File

prosodyctl @ 11111:55d8612ac357 0.11

mod_websocket: Continue to process data already in the buffer after an error occurs Previously any error, or even a normal websocket close frame, would return early, leaving potentially entire frames in the buffer unprocessed and then discarded. This change stops processing new data, but returns an existing processed data up to the point of the error/close.
author Matthew Wild <mwild1@gmail.com>
date Mon, 28 Sep 2020 16:36:12 +0100
parent 10610:b9a054ad38e7
child 10611:c10511380c0f
child 11529:10bea0941bab
line wrap: on
line source

#!/usr/bin/env lua
-- Prosody IM
-- Copyright (C) 2008-2010 Matthew Wild
-- Copyright (C) 2008-2010 Waqas Hussain
--
-- This project is MIT/X11 licensed. Please see the
-- COPYING file in the source package for more information.
--

-- prosodyctl - command-line controller for Prosody XMPP server

-- Will be modified by configure script if run --

CFG_SOURCEDIR=CFG_SOURCEDIR or os.getenv("PROSODY_SRCDIR");
CFG_CONFIGDIR=CFG_CONFIGDIR or os.getenv("PROSODY_CFGDIR");
CFG_PLUGINDIR=CFG_PLUGINDIR or os.getenv("PROSODY_PLUGINDIR");
CFG_DATADIR=CFG_DATADIR or os.getenv("PROSODY_DATADIR");

-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --

local function is_relative(path)
	local path_sep = package.config:sub(1,1);
        return ((path_sep == "/" and path:sub(1,1) ~= "/")
	or (path_sep == "\\" and (path:sub(1,1) ~= "/" and path:sub(2,3) ~= ":\\")))
end

-- Tell Lua where to find our libraries
if CFG_SOURCEDIR then
	local function filter_relative_paths(path)
		if is_relative(path) then return ""; end
	end
	local function sanitise_paths(paths)
		return (paths:gsub("[^;]+;?", filter_relative_paths):gsub(";;+", ";"));
	end
	package.path = sanitise_paths(CFG_SOURCEDIR.."/?.lua;"..package.path);
	package.cpath = sanitise_paths(CFG_SOURCEDIR.."/?.so;"..package.cpath);
end

-- Substitute ~ with path to home directory in data path
if CFG_DATADIR then
	if os.getenv("HOME") then
		CFG_DATADIR = CFG_DATADIR:gsub("^~", os.getenv("HOME"));
	end
end

-----------

local startup = require "util.startup";
startup.prosodyctl();

-----------

local error_messages = setmetatable({
		["invalid-username"] = "The given username is invalid in a Jabber ID";
		["invalid-hostname"] = "The given hostname is invalid";
		["no-password"] = "No password was supplied";
		["no-such-user"] = "The given user does not exist on the server";
		["no-such-host"] = "The given hostname does not exist in the config";
		["unable-to-save-data"] = "Unable to store, perhaps you don't have permission?";
		["no-pidfile"] = "There is no 'pidfile' option in the configuration file, see https://prosody.im/doc/prosodyctl#pidfile for help";
		["invalid-pidfile"] = "The 'pidfile' option in the configuration file is not a string, see https://prosody.im/doc/prosodyctl#pidfile for help";
		["no-posix"] = "The mod_posix module is not enabled in the Prosody config file, see https://prosody.im/doc/prosodyctl for more info";
		["no-such-method"] = "This module has no commands";
		["not-running"] = "Prosody is not running";
		}, { __index = function (_,k) return "Error: "..(tostring(k):gsub("%-", " "):gsub("^.", string.upper)); end });

local configmanager = require "core.configmanager";
local modulemanager = require "core.modulemanager"
local prosodyctl = require "util.prosodyctl"
local socket = require "socket"
local dependencies = require "util.dependencies";
local lfs = dependencies.softreq "lfs";

-----------------------

local show_message, show_warning = prosodyctl.show_message, prosodyctl.show_warning;
local show_usage = prosodyctl.show_usage;
local show_yesno = prosodyctl.show_yesno;
local show_prompt = prosodyctl.show_prompt;
local read_password = prosodyctl.read_password;

local jid_split = require "util.jid".prepped_split;

local prosodyctl_timeout = (configmanager.get("*", "prosodyctl_timeout") or 5) * 2;
-----------------------
local commands = {};
local command = arg[1];

function commands.adduser(arg)
	if not arg[1] or arg[1] == "--help" then
		show_usage([[adduser JID]], [[Create the specified user account in Prosody]]);
		return 1;
	end
	local user, host = jid_split(arg[1]);
	if not user and host then
		show_message [[Failed to understand JID, please supply the JID you want to create]]
		show_usage [[adduser user@host]]
		return 1;
	end

	if not host then
		show_message [[Please specify a JID, including a host. e.g. alice@example.com]];
		return 1;
	end

	if not prosody.hosts[host] then
		show_warning("The host '%s' is not listed in the configuration file (or is not enabled).", host)
		show_warning("The user will not be able to log in until this is changed.");
		prosody.hosts[host] = startup.make_host(host); --luacheck: ignore 122
	end

	if prosodyctl.user_exists{ user = user, host = host } then
		show_message [[That user already exists]];
		return 1;
	end

	local password = read_password();
	if not password then return 1; end

	local ok, msg = prosodyctl.adduser { user = user, host = host, password = password };

	if ok then return 0; end

	show_message(msg)
	return 1;
end

function commands.passwd(arg)
	if not arg[1] or arg[1] == "--help" then
		show_usage([[passwd JID]], [[Set the password for the specified user account in Prosody]]);
		return 1;
	end
	local user, host = jid_split(arg[1]);
	if not user and host then
		show_message [[Failed to understand JID, please supply the JID you want to set the password for]]
		show_usage [[passwd user@host]]
		return 1;
	end

	if not host then
		show_message [[Please specify a JID, including a host. e.g. alice@example.com]];
		return 1;
	end

	if not prosody.hosts[host] then
		show_warning("The host '%s' is not listed in the configuration file (or is not enabled).", host)
		show_warning("The user will not be able to log in until this is changed.");
		prosody.hosts[host] = startup.make_host(host); --luacheck: ignore 122
	end

