File

mod_saslauth, mod_c2s: Disable tls-server-end-point channel binding by default This channel binding method is now enabled when a hash is manually set in the config, or it attempts to discover the hash automatically if the value is the special string "auto". A related change to mod_c2s prevents complicated certificate lookups in the client connection hot path - this work now happens only when this channel binding method is used. I'm not aware of anything else that uses ssl_cfg (vs ssl_ctx). Rationale for disabling by default: - Minor performance impact in automatic cert detection - This method is weak against a leaked/stolen private key (other methods such as 'tls-exporter' would not be compromised in such a case) Rationale for keeping the implementation: - For some deployments, this may be the only method available (e.g. due to TLS offloading in another process/server).

-- Compatibility layer for bitwise operations

-- First try the bit32 lib
-- Lua 5.3 has it with compat enabled
-- Lua 5.2 has it by default
if _G.bit32 then
	return _G.bit32;
end

do
	-- Lua 5.3 and 5.4 would be able to use native infix operators
	local ok, bitop = pcall(require, "prosody.util.bit53")
	if ok then
		return bitop;
	end
end

error "No bit module found. See https://prosody.im/doc/depends#bitop";