From 4776abee1d5e0367840e4bd7ef2d8fbde86cdd01 Mon Sep 17 00:00:00 2001 From: Matthew Wild Date: Sat, 11 Dec 2010 22:34:29 +0000 Subject: util.stanza: Change get_error() to return nil rather than '' for no text --- util/stanza.lua | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'util') diff --git a/util/stanza.lua b/util/stanza.lua index 307a858a..16d558af 100644 --- a/util/stanza.lua +++ b/util/stanza.lua @@ -254,7 +254,7 @@ function stanza_mt.get_error(stanza) end end end - return type, condition or "undefined-condition", text or ""; + return type, condition or "undefined-condition", text; end function stanza_mt.__add(s1, s2) -- cgit v1.2.3 From 49298b499e5018526c6b95b3d81585bfe5cb710f Mon Sep 17 00:00:00 2001 From: Kim Alvefur Date: Sun, 12 Dec 2010 02:03:32 +0100 Subject: core.s2smanager, mod_console, mod_saslauth, util.certverification: rename util.certverification to util.x509 --- util/certverification.lua | 211 ---------------------------------------------- util/x509.lua | 211 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 211 insertions(+), 211 deletions(-) delete mode 100644 util/certverification.lua create mode 100644 util/x509.lua (limited to 'util') diff --git a/util/certverification.lua b/util/certverification.lua deleted file mode 100644 index d323f4b4..00000000 --- a/util/certverification.lua +++ /dev/null @@ -1,211 +0,0 @@ --- Prosody IM --- Copyright (C) 2010 Matthew Wild --- Copyright (C) 2010 Paul Aurich --- --- This project is MIT/X11 licensed. Please see the --- COPYING file in the source package for more information. --- - --- TODO: I feel a fair amount of this logic should be integrated into Luasec, --- so that everyone isn't re-inventing the wheel. Dependencies on --- IDN libraries complicate that. - - --- [TLS-CERTS] - http://tools.ietf.org/html/draft-saintandre-tls-server-id-check-10 --- [XMPP-CORE] - http://tools.ietf.org/html/draft-ietf-xmpp-3920bis-18 --- [SRV-ID] - http://tools.ietf.org/html/rfc4985 --- [IDNA] - http://tools.ietf.org/html/rfc5890 --- [LDAP] - http://tools.ietf.org/html/rfc4519 --- [PKIX] - http://tools.ietf.org/html/rfc5280 - -local nameprep = require "util.encodings".stringprep.nameprep; -local idna_to_ascii = require "util.encodings".idna.to_ascii; -local log = require "util.logger".init("certverification"); - -module "certverification" - -local oid_commonname = "2.5.4.3"; -- [LDAP] 2.3 -local oid_subjectaltname = "2.5.29.17"; -- [PKIX] 4.2.1.6 -local oid_xmppaddr = "1.3.6.1.5.5.7.8.5"; -- [XMPP-CORE] -local oid_dnssrv = "1.3.6.1.5.5.7.8.7"; -- [SRV-ID] - --- Compare a hostname (possibly international) with asserted names --- extracted from a certificate. --- This function follows the rules laid out in --- sections 4.4.1 and 4.4.2 of [TLS-CERTS] --- --- A wildcard ("*") all by itself is allowed only as the left-most label -local function compare_dnsname(host, asserted_names) - -- TODO: Sufficient normalization? Review relevant specs. - local norm_host = idna_to_ascii(host) - if norm_host == nil then - log("info", "Host %s failed IDNA ToASCII operation", host) - return false - end - - norm_host = norm_host:lower() - - local host_chopped = norm_host:gsub("^[^.]+%.", "") -- everything after the first label - - for i=1,#asserted_names do - local name = asserted_names[i] - if norm_host == name:lower() then - log("debug", "Cert dNSName %s matched hostname", name); - return true - end - - -- Allow the left most label to be a "*" - if name:match("^%*%.") then - local rest_name = name:gsub("^[^.]