Software `/` code `/` prosody

Annotate

plugins/mod_tls.lua @ 11906:ba3344926e18

MUC: Add option to include form in registration query This was originally not done based on my interpretation of XEP-0045. Today's reading, however, revealed that it actually says the result > SHOULD contain **at least** a <username/> element (emphasis mine) I take this to mean that including a form **is** allowed (and I think this is sensible). Tigase already includes the form I believe. I've gated the new behaviour behind a (default off) option, because it hasn't been tested for compatibility with clients. My primary desire for it is in Snikket, where the clients will be tested to ensure compatibility with this. I don't anticipate that (m)any clients would break, so maybe after 0.12 we can experiment with enabling it by default and eventually remove the option.

author	Matthew Wild <mwild1@gmail.com>
date	Mon, 15 Nov 2021 16:11:03 +0000
parent	11766:6ad335cd43f9
child	12207:65e252940337

rev	line source
1523 841d61be198f Remove version number from copyright headers Matthew Wild <mwild1@gmail.com> parents: 1219 diff changeset	1 -- Prosody IM
2923 b7049746bd29 Update copyright headers for 2010 Matthew Wild <mwild1@gmail.com> parents: 2877 diff changeset	2 -- Copyright (C) 2008-2010 Matthew Wild
b7049746bd29 Update copyright headers for 2010 Matthew Wild <mwild1@gmail.com> parents: 2877 diff changeset	3 -- Copyright (C) 2008-2010 Waqas Hussain
5776 bd0ff8ae98a8 Remove all trailing whitespace Florian Zeitz <florob@babelmonkeys.de> parents: 5698 diff changeset	4 --
758 b1885732e979 GPL->MIT! Matthew Wild <mwild1@gmail.com> parents: 705 diff changeset	5 -- This project is MIT/X11 licensed. Please see the
b1885732e979 GPL->MIT! Matthew Wild <mwild1@gmail.com> parents: 705 diff changeset	6 -- COPYING file in the source package for more information.
519 cccd610a0ef9 Insert copyright/license headers Matthew Wild <mwild1@gmail.com> parents: 438 diff changeset	7 --
cccd610a0ef9 Insert copyright/license headers Matthew Wild <mwild1@gmail.com> parents: 438 diff changeset	8
3571 675d65036f31 certmanager, hostmanager, mod_tls: Move responsibility for creating per-host SSL contexts to mod_tls, meaning reloading certs is now as trivial as reloading mod_tls Matthew Wild <mwild1@gmail.com> parents: 3397 diff changeset	9 local create_context = require "core.certmanager".create_context;
6832 9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	10 local rawgetopt = require"core.configmanager".rawget;
69 5b664c8fef86 forgot to commit mod_tls, oops :) Matthew Wild <mwild1@gmail.com> parents: diff changeset	11 local st = require "util.stanza";
99 ba08b8a4eeef Abstract connections with "connection listeners" Matthew Wild <mwild1@gmail.com> parents: 69 diff changeset	12
6487 edc63dc72566 mod_legacyauth, mod_saslauth, mod_tls: Pass require_encryption as default option to s2s_require_encryption so the later overrides the former Kim Alvefur <zash@zash.se> parents: 6302 diff changeset	13 local c2s_require_encryption = module:get_option("c2s_require_encryption", module:get_option("require_encryption"));
5987 bd90250ee1ee mod_tls: Rename variables to be less confusing Kim Alvefur <zash@zash.se> parents: 5976 diff changeset	14 local s2s_require_encryption = module:get_option("s2s_require_encryption");
2933 e68ff49fa79b Merge 0.6->0.7 Matthew Wild <mwild1@gmail.com> parents: 2925 2932 diff changeset	15 local allow_s2s_tls = module:get_option("s2s_allow_encryption") ~= false;
5988 177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ Kim Alvefur <zash@zash.se> parents: 5987 diff changeset	16 local s2s_secure_auth = module:get_option("s2s_secure_auth");
177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ Kim Alvefur <zash@zash.se> parents: 5987 diff changeset	17
177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ Kim Alvefur <zash@zash.se> parents: 5987 diff changeset	18 if s2s_secure_auth and s2s_require_encryption == false then
177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ Kim Alvefur <zash@zash.se> parents: 5987 diff changeset	19 module:log("warn", "s2s_secure_auth implies s2s_require_encryption, but s2s_require_encryption is set to false");
