Software `/` code `/` prosody

Annotate

plugins/mod_tls.lua @ 10303:c434bff22b14

mod_csi_simple: Always remove session filters when disabling CSI Only guard the actual pausing of outgoing data on the method existing. This prevents the filters from lingering in case something happened to the connection. Removing already removed filters should be a safe noop.

author	Kim Alvefur <zash@zash.se>
date	Sat, 05 Oct 2019 16:55:58 +0200
parent	9975:ca01c449357f
child	10784:0b0fe73199d2

rev	line source
1523 841d61be198f Remove version number from copyright headers Matthew Wild <mwild1@gmail.com> parents: 1219 diff changeset	1 -- Prosody IM
2923 b7049746bd29 Update copyright headers for 2010 Matthew Wild <mwild1@gmail.com> parents: 2877 diff changeset	2 -- Copyright (C) 2008-2010 Matthew Wild
b7049746bd29 Update copyright headers for 2010 Matthew Wild <mwild1@gmail.com> parents: 2877 diff changeset	3 -- Copyright (C) 2008-2010 Waqas Hussain
5776 bd0ff8ae98a8 Remove all trailing whitespace Florian Zeitz <florob@babelmonkeys.de> parents: 5698 diff changeset	4 --
758 b1885732e979 GPL->MIT! Matthew Wild <mwild1@gmail.com> parents: 705 diff changeset	5 -- This project is MIT/X11 licensed. Please see the
b1885732e979 GPL->MIT! Matthew Wild <mwild1@gmail.com> parents: 705 diff changeset	6 -- COPYING file in the source package for more information.
519 cccd610a0ef9 Insert copyright/license headers Matthew Wild <mwild1@gmail.com> parents: 438 diff changeset	7 --
cccd610a0ef9 Insert copyright/license headers Matthew Wild <mwild1@gmail.com> parents: 438 diff changeset	8
3571 675d65036f31 certmanager, hostmanager, mod_tls: Move responsibility for creating per-host SSL contexts to mod_tls, meaning reloading certs is now as trivial as reloading mod_tls Matthew Wild <mwild1@gmail.com> parents: 3397 diff changeset	9 local create_context = require "core.certmanager".create_context;
6832 9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	10 local rawgetopt = require"core.configmanager".rawget;
69 5b664c8fef86 forgot to commit mod_tls, oops :) Matthew Wild <mwild1@gmail.com> parents: diff changeset	11 local st = require "util.stanza";
99 ba08b8a4eeef Abstract connections with "connection listeners" Matthew Wild <mwild1@gmail.com> parents: 69 diff changeset	12
6487 edc63dc72566 mod_legacyauth, mod_saslauth, mod_tls: Pass require_encryption as default option to s2s_require_encryption so the later overrides the former Kim Alvefur <zash@zash.se> parents: 6302 diff changeset	13 local c2s_require_encryption = module:get_option("c2s_require_encryption", module:get_option("require_encryption"));
5987 bd90250ee1ee mod_tls: Rename variables to be less confusing Kim Alvefur <zash@zash.se> parents: 5976 diff changeset	14 local s2s_require_encryption = module:get_option("s2s_require_encryption");
2933 e68ff49fa79b Merge 0.6->0.7 Matthew Wild <mwild1@gmail.com> parents: 2925 2932 diff changeset	15 local allow_s2s_tls = module:get_option("s2s_allow_encryption") ~= false;
5988 177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ Kim Alvefur <zash@zash.se> parents: 5987 diff changeset	16 local s2s_secure_auth = module:get_option("s2s_secure_auth");
177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ Kim Alvefur <zash@zash.se> parents: 5987 diff changeset	17
177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ Kim Alvefur <zash@zash.se> parents: 5987 diff changeset	18 if s2s_secure_auth and s2s_require_encryption == false then
177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ Kim Alvefur <zash@zash.se> parents: 5987 diff changeset	19 module:log("warn", "s2s_secure_auth implies s2s_require_encryption, but s2s_require_encryption is set to false");
177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ Kim Alvefur <zash@zash.se> parents: 5987 diff changeset	20 s2s_require_encryption = true;
177f233b5211 mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ Kim Alvefur <zash@zash.se> parents: 5987 diff changeset	21 end
1219 f14e08a0ae7f mod_tls: Add <required/> to stream feature when TLS is required Matthew Wild <mwild1@gmail.com> parents: 1213 diff changeset	22
