aboutsummaryrefslogtreecommitdiffstats
path: root/core
Commit message (Collapse)AuthorAgeFilesLines
* core.usermanager: Add missing methods to fallback authz providerKim Alvefur2022-08-181-0/+3
|
* core.usermanager: Add scoped luacheck ignore rule to reduce clutterKim Alvefur2022-08-181-11/+12
|
* mod_authz_internal: Expose convenience method to test if user can assume roleMatthew Wild2022-08-181-0/+8
|
* mod_authz_internal, and more: New iteration of role APIMatthew Wild2022-08-173-21/+52
| | | | | | | | | | | These changes to the API (hopefully the last) introduce a cleaner separation between the user's primary (default) role, and their secondary (optional) roles. To keep the code sane and reduce complexity, a data migration is needed for people using stored roles in 0.12. This can be performed with prosodyctl mod_authz_internal migrate <host>
* usermanager: Add back temporary is_admin to warn about deprecated API usageMatthew Wild2022-08-151-0/+19
| | | | | | | | | | | | | | | | | | | | | | | | Goal: Introduce role-auth with minimal disruption is_admin() is unsafe in a system with per-session permissions, so it has been deprecated. Roll-out approach: 1) First, log a warning when is_admin() is used. It should continue to function normally, backed by the new role API. Nothing is really using per-session authz yet, so there is minimal security concern. The 'strict_deprecate_is_admin' global setting can be set to 'true' to force a hard failure of is_admin() attempts (it will log an error and always return false). 2) In some time (at least 1 week), but possibly longer depending on the number of affected deployments: switch 'strict_deprecate_is_admin' to 'true' by default. It can still be disabled for systems that need it. 3) Further in the future, before the next release, the option will be removed and is_admin() will be permanently disabled.
* usermanager: Remove concept of global authz providerMatthew Wild2022-08-121-46/+12
| | | | | | | | | | | | | | | Rationale: - Removes a bunch of code! - We don't have many cases where an actor is not bound to one of our hosts - A notable exception is the admin shell, but if we ever attempt to lock those sessions down, there is a load of other work that also has to be done. And it's not clear if we would need a global authz provider for that anyway. - Removes an extra edge case from the necessary mental model for operators - Sessions that aren't bound to a host generally are anonymous or have an alternative auth model (such as by IP addres). - With the encapsulation now provided by util.roles, ad-hoc "detached roles" can still be created anyway by code that needs them.
* usermanager: Fix method name of global authz provider (thanks Zash)Matthew Wild2022-08-121-1/+1
|
* usermanager: Remove obsolete function from global authz providerMatthew Wild2022-08-111-5/+0
|
* features: Add "permissions" feature for role-authMatthew Wild2022-08-111-0/+2
|
* usermanager: Handle local JIDs being passed to get/set_jid_role()Matthew Wild2022-08-011-1/+9
| | | | | There is no reasonable fallback for set_jid_role() because users may have multiple roles, so that's an error.
* core.usermanager: Add missing stub authz methods to global authz providerKim Alvefur2022-07-201-0/+7
| | | | Except, should we have a global authz provider at all?
* moduleapi: Stricter type check for actor in permission checkKim Alvefur2022-07-201-1/+1
| | | | | Non-table but truthy values would trigger "attempt to index a foo value" on the next line otherwise
* moduleapi: Remove redundant expansion of ':' prefix in permission namesKim Alvefur2022-07-201-1/+0
|
* moduleapi: Distribute permissions set from global modules to all hostsKim Alvefur2022-07-201-0/+8
| | | | | | Roles and permissions will always happen in the context of a host. Prevents error upon indexing since `hosts["*"] == nil`
* mod_authz_internal: Use util.roles, some API changes and config supportMatthew Wild2022-07-192-32/+50
| | | | | | | | | | | | | | | | This commit was too awkward to split (hg record didn't like it), so: - Switch to the new util.roles lib to provide a consistent representation of a role object. - Change API method from get_role_info() to get_role_by_name() (touches sessionmanager and usermanager) - Change get_roles() to get_user_roles(), take a username instead of a JID This is more consistent with all other usermanager API methods. - Support configuration of custom roles and permissions via the config file (to be documented).
* usermanager, mod_auth_*: Add get_account_info() returning creation/update timeMatthew Wild2022-07-121-0/+7
| | | | | | | This is useful for a number of things. For example, listing users that need to rotate their passwords after some event. It also provides a safer way for code to determine that a user password has changed without needing to set a handler for the password change event (which is a more fragile approach).
