diff options
| -rw-r--r-- | .semgrep.yml | 9 | ||||
| -rw-r--r-- | CHANGES | 5 | ||||
| -rw-r--r-- | core/certmanager.lua | 4 | ||||
| -rw-r--r-- | core/features.lua | 2 | ||||
| -rw-r--r-- | core/moduleapi.lua | 8 | ||||
| -rw-r--r-- | core/modulemanager.lua | 1 | ||||
| -rw-r--r-- | doc/doap.xml | 11 | ||||
| -rw-r--r-- | net/httpserver.lua | 17 | ||||
| -rw-r--r-- | plugins/mod_admin_shell.lua | 187 | ||||
| -rw-r--r-- | plugins/mod_bosh.lua | 2 | ||||
| -rw-r--r-- | plugins/mod_cloud_notify.lua | 14 | ||||
| -rw-r--r-- | plugins/mod_cron.lua | 2 | ||||
| -rw-r--r-- | plugins/mod_http_altconnect.lua | 52 | ||||
| -rw-r--r-- | plugins/mod_http_file_share.lua | 1 | ||||
| -rw-r--r-- | plugins/mod_invites.lua | 178 | ||||
| -rw-r--r-- | plugins/mod_s2s.lua | 8 | ||||
| -rw-r--r-- | plugins/mod_websocket.lua | 2 | ||||
| -rw-r--r-- | plugins/muc/hats.lib.lua | 2 | ||||
| -rw-r--r-- | prosody.cfg.lua.dist | 6 | ||||
| -rw-r--r-- | spec/util_argparse_spec.lua | 52 | ||||
| -rw-r--r-- | util/argparse.lua | 77 | ||||
| -rw-r--r-- | util/prosodyctl/check.lua | 312 | ||||
| -rw-r--r-- | util/prosodyctl/shell.lua | 12 | ||||
| -rw-r--r-- | util/sql.lua | 2 | ||||
| -rw-r--r-- | util/x509.lua | 51 |
25 files changed, 751 insertions, 266 deletions
diff --git a/.semgrep.yml b/.semgrep.yml index 22bfcfea..c475859d 100644 --- a/.semgrep.yml +++ b/.semgrep.yml @@ -28,3 +28,12 @@ rules: message: Use :get_text() to read text, or pass a value here to add text severity: WARNING languages: [lua] +- id: require-unprefixed-module + patterns: + - pattern: require("$X") + - metavariable-regex: + metavariable: $X + regex: '^(core|net|util)\.' + message: Prefix required module path with 'prosody.' + severity: ERROR + languages: [lua] @@ -11,6 +11,7 @@ TRUNK - Add 'watch log' command to follow live debug logs at runtime (even if disabled) - mod_announce: Add shell commands to send messages to all users, online users, or limited by roles - New mod_account_activity plugin records last login/logout time of a user account +- New 'prosodyctl check features' recommends configuration improvements ### Networking @@ -45,6 +46,7 @@ TRUNK - Ability to disable and enable user accounts - Full DANE support for s2s - A "grace period" is now supported for deletion requests via in-band registration +- No longer check certificate Common Names per RFC 9525 ### Storage @@ -61,6 +63,7 @@ TRUNK - Method for retrieving integer settings from config - It is now easy for modules to expose a Prosody shell command, by adding a shell-command item - Modules can now implement a module.ready method which will be called after server initialization +- module:depends() now accepts a second parameter 'soft' to enable soft dependencies ### Configuration @@ -82,6 +85,8 @@ TRUNK - Support for the roster *group* access_model in mod_pep - Support for systemd socket activation in server_epoll - mod_invites_adhoc gained a command for creating password resets +- mod_cloud_notify imported from community modules for push notification support +- mod_http_altconnect imported from community modules, simplifying web clients ## Removed diff --git a/core/certmanager.lua b/core/certmanager.lua index 9e0ace6a..1c9cefed 100644 --- a/core/certmanager.lua +++ b/core/certmanager.lua @@ -189,10 +189,6 @@ local core_defaults = { single_ecdh_use = tls.features.options.single_ecdh_use; no_renegotiation = tls.features.options.no_renegotiation; }; - verifyext = { - "lsec_continue", -- Continue past certificate verification errors - "lsec_ignore_purpose", -- Validate client certificates as if they were server certificates - }; curve = tls.features.algorithms.ec and not tls.features.capabilities.curves_list and "secp384r1"; curveslist = { "X25519", diff --git a/core/features.lua b/core/features.lua index d8cefe74..8e155f70 100644 --- a/core/features.lua +++ b/core/features.lua @@ -12,6 +12,8 @@ return { "mod_cloud_notify"; -- mod_muc has built-in vcard support "muc_vcard"; + -- mod_http_altconnect bundled + "http_altconnect"; -- Roles, module.may and per-session authz "permissions"; -- prosody.* namespace diff --git a/core/moduleapi.lua b/core/moduleapi.lua index b93536b5..50524b32 100644 --- a/core/moduleapi.lua +++ b/core/moduleapi.lua @@ -136,10 +136,14 @@ function api:require(lib) return f(); end -function api:depends(name) +function api:depends(name, soft) local modulemanager = require"prosody.core.modulemanager"; if self:get_option_inherited_set("modules_disabled", {}):contains(name) then - error("Dependency on disabled module mod_"..name); + if not soft then + error("Dependency on disabled module mod_"..name); + end + self:log("debug", "Not loading disabled soft dependency mod_%s", name); + return nil, "disabled"; end if not self.dependencies then self.dependencies = {}; diff --git a/core/modulemanager.lua b/core/modulemanager.lua index b8ba2f35..7295ba25 100644 --- a/core/modulemanager.lua +++ b/core/modulemanager.lua @@ -29,7 +29,6 @@ local ipairs, pairs, type, t_insert = ipairs, pairs, type, table.insert; local lua_version = _VERSION:match("5%.%d+$"); local autoload_modules = { - prosody.platform, "presence", "message", "iq", diff --git a/doc/doap.xml b/doc/doap.xml index edd924bf..9c97ef1c 100644 --- a/doc/doap.xml +++ b/doc/doap.xml @@ -64,6 +64,7 @@ <implements rdf:resource="https://www.rfc-editor.org/info/rfc7673"/> <implements rdf:resource="https://www.rfc-editor.org/info/rfc8305"/> <implements rdf:resource="https://www.rfc-editor.org/info/rfc9266"/> + <implements rdf:resource="https://www.rfc-editor.org/info/rfc9525"/> <implements rdf:resource="https://datatracker.ietf.org/doc/draft-cridland-xmpp-session/"> <!