File

util/jsonschema.lua @ 13801:a5d5fefb8b68 13.0

mod_tls: Enable Prosody's certificate checking for incoming s2s connections (fixes #1916) (thanks Damian, Zash) Various options in Prosody allow control over the behaviour of the certificate verification process For example, some deployments choose to allow falling back to traditional "dialback" authentication (XEP-0220), while others verify via DANE, hard-coded fingerprints, or other custom plugins. Implementing this flexibility requires us to override OpenSSL's default certificate verification, to allow Prosody to verify the certificate itself, apply custom policies and make decisions based on the outcome. To enable our custom logic, we have to suppress OpenSSL's default behaviour of aborting the connection with a TLS alert message. With LuaSec, this can be achieved by using the verifyext "lsec_continue" flag. We also need to use the lsec_ignore_purpose flag, because XMPP s2s uses server certificates as "client" certificates (for mutual TLS verification in outgoing s2s connections). Commit 99d2100d2918 moved these settings out of the defaults and into mod_s2s, because we only really need these changes for s2s, and they should be opt-in, rather than automatically applied to all TLS services we offer. That commit was incomplete, because it only added the flags for incoming direct TLS connections. StartTLS connections are handled by mod_tls, which was not applying the lsec_* flags. It previously worked because they were already in the defaults. This resulted in incoming s2s connections with "invalid" certificates being aborted early by OpenSSL, even if settings such as `s2s_secure_auth = false` or DANE were present in the config. Outgoing s2s connections inherit verify "none" from the defaults, which means OpenSSL will receive the cert but will not terminate the connection when it is deemed invalid. This means we don't need lsec_continue there, and we also don't need lsec_ignore_purpose (because the remote peer is a "server"). Wondering why we can't just use verify "none" for incoming s2s? It's because in that mode, OpenSSL won't request a certificate from the peer for incoming connections. Setting verify "peer" is how you ask OpenSSL to request a certificate from the client, but also what triggers its built-in verification.
author Matthew Wild <mwild1@gmail.com>
date Tue, 01 Apr 2025 17:26:56 +0100
parent 13385:72d7830505f0
child 13867:eabd38507c1d
child 13866:7f6916088278
line wrap: on
line source

-- This file is generated from teal-src/util/jsonschema.lua

if not math.type then
	require("prosody.util.mathcompat")
end

local utf8_enc = rawget(_G, "utf8") or require("prosody.util.encodings").utf8;
local utf8_len = utf8_enc.len or function(s)
	local _, count = s:gsub("[%z\001-\127\194-\253][\128-\191]*", "");
	return count
end;

local json = require("prosody.util.json")
local null = json.null;

local pointer = require("prosody.util.jsonpointer")

local json_schema_object = { xml_t = {} }

local function simple_validate(schema, data)
	if schema == nil then
		return true
	elseif schema == "object" and type(data) == "table" then
		return type(data) == "table" and (next(data) == nil or type((next(data, nil))) == "string")
	elseif schema == "array" and type(data) == "table" then
		return type(data) == "table" and (next(data) == nil or type((next(data, nil))) == "number")
	elseif schema == "integer" then
		return math.type(data) == schema
	elseif schema == "null" then
		return data == null
	elseif type(schema) == "table" then
		for _, one in ipairs(schema) do
			if simple_validate(one, data) then
				return true
			end
		end
		return false
	else
		return type(data) == schema
	end
end

local function mkerr(sloc, iloc, err)
	return { schemaLocation = sloc; instanceLocation = iloc; error = err }
end

local function validate(schema, data, root, sloc, iloc, errs)
	if type(schema) == "boolean" then
		return schema
	end

	if root == nil then
		root = schema
		iloc = ""
		sloc = ""
		errs = {};
	end

	if schema["$ref"] and schema["$ref"]:sub(1, 1) == "#" then
		local referenced = pointer.resolve(root, schema["$ref"]:sub(2))
		if referenced ~= nil and referenced ~= root and referenced ~= schema then
			if not validate(referenced, data, root, schema["$ref"], iloc, errs) then
				table.insert(errs, mkerr(sloc .. "/$ref", iloc, "Subschema failed validation"))
				return false, errs
			end
		end
	end

	if not simple_validate(schema.type, data) then
		table.insert(errs, mkerr(sloc .. "/type", iloc, "unexpected type"));
		return false, errs
	end

	if schema.type == "object" then
		if type(data) == "table" then

			for k in pairs(data) do
				if not (type(k) == "string") then
					table.insert(errs, mkerr(sloc .. "/type", iloc, "'object' had non-string keys"));
					return false, errs
				end
			end
		end
	end