* core.moduleapi: Expand permission name ':' prefix earlierKim Alvefur2022-06-151-3/+3
| | | | | | Ensures it applies to the context as string case Somehow this fixes everything
* core.moduleapi: Fixup method nameKim Alvefur2022-06-151-1/+1
| | | | | | `get_user_role()` did not exist anywhere else. MattJ said `get_user_default_role()` was indented
* Switch to a new role-based authorization framework, removing is_admin()Matthew Wild2022-06-153-9/+75
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We began moving away from simple "is this user an admin?" permission checks before 0.12, with the introduction of mod_authz_internal and the ability to dynamically change the roles of individual users. The approach in 0.12 still had various limitations however, and apart from the introduction of roles other than "admin" and the ability to pull that info from storage, not much actually changed. This new framework shakes things up a lot, though aims to maintain the same functionality and behaviour on the surface for a default Prosody configuration. That is, if you don't take advantage of any of the new features, you shouldn't notice any change. The biggest change visible to developers is that usermanager.is_admin() (and the auth provider is_admin() method) have been removed. Gone. Completely. Permission checks should now be performed using a new module API method: module:may(action_name, context) This method accepts an action name, followed by either a JID (string) or (preferably) a table containing 'origin'/'session' and 'stanza' fields (e.g. the standard object passed to most events). It will return true if the action should be permitted, or false/nil otherwise. Modules should no longer perform permission checks based on the role name. E.g. a lot of code previously checked if the user's role was prosody:admin before permitting some action. Since many roles might now exist with similar permissions, and the permissions of prosody:admin may be redefined dynamically, it is no longer suitable to use this method for permission checks. Use module:may(). If you start an action name with ':' (recommended) then the current module's name will automatically be used as a prefix. To define a new permission, use the new module API: module:default_permission(role_name, action_name) module:default_permissions(role_name, { action_name[, action_name...] }) This grants the specified role permission to execute the named action(s) by default. This may be overridden via other mechanisms external to your module. The built-in roles that developers should use are: - prosody:user (normal user) - prosody:admin (host admin) - prosody:operator (global admin) The new prosody:operator role is intended for server-wide actions (such as shutting down Prosody). Finally, all usage of is_admin() in modules has been fixed by this commit. Some of these changes were trickier than others, but no change is expected to break existing deployments. EXCEPT: mod_auth_ldap no longer supports the ldap_admin_filter option. It's very possible nobody is using this, but if someone is then we can later update it to pull roles from LDAP somehow.
* compat: Use table.pack (there since Lua 5.2) over our util.tableKim Alvefur2022-07-111-1/+1
| | | | | Added in d278a770eddc avoid having to deal with its absence in Lua 5.1. No longer needed when Lua 5.1 support is dropped.
* compat: Remove handling of Lua 5.1 location of 'unpack' functionKim Alvefur2022-07-111-1/+1
|
* Merge 0.12->trunkKim Alvefur2022-07-111-1/+1
|\
| * core.s2smanager: Don't remove unrelated session on close of bidi sessionKim Alvefur2022-06-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Normally with bidi, any outgoing connection should be the same as the incoming, hence when closing a bidi connection it should be removed as a route to the remote server. However it is not guaranteed, a remote bidi-capable server might have decided to open a new connection for some reason. This can lead to a situation where there are two bidi connections, and the s2sout route is a locally initiated s2sout connection. In this case, such a s2sout connection should be kept. Noticed in a rare case where bidi has just been enabled on a running server, and something establishes new connections immediately when a connection is closed.
* | core.configmanager: Remove COMPAT for old config format from 2013Kim Alvefur2022-05-291-12/+3
| |
* | Merge 0.12->trunkKim Alvefur2022-05-161-2/+2
|\|
| * core.certmanager: Expand debug messages about cert lookups in indexKim Alvefur2022-05-161-2/+2
| | | | | | | | | | | | Answers my recurring question of > Using cert "certs/example.com.crt" from index ... for what?
* | Merge 0.12->trunkKim Alvefur2022-04-271-1/+1
|\|
| * core.moduleapi: Fix 'global' property via :context() - #1748Kim Alvefur2022-04-271-1/+1
| | | | | | | | | | | | | | | | | | | | The 'global' property should reflect whether the module API instance represents the global context or a VirtualHost or Component context. However the module:context() method did not override this, leading the property of the previous module shining trough, leading to bugs in code relying on the 'global' property. See also #1736
* | net: refactor sslconfig to not depend on LuaSecJonas Schäfer2022-04-021-1/+1
| | | | | | | | | | | | | | | | | | | | | | This now requires that the network backend exposes a tls_builder function, which essentially wraps the former util.sslconfig.new() function, passing a factory to create the eventual SSL context. That allows a net.server backend to pick whatever it likes as SSL context factory, as long as it understands the config table passed by the SSL config builder. Heck, a backend could even mock and replace the entire SSL config builder API.
* | net: isolate LuaSec-specificsJonas Schäfer2022-04-272-43/+12
|/ | | | | | | | | | | | | | For this, various accessor functions are now provided directly on the sockets, which reach down into the LuaSec implementation to obtain the information. While this may seem of little gain at first, it hides the implementation detail of the LuaSec+LuaSocket combination that the actual socket and the TLS layer are separate objects. The net gain here is that an alternative implementation does not have to emulate that specific implementation detail and "only" has to expose LuaSec-compatible data structures on the new functions.
