File

util/human/io.lua @ 13801:a5d5fefb8b68 13.0

mod_tls: Enable Prosody's certificate checking for incoming s2s connections (fixes #1916) (thanks Damian, Zash) Various options in Prosody allow control over the behaviour of the certificate verification process For example, some deployments choose to allow falling back to traditional "dialback" authentication (XEP-0220), while others verify via DANE, hard-coded fingerprints, or other custom plugins. Implementing this flexibility requires us to override OpenSSL's default certificate verification, to allow Prosody to verify the certificate itself, apply custom policies and make decisions based on the outcome. To enable our custom logic, we have to suppress OpenSSL's default behaviour of aborting the connection with a TLS alert message. With LuaSec, this can be achieved by using the verifyext "lsec_continue" flag. We also need to use the lsec_ignore_purpose flag, because XMPP s2s uses server certificates as "client" certificates (for mutual TLS verification in outgoing s2s connections). Commit 99d2100d2918 moved these settings out of the defaults and into mod_s2s, because we only really need these changes for s2s, and they should be opt-in, rather than automatically applied to all TLS services we offer. That commit was incomplete, because it only added the flags for incoming direct TLS connections. StartTLS connections are handled by mod_tls, which was not applying the lsec_* flags. It previously worked because they were already in the defaults. This resulted in incoming s2s connections with "invalid" certificates being aborted early by OpenSSL, even if settings such as `s2s_secure_auth = false` or DANE were present in the config. Outgoing s2s connections inherit verify "none" from the defaults, which means OpenSSL will receive the cert but will not terminate the connection when it is deemed invalid. This means we don't need lsec_continue there, and we also don't need lsec_ignore_purpose (because the remote peer is a "server"). Wondering why we can't just use verify "none" for incoming s2s? It's because in that mode, OpenSSL won't request a certificate from the peer for incoming connections. Setting verify "peer" is how you ask OpenSSL to request a certificate from the client, but also what triggers its built-in verification.
author Matthew Wild <mwild1@gmail.com>
date Tue, 01 Apr 2025 17:26:56 +0100
parent 13367:82513890a1d8
line wrap: on
line source

local array = require "prosody.util.array";
local pposix = require "prosody.util.pposix";
local utf8 = rawget(_G, "utf8") or require"prosody.util.encodings".utf8;
local len = utf8.len or function(s)
	local _, count = s:gsub("[%z\001-\127\194-\253][\128-\191]*", "");
	return count;
end;

local function getchar(n)
	local stty_ret = os.execute("stty raw -echo 2>/dev/null");
	local ok, char;
	if stty_ret then
		ok, char = pcall(io.read, n or 1);
		os.execute("stty sane");
	else
		ok, char = pcall(io.read, "*l");
		if ok then
			char = char:sub(1, n or 1);
		end
	end
	if ok then
		return char;
	end
end

local function getline()
	local ok, line = pcall(io.read, "*l");
	if ok then
		return line;
	end
end

local function getpass()
	local stty_ret = os.execute("stty -echo 2>/dev/null");
	if not stty_ret then
		io.write("\027[08m"); -- ANSI 'hidden' text attribute
	end
	local ok, pass = pcall(io.read, "*l");
	if stty_ret then
		os.execute("stty sane");
	else
		io.write("\027[00m");
	end
	io.write("\n");
	if ok then
		return pass;
	end
end

local function show_yesno(prompt)
	io.write(prompt, " ");
	local choice = getchar():lower();
	io.write("\n");
	if not choice:match("%a") then
		choice = prompt:match("%[.-(%U).-%]$");
		if not choice then return nil; end
	end
	return (choice == "y");
end

local function read_password()
	local password;
	while true do
		io.write("Enter new password: ");
		password = getpass();
		if not password then
			print("No password - cancelled");
			return;
		end
		io.write("Retype new password: ");
		if getpass() ~= password then
			if not show_yesno [=[Passwords did not match, try again? [Y/n]]=] then
				return;
			end
		else
			break;
		end
	end
	return password;
end

local function show_prompt(prompt)
	io.write(prompt, " ");
	local line = getline();
	line = line and line:gsub("\n$","");
	return (line and #line > 0) and line or nil;
end

