Software /
code /
prosody
File
util/paths.lua @ 13289:38c95544b7ee
mod_saslauth, mod_c2s: Disable tls-server-end-point channel binding by default
This channel binding method is now enabled when a hash is manually set in the
config, or it attempts to discover the hash automatically if the value is the
special string "auto".
A related change to mod_c2s prevents complicated certificate lookups in the
client connection hot path - this work now happens only when this channel
binding method is used. I'm not aware of anything else that uses ssl_cfg (vs
ssl_ctx).
Rationale for disabling by default:
- Minor performance impact in automatic cert detection
- This method is weak against a leaked/stolen private key (other methods such
as 'tls-exporter' would not be compromised in such a case)
Rationale for keeping the implementation:
- For some deployments, this may be the only method available (e.g. due to
TLS offloading in another process/server).
author | Matthew Wild <mwild1@gmail.com> |
---|---|
date | Thu, 26 Oct 2023 15:14:39 +0100 |
parent | 11183:2ac63715ef6f |
line wrap: on
line source
local t_concat = table.concat; local path_sep = package.config:sub(1,1); local path_util = {} -- Helper function to resolve relative paths (needed by config) function path_util.resolve_relative_path(parent_path, path) if path then -- Some normalization parent_path = parent_path:gsub("%"..path_sep.."+$", ""); path = path:gsub("^%.%"..path_sep.."+", ""); local is_relative; if path_sep == "/" and path:sub(1,1) ~= "/" then is_relative = true; elseif path_sep == "\\" and (path:sub(1,1) ~= "/" and (path:sub(2,3) ~= ":\\" and path:sub(2,3) ~= ":/")) then is_relative = true; end if is_relative then return parent_path..path_sep..path; end end return path; end -- Helper function to convert a glob to a Lua pattern function path_util.glob_to_pattern(glob) return "^"..glob:gsub("[%p*?]", function (c) if c == "*" then return ".*"; elseif c == "?" then return "."; else return "%"..c; end end).."$"; end function path_util.join(a, b, c, ...) -- (... : string) --> string -- Optimization: Avoid creating table for most uses if b then if c then if ... then return t_concat({a,b,c,...}, path_sep); end return a..path_sep..b..path_sep..c; end return a..path_sep..b; end return a; end function path_util.complement_lua_path(installer_plugin_path) -- Checking for duplicates -- The commands using luarocks need the path to the directory that has the /share and /lib folders. local lua_version = _VERSION:match(" (.+)$"); local lua_path_sep = package.config:sub(3,3); local dir_sep = package.config:sub(1,1); local sub_path = dir_sep.."lua"..dir_sep..lua_version..dir_sep; if not string.find(package.path, installer_plugin_path, 1, true) then package.path = package.path..lua_path_sep..installer_plugin_path..dir_sep.."share"..sub_path.."?.lua"; package.path = package.path..lua_path_sep..installer_plugin_path..dir_sep.."share"..sub_path.."?"..dir_sep.."init.lua"; end if not string.find(package.path, installer_plugin_path, 1, true) then package.cpath = package.cpath..lua_path_sep..installer_plugin_path..dir_sep.."lib"..sub_path.."?.so"; end end return path_util;