aboutsummaryrefslogtreecommitdiffstats
path: root/core
Commit message (Collapse)AuthorAgeFilesLines
* core.certmanager: Turn soft dependency on LuaSec into a hardKim Alvefur2022-02-101-13/+3
| | | | | | The default network backend server_epoll already requires LuaSec so Prosody won't even start without it, so we can get rid of these lines here too.
* core.certmanager: Relax certificate filename check #1713Kim Alvefur2022-02-141-8/+2
| | | | | After a survey of ACME clients it seems *.crt and *fullchain* should work for the majority. The rest get to manually copy their files.
* core.modulemanager: Save module metadata for potential later useKim Alvefur2022-02-051-1/+2
| | | | Makes it reachable from the shell if nothing else
* modulemanager: Shorten metadata keys to improve readability and memorabilityMatthew Wild2022-02-041-5/+5
|
* modulemanager: Add plugin load filter that reads module metadata from sourceMatthew Wild2022-02-041-0/+32
| | | | | | | | | | | | | | | | | | | | | Metadata in modules is added using lines formatted as: --% key: value Where key is a valid identifier string, and value is also a string (leading and trailing whitespace are trimmed during parsing). The initial supported keys are: --% requires_core_features: feature1, feature2, ... --% conflicts_core_features: feature1, feature2. ... These 'features' map to features reported by the new core.features module. A benefit of this load-time metadata approach compared to e.g. something like module:requires()/module:conflicts() is that we can continue to look in module search paths for a suitable module. Aborting an already-loaded module due to a version conflict would be too late.
* modulemanager, moduleapi: Switch to new pluginloader interfaceMatthew Wild2022-02-042-4/+9
|
* core.features: New module to track and expose the features supported by ProsodyMatthew Wild2022-02-041-0/+8
| | | | | A "feature" is a simple string, and it's expected that we will add to (and maybe remove from) this list over the course of time.
* core.loggingmanager: Add FIXME about supporting console logging to stderrKim Alvefur2022-02-021-0/+1
| | | | | Currently it is hard codded to be a specialized stdout logger, which should be fixed one day.
* core.certmanager: Use 'tls_profile' instead of 'tls_preset' to match ↵Kim Alvefur2022-01-181-3/+3
| | | | | | | | documentation Confusion! Thanks Martin
* core.certmanager: Apply TLS preset before global settings (thanks Menel)Kim Alvefur2022-01-181-1/+1
| | | | | | Allows overriding settings via the global 'ssl' settings as before. This order was probably accidental. That said, 'ssl' is a giant footgun we will want to discourage use of.
* core.certmanager: Disable DANE name checks (not needed for XMPP)Kim Alvefur2021-09-161-1/+1
| | | | | | | Pending https://github.com/brunoos/luasec/pull/179 Should not be done globally, but rather only for s2sout, but that would have to be in mod_tls then.
* core.modulemanager: Remove compat for mod_console rename in 0.8Kim Alvefur2022-01-051-7/+0
| | | | | Should no longer be needed, especially since mod_admin_telnet morphed into mod_admin_shell and mod_admin_socket
* core.certmanager: Add curveslist to 'old' Mozilla TLS presetKim Alvefur2021-12-261-1/+2
| | | | | | | Unsure if this was overlooked before or a recent addition. Reproduced the data from JSON file available. Would be nice to have a tool that does that.
* core.certmanager: Check index for wildcard certsKim Alvefur2021-12-221-1/+2
|
* prosodyctl cert: use the indexing functions for better UXJonas Schäfer2021-12-211-6/+14
| | | | | | These provide (a) a way to deal with random assortments of certs and (b) avoid unnecessary error messages and warnings, according to #1669 anyway, which this fixes.
* core.certmanager: Rename preset option to 'tls_preset'Kim Alvefur2021-12-221-1/+1
| | | | TLS good, SSL bad.
