aboutsummaryrefslogtreecommitdiffstats
path: root/plugins
diff options
context:
space:
mode:
Diffstat (limited to 'plugins')
-rw-r--r--plugins/mod_auth_internal_hashed.lua5
-rw-r--r--plugins/mod_auth_internal_plain.lua3
-rw-r--r--plugins/mod_bosh.lua3
-rw-r--r--plugins/mod_c2s.lua2
-rw-r--r--plugins/mod_component.lua3
-rw-r--r--plugins/mod_dialback.lua26
-rw-r--r--plugins/mod_limits.lua13
-rw-r--r--plugins/mod_proxy65.lua16
-rw-r--r--plugins/mod_s2s.lua4
-rw-r--r--plugins/mod_websocket.lua2
-rw-r--r--plugins/muc/members_only.lib.lua12
11 files changed, 48 insertions, 41 deletions
diff --git a/plugins/mod_auth_internal_hashed.lua b/plugins/mod_auth_internal_hashed.lua
index 4fd0bd13..37621d20 100644
--- a/plugins/mod_auth_internal_hashed.lua
+++ b/plugins/mod_auth_internal_hashed.lua
@@ -16,6 +16,7 @@ local new_sasl = require "util.sasl".new;
local hex = require"util.hex";
local to_hex, from_hex = hex.to, hex.from;
local saslprep = require "util.encodings".stringprep.saslprep;
+local secure_equals = require "util.hashes".equals;
local log = module._log;
local host = module.host;
@@ -41,7 +42,7 @@ function provider.test_password(username, password)
end
if credentials.password ~= nil and string.len(credentials.password) ~= 0 then
- if saslprep(credentials.password) ~= password then
+ if not secure_equals(saslprep(credentials.password), password) then
return nil, "Auth failed. Provided password is incorrect.";
end
@@ -61,7 +62,7 @@ function provider.test_password(username, password)
local stored_key_hex = to_hex(stored_key);
local server_key_hex = to_hex(server_key);
- if valid and stored_key_hex == credentials.stored_key and server_key_hex == credentials.server_key then
+ if valid and secure_equals(stored_key_hex, credentials.stored_key) and secure_equals(server_key_hex, credentials.server_key) then
return true;
else
return nil, "Auth failed. Invalid username, password, or password hash information.";
diff --git a/plugins/mod_auth_internal_plain.lua b/plugins/mod_auth_internal_plain.lua
index 56ef52d5..8a50e820 100644
--- a/plugins/mod_auth_internal_plain.lua
+++ b/plugins/mod_auth_internal_plain.lua
@@ -9,6 +9,7 @@
local usermanager = require "core.usermanager";
local new_sasl = require "util.sasl".new;
local saslprep = require "util.encodings".stringprep.saslprep;
+local secure_equals = require "util.hashes".equals;
local log = module._log;
local host = module.host;
@@ -26,7 +27,7 @@ function provider.test_password(username, password)
return nil, "Password fails SASLprep.";
end
- if password == saslprep(credentials.password) then
+ if secure_equals(password, saslprep(credentials.password)) then
return true;
else
return nil, "Auth failed. Invalid username or password.";
diff --git a/plugins/mod_bosh.lua b/plugins/mod_bosh.lua
index 0fbf3037..b050e350 100644
--- a/plugins/mod_bosh.lua
+++ b/plugins/mod_bosh.lua
@@ -45,6 +45,7 @@ local bosh_max_wait = module:get_option_number("bosh_max_wait", 120);
local consider_bosh_secure = module:get_option_boolean("consider_bosh_secure");
local cross_domain = module:get_option("cross_domain_bosh");
+local stanza_size_limit = module:get_option_number("c2s_stanza_size_limit", 1024*256);
if cross_domain ~= nil then
module:log("info", "The 'cross_domain_bosh' option has been deprecated");
@@ -122,7 +123,7 @@ function handle_POST(event)
local body = request.body;
local context = { request = request, response = response, notopen = true };
- local stream = new_xmpp_stream(context, stream_callbacks);
+ local stream = new_xmpp_stream(context, stream_callbacks, stanza_size_limit);
response.context = context;
local headers = response.headers;
diff --git a/plugins/mod_c2s.lua b/plugins/mod_c2s.lua
index 8687b4df..38a275f5 100644
--- a/plugins/mod_c2s.lua
+++ b/plugins/mod_c2s.lua
@@ -27,7 +27,7 @@ local log = module._log;
local c2s_timeout = module:get_option_number("c2s_timeout", 300);
local stream_close_timeout = module:get_option_number("c2s_close_timeout", 5);
local opt_keepalives = module:get_option_boolean("c2s_tcp_keepalives", module:get_option_boolean("tcp_keepalives", true));
-local stanza_size_limit = module:get_option_number("c2s_stanza_size_limit"); -- TODO come up with a sensible default (util.xmppstream defaults to 10M)
