| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| * | | mod_http_file_share: Use correct variable name (thanks riau.sni) | Matthew Wild | 2022-09-04 | 1 | -3/+3 | |
| | | | ||||||
| * | | mod_saslauth: Fix incorrect variable name introduced in 27a4a7e64831 | Matthew Wild | 2022-09-03 | 1 | -1/+1 | |
| | | | ||||||
| * | | mod_smacks: Set session flag during successful enable | Matthew Wild | 2022-09-03 | 1 | -0/+1 | |
| | | | ||||||
| * | | mod_smacks: Add type field to results so actions can be later distinguished | Matthew Wild | 2022-09-03 | 1 | -1/+2 | |
| | | | ||||||
| * | | mod_saslauth: Only announce bind feature if no resource yet bound | Matthew Wild | 2022-09-03 | 1 | -1/+1 | |
| | | | | | | | | | It's now possible to bind during SASL2 negotiation. | |||||
| * | | semgrep: Catch stanza:text() (assuming it's meant to be :get_text()) | Matthew Wild | 2022-09-03 | 1 | -0/+6 | |
| | | | ||||||
| * | | util.paseto: Do strict type check in pae() function | Kim Alvefur | 2022-07-11 | 1 | -0/+3 | |
| | | | | | | | | | | | Fixes a test failure on Lua 5.4 where ipairs("") does not produce an error. | |||||
| * | | util.crypto: Use Lua 5.2 API for predictable buffer size | Kim Alvefur | 2022-07-11 | 1 | -6/+1 | |
| | | | | | | | | | | | | | | | | | In Lua 5.3 LUAL_BUFFERSIZE is a macro computed from sizeof and is thus not known at pre-processing time, so this does not work. Since Lua 5.1 is no longer supported, we can use luaL_prepbuffsize() which is available from Lua 5.2 | |||||
| * | | util.crypto: Use stack space buffers | Kim Alvefur | 2022-07-11 | 1 | -14/+11 | |
| | | | | | | | | | | | | | | | | | | | Removes assumption that LUAL_BUFFERSIZE is known at pre-processing time, which it is not in Lua 5.3 and 5.4, where it is a computed macro based on sizeof. Allocation of stack space is safer and faster, no need to worry about luaL_prepbuffer failing to allocate memory and skipping free() | |||||
| * | | util.paseto: Drop custom wrappers around key objects | Matthew Wild | 2022-07-11 | 2 | -47/+6 | |
| | | | | | | | | | | | | | | | | | | | | | The PASETO spec recommends - no, *requires* - that implementations enforce type safety for keys, and e.g. do not pass them around as arbitrary byte strings. Typed wrapper objects are recommended. I originally followed this advice when starting the lib. However, key wrapping and type safety is now also a feature of util.crypto. All we're doing is duplicating it unnecessarily with this additional wrapper code. | |||||
| * | | util.paseto: Add tests based on official PASETO test vectors | Matthew Wild | 2022-07-11 | 1 | -0/+118 | |
| | | | | | | | | | | | Unfortunately there are only a few relevant ones, but they did help catch some bugs. | |||||
| * | | util.paseto: Export similar API to new util.jwt for ease and consistency | Matthew Wild | 2022-07-11 | 1 | -0/+21 | |
| | | | ||||||
| * | | util.paseto: Error early on invalid keys | Matthew Wild | 2022-07-11 | 1 | -0/+2 | |
| | | | ||||||
| * | | util.paseto: Fix to decode footer before comparison | Matthew Wild | 2022-07-11 | 1 | -0/+1 | |
| | | | ||||||
| * | | mod_http_file_share: Switch to new util.jwt API | Matthew Wild | 2022-07-11 | 1 | -32/+32 | |
| | | | | | | | | | | | | | | | | | Some changes/improvements in this commit: - Default token lifetime is now 3600s (from 300s) - Tokens are only validated once per upload - "iat"/"exp" are handled automatically by util.jwt | |||||
| * | | util.jwt: Add new init() convenience method to obtain both signer and verifier | Matthew Wild | 2022-07-11 | 1 | -0/+6 | |
| | | | ||||||
| * | | util.jwt: Consolidate payload parsing, ensure it's always a valid object | Matthew Wild | 2022-07-11 | 1 | -11/+13 | |
| | | | ||||||