177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ Kim Alvefur <zash@zash.se> parents: 5987 diff changeset	20 s2s_require_encryption = true;
177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ Kim Alvefur <zash@zash.se> parents: 5987 diff changeset	21 end
1219 f14e08a0ae7f mod_tls: Add <required/> to stream feature when TLS is required Matthew Wild <mwild1@gmail.com> parents: 1213 diff changeset	22
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	23 local xmlns_starttls = 'urn:ietf:params:xml:ns:xmpp-tls';
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	24 local starttls_attr = { xmlns = xmlns_starttls };
6709 b6eff3ba13de mod_tls: Build <starttls/> as a stanza instead of with string concatenation Kim Alvefur <zash@zash.se> parents: 6526 diff changeset	25 local starttls_initiate= st.stanza("starttls", starttls_attr);
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	26 local starttls_proceed = st.stanza("proceed", starttls_attr);
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	27 local starttls_failure = st.stanza("failure", starttls_attr);
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	28 local c2s_feature = st.stanza("starttls", starttls_attr);
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	29 local s2s_feature = st.stanza("starttls", starttls_attr);
5987 bd90250ee1ee mod_tls: Rename variables to be less confusing Kim Alvefur <zash@zash.se> parents: 5976 diff changeset	30 if c2s_require_encryption then c2s_feature:tag("required"):up(); end
bd90250ee1ee mod_tls: Rename variables to be less confusing Kim Alvefur <zash@zash.se> parents: 5976 diff changeset	31 if s2s_require_encryption then s2s_feature:tag("required"):up(); end
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	32
5370 7838acadb0fa mod_announce, mod_auth_anonymous, mod_c2s, mod_c2s, mod_component, mod_iq, mod_message, mod_presence, mod_tls: Access prosody.{hosts,bare_sessions,full_sessions} instead of the old globals Kim Alvefur <zash@zash.se> parents: 4475 diff changeset	33 local hosts = prosody.hosts;
2872 cdc292d201fc mod_tls: Don't offer TLS on hosts that don't have any certs Matthew Wild <mwild1@gmail.com> parents: 2854 diff changeset	34 local host = hosts[module.host];
cdc292d201fc mod_tls: Don't offer TLS on hosts that don't have any certs Matthew Wild <mwild1@gmail.com> parents: 2854 diff changeset	35
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	36 local ssl_ctx_c2s, ssl_ctx_s2sout, ssl_ctx_s2sin;
6521 29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions Kim Alvefur <zash@zash.se> parents: 6487 diff changeset	37 local ssl_cfg_c2s, ssl_cfg_s2sout, ssl_cfg_s2sin;
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	38 local err_c2s, err_s2sin, err_s2sout;
8131 c8e3a0caa0a9 mod_tls: Rebuild SSL context objects on configuration reload - #701 Kim Alvefur <zash@zash.se> parents: 7959 diff changeset	39
10783 950082c1669e mod_tls: Log when certificates are (re)loaded Kim Alvefur <zash@zash.se> parents: 9971 diff changeset	40 function module.load(reload)
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	41 local NULL = {};
6832 9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	42 local modhost = module.host;
9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	43 local parent = modhost:match("%.(.*)$");
6296 66fb7b7c668d mod_tls: Simplify and use new ssl config merging in certmanager Kim Alvefur <zash@zash.se> parents: 5993 diff changeset	44
6832 9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	45 local parent_ssl = rawgetopt(parent, "ssl") or NULL;
9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	46 local host_ssl = rawgetopt(modhost, "ssl") or parent_ssl;
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	47
6832 9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	48 local global_c2s = rawgetopt("*", "c2s_ssl") or NULL;
9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	49 local parent_c2s = rawgetopt(parent, "c2s_ssl") or NULL;
6919 ab6c57633ce5 mod_tls: Fix ssl option fallback to a "parent" host if current host does not have ssl options set (thanks 70b1) Kim Alvefur <zash@zash.se> parents: 6918 diff changeset	50 local host_c2s = rawgetopt(modhost, "c2s_ssl") or parent_c2s;
