Software /
code /
prosody
Annotate
plugins/mod_tls.lua @ 12446:e54b8a5e35ad 0.12
util.random: Test whether util.crand works before using it (fix #1734)
util.crand can be configured at compile time to use the Linux
getrandom() system call, available from Linux 3.17, but it is still
possible to load it with an older kernel lacking that system call, where
attempting to use it throws an ENOSYS error.
By testing for this on load we can fall back to /dev/urandom in this
case.
author | Kim Alvefur <zash@zash.se> |
---|---|
date | Sat, 02 Apr 2022 16:33:27 +0200 |
parent | 12330:38b5b05407be |
child | 12482:b193f8a2737e |
rev | line source |
---|---|
1523
841d61be198f
Remove version number from copyright headers
Matthew Wild <mwild1@gmail.com>
parents:
1219
diff
changeset
|
1 -- Prosody IM |
2923
b7049746bd29
Update copyright headers for 2010
Matthew Wild <mwild1@gmail.com>
parents:
2877
diff
changeset
|
2 -- Copyright (C) 2008-2010 Matthew Wild |
b7049746bd29
Update copyright headers for 2010
Matthew Wild <mwild1@gmail.com>
parents:
2877
diff
changeset
|
3 -- Copyright (C) 2008-2010 Waqas Hussain |
5776
bd0ff8ae98a8
Remove all trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents:
5698
diff
changeset
|
4 -- |
758 | 5 -- This project is MIT/X11 licensed. Please see the |
6 -- COPYING file in the source package for more information. | |
519
cccd610a0ef9
Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents:
438
diff
changeset
|
7 -- |
cccd610a0ef9
Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents:
438
diff
changeset
|
8 |
3571
675d65036f31
certmanager, hostmanager, mod_tls: Move responsibility for creating per-host SSL contexts to mod_tls, meaning reloading certs is now as trivial as reloading mod_tls
Matthew Wild <mwild1@gmail.com>
parents:
3397
diff
changeset
|
9 local create_context = require "core.certmanager".create_context; |
6832
9566a15d3e59
mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511)
Kim Alvefur <zash@zash.se>
parents:
6710
diff
changeset
|
10 local rawgetopt = require"core.configmanager".rawget; |
69
5b664c8fef86
forgot to commit mod_tls, oops :)
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
11 local st = require "util.stanza"; |
99
ba08b8a4eeef
Abstract connections with "connection listeners"
Matthew Wild <mwild1@gmail.com>
parents:
69
diff
changeset
|
12 |
12330
38b5b05407be
various: Require encryption by default for real
Kim Alvefur <zash@zash.se>
parents:
12211
diff
changeset
|
13 local c2s_require_encryption = module:get_option("c2s_require_encryption", module:get_option("require_encryption", true)); |
38b5b05407be
various: Require encryption by default for real
Kim Alvefur <zash@zash.se>
parents:
12211
diff
changeset
|
14 local s2s_require_encryption = module:get_option("s2s_require_encryption", true); |
2933 | 15 local allow_s2s_tls = module:get_option("s2s_allow_encryption") ~= false; |
5988
177f233b5211
mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ
Kim Alvefur <zash@zash.se>
parents:
5987
diff
changeset
|
16 local s2s_secure_auth = module:get_option("s2s_secure_auth"); |
177f233b5211
mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ
Kim Alvefur <zash@zash.se>
parents:
5987
diff
changeset
|
17 |
177f233b5211
mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ
Kim Alvefur <zash@zash.se>
parents:
5987
diff
changeset
|
18 if s2s_secure_auth and s2s_require_encryption == false then |
177f233b5211
mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ
Kim Alvefur <zash@zash.se>
parents:
5987
diff
changeset
|
19 module:log("warn", "s2s_secure_auth implies s2s_require_encryption, but s2s_require_encryption is set to false"); |
177f233b5211
mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ
Kim Alvefur <zash@zash.se>
parents:
5987
diff
changeset
|
20 s2s_require_encryption = true; |
177f233b5211
mod_tls: Let s2s_secure_auth override s2s_require_encryption and warn if they differ
Kim Alvefur <zash@zash.se>
parents:
5987
diff
changeset
|
21 end |
1219
f14e08a0ae7f
mod_tls: Add <required/> to stream feature when TLS is required
Matthew Wild <mwild1@gmail.com>
parents:
1213
diff
changeset
|
22 |
2605 | 23 local xmlns_starttls = 'urn:ietf:params:xml:ns:xmpp-tls'; |
