| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| * | | util.paseto: Add tests based on official PASETO test vectors | Matthew Wild | 2022-07-11 | 1 | -0/+118 | |
| | | | | | | | | | | | Unfortunately there are only a few relevant ones, but they did help catch some bugs. | |||||
| * | | util.paseto: Export similar API to new util.jwt for ease and consistency | Matthew Wild | 2022-07-11 | 1 | -0/+21 | |
| | | | ||||||
| * | | util.paseto: Error early on invalid keys | Matthew Wild | 2022-07-11 | 1 | -0/+2 | |
| | | | ||||||
| * | | util.paseto: Fix to decode footer before comparison | Matthew Wild | 2022-07-11 | 1 | -0/+1 | |
| | | | ||||||
| * | | mod_http_file_share: Switch to new util.jwt API | Matthew Wild | 2022-07-11 | 1 | -32/+32 | |
| | | | | | | | | | | | | | | | | | Some changes/improvements in this commit: - Default token lifetime is now 3600s (from 300s) - Tokens are only validated once per upload - "iat"/"exp" are handled automatically by util.jwt | |||||
| * | | util.jwt: Add new init() convenience method to obtain both signer and verifier | Matthew Wild | 2022-07-11 | 1 | -0/+6 | |
| | | | ||||||
| * | | util.jwt: Consolidate payload parsing, ensure it's always a valid object | Matthew Wild | 2022-07-11 | 1 | -11/+13 | |
| | | | ||||||
| * | | util.jwt: Provide built-in token expiry support (defaults to 3600s lifetime) | Matthew Wild | 2022-07-11 | 1 | -3/+28 | |
| | | | | | | | | | | | | | | | | | To avoid every user of the library needing to add and verify expiry info, this is now handled by util.jwt itself (if not overridden or disabled). Issuing tokens that are valid forever is bad practice and rarely desired, and the default token lifetime is now 3600s (1 hour). | |||||
| * | | util.jwt: All the algorithms (+ all the tests!) | Matthew Wild | 2022-07-02 | 2 | -24/+98 | |
| | | | | | | | | | Except 'none'. Not implementing that one. | |||||
| * | | util.crypto: tests: fix some tests that didn't do much (thanks luacheck!) | Matthew Wild | 2022-07-02 | 1 | -3/+2 | |
| | | | ||||||
| * | | util.crypto: More digests for sign/verify, use macros for clarity/consistency | Matthew Wild | 2022-07-02 | 2 | -34/+42 | |
| | | | ||||||
| * | | util.jwt: Overhaul of tests to use declarative approach | Matthew Wild | 2022-07-02 | 2 | -115/+199 | |
| | | | | | | | | | | | Now we can consistently apply the same tests to every algorithm, instead of duplicating code. | |||||
| * | | spec: Move test crypto keys to a shared file for clarity and easy maintenance | Matthew Wild | 2022-07-02 | 3 | -125/+82 | |
| | | | ||||||
| * | | util.jwt: Add support for RSA-based algorithms (RS256, PS256) | Matthew Wild | 2022-07-02 | 2 | -14/+205 | |
| | | | ||||||
| * | | util.crypto: Friendlier error message on incorrect key types | Matthew Wild | 2022-07-02 | 1 | -1/+6 | |
| | | | ||||||
| * | | util.crypto: Add support for RSA signatures (PKCS1-v1.5 + PSS) | Matthew Wild | 2022-07-02 | 1 | -3/+31 | |
| | | | | | | | | | These are used by the RS*** and PS*** family of JOSE algorithms (e.g. in JWTs) | |||||
| * | | util.jwt: Add support/tests for ES256 via improved API and using util.crypto | Matthew Wild | 2022-07-01 | 2 | -19/+171 | |
| | | | | | | | | | | | | | | | | | | | | | | | In many cases code will be either signing or verifying. With asymmetric algorithms it's clearer and more efficient to just state that once, instead of passing keys (and possibly other parameters) with every sign/verify call. This also allows earlier validation of the key used. The previous (HS256-only) sign/verify methods continue to be exposed for backwards-compatibility. | |||||
