aboutsummaryrefslogtreecommitdiffstats
path: root/core
Commit message (Collapse)AuthorAgeFilesLines
* core.stanza_router: Rename variable to be more specificKim Alvefur2021-06-251-3/+3
|
* core.portmanager: Also reload per-SNI certificatesKim Alvefur2021-06-101-1/+3
|
* core.portmanager: Reload direct TLS certificates after config reloadKim Alvefur2021-06-101-0/+21
| | | | | This should re-create all contexts the same way as when the service was activated, which reloads certificates.
* core.portmanager: Factor out base TLS context creation for reuseKim Alvefur2021-06-101-10/+15
| | | | Thinking I can use this to reload certificates after config reload
* core.certmanager: Skip service certificate lookup for https clientKim Alvefur2021-05-271-1/+2
| | | | | | Quick Fix\u{2122} to stop prevent certmanager from automatically adding a client certificate for net.http.request, since this normally does not require such.
* core.portmanager: Fix race condition in initialization of SNI cert mapKim Alvefur2021-05-281-2/+2
| | | | | | | | | | | | | | | | | Under some circumstances when hosts and modules are loaded in some certain order, entries end up missing from the SNI map. This manifests in e.g. `curl https://localhost:5281/` giving an error about "unrecognized name". The `service` argument is `nil` when invoked from the "host-activated" event, leading it to iterating over every service. And then it would not be fetching e.g. `http_host` from the config, which explains why https would sometimes not work due to the missing name entry. Because when `service` is included, this limits the iteration to matching entries, while also returning the same value as the `name` loop variable. Because `name == service when service != nil` we can use name instead in the body of the loop.
* core.modulemanager: Inherit mod_server_contact_info onto components #1270Kim Alvefur2021-05-271-0/+1
|
* statsmanager: remove "legacy" wordingJonas Schäfer2021-05-201-1/+1
| | | | | | | This was a leftover from when we (or rather I) thought that the old (now called "high-level") API would be removed. We deemed it useful though, so let's remove that "legacy" language and make the description more friendly.
* Merge 0.11->trunkMatthew Wild2021-05-131-9/+12
|\
| * certmanager: Disable renegotiation by defaultMatthew Wild2021-05-111-0/+2
| | | | | | | | This requires LuaSec 0.7+ and OpenSSL 1.1.1+
| * core.certmanager: Test for SSL options in absence of LuaSec configKim Alvefur2021-04-261-5/+9
| |
| * core.certmanager: Attempt to directly access LuaSec config tableKim Alvefur2021-04-261-1/+1
| | | | | | | | | | Due to a bug this field was not properly exported before See https://github.com/brunoos/luasec/issues/149
| * core.certmanager: Move EECDH ciphers before EDH in default cipherstring ↵Kim Alvefur2019-08-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (fixes #1513) Backport of 94e341dee51c The original intent of having kEDH before kEECDH was that if a `dhparam` file was specified, this would be interpreted as a preference by the admin for old and well-tested Diffie-Hellman key agreement over newer elliptic curve ones. Otherwise the faster elliptic curve ciphersuites would be preferred. This didn't really work as intended since this affects the ClientHello on outgoing s2s connections, leading to some servers using poorly configured kEDH. With Debian shipping OpenSSL settings that enforce a higher security level, this caused interoperability problems with servers that use DH params smaller than 2048 bits. E.g. jabber.org at the time of this writing has 1024 bit DH params. MattJ says > Curves have won, and OpenSSL is less weird about them now
* | core.certmanager: Catch error from lfsKim Alvefur2021-05-071-1/+11
| | | | | | | | | | | | | | lfs.dir() throws a hard error if there's a problem, e.g. no such directory or permission issues. This also gets called early enough that the main loop error protection hasn't been brought up yet, causing a proper crash.
* | core.certmanager: Resolve certs path relative to config dirKim Alvefur2021-05-071-3/+3
| | | | | | | | | | | | | | | | | | Otherwise the default "certs" would be relative to $PWD, which works when testing from a source checkout, but not on installed systems where it usually points to the data directory. Also, the LuaFileSystem dir() iterator throws a hard error, which may cause a crash or other problems.