6296 66fb7b7c668d mod_tls: Simplify and use new ssl config merging in certmanager Kim Alvefur <zash@zash.se> parents: 5993 diff changeset	51
6832 9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	52 local global_s2s = rawgetopt("*", "s2s_ssl") or NULL;
9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	53 local parent_s2s = rawgetopt(parent, "s2s_ssl") or NULL;
6919 ab6c57633ce5 mod_tls: Fix ssl option fallback to a "parent" host if current host does not have ssl options set (thanks 70b1) Kim Alvefur <zash@zash.se> parents: 6918 diff changeset	54 local host_s2s = rawgetopt(modhost, "s2s_ssl") or parent_s2s;
6296 66fb7b7c668d mod_tls: Simplify and use new ssl config merging in certmanager Kim Alvefur <zash@zash.se> parents: 5993 diff changeset	55
9971 5b048ccd106f mod_tls: Log debug message for each kind of TLS context created Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	56 module:log("debug", "Creating context for c2s");
9854 115b5e32d960 mod_tls: Restore querying for certificates on s2s Kim Alvefur <zash@zash.se> parents: 9740 diff changeset	57 local request_client_certs = { verify = { "peer", "client_once", }; };
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	58
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	59 ssl_ctx_c2s, err_c2s, ssl_cfg_c2s = create_context(host.host, "server", host_c2s, host_ssl, global_c2s); -- for incoming client connections
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	60 if not ssl_ctx_c2s then module:log("error", "Error creating context for c2s: %s", err_c2s); end
6521 29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions Kim Alvefur <zash@zash.se> parents: 6487 diff changeset	61
11530 a90389e7296c mod_tls: Fix order of debug messages and tls context creation Kim Alvefur <zash@zash.se> parents: 11519 diff changeset	62 module:log("debug", "Creating context for s2sout");
9854 115b5e32d960 mod_tls: Restore querying for certificates on s2s Kim Alvefur <zash@zash.se> parents: 9740 diff changeset	63 -- for outgoing server connections
115b5e32d960 mod_tls: Restore querying for certificates on s2s Kim Alvefur <zash@zash.se> parents: 9740 diff changeset	64 ssl_ctx_s2sout, err_s2sout, ssl_cfg_s2sout = create_context(host.host, "client", host_s2s, host_ssl, global_s2s, request_client_certs);
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	65 if not ssl_ctx_s2sout then module:log("error", "Error creating contexts for s2sout: %s", err_s2sout); end
6521 29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions Kim Alvefur <zash@zash.se> parents: 6487 diff changeset	66
11530 a90389e7296c mod_tls: Fix order of debug messages and tls context creation Kim Alvefur <zash@zash.se> parents: 11519 diff changeset	67 module:log("debug", "Creating context for s2sin");
9854 115b5e32d960 mod_tls: Restore querying for certificates on s2s Kim Alvefur <zash@zash.se> parents: 9740 diff changeset	68 -- for incoming server connections
115b5e32d960 mod_tls: Restore querying for certificates on s2s Kim Alvefur <zash@zash.se> parents: 9740 diff changeset	69 ssl_ctx_s2sin, err_s2sin, ssl_cfg_s2sin = create_context(host.host, "server", host_s2s, host_ssl, global_s2s, request_client_certs);
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	70 if not ssl_ctx_s2sin then module:log("error", "Error creating contexts for s2sin: %s", err_s2sin); end
10783 950082c1669e mod_tls: Log when certificates are (re)loaded Kim Alvefur <zash@zash.se> parents: 9971 diff changeset	71
950082c1669e mod_tls: Log when certificates are (re)loaded Kim Alvefur <zash@zash.se> parents: 9971 diff changeset	72 if reload then
950082c1669e mod_tls: Log when certificates are (re)loaded Kim Alvefur <zash@zash.se> parents: 9971 diff changeset	73 module:log("info", "Certificates reloaded");
950082c1669e mod_tls: Log when certificates are (re)loaded Kim Alvefur <zash@zash.se> parents: 9971 diff changeset	74 else
950082c1669e mod_tls: Log when certificates are (re)loaded Kim Alvefur <zash@zash.se> parents: 9971 diff changeset	75 module:log("info", "Certificates loaded");
950082c1669e mod_tls: Log when certificates are (re)loaded Kim Alvefur <zash@zash.se> parents: 9971 diff changeset	76 end
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	77 end
f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	78
