Schäfer <jonas@wielicki.name> parents: 12330 diff changeset	84 return false;
b193f8a2737e mod_tls: Do not offer TLS if the connection is considered secure Jonas Schäfer <jonas@wielicki.name> parents: 12330 diff changeset	85 end
12207 65e252940337 mod_s2s: Retrieve TLS context for outgoing Direct TLS connections from mod_tls Kim Alvefur <zash@zash.se> parents: 11766 diff changeset	86 if session.conn and not session.conn.starttls then
7913 64daa21450f9 mod_tls: Suppress debug message if already using encryption Kim Alvefur <zash@zash.se> parents: 7898 diff changeset	87 if not session.secure then
64daa21450f9 mod_tls: Suppress debug message if already using encryption Kim Alvefur <zash@zash.se> parents: 7898 diff changeset	88 session.log("debug", "Underlying connection does not support STARTTLS");
64daa21450f9 mod_tls: Suppress debug message if already using encryption Kim Alvefur <zash@zash.se> parents: 7898 diff changeset	89 end
7869 eb5fba4c8074 mod_tls: Check that connection has starttls method first to prevent offering starttls over tls (thanks Remko and Tobias) Kim Alvefur <zash@zash.se> parents: 7864 diff changeset	90 return false;
eb5fba4c8074 mod_tls: Check that connection has starttls method first to prevent offering starttls over tls (thanks Remko and Tobias) Kim Alvefur <zash@zash.se> parents: 7864 diff changeset	91 elseif session.ssl_ctx ~= nil then
7864 7ece186a44d3 mod_tls: Return session.ssl_ctx if not nil, like when doing the full session type check Kim Alvefur <zash@zash.se> parents: 7863 diff changeset	92 return session.ssl_ctx;
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	93 end
2625 03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection Matthew Wild <mwild1@gmail.com> parents: 2623 diff changeset	94 if session.type == "c2s_unauthed" then
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	95 if not ssl_ctx_c2s and c2s_require_encryption then
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	96 session.log("error", "No TLS context available for c2s. Earlier error was: %s", err_c2s);
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	97 end
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	98 session.ssl_ctx = ssl_ctx_c2s;
6521 29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions Kim Alvefur <zash@zash.se> parents: 6487 diff changeset	99 session.ssl_cfg = ssl_cfg_c2s;
2933 e68ff49fa79b Merge 0.6->0.7 Matthew Wild <mwild1@gmail.com> parents: 2925 2932 diff changeset	100 elseif session.type == "s2sin_unauthed" and allow_s2s_tls then
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	101 if not ssl_ctx_s2sin and s2s_require_encryption then
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	102 session.log("error", "No TLS context available for s2sin. Earlier error was: %s", err_s2sin);
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	103 end
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	104 session.ssl_ctx = ssl_ctx_s2sin;
6521 29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions Kim Alvefur <zash@zash.se> parents: 6487 diff changeset	105 session.ssl_cfg = ssl_cfg_s2sin;
2933 e68ff49fa79b Merge 0.6->0.7 Matthew Wild <mwild1@gmail.com> parents: 2925 2932 diff changeset	106 elseif session.direction == "outgoing" and allow_s2s_tls then
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	107 if not ssl_ctx_s2sout and s2s_require_encryption then
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	108 session.log("error", "No TLS context available for s2sout. Earlier error was: %s", err_s2sout);
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	109 end
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	110 session.ssl_ctx = ssl_ctx_s2sout;
6521 29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions Kim Alvefur <zash@zash.se> parents: 6487 diff changeset	111 session.ssl_cfg = ssl_cfg_s2sout;
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	112 else
7898 d8029b2e0f43 mod_tls: Log reasons for not being able to do TLS Kim Alvefur <zash@zash.se> parents: 7869 diff changeset	113 session.log("debug", "Unknown session type, don't know which TLS context to use");
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	114 return false;
2625 03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection Matthew Wild <mwild1@gmail.com> parents: 2623 diff changeset	115 end