| * | | util.jwt: Provide built-in token expiry support (defaults to 3600s lifetime) | Matthew Wild | 2022-07-11 | 1 | -3/+28 | |
| | | | | | | | | | | | | | | | | | To avoid every user of the library needing to add and verify expiry info, this is now handled by util.jwt itself (if not overridden or disabled). Issuing tokens that are valid forever is bad practice and rarely desired, and the default token lifetime is now 3600s (1 hour). | |||||
| * | | util.jwt: All the algorithms (+ all the tests!) | Matthew Wild | 2022-07-02 | 2 | -24/+98 | |
| | | | | | | | | | Except 'none'. Not implementing that one. | |||||
| * | | util.crypto: tests: fix some tests that didn't do much (thanks luacheck!) | Matthew Wild | 2022-07-02 | 1 | -3/+2 | |
| | | | ||||||
| * | | util.crypto: More digests for sign/verify, use macros for clarity/consistency | Matthew Wild | 2022-07-02 | 2 | -34/+42 | |
| | | | ||||||
| * | | util.jwt: Overhaul of tests to use declarative approach | Matthew Wild | 2022-07-02 | 2 | -115/+199 | |
| | | | | | | | | | | | Now we can consistently apply the same tests to every algorithm, instead of duplicating code. | |||||
| * | | spec: Move test crypto keys to a shared file for clarity and easy maintenance | Matthew Wild | 2022-07-02 | 3 | -125/+82 | |
| | | | ||||||
| * | | util.jwt: Add support for RSA-based algorithms (RS256, PS256) | Matthew Wild | 2022-07-02 | 2 | -14/+205 | |
| | | | ||||||
| * | | util.crypto: Friendlier error message on incorrect key types | Matthew Wild | 2022-07-02 | 1 | -1/+6 | |
| | | | ||||||
| * | | util.crypto: Add support for RSA signatures (PKCS1-v1.5 + PSS) | Matthew Wild | 2022-07-02 | 1 | -3/+31 | |
| | | | | | | | | | These are used by the RS*** and PS*** family of JOSE algorithms (e.g. in JWTs) | |||||
| * | | util.jwt: Add support/tests for ES256 via improved API and using util.crypto | Matthew Wild | 2022-07-01 | 2 | -19/+171 | |
| | | | | | | | | | | | | | | | | | | | | | | | In many cases code will be either signing or verifying. With asymmetric algorithms it's clearer and more efficient to just state that once, instead of passing keys (and possibly other parameters) with every sign/verify call. This also allows earlier validation of the key used. The previous (HS256-only) sign/verify methods continue to be exposed for backwards-compatibility. | |||||
| * | | util.crypto: Add Teal type specification | Kim Alvefur | 2022-06-30 | 1 | -0/+29 | |
| | | | ||||||
| * | | util.paseto: Implementation of PASETO v4.public tokens | Matthew Wild | 2022-06-24 | 1 | -0/+123 | |
| | | | | | | | | | | | | | | | | | | | | | | | | | PASETO provides an alternative to JWT with the promise of fewer implementation pitfalls. The v4.public algorithm allows asymmetric cryptographically-verified token issuance and validation. In summary, such tokens can be issued by one party and securely verified by any other party independently using the public key of the issuer. This has a number of potential applications in a decentralized network and ecosystem such as XMPP. For example, such tokens could be combined with XEP-0317 to allow hats to be verified even in the context of a third-party MUC service. | |||||
| * | | util.crypto: New wrapper for some operations in OpenSSL's libcrypto | Matthew Wild | 2022-06-24 | 3 | -2/+753 | |
| | | | | | | | | | | | Specifically, ED25519 key generation/import/export, sign/verify operations, and AES encrypt/decrypt. | |||||
| * | | util-src: Add new utility header managed_pointer.h | Matthew Wild | 2022-07-01 | 1 | -0/+61 | |
| | | | | | | | | | | | The macros in this header allow creation of GC-managed objects from manually- managed C alloc/free APIs. | |||||
| * | | mod_smacks: Set session.smacks after sending <enabled/> to fix traceback | Matthew Wild | 2022-08-29 | 1 | -2/+1 | |
