Software /
code /
prosody
File
net/connect.lua @ 10721:3a1b1d3084fb 0.11
core.certmanager: Move EECDH ciphers before EDH in default cipherstring (fixes #1513)
Backport of 94e341dee51c
The original intent of having kEDH before kEECDH was that if a `dhparam`
file was specified, this would be interpreted as a preference by the
admin for old and well-tested Diffie-Hellman key agreement over newer
elliptic curve ones. Otherwise the faster elliptic curve ciphersuites
would be preferred. This didn't really work as intended since this
affects the ClientHello on outgoing s2s connections, leading to some
servers using poorly configured kEDH.
With Debian shipping OpenSSL settings that enforce a higher security
level, this caused interoperability problems with servers that use DH
params smaller than 2048 bits. E.g. jabber.org at the time of this
writing has 1024 bit DH params.
MattJ says
> Curves have won, and OpenSSL is less weird about them now
author | Kim Alvefur <zash@zash.se> |
---|---|
date | Sun, 25 Aug 2019 20:22:35 +0200 (2019-08-25) |
parent | 9387:33e52f727f0f |
child | 10112:b327f2870382 |
line wrap: on
line source
local server = require "net.server"; local log = require "util.logger".init("net.connect"); local new_id = require "util.id".short; local pending_connection_methods = {}; local pending_connection_mt = { __name = "pending_connection"; __index = pending_connection_methods; __tostring = function (p) return "<pending connection "..p.id.." to "..tostring(p.target_resolver.hostname)..">"; end; }; function pending_connection_methods:log(level, message, ...) log(level, "[pending connection %s] "..message, self.id, ...); end -- pending_connections_map[conn] = pending_connection local pending_connections_map = {}; local pending_connection_listeners = {}; local function attempt_connection(p) p:log("debug", "Checking for targets..."); if p.conn then pending_connections_map[p.conn] = nil; p.conn = nil; end p.target_resolver:next(function (conn_type, ip, port, extra) if not conn_type then -- No more targets to try p:log("debug", "No more connection targets to try"); if p.listeners.onfail then p.listeners.onfail(p.data, p.last_error or "unable to resolve service"); end return; end p:log("debug", "Next target to try is %s:%d", ip, port); local conn, err = server.addclient(ip, port, pending_connection_listeners, p.options.pattern or "*a", p.options.sslctx, conn_type, extra); if not conn then log("debug", "Connection attempt failed immediately: %s", tostring(err)); p.last_error = err or "unknown reason"; return attempt_connection(p); end p.conn = conn; pending_connections_map[conn] = p; end); end function pending_connection_listeners.onconnect(conn) local p = pending_connections_map[conn]; if not p then log("warn", "Successful connection, but unexpected! Closing."); conn:close(); return; end pending_connections_map[conn] = nil; p:log("debug", "Successfully connected"); conn:setlistener(p.listeners, p.data); return p.listeners.onconnect(conn); end function pending_connection_listeners.ondisconnect(conn, reason) local p = pending_connections_map[conn]; if not p then log("warn", "Failed connection, but unexpected!"); return; end p.last_error = reason or "unknown reason"; p:log("debug", "Connection attempt failed: %s", p.last_error); attempt_connection(p); end local function connect(target_resolver, listeners, options, data) local p = setmetatable({ id = new_id(); target_resolver = target_resolver; listeners = assert(listeners); options = options or {}; data = data; }, pending_connection_mt); p:log("debug", "Starting connection process"); attempt_connection(p); end return { connect = connect; };