24 local starttls_attr = { xmlns = xmlns_starttls }; | |
6709
b6eff3ba13de
mod_tls: Build <starttls/> as a stanza instead of with string concatenation
Kim Alvefur <zash@zash.se>
parents:
6526
diff
changeset
|
25 local starttls_initiate= st.stanza("starttls", starttls_attr); |
2605 | 26 local starttls_proceed = st.stanza("proceed", starttls_attr); |
27 local starttls_failure = st.stanza("failure", starttls_attr); | |
28 local c2s_feature = st.stanza("starttls", starttls_attr); | |
29 local s2s_feature = st.stanza("starttls", starttls_attr); | |
5987
bd90250ee1ee
mod_tls: Rename variables to be less confusing
Kim Alvefur <zash@zash.se>
parents:
5976
diff
changeset
|
30 if c2s_require_encryption then c2s_feature:tag("required"):up(); end |
bd90250ee1ee
mod_tls: Rename variables to be less confusing
Kim Alvefur <zash@zash.se>
parents:
5976
diff
changeset
|
31 if s2s_require_encryption then s2s_feature:tag("required"):up(); end |
2605 | 32 |
5370
7838acadb0fa
mod_announce, mod_auth_anonymous, mod_c2s, mod_c2s, mod_component, mod_iq, mod_message, mod_presence, mod_tls: Access prosody.{hosts,bare_sessions,full_sessions} instead of the old globals
Kim Alvefur <zash@zash.se>
parents:
4475
diff
changeset
|
33 local hosts = prosody.hosts; |
2872
cdc292d201fc
mod_tls: Don't offer TLS on hosts that don't have any certs
Matthew Wild <mwild1@gmail.com>
parents:
2854
diff
changeset
|
34 local host = hosts[module.host]; |
cdc292d201fc
mod_tls: Don't offer TLS on hosts that don't have any certs
Matthew Wild <mwild1@gmail.com>
parents:
2854
diff
changeset
|
35 |
5685
f965ac6b7ce1
mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections
Kim Alvefur <zash@zash.se>
parents:
5378
diff
changeset
|
36 local ssl_ctx_c2s, ssl_ctx_s2sout, ssl_ctx_s2sin; |
6521
29c7586665f5
mod_tls: Keep ssl config around and attach them to sessions
Kim Alvefur <zash@zash.se>
parents:
6487
diff
changeset
|
37 local ssl_cfg_c2s, ssl_cfg_s2sout, ssl_cfg_s2sin; |
9740
4b34687ede3f
mod_tls: Keep TLS context errors and repeat them again for each session
Kim Alvefur <zash@zash.se>
parents:
8131
diff
changeset
|
38 local err_c2s, err_s2sin, err_s2sout; |
8131
c8e3a0caa0a9
mod_tls: Rebuild SSL context objects on configuration reload - #701
Kim Alvefur <zash@zash.se>
parents:
7959
diff
changeset
|
39 |
10783
950082c1669e
mod_tls: Log when certificates are (re)loaded
Kim Alvefur <zash@zash.se>
parents:
9971
diff
changeset
|
40 function module.load(reload) |
9740
4b34687ede3f
mod_tls: Keep TLS context errors and repeat them again for each session
Kim Alvefur <zash@zash.se>
parents:
8131
diff
changeset
|
41 local NULL = {}; |
6832
9566a15d3e59
mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511)
Kim Alvefur <zash@zash.se>
parents:
6710
diff
changeset
|
42 local modhost = module.host; |
9566a15d3e59
mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511)
Kim Alvefur <zash@zash.se>
parents:
6710
diff
changeset
|
43 local parent = modhost:match("%.(.*)$"); |
6296
66fb7b7c668d
mod_tls: Simplify and use new ssl config merging in certmanager
Kim Alvefur <zash@zash.se>
parents:
5993
diff
changeset
|
44 |
6832
9566a15d3e59
mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511)
Kim Alvefur <zash@zash.se>
parents:
6710
diff
changeset
|
45 local parent_ssl = rawgetopt(parent, "ssl") or NULL; |
9566a15d3e59
mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511)
Kim Alvefur <zash@zash.se>
parents:
6710
diff
changeset
|
46 local host_ssl = rawgetopt(modhost, "ssl") or parent_ssl; |
5685
f965ac6b7ce1
mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections
Kim Alvefur <zash@zash.se>
parents:
5378
diff
changeset
|
47 |
6832
9566a15d3e59
mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511)
Kim Alvefur <zash@zash.se>
parents:
6710
diff
changeset
|
48 local global_c2s = rawgetopt("*", "c2s_ssl") or NULL; |
9566a15d3e59
mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511)
Kim Alvefur <zash@zash.se>
parents:
6710
diff
changeset
|
49 local parent_c2s = rawgetopt(parent, "c2s_ssl") or NULL; |
6919
ab6c57633ce5
mod_tls: Fix ssl option fallback to a "parent" host if current host does not have ssl options set (thanks 70b1)
Kim Alvefur <zash@zash.se>