8131 c8e3a0caa0a9 mod_tls: Rebuild SSL context objects on configuration reload - #701 Kim Alvefur <zash@zash.se> parents: 7959 diff changeset	79 module:hook_global("config-reloaded", module.load);
c8e3a0caa0a9 mod_tls: Rebuild SSL context objects on configuration reload - #701 Kim Alvefur <zash@zash.se> parents: 7959 diff changeset	80
2625 03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection Matthew Wild <mwild1@gmail.com> parents: 2623 diff changeset	81 local function can_do_tls(session)
7869 eb5fba4c8074 mod_tls: Check that connection has starttls method first to prevent offering starttls over tls (thanks Remko and Tobias) Kim Alvefur <zash@zash.se> parents: 7864 diff changeset	82 if not session.conn.starttls then
7913 64daa21450f9 mod_tls: Suppress debug message if already using encryption Kim Alvefur <zash@zash.se> parents: 7898 diff changeset	83 if not session.secure then
64daa21450f9 mod_tls: Suppress debug message if already using encryption Kim Alvefur <zash@zash.se> parents: 7898 diff changeset	84 session.log("debug", "Underlying connection does not support STARTTLS");
64daa21450f9 mod_tls: Suppress debug message if already using encryption Kim Alvefur <zash@zash.se> parents: 7898 diff changeset	85 end
7869 eb5fba4c8074 mod_tls: Check that connection has starttls method first to prevent offering starttls over tls (thanks Remko and Tobias) Kim Alvefur <zash@zash.se> parents: 7864 diff changeset	86 return false;
eb5fba4c8074 mod_tls: Check that connection has starttls method first to prevent offering starttls over tls (thanks Remko and Tobias) Kim Alvefur <zash@zash.se> parents: 7864 diff changeset	87 elseif session.ssl_ctx ~= nil then
7864 7ece186a44d3 mod_tls: Return session.ssl_ctx if not nil, like when doing the full session type check Kim Alvefur <zash@zash.se> parents: 7863 diff changeset	88 return session.ssl_ctx;
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	89 end
2625 03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection Matthew Wild <mwild1@gmail.com> parents: 2623 diff changeset	90 if session.type == "c2s_unauthed" then
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	91 if not ssl_ctx_c2s and c2s_require_encryption then
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	92 session.log("error", "No TLS context available for c2s. Earlier error was: %s", err_c2s);
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	93 end
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	94 session.ssl_ctx = ssl_ctx_c2s;
6521 29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions Kim Alvefur <zash@zash.se> parents: 6487 diff changeset	95 session.ssl_cfg = ssl_cfg_c2s;
2933 e68ff49fa79b Merge 0.6->0.7 Matthew Wild <mwild1@gmail.com> parents: 2925 2932 diff changeset	96 elseif session.type == "s2sin_unauthed" and allow_s2s_tls then
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	97 if not ssl_ctx_s2sin and s2s_require_encryption then
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	98 session.log("error", "No TLS context available for s2sin. Earlier error was: %s", err_s2sin);
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	99 end
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	100 session.ssl_ctx = ssl_ctx_s2sin;
6521 29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions Kim Alvefur <zash@zash.se> parents: 6487 diff changeset	101 session.ssl_cfg = ssl_cfg_s2sin;
2933 e68ff49fa79b Merge 0.6->0.7 Matthew Wild <mwild1@gmail.com> parents: 2925 2932 diff changeset	102 elseif session.direction == "outgoing" and allow_s2s_tls then
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	103 if not ssl_ctx_s2sout and s2s_require_encryption then
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	104 session.log("error", "No TLS context available for s2sout. Earlier error was: %s", err_s2sout);
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	105 end
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	106 session.ssl_ctx = ssl_ctx_s2sout;
6521 29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions Kim Alvefur <zash@zash.se> parents: 6487 diff changeset	107 session.ssl_cfg = ssl_cfg_s2sout;
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	108 else