-- since=0.6.0 note=Added in hg:0bbbc9042361 --> </implements> @@ -245,7 +246,7 @@ <xmpp:xep rdf:resource="https://xmpp.org/extensions/xep-0090.html"/> <xmpp:version>1.2</xmpp:version> <xmpp:since>0.1.0</xmpp:since> - <xmpp:until>trunk</xmpp:until> + <xmpp:until>13.0.0</xmpp:until> <xmpp:status>removed</xmpp:status> <xmpp:note>mod_time</xmpp:note> </xmpp:SupportedXep> @@ -736,7 +737,7 @@ <xmpp:SupportedXep> <xmpp:xep rdf:resource="https://xmpp.org/extensions/xep-0357.html"/> <xmpp:version>0.4.1</xmpp:version> - <xmpp:since>trunk</xmpp:since> + <xmpp:since>13.0.0</xmpp:since> <xmpp:status>complete</xmpp:status> <xmpp:note>mod_cloud_notify</xmpp:note> </xmpp:SupportedXep> @@ -840,7 +841,7 @@ <implements> <xmpp:SupportedXep> <xmpp:xep rdf:resource="https://xmpp.org/extensions/xep-0421.html"/> - <xmpp:version>0.2.0</xmpp:version> + <xmpp:version>1.0.0</xmpp:version> <xmpp:since>0.12.0</xmpp:since> <xmpp:status>complete</xmpp:status> <xmpp:note>mod_muc</xmpp:note> @@ -857,7 +858,7 @@ <xmpp:SupportedXep> <xmpp:xep rdf:resource="https://xmpp.org/extensions/xep-0440.html"/> <xmpp:version>0.4.2</xmpp:version> - <xmpp:since>trunk</xmpp:since> + <xmpp:since>13.0.0</xmpp:since> <xmpp:status>complete</xmpp:status> </xmpp:SupportedXep> </implements> @@ -881,7 +882,7 @@ <xmpp:SupportedXep> <xmpp:xep rdf:resource="https://xmpp.org/extensions/xep-0478.html"/> <xmpp:version>0.2.0</xmpp:version> - <xmpp:since>trunk</xmpp:since> + <xmpp:since>13.0.0</xmpp:since> </xmpp:SupportedXep> </implements> </Project> diff --git a/net/httpserver.lua b/net/httpserver.lua deleted file mode 100644 index 0dfd862e..00000000 --- a/net/httpserver.lua +++ /dev/null @@ -1,17 +0,0 @@ --- COMPAT w/pre-0.9 -local log = require "prosody.util.logger".init("net.httpserver"); -local traceback = debug.traceback; - -local _ENV = nil; --- luacheck: std none - -local function fail() - log("error", "Attempt to use legacy HTTP API. For more info see https://prosody.im/doc/developers/legacy_http"); - log("error", "Legacy HTTP API usage, %s", traceback("", 2)); -end - -return { - new = fail; - new_from_config = fail; - set_default_handler = fail; -}; diff --git a/plugins/mod_admin_shell.lua b/plugins/mod_admin_shell.lua index 3301ed9b..b88b5316 100644 --- a/plugins/mod_admin_shell.lua +++ b/plugins/mod_admin_shell.lua @@ -19,6 +19,7 @@ local it = require "prosody.util.iterators"; local server = require "prosody.net.server"; local schema = require "prosody.util.jsonschema"; local st = require "prosody.util.stanza"; +local parse_args = require "prosody.util.argparse".parse; local _G = _G; @@ -255,6 +256,83 @@ function console:new_session(admin_session) return session; end +local function process_cmd_line(session, arg_line) + local chunk = load("return "..arg_line, "=shell", "t", {}); + local ok, args = pcall(chunk); + if not ok then return nil, args; end + + local section_name, command = args[1], args[2]; + + local section_mt = getmetatable(def_env[section_name]); + local section_help = section_mt and section_mt.help; + local command_help = section_help and section_help.commands[command]; + + if not command_help then + if commands[section_name] then + commands[section_name](session, table.concat(args, " ")); + return; + end + if section_help then + return nil, "Command not found or necessary module not loaded. Try 'help "..section_name.." for a list of available commands."; + end + return nil, "Command not found. Is the necessary module loaded?"; + end + + local fmt = { "%s"; ":%s("; ")" }; + + if command_help.flags then + local flags, flags_err, flags_err_extra = parse_args(args, command_help.flags); + if not flags then + if flags_err == "missing-value" then + return nil, "Expected value after "..flags_err_extra; + elseif flags_err == "param-not-found" then + return nil, "Unknown parameter: "..flags_err_extra; + end + return nil, flags_err; + end + + table.remove(flags, 2); + table.remove(flags, 1); + + local n_fixed_args = #command_help.args; + + local arg_str = {}; + for i = 1, n_fixed_args do + if flags[i] ~= nil then + table.insert(arg_str, ("%q"):format(flags[i])); + else + table.insert(arg_str, "nil"); + end + end + + table.insert(arg_str, "flags"); + + for i = n_fixed_args + 1, #flags do + if flags[i] ~= nil then + table.insert(arg_str, ("%q"):format(flags[i])); + else + table.insert(arg_str, "nil"); + end + end + + table.insert(fmt, 3, "%s"); + + return "local flags = ...; return "..string.format(table.concat(fmt), section_name, command, table.concat(arg_str, ", ")), flags; + end + + for i = 3, #args do + if args[i]:sub(1, 1) == ":" then + table.insert(fmt, i, ")%s("); + elseif i > 3 and fmt[i - 1]:match("%%q$") then + table.insert(fmt, i, ", %q"); + else + table.insert(fmt, i, "%q"); + end + end + + return "return "..string.format(table.concat(fmt), table.unpack(args)); +end + local function handle_line(event) local session = event.origin.shell_session; if not session then @@ -295,23 +373,6 @@ local function handle_line(event) session.globalenv = redirect_output(_G, session); end - local chunkname = "=console"; - local env = (useglobalenv and session.globalenv) or session.env or nil - -- luacheck: ignore 311/err - local chunk, err = envload("return "..line, chunkname, env); - if not chunk then - chunk, err = envload(line, chunkname, env); - if not chunk then - err = err:gsub("^%[string .-%]:%d+: ", ""); - err = err:gsub("^:%d+: ", ""); - err = err:gsub("'<eof>'", "the end of the line"); - result.attr.type = "error"; - result:text("Sorry, I couldn't understand that... "..err); - event.origin.send(result); - return; - end - end - local function send_result(taskok, message) if not message then if type(taskok) ~= "string" and useglobalenv then @@ -328,7 +389,49 @@ local function handle_line(event) event.origin.send(result); end - local taskok, message = chunk(); + local taskok, message; + local env = (useglobalenv and session.globalenv) or session.env or nil; + local flags; + + local source; + if line:match("^{") then + -- Input is a serialized array of strings, typically from + -- a command-line invocation of 'prosodyctl shell something' + source, flags = process_cmd_line(session, line); + if not source then + if flags then -- err + send_result(false, flags); + else -- no err, but nothing more to do + -- This happens if it was a "simple" command + event.origin.send(result); + end + return; + end + end + + local chunkname = "=console"; + -- luacheck: ignore 311/err + local chunk, err = envload(source or ("return "..line), chunkname, env); + if not chunk then + if not source then + chunk, err = envload(line, chunkname, env); + end + if not chunk then + err = err:gsub("^%[string .