Merge 0.11->trunk

11 files changed, 48 insertions, 41 deletions

diff --git a/plugins/mod_auth_internal_hashed.lua b/plugins/mod_auth_internal_hashed.lua
index 4fd0bd13..37621d20 100644
--- a/plugins/mod_auth_internal_hashed.lua
+++ b/plugins/mod_auth_internal_hashed.lua
@@ -16,6 +16,7 @@ local new_sasl = require "util.sasl".new;
 local hex = require"util.hex";
 local to_hex, from_hex = hex.to, hex.from;
 local saslprep = require "util.encodings".stringprep.saslprep;
+local secure_equals = require "util.hashes".equals;
 
 local log = module._log;
 local host = module.host;
@@ -41,7 +42,7 @@ function provider.test_password(username, password)
 	end
 
 	if credentials.password ~= nil and string.len(credentials.password) ~= 0 then
-		if saslprep(credentials.password) ~= password then
+		if not secure_equals(saslprep(credentials.password), password) then
 			return nil, "Auth failed. Provided password is incorrect.";
 		end
 
@@ -61,7 +62,7 @@ function provider.test_password(username, password)
 	local stored_key_hex = to_hex(stored_key);
 	local server_key_hex = to_hex(server_key);
 
-	if valid and stored_key_hex == credentials.stored_key and server_key_hex == credentials.server_key then
+	if valid and secure_equals(stored_key_hex, credentials.stored_key) and secure_equals(server_key_hex, credentials.server_key) then
 		return true;
 	else
 		return nil, "Auth failed. Invalid username, password, or password hash information.";
diff --git a/plugins/mod_auth_internal_plain.lua b/plugins/mod_auth_internal_plain.lua
index 56ef52d5..8a50e820 100644
--- a/plugins/mod_auth_internal_plain.lua
+++ b/plugins/mod_auth_internal_plain.lua
@@ -9,6 +9,7 @@
 local usermanager = require "core.usermanager";
 local new_sasl = require "util.sasl".new;
 local saslprep = require "util.encodings".stringprep.saslprep;
+local secure_equals = require "util.hashes".equals;
 
 local log = module._log;
 local host = module.host;
@@ -26,7 +27,7 @@ function provider.test_password(username, password)
 		return nil, "Password fails SASLprep.";
 	end
 
-	if password == saslprep(credentials.password) then
+	if secure_equals(password, saslprep(credentials.password)) then
 		return true;
 	else
 		return nil, "Auth failed. Invalid username or password.";
diff --git a/plugins/mod_bosh.lua b/plugins/mod_bosh.lua
index 0fbf3037..b050e350 100644
--- a/plugins/mod_bosh.lua
+++ b/plugins/mod_bosh.lua
@@ -45,6 +45,7 @@ local bosh_max_wait = module:get_option_number("bosh_max_wait", 120);
 
 local consider_bosh_secure = module:get_option_boolean("consider_bosh_secure");
 local cross_domain = module:get_option("cross_domain_bosh");
+local stanza_size_limit = module:get_option_number("c2s_stanza_size_limit", 1024*256);
 
 if cross_domain ~= nil then
 	module:log("info", "The 'cross_domain_bosh' option has been deprecated");
@@ -122,7 +123,7 @@ function handle_POST(event)
 	local body = request.body;
 
 	local context = { request = request, response = response, notopen = true };
-	local stream = new_xmpp_stream(context, stream_callbacks);
+	local stream = new_xmpp_stream(context, stream_callbacks, stanza_size_limit);
 	response.context = context;
 
 	local headers = response.headers;
diff --git a/plugins/mod_c2s.lua b/plugins/mod_c2s.lua
index 8687b4df..38a275f5 100644
--- a/plugins/mod_c2s.lua
+++ b/plugins/mod_c2s.lua
@@ -27,7 +27,7 @@ local log = module._log;
 local c2s_timeout = module:get_option_number("c2s_timeout", 300);
 local stream_close_timeout = module:get_option_number("c2s_close_timeout", 5);
 local opt_keepalives = module:get_option_boolean("c2s_tcp_keepalives", module:get_option_boolean("tcp_keepalives", true));
-local stanza_size_limit = module:get_option_number("c2s_stanza_size_limit"); -- TODO come up with a sensible default (util.xmppstream defaults to 10M)
+local stanza_size_limit = module:get_option_number("c2s_stanza_size_limit", 1024*256);
 
 local measure_connections = module:metric("gauge", "connections", "", "Established c2s connections", {"host", "type", "ip_family"});
 
diff --git a/plugins/mod_component.lua b/plugins/mod_component.lua
index a0bac298..fb5f5ab8 100644
--- a/plugins/mod_component.lua
+++ b/plugins/mod_component.lua
@@ -27,6 +27,7 @@ local hosts = prosody.hosts;
 local log = module._log;
 
 local opt_keepalives = module:get_option_boolean("component_tcp_keepalives", module:get_option_boolean("tcp_keepalives", true));
+local stanza_size_limit = module:get_option_number("component_stanza_size_limit", module:get_option_number("s2s_stanza_size_limit", 1024*512));
 
 local sessions = module:shared("sessions");
 
