| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
|
|
| |
To avoid every user of the library needing to add and verify expiry info, this
is now handled by util.jwt itself (if not overridden or disabled).
Issuing tokens that are valid forever is bad practice and rarely desired, and
the default token lifetime is now 3600s (1 hour).
|
| |
|
|
| |
Except 'none'. Not implementing that one.
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
| |
In many cases code will be either signing or verifying. With asymmetric
algorithms it's clearer and more efficient to just state that once, instead of
passing keys (and possibly other parameters) with every sign/verify call.
This also allows earlier validation of the key used.
The previous (HS256-only) sign/verify methods continue to be exposed for
backwards-compatibility.
|
| |
|
|
|
|
|
|
|
|
|
|
| |
PASETO provides an alternative to JWT with the promise of fewer implementation
pitfalls. The v4.public algorithm allows asymmetric cryptographically-verified
token issuance and validation.
In summary, such tokens can be issued by one party and securely verified by
any other party independently using the public key of the issuer. This has a
number of potential applications in a decentralized network and ecosystem such
as XMPP. For example, such tokens could be combined with XEP-0317 to allow
hats to be verified even in the context of a third-party MUC service.
|
| |
|
|
|
| |
Some fiddling is required now in error_reply() to ensure the cursor is in the
same place as before this change (a lot of code apparently uses that feature).
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
| |
Sometimes you only care about a single attribute, but the child tag
itself may be optional, leading to needing `tag and tag.attr.foo` or
`stanza:find("tag@foo")`.
The `:find()` method is fairly complex, so avoiding it for this kind of
simpler use case is a win.
|
| |
|
|
|
|
|
|
| |
No idea why the locals were declared on a line by itself. Perhaps line
length considerations? But saving 6 characters in width by adding a
whole line with 47 characters seems excessive.
This is still within the 150 character limit set by .luacheckrc
|
| |
|
|
|
|
| |
Lua since 5.3 raises a fuss when time functions are handed a number with
a fractional part and the underlying C functions are all based on
integer seconds without support for more precision.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
XEP-0004: Partial forms are handled
XEP-0045: We're already strict with GC 1.0
XEP-0060: Change in semantics wrt 'pubsub#type', but not in code
XEP-0115: No protocol change
XEP-0138: Specification moved to Obsolete
XEP-0163: Editorial only change
XEP-0215: Minor schema change
XEP-0280: Editorial change
XEP-0297: Had the wrong version number
XEP-0106: Note missing piece for version 1.1
XEP-0313: Editorial change
XEP-0363: Editorial clarification, no code change required
XEP-0380: Registry additions, no code change needed
XEP-0384: Not directly supported, only here because people will ask otherwise
XEP-0445: Broken out of XEP-0401
|
| |
|
|
|
|
| |
See https://www.ietf.org/blog/finalizing-ietf-tools-transition/
Already done in various other places.
|
| |
|
|
|
| |
The last missing piece of #1760, otherwise SCRAM-SHA-*-PLUS is not
actually advertised.
|
| |
|
|
|
| |
Added in d278a770eddc avoid having to deal with its absence in Lua 5.1.
No longer needed when Lua 5.1 support is dropped.
|
| | |
|
| |\ |
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
The JSON Schema specification says that schemas are objects or booleans,
and that the 'type' property is optional and can be an array.
This module previously allowed bare type names as schemas and did not
really handle booleans.
It now handles missing 'type' properties and boolean 'true' as a schema.
Objects and arrays are guessed based on the presence of 'properties' or
'items' field.
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
MattJ reported a curious issue where validation did not work as
expected. Primarily that the "type" field was expected to be mandatory,
and thus leaving it out would result in no checks being performed.
This was likely caused by misreading during initial development.
Spent some time testing against
https://github.com/json-schema-org/JSON-Schema-Test-Suite.git and
discovered a multitude of issues, far too many to bother splitting into
separate commits.
More than half of them fail. Many because of features not implemented,
which have been marked NYI. For example, some require deep comparisons
e.g. when objects or arrays are present in enums fields.
Some because of quirks with how Lua differs from JavaScript, e.g. no
distinct array or object types. Tests involving fractional floating
point numbers. We're definitely not going to follow references to remote
resources. Or deal with UTF-16 sillyness. One test asserted that 1.0 is
an integer, where Lua 5.3+ will disagree.
|
| | |
| |
| |
| |
| |
| | |
Part of #1600
Is this module even needed anymore?
|
| | |
| |
| |
| | |
Part of #1600
|
| | | |
|
| | | |
|
| | | |
|
| | |
| |
| |
| | |
For completeness and consistency with set of plain hash functions
|
| |\| |
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Observed problem: When shutting down prosody would immediately exit
after waiting for s2s connections to close, skipping the last cleanup
events and reporting the exit reason and code.
This happens because prosody.main_thread is in a waiting state and
queuing startup.shutdown is dispatched trough the main loop via
nexttick, but since the main loop was no longer running at that point it
proceeded to the end of the prosody script and exited there.
|
| | | |
|
| | | |
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
When this module was written, it wasn't possible to cancel or reschedule a
timer. Times have changed, and we should take advantage of those new methods.
This module becomes a very thin wrapper around util.timer now, but I'd argue
it's still a very common and useful concept/abstraction to have around.
Possible API change: this removes the 'last_reset' field of the watchdog. This
was never really intended as a public thing, and I can't find any code that
uses it, so I consider removal to be safe.
|
| | | |
|
| | |
| |
| |
| | |
Don't think we cause any such errors right now, but you never know!
|
| | |
| |
| |
| | |
Silences luacheck warning about the metatable being unused.
|
| | | |
|
| | |
| |
| |
| | |
This lets it adjust the width of tables to the actual terminal width.
|
| |\| |
|
| | |
| |
| |
| |
| |
| |
| | |
This is now done in net.unbound itself
Turning it back on in the config may still cause the problem of entries
there masking the DNS values.
|
| |\| |
|
| | | |
|
| | | |
|
| |\| |
|
| | |
| |
| |
| |
| |
| | |
Fixes #1753
Not known to be used anywhere
|
| |\| |
|
| | |
| |
| |
| |
| | |
Rationale: It seems unlikely that someone who has not configured any
TURN service runs 'prosodyctl check turn' expecting this to be okay.
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
This now requires that the network backend exposes a tls_builder
function, which essentially wraps the former util.sslconfig.new()
function, passing a factory to create the eventual SSL context.
That allows a net.server backend to pick whatever it likes as SSL
context factory, as long as it understands the config table passed by
the SSL config builder. Heck, a backend could even mock and replace the
entire SSL config builder API.
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
For this, various accessor functions are now provided directly on the
sockets, which reach down into the LuaSec implementation to obtain the
information.
While this may seem of little gain at first, it hides the implementation
detail of the LuaSec+LuaSocket combination that the actual socket and
the TLS layer are separate objects.
The net gain here is that an alternative implementation does not have to
emulate that specific implementation detail and "only" has to expose
LuaSec-compatible data structures on the new functions.
|
| |\| |
|
| | |
| |
| |
| |
| |
| | |
The second return value is (not insensibly) assumed to be an error. Instead of
returning a value there in the success case, copy the positional arguments
into the existing opts table.
|
| |\| |
|