	if not prosodyctl.user_exists { user = user, host = host } then
		show_message [[That user does not exist, use prosodyctl adduser to create a new user]]
		return 1;
	end

	local password = read_password();
	if not password then return 1; end

	local ok, msg = prosodyctl.passwd { user = user, host = host, password = password };

	if ok then return 0; end

	show_message(error_messages[msg])
	return 1;
end

function commands.deluser(arg)
	if not arg[1] or arg[1] == "--help" then
		show_usage([[deluser JID]], [[Permanently remove the specified user account from Prosody]]);
		return 1;
	end
	local user, host = jid_split(arg[1]);
	if not user and host then
		show_message [[Failed to understand JID, please supply the JID to the user account you want to delete]]
		show_usage [[deluser user@host]]
		return 1;
	end

	if not host then
		show_message [[Please specify a JID, including a host. e.g. alice@example.com]];
		return 1;
	end

	if not prosody.hosts[host] then
		show_warning("The host '%s' is not listed in the configuration file (or is not enabled).", host)
		prosody.hosts[host] = startup.make_host(host); --luacheck: ignore 122
	end

	if not prosodyctl.user_exists { user = user, host = host } then
		show_message [[That user does not exist on this server]]
		return 1;
	end

	local ok, msg = prosodyctl.deluser { user = user, host = host };

	if ok then return 0; end

	show_message(error_messages[msg])
	return 1;
end

local function service_command_warning(service_command)
	if prosody.installed and configmanager.get("*", "prosodyctl_service_warnings") ~= false then
		show_warning("WARNING: Use of prosodyctl start/stop/restart/reload is not recommended");
		show_warning("         if Prosody is managed by an init system - use that directly instead.");
		lfs = lfs or require
		if lfs.attributes("/etc/systemd") then
			show_warning("         e.g. systemctl %s prosody", service_command);
		elseif lfs.attributes("/etc/init.d/prosody") then
			show_warning("         e.g. /etc/init.d/prosody %s", service_command);
		end
		show_warning("");
	end
end

function commands.start(arg)
	if arg[1] == "--help" then
		show_usage([[start]], [[Start Prosody]]);
		return 1;
	end
	service_command_warning("start");
	local ok, ret = prosodyctl.isrunning();
	if not ok then
		show_message(error_messages[ret]);
		return 1;
	end

	if ret then
		--luacheck: ignore 421/ret
		local ok, ret = prosodyctl.getpid();
		if not ok then
			show_message("Couldn't get running Prosody's PID");
			show_message(error_messages[ret]);
			return 1;
		end
		show_message("Prosody is already running with PID %s", ret or "(unknown)");
		return 1;
	end

	--luacheck: ignore 411/ret
	local ok, ret = prosodyctl.start(prosody.paths.source);
	if ok then
		local daemonize = configmanager.get("*", "daemonize");
		if daemonize == nil then
			daemonize = prosody.installed;
		end
		if daemonize then
			local i=1;
			while true do
				local ok, running = prosodyctl.isrunning();
				if ok and running then
					break;
				elseif i == 5 then
					show_message("Still waiting...");
				elseif i >= prosodyctl_timeout then
					show_message("Prosody is still not running. Please give it some time or check your log files for errors.");
					return 2;
				end
				socket.sleep(0.5);
				i = i + 1;
			end
			show_message("Started");
		end
		return 0;
	end

	show_message("Failed to start Prosody");
	show_message(error_messages[ret])
	return 1;
end

function commands.status(arg)
	if arg[1] == "--help" then
		show_usage([[status]], [[Reports the running status of Prosody]]);
		return 1;
	end

	local ok, ret = prosodyctl.isrunning();
	if not ok then
		show_message(error_messages[ret]);
		return 1;
	end

	if ret then
		--luacheck: ignore 421/ret
		local ok, ret = prosodyctl.getpid();
		if not ok then
			show_message("Couldn't get running Prosody's PID");
			show_message(error_messages[ret]);
			return 1;
		end
		show_message("Prosody is running with PID %s", ret or "(unknown)");
		return 0;
	else
		show_message("Prosody is not running");
		if not prosody.switched_user and prosody.current_uid ~= 0 then
			print("\nNote:")
			print(" You will also see this if prosodyctl is not running under");
			print(" the same user account as Prosody. Try running as root (e.g. ");
			print(" with 'sudo' in front) to gain access to Prosody's real status.");
		end
		return 2
	end
end

function commands.stop(arg)
	if arg[1] == "--help" then
		show_usage([[stop]], [[Stop a running Prosody server]]);
		return 1;
	end

	service_command_warning("stop");

	if not prosodyctl.isrunning() then
		show_message("Prosody is not running");
		return 1;
	end

	local ok, ret = prosodyctl.stop();
	if ok then
		local i=1;
		while true do
			local ok, running = prosodyctl.isrunning();
			if ok and not running then
				break;
			elseif i == 5 then
				show_message("Still waiting...");
			elseif i >= prosodyctl_timeout then
				show_message("Prosody is still running. Please give it some time or check your log files for errors.");
				return 2;
			end
			socket.sleep(0.5);
			i = i + 1;
		end
		show_message("Stopped");
		return 0;
	end

	show_message(error_messages[ret]);
	return 1;
end

function commands.restart(arg)
	if arg[1] == "--help" then
		show_usage([[restart]], [[Restart a running Prosody server]]);
		return 1;
	end

	service_command_warning("restart");

	commands.stop(arg);
	return commands.start(arg);
end

function commands.about(arg)
	if arg[1] == "--help" then
		show_usage([[about]], [[Show information about this Prosody installation]]);
		return 1;
	end

	local pwd = ".";
	local array = require "util.array";
	local keys = require "util.iterators".keys;
	local hg = require"util.mercurial";
	local relpath = configmanager.resolve_relative_path;