+%.", "") - if host_chopped == rest_name:lower() then - log("debug", "Cert dNSName %s matched hostname", name); - return true - end - end - end - - return false -end - --- Compare an XMPP domain name with the asserted id-on-xmppAddr --- identities extracted from a certificate. Both are UTF8 strings. --- --- Per [XMPP-CORE], matches against asserted identities don't include --- wildcards, so we just do a normalize on both and then a string comparison --- --- TODO: Support for full JIDs? -local function compare_xmppaddr(host, asserted_names) - local norm_host = nameprep(host) - - for i=1,#asserted_names do - local name = asserted_names[i] - - -- We only want to match against bare domains right now, not - -- those crazy full-er JIDs. - if name:match("[@/]") then - log("debug", "Ignoring xmppAddr %s because it's not a bare domain", name) - else - local norm_name = nameprep(name) - if norm_name == nil then - log("info", "Ignoring xmppAddr %s, failed nameprep!", name) - else - if norm_host == norm_name then - log("debug", "Cert xmppAddr %s matched hostname", name) - return true - end - end - end - end - - return false -end - --- Compare a host + service against the asserted id-on-dnsSRV (SRV-ID) --- identities extracted from a certificate. --- --- Per [SRV-ID], the asserted identities will be encoded in ASCII via ToASCII. --- Comparison is done case-insensitively, and a wildcard ("*") all by itself --- is allowed only as the left-most non-service label. -local function compare_srvname(host, service, asserted_names) - local norm_host = idna_to_ascii(host) - if norm_host == nil then - log("info", "Host %s failed IDNA ToASCII operation", host); - return false - end - - -- Service names start with a "_" - if service:match("^_") == nil then service = "_"..service end - - norm_host = norm_host:lower(); - local host_chopped = norm_host:gsub("^[^.]+%.", "") -- everything after the first label - - for i=1,#asserted_names do - local asserted_service, name = asserted_names[i]:match("^(_[^.]+)%.(.*)"); - if service == asserted_service then - if norm_host == name:lower() then - log("debug", "Cert SRVName %s matched hostname", name); - return true; - end - - -- Allow the left most label to be a "*" - if name:match("^%*%.") then - local rest_name = name:gsub("^[^.]+%.", "") - if host_chopped == rest_name:lower() then - log("debug", "Cert SRVName %s matched hostname", name) - return true - end - end - if norm_host == name:lower() then - log("debug", "Cert SRVName %s matched hostname", name); - return true - end - end - end - - return false -end - -function verify_identity(host, service, cert) - local ext = cert:extensions() - if ext[oid_subjectaltname] then - local sans = ext[oid_subjectaltname]; - - -- Per [TLS-CERTS] 4.3, 4.4.4, "a client MUST NOT seek a match for a - -- reference identifier if the presented identifiers include a DNS-ID - -- SRV-ID, URI-ID, or any application-specific identifier types" - local had_supported_altnames = false - - if sans[oid_xmppaddr] then - had_supported_altnames = true - if compare_xmppaddr(host, sans[oid_xmppaddr]) then return true end - end - - if sans[oid_dnssrv] then - had_supported_altnames = true - -- Only check srvNames if the caller specified a service - if service and compare_srvname(host, service, sans[oid_dnssrv]) then return true end - end - - if sans["dNSName"] then - had_supported_altnames = true - if compare_dnsname(host, sans["dNSName"]) then return true end - end - - -- We don't need URIs, but [TLS-CERTS] is clear. - if sans["uniformResourceIdentifier"] then - had_supported_altnames = true - end - - if had_supported_altnames then return false end - end - - -- Extract a common name from the certificate, and check it as if it were - -- a dNSName subjectAltName (wildcards may apply for, and receive, - -- cat treats) - -- - -- Per [TLS-CERTS] 1.5, a CN-ID is the Common Name from a cert subject - -- which has one and only one Common Name - local subject = cert:subject() - local cn = nil - for i=1,#subject do - local dn = subject[i] - if dn["oid"] == oid_commonname then - if cn then - log("info", "Certificate has multiple common names") - return false - end - - cn = dn["value"]; - end - end - - if cn then - -- Per [TLS-CERTS] 4.4.4, follow the comparison rules for dNSName SANs. - return compare_dnsname(host, { cn }) - end - - -- If all else fails, well, why should we be any different? - return false -end - -return _M; diff --git a/util/x509.lua b/util/x509.lua new file mode 100644 index 00000000..d323f4b4 --- /dev/null +++ b/util/x509.lua @@ -0,0 +1,211 @@ +-- Prosody IM +-- Copyright (C) 2010 Matthew Wild +-- Copyright (C) 2010 Paul Aurich +-- +-- This project is MIT/X11 licensed. Please see the +-- COPYING file in the source package for more information. +-- + +-- TODO: I feel a fair amount of this logic should be integrated into Luasec, +-- so that everyone isn't re-inventing the wheel. Dependencies on +-- IDN libraries complicate that. + + +-- [TLS-CERTS] - http://tools.ietf.org/html/draft-saintandre-tls-server-id-check-10 +-- [XMPP-CORE] - http://tools.ietf.org/html/draft-ietf-xmpp-3920bis-18 +-- [SRV-ID] - http://tools.ietf.org/html/rfc4985 +-- [IDNA] - http://tools.ietf.org/html/rfc5890 +-- [LDAP] - http://tools.ietf.org/html/rfc4519 +-- [PKIX] - http://tools.ietf.org/html/rfc5280 + +local nameprep = require "util.encodings".stringprep.nameprep; +local idna_to_ascii = require "util.encodings".idna.to_ascii; +local log = require "util.logger".init("certverification"); + +module "certverification" + +local oid_commonname = "2.5.4.3"; -- [LDAP] 2.3 +local oid_subjectaltname = "2.5.29.17"; -- [PKIX] 4.2.1.6 +local oid_xmppaddr = "1.3.6.1.5.5.7.8.5"; -- [XMPP-CORE] +local oid_dnssrv = "1.3.6.1.5.5.7.8.7"; -- [SRV-ID] + +-- Compare a hostname (possibly international) with asserted names +-- extracted from a certificate. +-- This function follows the rules laid out in +-- sections 4.4.1 and 4.4.2 of [TLS-CERTS] +-- +-- A wildcard ("*") all by itself is allowed only as the left-most label +local function compare_dnsname(host, asserted_names) + -- TODO: Sufficient normalization? Review relevant specs. + local norm_host = idna_to_ascii(host) + if norm_host == nil then + log("info", "Host %s failed IDNA ToASCII operation", host) + return false + end + + norm_host = norm_host:lower() + + local host_chopped = norm_host:gsub("^[^.]+%.", "") -- everything after the first label + + for i=1,#asserted_names do + local name = asserted_names[i] + if norm_host == name:lower() then + log("debug", "Cert dNSName %s matched hostname", name); + return true + end + + -- Allow the left most label to be a "*" + if name:match("^%*%.") then + local rest_name = name:gsub("^[^.]+%.", "") + if host_chopped == rest_name:lower() then + log("debug", "Cert dNSName %s matched hostname", name); + return true + end + end + end + + return false +end + +-- Compare an XMPP domain name with the asserted id-on-xmppAddr +-- identities extracted from a certificate. Both are UTF8 strings. +-- +-- Per [XMPP-CORE], matches against asserted identities don't include +-- wildcards, so we just do a normalize on both and then a string comparison +-- +-- TODO: Support for full JIDs? +local function compare_xmppaddr(host, asserted_names) + local norm_host = nameprep(host) + + for i=1,#asserted_names do + local name = asserted_names[i] + + -- We only want to match against bare domains right now, not + -- those crazy full-er JIDs. + if name:match("[@/]") then + log("debug", "Ignoring xmppAddr %s because it's not a bare domain", name) + else + local norm_name = nameprep(name) + if norm_name == nil then + log("info", "Ignoring xmppAddr %s, failed nameprep!", name) + else + if norm_host == norm_name then + log("debug", "Cert xmppAddr %s matched hostname", name) + return true + end + end + end + end + + return false +end + +-- Compare a host + service against the asserted id-on-dnsSRV (SRV-ID) +-- identities extracted from a certificate. +-- +-- Per [SRV-ID], the asserted identities will be encoded in ASCII via ToASCII. +-- Comparison is done case-insensitively, and a wildcard ("*") all by itself +-- is allowed only as the left-most non-service label. +local function compare_srvname(host, service, asserted_names) + local norm_host = idna_to_ascii(host) + if norm_host == nil then + log("info", "Host %s failed IDNA ToASCII operation", host); + return false + end + + -- Service names start with a "_" + if service:match("^_") == nil then service = "_"..service end + + norm_host = norm_host:lower(); + local host_chopped = norm_host:gsub("^[^.]