@@ -304,7 +305,7 @@ function listener.onconnect(conn)
 
 	session.log("info", "Incoming Jabber component connection");
 
-	local stream = new_xmpp_stream(session, stream_callbacks);
+	local stream = new_xmpp_stream(session, stream_callbacks, stanza_size_limit);
 	session.stream = stream;
 
 	session.notopen = true;
diff --git a/plugins/mod_dialback.lua b/plugins/mod_dialback.lua
index 7396e07e..0df8d36f 100644
--- a/plugins/mod_dialback.lua
+++ b/plugins/mod_dialback.lua
@@ -13,6 +13,7 @@ local log = module._log;
 local st = require "util.stanza";
 local sha256_hash = require "util.hashes".sha256;
 local sha256_hmac = require "util.hashes".hmac_sha256;
+local secure_equals = require "util.hashes".equals;
 local nameprep = require "util.encodings".stringprep.nameprep;
 local uuid_gen = require"util.uuid".generate;
 
@@ -21,20 +22,6 @@ local xmlns_stream = "http://etherx.jabber.org/streams";
 local dialback_requests = setmetatable({}, { __mode = 'v' });
 
 local dialback_secret = sha256_hash(module:get_option_string("dialback_secret", uuid_gen()), true);
-local dwd = module:get_option_boolean("dialback_without_dialback", false);
-
---- Helper to check that a session peer's certificate is valid
-function check_cert_status(session)
-	local host = session.direction == "outgoing" and session.to_host or session.from_host
-	local conn = session.conn:socket()
-	local cert
-	if conn.getpeercertificate then
-		cert = conn:getpeercertificate()
-	end
-
-	return module:fire_event("s2s-check-certificate", { host = host, session = session, cert = cert });
-end
-
 
 function module.save()
 	return { dialback_secret = dialback_secret };
@@ -56,7 +43,7 @@ function initiate_dialback(session)
 end
 
 function verify_dialback(id, to, from, key)
-	return key == generate_dialback(id, to, from);
+	return secure_equals(key, generate_dialback(id, to, from));
 end
 
 module:hook("stanza/jabber:server:dialback:verify", function(event)
@@ -110,15 +97,6 @@ module:hook("stanza/jabber:server:dialback:result", function(event)
 			return true;
 		end
 
-		if dwd and origin.secure then
-			if check_cert_status(origin, from) == false then
-				return
-			elseif origin.cert_chain_status == "valid" and origin.cert_identity_status == "valid" then
-				origin.sends2s(st.stanza("db:result", { to = from, from = to, id = attr.id, type = "valid" }));
-				module:fire_event("s2s-authenticated", { session = origin, host = from, mechanism = "dialback" });
-				return true;
-			end
-		end
 
 		origin.hosts[from] = { dialback_key = stanza[1] };
 
diff --git a/plugins/mod_limits.lua b/plugins/mod_limits.lua
index 024ab686..9fe62d05 100644
--- a/plugins/mod_limits.lua
+++ b/plugins/mod_limits.lua
@@ -31,7 +31,7 @@ local function parse_burst(burst, sess_type)
 		burst = burst:match("^(%d+) ?s$");
 	end
 	local n_burst = tonumber(burst);
-	if not n_burst then
+	if burst and not n_burst then
 		module:log("error", "Unable to parse burst for %s: %q, using default burst interval (%ds)", sess_type, burst, default_burst);
 	end
 	return n_burst or default_burst;
@@ -39,7 +39,16 @@ end
 
 -- Process config option into limits table:
 -- limits = { c2s = { bytes_per_second = X, burst_seconds = Y } }
-local limits = {};
+local limits = {
+	c2s = {
+		bytes_per_second = 10 * 1024;
+		burst_seconds = 2;
+	};
+	s2sin = {
+		bytes_per_second = 30 * 1024;
+		burst_seconds = 2;
+	};
+};
 
 for sess_type, sess_limits in pairs(limits_cfg) do
 	limits[sess_type] = {
diff --git a/plugins/mod_proxy65.lua b/plugins/mod_proxy65.lua
index bac36b55..069ce0a9 100644
--- a/plugins/mod_proxy65.lua
+++ b/plugins/mod_proxy65.lua
@@ -93,6 +93,7 @@ function module.add_host(module)
 
 	local proxy_address = module:get_option_string("proxy65_address", host);
 	local proxy_acl = module:get_option_array("proxy65_acl");
+	local proxy_open_access = module:get_option_boolean("proxy65_open_access", false);
 