parents:
6918
diff
changeset
|
50 local host_c2s = rawgetopt(modhost, "c2s_ssl") or parent_c2s; |
6296
66fb7b7c668d
mod_tls: Simplify and use new ssl config merging in certmanager
Kim Alvefur <zash@zash.se>
parents:
5993
diff
changeset
|
51 |
6832
9566a15d3e59
mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511)
Kim Alvefur <zash@zash.se>
parents:
6710
diff
changeset
|
52 local global_s2s = rawgetopt("*", "s2s_ssl") or NULL; |
9566a15d3e59
mod_tls: Fix inhertinance of 'ssl' option from "parent" host to subdomain (fixes #511)
Kim Alvefur <zash@zash.se>
parents:
6710
diff
changeset
|
53 local parent_s2s = rawgetopt(parent, "s2s_ssl") or NULL; |
6919
ab6c57633ce5
mod_tls: Fix ssl option fallback to a "parent" host if current host does not have ssl options set (thanks 70b1)
Kim Alvefur <zash@zash.se>
parents:
6918
diff
changeset
|
54 local host_s2s = rawgetopt(modhost, "s2s_ssl") or parent_s2s; |
6296
66fb7b7c668d
mod_tls: Simplify and use new ssl config merging in certmanager
Kim Alvefur <zash@zash.se>
parents:
5993
diff
changeset
|
55 |
9971
5b048ccd106f
mod_tls: Log debug message for each kind of TLS context created
Kim Alvefur <zash@zash.se>
parents:
8131
diff
changeset
|
56 module:log("debug", "Creating context for c2s"); |
9854
115b5e32d960
mod_tls: Restore querying for certificates on s2s
Kim Alvefur <zash@zash.se>
parents:
9740
diff
changeset
|
57 local request_client_certs = { verify = { "peer", "client_once", }; }; |
12211
5c2ae28f536e
mod_tls: Set ALPN on outgoing connections
Kim Alvefur <zash@zash.se>
parents:
12207
diff
changeset
|
58 local xmpp_alpn = { alpn = "xmpp-server" }; |
5685
f965ac6b7ce1
mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections
Kim Alvefur <zash@zash.se>
parents:
5378
diff
changeset
|
59 |
9740
4b34687ede3f
mod_tls: Keep TLS context errors and repeat them again for each session
Kim Alvefur <zash@zash.se>
parents:
8131
diff
changeset
|
60 ssl_ctx_c2s, err_c2s, ssl_cfg_c2s = create_context(host.host, "server", host_c2s, host_ssl, global_c2s); -- for incoming client connections |
4b34687ede3f
mod_tls: Keep TLS context errors and repeat them again for each session
Kim Alvefur <zash@zash.se>
parents:
8131
diff
changeset
|
61 if not ssl_ctx_c2s then module:log("error", "Error creating context for c2s: %s", err_c2s); end |
6521
29c7586665f5
mod_tls: Keep ssl config around and attach them to sessions
Kim Alvefur <zash@zash.se>
parents:
6487
diff
changeset
|
62 |
11530
a90389e7296c
mod_tls: Fix order of debug messages and tls context creation
Kim Alvefur <zash@zash.se>
parents:
11519
diff
changeset
|
63 module:log("debug", "Creating context for s2sout"); |
9854
115b5e32d960
mod_tls: Restore querying for certificates on s2s
Kim Alvefur <zash@zash.se>
parents:
9740
diff
changeset
|
64 -- for outgoing server connections |
12211
5c2ae28f536e
mod_tls: Set ALPN on outgoing connections
Kim Alvefur <zash@zash.se>
parents:
12207
diff
changeset
|
65 ssl_ctx_s2sout, err_s2sout, ssl_cfg_s2sout = create_context(host.host, "client", host_s2s, host_ssl, global_s2s, request_client_certs, xmpp_alpn); |
9740
4b34687ede3f
mod_tls: Keep TLS context errors and repeat them again for each session
Kim Alvefur <zash@zash.se>
parents:
8131
diff
changeset
|
66 if not ssl_ctx_s2sout then module:log("error", "Error creating contexts for s2sout: %s", err_s2sout); end |
6521
29c7586665f5
mod_tls: Keep ssl config around and attach them to sessions
Kim Alvefur <zash@zash.se>
parents:
6487
diff
changeset
|
67 |
11530
a90389e7296c
mod_tls: Fix order of debug messages and tls context creation
Kim Alvefur <zash@zash.se>
parents:
11519
diff
changeset
|
68 module:log("debug", "Creating context for s2sin"); |
9854
115b5e32d960
mod_tls: Restore querying for certificates on s2s
Kim Alvefur <zash@zash.se>
parents:
9740
diff
changeset
|
69 -- for incoming server connections |
115b5e32d960
mod_tls: Restore querying for certificates on s2s
Kim Alvefur <zash@zash.se>
parents:
9740
diff
changeset
|
70 ssl_ctx_s2sin, err_s2sin, ssl_cfg_s2sin = create_context(host.host, "server", host_s2s, host_ssl, global_s2s, request_client_certs); |
9740
4b34687ede3f
mod_tls: Keep TLS context errors and repeat them again for each session