+%.", "") -- everything after the first label + + for i=1,#asserted_names do + local asserted_service, name = asserted_names[i]:match("^(_[^.]+)%.(.*)"); + if service == asserted_service then + if norm_host == name:lower() then + log("debug", "Cert SRVName %s matched hostname", name); + return true; + end + + -- Allow the left most label to be a "*" + if name:match("^%*%.") then + local rest_name = name:gsub("^[^.]+%.", "") + if host_chopped == rest_name:lower() then + log("debug", "Cert SRVName %s matched hostname", name) + return true + end + end + if norm_host == name:lower() then + log("debug", "Cert SRVName %s matched hostname", name); + return true + end + end + end + + return false +end + +function verify_identity(host, service, cert) + local ext = cert:extensions() + if ext[oid_subjectaltname] then + local sans = ext[oid_subjectaltname]; + + -- Per [TLS-CERTS] 4.3, 4.4.4, "a client MUST NOT seek a match for a + -- reference identifier if the presented identifiers include a DNS-ID + -- SRV-ID, URI-ID, or any application-specific identifier types" + local had_supported_altnames = false + + if sans[oid_xmppaddr] then + had_supported_altnames = true + if compare_xmppaddr(host, sans[oid_xmppaddr]) then return true end + end + + if sans[oid_dnssrv] then + had_supported_altnames = true + -- Only check srvNames if the caller specified a service + if service and compare_srvname(host, service, sans[oid_dnssrv]) then return true end + end + + if sans["dNSName"] then + had_supported_altnames = true + if compare_dnsname(host, sans["dNSName"]) then return true end + end + + -- We don't need URIs, but [TLS-CERTS] is clear. + if sans["uniformResourceIdentifier"] then + had_supported_altnames = true + end + + if had_supported_altnames then return false end + end + + -- Extract a common name from the certificate, and check it as if it were + -- a dNSName subjectAltName (wildcards may apply for, and receive, + -- cat treats) + -- + -- Per [TLS-CERTS] 1.5, a CN-ID is the Common Name from a cert subject + -- which has one and only one Common Name + local subject = cert:subject() + local cn = nil + for i=1,#subject do + local dn = subject[i] + if dn["oid"] == oid_commonname then + if cn then + log("info", "Certificate has multiple common names") + return false + end + + cn = dn["value"]; + end + end + + if cn then + -- Per [TLS-CERTS] 4.4.4, follow the comparison rules for dNSName SANs. + return compare_dnsname(host, { cn }) + end + + -- If all else fails, well, why should we be any different? + return false +end + +return _M; -- cgit v1.2.3 From 0c43b50b88d382a49dfec55b2f5cbe5fa673077a Mon Sep 17 00:00:00 2001 From: Waqas Hussain Date: Sun, 12 Dec 2010 06:25:54 +0500 Subject: util.x509: "certverification" -> "x509". --- util/x509.lua | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'util') diff --git a/util/x509.lua b/util/x509.lua index d323f4b4..11f231a0 100644 --- a/util/x509.lua +++ b/util/x509.lua @@ -20,9 +20,9 @@ local nameprep = require "util.encodings".stringprep.nameprep; local idna_to_ascii = require "util.encodings".idna.to_ascii; -local log = require "util.logger".init("certverification"); +local log = require "util.logger".init("x509"); -module "certverification" +module "x509" local oid_commonname = "2.5.4.3"; -- [LDAP] 2.3 local oid_subjectaltname = "2.5.29.17"; -- [PKIX] 4.2.1.6 -- cgit v1.2.3 From 31cd341b7da2df0966ea76d04f67eeb410a3b5cb Mon Sep 17 00:00:00 2001 From: Waqas Hussain Date: Sun, 12 Dec 2010 06:29:19 +0500 Subject: util.serialization: Implemented deserialize(). --- util/serialization.lua | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) (limited to 'util') diff --git a/util/serialization.lua b/util/serialization.lua index bad2fe43..474b5d65 100644 --- a/util/serialization.lua +++ b/util/serialization.lua @@ -15,6 +15,10 @@ local error = error; local pairs = pairs; local next = next; +local loadstring = loadstring; +local setfenv = setfenv; +local pcall = pcall; + local debug_traceback = debug.traceback; local