aboutsummaryrefslogtreecommitdiffstats
path: root/plugins
Commit message (Collapse)AuthorAgeFilesLines
* mod_s2s_auth_dane_in: DANE support for s2sinKim Alvefur2023-11-011-0/+114
| | | | | Complements the DANE support for outgoing connections included in net.connect
* mod_bosh: Include stream attributes in stream-features eventMatthew Wild2023-10-281-1/+1
| | | | | This matches what mod_c2s does, and fixes a traceback in mod_sasl2_fast when used with BOSH (that module tries to use event.stream.from).
* mod_saslauth: Clear 'auto' from endpoint hash var, it's not a real hash ↵Matthew Wild2023-10-261-0/+1
| | | | (thanks tmolitor)
* mod_saslauth, mod_c2s: Disable tls-server-end-point channel binding by defaultMatthew Wild2023-10-262-14/+23
| | | | | | | | | | | | | | | | | | | | | | This channel binding method is now enabled when a hash is manually set in the config, or it attempts to discover the hash automatically if the value is the special string "auto". A related change to mod_c2s prevents complicated certificate lookups in the client connection hot path - this work now happens only when this channel binding method is used. I'm not aware of anything else that uses ssl_cfg (vs ssl_ctx). Rationale for disabling by default: - Minor performance impact in automatic cert detection - This method is weak against a leaked/stolen private key (other methods such as 'tls-exporter' would not be compromised in such a case) Rationale for keeping the implementation: - For some deployments, this may be the only method available (e.g. due to TLS offloading in another process/server).
* mod_saslauth: Fix traceback in tls-server-end-point channel bindingMatthew Wild2023-10-261-3/+8
|
* mod_admin_shell: Make 'Role' column dynamically sizedKim Alvefur2023-10-261-1/+1
| | | | | | | Some of the new roles don't quite fit nicely into 4 characters (excluding ellipsis). Given the ability to dynamically add additional roles from the config and possibly from modules, it seems better to just make it a relative size since we can't know how long they will be.
* mod_saslauth: Actively close cert file after readingMatthew Wild2023-10-241-0/+1
| | | | Explicit > implicit
* mod_saslauth: Fix read format string (thanks tmolitor)Matthew Wild2023-10-241-1/+1
|
* mod_cron: Make task frequencies configurable in overly generic mannerKim Alvefur2023-10-221-5/+4
| | | | Requested feature for many modules, notably MAM and file sharing.
* mod_saslauth: Get correct 'tls-server-end-point' with new LuaSec APIKim Alvefur2022-10-231-12/+15
| | | | | | MattJ contributed new APIs for retrieving the actually used certificate and chain to LuaSec, which are not in a release at the time of this commit.
* mod_c2s: Add session.ssl_cfg/ssl_ctx for direct TLS connectionsMatthew Wild2022-09-071-0/+8
|
* mod_saslauth: Derive hash from certificate per tls-server-end-pointKim Alvefur2021-06-291-0/+34
| | | | | | | | | | | This originally used a WIP implementation of cert:sigalg(), a method to retrieve certificate signature algorithm, but it was never submitted upstream. https://github.com/Zash/luasec/tree/zash/sigalg cert:getsignaturename() was merged in https://github.com/brunoos/luasec/commit/de393417b7c7566caf1e0a0ad54132942ac4f049 XEP-0440 v0.3.0 made implementing tls-server-end-point a MUST
* mod_saslauth: Support tls-server-end-point via manually specified hashKim Alvefur2020-12-071-0/+13
| | | | | | | | Since this channel binding method is said to enable TLS offloading then you need tell Prosody the hash (or the full cert), so this seems like a good start. Support is RECOMMENDED in XEP-0440 version 0.2
* mod_tokenauth: Set name/description on cleanup jobKim Alvefur2023-10-211-1/+1
|
* mod_tokenauth: Save grant after removing expired tokensKim Alvefur2023-10-211-0/+5
| | | | Ensures the periodic cleanup really does remove expired tokens.
* mod_tokenauth: Periodically clear out expired tokens and grantsKim Alvefur2023-10-091-0/+6
| | | | This should ensure expired grants eventually disappear.
* mod_tokenauth: Delete grants without tokens after periodKim Alvefur2023-10-161-0/+8
| | | | | | | | | | Generally it is expected that a grant would have at least one token as long as the grant is in active use. Refresh tokens issued by mod_http_oauth2 have a lifetime of one week by default, so the idea here is that if that refresh token expired and another week goes by without the grant being used, then the whole grant can be removed.
* mod_tokenauth: Clear expired tokens on grant retrievalKim Alvefur2023-10-091-1/+8
|
* mod_tokenauth: Delete grants in the wrong formats on retrievalKim Alvefur2023-10-091-0/+5
|
* mod_cron: Remove unused import [luacheck]Kim Alvefur2023-10-151-1/+0
| | | | Use of datetime was removed in 6ac5ad578565
* Merge 0.12->trunkKim Alvefur2023-10-151-1/+1
|\
| * mod_muc_mam: Improve wording of enable settingKim Alvefur2023-10-151-1/+1
| | | | | | | | | | | | | | | | Suggested by jstein in the chat This option label is used by XMPP clients to explain what the option does. a) The user should know where the data is archived. b) The user needs a statement that can be enabled/disabled by the variable. A question would have the wrong logic here.
* | mod_http_file_share: Retrieve stored total in async-friendly wayKim Alvefur2023-10-141-2/+2
| | | | | | | | Does this run in a thread?