Kim Alvefur <zash@zash.se>
parents:
8131
diff
changeset
|
71 if not ssl_ctx_s2sin then module:log("error", "Error creating contexts for s2sin: %s", err_s2sin); end |
10783
950082c1669e
mod_tls: Log when certificates are (re)loaded
Kim Alvefur <zash@zash.se>
parents:
9971
diff
changeset
|
72 |
950082c1669e
mod_tls: Log when certificates are (re)loaded
Kim Alvefur <zash@zash.se>
parents:
9971
diff
changeset
|
73 if reload then |
950082c1669e
mod_tls: Log when certificates are (re)loaded
Kim Alvefur <zash@zash.se>
parents:
9971
diff
changeset
|
74 module:log("info", "Certificates reloaded"); |
950082c1669e
mod_tls: Log when certificates are (re)loaded
Kim Alvefur <zash@zash.se>
parents:
9971
diff
changeset
|
75 else |
950082c1669e
mod_tls: Log when certificates are (re)loaded
Kim Alvefur <zash@zash.se>
parents:
9971
diff
changeset
|
76 module:log("info", "Certificates loaded"); |
950082c1669e
mod_tls: Log when certificates are (re)loaded
Kim Alvefur <zash@zash.se>
parents:
9971
diff
changeset
|
77 end |
5685
f965ac6b7ce1
mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections
Kim Alvefur <zash@zash.se>
parents:
5378
diff
changeset
|
78 end |
f965ac6b7ce1
mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections
Kim Alvefur <zash@zash.se>
parents:
5378
diff
changeset
|
79 |
8131
c8e3a0caa0a9
mod_tls: Rebuild SSL context objects on configuration reload - #701
Kim Alvefur <zash@zash.se>
parents:
7959
diff
changeset
|
80 module:hook_global("config-reloaded", module.load); |
c8e3a0caa0a9
mod_tls: Rebuild SSL context objects on configuration reload - #701
Kim Alvefur <zash@zash.se>
parents:
7959
diff
changeset
|
81 |
2625
03287c06d986
mod_tls: Refactor to simplify detection of whether we can do TLS on a connection
Matthew Wild <mwild1@gmail.com>
parents:
2623
diff
changeset
|
82 local function can_do_tls(session) |
12207
65e252940337
mod_s2s: Retrieve TLS context for outgoing Direct TLS connections from mod_tls
Kim Alvefur <zash@zash.se>
parents:
11766
diff
changeset
|
83 if session.conn and not session.conn.starttls then |
7913
64daa21450f9
mod_tls: Suppress debug message if already using encryption
Kim Alvefur <zash@zash.se>
parents:
7898
diff
changeset
|
84 if not session.secure then |
64daa21450f9
mod_tls: Suppress debug message if already using encryption
Kim Alvefur <zash@zash.se>
parents:
7898
diff
changeset
|
85 session.log("debug", "Underlying connection does not support STARTTLS"); |
64daa21450f9
mod_tls: Suppress debug message if already using encryption
Kim Alvefur <zash@zash.se>
parents:
7898
diff
changeset
|
86 end |
7869
eb5fba4c8074
mod_tls: Check that connection has starttls method first to prevent offering starttls over tls (thanks Remko and Tobias)
Kim Alvefur <zash@zash.se>
parents:
7864
diff
changeset
|
87 return false; |
eb5fba4c8074
mod_tls: Check that connection has starttls method first to prevent offering starttls over tls (thanks Remko and Tobias)
Kim Alvefur <zash@zash.se>
parents:
7864
diff
changeset
|
88 elseif session.ssl_ctx ~= nil then |
7864
7ece186a44d3
mod_tls: Return session.ssl_ctx if not nil, like when doing the full session type check
Kim Alvefur <zash@zash.se>
parents:
7863
diff
changeset
|
89 return session.ssl_ctx; |
5685
f965ac6b7ce1
mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections
Kim Alvefur <zash@zash.se>
parents:
5378
diff
changeset
|
90 end |
2625
03287c06d986
mod_tls: Refactor to simplify detection of whether we can do TLS on a connection
Matthew Wild <mwild1@gmail.com>
parents:
2623
diff
changeset
|
91 if session.type == "c2s_unauthed" then |
9740
4b34687ede3f
mod_tls: Keep TLS context errors and repeat them again for each session
Kim Alvefur <zash@zash.se>
parents:
8131
diff
changeset
|
92 if not ssl_ctx_c2s and c2s_require_encryption then |
4b34687ede3f
mod_tls: Keep TLS context errors and repeat them again for each session
Kim Alvefur <zash@zash.se>
parents:
8131
diff
changeset
|
93 session.log("error", "No TLS context available for c2s. Earlier error was: %s", err_c2s); |
4b34687ede3f
mod_tls: Keep TLS context errors and repeat them again for each session
Kim Alvefur <zash@zash.se>
parents:
8131
diff
changeset
|
94 end |
5685
f965ac6b7ce1
mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections
Kim Alvefur <zash@zash.se>
parents:
5378
diff
changeset
|
95 session.ssl_ctx = ssl_ctx_c2s; |
6521
29c7586665f5
mod_tls: Keep ssl config around and attach them to sessions
Kim Alvefur <zash@zash.se>
parents:
6487
diff
changeset
|
96 session.ssl_cfg = ssl_cfg_c2s; |
2933 | 97 elseif session.type == "s2sin_unauthed" and allow_s2s_tls then |
9740
4b34687ede3f
mod_tls: Keep TLS context errors and repeat them again for each session
Kim Alvefur <zash@zash.se>
parents:
8131
diff
changeset
|
98 if not ssl_ctx_s2sin and s2s_require_encryption then |
4b34687ede3f
mod_tls: Keep TLS context errors and repeat them again for each session
Kim Alvefur <zash@zash.se>
parents:
8131
diff
changeset
|
99 session.log("error", "No TLS context available for s2sin. Earlier error was: %s", err_s2sin); |
4b34687ede3f
mod_tls: Keep TLS context errors and repeat them again for each session
Kim Alvefur <zash@zash.se>
parents:
8131
diff
changeset
|
100 end |
5685
f965ac6b7ce1
mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections
Kim Alvefur <zash@zash.se>
parents:
5378
diff
changeset
|
101 session.ssl_ctx = ssl_ctx_s2sin; |
6521
29c7586665f5
mod_tls: Keep ssl config around and attach them to sessions
Kim Alvefur <zash@zash.se>
parents:
6487
diff
changeset
|
102 session.ssl_cfg = ssl_cfg_s2sin; |
2933 | 103 elseif session.direction == "outgoing" and allow_s2s_tls then |
9740
4b34687ede3f
mod_tls: Keep TLS context errors and repeat them again for each session
Kim Alvefur <zash@zash.se>
parents:
8131
diff
changeset
|
104 if not ssl_ctx_s2sout and s2s_require_encryption then |
4b34687ede3f
mod_tls: Keep TLS context errors and repeat them again for each session
Kim Alvefur <zash@zash.se>
parents:
8131
diff
changeset
|
105 session.log("error", "No TLS context available for s2sout. Earlier error was: %s", err_s2sout); |
4b34687ede3f
mod_tls: Keep TLS context errors and repeat them again for each session
Kim Alvefur <zash@zash.se>
parents:
8131
diff
changeset
|
106 end |
5685
f965ac6b7ce1
mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections
Kim Alvefur <zash@zash.se>
parents:
5378
diff
changeset
|
107 session.ssl_ctx = ssl_ctx_s2sout; |
6521
29c7586665f5
mod_tls: Keep ssl config around and attach them to sessions
Kim Alvefur <zash@zash.se>
parents:
6487
diff
changeset
|
108 session.ssl_cfg = ssl_cfg_s2sout; |
5685
f965ac6b7ce1
mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections
Kim Alvefur <zash@zash.se>
parents:
5378
diff
changeset
|
109 else |
7898
d8029b2e0f43
mod_tls: Log reasons for not being able to do TLS
Kim Alvefur <zash@zash.se>
parents:
7869
diff
changeset
|
110 session.log("debug", "Unknown session type, don't know which TLS context to use"); |
5685
f965ac6b7ce1
mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections
Kim Alvefur <zash@zash.se>
parents:
5378
diff
changeset
|
111 return false; |
2625
03287c06d986
mod_tls: Refactor to simplify detection of whether we can do TLS on a connection
Matthew Wild <mwild1@gmail.com>
parents:
2623
diff
changeset
|
112 end |
7863
a634fe3c21f2
mod_tls: Add debug logging for when TLS should be doable but no ssl context was set
Kim Alvefur <zash@zash.se>
parents:
7834
diff
changeset
|
113 if not session.ssl_ctx then |
a634fe3c21f2
mod_tls: Add debug logging for when TLS should be doable but no ssl context was set
Kim Alvefur <zash@zash.se>
parents:
7834
diff
changeset
|
114 session.log("debug", "Should be able to do TLS but no context available"); |
a634fe3c21f2
mod_tls: Add debug logging for when TLS should be doable but no ssl context was set
Kim Alvefur <zash@zash.se>
parents:
7834
diff
changeset
|
115 return false; |
a634fe3c21f2
mod_tls: Add debug logging for when TLS should be doable but no ssl context was set
Kim Alvefur <zash@zash.se>
parents:
7834
diff
changeset
|
116 end |
5685
f965ac6b7ce1
mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections
Kim Alvefur <zash@zash.se>
parents:
5378
diff
changeset
|
117 return session.ssl_ctx; |
2932
d2816fb6c7ea
mod_tls: Add s2s_allow_encryption option which, when set to false, disabled TLS for s2s
Matthew Wild <mwild1@gmail.com>
parents:
2923
diff
changeset
|
118 end |