	print("Prosody "..(prosody.version or "(unknown version)"));
	print("");
	print("# Prosody directories");
	print("Data directory:     "..relpath(pwd, prosody.paths.data));
	print("Config directory:   "..relpath(pwd, prosody.paths.config or "."));
	print("Source directory:   "..relpath(pwd, prosody.paths.source or "."));
	print("Plugin directories:")
	print("  "..(prosody.paths.plugins:gsub("([^;]+);?", function(path)
			path = configmanager.resolve_relative_path(pwd, path);
			local hgid, hgrepo = hg.check_id(path);
			if not hgid and hgrepo then
				return path.." - "..hgrepo .."!\n  ";
			end
			-- 010452cfaf53 is the first commit in the prosody-modules repository
			hgrepo = hgrepo == "010452cfaf53" and "prosody-modules";
			return path..(hgid and " - "..(hgrepo or "HG").." rev: "..hgid or "")
				.."\n  ";
		end)));
	print("");
	print("# Lua environment");
	print("Lua version:             ", _G._VERSION);
	print("");
	print("Lua module search paths:");
	for path in package.path:gmatch("[^;]+") do
		print("  "..path);
	end
	print("");
	print("Lua C module search paths:");
	for path in package.cpath:gmatch("[^;]+") do
		print("  "..path);
	end
	print("");
	local luarocks_status = "Not installed"
	if pcall(require, "luarocks.loader") then
		luarocks_status = "Installed (2.x+)";
		if package.loaded["luarocks.cfg"] then
			luarocks_status = "Installed ("..(package.loaded["luarocks.cfg"].program_version or "2.x+")..")";
		end
	elseif pcall(require, "luarocks.require") then
		luarocks_status = "Installed (1.x)";
	end
	print("LuaRocks:        ", luarocks_status);
	print("");
	print("# Network");
	print("");
	print("Backend: "..require "net.server".get_backend());
	print("");
	print("# Lua module versions");
	local module_versions, longest_name = {}, 8;
	local luaevent =dependencies.softreq"luaevent";
	dependencies.softreq"ssl";
	dependencies.softreq"DBI";
	for name, module in pairs(package.loaded) do
		if type(module) == "table" and rawget(module, "_VERSION")
		and name ~= "_G" and not name:match("%.") then
			if #name > longest_name then
				longest_name = #name;
			end
			module_versions[name] = module._VERSION;
		end
	end
	if luaevent then
		module_versions["libevent"] = luaevent.core.libevent_version();
	end
	local sorted_keys = array.collect(keys(module_versions)):sort();
	for _, name in ipairs(sorted_keys) do
		print(name..":"..string.rep(" ", longest_name-#name), module_versions[name]);
	end
	print("");
end

function commands.reload(arg)
	if arg[1] == "--help" then
		show_usage([[reload]], [[Reload Prosody's configuration and re-open log files]]);
		return 1;
	end

	service_command_warning("reload");

	if not prosodyctl.isrunning() then
		show_message("Prosody is not running");
		return 1;
	end

	local ok, ret = prosodyctl.reload();
	if ok then

		show_message("Prosody log files re-opened and config file reloaded. You may need to reload modules for some changes to take effect.");
		return 0;
	end

	show_message(error_messages[ret]);
	return 1;
end
-- ejabberdctl compatibility

local unpack = table.unpack or unpack; -- luacheck: ignore 113

function commands.register(arg)
	local user, host, password = unpack(arg);
	if (not (user and host)) or arg[1] == "--help" then
		if user ~= "--help" then
			if not user then
				show_message [[No username specified]]
			elseif not host then
				show_message [[Please specify which host you want to register the user on]];
			end
		end
		show_usage("register USER HOST [PASSWORD]", "Register a user on the server, with the given password");
		return 1;
	end
	if not password then
		password = read_password();
		if not password then
			show_message [[Unable to register user with no password]];
			return 1;
		end
	end

	local ok, msg = prosodyctl.adduser { user = user, host = host, password = password };

	if ok then return 0; end

	show_message(error_messages[msg])
	return 1;
end

function commands.unregister(arg)
	local user, host = unpack(arg);
	if (not (user and host)) or arg[1] == "--help" then
		if user ~= "--help" then
			if not user then
				show_message [[No username specified]]
			elseif not host then
				show_message [[Please specify which host you want to unregister the user from]];
			end
		end
		show_usage("unregister USER HOST [PASSWORD]", "Permanently remove a user account from the server");
		return 1;
	end

	local ok, msg = prosodyctl.deluser { user = user, host = host };

	if ok then return 0; end

	show_message(error_messages[msg])
	return 1;
end

local openssl;

local cert_commands = {};

-- If a file already exists, ask if the user wants to use it or replace it
-- Backups the old file if replaced
local function use_existing(filename)
	local attrs = lfs.attributes(filename);
	if attrs then
		if show_yesno(filename .. " exists, do you want to replace it? [y/n]") then
			local backup = filename..".bkp~"..os.date("%FT%T", attrs.change);
			os.rename(filename, backup);
			show_message(filename.." backed up to "..backup);
		else
			-- Use the existing file
			return true;
		end
	end
end

local have_pposix, pposix = pcall(require, "util.pposix");
local cert_basedir = prosody.paths.data == "." and "./certs" or prosody.paths.data;
if have_pposix and pposix.getuid() == 0 then
	-- FIXME should be enough to check if this directory is writable
	local cert_dir = configmanager.get("*", "certificates") or "certs";
	cert_basedir = configmanager.resolve_relative_path(prosody.paths.config, cert_dir);
end