* | core.portmanager: Use existing http_host for https SNI mappingKim Alvefur2021-05-051-0/+4
| |
* | core.portmanager: Allow overriding expected SNI name per serviceKim Alvefur2021-05-051-2/+3
| | | | | | | | | | | | | | E.g. VirtualHost"example.com" https_name = "xmpp.example.com"
* | core.certmanager: Skip directly to guessing of key from cert filenameKim Alvefur2021-05-051-2/+17
| | | | | | | | Cuts down on a ton of debug logs
* | core.certmanager: Join paths with OS-aware util.paths functionKim Alvefur2021-05-051-2/+3
| | | | | | | | Right thing to do, rather than hardcoding '/'
* | core.certmanager: Build an index over certificatesKim Alvefur2021-04-101-0/+79
| |
* | core.certmanager: Check for complete filenameKim Alvefur2021-04-101-1/+1
| | | | | | | | Prevents a false positive match on files with fullchain.pem as suffix
* | Statistics: Rewrite statistics backends to use OpenMetricsJonas Schäfer2021-04-182-47/+202
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The metric subsystem of Prosody has had some shortcomings from the perspective of the current state-of-the-art in metric observability. The OpenMetrics standard [0] is a formalization of the data model (and serialization format) of the well-known and widely-used Prometheus [1] software stack. The previous stats subsystem of Prosody did not map well to that format (see e.g. [2] and [3]); the key reason is that it was trying to do too much math on its own ([2]) while lacking first-class support for "families" of metrics ([3]) and structured metric metadata (despite the `extra` argument to metrics, there was no standard way of representing common things like "tags" or "labels"). Even though OpenMetrics has grown from the Prometheus world of monitoring, it maps well to other popular monitoring stacks such as: - InfluxDB (labels can be mapped to tags and fields as necessary) - Carbon/Graphite (labels can be attached to the metric name with dot-separation) - StatsD (see graphite when assuming that graphite is used as backend, which is the default) The util.statsd module has been ported to use the OpenMetrics model as a proof of concept. An implementation which exposes the util.statistics backend data as Prometheus metrics is ready for publishing in prosody-modules (most likely as mod_openmetrics_prometheus to avoid breaking existing 0.11 deployments). At the same time, the previous measure()-based API had one major advantage: It is really simple and easy to use without requiring lots of knowledge about OpenMetrics or similar concepts. For that reason as well as compatibility with existing code, it is preserved and may even be extended in the future. However, code relying on the `stats-updated` event as well as `get_stats` from `statsmanager` will break because the data model has changed completely; in case of `stats-updated`, the code will simply not run (as the event was renamed in order to avoid conflicts); the `get_stats` function has been removed completely (so it will cause a traceback when it is attempted to be used). Note that the measure_*_event methods have been removed from the module API. I was unable to find any uses or documentation and thus deemed they should not be ported. Re-implementation is possible when necessary. [0]: https://openmetrics.io/ [1]: https://prometheus.io/ [2]: #959 [3]: #960
* | core.sessionmanager: Add a dummy rawsend() method to resting sessionsKim Alvefur2021-04-151-0/+1
| | | | | | | | | | | | | | Should fix a traceback on attempted use after destruction, in case where opportunistic_writes was in use. Thanks Ge0rG
* | core.statsmanager: Allow special "manual" value for statistics_intervalKim Alvefur2021-04-061-6/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | When set, no periodic statistics collection is done by core.statsmanager, instead some module is expected to call collect() when it suits. Obviously only one such module should be enabled. Quoth jonas’ > correct way is to scrape the internal sources on each call to /metrics > in the context of Prometheus "manual" as opposed to "automatic", from the point of view of statsmanager.
* | core.statsmanager: Cover util.statistics work in processing measurementKim Alvefur2021-04-061-1/+1
| | | | | | | | | | | | | | | | | | Zash> Btw, this conditional and loop, shouldn't it be covered by the timing measurement? Zash> Isn't that where all the util.statistics work is done? MattJ> Yeah, it should Zash> ("the", but there's two ... which one‽) MattJ> Yeah... not sure :) MattJ> Processing I guess
* | core.hostmanager: Remove obsolete clearing of srv_hostsKim Alvefur2021-04-061-1/+0
| | | | | | | | Gone with s2sout.lib in 756b8821007a
* | usermanager: expose set_roles through APIJonas Schäfer2021-03-221-0/+18
| |
* | core.s2smanager: Set "direction" on destroyed sessions (fixes #1641)Kim Alvefur2021-03-031-0/+1
| | | | | | | | | | | | | | | | Should prevent errors in certain places where it logs session.direction captialized using gsub. Might cause bugs tho, but then the session is destroyed so maybe it doesn't matter?
