| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
| |
This will be used by the console logger for pretty printing.
|
| | |
|
| | |
|
| |
|
|
|
| |
This should re-create all contexts the same way as when the service was
activated, which reloads certificates.
|
| |
|
|
| |
Thinking I can use this to reload certificates after config reload
|
| |
|
|
|
|
| |
Quick Fix\u{2122} to stop prevent certmanager from automatically adding
a client certificate for net.http.request, since this normally does not
require such.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Under some circumstances when hosts and modules are loaded in some
certain order, entries end up missing from the SNI map. This manifests
in e.g. `curl https://localhost:5281/` giving an error about
"unrecognized name".
The `service` argument is `nil` when invoked from the "host-activated"
event, leading it to iterating over every service. And then it would not
be fetching e.g. `http_host` from the config, which explains why https
would sometimes not work due to the missing name entry.
Because when `service` is included, this limits the iteration to
matching entries, while also returning the same value as the `name` loop
variable. Because `name == service when service != nil` we can use name
instead in the body of the loop.
|
| | |
|
| |
|
|
|
|
|
| |
This was a leftover from when we (or rather I) thought that the
old (now called "high-level") API would be removed. We deemed it
useful though, so let's remove that "legacy" language and make
the description more friendly.
|
| |\ |
|
| | |
| |
| |
| | |
This requires LuaSec 0.7+ and OpenSSL 1.1.1+
|
| | | |
|
| | |
| |
| |
| |
| | |
Due to a bug this field was not properly exported before
See https://github.com/brunoos/luasec/issues/149
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
(fixes #1513)
Backport of 94e341dee51c
The original intent of having kEDH before kEECDH was that if a `dhparam`
file was specified, this would be interpreted as a preference by the
admin for old and well-tested Diffie-Hellman key agreement over newer
elliptic curve ones. Otherwise the faster elliptic curve ciphersuites
would be preferred. This didn't really work as intended since this
affects the ClientHello on outgoing s2s connections, leading to some
servers using poorly configured kEDH.
With Debian shipping OpenSSL settings that enforce a higher security
level, this caused interoperability problems with servers that use DH
params smaller than 2048 bits. E.g. jabber.org at the time of this
writing has 1024 bit DH params.
MattJ says
> Curves have won, and OpenSSL is less weird about them now
|
| | |
| |
| |
| |
| |
| |
| | |
lfs.dir() throws a hard error if there's a problem, e.g. no such
directory or permission issues. This also gets called early enough that
the main loop error protection hasn't been brought up yet, causing a
proper crash.
|
| | |
| |
| |
| |
| |
| |
| |
| |
| | |
Otherwise the default "certs" would be relative to $PWD, which works
when testing from a source checkout, but not on installed systems where
it usually points to the data directory.
Also, the LuaFileSystem dir() iterator throws a hard error, which may
cause a crash or other problems.
|
| | | |
|
| | |
| |
| |
| |
| |
| |
| | |
E.g.
VirtualHost"example.com"
https_name = "xmpp.example.com"
|
| | |
| |
| |
| | |
Cuts down on a ton of debug logs
|
| | |
| |
| |
| | |
Right thing to do, rather than hardcoding '/'
|
| | | |
|
| | |
| |
| |
| | |
Prevents a false positive match on files with fullchain.pem as suffix
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
The metric subsystem of Prosody has had some shortcomings from
the perspective of the current state-of-the-art in metric
observability.
The OpenMetrics standard [0] is a formalization of the data
model (and serialization format) of the well-known and
widely-used Prometheus [1] software stack.
The previous stats subsystem of Prosody did not map well to that
format (see e.g. [2] and [3]); the key reason is that it was
trying to do too much math on its own ([2]) while lacking
first-class support for "families" of metrics ([3]) and
structured metric metadata (despite the `extra` argument to
metrics, there was no standard way of representing common things
like "tags" or "labels").
Even though OpenMetrics has grown from the Prometheus world of
monitoring, it maps well to other popular monitoring stacks
such as:
- InfluxDB (labels can be mapped to tags and fields as necessary)
- Carbon/Graphite (labels can be attached to the metric name with
dot-separation)
- StatsD (see graphite when assuming that graphite is used as
backend, which is the default)
The util.statsd module has been ported to use the OpenMetrics
model as a proof of concept. An implementation which exposes
the util.statistics backend data as Prometheus metrics is
ready for publishing in prosody-modules (most likely as
mod_openmetrics_prometheus to avoid breaking existing 0.11
deployments).