function cert_commands.config(arg)
	if #arg >= 1 and arg[1] ~= "--help" then
		local conf_filename = cert_basedir .. "/" .. arg[1] .. ".cnf";
		if use_existing(conf_filename) then
			return nil, conf_filename;
		end
		local distinguished_name;
		if arg[#arg]:find("^/") then
			distinguished_name = table.remove(arg);
		end
		local conf = openssl.config.new();
		conf:from_prosody(prosody.hosts, configmanager, arg);
		if distinguished_name then
			local dn = {};
			for k, v in distinguished_name:gmatch("/([^=/]+)=([^/]+)") do
				table.insert(dn, k);
				dn[k] = v;
			end
			conf.distinguished_name = dn;
		else
			show_message("Please provide details to include in the certificate config file.");
			show_message("Leave the field empty to use the default value or '.' to exclude the field.")
			for _, k in ipairs(openssl._DN_order) do
				local v = conf.distinguished_name[k];
				if v then
					local nv = nil;
					if k == "commonName" then
						v = arg[1]
					elseif k == "emailAddress" then
						v = "xmpp@" .. arg[1];
					elseif k == "countryName" then
						local tld = arg[1]:match"%.([a-z]+)$";
						if tld and #tld == 2 and tld ~= "uk" then
							v = tld:upper();
						end
					end
					nv = show_prompt(("%s (%s):"):format(k, nv or v));
					nv = (not nv or nv == "") and v or nv;
					if nv:find"[\192-\252][\128-\191]+" then
						conf.req.string_mask = "utf8only"
					end
					conf.distinguished_name[k] = nv ~= "." and nv or nil;
				end
			end
		end
		local conf_file, err = io.open(conf_filename, "w");
		if not conf_file then
			show_warning("Could not open OpenSSL config file for writing");
			show_warning(err);
			os.exit(1);
		end
		conf_file:write(conf:serialize());
		conf_file:close();
		print("");
		show_message("Config written to " .. conf_filename);
		return nil, conf_filename;
	else
		show_usage("cert config HOSTNAME [HOSTNAME+]", "Builds a certificate config file covering the supplied hostname(s)")
	end
end

function cert_commands.key(arg)
	if #arg >= 1 and arg[1] ~= "--help" then
		local key_filename = cert_basedir .. "/" .. arg[1] .. ".key";
		if use_existing(key_filename) then
			return nil, key_filename;
		end
		os.remove(key_filename); -- This file, if it exists is unlikely to have write permissions
		local key_size = tonumber(arg[2] or show_prompt("Choose key size (2048):") or 2048);
		local old_umask = pposix.umask("0377");
		if openssl.genrsa{out=key_filename, key_size} then
			os.execute(("chmod 400 '%s'"):format(key_filename));
			show_message("Key written to ".. key_filename);
			pposix.umask(old_umask);
			return nil, key_filename;
		end
		show_message("There was a problem, see OpenSSL output");
	else
		show_usage("cert key HOSTNAME <bits>", "Generates a RSA key named HOSTNAME.key\n "
		.."Prompts for a key size if none given")
	end
end

function cert_commands.request(arg)
	if #arg >= 1 and arg[1] ~= "--help" then
		local req_filename = cert_basedir .. "/" .. arg[1] .. ".req";
		if use_existing(req_filename) then
			return nil, req_filename;
		end
		local _, key_filename = cert_commands.key({arg[1]});
		local _, conf_filename = cert_commands.config(arg);
		if openssl.req{new=true, key=key_filename, utf8=true, sha256=true, config=conf_filename, out=req_filename} then
			show_message("Certificate request written to ".. req_filename);
		else
			show_message("There was a problem, see OpenSSL output");
		end
	else
		show_usage("cert request HOSTNAME [HOSTNAME+]", "Generates a certificate request for the supplied hostname(s)")
	end
end

function cert_commands.generate(arg)
	if #arg >= 1 and arg[1] ~= "--help" then
		local cert_filename = cert_basedir .. "/" .. arg[1] .. ".crt";
		if use_existing(cert_filename) then
			return nil, cert_filename;
		end
		local _, key_filename = cert_commands.key({arg[1]});
		local _, conf_filename = cert_commands.config(arg);
		if key_filename and conf_filename and cert_filename
			and openssl.req{new=true, x509=true, nodes=true, key=key_filename,
				days=365, sha256=true, utf8=true, config=conf_filename, out=cert_filename} then
			show_message("Certificate written to ".. cert_filename);
			print();
		else
			show_message("There was a problem, see OpenSSL output");
		end
	else
		show_usage("cert generate HOSTNAME [HOSTNAME+]", "Generates a self-signed certificate for the current hostname(s)")
	end
end

local function sh_esc(s)
	return "'" .. s:gsub("'", "'\\''") .. "'";
end

local function copy(from, to, umask, owner, group)
	local old_umask = umask and pposix.umask(umask);
	local attrs = lfs.attributes(to);
	if attrs then -- Move old file out of the way
		local backup = to..".bkp~"..os.date("%FT%T", attrs.change);
		os.rename(to, backup);
	end
	-- FIXME friendlier error handling, maybe move above backup back?
	local input = assert(io.open(from));
	local output = assert(io.open(to, "w"));
	local data = input:read(2^11);
	while data and output:write(data) do
		data = input:read(2^11);
	end
	assert(input:close());
	assert(output:close());
	if not prosody.installed then
		-- FIXME this is possibly specific to GNU chown
		os.execute(("chown -c --reference=%s %s"):format(sh_esc(cert_basedir), sh_esc(to)));
	elseif owner and group then
		local ok = os.execute(("chown %s:%s %s"):format(sh_esc(owner), sh_esc(group), sh_esc(to)));
		assert(ok == true or ok == 0, "Failed to change ownership of "..to);
	end
	if old_umask then pposix.umask(old_umask); end
	return true;
end