d2816fb6c7ea
mod_tls: Add s2s_allow_encryption option which, when set to false, disabled TLS for s2s
Matthew Wild <mwild1@gmail.com>
parents:
2923
diff
changeset
|
119 |
12207
65e252940337
mod_s2s: Retrieve TLS context for outgoing Direct TLS connections from mod_tls
Kim Alvefur <zash@zash.se>
parents:
11766
diff
changeset
|
120 module:hook("s2sout-created", function (event) |
65e252940337
mod_s2s: Retrieve TLS context for outgoing Direct TLS connections from mod_tls
Kim Alvefur <zash@zash.se>
parents:
11766
diff
changeset
|
121 -- Initialize TLS context for outgoing connections |
65e252940337
mod_s2s: Retrieve TLS context for outgoing Direct TLS connections from mod_tls
Kim Alvefur <zash@zash.se>
parents:
11766
diff
changeset
|
122 can_do_tls(event.session); |
65e252940337
mod_s2s: Retrieve TLS context for outgoing Direct TLS connections from mod_tls
Kim Alvefur <zash@zash.se>
parents:
11766
diff
changeset
|
123 end); |
65e252940337
mod_s2s: Retrieve TLS context for outgoing Direct TLS connections from mod_tls
Kim Alvefur <zash@zash.se>
parents:
11766
diff
changeset
|
124 |
2605 | 125 -- Hook <starttls/> |
2600
1e6f3002e04f
mod_tls: Inlined some code.
Waqas Hussain <waqas20@gmail.com>
parents:
2596
diff
changeset
|
126 module:hook("stanza/urn:ietf:params:xml:ns:xmpp-tls:starttls", function(event) |
1e6f3002e04f
mod_tls: Inlined some code.
Waqas Hussain <waqas20@gmail.com>
parents:
2596
diff
changeset
|
127 local origin = event.origin; |
2625
03287c06d986
mod_tls: Refactor to simplify detection of whether we can do TLS on a connection
Matthew Wild <mwild1@gmail.com>
parents:
2623
diff
changeset
|
128 if can_do_tls(origin) then |
2605 | 129 (origin.sends2s or origin.send)(starttls_proceed); |
11519
df4bd3af4099
mod_tls: Bail out if session got destroyed while sending <proceed/>
Kim Alvefur <zash@zash.se>
parents:
11341
diff
changeset
|
130 if origin.destroyed then return end |
2600
1e6f3002e04f
mod_tls: Inlined some code.
Waqas Hussain <waqas20@gmail.com>
parents:
2596
diff
changeset
|
131 origin:reset_stream(); |
5685
f965ac6b7ce1
mod_tls: Refactor to allow separate SSL configuration for c2s and s2s connections
Kim Alvefur <zash@zash.se>
parents:
5378
diff
changeset
|
132 origin.conn:starttls(origin.ssl_ctx); |
4157
1b5a8e071a80
mod_tls: Drop 'TLS negotiation started for ...' to debug level from info
Matthew Wild <mwild1@gmail.com>
parents:
3583
diff
changeset
|
133 origin.log("debug", "TLS negotiation started for %s...", origin.type); |
2600
1e6f3002e04f
mod_tls: Inlined some code.
Waqas Hussain <waqas20@gmail.com>
parents:
2596
diff
changeset
|
134 origin.secure = false; |
2595
015934e20f03
mod_tls: Switched to new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
2594
diff
changeset
|
135 else |
015934e20f03
mod_tls: Switched to new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
2594
diff
changeset
|
136 origin.log("warn", "Attempt to start TLS, but TLS is not available on this %s connection", origin.type); |
2605 | 137 (origin.sends2s or origin.send)(starttls_failure); |
2601
e64c6a4aa50b
mod_tls: Respond with proper error when TLS cannot be negotiated.
Waqas Hussain <waqas20@gmail.com>
parents:
2600
diff
changeset
|
138 origin:close(); |
2595
015934e20f03
mod_tls: Switched to new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
2594
diff
changeset
|
139 end |
015934e20f03
mod_tls: Switched to new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
2594
diff
changeset
|
140 return true; |
015934e20f03
mod_tls: Switched to new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
2594
diff
changeset
|
141 end); |
2932
d2816fb6c7ea
mod_tls: Add s2s_allow_encryption option which, when set to false, disabled TLS for s2s
Matthew Wild <mwild1@gmail.com>
parents:
2923
diff
changeset
|
142 |
11727
f3aee8a825cc
Fix various spelling errors (thanks codespell)
Kim Alvefur <zash@zash.se>
parents:
11580
diff
changeset
|
143 -- Advertise stream feature |
2607
35a5d1c5ea28
mod_tls: Hook stream-features event using new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
2605
diff
changeset
|
144 module:hook("stream-features", function(event) |
35a5d1c5ea28
mod_tls: Hook stream-features event using new events API.