* | core.portmanager: Log SNI hosts, services looked forKim Alvefur2021-03-021-0/+1
| | | | | | | | To highlight how many these are
* | core.certmanager: Add comments explaining the 'verifyext' TLS settingsKim Alvefur2021-02-061-1/+4
| | | | | | | | | | | | | | Thanks to debacle for reminding me, in the context of mod_auth_ccert I wonder if we still need lsec_ignore_purpose, Let's Encrypt seems to include both client and server purposes in certs.
* | core.modulemanager: Fix resource location compat with LuaRocks 2.xKim Alvefur2021-01-161-1/+1
| | | | | | | | | | The path doesn't include lua version, at least least on Debian, which still has luarocks 2.x
* | core.modulemanager: Fix error if installer path missingKim Alvefur2020-10-111-1/+1
| | | | | | | | | | Happens if run outside prosody. Noticed because because the storage tests fail.
* | core.moduleapi: Return resource path from module:get_directory() (API BC)Kim Alvefur2020-10-091-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | :get_directory has so far returned the base directory of the current module source code. This has worked well so far to load resources which tend to be included in the same directory, but with the plugin installer using LuaRocks, extra resources (e.g. templates and other assets) these are saved in a completely different directory. In be73df6765b9 core.modulemanager gained some code for finding that directory and saving it in module.resource_path but now the question is how this should be reflected in the API. A survey of community modules suggest the vast majority use the :get_directory method for locating templates and other assets, rather than the code (which would use module:require instead). Therefore this commit changes :get_directory to return the resource_path when available. This should work for most modules.
* | core.modulemanager: Add compat for LuaRocks 2.xKim Alvefur2020-10-071-0/+7
| |
* | core.moduleapi: Use resource path for :load_resource()Kim Alvefur2020-10-071-1/+1
| |
* | core.modulemanager: Locate resources of LuaRocks-installed modulesKim Alvefur2020-10-071-0/+31
| | | | | | | | | | | | | | Extra non-code files included with a `copy_directories` directive in a LuaRocks manifest will be copied into a per-module and per-version directory under /lib/luarocks/ and all this is there to dig that out so it can be used in e.g. moduleapi :load_resource().
* | core.certmanager: Add TODO about LuaSec issueKim Alvefur2020-06-071-0/+3
| |
* | core.moduleapi: Allow passing a config table trough :measureKim Alvefur2019-01-041-2/+2
| |
* | core.statsmanager: Allow passing a config table trough measureKim Alvefur2019-01-041-2/+2
| |
* | Merge 0.11->trunkKim Alvefur2020-04-101-6/+8
|\|
| * core.certmanager: Look for privkey.pem to go with fullchain.pem (fix #1526)Kim Alvefur2020-04-101-6/+8
| | | | | | | | | | | | | | This makes `prosodyctl cert import example.com /path/to/example.com/fullchain.pem` work. This was never intended to, yet users commonly tried this and got problems.
| * core.rostermanager: Cache rosters of offline users for faster access (fixes ↵Kim Alvefur2018-12-161-0/+22
| | | | | | | | | | | | #1233) (grafted from 42a3e3a2824822cef7640ac56d182c59bdd4224e)
* | moduleapi: Rename argument to silence luacheckKim Alvefur2020-04-011-2/+2
| |
* | moduleapi: Fix handling of replies to :send_iq from internal modulesKim Alvefur2020-03-221-1/+10
| | | | | | | | | | Unclear exactly why, but replies to some queries to local modules would be discarded by stanza_router. This appears to fix it.
* | usermanager: Fix traceback when checking admin status of host-only JIDs ↵Matthew Wild2020-03-191-1/+1
| | | | | | | | (fixes #1508)
* | storagemanager, mod_storage_sql: Rename methods to :get_all() and :delete_all()Matthew Wild2020-03-111-4/+4
| |
* | storagemanager: Add support for :find_key() and :delete_key() to map store shimMatthew Wild2020-03-111-0/+33
| |
* | usermanager, mod_authz_*: Merge mod_authz_config and mod_authz_internal into ↵Matthew Wild2020-02-231-1/+1
| | | | | | | | the latter
* | stanza_router: only fire pre-stanza if firing other preevents (e.g. for c2s ↵Matthew Wild2020-02-051-6/+6
| | | | | | | | sessions)
* | sessionmanager: Support passing an auth scope to make_authenticatedMatthew Wild2020-02-051-1/+2
| |
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-22 04:57:25 +0000