* core.certmanager: Add "legacy" preset for keeping previous default settingsKim Alvefur2021-12-221-1/+3
| | | | If anyone wants that.
* core.certmanager: Add TLS 1.3 cipher suites to Mozilla TLS presetsKim Alvefur2021-11-031-1/+7
|
* core.certmanager: Presets based on Mozilla SSL Configuration GeneratorKim Alvefur2019-12-221-0/+60
| | | | ssl_preset = "modern"
* moduleapi: Support stripping of multi-word from module namesMatthew Wild2021-12-221-1/+1
| | | | | | The goal is to allow module:provides("foo-bar") with a mod_foo_bar_ prefix being stripped. It will break any existing modules that use a prefix and have hyphens instead of underscores. No such modules are known.
* configmanager: Update error message to say 'VirtualHost' instead of 'Host'Matthew Wild2021-12-201-1/+1
|
* core.modulemanager: Load mod_smacks on ComponentsKim Alvefur2021-12-201-0/+1
| | | | Since it applies to s2s on Components as well as on VirtualHosts.
* core.usermanager: Implement noop role writes on global authz providerKim Alvefur2021-12-061-0/+2
| | | | So that the methods are there and don't cause an error.
* mod_cron: Add a 'weekly' job frequencyKim Alvefur2021-12-031-0/+5
|
* core.moduleapi: Add API for adding daily or hourly tasks via mod_cronKim Alvefur2021-11-211-0/+15
|
* mod_admin_shell: List collected metrics in module:infoKim Alvefur2021-11-241-0/+2
| | | | Lets you know what to look for with stats:show()
* core.moduleapi: Fix name of renamed API in log messageKim Alvefur2021-11-181-1/+1
| | | | | | | hook_stanza was renamed hook_tag in 2012 in 2087d42f1e77 Why do we still have hook_stanza? Why is this only a warning anyway?
* s2smanager: Fire s2s-destroyed event to mirror s2s-createdMatthew Wild2021-11-121-0/+1
| | | | | | | | | | | | The existing events do not fire for unauthed sessions, for example (because the type does not match). I deemed changing their behaviour too risky, and the current behaviour may even be more desirable for some uses. This means we now have roughly paired events: - s2s-created -> s2s-destroyed (global only) - s2sin-established -> s2sin-destroyed (global + host) - s2sout-established -> s2sout-destroyed (global + host)
* usermanager: Fire user-roles-changed event when updating roles of a local userMatthew Wild2021-11-121-1/+7
|
* core.moduleapi: Ensure module:send_iq() handler priority over mod_iqKim Alvefur2021-09-241-2/+2
| | | | | | To prevent a situation where you for whatever reason use a full JID that is currently online and the response ends up routed there instead of the module:send_iq() handlers.
* core.moduleapi: Enable full JID origin queries with module:send_iq()Kim Alvefur2021-09-241-2/+11
| | | | | Since we don't currently have hooks that includes type and id here, we need to check those attributes in the handlers.
* core.moduleapi: Filter out unrelated direct replies to module:send_iqKim Alvefur2021-09-241-1/+4
| | | | | | | | | | | This is primarily something that happens with an internal query to mod_mam, which calls origin.send() several times with results, leading to the first such result being treated as the final response and resolving the promise. Now, these responses pass trough to the underlying origin.send(), where they can be caught. Tricky but not impossible. For remote queries, it's even trickier, you would likely need to bind a resource or similar.
* usermanager, mod_authz_internal: Add methods to fetch users/JIDs of given roleMatthew Wild2021-08-261-0/+24
|
* core.certmanager: Support 'use_dane' setting to enable DANE supportKim Alvefur2021-07-181-0/+2
| | | | | | Removes the need to enable DANE with two separate settings. Previously you had to also set `ssl = { dane = true }` to activate DANE support in LuaSec and OpenSSL.