7898 d8029b2e0f43 mod_tls: Log reasons for not being able to do TLS Kim Alvefur <zash@zash.se> parents: 7869 diff changeset	109 session.log("debug", "Unknown session type, don't know which TLS context to use");
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	110 return false;
2625 03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection Matthew Wild <mwild1@gmail.com> parents: 2623 diff changeset	111 end
7863 a634fe3c21f2 mod_tls: Add debug logging for when TLS should be doable but no ssl context was set Kim Alvefur <zash@zash.se> parents: 7834 diff changeset	112 if not session.ssl_ctx then
a634fe3c21f2 mod_tls: Add debug logging for when TLS should be doable but no ssl context was set Kim Alvefur <zash@zash.se> parents: 7834 diff changeset	113 session.log("debug", "Should be able to do TLS but no context available");
a634fe3c21f2 mod_tls: Add debug logging for when TLS should be doable but no ssl context was set Kim Alvefur <zash@zash.se> parents: 7834 diff changeset	114 return false;
a634fe3c21f2 mod_tls: Add debug logging for when TLS should be doable but no ssl context was set Kim Alvefur <zash@zash.se> parents: 7834 diff changeset	115 end
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	116 return session.ssl_ctx;
2932 d2816fb6c7ea mod_tls: Add s2s_allow_encryption option which, when set to false, disabled TLS for s2s Matthew Wild <mwild1@gmail.com> parents: 2923 diff changeset	117 end
d2816fb6c7ea mod_tls: Add s2s_allow_encryption option which, when set to false, disabled TLS for s2s Matthew Wild <mwild1@gmail.com> parents: 2923 diff changeset	118
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	119 -- Hook <starttls/>
2600 1e6f3002e04f mod_tls: Inlined some code. Waqas Hussain <waqas20@gmail.com> parents: 2596 diff changeset	120 module:hook("stanza/urn:ietf:params:xml:ns:xmpp-tls:starttls", function(event)
1e6f3002e04f mod_tls: Inlined some code. Waqas Hussain <waqas20@gmail.com> parents: 2596 diff changeset	121 local origin = event.origin;
2625 03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection Matthew Wild <mwild1@gmail.com> parents: 2623 diff changeset	122 if can_do_tls(origin) then
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	123 (origin.sends2s or origin.send)(starttls_proceed);
11519 df4bd3af4099 mod_tls: Bail out if session got destroyed while sending <proceed/> Kim Alvefur <zash@zash.se> parents: 11341 diff changeset	124 if origin.destroyed then return end
2600 1e6f3002e04f mod_tls: Inlined some code. Waqas Hussain <waqas20@gmail.com> parents: 2596 diff changeset	125 origin:reset_stream();
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	126 origin.conn:starttls(origin.ssl_ctx);
4157 1b5a8e071a80 mod_tls: Drop 'TLS negotiation started for ...' to debug level from info Matthew Wild <mwild1@gmail.com> parents: 3583 diff changeset	127 origin.log("debug", "TLS negotiation started for %s...", origin.type);
2600 1e6f3002e04f mod_tls: Inlined some code. Waqas Hussain <waqas20@gmail.com> parents: 2596 diff changeset	128 origin.secure = false;
2595 015934e20f03 mod_tls: Switched to new events API. Waqas Hussain <waqas20@gmail.com> parents: 2594 diff changeset	129 else
015934e20f03 mod_tls: Switched to new events API. Waqas Hussain <waqas20@gmail.com> parents: 2594 diff changeset	130 origin.log("warn", "Attempt to start TLS, but TLS is not available on this %s connection", origin.type);
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	131 (origin.sends2s or origin.send)(starttls_failure);
2601 e64c6a4aa50b mod_tls: Respond with proper error when TLS cannot be negotiated. Waqas Hussain <waqas20@gmail.com> parents: 2600 diff changeset	132 origin:close();
2595 015934e20f03 mod_tls: Switched to new events API. Waqas Hussain <waqas20@gmail.com> parents: 2594 diff changeset	133 end
015934e20f03 mod_tls: Switched to new events API. Waqas Hussain <waqas20@gmail.com> parents: 2594 diff changeset	134 return true;
015934e20f03 mod_tls: Switched to new events API. Waqas Hussain <waqas20@gmail.com> parents: 2594 diff changeset	135 end);
2932 d2816fb6c7ea mod_tls: Add s2s_allow_encryption option which, when set to false, disabled TLS for s2s Matthew Wild <mwild1@gmail.com> parents: 2923 diff changeset	136
