aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
| * | | | | | | util.paseto: Fix to decode footer before comparisonMatthew Wild2022-07-111-0/+1
| | | | | | | |
| * | | | | | | mod_http_file_share: Switch to new util.jwt APIMatthew Wild2022-07-111-32/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some changes/improvements in this commit: - Default token lifetime is now 3600s (from 300s) - Tokens are only validated once per upload - "iat"/"exp" are handled automatically by util.jwt
| * | | | | | | util.jwt: Add new init() convenience method to obtain both signer and verifierMatthew Wild2022-07-111-0/+6
| | | | | | | |
| * | | | | | | util.jwt: Consolidate payload parsing, ensure it's always a valid objectMatthew Wild2022-07-111-11/+13
| | | | | | | |
| * | | | | | | util.jwt: Provide built-in token expiry support (defaults to 3600s lifetime)Matthew Wild2022-07-111-3/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To avoid every user of the library needing to add and verify expiry info, this is now handled by util.jwt itself (if not overridden or disabled). Issuing tokens that are valid forever is bad practice and rarely desired, and the default token lifetime is now 3600s (1 hour).
| * | | | | | | util.jwt: All the algorithms (+ all the tests!)Matthew Wild2022-07-022-24/+98
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Except 'none'. Not implementing that one.
| * | | | | | | util.crypto: tests: fix some tests that didn't do much (thanks luacheck!)Matthew Wild2022-07-021-3/+2
| | | | | | | |
| * | | | | | | util.crypto: More digests for sign/verify, use macros for clarity/consistencyMatthew Wild2022-07-022-34/+42
| | | | | | | |
| * | | | | | | util.jwt: Overhaul of tests to use declarative approachMatthew Wild2022-07-022-115/+199
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Now we can consistently apply the same tests to every algorithm, instead of duplicating code.
| * | | | | | | spec: Move test crypto keys to a shared file for clarity and easy maintenanceMatthew Wild2022-07-023-125/+82
| | | | | | | |
| * | | | | | | util.jwt: Add support for RSA-based algorithms (RS256, PS256)Matthew Wild2022-07-022-14/+205
| | | | | | | |
| * | | | | | | util.crypto: Friendlier error message on incorrect key typesMatthew Wild2022-07-021-1/+6
| | | | | | | |
| * | | | | | | util.crypto: Add support for RSA signatures (PKCS1-v1.5 + PSS)Matthew Wild2022-07-021-3/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | These are used by the RS*** and PS*** family of JOSE algorithms (e.g. in JWTs)
| * | | | | | | util.jwt: Add support/tests for ES256 via improved API and using util.cryptoMatthew Wild2022-07-012-19/+171
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In many cases code will be either signing or verifying. With asymmetric algorithms it's clearer and more efficient to just state that once, instead of passing keys (and possibly other parameters) with every sign/verify call. This also allows earlier validation of the key used. The previous (HS256-only) sign/verify methods continue to be exposed for backwards-compatibility.
| * | | | | | | util.crypto: Add Teal type specificationKim Alvefur2022-06-301-0/+29
| | | | | | | |
| * | | | | | | util.paseto: Implementation of PASETO v4.public tokensMatthew Wild2022-06-241-0/+123
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | PASETO provides an alternative to JWT with the promise of fewer implementation pitfalls. The v4.public algorithm allows asymmetric cryptographically-verified token issuance and validation. In summary, such tokens can be issued by one party and securely verified by any other party independently using the public key of the issuer. This has a number of potential applications in a decentralized network and ecosystem such as XMPP. For example, such tokens could be combined with XEP-0317 to allow hats to be verified even in the context of a third-party MUC service.
| * | | | | | | util.crypto: New wrapper for some operations in OpenSSL's libcryptoMatthew Wild2022-06-243-2/+753
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Specifically, ED25519 key generation/import/export, sign/verify operations, and AES encrypt/decrypt.
| * | | | | | | util-src: Add new utility header managed_pointer.hMatthew Wild2022-07-011-0/+61
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The macros in this header allow creation of GC-managed objects from manually- managed C alloc/free APIs.
| * | | | | | | mod_smacks: Set session.smacks after sending <enabled/> to fix tracebackMatthew Wild2022-08-291-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ...with opportunistic writes enabled.
| * | | | | | | core.moduleapi: Check for local role-aware sessions before e.g. s2sKim Alvefur2022-08-291-9/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The condition checked for s2sin but not s2sout, so would have ignored bidi-enabled s2sout sessions. Components as well.
| * | | | | | | mod_smacks: Use new :add_error() in last remaining error result constructionMatthew Wild2022-08-291-2/+1
| | | | | | | |
| * | | | | | | mod_smacks: Split enable handling to stages, to allow easier SASL2 integrationMatthew Wild2022-08-291-21/+48
| | | | | | | |
| * | | | | | | util.stanza: Add add_error() to simplify adding error tags to existing stanzasMatthew Wild2022-08-292-25/+45
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some fiddling is required now in error_reply() to ensure the cursor is in the same place as before this change (a lot of code apparently uses that feature).
| * | | | | | | mod_component: Require 'from' attribute on stanzas by defaultMatthew Wild2022-08-281-16/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The old behaviour of falling back to the component domain when it is missing has been merged into the logic for the existing "validate_from_addresses" option (which is strict by default). ejabberd already rejects component stanzas with no 'from' (as the XEP requires), and this has led to compatibility issues for components that were seemingly working fine with Prosody.