| | | | | | | | | | ...with opportunistic writes enabled. | |||||
| * | | core.moduleapi: Check for local role-aware sessions before e.g. s2s | Kim Alvefur | 2022-08-29 | 1 | -9/+9 | |
| | | | | | | | | | | | The condition checked for s2sin but not s2sout, so would have ignored bidi-enabled s2sout sessions. Components as well. | |||||
| * | | mod_smacks: Use new :add_error() in last remaining error result construction | Matthew Wild | 2022-08-29 | 1 | -2/+1 | |
| | | | ||||||
| * | | mod_smacks: Split enable handling to stages, to allow easier SASL2 integration | Matthew Wild | 2022-08-29 | 1 | -21/+48 | |
| | | | ||||||
| * | | util.stanza: Add add_error() to simplify adding error tags to existing stanzas | Matthew Wild | 2022-08-29 | 2 | -25/+45 | |
| | | | | | | | | | | | Some fiddling is required now in error_reply() to ensure the cursor is in the same place as before this change (a lot of code apparently uses that feature). | |||||
| * | | mod_component: Require 'from' attribute on stanzas by default | Matthew Wild | 2022-08-28 | 1 | -16/+13 | |
| | | | | | | | | | | | | | | | | | | | | | The old behaviour of falling back to the component domain when it is missing has been merged into the logic for the existing "validate_from_addresses" option (which is strict by default). ejabberd already rejects component stanzas with no 'from' (as the XEP requires), and this has led to compatibility issues for components that were seemingly working fine with Prosody. | |||||
| * | | mod_external_services: Update tools.ietf.org URL | Kim Alvefur | 2022-08-27 | 1 | -1/+1 | |
| | | | | | | | | | See bd9e006a7a74 | |||||
| * | | doap: Update for XEP-0215 advancement to Stable | Kim Alvefur | 2022-08-27 | 1 | -1/+1 | |
| | | | | | | | | | No other changes to account for. | |||||
| * | | core.usermanager: Link to docs for new role API to make warning more actionable | Kim Alvefur | 2022-08-27 | 1 | -0/+1 | |
| | | | ||||||
| * | | mod_smacks: Split resumption into multiple stages, to simplify ISR integration | Matthew Wild | 2022-08-26 | 1 | -63/+82 | |
| | | | | | | | | | | | This will allow us to return the success/failed as part of the SASL2 response, and *then* perform the stanza sync as a second step. | |||||
| * | | mod_s2s: Simplify conditionals since all sessions should have .host now | Kim Alvefur | 2022-08-26 | 2 | -3/+3 | |
| | | | ||||||
| * | | Merge 0.12->trunk | Kim Alvefur | 2022-08-26 | 1 | -2/+2 | |
| |\| | ||||||
| | * | mod_s2s: Fix firing buffer drain events | Kim Alvefur | 2022-08-26 | 1 | -2/+2 | |
| | | | | | | | | | | | Fixes the same kind of issue as in 65563530375b but once and for all, while improving similarity between incoming and outgoing connections. | |||||
| * | | mod_smacks: Don't close resuming session when failed due to overflow | Matthew Wild | 2022-08-26 | 1 | -7/+8 | |
| | | | ||||||
| * | | mod_smacks: Long overdue cleanup of resumption code, fixes some old TODOs | Matthew Wild | 2022-08-26 | 3 | -52/+66 | |
| | | | ||||||
| * | | mod_admin_shell: Rename variable to avoid confusion with global function | Kim Alvefur | 2022-08-25 | 1 | -7/+7 | |
| | | | | | | | | | For luacheck, but it doesn't actually complain about this right now | |||||
| * | | mod_admin_shell: Fix output from user:roles() | Kim Alvefur | 2022-08-25 | 1 | -0/+1 | |
| | | | | | | | | | | | It used _G.print instead of the shell session print, which would silently write to stdout | |||||
| * | | Merge role-auth->trunk | Matthew Wild | 2022-08-22 | 28 | -259/+837 | |
| |\ \ | ||||||
| | * | | CHANGES: Add role auth | Matthew Wild | 2022-08-22 | 1 | -0/+1 | |
| | | | | ||||||
 |
index : prosody.git | |
| unofficial mirror of the prosody mercurial project |
| aboutsummaryrefslogtreecommitdiffstats |