Software /
code /
prosody
File
util/session.lua @ 13289:38c95544b7ee
mod_saslauth, mod_c2s: Disable tls-server-end-point channel binding by default
This channel binding method is now enabled when a hash is manually set in the
config, or it attempts to discover the hash automatically if the value is the
special string "auto".
A related change to mod_c2s prevents complicated certificate lookups in the
client connection hot path - this work now happens only when this channel
binding method is used. I'm not aware of anything else that uses ssl_cfg (vs
ssl_ctx).
Rationale for disabling by default:
- Minor performance impact in automatic cert detection
- This method is weak against a leaked/stolen private key (other methods such
as 'tls-exporter' would not be compromised in such a case)
Rationale for keeping the implementation:
- For some deployments, this may be the only method available (e.g. due to
TLS offloading in another process/server).
author | Matthew Wild <mwild1@gmail.com> |
---|---|
date | Thu, 26 Oct 2023 15:14:39 +0100 |
parent | 13165:9c13c11b199d |
line wrap: on
line source
local initialize_filters = require "prosody.util.filters".initialize; local time = require "prosody.util.time"; local logger = require "prosody.util.logger"; local function new_session(typ) local session = { type = typ .. "_unauthed"; base_type = typ; since = time.now(); }; return session; end local function set_id(session) local id = session.base_type .. tostring(session):match("%x+$"):lower(); session.id = id; return session; end local function set_logger(session) local log = logger.init(session.id); session.log = log; return session; end local function set_conn(session, conn) session.conn = conn; session.ip = conn:ip(); return session; end local function set_send(session) local conn = session.conn; if not conn then function session.send(data) session.log("debug", "Discarding data sent to unconnected session: %s", data); return false; end return session; end local filter = initialize_filters(session); local w = conn.write; session.send = function (t) if t.name then t = filter("stanzas/out", t); end if t then t = filter("bytes/out", tostring(t)); if t then local ret, err = w(conn, t); if not ret then session.log("debug", "Error writing to connection: %s", err); return false, err; end end end return true; end return session; end local function set_role(session, role) session.role = role; end return { new = new_session; set_id = set_id; set_logger = set_logger; set_conn = set_conn; set_send = set_send; set_role = set_role; }