| * | | | | | | mod_external_services: Update tools.ietf.org URLKim Alvefur2022-08-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | See bd9e006a7a74
| * | | | | | | doap: Update for XEP-0215 advancement to StableKim Alvefur2022-08-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | No other changes to account for.
| * | | | | | | core.usermanager: Link to docs for new role API to make warning more actionableKim Alvefur2022-08-271-0/+1
| | | | | | | |
| * | | | | | | mod_smacks: Split resumption into multiple stages, to simplify ISR integrationMatthew Wild2022-08-261-63/+82
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This will allow us to return the success/failed as part of the SASL2 response, and *then* perform the stanza sync as a second step.
| * | | | | | | mod_s2s: Simplify conditionals since all sessions should have .host nowKim Alvefur2022-08-262-3/+3
| | | | | | | |
| * | | | | | | Merge 0.12->trunkKim Alvefur2022-08-261-2/+2
| |\ \ \ \ \ \ \
| * | | | | | | | mod_smacks: Don't close resuming session when failed due to overflowMatthew Wild2022-08-261-7/+8
| | | | | | | | |
| * | | | | | | | mod_smacks: Long overdue cleanup of resumption code, fixes some old TODOsMatthew Wild2022-08-263-52/+66
| | | | | | | | |
| * | | | | | | | mod_admin_shell: Rename variable to avoid confusion with global functionKim Alvefur2022-08-251-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For luacheck, but it doesn't actually complain about this right now
| * | | | | | | | mod_admin_shell: Fix output from user:roles()Kim Alvefur2022-08-251-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It used _G.print instead of the shell session print, which would silently write to stdout
| * | | | | | | | Merge role-auth->trunkMatthew Wild2022-08-2228-259/+837
| |\ \ \ \ \ \ \ \
| | * | | | | | | | CHANGES: Add role authMatthew Wild2022-08-221-0/+1
| | | | | | | | | |
| | * | | | | | | | mod_admin_shell: Ensure account has role before it is usableKim Alvefur2022-08-181-8/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | By creating the account first without a password it can't be used until the role has set. This is most important for restricted accounts, as a failure to set the role would lead to the account having more privileges than indented.
| | * | | | | | | | mod_auth_insecure: Store creation and update timestamps on accountKim Alvefur2022-08-181-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This ensures that the store is not empty in case no password is provided, so the underlying data storage won't consider the store empty.
| | * | | | | | | | mod_admin_shell: Update help for user:create to reflect singular role argumentKim Alvefur2022-08-181-1/+1
| | | | | | | | | |
| | * | | | | | | | mod_auth_internal_hashed: Allow creating disabled account without passwordKim Alvefur2022-08-181-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Otherwise, create_user(username, nil) leads to the account being deleted.
| | * | | | | | | | mod_admin_shell: Update with new role management commands and help textMatthew Wild2022-08-181-39/+52
| | | | | | | | | |
| | * | | | | | | | core.usermanager: Update argument name in authz fallback methodKim Alvefur2022-08-181-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It's not plural
| | * | | | | | | | core.usermanager: Remove obsolete authz fallback methodKim Alvefur2022-08-181-1/+0
| | | | | | | | | |
| | * | | | | | | | core.usermanager: Add missing methods to fallback authz providerKim Alvefur2022-08-181-0/+3
| | | | | | | | | |
| | * | | | | | | | core.usermanager: Add scoped luacheck ignore rule to reduce clutterKim Alvefur2022-08-181-11/+12
| | | | | | | | | |
| | * | | | | | | | mod_authz_internal: Expose convenience method to test if user can assume roleMatthew Wild2022-08-182-0/+20
| | | | | | | | | |
| | * | | | | | | | mod_authz_internal, and more: New iteration of role APIMatthew Wild2022-08-176-59/+184
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | These changes to the API (hopefully the last) introduce a cleaner separation between the user's primary (default) role, and their secondary (optional) roles. To keep the code sane and reduce complexity, a data migration is needed for people using stored roles in 0.12. This can be performed with prosodyctl mod_authz_internal migrate <host>
| | * | | | | | | | util.roles: Add Teal interface declarationKim Alvefur2022-08-121-0/+32
| | | | | | | | | |
| | * | | | | | | | mod_admin_shell: Show session role in c2s:showKim Alvefur2022-08-151-1/+10
| | | | | | | | | |
| | * | | | | | | | usermanager: Add back temporary is_admin to warn about deprecated API usageMatthew Wild2022-08-151-0/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Goal: Introduce role-auth with minimal disruption is_admin() is unsafe in a system with per-session permissions, so it has been deprecated. Roll-out approach: 1) First, log a warning when is_admin() is used. It should continue to function normally, backed by the new role API. Nothing is really using per-session authz yet, so there is minimal security concern. The 'strict_deprecate_is_admin' global setting can be set to 'true' to force a hard failure of is_admin() attempts (it will log an error and always return false). 2) In some time (at least 1 week), but possibly longer depending on the number of affected deployments: switch 'strict_deprecate_is_admin' to 'true' by default. It can still be disabled for systems that need it. 3) Further in the future, before the next release, the option will be removed and is_admin() will be permanently disabled.
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-15 01:28:02 +0000