-%]:%d+: ", ""); + err = err:gsub("^:%d+: ", ""); + err = err:gsub("'<eof>'", "the end of the line"); + result.attr.type = "error"; + result:text("Sorry, I couldn't understand that... "..err); + event.origin.send(result); + return; + end + end + + if not source then + session.repl = true; + end + + taskok, message = chunk(flags); if promise.is_promise(taskok) then taskok:next(function (resolved_message) @@ -462,9 +565,43 @@ def_env.help = setmetatable({}, { for command, command_help in it.sorted_pairs(section_help.commands or {}) do if not command_help.hidden then c = c + 1; - local args = array.pluck(command_help.args, "name"):concat(", "); local desc = command_help.desc or command_help.module and ("Provided by mod_"..command_help.module) or ""; - print(("%s:%s(%s) - %s"):format(section_name, command, args, desc)); + if self.session.repl then + local args = array.pluck(command_help.args, "name"):concat(", "); + print(("%s:%s(%s) - %s"):format(section_name, command, args, desc)); + else + local args = array.pluck(command_help.args, "name"):concat("> <"); + if args ~= "" then + args = "<"..args..">"; + end + print(("%s %s %s"):format(section_name, command, args)); + print((" %s"):format(desc)); + if command_help.flags then + local flags = command_help.flags; + print(""); + print((" Flags:")); + + if flags.kv_params then + for name in it.sorted_pairs(flags.kv_params) do + print(" --"..name:gsub("_", "-")); + end + end + + if flags.value_params then + for name in it.sorted_pairs(flags.value_params) do + print(" --"..name:gsub("_", "-").." <"..name..">"); + end + end + + if flags.array_params then + for name in it.sorted_pairs(flags.array_params) do + print(" --"..name:gsub("_", "-").." <"..name..">, ..."); + end + end + + end + print(""); + end end end elseif help_topics[section_name] then @@ -2641,10 +2778,20 @@ local function new_item_handlers(command_host) section_mt.help = section_help; end + if command.flags then + if command.flags.stop_on_positional == nil then + command.flags.stop_on_positional = false; + end + if command.flags.strict == nil then + command.flags.strict = true; + end + end + section_help.commands[command.name] = { desc = command.desc; full = command.help; args = array(command.args); + flags = command.flags; module = command._provided_by; }; diff --git a/plugins/mod_bosh.lua b/plugins/mod_bosh.lua index 091a7d81..fc2c92ae 100644 --- a/plugins/mod_bosh.lua +++ b/plugins/mod_bosh.lua @@ -557,6 +557,8 @@ function module.add_host(module) ["POST /"] = handle_POST; }; }); + + module:depends("http_altconnect", true); end if require"prosody.core.modulemanager".get_modules_for_host("*"):contains(module.name) then diff --git a/plugins/mod_cloud_notify.lua b/plugins/mod_cloud_notify.lua index 987be84f..1c660e93 100644 --- a/plugins/mod_cloud_notify.lua +++ b/plugins/mod_cloud_notify.lua @@ -5,13 +5,13 @@ -- This file is MIT/X11 licensed. local os_time = os.time; -local st = require"util.stanza"; -local jid = require"util.jid"; -local dataform = require"util.dataforms".new; -local hashes = require"util.hashes"; -local random = require"util.random"; -local cache = require"util.cache"; -local watchdog = require "util.watchdog"; +local st = require"prosody.util.stanza"; +local jid = require"prosody.util.jid"; +local dataform = require"prosody.util.dataforms".new; +local hashes = require"prosody.util.hashes"; +local random = require"prosody.util.random"; +local cache = require"prosody.util.cache"; +local watchdog = require "prosody.util.watchdog"; local xmlns_push = "urn:xmpp:push:0"; diff --git a/plugins/mod_cron.lua b/plugins/mod_cron.lua index 67b68514..77bdd7e5 100644 --- a/plugins/mod_cron.lua +++ b/plugins/mod_cron.lua @@ -78,7 +78,7 @@ module:add_item("shell-command", { args = {}; handler = function(self, filter_host) local format_table = require("prosody.util.human.io").table; - local it = require("util.iterators"); + local it = require("prosody.util.iterators"); local row = format_table({ { title = "Host"; width = "2p" }; { title = "Task"; width = "3p" }; diff --git a/plugins/mod_http_altconnect.lua b/plugins/mod_http_altconnect.lua new file mode 100644 index 00000000..9252433e --- /dev/null +++ b/plugins/mod_http_altconnect.lua @@ -0,0 +1,52 @@ +-- mod_http_altconnect +-- XEP-0156: Discovering Alternative XMPP Connection Methods + +module:depends"http"; + +local mm = require "prosody.core.modulemanager"; +local json = require"prosody.util.json"; +local st = require"prosody.util.stanza"; +local array = require"prosody.util.array"; + +local advertise_bosh = module:get_option_boolean("advertise_bosh", true); +local advertise_websocket = module:get_option_boolean("advertise_websocket", true); + +local function get_supported() + local uris = array(); + if advertise_bosh and (mm.is_loaded(module.host, "bosh") or mm.is_loaded("*", "bosh")) then + uris:push({ rel = "urn:xmpp:alt-connections:xbosh", href = module:http_url("bosh", "/http-bind") }); + end + if advertise_websocket and (mm.is_loaded(module.host, "websocket") or mm.is_loaded("*", "websocket")) then + uris:push({ rel = "urn:xmpp:alt-connections:websocket", href = module:http_url("websocket", "xmpp-websocket"):gsub("^http", "ws") }); + end + return uris; +end + + +local function GET_xml(event) + local response = event.response; + local xrd = st.stanza("XRD", { xmlns='http://docs.oasis-open.org/ns/xri/xrd-1.0' }); + local uris = get_supported(); + for _, method in ipairs(uris) do + xrd:tag("Link", method):up(); + end + response.headers.content_type = "application/xrd+xml" + response.headers.access_control_allow_origin = "*"; + return '<?xml version="1.0" encoding="UTF-8"?>' .. tostring(xrd); +end + +local function GET_json(event) + local response = event.response; + local jrd = { links = get_supported() }; + response.headers.content_type = "application/json" + response.headers.access_control_allow_origin = "*"; + return json.encode(jrd); +end; + +module:provides("http", { + default_path = "/.well-known"; + route = { + ["GET /host-meta"] = GET_xml; + ["GET /host-meta.json"] = GET_json; + }; +}); diff --git a/plugins/mod_http_file_share.lua b/plugins/mod_http_file_share.lua index 48972067..705420d0 100644 --- a/plugins/mod_http_file_share.lua +++ b/plugins/mod_http_file_share.lua @@ -224,6 +224,7 @@ function handle_slot_request(event) end total_storage_usage = total_storage_usage + filesize; + persist_stats:set(nil, "total", total_storage_usage); module:log("debug", "Total storage usage: %s / %s", B(total_storage_usage), B(total_storage_limit)); local cached_quota = quota_cache:get(uploader); diff --git a/plugins/mod_invites.lua b/plugins/mod_invites.lua index 1e6ef861..c6a66a8f 100644 --- a/plugins/mod_invites.lua +++ b/plugins/mod_invites.lua @@ -6,8 +6,8 @@ local jid_split = require "prosody.util.jid".split; local argparse = require "prosody.util.argparse"; local human_io = require "prosody.util.human.io"; -local url_escape = require "util.http".urlencode; -local render_url = require "util.interpolation".new("%b{}", url_escape, { +local url_escape = require "prosody.util.http".urlencode; +local render_url = require "prosody.util.interpolation".new("%b{}", url_escape, { urlescape = url_escape; noscheme = function (urlstring) return (urlstring:gsub("^[^:]+:", "")); @@ -239,18 +239,48 @@ end module:hook("invite-created", add_landing_url, -1); --- shell command +-- COMPAT: Dynamic groups are work in progress as of 13.0, so we'll use the +-- presence of mod_invites_groups (a community module) to determine whether to +-- expose our support for invites to groups. +local have_group_invites = module:get_option_inherited_set("modules_enabled"):contains("invites_groups"); + module:add_item("shell-command", { section = "invite"; section_desc = "Create and manage invitations"; name = "create_account"; desc = "Create an invitation to make an account on this server with the specified JID (supply only a hostname to allow any username)"; - args = { { name = "user_jid", type = "string" } }; + args = { + { name = "user_jid", type = "string" }; + }; host_selector = "user_jid"; + flags = { + array_params = { role = true, group = have_group_invites }; + value_params = { expires_after = true }; + }; - handler = function (self, user_jid) --luacheck: ignore 212/self + handler = function (self, user_jid, opts) --luacheck: ignore 212/self local username = jid_split(user_jid); - local invite, err = create_account(username); - if not invite then return nil, err; end + local roles = opts and opts.role or {}; + local groups = opts and opts.group or {}; + + if opts and opts.admin then + -- Insert it first since we don't get order out of argparse + table.insert(roles, 1, "prosody:admin"); + end + + local ttl; + if opts and opts.expires_after then + ttl = human_io.parse_duration(opts.expires_after); + if not ttl then + return false, "Unable to parse duration: "..opts.expires_after; + end + end + + local invite = assert(create_account(username, { + roles = roles; + groups = groups; + }, ttl)); + return true, invite.landing_page or invite.uri; end; }); @@ -260,12 +290,21 @@ module:add_item("shell-command", { section_desc = "Create and manage invitations"; name = "create_reset"; desc = "Create a password reset link for the specified user"; - args = { { name = "user_jid", type = "string" }, { name = "duration", type = "string" } }; + args = { { name = "user_jid", type = "string" } }; host_selector = "user_jid"; + flags = { + value_params = { expires_after = true }; + }; - handler = function (self, user_jid, duration) --luacheck: ignore 212/self + handler = function (self, user_jid, opts) --luacheck: ignore 212/self local username = jid_split(user_jid); - local duration_sec = require "prosody.util.human.io".parse_duration(duration or "1d"); + if not username then + return nil, "Supply the JID of the account you want to generate a password reset for"; + end + local duration_sec = require "prosody.util.human.io".parse_duration(opts and opts.expires_after or "1d"); + if not duration_sec then + return nil, "Unable to parse duration: "..opts.expires_after; + end local invite, err = create_account_reset(username, duration_sec); if not invite then return nil, err; end self.session.print(invite.landing_page or invite.uri); @@ -278,12 +317,26 @@ module:add_item("shell-command", { section_desc = "Create and manage invitations"; name = "create_contact"; desc = "Create an invitation to become contacts with the specified user"; - args = { { name = "user_jid", type = "string" }, { name = "allow_registration" } }; + args = { { name = "user_jid", type = "string" } }; host_selector = "user_jid"; + flags = { + value_params = { expires_after = true }; + kv_params = { allow_registration = true }; + }; - handler = function (self, user_jid, allow_registration) --luacheck: ignore 212/self + handler = function (self, user_jid, opts) --luacheck: ignore 212/self local username = jid_split(user_jid); - local invite, err = create_contact(username, allow_registration); + if not username then + return nil, "Supply the JID of the account you want the recipient to become a contact of"; + end + local ttl; + if opts and opts.expires_after then + ttl = require "prosody.util.human.io".parse_duration(opts.expires_after); + if not ttl then + return nil, "Unable to parse duration: "..opts.expires_after; + end + end + local invite, err = create_contact(username, opts and opts.allow_registration, nil, ttl); if not invite then return nil, err; end return true, invite.landing_page or invite.uri; end; @@ -442,102 +495,7 @@ function module.command(arg) return subcommands[cmd](arg); end -function subcommands.generate(arg) - local function help(short) - print("usage: prosodyctl mod_" .. module.name .. " generate DOMAIN --reset USERNAME") - print("usage: prosodyctl mod_" .. module.name .. " generate DOMAIN [--admin] [--role ROLE] [--group GROUPID]...") - if short then return 2 end - print() - print("This command has two modes: password reset and new account.") - print("If --reset is given, the command operates in password reset mode and in new account mode otherwise.") - print() - print("required arguments in password reset mode:") - print() - print(" --reset USERNAME Generate a password reset link for the given USERNAME.") - print() - print("optional arguments in new account mode:") - print() - print(" --admin Make the new user privileged") - print(" Equivalent to --role prosody:admin") - print(" --role ROLE Grant the given ROLE to the new user") - print(" --group GROUPID Add the user to the group with the given ID") - print(" Can be specified multiple times") - print(" --expires-after T Time until the invite expires (e.g. '1 week')") - print() - print("--group can be specified multiple times; the user will be added to all groups.") - print() - print("--reset and the other options cannot be mixed.") - return 2 - end - - local earlyopts = argparse.parse(arg, { short_params = { h = "help"; ["?"] = "help" } }); - if earlyopts.help or not earlyopts[1] then - return help(); - end - - local sm = require "prosody.core.storagemanager"; - local mm = require "prosody.core.modulemanager"; - - local host = table.remove(arg, 1); -- pop host - if not host then return help(true) end - sm.initialize_host(host); - module.host = host; --luacheck: ignore 122/module - token_storage = module:open_store("invite_token", "map"); - - local opts = argparse.parse(arg, { - short_params = { h = "help"; ["?"] = "help"; g = "group" }; - value_params = { group = true; reset = true; role = true }; - array_params = { group = true; role = true }; - }); - - if opts.help then - return help(); - end - - -- Load mod_invites - local invites = module:depends("invites"); - -- Optional community module that if used, needs to be loaded here - local invites_page_module = module:get_option_string("invites_page_module", "invites_page"); - if mm.get_modules_for_host(host):contains(invites_page_module) then - module:depends(invites_page_module); - end - - local allow_reset; - - if opts.reset then - local nodeprep = require "prosody.util.encodings".stringprep.nodeprep; - local username = nodeprep(opts.reset) - if not username then - print("Please supply a valid username to generate a reset link for"); - return 2; - end - allow_reset = username; - end - - local roles = opts.role or {}; - local groups = opts.groups or {}; - - if opts.admin then - -- Insert it first since we don't get order out of argparse - table.insert(roles, 1, "prosody:admin"); - end - - local invite; - if allow_reset then - if roles[1] then - print("--role/--admin and --reset are mutually exclusive") - return 2; - end - if #groups > 0 then - print("--group and --reset are mutually exclusive") - end - invite = assert(invites.create_account_reset(allow_reset)); - else - invite = assert(invites.create_account(nil, { - roles = roles, - groups = groups - }, opts.expires_after and human_io.parse_duration(opts.expires_after))); - end - - print(invite.landing_page or invite.uri); +function subcommands.generate() + print("This command is deprecated. Please see 'prosodyctl shell help invite' for available commands."); + return 1; end diff --git a/plugins/mod_s2s.lua b/plugins/mod_s2s.lua index 8eb1565e..84ae34b5 100644 --- a/plugins/mod_s2s.lua +++ b/plugins/mod_s2s.lua @@ -1097,6 +1097,10 @@ module:provides("net", { -- FIXME This only applies to Direct TLS, which we don't use yet. -- This gets applied for real in mod_tls verify = { "peer", "client_once", }; + verifyext = { + "lsec_continue", -- Continue past certificate verification errors + "lsec_ignore_purpose", -- Validate client certificates as if they were server certificates + }; }; multiplex = { protocol = "xmpp-server"; @@ -1111,6 +1115,10 @@ module:provides("net", { encryption = "ssl"; ssl_config = { verify = { "peer", "client_once", }; + verifyext = { + "lsec_continue", -- Continue past certificate verification errors + "lsec_ignore_purpose", -- Validate client certificates as if they were server certificates + }; }; multiplex = { protocol = "xmpp-server"; diff --git a/plugins/mod_websocket.lua b/plugins/mod_websocket.lua index 7120f3cc..dfc1a215 100644 --- a/plugins/mod_websocket.lua +++ b/plugins/mod_websocket.lua @@ -367,6 +367,8 @@ function module.add_host(module) }; }); + module:depends("http_altconnect", true); + module:hook("c2s-read-timeout", keepalive, -0.9); end diff --git a/plugins/muc/hats.lib.lua b/plugins/muc/hats.lib.lua index 7eb71eb4..7ccf194e 100644 --- a/plugins/muc/hats.lib.lua +++ b/plugins/muc/hats.lib.lua @@ -1,7 +1,7 @@ local st = require "prosody.util.stanza"; local muc_util = module:require "muc/util"; -local hats_compat = module:get_option_boolean("muc_hats_compat", true); -- COMPAT for pre-XEP namespace, TODO reconsider default for next release +local hats_compat = module:get_option_boolean("muc_hats_compat", false); -- COMPAT for pre-XEP namespace local xmlns_hats_legacy = "xmpp:prosody.im/protocol/hats:1"; local xmlns_hats = "urn:xmpp:hats:0"; diff --git a/prosody.cfg.lua.dist b/prosody.cfg.lua.dist index 267a650c..65eedc7d 100644 --- a/prosody.cfg.lua.dist +++ b/prosody.cfg.lua.dist @@ -9,6 +9,8 @@ -- If there are any errors, it will let you know what and where -- they are, otherwise it will keep quiet. -- +-- Upgrading from a previous release? Check https://prosody.im/doc/upgrading +-- -- The only thing left to do is rename this file to remove the .dist ending, and fill in the -- blanks. Good luck, and happy Jabbering! @@ -51,6 +53,8 @@ modules_enabled = { "vcard_legacy"; -- Conversion between legacy vCard and PEP Avatar, vcard -- Nice to have + "account_activity"; -- Record time when an account was last used + "cloud_notify"; -- Push notifications for mobile devices "csi_simple"; -- Simple but effective traffic optimizations for mobile devices "invites"; -- Create and manage invites "invites_adhoc"; -- Allow admins/users to create invitations via their client @@ -75,7 +79,6 @@ modules_enabled = { -- Other specific functionality --"announce"; -- Send announcement to all online users --"groups"; -- Shared roster support - --"legacyauth"; -- Legacy authentication. Only used by some old clients and bots. --"mimicking"; -- Prevent address spoofing --"motd"; -- Send a message to users when they log in --"proxy65"; -- Enables a file transfer proxy service which clients behind NAT can use @@ -92,7 +95,6 @@ modules_disabled = { -- "offline"; -- Store offline messages -- "c2s"; -- Handle client connections -- "s2s"; -- Handle server-to-server connections - -- "posix"; -- POSIX functionality, sends server to background, etc. } diff --git a/spec/util_argparse_spec.lua b/spec/util_argparse_spec.lua index 40f647c9..be1d99df 100644 --- a/spec/util_argparse_spec.lua +++ b/spec/util_argparse_spec.lua @@ -24,10 +24,28 @@ describe("parse", function() assert.same({ "bar"; "--baz" }, arg); end); - it("expands short options", function() - local opts, err = parse({ "--foo"; "-b" }, { short_params = { b = "bar" } }); + it("allows continuation beyond first positional argument", function() + local arg = { "--foo"; "bar"; "--baz" }; + local opts, err = parse(arg, { stop_on_positional = false }); assert.falsy(err); - assert.same({ foo = true; bar = true }, opts); + assert.same({ foo = true, baz = true, "bar" }, opts); + -- All input should have been consumed: + assert.same({ }, arg); + end); + + it("expands short options", function() + do + local opts, err = parse({ "--foo"; "-b" }, { short_params = { b = "bar" } }); + assert.falsy(err); + assert.same({ foo = true; bar = true }, opts); + end + + do + -- Same test with strict mode enabled and all parameters declared + local opts, err = parse({ "--foo"; "-b" }, { kv_params = { foo = true, bar = true }; short_params = { b = "bar" }, strict = true }); + assert.falsy(err); + assert.same({ foo = true; bar = true }, opts); + end