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	23 local xmlns_starttls = 'urn:ietf:params:xml:ns:xmpp-tls';
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	24 local starttls_attr = { xmlns = xmlns_starttls };
6709 b6eff3ba13de mod_tls: Build <starttls/> as a stanza instead of with string concatenation Kim Alvefur <zash@zash.se> parents: 6526 diff changeset	25 local starttls_initiate= st.stanza("starttls", starttls_attr);
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	26 local starttls_proceed = st.stanza("proceed", starttls_attr);
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	27 local starttls_failure = st.stanza("failure", starttls_attr);
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	28 local c2s_feature = st.stanza("starttls", starttls_attr);
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	29 local s2s_feature = st.stanza("starttls", starttls_attr);
5987 bd90250ee1ee mod_tls: Rename variables to be less confusing Kim Alvefur <zash@zash.se> parents: 5976 diff changeset	30 if c2s_require_encryption then c2s_feature:tag("required"):up(); end
bd90250ee1ee mod_tls: Rename variables to be less confusing Kim Alvefur <zash@zash.se> parents: 5976 diff changeset	31 if s2s_require_encryption then s2s_feature:tag("required"):up(); end
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	32
5370 7838acadb0fa mod_announce, mod_auth_anonymous, mod_c2s, mod_c2s, mod_component, mod_iq, mod_message, mod_presence, mod_tls: Access prosody.{hosts,bare_sessions,full_sessions} instead of the old globals Kim Alvefur <zash@zash.se> parents: 4475 diff changeset	33 local hosts = prosody.hosts;
2872 cdc292d201fc mod_tls: Don't offer TLS on hosts that don't have any certs Matthew Wild <mwild1@gmail.com> parents: 2854 diff changeset	34 local host = hosts[module.host];
cdc292d201fc mod_tls: Don't offer TLS on hosts that don't have any certs Matthew Wild <mwild1@gmail.com> parents: 2854 diff changeset	35
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	36 local ssl_ctx_c2s, ssl_ctx_s2sout, ssl_ctx_s2sin;
6521 29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions Kim Alvefur <zash@zash.se> parents: 6487 diff changeset	37 local ssl_cfg_c2s, ssl_cfg_s2sout, ssl_cfg_s2sin;
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	38 local err_c2s, err_s2sin, err_s2sout;
8131 c8e3a0caa0a9 mod_tls: Rebuild SSL context objects on configuration reload - #701 Kim Alvefur <zash@zash.se> parents: 7959 diff changeset	39
c8e3a0caa0a9 mod_tls: Rebuild SSL context objects on configuration reload - #701 Kim Alvefur <zash@zash.se> parents: 7959 diff changeset	40 function module.load()
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	41 local NULL = {};
6832 9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	42 local modhost = module.host;
9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	43 local parent = modhost:match("%.(.*)$");
6296 66fb7b7c668d mod_tls: Simplify and use new ssl config merging in certmanager Kim Alvefur <zash@zash.se> parents: 5993 diff changeset	44
6832 9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	45 local parent_ssl = rawgetopt(parent, "ssl") or NULL;
9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	46 local host_ssl = rawgetopt(modhost, "ssl") or parent_ssl;
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	47
6832 9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	48 local global_c2s = rawgetopt("*", "c2s_ssl") or NULL;
9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	49 local parent_c2s = rawgetopt(parent, "c2s_ssl") or NULL;
6919 ab6c57633ce5 mod_tls: Fix ssl option fallback to a "parent" host if current host does not have ssl options set (thanks 70b1) Kim Alvefur <zash@zash.se> parents: 6918 diff changeset	50 local host_c2s = rawgetopt(modhost, "c2s_ssl") or parent_c2s;
6296 66fb7b7c668d mod_tls: Simplify and use new ssl config merging in certmanager Kim Alvefur <zash@zash.se> parents: 5993 diff changeset	51
6832 9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	52 local global_s2s = rawgetopt("*", "s2s_ssl") or NULL;
9566a15d3e59 mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511) Kim Alvefur <zash@zash.se> parents: 6710 diff changeset	53 local parent_s2s = rawgetopt(parent, "s2s_ssl") or NULL;