At the same time, the previous measure()-based API had one major
advantage: It is really simple and easy to use without requiring
lots of knowledge about OpenMetrics or similar concepts. For that
reason as well as compatibility with existing code, it is preserved
and may even be extended in the future.
However, code relying on the `stats-updated` event as well as
`get_stats` from `statsmanager` will break because the data
model has changed completely; in case of `stats-updated`, the
code will simply not run (as the event was renamed in order
to avoid conflicts); the `get_stats` function has been removed
completely (so it will cause a traceback when it is attempted
to be used).
Note that the measure_*_event methods have been removed from
the module API. I was unable to find any uses or documentation
and thus deemed they should not be ported. Re-implementation is
possible when necessary.
[0]: https://openmetrics.io/
[1]: https://prometheus.io/
[2]: #959
[3]: #960
|
| | |
| |
| |
| |
| |
| |
| | |
Should fix a traceback on attempted use after destruction, in case where
opportunistic_writes was in use.
Thanks Ge0rG
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
When set, no periodic statistics collection is done by
core.statsmanager, instead some module is expected to call collect()
when it suits. Obviously only one such module should be enabled.
Quoth jonas’
> correct way is to scrape the internal sources on each call to /metrics
> in the context of Prometheus
"manual" as opposed to "automatic", from the point of view of
statsmanager.
|
| | |
| |
| |
| |
| |
| |
| |
| |
| | |
Zash> Btw, this conditional and loop, shouldn't it be covered by the timing measurement?
Zash> Isn't that where all the util.statistics work is done?
MattJ> Yeah, it should
Zash> ("the", but there's two ... which one‽)
MattJ> Yeah... not sure :)
MattJ> Processing I guess
|
| | |
| |
| |
| | |
Gone with s2sout.lib in 756b8821007a
|
| | | |
|
| | |
| |
| |
| |
| |
| |
| |
| | |
Should prevent errors in certain places where it logs
session.direction captialized using gsub.
Might cause bugs tho, but then the session is destroyed so maybe it
doesn't matter?
|
| | |
| |
| |
| | |
To highlight how many these are
|
| | |
| |
| |
| |
| |
| |
| | |
Thanks to debacle for reminding me, in the context of mod_auth_ccert
I wonder if we still need lsec_ignore_purpose, Let's Encrypt seems to
include both client and server purposes in certs.
|
| | |
| |
| |
| |
| | |
The path doesn't include lua version, at least least on Debian, which
still has luarocks 2.x
|
| | |
| |
| |
| |
| | |
Happens if run outside prosody. Noticed because because the storage
tests fail.
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
:get_directory has so far returned the base directory of the current
module source code. This has worked well so far to load resources which
tend to be included in the same directory, but with the plugin installer
using LuaRocks, extra resources (e.g. templates and other assets) these
are saved in a completely different directory.
In be73df6765b9 core.modulemanager gained some code for finding that
directory and saving it in module.resource_path but now the question is
how this should be reflected in the API.
A survey of community modules suggest the vast majority use the
:get_directory method for locating templates and other assets, rather
than the code (which would use module:require instead).
Therefore this commit changes :get_directory to return the resource_path
when available. This should work for most modules.
|
| | | |
|
| | | |
|
| | |
| |
| |
| |
| |
| |
| | |
Extra non-code files included with a `copy_directories` directive in a
LuaRocks manifest will be copied into a per-module and per-version
directory under /lib/luarocks/ and all this is there to dig that out so
it can be used in e.g. moduleapi :load_resource().
|
| | | |
|
| | | |
|
| | | |
|
| |\| |
|
| | |
| |
| |
| |
| |
| |
| | |
This makes
`prosodyctl cert import example.com /path/to/example.com/fullchain.pem`
work. This was never intended to, yet users commonly tried this and got
problems.
|
| | |
| |
| |
| |
| |
| | |
#1233)
(grafted from 42a3e3a2824822cef7640ac56d182c59bdd4224e)
|
| | | |
|
| | |
| |
| |
| |
| | |
Unclear exactly why, but replies to some queries to local modules would
be discarded by stanza_router. This appears to fix it.
|
| | |
| |
| |
| | |
(fixes #1508)
|
| | | |
|
| | | |
|
| | |
| |
| |
| | |
the latter
|
| | |
| |
| |
| | |
sessions)
|