end); it("supports value arguments", function() @@ -51,8 +69,30 @@ describe("parse", function() end); it("supports array arguments", function () - local opts, err = parse({ "--item"; "foo"; "--item"; "bar" }, { array_params = { item = true } }); - assert.falsy(err); - assert.same({"foo","bar"}, opts.item); + do + local opts, err = parse({ "--item"; "foo"; "--item"; "bar" }, { array_params = { item = true } }); + assert.falsy(err); + assert.same({"foo","bar"}, opts.item); + end + + do + -- Same test with strict mode enabled + local opts, err = parse({ "--item"; "foo"; "--item"; "bar" }, { array_params = { item = true }, strict = true }); + assert.falsy(err); + assert.same({"foo","bar"}, opts.item); + end end) + + it("rejects unknown parameters in strict mode", function () + local opts, err, err2 = parse({ "--item"; "foo"; "--item"; "bar", "--foobar" }, { array_params = { item = true }, strict = true }); + assert.falsy(opts); + assert.same("param-not-found", err); + assert.same("--foobar", err2); + end); + + it("accepts known kv parameters in strict mode", function () + local opts, err = parse({ "--item=foo" }, { kv_params = { item = true }, strict = true }); + assert.falsy(err); + assert.same("foo", opts.item); + end); end); diff --git a/util/argparse.lua b/util/argparse.lua index 7a55cb0b..3a7d1ba2 100644 --- a/util/argparse.lua +++ b/util/argparse.lua @@ -2,6 +2,9 @@ local function parse(arg, config) local short_params = config and config.short_params or {}; local value_params = config and config.value_params or {}; local array_params = config and config.array_params or {}; + local kv_params = config and config.kv_params or {}; + local strict = config and config.strict; + local stop_on_positional = not config or config.stop_on_positional ~= false; local parsed_opts = {}; @@ -15,51 +18,65 @@ local function parse(arg, config) end local prefix = raw_param:match("^%-%-?"); - if not prefix then + if not prefix and stop_on_positional then break; elseif prefix == "--" and raw_param == "--" then table.remove(arg, 1); break; end - local param = table.remove(arg, 1):sub(#prefix+1); - if #param == 1 and short_params then - param = short_params[param]; - end - if not param then - return nil, "param-not-found", raw_param; - end + if prefix then + local param = table.remove(arg, 1):sub(#prefix+1); + if #param == 1 and short_params then + param = short_params[param]; + end - local param_k, param_v; - if value_params[param] or array_params[param] then - param_k, param_v = param, table.remove(arg, 1); - if not param_v then - return nil, "missing-value", raw_param; + if not param then + return nil, "param-not-found", raw_param; end - else - param_k, param_v = param:match("^([^=]+)=(.+)$"); - if not param_k then - if param:match("^no%-") then - param_k, param_v = param:sub(4), false; - else - param_k, param_v = param, true; + + local uparam = param:match("^[^=]*"):gsub("%-", "_"); + + local param_k, param_v; + if value_params[uparam] or array_params[uparam] then + param_k, param_v = uparam, table.remove(arg, 1); + if not param_v then + return nil, "missing-value", raw_param; + end + else + param_k, param_v = param:match("^([^=]+)=(.+)$"); + if not param_k then + if param:match("^no%-") then + param_k, param_v = param:sub(4), false; + else + param_k, param_v = param, true; + end + end + param_k = param_k:gsub("%-", "_"); + if strict and not kv_params[param_k] then + return nil, "param-not-found", raw_param; end end - param_k = param_k:gsub("%-", "_"); - end - if array_params[param] then - if parsed_opts[param_k] then - table.insert(parsed_opts[param_k], param_v); + if array_params[uparam] then + if parsed_opts[param_k] then + table.insert(parsed_opts[param_k], param_v); + else + parsed_opts[param_k] = { param_v }; + end else - parsed_opts[param_k] = { param_v }; + parsed_opts[param_k] = param_v; end - else - parsed_opts[param_k] = param_v; + elseif not stop_on_positional then + table.insert(parsed_opts, table.remove(arg, 1)); end end - for i = 1, #arg do - parsed_opts[i] = arg[i]; + + if stop_on_positional then + for i = 1, #arg do + parsed_opts[i] = arg[i]; + end end + return parsed_opts; end diff --git a/util/prosodyctl/check.lua b/util/prosodyctl/check.lua index ac8cc9c1..4ac7af9e 100644 --- a/util/prosodyctl/check.lua +++ b/util/prosodyctl/check.lua @@ -325,7 +325,12 @@ local function check(arg) local ok = true; local function contains_match(hayset, needle) for member in hayset do if member:find(needle) then return true end end end local function disabled_hosts(host, conf) return host ~= "*" and conf.enabled ~= false; end - local function enabled_hosts() return it.filter(disabled_hosts, pairs(configmanager.getconfig())); end + local function is_user_host(host, conf) return host ~= "*" and conf.component_module == nil; end + local function is_component_host(host, conf) return host ~= "*" and conf.component_module ~= nil; end + local function enabled_hosts() return it.filter(disabled_hosts, it.sorted_pairs(configmanager.getconfig())); end + local function enabled_user_hosts() return it.filter(is_user_host, it.sorted_pairs(configmanager.getconfig())); end + local function enabled_components() return it.filter(is_component_host, it.sorted_pairs(configmanager.getconfig())); end + local checks = {}; function checks.disabled() local disabled_hosts_set = set.new(); @@ -632,6 +637,12 @@ local function check(arg) print(" Both mod_pep_simple and mod_pep are enabled but they conflict"); print(" with each other. Remove one."); end + if all_modules:contains("posix") then + print(""); + print(" mod_posix is loaded in your configuration file, but it has"); + print(" been deprecated. You can safely remove it."); + end + for host, host_config in pairs(config) do --luacheck: ignore 213/host if type(rawget(host_config, "storage")) == "string" and rawget(host_config, "default_storage") then print(""); @@ -790,12 +801,28 @@ local function check(arg) if #invalid_hosts > 0 or #alabel_hosts > 0 then print(""); - print("WARNING: Changing the name of a VirtualHost in Prosody's config file"); - print(" WILL NOT migrate any existing data (user accounts, etc.) to the new name."); + print(" WARNING: Changing the name of a VirtualHost in Prosody's config file"); + print(" WILL NOT migrate any existing data (user accounts, etc.) to the new name."); ok = false; end end + -- Check features + do + local missing_features = {}; + for host in enabled_user_hosts() do + local all_features = checks.features(host, true); + if not all_features then + table.insert(missing_features, host); + end + end + if #missing_features > 0 then + print(""); + print(" Some of your hosts may be missing features due to a lack of configuration."); + print(" For more details, use the 'prosodyctl check features' command."); + end + end + print("Done.