aboutsummaryrefslogtreecommitdiffstats
path: root/plugins
Commit message (Collapse)AuthorAgeFilesLines
...
* | mod_tls: pass target hostname to starttlsJonas Schäfer2021-09-171-1/+1
| | | | | | | | In case the network backend needs it for outgoing SNI or something.
* | mod_tls: tell network backend to stop reading while preparing TLSJonas Schäfer2022-04-021-0/+7
| |
* | mod_tls: Do not offer TLS if the connection is considered secureJonas Schäfer2021-09-171-0/+3
| | | | | | | | | | | | | | | | | | | | This may be necessary if the session.conn object is not exchanged by the network backend when establishing TLS. In that case, the starttls method will always exist and thus that is not a good indicator for offering TLS. However, the secure bit already tells us that TLS has been established or is not to be established on the connection, so we use that instead.
* | net: isolate LuaSec-specificsJonas Schäfer2022-04-275-23/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | For this, various accessor functions are now provided directly on the sockets, which reach down into the LuaSec implementation to obtain the information. While this may seem of little gain at first, it hides the implementation detail of the LuaSec+LuaSocket combination that the actual socket and the TLS layer are separate objects. The net gain here is that an alternative implementation does not have to emulate that specific implementation detail and "only" has to expose LuaSec-compatible data structures on the new functions.
* | Merge 0.12->trunkMatthew Wild2022-04-251-0/+11
|\|
| * mod_s2s: Improve robustness of outgoing s2s certificate verificationMatthew Wild2022-04-251-0/+11
| | | | | | | | | | | | | | | | | | This change ensures we have positively verified the certificates of the server we are connecting to before marking the session as authenticated. It protects against situations where the verify-or-close stage of the connection was interrupted (e.g. due to an uncaught error). Thanks to Zash for discovery and testing.
* | mod_s2s: Distinguish DANE TLSA errors from generic cert chain errorsKim Alvefur2022-04-251-0/+2
| | | | | | | | | | | | Otherwise it would just report "is not trusted" unless you inspect the logs. This message is sent to to the remote server, and will hopefully show up in their logs, allowing the admin to fix their DANE setup.
* | mod_s2s: Recognise and report errors with CA or intermediate certsKim Alvefur2022-04-251-0/+8
| | | | | | | | | | Should be invoked for cases such as when the Let's Encrypt intermediate certificate expired not too long ago.
* | mod_smacks: Improve activation of smacks on outgoing s2sKim Alvefur2022-04-241-21/+16
| | | | | | | | | | | | | | | | | | Using a timer was a hack to get around that stream features are not available at the right time and sendq stanzas were stored as strings so could not be counted properly. The later has now been fixed and the former is fixed by recording the relevant stream feature on the session so that the correct version of XEP-0198 can be activated once the connection has been authenticated and is ready to start.
* | mod_admin_shell: Add watch:stanzas() commandMatthew Wild2022-03-231-0/+38
| |
* | mod_debug_stanzas/watcher: New module library to dynamically 'watch' for stanzasMatthew Wild2022-03-231-0/+220
| |
* | mod_s2s: Store real stanzas in session.sendq, rather than stringsMatthew Wild2022-03-231-19/+13
| | | | | | | | | | | | | | | | | | | | | | | | This is the "right" thing to do. Strings were more memory-efficient, but e.g. bypassed stanza filters at reconnection time. Also not being stanzas prevents us from potential future work, such as merging sendq with mod_smacks. Regarding performance: we should counter the probable negative effect of this change with other positive changes that are desired anyway - e.g. a limit on the size of the sendq, improved in-memory representation of stanzas, s2s backoff (e.g. if a remote server is persistently unreachable, cache this failure for a while and don't just keep forever queuing stanzas for it).
* | Merge 0.12->trunkKim Alvefur2022-04-081-3/+1
|\|
| * mod_storage_xep0227: Fix mapping of nodes without explicit configurationKim Alvefur2022-04-081-3/+1
| | | | | | | | | | | | | | Turns out this table was wrong, it's missing some fields which are required and it's 'name', not 'node'. Setting it to the boolean true invokes compatibility behavior in mod_pep which results in the correct default structure.
* | Merge 0.12->trunkKim Alvefur2022-04-081-4/+13
|\|
| * mod_storage_xep0227: Fix conversion of SCRAM into internal format (fix #1741)Kim Alvefur2022-04-081-1/+1
| | | | | | | | | | Looks like this function was a copy of hex_to_base64 without modifying it to do its inverse.
| * mod_storage_xep0227: Support basic listing of PEP nodes in absence of ↵Kim Alvefur2022-03-311-2/+11
| | | | | | | | | | | | pubsub#admin data Allows migrating PEP nodes with default settings
| * mod_storage_xep0227: Improve loggingKim Alvefur2022-03-291-1/+1
| | | | | | | | What were we looking at?
* | Merge 0.12->trunkMatthew Wild2022-04-071-0/+3
|\|
| * mod_storage_xep0227: Handle missing {pubsub#owner}pubsub element (fixes #1740)Matthew Wild2022-04-071-0/+3
| |
* | Merge 0.12->trunkMatthew Wild2022-03-284-13/+38
|\|
| * mod_http (and dependent modules): Make CORS opt-in by default (fixes #1731)Matthew Wild2022-03-284-1/+8
| | | | | | | | | | | | | | | | | | The same-origin policy enforced by browsers is a security measure that should only be turned off when it is safe to do so. It is safe to do so in Prosody's default modules, but people may load third-party modules that are unsafe. Therefore we have flipped the default, so that modules must explicitly opt in to having CORS headers added on their requests.
| * mod_http: Reintroduce support for disabling or limiting CORS (fixes #1730)Matthew Wild2022-03-281-13/+31
| | | | | | | | | | This is far better than pre-0.12, because we now have a universal way to configure and enable/disable CORS on a per-module basis.