| * | | util.crypto: Add Teal type specification | Kim Alvefur | 2022-06-30 | 1 | -0/+29 | |
| | | | ||||||
| * | | util.paseto: Implementation of PASETO v4.public tokens | Matthew Wild | 2022-06-24 | 1 | -0/+123 | |
| | | | | | | | | | | | | | | | | | | | | | | | | | PASETO provides an alternative to JWT with the promise of fewer implementation pitfalls. The v4.public algorithm allows asymmetric cryptographically-verified token issuance and validation. In summary, such tokens can be issued by one party and securely verified by any other party independently using the public key of the issuer. This has a number of potential applications in a decentralized network and ecosystem such as XMPP. For example, such tokens could be combined with XEP-0317 to allow hats to be verified even in the context of a third-party MUC service. | |||||
| * | | util.crypto: New wrapper for some operations in OpenSSL's libcrypto | Matthew Wild | 2022-06-24 | 3 | -2/+753 | |
| | | | | | | | | | | | Specifically, ED25519 key generation/import/export, sign/verify operations, and AES encrypt/decrypt. | |||||
| * | | util-src: Add new utility header managed_pointer.h | Matthew Wild | 2022-07-01 | 1 | -0/+61 | |
| | | | | | | | | | | | The macros in this header allow creation of GC-managed objects from manually- managed C alloc/free APIs. | |||||
| * | | mod_smacks: Set session.smacks after sending <enabled/> to fix traceback | Matthew Wild | 2022-08-29 | 1 | -2/+1 | |
| | | | | | | | | | ...with opportunistic writes enabled. | |||||
| * | | core.moduleapi: Check for local role-aware sessions before e.g. s2s | Kim Alvefur | 2022-08-29 | 1 | -9/+9 | |
| | | | | | | | | | | | The condition checked for s2sin but not s2sout, so would have ignored bidi-enabled s2sout sessions. Components as well. | |||||
| * | | mod_smacks: Use new :add_error() in last remaining error result construction | Matthew Wild | 2022-08-29 | 1 | -2/+1 | |
| | | | ||||||
| * | | mod_smacks: Split enable handling to stages, to allow easier SASL2 integration | Matthew Wild | 2022-08-29 | 1 | -21/+48 | |
| | | | ||||||
| * | | util.stanza: Add add_error() to simplify adding error tags to existing stanzas | Matthew Wild | 2022-08-29 | 2 | -25/+45 | |
| | | | | | | | | | | | Some fiddling is required now in error_reply() to ensure the cursor is in the same place as before this change (a lot of code apparently uses that feature). | |||||
| * | | mod_component: Require 'from' attribute on stanzas by default | Matthew Wild | 2022-08-28 | 1 | -16/+13 | |
| | | | | | | | | | | | | | | | | | | | | | The old behaviour of falling back to the component domain when it is missing has been merged into the logic for the existing "validate_from_addresses" option (which is strict by default). ejabberd already rejects component stanzas with no 'from' (as the XEP requires), and this has led to compatibility issues for components that were seemingly working fine with Prosody. | |||||
| * | | mod_external_services: Update tools.ietf.org URL | Kim Alvefur | 2022-08-27 | 1 | -1/+1 | |
| | | | | | | | | | See bd9e006a7a74 | |||||
| * | | doap: Update for XEP-0215 advancement to Stable | Kim Alvefur | 2022-08-27 | 1 | -1/+1 | |
| | | | | | | | | | No other changes to account for. | |||||
| * | | core.usermanager: Link to docs for new role API to make warning more actionable | Kim Alvefur | 2022-08-27 | 1 | -0/+1 | |
| | | | ||||||
| * | | mod_smacks: Split resumption into multiple stages, to simplify ISR integration | Matthew Wild | 2022-08-26 | 1 | -63/+82 | |