11727 f3aee8a825cc Fix various spelling errors (thanks codespell) Kim Alvefur <zash@zash.se> parents: 11580 diff changeset	137 -- Advertise stream feature
2607 35a5d1c5ea28 mod_tls: Hook stream-features event using new events API. Waqas Hussain <waqas20@gmail.com> parents: 2605 diff changeset	138 module:hook("stream-features", function(event)
35a5d1c5ea28 mod_tls: Hook stream-features event using new events API. Waqas Hussain <waqas20@gmail.com> parents: 2605 diff changeset	139 local origin, features = event.origin, event.features;
2625 03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection Matthew Wild <mwild1@gmail.com> parents: 2623 diff changeset	140 if can_do_tls(origin) then
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	141 features:add_child(c2s_feature);
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	142 end
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	143 end);
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	144 module:hook("s2s-stream-features", function(event)
2613 afa20941e098 s2smanager, mod_compression, mod_tls: Changed event.session to event.origin for s2s-stream-features event for consistency. Waqas Hussain <waqas20@gmail.com> parents: 2607 diff changeset	145 local origin, features = event.origin, event.features;
2625 03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection Matthew Wild <mwild1@gmail.com> parents: 2623 diff changeset	146 if can_do_tls(origin) then
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	147 features:add_child(s2s_feature);
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	148 end
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	149 end);
1875 334383faf77b mod_tls: Advertise and handle TLS for s2s connections Matthew Wild <mwild1@gmail.com> parents: 1675 diff changeset	150
334383faf77b mod_tls: Advertise and handle TLS for s2s connections Matthew Wild <mwild1@gmail.com> parents: 1675 diff changeset	151 -- For s2sout connections, start TLS if we can
7959 3941d609ff85 mod_tls: Switch to hook_tag from hook_stanza which was renamed in 2087d42f1e77 Kim Alvefur <zash@zash.se> parents: 7913 diff changeset	152 module:hook_tag("http://etherx.jabber.org/streams", "features", function (session, stanza)
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	153 module:log("debug", "Received features element");
11340 a7109eb45e30 mod_tls: Attempt STARTTLS even if not advertised as per RFC 7590 Kim Alvefur <zash@zash.se> parents: 10784 diff changeset	154 if can_do_tls(session) then
a7109eb45e30 mod_tls: Attempt STARTTLS even if not advertised as per RFC 7590 Kim Alvefur <zash@zash.se> parents: 10784 diff changeset	155 if stanza:get_child("starttls", xmlns_starttls) then
a7109eb45e30 mod_tls: Attempt STARTTLS even if not advertised as per RFC 7590 Kim Alvefur <zash@zash.se> parents: 10784 diff changeset	156 module:log("debug", "%s is offering TLS, taking up the offer...", session.to_host);
11341 c567e5e2b77a mod_tls: Ignore lack of STARTTLS offer only when s2s_require_encryption set Kim Alvefur <zash@zash.se> parents: 11340 diff changeset	157 elseif s2s_require_encryption then
c567e5e2b77a mod_tls: Ignore lack of STARTTLS offer only when s2s_require_encryption set Kim Alvefur <zash@zash.se> parents: 11340 diff changeset	158 module:log("debug", "%s is not offering TLS, trying anyways!", session.to_host);
11340 a7109eb45e30 mod_tls: Attempt STARTTLS even if not advertised as per RFC 7590 Kim Alvefur <zash@zash.se> parents: 10784 diff changeset	159 else
11341 c567e5e2b77a mod_tls: Ignore lack of STARTTLS offer only when s2s_require_encryption set Kim Alvefur <zash@zash.se> parents: 11340 diff changeset	160 module:log("debug", "%s is not offering TLS", session.to_host);
c567e5e2b77a mod_tls: Ignore lack of STARTTLS offer only when s2s_require_encryption set Kim Alvefur <zash@zash.se> parents: 11340 diff changeset	161 return;
11340 a7109eb45e30 mod_tls: Attempt STARTTLS even if not advertised as per RFC 7590 Kim Alvefur <zash@zash.se> parents: 10784 diff changeset	162 end
6709 b6eff3ba13de mod_tls: Build <starttls/> as a stanza instead of with string concatenation Kim Alvefur <zash@zash.se> parents: 6526 diff changeset	163 session.sends2s(starttls_initiate);
