From 0a3f580122c971b7eaddd5d9b97c6c4137023054 Mon Sep 17 00:00:00 2001 From: Kim Alvefur Date: Fri, 7 Jun 2013 20:55:02 +0200 Subject: certmanager: Complain if key or certificate is missing from SSL config. --- core/certmanager.lua | 2 ++ 1 file changed, 2 insertions(+) (limited to 'core/certmanager.lua') diff --git a/core/certmanager.lua b/core/certmanager.lua index 49f445f6..5be328f6 100644 --- a/core/certmanager.lua +++ b/core/certmanager.lua @@ -49,6 +49,8 @@ function create_context(host, mode, user_ssl_config) if not ssl then return nil, "LuaSec (required for encryption) was not found"; end if not user_ssl_config then return nil, "No SSL/TLS configuration present for "..host; end + if not user_ssl_config.key then return nil, "No key present in SSL/TLS configuration for "..host; end + if not user_ssl_config.certificate then return nil, "No certificate present in SSL/TLS configuration for "..host; end local ssl_config = { mode = mode; -- cgit v1.2.3 From 2bf1a784c771c3134c46dab34ff9990acdb9174b Mon Sep 17 00:00:00 2001 From: Kim Alvefur Date: Thu, 13 Jun 2013 17:44:42 +0200 Subject: certmanager: Overhaul of how ssl configs are built. --- core/certmanager.lua | 83 ++++++++++++++++++++++++++++------------------------ 1 file changed, 45 insertions(+), 38 deletions(-) (limited to 'core/certmanager.lua') diff --git a/core/certmanager.lua b/core/certmanager.lua index 5618589b..92b63ec3 100644 --- a/core/certmanager.lua +++ b/core/certmanager.lua @@ -12,6 +12,7 @@ local ssl = ssl; local ssl_newcontext = ssl and ssl.newcontext; local tostring = tostring; +local pairs = pairs; local prosody = prosody; local resolve_path = configmanager.resolve_relative_path; @@ -28,54 +29,60 @@ end module "certmanager" -- Global SSL options if not overridden per-host -local default_ssl_config = configmanager.get("*", "ssl"); -local default_capath = "/etc/ssl/certs"; -local default_verify = (ssl and ssl.x509 and { "peer", "client_once", }) or "none"; -local default_options = { "no_sslv2", luasec_has_noticket and "no_ticket" or nil }; -local default_verifyext = { "lsec_continue", "lsec_ignore_purpose" }; +local global_ssl_config = configmanager.get("*", "ssl"); + +local core_defaults = { + capath = "/etc/ssl/certs"; + protocol = "sslv23"; + verify = (ssl and ssl.x509 and { "peer", "client_once", }) or "none"; + options = { "no_sslv2", luasec_has_noticket and "no_ticket" or nil }; + verifyext = { "lsec_continue", "lsec_ignore_purpose" }; + curve = "secp384r1"; +} +local path_options = { -- These we pass through resolve_path() + key = true, certificate = true, cafile = true, capath = true +} if ssl and not luasec_has_verifyext and ssl.x509 then -- COMPAT mw/luasec-hg - for i=1,#default_verifyext do -- Remove lsec_ prefix - default_verify[#default_verify+1] = default_verifyext[i]:sub(6); + for i=1,#core_defaults.verifyext do -- Remove lsec_ prefix + core_defaults.verify[#core_defaults.verify+1] = core_defaults.verifyext[i]:sub(6); end end -if luasec_has_no_compression and configmanager.get("*", "ssl_compression") ~= true then - default_options[#default_options+1] = "no_compression"; -end -if luasec_has_no_compression then -- Has no_compression? Then it has these too... - default_options[#default_options+1] = "single_dh_use"; - default_options[#default_options+1] = "single_ecdh_use"; +if luasec_has_no_compression and configmanager.get("*", "ssl_compression") ~= true then + core_defaults.options[#core_defaults.options+1] = "no_compression"; end function create_context(host, mode, user_ssl_config) - user_ssl_config = user_ssl_config or default_ssl_config; + user_ssl_config = user_ssl_config or {} + user_ssl_config.mode = mode; if not ssl then return nil, "LuaSec (required for encryption) was not found"; end - if not user_ssl_config then return nil, "No SSL/TLS configuration present for "..host; end + + if global_ssl_config then + for option,default_value in pairs(global_ssl_config) do + if not user_ssl_config[option] then + user_ssl_config[option] = default_value; + end + end + end + for option,default_value in pairs(core_defaults) do + if not user_ssl_config[option] then + user_ssl_config[option] = default_value; + end + end + user_ssl_config.password = user_ssl_config.password or function() log("error", "Encrypted certificate for %s requires 'ssl' 'password' to be set in config", host); end; + for option in pairs(path_options) do + user_ssl_config[option] = user_ssl_config[option] and resolve_path(config_path, user_ssl_config[option]); + end + if not user_ssl_config.key then return nil, "No key present in SSL/TLS configuration for "..host; end if not user_ssl_config.certificate then return nil, "No certificate present in SSL/TLS configuration for "..host; end - - local ssl_config = { - mode = mode; - protocol = user_ssl_config.protocol or "sslv23"; - key = resolve_path(config_path, user_ssl_config.key); - password = user_ssl_config.password or function() log("error", "Encrypted certificate for %s requires 'ssl' 'password' to be set in config", host); end; - certificate = resolve_path(config_path, user_ssl_config.certificate); - capath = resolve_path(config_path, user_ssl_config.capath or default_capath); - cafile = resolve_path(config_path, user_ssl_config.cafile); - verify = user_ssl_config.verify or default_verify; - verifyext = user_ssl_config.verifyext or default_verifyext; - options = user_ssl_config.options or default_options; - depth = user_ssl_config.depth; - curve = user_ssl_config.curve or "secp384r1"; - dhparam = user_ssl_config.dhparam; - }; - - local ctx, err = ssl_newcontext(ssl_config); - - -- LuaSec ignores the cipher list from the config, so we have to take care + + local ctx, err = ssl_newcontext(user_ssl_config); + + -- COMPAT Older LuaSec ignores the cipher list from the config, so we have to take care -- of it ourselves (W/A for #x) if ctx and user_ssl_config.ciphers then local success; @@ -88,9 +95,9 @@ function create_context(host, mode, user_ssl_config) local file = err:match("^error loading (.-) %("); if file then if file == "private key" then - file = ssl_config.key or "your private key"; + file = user_ssl_config.key or "your private key"; elseif file == "certificate" then - file = ssl_config.certificate or "your certificate file"; + file = user_ssl_config.certificate or "your certificate file"; end local reason = err:match("%((.+)%)$") or "some reason"; if reason == "Permission denied" then @@ -113,7 +120,7 @@ function create_context(host, mode, user_ssl_config) end function reload_ssl_config() - default_ssl_config = configmanager.get("*", "ssl"); + global_ssl_config = configmanager.get("*", "ssl"); end prosody.events.add_handler("config-reloaded", reload_ssl_config); -- cgit v1.2.3 From 1d833bb80779ed9c9e1d7ec6c7fab231ebf48182 Mon Sep 17 00:00:00 2001 From: Florian Zeitz Date: Fri, 9 Aug 2013 17:48:21 +0200 Subject: Remove all trailing whitespace --- core/certmanager.lua | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'core/certmanager.lua') diff --git a/core/certmanager.lua b/core/certmanager.lua index dc08cb78..b39f4ed4 100644 --- a/core/certmanager.lua +++ b/core/certmanager.lua @@ -1,7 +1,7 @@ -- Prosody IM -- Copyright (C) 2008-2010 Matthew Wild -- Copyright (C) 2008-2010 Waqas Hussain --- +-- -- This project is MIT/X11 licensed. Please see the -- COPYING file in the source package for more information. -- -- cgit v1.2.3 From 247c7be5c780c54a9f08a20dd1a12e176896bb19 Mon Sep 17 00:00:00 2001 From: Kim Alvefur Date: Tue, 3 Sep 2013 15:43:59 +0200 Subject: certmanager: Allow for specifying the dhparam option as a path to a file instead of a callback --- core/certmanager.lua | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) (limited to 'core/certmanager.lua') diff --git a/core/certmanager.lua b/core/certmanager.lua index b39f4ed4..caa4afce 100644 --- a/core/certmanager.lua +++ b/core/certmanager.lua @@ -13,6 +13,8 @@ local ssl_newcontext = ssl and ssl.newcontext; local tostring = tostring; local pairs = pairs; +local type = type; +local io_open = io.open; local prosody = prosody; local resolve_path = configmanager.resolve_relative_path; @@ -41,7 +43,7 @@ local core_defaults = { ciphers = "HIGH:!DSS:!aNULL@STRENGTH"; } local path_options = { -- These we pass through resolve_path() - key = true, certificate = true, cafile = true, capath = true + key = true, certificate = true, cafile = true, capath = true, dhparam = true } if ssl and not luasec_has_verifyext and ssl.x509 then @@ -75,12 +77,25 @@ function create_context(host, mode, user_ssl_config) end user_ssl_config.password = user_ssl_config.password or function() log("error", "Encrypted certificate for %s requires 'ssl' 'password' to be set in config", host); end; for option in pairs(path_options) do - user_ssl_config[option] = user_ssl_config[option] and resolve_path(config_path, user_ssl_config[option]); + if type(user_ssl_config[option]) == "string" then + user_ssl_config[option] = resolve_path(config_path, user_ssl_config[option]); + end end if not user_ssl_config.key then return nil, "No key present in SSL/TLS configuration for "..host; end if not user_ssl_config.certificate then return nil, "No certificate present in SSL/TLS configuration for "..host; end + -- LuaSec expects dhparam to be a callback that takes two arguments. + -- We ignore those because it is mostly used for having a separate + -- set of params for EXPORT ciphers, which we don't have by default. + if type(user_ssl_config.dhparam) == "string" then + local f, err = io_open(user_ssl_config.dhparam); + if not f then return nil, "Could not open DH parameters: "..err end + local dhparam = f:read("*a"); + f:close(); + user_ssl_config.dhparam = function() return dhparam; end + end + local ctx, err = ssl_newcontext(user_ssl_config); -- COMPAT Older LuaSec ignores the cipher list from the config, so we have to take care -- cgit v1.2.3 From 65931067bf8d24dc78885fabeed2297864ccebde Mon Sep 17 00:00:00 2001 From: Kim Alvefur Date: Tue, 15 Oct 2013 01:37:16 +0200 Subject: certmanager: Add back single_dh_use and single_ecdh_use to default options (Zash breaks, Zash unbreaks) --- core/certmanager.lua | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'core/certmanager.lua') diff --git a/core/certmanager.lua b/core/certmanager.lua index caa4afce..0709c650 100644 --- a/core/certmanager.lua +++ b/core/certmanager.lua @@ -53,8 +53,12 @@ if ssl and not luasec_has_verifyext and ssl.x509 then end end -if luasec_has_no_compression and configmanager.get("*", "ssl_compression") ~= true then - core_defaults.options[#core_defaults.options+1] = "no_compression"; +if luasec_has_no_compression then -- Has no_compression? Then it has these too... + default_options[#default_options+1] = "single_dh_use"; + default_options[#default_options+1] = "single_ecdh_use"; + if configmanager.get("*", "ssl_compression") ~= true then + core_defaults.options[#core_defaults.options+1] = "no_compression"; + end end function create_context(host, mode, user_ssl_config) -- cgit v1.2.3 From 4c2ea20af4ca9ea1136a83863bd9b7d2a8469f3f Mon Sep 17 00:00:00 2001 From: Kim Alvefur Date: Tue, 15 Oct 2013 10:47:34 +0200 Subject: certmanager: Fix. Again. --- core/certmanager.lua | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'core/certmanager.lua') diff --git a/core/certmanager.lua b/core/certmanager.lua index 0709c650..e8030581 100644 --- a/core/certmanager.lua +++ b/core/certmanager.lua @@ -54,8 +54,8 @@ if ssl and not luasec_has_verifyext and ssl.x509 then end if luasec_has_no_compression then -- Has no_compression? Then it has these too... - default_options[#default_options+1] = "single_dh_use"; - default_options[#default_options+1] = "single_ecdh_use"; + core_defaults.options[#core_defaults.options+1] = "single_dh_use"; + core_defaults.options[#core_defaults.options+1] = "single_ecdh_use"; if configmanager.get("*", "ssl_compression") ~= true then core_defaults.options[#core_defaults.options+1] = "no_compression"; end -- cgit v1.2.3