7863 a634fe3c21f2 mod_tls: Add debug logging for when TLS should be doable but no ssl context was set Kim Alvefur <zash@zash.se> parents: 7834 diff changeset	116 if not session.ssl_ctx then
a634fe3c21f2 mod_tls: Add debug logging for when TLS should be doable but no ssl context was set Kim Alvefur <zash@zash.se> parents: 7834 diff changeset	117 session.log("debug", "Should be able to do TLS but no context available");
a634fe3c21f2 mod_tls: Add debug logging for when TLS should be doable but no ssl context was set Kim Alvefur <zash@zash.se> parents: 7834 diff changeset	118 return false;
a634fe3c21f2 mod_tls: Add debug logging for when TLS should be doable but no ssl context was set Kim Alvefur <zash@zash.se> parents: 7834 diff changeset	119 end
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	120 return session.ssl_ctx;
2932 d2816fb6c7ea mod_tls: Add s2s_allow_encryption option which, when set to false, disabled TLS for s2s Matthew Wild <mwild1@gmail.com> parents: 2923 diff changeset	121 end
d2816fb6c7ea mod_tls: Add s2s_allow_encryption option which, when set to false, disabled TLS for s2s Matthew Wild <mwild1@gmail.com> parents: 2923 diff changeset	122
12207 65e252940337 mod_s2s: Retrieve TLS context for outgoing Direct TLS connections from mod_tls Kim Alvefur <zash@zash.se> parents: 11766 diff changeset	123 module:hook("s2sout-created", function (event)
65e252940337 mod_s2s: Retrieve TLS context for outgoing Direct TLS connections from mod_tls Kim Alvefur <zash@zash.se> parents: 11766 diff changeset	124 -- Initialize TLS context for outgoing connections
65e252940337 mod_s2s: Retrieve TLS context for outgoing Direct TLS connections from mod_tls Kim Alvefur <zash@zash.se> parents: 11766 diff changeset	125 can_do_tls(event.session);
65e252940337 mod_s2s: Retrieve TLS context for outgoing Direct TLS connections from mod_tls Kim Alvefur <zash@zash.se> parents: 11766 diff changeset	126 end);
65e252940337 mod_s2s: Retrieve TLS context for outgoing Direct TLS connections from mod_tls Kim Alvefur <zash@zash.se> parents: 11766 diff changeset	127
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	128 -- Hook <starttls/>
2600 1e6f3002e04f mod_tls: Inlined some code. Waqas Hussain <waqas20@gmail.com> parents: 2596 diff changeset	129 module:hook("stanza/urn:ietf:params:xml:ns:xmpp-tls:starttls", function(event)
1e6f3002e04f mod_tls: Inlined some code. Waqas Hussain <waqas20@gmail.com> parents: 2596 diff changeset	130 local origin = event.origin;
2625 03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection Matthew Wild <mwild1@gmail.com> parents: 2623 diff changeset	131 if can_do_tls(origin) then
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	132 (origin.sends2s or origin.send)(starttls_proceed);
11519 df4bd3af4099 mod_tls: Bail out if session got destroyed while sending <proceed/> Kim Alvefur <zash@zash.se> parents: 11341 diff changeset	133 if origin.destroyed then return end
2600 1e6f3002e04f mod_tls: Inlined some code. Waqas Hussain <waqas20@gmail.com> parents: 2596 diff changeset	134 origin:reset_stream();
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	135 origin.conn:starttls(origin.ssl_ctx);
4157 1b5a8e071a80 mod_tls: Drop 'TLS negotiation started for ...' to debug level from info Matthew Wild <mwild1@gmail.com> parents: 3583 diff changeset	136 origin.log("debug", "TLS negotiation started for %s...", origin.type);
2600 1e6f3002e04f mod_tls: Inlined some code. Waqas Hussain <waqas20@gmail.com> parents: 2596 diff changeset	137 origin.secure = false;
2595 015934e20f03 mod_tls: Switched to new events API. Waqas Hussain <waqas20@gmail.com> parents: 2594 diff changeset	138 else
015934e20f03 mod_tls: Switched to new events API. Waqas Hussain <waqas20@gmail.com> parents: 2594 diff changeset	139 origin.log("warn", "Attempt to start TLS, but TLS is not available on this %s connection", origin.type);
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	140 (origin.sends2s or origin.send)(starttls_failure);
2601 e64c6a4aa50b mod_tls: Respond with proper error when TLS cannot be negotiated. Waqas Hussain <waqas20@gmail.com> parents: 2600 diff changeset	141 origin:close();
2595 015934e20f03 mod_tls: Switched to new events API. Waqas Hussain <waqas20@gmail.com> parents: 2594 diff changeset	142 end
015934e20f03 mod_tls: Switched to new events API. Waqas Hussain <waqas20@gmail.com> parents: 2594 diff changeset	143 return true;