log = require "util.logger".init("serialization"); module "serialization" @@ -72,7 +76,14 @@ function serialize(o) end function deserialize(str) - error("Not implemented"); + if type(str) ~= "string" then return nil; end + str = "return "..str; + local f, err = loadstring(str, "@data"); + if not f then return nil, err; end + setfenv(f, {}); + local success, ret = pcall(f); + if not success then return nil, ret; end + return ret; end return _M; -- cgit v1.2.3 From de4152ae6df819fea2bc68ff73301d9b85b3a708 Mon Sep 17 00:00:00 2001 From: Waqas Hussain Date: Mon, 13 Dec 2010 20:45:08 +0500 Subject: util.serialization: Proper serialization of Infinity, -Infinity and NaN. --- util/serialization.lua | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'util') diff --git a/util/serialization.lua b/util/serialization.lua index 474b5d65..e193b64f 100644 --- a/util/serialization.lua +++ b/util/serialization.lua @@ -28,14 +28,20 @@ local indent = function(i) end local function basicSerialize (o) if type(o) == "number" or type(o) == "boolean" then - return tostring(o); + -- no need to check for NaN, as that's not a valid table index + if o == 1/0 then return "(1/0)"; + elseif o == -1/0 then return "(-1/0)"; + else return tostring(o); end else -- assume it is a string -- FIXME make sure it's a string. throw an error otherwise. return (("%q"):format(tostring(o)):gsub("\\\n", "\\n")); end end local function _simplesave(o, ind, t, func) if type(o) == "number" then - func(t, tostring(o)); + if o ~= o then func(t, "(0/0)"); + elseif o == 1/0 then func(t, "(1/0)"); + elseif o == -1/0 then func(t, "(-1/0)"); + else func(t, tostring(o)); end elseif type(o) == "string" then func(t, (("%q"):format(o):gsub("\\\n", "\\n"))); elseif type(o) == "table" then -- cgit v1.2.3 From a0f4376c7803b5fc4d4fc99e431ac97067d628a7 Mon Sep 17 00:00:00 2001 From: Waqas Hussain Date: Wed, 15 Dec 2010 01:55:13 +0500 Subject: util.termcolours: Added setstyle(str), which works on Windows too. --- util/termcolours.lua | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) (limited to 'util') diff --git a/util/termcolours.lua b/util/termcolours.lua index 4e267bee..df204688 100644 --- a/util/termcolours.lua +++ b/util/termcolours.lua @@ -10,6 +10,14 @@ local t_concat, t_insert = table.concat, table.insert; local char, format = string.char, string.format; local ipairs = ipairs; +local io_write = io.write; + +local windows; +if os.getenv("WINDIR") then + windows = require "util.windows"; +end +local orig_color = windows and windows.get_consolecolor and windows.get_consolecolor(); + module "termcolours" local stylemap = { @@ -19,6 +27,13 @@ local stylemap = { bold = 1, dark = 2, underline = 4, underlined = 4, normal = 0; } +local winstylemap = { + ["0"] = orig_color, -- reset + ["1"] = 7+8, -- bold + ["1;33"] = 2+4+8, -- bold yellow + ["1;31"] = 4+8 -- bold red +} + local fmt_string = char(0x1B).."[%sm%s"..char(0x1B).."[0m"; function getstring(style, text) if style then @@ -39,4 +54,26 @@ function getstyle(...) return t_concat(result, ";"); end +local last = "0"; +function setstyle(style) + style = style or "0"; + if style ~= last then + io_write("\27["..style.."m"); + last = style; + end +end + +if windows then + function setstyle(style) + style = style or "0"; + if style ~= last then + windows.set_consolecolor(winstylemap[style] or orig_color); + last = style; + end + end + if not orig_color then + function setstyle(style) end + end +end + return _M; -- cgit v1.2.3 From de79d047af80dc7b7310ef987e9c193f26a2167a Mon Sep 17 00:00:00 2001 From: Matthew Wild Date: Fri, 17 Dec 2010 13:23:01 +0000 Subject: util.pubsub: Add service:get_nodes() --- util/pubsub.lua | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'util') diff --git a/util/pubsub.lua b/util/pubsub.lua index 02e845e1..811f4a15 100644 --- a/util/pubsub.lua +++ b/util/pubsub.lua @@ -77,4 +77,8 @@ function service:get(node, actor, id) end end +function service:get_nodes(actor) + return true, self.nodes; +end + return _M; -- cgit v1.2.3