Waqas Hussain <waqas20@gmail.com>
parents:
2605
diff
changeset
|
145 local origin, features = event.origin, event.features; |
2625
03287c06d986
mod_tls: Refactor to simplify detection of whether we can do TLS on a connection
Matthew Wild <mwild1@gmail.com>
parents:
2623
diff
changeset
|
146 if can_do_tls(origin) then |
2605 | 147 features:add_child(c2s_feature); |
148 end | |
149 end); | |
150 module:hook("s2s-stream-features", function(event) | |
2613
afa20941e098
s2smanager, mod_compression, mod_tls: Changed event.session to event.origin for s2s-stream-features event for consistency.
Waqas Hussain <waqas20@gmail.com>
parents:
2607
diff
changeset
|
151 local origin, features = event.origin, event.features; |
2625
03287c06d986
mod_tls: Refactor to simplify detection of whether we can do TLS on a connection
Matthew Wild <mwild1@gmail.com>
parents:
2623
diff
changeset
|
152 if can_do_tls(origin) then |
2605 | 153 features:add_child(s2s_feature); |
154 end | |
155 end); | |
1875
334383faf77b
mod_tls: Advertise and handle TLS for s2s connections
Matthew Wild <mwild1@gmail.com>
parents:
1675
diff
changeset
|
156 |
334383faf77b
mod_tls: Advertise and handle TLS for s2s connections
Matthew Wild <mwild1@gmail.com>
parents:
1675
diff
changeset
|
157 -- For s2sout connections, start TLS if we can |
7959
3941d609ff85
mod_tls: Switch to hook_tag from hook_stanza which was renamed in 2087d42f1e77
Kim Alvefur <zash@zash.se>
parents:
7913
diff
changeset
|
158 module:hook_tag("http://etherx.jabber.org/streams", "features", function (session, stanza) |
2605 | 159 module:log("debug", "Received features element"); |
11340
a7109eb45e30
mod_tls: Attempt STARTTLS even if not advertised as per RFC 7590
Kim Alvefur <zash@zash.se>
parents:
10784
diff
changeset
|
160 if can_do_tls(session) then |
a7109eb45e30
mod_tls: Attempt STARTTLS even if not advertised as per RFC 7590
Kim Alvefur <zash@zash.se>
parents:
10784
diff
changeset
|
161 if stanza:get_child("starttls", xmlns_starttls) then |
a7109eb45e30
mod_tls: Attempt STARTTLS even if not advertised as per RFC 7590
Kim Alvefur <zash@zash.se>
parents:
10784
diff
changeset
|
162 module:log("debug", "%s is offering TLS, taking up the offer...", session.to_host); |
11341
c567e5e2b77a
mod_tls: Ignore lack of STARTTLS offer only when s2s_require_encryption set
Kim Alvefur <zash@zash.se>
parents:
11340
diff
changeset
|
163 elseif s2s_require_encryption then |
c567e5e2b77a
mod_tls: Ignore lack of STARTTLS offer only when s2s_require_encryption set
Kim Alvefur <zash@zash.se>
parents:
11340
diff
changeset
|
164 module:log("debug", "%s is *not* offering TLS, trying anyways!", session.to_host); |
11340
a7109eb45e30
mod_tls: Attempt STARTTLS even if not advertised as per RFC 7590
Kim Alvefur <zash@zash.se>
parents:
10784
diff
changeset
|
165 else |
11341
c567e5e2b77a
mod_tls: Ignore lack of STARTTLS offer only when s2s_require_encryption set
Kim Alvefur <zash@zash.se>
parents:
11340
diff
changeset
|
166 module:log("debug", "%s is not offering TLS", session.to_host); |
c567e5e2b77a
mod_tls: Ignore lack of STARTTLS offer only when s2s_require_encryption set
Kim Alvefur <zash@zash.se>
parents:
11340
diff
changeset
|
167 return; |
11340
a7109eb45e30
mod_tls: Attempt STARTTLS even if not advertised as per RFC 7590
Kim Alvefur <zash@zash.se>
parents:
10784
diff
changeset
|
168 end |
6709
b6eff3ba13de
mod_tls: Build <starttls/> as a stanza instead of with string concatenation
Kim Alvefur <zash@zash.se>
parents:
6526
diff
changeset
|
169 session.sends2s(starttls_initiate); |
2605 | 170 return true; |
171 end | |
172 end, 500); | |
1875
334383faf77b
mod_tls: Advertise and handle TLS for s2s connections
Matthew Wild <mwild1@gmail.com>
parents:
1675
diff
changeset
|
173 |
11766
6ad335cd43f9
mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections
Kim Alvefur <zash@zash.se>
parents:
11727
diff
changeset
|
174 module:hook("s2sout-authenticate-legacy", function(event) |
6ad335cd43f9
mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections
Kim Alvefur <zash@zash.se>
parents:
11727
diff
changeset
|
175 local session = event.origin; |
6ad335cd43f9
mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections
Kim Alvefur <zash@zash.se>
parents:
11727
diff
changeset
|
176 if s2s_require_encryption and can_do_tls(session) then |
6ad335cd43f9
mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections
Kim Alvefur <zash@zash.se>
parents:
11727
diff
changeset
|
177 session.sends2s(starttls_initiate); |
6ad335cd43f9
mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections
Kim Alvefur <zash@zash.se>
parents:
11727
diff
changeset
|
178 return true; |
6ad335cd43f9
mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections
Kim Alvefur <zash@zash.se>
parents:
11727
diff
changeset
|
179 end |
6ad335cd43f9
mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections
Kim Alvefur <zash@zash.se>
parents:
11727
diff
changeset
|
180 end, 200); |
6ad335cd43f9
mod_tls: Attempt STARTTLS on outgoing unencrypted legacy s2s connections
Kim Alvefur <zash@zash.se>
parents:
11727
diff
changeset
|
181 |
7959
3941d609ff85
mod_tls: Switch to hook_tag from hook_stanza which was renamed in 2087d42f1e77
Kim Alvefur <zash@zash.se>
parents:
7913
diff
changeset
|
182 module:hook_tag(xmlns_starttls, "proceed", function (session, stanza) -- luacheck: ignore 212/stanza |
7834
a2081d28bd22
mod_tls: Verify that TLS is available before proceeding
Kim Alvefur <zash@zash.se>
parents:
7833
diff
changeset
|
183 if session.type == "s2sout_unauthed" and can_do_tls(session) then |
7833
94c0c8649826
mod_tls: Only accept <proceed> on outgoing s2s connections
Kim Alvefur <zash@zash.se>
parents:
7712
diff
changeset
|
184 module:log("debug", "Proceeding with TLS on s2sout..."); |
94c0c8649826
mod_tls: Only accept <proceed> on outgoing s2s connections
Kim Alvefur <zash@zash.se>
parents:
7712
diff
changeset
|
185 session:reset_stream(); |
94c0c8649826
mod_tls: Only accept <proceed> on outgoing s2s connections
Kim Alvefur <zash@zash.se>
parents:
7712
diff
changeset
|
186 session.conn:starttls(session.ssl_ctx); |
94c0c8649826
mod_tls: Only accept <proceed> on outgoing s2s connections
Kim Alvefur <zash@zash.se>
parents:
7712
diff
changeset
|
187 session.secure = false; |
94c0c8649826
mod_tls: Only accept <proceed> on outgoing s2s connections
Kim Alvefur <zash@zash.se>
parents:
7712
diff
changeset
|
188 return true; |
94c0c8649826
mod_tls: Only accept <proceed> on outgoing s2s connections
Kim Alvefur <zash@zash.se>
parents:
7712
diff
changeset
|
189 end |
2605 | 190 end); |
11580
9ad5ec65132d
mod_tls: Add "support" for <failure> by closing gracefully
Kim Alvefur <zash@zash.se>
parents:
11530
diff
changeset
|
191 |
9ad5ec65132d
mod_tls: Add "support" for <failure> by closing gracefully
Kim Alvefur <zash@zash.se>
parents:
11530
diff
changeset
|
192 module:hook_tag(xmlns_starttls, "failure", function (session, stanza) -- luacheck: ignore 212/stanza |
9ad5ec65132d
mod_tls: Add "support" for <failure> by closing gracefully
Kim Alvefur <zash@zash.se>
parents:
11530
diff
changeset
|
193 module:log("warn", "TLS negotiation with %s failed.", session.to_host); |
9ad5ec65132d
mod_tls: Add "support" for <failure> by closing gracefully
Kim Alvefur <zash@zash.se>
parents:
11530
diff
changeset
|
194 session:close(nil, "TLS negotiation failed"); |
9ad5ec65132d
mod_tls: Add "support" for <failure> by closing gracefully
Kim Alvefur <zash@zash.se>
parents:
11530
diff
changeset
|
195 return false; |
9ad5ec65132d
mod_tls: Add "support" for <failure> by closing gracefully
Kim Alvefur <zash@zash.se>
parents:
11530
diff
changeset
|
196 end); |