| | | | | | | | | | | | This will allow us to return the success/failed as part of the SASL2 response, and *then* perform the stanza sync as a second step. | |||||
| * | | mod_s2s: Simplify conditionals since all sessions should have .host now | Kim Alvefur | 2022-08-26 | 2 | -3/+3 | |
| | | | ||||||
| * | | Merge 0.12->trunk | Kim Alvefur | 2022-08-26 | 1 | -2/+2 | |
| |\| | ||||||
| | * | mod_s2s: Fix firing buffer drain events | Kim Alvefur | 2022-08-26 | 1 | -2/+2 | |
| | | | | | | | | | | | Fixes the same kind of issue as in 65563530375b but once and for all, while improving similarity between incoming and outgoing connections. | |||||
| * | | mod_smacks: Don't close resuming session when failed due to overflow | Matthew Wild | 2022-08-26 | 1 | -7/+8 | |
| | | | ||||||
| * | | mod_smacks: Long overdue cleanup of resumption code, fixes some old TODOs | Matthew Wild | 2022-08-26 | 3 | -52/+66 | |
| | | | ||||||
| * | | mod_admin_shell: Rename variable to avoid confusion with global function | Kim Alvefur | 2022-08-25 | 1 | -7/+7 | |
| | | | | | | | | | For luacheck, but it doesn't actually complain about this right now | |||||
| * | | mod_admin_shell: Fix output from user:roles() | Kim Alvefur | 2022-08-25 | 1 | -0/+1 | |
| | | | | | | | | | | | It used _G.print instead of the shell session print, which would silently write to stdout | |||||
| * | | Merge role-auth->trunk | Matthew Wild | 2022-08-22 | 28 | -259/+837 | |
| |\ \ | ||||||
| | * | | CHANGES: Add role auth | Matthew Wild | 2022-08-22 | 1 | -0/+1 | |
| | | | | ||||||
| | * | | mod_admin_shell: Ensure account has role before it is usable | Kim Alvefur | 2022-08-18 | 1 | -8/+16 | |
| | | | | | | | | | | | | | | | | | | | | | | By creating the account first without a password it can't be used until the role has set. This is most important for restricted accounts, as a failure to set the role would lead to the account having more privileges than indented. | |||||
| | * | | mod_auth_insecure: Store creation and update timestamps on account | Kim Alvefur | 2022-08-18 | 1 | -1/+3 | |
| | | | | | | | | | | | | | | | | This ensures that the store is not empty in case no password is provided, so the underlying data storage won't consider the store empty. | |||||
| | * | | mod_admin_shell: Update help for user:create to reflect singular role argument | Kim Alvefur | 2022-08-18 | 1 | -1/+1 | |
| | | | | ||||||
| | * | | mod_auth_internal_hashed: Allow creating disabled account without password | Kim Alvefur | 2022-08-18 | 1 | -2/+2 | |
| | | | | | | | | | | | | | | | | Otherwise, create_user(username, nil) leads to the account being deleted. | |||||
| | * | | mod_admin_shell: Update with new role management commands and help text | Matthew Wild | 2022-08-18 | 1 | -39/+52 | |
| | | | | ||||||
| | * | | core.usermanager: Update argument name in authz fallback method | Kim Alvefur | 2022-08-18 | 1 | -1/+1 | |
| | | | | | | | | | | | | | It's not plural | |||||
| | * | | core.usermanager: Remove obsolete authz fallback method | Kim Alvefur | 2022-08-18 | 1 | -1/+0 | |
| | | | | ||||||
| | * | | core.usermanager: Add missing methods to fallback authz provider | Kim Alvefur | 2022-08-18 | 1 | -0/+3 | |
| | | | | ||||||
| | * | | core.usermanager: Add scoped luacheck ignore rule to reduce clutter | Kim Alvefur | 2022-08-18 | 1 | -11/+12 | |
| | | | | ||||||
| | * | | mod_authz_internal: Expose convenience method to test if user can assume role | Matthew Wild | 2022-08-18 | 2 | -0/+20 | |
| | | | | ||||||
 |
index : prosody.git | |
| unofficial mirror of the prosody mercurial project |
| aboutsummaryrefslogtreecommitdiffstats |