	if schema.type == "array" then
		if type(data) == "table" then

			for i in pairs(data) do
				if not (math.type(i) == "integer") then
					table.insert(errs, mkerr(sloc .. "/type", iloc, "'array' had non-integer keys"));
					return false, errs
				end
			end
		end
	end

	if schema["enum"] ~= nil then
		local match = false
		for _, v in ipairs(schema["enum"]) do
			if v == data then

				match = true
				break
			end
		end
		if not match then
			table.insert(errs, mkerr(sloc .. "/enum", iloc, "not one of the enumerated values"));
			return false, errs
		end
	end

	if type(data) == "string" then
		if schema.maxLength and utf8_len(data) > schema.maxLength then
			table.insert(errs, mkerr(sloc .. "/maxLength", iloc, "string too long"))
			return false, errs
		end
		if schema.minLength and utf8_len(data) < schema.minLength then
			table.insert(errs, mkerr(sloc .. "/maxLength", iloc, "string too short"))
			return false, errs
		end
		if schema.luaPattern and not data:match(schema.luaPattern) then
			table.insert(errs, mkerr(sloc .. "/luaPattern", iloc, "string does not match pattern"))
			return false, errs
		end
	end

	if type(data) == "number" then
		if schema.multipleOf and (data == 0 or data % schema.multipleOf ~= 0) then
			table.insert(errs, mkerr(sloc .. "/luaPattern", iloc, "not a multiple"))
			return false, errs
		end

		if schema.maximum and not (data <= schema.maximum) then
			table.insert(errs, mkerr(sloc .. "/maximum", iloc, "number exceeds maximum"))
			return false, errs
		end

		if schema.exclusiveMaximum and not (data < schema.exclusiveMaximum) then
			table.insert(errs, mkerr(sloc .. "/exclusiveMaximum", iloc, "number exceeds exclusive maximum"))
			return false, errs
		end

		if schema.minimum and not (data >= schema.minimum) then
			table.insert(errs, mkerr(sloc .. "/minimum", iloc, "number below minimum"))
			return false, errs
		end

		if schema.exclusiveMinimum and not (data > schema.exclusiveMinimum) then
			table.insert(errs, mkerr(sloc .. "/exclusiveMinimum", iloc, "number below exclusive minimum"))
			return false, errs
		end
	end

	if schema.allOf then
		for i, sub in ipairs(schema.allOf) do
			if not validate(sub, data, root, sloc .. "/allOf/" .. i, iloc, errs) then
				table.insert(errs, mkerr(sloc .. "/allOf", iloc, "did not match all subschemas"))
				return false, errs
			end
		end
	end

	if schema.oneOf then
		local valid = 0
		for i, sub in ipairs(schema.oneOf) do
			if validate(sub, data, root, sloc .. "/oneOf" .. i, iloc, errs) then
				valid = valid + 1
			end
		end
		if valid ~= 1 then
			table.insert(errs, mkerr(sloc .. "/oneOf", iloc, "did not match exactly one subschema"))
			return false, errs
		end
	end

	if schema.anyOf then
		local match = false
		for i, sub in ipairs(schema.anyOf) do
			if validate(sub, data, root, sloc .. "/anyOf/" .. i, iloc, errs) then
				match = true
				break
			end
		end
		if not match then
			table.insert(errs, mkerr(sloc .. "/anyOf", iloc, "did not match any subschema"))
			return false, errs
		end
	end

	if schema["not"] then
		if validate(schema["not"], data, root, sloc .. "/not", iloc, errs) then
			table.insert(errs, mkerr(sloc .. "/not", iloc, "did match subschema"))
			return false, errs
		end
	end

	if schema["if"] ~= nil then
		if validate(schema["if"], data, root, sloc .. "/if", iloc, errs) then
			if schema["then"] then
				if not validate(schema["then"], data, root, sloc .. "/then", iloc, errs) then
					table.insert(errs, mkerr(sloc .. "/then", iloc, "did not match subschema"))
					return false, errs
				end
			end
		else
			if schema["else"] then
				if not validate(schema["else"], data, root, sloc .. "/else", iloc, errs) then
					table.insert(errs, mkerr(sloc .. "/else", iloc, "did not match subschema"))
					return false, errs
				end
			end
		end
	end

	if schema.const ~= nil and schema.const ~= data then
		table.insert(errs, mkerr(sloc .. "/const", iloc, "did not match constant value"))
		return false, errs
	end

	if type(data) == "table" then

		if schema.maxItems and #(data) > schema.maxItems then
			table.insert(errs, mkerr(sloc .. "/maxItems", iloc, "too many items"))
			return false, errs
		end

		if schema.minItems and #(data) < schema.minItems then
			table.insert(errs, mkerr(sloc .. "/minItems", iloc, "too few items"))
			return false, errs
		end