local function printf(fmt, ...)
	print(fmt:format(...));
end

local function padright(s, width)
	return s..string.rep(" ", width-len(s));
end

local function padleft(s, width)
	return string.rep(" ", width-len(s))..s;
end

local pat = "[%z\001-\127\194-\253][\128-\191]*";
local function utf8_cut(s, pos)
	return s:match("^"..pat:rep(pos)) or s;
end

if utf8.len and utf8.offset then
	function utf8_cut(s, pos)
		return s:sub(1, utf8.offset(s, pos+1)-1);
	end
end

local function term_width(default)
	local env_cols = tonumber(os.getenv "COLUMNS");
	if env_cols then return env_cols; end
	if not pposix.isatty(io.stdout) then
		return default;
	end
	local stty = io.popen("stty -a");
	if not stty then return default; end
	local result = stty:read("*a");
	if result then
		result = result:match("%f[%w]columns[ =]*(%d+)");
	end
	stty:close();
	return tonumber(result or default);
end

local function ellipsis(s, width)
	if len(s) <= width then return s; end
	if width <= 1 then return "…"; end
	return utf8_cut(s, width - 1) .. "…";
end

local function new_table(col_specs, max_width)
	max_width = max_width or term_width(80);
	local separator = " | ";

	local widths = {};
	local total_width = max_width - #separator * (#col_specs-1);
	local free_width = total_width;
	-- Calculate width of fixed-size columns
	for i = 1, #col_specs do
		local width = col_specs[i].width or "0";
		if not (type(width) == "string" and width:match("[p%%]$")) then
			local title = col_specs[i].title;
			width = math.max(tonumber(width), title and (#title+1) or 0);
			widths[i] = width;
			free_width = free_width - width;
		end
	end

	-- Calculate width of proportional columns
	local total_proportional_width = 0;
	for i = 1, #col_specs do
		if not widths[i] then
			local width_spec = col_specs[i].width:match("([%d%.]+)[p%%]");
			total_proportional_width = total_proportional_width + tonumber(width_spec);
		end
	end

	for i = 1, #col_specs do
		if not widths[i] then
			local width_spec = col_specs[i].width:match("([%d%.]+)[p%%]");
			local rel_width = tonumber(width_spec);
			widths[i] = math.floor(free_width*(rel_width/total_proportional_width));
		end
	end

	return function (row)
		local titles;
		if not row then
			titles, row = true, array.pluck(col_specs, "title", "");
		end
		local output = {};
		for i, column in ipairs(col_specs) do
			local width = widths[i];
			local v = row[not titles and column.key or i];
			if not titles and column.mapper then
				v = column.mapper(v, row, width, column);
			end
			if v == nil then
				v = column.default or "";
			else
				v = tostring(v);
			end
			if len(v) < width then
				if column.align == "right" then
					v = padleft(v, width);
				else
					v = padright(v, width);
				end
			elseif len(v) > width then
				v = (column.ellipsis or ellipsis)(v, width);
			end
			table.insert(output, v);
		end
		return table.concat(output, separator);
	end, max_width;
end

local day = 86400;
local multipliers = {
	d = day, w = day * 7, mon = 31 * day, y = 365.2425 * day;
	s = 1, min = 60, h = 3600, ho = 3600
};

local function parse_duration(duration_string)
	local n, m = duration_string:lower():match("(%d+)%s*([smhdwy]?[io]?n?)");
	if not n or not multipliers[m] then return nil; end
	return tonumber(n) * ( multipliers[m] or 1 );
end

local multipliers_lax = setmetatable({
	m = multipliers.mon;
	mo = multipliers.mon;
	mi = multipliers.min;
}, { __index = multipliers });

local function parse_duration_lax(duration_string)
	local n, m = duration_string:lower():match("(%d+)%s*([smhdwy]?[io]?)");
	if not n then return nil; end
	return tonumber(n) * ( multipliers_lax[m] or 1 );
end

return {
	getchar = getchar;
	getline = getline;
	getpass = getpass;
	show_yesno = show_yesno;
	read_password = read_password;
	show_prompt = show_prompt;
	printf = printf;
	padleft = padleft;
	padright = padright;
	term_width = term_width;
	ellipsis = ellipsis;
	table = new_table;
	parse_duration = parse_duration;
	parse_duration_lax = parse_duration_lax;
};