function cert_commands.import(arg)
	local hostnames = {};
	-- Move hostname arguments out of arg, the rest should be a list of paths
	while arg[1] and prosody.hosts[ arg[1] ] do
		table.insert(hostnames, table.remove(arg, 1));
	end
	if hostnames[1] == nil then
		local domains = os.getenv"RENEWED_DOMAINS"; -- Set if invoked via certbot
		if domains then
			for host in domains:gmatch("%S+") do
				table.insert(hostnames, host);
			end
		else
			for host in pairs(prosody.hosts) do
				if host ~= "*" and configmanager.get(host, "enabled") ~= false then
					table.insert(hostnames, host);
				end
			end
		end
	end
	if not arg[1] or arg[1] == "--help" then -- Probably forgot the path
		show_usage("cert import [HOSTNAME+] /path/to/certs [/other/paths/]+",
			"Copies certificates to "..cert_basedir);
		return 1;
	end
	local owner, group;
	if pposix.getuid() == 0 then -- We need root to change ownership
		owner = configmanager.get("*", "prosody_user") or "prosody";
		group = configmanager.get("*", "prosody_group") or owner;
	end
	local cm = require "core.certmanager";
	local imported = {};
	for _, host in ipairs(hostnames) do
		for _, dir in ipairs(arg) do
			local paths = cm.find_cert(dir, host);
			if paths then
				copy(paths.certificate, cert_basedir .. "/" .. host .. ".crt", nil, owner, group);
				copy(paths.key, cert_basedir .. "/" .. host .. ".key", "0377", owner, group);
				table.insert(imported, host);
			else
				-- TODO Say where we looked
				show_warning("No certificate for host "..host.." found :(");
			end
			-- TODO Additional checks
			-- Certificate names matches the hostname
			-- Private key matches public key in certificate
		end
	end
	if imported[1] then
		show_message("Imported certificate and key for hosts "..table.concat(imported, ", "));
		local ok, err = prosodyctl.reload();
		if not ok and err ~= "not-running" then
			show_message(error_messages[err]);
		end
	else
		show_warning("No certificates imported :(");
		return 1;
	end
end

function commands.cert(arg)
	if #arg >= 1 and arg[1] ~= "--help" then
		openssl = require "util.openssl";
		lfs = require "lfs";
		local cert_dir_attrs = lfs.attributes(cert_basedir);
		if not cert_dir_attrs then
			show_warning("The directory "..cert_basedir.." does not exist");
			return 1; -- TODO Should we create it?
		end
		local uid = pposix.getuid();
		if uid ~= 0 and uid ~= cert_dir_attrs.uid then
			show_warning("The directory "..cert_basedir.." is not owned by the current user, won't be able to write files to it");
			return 1;
		elseif not cert_dir_attrs.permissions then -- COMPAT with LuaFilesystem < 1.6.2 (hey CentOS!)
			show_message("Unable to check permissions on "..cert_basedir.." (LuaFilesystem 1.6.2+ required)");
			show_message("Please confirm that Prosody (and only Prosody) can write to this directory)");
		elseif cert_dir_attrs.permissions:match("^%.w..%-..%-.$") then
			show_warning("The directory "..cert_basedir.." not only writable by its owner");
			return 1;
		end
		local subcmd = table.remove(arg, 1);
		if type(cert_commands[subcmd]) == "function" then
			if subcmd ~= "import" then -- hostnames are optional for import
				if not arg[1] then
					show_message"You need to supply at least one hostname"
					arg = { "--help" };
				end
				if arg[1] ~= "--help" and not prosody.hosts[arg[1]] then
					show_message(error_messages["no-such-host"]);
					return 1;
				end
			end
			return cert_commands[subcmd](arg);
		elseif subcmd == "check" then
			return commands.check({"certs"});
		end
	end
	show_usage("cert config|request|generate|key|import", "Helpers for generating X.509 certificates and keys.")
	for _, cmd in pairs(cert_commands) do
		print()
		cmd{ "--help" }
	end
end

function commands.check(arg)
	if arg[1] == "--help" then
		show_usage([[check]], [[Perform basic checks on your Prosody installation]]);
		return 1;
	end
	local what = table.remove(arg, 1);
	local set = require "util.set";
	local it = require "util.iterators";
	local ok = true;
	local function disabled_hosts(host, conf) return host ~= "*" and conf.enabled ~= false; end
	local function enabled_hosts() return it.filter(disabled_hosts, pairs(configmanager.getconfig())); end
	if not (what == nil or what == "disabled" or what == "config" or what == "dns" or what == "certs") then
		show_warning("Don't know how to check '%s'. Try one of 'config', 'dns', 'certs' or 'disabled'.", what);
		return 1;
	end
	if not what or what == "disabled" then
		local disabled_hosts_set = set.new();
		for host, host_options in it.filter("*", pairs(configmanager.getconfig())) do
			if host_options.enabled == false then
				disabled_hosts_set:add(host);
			end
		end
		if not disabled_hosts_set:empty() then
			local msg = "Checks will be skipped for these disabled hosts: %s";
			if what then msg = "These hosts are disabled: %s"; end
			show_warning(msg, tostring(disabled_hosts_set));
			if what then return 0; end
			print""
		end
	end
	if not what or what == "config" then
		print("Checking config...");
		local deprecated = set.new({
			"bosh_ports", "disallow_s2s", "no_daemonize", "anonymous_login", "require_encryption",
			"vcard_compatibility",
		});
		local known_global_options = set.new({
			"pidfile", "log", "plugin_paths", "prosody_user", "prosody_group", "daemonize",
			"umask", "prosodyctl_timeout", "use_ipv6", "use_libevent", "network_settings",
			"network_backend", "http_default_host",
			"statistics_interval", "statistics", "statistics_config",
		});
		local config = configmanager.getconfig();
		-- Check that we have any global options (caused by putting a host at the top)
		if it.count(it.filter("log", pairs(config["*"]))) == 0 then
			ok = false;
			print("");
			print("    No global options defined. Perhaps you have put a host definition at the top")
			print("    of the config file? They should be at the bottom, see https://prosody.im/doc/configure#overview");
		end
		if it.count(enabled_hosts()) == 0 then
			ok = false;
			print("");
			if it.count(it.filter("*", pairs(config))) == 0 then
				print("    No hosts are defined, please add at least one VirtualHost section")
			elseif config["*"]["enabled"] == false then
				print("    No hosts are enabled. Remove enabled = false from the global section or put enabled = true under at least one VirtualHost section")
			else
				print("    All hosts are disabled. Remove enabled = false from at least one VirtualHost section")
			end
		end
		if not config["*"].modules_enabled then
			print("    No global modules_enabled is set?");
			local suggested_global_modules;
			for host, options in enabled_hosts() do --luacheck: ignore 213/host
				if not options.component_module and options.modules_enabled then
					suggested_global_modules = set.intersection(suggested_global_modules or set.new(options.modules_enabled), set.new(options.modules_enabled));
				end
			end
			if suggested_global_modules and not suggested_global_modules:empty() then
				print("    Consider moving these modules into modules_enabled in the global section:")
				print("    "..tostring(suggested_global_modules / function (x) return ("%q"):format(x) end));
			end
			print();
		end

		do -- Check for modules enabled both normally and as components
			local modules = set.new(config["*"]["modules_enabled"]);
			for host, options in enabled_hosts() do
				local component_module = options.component_module;
				if component_module and modules:contains(component_module) then
					print(("    mod_%s is enabled both in modules_enabled and as Component %q %q"):format(component_module, host, component_module));
					print("    This means the service is enabled on all VirtualHosts as well as the Component.");
					print("    Are you sure this what you want? It may cause unexpected behaviour.");
				end
			end
		end