		if schema.required then
			for _, k in ipairs(schema.required) do
				if data[k] == nil then
					table.insert(errs, mkerr(sloc .. "/required", iloc .. "/" .. tostring(k), "missing required property"))
					return false, errs
				end
			end
		end

		if schema.dependentRequired then
			for k, reqs in pairs(schema.dependentRequired) do
				if data[k] ~= nil then
					for _, req in ipairs(reqs) do
						if data[req] == nil then
							table.insert(errs, mkerr(sloc .. "/dependentRequired", iloc, "missing dependent required property"))
							return false, errs
						end
					end
				end
			end
		end

		if schema.propertyNames ~= nil then

			for k in pairs(data) do
				if not validate(schema.propertyNames, k, root, sloc .. "/propertyNames", iloc .. "/" .. tostring(k), errs) then
					table.insert(errs, mkerr(sloc .. "/propertyNames", iloc .. "/" .. tostring(k), "a property name did not match subschema"))
					return false, errs
				end
			end
		end

		local seen_properties = {}

		if schema.properties then
			for k, sub in pairs(schema.properties) do
				if data[k] ~= nil and not validate(sub, data[k], root, sloc .. "/" .. tostring(k), iloc .. "/" .. tostring(k), errs) then
					table.insert(errs, mkerr(sloc .. "/" .. tostring(k), iloc .. "/" .. tostring(k), "a property did not match subschema"))
					return false, errs
				end
				seen_properties[k] = true
			end
		end

		if schema.luaPatternProperties then

			for pattern, sub in pairs(schema.luaPatternProperties) do
				for k in pairs(data) do
					if type(k) == "string" and k:match(pattern) then
						if not validate(sub, data[k], root, sloc .. "/luaPatternProperties", iloc, errs) then
							table.insert(errs, mkerr(sloc .. "/luaPatternProperties/" .. pattern, iloc .. "/" .. tostring(k), "a property did not match subschema"))
							return false, errs
						end
						seen_properties[k] = true
					end
				end
			end
		end

		if schema.additionalProperties ~= nil then
			for k, v in pairs(data) do
				if not seen_properties[k] then
					if not validate(schema.additionalProperties, v, root, sloc .. "/additionalProperties", iloc .. "/" .. tostring(k), errs) then
						table.insert(errs, mkerr(sloc .. "/additionalProperties", iloc .. "/" .. tostring(k), "additional property did not match subschema"))
						return false, errs
					end
				end
			end
		end

		if schema.dependentSchemas then
			for k, sub in pairs(schema.dependentSchemas) do
				if data[k] ~= nil and not validate(sub, data, root, sloc .. "/dependentSchemas/" .. k, iloc, errs) then
					table.insert(errs, mkerr(sloc .. "/dependentSchemas", iloc .. "/" .. tostring(k), "did not match dependent subschema"))
					return false, errs
				end
			end
		end

		if schema.uniqueItems then

			local values = {}
			for _, v in pairs(data) do
				if values[v] then
					table.insert(errs, mkerr(sloc .. "/uniqueItems", iloc, "had duplicate items"))
					return false, errs
				end
				values[v] = true
			end
		end

		local p = 0
		if schema.prefixItems ~= nil then
			for i, s in ipairs(schema.prefixItems) do
				if data[i] == nil then
					break
				elseif validate(s, data[i], root, sloc .. "/prefixItems/" .. i, iloc .. "/" .. i, errs) then
					p = i
				else
					table.insert(errs, mkerr(sloc .. "/prefixItems/" .. i, iloc .. "/" .. tostring(i), "did not match subschema"))
					return false, errs
				end
			end
		end

		if schema.items ~= nil then
			for i = p + 1, #(data) do
				if not validate(schema.items, data[i], root, sloc, iloc .. "/" .. i, errs) then
					table.insert(errs, mkerr(sloc .. "/prefixItems/" .. i, iloc .. "/" .. i, "did not match subschema"))
					return false, errs
				end
			end
		end

		if schema.contains ~= nil then
			local found = 0
			for i = 1, #(data) do
				if validate(schema.contains, data[i], root, sloc .. "/contains", iloc .. "/" .. i, errs) then
					found = found + 1
				else
					table.insert(errs, mkerr(sloc .. "/contains", iloc .. "/" .. i, "did not match subschema"))
				end
			end
			if found < (schema.minContains or 1) then
				table.insert(errs, mkerr(sloc .. "/minContains", iloc, "too few matches"))
				return false, errs
			elseif found > (schema.maxContains or math.huge) then
				table.insert(errs, mkerr(sloc .. "/maxContains", iloc, "too many matches"))
				return false, errs
			end
		end
	end

	return true
end

json_schema_object.validate = validate;

return json_schema_object