\n"); end function checks.dns() @@ -901,7 +928,11 @@ local function check(arg) local unknown_addresses = set.new(); - for jid in enabled_hosts() do + local function is_valid_domain(domain) + return idna.to_ascii(domain) ~= nil; + end + + for jid in it.filter(is_valid_domain, enabled_hosts()) do local all_targets_ok, some_targets_ok = true, false; local node, host = jid_split(jid); @@ -1444,6 +1475,279 @@ local function check(arg) end end end + + function checks.features(check_host, quiet) + if not quiet then + print("Feature report"); + end + + local common_subdomains = { + http_file_share = "share"; + muc = "groups"; + }; + + local recommended_component_modules = { + muc = { "muc_mam" }; + }; + + local function print_feature_status(feature, host) + if quiet then return; end + print("", feature.ok and "OK" or "(!)", feature.name); + if not feature.ok then + if feature.lacking_modules then + table.sort(feature.lacking_modules); + print("", "", "Suggested modules: "); + for _, module in ipairs(feature.lacking_modules) do + print("", "", (" - %s: https://prosody.im/doc/modules/mod_%s"):format(module, module)); + end + end + if feature.lacking_components then + table.sort(feature.lacking_components); + for _, component_module in ipairs(feature.lacking_components) do + local subdomain = common_subdomains[component_module]; + local recommended_mods = recommended_component_modules[component_module]; + if subdomain then + print("", "", "Suggested component:"); + print(""); + print("", "", "", ("-- Documentation: https://prosody.im/doc/modules/mod_%s"):format(component_module)); + print("", "", "", ("Component %q %q"):format(subdomain.."."..host, component_module)); + if recommended_mods then + print("", "", "", " modules_enabled = {"); + table.sort(recommended_mods); + for _, mod in ipairs(recommended_mods) do + print("", "", "", (" %q;"):format(mod)); + end + print("", "", "", " }"); + end + else + print("", "", ("Suggested component: %s"):format(component_module)); + end + end + print(""); + print("", "", "If you have already configured any of these components, they may not be"); + print("", "", "linked correctly to "..host..". For more info see https://prosody.im/doc/components"); + end + if feature.lacking_component_modules then + table.sort(feature.lacking_component_modules, function (a, b) + return a.host < b.host; + end); + for _, problem in ipairs(feature.lacking_component_modules) do + local hostapi = api(problem.host); + local current_modules_enabled = hostapi:get_option_array("modules_enabled", {}); + print("", "", ("Component %q is missing the following modules: %s"):format(problem.host, table.concat(problem.missing_mods))); + print(""); + print("","", "Add the missing modules to your modules_enabled under the Component, like this:"); + print(""); + print(""); + print("", "", "", ("-- Documentation: https://prosody.im/doc/modules/mod_%s"):format(problem.component_module)); + print("", "", "", ("Component %q %q"):format(problem.host, problem.component_module)); + print("", "", "", (" modules_enabled = {")); + for _, mod in ipairs(current_modules_enabled) do + print("", "", "", (" %q;"):format(mod)); + end + for _, mod in ipairs(problem.missing_mods) do + print("", "", "", (" %q; -- Add this!"):format(mod)); + end + print("", "", "", (" }")); + end + end + end + print(""); + end + + local all_ok = true; + + local config = configmanager.getconfig(); + + local f, s, v; + if check_host then + f, s, v = it.values({ check_host }); + else + f, s, v = enabled_user_hosts(); + end + + for host in f, s, v do + local modules_enabled = set.new(config["*"].modules_enabled); + modules_enabled:include(set.new(config[host].modules_enabled)); + + -- { [component_module] = { hostname1, hostname2, ... } } + local host_components = setmetatable({}, { __index = function (t, k) return rawset(t, k, {})[k]; end }); + + do + local hostapi = api(host); + + -- Find implicitly linked components + for other_host in enabled_components() do + local parent_host = other_host:match("^[^.]+%.(.+)$"); + if parent_host == host then + local component_module = configmanager.get(other_host, "component_module"); + if component_module then + table.insert(host_components[component_module], other_host); + end + end + end + + -- And components linked explicitly + for _, disco_item in ipairs(hostapi:get_option_array("disco_items", {})) do + local other_host = disco_item[1]; + local component_module = configmanager.get(other_host, "component_module"); + if component_module then + table.insert(host_components[component_module], other_host); + end + end + end + + local current_feature; + + local function check_module(suggested, alternate, ...) + if set.intersection(modules_enabled, set.new({suggested, alternate, ...})):empty() then + current_feature.lacking_modules = current_feature.lacking_modules or {}; + table.insert(current_feature.lacking_modules, suggested); + end + end + + local function check_component(suggested, alternate, ...) + local found; + for _, component_module in ipairs({ suggested, alternate, ... }) do + found = host_components[component_module][1]; + if found then + local enabled_component_modules = api(found):get_option_inherited_set("modules_enabled"); + local recommended_mods = recommended_component_modules[component_module]; + if recommended_mods then + local missing_mods = {}; + for _, mod in ipairs(recommended_mods) do + if not enabled_component_modules:contains(mod) then + table.insert(missing_mods, mod); + end + end + if #missing_mods > 0 then + if not current_feature.lacking_component_modules then + current_feature.lacking_component_modules = {}; + end + table.insert(current_feature.lacking_component_modules, { + host = found; + component_module = component_module; + missing_mods = missing_mods; + }); + end + end + end + end + if not found then + current_feature.lacking_components = current_feature.lacking_components or {}; + table.insert(current_feature.lacking_components, suggested); + end + end + + local features = { + { + name = "Basic