+local stanza_size_limit = module:get_option_number("c2s_stanza_size_limit", 1024*256);
local measure_connections = module:metric("gauge", "connections", "", "Established c2s connections", {"host", "type", "ip_family"});
diff --git a/plugins/mod_component.lua b/plugins/mod_component.lua
index a0bac298..fb5f5ab8 100644
--- a/plugins/mod_component.lua
+++ b/plugins/mod_component.lua
@@ -27,6 +27,7 @@ local hosts = prosody.hosts;
local log = module._log;
local opt_keepalives = module:get_option_boolean("component_tcp_keepalives", module:get_option_boolean("tcp_keepalives", true));
+local stanza_size_limit = module:get_option_number("component_stanza_size_limit", module:get_option_number("s2s_stanza_size_limit", 1024*512));
local sessions = module:shared("sessions");
@@ -304,7 +305,7 @@ function listener.onconnect(conn)
session.log("info", "Incoming Jabber component connection");
- local stream = new_xmpp_stream(session, stream_callbacks);
+ local stream = new_xmpp_stream(session, stream_callbacks, stanza_size_limit);
session.stream = stream;
session.notopen = true;
diff --git a/plugins/mod_dialback.lua b/plugins/mod_dialback.lua
index 7396e07e..0df8d36f 100644
--- a/plugins/mod_dialback.lua
+++ b/plugins/mod_dialback.lua
@@ -13,6 +13,7 @@ local log = module._log;
local st = require "util.stanza";
local sha256_hash = require "util.hashes".sha256;
local sha256_hmac = require "util.hashes".hmac_sha256;
+local secure_equals = require "util.hashes".equals;
local nameprep = require "util.encodings".stringprep.nameprep;
local uuid_gen = require"util.uuid".generate;
@@ -21,20 +22,6 @@ local xmlns_stream = "http://etherx.jabber.org/streams";
local dialback_requests = setmetatable({}, { __mode = 'v' });
local dialback_secret = sha256_hash(module:get_option_string("dialback_secret", uuid_gen()), true);
-local dwd = module:get_option_boolean("dialback_without_dialback", false);
-
---- Helper to check that a session peer's certificate is valid
-function check_cert_status(session)
- local host = session.direction == "outgoing" and session.to_host or session.from_host
- local conn = session.conn:socket()
- local cert
- if conn.getpeercertificate then
- cert = conn:getpeercertificate()
- end
-
- return module:fire_event("s2s-check-certificate", { host = host, session = session, cert = cert });
-end
-
function module.save()
return { dialback_secret = dialback_secret };
@@ -56,7 +43,7 @@ function initiate_dialback(session)
end
function verify_dialback(id, to, from, key)
- return key == generate_dialback(id, to, from);
+ return secure_equals(key, generate_dialback(id, to, from));
end
module:hook("stanza/jabber:server:dialback:verify", function(event)
@@ -110,15 +97,6 @@ module:hook("stanza/jabber:server:dialback:result", function(event)
return true;
end
- if dwd and origin.secure then
- if check_cert_status(origin, from) == false then
- return
- elseif origin.cert_chain_status == "valid" and origin.cert_identity_status == "valid" then
- origin.sends2s(st.stanza("db:result", { to = from, from = to, id = attr.id, type = "valid" }));
- module:fire_event("s2s-authenticated", { session = origin, host = from, mechanism = "dialback" });
- return true;
- end
- end
origin.hosts[from] = { dialback_key = stanza[1] };
diff --git a/plugins/mod_limits.lua b/plugins/mod_limits.lua
index 024ab686..9fe62d05 100644
--- a/plugins/mod_limits.lua
+++ b/plugins/mod_limits.lua
@@ -31,7 +31,7 @@ local function parse_burst(burst, sess_type)
burst = burst:match("^(%d+) ?s$");
end
local n_burst = tonumber(burst);
- if not n_burst then
+ if burst and not n_burst then
module:log("error", "Unable to parse burst for %s: %q, using default burst interval (%ds)", sess_type, burst, default_burst);
end
return n_burst or default_burst;
@@ -39,7 +39,16 @@ end
-- Process config option into limits table:
-- limits = { c2s = { bytes_per_second = X, burst_seconds = Y } }
-local limits = {};
+local limits = {
+ c2s = {
+ bytes_per_second = 10 * 1024;
+ burst_seconds = 2;
+ };
+ s2sin = {
+ bytes_per_second = 30 * 1024;
+ burst_seconds = 2;
+ };
+};
for sess_type, sess_limits in pairs(limits_cfg) do
limits[sess_type] = {
diff --git a/plugins/mod_proxy65.lua b/plugins/mod_proxy65.lua
index bac36b55..069ce0a9 100644
--- a/plugins/mod_proxy65.lua