6919 ab6c57633ce5 mod_tls: Fix ssl option fallback to a "parent" host if current host does not have ssl options set (thanks 70b1) Kim Alvefur <zash@zash.se> parents: 6918 diff changeset	54 local host_s2s = rawgetopt(modhost, "s2s_ssl") or parent_s2s;
6296 66fb7b7c668d mod_tls: Simplify and use new ssl config merging in certmanager Kim Alvefur <zash@zash.se> parents: 5993 diff changeset	55
9971 5b048ccd106f mod_tls: Log debug message for each kind of TLS context created Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	56 module:log("debug", "Creating context for c2s");
9854 115b5e32d960 mod_tls: Restore querying for certificates on s2s Kim Alvefur <zash@zash.se> parents: 9740 diff changeset	57 local request_client_certs = { verify = { "peer", "client_once", }; };
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	58
9971 5b048ccd106f mod_tls: Log debug message for each kind of TLS context created Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	59 module:log("debug", "Creating context for s2sout");
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	60 ssl_ctx_c2s, err_c2s, ssl_cfg_c2s = create_context(host.host, "server", host_c2s, host_ssl, global_c2s); -- for incoming client connections
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	61 if not ssl_ctx_c2s then module:log("error", "Error creating context for c2s: %s", err_c2s); end
6521 29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions Kim Alvefur <zash@zash.se> parents: 6487 diff changeset	62
9971 5b048ccd106f mod_tls: Log debug message for each kind of TLS context created Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	63 module:log("debug", "Creating context for s2sin");
9854 115b5e32d960 mod_tls: Restore querying for certificates on s2s Kim Alvefur <zash@zash.se> parents: 9740 diff changeset	64 -- for outgoing server connections
115b5e32d960 mod_tls: Restore querying for certificates on s2s Kim Alvefur <zash@zash.se> parents: 9740 diff changeset	65 ssl_ctx_s2sout, err_s2sout, ssl_cfg_s2sout = create_context(host.host, "client", host_s2s, host_ssl, global_s2s, request_client_certs);
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	66 if not ssl_ctx_s2sout then module:log("error", "Error creating contexts for s2sout: %s", err_s2sout); end
6521 29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions Kim Alvefur <zash@zash.se> parents: 6487 diff changeset	67
9854 115b5e32d960 mod_tls: Restore querying for certificates on s2s Kim Alvefur <zash@zash.se> parents: 9740 diff changeset	68 -- for incoming server connections
115b5e32d960 mod_tls: Restore querying for certificates on s2s Kim Alvefur <zash@zash.se> parents: 9740 diff changeset	69 ssl_ctx_s2sin, err_s2sin, ssl_cfg_s2sin = create_context(host.host, "server", host_s2s, host_ssl, global_s2s, request_client_certs);
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	70 if not ssl_ctx_s2sin then module:log("error", "Error creating contexts for s2sin: %s", err_s2sin); end
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	71 end
f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	72
8131 c8e3a0caa0a9 mod_tls: Rebuild SSL context objects on configuration reload - #701 Kim Alvefur <zash@zash.se> parents: 7959 diff changeset	73 module:hook_global("config-reloaded", module.load);
c8e3a0caa0a9 mod_tls: Rebuild SSL context objects on configuration reload - #701 Kim Alvefur <zash@zash.se> parents: 7959 diff changeset	74
2625 03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection Matthew Wild <mwild1@gmail.com> parents: 2623 diff changeset	75 local function can_do_tls(session)
7869 eb5fba4c8074 mod_tls: Check that connection has starttls method first to prevent offering starttls over tls (thanks Remko and Tobias) Kim Alvefur <zash@zash.se> parents: 7864 diff changeset	76 if not session.conn.starttls then
7913 64daa21450f9 mod_tls: Suppress debug message if already using encryption Kim Alvefur <zash@zash.se> parents: 7898 diff changeset	77 if not session.secure then