* core.loggingmanager: Disable pretty printing when not connected to a ttyKim Alvefur2021-07-041-1/+1
| | | | Things can behave unexpectedly when fed ANSI escape codes.
* core.loggingmanager: Pretty-print logged XML snippets in consoleKim Alvefur2021-06-291-3/+7
| | | | | This replaces an earlier method in a private extension that logged pretty-printed XML, which broke due to the escaping added in util.format
* core.loggingmanager: Support passing log messages trough a filterKim Alvefur2021-06-291-2/+5
| | | | This will be used by the console logger for pretty printing.
* core.stanza_router: Rename variable to be more specificKim Alvefur2021-06-251-3/+3
|
* core.portmanager: Also reload per-SNI certificatesKim Alvefur2021-06-101-1/+3
|
* core.portmanager: Reload direct TLS certificates after config reloadKim Alvefur2021-06-101-0/+21
| | | | | This should re-create all contexts the same way as when the service was activated, which reloads certificates.
* core.portmanager: Factor out base TLS context creation for reuseKim Alvefur2021-06-101-10/+15
| | | | Thinking I can use this to reload certificates after config reload
* core.certmanager: Skip service certificate lookup for https clientKim Alvefur2021-05-271-1/+2
| | | | | | Quick Fix\u{2122} to stop prevent certmanager from automatically adding a client certificate for net.http.request, since this normally does not require such.
* core.portmanager: Fix race condition in initialization of SNI cert mapKim Alvefur2021-05-281-2/+2
| | | | | | | | | | | | | | | | | Under some circumstances when hosts and modules are loaded in some certain order, entries end up missing from the SNI map. This manifests in e.g. `curl https://localhost:5281/` giving an error about "unrecognized name". The `service` argument is `nil` when invoked from the "host-activated" event, leading it to iterating over every service. And then it would not be fetching e.g. `http_host` from the config, which explains why https would sometimes not work due to the missing name entry. Because when `service` is included, this limits the iteration to matching entries, while also returning the same value as the `name` loop variable. Because `name == service when service != nil` we can use name instead in the body of the loop.
* core.modulemanager: Inherit mod_server_contact_info onto components #1270Kim Alvefur2021-05-271-0/+1
|
* statsmanager: remove "legacy" wordingJonas Schäfer2021-05-201-1/+1
| | | | | | | This was a leftover from when we (or rather I) thought that the old (now called "high-level") API would be removed. We deemed it useful though, so let's remove that "legacy" language and make the description more friendly.
* Merge 0.11->trunkMatthew Wild2021-05-131-9/+12
|\
| * certmanager: Disable renegotiation by defaultMatthew Wild2021-05-111-0/+2
| | | | | | | | This requires LuaSec 0.7+ and OpenSSL 1.1.1+
| * core.certmanager: Test for SSL options in absence of LuaSec configKim Alvefur2021-04-261-5/+9
| |
| * core.certmanager: Attempt to directly access LuaSec config tableKim Alvefur2021-04-261-1/+1
| | | | | | | | | | Due to a bug this field was not properly exported before See https://github.com/brunoos/luasec/issues/149
| * core.certmanager: Move EECDH ciphers before EDH in default cipherstring ↵Kim Alvefur2019-08-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (fixes #1513) Backport of 94e341dee51c The original intent of having kEDH before kEECDH was that if a `dhparam` file was specified, this would be interpreted as a preference by the admin for old and well-tested Diffie-Hellman key agreement over newer elliptic curve ones. Otherwise the faster elliptic curve ciphersuites would be preferred. This didn't really work as intended since this affects the ClientHello on outgoing s2s connections, leading to some servers using poorly configured kEDH. With Debian shipping OpenSSL settings that enforce a higher security level, this caused interoperability problems with servers that use DH params smaller than 2048 bits. E.g. jabber.org at the time of this writing has 1024 bit DH params. MattJ says > Curves have won, and OpenSSL is less weird about them now
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-18 08:32:35 +0000