		-- Check for global options under hosts
		local global_options = set.new(it.to_array(it.keys(config["*"])));
		local deprecated_global_options = set.intersection(global_options, deprecated);
		if not deprecated_global_options:empty() then
			print("");
			print("    You have some deprecated options in the global section:");
			print("    "..tostring(deprecated_global_options))
			ok = false;
		end
		for host, options in it.filter(function (h) return h ~= "*" end, pairs(configmanager.getconfig())) do
			local host_options = set.new(it.to_array(it.keys(options)));
			local misplaced_options = set.intersection(host_options, known_global_options);
			for name in pairs(options) do
				if name:match("^interfaces?")
				or name:match("_ports?$") or name:match("_interfaces?$")
				or (name:match("_ssl$") and not name:match("^[cs]2s_ssl$")) then
					misplaced_options:add(name);
				end
			end
			if not misplaced_options:empty() then
				ok = false;
				print("");
				local n = it.count(misplaced_options);
				print("    You have "..n.." option"..(n>1 and "s " or " ").."set under "..host.." that should be");
				print("    in the global section of the config file, above any VirtualHost or Component definitions,")
				print("    see https://prosody.im/doc/configure#overview for more information.")
				print("");
				print("    You need to move the following option"..(n>1 and "s" or "")..": "..table.concat(it.to_array(misplaced_options), ", "));
			end
		end
		for host, options in enabled_hosts() do
			local host_options = set.new(it.to_array(it.keys(options)));
			local subdomain = host:match("^[^.]+");
			if not(host_options:contains("component_module")) and (subdomain == "jabber" or subdomain == "xmpp"
			   or subdomain == "chat" or subdomain == "im") then
				print("");
				print("    Suggestion: If "..host.. " is a new host with no real users yet, consider renaming it now to");
				print("     "..host:gsub("^[^.]+%.", "")..". You can use SRV records to redirect XMPP clients and servers to "..host..".");
				print("     For more information see: https://prosody.im/doc/dns");
			end
		end
		local all_modules = set.new(config["*"].modules_enabled);
		local all_options = set.new(it.to_array(it.keys(config["*"])));
		for host in enabled_hosts() do
			all_options:include(set.new(it.to_array(it.keys(config[host]))));
			all_modules:include(set.new(config[host].modules_enabled));
		end
		for mod in all_modules do
			if mod:match("^mod_") then
				print("");
				print("    Modules in modules_enabled should not have the 'mod_' prefix included.");
				print("    Change '"..mod.."' to '"..mod:match("^mod_(.*)").."'.");
			elseif mod:match("^auth_") then
				print("");
				print("    Authentication modules should not be added to modules_enabled,");
				print("    but be specified in the 'authentication' option.");
				print("    Remove '"..mod.."' from modules_enabled and instead add");
				print("        authentication = '"..mod:match("^auth_(.*)").."'");
				print("    For more information see https://prosody.im/doc/authentication");
			elseif mod:match("^storage_") then
				print("");
				print("    storage modules should not be added to modules_enabled,");
				print("    but be specified in the 'storage' option.");
				print("    Remove '"..mod.."' from modules_enabled and instead add");
				print("        storage = '"..mod:match("^storage_(.*)").."'");
				print("    For more information see https://prosody.im/doc/storage");
			end
		end
		if all_modules:contains("vcard") and all_modules:contains("vcard_legacy") then
			print("");
			print("    Both mod_vcard_legacy and mod_vcard are enabled but they conflict");
			print("    with each other. Remove one.");
		end
		if all_modules:contains("pep") and all_modules:contains("pep_simple") then
			print("");
			print("    Both mod_pep_simple and mod_pep are enabled but they conflict");
			print("    with each other. Remove one.");
		end
		for host, host_config in pairs(config) do --luacheck: ignore 213/host
			if type(rawget(host_config, "storage")) == "string" and rawget(host_config, "default_storage") then
				print("");
				print("    The 'default_storage' option is not needed if 'storage' is set to a string.");
				break;
			end
		end
		local require_encryption = set.intersection(all_options, set.new({
			"require_encryption", "c2s_require_encryption", "s2s_require_encryption"
		})):empty();
		local ssl = dependencies.softreq"ssl";
		if not ssl then
			if not require_encryption then
				print("");
				print("    You require encryption but LuaSec is not available.");
				print("    Connections will fail.");
				ok = false;
			end
		elseif not ssl.loadcertificate then
			if all_options:contains("s2s_secure_auth") then
				print("");
				print("    You have set s2s_secure_auth but your version of LuaSec does ");
				print("    not support certificate validation, so all s2s connections will");
				print("    fail.");
				ok = false;
			elseif all_options:contains("s2s_secure_domains") then
				local secure_domains = set.new();
				for host in enabled_hosts() do
					if config[host].s2s_secure_auth == true then
						secure_domains:add("*");
					else
						secure_domains:include(set.new(config[host].s2s_secure_domains));
					end
				end
				if not secure_domains:empty() then
					print("");
					print("    You have set s2s_secure_domains but your version of LuaSec does ");
					print("    not support certificate validation, so s2s connections to/from ");
					print("    these domains will fail.");
					ok = false;
				end
			end
		elseif require_encryption and not all_modules:contains("tls") then
			print("");
			print("    You require encryption but mod_tls is not enabled.");
			print("    Connections will fail.");
			ok = false;
		end