* | mod_cron: Load last task run time inside task runner to fix asyncKim Alvefur2023-10-141-10/+28
| | | | | | | | | | This ensures that all interactions with storage happen inside an async thread, allowing async waiting to be performed in storage drivers.
* | mod_cron: Revert bbd3ac65640dKim Alvefur2023-07-301-4/+0
| | | | | | | | | | | | | | Maybe it is better to run daily and weekly tasks 'now' on the theory that people set these things up during times that are appropriate for maintenance already, so the same time next day or next week might be fine for periodic cleanup.
* | mod_storage_internal: Don't report error when attempting to trim empty archiveKim Alvefur2023-10-081-1/+7
| | | | | | | | Fixes "Could not delete messages for room 'x': (nil)"
* | mod_storage_internal: Fix fast trimming of archive with exactly one itemKim Alvefur2023-09-241-0/+7
| | | | | | | | | | | | | | | | | | This method would previously never delete the first (and only) item since it works out which item should become the first item after the trim operation, which doesn't make sense when all should be removed. This also works as an optimization for when all the last item should be trimmed, thus items should be removed.
* | mod_http_file_share: Switch to the new authz API (BC)Kim Alvefur2023-09-161-1/+3
| | | | | | | | | | | | | | | | | | Behavior change: It becomes up to the authorization module whether to allow requests. The default, mod_authz_internal, will allow users on the *parent* host only, breaking use by some components. Remaining question is whether to deprecate the `http_file_share_access` setting or leave as a way to complement/bypass access control?
* | mod_s2s: Fix reporting of DANE mismatchKim Alvefur2023-08-051-1/+3
| | | | | | | | | | | | Thought it was a case mismatch at first, fixed that, but it changed nothing because the error was in the leaf part of the errors, not the chain part.
* | mod_http: Generate URL from configuration in prosodyctlKim Alvefur2023-07-261-0/+31
| | | | | | | | | | | | This removes the need to configure e.g. http_external_url or similar settings in order to get correct URLs out of prosodyctl, as the API depends on portmanager to know the actual ports that are used.
* | mod_tokenauth: Fix revoking a single token without revoking whole grantKim Alvefur2023-07-231-4/+18
| | | | | | | | | | | | This appears to have been a copy-paste of the grant revocation function, or maybe the other way around. Either way, it deleted the whole grant instead of the individual token as might be expected.
* | mod_storage_sql: Spell out missing dependenciesKim Alvefur2023-07-221-3/+16
| | | | | | | | | | Using util.dependencies appeared to cause problems with running tests in Busted, so this also removes that and uses pcall directly.
* | mod_storage_sql: Pass variables as arguments instead of upvaluesKim Alvefur2023-07-221-10/+5
| | | | | | | | | | Probably a workaround for the lack of argument passing when using xpcall in Lua 5.1, no longer relevant.
* | mod_muc: Use enum config API for 'restrict_room_creation'Kim Alvefur2023-07-211-1/+1
| | | | | | | | | | | | This communicates the accepted values in case the config diverges from them. Note that older documentation used an "admin" value behaving like an alias to true, but this is no longer handled. Should it?
* | plugins: Use get_option_array for some list shaped optionsKim Alvefur2023-07-212-2/+2
| | | | | | | | | | Passing something from module:get_option() to ipairs() suggests that the option is a list of some sort.
* | plugins: Handle how get_option_period returns "never"Kim Alvefur2023-07-213-4/+4
| |
* | plugins: Use boolean config method in some placesKim Alvefur2023-07-183-9/+7
| | | | | | | | Because it makes sense and improves feedback via logging
* | mod_storage_internal: Use integer option method for cache sizeKim Alvefur2023-07-181-1/+1
| | | | | | | | Missed this one in previous sweep
* | mod_muc_mam: Use period option methodKim Alvefur2023-07-181-13/+3
| |
* | mod_muc: Use enum option method for 'muc_room_default_presence_broadcast'Kim Alvefur2023-07-181-1/+2
| |
* | mod_storage_xep0227: Use enum option methodKim Alvefur2023-07-181-1/+1
| |
* | mod_auth_ldap: Use enum option methodKim Alvefur2023-07-181-2/+2
| |
* | mod_storage_sql: Use integer config option for cache sizeKim Alvefur2023-07-181-1/+1
| | | | | | | | Missed this one, was probably only looking for get_option_number
* | mod_storage_sql: Use config enum for 'sqlite_tune'Kim Alvefur2023-07-181-1/+1
| |
* | mod_storage_sql: Allow higher precision timestamps in SQLite3Kim Alvefur2023-07-171-1/+5
| | | | | | | | Since it doesn't actually do strict typing :)
* | mod_http: Fix passing minimum limits in wrong argument positionKim Alvefur2023-07-171-2/+2
| |
* | plugins: Use integer config API with interval specification where sensibleKim Alvefur2023-07-1726-47/+48
| | | | | | | | | | | | | | Many of these fall into a few categories: - util.cache size, must be >= 1 - byte or item counts that logically can't be negative - port numbers that should be in 1..0xffff
* | plugins: Switch to :get_option_period() for time range optionsKim Alvefur2023-07-1618-38/+24
| | | | | | | | Improves readability ("1 day" vs 86400) and centralizes validation.
* | plugins: Use get_option_enum where appropriateKim Alvefur2021-01-165-8/+11
| |
* | mod_storage_sql: Remove completed TODO (testing UPSERT on PostgreSQL)Kim Alvefur2023-07-121-1/+0
| |
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-25 00:00:50 +0000