+++ b/plugins/mod_proxy65.lua
@@ -93,6 +93,7 @@ function module.add_host(module)
local proxy_address = module:get_option_string("proxy65_address", host);
local proxy_acl = module:get_option_array("proxy65_acl");
+ local proxy_open_access = module:get_option_boolean("proxy65_open_access", false);
-- COMPAT w/pre-0.9 where proxy65_port was specified in the components section of the config
local legacy_config = module:get_option_number("proxy65_port");
@@ -109,13 +110,20 @@ function module.add_host(module)
-- check ACL
-- using 'while' instead of 'if' so we can break out of it
- while proxy_acl and #proxy_acl > 0 do --luacheck: ignore 512
+ local allow;
+ if proxy_acl and #proxy_acl > 0 then
local jid = stanza.attr.from;
- local allow;
for _, acl in ipairs(proxy_acl) do
- if jid_compare(jid, acl) then allow = true; break; end
+ if jid_compare(jid, acl) then
+ allow = true;
+ break;
+ end
end
- if allow then break; end
+ elseif proxy_open_access or origin.type == "c2s" then
+ allow = true;
+ end
+
+ if not allow then
module:log("warn", "Denying use of proxy for %s", stanza.attr.from);
origin.send(st.error_reply(stanza, "auth", "forbidden"));
return true;
diff --git a/plugins/mod_s2s.lua b/plugins/mod_s2s.lua
index 679f97e9..9c45fc31 100644
--- a/plugins/mod_s2s.lua
+++ b/plugins/mod_s2s.lua
@@ -39,7 +39,7 @@ local secure_auth = module:get_option_boolean("s2s_secure_auth", false); -- One
local secure_domains, insecure_domains =
module:get_option_set("s2s_secure_domains", {})._items, module:get_option_set("s2s_insecure_domains", {})._items;
local require_encryption = module:get_option_boolean("s2s_require_encryption", false);
-local stanza_size_limit = module:get_option_number("s2s_stanza_size_limit"); -- TODO come up with a sensible default (util.xmppstream defaults to 10M)
+local stanza_size_limit = module:get_option_number("s2s_stanza_size_limit", 1024*512);
local measure_connections_inbound = module:metric(
"gauge", "connections_inbound", "",
@@ -343,7 +343,7 @@ function make_authenticated(event)
end
--- Helper to check that a session peer's certificate is valid
-function check_cert_status(session)
+local function check_cert_status(session)
local host = session.direction == "outgoing" and session.to_host or session.from_host
local conn = session.conn:socket()
local cert
diff --git a/plugins/mod_websocket.lua b/plugins/mod_websocket.lua
index 6946894a..80296c5b 100644
--- a/plugins/mod_websocket.lua
+++ b/plugins/mod_websocket.lua
@@ -28,7 +28,7 @@ local parse_close = websocket_frames.parse_close;
local t_concat = table.concat;
-local stanza_size_limit = module:get_option_number("c2s_stanza_size_limit", 10 * 1024 * 1024);
+local stanza_size_limit = module:get_option_number("c2s_stanza_size_limit", 1024 * 256);
local frame_buffer_limit = module:get_option_number("websocket_frame_buffer_limit", 2 * stanza_size_limit);
local frame_fragment_limit = module:get_option_number("websocket_frame_fragment_limit", 8);
local stream_close_timeout = module:get_option_number("c2s_close_timeout", 5);
diff --git a/plugins/muc/members_only.lib.lua b/plugins/muc/members_only.lib.lua
index 79077153..6a2543e1 100644
--- a/plugins/muc/members_only.lib.lua
+++ b/plugins/muc/members_only.lib.lua
@@ -61,12 +61,20 @@ local function set_allow_member_invites(room, allow_member_invites)
end
module:hook("muc-disco#info", function(event)
- event.reply:tag("feature", {var = get_members_only(event.room) and "muc_membersonly" or "muc_open"}):up();
+ local members_only_room = not not get_members_only(event.room);
+ local members_can_invite = not not get_allow_member_invites(event.room);
+ event.reply:tag("feature", {var = members_only_room and "muc_membersonly" or "muc_open"}):up();
table.insert(event.form, {
name = "{http://prosody.im/protocol/muc}roomconfig_allowmemberinvites";
label = "Allow members to invite new members";
type = "boolean";
- value = not not get_allow_member_invites(event.room);
+ value = members_can_invite;
+ });
+ table.insert(event.form, {
+ name = "muc#roomconfig_allowinvites";
+ label = "Allow users to invite other users";
+ type = "boolean";
+ value = not members_only_room or members_can_invite;
});
end);
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-29 07:54:13 +0000