		print("Done.\n");
	end
	if not what or what == "dns" then
		local dns = require "net.dns";
		local idna = require "util.encodings".idna;
		local ip = require "util.ip";
		local c2s_ports = set.new(configmanager.get("*", "c2s_ports") or {5222});
		local s2s_ports = set.new(configmanager.get("*", "s2s_ports") or {5269});

		local c2s_srv_required, s2s_srv_required;
		if not c2s_ports:contains(5222) then
			c2s_srv_required = true;
		end
		if not s2s_ports:contains(5269) then
			s2s_srv_required = true;
		end

		local problem_hosts = set.new();

		local external_addresses, internal_addresses = set.new(), set.new();

		local fqdn = socket.dns.tohostname(socket.dns.gethostname());
		if fqdn then
			do
				local res = dns.lookup(idna.to_ascii(fqdn), "A");
				if res then
					for _, record in ipairs(res) do
						external_addresses:add(record.a);
					end
				end
			end
			do
				local res = dns.lookup(idna.to_ascii(fqdn), "AAAA");
				if res then
					for _, record in ipairs(res) do
						external_addresses:add(record.aaaa);
					end
				end
			end
		end

		local local_addresses = require"util.net".local_addresses() or {};

		for addr in it.values(local_addresses) do
			if not ip.new_ip(addr).private then
				external_addresses:add(addr);
			else
				internal_addresses:add(addr);
			end
		end

		if external_addresses:empty() then
			print("");
			print("   Failed to determine the external addresses of this server. Checks may be inaccurate.");
			c2s_srv_required, s2s_srv_required = true, true;
		end

		local v6_supported = not not socket.tcp6;

		for jid, host_options in enabled_hosts() do
			local all_targets_ok, some_targets_ok = true, false;
			local node, host = jid_split(jid);

			local modules, component_module = modulemanager.get_modules_for_host(host);
			if component_module then
				modules:add(component_module);
			end

			local is_component = not not host_options.component_module;
			print("Checking DNS for "..(is_component and "component" or "host").." "..jid.."...");
			if node then
				print("Only the domain part ("..host..") is used in DNS.")
			end
			local target_hosts = set.new();
			if modules:contains("c2s") then
				local res = dns.lookup("_xmpp-client._tcp."..idna.to_ascii(host)..".", "SRV");
				if res then
					for _, record in ipairs(res) do
						target_hosts:add(record.srv.target);
						if not c2s_ports:contains(record.srv.port) then
							print("    SRV target "..record.srv.target.." contains unknown client port: "..record.srv.port);
						end
					end
				else
					if c2s_srv_required then
						print("    No _xmpp-client SRV record found for "..host..", but it looks like you need one.");
						all_targets_ok = false;
					else
						target_hosts:add(host);
					end
				end
			end
			if modules:contains("s2s") then
				local res = dns.lookup("_xmpp-server._tcp."..idna.to_ascii(host)..".", "SRV");
				if res then
					for _, record in ipairs(res) do
						target_hosts:add(record.srv.target);
						if not s2s_ports:contains(record.srv.port) then
							print("    SRV target "..record.srv.target.." contains unknown server port: "..record.srv.port);
						end
					end
				else
					if s2s_srv_required then
						print("    No _xmpp-server SRV record found for "..host..", but it looks like you need one.");
						all_targets_ok = false;
					else
						target_hosts:add(host);
					end
				end
			end
			if target_hosts:empty() then
				target_hosts:add(host);
			end

			if target_hosts:contains("localhost") then
				print("    Target 'localhost' cannot be accessed from other servers");
				target_hosts:remove("localhost");
			end

			if modules:contains("proxy65") then
				local proxy65_target = configmanager.get(host, "proxy65_address") or host;
				if type(proxy65_target) == "string" then
					local A, AAAA = dns.lookup(idna.to_ascii(proxy65_target), "A"), dns.lookup(idna.to_ascii(proxy65_target), "AAAA");
					local prob = {};
					if not A then
						table.insert(prob, "A");
					end
					if v6_supported and not AAAA then
						table.insert(prob, "AAAA");
					end
					if #prob > 0 then
						print("    File transfer proxy "..proxy65_target.." has no "..table.concat(prob, "/")
						.." record. Create one or set 'proxy65_address' to the correct host/IP.");
					end
				else
					print("    proxy65_address for "..host.." should be set to a string, unable to perform DNS check");
				end
			end

			for target_host in target_hosts do
				local host_ok_v4, host_ok_v6;
				do
					local res = dns.lookup(idna.to_ascii(target_host), "A");
					if res then
						for _, record in ipairs(res) do
							if external_addresses:contains(record.a) then
								some_targets_ok = true;
								host_ok_v4 = true;
							elseif internal_addresses:contains(record.a) then
								host_ok_v4 = true;
								some_targets_ok = true;
								print("    "..target_host.." A record points to internal address, external connections might fail");
							else
								print("    "..target_host.." A record points to unknown address "..record.a);
								all_targets_ok = false;
							end
						end
					end
				end
				do
					local res = dns.lookup(idna.to_ascii(target_host), "AAAA");
					if res then
						for _, record in ipairs(res) do
							if external_addresses:contains(record.aaaa) then
								some_targets_ok = true;
								host_ok_v6 = true;
							elseif internal_addresses:contains(record.aaaa) then
								host_ok_v6 = true;
								some_targets_ok = true;
								print("    "..target_host.." AAAA record points to internal address, external connections might fail");
							else
								print("    "..target_host.." AAAA record points to unknown address "..record.aaaa);
								all_targets_ok = false;
							end
						end
					end
				end