64daa21450f9 mod_tls: Suppress debug message if already using encryption Kim Alvefur <zash@zash.se> parents: 7898 diff changeset	78 session.log("debug", "Underlying connection does not support STARTTLS");
64daa21450f9 mod_tls: Suppress debug message if already using encryption Kim Alvefur <zash@zash.se> parents: 7898 diff changeset	79 end
7869 eb5fba4c8074 mod_tls: Check that connection has starttls method first to prevent offering starttls over tls (thanks Remko and Tobias) Kim Alvefur <zash@zash.se> parents: 7864 diff changeset	80 return false;
eb5fba4c8074 mod_tls: Check that connection has starttls method first to prevent offering starttls over tls (thanks Remko and Tobias) Kim Alvefur <zash@zash.se> parents: 7864 diff changeset	81 elseif session.ssl_ctx ~= nil then
7864 7ece186a44d3 mod_tls: Return session.ssl_ctx if not nil, like when doing the full session type check Kim Alvefur <zash@zash.se> parents: 7863 diff changeset	82 return session.ssl_ctx;
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	83 end
2625 03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection Matthew Wild <mwild1@gmail.com> parents: 2623 diff changeset	84 if session.type == "c2s_unauthed" then
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	85 if not ssl_ctx_c2s and c2s_require_encryption then
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	86 session.log("error", "No TLS context available for c2s. Earlier error was: %s", err_c2s);
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	87 end
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	88 session.ssl_ctx = ssl_ctx_c2s;
6521 29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions Kim Alvefur <zash@zash.se> parents: 6487 diff changeset	89 session.ssl_cfg = ssl_cfg_c2s;
2933 e68ff49fa79b Merge 0.6->0.7 Matthew Wild <mwild1@gmail.com> parents: 2925 2932 diff changeset	90 elseif session.type == "s2sin_unauthed" and allow_s2s_tls then
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	91 if not ssl_ctx_s2sin and s2s_require_encryption then
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	92 session.log("error", "No TLS context available for s2sin. Earlier error was: %s", err_s2sin);
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	93 end
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	94 session.ssl_ctx = ssl_ctx_s2sin;
6521 29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions Kim Alvefur <zash@zash.se> parents: 6487 diff changeset	95 session.ssl_cfg = ssl_cfg_s2sin;
2933 e68ff49fa79b Merge 0.6->0.7 Matthew Wild <mwild1@gmail.com> parents: 2925 2932 diff changeset	96 elseif session.direction == "outgoing" and allow_s2s_tls then
9740 4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	97 if not ssl_ctx_s2sout and s2s_require_encryption then
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	98 session.log("error", "No TLS context available for s2sout. Earlier error was: %s", err_s2sout);
4b34687ede3f mod_tls: Keep TLS context errors and repeat them again for each session Kim Alvefur <zash@zash.se> parents: 8131 diff changeset	99 end
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	100 session.ssl_ctx = ssl_ctx_s2sout;
6521 29c7586665f5 mod_tls: Keep ssl config around and attach them to sessions Kim Alvefur <zash@zash.se> parents: 6487 diff changeset	101 session.ssl_cfg = ssl_cfg_s2sout;
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	102 else
7898 d8029b2e0f43 mod_tls: Log reasons for not being able to do TLS Kim Alvefur <zash@zash.se> parents: 7869 diff changeset	103 session.log("debug", "Unknown session type, don't know which TLS context to use");
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	104 return false;
2625 03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection Matthew Wild <mwild1@gmail.com> parents: 2623 diff changeset	105 end
7863 a634fe3c21f2 mod_tls: Add debug logging for when TLS should be doable but no ssl context was set Kim Alvefur <zash@zash.se> parents: 7834 diff changeset	106 if not session.ssl_ctx then
a634fe3c21f2 mod_tls: Add debug logging for when TLS should be doable but no ssl context was set Kim Alvefur <zash@zash.se> parents: 7834 diff changeset	107 session.log("debug", "Should be able to do TLS but no context available");