 	-- COMPAT w/pre-0.9 where proxy65_port was specified in the components section of the config
 	local legacy_config = module:get_option_number("proxy65_port");
@@ -109,13 +110,20 @@ function module.add_host(module)
 
 		-- check ACL
 		-- using 'while' instead of 'if' so we can break out of it
-		while proxy_acl and #proxy_acl > 0 do --luacheck: ignore 512
+		local allow;
+		if proxy_acl and #proxy_acl > 0 then
 			local jid = stanza.attr.from;
-			local allow;
 			for _, acl in ipairs(proxy_acl) do
-				if jid_compare(jid, acl) then allow = true; break; end
+				if jid_compare(jid, acl) then
+					allow = true;
+					break;
+				end
 			end
-			if allow then break; end
+		elseif proxy_open_access or origin.type == "c2s" then
+			allow = true;
+		end
+
+		if not allow then
 			module:log("warn", "Denying use of proxy for %s", stanza.attr.from);
 			origin.send(st.error_reply(stanza, "auth", "forbidden"));
 			return true;
diff --git a/plugins/mod_s2s.lua b/plugins/mod_s2s.lua
index 679f97e9..9c45fc31 100644
--- a/plugins/mod_s2s.lua
+++ b/plugins/mod_s2s.lua
@@ -39,7 +39,7 @@ local secure_auth = module:get_option_boolean("s2s_secure_auth", false); -- One
 local secure_domains, insecure_domains =
 	module:get_option_set("s2s_secure_domains", {})._items, module:get_option_set("s2s_insecure_domains", {})._items;
 local require_encryption = module:get_option_boolean("s2s_require_encryption", false);
-local stanza_size_limit = module:get_option_number("s2s_stanza_size_limit"); -- TODO come up with a sensible default (util.xmppstream defaults to 10M)
+local stanza_size_limit = module:get_option_number("s2s_stanza_size_limit", 1024*512);
 
 local measure_connections_inbound = module:metric(
 	"gauge", "connections_inbound", "",
@@ -343,7 +343,7 @@ function make_authenticated(event)
 end
 
 --- Helper to check that a session peer's certificate is valid
-function check_cert_status(session)
+local function check_cert_status(session)
 	local host = session.direction == "outgoing" and session.to_host or session.from_host
 	local conn = session.conn:socket()
 	local cert
diff --git a/plugins/mod_websocket.lua b/plugins/mod_websocket.lua
index 6946894a..80296c5b 100644
--- a/plugins/mod_websocket.lua
+++ b/plugins/mod_websocket.lua
@@ -28,7 +28,7 @@ local parse_close = websocket_frames.parse_close;
 
 local t_concat = table.concat;
 
-local stanza_size_limit = module:get_option_number("c2s_stanza_size_limit", 10 * 1024 * 1024);
+local stanza_size_limit = module:get_option_number("c2s_stanza_size_limit", 1024 * 256);
 local frame_buffer_limit = module:get_option_number("websocket_frame_buffer_limit", 2 * stanza_size_limit);
 local frame_fragment_limit = module:get_option_number("websocket_frame_fragment_limit", 8);
 local stream_close_timeout = module:get_option_number("c2s_close_timeout", 5);
diff --git a/plugins/muc/members_only.lib.lua b/plugins/muc/members_only.lib.lua
index 79077153..6a2543e1 100644
--- a/plugins/muc/members_only.lib.lua
+++ b/plugins/muc/members_only.lib.lua
@@ -61,12 +61,20 @@ local function set_allow_member_invites(room, allow_member_invites)
 end
 
 module:hook("muc-disco#info", function(event)
-	event.reply:tag("feature", {var = get_members_only(event.room) and "muc_membersonly" or "muc_open"}):up();
+	local members_only_room = not not get_members_only(event.room);
+	local members_can_invite = not not get_allow_member_invites(event.room);
+	event.reply:tag("feature", {var = members_only_room and "muc_membersonly" or "muc_open"}):up();
 	table.insert(event.form, {
 		name = "{http://prosody.im/protocol/muc}roomconfig_allowmemberinvites";
 		label = "Allow members to invite new members";
 		type = "boolean";
-		value = not not get_allow_member_invites(event.room);
+		value = members_can_invite;
+	});
+	table.insert(event.form, {
+		name = "muc#roomconfig_allowinvites";
+		label = "Allow users to invite other users";
+		type = "boolean";
+		value = not members_only_room or members_can_invite;
 	});
 end);