				local bad_protos = {}
				if not host_ok_v4 then
					table.insert(bad_protos, "IPv4");
				end
				if not host_ok_v6 then
					table.insert(bad_protos, "IPv6");
				end
				if #bad_protos > 0 then
					print("    Host "..target_host.." does not seem to resolve to this server ("..table.concat(bad_protos, "/")..")");
				end
				if host_ok_v6 and not v6_supported then
					print("    Host "..target_host.." has AAAA records, but your version of LuaSocket does not support IPv6.");
					print("      Please see https://prosody.im/doc/ipv6 for more information.");
				end
			end
			if not all_targets_ok then
				print("    "..(some_targets_ok and "Only some" or "No").." targets for "..host.." appear to resolve to this server.");
				if is_component then
					print("    DNS records are necessary if you want users on other servers to access this component.");
				end
				problem_hosts:add(host);
			end
			print("");
		end
		if not problem_hosts:empty() then
			print("");
			print("For more information about DNS configuration please see https://prosody.im/doc/dns");
			print("");
			ok = false;
		end
	end
	if not what or what == "certs" then
		local cert_ok;
		print"Checking certificates..."
		local x509_verify_identity = require"util.x509".verify_identity;
		local create_context = require "core.certmanager".create_context;
		local ssl = dependencies.softreq"ssl";
		-- local datetime_parse = require"util.datetime".parse_x509;
		local load_cert = ssl and ssl.loadcertificate;
		-- or ssl.cert_from_pem
		if not ssl then
			print("LuaSec not available, can't perform certificate checks")
			if what == "certs" then cert_ok = false end
		elseif not load_cert then
			print("This version of LuaSec (" .. ssl._VERSION .. ") does not support certificate checking");
			cert_ok = false
		else
			local function skip_bare_jid_hosts(host)
				if jid_split(host) then
					-- See issue #779
					return false;
				end
				return true;
			end
			for host in it.filter(skip_bare_jid_hosts, enabled_hosts()) do
				print("Checking certificate for "..host);
				-- First, let's find out what certificate this host uses.
				local host_ssl_config = configmanager.rawget(host, "ssl")
					or configmanager.rawget(host:match("%.(.*)"), "ssl");
				local global_ssl_config = configmanager.rawget("*", "ssl");
				local ok, err, ssl_config = create_context(host, "server", host_ssl_config, global_ssl_config);
				if not ok then
					print("  Error: "..err);
					cert_ok = false
				elseif not ssl_config.certificate then
					print("  No 'certificate' found for "..host)
					cert_ok = false
				elseif not ssl_config.key then
					print("  No 'key' found for "..host)
					cert_ok = false
				else
					local key, err = io.open(ssl_config.key); -- Permissions check only
					if not key then
						print("    Could not open "..ssl_config.key..": "..err);
						cert_ok = false
					else
						key:close();
					end
					local cert_fh, err = io.open(ssl_config.certificate); -- Load the file.
					if not cert_fh then
						print("    Could not open "..ssl_config.certificate..": "..err);
						cert_ok = false
					else
						print("  Certificate: "..ssl_config.certificate)
						local cert = load_cert(cert_fh:read"*a"); cert_fh:close();
						if not cert:validat(os.time()) then
							print("    Certificate has expired.")
							cert_ok = false
						elseif not cert:validat(os.time() + 86400) then
							print("    Certificate expires within one day.")
							cert_ok = false
						elseif not cert:validat(os.time() + 86400*7) then
							print("    Certificate expires within one week.")
						elseif not cert:validat(os.time() + 86400*31) then
							print("    Certificate expires within one month.")
						end
						if configmanager.get(host, "component_module") == nil
							and not x509_verify_identity(host, "_xmpp-client", cert) then
							print("    Not valid for client connections to "..host..".")
							cert_ok = false
						end
						if (not (configmanager.get(host, "anonymous_login")
							or configmanager.get(host, "authentication") == "anonymous"))
							and not x509_verify_identity(host, "_xmpp-server", cert) then
							print("    Not valid for server-to-server connections to "..host..".")
							cert_ok = false
						end
					end
				end
			end
		end
		if cert_ok == false then
			print("")
			print("For more information about certificates please see https://prosody.im/doc/certificates");
			ok = false
		end
		print("")
	end
	if not ok then
		print("Problems found, see above.");
	else
		print("All checks passed, congratulations!");
	end
	return ok and 0 or 2;
end

---------------------

local async = require "util.async";
local server = require "net.server";
local watchers = {
	error = function (_, err)
		error(err);
	end;
	waiting = function ()
		server.loop();
	end;
};
local command_runner = async.runner(function ()
	if command and command:match("^mod_") then -- Is a command in a module
		local module_name = command:match("^mod_(.+)");
		do
			local ret, err = modulemanager.load("*", module_name);
			if not ret then
				show_message("Failed to load module '"..module_name.."': "..err);
				os.exit(1);
			end
		end

		table.remove(arg, 1);

		local module = modulemanager.get_module("*", module_name);
		if not module then
			show_message("Failed to load module '"..module_name.."': Unknown error");
			os.exit(1);
		end

		if not modulemanager.module_has_method(module, "command") then
			show_message("Fail: mod_"..module_name.." does not support any commands");
			os.exit(1);
		end

		local ok, ret = modulemanager.call_module_method(module, "command", arg);
		if ok then
			if type(ret) == "number" then
				os.exit(ret);
			elseif type(ret) == "string" then
				show_message(ret);
			end
			os.exit(0); -- :)
		else
			show_message("Failed to execute command: "..error_messages[ret]);
			os.exit(1); -- :(
		end
	end

	if not commands[command] then -- Show help for all commands
		function show_usage(usage, desc)
			print(" "..usage);
			print("    "..desc);
		end

		print("prosodyctl - Manage a Prosody server");
		print("");
		print("Usage: "..arg[0].." COMMAND [OPTIONS]");
		print("");
		print("Where COMMAND may be one of:\n");

		local hidden_commands = require "util.set".new{ "register", "unregister", "addplugin" };
		local commands_order = { "adduser", "passwd", "deluser", "start", "stop", "restart", "reload", "about" };

		local done = {};

		for _, command_name in ipairs(commands_order) do
			local command_func = commands[command_name];
			if command_func then
				command_func{ "--help" };
				print""
				done[command_name] = true;
			end
		end

		for command_name, command_func in pairs(commands) do
			if not done[command_name] and not hidden_commands:contains(command_name) then
				command_func{ "--help" };
				print""
				done[command_name] = true;
			end
		end


		os.exit(0);
	end

	os.exit(commands[command]({ select(2, unpack(arg)) }));
end, watchers);

command_runner:run(true);