* core.modulemanager: Fix global flag on per-host instances of shared modules ↵Kim Alvefur2022-04-041-0/+1
| | | | | | | | | (fix #1736) This flag is something of a shortcut for `module.host == "*"` and should always be equal to that. Its absence on the proxy object made the property of the global module instance visible, causing problems such as with URL reporting in mod_http
* configmanager: Clearer errors when providing unexpected values after ↵Matthew Wild2022-04-031-0/+5
| | | | VirtualHost (fixes #1735, thanks arawaks)
* configmanager: Add method to report loaded config files (part of #1729 fix)Matthew Wild2022-03-281-0/+7
|
* Spelling: Fix various spelling mistakes (thanks timeless)Kim Alvefur2022-03-071-1/+1
| | | | | | Words, sometimes I wonder how they even work Maybe I missed something.
* Merge config-updates+check-turn from timberMatthew Wild2022-03-042-14/+4
|\
| * usermanager, mod_saslauth: Default to internal_hashed if no auth module ↵Matthew Wild2022-02-101-1/+1
| | | | | | | | | | | | | | | | | | | | specified The default config was updated in this way long ago, but if no option was present in the config, Prosody would load internal_plain. This change can result in changes (for the better) for people using very old configuration files lacking an 'authentication' setting.
| * core.certmanager: Turn soft dependency on LuaSec into a hardKim Alvefur2022-02-101-13/+3
| | | | | | | | | | | | The default network backend server_epoll already requires LuaSec so Prosody won't even start without it, so we can get rid of these lines here too.
* | core.portmanager: Fix traceback on attempt to get non-existent serviceKim Alvefur2022-02-221-1/+3
| | | | | | | | | | If there's no such interface:port then `data` is nil and `data.service` errors.
* | core.certmanager: Ensure key exists for fullchainKim Alvefur2022-02-211-1/+1
|/ | | | | | | | | | Since 5cd075ed4fd3 any file matching "fullchain" would be considered for use. Dehydrated stores fullchain certs in e.g, fullchain-1641171024.pem and a symlink fullchain.pem pointing at the latest one. However the current rule for finding a corresponding private key would try privkey-1641171024.pem in the same directory, which may not exist.
* core.certmanager: Relax certificate filename check #1713Kim Alvefur2022-02-141-8/+2
| | | | | After a survey of ACME clients it seems *.crt and *fullchain* should work for the majority. The rest get to manually copy their files.
* core.modulemanager: Save module metadata for potential later useKim Alvefur2022-02-051-1/+2
| | | | Makes it reachable from the shell if nothing else
* modulemanager: Shorten metadata keys to improve readability and memorabilityMatthew Wild2022-02-041-5/+5
|
* modulemanager: Add plugin load filter that reads module metadata from sourceMatthew Wild2022-02-041-0/+32
| | | | | | | | | | | | | | | | | | | | | Metadata in modules is added using lines formatted as: --% key: value Where key is a valid identifier string, and value is also a string (leading and trailing whitespace are trimmed during parsing). The initial supported keys are: --% requires_core_features: feature1, feature2, ... --% conflicts_core_features: feature1, feature2. ... These 'features' map to features reported by the new core.features module. A benefit of this load-time metadata approach compared to e.g. something like module:requires()/module:conflicts() is that we can continue to look in module search paths for a suitable module. Aborting an already-loaded module due to a version conflict would be too late.
* modulemanager, moduleapi: Switch to new pluginloader interfaceMatthew Wild2022-02-042-4/+9
|
* core.features: New module to track and expose the features supported by ProsodyMatthew Wild2022-02-041-0/+8
| | | | | A "feature" is a simple string, and it's expected that we will add to (and maybe remove from) this list over the course of time.
* core.loggingmanager: Add FIXME about supporting console logging to stderrKim Alvefur2022-02-021-0/+1
| | | | | Currently it is hard codded to be a specialized stdout logger, which should be fixed one day.
* core.certmanager: Use 'tls_profile' instead of 'tls_preset' to match ↵Kim Alvefur2022-01-181-3/+3
| | | | | | | | documentation Confusion! Thanks Martin
* core.certmanager: Apply TLS preset before global settings (thanks Menel)Kim Alvefur2022-01-181-1/+1
| | | | | | Allows overriding settings via the global 'ssl' settings as before. This order was probably accidental. That said, 'ssl' is a giant footgun we will want to discourage use of.
* core.certmanager: Disable DANE name checks (not needed for XMPP)Kim Alvefur2021-09-161-1/+1
| | | | | | | Pending https://github.com/brunoos/luasec/pull/179 Should not be done globally, but rather only for s2sout, but that would have to be in mod_tls then.
* core.modulemanager: Remove compat for mod_console rename in 0.8Kim Alvefur2022-01-051-7/+0
| | | | | Should no longer be needed, especially since mod_admin_telnet morphed into mod_admin_shell and mod_admin_socket
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-10 18:31:32 +0000