015934e20f03 mod_tls: Switched to new events API. Waqas Hussain <waqas20@gmail.com> parents: 2594 diff changeset	144 end);
2932 d2816fb6c7ea mod_tls: Add s2s_allow_encryption option which, when set to false, disabled TLS for s2s Matthew Wild <mwild1@gmail.com> parents: 2923 diff changeset	145
11727 f3aee8a825cc Fix various spelling errors (thanks codespell) Kim Alvefur <zash@zash.se> parents: 11580 diff changeset	146 -- Advertise stream feature
2607 35a5d1c5ea28 mod_tls: Hook stream-features event using new events API. Waqas Hussain <waqas20@gmail.com> parents: 2605 diff changeset	147 module:hook("stream-features", function(event)
35a5d1c5ea28 mod_tls: Hook stream-features event using new events API. Waqas Hussain <waqas20@gmail.com> parents: 2605 diff changeset	148 local origin, features = event.origin, event.features;
2625 03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection Matthew Wild <mwild1@gmail.com> parents: 2623 diff changeset	149 if can_do_tls(origin) then
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	150 features:add_child(c2s_feature);
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	151 end
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	152 end);
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	153 module:hook("s2s-stream-features", function(event)
2613 afa20941e098 s2smanager, mod_compression, mod_tls: Changed event.session to event.origin for s2s-stream-features event for consistency. Waqas Hussain <waqas20@gmail.com> parents: 2607 diff changeset	154 local origin, features = event.origin, event.features;
2625 03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection Matthew Wild <mwild1@gmail.com> parents: 2623 diff changeset	155 if can_do_tls(origin) then
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	156 features:add_child(s2s_feature);
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	157 end
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	158 end);
1875 334383faf77b mod_tls: Advertise and handle TLS for s2s connections Matthew Wild <mwild1@gmail.com> parents: 1675 diff changeset	159
334383faf77b mod_tls: Advertise and handle TLS for s2s connections Matthew Wild <mwild1@gmail.com> parents: 1675 diff changeset	160 -- For s2sout connections, start TLS if we can
7959 3941d609ff85 mod_tls: Switch to hook_tag from hook_stanza which was renamed in 2087d42f1e77 Kim Alvefur <zash@zash.se> parents: 7913 diff changeset	161 module:hook_tag("http://etherx.jabber.org/streams", "features", function (session, stanza)
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	162 module:log("debug", "Received features element");
11340 a7109eb45e30 mod_tls: Attempt STARTTLS even if not advertised as per RFC 7590 Kim Alvefur <zash@zash.se> parents: 10784 diff changeset	163 if can_do_tls(session) then
a7109eb45e30 mod_tls: Attempt STARTTLS even if not advertised as per RFC 7590 Kim Alvefur <zash@zash.se> parents: 10784 diff changeset	164 if stanza:get_child("starttls", xmlns_starttls) then
a7109eb45e30 mod_tls: Attempt STARTTLS even if not advertised as per RFC 7590 Kim Alvefur <zash@zash.se> parents: 10784 diff changeset	165 module:log("debug", "%s is offering TLS, taking up the offer...", session.to_host);
11341 c567e5e2b77a mod_tls: Ignore lack of STARTTLS offer only when s2s_require_encryption set Kim Alvefur <zash@zash.se> parents: 11340 diff changeset	166 elseif s2s_require_encryption then
c567e5e2b77a mod_tls: Ignore lack of STARTTLS offer only when s2s_require_encryption set Kim Alvefur <zash@zash.se> parents: 11340 diff changeset	167 module:log("debug", "%s is not offering TLS, trying anyways!", session.to_host);
11340 a7109eb45e30 mod_tls: Attempt STARTTLS even if not advertised as per RFC 7590 Kim Alvefur <zash@zash.se> parents: 10784 diff changeset	168 else
11341 c567e5e2b77a mod_tls: Ignore lack of STARTTLS offer only when s2s_require_encryption set Kim Alvefur <zash@zash.se> parents: 11340 diff changeset	169 module:log("debug", "%s is not offering TLS", session.to_host);
c567e5e2b77a mod_tls: Ignore lack of STARTTLS offer only when s2s_require_encryption set Kim Alvefur <zash@zash.se> parents: 11340 diff changeset	170 return;
11340 a7109eb45e30 mod_tls: Attempt STARTTLS even if not advertised as per RFC 7590 Kim Alvefur <zash@zash.se> parents: 10784 diff changeset	171 end