* | Merge 0.12->trunkMatthew Wild2022-03-282-12/+46
|\|
| * mod_tombstones: Add caching to improve performance on busy servers (fixes #1728)Matthew Wild2022-03-281-11/+42
| |
| * mod_turn_external: Update status and friendlier handling of missing secret ↵Matthew Wild2022-03-281-1/+4
| | | | | | | | option (fixes #1727)
* | Merge 0.12->trunkMatthew Wild2022-03-241-4/+5
|\|
| * MUC: Allow kicking users with the same affiliation as the kicker (fixes #1724)Matthew Wild2022-03-231-4/+5
| | | | | | | | | | | | | | | | | | | | This is allowed by XEP-0045, which states: "A moderator SHOULD NOT be allowed to revoke moderation privileges from someone with a higher affiliation than themselves (i.e., an unaffiliated moderator SHOULD NOT be allowed to revoke moderation privileges from an admin or an owner, and an admin SHOULD NOT be allowed to revoke moderation privileges from an owner)."
* | Merge 0.12->trunkKim Alvefur2022-03-231-2/+2
|\|
| * mod_external_services: Move error message to correct place (fix #1725)Kim Alvefur2022-03-231-2/+2
| | | | | | | | | | This message was misplaced in c4599a7c534c when the @type and @host check was introduced.
* | mod_adhoc: Simplify variable referencesKim Alvefur2022-03-221-2/+2
| | | | | | | | Since commands[node] was already stored in a local a few lines up
* | adhoc: Include stanza and origin in adhoc event dataKim Alvefur2017-03-061-0/+2
| | | | | | | | | | This allows easier access to these, which could be useful for all sorts of reasons
* | Merge 0.12->trunkMatthew Wild2022-03-211-1/+1
|\|
| * mod_pubsub: Don't attempt to use server actor as publisher (fixes #1723)Matthew Wild2022-03-211-1/+1
| |
* | Merge 0.12->trunkMatthew Wild2022-03-191-2/+10
|\|
| * mod_admin_socket: Improve error reporting when socket can't be created ↵Matthew Wild2022-03-191-2/+10
| | | | | | | | (fixes #1719)
* | Merge 0.12->trunkMatthew Wild2022-03-192-0/+10
|\|
| * mod_admin_socket: Comment on LuaSocket UNIX compat codeKim Alvefur2022-03-161-0/+6
| | | | | | | | Ref #1717
| * mod_admin_socket: Compat for luasocket prior to unix datagram supportKim Alvefur2022-03-151-0/+3
| | | | | | | | | | | | | | | | | | | | The "socket.unix" module exported only a function before https://github.com/lunarmodules/luasocket/commit/aa1b8cc9bc35e56de15eeb153c899e4c51de82a8 when datagram support was added. Fixes #1717 Thanks rsc and lucas for reporting and testing
| * mod_invites_register: Push invitee contact entry to inviterKim Alvefur2022-03-151-0/+1
| | | | | | | | | | | | | | | | | | Invitee would not show up in the roster of the invite creator unless they fetch their roster afterwards. Fixes #1715 Thanks gerald
* | mod_admin_shell: Add watch:log() command to tail logs in realtimeMatthew Wild2022-03-171-0/+21
| |
* | mod_admin_shell: Add session.is_connected() methodMatthew Wild2022-03-171-0/+3
| |
* | mod_admin_shell: Add session.write() method to write data to client with no \nMatthew Wild2022-03-171-2/+5
|/
* spelling: non-existing mistakes (thanks timeless)0.12.0Kim Alvefur2022-03-071-1/+1
|
* Spelling: Fix various spelling mistakes (thanks timeless)Kim Alvefur2022-03-072-3/+3
| | | | | | Words, sometimes I wonder how they even work Maybe I missed something.
* Merge config-updates+check-turn from timberMatthew Wild2022-03-049-12/+12
|\
| * util.hex: Deprecate to/from in favour of encode/decode, for consistency!Matthew Wild2022-03-042-3/+3
| |
| * usermanager, mod_saslauth: Default to internal_hashed if no auth module ↵Matthew Wild2022-02-101-1/+1
| | | | | | | | | | | | | | | | | | | | specified The default config was updated in this way long ago, but if no option was present in the config, Prosody would load internal_plain. This change can result in changes (for the better) for people using very old configuration files lacking an 'authentication' setting.
| * various: Require encryption by default for realKim Alvefur2021-12-255-6/+6
| | | | | | | | | | | | | | | | | | These options have been specified (and enabled) in the default config file for a long time. However if unspecified in the config, they were not enabled. Now they are. This may result in a change of behaviour for people using very old config files that lack the require_encryption options. But that's what we want.
| * mod_invites_register: Default to require encryptionMatthew Wild2022-02-101-1/+1
| | | | | | | | In line with the Prosody-wide default change for 0.12.
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-01 17:05:32 +0000