a634fe3c21f2 mod_tls: Add debug logging for when TLS should be doable but no ssl context was set Kim Alvefur <zash@zash.se> parents: 7834 diff changeset	108 return false;
a634fe3c21f2 mod_tls: Add debug logging for when TLS should be doable but no ssl context was set Kim Alvefur <zash@zash.se> parents: 7834 diff changeset	109 end
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	110 return session.ssl_ctx;
2932 d2816fb6c7ea mod_tls: Add s2s_allow_encryption option which, when set to false, disabled TLS for s2s Matthew Wild <mwild1@gmail.com> parents: 2923 diff changeset	111 end
d2816fb6c7ea mod_tls: Add s2s_allow_encryption option which, when set to false, disabled TLS for s2s Matthew Wild <mwild1@gmail.com> parents: 2923 diff changeset	112
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	113 -- Hook <starttls/>
2600 1e6f3002e04f mod_tls: Inlined some code. Waqas Hussain <waqas20@gmail.com> parents: 2596 diff changeset	114 module:hook("stanza/urn:ietf:params:xml:ns:xmpp-tls:starttls", function(event)
1e6f3002e04f mod_tls: Inlined some code. Waqas Hussain <waqas20@gmail.com> parents: 2596 diff changeset	115 local origin = event.origin;
2625 03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection Matthew Wild <mwild1@gmail.com> parents: 2623 diff changeset	116 if can_do_tls(origin) then
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	117 (origin.sends2s or origin.send)(starttls_proceed);
2600 1e6f3002e04f mod_tls: Inlined some code. Waqas Hussain <waqas20@gmail.com> parents: 2596 diff changeset	118 origin:reset_stream();
5685 f965ac6b7ce1 mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections Kim Alvefur <zash@zash.se> parents: 5378 diff changeset	119 origin.conn:starttls(origin.ssl_ctx);
4157 1b5a8e071a80 mod_tls: Drop 'TLS negotiation started for ...' to debug level from info Matthew Wild <mwild1@gmail.com> parents: 3583 diff changeset	120 origin.log("debug", "TLS negotiation started for %s...", origin.type);
2600 1e6f3002e04f mod_tls: Inlined some code. Waqas Hussain <waqas20@gmail.com> parents: 2596 diff changeset	121 origin.secure = false;
2595 015934e20f03 mod_tls: Switched to new events API. Waqas Hussain <waqas20@gmail.com> parents: 2594 diff changeset	122 else
015934e20f03 mod_tls: Switched to new events API. Waqas Hussain <waqas20@gmail.com> parents: 2594 diff changeset	123 origin.log("warn", "Attempt to start TLS, but TLS is not available on this %s connection", origin.type);
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	124 (origin.sends2s or origin.send)(starttls_failure);
2601 e64c6a4aa50b mod_tls: Respond with proper error when TLS cannot be negotiated. Waqas Hussain <waqas20@gmail.com> parents: 2600 diff changeset	125 origin:close();
2595 015934e20f03 mod_tls: Switched to new events API. Waqas Hussain <waqas20@gmail.com> parents: 2594 diff changeset	126 end
015934e20f03 mod_tls: Switched to new events API. Waqas Hussain <waqas20@gmail.com> parents: 2594 diff changeset	127 return true;
015934e20f03 mod_tls: Switched to new events API. Waqas Hussain <waqas20@gmail.com> parents: 2594 diff changeset	128 end);
2932 d2816fb6c7ea mod_tls: Add s2s_allow_encryption option which, when set to false, disabled TLS for s2s Matthew Wild <mwild1@gmail.com> parents: 2923 diff changeset	129
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	130 -- Advertize stream feature
2607 35a5d1c5ea28 mod_tls: Hook stream-features event using new events API. Waqas Hussain <waqas20@gmail.com> parents: 2605 diff changeset	131 module:hook("stream-features", function(event)
35a5d1c5ea28 mod_tls: Hook stream-features event using new events API. Waqas Hussain <waqas20@gmail.com> parents: 2605 diff changeset	132 local origin, features = event.origin, event.features;
2625 03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection Matthew Wild <mwild1@gmail.com> parents: 2623 diff changeset	133 if can_do_tls(origin) then
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	134 features:add_child(c2s_feature);
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	135 end
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	136 end);