6709 b6eff3ba13de mod_tls: Build <starttls/> as a stanza instead of with string concatenation Kim Alvefur <zash@zash.se> parents: 6526 diff changeset	172 session.sends2s(starttls_initiate);
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	173 return true;
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	174 end
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	175 end, 500);
1875 334383faf77b mod_tls: Advertise and handle TLS for s2s connections Matthew Wild <mwild1@gmail.com> parents: 1675 diff changeset	176
11766 6ad335cd43f9 mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections Kim Alvefur <zash@zash.se> parents: 11727 diff changeset	177 module:hook("s2sout-authenticate-legacy", function(event)
6ad335cd43f9 mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections Kim Alvefur <zash@zash.se> parents: 11727 diff changeset	178 local session = event.origin;
6ad335cd43f9 mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections Kim Alvefur <zash@zash.se> parents: 11727 diff changeset	179 if s2s_require_encryption and can_do_tls(session) then
6ad335cd43f9 mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections Kim Alvefur <zash@zash.se> parents: 11727 diff changeset	180 session.sends2s(starttls_initiate);
6ad335cd43f9 mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections Kim Alvefur <zash@zash.se> parents: 11727 diff changeset	181 return true;
6ad335cd43f9 mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections Kim Alvefur <zash@zash.se> parents: 11727 diff changeset	182 end
6ad335cd43f9 mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections Kim Alvefur <zash@zash.se> parents: 11727 diff changeset	183 end, 200);
6ad335cd43f9 mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections Kim Alvefur <zash@zash.se> parents: 11727 diff changeset	184
7959 3941d609ff85 mod_tls: Switch to hook_tag from hook_stanza which was renamed in 2087d42f1e77 Kim Alvefur <zash@zash.se> parents: 7913 diff changeset	185 module:hook_tag(xmlns_starttls, "proceed", function (session, stanza) -- luacheck: ignore 212/stanza
7834 a2081d28bd22 mod_tls: Verify that TLS is available before proceeding Kim Alvefur <zash@zash.se> parents: 7833 diff changeset	186 if session.type == "s2sout_unauthed" and can_do_tls(session) then
7833 94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections Kim Alvefur <zash@zash.se> parents: 7712 diff changeset	187 module:log("debug", "Proceeding with TLS on s2sout...");
94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections Kim Alvefur <zash@zash.se> parents: 7712 diff changeset	188 session:reset_stream();
94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections Kim Alvefur <zash@zash.se> parents: 7712 diff changeset	189 session.conn:starttls(session.ssl_ctx);
94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections Kim Alvefur <zash@zash.se> parents: 7712 diff changeset	190 session.secure = false;
94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections Kim Alvefur <zash@zash.se> parents: 7712 diff changeset	191 return true;
94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections Kim Alvefur <zash@zash.se> parents: 7712 diff changeset	192 end
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	193 end);
11580 9ad5ec65132d mod_tls: Add "support" for <failure> by closing gracefully Kim Alvefur <zash@zash.se> parents: 11530 diff changeset	194
9ad5ec65132d mod_tls: Add "support" for <failure> by closing gracefully Kim Alvefur <zash@zash.se> parents: 11530 diff changeset	195 module:hook_tag(xmlns_starttls, "failure", function (session, stanza) -- luacheck: ignore 212/stanza
9ad5ec65132d mod_tls: Add "support" for <failure> by closing gracefully Kim Alvefur <zash@zash.se> parents: 11530 diff changeset	196 module:log("warn", "TLS negotiation with %s failed.", session.to_host);
9ad5ec65132d mod_tls: Add "support" for <failure> by closing gracefully Kim Alvefur <zash@zash.se> parents: 11530 diff changeset	197 session:close(nil, "TLS negotiation failed");
9ad5ec65132d mod_tls: Add "support" for <failure> by closing gracefully Kim Alvefur <zash@zash.se> parents: 11530 diff changeset	198 return false;
9ad5ec65132d mod_tls: Add "support" for <failure> by closing gracefully Kim Alvefur <zash@zash.se> parents: 11530 diff changeset	199 end);

prosody

b193f8a2737e

plugins/mod_tls.lua

Software / code / prosody

Annotate

plugins/mod_tls.lua @ 12482:b193f8a2737e

Software `/` code `/` prosody