functionality"; + check = function () + check_module("disco"); + check_module("roster"); + check_module("saslauth"); + check_module("tls"); + check_module("pep"); + end; + }; + { + name = "Multi-device sync"; + check = function () + check_module("carbons"); + check_module("mam"); + check_module("bookmarks"); + end; + }; + { + name = "Mobile optimizations"; + check = function () + check_module("smacks"); + check_module("csi_simple", "csi_battery_saver"); + end; + }; + { + name = "Web connections"; + check = function () + check_module("bosh"); + check_module("websocket"); + end; + }; + { + name = "User profiles"; + check = function () + check_module("vcard_legacy", "vcard"); + end; + }; + { + name = "Blocking"; + check = function () + check_module("blocklist"); + end; + }; + { + name = "Push notifications"; + check = function () + check_module("cloud_notify"); + end; + }; + { + name = "Audio/video calls"; + check = function () + check_module( + "turn_external", + "external_services", + "turncredentials", + "extdisco" + ); + end; + }; + { + name = "File sharing"; + check = function () + check_component("http_file_share", "http_upload", "http_upload_external"); + end; + }; + { + name = "Group chats"; + check = function () + check_component("muc"); + end; + }; + }; + + if not quiet then + print(host); + end + + for _, feature in ipairs(features) do + current_feature = feature; + feature.check(); + feature.ok = ( + not feature.lacking_modules and + not feature.lacking_components and + not feature.lacking_component_modules + ); + -- For improved presentation, we group the (ok) and (not ok) features + if feature.ok then + print_feature_status(feature, host); + end + end + + for _, feature in ipairs(features) do + if not feature.ok then + all_ok = false; + print_feature_status(feature, host); + end + end + + if not quiet then + print(""); + end + end + + return all_ok; + end + if what == nil or what == "all" then local ret; ret = checks.disabled(); diff --git a/util/prosodyctl/shell.lua b/util/prosodyctl/shell.lua index a0fbb09c..d72cf294 100644 --- a/util/prosodyctl/shell.lua +++ b/util/prosodyctl/shell.lua @@ -87,17 +87,7 @@ local function start(arg) --luacheck: ignore 212/arg if arg[1] then if arg[2] then - local fmt = { "%s"; ":%s("; ")" }; - for i = 3, #arg do - if arg[i]:sub(1, 1) == ":" then - table.insert(fmt, i, ")%s("); - elseif i > 3 and fmt[i - 1]:match("%%q$") then - table.insert(fmt, i, ", %q"); - else - table.insert(fmt, i, "%q"); - end - end - arg[1] = string.format(table.concat(fmt), table.unpack(arg)); + arg[1] = ("{"..string.rep("%q", #arg, ", ").."}"):format(table.unpack(arg, 1, #arg)); end client.events.add_handler("connected", function() diff --git a/util/sql.lua b/util/sql.lua index 2f0ec493..06550455 100644 --- a/util/sql.lua +++ b/util/sql.lua @@ -84,7 +84,7 @@ function engine:connect() dbh:autocommit(false); -- don't commit automatically self.conn = dbh; self.prepared = {}; - if params.password then + if params.driver == "SQLite3" and params.password then local ok, err = self:execute(("PRAGMA key='%s'"):format(dbh:quote(params.password))); if not ok then return ok, err; diff --git a/util/x509.lua b/util/x509.lua index 9ecb5b60..6d856be0 100644 --- a/util/x509.lua +++ b/util/x509.lua @@ -11,7 +11,8 @@ -- IDN libraries complicate that. --- [TLS-CERTS] - https://www.rfc-editor.org/rfc/rfc6125.html +-- [TLS-CERTS] - https://www.rfc-editor.org/rfc/rfc6125.html -- Obsolete +-- [TLS-IDENT] - https://www.rfc-editor.org/rfc/rfc9525.html -- [XMPP-CORE] - https://www.rfc-editor.org/rfc/rfc6120.html -- [SRV-ID] - https://www.rfc-editor.org/rfc/rfc4985.html -- [IDNA] - https://www.rfc-editor.org/rfc/rfc5890.html @@ -35,10 +36,8 @@ local oid_subjectaltname = "2.5.29.17"; -- [PKIX] 4.2.1.6 local oid_xmppaddr = "1.3.6.1.5.5.7.8.5"; -- [XMPP-CORE] local oid_dnssrv = "1.3.6.1.5.5.7.8.7"; -- [SRV-ID] --- Compare a hostname (possibly international) with asserted names --- extracted from a certificate. --- This function follows the rules laid out in --- sections 6.4.1 and 6.4.2 of [TLS-CERTS] +-- Compare a hostname (possibly international) with asserted names extracted from a certificate. +-- This function follows the rules laid out in section 6.3 of [TLS-IDENT] -- -- A wildcard ("*") all by itself is allowed only as the left-most label local function compare_dnsname(host, asserted_names) @@ -159,61 +158,25 @@ local function verify_identity(host, service, cert) if ext[oid_subjectaltname] then local sans = ext[oid_subjectaltname]; - -- Per [TLS-CERTS] 6.3, 6.4.4, "a client MUST NOT seek a match for a - -- reference identifier if the presented identifiers include a DNS-ID - -- SRV-ID, URI-ID, or any application-specific identifier types" - local had_supported_altnames = false - if sans[oid_xmppaddr] then - had_supported_altnames = true if service == "_xmpp-client" or service == "_xmpp-server" then if compare_xmppaddr(host, sans[oid_xmppaddr]) then return true end end end if sans[oid_dnssrv] then - had_supported_altnames = true -- Only check srvNames if the caller specified a service if service and compare_srvname(host, service, sans[oid_dnssrv]) then return true end end if sans["dNSName"] then - had_supported_altnames = true if compare_dnsname(host, sans["dNSName"]) then return true end end - - -- We don't need URIs, but [TLS-CERTS] is clear. - if sans["uniformResourceIdentifier"] then - had_supported_altnames = true - end - - if had_supported_altnames then return false end - end - - -- Extract a common name from the certificate, and check it as if it were - -- a dNSName subjectAltName (wildcards may apply for, and receive, - -- cat treats) - -- - -- Per [TLS-CERTS] 1.8, a CN-ID is the Common Name from a cert subject - -- which has one and only one Common Name - local subject = cert:subject() - local cn = nil - for i=1,#subject do - local dn = subject[i] - if dn["oid"] == oid_commonname then - if cn then - log("info", "Certificate has multiple common names") - return false - end - - cn = dn["value"]; - end end - if cn then - -- Per [TLS-CERTS] 6.4.4, follow the comparison rules for dNSName SANs. - return compare_dnsname(host, { cn }) - end + -- Per [TLS-IDENT] ignore the Common Name + -- The server identity can only be expressed in the subjectAltNames extension; + -- it is no longer valid to use the commonName RDN, known as CN-ID in [TLS-CERTS]. -- If all else fails, well, why should we be any different? return false |