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	137 module:hook("s2s-stream-features", function(event)
2613 afa20941e098 s2smanager, mod_compression, mod_tls: Changed event.session to event.origin for s2s-stream-features event for consistency. Waqas Hussain <waqas20@gmail.com> parents: 2607 diff changeset	138 local origin, features = event.origin, event.features;
2625 03287c06d986 mod_tls: Refactor to simplify detection of whether we can do TLS on a connection Matthew Wild <mwild1@gmail.com> parents: 2623 diff changeset	139 if can_do_tls(origin) then
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	140 features:add_child(s2s_feature);
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	141 end
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	142 end);
1875 334383faf77b mod_tls: Advertise and handle TLS for s2s connections Matthew Wild <mwild1@gmail.com> parents: 1675 diff changeset	143
334383faf77b mod_tls: Advertise and handle TLS for s2s connections Matthew Wild <mwild1@gmail.com> parents: 1675 diff changeset	144 -- For s2sout connections, start TLS if we can
7959 3941d609ff85 mod_tls: Switch to hook_tag from hook_stanza which was renamed in 2087d42f1e77 Kim Alvefur <zash@zash.se> parents: 7913 diff changeset	145 module:hook_tag("http://etherx.jabber.org/streams", "features", function (session, stanza)
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	146 module:log("debug", "Received features element");
6302 76699a0ae4c4 mod_lastactivity, mod_legacyauth, mod_presence, mod_saslauth, mod_tls: Use the newer stanza:get_child APIs and optimize away some table lookups Kim Alvefur <zash@zash.se> parents: 6296 diff changeset	147 if can_do_tls(session) and stanza:get_child("starttls", xmlns_starttls) then
4475 7341cc5c8da9 mod_tls: Fix log statement (thanks Zash) Matthew Wild <mwild1@gmail.com> parents: 4244 diff changeset	148 module:log("debug", "%s is offering TLS, taking up the offer...", session.to_host);
6709 b6eff3ba13de mod_tls: Build <starttls/> as a stanza instead of with string concatenation Kim Alvefur <zash@zash.se> parents: 6526 diff changeset	149 session.sends2s(starttls_initiate);
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	150 return true;
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	151 end
ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	152 end, 500);
1875 334383faf77b mod_tls: Advertise and handle TLS for s2s connections Matthew Wild <mwild1@gmail.com> parents: 1675 diff changeset	153
7959 3941d609ff85 mod_tls: Switch to hook_tag from hook_stanza which was renamed in 2087d42f1e77 Kim Alvefur <zash@zash.se> parents: 7913 diff changeset	154 module:hook_tag(xmlns_starttls, "proceed", function (session, stanza) -- luacheck: ignore 212/stanza
7834 a2081d28bd22 mod_tls: Verify that TLS is available before proceeding Kim Alvefur <zash@zash.se> parents: 7833 diff changeset	155 if session.type == "s2sout_unauthed" and can_do_tls(session) then
7833 94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections Kim Alvefur <zash@zash.se> parents: 7712 diff changeset	156 module:log("debug", "Proceeding with TLS on s2sout...");
94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections Kim Alvefur <zash@zash.se> parents: 7712 diff changeset	157 session:reset_stream();
94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections Kim Alvefur <zash@zash.se> parents: 7712 diff changeset	158 session.conn:starttls(session.ssl_ctx);
94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections Kim Alvefur <zash@zash.se> parents: 7712 diff changeset	159 session.secure = false;
94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections Kim Alvefur <zash@zash.se> parents: 7712 diff changeset	160 return true;
94c0c8649826 mod_tls: Only accept <proceed> on outgoing s2s connections Kim Alvefur <zash@zash.se> parents: 7712 diff changeset	161 end
2605 ade70495fe7f mod_tls: Cleanup. Waqas Hussain <waqas20@gmail.com> parents: 2604 diff changeset	162 end);

prosody

c434bff22b14

plugins/mod_tls.lua

Software / code / prosody

Annotate

plugins/mod_tls.lua @ 10303:c434bff22b14

Software `/` code `/` prosody