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	164 return true;
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	165 end
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	166 end, 500);
1875 334383faf77b mod_tls: Advertise and handle TLS for s2s connections Matthew Wild <mwild1@gmail.com> parents: 1675 diff changeset	167
11766 6ad335cd43f9 mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections Kim Alvefur <zash@zash.se> parents: 11727 diff changeset	168 module:hook("s2sout-authenticate-legacy", function(event)
6ad335cd43f9 mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections Kim Alvefur <zash@zash.se> parents: 11727 diff changeset	169 local session = event.origin;
6ad335cd43f9 mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections Kim Alvefur <zash@zash.se> parents: 11727 diff changeset	170 if s2s_require_encryption and can_do_tls(session) then
6ad335cd43f9 mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections Kim Alvefur <zash@zash.se> parents: 11727 diff changeset	171 session.sends2s(starttls_initiate);
6ad335cd43f9 mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections Kim Alvefur <zash@zash.se> parents: 11727 diff changeset	172 return true;
6ad335cd43f9 mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections Kim Alvefur <zash@zash.se> parents: 11727 diff changeset	173 end
6ad335cd43f9 mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections Kim Alvefur <zash@zash.se> parents: 11727 diff changeset	174 end, 200);
6ad335cd43f9 mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections Kim Alvefur <zash@zash.se> parents: 11727 diff changeset	175
7959 3941d609ff85 mod_tls: Switch to hook_tag from hook_stanza which was renamed in 2087d42f1e77 Kim Alvefur <zash@zash.se> parents: 7913 diff changeset	176 module:hook_tag(xmlns_starttls, "proceed", function (session, stanza) -- luacheck: ignore 212/stanza
7834 a2081d28bd22 mod_tls: Verify that TLS is available before proceeding Kim Alvefur <zash@zash.se> parents: 7833 diff changeset	177 if session.type == "s2sout_unauthed" and can_do_tls(session) then
7833 94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections Kim Alvefur <zash@zash.se> parents: 7712 diff changeset	178 module:log("debug", "Proceeding with TLS on s2sout...");
94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections Kim Alvefur <zash@zash.se> parents: 7712 diff changeset	179 session:reset_stream();
94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections Kim Alvefur <zash@zash.se> parents: 7712 diff changeset	180 session.conn:starttls(session.ssl_ctx);
94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections Kim Alvefur <zash@zash.se> parents: 7712 diff changeset	181 session.secure = false;
94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections Kim Alvefur <zash@zash.se> parents: 7712 diff changeset	182 return true;
94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections Kim Alvefur <zash@zash.se> parents: 7712 diff changeset	183 end
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	184 end);
11580 9ad5ec65132d mod_tls: Add "support" for <failure> by closing gracefully Kim Alvefur <zash@zash.se> parents: 11530 diff changeset	185
9ad5ec65132d mod_tls: Add "support" for <failure> by closing gracefully Kim Alvefur <zash@zash.se> parents: 11530 diff changeset	186 module:hook_tag(xmlns_starttls, "failure", function (session, stanza) -- luacheck: ignore 212/stanza
9ad5ec65132d mod_tls: Add "support" for <failure> by closing gracefully Kim Alvefur <zash@zash.se> parents: 11530 diff changeset	187 module:log("warn", "TLS negotiation with %s failed.", session.to_host);
9ad5ec65132d mod_tls: Add "support" for <failure> by closing gracefully Kim Alvefur <zash@zash.se> parents: 11530 diff changeset	188 session:close(nil, "TLS negotiation failed");
9ad5ec65132d mod_tls: Add "support" for <failure> by closing gracefully Kim Alvefur <zash@zash.se> parents: 11530 diff changeset	189 return false;
9ad5ec65132d mod_tls: Add "support" for <failure> by closing gracefully Kim Alvefur <zash@zash.se> parents: 11530 diff changeset	190 end);

prosody

ba3344926e18

plugins/mod_tls.lua

Software / code / prosody

Annotate

plugins/mod_tls.lua @ 11906:ba3344926e18

Software `/` code `/` prosody